@ironwallet/mcp-server 1.0.1 → 1.0.2

package/README.md

@@ -1,10 +1,10 @@
 # @ironwallet/mcp-server
 
-Local [MCP](https://modelcontextprotocol.io) server for **Ironwallet** (`ironwallet-mcp` bin).
+Local [MCP](https://modelcontextprotocol.io) server for **IronWallet** (`ironwallet-mcp` bin).
 
-The Ironwallet MCP server gives AI agents secure access to a **non-custodial** wallet. Seed phrases stay encrypted on the host and never leave this machine — they never pass through the agent. Agents can retrieve balances, sign locally, transfer tokens, and swap across 10+ networks.
+The IronWallet MCP server gives AI agents secure access to a **non-custodial** wallet. Seed phrases stay encrypted on the host and never leave this machine — they never pass through the agent. Agents can retrieve balances, sign locally, transfer tokens, and swap across 10+ networks.
 
-Seed-compatible with the [Ironwallet](https://ironwallet.io) app.
+Seed-compatible with the [IronWallet](https://ironwallet.io) app.
 
 There is no per-transaction confirmation UI.
 
@@ -47,7 +47,7 @@ The plugin install on [ironwallet.io/ai](https://ironwallet.io/ai) wires this up
 MCP client  →  ironwallet-mcp (stdio)
                     ├── encrypted keystore on disk
                     ├── signs on this machine
-                    └── HTTPS to Ironwallet backends
+                    └── HTTPS to IronWallet backends
 ```
 
 The mnemonic never appears in tool inputs/outputs, logs meant for the agent, or requests to backends / the LLM / the MCP client’s cloud.
@@ -61,14 +61,15 @@ The mnemonic never appears in tool inputs/outputs, logs meant for the agent, or
 | **Networks** | Ethereum, BSC, Polygon, Base, Arbitrum, Optimism, Avalanche, Tron, Bitcoin, Litecoin, Dogecoin, Solana, XRP, TON |
 | **Wallets** | Create, import, list, deposit QR, and back up (local browser for secrets) |
 | **Balances** | Native coins and tokens |
-| **Transfers** | Fee estimate and send through Ironwallet’s transfer relay |
-| **Swaps** | Quotes and execution through Ironwallet **Swap Proxy** |
+| **Transfers** | Fee estimate and send through IronWallet’s transfer relay |
+| **Swaps** | Quotes and execution through IronWallet |
 | **Policy** | Optional per-wallet limits (`readOnly`, `maxPerTx`, transfer recipient allow-list). Applies to `send_transfer` and `execute_swap`. |
 
 ---
 
 ## Tools
 
+<!-- tools-table -->
 | Tool | Purpose | Moves funds? |
 |------|---------|:------------:|
 | `list_wallets` | Names, addresses, and `policy` | no |
@@ -84,6 +85,7 @@ The mnemonic never appears in tool inputs/outputs, logs meant for the agent, or
 | `estimate_swap` | Quote (may expire) | no |
 | `execute_swap` | Fresh quote → sign → swap | **yes** |
 | `get_swap_status` | Poll a swap | no |
+<!-- /tools-table -->
 
 No tool accepts or returns a seed. Import and backup only in the local browser (`open_wallet_manager` / `backup_url`).
 
@@ -107,7 +109,7 @@ The browser page binds to `127.0.0.1` under an unguessable path and shuts down a
 
 ### Swaps
 
-Swaps use **Swap Proxy**, not the transfer relay.
+Swaps are a separate flow from transfers.
 
 1. `list_swap_networks`
 2. `list_swap_assets` (`direction=from`, then `direction=to` with the chosen sell asset)
@@ -129,7 +131,7 @@ Swaps use **Swap Proxy**, not the transfer relay.
 
 ## Configuration
 
-Nothing to paste into MCP config for normal use. On first launch the server writes a relay API key, keystore wrapping secret, and device id under `~/.ironwallet-mcp/` (`keystore-passphrase`, `relay-api-key`, `device-id`, mode `0600`). Set the env vars only to override.
+Nothing to paste into MCP config for normal use. On first launch the server writes a relay API key, keystore wrapping secret, and device id under `~/.ironwallet-mcp/` (`keystore-passphrase`, `relay-api-key`, `device-id`; owner-only POSIX `0600` or NTFS ACL on Windows). Set the env vars only to override.
 
 The user-facing backup is the **recovery phrase** in the wallet manager, not those files.
 

package/dist/api/swap.d.ts

@@ -1,5 +1,5 @@
 /**
- * Swap Proxy (SWP) HTTP client — matches mobile SwapProxyApiClient:
+ * Swap HTTP client — matches the mobile client:
  *   /swp/refs/*  discovery
  *   /swp/exchange/*  estimate → create → execute → status
  *

package/dist/api/swap.js

@@ -1,5 +1,5 @@
 /**
- * Swap Proxy (SWP) HTTP client — matches mobile SwapProxyApiClient:
+ * Swap HTTP client — matches the mobile client:
  *   /swp/refs/*  discovery
  *   /swp/exchange/*  estimate → create → execute → status
  *

package/dist/config.d.ts

@@ -4,15 +4,11 @@
  * generated on first launch. There is no runtime IW_ENV switch — each build
  * embeds one profile via the repo-root `npm run bake`.
  */
+import { type NetworkId } from "./networks.js";
 /** `package.json` version of this package (works from `src/` and compiled `dist/`). */
 export declare function packageVersion(): string;
-/** Canonical network identifiers used across the server. */
-export type NetworkId = "ethereum" | "bsc" | "polygon" | "base" | "arbitrum" | "optimism" | "avalanche" | "tron" | "bitcoin" | "litecoin" | "doge" | "solana" | "ton" | "xrp";
-/** Networks that share the secp256k1 EVM key and signing scheme. */
-export declare const EVM_NETWORKS: NetworkId[];
-/** Non-EVM chains, each with its own curve / address scheme / node API. */
-export declare const NON_EVM_NETWORKS: NetworkId[];
-export declare const ALL_NETWORKS: NetworkId[];
+export type { NetworkId } from "./networks.js";
+export { ALL_NETWORKS, EVM_NETWORKS, NON_EVM_NETWORKS } from "./networks.js";
 /**
  * Networks advertised during challenge login. Kept to the proven EVM+Tron set:
  * the backend authenticates against these public keys and the flow is verified
@@ -22,7 +18,7 @@ export declare const ALL_NETWORKS: NetworkId[];
 export declare const AUTH_NETWORKS: NetworkId[];
 /**
  * Networks whose transfer signing is implemented (send is allowed). All of these
- * go through the Ironwallet relay forward flow (estimate → sign → forward),
+ * go through the IronWallet relay forward flow (estimate → sign → forward),
  * including TON (IR-673 / mobile RelayV2).
  */
 export declare const SIGNABLE_NETWORKS: NetworkId[];
@@ -40,7 +36,7 @@ export declare function relaySegment(network: NetworkId): string;
 export interface Config {
     authUrl: string;
     relayUrl: string;
-    /** Swap Proxy host (`/swp/exchange/*`, `/swp/refs/*`). */
+    /** Swap API host (`/swp/exchange/*`, `/swp/refs/*`). */
     swapProxyUrl: string;
     /** Optional relay API key (x-api-key). Empty string means header is omitted. */
     relayApiKey: string;
@@ -48,11 +44,13 @@ export interface Config {
     appVersion: string;
     /** Device id sent as X-Device-Id. UUID file under the keystore dir unless overridden. */
     deviceId: string;
+    /** Machine fingerprint sent as X-Device-Fingerprint. OS install id + platform, or device-id if that id is missing. */
+    deviceFingerprint: string;
     /** X-Device-Locale value, format: TimeZone=..;Language=..;Region=..; */
     deviceLocale: string;
     /**
-     * JSON for `X-Device-Info`. Swap Proxy requires `systemName`
-     * (e.g. `{"systemName":"iOS","systemVersion":"17.0","model":"iPhone"}`).
+     * JSON for `X-Device-Info`. The swap API keys routing off `systemName`
+     * (`Web` here — this is a desktop MCP, not a phone).
      */
     deviceInfo: string;
     /** Directory holding the encrypted keystore. */
@@ -88,8 +86,10 @@ export interface Config {
     /** When true, `send_transfer` and `execute_swap` are rejected immediately. */
     readOnly: boolean;
 }
+/** Host-honest Web payload. Do not pretend to be iOS/Android. */
+export declare function defaultDeviceInfo(): string;
 export declare function getConfig(): Config;
 /** Reject send/swap when `IW_READ_ONLY` is set. */
 export declare function assertServerWritable(action: "send" | "swap"): void;
-/** Common device-mimicking headers sent to auth, relay, and Swap Proxy. */
+/** Device headers sent to auth, relay, and swap APIs. */
 export declare function commonHeaders(cfg: Config): Record<string, string>;

package/dist/config.js

@@ -5,9 +5,12 @@
  * embeds one profile via the repo-root `npm run bake`.
  */
 import { readFileSync } from "node:fs";
+import { arch, release, type as osType } from "node:os";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { BAKED_ENV } from "./generated/env-config.js";
+import { ALL_NETWORKS, EVM_NETWORKS } from "./networks.js";
+import { resolveDeviceFingerprint } from "./device-fingerprint.js";
 import { resolveDeviceId, resolveKeystoreDir, resolveKeystorePassphrase, resolveRelayApiKey, } from "./local-secrets.js";
 /** `package.json` version of this package (works from `src/` and compiled `dist/`). */
 export function packageVersion() {
@@ -20,27 +23,7 @@ export function packageVersion() {
         return "0.0.0";
     }
 }
-/** Networks that share the secp256k1 EVM key and signing scheme. */
-export const EVM_NETWORKS = [
-    "ethereum",
-    "bsc",
-    "polygon",
-    "base",
-    "arbitrum",
-    "optimism",
-    "avalanche",
-];
-/** Non-EVM chains, each with its own curve / address scheme / node API. */
-export const NON_EVM_NETWORKS = [
-    "tron",
-    "bitcoin",
-    "litecoin",
-    "doge",
-    "solana",
-    "ton",
-    "xrp",
-];
-export const ALL_NETWORKS = [...EVM_NETWORKS, ...NON_EVM_NETWORKS];
+export { ALL_NETWORKS, EVM_NETWORKS, NON_EVM_NETWORKS } from "./networks.js";
 /**
  * Networks advertised during challenge login. Kept to the proven EVM+Tron set:
  * the backend authenticates against these public keys and the flow is verified
@@ -50,7 +33,7 @@ export const ALL_NETWORKS = [...EVM_NETWORKS, ...NON_EVM_NETWORKS];
 export const AUTH_NETWORKS = [...EVM_NETWORKS, "tron"];
 /**
  * Networks whose transfer signing is implemented (send is allowed). All of these
- * go through the Ironwallet relay forward flow (estimate → sign → forward),
+ * go through the IronWallet relay forward flow (estimate → sign → forward),
  * including TON (IR-673 / mobile RelayV2).
  */
 export const SIGNABLE_NETWORKS = [...ALL_NETWORKS];
@@ -106,6 +89,37 @@ function envBool(key, fallback) {
         return fallback;
     return !/^(0|false|off|no)$/i.test(v);
 }
+/** Host-honest Web payload. Do not pretend to be iOS/Android. */
+export function defaultDeviceInfo() {
+    return JSON.stringify({
+        systemName: "Web",
+        systemVersion: packageVersion(),
+        model: "ironwallet-mcp",
+        platform: process.platform,
+        arch: arch(),
+        os: osType(),
+        osRelease: release(),
+    });
+}
+function defaultDeviceLocale() {
+    let timeZone = "UTC";
+    let language = "en";
+    let region = "US";
+    try {
+        const opts = Intl.DateTimeFormat().resolvedOptions();
+        if (opts.timeZone)
+            timeZone = opts.timeZone;
+        const parts = (opts.locale ?? "").split(/[-_]/);
+        if (parts[0])
+            language = parts[0];
+        if (parts[1])
+            region = parts[1];
+    }
+    catch {
+        // keep UTC/en/US
+    }
+    return `TimeZone=${timeZone};Language=${language};Region=${region};`;
+}
 /** Parse an integer env var, clamped to [min, max], falling back on invalid input. */
 function envInt(key, fallback, min, max) {
     const raw = process.env[key];
@@ -130,6 +144,7 @@ export function getConfig() {
     if (cached)
         return cached;
     resolveKeystorePassphrase();
+    const deviceId = resolveDeviceId();
     const profile = BAKED_ENV;
     cached = {
         authUrl: envOr("IW_AUTH_URL", profile.authUrl),
@@ -137,13 +152,10 @@ export function getConfig() {
         swapProxyUrl: envOr("IW_SWAP_PROXY_URL", profile.swapProxyUrl),
         relayApiKey: resolveRelayApiKey(),
         appVersion: envOr("IW_APP_VERSION", `ironwallet-mcp/${packageVersion()}`),
-        deviceId: resolveDeviceId(),
-        deviceLocale: envOr("IW_DEVICE_LOCALE", "TimeZone=UTC;Language=en;Region=US;"),
-        deviceInfo: envOr("IW_DEVICE_INFO", JSON.stringify({
-            systemName: "iOS",
-            systemVersion: "17.0",
-            model: "iPhone",
-        })),
+        deviceId,
+        deviceFingerprint: resolveDeviceFingerprint(deviceId),
+        deviceLocale: envOr("IW_DEVICE_LOCALE", defaultDeviceLocale()),
+        deviceInfo: envOr("IW_DEVICE_INFO", defaultDeviceInfo()),
         keystoreDir: resolveKeystoreDir(),
         evmRpcUrls: resolveEvmRpcUrls(profile.evmRpcUrls),
         tronApiUrl: envOr("IW_TRON_API", profile.tronApiUrl),
@@ -171,15 +183,16 @@ export function assertServerWritable(action) {
         ? "Server is read-only (IW_READ_ONLY); swaps are disabled."
         : "Server is read-only (IW_READ_ONLY); sending is disabled.");
 }
-/** Common device-mimicking headers sent to auth, relay, and Swap Proxy. */
+/** Device headers sent to auth, relay, and swap APIs. */
 export function commonHeaders(cfg) {
     const headers = {
         "x-iwt-cli": cfg.appVersion,
         "X-App-Version": cfg.appVersion,
         "X-Device-Id": cfg.deviceId,
+        "X-Device-Fingerprint": cfg.deviceFingerprint,
         // Backend validates the format: TimeZone=..;Language=..;Region=..;
         "X-Device-Locale": cfg.deviceLocale,
-        // SWP validates UserData.XDeviceInfo — JSON with required `systemName`.
+        // Swap routing reads UserData.XDeviceInfo.systemName (`Web` for this client).
         "X-Device-Info": cfg.deviceInfo,
         "Content-Language": "en",
     };

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAE5B,uFAAuF;AACvF,MAAM,UAAU,cAAc;IAC5B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAClB,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EACvC,IAAI,EACJ,cAAc,CACf,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAyB,CAAC;QAC9E,OAAO,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAmBD,oEAAoE;AACpE,MAAM,CAAC,MAAM,YAAY,GAAgB;IACvC,UAAU;IACV,KAAK;IACL,SAAS;IACT,MAAM;IACN,UAAU;IACV,UAAU;IACV,WAAW;CACZ,CAAC;AAEF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,gBAAgB,GAAgB;IAC3C,MAAM;IACN,SAAS;IACT,UAAU;IACV,MAAM;IACN,QAAQ;IACR,KAAK;IACL,KAAK;CACN,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAgB,CAAC,GAAG,YAAY,EAAE,GAAG,gBAAgB,CAAC,CAAC;AAEhF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAgB,CAAC,GAAG,YAAY,EAAE,MAAM,CAAC,CAAC;AAEpE;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAgB,CAAC,GAAG,YAAY,CAAC,CAAC;AAEhE,MAAM,UAAU,OAAO,CAAC,OAAkB;IACxC,OAAO,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC7C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAgB,YAAY,CAAC,MAAM,CACpE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,MAAM,CACxC,CAAC;AAEF,MAAM,UAAU,OAAO,CAAC,OAAkB;IACxC,OAAO,sBAAsB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAClD,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACtC,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAkB;IAC7C,OAAO,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,aAAa,GAA8B;IAC/C,QAAQ,EAAE,UAAU;IACpB,GAAG,EAAE,KAAK;IACV,OAAO,EAAE,SAAS;IAClB,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,UAAU;IACpB,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;IACtB,IAAI,EAAE,MAAM;IACZ,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,QAAQ;IAChB,GAAG,EAAE,KAAK;IACV,GAAG,EAAE,KAAK;CACX,CAAC;AAEF,MAAM,UAAU,YAAY,CAAC,OAAkB;IAC7C,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC;AAsDD,SAAS,KAAK,CAAC,GAAW,EAAE,QAAgB;IAC1C,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC1C,CAAC;AAED,SAAS,OAAO,CAAC,GAAW,EAAE,QAAiB;IAC7C,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IACjD,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,sFAAsF;AACtF,SAAS,MAAM,CAAC,GAAW,EAAE,QAAgB,EAAE,GAAW,EAAE,GAAW;IACrE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG;QAAE,OAAO,QAAQ,CAAC;IAC1B,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAC;IACzC,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,iBAAiB,CACxB,WAAmC;IAEnC,MAAM,IAAI,GAA2B,EAAE,GAAG,WAAW,EAAE,CAAC;IACxD,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC5D,IAAI,QAAQ;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;IACrC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,IAAI,MAAM,GAAkB,IAAI,CAAC;AAEjC,MAAM,UAAU,SAAS;IACvB,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,yBAAyB,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,SAAS,CAAC;IAC1B,MAAM,GAAG;QACP,OAAO,EAAE,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC;QAC9C,QAAQ,EAAE,KAAK,CAAC,cAAc,EAAE,OAAO,CAAC,QAAQ,CAAC;QACjD,YAAY,EAAE,KAAK,CAAC,mBAAmB,EAAE,OAAO,CAAC,YAAY,CAAC;QAC9D,WAAW,EAAE,kBAAkB,EAAE;QACjC,UAAU,EAAE,KAAK,CAAC,gBAAgB,EAAE,kBAAkB,cAAc,EAAE,EAAE,CAAC;QACzE,QAAQ,EAAE,eAAe,EAAE;QAC3B,YAAY,EAAE,KAAK,CAAC,kBAAkB,EAAE,qCAAqC,CAAC;QAC9E,UAAU,EAAE,KAAK,CACf,gBAAgB,EAChB,IAAI,CAAC,SAAS,CAAC;YACb,UAAU,EAAE,KAAK;YACjB,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,QAAQ;SAChB,CAAC,CACH;QACD,WAAW,EAAE,kBAAkB,EAAE;QACjC,UAAU,EAAE,iBAAiB,CAAC,OAAO,CAAC,UAAU,CAAC;QACjD,UAAU,EAAE,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,UAAU,CAAC;QACpD,aAAa,EAAE,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,aAAa,CAAC;QACzD,cAAc,EAAE,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,cAAc,CAAC;QAC3D,UAAU,EAAE,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,UAAU,CAAC;QACpD,YAAY,EAAE,KAAK,CAAC,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC;QAC1D,SAAS,EAAE,KAAK,CAAC,gBAAgB,EAAE,OAAO,CAAC,SAAS,CAAC;QACrD,SAAS,EAAE,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,SAAS,CAAC;QACjD,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,aAAa,EAAE,MAAM,CAAC,oBAAoB,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC;QAChE,6EAA6E;QAC7E,yEAAyE;QACzE,oBAAoB,EAAE,MAAM,CAAC,4BAA4B,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC;QAC/E,WAAW,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAChD,QAAQ,EAAE,OAAO,CAAC,cAAc,EAAE,KAAK,CAAC;KACzC,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,oBAAoB,CAAC,MAAuB;IAC1D,IAAI,CAAC,SAAS,EAAE,CAAC,QAAQ;QAAE,OAAO;IAClC,MAAM,IAAI,KAAK,CACb,MAAM,KAAK,MAAM;QACf,CAAC,CAAC,yDAAyD;QAC3D,CAAC,CAAC,0DAA0D,CAC/D,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,MAAM,OAAO,GAA2B;QACtC,WAAW,EAAE,GAAG,CAAC,UAAU;QAC3B,eAAe,EAAE,GAAG,CAAC,UAAU;QAC/B,aAAa,EAAE,GAAG,CAAC,QAAQ;QAC3B,mEAAmE;QACnE,iBAAiB,EAAE,GAAG,CAAC,YAAY;QACnC,wEAAwE;QACxE,eAAe,EAAE,GAAG,CAAC,UAAU;QAC/B,kBAAkB,EAAE,IAAI;KACzB,CAAC;IACF,IAAI,GAAG,CAAC,WAAW;QAAE,OAAO,CAAC,WAAW,CAAC,GAAG,GAAG,CAAC,WAAW,CAAC;IAC5D,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,MAAM,EAAE,MAAM,SAAS,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAkB,MAAM,eAAe,CAAC;AAC3E,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAE5B,uFAAuF;AACvF,MAAM,UAAU,cAAc;IAC5B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAClB,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EACvC,IAAI,EACJ,cAAc,CACf,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAyB,CAAC;QAC9E,OAAO,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAGD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAE7E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAgB,CAAC,GAAG,YAAY,EAAE,MAAM,CAAC,CAAC;AAEpE;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAgB,CAAC,GAAG,YAAY,CAAC,CAAC;AAEhE,MAAM,UAAU,OAAO,CAAC,OAAkB;IACxC,OAAO,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC7C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAgB,YAAY,CAAC,MAAM,CACpE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,MAAM,CACxC,CAAC;AAEF,MAAM,UAAU,OAAO,CAAC,OAAkB;IACxC,OAAO,sBAAsB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAClD,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACtC,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAkB;IAC7C,OAAQ,YAAqC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,MAAM,aAAa,GAA8B;IAC/C,QAAQ,EAAE,UAAU;IACpB,GAAG,EAAE,KAAK;IACV,OAAO,EAAE,SAAS;IAClB,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,UAAU;IACpB,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;IACtB,IAAI,EAAE,MAAM;IACZ,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,QAAQ;IAChB,GAAG,EAAE,KAAK;IACV,GAAG,EAAE,KAAK;CACX,CAAC;AAEF,MAAM,UAAU,YAAY,CAAC,OAAkB;IAC7C,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC;AAwDD,SAAS,KAAK,CAAC,GAAW,EAAE,QAAgB;IAC1C,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC1C,CAAC;AAED,SAAS,OAAO,CAAC,GAAW,EAAE,QAAiB;IAC7C,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IACjD,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,iBAAiB;IAC/B,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,UAAU,EAAE,KAAK;QACjB,aAAa,EAAE,cAAc,EAAE;QAC/B,KAAK,EAAE,gBAAgB;QACvB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,IAAI,EAAE,IAAI,EAAE;QACZ,EAAE,EAAE,MAAM,EAAE;QACZ,SAAS,EAAE,OAAO,EAAE;KACrB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB;IAC1B,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE,CAAC;QACrD,IAAI,IAAI,CAAC,QAAQ;YAAE,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC5C,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,KAAK,CAAC,CAAC,CAAC;YAAE,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,KAAK,CAAC,CAAC,CAAC;YAAE,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;IACD,OAAO,YAAY,QAAQ,aAAa,QAAQ,WAAW,MAAM,GAAG,CAAC;AACvE,CAAC;AAED,sFAAsF;AACtF,SAAS,MAAM,CAAC,GAAW,EAAE,QAAgB,EAAE,GAAW,EAAE,GAAW;IACrE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG;QAAE,OAAO,QAAQ,CAAC;IAC1B,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAC;IACzC,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,iBAAiB,CACxB,WAAmC;IAEnC,MAAM,IAAI,GAA2B,EAAE,GAAG,WAAW,EAAE,CAAC;IACxD,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC5D,IAAI,QAAQ;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;IACrC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,IAAI,MAAM,GAAkB,IAAI,CAAC;AAEjC,MAAM,UAAU,SAAS;IACvB,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,yBAAyB,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,SAAS,CAAC;IAC1B,MAAM,GAAG;QACP,OAAO,EAAE,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC;QAC9C,QAAQ,EAAE,KAAK,CAAC,cAAc,EAAE,OAAO,CAAC,QAAQ,CAAC;QACjD,YAAY,EAAE,KAAK,CAAC,mBAAmB,EAAE,OAAO,CAAC,YAAY,CAAC;QAC9D,WAAW,EAAE,kBAAkB,EAAE;QACjC,UAAU,EAAE,KAAK,CAAC,gBAAgB,EAAE,kBAAkB,cAAc,EAAE,EAAE,CAAC;QACzE,QAAQ;QACR,iBAAiB,EAAE,wBAAwB,CAAC,QAAQ,CAAC;QACrD,YAAY,EAAE,KAAK,CAAC,kBAAkB,EAAE,mBAAmB,EAAE,CAAC;QAC9D,UAAU,EAAE,KAAK,CAAC,gBAAgB,EAAE,iBAAiB,EAAE,CAAC;QACxD,WAAW,EAAE,kBAAkB,EAAE;QACjC,UAAU,EAAE,iBAAiB,CAAC,OAAO,CAAC,UAAU,CAAC;QACjD,UAAU,EAAE,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,UAAU,CAAC;QACpD,aAAa,EAAE,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,aAAa,CAAC;QACzD,cAAc,EAAE,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,cAAc,CAAC;QAC3D,UAAU,EAAE,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,UAAU,CAAC;QACpD,YAAY,EAAE,KAAK,CAAC,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC;QAC1D,SAAS,EAAE,KAAK,CAAC,gBAAgB,EAAE,OAAO,CAAC,SAAS,CAAC;QACrD,SAAS,EAAE,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,SAAS,CAAC;QACjD,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,aAAa,EAAE,MAAM,CAAC,oBAAoB,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC;QAChE,6EAA6E;QAC7E,yEAAyE;QACzE,oBAAoB,EAAE,MAAM,CAAC,4BAA4B,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC;QAC/E,WAAW,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAChD,QAAQ,EAAE,OAAO,CAAC,cAAc,EAAE,KAAK,CAAC;KACzC,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,oBAAoB,CAAC,MAAuB;IAC1D,IAAI,CAAC,SAAS,EAAE,CAAC,QAAQ;QAAE,OAAO;IAClC,MAAM,IAAI,KAAK,CACb,MAAM,KAAK,MAAM;QACf,CAAC,CAAC,yDAAyD;QAC3D,CAAC,CAAC,0DAA0D,CAC/D,CAAC;AACJ,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,MAAM,OAAO,GAA2B;QACtC,WAAW,EAAE,GAAG,CAAC,UAAU;QAC3B,eAAe,EAAE,GAAG,CAAC,UAAU;QAC/B,aAAa,EAAE,GAAG,CAAC,QAAQ;QAC3B,sBAAsB,EAAE,GAAG,CAAC,iBAAiB;QAC7C,mEAAmE;QACnE,iBAAiB,EAAE,GAAG,CAAC,YAAY;QACnC,8EAA8E;QAC9E,eAAe,EAAE,GAAG,CAAC,UAAU;QAC/B,kBAAkB,EAAE,IAAI;KACzB,CAAC;IACF,IAAI,GAAG,CAAC,WAAW;QAAE,OAAO,CAAC,WAAW,CAAC,GAAG,GAAG,CAAC,WAAW,CAAC;IAC5D,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/device-fingerprint.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Stable machine fingerprint for `X-Device-Fingerprint`.
+ *
+ * Hashes the OS install id (Linux machine-id, Windows MachineGuid,
+ * macOS IOPlatformUUID) plus platform. If that id is missing, hashes the
+ * local `device-id` UUID instead. Hostname, username, and arch are never
+ * included. Computed in memory only — not written under ~/.ironwallet-mcp/.
+ */
+export declare const FINGERPRINT_VERSION = "v1";
+export declare function parseWindowsMachineGuid(regOutput: string): string | undefined;
+export declare function parseMacPlatformUuid(ioregOutput: string): string | undefined;
+export declare function parseLinuxMachineId(raw: string): string | undefined;
+export declare function formatDeviceFingerprint(parts: {
+    osMachineId?: string;
+    platform: string;
+    fallbackId?: string;
+}): string;
+export declare function resolveDeviceFingerprint(fallbackId?: string): string;

package/dist/device-fingerprint.js

@@ -0,0 +1,81 @@
+/**
+ * Stable machine fingerprint for `X-Device-Fingerprint`.
+ *
+ * Hashes the OS install id (Linux machine-id, Windows MachineGuid,
+ * macOS IOPlatformUUID) plus platform. If that id is missing, hashes the
+ * local `device-id` UUID instead. Hostname, username, and arch are never
+ * included. Computed in memory only — not written under ~/.ironwallet-mcp/.
+ */
+import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+export const FINGERPRINT_VERSION = "v1";
+export function parseWindowsMachineGuid(regOutput) {
+    const match = /MachineGuid\s+REG_SZ\s+([0-9a-fA-F-]{36})/.exec(regOutput);
+    return match?.[1]?.toLowerCase();
+}
+export function parseMacPlatformUuid(ioregOutput) {
+    const match = /"IOPlatformUUID"\s*=\s*"([0-9a-fA-F-]{36})"/.exec(ioregOutput);
+    return match?.[1]?.toLowerCase();
+}
+export function parseLinuxMachineId(raw) {
+    const id = raw.trim().toLowerCase().replace(/[^0-9a-f]/g, "");
+    return id.length >= 16 ? id : undefined;
+}
+export function formatDeviceFingerprint(parts) {
+    const machineId = parts.osMachineId?.trim() ?? "";
+    const fallbackId = parts.fallbackId?.trim() ?? "";
+    const identity = machineId || (fallbackId ? `fallback:${fallbackId}` : "");
+    const material = ["ironwallet-mcp", FINGERPRINT_VERSION, identity, parts.platform].join("|");
+    const digest = createHash("sha256").update(material).digest("hex");
+    return `${FINGERPRINT_VERSION}:${digest}`;
+}
+function readOsMachineId(platform = process.platform) {
+    try {
+        if (platform === "linux") {
+            for (const path of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
+                try {
+                    const id = parseLinuxMachineId(readFileSync(path, "utf8"));
+                    if (id)
+                        return id;
+                }
+                catch {
+                    // try the next path
+                }
+            }
+            return undefined;
+        }
+        if (platform === "win32") {
+            const root = process.env.SystemRoot || process.env.WINDIR || "C:\\Windows";
+            const output = execFileSync(join(root, "System32", "reg.exe"), [
+                "query",
+                "HKLM\\SOFTWARE\\Microsoft\\Cryptography",
+                "/v",
+                "MachineGuid",
+                "/reg:64",
+            ], { windowsHide: true, stdio: ["ignore", "pipe", "pipe"], encoding: "utf8" });
+            return parseWindowsMachineGuid(output);
+        }
+        if (platform === "darwin") {
+            const output = execFileSync("ioreg", ["-rd1", "-c", "IOPlatformExpertDevice"], { stdio: ["ignore", "pipe", "pipe"], encoding: "utf8" });
+            return parseMacPlatformUuid(output);
+        }
+    }
+    catch {
+        return undefined;
+    }
+    return undefined;
+}
+let cached;
+export function resolveDeviceFingerprint(fallbackId) {
+    if (cached)
+        return cached;
+    cached = formatDeviceFingerprint({
+        osMachineId: readOsMachineId(),
+        platform: process.platform,
+        fallbackId,
+    });
+    return cached;
+}
+//# sourceMappingURL=device-fingerprint.js.map

package/dist/device-fingerprint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-fingerprint.js","sourceRoot":"","sources":["../src/device-fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAExC,MAAM,UAAU,uBAAuB,CAAC,SAAiB;IACvD,MAAM,KAAK,GAAG,2CAA2C,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1E,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACtD,MAAM,KAAK,GAAG,6CAA6C,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC9E,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAC9D,OAAO,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAIvC;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAClD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAClD,MAAM,QAAQ,GAAG,SAAS,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7F,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnE,OAAO,GAAG,mBAAmB,IAAI,MAAM,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,eAAe,CAAC,WAA4B,OAAO,CAAC,QAAQ;IACnE,IAAI,CAAC;QACH,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,KAAK,MAAM,IAAI,IAAI,CAAC,iBAAiB,EAAE,0BAA0B,CAAC,EAAE,CAAC;gBACnE,IAAI,CAAC;oBACH,MAAM,EAAE,GAAG,mBAAmB,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;oBAC3D,IAAI,EAAE;wBAAE,OAAO,EAAE,CAAC;gBACpB,CAAC;gBAAC,MAAM,CAAC;oBACP,oBAAoB;gBACtB,CAAC;YACH,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,aAAa,CAAC;YAC3E,MAAM,MAAM,GAAG,YAAY,CACzB,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,CAAC,EACjC;gBACE,OAAO;gBACP,yCAAyC;gBACzC,IAAI;gBACJ,aAAa;gBACb,SAAS;aACV,EACD,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAC3E,CAAC;YACF,OAAO,uBAAuB,CAAC,MAAM,CAAC,CAAC;QACzC,CAAC;QAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,YAAY,CACzB,OAAO,EACP,CAAC,MAAM,EAAE,IAAI,EAAE,wBAAwB,CAAC,EACxC,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CACxD,CAAC;YACF,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,IAAI,MAA0B,CAAC;AAE/B,MAAM,UAAU,wBAAwB,CAAC,UAAmB;IAC1D,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,GAAG,uBAAuB,CAAC;QAC/B,WAAW,EAAE,eAAe,EAAE;QAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU;KACX,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/keystore/store.js

@@ -4,9 +4,10 @@
  * signing; they are never returned to callers of these functions except the
  * local browser wallet manager.
  */
-import { mkdirSync, readFileSync, writeFileSync, existsSync, chmodSync, } from "node:fs";
+import { mkdirSync, readFileSync, writeFileSync, existsSync } from "node:fs";
 import { join } from "node:path";
 import { getConfig } from "../config.js";
+import { restrictPrivateFile } from "../restrict-private-file.js";
 import { encryptSecret, decryptSecret } from "./crypto.js";
 import { deriveAddresses, newMnemonic, isValidMnemonic, } from "../wallet/derive.js";
 import { logDebug, logError, logInfo } from "../log.js";
@@ -41,12 +42,7 @@ function saveKeystore(ks) {
     ensureDir();
     const path = keystorePath();
     writeFileSync(path, JSON.stringify(ks, null, 2), { mode: 0o600 });
-    try {
-        chmodSync(path, 0o600);
-    }
-    catch {
-        // best effort on platforms without POSIX perms
-    }
+    restrictPrivateFile(path);
     logInfo("keystore.save", {
         path,
         walletCount: ks.wallets.length,

package/dist/keystore/store.js.map

@@ -1 +1 @@
-{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/keystore/store.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,SAAS,EACT,YAAY,EACZ,aAAa,EACb,UAAU,EACV,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE3D,OAAO,EACL,eAAe,EACf,WAAW,EACX,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAExD,SAAS,YAAY;IACnB,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,SAAS;IAChB,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC,WAAW,CAAC;IACpC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;IAC5B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,QAAQ,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC;QACnE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACrC,CAAC;IACD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiB,CAAC;IAC/C,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,iCAAiC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,QAAQ,CAAC,eAAe,EAAE;QACxB,IAAI;QACJ,MAAM,EAAE,IAAI;QACZ,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;QAClC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;KACzC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,EAAgB;IACpC,SAAS,EAAE,CAAC;IACZ,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;IAC5B,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,IAAI,CAAC;QACH,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,+CAA+C;IACjD,CAAC;IACD,OAAO,CAAC,eAAe,EAAE;QACvB,IAAI;QACJ,WAAW,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM;QAC9B,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;KACrC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,OAAO,YAAY,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,OAAO,YAAY,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AAC7D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,IAAa;IACxC,MAAM,EAAE,GAAG,YAAY,EAAE,CAAC;IAC1B,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,cAAc,CAAC,CAAC;QAC3D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAClD,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,KAAK,CACb,2BAA2B,EAAE,CAAC,OAAO;SAClC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SAClB,IAAI,CAAC,IAAI,CAAC,mDAAmD,CACjE,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,QAAqB;IACrD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,QAAQ,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;QAAE,CAAC,EAAE,CAAC;IACzC,OAAO,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;AACxB,CAAC;AASD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,KAAa,EACb,UAAkB,EAClB,OAA0D,EAAE;IAE5D,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,CAAC,+BAA+B,EAAE;QACvC,KAAK;QACL,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC;KAC7C,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,YAAY,EAAE,CAAC;IAC1B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,IAAI,QAAQ,CAAC;IAC3C,MAAM,OAAO,GAAoB,EAAE,CAAC;IAEpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,SAAS,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,UAAU,CACrB,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,QAAQ,CAAC,IAAI,GAAG,CAAC,EAAE,EAC1E,QAAQ,CACT,CAAC;QACF,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnB,MAAM,KAAK,GAAgB;YACzB,IAAI;YACJ,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE,UAAU,CAAC;YAC5C,SAAS;YACT,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QACF,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC;YACX,IAAI;YACJ,SAAS;YACT,QAAQ,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;SACrD,CAAC,CAAC;IACL,CAAC;IACD,YAAY,CAAC,EAAE,CAAC,CAAC;IACjB,OAAO,CAAC,4BAA4B,EAAE;QACpC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;KACxE,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,YAAY,CAC1B,QAAgB,EAChB,UAAkB,EAClB,IAAa;IAEb,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,QAAQ,CAAC,sBAAsB,EAAE,IAAI,KAAK,CAAC,0BAA0B,CAAC,EAAE;YACtE,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;QACH,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,EAAE,GAAG,YAAY,EAAE,CAAC;IAC1B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,IAAI,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAgB;QACzB,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC;QAC3C,SAAS;QACT,QAAQ,EAAE,IAAI,EAAE,+BAA+B;QAC/C,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IACF,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvB,YAAY,CAAC,EAAE,CAAC,CAAC;IACjB,OAAO,CAAC,oBAAoB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;IAC9D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AACxC,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,UAAkB;IAC7D,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,cAAc,CAAC,CAAC;IAC3D,OAAO,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAClD,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,cAAc,CAAC,KAAkB,EAAE,UAAkB;IACnE,OAAO,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,KAAkB,EAAE,QAAgB;IAChE,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,MAAM,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;IACtC,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACjB,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;YACnB,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,EAAE,GAAG,YAAY,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7D,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IACpD,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,CAAC,CAAC;IACjB,OAAO,CAAC,yBAAyB,EAAE;QACjC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;KAC7D,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,EAAE,GAAG,YAAY,EAAE,CAAC;IAC1B,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,cAAc,CAAC,CAAC;IAC3D,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;IACtB,YAAY,CAAC,EAAE,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,EAAE,GAAG,YAAY,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IACjC,EAAE,CAAC,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACvD,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,cAAc,CAAC,CAAC;IACjF,YAAY,CAAC,EAAE,CAAC,CAAC;IACjB,OAAO,CAAC,oBAAoB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,MAAoB;IAC1D,MAAM,EAAE,GAAG,YAAY,EAAE,CAAC;IAC1B,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,cAAc,CAAC,CAAC;IAC3D,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,CAAC,CAAC;AACnB,CAAC"}
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/keystore/store.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE3D,OAAO,EACL,eAAe,EACf,WAAW,EACX,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAExD,SAAS,YAAY;IACnB,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,SAAS;IAChB,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC,WAAW,CAAC;IACpC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;IAC5B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,QAAQ,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC;QACnE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACrC,CAAC;IACD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiB,CAAC;IAC/C,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,iCAAiC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,QAAQ,CAAC,eAAe,EAAE;QACxB,IAAI;QACJ,MAAM,EAAE,IAAI;QACZ,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;QAClC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;KACzC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,EAAgB;IACpC,SAAS,EAAE,CAAC;IACZ,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;IAC5B,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC1B,OAAO,CAAC,eAAe,EAAE;QACvB,IAAI;QACJ,WAAW,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM;QAC9B,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;KACrC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,OAAO,YAAY,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,OAAO,YAAY,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AAC7D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,IAAa;IACxC,MAAM,EAAE,GAAG,YAAY,EAAE,CAAC;IAC1B,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,cAAc,CAAC,CAAC;QAC3D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAClD,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,KAAK,CACb,2BAA2B,EAAE,CAAC,OAAO;SAClC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SAClB,IAAI,CAAC,IAAI,CAAC,mDAAmD,CACjE,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,QAAqB;IACrD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,QAAQ,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;QAAE,CAAC,EAAE,CAAC;IACzC,OAAO,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;AACxB,CAAC;AASD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,KAAa,EACb,UAAkB,EAClB,OAA0D,EAAE;IAE5D,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,CAAC,+BAA+B,EAAE;QACvC,KAAK;QACL,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC;KAC7C,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,YAAY,EAAE,CAAC;IAC1B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,IAAI,QAAQ,CAAC;IAC3C,MAAM,OAAO,GAAoB,EAAE,CAAC;IAEpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,SAAS,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,UAAU,CACrB,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,QAAQ,CAAC,IAAI,GAAG,CAAC,EAAE,EAC1E,QAAQ,CACT,CAAC;QACF,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnB,MAAM,KAAK,GAAgB;YACzB,IAAI;YACJ,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE,UAAU,CAAC;YAC5C,SAAS;YACT,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QACF,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC;YACX,IAAI;YACJ,SAAS;YACT,QAAQ,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;SACrD,CAAC,CAAC;IACL,CAAC;IACD,YAAY,CAAC,EAAE,CAAC,CAAC;IACjB,OAAO,CAAC,4BAA4B,EAAE;QACpC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;KACxE,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,YAAY,CAC1B,QAAgB,EAChB,UAAkB,EAClB,IAAa;IAEb,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,QAAQ,CAAC,sBAAsB,EAAE,IAAI,KAAK,CAAC,0BAA0B,CAAC,EAAE;YACtE,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;QACH,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,EAAE,GAAG,YAAY,EAAE,CAAC;IAC1B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,IAAI,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAgB;QACzB,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC;QAC3C,SAAS;QACT,QAAQ,EAAE,IAAI,EAAE,+BAA+B;QAC/C,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IACF,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvB,YAAY,CAAC,EAAE,CAAC,CAAC;IACjB,OAAO,CAAC,oBAAoB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;IAC9D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AACxC,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,UAAkB;IAC7D,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,cAAc,CAAC,CAAC;IAC3D,OAAO,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAClD,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,cAAc,CAAC,KAAkB,EAAE,UAAkB;IACnE,OAAO,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,KAAkB,EAAE,QAAgB;IAChE,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,MAAM,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;IACtC,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACjB,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;YACnB,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,EAAE,GAAG,YAAY,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7D,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IACpD,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,CAAC,CAAC;IACjB,OAAO,CAAC,yBAAyB,EAAE;QACjC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;KAC7D,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,EAAE,GAAG,YAAY,EAAE,CAAC;IAC1B,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,cAAc,CAAC,CAAC;IAC3D,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;IACtB,YAAY,CAAC,EAAE,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,EAAE,GAAG,YAAY,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IACjC,EAAE,CAAC,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACvD,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,cAAc,CAAC,CAAC;IACjF,YAAY,CAAC,EAAE,CAAC,CAAC;IACjB,OAAO,CAAC,oBAAoB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,MAAoB;IAC1D,MAAM,EAAE,GAAG,YAAY,EAAE,CAAC;IAC1B,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,cAAc,CAAC,CAAC;IAC3D,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,CAAC,CAAC;AACnB,CAAC"}

package/dist/local-secrets.d.ts

@@ -1,6 +1,6 @@
 /**
  * Machine-local secrets and install identity. Generated on first use and stored
- * under the keystore directory (0600). Not written to User env, mcp.json, or
+ * under the keystore directory (owner-only). Not written to User env, mcp.json, or
  * the plugin dashboard.
  *
  * Env vars still win when set to a real value. Unexpanded `${VAR}` placeholders
@@ -8,7 +8,7 @@
  */
 export declare function resolveKeystoreDir(): string;
 export declare function isUnsetSecret(value: string | undefined): boolean;
-/** x-api-key for Relay / Swap Proxy. UUID, stable per machine directory. */
+/** x-api-key for relay and swap APIs. UUID, stable per machine directory. */
 export declare function resolveRelayApiKey(): string;
 /** Keystore wrapping secret. Not the recovery phrase. */
 export declare function resolveKeystorePassphrase(): string;

package/dist/local-secrets.js

@@ -1,14 +1,15 @@
 /**
  * Machine-local secrets and install identity. Generated on first use and stored
- * under the keystore directory (0600). Not written to User env, mcp.json, or
+ * under the keystore directory (owner-only). Not written to User env, mcp.json, or
  * the plugin dashboard.
  *
  * Env vars still win when set to a real value. Unexpanded `${VAR}` placeholders
  * (Claude Code when the shell var is missing) are treated as unset.
  */
-import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync, } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { randomBytes, randomUUID } from "node:crypto";
+import { restrictPrivateFile } from "./restrict-private-file.js";
 const RELAY_KEY_FILE = "relay-api-key";
 const PASSPHRASE_FILE = "keystore-passphrase";
 const DEVICE_ID_FILE = "device-id";
@@ -41,15 +42,10 @@ function readOrCreate(filename, generate) {
     }
     const value = generate();
     writeFileSync(path, `${value}\n`, { mode: 0o600 });
-    try {
-        chmodSync(path, 0o600);
-    }
-    catch {
-        // best effort on platforms without POSIX perms
-    }
+    restrictPrivateFile(path);
     return value;
 }
-/** x-api-key for Relay / Swap Proxy. UUID, stable per machine directory. */
+/** x-api-key for relay and swap APIs. UUID, stable per machine directory. */
 export function resolveRelayApiKey() {
     const fromEnv = process.env.IW_RELAY_API_KEY;
     if (!isUnsetSecret(fromEnv))

package/dist/local-secrets.js.map

@@ -1 +1 @@
-{"version":3,"file":"local-secrets.js","sourceRoot":"","sources":["../src/local-secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,YAAY,EACZ,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEtD,MAAM,cAAc,GAAG,eAAe,CAAC;AACvC,MAAM,eAAe,GAAG,qBAAqB,CAAC;AAC9C,MAAM,cAAc,GAAG,WAAW,CAAC;AAEnC,MAAM,UAAU,kBAAkB;IAChC,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IACpE,MAAM,IAAI,GACR,OAAO,CAAC,GAAG,CAAC,IAAI;QAChB,OAAO,CAAC,GAAG,CAAC,WAAW;QACvB,OAAO,CAAC,GAAG,CAAC,QAAQ;QACpB,GAAG,CAAC;IACN,OAAO,GAAG,IAAI,kBAAkB,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAyB;IACrD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,gCAAgC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB,EAAE,QAAsB;IAC5D,MAAM,GAAG,GAAG,kBAAkB,EAAE,CAAC;IACjC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACjC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACnD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;YAAE,OAAO,QAAQ,CAAC;IACvE,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;IACzB,aAAa,CAAC,IAAI,EAAE,GAAG,KAAK,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,IAAI,CAAC;QACH,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,+CAA+C;IACjD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,kBAAkB;IAChC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC7C,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;QAAE,OAAO,OAAQ,CAAC,IAAI,EAAE,CAAC;IACpD,OAAO,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,yBAAyB;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IAC1C,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;QAAE,OAAO,OAAQ,CAAC,IAAI,EAAE,CAAC;IACpD,OAAO,YAAY,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,eAAe;IAC7B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IACzC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;QAAE,OAAO,OAAQ,CAAC,IAAI,EAAE,CAAC;IACpD,OAAO,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;AAC1D,CAAC"}
+{"version":3,"file":"local-secrets.js","sourceRoot":"","sources":["../src/local-secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,MAAM,cAAc,GAAG,eAAe,CAAC;AACvC,MAAM,eAAe,GAAG,qBAAqB,CAAC;AAC9C,MAAM,cAAc,GAAG,WAAW,CAAC;AAEnC,MAAM,UAAU,kBAAkB;IAChC,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IACpE,MAAM,IAAI,GACR,OAAO,CAAC,GAAG,CAAC,IAAI;QAChB,OAAO,CAAC,GAAG,CAAC,WAAW;QACvB,OAAO,CAAC,GAAG,CAAC,QAAQ;QACpB,GAAG,CAAC;IACN,OAAO,GAAG,IAAI,kBAAkB,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAyB;IACrD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,gCAAgC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB,EAAE,QAAsB;IAC5D,MAAM,GAAG,GAAG,kBAAkB,EAAE,CAAC;IACjC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACjC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACnD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;YAAE,OAAO,QAAQ,CAAC;IACvE,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;IACzB,aAAa,CAAC,IAAI,EAAE,GAAG,KAAK,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC1B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,kBAAkB;IAChC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC7C,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;QAAE,OAAO,OAAQ,CAAC,IAAI,EAAE,CAAC;IACpD,OAAO,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,yBAAyB;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IAC1C,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;QAAE,OAAO,OAAQ,CAAC,IAAI,EAAE,CAAC;IACpD,OAAO,YAAY,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,eAAe;IAC7B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IACzC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;QAAE,OAAO,OAAQ,CAAC,IAAI,EAAE,CAAC;IACpD,OAAO,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;AAC1D,CAAC"}

package/dist/networks.d.ts

@@ -0,0 +1,5 @@
+/** Canonical network identifiers used across the server. No baked env. */
+export declare const EVM_NETWORKS: readonly ["ethereum", "bsc", "polygon", "base", "arbitrum", "optimism", "avalanche"];
+export declare const NON_EVM_NETWORKS: readonly ["tron", "bitcoin", "litecoin", "doge", "solana", "ton", "xrp"];
+export declare const ALL_NETWORKS: readonly ["ethereum", "bsc", "polygon", "base", "arbitrum", "optimism", "avalanche", "tron", "bitcoin", "litecoin", "doge", "solana", "ton", "xrp"];
+export type NetworkId = (typeof ALL_NETWORKS)[number];

package/dist/networks.js

@@ -0,0 +1,21 @@
+/** Canonical network identifiers used across the server. No baked env. */
+export const EVM_NETWORKS = [
+    "ethereum",
+    "bsc",
+    "polygon",
+    "base",
+    "arbitrum",
+    "optimism",
+    "avalanche",
+];
+export const NON_EVM_NETWORKS = [
+    "tron",
+    "bitcoin",
+    "litecoin",
+    "doge",
+    "solana",
+    "ton",
+    "xrp",
+];
+export const ALL_NETWORKS = [...EVM_NETWORKS, ...NON_EVM_NETWORKS];
+//# sourceMappingURL=networks.js.map

package/dist/networks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"networks.js","sourceRoot":"","sources":["../src/networks.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAE1E,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,UAAU;IACV,KAAK;IACL,SAAS;IACT,MAAM;IACN,UAAU;IACV,UAAU;IACV,WAAW;CACH,CAAC;AAEX,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,MAAM;IACN,SAAS;IACT,UAAU;IACV,MAAM;IACN,QAAQ;IACR,KAAK;IACL,KAAK;CACG,CAAC;AAEX,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAG,YAAY,EAAE,GAAG,gBAAgB,CAAU,CAAC"}

package/dist/restrict-private-file.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Owner-only access for files under ~/.ironwallet-mcp/.
+ * POSIX: chmod 0600. Windows: NTFS ACL via icacls (chmod is a no-op there).
+ * Best-effort: a failed chmod/icacls must not block keystore or secret writes.
+ */
+export declare function windowsIcaclsPath(systemRoot?: string | undefined): string;
+export declare function windowsIcaclsArgs(filePath: string, username: string): string[];
+export declare function resolveWindowsUsername(osUsername?: string | undefined, envUsername?: string | undefined): string;
+export declare function restrictPrivateFile(filePath: string): void;