@ironwallet/mcp-server 1.0.1 → 1.0.3

package/README.md

@@ -1,10 +1,10 @@
 # @ironwallet/mcp-server
 
-Local [MCP](https://modelcontextprotocol.io) server for **Ironwallet** (`ironwallet-mcp` bin).
+Local [MCP](https://modelcontextprotocol.io) server for **IronWallet** (`ironwallet-mcp` bin).
 
-The Ironwallet MCP server gives AI agents secure access to a **non-custodial** wallet. Seed phrases stay encrypted on the host and never leave this machine — they never pass through the agent. Agents can retrieve balances, sign locally, transfer tokens, and swap across 10+ networks.
+The IronWallet MCP server gives AI agents secure access to a **non-custodial** wallet. Seed phrases stay encrypted on the host and never leave this machine — they never pass through the agent. Agents can retrieve balances, sign locally, transfer tokens, and swap across 10+ networks.
 
-Seed-compatible with the [Ironwallet](https://ironwallet.io) app.
+Seed-compatible with the [IronWallet](https://ironwallet.io) app.
 
 There is no per-transaction confirmation UI.
 
@@ -47,7 +47,7 @@ The plugin install on [ironwallet.io/ai](https://ironwallet.io/ai) wires this up
 MCP client  →  ironwallet-mcp (stdio)
                     ├── encrypted keystore on disk
                     ├── signs on this machine
-                    └── HTTPS to Ironwallet backends
+                    └── HTTPS to IronWallet backends
 ```
 
 The mnemonic never appears in tool inputs/outputs, logs meant for the agent, or requests to backends / the LLM / the MCP client’s cloud.
@@ -61,19 +61,22 @@ The mnemonic never appears in tool inputs/outputs, logs meant for the agent, or
 | **Networks** | Ethereum, BSC, Polygon, Base, Arbitrum, Optimism, Avalanche, Tron, Bitcoin, Litecoin, Dogecoin, Solana, XRP, TON |
 | **Wallets** | Create, import, list, deposit QR, and back up (local browser for secrets) |
 | **Balances** | Native coins and tokens |
-| **Transfers** | Fee estimate and send through Ironwallet’s transfer relay |
-| **Swaps** | Quotes and execution through Ironwallet **Swap Proxy** |
-| **Policy** | Optional per-wallet limits (`readOnly`, `maxPerTx`, transfer recipient allow-list). Applies to `send_transfer` and `execute_swap`. |
+| **Transfers** | Fee estimate and send through IronWallet’s transfer relay |
+| **Swaps** | Quotes and execution through IronWallet |
+| **Policy** | Optional per-wallet limits (`readOnly`, `maxPerTxUsd`, transfer recipient allow-list) set via `set_wallet_policy`. Applies to `send_transfer` and `execute_swap`. |
 
 ---
 
 ## Tools
 
+<!-- tools-table -->
 | Tool | Purpose | Moves funds? |
 |------|---------|:------------:|
 | `list_wallets` | Names, addresses, and `policy` | no |
+| `accept_mcp_consent` | Record chat acceptance of the MCP disclaimer | no |
 | `create_wallets` | New wallets; returns a browser `backup_url` | no |
 | `open_wallet_manager` | Local browser UI to import / create / back up | no |
+| `set_wallet_policy` | Replace per-wallet limits (`readOnly`, `maxPerTxUsd`, allow-list) | no |
 | `get_deposit_qr` | PNG QR (try chat; else local `qr_url`) | no |
 | `get_balance` | Native or token balance | no |
 | `estimate_transfer` | Fee estimate, no broadcast | no |
@@ -84,6 +87,7 @@ The mnemonic never appears in tool inputs/outputs, logs meant for the agent, or
 | `estimate_swap` | Quote (may expire) | no |
 | `execute_swap` | Fresh quote → sign → swap | **yes** |
 | `get_swap_status` | Poll a swap | no |
+<!-- /tools-table -->
 
 No tool accepts or returns a seed. Import and backup only in the local browser (`open_wallet_manager` / `backup_url`).
 
@@ -107,7 +111,7 @@ The browser page binds to `127.0.0.1` under an unguessable path and shuts down a
 
 ### Swaps
 
-Swaps use **Swap Proxy**, not the transfer relay.
+Swaps are a separate flow from transfers.
 
 1. `list_swap_networks`
 2. `list_swap_assets` (`direction=from`, then `direction=to` with the chosen sell asset)
@@ -123,13 +127,13 @@ Swaps use **Swap Proxy**, not the transfer relay.
 **Operational notes**
 
 - Quotes expire. Prefer `execute_swap` (fresh quote). If execute times out, **poll status** before retrying — do not blindly re-run execute.
-- Wallet policy: `readOnly` blocks sends and swaps. `maxPerTx` applies to the transfer amount or the corrected swap sell amount. A transfer recipient allow-list also blocks swaps (the swap router is not a whitelisted destination).
+- Wallet policy: `readOnly` blocks sends and swaps. `maxPerTxUsd` values the transfer amount (or the corrected swap sell amount) in USD at operation time via IronWallet backend rates; when no rate is available the operation is rejected (fail closed). The recipient allow-list applies to `send_transfer`. `set_wallet_policy` replaces the whole policy — read `list_wallets.policy` first.
 
 ---
 
 ## Configuration
 
-Nothing to paste into MCP config for normal use. On first launch the server writes a relay API key, keystore wrapping secret, and device id under `~/.ironwallet-mcp/` (`keystore-passphrase`, `relay-api-key`, `device-id`, mode `0600`). Set the env vars only to override.
+Nothing to paste into MCP config for normal use. On first launch the server writes a relay API key, keystore wrapping secret, and device id under `~/.ironwallet-mcp/` (`keystore-passphrase`, `relay-api-key`, `device-id`; owner-only POSIX `0600` or NTFS ACL on Windows). Set the env vars only to override.
 
 The user-facing backup is the **recovery phrase** in the wallet manager, not those files.
 
@@ -140,6 +144,8 @@ The user-facing backup is the **recovery phrase** in the wallet manager, not tho
 | `IW_RELAY_API_KEY` | generated UUID | Override `x-api-key` |
 | `IW_DEVICE_ID` | generated UUID | Override `X-Device-Id` (stable per keystore directory) |
 | `IW_KEYSTORE_DIR` | `~/.ironwallet-mcp` | Keystore directory |
+| `IW_RATES_API_URL` | baked profile | Rates backend for `maxPerTxUsd` valuation. Unset in the profile → USD limits reject (fail closed) |
+| `IW_STATIC_RESOURCES_URL` | baked profile | Static asset catalogs (token → rates id) |
 | `IW_HTTP_TIMEOUT_MS` | `15000` | General HTTP timeout (1s–120s) |
 | `IW_HTTP_FORWARD_TIMEOUT_MS` | `60000` | Longer timeout for broadcast-style calls. A client timeout does not always mean the operation failed — check status |
 | `IW_HTTP_RETRIES` | `2` | Retries for safe/idempotent calls; broadcasts are not auto-retried |
@@ -153,7 +159,7 @@ The user-facing backup is the **recovery phrase** in the wallet manager, not tho
 ## Security
 
 - Seeds are encrypted at rest. They never appear in tool results, agent chat, or backend requests.
-- The agent **can move funds without asking again**. Optional wallet policy (`readOnly`, `maxPerTx`, transfer recipient allow-list) is off by default and applies to both `send_transfer` and `execute_swap`.
+- The agent **can move funds without asking again**. Optional wallet policy (`readOnly`, `maxPerTxUsd`, transfer recipient allow-list — set via `set_wallet_policy`) is off by default and applies to both `send_transfer` and `execute_swap`.
 - Anyone with the keystore **and** the wrapping secret controls the funds. A leaked seed cannot be revoked.
 - Timeout is not always failure: poll status before retrying a send or swap.
 - Desktop / stdio only. A phone or remote agent would need a design where signing stays on a trusted device.

package/dist/api/rates.d.ts

@@ -0,0 +1,62 @@
+/**
+ * USD rates for policy limits (`maxPerTxUsd`).
+ *
+ * Same backend the mobile app uses:
+ *   GET {ratesApiUrl}/api/v1/rate/rates?Ids=<externalId,...>&Currencies=usd
+ * `Ids` are catalog `externalId`s (CoinGecko-style: "ethereum", "tether"), not
+ * symbols or contracts. Native coins map statically; tokens are resolved via the
+ * public static asset catalog
+ *   GET {staticResourcesUrl}/assets/main/blockchains/<net>/assets.mainnet.json
+ * matched by contract address (symbol as fallback).
+ *
+ * Callers must fail closed: `undefined` means "no rate", never "skip the check".
+ */
+import type { NetworkId } from "../networks.js";
+/** Verified against the mobile app's asset catalogs (init_assets_data). */
+export declare const NATIVE_EXTERNAL_ID: Record<NetworkId, string>;
+export interface CatalogAsset {
+    symbol?: string;
+    address?: string;
+    externalId?: string;
+}
+export interface AssetCatalogDocument {
+    assets?: CatalogAsset[];
+}
+/** Hex (EVM) contracts compare case-insensitively; base58 chains compare exactly. */
+export declare function sameTokenAddress(a: string, b: string): boolean;
+/** Find a token's externalId in a static catalog document. Pure, for tests. */
+export declare function findExternalIdInCatalog(doc: AssetCatalogDocument, query: {
+    symbol?: string;
+    tokenAddress?: string;
+}): string | undefined;
+/** Response shape of GET /api/v1/rate/rates (keys are externalIds). */
+export type RatesResponse = Record<string, Record<string, {
+    value?: number;
+    dailyChange?: number;
+    isExpired?: boolean;
+}> | null>;
+/** Extract a positive USD rate from the backend response. Pure, for tests. */
+export declare function parseUsdRate(response: RatesResponse, externalId: string): {
+    value: number;
+    isExpired: boolean;
+} | undefined;
+/** Test hook. */
+export declare function clearRatesCaches(): void;
+/**
+ * Resolve the rates id for an asset. Native coins come from the static map;
+ * tokens are looked up in the network's asset catalog by contract address.
+ */
+export declare function resolveExternalId(asset: {
+    network: NetworkId;
+    symbol?: string;
+    tokenAddress?: string;
+}, correlationId?: string): Promise<string | undefined>;
+/**
+ * USD price for one asset unit, or `undefined` when the asset or its rate is
+ * unknown / the backend is unreachable. Cached for ~60s per externalId.
+ */
+export declare function getUsdRate(asset: {
+    network: NetworkId;
+    symbol?: string;
+    tokenAddress?: string;
+}, correlationId?: string): Promise<number | undefined>;

package/dist/api/rates.js

@@ -0,0 +1,198 @@
+/**
+ * USD rates for policy limits (`maxPerTxUsd`).
+ *
+ * Same backend the mobile app uses:
+ *   GET {ratesApiUrl}/api/v1/rate/rates?Ids=<externalId,...>&Currencies=usd
+ * `Ids` are catalog `externalId`s (CoinGecko-style: "ethereum", "tether"), not
+ * symbols or contracts. Native coins map statically; tokens are resolved via the
+ * public static asset catalog
+ *   GET {staticResourcesUrl}/assets/main/blockchains/<net>/assets.mainnet.json
+ * matched by contract address (symbol as fallback).
+ *
+ * Callers must fail closed: `undefined` means "no rate", never "skip the check".
+ */
+import { getConfig } from "../config.js";
+import { logInfo, logWarn } from "../log.js";
+import { httpJson } from "./http.js";
+/** Verified against the mobile app's asset catalogs (init_assets_data). */
+export const NATIVE_EXTERNAL_ID = {
+    ethereum: "ethereum",
+    bsc: "binancecoin",
+    polygon: "polygon-ecosystem-token",
+    base: "ethereum",
+    arbitrum: "ethereum",
+    optimism: "ethereum",
+    avalanche: "avalanche-2",
+    tron: "tron",
+    bitcoin: "bitcoin",
+    litecoin: "litecoin",
+    doge: "dogecoin",
+    solana: "solana",
+    ton: "the-open-network",
+    xrp: "ripple",
+};
+/** Networks with a token catalog on static resources (litecoin/doge are native-only). */
+const CATALOG_NETWORKS = [
+    "ethereum",
+    "bsc",
+    "polygon",
+    "base",
+    "arbitrum",
+    "optimism",
+    "avalanche",
+    "tron",
+    "bitcoin",
+    "solana",
+    "ton",
+    "xrp",
+];
+/** Hex (EVM) contracts compare case-insensitively; base58 chains compare exactly. */
+export function sameTokenAddress(a, b) {
+    const ta = a.trim();
+    const tb = b.trim();
+    if (ta === tb)
+        return true;
+    if (ta.startsWith("0x") && tb.startsWith("0x")) {
+        return ta.toLowerCase() === tb.toLowerCase();
+    }
+    return false;
+}
+/** Find a token's externalId in a static catalog document. Pure, for tests. */
+export function findExternalIdInCatalog(doc, query) {
+    const assets = doc.assets ?? [];
+    if (query.tokenAddress) {
+        const byAddress = assets.find((a) => a.address && sameTokenAddress(a.address, query.tokenAddress));
+        if (byAddress?.externalId)
+            return byAddress.externalId;
+    }
+    if (query.symbol) {
+        const want = query.symbol.trim().toLowerCase();
+        const bySymbol = assets.find((a) => !a.address && a.symbol?.trim().toLowerCase() === want);
+        if (bySymbol?.externalId)
+            return bySymbol.externalId;
+    }
+    return undefined;
+}
+/** Extract a positive USD rate from the backend response. Pure, for tests. */
+export function parseUsdRate(response, externalId) {
+    const perCurrency = response[externalId];
+    if (!perCurrency)
+        return undefined;
+    const usdKey = Object.keys(perCurrency).find((k) => k.toLowerCase() === "usd");
+    if (!usdKey)
+        return undefined;
+    const rate = perCurrency[usdKey];
+    if (!rate || typeof rate.value !== "number" || !(rate.value > 0))
+        return undefined;
+    return { value: rate.value, isExpired: rate.isExpired === true };
+}
+const CATALOG_TTL_MS = 6 * 60 * 60 * 1000;
+const RATE_TTL_MS = 60 * 1000;
+/**
+ * Keep the policy check snappy: a send/swap should not hang for minutes when
+ * the rates backend is down — it will be rejected (fail closed) anyway.
+ */
+const FETCH_OPTS = { timeoutMs: 10000, retries: 1 };
+const catalogCache = new Map();
+const rateCache = new Map();
+/** Test hook. */
+export function clearRatesCaches() {
+    catalogCache.clear();
+    rateCache.clear();
+}
+async function fetchCatalog(network, correlationId) {
+    const cached = catalogCache.get(network);
+    if (cached && Date.now() - cached.at < CATALOG_TTL_MS)
+        return cached.doc;
+    const cfg = getConfig();
+    if (!cfg.staticResourcesUrl) {
+        logWarn("rates.catalog.no_url", { correlationId, network });
+        return undefined;
+    }
+    const url = `${cfg.staticResourcesUrl}/assets/main/blockchains/${network}/assets.mainnet.json`;
+    try {
+        const doc = await httpJson(url, { method: "GET" }, { correlationId, label: "rates.catalog", ...FETCH_OPTS });
+        catalogCache.set(network, { at: Date.now(), doc });
+        logInfo("rates.catalog.ok", {
+            correlationId,
+            network,
+            assets: doc.assets?.length ?? 0,
+        });
+        return doc;
+    }
+    catch (e) {
+        logWarn("rates.catalog.fail", {
+            correlationId,
+            network,
+            error: e instanceof Error ? e.message : String(e),
+        });
+        return undefined;
+    }
+}
+/**
+ * Resolve the rates id for an asset. Native coins come from the static map;
+ * tokens are looked up in the network's asset catalog by contract address.
+ */
+export async function resolveExternalId(asset, correlationId) {
+    if (!asset.tokenAddress)
+        return NATIVE_EXTERNAL_ID[asset.network];
+    if (!CATALOG_NETWORKS.includes(asset.network))
+        return undefined;
+    const doc = await fetchCatalog(asset.network, correlationId);
+    if (!doc)
+        return undefined;
+    return findExternalIdInCatalog(doc, {
+        symbol: asset.symbol,
+        tokenAddress: asset.tokenAddress,
+    });
+}
+/**
+ * USD price for one asset unit, or `undefined` when the asset or its rate is
+ * unknown / the backend is unreachable. Cached for ~60s per externalId.
+ */
+export async function getUsdRate(asset, correlationId) {
+    const externalId = await resolveExternalId(asset, correlationId);
+    if (!externalId) {
+        logWarn("rates.usd.no_external_id", {
+            correlationId,
+            network: asset.network,
+            symbol: asset.symbol,
+            tokenAddress: asset.tokenAddress,
+        });
+        return undefined;
+    }
+    const cached = rateCache.get(externalId);
+    if (cached && Date.now() - cached.at < RATE_TTL_MS)
+        return cached.value;
+    const cfg = getConfig();
+    if (!cfg.ratesApiUrl) {
+        logWarn("rates.usd.no_url", { correlationId, externalId });
+        return undefined;
+    }
+    const url = `${cfg.ratesApiUrl}/api/v1/rate/rates` +
+        `?Ids=${encodeURIComponent(externalId)}&Currencies=usd`;
+    let response;
+    try {
+        response = await httpJson(url, { method: "GET" }, { correlationId, label: "rates.usd", ...FETCH_OPTS });
+    }
+    catch (e) {
+        logWarn("rates.usd.fetch_fail", {
+            correlationId,
+            externalId,
+            error: e instanceof Error ? e.message : String(e),
+        });
+        return undefined;
+    }
+    const rate = parseUsdRate(response ?? {}, externalId);
+    if (!rate) {
+        logWarn("rates.usd.missing", { correlationId, externalId });
+        return undefined;
+    }
+    if (rate.isExpired) {
+        logWarn("rates.usd.expired", { correlationId, externalId, value: rate.value });
+    }
+    rateCache.set(externalId, { at: Date.now(), value: rate.value });
+    logInfo("rates.usd.ok", { correlationId, externalId, value: rate.value });
+    return rate.value;
+}
+//# sourceMappingURL=rates.js.map

package/dist/api/rates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rates.js","sourceRoot":"","sources":["../../src/api/rates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,2EAA2E;AAC3E,MAAM,CAAC,MAAM,kBAAkB,GAA8B;IAC3D,QAAQ,EAAE,UAAU;IACpB,GAAG,EAAE,aAAa;IAClB,OAAO,EAAE,yBAAyB;IAClC,IAAI,EAAE,UAAU;IAChB,QAAQ,EAAE,UAAU;IACpB,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,aAAa;IACxB,IAAI,EAAE,MAAM;IACZ,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,UAAU;IAChB,MAAM,EAAE,QAAQ;IAChB,GAAG,EAAE,kBAAkB;IACvB,GAAG,EAAE,QAAQ;CACd,CAAC;AAEF,yFAAyF;AACzF,MAAM,gBAAgB,GAAyB;IAC7C,UAAU;IACV,KAAK;IACL,SAAS;IACT,MAAM;IACN,UAAU;IACV,UAAU;IACV,WAAW;IACX,MAAM;IACN,SAAS;IACT,QAAQ;IACR,KAAK;IACL,KAAK;CACN,CAAC;AAYF,qFAAqF;AACrF,MAAM,UAAU,gBAAgB,CAAC,CAAS,EAAE,CAAS;IACnD,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACpB,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACpB,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,OAAO,EAAE,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,uBAAuB,CACrC,GAAyB,EACzB,KAAiD;IAEjD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;IAChC,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,YAAa,CAAC,CACrE,CAAC;QACF,IAAI,SAAS,EAAE,UAAU;YAAE,OAAO,SAAS,CAAC,UAAU,CAAC;IACzD,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAC1B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,IAAI,CAC7D,CAAC;QACF,IAAI,QAAQ,EAAE,UAAU;YAAE,OAAO,QAAQ,CAAC,UAAU,CAAC;IACvD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAQD,8EAA8E;AAC9E,MAAM,UAAU,YAAY,CAC1B,QAAuB,EACvB,UAAkB;IAElB,MAAM,WAAW,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,CAAC,WAAW;QAAE,OAAO,SAAS,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,CAAC;IAC/E,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACnF,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;AACnE,CAAC;AAED,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC1C,MAAM,WAAW,GAAG,EAAE,GAAG,IAAI,CAAC;AAE9B;;;GAGG;AACH,MAAM,UAAU,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAW,CAAC;AAE7D,MAAM,YAAY,GAAG,IAAI,GAAG,EAAwD,CAAC;AACrF,MAAM,SAAS,GAAG,IAAI,GAAG,EAAyC,CAAC;AAEnE,iBAAiB;AACjB,MAAM,UAAU,gBAAgB;IAC9B,YAAY,CAAC,KAAK,EAAE,CAAC;IACrB,SAAS,CAAC,KAAK,EAAE,CAAC;AACpB,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,OAAkB,EAClB,aAAsB;IAEtB,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,GAAG,cAAc;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC;IACzE,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC;QAC5B,OAAO,CAAC,sBAAsB,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5D,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,kBAAkB,4BAA4B,OAAO,sBAAsB,CAAC;IAC/F,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CACxB,GAAG,EACH,EAAE,MAAM,EAAE,KAAK,EAAE,EACjB,EAAE,aAAa,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,UAAU,EAAE,CACzD,CAAC;QACF,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACnD,OAAO,CAAC,kBAAkB,EAAE;YAC1B,aAAa;YACb,OAAO;YACP,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC;SAChC,CAAC,CAAC;QACH,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,oBAAoB,EAAE;YAC5B,aAAa;YACb,OAAO;YACP,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;SAClD,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAqE,EACrE,aAAsB;IAEtB,IAAI,CAAC,KAAK,CAAC,YAAY;QAAE,OAAO,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClE,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAChE,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC7D,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,OAAO,uBAAuB,CAAC,GAAG,EAAE;QAClC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,KAAqE,EACrE,aAAsB;IAEtB,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IACjE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,CAAC,0BAA0B,EAAE;YAClC,aAAa;YACb,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,GAAG,WAAW;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC;IAExE,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QACrB,OAAO,CAAC,kBAAkB,EAAE,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC,CAAC;QAC3D,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GACP,GAAG,GAAG,CAAC,WAAW,oBAAoB;QACtC,QAAQ,kBAAkB,CAAC,UAAU,CAAC,iBAAiB,CAAC;IAC1D,IAAI,QAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,QAAQ,CACvB,GAAG,EACH,EAAE,MAAM,EAAE,KAAK,EAAE,EACjB,EAAE,aAAa,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,UAAU,EAAE,CACrD,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,sBAAsB,EAAE;YAC9B,aAAa;YACb,UAAU;YACV,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;SAClD,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,IAAI,EAAE,EAAE,UAAU,CAAC,CAAC;IACtD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,mBAAmB,EAAE,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC,CAAC;QAC5D,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,OAAO,CAAC,mBAAmB,EAAE,EAAE,aAAa,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACjE,OAAO,CAAC,cAAc,EAAE,EAAE,aAAa,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IAC1E,OAAO,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC"}

package/dist/api/swap.d.ts

@@ -1,5 +1,5 @@
 /**
- * Swap Proxy (SWP) HTTP client — matches mobile SwapProxyApiClient:
+ * Swap HTTP client — matches the mobile client:
  *   /swp/refs/*  discovery
  *   /swp/exchange/*  estimate → create → execute → status
  *

package/dist/api/swap.js

@@ -1,5 +1,5 @@
 /**
- * Swap Proxy (SWP) HTTP client — matches mobile SwapProxyApiClient:
+ * Swap HTTP client — matches the mobile client:
  *   /swp/refs/*  discovery
  *   /swp/exchange/*  estimate → create → execute → status
  *

package/dist/config.d.ts

@@ -4,15 +4,11 @@
  * generated on first launch. There is no runtime IW_ENV switch — each build
  * embeds one profile via the repo-root `npm run bake`.
  */
+import { type NetworkId } from "./networks.js";
 /** `package.json` version of this package (works from `src/` and compiled `dist/`). */
 export declare function packageVersion(): string;
-/** Canonical network identifiers used across the server. */
-export type NetworkId = "ethereum" | "bsc" | "polygon" | "base" | "arbitrum" | "optimism" | "avalanche" | "tron" | "bitcoin" | "litecoin" | "doge" | "solana" | "ton" | "xrp";
-/** Networks that share the secp256k1 EVM key and signing scheme. */
-export declare const EVM_NETWORKS: NetworkId[];
-/** Non-EVM chains, each with its own curve / address scheme / node API. */
-export declare const NON_EVM_NETWORKS: NetworkId[];
-export declare const ALL_NETWORKS: NetworkId[];
+export type { NetworkId } from "./networks.js";
+export { ALL_NETWORKS, EVM_NETWORKS, NON_EVM_NETWORKS } from "./networks.js";
 /**
  * Networks advertised during challenge login. Kept to the proven EVM+Tron set:
  * the backend authenticates against these public keys and the flow is verified
@@ -22,7 +18,7 @@ export declare const ALL_NETWORKS: NetworkId[];
 export declare const AUTH_NETWORKS: NetworkId[];
 /**
  * Networks whose transfer signing is implemented (send is allowed). All of these
- * go through the Ironwallet relay forward flow (estimate → sign → forward),
+ * go through the IronWallet relay forward flow (estimate → sign → forward),
  * including TON (IR-673 / mobile RelayV2).
  */
 export declare const SIGNABLE_NETWORKS: NetworkId[];
@@ -40,19 +36,25 @@ export declare function relaySegment(network: NetworkId): string;
 export interface Config {
     authUrl: string;
     relayUrl: string;
-    /** Swap Proxy host (`/swp/exchange/*`, `/swp/refs/*`). */
+    /** Swap API host (`/swp/exchange/*`, `/swp/refs/*`). */
     swapProxyUrl: string;
+    /** Rates API host (`/api/v1/rate/rates`). Used only for USD policy limits. */
+    ratesApiUrl: string;
+    /** Static resources base with asset catalogs (`/assets/main/blockchains/...`). */
+    staticResourcesUrl: string;
     /** Optional relay API key (x-api-key). Empty string means header is omitted. */
     relayApiKey: string;
     /** App version string sent as x-iwt-cli / X-App-Version. */
     appVersion: string;
     /** Device id sent as X-Device-Id. UUID file under the keystore dir unless overridden. */
     deviceId: string;
+    /** Machine fingerprint sent as X-Device-Fingerprint. OS install id + platform, or device-id if that id is missing. */
+    deviceFingerprint: string;
     /** X-Device-Locale value, format: TimeZone=..;Language=..;Region=..; */
     deviceLocale: string;
     /**
-     * JSON for `X-Device-Info`. Swap Proxy requires `systemName`
-     * (e.g. `{"systemName":"iOS","systemVersion":"17.0","model":"iPhone"}`).
+     * JSON for `X-Device-Info`. The swap API keys routing off `systemName`
+     * (`Web` here — this is a desktop MCP, not a phone).
      */
     deviceInfo: string;
     /** Directory holding the encrypted keystore. */
@@ -88,8 +90,10 @@ export interface Config {
     /** When true, `send_transfer` and `execute_swap` are rejected immediately. */
     readOnly: boolean;
 }
+/** Host-honest Web payload. Do not pretend to be iOS/Android. */
+export declare function defaultDeviceInfo(): string;
 export declare function getConfig(): Config;
 /** Reject send/swap when `IW_READ_ONLY` is set. */
 export declare function assertServerWritable(action: "send" | "swap"): void;
-/** Common device-mimicking headers sent to auth, relay, and Swap Proxy. */
+/** Device headers sent to auth, relay, and swap APIs. */
 export declare function commonHeaders(cfg: Config): Record<string, string>;

package/dist/config.js

@@ -5,9 +5,12 @@
  * embeds one profile via the repo-root `npm run bake`.
  */
 import { readFileSync } from "node:fs";
+import { arch, release, type as osType } from "node:os";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { BAKED_ENV } from "./generated/env-config.js";
+import { ALL_NETWORKS, EVM_NETWORKS } from "./networks.js";
+import { resolveDeviceFingerprint } from "./device-fingerprint.js";
 import { resolveDeviceId, resolveKeystoreDir, resolveKeystorePassphrase, resolveRelayApiKey, } from "./local-secrets.js";
 /** `package.json` version of this package (works from `src/` and compiled `dist/`). */
 export function packageVersion() {
@@ -20,27 +23,7 @@ export function packageVersion() {
         return "0.0.0";
     }
 }
-/** Networks that share the secp256k1 EVM key and signing scheme. */
-export const EVM_NETWORKS = [
-    "ethereum",
-    "bsc",
-    "polygon",
-    "base",
-    "arbitrum",
-    "optimism",
-    "avalanche",
-];
-/** Non-EVM chains, each with its own curve / address scheme / node API. */
-export const NON_EVM_NETWORKS = [
-    "tron",
-    "bitcoin",
-    "litecoin",
-    "doge",
-    "solana",
-    "ton",
-    "xrp",
-];
-export const ALL_NETWORKS = [...EVM_NETWORKS, ...NON_EVM_NETWORKS];
+export { ALL_NETWORKS, EVM_NETWORKS, NON_EVM_NETWORKS } from "./networks.js";
 /**
  * Networks advertised during challenge login. Kept to the proven EVM+Tron set:
  * the backend authenticates against these public keys and the flow is verified
@@ -50,7 +33,7 @@ export const ALL_NETWORKS = [...EVM_NETWORKS, ...NON_EVM_NETWORKS];
 export const AUTH_NETWORKS = [...EVM_NETWORKS, "tron"];
 /**
  * Networks whose transfer signing is implemented (send is allowed). All of these
- * go through the Ironwallet relay forward flow (estimate → sign → forward),
+ * go through the IronWallet relay forward flow (estimate → sign → forward),
  * including TON (IR-673 / mobile RelayV2).
  */
 export const SIGNABLE_NETWORKS = [...ALL_NETWORKS];
@@ -106,6 +89,37 @@ function envBool(key, fallback) {
         return fallback;
     return !/^(0|false|off|no)$/i.test(v);
 }
+/** Host-honest Web payload. Do not pretend to be iOS/Android. */
+export function defaultDeviceInfo() {
+    return JSON.stringify({
+        systemName: "Web",
+        systemVersion: packageVersion(),
+        model: "ironwallet-mcp",
+        platform: process.platform,
+        arch: arch(),
+        os: osType(),
+        osRelease: release(),
+    });
+}
+function defaultDeviceLocale() {
+    let timeZone = "UTC";
+    let language = "en";
+    let region = "US";
+    try {
+        const opts = Intl.DateTimeFormat().resolvedOptions();
+        if (opts.timeZone)
+            timeZone = opts.timeZone;
+        const parts = (opts.locale ?? "").split(/[-_]/);
+        if (parts[0])
+            language = parts[0];
+        if (parts[1])
+            region = parts[1];
+    }
+    catch {
+        // keep UTC/en/US
+    }
+    return `TimeZone=${timeZone};Language=${language};Region=${region};`;
+}
 /** Parse an integer env var, clamped to [min, max], falling back on invalid input. */
 function envInt(key, fallback, min, max) {
     const raw = process.env[key];
@@ -130,20 +144,22 @@ export function getConfig() {
     if (cached)
         return cached;
     resolveKeystorePassphrase();
+    const deviceId = resolveDeviceId();
     const profile = BAKED_ENV;
     cached = {
         authUrl: envOr("IW_AUTH_URL", profile.authUrl),
         relayUrl: envOr("IW_RELAY_URL", profile.relayUrl),
         swapProxyUrl: envOr("IW_SWAP_PROXY_URL", profile.swapProxyUrl),
+        // Hosts live only in the baked configurations profile (no fallbacks in
+        // code). Empty string means USD policy limits fail closed.
+        ratesApiUrl: envOr("IW_RATES_API_URL", profile.ratesApiUrl ?? ""),
+        staticResourcesUrl: envOr("IW_STATIC_RESOURCES_URL", profile.staticResourcesUrl ?? ""),
         relayApiKey: resolveRelayApiKey(),
         appVersion: envOr("IW_APP_VERSION", `ironwallet-mcp/${packageVersion()}`),
-        deviceId: resolveDeviceId(),
-        deviceLocale: envOr("IW_DEVICE_LOCALE", "TimeZone=UTC;Language=en;Region=US;"),
-        deviceInfo: envOr("IW_DEVICE_INFO", JSON.stringify({
-            systemName: "iOS",
-            systemVersion: "17.0",
-            model: "iPhone",
-        })),
+        deviceId,
+        deviceFingerprint: resolveDeviceFingerprint(deviceId),
+        deviceLocale: envOr("IW_DEVICE_LOCALE", defaultDeviceLocale()),
+        deviceInfo: envOr("IW_DEVICE_INFO", defaultDeviceInfo()),
         keystoreDir: resolveKeystoreDir(),
         evmRpcUrls: resolveEvmRpcUrls(profile.evmRpcUrls),
         tronApiUrl: envOr("IW_TRON_API", profile.tronApiUrl),
@@ -171,15 +187,16 @@ export function assertServerWritable(action) {
         ? "Server is read-only (IW_READ_ONLY); swaps are disabled."
         : "Server is read-only (IW_READ_ONLY); sending is disabled.");
 }
-/** Common device-mimicking headers sent to auth, relay, and Swap Proxy. */
+/** Device headers sent to auth, relay, and swap APIs. */
 export function commonHeaders(cfg) {
     const headers = {
         "x-iwt-cli": cfg.appVersion,
         "X-App-Version": cfg.appVersion,
         "X-Device-Id": cfg.deviceId,
+        "X-Device-Fingerprint": cfg.deviceFingerprint,
         // Backend validates the format: TimeZone=..;Language=..;Region=..;
         "X-Device-Locale": cfg.deviceLocale,
-        // SWP validates UserData.XDeviceInfo — JSON with required `systemName`.
+        // Swap routing reads UserData.XDeviceInfo.systemName (`Web` for this client).
         "X-Device-Info": cfg.deviceInfo,
         "Content-Language": "en",
     };

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAE5B,uFAAuF;AACvF,MAAM,UAAU,cAAc;IAC5B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAClB,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EACvC,IAAI,EACJ,cAAc,CACf,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAyB,CAAC;QAC9E,OAAO,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAmBD,oEAAoE;AACpE,MAAM,CAAC,MAAM,YAAY,GAAgB;IACvC,UAAU;IACV,KAAK;IACL,SAAS;IACT,MAAM;IACN,UAAU;IACV,UAAU;IACV,WAAW;CACZ,CAAC;AAEF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,gBAAgB,GAAgB;IAC3C,MAAM;IACN,SAAS;IACT,UAAU;IACV,MAAM;IACN,QAAQ;IACR,KAAK;IACL,KAAK;CACN,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAgB,CAAC,GAAG,YAAY,EAAE,GAAG,gBAAgB,CAAC,CAAC;AAEhF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAgB,CAAC,GAAG,YAAY,EAAE,MAAM,CAAC,CAAC;AAEpE;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAgB,CAAC,GAAG,YAAY,CAAC,CAAC;AAEhE,MAAM,UAAU,OAAO,CAAC,OAAkB;IACxC,OAAO,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC7C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAgB,YAAY,CAAC,MAAM,CACpE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,MAAM,CACxC,CAAC;AAEF,MAAM,UAAU,OAAO,CAAC,OAAkB;IACxC,OAAO,sBAAsB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAClD,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACtC,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAkB;IAC7C,OAAO,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,aAAa,GAA8B;IAC/C,QAAQ,EAAE,UAAU;IACpB,GAAG,EAAE,KAAK;IACV,OAAO,EAAE,SAAS;IAClB,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,UAAU;IACpB,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;IACtB,IAAI,EAAE,MAAM;IACZ,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,QAAQ;IAChB,GAAG,EAAE,KAAK;IACV,GAAG,EAAE,KAAK;CACX,CAAC;AAEF,MAAM,UAAU,YAAY,CAAC,OAAkB;IAC7C,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC;AAsDD,SAAS,KAAK,CAAC,GAAW,EAAE,QAAgB;IAC1C,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC1C,CAAC;AAED,SAAS,OAAO,CAAC,GAAW,EAAE,QAAiB;IAC7C,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IACjD,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,sFAAsF;AACtF,SAAS,MAAM,CAAC,GAAW,EAAE,QAAgB,EAAE,GAAW,EAAE,GAAW;IACrE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG;QAAE,OAAO,QAAQ,CAAC;IAC1B,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAC;IACzC,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,iBAAiB,CACxB,WAAmC;IAEnC,MAAM,IAAI,GAA2B,EAAE,GAAG,WAAW,EAAE,CAAC;IACxD,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC5D,IAAI,QAAQ;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;IACrC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,IAAI,MAAM,GAAkB,IAAI,CAAC;AAEjC,MAAM,UAAU,SAAS;IACvB,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,yBAAyB,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,SAAS,CAAC;IAC1B,MAAM,GAAG;QACP,OAAO,EAAE,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC;QAC9C,QAAQ,EAAE,KAAK,CAAC,cAAc,EAAE,OAAO,CAAC,QAAQ,CAAC;QACjD,YAAY,EAAE,KAAK,CAAC,mBAAmB,EAAE,OAAO,CAAC,YAAY,CAAC;QAC9D,WAAW,EAAE,kBAAkB,EAAE;QACjC,UAAU,EAAE,KAAK,CAAC,gBAAgB,EAAE,kBAAkB,cAAc,EAAE,EAAE,CAAC;QACzE,QAAQ,EAAE,eAAe,EAAE;QAC3B,YAAY,EAAE,KAAK,CAAC,kBAAkB,EAAE,qCAAqC,CAAC;QAC9E,UAAU,EAAE,KAAK,CACf,gBAAgB,EAChB,IAAI,CAAC,SAAS,CAAC;YACb,UAAU,EAAE,KAAK;YACjB,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,QAAQ;SAChB,CAAC,CACH;QACD,WAAW,EAAE,kBAAkB,EAAE;QACjC,UAAU,EAAE,iBAAiB,CAAC,OAAO,CAAC,UAAU,CAAC;QACjD,UAAU,EAAE,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,UAAU,CAAC;QACpD,aAAa,EAAE,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,aAAa,CAAC;QACzD,cAAc,EAAE,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,cAAc,CAAC;QAC3D,UAAU,EAAE,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,UAAU,CAAC;QACpD,YAAY,EAAE,KAAK,CAAC,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC;QAC1D,SAAS,EAAE,KAAK,CAAC,gBAAgB,EAAE,OAAO,CAAC,SAAS,CAAC;QACrD,SAAS,EAAE,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,SAAS,CAAC;QACjD,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,aAAa,EAAE,MAAM,CAAC,oBAAoB,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC;QAChE,6EAA6E;QAC7E,yEAAyE;QACzE,oBAAoB,EAAE,MAAM,CAAC,4BAA4B,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC;QAC/E,WAAW,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAChD,QAAQ,EAAE,OAAO,CAAC,cAAc,EAAE,KAAK,CAAC;KACzC,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,oBAAoB,CAAC,MAAuB;IAC1D,IAAI,CAAC,SAAS,EAAE,CAAC,QAAQ;QAAE,OAAO;IAClC,MAAM,IAAI,KAAK,CACb,MAAM,KAAK,MAAM;QACf,CAAC,CAAC,yDAAyD;QAC3D,CAAC,CAAC,0DAA0D,CAC/D,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,MAAM,OAAO,GAA2B;QACtC,WAAW,EAAE,GAAG,CAAC,UAAU;QAC3B,eAAe,EAAE,GAAG,CAAC,UAAU;QAC/B,aAAa,EAAE,GAAG,CAAC,QAAQ;QAC3B,mEAAmE;QACnE,iBAAiB,EAAE,GAAG,CAAC,YAAY;QACnC,wEAAwE;QACxE,eAAe,EAAE,GAAG,CAAC,UAAU;QAC/B,kBAAkB,EAAE,IAAI;KACzB,CAAC;IACF,IAAI,GAAG,CAAC,WAAW;QAAE,OAAO,CAAC,WAAW,CAAC,GAAG,GAAG,CAAC,WAAW,CAAC;IAC5D,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,MAAM,EAAE,MAAM,SAAS,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAkB,MAAM,eAAe,CAAC;AAC3E,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAE5B,uFAAuF;AACvF,MAAM,UAAU,cAAc;IAC5B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAClB,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EACvC,IAAI,EACJ,cAAc,CACf,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAyB,CAAC;QAC9E,OAAO,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAGD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAE7E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAgB,CAAC,GAAG,YAAY,EAAE,MAAM,CAAC,CAAC;AAEpE;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAgB,CAAC,GAAG,YAAY,CAAC,CAAC;AAEhE,MAAM,UAAU,OAAO,CAAC,OAAkB;IACxC,OAAO,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC7C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAgB,YAAY,CAAC,MAAM,CACpE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,MAAM,CACxC,CAAC;AAEF,MAAM,UAAU,OAAO,CAAC,OAAkB;IACxC,OAAO,sBAAsB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAClD,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACtC,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAkB;IAC7C,OAAQ,YAAqC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,MAAM,aAAa,GAA8B;IAC/C,QAAQ,EAAE,UAAU;IACpB,GAAG,EAAE,KAAK;IACV,OAAO,EAAE,SAAS;IAClB,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,UAAU;IACpB,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;IACtB,IAAI,EAAE,MAAM;IACZ,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,QAAQ;IAChB,GAAG,EAAE,KAAK;IACV,GAAG,EAAE,KAAK;CACX,CAAC;AAEF,MAAM,UAAU,YAAY,CAAC,OAAkB;IAC7C,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC;AA4DD,SAAS,KAAK,CAAC,GAAW,EAAE,QAAgB;IAC1C,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC1C,CAAC;AAED,SAAS,OAAO,CAAC,GAAW,EAAE,QAAiB;IAC7C,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IACjD,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,iBAAiB;IAC/B,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,UAAU,EAAE,KAAK;QACjB,aAAa,EAAE,cAAc,EAAE;QAC/B,KAAK,EAAE,gBAAgB;QACvB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,IAAI,EAAE,IAAI,EAAE;QACZ,EAAE,EAAE,MAAM,EAAE;QACZ,SAAS,EAAE,OAAO,EAAE;KACrB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB;IAC1B,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE,CAAC;QACrD,IAAI,IAAI,CAAC,QAAQ;YAAE,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC5C,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,KAAK,CAAC,CAAC,CAAC;YAAE,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,KAAK,CAAC,CAAC,CAAC;YAAE,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;IACD,OAAO,YAAY,QAAQ,aAAa,QAAQ,WAAW,MAAM,GAAG,CAAC;AACvE,CAAC;AAED,sFAAsF;AACtF,SAAS,MAAM,CAAC,GAAW,EAAE,QAAgB,EAAE,GAAW,EAAE,GAAW;IACrE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG;QAAE,OAAO,QAAQ,CAAC;IAC1B,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAC;IACzC,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,iBAAiB,CACxB,WAAmC;IAEnC,MAAM,IAAI,GAA2B,EAAE,GAAG,WAAW,EAAE,CAAC;IACxD,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC5D,IAAI,QAAQ;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;IACrC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,IAAI,MAAM,GAAkB,IAAI,CAAC;AAEjC,MAAM,UAAU,SAAS;IACvB,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,yBAAyB,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,SAAS,CAAC;IAC1B,MAAM,GAAG;QACP,OAAO,EAAE,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC;QAC9C,QAAQ,EAAE,KAAK,CAAC,cAAc,EAAE,OAAO,CAAC,QAAQ,CAAC;QACjD,YAAY,EAAE,KAAK,CAAC,mBAAmB,EAAE,OAAO,CAAC,YAAY,CAAC;QAC9D,uEAAuE;QACvE,2DAA2D;QAC3D,WAAW,EAAE,KAAK,CAAC,kBAAkB,EAAE,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC;QACjE,kBAAkB,EAAE,KAAK,CAAC,yBAAyB,EAAE,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC;QACtF,WAAW,EAAE,kBAAkB,EAAE;QACjC,UAAU,EAAE,KAAK,CAAC,gBAAgB,EAAE,kBAAkB,cAAc,EAAE,EAAE,CAAC;QACzE,QAAQ;QACR,iBAAiB,EAAE,wBAAwB,CAAC,QAAQ,CAAC;QACrD,YAAY,EAAE,KAAK,CAAC,kBAAkB,EAAE,mBAAmB,EAAE,CAAC;QAC9D,UAAU,EAAE,KAAK,CAAC,gBAAgB,EAAE,iBAAiB,EAAE,CAAC;QACxD,WAAW,EAAE,kBAAkB,EAAE;QACjC,UAAU,EAAE,iBAAiB,CAAC,OAAO,CAAC,UAAU,CAAC;QACjD,UAAU,EAAE,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,UAAU,CAAC;QACpD,aAAa,EAAE,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,aAAa,CAAC;QACzD,cAAc,EAAE,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,cAAc,CAAC;QAC3D,UAAU,EAAE,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,UAAU,CAAC;QACpD,YAAY,EAAE,KAAK,CAAC,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC;QAC1D,SAAS,EAAE,KAAK,CAAC,gBAAgB,EAAE,OAAO,CAAC,SAAS,CAAC;QACrD,SAAS,EAAE,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,SAAS,CAAC;QACjD,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,aAAa,EAAE,MAAM,CAAC,oBAAoB,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC;QAChE,6EAA6E;QAC7E,yEAAyE;QACzE,oBAAoB,EAAE,MAAM,CAAC,4BAA4B,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC;QAC/E,WAAW,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAChD,QAAQ,EAAE,OAAO,CAAC,cAAc,EAAE,KAAK,CAAC;KACzC,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,oBAAoB,CAAC,MAAuB;IAC1D,IAAI,CAAC,SAAS,EAAE,CAAC,QAAQ;QAAE,OAAO;IAClC,MAAM,IAAI,KAAK,CACb,MAAM,KAAK,MAAM;QACf,CAAC,CAAC,yDAAyD;QAC3D,CAAC,CAAC,0DAA0D,CAC/D,CAAC;AACJ,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,MAAM,OAAO,GAA2B;QACtC,WAAW,EAAE,GAAG,CAAC,UAAU;QAC3B,eAAe,EAAE,GAAG,CAAC,UAAU;QAC/B,aAAa,EAAE,GAAG,CAAC,QAAQ;QAC3B,sBAAsB,EAAE,GAAG,CAAC,iBAAiB;QAC7C,mEAAmE;QACnE,iBAAiB,EAAE,GAAG,CAAC,YAAY;QACnC,8EAA8E;QAC9E,eAAe,EAAE,GAAG,CAAC,UAAU;QAC/B,kBAAkB,EAAE,IAAI;KACzB,CAAC;IACF,IAAI,GAAG,CAAC,WAAW;QAAE,OAAO,CAAC,WAAW,CAAC,GAAG,GAAG,CAAC,WAAW,CAAC;IAC5D,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/consent/copy.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Canonical MCP consent copy (English). Chat, create_wallets, and the local
+ * manager must show this text. Bump CONSENT_VERSION when the wording changes.
+ */
+export declare const CONSENT_VERSION = "v1";
+export declare const CONSENT_TITLE = "Before connecting an AI agent to your wallet";
+export declare const CONSENT_LEAD = "Connecting MCP lets the AI agent view balances, transfer assets, and swap on behalf of this wallet.";
+export declare const CONSENT_BULLETS: readonly ["By default the agent can send funds and swap without extra confirmation on each operation.", "Use a dedicated wallet with a small balance, not your main or savings wallet.", "The recovery phrase stays encrypted on this device. Loss or compromise means permanent loss of access to the funds.", "IronWallet is not responsible for the AI agent's actions, misconfiguration, or loss of funds from using this feature.", "You can ask the agent to set limits in chat (read-only, a per-transaction USD limit, a transfer recipient allow-list)."];
+export declare const CONSENT_CHECKBOX = "I understand the risks and want to continue";
+export declare const CONSENT_CHAT_INSTRUCTION = "Show this text in full in chat. Do not shorten it. After the user explicitly confirms, call accept_mcp_consent with accepted=true, or open the wallet manager so they can accept there.";
+export declare function consentDocument(): {
+    version: string;
+    title: string;
+    lead: string;
+    bullets: readonly string[];
+    checkbox: string;
+    instruction: string;
+};