@ironwallet/mcp-server 1.0.1 → 1.0.3

package/dist/consent/copy.js

@@ -0,0 +1,27 @@
+/**
+ * Canonical MCP consent copy (English). Chat, create_wallets, and the local
+ * manager must show this text. Bump CONSENT_VERSION when the wording changes.
+ */
+export const CONSENT_VERSION = "v1";
+export const CONSENT_TITLE = "Before connecting an AI agent to your wallet";
+export const CONSENT_LEAD = "Connecting MCP lets the AI agent view balances, transfer assets, and swap on behalf of this wallet.";
+export const CONSENT_BULLETS = [
+    "By default the agent can send funds and swap without extra confirmation on each operation.",
+    "Use a dedicated wallet with a small balance, not your main or savings wallet.",
+    "The recovery phrase stays encrypted on this device. Loss or compromise means permanent loss of access to the funds.",
+    "IronWallet is not responsible for the AI agent's actions, misconfiguration, or loss of funds from using this feature.",
+    "You can ask the agent to set limits in chat (read-only, a per-transaction USD limit, a transfer recipient allow-list).",
+];
+export const CONSENT_CHECKBOX = "I understand the risks and want to continue";
+export const CONSENT_CHAT_INSTRUCTION = "Show this text in full in chat. Do not shorten it. After the user explicitly confirms, call accept_mcp_consent with accepted=true, or open the wallet manager so they can accept there.";
+export function consentDocument() {
+    return {
+        version: CONSENT_VERSION,
+        title: CONSENT_TITLE,
+        lead: CONSENT_LEAD,
+        bullets: CONSENT_BULLETS,
+        checkbox: CONSENT_CHECKBOX,
+        instruction: CONSENT_CHAT_INSTRUCTION,
+    };
+}
+//# sourceMappingURL=copy.js.map

package/dist/consent/copy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"copy.js","sourceRoot":"","sources":["../../src/consent/copy.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC;AAEpC,MAAM,CAAC,MAAM,aAAa,GAAG,8CAA8C,CAAC;AAE5E,MAAM,CAAC,MAAM,YAAY,GACvB,qGAAqG,CAAC;AAExG,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,4FAA4F;IAC5F,+EAA+E;IAC/E,qHAAqH;IACrH,uHAAuH;IACvH,wHAAwH;CAChH,CAAC;AAEX,MAAM,CAAC,MAAM,gBAAgB,GAAG,6CAA6C,CAAC;AAE9E,MAAM,CAAC,MAAM,wBAAwB,GACnC,yLAAyL,CAAC;AAE5L,MAAM,UAAU,eAAe;IAQ7B,OAAO;QACL,OAAO,EAAE,eAAe;QACxB,KAAK,EAAE,aAAa;QACpB,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,eAAe;QACxB,QAAQ,EAAE,gBAAgB;QAC1B,WAAW,EAAE,wBAAwB;KACtC,CAAC;AACJ,CAAC"}

package/dist/consent/store.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Durable MCP consent next to the keystore. Written by accept_mcp_consent (chat)
+ * or the local manager. create / import stay blocked until the current version
+ * is accepted.
+ */
+import { consentDocument } from "./copy.js";
+export declare const CONSENT_FILE = "mcp-consent.json";
+export type ConsentChannel = "chat" | "manager";
+export interface ConsentRecord {
+    version: string;
+    acceptedAt: string;
+    channel: ConsentChannel;
+}
+export declare function consentFilePath(dir?: string): string;
+export declare function readConsent(dir?: string): ConsentRecord | undefined;
+export declare function hasCurrentConsent(dir?: string): boolean;
+export declare function recordConsent(channel: ConsentChannel, dir?: string): ConsentRecord;
+/** Payload for agents when create/import is blocked. */
+export declare function consentRequiredPayload(): {
+    needs_consent: true;
+    accept: "accept_mcp_consent";
+    consent: ReturnType<typeof consentDocument>;
+};

package/dist/consent/store.js

@@ -0,0 +1,63 @@
+/**
+ * Durable MCP consent next to the keystore. Written by accept_mcp_consent (chat)
+ * or the local manager. create / import stay blocked until the current version
+ * is accepted.
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { resolveKeystoreDir } from "../local-secrets.js";
+import { restrictPrivateFile } from "../restrict-private-file.js";
+import { CONSENT_VERSION, consentDocument } from "./copy.js";
+export const CONSENT_FILE = "mcp-consent.json";
+export function consentFilePath(dir = resolveKeystoreDir()) {
+    return join(dir, CONSENT_FILE);
+}
+export function readConsent(dir) {
+    const path = consentFilePath(dir);
+    if (!existsSync(path))
+        return undefined;
+    try {
+        const raw = JSON.parse(readFileSync(path, "utf8"));
+        if (typeof raw.version !== "string" || !raw.version.trim())
+            return undefined;
+        if (typeof raw.acceptedAt !== "string" || !raw.acceptedAt.trim())
+            return undefined;
+        if (raw.channel !== "chat" && raw.channel !== "manager")
+            return undefined;
+        return {
+            version: raw.version.trim(),
+            acceptedAt: raw.acceptedAt,
+            channel: raw.channel,
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+export function hasCurrentConsent(dir) {
+    const record = readConsent(dir);
+    return record?.version === CONSENT_VERSION;
+}
+export function recordConsent(channel, dir) {
+    const root = dir ?? resolveKeystoreDir();
+    if (!existsSync(root))
+        mkdirSync(root, { recursive: true });
+    const record = {
+        version: CONSENT_VERSION,
+        acceptedAt: new Date().toISOString(),
+        channel,
+    };
+    const path = consentFilePath(root);
+    writeFileSync(path, `${JSON.stringify(record, null, 2)}\n`, { mode: 0o600 });
+    restrictPrivateFile(path);
+    return record;
+}
+/** Payload for agents when create/import is blocked. */
+export function consentRequiredPayload() {
+    return {
+        needs_consent: true,
+        accept: "accept_mcp_consent",
+        consent: consentDocument(),
+    };
+}
+//# sourceMappingURL=store.js.map

package/dist/consent/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/consent/store.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE7D,MAAM,CAAC,MAAM,YAAY,GAAG,kBAAkB,CAAC;AAU/C,MAAM,UAAU,eAAe,CAAC,MAAc,kBAAkB,EAAE;IAChE,OAAO,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAY;IACtC,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAA2B,CAAC;QAC7E,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE;YAAE,OAAO,SAAS,CAAC;QAC7E,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE;YAAE,OAAO,SAAS,CAAC;QACnF,IAAI,GAAG,CAAC,OAAO,KAAK,MAAM,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC1E,OAAO;YACL,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE;YAC3B,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;SACrB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAY;IAC5C,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,MAAM,EAAE,OAAO,KAAK,eAAe,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAuB,EAAE,GAAY;IACjE,MAAM,IAAI,GAAG,GAAG,IAAI,kBAAkB,EAAE,CAAC;IACzC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAkB;QAC5B,OAAO,EAAE,eAAe;QACxB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,OAAO;KACR,CAAC;IACF,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACnC,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7E,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC1B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,sBAAsB;IAKpC,OAAO;QACL,aAAa,EAAE,IAAI;QACnB,MAAM,EAAE,oBAAoB;QAC5B,OAAO,EAAE,eAAe,EAAE;KAC3B,CAAC;AACJ,CAAC"}

package/dist/device-fingerprint.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Stable machine fingerprint for `X-Device-Fingerprint`.
+ *
+ * Hashes the OS install id (Linux machine-id, Windows MachineGuid,
+ * macOS IOPlatformUUID) plus platform. If that id is missing, hashes the
+ * local `device-id` UUID instead. Hostname, username, and arch are never
+ * included. Computed in memory only — not written under ~/.ironwallet-mcp/.
+ */
+export declare const FINGERPRINT_VERSION = "v1";
+export declare function parseWindowsMachineGuid(regOutput: string): string | undefined;
+export declare function parseMacPlatformUuid(ioregOutput: string): string | undefined;
+export declare function parseLinuxMachineId(raw: string): string | undefined;
+export declare function formatDeviceFingerprint(parts: {
+    osMachineId?: string;
+    platform: string;
+    fallbackId?: string;
+}): string;
+export declare function resolveDeviceFingerprint(fallbackId?: string): string;

package/dist/device-fingerprint.js

@@ -0,0 +1,81 @@
+/**
+ * Stable machine fingerprint for `X-Device-Fingerprint`.
+ *
+ * Hashes the OS install id (Linux machine-id, Windows MachineGuid,
+ * macOS IOPlatformUUID) plus platform. If that id is missing, hashes the
+ * local `device-id` UUID instead. Hostname, username, and arch are never
+ * included. Computed in memory only — not written under ~/.ironwallet-mcp/.
+ */
+import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+export const FINGERPRINT_VERSION = "v1";
+export function parseWindowsMachineGuid(regOutput) {
+    const match = /MachineGuid\s+REG_SZ\s+([0-9a-fA-F-]{36})/.exec(regOutput);
+    return match?.[1]?.toLowerCase();
+}
+export function parseMacPlatformUuid(ioregOutput) {
+    const match = /"IOPlatformUUID"\s*=\s*"([0-9a-fA-F-]{36})"/.exec(ioregOutput);
+    return match?.[1]?.toLowerCase();
+}
+export function parseLinuxMachineId(raw) {
+    const id = raw.trim().toLowerCase().replace(/[^0-9a-f]/g, "");
+    return id.length >= 16 ? id : undefined;
+}
+export function formatDeviceFingerprint(parts) {
+    const machineId = parts.osMachineId?.trim() ?? "";
+    const fallbackId = parts.fallbackId?.trim() ?? "";
+    const identity = machineId || (fallbackId ? `fallback:${fallbackId}` : "");
+    const material = ["ironwallet-mcp", FINGERPRINT_VERSION, identity, parts.platform].join("|");
+    const digest = createHash("sha256").update(material).digest("hex");
+    return `${FINGERPRINT_VERSION}:${digest}`;
+}
+function readOsMachineId(platform = process.platform) {
+    try {
+        if (platform === "linux") {
+            for (const path of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
+                try {
+                    const id = parseLinuxMachineId(readFileSync(path, "utf8"));
+                    if (id)
+                        return id;
+                }
+                catch {
+                    // try the next path
+                }
+            }
+            return undefined;
+        }
+        if (platform === "win32") {
+            const root = process.env.SystemRoot || process.env.WINDIR || "C:\\Windows";
+            const output = execFileSync(join(root, "System32", "reg.exe"), [
+                "query",
+                "HKLM\\SOFTWARE\\Microsoft\\Cryptography",
+                "/v",
+                "MachineGuid",
+                "/reg:64",
+            ], { windowsHide: true, stdio: ["ignore", "pipe", "pipe"], encoding: "utf8" });
+            return parseWindowsMachineGuid(output);
+        }
+        if (platform === "darwin") {
+            const output = execFileSync("ioreg", ["-rd1", "-c", "IOPlatformExpertDevice"], { stdio: ["ignore", "pipe", "pipe"], encoding: "utf8" });
+            return parseMacPlatformUuid(output);
+        }
+    }
+    catch {
+        return undefined;
+    }
+    return undefined;
+}
+let cached;
+export function resolveDeviceFingerprint(fallbackId) {
+    if (cached)
+        return cached;
+    cached = formatDeviceFingerprint({
+        osMachineId: readOsMachineId(),
+        platform: process.platform,
+        fallbackId,
+    });
+    return cached;
+}
+//# sourceMappingURL=device-fingerprint.js.map

package/dist/device-fingerprint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-fingerprint.js","sourceRoot":"","sources":["../src/device-fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAExC,MAAM,UAAU,uBAAuB,CAAC,SAAiB;IACvD,MAAM,KAAK,GAAG,2CAA2C,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1E,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACtD,MAAM,KAAK,GAAG,6CAA6C,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC9E,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAC9D,OAAO,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAIvC;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAClD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAClD,MAAM,QAAQ,GAAG,SAAS,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7F,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnE,OAAO,GAAG,mBAAmB,IAAI,MAAM,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,eAAe,CAAC,WAA4B,OAAO,CAAC,QAAQ;IACnE,IAAI,CAAC;QACH,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,KAAK,MAAM,IAAI,IAAI,CAAC,iBAAiB,EAAE,0BAA0B,CAAC,EAAE,CAAC;gBACnE,IAAI,CAAC;oBACH,MAAM,EAAE,GAAG,mBAAmB,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;oBAC3D,IAAI,EAAE;wBAAE,OAAO,EAAE,CAAC;gBACpB,CAAC;gBAAC,MAAM,CAAC;oBACP,oBAAoB;gBACtB,CAAC;YACH,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,aAAa,CAAC;YAC3E,MAAM,MAAM,GAAG,YAAY,CACzB,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,CAAC,EACjC;gBACE,OAAO;gBACP,yCAAyC;gBACzC,IAAI;gBACJ,aAAa;gBACb,SAAS;aACV,EACD,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAC3E,CAAC;YACF,OAAO,uBAAuB,CAAC,MAAM,CAAC,CAAC;QACzC,CAAC;QAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,YAAY,CACzB,OAAO,EACP,CAAC,MAAM,EAAE,IAAI,EAAE,wBAAwB,CAAC,EACxC,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CACxD,CAAC;YACF,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,IAAI,MAA0B,CAAC;AAE/B,MAAM,UAAU,wBAAwB,CAAC,UAAmB;IAC1D,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,GAAG,uBAAuB,CAAC;QAC/B,WAAW,EAAE,eAAe,EAAE;QAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU;KACX,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/generated/env-config.js

@@ -18,6 +18,8 @@ export const BAKED_ENV = {
     "solanaRpcUrl": "https://api.mainnet-beta.solana.com",
     "tonApiUrl": "https://toncenter.com/api/v2",
     "xrpRpcUrl": "https://xrplcluster.com",
-    "bitcoinTestnet": false
+    "bitcoinTestnet": false,
+    "ratesApiUrl": "https://rates.iwio.app",
+    "staticResourcesUrl": "https://resources.iwio.app/Ironwallet"
 };
 //# sourceMappingURL=env-config.js.map

package/dist/generated/env-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"env-config.js","sourceRoot":"","sources":["../../src/generated/env-config.ts"],"names":[],"mappings":"AAKA,MAAM,CAAC,MAAM,SAAS,GAAoB;IACxC,SAAS,EAAE,uBAAuB;IAClC,UAAU,EAAE,0BAA0B;IACtC,cAAc,EAAE,kBAAkB;IAClC,YAAY,EAAE;QACZ,UAAU,EAAE,qCAAqC;QACjD,KAAK,EAAE,gCAAgC;QACvC,SAAS,EAAE,wCAAwC;QACnD,MAAM,EAAE,iCAAiC;QACzC,UAAU,EAAE,yCAAyC;QACrD,UAAU,EAAE,qCAAqC;QACjD,WAAW,EAAE,8CAA8C;KAC5D;IACD,YAAY,EAAE,yBAAyB;IACvC,eAAe,EAAE,8BAA8B;IAC/C,gBAAgB,EAAE,+BAA+B;IACjD,YAAY,EAAE,0CAA0C;IACxD,cAAc,EAAE,qCAAqC;IACrD,WAAW,EAAE,8BAA8B;IAC3C,WAAW,EAAE,yBAAyB;IACtC,gBAAgB,EAAE,KAAK;CACf,CAAC"}
+{"version":3,"file":"env-config.js","sourceRoot":"","sources":["../../src/generated/env-config.ts"],"names":[],"mappings":"AAKA,MAAM,CAAC,MAAM,SAAS,GAAoB;IACxC,SAAS,EAAE,uBAAuB;IAClC,UAAU,EAAE,0BAA0B;IACtC,cAAc,EAAE,kBAAkB;IAClC,YAAY,EAAE;QACZ,UAAU,EAAE,qCAAqC;QACjD,KAAK,EAAE,gCAAgC;QACvC,SAAS,EAAE,wCAAwC;QACnD,MAAM,EAAE,iCAAiC;QACzC,UAAU,EAAE,yCAAyC;QACrD,UAAU,EAAE,qCAAqC;QACjD,WAAW,EAAE,8CAA8C;KAC5D;IACD,YAAY,EAAE,yBAAyB;IACvC,eAAe,EAAE,8BAA8B;IAC/C,gBAAgB,EAAE,+BAA+B;IACjD,YAAY,EAAE,0CAA0C;IACxD,cAAc,EAAE,qCAAqC;IACrD,WAAW,EAAE,8BAA8B;IAC3C,WAAW,EAAE,yBAAyB;IACtC,gBAAgB,EAAE,KAAK;IACvB,aAAa,EAAE,wBAAwB;IACvC,oBAAoB,EAAE,uCAAuC;CACrD,CAAC"}

package/dist/generated/env-profile.d.ts

@@ -3,6 +3,10 @@ export interface BakedEnvProfile {
     authUrl: string;
     relayUrl: string;
     swapProxyUrl: string;
+    /** Rates API host (`/api/v1/rate/*`). Optional until configurations ships it. */
+    ratesApiUrl?: string;
+    /** Static resources base for asset catalogs (`/assets/main/blockchains/...`). */
+    staticResourcesUrl?: string;
     evmRpcUrls: Record<string, string>;
     tronApiUrl: string;
     bitcoinApiUrl: string;

package/dist/keystore/store.js

@@ -4,9 +4,10 @@
  * signing; they are never returned to callers of these functions except the
  * local browser wallet manager.
  */
-import { mkdirSync, readFileSync, writeFileSync, existsSync, chmodSync, } from "node:fs";
+import { mkdirSync, readFileSync, writeFileSync, existsSync } from "node:fs";
 import { join } from "node:path";
 import { getConfig } from "../config.js";
+import { restrictPrivateFile } from "../restrict-private-file.js";
 import { encryptSecret, decryptSecret } from "./crypto.js";
 import { deriveAddresses, newMnemonic, isValidMnemonic, } from "../wallet/derive.js";
 import { logDebug, logError, logInfo } from "../log.js";
@@ -41,12 +42,7 @@ function saveKeystore(ks) {
     ensureDir();
     const path = keystorePath();
     writeFileSync(path, JSON.stringify(ks, null, 2), { mode: 0o600 });
-    try {
-        chmodSync(path, 0o600);
-    }
-    catch {
-        // best effort on platforms without POSIX perms
-    }
+    restrictPrivateFile(path);
     logInfo("keystore.save", {
         path,
         walletCount: ks.wallets.length,

package/dist/keystore/store.js.map

@@ -1 +1 @@
-{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/keystore/store.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,SAAS,EACT,YAAY,EACZ,aAAa,EACb,UAAU,EACV,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE3D,OAAO,EACL,eAAe,EACf,WAAW,EACX,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAExD,SAAS,YAAY;IACnB,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,SAAS;IAChB,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC,WAAW,CAAC;IACpC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;IAC5B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,QAAQ,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC;QACnE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACrC,CAAC;IACD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiB,CAAC;IAC/C,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,iCAAiC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,QAAQ,CAAC,eAAe,EAAE;QACxB,IAAI;QACJ,MAAM,EAAE,IAAI;QACZ,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;QAClC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;KACzC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,EAAgB;IACpC,SAAS,EAAE,CAAC;IACZ,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;IAC5B,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,IAAI,CAAC;QACH,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,+CAA+C;IACjD,CAAC;IACD,OAAO,CAAC,eAAe,EAAE;QACvB,IAAI;QACJ,WAAW,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM;QAC9B,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;KACrC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,OAAO,YAAY,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,OAAO,YAAY,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AAC7D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,IAAa;IACxC,MAAM,EAAE,GAAG,YAAY,EAAE,CAAC;IAC1B,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,cAAc,CAAC,CAAC;QAC3D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAClD,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,KAAK,CACb,2BAA2B,EAAE,CAAC,OAAO;SAClC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SAClB,IAAI,CAAC,IAAI,CAAC,mDAAmD,CACjE,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,QAAqB;IACrD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,QAAQ,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;QAAE,CAAC,EAAE,CAAC;IACzC,OAAO,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;AACxB,CAAC;AASD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,KAAa,EACb,UAAkB,EAClB,OAA0D,EAAE;IAE5D,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,CAAC,+BAA+B,EAAE;QACvC,KAAK;QACL,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC;KAC7C,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,YAAY,EAAE,CAAC;IAC1B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,IAAI,QAAQ,CAAC;IAC3C,MAAM,OAAO,GAAoB,EAAE,CAAC;IAEpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,SAAS,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,UAAU,CACrB,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,QAAQ,CAAC,IAAI,GAAG,CAAC,EAAE,EAC1E,QAAQ,CACT,CAAC;QACF,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnB,MAAM,KAAK,GAAgB;YACzB,IAAI;YACJ,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE,UAAU,CAAC;YAC5C,SAAS;YACT,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QACF,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC;YACX,IAAI;YACJ,SAAS;YACT,QAAQ,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;SACrD,CAAC,CAAC;IACL,CAAC;IACD,YAAY,CAAC,EAAE,CAAC,CAAC;IACjB,OAAO,CAAC,4BAA4B,EAAE;QACpC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;KACxE,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,YAAY,CAC1B,QAAgB,EAChB,UAAkB,EAClB,IAAa;IAEb,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,QAAQ,CAAC,sBAAsB,EAAE,IAAI,KAAK,CAAC,0BAA0B,CAAC,EAAE;YACtE,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;QACH,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,EAAE,GAAG,YAAY,EAAE,CAAC;IAC1B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,IAAI,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAgB;QACzB,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC;QAC3C,SAAS;QACT,QAAQ,EAAE,IAAI,EAAE,+BAA+B;QAC/C,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IACF,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvB,YAAY,CAAC,EAAE,CAAC,CAAC;IACjB,OAAO,CAAC,oBAAoB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;IAC9D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AACxC,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,UAAkB;IAC7D,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,cAAc,CAAC,CAAC;IAC3D,OAAO,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAClD,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,cAAc,CAAC,KAAkB,EAAE,UAAkB;IACnE,OAAO,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,KAAkB,EAAE,QAAgB;IAChE,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,MAAM,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;IACtC,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACjB,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;YACnB,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,EAAE,GAAG,YAAY,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7D,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IACpD,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,CAAC,CAAC;IACjB,OAAO,CAAC,yBAAyB,EAAE;QACjC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;KAC7D,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,EAAE,GAAG,YAAY,EAAE,CAAC;IAC1B,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,cAAc,CAAC,CAAC;IAC3D,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;IACtB,YAAY,CAAC,EAAE,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,EAAE,GAAG,YAAY,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IACjC,EAAE,CAAC,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACvD,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,cAAc,CAAC,CAAC;IACjF,YAAY,CAAC,EAAE,CAAC,CAAC;IACjB,OAAO,CAAC,oBAAoB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,MAAoB;IAC1D,MAAM,EAAE,GAAG,YAAY,EAAE,CAAC;IAC1B,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,cAAc,CAAC,CAAC;IAC3D,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,CAAC,CAAC;AACnB,CAAC"}
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/keystore/store.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE3D,OAAO,EACL,eAAe,EACf,WAAW,EACX,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAExD,SAAS,YAAY;IACnB,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,SAAS;IAChB,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC,WAAW,CAAC;IACpC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;IAC5B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,QAAQ,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC;QACnE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACrC,CAAC;IACD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiB,CAAC;IAC/C,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,iCAAiC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,QAAQ,CAAC,eAAe,EAAE;QACxB,IAAI;QACJ,MAAM,EAAE,IAAI;QACZ,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;QAClC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;KACzC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,EAAgB;IACpC,SAAS,EAAE,CAAC;IACZ,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;IAC5B,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC1B,OAAO,CAAC,eAAe,EAAE;QACvB,IAAI;QACJ,WAAW,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM;QAC9B,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;KACrC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,OAAO,YAAY,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,OAAO,YAAY,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AAC7D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,IAAa;IACxC,MAAM,EAAE,GAAG,YAAY,EAAE,CAAC;IAC1B,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,cAAc,CAAC,CAAC;QAC3D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAClD,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,KAAK,CACb,2BAA2B,EAAE,CAAC,OAAO;SAClC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SAClB,IAAI,CAAC,IAAI,CAAC,mDAAmD,CACjE,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,QAAqB;IACrD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,QAAQ,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;QAAE,CAAC,EAAE,CAAC;IACzC,OAAO,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;AACxB,CAAC;AASD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,KAAa,EACb,UAAkB,EAClB,OAA0D,EAAE;IAE5D,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,CAAC,+BAA+B,EAAE;QACvC,KAAK;QACL,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC;KAC7C,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,YAAY,EAAE,CAAC;IAC1B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,IAAI,QAAQ,CAAC;IAC3C,MAAM,OAAO,GAAoB,EAAE,CAAC;IAEpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,SAAS,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,UAAU,CACrB,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,QAAQ,CAAC,IAAI,GAAG,CAAC,EAAE,EAC1E,QAAQ,CACT,CAAC;QACF,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnB,MAAM,KAAK,GAAgB;YACzB,IAAI;YACJ,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE,UAAU,CAAC;YAC5C,SAAS;YACT,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QACF,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC;YACX,IAAI;YACJ,SAAS;YACT,QAAQ,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;SACrD,CAAC,CAAC;IACL,CAAC;IACD,YAAY,CAAC,EAAE,CAAC,CAAC;IACjB,OAAO,CAAC,4BAA4B,EAAE;QACpC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;KACxE,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,YAAY,CAC1B,QAAgB,EAChB,UAAkB,EAClB,IAAa;IAEb,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,QAAQ,CAAC,sBAAsB,EAAE,IAAI,KAAK,CAAC,0BAA0B,CAAC,EAAE;YACtE,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;QACH,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,EAAE,GAAG,YAAY,EAAE,CAAC;IAC1B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,IAAI,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAgB;QACzB,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC;QAC3C,SAAS;QACT,QAAQ,EAAE,IAAI,EAAE,+BAA+B;QAC/C,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IACF,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvB,YAAY,CAAC,EAAE,CAAC,CAAC;IACjB,OAAO,CAAC,oBAAoB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;IAC9D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AACxC,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,UAAkB;IAC7D,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,cAAc,CAAC,CAAC;IAC3D,OAAO,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAClD,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,cAAc,CAAC,KAAkB,EAAE,UAAkB;IACnE,OAAO,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,KAAkB,EAAE,QAAgB;IAChE,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,MAAM,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;IACtC,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACjB,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;YACnB,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,EAAE,GAAG,YAAY,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7D,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IACpD,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,CAAC,CAAC;IACjB,OAAO,CAAC,yBAAyB,EAAE;QACjC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;KAC7D,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,EAAE,GAAG,YAAY,EAAE,CAAC;IAC1B,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,cAAc,CAAC,CAAC;IAC3D,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;IACtB,YAAY,CAAC,EAAE,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,EAAE,GAAG,YAAY,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IACjC,EAAE,CAAC,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACvD,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,cAAc,CAAC,CAAC;IACjF,YAAY,CAAC,EAAE,CAAC,CAAC;IACjB,OAAO,CAAC,oBAAoB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,MAAoB;IAC1D,MAAM,EAAE,GAAG,YAAY,EAAE,CAAC;IAC1B,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,cAAc,CAAC,CAAC;IAC3D,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,CAAC,CAAC;AACnB,CAAC"}

package/dist/keystore/types.d.ts

@@ -4,11 +4,16 @@ export interface WalletPolicy {
     enabled: boolean;
     /** If true, send_transfer and execute_swap are rejected. */
     readOnly?: boolean;
-    /** Max amount per send_transfer or execute_swap (decimal string, asset units). */
-    maxPerTx?: string;
+    /**
+     * Max USD value per send_transfer or execute_swap (decimal string, e.g. "50").
+     * Converted at the moment of the operation via the rates backend; if the rate
+     * is unavailable the operation is rejected (fail closed).
+     */
+    maxPerTxUsd?: string;
     /**
      * Allowed transfer destinations. Empty/undefined = no whitelist.
-     * When set, execute_swap is rejected (swap routers are not on this list).
+     * Applies to send_transfer only; execute_swap is exempt because the bought
+     * asset is always paid out to the wallet's own keystore address.
      */
     allowedRecipients?: string[];
 }

package/dist/local-secrets.d.ts

@@ -1,6 +1,6 @@
 /**
  * Machine-local secrets and install identity. Generated on first use and stored
- * under the keystore directory (0600). Not written to User env, mcp.json, or
+ * under the keystore directory (owner-only). Not written to User env, mcp.json, or
  * the plugin dashboard.
  *
  * Env vars still win when set to a real value. Unexpanded `${VAR}` placeholders
@@ -8,7 +8,7 @@
  */
 export declare function resolveKeystoreDir(): string;
 export declare function isUnsetSecret(value: string | undefined): boolean;
-/** x-api-key for Relay / Swap Proxy. UUID, stable per machine directory. */
+/** x-api-key for relay and swap APIs. UUID, stable per machine directory. */
 export declare function resolveRelayApiKey(): string;
 /** Keystore wrapping secret. Not the recovery phrase. */
 export declare function resolveKeystorePassphrase(): string;

package/dist/local-secrets.js

@@ -1,14 +1,15 @@
 /**
  * Machine-local secrets and install identity. Generated on first use and stored
- * under the keystore directory (0600). Not written to User env, mcp.json, or
+ * under the keystore directory (owner-only). Not written to User env, mcp.json, or
  * the plugin dashboard.
  *
  * Env vars still win when set to a real value. Unexpanded `${VAR}` placeholders
  * (Claude Code when the shell var is missing) are treated as unset.
  */
-import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync, } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { randomBytes, randomUUID } from "node:crypto";
+import { restrictPrivateFile } from "./restrict-private-file.js";
 const RELAY_KEY_FILE = "relay-api-key";
 const PASSPHRASE_FILE = "keystore-passphrase";
 const DEVICE_ID_FILE = "device-id";
@@ -41,15 +42,10 @@ function readOrCreate(filename, generate) {
     }
     const value = generate();
     writeFileSync(path, `${value}\n`, { mode: 0o600 });
-    try {
-        chmodSync(path, 0o600);
-    }
-    catch {
-        // best effort on platforms without POSIX perms
-    }
+    restrictPrivateFile(path);
     return value;
 }
-/** x-api-key for Relay / Swap Proxy. UUID, stable per machine directory. */
+/** x-api-key for relay and swap APIs. UUID, stable per machine directory. */
 export function resolveRelayApiKey() {
     const fromEnv = process.env.IW_RELAY_API_KEY;
     if (!isUnsetSecret(fromEnv))

package/dist/local-secrets.js.map

@@ -1 +1 @@
-{"version":3,"file":"local-secrets.js","sourceRoot":"","sources":["../src/local-secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,YAAY,EACZ,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEtD,MAAM,cAAc,GAAG,eAAe,CAAC;AACvC,MAAM,eAAe,GAAG,qBAAqB,CAAC;AAC9C,MAAM,cAAc,GAAG,WAAW,CAAC;AAEnC,MAAM,UAAU,kBAAkB;IAChC,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IACpE,MAAM,IAAI,GACR,OAAO,CAAC,GAAG,CAAC,IAAI;QAChB,OAAO,CAAC,GAAG,CAAC,WAAW;QACvB,OAAO,CAAC,GAAG,CAAC,QAAQ;QACpB,GAAG,CAAC;IACN,OAAO,GAAG,IAAI,kBAAkB,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAyB;IACrD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,gCAAgC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB,EAAE,QAAsB;IAC5D,MAAM,GAAG,GAAG,kBAAkB,EAAE,CAAC;IACjC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACjC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACnD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;YAAE,OAAO,QAAQ,CAAC;IACvE,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;IACzB,aAAa,CAAC,IAAI,EAAE,GAAG,KAAK,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,IAAI,CAAC;QACH,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,+CAA+C;IACjD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,kBAAkB;IAChC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC7C,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;QAAE,OAAO,OAAQ,CAAC,IAAI,EAAE,CAAC;IACpD,OAAO,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,yBAAyB;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IAC1C,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;QAAE,OAAO,OAAQ,CAAC,IAAI,EAAE,CAAC;IACpD,OAAO,YAAY,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,eAAe;IAC7B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IACzC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;QAAE,OAAO,OAAQ,CAAC,IAAI,EAAE,CAAC;IACpD,OAAO,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;AAC1D,CAAC"}
+{"version":3,"file":"local-secrets.js","sourceRoot":"","sources":["../src/local-secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,MAAM,cAAc,GAAG,eAAe,CAAC;AACvC,MAAM,eAAe,GAAG,qBAAqB,CAAC;AAC9C,MAAM,cAAc,GAAG,WAAW,CAAC;AAEnC,MAAM,UAAU,kBAAkB;IAChC,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IACpE,MAAM,IAAI,GACR,OAAO,CAAC,GAAG,CAAC,IAAI;QAChB,OAAO,CAAC,GAAG,CAAC,WAAW;QACvB,OAAO,CAAC,GAAG,CAAC,QAAQ;QACpB,GAAG,CAAC;IACN,OAAO,GAAG,IAAI,kBAAkB,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAyB;IACrD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,gCAAgC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB,EAAE,QAAsB;IAC5D,MAAM,GAAG,GAAG,kBAAkB,EAAE,CAAC;IACjC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACjC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACnD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;YAAE,OAAO,QAAQ,CAAC;IACvE,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;IACzB,aAAa,CAAC,IAAI,EAAE,GAAG,KAAK,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC1B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,kBAAkB;IAChC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC7C,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;QAAE,OAAO,OAAQ,CAAC,IAAI,EAAE,CAAC;IACpD,OAAO,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,yBAAyB;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IAC1C,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;QAAE,OAAO,OAAQ,CAAC,IAAI,EAAE,CAAC;IACpD,OAAO,YAAY,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,eAAe;IAC7B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IACzC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;QAAE,OAAO,OAAQ,CAAC,IAAI,EAAE,CAAC;IACpD,OAAO,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;AAC1D,CAAC"}

package/dist/networks.d.ts

@@ -0,0 +1,5 @@
+/** Canonical network identifiers used across the server. No baked env. */
+export declare const EVM_NETWORKS: readonly ["ethereum", "bsc", "polygon", "base", "arbitrum", "optimism", "avalanche"];
+export declare const NON_EVM_NETWORKS: readonly ["tron", "bitcoin", "litecoin", "doge", "solana", "ton", "xrp"];
+export declare const ALL_NETWORKS: readonly ["ethereum", "bsc", "polygon", "base", "arbitrum", "optimism", "avalanche", "tron", "bitcoin", "litecoin", "doge", "solana", "ton", "xrp"];
+export type NetworkId = (typeof ALL_NETWORKS)[number];

package/dist/networks.js

@@ -0,0 +1,21 @@
+/** Canonical network identifiers used across the server. No baked env. */
+export const EVM_NETWORKS = [
+    "ethereum",
+    "bsc",
+    "polygon",
+    "base",
+    "arbitrum",
+    "optimism",
+    "avalanche",
+];
+export const NON_EVM_NETWORKS = [
+    "tron",
+    "bitcoin",
+    "litecoin",
+    "doge",
+    "solana",
+    "ton",
+    "xrp",
+];
+export const ALL_NETWORKS = [...EVM_NETWORKS, ...NON_EVM_NETWORKS];
+//# sourceMappingURL=networks.js.map

package/dist/networks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"networks.js","sourceRoot":"","sources":["../src/networks.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAE1E,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,UAAU;IACV,KAAK;IACL,SAAS;IACT,MAAM;IACN,UAAU;IACV,UAAU;IACV,WAAW;CACH,CAAC;AAEX,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,MAAM;IACN,SAAS;IACT,UAAU;IACV,MAAM;IACN,QAAQ;IACR,KAAK;IACL,KAAK;CACG,CAAC;AAEX,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAG,YAAY,EAAE,GAAG,gBAAgB,CAAU,CAAC"}

package/dist/policy.d.ts

@@ -1,24 +1,54 @@
 /**
  * Optional per-wallet spending policy. Disabled by default (sends autonomously).
  * When `policy.enabled` is set, both `send_transfer` and `execute_swap` check it
- * before signing.
+ * before signing. `maxPerTxUsd` converts the amount via the rates backend at the
+ * moment of the operation and fails closed when no rate is available.
  */
 import type { WalletEntry, WalletPolicy } from "./keystore/types.js";
 import type { NetworkId } from "./config.js";
 export interface PolicyCheck {
     kind: "transfer" | "swap";
     network: NetworkId;
-    /** Decimal string in asset units. Required to enforce `maxPerTx`. */
-    amount?: string;
     /** Transfer destination. Ignored for swaps. */
     toAddress?: string;
 }
+export interface UsdLimitCheck {
+    kind: "transfer" | "swap";
+    network: NetworkId;
+    /** Decimal string in asset units (final amount that will be signed). */
+    amount: string;
+    /** Asset symbol, used for catalog fallback matching and messages. */
+    symbol?: string;
+    /** Token contract. Omit for the native coin. */
+    tokenAddress?: string;
+    correlationId?: string;
+}
 /**
  * Compare two non-negative decimal strings without floating point.
  * Returns < 0 if a < b, 0 if equal, > 0 if a > b.
  */
 export declare function compareDecimalAmount(a: string, b: string): number;
+/** Render a float (e.g. a JSON rate) as a plain decimal string, no exponent. */
+export declare function numberToDecimalString(n: number): string;
+/** Multiply two non-negative decimal strings exactly (BigInt, no float). */
+export declare function multiplyDecimalAmounts(a: string, b: string): string;
 /** Always-present policy for `list_wallets` (`enabled: false` when unset). */
 export declare function listWalletPolicy(policy: WalletPolicy | undefined): WalletPolicy;
 /** Throws with a clear message if the operation violates the wallet policy. */
 export declare function enforcePolicy(entry: WalletEntry, check: PolicyCheck): void;
+/** Pure part of the USD check: amount × rate vs limit. Throws on violation. */
+export declare function assertUsdWithinLimit(opts: {
+    wallet: string;
+    kind: "transfer" | "swap";
+    amount: string;
+    rate: number;
+    maxPerTxUsd: string;
+    assetLabel: string;
+}): {
+    usdValue: string;
+};
+/**
+ * Enforce `maxPerTxUsd` right before signing. Fail closed: if the limit is set
+ * and the USD rate cannot be resolved, the operation is rejected.
+ */
+export declare function enforceUsdLimit(entry: WalletEntry, check: UsdLimitCheck): Promise<void>;