@trustwallet/cli 0.20.0 → 0.21.0

package/dist/index.js

@@ -1046,8 +1046,8 @@ var require_command = __commonJS({
     "use strict";
     var EventEmitter = require("events").EventEmitter;
     var childProcess = require("child_process");
-    var path5 = require("path");
-    var fs7 = require("fs");
+    var path7 = require("path");
+    var fs10 = require("fs");
     var process3 = require("process");
     var { Argument: Argument2, humanReadableArgName } = require_argument();
     var { CommanderError: CommanderError2 } = require_error();
@@ -1979,11 +1979,11 @@ Expecting one of '${allowedValues.join("', '")}'`);
         let launchWithNode = false;
         const sourceExt = [".js", ".ts", ".tsx", ".mjs", ".cjs"];
         function findFile(baseDir, baseName) {
-          const localBin = path5.resolve(baseDir, baseName);
-          if (fs7.existsSync(localBin)) return localBin;
-          if (sourceExt.includes(path5.extname(baseName))) return void 0;
+          const localBin = path7.resolve(baseDir, baseName);
+          if (fs10.existsSync(localBin)) return localBin;
+          if (sourceExt.includes(path7.extname(baseName))) return void 0;
           const foundExt = sourceExt.find(
-            (ext) => fs7.existsSync(`${localBin}${ext}`)
+            (ext) => fs10.existsSync(`${localBin}${ext}`)
           );
           if (foundExt) return `${localBin}${foundExt}`;
           return void 0;
@@ -1995,21 +1995,21 @@ Expecting one of '${allowedValues.join("', '")}'`);
         if (this._scriptPath) {
           let resolvedScriptPath;
           try {
-            resolvedScriptPath = fs7.realpathSync(this._scriptPath);
+            resolvedScriptPath = fs10.realpathSync(this._scriptPath);
           } catch (err) {
             resolvedScriptPath = this._scriptPath;
           }
-          executableDir = path5.resolve(
-            path5.dirname(resolvedScriptPath),
+          executableDir = path7.resolve(
+            path7.dirname(resolvedScriptPath),
             executableDir
           );
         }
         if (executableDir) {
           let localFile = findFile(executableDir, executableFile);
           if (!localFile && !subcommand._executableFile && this._scriptPath) {
-            const legacyName = path5.basename(
+            const legacyName = path7.basename(
               this._scriptPath,
-              path5.extname(this._scriptPath)
+              path7.extname(this._scriptPath)
             );
             if (legacyName !== this._name) {
               localFile = findFile(
@@ -2020,7 +2020,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
           }
           executableFile = localFile || executableFile;
         }
-        launchWithNode = sourceExt.includes(path5.extname(executableFile));
+        launchWithNode = sourceExt.includes(path7.extname(executableFile));
         let proc;
         if (process3.platform !== "win32") {
           if (launchWithNode) {
@@ -2860,7 +2860,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @return {Command}
        */
       nameFromFilename(filename) {
-        this._name = path5.basename(filename, path5.extname(filename));
+        this._name = path7.basename(filename, path7.extname(filename));
         return this;
       }
       /**
@@ -2874,9 +2874,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {string} [path]
        * @return {(string|null|Command)}
        */
-      executableDir(path6) {
-        if (path6 === void 0) return this._executableDir;
-        this._executableDir = path6;
+      executableDir(path8) {
+        if (path8 === void 0) return this._executableDir;
+        this._executableDir = path8;
         return this;
       }
       /**
@@ -3158,6 +3158,7 @@ __export(dist_exports, {
   coinTypeToChainKey: () => coinTypeToChainKey,
   createTwakClient: () => createTwakClient,
   encodeErc20Transfer: () => encodeErc20Transfer,
+  errorMessage: () => errorMessage,
   fetchBalance: () => fetchBalance,
   fetchBalances: () => fetchBalances,
   formatAmount: () => formatAmount,
@@ -3315,6 +3316,20 @@ function getSupportedCoinTypes() {
 function isCoinTypeSupported(coinType) {
   return Object.values(CHAINS).some((chain2) => chain2.coinId === coinType);
 }
+function errorMessage(err) {
+  if (err instanceof Error) return err.message;
+  if (typeof err === "string") return err;
+  if (err && typeof err === "object") {
+    const { message } = err;
+    if (typeof message === "string") return message;
+    try {
+      const json = JSON.stringify(err);
+      if (typeof json === "string") return json;
+    } catch {
+    }
+  }
+  return String(err);
+}
 function classifyApiError(err) {
   if (err instanceof TwakApiError) {
     const status = err.statusCode;
@@ -3357,7 +3372,7 @@ function classifyStorageError(err) {
       syscall
     );
     if (isFsByCode || isFsBySyscall) {
-      const msg = err instanceof Error ? err.message : String(err);
+      const msg = errorMessage(err);
       return { code: "STORAGE_ERROR", message: msg };
     }
   }
@@ -3367,7 +3382,7 @@ function classifyStorageError(err) {
   return null;
 }
 function classifyWalletLoadError(err) {
-  const msg = err instanceof Error ? err.message : String(err);
+  const msg = errorMessage(err);
   if (/no wallet password/i.test(msg)) {
     return { code: "PASSWORD_MISSING", message: msg };
   }
@@ -3678,11 +3693,11 @@ function sortQueryRaw(query) {
   });
   return parts.join("&");
 }
-function signRequest(method, path5, query, accessId, hmacSecret) {
+function signRequest(method, path7, query, accessId, hmacSecret) {
   const date = (/* @__PURE__ */ new Date()).toUTCString();
   const nonce = (0, import_crypto.randomUUID)();
   const sortedQuery = sortQueryRaw(query);
-  const plaintext = [method.toUpperCase(), path5, sortedQuery, accessId, nonce, date].join(";");
+  const plaintext = [method.toUpperCase(), path7, sortedQuery, accessId, nonce, date].join(";");
   const signature = (0, import_crypto.createHmac)("sha256", hmacSecret).update(plaintext).digest("base64");
   return {
     "X-TW-CREDENTIAL": accessId,
@@ -4329,7 +4344,13 @@ var init_dist = __esm({
       // Raised by signing-path action providers when no wallet mode has been
       // selected yet for this server lifetime. Actionable: agent calls
       // switch_wallet_mode (local or walletconnect) and retries.
-      WALLET_NOT_BOUND: "WALLET_NOT_BOUND"
+      WALLET_NOT_BOUND: "WALLET_NOT_BOUND",
+      // The user declined a signing request in their wallet (WalletConnect).
+      // Not retryable: the agent should ask the user instead of re-sending.
+      USER_REJECTED: "USER_REJECTED",
+      // The connected wallet answered a WalletConnect request with an error other
+      // than a user rejection (e.g. unsupported method, invalid params).
+      WC_REQUEST_FAILED: "WC_REQUEST_FAILED"
     };
     WalletError = class extends CommandError {
       constructor(code2, message) {
@@ -4441,12 +4462,12 @@ var init_dist = __esm({
           ...config
         };
       }
-      async gateway(method, path5, body, query) {
-        const url = new URL(path5, this.config.gatewayBaseUrl);
+      async gateway(method, path7, body, query) {
+        const url = new URL(path7, this.config.gatewayBaseUrl);
         if (query) url.search = query;
         const headers = signRequest(
           method,
-          path5,
+          path7,
           query || "",
           this.config.accessId,
           this.config.hmacSecret
@@ -4461,14 +4482,14 @@ var init_dist = __esm({
           body: body ? JSON.stringify(body) : void 0
         });
       }
-      async amber(method, path5, body) {
-        if (!path5.startsWith("/amber-api/")) {
+      async amber(method, path7, body) {
+        if (!path7.startsWith("/amber-api/")) {
           throw new Error("Amber API path must start with '/amber-api/'.");
         }
-        return this.gateway(method, path5, body);
+        return this.gateway(method, path7, body);
       }
-      async market(method, path5, body) {
-        const url = new URL(path5, this.config.marketBaseUrl);
+      async market(method, path7, body) {
+        const url = new URL(path7, this.config.marketBaseUrl);
         const raw = await this.fetch(url.toString(), {
           method,
           headers: { "Content-Type": "application/json" },
@@ -5803,15 +5824,15 @@ var require_route = __commonJS({
       };
     }
     function wrapConversion(toModel, graph) {
-      const path5 = [graph[toModel].parent, toModel];
+      const path7 = [graph[toModel].parent, toModel];
       let fn2 = conversions[graph[toModel].parent][toModel];
       let cur = graph[toModel].parent;
       while (graph[cur].parent) {
-        path5.unshift(graph[cur].parent);
+        path7.unshift(graph[cur].parent);
         fn2 = link(conversions[graph[cur].parent][cur], fn2);
         cur = graph[cur].parent;
       }
-      fn2.conversion = path5;
+      fn2.conversion = path7;
       return fn2;
     }
     module2.exports = function(fromModel) {
@@ -6976,8 +6997,10 @@ async function initTrustSDK(config) {
         new import_trust_sdk.Node(cfg.rpcUrl)
       );
     } catch (err) {
-      process.stderr.write(`twak: could not register testnet node for ${cfg.id}: ${String(err)}
-`);
+      process.stderr.write(
+        `twak: could not register testnet node for ${cfg.id}: ${errorMessage(err)}
+`
+      );
     }
   }
   initialized = true;
@@ -7269,7 +7292,7 @@ async function verifyCredentials(config) {
   try {
     response = await gatewayFetch("PUT", `/v2/devices/${deviceId}`, config, DEVICE_INFO_BODY);
   } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
+    const message = errorMessage(err);
     throw new VerifyCredentialsError(
       "NETWORK_ERROR",
       `Could not reach Trust Wallet gateway: ${message}`
@@ -8092,10 +8115,11 @@ var init_dist3 = __esm({
             signal: AbortSignal.timeout(timeoutMs)
           });
         } catch (err) {
-          throw new TwakNetworkError(
-            `RPC fetch failed on ${method}: ${err instanceof Error ? err.message : String(err)}`,
-            { method, rpcUrl, timeoutMs }
-          );
+          throw new TwakNetworkError(`RPC fetch failed on ${method}: ${errorMessage(err)}`, {
+            method,
+            rpcUrl,
+            timeoutMs
+          });
         }
         if (!response.ok) {
           const body = await response.text().catch(() => "");
@@ -8112,7 +8136,7 @@ var init_dist3 = __esm({
           json = await response.json();
         } catch (err) {
           throw new TwakNetworkError(
-            `RPC response JSON parse failed on ${method}: ${err instanceof Error ? err.message : String(err)}`,
+            `RPC response JSON parse failed on ${method}: ${errorMessage(err)}`,
             { method, rpcUrl }
           );
         }
@@ -8523,50 +8547,83 @@ var init_dist3 = __esm({
     WalletContext = class {
       _state = "unbound";
       _wallet;
-      /**
-       * The WC instance we're currently pairing with. Used to ignore callbacks
-       * from a previous pairing if the user re-calls `beginWalletConnect` while
-       * already in `wc-pairing` (e.g. the first QR went stale and they want a
-       * fresh one). Without this guard, the first wc's session-established
-       * callback could land later and overwrite `_wallet` with the wrong instance.
-       */
-      _pendingWc;
       _pairing;
       _peerName;
       _lastError;
+      _walletConnectFactory;
+      _wc;
       /**
        * Mode-switch serializer. Concurrent `bindLocal` / `beginWalletConnect` /
-       * `reset` calls otherwise interleave their state writes — `_pendingWc`
-       * identity guards prevent signing-against-wrong-wallet, but `_state` and
-       * `_pairing` can land in an inconsistent shape. We queue each entry so the
+       * `reset` calls otherwise interleave their state writes, leaving `_state`
+       * and `_pairing` in an inconsistent shape. We queue each entry so the
        * second call waits for the first to settle. `.catch(()=>{})` on the field
        * itself keeps a rejected switch from poisoning the queue for later calls
        * (the caller still sees the original rejection via the awaited promise
        * we return from each entry method).
        */
       _switchInflight = Promise.resolve();
+      /** Bumped by every explicit mode switch, so a session restore that
+       * resolves after the user already chose a mode is not bound. */
+      _generation = 0;
+      constructor(options = {}) {
+        this._walletConnectFactory = options.walletConnectFactory;
+      }
+      /** Whether WalletConnect can be used (a project ID was configured). */
+      get walletConnectAvailable() {
+        return this._walletConnectFactory !== void 0;
+      }
       /**
-       * Disconnect any in-flight or established WC session. Used internally when
-       * switching modes and externally by `reset()`. Best-effort — disconnect
-       * failures are swallowed (state still progresses to a clean slot).
-       *
-       * Covers both `wc-connected` (via `_wallet`) and `wc-pairing` (via
-       * `_pendingWc`). Without the pending-wc disconnect, switching away from
-       * `wc-pairing` would leave the relay client open until expiry.
+       * If the peer wallet later revokes the session (user dismisses on their
+       * phone, relay-side expiry, etc.), flip context back to `unbound` so the
+       * next sign attempt surfaces WALLET_NOT_BOUND with a recoverable hint
+       * instead of a deep WC-RPC failure. Only reacts while bound to WC.
        */
-      async disconnectWcIfAny() {
-        const targets = [];
-        if (this._wallet && this._wallet.name === "walletconnect") {
-          targets.push(this._wallet);
-        }
-        if (this._pendingWc && this._pendingWc !== this._wallet) {
-          targets.push(this._pendingWc);
+      handleSessionEnded(reason) {
+        if (!this._wc || this._wallet !== this._wc) return;
+        this._wallet = void 0;
+        this._pairing = void 0;
+        this._peerName = void 0;
+        this._state = "unbound";
+        this._lastError = {
+          code: "WC_NOT_CONNECTED",
+          message: `WalletConnect session ended (${reason}). Call switch_wallet_mode to re-pair or switch to local.`
+        };
+      }
+      /** Bind the approved pairing, unless the user switched away meanwhile. */
+      handleSessionEstablished(session) {
+        if (this._state !== "wc-pairing" || !this._wc) return;
+        this._wallet = this._wc;
+        this._peerName = session.peerName;
+        this._state = "wc-connected";
+        this._pairing = void 0;
+      }
+      /** The process's single WC provider, created on first use. */
+      walletConnect() {
+        if (this._wc) return this._wc;
+        if (!this._walletConnectFactory) {
+          throw new WalletError(
+            "VALIDATION_ERROR",
+            "WalletConnect is not configured: no project ID. Set WALLETCONNECT_PROJECT_ID or run `twak init --wc-project-id <id>`, then restart the server."
+          );
         }
-        for (const t of targets) {
-          try {
-            await t.disconnect();
-          } catch {
-          }
+        const wc3 = this._walletConnectFactory();
+        wc3.onSessionEstablished((session) => this.handleSessionEstablished(session));
+        wc3.onSessionEnded((reason) => this.handleSessionEnded(reason));
+        this._wc = wc3;
+        return wc3;
+      }
+      /**
+       * Revoke the WC session, if a provider was ever used. Covers bound,
+       * pairing and still-restoring sessions alike (the provider waits for an
+       * in-flight init). Bounded: peer notification is time-limited by the
+       * provider and local removal never needs the relay. Best-effort: failures
+       * are swallowed so the switch still lands in a clean state.
+       */
+      async disconnectWcIfAny() {
+        if (!this._wc) return;
+        try {
+          await this._wc.disconnect();
+        } catch {
         }
       }
       get state() {
@@ -8608,102 +8665,101 @@ var init_dist3 = __esm({
         return base3;
       }
       /**
-       * Bind to the local agent wallet. Idempotent for the same provider; when
-       * called while bound to WC (`wc-connected` or `wc-pairing`), the WC session
-       * is disconnected first and any in-flight pairing is invalidated so its
-       * later session-established callback can't reclaim state.
+       * Run `task` after any in-flight mode switch finishes. The returned promise
+       * settles with `task`'s outcome (success or failure). The internal queue
+       * promise always resolves so a failing switch can't block subsequent
+       * switches.
+       */
+      enqueue(task) {
+        const next = this._switchInflight.then(task);
+        this._switchInflight = next.catch(() => void 0);
+        return next;
+      }
+      /**
+       * Bind to the local agent wallet. This is an explicit choice: any WC
+       * session (bound, pairing, or still being restored) is revoked first, so a
+       * restart does not resume it.
        */
       async bindLocal(agent) {
         return this.enqueue(() => this.bindLocalImpl(agent));
       }
       async bindLocalImpl(agent) {
+        this._generation++;
         await this.disconnectWcIfAny();
-        this._pendingWc = void 0;
         this._wallet = agent;
         this._pairing = void 0;
         this._peerName = void 0;
         this._state = "local";
         this._lastError = void 0;
       }
-      /**
-       * Run `task` after any in-flight mode switch finishes. The returned promise
-       * settles with `task`'s outcome (success or failure). The internal queue
-       * promise always resolves so a failing switch can't block subsequent
-       * switches.
-       */
-      enqueue(task) {
-        const next = this._switchInflight.then(task);
-        this._switchInflight = next.catch(() => void 0);
-        return next;
-      }
       /**
        * Start a WalletConnect pairing. Returns the pairing payload immediately;
        * the caller surfaces it (QR code, deep link). When any compatible client
        * approves, the provider's session_established event fires and the context
-       * transitions to `wc-connected`.
-       *
-       * V1 does not restrict the peer wallet — any WC v2 client can pair. The
-       * user's choice to scan the QR is the consent moment. A peer-identity gate
-       * (e.g. Trust-Wallet-only) is deferred until we have a real pairing log to
-       * write it against.
+       * transitions to `wc-connected`. The previous session is revoked first:
+       * asking to pair again expresses the intent to invalidate it.
        *
-       * `wc` is opaque here — we don't import the WalletConnect package directly
-       * to avoid forcing wallet-core to depend on it. The caller (typically the
-       * MCP action provider) constructs the WC provider and passes it in.
+       * V1 does not restrict the peer wallet: any WC v2 client can pair. The
+       * user's choice to scan the QR is the consent moment.
        */
-      async beginWalletConnect(wc3, chains) {
-        return this.enqueue(() => this.beginWalletConnectImpl(wc3, chains));
+      async beginWalletConnect(chains) {
+        return this.enqueue(() => this.beginWalletConnectImpl(chains));
       }
-      async beginWalletConnectImpl(wc3, chains) {
+      async beginWalletConnectImpl(chains) {
+        const wc3 = this.walletConnect();
+        this._generation++;
         await this.disconnectWcIfAny();
         try {
           this._pairing = await wc3.connect(chains);
         } catch (err) {
           this._wallet = void 0;
-          this._pendingWc = void 0;
           this._pairing = void 0;
           this._peerName = void 0;
           this._state = "unbound";
           this._lastError = {
             code: "WC_PAIRING_FAILED",
-            message: `WalletConnect pairing failed: ${err instanceof Error ? err.message : String(err)}`
+            message: `WalletConnect pairing failed: ${errorMessage(err)}`
           };
           throw err;
         }
         this._wallet = void 0;
-        this._pendingWc = wc3;
         this._state = "wc-pairing";
         this._lastError = void 0;
         this._peerName = void 0;
-        wc3.onSessionEstablished((session) => {
-          if (this._pendingWc !== wc3) return;
+        return this.snapshot().pairing;
+      }
+      /**
+       * Bind the WC session persisted by a previous process, if any. Returns
+       * true and moves to `wc-connected` when the provider finds a live session;
+       * leaves the context untouched otherwise (and when WC is not configured).
+       *
+       * Runs outside the mode-switch queue so a switch made meanwhile is never
+       * blocked; that switch wins (the late session is not bound) and, being
+       * explicit, revokes the session through the shared provider.
+       */
+      async restoreWalletConnect() {
+        if (!this.walletConnectAvailable) return false;
+        const generation = this._generation;
+        const wc3 = this.walletConnect();
+        const session = await wc3.restore();
+        return this.enqueue(async () => {
+          if (!session || this._generation !== generation) return false;
           this._wallet = wc3;
+          this._pairing = void 0;
           this._peerName = session.peerName;
           this._state = "wc-connected";
-          this._pendingWc = void 0;
-          this._pairing = void 0;
-        });
-        wc3.onSessionEnded((reason) => {
-          if (this._wallet !== wc3) return;
-          this._wallet = void 0;
-          this._pairing = void 0;
-          this._peerName = void 0;
-          this._state = "unbound";
-          this._lastError = {
-            code: "WC_NOT_CONNECTED",
-            message: `WalletConnect session ended (${reason}). Call switch_wallet_mode to re-pair or switch to local.`
-          };
+          this._lastError = void 0;
+          return true;
         });
-        return this.snapshot().pairing;
       }
-      /** Disconnect the active wallet (best-effort) and return to `unbound`. */
+      /** Revoke any WC session (best-effort) and return to `unbound`. */
       async reset() {
         return this.enqueue(() => this.resetImpl());
       }
       async resetImpl() {
+        this._generation++;
         await this.disconnectWcIfAny();
         this._wallet = void 0;
-        this._pendingWc = void 0;
         this._pairing = void 0;
         this._peerName = void 0;
         this._state = "unbound";
@@ -9317,9 +9373,9 @@ var require_cjs3 = __commonJS({
                   if (href.indexOf("/") === 0) {
                     absoluteHref += href;
                   } else {
-                    const path5 = loc.pathname.split("/");
-                    path5.pop();
-                    const finalPath = path5.join("/");
+                    const path7 = loc.pathname.split("/");
+                    path7.pop();
+                    const finalPath = path7.join("/");
                     absoluteHref += finalPath + "/" + href;
                   }
                   icons2.push(absoluteHref);
@@ -12179,7 +12235,7 @@ var require_websocket = __commonJS({
     var http2 = require("http");
     var net = require("net");
     var tls = require("tls");
-    var { randomBytes: randomBytes7, createHash: createHash2 } = require("crypto");
+    var { randomBytes: randomBytes8, createHash: createHash2 } = require("crypto");
     var { Readable } = require("stream");
     var { URL: URL2 } = require("url");
     var PerMessageDeflate = require_permessage_deflate();
@@ -12639,7 +12695,7 @@ var require_websocket = __commonJS({
       }
       const isSecure = parsedUrl.protocol === "wss:" || parsedUrl.protocol === "https:";
       const defaultPort = isSecure ? 443 : 80;
-      const key = randomBytes7(16).toString("base64");
+      const key = randomBytes8(16).toString("base64");
       const get2 = isSecure ? https2.get : http2.get;
       let perMessageDeflate;
       opts.createConnection = isSecure ? tlsConnect : netConnect;
@@ -16261,15 +16317,15 @@ var dapps_service_exports = {};
 __export(dapps_service_exports, {
   DappsService: () => DappsService
 });
-var fs5, path3, os3, CACHE_FILE, CACHE_TTL_MS, DappsService;
+var fs7, path5, os3, CACHE_FILE, CACHE_TTL_MS, DappsService;
 var init_dapps_service = __esm({
   "../security/dist/services/dapps-service.mjs"() {
     "use strict";
-    fs5 = __toESM(require("fs"), 1);
-    path3 = __toESM(require("path"), 1);
+    fs7 = __toESM(require("fs"), 1);
+    path5 = __toESM(require("path"), 1);
     os3 = __toESM(require("os"), 1);
     init_dist();
-    CACHE_FILE = path3.join(os3.homedir(), ".twak", "dapps-cache.json");
+    CACHE_FILE = path5.join(os3.homedir(), ".twak", "dapps-cache.json");
     CACHE_TTL_MS = 6 * 36e5;
     DappsService = class {
       protocols = null;
@@ -16286,9 +16342,7 @@ var init_dapps_service = __esm({
             signal: AbortSignal.timeout(15e3)
           });
         } catch (e2) {
-          throw new TwakNetworkError(
-            `DeFi Llama unreachable: ${e2 instanceof Error ? e2.message : String(e2)}`
-          );
+          throw new TwakNetworkError(`DeFi Llama unreachable: ${errorMessage(e2)}`);
         }
         if (!resp.ok) {
           throw new TwakApiError(`DeFi Llama API error: ${resp.status}`, resp.status);
@@ -16337,7 +16391,7 @@ var init_dapps_service = __esm({
       }
       readCache() {
         try {
-          const raw = fs5.readFileSync(CACHE_FILE, "utf-8");
+          const raw = fs7.readFileSync(CACHE_FILE, "utf-8");
           const data = JSON.parse(raw);
           if (Date.now() - data.fetchedAt < CACHE_TTL_MS) {
             return data.protocols;
@@ -16348,10 +16402,10 @@ var init_dapps_service = __esm({
       }
       writeCache(protocols) {
         try {
-          const dir = path3.dirname(CACHE_FILE);
-          fs5.mkdirSync(dir, { recursive: true });
+          const dir = path5.dirname(CACHE_FILE);
+          fs7.mkdirSync(dir, { recursive: true });
           const data = { fetchedAt: Date.now(), protocols };
-          fs5.writeFileSync(CACHE_FILE, JSON.stringify(data));
+          fs7.writeFileSync(CACHE_FILE, JSON.stringify(data));
         } catch {
         }
       }
@@ -19552,8 +19606,8 @@ var require_utils2 = __commonJS({
       }
       return ind;
     }
-    function removeDotSegments(path5) {
-      let input2 = path5;
+    function removeDotSegments(path7) {
+      let input2 = path7;
       const output2 = [];
       let nextSlash = -1;
       let len = 0;
@@ -19752,8 +19806,8 @@ var require_schemes = __commonJS({
         wsComponent.secure = void 0;
       }
       if (wsComponent.resourceName) {
-        const [path5, query] = wsComponent.resourceName.split("?");
-        wsComponent.path = path5 && path5 !== "/" ? path5 : void 0;
+        const [path7, query] = wsComponent.resourceName.split("?");
+        wsComponent.path = path7 && path7 !== "/" ? path7 : void 0;
         wsComponent.query = query;
         wsComponent.resourceName = void 0;
       }
@@ -23115,12 +23169,12 @@ var require_dist = __commonJS({
         throw new Error(`Unknown format "${name2}"`);
       return f3;
     };
-    function addFormats(ajv, list, fs7, exportName) {
+    function addFormats(ajv, list, fs10, exportName) {
       var _a2;
       var _b;
       (_a2 = (_b = ajv.opts.code).formats) !== null && _a2 !== void 0 ? _a2 : _b.formats = (0, codegen_1._)`require("ajv-formats/dist/formats").${exportName}`;
       for (const f3 of list)
-        ajv.addFormat(f3, fs7[f3]);
+        ajv.addFormat(f3, fs10[f3]);
     }
     module2.exports = exports2 = formatsPlugin;
     Object.defineProperty(exports2, "__esModule", { value: true });
@@ -24660,12 +24714,12 @@ var init_debug = __esm({
         };
       };
     };
-    getValueByStringPath = function(obj, path5) {
+    getValueByStringPath = function(obj, path7) {
       var e_1, _a2;
-      path5 = path5.replace(/\[(\w+)\]/g, ".$1");
-      path5 = path5.replace(/^\./, "");
+      path7 = path7.replace(/\[(\w+)\]/g, ".$1");
+      path7 = path7.replace(/^\./, "");
       try {
-        for (var _b = __values2(path5.split(".")), _c2 = _b.next(); !_c2.done; _c2 = _b.next()) {
+        for (var _b = __values2(path7.split(".")), _c2 = _b.next(); !_c2.done; _c2 = _b.next()) {
           var attr = _c2.value;
           if (attr in obj) {
             obj = obj[attr];
@@ -24690,8 +24744,8 @@ var init_debug = __esm({
         var res = {};
         try {
           for (var paths_1 = __values2(paths), paths_1_1 = paths_1.next(); !paths_1_1.done; paths_1_1 = paths_1.next()) {
-            var path5 = paths_1_1.value;
-            res[path5] = getValueByStringPath(client, path5);
+            var path7 = paths_1_1.value;
+            res[path7] = getValueByStringPath(client, path7);
           }
         } catch (e_2_1) {
           e_2 = { error: e_2_1 };
@@ -24951,7 +25005,7 @@ var init_destination = __esm({
           useRetry = true;
         }
         return __awaiter2(this, void 0, void 0, function() {
-          var payload, serverUrl, res, e_1, errorMessage;
+          var payload, serverUrl, res, e_1, errorMessage2;
           return __generator2(this, function(_b) {
             switch (_b.label) {
               case 0:
@@ -25000,13 +25054,13 @@ var init_destination = __esm({
                 return [3, 4];
               case 3:
                 e_1 = _b.sent();
-                errorMessage = getErrorMessage(e_1);
-                this.config.loggerProvider.error(errorMessage);
+                errorMessage2 = getErrorMessage(e_1);
+                this.config.loggerProvider.error(errorMessage2);
                 (_a2 = this.diagnosticsClient) === null || _a2 === void 0 ? void 0 : _a2.recordEvent("analytics.events.unsuccessful.from.catch.error", {
                   events: list.map(function(context) {
                     return context.event.event_type;
                   }),
-                  message: errorMessage,
+                  message: errorMessage2,
                   stack_trace: getStacktrace()
                 });
                 this.handleResponse({ status: Status.Failed, statusCode: 0 }, list);
@@ -25638,7 +25692,7 @@ function classifyError(err) {
   if (err instanceof CommandError) return err;
   const cls = classifyApiError(err) ?? classifyStorageError(err) ?? classifyWalletLoadError(err);
   if (cls) return new CommandError(cls.code, cls.message);
-  return new CommandError("UNKNOWN_ERROR", err instanceof Error ? err.message : String(err));
+  return new CommandError("UNKNOWN_ERROR", errorMessage(err));
 }
 function handleCommandError(err, json, fallbackPrefix) {
   const classified = classifyError(err);
@@ -25670,7 +25724,7 @@ var import_chalk2 = __toESM(require_source());
 init_dist();
 init_dist3();
 init_dist2();
-var EMBEDDED_NAAS_SESSION_ID = "Nr8eogRKLULRxGpVkeMqQBoDpGnZxgYjKK7tu6bKxqUn6eZU";
+var EMBEDDED_NAAS_SESSION_ID = "NDVjMWRjY2MtYTYwNy00NGNhLWIxZGUtMmJiZDIyNmEyODQ4";
 function resolveNaasSessionId() {
   if (process.env.TWAK_NAAS_SESSION_ID) return process.env.TWAK_NAAS_SESSION_ID;
   if (EMBEDDED_NAAS_SESSION_ID && !EMBEDDED_NAAS_SESSION_ID.startsWith("__"))
@@ -31522,7 +31576,7 @@ function weierstrass(curveDef) {
   function prepSig(msgHash, privateKey, opts = defaultSigOpts) {
     if (["recovered", "canonical"].some((k4) => k4 in opts))
       throw new Error("sign() legacy options not supported");
-    const { hash, randomBytes: randomBytes7 } = CURVE;
+    const { hash, randomBytes: randomBytes8 } = CURVE;
     let { lowS, prehash, extraEntropy: ent } = opts;
     if (lowS == null)
       lowS = true;
@@ -31534,7 +31588,7 @@ function weierstrass(curveDef) {
     const d3 = normPrivateKeyToScalar(privateKey);
     const seedArgs = [int2octets(d3), int2octets(h1int)];
     if (ent != null && ent !== false) {
-      const e2 = ent === true ? randomBytes7(Fp.BYTES) : ent;
+      const e2 = ent === true ? randomBytes8(Fp.BYTES) : ent;
       seedArgs.push(ensureBytes("extraEntropy", e2));
     }
     const seed = concatBytes2(...seedArgs);
@@ -41568,6 +41622,10 @@ var Os3 = ut4;
 // ../walletconnect/dist/index.mjs
 init_dist3();
 init_dist();
+var fs5 = __toESM(require("fs"), 1);
+var path3 = __toESM(require("path"), 1);
+var crypto7 = __toESM(require("crypto"), 1);
+init_dist();
 var __require2 = /* @__PURE__ */ ((x6) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x6, {
   get: (a3, b3) => (typeof require !== "undefined" ? require : a3)[b3]
 }) : x6)(function(x6) {
@@ -41586,12 +41644,111 @@ async function renderPngDataUrl(uri) {
   const qrcode = __require2("qrcode");
   return qrcode.toDataURL(uri, { errorCorrectionLevel: "M" });
 }
+var FileKeyValueStorage = class {
+  constructor(filePath, opts = {}) {
+    this.filePath = filePath;
+    this.opts = opts;
+  }
+  cache = null;
+  warn(msg) {
+    this.opts.onWarning?.(msg);
+  }
+  readFile() {
+    let raw;
+    try {
+      raw = fs5.readFileSync(this.filePath, "utf-8");
+    } catch (err) {
+      if (err.code !== "ENOENT") {
+        this.warn(`Could not read ${this.filePath}: ${errorMessage(err)}`);
+      }
+      return /* @__PURE__ */ new Map();
+    }
+    try {
+      return new Map(Object.entries(JSON.parse(raw)));
+    } catch {
+      const corruptPath = `${this.filePath}.corrupt`;
+      try {
+        fs5.renameSync(this.filePath, corruptPath);
+        this.warn(`WalletConnect storage file was corrupt; moved it to ${corruptPath}`);
+      } catch (err) {
+        this.warn(
+          `WalletConnect storage file is corrupt and could not be moved: ${errorMessage(err)}`
+        );
+      }
+      return /* @__PURE__ */ new Map();
+    }
+  }
+  load() {
+    if (!this.cache) this.cache = this.readFile();
+    return this.cache;
+  }
+  persist() {
+    const snapshot = JSON.stringify(Object.fromEntries(this.load()));
+    const tmpPath = `${this.filePath}.tmp.${crypto7.randomBytes(8).toString("hex")}`;
+    try {
+      fs5.mkdirSync(path3.dirname(this.filePath), { recursive: true, mode: 448 });
+      fs5.writeFileSync(tmpPath, snapshot, { encoding: "utf-8", mode: 384 });
+      fs5.renameSync(tmpPath, this.filePath);
+    } catch (err) {
+      try {
+        fs5.rmSync(tmpPath, { force: true });
+      } catch {
+      }
+      this.warn(`Could not save WalletConnect session to ${this.filePath}: ${errorMessage(err)}`);
+    }
+  }
+  async getKeys() {
+    return [...this.load().keys()];
+  }
+  async getEntries() {
+    return [...this.load().entries()];
+  }
+  async getItem(key) {
+    return this.load().get(key);
+  }
+  async setItem(key, value) {
+    this.load().set(key, value);
+    this.persist();
+  }
+  async removeItem(key) {
+    if (this.load().delete(key)) this.persist();
+  }
+};
 var DEFAULT_METADATA = {
   name: "TWAK Agent",
   description: "AI Agent for Trust Wallet operations",
   url: "https://portal.trustwallet.com",
   icons: ["https://avatars.githubusercontent.com/u/32179365"]
 };
+var SESSION_CLEARED_REASON = { code: 6e3, message: "Session cleared" };
+var PEER_NOTIFY_TIMEOUT_MS = 5e3;
+var USER_REJECTION_CODES = /* @__PURE__ */ new Set([5e3, 4001]);
+var GENERIC_SERVER_ERROR_CODE = -32e3;
+var USER_REJECTION_MESSAGE_RE = /\buser (cancell?ed|rejected|denied)\b/i;
+function isUserRejection(code2, message) {
+  if (USER_REJECTION_CODES.has(code2)) return true;
+  return code2 === GENERIC_SERVER_ERROR_CODE && USER_REJECTION_MESSAGE_RE.test(message);
+}
+function toRequestError(err) {
+  if (err instanceof Error || !err || typeof err !== "object") return err;
+  const { code: code2, message } = err;
+  if (typeof code2 !== "number" || typeof message !== "string") return err;
+  if (isUserRejection(code2, message)) {
+    return new WalletError("USER_REJECTED", `Request rejected in the wallet: ${message}`);
+  }
+  return new WalletError("WC_REQUEST_FAILED", `${message} (code ${code2})`);
+}
+async function settleWithin(promise, ms3) {
+  let timer;
+  const elapsed = new Promise((resolve2) => {
+    timer = setTimeout(resolve2, ms3);
+  });
+  try {
+    await Promise.race([promise.catch(() => void 0), elapsed]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
 var WC_NOT_CONNECTED_MSG = 'WalletConnect session not established. If pairing is in progress, complete the approval in Trust Wallet mobile and retry; otherwise call switch_wallet_mode({mode: "walletconnect"}) to start pairing.';
 var WalletConnectProvider = class extends WalletProvider {
   name = "walletconnect";
@@ -41599,12 +41756,17 @@ var WalletConnectProvider = class extends WalletProvider {
   initPromise = null;
   currentSession = null;
   config;
+  storage;
+  /** Bumped by each pairing request and by disconnect(); an approval that
+   * arrives for an older pairing is revoked instead of bound. */
+  pairingGeneration = 0;
   sessionCallback = null;
   sessionEndedCallback = null;
   pairingEventCallback = null;
   constructor(config) {
     super();
     this.config = config;
+    this.storage = config.storagePath ? new FileKeyValueStorage(config.storagePath, { onWarning: config.onStorageWarning }) : null;
   }
   async ensureClient() {
     if (this.client) return this.client;
@@ -41612,12 +41774,26 @@ var WalletConnectProvider = class extends WalletProvider {
     this.initPromise = Os3.init({
       projectId: this.config.projectId,
       relayUrl: this.config.relayUrl || "wss://relay.walletconnect.com",
-      metadata: this.config.metadata || DEFAULT_METADATA
+      metadata: this.config.metadata || DEFAULT_METADATA,
+      ...this.storage ? { storage: this.storage } : {}
     });
-    this.client = await this.initPromise;
+    try {
+      this.client = await this.initPromise;
+    } catch (err) {
+      this.initPromise = null;
+      throw err;
+    }
     this.setupEventHandlers(this.client);
     return this.client;
   }
+  /** `client.request` with wallet-side errors converted (see toRequestError). */
+  async request(client, args) {
+    try {
+      return await client.request(args);
+    } catch (err) {
+      throw toRequestError(err);
+    }
+  }
   onPairingEvent(callback) {
     this.pairingEventCallback = callback;
   }
@@ -41704,7 +41880,7 @@ var WalletConnectProvider = class extends WalletProvider {
     if (!session) throw new WalletError("WC_NOT_CONNECTED", WC_NOT_CONNECTED_MSG);
     const client = await this.ensureClient();
     const hexMessage = `0x${Buffer.from(message, "utf8").toString("hex")}`;
-    return client.request({
+    return this.request(client, {
       topic: session.topic,
       chainId,
       request: {
@@ -41718,7 +41894,7 @@ var WalletConnectProvider = class extends WalletProvider {
     if (!session) throw new WalletError("WC_NOT_CONNECTED", WC_NOT_CONNECTED_MSG);
     const client = await this.ensureClient();
     const caipChainId = chainKey.includes(":") ? chainKey : `eip155:${chainId}`;
-    return client.request({
+    return this.request(client, {
       topic: session.topic,
       chainId: caipChainId,
       request: {
@@ -41742,7 +41918,7 @@ var WalletConnectProvider = class extends WalletProvider {
     if (value && !value.startsWith("0x")) {
       value = "0x" + BigInt(value).toString(16);
     }
-    return client.request({
+    return this.request(client, {
       topic: session.topic,
       chainId: params.chainId,
       request: {
@@ -41763,8 +41939,38 @@ var WalletConnectProvider = class extends WalletProvider {
   supportsChain(chainId) {
     return chainId.startsWith("eip155:");
   }
+  /**
+   * Ends a session in two phases:
+   *   1. Tell the peer wallet (best-effort, bounded by PEER_NOTIFY_TIMEOUT_MS:
+   *      the relay may be unreachable and `client.disconnect` then never
+   *      settles).
+   *   2. Always drop the session locally if it is still stored, so it never
+   *      lingers in persisted storage. If the peer was not reached, it keeps
+   *      a dead entry until the session expires.
+   */
+  async revokeSession(client, topic) {
+    await settleWithin(
+      client.disconnect({ topic, reason: SESSION_CLEARED_REASON }),
+      PEER_NOTIFY_TIMEOUT_MS
+    );
+    if (!client.session.getAll().some((s2) => s2.topic === topic)) return;
+    try {
+      await client.session.delete(topic, SESSION_CLEARED_REASON);
+    } catch {
+    }
+  }
+  /**
+   * Starts a new pairing. Only one session is kept per storage, so any
+   * existing session is revoked first: asking to pair again expresses the
+   * intent to invalidate the previous one.
+   */
   async connect(chains = getDefaultWcChains()) {
     const client = await this.ensureClient();
+    const generation = ++this.pairingGeneration;
+    for (const session of client.session.getAll()) {
+      await this.revokeSession(client, session.topic);
+    }
+    this.currentSession = null;
     const nsMap = {};
     for (const chain2 of chains) {
       const ns2 = chain2.split(":")[0];
@@ -41786,7 +41992,7 @@ var WalletConnectProvider = class extends WalletProvider {
         "WalletConnect relay handshake failed: no pairing URI returned. Check network and project ID, then retry."
       );
     }
-    this.handleApproval(approval());
+    this.handleApproval(approval(), generation);
     const encodedUri = encodeURIComponent(uri);
     const terminal = renderTerminalQR(uri);
     const imageUrl = await renderPngDataUrl(uri);
@@ -41803,9 +42009,13 @@ var WalletConnectProvider = class extends WalletProvider {
       expiresAt: Date.now() + 5 * 60 * 1e3
     };
   }
-  async handleApproval(approval) {
+  async handleApproval(approval, generation) {
     try {
       const session = await approval;
+      if (generation !== this.pairingGeneration) {
+        if (this.client) await this.revokeSession(this.client, session.topic);
+        return;
+      }
       this.currentSession = this.sessionToWalletSession(session);
       if (this.currentSession && this.sessionCallback) {
         this.sessionCallback(this.currentSession);
@@ -41832,20 +42042,42 @@ var WalletConnectProvider = class extends WalletProvider {
       `Timed out after ${Math.round(timeoutMs / 1e3)}s waiting for WalletConnect pairing approval.`
     );
   }
+  /**
+   * Revokes every stored session. Waits for an in-flight client init (e.g. a
+   * restore still loading storage) so a session being restored is revoked
+   * too; a no-op when the client was never started.
+   */
   async disconnect() {
-    if (!this.client) return;
-    const sessions = this.client.session.getAll();
-    for (const session of sessions) {
+    this.pairingGeneration++;
+    let client = this.client;
+    if (!client && this.initPromise) {
       try {
-        await this.client.disconnect({
-          topic: session.topic,
-          reason: { code: 6e3, message: "Session cleared" }
-        });
+        client = await this.initPromise;
       } catch {
+        return;
       }
     }
+    if (!client) return;
+    for (const session of client.session.getAll()) {
+      await this.revokeSession(client, session.topic);
+    }
     this.currentSession = null;
   }
+  /**
+   * Resumes the session persisted by a previous process. Keeps the live
+   * session with the latest expiry and revokes any other, so at most one
+   * session remains. Returns null when none is live.
+   */
+  async restore() {
+    const client = await this.ensureClient();
+    const now = Math.floor(Date.now() / 1e3);
+    const live = client.session.getAll().filter((s2) => s2.expiry > now).sort((a3, b3) => b3.expiry - a3.expiry);
+    for (const stale of live.slice(1)) {
+      await this.revokeSession(client, stale.topic);
+    }
+    this.currentSession = live.length > 0 ? this.sessionToWalletSession(live[0]) : null;
+    return this.currentSession;
+  }
   isConnected() {
     return this.getActiveSession() !== null;
   }
@@ -42058,18 +42290,18 @@ var import_promises2 = require("fs/promises");
 var import_node_crypto = require("crypto");
 var import_promises = require("fs/promises");
 var import_node_path = require("path");
-async function writeAtomic(path5, contents, mode = 420) {
-  await (0, import_promises.mkdir)((0, import_node_path.dirname)(path5), { recursive: true });
+async function writeAtomic(path7, contents, mode = 420) {
+  await (0, import_promises.mkdir)((0, import_node_path.dirname)(path7), { recursive: true });
   let effectiveMode = mode;
   try {
-    const st4 = await (0, import_promises.stat)(path5);
+    const st4 = await (0, import_promises.stat)(path7);
     effectiveMode = st4.mode & 511;
   } catch {
   }
-  const tmpPath = `${path5}.tmp.${(0, import_node_crypto.randomBytes)(8).toString("hex")}`;
+  const tmpPath = `${path7}.tmp.${(0, import_node_crypto.randomBytes)(8).toString("hex")}`;
   await (0, import_promises.writeFile)(tmpPath, contents, { mode: effectiveMode });
   try {
-    await (0, import_promises.rename)(tmpPath, path5);
+    await (0, import_promises.rename)(tmpPath, path7);
   } catch (err) {
     try {
       await (0, import_promises.rm)(tmpPath, { force: true });
@@ -42481,7 +42713,7 @@ async function processHarness(writer, deps, verbose, entry) {
   try {
     current = await writer.getCurrentEntry();
   } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
+    const msg = errorMessage(err);
     error(
       `Skipping ${writer.displayName}: config at ${writer.configPath()} is invalid (${msg}). Fix it manually and re-run \`twak setup --harness ${writer.name}\`.`
     );
@@ -42535,7 +42767,7 @@ async function runSkillsInstall(harness, deps) {
     await deps.skillsInstaller.install(agent);
     success(`  Skills installed for ${harness}.`);
   } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
+    const msg = errorMessage(err);
     warn(
       `  Skills install for ${harness} failed (${msg}). The MCP wiring is in place; you can re-run \`npx skills add trustwallet/tw-agent-skills -a ${agent}\` manually.`
     );
@@ -42567,7 +42799,7 @@ async function runNonInteractive2(opts, deps) {
     try {
       current = await writer.getCurrentEntry();
     } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
+      const msg = errorMessage(err);
       throw new CommandError(
         "VALIDATION_ERROR",
         `Cannot wire ${writer.displayName}: config at ${writer.configPath()} is invalid (${msg}). Fix it manually and re-run.`
@@ -42903,6 +43135,7 @@ function registerAuthCommand(program3) {
 }
 
 // src/commands/wallet.ts
+var fs6 = __toESM(require("fs"));
 init_dist2();
 var import_chalk6 = __toESM(require_source());
 init_dist();
@@ -42930,7 +43163,7 @@ function mapBroadcastError(err) {
       throw new TransferError("BROADCAST_FAILED", err.message);
     }
   }
-  const msg = err instanceof Error ? err.message : String(err);
+  const msg = errorMessage(err);
   if (/\binsufficient\b/i.test(msg)) {
     throw new TransferError("INSUFFICIENT_BALANCE", msg);
   }
@@ -42961,7 +43194,7 @@ var TransferExecutor = class {
       return {
         success: false,
         code: "UNKNOWN_ERROR",
-        message: err instanceof Error ? err.message : String(err)
+        message: errorMessage(err)
       };
     }
   }
@@ -42981,7 +43214,7 @@ var TransferExecutor = class {
     try {
       resolvedTo = await resolveAddressOrName(params.to);
     } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
+      const msg = errorMessage(err);
       if (msg.includes("Could not resolve name")) {
         throw new TransferError("ENS_NOT_FOUND", `Could not resolve ENS name: ${params.to}`);
       }
@@ -43122,7 +43355,7 @@ function parseInterval(value) {
   return num;
 }
 function errMsg(err) {
-  return err instanceof Error ? err.message : String(err);
+  return errorMessage(err);
 }
 async function fetchPriceMap(client, assetIds) {
   const assets = [...new Set(assetIds)];
@@ -43572,6 +43805,46 @@ function box(content) {
   });
 }
 
+// src/walletconnect-config.ts
+var path4 = __toESM(require("path"));
+init_dist();
+init_dist2();
+var RESTORE_TIMEOUT_MS = 1e4;
+function wcStoragePath() {
+  return path4.join(new FileStore().getDataDir(), "walletconnect.json");
+}
+async function resolveWcProjectId(flag) {
+  const fromFlagOrEnv = flag || process.env.WALLETCONNECT_PROJECT_ID;
+  if (fromFlagOrEnv) return fromFlagOrEnv;
+  try {
+    const creds = await new CredentialManager().load();
+    return creds?.walletConnectProjectId || void 0;
+  } catch {
+    return void 0;
+  }
+}
+function createWalletConnectProvider(projectId) {
+  return new WalletConnectProvider({
+    projectId,
+    storagePath: wcStoragePath(),
+    onStorageWarning: (msg) => warn(msg)
+  });
+}
+async function withTimeout(promise, ms3) {
+  let timer;
+  const timeout = new Promise((_2, reject) => {
+    timer = setTimeout(
+      () => reject(new WalletError("NETWORK_ERROR", `Timed out after ${ms3 / 1e3}s`)),
+      ms3
+    );
+  });
+  try {
+    return await Promise.race([promise, timeout]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
 // src/commands/wallet.ts
 function getQRString(address) {
   try {
@@ -43585,6 +43858,36 @@ function getQRString(address) {
     return "";
   }
 }
+var WC_PROJECT_ID_HINT = "Use --project-id, set WALLETCONNECT_PROJECT_ID, or run `twak init --wc-project-id <id>`";
+async function openStoredWalletConnect(projectIdFlag) {
+  if (!fs6.existsSync(wcStoragePath())) return null;
+  const projectId = await resolveWcProjectId(projectIdFlag);
+  if (!projectId) {
+    throw new WalletError(
+      "VALIDATION_ERROR",
+      `A WalletConnect session is stored but no project ID is configured. ${WC_PROJECT_ID_HINT}`
+    );
+  }
+  const provider = createWalletConnectProvider(projectId);
+  const session = await withTimeout(provider.restore(), RESTORE_TIMEOUT_MS);
+  return { provider, session };
+}
+async function getWalletConnectStatus(projectIdFlag) {
+  try {
+    const stored = await openStoredWalletConnect(projectIdFlag);
+    if (!stored?.session) return { connected: false };
+    const { peerName, address, expiry } = stored.session;
+    return {
+      connected: true,
+      peer: peerName,
+      address,
+      expiresAt: new Date(expiry * 1e3).toISOString()
+    };
+  } catch (err) {
+    warn(`Could not check WalletConnect session: ${errorMessage(err)}`);
+    return { connected: false };
+  }
+}
 function registerWalletCommand(program3) {
   const wallet = program3.command("wallet").description("Manage agent wallet");
   wallet.command("create").description("Create a new agent wallet").requiredOption("--password <password>", "Password to encrypt the wallet").option("--no-keychain", "Do not save password to OS keychain").option("--skip-password-check", "Skip password strength validation").option("--json", "JSON output").action(async (opts) => {
@@ -43864,21 +44167,23 @@ ${qr3}`;
     }
     safeExit();
   });
-  wallet.command("connect").description("Connect external wallet via WalletConnect").option("--project-id <id>", "WalletConnect project ID (or set WALLETCONNECT_PROJECT_ID)").option(
+  wallet.command("connect").description("Connect external wallet via WalletConnect").option(
+    "--project-id <id>",
+    "WalletConnect project ID (or WALLETCONNECT_PROJECT_ID / twak init --wc-project-id)"
+  ).option(
     "--chains <list>",
-    "Comma-separated CAIP-2 chain IDs",
-    "eip155:1,eip155:56,eip155:137,eip155:8453,eip155:42161"
+    "Comma-separated CAIP-2 chain IDs (default: all supported EVM chains)"
   ).option("--timeout <seconds>", "Connection timeout in seconds", "300").option("--json", "JSON output").action(async (opts) => {
     try {
-      const projectId = opts.projectId || process.env.WALLETCONNECT_PROJECT_ID;
+      const projectId = await resolveWcProjectId(opts.projectId);
       if (!projectId) {
         throw new WalletError(
           "VALIDATION_ERROR",
-          "WalletConnect project ID required. Use --project-id or set WALLETCONNECT_PROJECT_ID"
+          `WalletConnect project ID required. ${WC_PROJECT_ID_HINT}`
         );
       }
-      const provider = new WalletConnectProvider({ projectId });
-      const chains = opts.chains.split(",").map((s2) => s2.trim()).filter(Boolean);
+      const provider = createWalletConnectProvider(projectId);
+      const chains = opts.chains ? opts.chains.split(",").map((s2) => s2.trim()).filter(Boolean) : getDefaultWcChains();
       info("Connecting via WalletConnect...");
       const result = await provider.connect(chains);
       const qr3 = getQRString(result.uri);
@@ -43910,7 +44215,32 @@ ${qr3}`;
     }
     safeExit();
   });
-  wallet.command("status").description("Check wallet configuration status").option("--json", "JSON output").action(async (opts) => {
+  wallet.command("disconnect").description("Revoke the stored WalletConnect session").option(
+    "--project-id <id>",
+    "WalletConnect project ID (or WALLETCONNECT_PROJECT_ID / twak init --wc-project-id)"
+  ).option("--json", "JSON output").action(async (opts) => {
+    try {
+      const stored = await openStoredWalletConnect(opts.projectId);
+      const disconnected = !!stored?.session;
+      if (stored?.session) {
+        await withTimeout(stored.provider.disconnect(), RESTORE_TIMEOUT_MS);
+      }
+      if (opts.json) {
+        output({ disconnected }, true);
+      } else if (disconnected) {
+        success("WalletConnect session disconnected");
+      } else {
+        info("No WalletConnect session");
+      }
+    } catch (err) {
+      handleCommandError(err, opts.json, "WalletConnect disconnect failed");
+    }
+    safeExit();
+  });
+  wallet.command("status").description("Check wallet configuration status").option(
+    "--project-id <id>",
+    "WalletConnect project ID used to check the stored session (or WALLETCONNECT_PROJECT_ID / twak init --wc-project-id)"
+  ).option("--json", "JSON output").action(async (opts) => {
     try {
       const store = new WalletConfigStore();
       const exists = await store.exists();
@@ -43924,13 +44254,15 @@ ${qr3}`;
         createdAt = config?.createdAt;
         addressCount = config?.chains?.length ?? totalChains;
       }
+      const walletConnect = await getWalletConnectStatus(opts.projectId);
       const result = {
         agentWallet: exists ? "configured" : "not configured",
         keychainPassword: keychainHasPassword ? "stored" : "not stored",
         chains: totalChains,
         supportedChains: totalChains,
         ...createdAt ? { createdAt } : {},
-        ...addressCount !== void 0 ? { addressCount } : {}
+        ...addressCount !== void 0 ? { addressCount } : {},
+        walletConnect
       };
       if (opts.json) {
         output(result, true);
@@ -43945,6 +44277,11 @@ ${qr3}`;
         console.log(`  ${import_chalk6.default.dim("Chains")}     ${totalChains} supported`);
         if (addressCount !== void 0)
           console.log(`  ${import_chalk6.default.dim("Addresses")}  ${addressCount}`);
+        console.log(
+          `  ${import_chalk6.default.dim("WalletConnect")} ${walletConnect.connected ? import_chalk6.default.green(
+            `connected to ${walletConnect.peer || "wallet"} (${walletConnect.address}), expires ${walletConnect.expiresAt}`
+          ) : import_chalk6.default.yellow("not connected")}`
+        );
         if (!exists) info("\nRun `twak wallet create --password <pw>` to create a wallet.");
       }
     } catch (err) {
@@ -44312,8 +44649,8 @@ var SwapExecutor = class {
         explorerUrl: getExplorerTxUrl(params.fromChain, hash)
       };
     } catch (err) {
-      let msg = err instanceof Error ? err.message : "Unknown error";
-      let code2 = classifySwapError(msg);
+      let msg = errorMessage(err);
+      let code2 = err instanceof CommandError ? err.code : classifySwapError(msg);
       if (approvalHash) {
         code2 = "APPROVAL_SENT_SWAP_FAILED";
         msg += `. Approval was sent (tx: ${approvalHash}). Check allowance before retrying.`;
@@ -44387,7 +44724,7 @@ var SwapExecutor = class {
         if (status.failed)
           throw new Error(`Transaction failed: ${status.error || "unknown error"}`);
       } catch (e2) {
-        const err = e2 instanceof Error ? e2 : new Error(String(e2));
+        const err = e2 instanceof Error ? e2 : new Error(errorMessage(e2));
         if (err.message.startsWith("Transaction failed")) throw err;
         if (!err.message.includes("not found") && !err.message.includes("Transaction not found"))
           throw err;
@@ -45704,7 +46041,7 @@ var SecurityService = class {
         query.toString()
       );
     } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
+      const msg = errorMessage(err);
       const details = err?.details;
       let detailsStr = "";
       if (details != null) {
@@ -46788,6 +47125,9 @@ function registerQueryCommand(program3) {
   });
 }
 
+// src/commands/serve.ts
+var fs8 = __toESM(require("fs"));
+
 // ../actions/dist/index.mjs
 init_dist();
 var import_zod3 = require("zod");
@@ -48533,7 +48873,7 @@ function validateOfframpInput(input2, chainKey, nativeDecimals) {
   try {
     assertStrictPositiveAmount(input2.cryptoAmount, decimals);
   } catch (err) {
-    throw new TransferError("VALIDATION_ERROR", err instanceof Error ? err.message : String(err));
+    throw new TransferError("VALIDATION_ERROR", errorMessage(err));
   }
   return decimals;
 }
@@ -49198,12 +49538,10 @@ var WalletModeActionProvider = class extends ActionProvider {
   description = "Switch wallet modes mid-session. The local agent wallet is auto-bound at server startup when configured, so signing actions work out of the box without calling this. Only call switch_wallet_mode when the user explicitly asks to use WalletConnect (or to return to the local wallet afterwards).";
   walletContext;
   agentWallet;
-  walletConnectFactory;
   constructor(options) {
     super();
     this.walletContext = options.walletContext;
     this.agentWallet = options.agentWallet;
-    this.walletConnectFactory = options.walletConnectFactory;
   }
   getActions() {
     return [this.switchWalletMode(), this.getWalletStatus()];
@@ -49246,14 +49584,13 @@ var WalletModeActionProvider = class extends ActionProvider {
           await this.walletContext.bindLocal(this.agentWallet);
           return this.snapshotResponse(this.walletContext.snapshot());
         }
-        if (!this.walletConnectFactory) {
+        if (!this.walletContext.walletConnectAvailable) {
           throw new WalletError(
             "VALIDATION_ERROR",
             "WalletConnect is not configured. Set WALLETCONNECT_PROJECT_ID (env var or `twak init --wc-project-id <id>`) and restart the MCP server."
           );
         }
-        const wc3 = this.walletConnectFactory();
-        await this.walletContext.beginWalletConnect(wc3);
+        await this.walletContext.beginWalletConnect();
         return this.snapshotResponse(this.walletContext.snapshot());
       }
     };
@@ -51539,19 +51876,19 @@ var getRefs = (options) => {
 };
 
 // ../../node_modules/.pnpm/zod-to-json-schema@3.25.1_zod@3.25.76/node_modules/zod-to-json-schema/dist/esm/errorMessages.js
-function addErrorMessage(res, key, errorMessage, refs) {
+function addErrorMessage(res, key, errorMessage2, refs) {
   if (!refs?.errorMessages)
     return;
-  if (errorMessage) {
+  if (errorMessage2) {
     res.errorMessage = {
       ...res.errorMessage,
-      [key]: errorMessage
+      [key]: errorMessage2
     };
   }
 }
-function setResponseValueAndErrors(res, key, value, errorMessage, refs) {
+function setResponseValueAndErrors(res, key, value, errorMessage2, refs) {
   res[key] = value;
-  addErrorMessage(res, key, errorMessage, refs);
+  addErrorMessage(res, key, errorMessage2, refs);
 }
 
 // ../../node_modules/.pnpm/zod-to-json-schema@3.25.1_zod@3.25.76/node_modules/zod-to-json-schema/dist/esm/getRelativePath.js
@@ -52848,8 +53185,8 @@ var Protocol = class {
                   if (queuedMessage.type === "response") {
                     resolver(message);
                   } else {
-                    const errorMessage = message;
-                    const error2 = new McpError(errorMessage.error.code, errorMessage.error.message, errorMessage.error.data);
+                    const errorMessage2 = message;
+                    const error2 = new McpError(errorMessage2.error.code, errorMessage2.error.message, errorMessage2.error.data);
                     resolver(error2);
                   }
                 } else {
@@ -54143,23 +54480,23 @@ var Server = class extends Protocol {
       const wrappedHandler = async (request, extra) => {
         const validatedRequest = safeParse2(CallToolRequestSchema, request);
         if (!validatedRequest.success) {
-          const errorMessage = validatedRequest.error instanceof Error ? validatedRequest.error.message : String(validatedRequest.error);
-          throw new McpError(ErrorCode.InvalidParams, `Invalid tools/call request: ${errorMessage}`);
+          const errorMessage2 = validatedRequest.error instanceof Error ? validatedRequest.error.message : String(validatedRequest.error);
+          throw new McpError(ErrorCode.InvalidParams, `Invalid tools/call request: ${errorMessage2}`);
         }
         const { params } = validatedRequest.data;
         const result = await Promise.resolve(handler(request, extra));
         if (params.task) {
           const taskValidationResult = safeParse2(CreateTaskResultSchema, result);
           if (!taskValidationResult.success) {
-            const errorMessage = taskValidationResult.error instanceof Error ? taskValidationResult.error.message : String(taskValidationResult.error);
-            throw new McpError(ErrorCode.InvalidParams, `Invalid task creation result: ${errorMessage}`);
+            const errorMessage2 = taskValidationResult.error instanceof Error ? taskValidationResult.error.message : String(taskValidationResult.error);
+            throw new McpError(ErrorCode.InvalidParams, `Invalid task creation result: ${errorMessage2}`);
           }
           return taskValidationResult.data;
         }
         const validationResult = safeParse2(CallToolResultSchema, result);
         if (!validationResult.success) {
-          const errorMessage = validationResult.error instanceof Error ? validationResult.error.message : String(validationResult.error);
-          throw new McpError(ErrorCode.InvalidParams, `Invalid tools/call result: ${errorMessage}`);
+          const errorMessage2 = validationResult.error instanceof Error ? validationResult.error.message : String(validationResult.error);
+          throw new McpError(ErrorCode.InvalidParams, `Invalid tools/call result: ${errorMessage2}`);
         }
         return validationResult.data;
       };
@@ -54605,7 +54942,7 @@ var TwakMcpServer = class {
         const isZodValidation = error2 instanceof Error && error2.name === "ZodError";
         const payload = classified ?? (isZodValidation ? { code: "VALIDATION_ERROR", message: error2.message } : {
           code: "UNKNOWN_ERROR",
-          message: error2 instanceof Error ? error2.message : "Unknown error"
+          message: errorMessage(error2)
         });
         return {
           content: [{ type: "text", text: JSON.stringify(payload) }],
@@ -54639,6 +54976,8 @@ function errorCodeToHttpStatus(code2) {
     case "SLIPPAGE_EXCEEDED":
     case "VALUE_LIMIT_EXCEEDED":
     case "TX_FAILED":
+    case "USER_REJECTED":
+    case "WC_REQUEST_FAILED":
       return 422;
     case "RATE_LIMITED":
       return 429;
@@ -54777,7 +55116,7 @@ var TwakRestServer = class {
         const isZodValidation = err instanceof Error && err.name === "ZodError";
         const payload = classified ?? (isZodValidation ? { code: "VALIDATION_ERROR", message: err.message } : {
           code: err instanceof CommandError ? err.code : "UNKNOWN_ERROR",
-          message: err instanceof Error ? err.message : "Unknown error"
+          message: errorMessage(err)
         });
         const status = isZodValidation ? 400 : errorCodeToHttpStatus(payload.code);
         res.writeHead(status);
@@ -54788,6 +55127,7 @@ var TwakRestServer = class {
 };
 
 // src/commands/serve.ts
+init_dist();
 function registerServeCommand(program3) {
   program3.command("serve").description("Start MCP server (stdio) or REST API server for AI agent connection").option("--rest", "Start REST HTTP server instead of MCP stdio server").option("--port <n>", "Port for REST server", "3000").option(
     "--host <host>",
@@ -54823,25 +55163,33 @@ function registerServeCommand(program3) {
         passwordResolver: () => resolvePassword(opts)
       });
     }
-    let wcProjectId = opts.wcProjectId || process.env.WALLETCONNECT_PROJECT_ID;
-    if (!wcProjectId) {
+    const wcProjectId = await resolveWcProjectId(opts.wcProjectId);
+    const walletContext = new WalletContext({
+      walletConnectFactory: wcProjectId ? () => createWalletConnectProvider(wcProjectId) : void 0
+    });
+    let resumeOutcome = "none";
+    if (walletContext.walletConnectAvailable && fs8.existsSync(wcStoragePath())) {
       try {
-        const creds = await new CredentialManager().load();
-        wcProjectId = creds?.walletConnectProjectId;
-      } catch {
+        const resumed = await withTimeout(
+          walletContext.restoreWalletConnect(),
+          RESTORE_TIMEOUT_MS
+        );
+        if (resumed) {
+          resumeOutcome = "resumed";
+          info("Resumed WalletConnect session");
+        }
+      } catch (err) {
+        resumeOutcome = "pending";
+        warn(`Could not resume WalletConnect session: ${errorMessage(err)}`);
       }
     }
-    const walletConnectFactory = wcProjectId ? () => new WalletConnectProvider({ projectId: wcProjectId }) : void 0;
-    const walletContext = new WalletContext();
-    if (agentWallet) {
+    if (agentWallet && resumeOutcome === "none") {
       await walletContext.bindLocal(agentWallet);
       blockchainClient.setSigner(agentWallet.getSigner());
     }
     const registry = new ActionRegistry();
     registry.register(new BalanceActionProvider());
-    registry.register(
-      new WalletModeActionProvider({ walletContext, agentWallet, walletConnectFactory })
-    );
+    registry.register(new WalletModeActionProvider({ walletContext, agentWallet }));
     registry.register(new SwapActionProvider(swapClient, walletContext, blockchainClient));
     registry.register(new SecurityActionProvider());
     registry.register(new HistoryActionProvider());
@@ -54890,7 +55238,7 @@ function registerServeCommand(program3) {
           },
           {
             intervalSec,
-            onTickError: (err) => error(`Automation tick error: ${err instanceof Error ? err.message : String(err)}`)
+            onTickError: (err) => error(`Automation tick error: ${errorMessage(err)}`)
           }
         );
         info(
@@ -54908,21 +55256,19 @@ function registerServeCommand(program3) {
         host: opts.host,
         apiKey: client.hmacSecret
       });
-      registerShutdownHandlers([agentWallet], async () => {
+      registerShutdownHandlers([agentWallet], () => {
         watcher?.stop();
-        await walletContext.reset();
         restServer.stop();
       });
       try {
         await restServer.start();
       } catch (err) {
-        error(`Error: ${err instanceof Error ? err.message : String(err)}`);
+        error(`Error: ${errorMessage(err)}`);
         process.exit(1);
       }
     } else {
       registerShutdownHandlers([agentWallet], () => {
         watcher?.stop();
-        return walletContext.reset();
       });
       const mcpServer = new TwakMcpServer(registry, context);
       console.error("TW Agent MCP server starting...");
@@ -55273,10 +55619,7 @@ ${url}`);
       try {
         assertStrictPositiveAmount(opts.amount, decimals);
       } catch (err) {
-        throw new TransferError(
-          "VALIDATION_ERROR",
-          err instanceof Error ? err.message : String(err)
-        );
+        throw new TransferError("VALIDATION_ERROR", errorMessage(err));
       }
       if (!opts.skipSafetyCheck) {
         const maxUsd = parseFloat(opts.maxUsd ?? String(DEFAULT_MAX_OFFRAMP_USD2));
@@ -55831,15 +56174,15 @@ function registerX402Command(program3) {
 }
 
 // src/analytics.ts
-var fs6 = __toESM(require("fs"));
+var fs9 = __toESM(require("fs"));
 var os4 = __toESM(require("os"));
-var path4 = __toESM(require("path"));
-var crypto7 = __toESM(require("crypto"));
+var path6 = __toESM(require("path"));
+var crypto8 = __toESM(require("crypto"));
 
 // package.json
 var package_default = {
   name: "@trustwallet/cli",
-  version: "0.20.0",
+  version: "0.21.0",
   description: "TWAK CLI \u2014 command-line interface for Trust Wallet Agent Kit",
   main: "dist/index.js",
   types: "dist/index.d.ts",
@@ -55916,10 +56259,10 @@ try {
 } catch (_e6) {
 }
 var AMPLITUDE_API_KEY = process.env.AMPLITUDE_API_KEY || "__AMPLITUDE_API_KEY__";
-var CONFIG_DIR = path4.join(os4.homedir(), ".twak");
-var ID_FILE = path4.join(CONFIG_DIR, "analytics-id");
-var OPT_IN_FILE = path4.join(CONFIG_DIR, "telemetry-on");
-var OPT_OUT_FILE = path4.join(CONFIG_DIR, "telemetry-off");
+var CONFIG_DIR = path6.join(os4.homedir(), ".twak");
+var ID_FILE = path6.join(CONFIG_DIR, "analytics-id");
+var OPT_IN_FILE = path6.join(CONFIG_DIR, "telemetry-on");
+var OPT_OUT_FILE = path6.join(CONFIG_DIR, "telemetry-off");
 var initialized2 = false;
 function isOptedOut() {
   if (process.argv.includes("--no-analytics")) return true;
@@ -55927,31 +56270,31 @@ function isOptedOut() {
   if (env === "off" || env === "0" || env === "false") return true;
   if (env === "on" || env === "1" || env === "true") return false;
   try {
-    if (fs6.existsSync(OPT_OUT_FILE)) return true;
-    return !fs6.existsSync(OPT_IN_FILE);
+    if (fs9.existsSync(OPT_OUT_FILE)) return true;
+    return !fs9.existsSync(OPT_IN_FILE);
   } catch (_e6) {
     return true;
   }
 }
 function setOptOut2(optOut) {
-  fs6.mkdirSync(CONFIG_DIR, { recursive: true });
+  fs9.mkdirSync(CONFIG_DIR, { recursive: true });
   if (optOut) {
-    if (fs6.existsSync(OPT_IN_FILE)) fs6.unlinkSync(OPT_IN_FILE);
-    fs6.writeFileSync(OPT_OUT_FILE, "");
+    if (fs9.existsSync(OPT_IN_FILE)) fs9.unlinkSync(OPT_IN_FILE);
+    fs9.writeFileSync(OPT_OUT_FILE, "");
   } else {
-    fs6.writeFileSync(OPT_IN_FILE, "");
-    if (fs6.existsSync(OPT_OUT_FILE)) fs6.unlinkSync(OPT_OUT_FILE);
+    fs9.writeFileSync(OPT_IN_FILE, "");
+    if (fs9.existsSync(OPT_OUT_FILE)) fs9.unlinkSync(OPT_OUT_FILE);
   }
 }
 function getUserId() {
   try {
-    if (fs6.existsSync(ID_FILE)) return fs6.readFileSync(ID_FILE, "utf-8").trim();
+    if (fs9.existsSync(ID_FILE)) return fs9.readFileSync(ID_FILE, "utf-8").trim();
   } catch (_e6) {
   }
-  const id = crypto7.randomUUID();
+  const id = crypto8.randomUUID();
   try {
-    fs6.mkdirSync(CONFIG_DIR, { recursive: true });
-    fs6.writeFileSync(ID_FILE, id);
+    fs9.mkdirSync(CONFIG_DIR, { recursive: true });
+    fs9.writeFileSync(ID_FILE, id);
   } catch (_e6) {
   }
   return id;