@trustwallet/cli 0.21.0 → 0.23.0

package/dist/index.js

@@ -4282,7 +4282,8 @@ var init_dist = __esm({
       PASSWORD_MISSING: "PASSWORD_MISSING",
       WALLET_NOT_FOUND: "WALLET_NOT_FOUND",
       WALLET_AUTH_FAILED: "WALLET_AUTH_FAILED",
-      STORAGE_ERROR: "STORAGE_ERROR"
+      STORAGE_ERROR: "STORAGE_ERROR",
+      CREDENTIALS_MISSING: "CREDENTIALS_MISSING"
     };
     EXECUTION_REVERTED_RE = /\bexecution reverted\b/i;
     FS_ERRNO_CODES = /* @__PURE__ */ new Set([
@@ -4452,6 +4453,7 @@ var init_dist = __esm({
     DEFAULT_X_ORIGIN = "Trust/2.15.0 AgentKit";
     TwakHttpClient = class {
       config;
+      resolveCredentials;
       constructor(config) {
         this.config = {
           gatewayBaseUrl: DEFAULT_GATEWAY_URL,
@@ -4461,17 +4463,18 @@ var init_dist = __esm({
           xOrigin: DEFAULT_X_ORIGIN,
           ...config
         };
+        if ("credentials" in config) {
+          this.resolveCredentials = config.credentials;
+        } else {
+          const fixed = { accessId: config.accessId, hmacSecret: config.hmacSecret };
+          this.resolveCredentials = () => fixed;
+        }
       }
       async gateway(method, path7, body, query) {
         const url = new URL(path7, this.config.gatewayBaseUrl);
         if (query) url.search = query;
-        const headers = signRequest(
-          method,
-          path7,
-          query || "",
-          this.config.accessId,
-          this.config.hmacSecret
-        );
+        const { accessId, hmacSecret } = this.resolveCredentials();
+        const headers = signRequest(method, path7, query || "", accessId, hmacSecret);
         return this.fetch(url.toString(), {
           method,
           headers: {
@@ -4547,10 +4550,10 @@ var init_dist = __esm({
         }
       }
       get accessId() {
-        return this.config.accessId;
+        return this.resolveCredentials().accessId;
       }
       get hmacSecret() {
-        return this.config.hmacSecret;
+        return this.resolveCredentials().hmacSecret;
       }
     };
     ALLOWED_OFFRAMP_PROVIDERS = /* @__PURE__ */ new Set(["MoonPay"]);
@@ -6506,7 +6509,7 @@ var require_source = __commonJS({
 var dist_exports2 = {};
 __export(dist_exports2, {
   AgentWalletProvider: () => AgentWalletProvider,
-  BlockchainClient: () => BlockchainClient,
+  ChainClient: () => ChainClient,
   TeeWalletProvider: () => TeeWalletProvider,
   VerifyCredentialsError: () => VerifyCredentialsError,
   WalletContext: () => WalletContext,
@@ -7366,7 +7369,7 @@ function registerShutdownHandlers(providers, onBeforeExit) {
     process.removeListener("SIGTERM", handler);
   };
 }
-var fs2, path2, import_trust_sdk, import_trust_sdk2, import_trust_sdk3, import_trust_sdk4, import_trust_sdk5, import_crypto2, __require, polyfillsApplied, _credentials, _naasSessionId, nodeStubsPatched, sponsorNonceByAddress, NAAS_SESSION_RE, naasSessionPatched, coinTypeByValue, walletCore, initialized, BSC_COIN_ID, DEFAULT_BSC_SPONSORED_RPC, SPONSOR_PRECHECK_TIMEOUT_MS, SPONSOR_USER_AGENT, RPC_TIMEOUT_MS, RECEIPT_POLL_INTERVAL_MS, RECEIPT_DEFAULT_TIMEOUT_MS, BlockchainClient, WalletCoreSigner, domainsByCoinId, GATEWAY_URL, DEVICE_INFO_BODY, VerifyCredentialsError, WALLET_ID_SUFFIX, WALLET_ID_LENGTH, EVM_COIN_IDS, MAINTAINED_COIN_IDS, WalletProvider, AgentWalletProvider, TeeWalletProvider, WalletContext, SHUTDOWN_TIMEOUT_MS;
+var fs2, path2, import_trust_sdk, import_trust_sdk2, import_trust_sdk3, import_trust_sdk4, import_trust_sdk5, import_crypto2, __require, polyfillsApplied, _credentials, _naasSessionId, nodeStubsPatched, sponsorNonceByAddress, NAAS_SESSION_RE, naasSessionPatched, coinTypeByValue, walletCore, initialized, BSC_COIN_ID, DEFAULT_BSC_SPONSORED_RPC, SPONSOR_PRECHECK_TIMEOUT_MS, SPONSOR_USER_AGENT, RPC_TIMEOUT_MS, RECEIPT_POLL_INTERVAL_MS, RECEIPT_DEFAULT_TIMEOUT_MS, ChainClient, SigningChainClient, WalletCoreSigner, domainsByCoinId, GATEWAY_URL, DEVICE_INFO_BODY, VerifyCredentialsError, WALLET_ID_SUFFIX, WALLET_ID_LENGTH, EVM_COIN_IDS, MAINTAINED_COIN_IDS, WalletProvider, AgentWalletProvider, TeeWalletProvider, WalletContext, SHUTDOWN_TIMEOUT_MS;
 var init_dist3 = __esm({
   "../wallet-core/dist/index.mjs"() {
     "use strict";
@@ -7409,18 +7412,20 @@ var init_dist3 = __esm({
     RPC_TIMEOUT_MS = 15e3;
     RECEIPT_POLL_INTERVAL_MS = 1500;
     RECEIPT_DEFAULT_TIMEOUT_MS = 6e4;
-    BlockchainClient = class _BlockchainClient {
-      signer;
-      constructor(signer) {
-        this.signer = signer;
-      }
-      setSigner(signer) {
-        this.signer = signer;
-      }
+    ChainClient = class {
+      /** Balance of `address`, read through an account built from that address alone. */
       async getBalance(assetId, address, chainKey) {
+        const { coinId } = parseTokenId(assetId);
+        return this.loadBalance(
+          assetId,
+          this.createAccountForAddress(coinId, address, chainKey),
+          address
+        );
+      }
+      /** `address` feeds the Bitcoin REST fallback when the SDK load fails. */
+      async loadBalance(assetId, account, address) {
         const { coinId, contractAddress } = parseTokenId(assetId);
         const ct5 = requireCoinType(coinId);
-        const account = this.createAccountForAddress(coinId, address, chainKey);
         const asset = contractAddress ? new import_trust_sdk2.Asset.Token(account, contractAddress, tokenTypeForCoinId(coinId)) : new import_trust_sdk2.Asset.Coin(account);
         let results;
         try {
@@ -7513,47 +7518,6 @@ var init_dist3 = __esm({
         }
         return result;
       }
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      async transfer(params) {
-        const { coinId, contractAddress } = parseTokenId(params.assetId);
-        const chainKey = params.chainKey;
-        const ct5 = requireCoinType(coinId);
-        const account = this.getAccountFromSigner(chainKey);
-        const asset = contractAddress ? new import_trust_sdk2.Asset.Token(account, contractAddress, tokenTypeForCoinId(coinId)) : new import_trust_sdk2.Asset.Coin(account);
-        let decimals;
-        if (params.decimals !== void 0) {
-          decimals = params.decimals;
-        } else if (contractAddress) {
-          const known = lookupKnownTokenDecimals(chainKey, contractAddress);
-          if (known === void 0) {
-            throw new TwakValidationError(
-              `Cannot determine decimals for ${params.assetId}; pass decimals explicitly.`
-            );
-          }
-          decimals = known;
-        } else {
-          decimals = getCoinDecimals(coinId);
-        }
-        const amountWei = humanAmountToWei(params.amount, decimals);
-        const transaction = new import_trust_sdk2.TransactionTransfer(
-          params.to,
-          asset,
-          amountWei.toString(),
-          false,
-          params.memo || null
-        );
-        return this.signAndBroadcast(transaction, account, coinId, chainKey, ct5, params.hdWallet);
-      }
-      async executeContract(params) {
-        const { coinId } = parseTokenId(params.assetId);
-        const chainKey = params.chainKey;
-        const ct5 = requireCoinType(coinId);
-        const account = this.getAccountFromSigner(chainKey);
-        const asset = new import_trust_sdk2.Asset.Coin(account);
-        const valueWei = params.value && params.value !== "0x0" && params.value !== "0x" ? BigInt(params.value).toString() : "0";
-        const transaction = new import_trust_sdk2.TransactionSmartContract(asset, params.to, valueWei, params.data);
-        return this.signAndBroadcast(transaction, account, coinId, chainKey, ct5, params.hdWallet);
-      }
       /**
        * Execute a read-only EVM `eth_call` against the chain's default RPC node.
        * Returns the raw hex result string from the JSON-RPC envelope, or `'0x'`
@@ -7617,6 +7581,177 @@ var init_dist3 = __esm({
       contract(def) {
         return def.using(this);
       }
+      async findTransactionStatus(chainKey, address, hash) {
+        const coinId = chainKeyToCoinType(chainKey);
+        if (coinId === void 0) throw new Error(`Unsupported chain: ${chainKey}`);
+        const account = this.createAccountForAddress(coinId, address);
+        let result;
+        try {
+          result = await import_trust_sdk2.BlockchainService.findTransaction(account, hash);
+        } catch {
+          return { confirmed: false, pending: false, failed: false, error: "Transaction not found" };
+        }
+        if (!result) {
+          return { confirmed: false, pending: false, failed: false, error: "Transaction not found" };
+        }
+        const failed = result.status instanceof import_trust_sdk2.TransactionResult.Status.Failed;
+        return {
+          confirmed: result.status === import_trust_sdk2.TransactionResult.Status.Confirmed,
+          pending: result.status === import_trust_sdk2.TransactionResult.Status.Pending,
+          failed,
+          error: failed ? result.status.error : void 0,
+          meta: result.meta || void 0
+        };
+      }
+      async getNodes(chainKey) {
+        const coinId = chainKeyToCoinType(chainKey);
+        if (coinId === void 0) {
+          throw new Error(`Unsupported chain: ${chainKey}`);
+        }
+        const ct5 = requireCoinType(coinId);
+        const chain2 = new import_trust_sdk2.DefinedChain(ct5);
+        const nodes = await import_trust_sdk2.BlockchainService.getNodes(chain2);
+        return nodes.map((n4) => ({ url: n4.url }));
+      }
+      async setNode(chainKey, rpcUrl) {
+        const coinId = chainKeyToCoinType(chainKey);
+        if (coinId === void 0) {
+          throw new Error(`Unsupported chain: ${chainKey}`);
+        }
+        const ct5 = requireCoinType(coinId);
+        const chain2 = new import_trust_sdk2.DefinedChain(ct5);
+        await import_trust_sdk2.BlockchainService.setNode(chain2, new import_trust_sdk2.Node(rpcUrl));
+      }
+      createAccountForAddress(coinId, address, chainKey) {
+        const ct5 = requireCoinType(coinId);
+        const chain2 = chainKey !== void 0 && isTestnetChain(chainKey) ? chainKeyToDefinedChain(chainKey).chain : new import_trust_sdk2.DefinedChain(ct5);
+        const wc3 = getWalletCore();
+        const derivation = coinId === 0 && address.startsWith("bc1p") ? wc3.Derivation.bitcoinTaproot : coinId === 0 && address.startsWith("bc1") ? wc3.Derivation.bitcoinSegwit : wc3.Derivation.default;
+        return new import_trust_sdk2.Account(address, derivation, "", "", "", chain2);
+      }
+      async fetchBitcoinBalanceFromBlockbook(address) {
+        const res = await fetch(
+          `https://btc-blockbook.twnodes.com/api/v2/address/${encodeURIComponent(address)}?details=basic`
+        );
+        if (!res.ok) throw new Error(`Blockbook error: ${res.status}`);
+        const data = await res.json();
+        const confirmed = data.balance || "0";
+        const unconfirmed = data.unconfirmedBalance || "0";
+        const total = BigInt(confirmed) + BigInt(unconfirmed);
+        return { available: confirmed, total: total.toString() };
+      }
+      async resolveRpcUrl(chainKey) {
+        const { chain: chain2 } = chainKeyToDefinedChain(chainKey);
+        return this.rpcUrlForChain(chain2, chainKey);
+      }
+      async rpcUrlForChain(chain2, chainKey) {
+        const nodes = await import_trust_sdk2.BlockchainService.getNodes(chain2);
+        const rpcUrl = nodes[0]?.url;
+        if (!rpcUrl) {
+          throw new TwakNetworkError(`No RPC node available for ${chainKey}`, { chainKey });
+        }
+        return rpcUrl;
+      }
+      async postJsonRpc(rpcUrl, method, params, opts) {
+        const timeoutMs = opts?.timeoutMs ?? RPC_TIMEOUT_MS;
+        let response;
+        try {
+          response = await fetch(rpcUrl, {
+            method: "POST",
+            headers: { "Content-Type": "application/json", ...opts?.headers },
+            body: JSON.stringify({ jsonrpc: "2.0", id: 1, method, params }),
+            signal: AbortSignal.timeout(timeoutMs)
+          });
+        } catch (err) {
+          throw new TwakNetworkError(`RPC fetch failed on ${method}: ${errorMessage(err)}`, {
+            method,
+            rpcUrl,
+            timeoutMs
+          });
+        }
+        if (!response.ok) {
+          const body = await response.text().catch(() => "");
+          const truncated = body.slice(0, 500);
+          throw new TwakNetworkError(`RPC HTTP error ${response.status} on ${method}: ${truncated}`, {
+            status: response.status,
+            method,
+            rpcUrl,
+            body: truncated
+          });
+        }
+        let json;
+        try {
+          json = await response.json();
+        } catch (err) {
+          throw new TwakNetworkError(
+            `RPC response JSON parse failed on ${method}: ${errorMessage(err)}`,
+            { method, rpcUrl }
+          );
+        }
+        if (json.error) {
+          const { message, data } = json.error;
+          const suffix = revertDataSuffix(message, data);
+          throw new TwakNetworkError(`RPC error on ${method}: ${message}${suffix}`, {
+            method,
+            rpcUrl,
+            rpcError: json.error
+          });
+        }
+        return json.result;
+      }
+    };
+    SigningChainClient = class _SigningChainClient extends ChainClient {
+      constructor(signer) {
+        super();
+        this.signer = signer;
+      }
+      /** This wallet's own balance, read through its derived account (for UTXO
+       * chains such as Bitcoin it carries the extended public key). */
+      async getOwnBalance(assetId, chainKey) {
+        const account = this.getAccountFromSigner(chainKey);
+        return this.loadBalance(assetId, account, account.address);
+      }
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      async transfer(params) {
+        const { coinId, contractAddress } = parseTokenId(params.assetId);
+        const chainKey = params.chainKey;
+        const ct5 = requireCoinType(coinId);
+        const account = this.getAccountFromSigner(chainKey);
+        const asset = contractAddress ? new import_trust_sdk2.Asset.Token(account, contractAddress, tokenTypeForCoinId(coinId)) : new import_trust_sdk2.Asset.Coin(account);
+        let decimals;
+        if (params.decimals !== void 0) {
+          decimals = params.decimals;
+        } else if (contractAddress) {
+          const known = lookupKnownTokenDecimals(chainKey, contractAddress);
+          if (known === void 0) {
+            throw new TwakValidationError(
+              `Cannot determine decimals for ${params.assetId}; pass decimals explicitly.`
+            );
+          }
+          decimals = known;
+        } else {
+          decimals = getCoinDecimals(coinId);
+        }
+        const amountWei = humanAmountToWei(params.amount, decimals);
+        const transaction = new import_trust_sdk2.TransactionTransfer(
+          params.to,
+          asset,
+          amountWei.toString(),
+          false,
+          params.memo || null
+        );
+        return this.signAndBroadcast(transaction, account, coinId, chainKey, ct5, params.hdWallet);
+      }
+      async executeContract(params) {
+        const { coinId } = parseTokenId(params.assetId);
+        const chainKey = params.chainKey;
+        const ct5 = requireCoinType(coinId);
+        const account = this.getAccountFromSigner(chainKey);
+        const asset = new import_trust_sdk2.Asset.Coin(account);
+        const valueWei = params.value && params.value !== "0x0" && params.value !== "0x" ? BigInt(params.value).toString() : "0";
+        const transaction = new import_trust_sdk2.TransactionSmartContract(asset, params.to, valueWei, params.data);
+        return this.signAndBroadcast(transaction, account, coinId, chainKey, ct5, params.hdWallet);
+      }
       async transferRawSolana(params) {
         const ct5 = requireCoinType(501);
         const chain2 = new import_trust_sdk2.DefinedChain(ct5);
@@ -7702,47 +7837,6 @@ var init_dist3 = __esm({
           currency: chainKey
         };
       }
-      async findTransactionStatus(chainKey, address, hash) {
-        const coinId = chainKeyToCoinType(chainKey);
-        if (coinId === void 0) throw new Error(`Unsupported chain: ${chainKey}`);
-        const account = this.createAccountForAddress(coinId, address);
-        let result;
-        try {
-          result = await import_trust_sdk2.BlockchainService.findTransaction(account, hash);
-        } catch {
-          return { confirmed: false, pending: false, failed: false, error: "Transaction not found" };
-        }
-        if (!result) {
-          return { confirmed: false, pending: false, failed: false, error: "Transaction not found" };
-        }
-        const failed = result.status instanceof import_trust_sdk2.TransactionResult.Status.Failed;
-        return {
-          confirmed: result.status === import_trust_sdk2.TransactionResult.Status.Confirmed,
-          pending: result.status === import_trust_sdk2.TransactionResult.Status.Pending,
-          failed,
-          error: failed ? result.status.error : void 0,
-          meta: result.meta || void 0
-        };
-      }
-      async getNodes(chainKey) {
-        const coinId = chainKeyToCoinType(chainKey);
-        if (coinId === void 0) {
-          throw new Error(`Unsupported chain: ${chainKey}`);
-        }
-        const ct5 = requireCoinType(coinId);
-        const chain2 = new import_trust_sdk2.DefinedChain(ct5);
-        const nodes = await import_trust_sdk2.BlockchainService.getNodes(chain2);
-        return nodes.map((n4) => ({ url: n4.url }));
-      }
-      async setNode(chainKey, rpcUrl) {
-        const coinId = chainKeyToCoinType(chainKey);
-        if (coinId === void 0) {
-          throw new Error(`Unsupported chain: ${chainKey}`);
-        }
-        const ct5 = requireCoinType(coinId);
-        const chain2 = new import_trust_sdk2.DefinedChain(ct5);
-        await import_trust_sdk2.BlockchainService.setNode(chain2, new import_trust_sdk2.Node(rpcUrl));
-      }
       // EIP-7702 sponsorship-eligible chain coin IDs
       static SPONSORABLE_COINS = [60, 20000714];
       /**
@@ -7902,7 +7996,7 @@ var init_dist3 = __esm({
         } catch {
         }
         const seen = new Set(candidates.map((a3) => a3.toLowerCase()));
-        for (const addr of _BlockchainClient.FALLBACK_GAS_TOKENS[coinId] || []) {
+        for (const addr of _SigningChainClient.FALLBACK_GAS_TOKENS[coinId] || []) {
           if (!seen.has(addr.toLowerCase())) candidates.push(addr);
         }
         if (candidates.length === 0) return void 0;
@@ -7929,7 +8023,7 @@ var init_dist3 = __esm({
        * Trust SDK routes through the Smart Wallet fee service internally.
        */
       async calculateFeeWithSponsorship(transaction, account, coinId, chainKey) {
-        if (!_BlockchainClient.SPONSORABLE_COINS.includes(coinId) || chainKey !== void 0 && isTestnetChain(chainKey)) {
+        if (!_SigningChainClient.SPONSORABLE_COINS.includes(coinId) || chainKey !== void 0 && isTestnetChain(chainKey)) {
           return { fee: await import_trust_sdk2.BlockchainService.calculateFee(transaction) };
         }
         let supports7702 = false;
@@ -8060,97 +8154,8 @@ var init_dist3 = __esm({
         return { fee: baseFee, transaction7702: tx7702 };
       }
       getAccountFromSigner(chainKey) {
-        if (!this.signer) {
-          throw new Error("BlockchainClient requires a signer for this operation");
-        }
         return this.signer.getAccount(chainKey);
       }
-      createAccountForAddress(coinId, address, chainKey) {
-        if (this.signer) {
-          const key = chainKey ?? coinTypeToChainKey(coinId);
-          if (key) {
-            try {
-              return this.signer.getAccount(key);
-            } catch {
-            }
-          }
-        }
-        const ct5 = requireCoinType(coinId);
-        const chain2 = chainKey !== void 0 && isTestnetChain(chainKey) ? chainKeyToDefinedChain(chainKey).chain : new import_trust_sdk2.DefinedChain(ct5);
-        const wc3 = getWalletCore();
-        const derivation = coinId === 0 && address.startsWith("bc1p") ? wc3.Derivation.bitcoinTaproot : coinId === 0 && address.startsWith("bc1") ? wc3.Derivation.bitcoinSegwit : wc3.Derivation.default;
-        return new import_trust_sdk2.Account(address, derivation, "", "", "", chain2);
-      }
-      async fetchBitcoinBalanceFromBlockbook(address) {
-        const res = await fetch(
-          `https://btc-blockbook.twnodes.com/api/v2/address/${encodeURIComponent(address)}?details=basic`
-        );
-        if (!res.ok) throw new Error(`Blockbook error: ${res.status}`);
-        const data = await res.json();
-        const confirmed = data.balance || "0";
-        const unconfirmed = data.unconfirmedBalance || "0";
-        const total = BigInt(confirmed) + BigInt(unconfirmed);
-        return { available: confirmed, total: total.toString() };
-      }
-      async resolveRpcUrl(chainKey) {
-        const { chain: chain2 } = chainKeyToDefinedChain(chainKey);
-        return this.rpcUrlForChain(chain2, chainKey);
-      }
-      async rpcUrlForChain(chain2, chainKey) {
-        const nodes = await import_trust_sdk2.BlockchainService.getNodes(chain2);
-        const rpcUrl = nodes[0]?.url;
-        if (!rpcUrl) {
-          throw new TwakNetworkError(`No RPC node available for ${chainKey}`, { chainKey });
-        }
-        return rpcUrl;
-      }
-      async postJsonRpc(rpcUrl, method, params, opts) {
-        const timeoutMs = opts?.timeoutMs ?? RPC_TIMEOUT_MS;
-        let response;
-        try {
-          response = await fetch(rpcUrl, {
-            method: "POST",
-            headers: { "Content-Type": "application/json", ...opts?.headers },
-            body: JSON.stringify({ jsonrpc: "2.0", id: 1, method, params }),
-            signal: AbortSignal.timeout(timeoutMs)
-          });
-        } catch (err) {
-          throw new TwakNetworkError(`RPC fetch failed on ${method}: ${errorMessage(err)}`, {
-            method,
-            rpcUrl,
-            timeoutMs
-          });
-        }
-        if (!response.ok) {
-          const body = await response.text().catch(() => "");
-          const truncated = body.slice(0, 500);
-          throw new TwakNetworkError(`RPC HTTP error ${response.status} on ${method}: ${truncated}`, {
-            status: response.status,
-            method,
-            rpcUrl,
-            body: truncated
-          });
-        }
-        let json;
-        try {
-          json = await response.json();
-        } catch (err) {
-          throw new TwakNetworkError(
-            `RPC response JSON parse failed on ${method}: ${errorMessage(err)}`,
-            { method, rpcUrl }
-          );
-        }
-        if (json.error) {
-          const { message, data } = json.error;
-          const suffix = revertDataSuffix(message, data);
-          throw new TwakNetworkError(`RPC error on ${method}: ${message}${suffix}`, {
-            method,
-            rpcUrl,
-            rpcError: json.error
-          });
-        }
-        return json.result;
-      }
     };
     WalletCoreSigner = class _WalletCoreSigner {
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -8299,6 +8304,7 @@ var init_dist3 = __esm({
     };
     AgentWalletProvider = class _AgentWalletProvider extends WalletProvider {
       name = "agent";
+      kind = "local";
       signer;
       blockchainClient;
       connected = true;
@@ -8355,7 +8361,7 @@ var init_dist3 = __esm({
           const store = new WalletConfigStore();
           const mnemonic = await store.loadMnemonic(password3);
           this.signer = await WalletCoreSigner.fromMnemonic(mnemonic);
-          this.blockchainClient = new BlockchainClient(this.signer);
+          this.blockchainClient = new SigningChainClient(this.signer);
           this.connected = true;
         })();
         try {
@@ -8371,21 +8377,21 @@ var init_dist3 = __esm({
         const store = new WalletConfigStore();
         await store.saveMnemonic(mnemonic, password3, Object.keys(CHAINS));
         const signer = WalletCoreSigner.fromHDWallet(hdWallet);
-        const client = new BlockchainClient(signer);
+        const client = new SigningChainClient(signer);
         return new _AgentWalletProvider(signer, client);
       }
       static async fromStorage(password3) {
         const store = new WalletConfigStore();
         const mnemonic = await store.loadMnemonic(password3);
         const signer = await WalletCoreSigner.fromMnemonic(mnemonic);
-        const client = new BlockchainClient(signer);
+        const client = new SigningChainClient(signer);
         return new _AgentWalletProvider(signer, client);
       }
       static async fromMnemonic(mnemonic, password3) {
         const store = new WalletConfigStore();
         await store.saveMnemonic(mnemonic, password3, Object.keys(CHAINS));
         const signer = await WalletCoreSigner.fromMnemonic(mnemonic);
-        const client = new BlockchainClient(signer);
+        const client = new SigningChainClient(signer);
         return new _AgentWalletProvider(signer, client);
       }
       async getAddress(chainId) {
@@ -8473,6 +8479,20 @@ var init_dist3 = __esm({
         });
         return result.hash;
       }
+      async transfer(request) {
+        await this.ensureConnected();
+        this.resetAutoLockTimer();
+        const { hash, chainKey } = await this.blockchainClient.transfer({
+          ...request,
+          hdWallet: this.signer.getHDWallet()
+        });
+        return { hash, chainKey };
+      }
+      async getBalance(assetId, chainKey) {
+        await this.ensureConnected();
+        this.resetAutoLockTimer();
+        return this.blockchainClient.getOwnBalance(assetId, chainKey);
+      }
       supportsChain(chainId) {
         return isChainSupported(chainId);
       }
@@ -8500,19 +8520,10 @@ var init_dist3 = __esm({
       isConnected() {
         return this.connected;
       }
-      getBlockchainClient() {
-        if (!this.connected)
-          throw new Error("Wallet is locked. Use an async method to trigger re-auth.");
-        return this.blockchainClient;
-      }
-      getSigner() {
-        if (!this.connected)
-          throw new Error("Wallet is locked. Use an async method to trigger re-auth.");
-        return this.signer;
-      }
     };
     TeeWalletProvider = class extends WalletProvider {
       name = "tee";
+      kind = "remote";
       address = null;
       async getAddress(_chainId) {
         if (!this.address) throw new Error("TEE wallet not initialized");
@@ -8531,6 +8542,12 @@ var init_dist3 = __esm({
       async sendTransaction(_params) {
         throw new Error("TEE transaction sending not yet implemented");
       }
+      async transfer() {
+        throw new Error("TEE transfers not yet implemented");
+      }
+      async getBalance() {
+        throw new Error("TEE balances not yet implemented");
+      }
       supportsChain(_chainId) {
         return false;
       }
@@ -25724,6 +25741,17 @@ var import_chalk2 = __toESM(require_source());
 init_dist();
 init_dist3();
 init_dist2();
+
+// src/credentials-error.ts
+init_dist();
+function credentialsMissingError() {
+  return new CommandError(
+    "CREDENTIALS_MISSING",
+    "No API credentials found. Run `twak init` or `twak setup` (or set TWAK_ACCESS_ID and TWAK_HMAC_SECRET env vars)."
+  );
+}
+
+// src/config-loader.ts
 var EMBEDDED_NAAS_SESSION_ID = "NDVjMWRjY2MtYTYwNy00NGNhLWIxZGUtMmJiZDIyNmEyODQ4";
 function resolveNaasSessionId() {
   if (process.env.TWAK_NAAS_SESSION_ID) return process.env.TWAK_NAAS_SESSION_ID;
@@ -25731,45 +25759,41 @@ function resolveNaasSessionId() {
     return EMBEDDED_NAAS_SESSION_ID;
   return void 0;
 }
-async function getCredentials() {
+async function loadCredentials() {
   const envAccessId = process.env.TWAK_ACCESS_ID;
   const envSecret = process.env.TWAK_HMAC_SECRET;
   if (envAccessId && envSecret) {
     return { accessId: envAccessId, hmacSecret: envSecret };
   }
-  const credManager = new CredentialManager();
-  const credentials = await credManager.load();
+  const credentials = await new CredentialManager().load();
   if (credentials) {
     return { accessId: credentials.accessId, hmacSecret: credentials.hmacSecret };
   }
-  throw new CommandError(
-    "VALIDATION_ERROR",
-    "No API credentials found. Run `twak setup` (or set TWAK_ACCESS_ID and TWAK_HMAC_SECRET env vars)."
-  );
+  return null;
+}
+async function getCredentials() {
+  const credentials = await loadCredentials();
+  if (credentials) return credentials;
+  throw credentialsMissingError();
 }
 async function getClient() {
   const creds = await getCredentials();
   return createTwakClient({ ...creds });
 }
 async function tryGetClient() {
-  const envAccessId = process.env.TWAK_ACCESS_ID;
-  const envSecret = process.env.TWAK_HMAC_SECRET;
-  if (envAccessId && envSecret) {
-    return createTwakClient({ accessId: envAccessId, hmacSecret: envSecret });
-  }
-  const credentials = await new CredentialManager().load();
-  if (credentials) {
-    return createTwakClient({ accessId: credentials.accessId, hmacSecret: credentials.hmacSecret });
-  }
-  return void 0;
+  const credentials = await loadCredentials();
+  return credentials ? createTwakClient(credentials) : void 0;
 }
-async function ensureTrustSDK() {
-  const creds = await getCredentials();
+async function initTrustSDKWithCredentials(creds) {
   await initTrustSDK({
     accessId: creds.accessId,
     hmacSecret: creds.hmacSecret,
     naasSessionId: resolveNaasSessionId()
   });
+}
+async function ensureTrustSDK() {
+  const creds = await getCredentials();
+  await initTrustSDKWithCredentials(creds);
   return creds;
 }
 async function registerWalletWithBackend(creds, provider) {
@@ -41715,10 +41739,10 @@ var FileKeyValueStorage = class {
   }
 };
 var DEFAULT_METADATA = {
-  name: "TWAK Agent",
-  description: "AI Agent for Trust Wallet operations",
+  name: "TWAK",
+  description: "Trust Wallet Agent Kit",
   url: "https://portal.trustwallet.com",
-  icons: ["https://avatars.githubusercontent.com/u/32179365"]
+  icons: ["https://avatars.githubusercontent.com/u/32179889"]
 };
 var SESSION_CLEARED_REASON = { code: 6e3, message: "Session cleared" };
 var PEER_NOTIFY_TIMEOUT_MS = 5e3;
@@ -41752,6 +41776,7 @@ async function settleWithin(promise, ms3) {
 var WC_NOT_CONNECTED_MSG = 'WalletConnect session not established. If pairing is in progress, complete the approval in Trust Wallet mobile and retry; otherwise call switch_wallet_mode({mode: "walletconnect"}) to start pairing.';
 var WalletConnectProvider = class extends WalletProvider {
   name = "walletconnect";
+  kind = "remote";
   client = null;
   initPromise = null;
   currentSession = null;
@@ -41903,6 +41928,43 @@ var WalletConnectProvider = class extends WalletProvider {
       }
     });
   }
+  /**
+   * EVM only: the phone signs and broadcasts. Native coins go out as a value
+   * transfer, tokens as an ERC-20 `transfer` call built by the chain client.
+   */
+  async transfer(request) {
+    const { chainKey } = request;
+    const chain2 = requireChain(chainKey);
+    if (chain2.namespace !== "eip155") {
+      throw new TransferError(
+        "CHAIN_UNSUPPORTED",
+        `transfer on ${chainKey} is not supported in WalletConnect mode (EVM-only). Switch to local wallet mode for ${chainKey} transfers.`
+      );
+    }
+    if (request.decimals === void 0) {
+      throw new TransferError("VALIDATION_ERROR", `Decimals are required for ${request.assetId}`);
+    }
+    const atomicAmount = BigInt(parseAmount(request.amount, request.decimals));
+    const { contractAddress } = parseTokenId(request.assetId);
+    if (contractAddress) {
+      assertEvmAddress(contractAddress, "tokenAddress");
+      const { erc20: erc202 } = await Promise.resolve().then(() => (init_dist4(), dist_exports3));
+      const pending = await this.config.chainClient.contract(erc202).withAddress(contractAddress, chainKey).write.transfer([request.to, atomicAmount], this);
+      return { hash: pending.hash, chainKey };
+    }
+    assertEvmAddress(request.to, "to");
+    const hash = await this.sendTransaction({
+      chainId: `${chain2.namespace}:${chain2.chainId}`,
+      to: request.to,
+      data: "0x",
+      value: "0x" + atomicAmount.toString(16)
+    });
+    return { hash, chainKey };
+  }
+  async getBalance(assetId, chainKey) {
+    const address = await this.getAddress(chainKey);
+    return this.config.chainClient.getBalance(assetId, address, chainKey);
+  }
   async sendTransaction(params) {
     const session = this.getActiveSession();
     if (!session) throw new WalletError("WC_NOT_CONNECTED", WC_NOT_CONNECTED_MSG);
@@ -42193,7 +42255,10 @@ async function tryRegisterWallet() {
   }
 }
 function registerInitCommand(program3) {
-  program3.command("init").description("Initialize twak configuration").option("--api-key <key>", "TWAK API access ID (prefer TWAK_ACCESS_ID env var)").option("--api-secret <secret>", "TWAK HMAC secret (prefer TWAK_HMAC_SECRET env var)").option("--wc-project-id <id>", "WalletConnect project ID").option("--json", "JSON output").action(async (opts) => {
+  program3.command("init").description("Initialize twak configuration").option("--api-key <key>", "TWAK API access ID (prefer TWAK_ACCESS_ID env var)").option("--api-secret <secret>", "TWAK HMAC secret (prefer TWAK_HMAC_SECRET env var)").option(
+    "--wc-project-id <id>",
+    "WalletConnect project ID override (default: Trust Wallet project)"
+  ).option("--json", "JSON output").action(async (opts) => {
     try {
       const credManager = new CredentialManager();
       if (opts.apiKey && opts.apiSecret) {
@@ -42558,8 +42623,8 @@ async function runInteractive(deps) {
   const hmacSecret = (await deps.prompter.promptHmacSecret()).trim();
   info(
     `
-WalletConnect Project ID is only used when signing via WalletConnect in MCP mode.
-Skip if you only plan to use the local agent wallet. Get one at: ${WC_DASHBOARD_URL}
+WalletConnect Project ID is optional: twak uses Trust Wallet's project by default.
+Set one only to use your own project. Get one at: ${WC_DASHBOARD_URL}
 `
   );
   const walletConnectProjectId = (await deps.prompter.promptWalletConnectProjectId())?.trim() || void 0;
@@ -43107,7 +43172,10 @@ var import_chalk4 = __toESM(require_source());
 init_dist2();
 function registerAuthCommand(program3) {
   const auth = program3.command("auth").description("Manage authentication");
-  auth.command("setup").description("Set up API credentials").requiredOption("--api-key <key>", "TWAK API access ID").requiredOption("--api-secret <secret>", "TWAK HMAC secret").option("--wc-project-id <id>", "WalletConnect project ID").action(async (opts) => {
+  auth.command("setup").description("Set up API credentials").requiredOption("--api-key <key>", "TWAK API access ID").requiredOption("--api-secret <secret>", "TWAK HMAC secret").option(
+    "--wc-project-id <id>",
+    "WalletConnect project ID override (default: Trust Wallet project)"
+  ).action(async (opts) => {
     const credManager = new CredentialManager();
     await credManager.save({
       accessId: opts.apiKey,
@@ -43126,7 +43194,9 @@ function registerAuthCommand(program3) {
     if (opts.json) {
       output({ configured, source, accessId }, true);
     } else {
-      console.log(`  ${import_chalk4.default.dim("Status")}     ${configured ? import_chalk4.default.green("configured") : import_chalk4.default.yellow("not configured")}`);
+      console.log(
+        `  ${import_chalk4.default.dim("Status")}     ${configured ? import_chalk4.default.green("configured") : import_chalk4.default.yellow("not configured")}`
+      );
       console.log(`  ${import_chalk4.default.dim("Source")}     ${source}`);
       if (accessId) console.log(`  ${import_chalk4.default.dim("Access ID")}  ${accessId}...`);
       if (!configured) info("\nRun `twak init` to set up credentials.");
@@ -43178,9 +43248,6 @@ function mapBroadcastError(err) {
   }
   throw err;
 }
-function hasLocalSigner(wallet) {
-  return typeof wallet.getSigner === "function";
-}
 var TransferExecutor = class {
   constructor(deps) {
     this.deps = deps;
@@ -43199,7 +43266,7 @@ var TransferExecutor = class {
     }
   }
   async run(params) {
-    const { wallet, swapClient, blockchainClient, onInfo, onWarn } = this.deps;
+    const { wallet, swapClient, onInfo, onWarn } = this.deps;
     const chainKey = resolveChain(params.chain);
     const contractAddress = params.tokenAddress && params.tokenAddress.toLowerCase() !== NATIVE_TOKEN_ADDRESS.toLowerCase() ? params.tokenAddress : void 0;
     const { assetId } = resolveAsset(chainKey, contractAddress);
@@ -43237,7 +43304,7 @@ var TransferExecutor = class {
       isNative: !contractAddress,
       explicitDecimals: params.decimals ?? null
     });
-    const atomicAmount = parseAmount(params.amount, decimals);
+    parseAmount(params.amount, decimals);
     if (!params.safety?.skip) {
       const maxUsd = params.safety?.maxUsd ?? DEFAULT_MAX_TRANSFER_USD;
       const warnThreshold = params.safety?.warnThresholdUsd ?? DEFAULT_WARN_THRESHOLD_USD;
@@ -43263,80 +43330,30 @@ var TransferExecutor = class {
         );
       }
     }
-    let hash;
-    let resultChainKey = chainKey;
-    if (hasLocalSigner(wallet)) {
-      if (!blockchainClient) {
-        throw new TransferError(
-          "WALLET_NOT_FOUND",
-          "BlockchainClient not available \u2014 local transfer requires a configured blockchain client"
-        );
-      }
-      const from8 = await wallet.getAddress(chainKey);
-      onInfo?.(`Sending from ${from8} on ${chainKey}...`);
-      const hdWallet = wallet.getSigner().getHDWallet();
-      try {
-        const result = await blockchainClient.transfer({
-          assetId,
-          to: resolvedTo,
-          amount: params.amount,
-          decimals,
-          memo: params.memo,
-          hdWallet,
-          chainKey
-        });
-        hash = result.hash;
-        resultChainKey = result.chainKey;
-      } catch (err) {
-        mapBroadcastError(err);
-      }
-      const explorerUrl2 = getExplorerTxUrl(resultChainKey, hash);
-      return {
-        success: true,
-        hash,
-        chainKey: resultChainKey,
+    const local = wallet.kind === "local";
+    const from8 = local ? await wallet.getAddress(chainKey) : "";
+    if (local) onInfo?.(`Sending from ${from8} on ${chainKey}...`);
+    let receipt;
+    try {
+      receipt = await wallet.transfer({
+        chainKey,
         assetId,
-        from: from8,
-        to: resolvedTo,
-        resolvedFrom,
-        explorerUrl: explorerUrl2 || void 0
-      };
-    }
-    const chain2 = requireChain(chainKey);
-    if (chain2.namespace !== "eip155") {
-      throw new TransferError(
-        "CHAIN_UNSUPPORTED",
-        `transfer on ${chainKey} is not supported in WalletConnect mode (EVM-only). Switch to local wallet mode for ${chainKey} transfers.`
-      );
-    }
-    const caip2 = `${chain2.namespace}:${chain2.chainId}`;
-    if (contractAddress) {
-      assertEvmAddress(contractAddress, "tokenAddress");
-      if (!blockchainClient) {
-        throw new TransferError(
-          "WALLET_NOT_FOUND",
-          "BlockchainClient not available \u2014 ERC-20 transfer requires a configured blockchain client"
-        );
-      }
-      const { erc20: erc202 } = await Promise.resolve().then(() => (init_dist4(), dist_exports3));
-      const pending = await blockchainClient.contract(erc202).withAddress(contractAddress, chainKey).write.transfer([resolvedTo, BigInt(atomicAmount)], wallet);
-      hash = pending.hash;
-    } else {
-      assertEvmAddress(resolvedTo, "to");
-      hash = await wallet.sendTransaction({
-        chainId: caip2,
         to: resolvedTo,
-        data: "0x",
-        value: "0x" + BigInt(atomicAmount).toString(16)
+        amount: params.amount,
+        decimals,
+        memo: params.memo
       });
+    } catch (err) {
+      if (local) mapBroadcastError(err);
+      throw err;
     }
-    const explorerUrl = getExplorerTxUrl(chainKey, hash);
+    const explorerUrl = getExplorerTxUrl(receipt.chainKey, receipt.hash);
     return {
       success: true,
-      hash,
-      chainKey,
+      hash: receipt.hash,
+      chainKey: receipt.chainKey,
       assetId,
-      from: "",
+      from: from8,
       to: resolvedTo,
       resolvedFrom,
       explorerUrl: explorerUrl || void 0
@@ -43813,19 +43830,21 @@ var RESTORE_TIMEOUT_MS = 1e4;
 function wcStoragePath() {
   return path4.join(new FileStore().getDataDir(), "walletconnect.json");
 }
+var DEFAULT_WC_PROJECT_ID = "a863b78b54c4222603c8db4d6d880172";
 async function resolveWcProjectId(flag) {
   const fromFlagOrEnv = flag || process.env.WALLETCONNECT_PROJECT_ID;
   if (fromFlagOrEnv) return fromFlagOrEnv;
   try {
     const creds = await new CredentialManager().load();
-    return creds?.walletConnectProjectId || void 0;
+    return creds?.walletConnectProjectId || DEFAULT_WC_PROJECT_ID;
   } catch {
-    return void 0;
+    return DEFAULT_WC_PROJECT_ID;
   }
 }
-function createWalletConnectProvider(projectId) {
+function createWalletConnectProvider(projectId, chainClient) {
   return new WalletConnectProvider({
     projectId,
+    chainClient,
     storagePath: wcStoragePath(),
     onStorageWarning: (msg) => warn(msg)
   });
@@ -43858,17 +43877,10 @@ function getQRString(address) {
     return "";
   }
 }
-var WC_PROJECT_ID_HINT = "Use --project-id, set WALLETCONNECT_PROJECT_ID, or run `twak init --wc-project-id <id>`";
 async function openStoredWalletConnect(projectIdFlag) {
   if (!fs6.existsSync(wcStoragePath())) return null;
   const projectId = await resolveWcProjectId(projectIdFlag);
-  if (!projectId) {
-    throw new WalletError(
-      "VALIDATION_ERROR",
-      `A WalletConnect session is stored but no project ID is configured. ${WC_PROJECT_ID_HINT}`
-    );
-  }
-  const provider = createWalletConnectProvider(projectId);
+  const provider = createWalletConnectProvider(projectId, new ChainClient());
   const session = await withTimeout(provider.restore(), RESTORE_TIMEOUT_MS);
   return { provider, session };
 }
@@ -44169,20 +44181,14 @@ ${qr3}`;
   });
   wallet.command("connect").description("Connect external wallet via WalletConnect").option(
     "--project-id <id>",
-    "WalletConnect project ID (or WALLETCONNECT_PROJECT_ID / twak init --wc-project-id)"
+    "WalletConnect project ID override (default: Trust Wallet project; or WALLETCONNECT_PROJECT_ID / twak init --wc-project-id)"
   ).option(
     "--chains <list>",
     "Comma-separated CAIP-2 chain IDs (default: all supported EVM chains)"
   ).option("--timeout <seconds>", "Connection timeout in seconds", "300").option("--json", "JSON output").action(async (opts) => {
     try {
       const projectId = await resolveWcProjectId(opts.projectId);
-      if (!projectId) {
-        throw new WalletError(
-          "VALIDATION_ERROR",
-          `WalletConnect project ID required. ${WC_PROJECT_ID_HINT}`
-        );
-      }
-      const provider = createWalletConnectProvider(projectId);
+      const provider = createWalletConnectProvider(projectId, new ChainClient());
       const chains = opts.chains ? opts.chains.split(",").map((s2) => s2.trim()).filter(Boolean) : getDefaultWcChains();
       info("Connecting via WalletConnect...");
       const result = await provider.connect(chains);
@@ -44217,7 +44223,7 @@ ${qr3}`;
   });
   wallet.command("disconnect").description("Revoke the stored WalletConnect session").option(
     "--project-id <id>",
-    "WalletConnect project ID (or WALLETCONNECT_PROJECT_ID / twak init --wc-project-id)"
+    "WalletConnect project ID override (default: Trust Wallet project; or WALLETCONNECT_PROJECT_ID / twak init --wc-project-id)"
   ).option("--json", "JSON output").action(async (opts) => {
     try {
       const stored = await openStoredWalletConnect(opts.projectId);
@@ -44239,7 +44245,7 @@ ${qr3}`;
   });
   wallet.command("status").description("Check wallet configuration status").option(
     "--project-id <id>",
-    "WalletConnect project ID used to check the stored session (or WALLETCONNECT_PROJECT_ID / twak init --wc-project-id)"
+    "WalletConnect project ID override used to check the stored session (or WALLETCONNECT_PROJECT_ID / twak init --wc-project-id)"
   ).option("--json", "JSON output").action(async (opts) => {
     try {
       const store = new WalletConfigStore();
@@ -44543,7 +44549,7 @@ function classifySwapError(message) {
   return "TX_FAILED";
 }
 var SwapExecutor = class {
-  constructor(swapClient, walletProvider, options = {}) {
+  constructor(swapClient, walletProvider, options) {
     this.swapClient = swapClient;
     this.walletProvider = walletProvider;
     this.options = options;
@@ -44679,7 +44685,7 @@ var SwapExecutor = class {
     const fromAssetAddr = route.steps[0].from.asset.address;
     if (!fromAssetAddr || fromAssetAddr.toLowerCase() === NATIVE_TOKEN_ADDRESS.toLowerCase())
       return void 0;
-    const blockchainClient = this.getBlockchainClient();
+    const blockchainClient = this.options.chainClient;
     const allowance = await blockchainClient.contract(erc20).withAddress(fromAssetAddr, fromChain).read.allowance([address, stepApproval.operatorAddress]);
     const required = BigInt(stepApproval.minAmount || parsedAmount);
     if (allowance >= required) return void 0;
@@ -44688,14 +44694,6 @@ var SwapExecutor = class {
     this.log(`Approval tx: ${getExplorerTxUrl(fromChain, approveResult.hash)}`);
     return approveResult.hash;
   }
-  getBlockchainClient() {
-    const blockchainClient = this.walletProvider.getBlockchainClient?.() ?? this.options.blockchainClient;
-    if (!blockchainClient)
-      throw new Error(
-        "Wallet provider does not support on-chain reads; cannot check allowance or confirm transactions"
-      );
-    return blockchainClient;
-  }
   async sendTransaction(txData, chainConfig, fromChain) {
     if (chainConfig?.namespace === "solana" && txData.transaction.solanaTx) {
       return this.walletProvider.sendTransaction({
@@ -44714,7 +44712,7 @@ var SwapExecutor = class {
     throw new Error(`No transaction data returned for swap step on ${fromChain}`);
   }
   async pollForConfirmation(chainKey, address, hash, timeoutMs) {
-    const blockchainClient = this.getBlockchainClient();
+    const blockchainClient = this.options.chainClient;
     const deadline = Date.now() + timeoutMs;
     while (Date.now() < deadline) {
       await new Promise((r3) => setTimeout(r3, 2e3));
@@ -44851,7 +44849,6 @@ function registerTransferCommand(program3) {
       const executor = new TransferExecutor({
         wallet: provider,
         swapClient,
-        blockchainClient: provider.getBlockchainClient(),
         onInfo: info,
         onWarn: warn
       });
@@ -45058,6 +45055,7 @@ function registerSwapCommand(program3) {
           return;
         }
         const executor = new SwapExecutor(swapClient, provider, {
+          chainClient: new ChainClient(),
           onStatus: info
         });
         const result = await executor.execute({
@@ -45158,7 +45156,7 @@ function registerErc20Command(program3) {
         warn("WARNING: Unlimited approval grants the spender access to ALL tokens of this type.");
       }
       info(`Approving ${opts.spender} to spend from ${address} on ${chainKey}...`);
-      const client = provider.getBlockchainClient();
+      const client = new ChainClient();
       const pending = await client.contract(erc20).withAddress(contractAddress, chainKey).write.approve([opts.spender, BigInt(amount)], provider);
       const explorerUrl = getExplorerTxUrl(chainKey, pending.hash);
       success("Approval sent!");
@@ -45199,7 +45197,7 @@ function registerErc20Command(program3) {
       );
       const address = await provider.getAddress(chainKey);
       info(`Revoking approval for ${opts.spender} on ${chainKey}...`);
-      const client = provider.getBlockchainClient();
+      const client = new ChainClient();
       const pending = await client.contract(erc20).withAddress(contractAddress, chainKey).write.approve([opts.spender, 0n], provider);
       const explorerUrl = getExplorerTxUrl(chainKey, pending.hash);
       success("Approval revoked!");
@@ -45279,7 +45277,7 @@ function registerErc20Command(program3) {
         contractAddress = parsed;
         chainKey = k4;
       }
-      const client = new BlockchainClient();
+      const client = new ChainClient();
       const allowance = await client.contract(erc20).withAddress(contractAddress, chainKey).read.allowance([opts.owner, opts.spender]);
       output(
         {
@@ -45333,10 +45331,10 @@ function registerErc8004Command(program3) {
       await ensureTrustSDK();
       const password3 = await resolvePassword(opts);
       const provider = await AgentWalletProvider.fromStorage(password3);
-      const ops = new Erc8004Operations(
-        resolveErc8004Contract(provider.getBlockchainClient(), opts.chain),
-        { signer: provider, onInfo: info }
-      );
+      const ops = new Erc8004Operations(resolveErc8004Contract(new ChainClient(), opts.chain), {
+        signer: provider,
+        onInfo: info
+      });
       const result = await ops.register({
         agentURI: opts.uri,
         metadata: parseMetadataPairs(opts.metadata)
@@ -45372,10 +45370,10 @@ function registerErc8004Command(program3) {
       await ensureTrustSDK();
       const password3 = await resolvePassword(opts);
       const provider = await AgentWalletProvider.fromStorage(password3);
-      const ops = new Erc8004Operations(
-        resolveErc8004Contract(provider.getBlockchainClient(), opts.chain),
-        { signer: provider, onInfo: info }
-      );
+      const ops = new Erc8004Operations(resolveErc8004Contract(new ChainClient(), opts.chain), {
+        signer: provider,
+        onInfo: info
+      });
       const result = await ops.setUri({ agentId, agentURI: opts.uri });
       success("agentURI updated!");
       output(
@@ -45403,10 +45401,10 @@ function registerErc8004Command(program3) {
       await ensureTrustSDK();
       const password3 = await resolvePassword(opts);
       const provider = await AgentWalletProvider.fromStorage(password3);
-      const ops = new Erc8004Operations(
-        resolveErc8004Contract(provider.getBlockchainClient(), opts.chain),
-        { signer: provider, onInfo: info }
-      );
+      const ops = new Erc8004Operations(resolveErc8004Contract(new ChainClient(), opts.chain), {
+        signer: provider,
+        onInfo: info
+      });
       const result = await ops.setMetadata({ agentId, key: opts.key, value: opts.value });
       success("Metadata set!");
       output(
@@ -45433,9 +45431,7 @@ function registerErc8004Command(program3) {
     try {
       parseAgentId(agentId);
       await ensureTrustSDK();
-      const ops = new Erc8004Operations(
-        resolveErc8004Contract(new BlockchainClient(), opts.chain)
-      );
+      const ops = new Erc8004Operations(resolveErc8004Contract(new ChainClient(), opts.chain));
       const result = await ops.getMetadata({ agentId, key: opts.key });
       output(
         { agentId, key: result.key, value: result.value, chain: result.chainKey },
@@ -45454,9 +45450,7 @@ function registerErc8004Command(program3) {
     try {
       parseAgentId(agentId);
       await ensureTrustSDK();
-      const ops = new Erc8004Operations(
-        resolveErc8004Contract(new BlockchainClient(), opts.chain)
-      );
+      const ops = new Erc8004Operations(resolveErc8004Contract(new ChainClient(), opts.chain));
       const result = await ops.show({ agentId });
       output(
         {
@@ -45498,7 +45492,7 @@ function registerErc8183Command(program3) {
       await ensureTrustSDK();
       const password3 = await resolvePassword(opts);
       const provider = await AgentWalletProvider.fromStorage(password3);
-      const ops = buildOps(provider.getBlockchainClient(), opts.chain, provider);
+      const ops = buildOps(new ChainClient(), opts.chain, provider);
       const result = await ops.createJob({
         provider: opts.provider,
         evaluator: opts.evaluator,
@@ -45529,7 +45523,7 @@ function registerErc8183Command(program3) {
       await ensureTrustSDK();
       const password3 = await resolvePassword(opts);
       const provider = await AgentWalletProvider.fromStorage(password3);
-      const ops = buildOps(provider.getBlockchainClient(), opts.chain, provider);
+      const ops = buildOps(new ChainClient(), opts.chain, provider);
       const result = await ops.setProvider({
         jobId,
         provider: opts.provider,
@@ -45559,7 +45553,7 @@ function registerErc8183Command(program3) {
       await ensureTrustSDK();
       const password3 = await resolvePassword(opts);
       const provider = await AgentWalletProvider.fromStorage(password3);
-      const ops = buildOps(provider.getBlockchainClient(), opts.chain, provider);
+      const ops = buildOps(new ChainClient(), opts.chain, provider);
       const result = await ops.setBudget({
         jobId,
         amount: opts.amount,
@@ -45591,7 +45585,7 @@ function registerErc8183Command(program3) {
       await ensureTrustSDK();
       const password3 = await resolvePassword(opts);
       const provider = await AgentWalletProvider.fromStorage(password3);
-      const ops = buildOps(provider.getBlockchainClient(), opts.chain, provider);
+      const ops = buildOps(new ChainClient(), opts.chain, provider);
       const result = await ops.fund({
         jobId,
         expectedBudget: opts.expectedBudget,
@@ -45621,7 +45615,7 @@ function registerErc8183Command(program3) {
       await ensureTrustSDK();
       const password3 = await resolvePassword(opts);
       const provider = await AgentWalletProvider.fromStorage(password3);
-      const ops = buildOps(provider.getBlockchainClient(), opts.chain, provider);
+      const ops = buildOps(new ChainClient(), opts.chain, provider);
       const result = await ops.submit({
         jobId,
         deliverable: opts.deliverable,
@@ -45650,7 +45644,7 @@ function registerErc8183Command(program3) {
       await ensureTrustSDK();
       const password3 = await resolvePassword(opts);
       const provider = await AgentWalletProvider.fromStorage(password3);
-      const ops = buildOps(provider.getBlockchainClient(), opts.chain, provider);
+      const ops = buildOps(new ChainClient(), opts.chain, provider);
       const result = await ops.complete({
         jobId,
         reason: opts.reason,
@@ -45680,7 +45674,7 @@ function registerErc8183Command(program3) {
       await ensureTrustSDK();
       const password3 = await resolvePassword(opts);
       const provider = await AgentWalletProvider.fromStorage(password3);
-      const ops = buildOps(provider.getBlockchainClient(), opts.chain, provider);
+      const ops = buildOps(new ChainClient(), opts.chain, provider);
       const result = await ops.reject({
         jobId,
         reason: opts.reason,
@@ -45709,7 +45703,7 @@ function registerErc8183Command(program3) {
       await ensureTrustSDK();
       const password3 = await resolvePassword(opts);
       const provider = await AgentWalletProvider.fromStorage(password3);
-      const ops = buildOps(provider.getBlockchainClient(), opts.chain, provider);
+      const ops = buildOps(new ChainClient(), opts.chain, provider);
       const result = await ops.claimRefund({ jobId });
       success("Refund claimed!");
       output(
@@ -45732,7 +45726,7 @@ function registerErc8183Command(program3) {
     try {
       parseUint(jobId, "jobId");
       await ensureTrustSDK();
-      const ops = buildOps(new BlockchainClient(), opts.chain);
+      const ops = buildOps(new ChainClient(), opts.chain);
       const result = await ops.status({ jobId });
       output(
         {
@@ -45763,7 +45757,7 @@ function registerErc8183Command(program3) {
       await ensureTrustSDK();
       const password3 = await resolvePassword(opts);
       const provider = await AgentWalletProvider.fromStorage(password3);
-      const ops = buildOps(provider.getBlockchainClient(), opts.chain, provider);
+      const ops = buildOps(new ChainClient(), opts.chain, provider);
       const result = await ops.registerJob({ jobId, policy: opts.policy });
       success("Job registered!");
       output(
@@ -45787,7 +45781,7 @@ function registerErc8183Command(program3) {
       await ensureTrustSDK();
       const password3 = await resolvePassword(opts);
       const provider = await AgentWalletProvider.fromStorage(password3);
-      const ops = buildOps(provider.getBlockchainClient(), opts.chain, provider);
+      const ops = buildOps(new ChainClient(), opts.chain, provider);
       const result = await ops.settle({ jobId, evidence: opts.evidence });
       success("Job settled!");
       output(
@@ -45810,7 +45804,7 @@ function registerErc8183Command(program3) {
       await ensureTrustSDK();
       const password3 = await resolvePassword(opts);
       const provider = await AgentWalletProvider.fromStorage(password3);
-      const ops = buildOps(provider.getBlockchainClient(), opts.chain, provider);
+      const ops = buildOps(new ChainClient(), opts.chain, provider);
       const result = await ops.markExpired({ jobId });
       success("Job marked expired!");
       output(
@@ -45832,7 +45826,7 @@ function registerErc8183Command(program3) {
     try {
       parseUint(jobId, "jobId");
       await ensureTrustSDK();
-      const ops = buildOps(new BlockchainClient(), opts.chain);
+      const ops = buildOps(new ChainClient(), opts.chain);
       const result = await ops.policyInfo({ jobId });
       output(
         {
@@ -45861,7 +45855,7 @@ function registerErc8183Command(program3) {
       await ensureTrustSDK();
       const password3 = await resolvePassword(opts);
       const provider = await AgentWalletProvider.fromStorage(password3);
-      const ops = buildOps(provider.getBlockchainClient(), opts.chain, provider);
+      const ops = buildOps(new ChainClient(), opts.chain, provider);
       const result = await ops.dispute({ jobId });
       success("Dispute raised!");
       output(
@@ -45884,7 +45878,7 @@ function registerErc8183Command(program3) {
       await ensureTrustSDK();
       const password3 = await resolvePassword(opts);
       const provider = await AgentWalletProvider.fromStorage(password3);
-      const ops = buildOps(provider.getBlockchainClient(), opts.chain, provider);
+      const ops = buildOps(new ChainClient(), opts.chain, provider);
       const result = await ops.voteReject({ jobId });
       success("Reject vote cast!");
       output(
@@ -45919,7 +45913,7 @@ function registerCompeteCommand(program3) {
       await ensureTrustSDK();
       const password3 = await resolvePassword(opts);
       const provider = await AgentWalletProvider.fromStorage(password3);
-      const { contract, chainKey } = resolveCompetitionContract(provider.getBlockchainClient());
+      const { contract, chainKey } = resolveCompetitionContract(new ChainClient());
       const participant = await provider.getAddress(chainKey);
       const [start, deadline, alreadyRegistered] = await Promise.all([
         contract.read.registrationStart([]),
@@ -45988,7 +45982,7 @@ function registerCompeteCommand(program3) {
       await ensureTrustSDK();
       const password3 = await resolvePassword(opts);
       const provider = await AgentWalletProvider.fromStorage(password3);
-      const { contract, chainKey } = resolveCompetitionContract(provider.getBlockchainClient());
+      const { contract, chainKey } = resolveCompetitionContract(new ChainClient());
       const participant = await provider.getAddress(chainKey);
       const [registered, start, deadline] = await Promise.all([
         contract.read.isRegistered([participant]),
@@ -46799,8 +46793,8 @@ function registerQueryCommand(program3) {
       }
       if (address) {
         await ensureTrustSDK();
-        const blockchainClient = new BlockchainClient();
-        const status = await blockchainClient.findTransactionStatus(opts.chain, address, hash);
+        const chainClient = new ChainClient();
+        const status = await chainClient.findTransactionStatus(opts.chain, address, hash);
         output(
           {
             hash,
@@ -47548,7 +47542,7 @@ async function payAndFetch(args) {
     if (!confirmed) {
       throw new X402Error("PAYMENT_CANCELLED", "Payment cancelled by user");
     }
-    const bc2 = new BlockchainClient();
+    const bc2 = new ChainClient();
     const fromAddress = await args.provider.getAddress(chainKey);
     const tokenAddress = getAsset(kind);
     const amount = getAmount(kind);
@@ -48126,11 +48120,10 @@ var BalanceActionProvider = class extends ActionProvider {
 };
 var DEFAULT_MAX_TRANSFER_USD3 = 1e4;
 var TransferActionProvider = class extends ActionProvider {
-  constructor(walletContext, swapClient, blockchainClient, maxTransferUsd = DEFAULT_MAX_TRANSFER_USD3) {
+  constructor(walletContext, swapClient, maxTransferUsd = DEFAULT_MAX_TRANSFER_USD3) {
     super();
     this.walletContext = walletContext;
     this.swapClient = swapClient;
-    this.blockchainClient = blockchainClient;
     this.maxTransferUsd = maxTransferUsd;
   }
   name = "transfer";
@@ -48159,8 +48152,7 @@ var TransferActionProvider = class extends ActionProvider {
         const wallet = this.walletContext.activeWallet();
         const executor = new TransferExecutor({
           wallet,
-          swapClient: this.swapClient,
-          blockchainClient: this.blockchainClient
+          swapClient: this.swapClient
         });
         const result = await executor.execute({
           chain: input2.chain,
@@ -48240,8 +48232,11 @@ var SwapActionProvider = class extends ActionProvider {
             message: `Unknown token: ${input2.toToken} on ${toChain}`
           };
         }
+        if (!this.blockchainClient) {
+          throw new WalletError("WALLET_NOT_FOUND", "Chain client not available");
+        }
         const executor = new SwapExecutor(this.swapClient, signer, {
-          blockchainClient: this.blockchainClient
+          chainClient: this.blockchainClient
         });
         const result = await executor.execute({
           fromChain,
@@ -48590,9 +48585,8 @@ var AlertActionProvider = class extends ActionProvider {
   }
 };
 var AgentWalletActionProvider = class extends ActionProvider {
-  constructor(blockchainClient, walletContext) {
+  constructor(walletContext) {
     super();
-    this.blockchainClient = blockchainClient;
     this.walletContext = walletContext;
   }
   name = "agent-wallet";
@@ -48641,10 +48635,7 @@ var AgentWalletActionProvider = class extends ActionProvider {
         const { chainKey, assetId } = resolveAsset(input2.chain);
         const wallet = this.requireWallet();
         const address = await wallet.getAddress(chainKey);
-        if (!this.blockchainClient) {
-          return { chain: chainKey, address, balance: "BlockchainClient not available" };
-        }
-        const balance = await this.blockchainClient.getBalance(assetId, address, chainKey);
+        const balance = await wallet.getBalance(assetId, chainKey);
         return { chain: chainKey, address, balance };
       }
     };
@@ -48695,7 +48686,7 @@ var TokenActionProvider = class extends ActionProvider {
       }),
       invoke: async (_ctx, input2) => {
         if (!this.blockchainClient) {
-          throw new WalletError("WALLET_NOT_FOUND", "BlockchainClient not available");
+          throw new WalletError("WALLET_NOT_FOUND", "Chain client not available");
         }
         const { chainKey, assetId } = resolveAsset(input2.chain, input2.tokenAddress);
         const balance = await this.blockchainClient.getBalance(assetId, input2.address, chainKey);
@@ -48726,7 +48717,7 @@ var TokenActionProvider = class extends ActionProvider {
         assertEvmAddress(input2.tokenAddress, "tokenAddress");
         assertEvmAddress(input2.spender, "spender");
         if (!this.blockchainClient) {
-          throw new WalletError("WALLET_NOT_FOUND", "BlockchainClient not available");
+          throw new WalletError("WALLET_NOT_FOUND", "Chain client not available");
         }
         const amount = input2.amount === "unlimited" ? "115792089237316195423570985008687907853269984665640564039457584007913129639935" : input2.amount;
         const pending = await this.blockchainClient.contract(erc20).withAddress(input2.tokenAddress, chainKey).write.approve([input2.spender, BigInt(amount)], wallet);
@@ -48756,7 +48747,7 @@ var TokenActionProvider = class extends ActionProvider {
         assertEvmAddress(input2.tokenAddress, "tokenAddress");
         assertEvmAddress(input2.spender, "spender");
         if (!this.blockchainClient) {
-          throw new WalletError("WALLET_NOT_FOUND", "BlockchainClient not available");
+          throw new WalletError("WALLET_NOT_FOUND", "Chain client not available");
         }
         const pending = await this.blockchainClient.contract(erc20).withAddress(input2.tokenAddress, chainKey).write.approve([input2.spender, 0n], wallet);
         return { hash: pending.hash, chain: chainKey };
@@ -48775,7 +48766,7 @@ var TokenActionProvider = class extends ActionProvider {
       }),
       invoke: async (_ctx, input2) => {
         if (!this.blockchainClient) {
-          throw new WalletError("WALLET_NOT_FOUND", "BlockchainClient not available");
+          throw new WalletError("WALLET_NOT_FOUND", "Chain client not available");
         }
         const chainKey = resolveChain(input2.chain);
         const allowance = await this.blockchainClient.contract(erc20).withAddress(input2.tokenAddress, chainKey).read.allowance([input2.owner, input2.spender]);
@@ -49234,7 +49225,7 @@ var OnrampActionProvider = class extends ActionProvider {
           if (!this.blockchainClient) {
             throw new TransferError(
               "WALLET_NOT_FOUND",
-              "BlockchainClient not available \u2014 off-ramp token payout requires a configured blockchain client"
+              "Chain client not available \u2014 off-ramp token payout requires a configured blockchain client"
             );
           }
           const pending = await this.blockchainClient.contract(erc20).withAddress(input2.tokenAddress, chainKey).write.transfer([input2.depositAddress, BigInt(atomic)], signer);
@@ -49413,8 +49404,11 @@ var AutomateActionProvider = class extends ActionProvider {
             message: `Unknown token: ${record2.toToken} on ${record2.chain}`
           };
         }
+        if (!this.blockchainClient) {
+          throw new WalletError("WALLET_NOT_FOUND", "Chain client not available");
+        }
         const executor = new SwapExecutor(this.swapClient, walletProvider, {
-          blockchainClient: this.blockchainClient
+          chainClient: this.blockchainClient
         });
         const result = await executeAutomation(record2, {
           executor,
@@ -49538,10 +49532,21 @@ var WalletModeActionProvider = class extends ActionProvider {
   description = "Switch wallet modes mid-session. The local agent wallet is auto-bound at server startup when configured, so signing actions work out of the box without calling this. Only call switch_wallet_mode when the user explicitly asks to use WalletConnect (or to return to the local wallet afterwards).";
   walletContext;
   agentWallet;
+  /**
+   * `agentWallet` resolves the agent wallet on each switch to local mode,
+   * loading it if needed, so a wallet created or unlocked after construction
+   * is used. It rejects with a typed WalletError (WALLET_NOT_FOUND,
+   * PASSWORD_MISSING, WALLET_AUTH_FAILED), which surfaces as is.
+   */
   constructor(options) {
     super();
     this.walletContext = options.walletContext;
-    this.agentWallet = options.agentWallet;
+    this.agentWallet = options.agentWallet ?? (async () => {
+      throw new WalletError(
+        "WALLET_NOT_FOUND",
+        "No local agent wallet is available. Create one with `twak wallet create`."
+      );
+    });
   }
   getActions() {
     return [this.switchWalletMode(), this.getWalletStatus()];
@@ -49575,13 +49580,8 @@ var WalletModeActionProvider = class extends ActionProvider {
       }),
       invoke: async (_ctx, input2) => {
         if (input2.mode === "local") {
-          if (!this.agentWallet) {
-            throw new WalletError(
-              "WALLET_NOT_FOUND",
-              "No local agent wallet found. Create one with `twak init` (CLI), then restart the MCP client (e.g. Claude Desktop)."
-            );
-          }
-          await this.walletContext.bindLocal(this.agentWallet);
+          const agentWallet = await this.agentWallet();
+          await this.walletContext.bindLocal(agentWallet);
           return this.snapshotResponse(this.walletContext.snapshot());
         }
         if (!this.walletContext.walletConnectAvailable) {
@@ -49733,7 +49733,7 @@ var Erc8004ActionProvider = class extends ActionProvider {
   }
   ops(chainInput, signer) {
     if (!this.blockchainClient) {
-      throw new WalletError("WALLET_NOT_FOUND", "BlockchainClient not available");
+      throw new WalletError("WALLET_NOT_FOUND", "Chain client not available");
     }
     return new Erc8004Operations(resolveErc8004Contract(this.blockchainClient, chainInput), {
       signer
@@ -50118,7 +50118,7 @@ var Erc8183ActionProvider = class extends ActionProvider {
   }
   ops(chainInput, signer) {
     if (!this.blockchainClient) {
-      throw new WalletError("WALLET_NOT_FOUND", "BlockchainClient not available");
+      throw new WalletError("WALLET_NOT_FOUND", "Chain client not available");
     }
     const client = this.blockchainClient;
     return new Erc8183Operations(resolveErc8183Contracts(client, chainInput), {
@@ -50230,7 +50230,7 @@ var CompetitionActionProvider = class extends ActionProvider {
   }
   bind() {
     if (!this.blockchainClient) {
-      throw new WalletError("WALLET_NOT_FOUND", "BlockchainClient not available");
+      throw new WalletError("WALLET_NOT_FOUND", "Chain client not available");
     }
     return resolveCompetitionContract(this.blockchainClient).contract;
   }
@@ -54875,20 +54875,24 @@ var import_crypto7 = require("crypto");
 init_dist();
 var SERVER_INSTRUCTIONS = `twak signs blockchain operations through one of two wallet modes:
 
-LOCAL (default): an HD wallet auto-bound at server startup. In-process signing, no user-side prompts.
+LOCAL (default): an HD wallet auto-bound at server startup when no WalletConnect session was resumed. In-process signing, no user-side prompts.
 
-WALLETCONNECT: a remote wallet (e.g. Trust Wallet on phone) paired via WC v2. Each signing action prompts the user on their device. More secure: the private key never leaves the user's device.
+WALLETCONNECT: a remote wallet (e.g. Trust Wallet on phone) paired via WC v2. Each signing action must be approved on the user's device; Trust Wallet shows the request only once the app is open (no push notification), so tell the user to open it. More secure: the private key never leaves the user's device.
 
 When the user first engages with signing operations in a fresh conversation, briefly mention that they can optionally switch to phone-based signing via \`switch_wallet_mode({mode: "walletconnect"})\` \u2014 many users don't know this is an option. Mention once; don't repeat on every signing call.
 
-To switch mid-session, call \`switch_wallet_mode\`. The new mode applies to subsequent calls; in-flight signing keeps using its captured wallet. Mode persists for the MCP server's lifetime; restarting the MCP client (e.g. Claude Desktop) resets to local.`;
+To switch mid-session, call \`switch_wallet_mode\`. The new mode applies to subsequent calls; in-flight signing keeps using its captured wallet. A WalletConnect session is stored on disk and resumed when the server restarts, until it expires (about 7 days) or is revoked; choosing local mode revokes it.
+
+If a tool returns CREDENTIALS_MISSING, the Trust Wallet API credentials are not set up yet: ask the user to run \`twak init\` (or \`twak setup\`) with their access ID and HMAC secret. The tools work as soon as the credentials are saved; no server restart is needed.`;
 var TwakMcpServer = class {
   server;
   registry;
   context;
-  constructor(registry, context) {
+  beforeInvoke;
+  constructor(registry, context, options = {}) {
     this.registry = registry;
     this.context = context;
+    this.beforeInvoke = options.beforeInvoke;
     this.server = new Server(
       { name: "twak", version: "0.1.0" },
       { capabilities: { tools: {} }, instructions: SERVER_INSTRUCTIONS }
@@ -54924,6 +54928,7 @@ var TwakMcpServer = class {
         };
       }
       try {
+        await this.beforeInvoke?.();
         const parsed = action.schema.parse(args);
         const result = await action.invoke(this.context, parsed);
         if (result instanceof McpResponse) {
@@ -55128,11 +55133,103 @@ var TwakRestServer = class {
 
 // src/commands/serve.ts
 init_dist();
+
+// src/serve-bootstrap.ts
+var ServeBootstrap = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  ready;
+  attempt;
+  async run() {
+    const credentials = await this.deps.loadCredentials();
+    if (!credentials) throw credentialsMissingError();
+    await this.deps.initTrustSDK(credentials);
+    await this.deps.onReady();
+    this.ready = { credentials };
+  }
+  async ensureReady() {
+    if (this.ready) return;
+    if (!this.attempt) {
+      this.attempt = this.run().finally(() => {
+        this.attempt = void 0;
+      });
+    }
+    return this.attempt;
+  }
+  /** Credentials once ready; throws CREDENTIALS_MISSING before. */
+  credentials() {
+    if (!this.ready) throw credentialsMissingError();
+    return this.ready.credentials;
+  }
+};
+
+// src/agent-wallet-loader.ts
+init_dist();
+var AgentWalletLoader = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  loaded;
+  attempt;
+  async open() {
+    if (!await this.deps.walletExists()) {
+      throw new WalletError(
+        "WALLET_NOT_FOUND",
+        "No local agent wallet found. Create one with `twak wallet create`, then switch to local mode again."
+      );
+    }
+    const password3 = await this.deps.resolvePassword();
+    if (!password3) {
+      throw new WalletError(
+        "PASSWORD_MISSING",
+        "No wallet password available to the server. Run `twak wallet keychain save`, or start the server with TWAK_WALLET_PASSWORD or --password."
+      );
+    }
+    let wallet;
+    try {
+      wallet = await this.deps.open(password3);
+    } catch (err) {
+      const classified = classifyWalletLoadError(err);
+      if (classified) throw new WalletError(classified.code, classified.message);
+      throw err;
+    }
+    this.deps.onLoaded(wallet);
+    this.loaded = wallet;
+    return wallet;
+  }
+  /** The loaded wallet; never loads. */
+  get current() {
+    return this.loaded;
+  }
+  /** Rejects with WalletError WALLET_NOT_FOUND, PASSWORD_MISSING or
+   * WALLET_AUTH_FAILED, or the underlying error when unclassified. */
+  async load() {
+    if (this.loaded) return this.loaded;
+    if (!this.attempt) {
+      this.attempt = this.open().finally(() => {
+        this.attempt = void 0;
+      });
+    }
+    return this.attempt;
+  }
+};
+
+// src/stdio-console.ts
+var import_node_console = require("console");
+function routeConsoleToStderr(target = console, stderr = process.stderr) {
+  Object.assign(target, new import_node_console.Console({ stdout: stderr, stderr }));
+}
+
+// src/commands/serve.ts
 function registerServeCommand(program3) {
   program3.command("serve").description("Start MCP server (stdio) or REST API server for AI agent connection").option("--rest", "Start REST HTTP server instead of MCP stdio server").option("--port <n>", "Port for REST server", "3000").option(
     "--host <host>",
     "Host to bind REST server (default: 127.0.0.1; use 0.0.0.0 to expose externally)"
-  ).option("--password <password>", "Wallet password (falls back to keychain)").option("--auto-lock <minutes>", "Auto-lock wallet after N minutes of inactivity").option("--wc-project-id <id>", "WalletConnect project ID (or set WALLETCONNECT_PROJECT_ID)").option(
+  ).option("--password <password>", "Wallet password (falls back to keychain)").option("--auto-lock <minutes>", "Auto-lock wallet after N minutes of inactivity").option(
+    "--wc-project-id <id>",
+    "WalletConnect project ID override (default: Trust Wallet project; or set WALLETCONNECT_PROJECT_ID)"
+  ).option(
     "--watch",
     "Run a background watcher that fires DCA/limit automations (created via CLI or the create_automation MCP action); requires the local agent wallet"
   ).option(
@@ -55140,35 +55237,24 @@ function registerServeCommand(program3) {
     "Automation poll interval when --watch is set \u2014 e.g. 30s, 5m, 1h (min 5s)",
     "60"
   ).action(async (opts) => {
-    await ensureTrustSDK();
-    const client = await getClient();
-    const swapClient = new SwapClient(client);
-    const alertStore = new AlertStore();
-    const automationStore = new AutomationStore();
-    const blockchainClient = new BlockchainClient();
-    let agentWallet;
-    try {
-      const password3 = opts.password || process.env.TWAK_WALLET_PASSWORD || await new KeychainManager().getWalletPassword();
-      if (password3) agentWallet = await AgentWalletProvider.fromStorage(password3);
-    } catch {
-    }
-    if (opts.autoLock && agentWallet) {
-      const minutes = parseInt(opts.autoLock, 10);
-      if (isNaN(minutes) || minutes <= 0) {
+    if (!opts.rest) routeConsoleToStderr();
+    let autoLockMinutes;
+    if (opts.autoLock) {
+      autoLockMinutes = parseInt(opts.autoLock, 10);
+      if (isNaN(autoLockMinutes) || autoLockMinutes <= 0) {
         error("--auto-lock must be a positive number of minutes");
         process.exit(1);
       }
-      agentWallet.setAutoLock({
-        autoLockMinutes: minutes,
-        passwordResolver: () => resolvePassword(opts)
-      });
     }
+    const alertStore = new AlertStore();
+    const automationStore = new AutomationStore();
+    const chainClient = new ChainClient();
     const wcProjectId = await resolveWcProjectId(opts.wcProjectId);
     const walletContext = new WalletContext({
-      walletConnectFactory: wcProjectId ? () => createWalletConnectProvider(wcProjectId) : void 0
+      walletConnectFactory: () => createWalletConnectProvider(wcProjectId, chainClient)
     });
     let resumeOutcome = "none";
-    if (walletContext.walletConnectAvailable && fs8.existsSync(wcStoragePath())) {
+    if (fs8.existsSync(wcStoragePath())) {
       try {
         const resumed = await withTimeout(
           walletContext.restoreWalletConnect(),
@@ -55183,37 +55269,75 @@ function registerServeCommand(program3) {
         warn(`Could not resume WalletConnect session: ${errorMessage(err)}`);
       }
     }
-    if (agentWallet && resumeOutcome === "none") {
-      await walletContext.bindLocal(agentWallet);
-      blockchainClient.setSigner(agentWallet.getSigner());
+    const walletLoader = new AgentWalletLoader({
+      walletExists: () => new WalletConfigStore().exists(),
+      resolvePassword: async () => opts.password || process.env.TWAK_WALLET_PASSWORD || await new KeychainManager().getWalletPassword() || void 0,
+      open: (password3) => AgentWalletProvider.fromStorage(password3),
+      onLoaded: (agentWallet) => {
+        if (autoLockMinutes) {
+          agentWallet.setAutoLock({
+            autoLockMinutes,
+            passwordResolver: () => resolvePassword(opts)
+          });
+        }
+      }
+    });
+    const bootstrap = new ServeBootstrap({
+      loadCredentials,
+      initTrustSDK: initTrustSDKWithCredentials,
+      onReady: async () => {
+        let agentWallet;
+        try {
+          agentWallet = await walletLoader.load();
+        } catch (err) {
+          if (!(err instanceof CommandError && err.code === "WALLET_NOT_FOUND")) {
+            warn(`Local agent wallet not loaded: ${errorMessage(err)}`);
+          }
+          return;
+        }
+        if (resumeOutcome === "none") await walletContext.bindLocal(agentWallet);
+      }
+    });
+    const client = createTwakClient({ credentials: () => bootstrap.credentials() });
+    const swapClient = new SwapClient(client);
+    if (opts.rest || opts.watch) {
+      await bootstrap.ensureReady();
+    } else {
+      try {
+        await bootstrap.ensureReady();
+      } catch (err) {
+        warn(`${errorMessage(err)} Tool calls report this error until it is resolved.`);
+      }
     }
     const registry = new ActionRegistry();
     registry.register(new BalanceActionProvider());
-    registry.register(new WalletModeActionProvider({ walletContext, agentWallet }));
-    registry.register(new SwapActionProvider(swapClient, walletContext, blockchainClient));
+    registry.register(
+      new WalletModeActionProvider({ walletContext, agentWallet: () => walletLoader.load() })
+    );
+    registry.register(new SwapActionProvider(swapClient, walletContext, chainClient));
     registry.register(new SecurityActionProvider());
     registry.register(new HistoryActionProvider());
-    registry.register(new TransferActionProvider(walletContext, swapClient, blockchainClient));
+    registry.register(new TransferActionProvider(walletContext, swapClient));
     registry.register(new AlertActionProvider(alertStore));
-    registry.register(new AgentWalletActionProvider(blockchainClient, walletContext));
-    registry.register(new TokenActionProvider(blockchainClient, walletContext));
+    registry.register(new AgentWalletActionProvider(walletContext));
+    registry.register(new TokenActionProvider(chainClient, walletContext));
     registry.register(new MarketActionProvider());
     registry.register(
-      new OnrampActionProvider(walletContext, swapClient, void 0, blockchainClient)
+      new OnrampActionProvider(walletContext, swapClient, void 0, chainClient)
     );
     registry.register(
       new AutomateActionProvider(
         automationStore,
         swapClient,
         walletContext,
-        blockchainClient,
+        chainClient,
         Boolean(opts.watch)
       )
     );
     registry.register(new X402ActionProvider(walletContext));
-    registry.register(new Erc8004ActionProvider(blockchainClient, walletContext));
-    registry.register(new Erc8183ActionProvider(blockchainClient, walletContext));
-    registry.register(new CompetitionActionProvider(blockchainClient, walletContext));
+    registry.register(new Erc8004ActionProvider(chainClient, walletContext));
+    registry.register(new Erc8183ActionProvider(chainClient, walletContext));
+    registry.register(new CompetitionActionProvider(chainClient, walletContext));
     let watcher;
     if (opts.watch) {
       const intervalSec = parseInterval(opts.watchInterval);
@@ -55227,7 +55351,7 @@ function registerServeCommand(program3) {
             automationStore,
             client,
             getExecutor: () => walletContext.state === "local" ? new SwapExecutor(swapClient, walletContext.activeWallet(), {
-              blockchainClient,
+              chainClient,
               onStatus: (msg) => info(msg)
             }) : null,
             log: (level, msg) => {
@@ -55242,7 +55366,7 @@ function registerServeCommand(program3) {
           }
         );
         info(
-          `Automation watcher active (every ${intervalSec}s)${agentWallet ? "" : " \u2014 idle until a local wallet is unlocked"}`
+          `Automation watcher active (every ${intervalSec}s)${walletLoader.current ? "" : " \u2014 idle until a local wallet is unlocked"}`
         );
         watcher.start();
       }
@@ -55250,15 +55374,21 @@ function registerServeCommand(program3) {
     const context = {
       httpClient: client
     };
+    const disconnectLoadedWallet = async () => {
+      const agentWallet = walletLoader.current;
+      if (agentWallet?.isConnected()) await agentWallet.disconnect().catch(() => {
+      });
+    };
     if (opts.rest) {
       const restServer = new TwakRestServer(registry, context, {
         port: parseInt(opts.port),
         host: opts.host,
         apiKey: client.hmacSecret
       });
-      registerShutdownHandlers([agentWallet], () => {
+      registerShutdownHandlers([], async () => {
         watcher?.stop();
         restServer.stop();
+        await disconnectLoadedWallet();
       });
       try {
         await restServer.start();
@@ -55267,10 +55397,13 @@ function registerServeCommand(program3) {
         process.exit(1);
       }
     } else {
-      registerShutdownHandlers([agentWallet], () => {
+      registerShutdownHandlers([], async () => {
         watcher?.stop();
+        await disconnectLoadedWallet();
+      });
+      const mcpServer = new TwakMcpServer(registry, context, {
+        beforeInvoke: () => bootstrap.ensureReady()
       });
-      const mcpServer = new TwakMcpServer(registry, context);
       console.error("TW Agent MCP server starting...");
       await mcpServer.start();
     }
@@ -55655,11 +55788,9 @@ ${url}`);
       warn(
         `About to send ${opts.amount} ${opts.asset} from ${address} to third-party off-ramp deposit address ${opts.to}${opts.memo ? ` (memo: ${opts.memo})` : ""}. This address is not under your control \u2014 verify it matches what the provider displayed before continuing.`
       );
-      const client = provider.getBlockchainClient();
-      const hdWallet = provider.getSigner().getHDWallet();
       let result;
       try {
-        result = await client.transfer({
+        result = await provider.transfer({
           assetId: opts.asset,
           to: opts.to,
           amount: opts.amount,
@@ -55667,8 +55798,7 @@ ${url}`);
           memo: opts.memo,
           // Mainnet by construction — onramp has no --chain input and derives
           // chainKey from the asset's coinId via the CHAINS-only resolver.
-          chainKey,
-          hdWallet
+          chainKey
         });
       } catch (err) {
         mapBroadcastError(err);
@@ -56182,7 +56312,7 @@ var crypto8 = __toESM(require("crypto"));
 // package.json
 var package_default = {
   name: "@trustwallet/cli",
-  version: "0.21.0",
+  version: "0.23.0",
   description: "TWAK CLI \u2014 command-line interface for Trust Wallet Agent Kit",
   main: "dist/index.js",
   types: "dist/index.d.ts",
@@ -56396,6 +56526,7 @@ function registerWatchCommand(program3) {
           });
         }
         executor = new SwapExecutor(swapClient, provider, {
+          chainClient: new ChainClient(),
           onStatus: (msg) => {
             info(`[${ts3()}] ${msg}`);
           }