@venlyfinance/settlement-mcp 0.5.0 → 0.6.0

package/AGENTS.md

@@ -0,0 +1,35 @@
+# Composition rules for coding agents
+
+You are building a financial product UI on `@venlyfinance/react`. These rules exist because the failure modes of money UIs are specific; follow them over generic dashboard instincts.
+
+## Non-negotiable
+
+1. **Never hand-roll API calls, auth, retries, or transfer state.** Every read is a hook (`useAccounts`, `useTransfers`, `useRampRequests`, …); every regulated lifecycle is a flow machine (`useStagedTransfer`, `useFourEyesApproval`, `useRampLifecycle`). If you are writing `fetch` or a `useEffect` polling loop, stop – the hook exists.
+2. **Wrap the tree once** in `<VenlyProvider environment="mock">`. Mock mode needs zero credentials and zero network; it is the correct default for any demo, test, or first build. Going live is a constructor change, not a rewrite.
+3. **Never place `clientSecret` in browser code.** The provider throws if you try. For browser apps use `proxyClientOptions()` against your own backend route.
+4. **Money movement is stage-then-confirm.** Render a review step showing `state.staged` (the exact request) before calling `confirm()`. Never wire a form submit directly to execution.
+5. **Approval UIs render the rule, not the error.** Use `capability` from `useFourEyesApproval`: when `reason` is `"actor-is-creator"`, say that a second person must approve – do not show buttons that will be refused. On failure `"stale-version"`, refetch and let the operator re-decide; never auto-retry an approval.
+6. **Gate every finished screen with the design audit, and wire it into CI.** `npx @venlyfinance/settlement-mcp review "src/**/*.tsx"` fails (exit 1) on any error-severity finding – raw colours, invented timing or custody copy, crypto codes inside `Intl.NumberFormat` currency formatting, a required field labelled optional, parity fixtures, and more. Add it as a CI step in the app you build. A deliberate, justified exception carries `venly-allow:<rule-id>` on the offending line or the line above.
+
+## Rendering money states
+
+- Use `descriptor` from `useRampLifecycle` for status pills and timelines: `intent` gives the semantic colour, but always pair colour with a glyph or label – state is never carried by colour alone.
+- A waiting state must answer: must I act, who is it waiting on, what still works. `descriptor.waitingOn` and `descriptor.explanation` carry this; render them instead of a bare "Pending".
+- Amounts: tabular figures, currency code after the amount, and never render a debit in red as the only signal. Empty numeric cells are an em dash, not 0.
+- Terminal failure states show the reason from the record; the status field is the explanation field.
+
+## Bring your own auth
+
+The Venly APIs authenticate machines (OAuth2 client credentials), not people: there is no end-user login, sign-up, session, password, or MFA endpoint in either API, by design. **The Venly APIs never see end-user credentials.** End-user auth is your identity layer's job; the sanctioned browser shape is a backend proxy that inherits YOUR app's session (`proxyClientOptions()`), never Venly's.
+
+The UI kit's auth and team blocks therefore render against two adapter interfaces, `AuthAdapter` and `TeamAdapter`, instead of an SDK client:
+
+- **Real implementations** wrap what you already run: OAuth/OIDC, Better Auth, Auth0, Clerk, Keycloak, or a plain session cookie. Implement `signIn`/`verifyTotp`/`signUp`/`session`/`signOut` (and the team CRUD) over your provider's SDK.
+- **Session-expiry contract:** `session()` returns `null` once the session has expired for any reason. The shell treats null as signed-out and redirects to sign-in; no other expiry signal exists in the interface.
+- **Mock adapters ship with the blocks** (`createMockAuthAdapter`, `createMockTeamAdapter`): zero credentials, deterministic 2FA code `000000`, an `expireSession()` driver, and invites that mint a display-only link – the mock never claims an email was sent.
+- Password reset, SSO buttons, and passkeys are provider features: point users at your provider's flow rather than rebuilding it behind the adapter.
+
+## Demo choreography (mock mode)
+
+`useVenlyMock()` exposes the store controls. A credible end-to-end demo:
+create party → `advanceVerification(id)` → create account → virtual bank account (note its `referenceCode`) → stage + confirm a transfer → `advanceTransfer(id)` → show the ledger. Inject failures with `failNext("CONFLICT")` to show the stale-version approval path – error states are part of the product.

package/CHANGELOG.md

@@ -2,8 +2,7 @@
 
 ## 0.3.0 – 2026-08-04
 
-Wording-is-the-safety-surface release. An outside integrator audit (Report 1,
-2026-08-04) found the server's words disagreeing with its behavior in three
+Wording-is-the-safety-surface release. An outside integrator audit (2026-08-04) found the server's words disagreeing with its behavior in three
 places; all fixed, plus the SDK under the mock now teaches the documented
 lifecycle (see @venlyfinance/sdk 0.2.0).
 
@@ -104,3 +103,34 @@ Frontend toolset: the judgment layer for interface assembly.
 ## 0.4.1 – 2026-08-07
 
 - `venly://frontend/agents` now carries the full cold-start recipe, learned from a fresh-agent build run: Tailwind + path-alias prerequisites before `shadcn init`, the non-interactive `-y -b radix -p nova` flags, that blocks land under `components/venly/` at the project root (relative imports, not the `@/` alias), that `shadcn add` auto-installs the npm dependencies, and the `.js`-extension bundler note.
+
+## 0.5.0 – 2026-08-14 (backfill; published 2026-08-15)
+
+Entry added retroactively in 0.6.0 – the publish predates it.
+
+- Nine payout tools over the re-vendored finance contract (payouts, payout routes +
+  ownership proof, party payout bank accounts), fail-closed writes.
+- Corrected capabilities text; react/ui alignment with the 0.4.0 SDK line.
+
+## 0.6.0 – 2026-08-18
+
+`review_screen` grows teeth: five new rule classes, a suppression hatch, and a CI-runnable command.
+
+- New error rules: `invented-timing-claim` (copy promising durations, settlement windows
+  or custody behaviour no API in this stack returns), `intl-currency-crypto`
+  (`Intl.NumberFormat` + `style:"currency"` + a crypto code throws `RangeError` at render;
+  a variable-fed `currency:` in the same call is a warn), `required-rendered-optional`
+  (the payment reference labelled "(not required)"), `parity-fixture` (seeded 1:1
+  exchange rates).
+- New warn rules: `blueprint-state-missing` (pass the new optional `journey` argument to
+  `review_screen` and the audit lists blueprint-named states not found in the source) and
+  `round-number-coincidence` (three or more `x.00` amounts seeded in one source).
+- Suppression hatch on every rule, old and new: `venly-allow:<rule-id>` on the offending
+  line or the line above drops the finding silently.
+- Copy-judging rules skip comment lines – a comment documenting a rule must not trip it.
+- Findings now carry a 1-based `line`.
+- New `review` CLI over the same audit: `npx @venlyfinance/settlement-mcp review "src/**/*.tsx"`
+  exits 1 on any error-severity finding (0 otherwise, 2 on usage errors/no matches), with
+  self-expanded globs and zero dependencies. Added a `settlement-mcp` bin alias so the
+  npx form resolves under npm's unscoped-name rule. This repo's CI now runs the command
+  over its own registry and example sources.

package/README.md

@@ -15,6 +15,8 @@ the normalized write requests. Staging and production writes fail closed.
 
 The Venly Finance builder surface documented here is the v0.2.0 release line.
 
+Building with a coding agent? Start from [AGENTS.md](AGENTS.md) - the MCP also serves it as the \venly://frontend/agents resource.
+
 ## What it is
 
 - Built on the official MCP TypeScript SDK (`@modelcontextprotocol/sdk`), Node
@@ -98,6 +100,15 @@ Operator writes: `approve_ramp_request`, `reject_ramp_request`. The legacy
 Each is dry-run by default and returns the exact request it would send. See the
 safety model below.
 
+### Payout tools (since 0.5.0)
+
+The payout surface of the finance contract, same tiering as above. Reads:
+`list_payouts`, `get_payout`, `list_payout_routes`, `list_payout_bank_accounts`.
+Writes (dry-run by default, fail-closed like every write): 
+`register_payout_bank_account`, `create_payout_route`,
+`prepare_payout_ownership_proof`, `complete_payout_ownership_proof`,
+`request_payout`.
+
 ### 3. x402 tool (position + stub)
 
 `quote_x402_payment` returns an HTTP-402-shaped quote (price, asset, payTo,
@@ -116,13 +127,36 @@ what a registry cannot:
 - `get_journey_blueprint` – screen inventory, required states, registry items and binding
   hooks for eight money-product journeys.
 - `review_screen` – deterministic design audit of a screen's source (raw colours,
-  hyphen-minus amounts, success styling on cancelled steps, masked review values, zebra
-  striping, off-token shadows, colour-only state). Findings, not a score.
+  hyphen-minus amounts, success styling on cancelled steps, masked review values,
+  invented timing/custody copy, crypto codes inside `Intl.NumberFormat` currency
+  formatting, required fields rendered optional, parity and round-number fixtures,
+  zebra striping, off-token shadows, colour-only state). Pass the optional `journey`
+  key to also check that every state the journey blueprint names appears in the
+  source. Findings, not a score.
 - `venly://frontend/agents` – the composition rules an agent should read before building.
 
 The `build_international_account` prompt assembles the interface from the registry and
 gates every finished screen on `review_screen`. See [`ui/`](../ui/README.md) for the kit itself.
 
+### Design-audit CLI
+
+The same audit runs as a command, so a generated app can gate itself in CI:
+
+```bash
+npx @venlyfinance/settlement-mcp review "src/**/*.tsx"
+```
+
+Exit `1` on any error-severity finding, `0` otherwise (warnings print either way),
+`2` on usage errors or a pattern that matches nothing. Suppress a deliberate,
+justified exception with `venly-allow:<rule-id>` on the offending line or the line
+above – the finding is dropped silently. This repo runs the same command over its
+own registry sources in CI.
+
+Scope the glob to component source, never to token or theme files: the
+`raw-colour` rule fires on any hex/rgba literal by design, and a tokens/theme
+css file is the one legitimate home of raw colour values (theming stays a
+one-file edit). `"src/**/*.tsx"` is the right default.
+
 ## Safety model (fail closed)
 
 Outside explicit mock mode, read-only/dry-run is the default posture. A staging
@@ -228,8 +262,9 @@ reads, and fail-closed write gate without mutating staging:
 VENLY_CLIENT_ID=... VENLY_CLIENT_SECRET=... npm run smoke:staging
 ```
 
-The command starts the MCP with `VENLY_ENV=staging`, lists the expected 24 tools,
-five resources, and builder prompt, then reads parties, accounts, and reference data.
+The command starts the MCP with `VENLY_ENV=staging`, verifies the discovery
+surface against the exact tool/resource/prompt inventory pinned in the smoke
+script itself, then reads parties, accounts, and reference data.
 It deliberately removes `VENLY_MCP_LIVE` and `VENLY_MCP_PRODUCTION` from the child
 process before submitting one confirmed `create_party` request. Passing requires that
 request to return `mode: dry-run`, `environment: staging`, and an unarmed gate. Output

package/dist/constants.d.ts

@@ -1,7 +1,7 @@
 /** Shared constants. The default environment is MOCK so an unconfigured run
  * never touches real infrastructure; staging/production are explicit. */
 export declare const SERVER_NAME = "venly-finance-mcp-server";
-export declare const SERVER_VERSION = "0.5.0";
+export declare const SERVER_VERSION = "0.6.0";
 export declare const ENVIRONMENT_FLAG = "VENLY_ENV";
 export type VenlyEnvironment = "mock" | "qa" | "staging" | "production";
 export declare function resolveVenlyEnvironment(env: Record<string, string | undefined>): VenlyEnvironment;

package/dist/constants.js

@@ -1,7 +1,7 @@
 /** Shared constants. The default environment is MOCK so an unconfigured run
  * never touches real infrastructure; staging/production are explicit. */
 export const SERVER_NAME = "venly-finance-mcp-server";
-export const SERVER_VERSION = "0.5.0";
+export const SERVER_VERSION = "0.6.0";
 export const ENVIRONMENT_FLAG = "VENLY_ENV";
 export function resolveVenlyEnvironment(env) {
     // Default is MOCK (since 0.3.0): the mock-first product must not point at

package/dist/frontend.d.ts

@@ -9,13 +9,29 @@
  */
 import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 export declare const REGISTRY_URL_TEMPLATE = "https://raw.githubusercontent.com/Venly/venly-settlement-sdk/main/ui/r/{name}.json";
+declare const JOURNEYS: {
+    readonly auth: "# Auth (sign-in, 2FA, sign-up)\nShell: outside the app shell - a centred card column.\nRegistry items: venly-tokens; block: auth (SignInForm, TwoFactorForm, SignUpForm).\nBinding: an AuthAdapter YOU implement - the Venly APIs authenticate machines\n(client credentials), never people, so end-user auth is your identity layer\n(OAuth/OIDC, Better Auth, Auth0, Clerk, Keycloak). createMockAuthAdapter ships\nfor demos: deterministic 2FA code 000000, expireSession() driver.\nStates that must exist: signed out, bad credentials (ONE combined message -\nno user enumeration), 2FA challenge with wrong-code path, session expired\n(session() returns null - redirect, no other signal), duplicate sign-up email.\nRules that must hold: credential errors never confirm which half was wrong;\nthe code field is six slots with paste distribution and full keyboard support;\nthe mock never claims an email was sent.";
+    readonly team: "# Team\nShell: in-shell content column.\nRegistry items: venly-tokens, data-table, status-pill; block: team (TeamTable, InviteDialog).\nBinding: a TeamAdapter over your auth provider (createMockTeamAdapter for demos).\nStates that must exist: ACTIVE/INVITED/DISABLED members on first paint, invite\ncreated (display-only link in mock - never a fake sent-email claim), role\nchange persisting, self-actions blocked with the reason.\nRules that must hold: member status is word + glyph; role controls live in the\nrow; you cannot change your own role or disable yourself - the control is\ndisabled AND explains why.";
+    readonly "home-balances": "# Home / balances\nShell: left nav rail + thin top bar; full-width content.\nRegistry items: venly-tokens, balance-card, data-table, status-pill; block: balances (BalancesBlock, BalanceMiniature).\nHooks: useAccounts, useWallets; balances rendered per asset across the account's wallets.\nStates that must exist: loading, zero balances (first-run guidance), reserved buckets, entirely reserved (available 0 rendered honestly - the acct-escrow seed exercises it), balance load error degrading locally with a retry.\nRules that must hold: available is the emphasised figure and the only one above the rule; reserved is demoted by position and scale, never colour, and carries the still-yours qualifier; unspendable buckets carry the padlock; masking covers every figure including the chrome miniature; arithmetic mismatches are surfaced, never corrected; never assume stablecoin parity - render the quoted rate.";
+    readonly receive: "# Receive\nShell: content column - a warning callout, the field card, an advisory below.\nRegistry items: venly-tokens, field-list; block: receive.\nHooks: useVirtualBankAccounts (first active EUR account).\nStates that must exist: no virtual bank account yet (offer creation), details present, reference not yet assigned (\"Not assigned yet\" + Required pill - never \"(not required)\").\nRules that must hold: the payment reference is enforced as mandatory (amber Required pill, warning above the fields); per-field copy names the field it copied and only confirms on a successful write; rows never vanish - render the \"(not required)\" variant.";
+    readonly send: "# Send\nShell: full page; form clamped ~600px; review step replaces the form.\nRegistry items: venly-tokens, arithmetic-ladder, timeline; block: send.\nHooks: useStagedTransfer (the machine IS the flow), useFeeQuote when fees apply.\nStates that must exist: draft (validation issues listed), staged review, submitting, pending (polling), completed, failed (reason shown, terminal).\nRules that must hold: money movement is stage-then-confirm - the review renders the exact staged request as an arithmetic ladder (working before the answer, uncertainty attached to the number); the commit button restates the amount and never carries a countdown; values are never masked on review; execution is single-shot on an idempotency key pinned at staging.";
+    readonly activity: "# Activity\nShell: full-width table + side panel.\nRegistry items: venly-tokens, data-table, status-pill, side-panel, timeline; block: activity.\nHooks: useTransfers (and useRampRequests where ramps are in scope).\nStates that must exist: loading, empty ledger, rows with pending/failed pills, open detail panel that stays in sync with refetches.\nRules that must hold: a row click opens the panel, never navigates; no scrim - the source row stays tinted; settled rows stay quiet (colour is a budget; pills only where action or failure lives); the panel's hero is the amount; the failure reason rides the terminal timeline node.";
+    readonly "onboarding-status": "# Onboarding / verification status\nShell: full page, form clamped ~600px; a status home once submitted.\nRegistry items: venly-tokens, timeline, status-pill, field-list; block: onboarding (CompanyForm, VerificationStatusHome, RestrictedBanner).\nHooks: useCreateParty, useCreateAccount, useParty, useAccount; verification status from the party/account records verbatim.\nStates that must exist: collecting (review before submit), submitted/waiting (say who acts next, on which channel, what still works meanwhile), approved, declined (humane copy, review-request as the primary action), re-verification on a live account (banner naming what pauses and what keeps working).\nRules that must hold: never render a fake progress percentage - use real status; a waiting state answers how long / who acts / what still works, and where no review window is published the copy says so instead of inventing one; a decline explains and offers a next step, not a dead end; creating a party is NOT completed verification - show the honest state.";
+    readonly "withdraw-bank-accounts": "# Withdraw + bank accounts (off-ramp)\nShell: settings page for the whitelist; full page for the flow, form clamped ~600px.\nRegistry items: venly-tokens, data-table, status-pill, timeline, field-list, arithmetic-ladder; blocks: bank-accounts (BankAccountsBlock, AddBankAccountForm), withdraw (WithdrawFlow, WithdrawalsTable, ConnectedWithdrawDetail).\nHooks: useCompanyBankAccounts, useBankAccountConfig, useCreateCompanyBankAccount, useRampRequests, useRampRequest, useCreateRampRequest, useFeeQuote, useRampPairs, useReferenceData, useFourEyesApproval, useInitiateRamp, describeRampStatus.\nStates that must exist: empty whitelist (one CTA), account in review / verified / declined, no-verified-destination block, amount over balance (two-place signal), fee quote with its unit, awaiting approval (creator sees why they can't approve), stale decision (409 - refetch and re-decide, never auto-retry), awaiting funds (deposit instructions + mandatory reference + tx-hash report), processing, paid out, failed, rejected, cancelled, on hold.\nRules that must hold: destinations are the company's OWN verified accounts - unverified rows are disabled with the reason, never hidden; the pre-create review renders only known figures (no invented rate, no bank-receives placeholder - the created record carries the fiat arithmetic and the detail opens on it); a refusal never reads as a wait; the event timeline renders actor, role and absolute timestamps.";
+    readonly reconciliation: "# Reconciliation\nShell: split pane (roughly one-third list, two-thirds evidence) - not a drawer.\nRegistry items: venly-tokens, data-table, side-panel, status-pill, field-list.\nHooks: reconcile_by_reference_code (MCP composite) or useVirtualBankAccounts + useTransfers joined on referenceCode.\nStates that must exist: matched, unmatched with candidate expectations, partial/many-to-one with a live shortfall figure, resolved.\nRules that must hold: show per-signal match rationale (which fields agree), never a bare score; keep zero-counts visible - an empty exception queue is information; keyboard row-stepping for review throughput.";
+    readonly "proof-of-segregation": "# Proof of segregation\nShell: content column, single card.\nRegistry items: venly-tokens, field-list, balance-card.\nHooks: useWallets, useAccount; on-chain balance beside the ledger figure.\nStates that must exist: reconciled (figures agree, timestamped), reconciling, source unavailable (say so - never render a stale figure as current).\nRules that must hold: the wallet address renders monospace with copy; the on-chain figure and ledger figure sit side by side with their as-of times; discrepancies are stated, not smoothed.";
+    readonly approvals: "# Approvals\nShell: full-width queue + side panel tailored to the approver.\nRegistry items: venly-tokens, data-table, status-pill, side-panel, timeline.\nHooks: useRampRequests, useFourEyesApproval (capability decides what renders), useRampLifecycle.\nStates that must exist: queue with awaiting-approval items, detail with the decision context beside the figures, applied, stale-version (someone acted first - refetch and re-decide), creator-view (cannot approve own request - render the rule, not a disabled mystery button).\nRules that must hold: the optimistic-locking version travels with every decision; a 409 means re-decide against fresh state, never auto-retry; reject requires a reason; the creator sees why they cannot approve.";
+};
+type JourneyKey = keyof typeof JOURNEYS;
 interface Finding {
     rule: string;
     severity: "error" | "warn";
     evidence: string;
     fix: string;
+    /** 1-based line the finding fired on - lets a CLI print path:line. */
+    line?: number;
 }
 /** Deterministic design audit. Text in, findings out - no model, no taste. */
-export declare function reviewScreenSource(source: string): Finding[];
+export declare function reviewScreenSource(source: string, journey?: JourneyKey): Finding[];
 export declare function registerFrontendTools(server: McpServer): void;
 export {};

package/dist/frontend.js

@@ -80,15 +80,75 @@ States that must exist: queue with awaiting-approval items, detail with the deci
 Rules that must hold: the optimistic-locking version travels with every decision; a 409 means re-decide against fresh state, never auto-retry; reject requires a reason; the creator sees why they cannot approve.`,
 };
 const JOURNEY_KEYS = Object.keys(JOURNEYS);
+// ---------------------------------------------------------------------------
+// Shared mechanics. Three cross-cutting behaviours every rule participates in:
+//
+// 1. Suppression: `venly-allow:<rule-id>` on the offending line or the line
+//    immediately above drops the finding silently - no counter, no second
+//    severity tier. A consumer's own API may legitimately return what ours
+//    does not; without this hatch the audit is uninstallable for them.
+// 2. Comment lines are not copy: rules that judge words skip lines whose
+//    trimmed form starts with `*`, `//`, `/*` or `{/*` - otherwise the rule
+//    fires on the comment that documents the rule itself.
+// 3. Findings carry the character index they fired at, so suppression can be
+//    resolved against the exact offending line.
+// ---------------------------------------------------------------------------
+const COMMENT_LINE = /^\s*(?:\*|\/\/|\/\*|\{\/\*)/;
+function lineBoundsAt(source, idx) {
+    const at = Math.min(Math.max(idx, 0), source.length);
+    const start = source.lastIndexOf("\n", Math.max(0, at - 1)) + 1;
+    const nl = source.indexOf("\n", at);
+    return { start, end: nl === -1 ? source.length : nl };
+}
+function lineAt(source, idx) {
+    const { start, end } = lineBoundsAt(source, idx);
+    return source.slice(start, end);
+}
+function lineAboveAt(source, idx) {
+    const { start } = lineBoundsAt(source, idx);
+    if (start === 0)
+        return "";
+    const prevEnd = start - 1; // the \n terminating the previous line
+    const prevStart = source.lastIndexOf("\n", prevEnd - 1) + 1;
+    return source.slice(prevStart, prevEnd);
+}
+function isCommentLineAt(source, idx) {
+    return COMMENT_LINE.test(lineAt(source, idx));
+}
+function isSuppressedAt(source, idx, ruleId) {
+    const token = `venly-allow:${ruleId}`;
+    return lineAt(source, idx).includes(token) || lineAboveAt(source, idx).includes(token);
+}
+function lineNumberAt(source, idx) {
+    let line = 1;
+    for (let i = 0; i < idx && i < source.length; i++)
+        if (source[i] === "\n")
+            line++;
+    return line;
+}
 /** Deterministic design audit. Text in, findings out - no model, no taste. */
-export function reviewScreenSource(source) {
+export function reviewScreenSource(source, journey) {
     const findings = [];
-    const push = (rule, severity, evidence, fix) => findings.push({ rule, severity, evidence: evidence.slice(0, 120), fix });
+    // Returns whether the finding was recorded, so rules that stop after the
+    // first hit can keep scanning past a suppressed occurrence instead of
+    // letting one venly-allow blind them to a later real violation.
+    const push = (rule, severity, evidence, fix, atIndex) => {
+        if (isSuppressedAt(source, atIndex, rule))
+            return false;
+        findings.push({
+            rule,
+            severity,
+            evidence: evidence.slice(0, 120),
+            fix,
+            line: lineNumberAt(source, atIndex),
+        });
+        return true;
+    };
     for (const match of source.matchAll(/#[0-9a-fA-F]{3,8}\b|rgba?\([^)]*\)/g)) {
-        push("raw-colour", "error", match[0], "Read colours from the venly-tokens custom properties; a reskin must be tokens.css and nothing else.");
+        push("raw-colour", "error", match[0], "Read colours from the venly-tokens custom properties; a reskin must be tokens.css and nothing else.", match.index ?? 0);
     }
     for (const match of source.matchAll(/-\d[\d,]*\.\d{2}\s*(?:[A-Z]{3}|€|\$|£)/g)) {
-        push("hyphen-minus-amount", "error", match[0], "Use the true minus sign − before negative amounts (the Money primitive does this).");
+        push("hyphen-minus-amount", "error", match[0], "Use the true minus sign − before negative amounts (the Money primitive does this).", match.index ?? 0);
     }
     // Only a RENDERED cancelled state counts (a quoted/JSX label or a state
     // value), never the verb "cancel" in prose or a token file's comment; and
@@ -98,29 +158,238 @@ export function reviewScreenSource(source) {
         const idx = match.index ?? 0;
         const around = source.slice(Math.max(0, idx - 150), idx + 150);
         if (/✓/.test(around)) {
-            push("success-on-cancelled", "error", around.trim().slice(0, 80), "A cancelled or failed terminal step must never carry a success check - grey ↺ or red ✕.");
-            break;
+            if (push("success-on-cancelled", "error", around.trim().slice(0, 80), "A cancelled or failed terminal step must never carry a success check - grey ↺ or red ✕.", idx))
+                break;
         }
     }
-    if (/review|confirm/i.test(source) && /[•*]{3,}/.test(source)) {
-        push("masked-review-value", "error", source.match(/[•*]{3,}/)[0], "Never mask values on a review screen; its only job is legibility of what is about to happen.");
+    // The once-per-source rules below scan every occurrence and stop at the
+    // first RECORDED finding, so a venly-allow on one occurrence never hides a
+    // later unsuppressed one.
+    if (/review|confirm/i.test(source)) {
+        for (const masked of source.matchAll(/[•*]{3,}/g)) {
+            if (push("masked-review-value", "error", masked[0], "Never mask values on a review screen; its only job is legibility of what is about to happen.", masked.index ?? 0))
+                break;
+        }
     }
-    if (/nth-child\(\s*(?:even|odd|2n)/.test(source)) {
-        push("zebra-striping", "warn", "nth-child(even/odd) background", "No finance reference uses zebra striping - separate rows with hairlines and spacing.");
+    for (const zebra of source.matchAll(/nth-child\(\s*(?:even|odd|2n)/g)) {
+        if (push("zebra-striping", "warn", "nth-child(even/odd) background", "No finance reference uses zebra striping - separate rows with hairlines and spacing.", zebra.index ?? 0))
+            break;
     }
-    if (/box-shadow/.test(source) && !/var\(--shadow-overlay\)/.test(source)) {
-        push("shadow-outside-overlay", "warn", source.match(/box-shadow[^;"}]*/)?.[0] ?? "box-shadow", "Elevation is only for overlays, and only via the --shadow-overlay token; the base layer is flat.");
+    if (!/var\(--shadow-overlay\)/.test(source)) {
+        for (const shadow of source.matchAll(/box-shadow[^;"}]*/g)) {
+            if (push("shadow-outside-overlay", "warn", shadow[0], "Elevation is only for overlays, and only via the --shadow-overlay token; the base layer is flat.", shadow.index ?? 0))
+                break;
+        }
     }
-    if (/linear-gradient|radial-gradient/.test(source)) {
-        push("gradient-surface", "warn", source.match(/\w+-gradient\([^)]*\)/)?.[0] ?? "gradient", "Gradient balance heroes read as template, not product; surfaces are flat neutrals with one accent.");
+    for (const gradient of source.matchAll(/(?:linear|radial)-gradient(?:\([^)]*\))?/g)) {
+        if (push("gradient-surface", "warn", gradient[0], "Gradient balance heroes read as template, not product; surfaces are flat neutrals with one accent.", gradient.index ?? 0))
+            break;
     }
-    if (/(?:status|state)/i.test(source) && /var\(--state-/.test(source)) {
-        if (!/[✓✕↺⚠●○]|aria-hidden/.test(source)) {
-            push("colour-only-state", "warn", "state colours present without any glyph", "Pair every state hue with a glyph or word so status survives greyscale.");
+    if (/(?:status|state)/i.test(source) && !/[✓✕↺⚠●○]|aria-hidden/.test(source)) {
+        for (const stateVar of source.matchAll(/var\(--state-/g)) {
+            if (push("colour-only-state", "warn", "state colours present without any glyph", "Pair every state hue with a glyph or word so status survives greyscale.", stateVar.index ?? 0))
+                break;
         }
     }
+    // --- New rule classes (invented timing copy, crypto currency formatting,
+    // required-rendered-optional, blueprint state coverage, fixture honesty)
+    // are registered below. Each judges text only, honours the suppression
+    // hatch, and skips comment lines wherever it judges copy.
+    checkInventedTimingClaim(source, push);
+    checkIntlCurrencyCrypto(source, push);
+    checkRequiredRenderedOptional(source, push);
+    checkBlueprintStateCoverage(source, journey, push);
+    checkFixtureHonesty(source, push);
     return findings;
 }
+/**
+ * invented-timing-claim - copy that promises a duration, a settlement window
+ * or custody behaviour ("1-2 business days", "held until claimed",
+ * "estimated arrival") that no API in this stack returns. Rendering such a
+ * promise invents a guarantee the backend cannot honour; the journey
+ * contracts require a labelled omission instead. Copy rule: comment lines
+ * are not copy, so matches on them are skipped.
+ */
+function checkInventedTimingClaim(source, push) {
+    const pattern = /\b(?:typically|usually|normally|generally)\s+(?:arrives?|takes?|clears?|settles?)\b|\b\d+\s*(?:-|–|to)\s*\d+\s+business\s+days?\b|\bwithin\s+\d+\s+(?:seconds?|minutes?|hours?|days?|business\s+days?)\b|\bheld\s+until\s+claimed\b|\bestimated\s+(?:arrival|delivery|completion)\b/gi;
+    for (const match of source.matchAll(pattern)) {
+        const at = match.index ?? 0;
+        if (isCommentLineAt(source, at))
+            continue;
+        push("invented-timing-claim", "error", match[0], "No API in this stack returns a duration, settlement window or custody guarantee. Render the labelled omission the contract specifies, or - if your own API does return it - name the field path on the line and add venly-allow:invented-timing-claim.", at);
+    }
+}
+// --- intl-currency-crypto -------------------------------------------------
+// Intl.NumberFormat validates `currency` against ISO 4217, so a crypto asset
+// code ("USDC", "DAI", ...) throws RangeError the moment the formatter is
+// constructed - a screen that compiles fine crashes on first render. Each
+// Intl.NumberFormat call site is judged by the 200 characters that follow it:
+// a literal crypto code next to style:"currency" is a certain crash (error);
+// a variable-fed `currency:` is a latent one (warn) - it only survives until
+// a crypto asset reaches it. Not a copy rule, so comment lines are not
+// skipped; suppression still applies via the shared venly-allow hatch.
+function checkIntlCurrencyCrypto(source, push) {
+    const currencyStyle = /style\s*:\s*["']currency["']/;
+    const cryptoCode = /["'](?:USDC|EURC|USDT|USDS|DAI|PYUSD|USDG|RLUSD)["']/;
+    // `\s*` lives inside the lookahead: with `currency\s*:\s*(?!["'])` the
+    // greedy whitespace backtracks to zero and the lookahead inspects the
+    // space instead of the quote, flagging `currency: "USD"` as a variable.
+    const variableCurrency = /currency\s*:(?!\s*["'])/;
+    for (const match of source.matchAll(/Intl\.NumberFormat/g)) {
+        const at = match.index ?? 0;
+        const window = source.slice(at, at + 200);
+        const style = currencyStyle.exec(window);
+        if (!style)
+            continue; // plain decimal formatting (the kit's own formatAmount) is safe
+        const styleAt = style.index ?? 0;
+        const crypto = cryptoCode.exec(window);
+        if (crypto) {
+            const cryptoAt = crypto.index ?? 0;
+            const from = Math.min(styleAt, cryptoAt);
+            const to = Math.max(styleAt + style[0].length, cryptoAt + crypto[0].length);
+            push("intl-currency-crypto", "error", window.slice(from, to), "Intl.NumberFormat with style:\"currency\" throws RangeError on a non-ISO-4217 code. Render crypto amounts with the Money primitive, which places the code beside the digits instead of inside the formatter.", at);
+            continue; // one finding per call site; the certain crash outranks the latent one
+        }
+        const variable = variableCurrency.exec(window);
+        if (variable) {
+            const variableAt = variable.index ?? 0;
+            const from = Math.min(styleAt, variableAt);
+            const to = Math.min(window.length, Math.max(styleAt + style[0].length, variableAt) + 40);
+            push("intl-currency-crypto", "warn", window.slice(from, to), "This formatter takes its currency from a variable. If a crypto asset can reach it, it throws at runtime. Use the Money primitive, or narrow the variable to ISO-4217 codes.", at);
+        }
+    }
+}
+/**
+ * A required field labelled as optional. The kit deliberately ships a
+ * "(not required)" variant for genuinely optional rows, so the net is scoped
+ * tightly: only the payment reference is required-by-contract, and a payer
+ * who omits it produces an unmatched credit that someone has to reconcile by
+ * hand. The rule therefore fires only when "(not required)" appears on a real
+ * code line AND the surrounding code (comments removed) mentions the
+ * reference - a comment that merely documents this contract must not trip it.
+ */
+function checkRequiredRenderedOptional(source, push) {
+    for (const match of source.matchAll(/\(not required\)/gi)) {
+        const idx = match.index ?? 0;
+        // Copy rule: only judge rendered copy, never commentary about it.
+        if (isCommentLineAt(source, idx))
+            continue;
+        const winStart = Math.max(0, idx - 200);
+        const winEnd = Math.min(source.length, idx + match[0].length + 200);
+        // Rebuild the window with every comment line removed. Each line is
+        // classified on its FULL text (a fragment cut by the window edge could
+        // hide its comment marker), but only the in-window portion of surviving
+        // code lines feeds the reference test.
+        let pos = source.lastIndexOf("\n", Math.max(0, winStart - 1)) + 1;
+        let window = "";
+        while (pos < winEnd) {
+            let lineEnd = source.indexOf("\n", pos);
+            if (lineEnd === -1)
+                lineEnd = source.length;
+            const line = source.slice(pos, lineEnd);
+            if (!COMMENT_LINE.test(line)) {
+                const from = Math.max(pos, winStart);
+                const to = Math.min(lineEnd, winEnd);
+                if (to > from)
+                    window += source.slice(from, to) + "\n";
+            }
+            pos = lineEnd + 1;
+        }
+        if (!/reference/i.test(window))
+            continue;
+        push("required-rendered-optional", "error", lineAt(source, idx).trim(), 'The payment reference is required - a payer who omits it produces an unmatched credit. Render the amber Required pill; never label it "(not required)".', idx);
+    }
+}
+function checkBlueprintStateCoverage(source, journey, push) {
+    // Only meaningful when the caller declared which journey this screen serves.
+    if (journey === undefined)
+        return;
+    // Whole-source suppression: this finding has no single offending line (it
+    // reports blueprint states absent from the entire file), so the escape
+    // hatch is whole-source too - the venly-allow token anywhere drops it.
+    if (source.includes("venly-allow:blueprint-state-missing"))
+        return;
+    const blueprint = JOURNEYS[journey];
+    const startMarker = "States that must exist:";
+    const startIdx = blueprint.indexOf(startMarker);
+    if (startIdx === -1)
+        return;
+    let statesText = blueprint.slice(startIdx + startMarker.length);
+    const end = /^Rules that must hold/m.exec(statesText);
+    if (end)
+        statesText = statesText.slice(0, end.index);
+    // Blueprint prose wraps across lines mid-sentence; collapse before parsing.
+    statesText = statesText.replace(/\n/g, " ");
+    // One state per " · " or "," separator - but only at parenthesis depth 0:
+    // a comma inside a parenthetical is part of that state's description, not
+    // a state boundary. Naive splitting yields fragments like "terminal)" that
+    // no source can contain, making a journey structurally unable to pass.
+    const parts = [];
+    let depth = 0;
+    let current = "";
+    for (const ch of statesText) {
+        if (ch === "(")
+            depth++;
+        else if (ch === ")")
+            depth = Math.max(0, depth - 1);
+        if (depth === 0 && (ch === "," || ch === "·")) {
+            parts.push(current);
+            current = "";
+            continue;
+        }
+        current += ch;
+    }
+    parts.push(current);
+    // Each state's keyword is the text before the first parenthetical,
+    // normalised for a case-insensitive substring probe.
+    const keywords = [];
+    for (const part of parts) {
+        const keyword = part
+            .split("(")[0]
+            .trim()
+            .toLowerCase()
+            .replace(/\s+/g, " ")
+            .replace(/\.$/, "");
+        if (keyword)
+            keywords.push(keyword);
+    }
+    const lowered = source.toLowerCase();
+    const missing = keywords.filter((keyword) => !lowered.includes(keyword));
+    if (missing.length === 0)
+        return;
+    // One aggregate warn, never per-keyword findings and never an empty-list
+    // finding. Warn (not error) because blueprint phrases are prose - a state
+    // can be fully implemented under different wording.
+    const list = missing.join(", ");
+    push("blueprint-state-missing", "warn", list, `The ${journey} blueprint names ${keywords.length} states. These were not found by name in this source: ${list}. Either they are missing or they render under different wording - check each by hand.`, 0);
+}
+function checkFixtureHonesty(source, push) {
+    // Fixture honesty. A demo that seeds parity rates or round-number amounts
+    // teaches false patterns: parity hides the crypto/fiat unit distinction,
+    // and round numbers let a total look derivable when it is coincidence.
+    // ERROR - an explicit parity rate seeded on a rate-named field. Anchored to
+    // the three rate names so counters like `rateLimit: 1` never trip it.
+    for (const match of source.matchAll(/\b(?:exchangeRate|rate|fxRate)\s*[:=]\s*1(?:\.0+)?\b/g)) {
+        push("parity-fixture", "error", match[0], "A parity exchange rate makes the crypto/fiat unit distinction numerically invisible, which is the falsehood a real quoted rate exists to prevent. Seed a real non-parity rate.", match.index ?? 0);
+    }
+    // WARN - three or more round-number amounts (x.00) in one source. Comment
+    // lines are skipped: this sibling judges seeded copy/fixtures, and prose
+    // like "may display as 0.00" is documentation, not a seeded amount. One
+    // finding per source, anchored at the first counted match.
+    let roundCount = 0;
+    let firstRoundIdx = -1;
+    for (const match of source.matchAll(/\b\d+\.00\b/g)) {
+        const idx = match.index ?? 0;
+        if (isCommentLineAt(source, idx))
+            continue;
+        if (firstRoundIdx === -1)
+            firstRoundIdx = idx;
+        roundCount++;
+    }
+    if (roundCount >= 3) {
+        push("round-number-coincidence", "warn", `${roundCount} round-number (.00) amounts seeded in one source`, "Round-number fixtures hide arithmetic. If a total is coincidentally equal to a part, the screen teaches a false pattern - use amounts that do not divide evenly.", firstRoundIdx);
+    }
+}
 const AGENTS_TEXT = `# Composition rules for coding agents building on the Venly UI registry
 
 Delivery: the shadcn CLI expects a working shadcn environment BEFORE any
@@ -157,8 +426,14 @@ installed venly-tokens css once at the app root.
    on "stale-version" refetch and let the operator re-decide.
 5. Theme by editing the installed venly-tokens css file and nothing else.
 6. Before declaring a screen done, run the review_screen tool on its source
-   and fix every error-severity finding. Consult get_journey_blueprint
-   before designing a screen the registry has no block for.
+   (pass the journey key so blueprint state coverage is checked too) and fix
+   every error-severity finding. Consult get_journey_blueprint before
+   designing a screen the registry has no block for.
+7. Wire the same audit into the app you generate as a CI step - it is what
+   turns the design contract into a gate:
+   \`npx @venlyfinance/settlement-mcp review "src/**/*.tsx"\`
+   (exit 1 on any error-severity finding). A deliberate, justified exception
+   carries venly-allow:<rule-id> on the offending line or the line above.
 `;
 export function registerFrontendTools(server) {
     server.registerTool("get_journey_blueprint", {
@@ -172,12 +447,16 @@ export function registerFrontendTools(server) {
     }));
     server.registerTool("review_screen", {
         title: "Design-audit a screen",
-        description: "Deterministic audit of component/markup source against the kit's design contract: raw colours, hyphen-minus amounts, success styling on cancelled steps, masked review values, zebra striping, off-token shadows, gradients, colour-only state. Returns findings, not a score.",
+        description: "Deterministic audit of component/markup source against the kit's design contract: raw colours, hyphen-minus amounts, success styling on cancelled steps, masked review values, invented timing/custody copy, crypto codes inside Intl currency formatting, required fields rendered optional, parity and round-number fixtures, zebra striping, off-token shadows, gradients, colour-only state. Pass the journey key to also check the source against that journey's required blueprint states. Suppress a deliberate exception with venly-allow:<rule-id> on the offending line or the line above. Returns findings, not a score.",
         inputSchema: {
             source: z.string().min(1).describe("The component/markup/CSS source to audit"),
+            journey: z
+                .enum(JOURNEY_KEYS)
+                .optional()
+                .describe("Optional: which journey this screen implements - enables the blueprint state-coverage check"),
         },
-    }, async ({ source }) => {
-        const findings = reviewScreenSource(source);
+    }, async ({ source, journey }) => {
+        const findings = reviewScreenSource(source, journey);
         return {
             content: [
                 {

package/dist/index.js

@@ -27,7 +27,24 @@ async function main() {
             : "writes DISARMED: mutations return dry-run previews (arming needs confirm:true + VENLY_MCP_LIVE=1 + credentials)";
     process.stderr.write(`venly-finance-mcp started in ${client.environment}. ${writeState}.\n`);
 }
-main().catch((err) => {
-    process.stderr.write(`Fatal: ${err.message}\n`);
-    process.exit(1);
-});
+const argv = process.argv.slice(2);
+if (argv[0] === "review") {
+    // Design-audit CLI mode: `... review "src/**/*.tsx"`. Dynamic import so the
+    // MCP/SDK path is never touched; MCP hosts launch with zero args, so plain
+    // startup is unchanged.
+    import("./review-cli.js")
+        .then(({ runReviewCli }) => runReviewCli(argv.slice(1)))
+        .then((code) => {
+        process.exitCode = code;
+    })
+        .catch((err) => {
+        process.stderr.write(`Fatal: ${err.message}\n`);
+        process.exit(2);
+    });
+}
+else {
+    main().catch((err) => {
+        process.stderr.write(`Fatal: ${err.message}\n`);
+        process.exit(1);
+    });
+}

package/dist/review-cli.d.ts

@@ -0,0 +1,4 @@
+/** Expand one glob pattern (posix-style separators) relative to cwd. */
+export declare function expandPattern(pattern: string, cwd: string): string[];
+export declare function expandPatterns(patterns: string[], cwd: string): string[];
+export declare function runReviewCli(args: string[], out?: NodeJS.WritableStream, err?: NodeJS.WritableStream): Promise<0 | 1 | 2>;

package/dist/review-cli.js

@@ -0,0 +1,131 @@
+// `review` subcommand: the review_screen design audit as a CI gate.
+//
+//   npx @venlyfinance/settlement-mcp review "src/**/*.tsx"
+//
+// Exit codes: 0 clean (warnings allowed, printed either way) · 1 at least one
+// error-severity finding · 2 usage error or a pattern that matched nothing
+// (a typo'd path must never pass CI silently).
+//
+// Patterns are self-expanded (**, *, {a,b}) so the quoted form works on any
+// shell; unquoted shell-expanded literal paths work too. No dependencies.
+// (Line comments on purpose: a glob's **/ would terminate a block comment.)
+import { readdirSync, readFileSync, statSync, existsSync } from "node:fs";
+import { join, relative } from "node:path";
+import { reviewScreenSource } from "./frontend.js";
+const SKIP_DIRS = new Set(["node_modules", ".git", "dist"]);
+function braceExpand(pattern) {
+    const m = /\{([^{}]*)\}/.exec(pattern);
+    if (!m)
+        return [pattern];
+    const before = pattern.slice(0, m.index);
+    const after = pattern.slice(m.index + m[0].length);
+    const out = [];
+    for (const option of m[1].split(",")) {
+        out.push(...braceExpand(before + option + after));
+    }
+    return out;
+}
+function patternToRegExp(pattern) {
+    // Escape everything regex-special except the glob characters we translate.
+    const escaped = pattern.replace(/[.+^$()|[\]\\?]/g, "\\$&");
+    const translated = escaped
+        .replace(/\*\*\//g, "\u0000") // **/ may match zero segments
+        .replace(/\*\*/g, "\u0001") // a bare ** matches anything
+        .replace(/\*/g, "[^/]*")
+        .replace(/\u0000/g, "(?:.*/)?")
+        .replace(/\u0001/g, ".*");
+    return new RegExp(`^${translated}$`);
+}
+function walk(dir, into) {
+    let entries;
+    try {
+        entries = readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    for (const entry of entries) {
+        if (entry.isDirectory()) {
+            if (!SKIP_DIRS.has(entry.name))
+                walk(join(dir, entry.name), into);
+        }
+        else if (entry.isFile()) {
+            into.push(join(dir, entry.name));
+        }
+    }
+}
+/** Expand one glob pattern (posix-style separators) relative to cwd. */
+export function expandPattern(pattern, cwd) {
+    const results = [];
+    for (const variant of braceExpand(pattern)) {
+        const segments = variant.split("/");
+        const firstWild = segments.findIndex((s) => s.includes("*"));
+        if (firstWild === -1) {
+            if (existsSync(join(cwd, variant)) && statSync(join(cwd, variant)).isFile()) {
+                results.push(variant);
+            }
+            continue;
+        }
+        const staticPrefix = segments.slice(0, firstWild).join("/");
+        const root = staticPrefix ? join(cwd, staticPrefix) : cwd;
+        const files = [];
+        walk(root, files);
+        const matcher = patternToRegExp(variant);
+        for (const file of files) {
+            // relative(), not string slicing: a pattern like "../ui/**/*.tsx"
+            // walks outside cwd, where prefix slicing produces garbage.
+            const rel = relative(cwd, file).split("\\").join("/");
+            if (matcher.test(rel))
+                results.push(rel);
+        }
+    }
+    return [...new Set(results)].sort();
+}
+export function expandPatterns(patterns, cwd) {
+    const out = [];
+    for (const pattern of patterns) {
+        if (/[*{]/.test(pattern)) {
+            out.push(...expandPattern(pattern.split("\\").join("/"), cwd));
+        }
+        else {
+            out.push(pattern); // shell-expanded or literal; existence checked by caller
+        }
+    }
+    return [...new Set(out)];
+}
+export async function runReviewCli(args, out = process.stdout, err = process.stderr) {
+    const patterns = args.filter((a) => !a.startsWith("-"));
+    if (patterns.length === 0) {
+        err.write('Usage: review "<glob>" [more globs or files]\n' +
+            '  e.g. review "src/**/*.tsx"\n' +
+            "Exits 1 on any error-severity finding, 2 when nothing matched.\n");
+        return 2;
+    }
+    const cwd = process.cwd();
+    const files = expandPatterns(patterns, cwd);
+    const missing = files.filter((f) => !existsSync(f));
+    if (missing.length > 0) {
+        err.write(`No such file: ${missing.join(", ")}\n`);
+        return 2;
+    }
+    if (files.length === 0) {
+        err.write(`Nothing matched: ${patterns.join(" ")}\n`);
+        return 2;
+    }
+    let errors = 0;
+    let warnings = 0;
+    for (const file of files) {
+        const findings = reviewScreenSource(readFileSync(file, "utf8"));
+        for (const finding of findings) {
+            if (finding.severity === "error")
+                errors++;
+            else
+                warnings++;
+            const line = finding.line === undefined ? "" : `:${finding.line}`;
+            out.write(`${file}${line}  ${finding.severity}  ${finding.rule}  ${finding.evidence}\n`);
+            out.write(`  fix: ${finding.fix}\n`);
+        }
+    }
+    out.write(`${errors} error(s), ${warnings} warning(s) across ${files.length} file(s)\n`);
+    return errors > 0 ? 1 : 0;
+}

package/package.json

@@ -1,17 +1,19 @@
 {
   "name": "@venlyfinance/settlement-mcp",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Venly Finance MCP: SDK-backed tools, resources and prompts for building international money products safely.",
   "type": "module",
   "bin": {
     "venly-finance-mcp": "dist/index.js",
-    "venly-settlement-mcp": "dist/index.js"
+    "venly-settlement-mcp": "dist/index.js",
+    "settlement-mcp": "dist/index.js"
   },
   "main": "dist/index.js",
   "files": [
     "dist",
     "scripts",
     "skills",
+    "AGENTS.md",
     "README.md",
     "CHANGELOG.md"
   ],
@@ -60,4 +62,4 @@
     "eur",
     "viban"
   ]
-}
+}