agentic-wallet-mcp 0.10.0 → 0.11.0

package/CHANGELOG.md

@@ -8,6 +8,22 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 > Entries for 0.5.0 and earlier were reconstructed from commit history when this file was
 > introduced in 0.6.0, so they summarise each release rather than being exhaustive.
 
+## [0.11.0] — 17 September 2026
+
+### Added
+
+- **VC pass-design images are now surfaced for basic and verified birthcert issuance.** When the
+  issuer returns a pass-design image alongside a credential, the wallet extracts it, writes it to
+  disk, and — since a remote MCP client has no filesystem access to read a local path back —
+  returns it as an inline image in the tool response too, so the pass is actually visible rather
+  than just referenced by path.
+
+### Fixed
+
+- **The spending-cap blocker now shows human-readable amounts.** It previously showed the raw
+  base-unit number with no symbol or decimal conversion, while the balance/fee blocker in the same
+  response already showed the correctly formatted amount — the cap blocker now matches it.
+
 ## [0.10.0] — 14 September 2026
 
 ### Added

package/dist/server-bundle.cjs

@@ -12542,15 +12542,16 @@ __export(index_exports, {
   buildToolList: () => buildToolList
 });
 module.exports = __toCommonJS(index_exports);
-var import_node_crypto5 = require("node:crypto");
+var import_node_crypto6 = require("node:crypto");
 var import_node_fs = require("node:fs");
+var import_promises6 = require("node:fs/promises");
 var import_node_os2 = require("node:os");
-var import_node_path6 = require("node:path");
+var import_node_path7 = require("node:path");
 
 // package.json
 var package_default = {
   name: "agentic-wallet-mcp",
-  version: "0.10.0",
+  version: "0.11.0",
   description: "Agent-facing MCP wallet for Zetrix \u2014 orchestrates x401 identity proof, x402 payment, and MBI VC issuance",
   keywords: [
     "mcp",
@@ -22429,6 +22430,31 @@ async function payWithReadinessCheck(requestedAsset, rawPay, activated) {
   }
 }
 
+// src/clients/vc-pass-image.ts
+var import_node_crypto2 = require("node:crypto");
+var import_promises2 = require("node:fs/promises");
+var import_node_path3 = require("node:path");
+var MAX_PASS_IMAGE_PAGES = 10;
+var MAX_PASS_IMAGE_BASE64_LENGTH = 8e6;
+function extractVcPassBase64(extraData) {
+  if (typeof extraData !== "object" || extraData === null) return void 0;
+  const raw = extraData.vcPassBase64;
+  if (!Array.isArray(raw)) return void 0;
+  const strings = raw.filter((v) => typeof v === "string" && v.length > 0 && v.length <= MAX_PASS_IMAGE_BASE64_LENGTH).slice(0, MAX_PASS_IMAGE_PAGES);
+  return strings.length > 0 ? strings : void 0;
+}
+async function writeVcPassImages(baseDir, vcId, base64Images) {
+  await (0, import_promises2.mkdir)(baseDir, { recursive: true });
+  const hash = (0, import_node_crypto2.createHash)("sha256").update(vcId).digest("hex");
+  const paths = [];
+  for (let i = 0; i < base64Images.length; i++) {
+    const filePath = (0, import_node_path3.join)(baseDir, `${hash}-${i}.png`);
+    await (0, import_promises2.writeFile)(filePath, Buffer.from(base64Images[i], "base64"));
+    paths.push(filePath);
+  }
+  return paths;
+}
+
 // src/orchestrator/subscribe.ts
 function diffAgainstTemplate(vc, fields) {
   const held = new Set(extractAttributeKeys(vc));
@@ -22458,6 +22484,36 @@ async function pollSettlementOutcome(deps, paymentId) {
   }
   return { ...last, polls: RECOVERY_MAX_POLLS };
 }
+async function resolveVcPassImagePaths(deps, vcId) {
+  const downloadVcs = deps.mbi.downloadVcs;
+  const auth = deps.auth;
+  const address = deps.address;
+  const quarantine = deps.quarantine;
+  const passImagesDir = deps.passImagesDir;
+  if (!downloadVcs || !auth || !address || !quarantine || !passImagesDir) return void 0;
+  try {
+    const entries = await quarantine.withLock(vcId, async () => {
+      const quarantined = await quarantine.get(vcId);
+      if (quarantined) return quarantined.entries;
+      let downloaded;
+      try {
+        downloaded = await downloadVcs({ address }, await auth());
+      } catch {
+        return void 0;
+      }
+      await quarantine.set({ vcId, entries: downloaded, downloadedAt: (/* @__PURE__ */ new Date()).toISOString() });
+      return downloaded;
+    });
+    if (!entries) return void 0;
+    const match = entries.find((e) => typeof e.vc === "object" && e.vc !== null && e.vc.id === vcId);
+    if (!match) return void 0;
+    const base64Images = extractVcPassBase64(match.extraData);
+    if (!base64Images) return void 0;
+    return await writeVcPassImages(passImagesDir, vcId, base64Images);
+  } catch {
+    return void 0;
+  }
+}
 async function subscribeAndIssue(deps, opts) {
   if (!/^did:zid:/.test(opts.templateId)) {
     return { issued: false, reason: `templateId must be a did:zid:... credential-definition id, got "${opts.templateId}"` };
@@ -22534,7 +22590,9 @@ async function subscribeAndIssue(deps, opts) {
       ...schema ? { schema } : {}
     };
   }
-  const data = JSON.stringify([{ templateId: opts.templateId, metadata: attributes }]);
+  const data = JSON.stringify([
+    deps.passDesignId ? { templateId: opts.templateId, passDesignId: deps.passDesignId, metadata: attributes } : { templateId: opts.templateId, metadata: attributes }
+  ]);
   const blob = zetrixHexStringToBytes(data).toString("hex");
   const { signBlob: signData, publicKey } = await deps.sign(blob);
   const body = { data, signData, publicKey };
@@ -22550,6 +22608,7 @@ async function subscribeAndIssue(deps, opts) {
   }
   if (challenge.issued) {
     const issued2 = challenge.issued;
+    const vcPassImagePaths2 = issued2.vcId ? await resolveVcPassImagePaths(deps, issued2.vcId) : void 0;
     if (deps.cache) {
       await deps.cache.set(opts.templateId, {
         templateId: opts.templateId,
@@ -22559,7 +22618,8 @@ async function subscribeAndIssue(deps, opts) {
         paidAsset: "none",
         amountPaid: "0",
         issuedAt: (/* @__PURE__ */ new Date()).toISOString(),
-        validUntil: extractValidUntil(issued2.verifiableCredential, opts.expirationDate)
+        validUntil: extractValidUntil(issued2.verifiableCredential, opts.expirationDate),
+        ...vcPassImagePaths2 ? { vcPassImagePaths: vcPassImagePaths2 } : {}
       });
     }
     return {
@@ -22569,7 +22629,8 @@ async function subscribeAndIssue(deps, opts) {
       txHash: issued2.txHash,
       paidAsset: "none",
       amountPaid: "0",
-      ...schema ? { schema } : {}
+      ...schema ? { schema } : {},
+      ...vcPassImagePaths2 ? { vcPassImagePaths: vcPassImagePaths2 } : {}
     };
   }
   const accept = challenge.accepts[0];
@@ -22604,6 +22665,7 @@ async function subscribeAndIssue(deps, opts) {
     }
     throw err;
   }
+  const vcPassImagePaths = issued.vcId ? await resolveVcPassImagePaths(deps, issued.vcId) : void 0;
   if (deps.cache) {
     await deps.cache.set(opts.templateId, {
       templateId: opts.templateId,
@@ -22613,7 +22675,8 @@ async function subscribeAndIssue(deps, opts) {
       paidAsset,
       amountPaid,
       issuedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      validUntil: extractValidUntil(issued.verifiableCredential, opts.expirationDate)
+      validUntil: extractValidUntil(issued.verifiableCredential, opts.expirationDate),
+      ...vcPassImagePaths ? { vcPassImagePaths } : {}
     });
   }
   return {
@@ -22623,7 +22686,8 @@ async function subscribeAndIssue(deps, opts) {
     txHash: issued.txHash,
     paidAsset,
     amountPaid,
-    ...schema ? { schema } : {}
+    ...schema ? { schema } : {},
+    ...vcPassImagePaths ? { vcPassImagePaths } : {}
   };
 }
 
@@ -22986,7 +23050,11 @@ var TEMPLATE_ALIASES = [
     testnet: "did:zid:3c0fb79adff08e14e06dcd6e3243205010dd65f533434a3d96c55575d1d3d959",
     mainnet: "did:zid:19091d19049abb8869b4b8e2f4a887bd1d1d86e5f5ebd0c8297000255f67765b",
     deriveAttributes: { id: "agentUsername" },
-    validateAttributes: { dob: validateDob, countryOfOrigin: validateCountryOfOrigin }
+    validateAttributes: { dob: validateDob, countryOfOrigin: validateCountryOfOrigin },
+    passDesignId: {
+      testnet: "did:zid:992e1e18985ba36a09ba0fbfeb601ddeb449f5e4e882ed69d0d620085f399818",
+      mainnet: "did:zid:915955cb71c6fd2a256d04344f57381084903cb6a85a1c9ddb71c746f08932ab"
+    }
   }
 ];
 function normalize2(s) {
@@ -23033,6 +23101,11 @@ function validateTemplateAttributes(templateId, network, attributes) {
   }
   return errors;
 }
+function resolvePassDesignId(templateId, network) {
+  const entry = findEntry(templateId, network);
+  if (!entry?.passDesignId) return void 0;
+  return network.includes("testnet") ? entry.passDesignId.testnet : entry.passDesignId.mainnet;
+}
 
 // src/orchestrator/preflight.ts
 var VERIFIED_AI_BIRTHCERT = "verified_ai_birthcert";
@@ -23080,7 +23153,7 @@ async function credentialPreflight(deps, input) {
     }
   }
   const cap = describePaymentCap(asset, requiredRaw, deps.caps);
-  if (!cap.wouldPass && !isFree) blockers.push(renderCapBlocker(cap, requiredRaw));
+  if (!cap.wouldPass && !isFree) blockers.push(renderCapBlocker(cap, requiredRaw, feeBalance));
   return {
     credential: input.credential,
     ready: blockers.length === 0,
@@ -23106,12 +23179,14 @@ function renderAmount(raw, balance) {
   const frac = (BigInt(raw) % d).toString().padStart(balance.decimals, "0").replace(/0+$/, "");
   return `${whole}${frac ? `.${frac}` : ""} ${balance.token}`;
 }
-function renderCapBlocker(cap, requiredRaw) {
+function renderCapBlocker(cap, requiredRaw, feeBalance) {
+  const requiredHuman = renderAmount(requiredRaw, feeBalance);
   if (cap.capRaw === null) {
     return `No spending limit applies to ${cap.asset}, and limits are configured \u2014 so this payment would be refused. Set a limit keyed by "${cap.asset}".`;
   }
+  const capHuman = renderAmount(cap.capRaw, feeBalance);
   const misKeyed = cap.matchedKey !== cap.asset;
-  return misKeyed ? `The spending limit that applies is ${cap.capRaw} (from the "*" fallback \u2014 no limit is set for ${cap.asset}), and this needs ${requiredRaw}.` : `The spending limit for ${cap.asset} is ${cap.capRaw}, and this needs ${requiredRaw}.`;
+  return misKeyed ? `The spending limit that applies is ${capHuman} (from the "*" fallback \u2014 no limit is set for ${cap.asset}), and this needs ${requiredHuman}.` : `The spending limit for ${cap.asset} is ${capHuman}, and this needs ${requiredHuman}.`;
 }
 function uncheckable(isVerified, isFree = false) {
   const items = [
@@ -23189,7 +23264,11 @@ function createTools(deps) {
       if (errors.length > 0) {
         return { issued: false, reason: errors.join("; ") };
       }
-      const result = await subscribeAndIssue(deps.subscribeDeps, { ...input, templateId, attributes });
+      const passDesignId = resolvePassDesignId(templateId, deps.config.network);
+      const result = await subscribeAndIssue(
+        { ...deps.subscribeDeps, passDesignId },
+        { ...input, templateId, attributes }
+      );
       if (!result.schema) return result;
       const hidden = /* @__PURE__ */ new Set(["agentDid", ...derivedAttributeKeys(templateId, deps.config.network)]);
       return {
@@ -23388,12 +23467,12 @@ function configPathFrom(argv) {
   if (!path || path.startsWith("--")) throw new Error("agentic-wallet-mcp: --config requires a file path");
   return path;
 }
-function loadConfigFileEnv(argv, readFile5) {
+function loadConfigFileEnv(argv, readFile6) {
   const path = configPathFrom(argv);
   if (path === null) return {};
   let raw;
   try {
-    raw = readFile5(path);
+    raw = readFile6(path);
   } catch (e) {
     throw new Error(`agentic-wallet-mcp: cannot read config file ${path}: ${e.message}`);
   }
@@ -23425,9 +23504,9 @@ function loadConfigFileEnv(argv, readFile5) {
 }
 
 // src/hsm-password.ts
-var import_node_crypto2 = require("node:crypto");
+var import_node_crypto3 = require("node:crypto");
 function generateHsmPassword() {
-  return (0, import_node_crypto2.randomBytes)(24).toString("base64url");
+  return (0, import_node_crypto3.randomBytes)(24).toString("base64url");
 }
 
 // src/export-credentials.ts
@@ -23464,8 +23543,8 @@ permanently inaccessible.
 }
 
 // src/clients/account-store.ts
-var import_promises2 = require("node:fs/promises");
-var import_node_path3 = require("node:path");
+var import_promises3 = require("node:fs/promises");
+var import_node_path4 = require("node:path");
 function isStoredAccountShape(value) {
   return typeof value === "object" && value !== null && typeof value.zetrixAddress === "string" && typeof value.holderDid === "string" && typeof value.hsmPassword === "string";
 }
@@ -23473,7 +23552,7 @@ function createFsAccountStore(filePath) {
   return {
     async get() {
       try {
-        const raw = await (0, import_promises2.readFile)(filePath, "utf8");
+        const raw = await (0, import_promises3.readFile)(filePath, "utf8");
         const parsed = JSON.parse(raw);
         return isStoredAccountShape(parsed) ? parsed : null;
       } catch {
@@ -23481,12 +23560,31 @@ function createFsAccountStore(filePath) {
       }
     },
     async set(account) {
-      await (0, import_promises2.mkdir)((0, import_node_path3.dirname)(filePath), { recursive: true, mode: 448 });
-      await (0, import_promises2.writeFile)(filePath, JSON.stringify(account, null, 2), { encoding: "utf8", mode: 384 });
+      await (0, import_promises3.mkdir)((0, import_node_path4.dirname)(filePath), { recursive: true, mode: 448 });
+      await (0, import_promises3.writeFile)(filePath, JSON.stringify(account, null, 2), { encoding: "utf8", mode: 384 });
     }
   };
 }
 
+// src/tool-result.ts
+function extractVcPassImagePaths(result) {
+  if (typeof result !== "object" || result === null) return [];
+  const paths = result.vcPassImagePaths;
+  if (!Array.isArray(paths)) return [];
+  return paths.filter((p) => typeof p === "string");
+}
+async function buildToolContent(result, readFile6) {
+  const blocks = [{ type: "text", text: JSON.stringify(result) }];
+  for (const path of extractVcPassImagePaths(result)) {
+    try {
+      const data = await readFile6(path);
+      blocks.push({ type: "image", data: data.toString("base64"), mimeType: "image/png" });
+    } catch {
+    }
+  }
+  return blocks;
+}
+
 // src/clients/ssivc-client.ts
 var SsivcError = class extends Error {
   httpStatus;
@@ -23589,8 +23687,8 @@ var SsivcClient = class {
 };
 
 // src/clients/ssivc-session-store.ts
-var import_promises3 = require("node:fs/promises");
-var import_node_path4 = require("node:path");
+var import_promises4 = require("node:fs/promises");
+var import_node_path5 = require("node:path");
 function isStoredSessionShape(value) {
   if (typeof value !== "object" || value === null) return false;
   const v = value;
@@ -23600,7 +23698,7 @@ function createFsSsivcSessionStore(filePath) {
   return {
     async get() {
       try {
-        const raw = await (0, import_promises3.readFile)(filePath, "utf8");
+        const raw = await (0, import_promises4.readFile)(filePath, "utf8");
         const parsed = JSON.parse(raw);
         return isStoredSessionShape(parsed) ? parsed : null;
       } catch {
@@ -23608,20 +23706,20 @@ function createFsSsivcSessionStore(filePath) {
       }
     },
     async set(session) {
-      await (0, import_promises3.mkdir)((0, import_node_path4.dirname)(filePath), { recursive: true, mode: 448 });
+      await (0, import_promises4.mkdir)((0, import_node_path5.dirname)(filePath), { recursive: true, mode: 448 });
       const tmpPath = `${filePath}.tmp-${process.pid}-${Date.now()}`;
-      await (0, import_promises3.writeFile)(tmpPath, JSON.stringify(session, null, 2), { encoding: "utf8", mode: 384 });
-      await (0, import_promises3.rename)(tmpPath, filePath);
+      await (0, import_promises4.writeFile)(tmpPath, JSON.stringify(session, null, 2), { encoding: "utf8", mode: 384 });
+      await (0, import_promises4.rename)(tmpPath, filePath);
     }
   };
 }
 
 // src/clients/ssivc-download-quarantine-store.ts
-var import_node_crypto3 = require("node:crypto");
-var import_promises4 = require("node:fs/promises");
-var import_node_path5 = require("node:path");
+var import_node_crypto4 = require("node:crypto");
+var import_promises5 = require("node:fs/promises");
+var import_node_path6 = require("node:path");
 function quarantineFileName(vcId) {
-  return `${(0, import_node_crypto3.createHash)("sha256").update(vcId).digest("hex")}.json`;
+  return `${(0, import_node_crypto4.createHash)("sha256").update(vcId).digest("hex")}.json`;
 }
 function isQuarantinedDownloadShape(value) {
   if (typeof value !== "object" || value === null) return false;
@@ -23629,12 +23727,22 @@ function isQuarantinedDownloadShape(value) {
   return typeof v.vcId === "string" && "entries" in v && typeof v.downloadedAt === "string";
 }
 function createFsDownloadQuarantineStore(baseDir) {
-  const pathFor = (vcId) => (0, import_node_path5.join)(baseDir, quarantineFileName(vcId));
+  const pathFor = (vcId) => (0, import_node_path6.join)(baseDir, quarantineFileName(vcId));
+  const locks = /* @__PURE__ */ new Map();
   return {
     filePathFor: pathFor,
+    withLock(vcId, fn) {
+      const previous = locks.get(vcId) ?? Promise.resolve();
+      const next = previous.then(fn, fn);
+      locks.set(
+        vcId,
+        next.catch(() => void 0)
+      );
+      return next;
+    },
     async get(vcId) {
       try {
-        const raw = await (0, import_promises4.readFile)(pathFor(vcId), "utf8");
+        const raw = await (0, import_promises5.readFile)(pathFor(vcId), "utf8");
         const parsed = JSON.parse(raw);
         return isQuarantinedDownloadShape(parsed) ? parsed : null;
       } catch {
@@ -23642,17 +23750,17 @@ function createFsDownloadQuarantineStore(baseDir) {
       }
     },
     async set(entry) {
-      await (0, import_promises4.mkdir)(baseDir, { recursive: true, mode: 448 });
+      await (0, import_promises5.mkdir)(baseDir, { recursive: true, mode: 448 });
       const filePath = pathFor(entry.vcId);
       const tmpPath = `${filePath}.tmp-${process.pid}-${Date.now()}`;
-      await (0, import_promises4.writeFile)(tmpPath, JSON.stringify(entry, null, 2), { encoding: "utf8", mode: 384 });
-      await (0, import_promises4.rename)(tmpPath, filePath);
+      await (0, import_promises5.writeFile)(tmpPath, JSON.stringify(entry, null, 2), { encoding: "utf8", mode: 384 });
+      await (0, import_promises5.rename)(tmpPath, filePath);
     }
   };
 }
 
 // src/orchestrator/verify-ai-birthcert.ts
-var import_node_crypto4 = require("node:crypto");
+var import_node_crypto5 = require("node:crypto");
 
 // src/canonical-json.ts
 function canonicalizeJson(value) {
@@ -23890,7 +23998,7 @@ async function buildSessionBody(deps, agentName, input) {
   if (input.evidenceAssuranceLevel) fields.evidenceAssuranceLevel = input.evidenceAssuranceLevel;
   if (input.ownerType) fields.ownerType = input.ownerType;
   if (input.ownerVerified) fields.ownerVerified = input.ownerVerified;
-  const digestHex = (0, import_node_crypto4.createHash)("sha256").update(canonicalizeJson(fields), "utf8").digest("hex");
+  const digestHex = (0, import_node_crypto5.createHash)("sha256").update(canonicalizeJson(fields), "utf8").digest("hex");
   const { signBlob: signedData } = await deps.signHexBlob(digestHex);
   return { ...fields, signedData };
 }
@@ -24009,6 +24117,7 @@ async function checkAiBirthcertVerification(deps) {
     return { ...status, verificationUrl: stored.verificationUrl };
   }
   if (status.status !== "issued" || !status.vcId) return status;
+  const vcId = status.vcId;
   if (deps.verifiedTemplateId && deps.cache) {
     const cached2 = await deps.cache.get(deps.verifiedTemplateId);
     if (cached2 && cached2.vcId === status.vcId && isVcValid(cached2)) return { ...status, vc: cached2.vc };
@@ -24016,20 +24125,22 @@ async function checkAiBirthcertVerification(deps) {
   if (!deps.verifiedTemplateId || !deps.cache) {
     return { ...status, cacheError: "AI Birthcert verified-template id is not configured \u2014 cannot fetch or cache the credential yet." };
   }
-  const quarantined = await deps.quarantine.get(status.vcId);
-  const quarantineFilePath = deps.quarantine.filePathFor(status.vcId);
-  let entries;
-  if (quarantined) {
-    entries = quarantined.entries;
-  } else {
+  const quarantineFilePath = deps.quarantine.filePathFor(vcId);
+  const locked = await deps.quarantine.withLock(vcId, async () => {
+    const quarantined = await deps.quarantine.get(vcId);
+    if (quarantined) return { entries: quarantined.entries };
     const auth = await deps.messageSigner(deps.address).then((r) => ({ signedData: r.signBlob, publicKey: r.publicKey }));
+    let downloaded;
     try {
-      entries = await deps.mbi.downloadVcs({ address: deps.address }, auth);
+      downloaded = await deps.mbi.downloadVcs({ address: deps.address }, auth);
     } catch (err) {
-      return { ...status, cacheError: `failed to fetch credential from MBI: ${err instanceof Error ? err.message : String(err)}` };
+      return { error: `failed to fetch credential from MBI: ${err instanceof Error ? err.message : String(err)}` };
     }
-    await deps.quarantine.set({ vcId: status.vcId, entries, downloadedAt: (/* @__PURE__ */ new Date()).toISOString() });
-  }
+    await deps.quarantine.set({ vcId, entries: downloaded, downloadedAt: (/* @__PURE__ */ new Date()).toISOString() });
+    return { entries: downloaded };
+  });
+  if ("error" in locked) return { ...status, cacheError: locked.error };
+  const entries = locked.entries;
   const match = entries.find((e) => typeof e.vc === "object" && e.vc !== null && e.vc.id === status.vcId);
   if (!match) {
     return {
@@ -24056,14 +24167,23 @@ async function checkAiBirthcertVerification(deps) {
       cacheError: `downloaded credential expired at ${validUntil} \u2014 refusing to cache or return; raw response preserved for recovery at ${quarantineFilePath}`
     };
   }
+  const vcPassImagePaths = deps.passImagesDir ? await (async () => {
+    try {
+      const base64Images = extractVcPassBase64(match.extraData);
+      return base64Images ? await writeVcPassImages(deps.passImagesDir, status.vcId, base64Images) : void 0;
+    } catch {
+      return void 0;
+    }
+  })() : void 0;
   await deps.cache.set(deps.verifiedTemplateId, {
     templateId: deps.verifiedTemplateId,
     vc: match.vc,
     vcId: status.vcId,
     issuedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    validUntil
+    validUntil,
+    ...vcPassImagePaths ? { vcPassImagePaths } : {}
   });
-  return { ...status, vc: match.vc };
+  return { ...status, vc: match.vc, ...vcPassImagePaths ? { vcPassImagePaths } : {} };
 }
 
 // src/index.ts
@@ -24253,8 +24373,8 @@ function asPayRequest(accept) {
 }
 async function main() {
   const fileEnv = loadConfigFileEnv(process.argv, (p) => (0, import_node_fs.readFileSync)(p, "utf8"));
-  const stateDir = (process.env.ZETRIX_WALLET_STATE_DIR ?? fileEnv.ZETRIX_WALLET_STATE_DIR ?? (0, import_node_path6.join)((0, import_node_os2.homedir)(), ".agentic-wallet-mcp")).replace(/\/+$/, "");
-  const accountStore = createFsAccountStore((0, import_node_path6.join)(stateDir, "account.json"));
+  const stateDir = (process.env.ZETRIX_WALLET_STATE_DIR ?? fileEnv.ZETRIX_WALLET_STATE_DIR ?? (0, import_node_path7.join)((0, import_node_os2.homedir)(), ".agentic-wallet-mcp")).replace(/\/+$/, "");
+  const accountStore = createFsAccountStore((0, import_node_path7.join)(stateDir, "account.json"));
   if (process.argv[2] === "export-credentials") {
     const { exitCode } = await exportCredentials({
       getAccount: () => accountStore.get(),
@@ -24327,8 +24447,8 @@ async function main() {
   const nodeBaseUrl = `https://${config2.nodeHost}${config2.nodePort ? `:${config2.nodePort}` : ""}`;
   const nodeMetaQuery = (url) => fetch(url, { headers: { Accept: "application/json" } }).then((r) => r.json());
   const resolveTemplateFields = (templateId) => fetchTemplateFields(templateId, config2.templateRegistryAddress, nodeBaseUrl, nodeMetaQuery);
-  const cacheScope = (0, import_node_crypto5.createHash)("sha256").update(`${config2.network}:${zetrixAddress}`).digest("hex");
-  const vcCache = createFsVcCache((0, import_node_path6.join)(config2.stateDir, "vc-cache", cacheScope));
+  const cacheScope = (0, import_node_crypto6.createHash)("sha256").update(`${config2.network}:${zetrixAddress}`).digest("hex");
+  const vcCache = createFsVcCache((0, import_node_path7.join)(config2.stateDir, "vc-cache", cacheScope));
   const mbi = new MbiClient(config2.mbiBaseUrl);
   const messageSigner = (message) => be.signMessage(message, zetrixAddress, hsmPassword);
   const formatAssetAmount = async (asset, raw) => {
@@ -24384,9 +24504,14 @@ async function main() {
     }
   };
   const { pay, payForCredential, preflightCaps } = buildPayers(config2, makePay);
+  const downloadQuarantine = createFsDownloadQuarantineStore((0, import_node_path7.join)(config2.stateDir, "ssivc-download-quarantine"));
+  const passImagesDir = (0, import_node_path7.join)(config2.stateDir, "vc-pass-images");
+  const mbiAuth = async () => {
+    const { signBlob, publicKey } = await messageSigner(zetrixAddress);
+    return { signedData: signBlob, publicKey };
+  };
   const verifyAiBirthcert = config2.ssivcBaseUrl ? (() => {
-    const ssivcSessionStore = createFsSsivcSessionStore((0, import_node_path6.join)(config2.stateDir, "ssivc-session.json"));
-    const downloadQuarantine = createFsDownloadQuarantineStore((0, import_node_path6.join)(config2.stateDir, "ssivc-download-quarantine"));
+    const ssivcSessionStore = createFsSsivcSessionStore((0, import_node_path7.join)(config2.stateDir, "ssivc-session.json"));
     const ssivc = new SsivcClient(config2.ssivcBaseUrl);
     const verifyAiBirthcertDeps = {
       ssivc,
@@ -24404,7 +24529,8 @@ async function main() {
       quarantine: downloadQuarantine,
       gasPreference: config2.gasPreference,
       maxSettlementAttempts: config2.maxSettlementAttempts,
-      formatAssetAmount
+      formatAssetAmount,
+      passImagesDir
     };
     return {
       request: (input) => requestAiBirthcertVerification(verifyAiBirthcertDeps, input),
@@ -24455,7 +24581,19 @@ async function main() {
     config: { holderDid, zetrixAddress, network: config2.network },
     makeWallet,
     payer,
-    subscribeDeps: { mbi, sign: subscribeSign, pay: payForCredential, resolveSymbol, holderDid, resolveTemplateFields, cache: vcCache },
+    subscribeDeps: {
+      mbi,
+      sign: subscribeSign,
+      pay: payForCredential,
+      resolveSymbol,
+      holderDid,
+      resolveTemplateFields,
+      cache: vcCache,
+      auth: mbiAuth,
+      address: zetrixAddress,
+      quarantine: downloadQuarantine,
+      passImagesDir
+    },
     queryContract: (input) => queryContract(input, contractQuery),
     queryTokenBalance: queryTokenBalance2,
     // Read-only, for credential_preflight's cap headroom. Preflight only ever prices credentials,
@@ -24480,7 +24618,7 @@ async function main() {
     if (!fn) throw new Error(`Unknown tool: ${name}`);
     try {
       const result = await fn(args ?? {});
-      return { content: [{ type: "text", text: JSON.stringify(result) }] };
+      return { content: await buildToolContent(result, (p) => (0, import_promises6.readFile)(p)) };
     } catch (err) {
       const chain = [];
       let e = err;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-wallet-mcp",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "description": "Agent-facing MCP wallet for Zetrix — orchestrates x401 identity proof, x402 payment, and MBI VC issuance",
   "keywords": [
     "mcp",