agentwallet-mcp 1.14.6 → 1.14.8

package/README.md

@@ -43,7 +43,7 @@ Use `AGENTWALLET_KEYFILE=/path/to/key` instead if you would rather keep the key
 
 `AGENTWALLET_MAX_TX_NATIVE` is a per-transaction ceiling in native units (ETH, MATIC and so on). In hosted mode the server enforces limits; in local mode there is no server, so these guards are the only ones there are. Set them.
 
-`AGENTWALLET_MAX_TX_TOKEN` is the equivalent ceiling for ERC-20 movement, in human units of the token. **Set this one too if you hold stablecoins.** The native cap cannot see a token transfer: an ERC-20 send carries `value = 0` with the amount in the calldata, so `AGENTWALLET_MAX_TX_NATIVE` alone leaves a USDC balance uncapped. `AGENTWALLET_MAX_TX_TOKEN` covers `transfer`, `transferFrom`, `approve`, `increaseAllowance`, Permit2 `approve`, and `deposit()` / `withdraw(uint256)` on the chain's own wrapped-native contract (so `wrap_eth` and `unwrap_eth` keep working under the cap), the approvals because an unbounded allowance is a drain waiting to happen. Any other calldata sent to a token contract or to Permit2 is refused while the cap is set, because the guard cannot price it; set `AGENTWALLET_ALLOW_UNKNOWN_TOKEN_CALLS=1` to allow such calls deliberately. `increaseAllowance` is judged on the resulting total: the current allowance is read first and the call refuses if it cannot be, so two compliant increments cannot stack a standing allowance above the cap. Calls to other contracts (routers, bridges) pass, since they can only pull what an approval already allowed; a contract counts as "other" only when it demonstrably declines `decimals()`, so an absurd or malformed answer, or an RPC that cannot be reached, refuses rather than allows. Decimals are resolved locally from the trusted registry, then the token's own `decimals()`; a token that resolves neither way is evaluated at 0 decimals, the only value that cannot fail open. For a token outside the registry the RPC is the only source of decimals, and an RPC you do not control could scale the amount and the cap together; pin such tokens with `AGENTWALLET_TOKEN_DECIMALS` (for example `8453:0x<token>=6`) and the pin is used everywhere the RPC's answer would have been.
+`AGENTWALLET_MAX_TX_TOKEN` is the equivalent ceiling for ERC-20 movement, in human units of the token. **Set this one too if you hold stablecoins.** The native cap cannot see a token transfer: an ERC-20 send carries `value = 0` with the amount in the calldata, so `AGENTWALLET_MAX_TX_NATIVE` alone leaves a USDC balance uncapped. `AGENTWALLET_MAX_TX_TOKEN` covers `transfer`, `transferFrom`, `approve`, `increaseAllowance`, Permit2 `approve`, and `deposit()` / `withdraw(uint256)` on the chain's own wrapped-native contract (so `wrap_eth` and `unwrap_eth` keep working under the cap), the approvals because an unbounded allowance is a drain waiting to happen. ERC-721 and ERC-1155 calldata (`setApprovalForAll`, `safeTransferFrom`) is refused while the cap is set, since nothing prices an NFT; without the cap it passes the way an ERC-20 transfer of any size does, except that an operator grant is an unlimited approval and is refused everywhere by default (see `AGENTWALLET_ALLOW_UNLIMITED_APPROVAL`). Any other calldata sent to a token contract or to Permit2 is refused while the cap is set, because the guard cannot price it; set `AGENTWALLET_ALLOW_UNKNOWN_TOKEN_CALLS=1` to allow such calls deliberately. `increaseAllowance` is judged on the resulting total: the current allowance is read first and the call refuses if it cannot be, so two compliant increments cannot stack a standing allowance above the cap. Calls to other contracts (routers, bridges) pass, since they can only pull what an approval already allowed; a contract counts as "other" only when it demonstrably declines `decimals()`, so an absurd or malformed answer, or an RPC that cannot be reached, refuses rather than allows. Decimals are resolved locally from the trusted registry, then the token's own `decimals()`; a token that resolves neither way is evaluated at 0 decimals, the only value that cannot fail open. For a token outside the registry the RPC is the only source of decimals, and an RPC you do not control could scale the amount and the cap together; pin such tokens with `AGENTWALLET_TOKEN_DECIMALS` (for example `8453:0x<token>=6`) and the pin is used everywhere the RPC's answer would have been.
 
 ### Solana local signing
 
@@ -256,7 +256,7 @@ pay_x402(
 
 **Asset risk.** `check_token_risk` (and every `approve_token` result) reports honeypot, tax, owner-power, verified-source, holder-concentration and liquidity flags from GoPlus Security, with an on-chain fallback. A warning for the caller to weigh, never a block.
 
-**Proof.** Real settlements are listed in [PAYMENTS.md](https://github.com/hifriendbot/agentwallet-mcp/blob/main/PAYMENTS.md); the first is a 0.02 USDC `exact` payment on Base with the facilitator paying the gas.
+**Proof.** Real settlements are listed in [PAYMENTS.md](https://github.com/hifriendbot/agentwallet-mcp/blob/main/PAYMENTS.md); the first is a 0.02 USDC `exact` payment on Base with the facilitator paying the gas. The same list, rendered with Basescan links, is at [hifriendbot.com/wallet/payments](https://hifriendbot.com/wallet/payments/), and a five-minute walkthrough from install to a real settlement is at [hifriendbot.com/wallet/quickstart](https://hifriendbot.com/wallet/quickstart/). Security policy, fixed disclosures and the release history: [hifriendbot.com/security](https://hifriendbot.com/security/) and [hifriendbot.com/changelog](https://hifriendbot.com/changelog/).
 
 ## Pay any x402 API from Claude in three steps
 
@@ -340,6 +340,7 @@ Which guards apply depends on who holds the key.
 - `AGENTWALLET_MAX_FEE_NATIVE`: the most one transaction may burn in fees, gas x max fee per gas, in native units (default `0.01`). The value cap alone did not bound fees: a node answering an absurd tip or gas estimate could take the whole balance as priority fee on a cap-compliant transfer. Caller-supplied `gas_limit` / `max_fee` / `priority_fee` are honoured and then bounded by this cap
 - `AGENTWALLET_MAX_TX_TOKEN`: ceiling per ERC-20 transfer or approval, in human units of the token
 - `AGENTWALLET_ALLOW_UNKNOWN_TOKEN_CALLS`: set to `1` to let calldata the token cap cannot price reach a token contract or Permit2 (refused by default while the cap is set)
+- `AGENTWALLET_ALLOW_UNLIMITED_APPROVAL`: set to `1` to let an unlimited ERC-20 allowance (`approve_token` with `"max"`, `approve_permit2` with no amount) or an NFT operator grant (`setApprovalForAll`) through while no spend policy is set; refused by default, and always refused under a policy
 - `AGENTWALLET_TOKEN_DECIMALS`: pin decimals for tokens outside the registry (`8453:0x<token>=6,<mint>=9`); a pin is used for amounts and caps instead of asking the RPC
 - `AGENTWALLET_MAX_TX_SOL`: ceiling per native SOL transfer (also charged for the rent of a recipient token account an SPL send has to create). It does not cover SPL token amounts: `AGENTWALLET_MAX_TX_TOKEN` does, on Solana as on EVM
 - `AGENTWALLET_MAX_AUTOPAY`: ceiling per x402 auto-payment in stablecoin units (default `1`); `AGENTWALLET_AUTOPAY_ASSETS` opts native or non-stable assets in; `AGENTWALLET_X402_MAX_TIMEOUT` bounds how long a signed authorization stays valid (default 3600 seconds)
@@ -374,8 +375,8 @@ A per-transaction cap bounds one signature. It cannot see that the five hundredt
 ```
 
 - **`budget`**: rolling dollar budgets (last 24 hours, last 30 days, lifetime) across every chain, counting x402 payments, stablecoin transfers and stablecoin approvals in registry stablecoins. A spend the budget cannot price (a token outside the registry) is refused while a budget is set, unless `"unpriced_spends": "allow"`. An SPL send is priced at the mint's own decimals; a `token_decimals` hint that disagrees with the mint is refused before any request is made.
-- **`native_budget`**: the same per chain, in the chain's own coin, counting native transfers and the native value sent into any contract (`wrap_eth`, `send_transaction` with value and calldata), including value carried on a token transfer or approval call (a payable token contract keeps it, so it is a second spend, to that contract).
-- **Approvals are spends.** An ERC-20 allowance (`approve_token`, `approve_permit2`, `increaseAllowance`, `approveAndCall`, Permit2 `approve`, or the same calldata through `send_transaction`) is what the spender will take later, so it is priced, checked and reserved on the ledger when it is granted, the spender is checked against the recipient lists, and an unlimited approval (2^128 base units or more) is refused outright, since no budget can count it; grant an exact amount. A zero-value call to any other contract (a router, a bridge) reserves nothing: it can only pull what an approval already granted.
+- **`native_budget`**: the same per chain, in the chain's own coin, counting native transfers and the native value sent into any contract (`wrap_eth`, `send_transaction` with value and calldata), including value carried on a token transfer or approval call (a payable token contract keeps it, so it is a second spend, to that contract) and, in local Solana mode, the rent an SPL send pays to create the recipient's token account (the recipient owns that account and can close it for the lamports; the ledger records it as its own line, method `rent`, to the recipient, and `assets.allow` does not need to list `native` for it).
+- **Approvals are spends.** An ERC-20 allowance (`approve_token`, `approve_permit2`, `increaseAllowance`, `approveAndCall`, Permit2 `approve`, or the same calldata through `send_transaction`) is what the spender will take later, so it is priced, checked and reserved on the ledger when it is granted, the spender is checked against the recipient lists, and an unlimited approval (2^128 base units or more) is refused, since no budget can count it; grant an exact amount. An NFT operator grant (`setApprovalForAll`, ERC-777 `authorizeOperator`) is unbounded by construction and refused the same way, and an ERC-721 or ERC-1155 transfer is a spend of the collection to the recipient that no budget can price, so it is refused under a dollar budget unless `unpriced_spends` is `"allow"`, with the recipient checked either way. A zero-value call to any other contract (a router, a bridge) reserves nothing: it can only pull what an approval already granted.
 - **`hosts`**, **`per_host`**: which endpoints `pay_x402` may pay, and how much per host per day, per month and per payment. A denied host is never contacted, not even for a quote. A host is matched by its canonical DNS name (lowercase, the root label's trailing dot removed), so `api.example.com.` and its percent-encoded spelling are `api.example.com` to every list and to the ledger's per-host sums.
 - **`recipients`**: where funds may go (transfers, x402 `payTo`, approval spenders, contracts that receive native value). The allow list covers those funds destinations; the contract a zero-value call is aimed at (a token being approved, a router) is checked against the deny list and the chain list.
 - **`chains`**, **`assets`**: allow lists; an asset entry can be scoped `"8453:0x..."` or be the word `native`.

package/build/index.js

@@ -13,13 +13,15 @@ import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { z } from 'zod';
 // Validation errors used to echo an unknown key or enum value unbounded, a reflector for a second-stage injection (round 6).
-z.setErrorMap((issue, ctx) => {
-    const cut = (v) => { const t = String(v); return t.length > 80 ? t.slice(0, 80) + '…' : t; };
-    if (issue.code === 'unrecognized_keys')
-        return { message: `Unrecognized key(s) in object: ${issue.keys.map(k => `'${cut(k)}'`).join(', ')}` };
-    if (issue.code === 'invalid_enum_value')
-        return { message: `Invalid enum value. Expected ${issue.options.map(o => `'${o}'`).join(' | ')}, received '${cut(issue.received)}'` };
-    return { message: ctx.defaultError };
+z.config({
+    customError: (issue) => {
+        const cut = (v) => { const t = String(v); return t.length > 80 ? t.slice(0, 80) + '…' : t; };
+        if (issue.code === 'unrecognized_keys')
+            return `Unrecognized key(s) in object: ${issue.keys.map((k) => `'${cut(k)}'`).join(', ')}`;
+        if (issue.code === 'invalid_value')
+            return `Invalid enum value. Expected ${issue.values.map((o) => `'${String(o)}'`).join(' | ')}, received '${cut(issue.input)}'`;
+        return undefined;
+    },
 });
 import { assertPublicUrl, safeFetch, finalUrlOf } from './ssrf-guard.js';
 import { deriveX402Payment, isWithinCap, lookupTrustedDecimals, assertDeclaredDecimals, nativeDecimals, SOLANA_CHAIN_IDS, assetLabel, autopayAssetAllowed, autopayEnvCap, effectiveAutopayCap, maxAuthWindowSeconds, parseDecimalPins, approvalRefusal, authorizationResource, resolveNetworkChainId, normalizeRawAmount, parseAutopayAssets, assetSupportsExact, approvalResourceUrl, } from './x402-payment.js';
@@ -30,7 +32,7 @@ import { WRAPPED_NATIVE } from './wrapped-native.js';
 import { buildUptoAuthorization, uptoPayload, permit2AllowanceCalldata, permit2ApproveCalldata, decodeUint, permit2Address, } from './x402-permit2.js';
 import { assessTokenRisk } from './token-risk.js';
 import { isLegacyAgentWalletAccept, requiredAmount, buildAuthorization, buildPaymentPayload, buildPaymentPayloadRaw, paymentHeaderFor, parsePaymentRequired, parseSettlement, pickOption, knownTokenDomain, decodeAbiString as decodeDomainString, parseEip7702Delegation, erc1271ProbeCalldata, classifyErc1271Probe, settlementVerdict, legacyReceiptAllowed, sanitizeRequired, } from './x402-eip3009.js';
-import { isSolanaLocalMode, getSolanaAddress, solanaWalletRecord, localSolBalance, localSplBalance, localSolTransfer, localSplTransfer, resolveSolanaRpc, mintDecimalsStrict, } from './local-solana.js';
+import { isSolanaLocalMode, getSolanaAddress, solanaWalletRecord, localSolBalance, localSplBalance, localSolTransfer, localSplTransfer, resolveSolanaRpc, mintDecimalsStrict, splAccountRent, } from './local-solana.js';
 import { localSimulate } from './local-wallet.js';
 import { loadPolicy, describePolicy, hostAllowed, recipientAllowed, targetAllowed, chainAllowed, assetAllowed, perHostRule, toolAllowed, hostOf, budgetReport, units as policyUnits, human as policyHuman, rawToUnits, } from './policy.js';
 import { Ledger } from './ledger.js';
@@ -92,7 +94,10 @@ function reserveSpend(input) {
     const chain = chainAllowed(p, input.chainId);
     if (!chain.ok)
         throw new Error(chain.reason + ' Nothing was signed.');
-    const asset = assetAllowed(p, input.chainId, input.asset);
+    // Rent is SOL by nature, not by choice: the operator allowed the token, and
+    // the account that holds it is paid for in the chain's coin, so assets.allow
+    // does not have to list native for the rent line. native_budget counts it.
+    const asset = input.method === 'rent' ? { ok: true } : assetAllowed(p, input.chainId, input.asset);
     if (!asset.ok)
         throw new Error(asset.reason + ' Nothing was signed.');
     const to = recipientAllowed(p, input.to);
@@ -105,7 +110,7 @@ function reserveSpend(input) {
 /** The same checks with nothing recorded, for quotes and simulations. */
 function spendVerdict(input) {
     const p = POL();
-    for (const r of [chainAllowed(p, input.chainId), assetAllowed(p, input.chainId, input.asset), recipientAllowed(p, input.to)])
+    for (const r of [chainAllowed(p, input.chainId), input.method === 'rent' ? { ok: true } : assetAllowed(p, input.chainId, input.asset), recipientAllowed(p, input.to)])
         if (!r.ok)
             return r;
     const limits = limitsFor(input.host);
@@ -129,8 +134,43 @@ const SPEND_LAYOUTS = {
     '39509351': { kind: 'approval', what: 'increaseAllowance', toIndex: 0, amountIndex: 1 }, // increaseAllowance(address,uint256)
     cae9ca51: { kind: 'approval', what: 'approveAndCall', toIndex: 0, amountIndex: 1 }, // approveAndCall(address,uint256,bytes)
     '87517c45': { kind: 'approval', what: 'Permit2 approve', toIndex: 1, amountIndex: 2, tokenIndex: 0, permit2Only: true }, // Permit2.approve(address,address,uint160,uint48)
+    // ERC-721 / ERC-1155 movers and operator grants (reported privately
+    // 2026-10-26, 1.14.8): none of these was decoded, so an NFT approval or
+    // transfer fell through to 'contract' with value 0 and reached the signer
+    // under a policy with no budget line, no ledger line and no recipient check.
+    // An operator grant is an unbounded approval by construction (`operator`;
+    // amountIndex -1 means there is no amount word, otherwise the bool at that
+    // word says grant or revoke). A transfer moves a token no budget can price
+    // (`nft`; amountIndex -1 means one token), so under a dollar budget it is an
+    // unpriced spend, refused unless unpriced_spends allows it, and its
+    // recipient is checked either way.
+    a22cb465: { kind: 'approval', what: 'setApprovalForAll', toIndex: 0, amountIndex: 1, nft: true, operator: true }, // setApprovalForAll(address,bool)
+    '959b8c3f': { kind: 'approval', what: 'ERC-777 authorizeOperator', toIndex: 0, amountIndex: -1, operator: true }, // authorizeOperator(address)
+    '42842e0e': { kind: 'token', what: 'ERC-721 safeTransferFrom', toIndex: 1, amountIndex: -1, nft: true }, // safeTransferFrom(address,address,uint256)
+    b88d4fde: { kind: 'token', what: 'ERC-721 safeTransferFrom', toIndex: 1, amountIndex: -1, nft: true }, // safeTransferFrom(address,address,uint256,bytes)
+    f242432a: { kind: 'token', what: 'ERC-1155 safeTransferFrom', toIndex: 1, amountIndex: 3, nft: true }, // safeTransferFrom(address,address,uint256,uint256,bytes)
+    '2eb2c2d6': { kind: 'token', what: 'ERC-1155 safeBatchTransferFrom', toIndex: 1, amountIndex: 3, nft: true, batch: true }, // safeBatchTransferFrom(address,address,uint256[],uint256[],bytes)
 };
 const UNBOUNDED_APPROVAL = 1n << 128n;
+const UINT256_MAX = (1n << 256n) - 1n;
+/**
+ * The sum of the `amounts` array of an ERC-1155 safeBatchTransferFrom, read
+ * through the caller's word reader so a short word refuses the whole call.
+ * `offsetWord` holds the array's byte offset from the start of the arguments.
+ */
+function batchTotal(wordAt, offsetWord) {
+    const offset = BigInt('0x' + wordAt(offsetWord));
+    if (offset % 32n !== 0n || offset > 1n << 20n)
+        throw new Error('policy: calldata for ERC-1155 safeBatchTransferFrom has a malformed amounts offset; refused rather than treated as a plain contract call. Nothing was signed.');
+    const base = Number(offset / 32n);
+    const count = BigInt('0x' + wordAt(base));
+    if (count > 4096n)
+        throw new Error('policy: calldata for ERC-1155 safeBatchTransferFrom names more than 4096 amounts; refused. Nothing was signed.');
+    let total = 0n;
+    for (let i = 0; i < Number(count); i++)
+        total += BigInt('0x' + wordAt(base + 1 + i));
+    return total;
+}
 async function describeSend(body, chainId) {
     if (body.token_mint) {
         const mint = String(body.token_mint);
@@ -141,7 +181,19 @@ async function describeSend(body, chainId) {
         // reached the custodian (reported privately 2026-10-24, 1.14.5). The chain
         // would have refused the TransferChecked, but the ledger was already wrong.
         const given = Number.isInteger(d) && d >= 0 && d <= 36 ? d : undefined;
-        return { kind: 'spl', to: String(body.to || ''), asset: mint, raw: String(body.value ?? '0'), decimals: await verifiedDecimals(chainId, mint, given) };
+        const to = String(body.to || '');
+        const decimals = await verifiedDecimals(chainId, mint, given);
+        // In local mode this process is the payer: when the recipient has no token
+        // account yet, the send creates one and the rent is native value leaving
+        // the wallet, reserved here from the same reading the signer will make.
+        // The hosted custodian pays its own rent and bounds it on its side.
+        let carried;
+        if (isSolanaLocalMode() && to) {
+            const rent = await splAccountRent(mint, to, chainId);
+            if (rent > 0n)
+                carried = { raw: rent.toString(), to, rent: true };
+        }
+        return { kind: 'spl', to, asset: mint, raw: String(body.value ?? '0'), decimals, ...(carried ? { carried } : {}) };
     }
     const data = String(body.data || '');
     const to = String(body.to || '');
@@ -160,14 +212,27 @@ async function describeSend(body, chainId) {
             };
             const token = layout.tokenIndex === undefined ? to : '0x' + wordAt(layout.tokenIndex).slice(24);
             const counterparty = '0x' + wordAt(layout.toIndex).slice(24);
-            const amount = BigInt('0x' + wordAt(layout.amountIndex));
             // The call's own value does not vanish because the calldata was
             // recognised: the contract keeps whatever rides along. It is a second
             // spend, native, to the contract (reported privately 2026-10-23, 1.14.4).
             const carried = BigInt(value) > 0n ? { raw: value, to } : undefined;
+            if (layout.operator) {
+                // setApprovalForAll(operator, false) takes a grant away and moves
+                // nothing: a zero-value call to the collection, reserving nothing.
+                const granted = layout.amountIndex < 0 || BigInt('0x' + wordAt(layout.amountIndex)) !== 0n;
+                if (!granted)
+                    return { kind: 'contract', to, asset: '', raw: value, decimals: nativeDecimals(chainId) };
+                return { kind: 'approval', to: counterparty, asset: token, raw: UINT256_MAX.toString(), decimals: 0, unbounded: true, ...(carried ? { carried } : {}) };
+            }
+            const amount = layout.amountIndex < 0 ? 1n : layout.batch ? batchTotal(wordAt, layout.amountIndex) : BigInt('0x' + wordAt(layout.amountIndex));
             if (layout.kind === 'approval' && amount >= UNBOUNDED_APPROVAL) {
                 return { kind: 'approval', to: counterparty, asset: token, raw: amount.toString(), decimals: 0, unbounded: true, ...(carried ? { carried } : {}) };
             }
+            if (layout.nft) {
+                // A collection has no decimals and no price: whole tokens, unpriced,
+                // to the recipient, recorded under the collection's address.
+                return { kind: layout.kind, to: counterparty, asset: token, raw: amount.toString(), decimals: 0, ...(carried ? { carried } : {}) };
+            }
             // Decimals matter here only to price a registry stablecoin (resolved
             // offline) and to print the ledger amount. A token the registry and the
             // node cannot place is unpriced whatever its decimals, so a failed lookup
@@ -221,12 +286,27 @@ function assertSendTarget(d, chainId) {
  * recipients.allow and .deny bind who may be allowed to pull; the native
  * value of a contract call is a spend to that contract; the native value
  * carried on a token or approval call is a second spend, native, to the
- * called contract (1.14.4). Throws for an unbounded approval under a policy.
+ * called contract (1.14.4); the rent a local SPL send pays for the recipient's
+ * token account is a native spend to the recipient, method 'rent' (1.14.7).
+ * Throws for an unbounded approval: under a policy always, and otherwise
+ * unless the operator allowed it.
  */
+const unlimitedApprovalsAllowed = () => !POLICY.path && process.env.AGENTWALLET_ALLOW_UNLIMITED_APPROVAL === '1';
+const unlimitedApprovalsReport = () => POLICY.path
+    ? 'refused (a spend policy is set; no budget can count an unlimited allowance)'
+    : unlimitedApprovalsAllowed() ? 'allowed by the operator (AGENTWALLET_ALLOW_UNLIMITED_APPROVAL=1)' : 'refused by default (the operator can set AGENTWALLET_ALLOW_UNLIMITED_APPROVAL=1 while no policy is set)';
 function spendInputsOf(d, chainId, tool, wallet, ctx = {}) {
-    if (d.kind === 'approval' && d.unbounded && POLICY.path) {
-        throw new Error(`policy: an unlimited approval of ${assetLabel(chainId, d.asset)} to ${d.to} cannot be counted against any budget, and under a spend policy every approval is a bounded spend. ` +
-            `Approve an exact amount instead. Nothing was signed.`);
+    if (d.kind === 'approval' && d.unbounded) {
+        // The README promised an unlimited approval was "refused outright" while
+        // the code refused it only under a policy (reported privately 2026-10-26,
+        // 1.14.8). Now the default everywhere; only the operator opens it, and
+        // only where no policy is set.
+        if (POLICY.path)
+            throw new Error(`policy: an unlimited approval of ${assetLabel(chainId, d.asset)} to ${d.to} cannot be counted against any budget, and under a spend policy every approval is a bounded spend. ` +
+                `Approve an exact amount instead. Nothing was signed.`);
+        if (!unlimitedApprovalsAllowed())
+            throw new Error(`an unlimited approval of ${assetLabel(chainId, d.asset)} to ${d.to} is refused by default: it is a standing grant over the whole balance. ` +
+                `Approve an exact amount instead. Only the operator can allow unlimited approvals (AGENTWALLET_ALLOW_UNLIMITED_APPROVAL=1, never under a spend policy). Nothing was signed.`);
     }
     const base = { tool, mode: anyLocalMode() ? 'local' : 'hosted', wallet: anyLocalMode() ? 'local' : wallet, chainId, host: ctx.host ?? null, resource: ctx.resource ?? null };
     const out = [];
@@ -238,7 +318,7 @@ function spendInputsOf(d, chainId, tool, wallet, ctx = {}) {
         });
     }
     if (d.carried) {
-        out.push({ ...base, asset: '', assetLabel: assetLabel(chainId, ''), raw: d.carried.raw, decimals: nativeDecimals(chainId), usd: null, to: d.carried.to, method: 'native' });
+        out.push({ ...base, asset: '', assetLabel: assetLabel(chainId, ''), raw: d.carried.raw, decimals: nativeDecimals(chainId), usd: null, to: d.carried.to, method: d.carried.rent ? 'rent' : 'native' });
     }
     return out;
 }
@@ -1049,7 +1129,7 @@ function validateGuardEnv() {
         throw new Error(`Unknown environment variable ${k}. AgentWallet refuses to start on an unrecognised AGENTWALLET_* name so that a misspelled cap cannot run uncapped. Known names: ${[...KNOWN_ENV].join(', ')}, AGENTWALLET_RPC_<chainId>, AGENTWALLET_SOLANA_RPC_<chainId>.`);
     }
 }
-const KNOWN_ENV = new Set(["AGENTWALLET_ALLOW_UNKNOWN_TOKEN_CALLS", "AGENTWALLET_API_URL", "AGENTWALLET_APPROVALS", "AGENTWALLET_AUTOPAY_ASSETS", "AGENTWALLET_CHAIN_ID", "AGENTWALLET_DASHBOARD_URL", "AGENTWALLET_KEYFILE", "AGENTWALLET_KEYFILE_PASSPHRASE", "AGENTWALLET_KEYFILE_PASSPHRASE_FILE", "AGENTWALLET_LEDGER", "AGENTWALLET_LEGACY_PAYWALL_ORIGINS", "AGENTWALLET_MAX_AUTOPAY", "AGENTWALLET_MAX_AUTOPAY_PER_HOUR", "AGENTWALLET_MAX_FEE_NATIVE", "AGENTWALLET_MAX_TX_NATIVE", "AGENTWALLET_MAX_TX_SOL", "AGENTWALLET_MAX_TX_TOKEN", "AGENTWALLET_PASS", "AGENTWALLET_PERMIT2_AUTO_APPROVE", "AGENTWALLET_POLICY", "AGENTWALLET_PRIVATE_KEY", "AGENTWALLET_RPC_URL", "AGENTWALLET_SOLANA_KEY", "AGENTWALLET_SOLANA_KEYFILE", "AGENTWALLET_SOLANA_RPC", "AGENTWALLET_TOKEN_DECIMALS", "AGENTWALLET_TOKEN_RISK", "AGENTWALLET_USER", "AGENTWALLET_WALLET_ID", "AGENTWALLET_WEBHOOK_SECRET", "AGENTWALLET_WEBHOOK_URL", "AGENTWALLET_X402_MAX_TIMEOUT"]);
+const KNOWN_ENV = new Set(["AGENTWALLET_ALLOW_UNKNOWN_TOKEN_CALLS", "AGENTWALLET_ALLOW_UNLIMITED_APPROVAL", "AGENTWALLET_API_URL", "AGENTWALLET_APPROVALS", "AGENTWALLET_AUTOPAY_ASSETS", "AGENTWALLET_CHAIN_ID", "AGENTWALLET_DASHBOARD_URL", "AGENTWALLET_KEYFILE", "AGENTWALLET_KEYFILE_PASSPHRASE", "AGENTWALLET_KEYFILE_PASSPHRASE_FILE", "AGENTWALLET_LEDGER", "AGENTWALLET_LEGACY_PAYWALL_ORIGINS", "AGENTWALLET_MAX_AUTOPAY", "AGENTWALLET_MAX_AUTOPAY_PER_HOUR", "AGENTWALLET_MAX_FEE_NATIVE", "AGENTWALLET_MAX_TX_NATIVE", "AGENTWALLET_MAX_TX_SOL", "AGENTWALLET_MAX_TX_TOKEN", "AGENTWALLET_PASS", "AGENTWALLET_PERMIT2_AUTO_APPROVE", "AGENTWALLET_POLICY", "AGENTWALLET_PRIVATE_KEY", "AGENTWALLET_RPC_URL", "AGENTWALLET_SOLANA_KEY", "AGENTWALLET_SOLANA_KEYFILE", "AGENTWALLET_SOLANA_RPC", "AGENTWALLET_TOKEN_DECIMALS", "AGENTWALLET_TOKEN_RISK", "AGENTWALLET_USER", "AGENTWALLET_WALLET_ID", "AGENTWALLET_WEBHOOK_SECRET", "AGENTWALLET_WEBHOOK_URL", "AGENTWALLET_X402_MAX_TIMEOUT"]);
 /**
  * Register a tool whose arguments are strict: an unknown key (max_payemnt for
  * max_payment) is an error that names it, not a silently dropped guard. The
@@ -1175,7 +1255,7 @@ function resolveChainId(network) {
 const AddressSchema = z.string().regex(/^(0x[a-fA-F0-9]{40}|[1-9A-HJ-NP-Za-km-z]{32,44})$/, 'Must be a 0x-prefixed 40-hex EVM address or a base58 Solana address');
 const server = new McpServer({
     name: 'agentwallet',
-    version: '1.14.6',
+    version: '1.14.8',
 }, {
     instructions: `AgentWallet gives AI agents their own blockchain wallets. ${anyLocalMode()
         ? 'This server runs in LOCAL (self-custody) mode: the operator supplied the key, signing happens in this process, and the only spend guards are the environment caps (AGENTWALLET_MAX_TX_NATIVE / _TOKEN / _SOL per transaction, AGENTWALLET_MAX_AUTOPAY and AGENTWALLET_AUTOPAY_ASSETS for x402, AGENTWALLET_X402_MAX_TIMEOUT for authorization windows). There is no server-side pause, daily limit or approval email; pause_wallet, unpause_wallet and delete_wallet are refused.'
@@ -1520,12 +1600,12 @@ tool('call_contract', 'Execute a read-only call against a smart contract (eth_ca
 // ─── Tool: approve_token ────────────────────────────────────────
 tool('approve_token', 'Approve a spender contract to transfer ERC-20 tokens on your behalf. ' +
     'Required before interacting with any DeFi protocol (DEXs, lending, etc.). ' +
-    'Use amount "max" for unlimited approval, or specify an exact amount. ' +
-    'Under a spend policy an approval is a spend: it counts against the budgets, the spender is checked as a recipient, and "max" is refused.', {
+    'Specify an exact amount. "max" (an unlimited allowance) is refused by default and always under a spend policy; only the operator can allow it, with AGENTWALLET_ALLOW_UNLIMITED_APPROVAL=1 while no policy is set. ' +
+    'Under a spend policy an approval is a spend: it counts against the budgets and the spender is checked as a recipient.', {
     wallet_id: z.number().int().describe('Wallet ID'),
     token: z.string().regex(/^0x[a-fA-F0-9]{40}$/).describe('ERC-20 token contract address'),
     spender: z.string().regex(/^0x[a-fA-F0-9]{40}$/).describe('Contract address to approve as spender'),
-    amount: z.string().describe('Amount to approve in human-readable format (e.g. "1000"), or "max" for unlimited'),
+    amount: z.string().describe('Amount to approve in human-readable format (e.g. "1000"); "max" means unlimited and is refused unless the operator allowed it'),
     chain_id: z.number().int().describe('Chain ID'),
     decimals: z.number().int().min(0).max(36).optional().describe('Token decimals. Resolved from the registry or the token contract when omitted; if given, it must match'),
 }, async ({ wallet_id, token, spender, amount, chain_id, decimals: givenDecimals }) => {
@@ -2425,8 +2505,8 @@ tool('check_approval', 'Status of a payment approval created when pay_x402 excee
     'Returns pending, approved, denied or expired. Once approved, call pay_x402 again with approval_id.', { approval_id: z.string().describe('Approval id returned by pay_x402') }, async ({ approval_id }) => jsonResponse(await api(`/approvals/${encodeURIComponent(approval_id)}`, 'GET', undefined, { 'X-AGW-SKIP-X402': 'true' })));
 // ─── Tool: approve_permit2 ──────────────────────────────────────
 tool('approve_permit2', 'One-time ERC-20 approval of a token to the Permit2 contract, needed before paying x402 "upto" endpoints with that token. ' +
-    'A normal on-chain transaction (needs gas). By default approves the maximum, the ecosystem norm, so it never has to be repeated; ' +
-    'pass amount to grant a bounded allowance instead (required under AGENTWALLET_MAX_TX_TOKEN and under a spend policy, both of which refuse a max approval; under a policy the allowance counts against the budgets). ' +
+    'A normal on-chain transaction (needs gas). Pass amount to grant a bounded allowance; with no amount it asks for the maximum, which is refused by default, under AGENTWALLET_MAX_TX_TOKEN, and always under a spend policy (where the allowance counts against the budgets). ' +
+    'Only the operator can allow a maximum approval, with AGENTWALLET_ALLOW_UNLIMITED_APPROVAL=1 while no policy is set. ' +
     'Permit2 itself only moves what each signed authorization allows.', {
     wallet_id: z.number().int().describe('Wallet ID'),
     token: z.string().regex(/^0x[a-fA-F0-9]{40}$/).describe('ERC-20 token address (e.g. USDC on Base)'),
@@ -2890,6 +2970,7 @@ tool('wallet_mode', 'Report whether this server is signing locally (self-custody
             api_base: redactUrl(API_BASE),
             spend_policy: POLICY.path ? { path: POLICY.path, sha256: POLICY.hash, name: POLICY.policy.name ?? null, ledger: POLICY.ledgerPath, see: 'spend_policy' } : 'none (AGENTWALLET_POLICY not set)',
             client_guards: {
+                unlimited_approvals: unlimitedApprovalsReport(),
                 autopay_cap_usd: autopayEnvCap(),
                 internal_autopay_armed: Boolean(X402_WALLET_ID),
                 max_autopay_per_hour: AUTOPAY_PER_HOUR,
@@ -2916,6 +2997,7 @@ tool('wallet_mode', 'Report whether this server is signing locally (self-custody
         x402_max_timeout_seconds: maxAuthWindowSeconds(),
         per_tx_cap_token: (process.env.AGENTWALLET_MAX_TX_TOKEN || '').trim() || 'not set (ERC-20 and SPL transfers are uncapped)',
         allow_unknown_token_calls: process.env.AGENTWALLET_ALLOW_UNKNOWN_TOKEN_CALLS === '1',
+        unlimited_approvals: unlimitedApprovalsReport(),
         token_decimals_pins: parseDecimalPins(process.env.AGENTWALLET_TOKEN_DECIMALS).size,
         token_risk_lookup: process.env.AGENTWALLET_TOKEN_RISK !== '0',
         permit2_auto_approve: process.env.AGENTWALLET_PERMIT2_AUTO_APPROVE === '1',

package/build/ledger.d.ts

@@ -1,6 +1,9 @@
 import { type Spent } from './policy.js';
-/** 'approval' is an ERC-20 allowance granted (approve, increaseAllowance, Permit2.approve): a spend the spender executes later, counted when granted. */
-export type SpendMethod = 'eip3009' | 'permit2' | 'transfer' | 'native' | 'spl' | 'autopay' | 'approval';
+/**
+ * 'approval' is an ERC-20 allowance granted (approve, increaseAllowance, Permit2.approve): a spend the spender executes later, counted when granted.
+ * 'rent' is the SOL an SPL send pays to create the recipient's token account (1.14.7): native, to the recipient, who owns the account and can close it for the lamports.
+ */
+export type SpendMethod = 'eip3009' | 'permit2' | 'transfer' | 'native' | 'spl' | 'autopay' | 'approval' | 'rent';
 export interface SpendEntry {
     seq: number;
     ts: string;

package/build/local-solana.d.ts

@@ -76,6 +76,16 @@ export declare function localSolTransfer(to: string, lamports: string, chainId?:
  * not exist, using the idempotent instruction so a race cannot fail the send.
  */
 export declare function localSplTransfer(mintStr: string, to: string, rawAmount: string, decimals: number, chainId?: number): Promise<LocalSolResult>;
+/**
+ * The SOL an SPL send to `to` spends on creating the recipient's token
+ * account, in lamports; 0n when the account exists. The recipient owns that
+ * account and can close it to keep the lamports, so it is native value leaving
+ * the wallet and the spend policy reserves it against native_budget before the
+ * send is built (reported privately 2026-10-26: it was checked against the
+ * per-transaction SOL cap only, and fresh recipients took SOL past the daily
+ * budget while the ledger held token lines alone).
+ */
+export declare function splAccountRent(mintStr: string, to: string, chainId?: number): Promise<bigint>;
 export declare function solanaWalletRecord(): {
     id: string;
     address: string;

package/build/local-solana.js

@@ -448,31 +448,15 @@ export async function localSplTransfer(mintStr, to, rawAmount, decimals, chainId
     const mint = new PublicKey(mintStr);
     const recipient = new PublicKey(to);
     await assertRecipientIsWallet(conn, recipient);
-    const { tokenProgram, ataSize } = await mintLayout(conn, mint);
+    const { tokenProgram, destAta, rent } = await destinationAccount(conn, mint, recipient);
     const sourceAta = associatedTokenAddress(payer.publicKey, mint, tokenProgram);
-    const destAta = associatedTokenAddress(recipient, mint, tokenProgram);
     const tx = new Transaction();
-    const destInfo = await conn.getAccountInfo(destAta);
-    // The associated-account program creates into an address that already holds
-    // plain SOL (system-owned, no data): it tops up the rent, allocates and
-    // assigns. Only an address holding something else cannot become the token
-    // account (2026-10-04 round 2; the 1.13.5 refusal of any occupant let anyone
-    // block a recipient for the price of the rent-exempt minimum).
-    const prefunded = destInfo !== null && destInfo.owner.equals(SystemProgram.programId) && destInfo.data.length === 0;
-    if (destInfo && !destInfo.owner.equals(tokenProgram) && !prefunded) {
-        throw new Error(`Refusing to send: the recipient's token account address ${destAta.toBase58()} is occupied by an account owned by ${destInfo.owner.toBase58()}, so no token account can be created there.`);
-    }
-    if (!destInfo || prefunded) {
+    if (rent > 0n) {
         // Creating the recipient's token account costs the payer rent in SOL, an
         // outflow the SOL cap must see (0.002 SOL a time adds up over many sends).
-        // Rent follows the account's real size, which for Token-2022 is above 165;
-        // SOL already sitting at the address reduces what the payer tops up.
-        // The node's rent figure is floored at the cluster constant and the SOL the
-        // node says already sits at the address is not credited: both are numbers a
-        // lying RPC used to zero so the create went out under the cap (round 4).
-        const claimed = Number(await conn.getMinimumBalanceForRentExemption(ataSize));
-        const rent = Math.max(Number.isFinite(claimed) ? Math.trunc(claimed) : 0, (128 + ataSize) * 6960);
-        assertWithinSolCap(BigInt(rent));
+        // The policy reserved the same figure against native_budget before this
+        // call (1.14.7); the cap is the per-transaction floor under it.
+        assertWithinSolCap(rent);
         tx.add(createAtaIdempotentIx(payer.publicKey, destAta, recipient, mint, tokenProgram));
     }
     tx.add(transferCheckedIx(tokenProgram, sourceAta, mint, destAta, payer.publicKey, BigInt(rawAmount), decimals));
@@ -487,6 +471,52 @@ export async function localSplTransfer(mintStr, to, rawAmount, decimals, chainId
         signed_locally: true,
     };
 }
+/**
+ * The recipient's associated account for a mint, and the rent the payer funds
+ * when it has to be created: 0 when it already exists. One reading shared by
+ * the send and by the policy's reservation, so the ledger line and the
+ * instruction carry the same figure.
+ *
+ * The associated-account program creates into an address that already holds
+ * plain SOL (system-owned, no data): it tops up the rent, allocates and
+ * assigns. Only an address holding something else cannot become the token
+ * account (2026-10-04 round 2; the 1.13.5 refusal of any occupant let anyone
+ * block a recipient for the price of the rent-exempt minimum).
+ *
+ * Rent follows the account's real size, which for Token-2022 is above 165;
+ * SOL already sitting at the address reduces what the payer tops up. The
+ * node's rent figure is floored at the cluster constant and the SOL the node
+ * says already sits at the address is not credited: both are numbers a lying
+ * RPC used to zero so the create went out under the cap (round 4).
+ */
+async function destinationAccount(conn, mint, recipient) {
+    const { tokenProgram, ataSize } = await mintLayout(conn, mint);
+    const destAta = associatedTokenAddress(recipient, mint, tokenProgram);
+    const destInfo = await conn.getAccountInfo(destAta);
+    const prefunded = destInfo !== null && destInfo.owner.equals(SystemProgram.programId) && destInfo.data.length === 0;
+    if (destInfo && !destInfo.owner.equals(tokenProgram) && !prefunded) {
+        throw new Error(`Refusing to send: the recipient's token account address ${destAta.toBase58()} is occupied by an account owned by ${destInfo.owner.toBase58()}, so no token account can be created there.`);
+    }
+    if (destInfo && !prefunded)
+        return { tokenProgram, destAta, rent: 0n };
+    const claimed = Number(await conn.getMinimumBalanceForRentExemption(ataSize));
+    const rent = Math.max(Number.isFinite(claimed) ? Math.trunc(claimed) : 0, (128 + ataSize) * 6960);
+    return { tokenProgram, destAta, rent: BigInt(rent) };
+}
+/**
+ * The SOL an SPL send to `to` spends on creating the recipient's token
+ * account, in lamports; 0n when the account exists. The recipient owns that
+ * account and can close it to keep the lamports, so it is native value leaving
+ * the wallet and the spend policy reserves it against native_budget before the
+ * send is built (reported privately 2026-10-26: it was checked against the
+ * per-transaction SOL cap only, and fresh recipients took SOL past the daily
+ * budget while the ledger held token lines alone).
+ */
+export async function splAccountRent(mintStr, to, chainId = 900) {
+    const conn = connection(chainId);
+    await assertCluster(conn, chainId);
+    return (await destinationAccount(conn, new PublicKey(mintStr), new PublicKey(to))).rent;
+}
 const TOKEN_ACCOUNT_SIZE = 165;
 const MINT_SIZE = 82;
 /** Token-2022 pads a mint to the token-account size and tags the next byte: 1 = mint, 2 = token account. */

package/build/policy.d.ts

@@ -2,197 +2,50 @@ import { z } from 'zod';
 export declare const PolicySchema: z.ZodObject<{
     version: z.ZodLiteral<1>;
     name: z.ZodOptional<z.ZodString>;
-    /** Rolling budgets in stablecoin (dollar) units across every chain: x402 payments and stablecoin transfers. */
     budget: z.ZodOptional<z.ZodObject<{
         daily: z.ZodOptional<z.ZodString>;
         monthly: z.ZodOptional<z.ZodString>;
         total: z.ZodOptional<z.ZodString>;
-    }, "strict", z.ZodTypeAny, {
-        total?: string | undefined;
-        daily?: string | undefined;
-        monthly?: string | undefined;
-    }, {
-        total?: string | undefined;
-        daily?: string | undefined;
-        monthly?: string | undefined;
-    }>>;
-    /** Rolling budgets for the chain's own coin, keyed by chain id, in that coin's units. */
+    }, z.core.$strict>>;
     native_budget: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
         daily: z.ZodOptional<z.ZodString>;
         monthly: z.ZodOptional<z.ZodString>;
         total: z.ZodOptional<z.ZodString>;
-    }, "strict", z.ZodTypeAny, {
-        total?: string | undefined;
-        daily?: string | undefined;
-        monthly?: string | undefined;
-    }, {
-        total?: string | undefined;
-        daily?: string | undefined;
-        monthly?: string | undefined;
-    }>>>;
-    /** What to do with a spend the budget cannot price (a token outside the registry). Default refuse when a budget is set. */
-    unpriced_spends: z.ZodOptional<z.ZodEnum<["refuse", "allow"]>>;
-    hosts: z.ZodOptional<z.ZodObject<{
-        allow: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-        deny: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    }, "strict", z.ZodTypeAny, {
-        allow?: string[] | undefined;
-        deny?: string[] | undefined;
-    }, {
-        allow?: string[] | undefined;
-        deny?: string[] | undefined;
+    }, z.core.$strict>>>;
+    unpriced_spends: z.ZodOptional<z.ZodEnum<{
+        allow: "allow";
+        refuse: "refuse";
     }>>;
-    /** Per-host ceilings for x402 payments, dollar units. */
+    hosts: z.ZodOptional<z.ZodObject<{
+        allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        deny: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
     per_host: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
         daily: z.ZodOptional<z.ZodString>;
         monthly: z.ZodOptional<z.ZodString>;
         per_payment: z.ZodOptional<z.ZodString>;
-    }, "strict", z.ZodTypeAny, {
-        daily?: string | undefined;
-        monthly?: string | undefined;
-        per_payment?: string | undefined;
-    }, {
-        daily?: string | undefined;
-        monthly?: string | undefined;
-        per_payment?: string | undefined;
-    }>>>;
+    }, z.core.$strict>>>;
     recipients: z.ZodOptional<z.ZodObject<{
-        allow: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-        deny: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    }, "strict", z.ZodTypeAny, {
-        allow?: string[] | undefined;
-        deny?: string[] | undefined;
-    }, {
-        allow?: string[] | undefined;
-        deny?: string[] | undefined;
-    }>>;
+        allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        deny: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
     chains: z.ZodOptional<z.ZodObject<{
-        allow: z.ZodOptional<z.ZodArray<z.ZodNumber, "many">>;
-    }, "strict", z.ZodTypeAny, {
-        allow?: number[] | undefined;
-    }, {
-        allow?: number[] | undefined;
-    }>>;
+        allow: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
+    }, z.core.$strict>>;
     assets: z.ZodOptional<z.ZodObject<{
-        allow: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    }, "strict", z.ZodTypeAny, {
-        allow?: string[] | undefined;
-    }, {
-        allow?: string[] | undefined;
-    }>>;
-    /** Ask the human (MCP elicitation) above `above`; in local mode an accepted ask may admit up to `max`, above the per-payment cap. */
+        allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
     approval: z.ZodOptional<z.ZodObject<{
         above: z.ZodOptional<z.ZodString>;
         max: z.ZodOptional<z.ZodString>;
         timeout_seconds: z.ZodOptional<z.ZodNumber>;
-    }, "strict", z.ZodTypeAny, {
-        max?: string | undefined;
-        above?: string | undefined;
-        timeout_seconds?: number | undefined;
-    }, {
-        max?: string | undefined;
-        above?: string | undefined;
-        timeout_seconds?: number | undefined;
-    }>>;
+    }, z.core.$strict>>;
     tools: z.ZodOptional<z.ZodObject<{
-        allow: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-        deny: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    }, "strict", z.ZodTypeAny, {
-        allow?: string[] | undefined;
-        deny?: string[] | undefined;
-    }, {
-        allow?: string[] | undefined;
-        deny?: string[] | undefined;
-    }>>;
-    /** Ledger path; relative paths resolve against the policy file's directory. */
+        allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        deny: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
     ledger: z.ZodOptional<z.ZodString>;
-}, "strict", z.ZodTypeAny, {
-    version: 1;
-    name?: string | undefined;
-    approval?: {
-        max?: string | undefined;
-        above?: string | undefined;
-        timeout_seconds?: number | undefined;
-    } | undefined;
-    budget?: {
-        total?: string | undefined;
-        daily?: string | undefined;
-        monthly?: string | undefined;
-    } | undefined;
-    native_budget?: Record<string, {
-        total?: string | undefined;
-        daily?: string | undefined;
-        monthly?: string | undefined;
-    }> | undefined;
-    unpriced_spends?: "allow" | "refuse" | undefined;
-    hosts?: {
-        allow?: string[] | undefined;
-        deny?: string[] | undefined;
-    } | undefined;
-    per_host?: Record<string, {
-        daily?: string | undefined;
-        monthly?: string | undefined;
-        per_payment?: string | undefined;
-    }> | undefined;
-    recipients?: {
-        allow?: string[] | undefined;
-        deny?: string[] | undefined;
-    } | undefined;
-    chains?: {
-        allow?: number[] | undefined;
-    } | undefined;
-    assets?: {
-        allow?: string[] | undefined;
-    } | undefined;
-    tools?: {
-        allow?: string[] | undefined;
-        deny?: string[] | undefined;
-    } | undefined;
-    ledger?: string | undefined;
-}, {
-    version: 1;
-    name?: string | undefined;
-    approval?: {
-        max?: string | undefined;
-        above?: string | undefined;
-        timeout_seconds?: number | undefined;
-    } | undefined;
-    budget?: {
-        total?: string | undefined;
-        daily?: string | undefined;
-        monthly?: string | undefined;
-    } | undefined;
-    native_budget?: Record<string, {
-        total?: string | undefined;
-        daily?: string | undefined;
-        monthly?: string | undefined;
-    }> | undefined;
-    unpriced_spends?: "allow" | "refuse" | undefined;
-    hosts?: {
-        allow?: string[] | undefined;
-        deny?: string[] | undefined;
-    } | undefined;
-    per_host?: Record<string, {
-        daily?: string | undefined;
-        monthly?: string | undefined;
-        per_payment?: string | undefined;
-    }> | undefined;
-    recipients?: {
-        allow?: string[] | undefined;
-        deny?: string[] | undefined;
-    } | undefined;
-    chains?: {
-        allow?: number[] | undefined;
-    } | undefined;
-    assets?: {
-        allow?: string[] | undefined;
-    } | undefined;
-    tools?: {
-        allow?: string[] | undefined;
-        deny?: string[] | undefined;
-    } | undefined;
-    ledger?: string | undefined;
-}>;
+}, z.core.$strict>;
 export type Policy = z.infer<typeof PolicySchema>;
 export declare const PRECISION = 18;
 /** Decimal string to an integer at 18 places. */

package/package.json

@@ -5,7 +5,7 @@
     "type": "git",
     "url": "git+https://github.com/hifriendbot/agentwallet-mcp.git"
   },
-  "version": "1.14.6",
+  "version": "1.14.8",
   "description": "MCP server for AgentWallet: self-custody local signing on EVM and Solana, or hosted wallets. Sign, broadcast, pay x402 invoices, and accept x402 payments.",
   "type": "module",
   "main": "build/index.js",
@@ -20,7 +20,7 @@
   "scripts": {
     "build": "tsc",
     "start": "node build/index.js",
-    "test": "node test/x402-payment.test.mjs && node test/eip3009.test.mjs && node test/permit2-risk.test.mjs && node test/token-cap.test.mjs && node test/spl-cap.test.mjs && node test/unknown-decimals-cap.test.mjs && node test/decimals-range-cap.test.mjs && node test/local-mode.test.mjs && node test/ssrf-guard.test.mjs && node test/x402-policy.test.mjs && node test/local-guard-shape.test.mjs && node test/allowance-total-cap.test.mjs && node test/autopay-scheme.test.mjs && node test/spl-recipient-guard.test.mjs && node test/approval-binding.test.mjs && node test/ata-rent-size.test.mjs && node test/final-url-guard.test.mjs && node test/audit-1135.test.mjs && node test/local-no-autopay.test.mjs && node test/audit-1136.test.mjs && node test/delete-confirm.test.mjs && node test/audit-1138.test.mjs && node test/audit-1139.test.mjs && node test/audit-11310.test.mjs && node test/audit-11311.test.mjs && node test/audit-11312.test.mjs && node test/audit-11313.test.mjs && node test/audit-11316.test.mjs && node test/spend-policy.test.mjs && node test/policy-path-resolution.test.mjs",
+    "test": "node test/x402-payment.test.mjs && node test/eip3009.test.mjs && node test/permit2-risk.test.mjs && node test/token-cap.test.mjs && node test/spl-cap.test.mjs && node test/unknown-decimals-cap.test.mjs && node test/decimals-range-cap.test.mjs && node test/local-mode.test.mjs && node test/ssrf-guard.test.mjs && node test/x402-policy.test.mjs && node test/local-guard-shape.test.mjs && node test/allowance-total-cap.test.mjs && node test/autopay-scheme.test.mjs && node test/spl-recipient-guard.test.mjs && node test/approval-binding.test.mjs && node test/ata-rent-size.test.mjs && node test/final-url-guard.test.mjs && node test/audit-1135.test.mjs && node test/local-no-autopay.test.mjs && node test/audit-1136.test.mjs && node test/delete-confirm.test.mjs && node test/audit-1138.test.mjs && node test/audit-1139.test.mjs && node test/audit-11310.test.mjs && node test/audit-11311.test.mjs && node test/audit-11312.test.mjs && node test/audit-11313.test.mjs && node test/audit-11316.test.mjs && node test/spend-policy.test.mjs && node test/policy-path-resolution.test.mjs && node test/server-json-env.test.mjs",
     "prepublishOnly": "npm run build"
   },
   "keywords": [
@@ -59,12 +59,12 @@
     "node": ">=22.19.0"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.30.1",
+    "@modelcontextprotocol/sdk": "^1.32.2",
     "@solana/web3.js": "^1.99.0",
     "bs58": "^6.0.0",
-    "undici": "^8.11.2",
+    "undici": "^8.12.3",
     "viem": "^2.56.9",
-    "zod": "^3.24.0"
+    "zod": "^4.6.7"
   },
   "devDependencies": {
     "@types/node": "^20.0.0",