paisa-mcp 0.4.2 → 0.4.3

package/dist/index.js

@@ -53256,25 +53256,8 @@ async function decryptFields(input2, paths, { decrypt, isCiphertext }) {
   return { data, undecrypted };
 }
 
-// src/crypto.ts
+// ../crypto/src/index.ts
 var import_hash_wasm = __toESM(require_index_umd(), 1);
-var ENCRYPTED_TXN_FIELDS = ["description", "referenceNumber", "notes"];
-var ENCRYPTED_MERCHANT_FIELDS = ["cleanName", "rawId", "notes"];
-async function hmacWithKey(value, key) {
-  const rawKey = await crypto.subtle.exportKey("raw", key);
-  const hmacKey = await crypto.subtle.importKey("raw", rawKey, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
-  const sig = await crypto.subtle.sign("HMAC", hmacKey, new TextEncoder().encode(value));
-  return btoa(String.fromCharCode(...new Uint8Array(sig)));
-}
-async function encryptPersonCipher(fields, key) {
-  const cipher = await encryptField(JSON.stringify(fields), key);
-  const searchHash = await hmacWithKey(fields.name.toLowerCase().trim().replace(/\s+/g, " "), key);
-  return { cipher, searchHash };
-}
-async function decryptPersonCipher(cipher, key) {
-  const json2 = await decryptField(cipher, key);
-  return JSON.parse(json2);
-}
 async function deriveKey(userId, pin, salt) {
   const enc = new TextEncoder;
   const baseKey = await crypto.subtle.importKey("raw", enc.encode(userId + pin), "PBKDF2", false, [
@@ -53318,6 +53301,34 @@ async function decryptField(encrypted, key) {
   const plaintext = await crypto.subtle.decrypt({ name: "AES-GCM", iv }, key, ciphertext);
   return new TextDecoder().decode(plaintext);
 }
+var VERIFIER_PLAINTEXT = "paisa-verify-v1";
+async function checkVerifier(key, encryptedVerifier) {
+  try {
+    const decrypted = await decryptField(encryptedVerifier, key);
+    return decrypted === VERIFIER_PLAINTEXT;
+  } catch {
+    return false;
+  }
+}
+
+// src/crypto.ts
+var ENCRYPTED_TXN_FIELDS = ["description", "referenceNumber", "notes"];
+var ENCRYPTED_MERCHANT_FIELDS = ["cleanName", "rawId", "notes"];
+async function hmacWithKey(value, key) {
+  const rawKey = await crypto.subtle.exportKey("raw", key);
+  const hmacKey = await crypto.subtle.importKey("raw", rawKey, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  const sig = await crypto.subtle.sign("HMAC", hmacKey, new TextEncoder().encode(value));
+  return btoa(String.fromCharCode(...new Uint8Array(sig)));
+}
+async function encryptPersonCipher(fields, key) {
+  const cipher = await encryptField(JSON.stringify(fields), key);
+  const searchHash = await hmacWithKey(fields.name.toLowerCase().trim().replace(/\s+/g, " "), key);
+  return { cipher, searchHash };
+}
+async function decryptPersonCipher(cipher, key) {
+  const json2 = await decryptField(cipher, key);
+  return JSON.parse(json2);
+}
 async function encryptObjectFields(obj, fields, key) {
   for (const field of fields) {
     const val = obj[field];
@@ -53375,15 +53386,6 @@ async function decryptPersonCiphers(input2, key) {
     merge3(data);
   return { data, undecrypted };
 }
-var VERIFIER_PLAINTEXT = "paisa-verify-v1";
-async function checkVerifier(key, encryptedVerifier) {
-  try {
-    const decrypted = await decryptField(encryptedVerifier, key);
-    return decrypted === VERIFIER_PLAINTEXT;
-  } catch {
-    return false;
-  }
-}
 
 // src/lib/crypto-init.ts
 async function initCrypto(client, pin, userId) {
@@ -54573,7 +54575,7 @@ async function decryptAnalytics(data, key) {
   ], key);
   return undecrypted.length ? { ...decrypted, undecrypted } : decrypted;
 }
-function analyticsTools(client, crypto3) {
+function analyticsTools(client, crypto4) {
   return [
     defineTool({
       name: "get_analytics",
@@ -54598,8 +54600,8 @@ function analyticsTools(client, crypto3) {
             data = await client.get(`/api/analytics/merchants/${params.id}`, params.months ? { months: params.months } : undefined);
             break;
         }
-        if (crypto3)
-          data = await decryptAnalytics(data, crypto3.key);
+        if (crypto4)
+          data = await decryptAnalytics(data, crypto4.key);
         return data;
       }
     })
@@ -54657,7 +54659,7 @@ function budgetTools(client) {
 }
 
 // src/tools/dashboard.ts
-function dashboardTools(client, crypto3) {
+function dashboardTools(client, crypto4) {
   return [
     defineTool({
       name: "get_dashboard",
@@ -54666,8 +54668,8 @@ function dashboardTools(client, crypto3) {
       output: dashboardOutputSchema,
       handler: async (params) => {
         const data = await client.get("/api/dashboard", params.months ? { months: params.months } : undefined);
-        if (crypto3 && Array.isArray(data?.recentTransactions)) {
-          const { data: decrypted, undecrypted } = await decryptTransactionFields(data.recentTransactions, crypto3.key);
+        if (crypto4 && Array.isArray(data?.recentTransactions)) {
+          const { data: decrypted, undecrypted } = await decryptTransactionFields(data.recentTransactions, crypto4.key);
           data.recentTransactions = decrypted;
           if (undecrypted.length)
             return { ...data, undecrypted };
@@ -55231,13 +55233,13 @@ async function categorySlugToId(client) {
   }
   return map2;
 }
-function merchantVariants(client, crypto3) {
+function merchantVariants(client, crypto4) {
   return {
     list: variant(exports_external.object({ rawId: exports_external.string().optional().describe("merchants: find one by UPI ID or name") }), async ({ rawId }) => {
       const data = await client.get("/api/merchants");
       let undecrypted = [];
-      if (crypto3 && data.data) {
-        const dec = await decryptMerchantFields(data.data, crypto3.key);
+      if (crypto4 && data.data) {
+        const dec = await decryptMerchantFields(data.data, crypto4.key);
         data.data = dec.data;
         undecrypted = dec.undecrypted;
       }
@@ -55295,7 +55297,7 @@ function merchantTools(client) {
 }
 
 // src/tools/persons.ts
-function personVariants(client, crypto3) {
+function personVariants(client, crypto4) {
   return {
     upsert: variant(exports_external.object({
       id: exports_external.string().optional().describe("Person UUID — pass to update, omit to create"),
@@ -55305,13 +55307,13 @@ function personVariants(client, crypto3) {
       relationship: exports_external.string().optional(),
       notes: exports_external.string().optional()
     }), async ({ id, ...updates }) => {
-      if (crypto3) {
+      if (crypto4) {
         if (id) {
           const existing = await client.get(`/api/persons/${id}`);
           const personData = existing.data;
           let current;
           if (personData.cipher) {
-            current = await decryptPersonCipher(personData.cipher, crypto3.key);
+            current = await decryptPersonCipher(personData.cipher, crypto4.key);
           } else {
             current = {
               name: personData.name,
@@ -55328,7 +55330,7 @@ function personVariants(client, crypto3) {
             relationship: updates.relationship ?? current.relationship ?? null,
             notes: updates.notes ?? current.notes ?? null
           };
-          const payload2 = await encryptPersonCipher(merged, crypto3.key);
+          const payload2 = await encryptPersonCipher(merged, crypto4.key);
           const data3 = await client.patch(`/api/persons/${id}`, payload2);
           return data3;
         }
@@ -55341,7 +55343,7 @@ function personVariants(client, crypto3) {
           relationship: updates.relationship ?? null,
           notes: updates.notes ?? null
         };
-        const payload = await encryptPersonCipher(fields, crypto3.key);
+        const payload = await encryptPersonCipher(fields, crypto4.key);
         const data2 = await client.post("/api/persons", payload);
         return data2;
       }
@@ -55353,8 +55355,8 @@ function personVariants(client, crypto3) {
     }), async ({ id }) => {
       if (id) {
         const data2 = await client.get(`/api/persons/${id}`);
-        if (crypto3 && data2.data.cipher) {
-          const { data: decrypted, undecrypted } = await decryptPersonCiphers(data2.data, crypto3.key);
+        if (crypto4 && data2.data.cipher) {
+          const { data: decrypted, undecrypted } = await decryptPersonCiphers(data2.data, crypto4.key);
           data2.data = decrypted;
           if (undecrypted.length)
             return { ...data2, undecrypted };
@@ -55362,8 +55364,8 @@ function personVariants(client, crypto3) {
         return data2;
       }
       const data = await client.get("/api/persons");
-      if (crypto3 && data.data) {
-        const { data: decrypted, undecrypted } = await decryptPersonCiphers(data.data, crypto3.key);
+      if (crypto4 && data.data) {
+        const { data: decrypted, undecrypted } = await decryptPersonCiphers(data.data, crypto4.key);
         data.data = decrypted;
         if (undecrypted.length)
           return { ...data, undecrypted };
@@ -55501,11 +55503,11 @@ function reportTools(client) {
 }
 
 // src/tools/entities.ts
-function entityTools(client, crypto3) {
+function entityTools(client, crypto4) {
   const category = categoryVariants(client);
   const account = accountVariants(client);
-  const person = personVariants(client, crypto3);
-  const merchant = merchantVariants(client, crypto3);
+  const person = personVariants(client, crypto4);
+  const merchant = merchantVariants(client, crypto4);
   const debt = debtVariants(client);
   const household = householdVariants(client);
   const goal = goalVariants(client);
@@ -59154,10 +59156,10 @@ function toTxnRow(r2) {
     isDuplicate: !!r2.isDuplicate
   };
 }
-async function fetchAllRows(client, crypto3, params = {}, maxPages = 100) {
-  return (await fetchAllRowsPaged(client, crypto3, params, maxPages)).rows;
+async function fetchAllRows(client, crypto4, params = {}, maxPages = 100) {
+  return (await fetchAllRowsPaged(client, crypto4, params, maxPages)).rows;
 }
-async function fetchAllRowsPaged(client, crypto3, params = {}, maxPages = 100) {
+async function fetchAllRowsPaged(client, crypto4, params = {}, maxPages = 100) {
   const out = [];
   let cursor;
   let truncated = false;
@@ -59167,7 +59169,7 @@ async function fetchAllRowsPaged(client, crypto3, params = {}, maxPages = 100) {
       q2.cursor = cursor;
     const res = await client.get("/api/transactions", q2);
     const batch0 = res.data ?? [];
-    const batch = crypto3 ? (await decryptTransactionFields(batch0, crypto3.key)).data : batch0;
+    const batch = crypto4 ? (await decryptTransactionFields(batch0, crypto4.key)).data : batch0;
     out.push(...batch.map(toTxnRow));
     if (!res.hasMore || !res.nextCursor || batch.length === 0 || res.nextCursor === cursor)
       break;
@@ -59216,14 +59218,14 @@ function normalizePersonName(name) {
 function normalizeUpiHandle(handle) {
   return handle.toLowerCase().trim().split("@")[0];
 }
-async function loadDecryptedPersons(client, crypto3) {
+async function loadDecryptedPersons(client, crypto4) {
   const res = await client.get("/api/persons");
   const persons = [];
   for (const p2 of res.data ?? []) {
     let name = p2.name ?? "";
-    if (crypto3 && p2.cipher) {
+    if (crypto4 && p2.cipher) {
       try {
-        name = (await decryptPersonCipher(p2.cipher, crypto3.key)).name;
+        name = (await decryptPersonCipher(p2.cipher, crypto4.key)).name;
       } catch {}
     }
     if (name)
@@ -59264,8 +59266,8 @@ function isPersonLikeNarration(description) {
   const { name, paymentMethod } = parseNarration(description);
   return classifyEntity({ paymentMethod, extractedName: name }) !== "merchant";
 }
-async function backfillPersons(client, crypto3, opts = {}) {
-  const existing = await loadDecryptedPersons(client, crypto3);
+async function backfillPersons(client, crypto4, opts = {}) {
+  const existing = await loadDecryptedPersons(client, crypto4);
   const personIdByNorm = new Map;
   const personIdByHandle = new Map;
   for (const p2 of existing) {
@@ -59273,7 +59275,7 @@ async function backfillPersons(client, crypto3, opts = {}) {
     for (const h2 of p2.upiHandles)
       personIdByHandle.set(normalizeUpiHandle(h2), p2.id);
   }
-  const { rows, truncated } = await fetchAllRowsPaged(client, crypto3, { unresolved: "true" });
+  const { rows, truncated } = await fetchAllRowsPaged(client, crypto4, { unresolved: "true" });
   const candidates = rows.filter((r2) => !r2.merchantId && !r2.personId && !r2.isTransfer && !r2.isIgnored);
   const directLinks = [];
   const groups = new Map;
@@ -59365,7 +59367,7 @@ async function backfillPersons(client, crypto3, opts = {}) {
         relationship: null,
         notes: null
       };
-      return crypto3 ? await encryptPersonCipher(fields, crypto3.key) : { name: displayName, upiHandles, phoneNumbers: [], relationship: null, notes: null };
+      return crypto4 ? await encryptPersonCipher(fields, crypto4.key) : { name: displayName, upiHandles, phoneNumbers: [], relationship: null, notes: null };
     }));
     const res = await client.post("/api/persons/bulk", {
       persons: bodies
@@ -59500,20 +59502,20 @@ function groupRows(rows) {
 function isCategorizable(r2) {
   return !r2.categoryId && !r2.isTransfer && !r2.isIgnored && !r2.isDuplicate;
 }
-async function fetchUncategorized(client, crypto3, range = {}) {
+async function fetchUncategorized(client, crypto4, range = {}) {
   const params = { uncategorized: "true" };
   if (range.startDate)
     params.startDate = range.startDate;
   if (range.endDate)
     params.endDate = range.endDate;
-  return (await fetchAllRows(client, crypto3, params)).filter(isCategorizable);
+  return (await fetchAllRows(client, crypto4, params)).filter(isCategorizable);
 }
 var MERCHANT_CREATE_CONCURRENCY = 5;
 var titleCase = (s2) => s2.replace(/\b[a-z]/g, (c2) => c2.toUpperCase());
-async function applyGroupAssignments(client, crypto3, assignments, opts = {}) {
+async function applyGroupAssignments(client, crypto4, assignments, opts = {}) {
   const catIndex = await loadCategoryIndex(client);
   const resolved = assignments.map((a2) => ({ a: a2, cat: requireCategory(catIndex, a2.categorySlug) }));
-  const groups = groupRows(await fetchUncategorized(client, crypto3, opts));
+  const groups = groupRows(await fetchUncategorized(client, crypto4, opts));
   const result = { applied: [], notFound: [], rulesSaved: 0, unlearnable: [] };
   const plan = [];
   const claimed = new Set;
@@ -59568,7 +59570,7 @@ async function applyGroupAssignments(client, crypto3, assignments, opts = {}) {
     const { group, learn, confirmMerchant } = p2;
     if (!learn || group.pattern === UNPARSED) {
       directPlans.push({ p: p2, reason: learn ? UNPARSED : undefined });
-    } else if (crypto3 && !confirmMerchant && group.rows.some((r2) => isPersonLikeNarration(r2.description))) {
+    } else if (crypto4 && !confirmMerchant && group.rows.some((r2) => isPersonLikeNarration(r2.description))) {
       directPlans.push({ p: p2, reason: `${group.pattern} (private mode: person-like)` });
     } else if (taught.has(group.pattern) && taught.get(group.pattern) !== p2.categoryId) {
       directPlans.push({ p: p2, reason: `${group.pattern} (conflicting category for same pattern)` });
@@ -59666,12 +59668,12 @@ function flagBatchDuplicates(txns) {
     return false;
   });
 }
-async function importTransactions(client, crypto3, opts) {
+async function importTransactions(client, crypto4, opts) {
   let txns = opts.txns;
   let duplicatesSkipped = 0;
   if (txns.length > 0) {
     const dates = txns.map((t2) => t2.date).sort();
-    const existing = await fetchAllRows(client, crypto3, {
+    const existing = await fetchAllRows(client, crypto4, {
       startDate: dates[0],
       endDate: dates[dates.length - 1]
     });
@@ -59687,8 +59689,8 @@ async function importTransactions(client, crypto3, opts) {
     const base = { ...t2, isDuplicate: dupFlags[i2] };
     return enrichedData ? { ...base, enrichedData } : base;
   });
-  if (crypto3)
-    await encryptTransactionFields(rows, crypto3.key);
+  if (crypto4)
+    await encryptTransactionFields(rows, crypto4.key);
   const CHUNK = 200;
   let imported = 0;
   for (let i2 = 0;i2 < rows.length; i2 += CHUNK) {
@@ -59703,19 +59705,19 @@ async function importTransactions(client, crypto3, opts) {
   }
   return { imported, duplicatesSkipped, duplicatesFlagged };
 }
-async function runRescan(client, crypto3) {
+async function runRescan(client, crypto4) {
   let bag = structuredClone(EMPTY_BAG);
   try {
     bag = (await loadBag(client)).bag;
   } catch {}
   const merchantsRes = await client.get("/api/merchants");
   const allMerchants0 = merchantsRes.data ?? [];
-  const allMerchants = crypto3 ? (await decryptMerchantFields(allMerchants0, crypto3.key)).data : allMerchants0;
+  const allMerchants = crypto4 ? (await decryptMerchantFields(allMerchants0, crypto4.key)).data : allMerchants0;
   const globalMerchants = allMerchants.filter((m2) => !m2.householdId && m2.cleanName).map((m2) => ({ id: m2.id, name: m2.cleanName }));
   const localMerchants = allMerchants.filter((m2) => m2.householdId && m2.cleanName).map((m2) => ({ id: m2.id, name: m2.cleanName }));
   const merchantCategoryById = new Map(allMerchants.filter((m2) => m2.categoryId).map((m2) => [m2.id, m2.categoryId]));
-  const persons = await loadDecryptedPersons(client, crypto3);
-  const allRows = await fetchAllRows(client, crypto3, { unresolved: "true" });
+  const persons = await loadDecryptedPersons(client, crypto4);
+  const allRows = await fetchAllRows(client, crypto4, { unresolved: "true" });
   const categoryByTxn = new Map(allRows.map((r2) => [r2.id, r2.categoryId]));
   const plan = autoCategorizeFromDescriptions({
     rows: allRows,
@@ -59724,8 +59726,17 @@ async function runRescan(client, crypto3) {
     localMerchants,
     persons
   });
+  const knownMerchants = new Set([
+    ...allMerchants.map((m2) => m2.id),
+    ...allRows.flatMap((r2) => r2.merchantId ? [r2.merchantId] : [])
+  ]);
+  const knownPersons = new Set([
+    ...persons.map((p2) => p2.id),
+    ...allRows.flatMap((r2) => r2.personId ? [r2.personId] : [])
+  ]);
+  const live = plan.suggestions.filter((s2) => s2.entity.type === "merchant" ? knownMerchants.has(s2.entity.merchantId) : knownPersons.has(s2.entity.personId));
   let categorized = 0;
-  const links = plan.suggestions.flatMap((s2) => {
+  const links = live.flatMap((s2) => {
     const categoryId = s2.categoryId ?? (s2.entity.type === "merchant" ? merchantCategoryById.get(s2.entity.merchantId) ?? null : null);
     return s2.transactionIds.map((txId) => {
       const applyCategory = categoryId && !categoryByTxn.get(txId);
@@ -59745,7 +59756,7 @@ var TRUNCATED_WARNING = "TRUNCATED: the API capped this result, so it is INCOMPL
 function withTruncationWarning(data) {
   return data.truncated ? { warning: TRUNCATED_WARNING, ...data } : data;
 }
-function transactionTools(client, crypto3) {
+function transactionTools(client, crypto4) {
   return [
     defineTool({
       name: "get_transactions",
@@ -59792,7 +59803,7 @@ function transactionTools(client, crypto3) {
           apiParams.categoryId = requireCategory(await loadCategoryIndex(client), categorySlug).id;
         }
         if (personName && !apiParams.personId) {
-          const persons = await loadDecryptedPersons(client, crypto3);
+          const persons = await loadDecryptedPersons(client, crypto4);
           const match = resolvePersonByName(persons, personName);
           const err = (error62) => ({ error: error62 });
           if (!match) {
@@ -59809,14 +59820,14 @@ function transactionTools(client, crypto3) {
         const data = await client.get("/api/transactions", Object.fromEntries(Object.entries(apiParams).filter(([, v2]) => v2 !== undefined).map(([k2, v2]) => [k2, String(v2)])));
         let rows = data.data ?? [];
         let undecrypted = [];
-        if (crypto3) {
-          const dec = await decryptTransactionFields(rows, crypto3.key);
+        if (crypto4) {
+          const dec = await decryptTransactionFields(rows, crypto4.key);
           rows = dec.data;
           undecrypted = dec.undecrypted;
         }
         const personNames = new Map;
         if (rows.some((r2) => r2.personId)) {
-          for (const p2 of await loadDecryptedPersons(client, crypto3))
+          for (const p2 of await loadDecryptedPersons(client, crypto4))
             personNames.set(p2.id, p2.name);
         }
         if (full) {
@@ -59847,7 +59858,7 @@ function transactionTools(client, crypto3) {
         limit: exports_external.number().optional().describe("Max groups (default 40, max 100)")
       }),
       handler: async ({ startDate, endDate, minTotal, limit }) => {
-        const rows = await fetchUncategorized(client, crypto3, { startDate, endDate });
+        const rows = await fetchUncategorized(client, crypto4, { startDate, endDate });
         const all2 = groupRows(rows);
         const shown = all2.filter((g2) => g2.total >= (minTotal ?? 0)).slice(0, Math.min(Math.max(limit ?? 40, 1), 100));
         const shownRows = shown.reduce((n2, g2) => n2 + g2.rows.length, 0);
@@ -59884,7 +59895,7 @@ function transactionTools(client, crypto3) {
       handler: (args, ctx) => {
         const { assignments, startDate, endDate, dryRun } = args;
         const { expectedPlanHash } = args;
-        return applyGroupAssignments(client, crypto3, assignments, {
+        return applyGroupAssignments(client, crypto4, assignments, {
           dryRun,
           startDate,
           endDate,
@@ -59897,7 +59908,7 @@ function transactionTools(client, crypto3) {
       name: "backfill_persons",
       description: "Create persons from UPI/IMPS counterparties in unlinked transactions (deduped by name) and link those transactions to them. Idempotent. dryRun previews.",
       input: exports_external.object({ dryRun: exports_external.boolean().optional() }),
-      handler: (args, ctx) => backfillPersons(client, crypto3, {
+      handler: (args, ctx) => backfillPersons(client, crypto4, {
         onProgress: progressFor(ctx),
         dryRun: args.dryRun,
         expectedPlanHash: args.expectedPlanHash
@@ -59919,8 +59930,8 @@ function transactionTools(client, crypto3) {
       }),
       handler: async ({ id, ...updates }) => {
         const body = { ...updates };
-        if (crypto3 && body.notes)
-          body.notes = await encryptField(body.notes, crypto3.key);
+        if (crypto4 && body.notes)
+          body.notes = await encryptField(body.notes, crypto4.key);
         if (body.categorySlug) {
           const cat = requireCategory(await loadCategoryIndex(client), body.categorySlug);
           body.categoryId = cat.id;
@@ -59969,8 +59980,8 @@ function transactionTools(client, crypto3) {
         }
         if (action === "list") {
           const data2 = await client.get("/api/transactions/duplicates");
-          if (crypto3 && data2.data) {
-            const { data: decrypted, undecrypted } = await decryptTransactionFields(data2.data, crypto3.key);
+          if (crypto4 && data2.data) {
+            const { data: decrypted, undecrypted } = await decryptTransactionFields(data2.data, crypto4.key);
             data2.data = decrypted;
             return withTruncationWarning(undecrypted.length ? { ...data2, undecrypted } : data2);
           }
@@ -59993,8 +60004,8 @@ function transactionTools(client, crypto3) {
       }),
       handler: async ({ accountId, startDate, endDate }) => {
         const data = await client.get("/api/transactions/reconciliation-context", { accountId, startDate, endDate });
-        if (crypto3 && data.data) {
-          const { data: decrypted, undecrypted } = await decryptTransactionFields(data.data, crypto3.key);
+        if (crypto4 && data.data) {
+          const { data: decrypted, undecrypted } = await decryptTransactionFields(data.data, crypto4.key);
           data.data = decrypted;
           return withTruncationWarning(undecrypted.length ? { ...data, undecrypted } : data);
         }
@@ -60081,7 +60092,7 @@ function transactionTools(client, crypto3) {
       name: "rescan_transactions",
       description: "Apply saved learning rules (merchant aliases, category rules) to uncategorized transactions, like the web app's auto-categorize.",
       input: exports_external.object({}),
-      handler: () => runRescan(client, crypto3)
+      handler: () => runRescan(client, crypto4)
     }),
     defineTool({
       name: "get_settlement_candidates",
@@ -60089,8 +60100,8 @@ function transactionTools(client, crypto3) {
       input: exports_external.object({ ccAccountId: exports_external.string().uuid() }),
       handler: async ({ ccAccountId }) => {
         const data = await client.get("/api/transactions/settlement-candidates", { ccAccountId });
-        if (crypto3 && data.data) {
-          const { data: decrypted, undecrypted } = await decryptTransactionFields(data.data, crypto3.key);
+        if (crypto4 && data.data) {
+          const { data: decrypted, undecrypted } = await decryptTransactionFields(data.data, crypto4.key);
           data.data = decrypted;
           return withTruncationWarning(undecrypted.length ? { ...data, undecrypted } : data);
         }
@@ -60107,8 +60118,8 @@ function transactionTools(client, crypto3) {
         if (!row)
           return res;
         let undecrypted = [];
-        if (crypto3) {
-          const dec = await decryptTransactionFields([row], crypto3.key);
+        if (crypto4) {
+          const dec = await decryptTransactionFields([row], crypto4.key);
           row = dec.data[0];
           undecrypted = dec.undecrypted;
         }
@@ -60134,7 +60145,7 @@ function transactionTools(client, crypto3) {
 }
 
 // src/tools/export.ts
-function exportTools(client, crypto3) {
+function exportTools(client, crypto4) {
   return [
     defineTool({
       name: "export_transactions",
@@ -60151,8 +60162,8 @@ function exportTools(client, crypto3) {
           ...Object.fromEntries(Object.entries(params).filter(([, v2]) => v2 !== undefined)),
           format: "json"
         });
-        if (crypto3 && Array.isArray(data?.transactions)) {
-          const { data: decrypted, undecrypted } = await decryptTransactionFields(data.transactions, crypto3.key);
+        if (crypto4 && Array.isArray(data?.transactions)) {
+          const { data: decrypted, undecrypted } = await decryptTransactionFields(data.transactions, crypto4.key);
           data.transactions = decrypted;
           return withTruncationWarning(undecrypted.length ? { ...data, undecrypted } : data);
         }
@@ -60394,28 +60405,28 @@ var DEFAULT_MIN_CONFIDENCE = 0.95;
 var TIMEOUT_MS = 8000;
 var CONCURRENCY = 8;
 var MIN_LEARN_PATTERN_LEN = 5;
-function assertPrivateModeAllowed(crypto3, env2 = process.env) {
-  if (crypto3 && env2.JEV_ALLOW_PRIVATE_MODE !== "1") {
+function assertPrivateModeAllowed(crypto4, env2 = process.env) {
+  if (crypto4 && env2.JEV_ALLOW_PRIVATE_MODE !== "1") {
     throw new Error("Jev categorization is disabled in private mode: it would send transaction text to a third party. " + "To opt in for your own account, set JEV_ALLOW_PRIVATE_MODE=1 in the MCP's environment. " + "Otherwise use get_uncategorized_groups + categorize_groups.");
   }
 }
-function assertJevAllowed(crypto3, env2 = process.env) {
-  assertPrivateModeAllowed(crypto3, env2);
+function assertJevAllowed(crypto4, env2 = process.env) {
+  assertPrivateModeAllowed(crypto4, env2);
   const key = env2.JEV_API_KEY;
   if (!key)
     throw new Error("JEV_API_KEY is not set — Jev categorization is off.");
   return key;
 }
-function jevAllowSensitive(crypto3, env2) {
-  return crypto3 === undefined || env2.JEV_ALLOW_PRIVATE_MODE === "1";
+function jevAllowSensitive(crypto4, env2) {
+  return crypto4 === undefined || env2.JEV_ALLOW_PRIVATE_MODE === "1";
 }
-function makeJev(apiKey, crypto3, env2 = process.env, fetchImpl) {
+function makeJev(apiKey, crypto4, env2 = process.env, fetchImpl) {
   return createJev({
     apiKey,
     model: JEV_MODEL,
     minConfidence: DEFAULT_MIN_CONFIDENCE,
     timeoutMs: TIMEOUT_MS,
-    allowSensitive: jevAllowSensitive(crypto3, env2),
+    allowSensitive: jevAllowSensitive(crypto4, env2),
     ...fetchImpl ? { fetch: fetchImpl } : {}
   });
 }
@@ -60435,10 +60446,10 @@ function groupState(type, sample) {
   const dir = type === "credit" ? "Money received" : "Money paid out";
   return `${dir}. Bank narration: "${sample.slice(0, 80)}"`;
 }
-async function jevCategorize(client, crypto3, jev, opts = {}) {
-  assertPrivateModeAllowed(crypto3, opts.env);
+async function jevCategorize(client, crypto4, jev, opts = {}) {
+  assertPrivateModeAllowed(crypto4, opts.env);
   const index = await loadCategoryIndex(client);
-  const rows = await fetchUncategorized(client, crypto3, opts);
+  const rows = await fetchUncategorized(client, crypto4, opts);
   const groups = groupRows(rows);
   const unparsed = groups.filter((g2) => g2.pattern === UNPARSED).length;
   const candidates = groups.filter((g2) => g2.pattern !== UNPARSED);
@@ -60446,7 +60457,7 @@ async function jevCategorize(client, crypto3, jev, opts = {}) {
   const suggestions = await mapLimit(candidates, CONCURRENCY, async (g2) => {
     const options = optionsFor(g2.type, index);
     const sample = g2.rows[0].description;
-    const text = crypto3 ? g2.pattern : sample;
+    const text = crypto4 ? g2.pattern : sample;
     const d2 = await jev.choice({
       question: "Which spending category best fits this bank transaction?",
       options,
@@ -60488,7 +60499,7 @@ async function jevCategorize(client, crypto3, jev, opts = {}) {
     }
   }
   review.sort((a2, b2) => b2.total - a2.total);
-  const applied = await applyGroupAssignments(client, crypto3, accepted.map(({ confidence: _c, ...a2 }) => a2), { dryRun: opts.dryRun, startDate: opts.startDate, endDate: opts.endDate });
+  const applied = await applyGroupAssignments(client, crypto4, accepted.map(({ confidence: _c, ...a2 }) => a2), { dryRun: opts.dryRun, startDate: opts.startDate, endDate: opts.endDate });
   const conf = new Map(accepted.map((a2) => [`${a2.pattern}|${a2.type}`, a2.confidence]));
   return {
     dryRun: !!opts.dryRun,
@@ -60505,7 +60516,7 @@ async function jevCategorize(client, crypto3, jev, opts = {}) {
 }
 
 // src/tools/jev.ts
-function jevTools(client, crypto3) {
+function jevTools(client, crypto4) {
   return [
     defineTool({
       name: "auto_categorize_jev",
@@ -60517,9 +60528,9 @@ function jevTools(client, crypto3) {
         dryRun: exports_external.boolean().optional()
       }),
       handler: async ({ startDate, endDate, minConfidence, dryRun }) => {
-        const key = assertJevAllowed(crypto3);
-        const jev = makeJev(key, crypto3);
-        const result = await jevCategorize(client, crypto3, jev, {
+        const key = assertJevAllowed(crypto4);
+        const jev = makeJev(key, crypto4);
+        const result = await jevCategorize(client, crypto4, jev, {
           startDate,
           endDate,
           minConfidence,
@@ -60543,12 +60554,12 @@ function profileVariants(client) {
 function settingsTools(client) {
   const profile = profileVariants(client);
   const household = householdVariants(client);
-  const crypto3 = authCryptoVariants(client);
+  const crypto4 = authCryptoVariants(client);
   const get = unionTool({
     name: "get_settings",
     description: "Read settings. profile: your name, email, owner. household: name, currency, locale, owner labels, members. encryption: mode (standard/private) and whether a PIN verifier / recovery key is set.",
     key: "section",
-    variants: { profile: profile.get, household: household.get, encryption: crypto3.status }
+    variants: { profile: profile.get, household: household.get, encryption: crypto4.status }
   });
   const update = unionTool({
     name: "update_settings",
@@ -60630,7 +60641,7 @@ async function fetchReconciliationContext(client, accountId, start, end, budget
 }
 var sum2 = (rows) => Math.round(rows.reduce((n2, r2) => n2 + r2.amount, 0));
 async function runStatementImport(deps, args) {
-  const { client, crypto: crypto3 } = deps;
+  const { client, crypto: crypto4 } = deps;
   const accounts = (await client.get("/api/accounts")).data ?? [];
   const account = resolveAccount(accounts, args.account);
   const format = pickFormat(account, args.format);
@@ -60649,7 +60660,7 @@ async function runStatementImport(deps, args) {
   }
   const dates = txns.map((t2) => t2.date).sort();
   const existing0 = await fetchReconciliationContext(client, account.id, dates[0], dates[dates.length - 1]);
-  const existing = crypto3 ? (await decryptTransactionFields(existing0, crypto3.key)).data : existing0;
+  const existing = crypto4 ? (await decryptTransactionFields(existing0, crypto4.key)).data : existing0;
   const present = existing.map((r2) => ({ ...r2, isDuplicate: false, isIgnored: false }));
   const result = reconcile(present, { ...statement, transactions: txns });
   const fresh = result.unmatched;
@@ -60690,7 +60701,7 @@ async function runStatementImport(deps, args) {
   if (fresh.length === 0)
     return { ...summary, dryRun: false, imported: 0 };
   const savings = account.type !== "credit_card";
-  const imported = await importTransactions(client, crypto3, {
+  const imported = await importTransactions(client, crypto4, {
     onProgress: deps.onProgress,
     accountId: account.id,
     source: savings ? "bank_statement" : "cc_statement",
@@ -60703,7 +60714,7 @@ async function runStatementImport(deps, args) {
       referenceNumber: t2.referenceNumber ?? undefined
     }))
   });
-  const rescan = await runRescan(client, crypto3);
+  const rescan = await runRescan(client, crypto4);
   return { ...summary, dryRun: false, ...imported, rescan };
 }
 
@@ -60739,16 +60750,16 @@ var statementSource = exports_external.enum([
   "ai_import"
 ]);
 var granularity = exports_external.number().int().min(1).max(5).describe("1=bank, 2=CC, 3=manual, 4=app export, 5=telegram/AI");
-function statementImportTools(client, crypto3) {
+function statementImportTools(client, crypto4) {
   const pdf = (confirm2) => variant(pdfInput, (args, ctx) => runStatementImport({
     client,
-    crypto: crypto3,
+    crypto: crypto4,
     readFile: readFileAsArrayBuffer,
     parsers: realParsers,
     onProgress: progressFor(ctx)
   }, confirm2 ? { ...args, confirm: true } : args));
   const csvParse = variant(exports_external.object({ filePath: exports_external.string() }), async ({ filePath }) => {
-    if (crypto3)
+    if (crypto4)
       return CSV_PRIVATE_MODE_ERROR;
     const buf = await readFile2(filePath);
     const form = new FormData;
@@ -60783,7 +60794,7 @@ function statementImportTools(client, crypto3) {
         skipDuplicates: exports_external.boolean().optional(),
         force: exports_external.boolean().optional()
       }), async ({ filePath, mapping, accountId, owner, skipDuplicates, force }) => {
-        if (crypto3)
+        if (crypto4)
           return CSV_PRIVATE_MODE_ERROR;
         const csvText = await readFile2(filePath, "utf8");
         const data = await client.post("/api/transactions/import/confirm", {
@@ -60808,14 +60819,14 @@ function statementImportTools(client, crypto3) {
           referenceNumber: exports_external.string().optional()
         }))
       }), async ({ accountId, source, granularity: granularity2, transactions: txns }, ctx) => {
-        const data = await importTransactions(client, crypto3, {
+        const data = await importTransactions(client, crypto4, {
           onProgress: progressFor(ctx),
           accountId,
           source,
           granularity: granularity2,
           txns
         });
-        const rescan = await runRescan(client, crypto3);
+        const rescan = await runRescan(client, crypto4);
         return { import: data, rescan };
       }),
       json_file: variant(exports_external.object({
@@ -60839,14 +60850,14 @@ function statementImportTools(client, crypto3) {
         } catch (e2) {
           throw new Error(`Failed to read/parse ${filePath}: ${e2 instanceof Error ? e2.message : String(e2)}`);
         }
-        const data = await importTransactions(client, crypto3, {
+        const data = await importTransactions(client, crypto4, {
           onProgress: progressFor(ctx),
           accountId,
           source,
           granularity: granularity2,
           txns
         });
-        const rescan = await runRescan(client, crypto3);
+        const rescan = await runRescan(client, crypto4);
         return { import: data, count: txns.length, rescan };
       })
     }
@@ -61003,7 +61014,7 @@ function registerResources2(server2, tools) {
 // package.json
 var package_default = {
   name: "paisa-mcp",
-  version: "0.4.2",
+  version: "0.4.3",
   repository: {
     type: "git",
     url: "git+https://github.com/nimit9/paisa.git",
@@ -61033,13 +61044,12 @@ var package_default = {
     "@nimit9/signet-ai": "^0.1.11",
     "@nimit9/signet-lib": "^0.1.15",
     "@nimit9/signet-server": "^0.2.7",
+    "@paisa/crypto": "workspace:*",
     "@paisa/parsers": "workspace:*",
     "@paisa/reconciliation": "workspace:*",
     "@paisa/types": "workspace:*",
-    "@scure/bip39": "^2.2.0",
     "@types/bun": "^1.3.14",
     axios: "^1.16.1",
-    "hash-wasm": "^4.12.0",
     typescript: "^7.0.2",
     zod: "^4.6.5"
   },
@@ -61059,8 +61069,8 @@ function paisaErrorResult(err) {
   });
 }
 var CONFIRM_KEY2 = randomBytes(32);
-function buildServer(client, crypto3) {
-  const tools = applyAnnotations(REGISTRATIONS.flatMap((group) => group.tools(client, crypto3)).map((t2) => {
+function buildServer(client, crypto4) {
+  const tools = applyAnnotations(REGISTRATIONS.flatMap((group) => group.tools(client, crypto4)).map((t2) => {
     const describe3 = CONFIRMED_TOOLS[t2.name];
     if (describe3)
       return withConfirmation(t2, describe3);
@@ -61103,5 +61113,5 @@ main().catch((err) => {
   process.exit(1);
 });
 
-//# debugId=24F552E300AC132164756E2164756E21
+//# debugId=1892106D83105DD764756E2164756E21
 //# sourceMappingURL=index.js.map