web3-tools-mcp 3.0.0 → 3.2.0

package/CHANGELOG.md

@@ -2,7 +2,104 @@
 
 Notable changes per release. Dates are release dates; unreleased work sits at the top.
 
-## [3.0.0] — 2026-09-23
+## [3.2.0] — 2026-10-02
+
+### Added
+
+- Monad, Robinhood Chain, Arc, Plasma, Ink, Mantle, Celo and HyperEVM (`hyperevm`).
+  `get_portfolio` skips Plasma and Mantle, where Alchemy has no token API, and
+  `get_contract_abi` cannot reach Ink, which Etherscan does not index.
+- **`get_portfolio`** values a wallet across chains in one call: Alchemy finds the native and
+  ERC20 balances, DefiLlama prices them, largest first. Tokens DefiLlama cannot price are
+  left out and counted, which drops the spam airdrops that otherwise bury a wallet's real
+  holdings. Offered when `ALCHEMY_API_KEY` is set.
+- **`get_token_prices`** prices up to 25 tokens on a chain in USD, now or at a past
+  timestamp, from DefiLlama's free API — the zero address for the native token. Tokens it
+  cannot price come back as unpriced.
+- **`get_yield_pools`** lists DefiLlama's lending, staking and liquidity pools on the
+  supported chains, filtered by token, protocol, stablecoins and TVL, highest APY first.
+
+### Changed
+
+- The signing page moved from `/` to `/sign/`, leaving the root free for a host's own page.
+  Signing links in the old `/#t=…` form no longer open it. `SIGN_PATH` is exported for hosts
+  building links.
+
+### Removed
+
+- Infura: `INFURA_API_KEY` and `--infura-api-key`. Any other provider still works through
+  `CUSTOM_RPC`, chain by chain.
+- Sonic. Alchemy serves no token API there, and its DeFi activity has largely moved on.
+
+## [3.1.0] — 2026-10-01
+
+Mostly fixes, several of them for security — worth taking on any hosted server.
+
+From this release `web3-wallet-relay` shares the server's version number, jumping from 2.0.0
+to 3.1.0. The two speak one protocol that carries no version of its own, so the package
+version is what matches them: a relay hosted on its own runs at the version of the server
+pointing at it. `web3-tools-mcp` still pins it exactly.
+
+### Added
+
+- A host's `Login` can name the `credential` it checks, binding every code and token issued
+  under it so that rotating the secret revokes them, and its `page()` is told which client
+  is asking and where the code will go.
+
+### Changed
+
+- `trace_transaction`'s `traceType` is `trace`, `prestate` or `stateDiff`. `vmTrace` is gone:
+  it ran the prestate tracer under another name, and `stateDiff` asked for a tracer no node
+  has. Traces too large for an agent's context are cut short and say so.
+- `get_logs` returns at most 1,000 logs, with `truncated` and the `nextBlock` to continue
+  from. `toBlock` is inclusive on both paths, a list in `eventArgs` is an OR filter, and an
+  invalid `address` is an error rather than a filter silently dropped.
+- `get_balance`, `read_contract` and `batch_resolve_ens_names` take at most 25 items.
+- ENS tools take `mainnet`, `linea` or `base` — the chains that have a resolver — and the
+  no-op `universalResolver` parameter is gone.
+- `render.yaml` is a single service: the relay runs inside the MCP server, as on Fly.
+- Keeping OAuth state in Upstash needs per-field hash expiry (`HEXPIRE`, Redis ≥ 7.4), so
+  expired tokens no longer pile up. The file store prunes them on write.
+
+### Fixed
+
+- `send_erc20_token` no longer assumes 18 decimals. It reads them on-chain and refuses a
+  `decimals` that disagrees; a token whose decimals cannot be read needs them passed.
+- `write_contract` takes numeric arguments only as safe integers — pass a large uint or int
+  as a string — and coerces string arguments to their ABI types, as `read_contract` does.
+- `sign_message` sends the browser the message hex-encoded, as the phone gets it, so both
+  sign the same bytes. The phone signs on a chain its session approved, not mainnet.
+- Phone signing on `localhost` is refused up front: the phone has no route to that node. Use
+  the browser.
+- The signing preview names each labelled address as `Name (0x…)`, shows token amounts with
+  the token's address, and gives an amount whose decimals are unknown as the raw integer,
+  marked so, rather than assuming 18. Its summary includes `to`.
+- `get_logs` over Hypersync no longer drops the last block, reports a response cut short
+  by the server, or scans from genesis when `fromBlock` is omitted.
+- `get_error_signature` hashes tuple parameters correctly.
+- `get_gas_price` shows sub-gwei L2 prices instead of "0.00", and costs in the chain's own
+  native token.
+- An invalid, expired or replayed OAuth code or refresh token answers `invalid_grant`, not a
+  500, so connectors re-authorise instead of retrying.
+- Etherscan errors say why ("Invalid API Key", rate limit) rather than "NOTOK".
+- `npx web3-wallet-relay` starts the relay.
+
+### Security
+
+- The provider API key no longer appears in tool output.
+- `get_ens_avatar` returns the raw avatar record rather than fetching it server-side.
+- Requests carry `expiresAt`, and the signing page cancels an approval that arrives after
+  the request timed out or was disconnected. A request that failed any way but an explicit
+  rejection now reports `outcome_unknown` — it may still have been broadcast — instead of
+  `rejected_or_failed`, so an agent checks before retrying rather than paying twice.
+- The signing page is hardened against script injection and framing, with a strict CSP.
+- OAuth refresh tokens expire, and rotating `MCP_TOKEN` revokes every token issued under
+  it — existing tokens predate the binding, so single-token deployments re-authorise once.
+  The login page names the client and where it redirects, and cannot be framed.
+  `MCP_TRUST_PROXY` lets rate limiting see client addresses behind a proxy.
+- The hosted signer link is no longer written to the logs.
+
+## [3.0.0] — 2026-09-26
 
 The theme is multi-tenancy: one server can now carry several people without their wallets
 meeting. Nothing turns that on by itself — a server still authenticates its deployment
@@ -36,6 +133,22 @@ handshake changed, so a mismatched pair cannot pair at all.
   tools take `account` to choose between them, as does `disconnect_phone_wallet` — which
   still clears everything when no account is named. With one wallet paired nothing changes,
   and omitting `account` uses the most recently paired.
+- **`simulate_bundle`** runs several transactions in order in one block, each on the state
+  the last left — approve then swap, deposit then borrow. Offered with an Alchemy key.
+- **Signing requests outlive their call.** One not approved in time comes back with a
+  `requestId`, and `check_signing_request` collects it instead of a second prompt landing in
+  the wallet. A phone request returns as soon as the wallet has it, and both signers wait
+  for the receipt, reporting mined, reverted or still pending. The signing page shows every
+  request waiting, approvable in any order.
+- A host assembling its own server can mount routes, hand a pairing made under a
+  placeholder to the address it proved, and draw the pairing QR as SVG (`qrSvg`).
+- The server declares an icon, so a connector list shows more than a letter.
+- `pair_phone_wallet` warns when the same wallet app is already paired, and reports a
+  pairing the wallet ended itself.
+
+### Fixed
+
+- An ERC-721 `Transfer` reads as a token id, not as an ERC-20 transfer of nothing.
 
 ### Security
 
@@ -177,7 +290,7 @@ sign it.
   `call_contract_write` is now `write_contract` — the old pair gave no hint which one
   spent gas. The names now match viem's, and a saved prompt naming the old ones will need
   updating.
-- Every supported chain now lives in one table ([mcp/src/chains.ts](mcp/src/chains.ts)). Adding a
+- Every supported chain now lives in one table ([mcp/src/chains.ts](https://github.com/hajnalben/web3-tools-mcp/blob/main/mcp/src/chains.ts)). Adding a
   chain is a single entry; the tool schemas, RPC selection, explorer links, Hypersync
   routing and `--help` all derive from it.
 - Tool errors surface the underlying failure rather than a re-wrapped message that hid it.

package/README.md

@@ -1,16 +1,18 @@
 <div align="center">
 
-# web3-tools-mcp
+<img src="https://raw.githubusercontent.com/hajnalben/web3-tools-mcp/main/wallet-relay/public/icon.png" alt="Web3 Tools logo" width="112" height="112">
 
-**Your agent proposes the transaction. You approve it — in your own wallet, on your phone.** 📱
+# Web3 Tools MCP
 
-30 MCP tools for reading any EVM network and signing transactions in *your own* wallet.
-Every transaction is decoded, named and simulated before you approve it.
+**Everything onchain your agent needs — read, price, simulate, sign — with you holding the keys.** 🔐
+
+35 MCP tools across 19 EVM networks, signing in *your own* wallet on your phone or in the browser.
+Every transaction is decoded, named and simulated before it reaches your wallet.
 
 [![npm](https://img.shields.io/npm/v/web3-tools-mcp?color=%233856d6&label=npm)](https://www.npmjs.com/package/web3-tools-mcp)
 [![downloads](https://img.shields.io/npm/dm/web3-tools-mcp?color=%233856d6)](https://www.npmjs.com/package/web3-tools-mcp)
 [![node](https://img.shields.io/node/v/web3-tools-mcp?color=%233856d6)](https://nodejs.org)
-[![license](https://img.shields.io/npm/l/web3-tools-mcp?color=%233856d6)](LICENSE)
+[![license](https://img.shields.io/npm/l/web3-tools-mcp?color=%233856d6)](https://github.com/hajnalben/web3-tools-mcp/blob/main/LICENSE)
 
 </div>
 
@@ -22,7 +24,7 @@ One entry in that client's MCP config:
 ```
 
 Each app keeps that config somewhere different —
-[the file paths are below ↓](#-setup). You need Node.js ≥ 20; `npx` fetches the rest.
+[the file paths are below ↓](#-setup). You need Node.js ≥ 20.19; `npx` fetches the rest.
 
 **ChatGPT, Grok** and **claude.ai** cannot launch anything locally — they only reach a URL.
 [Host it once ↓](#-hosting) and add it as a connector, and there is nothing running on your
@@ -91,7 +93,7 @@ npx web3-tools-mcp --walletconnect-project-id YOUR_PROJECT_ID
 | 💾 | **It sticks.** The session is stored on disk (or in Redis when hosted), so it survives restarts and redeploys. Pair once, not once a day |
 | ✍️ | **You choose each time.** Every signing tool takes a required `signWith`, so the agent asks whether this one goes to your phone or the browser. A paired phone never quietly claims a request |
 | 🧾 | **You still see the decode.** The full preview comes back in the tool response — your wallet shows its own summary, so read ours before you approve theirs |
-| 🔌 | **Drop it any time.** `disconnect_phone_wallet` clears every session and pairing |
+| 🔌 | **Drop it any time.** `disconnect_phone_wallet` drops the wallet you name by `account`, or every session and pairing when you name none |
 
 Works with **MetaMask · Rabby · Trust · Coinbase Wallet** — anything speaking WalletConnect v2.
 
@@ -123,28 +125,36 @@ returns the page URL any time you want to open it yourself.
 ## 🧰 Tools
 
 <details>
-<summary><b>30 tools</b> — reads, writes, ENS, logs, tracing</summary>
+<summary><b>35 tools</b> — reads, writes, ENS, logs, tracing</summary>
 
 ### ✍️ Transactions & signing
 | Tool | |
 | --- | --- |
-| `write_contract` | Send a transaction calling a state-changing function, via your wallet |
+| `write_contract` | Send a transaction calling a state-changing function, via your wallet. Pass large integers as strings |
 | `send_native_token` | Send ETH or a native token |
-| `send_erc20_token` | Send an ERC-20 |
-| `sign_message` | Sign a message |
-| `wallet_status` | Which signer is connected — phone or browser |
+| `send_erc20_token` | Send an ERC-20, with decimals read on-chain — a `decimals` you pass must agree |
+| `sign_message` | Sign a message — the same bytes on either signer |
+| `check_signing_request` | Collect a request still awaiting approval, by its `requestId` |
+| `wallet_status` | Every signer and whether it is ready — phone wallets and the browser page |
 | `pair_phone_wallet` | Pair a phone over WalletConnect, returns a QR |
-| `disconnect_phone_wallet` | Drop every WalletConnect session and pairing |
+| `disconnect_phone_wallet` | Drop one paired wallet by `account`, or every session and pairing |
 
 The four signing tools take a required `signWith` of `phone` or `browser`. There is no
 default on purpose — the agent has to ask you, so a request never lands on a device you are
-not holding.
+not holding. On `localhost` only the browser can sign; a phone has no route to your node.
+With several phones paired, the optional `account` picks one by address;
+omitted, the most recently paired is used.
+
+A request not approved within the call comes back with a `requestId` instead of hanging,
+and `check_signing_request` collects it — asking again would put a second prompt in front
+of your wallet.
 
 ### 📜 Contracts
 | Tool | |
 | --- | --- |
-| `read_contract` | Read state via view/pure functions — batched, no wallet, no gas |
+| `read_contract` | Read state via view/pure functions — batched (up to 25 calls), no wallet, no gas |
 | `simulate_contract` | Simulate without broadcasting, with gas |
+| `simulate_bundle` | Simulate several transactions in order, each on the state the last left — approve → swap. Needs `ALCHEMY_API_KEY` |
 | `get_contract_abi` | ABI, with proxy detection and verification status |
 | `get_contract_source_code` | Verified source, proxies included |
 | `get_contract_source_file` | One file out of the cached source |
@@ -157,14 +167,23 @@ not holding.
 ### ⛓️ Chain data
 | Tool | |
 | --- | --- |
-| `get_balance` | Native or ERC-20 balances — batched |
-| `get_logs` | Query and decode events, with Hypersync fallback |
+| `get_balance` | Native or ERC-20 balances — batched, up to 25 queries |
+| `get_logs` | Query and decode events; Hypersync when the RPC refuses the range. At most 1,000 logs — past that it returns `truncated` and the `nextBlock` to continue from. A list in `eventArgs` matches any of its values |
 | `get_block_info` | Block data |
 | `get_storage_at` | Storage slots, with type decoding |
 | `get_gas_price` | Current gas — legacy and EIP-1559 |
 | `estimate_gas` | Gas for any transaction |
-| `trace_transaction` | Call tree, VM trace, state diff |
-| `debug_call` | Trace a call without broadcasting, falling back to a local anvil fork |
+| `trace_transaction` | Call tree, prestate or state diff |
+| `debug_call` | Trace a call without broadcasting, through a node at `ANVIL_RPC_URL` |
+| `get_portfolio` | A wallet's native and ERC-20 holdings across chains, valued in USD; tokens DefiLlama cannot price — spam, mostly — are left out. Needs `ALCHEMY_API_KEY` |
+| `get_token_prices` | USD prices from DefiLlama, now or at a past timestamp, up to 25 tokens; the zero address prices the native token |
+| `get_yield_pools` | DefiLlama yield pools by chain, token and protocol, highest APY first |
+
+Tracing prefers an RPC that exposes `debug_*`, and otherwise uses a node you already run at
+`ANVIL_RPC_URL` (default `127.0.0.1:8545`, e.g. `anvil --fork-url …`) — nothing is started
+for you. Replaying a transaction older than the fork re-forks that node, clearing its state,
+so it happens only with `ANVIL_ALLOW_RESET=1`. A hosted server has no default and traces only
+through an explicit `ANVIL_RPC_URL`.
 
 ### 🏷️ ENS
 | Tool | |
@@ -172,13 +191,15 @@ not holding.
 | `resolve_ens_name` | Name → address |
 | `reverse_resolve_ens` | Address → name |
 | `get_ens_text_record` | Text records |
-| `get_ens_avatar` | Avatar URI |
-| `batch_resolve_ens_names` | Many names at once |
+| `get_ens_avatar` | The raw avatar record — URL, data URI or NFT reference, not fetched |
+| `batch_resolve_ens_names` | Up to 25 names at once |
+
+ENS tools take `mainnet` (ENS), `linea` (Linea Names) or `base` (Basenames).
 
 </details>
 
 <details>
-<summary>🌐 <b>13 networks</b></summary>
+<summary>🌐 <b>20 networks</b></summary>
 
 | Network | Chain ID | Hypersync |
 | --- | --- | --- |
@@ -188,15 +209,22 @@ not holding.
 | Base | 8453 | ✅ |
 | BNB Chain | 56 | ✅ |
 | Gnosis | 100 | ✅ |
-| Sonic | 146 | ✅ |
 | Optimism | 10 | ✅ |
 | Polygon | 137 | ✅ |
 | zkSync Era | 324 | ✅ |
 | Linea | 59144 | ✅ |
 | Unichain | 130 | ✅ |
+| Monad | 143 | ✅ |
+| Robinhood Chain | 4663 | ✅ |
+| Arc | 5042 | ✅ |
+| Plasma | 9745 | ✅ |
+| Ink | 57073 | ✅ |
+| Mantle | 5000 | ✅ |
+| Celo | 42220 | ✅ |
+| HyperEVM | 999 | ✅ |
 | Localhost | 1337 | ❌ |
 
-Adding one is a single entry in [`mcp/src/chains.ts`](mcp/src/chains.ts).
+Adding one is a single entry in [`mcp/src/chains.ts`](https://github.com/hajnalben/web3-tools-mcp/blob/main/mcp/src/chains.ts).
 
 </details>
 
@@ -289,17 +317,17 @@ What you lose is reach, not stability — so here is the honest version:
 | Key | Free from | Without it |
 | --- | --- | --- |
 | `WALLETCONNECT_PROJECT_ID` | [walletconnect](https://dashboard.walletconnect.com) | 📱 **No phone signing at all.** Browser wallet only, so a hosted instance has no way to sign |
-| `ALCHEMY_API_KEY`<br>or `INFURA_API_KEY`<br>or `CUSTOM_RPC` | [alchemy](https://alchemy.com) · [infura](https://infura.io) | **No historical state.** Public endpoints answer `403 Archive requests require a personal token`, which takes out balances, storage and calls at a past block, event ranges, and `trace_transaction` |
+| `ALCHEMY_API_KEY`<br>or `CUSTOM_RPC` | [alchemy](https://alchemy.com) | **No historical state.** Public endpoints answer `403 Archive requests require a personal token`, which takes out balances, storage and calls at a past block, event ranges, and `trace_transaction` |
 | `ETHERSCAN_API_KEY` | [etherscan](https://etherscan.io/apis) | `get_contract_abi`, `get_contract_source_code` and `get_contract_source_file` refuse. Signing previews still decode — they try Sourcify first, then recover the ABI from bytecode |
-| `HYPERSYNC_API_KEY` | [envio](https://envio.dev) | Event queries fall back to plain RPC — slower, and past ranges then need one of the provider keys above |
+| `HYPERSYNC_API_KEY` | [envio](https://envio.dev) | `get_logs` asks the RPC first and falls back to Hypersync when the RPC refuses the range. Without a token that fallback is gone, so wide or past ranges depend on your provider's limits |
 
 So with nothing configured you get current balances, contract reads, gas, ENS, simulation
 and browser signing. Add `WALLETCONNECT_PROJECT_ID` for your phone and one provider key for
 history, and everything above lights up.
 
 Every key has a matching flag (`--etherscan-api-key`, …), RPC selection falls back
-Alchemy → Infura → public, and `CUSTOM_RPC` overrides all of it.
-`npx web3-tools-mcp --help` lists them; [.env.example](.env.example) documents each one.
+Alchemy → public, and `CUSTOM_RPC` overrides both, chain by chain.
+`npx web3-tools-mcp --help` lists them; [.env.example](https://github.com/hajnalben/web3-tools-mcp/blob/main/.env.example) documents each one.
 
 ```bash
 npx web3-tools-mcp --etherscan-api-key KEY --walletconnect-project-id ID
@@ -319,26 +347,34 @@ transaction at your phone.
 <a href="https://fly.io/docs/launch/"><img src="https://img.shields.io/badge/Deploy%20on-Fly.io-8b5cf6?style=for-the-badge&logo=flydotio&logoColor=white" alt="Deploy on Fly.io" height="32"></a>
 
 **Render** reads `render.yaml`, generates `MCP_TOKEN` and asks for `WALLETCONNECT_PROJECT_ID`
-— genuinely one click.
+— one click, on a paid `starter` instance with a 1 GB disk so it stays awake and keeps the
+pairing. `MCP_PUBLIC_URL` defaults to the service's `onrender.com` address; set it only for a
+custom domain.
 
 **Fly** ships no deploy button, so it is four commands. Worth it for a personal instance:
 volumes come with any plan, so the pairing survives redeploys without paying for a disk.
 
 ```bash
-fly launch --no-deploy --copy-config
+fly launch --no-deploy --copy-config   # then set MCP_PUBLIC_URL in fly.toml to https://<app>.fly.dev
 fly volumes create data --size 1
 fly secrets set MCP_TOKEN=$(openssl rand -hex 24) WALLETCONNECT_PROJECT_ID=<id>
 fly deploy
 ```
 
+Without the right `MCP_PUBLIC_URL` the OAuth metadata and the wallet links point somewhere
+clients cannot reach. Both `fly.toml` and `render.yaml` set `MCP_TRUST_PROXY=1`, so rate
+limiting sees client addresses rather than the platform's proxy.
+
 <details>
 <summary>🐳 <b>Docker, and connecting a client</b></summary>
 
 There is a plain `Dockerfile` too, so Railway, Cloud Run or your own box work the same way:
 
 ```bash
+docker build -t web3-tools-mcp .
 docker run -p 8080:8080 \
   -e MCP_TOKEN=<long random string> \
+  -e MCP_PUBLIC_URL=https://your-host \
   -e WALLETCONNECT_PROJECT_ID=<id> \
   web3-tools-mcp
 ```
@@ -352,54 +388,54 @@ claude mcp add --transport http web3-tools https://your-host/mcp \
 
 Clients that cannot send a header — claude.ai connectors, and the browser and phone apps —
 use OAuth, which the server implements against the same credential: it shows a page asking
-for `MCP_TOKEN` and issues a token once you paste it. No identity provider, no accounts. Set
-`MCP_PUBLIC_URL` to the address clients reach you on, since OAuth metadata must advertise it.
+for `MCP_TOKEN` and issues a token once you paste it. No identity provider, no accounts.
 
 > 🔐 **`MCP_TOKEN` is mandatory** and the server refuses to start without it. Anyone who
 > reaches `/mcp` while your phone is paired can push signing prompts at it. You would still
 > approve each one, but that is a phishing surface, not a feature.
 
+| Variable | |
+| --- | --- |
+| `MCP_HTTP_PORT` | Serve over HTTP on this port instead of stdio. Also switches on the hosted guards: no `localhost` chain, no loopback tracing node |
+| `MCP_HTTP_HOST` | Bind address, default `0.0.0.0` |
+| `MCP_TOKEN` | The one credential, as a bearer header or through OAuth. Changing it revokes every OAuth token issued against the old one |
+| `MCP_PUBLIC_URL` | The address clients reach you on — advertised in OAuth metadata and used for wallet links |
+| `MCP_TRUST_PROXY` | Reverse-proxy hops to trust for client IPs in rate limiting. `1` behind Fly or Render; off by default |
+| `MCP_HOSTED` | The hosted guards without `MCP_HTTP_PORT`, for a host assembling its own server from the library |
+| `XDG_CONFIG_HOME` | Where pairings, OAuth tokens and the relay token are stored, under `web3-tools-mcp/` |
+| `UPSTASH_REDIS_REST_URL`<br>`UPSTASH_REDIS_REST_TOKEN` | Keep sessions and tokens in Redis instead. Needs per-field hash expiry (`HEXPIRE`: Upstash, or Redis ≥ 7.4) |
+| `WALLET_TOKEN` | Relay secret. Unset, a hosted server mints one per boot |
+| `WALLET_SERVER_URL` | A separately hosted relay, below |
+| `ANVIL_RPC_URL`<br>`ANVIL_ALLOW_RESET` | Tracing node, and whether it may be re-forked — see Tools |
+
 Two things decide whether the pairing survives:
 
 - ⏰ **Keep the instance awake.** Sleeping drops the WalletConnect socket, so the first
   transaction after an idle period waits for the host to wake — about a minute on a free tier.
 - 💾 **Give the session somewhere durable.** Most hosts have an ephemeral filesystem, so a
   plain file is lost on redeploy and you rescan the QR. Attach a volume and point
-  `XDG_CONFIG_HOME` at it (what `render.yaml` does), or set `UPSTASH_REDIS_REST_URL` and
-  `UPSTASH_REDIS_REST_TOKEN` ([Upstash](https://upstash.com) has a free plan).
+  `XDG_CONFIG_HOME` at it (what `render.yaml` and `fly.toml` do), or set
+  `UPSTASH_REDIS_REST_URL` and `UPSTASH_REDIS_REST_TOKEN` ([Upstash](https://upstash.com)
+  has a free plan).
 
 Render's free Key Value instance is not an option here — no persistence, so the pairing
 disappears at its next maintenance.
 
 Both signers work on a hosted instance. The signing page is served from the same port as
-`/mcp`, so `https://your-host/#t=<relay token>` is your wallet page — no second service to
-deploy. Ask the agent for `wallet_status` to get the link; it is behind `MCP_TOKEN`, and the
-relay token is minted fresh each boot rather than stored, so the URL changes when you
-redeploy.
+`/mcp`, so `https://your-host/sign/#t=<relay token>` is your wallet page — no second service to
+deploy. The root is left free for a page of your own. Ask the agent for `wallet_status` to get the link; it is behind `MCP_TOKEN` and never written to the logs. Unless
+you set `WALLET_TOKEN`, the relay secret is minted fresh each boot rather than stored, so the
+URL changes when you redeploy.
 
 </details>
 
 <details>
 <summary>🖇️ <b>Host the signing page</b> separately</summary>
 
-The relay is its own package, [`wallet-relay/`](wallet-relay) — express, cors and ws, about
-4 MB installed against ~180 MB for the server. It runs anywhere that keeps a Node process
-alive and supports WebSockets.
-
-```bash
-WALLET_TOKEN=<long random string> \
-WALLET_PUBLIC_URL=https://wallet.example.com \
-npx web3-wallet-relay
-```
-
-Then point the server at it with `WALLET_SERVER_URL` and the same `WALLET_TOKEN`.
-`render.yaml` deploys it as-is. Anyone holding `WALLET_TOKEN` can send your browser a
-transaction to sign — treat it like a password, and always serve over HTTPS.
-
-The pairing link the server prints carries a different token, derived from that one, which
-can only answer signing requests and not make them. Sharing a pairing link is therefore not
-the same as sharing `WALLET_TOKEN` — but it still lets whoever has it act as your wallet
-page, so a signing request can reach them instead of you.
+The relay is its own package, [`web3-wallet-relay`](https://github.com/hajnalben/web3-tools-mcp/tree/main/wallet-relay),
+and runs anywhere that keeps a Node process alive and supports WebSockets. Its README covers
+hosting it; run it at this server's version, then point the server at it with
+`WALLET_SERVER_URL` and the same `WALLET_TOKEN`.
 
 Locally nothing changes: the server embeds the same relay.
 
@@ -421,11 +457,11 @@ npm run typecheck
 npm test
 ```
 
-Two workspaces: [`mcp/`](mcp) is this server, [`wallet-relay/`](wallet-relay) is the signing
-page. [CONTRIBUTING.md](CONTRIBUTING.md) covers running a checkout against a client, the
-layout, and how to add a chain or a tool. Releases: [CHANGELOG.md](CHANGELOG.md).
+Two workspaces: [`mcp/`](https://github.com/hajnalben/web3-tools-mcp/tree/main/mcp) is this server, [`wallet-relay/`](https://github.com/hajnalben/web3-tools-mcp/tree/main/wallet-relay) is the signing
+page. [CONTRIBUTING.md](https://github.com/hajnalben/web3-tools-mcp/blob/main/CONTRIBUTING.md) covers running a checkout against a client, the
+layout, and how to add a chain or a tool. Releases: [CHANGELOG.md](https://github.com/hajnalben/web3-tools-mcp/blob/main/CHANGELOG.md).
 
-Requires Node.js ≥ 20.
+Requires Node.js ≥ 20.19.
 
 ## 📄 License
 

package/dist/chain-meta.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"chain-meta.d.ts","sourceRoot":"","sources":["../src/chain-meta.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,KAAK,GAAG,EAA8B,MAAM,MAAM,CAAA;AAE3D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAW3C,wBAAsB,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM;SAJvB,GAAG;YAAU,UAAU,GAAG,SAAS;YAAU,MAAM;WAAS,MAAM;GAqCzG;AAED,wBAAsB,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM;aArClB,MAAM;eAAa,MAAM;GAyDrE;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAmBjG;AAED,wEAAwE;AACxE,eAAO,MAAM,WAAW,QAAoB,CAAA;AAC5C,eAAO,MAAM,mBAAmB,QAAmB,CAAA"}
+{"version":3,"file":"chain-meta.d.ts","sourceRoot":"","sources":["../src/chain-meta.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,KAAK,GAAG,EAA8B,MAAM,MAAM,CAAA;AAE3D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAiB3C,wBAAsB,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM;SAP1B,GAAG;YAAU,UAAU,GAAG,SAAS;YAAU,MAAM;WAAS,MAAM;GAwCtG;AAED,wBAAsB,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM;aAxCrB,MAAM;eAAa,MAAM;GA6DlE;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAqBjG;AAED,wEAAwE;AACxE,eAAO,MAAM,WAAW,QAAoB,CAAA;AAC5C,eAAO,MAAM,mBAAmB,QAAmB,CAAA"}

package/dist/chain-meta.js

@@ -6,13 +6,18 @@
 import { whatsabi } from '@shazow/whatsabi';
 import { parseAbiItem } from 'viem';
 import { getClientManager } from './client.js';
+import { TtlCache } from './utils.js';
 const ERC20_META_ABI = [
     parseAbiItem('function decimals() view returns (uint8)'),
     parseAbiItem('function symbol() view returns (string)')
 ];
-const abiCache = new Map();
-const labelCache = new Map();
-const metaCache = new Map();
+// An hour covers a session's repeats while still noticing an upgraded proxy.
+const TTL_MS = 60 * 60 * 1000;
+const abiCache = new TtlCache(200, TTL_MS);
+const labelCache = new TtlCache(1000, TTL_MS);
+const metaCache = new TtlCache(1000, TTL_MS);
+/** A local node is reset and redeployed at will, so nothing learned from it stays true. */
+const cacheable = (chain) => chain !== 'localhost';
 export async function loadAbi(chain, address) {
     const key = `${chain}:${address.toLowerCase()}`;
     const cached = abiCache.get(key);
@@ -41,7 +46,8 @@ export async function loadAbi(chain, address) {
         proxy: result.address !== address ? result.address : undefined,
         name: result.contractResult?.name ?? undefined
     };
-    abiCache.set(key, loaded);
+    if (cacheable(chain))
+        abiCache.set(key, loaded);
     return loaded;
 }
 export async function tokenMeta(chain, token) {
@@ -61,7 +67,9 @@ export async function tokenMeta(chain, token) {
         decimals: decimals.status === 'success' ? Number(decimals.result) : undefined,
         symbol: symbol.status === 'success' ? symbol.result : undefined
     };
-    metaCache.set(key, meta);
+    // A failed call may be a flaky RPC rather than a token without that method.
+    if (cacheable(chain) && decimals.status === 'success' && symbol.status === 'success')
+        metaCache.set(key, meta);
     return meta;
 }
 /**
@@ -71,8 +79,9 @@ export async function tokenMeta(chain, token) {
  */
 export async function addressLabel(chain, address) {
     const key = `${chain}:${address.toLowerCase()}`;
-    if (labelCache.has(key))
-        return labelCache.get(key);
+    const cached = labelCache.get(key);
+    if (cached)
+        return cached.label;
     let label;
     try {
         const code = await getClientManager()
@@ -86,8 +95,10 @@ export async function addressLabel(chain, address) {
     }
     catch {
         // Unknown address — show it bare rather than failing the preview.
+        return undefined;
     }
-    labelCache.set(key, label);
+    if (cacheable(chain))
+        labelCache.set(key, { label });
     return label;
 }
 /** uint256 max and anything near it means "infinite" in an approval. */

package/dist/chain-meta.js.map

@@ -1 +1 @@
-{"version":3,"file":"chain-meta.js","sourceRoot":"","sources":["../src/chain-meta.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAA0B,YAAY,EAAE,MAAM,MAAM,CAAA;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAG9C,MAAM,cAAc,GAAG;IACrB,YAAY,CAAC,0CAA0C,CAAC;IACxD,YAAY,CAAC,yCAAyC,CAAC;CACxD,CAAA;AAED,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAuF,CAAA;AAC/G,MAAM,UAAU,GAAG,IAAI,GAAG,EAA8B,CAAA;AACxD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkD,CAAA;AAE3E,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,KAAgB,EAAE,OAAe;IAC7D,MAAM,GAAG,GAAG,GAAG,KAAK,IAAI,OAAO,CAAC,WAAW,EAAE,EAAE,CAAA;IAC/C,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAChC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAA;IAEzB,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAA;IACxC,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IAC7C,MAAM,eAAe,GAAG,aAAa,CAAC,SAAS,EAAE,CAAC,eAAe,CAAA;IAEjE,MAAM,OAAO,GAAiC;QAC5C,IAAI,QAAQ,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,aAAa,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;KACrF,CAAA;IACD,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,aAAa,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAA;IAChI,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,OAAkB,EAAE;QACzD,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,IAAI,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC;QACvD,eAAe,EAAE,IAAI,QAAQ,CAAC,OAAO,CAAC,wBAAwB,EAAE;QAChE,aAAa,EAAE,IAAI;KACpB,CAAC,CAAA;IAEF,mEAAmE;IACnE,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAA;IAC/H,MAAM,MAAM,GAAG;QACb,GAAG,EAAE,MAAM,CAAC,GAAU;QACtB,MAAM,EAAE,MAAgC;QACxC,KAAK,EAAE,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;QAC9D,IAAI,EAAE,MAAM,CAAC,cAAc,EAAE,IAAI,IAAI,SAAS;KAC/C,CAAA;IACD,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IACzB,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAgB,EAAE,KAAa;IAC7D,MAAM,GAAG,GAAG,GAAG,KAAK,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAA;IAC7C,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACjC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAA;IAEzB,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IAClD,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC;QAChD,SAAS,EAAE;YACT,EAAE,OAAO,EAAE,KAAgB,EAAE,GAAG,EAAE,cAAc,EAAE,YAAY,EAAE,UAAU,EAAE;YAC5E,EAAE,OAAO,EAAE,KAAgB,EAAE,GAAG,EAAE,cAAc,EAAE,YAAY,EAAE,QAAQ,EAAE;SAC3E;QACD,GAAG,CAAC,KAAK,KAAK,WAAW,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;KACnD,CAAC,CAAA;IAEF,MAAM,IAAI,GAAG;QACX,QAAQ,EAAE,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;QAC7E,MAAM,EAAE,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAE,MAAM,CAAC,MAAiB,CAAC,CAAC,CAAC,SAAS;KAC5E,CAAA;IACD,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACxB,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAgB,EAAE,OAAe;IAClE,MAAM,GAAG,GAAG,GAAG,KAAK,IAAI,OAAO,CAAC,WAAW,EAAE,EAAE,CAAA;IAC/C,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAEnD,IAAI,KAAyB,CAAA;IAC7B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE;aAClC,SAAS,CAAC,KAAK,CAAC;aAChB,WAAW,CAAC,EAAE,OAAO,EAAE,OAAkB,EAAE,CAAC,CAAA;QAC/C,IAAI,IAAI,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAC1B,KAAK,GAAG,CAAC,MAAM,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;YACrF,IAAI,CAAC,KAAK;gBAAE,KAAK,GAAG,CAAC,MAAM,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;QAC1D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;IACpE,CAAC;IAED,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAC1B,OAAO,KAAK,CAAA;AACd,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAA;AAC5C,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,GAAG,EAAE,CAAA"}
+{"version":3,"file":"chain-meta.js","sourceRoot":"","sources":["../src/chain-meta.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAA0B,YAAY,EAAE,MAAM,MAAM,CAAA;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAE9C,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAErC,MAAM,cAAc,GAAG;IACrB,YAAY,CAAC,0CAA0C,CAAC;IACxD,YAAY,CAAC,yCAAyC,CAAC;CACxD,CAAA;AAED,6EAA6E;AAC7E,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAC7B,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAA8E,GAAG,EAAE,MAAM,CAAC,CAAA;AACvH,MAAM,UAAU,GAAG,IAAI,QAAQ,CAAqB,IAAI,EAAE,MAAM,CAAC,CAAA;AACjE,MAAM,SAAS,GAAG,IAAI,QAAQ,CAAyC,IAAI,EAAE,MAAM,CAAC,CAAA;AAEpF,2FAA2F;AAC3F,MAAM,SAAS,GAAG,CAAC,KAAgB,EAAE,EAAE,CAAC,KAAK,KAAK,WAAW,CAAA;AAE7D,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,KAAgB,EAAE,OAAe;IAC7D,MAAM,GAAG,GAAG,GAAG,KAAK,IAAI,OAAO,CAAC,WAAW,EAAE,EAAE,CAAA;IAC/C,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAChC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAA;IAEzB,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAA;IACxC,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IAC7C,MAAM,eAAe,GAAG,aAAa,CAAC,SAAS,EAAE,CAAC,eAAe,CAAA;IAEjE,MAAM,OAAO,GAAiC;QAC5C,IAAI,QAAQ,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,aAAa,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;KACrF,CAAA;IACD,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,aAAa,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAA;IAChI,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,OAAkB,EAAE;QACzD,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,IAAI,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC;QACvD,eAAe,EAAE,IAAI,QAAQ,CAAC,OAAO,CAAC,wBAAwB,EAAE;QAChE,aAAa,EAAE,IAAI;KACpB,CAAC,CAAA;IAEF,mEAAmE;IACnE,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAA;IAC/H,MAAM,MAAM,GAAG;QACb,GAAG,EAAE,MAAM,CAAC,GAAU;QACtB,MAAM,EAAE,MAAgC;QACxC,KAAK,EAAE,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;QAC9D,IAAI,EAAE,MAAM,CAAC,cAAc,EAAE,IAAI,IAAI,SAAS;KAC/C,CAAA;IACD,IAAI,SAAS,CAAC,KAAK,CAAC;QAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAC/C,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAgB,EAAE,KAAa;IAC7D,MAAM,GAAG,GAAG,GAAG,KAAK,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAA;IAC7C,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACjC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAA;IAEzB,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IAClD,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC;QAChD,SAAS,EAAE;YACT,EAAE,OAAO,EAAE,KAAgB,EAAE,GAAG,EAAE,cAAc,EAAE,YAAY,EAAE,UAAU,EAAE;YAC5E,EAAE,OAAO,EAAE,KAAgB,EAAE,GAAG,EAAE,cAAc,EAAE,YAAY,EAAE,QAAQ,EAAE;SAC3E;QACD,GAAG,CAAC,KAAK,KAAK,WAAW,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;KACnD,CAAC,CAAA;IAEF,MAAM,IAAI,GAAG;QACX,QAAQ,EAAE,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;QAC7E,MAAM,EAAE,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAE,MAAM,CAAC,MAAiB,CAAC,CAAC,CAAC,SAAS;KAC5E,CAAA;IACD,4EAA4E;IAC5E,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;QAAE,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAC9G,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAgB,EAAE,OAAe;IAClE,MAAM,GAAG,GAAG,GAAG,KAAK,IAAI,OAAO,CAAC,WAAW,EAAE,EAAE,CAAA;IAC/C,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAClC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,KAAK,CAAA;IAE/B,IAAI,KAAyB,CAAA;IAC7B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE;aAClC,SAAS,CAAC,KAAK,CAAC;aAChB,WAAW,CAAC,EAAE,OAAO,EAAE,OAAkB,EAAE,CAAC,CAAA;QAC/C,IAAI,IAAI,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAC1B,KAAK,GAAG,CAAC,MAAM,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;YACrF,IAAI,CAAC,KAAK;gBAAE,KAAK,GAAG,CAAC,MAAM,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;QAC1D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;QAClE,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,IAAI,SAAS,CAAC,KAAK,CAAC;QAAE,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;IACpD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAA;AAC5C,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,GAAG,EAAE,CAAA"}