Price & token sources: The Forge as a built-in token index

[awizardxch]

Depends on #897 (Price & token sources). Review that one first; this PR is the single commit on top of it.

Problem

Many CATs trade only in AMM pools, with no order book on Dexie. Dexie has no last_price for them, so Sage values them at $0. The liquidity tokens those pools mint aren't registered with Dexie, so Sage shows them as "Unknown CAT". After #897 a user can fix this by adding a token index by hand, but that requires knowing that an index exists and pasting its URL.

Change

The Forge (forge.awizard.dev, an AMM for Chia CATs) becomes a built-in source in the Price & Token Sources list, beside Dexie and CoinGecko:

Source	Provides	Default
Dexie	CAT prices; names and icons (saved in the wallet)	On, first
CoinGecko	XCH/USD rate	On, second
The Forge	CAT prices from its AMM pools (with liquidity), names, tickers and icons for Forge-traded CATs and Forge LP tokens	On, third

Because it comes after Dexie and CoinGecko, it only fills what they lack. A CAT that Dexie prices keeps Dexie's price, and the XCH/USD rate stays CoinGecko's. The Forge's names, tickers and icons are display-only suggestions for what a token lacks, under the same rules as any token index in #897. They never replace a value the wallet has and are never written to it. The user can turn The Forge off or move it like any other source.

It reads the same token index format (version 1) as a custom source, at a URL that depends on the network:

• mainnet: https://forge.awizard.dev/token-index/v1/mainnet.json
• testnet11: https://forge.awizard.dev/token-index/v1/testnet11.json

A source list saved before this source existed gains it in the same place, after Dexie and CoinGecko, switched on.

The diff is one source entry in src/lib/priceSources.ts (name, homepage, a URL per network) and its tests in src/lib/priceSources.test.ts. The Settings row, fetching, validation and priority all come from #897.

Why on by default

This adds a default host, which is a fair thing to question, so here is the reasoning:

• Cost to the user: one GET per minute, on the price refresh Sage already runs. No key, no cookie, no wallet data and no query string: the URL is the same for every user. The response is about 11 KB (31 CATs today).
• Cost to the host: the index is served from Vercel's edge with Cache-Control: public, max-age=60, s-maxage=300, stale-while-revalidate=86400, so wallets' polls are answered by the CDN (X-Vercel-Cache: HIT after the first call), not by the Forge's servers. CORS is *.
• Failure is silent: if the host is down, slow or returns something invalid, the fetch fails on its own. Sage keeps the last good copy (or nothing) and shows what it shows today. Dexie and CoinGecko are never affected.
• It only fills gaps: being third means it can't change a value Sage shows today. It only adds values where Sage currently shows $0 or "Unknown CAT".

If maintainers would rather not add a default host, it's a one-line change (enabledByDefault: false). The Forge would then still be listed, ready to switch on, without making a request until the user does. Happy to switch it.

How to test

1. pnpm test:unit (src/lib/priceSources.test.ts), pnpm lint, pnpm tsc -b.
2. Fresh profile: Settings → Network → Price & Token Sources lists Dexie, CoinGecko and The Forge, all on, in that order. The network tab shows one GET to forge.awizard.dev/token-index/v1/mainnet.json per refresh (testnet11.json on testnet), beside the Dexie and CoinGecko requests.
3. Hold a CAT that trades on the Forge but has no Dexie price: it now has a USD value. Hold a CAT that Dexie prices: its price is unchanged.
4. Hold a Forge LP token: it shows as "FLP - …" with the Forge icon instead of "Unknown CAT". Rename it: your name is shown.
5. Turn The Forge off: its request stops, and those values and suggestions disappear.
6. With a source list saved from Price & token sources: list, order and extend where Sage reads prices #897 (for example, a custom index added), update to this branch: The Forge appears after Dexie and CoinGecko and before the custom index.
7. Block forge.awizard.dev (or go offline): Sage shows what it shows without the source, with only a console warning.

🤖 Generated with Claude Code

[awizardxch]

A note on the red checks: the two iOS jobs and Android fail at the signing step, because GitHub doesn't pass this repo's signing secrets to a PR from a fork. The iOS log shows APPLE_CERTIFICATE empty and xcodebuild: error: The flag -authenticationKeyID is required when specifying -authenticationKeyPath; the Android log writes an empty keyAlias, password and keystore.jks. Every job that builds or tests the code passes: Tests, Linux x64 and ARM, Windows x64 and ARM, macOS and Validate package.