@1sat/cli 0.0.125 → 0.0.126

package/dist/cli.js

@@ -1486,15 +1486,15 @@ var init_help = __esm(() => {
     {
       group: "Server",
       name: "serve",
-      description: "Run unified host server (storage + accounts + paymail + messagebox) and/or monitor (config under server.* in config.json)",
+      description: "Run unified host server (accounts + paymail + messagebox), wallet storage server and/or monitor (config under server.* in config.json)",
       subcommands: [
         {
           name: "(no subcommand)",
           description: "Host server + monitor daemon"
         },
         {
-          name: "wallet",
-          description: "Wallet storage server only (BRC-100 HTTP)"
+          name: "storage",
+          description: "Wallet storage server only (wallet-toolbox StorageServer, BRC-100 HTTP)"
         },
         { name: "monitor", description: "Monitor daemon only" },
         {
@@ -3615,7 +3615,9 @@ async function remoteAdd(args, opts) {
   });
   const config = loadConfig();
   try {
-    const client = new StorageClient(walletResult.wallet, url);
+    const client = new StorageClient(walletResult.wallet, url, {
+      binaryRequests: true
+    });
     await walletResult.storage.addWalletStorageProvider(client);
     if (!walletResult.storage.isActiveEnabled) {
       const localKey = config.storageIdentityKey ?? "1sat-cli-default";
@@ -4183,8 +4185,9 @@ import {
   KnexHandleCertStore,
   KnexPendingStore,
   createHostServer,
-  createWalletServer
+  createStorageServer
 } from "@1sat/wallet-server";
+import { StorageProvider } from "@bsv/wallet-toolbox";
 import { initLogger as initLogger2 } from "evlog";
 import knexLib from "knex";
 async function handleServeCommand(args, opts) {
@@ -4216,7 +4219,7 @@ function resolveMode(subcommand) {
   if (!subcommand)
     return "all";
   switch (subcommand) {
-    case "wallet":
+    case "storage":
     case "monitor":
     case "wallet-api":
       return subcommand;
@@ -4321,9 +4324,18 @@ async function runWithStorage(resolved, mode) {
       }
     };
   }
+  if (mode === "storage") {
+    const server = startStorageServer(resolved, walletResult);
+    return {
+      stop: async () => {
+        await server.close();
+        await walletResult.destroy();
+      }
+    };
+  }
   const runMonitor = mode === "monitor" || mode === "all" && resolved.monitorEnabled;
   const accounts = mode === "monitor" ? undefined : await buildAccountsForServer(resolved, walletResult);
-  const serverHandle = mode === "monitor" ? undefined : await startWalletServer(resolved, walletResult, accounts, mode);
+  const serverHandle = mode === "monitor" ? undefined : await startWalletServer(resolved, walletResult, accounts);
   if (runMonitor) {
     const r = resolved.repricer;
     const targets = [];
@@ -4376,29 +4388,29 @@ async function runWithStorage(resolved, mode) {
     }
   };
 }
-async function startWalletServer(resolved, walletResult, accounts, mode) {
-  const config = loadConfig();
-  const sessionStoreCfg = config.server?.sessionStore;
-  const sessionStore = sessionStoreCfg?.redisUrl ? {
-    redisUrl: sessionStoreCfg.redisUrl,
-    ttlSeconds: sessionStoreCfg.ttlSeconds
-  } : undefined;
-  if (mode === "wallet") {
-    const handle2 = createWalletServer({
-      wallet: walletResult.wallet,
-      storage: walletResult.getActiveStorage(),
-      serverIdentityKey: walletResult.wallet.identityKey,
-      listen: { port: resolved.port, host: resolved.host },
-      publicPath: "/",
-      internalPath: null,
-      accounts: accounts?.walletServerAccounts,
-      sessionStore
-    });
-    const port2 = await handle2.start();
-    const notes2 = [resolved.accounts.enabled ? "accounts: on" : ""].filter(Boolean).join(", ");
-    console.log(`[wallet] listening on ${resolved.host}:${port2}${notes2 ? ` (${notes2})` : ""}`);
-    return { stop: () => handle2.stop() };
+function resolveSessionStore(config) {
+  const sessionStore = config.server?.sessionStore;
+  return sessionStore?.redisUrl ? { redisUrl: sessionStore.redisUrl, ttlSeconds: sessionStore.ttlSeconds } : undefined;
+}
+function startStorageServer(resolved, walletResult) {
+  const storage = walletResult.getActiveStorage();
+  if (!(storage instanceof StorageProvider)) {
+    fatal("serve storage needs local storage active; activeRemote is set.");
   }
+  const config = loadConfig();
+  const server = createStorageServer({
+    storage,
+    wallet: walletResult.wallet,
+    listen: { port: resolved.port, host: resolved.host },
+    sessionStore: resolveSessionStore(config),
+    trustProxy: config.server?.trustProxy
+  });
+  server.start();
+  return server;
+}
+async function startWalletServer(resolved, walletResult, accounts) {
+  const config = loadConfig();
+  const sessionStore = resolveSessionStore(config);
   const serverCfg = config.server ?? {};
   const paymailCfg = serverCfg.paymail;
   const messageboxCfg = serverCfg.messagebox;
@@ -4596,7 +4608,7 @@ var init_social = __esm(() => {
 // src/commands/storage.ts
 import { join as join7 } from "node:path";
 import { StorageBunSqlite, nominateInvalidReqs } from "@1sat/wallet-node";
-import { StorageProvider } from "@bsv/wallet-toolbox";
+import { StorageProvider as StorageProvider2 } from "@bsv/wallet-toolbox";
 async function handleStorageCommand(args, opts) {
   const [subcommand, ...rest] = args;
   switch (subcommand) {
@@ -4653,14 +4665,14 @@ async function openServeStorage(opts) {
   const config = loadConfig();
   const chain = opts.chain ?? config.chain ?? "main";
   const storageConfig = config.server?.storage ?? { provider: "bun-sqlite" };
-  const baseOptions = StorageProvider.createStorageBaseOptions(chain);
+  const baseOptions = StorageProvider2.createStorageBaseOptions(chain);
   let storage;
   if (storageConfig.provider === "pg") {
     if (!storageConfig.dbUrl) {
       fatal("server.storage.provider is pg but server.storage.dbUrl is not set.");
     }
-    const { StoragePg } = await import("@1sat/wallet-node");
-    storage = new StoragePg({ ...baseOptions, dbUrl: storageConfig.dbUrl });
+    const { StorageKnexPg } = await import("@1sat/wallet-node");
+    storage = new StorageKnexPg({ ...baseOptions, dbUrl: storageConfig.dbUrl });
   } else {
     storage = new StorageBunSqlite({
       ...baseOptions,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1sat/cli",
-  "version": "0.0.125",
+  "version": "0.0.126",
   "description": "CLI for 1Sat Ordinals SDK",
   "type": "module",
   "main": "./dist/cli.js",
@@ -27,15 +27,15 @@
   ],
   "license": "MIT",
   "dependencies": {
-    "@1sat/actions": "0.0.228",
-    "@1sat/client": "0.0.57",
+    "@1sat/actions": "0.0.229",
+    "@1sat/client": "0.0.58",
     "@1sat/types": "0.0.49",
-    "@1sat/wallet": "0.0.114",
-    "@1sat/wallet-node": "0.0.81",
-    "@1sat/wallet-server": "0.0.59",
+    "@1sat/wallet": "0.0.115",
+    "@1sat/wallet-node": "0.0.82",
+    "@1sat/wallet-server": "0.0.60",
     "@bopen-io/messagebox-server": "^1.3.2",
     "@bsv/sdk": "^2.6.0",
-    "@bsv/wallet-toolbox": "^2.14.4",
+    "@bsv/wallet-toolbox": "npm:@bopen-io/wallet-toolbox@2.14.5",
     "@clack/prompts": "^0.8.0",
     "bitcoin-backup": "^0.0.11",
     "chalk": "^5.0.0",

package/src/commands/remote.ts

@@ -84,7 +84,9 @@ async function remoteAdd(args: string[], opts: GlobalFlags): Promise<void> {
 	const config = loadConfig()
 
 	try {
-		const client = new StorageClient(walletResult.wallet, url)
+		const client = new StorageClient(walletResult.wallet, url, {
+			binaryRequests: true,
+		})
 		await walletResult.storage.addWalletStorageProvider(client)
 
 		// When adding a backup, the remote may report itself as "active" which

package/src/commands/serve.ts

@@ -1,8 +1,8 @@
 /**
  * `1sat serve` command — launch the unified host server and/or monitor.
  *
- *   1sat serve              Host server (storage + accounts + paymail + messagebox) + monitor
- *   1sat serve wallet       Wallet storage server only
+ *   1sat serve              Host server (accounts + paymail + messagebox) + monitor
+ *   1sat serve storage      Wallet storage server only (wallet-toolbox StorageServer)
  *   1sat serve monitor      Monitor daemon only
  *   1sat serve wallet-api   App-facing BRC-100 endpoint (headless; grants come from `1sat permissions`)
  *
@@ -29,14 +29,17 @@ import {
 	KnexAccountStore,
 	KnexHandleCertStore,
 	KnexPendingStore,
+	type WalletServerAccounts,
 	createHostServer,
-	createWalletServer,
+	createStorageServer,
 } from '@1sat/wallet-server'
 import type { PrivateKey } from '@bsv/sdk'
+import { StorageProvider } from '@bsv/wallet-toolbox'
 import { initLogger } from 'evlog'
 import knexLib from 'knex'
 import type { GlobalFlags } from '../args.js'
 import {
+	type OneSatCliConfig,
 	type RepricerConfig,
 	type ServerAccountsConfig,
 	type ServerMessageboxConfig,
@@ -68,7 +71,7 @@ const DEFAULT_SATS_PER_UNIT = 1_000_000
 const DEFAULT_DURATION_BLOCKS = 4383
 const DEFAULT_STORAGE_IDENTITY_KEY = '1sat-cli-default'
 
-type ServeMode = 'all' | 'wallet' | 'monitor' | 'wallet-api'
+type ServeMode = 'all' | 'storage' | 'monitor' | 'wallet-api'
 
 interface ResolvedServe {
 	chain: 'main' | 'test'
@@ -132,7 +135,7 @@ export async function handleServeCommand(
 function resolveMode(subcommand: string | undefined): ServeMode | null {
 	if (!subcommand) return 'all'
 	switch (subcommand) {
-		case 'wallet':
+		case 'storage':
 		case 'monitor':
 		case 'wallet-api':
 			return subcommand
@@ -286,9 +289,21 @@ async function runWithStorage(
 		}
 	}
 
-	// One active monitor per deployment: wallet mode never runs it, monitor
-	// mode always does, all mode runs it unless server.monitor.enabled=false
-	// (set on redundant host instances that share a dedicated serve monitor).
+	// storage serves only the wallet-toolbox StorageServer: no accounts, no
+	// monitor.
+	if (mode === 'storage') {
+		const server = startStorageServer(resolved, walletResult)
+		return {
+			stop: async () => {
+				await server.close()
+				await walletResult.destroy()
+			},
+		}
+	}
+
+	// One active monitor per deployment: monitor mode always runs it, all mode
+	// runs it unless server.monitor.enabled=false (set on redundant host
+	// instances that share a dedicated serve monitor).
 	const runMonitor =
 		mode === 'monitor' || (mode === 'all' && resolved.monitorEnabled)
 
@@ -300,7 +315,7 @@ async function runWithStorage(
 	const serverHandle =
 		mode === 'monitor'
 			? undefined
-			: await startWalletServer(resolved, walletResult, accounts, mode)
+			: await startWalletServer(resolved, walletResult, accounts)
 
 	if (runMonitor) {
 		const r = resolved.repricer
@@ -370,44 +385,49 @@ async function runWithStorage(
 	}
 }
 
+/**
+ * BRC-104 sessions in Redis when server.sessionStore.redisUrl is set (several
+ * instances behind one load balancer); in memory otherwise.
+ */
+function resolveSessionStore(
+	config: OneSatCliConfig,
+): { redisUrl: string; ttlSeconds?: number } | undefined {
+	const sessionStore = config.server?.sessionStore
+	return sessionStore?.redisUrl
+		? { redisUrl: sessionStore.redisUrl, ttlSeconds: sessionStore.ttlSeconds }
+		: undefined
+}
+
+/** The wallet's own storage, served to remote wallets by the toolbox StorageServer. */
+function startStorageServer(
+	resolved: ResolvedServe,
+	walletResult: NodeWalletResult,
+): ReturnType<typeof createStorageServer> {
+	const storage = walletResult.getActiveStorage()
+	if (!(storage instanceof StorageProvider)) {
+		fatal('serve storage needs local storage active; activeRemote is set.')
+	}
+	const config = loadConfig()
+	const server = createStorageServer({
+		storage,
+		wallet: walletResult.wallet,
+		listen: { port: resolved.port, host: resolved.host },
+		sessionStore: resolveSessionStore(config),
+		trustProxy: config.server?.trustProxy,
+	})
+	server.start()
+	return server
+}
+
 async function startWalletServer(
 	resolved: ResolvedServe,
 	walletResult: NodeWalletResult,
 	accounts: AccountsRuntime | undefined,
-	mode: ServeMode,
 ): Promise<{ stop(): Promise<void> }> {
 	const config = loadConfig()
+	const sessionStore = resolveSessionStore(config)
 
-	const sessionStoreCfg = config.server?.sessionStore
-	const sessionStore = sessionStoreCfg?.redisUrl
-		? {
-				redisUrl: sessionStoreCfg.redisUrl,
-				ttlSeconds: sessionStoreCfg.ttlSeconds,
-			}
-		: undefined
-
-	if (mode === 'wallet') {
-		const handle = createWalletServer({
-			wallet: walletResult.wallet,
-			storage: walletResult.getActiveStorage(),
-			serverIdentityKey: walletResult.wallet.identityKey,
-			listen: { port: resolved.port, host: resolved.host },
-			publicPath: '/',
-			internalPath: null,
-			accounts: accounts?.walletServerAccounts,
-			sessionStore,
-		})
-		const port = await handle.start()
-		const notes = [resolved.accounts.enabled ? 'accounts: on' : '']
-			.filter(Boolean)
-			.join(', ')
-		console.log(
-			`[wallet] listening on ${resolved.host}:${port}${notes ? ` (${notes})` : ''}`,
-		)
-		return { stop: () => handle.stop() }
-	}
-
-	// Unified host: storage + accounts + paymail + messagebox. The account
+	// Unified host: accounts + paymail + messagebox. The account
 	// registry is always on: it is the paymail user-domain backend and the
 	// entitlement gate for paymail resolution and messagebox delivery.
 	const serverCfg = config.server ?? {}
@@ -508,9 +528,7 @@ function createMessageboxKnex(
 }
 
 interface AccountsRuntime {
-	walletServerAccounts: NonNullable<
-		Parameters<typeof createWalletServer>[0]['accounts']
-	>
+	walletServerAccounts: WalletServerAccounts
 }
 
 async function buildAccountsForServer(

package/src/commands/storage.ts

@@ -102,8 +102,8 @@ async function openServeStorage(opts: GlobalFlags): Promise<StorageProvider> {
 				'server.storage.provider is pg but server.storage.dbUrl is not set.',
 			)
 		}
-		const { StoragePg } = await import('@1sat/wallet-node')
-		storage = new StoragePg({ ...baseOptions, dbUrl: storageConfig.dbUrl })
+		const { StorageKnexPg } = await import('@1sat/wallet-node')
+		storage = new StorageKnexPg({ ...baseOptions, dbUrl: storageConfig.dbUrl })
 	} else {
 		storage = new StorageBunSqlite({
 			...baseOptions,

package/src/config.ts

@@ -181,6 +181,12 @@ export interface ServerConfig {
 	 * run behind one load balancer; unset keeps sessions in-memory.
 	 */
 	sessionStore?: ServerSessionStoreConfig
+	/**
+	 * Express `trust proxy` for `serve storage`, whose IP rate limit keys on
+	 * the client address: a hop count, or an address/subnet list such as
+	 * `"loopback"`. Set it behind a reverse proxy. Unset = the socket address.
+	 */
+	trustProxy?: number | string | string[]
 	/** Background monitor task loop. Defaults to enabled. */
 	monitor?: ServerMonitorConfig
 }

package/src/help.ts

@@ -743,15 +743,16 @@ export const COMMANDS: CommandSpec[] = [
 		group: 'Server',
 		name: 'serve',
 		description:
-			'Run unified host server (storage + accounts + paymail + messagebox) and/or monitor (config under server.* in config.json)',
+			'Run unified host server (accounts + paymail + messagebox), wallet storage server and/or monitor (config under server.* in config.json)',
 		subcommands: [
 			{
 				name: '(no subcommand)',
 				description: 'Host server + monitor daemon',
 			},
 			{
-				name: 'wallet',
-				description: 'Wallet storage server only (BRC-100 HTTP)',
+				name: 'storage',
+				description:
+					'Wallet storage server only (wallet-toolbox StorageServer, BRC-100 HTTP)',
 			},
 			{ name: 'monitor', description: 'Monitor daemon only' },
 			{

package/src/wallet-api/admin.ts

@@ -64,7 +64,7 @@ const adminPermissionModules = Object.fromEntries(
  * Metadata encryption is left at the toolbox default (on), the same as
  * the served endpoint: the CLI writes encrypted descriptions and custom
  * instructions and reads them back decrypted. Nothing downstream loses by
- * that. `1sat serve wallet` is the wallet-toolbox *storage* interface, not
+ * that. `1sat serve storage` is the wallet-toolbox *storage* interface, not
  * a BRC-100 API — it moves opaque records and never interprets a
  * description — and the wallet at the far end (wallet-desktop, the
  * browser wallet, a remote CLI) runs its own permissions manager, which