@1sat/cli 0.0.43 → 0.0.46

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1sat/cli",
-  "version": "0.0.43",
+  "version": "0.0.46",
   "description": "CLI for 1Sat Ordinals SDK",
   "type": "module",
   "main": "./src/cli.ts",
@@ -25,13 +25,13 @@
   ],
   "license": "MIT",
   "dependencies": {
-    "@1sat/actions": "0.0.109",
-    "@1sat/client": "0.0.24",
+    "@1sat/actions": "0.0.112",
+    "@1sat/client": "0.0.25",
     "@1sat/types": "0.0.18",
-    "@1sat/wallet-node": "0.0.39",
-    "@1sat/wallet-server": "0.0.9",
+    "@1sat/wallet-node": "0.0.40",
+    "@1sat/wallet-server": "0.0.10",
     "@bsv/sdk": "^2.0.13",
-    "@bsv/wallet-toolbox": "npm:@bopen-io/wallet-toolbox@2.1.21-parity-fix.1",
+    "@bsv/wallet-toolbox": "npm:@bopen-io/wallet-toolbox@2.1.21-parity-fix.2",
     "chalk": "^5.0.0",
     "@clack/prompts": "^0.8.0",
     "bitcoin-backup": "^0.0.11",

package/src/commands/action.ts

@@ -8,7 +8,7 @@
 import { actionRegistry } from '@1sat/actions'
 import type { GlobalFlags } from '../args'
 import { loadContext } from '../context'
-import { loadKey, resolvePassword } from '../keys'
+import { loadKey } from '../keys'
 import { fatal, output } from '../output'
 
 export async function handleActionCommand(
@@ -65,7 +65,7 @@ export async function handleActionCommand(
 		}
 	}
 
-	const privateKey = await loadKey(resolvePassword())
+	const privateKey = await loadKey()
 	const { ctx, destroy } = await loadContext(privateKey, {
 		chain: opts.chain,
 	})

package/src/commands/identity.ts

@@ -9,7 +9,7 @@ import type { GlobalFlags } from '../args'
 import { extractFlag } from '../args'
 import { loadContext } from '../context'
 import { printCommandHelp } from '../help'
-import { loadKey, resolvePassword } from '../keys'
+import { loadKey } from '../keys'
 import { fatal, output, printKeyValue } from '../output'
 
 export async function handleIdentityCommand(
@@ -34,7 +34,7 @@ export async function handleIdentityCommand(
 				create: 'Create/publish a BAP identity',
 				'update-profile': 'Update BAP identity profile (--profile <json>)',
 				info: 'Show BAP identity information',
-				sign: 'Sign a message with identity key (--message <text>)',
+				sign: 'Sign a message with identity key (--message <text> [--encoding <utf8|hex|base64>])',
 				verify:
 					'Verify a signed message (--message <text> --sig <sig> --address <addr>)',
 			})
@@ -48,7 +48,7 @@ async function identityCreate(
 	_args: string[],
 	opts: GlobalFlags,
 ): Promise<void> {
-	const privateKey = await loadKey(resolvePassword())
+	const privateKey = await loadKey()
 	const { ctx, destroy } = await loadContext(privateKey, {
 		chain: opts.chain,
 	})
@@ -67,7 +67,7 @@ async function identityCreate(
 }
 
 async function identityInfo(_args: string[], opts: GlobalFlags): Promise<void> {
-	const privateKey = await loadKey(resolvePassword())
+	const privateKey = await loadKey()
 	const { ctx, destroy } = await loadContext(privateKey, {
 		chain: opts.chain,
 	})
@@ -92,16 +92,28 @@ async function identityInfo(_args: string[], opts: GlobalFlags): Promise<void> {
 
 async function identitySign(args: string[], opts: GlobalFlags): Promise<void> {
 	const message = extractFlag(args, '--message')
+	const encoding = extractFlag(args, '--encoding')
 
 	if (!message) fatal('Missing --message <text>')
+	if (
+		encoding !== undefined &&
+		encoding !== 'utf8' &&
+		encoding !== 'hex' &&
+		encoding !== 'base64'
+	) {
+		fatal('--encoding must be one of: utf8, hex, base64')
+	}
 
-	const privateKey = await loadKey(resolvePassword())
+	const privateKey = await loadKey()
 	const { ctx, destroy } = await loadContext(privateKey, {
 		chain: opts.chain,
 	})
 
 	try {
-		const result = await signBsm.execute(ctx, { message })
+		const result = await signBsm.execute(ctx, {
+			message,
+			...(encoding ? { encoding: encoding as 'utf8' | 'hex' | 'base64' } : {}),
+		})
 
 		if (result.error) {
 			fatal(result.error)
@@ -147,7 +159,7 @@ async function identityUpdateProfile(
 		fatal(`Invalid JSON in --profile: ${profileStr}`)
 	}
 
-	const privateKey = await loadKey(resolvePassword())
+	const privateKey = await loadKey()
 	const { ctx, destroy } = await loadContext(privateKey, {
 		chain: opts.chain,
 	})

package/src/commands/init.ts

@@ -18,11 +18,10 @@ import {
 	outro,
 	password,
 	select,
-	text,
 } from '@clack/prompts'
 import type { GlobalFlags } from '../args'
 import { ensureConfigDir, loadConfig, saveConfig } from '../config'
-import { cacheKeyPassword, hasKey, saveKey } from '../keys'
+import { hasKey, saveKey } from '../keys'
 import { fatal, formatSuccess, formatValue, formatWarning } from '../output'
 
 export async function handleInitCommand(
@@ -144,82 +143,30 @@ export async function handleInitCommand(
 		fatal('Passwords do not match.')
 	}
 
-	// 3.5. Touch ID protection (macOS arm64)
-	let useTouchID = false
-	try {
-		const { isTouchIDAvailable } = await import('bitcoin-backup')
-		if (isTouchIDAvailable()) {
-			const enableTouchID = await confirm({
-				message:
-					'Enable Touch ID? (unlock your wallet without typing a password)',
-			})
-			if (isCancel(enableTouchID)) {
-				cancel('Setup cancelled.')
-				process.exit(0)
-			}
-			useTouchID = enableTouchID as boolean
-		}
-	} catch {
-		// bitcoin-backup Touch ID not available — skip silently
-	}
-
 	// 4. Generate random storage identity key
 	const storageId = `1sat-cli-${randomBytes(8).toString('hex')}`
 
-	// 5. Optional: remote storage configuration
-	const useRemote = await confirm({
-		message: 'Configure remote storage? (remote is active, local is backup)',
-		defaultValue: false,
-	})
-	let activeRemote: string | undefined
-
-	if (useRemote) {
-		const url = await text({
-			message: 'Primary remote storage URL:',
-			validate(value) {
-				if (!value) return 'Required'
-				try {
-					new URL(value)
-				} catch {
-					return 'Invalid URL'
-				}
-			},
-		})
-		if (isCancel(url)) {
-			cancel('Setup cancelled.')
-			process.exit(0)
-		}
-		activeRemote = url as string
-	}
-
-	// 6. Save everything
+	// 5. Save everything
 	ensureConfigDir()
 
 	await saveKey(wif, pw as string)
 
-	// Cache password with Touch ID if user opted in
-	if (useTouchID) {
-		try {
-			await cacheKeyPassword(pw as string)
-		} catch {
-			console.log(
-				formatWarning(
-					'  Touch ID caching failed. You can enable it later with "1sat touchid enable".',
-				),
-			)
-		}
-	}
-
 	saveConfig({
 		...loadConfig(),
 		chain: chain as 'main' | 'test',
 		storageIdentityKey: storageId,
-		activeRemote,
 	})
 
 	const pk = PrivateKey.fromWif(wif)
 	const address = pk.toPublicKey().toAddress()
 
-	const touchIdNote = useTouchID ? ' (Touch ID enabled)' : ''
-	outro(formatSuccess(`Wallet configured${touchIdNote}! Address: ${address}`))
+	outro(formatSuccess(`Wallet configured! Address: ${address}`))
+
+	console.log()
+	console.log(
+		`  Want hosted storage? Run ${formatValue('1sat remote add <url>')} to attach a backup remote,`,
+	)
+	console.log(
+		`  then ${formatValue('1sat remote set-active <url>')} to make it primary.`,
+	)
 }

package/src/commands/locks.ts

@@ -8,7 +8,7 @@ import type { GlobalFlags } from '../args'
 import { extractFlag } from '../args'
 import { loadContext } from '../context'
 import { printCommandHelp } from '../help'
-import { loadKey, resolvePassword } from '../keys'
+import { loadKey } from '../keys'
 import { fatal, output, printKeyValue } from '../output'
 
 export async function handleLocksCommand(
@@ -37,7 +37,7 @@ export async function handleLocksCommand(
 }
 
 async function locksInfo(_args: string[], opts: GlobalFlags): Promise<void> {
-	const privateKey = await loadKey(resolvePassword())
+	const privateKey = await loadKey()
 	const { ctx, destroy } = await loadContext(privateKey, {
 		chain: opts.chain,
 	})
@@ -86,7 +86,7 @@ async function locksLock(args: string[], opts: GlobalFlags): Promise<void> {
 		}
 	}
 
-	const privateKey = await loadKey(resolvePassword())
+	const privateKey = await loadKey()
 	const { ctx, destroy } = await loadContext(privateKey, {
 		chain: opts.chain,
 	})
@@ -107,7 +107,7 @@ async function locksLock(args: string[], opts: GlobalFlags): Promise<void> {
 }
 
 async function locksUnlock(_args: string[], opts: GlobalFlags): Promise<void> {
-	const privateKey = await loadKey(resolvePassword())
+	const privateKey = await loadKey()
 	const { ctx, destroy } = await loadContext(privateKey, {
 		chain: opts.chain,
 	})

package/src/commands/opns.ts

@@ -15,7 +15,7 @@ import type { GlobalFlags } from '../args'
 import { extractFlag } from '../args'
 import { loadContext } from '../context'
 import { printCommandHelp } from '../help'
-import { loadKey, resolvePassword } from '../keys'
+import { loadKey } from '../keys'
 import { fatal, formatLabel, formatValue, output } from '../output'
 
 export async function handleOpnsCommand(
@@ -57,7 +57,7 @@ async function opnsRegister(args: string[], opts: GlobalFlags): Promise<void> {
 		}
 	}
 
-	const privateKey = await loadKey(resolvePassword())
+	const privateKey = await loadKey()
 	const { ctx, destroy } = await loadContext(privateKey, {
 		chain: opts.chain,
 	})
@@ -102,7 +102,7 @@ async function opnsDeregister(
 		}
 	}
 
-	const privateKey = await loadKey(resolvePassword())
+	const privateKey = await loadKey()
 	const { ctx, destroy } = await loadContext(privateKey, {
 		chain: opts.chain,
 	})
@@ -131,7 +131,7 @@ async function opnsDeregister(
 }
 
 async function opnsLookup(_args: string[], opts: GlobalFlags): Promise<void> {
-	const privateKey = await loadKey(resolvePassword())
+	const privateKey = await loadKey()
 	const { ctx, destroy } = await loadContext(privateKey, {
 		chain: opts.chain,
 	})

package/src/commands/ordinals.ts

@@ -17,10 +17,10 @@ import {
 import { Utils } from '@bsv/sdk'
 import { confirm, isCancel } from '@clack/prompts'
 import type { GlobalFlags } from '../args'
-import { extractFlag } from '../args'
+import { extractFlag, hasFlag } from '../args'
 import { loadContext } from '../context'
 import { printCommandHelp } from '../help'
-import { loadKey, resolvePassword } from '../keys'
+import { loadKey } from '../keys'
 import { fatal, formatLabel, formatValue, output } from '../output'
 
 export async function handleOrdinalsCommand(
@@ -45,7 +45,7 @@ export async function handleOrdinalsCommand(
 		default:
 			printCommandHelp('ordinals', {
 				list: 'List owned ordinals/inscriptions',
-				mint: 'Mint a new ordinal inscription (--file <path> --type <mime>)',
+				mint: 'Mint a new ordinal inscription (--file <path> [--type <mime>] [--map <json>] [--sign-with-bap])',
 				transfer: 'Transfer an ordinal (--outpoint <op> --to <addr>)',
 				sell: 'List an ordinal for sale (--outpoint <op> --price <sats>)',
 				cancel: 'Cancel an ordinal listing (--outpoint <op>)',
@@ -58,7 +58,7 @@ export async function handleOrdinalsCommand(
 }
 
 async function ordinalsList(_args: string[], opts: GlobalFlags): Promise<void> {
-	const privateKey = await loadKey(resolvePassword())
+	const privateKey = await loadKey()
 	const { ctx, destroy } = await loadContext(privateKey, {
 		chain: opts.chain,
 	})
@@ -121,6 +121,8 @@ const MIME_TYPES: Record<string, string> = {
 async function ordinalsMint(args: string[], opts: GlobalFlags): Promise<void> {
 	const file = extractFlag(args, '--file')
 	const type = extractFlag(args, '--type')
+	const mapStr = extractFlag(args, '--map')
+	const signWithBAP = hasFlag(args, '--sign-with-bap')
 
 	if (!file) fatal('Missing --file <path>')
 
@@ -131,6 +133,29 @@ async function ordinalsMint(args: string[], opts: GlobalFlags): Promise<void> {
 		)
 	}
 
+	let map: Record<string, string> | undefined
+	if (mapStr !== undefined) {
+		let parsed: unknown
+		try {
+			parsed = JSON.parse(mapStr)
+		} catch (err) {
+			fatal(`--map must be valid JSON: ${(err as Error).message}`)
+		}
+		if (
+			typeof parsed !== 'object' ||
+			parsed === null ||
+			Array.isArray(parsed)
+		) {
+			fatal('--map must be a JSON object')
+		}
+		for (const [k, v] of Object.entries(parsed as Record<string, unknown>)) {
+			if (typeof v !== 'string') {
+				fatal(`--map values must be strings (key "${k}" is ${typeof v})`)
+			}
+		}
+		map = parsed as Record<string, string>
+	}
+
 	let fileBytes: Uint8Array
 	try {
 		fileBytes = readFileSync(file)
@@ -149,7 +174,7 @@ async function ordinalsMint(args: string[], opts: GlobalFlags): Promise<void> {
 		}
 	}
 
-	const privateKey = await loadKey(resolvePassword())
+	const privateKey = await loadKey()
 	const { ctx, destroy } = await loadContext(privateKey, {
 		chain: opts.chain,
 	})
@@ -158,6 +183,8 @@ async function ordinalsMint(args: string[], opts: GlobalFlags): Promise<void> {
 		const result = await inscribe.execute(ctx, {
 			base64Content,
 			contentType,
+			...(map ? { map } : {}),
+			...(signWithBAP ? { signWithBAP: true } : {}),
 		})
 
 		if (result.error) {
@@ -189,7 +216,7 @@ async function ordinalsTransfer(
 		}
 	}
 
-	const privateKey = await loadKey(resolvePassword())
+	const privateKey = await loadKey()
 	const { ctx, destroy } = await loadContext(privateKey, {
 		chain: opts.chain,
 	})
@@ -238,7 +265,7 @@ async function ordinalsSell(args: string[], opts: GlobalFlags): Promise<void> {
 		}
 	}
 
-	const privateKey = await loadKey(resolvePassword())
+	const privateKey = await loadKey()
 	const { ctx, destroy } = await loadContext(privateKey, {
 		chain: opts.chain,
 	})
@@ -295,7 +322,7 @@ async function ordinalsCancel(
 		}
 	}
 
-	const privateKey = await loadKey(resolvePassword())
+	const privateKey = await loadKey()
 	const { ctx, destroy } = await loadContext(privateKey, {
 		chain: opts.chain,
 	})
@@ -337,7 +364,7 @@ async function ordinalsBuy(args: string[], opts: GlobalFlags): Promise<void> {
 		}
 	}
 
-	const privateKey = await loadKey(resolvePassword())
+	const privateKey = await loadKey()
 	const { ctx, destroy } = await loadContext(privateKey, {
 		chain: opts.chain,
 	})

package/src/commands/remote.ts

@@ -15,7 +15,7 @@ import type { GlobalFlags } from '../args'
 import { loadConfig, saveConfig } from '../config'
 import { loadContext } from '../context'
 import { printCommandHelp } from '../help'
-import { loadKey, resolvePassword } from '../keys'
+import { loadKey } from '../keys'
 import { fatal, formatSuccess, formatWarning, output } from '../output'
 
 export async function handleRemoteCommand(
@@ -47,8 +47,7 @@ export async function handleRemoteCommand(
 					'Switch active storage (1sat remote set-active <url | local>)',
 				status:
 					'Fetch GET /account/status from a remote (1sat remote status [url])',
-				topup:
-					'Buy capacity on a remote (1sat remote topup [url] [--units N])',
+				topup: 'Buy capacity on a remote (1sat remote topup [url] [--units N])',
 			})
 			if (subcommand && subcommand !== 'help') {
 				process.exit(1)
@@ -86,7 +85,7 @@ async function remoteAdd(args: string[], opts: GlobalFlags): Promise<void> {
 		}
 	}
 
-	const privateKey = await loadKey(resolvePassword())
+	const privateKey = await loadKey()
 	const { walletResult, destroy } = await loadContext(privateKey, {
 		chain: opts.chain,
 	})
@@ -133,7 +132,7 @@ async function remoteAdd(args: string[], opts: GlobalFlags): Promise<void> {
 // ============================================================================
 
 async function remoteList(_args: string[], opts: GlobalFlags): Promise<void> {
-	const privateKey = await loadKey(resolvePassword())
+	const privateKey = await loadKey()
 	const { destroy } = await loadContext(privateKey, {
 		chain: opts.chain,
 	})
@@ -259,7 +258,7 @@ async function remoteSetActive(
 			fatal('No remote storages configured')
 		}
 
-		const privateKey = await loadKey(resolvePassword())
+		const privateKey = await loadKey()
 		const { walletResult, destroy } = await loadContext(privateKey, {
 			chain: opts.chain,
 		})
@@ -299,7 +298,7 @@ async function remoteSetActive(
 			fatal(`Invalid URL: ${target}`)
 		}
 
-		const privateKey = await loadKey(resolvePassword())
+		const privateKey = await loadKey()
 		const { walletResult, destroy } = await loadContext(privateKey, {
 			chain: opts.chain,
 		})
@@ -345,7 +344,7 @@ async function remoteStatus(args: string[], opts: GlobalFlags): Promise<void> {
 		fatal(`Invalid URL: ${url}`)
 	}
 
-	const privateKey = await loadKey(resolvePassword())
+	const privateKey = await loadKey()
 	const { walletResult, destroy } = await loadContext(privateKey, {
 		chain: opts.chain,
 	})
@@ -430,7 +429,7 @@ async function remoteTopup(args: string[], opts: GlobalFlags): Promise<void> {
 		fatal(`Invalid URL: ${url}`)
 	}
 
-	const privateKey = await loadKey(resolvePassword())
+	const privateKey = await loadKey()
 	const { walletResult, destroy } = await loadContext(privateKey, {
 		chain: opts.chain,
 	})
@@ -452,7 +451,8 @@ async function remoteTopup(args: string[], opts: GlobalFlags): Promise<void> {
 				`  ${bold('New capacity:')} ${formatBytes(result.status.capacityBytes)} (${formatBytes(result.status.usedBytes)} used, ${formatBytes(result.status.deficitBytes)} deficit)`,
 			)
 			if (result.status.paidThroughBlock != null) {
-				const remaining = result.status.paidThroughBlock - result.status.currentBlock
+				const remaining =
+					result.status.paidThroughBlock - result.status.currentBlock
 				console.log(
 					`  ${bold('Paid through:')} block ${result.status.paidThroughBlock} (${remaining} blocks left)`,
 				)

package/src/commands/serve.ts

@@ -31,7 +31,7 @@ import {
 } from '../config'
 import { ensureDataDir } from '../config'
 import { printCommandHelp } from '../help'
-import { loadKey, resolvePassword } from '../keys'
+import { loadKey } from '../keys'
 import { clearMonitorPid, writeMonitorPid } from '../monitor-lock'
 import { fatal } from '../output'
 
@@ -138,7 +138,7 @@ async function resolveServe(opts: GlobalFlags): Promise<ResolvedServe> {
 
 	let privateKey: PrivateKey
 	try {
-		privateKey = await loadKey(resolvePassword())
+		privateKey = await loadKey()
 	} catch (err) {
 		fatal((err as Error).message)
 	}

package/src/commands/social.ts

@@ -6,10 +6,10 @@
 
 import { createSocialPost } from '@1sat/actions'
 import type { GlobalFlags } from '../args'
-import { extractFlag } from '../args'
+import { extractFlag, extractFlags } from '../args'
 import { loadContext } from '../context'
 import { printCommandHelp } from '../help'
-import { loadKey, resolvePassword } from '../keys'
+import { loadKey } from '../keys'
 import { fatal, output } from '../output'
 
 export async function handleSocialCommand(
@@ -23,7 +23,7 @@ export async function handleSocialCommand(
 			return socialPost(rest, opts)
 		default:
 			printCommandHelp('social', {
-				post: 'Create an on-chain social post (--content <text> --app <name>)',
+				post: 'Create an on-chain social post (--content <text> [--app <name>] [--content-type <text/plain|text/markdown>] [--tags <t1,t2>])',
 			})
 			if (subcommand && subcommand !== 'help') {
 				process.exit(1)
@@ -34,16 +34,32 @@ export async function handleSocialCommand(
 async function socialPost(args: string[], opts: GlobalFlags): Promise<void> {
 	const content = extractFlag(args, '--content')
 	const app = extractFlag(args, '--app') ?? '1sat-cli'
+	const contentType = extractFlag(args, '--content-type')
+	const tags = extractFlags(args, '--tags')
 
 	if (!content) fatal('Missing --content <text>')
+	if (
+		contentType !== undefined &&
+		contentType !== 'text/plain' &&
+		contentType !== 'text/markdown'
+	) {
+		fatal('--content-type must be one of: text/plain, text/markdown')
+	}
 
-	const privateKey = await loadKey(resolvePassword())
+	const privateKey = await loadKey()
 	const { ctx, destroy } = await loadContext(privateKey, {
 		chain: opts.chain,
 	})
 
 	try {
-		const result = await createSocialPost.execute(ctx, { app, content })
+		const result = await createSocialPost.execute(ctx, {
+			app,
+			content,
+			...(contentType
+				? { contentType: contentType as 'text/plain' | 'text/markdown' }
+				: {}),
+			...(tags.length ? { tags } : {}),
+		})
 
 		if (result.error) {
 			fatal(result.error)

package/src/commands/sweep.ts

@@ -17,7 +17,7 @@ import type { GlobalFlags } from '../args'
 import { extractFlag } from '../args'
 import { loadContext } from '../context'
 import { printCommandHelp } from '../help'
-import { loadKey, resolvePassword } from '../keys'
+import { loadKey } from '../keys'
 import { fatal, formatLabel, formatValue, output } from '../output'
 
 export async function handleSweepCommand(
@@ -55,7 +55,7 @@ async function sweepScan(args: string[], opts: GlobalFlags): Promise<void> {
 		fatal('Invalid WIF private key')
 	}
 
-	const privateKey = await loadKey(resolvePassword())
+	const privateKey = await loadKey()
 	const { ctx, destroy } = await loadContext(privateKey, {
 		chain: opts.chain,
 	})
@@ -145,7 +145,7 @@ async function sweepImport(args: string[], opts: GlobalFlags): Promise<void> {
 		fatal('Invalid WIF private key')
 	}
 
-	const privateKey = await loadKey(resolvePassword())
+	const privateKey = await loadKey()
 	const { ctx, destroy } = await loadContext(privateKey, {
 		chain: opts.chain,
 	})

package/src/commands/tokens.ts

@@ -14,7 +14,7 @@ import type { GlobalFlags } from '../args'
 import { extractFlag } from '../args'
 import { loadContext } from '../context'
 import { printCommandHelp } from '../help'
-import { loadKey, resolvePassword } from '../keys'
+import { loadKey } from '../keys'
 import { fatal, formatLabel, formatValue, output } from '../output'
 
 export async function handleTokensCommand(
@@ -52,7 +52,7 @@ async function tokenBalances(
 	_args: string[],
 	opts: GlobalFlags,
 ): Promise<void> {
-	const privateKey = await loadKey(resolvePassword())
+	const privateKey = await loadKey()
 	const { ctx, destroy } = await loadContext(privateKey, {
 		chain: opts.chain,
 	})
@@ -84,7 +84,7 @@ async function tokenBalances(
 async function tokenList(args: string[], opts: GlobalFlags): Promise<void> {
 	const tokenId = extractFlag(args, '--token-id')
 
-	const privateKey = await loadKey(resolvePassword())
+	const privateKey = await loadKey()
 	const { ctx, destroy } = await loadContext(privateKey, {
 		chain: opts.chain,
 	})
@@ -154,7 +154,7 @@ async function tokenSend(args: string[], opts: GlobalFlags): Promise<void> {
 		}
 	}
 
-	const privateKey = await loadKey(resolvePassword())
+	const privateKey = await loadKey()
 	const { ctx, destroy } = await loadContext(privateKey, {
 		chain: opts.chain,
 	})
@@ -199,7 +199,7 @@ async function tokenBuy(args: string[], opts: GlobalFlags): Promise<void> {
 		}
 	}
 
-	const privateKey = await loadKey(resolvePassword())
+	const privateKey = await loadKey()
 	const { ctx, destroy } = await loadContext(privateKey, {
 		chain: opts.chain,
 	})

package/src/commands/wallet.ts

@@ -3,13 +3,18 @@
  * BRC-100 interface commands - list-outputs, relinquish-output, list-actions, etc.
  */
 
-import { deriveDepositAddresses, sendAllBsv, sendBsv } from '@1sat/actions'
+import {
+	deriveDepositAddresses,
+	sendAllBsv,
+	sendBsv,
+	syncAddresses,
+} from '@1sat/actions'
 import { confirm, isCancel } from '@clack/prompts'
 import type { GlobalFlags } from '../args'
 import { extractFlag, extractFlags } from '../args'
 import { loadContext } from '../context'
 import { printCommandHelp } from '../help'
-import { loadKey, resolvePassword } from '../keys'
+import { loadKey } from '../keys'
 import { fatal, formatValue, output, printKeyValue } from '../output'
 
 export async function handleWalletCommand(
@@ -27,6 +32,8 @@ export async function handleWalletCommand(
 			return walletSend(rest, opts)
 		case 'send-all':
 			return walletSendAll(rest, opts)
+		case 'sync':
+			return walletSync(rest, opts)
 		case 'info':
 			return walletInfo(rest, opts)
 		case 'list-outputs':
@@ -48,9 +55,11 @@ export async function handleWalletCommand(
 		default:
 			printCommandHelp('wallet', {
 				balance: 'Show wallet balance in satoshis',
-				address: 'Show deposit address',
-				send: 'Send BSV to an address (--to <addr> --sats <amount>)',
+				address:
+					'Show deposit address [--prefix <p>] [--start-index <n>] [--count <n>]',
+				send: 'Send BSV (--to <addr> --sats <n> | --script <hex> --sats <n> | --data-asm "<asm>")',
 				'send-all': 'Send all BSV to an address (--to <addr>)',
+				sync: 'Sync inbound payments at BRC-29 deposit addresses [--prefix <p>] [--start-index <n>] [--count <n>]',
 				info: 'Show wallet info (address, balance, network)',
 				'list-outputs':
 					'List wallet outputs (--basket <name> [--tags <t1,t2>] [--limit N] [--include-tags] [--include <val>])',
@@ -74,7 +83,7 @@ async function walletBalance(
 	_args: string[],
 	opts: GlobalFlags,
 ): Promise<void> {
-	const privateKey = await loadKey(resolvePassword())
+	const privateKey = await loadKey()
 	const { ctx, destroy } = await loadContext(privateKey, {
 		chain: opts.chain,
 	})
@@ -99,27 +108,44 @@ async function walletBalance(
 	}
 }
 
-async function walletAddress(
-	_args: string[],
-	opts: GlobalFlags,
-): Promise<void> {
-	const privateKey = await loadKey(resolvePassword())
+async function walletAddress(args: string[], opts: GlobalFlags): Promise<void> {
+	const prefix = extractFlag(args, '--prefix') ?? '1sat'
+	const startIndexStr = extractFlag(args, '--start-index')
+	const countStr = extractFlag(args, '--count')
+
+	const startIndex = startIndexStr === undefined ? 0 : Number(startIndexStr)
+	const count = countStr === undefined ? 1 : Number(countStr)
+
+	if (!Number.isInteger(startIndex) || startIndex < 0) {
+		fatal('--start-index must be a non-negative integer')
+	}
+	if (!Number.isInteger(count) || count < 1) {
+		fatal('--count must be a positive integer')
+	}
+
+	const privateKey = await loadKey()
 	const { ctx, destroy } = await loadContext(privateKey, {
 		chain: opts.chain,
 	})
 
 	try {
 		const result = await deriveDepositAddresses.execute(ctx, {
-			prefix: '1sat',
-			count: 1,
+			prefix,
+			startIndex,
+			count,
 		})
 
-		const primary = result.derivations[0]
-		if (!primary) {
+		if (!result.derivations.length) {
 			fatal('Failed to derive deposit address')
 		}
 
-		output(opts.json ? primary : primary.address, opts)
+		if (opts.json) {
+			output(count === 1 ? result.derivations[0] : result.derivations, opts)
+		} else if (!opts.quiet) {
+			for (const d of result.derivations) {
+				console.log(d.address)
+			}
+		}
 	} finally {
 		await destroy()
 	}
@@ -127,34 +153,68 @@ async function walletAddress(
 
 async function walletSend(args: string[], opts: GlobalFlags): Promise<void> {
 	const to = extractFlag(args, '--to')
+	const script = extractFlag(args, '--script')
+	const dataAsm = extractFlag(args, '--data-asm')
 	const satsStr = extractFlag(args, '--sats')
 
-	if (!to) fatal('Missing --to <address>')
-	if (!satsStr) fatal('Missing --sats <amount>')
+	const modes = [to, script, dataAsm].filter((v) => v !== undefined).length
+	if (modes === 0) {
+		fatal(
+			'Specify one of --to <address>, --script <hex>, or --data-asm "<asm>"',
+		)
+	}
+	if (modes > 1) {
+		fatal('--to, --script, and --data-asm are mutually exclusive')
+	}
 
-	const satoshis = Number(satsStr)
-	if (!Number.isFinite(satoshis) || satoshis <= 0) {
-		fatal('--sats must be a positive number')
+	let request: {
+		address?: string
+		script?: string
+		data?: string[]
+		satoshis: number
+	}
+	let confirmMessage: string
+
+	if (dataAsm !== undefined) {
+		if (satsStr !== undefined) {
+			fatal(
+				'--sats is not allowed with --data-asm (OP_RETURN outputs are 0 sats)',
+			)
+		}
+		request = { data: [dataAsm], satoshis: 0 }
+		confirmMessage = `Publish OP_RETURN data "${dataAsm}"?`
+	} else {
+		if (!satsStr) fatal('Missing --sats <amount>')
+		const satoshis = Number(satsStr)
+		if (!Number.isFinite(satoshis) || satoshis <= 0) {
+			fatal('--sats must be a positive number')
+		}
+		if (script !== undefined) {
+			if (!/^[0-9a-fA-F]*$/.test(script) || script.length % 2 !== 0) {
+				fatal('--script must be a hex string')
+			}
+			request = { script, satoshis }
+			confirmMessage = `Send ${satoshis} satoshis to custom script?`
+		} else {
+			request = { address: to, satoshis }
+			confirmMessage = `Send ${satoshis} satoshis to ${to}?`
+		}
 	}
 
 	if (!opts.yes) {
-		const ok = await confirm({
-			message: `Send ${satoshis} satoshis to ${to}?`,
-		})
+		const ok = await confirm({ message: confirmMessage })
 		if (isCancel(ok) || !ok) {
 			fatal('Send cancelled.')
 		}
 	}
 
-	const privateKey = await loadKey(resolvePassword())
+	const privateKey = await loadKey()
 	const { ctx, destroy } = await loadContext(privateKey, {
 		chain: opts.chain,
 	})
 
 	try {
-		const result = await sendBsv.execute(ctx, {
-			requests: [{ address: to, satoshis }],
-		})
+		const result = await sendBsv.execute(ctx, { requests: [request] })
 
 		if (result.error) {
 			fatal(result.error)
@@ -180,7 +240,7 @@ async function walletSendAll(args: string[], opts: GlobalFlags): Promise<void> {
 		}
 	}
 
-	const privateKey = await loadKey(resolvePassword())
+	const privateKey = await loadKey()
 	const { ctx, destroy } = await loadContext(privateKey, {
 		chain: opts.chain,
 	})
@@ -198,8 +258,58 @@ async function walletSendAll(args: string[], opts: GlobalFlags): Promise<void> {
 	}
 }
 
+async function walletSync(args: string[], opts: GlobalFlags): Promise<void> {
+	const prefix = extractFlag(args, '--prefix')
+	const startIndexRaw = extractFlag(args, '--start-index')
+	const countRaw = extractFlag(args, '--count')
+
+	const startIndex =
+		startIndexRaw !== undefined ? Number.parseInt(startIndexRaw, 10) : undefined
+	const count =
+		countRaw !== undefined ? Number.parseInt(countRaw, 10) : undefined
+
+	if (
+		startIndex !== undefined &&
+		(!Number.isFinite(startIndex) || startIndex < 0)
+	) {
+		fatal('--start-index must be a non-negative integer')
+	}
+	if (count !== undefined && (!Number.isFinite(count) || count < 1)) {
+		fatal('--count must be a positive integer')
+	}
+
+	const privateKey = await loadKey()
+	const { ctx, destroy } = await loadContext(privateKey, {
+		chain: opts.chain,
+	})
+
+	try {
+		const result = await syncAddresses.execute(ctx, {
+			...(prefix ? { prefix } : {}),
+			...(startIndex !== undefined ? { startIndex } : {}),
+			...(count !== undefined ? { count } : {}),
+		})
+
+		if (opts.json) {
+			output(result, opts)
+			return
+		}
+
+		console.log(
+			`\nprocessed: ${result.processed}  failed: ${result.failed}  lastScore: ${result.lastScore}`,
+		)
+		if (result.addresses.length > 0) {
+			console.log('addresses:')
+			for (const addr of result.addresses) console.log(`  ${addr}`)
+		}
+		console.log()
+	} finally {
+		await destroy()
+	}
+}
+
 async function walletInfo(_args: string[], opts: GlobalFlags): Promise<void> {
-	const privateKey = await loadKey(resolvePassword())
+	const privateKey = await loadKey()
 	const { ctx, destroy } = await loadContext(privateKey, {
 		chain: opts.chain,
 	})
@@ -264,7 +374,7 @@ async function walletListOutputs(
 	const includeTags = args.includes('--include-tags')
 	const include = extractFlag(args, '--include')
 
-	const privateKey = await loadKey(resolvePassword())
+	const privateKey = await loadKey()
 	const { ctx, destroy } = await loadContext(privateKey, {
 		chain: opts.chain,
 	})
@@ -314,7 +424,7 @@ async function walletRelinquishOutput(
 		fatal('Invalid --output format. Expected: txid.vout (e.g., abc123...0)')
 	}
 
-	const privateKey = await loadKey(resolvePassword())
+	const privateKey = await loadKey()
 	const { ctx, destroy } = await loadContext(privateKey, {
 		chain: opts.chain,
 	})
@@ -346,7 +456,7 @@ async function walletListActions(
 		fatal('--limit must be between 1 and 10000')
 	}
 
-	const privateKey = await loadKey(resolvePassword())
+	const privateKey = await loadKey()
 	const { ctx, destroy } = await loadContext(privateKey, {
 		chain: opts.chain,
 	})
@@ -389,7 +499,7 @@ async function walletCreateAction(
 		fatal(`Invalid JSON: ${jsonInput}`)
 	}
 
-	const privateKey = await loadKey(resolvePassword())
+	const privateKey = await loadKey()
 	const { ctx, destroy } = await loadContext(privateKey, {
 		chain: opts.chain,
 	})
@@ -418,7 +528,7 @@ async function walletSignAction(
 		fatal(`Invalid JSON: ${jsonInput}`)
 	}
 
-	const privateKey = await loadKey(resolvePassword())
+	const privateKey = await loadKey()
 	const { ctx, destroy } = await loadContext(privateKey, {
 		chain: opts.chain,
 	})
@@ -439,7 +549,7 @@ async function walletAbortAction(
 
 	if (!reference) fatal('Missing required --reference <ref>')
 
-	const privateKey = await loadKey(resolvePassword())
+	const privateKey = await loadKey()
 	const { ctx, destroy } = await loadContext(privateKey, {
 		chain: opts.chain,
 	})
@@ -465,7 +575,7 @@ async function walletListCertificates(
 		fatal('--limit must be between 1 and 10000')
 	}
 
-	const privateKey = await loadKey(resolvePassword())
+	const privateKey = await loadKey()
 	const { ctx, destroy } = await loadContext(privateKey, {
 		chain: opts.chain,
 	})
@@ -505,7 +615,7 @@ async function walletRelinquishCertificate(
 	if (!serialNumber) fatal('Missing required --serialNumber <serial>')
 	if (!certifier) fatal('Missing required --certifier <certifier>')
 
-	const privateKey = await loadKey(resolvePassword())
+	const privateKey = await loadKey()
 	const { ctx, destroy } = await loadContext(privateKey, {
 		chain: opts.chain,
 	})

package/src/keys.ts

@@ -1,17 +1,21 @@
 /**
  * Encrypted key management for the 1sat CLI.
  *
- * Key resolution priority:
+ * Key resolution priority inside loadKey():
  * 1. PRIVATE_KEY_WIF env var (headless/CI)
- * 2. Touch ID cached password → decrypt keys.bep (macOS arm64)
- * 3. Explicit password → decrypt keys.bep
+ * 2. ONESAT_PASSWORD env var → decrypt keys.bep
+ * 3. Interactive TTY prompt → decrypt keys.bep
  * 4. Fail with guidance
+ *
+ * A biometric vault tier will be added once @1sat/wallet-mac is
+ * CLI-ready (resolves its own enclave binary relative to its module
+ * directory instead of wallet-desktop's layout).
  */
 
 import { existsSync, readFileSync, writeFileSync } from 'node:fs'
-import { arch, platform } from 'node:os'
 import { join } from 'node:path'
 import { PrivateKey } from '@bsv/sdk'
+import { isCancel, password as promptPassword } from '@clack/prompts'
 import { type WifBackup, decryptBackup, encryptBackup } from 'bitcoin-backup'
 import { ensureConfigDir, getConfigDir } from './config'
 
@@ -30,28 +34,14 @@ export function hasKey(): boolean {
 }
 
 /**
- * Check if Touch ID is available for password caching.
+ * Load the private key from env, env password, or TTY prompt.
  */
-export function isTouchIDAvailable(): boolean {
-	return platform() === 'darwin' && arch() === 'arm64'
-}
-
-/**
- * Load the private key from env, Touch ID cache, or password.
- *
- * Resolution order:
- * 1. PRIVATE_KEY_WIF env var
- * 2. Touch ID cached password (if available)
- * 3. Explicit password parameter
- */
-export async function loadKey(password?: string): Promise<PrivateKey> {
-	// Priority 1: Environment variable
+export async function loadKey(): Promise<PrivateKey> {
 	const envWif = process.env.PRIVATE_KEY_WIF
 	if (envWif) {
 		return PrivateKey.fromWif(envWif)
 	}
 
-	// Priority 2: Encrypted file
 	const keysPath = getKeysPath()
 	if (!existsSync(keysPath)) {
 		throw new Error(
@@ -61,24 +51,21 @@ export async function loadKey(password?: string): Promise<PrivateKey> {
 
 	const encrypted = readFileSync(keysPath, 'utf8')
 
-	// Priority 2a: Try Touch ID cached password
-	let resolvedPassword = password
-	if (!resolvedPassword) {
-		try {
-			const { getCachedPassword } = await import('bitcoin-backup')
-			const cached = await getCachedPassword(keysPath)
-			if (cached) {
-				resolvedPassword = cached
-			}
-		} catch {
-			// Touch ID not available or no cached password — fall through
-		}
-	}
+	let resolvedPassword = process.env.ONESAT_PASSWORD
 
 	if (!resolvedPassword) {
-		throw new Error(
-			'Password required to decrypt key file. Pass --password, set ONESAT_PASSWORD, or run "1sat init --touchid" to enable Touch ID.',
-		)
+		if (!process.stdin.isTTY) {
+			throw new Error(
+				'Password required to decrypt key file. Set ONESAT_PASSWORD or run in an interactive terminal.',
+			)
+		}
+		const input = await promptPassword({
+			message: 'Password:',
+		})
+		if (isCancel(input) || typeof input !== 'string' || input.length === 0) {
+			throw new Error('Password required to decrypt key file.')
+		}
+		resolvedPassword = input
 	}
 
 	const backup = await decryptBackup(encrypted, resolvedPassword)
@@ -93,8 +80,6 @@ export async function loadKey(password?: string): Promise<PrivateKey> {
  */
 export async function saveKey(wif: string, password: string): Promise<void> {
 	ensureConfigDir()
-
-	// Validate the WIF before saving
 	PrivateKey.fromWif(wif)
 
 	const payload: WifBackup = {
@@ -103,29 +88,5 @@ export async function saveKey(wif: string, password: string): Promise<void> {
 		createdAt: new Date().toISOString(),
 	}
 	const encrypted = await encryptBackup(payload, password)
-	const keysPath = getKeysPath()
-	writeFileSync(keysPath, encrypted, { mode: 0o600 })
-}
-
-/**
- * Cache the password for keys.bep using Touch ID.
- */
-export async function cacheKeyPassword(password: string): Promise<void> {
-	const { cachePassword } = await import('bitcoin-backup')
-	await cachePassword(getKeysPath(), password)
-}
-
-/**
- * Remove the cached password for keys.bep.
- */
-export async function forgetKeyPassword(): Promise<void> {
-	const { forgetPassword } = await import('bitcoin-backup')
-	await forgetPassword(getKeysPath())
-}
-
-/**
- * Resolve a password from flag or environment variable.
- */
-export function resolvePassword(flagValue?: string): string | undefined {
-	return flagValue ?? process.env.ONESAT_PASSWORD
+	writeFileSync(getKeysPath(), encrypted, { mode: 0o600 })
 }