@agentsmarket/cli 0.1.0

package/dist/lib/http.js

@@ -0,0 +1,105 @@
+/**
+ * Authenticated HTTP client for the marketplace server.
+ *
+ * Signs every request with the agent's Ed25519 key per server protocol:
+ *   Headers:
+ *     X-Agent-ID:    ed25519:...
+ *     X-Signature:   base64(64-byte Ed25519 sig)
+ *     X-Timestamp:   unix ms (within 5 min drift)
+ *   Message: METHOD\nPATH\nTIMESTAMP\nSHA256(BODY)
+ */
+import * as crypto from 'node:crypto';
+import { createHash } from 'node:crypto';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { loadConfig } from './config.js';
+import { loadPrivateKey, exportPublicKeyRaw } from './keys.js';
+// Override at runtime with AGENTSMARKET_URL env var (used by smoke.sh, tests, dev).
+const DEFAULT_BASE_URL = 'https://api.agentsmarket.world';
+export class HttpError extends Error {
+    status;
+    code;
+    constructor(status, code, message) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.name = 'HttpError';
+    }
+}
+function getKeyPath() {
+    const home = os.homedir();
+    if (process.platform === 'win32') {
+        return path.join(home, 'AppData', 'Roaming', 'agentsmarket', 'agent.key');
+    }
+    if (process.platform === 'darwin') {
+        return path.join(home, 'Library', 'Application Support', 'agentsmarket', 'agent.key');
+    }
+    const xdgConfig = process.env.XDG_CONFIG_HOME ?? path.join(home, '.config');
+    return path.join(xdgConfig, 'agentsmarket', 'agent.key');
+}
+function getSigningKey() {
+    const config = loadConfig();
+    if (!config) {
+        throw new Error('Agent not initialized. Run `agentsmarket init` first.');
+    }
+    const pem = fs.readFileSync(getKeyPath(), 'utf-8');
+    const privateKey = loadPrivateKey(pem);
+    const publicKey = crypto.createPublicKey(privateKey);
+    const raw = exportPublicKeyRaw(publicKey);
+    const derivedId = 'ed25519:' + raw.toString('base64url');
+    if (derivedId !== config.agent_id) {
+        throw new Error(`Key file does not match stored agent_id. Stored: ${config.agent_id}, Derived: ${derivedId}`);
+    }
+    return { privateKey, agentId: config.agent_id };
+}
+function signRequest(privateKey, method, path, body) {
+    const timestamp = Date.now().toString();
+    const bodyHash = createHash('sha256').update(body || '').digest('hex');
+    const message = `${method}\n${path}\n${timestamp}\n${bodyHash}`;
+    const sig = crypto.sign(null, Buffer.from(message), privateKey);
+    return { signature: sig.toString('base64'), timestamp };
+}
+/** Make an authenticated request to the marketplace server. */
+export async function authedFetch(method, path, body, opts = {}) {
+    const baseUrl = (opts.baseUrl ?? process.env.AGENTSMARKET_URL ?? DEFAULT_BASE_URL).replace(/\/$/, '');
+    const bodyStr = body !== undefined ? JSON.stringify(body) : '';
+    const url = `${baseUrl}${path}`;
+    const headers = {
+        'Content-Type': 'application/json',
+    };
+    if (opts.requireAuth !== false) {
+        const { privateKey, agentId } = getSigningKey();
+        const { signature, timestamp } = signRequest(privateKey, method, path, bodyStr);
+        headers['X-Agent-ID'] = agentId;
+        headers['X-Signature'] = signature;
+        headers['X-Timestamp'] = timestamp;
+    }
+    const res = await fetch(url, {
+        method,
+        headers,
+        body: method === 'GET' || method === 'HEAD' ? undefined : bodyStr,
+    });
+    if (!res.ok) {
+        let code = 'UNKNOWN';
+        let message = `HTTP ${res.status}`;
+        try {
+            const parsed = await res.json();
+            if (parsed.code)
+                code = parsed.code;
+            if (parsed.error)
+                message = `${parsed.code ?? 'UNKNOWN'}: ${parsed.error}`;
+        }
+        catch {
+            // not JSON
+        }
+        throw new HttpError(res.status, code, message);
+    }
+    return res;
+}
+/** Convenience: authed JSON request, returns parsed body. */
+export async function authedJson(method, path, body, opts) {
+    const res = await authedFetch(method, path, body, opts);
+    return await res.json();
+}
+//# sourceMappingURL=http.js.map

package/dist/lib/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/lib/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAE/D,oFAAoF;AACpF,MAAM,gBAAgB,GAAG,gCAAgC,CAAC;AAE1D,MAAM,OAAO,SAAU,SAAQ,KAAK;IAEhB;IACA;IAFlB,YACkB,MAAc,EACd,IAAY,EAC5B,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QAI5B,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,SAAS,UAAU;IACjB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,qBAAqB,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC5E,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,aAAa;IACpB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACzD,IAAI,SAAS,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,oDAAoD,MAAM,CAAC,QAAQ,cAAc,SAAS,EAAE,CAC7F,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;AAClD,CAAC;AAED,SAAS,WAAW,CAClB,UAA4B,EAC5B,MAAc,EACd,IAAY,EACZ,IAAY;IAEZ,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,GAAG,MAAM,KAAK,IAAI,KAAK,SAAS,KAAK,QAAQ,EAAE,CAAC;IAChE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC,CAAC;IAChE,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,CAAC;AAC1D,CAAC;AAED,+DAA+D;AAC/D,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAc,EACd,IAAY,EACZ,IAAc,EACd,OAAoD,EAAE;IAEtD,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtG,MAAM,OAAO,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,MAAM,GAAG,GAAG,GAAG,OAAO,GAAG,IAAI,EAAE,CAAC;IAChC,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;KACnC,CAAC;IAEF,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;QAC/B,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,aAAa,EAAE,CAAC;QAChD,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAChF,OAAO,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC;QAChC,OAAO,CAAC,aAAa,CAAC,GAAG,SAAS,CAAC;QACnC,OAAO,CAAC,aAAa,CAAC,GAAG,SAAS,CAAC;IACrC,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,MAAM;QACN,OAAO;QACP,IAAI,EAAE,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO;KAClE,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,IAAI,IAAI,GAAG,SAAS,CAAC;QACrB,IAAI,OAAO,GAAG,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,EAAuC,CAAC;YACrE,IAAI,MAAM,CAAC,IAAI;gBAAE,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;YACpC,IAAI,MAAM,CAAC,KAAK;gBAAE,OAAO,GAAG,GAAG,MAAM,CAAC,IAAI,IAAI,SAAS,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;QAC7E,CAAC;QAAC,MAAM,CAAC;YACP,WAAW;QACb,CAAC;QACD,MAAM,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,6DAA6D;AAC7D,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAAc,EACd,IAAY,EACZ,IAAc,EACd,IAAkD;IAElD,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACxD,OAAO,MAAM,GAAG,CAAC,IAAI,EAAO,CAAC;AAC/B,CAAC"}

package/dist/lib/keys.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Ed25519 key management for agentsmarket agents.
+ *
+ * Uses Node.js built-in `crypto` (RFC 8032 compliant). NO external crypto
+ * dependencies — battle-tested by the Node.js team.
+ *
+ * SECURITY: This is the foundation of agent identity. If keys are generated
+ * incorrectly, agents lose their identity, reputation, and any funds.
+ * Every function here is unit-tested.
+ */
+import * as crypto from 'node:crypto';
+/**
+ * Pair of Ed25519 keys for an agent.
+ */
+export interface AgentKeypair {
+    publicKey: crypto.KeyObject;
+    privateKey: crypto.KeyObject;
+}
+/**
+ * Generate a fresh Ed25519 keypair.
+ * Uses Node's built-in crypto (constant-time, side-channel resistant).
+ */
+export declare function generateKeypair(): AgentKeypair;
+/**
+ * Derive agent_id from public key.
+ *
+ * Format: "ed25519:" + base64url(raw 32-byte Ed25519 public key)
+ * Example: "ed25519:wdlEEYI0rCNkobjR0d1aPJBl6v2HQ4Sqh8C5FZ3mNoE"
+ *
+ * The base64url encoding has no padding and uses URL-safe characters.
+ */
+export declare function agentIdFromPublicKey(publicKey: crypto.KeyObject): string;
+/**
+ * Export public key as raw 32-byte buffer.
+ *
+ * SPKI DER for Ed25519 ends with the BIT STRING containing the 32-byte key.
+ * The last 32 bytes of the DER encoding ARE the raw public key.
+ */
+export declare function exportPublicKeyRaw(publicKey: crypto.KeyObject): Buffer;
+/**
+ * Export public key as hex string (64 chars).
+ * Useful for debugging.
+ */
+export declare function exportPublicKeyHex(publicKey: crypto.KeyObject): string;
+/**
+ * Sign a message with the private key.
+ *
+ * Returns 64-byte Ed25519 signature.
+ *
+ * Ed25519 doesn't use a separate hash algorithm — first arg to crypto.sign is null.
+ */
+export declare function signMessage(privateKey: crypto.KeyObject, message: Buffer | Uint8Array): Buffer;
+/**
+ * Verify a signature against a public key and message.
+ * Returns true if valid, false otherwise.
+ */
+export declare function verifySignature(publicKey: crypto.KeyObject, message: Buffer | Uint8Array, signature: Buffer | Uint8Array): boolean;
+/**
+ * Load private key from PEM string (PKCS8 format).
+ */
+export declare function loadPrivateKey(pem: string): crypto.KeyObject;
+/**
+ * Derive public key from private key.
+ */
+export declare function derivePublicKey(privateKey: crypto.KeyObject): crypto.KeyObject;
+/**
+ * Export private key as PEM string (PKCS8 format, standard).
+ */
+export declare function exportPrivateKeyPem(privateKey: crypto.KeyObject): string;

package/dist/lib/keys.js

@@ -0,0 +1,85 @@
+/**
+ * Ed25519 key management for agentsmarket agents.
+ *
+ * Uses Node.js built-in `crypto` (RFC 8032 compliant). NO external crypto
+ * dependencies — battle-tested by the Node.js team.
+ *
+ * SECURITY: This is the foundation of agent identity. If keys are generated
+ * incorrectly, agents lose their identity, reputation, and any funds.
+ * Every function here is unit-tested.
+ */
+import * as crypto from 'node:crypto';
+/**
+ * Generate a fresh Ed25519 keypair.
+ * Uses Node's built-in crypto (constant-time, side-channel resistant).
+ */
+export function generateKeypair() {
+    const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519');
+    return { publicKey, privateKey };
+}
+/**
+ * Derive agent_id from public key.
+ *
+ * Format: "ed25519:" + base64url(raw 32-byte Ed25519 public key)
+ * Example: "ed25519:wdlEEYI0rCNkobjR0d1aPJBl6v2HQ4Sqh8C5FZ3mNoE"
+ *
+ * The base64url encoding has no padding and uses URL-safe characters.
+ */
+export function agentIdFromPublicKey(publicKey) {
+    const raw = exportPublicKeyRaw(publicKey);
+    return 'ed25519:' + raw.toString('base64url');
+}
+/**
+ * Export public key as raw 32-byte buffer.
+ *
+ * SPKI DER for Ed25519 ends with the BIT STRING containing the 32-byte key.
+ * The last 32 bytes of the DER encoding ARE the raw public key.
+ */
+export function exportPublicKeyRaw(publicKey) {
+    const der = publicKey.export({ format: 'der', type: 'spki' });
+    return Buffer.from(der).subarray(-32);
+}
+/**
+ * Export public key as hex string (64 chars).
+ * Useful for debugging.
+ */
+export function exportPublicKeyHex(publicKey) {
+    return exportPublicKeyRaw(publicKey).toString('hex');
+}
+/**
+ * Sign a message with the private key.
+ *
+ * Returns 64-byte Ed25519 signature.
+ *
+ * Ed25519 doesn't use a separate hash algorithm — first arg to crypto.sign is null.
+ */
+export function signMessage(privateKey, message) {
+    const signature = crypto.sign(null, Buffer.from(message), privateKey);
+    return Buffer.from(signature);
+}
+/**
+ * Verify a signature against a public key and message.
+ * Returns true if valid, false otherwise.
+ */
+export function verifySignature(publicKey, message, signature) {
+    return crypto.verify(null, Buffer.from(message), publicKey, Buffer.from(signature));
+}
+/**
+ * Load private key from PEM string (PKCS8 format).
+ */
+export function loadPrivateKey(pem) {
+    return crypto.createPrivateKey(pem);
+}
+/**
+ * Derive public key from private key.
+ */
+export function derivePublicKey(privateKey) {
+    return crypto.createPublicKey(privateKey);
+}
+/**
+ * Export private key as PEM string (PKCS8 format, standard).
+ */
+export function exportPrivateKeyPem(privateKey) {
+    return privateKey.export({ format: 'pem', type: 'pkcs8' });
+}
+//# sourceMappingURL=keys.js.map

package/dist/lib/keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../src/lib/keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAUtC;;;GAGG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACxE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAA2B;IAC9D,MAAM,GAAG,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC1C,OAAO,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAA2B;IAC5D,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9D,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAA2B;IAC5D,OAAO,kBAAkB,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,UAA4B,EAAE,OAA4B;IACpF,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC,CAAC;IACtE,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,SAA2B,EAC3B,OAA4B,EAC5B,SAA8B;IAE9B,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;AACtF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,OAAO,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,UAA4B;IAC1D,OAAO,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;AAC5C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAA4B;IAC9D,OAAO,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAW,CAAC;AACvE,CAAC"}

package/dist/lib/payment-keys.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Secp256k1 key management for USDC payments (EIP-3009).
+ *
+ * Separate from Ed25519 agent identity keys. Agent has BOTH:
+ * - Ed25519 (agent.key): identity + HTTP request signing
+ * - secp256k1 (payment.key): USDC payment authorization signing
+ *
+ * Both are saved as PKCS8 PEM (mode 0600). Node crypto handles both.
+ */
+import * as crypto from 'node:crypto';
+export interface PaymentKeypair {
+    publicKey: crypto.KeyObject;
+    privateKey: crypto.KeyObject;
+}
+export declare function generatePaymentKeypair(): PaymentKeypair;
+export declare function exportPaymentPublicKeyRaw(key: crypto.KeyObject): Buffer;
+export declare function exportPaymentPublicKeyHex(key: crypto.KeyObject): string;
+export declare function exportPaymentAddress(key: crypto.KeyObject): string;
+export declare function loadPaymentPrivateKey(pem: string): crypto.KeyObject;
+export declare function exportPaymentPrivateKeyPem(privateKey: crypto.KeyObject): string;
+/**
+ * Sign a 32-byte message hash with secp256k1 (used for EIP-3009).
+ * Returns 65-byte signature: r (32) || s (32) || v (1, value 27 or 28).
+ */
+export declare function signSecp256k1(privateKey: crypto.KeyObject, msgHash: Buffer): Buffer;

package/dist/lib/payment-keys.js

@@ -0,0 +1,55 @@
+/**
+ * Secp256k1 key management for USDC payments (EIP-3009).
+ *
+ * Separate from Ed25519 agent identity keys. Agent has BOTH:
+ * - Ed25519 (agent.key): identity + HTTP request signing
+ * - secp256k1 (payment.key): USDC payment authorization signing
+ *
+ * Both are saved as PKCS8 PEM (mode 0600). Node crypto handles both.
+ */
+import * as crypto from 'node:crypto';
+export function generatePaymentKeypair() {
+    const { publicKey, privateKey } = crypto.generateKeyPairSync('ec', { namedCurve: 'secp256k1' });
+    return { publicKey, privateKey };
+}
+function toPublicKey(key) {
+    return key.type === 'private' ? crypto.createPublicKey(key) : key;
+}
+export function exportPaymentPublicKeyRaw(key) {
+    const der = toPublicKey(key).export({ format: 'der', type: 'spki' });
+    return Buffer.from(der).subarray(-65).subarray(1);
+}
+export function exportPaymentPublicKeyHex(key) {
+    return '0x' + exportPaymentPublicKeyRaw(key).toString('hex');
+}
+export function exportPaymentAddress(key) {
+    const uncompressed = exportPaymentPublicKeyRaw(key);
+    const hash = crypto.createHash('sha256').update(uncompressed).digest();
+    return '0x' + hash.subarray(-20).toString('hex');
+}
+export function loadPaymentPrivateKey(pem) {
+    return crypto.createPrivateKey(pem);
+}
+export function exportPaymentPrivateKeyPem(privateKey) {
+    return privateKey.export({ format: 'pem', type: 'pkcs8' });
+}
+/**
+ * Sign a 32-byte message hash with secp256k1 (used for EIP-3009).
+ * Returns 65-byte signature: r (32) || s (32) || v (1, value 27 or 28).
+ */
+export function signSecp256k1(privateKey, msgHash) {
+    const sig = crypto.sign('sha256', msgHash, { key: privateKey, dsaEncoding: 'der' });
+    const der = Buffer.from(sig);
+    if (der.length < 8)
+        throw new Error('invalid DER signature');
+    const rLen = der[3];
+    const sLen = der[4 + rLen];
+    const r = der.subarray(4, 4 + rLen);
+    const sStart = 4 + rLen + 2;
+    const s = der.subarray(sStart, sStart + sLen);
+    let rPadded = r.length === 32 ? r : (r.length < 32 ? Buffer.concat([Buffer.alloc(32 - r.length), r]) : r.subarray(-32));
+    let sPadded = s.length === 32 ? s : (s.length < 32 ? Buffer.concat([Buffer.alloc(32 - s.length), s]) : s.subarray(-32));
+    const v = 27 + (der[der.length - 1] & 1);
+    return Buffer.concat([rPadded, sPadded, Buffer.from([v])]);
+}
+//# sourceMappingURL=payment-keys.js.map

package/dist/lib/payment-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payment-keys.js","sourceRoot":"","sources":["../../src/lib/payment-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAOtC,MAAM,UAAU,sBAAsB;IACpC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,mBAAmB,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC,CAAC;IAChG,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,WAAW,CAAC,GAAqB;IACxC,OAAO,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,GAAqB;IAC7D,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACrE,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,GAAqB;IAC7D,OAAO,IAAI,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAqB;IACxD,MAAM,YAAY,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC;IACvE,OAAO,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,OAAO,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,UAA4B;IACrE,OAAO,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAW,CAAC;AACvE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,UAA4B,EAAE,OAAe;IACzE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;IACpF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IACpB,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;IAC5B,MAAM,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;IAC9C,IAAI,OAAO,GAAG,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACxH,IAAI,OAAO,GAAG,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACxH,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7D,CAAC"}

package/dist/lib/payment.d.ts

@@ -0,0 +1,27 @@
+/**
+ * EIP-3009 receiveWithAuthorization message builder + signer (CLI side).
+ *
+ * Phase 2 MVP: build the typed data for USDC on Base Sepolia, sign with
+ * secp256k1, submit to server. Server verifies signature, nonce uniqueness,
+ * and time window.
+ */
+import type { KeyObject } from 'node:crypto';
+export interface Eip3009Payload {
+    from: string;
+    to: string;
+    value: string;
+    validAfter: string;
+    validBefore: string;
+    nonce: string;
+    v: number;
+    r: string;
+    s: string;
+}
+export interface BuildAuthorizationParams {
+    privateKey: KeyObject;
+    to: string;
+    valueUsdcBaseUnits: string | number;
+    validForSeconds?: number;
+}
+export declare function buildAndSignAuthorization(params: BuildAuthorizationParams): Eip3009Payload;
+export declare function loadPaymentKey(pem: string): KeyObject;

package/dist/lib/payment.js

@@ -0,0 +1,123 @@
+/**
+ * EIP-3009 receiveWithAuthorization message builder + signer (CLI side).
+ *
+ * Phase 2 MVP: build the typed data for USDC on Base Sepolia, sign with
+ * secp256k1, submit to server. Server verifies signature, nonce uniqueness,
+ * and time window.
+ */
+import { randomBytes } from 'node:crypto';
+import { keccak_256 } from '@noble/hashes/sha3.js';
+import { exportPaymentAddress, loadPaymentPrivateKey, signSecp256k1, } from './payment-keys.js';
+const BASE_SEPOLIA_USDC = '0x036CbD53842c5426634e7929541eC2318f3dCF7e';
+const BASE_SEPOLIA_CHAIN_ID = 84532;
+const RECEIVE_WITH_AUTHORIZATION_TYPEHASH = keccak256(utf8('ReceiveWithAuthorization(address from,address to,uint256 value,uint256 validAfter,uint256 validBefore,bytes32 nonce)'));
+const DOMAIN_TYPEHASH = keccak256(utf8('EIP712Domain(string name,string version,uint256 chainId,address verifyingContract)'));
+export function buildAndSignAuthorization(params) {
+    const { privateKey, to, valueUsdcBaseUnits, validForSeconds = 3600 } = params;
+    const from = exportPaymentAddress(privateKey);
+    const now = Math.floor(Date.now() / 1000);
+    const value = BigInt(valueUsdcBaseUnits);
+    const validAfter = '0';
+    const validBefore = String(now + validForSeconds);
+    const nonceBytes = randomBytes(32);
+    const nonce = '0x' + Buffer.from(nonceBytes).toString('hex');
+    const domain = computeDomainSeparator(BASE_SEPOLIA_CHAIN_ID, BASE_SEPOLIA_USDC);
+    const structHash = computeStructHash({
+        from,
+        to,
+        value: value.toString(),
+        validAfter,
+        validBefore,
+        nonce,
+    });
+    const msgHash = keccak256(concatBytes([
+        new Uint8Array([0x19, 0x01]),
+        domain,
+        structHash,
+    ]));
+    const sig = signSecp256k1(privateKey, Buffer.from(msgHash));
+    const r = '0x' + sig.subarray(0, 32).toString('hex');
+    const s = '0x' + sig.subarray(32, 64).toString('hex');
+    const v = sig[64];
+    return {
+        from,
+        to,
+        value: value.toString(),
+        validAfter,
+        validBefore,
+        nonce,
+        v,
+        r,
+        s,
+    };
+}
+export function loadPaymentKey(pem) {
+    return loadPaymentPrivateKey(pem);
+}
+function utf8(s) {
+    return new TextEncoder().encode(s);
+}
+function keccak256(data) {
+    return keccak_256(data);
+}
+function pad32(hexNoPrefix) {
+    return hexToBytes(hexNoPrefix.padStart(64, '0'));
+}
+function hexToBytes(hex) {
+    const clean = hex.startsWith('0x') ? hex.slice(2) : hex;
+    if (clean.length % 2 !== 0)
+        throw new Error(`odd hex length: ${hex}`);
+    const out = new Uint8Array(clean.length / 2);
+    for (let i = 0; i < out.length; i++) {
+        out[i] = parseInt(clean.slice(i * 2, i * 2 + 2), 16);
+    }
+    return out;
+}
+function bytesToHex(bytes) {
+    let s = '';
+    for (const b of bytes)
+        s += b.toString(16).padStart(2, '0');
+    return s;
+}
+function concatBytes(arrays) {
+    const total = arrays.reduce((s, a) => s + a.length, 0);
+    const out = new Uint8Array(total);
+    let offset = 0;
+    for (const a of arrays) {
+        out.set(a, offset);
+        offset += a.length;
+    }
+    return out;
+}
+function addressToBytes32(addr) {
+    return pad32(addr.slice(2).toLowerCase());
+}
+function uint256Bytes(value) {
+    const v = BigInt(value);
+    if (v < 0n)
+        throw new Error('negative uint256');
+    return pad32(v.toString(16));
+}
+function computeDomainSeparator(chainId, verifyingContract) {
+    const nameHash = keccak256(utf8('USD Coin'));
+    const versionHash = keccak256(utf8('2'));
+    return keccak256(concatBytes([
+        pad32(bytesToHex(DOMAIN_TYPEHASH)),
+        nameHash,
+        versionHash,
+        pad32(BigInt(chainId).toString(16)),
+        pad32(verifyingContract.slice(2).toLowerCase()),
+    ]));
+}
+function computeStructHash(p) {
+    return keccak256(concatBytes([
+        pad32(bytesToHex(RECEIVE_WITH_AUTHORIZATION_TYPEHASH)),
+        addressToBytes32(p.from),
+        addressToBytes32(p.to),
+        uint256Bytes(p.value),
+        uint256Bytes(p.validAfter),
+        uint256Bytes(p.validBefore),
+        hexToBytes(p.nonce.slice(2)),
+    ]));
+}
+//# sourceMappingURL=payment.js.map

package/dist/lib/payment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payment.js","sourceRoot":"","sources":["../../src/lib/payment.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAc,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,aAAa,GACd,MAAM,mBAAmB,CAAC;AAE3B,MAAM,iBAAiB,GAAG,4CAA4C,CAAC;AACvE,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAEpC,MAAM,mCAAmC,GAAG,SAAS,CACnD,IAAI,CAAC,sHAAsH,CAAC,CAC7H,CAAC;AAEF,MAAM,eAAe,GAAG,SAAS,CAC/B,IAAI,CAAC,oFAAoF,CAAC,CAC3F,CAAC;AAqBF,MAAM,UAAU,yBAAyB,CAAC,MAAgC;IACxE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,kBAAkB,EAAE,eAAe,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;IAC9E,MAAM,IAAI,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,GAAG,CAAC;IACvB,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,GAAG,eAAe,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAE7D,MAAM,MAAM,GAAG,sBAAsB,CAAC,qBAAqB,EAAE,iBAAiB,CAAC,CAAC;IAChF,MAAM,UAAU,GAAG,iBAAiB,CAAC;QACnC,IAAI;QACJ,EAAE;QACF,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE;QACvB,UAAU;QACV,WAAW;QACX,KAAK;KACN,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,SAAS,CAAC,WAAW,CAAC;QACpC,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC5B,MAAM;QACN,UAAU;KACX,CAAC,CAAC,CAAC;IAEJ,MAAM,GAAG,GAAG,aAAa,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5D,MAAM,CAAC,GAAG,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACrD,MAAM,CAAC,GAAG,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACtD,MAAM,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC;IAElB,OAAO;QACL,IAAI;QACJ,EAAE;QACF,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE;QACvB,UAAU;QACV,WAAW;QACX,KAAK;QACL,CAAC;QACD,CAAC;QACD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,OAAO,qBAAqB,CAAC,GAAG,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,IAAI,CAAC,CAAS;IACrB,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,SAAS,CAAC,IAAgB;IACjC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,KAAK,CAAC,WAAmB;IAChC,OAAO,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACxD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,GAAG,EAAE,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,KAAiB;IACnC,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,WAAW,CAAC,MAAoB;IACvC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC;IAAC,CAAC;IACnE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACxB,IAAI,CAAC,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAChD,OAAO,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAe,EAAE,iBAAyB;IACxE,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,OAAO,SAAS,CAAC,WAAW,CAAC;QAC3B,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;QAClC,QAAQ;QACR,WAAW;QACX,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACnC,KAAK,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;KAChD,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAsG;IAC/H,OAAO,SAAS,CAAC,WAAW,CAAC;QAC3B,KAAK,CAAC,UAAU,CAAC,mCAAmC,CAAC,CAAC;QACtD,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC;QACxB,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;QACtB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC;QACrB,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC;QAC1B,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;QAC3B,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;KAC7B,CAAC,CAAC,CAAC;AACN,CAAC"}

package/package.json

@@ -0,0 +1,36 @@
+{
+  "name": "@agentsmarket/cli",
+  "version": "0.1.0",
+  "description": "CLI for agentsmarket.world — agent identity, wallet, and skill invocations",
+  "license": "MIT",
+  "type": "module",
+  "main": "./dist/index.js",
+  "bin": {
+    "agentsmarket": "./dist/index.js"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "test": "node --test --import tsx/esm tests/*.test.ts",
+    "dev": "tsx src/index.ts",
+    "lint": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.30.0",
+    "@noble/curves": "^2.4.0",
+    "@noble/hashes": "^2.4.0",
+    "commander": "^12.1.0",
+    "zod": "^3.25"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "tsx": "^4.19.0",
+    "typescript": "^5.6.0"
+  },
+  "engines": {
+    "node": ">=20"
+  }
+}