@ametyst/cli 0.2.0

package/native/Cargo.toml

@@ -0,0 +1,25 @@
+[package]
+name = "ametyst-vault"
+version = "0.1.0"
+edition = "2021"
+
+[lib]
+crate-type = ["cdylib"]
+
+[dependencies]
+napi = { version = "2", features = ["napi8"] }
+napi-derive = "2"
+aes-gcm = "0.10"
+scrypt = { version = "0.11", features = ["simple"] }
+zeroize = { version = "1", features = ["derive"] }
+libc = "0.2"
+rand = "0.8"
+uuid = { version = "1", features = ["v4"] }
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+hex = "0.4"
+k256 = { version = "0.13", features = ["ecdsa"] }
+sha3 = "0.10"
+
+[build-dependencies]
+napi-build = "2"

package/native/build.rs

@@ -0,0 +1,4 @@
+extern crate napi_build;
+fn main() {
+  napi_build::setup();
+}

package/native/index.d.ts

@@ -0,0 +1,9 @@
+/* tslint:disable */
+/* eslint-disable */
+
+/* auto-generated by NAPI-RS */
+
+export declare function hardenProcess(): void
+export declare function createWallet(passphrase: string): string
+export declare function decryptWallet(keystoreJson: string, passphrase: string): string
+export declare function getWalletAddress(keystoreJson: string): string

package/native/package.json

@@ -0,0 +1,9 @@
+{
+  "name": "ametyst-vault",
+  "version": "0.1.0",
+  "private": true,
+  "napi": {
+    "name": "ametyst-vault",
+    "triples": {}
+  }
+}

package/native/src/.gitkeep

@@ -0,0 +1 @@
+

package/native/src/lib.rs

@@ -0,0 +1,229 @@
+use aes_gcm::aead::{Aead, KeyInit};
+use aes_gcm::{Aes256Gcm, Nonce};
+use k256::ecdsa::SigningKey;
+use libc::{c_void, mlock, munlock, rlimit, setrlimit, RLIMIT_CORE};
+use napi_derive::napi;
+use rand::rngs::OsRng;
+use rand::RngCore;
+use scrypt::{scrypt, Params};
+use serde::{Deserialize, Serialize};
+use sha3::{Digest, Keccak256};
+use std::ptr;
+use uuid::Uuid;
+use zeroize::Zeroize;
+
+const SCRYPT_N_LOG2: u8 = 18;
+const SCRYPT_R: u32 = 8;
+const SCRYPT_P: u32 = 1;
+const SCRYPT_DKLEN: usize = 32;
+
+struct SecretBytes {
+  bytes: Vec<u8>,
+}
+
+impl SecretBytes {
+  fn new(bytes: Vec<u8>) -> Self {
+    let secret = Self { bytes };
+    let ptr = secret.bytes.as_ptr() as *const c_void;
+    let len = secret.bytes.len();
+    unsafe {
+      let _ = mlock(ptr, len);
+    }
+    secret
+  }
+
+  fn as_slice(&self) -> &[u8] {
+    &self.bytes
+  }
+
+  fn to_vec(&self) -> Vec<u8> {
+    self.bytes.clone()
+  }
+}
+
+impl Drop for SecretBytes {
+  fn drop(&mut self) {
+    let ptr = self.bytes.as_ptr() as *const c_void;
+    let len = self.bytes.len();
+    self.bytes.zeroize();
+    unsafe {
+      let _ = munlock(ptr, len);
+    }
+  }
+}
+
+#[derive(Serialize, Deserialize)]
+struct Keystore {
+  version: u8,
+  id: String,
+  address: String,
+  crypto: Crypto,
+}
+
+#[derive(Serialize, Deserialize)]
+struct Crypto {
+  cipher: String,
+  ciphertext: String,
+  cipherparams: CipherParams,
+  kdf: String,
+  kdfparams: KdfParams,
+}
+
+#[derive(Serialize, Deserialize)]
+struct CipherParams {
+  iv: String,
+  tag: String,
+}
+
+#[derive(Serialize, Deserialize)]
+struct KdfParams {
+  n: u32,
+  r: u32,
+  p: u32,
+  dklen: usize,
+  salt: String,
+}
+
+fn derive_address_from_private_key(private_key: &[u8]) -> napi::Result<String> {
+  let signing_key = SigningKey::from_slice(private_key)
+    .map_err(|e| napi::Error::from_reason(format!("invalid private key: {e}")))?;
+  let verify_key = signing_key.verifying_key();
+  let encoded = verify_key.to_encoded_point(false);
+  let pubkey = encoded.as_bytes();
+  let mut hasher = Keccak256::new();
+  hasher.update(&pubkey[1..]);
+  let hash = hasher.finalize();
+  let address = &hash[12..];
+  Ok(format!("0x{}", hex::encode(address)))
+}
+
+#[napi(js_name = "hardenProcess")]
+pub fn harden_process() -> napi::Result<()> {
+  #[cfg(target_os = "macos")]
+  unsafe {
+    const PT_DENY_ATTACH: i32 = 31;
+    libc::ptrace(PT_DENY_ATTACH, 0, ptr::null_mut(), 0);
+  }
+
+  #[cfg(target_os = "linux")]
+  unsafe {
+    libc::prctl(libc::PR_SET_DUMPABLE, 0, 0, 0, 0);
+  }
+
+  let lim = rlimit {
+    rlim_cur: 0,
+    rlim_max: 0,
+  };
+  unsafe {
+    setrlimit(RLIMIT_CORE, &lim);
+  }
+
+  Ok(())
+}
+
+#[napi(js_name = "createWallet")]
+pub fn create_wallet(passphrase: String) -> napi::Result<String> {
+  let mut private_key = [0u8; 32];
+  OsRng.fill_bytes(&mut private_key);
+  let secret_private_key = SecretBytes::new(private_key.to_vec());
+  private_key.zeroize();
+
+  let address = derive_address_from_private_key(secret_private_key.as_slice())?;
+
+  let mut salt = [0u8; 32];
+  OsRng.fill_bytes(&mut salt);
+  let params = Params::new(SCRYPT_N_LOG2, SCRYPT_R, SCRYPT_P, SCRYPT_DKLEN)
+    .map_err(|e| napi::Error::from_reason(format!("scrypt params error: {e}")))?;
+  let mut derived_key = [0u8; SCRYPT_DKLEN];
+  scrypt(passphrase.as_bytes(), &salt, &params, &mut derived_key)
+    .map_err(|e| napi::Error::from_reason(format!("scrypt failed: {e}")))?;
+  let secret_derived_key = SecretBytes::new(derived_key.to_vec());
+  derived_key.zeroize();
+
+  let mut iv = [0u8; 12];
+  OsRng.fill_bytes(&mut iv);
+  let cipher = Aes256Gcm::new_from_slice(secret_derived_key.as_slice())
+    .map_err(|e| napi::Error::from_reason(format!("cipher init failed: {e}")))?;
+  let encrypted = cipher
+    .encrypt(Nonce::from_slice(&iv), secret_private_key.as_slice())
+    .map_err(|e| napi::Error::from_reason(format!("encrypt failed: {e}")))?;
+
+  if encrypted.len() < 16 {
+    return Err(napi::Error::from_reason("encrypted payload too short"));
+  }
+  let split = encrypted.len() - 16;
+  let ciphertext = &encrypted[..split];
+  let tag = &encrypted[split..];
+
+  let keystore = Keystore {
+    version: 3,
+    id: Uuid::new_v4().to_string(),
+    address,
+    crypto: Crypto {
+      cipher: "aes-256-gcm".to_string(),
+      ciphertext: hex::encode(ciphertext),
+      cipherparams: CipherParams {
+        iv: hex::encode(iv),
+        tag: hex::encode(tag),
+      },
+      kdf: "scrypt".to_string(),
+      kdfparams: KdfParams {
+        n: 1 << SCRYPT_N_LOG2,
+        r: SCRYPT_R,
+        p: SCRYPT_P,
+        dklen: SCRYPT_DKLEN,
+        salt: hex::encode(salt),
+      },
+    },
+  };
+
+  serde_json::to_string(&keystore)
+    .map_err(|e| napi::Error::from_reason(format!("keystore serialization failed: {e}")))
+}
+
+#[napi(js_name = "decryptWallet")]
+pub fn decrypt_wallet(keystore_json: String, passphrase: String) -> napi::Result<String> {
+  let keystore: Keystore = serde_json::from_str(&keystore_json)
+    .map_err(|e| napi::Error::from_reason(format!("invalid keystore json: {e}")))?;
+
+  let salt = hex::decode(&keystore.crypto.kdfparams.salt)
+    .map_err(|e| napi::Error::from_reason(format!("invalid salt: {e}")))?;
+  let params = Params::new(
+    (32 - keystore.crypto.kdfparams.n.leading_zeros() - 1) as u8,
+    keystore.crypto.kdfparams.r,
+    keystore.crypto.kdfparams.p,
+    keystore.crypto.kdfparams.dklen,
+  )
+  .map_err(|e| napi::Error::from_reason(format!("invalid scrypt params: {e}")))?;
+
+  let mut derived_key = vec![0u8; keystore.crypto.kdfparams.dklen];
+  scrypt(passphrase.as_bytes(), &salt, &params, &mut derived_key)
+    .map_err(|e| napi::Error::from_reason(format!("scrypt failed: {e}")))?;
+  let secret_derived_key = SecretBytes::new(derived_key.clone());
+  derived_key.zeroize();
+
+  let iv = hex::decode(&keystore.crypto.cipherparams.iv)
+    .map_err(|e| napi::Error::from_reason(format!("invalid iv: {e}")))?;
+  let tag = hex::decode(&keystore.crypto.cipherparams.tag)
+    .map_err(|e| napi::Error::from_reason(format!("invalid tag: {e}")))?;
+  let ciphertext = hex::decode(&keystore.crypto.ciphertext)
+    .map_err(|e| napi::Error::from_reason(format!("invalid ciphertext: {e}")))?;
+
+  let mut payload = ciphertext;
+  payload.extend_from_slice(&tag);
+  let cipher = Aes256Gcm::new_from_slice(secret_derived_key.as_slice())
+    .map_err(|e| napi::Error::from_reason(format!("cipher init failed: {e}")))?;
+  let decrypted = cipher
+    .decrypt(Nonce::from_slice(&iv), payload.as_ref())
+    .map_err(|e| napi::Error::from_reason(format!("decrypt failed: {e}")))?;
+  let secret_private_key = SecretBytes::new(decrypted);
+
+  Ok(format!("0x{}", hex::encode(secret_private_key.to_vec())))
+}
+
+#[napi(js_name = "getWalletAddress")]
+pub fn get_wallet_address(keystore_json: String) -> napi::Result<String> {
+  let keystore: Keystore = serde_json::from_str(&keystore_json)
+    .map_err(|e| napi::Error::from_reason(format!("invalid keystore json: {e}")))?;
+  Ok(keystore.address)
+}

package/package.json

@@ -0,0 +1,76 @@
+{
+  "name": "@ametyst/cli",
+  "version": "0.2.0",
+  "private": false,
+  "description": "Ametyst CLI — embedded MCP server, wallet ops, agent payments",
+  "type": "module",
+  "bin": {
+    "ametyst": "./dist/index.js"
+  },
+  "main": "dist/index.js",
+  "files": [
+    "dist",
+    "ametyst.node",
+    "index.d.ts",
+    "native"
+  ],
+  "engines": {
+    "node": ">=20",
+    "pnpm": ">=9"
+  },
+  "napi": {
+    "name": "ametyst",
+    "package": {
+      "name": "@ametyst-dev/cli"
+    },
+    "triples": {
+      "defaults": false,
+      "additional": [
+        "aarch64-apple-darwin",
+        "x86_64-apple-darwin",
+        "x86_64-unknown-linux-gnu"
+      ]
+    }
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "1.29.0",
+    "@napi-rs/keyring": "1.1.7",
+    "mcp-use": "1.24.2"
+  },
+  "_comment_optionalDependencies": "Injected at publish-time by publish-staging.yml / publish-prod.yml via `npm pkg set` with the version being published. Not committed here so pnpm install (locally + CI) doesn't try to resolve sub-package versions that may not exist on the registry between releases.",
+  "devDependencies": {
+    "@ametyst-dev/sdk-prod": "^0.2.0",
+    "@napi-rs/cli": "2.18.4",
+    "@types/node": "20.19.39",
+    "@types/prompts": "2.4.9",
+    "@zerodev/permissions": "5.6.3",
+    "@zerodev/sdk": "5.5.7",
+    "commander": "12.0.0",
+    "prompts": "2.4.2",
+    "tsup": "8.5.1",
+    "tsx": "4.19.2",
+    "typescript": "5.2.2",
+    "viem": "2.38.6",
+    "vitest": "2.1.9"
+  },
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org"
+  },
+  "optionalDependencies": {
+    "@ametyst/cli-darwin-arm64": "0.2.0",
+    "@ametyst/cli-darwin-x64": "0.2.0",
+    "@ametyst/cli-linux-x64-gnu": "0.2.0"
+  },
+  "scripts": {
+    "build:native": "cd native && cargo build --release && napi build --release",
+    "build:ts": "tsc",
+    "build": "tsup",
+    "build:staging": "AMETYST_BUILD_ENV=staging tsup",
+    "build:prod": "AMETYST_BUILD_ENV=prod tsup",
+    "dev": "tsup --watch",
+    "test": "vitest run",
+    "lint": "echo 'no lint configured yet' && exit 0",
+    "typecheck": "tsc --noEmit",
+    "perf:start-session": "tsx scripts/perf-start-session.ts"
+  }
+}