@defdone/annon 0.0.0-stage → 0.1.0-alpha.0

package/dist/node/core-adapter.d.ts

@@ -0,0 +1,43 @@
+import '../api/annon.js';
+import '../download/download.js';
+import '../download/proof.js';
+import '../envelope/pay2.js';
+import '../errors.js';
+import '../near/rpc.js';
+import '../oneclick/oneclick.js';
+import '../pay/backup.js';
+import '../pay/purchase.js';
+import '../pay/x402.js';
+import '../relay/capabilities.js';
+import '../relay/fees.js';
+import '../settle-near/codec.js';
+import '../settle-near/identity.js';
+import '../wallet/uncertain.js';
+import '../wallet/wallet.js';
+import './agent.js';
+import './browser-login.js';
+import './budget.js';
+import type { Input } from './cli.js';
+import './errors.js';
+import './io.js';
+import './keychain.js';
+import './paths.js';
+import './payment-terms.js';
+import './purchase-guard.js';
+import './resources.js';
+import './retry-gate.js';
+import './signer-wallet.js';
+import './signing.js';
+import { type Environment } from './wallets.js';
+import './adapter-checks.js';
+import './amounts.js';
+import './offers.js';
+import './origin.js';
+import { type Dependencies } from './command-context.js';
+export type { Dependencies } from './command-context.js';
+/**
+ * Steps run in this order for every command: config and contract trust, the checks that need no
+ * backup secret, the secret, the local stores and the SDK, then the command itself.
+ */
+declare function createCoreAdapter(env?: Environment, d?: Dependencies): (o: Input) => Promise<Record<string, unknown>>;
+export { createCoreAdapter };

package/dist/node/core-adapter.js

@@ -0,0 +1,122 @@
+/** Runs one CLI command against the SDK once config, trust and signer are resolved. */
+// The imports keep node/adapter.ts's original order, bare ones included, so modules initialize as before.
+import { mkdir } from 'node:fs/promises';
+import { join } from 'node:path';
+import '../api/annon.js';
+import '../download/download.js';
+import '../download/proof.js';
+import '../envelope/pay2.js';
+import '../errors.js';
+import '../near/rpc.js';
+import { sleep } from '../net/retry.js';
+import '../oneclick/oneclick.js';
+import '../pay/backup.js';
+import '../pay/purchase.js';
+import { fileStore } from '../pay/store-node.js';
+import '../pay/x402.js';
+import '../relay/capabilities.js';
+import '../relay/fees.js';
+import '../settle-near/codec.js';
+import '../settle-near/identity.js';
+import '../wallet/uncertain.js';
+import '../wallet/wallet.js';
+import './agent.js';
+import './browser-login.js';
+import './budget.js';
+import { loadConfig, trustContract } from './config.js';
+import './errors.js';
+import './io.js';
+import './keychain.js';
+import './paths.js';
+import './payment-terms.js';
+import './purchase-guard.js';
+import './resources.js';
+import './retry-gate.js';
+import { shareHost } from './sharing.js';
+import { selectedShopRules } from './shops.js';
+import './signer-wallet.js';
+import './signing.js';
+import { readBackupSecret } from './wallets.js';
+// Modules split out of the adapter load after its original imports, so initialization order is unchanged.
+import './adapter-checks.js';
+import './amounts.js';
+import './offers.js';
+import './origin.js';
+// The command modules declare functions only; every module they import has loaded by now.
+import { buy, prepareBuy, verifyFile } from './buy-commands.js';
+import { requestContext, } from './command-context.js';
+import { open, recover, status, statusOnChain } from './purchase-commands.js';
+import { createSdk } from './relay-transport.js';
+import { sell, share, stop } from './seller-commands.js';
+import { fileBudget, fund, fundWithNearWallet } from './storage-commands.js';
+/**
+ * Steps run in this order for every command: config and contract trust, the checks that need no
+ * backup secret, the secret, the local stores and the SDK, then the command itself.
+ */
+function createCoreAdapter(env = process.env, d = {}) {
+    const fetcher = d.fetch ?? globalThis.fetch;
+    const wait = d.wait ?? sleep;
+    return async (o) => {
+        const c = await loadConfig(o, env, false, d.agent);
+        await trustContract(c, o.trustContract === true || c.trustContract === true, o.json || d.agent ? undefined : d.prompt);
+        const ctx = requestContext(env, d, fetcher, wait, o, c);
+        if (o.command === 'budget')
+            return fileBudget(ctx);
+        if (o.command === 'verify')
+            return verifyFile(ctx);
+        if (o.command === 'status') {
+            const settled = await statusOnChain(ctx);
+            if (settled)
+                return settled;
+        }
+        const preparedBuy = o.command === 'buy' ? await prepareBuy(ctx) : undefined;
+        const hostedOrigin = o.command === 'share' ? await shareHost(c, o.shop, fetcher) : undefined;
+        const shopRules = o.command === 'share' ? await selectedShopRules(c, o.shop, fetcher) : {};
+        if (o.command === 'fund') {
+            const funded = await fundWithNearWallet(ctx);
+            if (funded)
+                return funded;
+        }
+        let secret;
+        try {
+            secret = await readBackupSecret(o, env);
+        }
+        catch (error) {
+            if (o.command === 'status' && o.target)
+                return ctx.pendingSetup(o.target);
+            throw error;
+        }
+        const storeDir = join(c.stateDir, 'records');
+        const resourceDir = join(c.stateDir, 'resources');
+        if (o.command !== 'status')
+            for (const dir of [storeDir, resourceDir, join(c.stateDir, 'backups')])
+                await mkdir(dir, { recursive: true, mode: 0o700 });
+        const rawStore = fileStore(storeDir);
+        const resources = fileStore(resourceDir);
+        const sdk = createSdk(ctx, rawStore, secret);
+        // The same object as ctx, so the wallet selected so far stays visible to every step.
+        const session = Object.assign(ctx, {
+            secret,
+            storeDir,
+            rawStore,
+            resources,
+            sdk,
+        });
+        if (o.command === 'fund')
+            return fund(session);
+        if (o.command === 'status')
+            return status(session);
+        if (o.command === 'share')
+            return share(session, hostedOrigin, shopRules);
+        if (o.command === 'sell')
+            return sell(session);
+        if (o.command === 'buy')
+            return buy(session, preparedBuy);
+        if (o.command === 'recover')
+            return recover(session);
+        if (o.command === 'stop')
+            return stop(session);
+        return open(session);
+    };
+}
+export { createCoreAdapter };

package/dist/node/errors.d.ts

@@ -0,0 +1,8 @@
+import { AnnonError, type AnnonErrorCode, type PublicError, toPublicError } from '../errors.js';
+/** Adapter-authored messages and exit codes are safe to display to the caller. */
+export declare class AdapterError extends AnnonError {
+    readonly exitCode: PublicError['exitCode'];
+    constructor(code: AnnonErrorCode, message: string, exitCode?: PublicError['exitCode']);
+}
+export declare const usage: () => AdapterError;
+export declare const publicError: typeof toPublicError;

package/dist/node/errors.js

@@ -0,0 +1,12 @@
+import { AnnonError, toPublicError } from '../errors.js';
+/** Adapter-authored messages and exit codes are safe to display to the caller. */
+export class AdapterError extends AnnonError {
+    exitCode;
+    constructor(code, message, exitCode = 1) {
+        super(code, message);
+        this.exitCode = exitCode;
+        this.name = 'AdapterError';
+    }
+}
+export const usage = () => new AdapterError('invalid_arguments', 'Invalid arguments. Run annon --help.', 2);
+export const publicError = toPublicError;

package/dist/node/index.d.ts

@@ -0,0 +1,7 @@
+/** Node-only entry: the adapter behind the annon CLI and the MCP server. */
+export { type AnnonErrorCode, annonErrorCodes, type PublicError } from '../errors.js';
+export { createAdapter } from './adapter.js';
+export type { BudgetRecord } from './budget.js';
+export { BudgetError } from './budget.js';
+export type { Input } from './cli.js';
+export { AdapterError, publicError } from './errors.js';

package/dist/node/index.js

@@ -0,0 +1,5 @@
+/** Node-only entry: the adapter behind the annon CLI and the MCP server. */
+export { annonErrorCodes } from '../errors.js';
+export { createAdapter } from './adapter.js';
+export { BudgetError } from './budget.js';
+export { AdapterError, publicError } from './errors.js';

package/dist/node/io.d.ts

@@ -0,0 +1,13 @@
+import type { ReplayableSource } from '../envelope/replay.js';
+/** Also supplies serveFile's size/read(start) interface without buffering the disk file. */
+export declare function fileSource(path: string): Promise<ReplayableSource & {
+    read(start?: number): ReadableStream<Uint8Array>;
+}>;
+/** No requested output name is created until the producer and final authentication succeed. */
+export declare function withOutput<T>(path: string, write: (sink: WritableStream<Uint8Array>) => Promise<T>): Promise<T>;
+export declare function writeStream(path: string, stream: ReadableStream<Uint8Array>): Promise<void>;
+/** Encrypted disk spool for a non-replayable download; always removed on success or failure. */
+export declare function withSpool<T>(output: string, stream: ReadableStream<Uint8Array>, use: (source: ReplayableSource) => Promise<T>): Promise<T>;
+export declare function newOutput(path: string): Promise<void>;
+/** Portable backups are complete and synced before the SDK proceeds to payment or key release. */
+export declare function writeBackup(path: string, content: string): Promise<void>;

package/dist/node/io.js

@@ -0,0 +1,112 @@
+import { randomBytes } from 'node:crypto';
+import { createReadStream } from 'node:fs';
+import { link, lstat, mkdtemp, open, rename, rm, stat, unlink } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { Readable } from 'node:stream';
+import { AdapterError } from './errors.js';
+/** Also supplies serveFile's size/read(start) interface without buffering the disk file. */
+export async function fileSource(path) {
+    const info = await stat(path);
+    if (!info.isFile())
+        throw new TypeError('expected a regular file');
+    return {
+        size: info.size,
+        read: (start = 0) => Readable.toWeb(createReadStream(path, { start, highWaterMark: 256 * 1024 }), {
+            strategy: { highWaterMark: 256 * 1024, size: (chunk) => chunk.length },
+        }),
+    };
+}
+/** No requested output name is created until the producer and final authentication succeed. */
+export async function withOutput(path, write) {
+    await newOutput(path);
+    const temp = `${path}.${randomBytes(8).toString('hex')}.tmp`;
+    const handle = await open(temp, 'wx', 0o600);
+    try {
+        let result;
+        try {
+            result = await write(new WritableStream({ write: (chunk) => handle.writeFile(chunk) }));
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+        // Hard-link the complete inode exclusively: the requested name is never empty.
+        try {
+            await link(temp, path);
+        }
+        catch (error) {
+            if (error.code === 'EEXIST')
+                await newOutput(path);
+            throw error;
+        }
+        await unlink(temp);
+        const dir = await open(dirname(path), 'r');
+        try {
+            await dir.sync();
+        }
+        finally {
+            await dir.close();
+        }
+        return result;
+    }
+    finally {
+        await unlink(temp).catch(() => { });
+    }
+}
+export async function writeStream(path, stream) {
+    try {
+        await withOutput(path, (sink) => stream.pipeTo(sink));
+    }
+    catch (error) {
+        await stream.cancel(error).catch(() => { });
+        throw error;
+    }
+}
+/** Encrypted disk spool for a non-replayable download; always removed on success or failure. */
+export async function withSpool(output, stream, use) {
+    const dir = await mkdtemp(join(dirname(output), '.annon-spool-'));
+    try {
+        const path = join(dir, 'encrypted');
+        await writeStream(path, stream);
+        return await use(await fileSource(path));
+    }
+    finally {
+        await rm(dir, { recursive: true, force: true });
+    }
+}
+export async function newOutput(path) {
+    try {
+        await lstat(path);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return;
+        throw error;
+    }
+    throw new AdapterError('output_exists', 'Choose a new output path; the existing file will not be overwritten.', 2);
+}
+/** Portable backups are complete and synced before the SDK proceeds to payment or key release. */
+export async function writeBackup(path, content) {
+    const temp = `${path}.${randomBytes(8).toString('hex')}.tmp`;
+    const handle = await open(temp, 'wx', 0o600);
+    try {
+        try {
+            await handle.writeFile(content);
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+        await rename(temp, path);
+        const dir = await open(dirname(path), 'r');
+        try {
+            await dir.sync();
+        }
+        finally {
+            await dir.close();
+        }
+    }
+    finally {
+        await unlink(temp).catch(() => { });
+    }
+}

package/dist/node/keychain.d.ts

@@ -0,0 +1,10 @@
+import type { Identity } from '../settle-near/identity.js';
+/** Inject this boundary in every test. Entry is a public service/account reference, never a secret. */
+export interface Keychain {
+    read(entry: string): Promise<string>;
+    create(kind: 'evm' | 'near', entry: string, nearAccount?: string): Promise<Identity & {
+        publicKey?: string;
+    }>;
+}
+export declare const osKeychain: Keychain;
+export declare function decodeKeychain(value: string): string;

package/dist/node/keychain.js

@@ -0,0 +1,67 @@
+import { execFile, spawn } from 'node:child_process';
+import { promisify } from 'node:util';
+import { base58 } from '@scure/base';
+import { KeyPair } from 'near-api-js';
+import { generatePrivateKey, privateKeyToAccount } from 'viem/accounts';
+const entryParts = (entry) => {
+    const [service, account = service] = entry.split('/');
+    if (!service ||
+        !account ||
+        entry.split('/').length > 2 ||
+        !/^[a-zA-Z0-9_.:@-]+$/.test(service + account))
+        throw new TypeError('invalid keychain reference');
+    return { service, account };
+};
+export const osKeychain = {
+    async read(entry) {
+        if (process.platform !== 'darwin')
+            throw new Error('OS keychain adapter currently requires macOS; use an env/file/remote signer');
+        const { service, account } = entryParts(entry);
+        const { stdout } = await promisify(execFile)('/usr/bin/security', ['find-generic-password', '-s', service, '-a', account, '-w'], { timeout: 10000, maxBuffer: 16384 });
+        return stdout.trim();
+    },
+    async create(kind, entry, nearAccount) {
+        if (process.platform !== 'darwin')
+            throw new Error('OS keychain adapter currently requires macOS');
+        const { service, account } = entryParts(entry);
+        let secret;
+        let identity;
+        if (kind === 'near') {
+            if (!nearAccount)
+                throw new Error('NEAR account required');
+            const key = KeyPair.fromRandom('ed25519');
+            secret = JSON.stringify({
+                account_id: nearAccount,
+                public_key: key.getPublicKey().toString(),
+                private_key: key.toString(),
+            });
+            identity = { kind, id: nearAccount, publicKey: key.getPublicKey().toString() };
+        }
+        else {
+            secret = generatePrivateKey();
+            identity = { kind, id: privateKeyToAccount(secret).address.toLowerCase() };
+        }
+        // An empty trusted-app ACL removes the creator (security) from automatic access.
+        // Reads require macOS approval; never trust the generic security executable.
+        // Feed security's command interpreter via stdin, keeping secrets out of process arguments.
+        // Base58 is an encoding inside the keychain, not a config-file credential.
+        const encoded = base58.encode(new TextEncoder().encode(secret));
+        await new Promise((resolve, reject) => {
+            const child = spawn('/usr/bin/security', ['-i'], { stdio: ['pipe', 'ignore', 'pipe'] });
+            let failed = false;
+            child.stderr.on('data', (b) => {
+                if (/SecKeychain|Error|error|already exists/.test(String(b)))
+                    failed = true;
+            });
+            child.on('error', reject);
+            child.on('exit', (code) => code === 0 && !failed ? resolve() : reject(new Error('keychain storage failed')));
+            child.stdin.end(`add-generic-password -s ${service} -a ${account} -T "" -w ${encoded}\n`);
+        });
+        return identity;
+    },
+};
+export function decodeKeychain(value) {
+    if (value.startsWith('{') || value.startsWith('0x'))
+        return value;
+    return new TextDecoder().decode(base58.decode(value));
+}

package/dist/node/main.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/node/main.js

@@ -0,0 +1,21 @@
+#!/usr/bin/env node
+import { createInterface } from 'node:readline/promises';
+import { createAdapter } from './adapter.js';
+import { runCli } from './cli.js';
+const adapter = createAdapter(process.env, {
+    ...(process.stdin.isTTY && process.stderr.isTTY
+        ? {
+            prompt: async (message) => {
+                const reader = createInterface({ input: process.stdin, output: process.stderr });
+                try {
+                    return (await reader.question(message)).trim().toLowerCase() === 'yes';
+                }
+                finally {
+                    reader.close();
+                }
+            },
+        }
+        : {}),
+    notify: (message) => process.stderr.write(`${message}\n`),
+});
+process.exitCode = await runCli(process.argv.slice(2), adapter, (text) => process.stdout.write(`${text}\n`));

package/dist/node/offers.d.ts

@@ -0,0 +1,16 @@
+import { type PaymentRequired } from '../pay/x402.js';
+import type { Config } from './config.js';
+declare const requestOptions: {
+    readonly redirect: "error";
+    readonly credentials: "omit";
+    readonly cache: "no-store";
+};
+declare function response(url: string, fetcher: typeof fetch, headers?: Record<string, string>): Promise<Response>;
+declare function offer(target: string, c: Config, fetcher: typeof fetch, provided?: PaymentRequired, expectedUrl?: string): Promise<{
+    pr: PaymentRequired;
+    url: string;
+    header: Uint8Array<ArrayBufferLike>;
+    fileId: string;
+}>;
+declare function resourceHeader(url: string, c: Config, fetcher: typeof fetch): Promise<Uint8Array<ArrayBufferLike>>;
+export { offer, requestOptions, resourceHeader, response };

package/dist/node/offers.js

@@ -0,0 +1,91 @@
+/** Reads x402 offers and PAY2 headers over HTTPS for the CLI. */
+import { readFile } from 'node:fs/promises';
+import { secureUrl } from '../download/download.js';
+import { sameResource } from '../download/proof.js';
+import { MAX_HEADER, parseHeader } from '../envelope/pay2.js';
+import { discover, readPaymentRequired } from '../pay/x402.js';
+import { hex } from '../settle-near/codec.js';
+import { fail } from './adapter-checks.js';
+import { usage } from './errors.js';
+const requestOptions = { redirect: 'error', credentials: 'omit', cache: 'no-store' };
+async function response(url, fetcher, headers) {
+    const u = secureUrl(url);
+    if (u.username || u.password)
+        throw usage();
+    return fetcher(u, {
+        ...requestOptions,
+        signal: AbortSignal.timeout(20000),
+        ...(headers ? { headers } : {}),
+    });
+}
+async function headerAt(url, fetcher, initial) {
+    const r = initial ?? (await response(url, fetcher, { Range: `bytes=0-${MAX_HEADER - 1}` }));
+    if (![200, 206].includes(r.status) || !r.body)
+        throw new Error('header unavailable');
+    const reader = r.body.getReader();
+    const parts = [];
+    let size = 0;
+    try {
+        while (size < MAX_HEADER) {
+            const next = await reader.read();
+            if (next.done)
+                break;
+            const part = next.value.subarray(0, MAX_HEADER - size);
+            parts.push(part);
+            size += part.length;
+        }
+    }
+    finally {
+        await reader.cancel();
+    }
+    const b = Buffer.concat(parts);
+    if (b.length < 12)
+        throw new Error('short header');
+    const length = b.readUInt32BE(8);
+    if (length > MAX_HEADER || length > b.length)
+        throw new Error('bad header length');
+    return new Uint8Array(b.subarray(0, length));
+}
+async function offer(target, c, fetcher, provided, expectedUrl) {
+    let pr;
+    if (provided)
+        pr = provided;
+    else if (/^https?:/.test(target)) {
+        const r = await response(target, fetcher);
+        await r.body?.cancel();
+        const required = r.headers.get('PAYMENT-REQUIRED');
+        if (!required)
+            return fail('offer_required', 'The URL must advertise an Annon PAYMENT-REQUIRED offer.');
+        pr = readPaymentRequired(required);
+    }
+    else {
+        // A named file contains the decoded x402 JSON; SDK parsing remains authoritative.
+        const text = await readFile(target, 'utf8');
+        pr = readPaymentRequired(Buffer.from(text).toString('base64'));
+    }
+    const found = discover(pr, [c.contractId]);
+    const url = pr.resource?.url;
+    if (typeof url !== 'string' ||
+        !sameResource(url, /^https?:/.test(target) ? target : (expectedUrl ?? '')))
+        throw new Error('resource mismatch');
+    secureUrl(url);
+    const header = pr.extensions?.annon?.info.header;
+    if (typeof header !== 'string')
+        throw new Error('header missing');
+    if (secureUrl(header).origin !== new URL(url).origin)
+        throw new Error('header origin mismatch');
+    return { pr, url, header: await headerAt(header, fetcher), fileId: found.fileId };
+}
+async function resourceHeader(url, c, fetcher) {
+    const r = await response(url, fetcher, { Range: `bytes=0-${MAX_HEADER - 1}` });
+    const required = r.headers.get('PAYMENT-REQUIRED');
+    if (r.status === 402 && required) {
+        await r.body?.cancel();
+        const found = await offer(url, c, fetcher, readPaymentRequired(required));
+        if (hex(parseHeader(new Uint8Array(found.header)).fileId) !== found.fileId)
+            throw new Error('offer header mismatch');
+        return found.header;
+    }
+    return headerAt(url, fetcher, r);
+}
+export { offer, requestOptions, resourceHeader, response };

package/dist/node/origin.d.ts

@@ -0,0 +1,11 @@
+/** Resolves the 1Click source chain, asset and refund address for a cross-chain purchase. */
+import { type Origin } from '../oneclick/oneclick.js';
+import type { Input } from './cli.js';
+import type { Config } from './config.js';
+import type { SourceAsset } from './payment-terms.js';
+import type { Environment, LocalWallet } from './wallets.js';
+declare function originFor(o: Input, env: Environment, wallet: LocalWallet, fetcher: typeof fetch, c: Config): Promise<Origin & {
+    sourceAsset: SourceAsset;
+    maxSourceAmount?: string;
+}>;
+export { originFor };

package/dist/node/origin.js

@@ -0,0 +1,80 @@
+/** Resolves the 1Click source chain, asset and refund address for a cross-chain purchase. */
+import { originFamily } from '../oneclick/oneclick.js';
+import { bytes } from '../settle-near/codec.js';
+import { fail } from './adapter-checks.js';
+import { response } from './offers.js';
+const tokenIdentifier = (value) => typeof value === 'string' &&
+    value.length >= 1 &&
+    value.length <= 128 &&
+    !/[^A-Za-z0-9._:-]/.test(value);
+const chainAliases = new Map([
+    ['solana', 'sol'],
+    ['ethereum', 'eth'],
+    ['arbitrum', 'arb'],
+    ['polygon', 'pol'],
+    ['optimism', 'op'],
+    ['avalanche', 'avax'],
+    ['berachain', 'bera'],
+]);
+async function originFor(o, env, wallet, fetcher, c) {
+    const sourcePolicy = o.origin ? c.origins?.[o.origin] : undefined;
+    if (o.origin) {
+        if (!c.origins || !Object.hasOwn(c.origins, o.origin))
+            return fail('origin_not_allowed', 'Choose a human-configured origin name.', 2);
+        o = { ...o, ...c.origins[o.origin] };
+    }
+    const inputChain = o.fromChain ?? env.ANNON_FROM_CHAIN;
+    const chain = inputChain ? (chainAliases.get(inputChain) ?? inputChain) : undefined;
+    if (!chain)
+        return fail('origin_required', 'Choose --from-chain and optionally --from-asset for 1Click.', 2);
+    let asset = o.fromAsset ?? env.ANNON_FROM_ASSET;
+    let token;
+    if (!asset) {
+        const r = await response('https://1click.chaindefuser.com/v0/tokens', fetcher);
+        if (!r.ok)
+            throw new Error('tokens unavailable');
+        const tokens = (await r.json());
+        const matches = tokens.filter((t) => t.blockchain === chain && t.symbol === 'USDC');
+        if (matches.length !== 1)
+            return fail('origin_asset_required', 'Specify --from-asset with the exact 1Click nep141 asset ID for this chain.', 2);
+        token = matches[0];
+        asset = matches[0]?.assetId;
+    }
+    if (!tokenIdentifier(asset))
+        return fail('origin_asset_required', 'Specify --from-asset with a valid 1Click asset ID.', 2);
+    const kind = originFamily(chain);
+    let refundTo = o.refundTo ?? env.ANNON_REFUND_TO;
+    if (!refundTo && kind === wallet.identity.kind) {
+        refundTo = wallet.identity.id;
+        if (kind === 'solana') {
+            const { base58 } = await import('@scure/base');
+            refundTo = base58.encode(bytes(`0x${wallet.identity.id}`, 32));
+        }
+    }
+    if (!asset || !refundTo)
+        return fail('origin_required', 'Provide --from-asset and --refund-to for the source chain.', 2);
+    const decimals = token?.decimals;
+    const contractAddress = token?.contractAddress;
+    return {
+        asset,
+        chain: kind,
+        refundTo,
+        ...(sourcePolicy?.maxSourceAmount ? { maxSourceAmount: sourcePolicy.maxSourceAmount } : {}),
+        sourceAsset: {
+            ...(sourcePolicy?.usdcDecimals !== undefined
+                ? { symbol: 'USDC', decimals: sourcePolicy.usdcDecimals }
+                : {}),
+            chain,
+            asset,
+            ...(token ? { symbol: token.symbol } : {}),
+            ...(typeof decimals === 'number' &&
+                Number.isInteger(decimals) &&
+                decimals >= 0 &&
+                decimals <= 255
+                ? { decimals }
+                : {}),
+            ...(tokenIdentifier(contractAddress) ? { contractAddress } : {}),
+        },
+    };
+}
+export { originFor };

package/dist/node/paths.d.ts

@@ -0,0 +1,3 @@
+import type { Input } from './cli.js';
+/** Canonical paths are passed to I/O; tool-relative paths start at the operator directory. */
+export declare function confinePaths(input: Input, workDir: string): Promise<Input>;