@genkaku/protocol 0.1.17 → 0.1.19

package/dist/bridge.d.ts

@@ -1,4 +1,5 @@
 import type { Libp2p } from 'libp2p';
+import { type WalletControl } from './walletControl.ts';
 import type { Hex } from 'viem';
 import type { ModeManager, RoleMode } from './modeManager.ts';
 import type { NetEnvironment } from './netconfig.ts';
@@ -39,15 +40,8 @@ export type BridgeOptions = {
         settle?: boolean;
     }) => void | Promise<void>;
     /** Wallet operations the panel drives. Key material only ever leaves over
-     *  loopback CORS, and only after an explicit confirmation flag. */
-    wallet?: {
-        address: () => string;
-        exportKey: () => string;
-        importKey: (privateKey: string) => void;
-        rotate: () => void;
-        /** testnet only; mints MockUSDC to the current user wallet */
-        mint?: (amount: bigint) => Promise<string>;
-    };
+     *  the panel CORS gate, and only after an explicit confirmation flag. */
+    wallet?: WalletControl;
     /** P4.9h: derived credit per worker wallet (escrow events, not self-report).
      *  Absent = offers keep whatever the worker claimed. */
     credit?: (wallets: string[]) => Map<string, {

package/dist/bridge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bridge.d.ts","sourceRoot":"","sources":["../src/bridge.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAGpC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAA;AAc/B,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AACpD,OAAO,EAAgB,MAAM,EAAc,MAAM,YAAY,CAAA;AAI7D,uEAAuE;AACvE,MAAM,MAAM,YAAY,GAAG;IACzB,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,UAAU,CAAC,OAAO,MAAM,CAAC,CAAA;KAAE,CAAC,CAAA;IACjE,GAAG,EAAE,MAAM,CAAA;IACX,8EAA8E;IAC9E,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,CAAA;CAChD,CAAA;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,cAAc,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,OAAO,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IAC9B,OAAO,EAAE,MAAM,GAAG,CAAA;IAClB,yEAAyE;IACzE,MAAM,EAAE,OAAO,CAAA;IACf,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC3B,wFAAwF;IACxF,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IACnC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,YAAY,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IAC3F,wDAAwD;IACxD,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACjD;gFAC4E;IAC5E,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACtF;uEACmE;IACnE,MAAM,CAAC,EAAE;QACP,OAAO,EAAE,MAAM,MAAM,CAAA;QACrB,SAAS,EAAE,MAAM,MAAM,CAAA;QACvB,SAAS,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,IAAI,CAAA;QACvC,MAAM,EAAE,MAAM,IAAI,CAAA;QAClB,8DAA8D;QAC9D,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;KAC3C,CAAA;IACD;4DACwD;IACxD,MAAM,CAAC,EAAE,CACP,OAAO,EAAE,MAAM,EAAE,KACd,GAAG,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAA;CAClH,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3B,CAAA;AAuJD,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CA2nBlF"}
+{"version":3,"file":"bridge.d.ts","sourceRoot":"","sources":["../src/bridge.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAGpC,OAAO,EAAmB,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAA;AACxE,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAA;AAc/B,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AACpD,OAAO,EAAgB,MAAM,EAAc,MAAM,YAAY,CAAA;AAI7D,uEAAuE;AACvE,MAAM,MAAM,YAAY,GAAG;IACzB,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,UAAU,CAAC,OAAO,MAAM,CAAC,CAAA;KAAE,CAAC,CAAA;IACjE,GAAG,EAAE,MAAM,CAAA;IACX,8EAA8E;IAC9E,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,CAAA;CAChD,CAAA;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,cAAc,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,OAAO,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IAC9B,OAAO,EAAE,MAAM,GAAG,CAAA;IAClB,yEAAyE;IACzE,MAAM,EAAE,OAAO,CAAA;IACf,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC3B,wFAAwF;IACxF,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IACnC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,YAAY,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IAC3F,wDAAwD;IACxD,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACjD;gFAC4E;IAC5E,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACtF;6EACyE;IACzE,MAAM,CAAC,EAAE,aAAa,CAAA;IACtB;4DACwD;IACxD,MAAM,CAAC,EAAE,CACP,OAAO,EAAE,MAAM,EAAE,KACd,GAAG,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAA;CAClH,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3B,CAAA;AAuJD,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAskBlF"}

package/dist/bridge.js

@@ -4,7 +4,8 @@
 // escrow on Base Sepolia. No provider wire code leaks into dsh.
 import { appendFileSync } from 'node:fs';
 import { createServer } from 'node:http';
-import { applyLoopbackCors } from "./cors.js";
+import { applyPanelCors } from "./cors.js";
+import { runWalletAction } from "./walletControl.js";
 import { openEscrow, publicClientFor, readWorker, refundSession, settleSession, signReceiptPayload, walletAddress, walletClientFor, } from "./chain.js";
 import { dialWorkerAny, fetchOffers, requestSettleCosign } from "./dial.js";
 import { dedupeOffers, toWire } from "./offer.js";
@@ -533,7 +534,7 @@ export async function startOpenAiBridge(opts) {
         void (async () => {
             try {
                 const path = (req.url ?? '/').split('?')[0] ?? '/';
-                if (!applyLoopbackCors(req, res)) {
+                if (!applyPanelCors(req, res)) {
                     res.writeHead(403, { 'content-type': 'application/json' });
                     res.end(JSON.stringify({ error: { message: 'origin not allowed' } }));
                     return;
@@ -579,60 +580,10 @@ export async function startOpenAiBridge(opts) {
                         failure(res, 400, 'invalid JSON body');
                         return;
                     }
-                    if (action === 'export') {
-                        // The key is the wallet: require an explicit acknowledgement so a
-                        // stray click (or a scripted call without intent) cannot read it.
-                        if (body.confirm !== true) {
-                            failure(res, 400, 'export requires confirm: true');
-                            return;
-                        }
+                    const reply = await runWalletAction(action, body, opts.wallet);
+                    if (reply.status === 200 && action === 'export')
                         res.setHeader('cache-control', 'no-store');
-                        json(res, 200, { ok: true, address: opts.wallet.address(), privateKey: opts.wallet.exportKey() });
-                        return;
-                    }
-                    if (action === 'import') {
-                        const key = typeof body.privateKey === 'string' ? body.privateKey.trim() : '';
-                        if (key === '') {
-                            failure(res, 400, 'privateKey is required');
-                            return;
-                        }
-                        try {
-                            opts.wallet.importKey(key);
-                        }
-                        catch (error) {
-                            failure(res, 400, error instanceof Error ? error.message : String(error));
-                            return;
-                        }
-                        json(res, 200, { ok: true, address: opts.wallet.address(), restarting: true });
-                        return;
-                    }
-                    if (action === 'new') {
-                        opts.wallet.rotate();
-                        json(res, 200, { ok: true, address: opts.wallet.address(), restarting: true });
-                        return;
-                    }
-                    if (action === 'mint') {
-                        if (opts.wallet.mint == null) {
-                            failure(res, 400, 'test USDC mint is only available on base-sepolia');
-                            return;
-                        }
-                        const raw = body.amountUsdc === undefined ? '100' : String(body.amountUsdc);
-                        const amount = Math.round(Number(raw) * 1e6);
-                        if (!Number.isFinite(amount) || amount <= 0 || amount > 10_000e6) {
-                            failure(res, 400, 'amountUsdc must be between 0 and 10000');
-                            return;
-                        }
-                        try {
-                            const tx = await opts.wallet.mint(BigInt(amount));
-                            json(res, 200, { ok: true, tx, amountUsdc: Number(raw) });
-                        }
-                        catch (error) {
-                            failure(res, 500, error instanceof Error ? error.message : String(error));
-                        }
-                        return;
-                    }
-                    failure(res, 404, 'unknown wallet action');
-                    return;
+                    json(res, reply.status, reply.doc);
                 }
                 if (req.method === 'POST' && (path === '/genkaku/settings' || path === '/genkaku/settings/')) {
                     let body;

package/dist/cors.d.ts

@@ -1,7 +1,7 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
 /**
- * Apply CORS headers when the request comes from a loopback origin.
- * @returns false when a browser origin outside loopback tried to call us.
+ * Apply CORS headers when the request comes from a host allowed to show a panel.
+ * @returns false when a browser origin outside that set tried to call us.
  */
-export declare function applyLoopbackCors(req: IncomingMessage, res: ServerResponse): boolean;
+export declare function applyPanelCors(req: IncomingMessage, res: ServerResponse): boolean;
 //# sourceMappingURL=cors.d.ts.map

package/dist/cors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../src/cors.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAIhE;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAepF"}
+{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../src/cors.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAOhE;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAejF"}

package/dist/cors.js

@@ -1,21 +1,32 @@
-// GENKAKU: CORS for the loopback control planes.
+// GENKAKU: CORS for the local control planes.
 //
 // The bridge and the worker status server answer on 127.0.0.1 and used to send
 // `access-control-allow-origin: *`. Any website the user visited could then
-// read wallet state and, once wallet endpoints existed, key material. Only a
-// loopback Origin (the DSH web app) may read these responses.
+// read wallet state and, once wallet endpoints existed, key material. Now only
+// the two hosts that actually render a panel may read these responses:
+//
+//   - the DSH web app served from loopback (`dsh web` in a browser), and
+//   - the official DSH desktop app, whose renderer runs on `dsh-app://app`.
+//     Chromium sends that origin on every cross-origin fetch, and the app's own
+//     web route authenticates with the same string.
+//
+// `null` stays rejected. A sandboxed iframe on any website carries that origin,
+// and file:// pages do too, so allowing it would hand every page the key
+// material this gate exists to protect.
 const LOOPBACK = /^https?:\/\/(127\.0\.0\.1|localhost|\[::1\])(:\d+)?$/;
+/** Origin of the official DSH desktop renderer (Electron custom scheme). */
+const DESKTOP_APP = 'dsh-app://app';
 /**
- * Apply CORS headers when the request comes from a loopback origin.
- * @returns false when a browser origin outside loopback tried to call us.
+ * Apply CORS headers when the request comes from a host allowed to show a panel.
+ * @returns false when a browser origin outside that set tried to call us.
  */
-export function applyLoopbackCors(req, res) {
+export function applyPanelCors(req, res) {
     const origin = req.headers.origin;
     // curl, the HTML dashboard (same-origin navigation) and node clients send no
     // Origin; they are not subject to the browser's cross-origin rules.
     if (origin == null)
         return true;
-    if (!LOOPBACK.test(origin))
+    if (!LOOPBACK.test(origin) && origin !== DESKTOP_APP)
         return false;
     res.setHeader('access-control-allow-origin', origin);
     res.setHeader('vary', 'origin');

package/dist/index.d.ts

@@ -30,5 +30,6 @@ export * from './registry.ts';
 export * from './rpc.ts';
 export * from './status.ts';
 export * from './userSession.ts';
+export * from './walletControl.ts';
 export * from './workerSession.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,WAAW,CAAA;AACzB,cAAc,aAAa,CAAA;AAC3B,cAAc,WAAW,CAAA;AACzB,cAAc,gBAAgB,CAAA;AAC9B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,YAAY,CAAA;AAC1B,cAAc,WAAW,CAAA;AACzB,cAAc,gBAAgB,CAAA;AAC9B,cAAc,SAAS,CAAA;AACvB,cAAc,kBAAkB,CAAA;AAChC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,cAAc,CAAA;AAC5B,cAAc,mBAAmB,CAAA;AACjC,cAAc,kBAAkB,CAAA;AAChC,cAAc,eAAe,CAAA;AAC7B,cAAc,eAAe,CAAA;AAC7B,cAAc,UAAU,CAAA;AACxB,cAAc,aAAa,CAAA;AAC3B,cAAc,kBAAkB,CAAA;AAChC,cAAc,oBAAoB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,WAAW,CAAA;AACzB,cAAc,aAAa,CAAA;AAC3B,cAAc,WAAW,CAAA;AACzB,cAAc,gBAAgB,CAAA;AAC9B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,YAAY,CAAA;AAC1B,cAAc,WAAW,CAAA;AACzB,cAAc,gBAAgB,CAAA;AAC9B,cAAc,SAAS,CAAA;AACvB,cAAc,kBAAkB,CAAA;AAChC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,cAAc,CAAA;AAC5B,cAAc,mBAAmB,CAAA;AACjC,cAAc,kBAAkB,CAAA;AAChC,cAAc,eAAe,CAAA;AAC7B,cAAc,eAAe,CAAA;AAC7B,cAAc,UAAU,CAAA;AACxB,cAAc,aAAa,CAAA;AAC3B,cAAc,kBAAkB,CAAA;AAChC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA"}

package/dist/index.js

@@ -30,5 +30,6 @@ export * from "./registry.js";
 export * from "./rpc.js";
 export * from "./status.js";
 export * from "./userSession.js";
+export * from "./walletControl.js";
 export * from "./workerSession.js";
 //# sourceMappingURL=index.js.map

package/dist/keys.d.ts

@@ -14,6 +14,8 @@ export type KeyVault = {
     workerKey(): PrivKey;
     /** replace the user key (import / rotate); refuses while an env key wins */
     setUserKey(key: PrivKey): void;
+    /** replace the worker identity key (import / rotate); same env guard */
+    setWorkerKey(key: PrivKey): void;
     /** derived addresses only (renderer-safe mirror of the keys) */
     addresses(): {
         user: EthAddress;

package/dist/keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../src/keys.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAA;AAG/B,MAAM,MAAM,OAAO,GAAG,GAAG,CAAA;AACzB,MAAM,MAAM,UAAU,GAAG,KAAK,MAAM,EAAE,CAAA;AAEtC;gFACgF;AAChF,MAAM,MAAM,QAAQ,GAAG;IACrB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAA;IAC9B,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;CAC9B,CAAA;AASD,MAAM,MAAM,QAAQ,GAAG;IACrB,2DAA2D;IAC3D,OAAO,IAAI,OAAO,CAAA;IAClB,6DAA6D;IAC7D,SAAS,IAAI,OAAO,CAAA;IACpB,4EAA4E;IAC5E,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAAA;IAC9B,gEAAgE;IAChE,SAAS,IAAI;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,MAAM,EAAE,UAAU,CAAA;KAAE,CAAA;IACrD,qEAAqE;IACrE,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAA;CACpC,CAAA;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE;IACnC,0EAA0E;IAC1E,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,CAAC,EAAE,QAAQ,CAAA;CACjB,GAAG,QAAQ,CAuHX;AAED,gFAAgF;AAChF,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAQnD"}
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../src/keys.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAA;AAG/B,MAAM,MAAM,OAAO,GAAG,GAAG,CAAA;AACzB,MAAM,MAAM,UAAU,GAAG,KAAK,MAAM,EAAE,CAAA;AAEtC;gFACgF;AAChF,MAAM,MAAM,QAAQ,GAAG;IACrB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAA;IAC9B,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;CAC9B,CAAA;AASD,MAAM,MAAM,QAAQ,GAAG;IACrB,2DAA2D;IAC3D,OAAO,IAAI,OAAO,CAAA;IAClB,6DAA6D;IAC7D,SAAS,IAAI,OAAO,CAAA;IACpB,4EAA4E;IAC5E,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAAA;IAC9B,wEAAwE;IACxE,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAAA;IAChC,gEAAgE;IAChE,SAAS,IAAI;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,MAAM,EAAE,UAAU,CAAA;KAAE,CAAA;IACrD,qEAAqE;IACrE,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAA;CACpC,CAAA;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE;IACnC,0EAA0E;IAC1E,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,CAAC,EAAE,QAAQ,CAAA;CACjB,GAAG,QAAQ,CAmIX;AAED,gFAAgF;AAChF,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAQnD"}

package/dist/keys.js

@@ -108,6 +108,17 @@ export function createKeyVault(opts) {
             vault.userKeyEnc = codec.encrypt(next).toString('base64');
             persist();
         },
+        setWorkerKey(key) {
+            // Same reasoning as setUserKey: an env key is process-scoped, so claiming
+            // a successful replacement while the old identity stays live would lie.
+            if (envWorker != null) {
+                throw new Error('the worker key comes from GENKAKU_WORKER_KEY; unset it before importing or rotating');
+            }
+            const next = normalizeKey(key);
+            workerKey = next;
+            vault.workerKeyEnc = codec.encrypt(next).toString('base64');
+            persist();
+        },
         get usingEnvOverrides() {
             return envUser != null || envWorker != null;
         },

package/dist/status.d.ts

@@ -1,3 +1,4 @@
+import { type WalletControl } from './walletControl.ts';
 import type { RoleMode } from './modeManager.ts';
 import type { OfferWire } from './offer.ts';
 /** One offer row rendered by the dashboard. */
@@ -26,6 +27,11 @@ export type StatusSnapshot = {
     transport?: 'direct' | 'relay' | 'lan';
     /** Relay hops this worker reserved (seed VM), for the panel to explain relay mode. */
     relayHints?: string[];
+    /** Live wallet figures, base units as decimal strings (wei / 6-dec USDC). */
+    balances?: {
+        eth: string;
+        usdc: string;
+    };
 };
 export type StatusHandle = {
     url: string;
@@ -60,5 +66,19 @@ export type OllamaControl = {
     remove: (model: string) => Promise<void>;
 };
 /** Serve the dashboard and live status JSON on 127.0.0.1. */
-export declare function startStatusServer(port: number, snapshot: () => StatusSnapshot | Promise<StatusSnapshot>, onCatalog?: CatalogUpdateHandler, onMode?: ModeUpdateHandler, ollama?: OllamaControl, onPublish?: PublishUpdateHandler): Promise<StatusHandle>;
+/** Everything the worker dashboard can drive. Named fields rather than a long
+ *  positional list: the wallet joined five other callbacks, and a positional
+ *  boolean trade at the end is how panels end up wiring the wrong handler. */
+export type StatusServerOptions = {
+    port: number;
+    snapshot: () => StatusSnapshot | Promise<StatusSnapshot>;
+    onCatalog?: CatalogUpdateHandler;
+    onMode?: ModeUpdateHandler;
+    ollama?: OllamaControl;
+    onPublish?: PublishUpdateHandler;
+    /** Worker identity wallet: export/import/rotate. No mint — a worker earns
+     *  USDC and only ever needs gas, which it cannot buy from a faucet button. */
+    wallet?: WalletControl;
+};
+export declare function startStatusServer(opts: StatusServerOptions): Promise<StatusHandle>;
 //# sourceMappingURL=status.d.ts.map

package/dist/status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../src/status.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAChD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAE3C,+CAA+C;AAC/C,MAAM,MAAM,WAAW,GAAG;IACxB,0EAA0E;IAC1E,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,SAAS,CAAA;CACjB,CAAA;AAED,0EAA0E;AAC1E,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,EAAE,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,WAAW,EAAE,CAAA;IACrB,cAAc,EAAE,MAAM,CAAA;IACtB,4EAA4E;IAC5E,SAAS,EAAE,OAAO,CAAA;IAClB,2EAA2E;IAC3E,cAAc,EAAE,OAAO,CAAA;IACvB,+EAA+E;IAC/E,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,oFAAoF;IACpF,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,iFAAiF;IACjF,SAAS,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,KAAK,CAAA;IACtC,sFAAsF;IACtF,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3B,CAAA;AAED,mEAAmE;AACnE,MAAM,MAAM,iBAAiB,GAAG;IAC9B,KAAK,EAAE,MAAM,CAAA;IACb,YAAY,EAAE,MAAM,CAAA;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB,CAAA;AAED,6DAA6D;AAC7D,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,EAAE,iBAAiB,EAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;AAEzF,0DAA0D;AAC1D,MAAM,MAAM,iBAAiB,GAAG,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;AAExE,2DAA2D;AAC3D,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;AAE7E,8DAA8D;AAC9D,MAAM,MAAM,aAAa,GAAG;IAC1B,mEAAmE;IACnE,KAAK,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;IAC7B,2CAA2C;IAC3C,aAAa,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;IACrC,sEAAsE;IACtE,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,QAAQ,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,KAAK,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC1H,0CAA0C;IAC1C,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACzC,CAAA;AAyKD,6DAA6D;AAC7D,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,EACxD,SAAS,CAAC,EAAE,oBAAoB,EAChC,MAAM,CAAC,EAAE,iBAAiB,EAC1B,MAAM,CAAC,EAAE,aAAa,EACtB,SAAS,CAAC,EAAE,oBAAoB,GAC/B,OAAO,CAAC,YAAY,CAAC,CA+LvB"}
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../src/status.ts"],"names":[],"mappings":"AAOA,OAAO,EAAmB,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAA;AACxE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAChD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAE3C,+CAA+C;AAC/C,MAAM,MAAM,WAAW,GAAG;IACxB,0EAA0E;IAC1E,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,SAAS,CAAA;CACjB,CAAA;AAED,0EAA0E;AAC1E,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,EAAE,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,WAAW,EAAE,CAAA;IACrB,cAAc,EAAE,MAAM,CAAA;IACtB,4EAA4E;IAC5E,SAAS,EAAE,OAAO,CAAA;IAClB,2EAA2E;IAC3E,cAAc,EAAE,OAAO,CAAA;IACvB,+EAA+E;IAC/E,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,oFAAoF;IACpF,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,iFAAiF;IACjF,SAAS,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,KAAK,CAAA;IACtC,sFAAsF;IACtF,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CACzC,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3B,CAAA;AAED,mEAAmE;AACnE,MAAM,MAAM,iBAAiB,GAAG;IAC9B,KAAK,EAAE,MAAM,CAAA;IACb,YAAY,EAAE,MAAM,CAAA;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB,CAAA;AAED,6DAA6D;AAC7D,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,EAAE,iBAAiB,EAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;AAEzF,0DAA0D;AAC1D,MAAM,MAAM,iBAAiB,GAAG,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;AAExE,2DAA2D;AAC3D,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;AAE7E,8DAA8D;AAC9D,MAAM,MAAM,aAAa,GAAG;IAC1B,mEAAmE;IACnE,KAAK,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;IAC7B,2CAA2C;IAC3C,aAAa,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;IACrC,sEAAsE;IACtE,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,QAAQ,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,KAAK,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC1H,0CAA0C;IAC1C,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACzC,CAAA;AAyKD,6DAA6D;AAC7D;;8EAE8E;AAC9E,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAAA;IACxD,SAAS,CAAC,EAAE,oBAAoB,CAAA;IAChC,MAAM,CAAC,EAAE,iBAAiB,CAAA;IAC1B,MAAM,CAAC,EAAE,aAAa,CAAA;IACtB,SAAS,CAAC,EAAE,oBAAoB,CAAA;IAChC;kFAC8E;IAC9E,MAAM,CAAC,EAAE,aAAa,CAAA;CACvB,CAAA;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,YAAY,CAAC,CAsNxF"}

package/dist/status.js

@@ -2,7 +2,8 @@
 // GET /genkaku/status (JSON). Snapshot is called per request so the page and
 // the JSON always reflect the live sidecar, never a boot-time copy.
 import { createServer } from 'node:http';
-import { applyLoopbackCors } from "./cors.js";
+import { applyPanelCors } from "./cors.js";
+import { runWalletAction } from "./walletControl.js";
 /** Self-contained dashboard; mirrors the user bridge style and polls the JSON. */
 const DASHBOARD_HTML = `<!doctype html>
 <html lang="en">
@@ -165,13 +166,13 @@ function parseCatalog(body) {
     }
     return { ok: true, catalog };
 }
-/** Serve the dashboard and live status JSON on 127.0.0.1. */
-export async function startStatusServer(port, snapshot, onCatalog, onMode, ollama, onPublish) {
+export async function startStatusServer(opts) {
+    const { port, snapshot, onCatalog, onMode, ollama, onPublish, wallet } = opts;
     const server = createServer((req, res) => {
         void (async () => {
             try {
                 const path = (req.url ?? '/').split('?')[0] ?? '/';
-                if (!applyLoopbackCors(req, res)) {
+                if (!applyPanelCors(req, res)) {
                     res.writeHead(403, { 'content-type': 'application/json' });
                     res.end(JSON.stringify({ error: { message: 'origin not allowed' } }));
                     return;
@@ -246,6 +247,28 @@ export async function startStatusServer(port, snapshot, onCatalog, onMode, ollam
                     json(res, { ok: true });
                     return;
                 }
+                if (req.method === 'POST' && path.startsWith('/genkaku/wallet/')) {
+                    const action = path.slice('/genkaku/wallet/'.length).replace(/\/$/, '');
+                    if (wallet == null) {
+                        failure(res, 501, 'wallet operations are not enabled in this role');
+                        return;
+                    }
+                    let body = {};
+                    try {
+                        body = await readJson(req);
+                    }
+                    catch {
+                        failure(res, 400, 'invalid JSON body');
+                        return;
+                    }
+                    const reply = await runWalletAction(action, body, wallet);
+                    res.writeHead(reply.status, {
+                        'content-type': 'application/json',
+                        ...(action === 'export' ? { 'cache-control': 'no-store' } : {}),
+                    });
+                    res.end(JSON.stringify(reply.doc));
+                    return;
+                }
                 if (path === '/genkaku/ollama' || path === '/genkaku/ollama/') {
                     if (ollama == null) {
                         failure(res, 501, 'ollama onboarding is not enabled in this role');

package/dist/walletControl.d.ts

@@ -0,0 +1,17 @@
+/** Wallet operations a control plane may offer. */
+export type WalletControl = {
+    address: () => string;
+    exportKey: () => string;
+    importKey: (privateKey: string) => void | Promise<void>;
+    rotate: () => void | Promise<void>;
+    /** base-sepolia only; mints MockUSDC to the panel's own address */
+    mint?: (amount: bigint) => Promise<string>;
+};
+/** One action's HTTP answer: status code plus JSON body. */
+export type WalletActionReply = {
+    status: number;
+    doc: Record<string, unknown>;
+};
+/** Validate and run one `/genkaku/wallet/<action>` call. */
+export declare function runWalletAction(action: string, body: Record<string, unknown>, wallet: WalletControl): Promise<WalletActionReply>;
+//# sourceMappingURL=walletControl.d.ts.map

package/dist/walletControl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"walletControl.d.ts","sourceRoot":"","sources":["../src/walletControl.ts"],"names":[],"mappings":"AAYA,mDAAmD;AACnD,MAAM,MAAM,aAAa,GAAG;IAC1B,OAAO,EAAE,MAAM,MAAM,CAAA;IACrB,SAAS,EAAE,MAAM,MAAM,CAAA;IACvB,SAAS,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACvD,MAAM,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClC,mEAAmE;IACnE,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;CAC3C,CAAA;AAED,4DAA4D;AAC5D,MAAM,MAAM,iBAAiB,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAA;AAEhF,4DAA4D;AAC5D,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,iBAAiB,CAAC,CAwD5B"}

package/dist/walletControl.js

@@ -0,0 +1,63 @@
+// GENKAKU: wallet operations shared by both control planes.
+//
+// The user bridge and the worker status server expose the same four actions —
+// export, import, new, mint — against different keys: the buyer's key signs
+// escrows, the worker's key signs receipts and binds the directory entry. The
+// HTTP shape and the safeguards are identical, so they live here instead of
+// being copied into two request handlers that can drift apart.
+//
+// Key material only ever leaves over the panel CORS gate (see cors.ts), and
+// export additionally requires `confirm: true` so a stray click — or a script
+// that reached the port without intent — cannot read it.
+/** Validate and run one `/genkaku/wallet/<action>` call. */
+export async function runWalletAction(action, body, wallet) {
+    if (action === 'export') {
+        // The key IS the wallet: require an explicit acknowledgement.
+        if (body.confirm !== true)
+            return { status: 400, doc: { error: { message: 'export requires confirm: true' } } };
+        return {
+            status: 200,
+            doc: { ok: true, address: wallet.address(), privateKey: wallet.exportKey() },
+        };
+    }
+    if (action === 'import') {
+        const key = typeof body.privateKey === 'string' ? body.privateKey.trim() : '';
+        if (key === '')
+            return { status: 400, doc: { error: { message: 'privateKey is required' } } };
+        try {
+            await wallet.importKey(key);
+        }
+        catch (error) {
+            return { status: 400, doc: { error: { message: error instanceof Error ? error.message : String(error) } } };
+        }
+        return { status: 200, doc: { ok: true, address: wallet.address(), restarting: true } };
+    }
+    if (action === 'new') {
+        try {
+            await wallet.rotate();
+        }
+        catch (error) {
+            return { status: 500, doc: { error: { message: error instanceof Error ? error.message : String(error) } } };
+        }
+        return { status: 200, doc: { ok: true, address: wallet.address(), restarting: true } };
+    }
+    if (action === 'mint') {
+        if (wallet.mint == null) {
+            return { status: 400, doc: { error: { message: 'test USDC mint is only available on base-sepolia' } } };
+        }
+        const raw = body.amountUsdc === undefined ? '100' : String(body.amountUsdc);
+        const amount = Math.round(Number(raw) * 1e6);
+        if (!Number.isFinite(amount) || amount <= 0 || amount > 10_000e6) {
+            return { status: 400, doc: { error: { message: 'amountUsdc must be between 0 and 10000' } } };
+        }
+        try {
+            const tx = await wallet.mint(BigInt(amount));
+            return { status: 200, doc: { ok: true, tx, amountUsdc: Number(raw) } };
+        }
+        catch (error) {
+            return { status: 500, doc: { error: { message: error instanceof Error ? error.message : String(error) } } };
+        }
+    }
+    return { status: 404, doc: { error: { message: 'unknown wallet action' } } };
+}
+//# sourceMappingURL=walletControl.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@genkaku/protocol",
-  "version": "0.1.17",
+  "version": "0.1.19",
   "description": "GenKaKu protocol core: on-chain worker directory, USDC escrow billing, libp2p transport, Ollama lifecycle",
   "license": "MIT",
   "type": "module",