@getbags/cash 0.2.0

package/README.md

@@ -0,0 +1,104 @@
+# @getbags/cash
+
+BAGS Cash CLI — hosted agent wallet for x402. Redeem credits, discover endpoints, check quotes, and pay from your agent.
+
+## Install
+
+```bash
+npx @getbags/cash --help
+# or
+npm install -g @getbags/cash
+bags --help
+```
+
+### Agent skill (prompt paste)
+
+Hosted skill: https://www.getbags.app/wallet/skill.md
+
+Paste into Cursor / Claude / Codex / etc.:
+
+```text
+Set up https://www.getbags.app/wallet/skill.md
+```
+
+Human onboard (bonus + same prompt): https://www.getbags.app/wallet/onboard  
+Staging: use `https://staging.getbags.app/wallet/skill.md` (or set `BAGS_API_URL`).
+
+## Workflow
+
+`balance → discover|search → check → fetch`
+
+## Commands
+
+| Command                     | Description                                                 |
+| --------------------------- | ----------------------------------------------------------- |
+| `redeem <code>`             | Redeem an invite; saves token to `~/.bags/credentials.json` |
+| `balance`                   | Show balance, daily spent/cap, status                       |
+| `discover [query]`          | List BAGS merchant endpoints (BAGS first)                   |
+| `search <query>`            | NL search across BAGS + ecosystem index                     |
+| `check <url>`               | Probe schema + exact quote **without paying**               |
+| `fetch <url> [flags]`       | Pay and proxy an x402 endpoint                              |
+| `transactions`              | Spend / ledger history                                      |
+| `policies get\|set`         | Read or update spend policies                               |
+| `keys create\|list\|revoke` | Per-agent wallet keys                                       |
+| `register <origin>`         | Persist an origin into the discover/search index            |
+| `init`                      | Write the `bags-cash` agent skill into this repo            |
+
+Fetch / check flags: `-m/--method`, `-b/--body` (JSON string), `--max-price-cents` (fetch), `--format json|pretty`.
+
+## Env
+
+| Variable       | Default                   | Notes                                  |
+| -------------- | ------------------------- | -------------------------------------- |
+| `BAGS_API_URL` | `https://www.getbags.app` | Staging: `https://staging.getbags.app` |
+
+## Example
+
+```bash
+export BAGS_API_URL=https://staging.getbags.app   # optional
+npx @getbags/cash redeem BAGS-XXXX-XXXX
+npx @getbags/cash balance
+npx @getbags/cash search "weather forecast"
+npx @getbags/cash check 'https://example.com/paid'
+npx @getbags/cash fetch 'https://example.com/paid' -m POST -b '{"q":"hi"}'
+```
+
+Payment receipt prints on stderr; the upstream body prints on stdout.
+
+## Auth
+
+Token at `~/.bags/credentials.json`. Hosted custody — no local private keys. MCP tools accept the same token via `Authorization: Bearer` or a `wallet_token` argument.
+
+## Publishing `@getbags/cash`
+
+### Local (preferred dry-run)
+
+From the repo root:
+
+```bash
+bun run publish:cash --dry-run   # install + build + test; never publishes
+bun run publish:cash             # same as dry-run unless NPM_TOKEN is set
+bun run publish:cash --publish   # requires NPM_TOKEN; runs npm publish --access public
+```
+
+Or manually:
+
+```bash
+cd packages/cli
+bun install && bun run build && bun run test
+# npm publish --access public   # only with npm auth for @getbags
+```
+
+`prepublishOnly` runs the build. Version bumps are manual in `packages/cli/package.json`.
+
+### CI (tag automation)
+
+GitHub Action: [`.github/workflows/publish-cash.yml`](../../.github/workflows/publish-cash.yml)
+
+1. Bump `version` in `packages/cli/package.json`
+2. Tag and push: `git tag cash-v0.2.0 && git push origin cash-v0.2.0` (tag must match package version)
+3. Workflow builds and tests. It publishes only when repo secret `NPM_TOKEN` is set; otherwise the job succeeds as a dry-run (no npm publish).
+
+`workflow_dispatch` defaults to dry-run (build/test only). Set `dry_run=false` to attempt publish (still skips cleanly if `NPM_TOKEN` is missing).
+
+**Do not publish** unless `NPM_TOKEN` is available and you intend a release. Scoped packages typically need an automation token with 2FA bypass for CI. Add the secret under GitHub → Settings → Secrets and variables → Actions (`NPM_TOKEN`).

package/SKILL.md

@@ -0,0 +1,115 @@
+---
+name: bags-cash
+description: |
+    Pay x402-protected APIs with a BAGS hosted agent wallet (USDC credits, server-side policies).
+    Use when the user has a BAGS invite code, wants to call paid APIs via BAGS Cash / BAGS Wallet,
+    or mentions bags wallet / bags cash / getbags / x402 micropayments.
+
+    TRIGGERS: x402, paid API, bags wallet, bags cash, getbags, invite code, redeem, micropayment,
+    agent wallet, check endpoint, wallet fetch
+homepage: https://www.getbags.app/wallet/skill.md
+metadata:
+    version: 0.2
+---
+
+# BAGS Cash — Hosted Agent Wallet
+
+> Hosted skill URL: https://www.getbags.app/wallet/skill.md  
+> Onboard (humans): https://www.getbags.app/wallet/onboard  
+> Staging: replace the host with `https://staging.getbags.app`.
+
+Call x402-protected APIs with a **hosted** BAGS wallet. Redeem an invite, discover services, **check** the exact quote + schema, then `fetch`. No local private keys — the agent holds only a token (`bag_agent_sk_*`).
+
+## Why hosted (vs local-key wallets)
+
+Local plaintext / keychain wallets break in ephemeral sandboxes (Claude Cowork, CI, short-lived VMs): the key dies with the machine. BAGS keeps custody + ledger server-side. Your agent only needs the token in `~/.bags/credentials.json` (or `Authorization: Bearer`). Policies (caps, allowlists, kill switch) are enforced on the server — the agent cannot bypass them by editing a local file.
+
+## Wallet
+
+| Task                           | Command                           |
+| ------------------------------ | --------------------------------- |
+| Redeem invite (saves token)    | `npx @getbags/cash redeem <code>` |
+| Check balance + caps           | `npx @getbags/cash balance`       |
+| Install this skill into a repo | `npx @getbags/cash init`          |
+
+If there is no token yet, redeem first. If balance is too low, ask for another invite.
+
+## Workflow: balance → discover → check → fetch
+
+Match AgentCash’s agent loop; prefer this order every time.
+
+### 1. Balance
+
+```bash
+npx @getbags/cash balance
+```
+
+### 2. Discover or search
+
+```bash
+npx @getbags/cash discover                    # BAGS merchant catalog
+npx @getbags/cash discover weather forecast   # BAGS first, then open x402 index
+npx @getbags/cash search "send physical mail" # NL search (catalog + ecosystem)
+```
+
+Prefer `source: bags` results (refund-guaranteed on BAGS merchants when that guarantee is live). Then `source: bazaar`. Default table columns: `url`, `method`, `price`, `merchant`, `source`. Use `--format json` for the raw payload (includes schemas when present).
+
+### 3. Check (exact quote, no payment)
+
+```bash
+npx @getbags/cash check '<url>'
+npx @getbags/cash check '<url>' -m POST -b '{"key":"value"}'
+```
+
+Returns HTTP status, whether payment is required, price in cents/USD, accept options (network/scheme), and input/output schemas when the endpoint advertises them. **Always check before an expensive or schema-sensitive fetch** to avoid 400s.
+
+### 4. Fetch (pay + proxy)
+
+```bash
+npx @getbags/cash fetch '<url>'
+npx @getbags/cash fetch '<url>' -m POST -b '{"key":"value"}'
+npx @getbags/cash fetch '<url>' --max-price-cents 25
+```
+
+Payment receipt (amount, tx hash, network) → stderr; upstream body → stdout (pipe-friendly).
+
+**Response envelope:** check top-level `status` / `code` first. `status: "success"` means the fetch completed as intended (including free/SIWX calls with `payment.paid: false`). A paid attempt that did not complete returns `status: "error"` with `PRE_PAYMENT_FAILED` or `NETWORK_NOT_ALLOWED` (nested `data.http_status` / `data.payment` keep the upstream diagnostic). Do not treat HTTP 200 alone as “paid OK” — and do not treat nested `http_status: 402` under `status: "success"` as a thing that happens anymore.
+
+## Other commands
+
+| Command                                                 | Purpose                             |
+| ------------------------------------------------------- | ----------------------------------- |
+| `transactions`                                          | Ledger / spend history              |
+| `policies get` / `policies set --per-call-cap-cents=50` | Read/update spend caps              |
+| `keys create\|list\|revoke`                             | Per-agent sub-keys                  |
+| `register <origin>`                                     | Register origin into discover index |
+
+## Important rules
+
+- **Hosted token only** — never invent or store user private keys for BAGS Cash.
+- **Check before fetch** when price or request shape is unclear.
+- **Prefer `source: bags`**, then bazaar, then any trusted x402 URL via `fetch`.
+- **Failed pre-payment requests cost nothing.** If payment settled and upstream still errored, read the stderr receipt / `transactions`.
+- **Do not invent endpoints.** Use `discover` / `search` / `check` or a URL the user provided.
+
+## Troubleshooting
+
+| Code                                | Fix                                                                           |
+| ----------------------------------- | ----------------------------------------------------------------------------- |
+| `INSUFFICIENT_BALANCE`              | `bags balance` then redeem another invite                                     |
+| `INVITE_INVALID` / `INVITE_EXPIRED` | Ask for a new invite code                                                     |
+| `URL_BLOCKED`                       | Use a public `https` endpoint (SSRF gate)                                     |
+| `CAP_EXCEEDED`                      | Wait, lower `--max-price-cents`, or `policies set`                            |
+| `WALLET_SUSPENDED`                  | Dashboard / support                                                           |
+| `WALLET_FETCH_DISABLED`             | Retry later (global kill switch)                                              |
+| `VALIDATION_FAILED`                 | Fix url/method/body JSON                                                      |
+| `NOT_FOUND`                         | Route not live on this env — set `BAGS_API_URL` or upgrade                    |
+| `UPSTREAM_ERROR` / `TIMEOUT`        | Retry; `bags check <url>` for a fresh quote                                   |
+| `NETWORK_NOT_ALLOWED`               | Test wallet vs mainnet (or vice versa) — use matching mode                    |
+| `PRE_PAYMENT_FAILED`                | Payment did not broadcast; reservation reversed — fix quote / network / funds |
+| `AUTH_MISSING_CREDENTIALS`          | `bags redeem <code>`                                                          |
+
+Env: `BAGS_API_URL` (default `https://www.getbags.app`; staging example `https://staging.getbags.app`).  
+Token path: `~/.bags/credentials.json`.
+
+MCP: wallet tools on `https://www.getbags.app/api/mcp/mcp` — pass `Authorization: Bearer bag_agent_sk_...` or a `wallet_token` argument on each tool.

package/dist/api.d.ts

@@ -0,0 +1,167 @@
+export type ApiErrorBody = {
+    status: 'error';
+    code: string;
+    message: string;
+};
+export type RedeemResponse = {
+    token: string;
+    balance_cents: number;
+    expires: null;
+};
+export type BalanceResponse = {
+    balance_cents: number;
+    daily_spent_cents: number;
+    daily_cap_cents: number;
+    per_call_cap_cents: number;
+    status: string;
+};
+export type DiscoverEndpoint = {
+    url: string;
+    method: string;
+    price_usd: number | string;
+    description?: string | null;
+    merchant_name: string | null;
+    source?: 'bags' | 'bazaar' | 'registered';
+    input_schema?: unknown;
+    output_schema?: unknown;
+    score?: number;
+    signals?: {
+        text_match: number;
+        usage: number;
+        trust: number;
+    };
+};
+export type DiscoverResponse = {
+    endpoints: DiscoverEndpoint[];
+    query?: string | null;
+};
+export type FetchPayment = {
+    paid: boolean;
+    amount_cents: number;
+    tx_hash: string;
+    network: string;
+};
+export type FetchResponse = {
+    status: string;
+    http_status: number;
+    payment: FetchPayment | null;
+    response: unknown;
+};
+export type CheckResponse = {
+    url: string;
+    method: string;
+    http_status: number;
+    requires_payment: boolean;
+    price_cents: number | null;
+    price_usd: number | null;
+    accepts: unknown[];
+    input_schema: unknown;
+    output_schema: unknown;
+    error: string | null;
+    paid: boolean;
+};
+export type FundResponse = {
+    deposit_url?: string;
+    instructions?: string;
+    addresses?: Array<{
+        network: string;
+        address: string;
+        asset?: string;
+    }>;
+    onramp_url?: string;
+    onramp_error?: string | null;
+    deposits?: Array<{
+        id: string;
+        network: string;
+        amount_cents: number | null;
+        status: string;
+        deposit_address: string | null;
+        tx_hash: string | null;
+    }>;
+    deposit_id?: string;
+    deposit_address?: string | null;
+    network?: string;
+    status?: string;
+};
+export type TransactionsResponse = {
+    transactions: unknown[];
+    next_cursor?: string | null;
+};
+export type PoliciesResponse = Record<string, unknown>;
+export type KeysResponse = {
+    keys?: unknown[];
+    key?: unknown;
+    token?: string;
+    [key: string]: unknown;
+};
+export declare class CliApiError extends Error {
+    readonly code: string;
+    readonly httpStatus: number;
+    constructor(code: string, message: string, httpStatus: number);
+}
+export declare function apiRequest(path: string, options?: {
+    method?: string;
+    body?: unknown;
+    token?: string;
+}): Promise<Record<string, unknown>>;
+export declare function redeem(code: string): Promise<RedeemResponse>;
+export declare function getBalance(token: string): Promise<BalanceResponse>;
+export declare function discover(token: string, query?: string): Promise<DiscoverResponse>;
+export declare function search(token: string, query: string): Promise<DiscoverResponse>;
+export declare function checkEndpoint(token: string, input: {
+    url: string;
+    method?: string;
+    body?: unknown;
+}): Promise<CheckResponse>;
+export declare function walletFetch(token: string, input: {
+    url: string;
+    method?: string;
+    headers?: Record<string, string>;
+    body?: unknown;
+    max_price_cents?: number;
+    payment_protocol?: 'x402' | 'mpp' | 'auto';
+}): Promise<FetchResponse>;
+export type MppSessionSummary = {
+    id: string;
+    channel_id: string;
+    origin: string;
+    resource_url: string;
+    status: string;
+    max_deposit_cents: number;
+    cumulative_cents: number;
+    network: string | null;
+};
+export declare function listSessions(token: string): Promise<{
+    sessions: MppSessionSummary[];
+}>;
+export declare function closeSessions(token: string, input: {
+    session_id?: string;
+    channel_id?: string;
+    all?: boolean;
+}): Promise<{
+    closed: Array<{
+        id: string;
+        channel_id: string;
+        status: string;
+    }>;
+    errors: unknown[];
+}>;
+/** List deposit instructions / recent deposits (POST creates a new deposit address). */
+export declare function getFund(token: string): Promise<FundResponse>;
+export declare function createDeposit(token: string, opts?: {
+    network?: string;
+    amount_cents?: number;
+}): Promise<FundResponse>;
+export declare function getTransactions(token: string, opts?: {
+    limit?: number;
+    cursor?: string;
+}): Promise<TransactionsResponse>;
+export declare function getPolicies(token: string): Promise<PoliciesResponse>;
+export declare function setPolicies(token: string, patch: Record<string, unknown>): Promise<PoliciesResponse>;
+export declare function listKeys(token: string): Promise<KeysResponse>;
+export declare function createKey(token: string, label?: string): Promise<KeysResponse>;
+export declare function revokeKey(token: string, id: string): Promise<KeysResponse>;
+export declare function registerOrigin(token: string, origin: string, opts?: {
+    label?: string;
+    description?: string;
+}): Promise<Record<string, unknown>>;

package/dist/api.js

@@ -0,0 +1,235 @@
+import { getBaseUrl } from './config.js';
+import { formatApiError } from './errors.js';
+export class CliApiError extends Error {
+    code;
+    httpStatus;
+    constructor(code, message, httpStatus) {
+        super(formatApiError(code, message));
+        this.name = 'CliApiError';
+        this.code = code;
+        this.httpStatus = httpStatus;
+    }
+}
+function unwrapPayload(body) {
+    if (body.data && typeof body.data === 'object' && !Array.isArray(body.data)) {
+        return body.data;
+    }
+    return body;
+}
+export async function apiRequest(path, options = {}) {
+    const url = `${getBaseUrl()}${path}`;
+    const headers = {
+        Accept: 'application/json',
+    };
+    if (options.token) {
+        headers.Authorization = `Bearer ${options.token}`;
+    }
+    let body;
+    if (options.body !== undefined) {
+        headers['Content-Type'] = 'application/json';
+        body = JSON.stringify(options.body);
+    }
+    const res = await fetch(url, {
+        method: options.method ?? (options.body !== undefined ? 'POST' : 'GET'),
+        headers,
+        body,
+    });
+    let json = {};
+    const text = await res.text();
+    if (text) {
+        try {
+            json = JSON.parse(text);
+        }
+        catch {
+            if (!res.ok) {
+                throw new CliApiError('HTTP_ERROR', text.slice(0, 200) || res.statusText, res.status);
+            }
+            throw new CliApiError('INVALID_RESPONSE', 'response was not JSON', res.status);
+        }
+    }
+    if (!res.ok || json.status === 'error') {
+        const code = typeof json.code === 'string' ? json.code : res.status === 404 ? 'NOT_FOUND' : `HTTP_${res.status}`;
+        const message = typeof json.message === 'string' ? json.message : res.statusText || 'request failed';
+        throw new CliApiError(code, message, res.status);
+    }
+    return json;
+}
+export async function redeem(code) {
+    const body = await apiRequest('/api/wallet/redeem', {
+        method: 'POST',
+        body: { code },
+    });
+    const data = unwrapPayload(body);
+    if (typeof data.token !== 'string') {
+        throw new CliApiError('INVALID_RESPONSE', 'redeem response missing token', 200);
+    }
+    return data;
+}
+export async function getBalance(token) {
+    const body = await apiRequest('/api/wallet/balance', { token });
+    const data = unwrapPayload(body);
+    const status = typeof data.status === 'string' && data.status !== 'success'
+        ? data.status
+        : typeof body.wallet_status === 'string'
+            ? body.wallet_status
+            : 'unknown';
+    return {
+        balance_cents: Number(data.balance_cents),
+        daily_spent_cents: Number(data.daily_spent_cents),
+        daily_cap_cents: Number(data.daily_cap_cents),
+        per_call_cap_cents: Number(data.per_call_cap_cents),
+        status,
+    };
+}
+export async function discover(token, query) {
+    const path = query ? `/api/wallet/discover?q=${encodeURIComponent(query)}` : '/api/wallet/discover';
+    const body = await apiRequest(path, { token });
+    const data = unwrapPayload(body);
+    return {
+        endpoints: Array.isArray(data.endpoints) ? data.endpoints : [],
+        query: data.query,
+    };
+}
+export async function search(token, query) {
+    const path = `/api/wallet/search?q=${encodeURIComponent(query)}`;
+    const body = await apiRequest(path, { token });
+    const data = unwrapPayload(body);
+    return {
+        endpoints: Array.isArray(data.endpoints) ? data.endpoints : [],
+        query: typeof data.query === 'string' ? data.query : query,
+    };
+}
+export async function checkEndpoint(token, input) {
+    const body = await apiRequest('/api/wallet/check', {
+        method: 'POST',
+        token,
+        body: input,
+    });
+    return unwrapPayload(body);
+}
+export async function walletFetch(token, input) {
+    const body = await apiRequest('/api/wallet/fetch', {
+        method: 'POST',
+        token,
+        body: input,
+    });
+    const data = unwrapPayload(body);
+    return {
+        status: typeof data.status === 'string' ? data.status : 'success',
+        http_status: Number(data.http_status),
+        payment: data.payment ?? null,
+        response: data.response,
+    };
+}
+export async function listSessions(token) {
+    const body = await apiRequest('/api/wallet/sessions', { token });
+    const data = unwrapPayload(body);
+    return { sessions: Array.isArray(data.sessions) ? data.sessions : [] };
+}
+export async function closeSessions(token, input) {
+    const body = await apiRequest('/api/wallet/sessions/close', {
+        method: 'POST',
+        token,
+        body: input,
+    });
+    const data = unwrapPayload(body);
+    return {
+        closed: Array.isArray(data.closed) ? data.closed : [],
+        errors: Array.isArray(data.errors) ? data.errors : [],
+    };
+}
+/** List deposit instructions / recent deposits (POST creates a new deposit address). */
+export async function getFund(token) {
+    const body = await apiRequest('/api/wallet/deposit', { token });
+    const data = unwrapPayload(body);
+    const deposits = Array.isArray(data.deposits) ? data.deposits : [];
+    const addresses = deposits
+        .filter((d) => d.deposit_address)
+        .map((d) => ({
+        network: d.network,
+        address: d.deposit_address,
+        asset: 'USDC',
+    }));
+    return {
+        ...data,
+        deposits,
+        addresses: data.addresses ?? addresses,
+        instructions: data.instructions ??
+            (addresses.length
+                ? 'Send USDC to a deposit address below. Credits appear after chain confirmation.'
+                : 'No deposit address yet. Run: bags fund --create  (or open the dashboard onboard page).'),
+        deposit_url: data.deposit_url ?? `${getBaseUrl()}/wallet/onboard`,
+    };
+}
+export async function createDeposit(token, opts = {}) {
+    const body = await apiRequest('/api/wallet/deposit', {
+        method: 'POST',
+        token,
+        body: {
+            network: opts.network ?? 'base',
+            ...(opts.amount_cents != null ? { amount_cents: opts.amount_cents } : {}),
+        },
+    });
+    return unwrapPayload(body);
+}
+export async function getTransactions(token, opts = {}) {
+    const params = new URLSearchParams();
+    if (opts.limit != null)
+        params.set('limit', String(opts.limit));
+    if (opts.cursor)
+        params.set('cursor', opts.cursor);
+    const qs = params.toString();
+    const body = await apiRequest(`/api/wallet/transactions${qs ? `?${qs}` : ''}`, { token });
+    const data = unwrapPayload(body);
+    return {
+        transactions: Array.isArray(data.transactions)
+            ? data.transactions
+            : Array.isArray(data)
+                ? data
+                : [],
+        next_cursor: data.next_cursor ?? null,
+    };
+}
+export async function getPolicies(token) {
+    const body = await apiRequest('/api/wallet/policies', { token });
+    return unwrapPayload(body);
+}
+export async function setPolicies(token, patch) {
+    const body = await apiRequest('/api/wallet/policies', {
+        method: 'PATCH',
+        token,
+        body: patch,
+    });
+    return unwrapPayload(body);
+}
+export async function listKeys(token) {
+    const body = await apiRequest('/api/wallet/keys', { token });
+    return unwrapPayload(body);
+}
+export async function createKey(token, label) {
+    const body = await apiRequest('/api/wallet/keys', {
+        method: 'POST',
+        token,
+        body: label ? { label } : {},
+    });
+    return unwrapPayload(body);
+}
+export async function revokeKey(token, id) {
+    const body = await apiRequest(`/api/wallet/keys?id=${encodeURIComponent(id)}`, {
+        method: 'DELETE',
+        token,
+    });
+    return unwrapPayload(body);
+}
+export async function registerOrigin(token, origin, opts = {}) {
+    const body = await apiRequest('/api/wallet/register', {
+        method: 'POST',
+        token,
+        body: {
+            origin,
+            ...(opts.label ? { label: opts.label } : {}),
+            ...(opts.description ? { description: opts.description } : {}),
+        },
+    });
+    return unwrapPayload(body);
+}

package/dist/config.d.ts

@@ -0,0 +1,14 @@
+/** Production default. Override with BAGS_API_URL for staging (e.g. https://staging.getbags.app). */
+export declare const DEFAULT_BASE_URL = "https://www.getbags.app";
+export type Credentials = {
+    token: string;
+};
+export declare function getBaseUrl(): string;
+/** Hosted agent skill URL (follows BAGS_API_URL). */
+export declare function getSkillUrl(): string;
+/** Prompt agents paste to install the hosted skill. */
+export declare function getSkillSetupPrompt(): string;
+export declare function credentialsPath(): string;
+export declare function loadCredentials(): Credentials | null;
+export declare function saveCredentials(token: string): void;
+export declare function requireToken(): string;

package/dist/config.js

@@ -0,0 +1,51 @@
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+/** Production default. Override with BAGS_API_URL for staging (e.g. https://staging.getbags.app). */
+export const DEFAULT_BASE_URL = 'https://www.getbags.app';
+export function getBaseUrl() {
+    const raw = process.env.BAGS_API_URL?.trim();
+    if (!raw)
+        return DEFAULT_BASE_URL;
+    return raw.replace(/\/+$/, '');
+}
+/** Hosted agent skill URL (follows BAGS_API_URL). */
+export function getSkillUrl() {
+    return `${getBaseUrl()}/wallet/skill.md`;
+}
+/** Prompt agents paste to install the hosted skill. */
+export function getSkillSetupPrompt() {
+    return `Set up ${getSkillUrl()}`;
+}
+export function credentialsPath() {
+    return join(homedir(), '.bags', 'credentials.json');
+}
+export function loadCredentials() {
+    const path = credentialsPath();
+    if (!existsSync(path))
+        return null;
+    try {
+        const parsed = JSON.parse(readFileSync(path, 'utf8'));
+        if (typeof parsed.token === 'string' && parsed.token.length > 0) {
+            return { token: parsed.token };
+        }
+    }
+    catch {
+        return null;
+    }
+    return null;
+}
+export function saveCredentials(token) {
+    const dir = join(homedir(), '.bags');
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const path = credentialsPath();
+    writeFileSync(path, `${JSON.stringify({ token }, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
+    chmodSync(path, 0o600);
+}
+export function requireToken() {
+    const creds = loadCredentials();
+    if (!creds) {
+        throw new Error('no wallet token; run: npx @getbags/cash redeem <code>');
+    }
+    return creds.token;
+}