@inversealtruism/cairn-cli 0.3.1 → 0.3.2

package/README.md

@@ -91,9 +91,16 @@ Fees and amounts are in **CSD** (e.g. `--amount 1.5`, `--fee 0.05`). Minimums: 0
 - `verify` fetches an item, recomputes `sha256(canonical content)` locally, and if `CAIRN_RPC` is set,
   confirms that hash is the one committed on-chain. You trust the math, not the server.
 - `send` / `propose` / `support` / `wall place`: cairn-cli fetches a spendable input from the Cairn
-  proxy, hands it to **your** `csd` (which signs with your wallet key — the key never leaves your
-  machine and never touches cairn-cli), then submits the signed transaction through the proxy and (for
-  proposals) registers the off-chain content. Sealed claims and Sign-in-with-CSD live in the Cairn Wallet.
+  proxy, hands it to **your** `csd` (which signs with your wallet key — for these commands the key
+  stays inside `csd` and never enters the cairn-cli process), then submits the signed transaction
+  through the proxy and (for proposals) registers the off-chain content. Sealed claims and
+  Sign-in-with-CSD live in the Cairn Wallet.
+- **L3 registry commands** (`gateway register`, `peer announce`, `identity claim`) are the one
+  exception: they sign a registry *binding* with `@inversealtruism/csd-registry`, so cairn-cli reads
+  your private key from `csd wallet config` and signs **in-process** (the key is never networked — only
+  the signed canonical content is published). Because these load key material into the Node process,
+  the `csd-registry` / `csd-codec` dependencies are **pinned to exact versions** (no caret ranges) to
+  shrink the supply-chain surface. If you only ever `send`/`propose`/`support`, your key never leaves `csd`.
 
 ## License
 

package/dist/cli.js

@@ -5,6 +5,9 @@ import { CAIRN_API, CAIRN_ADDR, CAIRN_TOKEN, CAIRN_RPC, MIN_FEE_PROPOSE, MIN_FEE
 import * as api from "./lib/api.js";
 import * as csd from "./lib/csd.js";
 import { buildCommitment } from "./lib/item.js";
+import { buildGatewayRecord, buildPeerRecord, buildIdentityCommit, buildIdentityReveal } from "@inversealtruism/csd-registry";
+import { canonicalJson } from "@inversealtruism/csd-codec";
+import { randomBytes } from "node:crypto";
 import { c, banner, bannerAnimated, rule, badge, bar, csd as csdFmt, ok, warn, err, key as kdim, pad, spinner, sleep, isTty, anim, clearScreen, cursorHome, san } from "./lib/ui.js";
 const CSD = (n) => Number.isFinite(n) ? Math.round(n * CSD_PER_COIN) : NaN; // CSD → base units
 // Resolve the user's PUBLIC address (to fetch inputs from the proxy). Never reads the key
@@ -664,7 +667,143 @@ async function main() {
         case "propose":
         case "post": return cmdPropose(a);
         case "support": return cmdSupport(a);
+        case "gateway": return cmdGateway(a);
+        case "peer": return cmdPeer(a);
+        case "identity": return cmdIdentity(a);
         default: return help();
     }
 }
+// ── L3 registry publish commands (build a signed record → anchor Propose → serve bytes) ──
+// Anchor a built registry record: Propose{domain, payloadHash} signed by the csd wallet,
+// then publish the EXACT canonical bytes to the content origin (self-certified on arrival).
+async function anchorRecord(rec, addr, fee, days, label) {
+    const uri = "csd:" + rec.domain.replace(/[^a-z]/gi, "").slice(0, 6) + ":v1:" + rec.payloadHash.slice(2, 14);
+    const sp = spinner("fetching input → csd signs → submit");
+    const picked = await api.pickInput(addr, fee).catch(() => null);
+    if (!picked) {
+        sp.stop();
+        console.log(err("no confirmed UTXO above the fee") + c.gray(" — fund " + addr));
+        return false;
+    }
+    const tip = await api.tipHeight().catch(() => 0);
+    const r = await signAndSubmit(["propose", "--domain", rec.domain, "--payload-hash", rec.payloadHash, "--uri", uri, "--expires-epoch", String(Math.floor(tip / 30) + days * 24), "--fee", String(fee), "--change", addr, "--input", picked.input]);
+    sp.stop();
+    if (!r.ok) {
+        console.log(err(r.error || "failed"));
+        return false;
+    }
+    console.log(ok(`${label} anchored  ${c.cyan(r.txid)}`) + c.gray("  (signed by your csd wallet)"));
+    const sp2 = spinner("publishing content (waits for the tx to mine)");
+    const done = await api.registerRawContent(canonicalJson(rec.content), r.txid);
+    sp2.stop();
+    console.log(done ? ok("content published — record is now resolvable") : warn("content not published yet — re-run once mined"));
+    return done;
+}
+// Shared setup for the registry commands: require csd, the privkey (to sign the binding
+// locally — never networked), and the address.
+async function registryPrep(a) {
+    if (!(await requireCsd()))
+        return null;
+    const cfg = await csd.walletConfig();
+    const priv = cfg?.default_privkey;
+    if (!priv) {
+        console.log(err("no csd wallet key configured.") + c.gray("  Run ") + c.cyan("csd wallet new"));
+        return null;
+    }
+    const addr = await resolveAddr(a);
+    if (!addr) {
+        console.log(err("could not resolve your address — run ") + c.cyan("cairn setup"));
+        return null;
+    }
+    return { priv, addr };
+}
+async function cmdGateway(a) {
+    if (a._[1] !== "register") {
+        console.log(warn("usage: ") + c.cyan("cairn gateway register --url https://gw/content/0x{hash} [--pin] [--fee 0.25]"));
+        return;
+    }
+    const url = String(a.flags.url ?? "");
+    if (!url.includes("{hash}")) {
+        console.log(err("--url must contain the {hash} template, e.g. https://gw/content/0x{hash}"));
+        return;
+    }
+    const p = await registryPrep(a);
+    if (!p)
+        return;
+    const rec = buildGatewayRecord({ priv: p.priv, url, kind: a.flags.pin ? "pin" : "gateway", address: p.addr });
+    const fee = Math.max(MIN_FEE_PROPOSE, a.flags.fee !== undefined ? CSD(Number(a.flags.fee)) : MIN_FEE_PROPOSE);
+    if (a.flags["dry-run"]) {
+        console.log(`${kdim("domain")} ${c.cyan(rec.domain)}\n${kdim("url")}    ${c.white(url)}\n${kdim("hash")}   ${c.magenta(rec.payloadHash)}`);
+        console.log(c.gray("\n[dry-run] not signed or submitted"));
+        return;
+    }
+    await anchorRecord(rec, p.addr, fee, 10, "gateway");
+}
+async function cmdPeer(a) {
+    if (a._[1] !== "announce") {
+        console.log(warn("usage: ") + c.cyan("cairn peer announce --peer-id <id> --addr /ip4/…/tcp/… [--addr …] [--cap full] [--fee 0.25]"));
+        return;
+    }
+    const peerId = String(a.flags["peer-id"] ?? "");
+    const multiaddrs = (a.multi.addr ?? (a.flags.addr ? [String(a.flags.addr)] : [])).filter(Boolean);
+    if (!peerId || multiaddrs.length === 0) {
+        console.log(err("--peer-id and at least one --addr required"));
+        return;
+    }
+    const p = await registryPrep(a);
+    if (!p)
+        return;
+    const caps = (a.multi.cap ?? (a.flags.cap ? [String(a.flags.cap)] : [])).filter(Boolean);
+    const rec = buildPeerRecord({ priv: p.priv, peer_id: peerId, multiaddrs, caps: caps.length ? caps : undefined, address: p.addr });
+    const fee = Math.max(MIN_FEE_PROPOSE, a.flags.fee !== undefined ? CSD(Number(a.flags.fee)) : MIN_FEE_PROPOSE);
+    if (a.flags["dry-run"]) {
+        console.log(`${kdim("domain")} ${c.cyan(rec.domain)}\n${kdim("peer")}   ${c.white(peerId)}\n${kdim("hash")}   ${c.magenta(rec.payloadHash)}`);
+        console.log(c.gray("\n[dry-run] not signed or submitted"));
+        return;
+    }
+    await anchorRecord(rec, p.addr, fee, 10, "peer");
+}
+async function cmdIdentity(a) {
+    const sub = a._[1];
+    const handle = String(a.flags.handle ?? a._[2] ?? "");
+    if (sub !== "claim" || !handle) {
+        console.log(warn("usage: ") + c.cyan("cairn identity claim <handle> [--salt <hex>] [--commit-only|--reveal] [--fee 0.25]"));
+        console.log(c.gray("  step 1: --commit-only (saves a salt)  ·  step 2 (next epoch): --reveal --salt <hex>"));
+        return;
+    }
+    if (!/^[a-z0-9_.-]{3,32}$/i.test(handle)) {
+        console.log(err("handle must be 3–32 chars [a-z0-9_.-]"));
+        return;
+    }
+    const p = await registryPrep(a);
+    if (!p)
+        return;
+    const fee = Math.max(MIN_FEE_PROPOSE, a.flags.fee !== undefined ? CSD(Number(a.flags.fee)) : MIN_FEE_PROPOSE);
+    if (a.flags.reveal) {
+        const salt = String(a.flags.salt ?? "");
+        if (!/^[0-9a-f]{16,}$/i.test(salt)) {
+            console.log(err("--salt <hex> from your earlier --commit-only step is required to reveal"));
+            return;
+        }
+        const rec = buildIdentityReveal({ priv: p.priv, handle, salt, address: p.addr });
+        if (a.flags["dry-run"]) {
+            console.log(`${kdim("reveal")} ${c.white(handle)} → ${c.cyan(p.addr)}\n${kdim("hash")}   ${c.magenta(rec.payloadHash)}`);
+            console.log(c.gray("\n[dry-run] not signed"));
+            return;
+        }
+        await anchorRecord(rec, p.addr, fee, 90, "identity reveal");
+        return;
+    }
+    // default / --commit-only: step 1
+    const salt = String(a.flags.salt ?? randomBytes(16).toString("hex"));
+    const rec = buildIdentityCommit({ handle, salt, address: p.addr });
+    if (a.flags["dry-run"]) {
+        console.log(`${kdim("commit")} ${c.white(handle)}\n${kdim("salt")}   ${c.magenta(salt)}\n${kdim("hash")}   ${c.magenta(rec.payloadHash)}`);
+        console.log(c.gray("\n[dry-run] not signed"));
+        return;
+    }
+    const okc = await anchorRecord(rec, p.addr, fee, 90, "identity commit");
+    if (okc)
+        console.log(c.gray("\n  save this salt — reveal NEXT epoch (~1h):  ") + c.cyan(`cairn identity claim ${handle} --reveal --salt ${salt}`));
+}
 main().catch((e) => { console.error(err(String(e?.message ?? e))); process.exit(1); });

package/dist/lib/api.js

@@ -85,6 +85,20 @@ export async function registerContent(content, txid, attempts = 20) {
     }
     return false;
 }
+// Register an L3 registry record's EXACT canonical bytes (origin serves them verbatim;
+// accepted only if sha256(bytes) == the on-chain payload_hash). Retries while it mines.
+export async function registerRawContent(bytes, txid, attempts = 20) {
+    for (let i = 0; i < attempts; i++) {
+        try {
+            const r = await req("/api/content", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ bytes, txid }) });
+            if (r.ok)
+                return true;
+        }
+        catch { /* keep trying while it mines */ }
+        await new Promise((res) => setTimeout(res, 8000));
+    }
+    return false;
+}
 // optional: query a raw csd node RPC (for trustless verify)
 export async function chainProposal(id) {
     if (!CAIRN_RPC)

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@inversealtruism/cairn-cli",
-  "version": "0.3.1",
-  "description": "CLI for Compute Substrate / Cairn \u2014 browse the board/wall/network, and send CSD, propose, attest, and place stones non-custodially by driving your own installed `csd` wallet (cairn never holds your key; works node-less via the Cairn proxy).",
+  "version": "0.3.2",
+  "description": "CLI for Compute Substrate / Cairn — browse the board/wall/network, and send CSD, propose, attest, and place stones non-custodially by driving your own installed `csd` wallet (cairn never holds your key; works node-less via the Cairn proxy).",
   "type": "module",
   "bin": {
     "cairn": "dist/cli.js"
@@ -22,10 +22,12 @@
     "access": "public"
   },
   "scripts": {
-    "build": "tsc",
+    "clean": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\"",
+    "build": "npm run clean && tsc",
     "dev": "tsx src/cli.ts",
-    "test": "tsc && node test/security.mjs && node test/e2e.mjs",
-    "prepare": "tsc"
+    "test": "npm run build && node test/security.mjs && node test/e2e.mjs",
+    "prepare": "npm run clean && tsc",
+    "prepublishOnly": "npm run clean && tsc"
   },
   "keywords": [
     "cairn",
@@ -37,5 +39,9 @@
     "@types/node": "^22.10.0",
     "tsx": "^4.19.2",
     "typescript": "^5.7.2"
+  },
+  "dependencies": {
+    "@inversealtruism/csd-codec": "0.1.3",
+    "@inversealtruism/csd-registry": "0.1.3"
   }
 }