@ldgr/cli 0.5.2 → 0.5.3

package/README.md

@@ -1,6 +1,6 @@
 # @ldgr/cli
 
-LDGR's self-custody terminal wallet. Version 0.5.2 creates or imports local wallets, lets you select between them, shows addresses and balances, sends native Ledra or a token, and persistently switches the selected wallet between mainnet and testnet. It also reviews prepared MCP requests for transfers, swaps, token creation and escrow creation in a separate interactive terminal.
+LDGR's self-custody terminal wallet. Version 0.5.3 creates or imports local wallets, lets you select between them, shows addresses and balances, sends native Ledra or a token, and persistently switches the selected wallet between mainnet and testnet. It also exports encrypted files for the web wallet and reviews prepared MCP requests for transfers, swaps, token creation and escrow creation in a separate interactive terminal.
 
 The MCP launcher uses `ldgr mcp --stdin` with a UTF-8 JSON envelope for
 `wallet-info` and `save-request`. Envelopes are limited to 128 KiB. Public wallet
@@ -16,6 +16,7 @@ npm install -g @ldgr/cli
 ldgr wallet create
 ldgr wallet import ~/Downloads/ldgr-recovery-key.txt
 ldgr wallet export ~/Desktop/ldgr-recovery-key.txt
+ldgr wallet export-web ~/Desktop/ldgr-web-wallet.json
 ldgr wallet list
 ldgr wallet select 2
 ldgr address
@@ -26,6 +27,14 @@ ldgr network show
 ldgr network set testnet
 ```
 
+## Encrypted web-wallet transfer
+
+Run `ldgr wallet export-web <file> [--wallet <path>]` in your own interactive terminal. It shows the selected public address, network and destination `https://wlt.ldgr.ltd`, then asks for confirmation with **No** selected. A protected source wallet prompts privately for its existing passphrase. Every export requires a separate transfer-file passphrase of at least 12 characters, entered twice through masked prompts, including when the source wallet is unprotected. Recovery keys and passphrases are never command arguments, environment variables, or terminal output for this operation.
+
+The command writes a new owner-only file without overwriting an existing path. Its version-1 `ldgr-web-wallet-transfer` envelope contains `ledgerId`, `address`, `publicKey`, and a passphrase-encrypted `ldgr-browser-wallet` vault. Open [Ledra Wallet](https://wlt.ldgr.ltd/#import), choose **Import encrypted wallet file**, select this file, and enter its transfer passphrase there. Delete the transfer file after import and keep the passphrase private. The encrypted file is sensitive backup material. On Windows its permissions rely on native ACLs, as the source wallet does.
+
+The MCP command envelope may launch `wallet export-web` in a separate terminal, but the machine bridge and `@ldgr/cli/mcp` module cannot export or unlock a wallet. Piped input or output is rejected before the command reads or migrates the source vault.
+
 ## MCP approval requests
 
 The public `@ldgr/cli/mcp` module exposes `getMcpWalletInfo`, `validateMcpRequest`, and `saveMcpRequest`. Metadata is an explicit public projection: address, public key, network, ledger ID and protection mode. It never returns a recovery key, passphrase, encrypted vault or signer. Request preparation does not unlock, sign or submit.

package/dist/cli.js

@@ -812,7 +812,7 @@ function commandArgs(input) {
   const creation = first === "wallet" && (second === "create" || second === "import");
   if (testnet && !creation)
     throw new TypeError("Invalid network flag");
-  const valid = first === "wallet" && second === "create" && positional.length === 2 || first === "wallet" && second === "import" && (positional.length === 2 || positional.length === 3) || first === "wallet" && second === "list" && positional.length === 2 || first === "wallet" && second === "select" && positional.length === 3 && /^[0-9]+$/.test(third) || first === "approve" && positional.length === 2 || first === "address" && positional.length === 1 || first === "network" && second === "show" && positional.length === 2 || first === "network" && second === "set" && positional.length === 3 && (third === "mainnet" || third === "testnet");
+  const valid = first === "wallet" && second === "create" && positional.length === 2 || first === "wallet" && second === "import" && (positional.length === 2 || positional.length === 3) || first === "wallet" && second === "list" && positional.length === 2 || first === "wallet" && second === "export-web" && positional.length === 3 || first === "wallet" && second === "select" && positional.length === 3 && /^[0-9]+$/.test(third) || first === "approve" && positional.length === 2 || first === "address" && positional.length === 1 || first === "network" && second === "show" && positional.length === 2 || first === "network" && second === "set" && positional.length === 3 && (third === "mainnet" || third === "testnet");
   if (!valid)
     throw new TypeError("Unsupported command");
   return [...input];
@@ -873,14 +873,58 @@ async function runMcpBridge(args) {
   return;
 }
 
+// src/web-wallet-export.ts
+import { importEncryptedWalletVault } from "@ldgr/wallet-core";
+import { mkdir as mkdir4, open as open4 } from "node:fs/promises";
+import { dirname as dirname4 } from "node:path";
+async function exportWebWalletFile(input) {
+  if (input.transferPassphrase.length < 12)
+    throw new RangeError("Transfer passphrase must be at least 12 characters");
+  const file = await walletFileMetadata(input.walletPath);
+  if (input.expectedIdentity && (file.ledgerId !== input.expectedIdentity.ledgerId || file.address !== input.expectedIdentity.address || file.publicKey !== input.expectedIdentity.publicKey)) {
+    throw new Error("Selected wallet changed after review; start the export again");
+  }
+  const unlocked = await unlockWalletFile(file, input.sourcePassphrase);
+  const imported = await importEncryptedWalletVault({
+    recoveryKey: unlocked.recoveryKey,
+    ledgerId: file.ledgerId,
+    passphrase: input.transferPassphrase
+  });
+  if (imported.address !== file.address || imported.publicKey !== file.publicKey || imported.vault.publicKey !== file.publicKey || imported.vault.protection !== "passphrase") {
+    throw new Error("Exported wallet identity or protection does not match the source wallet");
+  }
+  const envelope = {
+    format: "ldgr-web-wallet-transfer",
+    version: 1,
+    ledgerId: file.ledgerId,
+    address: file.address,
+    publicKey: file.publicKey,
+    vault: imported.vault
+  };
+  await mkdir4(dirname4(input.backupPath), { recursive: true, mode: 448 });
+  const handle = await open4(input.backupPath, "wx", 384).catch((error) => {
+    if (error.code === "EEXIST")
+      throw new Error(`Web-wallet transfer file already exists: ${input.backupPath}`);
+    throw error;
+  });
+  try {
+    await handle.writeFile(JSON.stringify(envelope) + `
+`, "utf8");
+    await handle.sync();
+  } finally {
+    await handle.close();
+  }
+}
+
 // src/cli.ts
 var HELP = `
-LDGR CLI 0.5.2 — self-custody wallet
+LDGR CLI 0.5.3 — self-custody wallet
 
 Usage:
   ldgr wallet create [--testnet] [--wallet <path>]
   ldgr wallet import [recovery-key-file] [--testnet] [--wallet <path>]
   ldgr wallet export <recovery-key-file> [--wallet <path>]
+  ldgr wallet export-web <transfer-file> [--wallet <path>]
   ldgr wallet list [--wallet <path>]
   ldgr wallet select <index> [--wallet <path>]
   ldgr address [--wallet <path>]
@@ -895,7 +939,9 @@ The default wallet store is ~/.ldgr/wallet.json. A wallet can be
 passphrase-protected or unprotected (local-file permissions only). The CLI
 never accepts recovery-key values or passphrases as arguments or environment
 variables. Use \`ldgr wallet export <path>\` for an extension-compatible
-recovery-key file. Testnet mode prints a warning on every wallet command.
+recovery-key file. Use \`ldgr wallet export-web <path>\` in an interactive
+terminal for a passphrase-encrypted transfer file for https://wlt.ldgr.ltd.
+Testnet mode prints a warning on every wallet command.
 `;
 function parseArguments(argv) {
   const command = [];
@@ -1041,6 +1087,30 @@ async function runExport(path, backupPath) {
   p2.log.warn("Anyone with this recovery-key file can control the wallet. Keep it offline and never share it.");
   p2.outro(`Recovery-key file saved at ${backupPath}`);
 }
+async function runExportWeb(path, backupPath) {
+  const file = await walletFileMetadata(path);
+  showNetworkWarning(file);
+  p2.note(`Address
+${file.address}
+
+Network
+${networkLabel(file)}
+
+Destination
+https://wlt.ldgr.ltd
+
+Transfer file
+${backupPath.replace(/[\x00-\x1f\x7f-\x9f\p{Cf}\u2028\u2029]/gu, "?")}`, "Review encrypted wallet export");
+  await confirm3("Export this wallet for https://wlt.ldgr.ltd?");
+  const sourcePassphrase = await signingPassphrase(file, "Enter your source wallet passphrase");
+  const transferPassphrase = await askPassphrase("Choose a separate transfer-file passphrase");
+  const repeated = await askPassphrase("Repeat the transfer-file passphrase");
+  if (transferPassphrase !== repeated)
+    throw new Error("Passphrases did not match");
+  await exportWebWalletFile({ walletPath: path, backupPath, sourcePassphrase, transferPassphrase, expectedIdentity: file });
+  p2.log.info("Open https://wlt.ldgr.ltd/#import, choose Import encrypted wallet file, and select this file. Enter its passphrase only in the wallet. Delete the transfer file after import.");
+  p2.outro("Encrypted web-wallet transfer file saved");
+}
 async function runWalletList(path) {
   const wallets = await listWalletFileMetadata(path);
   const selected = wallets.find((wallet) => wallet.selected);
@@ -1189,6 +1259,9 @@ async function main() {
   }
   p2.intro("LDGR CLI");
   try {
+    if (first === "wallet" && second === "export-web" && (!process.stdin.isTTY || !process.stdout.isTTY)) {
+      throw new Error("Web-wallet export requires an interactive terminal with terminal input and output");
+    }
     const resolved = parsed.walletPathExplicit ? { path: parsed.walletPath, migrated: false } : await migrateDefaultWalletPath();
     if (resolved.migrated)
       p2.log.info(`Moved legacy wallet store to ${resolved.path}`);
@@ -1198,6 +1271,8 @@ async function main() {
       await runImport(resolved.path, parsed.walletOnTestnet, third);
     else if (first === "wallet" && second === "export" && third && fourth === undefined)
       await runExport(resolved.path, third);
+    else if (first === "wallet" && second === "export-web" && third && fourth === undefined)
+      await runExportWeb(resolved.path, third);
     else if (first === "wallet" && second === "list" && third === undefined)
       await runWalletList(resolved.path);
     else if (first === "wallet" && second === "select" && third && fourth === undefined)

package/dist/wallet-file.d.ts

@@ -67,6 +67,10 @@ export declare function migrateDefaultWalletPath(input?: DefaultWalletPathInput)
     readonly path: string;
     readonly migrated: boolean;
 }>;
+export declare function unlockWalletFile(file: LocalWalletFile, passphrase?: string): Promise<{
+    readonly wallet: LdgrSigner;
+    readonly recoveryKey: string;
+}>;
 export declare function readEncryptedWalletFile(path: string, passphrase?: string): Promise<LdgrSigner>;
 /** Writes the exact raw recovery-key text accepted by the extension importer. */
 export declare function exportRecoveryKeyFile(input: {

package/dist/web-wallet-export.d.ts

@@ -0,0 +1,21 @@
+import { type EncryptedWalletVault } from "@ldgr/wallet-core";
+import type { LedgerId } from "@ldgr/protocol";
+type WalletIdentity = {
+    readonly ledgerId: LedgerId;
+    readonly address: string;
+    readonly publicKey: string;
+};
+export type WebWalletTransfer = WalletIdentity & {
+    readonly format: "ldgr-web-wallet-transfer";
+    readonly version: 1;
+    readonly vault: EncryptedWalletVault;
+};
+/** Local-only export; never expose this operation through the public MCP module. */
+export declare function exportWebWalletFile(input: {
+    readonly walletPath: string;
+    readonly backupPath: string;
+    readonly sourcePassphrase?: string | undefined;
+    readonly transferPassphrase: string;
+    readonly expectedIdentity?: WalletIdentity;
+}): Promise<void>;
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ldgr/cli",
-  "version": "0.5.2",
+  "version": "0.5.3",
   "type": "module",
   "bin": {
     "ldgr": "dist/cli.js"