@metamask-previews/wallet-cli 0.0.0-preview-4f4c98e → 0.0.0-preview-eb263b0ee

package/dist/daemon/daemon-spawn.cjs

@@ -0,0 +1,138 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureDaemon = void 0;
+const node_child_process_1 = require("node:child_process");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const daemon_client_js_1 = require("./daemon-client.cjs");
+const data_dir_js_1 = require("./data-dir.cjs");
+const paths_js_1 = require("./paths.cjs");
+const POLL_INTERVAL_MS = 100;
+const MAX_POLLS = 300; // 30 seconds
+/**
+ * Ensure the daemon is running. If a responsive daemon already exists, return
+ * `'already-running'` (caller decides how to surface that). Otherwise spawn
+ * one as a detached process and wait until the socket becomes responsive.
+ *
+ * Refuses to spawn when pinging the existing socket fails with anything other
+ * than `ENOENT` (wedged or foreign daemon) — taking over could orphan the
+ * existing process and corrupt its PID file.
+ *
+ * @param config - Spawn configuration.
+ * @returns The state of the daemon and the socket path it's listening on.
+ */
+async function ensureDaemon(config) {
+    const { socketPath, logPath } = (0, paths_js_1.getDaemonPaths)(config.dataDir);
+    const initialPing = await (0, daemon_client_js_1.pingDaemon)(socketPath);
+    switch (initialPing.status) {
+        case 'responsive':
+            return { state: 'already-running', socketPath };
+        case 'unreachable':
+            if (initialPing.reason === 'permission') {
+                throw new Error(`Refusing to start: the socket at ${socketPath} is owned by another user. ` +
+                    `Choose a different data directory (MM_DAEMON_DATA_DIR) or remove the socket manually. ` +
+                    `(${initialPing.error.message})`);
+            }
+            throw new Error(`Refusing to start: a daemon socket already exists at ${socketPath} but is unresponsive. ` +
+                `Run \`mm daemon stop\` (or \`mm daemon purge\`) before starting a new daemon. ` +
+                `(${initialPing.error.message})`);
+        case 'absent':
+            break;
+        /* istanbul ignore next -- exhaustiveness guard; unreachable for the current PingResult union */
+        default: {
+            const exhaustiveCheck = initialPing;
+            throw new Error(`Unexpected daemon ping status: ${String(exhaustiveCheck)}`);
+        }
+    }
+    process.stderr.write('Starting daemon...\n');
+    const { entryPath, args } = resolveEntryPoint(config.packageRoot);
+    // Create the data directory before opening the log file inside it. The daemon
+    // entry also does this, but only after spawn — opening the log first would
+    // ENOENT on a fresh data directory.
+    await (0, data_dir_js_1.ensureOwnerOnlyDirectory)(config.dataDir);
+    // Redirect the detached daemon's stderr to its log file rather than
+    // discarding it, so a crash after startup stays diagnosable. stdout stays
+    // ignored — structured status goes through the file logger.
+    const logFileDescriptor = (0, node_fs_1.openSync)(logPath, 'a');
+    const childEnv = {
+        ...process.env,
+        MM_DAEMON_DATA_DIR: config.dataDir,
+        MM_DAEMON_SOCKET_PATH: socketPath,
+        INFURA_PROJECT_ID: config.infuraProjectId,
+        MM_WALLET_SRP: config.srp.unwrap(),
+    };
+    // `childEnv` spreads `process.env`, so an inherited `MM_WALLET_PASSWORD`
+    // would otherwise leak into the child and unlock a daemon the caller meant
+    // to start locked. When no password was supplied, delete the inherited key
+    // so the daemon comes up locked; otherwise overwrite it with the supplied
+    // value.
+    if (config.password === undefined) {
+        delete childEnv.MM_WALLET_PASSWORD;
+    }
+    else {
+        childEnv.MM_WALLET_PASSWORD = config.password.unwrap();
+    }
+    const child = (0, node_child_process_1.spawn)(process.execPath, [...args, entryPath], {
+        detached: true,
+        stdio: ['ignore', 'ignore', logFileDescriptor],
+        env: childEnv,
+    });
+    // The child dup'd the file descriptor into its stderr, so drop the parent's
+    // copy. Safe on the success path: `spawn` reports failures via the 'error'
+    // event, not a synchronous throw.
+    (0, node_fs_1.closeSync)(logFileDescriptor);
+    // A failed spawn (bad interpreter, EACCES, ENOENT) emits 'error' and may
+    // never emit 'exit', so 'error' is recorded first and not overwritten by a
+    // later 'exit' — the loop surfaces the real cause instead of hanging.
+    const outcome = { current: { kind: 'pending' } };
+    child.on('error', (error) => {
+        process.stderr.write(`Failed to spawn daemon process: ${String(error)}\n`);
+        outcome.current = { kind: 'error', error };
+    });
+    child.on('exit', (code, signal) => {
+        if (outcome.current.kind === 'pending') {
+            outcome.current = { kind: 'exited', code, signal };
+        }
+    });
+    child.unref();
+    for (let i = 0; i < MAX_POLLS; i++) {
+        await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));
+        const settled = outcome.current;
+        if (settled.kind === 'error') {
+            throw new Error(`Failed to spawn daemon process: ${settled.error.message}. ` +
+                `Check the daemon log at ${logPath}.`);
+        }
+        if (settled.kind === 'exited') {
+            throw new Error(`Daemon process exited during startup (code=${String(settled.code)}, signal=${String(settled.signal)}). ` +
+                `Check the daemon log at ${logPath}.`);
+        }
+        const ping = await (0, daemon_client_js_1.pingDaemon)(socketPath);
+        if (ping.status === 'responsive') {
+            process.stderr.write('Daemon ready.\n');
+            return { state: 'started', socketPath };
+        }
+    }
+    throw new Error(`Daemon did not start within ${(MAX_POLLS * POLL_INTERVAL_MS) / 1000}s`);
+}
+exports.ensureDaemon = ensureDaemon;
+/**
+ * Resolve the daemon entry point path and any extra Node.js args needed.
+ *
+ * In production, uses the compiled dist output. In development, uses tsx
+ * to run TypeScript source directly.
+ *
+ * @param packageRoot - The root directory of the wallet-cli package.
+ * @returns The entry path and any extra node args.
+ */
+function resolveEntryPoint(packageRoot) {
+    const distEntry = (0, node_path_1.join)(packageRoot, 'dist', 'daemon', 'daemon-entry.mjs');
+    if ((0, node_fs_1.existsSync)(distEntry)) {
+        return { entryPath: distEntry, args: [] };
+    }
+    const srcEntry = (0, node_path_1.join)(packageRoot, 'src', 'daemon', 'daemon-entry.ts');
+    return {
+        entryPath: srcEntry,
+        args: ['--import', 'tsx'],
+    };
+}
+//# sourceMappingURL=daemon-spawn.cjs.map

package/dist/daemon/daemon-spawn.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-spawn.cjs","sourceRoot":"","sources":["../../src/daemon/daemon-spawn.ts"],"names":[],"mappings":";;;AAAA,2DAA2C;AAC3C,qCAA0D;AAC1D,yCAAiC;AAEjC,0DAAgD;AAChD,gDAAyD;AACzD,0CAA4C;AAG5C,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,MAAM,SAAS,GAAG,GAAG,CAAC,CAAC,aAAa;AAgBpC;;;;;;;;;;;GAWG;AACI,KAAK,UAAU,YAAY,CAChC,MAAyB;IAEzB,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,IAAA,yBAAc,EAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAE/D,MAAM,WAAW,GAAG,MAAM,IAAA,6BAAU,EAAC,UAAU,CAAC,CAAC;IACjD,QAAQ,WAAW,CAAC,MAAM,EAAE,CAAC;QAC3B,KAAK,YAAY;YACf,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,CAAC;QAClD,KAAK,aAAa;YAChB,IAAI,WAAW,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;gBACxC,MAAM,IAAI,KAAK,CACb,oCAAoC,UAAU,6BAA6B;oBACzE,wFAAwF;oBACxF,IAAI,WAAW,CAAC,KAAK,CAAC,OAAO,GAAG,CACnC,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,KAAK,CACb,wDAAwD,UAAU,wBAAwB;gBACxF,gFAAgF;gBAChF,IAAI,WAAW,CAAC,KAAK,CAAC,OAAO,GAAG,CACnC,CAAC;QACJ,KAAK,QAAQ;YACX,MAAM;QACR,gGAAgG;QAChG,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,eAAe,GAAU,WAAW,CAAC;YAC3C,MAAM,IAAI,KAAK,CACb,kCAAkC,MAAM,CAAC,eAAe,CAAC,EAAE,CAC5D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAE7C,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,iBAAiB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAElE,8EAA8E;IAC9E,2EAA2E;IAC3E,oCAAoC;IACpC,MAAM,IAAA,sCAAwB,EAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAE/C,oEAAoE;IACpE,0EAA0E;IAC1E,4DAA4D;IAC5D,MAAM,iBAAiB,GAAG,IAAA,kBAAQ,EAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAEjD,MAAM,QAAQ,GAAsB;QAClC,GAAG,OAAO,CAAC,GAAG;QACd,kBAAkB,EAAE,MAAM,CAAC,OAAO;QAClC,qBAAqB,EAAE,UAAU;QACjC,iBAAiB,EAAE,MAAM,CAAC,eAAe;QACzC,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE;KACnC,CAAC;IACF,yEAAyE;IACzE,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,SAAS;IACT,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO,QAAQ,CAAC,kBAAkB,CAAC;IACrC,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,kBAAkB,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;IACzD,CAAC;IAED,MAAM,KAAK,GAAG,IAAA,0BAAK,EAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,SAAS,CAAC,EAAE;QAC1D,QAAQ,EAAE,IAAI;QACd,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,iBAAiB,CAAC;QAC9C,GAAG,EAAE,QAAQ;KACd,CAAC,CAAC;IACH,4EAA4E;IAC5E,2EAA2E;IAC3E,kCAAkC;IAClC,IAAA,mBAAS,EAAC,iBAAiB,CAAC,CAAC;IAO7B,yEAAyE;IACzE,2EAA2E;IAC3E,sEAAsE;IACtE,MAAM,OAAO,GAAgC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC;IAE9E,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE;QACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3E,OAAO,CAAC,OAAO,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;QAChC,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACvC,OAAO,CAAC,OAAO,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACrD,CAAC;IACH,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,KAAK,EAAE,CAAC;IAEd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CACb,mCAAmC,OAAO,CAAC,KAAK,CAAC,OAAO,IAAI;gBAC1D,2BAA2B,OAAO,GAAG,CACxC,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,8CAA8C,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK;gBACvG,2BAA2B,OAAO,GAAG,CACxC,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAA,6BAAU,EAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;YACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;YACxC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,MAAM,IAAI,KAAK,CACb,+BAA+B,CAAC,SAAS,GAAG,gBAAgB,CAAC,GAAG,IAAI,GAAG,CACxE,CAAC;AACJ,CAAC;AAzHD,oCAyHC;AAED;;;;;;;;GAQG;AACH,SAAS,iBAAiB,CAAC,WAAmB;IAI5C,MAAM,SAAS,GAAG,IAAA,gBAAI,EAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IAC1E,IAAI,IAAA,oBAAU,EAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAC5C,CAAC;IAED,MAAM,QAAQ,GAAG,IAAA,gBAAI,EAAC,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC;IACvE,OAAO;QACL,SAAS,EAAE,QAAQ;QACnB,IAAI,EAAE,CAAC,UAAU,EAAE,KAAK,CAAC;KAC1B,CAAC;AACJ,CAAC","sourcesContent":["import { spawn } from 'node:child_process';\nimport { closeSync, existsSync, openSync } from 'node:fs';\nimport { join } from 'node:path';\n\nimport { pingDaemon } from './daemon-client.js';\nimport { ensureOwnerOnlyDirectory } from './data-dir.js';\nimport { getDaemonPaths } from './paths.js';\nimport type { DaemonSpawnConfig } from './types.js';\n\nconst POLL_INTERVAL_MS = 100;\nconst MAX_POLLS = 300; // 30 seconds\n\n/**\n * Outcome of {@link ensureDaemon}.\n *\n * - `'already-running'`: a responsive daemon was found at the configured\n *   socket path. The supplied flags (`infuraProjectId`, `password`, `srp`)\n *   were NOT applied to that daemon; the caller should surface this so a\n *   user who is trying to change them isn't silently ignored.\n * - `'started'`: a new daemon was spawned and is now responsive.\n */\nexport type EnsureDaemonResult = {\n  state: 'already-running' | 'started';\n  socketPath: string;\n};\n\n/**\n * Ensure the daemon is running. If a responsive daemon already exists, return\n * `'already-running'` (caller decides how to surface that). Otherwise spawn\n * one as a detached process and wait until the socket becomes responsive.\n *\n * Refuses to spawn when pinging the existing socket fails with anything other\n * than `ENOENT` (wedged or foreign daemon) — taking over could orphan the\n * existing process and corrupt its PID file.\n *\n * @param config - Spawn configuration.\n * @returns The state of the daemon and the socket path it's listening on.\n */\nexport async function ensureDaemon(\n  config: DaemonSpawnConfig,\n): Promise<EnsureDaemonResult> {\n  const { socketPath, logPath } = getDaemonPaths(config.dataDir);\n\n  const initialPing = await pingDaemon(socketPath);\n  switch (initialPing.status) {\n    case 'responsive':\n      return { state: 'already-running', socketPath };\n    case 'unreachable':\n      if (initialPing.reason === 'permission') {\n        throw new Error(\n          `Refusing to start: the socket at ${socketPath} is owned by another user. ` +\n            `Choose a different data directory (MM_DAEMON_DATA_DIR) or remove the socket manually. ` +\n            `(${initialPing.error.message})`,\n        );\n      }\n      throw new Error(\n        `Refusing to start: a daemon socket already exists at ${socketPath} but is unresponsive. ` +\n          `Run \\`mm daemon stop\\` (or \\`mm daemon purge\\`) before starting a new daemon. ` +\n          `(${initialPing.error.message})`,\n      );\n    case 'absent':\n      break;\n    /* istanbul ignore next -- exhaustiveness guard; unreachable for the current PingResult union */\n    default: {\n      const exhaustiveCheck: never = initialPing;\n      throw new Error(\n        `Unexpected daemon ping status: ${String(exhaustiveCheck)}`,\n      );\n    }\n  }\n\n  process.stderr.write('Starting daemon...\\n');\n\n  const { entryPath, args } = resolveEntryPoint(config.packageRoot);\n\n  // Create the data directory before opening the log file inside it. The daemon\n  // entry also does this, but only after spawn — opening the log first would\n  // ENOENT on a fresh data directory.\n  await ensureOwnerOnlyDirectory(config.dataDir);\n\n  // Redirect the detached daemon's stderr to its log file rather than\n  // discarding it, so a crash after startup stays diagnosable. stdout stays\n  // ignored — structured status goes through the file logger.\n  const logFileDescriptor = openSync(logPath, 'a');\n\n  const childEnv: NodeJS.ProcessEnv = {\n    ...process.env,\n    MM_DAEMON_DATA_DIR: config.dataDir,\n    MM_DAEMON_SOCKET_PATH: socketPath,\n    INFURA_PROJECT_ID: config.infuraProjectId,\n    MM_WALLET_SRP: config.srp.unwrap(),\n  };\n  // `childEnv` spreads `process.env`, so an inherited `MM_WALLET_PASSWORD`\n  // would otherwise leak into the child and unlock a daemon the caller meant\n  // to start locked. When no password was supplied, delete the inherited key\n  // so the daemon comes up locked; otherwise overwrite it with the supplied\n  // value.\n  if (config.password === undefined) {\n    delete childEnv.MM_WALLET_PASSWORD;\n  } else {\n    childEnv.MM_WALLET_PASSWORD = config.password.unwrap();\n  }\n\n  const child = spawn(process.execPath, [...args, entryPath], {\n    detached: true,\n    stdio: ['ignore', 'ignore', logFileDescriptor],\n    env: childEnv,\n  });\n  // The child dup'd the file descriptor into its stderr, so drop the parent's\n  // copy. Safe on the success path: `spawn` reports failures via the 'error'\n  // event, not a synchronous throw.\n  closeSync(logFileDescriptor);\n\n  type StartupOutcome =\n    | { kind: 'pending' }\n    | { kind: 'error'; error: Error }\n    | { kind: 'exited'; code: number | null; signal: NodeJS.Signals | null };\n\n  // A failed spawn (bad interpreter, EACCES, ENOENT) emits 'error' and may\n  // never emit 'exit', so 'error' is recorded first and not overwritten by a\n  // later 'exit' — the loop surfaces the real cause instead of hanging.\n  const outcome: { current: StartupOutcome } = { current: { kind: 'pending' } };\n\n  child.on('error', (error: Error) => {\n    process.stderr.write(`Failed to spawn daemon process: ${String(error)}\\n`);\n    outcome.current = { kind: 'error', error };\n  });\n  child.on('exit', (code, signal) => {\n    if (outcome.current.kind === 'pending') {\n      outcome.current = { kind: 'exited', code, signal };\n    }\n  });\n  child.unref();\n\n  for (let i = 0; i < MAX_POLLS; i++) {\n    await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));\n    const settled = outcome.current;\n    if (settled.kind === 'error') {\n      throw new Error(\n        `Failed to spawn daemon process: ${settled.error.message}. ` +\n          `Check the daemon log at ${logPath}.`,\n      );\n    }\n    if (settled.kind === 'exited') {\n      throw new Error(\n        `Daemon process exited during startup (code=${String(settled.code)}, signal=${String(settled.signal)}). ` +\n          `Check the daemon log at ${logPath}.`,\n      );\n    }\n    const ping = await pingDaemon(socketPath);\n    if (ping.status === 'responsive') {\n      process.stderr.write('Daemon ready.\\n');\n      return { state: 'started', socketPath };\n    }\n  }\n\n  throw new Error(\n    `Daemon did not start within ${(MAX_POLLS * POLL_INTERVAL_MS) / 1000}s`,\n  );\n}\n\n/**\n * Resolve the daemon entry point path and any extra Node.js args needed.\n *\n * In production, uses the compiled dist output. In development, uses tsx\n * to run TypeScript source directly.\n *\n * @param packageRoot - The root directory of the wallet-cli package.\n * @returns The entry path and any extra node args.\n */\nfunction resolveEntryPoint(packageRoot: string): {\n  entryPath: string;\n  args: string[];\n} {\n  const distEntry = join(packageRoot, 'dist', 'daemon', 'daemon-entry.mjs');\n  if (existsSync(distEntry)) {\n    return { entryPath: distEntry, args: [] };\n  }\n\n  const srcEntry = join(packageRoot, 'src', 'daemon', 'daemon-entry.ts');\n  return {\n    entryPath: srcEntry,\n    args: ['--import', 'tsx'],\n  };\n}\n"]}

package/dist/daemon/{daemon-spawn.d.ts → daemon-spawn.d.cts}

@@ -1,4 +1,4 @@
-import type { DaemonSpawnConfig } from './types.js';
+import type { DaemonSpawnConfig } from "./types.cjs";
 /**
  * Outcome of {@link ensureDaemon}.
  *
@@ -25,4 +25,4 @@ export type EnsureDaemonResult = {
  * @returns The state of the daemon and the socket path it's listening on.
  */
 export declare function ensureDaemon(config: DaemonSpawnConfig): Promise<EnsureDaemonResult>;
-//# sourceMappingURL=daemon-spawn.d.ts.map
+//# sourceMappingURL=daemon-spawn.d.cts.map

package/dist/daemon/daemon-spawn.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-spawn.d.cts","sourceRoot":"","sources":["../../src/daemon/daemon-spawn.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,iBAAiB,EAAE,oBAAmB;AAKpD;;;;;;;;GAQG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,KAAK,EAAE,iBAAiB,GAAG,SAAS,CAAC;IACrC,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,kBAAkB,CAAC,CAuH7B"}

package/dist/daemon/daemon-spawn.d.mts

@@ -0,0 +1,28 @@
+import type { DaemonSpawnConfig } from "./types.mjs";
+/**
+ * Outcome of {@link ensureDaemon}.
+ *
+ * - `'already-running'`: a responsive daemon was found at the configured
+ *   socket path. The supplied flags (`infuraProjectId`, `password`, `srp`)
+ *   were NOT applied to that daemon; the caller should surface this so a
+ *   user who is trying to change them isn't silently ignored.
+ * - `'started'`: a new daemon was spawned and is now responsive.
+ */
+export type EnsureDaemonResult = {
+    state: 'already-running' | 'started';
+    socketPath: string;
+};
+/**
+ * Ensure the daemon is running. If a responsive daemon already exists, return
+ * `'already-running'` (caller decides how to surface that). Otherwise spawn
+ * one as a detached process and wait until the socket becomes responsive.
+ *
+ * Refuses to spawn when pinging the existing socket fails with anything other
+ * than `ENOENT` (wedged or foreign daemon) — taking over could orphan the
+ * existing process and corrupt its PID file.
+ *
+ * @param config - Spawn configuration.
+ * @returns The state of the daemon and the socket path it's listening on.
+ */
+export declare function ensureDaemon(config: DaemonSpawnConfig): Promise<EnsureDaemonResult>;
+//# sourceMappingURL=daemon-spawn.d.mts.map

package/dist/daemon/daemon-spawn.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-spawn.d.mts","sourceRoot":"","sources":["../../src/daemon/daemon-spawn.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,iBAAiB,EAAE,oBAAmB;AAKpD;;;;;;;;GAQG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,KAAK,EAAE,iBAAiB,GAAG,SAAS,CAAC;IACrC,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,kBAAkB,CAAC,CAuH7B"}

package/dist/daemon/{daemon-spawn.js → daemon-spawn.mjs}

@@ -1,9 +1,9 @@
-import { spawn } from 'node:child_process';
-import { closeSync, existsSync, openSync } from 'node:fs';
-import { join } from 'node:path';
-import { pingDaemon } from './daemon-client.js';
-import { ensureOwnerOnlyDirectory } from './data-dir.js';
-import { getDaemonPaths } from './paths.js';
+import { spawn } from "node:child_process";
+import { closeSync, existsSync, openSync } from "node:fs";
+import { join } from "node:path";
+import { pingDaemon } from "./daemon-client.mjs";
+import { ensureOwnerOnlyDirectory } from "./data-dir.mjs";
+import { getDaemonPaths } from "./paths.mjs";
 const POLL_INTERVAL_MS = 100;
 const MAX_POLLS = 300; // 30 seconds
 /**
@@ -131,4 +131,4 @@ function resolveEntryPoint(packageRoot) {
         args: ['--import', 'tsx'],
     };
 }
-//# sourceMappingURL=daemon-spawn.js.map
+//# sourceMappingURL=daemon-spawn.mjs.map

package/dist/daemon/daemon-spawn.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-spawn.mjs","sourceRoot":"","sources":["../../src/daemon/daemon-spawn.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,2BAA2B;AAC3C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,gBAAgB;AAC1D,OAAO,EAAE,IAAI,EAAE,kBAAkB;AAEjC,OAAO,EAAE,UAAU,EAAE,4BAA2B;AAChD,OAAO,EAAE,wBAAwB,EAAE,uBAAsB;AACzD,OAAO,EAAE,cAAc,EAAE,oBAAmB;AAG5C,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,MAAM,SAAS,GAAG,GAAG,CAAC,CAAC,aAAa;AAgBpC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAyB;IAEzB,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAE/D,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,CAAC;IACjD,QAAQ,WAAW,CAAC,MAAM,EAAE,CAAC;QAC3B,KAAK,YAAY;YACf,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,CAAC;QAClD,KAAK,aAAa;YAChB,IAAI,WAAW,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;gBACxC,MAAM,IAAI,KAAK,CACb,oCAAoC,UAAU,6BAA6B;oBACzE,wFAAwF;oBACxF,IAAI,WAAW,CAAC,KAAK,CAAC,OAAO,GAAG,CACnC,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,KAAK,CACb,wDAAwD,UAAU,wBAAwB;gBACxF,gFAAgF;gBAChF,IAAI,WAAW,CAAC,KAAK,CAAC,OAAO,GAAG,CACnC,CAAC;QACJ,KAAK,QAAQ;YACX,MAAM;QACR,gGAAgG;QAChG,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,eAAe,GAAU,WAAW,CAAC;YAC3C,MAAM,IAAI,KAAK,CACb,kCAAkC,MAAM,CAAC,eAAe,CAAC,EAAE,CAC5D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAE7C,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,iBAAiB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAElE,8EAA8E;IAC9E,2EAA2E;IAC3E,oCAAoC;IACpC,MAAM,wBAAwB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAE/C,oEAAoE;IACpE,0EAA0E;IAC1E,4DAA4D;IAC5D,MAAM,iBAAiB,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAEjD,MAAM,QAAQ,GAAsB;QAClC,GAAG,OAAO,CAAC,GAAG;QACd,kBAAkB,EAAE,MAAM,CAAC,OAAO;QAClC,qBAAqB,EAAE,UAAU;QACjC,iBAAiB,EAAE,MAAM,CAAC,eAAe;QACzC,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE;KACnC,CAAC;IACF,yEAAyE;IACzE,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,SAAS;IACT,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO,QAAQ,CAAC,kBAAkB,CAAC;IACrC,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,kBAAkB,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;IACzD,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,SAAS,CAAC,EAAE;QAC1D,QAAQ,EAAE,IAAI;QACd,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,iBAAiB,CAAC;QAC9C,GAAG,EAAE,QAAQ;KACd,CAAC,CAAC;IACH,4EAA4E;IAC5E,2EAA2E;IAC3E,kCAAkC;IAClC,SAAS,CAAC,iBAAiB,CAAC,CAAC;IAO7B,yEAAyE;IACzE,2EAA2E;IAC3E,sEAAsE;IACtE,MAAM,OAAO,GAAgC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC;IAE9E,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE;QACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3E,OAAO,CAAC,OAAO,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;QAChC,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACvC,OAAO,CAAC,OAAO,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACrD,CAAC;IACH,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,KAAK,EAAE,CAAC;IAEd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CACb,mCAAmC,OAAO,CAAC,KAAK,CAAC,OAAO,IAAI;gBAC1D,2BAA2B,OAAO,GAAG,CACxC,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,8CAA8C,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK;gBACvG,2BAA2B,OAAO,GAAG,CACxC,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;YACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;YACxC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,MAAM,IAAI,KAAK,CACb,+BAA+B,CAAC,SAAS,GAAG,gBAAgB,CAAC,GAAG,IAAI,GAAG,CACxE,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,iBAAiB,CAAC,WAAmB;IAI5C,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IAC1E,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAC5C,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC;IACvE,OAAO;QACL,SAAS,EAAE,QAAQ;QACnB,IAAI,EAAE,CAAC,UAAU,EAAE,KAAK,CAAC;KAC1B,CAAC;AACJ,CAAC","sourcesContent":["import { spawn } from 'node:child_process';\nimport { closeSync, existsSync, openSync } from 'node:fs';\nimport { join } from 'node:path';\n\nimport { pingDaemon } from './daemon-client.js';\nimport { ensureOwnerOnlyDirectory } from './data-dir.js';\nimport { getDaemonPaths } from './paths.js';\nimport type { DaemonSpawnConfig } from './types.js';\n\nconst POLL_INTERVAL_MS = 100;\nconst MAX_POLLS = 300; // 30 seconds\n\n/**\n * Outcome of {@link ensureDaemon}.\n *\n * - `'already-running'`: a responsive daemon was found at the configured\n *   socket path. The supplied flags (`infuraProjectId`, `password`, `srp`)\n *   were NOT applied to that daemon; the caller should surface this so a\n *   user who is trying to change them isn't silently ignored.\n * - `'started'`: a new daemon was spawned and is now responsive.\n */\nexport type EnsureDaemonResult = {\n  state: 'already-running' | 'started';\n  socketPath: string;\n};\n\n/**\n * Ensure the daemon is running. If a responsive daemon already exists, return\n * `'already-running'` (caller decides how to surface that). Otherwise spawn\n * one as a detached process and wait until the socket becomes responsive.\n *\n * Refuses to spawn when pinging the existing socket fails with anything other\n * than `ENOENT` (wedged or foreign daemon) — taking over could orphan the\n * existing process and corrupt its PID file.\n *\n * @param config - Spawn configuration.\n * @returns The state of the daemon and the socket path it's listening on.\n */\nexport async function ensureDaemon(\n  config: DaemonSpawnConfig,\n): Promise<EnsureDaemonResult> {\n  const { socketPath, logPath } = getDaemonPaths(config.dataDir);\n\n  const initialPing = await pingDaemon(socketPath);\n  switch (initialPing.status) {\n    case 'responsive':\n      return { state: 'already-running', socketPath };\n    case 'unreachable':\n      if (initialPing.reason === 'permission') {\n        throw new Error(\n          `Refusing to start: the socket at ${socketPath} is owned by another user. ` +\n            `Choose a different data directory (MM_DAEMON_DATA_DIR) or remove the socket manually. ` +\n            `(${initialPing.error.message})`,\n        );\n      }\n      throw new Error(\n        `Refusing to start: a daemon socket already exists at ${socketPath} but is unresponsive. ` +\n          `Run \\`mm daemon stop\\` (or \\`mm daemon purge\\`) before starting a new daemon. ` +\n          `(${initialPing.error.message})`,\n      );\n    case 'absent':\n      break;\n    /* istanbul ignore next -- exhaustiveness guard; unreachable for the current PingResult union */\n    default: {\n      const exhaustiveCheck: never = initialPing;\n      throw new Error(\n        `Unexpected daemon ping status: ${String(exhaustiveCheck)}`,\n      );\n    }\n  }\n\n  process.stderr.write('Starting daemon...\\n');\n\n  const { entryPath, args } = resolveEntryPoint(config.packageRoot);\n\n  // Create the data directory before opening the log file inside it. The daemon\n  // entry also does this, but only after spawn — opening the log first would\n  // ENOENT on a fresh data directory.\n  await ensureOwnerOnlyDirectory(config.dataDir);\n\n  // Redirect the detached daemon's stderr to its log file rather than\n  // discarding it, so a crash after startup stays diagnosable. stdout stays\n  // ignored — structured status goes through the file logger.\n  const logFileDescriptor = openSync(logPath, 'a');\n\n  const childEnv: NodeJS.ProcessEnv = {\n    ...process.env,\n    MM_DAEMON_DATA_DIR: config.dataDir,\n    MM_DAEMON_SOCKET_PATH: socketPath,\n    INFURA_PROJECT_ID: config.infuraProjectId,\n    MM_WALLET_SRP: config.srp.unwrap(),\n  };\n  // `childEnv` spreads `process.env`, so an inherited `MM_WALLET_PASSWORD`\n  // would otherwise leak into the child and unlock a daemon the caller meant\n  // to start locked. When no password was supplied, delete the inherited key\n  // so the daemon comes up locked; otherwise overwrite it with the supplied\n  // value.\n  if (config.password === undefined) {\n    delete childEnv.MM_WALLET_PASSWORD;\n  } else {\n    childEnv.MM_WALLET_PASSWORD = config.password.unwrap();\n  }\n\n  const child = spawn(process.execPath, [...args, entryPath], {\n    detached: true,\n    stdio: ['ignore', 'ignore', logFileDescriptor],\n    env: childEnv,\n  });\n  // The child dup'd the file descriptor into its stderr, so drop the parent's\n  // copy. Safe on the success path: `spawn` reports failures via the 'error'\n  // event, not a synchronous throw.\n  closeSync(logFileDescriptor);\n\n  type StartupOutcome =\n    | { kind: 'pending' }\n    | { kind: 'error'; error: Error }\n    | { kind: 'exited'; code: number | null; signal: NodeJS.Signals | null };\n\n  // A failed spawn (bad interpreter, EACCES, ENOENT) emits 'error' and may\n  // never emit 'exit', so 'error' is recorded first and not overwritten by a\n  // later 'exit' — the loop surfaces the real cause instead of hanging.\n  const outcome: { current: StartupOutcome } = { current: { kind: 'pending' } };\n\n  child.on('error', (error: Error) => {\n    process.stderr.write(`Failed to spawn daemon process: ${String(error)}\\n`);\n    outcome.current = { kind: 'error', error };\n  });\n  child.on('exit', (code, signal) => {\n    if (outcome.current.kind === 'pending') {\n      outcome.current = { kind: 'exited', code, signal };\n    }\n  });\n  child.unref();\n\n  for (let i = 0; i < MAX_POLLS; i++) {\n    await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));\n    const settled = outcome.current;\n    if (settled.kind === 'error') {\n      throw new Error(\n        `Failed to spawn daemon process: ${settled.error.message}. ` +\n          `Check the daemon log at ${logPath}.`,\n      );\n    }\n    if (settled.kind === 'exited') {\n      throw new Error(\n        `Daemon process exited during startup (code=${String(settled.code)}, signal=${String(settled.signal)}). ` +\n          `Check the daemon log at ${logPath}.`,\n      );\n    }\n    const ping = await pingDaemon(socketPath);\n    if (ping.status === 'responsive') {\n      process.stderr.write('Daemon ready.\\n');\n      return { state: 'started', socketPath };\n    }\n  }\n\n  throw new Error(\n    `Daemon did not start within ${(MAX_POLLS * POLL_INTERVAL_MS) / 1000}s`,\n  );\n}\n\n/**\n * Resolve the daemon entry point path and any extra Node.js args needed.\n *\n * In production, uses the compiled dist output. In development, uses tsx\n * to run TypeScript source directly.\n *\n * @param packageRoot - The root directory of the wallet-cli package.\n * @returns The entry path and any extra node args.\n */\nfunction resolveEntryPoint(packageRoot: string): {\n  entryPath: string;\n  args: string[];\n} {\n  const distEntry = join(packageRoot, 'dist', 'daemon', 'daemon-entry.mjs');\n  if (existsSync(distEntry)) {\n    return { entryPath: distEntry, args: [] };\n  }\n\n  const srcEntry = join(packageRoot, 'src', 'daemon', 'daemon-entry.ts');\n  return {\n    entryPath: srcEntry,\n    args: ['--import', 'tsx'],\n  };\n}\n"]}

package/dist/daemon/data-dir.cjs

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureOwnerOnlyDirectory = void 0;
+const node_fs_1 = require("node:fs");
+const promises_1 = require("node:fs/promises");
+/**
+ * Create the daemon's data directory (if it does not exist) and restrict it to
+ * the owning user.
+ *
+ * The mode is `0o700` (owner-only). The daemon exposes the full wallet
+ * messenger over the socket inside this directory, so anyone who can traverse
+ * the dir can also `connect()` to the socket. Restricting to the owning user is
+ * the only access-control boundary. We `chmod` after `mkdir` because the `mode`
+ * option is ignored when the directory already exists.
+ *
+ * @param dataDir - The data directory to create and lock down.
+ */
+async function ensureOwnerOnlyDirectory(dataDir) {
+    (0, node_fs_1.mkdirSync)(dataDir, { recursive: true, mode: 0o700 });
+    await (0, promises_1.chmod)(dataDir, 0o700);
+}
+exports.ensureOwnerOnlyDirectory = ensureOwnerOnlyDirectory;
+//# sourceMappingURL=data-dir.cjs.map

package/dist/daemon/data-dir.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-dir.cjs","sourceRoot":"","sources":["../../src/daemon/data-dir.ts"],"names":[],"mappings":";;;AAAA,qCAAoC;AACpC,+CAAyC;AAEzC;;;;;;;;;;;GAWG;AACI,KAAK,UAAU,wBAAwB,CAAC,OAAe;IAC5D,IAAA,mBAAS,EAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,MAAM,IAAA,gBAAK,EAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AAC9B,CAAC;AAHD,4DAGC","sourcesContent":["import { mkdirSync } from 'node:fs';\nimport { chmod } from 'node:fs/promises';\n\n/**\n * Create the daemon's data directory (if it does not exist) and restrict it to\n * the owning user.\n *\n * The mode is `0o700` (owner-only). The daemon exposes the full wallet\n * messenger over the socket inside this directory, so anyone who can traverse\n * the dir can also `connect()` to the socket. Restricting to the owning user is\n * the only access-control boundary. We `chmod` after `mkdir` because the `mode`\n * option is ignored when the directory already exists.\n *\n * @param dataDir - The data directory to create and lock down.\n */\nexport async function ensureOwnerOnlyDirectory(dataDir: string): Promise<void> {\n  mkdirSync(dataDir, { recursive: true, mode: 0o700 });\n  await chmod(dataDir, 0o700);\n}\n"]}

package/dist/daemon/{data-dir.d.ts → data-dir.d.cts}

@@ -11,4 +11,4 @@
  * @param dataDir - The data directory to create and lock down.
  */
 export declare function ensureOwnerOnlyDirectory(dataDir: string): Promise<void>;
-//# sourceMappingURL=data-dir.d.ts.map
+//# sourceMappingURL=data-dir.d.cts.map

package/dist/daemon/data-dir.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-dir.d.cts","sourceRoot":"","sources":["../../src/daemon/data-dir.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;GAWG;AACH,wBAAsB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAG7E"}

package/dist/daemon/data-dir.d.mts

@@ -0,0 +1,14 @@
+/**
+ * Create the daemon's data directory (if it does not exist) and restrict it to
+ * the owning user.
+ *
+ * The mode is `0o700` (owner-only). The daemon exposes the full wallet
+ * messenger over the socket inside this directory, so anyone who can traverse
+ * the dir can also `connect()` to the socket. Restricting to the owning user is
+ * the only access-control boundary. We `chmod` after `mkdir` because the `mode`
+ * option is ignored when the directory already exists.
+ *
+ * @param dataDir - The data directory to create and lock down.
+ */
+export declare function ensureOwnerOnlyDirectory(dataDir: string): Promise<void>;
+//# sourceMappingURL=data-dir.d.mts.map

package/dist/daemon/data-dir.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-dir.d.mts","sourceRoot":"","sources":["../../src/daemon/data-dir.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;GAWG;AACH,wBAAsB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAG7E"}

package/dist/daemon/{data-dir.js → data-dir.mjs}

@@ -1,5 +1,5 @@
-import { mkdirSync } from 'node:fs';
-import { chmod } from 'node:fs/promises';
+import { mkdirSync } from "node:fs";
+import { chmod } from "node:fs/promises";
 /**
  * Create the daemon's data directory (if it does not exist) and restrict it to
  * the owning user.
@@ -16,4 +16,4 @@ export async function ensureOwnerOnlyDirectory(dataDir) {
     mkdirSync(dataDir, { recursive: true, mode: 0o700 });
     await chmod(dataDir, 0o700);
 }
-//# sourceMappingURL=data-dir.js.map
+//# sourceMappingURL=data-dir.mjs.map

package/dist/daemon/data-dir.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-dir.mjs","sourceRoot":"","sources":["../../src/daemon/data-dir.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,gBAAgB;AACpC,OAAO,EAAE,KAAK,EAAE,yBAAyB;AAEzC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,OAAe;IAC5D,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,MAAM,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AAC9B,CAAC","sourcesContent":["import { mkdirSync } from 'node:fs';\nimport { chmod } from 'node:fs/promises';\n\n/**\n * Create the daemon's data directory (if it does not exist) and restrict it to\n * the owning user.\n *\n * The mode is `0o700` (owner-only). The daemon exposes the full wallet\n * messenger over the socket inside this directory, so anyone who can traverse\n * the dir can also `connect()` to the socket. Restricting to the owning user is\n * the only access-control boundary. We `chmod` after `mkdir` because the `mode`\n * option is ignored when the directory already exists.\n *\n * @param dataDir - The data directory to create and lock down.\n */\nexport async function ensureOwnerOnlyDirectory(dataDir: string): Promise<void> {\n  mkdirSync(dataDir, { recursive: true, mode: 0o700 });\n  await chmod(dataDir, 0o700);\n}\n"]}

package/dist/daemon/paths.cjs

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getDaemonPaths = void 0;
+const node_path_1 = require("node:path");
+/**
+ * Resolve paths for daemon state files within the given data directory.
+ *
+ * @param dataDir - The base data directory (e.g. oclif config.dataDir).
+ * @returns Resolved paths for socket, PID file, log file, and database file.
+ */
+function getDaemonPaths(dataDir) {
+    return {
+        socketPath: (0, node_path_1.join)(dataDir, 'daemon.sock'),
+        pidPath: (0, node_path_1.join)(dataDir, 'daemon.pid'),
+        logPath: (0, node_path_1.join)(dataDir, 'daemon.log'),
+        dbPath: (0, node_path_1.join)(dataDir, 'wallet.db'),
+    };
+}
+exports.getDaemonPaths = getDaemonPaths;
+//# sourceMappingURL=paths.cjs.map

package/dist/daemon/paths.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.cjs","sourceRoot":"","sources":["../../src/daemon/paths.ts"],"names":[],"mappings":";;;AAAA,yCAAiC;AAIjC;;;;;GAKG;AACH,SAAgB,cAAc,CAAC,OAAe;IAC5C,OAAO;QACL,UAAU,EAAE,IAAA,gBAAI,EAAC,OAAO,EAAE,aAAa,CAAC;QACxC,OAAO,EAAE,IAAA,gBAAI,EAAC,OAAO,EAAE,YAAY,CAAC;QACpC,OAAO,EAAE,IAAA,gBAAI,EAAC,OAAO,EAAE,YAAY,CAAC;QACpC,MAAM,EAAE,IAAA,gBAAI,EAAC,OAAO,EAAE,WAAW,CAAC;KACnC,CAAC;AACJ,CAAC;AAPD,wCAOC","sourcesContent":["import { join } from 'node:path';\n\nimport type { DaemonPaths } from './types.js';\n\n/**\n * Resolve paths for daemon state files within the given data directory.\n *\n * @param dataDir - The base data directory (e.g. oclif config.dataDir).\n * @returns Resolved paths for socket, PID file, log file, and database file.\n */\nexport function getDaemonPaths(dataDir: string): DaemonPaths {\n  return {\n    socketPath: join(dataDir, 'daemon.sock'),\n    pidPath: join(dataDir, 'daemon.pid'),\n    logPath: join(dataDir, 'daemon.log'),\n    dbPath: join(dataDir, 'wallet.db'),\n  };\n}\n"]}

package/dist/daemon/{paths.d.ts → paths.d.cts}

@@ -1,4 +1,4 @@
-import type { DaemonPaths } from './types.js';
+import type { DaemonPaths } from "./types.cjs";
 /**
  * Resolve paths for daemon state files within the given data directory.
  *
@@ -6,4 +6,4 @@ import type { DaemonPaths } from './types.js';
  * @returns Resolved paths for socket, PID file, log file, and database file.
  */
 export declare function getDaemonPaths(dataDir: string): DaemonPaths;
-//# sourceMappingURL=paths.d.ts.map
+//# sourceMappingURL=paths.d.cts.map

package/dist/daemon/paths.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.cts","sourceRoot":"","sources":["../../src/daemon/paths.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,oBAAmB;AAE9C;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW,CAO3D"}

package/dist/daemon/paths.d.mts

@@ -0,0 +1,9 @@
+import type { DaemonPaths } from "./types.mjs";
+/**
+ * Resolve paths for daemon state files within the given data directory.
+ *
+ * @param dataDir - The base data directory (e.g. oclif config.dataDir).
+ * @returns Resolved paths for socket, PID file, log file, and database file.
+ */
+export declare function getDaemonPaths(dataDir: string): DaemonPaths;
+//# sourceMappingURL=paths.d.mts.map

package/dist/daemon/paths.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.mts","sourceRoot":"","sources":["../../src/daemon/paths.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,oBAAmB;AAE9C;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW,CAO3D"}

package/dist/daemon/{paths.js → paths.mjs}

@@ -1,4 +1,4 @@
-import { join } from 'node:path';
+import { join } from "node:path";
 /**
  * Resolve paths for daemon state files within the given data directory.
  *
@@ -13,4 +13,4 @@ export function getDaemonPaths(dataDir) {
         dbPath: join(dataDir, 'wallet.db'),
     };
 }
-//# sourceMappingURL=paths.js.map
+//# sourceMappingURL=paths.mjs.map

package/dist/daemon/paths.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.mjs","sourceRoot":"","sources":["../../src/daemon/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,kBAAkB;AAIjC;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,OAAO;QACL,UAAU,EAAE,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC;QACxC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC;QACpC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC;QACpC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC;KACnC,CAAC;AACJ,CAAC","sourcesContent":["import { join } from 'node:path';\n\nimport type { DaemonPaths } from './types.js';\n\n/**\n * Resolve paths for daemon state files within the given data directory.\n *\n * @param dataDir - The base data directory (e.g. oclif config.dataDir).\n * @returns Resolved paths for socket, PID file, log file, and database file.\n */\nexport function getDaemonPaths(dataDir: string): DaemonPaths {\n  return {\n    socketPath: join(dataDir, 'daemon.sock'),\n    pidPath: join(dataDir, 'daemon.pid'),\n    logPath: join(dataDir, 'daemon.log'),\n    dbPath: join(dataDir, 'wallet.db'),\n  };\n}\n"]}

package/dist/daemon/prompts.cjs

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.promptPassword = exports.confirmSend = exports.confirmPurge = void 0;
+/**
+ * Ask the user to confirm the destructive `daemon purge` operation.
+ *
+ * Wraps `@inquirer/confirm` in a dynamic import so this CommonJS-compiled
+ * package can interop with that ESM-only dependency, and so tests can mock
+ * the prompt without going through jest's ESM mock machinery.
+ *
+ * @returns True if the user confirmed.
+ */
+async function confirmPurge() {
+    const { default: confirm } = await import("@inquirer/confirm");
+    return confirm({
+        message: 'This will stop the daemon and delete all state. Continue?',
+        default: false,
+    });
+}
+exports.confirmPurge = confirmPurge;
+/**
+ * Ask the user to confirm broadcasting a transaction. Used by `mm wallet send`
+ * when neither `--yes` nor `--dry-run` was passed. Same dynamic-import +
+ * ESM-interop pattern as {@link confirmPurge}. Defaults to `false` so an
+ * accidental bare Enter never broadcasts.
+ *
+ * @param summary - A human-readable description of the transaction to send
+ * (recipient, amount, network), shown above the prompt.
+ * @returns True if the user confirmed.
+ */
+async function confirmSend(summary) {
+    const { default: confirm } = await import("@inquirer/confirm");
+    return confirm({
+        message: `${summary}\nBroadcast this transaction?`,
+        default: false,
+    });
+}
+exports.confirmSend = confirmSend;
+/**
+ * Prompt the user for the wallet password, with input masked. Used by
+ * `mm wallet unlock` when the user did not pass `--password` or set the
+ * `MM_WALLET_PASSWORD` env var. Same dynamic-import + ESM-interop pattern
+ * as {@link confirmPurge}.
+ *
+ * @returns The password the user typed.
+ */
+async function promptPassword() {
+    const { default: password } = await import("@inquirer/password");
+    return password({
+        message: 'Wallet password:',
+        mask: true,
+    });
+}
+exports.promptPassword = promptPassword;
+//# sourceMappingURL=prompts.cjs.map

package/dist/daemon/prompts.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompts.cjs","sourceRoot":"","sources":["../../src/daemon/prompts.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;GAQG;AACI,KAAK,UAAU,YAAY;IAChC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,qBAAqB,CAAC;IAC/D,OAAO,OAAO,CAAC;QACb,OAAO,EAAE,2DAA2D;QACpE,OAAO,EAAE,KAAK;KACf,CAAC,CAAC;AACL,CAAC;AAND,oCAMC;AAED;;;;;;;;;GASG;AACI,KAAK,UAAU,WAAW,CAAC,OAAe;IAC/C,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,qBAAqB,CAAC;IAC/D,OAAO,OAAO,CAAC;QACb,OAAO,EAAE,GAAG,OAAO,+BAA+B;QAClD,OAAO,EAAE,KAAK;KACf,CAAC,CAAC;AACL,CAAC;AAND,kCAMC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,cAAc;IAClC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,sBAAsB,CAAC;IACjE,OAAO,QAAQ,CAAC;QACd,OAAO,EAAE,kBAAkB;QAC3B,IAAI,EAAE,IAAI;KACX,CAAC,CAAC;AACL,CAAC;AAND,wCAMC","sourcesContent":["/**\n * Ask the user to confirm the destructive `daemon purge` operation.\n *\n * Wraps `@inquirer/confirm` in a dynamic import so this CommonJS-compiled\n * package can interop with that ESM-only dependency, and so tests can mock\n * the prompt without going through jest's ESM mock machinery.\n *\n * @returns True if the user confirmed.\n */\nexport async function confirmPurge(): Promise<boolean> {\n  const { default: confirm } = await import('@inquirer/confirm');\n  return confirm({\n    message: 'This will stop the daemon and delete all state. Continue?',\n    default: false,\n  });\n}\n\n/**\n * Ask the user to confirm broadcasting a transaction. Used by `mm wallet send`\n * when neither `--yes` nor `--dry-run` was passed. Same dynamic-import +\n * ESM-interop pattern as {@link confirmPurge}. Defaults to `false` so an\n * accidental bare Enter never broadcasts.\n *\n * @param summary - A human-readable description of the transaction to send\n * (recipient, amount, network), shown above the prompt.\n * @returns True if the user confirmed.\n */\nexport async function confirmSend(summary: string): Promise<boolean> {\n  const { default: confirm } = await import('@inquirer/confirm');\n  return confirm({\n    message: `${summary}\\nBroadcast this transaction?`,\n    default: false,\n  });\n}\n\n/**\n * Prompt the user for the wallet password, with input masked. Used by\n * `mm wallet unlock` when the user did not pass `--password` or set the\n * `MM_WALLET_PASSWORD` env var. Same dynamic-import + ESM-interop pattern\n * as {@link confirmPurge}.\n *\n * @returns The password the user typed.\n */\nexport async function promptPassword(): Promise<string> {\n  const { default: password } = await import('@inquirer/password');\n  return password({\n    message: 'Wallet password:',\n    mask: true,\n  });\n}\n"]}

package/dist/daemon/{prompts.d.ts → prompts.d.cts}

@@ -28,4 +28,4 @@ export declare function confirmSend(summary: string): Promise<boolean>;
  * @returns The password the user typed.
  */
 export declare function promptPassword(): Promise<string>;
-//# sourceMappingURL=prompts.d.ts.map
+//# sourceMappingURL=prompts.d.cts.map

package/dist/daemon/prompts.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompts.d.cts","sourceRoot":"","sources":["../../src/daemon/prompts.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC,CAMrD;AAED;;;;;;;;;GASG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAMnE;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,CAMtD"}

package/dist/daemon/prompts.d.mts

@@ -0,0 +1,31 @@
+/**
+ * Ask the user to confirm the destructive `daemon purge` operation.
+ *
+ * Wraps `@inquirer/confirm` in a dynamic import so this CommonJS-compiled
+ * package can interop with that ESM-only dependency, and so tests can mock
+ * the prompt without going through jest's ESM mock machinery.
+ *
+ * @returns True if the user confirmed.
+ */
+export declare function confirmPurge(): Promise<boolean>;
+/**
+ * Ask the user to confirm broadcasting a transaction. Used by `mm wallet send`
+ * when neither `--yes` nor `--dry-run` was passed. Same dynamic-import +
+ * ESM-interop pattern as {@link confirmPurge}. Defaults to `false` so an
+ * accidental bare Enter never broadcasts.
+ *
+ * @param summary - A human-readable description of the transaction to send
+ * (recipient, amount, network), shown above the prompt.
+ * @returns True if the user confirmed.
+ */
+export declare function confirmSend(summary: string): Promise<boolean>;
+/**
+ * Prompt the user for the wallet password, with input masked. Used by
+ * `mm wallet unlock` when the user did not pass `--password` or set the
+ * `MM_WALLET_PASSWORD` env var. Same dynamic-import + ESM-interop pattern
+ * as {@link confirmPurge}.
+ *
+ * @returns The password the user typed.
+ */
+export declare function promptPassword(): Promise<string>;
+//# sourceMappingURL=prompts.d.mts.map

package/dist/daemon/prompts.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompts.d.mts","sourceRoot":"","sources":["../../src/daemon/prompts.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC,CAMrD;AAED;;;;;;;;;GASG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAMnE;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,CAMtD"}

package/dist/daemon/{prompts.js → prompts.mjs}

@@ -8,7 +8,7 @@
  * @returns True if the user confirmed.
  */
 export async function confirmPurge() {
-    const { default: confirm } = await import('@inquirer/confirm');
+    const { default: confirm } = await import("@inquirer/confirm");
     return confirm({
         message: 'This will stop the daemon and delete all state. Continue?',
         default: false,
@@ -25,7 +25,7 @@ export async function confirmPurge() {
  * @returns True if the user confirmed.
  */
 export async function confirmSend(summary) {
-    const { default: confirm } = await import('@inquirer/confirm');
+    const { default: confirm } = await import("@inquirer/confirm");
     return confirm({
         message: `${summary}\nBroadcast this transaction?`,
         default: false,
@@ -40,10 +40,10 @@ export async function confirmSend(summary) {
  * @returns The password the user typed.
  */
 export async function promptPassword() {
-    const { default: password } = await import('@inquirer/password');
+    const { default: password } = await import("@inquirer/password");
     return password({
         message: 'Wallet password:',
         mask: true,
     });
 }
-//# sourceMappingURL=prompts.js.map
+//# sourceMappingURL=prompts.mjs.map

package/dist/daemon/prompts.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompts.mjs","sourceRoot":"","sources":["../../src/daemon/prompts.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,qBAAqB,CAAC;IAC/D,OAAO,OAAO,CAAC;QACb,OAAO,EAAE,2DAA2D;QACpE,OAAO,EAAE,KAAK;KACf,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAe;IAC/C,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,qBAAqB,CAAC;IAC/D,OAAO,OAAO,CAAC;QACb,OAAO,EAAE,GAAG,OAAO,+BAA+B;QAClD,OAAO,EAAE,KAAK;KACf,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,sBAAsB,CAAC;IACjE,OAAO,QAAQ,CAAC;QACd,OAAO,EAAE,kBAAkB;QAC3B,IAAI,EAAE,IAAI;KACX,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Ask the user to confirm the destructive `daemon purge` operation.\n *\n * Wraps `@inquirer/confirm` in a dynamic import so this CommonJS-compiled\n * package can interop with that ESM-only dependency, and so tests can mock\n * the prompt without going through jest's ESM mock machinery.\n *\n * @returns True if the user confirmed.\n */\nexport async function confirmPurge(): Promise<boolean> {\n  const { default: confirm } = await import('@inquirer/confirm');\n  return confirm({\n    message: 'This will stop the daemon and delete all state. Continue?',\n    default: false,\n  });\n}\n\n/**\n * Ask the user to confirm broadcasting a transaction. Used by `mm wallet send`\n * when neither `--yes` nor `--dry-run` was passed. Same dynamic-import +\n * ESM-interop pattern as {@link confirmPurge}. Defaults to `false` so an\n * accidental bare Enter never broadcasts.\n *\n * @param summary - A human-readable description of the transaction to send\n * (recipient, amount, network), shown above the prompt.\n * @returns True if the user confirmed.\n */\nexport async function confirmSend(summary: string): Promise<boolean> {\n  const { default: confirm } = await import('@inquirer/confirm');\n  return confirm({\n    message: `${summary}\\nBroadcast this transaction?`,\n    default: false,\n  });\n}\n\n/**\n * Prompt the user for the wallet password, with input masked. Used by\n * `mm wallet unlock` when the user did not pass `--password` or set the\n * `MM_WALLET_PASSWORD` env var. Same dynamic-import + ESM-interop pattern\n * as {@link confirmPurge}.\n *\n * @returns The password the user typed.\n */\nexport async function promptPassword(): Promise<string> {\n  const { default: password } = await import('@inquirer/password');\n  return password({\n    message: 'Wallet password:',\n    mask: true,\n  });\n}\n"]}