@seedhape/local-wallet 0.2.0

package/dist/hosted.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted.js","sourceRoot":"","sources":["../src/hosted.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,MAAM,aAAa,GAAG,wBAAwB,CAAC;AAE/C,MAAM,CAAC,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,0BAA0B,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAE7G,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,KAAc;QACxB,KAAK,CAAC,kCAAkC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAC5J,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C;QACE,KAAK,CAAC,oGAAoG,CAAC,CAAC;QAC5G,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAa,EAAE,GAAG,GAAG,WAAW,EAAE,IAAmB,MAAM,MAAM,CAAC,WAAW,CAAC,aAAa,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AAC3I,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAG,GAAG,WAAW,EAAE,IAA4B,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,MAAM,MAAM,CAAC,WAAW,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AACnK,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAG,GAAG,WAAW,EAAE,IAAsB,OAAO,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AAE9H,6GAA6G;AAC7G,MAAM,CAAC,KAAK,UAAU,UAAU,CAAI,IAAY,EAAE,IAAa;IAC7D,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;IAChC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,iBAAiB,EAAE,CAAC;IAC1C,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,WAAW,EAAE,GAAG,IAAI,EAAE,EAAE;YAChD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;YACjF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,iBAAiB,EAAE,CAAC;IAC3D,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG;QAAE,MAAM,IAAI,wBAAwB,CAAC,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1F,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,IAAI,EAAO,EAAE,CAAC;AACvE,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,MAAM;IAC1B,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;IAChC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,WAAW,EAAE,MAAM,EAAE;YACnD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,qCAAqC,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;YAChI,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,CAAC;YACzH,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2DAA2D,EAAE,CAAC;QACvH,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;IAC5F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,wBAAwB,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;IAC5E,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;IAC3G,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7E,IAAI,CAAC;QAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,sCAAsC,CAAC,CAAC;AAC7H,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAA2B;IAChE,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC5E,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAEpD,IAAI,WAAW,GAA2B,GAAG,EAAE,GAAE,CAAC,CAAC;IACnD,IAAI,UAAU,GAA2B,GAAG,EAAE,GAAE,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,WAAW,GAAG,OAAO,CAAC,CAAC,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9G,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QAChD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAC5D,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;YAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YAAC,OAAO;QAAC,CAAC;QAC5E,MAAM,IAAI,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,qLAAqL,OAAO,aAAa,CAAC,CAAC;QAC1S,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,EAAE,CAAC;YAAC,IAAI,CAAC,8EAA8E,CAAC,CAAC;YAAC,UAAU,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC9L,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;YAAC,UAAU,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,wBAAwB,CAAC,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAChK,IAAI,CAAC,oEAAoE,CAAC,CAAC;QAC3E,WAAW,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7E,MAAM,WAAW,GAAG,oBAAqB,MAAM,CAAC,OAAO,EAAkB,CAAC,IAAI,WAAW,CAAC;IAC1F,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,iBAAiB,EAAE;YACzD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/D,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,uBAAuB,EAAE,CAAC;SAC7F,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,GAAG,MAAM,IAAI,wBAAwB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,EAA4C,CAAC;QACnF,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,8CAA8C,CAAC,CAAC;QAE3H,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,kBAAkB,CAAC,CAAC;QACrD,SAAS,CAAC,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QACpN,GAAG,CAAC,uCAAuC,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACnE,WAAW,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;QAElC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC;QAC1G,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;QACpE,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,cAAc,EAAE;YAC/C,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,oBAAoB,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC;SACvJ,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,EAA+C,CAAC;QAC/E,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,iCAAiC,CAAC,CAAC;QAC1G,MAAM,SAAS,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC;AACH,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAyL;IAC9N,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,UAAU,CAAsC,6BAA6B,EAAE;QACpG,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW;QACvE,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1H,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClL,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAiG;IACnI,MAAM,UAAU,CAAC,0BAA0B,EAAE;QAC3C,gBAAgB,EAAE,KAAK,CAAC,eAAe,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM;QAC7D,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClH,CAAC,CAAC;AACL,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,IAA6B;IAC9E,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;IAChC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,iBAAiB,EAAE,CAAC;IAC1C,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,WAAW,EAAE,MAAM,EAAE;YAC7C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,qCAAqC,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;YAChI,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC;YACrI,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,iBAAiB,EAAE,CAAC;IAC3D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAuF,CAAC;IACxH,IAAI,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,iBAAiB,IAAI,UAAU,CAAC,CAAC;IACvF,OAAO,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;AAC/E,CAAC"}

package/dist/identity-backup.d.ts

@@ -0,0 +1,12 @@
+import type { Hex } from "@seedhape/core";
+export interface LocalIdentityBackupPayload {
+    version: 1;
+    accountId: string;
+    controllerPrivateKey: Hex;
+    keyStoreMasterKey: string;
+    files: Record<string, string>;
+}
+export declare function encryptIdentityBackup(payload: LocalIdentityBackupPayload, passphrase: string): string;
+export declare function decryptIdentityBackup(encoded: string, passphrase: string): LocalIdentityBackupPayload;
+export declare function validatePayload(payload: LocalIdentityBackupPayload): void;
+//# sourceMappingURL=identity-backup.d.ts.map

package/dist/identity-backup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-backup.d.ts","sourceRoot":"","sources":["../src/identity-backup.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AAO1C,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,CAAC,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,oBAAoB,EAAE,GAAG,CAAC;IAC1B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAaD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,0BAA0B,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAsBrG;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,0BAA0B,CA0BrG;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,0BAA0B,GAAG,IAAI,CAwCzE"}

package/dist/identity-backup.js

@@ -0,0 +1,130 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes, scryptSync } from "node:crypto";
+import { privateKeyToAccount } from "viem/accounts";
+const FORMAT = "seedhape-agent-identity-backup";
+const AAD = Buffer.from(`${FORMAT}:v1`);
+const MAX_BACKUP_BYTES = 10 * 1024 * 1024;
+const FILE_PATH = /^(state\/[a-f0-9]{64}\.state\.json|keys\/[a-f0-9]{64}\.json|metadata\/[a-f0-9]{64}\.(directory|registration)\.json)$/;
+export function encryptIdentityBackup(payload, passphrase) {
+    validatePassphrase(passphrase);
+    validatePayload(payload);
+    const salt = randomBytes(16);
+    const iv = randomBytes(12);
+    const key = scryptSync(passphrase, salt, 32, { N: 32_768, r: 8, p: 1, maxmem: 64 * 1024 * 1024 });
+    const cipher = createCipheriv("aes-256-gcm", key, iv);
+    cipher.setAAD(AAD);
+    const ciphertext = Buffer.concat([cipher.update(JSON.stringify(payload), "utf8"), cipher.final()]);
+    const result = {
+        format: FORMAT,
+        version: 1,
+        kdf: "scrypt-N32768-r8-p1",
+        cipher: "aes-256-gcm",
+        salt: salt.toString("base64url"),
+        iv: iv.toString("base64url"),
+        ciphertext: ciphertext.toString("base64url"),
+        tag: cipher.getAuthTag().toString("base64url"),
+    };
+    const encoded = JSON.stringify(result);
+    if (Buffer.byteLength(encoded) > MAX_BACKUP_BYTES)
+        throw new Error("Identity backup exceeds the 10 MB limit.");
+    return encoded;
+}
+export function decryptIdentityBackup(encoded, passphrase) {
+    validatePassphrase(passphrase);
+    if (Buffer.byteLength(encoded) > MAX_BACKUP_BYTES)
+        throw new Error("Identity backup exceeds the 10 MB limit.");
+    let backup;
+    try {
+        backup = JSON.parse(encoded);
+    }
+    catch {
+        throw new Error("Identity backup is not valid JSON.");
+    }
+    if (backup.format !== FORMAT || backup.version !== 1 || backup.kdf !== "scrypt-N32768-r8-p1" || backup.cipher !== "aes-256-gcm") {
+        throw new Error("Unsupported identity backup format.");
+    }
+    const salt = decodeBase64Url(backup.salt, 16, "salt");
+    const iv = decodeBase64Url(backup.iv, 12, "IV");
+    const tag = decodeBase64Url(backup.tag, 16, "authentication tag");
+    const ciphertext = decodeBase64Url(backup.ciphertext, undefined, "ciphertext");
+    const key = scryptSync(passphrase, salt, 32, { N: 32_768, r: 8, p: 1, maxmem: 64 * 1024 * 1024 });
+    try {
+        const decipher = createDecipheriv("aes-256-gcm", key, iv);
+        decipher.setAAD(AAD);
+        decipher.setAuthTag(tag);
+        const json = Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
+        const payload = JSON.parse(json);
+        validatePayload(payload);
+        return payload;
+    }
+    catch (error) {
+        if (error instanceof Error && error.message.startsWith("Invalid identity backup"))
+            throw error;
+        throw new Error("Could not decrypt identity backup. Check the passphrase and file integrity.");
+    }
+}
+export function validatePayload(payload) {
+    if (!payload || payload.version !== 1 || typeof payload.accountId !== "string" || payload.accountId.length < 1 || payload.accountId.length > 256) {
+        throw new Error("Invalid identity backup: account metadata is missing.");
+    }
+    if (!/^0x[0-9a-fA-F]{64}$/.test(payload.controllerPrivateKey))
+        throw new Error("Invalid identity backup: controller key is malformed.");
+    if (privateKeyToAccount(payload.controllerPrivateKey).address === "0x0000000000000000000000000000000000000000")
+        throw new Error("Invalid identity backup: controller key is invalid.");
+    const masterKey = decodeBase64Url(payload.keyStoreMasterKey, 32, "key-store key");
+    if (masterKey.length !== 32)
+        throw new Error("Invalid identity backup: key-store key must be 32 bytes.");
+    if (!payload.files || typeof payload.files !== "object" || Array.isArray(payload.files))
+        throw new Error("Invalid identity backup: file manifest is missing.");
+    const names = Object.keys(payload.files);
+    if (names.length > 256 || names.some((name) => !FILE_PATH.test(name)))
+        throw new Error("Invalid identity backup: file manifest contains an invalid path.");
+    if (names.length < 4)
+        throw new Error("Invalid identity backup: file manifest is incomplete.");
+    let total = 0;
+    for (const [name, contents] of Object.entries(payload.files)) {
+        if (typeof contents !== "string")
+            throw new Error("Invalid identity backup: file contents are malformed.");
+        const bytes = decodeBase64Url(contents, undefined, `file ${name}`);
+        total += bytes.length;
+        if (total > MAX_BACKUP_BYTES)
+            throw new Error("Invalid identity backup: files exceed the size limit.");
+    }
+    const statePaths = names.filter((name) => name.startsWith("state/"));
+    const keyPaths = names.filter((name) => name.startsWith("keys/"));
+    const metadataPaths = names.filter((name) => name.startsWith("metadata/"));
+    if (statePaths.length !== 1 || !keyPaths.length || !metadataPaths.some((path) => path.endsWith(".directory.json")) || !metadataPaths.some((path) => path.endsWith(".registration.json"))) {
+        throw new Error("Invalid identity backup: setup state, signing key, and public metadata are all required.");
+    }
+    try {
+        const stateText = Buffer.from(payload.files[statePaths[0]], "base64url").toString("utf8");
+        const state = JSON.parse(stateText);
+        const controller = privateKeyToAccount(payload.controllerPrivateKey).address;
+        if (typeof state.controller !== "string" || state.controller.toLowerCase() !== controller.toLowerCase() || state.stage !== "ready" || typeof state.keyStoreRef !== "string" || !/^[a-f0-9]{64}$/.test(state.keyStoreRef) || typeof state.identityRef !== "string" || typeof state.keyId !== "string") {
+            throw new Error();
+        }
+        if (!payload.files[`keys/${state.keyStoreRef}.json`])
+            throw new Error();
+        const identityHash = createHash("sha256").update(state.identityRef).digest("hex");
+        const directory = JSON.parse(Buffer.from(payload.files[`metadata/${identityHash}.directory.json`] ?? "", "base64url").toString("utf8"));
+        const registration = JSON.parse(Buffer.from(payload.files[`metadata/${identityHash}.registration.json`] ?? "", "base64url").toString("utf8"));
+        if (directory.identityRef !== state.identityRef || directory.keyId !== state.keyId || !registration.services?.some((service) => service.name === "Web Bot Auth" && service.keyId === state.keyId))
+            throw new Error();
+    }
+    catch {
+        throw new Error("Invalid identity backup: controller does not match the saved setup state.");
+    }
+}
+function validatePassphrase(passphrase) {
+    if (typeof passphrase !== "string" || passphrase.length < 12 || Buffer.byteLength(passphrase) > 1024) {
+        throw new Error("Backup passphrase must be at least 12 characters and no more than 1 KB.");
+    }
+}
+function decodeBase64Url(value, expectedLength, label) {
+    if (typeof value !== "string" || !/^[A-Za-z0-9_-]*$/.test(value))
+        throw new Error(`Invalid identity backup: ${label} encoding is malformed.`);
+    const decoded = Buffer.from(value, "base64url");
+    if (expectedLength !== undefined && decoded.length !== expectedLength)
+        throw new Error(`Invalid identity backup: ${label} must be ${expectedLength} bytes.`);
+    return decoded;
+}
+//# sourceMappingURL=identity-backup.js.map

package/dist/identity-backup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-backup.js","sourceRoot":"","sources":["../src/identity-backup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACpG,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAGpD,MAAM,MAAM,GAAG,gCAAgC,CAAC;AAChD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,KAAK,CAAC,CAAC;AACxC,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAC1C,MAAM,SAAS,GAAG,sHAAsH,CAAC;AAqBzI,MAAM,UAAU,qBAAqB,CAAC,OAAmC,EAAE,UAAkB;IAC3F,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAC/B,eAAe,CAAC,OAAO,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,GAAG,GAAG,UAAU,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;IAClG,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnB,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACnG,MAAM,MAAM,GAAoB;QAC9B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,CAAC;QACV,GAAG,EAAE,qBAAqB;QAC1B,MAAM,EAAE,aAAa;QACrB,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;QAChC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC5B,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC5C,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;KAC/C,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,gBAAgB;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC/G,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAe,EAAE,UAAkB;IACvE,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,gBAAgB;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC/G,IAAI,MAAuB,CAAC;IAC5B,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAoB,CAAC;IAAC,CAAC;IACxD,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAAC,CAAC;IAChE,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,IAAI,MAAM,CAAC,GAAG,KAAK,qBAAqB,IAAI,MAAM,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;QAChI,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IACtD,MAAM,EAAE,GAAG,eAAe,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,CAAC;IAClE,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IAC/E,MAAM,GAAG,GAAG,UAAU,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;IAClG,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1D,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC7F,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA+B,CAAC;QAC/D,eAAe,CAAC,OAAO,CAAC,CAAC;QACzB,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC;YAAE,MAAM,KAAK,CAAC;QAC/F,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IACjG,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAmC;IACjE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,CAAC,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACjJ,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IACxI,IAAI,mBAAmB,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,KAAK,4CAA4C;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACvL,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,EAAE,eAAe,CAAC,CAAC;IAClF,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IACzG,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IAC/J,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IAC3J,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC/F,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7D,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3G,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;QACnE,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;QACtB,IAAI,KAAK,GAAG,gBAAgB;YAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IACzG,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IAClE,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;IAC3E,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,EAAE,CAAC;QACzL,MAAM,IAAI,KAAK,CAAC,0FAA0F,CAAC,CAAC;IAC9G,CAAC;IACD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC3F,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAA6G,CAAC;QAChJ,MAAM,UAAU,GAAG,mBAAmB,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC;QAC7E,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACrS,MAAM,IAAI,KAAK,EAAE,CAAC;QACpB,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,CAAC,WAAW,OAAO,CAAC;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QACxE,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClF,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,YAAY,iBAAiB,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA6C,CAAC;QACpL,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,YAAY,oBAAoB,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAkD,CAAC;QAC/L,IAAI,SAAS,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,IAAI,SAAS,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,cAAc,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;IACvN,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;IAC/F,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,UAAkB;IAC5C,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,GAAG,EAAE,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,IAAI,EAAE,CAAC;QACrG,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC7F,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,cAAkC,EAAE,KAAa;IACvF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,KAAK,yBAAyB,CAAC,CAAC;IAC9I,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAChD,IAAI,cAAc,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,KAAK,YAAY,cAAc,SAAS,CAAC,CAAC;IAC7J,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,18 @@
+#!/usr/bin/env node
+/**
+ * Seedhape local wallet (CLI: `seedhape`).
+ *
+ * Keeps an agent's payment key in the operating system keychain and signs
+ * payments on this computer. Spending rules, budget, pause, and history live in
+ * the user's Seedhape account; every payment is checked there first.
+ *
+ *   seedhape setup [--client codex|claude] [--agent <id>]   one-step setup
+ *   seedhape login [--token]                                sign in to Seedhape
+ *   seedhape logout | seedhape whoami
+ *   seedhape wallet:init|wallet:address|wallet:delete <agent-id>
+ *   seedhape webbotauth:init|status|rotate|revoke [--agent <id>]  agent identity key
+ *   seedhape identity:*                                     ERC-8004 identity tools
+ *   seedhape                                                run the local MCP server (stdio)
+ */
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;GAcG"}

package/dist/index.js

@@ -0,0 +1,429 @@
+#!/usr/bin/env node
+/**
+ * Seedhape local wallet (CLI: `seedhape`).
+ *
+ * Keeps an agent's payment key in the operating system keychain and signs
+ * payments on this computer. Spending rules, budget, pause, and history live in
+ * the user's Seedhape account; every payment is checked there first.
+ *
+ *   seedhape setup [--client codex|claude] [--agent <id>]   one-step setup
+ *   seedhape login [--token]                                sign in to Seedhape
+ *   seedhape logout | seedhape whoami
+ *   seedhape wallet:init|wallet:address|wallet:delete <agent-id>
+ *   seedhape webbotauth:init|status|rotate|revoke [--agent <id>]  agent identity key
+ *   seedhape identity:*                                     ERC-8004 identity tools
+ *   seedhape                                                run the local MCP server (stdio)
+ */
+import { homedir, hostname } from "node:os";
+import { join, resolve } from "node:path";
+import { readFile, stat, writeFile } from "node:fs/promises";
+import { emitKeypressEvents } from "node:readline";
+import { createServer as createHttpServer } from "node:http";
+import { spawnSync } from "node:child_process";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { LocalSessionKeySigner, USDC } from "@seedhape/core";
+import { privateKeyToAccount } from "viem/accounts";
+import { createServer } from "./server.js";
+import { callHostedTool, deleteToken, loadToken, loginWithBrowser, saveToken, seedhapeUrl, whoAmI } from "./hosted.js";
+import { deleteWebBotAuthKey, loadWebBotAuthKey, saveWebBotAuthKey } from "./keychain.js";
+import { loadSeedhapeHostedAgent, setupSeedhapeHostedAgent } from "./agent-identity.js";
+import { defaultSignatureAgent, generateWebBotAuthKey, registerWebBotAuthKey, revokeWebBotAuthKey } from "./web-bot-auth.js";
+import { createLocalWallet, deleteLocalWallet, exportIdentityControllerPrivateKey, identityControllerPrivateKey, importIdentityController, localWalletAddress, localWalletPrivateKey } from "./keychain.js";
+import { createSelfCustodiedBackupPayload, createSelfCustodiedMetadataHandler, restoreSelfCustodiedBackupPayload, setupSelfCustodiedAgent } from "./agent-identity.js";
+import { decryptIdentityBackup, encryptIdentityBackup } from "./identity-backup.js";
+const AGENT_ID = /^[A-Za-z0-9._-]{1,128}$/;
+const defaultAgentId = () => (hostname().replace(/[^A-Za-z0-9._-]/g, "-").slice(0, 60) || "local") + "-agent";
+const flag = (args, name) => { const index = args.indexOf(name); return index >= 0 ? args[index + 1] : undefined; };
+const say = (line) => console.error(line);
+function promptSecret(label) {
+    const input = process.stdin;
+    if (!input.isTTY || typeof input.setRawMode !== "function")
+        throw new Error("Identity backup/restore requires an interactive terminal so the passphrase is not echoed.");
+    return new Promise((resolvePrompt, rejectPrompt) => {
+        emitKeypressEvents(input);
+        input.setRawMode(true);
+        input.resume();
+        let value = "";
+        process.stderr.write(`${label} (hidden): `);
+        const cleanup = () => {
+            input.off("keypress", onKeypress);
+            input.setRawMode(false);
+            process.stderr.write("\n");
+        };
+        const onKeypress = (character, key) => {
+            if (key.ctrl && key.name === "c") {
+                cleanup();
+                rejectPrompt(new Error("Cancelled."));
+            }
+            else if (key.name === "return" || key.name === "enter") {
+                cleanup();
+                resolvePrompt(value);
+            }
+            else if (key.name === "backspace") {
+                if (value.length) {
+                    value = value.slice(0, -1);
+                    process.stderr.write("\b \b");
+                }
+            }
+            else if (character && !key.ctrl && !key.meta && character >= " ") {
+                value += character;
+                process.stderr.write("*");
+            }
+        };
+        input.on("keypress", onKeypress);
+    });
+}
+async function login(args) {
+    if (args.includes("--token")) {
+        const token = (await promptSecret(`Paste a connection token from ${seedhapeUrl()}/connect-mcp`)).trim();
+        if (!token)
+            throw new Error("No token entered.");
+        await saveToken(token);
+    }
+    else {
+        await loginWithBrowser(say);
+    }
+    const account = await whoAmI();
+    if (!account.ok)
+        throw new Error(`The saved sign-in did not work: ${account.detail}`);
+    say(`✓ Signed in to ${seedhapeUrl()}. Token saved in your keychain.`);
+}
+/** Create (or reuse) the keychain wallet and register its public address with the user's Seedhape account. */
+async function registerWallet(agentId, chain) {
+    const address = await createLocalWallet(agentId);
+    const key = await localWalletPrivateKey(agentId);
+    if (!key)
+        throw new Error("The wallet could not be read back from the keychain.");
+    const existing = await callHostedTool("external_agent_wallet_status", {});
+    if (existing.toLowerCase().includes(address.toLowerCase()))
+        return { address, alreadyRegistered: true };
+    const challenge = JSON.parse(await callHostedTool("external_agent_wallet_challenge", { agent_id: agentId, address, chain }));
+    if (!challenge.message)
+        throw new Error(challenge.error ?? "Seedhape did not return a registration challenge.");
+    const signature = await privateKeyToAccount(key).signMessage({ message: challenge.message });
+    const registered = JSON.parse(await callHostedTool("register_external_agent_wallet", { agent_id: agentId, address, chain, message: challenge.message, signature }));
+    if (!registered.registered)
+        throw new Error(registered.error ?? "Seedhape did not register the wallet.");
+    return { address, alreadyRegistered: false };
+}
+/** Add both the hosted Seedhape MCP and this local wallet to Codex or Claude Code. */
+function addToClient(client, agentId, network) {
+    const mcpUrl = `${seedhapeUrl()}/mcp`;
+    const env = [`SEEDHAPE_LOCAL_AGENT=${agentId}`, `SEEDHAPE_NETWORK=${network}`, `SEEDHAPE_URL=${seedhapeUrl()}`];
+    const commands = client === "codex"
+        ? [["codex", "mcp", "add", "Seedhape", "--url", mcpUrl], ["codex", "mcp", "add", "seedhape-wallet", ...env.flatMap((value) => ["--env", value]), "--", "npx", "-y", "@seedhape/local-wallet"]]
+        : [["claude", "mcp", "add", "--transport", "http", "seedhape", mcpUrl], ["claude", "mcp", "add", "seedhape-wallet", ...env.flatMap((value) => ["-e", value]), "--", "npx", "-y", "@seedhape/local-wallet"]];
+    for (const command of commands) {
+        const run = spawnSync(command[0], command.slice(1), { stdio: "inherit" });
+        if (run.error || run.status !== 0)
+            say(`     Could not run it automatically. Run this yourself:\n       ${command.join(" ")}`);
+    }
+}
+/** Create and register this agent's Web Bot Auth key, reusing an existing one. */
+async function initWebBotAuth(agentId, signatureAgent) {
+    const existing = await loadWebBotAuthKey(agentId);
+    if (existing && (!signatureAgent || new URL(signatureAgent).toString() === existing.signatureAgent)) {
+        // Re-registering a key this account already owns is a no-op on the server.
+        await registerWebBotAuthKey(callHostedTool, agentId, existing);
+        return { key: existing, created: false };
+    }
+    const key = generateWebBotAuthKey(signatureAgent ?? defaultSignatureAgent(seedhapeUrl(), agentId));
+    await registerWebBotAuthKey(callHostedTool, agentId, key);
+    await saveWebBotAuthKey(agentId, key);
+    return { key, created: true };
+}
+/** Replace the key: register the new one, switch to it, then revoke the old one. */
+async function rotateWebBotAuth(agentId) {
+    const old = await loadWebBotAuthKey(agentId);
+    if (!old)
+        throw new Error(`No Web Bot Auth key exists for ${agentId}. Run \`seedhape webbotauth:init\` first.`);
+    const next = generateWebBotAuthKey(old.signatureAgent);
+    await registerWebBotAuthKey(callHostedTool, agentId, next, true);
+    await saveWebBotAuthKey(agentId, next);
+    await revokeWebBotAuthKey(callHostedTool, old);
+    return next;
+}
+async function setup(args) {
+    const agentId = flag(args, "--agent") ?? defaultAgentId();
+    if (!AGENT_ID.test(agentId))
+        throw new Error("Agent ids may use letters, digits, '.', '_' and '-'.");
+    const network = process.env.SEEDHAPE_NETWORK ?? "base";
+    const asset = USDC[network];
+    if (!asset)
+        throw new Error(`Unsupported network "${network}". Use one of: ${Object.keys(USDC).join(", ")}`);
+    say("1/4  Signing in to Seedhape…");
+    if ((await whoAmI()).ok)
+        say("     Already signed in.");
+    else
+        await login([]);
+    say(`2/4  Creating the wallet "${agentId}" in your keychain and registering its address…`);
+    const wallet = await registerWallet(agentId, asset.network);
+    say(`     ${wallet.alreadyRegistered ? "Already registered" : "Registered"}: ${wallet.address} (the private key stays on this computer)`);
+    say("3/4  Creating this agent's identity so merchants can tell it's you…");
+    const dataDir = process.env.SEEDHAPE_DATA_DIR ?? join(homedir(), ".seedhape");
+    try {
+        // Preferred: an on-chain ERC-8004 identity that any merchant can verify. Seedhape hosts its metadata and covers gas.
+        const agent = await setupSeedhapeHostedAgent(dataDir, { name: agentId, description: "A self-custody Seedhape agent. Its keys stay on the owner's computer." }, say);
+        say(`     On-chain identity ready: ${agent.identityRef}`);
+    }
+    catch (error) {
+        say(`     On-chain identity not available (${error instanceof Error ? error.message : String(error)}).`);
+        try {
+            // Fallback: a Web Bot Auth key registered with Seedhape; works with Seedhape-hosted merchants.
+            const identity = await initWebBotAuth(agentId, flag(args, "--signature-agent"));
+            say(`     Using a Seedhape-registered key instead (${identity.created ? "created" : "already set up"}). Run setup again later to get the on-chain identity.`);
+        }
+        catch (fallbackError) {
+            // Payments don't depend on it, so setup carries on; the user can retry later.
+            say(`     Skipped: ${fallbackError instanceof Error ? fallbackError.message : String(fallbackError)}\n     Payments still work. Run setup again to retry.`);
+        }
+    }
+    const client = flag(args, "--client");
+    if (client === "codex" || client === "claude") {
+        say(`4/4  Adding Seedhape to ${client === "codex" ? "Codex" : "Claude Code"}…`);
+        addToClient(client, agentId, network);
+    }
+    else {
+        say("4/4  Skipped adding to an agent client (use --client codex or --client claude).");
+    }
+    say(`\nNext:\n  • Set its spending limit: ${seedhapeUrl()}/limits/advanced?wallet=${encodeURIComponent(agentId)}\n  • Send USDC on ${network} to ${wallet.address}\n  • Then ask your agent to buy something.`);
+}
+async function finishFirstUseSetup(agentId, network, dataDir, log) {
+    const account = await whoAmI();
+    if (!account.ok) {
+        log("Opening your browser to connect your Seedhape account…");
+        await loginWithBrowser(log);
+        const signedIn = await whoAmI();
+        if (!signedIn.ok)
+            throw new Error(`Sign-in did not finish: ${signedIn.detail}`);
+    }
+    log("Creating your local wallet and connecting it to Seedhape…");
+    const wallet = await registerWallet(agentId, network);
+    let identity = await loadSeedhapeHostedAgent(dataDir, (error) => log(`Identity refresh: ${error instanceof Error ? error.message : String(error)}`)).catch(() => undefined);
+    let webBotAuth = await loadWebBotAuthKey(agentId).catch(() => null);
+    if (!identity && !webBotAuth) {
+        log("Setting up your agent identity…");
+        try {
+            const ready = await setupSeedhapeHostedAgent(dataDir, { name: agentId, description: "A self-custody Seedhape agent. Its keys stay on this computer." }, log);
+            identity = await loadSeedhapeHostedAgent(dataDir, (error) => log(`Identity refresh: ${error instanceof Error ? error.message : String(error)}`));
+            if (!identity)
+                log(`Identity saved (${ready.identityRef}); it will be available after restarting the wallet.`);
+        }
+        catch (error) {
+            log(`On-chain identity is unavailable (${error instanceof Error ? error.message : String(error)}). Setting up a simpler identity instead…`);
+            try {
+                webBotAuth = (await initWebBotAuth(agentId)).key;
+            }
+            catch (fallbackError) {
+                log(`Identity setup skipped: ${fallbackError instanceof Error ? fallbackError.message : String(fallbackError)}. Payments can still work.`);
+            }
+        }
+    }
+    const key = await localWalletPrivateKey(agentId);
+    if (!key)
+        throw new Error("The local wallet could not be loaded from this computer's keychain.");
+    return { address: privateKeyToAccount(key).address, signer: new LocalSessionKeySigner(key), identity: identity ?? null, webBotAuth: webBotAuth ?? null };
+}
+async function main() {
+    const args = process.argv.slice(2);
+    const [command, commandAgent, commandOption] = args;
+    const dataDir = process.env.SEEDHAPE_DATA_DIR ?? join(homedir(), ".seedhape");
+    if (command === "login")
+        return login(args.slice(1));
+    if (command === "logout") {
+        say((await deleteToken()) ? "Signed out." : "Not signed in.");
+        return;
+    }
+    if (command === "whoami") {
+        const account = await whoAmI();
+        say(`${seedhapeUrl()}: ${account.detail}`);
+        return;
+    }
+    if (command === "setup")
+        return setup(args.slice(1));
+    if (command?.startsWith("webbotauth:")) {
+        const agentId = flag(args, "--agent") ?? process.env.SEEDHAPE_LOCAL_AGENT ?? defaultAgentId();
+        if (command === "webbotauth:init") {
+            const { key, created } = await initWebBotAuth(agentId, flag(args, "--signature-agent"));
+            say(`${created ? "Created and registered" : "Already set up"}: ${key.signatureAgent} (key ${key.keyId})`);
+            return;
+        }
+        if (command === "webbotauth:rotate") {
+            const key = await rotateWebBotAuth(agentId);
+            say(`Rotated. New key ${key.keyId}; the old key is revoked.`);
+            return;
+        }
+        if (command === "webbotauth:revoke") {
+            const key = await loadWebBotAuthKey(agentId);
+            if (!key) {
+                say("No Web Bot Auth key to revoke.");
+                return;
+            }
+            await revokeWebBotAuthKey(callHostedTool, key);
+            await deleteWebBotAuthKey(agentId);
+            say("Revoked and removed from your keychain.");
+            return;
+        }
+        if (command === "webbotauth:status") {
+            const key = await loadWebBotAuthKey(agentId);
+            say(key ? `Signing as ${key.signatureAgent}\nKey id: ${key.keyId}\nCreated: ${new Date(key.createdAt * 1000).toISOString()}` : "Not set up. Run `seedhape webbotauth:init`.");
+            return;
+        }
+        throw new Error(`Unknown command "${command}". Use webbotauth:init, webbotauth:status, webbotauth:rotate, or webbotauth:revoke.`);
+    }
+    if (command === "identity:setup") {
+        const agent = await setupSelfCustodiedAgent(dataDir);
+        console.log(`Self-custodied ERC-8004 identity ready: ${agent.identityRef}`);
+        console.log(`Controller: ${agent.controller}`);
+        console.log(`Web Bot Auth directory: ${agent.directoryUri}`);
+        console.log(`Network: ${agent.chainId === 8453 ? "Base" : "Base Sepolia"}`);
+        console.log("Create a complete encrypted backup with `seedhape identity:backup <file>` and keep its passphrase separate.");
+        return;
+    }
+    if (command === "identity:controller-import") {
+        const privateKey = await promptSecret("Existing ERC-8004 controller private key (0x-prefixed)");
+        const address = await importIdentityController(process.env.SEEDHAPE_AGENT_IDENTITY_CONTROLLER_ID ?? "local-primary", privateKey);
+        console.log(`Imported controller ${address} into the local OS keychain.`);
+        console.log("Next run `seedhape identity:import <identity-reference>` to verify ownership and finish local setup.");
+        return;
+    }
+    if (command === "identity:import") {
+        if (!commandAgent || commandOption !== "--replace-registration")
+            throw new Error("Import replaces the existing onchain metadata URI. Save the existing metadata, then run: seedhape identity:import eip155:<8453|84532>:<registry-address>:<agent-id> --replace-registration");
+        const controller = await identityControllerPrivateKey(process.env.SEEDHAPE_AGENT_IDENTITY_CONTROLLER_ID ?? "local-primary");
+        if (!controller)
+            throw new Error("Import the current ERC-8004 controller first with `seedhape identity:controller-import`.");
+        const agent = await setupSelfCustodiedAgent(dataDir, commandAgent, true);
+        console.log(`Existing self-custodied ERC-8004 identity ready: ${agent.identityRef}`);
+        console.log(`Controller: ${agent.controller}`);
+        console.log(`Web Bot Auth directory: ${agent.directoryUri}`);
+        console.log(`Network: ${agent.chainId === 8453 ? "Base" : "Base Sepolia"}`);
+        return;
+    }
+    if (command === "identity:export") {
+        if (commandAgent !== "--confirm")
+            throw new Error("This prints your identity controller private key. Re-run as `seedhape identity:export --confirm` only in a trusted local terminal.");
+        const key = await exportIdentityControllerPrivateKey(process.env.SEEDHAPE_AGENT_IDENTITY_CONTROLLER_ID ?? "local-primary");
+        if (!key)
+            throw new Error("No local identity controller exists. Run `seedhape identity:setup` first.");
+        console.error("WARNING: anyone with this key controls the onchain agent identity. Store the next line offline; never paste it into chat or commit it.");
+        console.log(key);
+        return;
+    }
+    if (command === "identity:backup") {
+        if (!commandAgent)
+            throw new Error("Usage: seedhape identity:backup <encrypted-backup-file>");
+        const first = await promptSecret("Choose a backup passphrase (12+ characters)");
+        const second = await promptSecret("Repeat backup passphrase");
+        if (first !== second)
+            throw new Error("Passphrases do not match.");
+        const payload = await createSelfCustodiedBackupPayload(dataDir);
+        const encrypted = encryptIdentityBackup(payload, first);
+        const destination = resolve(commandAgent);
+        await writeFile(destination, `${encrypted}\n`, { flag: "wx", mode: 0o600 });
+        console.log(`Encrypted identity backup created at ${destination}. Keep the passphrase separate from the file.`);
+        return;
+    }
+    if (command === "identity:restore") {
+        if (!commandAgent)
+            throw new Error("Usage: seedhape identity:restore <encrypted-backup-file>");
+        const source = resolve(commandAgent);
+        const info = await stat(source);
+        if (!info.isFile() || info.size > 10 * 1024 * 1024)
+            throw new Error("Identity backup must be a regular file no larger than 10 MB.");
+        const passphrase = await promptSecret("Backup passphrase");
+        const payload = decryptIdentityBackup(await readFile(source, "utf8"), passphrase);
+        const restored = await restoreSelfCustodiedBackupPayload(dataDir, payload);
+        console.log(`Restored identity ${restored.identityRef} controlled by ${restored.controller}.`);
+        console.log(`Identity keychain slot: ${payload.accountId}. Restore with this SEEDHAPE_AGENT_IDENTITY_CONTROLLER_ID value or leave it unset.`);
+        console.log("Verify SEEDHAPE_AGENT_TRUST_* and SEEDHAPE_AGENT_METADATA_ORIGIN match this identity before starting the MCP server.");
+        return;
+    }
+    if (command === "identity:metadata-server") {
+        const origin = process.env.SEEDHAPE_AGENT_METADATA_ORIGIN;
+        if (!origin)
+            throw new Error("Set SEEDHAPE_AGENT_METADATA_ORIGIN to the public HTTPS origin routed to this metadata server.");
+        const publicOrigin = new URL(origin);
+        if (publicOrigin.protocol !== "https:" || publicOrigin.pathname !== "/" || publicOrigin.search || publicOrigin.hash)
+            throw new Error("SEEDHAPE_AGENT_METADATA_ORIGIN must be an HTTPS origin without a path.");
+        const handler = await createSelfCustodiedMetadataHandler(dataDir);
+        const host = process.env.SEEDHAPE_AGENT_METADATA_BIND ?? "127.0.0.1";
+        const port = Number(process.env.SEEDHAPE_AGENT_METADATA_PORT ?? "8787");
+        if (!Number.isInteger(port) || port < 1 || port > 65535)
+            throw new Error("SEEDHAPE_AGENT_METADATA_PORT must be a valid TCP port.");
+        const server = createHttpServer(async (incoming, outgoing) => {
+            try {
+                const url = new URL(incoming.url ?? "/", origin);
+                if (url.origin !== publicOrigin.origin) {
+                    outgoing.statusCode = 400;
+                    outgoing.end("Invalid metadata origin.");
+                    return;
+                }
+                const response = await handler(new Request(url, { method: incoming.method ?? "GET" }));
+                outgoing.statusCode = response.status;
+                response.headers.forEach((value, name) => outgoing.setHeader(name, value));
+                outgoing.end(incoming.method === "HEAD" ? undefined : Buffer.from(await response.arrayBuffer()));
+            }
+            catch (error) {
+                outgoing.statusCode = 500;
+                outgoing.end(error instanceof Error ? error.message : "Metadata request failed.");
+            }
+        });
+        server.listen(port, host, () => console.error(`Self-custodied agent metadata handler listening on ${host}:${port}; proxy ${origin}/.well-known/seedhape-agents/* here.`));
+        return;
+    }
+    if (command === "wallet:init") {
+        if (!commandAgent)
+            throw new Error("Usage: seedhape wallet:init <agent-id>");
+        console.log(await createLocalWallet(commandAgent));
+        return;
+    }
+    if (command === "wallet:address") {
+        if (!commandAgent)
+            throw new Error("Usage: seedhape wallet:address <agent-id>");
+        const address = await localWalletAddress(commandAgent);
+        if (!address)
+            throw new Error(`No local wallet exists for ${commandAgent}.`);
+        console.log(address);
+        return;
+    }
+    if (command === "wallet:delete") {
+        if (!commandAgent)
+            throw new Error("Usage: seedhape wallet:delete <agent-id>");
+        console.log((await deleteLocalWallet(commandAgent)) ? "Deleted." : "No wallet found.");
+        return;
+    }
+    if (command && command !== "serve")
+        throw new Error(`Unknown command "${command}". Run \`seedhape setup\` to get started.`);
+    // Default: run the local MCP server over stdio for Codex, Claude Code, or another MCP client.
+    const network = process.env.SEEDHAPE_NETWORK ?? "base";
+    const asset = USDC[network];
+    if (!asset)
+        throw new Error(`Unsupported network "${network}". Use one of: ${Object.keys(USDC).join(", ")}`);
+    const agentId = process.env.SEEDHAPE_LOCAL_AGENT ?? process.env.SEEDHAPE_LOCAL_KEYTAR_AGENT ?? defaultAgentId();
+    const key = await localWalletPrivateKey(agentId);
+    const hasSavedAccount = Boolean(await loadToken());
+    const identity = await loadSeedhapeHostedAgent(process.env.SEEDHAPE_DATA_DIR ?? join(homedir(), ".seedhape"), (error) => say(`seedhape: could not refresh the agent's key directory: ${error instanceof Error ? error.message : String(error)}`)).catch((error) => { say(`seedhape: on-chain identity unavailable (${error instanceof Error ? error.message : String(error)}); continuing without it.`); return undefined; });
+    const webBotAuth = await loadWebBotAuthKey(agentId).catch(() => null);
+    const server = createServer({
+        agentId,
+        address: key ? privateKeyToAccount(key).address : null,
+        signer: key ? new LocalSessionKeySigner(key) : null,
+        webBotAuth,
+        identity: identity ?? null,
+        asset,
+        absoluteMaxPerPayment: BigInt(process.env.SEEDHAPE_ABSOLUTE_MAX ?? "1000000"),
+        setupNeeded: !hasSavedAccount || !key || (!identity && !webBotAuth),
+        finishSetup: () => finishFirstUseSetup(agentId, asset.network, dataDir, say),
+        onSetupError: (error) => say(`seedhape: browser setup did not finish (${error instanceof Error ? error.message : String(error)}). Try any wallet tool again to retry.`),
+    });
+    await server.connect(new StdioServerTransport());
+    const shutdown = () => process.exit(0);
+    process.on("SIGINT", shutdown);
+    process.on("SIGTERM", shutdown);
+}
+main().catch((error) => {
+    console.error(`seedhape: ${error instanceof Error ? error.message : String(error)}`);
+    process.exit(1);
+});
+//# sourceMappingURL=index.js.map