@t2000/cli 5.31.0 → 5.32.0

package/dist/{dist-L3E4Q45J.js → dist-VB42REWC.js}

@@ -99462,7 +99462,7 @@ The wallet can also HIRE OTHER AGENTS: the agent store (agents.t2000.ai) lists a
 The wallet can EARN too: t2000_tasks lists live reward tasks + the community task board, t2000_task_claim collects auto-verified rewards, t2000_task_submit submits proof on board jobs, and t2000_agent_earnings reports the wallet's seller sales. None of these spend \u2014 claims RECEIVE USDC through the rail (see the skill-earn prompt or the t2000-earn skill).
 
 Spending is the user's own USDC and every t2000_pay call is bounded by maxPrice. For larger or multi-step spends, state the estimated cost first and proceed once the user is happy. Use t2000_balance to check funds. The v4 wallet is payments-only; savings / lending live on audric.ai.`;
-var PKG_VERSION = "5.31.0";
+var PKG_VERSION = "5.32.0";
 console.log = (...args) => console.error("[log]", ...args);
 console.warn = (...args) => console.error("[warn]", ...args);
 async function startMcpServer(opts) {
@@ -99537,4 +99537,4 @@ mime-types/index.js:
 @scure/bip39/index.js:
   (*! scure-bip39 - MIT License (c) 2022 Patricio Palladino, Paul Miller (paulmillr.com) *)
 */
-//# sourceMappingURL=dist-L3E4Q45J.js.map
+//# sourceMappingURL=dist-VB42REWC.js.map

package/dist/index.js

@@ -33122,7 +33122,7 @@ function registerMcpStart(parent) {
   parent.command("start", { isDefault: true }).description("Start MCP server (stdio transport \u2014 for AI client integration)").option("--key <path>", "Custom wallet path (default ~/.t2000/wallet.key)").action(async (opts) => {
     let mod3;
     try {
-      mod3 = await import("./dist-L3E4Q45J.js");
+      mod3 = await import("./dist-VB42REWC.js");
     } catch {
       console.error("MCP server not installed. Run:\n  npm install -g @t2000/mcp");
       process.exit(1);
@@ -34083,7 +34083,8 @@ var HANDLER_TEMPLATE = `// t2000 hosted handler (R1). Deploys with: t2 agent ser
 // auto-refunded. Keep it fast (15s delivery timeout, 5s CPU cap).
 //
 //   input \u2014 the buyer's request body (parsed JSON, or a raw string)
-//   ctx   \u2014 { agent, slug, buyer }
+//   ctx   \u2014 { agent, slug, buyer, secrets }
+//           secrets = your vault (t2 agent serve secrets set KEY=value)
 export default async function handle(input, ctx) {
   // Example: compose public data and return a result.
   // const res = await fetch('https://api.example.com/data');
@@ -34095,6 +34096,37 @@ export default async function handle(input, ctx) {
   };
 }
 `;
+var PROXY_TEMPLATE = `// t2000 hosted handler \u2014 "Proxy an API" template. You hold a key to an
+// API; this resells calls to it per-call, with your key never leaving the
+// t2000 vault. Setup:
+//   1. Edit UPSTREAM below.
+//   2. t2 agent serve secrets set UPSTREAM_KEY=<your api key>
+//   3. t2 agent serve deploy
+const UPSTREAM = 'https://api.example.com/v1/endpoint';
+
+export default async function handle(input, ctx) {
+  const res = await fetch(UPSTREAM, {
+    method: 'POST',
+    headers: {
+      'content-type': 'application/json',
+      // Adjust the auth scheme to your upstream (x-api-key, basic, \u2026).
+      ...(ctx.secrets?.UPSTREAM_KEY
+        ? { authorization: \`Bearer \${ctx.secrets.UPSTREAM_KEY}\` }
+        : {}),
+    },
+    body: JSON.stringify(input ?? {}),
+  });
+  if (!res.ok) {
+    // Throwing fails the delivery \u2192 the buyer is auto-refunded.
+    throw new Error(\`Upstream error \${res.status}\`);
+  }
+  return await res.json();
+}
+`;
+var TEMPLATES = {
+  default: HANDLER_TEMPLATE,
+  proxy: PROXY_TEMPLATE
+};
 function readManifest(dir) {
   const p = join8(dir, MANIFEST);
   if (!existsSync4(p)) {
@@ -34150,7 +34182,11 @@ function registerAgentServe(agentGroup) {
   const group = agentGroup.command("serve").description(
     "Hosted handlers \u2014 deploy a function to t2000 compute and sell it per call. No server, no wrap. [R1]"
   );
-  group.command("init").description(`Scaffold ${HANDLER} + ${MANIFEST} in the current directory.`).option("--slug <slug>", "Service slug (in the buy URL)", "my-service").option("--dir <path>", "Target directory (default: cwd)").action((opts) => {
+  group.command("init").description(`Scaffold ${HANDLER} + ${MANIFEST} in the current directory.`).option("--slug <slug>", "Service slug (in the buy URL)", "my-service").option(
+    "--template <name>",
+    `Handler template: ${Object.keys(TEMPLATES).join(" | ")} (proxy = resell a keyed API)`,
+    "default"
+  ).option("--dir <path>", "Target directory (default: cwd)").action((opts) => {
     try {
       const dir = resolve2(opts.dir ?? ".");
       mkdirSync2(dir, { recursive: true });
@@ -34158,6 +34194,12 @@ function registerAgentServe(agentGroup) {
       if (!SLUG_RE2.test(slug)) {
         throw new Error("--slug must match [a-z0-9-], 2-40 chars.");
       }
+      const template = TEMPLATES[opts.template];
+      if (!template) {
+        throw new Error(
+          `Unknown --template "${opts.template}" \u2014 use: ${Object.keys(TEMPLATES).join(", ")}.`
+        );
+      }
       const manifestPath = join8(dir, MANIFEST);
       const handlerPath = join8(dir, HANDLER);
       if (existsSync4(manifestPath) || existsSync4(handlerPath)) {
@@ -34178,7 +34220,7 @@ function registerAgentServe(agentGroup) {
         )}
 `
       );
-      writeFileSync3(handlerPath, HANDLER_TEMPLATE);
+      writeFileSync3(handlerPath, template);
       if (isJsonMode()) {
         printJson({ dir, files: [MANIFEST, HANDLER] });
         return;
@@ -34329,6 +34371,105 @@ function registerAgentServe(agentGroup) {
       }
     }
   );
+  const secrets = group.command("secrets").description(
+    "This agent's handler secrets vault \u2014 encrypted at t2000, injected as ctx.secrets on paid deliveries only. Values are write-only."
+  );
+  secrets.command("set").argument("<pairs...>", "NAME=value pairs (e.g. UPSTREAM_KEY=sk-\u2026)").description("Set (or overwrite) vault secrets. NAME: A-Z, 0-9, _.").option("--key <path>", "Custom wallet path (default ~/.t2000/wallet.key)").option("--gateway <url>", `Gateway URL (default ${DEFAULT_GATEWAY2})`).action(
+    async (pairs, opts) => {
+      try {
+        const updates = {};
+        for (const pair of pairs) {
+          const eq = pair.indexOf("=");
+          if (eq <= 0) {
+            throw new Error(`"${pair}" is not NAME=value.`);
+          }
+          updates[pair.slice(0, eq).trim()] = pair.slice(eq + 1);
+        }
+        const res = await postSecrets(opts, "set", updates);
+        if (isJsonMode()) {
+          printJson({ names: res.names });
+          return;
+        }
+        printBlank();
+        printSuccess("Vault updated");
+        printKeyValue("Secrets", res.names.join(", ") || "(none)");
+        printInfo("Handlers read them as ctx.secrets.NAME on paid deliveries.");
+        printBlank();
+      } catch (error) {
+        handleError(error);
+      }
+    }
+  );
+  secrets.command("unset").argument("<names...>", "Secret names to delete").description("Delete vault secrets.").option("--key <path>", "Custom wallet path (default ~/.t2000/wallet.key)").option("--gateway <url>", `Gateway URL (default ${DEFAULT_GATEWAY2})`).action(
+    async (names, opts) => {
+      try {
+        const updates = {};
+        for (const n of names) {
+          updates[n.trim()] = "";
+        }
+        const res = await postSecrets(opts, "set", updates);
+        if (isJsonMode()) {
+          printJson({ names: res.names });
+          return;
+        }
+        printBlank();
+        printSuccess("Vault updated");
+        printKeyValue("Secrets", res.names.join(", ") || "(none)");
+        printBlank();
+      } catch (error) {
+        handleError(error);
+      }
+    }
+  );
+  secrets.command("list").description("List vault secret NAMES (values never leave the gateway).").option("--key <path>", "Custom wallet path (default ~/.t2000/wallet.key)").option("--gateway <url>", `Gateway URL (default ${DEFAULT_GATEWAY2})`).action(async (opts) => {
+    try {
+      const res = await postSecrets(opts, "list");
+      if (isJsonMode()) {
+        printJson({ names: res.names });
+        return;
+      }
+      const names = res.names;
+      printBlank();
+      if (names.length === 0) {
+        printLine("Vault is empty. Set one: t2 agent serve secrets set NAME=value");
+      } else {
+        for (const n of names) {
+          printLine(`  ${n}`);
+        }
+      }
+      printBlank();
+    } catch (error) {
+      handleError(error);
+    }
+  });
+  async function postSecrets(opts, op, updates) {
+    const gateway = opts.gateway ?? DEFAULT_GATEWAY2;
+    const agent = await withAgent({ keyPath: opts.key });
+    const address = agent.address();
+    const ts = Date.now();
+    const payload = op === "list" ? "list" : JSON.stringify(
+      Object.fromEntries(
+        Object.entries(updates ?? {}).sort(
+          ([a], [b]) => a.localeCompare(b)
+        )
+      )
+    );
+    const bodyHash = createHash3("sha256").update(payload).digest("hex");
+    const message = new TextEncoder().encode(
+      `t2000-serve-secrets:${ts}:${bodyHash}`
+    );
+    const { signature } = await agent.keypair.signPersonalMessage(message);
+    return await fetchJson4(`${gateway}/serve/secrets`, {
+      method: "POST",
+      body: {
+        address,
+        op,
+        ...op === "set" ? { updates } : {},
+        timestamp: ts,
+        signature
+      }
+    });
+  }
   group.command("status").description("Deployed handlers + invocation stats.").option("--key <path>", "Custom wallet path (default ~/.t2000/wallet.key)").option("--gateway <url>", `Gateway URL (default ${DEFAULT_GATEWAY2})`).action(async (opts) => {
     try {
       const gateway = opts.gateway ?? DEFAULT_GATEWAY2;