@trustwallet/cli 0.12.1 → 0.12.2

package/dist/commands/wallet.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wallet.d.ts","sourceRoot":"","sources":["../../src/commands/wallet.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA4CpC,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA0tB5D"}
+{"version":3,"file":"wallet.d.ts","sourceRoot":"","sources":["../../src/commands/wallet.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA6CpC,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAktB5D"}

package/dist/index.js

@@ -4366,12 +4366,12 @@ var init_dist = __esm({
 });
 
 // ../storage/dist/index.mjs
-function deriveKey(password2, salt) {
-  return crypto22.pbkdf2Sync(password2, salt, ITERATIONS, KEY_LENGTH, "sha256");
+function deriveKey(password3, salt) {
+  return crypto22.pbkdf2Sync(password3, salt, ITERATIONS, KEY_LENGTH, "sha256");
 }
-function encrypt(plaintext, password2) {
+function encrypt(plaintext, password3) {
   const salt = crypto22.randomBytes(SALT_LENGTH);
-  const key = deriveKey(password2, salt);
+  const key = deriveKey(password3, salt);
   const iv = crypto22.randomBytes(IV_LENGTH);
   const cipher = crypto22.createCipheriv(ALGORITHM, key, iv);
   let encrypted = cipher.update(plaintext, "utf-8", "hex");
@@ -4383,9 +4383,9 @@ function encrypt(plaintext, password2) {
     salt: salt.toString("hex")
   };
 }
-function decrypt(data, password2) {
+function decrypt(data, password3) {
   const salt = Buffer.from(data.salt, "hex");
-  const key = deriveKey(password2, salt);
+  const key = deriveKey(password3, salt);
   const iv = Buffer.from(data.iv, "hex");
   const decipher = crypto22.createDecipheriv(ALGORITHM, key, iv);
   decipher.setAuthTag(Buffer.from(data.authTag, "hex"));
@@ -4489,8 +4489,8 @@ var init_dist2 = __esm({
       async getWalletPassword() {
         return getPassword(SERVICE, WALLET_ACCOUNT);
       }
-      async saveWalletPassword(password2) {
-        new import_keyring.Entry(SERVICE, WALLET_ACCOUNT).setPassword(password2);
+      async saveWalletPassword(password3) {
+        new import_keyring.Entry(SERVICE, WALLET_ACCOUNT).setPassword(password3);
       }
       async deleteWalletPassword() {
         new import_keyring.Entry(SERVICE, WALLET_ACCOUNT).deletePassword();
@@ -4582,8 +4582,8 @@ var init_dist2 = __esm({
       constructor(config2) {
         this.store = new FileStore(config2);
       }
-      async saveMnemonic(mnemonic, password2, chains) {
-        const encrypted = encrypt(mnemonic, password2);
+      async saveMnemonic(mnemonic, password3, chains) {
+        const encrypted = encrypt(mnemonic, password3);
         const config2 = {
           encryptedMnemonic: encrypted.ciphertext,
           iv: encrypted.iv,
@@ -4594,7 +4594,7 @@ var init_dist2 = __esm({
         };
         await this.store.write(WALLET_FILE, config2);
       }
-      async loadMnemonic(password2) {
+      async loadMnemonic(password3) {
         const config2 = await this.store.read(WALLET_FILE);
         if (!config2) {
           throw new Error("No wallet configuration found");
@@ -4605,7 +4605,7 @@ var init_dist2 = __esm({
           authTag: config2.authTag,
           salt: config2.salt
         };
-        return decrypt(encrypted, password2);
+        return decrypt(encrypted, password3);
       }
       async exists() {
         return this.store.exists(WALLET_FILE);
@@ -7723,9 +7723,9 @@ var init_dist3 = __esm({
           throw new Error("Wallet is locked. Re-authenticate to continue.");
         }
         this.reconnecting = (async () => {
-          const password2 = await this.passwordResolver();
+          const password3 = await this.passwordResolver();
           const store = new WalletConfigStore();
-          const mnemonic = await store.loadMnemonic(password2);
+          const mnemonic = await store.loadMnemonic(password3);
           this.signer = await WalletCoreSigner.fromMnemonic(mnemonic);
           this.blockchainClient = new BlockchainClient(this.signer);
           this.connected = true;
@@ -7736,26 +7736,26 @@ var init_dist3 = __esm({
           this.reconnecting = null;
         }
       }
-      static async create(password2) {
+      static async create(password3) {
         const walletCore2 = getWalletCore();
         const hdWallet = walletCore2.HDWallet.create(128, "");
         const mnemonic = hdWallet.mnemonic();
         const store = new WalletConfigStore();
-        await store.saveMnemonic(mnemonic, password2, Object.keys(CHAINS));
+        await store.saveMnemonic(mnemonic, password3, Object.keys(CHAINS));
         const signer = WalletCoreSigner.fromHDWallet(hdWallet);
         const client = new BlockchainClient(signer);
         return new _AgentWalletProvider(signer, client);
       }
-      static async fromStorage(password2) {
+      static async fromStorage(password3) {
         const store = new WalletConfigStore();
-        const mnemonic = await store.loadMnemonic(password2);
+        const mnemonic = await store.loadMnemonic(password3);
         const signer = await WalletCoreSigner.fromMnemonic(mnemonic);
         const client = new BlockchainClient(signer);
         return new _AgentWalletProvider(signer, client);
       }
-      static async fromMnemonic(mnemonic, password2) {
+      static async fromMnemonic(mnemonic, password3) {
         const store = new WalletConfigStore();
-        await store.saveMnemonic(mnemonic, password2, Object.keys(CHAINS));
+        await store.saveMnemonic(mnemonic, password3, Object.keys(CHAINS));
         const signer = await WalletCoreSigner.fromMnemonic(mnemonic);
         const client = new BlockchainClient(signer);
         return new _AgentWalletProvider(signer, client);
@@ -14441,11 +14441,11 @@ var require_util3 = __commonJS({
       return false;
     }
     exports2.schemaHasRules = schemaHasRules;
-    function schemaHasRulesButRef(schema, RULES) {
+    function schemaHasRulesButRef(schema, RULES2) {
       if (typeof schema == "boolean")
         return !schema;
       for (const key in schema)
-        if (key !== "$ref" && RULES.all[key])
+        if (key !== "$ref" && RULES2.all[key])
           return true;
       return false;
     }
@@ -15839,17 +15839,17 @@ var require_validate = __commonJS({
     }
     function schemaKeywords(it4, types, typeErrors, errsCount) {
       const { gen: gen2, schema, data, allErrors, opts, self: self2 } = it4;
-      const { RULES } = self2;
-      if (schema.$ref && (opts.ignoreKeywordsWithRef || !(0, util_1.schemaHasRulesButRef)(schema, RULES))) {
-        gen2.block(() => keywordCode(it4, "$ref", RULES.all.$ref.definition));
+      const { RULES: RULES2 } = self2;
+      if (schema.$ref && (opts.ignoreKeywordsWithRef || !(0, util_1.schemaHasRulesButRef)(schema, RULES2))) {
+        gen2.block(() => keywordCode(it4, "$ref", RULES2.all.$ref.definition));
         return;
       }
       if (!opts.jtd)
         checkStrictTypes(it4, types);
       gen2.block(() => {
-        for (const group of RULES.rules)
+        for (const group of RULES2.rules)
           groupKeywords(group);
-        groupKeywords(RULES.post);
+        groupKeywords(RULES2.post);
       });
       function groupKeywords(group) {
         if (!(0, applicability_1.shouldUseGroup)(schema, group))
@@ -17551,10 +17551,10 @@ var require_core = __commonJS({
       }
       // Remove keyword
       removeKeyword(keyword) {
-        const { RULES } = this;
-        delete RULES.keywords[keyword];
-        delete RULES.all[keyword];
-        for (const group of RULES.rules) {
+        const { RULES: RULES2 } = this;
+        delete RULES2.keywords[keyword];
+        delete RULES2.all[keyword];
+        for (const group of RULES2.rules) {
           const i2 = group.rules.findIndex((rule) => rule.keyword === keyword);
           if (i2 >= 0)
             group.rules.splice(i2, 1);
@@ -17722,9 +17722,9 @@ var require_core = __commonJS({
     }
     var KEYWORD_NAME = /^[a-z_$][a-z0-9_$:-]*$/i;
     function checkKeyword(keyword, def) {
-      const { RULES } = this;
+      const { RULES: RULES2 } = this;
       (0, util_1.eachItem)(keyword, (kwd) => {
-        if (RULES.keywords[kwd])
+        if (RULES2.keywords[kwd])
           throw new Error(`Keyword ${kwd} is already defined`);
         if (!KEYWORD_NAME.test(kwd))
           throw new Error(`Keyword ${kwd} has invalid name`);
@@ -17740,13 +17740,13 @@ var require_core = __commonJS({
       const post = definition === null || definition === void 0 ? void 0 : definition.post;
       if (dataType && post)
         throw new Error('keyword with "post" flag cannot have "type"');
-      const { RULES } = this;
-      let ruleGroup = post ? RULES.post : RULES.rules.find(({ type: t }) => t === dataType);
+      const { RULES: RULES2 } = this;
+      let ruleGroup = post ? RULES2.post : RULES2.rules.find(({ type: t }) => t === dataType);
       if (!ruleGroup) {
         ruleGroup = { type: dataType, rules: [] };
-        RULES.rules.push(ruleGroup);
+        RULES2.rules.push(ruleGroup);
       }
-      RULES.keywords[keyword] = true;
+      RULES2.keywords[keyword] = true;
       if (!definition)
         return;
       const rule = {
@@ -17761,7 +17761,7 @@ var require_core = __commonJS({
         addBeforeRule.call(this, ruleGroup, rule, definition.before);
       else
         ruleGroup.rules.push(rule);
-      RULES.all[keyword] = rule;
+      RULES2.all[keyword] = rule;
       (_a2 = definition.implements) === null || _a2 === void 0 ? void 0 : _a2.forEach((kwd) => this.addKeyword(kwd));
     }
     function addBeforeRule(ruleGroup, rule, before) {
@@ -38944,8 +38944,8 @@ async function tryRegisterWallet() {
   if (!await store.exists()) return;
   try {
     const creds = await ensureTrustSDK();
-    const password2 = await resolvePassword();
-    const provider = await AgentWalletProvider.fromStorage(password2);
+    const password3 = await resolvePassword();
+    const provider = await AgentWalletProvider.fromStorage(password3);
     await registerWalletWithBackend(creds, provider);
     info("Wallet registered with backend");
   } catch {
@@ -39577,6 +39577,21 @@ var import_node_crypto2 = require("crypto");
 var import_prompts3 = require("@inquirer/prompts");
 init_dist2();
 init_dist();
+
+// src/password.ts
+var RULES = [
+  [(pw) => pw.length >= 8, "be at least 8 characters long"],
+  [(pw) => /[a-z]/.test(pw), "include a lowercase letter"],
+  [(pw) => /[A-Z]/.test(pw), "include an uppercase letter"],
+  [(pw) => /[0-9]/.test(pw), "include a number"]
+];
+function getPasswordWeaknesses(pw) {
+  const failed = RULES.filter(([test]) => !test(pw)).map(([, label]) => label);
+  return failed.length > 0 ? failed.join(", ") : null;
+}
+
+// src/setup/phase-wallet.ts
+var MAX_PASSWORD_CONFIRM_ATTEMPTS = 3;
 var defaultPrompter3 = {
   selectWalletOption: () => (0, import_prompts3.select)({
     message: "Pick one:",
@@ -39597,24 +39612,49 @@ var defaultPrompter3 = {
         description: "Read-only operations work without a wallet."
       }
     ]
-  })
+  }),
+  promptWalletPassword: async () => {
+    for (let attempt = 1; attempt <= MAX_PASSWORD_CONFIRM_ATTEMPTS; attempt++) {
+      const pw = await (0, import_prompts3.password)({
+        message: "Choose a wallet password (min 8 chars, mixed case + digit):",
+        mask: "\u25CF",
+        validate: (s2) => {
+          const w4 = getPasswordWeaknesses(s2);
+          return w4 === null ? true : `Password must ${w4}.`;
+        }
+      });
+      const confirm = await (0, import_prompts3.password)({
+        message: "Confirm password:",
+        mask: "\u25CF"
+      });
+      if (pw === confirm) return pw;
+      const remaining = MAX_PASSWORD_CONFIRM_ATTEMPTS - attempt;
+      if (remaining > 0) {
+        error(`Passwords don't match. ${remaining} attempt(s) left.`);
+      }
+    }
+    throw new CommandError(
+      "VALIDATION_ERROR",
+      `Could not capture a matching wallet password after ${MAX_PASSWORD_CONFIRM_ATTEMPTS} attempts.`
+    );
+  }
 };
 function makeDefaultDeps3() {
   return {
     prompter: defaultPrompter3,
     storage: new WalletConfigStore(),
     walletCreator: {
-      async create(password2) {
+      async create(pw) {
         await ensureTrustSDK();
-        const provider = await AgentWalletProvider.create(password2);
+        const provider = await AgentWalletProvider.create(pw);
         const primaryAddress = await provider.getAddress("ethereum") ?? "<unknown>";
         return { primaryAddress };
       }
     },
     keychain: {
       isAvailable: () => new KeychainManager().isAvailable(),
-      async saveWalletPassword(password2) {
-        await new KeychainManager().saveWalletPassword(password2);
+      async saveWalletPassword(pw) {
+        await new KeychainManager().saveWalletPassword(pw);
       },
       async saveProbe(value) {
         await new KeychainManager().saveProbe(value);
@@ -39626,8 +39666,7 @@ function makeDefaultDeps3() {
         await new KeychainManager().deleteProbe();
       }
     },
-    env: process.env,
-    generatePassword: () => (0, import_node_crypto2.randomBytes)(32).toString("hex")
+    env: process.env
   };
 }
 async function runWalletPhase(opts, deps = makeDefaultDeps3()) {
@@ -39652,6 +39691,14 @@ async function runWalletPhase(opts, deps = makeDefaultDeps3()) {
   }
 }
 async function createAgentWallet(deps) {
+  await preflightWalletCreate(deps);
+  info(
+    "Choose a password to encrypt your wallet. twak stores it in your local OS keychain so day-to-day commands don't re-prompt \u2014 nothing leaves your machine. Still: write it down somewhere safe (password manager) too. If the keychain ever fails, that's your only recovery path.\n"
+  );
+  const pw = await deps.prompter.promptWalletPassword();
+  await writeNewWallet(deps, pw);
+}
+async function preflightWalletCreate(deps) {
   if (await deps.storage.exists()) {
     throw new WalletError(
       "WALLET_EXISTS",
@@ -39665,10 +39712,11 @@ async function createAgentWallet(deps) {
     );
   }
   await assertKeychainCanPersist(deps);
+}
+async function writeNewWallet(deps, pw) {
   info("Creating agent wallet...");
-  const password2 = deps.generatePassword();
-  const { primaryAddress } = await deps.walletCreator.create(password2);
-  await deps.keychain.saveWalletPassword(password2);
+  const { primaryAddress } = await deps.walletCreator.create(pw);
+  await deps.keychain.saveWalletPassword(pw);
   success("Wallet created.");
   info(`  Primary ETH address: ${primaryAddress}`);
   success("Password saved to OS keychain.");
@@ -39698,18 +39746,29 @@ async function assertKeychainCanPersist(deps) {
 }
 async function runNonInteractive3(deps) {
   const mode = deps.env.TWAK_SETUP_WALLET ?? "skip";
-  if (mode === "create") {
-    await createAgentWallet(deps);
-    return;
-  }
   if (mode === "skip") {
     info("Wallet creation skipped (set TWAK_SETUP_WALLET=create to opt in).");
     return;
   }
-  throw new CommandError(
-    "VALIDATION_ERROR",
-    `Unknown TWAK_SETUP_WALLET value: ${mode}. Use 'create' or 'skip'.`
-  );
+  if (mode !== "create") {
+    throw new CommandError(
+      "VALIDATION_ERROR",
+      `Unknown TWAK_SETUP_WALLET value: ${mode}. Use 'create' or 'skip'.`
+    );
+  }
+  const envPassword = deps.env.TWAK_WALLET_PASSWORD?.trim();
+  if (!envPassword) {
+    throw new CommandError(
+      "VALIDATION_ERROR",
+      "TWAK_WALLET_PASSWORD must be set when TWAK_SETUP_WALLET=create. Choose a strong password (min 8 chars, mixed case + digit) and pass it via the env var before re-running setup."
+    );
+  }
+  const weakness = getPasswordWeaknesses(envPassword);
+  if (weakness) {
+    throw new CommandError("VALIDATION_ERROR", `TWAK_WALLET_PASSWORD too weak: must ${weakness}.`);
+  }
+  await preflightWalletCreate(deps);
+  await writeNewWallet(deps, envPassword);
 }
 
 // src/commands/setup.ts
@@ -39861,17 +39920,9 @@ function registerWalletCommand(program3) {
   wallet.command("create").description("Create a new agent wallet").requiredOption("--password <password>", "Password to encrypt the wallet").option("--no-keychain", "Do not save password to OS keychain").option("--skip-password-check", "Skip password strength validation").option("--json", "JSON output").action(async (opts) => {
     try {
       if (!opts.skipPasswordCheck) {
-        const pw = opts.password;
-        const issues = [];
-        if (pw.length < 8) issues.push("be at least 8 characters long");
-        if (!/[a-z]/.test(pw)) issues.push("include a lowercase letter");
-        if (!/[A-Z]/.test(pw)) issues.push("include an uppercase letter");
-        if (!/[0-9]/.test(pw)) issues.push("include a number");
-        if (issues.length > 0) {
-          throw new WalletError(
-            "VALIDATION_ERROR",
-            `Password too weak: must ${issues.join(", ")}.`
-          );
+        const weakness = getPasswordWeaknesses(opts.password);
+        if (weakness) {
+          throw new WalletError("VALIDATION_ERROR", `Password too weak: must ${weakness}.`);
         }
       }
       await ensureTrustSDK();
@@ -39918,8 +39969,8 @@ function registerWalletCommand(program3) {
         throw new WalletError("CHAIN_UNSUPPORTED", `Unknown chain: ${opts.chain}`);
       }
       await ensureTrustSDK();
-      const password2 = await resolvePassword(opts);
-      const provider = await AgentWalletProvider.fromStorage(password2);
+      const password3 = await resolvePassword(opts);
+      const provider = await AgentWalletProvider.fromStorage(password3);
       const address = await provider.getAddress(opts.chain);
       if (opts.json) {
         output({ chain: opts.chain, address }, true);
@@ -39942,8 +39993,8 @@ ${qr3}`;
   ).option("--json", "JSON output").action(async (opts) => {
     try {
       await ensureTrustSDK();
-      const password2 = await resolvePassword(opts);
-      const provider = await AgentWalletProvider.fromStorage(password2);
+      const password3 = await resolvePassword(opts);
+      const provider = await AgentWalletProvider.fromStorage(password3);
       const addresses = await provider.getAddresses();
       if (opts.json) {
         output({ addresses }, true);
@@ -39996,8 +40047,8 @@ ${qr3}`;
         throw new WalletError("VALIDATION_ERROR", "Provide --chain <key> or --all");
       }
       await ensureTrustSDK();
-      const password2 = await resolvePassword(opts);
-      const provider = await AgentWalletProvider.fromStorage(password2);
+      const password3 = await resolvePassword(opts);
+      const provider = await AgentWalletProvider.fromStorage(password3);
       const httpClient = await getClient();
       if (!opts.all) {
         const chain2 = getChainById(opts.chain);
@@ -40278,8 +40329,8 @@ ${qr3}`;
   ).option("--json", "JSON output").action(async (opts) => {
     try {
       await ensureTrustSDK();
-      const password2 = await resolvePassword(opts);
-      const provider = await AgentWalletProvider.fromStorage(password2);
+      const password3 = await resolvePassword(opts);
+      const provider = await AgentWalletProvider.fromStorage(password3);
       const httpClient = await getClient();
       const allAddresses = await provider.getAddresses();
       const chainsArg = opts.chains ?? Object.keys(CHAINS).join(",");
@@ -40393,8 +40444,8 @@ ${qr3}`;
         throw new WalletError("CHAIN_UNSUPPORTED", `Unknown chain: ${opts.chain}`);
       }
       await ensureTrustSDK();
-      const password2 = await resolvePassword(opts);
-      const provider = await AgentWalletProvider.fromStorage(password2);
+      const password3 = await resolvePassword(opts);
+      const provider = await AgentWalletProvider.fromStorage(password3);
       const address = await provider.getAddress(opts.chain);
       const signature = await provider.signMessage(opts.chain, opts.message);
       output({ chain: opts.chain, address, message: opts.message, signature }, opts.json);
@@ -40406,8 +40457,8 @@ ${qr3}`;
   wallet.command("register").description("Register wallet addresses with Trust Wallet backend (enables token holdings)").option("--password <password>", "Wallet password").option("--json", "JSON output").action(async (opts) => {
     try {
       const creds = await ensureTrustSDK();
-      const password2 = await resolvePassword(opts);
-      const provider = await AgentWalletProvider.fromStorage(password2);
+      const password3 = await resolvePassword(opts);
+      const provider = await AgentWalletProvider.fromStorage(password3);
       await registerWalletWithBackend(creds, provider);
       if (!opts.json) success("Wallet registered with backend");
       const addresses = await provider.getAddresses();
@@ -41009,8 +41060,8 @@ function registerTransferCommand(program3) {
   ).option("--json", "JSON output").action(async (opts) => {
     try {
       await ensureTrustSDK();
-      const password2 = await resolvePassword2(opts);
-      const provider = await AgentWalletProvider.fromStorage(password2);
+      const password3 = await resolvePassword2(opts);
+      const provider = await AgentWalletProvider.fromStorage(password3);
       let coinId;
       try {
         ({ coinId } = parseTokenId(opts.token));
@@ -41236,8 +41287,8 @@ function registerSwapCommand(program3) {
         let amberDomains = /* @__PURE__ */ new Map();
         if (needsWallet) {
           await ensureTrustSDK();
-          const password2 = await resolvePassword(opts);
-          provider = await AgentWalletProvider.fromStorage(password2);
+          const password3 = await resolvePassword(opts);
+          provider = await AgentWalletProvider.fromStorage(password3);
           walletAddress = await provider.getAddress(fromChain);
           if (toChain !== fromChain) {
             destinationAddress = await provider.getAddress(toChain);
@@ -41447,8 +41498,8 @@ function registerErc20Command(program3) {
   ).option("--json", "JSON output").action(async (opts) => {
     try {
       await ensureTrustSDK();
-      const password2 = await resolvePassword(opts);
-      const provider = await AgentWalletProvider.fromStorage(password2);
+      const password3 = await resolvePassword(opts);
+      const provider = await AgentWalletProvider.fromStorage(password3);
       let coinId;
       let contractAddress;
       try {
@@ -41514,8 +41565,8 @@ function registerErc20Command(program3) {
   ).option("--json", "JSON output").action(async (opts) => {
     try {
       await ensureTrustSDK();
-      const password2 = await resolvePassword(opts);
-      const provider = await AgentWalletProvider.fromStorage(password2);
+      const password3 = await resolvePassword(opts);
+      const provider = await AgentWalletProvider.fromStorage(password3);
       let coinId;
       let contractAddress;
       try {
@@ -42090,8 +42141,8 @@ function registerQueryCommand(program3) {
       }
       if (!opts.chain) {
         await ensureTrustSDK();
-        const password2 = await resolvePassword(opts);
-        const provider = await AgentWalletProvider.fromStorage(password2);
+        const password3 = await resolvePassword(opts);
+        const provider = await AgentWalletProvider.fromStorage(password3);
         const allAddresses = await provider.getAddresses();
         const addresses = allAddresses.map((wa2) => ({
           chain: wa2.chainId,
@@ -42115,8 +42166,8 @@ function registerQueryCommand(program3) {
       let address = opts.address;
       if (!address) {
         await ensureTrustSDK();
-        const password2 = await resolvePassword(opts);
-        const provider = await AgentWalletProvider.fromStorage(password2);
+        const password3 = await resolvePassword(opts);
+        const provider = await AgentWalletProvider.fromStorage(password3);
         address = await provider.getAddress(opts.chain);
       }
       const result = await service.getHistory({
@@ -42177,8 +42228,8 @@ function registerQueryCommand(program3) {
       if (!address) {
         try {
           await ensureTrustSDK();
-          const password2 = await resolvePassword(opts);
-          const provider = await AgentWalletProvider.fromStorage(password2);
+          const password3 = await resolvePassword(opts);
+          const provider = await AgentWalletProvider.fromStorage(password3);
           address = await provider.getAddress(opts.chain);
         } catch {
         }
@@ -56907,8 +56958,8 @@ function registerServeCommand(program3) {
     const blockchainClient = new BlockchainClient();
     let agentWallet;
     try {
-      const password2 = opts.password || process.env.TWAK_WALLET_PASSWORD || await new KeychainManager().getWalletPassword();
-      if (password2) agentWallet = await AgentWalletProvider.fromStorage(password2);
+      const password3 = opts.password || process.env.TWAK_WALLET_PASSWORD || await new KeychainManager().getWalletPassword();
+      if (password3) agentWallet = await AgentWalletProvider.fromStorage(password3);
     } catch {
     }
     let wallet;
@@ -57080,8 +57131,8 @@ async function resolveWalletAddress(opts, context) {
     );
   }
   await ensureTrustSDK();
-  const password2 = await resolvePassword({ password: opts.password });
-  const provider = await AgentWalletProvider.fromStorage(password2);
+  const password3 = await resolvePassword({ password: opts.password });
+  const provider = await AgentWalletProvider.fromStorage(password3);
   const address = await provider.getAddress(chainKey);
   info(`Using ${context} address ${address} on ${chainKey} (derived from your stored wallet).`);
   return address;
@@ -57301,8 +57352,8 @@ ${url}`);
   ).option("--json", "JSON output").action(async (opts) => {
     try {
       await ensureTrustSDK();
-      const password2 = await resolvePassword({ password: opts.password });
-      const provider = await AgentWalletProvider.fromStorage(password2);
+      const password3 = await resolvePassword({ password: opts.password });
+      const provider = await AgentWalletProvider.fromStorage(password3);
       let coinId;
       try {
         ({ coinId } = parseTokenId(opts.asset));
@@ -57701,8 +57752,8 @@ function registerX402Command(program3) {
     try {
       await validateX402Url(url);
       await ensureTrustSDK();
-      const password2 = await resolvePassword3(opts);
-      const provider = await AgentWalletProvider.fromStorage(password2);
+      const password3 = await resolvePassword3(opts);
+      const provider = await AgentWalletProvider.fromStorage(password3);
       const init3 = {
         method: opts.method.toUpperCase(),
         headers: { "Content-Type": "application/json", Accept: "application/json" },
@@ -57826,7 +57877,7 @@ var crypto7 = __toESM(require("crypto"));
 // package.json
 var package_default = {
   name: "@trustwallet/cli",
-  version: "0.12.1",
+  version: "0.12.2",
   description: "TWAK CLI \u2014 command-line interface for Trust Wallet Agent Kit",
   main: "dist/index.js",
   types: "dist/index.d.ts",
@@ -58034,8 +58085,8 @@ function registerWatchCommand(program3) {
       swapClient = new SwapClient(client);
       if (!opts.dryRun) {
         await ensureTrustSDK();
-        const password2 = await resolvePassword(opts);
-        provider = await AgentWalletProvider.fromStorage(password2);
+        const password3 = await resolvePassword(opts);
+        provider = await AgentWalletProvider.fromStorage(password3);
         if (opts.autoLock) {
           const minutes = parseInt(opts.autoLock, 10);
           if (isNaN(minutes) || minutes <= 0) {

package/dist/password.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Returns the comma-separated list of password-strength requirements that
+ * `pw` fails to meet (e.g. "include an uppercase letter, include a number"),
+ * or null if the password meets every rule.
+ *
+ * Callers prefix their own framing — e.g. "Password too weak: must <…>.",
+ * "Password must <…>.", "TWAK_WALLET_PASSWORD too weak: must <…>." — so each
+ * entry point keeps its own user-visible error wording while sharing the
+ * rule set.
+ */
+export declare function getPasswordWeaknesses(pw: string): string | null;
+//# sourceMappingURL=password.d.ts.map

package/dist/password.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../src/password.ts"],"names":[],"mappings":"AAaA;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAG/D"}

package/dist/setup/phase-wallet.d.ts

@@ -2,6 +2,7 @@ import type { SetupOptions } from './types';
 export type WalletChoice = '1' | '2' | '3';
 export interface WalletPrompter {
     selectWalletOption(): Promise<WalletChoice>;
+    promptWalletPassword(): Promise<string>;
 }
 export interface WalletCreator {
     create(password: string): Promise<{
@@ -22,7 +23,6 @@ export interface WalletPhaseDeps {
         deleteProbe(): Promise<void>;
     };
     env: NodeJS.ProcessEnv;
-    generatePassword: () => string;
 }
 export declare function runWalletPhase(opts: SetupOptions, deps?: WalletPhaseDeps): Promise<void>;
 //# sourceMappingURL=phase-wallet.d.ts.map

package/dist/setup/phase-wallet.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"phase-wallet.d.ts","sourceRoot":"","sources":["../../src/setup/phase-wallet.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE5C,MAAM,MAAM,YAAY,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;AAE3C,MAAM,WAAW,cAAc;IAC7B,kBAAkB,IAAI,OAAO,CAAC,YAAY,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC/D;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,cAAc,CAAC;IACzB,OAAO,EAAE;QAAE,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;IACxC,aAAa,EAAE,aAAa,CAAC;IAC7B,QAAQ,EAAE;QACR,WAAW,IAAI,OAAO,CAAC;QACvB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAMpD,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACxC,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;QACnC,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;KAC9B,CAAC;IACF,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,gBAAgB,EAAE,MAAM,MAAM,CAAC;CAChC;AA8DD,wBAAsB,cAAc,CAClC,IAAI,EAAE,YAAY,EAClB,IAAI,GAAE,eAAmC,GACxC,OAAO,CAAC,IAAI,CAAC,CAyBf"}
+{"version":3,"file":"phase-wallet.d.ts","sourceRoot":"","sources":["../../src/setup/phase-wallet.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE5C,MAAM,MAAM,YAAY,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;AAI3C,MAAM,WAAW,cAAc;IAC7B,kBAAkB,IAAI,OAAO,CAAC,YAAY,CAAC,CAAC;IAM5C,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC/D;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,cAAc,CAAC;IACzB,OAAO,EAAE;QAAE,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;IACxC,aAAa,EAAE,aAAa,CAAC;IAC7B,QAAQ,EAAE;QACR,WAAW,IAAI,OAAO,CAAC;QACvB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAMpD,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACxC,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;QACnC,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;KAC9B,CAAC;IACF,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;CACxB;AAwFD,wBAAsB,cAAc,CAClC,IAAI,EAAE,YAAY,EAClB,IAAI,GAAE,eAAmC,GACxC,OAAO,CAAC,IAAI,CAAC,CAyBf"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trustwallet/cli",
-  "version": "0.12.1",
+  "version": "0.12.2",
   "description": "TWAK CLI — command-line interface for Trust Wallet Agent Kit",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -32,17 +32,17 @@
     "tsup": "8.5.1",
     "typescript": "5.7.3",
     "vitest": "4.1.2",
-    "@twak/actions": "0.12.1",
-    "@twak/blockchain": "0.12.1",
-    "@twak/core": "0.12.1",
-    "@twak/mcp": "0.12.1",
-    "@twak/security": "0.12.1",
-    "@twak/storage": "0.12.1",
-    "@twak/swap": "0.12.1",
-    "@twak/transactions": "0.12.1",
-    "@twak/wallet": "0.12.1",
-    "@twak/wallet-core": "0.12.1",
-    "@twak/walletconnect": "0.12.1"
+    "@twak/actions": "0.12.2",
+    "@twak/core": "0.12.2",
+    "@twak/blockchain": "0.12.2",
+    "@twak/mcp": "0.12.2",
+    "@twak/swap": "0.12.2",
+    "@twak/wallet": "0.12.2",
+    "@twak/transactions": "0.12.2",
+    "@twak/wallet-core": "0.12.2",
+    "@twak/walletconnect": "0.12.2",
+    "@twak/storage": "0.12.2",
+    "@twak/security": "0.12.2"
   },
   "publishConfig": {
     "access": "public"