@wlfi-agent/cli 1.4.13 → 1.4.14

package/src/lib/wallet-profile.js

@@ -0,0 +1 @@
+export * from './wallet-profile.ts';

package/src/lib/wallet-profile.ts

@@ -0,0 +1,332 @@
+import { resolveChainProfile, type WalletProfile, type WlfiConfig } from '../../packages/config/src/index.js';
+import type { Address, Hex } from 'viem';
+import { isAddress } from 'viem';
+import { publicKeyToAddress } from 'viem/accounts';
+import { listAutoGeneratedBootstrapArtifacts } from './bootstrap-artifacts.js';
+import {
+  readBootstrapSetupSummaryFile,
+  type BootstrapSetupSummary,
+} from './bootstrap-credentials.js';
+
+function presentString(value: string | undefined | null): string | undefined {
+  const normalized = value?.trim();
+  return normalized ? normalized : undefined;
+}
+
+function renderError(error: unknown): string {
+  return error instanceof Error ? error.message : String(error);
+}
+
+function normalizePublicKeyHex(value: string): Hex {
+  const normalized = value.trim();
+  return (normalized.startsWith('0x') ? normalized : `0x${normalized}`) as Hex;
+}
+
+function deriveWalletAddress(vaultPublicKey: string): string | undefined {
+  try {
+    return publicKeyToAddress(normalizePublicKeyHex(vaultPublicKey));
+  } catch {
+    return undefined;
+  }
+}
+
+function findMatchingBootstrapSummary(profile: WalletProfile | undefined): BootstrapSetupSummary | undefined {
+  if (!profile) {
+    return undefined;
+  }
+
+  const persistedAgentKeyId = presentString(profile.agentKeyId);
+  const persistedPublicKey = presentString(profile.vaultPublicKey);
+  const persistedAddress = presentString(profile.address) ?? (
+    persistedPublicKey ? deriveWalletAddress(persistedPublicKey) : undefined
+  );
+
+  return listAutoGeneratedBootstrapArtifacts()
+    .filter(
+      (artifact) =>
+        (artifact.status === 'plaintext' || artifact.status === 'redacted') && !artifact.leaseExpired,
+    )
+    .map((artifact) => readBootstrapSetupSummaryFile(artifact.path))
+    .find((summary) => {
+      if (persistedAgentKeyId && summary.agentKeyId === persistedAgentKeyId) {
+        return true;
+      }
+
+      if (persistedPublicKey && summary.vaultPublicKey === persistedPublicKey) {
+        return true;
+      }
+
+      const summaryAddress = deriveWalletAddress(summary.vaultPublicKey);
+      return Boolean(persistedAddress && summaryAddress && summaryAddress === persistedAddress);
+    });
+}
+
+export function walletProfileFromBootstrapSummary(summary: BootstrapSetupSummary): WalletProfile {
+  return {
+    vaultKeyId: presentString(summary.vaultKeyId) ?? summary.vaultKeyId,
+    vaultPublicKey: presentString(summary.vaultPublicKey) ?? summary.vaultPublicKey,
+    address: deriveWalletAddress(summary.vaultPublicKey),
+    agentKeyId: presentString(summary.agentKeyId),
+    policyAttachment: presentString(summary.policyAttachment) ?? summary.policyAttachment,
+    attachedPolicyIds: summary.attachedPolicyIds.length > 0 ? [...summary.attachedPolicyIds] : undefined,
+    policyNote: presentString(summary.policyNote),
+    networkScope: presentString(summary.networkScope),
+    assetScope: presentString(summary.assetScope),
+    recipientScope: presentString(summary.recipientScope),
+  };
+}
+
+export function resolveWalletProfile(config: WlfiConfig): WalletProfile {
+  if (config.wallet?.vaultPublicKey && config.wallet?.policyAttachment) {
+    const matchingBootstrap = findMatchingBootstrapSummary(config.wallet);
+    return {
+      ...config.wallet,
+      vaultKeyId: config.wallet.vaultKeyId ?? matchingBootstrap?.vaultKeyId,
+      address: config.wallet.address ?? deriveWalletAddress(config.wallet.vaultPublicKey),
+    };
+  }
+
+  const bootstrapArtifact = listAutoGeneratedBootstrapArtifacts().find(
+    (artifact) =>
+      (artifact.status === 'plaintext' || artifact.status === 'redacted') && !artifact.leaseExpired,
+  );
+  if (!bootstrapArtifact) {
+    throw new Error(
+      'wallet metadata is unavailable; rerun `wlfi-agent admin setup` or import a bootstrap file first',
+    );
+  }
+
+  return walletProfileFromBootstrapSummary(readBootstrapSetupSummaryFile(bootstrapArtifact.path));
+}
+
+export function resolveWalletAddress(config: WlfiConfig): Address {
+  const profile = resolveWalletProfile(config);
+  const address = presentString(profile.address) ?? deriveWalletAddress(profile.vaultPublicKey);
+  if (!address || !isAddress(address)) {
+    throw new Error(
+      'wallet address is unavailable; rerun `wlfi-agent admin setup` or import a bootstrap file first',
+    );
+  }
+
+  return address;
+}
+
+export interface WalletBalanceEntry {
+  tokenKey: string;
+  symbol: string;
+  name?: string;
+  chainKey: string;
+  chainName: string;
+  chainId: number;
+  rpcUrl: string;
+  kind: 'native' | 'erc20';
+  tokenAddress: string;
+  decimals: number;
+  balance?: {
+    raw: string;
+    formatted: string;
+  };
+  error?: string;
+}
+
+export interface WalletProfileWithBalances extends WalletProfile {
+  balances: WalletBalanceEntry[];
+}
+
+interface ResolveWalletProfileWithBalancesDeps {
+  getNativeBalance: (rpcUrl: string, address: Address) => Promise<{
+    raw: bigint;
+    formatted: string;
+  }>;
+  getTokenBalance: (rpcUrl: string, token: Address, owner: Address, decimals?: number) => Promise<{
+    raw: bigint;
+    decimals: number;
+    name: string | null;
+    symbol: string | null;
+    formatted: string;
+  }>;
+}
+
+interface WalletBalanceTarget {
+  tokenKey: string;
+  symbol: string;
+  name?: string;
+  chainKey: string;
+  chainName: string;
+  chainId: number;
+  rpcUrl: string;
+  isNative: boolean;
+  tokenAddress: string;
+  decimals: number;
+}
+
+function collectWalletBalanceTargets(config: WlfiConfig): WalletBalanceTarget[] {
+  return Object.entries(config.tokens ?? {})
+    .flatMap(([tokenKey, tokenProfile]) =>
+      Object.entries(tokenProfile.chains ?? {}).flatMap(([chainKey, chainProfile]) => {
+        const resolvedChain = resolveChainProfile(chainKey, config);
+        const rpcUrl = presentString(resolvedChain?.rpcUrl);
+        if (!rpcUrl) {
+          return [];
+        }
+
+        return [{
+          tokenKey,
+          symbol: tokenProfile.symbol,
+          name: tokenProfile.name,
+          chainKey,
+          chainName: resolvedChain?.name ?? chainKey,
+          chainId: chainProfile.chainId,
+          rpcUrl,
+          isNative: chainProfile.isNative,
+          tokenAddress: chainProfile.isNative
+            ? 'native'
+            : presentString(chainProfile.address) ?? '',
+          decimals: chainProfile.decimals,
+        }];
+      }),
+    )
+    .sort(
+      (left, right) =>
+        left.chainId - right.chainId
+        || left.chainKey.localeCompare(right.chainKey)
+        || left.symbol.localeCompare(right.symbol)
+        || left.tokenKey.localeCompare(right.tokenKey),
+    );
+}
+
+export async function resolveWalletProfileWithBalances(
+  config: WlfiConfig,
+  deps: ResolveWalletProfileWithBalancesDeps,
+): Promise<WalletProfileWithBalances> {
+  const profile = resolveWalletProfile(config);
+  const owner = resolveWalletAddress(config);
+  const nativeBalance = deps.getNativeBalance;
+  const erc20Balance = deps.getTokenBalance;
+
+  const balances = await Promise.all(
+    collectWalletBalanceTargets(config).map(async (target): Promise<WalletBalanceEntry> => {
+      if (target.isNative) {
+        try {
+          const balance = await nativeBalance(target.rpcUrl, owner);
+          return {
+            tokenKey: target.tokenKey,
+            symbol: target.symbol,
+            name: target.name,
+            chainKey: target.chainKey,
+            chainName: target.chainName,
+            chainId: target.chainId,
+            rpcUrl: target.rpcUrl,
+            kind: 'native',
+            tokenAddress: target.tokenAddress,
+            decimals: target.decimals,
+            balance: {
+              raw: balance.raw.toString(),
+              formatted: balance.formatted,
+            },
+          };
+        } catch (error) {
+          return {
+            tokenKey: target.tokenKey,
+            symbol: target.symbol,
+            name: target.name,
+            chainKey: target.chainKey,
+            chainName: target.chainName,
+            chainId: target.chainId,
+            rpcUrl: target.rpcUrl,
+            kind: 'native',
+            tokenAddress: target.tokenAddress,
+            decimals: target.decimals,
+            error: renderError(error),
+          };
+        }
+      }
+
+      if (!isAddress(target.tokenAddress)) {
+        return {
+          tokenKey: target.tokenKey,
+          symbol: target.symbol,
+          name: target.name,
+          chainKey: target.chainKey,
+          chainName: target.chainName,
+          chainId: target.chainId,
+          rpcUrl: target.rpcUrl,
+          kind: 'erc20',
+          tokenAddress: target.tokenAddress || '<unset>',
+          decimals: target.decimals,
+          error: `configured token address for ${target.tokenKey} on ${target.chainKey} is invalid`,
+        };
+      }
+
+      try {
+        const balance = await erc20Balance(target.rpcUrl, target.tokenAddress as Address, owner, target.decimals);
+        return {
+          tokenKey: target.tokenKey,
+          symbol: balance.symbol ?? target.symbol,
+          name: balance.name ?? target.name,
+          chainKey: target.chainKey,
+          chainName: target.chainName,
+          chainId: target.chainId,
+          rpcUrl: target.rpcUrl,
+          kind: 'erc20',
+          tokenAddress: target.tokenAddress,
+          decimals: balance.decimals,
+          balance: {
+            raw: balance.raw.toString(),
+            formatted: balance.formatted,
+          },
+        };
+      } catch (error) {
+        return {
+          tokenKey: target.tokenKey,
+          symbol: target.symbol,
+          name: target.name,
+          chainKey: target.chainKey,
+          chainName: target.chainName,
+          chainId: target.chainId,
+          rpcUrl: target.rpcUrl,
+          kind: 'erc20',
+          tokenAddress: target.tokenAddress,
+          decimals: target.decimals,
+          error: renderError(error),
+        };
+      }
+    }),
+  );
+
+  return {
+    ...profile,
+    balances,
+  };
+}
+
+export function formatWalletProfileText(profile: WalletProfile | WalletProfileWithBalances): string {
+  const lines = [
+    `Public Key: ${profile.vaultPublicKey}`,
+    profile.address ? `Address: ${profile.address}` : null,
+    profile.agentKeyId ? `Agent Key ID: ${profile.agentKeyId}` : null,
+    `Policy Attachment: ${profile.policyAttachment}`,
+    profile.policyNote ? `Policy Note: ${profile.policyNote}` : null,
+    profile.networkScope ? `Network Scope: ${profile.networkScope}` : null,
+    profile.assetScope ? `Asset Scope: ${profile.assetScope}` : null,
+    profile.recipientScope ? `Recipient Scope: ${profile.recipientScope}` : null,
+    profile.attachedPolicyIds?.length
+      ? `Attached Policy IDs: ${profile.attachedPolicyIds.join(', ')}`
+      : null,
+  ];
+
+  if ('balances' in profile && Array.isArray(profile.balances) && profile.balances.length > 0) {
+    lines.push('Balances:');
+    lines.push(
+      ...profile.balances.map((balance) => {
+        const label = `${balance.symbol} on ${balance.chainKey} (${balance.chainId})`;
+        if (balance.error) {
+          return `- ${label}: error: ${balance.error}`;
+        }
+        return `- ${label}: ${balance.balance?.formatted ?? '0'}`;
+      }),
+    );
+  }
+
+  return lines.filter((line): line is string => Boolean(line)).join('\n');
+}

package/src/lib/wallet-repair.js

@@ -0,0 +1 @@
+export * from './wallet-repair.ts';

package/src/lib/wallet-repair.ts

@@ -0,0 +1,304 @@
+import { readConfig, type WlfiConfig } from '../../packages/config/src/index.js';
+import {
+  type MigrateLegacyAgentAuthInput,
+  type MigrateLegacyAgentAuthResult,
+  migrateLegacyAgentAuthToken,
+} from './agent-auth-migrate.js';
+import {
+  type BootstrapArtifactCheck,
+  cleanupAutoGeneratedBootstrapArtifacts,
+} from './bootstrap-artifacts.js';
+import { assertValidAgentKeyId } from './keychain.js';
+import { getWalletStatus, type WalletStatusResult } from './wallet-status.js';
+
+export interface RepairWalletStateOptions {
+  agentKeyId?: string;
+  overwriteKeychain?: boolean;
+  redactBootstrap?: boolean;
+}
+
+export interface WalletRepairLegacyAgentAuthResult {
+  attempted: boolean;
+  action: 'none' | 'migrated' | 'scrubbed-config' | 'skipped';
+  agentKeyId: string | null;
+  reason: string | null;
+  keychain: {
+    service: string | null;
+    stored: boolean;
+    overwritten: boolean;
+    alreadyPresent: boolean;
+    matchedExisting: boolean;
+  } | null;
+}
+
+export interface WalletRepairBootstrapArtifactsResult {
+  attempted: boolean;
+  action: 'deleted' | 'redacted';
+  wlfiHome: string | null;
+  files: Array<
+    BootstrapArtifactCheck & {
+      cleanup: 'deleted' | 'redacted' | 'skipped';
+    }
+  >;
+  error: string | null;
+}
+
+export interface WalletRepairResult {
+  before: WalletStatusResult;
+  after: WalletStatusResult;
+  legacyAgentAuth: WalletRepairLegacyAgentAuthResult;
+  bootstrapArtifacts: WalletRepairBootstrapArtifactsResult;
+  fixedWarnings: string[];
+  remainingWarnings: string[];
+  newWarnings: string[];
+}
+
+interface RepairWalletStateDeps {
+  platform?: NodeJS.Platform;
+  readConfig?: () => WlfiConfig;
+  getWalletStatus?: () => WalletStatusResult;
+  migrateLegacyAgentAuthToken?: (
+    input: MigrateLegacyAgentAuthInput,
+  ) => MigrateLegacyAgentAuthResult;
+  cleanupAutoGeneratedBootstrapArtifacts?: (action: 'deleted' | 'redacted') => {
+    wlfiHome: string;
+    action: 'deleted' | 'redacted';
+    files: Array<
+      BootstrapArtifactCheck & {
+        cleanup: 'deleted' | 'redacted' | 'skipped';
+      }
+    >;
+  };
+}
+
+function renderError(error: unknown): string {
+  return error instanceof Error ? error.message : String(error);
+}
+
+function presentSecret(value: string | undefined): string | null {
+  if (typeof value !== 'string') {
+    return null;
+  }
+
+  return value.trim().length > 0 ? value : null;
+}
+
+function resolveResultAgentKeyId(
+  explicitAgentKeyId: string | undefined,
+  status: WalletStatusResult,
+): string | null {
+  if (explicitAgentKeyId) {
+    return explicitAgentKeyId;
+  }
+
+  return status.agent.agentKeyId;
+}
+
+function describeLegacyMigration(result: MigrateLegacyAgentAuthResult): string {
+  if (!result.keychain.stored) {
+    return 'matching macOS Keychain token already existed, so plaintext config storage was scrubbed';
+  }
+
+  if (result.keychain.overwritten) {
+    return 'legacy config secret replaced a different macOS Keychain token after explicit confirmation, then plaintext config storage was scrubbed';
+  }
+
+  return 'legacy config secret was moved into macOS Keychain and scrubbed from plaintext config storage';
+}
+
+function repairLegacyAgentAuth(
+  input: RepairWalletStateOptions,
+  before: WalletStatusResult,
+  deps: RepairWalletStateDeps,
+): WalletRepairLegacyAgentAuthResult {
+  const platform = deps.platform ?? process.platform;
+  const loadConfig = deps.readConfig ?? readConfig;
+  const migrate = deps.migrateLegacyAgentAuthToken ?? migrateLegacyAgentAuthToken;
+  const explicitAgentKeyId = input.agentKeyId ? assertValidAgentKeyId(input.agentKeyId) : undefined;
+
+  let config: WlfiConfig;
+  try {
+    config = loadConfig();
+  } catch (error) {
+    return {
+      attempted: false,
+      action: 'skipped',
+      agentKeyId: resolveResultAgentKeyId(explicitAgentKeyId, before),
+      reason: `config is unreadable: ${renderError(error)}`,
+      keychain: null,
+    };
+  }
+
+  if (!presentSecret(config.agentAuthToken)) {
+    return {
+      attempted: false,
+      action: 'none',
+      agentKeyId: resolveResultAgentKeyId(explicitAgentKeyId, before),
+      reason: null,
+      keychain: null,
+    };
+  }
+
+  if (platform !== 'darwin') {
+    return {
+      attempted: false,
+      action: 'skipped',
+      agentKeyId: resolveResultAgentKeyId(explicitAgentKeyId, before),
+      reason:
+        'legacy agentAuthToken cannot be repaired automatically without macOS Keychain access',
+      keychain: null,
+    };
+  }
+
+  try {
+    const result = migrate({
+      agentKeyId: explicitAgentKeyId,
+      overwriteKeychain: input.overwriteKeychain,
+    });
+    return {
+      attempted: true,
+      action: result.keychain.stored ? 'migrated' : 'scrubbed-config',
+      agentKeyId: result.agentKeyId,
+      reason: describeLegacyMigration(result),
+      keychain: {
+        service: result.keychain.service,
+        stored: result.keychain.stored,
+        overwritten: result.keychain.overwritten,
+        alreadyPresent: result.keychain.alreadyPresent,
+        matchedExisting: result.keychain.matchedExisting,
+      },
+    };
+  } catch (error) {
+    return {
+      attempted: true,
+      action: 'skipped',
+      agentKeyId: resolveResultAgentKeyId(explicitAgentKeyId, before),
+      reason: renderError(error),
+      keychain: null,
+    };
+  }
+}
+
+function repairBootstrapArtifacts(
+  input: RepairWalletStateOptions,
+  deps: RepairWalletStateDeps,
+): WalletRepairBootstrapArtifactsResult {
+  const cleanup =
+    deps.cleanupAutoGeneratedBootstrapArtifacts ?? cleanupAutoGeneratedBootstrapArtifacts;
+  const action = input.redactBootstrap ? 'redacted' : 'deleted';
+
+  try {
+    const result = cleanup(action);
+    return {
+      attempted: true,
+      action: result.action,
+      wlfiHome: result.wlfiHome,
+      files: result.files,
+      error: null,
+    };
+  } catch (error) {
+    return {
+      attempted: true,
+      action,
+      wlfiHome: null,
+      files: [],
+      error: renderError(error),
+    };
+  }
+}
+
+function summarizeLegacyAgentAuth(result: WalletRepairLegacyAgentAuthResult): string {
+  switch (result.action) {
+    case 'none':
+      return 'no plaintext config token was present';
+    case 'migrated':
+      return `migrated for ${result.agentKeyId ?? '<unknown>'}`;
+    case 'scrubbed-config':
+      return `scrubbed plaintext config storage for ${result.agentKeyId ?? '<unknown>'}`;
+    case 'skipped':
+      return result.reason ? `skipped: ${result.reason}` : 'skipped';
+    default:
+      return result.reason ?? result.action;
+  }
+}
+
+function summarizeBootstrapArtifacts(result: WalletRepairBootstrapArtifactsResult): string {
+  if (result.error) {
+    return `cleanup failed: ${result.error}`;
+  }
+  if (result.files.length === 0) {
+    return 'no auto-generated bootstrap files found';
+  }
+
+  const deleted = result.files.filter((file) => file.cleanup === 'deleted').length;
+  const redacted = result.files.filter((file) => file.cleanup === 'redacted').length;
+  const skipped = result.files.filter((file) => file.cleanup === 'skipped').length;
+  const parts = [`${deleted} deleted`, `${redacted} redacted`];
+  if (skipped > 0) {
+    parts.push(`${skipped} skipped`);
+  }
+  return parts.join(', ');
+}
+
+export function formatWalletRepairText(result: WalletRepairResult): string {
+  const lines = [
+    'wallet repair complete',
+    `legacy agent auth: ${summarizeLegacyAgentAuth(result.legacyAgentAuth)}`,
+    `bootstrap artifacts: ${summarizeBootstrapArtifacts(result.bootstrapArtifacts)}`,
+  ];
+
+  if (result.fixedWarnings.length === 0) {
+    lines.push('fixed warnings: none');
+  } else {
+    lines.push(`fixed warnings (${result.fixedWarnings.length}):`);
+    for (const warning of result.fixedWarnings) {
+      lines.push(`- ${warning}`);
+    }
+  }
+
+  if (result.remainingWarnings.length === 0) {
+    lines.push('remaining warnings: none');
+  } else {
+    lines.push(`remaining warnings (${result.remainingWarnings.length}):`);
+    for (const warning of result.remainingWarnings) {
+      lines.push(`- ${warning}`);
+    }
+  }
+
+  if (result.newWarnings.length > 0) {
+    lines.push(`new warnings (${result.newWarnings.length}):`);
+    for (const warning of result.newWarnings) {
+      lines.push(`- ${warning}`);
+    }
+  }
+
+  return lines.join('\n');
+}
+
+export function repairWalletState(
+  input: RepairWalletStateOptions = {},
+  deps: RepairWalletStateDeps = {},
+): WalletRepairResult {
+  const readStatus = deps.getWalletStatus ?? getWalletStatus;
+  const before = readStatus();
+  const legacyAgentAuth = repairLegacyAgentAuth(input, before, deps);
+  const bootstrapArtifacts = repairBootstrapArtifacts(input, deps);
+  const after = readStatus();
+
+  const fixedWarnings = before.security.warnings.filter(
+    (warning) => !after.security.warnings.includes(warning),
+  );
+  const newWarnings = after.security.warnings.filter(
+    (warning) => !before.security.warnings.includes(warning),
+  );
+
+  return {
+    before,
+    after,
+    legacyAgentAuth,
+    bootstrapArtifacts,
+    fixedWarnings,
+    remainingWarnings: after.security.warnings,
+    newWarnings,
+  };
+}

package/src/lib/wallet-setup.js

@@ -0,0 +1 @@
+export * from './wallet-setup.ts';