@xylabs/aries 0.1.1

package/dist/commands/walletUnlockCommand.mjs

@@ -0,0 +1,308 @@
+// src/actions/wallet/paths.ts
+import OS from "os";
+import PATH from "path";
+function walletRoot() {
+  const override = process.env.ARIES_WALLET_HOME;
+  if (override) return override;
+  return PATH.join(OS.homedir(), ".aries", "wallet");
+}
+function walletPaths(root = walletRoot()) {
+  return {
+    root,
+    password: PATH.join(root, "password.json"),
+    phrases: PATH.join(root, "phrases.json"),
+    active: PATH.join(root, "active.json"),
+    addressBooks: PATH.join(root, "address-books.json"),
+    contacts: PATH.join(root, "contacts.json"),
+    networks: PATH.join(root, "networks.json"),
+    session: PATH.join(root, "session.json"),
+    machineId: PATH.join(root, ".machine-id")
+  };
+}
+
+// src/actions/wallet/storage.ts
+import FS from "fs";
+import PATH2 from "path";
+function ensureWalletDir(root = walletRoot()) {
+  if (!FS.existsSync(root)) {
+    FS.mkdirSync(root, { recursive: true, mode: 448 });
+    return;
+  }
+  try {
+    FS.chmodSync(root, 448);
+  } catch {
+  }
+}
+function readJsonFile(file) {
+  if (!FS.existsSync(file)) return void 0;
+  const raw = FS.readFileSync(file, "utf8");
+  if (raw.trim().length === 0) return void 0;
+  return JSON.parse(raw);
+}
+function writeJsonFile(file, value) {
+  ensureWalletDir(PATH2.dirname(file));
+  const tmp = `${file}.tmp`;
+  FS.writeFileSync(tmp, `${JSON.stringify(value, null, 2)}
+`, { mode: 384 });
+  FS.renameSync(tmp, file);
+  try {
+    FS.chmodSync(file, 384);
+  } catch {
+  }
+}
+
+// src/actions/wallet/prompt.ts
+import { execFileSync } from "child_process";
+import {
+  closeSync,
+  openSync,
+  readSync,
+  writeSync
+} from "fs";
+var CTRL_C = 3;
+var ENTER = 13;
+var NEWLINE = 10;
+var BACKSPACE_DELETE = 127;
+var BACKSPACE = 8;
+function readChars(readFd, writeFd, mask) {
+  const chars = [];
+  const buf = Buffer.alloc(1);
+  for (; ; ) {
+    const bytes = readSync(readFd, buf, 0, 1, null);
+    if (bytes === 0) break;
+    const ch = buf[0];
+    if (ch === ENTER || ch === NEWLINE) break;
+    if (ch === CTRL_C) {
+      writeSync(writeFd, "\n");
+      throw new Error("Aborted");
+    }
+    if (ch === BACKSPACE_DELETE || ch === BACKSPACE) {
+      if (chars.length > 0) {
+        chars.pop();
+        writeSync(writeFd, "\b \b");
+      }
+      continue;
+    }
+    chars.push(ch);
+    writeSync(writeFd, mask ? "*" : String.fromCodePoint(ch));
+  }
+  writeSync(writeFd, "\n");
+  return Buffer.from(chars).toString("utf8");
+}
+function saveStty(readFd) {
+  try {
+    return execFileSync("stty", ["-g"], {
+      stdio: [readFd, "pipe", "ignore"],
+      encoding: "utf8"
+    }).trim();
+  } catch {
+    return void 0;
+  }
+}
+function applyStty(readFd, args) {
+  try {
+    execFileSync("stty", args, { stdio: [readFd, "ignore", "ignore"] });
+  } catch {
+  }
+}
+function promptTty(options) {
+  const readFd = openSync("/dev/tty", "r");
+  const writeFd = openSync("/dev/tty", "w");
+  const saved = saveStty(readFd);
+  try {
+    if (saved) applyStty(readFd, ["-echo", "-icanon", "min", "1", "time", "0"]);
+    writeSync(writeFd, options.prompt);
+    return readChars(readFd, writeFd, options.mask === true);
+  } finally {
+    if (saved) applyStty(readFd, [saved]);
+    try {
+      closeSync(readFd);
+    } catch {
+    }
+    try {
+      closeSync(writeFd);
+    } catch {
+    }
+  }
+}
+function promptPassword(prompt = "Password: ") {
+  const env = process.env.ARIES_WALLET_PASSWORD;
+  if (env !== void 0 && env.length > 0) return env;
+  return promptTty({ prompt, mask: true });
+}
+
+// src/actions/wallet/session/sessionCache.ts
+import { webcrypto as webcrypto3 } from "crypto";
+
+// src/actions/wallet/passwordKey.ts
+import { webcrypto } from "crypto";
+var subtle = webcrypto.subtle;
+var INITIALIZATION_VECTOR_LENGTH = 12;
+var PBKDF2_ITERATIONS = 1e5;
+var SALT_BYTES = 16;
+var PasswordKey = class _PasswordKey {
+  password;
+  salt;
+  constructor(password, salt = _PasswordKey.generateSalt()) {
+    this.password = password;
+    this.salt = salt;
+  }
+  static async decryptString(key, data) {
+    const encryptedData = new Uint8Array(Buffer.from(data, "base64"));
+    const iv = encryptedData.slice(0, INITIALIZATION_VECTOR_LENGTH);
+    const ciphertext = encryptedData.slice(INITIALIZATION_VECTOR_LENGTH);
+    const decrypted = await subtle.decrypt({ name: "AES-GCM", iv }, key, ciphertext);
+    return new TextDecoder("utf-8").decode(decrypted);
+  }
+  static async encryptString(key, data) {
+    const iv = webcrypto.getRandomValues(new Uint8Array(INITIALIZATION_VECTOR_LENGTH));
+    const ciphertext = await subtle.encrypt({ name: "AES-GCM", iv }, key, new TextEncoder().encode(data));
+    const combined = new Uint8Array(iv.length + ciphertext.byteLength);
+    combined.set(iv, 0);
+    combined.set(new Uint8Array(ciphertext), iv.length);
+    return Buffer.from(combined).toString("base64");
+  }
+  static generateSalt() {
+    const array = new Uint8Array(SALT_BYTES);
+    webcrypto.getRandomValues(array);
+    return [...array].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+  }
+  static async getHashFromKey(key) {
+    const exported = await subtle.exportKey("raw", key);
+    const digest = await subtle.digest("SHA-256", exported);
+    return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+  }
+  static async importEncryptionKey(rawKey) {
+    return await subtle.importKey("raw", rawKey, { name: "AES-GCM" }, false, ["encrypt", "decrypt"]);
+  }
+  static async importExtractableKey(rawKey) {
+    return await subtle.importKey("raw", rawKey, { name: "AES-GCM" }, true, ["encrypt", "decrypt"]);
+  }
+  static async serializeKey(key, salt = _PasswordKey.generateSalt()) {
+    const hash = await _PasswordKey.getHashFromKey(key);
+    return { hash, salt };
+  }
+  async deriveKey() {
+    const encoder = new TextEncoder();
+    const passphraseKey = await subtle.importKey(
+      "raw",
+      encoder.encode(this.password),
+      { name: "PBKDF2" },
+      false,
+      ["deriveKey"]
+    );
+    return await subtle.deriveKey(
+      {
+        name: "PBKDF2",
+        salt: encoder.encode(this.salt),
+        iterations: PBKDF2_ITERATIONS,
+        hash: "SHA-256"
+      },
+      passphraseKey,
+      { name: "AES-GCM", length: 256 },
+      true,
+      ["encrypt", "decrypt"]
+    );
+  }
+};
+async function encryptWithKey(key, data) {
+  const exported = await subtle.exportKey("raw", key);
+  const encKey = await PasswordKey.importEncryptionKey(exported);
+  return await PasswordKey.encryptString(encKey, data);
+}
+
+// src/actions/wallet/session/machineId.ts
+import { webcrypto as webcrypto2 } from "crypto";
+import FS2 from "fs";
+import OS2 from "os";
+function generateMachineSecret() {
+  const bytes = new Uint8Array(32);
+  webcrypto2.getRandomValues(bytes);
+  return [...bytes].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+function loadMachineSecret() {
+  ensureWalletDir();
+  const path = walletPaths().machineId;
+  if (FS2.existsSync(path)) {
+    return FS2.readFileSync(path, "utf8").trim();
+  }
+  const secret = generateMachineSecret();
+  FS2.writeFileSync(path, `${secret}
+`, { mode: 384 });
+  try {
+    FS2.chmodSync(path, 384);
+  } catch {
+  }
+  return secret;
+}
+async function deriveMachineKey() {
+  const secret = loadMachineSecret();
+  const stable = `${OS2.hostname()}:${OS2.userInfo().username}:${secret}`;
+  const passwordKey = new PasswordKey(stable, "aries-wallet-machine-kek-v1");
+  return await passwordKey.deriveKey();
+}
+
+// src/actions/wallet/session/sessionCache.ts
+var subtle2 = webcrypto3.subtle;
+var DEFAULT_SESSION_TTL_SECONDS = 15 * 60;
+async function unlockSession(passwordKey, ttlSeconds = DEFAULT_SESSION_TTL_SECONDS) {
+  const machineKey = await deriveMachineKey();
+  const exported = await subtle2.exportKey("raw", passwordKey);
+  const exportedBase64 = Buffer.from(new Uint8Array(exported)).toString("base64");
+  const encryptedKey = await encryptWithKey(machineKey, exportedBase64);
+  const expiresAt = Date.now() + ttlSeconds * 1e3;
+  const data = { encryptedKey, expiresAt };
+  writeJsonFile(walletPaths().session, data);
+  return expiresAt;
+}
+
+// src/actions/wallet/password/passwordStorage.ts
+function readPassword() {
+  return readJsonFile(walletPaths().password);
+}
+function hasPassword() {
+  return readPassword() !== void 0;
+}
+
+// src/actions/wallet/password/validatePassword.ts
+async function validatePassword(password) {
+  const stored = readPassword();
+  if (!stored) return void 0;
+  const passwordKey = new PasswordKey(password, stored.salt);
+  const key = await passwordKey.deriveKey();
+  const hash = await PasswordKey.getHashFromKey(key);
+  if (hash !== stored.hash) return void 0;
+  return key;
+}
+
+// src/actions/wallet/session/unlock.ts
+import chalk from "chalk";
+async function unlock(options = {}) {
+  if (!hasPassword()) {
+    throw new Error("Wallet not initialized. Run `aries wallet create` or `aries wallet import` first.");
+  }
+  const password = promptPassword("Wallet password: ");
+  const key = await validatePassword(password);
+  if (!key) throw new Error("Incorrect password.");
+  const ttl = options.ttl ?? DEFAULT_SESSION_TTL_SECONDS;
+  const expiresAt = await unlockSession(key, ttl);
+  console.log(chalk.green(`Wallet unlocked. Session expires ${new Date(expiresAt).toISOString()}.`));
+}
+
+// src/commands/walletUnlockCommand.ts
+var walletUnlockCommand = {
+  command: "unlock",
+  describe: "Cache the wallet password (encrypted at rest) for a TTL",
+  builder: (yargs) => yargs.option("ttl", {
+    type: "number",
+    default: 900,
+    describe: "Session lifetime in seconds (default 900 = 15 min)"
+  }),
+  handler: async (argv) => {
+    await unlock({ ttl: argv.ttl });
+  }
+};
+export {
+  walletUnlockCommand
+};
+//# sourceMappingURL=walletUnlockCommand.mjs.map

package/dist/commands/walletUnlockCommand.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/actions/wallet/paths.ts","../../src/actions/wallet/storage.ts","../../src/actions/wallet/prompt.ts","../../src/actions/wallet/session/sessionCache.ts","../../src/actions/wallet/passwordKey.ts","../../src/actions/wallet/session/machineId.ts","../../src/actions/wallet/password/passwordStorage.ts","../../src/actions/wallet/password/validatePassword.ts","../../src/actions/wallet/session/unlock.ts","../../src/commands/walletUnlockCommand.ts"],"sourcesContent":["import OS from 'node:os'\nimport PATH from 'node:path'\n\nexport interface WalletPaths {\n  root: string\n  password: string\n  phrases: string\n  active: string\n  addressBooks: string\n  contacts: string\n  networks: string\n  session: string\n  machineId: string\n}\n\nexport function walletRoot(): string {\n  const override = process.env.ARIES_WALLET_HOME\n  if (override) return override\n  return PATH.join(OS.homedir(), '.aries', 'wallet')\n}\n\nexport function walletPaths(root: string = walletRoot()): WalletPaths {\n  return {\n    root,\n    password: PATH.join(root, 'password.json'),\n    phrases: PATH.join(root, 'phrases.json'),\n    active: PATH.join(root, 'active.json'),\n    addressBooks: PATH.join(root, 'address-books.json'),\n    contacts: PATH.join(root, 'contacts.json'),\n    networks: PATH.join(root, 'networks.json'),\n    session: PATH.join(root, 'session.json'),\n    machineId: PATH.join(root, '.machine-id'),\n  }\n}\n","import FS from 'node:fs'\nimport PATH from 'node:path'\n\nimport { walletRoot } from './paths.ts'\n\nexport function ensureWalletDir(root: string = walletRoot()): void {\n  if (!FS.existsSync(root)) {\n    FS.mkdirSync(root, { recursive: true, mode: 0o700 })\n    return\n  }\n  try {\n    FS.chmodSync(root, 0o700)\n  } catch {\n    // best-effort on platforms without chmod\n  }\n}\n\nexport function readJsonFile<T>(file: string): T | undefined {\n  if (!FS.existsSync(file)) return undefined\n  const raw = FS.readFileSync(file, 'utf8')\n  if (raw.trim().length === 0) return undefined\n  return JSON.parse(raw) as T\n}\n\nexport function writeJsonFile(file: string, value: unknown): void {\n  ensureWalletDir(PATH.dirname(file))\n  const tmp = `${file}.tmp`\n  FS.writeFileSync(tmp, `${JSON.stringify(value, null, 2)}\\n`, { mode: 0o600 })\n  FS.renameSync(tmp, file)\n  try {\n    FS.chmodSync(file, 0o600)\n  } catch {\n    // best-effort\n  }\n}\n\nexport function deleteFile(file: string): void {\n  if (FS.existsSync(file)) FS.unlinkSync(file)\n}\n","import { execFileSync } from 'node:child_process'\nimport {\n  closeSync, openSync, readSync, writeSync,\n} from 'node:fs'\n\nconst CTRL_C = 0x03\nconst ENTER = 0x0d\nconst NEWLINE = 0x0a\nconst BACKSPACE_DELETE = 0x7f\nconst BACKSPACE = 0x08\n\nexport interface PromptOptions {\n  prompt: string\n  mask?: boolean\n}\n\nfunction readChars(readFd: number, writeFd: number, mask: boolean): string {\n  const chars: number[] = []\n  const buf = Buffer.alloc(1)\n  for (;;) {\n    const bytes = readSync(readFd, buf, 0, 1, null)\n    if (bytes === 0) break\n    const ch = buf[0]\n    if (ch === ENTER || ch === NEWLINE) break\n    if (ch === CTRL_C) {\n      writeSync(writeFd, '\\n')\n      throw new Error('Aborted')\n    }\n    if (ch === BACKSPACE_DELETE || ch === BACKSPACE) {\n      if (chars.length > 0) {\n        chars.pop()\n        writeSync(writeFd, '\\b \\b')\n      }\n      continue\n    }\n    chars.push(ch)\n    writeSync(writeFd, mask ? '*' : String.fromCodePoint(ch))\n  }\n  writeSync(writeFd, '\\n')\n  return Buffer.from(chars).toString('utf8')\n}\n\nfunction saveStty(readFd: number): string | undefined {\n  try {\n    return execFileSync('stty', ['-g'], {\n      stdio: [readFd, 'pipe', 'ignore'],\n      encoding: 'utf8',\n    }).trim()\n  } catch {\n    return undefined\n  }\n}\n\nfunction applyStty(readFd: number, args: string[]): void {\n  try {\n    execFileSync('stty', args, { stdio: [readFd, 'ignore', 'ignore'] })\n  } catch { /* ignore */ }\n}\n\nexport function promptTty(options: PromptOptions): string {\n  const readFd = openSync('/dev/tty', 'r')\n  const writeFd = openSync('/dev/tty', 'w')\n  const saved = saveStty(readFd)\n  try {\n    if (saved) applyStty(readFd, ['-echo', '-icanon', 'min', '1', 'time', '0'])\n    writeSync(writeFd, options.prompt)\n    return readChars(readFd, writeFd, options.mask === true)\n  } finally {\n    if (saved) applyStty(readFd, [saved])\n    try {\n      closeSync(readFd)\n    } catch { /* ignore */ }\n    try {\n      closeSync(writeFd)\n    } catch { /* ignore */ }\n  }\n}\n\nexport function promptPassword(prompt = 'Password: '): string {\n  const env = process.env.ARIES_WALLET_PASSWORD\n  if (env !== undefined && env.length > 0) return env\n  return promptTty({ prompt, mask: true })\n}\n\nexport function promptText(prompt: string): string {\n  return promptTty({ prompt, mask: false })\n}\n\nexport function confirm(prompt: string): boolean {\n  const answer = promptTty({ prompt: `${prompt} [y/N] `, mask: false }).trim().toLowerCase()\n  return answer === 'y' || answer === 'yes'\n}\n","import { webcrypto } from 'node:crypto'\n\nimport {\n  decryptWithKey, encryptWithKey, PasswordKey,\n} from '../passwordKey.ts'\nimport { walletPaths } from '../paths.ts'\nimport {\n  deleteFile, readJsonFile, writeJsonFile,\n} from '../storage.ts'\nimport { deriveMachineKey } from './machineId.ts'\n\ninterface SessionData {\n  encryptedKey: string\n  expiresAt: number\n}\n\nconst subtle = webcrypto.subtle\n\nexport const DEFAULT_SESSION_TTL_SECONDS = 15 * 60\n\nexport async function unlockSession(passwordKey: webcrypto.CryptoKey, ttlSeconds: number = DEFAULT_SESSION_TTL_SECONDS): Promise<number> {\n  const machineKey = await deriveMachineKey()\n  const exported = await subtle.exportKey('raw', passwordKey)\n  const exportedBase64 = Buffer.from(new Uint8Array(exported)).toString('base64')\n  const encryptedKey = await encryptWithKey(machineKey, exportedBase64)\n  const expiresAt = Date.now() + ttlSeconds * 1000\n  const data: SessionData = { encryptedKey, expiresAt }\n  writeJsonFile(walletPaths().session, data)\n  return expiresAt\n}\n\nexport function lockSession(): void {\n  deleteFile(walletPaths().session)\n}\n\nexport async function readSession(): Promise<webcrypto.CryptoKey | undefined> {\n  const data = readJsonFile<SessionData>(walletPaths().session)\n  if (!data) return undefined\n  if (data.expiresAt <= Date.now()) {\n    lockSession()\n    return undefined\n  }\n  try {\n    const machineKey = await deriveMachineKey()\n    const exportedBase64 = await decryptWithKey(machineKey, data.encryptedKey)\n    const raw = Buffer.from(exportedBase64, 'base64')\n    return await PasswordKey.importExtractableKey(\n      raw.buffer.slice(raw.byteOffset, raw.byteOffset + raw.byteLength),\n    )\n  } catch {\n    lockSession()\n    return undefined\n  }\n}\n\nexport function readSessionExpiry(): number | undefined {\n  const data = readJsonFile<SessionData>(walletPaths().session)\n  if (!data) return undefined\n  if (data.expiresAt <= Date.now()) return undefined\n  return data.expiresAt\n}\n","import { webcrypto } from 'node:crypto'\n\nconst subtle = webcrypto.subtle\n\nconst INITIALIZATION_VECTOR_LENGTH = 12\nconst PBKDF2_ITERATIONS = 100_000\nconst SALT_BYTES = 16\n\nexport interface PasswordValues {\n  hash: string\n  salt: string\n}\n\nexport class PasswordKey {\n  readonly password: string\n  readonly salt: string\n\n  constructor(password: string, salt: string = PasswordKey.generateSalt()) {\n    this.password = password\n    this.salt = salt\n  }\n\n  static async decryptString(key: webcrypto.CryptoKey, data: string): Promise<string> {\n    const encryptedData = new Uint8Array(Buffer.from(data, 'base64'))\n    const iv = encryptedData.slice(0, INITIALIZATION_VECTOR_LENGTH)\n    const ciphertext = encryptedData.slice(INITIALIZATION_VECTOR_LENGTH)\n    const decrypted = await subtle.decrypt({ name: 'AES-GCM', iv }, key, ciphertext)\n    return new TextDecoder('utf-8').decode(decrypted)\n  }\n\n  static async encryptString(key: webcrypto.CryptoKey, data: string): Promise<string> {\n    const iv = webcrypto.getRandomValues(new Uint8Array(INITIALIZATION_VECTOR_LENGTH))\n    const ciphertext = await subtle.encrypt({ name: 'AES-GCM', iv }, key, new TextEncoder().encode(data))\n    const combined = new Uint8Array(iv.length + ciphertext.byteLength)\n    combined.set(iv, 0)\n    combined.set(new Uint8Array(ciphertext), iv.length)\n    return Buffer.from(combined).toString('base64')\n  }\n\n  static generateSalt(): string {\n    const array = new Uint8Array(SALT_BYTES)\n    webcrypto.getRandomValues(array)\n    return [...array].map(byte => byte.toString(16).padStart(2, '0')).join('')\n  }\n\n  static async getHashFromKey(key: webcrypto.CryptoKey): Promise<string> {\n    const exported = await subtle.exportKey('raw', key)\n    const digest = await subtle.digest('SHA-256', exported)\n    return [...new Uint8Array(digest)].map(byte => byte.toString(16).padStart(2, '0')).join('')\n  }\n\n  static async importEncryptionKey(rawKey: ArrayBuffer): Promise<webcrypto.CryptoKey> {\n    return await subtle.importKey('raw', rawKey, { name: 'AES-GCM' }, false, ['encrypt', 'decrypt'])\n  }\n\n  static async importExtractableKey(rawKey: ArrayBuffer): Promise<webcrypto.CryptoKey> {\n    return await subtle.importKey('raw', rawKey, { name: 'AES-GCM' }, true, ['encrypt', 'decrypt'])\n  }\n\n  static async serializeKey(key: webcrypto.CryptoKey, salt: string = PasswordKey.generateSalt()): Promise<PasswordValues> {\n    const hash = await PasswordKey.getHashFromKey(key)\n    return { hash, salt }\n  }\n\n  async deriveKey(): Promise<webcrypto.CryptoKey> {\n    const encoder = new TextEncoder()\n    const passphraseKey = await subtle.importKey(\n      'raw',\n      encoder.encode(this.password),\n      { name: 'PBKDF2' },\n      false,\n      ['deriveKey'],\n    )\n    return await subtle.deriveKey(\n      {\n        name: 'PBKDF2',\n        salt: encoder.encode(this.salt),\n        iterations: PBKDF2_ITERATIONS,\n        hash: 'SHA-256',\n      },\n      passphraseKey,\n      { name: 'AES-GCM', length: 256 },\n      true,\n      ['encrypt', 'decrypt'],\n    )\n  }\n}\n\nexport async function encryptWithKey(key: webcrypto.CryptoKey, data: string): Promise<string> {\n  const exported = await subtle.exportKey('raw', key)\n  const encKey = await PasswordKey.importEncryptionKey(exported)\n  return await PasswordKey.encryptString(encKey, data)\n}\n\nexport async function decryptWithKey(key: webcrypto.CryptoKey, data: string): Promise<string> {\n  const exported = await subtle.exportKey('raw', key)\n  const encKey = await PasswordKey.importEncryptionKey(exported)\n  return await PasswordKey.decryptString(encKey, data)\n}\n","import { webcrypto } from 'node:crypto'\nimport FS from 'node:fs'\nimport OS from 'node:os'\n\nimport { PasswordKey } from '../passwordKey.ts'\nimport { walletPaths } from '../paths.ts'\nimport { ensureWalletDir } from '../storage.ts'\n\nfunction generateMachineSecret(): string {\n  const bytes = new Uint8Array(32)\n  webcrypto.getRandomValues(bytes)\n  return [...bytes].map(b => b.toString(16).padStart(2, '0')).join('')\n}\n\nexport function loadMachineSecret(): string {\n  ensureWalletDir()\n  const path = walletPaths().machineId\n  if (FS.existsSync(path)) {\n    return FS.readFileSync(path, 'utf8').trim()\n  }\n  const secret = generateMachineSecret()\n  FS.writeFileSync(path, `${secret}\\n`, { mode: 0o600 })\n  try {\n    FS.chmodSync(path, 0o600)\n  } catch { /* best-effort */ }\n  return secret\n}\n\nexport async function deriveMachineKey(): Promise<webcrypto.CryptoKey> {\n  const secret = loadMachineSecret()\n  const stable = `${OS.hostname()}:${OS.userInfo().username}:${secret}`\n  const passwordKey = new PasswordKey(stable, 'aries-wallet-machine-kek-v1')\n  return await passwordKey.deriveKey()\n}\n","import type { PasswordValues } from '../passwordKey.ts'\nimport { walletPaths } from '../paths.ts'\nimport { readJsonFile, writeJsonFile } from '../storage.ts'\n\nexport function readPassword(): PasswordValues | undefined {\n  return readJsonFile<PasswordValues>(walletPaths().password)\n}\n\nexport function writePassword(values: PasswordValues): void {\n  writeJsonFile(walletPaths().password, values)\n}\n\nexport function hasPassword(): boolean {\n  return readPassword() !== undefined\n}\n","import type { webcrypto } from 'node:crypto'\n\nimport { PasswordKey } from '../passwordKey.ts'\nimport { readPassword } from './passwordStorage.ts'\n\nexport async function validatePassword(password: string): Promise<webcrypto.CryptoKey | undefined> {\n  const stored = readPassword()\n  if (!stored) return undefined\n  const passwordKey = new PasswordKey(password, stored.salt)\n  const key = await passwordKey.deriveKey()\n  const hash = await PasswordKey.getHashFromKey(key)\n  if (hash !== stored.hash) return undefined\n  return key\n}\n","import chalk from 'chalk'\n\nimport { hasPassword } from '../password/passwordStorage.ts'\nimport { validatePassword } from '../password/validatePassword.ts'\nimport { promptPassword } from '../prompt.ts'\nimport {\n  DEFAULT_SESSION_TTL_SECONDS, lockSession, unlockSession,\n} from './sessionCache.ts'\n\nexport interface UnlockOptions {\n  ttl?: number\n}\n\nexport async function unlock(options: UnlockOptions = {}): Promise<void> {\n  if (!hasPassword()) {\n    throw new Error('Wallet not initialized. Run `aries wallet create` or `aries wallet import` first.')\n  }\n  const password = promptPassword('Wallet password: ')\n  const key = await validatePassword(password)\n  if (!key) throw new Error('Incorrect password.')\n  const ttl = options.ttl ?? DEFAULT_SESSION_TTL_SECONDS\n  const expiresAt = await unlockSession(key, ttl)\n  console.log(chalk.green(`Wallet unlocked. Session expires ${new Date(expiresAt).toISOString()}.`))\n}\n\nexport function lock(): void {\n  lockSession()\n  console.log(chalk.green('Wallet locked.'))\n}\n","import type { CommandModule } from 'yargs'\n\nimport { unlock } from '../actions/wallet/index.ts'\n\nexport const walletUnlockCommand: CommandModule = {\n  command: 'unlock',\n  describe: 'Cache the wallet password (encrypted at rest) for a TTL',\n  builder: yargs =>\n    yargs.option('ttl', {\n      type: 'number',\n      default: 900,\n      describe: 'Session lifetime in seconds (default 900 = 15 min)',\n    }),\n  handler: async (argv) => {\n    await unlock({ ttl: argv.ttl as number })\n  },\n}\n"],"mappings":";AAAA,OAAO,QAAQ;AACf,OAAO,UAAU;AAcV,SAAS,aAAqB;AACnC,QAAM,WAAW,QAAQ,IAAI;AAC7B,MAAI,SAAU,QAAO;AACrB,SAAO,KAAK,KAAK,GAAG,QAAQ,GAAG,UAAU,QAAQ;AACnD;AAEO,SAAS,YAAY,OAAe,WAAW,GAAgB;AACpE,SAAO;AAAA,IACL;AAAA,IACA,UAAU,KAAK,KAAK,MAAM,eAAe;AAAA,IACzC,SAAS,KAAK,KAAK,MAAM,cAAc;AAAA,IACvC,QAAQ,KAAK,KAAK,MAAM,aAAa;AAAA,IACrC,cAAc,KAAK,KAAK,MAAM,oBAAoB;AAAA,IAClD,UAAU,KAAK,KAAK,MAAM,eAAe;AAAA,IACzC,UAAU,KAAK,KAAK,MAAM,eAAe;AAAA,IACzC,SAAS,KAAK,KAAK,MAAM,cAAc;AAAA,IACvC,WAAW,KAAK,KAAK,MAAM,aAAa;AAAA,EAC1C;AACF;;;ACjCA,OAAO,QAAQ;AACf,OAAOA,WAAU;AAIV,SAAS,gBAAgB,OAAe,WAAW,GAAS;AACjE,MAAI,CAAC,GAAG,WAAW,IAAI,GAAG;AACxB,OAAG,UAAU,MAAM,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AACnD;AAAA,EACF;AACA,MAAI;AACF,OAAG,UAAU,MAAM,GAAK;AAAA,EAC1B,QAAQ;AAAA,EAER;AACF;AAEO,SAAS,aAAgB,MAA6B;AAC3D,MAAI,CAAC,GAAG,WAAW,IAAI,EAAG,QAAO;AACjC,QAAM,MAAM,GAAG,aAAa,MAAM,MAAM;AACxC,MAAI,IAAI,KAAK,EAAE,WAAW,EAAG,QAAO;AACpC,SAAO,KAAK,MAAM,GAAG;AACvB;AAEO,SAAS,cAAc,MAAc,OAAsB;AAChE,kBAAgBC,MAAK,QAAQ,IAAI,CAAC;AAClC,QAAM,MAAM,GAAG,IAAI;AACnB,KAAG,cAAc,KAAK,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAAA,GAAM,EAAE,MAAM,IAAM,CAAC;AAC5E,KAAG,WAAW,KAAK,IAAI;AACvB,MAAI;AACF,OAAG,UAAU,MAAM,GAAK;AAAA,EAC1B,QAAQ;AAAA,EAER;AACF;;;AClCA,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EAAW;AAAA,EAAU;AAAA,EAAU;AAAA,OAC1B;AAEP,IAAM,SAAS;AACf,IAAM,QAAQ;AACd,IAAM,UAAU;AAChB,IAAM,mBAAmB;AACzB,IAAM,YAAY;AAOlB,SAAS,UAAU,QAAgB,SAAiB,MAAuB;AACzE,QAAM,QAAkB,CAAC;AACzB,QAAM,MAAM,OAAO,MAAM,CAAC;AAC1B,aAAS;AACP,UAAM,QAAQ,SAAS,QAAQ,KAAK,GAAG,GAAG,IAAI;AAC9C,QAAI,UAAU,EAAG;AACjB,UAAM,KAAK,IAAI,CAAC;AAChB,QAAI,OAAO,SAAS,OAAO,QAAS;AACpC,QAAI,OAAO,QAAQ;AACjB,gBAAU,SAAS,IAAI;AACvB,YAAM,IAAI,MAAM,SAAS;AAAA,IAC3B;AACA,QAAI,OAAO,oBAAoB,OAAO,WAAW;AAC/C,UAAI,MAAM,SAAS,GAAG;AACpB,cAAM,IAAI;AACV,kBAAU,SAAS,OAAO;AAAA,MAC5B;AACA;AAAA,IACF;AACA,UAAM,KAAK,EAAE;AACb,cAAU,SAAS,OAAO,MAAM,OAAO,cAAc,EAAE,CAAC;AAAA,EAC1D;AACA,YAAU,SAAS,IAAI;AACvB,SAAO,OAAO,KAAK,KAAK,EAAE,SAAS,MAAM;AAC3C;AAEA,SAAS,SAAS,QAAoC;AACpD,MAAI;AACF,WAAO,aAAa,QAAQ,CAAC,IAAI,GAAG;AAAA,MAClC,OAAO,CAAC,QAAQ,QAAQ,QAAQ;AAAA,MAChC,UAAU;AAAA,IACZ,CAAC,EAAE,KAAK;AAAA,EACV,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,UAAU,QAAgB,MAAsB;AACvD,MAAI;AACF,iBAAa,QAAQ,MAAM,EAAE,OAAO,CAAC,QAAQ,UAAU,QAAQ,EAAE,CAAC;AAAA,EACpE,QAAQ;AAAA,EAAe;AACzB;AAEO,SAAS,UAAU,SAAgC;AACxD,QAAM,SAAS,SAAS,YAAY,GAAG;AACvC,QAAM,UAAU,SAAS,YAAY,GAAG;AACxC,QAAM,QAAQ,SAAS,MAAM;AAC7B,MAAI;AACF,QAAI,MAAO,WAAU,QAAQ,CAAC,SAAS,WAAW,OAAO,KAAK,QAAQ,GAAG,CAAC;AAC1E,cAAU,SAAS,QAAQ,MAAM;AACjC,WAAO,UAAU,QAAQ,SAAS,QAAQ,SAAS,IAAI;AAAA,EACzD,UAAE;AACA,QAAI,MAAO,WAAU,QAAQ,CAAC,KAAK,CAAC;AACpC,QAAI;AACF,gBAAU,MAAM;AAAA,IAClB,QAAQ;AAAA,IAAe;AACvB,QAAI;AACF,gBAAU,OAAO;AAAA,IACnB,QAAQ;AAAA,IAAe;AAAA,EACzB;AACF;AAEO,SAAS,eAAe,SAAS,cAAsB;AAC5D,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,QAAQ,UAAa,IAAI,SAAS,EAAG,QAAO;AAChD,SAAO,UAAU,EAAE,QAAQ,MAAM,KAAK,CAAC;AACzC;;;AClFA,SAAS,aAAAC,kBAAiB;;;ACA1B,SAAS,iBAAiB;AAE1B,IAAM,SAAS,UAAU;AAEzB,IAAM,+BAA+B;AACrC,IAAM,oBAAoB;AAC1B,IAAM,aAAa;AAOZ,IAAM,cAAN,MAAM,aAAY;AAAA,EACd;AAAA,EACA;AAAA,EAET,YAAY,UAAkB,OAAe,aAAY,aAAa,GAAG;AACvE,SAAK,WAAW;AAChB,SAAK,OAAO;AAAA,EACd;AAAA,EAEA,aAAa,cAAc,KAA0B,MAA+B;AAClF,UAAM,gBAAgB,IAAI,WAAW,OAAO,KAAK,MAAM,QAAQ,CAAC;AAChE,UAAM,KAAK,cAAc,MAAM,GAAG,4BAA4B;AAC9D,UAAM,aAAa,cAAc,MAAM,4BAA4B;AACnE,UAAM,YAAY,MAAM,OAAO,QAAQ,EAAE,MAAM,WAAW,GAAG,GAAG,KAAK,UAAU;AAC/E,WAAO,IAAI,YAAY,OAAO,EAAE,OAAO,SAAS;AAAA,EAClD;AAAA,EAEA,aAAa,cAAc,KAA0B,MAA+B;AAClF,UAAM,KAAK,UAAU,gBAAgB,IAAI,WAAW,4BAA4B,CAAC;AACjF,UAAM,aAAa,MAAM,OAAO,QAAQ,EAAE,MAAM,WAAW,GAAG,GAAG,KAAK,IAAI,YAAY,EAAE,OAAO,IAAI,CAAC;AACpG,UAAM,WAAW,IAAI,WAAW,GAAG,SAAS,WAAW,UAAU;AACjE,aAAS,IAAI,IAAI,CAAC;AAClB,aAAS,IAAI,IAAI,WAAW,UAAU,GAAG,GAAG,MAAM;AAClD,WAAO,OAAO,KAAK,QAAQ,EAAE,SAAS,QAAQ;AAAA,EAChD;AAAA,EAEA,OAAO,eAAuB;AAC5B,UAAM,QAAQ,IAAI,WAAW,UAAU;AACvC,cAAU,gBAAgB,KAAK;AAC/B,WAAO,CAAC,GAAG,KAAK,EAAE,IAAI,UAAQ,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAAA,EAC3E;AAAA,EAEA,aAAa,eAAe,KAA2C;AACrE,UAAM,WAAW,MAAM,OAAO,UAAU,OAAO,GAAG;AAClD,UAAM,SAAS,MAAM,OAAO,OAAO,WAAW,QAAQ;AACtD,WAAO,CAAC,GAAG,IAAI,WAAW,MAAM,CAAC,EAAE,IAAI,UAAQ,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAAA,EAC5F;AAAA,EAEA,aAAa,oBAAoB,QAAmD;AAClF,WAAO,MAAM,OAAO,UAAU,OAAO,QAAQ,EAAE,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,SAAS,CAAC;AAAA,EACjG;AAAA,EAEA,aAAa,qBAAqB,QAAmD;AACnF,WAAO,MAAM,OAAO,UAAU,OAAO,QAAQ,EAAE,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,SAAS,CAAC;AAAA,EAChG;AAAA,EAEA,aAAa,aAAa,KAA0B,OAAe,aAAY,aAAa,GAA4B;AACtH,UAAM,OAAO,MAAM,aAAY,eAAe,GAAG;AACjD,WAAO,EAAE,MAAM,KAAK;AAAA,EACtB;AAAA,EAEA,MAAM,YAA0C;AAC9C,UAAM,UAAU,IAAI,YAAY;AAChC,UAAM,gBAAgB,MAAM,OAAO;AAAA,MACjC;AAAA,MACA,QAAQ,OAAO,KAAK,QAAQ;AAAA,MAC5B,EAAE,MAAM,SAAS;AAAA,MACjB;AAAA,MACA,CAAC,WAAW;AAAA,IACd;AACA,WAAO,MAAM,OAAO;AAAA,MAClB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,QAAQ,OAAO,KAAK,IAAI;AAAA,QAC9B,YAAY;AAAA,QACZ,MAAM;AAAA,MACR;AAAA,MACA;AAAA,MACA,EAAE,MAAM,WAAW,QAAQ,IAAI;AAAA,MAC/B;AAAA,MACA,CAAC,WAAW,SAAS;AAAA,IACvB;AAAA,EACF;AACF;AAEA,eAAsB,eAAe,KAA0B,MAA+B;AAC5F,QAAM,WAAW,MAAM,OAAO,UAAU,OAAO,GAAG;AAClD,QAAM,SAAS,MAAM,YAAY,oBAAoB,QAAQ;AAC7D,SAAO,MAAM,YAAY,cAAc,QAAQ,IAAI;AACrD;;;AC5FA,SAAS,aAAAC,kBAAiB;AAC1B,OAAOC,SAAQ;AACf,OAAOC,SAAQ;AAMf,SAAS,wBAAgC;AACvC,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,EAAAC,WAAU,gBAAgB,KAAK;AAC/B,SAAO,CAAC,GAAG,KAAK,EAAE,IAAI,OAAK,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AACrE;AAEO,SAAS,oBAA4B;AAC1C,kBAAgB;AAChB,QAAM,OAAO,YAAY,EAAE;AAC3B,MAAIC,IAAG,WAAW,IAAI,GAAG;AACvB,WAAOA,IAAG,aAAa,MAAM,MAAM,EAAE,KAAK;AAAA,EAC5C;AACA,QAAM,SAAS,sBAAsB;AACrC,EAAAA,IAAG,cAAc,MAAM,GAAG,MAAM;AAAA,GAAM,EAAE,MAAM,IAAM,CAAC;AACrD,MAAI;AACF,IAAAA,IAAG,UAAU,MAAM,GAAK;AAAA,EAC1B,QAAQ;AAAA,EAAoB;AAC5B,SAAO;AACT;AAEA,eAAsB,mBAAiD;AACrE,QAAM,SAAS,kBAAkB;AACjC,QAAM,SAAS,GAAGC,IAAG,SAAS,CAAC,IAAIA,IAAG,SAAS,EAAE,QAAQ,IAAI,MAAM;AACnE,QAAM,cAAc,IAAI,YAAY,QAAQ,6BAA6B;AACzE,SAAO,MAAM,YAAY,UAAU;AACrC;;;AFjBA,IAAMC,UAASC,WAAU;AAElB,IAAM,8BAA8B,KAAK;AAEhD,eAAsB,cAAc,aAAkC,aAAqB,6BAA8C;AACvI,QAAM,aAAa,MAAM,iBAAiB;AAC1C,QAAM,WAAW,MAAMD,QAAO,UAAU,OAAO,WAAW;AAC1D,QAAM,iBAAiB,OAAO,KAAK,IAAI,WAAW,QAAQ,CAAC,EAAE,SAAS,QAAQ;AAC9E,QAAM,eAAe,MAAM,eAAe,YAAY,cAAc;AACpE,QAAM,YAAY,KAAK,IAAI,IAAI,aAAa;AAC5C,QAAM,OAAoB,EAAE,cAAc,UAAU;AACpD,gBAAc,YAAY,EAAE,SAAS,IAAI;AACzC,SAAO;AACT;;;AGzBO,SAAS,eAA2C;AACzD,SAAO,aAA6B,YAAY,EAAE,QAAQ;AAC5D;AAMO,SAAS,cAAuB;AACrC,SAAO,aAAa,MAAM;AAC5B;;;ACTA,eAAsB,iBAAiB,UAA4D;AACjG,QAAM,SAAS,aAAa;AAC5B,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,cAAc,IAAI,YAAY,UAAU,OAAO,IAAI;AACzD,QAAM,MAAM,MAAM,YAAY,UAAU;AACxC,QAAM,OAAO,MAAM,YAAY,eAAe,GAAG;AACjD,MAAI,SAAS,OAAO,KAAM,QAAO;AACjC,SAAO;AACT;;;ACbA,OAAO,WAAW;AAalB,eAAsB,OAAO,UAAyB,CAAC,GAAkB;AACvE,MAAI,CAAC,YAAY,GAAG;AAClB,UAAM,IAAI,MAAM,mFAAmF;AAAA,EACrG;AACA,QAAM,WAAW,eAAe,mBAAmB;AACnD,QAAM,MAAM,MAAM,iBAAiB,QAAQ;AAC3C,MAAI,CAAC,IAAK,OAAM,IAAI,MAAM,qBAAqB;AAC/C,QAAM,MAAM,QAAQ,OAAO;AAC3B,QAAM,YAAY,MAAM,cAAc,KAAK,GAAG;AAC9C,UAAQ,IAAI,MAAM,MAAM,oCAAoC,IAAI,KAAK,SAAS,EAAE,YAAY,CAAC,GAAG,CAAC;AACnG;;;ACnBO,IAAM,sBAAqC;AAAA,EAChD,SAAS;AAAA,EACT,UAAU;AAAA,EACV,SAAS,WACP,MAAM,OAAO,OAAO;AAAA,IAClB,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,EACZ,CAAC;AAAA,EACH,SAAS,OAAO,SAAS;AACvB,UAAM,OAAO,EAAE,KAAK,KAAK,IAAc,CAAC;AAAA,EAC1C;AACF;","names":["PATH","PATH","webcrypto","webcrypto","FS","OS","webcrypto","FS","OS","subtle","webcrypto"]}

package/dist/commands/walletUseCommand.mjs

@@ -0,0 +1,95 @@
+// src/actions/wallet/paths.ts
+import OS from "os";
+import PATH from "path";
+function walletRoot() {
+  const override = process.env.ARIES_WALLET_HOME;
+  if (override) return override;
+  return PATH.join(OS.homedir(), ".aries", "wallet");
+}
+function walletPaths(root = walletRoot()) {
+  return {
+    root,
+    password: PATH.join(root, "password.json"),
+    phrases: PATH.join(root, "phrases.json"),
+    active: PATH.join(root, "active.json"),
+    addressBooks: PATH.join(root, "address-books.json"),
+    contacts: PATH.join(root, "contacts.json"),
+    networks: PATH.join(root, "networks.json"),
+    session: PATH.join(root, "session.json"),
+    machineId: PATH.join(root, ".machine-id")
+  };
+}
+
+// src/actions/wallet/storage.ts
+import FS from "fs";
+import PATH2 from "path";
+function ensureWalletDir(root = walletRoot()) {
+  if (!FS.existsSync(root)) {
+    FS.mkdirSync(root, { recursive: true, mode: 448 });
+    return;
+  }
+  try {
+    FS.chmodSync(root, 448);
+  } catch {
+  }
+}
+function readJsonFile(file) {
+  if (!FS.existsSync(file)) return void 0;
+  const raw = FS.readFileSync(file, "utf8");
+  if (raw.trim().length === 0) return void 0;
+  return JSON.parse(raw);
+}
+function writeJsonFile(file, value) {
+  ensureWalletDir(PATH2.dirname(file));
+  const tmp = `${file}.tmp`;
+  FS.writeFileSync(tmp, `${JSON.stringify(value, null, 2)}
+`, { mode: 384 });
+  FS.renameSync(tmp, file);
+  try {
+    FS.chmodSync(file, 384);
+  } catch {
+  }
+}
+
+// src/actions/wallet/seedPhrase/phraseStorage.ts
+function readPhrases() {
+  const data = readJsonFile(walletPaths().phrases);
+  return data?.phrases ?? [];
+}
+function readActive() {
+  return readJsonFile(walletPaths().active) ?? {};
+}
+function writeActive(active) {
+  writeJsonFile(walletPaths().active, active);
+}
+function findPhrase(id) {
+  return readPhrases().find((p) => p.id === id || p.label === id);
+}
+
+// src/actions/wallet/seedPhrase/usePhrase.ts
+import chalk from "chalk";
+function usePhrase(id) {
+  const record = findPhrase(id);
+  if (!record) throw new Error(`Wallet not found: ${id}`);
+  const active = readActive();
+  writeActive({ ...active, phraseId: record.id });
+  console.log(chalk.green(`Active wallet set to ${chalk.cyan(record.label)} (id ${record.id})`));
+}
+
+// src/commands/walletUseCommand.ts
+var walletUseCommand = {
+  command: "use <id>",
+  describe: "Set the active wallet",
+  builder: (yargs) => yargs.positional("id", {
+    type: "string",
+    describe: "Wallet id or label",
+    demandOption: true
+  }),
+  handler: (argv) => {
+    usePhrase(argv.id);
+  }
+};
+export {
+  walletUseCommand
+};
+//# sourceMappingURL=walletUseCommand.mjs.map

package/dist/commands/walletUseCommand.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/actions/wallet/paths.ts","../../src/actions/wallet/storage.ts","../../src/actions/wallet/seedPhrase/phraseStorage.ts","../../src/actions/wallet/seedPhrase/usePhrase.ts","../../src/commands/walletUseCommand.ts"],"sourcesContent":["import OS from 'node:os'\nimport PATH from 'node:path'\n\nexport interface WalletPaths {\n  root: string\n  password: string\n  phrases: string\n  active: string\n  addressBooks: string\n  contacts: string\n  networks: string\n  session: string\n  machineId: string\n}\n\nexport function walletRoot(): string {\n  const override = process.env.ARIES_WALLET_HOME\n  if (override) return override\n  return PATH.join(OS.homedir(), '.aries', 'wallet')\n}\n\nexport function walletPaths(root: string = walletRoot()): WalletPaths {\n  return {\n    root,\n    password: PATH.join(root, 'password.json'),\n    phrases: PATH.join(root, 'phrases.json'),\n    active: PATH.join(root, 'active.json'),\n    addressBooks: PATH.join(root, 'address-books.json'),\n    contacts: PATH.join(root, 'contacts.json'),\n    networks: PATH.join(root, 'networks.json'),\n    session: PATH.join(root, 'session.json'),\n    machineId: PATH.join(root, '.machine-id'),\n  }\n}\n","import FS from 'node:fs'\nimport PATH from 'node:path'\n\nimport { walletRoot } from './paths.ts'\n\nexport function ensureWalletDir(root: string = walletRoot()): void {\n  if (!FS.existsSync(root)) {\n    FS.mkdirSync(root, { recursive: true, mode: 0o700 })\n    return\n  }\n  try {\n    FS.chmodSync(root, 0o700)\n  } catch {\n    // best-effort on platforms without chmod\n  }\n}\n\nexport function readJsonFile<T>(file: string): T | undefined {\n  if (!FS.existsSync(file)) return undefined\n  const raw = FS.readFileSync(file, 'utf8')\n  if (raw.trim().length === 0) return undefined\n  return JSON.parse(raw) as T\n}\n\nexport function writeJsonFile(file: string, value: unknown): void {\n  ensureWalletDir(PATH.dirname(file))\n  const tmp = `${file}.tmp`\n  FS.writeFileSync(tmp, `${JSON.stringify(value, null, 2)}\\n`, { mode: 0o600 })\n  FS.renameSync(tmp, file)\n  try {\n    FS.chmodSync(file, 0o600)\n  } catch {\n    // best-effort\n  }\n}\n\nexport function deleteFile(file: string): void {\n  if (FS.existsSync(file)) FS.unlinkSync(file)\n}\n","import { walletPaths } from '../paths.ts'\nimport { readJsonFile, writeJsonFile } from '../storage.ts'\nimport type {\n  ActiveFile, PhrasesFile, SeedPhraseRecord,\n} from './types.ts'\n\nexport function readPhrases(): SeedPhraseRecord[] {\n  const data = readJsonFile<PhrasesFile>(walletPaths().phrases)\n  return data?.phrases ?? []\n}\n\nexport function writePhrases(phrases: SeedPhraseRecord[]): void {\n  writeJsonFile(walletPaths().phrases, { phrases })\n}\n\nexport function readActive(): ActiveFile {\n  return readJsonFile<ActiveFile>(walletPaths().active) ?? {}\n}\n\nexport function writeActive(active: ActiveFile): void {\n  writeJsonFile(walletPaths().active, active)\n}\n\nexport function findPhrase(id: string): SeedPhraseRecord | undefined {\n  return readPhrases().find(p => p.id === id || p.label === id)\n}\n\nexport function getActivePhrase(): SeedPhraseRecord | undefined {\n  const phrases = readPhrases()\n  if (phrases.length === 0) return undefined\n  const active = readActive()\n  if (active.phraseId) {\n    const found = phrases.find(p => p.id === active.phraseId)\n    if (found) return found\n  }\n  return phrases[0]\n}\n","import chalk from 'chalk'\n\nimport {\n  findPhrase, readActive, writeActive,\n} from './phraseStorage.ts'\n\nexport function usePhrase(id: string): void {\n  const record = findPhrase(id)\n  if (!record) throw new Error(`Wallet not found: ${id}`)\n  const active = readActive()\n  writeActive({ ...active, phraseId: record.id })\n  console.log(chalk.green(`Active wallet set to ${chalk.cyan(record.label)} (id ${record.id})`))\n}\n","import type { CommandModule } from 'yargs'\n\nimport { usePhrase } from '../actions/wallet/index.ts'\n\nexport const walletUseCommand: CommandModule = {\n  command: 'use <id>',\n  describe: 'Set the active wallet',\n  builder: yargs =>\n    yargs.positional('id', {\n      type: 'string',\n      describe: 'Wallet id or label',\n      demandOption: true,\n    }),\n  handler: (argv) => {\n    usePhrase(argv.id as string)\n  },\n}\n"],"mappings":";AAAA,OAAO,QAAQ;AACf,OAAO,UAAU;AAcV,SAAS,aAAqB;AACnC,QAAM,WAAW,QAAQ,IAAI;AAC7B,MAAI,SAAU,QAAO;AACrB,SAAO,KAAK,KAAK,GAAG,QAAQ,GAAG,UAAU,QAAQ;AACnD;AAEO,SAAS,YAAY,OAAe,WAAW,GAAgB;AACpE,SAAO;AAAA,IACL;AAAA,IACA,UAAU,KAAK,KAAK,MAAM,eAAe;AAAA,IACzC,SAAS,KAAK,KAAK,MAAM,cAAc;AAAA,IACvC,QAAQ,KAAK,KAAK,MAAM,aAAa;AAAA,IACrC,cAAc,KAAK,KAAK,MAAM,oBAAoB;AAAA,IAClD,UAAU,KAAK,KAAK,MAAM,eAAe;AAAA,IACzC,UAAU,KAAK,KAAK,MAAM,eAAe;AAAA,IACzC,SAAS,KAAK,KAAK,MAAM,cAAc;AAAA,IACvC,WAAW,KAAK,KAAK,MAAM,aAAa;AAAA,EAC1C;AACF;;;ACjCA,OAAO,QAAQ;AACf,OAAOA,WAAU;AAIV,SAAS,gBAAgB,OAAe,WAAW,GAAS;AACjE,MAAI,CAAC,GAAG,WAAW,IAAI,GAAG;AACxB,OAAG,UAAU,MAAM,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AACnD;AAAA,EACF;AACA,MAAI;AACF,OAAG,UAAU,MAAM,GAAK;AAAA,EAC1B,QAAQ;AAAA,EAER;AACF;AAEO,SAAS,aAAgB,MAA6B;AAC3D,MAAI,CAAC,GAAG,WAAW,IAAI,EAAG,QAAO;AACjC,QAAM,MAAM,GAAG,aAAa,MAAM,MAAM;AACxC,MAAI,IAAI,KAAK,EAAE,WAAW,EAAG,QAAO;AACpC,SAAO,KAAK,MAAM,GAAG;AACvB;AAEO,SAAS,cAAc,MAAc,OAAsB;AAChE,kBAAgBC,MAAK,QAAQ,IAAI,CAAC;AAClC,QAAM,MAAM,GAAG,IAAI;AACnB,KAAG,cAAc,KAAK,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAAA,GAAM,EAAE,MAAM,IAAM,CAAC;AAC5E,KAAG,WAAW,KAAK,IAAI;AACvB,MAAI;AACF,OAAG,UAAU,MAAM,GAAK;AAAA,EAC1B,QAAQ;AAAA,EAER;AACF;;;AC5BO,SAAS,cAAkC;AAChD,QAAM,OAAO,aAA0B,YAAY,EAAE,OAAO;AAC5D,SAAO,MAAM,WAAW,CAAC;AAC3B;AAMO,SAAS,aAAyB;AACvC,SAAO,aAAyB,YAAY,EAAE,MAAM,KAAK,CAAC;AAC5D;AAEO,SAAS,YAAY,QAA0B;AACpD,gBAAc,YAAY,EAAE,QAAQ,MAAM;AAC5C;AAEO,SAAS,WAAW,IAA0C;AACnE,SAAO,YAAY,EAAE,KAAK,OAAK,EAAE,OAAO,MAAM,EAAE,UAAU,EAAE;AAC9D;;;ACzBA,OAAO,WAAW;AAMX,SAAS,UAAU,IAAkB;AAC1C,QAAM,SAAS,WAAW,EAAE;AAC5B,MAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,qBAAqB,EAAE,EAAE;AACtD,QAAM,SAAS,WAAW;AAC1B,cAAY,EAAE,GAAG,QAAQ,UAAU,OAAO,GAAG,CAAC;AAC9C,UAAQ,IAAI,MAAM,MAAM,wBAAwB,MAAM,KAAK,OAAO,KAAK,CAAC,QAAQ,OAAO,EAAE,GAAG,CAAC;AAC/F;;;ACRO,IAAM,mBAAkC;AAAA,EAC7C,SAAS;AAAA,EACT,UAAU;AAAA,EACV,SAAS,WACP,MAAM,WAAW,MAAM;AAAA,IACrB,MAAM;AAAA,IACN,UAAU;AAAA,IACV,cAAc;AAAA,EAChB,CAAC;AAAA,EACH,SAAS,CAAC,SAAS;AACjB,cAAU,KAAK,EAAY;AAAA,EAC7B;AACF;","names":["PATH","PATH"]}

package/dist/commands/xyoCommand.mjs

@@ -0,0 +1,188 @@
+// src/actions/xyo/transaction/validateTransactions.ts
+import FS, { existsSync } from "fs";
+import path from "path";
+import { PayloadBuilder } from "@xyo-network/sdk-js";
+import {
+  isHydratedTransaction,
+  isTransactionBoundWitness,
+  validateTransaction
+} from "@xyo-network/xl1-sdk";
+import chalk from "chalk";
+function isRawTuple(value) {
+  return Array.isArray(value) && value.length === 2 && Array.isArray(value[1]);
+}
+function parseSingleOrBatch(raw, source) {
+  const parsed = JSON.parse(raw);
+  if (isRawTuple(parsed)) {
+    return [[parsed, source]];
+  }
+  if (Array.isArray(parsed) && parsed.length > 0 && parsed.every(isRawTuple)) {
+    return parsed.map((tx, i) => [tx, `${source}[${i}]`]);
+  }
+  throw new Error(`${source}: expected a transaction tuple [bw, payloads[]] or array of tuples`);
+}
+function parseJsonl(raw, source) {
+  const results = [];
+  for (const [i, rawLine] of raw.split("\n").entries()) {
+    const line = rawLine?.trim();
+    if (!line) continue;
+    let parsed;
+    try {
+      parsed = JSON.parse(line);
+    } catch (error) {
+      const msg = error instanceof Error ? error.message : String(error);
+      throw new Error(`${source} line ${i + 1}: invalid JSON (${msg})`, { cause: error });
+    }
+    if (!isRawTuple(parsed)) {
+      throw new Error(`${source} line ${i + 1}: expected a transaction tuple [bw, payloads[]]`);
+    }
+    results.push([parsed, `${source}:${i + 1}`]);
+  }
+  return results;
+}
+function parseInput(data) {
+  const absolute = path.resolve(data);
+  if (existsSync(absolute)) {
+    const raw = FS.readFileSync(absolute, "utf8");
+    const ext = path.extname(absolute).toLowerCase();
+    if (ext === ".jsonl" || ext === ".ndjson") {
+      return parseJsonl(raw, data);
+    }
+    return parseSingleOrBatch(raw, data);
+  }
+  return parseSingleOrBatch(data, "<inline>");
+}
+async function readStdin() {
+  return new Promise((resolve, reject) => {
+    let buf = "";
+    process.stdin.setEncoding("utf8");
+    process.stdin.on("data", (chunk) => {
+      buf += chunk;
+    });
+    process.stdin.on("end", () => resolve(buf));
+    process.stdin.on("error", reject);
+  });
+}
+async function validateOne(raw, source, index) {
+  const [bwRaw, payloadsRaw] = raw;
+  const errors = [];
+  if (!isTransactionBoundWitness(bwRaw)) {
+    return {
+      errors: ["not a valid transaction BoundWitness"],
+      index,
+      source,
+      valid: false
+    };
+  }
+  try {
+    const bwWithMeta = await PayloadBuilder.addHashMeta(bwRaw);
+    const payloadsWithMeta = await Promise.all(
+      payloadsRaw.map((p) => PayloadBuilder.addHashMeta(p))
+    );
+    const tx = [bwWithMeta, payloadsWithMeta];
+    if (isHydratedTransaction(tx)) {
+      const chainId = bwRaw.chain;
+      const txErrors = await validateTransaction({ chainId }, tx);
+      for (const err of txErrors) {
+        errors.push(String(err));
+      }
+    } else {
+      errors.push("transaction failed structural shape check (isHydratedTransaction)");
+    }
+  } catch (ex) {
+    errors.push(`Validation threw: ${ex instanceof Error ? ex.message : String(ex)}`);
+  }
+  return {
+    errors,
+    index,
+    source,
+    valid: errors.length === 0
+  };
+}
+async function validateTransactions(options) {
+  let rawTransactions;
+  if (options.data !== void 0) {
+    rawTransactions = parseInput(options.data);
+  } else if (process.stdin.isTTY) {
+    console.error(chalk.red("No input: provide a file path, inline JSON, or pipe data to stdin."));
+    process.exitCode = 1;
+    return;
+  } else {
+    const stdin = await readStdin();
+    rawTransactions = parseSingleOrBatch(stdin.trim(), "<stdin>");
+  }
+  const results = await Promise.all(rawTransactions.map(([tx, source], i) => validateOne(tx, source, i)));
+  const validCount = results.filter((r) => r.valid).length;
+  const invalidCount = results.filter((r) => !r.valid).length;
+  console.log(`Total:   ${results.length}`);
+  console.log(chalk.green(`Valid:   ${validCount}`));
+  if (invalidCount > 0) {
+    console.log(chalk.red(`Invalid: ${invalidCount}`));
+  }
+  if (options.detail === true || invalidCount > 0) {
+    for (const result of results.filter((r) => !r.valid)) {
+      console.log(chalk.red(`
+[${result.index}] ${result.source}`));
+      for (const err of result.errors) {
+        console.log(chalk.red(`  - ${err}`));
+      }
+    }
+  }
+  if (invalidCount > 0) {
+    process.exitCode = 1;
+  }
+}
+
+// src/commands/xyoTxValidateCommand.ts
+var xyoTxValidateCommand = {
+  command: "validate [data]",
+  describe: "Validate one or more XL1 transactions (file, inline JSON, or stdin)",
+  builder: (yargs) => yargs.positional("data", {
+    type: "string",
+    describe: "Path to a .json/.jsonl file, or an inline transaction JSON tuple [bw, payloads[]]"
+  }).option("detail", {
+    alias: "d",
+    type: "boolean",
+    default: false,
+    describe: "Print per-transaction error details (always shown for invalid transactions)"
+  }).example(
+    "$0 xyo tx validate ./tx.json",
+    "Validate a single signed transaction from a file"
+  ).example(
+    "$0 xyo tx validate ./txs.jsonl",
+    "Validate a batch of transactions, one per line"
+  ).example(
+    "cat txs.jsonl | $0 xyo tx validate",
+    "Validate transactions piped from stdin"
+  ),
+  handler: async (argv) => {
+    await validateTransactions({
+      data: argv.data,
+      detail: argv.detail
+    });
+  }
+};
+
+// src/commands/xyoTxCommand.ts
+var xyoTxCommand = {
+  command: "tx",
+  describe: "XL1 transaction utilities",
+  builder: (yargs) => yargs.command(xyoTxValidateCommand).demandCommand(1).strictCommands(),
+  // eslint-disable-next-line @typescript-eslint/no-empty-function
+  handler: () => {
+  }
+};
+
+// src/commands/xyoCommand.ts
+var xyoCommand = {
+  command: "xyo",
+  describe: "XYO protocol utilities",
+  builder: (yargs) => yargs.command(xyoTxCommand).demandCommand(1).strictCommands(),
+  // eslint-disable-next-line @typescript-eslint/no-empty-function
+  handler: () => {
+  }
+};
+export {
+  xyoCommand
+};
+//# sourceMappingURL=xyoCommand.mjs.map