arc402-cli 0.5.0 → 0.6.0

package/dist/commands/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/commands/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMpC,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA6C7D"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/commands/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMpC,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAmD7D"}

package/dist/commands/config.js

@@ -53,5 +53,11 @@ function registerConfigCommands(program) {
         const cfg = (0, config_1.loadConfig)();
         console.log(JSON.stringify({ ...cfg, privateKey: cfg.privateKey ? "***" : undefined, subdomainApi: (0, config_1.getSubdomainApi)(cfg) }, null, 2));
     });
+    config.command("set <key> <value>").description("Set a config value: arc402 config set <key> <value>").action((key, value) => {
+        const cfg = (0, config_1.loadConfig)();
+        cfg[key] = value;
+        (0, config_1.saveConfig)(cfg);
+        console.log(' ' + colors_1.c.success + colors_1.c.white(` ${key} = ${value}`));
+    });
 }
 //# sourceMappingURL=config.js.map

package/dist/commands/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/commands/config.ts"],"names":[],"mappings":";;;;;AAMA,wDA6CC;AAlDD,sDAA8B;AAC9B,kDAA0B;AAC1B,sCAAkH;AAClH,yCAAiC;AAEjC,SAAgB,sBAAsB,CAAC,OAAgB;IACrD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,kCAAkC,CAAC,CAAC;IACzF,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,6CAA6C,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;QAClG,MAAM,QAAQ,GAA0B,IAAA,qBAAY,GAAE,CAAC,CAAC,CAAC,IAAA,mBAAU,GAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,MAAM,OAAO,GAAG,MAAM,IAAA,iBAAO,EAAC;YAC5B,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,KAAK,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;SACvO,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YAAC,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAE9E,MAAM,QAAQ,GAAG,yBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACzD,MAAM,GAAG,GAAiB;YACxB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,sBAAsB,EAAE,kCAAkC;YAC1D,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,0BAA0B;YACrD,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB,IAAI,EAAE;YACzD,oBAAoB,EAAE,QAAQ,CAAC,sBAAsB,IAAI,QAAQ,CAAC,oBAAoB;YACtF,uBAAuB,EAAE,QAAQ,CAAC,uBAAuB;YACzD,uBAAuB,EAAE,QAAQ,CAAC,uBAAuB;YACzD,6BAA6B,EAAE,QAAQ,CAAC,6BAA6B;YACrE,yBAAyB,EAAE,QAAQ,CAAC,yBAAyB;YAC7D,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;YAC7C,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrF,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrF,GAAG,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,QAAQ,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrG,CAAC;QACF,IAAA,mBAAU,EAAC,GAAG,CAAC,CAAC;QAEhB,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,UAAC,CAAC,OAAO,GAAG,UAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,GAAG,CAAC,qBAAqB,CAAC,GAAG,eAAK,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,KAAK,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;QAClI,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,GAAG,CAAC,qBAAqB,CAAC,GAAG,eAAK,CAAC,KAAK,CAAC,GAAG,CAAC,MAAO,CAAC,CAAC,CAAC;QACzE,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,GAAG,CAAC,qBAAqB,CAAC,GAAG,eAAK,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC,CAAC;QAC7F,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,eAAK,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC;QACzE,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE;QACrE,MAAM,GAAG,GAAG,IAAA,mBAAU,GAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,GAAG,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,YAAY,EAAE,IAAA,wBAAe,EAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACvI,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/commands/config.ts"],"names":[],"mappings":";;;;;AAMA,wDAmDC;AAxDD,sDAA8B;AAC9B,kDAA0B;AAC1B,sCAAkH;AAClH,yCAAiC;AAEjC,SAAgB,sBAAsB,CAAC,OAAgB;IACrD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,kCAAkC,CAAC,CAAC;IACzF,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,6CAA6C,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;QAClG,MAAM,QAAQ,GAA0B,IAAA,qBAAY,GAAE,CAAC,CAAC,CAAC,IAAA,mBAAU,GAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,MAAM,OAAO,GAAG,MAAM,IAAA,iBAAO,EAAC;YAC5B,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,KAAK,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;SACvO,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YAAC,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAE9E,MAAM,QAAQ,GAAG,yBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACzD,MAAM,GAAG,GAAiB;YACxB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,sBAAsB,EAAE,kCAAkC;YAC1D,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,0BAA0B;YACrD,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB,IAAI,EAAE;YACzD,oBAAoB,EAAE,QAAQ,CAAC,sBAAsB,IAAI,QAAQ,CAAC,oBAAoB;YACtF,uBAAuB,EAAE,QAAQ,CAAC,uBAAuB;YACzD,uBAAuB,EAAE,QAAQ,CAAC,uBAAuB;YACzD,6BAA6B,EAAE,QAAQ,CAAC,6BAA6B;YACrE,yBAAyB,EAAE,QAAQ,CAAC,yBAAyB;YAC7D,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;YAC7C,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrF,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrF,GAAG,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,QAAQ,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrG,CAAC;QACF,IAAA,mBAAU,EAAC,GAAG,CAAC,CAAC;QAEhB,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,UAAC,CAAC,OAAO,GAAG,UAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,GAAG,CAAC,qBAAqB,CAAC,GAAG,eAAK,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,KAAK,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;QAClI,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,GAAG,CAAC,qBAAqB,CAAC,GAAG,eAAK,CAAC,KAAK,CAAC,GAAG,CAAC,MAAO,CAAC,CAAC,CAAC;QACzE,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,GAAG,CAAC,qBAAqB,CAAC,GAAG,eAAK,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC,CAAC;QAC7F,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,eAAK,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC;QACzE,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE;QACrE,MAAM,GAAG,GAAG,IAAA,mBAAU,GAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,GAAG,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,YAAY,EAAE,IAAA,wBAAe,EAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACvI,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,WAAW,CAAC,qDAAqD,CAAC,CAAC,MAAM,CAAC,CAAC,GAAW,EAAE,KAAa,EAAE,EAAE;QAC3I,MAAM,GAAG,GAAG,IAAA,mBAAU,GAAE,CAAC;QACxB,GAA0C,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACzD,IAAA,mBAAU,EAAC,GAAG,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,UAAC,CAAC,OAAO,GAAG,UAAC,CAAC,KAAK,CAAC,IAAI,GAAG,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/commands/wallet.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wallet.d.ts","sourceRoot":"","sources":["../../src/commands/wallet.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAsIpC,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAqvF7D"}
+{"version":3,"file":"wallet.d.ts","sourceRoot":"","sources":["../../src/commands/wallet.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAsiBpC,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA+vF7D"}

package/dist/commands/wallet.js

@@ -114,6 +114,385 @@ async function runWalletOnboardingCeremony(walletAddress, ownerAddress, config,
     console.log(" " + colors_1.c.dim("arc402 wallet set-velocity-limit <eth>   — wallet-level hourly ETH cap"));
     console.log(" " + colors_1.c.dim("arc402 wallet policy set-daily-limit --category general --amount <eth>   — daily per-category cap"));
 }
+/**
+ * Complete ARC-402 onboarding ceremony — matches web flow at app.arc402.xyz/onboard.
+ * Runs in a single WalletConnect session (or any sendTx provider). Idempotent.
+ *
+ * Steps:
+ *   2. Machine key — generate + authorizeMachineKey
+ *   3. Passkey    — CLI shows browser URL (WebAuthn requires browser)
+ *   4. Policy     — v5 protocol bypass; set hire limit + optional guardian
+ *   5. Agent      — register on AgentRegistry via executeContractCall
+ *   6. Summary    — branded tree
+ */
+async function runCompleteOnboardingCeremony(walletAddress, ownerAddress, config, provider, sendTx) {
+    const policyAddress = config.policyEngineAddress ?? POLICY_ENGINE_DEFAULT;
+    const agentRegistryAddress = config.agentRegistryV2Address ??
+        config_1.NETWORK_DEFAULTS[config.network]?.agentRegistryV2Address;
+    const handshakeAddress = config.handshakeAddress ??
+        config_1.NETWORK_DEFAULTS[config.network]?.handshakeAddress ??
+        "0x4F5A38Bb746d7E5d49d8fd26CA6beD141Ec2DDb3";
+    // ── Step 2: Machine Key ────────────────────────────────────────────────────
+    console.log("\n" + colors_1.c.dim("── Step 2: Machine Key ────────────────────────────────────────"));
+    let machineKeyAddress;
+    if (config.privateKey) {
+        machineKeyAddress = new ethers_1.ethers.Wallet(config.privateKey).address;
+    }
+    else {
+        const mk = ethers_1.ethers.Wallet.createRandom();
+        machineKeyAddress = mk.address;
+        config.privateKey = mk.privateKey;
+        (0, config_1.saveConfig)(config);
+        console.log(" " + colors_1.c.dim("Machine key generated: ") + colors_1.c.white(machineKeyAddress));
+        console.log(" " + colors_1.c.dim("Private key saved to ~/.arc402/config.json (chmod 600)"));
+    }
+    let mkAlreadyAuthorized = false;
+    try {
+        const mkContract = new ethers_1.ethers.Contract(walletAddress, abis_1.ARC402_WALLET_MACHINE_KEY_ABI, provider);
+        mkAlreadyAuthorized = await mkContract.authorizedMachineKeys(machineKeyAddress);
+    }
+    catch { /* older wallet — will try to authorize */ }
+    if (mkAlreadyAuthorized) {
+        console.log(" " + colors_1.c.success + colors_1.c.dim(" Machine key already authorized: ") + colors_1.c.white(machineKeyAddress));
+    }
+    else {
+        console.log(" " + colors_1.c.dim("Authorizing machine key: ") + colors_1.c.white(machineKeyAddress));
+        const mkIface = new ethers_1.ethers.Interface(abis_1.ARC402_WALLET_MACHINE_KEY_ABI);
+        await sendTx({ to: walletAddress, data: mkIface.encodeFunctionData("authorizeMachineKey", [machineKeyAddress]), value: "0x0" }, "authorizeMachineKey");
+        console.log(" " + colors_1.c.success + " Machine key authorized");
+    }
+    // ── Step 3: Passkey ───────────────────────────────────────────────────────
+    console.log("\n" + colors_1.c.dim("── Step 3: Passkey (Face ID / WebAuthn) ──────────────────────"));
+    let passkeyActive = false;
+    try {
+        const walletC = new ethers_1.ethers.Contract(walletAddress, abis_1.ARC402_WALLET_PASSKEY_ABI, provider);
+        const auth = await walletC.ownerAuth();
+        passkeyActive = Number(auth[0]) === 1;
+    }
+    catch { /* ignore */ }
+    if (passkeyActive) {
+        console.log(" " + colors_1.c.success + colors_1.c.dim(" Passkey already active"));
+    }
+    else {
+        const passkeyUrl = `https://app.arc402.xyz/passkey-setup?wallet=${walletAddress}`;
+        console.log("\n " + colors_1.c.white("Open this URL in your browser to set up Face ID:"));
+        console.log("   " + colors_1.c.cyan(passkeyUrl));
+        console.log(" " + colors_1.c.dim("Complete Face ID registration, then press Enter. Type 'n' + Enter to skip.\n"));
+        const passkeyAns = await (0, prompts_1.default)({
+            type: "text",
+            name: "done",
+            message: "Press Enter when done (or type 'n' to skip)",
+            initial: "",
+        });
+        if (passkeyAns.done?.toLowerCase() === "n") {
+            console.log(" " + colors_1.c.warning + " Passkey skipped");
+        }
+        else {
+            passkeyActive = true;
+            console.log(" " + colors_1.c.success + " Passkey set (via browser)");
+        }
+    }
+    // ── Step 4: Policy ────────────────────────────────────────────────────────
+    console.log("\n" + colors_1.c.dim("── Step 4: Policy ─────────────────────────────────────────────"));
+    // 4a) setVelocityLimit
+    let velocityLimitEth = "0.05";
+    let velocityAlreadySet = false;
+    try {
+        const ownerC = new ethers_1.ethers.Contract(walletAddress, abis_1.ARC402_WALLET_OWNER_ABI, provider);
+        const existing = await ownerC.velocityLimit();
+        if (existing > 0n) {
+            velocityAlreadySet = true;
+            velocityLimitEth = ethers_1.ethers.formatEther(existing);
+            console.log(" " + colors_1.c.success + colors_1.c.dim(` Velocity limit already set: ${velocityLimitEth} ETH`));
+        }
+    }
+    catch { /* ignore */ }
+    if (!velocityAlreadySet) {
+        const velAns = await (0, prompts_1.default)({
+            type: "text",
+            name: "limit",
+            message: "Velocity limit (ETH / rolling window)?",
+            initial: "0.05",
+        });
+        velocityLimitEth = velAns.limit || "0.05";
+        const velIface = new ethers_1.ethers.Interface(["function setVelocityLimit(uint256 limit) external"]);
+        await sendTx({ to: walletAddress, data: velIface.encodeFunctionData("setVelocityLimit", [ethers_1.ethers.parseEther(velocityLimitEth)]), value: "0x0" }, `setVelocityLimit: ${velocityLimitEth} ETH`);
+        (0, config_1.saveConfig)(config);
+    }
+    // 4b) setGuardian (optional — address, 'g' to generate, or skip)
+    let guardianAddress = null;
+    try {
+        const guardianC = new ethers_1.ethers.Contract(walletAddress, abis_1.ARC402_WALLET_GUARDIAN_ABI, provider);
+        const existing = await guardianC.guardian();
+        if (existing && existing !== ethers_1.ethers.ZeroAddress) {
+            guardianAddress = existing;
+            console.log(" " + colors_1.c.success + colors_1.c.dim(` Guardian already set: ${existing}`));
+        }
+    }
+    catch { /* ignore */ }
+    if (!guardianAddress) {
+        const guardianAns = await (0, prompts_1.default)({
+            type: "text",
+            name: "guardian",
+            message: "Guardian address? (address, 'g' to generate, Enter to skip)",
+            initial: "",
+        });
+        const guardianInput = guardianAns.guardian?.trim() ?? "";
+        if (guardianInput.toLowerCase() === "g") {
+            const generatedGuardian = ethers_1.ethers.Wallet.createRandom();
+            config.guardianPrivateKey = generatedGuardian.privateKey;
+            config.guardianAddress = generatedGuardian.address;
+            (0, config_1.saveConfig)(config);
+            guardianAddress = generatedGuardian.address;
+            console.log("\n " + colors_1.c.warning + " IMPORTANT: Save this guardian private key (emergency freeze key):");
+            console.log("   " + colors_1.c.dim(generatedGuardian.privateKey));
+            console.log("   " + colors_1.c.dim("Address: ") + colors_1.c.white(generatedGuardian.address) + "\n");
+            const guardianIface = new ethers_1.ethers.Interface(["function setGuardian(address _guardian) external"]);
+            await sendTx({ to: walletAddress, data: guardianIface.encodeFunctionData("setGuardian", [guardianAddress]), value: "0x0" }, "setGuardian");
+            (0, config_1.saveConfig)(config);
+        }
+        else if (guardianInput && ethers_1.ethers.isAddress(guardianInput)) {
+            guardianAddress = guardianInput;
+            config.guardianAddress = guardianInput;
+            const guardianIface = new ethers_1.ethers.Interface(["function setGuardian(address _guardian) external"]);
+            await sendTx({ to: walletAddress, data: guardianIface.encodeFunctionData("setGuardian", [guardianAddress]), value: "0x0" }, "setGuardian");
+            (0, config_1.saveConfig)(config);
+        }
+        else if (guardianInput) {
+            console.log(" " + colors_1.c.warning + " Invalid address — guardian skipped");
+        }
+    }
+    // 4c) setCategoryLimitFor('hire')
+    let hireLimit = "0.1";
+    let hireLimitAlreadySet = false;
+    try {
+        const limitsContract = new ethers_1.ethers.Contract(policyAddress, abis_1.POLICY_ENGINE_LIMITS_ABI, provider);
+        const existing = await limitsContract.categoryLimits(walletAddress, "hire");
+        if (existing > 0n) {
+            hireLimitAlreadySet = true;
+            hireLimit = ethers_1.ethers.formatEther(existing);
+            console.log(" " + colors_1.c.success + colors_1.c.dim(` Hire limit already set: ${hireLimit} ETH`));
+        }
+    }
+    catch { /* ignore */ }
+    if (!hireLimitAlreadySet) {
+        const limitAns = await (0, prompts_1.default)({
+            type: "text",
+            name: "limit",
+            message: "Max price per hire (ETH)?",
+            initial: "0.1",
+        });
+        hireLimit = limitAns.limit || "0.1";
+        const hireLimitWei = ethers_1.ethers.parseEther(hireLimit);
+        const policyIface = new ethers_1.ethers.Interface([
+            "function setCategoryLimitFor(address wallet, string category, uint256 limitPerTx) external",
+        ]);
+        await sendTx({ to: policyAddress, data: policyIface.encodeFunctionData("setCategoryLimitFor", [walletAddress, "hire", hireLimitWei]), value: "0x0" }, `setCategoryLimitFor: hire → ${hireLimit} ETH`);
+        (0, config_1.saveConfig)(config);
+    }
+    // 4d) enableContractInteraction(wallet, Handshake)
+    const contractInteractionIface = new ethers_1.ethers.Interface([
+        "function enableContractInteraction(address wallet, address target) external",
+    ]);
+    await sendTx({ to: policyAddress, data: contractInteractionIface.encodeFunctionData("enableContractInteraction", [walletAddress, handshakeAddress]), value: "0x0" }, "enableContractInteraction: Handshake");
+    (0, config_1.saveConfig)(config);
+    console.log(" " + colors_1.c.success + " Policy configured");
+    // ── Step 5: Agent Registration ─────────────────────────────────────────────
+    console.log("\n" + colors_1.c.dim("── Step 5: Agent Registration ─────────────────────────────────"));
+    let agentAlreadyRegistered = false;
+    let agentName = "";
+    let agentServiceType = "";
+    let agentEndpoint = "";
+    if (agentRegistryAddress) {
+        try {
+            const regContract = new ethers_1.ethers.Contract(agentRegistryAddress, abis_1.AGENT_REGISTRY_ABI, provider);
+            agentAlreadyRegistered = await regContract.isRegistered(walletAddress);
+            if (agentAlreadyRegistered) {
+                const info = await regContract.getAgent(walletAddress);
+                agentName = info.name;
+                agentServiceType = info.serviceType;
+                agentEndpoint = info.endpoint;
+                console.log(" " + colors_1.c.success + colors_1.c.dim(` Agent already registered: ${agentName}`));
+            }
+        }
+        catch { /* ignore */ }
+        if (!agentAlreadyRegistered) {
+            const rawHostname = os_1.default.hostname();
+            const cleanHostname = rawHostname.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
+            const answers = await (0, prompts_1.default)([
+                { type: "text", name: "name", message: "Agent name?", initial: cleanHostname },
+                { type: "text", name: "serviceType", message: "Service type?", initial: "intelligence" },
+                { type: "text", name: "caps", message: "Capabilities? (comma-separated)", initial: "research" },
+                { type: "text", name: "endpoint", message: "Endpoint?", initial: `https://${cleanHostname}.arc402.xyz` },
+            ]);
+            agentName = answers.name || cleanHostname;
+            agentServiceType = answers.serviceType || "intelligence";
+            agentEndpoint = answers.endpoint || `https://${cleanHostname}.arc402.xyz`;
+            const capabilities = (answers.caps || "research")
+                .split(",").map((s) => s.trim()).filter(Boolean);
+            // 5a) enableDefiAccess (check first)
+            const peExtIface = new ethers_1.ethers.Interface([
+                "function enableDefiAccess(address wallet) external",
+                "function whitelistContract(address wallet, address target) external",
+                "function defiAccessEnabled(address) external view returns (bool)",
+                "function isContractWhitelisted(address wallet, address target) external view returns (bool)",
+            ]);
+            const peContract = new ethers_1.ethers.Contract(policyAddress, peExtIface, provider);
+            const defiEnabled = await peContract.defiAccessEnabled(walletAddress).catch(() => false);
+            if (!defiEnabled) {
+                await sendTx({ to: policyAddress, data: peExtIface.encodeFunctionData("enableDefiAccess", [walletAddress]), value: "0x0" }, "enableDefiAccess on PolicyEngine");
+                (0, config_1.saveConfig)(config);
+            }
+            else {
+                console.log(" " + colors_1.c.success + colors_1.c.dim(" enableDefiAccess — already done"));
+            }
+            // 5b) whitelistContract for AgentRegistry (check first)
+            const whitelisted = await peContract.isContractWhitelisted(walletAddress, agentRegistryAddress).catch(() => false);
+            if (!whitelisted) {
+                await sendTx({ to: policyAddress, data: peExtIface.encodeFunctionData("whitelistContract", [walletAddress, agentRegistryAddress]), value: "0x0" }, "whitelistContract: AgentRegistry on PolicyEngine");
+                (0, config_1.saveConfig)(config);
+            }
+            else {
+                console.log(" " + colors_1.c.success + colors_1.c.dim(" whitelistContract(AgentRegistry) — already done"));
+            }
+            // 5c+d) executeContractCall → register
+            const regIface = new ethers_1.ethers.Interface(abis_1.AGENT_REGISTRY_ABI);
+            const execIface = new ethers_1.ethers.Interface(abis_1.ARC402_WALLET_EXECUTE_ABI);
+            const regData = regIface.encodeFunctionData("register", [agentName, capabilities, agentServiceType, agentEndpoint, ""]);
+            const execData = execIface.encodeFunctionData("executeContractCall", [{
+                    target: agentRegistryAddress,
+                    data: regData,
+                    value: 0n,
+                    minReturnValue: 0n,
+                    maxApprovalAmount: 0n,
+                    approvalToken: ethers_1.ethers.ZeroAddress,
+                }]);
+            await sendTx({ to: walletAddress, data: execData, value: "0x0" }, `register agent: ${agentName}`);
+            console.log(" " + colors_1.c.success + " Agent registered: " + agentName);
+        }
+    }
+    else {
+        console.log(" " + colors_1.c.warning + " AgentRegistry address not configured — skipping");
+    }
+    // ── Step 7: Workroom Init ─────────────────────────────────────────────────
+    console.log("\n" + colors_1.c.dim("── Step 7: Workroom ────────────────────────────────────────────"));
+    let workroomInitialized = false;
+    let dockerFound = false;
+    try {
+        const dockerCheck = (0, child_process_1.spawnSync)("docker", ["--version"], { encoding: "utf-8", timeout: 5000 });
+        dockerFound = dockerCheck.status === 0;
+    }
+    catch {
+        dockerFound = false;
+    }
+    if (dockerFound) {
+        console.log(" " + colors_1.c.dim("Docker found — initializing workroom..."));
+        try {
+            const initResult = (0, child_process_1.spawnSync)(process.execPath, [process.argv[1], "workroom", "init"], {
+                encoding: "utf-8",
+                timeout: 120000,
+                env: { ...process.env },
+            });
+            workroomInitialized = initResult.status === 0;
+            if (workroomInitialized) {
+                console.log(" " + colors_1.c.success + " Workroom initialized");
+            }
+            else {
+                console.log(" " + colors_1.c.warning + " Workroom init incomplete — run: arc402 workroom init");
+            }
+        }
+        catch {
+            console.log(" " + colors_1.c.warning + " Workroom init failed — run: arc402 workroom init");
+        }
+    }
+    else {
+        console.log(" " + colors_1.c.warning + " Docker not found");
+        console.log("   Install Docker: https://docs.docker.com/get-docker/");
+        console.log("   Or run daemon in host mode: " + colors_1.c.white("arc402 daemon start --host"));
+    }
+    // ── Step 8: Daemon Start ──────────────────────────────────────────────────
+    console.log("\n" + colors_1.c.dim("── Step 8: Daemon ──────────────────────────────────────────────"));
+    let daemonRunning = false;
+    const relayPort = 4402;
+    if (workroomInitialized) {
+        try {
+            const startResult = (0, child_process_1.spawnSync)(process.execPath, [process.argv[1], "workroom", "start"], {
+                encoding: "utf-8",
+                timeout: 30000,
+                env: { ...process.env },
+            });
+            daemonRunning = startResult.status === 0;
+            if (daemonRunning) {
+                console.log(" " + colors_1.c.success + " Daemon online (port " + relayPort + ")");
+            }
+            else {
+                console.log(" " + colors_1.c.warning + " Daemon start failed — run: arc402 workroom start");
+            }
+        }
+        catch {
+            console.log(" " + colors_1.c.warning + " Daemon start failed — run: arc402 workroom start");
+        }
+    }
+    else if (!dockerFound) {
+        try {
+            const startResult = (0, child_process_1.spawnSync)(process.execPath, [process.argv[1], "daemon", "start", "--host"], {
+                encoding: "utf-8",
+                timeout: 30000,
+                env: { ...process.env },
+            });
+            daemonRunning = startResult.status === 0;
+            if (daemonRunning) {
+                console.log(" " + colors_1.c.success + " Daemon online — host mode (port " + relayPort + ")");
+            }
+            else {
+                console.log(" " + colors_1.c.warning + " Daemon not started — run: arc402 daemon start --host");
+            }
+        }
+        catch {
+            console.log(" " + colors_1.c.warning + " Daemon not started — run: arc402 daemon start --host");
+        }
+    }
+    else {
+        console.log(" " + colors_1.c.warning + " Daemon not started — run: arc402 workroom init first");
+    }
+    // ── Step 6: Summary ───────────────────────────────────────────────────────
+    const trustScore = await (async () => {
+        try {
+            const trust = new ethers_1.ethers.Contract(config.trustRegistryAddress, abis_1.TRUST_REGISTRY_ABI, provider);
+            const s = await trust.getScore(walletAddress);
+            return s.toString();
+        }
+        catch {
+            return "100";
+        }
+    })();
+    const workroomLabel = dockerFound
+        ? (workroomInitialized ? (daemonRunning ? colors_1.c.green("✓ Running") : colors_1.c.yellow("✓ Initialized")) : colors_1.c.yellow("⚠ Init needed"))
+        : colors_1.c.yellow("⚠ No Docker");
+    const daemonLabel = daemonRunning
+        ? colors_1.c.green("✓ Online (port " + relayPort + ")")
+        : colors_1.c.dim("not started");
+    const endpointLabel = agentEndpoint
+        ? colors_1.c.white(agentEndpoint) + colors_1.c.dim(` → localhost:${relayPort}`)
+        : colors_1.c.dim("—");
+    console.log("\n " + colors_1.c.success + colors_1.c.white(" Onboarding complete"));
+    (0, tree_1.renderTree)([
+        { label: "Wallet", value: colors_1.c.white(walletAddress) },
+        { label: "Owner", value: colors_1.c.white(ownerAddress) },
+        { label: "Machine", value: colors_1.c.white(machineKeyAddress) + colors_1.c.dim(" (authorized)") },
+        { label: "Passkey", value: passkeyActive ? colors_1.c.green("✓ set") : colors_1.c.yellow("⚠ skipped") },
+        { label: "Velocity", value: colors_1.c.white(velocityLimitEth + " ETH") },
+        { label: "Guardian", value: guardianAddress ? colors_1.c.white(guardianAddress) : colors_1.c.dim("none") },
+        { label: "Hire limit", value: colors_1.c.white(hireLimit + " ETH") },
+        { label: "Agent", value: agentName ? colors_1.c.white(agentName) : colors_1.c.dim("not registered") },
+        { label: "Service", value: agentServiceType ? colors_1.c.white(agentServiceType) : colors_1.c.dim("—") },
+        { label: "Workroom", value: workroomLabel },
+        { label: "Daemon", value: daemonLabel },
+        { label: "Endpoint", value: endpointLabel },
+        { label: "Trust", value: colors_1.c.white(`${trustScore}`), last: true },
+    ]);
+    console.log("\n " + colors_1.c.dim("Next: fund your wallet with 0.002 ETH on Base"));
+}
 function printOpenShellHint() {
     const r = (0, child_process_1.spawnSync)("which", ["openshell"], { encoding: "utf-8" });
     if (r.status === 0 && r.stdout.trim()) {
@@ -604,30 +983,29 @@ function registerWalletCommands(program) {
                 console.error("Could not find WalletCreated event in receipt. Check the transaction on-chain.");
                 process.exit(1);
             }
+            // ── Step 1 complete: save wallet + owner immediately ─────────────────
             config.walletContractAddress = walletAddress;
             config.ownerAddress = account;
             (0, config_1.saveConfig)(config);
-            console.log("\n" + colors_1.c.success + colors_1.c.white(" ARC402Wallet deployed"));
+            try {
+                fs_1.default.chmodSync((0, config_1.getConfigPath)(), 0o600);
+            }
+            catch { /* best-effort */ }
+            console.log("\n " + colors_1.c.success + colors_1.c.white(" Wallet deployed"));
             (0, tree_1.renderTree)([
                 { label: "Wallet", value: walletAddress },
-                { label: "Owner", value: account + colors_1.c.dim(" (phone wallet)"), last: true },
+                { label: "Owner", value: account, last: true },
             ]);
-            // ── Mandatory onboarding ceremony (same WalletConnect session) ────────
-            console.log("\nStarting mandatory onboarding ceremony in this WalletConnect session...");
-            await runWalletOnboardingCeremony(walletAddress, account, config, provider, async (call, description) => {
-                console.log(" " + colors_1.c.dim(`Sending: ${description}`));
+            // ── Steps 2–6: Complete onboarding ceremony (same WalletConnect session)
+            const sendTxCeremony = async (call, description) => {
+                console.log(" " + colors_1.c.dim(`◈ ${description}`));
                 const hash = await (0, walletconnect_1.sendTransactionWithSession)(client, session, account, chainId, call);
+                console.log(" " + colors_1.c.dim("  waiting for confirmation..."));
                 await provider.waitForTransaction(hash, 1);
-                console.log(" " + colors_1.c.success + " " + colors_1.c.dim(description) + " " + colors_1.c.dim(hash));
+                console.log(" " + colors_1.c.success + " " + colors_1.c.white(description));
                 return hash;
-            });
-            console.log(colors_1.c.dim("Your wallet contract is ready for policy enforcement"));
-            const paymasterUrl2 = config.paymasterUrl ?? config_1.NETWORK_DEFAULTS[config.network]?.paymasterUrl;
-            const deployedBalance = await provider.getBalance(walletAddress);
-            if (paymasterUrl2 && deployedBalance < BigInt(1000000000000000)) {
-                console.log(colors_1.c.dim("Gas sponsorship active — initial setup ops are free"));
-            }
-            console.log(colors_1.c.dim("\nNext: run 'arc402 wallet set-guardian' to configure the emergency guardian key."));
+            };
+            await runCompleteOnboardingCeremony(walletAddress, account, config, provider, sendTxCeremony);
             printOpenShellHint();
         }
         else {
@@ -657,6 +1035,7 @@ function registerWalletCommands(program) {
             // Generate guardian key (separate from hot key) and call setGuardian
             const guardianWallet = ethers_1.ethers.Wallet.createRandom();
             config.walletContractAddress = walletAddress;
+            config.ownerAddress = address;
             config.guardianPrivateKey = guardianWallet.privateKey;
             config.guardianAddress = guardianWallet.address;
             (0, config_1.saveConfig)(config);
@@ -1367,14 +1746,29 @@ function registerWalletCommands(program) {
             console.error("walletConnectProjectId not set in config. Run `arc402 config set walletConnectProjectId <id>`.");
             process.exit(1);
         }
-        const ownerAddress = config.ownerAddress;
-        if (!ownerAddress) {
-            console.error("ownerAddress not set in config. Run `arc402 wallet deploy` first.");
-            process.exit(1);
-        }
         const policyAddress = config.policyEngineAddress ?? POLICY_ENGINE_DEFAULT;
         const chainId = config.network === "base-mainnet" ? 8453 : 84532;
         const provider = new ethers_1.ethers.JsonRpcProvider(config.rpcUrl);
+        let ownerAddress = config.ownerAddress;
+        if (!ownerAddress) {
+            // Fallback 1: WalletConnect session account
+            if (config.wcSession?.account) {
+                ownerAddress = config.wcSession.account;
+                console.log(colors_1.c.dim(`Owner resolved from WalletConnect session: ${ownerAddress}`));
+            }
+            else {
+                // Fallback 2: call owner() on the wallet contract
+                try {
+                    const walletOwnerContract = new ethers_1.ethers.Contract(config.walletContractAddress, ["function owner() external view returns (address)"], provider);
+                    ownerAddress = await walletOwnerContract.owner();
+                    console.log(colors_1.c.dim(`Owner resolved from contract: ${ownerAddress}`));
+                }
+                catch {
+                    console.error("ownerAddress not set in config and could not be resolved from contract or WalletConnect session.");
+                    process.exit(1);
+                }
+            }
+        }
         // Encode registerWallet(wallet, owner) calldata — called on PolicyEngine
         const policyInterface = new ethers_1.ethers.Interface([
             "function registerWallet(address wallet, address owner) external",