cspr402 0.4.7

package/dist/commands/onboard.test.js

@@ -0,0 +1,48 @@
+"use strict";
+// Unit tests for the onboard command's wallet-name derivation. The
+// helper is the load-bearing piece that fixes the "second agent reuses
+// the first agent's OWS wallet" bug — the test exists to keep that
+// behaviour locked in across future edits.
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const onboard_1 = require("./onboard");
+(0, vitest_1.describe)('deriveDefaultWalletName', () => {
+    const claimA = 'c402_a1b2c3d4e5f607080910111213141516171819202122232425262728293031';
+    const claimB = 'c402_ff00112233445566778899aabbccddeeff00112233445566778899aabbccdd';
+    (0, vitest_1.it)('produces a name prefixed with cspr402-', () => {
+        (0, vitest_1.expect)((0, onboard_1._deriveDefaultWalletName)(claimA, 'research-bot')).toMatch(/^cspr402-/);
+    });
+    (0, vitest_1.it)('includes a slugified version of the label', () => {
+        (0, vitest_1.expect)((0, onboard_1._deriveDefaultWalletName)(claimA, 'Research Bot v2!')).toContain('research-bot-v2');
+    });
+    (0, vitest_1.it)('falls back to "agent" when the label is null', () => {
+        (0, vitest_1.expect)((0, onboard_1._deriveDefaultWalletName)(claimA, null)).toContain('agent');
+    });
+    (0, vitest_1.it)('falls back to "agent" when the label is empty', () => {
+        (0, vitest_1.expect)((0, onboard_1._deriveDefaultWalletName)(claimA, '')).toContain('agent');
+    });
+    (0, vitest_1.it)('produces different names for different claims — even with the same label', () => {
+        const a = (0, onboard_1._deriveDefaultWalletName)(claimA, 'research-bot');
+        const b = (0, onboard_1._deriveDefaultWalletName)(claimB, 'research-bot');
+        (0, vitest_1.expect)(a).not.toBe(b);
+    });
+    (0, vitest_1.it)('is deterministic — same inputs always yield the same name', () => {
+        (0, vitest_1.expect)((0, onboard_1._deriveDefaultWalletName)(claimA, 'research-bot')).toBe((0, onboard_1._deriveDefaultWalletName)(claimA, 'research-bot'));
+    });
+    (0, vitest_1.it)('accepts a claim without the c402_ prefix', () => {
+        const raw = (0, onboard_1._deriveDefaultWalletName)(claimA, 'x');
+        const noPrefix = (0, onboard_1._deriveDefaultWalletName)(claimA.replace(/^c402_/, ''), 'x');
+        (0, vitest_1.expect)(raw).toBe(noPrefix);
+    });
+    (0, vitest_1.it)('caps the label slug so a long label does not blow out the path', () => {
+        const long = 'a'.repeat(200);
+        const name = (0, onboard_1._deriveDefaultWalletName)(claimA, long);
+        // cspr402- + slug (<=24) + - + 8-hex = ~42 chars max
+        (0, vitest_1.expect)(name.length).toBeLessThanOrEqual(48);
+    });
+    (0, vitest_1.it)('never contains characters unsafe for a filesystem vault path', () => {
+        const name = (0, onboard_1._deriveDefaultWalletName)(claimA, '../../evil/$(whoami)');
+        (0, vitest_1.expect)(name).toMatch(/^cspr402-[a-z0-9-]+$/);
+    });
+});
+//# sourceMappingURL=onboard.test.js.map

package/dist/commands/onboard.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"onboard.test.js","sourceRoot":"","sources":["../../src/commands/onboard.test.ts"],"names":[],"mappings":";AAAA,mEAAmE;AACnE,uEAAuE;AACvE,mEAAmE;AACnE,2CAA2C;;AAE3C,mCAA8C;AAC9C,uCAAqD;AAErD,IAAA,iBAAQ,EAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,MAAM,MAAM,GAAG,qEAAqE,CAAC;IACrF,MAAM,MAAM,GAAG,qEAAqE,CAAC;IAErF,IAAA,WAAE,EAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,IAAA,eAAM,EAAC,IAAA,kCAAwB,EAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,IAAA,eAAM,EAAC,IAAA,kCAAwB,EAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,IAAA,eAAM,EAAC,IAAA,kCAAwB,EAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,IAAA,eAAM,EAAC,IAAA,kCAAwB,EAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,MAAM,CAAC,GAAG,IAAA,kCAAwB,EAAC,MAAM,EAAE,cAAc,CAAC,CAAC;QAC3D,MAAM,CAAC,GAAG,IAAA,kCAAwB,EAAC,MAAM,EAAE,cAAc,CAAC,CAAC;QAC3D,IAAA,eAAM,EAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,IAAA,eAAM,EAAC,IAAA,kCAAwB,EAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,IAAI,CAC3D,IAAA,kCAAwB,EAAC,MAAM,EAAE,cAAc,CAAC,CACjD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,GAAG,GAAG,IAAA,kCAAwB,EAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAClD,MAAM,QAAQ,GAAG,IAAA,kCAAwB,EAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QAC7E,IAAA,eAAM,EAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAA,kCAAwB,EAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACpD,qDAAqD;QACrD,IAAA,eAAM,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,MAAM,IAAI,GAAG,IAAA,kCAAwB,EAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;QACtE,IAAA,eAAM,EAAC,IAAI,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/commands/purchase.d.ts

@@ -0,0 +1,2 @@
+export declare function purchaseCommand(argv: string[]): Promise<number>;
+//# sourceMappingURL=purchase.d.ts.map

package/dist/commands/purchase.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"purchase.d.ts","sourceRoot":"","sources":["../../src/commands/purchase.ts"],"names":[],"mappings":"AAgKA,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAuDrE"}

package/dist/commands/purchase.js

@@ -0,0 +1,206 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.purchaseCommand = purchaseCommand;
+const client_1 = require("../client");
+const config_1 = require("../config");
+const CASPER_PUBLIC_KEY_RE = /^(01[0-9a-f]{64}|02[0-9a-f]{66})$/i;
+const ORDER_ID_RE = /^[a-zA-Z0-9_-]{1,64}$/;
+function parseArgs(argv) {
+    const out = {};
+    const takeAsset = (value) => {
+        if (!value)
+            return;
+        if (value === 'cspr_casper' || value === 'mock_usdc_cep18')
+            out.asset = value;
+        else
+            out.assetInvalid = value;
+    };
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        if (!arg)
+            continue;
+        if (arg === '-h' || arg === '--help')
+            out.help = true;
+        else if (arg === '-a' || arg === '--amount')
+            out.amount = argv[++i];
+        else if (arg.startsWith('--amount='))
+            out.amount = arg.slice('--amount='.length);
+        else if (arg === '--asset')
+            takeAsset(argv[++i]);
+        else if (arg.startsWith('--asset='))
+            takeAsset(arg.slice('--asset='.length));
+        else if (arg === '--payer-public-key' || arg === '--public-key')
+            out.payerPublicKey = argv[++i];
+        else if (arg.startsWith('--payer-public-key='))
+            out.payerPublicKey = arg.slice('--payer-public-key='.length);
+        else if (arg.startsWith('--public-key='))
+            out.payerPublicKey = arg.slice('--public-key='.length);
+        else if (arg === '--sender-public-key')
+            out.senderPublicKey = argv[++i];
+        else if (arg.startsWith('--sender-public-key='))
+            out.senderPublicKey = arg.slice('--sender-public-key='.length);
+        else if (arg === '--order' || arg === '--order-id')
+            out.orderId = argv[++i];
+        else if (arg.startsWith('--order='))
+            out.orderId = arg.slice('--order='.length);
+        else if (arg.startsWith('--order-id='))
+            out.orderId = arg.slice('--order-id='.length);
+        else if (arg === '--verify')
+            out.verifyDeployHash = argv[++i];
+        else if (arg.startsWith('--verify='))
+            out.verifyDeployHash = arg.slice('--verify='.length);
+    }
+    return out;
+}
+function usage() {
+    process.stderr.write(`Usage:
+  cspr402 purchase --amount <USD> [--payer-public-key <hex>]
+  cspr402 purchase --amount <USD> --asset mock_usdc_cep18 --payer-public-key <hex>
+  cspr402 purchase --order <order-id> --verify <deploy-hash> [--sender-public-key <hex>]
+
+Creates a CSPR402 order and prints Casper testnet payment instructions. The CLI
+does not store private key material or sign transfers. Pay from Casper Wallet,
+CSPR.click, casper-client, or your own agent runtime, then verify the deploy hash.
+
+Options:
+  -a, --amount <USD>              Mock virtual card value, for example 25.00
+  --asset <asset>                 cspr_casper (default) or mock_usdc_cep18
+  --payer-public-key <hex>        Casper testnet public key to bind the order
+  --order <order-id>              Existing order to verify
+  --verify <deploy-hash>          Casper deploy hash to verify
+  --sender-public-key <hex>       Sender public key for verify; defaults to payer/config key
+  -h, --help                      Show this message
+
+Examples:
+  cspr402 purchase --amount 10 --payer-public-key 01...
+  cspr402 purchase --order ord_123 --verify <64-char-deploy-hash>
+`);
+}
+function normalizeCasperPublicKey(value, label) {
+    if (!value)
+        return undefined;
+    const normalized = value.trim().toLowerCase();
+    if (!CASPER_PUBLIC_KEY_RE.test(normalized)) {
+        throw new Error(`${label} must be a Casper public key hex string.`);
+    }
+    return normalized;
+}
+function validateAmount(amount) {
+    if (!amount)
+        throw new Error('--amount <USD> is required.');
+    if (!/^\d+(\.\d{1,2})?$/.test(amount)) {
+        throw new Error('--amount must be a decimal string with up to 2 decimal places.');
+    }
+    const cents = Math.round(Number(amount) * 100);
+    if (!Number.isFinite(cents) || cents < 1)
+        throw new Error('--amount must be at least 0.01.');
+    if (cents > 1_000_000)
+        throw new Error('--amount cannot exceed 10000.00.');
+    return amount;
+}
+function validateOrderId(orderId) {
+    if (!orderId || !ORDER_ID_RE.test(orderId)) {
+        throw new Error('--order must be a valid CSPR402 order id.');
+    }
+    return orderId;
+}
+function validateDeployHash(deployHash) {
+    const normalized = (deployHash || '').trim().toLowerCase();
+    if (!/^[0-9a-f]{64}$/.test(normalized)) {
+        throw new Error('--verify must be a 64-character Casper deploy hash.');
+    }
+    return normalized;
+}
+function configuredPayer(args) {
+    const config = (0, config_1.loadCards402Config)();
+    return normalizeCasperPublicKey(args.payerPublicKey ||
+        args.senderPublicKey ||
+        process.env.CSPR402_CASPER_PUBLIC_KEY ||
+        config?.casper_public_key, 'payer public key');
+}
+function printPayment(payment) {
+    process.stdout.write('\nPayment instruction\n');
+    process.stdout.write('-------------------\n');
+    if (payment.type === 'casper_cspr_transfer') {
+        process.stdout.write(`Rail:        Casper testnet CSPR\n`);
+        process.stdout.write(`Chain:       ${payment.chain_name}\n`);
+        process.stdout.write(`Recipient:   ${payment.recipient}\n`);
+        if (payment.sender_public_key)
+            process.stdout.write(`Sender:      ${payment.sender_public_key}\n`);
+        process.stdout.write(`Amount:      ${payment.amount_cspr} CSPR\n`);
+        process.stdout.write(`Motes:       ${payment.amount_motes}\n`);
+        process.stdout.write(`transfer_id: ${payment.transfer_id}\n`);
+        process.stdout.write(`Expires:     ${payment.expires_at}\n`);
+        return;
+    }
+    if (payment.type === 'casper_cep18_transfer') {
+        process.stdout.write(`Rail:        mockUSDC CEP-18\n`);
+        process.stdout.write(`Chain:       ${payment.chain_name}\n`);
+        process.stdout.write(`Package:     ${payment.contract_package_hash}\n`);
+        if (payment.contract_hash)
+            process.stdout.write(`Contract:    ${payment.contract_hash}\n`);
+        process.stdout.write(`Sender:      ${payment.sender_public_key}\n`);
+        process.stdout.write(`Recipient:   ${payment.recipient_public_key}\n`);
+        process.stdout.write(`Amount:      ${payment.amount} mockUSDC\n`);
+        process.stdout.write(`Base units:  ${payment.amount_base_units}\n`);
+        process.stdout.write(`Expires:     ${payment.expires_at}\n`);
+        return;
+    }
+    process.stdout.write(`Unsupported legacy payment instruction: ${payment.type}\n`);
+}
+function printOrder(order) {
+    process.stdout.write(`Order:       ${order.order_id}\n`);
+    process.stdout.write(`Status:      ${order.status}\n`);
+    printPayment(order.payment);
+    process.stdout.write('\nAfter payment finalizes, verify with:\n');
+    process.stdout.write(`  cspr402 purchase --order ${order.order_id} --verify <deploy-hash>\n`);
+}
+async function purchaseCommand(argv) {
+    const args = parseArgs(argv);
+    if (args.help) {
+        usage();
+        return 0;
+    }
+    try {
+        if (args.assetInvalid)
+            throw new Error(`--asset must be cspr_casper or mock_usdc_cep18.`);
+        const client = new client_1.CSPR402Client();
+        if (args.verifyDeployHash || args.orderId) {
+            const orderId = validateOrderId(args.orderId);
+            const deployHash = validateDeployHash(args.verifyDeployHash);
+            const senderPublicKey = normalizeCasperPublicKey(args.senderPublicKey ||
+                args.payerPublicKey ||
+                process.env.CSPR402_CASPER_PUBLIC_KEY ||
+                (0, config_1.loadCards402Config)()?.casper_public_key, 'sender public key');
+            const verified = await client.verifyCasperPayment(orderId, deployHash, {
+                ...(senderPublicKey ? { senderPublicKey } : {}),
+            });
+            process.stdout.write(`Payment verified for ${verified.order.order_id}\n`);
+            process.stdout.write(`Status: ${verified.order.status} (phase: ${verified.order.phase})\n`);
+            process.stdout.write(`Receipt: ${verified.receipt.type}\n`);
+            process.stdout.write(`Deploy: ${verified.receipt.deploy_hash}\n`);
+            if (verified.order.card) {
+                process.stdout.write(`Mock card: ${verified.order.card.brand || 'Mock Virtual Card'}\n`);
+            }
+            return 0;
+        }
+        const amount = validateAmount(args.amount);
+        const paymentAsset = args.asset || 'cspr_casper';
+        const payerPublicKey = configuredPayer(args);
+        if (paymentAsset === 'mock_usdc_cep18' && !payerPublicKey) {
+            throw new Error('mock_usdc_cep18 requires --payer-public-key so the order is bound to the sender.');
+        }
+        const order = await client.createOrder({
+            amount_usdc: amount,
+            payment_asset: paymentAsset,
+            ...(payerPublicKey ? { payer_public_key: payerPublicKey } : {}),
+        });
+        printOrder(order);
+        return 0;
+    }
+    catch (err) {
+        process.stderr.write(`error: ${err instanceof Error ? err.message : String(err)}\n`);
+        return 1;
+    }
+}
+//# sourceMappingURL=purchase.js.map

package/dist/commands/purchase.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"purchase.js","sourceRoot":"","sources":["../../src/commands/purchase.ts"],"names":[],"mappings":";;AAgKA,0CAuDC;AAvND,sCAAwF;AACxF,sCAA+C;AAe/C,MAAM,oBAAoB,GAAG,oCAAoC,CAAC;AAClE,MAAM,WAAW,GAAG,uBAAuB,CAAC;AAE5C,SAAS,SAAS,CAAC,IAAc;IAC/B,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,CAAC,KAAyB,EAAQ,EAAE;QACpD,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,IAAI,KAAK,KAAK,aAAa,IAAI,KAAK,KAAK,iBAAiB;YAAE,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC;;YACzE,GAAG,CAAC,YAAY,GAAG,KAAK,CAAC;IAChC,CAAC,CAAC;IACF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,QAAQ;YAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;aACjD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,UAAU;YAAE,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;aAC/D,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;aAC5E,IAAI,GAAG,KAAK,SAAS;YAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;aAC5C,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;aACxE,IAAI,GAAG,KAAK,oBAAoB,IAAI,GAAG,KAAK,cAAc;YAAE,GAAG,CAAC,cAAc,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;aAC3F,IAAI,GAAG,CAAC,UAAU,CAAC,qBAAqB,CAAC;YAC5C,GAAG,CAAC,cAAc,GAAG,GAAG,CAAC,KAAK,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;aAC1D,IAAI,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC;YACtC,GAAG,CAAC,cAAc,GAAG,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;aACpD,IAAI,GAAG,KAAK,qBAAqB;YAAE,GAAG,CAAC,eAAe,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;aACnE,IAAI,GAAG,CAAC,UAAU,CAAC,sBAAsB,CAAC;YAC7C,GAAG,CAAC,eAAe,GAAG,GAAG,CAAC,KAAK,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;aAC5D,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,YAAY;YAAE,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;aACvE,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;aAC3E,IAAI,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC;YAAE,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;aACjF,IAAI,GAAG,KAAK,UAAU;YAAE,GAAG,CAAC,gBAAgB,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;aACzD,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,GAAG,CAAC,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,KAAK;IACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;;;;;;CAqBtB,CAAC,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAyB,EAAE,KAAa;IACxE,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,0CAA0C,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,cAAc,CAAC,MAA0B;IAChD,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC5D,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAC7F,IAAI,KAAK,GAAG,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC3E,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,OAA2B;IAClD,IAAI,CAAC,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,kBAAkB,CAAC,UAA8B;IACxD,MAAM,UAAU,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3D,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,eAAe,CAAC,IAAkB;IACzC,MAAM,MAAM,GAAG,IAAA,2BAAkB,GAAE,CAAC;IACpC,OAAO,wBAAwB,CAC7B,IAAI,CAAC,cAAc;QACjB,IAAI,CAAC,eAAe;QACpB,OAAO,CAAC,GAAG,CAAC,yBAAyB;QACrC,MAAM,EAAE,iBAAiB,EAC3B,kBAAkB,CACnB,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,OAA4B;IAChD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAChD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC9C,IAAI,OAAO,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;QAC5C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAC3D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC;QAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC;QAC5D,IAAI,OAAO,CAAC,iBAAiB;YAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,OAAO,CAAC,iBAAiB,IAAI,CAAC,CAAC;QACtE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,OAAO,CAAC,WAAW,SAAS,CAAC,CAAC;QACnE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC;QAC/D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC;QAC9D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC;QAC7D,OAAO;IACT,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;QAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC;QAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,OAAO,CAAC,qBAAqB,IAAI,CAAC,CAAC;QACxE,IAAI,OAAO,CAAC,aAAa;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,OAAO,CAAC,aAAa,IAAI,CAAC,CAAC;QAC3F,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,OAAO,CAAC,iBAAiB,IAAI,CAAC,CAAC;QACpE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,OAAO,CAAC,oBAAoB,IAAI,CAAC,CAAC;QACvE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,OAAO,CAAC,MAAM,aAAa,CAAC,CAAC;QAClE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,OAAO,CAAC,iBAAiB,IAAI,CAAC,CAAC;QACpE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC;QAC7D,OAAO;IACT,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2CAA2C,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,UAAU,CAAC,KAAoB;IACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC;IACzD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;IACvD,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAClE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,KAAK,CAAC,QAAQ,2BAA2B,CAAC,CAAC;AAChG,CAAC;AAEM,KAAK,UAAU,eAAe,CAAC,IAAc;IAClD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,KAAK,EAAE,CAAC;QACR,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QAE1F,MAAM,MAAM,GAAG,IAAI,sBAAa,EAAE,CAAC;QAEnC,IAAI,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC1C,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC9C,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAC7D,MAAM,eAAe,GAAG,wBAAwB,CAC9C,IAAI,CAAC,eAAe;gBAClB,IAAI,CAAC,cAAc;gBACnB,OAAO,CAAC,GAAG,CAAC,yBAAyB;gBACrC,IAAA,2BAAkB,GAAE,EAAE,iBAAiB,EACzC,mBAAmB,CACpB,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,UAAU,EAAE;gBACrE,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChD,CAAC,CAAC;YACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,QAAQ,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC;YAC1E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,QAAQ,CAAC,KAAK,CAAC,MAAM,YAAY,QAAQ,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,CAAC;YAC5F,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC;YAC5D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,QAAQ,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC;YAClE,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,mBAAmB,IAAI,CAAC,CAAC;YAC3F,CAAC;YACD,OAAO,CAAC,CAAC;QACX,CAAC;QAED,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,IAAI,aAAa,CAAC;QACjD,MAAM,cAAc,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,YAAY,KAAK,iBAAiB,IAAI,CAAC,cAAc,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CACb,kFAAkF,CACnF,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC;YACrC,WAAW,EAAE,MAAM;YACnB,aAAa,EAAE,YAAY;YAC3B,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC,CAAC;QACH,UAAU,CAAC,KAAK,CAAC,CAAC;QAClB,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrF,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC"}

package/dist/commands/wallet.d.ts

@@ -0,0 +1,2 @@
+export declare function walletCommand(argv: string[]): Promise<number>;
+//# sourceMappingURL=wallet.d.ts.map

package/dist/commands/wallet.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wallet.d.ts","sourceRoot":"","sources":["../../src/commands/wallet.ts"],"names":[],"mappings":"AAiIA,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAkEnE"}

package/dist/commands/wallet.js

@@ -0,0 +1,161 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.walletCommand = walletCommand;
+const config_1 = require("../config");
+const CASPER_PUBLIC_KEY_RE = /^(01[0-9a-f]{64}|02[0-9a-f]{66})$/i;
+const DEFAULT_RPC_URL = 'https://node.testnet.casper.network/rpc';
+const MOTES_PER_CSPR = 1000000000n;
+function usage() {
+    process.stderr.write(`Usage: cspr402 wallet <subcommand> [--public-key <hex>] [--rpc-url <url>]
+
+Subcommands:
+  address              Print the configured Casper public key
+  key-path             Print the configured local key-file path, if one was saved
+  balance              Query Casper testnet CSPR balance for the configured public key
+  info                 Print configured wallet context
+  -h, --help           Show this message
+
+The wallet command is read-only. It never reads or stores private key material;
+the optional key path is only a local pointer saved by onboarding.
+`);
+}
+function parseFlag(rest, name) {
+    for (let i = 0; i < rest.length; i++) {
+        const arg = rest[i];
+        if (!arg)
+            continue;
+        if (arg === name)
+            return rest[i + 1];
+        if (arg.startsWith(`${name}=`))
+            return arg.slice(name.length + 1);
+    }
+    return undefined;
+}
+function normalizePublicKey(value) {
+    if (!value)
+        return undefined;
+    const normalized = value.trim().toLowerCase();
+    if (!CASPER_PUBLIC_KEY_RE.test(normalized)) {
+        throw new Error('Casper public key must be 01 + 32 bytes or 02 + 33 bytes in hex.');
+    }
+    return normalized;
+}
+function resolvePublicKey(rest) {
+    const config = (0, config_1.loadCards402Config)();
+    const publicKey = normalizePublicKey(parseFlag(rest, '--public-key') ||
+        process.env.CSPR402_CASPER_PUBLIC_KEY ||
+        config?.casper_public_key);
+    if (!publicKey) {
+        throw new Error("No Casper public key configured. Re-run 'cspr402 onboard --claim <code> --casper-public-key <hex>' or pass --public-key.");
+    }
+    return publicKey;
+}
+function resolveRpcUrl(rest) {
+    return (parseFlag(rest, '--rpc-url') ||
+        process.env.CSPR402_CASPER_NODE_RPC_URL ||
+        process.env.CASPER_NODE_RPC_URL ||
+        DEFAULT_RPC_URL);
+}
+async function rpcCall(rpcUrl, method, params) {
+    const res = await fetch(rpcUrl, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ id: 1, jsonrpc: '2.0', method, params }),
+    });
+    const body = (await res.json().catch(() => ({})));
+    if (!res.ok || body.error) {
+        const msg = body.error?.message ||
+            (typeof body.error?.data === 'string' ? body.error.data : undefined) ||
+            `Casper RPC HTTP ${res.status}`;
+        throw new Error(msg);
+    }
+    return body.result;
+}
+function unwrapValue(result) {
+    const obj = result;
+    if (obj && typeof obj === 'object' && obj.value && typeof obj.value === 'object') {
+        return obj.value;
+    }
+    return obj || {};
+}
+function formatCSPR(motesRaw) {
+    const motes = BigInt(motesRaw);
+    const whole = motes / MOTES_PER_CSPR;
+    const frac = String(motes % MOTES_PER_CSPR).padStart(9, '0');
+    return `${whole}.${frac}`;
+}
+async function fetchBalance(publicKey, rpcUrl) {
+    const accountInfo = unwrapValue(await rpcCall(rpcUrl, 'state_get_account_info', [
+        { name: 'account_identifier', value: publicKey },
+    ]));
+    const account = accountInfo.account;
+    const accountHash = typeof account?.account_hash === 'string' ? account.account_hash : undefined;
+    if (!accountHash) {
+        throw new Error('Account was not found on Casper testnet. Fund it with testnet CSPR first.');
+    }
+    const balanceResult = unwrapValue(await rpcCall(rpcUrl, 'query_balance', [
+        {
+            name: 'purse_identifier',
+            value: { main_purse_under_account_hash: accountHash },
+        },
+    ]));
+    const balance = balanceResult.balance;
+    if (typeof balance !== 'string' || !/^\d+$/.test(balance)) {
+        throw new Error('Casper RPC did not return a parseable balance.');
+    }
+    return { accountHash, motes: balance };
+}
+async function walletCommand(argv) {
+    const [sub, ...rest] = argv;
+    if (!sub || sub === '-h' || sub === '--help' || sub === 'help') {
+        usage();
+        return sub ? 0 : 2;
+    }
+    try {
+        const config = (0, config_1.loadCards402Config)();
+        if (sub === 'address') {
+            process.stdout.write(`${resolvePublicKey(rest)}\n`);
+            return 0;
+        }
+        if (sub === 'key-path') {
+            const keyPath = parseFlag(rest, '--key-path') ||
+                process.env.CSPR402_CASPER_KEY_PATH ||
+                config?.casper_key_path;
+            if (!keyPath) {
+                process.stderr.write('No Casper key-file path configured.\n');
+                return 1;
+            }
+            process.stdout.write(`${keyPath}\n`);
+            return 0;
+        }
+        if (sub === 'info') {
+            const publicKey = normalizePublicKey(parseFlag(rest, '--public-key') ||
+                process.env.CSPR402_CASPER_PUBLIC_KEY ||
+                config?.casper_public_key);
+            process.stdout.write(`config:     ${process.env.CSPR402_CONFIG_DIR || '~/.cspr402'}/config.json\n`);
+            process.stdout.write(`api_url:    ${config?.api_url || process.env.CSPR402_BASE_URL || 'not configured'}\n`);
+            process.stdout.write(`public_key: ${publicKey || 'not configured'}\n`);
+            process.stdout.write(`key_path:   ${config?.casper_key_path || process.env.CSPR402_CASPER_KEY_PATH || 'not configured'}\n`);
+            process.stdout.write(`rpc_url:    ${resolveRpcUrl(rest)}\n`);
+            return 0;
+        }
+        if (sub === 'balance') {
+            const publicKey = resolvePublicKey(rest);
+            const rpcUrl = resolveRpcUrl(rest);
+            const balance = await fetchBalance(publicKey, rpcUrl);
+            process.stdout.write(`address:      ${publicKey}\n`);
+            process.stdout.write(`account_hash: ${balance.accountHash}\n`);
+            process.stdout.write(`motes:        ${balance.motes}\n`);
+            process.stdout.write(`cspr:         ${formatCSPR(balance.motes)}\n`);
+            return 0;
+        }
+        process.stderr.write(`error: unknown wallet subcommand '${sub}'\n`);
+        usage();
+        return 2;
+    }
+    catch (err) {
+        process.stderr.write(`error: ${err instanceof Error ? err.message : String(err)}\n`);
+        return 1;
+    }
+}
+//# sourceMappingURL=wallet.js.map

package/dist/commands/wallet.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wallet.js","sourceRoot":"","sources":["../../src/commands/wallet.ts"],"names":[],"mappings":";;AAiIA,sCAkEC;AAnMD,sCAA+C;AAE/C,MAAM,oBAAoB,GAAG,oCAAoC,CAAC;AAClE,MAAM,eAAe,GAAG,yCAAyC,CAAC;AAClE,MAAM,cAAc,GAAG,WAAc,CAAC;AAEtC,SAAS,KAAK;IACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;;;;;;;;;;;CAWtB,CAAC,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,IAAc,EAAE,IAAY;IAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACrC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAyB;IACnD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAc;IACtC,MAAM,MAAM,GAAG,IAAA,2BAAkB,GAAE,CAAC;IACpC,MAAM,SAAS,GAAG,kBAAkB,CAClC,SAAS,CAAC,IAAI,EAAE,cAAc,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,yBAAyB;QACrC,MAAM,EAAE,iBAAiB,CAC5B,CAAC;IACF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,0HAA0H,CAC3H,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,aAAa,CAAC,IAAc;IACnC,OAAO,CACL,SAAS,CAAC,IAAI,EAAE,WAAW,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,2BAA2B;QACvC,OAAO,CAAC,GAAG,CAAC,mBAAmB;QAC/B,eAAe,CAChB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,MAAc,EAAE,MAAc,EAAE,MAAiB;IACtE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE;QAC9B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;KAChE,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAG/C,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC1B,MAAM,GAAG,GACP,IAAI,CAAC,KAAK,EAAE,OAAO;YACnB,CAAC,OAAO,IAAI,CAAC,KAAK,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YACpE,mBAAmB,GAAG,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC;AACrB,CAAC;AAED,SAAS,WAAW,CAAC,MAAe;IAClC,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACjF,OAAO,GAAG,CAAC,KAAgC,CAAC;IAC9C,CAAC;IACD,OAAO,GAAG,IAAI,EAAE,CAAC;AACnB,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB;IAClC,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,KAAK,GAAG,cAAc,CAAC;IACrC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,GAAG,cAAc,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC7D,OAAO,GAAG,KAAK,IAAI,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,SAAiB,EACjB,MAAc;IAEd,MAAM,WAAW,GAAG,WAAW,CAC7B,MAAM,OAAO,CAAC,MAAM,EAAE,wBAAwB,EAAE;QAC9C,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,SAAS,EAAE;KACjD,CAAC,CACH,CAAC;IACF,MAAM,OAAO,GAAG,WAAW,CAAC,OAA8C,CAAC;IAC3E,MAAM,WAAW,GAAG,OAAO,OAAO,EAAE,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IACjG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;IAC/F,CAAC;IAED,MAAM,aAAa,GAAG,WAAW,CAC/B,MAAM,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE;QACrC;YACE,IAAI,EAAE,kBAAkB;YACxB,KAAK,EAAE,EAAE,6BAA6B,EAAE,WAAW,EAAE;SACtD;KACF,CAAC,CACH,CAAC;IACF,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC;IACtC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AACzC,CAAC;AAEM,KAAK,UAAU,aAAa,CAAC,IAAc;IAChD,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC5B,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QAC/D,KAAK,EAAE,CAAC;QACR,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAA,2BAAkB,GAAE,CAAC;QAEpC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpD,OAAO,CAAC,CAAC;QACX,CAAC;QAED,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;YACvB,MAAM,OAAO,GACX,SAAS,CAAC,IAAI,EAAE,YAAY,CAAC;gBAC7B,OAAO,CAAC,GAAG,CAAC,uBAAuB;gBACnC,MAAM,EAAE,eAAe,CAAC;YAC1B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;gBAC9D,OAAO,CAAC,CAAC;YACX,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;YACrC,OAAO,CAAC,CAAC;QACX,CAAC;QAED,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;YACnB,MAAM,SAAS,GAAG,kBAAkB,CAClC,SAAS,CAAC,IAAI,EAAE,cAAc,CAAC;gBAC7B,OAAO,CAAC,GAAG,CAAC,yBAAyB;gBACrC,MAAM,EAAE,iBAAiB,CAC5B,CAAC;YACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,eAAe,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,YAAY,gBAAgB,CAC9E,CAAC;YACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,eAAe,MAAM,EAAE,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,gBAAgB,IAAI,CACvF,CAAC;YACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,SAAS,IAAI,gBAAgB,IAAI,CAAC,CAAC;YACvE,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,eAAe,MAAM,EAAE,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,gBAAgB,IAAI,CACtG,CAAC;YACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7D,OAAO,CAAC,CAAC;QACX,CAAC;QAED,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;YACnC,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACtD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,SAAS,IAAI,CAAC,CAAC;YACrD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC;YAC/D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC;YACzD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACrE,OAAO,CAAC,CAAC;QACX,CAAC;QAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,GAAG,KAAK,CAAC,CAAC;QACpE,KAAK,EAAE,CAAC;QACR,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrF,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,77 @@
+export interface Cards402Config {
+    api_key: string;
+    api_url: string;
+    webhook_secret?: string | null;
+    wallet_name?: string;
+    vault_path?: string;
+    casper_public_key?: string;
+    casper_key_path?: string;
+    /**
+     * Adversarial audit F12: the NAME of the environment variable that
+     * holds the OWS wallet passphrase, NOT the passphrase value itself.
+     * Subsequent CLI commands read this field, look up
+     * `process.env[passphrase_env]` at call time, and pass the value to
+     * the OWS layer. We never persist the passphrase value to disk —
+     * a config dump alone gives an attacker the api key but not the
+     * keys to the wallet vault.
+     */
+    passphrase_env?: string;
+    created_at: string;
+}
+export declare function loadCards402Config(configPath?: string): Cards402Config | null;
+/**
+ * Validate a base URL for safety before storing it in the config or
+ * using it for API calls. Rejects everything that isn't HTTPS unless
+ * the explicit CARDS402_ALLOW_INSECURE_BASE_URL escape hatch is set,
+ * which only exists so local dev against http://localhost:4000 still
+ * works. Returns the parsed URL.string() on success, throws on reject.
+ *
+ * Called from:
+ *   - onboard, when persisting the api_url returned by the claim
+ *     endpoint (defends against a MITM or compromised backend that
+ *     injects http:// or a foreign origin into the response)
+ *   - resolveCredentials, when an env-var override is used for
+ *     baseUrl (defends against a user being tricked into setting
+ *     CARDS402_BASE_URL to an attacker target)
+ */
+export declare function assertSafeBaseUrl(url: string, opts?: {
+    context?: string;
+}): string;
+/**
+ * Write the config file atomically with 0600 permissions so only the
+ * owner can read it. Creates the parent directory on demand.
+ *
+ * Atomicity: write to `<path>.tmp-<pid>-<rand>` first, fsync, then
+ * rename over the target. A mid-write crash (power loss, OOM, Ctrl-C
+ * between write and flush) leaves the old file intact instead of a
+ * truncated new one that loadCards402Config would explode on.
+ *
+ * Permission hardening: the `mode` option on writeFileSync only
+ * applies when the file is being CREATED, so a stale 0644 file from
+ * an earlier buggy version would retain its wide permissions forever.
+ * We fsync+rename so the temp path is always freshly created with
+ * 0600, then the rename replaces the target atomically.
+ */
+export declare function saveCards402Config(config: Cards402Config, configPath?: string): {
+    path: string;
+};
+/**
+ * Resolve an api key + base URL at SDK call time, in priority order:
+ *   1. Explicit `apiKey` / `baseUrl` passed to the call
+ *   2. CSPR402_API_KEY / CSPR402_BASE_URL env vars
+ *   3. ~/.cspr402/config.json
+ *
+ * The two fields resolve independently — passing `apiKey` to a call
+ * that needs its `baseUrl` to come from config.json used to silently
+ * drop the config lookup because the early-return on `opts.apiKey`
+ * was only consulting env vars for baseUrl. Now both fields walk the
+ * full priority chain and only stop once each is filled.
+ */
+export declare function resolveCredentials(opts?: {
+    apiKey?: string;
+    baseUrl?: string;
+}): {
+    apiKey: string | undefined;
+    baseUrl: string | undefined;
+};
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAoBA,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;CACpB;AAkCD,wBAAgB,kBAAkB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CA8E7E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,MAAM,CAkCtF;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,cAAc,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAgEhG;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,GAAE;IACJ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CACb,GACL;IAAE,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CA8B7D"}