hedera-curb 0.4.1 → 0.4.2

package/dist/cli.js

@@ -6,9 +6,24 @@ import { createAuditTopic } from './audit.js';
 import { createPolicyRegistry, publishPolicyVersion } from './policy-registry.js';
 import { DEFAULT_CONFIG } from './config.js';
 const flag = (name) => {
-    const i = process.argv.indexOf(`--${name}`);
+    const eq = process.argv.find((a) => a.startsWith(`--${name}=`)); // support --name=value
+    if (eq)
+        return eq.slice(name.length + 3);
+    const i = process.argv.indexOf(`--${name}`); // and --name value
     return i >= 0 ? process.argv[i + 1] : undefined;
 };
+// a numeric flag must parse to a positive, finite number — otherwise we'd publish a garbage policy (NaN caps).
+const num = (name, def) => {
+    const raw = flag(name);
+    if (raw === undefined)
+        return def;
+    const n = Number(raw);
+    if (!Number.isFinite(n) || n <= 0) {
+        console.error(`Invalid --${name}: "${raw}" (expected a positive number).`);
+        process.exit(1);
+    }
+    return n;
+};
 function parseKey(s) {
     for (const parse of [PrivateKey.fromStringECDSA, PrivateKey.fromStringED25519, PrivateKey.fromStringDer]) {
         try {
@@ -29,6 +44,9 @@ async function init() {
         console.error('Missing credentials. Pass --account and --key, or set HEDERA_OPERATOR_ID / HEDERA_OPERATOR_KEY.');
         process.exit(1);
     }
+    // validate all input (flags + key) BEFORE any on-chain work, so bad input never creates topics
+    const perTask = num('per-task', DEFAULT_CONFIG.perTask);
+    const perDay = num('per-day', DEFAULT_CONFIG.perDay);
     console.log(`Provisioning Curb on ${network}…`);
     const client = Client.forName(network).setOperator(account, parseKey(key));
     const auditTopicId = await createAuditTopic(client);
@@ -37,8 +55,8 @@ async function init() {
         agentAccountId: agent,
         auditTopicId,
         ...DEFAULT_CONFIG,
-        perTask: Number(flag('per-task') ?? DEFAULT_CONFIG.perTask),
-        perDay: Number(flag('per-day') ?? DEFAULT_CONFIG.perDay),
+        perTask,
+        perDay,
     };
     await publishPolicyVersion(client, config, policyTopicId, 'initial policy').catch(() => { });
     console.log(`\n✓ Audit topic:  ${auditTopicId}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hedera-curb",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Verifiable spend-control policies for Hedera AI agents — drop-in Hedera Agent Kit hooks for budgets, allowlists, human approval, and an immutable HCS audit trail.",
   "license": "MIT",
   "type": "module",