leak-cli 2026.2.17-beta.1 → 2026.2.17

package/scripts/config.js

@@ -15,17 +15,46 @@ import {
   writeConfig,
 } from "./config_store.js";
 import { resolveSupportedChain } from "../src/chain_meta.js";
+import {
+  ACCESS_MODE_VALUES,
+  DEFAULT_ACCESS_MODE,
+  accessModeRequiresDownloadCode,
+  accessModeRequiresPayment,
+  isValidAccessMode,
+} from "../src/access_mode.js";
+import { hashDownloadCode } from "../src/download_code.js";
+import { createUi } from "./ui.js";
 
 const ALLOWED_FACILITATOR_MODES = new Set(["testnet", "cdp_mainnet"]);
 const ALLOWED_CONFIRMATION_POLICIES = new Set(["confirmed", "optimistic"]);
+const outUi = createUi(output);
+const errUi = createUi(process.stderr);
+
+function logInfo(message) {
+  console.log(outUi.statusLine("info", message));
+}
+
+function logOk(message) {
+  console.log(outUi.statusLine("ok", message));
+}
+
+function logWarn(message) {
+  console.error(errUi.statusLine("warn", message));
+}
+
+function logError(message) {
+  console.error(errUi.statusLine("error", message));
+}
 
 function usageAndExit(code = 0) {
-  console.log("Usage:");
+  console.log(outUi.heading("Leak Config CLI"));
+  console.log("");
+  console.log(outUi.section("Usage"));
   console.log("  leak config");
   console.log("  leak config show");
   console.log("  leak config --write-env");
   console.log("");
-  console.log("Notes:");
+  console.log(outUi.section("Notes"));
   console.log("  - Stores defaults in ~/.leak/config.json");
   console.log("  - `--write-env` writes a project .env scaffold in the current directory");
   process.exit(code);
@@ -123,19 +152,48 @@ async function askOgField(rl, label, currentValue, fieldType) {
   }
 }
 
+async function askDownloadCodeHash(rl, existingHash, accessMode) {
+  if (!accessModeRequiresDownloadCode(accessMode)) return "";
+
+  if (existingHash) {
+    const prompt = new Select({
+      name: "DOWNLOAD_CODE",
+      message: "DOWNLOAD_CODE (required by selected ACCESS_MODE)",
+      choices: [
+        { name: "keep", message: "Keep existing stored download code hash" },
+        { name: "replace", message: "Replace with new download code" },
+      ],
+      initial: 0,
+    });
+    const choice = await prompt.run();
+    if (choice === "keep") return existingHash;
+  }
+
+  let raw = (await rl.question("DOWNLOAD_CODE (input visible): ")).trim();
+  while (!raw) {
+    logError("DOWNLOAD_CODE is required for the selected ACCESS_MODE.");
+    raw = (await rl.question("DOWNLOAD_CODE (input visible): ")).trim();
+  }
+  return hashDownloadCode(raw);
+}
+
 function printShow() {
   const loaded = readConfig();
   if (loaded.error) {
-    console.error(`[config] warning: ${loaded.error}`);
+    logWarn(loaded.error);
   }
   if (!loaded.exists) {
-    console.log(`No leak config found at ${loaded.path}`);
-    console.log("Run `leak config` to initialize your config file.");
+    logInfo(`No leak config found at ${loaded.path}`);
+    logInfo("Run `leak config` to initialize your config file.");
     return;
   }
 
   const redacted = redactConfig(loaded.config);
-  console.log(`Leak config path: ${loaded.path}`);
+  console.log(outUi.section("Leak Config"));
+  for (const line of outUi.formatRows([{ key: "path", value: loaded.path }])) {
+    console.log(line);
+  }
+  console.log("");
   console.log(JSON.stringify(redacted, null, 2));
 }
 
@@ -158,6 +216,10 @@ function buildEnvScaffold(defaults) {
     `CHAIN_ID=${defaults.chainId || "eip155:84532"}`,
     `WINDOW_SECONDS=${windowSeconds ?? 3600}`,
     "",
+    "# Access control",
+    `ACCESS_MODE=${defaults.accessMode || DEFAULT_ACCESS_MODE}`,
+    `DOWNLOAD_CODE_HASH=${defaults.downloadCodeHash || ""}`,
+    "",
     "# Required when FACILITATOR_MODE=cdp_mainnet (Base mainnet path)",
     `CDP_API_KEY_ID=${defaults.cdpApiKeyId || ""}`,
     `CDP_API_KEY_SECRET=${defaults.cdpApiKeySecret || ""}`,
@@ -182,19 +244,19 @@ function buildEnvScaffold(defaults) {
 function maybeWriteEnvScaffold(defaults) {
   const envPath = path.resolve(process.cwd(), ".env");
   if (fs.existsSync(envPath)) {
-    console.log(`[config] ${envPath} already exists; skipping .env scaffold write.`);
+    logWarn(`${envPath} already exists; skipping .env scaffold write.`);
     return;
   }
 
   const body = buildEnvScaffold(defaults);
   fs.writeFileSync(envPath, body);
-  console.log(`[config] wrote ${envPath}`);
+  logOk(`Wrote ${envPath}`);
 }
 
 async function runWizard({ writeEnv }) {
   const loaded = readConfig();
   if (loaded.error) {
-    console.error(`[config] warning: ${loaded.error}`);
+    logWarn(loaded.error);
   }
 
   const existing = loaded.config.defaults || {};
@@ -206,16 +268,12 @@ async function runWizard({ writeEnv }) {
       "SELLER_PAY_TO (seller payout address)",
       existing.sellerPayTo || "",
     );
-    while (true) {
-      sellerPayTo = String(sellerPayTo || "").trim();
-      if (!sellerPayTo) {
-        console.error("SELLER_PAY_TO is required.");
-      } else if (!isAddress(sellerPayTo)) {
-        console.error("Invalid SELLER_PAY_TO. Expected a valid Ethereum address (0x + 40 hex chars).");
-      } else {
-        break;
-      }
-      sellerPayTo = await askWithDefault(rl, "SELLER_PAY_TO (seller payout address)", sellerPayTo);
+    sellerPayTo = String(sellerPayTo || "").trim();
+    while (sellerPayTo && !isAddress(sellerPayTo)) {
+      logError("Invalid SELLER_PAY_TO. Expected a valid Ethereum address (0x + 40 hex chars).");
+      sellerPayTo = String(
+        await askWithDefault(rl, "SELLER_PAY_TO (seller payout address)", sellerPayTo),
+      ).trim();
     }
 
     let chainIdInput = await askWithDefault(
@@ -229,7 +287,7 @@ async function runWizard({ writeEnv }) {
         chainId = resolveSupportedChain(chainIdInput).caip2;
         break;
       } catch (err) {
-        console.error(err.message || String(err));
+        logError(err.message || String(err));
         chainIdInput = await askWithDefault(rl, "CHAIN_ID", chainIdInput || "eip155:84532");
       }
     }
@@ -241,7 +299,7 @@ async function runWizard({ writeEnv }) {
     );
     facilitatorMode = facilitatorMode.toLowerCase();
     while (!ALLOWED_FACILITATOR_MODES.has(facilitatorMode)) {
-      console.error("Invalid FACILITATOR_MODE. Use: testnet or cdp_mainnet");
+      logError("Invalid FACILITATOR_MODE. Use: testnet or cdp_mainnet");
       facilitatorMode = (await askWithDefault(rl, "FACILITATOR_MODE", "testnet")).toLowerCase();
     }
 
@@ -265,7 +323,7 @@ async function runWizard({ writeEnv }) {
         existing.cdpApiKeyId || "",
       );
       while (!cdpApiKeyId) {
-        console.error("CDP_API_KEY_ID is required when FACILITATOR_MODE=cdp_mainnet");
+        logError("CDP_API_KEY_ID is required when FACILITATOR_MODE=cdp_mainnet");
         cdpApiKeyId = await askWithDefault(rl, "CDP_API_KEY_ID", "");
       }
 
@@ -275,7 +333,7 @@ async function runWizard({ writeEnv }) {
         existing.cdpApiKeySecret || "",
       );
       while (!cdpApiKeySecret) {
-        console.error("CDP_API_KEY_SECRET is required when FACILITATOR_MODE=cdp_mainnet");
+        logError("CDP_API_KEY_SECRET is required when FACILITATOR_MODE=cdp_mainnet");
         cdpApiKeySecret = await askWithDefault(rl, "CDP_API_KEY_SECRET", "");
       }
     }
@@ -287,12 +345,50 @@ async function runWizard({ writeEnv }) {
     );
     confirmationPolicy = confirmationPolicy.toLowerCase();
     while (!ALLOWED_CONFIRMATION_POLICIES.has(confirmationPolicy)) {
-      console.error("Invalid CONFIRMATION_POLICY. Use: confirmed or optimistic");
+      logError("Invalid CONFIRMATION_POLICY. Use: confirmed or optimistic");
       confirmationPolicy = (
         await askWithDefault(rl, "CONFIRMATION_POLICY", "confirmed")
       ).toLowerCase();
     }
 
+    let accessMode = await askWithDefault(
+      rl,
+      `ACCESS_MODE (${ACCESS_MODE_VALUES.join("|")})`,
+      existing.accessMode || DEFAULT_ACCESS_MODE,
+    );
+    accessMode = accessMode.toLowerCase();
+    while (!isValidAccessMode(accessMode)) {
+      logError(`Invalid ACCESS_MODE. Use one of: ${ACCESS_MODE_VALUES.join(", ")}`);
+      accessMode = (
+        await askWithDefault(
+          rl,
+          "ACCESS_MODE",
+          existing.accessMode || DEFAULT_ACCESS_MODE,
+        )
+      ).toLowerCase();
+    }
+
+    if (accessModeRequiresPayment(accessMode)) {
+      while (!sellerPayTo) {
+        logError("SELLER_PAY_TO is required for payment access modes.");
+        sellerPayTo = String(
+          await askWithDefault(rl, "SELLER_PAY_TO (seller payout address)", ""),
+        ).trim();
+      }
+      while (!isAddress(sellerPayTo)) {
+        logError("Invalid SELLER_PAY_TO. Expected a valid Ethereum address (0x + 40 hex chars).");
+        sellerPayTo = String(
+          await askWithDefault(rl, "SELLER_PAY_TO (seller payout address)", sellerPayTo),
+        ).trim();
+      }
+    }
+
+    const downloadCodeHash = await askDownloadCodeHash(
+      rl,
+      existing.downloadCodeHash || "",
+      accessMode,
+    );
+
     const priceUsd = await askWithDefault(
       rl,
       "PRICE_USD",
@@ -311,7 +407,7 @@ async function runWizard({ writeEnv }) {
     );
     let port = parsePositiveInt(portRaw);
     while (port === null) {
-      console.error("PORT must be a positive integer");
+      logError("PORT must be a positive integer");
       portRaw = await askWithDefault(rl, "PORT", "4021");
       port = parsePositiveInt(portRaw);
     }
@@ -323,7 +419,7 @@ async function runWizard({ writeEnv }) {
     );
     let endedWindowSeconds = parseNonNegativeInt(endedWindowRaw);
     while (endedWindowSeconds === null) {
-      console.error("ENDED_WINDOW_SECONDS must be a non-negative integer");
+      logError("ENDED_WINDOW_SECONDS must be a non-negative integer");
       endedWindowRaw = await askWithDefault(rl, "ENDED_WINDOW_SECONDS", "0");
       endedWindowSeconds = parseNonNegativeInt(endedWindowRaw);
     }
@@ -345,10 +441,13 @@ async function runWizard({ writeEnv }) {
       endedWindowSeconds,
       ogTitle,
       ogDescription,
+      accessMode,
+      downloadCodeHash,
     };
 
     const written = writeConfig({ version: 1, defaults });
-    console.log(`[config] saved ${written.path}`);
+    logOk(`Saved ${written.path}`);
+    console.log("");
     console.log(JSON.stringify(redactConfig(written.config), null, 2));
 
     if (writeEnv) {
@@ -376,6 +475,7 @@ async function main() {
 }
 
 main().catch((err) => {
-  console.error(err);
+  const detail = err?.stack || err?.message || String(err);
+  logError(detail);
   process.exit(1);
 });

package/scripts/config_store.js

@@ -1,6 +1,11 @@
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
+import {
+  isValidAccessMode,
+  DEFAULT_ACCESS_MODE,
+} from "../src/access_mode.js";
+import { isValidDownloadCodeHash } from "../src/download_code.js";
 
 export const CONFIG_VERSION = 1;
 export const DEFAULT_TESTNET_FACILITATOR_URL = "https://x402.org/facilitator";
@@ -99,10 +104,24 @@ function normalizeDefaults(rawDefaults) {
   const ogDescription = trimString(rawDefaults.ogDescription);
   if (ogDescription) defaults.ogDescription = ogDescription;
 
+  const accessMode = trimString(rawDefaults.accessMode).toLowerCase();
+  if (isValidAccessMode(accessMode)) {
+    defaults.accessMode = accessMode;
+  }
+
+  const downloadCodeHash = trimString(rawDefaults.downloadCodeHash);
+  if (downloadCodeHash && isValidDownloadCodeHash(downloadCodeHash)) {
+    defaults.downloadCodeHash = downloadCodeHash;
+  }
+
   if (defaults.facilitatorMode && !defaults.facilitatorUrl) {
     defaults.facilitatorUrl = defaultFacilitatorUrlForMode(defaults.facilitatorMode);
   }
 
+  if (!defaults.accessMode) {
+    defaults.accessMode = DEFAULT_ACCESS_MODE;
+  }
+
   return defaults;
 }
 
@@ -194,5 +213,9 @@ export function redactConfig(config) {
     copy.defaults.cdpApiKeyId = redactSecret(copy.defaults.cdpApiKeyId);
   }
 
+  if (copy.defaults.downloadCodeHash) {
+    copy.defaults.downloadCodeHash = redactSecret(copy.defaults.downloadCodeHash);
+  }
+
   return copy;
 }