nansen-cli 1.14.0 → 1.15.0

package/src/transfer.js

@@ -5,7 +5,7 @@
 
 import crypto from 'crypto';
 import { base58 } from '@scure/base';
-import { base58Encode, exportWallet, getWalletConfig, verifyPassword } from './wallet.js';
+import { base58Encode, exportWallet, getWalletConfig, verifyPassword, showWallet } from './wallet.js';
 import { keccak256, signSecp256k1, rlpEncode } from './crypto.js';
 import { getWalletConnectAddress, sendTransactionViaWalletConnect } from './walletconnect-trading.js';
 import { EVM_CHAIN_IDS } from './chain-ids.js';
@@ -328,13 +328,13 @@ async function getTokenInfo(rpcUrl, mint) {
   return { tokenProgram: owner, decimals: decimals ?? 9 };
 }
 
-async function buildSolanaTransaction({ to, amount, amountStr, token, privateKey }) {
+/**
+ * Build an unsigned Solana transaction for external signing (e.g. Privy).
+ * Returns base64-encoded serialized transaction with an empty signature slot.
+ */
+export async function buildUnsignedSolanaTransaction({ to, amount, amountStr, token, fromAddress }) {
   const rpcUrl = CHAIN_RPCS.solana;
-
-  const keypairBuf = Buffer.from(privateKey, 'hex');
-  const seed = keypairBuf.subarray(0, 32);
-  const pubkey = keypairBuf.subarray(32, 64);
-  const fromAddr = base58Encode(pubkey);
+  const pubkey = base58DecodePubkey(fromAddress);
 
   // Get recent blockhash
   const bhResult = await rpcCall(rpcUrl, 'getLatestBlockhash', [{ commitment: 'finalized' }]);
@@ -347,7 +347,7 @@ async function buildSolanaTransaction({ to, amount, amountStr, token, privateKey
     const { tokenProgram, decimals } = await getTokenInfo(rpcUrl, token);
     const tokenAmount = parseAmount(amountStr, decimals);
     const mintBuf = base58DecodePubkey(token);
-    const sourceATA = deriveATA(fromAddr, token, tokenProgram);
+    const sourceATA = deriveATA(fromAddress, token, tokenProgram);
     const destATA = deriveATA(to, token, tokenProgram);
     const tokenProgBuf = base58DecodePubkey(tokenProgram);
 
@@ -381,9 +381,6 @@ async function buildSolanaTransaction({ to, amount, amountStr, token, privateKey
     } catch { /* assume doesn't exist */ }
 
     if (destAtaExists) {
-      // Simple: just TransferChecked, no CreateATA needed
-      // Account ordering: writable first, then readonly (Solana message format requirement)
-      // Accounts: [owner(s,w), sourceATA(w), destATA(w), mint(r), tokenProgram(r)]
       accountKeys = [
         pubkey,        // 0: owner/feePayer (signer, writable)
         sourceATA,     // 1: source ATA (writable)
@@ -398,7 +395,6 @@ async function buildSolanaTransaction({ to, amount, amountStr, token, privateKey
       }];
       numReadonlyUnsigned = 2; // mint + tokenProgram
     } else {
-      // Need CreateAssociatedTokenAccountIdempotent + TransferChecked
       const ataProgBuf = base58DecodePubkey(ATA_PROGRAM);
       const sysProgramBuf = base58DecodePubkey(SYSTEM_PROGRAM);
 
@@ -430,7 +426,7 @@ async function buildSolanaTransaction({ to, amount, amountStr, token, privateKey
     // Native SOL transfer
 
     // Pre-check: SOL balance
-    const balResult = await rpcCall(rpcUrl, 'getBalance', [fromAddr, { commitment: 'confirmed' }]);
+    const balResult = await rpcCall(rpcUrl, 'getBalance', [fromAddress, { commitment: 'confirmed' }]);
     const solBalance = BigInt(balResult.value);
     const needed = amount + 5000n; // amount + ~fee
     if (solBalance < needed) {
@@ -472,18 +468,32 @@ async function buildSolanaTransaction({ to, amount, amountStr, token, privateKey
 
   const messageBytes = Buffer.concat(parts);
 
-  // Sign
-  const signature = signEd25519(messageBytes, seed);
+  // Return unsigned: compact(1) + 64 zero bytes (empty sig slot) + message
+  const sigCount = encodeCompactU16(1);
+  const emptySignature = Buffer.alloc(64);
+  const txBytes = Buffer.concat([sigCount, emptySignature, messageBytes]);
+  return { unsignedTransaction: txBytes.toString('base64') };
+}
 
-  // Serialize transaction: compact(numSigs) + signatures + message
-  const txBytes = Buffer.concat([
-    encodeCompactU16(1),
-    signature, // 64 bytes
-    messageBytes,
-  ]);
+async function buildSolanaTransaction({ to, amount, amountStr, token, privateKey }) {
+  const keypairBuf = Buffer.from(privateKey, 'hex');
+  const seed = keypairBuf.subarray(0, 32);
+  const fromPubkey = keypairBuf.subarray(32, 64);
+  const fromAddress = base58Encode(fromPubkey);
+
+  const { unsignedTransaction } = await buildUnsignedSolanaTransaction({
+    to, amount, amountStr, token, fromAddress,
+  });
 
-  // Solana sendTransaction expects base64
-  return { signedTransaction: txBytes.toString('base64') };
+  // Sign: extract message bytes, sign, insert signature
+  const txBytes = Buffer.from(unsignedTransaction, 'base64');
+  const sigCountSize = 1; // compact-u16 for count=1 is always 1 byte
+  const messageBytes = txBytes.subarray(sigCountSize + 64);
+  const signature = signEd25519(messageBytes, seed);
+  const signedTx = Buffer.from(txBytes);
+  signature.copy(signedTx, sigCountSize);
+
+  return { signedTransaction: signedTx.toString('base64') };
 }
 
 // ============= Broadcasting =============
@@ -576,6 +586,115 @@ async function broadcastTransaction(signedTx, chain) {
 // Exported for testing
 export { parseAmount, formatAmount, signEd25519, encodeCompactU16, base58Decode, base58DecodePubkey, deriveATA, validateEvmAddress, validateSolanaAddress, bigIntToHex };
 
+/**
+ * Send tokens via Privy server wallet. EVM uses Privy's sendTransaction (handles gas/nonce).
+ * Solana builds unsigned tx, signs via Privy, then broadcasts.
+ */
+async function sendTokensViaPrivy({ to, amount, chain, token, max, dryRun, walletInfo }) {
+  const { PrivyClient } = await import('./privy.js');
+  const client = new PrivyClient(process.env.PRIVY_APP_ID, process.env.PRIVY_APP_SECRET);
+
+  if (chain === 'solana') {
+    const walletId = walletInfo.privyWalletIds?.solana;
+    const fromAddress = walletInfo.solana;
+    if (!fromAddress) throw new Error('No Solana wallet in this Privy wallet');
+    if (!walletId) throw new Error('No Privy Solana wallet ID found. Re-create the wallet with: nansen wallet create --provider privy');
+
+    if (max && !token) {
+      const balResult = await rpcCall(CHAIN_RPCS.solana, 'getBalance', [fromAddress, { commitment: 'confirmed' }]);
+      const fee = 5000n;
+      const maxAmount = BigInt(balResult.value) - fee;
+      if (maxAmount <= 0n) throw new Error('Insufficient SOL balance for fees');
+      amount = formatAmount(maxAmount, 9);
+    } else if (max && token) {
+      const rpcUrl = CHAIN_RPCS.solana;
+      const { tokenProgram, decimals: _decimals } = await getTokenInfo(rpcUrl, token);
+      const sourceATA = deriveATA(fromAddress, token, tokenProgram);
+      const sourceAtaAddr = base58Encode(sourceATA);
+      const ataInfo = await rpcCall(rpcUrl, 'getTokenAccountBalance', [sourceAtaAddr]);
+      amount = ataInfo.value.uiAmountString;
+    }
+
+    if (dryRun) return { dryRun: true, from: fromAddress, to, amount, token, chain };
+
+    const amountRaw = token ? null : parseAmount(amount, 9);
+    const { unsignedTransaction } = await buildUnsignedSolanaTransaction({
+      to, amount: amountRaw, amountStr: amount, token, fromAddress,
+    });
+
+    const signResult = await client.signSolanaTransaction(walletId, unsignedTransaction);
+    const signedTx = signResult.data?.signed_transaction || signResult.signed_transaction;
+    const txHash = await broadcastTransaction(signedTx, chain);
+    const confirmation = await waitForSolanaConfirmation(CHAIN_RPCS.solana, txHash);
+
+    return {
+      success: true, transactionHash: txHash, confirmed: confirmation.confirmed,
+      from: fromAddress, to, amount, token, chain,
+      explorer: getExplorerUrl(chain, txHash),
+    };
+  }
+
+  // EVM: use Privy sendTransaction (Privy handles gas/nonce/broadcast)
+  const walletId = walletInfo.privyWalletIds?.evm;
+  const fromAddress = walletInfo.evm;
+  if (!fromAddress) throw new Error('No EVM wallet in this Privy wallet');
+  if (!walletId) throw new Error('No Privy EVM wallet ID found. Re-create the wallet with: nansen wallet create --provider privy');
+
+  const chainId = CHAIN_IDS[chain];
+  if (!chainId) throw new Error(`Unsupported chain: ${chain}`);
+
+  let decimals = 18;
+  const rpcUrl = CHAIN_RPCS[chain] || CHAIN_RPCS.evm;
+  if (token) decimals = await validateErc20Token(rpcUrl, token);
+
+  if (max && token) {
+    const balResult = await rpcCall(rpcUrl, 'eth_call', [{
+      to: token, data: '0x70a08231' + fromAddress.slice(2).padStart(64, '0'),
+    }, 'latest']);
+    const tokenBalance = BigInt(balResult || '0x0');
+    if (tokenBalance === 0n) throw new Error('Token balance is zero');
+    amount = formatAmount(tokenBalance, decimals);
+  }
+
+  const parsedAmount = (max && !token) ? null : parseAmount(amount, decimals);
+
+  let txParams;
+  let maxValue;
+  if (token) {
+    const amtHex = parsedAmount.toString(16).padStart(64, '0');
+    const data = '0xa9059cbb' + to.slice(2).padStart(64, '0') + amtHex;
+    txParams = { to: token, data, value: '0x0', chainId };
+  } else if (max) {
+    // Compute max native send: balance minus gas reserve
+    const balance = BigInt(await rpcCall(rpcUrl, 'eth_getBalance', [fromAddress, 'latest']));
+    const gasPrice = BigInt(await rpcCall(rpcUrl, 'eth_gasPrice', []));
+    // 21000 is for reserve estimation only. Privy's sendTransaction handles actual
+    // gas estimation, including EIP-7702 delegated accounts. 3x covers L2 data fees.
+    const gasReserve = gasPrice * 21000n * 3n;
+    maxValue = balance - gasReserve;
+    if (maxValue <= 0n) throw new Error('Insufficient balance to cover gas fees');
+    txParams = { to, value: '0x' + maxValue.toString(16), chainId };
+  } else {
+    txParams = { to, value: '0x' + parsedAmount.toString(16), chainId };
+  }
+
+  const finalAmount = maxValue != null ? formatAmount(maxValue, 18) : amount;
+
+  if (dryRun) return { dryRun: true, from: fromAddress, to, amount: finalAmount, token, chain };
+
+  const result = await client.sendTransaction(walletId, txParams);
+  const txHash = result.data?.hash || result.hash;
+
+  const confirmation = await waitForEvmConfirmation(rpcUrl, txHash);
+
+  return {
+    success: true, transactionHash: txHash, confirmed: confirmation.confirmed,
+    ...(confirmation.blockNumber ? { blockNumber: confirmation.blockNumber } : {}),
+    from: fromAddress, to, amount: finalAmount, token, chain,
+    explorer: getExplorerUrl(chain, txHash),
+  };
+}
+
 export async function sendTokens({ to, amount, chain, token = null, wallet = null, password, max = false, dryRun = false, walletconnect = false }) {
   // Validate address
   const validate = chain === 'solana' ? validateSolanaAddress : validateEvmAddress;
@@ -589,11 +708,17 @@ export async function sendTokens({ to, amount, chain, token = null, wallet = nul
     return sendTokensViaWalletConnect({ to, amount, chain, token, max, dryRun });
   }
 
+  // Resolve wallet and check provider
   const config = getWalletConfig();
-  if (config.passwordHash && !verifyPassword(password, config)) throw new Error('Incorrect password');
-
   const walletName = wallet || config.defaultWallet;
   if (!walletName) throw new Error('No wallet specified and no default wallet set');
+
+  const walletInfo = showWallet(walletName);
+  if (walletInfo.provider === 'privy') {
+    return sendTokensViaPrivy({ to, amount, chain, token, max, dryRun, walletInfo });
+  }
+
+  if (config.passwordHash && !verifyPassword(password, config)) throw new Error('Incorrect password');
   const walletData = exportWallet(walletName, password);
 
   let result;

package/src/wallet.js

@@ -239,8 +239,8 @@ function getWalletFile(name) {
  * Verify the global password against stored hash.
  */
 export function verifyPassword(password, config) {
+  if (password == null) return false;
   if (!config.passwordHash) return true; // No password set yet
-  if (password === null || password === undefined) return false;
   const { salt, hash } = config.passwordHash;
   const derived = crypto.scryptSync(password, Buffer.from(salt, 'hex'), 32, {
     N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P, maxmem: 256 * 1024 * 1024,
@@ -367,6 +367,7 @@ export function listWallets() {
     const data = JSON.parse(fs.readFileSync(path.join(getWalletsDir(), f), 'utf8'));
     return {
       name: data.name,
+      provider: data.provider || 'local',
       evm: data.evm?.address || null,
       solana: data.solana?.address || null,
       createdAt: data.createdAt,
@@ -397,10 +398,18 @@ export function createWallet(name, password) {
   } else {
     // Encrypted mode
     if (!config.passwordHash) {
-      // First encrypted wallet: reject if passwordless wallets exist
-      const existingWallets = fs.readdirSync(getWalletsDir())
-        .filter(f => f.endsWith('.json') && f !== 'config.json');
-      if (existingWallets.length > 0) {
+      // First encrypted wallet: reject if passwordless local wallets exist
+      // (non-local wallets like Privy don't contain private keys, so skip them)
+      const walletsDir = getWalletsDir();
+      const existingLocalWallets = fs.readdirSync(walletsDir)
+        .filter(f => f.endsWith('.json') && f !== 'config.json')
+        .filter(f => {
+          try {
+            const data = JSON.parse(fs.readFileSync(path.join(walletsDir, f), 'utf8'));
+            return !data.provider || data.provider === 'local';
+          } catch { return true; }
+        });
+      if (existingLocalWallets.length > 0) {
         throw new Error('Existing wallets are passwordless. Cannot mix encrypted and unencrypted wallets.');
       }
       config.passwordHash = hashPassword(password);
@@ -452,13 +461,21 @@ export function showWallet(name) {
 
   const data = JSON.parse(fs.readFileSync(walletFile, 'utf8'));
   const config = getWalletConfig();
+  const isPrivy = data.provider === 'privy';
 
   return {
     name: data.name,
+    provider: data.provider || 'local',
     evm: data.evm?.address || null,
     solana: data.solana?.address || null,
     createdAt: data.createdAt,
     isDefault: data.name === config.defaultWallet,
+    ...(isPrivy ? {
+      privyWalletIds: {
+        evm: data.evm?.privyWalletId,
+        solana: data.solana?.privyWalletId,
+      }
+    } : {}),
   };
 }
 
@@ -471,13 +488,16 @@ export function exportWallet(name, password) {
     throw new Error(`Wallet "${name}" not found`);
   }
 
+  const data = JSON.parse(fs.readFileSync(walletFile, 'utf8'));
+  if (data.provider && data.provider !== 'local') {
+    throw new Error(`${data.provider} wallets don't support key export. Keys are managed by the provider.`);
+  }
+
   const config = getWalletConfig();
   if (config.passwordHash && !verifyPassword(password, config)) {
     throw new Error('Incorrect password');
   }
 
-  const data = JSON.parse(fs.readFileSync(walletFile, 'utf8'));
-
   return {
     name: data.name,
     evm: {
@@ -510,15 +530,21 @@ export function setDefaultWallet(name) {
 /**
  * Delete a wallet.
  */
-export function deleteWallet(name, password) {
+export async function deleteWallet(name, password) {
   const walletFile = getWalletFile(name);
   if (!fs.existsSync(walletFile)) {
     throw new Error(`Wallet "${name}" not found`);
   }
 
+  const data = JSON.parse(fs.readFileSync(walletFile, 'utf8'));
   const config = getWalletConfig();
-  if (config.passwordHash && !verifyPassword(password, config)) {
-    throw new Error('Incorrect password');
+
+  if (data.provider && data.provider !== 'local') {
+    // Non-local wallets: just remove local reference, no password needed
+  } else {
+    if (config.passwordHash && !verifyPassword(password, config)) {
+      throw new Error('Incorrect password');
+    }
   }
 
   fs.unlinkSync(walletFile);
@@ -537,20 +563,6 @@ export function deleteWallet(name, password) {
   return { deleted: name, newDefault: config.defaultWallet };
 }
 
-/**
- * Get the default wallet's address for a given chain type.
- */
-export function getDefaultAddress(chainType = 'evm') {
-  const config = getWalletConfig();
-  if (!config.defaultWallet) {
-    throw new Error('No default wallet set. Run: nansen wallet create');
-  }
-
-  const wallet = showWallet(config.defaultWallet);
-  const field = chainType === 'solana' ? 'solana' : 'evm';
-  return wallet[field];
-}
-
 // ============= CLI Command Builder =============
 
 /**
@@ -563,6 +575,27 @@ export function buildWalletCommands(deps = {}) {
     'wallet': async (args, apiInstance, flags, options) => {
       const subcommand = args[0] || 'help';
 
+      // Privy-specific: only 'create' and policy commands need --provider privy
+      if (options.provider === 'privy' || process.env.NANSEN_WALLET_PROVIDER === 'privy') {
+        if (subcommand === 'create') {
+          const { createPrivyWalletPair } = await import('./privy.js');
+          const name = options.name || args[1] || 'default';
+          try {
+            const result = await createPrivyWalletPair(name);
+            log(`\n✓ Privy wallet "${result.name}" created\n`);
+            log(`  EVM:    ${result.evm.address}`);
+            log(`  Solana: ${result.solana.address}`);
+            log('');
+            return;
+          } catch (err) {
+            log(`❌ ${err.message}`);
+            exit(1);
+            return;
+          }
+        }
+        // All other subcommands fall through to unified handlers below
+      }
+
       const handlers = {
         'create': async () => {
           const name = options.name || args[1] || 'default';
@@ -688,7 +721,8 @@ export function buildWalletCommands(deps = {}) {
           log('');
           for (const w of result.wallets) {
             const star = w.isDefault ? ' ★' : '';
-            log(`  ${w.name}${star}`);
+            const providerTag = w.provider === 'privy' ? ' (privy)' : '';
+            log(`  ${w.name}${star}${providerTag}`);
             log(`    EVM:    ${w.evm}`);
             log(`    Solana: ${w.solana}`);
             log('');
@@ -705,7 +739,8 @@ export function buildWalletCommands(deps = {}) {
           try {
             const result = showWallet(name);
             const star = result.isDefault ? ' ★' : '';
-            log(`\n  ${result.name}${star}`);
+            const providerTag = result.provider === 'privy' ? ' (privy)' : '';
+            log(`\n  ${result.name}${star}${providerTag}`);
             log(`    EVM:    ${result.evm}`);
             log(`    Solana: ${result.solana}`);
             log(`    Created: ${result.createdAt}\n`);
@@ -723,6 +758,7 @@ export function buildWalletCommands(deps = {}) {
             exit(1);
             return;
           }
+
           const config = getWalletConfig();
           const { password, error } = await resolvePasswordForCommand(config, flags, deps);
           if (error) {
@@ -771,16 +807,33 @@ export function buildWalletCommands(deps = {}) {
             exit(1);
             return;
           }
-          const config = getWalletConfig();
-          const { password, error } = await resolvePasswordForCommand(config, flags, deps);
-          if (error) {
-            log(error);
-            exit(1);
-            return;
+
+          // Check if this is a Privy wallet (no password needed)
+          let isPrivy = false;
+          try {
+            const walletFile = path.join(getWalletsDir(), `${name}.json`);
+            const data = JSON.parse(fs.readFileSync(walletFile, 'utf8'));
+            if (data.provider === 'privy') isPrivy = true;
+          } catch { /* file might not exist, deleteWallet will throw */ }
+
+          let password = null;
+          if (!isPrivy) {
+            const config = getWalletConfig();
+            const resolved = await resolvePasswordForCommand(config, flags, deps);
+            if (resolved.error) {
+              log(resolved.error);
+              exit(1);
+              return;
+            }
+            password = resolved.password;
           }
+
           try {
-            const result = deleteWallet(name, password);
+            const result = await deleteWallet(name, password);
             log(`✓ Wallet "${result.deleted}" deleted`);
+            if (isPrivy) {
+              log(`  Note: server-side wallet still exists on Privy`);
+            }
             if (result.newDefault) {
               log(`  New default: ${result.newDefault}`);
             }
@@ -820,8 +873,22 @@ export function buildWalletCommands(deps = {}) {
           }
 
           const isWalletConnect = options.wallet === 'walletconnect' || options.wallet === 'wc';
+
+          // Check if the wallet is Privy (no password needed)
+          let isPrivyWallet = false;
+          if (!isWalletConnect) {
+            try {
+              const walletName = options.wallet || getWalletConfig().defaultWallet;
+              if (walletName) {
+                const walletFile = path.join(getWalletsDir(), `${walletName}.json`);
+                const data = JSON.parse(fs.readFileSync(walletFile, 'utf8'));
+                if (data.provider === 'privy') isPrivyWallet = true;
+              }
+            } catch { /* ignore */ }
+          }
+
           let password;
-          if (isWalletConnect) {
+          if (isWalletConnect || isPrivyWallet) {
             password = null;
           } else {
             const sendConfig = getWalletConfig();
@@ -959,19 +1026,19 @@ export function buildWalletCommands(deps = {}) {
 
         'help': async () => {
           log(`
-Wallet Management - Local key storage for EVM and Solana
+Wallet Management - EVM and Solana wallets (local or Privy server-side)
 
 USAGE:
   nansen wallet <command> [options]
 
 COMMANDS:
-  create [--name <label>] [--unsafe-no-password]
+  create [--name <label>] [--provider <local|privy>] [--unsafe-no-password]
                              Create a new wallet pair (EVM + Solana)
   list                       List all wallets
   show <name>                Show wallet addresses
-  export <name>              Export private keys (requires password)
+  export <name>              Export private keys (local wallets only, requires password)
   default <name>             Set the default wallet
-  delete <name>              Delete a wallet (requires password)
+  delete <name>              Delete a wallet
   send --to <address> --amount <number> --chain <evm|solana> [--token <address>] [--wallet <name>] [--max] [--dry-run]
                              Send tokens or native currency (--max sends entire balance, --dry-run previews without sending)
   forget-password            Remove saved password from all stores
@@ -979,13 +1046,15 @@ COMMANDS:
 
 OPTIONS:
   --name <label>             Wallet name (default: "default")
+  --provider <local|privy>   Wallet provider: "local" (default) stores encrypted keys on disk,
+                             "privy" creates server-side wallets via Privy API
   --to <address>             Recipient address (required for send)
   --amount <number>          Amount to send in human-readable format (required unless --max)
   --chain <evm|solana>       Blockchain to use (required for send)
   --token <address>          Token contract/mint address (optional, sends native if omitted)
   --wallet <name>            Wallet to use (optional, uses default if omitted; use "walletconnect" or "wc" for WalletConnect, EVM only)
   --max                      Send entire balance (deducts gas for native transfers)
-  --unsafe-no-password       Skip encryption — private keys stored UNENCRYPTED on disk (create only)
+  --unsafe-no-password       Skip encryption — private keys stored UNENCRYPTED on disk (local only)
   --human                    Enable interactive prompts (for human terminal use only)
 
 PASSWORD RESOLUTION (automatic, in order):
@@ -995,11 +1064,15 @@ PASSWORD RESOLUTION (automatic, in order):
 
 ENVIRONMENT:
   NANSEN_WALLET_PASSWORD     Wallet encryption password
+  PRIVY_APP_ID               Privy application ID (required for --provider privy)
+  PRIVY_APP_SECRET           Privy application secret (required for --provider privy)
+  NANSEN_WALLET_PROVIDER     Default provider for wallet create ("local" or "privy")
   NANSEN_EVM_RPC            Custom EVM RPC endpoint
   NANSEN_SOLANA_RPC         Custom Solana RPC endpoint
 
 EXAMPLES:
   NANSEN_WALLET_PASSWORD=mypass nansen wallet create --name trading
+  nansen wallet create --name agent-wallet --provider privy
   nansen wallet list
   nansen wallet export trading
   nansen wallet default trading

package/src/x402-svm.js

@@ -268,28 +268,15 @@ function signEd25519(message, keypairHex) {
 // ============= x402 Solana Payment =============
 
 /**
- * Build a Solana x402 payment transaction.
- * 
- * This builds an SPL TransferChecked instruction wrapped in a VersionedTransaction.
- * The facilitator is the fee payer (index 0), client signs at index 1.
- *
- * NOTE: This requires a recent blockhash from Solana RPC. For the initial implementation,
- * we fetch it inline. In production, this should be cached.
+ * Build an unsigned Solana x402 payment transaction.
+ * Returns the serialized MessageV0 bytes and the full transaction bytes
+ * (with both signature slots as 64 zero bytes).
  *
- * @param {object} requirements - Parsed PaymentRequirements from 402 response
- * @param {string} keypairHex - 128-char hex string (64 bytes: seed + pubkey)
- * @param {string} walletAddress - Signer's Solana address (base58)
- * @param {string} resource - Original request URL
- * @param {string} recentBlockhash - Recent blockhash from Solana RPC (base58)
- * @param {number} decimals - Token decimals (default 6 for USDC)
- * @param {string} tokenProgram - Token program address (auto-detect if not provided)
- * @returns {string} Base64-encoded PaymentPayload for Payment-Signature header
+ * Used by local-key signing (createSvmPaymentPayload) and Privy server wallet signing.
  */
-export function createSvmPaymentPayload(
+export function buildUnsignedSvmTransaction(
   requirements,
-  keypairHex,
   walletAddress,
-  resource,
   recentBlockhash,
   decimals = 6,
   tokenProgram = TOKEN_PROGRAM,
@@ -356,7 +343,6 @@ export function createSvmPaymentPayload(
     },
   ];
 
-  // Build MessageV0
   const messageBytes = buildMessageV0({
     feePayer: feePayerStr,
     instructions,
@@ -364,17 +350,50 @@ export function createSvmPaymentPayload(
     accounts: null,
   });
 
+  // Build transaction: compact-u16(numSignatures) + signatures + message
+  // 2 signatures: [facilitator placeholder (64 zero bytes), client placeholder (64 zero bytes)]
+  const numSigs = encodeCompactU16(2);
+  const txBytes = Buffer.concat([
+    numSigs,
+    Buffer.alloc(64), // facilitator placeholder
+    Buffer.alloc(64), // client placeholder
+    messageBytes,
+  ]);
+
+  return { messageBytes, txBase64: txBytes.toString('base64') };
+}
+
+/**
+ * Build a signed Solana x402 payment transaction using a local Ed25519 keypair.
+ * Calls buildUnsignedSvmTransaction internally, then signs with the private key.
+ *
+ * @returns {string} Base64-encoded PaymentPayload JSON for Payment-Signature header
+ */
+export function createSvmPaymentPayload(
+  requirements,
+  keypairHex,
+  walletAddress,
+  resource,
+  recentBlockhash,
+  decimals = 6,
+  tokenProgram = TOKEN_PROGRAM,
+) {
+  const { messageBytes } = buildUnsignedSvmTransaction(
+    requirements,
+    walletAddress,
+    recentBlockhash,
+    decimals,
+    tokenProgram,
+  );
+
   // Sign: client signs the full message (with 0x80 version prefix already included)
   const clientSignature = signEd25519(messageBytes, keypairHex);
 
-  // Build transaction: compact-u16(numSignatures) + signatures + message
-  // 2 signatures: [facilitator placeholder (64 zero bytes), client signature]
+  // Rebuild transaction with the real client signature at slot 1
   const numSigs = encodeCompactU16(2);
-  const facilitatorPlaceholder = Buffer.alloc(64); // all zeros
-  
   const txBytes = Buffer.concat([
     numSigs,
-    facilitatorPlaceholder,
+    Buffer.alloc(64), // facilitator placeholder
     clientSignature,
     messageBytes,
   ]);