ncrypted 0.1.1 → 0.1.2

package/dist/cli.js

@@ -1,6 +1,8 @@
 #!/usr/bin/env node
 import { parseArgs } from "node:util";
+import { privateKeyToAccount } from "viem/accounts";
 import { Ncrypted } from "./client.js";
+import { createWallet, normalizeKey, readWalletKey, usdcBalance, walletPath } from "./wallet.js";
 const HELP = `ncrypted - one-time, end-to-end encrypted secrets for agents (0.005 USDC per secret, reads free)
 
 Usage:
@@ -9,8 +11,12 @@ Usage:
   ncrypted read <link> [--passphrase X]
   ncrypted status <id> --receipt <token>
   ncrypted burn <id> --receipt <token>
+  ncrypted wallet new           create a payer wallet at ~/.config/ncrypted/wallet.key
+  ncrypted wallet               show the payer address and its USDC balance on Base
 
-Env: NCRYPTED_WALLET_PRIVATE_KEY (Base wallet with USDC, needed for create), NCRYPTED_URL (optional)`;
+Creating a secret needs a Base wallet holding a little USDC (no ETH needed). The key is read from
+NCRYPTED_WALLET_PRIVATE_KEY, else NCRYPTED_WALLET_FILE, else ~/.config/ncrypted/wallet.key.
+NCRYPTED_URL overrides the API origin.`;
 function parseTtl(v) {
     if (!v)
         return undefined;
@@ -68,6 +74,24 @@ async function main() {
             await client.burn(arg, values.receipt);
             out({ burned: true });
             break;
+        case "wallet": {
+            if (arg === "new") {
+                const { address, path } = await createWallet().catch((e) => {
+                    if (e.code === "EEXIST")
+                        throw new Error(`A wallet already exists at ${walletPath()}`);
+                    throw e;
+                });
+                out({ address, path, next: "Send a little USDC on Base to this address. Each secret costs 0.005 USDC; no ETH needed." });
+                break;
+            }
+            const key = normalizeKey(process.env.NCRYPTED_WALLET_PRIVATE_KEY) ?? (await readWalletKey());
+            if (!key)
+                throw new Error("No wallet configured. Run `npx ncrypted wallet new`.");
+            const address = privateKeyToAccount(key).address;
+            const usdc = await usdcBalance(address);
+            out({ address, usdc, secretsAvailable: Math.floor(usdc / 0.005) });
+            break;
+        }
         default:
             console.log(HELP);
     }

package/dist/client.d.ts

@@ -1,10 +1,13 @@
-export declare const DEFAULT_BASE_URL = "https://ncrypted-ai.vercel.app";
+export declare const DEFAULT_BASE_URL = "https://ncrypted.ai";
 /** Hard cap on what the SDK will ever pay for one secret, whatever the server asks. */
 export declare const MAX_PRICE = "$0.01";
 export interface NcryptedOptions {
     /** API origin. Defaults to NCRYPTED_URL or the hosted service. */
     baseUrl?: string;
-    /** 0x-prefixed EVM private key of a wallet holding USDC on Base. Defaults to NCRYPTED_WALLET_PRIVATE_KEY. */
+    /**
+     * 0x-prefixed EVM private key of a wallet holding USDC on Base. Defaults to NCRYPTED_WALLET_PRIVATE_KEY,
+     * then the key file at NCRYPTED_WALLET_FILE or ~/.config/ncrypted/wallet.key (create one with `npx ncrypted wallet new`).
+     */
     privateKey?: string;
     /** Bring your own x402-paying fetch instead of a private key. */
     paymentFetch?: typeof fetch;
@@ -36,9 +39,12 @@ export declare class NcryptedError extends Error {
     constructor(message: string, status: number);
 }
 export declare class Ncrypted {
+    private readonly opts;
     readonly baseUrl: string;
     private payFetch?;
     constructor(opts?: NcryptedOptions);
+    /** Resolves the paying fetch lazily, so a missing or bad wallet only affects create(), never reads. */
+    private payer;
     /** Encrypts locally, pays 0.005 USDC via x402, stores the ciphertext and returns a one-time link. */
     create(secret: string, opts?: CreateOptions): Promise<CreatedSecret>;
     /** Sends the link by email once. Allowed only for the creator and only once per secret. */

package/dist/client.js

@@ -2,7 +2,8 @@ import { wrapFetchWithPaymentFromConfig, decodePaymentResponseHeader } from "@x4
 import { ExactEvmScheme } from "@x402/evm";
 import { privateKeyToAccount } from "viem/accounts";
 import { encrypt, decrypt, parseLink } from "./crypto.js";
-export const DEFAULT_BASE_URL = "https://ncrypted-ai.vercel.app";
+import { normalizeKey, readWalletKey, walletPath } from "./wallet.js";
+export const DEFAULT_BASE_URL = "https://ncrypted.ai";
 /** Hard cap on what the SDK will ever pay for one secret, whatever the server asks. */
 export const MAX_PRICE = "$0.01";
 export class NcryptedError extends Error {
@@ -42,33 +43,45 @@ async function errorFrom(res) {
 /** Settlement attempts per create. A failed settlement never moves funds, so retrying is safe. */
 const SETTLE_ATTEMPTS = 3;
 export class Ncrypted {
+    opts;
     baseUrl;
     payFetch;
     constructor(opts = {}) {
+        this.opts = opts;
         const env = typeof process !== "undefined" ? process.env : {};
         this.baseUrl = (opts.baseUrl ?? env.NCRYPTED_URL ?? DEFAULT_BASE_URL).replace(/\/$/, "");
-        const pk = opts.privateKey ?? env.NCRYPTED_WALLET_PRIVATE_KEY;
-        if (opts.paymentFetch)
-            this.payFetch = opts.paymentFetch;
-        else if (pk) {
-            const account = privateKeyToAccount((pk.startsWith("0x") ? pk : `0x${pk}`));
-            this.payFetch = wrapFetchWithPaymentFromConfig(fetch, {
-                schemes: [{ network: "eip155:*", client: new ExactEvmScheme(account) }],
+    }
+    /** Resolves the paying fetch lazily, so a missing or bad wallet only affects create(), never reads. */
+    payer() {
+        return (this.payFetch ??= (async () => {
+            if (this.opts.paymentFetch)
+                return this.opts.paymentFetch;
+            const env = typeof process !== "undefined" ? process.env : {};
+            const pk = normalizeKey(this.opts.privateKey ?? env.NCRYPTED_WALLET_PRIVATE_KEY) ?? (await readWalletKey());
+            if (!pk)
+                return undefined;
+            return wrapFetchWithPaymentFromConfig(fetch, {
+                schemes: [{ network: "eip155:*", client: new ExactEvmScheme(privateKeyToAccount(pk)) }],
                 spendControls: { maxAmountPerPayment: MAX_PRICE },
             });
-        }
+        })().catch((e) => {
+            this.payFetch = undefined;
+            throw e;
+        }));
     }
     /** Encrypts locally, pays 0.005 USDC via x402, stores the ciphertext and returns a one-time link. */
     async create(secret, opts = {}) {
-        if (!this.payFetch) {
-            throw new Error("No wallet configured. Set NCRYPTED_WALLET_PRIVATE_KEY (a Base wallet with USDC) or pass privateKey.");
+        const payFetch = await this.payer();
+        if (!payFetch) {
+            throw new Error(`No wallet configured. Run \`npx ncrypted wallet new\` to create one at ${walletPath()} and send it a little USDC on Base, ` +
+                "or set NCRYPTED_WALLET_PRIVATE_KEY.");
         }
         const { payload, key } = await encrypt(secret, opts.passphrase);
         const body = { ...payload, ttl: opts.ttl ?? 86400 };
         // The link is only knowable after the server assigns an id, so email goes in a second, free call.
         let res;
         for (let attempt = 1;; attempt++) {
-            res = await this.payFetch(`${this.baseUrl}/api/v1/secrets`, {
+            res = await payFetch(`${this.baseUrl}/api/v1/secrets`, {
                 method: "POST",
                 headers: { "content-type": "application/json" },
                 body: JSON.stringify(body),

package/dist/index.d.ts

@@ -1,2 +1,3 @@
 export * from "./client.js";
 export { encrypt, decrypt, parseLink, MAX_PLAINTEXT_BYTES, type EncryptedPayload } from "./crypto.js";
+export { walletPath, createWallet, usdcBalance } from "./wallet.js";

package/dist/index.js

@@ -1,2 +1,3 @@
 export * from "./client.js";
 export { encrypt, decrypt, parseLink, MAX_PLAINTEXT_BYTES } from "./crypto.js";
+export { walletPath, createWallet, usdcBalance } from "./wallet.js";

package/dist/wallet.d.ts

@@ -0,0 +1,13 @@
+export declare const USDC_BASE = "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913";
+/** NCRYPTED_WALLET_FILE, or ~/.config/ncrypted/wallet.key */
+export declare function walletPath(): string;
+/** Normalizes a private key, or returns undefined for empty or unexpanded "${VAR}" placeholders. */
+export declare function normalizeKey(raw: string | undefined): `0x${string}` | undefined;
+export declare function readWalletKey(): Promise<`0x${string}` | undefined>;
+/** Creates a new wallet key file (mode 0600). Refuses to overwrite an existing one. */
+export declare function createWallet(): Promise<{
+    address: string;
+    path: string;
+}>;
+/** USDC balance on Base mainnet, via a public RPC. */
+export declare function usdcBalance(address: string, rpc?: string): Promise<number>;

package/dist/wallet.js

@@ -0,0 +1,49 @@
+// Node-only helpers for the local payer wallet used to pay for secrets.
+import { readFile, writeFile, mkdir } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { generatePrivateKey, privateKeyToAccount } from "viem/accounts";
+export const USDC_BASE = "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913";
+/** NCRYPTED_WALLET_FILE, or ~/.config/ncrypted/wallet.key */
+export function walletPath() {
+    return process.env.NCRYPTED_WALLET_FILE || join(homedir(), ".config", "ncrypted", "wallet.key");
+}
+/** Normalizes a private key, or returns undefined for empty or unexpanded "${VAR}" placeholders. */
+export function normalizeKey(raw) {
+    const v = raw?.trim();
+    if (!v || v.startsWith("${") || v.startsWith("$"))
+        return undefined;
+    const hex = v.startsWith("0x") ? v : `0x${v}`;
+    if (!/^0x[0-9a-fA-F]{64}$/.test(hex))
+        throw new Error("Wallet private key must be 32 bytes of hex (0x + 64 hex characters)");
+    return hex;
+}
+export async function readWalletKey() {
+    try {
+        return normalizeKey(await readFile(walletPath(), "utf8"));
+    }
+    catch (e) {
+        if (e.code === "ENOENT")
+            return undefined;
+        throw e;
+    }
+}
+/** Creates a new wallet key file (mode 0600). Refuses to overwrite an existing one. */
+export async function createWallet() {
+    const path = walletPath();
+    const key = generatePrivateKey();
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    await writeFile(path, `${key}\n`, { mode: 0o600, flag: "wx" });
+    return { address: privateKeyToAccount(key).address, path };
+}
+/** USDC balance on Base mainnet, via a public RPC. */
+export async function usdcBalance(address, rpc = "https://mainnet.base.org") {
+    const data = `0x70a08231${address.slice(2).toLowerCase().padStart(64, "0")}`;
+    const res = await fetch(rpc, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "eth_call", params: [{ to: USDC_BASE, data }, "latest"] }),
+    });
+    const { result } = (await res.json());
+    return Number(BigInt(result)) / 1e6;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ncrypted",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "One-time, end-to-end encrypted secrets for AI agents. Pay 0.005 USDC per secret via x402; the note self-destructs after one read.",
   "license": "MIT",
   "type": "module",
@@ -14,6 +14,10 @@
     "./crypto": {
       "types": "./dist/crypto.d.ts",
       "default": "./dist/crypto.js"
+    },
+    "./wallet": {
+      "types": "./dist/wallet.d.ts",
+      "default": "./dist/wallet.js"
     }
   },
   "bin": {