neozip-cli 0.80.0 → 0.95.0

package/dist/src/connection/store.js

@@ -0,0 +1,406 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getConnectionDir = getConnectionDir;
+exports.readConnectionPublic = readConnectionPublic;
+exports.readConnectionSecrets = readConnectionSecrets;
+exports.listConnectionIds = listConnectionIds;
+exports.listConnections = listConnections;
+exports.getActiveConnectionId = getActiveConnectionId;
+exports.getActiveConnection = getActiveConnection;
+exports.readActiveConnectionSecrets = readActiveConnectionSecrets;
+exports.createConnection = createConnection;
+exports.selectConnection = selectConnection;
+exports.ensureActiveConnection = ensureActiveConnection;
+exports.updateConnection = updateConnection;
+exports.saveAccessToken = saveAccessToken;
+exports.saveEvmWallet = saveEvmWallet;
+exports.saveWalletLink = saveWalletLink;
+exports.saveIdentityProvision = saveIdentityProvision;
+exports.savePhoneVerified = savePhoneVerified;
+exports.logoutConnection = logoutConnection;
+exports.deleteConnection = deleteConnection;
+exports.clearConnectionCredentialsFromEnv = clearConnectionCredentialsFromEnv;
+exports.applyActiveConnectionToEnv = applyActiveConnectionToEnv;
+exports.connectionPathFor = connectionPathFor;
+const crypto = __importStar(require("node:crypto"));
+const fs = __importStar(require("node:fs"));
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
+const mask_1 = require("../util/mask");
+const crypto_1 = require("./crypto");
+const origin_1 = require("./origin");
+function getConnectionDir() {
+    return (process.env.NEOZIP_CONNECTION_DIR?.trim() ||
+        path.join(os.homedir(), ".neozip", "connection"));
+}
+const MANIFEST_PATH = () => path.join(getConnectionDir(), "manifest.json");
+const CONNECTIONS_DIR = () => path.join(getConnectionDir(), "connections");
+function ensureDir() {
+    fs.mkdirSync(getConnectionDir(), { recursive: true, mode: 0o700 });
+    fs.mkdirSync(CONNECTIONS_DIR(), { recursive: true, mode: 0o700 });
+}
+function connectionDir(id) {
+    return path.join(CONNECTIONS_DIR(), id);
+}
+function publicPath(id) {
+    return path.join(connectionDir(id), "public.json");
+}
+function secretsPath(id) {
+    return path.join(connectionDir(id), "secrets.enc");
+}
+function readManifest() {
+    if (!fs.existsSync(MANIFEST_PATH())) {
+        return { version: 1, activeConnectionId: null, workspaces: {} };
+    }
+    return JSON.parse(fs.readFileSync(MANIFEST_PATH(), "utf8"));
+}
+function writeManifest(manifest) {
+    ensureDir();
+    fs.writeFileSync(MANIFEST_PATH(), JSON.stringify(manifest, null, 2) + "\n", {
+        mode: 0o600,
+    });
+}
+function workspaceKey(origin) {
+    return (0, origin_1.normalizeTokenServiceOrigin)(origin) || "__unbound__";
+}
+function getWorkspace(manifest, origin) {
+    const key = workspaceKey(origin);
+    if (!manifest.workspaces[key]) {
+        manifest.workspaces[key] = { connectionIds: [], activeConnectionId: null };
+    }
+    return manifest.workspaces[key];
+}
+function readConnectionPublicRecord(id) {
+    const p = publicPath(id);
+    if (!fs.existsSync(p))
+        return null;
+    return JSON.parse(fs.readFileSync(p, "utf8"));
+}
+/** Merge a patch into existing public.json without dropping desktop or future unknown keys. */
+function mergeConnectionPublic(existing, patch) {
+    const { id: _ignored, ...restPatch } = patch;
+    return {
+        ...existing,
+        ...restPatch,
+        id: existing.id,
+        updatedAt: new Date().toISOString(),
+    };
+}
+function readConnectionPublic(id) {
+    return readConnectionPublicRecord(id);
+}
+function readConnectionSecrets(id) {
+    const sp = secretsPath(id);
+    if (!fs.existsSync(sp))
+        return null;
+    try {
+        return (0, crypto_1.decryptSecrets)(fs.readFileSync(sp, "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+function listConnectionIds() {
+    if (!fs.existsSync(CONNECTIONS_DIR()))
+        return [];
+    return fs
+        .readdirSync(CONNECTIONS_DIR(), { withFileTypes: true })
+        .filter((d) => d.isDirectory())
+        .map((d) => d.name);
+}
+function listConnections() {
+    return listConnectionIds()
+        .map((id) => readConnectionPublic(id))
+        .filter((c) => c !== null);
+}
+function getActiveConnectionId() {
+    const manifest = readManifest();
+    if (manifest.activeConnectionId)
+        return manifest.activeConnectionId;
+    return null;
+}
+function getActiveConnection() {
+    const id = getActiveConnectionId();
+    if (!id)
+        return null;
+    return readConnectionPublic(id);
+}
+function readActiveConnectionSecrets() {
+    const id = getActiveConnectionId();
+    if (!id)
+        return null;
+    return readConnectionSecrets(id);
+}
+function writeConnectionPublic(meta) {
+    ensureDir();
+    const dir = connectionDir(meta.id);
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    fs.writeFileSync(publicPath(meta.id), JSON.stringify(meta, null, 2) + "\n", {
+        mode: 0o600,
+    });
+}
+function writeConnectionSecrets(id, secrets) {
+    ensureDir();
+    fs.writeFileSync(secretsPath(id), (0, crypto_1.encryptSecrets)(secrets), { mode: 0o600 });
+}
+function registerInWorkspace(manifest, origin, id) {
+    const ws = getWorkspace(manifest, origin);
+    if (!ws.connectionIds.includes(id)) {
+        ws.connectionIds.push(id);
+    }
+    ws.activeConnectionId = id;
+    manifest.activeConnectionId = id;
+}
+function createConnection(input) {
+    const now = new Date().toISOString();
+    const origin = (0, origin_1.resolveTokenServiceOrigin)(input.tokenServiceUrl);
+    const meta = {
+        id: crypto.randomUUID(),
+        label: input.label?.trim() || "default",
+        tokenServiceOrigin: origin,
+        email: null,
+        emailVerified: false,
+        emailVerifiedAt: null,
+        evmAddress: null,
+        walletId: null,
+        linkId: null,
+        identityKeyId: null,
+        x25519PublicKeySpkiB64: null,
+        x25519Fingerprint: null,
+        onboardingCompleteAt: null,
+        createdAt: now,
+        updatedAt: now,
+    };
+    writeConnectionPublic(meta);
+    writeConnectionSecrets(meta.id, {
+        accessToken: null,
+        accessTokenObtainedAt: null,
+        accessTokenExpiresAt: null,
+        evmPrivateKeyHex: null,
+    });
+    const manifest = readManifest();
+    registerInWorkspace(manifest, origin, meta.id);
+    writeManifest(manifest);
+    return meta;
+}
+function selectConnection(connectionId) {
+    const meta = readConnectionPublic(connectionId);
+    if (!meta)
+        throw new Error(`Connection not found: ${connectionId}`);
+    const manifest = readManifest();
+    registerInWorkspace(manifest, meta.tokenServiceOrigin, connectionId);
+    writeManifest(manifest);
+    return meta;
+}
+function ensureActiveConnection(input) {
+    const active = getActiveConnection();
+    if (active)
+        return active;
+    const origin = (0, origin_1.resolveTokenServiceOrigin)(input?.tokenServiceUrl);
+    const manifest = readManifest();
+    const ws = manifest.workspaces[workspaceKey(origin)];
+    if (ws?.activeConnectionId) {
+        const existing = readConnectionPublic(ws.activeConnectionId);
+        if (existing) {
+            manifest.activeConnectionId = existing.id;
+            writeManifest(manifest);
+            return existing;
+        }
+    }
+    return createConnection({
+        label: input?.label,
+        tokenServiceUrl: input?.tokenServiceUrl,
+    });
+}
+function updateConnection(connectionId, patch) {
+    const existing = readConnectionPublicRecord(connectionId);
+    if (!existing)
+        throw new Error(`Connection not found: ${connectionId}`);
+    const updated = mergeConnectionPublic(existing, patch);
+    writeConnectionPublic(updated);
+    return updated;
+}
+function saveAccessToken(connectionId, accessToken, email, expiresAt) {
+    const secrets = readConnectionSecrets(connectionId) ?? emptySecrets();
+    secrets.accessToken = accessToken;
+    secrets.accessTokenObtainedAt = Date.now();
+    secrets.accessTokenExpiresAt = expiresAt ?? null;
+    writeConnectionSecrets(connectionId, secrets);
+    const now = new Date().toISOString();
+    return updateConnection(connectionId, {
+        email: email.trim().toLowerCase(),
+        emailVerified: true,
+        emailVerifiedAt: now,
+    });
+}
+function saveEvmWallet(connectionId, evmPrivateKeyHex, evmAddress) {
+    const secrets = readConnectionSecrets(connectionId) ?? emptySecrets();
+    secrets.evmPrivateKeyHex = evmPrivateKeyHex.replace(/^0x/i, "");
+    writeConnectionSecrets(connectionId, secrets);
+    return updateConnection(connectionId, { evmAddress });
+}
+function saveWalletLink(connectionId, walletId, linkId, evmAddress) {
+    return updateConnection(connectionId, { walletId, linkId, evmAddress });
+}
+function saveIdentityProvision(connectionId, identityKeyId, x25519PublicKeySpkiB64) {
+    const now = new Date().toISOString();
+    return updateConnection(connectionId, {
+        identityKeyId,
+        x25519PublicKeySpkiB64,
+        x25519Fingerprint: (0, mask_1.maskPublicKey)(x25519PublicKeySpkiB64),
+        onboardingCompleteAt: now,
+    });
+}
+function savePhoneVerified(connectionId, phoneE164) {
+    const now = new Date().toISOString();
+    return updateConnection(connectionId, {
+        phoneE164: phoneE164.trim(),
+        phoneVerifiedAt: now,
+    });
+}
+function emptySecrets() {
+    return {
+        accessToken: null,
+        accessTokenObtainedAt: null,
+        accessTokenExpiresAt: null,
+        evmPrivateKeyHex: null,
+    };
+}
+function logoutConnection(connectionId) {
+    const id = connectionId?.trim() || getActiveConnectionId();
+    if (!id) {
+        throw new Error("No connection to log out. Run neozip connect first.");
+    }
+    const meta = readConnectionPublic(id);
+    if (!meta)
+        throw new Error(`Connection not found: ${id}`);
+    writeConnectionSecrets(id, emptySecrets());
+    updateConnection(id, {
+        email: null,
+        emailVerified: false,
+        emailVerifiedAt: null,
+        evmAddress: null,
+        walletId: null,
+        linkId: null,
+        identityKeyId: null,
+        x25519PublicKeySpkiB64: null,
+        x25519Fingerprint: null,
+        onboardingCompleteAt: null,
+        phoneE164: null,
+        phoneVerifiedAt: null,
+    });
+    const manifest = readManifest();
+    const wasActive = manifest.activeConnectionId === id;
+    if (wasActive) {
+        manifest.activeConnectionId = null;
+        const ws = manifest.workspaces[workspaceKey(meta.tokenServiceOrigin)];
+        if (ws)
+            ws.activeConnectionId = null;
+        writeManifest(manifest);
+    }
+    return { connectionId: id, label: meta.label, wasActive };
+}
+function pickNextActiveConnectionId(manifest) {
+    for (const ws of Object.values(manifest.workspaces)) {
+        if (ws.activeConnectionId && readConnectionPublic(ws.activeConnectionId)) {
+            return ws.activeConnectionId;
+        }
+        for (const id of ws.connectionIds) {
+            if (readConnectionPublic(id))
+                return id;
+        }
+    }
+    return null;
+}
+/** Remove a connection and its secrets from disk. */
+function deleteConnection(connectionId) {
+    const id = connectionId.trim();
+    const meta = readConnectionPublic(id);
+    if (!meta)
+        throw new Error(`Connection not found: ${id}`);
+    const dir = connectionDir(id);
+    if (fs.existsSync(dir)) {
+        fs.rmSync(dir, { recursive: true, force: true });
+    }
+    const manifest = readManifest();
+    const wsKey = workspaceKey(meta.tokenServiceOrigin);
+    const ws = manifest.workspaces[wsKey];
+    if (ws) {
+        ws.connectionIds = ws.connectionIds.filter((existingId) => existingId !== id);
+        if (ws.activeConnectionId === id) {
+            ws.activeConnectionId = ws.connectionIds[0] ?? null;
+        }
+        if (ws.connectionIds.length === 0) {
+            delete manifest.workspaces[wsKey];
+        }
+    }
+    if (manifest.activeConnectionId === id) {
+        manifest.activeConnectionId = pickNextActiveConnectionId(manifest);
+    }
+    writeManifest(manifest);
+    return {
+        connectionId: id,
+        label: meta.label,
+        newActiveConnectionId: manifest.activeConnectionId,
+    };
+}
+function clearConnectionCredentialsFromEnv() {
+    delete process.env.NEOZIP_TOKEN_SERVICE_ACCESS_TOKEN;
+    delete process.env.NEOZIP_WALLET_PASSKEY;
+    delete process.env.NEOZIP_RECIPIENT_EMAIL;
+}
+/** Merge active connection into env when env does not override. */
+function applyActiveConnectionToEnv() {
+    const meta = getActiveConnection();
+    const secrets = readActiveConnectionSecrets();
+    if (!meta || !secrets) {
+        return { applied: false, connectionId: null };
+    }
+    if (!process.env.NEOZIP_TOKEN_SERVICE_ACCESS_TOKEN && secrets.accessToken) {
+        process.env.NEOZIP_TOKEN_SERVICE_ACCESS_TOKEN = secrets.accessToken;
+    }
+    if (!process.env.NEOZIP_WALLET_PASSKEY && secrets.evmPrivateKeyHex) {
+        process.env.NEOZIP_WALLET_PASSKEY = secrets.evmPrivateKeyHex;
+    }
+    if (!process.env.NEOZIP_RECIPIENT_EMAIL && meta.email) {
+        process.env.NEOZIP_RECIPIENT_EMAIL = meta.email;
+    }
+    return { applied: true, connectionId: meta.id };
+}
+function connectionPathFor(id) {
+    return connectionDir(id);
+}
+//# sourceMappingURL=store.js.map

package/dist/src/connection/token-auth.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseAccessTokenExpiry = parseAccessTokenExpiry;
+exports.isAccessTokenExpired = isAccessTokenExpired;
+exports.formatTokenReauthGuidance = formatTokenReauthGuidance;
+exports.tokenServiceAuthErrorMessage = tokenServiceAuthErrorMessage;
+/** Grace period before stored expiry to avoid edge-of-window 401s. */
+const TOKEN_EXPIRY_GRACE_MS = 60000;
+function parseAccessTokenExpiry(parsed) {
+    const expiresAt = parsed.expiresAt;
+    if (typeof expiresAt === "number" && Number.isFinite(expiresAt)) {
+        return expiresAt > 1e12 ? expiresAt : expiresAt * 1000;
+    }
+    const expiresIn = parsed.expiresIn;
+    if (typeof expiresIn === "number" && Number.isFinite(expiresIn)) {
+        return Date.now() + expiresIn * 1000;
+    }
+    return null;
+}
+function isAccessTokenExpired(secrets, now = Date.now()) {
+    const expiresAt = secrets?.accessTokenExpiresAt;
+    if (expiresAt == null)
+        return false;
+    return now >= expiresAt - TOKEN_EXPIRY_GRACE_MS;
+}
+function formatTokenReauthGuidance(email) {
+    const refreshCmd = email?.trim()
+        ? `neozip connect refresh --email ${email.trim().toLowerCase()}`
+        : "neozip connect refresh";
+    return [
+        "Token Service access token expired or rejected.",
+        "Refresh it (a 6-digit code is emailed to you):",
+        `  ${refreshCmd}`,
+        `  ${refreshCmd} --code 123456`,
+        "When the refresh completes, reload MCP in Cursor Settings if you use it.",
+    ].join("\n");
+}
+/** User-facing message for Token Service auth failures (401/403). */
+function tokenServiceAuthErrorMessage(status, email) {
+    if (status !== 401 && status !== 403)
+        return null;
+    return formatTokenReauthGuidance(email);
+}
+//# sourceMappingURL=token-auth.js.map

package/dist/src/connection/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/src/connection/wallet-json-migration.js

@@ -0,0 +1,155 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.walletJsonExists = walletJsonExists;
+exports.loadWalletJson = loadWalletJson;
+exports.archiveWalletJson = archiveWalletJson;
+exports.migrateFromWalletJson = migrateFromWalletJson;
+const fs = __importStar(require("node:fs"));
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
+const ethers_1 = require("ethers");
+const store_1 = require("./store");
+const WALLET_JSON = path.join(os.homedir(), '.neozip', 'wallet.json');
+const WALLET_JSON_MIGRATED = `${WALLET_JSON}.migrated`;
+const LEGACY_RPC_KEY_TO_NETWORK = {
+    baseSepolia: 'base-sepolia',
+    baseMainnet: 'base-mainnet',
+};
+function walletJsonExists() {
+    return fs.existsSync(WALLET_JSON);
+}
+function loadWalletJson() {
+    if (!walletJsonExists()) {
+        return null;
+    }
+    try {
+        return JSON.parse(fs.readFileSync(WALLET_JSON, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+function archiveWalletJson() {
+    if (!walletJsonExists()) {
+        return false;
+    }
+    try {
+        if (fs.existsSync(WALLET_JSON_MIGRATED)) {
+            fs.unlinkSync(WALLET_JSON_MIGRATED);
+        }
+        fs.renameSync(WALLET_JSON, WALLET_JSON_MIGRATED);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function migrateFromWalletJson() {
+    const legacy = loadWalletJson();
+    if (!legacy) {
+        return { migratedPrefs: false, importedKey: false, archived: false, messages: [] };
+    }
+    const messages = [];
+    let migratedPrefs = false;
+    let importedKey = false;
+    const connectionId = (0, store_1.getActiveConnectionId)();
+    const meta = (0, store_1.getActiveConnection)();
+    const secrets = (0, store_1.readActiveConnectionSecrets)();
+    if (connectionId && meta) {
+        const patch = {};
+        if (legacy.wallet?.network && !meta.defaultNetwork) {
+            patch.defaultNetwork = legacy.wallet.network;
+            migratedPrefs = true;
+        }
+        if (legacy.rpc && Object.keys(legacy.rpc).length > 0) {
+            const rpcOverrides = { ...(meta.rpcOverrides ?? {}) };
+            for (const [key, url] of Object.entries(legacy.rpc)) {
+                if (!url?.trim())
+                    continue;
+                const networkKey = LEGACY_RPC_KEY_TO_NETWORK[key] ?? key;
+                if (!rpcOverrides[networkKey]) {
+                    rpcOverrides[networkKey] = url.trim();
+                    migratedPrefs = true;
+                }
+            }
+            if (Object.keys(rpcOverrides).length > 0) {
+                patch.rpcOverrides = rpcOverrides;
+            }
+        }
+        if (legacy.gas && !meta.gas) {
+            patch.gas = legacy.gas;
+            migratedPrefs = true;
+        }
+        if (legacy.debug && !meta.debug) {
+            patch.debug = legacy.debug;
+            migratedPrefs = true;
+        }
+        if (Object.keys(patch).length > 0) {
+            (0, store_1.updateConnection)(connectionId, patch);
+            messages.push('Imported wallet.json preferences into active connection.');
+        }
+        const privateKey = legacy.wallet?.privateKey?.trim();
+        if (privateKey && !secrets?.evmPrivateKeyHex) {
+            if (meta.emailVerified && secrets?.accessToken) {
+                try {
+                    const normalized = privateKey.startsWith('0x') ? privateKey : `0x${privateKey}`;
+                    const wallet = new ethers_1.Wallet(normalized);
+                    (0, store_1.saveEvmWallet)(connectionId, wallet.privateKey, wallet.address);
+                    importedKey = true;
+                    messages.push(`Imported wallet private key (${wallet.address}). Run neozip connect finish if linking is incomplete.`);
+                }
+                catch (err) {
+                    messages.push(`Could not import wallet key: ${err instanceof Error ? err.message : String(err)}. Run: neozip connect wallet import-key`);
+                }
+            }
+            else {
+                messages.push('wallet.json contains a private key but connection email is not verified. Run neozip connect, then: neozip connect wallet import-key --private-key 0x...');
+            }
+        }
+        else if (privateKey && secrets?.evmPrivateKeyHex) {
+            messages.push('Skipped wallet.json private key (connection store already has a wallet).');
+        }
+    }
+    else if (legacy.wallet?.privateKey || legacy.wallet?.network) {
+        messages.push('wallet.json found but no active connection. Run neozip connect first, then neozip connect migrate.');
+    }
+    const archived = migratedPrefs || importedKey ? archiveWalletJson() : false;
+    if (archived) {
+        messages.push(`Archived ${WALLET_JSON} → wallet.json.migrated`);
+    }
+    return { migratedPrefs, importedKey, archived, messages };
+}
+//# sourceMappingURL=wallet-json-migration.js.map

package/dist/src/connection/wallet-login.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.refreshAccessTokenViaWallet = refreshAccessTokenViaWallet;
+exports.ensureFreshTokenServiceToken = ensureFreshTokenServiceToken;
+/**
+ * Silent Token Service token renewal via the local Data Wallet (EVM) signature.
+ *
+ * The Token Service has no refresh-token grant, but it accepts a SIWE-style
+ * wallet-login: prove control of the Data Wallet private key (already the master
+ * key for the account's data wallet) and receive a fresh access token without an
+ * email OTP. This module performs that exchange and persists the new token,
+ * leaving the wallet/identity untouched.
+ */
+const token_service_1 = require("neozip-blockchain/token-service");
+const wallet_evm_1 = require("../account/wallet-evm");
+const origin_1 = require("./origin");
+const store_1 = require("./store");
+const token_auth_1 = require("./token-auth");
+/** Attempt a silent wallet-signature token renewal for the active connection. */
+async function refreshAccessTokenViaWallet(options) {
+    const meta = (0, store_1.getActiveConnection)();
+    const secrets = (0, store_1.readActiveConnectionSecrets)();
+    const evmAddress = meta?.evmAddress?.trim();
+    const privateKeyHex = secrets?.evmPrivateKeyHex?.trim();
+    if (!meta || !evmAddress || !privateKeyHex) {
+        return { ok: false, reason: 'no_wallet' };
+    }
+    const origin = (0, origin_1.resolveTokenServiceOrigin)(options?.tokenServiceUrl ?? meta.tokenServiceOrigin);
+    const privateKey = privateKeyHex.startsWith('0x') ? privateKeyHex : `0x${privateKeyHex}`;
+    try {
+        const challenge = await (0, token_service_1.requestWalletLoginChallenge)(origin, evmAddress);
+        const signature = await (0, wallet_evm_1.signEvmMessage)(privateKey, challenge.message);
+        const out = await (0, token_service_1.walletLogin)(origin, {
+            evmAddress,
+            challengeId: challenge.challengeId,
+            evmSignature: signature,
+        });
+        (0, store_1.saveAccessToken)(meta.id, out.accessToken, meta.email ?? out.email ?? '', out.expiresAt);
+        (0, store_1.applyActiveConnectionToEnv)();
+        return { ok: true, expiresAt: out.expiresAt };
+    }
+    catch (err) {
+        if (err instanceof token_service_1.WalletLoginUnavailableError) {
+            return { ok: false, reason: 'unsupported', message: err.message };
+        }
+        return {
+            ok: false,
+            reason: 'error',
+            message: err instanceof Error ? err.message : String(err),
+        };
+    }
+}
+/**
+ * Best-effort: if the active access token is expired and a wallet is available,
+ * silently renew it via wallet login. Never throws; callers proceed and let the
+ * normal readiness checks surface any remaining problem.
+ */
+async function ensureFreshTokenServiceToken(options) {
+    const secrets = (0, store_1.readActiveConnectionSecrets)();
+    if (!secrets?.accessToken || !(0, token_auth_1.isAccessTokenExpired)(secrets)) {
+        return;
+    }
+    await refreshAccessTokenViaWallet(options);
+}
+//# sourceMappingURL=wallet-login.js.map