neozip-cli 0.90.0 → 0.95.0

package/dist/src/connection/onboarding.js

@@ -0,0 +1,616 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.connectStatus = connectStatus;
+exports.connectRegister = connectRegister;
+exports.connectVerify = connectVerify;
+exports.connectRefresh = connectRefresh;
+exports.connectSelect = connectSelect;
+exports.connectRename = connectRename;
+exports.connectPhoneRequest = connectPhoneRequest;
+exports.connectPhoneVerify = connectPhoneVerify;
+exports.connectWalletCreate = connectWalletCreate;
+exports.connectWalletImportMnemonic = connectWalletImportMnemonic;
+exports.connectWalletImportKey = connectWalletImportKey;
+exports.connectFinish = connectFinish;
+exports.connectSetup = connectSetup;
+exports.connectLogout = connectLogout;
+exports.connectDelete = connectDelete;
+exports.connectMigrate = connectMigrate;
+const identity_provision_1 = require("../account/identity-provision");
+const wallet_setup_1 = require("../account/wallet-setup");
+const token_service_1 = require("neozip-blockchain/token-service");
+const wallet_evm_1 = require("../account/wallet-evm");
+const coordinator_1 = require("./coordinator");
+const wallet_setup_2 = require("./wallet-setup");
+const migrate_1 = require("./migrate");
+const magic_link_1 = require("./magic-link");
+const status_report_1 = require("./status-report");
+const phase_1 = require("./phase");
+const origin_1 = require("./origin");
+const wallet_login_1 = require("./wallet-login");
+const phone_1 = require("./phone");
+const store_1 = require("./store");
+function result(phase, extra = {}) {
+    const meta = (0, store_1.getActiveConnection)();
+    return {
+        success: phase === "ready",
+        phase,
+        connectionId: meta?.id ?? null,
+        tokenServiceOrigin: meta?.tokenServiceOrigin ?? (0, origin_1.resolveTokenServiceOrigin)(),
+        nextCommand: (0, phase_1.nextConnectCommand)(phase, {
+            email: meta?.email,
+            phoneE164: meta?.phoneE164,
+        }),
+        ...extra,
+    };
+}
+async function connectStatus(options) {
+    if (options?.autoMigrate !== false && (0, migrate_1.hasLegacyMcpProfiles)()) {
+        (0, migrate_1.migrateFromMcpProfileStore)();
+    }
+    const origin = (0, origin_1.resolveTokenServiceOrigin)(options?.tokenServiceUrl);
+    (0, store_1.ensureActiveConnection)({ tokenServiceUrl: origin });
+    const phase = await (0, phase_1.resolveConnectionPhase)(origin);
+    const reachable = await (0, coordinator_1.fetchCoordinatorConfigParsed)(origin);
+    const reportPhase = reachable === null && phase !== "ready" ? "degraded" : phase;
+    const accounts = options?.verbose ? (0, status_report_1.buildAllAccountDetails)() : undefined;
+    const active = (0, store_1.getActiveConnection)();
+    return {
+        ...result(reportPhase, {
+            message: reportPhase === "degraded"
+                ? "Token Service unreachable."
+                : reportPhase === "ready"
+                    ? "Connection ready."
+                    : undefined,
+        }),
+        connectionId: active?.id ?? null,
+        tokenServiceOrigin: origin,
+        accounts,
+    };
+}
+async function connectRegister(input) {
+    if ((0, migrate_1.hasLegacyMcpProfiles)())
+        (0, migrate_1.migrateFromMcpProfileStore)();
+    const origin = (0, origin_1.resolveTokenServiceOrigin)(input.tokenServiceUrl);
+    const email = input.email.trim().toLowerCase();
+    (0, store_1.ensureActiveConnection)({ label: input.label, tokenServiceUrl: origin });
+    const reg = await (0, token_service_1.registerEmailCli)(origin, email);
+    if (!reg.success) {
+        return result("degraded", {
+            success: false,
+            message: reg.error ?? "Failed to send verification email.",
+        });
+    }
+    return result("awaiting_code", {
+        success: true,
+        message: input.resend
+            ? `Verification code re-sent to ${email}. Run neozip connect verify with the 6-digit code.`
+            : "Verification code sent. Run neozip connect verify with the 6-digit code.",
+    });
+}
+async function finalizeEmailVerification(origin, connId, accessToken, email, expiresAt) {
+    (0, store_1.saveAccessToken)(connId, accessToken, email, expiresAt);
+    (0, store_1.applyActiveConnectionToEnv)();
+    const updated = (0, store_1.getActiveConnection)();
+    if (await (0, phone_1.needsPhoneVerification)(updated, origin)) {
+        return result("phone_required", {
+            success: true,
+            message: "Email verified. Run neozip connect phone request --phone +14155551234, then phone verify with the SMS code.",
+        });
+    }
+    const phase = (0, phase_1.computeConnectionPhase)();
+    return result(phase, {
+        success: true,
+        message: phase === "ready"
+            ? "Email verified and connection ready."
+            : "Email verified. Configure a Data Wallet, then run neozip connect finish.",
+    });
+}
+async function connectVerify(input) {
+    if ((0, migrate_1.hasLegacyMcpProfiles)())
+        (0, migrate_1.migrateFromMcpProfileStore)();
+    const origin = (0, origin_1.resolveTokenServiceOrigin)(input.tokenServiceUrl);
+    const conn = (0, store_1.ensureActiveConnection)({ tokenServiceUrl: origin });
+    let email = input.email?.trim().toLowerCase();
+    let code = input.code?.trim();
+    if (input.magicToken?.trim()) {
+        const pair = (0, magic_link_1.extractEmailCodePair)(input.magicToken);
+        email = email ?? pair.email;
+        code = code ?? pair.code;
+        if (!email || !code) {
+            const opaque = (0, magic_link_1.normalizeMagicLinkTokenInput)(input.magicToken);
+            if (opaque) {
+                try {
+                    const exchanged = await (0, token_service_1.exchangeMagicLinkToken)(origin, opaque);
+                    return finalizeEmailVerification(origin, conn.id, exchanged.accessToken, exchanged.email, exchanged.expiresAt);
+                }
+                catch (err) {
+                    return result("awaiting_code", {
+                        success: false,
+                        message: err instanceof Error ? err.message : String(err),
+                    });
+                }
+            }
+        }
+    }
+    if (!email || !code) {
+        return result("awaiting_code", {
+            success: false,
+            message: "Provide --email and --code, or --magic-token (full link, email=…&code=…, or opaque token).",
+        });
+    }
+    try {
+        const verified = await (0, token_service_1.verifyEmailAndExtractToken)(origin, email, code);
+        return finalizeEmailVerification(origin, conn.id, verified.accessToken, verified.email, verified.expiresAt);
+    }
+    catch (err) {
+        return result("awaiting_code", {
+            success: false,
+            message: err instanceof Error ? err.message : String(err),
+        });
+    }
+}
+/**
+ * Refresh (renew) the Token Service access token without disturbing the wallet
+ * or identity. The Token Service has no silent refresh endpoint, so renewal
+ * re-runs the email OTP flow: call once to send a code, then again with --code
+ * (or --magic-token). Re-verifying only replaces the access token via
+ * saveAccessToken(), so a previously "ready" account stays ready.
+ */
+async function connectRefresh(input) {
+    if ((0, migrate_1.hasLegacyMcpProfiles)())
+        (0, migrate_1.migrateFromMcpProfileStore)();
+    const origin = (0, origin_1.resolveTokenServiceOrigin)(input.tokenServiceUrl);
+    const conn = (0, store_1.ensureActiveConnection)({ tokenServiceUrl: origin });
+    const email = (input.email ?? conn.email ?? "").trim().toLowerCase();
+    const hasVerifier = Boolean(input.code?.trim() || input.magicToken?.trim());
+    // Preferred path: silent wallet-signature renewal (no email round-trip). Only
+    // attempted when the caller did not supply an explicit code/magic token.
+    if (!hasVerifier) {
+        const walletTry = await (0, wallet_login_1.refreshAccessTokenViaWallet)({
+            tokenServiceUrl: input.tokenServiceUrl,
+        });
+        if (walletTry.ok) {
+            return result((0, phase_1.computeConnectionPhase)(), {
+                success: true,
+                message: "Access token refreshed via wallet signature. Connection ready.",
+            });
+        }
+        // Otherwise fall through to the email OTP flow below.
+    }
+    if (!email && !input.magicToken?.trim()) {
+        return result((0, phase_1.computeConnectionPhase)(), {
+            success: false,
+            message: "No account email to refresh. Run neozip connect to set up an account, or pass --email.",
+        });
+    }
+    // Step 2: a code (or magic token) is present — verify to mint a fresh token.
+    if (hasVerifier) {
+        const verified = await connectVerify({
+            email: email || undefined,
+            code: input.code,
+            magicToken: input.magicToken,
+            tokenServiceUrl: input.tokenServiceUrl,
+        });
+        if (!verified.success)
+            return verified;
+        const phase = (0, phase_1.computeConnectionPhase)();
+        return result(phase, {
+            success: true,
+            message: phase === "ready"
+                ? "Access token refreshed. Connection ready."
+                : verified.message ?? `Access token refreshed (phase: ${phase}).`,
+        });
+    }
+    // Step 1: no code yet — send a fresh verification code.
+    const sent = await connectRegister({
+        email,
+        tokenServiceUrl: input.tokenServiceUrl,
+        resend: true,
+    });
+    if (!sent.success)
+        return sent;
+    return result("awaiting_code", {
+        success: true,
+        message: `Verification code sent to ${email}. Complete the refresh with:\n  neozip connect refresh --email ${email} --code <6-digit-code>`,
+    });
+}
+function connectSelect(input) {
+    if ((0, migrate_1.hasLegacyMcpProfiles)())
+        (0, migrate_1.migrateFromMcpProfileStore)();
+    try {
+        const meta = (0, store_1.selectConnection)(input.connectionId.trim());
+        (0, store_1.applyActiveConnectionToEnv)();
+        return result((0, phase_1.computeConnectionPhase)(), {
+            success: true,
+            message: `Active connection: ${meta.label} (${meta.id})`,
+            accounts: [(0, status_report_1.buildAccountDetails)(meta, meta.id)],
+        });
+    }
+    catch (err) {
+        return result((0, phase_1.computeConnectionPhase)(), {
+            success: false,
+            message: err instanceof Error ? err.message : String(err),
+        });
+    }
+}
+function connectRename(input) {
+    if ((0, migrate_1.hasLegacyMcpProfiles)())
+        (0, migrate_1.migrateFromMcpProfileStore)();
+    const id = input.connectionId?.trim() || (0, store_1.getActiveConnection)()?.id;
+    if (!id) {
+        return result("no_profile", {
+            success: false,
+            message: "No connection to rename.",
+        });
+    }
+    const nextLabel = input.label.trim();
+    if (!nextLabel) {
+        return result((0, phase_1.computeConnectionPhase)(), {
+            success: false,
+            message: "Label is required.",
+        });
+    }
+    try {
+        const meta = (0, store_1.updateConnection)(id, { label: nextLabel });
+        return result((0, phase_1.computeConnectionPhaseForId)(id), {
+            success: true,
+            message: `Renamed connection to "${meta.label}".`,
+            accounts: [(0, status_report_1.buildAccountDetails)(meta, (0, store_1.getActiveConnection)()?.id ?? null)],
+        });
+    }
+    catch (err) {
+        return result((0, phase_1.computeConnectionPhase)(), {
+            success: false,
+            message: err instanceof Error ? err.message : String(err),
+        });
+    }
+}
+async function connectPhoneRequest(input) {
+    if ((0, migrate_1.hasLegacyMcpProfiles)())
+        (0, migrate_1.migrateFromMcpProfileStore)();
+    const origin = (0, origin_1.resolveTokenServiceOrigin)(input.tokenServiceUrl);
+    const conn = (0, store_1.ensureActiveConnection)({ tokenServiceUrl: origin });
+    const secrets = (0, store_1.readActiveConnectionSecrets)();
+    if (!secrets?.accessToken || !conn.emailVerified) {
+        return result("email_unverified", {
+            success: false,
+            message: "Verify email first. Run neozip connect verify.",
+        });
+    }
+    if ((0, phone_1.isPhoneVerified)(conn)) {
+        const phase = (0, phase_1.computeConnectionPhase)();
+        return result(phase, {
+            success: true,
+            message: "Phone already verified.",
+        });
+    }
+    try {
+        (0, phone_1.validatePhoneE164)(input.phone);
+    }
+    catch (err) {
+        return result("phone_required", {
+            success: false,
+            message: err instanceof Error ? err.message : String(err),
+        });
+    }
+    const otp = await (0, token_service_1.requestPhoneOtp)(origin, secrets.accessToken, input.phone);
+    if (!otp.success) {
+        return result("phone_required", {
+            success: false,
+            message: otp.error ?? "Failed to send phone verification SMS.",
+        });
+    }
+    return result("phone_required", {
+        success: true,
+        message: `SMS code sent to ${input.phone.trim()}. Run neozip connect phone verify --phone ${input.phone.trim()} --code <6-digit-code>.`,
+    });
+}
+async function connectPhoneVerify(input) {
+    if ((0, migrate_1.hasLegacyMcpProfiles)())
+        (0, migrate_1.migrateFromMcpProfileStore)();
+    const origin = (0, origin_1.resolveTokenServiceOrigin)(input.tokenServiceUrl);
+    const conn = (0, store_1.ensureActiveConnection)({ tokenServiceUrl: origin });
+    const secrets = (0, store_1.readActiveConnectionSecrets)();
+    if (!secrets?.accessToken || !conn.emailVerified) {
+        return result("email_unverified", {
+            success: false,
+            message: "Verify email first. Run neozip connect verify.",
+        });
+    }
+    try {
+        (0, phone_1.validatePhoneE164)(input.phone);
+    }
+    catch (err) {
+        return result("phone_required", {
+            success: false,
+            message: err instanceof Error ? err.message : String(err),
+        });
+    }
+    const verified = await (0, token_service_1.verifyPhoneOtp)(origin, secrets.accessToken, input.phone, input.code);
+    if (!verified.success) {
+        return result("phone_required", {
+            success: false,
+            message: verified.error ?? "Phone verification failed.",
+        });
+    }
+    (0, store_1.savePhoneVerified)(conn.id, input.phone);
+    (0, store_1.applyActiveConnectionToEnv)();
+    const phase = (0, phase_1.computeConnectionPhase)();
+    return result(phase, {
+        success: true,
+        message: phase === "ready"
+            ? "Phone verified and connection ready."
+            : "Phone verified. Configure a Data Wallet, then run neozip connect finish.",
+    });
+}
+async function connectWalletCreate(input) {
+    if ((0, migrate_1.hasLegacyMcpProfiles)())
+        (0, migrate_1.migrateFromMcpProfileStore)();
+    const origin = (0, origin_1.resolveTokenServiceOrigin)(input.tokenServiceUrl);
+    (0, store_1.ensureActiveConnection)({ tokenServiceUrl: origin });
+    const { conn, secrets } = (0, wallet_setup_2.activeWalletContext)();
+    try {
+        (0, wallet_setup_2.requireWalletPreconditions)(conn, secrets);
+        await (0, wallet_setup_2.requirePhonePreconditions)(conn, origin);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        const phase = message.includes("Phone") ? "phone_required" : "email_unverified";
+        return result(phase, { success: false, message });
+    }
+    if ((0, wallet_setup_2.walletAlreadyConfigured)(conn, secrets)) {
+        const phase = (0, phase_1.computeConnectionPhase)();
+        return result(phase, {
+            success: true,
+            message: `Data Wallet already configured (${conn.evmAddress}). Run neozip connect finish.`,
+        });
+    }
+    if (!input.ackBackup) {
+        return result("no_wallet", {
+            success: false,
+            message: "Creating a wallet requires --ack-backup (recovery phrase is shown once on stderr). " +
+                wallet_setup_2.WALLET_SETUP_HINT,
+        });
+    }
+    const evm = (0, wallet_setup_2.createLocalWalletIdentity)();
+    console.error(`
+Back up your Data Wallet recovery phrase (shown once):
+Address: ${evm.address}
+
+Recovery phrase:
+${evm.mnemonic}
+`);
+    (0, wallet_setup_2.saveImportedWallet)(conn.id, evm);
+    (0, store_1.applyActiveConnectionToEnv)();
+    const phase = (0, phase_1.computeConnectionPhase)();
+    return result(phase, {
+        success: true,
+        message: `Data Wallet created (${evm.address}). Run neozip connect finish.`,
+    });
+}
+async function connectWalletImportMnemonic(input) {
+    if ((0, migrate_1.hasLegacyMcpProfiles)())
+        (0, migrate_1.migrateFromMcpProfileStore)();
+    const origin = (0, origin_1.resolveTokenServiceOrigin)(input.tokenServiceUrl);
+    (0, store_1.ensureActiveConnection)({ tokenServiceUrl: origin });
+    const { conn, secrets } = (0, wallet_setup_2.activeWalletContext)();
+    try {
+        (0, wallet_setup_2.requireWalletPreconditions)(conn, secrets);
+        await (0, wallet_setup_2.requirePhonePreconditions)(conn, origin);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        const phase = message.includes("Phone") ? "phone_required" : "email_unverified";
+        return result(phase, { success: false, message });
+    }
+    if ((0, wallet_setup_2.walletAlreadyConfigured)(conn, secrets)) {
+        const phase = (0, phase_1.computeConnectionPhase)();
+        return result(phase, {
+            success: true,
+            message: `Data Wallet already configured (${conn.evmAddress}). Run neozip connect finish.`,
+        });
+    }
+    const mnemonic = input.mnemonic.trim();
+    if (!mnemonic) {
+        return result("no_wallet", { success: false, message: "--mnemonic is required." });
+    }
+    try {
+        const evm = (0, wallet_setup_2.importWalletFromMnemonic)(mnemonic);
+        await (0, wallet_setup_2.validateWalletImportAgainstServer)({
+            origin,
+            accessToken: secrets.accessToken,
+            derivedAddress: evm.address,
+            force: input.force,
+        });
+        (0, wallet_setup_2.saveImportedWallet)(conn.id, evm);
+        (0, store_1.applyActiveConnectionToEnv)();
+        const phase = (0, phase_1.computeConnectionPhase)();
+        return result(phase, {
+            success: true,
+            message: `Imported Data Wallet (${evm.address}). Run neozip connect finish.`,
+        });
+    }
+    catch (err) {
+        return result("no_wallet", {
+            success: false,
+            message: err instanceof Error ? err.message : String(err),
+        });
+    }
+}
+async function connectWalletImportKey(input) {
+    if ((0, migrate_1.hasLegacyMcpProfiles)())
+        (0, migrate_1.migrateFromMcpProfileStore)();
+    const origin = (0, origin_1.resolveTokenServiceOrigin)(input.tokenServiceUrl);
+    (0, store_1.ensureActiveConnection)({ tokenServiceUrl: origin });
+    const { conn, secrets } = (0, wallet_setup_2.activeWalletContext)();
+    try {
+        (0, wallet_setup_2.requireWalletPreconditions)(conn, secrets);
+        await (0, wallet_setup_2.requirePhonePreconditions)(conn, origin);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        const phase = message.includes("Phone") ? "phone_required" : "email_unverified";
+        return result(phase, { success: false, message });
+    }
+    if ((0, wallet_setup_2.walletAlreadyConfigured)(conn, secrets)) {
+        const phase = (0, phase_1.computeConnectionPhase)();
+        return result(phase, {
+            success: true,
+            message: `Data Wallet already configured (${conn.evmAddress}). Run neozip connect finish.`,
+        });
+    }
+    const privateKey = input.privateKey.trim();
+    if (!privateKey) {
+        return result("no_wallet", { success: false, message: "--private-key is required." });
+    }
+    try {
+        const evm = (0, wallet_setup_2.importWalletFromPrivateKey)(privateKey);
+        await (0, wallet_setup_2.validateWalletImportAgainstServer)({
+            origin,
+            accessToken: secrets.accessToken,
+            derivedAddress: evm.address,
+            force: input.force,
+        });
+        (0, wallet_setup_2.saveImportedWallet)(conn.id, evm);
+        (0, store_1.applyActiveConnectionToEnv)();
+        const phase = (0, phase_1.computeConnectionPhase)();
+        return result(phase, {
+            success: true,
+            message: `Imported Data Wallet (${evm.address}). Run neozip connect finish.`,
+        });
+    }
+    catch (err) {
+        return result("no_wallet", {
+            success: false,
+            message: err instanceof Error ? err.message : String(err),
+        });
+    }
+}
+async function connectFinish(input) {
+    if ((0, migrate_1.hasLegacyMcpProfiles)())
+        (0, migrate_1.migrateFromMcpProfileStore)();
+    const origin = (0, origin_1.resolveTokenServiceOrigin)(input?.tokenServiceUrl);
+    const conn = (0, store_1.ensureActiveConnection)({ tokenServiceUrl: origin });
+    const secrets = (0, store_1.readActiveConnectionSecrets)();
+    if (!secrets?.accessToken || !conn.emailVerified) {
+        return result("email_unverified", {
+            success: false,
+            message: "Email not verified. Run neozip connect to continue setup.",
+        });
+    }
+    const coordinator = await (0, coordinator_1.fetchCoordinatorConfigParsed)(origin);
+    (0, coordinator_1.assertCoordinatorWrapSupported)(coordinator);
+    if (await (0, phone_1.needsPhoneVerification)(conn, origin)) {
+        return result("phone_required", {
+            success: false,
+            message: "Phone verification required. Run neozip connect phone request --phone +14155551234, then phone verify.",
+        });
+    }
+    let meta = conn;
+    let sec = secrets;
+    if (!sec.evmPrivateKeyHex || !meta.evmAddress) {
+        if (!input?.createWallet) {
+            return result("no_wallet", {
+                success: false,
+                message: wallet_setup_2.WALLET_SETUP_HINT,
+            });
+        }
+        const evm = (0, wallet_evm_1.generateEvmIdentity)();
+        meta = (0, store_1.saveEvmWallet)(meta.id, evm.privateKey, evm.address);
+        sec = (0, store_1.readActiveConnectionSecrets)();
+    }
+    if (!meta.walletId || meta.linkId == null) {
+        const linked = await (0, wallet_setup_1.runWalletEnsureAndAttach)(origin, sec.accessToken, sec.evmPrivateKeyHex, meta.evmAddress);
+        meta = (0, store_1.saveWalletLink)(meta.id, linked.walletId, linked.linkId, linked.evmAddress);
+    }
+    if (!meta.identityKeyId) {
+        const provisioned = await (0, identity_provision_1.provisionWalletIdentityKey)({
+            baseUrl: origin,
+            accessToken: sec.accessToken,
+            walletId: meta.walletId,
+            evmPrivateKey: sec.evmPrivateKeyHex,
+            evmAddress: meta.evmAddress,
+        });
+        meta = (0, store_1.saveIdentityProvision)(meta.id, provisioned.identityKeyId, provisioned.x25519PublicKey);
+    }
+    (0, store_1.applyActiveConnectionToEnv)();
+    return result("ready", {
+        success: true,
+        message: `Connection ready. Profile stored under ${(0, store_1.getConnectionDir)()}. Reload MCP in Cursor.`,
+    });
+}
+async function connectSetup(input) {
+    if ((0, migrate_1.hasLegacyMcpProfiles)())
+        (0, migrate_1.migrateFromMcpProfileStore)();
+    const origin = (0, origin_1.resolveTokenServiceOrigin)(input.tokenServiceUrl);
+    (0, store_1.ensureActiveConnection)({
+        label: input.label,
+        tokenServiceUrl: origin,
+    });
+    const ver = await connectVerify({
+        email: input.email,
+        code: input.code,
+        tokenServiceUrl: input.tokenServiceUrl,
+    });
+    if (ver.phase === "phone_required")
+        return ver;
+    if (ver.phase === "ready")
+        return ver;
+    const phase = (0, phase_1.computeConnectionPhase)();
+    if (phase === "no_wallet" || phase === "wallet_unlinked" || phase === "identity_missing") {
+        return result(phase, {
+            success: true,
+            message: `Email verified (phase: ${phase}). ${wallet_setup_2.WALLET_SETUP_HINT}`,
+        });
+    }
+    return connectFinish({ tokenServiceUrl: input.tokenServiceUrl });
+}
+function connectLogout() {
+    const out = (0, store_1.logoutConnection)();
+    return result((0, phase_1.computeConnectionPhase)(), {
+        success: true,
+        message: `Logged out connection "${out.label}". Run neozip connect to set up again.`,
+    });
+}
+function connectDelete(input) {
+    const id = input?.connectionId?.trim() || (0, store_1.getActiveConnection)()?.id;
+    if (!id) {
+        return result("no_profile", {
+            success: false,
+            message: "No connection to delete.",
+        });
+    }
+    const out = (0, store_1.deleteConnection)(id);
+    return result((0, phase_1.computeConnectionPhase)(), {
+        success: true,
+        connectionId: out.newActiveConnectionId,
+        message: out.newActiveConnectionId != null
+            ? `Deleted connection "${out.label}". Active connection updated.`
+            : `Deleted connection "${out.label}". No accounts remain.`,
+    });
+}
+function connectMigrate() {
+    const mcp = (0, migrate_1.migrateFromMcpProfileStore)();
+    const wallet = (0, migrate_1.migrateFromWalletJson)();
+    const messages = [];
+    if (mcp.migrated > 0) {
+        messages.push(`Migrated ${mcp.migrated} legacy MCP profile(s) to ${mcp.connectionDir}.`);
+    }
+    messages.push(...wallet.messages);
+    if (messages.length === 0) {
+        messages.push("Nothing to migrate (connection store populated, no legacy profiles, no wallet.json).");
+    }
+    return {
+        success: mcp.migrated > 0 || wallet.migratedPrefs || wallet.importedKey,
+        phase: (0, phase_1.computeConnectionPhase)(),
+        connectionId: (0, store_1.getActiveConnectionId)(),
+        tokenServiceOrigin: (0, origin_1.resolveTokenServiceOrigin)(),
+        message: messages.join(" "),
+        nextCommand: (0, phase_1.nextConnectCommand)((0, phase_1.computeConnectionPhase)(), {
+            email: (0, store_1.getActiveConnection)()?.email,
+            phoneE164: (0, store_1.getActiveConnection)()?.phoneE164,
+        }),
+    };
+}
+//# sourceMappingURL=onboarding.js.map

package/dist/src/connection/origin.js

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KNOWN_TOKEN_SERVICE_PRESETS = exports.NEOZIP_TOKEN_SERVICE_PRODUCTION_URL = exports.NEOZIP_TOKEN_SERVICE_LOCALHOST = exports.NEOZIP_TOKEN_SERVICE_DEFAULT_URL = void 0;
+exports.defaultTokenServiceMenuChoice = defaultTokenServiceMenuChoice;
+exports.connectionLabelForOrigin = connectionLabelForOrigin;
+exports.normalizeTokenServiceOrigin = normalizeTokenServiceOrigin;
+exports.sameTokenServiceOrigin = sameTokenServiceOrigin;
+exports.resolveTokenServiceOrigin = resolveTokenServiceOrigin;
+/** Default token service when none is configured. */
+exports.NEOZIP_TOKEN_SERVICE_DEFAULT_URL = "https://testnet.token-service.neozip.io";
+/** Local token service URL for development. */
+exports.NEOZIP_TOKEN_SERVICE_LOCALHOST = "http://localhost:14789";
+/** Production token service URL. */
+exports.NEOZIP_TOKEN_SERVICE_PRODUCTION_URL = "https://token-service.neozip.io";
+/** Interactive menu order for Token Service deployment picker. */
+exports.KNOWN_TOKEN_SERVICE_PRESETS = [
+    {
+        name: "NeoZip Testnet",
+        url: exports.NEOZIP_TOKEN_SERVICE_DEFAULT_URL,
+        description: "NeoZip Token Service (testnet)",
+    },
+    {
+        name: "NeoZip Production",
+        url: exports.NEOZIP_TOKEN_SERVICE_PRODUCTION_URL,
+        description: "NeoZip Token Service (production)",
+    },
+    {
+        name: "Local Development",
+        url: exports.NEOZIP_TOKEN_SERVICE_LOCALHOST,
+        description: "Local NeoZip Token Service",
+    },
+];
+function defaultTokenServiceMenuChoice(serverUrl) {
+    const raw = serverUrl?.trim();
+    if (!raw)
+        return "1";
+    const normalized = normalizeTokenServiceOrigin(raw);
+    const presetIdx = exports.KNOWN_TOKEN_SERVICE_PRESETS.findIndex((p) => sameTokenServiceOrigin(p.url, normalized));
+    if (presetIdx >= 0)
+        return String(presetIdx + 1);
+    return "4";
+}
+function connectionLabelForOrigin(origin) {
+    const normalized = normalizeTokenServiceOrigin(origin);
+    const preset = exports.KNOWN_TOKEN_SERVICE_PRESETS.find((p) => sameTokenServiceOrigin(p.url, normalized));
+    return preset?.name ?? normalized;
+}
+function normalizeTokenServiceOrigin(url) {
+    const trimmed = (url || "").trim();
+    if (!trimmed)
+        return "";
+    const noSlash = trimmed.replace(/\/+$/, "");
+    try {
+        const u = new URL(noSlash);
+        const host = u.hostname.toLowerCase();
+        return `${u.protocol}//${host}${u.port ? `:${u.port}` : ""}${u.pathname.replace(/\/+$/, "") || ""}`;
+    }
+    catch {
+        return noSlash;
+    }
+}
+function sameTokenServiceOrigin(a, b) {
+    return normalizeTokenServiceOrigin(a) === normalizeTokenServiceOrigin(b);
+}
+function resolveTokenServiceOrigin(serverUrl) {
+    const raw = serverUrl?.trim() || exports.NEOZIP_TOKEN_SERVICE_DEFAULT_URL;
+    return normalizeTokenServiceOrigin(raw);
+}
+//# sourceMappingURL=origin.js.map