nervepay 1.2.1 → 1.2.8

package/bin/nervepay-cli.js

@@ -288,190 +288,452 @@ program
 
 program
   .command('pair')
-  .description('Quick pair gateway using a dashboard pairing code')
-  .requiredOption('--code <code>', '6-character pairing code from NervePay dashboard')
+  .description('Pair gateway via device node protocol (default) or pairing code (--code)')
+  .option('--code <code>', '6-character pairing code (legacy flow)')
   .option('--api-url <url>', 'NervePay API URL', 'https://api.nervepay.xyz')
   .option('--gateway-url <url>', 'Gateway URL (e.g. ws://127.0.0.1:18789)')
-  .option('--gateway-token <token>', 'Gateway authentication token')
-  .option('--name <name>', 'Agent name', 'OpenClaw Gateway')
+  .option('--gateway-token <token>', 'Gateway authentication token (only for --code flow)')
+  .option('--name <name>', 'Gateway display name', 'OpenClaw Gateway')
+  .option('--timeout <seconds>', 'Approval wait timeout in seconds', '300')
   .action(async (options) => {
-    console.log(chalk.cyan('\n🔗 NervePay Quick Pair\n'));
-    console.log(chalk.gray('  Code:'), chalk.white(options.code));
+    if (options.code) {
+      await legacyCodePairing(options);
+    } else {
+      await deviceNodePairing(options);
+    }
+  });
+
+/**
+ * Device node pairing — connects to gateway via WebSocket, signs challenge
+ * with the agent's DID Ed25519 key, and receives a scoped device token.
+ */
+async function deviceNodePairing(options) {
+  const { signRawBytes, deriveDeviceId, getPublicKeyFromPrivate } = await import('../dist/utils/crypto.js');
 
+  console.log(chalk.cyan('\n🔗 NervePay Device Node Pairing\n'));
+
+  try {
+    // 1. Load agent credentials (must exist — run setup first)
+    let config;
     try {
-      // Step 1: Load existing credentials or create new identity
-      let agentDid, privateKey, mnemonic, claimUrl, sessionId, isNew = false;
+      config = await loadConfig();
+    } catch {
+      console.error(chalk.red('❌ No agent credentials found.'));
+      console.error(chalk.yellow('   Run:'), chalk.cyan('nervepay setup'), chalk.yellow('first'));
+      process.exit(1);
+    }
 
-      try {
-        const config = await loadConfig();
-        agentDid = config.agentDid;
-        privateKey = config.privateKey;
-        console.log(chalk.green('✓ Using existing agent identity'));
-        console.log(chalk.gray('  DID:'), agentDid);
-      } catch {
-        // No existing config — create a new pending identity
-        console.log(chalk.cyan('  No existing identity found, creating one...\n'));
-        const tempClient = new NervePayClient({ apiUrl: options.apiUrl });
-        const reg = await identity.registerPendingIdentity(tempClient, {
-          name: options.name,
-          description: 'Gateway operator',
-        });
-        agentDid = reg.did;
-        privateKey = reg.private_key;
-        mnemonic = reg.mnemonic;
-        claimUrl = reg.claim_url;
-        sessionId = reg.session_id;
-        isNew = true;
-        console.log(chalk.green('  ✓ Agent identity created'));
-        console.log(chalk.gray('  DID:'), agentDid);
-
-        // Show claim URL and offer to open browser
-        if (claimUrl) {
-          console.log(chalk.cyan('\n  👤 Claim this agent to link it to your NervePay account:'));
-          console.log(chalk.yellow(`     ${claimUrl}`));
-          console.log(chalk.gray('     (This links the agent to your dashboard for management)\n'));
+    const { agentDid, privateKey, apiUrl } = config;
+    console.log(chalk.green('✓ Agent identity loaded'));
+    console.log(chalk.gray('  DID:'), agentDid);
 
-          try {
-            const open = await import('open');
-            await open.default(claimUrl);
-            console.log(chalk.gray('     Opened in browser.'));
-          } catch {
-            console.log(chalk.gray('     Open the URL above in your browser.'));
+    // 2. Find gateway URL from config or --gateway-url flag
+    let gatewayUrl = options.gatewayUrl;
+    if (!gatewayUrl) {
+      const openclawConfig = await readOpenClawConfig();
+      const gw = extractGatewayConfig(openclawConfig);
+      gatewayUrl = gw.url;
+    }
+
+    if (!gatewayUrl) {
+      console.error(chalk.red('\n❌ Could not find gateway URL'));
+      console.error(chalk.yellow('   Provide it via one of:'));
+      console.error(chalk.gray('     --gateway-url <url>  (e.g. ws://127.0.0.1:18789)'));
+      console.error(chalk.gray('     ~/.openclaw/openclaw.json'));
+      process.exit(1);
+    }
+
+    // Normalize to ws:// URL
+    let wsUrl = gatewayUrl.replace(/\/$/, '');
+    if (wsUrl.startsWith('https://')) wsUrl = 'wss://' + wsUrl.slice('https://'.length);
+    else if (wsUrl.startsWith('http://')) wsUrl = 'ws://' + wsUrl.slice('http://'.length);
+    else if (!wsUrl.startsWith('ws://') && !wsUrl.startsWith('wss://')) wsUrl = 'ws://' + wsUrl;
+
+    console.log(chalk.gray('  Gateway:'), wsUrl);
+
+    // 3. Derive device ID from agent's public key
+    const publicKeyBase58 = await getPublicKeyFromPrivate(privateKey);
+    const deviceId = deriveDeviceId(publicKeyBase58);
+    console.log(chalk.gray('  Device ID:'), deviceId.slice(0, 16) + '...');
+
+    // 4. Connect to gateway via WebSocket
+    console.log(chalk.cyan('\n📡 Connecting to gateway...'));
+    const WebSocket = (await import('ws')).default;
+
+    const ws = new WebSocket(wsUrl, { rejectUnauthorized: false });
+    const timeoutMs = parseInt(options.timeout, 10) * 1000;
+
+    // Pre-compute crypto values before entering the WebSocket flow
+    // (avoids async gaps in the message handler that cause race conditions)
+    const { decodeBase58 } = await import('../dist/utils/crypto.js');
+    const pubKeyBytes = decodeBase58(publicKeyBase58);
+    const pubKeyB64 = Buffer.from(pubKeyBytes).toString('base64');
+
+    const result = await new Promise((resolve, reject) => {
+      let settled = false;
+      let connectId = null;
+      let pairId = null;
+      let requestId = null;
+      let lastError = null;
+
+      function settle(fn, value) {
+        if (settled) return;
+        settled = true;
+        clearTimeout(timer);
+        fn(value);
+      }
+
+      const timer = setTimeout(() => {
+        ws.close();
+        settle(reject, new Error(`Pairing approval timed out (waited ${options.timeout}s)`));
+      }, timeoutMs + 15000);
+
+      ws.on('error', (err) => {
+        settle(reject, new Error(`WebSocket error: ${err.message}`));
+      });
+
+      ws.on('close', (code, reason) => {
+        // Delay slightly to let any pending message handler finish
+        setTimeout(() => {
+          const reasonStr = reason?.toString() || '';
+          const detail = lastError
+            ? lastError
+            : reasonStr
+              ? `code=${code} reason=${reasonStr}`
+              : `code=${code}`;
+          settle(reject, new Error(`Gateway closed connection (${detail})`));
+        }, 100);
+      });
+
+      ws.on('message', async (data) => {
+        try {
+          const raw = data.toString();
+          const frame = JSON.parse(raw);
+
+          // Step 5: Receive connect.challenge → sign nonce
+          if (frame.event === 'connect.challenge') {
+            const nonce = frame.payload?.nonce || '';
+            console.log(chalk.green('✓ Challenge received'));
+
+            const nonceBytes = new TextEncoder().encode(nonce);
+            const signatureB64 = await signRawBytes(privateKey, nonceBytes);
+            const signedAt = Date.now();
+
+            // Step 6: Send connect request as operator with device identity
+            connectId = crypto.randomUUID();
+            const connectReq = {
+              type: 'request',
+              id: connectId,
+              method: 'connect',
+              params: {
+                role: 'operator',
+                scopes: ['operator.read', 'operator.write'],
+                client: {
+                  id: `nervepay-cli-${crypto.randomUUID().slice(0, 8)}`,
+                  version: '1.2.6',
+                  platform: 'cli',
+                  mode: 'pairing',
+                },
+                device: {
+                  id: deviceId,
+                  publicKey: pubKeyB64,
+                  signature: signatureB64,
+                  signedAt,
+                  nonce,
+                },
+              },
+            };
+            ws.send(JSON.stringify(connectReq));
+            return;
+          }
+
+          // Connect response
+          if (frame.type === 'response' && frame.id === connectId) {
+            if (frame.ok) {
+              console.log(chalk.green('✓ Connected to gateway'));
+
+              // Step 7: Send node.pair.request
+              pairId = crypto.randomUUID();
+              const pairReq = {
+                type: 'request',
+                id: pairId,
+                method: 'node.pair.request',
+                params: {
+                  displayName: `NervePay (${agentDid.split(':').pop().slice(0, 8)})`,
+                  platform: 'cli',
+                },
+              };
+              ws.send(JSON.stringify(pairReq));
+            } else {
+              lastError = `Connect rejected: ${frame.error || 'Unknown error'}`;
+              console.error(chalk.red(`  ${lastError}`));
+              ws.close();
+              settle(reject, new Error(lastError));
+            }
+            return;
           }
 
-          // Poll for claim (30 seconds — quick pair shouldn't block too long)
-          console.log(chalk.cyan('  ⏳ Waiting for claim (30s timeout)...\n'));
-          let claimed = false;
-          for (let i = 0; i < 6; i++) {
-            await new Promise((r) => setTimeout(r, 5000));
-            try {
-              const status = await fetch(`${options.apiUrl}/v1/agent-identity/register-pending/${sessionId}/status`);
-              const data = await status.json();
-              if (data.status === 'claimed') {
-                claimed = true;
-                console.log(chalk.green('  ✓ Agent claimed successfully!\n'));
-                break;
-              } else if (data.status === 'expired') {
-                break;
-              }
-              process.stdout.write(chalk.gray('.'));
-            } catch {
-              process.stdout.write(chalk.gray('.'));
+          // Pair request response → extract requestId
+          if (frame.type === 'response' && frame.id === pairId) {
+            if (frame.ok) {
+              requestId = frame.payload?.requestId || '';
+              console.log(chalk.green('✓ Pairing request submitted'));
+              console.log(chalk.cyan('\n⏳ Waiting for gateway owner approval...'));
+              console.log(chalk.gray(`   Approve with: openclaw devices approve ${requestId}`));
+              console.log(chalk.gray(`   Timeout: ${options.timeout}s\n`));
+            } else {
+              lastError = `Pair request rejected: ${frame.error || 'Unknown error'}`;
+              console.error(chalk.red(`  ${lastError}`));
+              ws.close();
+              settle(reject, new Error(lastError));
             }
+            return;
           }
 
-          if (!claimed) {
-            console.log(chalk.yellow('\n  ⚠️  Not claimed yet — continuing with pairing.'));
-            console.log(chalk.gray('     You can claim later at:'), chalk.yellow(claimUrl));
+          // Step 8: node.pair.resolved event
+          if (frame.event === 'node.pair.resolved') {
+            const rid = frame.payload?.requestId;
+            if (rid && rid !== requestId) return;
+
+            const decision = frame.payload?.decision;
+            if (decision === 'approved') {
+              const token = frame.payload?.token || '';
+              const nodeId = frame.payload?.nodeId || '';
+              ws.close();
+              settle(resolve, { token, nodeId, requestId });
+            } else if (decision === 'rejected') {
+              ws.close();
+              settle(reject, new Error('Pairing request was rejected by the gateway owner'));
+            } else {
+              ws.close();
+              settle(reject, new Error(`Unexpected pairing decision: ${decision}`));
+            }
+            return;
           }
-        }
 
-        // Show mnemonic
-        if (mnemonic) {
-          console.log(chalk.cyan('\n  🔐 Recovery mnemonic:'));
-          console.log(chalk.yellow(`     ${mnemonic}`));
-          console.log(chalk.red('     ⚠️  Save this — you can recover your keys with it!\n'));
+          // Log unhandled frames for debugging
+          if (frame.type === 'response' || frame.error) {
+            console.log(chalk.gray('  [debug] Unhandled frame:'), JSON.stringify(frame).slice(0, 200));
+          }
+        } catch (err) {
+          // Ignore parse errors for non-JSON messages (ping, etc)
         }
+      });
+    });
+
+    // 9. Send device token to NervePay API
+    console.log(chalk.green('\n✓ Pairing approved! Saving to NervePay...'));
+
+    const client = new NervePayClient({
+      apiUrl: options.apiUrl || apiUrl,
+      agentDid,
+      privateKey,
+    });
+
+    const apiResult = await gateway.completeDevicePairing(client, {
+      device_token: result.token,
+      device_id: deviceId,
+      gateway_url: gatewayUrl,
+      gateway_name: options.name,
+    });
+
+    console.log(chalk.green('\n✅ Device pairing complete!'));
+    console.log(chalk.gray('  Gateway ID:'), apiResult.gateway_id || 'created');
+    console.log(chalk.gray('  Device ID: '), deviceId.slice(0, 16) + '...');
+    console.log(chalk.gray('  Agent DID: '), agentDid);
+    console.log(chalk.gray('\n  Your gateway is now live in the NervePay dashboard.'));
+    console.log(chalk.gray('  Go to Mission Control to spawn agents and manage tasks.\n'));
+  } catch (error) {
+    console.error(chalk.red('\n❌ Device pairing failed:'), error.message);
+    process.exit(1);
+  }
+}
+
+/**
+ * Legacy code-based pairing flow (--code flag provided).
+ */
+async function legacyCodePairing(options) {
+  console.log(chalk.cyan('\n🔗 NervePay Code Pairing\n'));
+  console.log(chalk.gray('  Code:'), chalk.white(options.code));
+
+  try {
+    // Step 1: Load existing credentials or create new identity
+    let agentDid, privateKey, mnemonic, claimUrl, sessionId, isNew = false;
+
+    try {
+      const config = await loadConfig();
+      agentDid = config.agentDid;
+      privateKey = config.privateKey;
+      console.log(chalk.green('✓ Using existing agent identity'));
+      console.log(chalk.gray('  DID:'), agentDid);
+    } catch {
+      // No existing config — create a new pending identity
+      console.log(chalk.cyan('  No existing identity found, creating one...\n'));
+      const tempClient = new NervePayClient({ apiUrl: options.apiUrl });
+      const reg = await identity.registerPendingIdentity(tempClient, {
+        name: options.name,
+        description: 'Gateway operator',
+      });
+      agentDid = reg.did;
+      privateKey = reg.private_key;
+      mnemonic = reg.mnemonic;
+      claimUrl = reg.claim_url;
+      sessionId = reg.session_id;
+      isNew = true;
+      console.log(chalk.green('  ✓ Agent identity created'));
+      console.log(chalk.gray('  DID:'), agentDid);
+
+      // Show claim URL and offer to open browser
+      if (claimUrl) {
+        console.log(chalk.cyan('\n  👤 Claim this agent to link it to your NervePay account:'));
+        console.log(chalk.yellow(`     ${claimUrl}`));
+        console.log(chalk.gray('     (This links the agent to your dashboard for management)\n'));
 
-        // Save credentials immediately so they persist even if pairing fails
         try {
-          const { mkdir } = await import('fs/promises');
-          await mkdir(join(homedir(), '.nervepay'), { recursive: true });
-          await writeFile(
-            NERVEPAY_CREDS_PATH,
-            JSON.stringify({
-              agent_did: agentDid,
-              private_key: privateKey,
-              mnemonic: mnemonic || undefined,
-              api_url: options.apiUrl,
-              created_at: new Date().toISOString(),
-            }, null, 2)
-          );
-          console.log(chalk.green('  ✓ Credentials saved to ~/.nervepay/credentials.json'));
-
-          // Update OpenClaw config if it exists
+          const open = await import('open');
+          await open.default(claimUrl);
+          console.log(chalk.gray('     Opened in browser.'));
+        } catch {
+          console.log(chalk.gray('     Open the URL above in your browser.'));
+        }
+
+        // Poll for claim (30 seconds — quick pair shouldn't block too long)
+        console.log(chalk.cyan('  ⏳ Waiting for claim (30s timeout)...\n'));
+        let claimed = false;
+        for (let i = 0; i < 6; i++) {
+          await new Promise((r) => setTimeout(r, 5000));
           try {
-            const ocConfigPath = await findOpenClawConfigPath();
-            if (ocConfigPath) {
-              const existingConfig = JSON.parse(await readFile(ocConfigPath, 'utf-8'));
-              if (!existingConfig.plugins) existingConfig.plugins = {};
-              if (!existingConfig.plugins.entries) existingConfig.plugins.entries = {};
-              if (!existingConfig.plugins.entries.nervepay) {
-                existingConfig.plugins.entries.nervepay = { enabled: true, config: {} };
-              }
-              existingConfig.plugins.entries.nervepay.config = {
-                ...existingConfig.plugins.entries.nervepay.config,
-                apiUrl: options.apiUrl,
-                agentDid,
-                privateKey,
-              };
-              await writeFile(ocConfigPath, JSON.stringify(existingConfig, null, 2));
-              console.log(chalk.green('  ✓ OpenClaw config updated'));
+            const status = await fetch(`${options.apiUrl}/v1/agent-identity/register-pending/${sessionId}/status`);
+            const data = await status.json();
+            if (data.status === 'claimed') {
+              claimed = true;
+              console.log(chalk.green('  ✓ Agent claimed successfully!\n'));
+              break;
+            } else if (data.status === 'expired') {
+              break;
             }
+            process.stdout.write(chalk.gray('.'));
           } catch {
-            // Non-fatal
+            process.stdout.write(chalk.gray('.'));
           }
-        } catch (e) {
-          console.log(chalk.yellow('  ⚠️  Could not save credentials:'), e.message);
         }
-      }
 
-      // Step 2: Read gateway config (from flags, env, or config files)
-      console.log(chalk.cyan('📡 Reading gateway config...'));
-
-      let gatewayUrl = options.gatewayUrl;
-      let gatewayToken = options.gatewayToken;
-
-      // Try OpenClaw config if flags not provided
-      if (!gatewayUrl || !gatewayToken) {
-        const openclawConfig = await readOpenClawConfig();
-        const gw = extractGatewayConfig(openclawConfig);
-        gatewayUrl = gatewayUrl || gw.url;
-        gatewayToken = gatewayToken || gw.token;
+        if (!claimed) {
+          console.log(chalk.yellow('\n  ⚠️  Not claimed yet — continuing with pairing.'));
+          console.log(chalk.gray('     You can claim later at:'), chalk.yellow(claimUrl));
+        }
       }
 
-      // Default URL if we have a token but no URL
-      if (gatewayToken && !gatewayUrl) {
-        gatewayUrl = 'http://127.0.0.1:18789';
+      // Show mnemonic
+      if (mnemonic) {
+        console.log(chalk.cyan('\n  🔐 Recovery mnemonic:'));
+        console.log(chalk.yellow(`     ${mnemonic}`));
+        console.log(chalk.red('     ⚠️  Save this — you can recover your keys with it!\n'));
       }
 
-      if (!gatewayToken) {
-        console.error(chalk.red('\n❌ Could not find gateway token'));
-        console.error(chalk.yellow('   Provide it via one of:'));
-        console.error(chalk.gray('     --gateway-token <token>'));
-        console.error(chalk.gray('     ~/.openclaw/openclaw.json (gateway.auth.token)'));
-        console.error(chalk.gray('     OPENCLAW_GATEWAY_TOKEN env var'));
-        process.exit(1);
+      // Save credentials immediately so they persist even if pairing fails
+      try {
+        const { mkdir } = await import('fs/promises');
+        await mkdir(join(homedir(), '.nervepay'), { recursive: true });
+        await writeFile(
+          NERVEPAY_CREDS_PATH,
+          JSON.stringify({
+            agent_did: agentDid,
+            private_key: privateKey,
+            mnemonic: mnemonic || undefined,
+            api_url: options.apiUrl,
+            created_at: new Date().toISOString(),
+          }, null, 2)
+        );
+        console.log(chalk.green('  ✓ Credentials saved to ~/.nervepay/credentials.json'));
+
+        // Update OpenClaw config if it exists
+        try {
+          const ocConfigPath = await findOpenClawConfigPath();
+          if (ocConfigPath) {
+            const existingConfig = JSON.parse(await readFile(ocConfigPath, 'utf-8'));
+            if (!existingConfig.plugins) existingConfig.plugins = {};
+            if (!existingConfig.plugins.entries) existingConfig.plugins.entries = {};
+            if (!existingConfig.plugins.entries.nervepay) {
+              existingConfig.plugins.entries.nervepay = { enabled: true, config: {} };
+            }
+            existingConfig.plugins.entries.nervepay.config = {
+              ...existingConfig.plugins.entries.nervepay.config,
+              apiUrl: options.apiUrl,
+              agentDid,
+              privateKey,
+            };
+            await writeFile(ocConfigPath, JSON.stringify(existingConfig, null, 2));
+            console.log(chalk.green('  ✓ OpenClaw config updated'));
+          }
+        } catch {
+          // Non-fatal
+        }
+      } catch (e) {
+        console.log(chalk.yellow('  ⚠️  Could not save credentials:'), e.message);
       }
+    }
 
-      console.log(chalk.green('✓ Gateway found'));
-      console.log(chalk.gray('  URL:'), gatewayUrl);
+    // Step 2: Read gateway config (from flags, env, or config files)
+    console.log(chalk.cyan('📡 Reading gateway config...'));
 
-      // Step 3: Complete pairing
-      console.log(chalk.cyan('\n🔐 Completing pairing...'));
-      const client = new NervePayClient({
-        apiUrl: options.apiUrl,
-        agentDid,
-        privateKey,
-      });
+    let gatewayUrl = options.gatewayUrl;
+    let gatewayToken = options.gatewayToken;
 
-      const result = await gateway.completePairing(client, {
-        pairing_code: options.code,
-        gateway_url: gatewayUrl,
-        gateway_token: gatewayToken,
-        gateway_name: options.name,
-      });
+    // Try OpenClaw config if flags not provided
+    if (!gatewayUrl || !gatewayToken) {
+      const openclawConfig = await readOpenClawConfig();
+      const gw = extractGatewayConfig(openclawConfig);
+      gatewayUrl = gatewayUrl || gw.url;
+      gatewayToken = gatewayToken || gw.token;
+    }
 
-      console.log(chalk.green('\n✅ Pairing complete!'));
-      console.log(chalk.gray('  Gateway ID:'), result.gateway_id || 'created');
-      console.log(chalk.gray('  Agent DID: '), agentDid);
-      console.log(chalk.gray('\n  Your gateway is now live in the NervePay dashboard.'));
-      console.log(chalk.gray('  Go to Mission Control to spawn agents and manage tasks.\n'));
-    } catch (error) {
-      console.error(chalk.red('\n❌ Pairing failed:'), error.message);
+    if (!gatewayToken) {
+      console.error(chalk.red('\n❌ Could not find gateway token'));
+      console.error(chalk.yellow('   Provide it via one of:'));
+      console.error(chalk.gray('     --gateway-token <token>'));
+      console.error(chalk.gray('     ~/.openclaw/openclaw.json (gateway.auth.token)'));
+      console.error(chalk.gray('     OPENCLAW_GATEWAY_TOKEN env var'));
       process.exit(1);
     }
-  });
+
+    if (!gatewayUrl) {
+      console.error(chalk.red('\n❌ Could not find gateway URL'));
+      console.error(chalk.yellow('   Provide it via one of:'));
+      console.error(chalk.gray('     --gateway-url <url>  (e.g. ws://your-server:18789)'));
+      console.error(chalk.gray('     ~/.openclaw/openclaw.json'));
+      console.error(chalk.gray('     OPENCLAW_GATEWAY_URL env var'));
+      process.exit(1);
+    }
+
+    console.log(chalk.green('✓ Gateway found'));
+    console.log(chalk.gray('  URL:'), gatewayUrl);
+
+    // Step 3: Complete pairing
+    console.log(chalk.cyan('\n🔐 Completing pairing...'));
+    const client = new NervePayClient({
+      apiUrl: options.apiUrl,
+      agentDid,
+      privateKey,
+    });
+
+    const result = await gateway.completePairing(client, {
+      pairing_code: options.code,
+      gateway_url: gatewayUrl,
+      gateway_token: gatewayToken,
+      gateway_name: options.name,
+    });
+
+    console.log(chalk.green('\n✅ Pairing complete!'));
+    console.log(chalk.gray('  Gateway ID:'), result.gateway_id || 'created');
+    console.log(chalk.gray('  Agent DID: '), agentDid);
+    console.log(chalk.gray('\n  Your gateway is now live in the NervePay dashboard.'));
+    console.log(chalk.gray('  Go to Mission Control to spawn agents and manage tasks.\n'));
+  } catch (error) {
+    console.error(chalk.red('\n❌ Pairing failed:'), error.message);
+    process.exit(1);
+  }
+}
 
 // ============================================================================
 // WHOAMI COMMAND

package/dist/tools/gateway.d.ts

@@ -29,6 +29,12 @@ export interface CompletePairingParams {
     gateway_token: string;
     gateway_name: string;
 }
+export interface DevicePairingCompleteParams {
+    device_token: string;
+    device_id: string;
+    gateway_url: string;
+    gateway_name?: string;
+}
 export interface Gateway {
     id: string;
     name: string;
@@ -56,6 +62,13 @@ export declare function completePairing(client: NervePayClient, params: Complete
     gateway_id: string;
     status: string;
 }>;
+/**
+ * Complete device node pairing — sends the scoped device token to NervePay API
+ */
+export declare function completeDevicePairing(client: NervePayClient, params: DevicePairingCompleteParams): Promise<{
+    gateway_id: string;
+    status: string;
+}>;
 /**
  * List all gateways
  */

package/dist/tools/gateway.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gateway.d.ts","sourceRoot":"","sources":["../../src/tools/gateway.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEzD,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,SAAS,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC;IACxD,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,QAAQ,GAAG,UAAU,GAAG,OAAO,CAAC;IACxC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,uBAAuB,EAAE,MAAM,CAAC;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAAC,oBAAoB,CAAC,CAM/B;AAED;;GAEG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,cAAc,EACtB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,oBAAoB,CAAC,CAK/B;AAED;;GAEG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,qBAAqB,GAC5B,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAMjD;AAED;;GAEG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC;IAAE,QAAQ,EAAE,OAAO,EAAE,CAAA;CAAE,CAAC,CAElC;AAED;;GAEG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,cAAc,EACtB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC,CAElB;AAED;;GAEG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,cAAc,EACtB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,qBAAqB,EAAE,MAAM,CAAC;IAC9B,uBAAuB,EAAE,MAAM,CAAC;CACjC,CAAC,GACD,OAAO,CAAC,OAAO,CAAC,CAElB;AAED;;GAEG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,cAAc,EACtB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAE/B;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,cAAc,EACtB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC;IACT,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC,CAMD;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAyDnE"}
+{"version":3,"file":"gateway.d.ts","sourceRoot":"","sources":["../../src/tools/gateway.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEzD,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,SAAS,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC;IACxD,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,2BAA2B;IAC1C,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,QAAQ,GAAG,UAAU,GAAG,OAAO,CAAC;IACxC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,uBAAuB,EAAE,MAAM,CAAC;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAAC,oBAAoB,CAAC,CAM/B;AAED;;GAEG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,cAAc,EACtB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,oBAAoB,CAAC,CAK/B;AAED;;GAEG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,qBAAqB,GAC5B,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAMjD;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,2BAA2B,GAClC,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAMjD;AAED;;GAEG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC;IAAE,QAAQ,EAAE,OAAO,EAAE,CAAA;CAAE,CAAC,CAElC;AAED;;GAEG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,cAAc,EACtB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC,CAElB;AAED;;GAEG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,cAAc,EACtB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,qBAAqB,EAAE,MAAM,CAAC;IAC9B,uBAAuB,EAAE,MAAM,CAAC;CACjC,CAAC,GACD,OAAO,CAAC,OAAO,CAAC,CAElB;AAED;;GAEG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,cAAc,EACtB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAE/B;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,cAAc,EACtB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC;IACT,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC,CAMD;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAyDnE"}

package/dist/tools/gateway.js

@@ -23,6 +23,12 @@ export async function getPairingRequestStatus(client, requestId) {
 export async function completePairing(client, params) {
     return client.post('/v1/integrations/openclaw/pairing/complete', params, true);
 }
+/**
+ * Complete device node pairing — sends the scoped device token to NervePay API
+ */
+export async function completeDevicePairing(client, params) {
+    return client.post('/v1/integrations/openclaw/device-pairing/complete', params, true);
+}
 /**
  * List all gateways
  */

package/dist/tools/gateway.js.map

@@ -1 +1 @@
-{"version":3,"file":"gateway.js","sourceRoot":"","sources":["../../src/tools/gateway.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AA8C7B;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAsB,EACtB,MAA4B;IAE5B,OAAO,MAAM,CAAC,IAAI,CAChB,4CAA4C,EAC5C,MAAM,EACN,IAAI,CACL,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAsB,EACtB,SAAiB;IAEjB,OAAO,MAAM,CAAC,GAAG,CACf,8CAA8C,SAAS,EAAE,EACzD,KAAK,CACN,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAsB,EACtB,MAA6B;IAE7B,OAAO,MAAM,CAAC,IAAI,CAChB,4CAA4C,EAC5C,MAAM,EACN,IAAI,CACL,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAsB;IAEtB,OAAO,MAAM,CAAC,GAAG,CAAC,4BAA4B,EAAE,IAAI,CAAC,CAAC;AACxD,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAAsB,EACtB,SAAiB;IAEjB,OAAO,MAAM,CAAC,GAAG,CAAC,8BAA8B,SAAS,EAAE,EAAE,IAAI,CAAC,CAAC;AACrE,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAsB,EACtB,SAAiB,EACjB,OAKE;IAEF,OAAO,MAAM,CAAC,GAAG,CAAC,8BAA8B,SAAS,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AAC9E,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAsB,EACtB,SAAiB;IAEjB,OAAO,MAAM,CAAC,MAAM,CAAC,8BAA8B,SAAS,EAAE,EAAE,IAAI,CAAC,CAAC;AACxE,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAsB,EACtB,SAAiB;IAMjB,OAAO,MAAM,CAAC,IAAI,CAChB,8BAA8B,SAAS,SAAS,EAChD,EAAE,EACF,IAAI,CACL,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAmB;IAClD,IAAI,CAAC;QACH,SAAS,YAAY,CAAC,IAAS;YAC7B,oBAAoB;YACpB,IAAI,IAAI,EAAE,OAAO,EAAE,IAAI,KAAK,QAAQ,IAAI,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;gBACrE,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;YACnC,CAAC;YACD,wCAAwC;YACxC,IAAI,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;gBAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;YACjC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,0BAA0B;QAC1B,IAAI,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;YAC3D,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;QAC1B,CAAC;QAED,qCAAqC;QACrC,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,CAAC;YACrF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,CAAC;YACjF,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;QAC1B,CAAC;QAED,2BAA2B;QAC3B,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG;YACjB,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,eAAe,CAAC;YACxC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,eAAe,CAAC;YAClD,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,eAAe,CAAC,EAAI,wBAAwB;YACnE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,eAAe,CAAC,EAAI,2BAA2B;SACxE,CAAC;QAEF,KAAK,MAAM,UAAU,IAAI,UAAU,EAAE,CAAC;YACpC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;gBAAE,SAAS;YACtC,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;gBAC3D,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;gBACjC,IAAI,KAAK;oBAAE,OAAO,KAAK,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;QAED,6BAA6B;QAC7B,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,CAAC;YACvC,OAAO,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;QAC5C,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"gateway.js","sourceRoot":"","sources":["../../src/tools/gateway.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAqD7B;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAsB,EACtB,MAA4B;IAE5B,OAAO,MAAM,CAAC,IAAI,CAChB,4CAA4C,EAC5C,MAAM,EACN,IAAI,CACL,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAsB,EACtB,SAAiB;IAEjB,OAAO,MAAM,CAAC,GAAG,CACf,8CAA8C,SAAS,EAAE,EACzD,KAAK,CACN,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAsB,EACtB,MAA6B;IAE7B,OAAO,MAAM,CAAC,IAAI,CAChB,4CAA4C,EAC5C,MAAM,EACN,IAAI,CACL,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAsB,EACtB,MAAmC;IAEnC,OAAO,MAAM,CAAC,IAAI,CAChB,mDAAmD,EACnD,MAAM,EACN,IAAI,CACL,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAsB;IAEtB,OAAO,MAAM,CAAC,GAAG,CAAC,4BAA4B,EAAE,IAAI,CAAC,CAAC;AACxD,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAAsB,EACtB,SAAiB;IAEjB,OAAO,MAAM,CAAC,GAAG,CAAC,8BAA8B,SAAS,EAAE,EAAE,IAAI,CAAC,CAAC;AACrE,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAsB,EACtB,SAAiB,EACjB,OAKE;IAEF,OAAO,MAAM,CAAC,GAAG,CAAC,8BAA8B,SAAS,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AAC9E,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAsB,EACtB,SAAiB;IAEjB,OAAO,MAAM,CAAC,MAAM,CAAC,8BAA8B,SAAS,EAAE,EAAE,IAAI,CAAC,CAAC;AACxE,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAsB,EACtB,SAAiB;IAMjB,OAAO,MAAM,CAAC,IAAI,CAChB,8BAA8B,SAAS,SAAS,EAChD,EAAE,EACF,IAAI,CACL,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAmB;IAClD,IAAI,CAAC;QACH,SAAS,YAAY,CAAC,IAAS;YAC7B,oBAAoB;YACpB,IAAI,IAAI,EAAE,OAAO,EAAE,IAAI,KAAK,QAAQ,IAAI,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;gBACrE,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;YACnC,CAAC;YACD,wCAAwC;YACxC,IAAI,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;gBAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;YACjC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,0BAA0B;QAC1B,IAAI,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;YAC3D,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;QAC1B,CAAC;QAED,qCAAqC;QACrC,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,CAAC;YACrF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,CAAC;YACjF,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;QAC1B,CAAC;QAED,2BAA2B;QAC3B,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG;YACjB,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,eAAe,CAAC;YACxC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,eAAe,CAAC;YAClD,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,eAAe,CAAC,EAAI,wBAAwB;YACnE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,eAAe,CAAC,EAAI,2BAA2B;SACxE,CAAC;QAEF,KAAK,MAAM,UAAU,IAAI,UAAU,EAAE,CAAC;YACpC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;gBAAE,SAAS;YACtC,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;gBAC3D,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;gBACjC,IAAI,KAAK;oBAAE,OAAO,KAAK,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;QAED,6BAA6B;QAC7B,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,CAAC;YACvC,OAAO,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;QAC5C,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/utils/crypto.d.ts

@@ -21,6 +21,21 @@ export declare function verifySignature(publicKeyBase58: string, payload: Record
  * Generate SHA-256 hash of string
  */
 export declare function sha256Hash(data: string): string;
+/**
+ * Sign raw bytes with Ed25519 private key (for gateway challenge signing).
+ * Returns base64-encoded signature.
+ */
+export declare function signRawBytes(privateKeyBase58: string, data: Uint8Array): Promise<string>;
+/**
+ * Derive a deterministic device ID from a public key (SHA-256 hex fingerprint).
+ * Matches the Rust `derive_device_id()` implementation.
+ */
+export declare function deriveDeviceId(publicKeyBase58: string): string;
+/**
+ * Extract the Ed25519 public key from a private key seed.
+ * Returns base58-encoded public key.
+ */
+export declare function getPublicKeyFromPrivate(privateKeyBase58: string): Promise<string>;
 /**
  * Generate random UUID v4
  */

package/dist/utils/crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/utils/crypto.ts"],"names":[],"mappings":"AAAA;;GAEG;AAcH;;GAEG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CA6BpD;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAwBtD;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,gBAAgB,EAAE,MAAM,EACxB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC3B,OAAO,CAAC,MAAM,CAAC,CAkBjB;AAED;;GAEG;AACH,wBAAsB,eAAe,CACnC,eAAe,EAAE,MAAM,EACvB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC5B,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,OAAO,CAAC,CAWlB;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAG/C;AAED;;GAEG;AACH,wBAAgB,UAAU,IAAI,MAAM,CAEnC"}
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/utils/crypto.ts"],"names":[],"mappings":"AAAA;;GAEG;AAcH;;GAEG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CA6BpD;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAwBtD;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,gBAAgB,EAAE,MAAM,EACxB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC3B,OAAO,CAAC,MAAM,CAAC,CAkBjB;AAED;;GAEG;AACH,wBAAsB,eAAe,CACnC,eAAe,EAAE,MAAM,EACvB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC5B,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,OAAO,CAAC,CAWlB;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAG/C;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAChC,gBAAgB,EAAE,MAAM,EACxB,IAAI,EAAE,UAAU,GACf,OAAO,CAAC,MAAM,CAAC,CAMjB;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAG9D;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC,CAMjB;AAED;;GAEG;AACH,wBAAgB,UAAU,IAAI,MAAM,CAEnC"}

package/dist/utils/crypto.js

@@ -103,6 +103,36 @@ export function sha256Hash(data) {
     const bytes = new TextEncoder().encode(data);
     return bytesToHex(sha256(bytes));
 }
+/**
+ * Sign raw bytes with Ed25519 private key (for gateway challenge signing).
+ * Returns base64-encoded signature.
+ */
+export async function signRawBytes(privateKeyBase58, data) {
+    const keyStr = privateKeyBase58.replace(/^ed25519:/, '');
+    const privateKeyBytes = decodeBase58(keyStr);
+    const seed = privateKeyBytes.slice(0, 32);
+    const signature = await ed25519.sign(data, seed);
+    return Buffer.from(signature).toString('base64');
+}
+/**
+ * Derive a deterministic device ID from a public key (SHA-256 hex fingerprint).
+ * Matches the Rust `derive_device_id()` implementation.
+ */
+export function deriveDeviceId(publicKeyBase58) {
+    const publicKeyBytes = decodeBase58(publicKeyBase58);
+    return bytesToHex(sha256(publicKeyBytes));
+}
+/**
+ * Extract the Ed25519 public key from a private key seed.
+ * Returns base58-encoded public key.
+ */
+export async function getPublicKeyFromPrivate(privateKeyBase58) {
+    const keyStr = privateKeyBase58.replace(/^ed25519:/, '');
+    const privateKeyBytes = decodeBase58(keyStr);
+    const seed = privateKeyBytes.slice(0, 32);
+    const publicKey = await ed25519.getPublicKey(seed);
+    return encodeBase58(publicKey);
+}
 /**
  * Generate random UUID v4
  */

package/dist/utils/crypto.js.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/utils/crypto.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEjD,0DAA0D;AAC1D,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,GAAG,CAAe,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACvF,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,GAAG,CAAe,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,UAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAEjG,8CAA8C;AAC9C,MAAM,eAAe,GAAG,4DAA4D,CAAC;AAErF;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAC;QACvD,CAAC;QAED,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YACvB,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC;YACxB,KAAK,KAAK,CAAC,CAAC;QACd,CAAC;QAED,OAAO,KAAK,GAAG,CAAC,EAAE,CAAC;YACjB,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;YACzB,KAAK,KAAK,CAAC,CAAC;QACd,CAAC;IACH,CAAC;IAED,gDAAgD;IAChD,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACvB,IAAI,IAAI,KAAK,GAAG;YAAE,MAAM;QACxB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChB,CAAC;IAED,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;AACzC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,KAAiB;IAC5C,MAAM,MAAM,GAAa,CAAC,CAAC,CAAC,CAAC;IAE7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,KAAK,GAAG,IAAI,CAAC;QACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,KAAK,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACxB,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;YACvB,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;QACjC,CAAC;QAED,OAAO,KAAK,GAAG,CAAC,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;YACxB,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,KAAK,CAAC;YAAE,MAAM;QACtB,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IAED,OAAO,MAAM,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAChE,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,gBAAwB,EACxB,OAA4B;IAE5B,sCAAsC;IACtC,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAEzD,0EAA0E;IAC1E,MAAM,eAAe,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IAE7C,4CAA4C;IAC5C,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAE1C,wBAAwB;IACxB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAEvD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IAEzD,kCAAkC;IAClC,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACnD,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,eAAuB,EACvB,OAA4B,EAC5B,eAAuB;IAEvB,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACvD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QAEzD,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7C,OAAO,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AACnC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU;IACxB,OAAO,MAAM,CAAC,UAAU,EAAE,CAAC;AAC7B,CAAC"}
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/utils/crypto.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEjD,0DAA0D;AAC1D,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,GAAG,CAAe,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACvF,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,GAAG,CAAe,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,UAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAEjG,8CAA8C;AAC9C,MAAM,eAAe,GAAG,4DAA4D,CAAC;AAErF;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAC;QACvD,CAAC;QAED,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YACvB,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC;YACxB,KAAK,KAAK,CAAC,CAAC;QACd,CAAC;QAED,OAAO,KAAK,GAAG,CAAC,EAAE,CAAC;YACjB,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;YACzB,KAAK,KAAK,CAAC,CAAC;QACd,CAAC;IACH,CAAC;IAED,gDAAgD;IAChD,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACvB,IAAI,IAAI,KAAK,GAAG;YAAE,MAAM;QACxB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChB,CAAC;IAED,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;AACzC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,KAAiB;IAC5C,MAAM,MAAM,GAAa,CAAC,CAAC,CAAC,CAAC;IAE7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,KAAK,GAAG,IAAI,CAAC;QACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,KAAK,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACxB,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;YACvB,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;QACjC,CAAC;QAED,OAAO,KAAK,GAAG,CAAC,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;YACxB,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,KAAK,CAAC;YAAE,MAAM;QACtB,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IAED,OAAO,MAAM,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAChE,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,gBAAwB,EACxB,OAA4B;IAE5B,sCAAsC;IACtC,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAEzD,0EAA0E;IAC1E,MAAM,eAAe,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IAE7C,4CAA4C;IAC5C,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAE1C,wBAAwB;IACxB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAEvD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IAEzD,kCAAkC;IAClC,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACnD,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,eAAuB,EACvB,OAA4B,EAC5B,eAAuB;IAEvB,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACvD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QAEzD,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7C,OAAO,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,gBAAwB,EACxB,IAAgB;IAEhB,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACzD,MAAM,eAAe,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACjD,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,eAAuB;IACpD,MAAM,cAAc,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;IACrD,OAAO,UAAU,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,gBAAwB;IAExB,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACzD,MAAM,eAAe,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACnD,OAAO,YAAY,CAAC,SAAS,CAAC,CAAC;AACjC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU;IACxB,OAAO,MAAM,CAAC,UAAU,EAAE,CAAC;AAC7B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nervepay",
-  "version": "1.2.1",
+  "version": "1.2.8",
   "description": "NervePay plugin for OpenClaw - Self-sovereign identity, vault, and orchestration",
   "type": "module",
   "main": "dist/index.js",
@@ -43,13 +43,15 @@
     "commander": "^13.1.0",
     "inquirer": "^12.4.0",
     "chalk": "^5.4.1",
-    "open": "^10.1.0"
+    "open": "^10.1.0",
+    "ws": "^8.16.0"
   },
   "peerDependencies": {
     "openclaw": ">=1.0.0"
   },
   "devDependencies": {
     "@types/node": "^22.13.0",
+    "@types/ws": "^8.5.10",
     "typescript": "^5.7.3",
     "vitest": "^3.0.0"
   },