npmguard-cli 0.3.1 → 0.5.0

package/README.md

@@ -0,0 +1,155 @@
+# npmguard-cli
+
+CLI that checks npm packages against on-chain audit records before installing. Published on npm as [`npmguard-cli`](https://www.npmjs.com/package/npmguard-cli).
+
+## `npmguard-cli check`
+
+Scans your `package.json`, queries the npm registry for available updates, then resolves each package version against ENS on Sepolia to find audit records.
+
+```bash
+npx npmguard-cli check --path /your/project
+```
+
+```mermaid
+flowchart LR
+    A[package.json] -->|read deps| B[npm registry]
+    B -->|latest version| C{ENS Sepolia}
+    C -->|resolve 1-7-9.axios.npmguard.eth| D[Text Records]
+    D -->|verdict, score, capabilities, CIDs| E[Terminal output]
+```
+
+What happens:
+
+1. Reads `package.json` and extracts all dependencies
+2. For each dependency, fetches `https://registry.npmjs.org/{package}/latest` to get the latest version
+3. Constructs the ENS name: `{version}.{package}.npmguard.eth` (e.g. `1-7-9.axios.npmguard.eth`)
+4. Resolves these ENS text records on Sepolia via a public RPC:
+   - `npmguard.verdict` — SAFE / CRITICAL
+   - `npmguard.score` — 0 to 100
+   - `npmguard.capabilities` — network, filesystem, process_spawn, etc.
+   - `npmguard.report_cid` — IPFS CID of the full audit report
+   - `npmguard.source_cid` — IPFS CID of the audited source code
+5. Displays a table with verdict and capabilities per package
+6. Lists clickable IPFS links to the full audit reports
+
+Example output:
+
+```
+NpmGuard Dependency Audit
+
+┌─────────┬───────────┬────────┬──────────────┬──────────────┐
+│ Package │ Installed │ Latest │ Verdict      │ Capabilities │
+├─────────┼───────────┼────────┼──────────────┼──────────────┤
+│ axios   │ 1.6.0     │ 1.7.9  │ SAFE (96)    │ network      │
+├─────────┼───────────┼────────┼──────────────┼──────────────┤
+│ lodash  │ 4.17.21   │ 4.18.1 │ CRITICAL (12)│ network, ... │
+├─────────┼───────────┼────────┼──────────────┼──────────────┤
+│ chalk   │ 5.6.2     │ 5.6.2  │ NOT AUDITED  │ -            │
+└─────────┴───────────┴────────┴──────────────┴──────────────┘
+
+  1 safe | 1 critical | 1 not audited
+
+  axios@1.7.9 report: https://gateway.pinata.cloud/ipfs/bafkrei...
+  lodash@4.18.1 report: https://gateway.pinata.cloud/ipfs/bafkrei...
+```
+
+## `npmguard-cli install`
+
+Installs a package from IPFS instead of the npm registry when an audit record exists on ENS.
+
+```bash
+npx npmguard-cli install axios
+npx npmguard-cli install axios@1.7.9
+```
+
+```mermaid
+flowchart TD
+    A[npmguard-cli install axios] --> B{ENS Sepolia}
+    B -->|resolve 1-7-9.axios.npmguard.eth| C[Get verdict + sourceCid]
+    C --> D{Verdict?}
+    D -->|SAFE / WARNING| E[npm install from IPFS gateway]
+    D -->|CRITICAL| F[Installation blocked]
+    F -->|--force| E
+    E -->|tarball from gateway.pinata.cloud/ipfs/sourceCid| G[node_modules/]
+```
+
+What happens:
+
+1. If no version specified, fetches the latest version from npm registry
+2. Resolves `{version}.{package}.npmguard.eth` on Sepolia ENS
+3. Reads the `npmguard.source_cid` text record — the IPFS CID of the audited source tarball
+4. Runs `npm install https://gateway.pinata.cloud/ipfs/{sourceCid}`
+5. npm downloads the tarball directly from IPFS and installs it
+
+The result in `package-lock.json`:
+
+```json
+"node_modules/axios": {
+  "version": "1.7.9",
+  "resolved": "https://gateway.pinata.cloud/ipfs/bafkrei...",
+  "integrity": "sha512-..."
+}
+```
+
+The `resolved` field points to IPFS, not npm. Anyone running `npm install` on this project gets the exact same IPFS-verified code.
+
+If the package is flagged **CRITICAL**, installation is blocked:
+
+```
+  lodash@4.18.1
+
+  CRITICAL (score: 12)
+  Capabilities: network, filesystem, process_spawn
+  Report: https://gateway.pinata.cloud/ipfs/bafkrei...
+
+  Installation blocked. This package has critical security issues.
+  Use --force to install anyway.
+```
+
+If no audit record exists on ENS, falls back to standard `npm install`.
+
+## ENS structure
+
+```mermaid
+graph TD
+    A[npmguard.eth] --> B[axios.npmguard.eth]
+    A --> C[lodash.npmguard.eth]
+    B --> D[1-7-9.axios.npmguard.eth]
+    B --> E[1-8-0.axios.npmguard.eth]
+    D --> F["npmguard.verdict = safe<br/>npmguard.score = 96<br/>npmguard.capabilities = network<br/>npmguard.report_cid = bafkrei...<br/>npmguard.source_cid = bafkrei..."]
+    E --> G["npmguard.verdict = critical<br/>npmguard.score = 66"]
+```
+
+## Project structure
+
+```
+cli/
+├── src/
+│   ├── index.ts              # Entry point — commander setup
+│   ├── audit-source.ts       # AuditSource interface
+│   ├── ens-source.ts         # Reads ENS text records on Sepolia via viem
+│   ├── mock-source.ts        # Mock data for testing without ENS
+│   ├── scanner.ts            # Reads package.json + fetches npm for updates
+│   └── commands/
+│       ├── check.ts          # npmguard-cli check
+│       └── install.ts        # npmguard-cli install
+├── reports/                  # Sample audit reports (uploaded to IPFS)
+├── package.json
+└── tsconfig.json
+```
+
+## Development
+
+```bash
+cd cli && npm install
+
+# Run locally
+npx tsx src/index.ts check --path /tmp/test-project
+npx tsx src/index.ts install axios@1.7.9
+
+# Build
+npm run build
+
+# Publish
+npm publish
+```

package/dist/commands/install.js

@@ -1,17 +1,188 @@
 import chalk from "chalk";
 import ora from "ora";
+import qrcode from "qrcode-terminal";
+import { createInterface } from "node:readline";
 import { execSync } from "node:child_process";
-import { readFile, writeFile, unlink, mkdir } from "node:fs/promises";
-import { join } from "node:path";
-import { tmpdir } from "node:os";
+import { createPublicClient, createWalletClient, http, formatEther, encodeFunctionData, } from "viem";
+import { privateKeyToAccount } from "viem/accounts";
+import { defineChain } from "viem";
+import { SignClient } from "@walletconnect/sign-client";
+import { AUDIT_REQUEST_ADDRESS_0G, AUDIT_REQUEST_ABI, } from "../contract.js";
+const ogGalileo = defineChain({
+    id: 16602,
+    name: "0G-Galileo-Testnet",
+    nativeCurrency: { name: "0G", symbol: "0G", decimals: 18 },
+    rpcUrls: { default: { http: ["https://evmrpc-testnet.0g.ai"] } },
+    blockExplorers: { default: { name: "0G Explorer", url: "https://chainscan-galileo.0g.ai" } },
+    testnet: true,
+});
 const IPFS_GATEWAY = "https://gateway.pinata.cloud/ipfs";
-async function downloadFromIPFS(cid, dest) {
-    const resp = await fetch(`${IPFS_GATEWAY}/${cid}`);
-    if (!resp.ok) {
-        throw new Error(`IPFS download failed: ${resp.status}`);
+const ZERO_ADDRESS = "0x0000000000000000000000000000000000000000";
+const DEFAULT_AUDIT_API_URL = "http://209.38.42.28:8000/audit";
+const WALLETCONNECT_PROJECT_ID = process.env.WALLETCONNECT_PROJECT_ID ?? "d5eb170c427570e15ac00ae53acc93ba";
+const OG_RPC = "https://evmrpc-testnet.0g.ai";
+const BLOCK_EXPLORER = "https://chainscan-galileo.0g.ai";
+function prompt(question) {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    return new Promise((resolve) => {
+        rl.question(question, (answer) => {
+            rl.close();
+            resolve(answer.trim().toLowerCase());
+        });
+    });
+}
+function generateQrCode(text) {
+    return new Promise((resolve) => {
+        qrcode.generate(text, { small: true }, (code) => {
+            console.log(code);
+            resolve();
+        });
+    });
+}
+async function askInstallWithoutAudit(packageSpec) {
+    const answer = await prompt(chalk.white(`  Install from npm without audit? (y/n) `));
+    if (answer === "y" || answer === "yes") {
+        console.log();
+        execSync(`npm install ${packageSpec}`, { stdio: "inherit" });
+    }
+}
+async function requestAuditOnChain(packageName, version, privateKey) {
+    const account = privateKeyToAccount(privateKey);
+    const rpcUrl = OG_RPC;
+    const publicClient = createPublicClient({
+        chain: ogGalileo,
+        transport: http(rpcUrl),
+    });
+    const walletClient = createWalletClient({
+        account,
+        chain: ogGalileo,
+        transport: http(rpcUrl),
+    });
+    const auditFee = await publicClient.readContract({
+        address: AUDIT_REQUEST_ADDRESS_0G,
+        abi: AUDIT_REQUEST_ABI,
+        functionName: "auditFee",
+    });
+    const hash = await walletClient.writeContract({
+        address: AUDIT_REQUEST_ADDRESS_0G,
+        abi: AUDIT_REQUEST_ABI,
+        functionName: "requestAudit",
+        args: [packageName, version],
+        value: auditFee,
+    });
+    await publicClient.waitForTransactionReceipt({ hash });
+    return hash;
+}
+async function payViaWalletConnect(packageName, version, feeWei, feeDisplay) {
+    const calldata = encodeFunctionData({
+        abi: AUDIT_REQUEST_ABI,
+        functionName: "requestAudit",
+        args: [packageName, version],
+    });
+    let signClient = null;
+    // WalletConnect throws unhandled errors when MetaMask sends
+    // session events after the session is cleaned up — suppress them
+    const wcErrorHandler = (err) => {
+        if (err?.message?.includes("No matching key"))
+            return;
+        console.error(err);
+        process.exit(1);
+    };
+    process.on("uncaughtException", wcErrorHandler);
+    try {
+        const initSpinner = ora("  Connecting to WalletConnect...").start();
+        signClient = await SignClient.init({
+            projectId: WALLETCONNECT_PROJECT_ID,
+            metadata: {
+                name: "NpmGuard",
+                description: "NPM package security audit",
+                url: "https://npmguard.dev",
+                icons: [],
+            },
+        });
+        initSpinner.stop();
+        const { uri, approval } = await signClient.connect({
+            requiredNamespaces: {
+                eip155: {
+                    methods: ["eth_sendTransaction"],
+                    chains: ["eip155:16602"],
+                    events: ["chainChanged", "accountsChanged"],
+                },
+            },
+        });
+        if (!uri) {
+            console.log(chalk.red("  Failed to generate WalletConnect URI"));
+            return false;
+        }
+        console.log();
+        console.log(chalk.cyan(`  Scan with your wallet to connect:`));
+        console.log();
+        await generateQrCode(uri);
+        console.log();
+        const pairSpinner = ora("  Waiting for wallet connection...").start();
+        const session = await approval();
+        // Find the 0G Galileo account in approved namespaces
+        const accounts = session.namespaces.eip155?.accounts ?? [];
+        const ogAccount = accounts.find((a) => a.startsWith("eip155:16602:"));
+        const account = ogAccount
+            ? ogAccount.split(":")[2]
+            : accounts[0]?.split(":")[2];
+        if (!account) {
+            pairSpinner.fail("Wallet did not approve any accounts");
+            return false;
+        }
+        pairSpinner.succeed(`Connected: ${account.slice(0, 6)}...${account.slice(-4)}`);
+        console.log(chalk.cyan(`  Confirm the ${feeDisplay} transaction in your wallet...`));
+        const txHash = await signClient.request({
+            topic: session.topic,
+            chainId: "eip155:16602",
+            request: {
+                method: "eth_sendTransaction",
+                params: [
+                    {
+                        from: account,
+                        to: AUDIT_REQUEST_ADDRESS_0G,
+                        data: calldata,
+                        value: "0x" + feeWei.toString(16),
+                    },
+                ],
+            },
+        });
+        const confirmSpinner = ora("  Waiting for on-chain confirmation...").start();
+        const ogClient = createPublicClient({
+            chain: ogGalileo,
+            transport: http(OG_RPC),
+        });
+        const receipt = await ogClient.waitForTransactionReceipt({
+            hash: txHash,
+        });
+        if (receipt.status === "success") {
+            confirmSpinner.succeed("Payment confirmed on-chain!");
+            console.log(chalk.gray(`  Tx: ${BLOCK_EXPLORER}/tx/${txHash}`));
+            console.log();
+            return true;
+        }
+        else {
+            confirmSpinner.fail("Transaction reverted");
+            return false;
+        }
+    }
+    catch (err) {
+        const msg = err.message ?? String(err);
+        if (msg.includes("rejected") || msg.includes("denied")) {
+            console.log(chalk.yellow("  Transaction rejected by user."));
+        }
+        else {
+            console.log(chalk.red(`  WalletConnect error: ${msg}`));
+        }
+        console.log();
+        return false;
+    }
+    finally {
+        signClient = null;
+        // Remove handler after a delay to catch late WC events
+        setTimeout(() => process.off("uncaughtException", wcErrorHandler), 5000);
     }
-    const buffer = Buffer.from(await resp.arrayBuffer());
-    await writeFile(dest, buffer);
 }
 export async function installCommand(packageSpec, auditSource, force = false) {
     const atIndex = packageSpec.lastIndexOf("@");
@@ -46,16 +217,144 @@ export async function installCommand(packageSpec, auditSource, force = false) {
     console.log();
     console.log(chalk.bold(`  ${packageName}@${requestedVersion}`));
     console.log();
-    // No audit found — fallback to npm
+    // ─── No audit found ───────────────────────────────────────────────
     if (!audit) {
         console.log(chalk.gray(`  NOT AUDITED — no NpmGuard record found for this version.`));
         console.log();
-        console.log(chalk.gray("  Falling back to npm install..."));
-        console.log();
-        execSync(`npm install ${packageSpec}`, { stdio: "inherit" });
-        return;
+        const privateKey = process.env.NPMGUARD_PRIVATE_KEY;
+        const contractDeployed = AUDIT_REQUEST_ADDRESS_0G !== ZERO_ADDRESS;
+        if (contractDeployed) {
+            const publicClient = createPublicClient({
+                chain: ogGalileo,
+                transport: http(OG_RPC),
+            });
+            // Check if user already paid (previous attempt where audit engine failed)
+            let alreadyPaid = false;
+            try {
+                alreadyPaid = (await publicClient.readContract({
+                    address: AUDIT_REQUEST_ADDRESS_0G,
+                    abi: AUDIT_REQUEST_ABI,
+                    functionName: "isRequested",
+                    args: [packageName, requestedVersion],
+                }));
+            }
+            catch {
+                // can't read — assume not paid
+            }
+            if (alreadyPaid) {
+                console.log(chalk.cyan(`  Already paid on-chain — re-triggering audit...`));
+                console.log();
+            }
+            else {
+                // Read fee for display
+                let feeDisplay = "0.01 0G";
+                let feeWei = 10000000000000000n;
+                try {
+                    feeWei = (await publicClient.readContract({
+                        address: AUDIT_REQUEST_ADDRESS_0G,
+                        abi: AUDIT_REQUEST_ABI,
+                        functionName: "auditFee",
+                    }));
+                    feeDisplay = `${formatEther(feeWei)} 0G`;
+                }
+                catch { }
+                const wantAudit = await prompt(chalk.yellow(`  Request on-chain audit for ${feeDisplay}? (y/n) `));
+                if (wantAudit !== "y" && wantAudit !== "yes") {
+                    return askInstallWithoutAudit(packageSpec);
+                }
+                // Ask how to pay
+                console.log();
+                console.log(chalk.bold(`  How to pay?`));
+                if (privateKey) {
+                    console.log(`    1) Wallet (NPMGUARD_PRIVATE_KEY)`);
+                    console.log(`    2) WalletConnect (mobile wallet)`);
+                    console.log(`    3) Back`);
+                }
+                else {
+                    console.log(`    1) WalletConnect (mobile wallet)`);
+                    console.log(`    2) Back`);
+                }
+                console.log();
+                const choice = await prompt(`  Choice: `);
+                const backChoice = privateKey ? "3" : "2";
+                if (choice === backChoice) {
+                    return askInstallWithoutAudit(packageSpec);
+                }
+                if (privateKey && choice === "1") {
+                    const txSpinner = ora("  Sending payment transaction...").start();
+                    try {
+                        const txHash = await requestAuditOnChain(packageName, requestedVersion, privateKey);
+                        txSpinner.succeed("Payment confirmed on-chain!");
+                        console.log(chalk.gray(`  Tx: ${BLOCK_EXPLORER}/tx/${txHash}`));
+                        console.log();
+                    }
+                    catch (err) {
+                        txSpinner.fail("Transaction failed");
+                        console.log(chalk.red(`  ${err.shortMessage ?? err.message}`));
+                        console.log();
+                        return askInstallWithoutAudit(packageSpec);
+                    }
+                }
+                else if ((privateKey && choice === "2") || (!privateKey && choice === "1")) {
+                    const paid = await payViaWalletConnect(packageName, requestedVersion, feeWei, feeDisplay);
+                    if (!paid)
+                        return askInstallWithoutAudit(packageSpec);
+                }
+                else {
+                    return askInstallWithoutAudit(packageSpec);
+                }
+            }
+            // Trigger audit engine
+            const auditApiUrl = process.env.NPMGUARD_AUDIT_API_URL ?? DEFAULT_AUDIT_API_URL;
+            const auditSpinner = ora("  Running security audit...").start();
+            try {
+                const resp = await fetch(auditApiUrl, {
+                    method: "POST",
+                    headers: { "Content-Type": "application/json" },
+                    body: JSON.stringify({ packageName, version: requestedVersion }),
+                });
+                if (!resp.ok)
+                    throw new Error(`Audit engine returned ${resp.status}`);
+                const result = await resp.json();
+                auditSpinner.stop();
+                console.log();
+                const verdict = (result.verdict ?? "UNKNOWN").toUpperCase();
+                const capabilities = result.capabilities ?? [];
+                if (verdict === "SAFE") {
+                    console.log(chalk.green(`  Verdict: SAFE`));
+                }
+                else if (verdict === "DANGEROUS") {
+                    console.log(chalk.red(`  Verdict: DANGEROUS`));
+                }
+                else {
+                    console.log(chalk.yellow(`  Verdict: ${verdict}`));
+                }
+                if (capabilities.length > 0) {
+                    console.log(chalk.gray(`  Capabilities: ${capabilities.join(", ")}`));
+                }
+                console.log();
+                if (verdict === "DANGEROUS" && !force) {
+                    console.log(chalk.red.bold("  Installation blocked. This package is dangerous."));
+                    console.log(chalk.gray("  Use --force to install anyway."));
+                    console.log();
+                    return;
+                }
+                console.log(chalk.gray("  Installing from npm..."));
+                console.log();
+                execSync(`npm install ${packageSpec}`, { stdio: "inherit" });
+            }
+            catch (err) {
+                auditSpinner.fail("Audit engine unreachable");
+                console.log(chalk.gray(`  ${err.message ?? err}`));
+                console.log();
+                return askInstallWithoutAudit(packageSpec);
+            }
+            return;
+        }
+        // Contract not deployed
+        return askInstallWithoutAudit(packageSpec);
     }
-    // Show verdict
+    // ─── Audit found — show verdict ───────────────────────────────────
     if (audit.verdict === "SAFE") {
         console.log(chalk.green(`  SAFE (score: ${audit.score})`));
     }
@@ -81,41 +380,18 @@ export async function installCommand(packageSpec, auditSource, force = false) {
     }
     // Install from IPFS if sourceCid is available
     if (audit.sourceCid) {
-        const dlSpinner = ora(`Downloading verified source from IPFS (${audit.sourceCid.slice(0, 12)}...)`).start();
+        const ipfsUrl = `${IPFS_GATEWAY}/${audit.sourceCid}`;
+        console.log(chalk.green(`  Installing from verified IPFS source...`));
+        console.log();
         try {
-            const tmpDir = join(tmpdir(), "npmguard");
-            await mkdir(tmpDir, { recursive: true });
-            const tarballPath = join(tmpDir, `${packageName}-${requestedVersion}.tgz`);
-            await downloadFromIPFS(audit.sourceCid, tarballPath);
-            dlSpinner.succeed("Downloaded from IPFS");
-            console.log(chalk.green(`  Installing from verified IPFS source...`));
-            console.log();
-            execSync(`npm install ${tarballPath}`, { stdio: "inherit" });
-            // Fix package.json — replace the file: path with the real version
-            try {
-                const pkgPath = join(process.cwd(), "package.json");
-                const pkgRaw = await readFile(pkgPath, "utf-8");
-                const pkg = JSON.parse(pkgRaw);
-                if (pkg.dependencies?.[packageName]?.startsWith("file:")) {
-                    pkg.dependencies[packageName] = `^${requestedVersion}`;
-                    await writeFile(pkgPath, JSON.stringify(pkg, null, 2) + "\n");
-                }
-            }
-            catch {
-                // Not critical if this fails
-            }
-            // Cleanup tarball
-            await unlink(tarballPath).catch(() => { });
+            execSync(`npm install ${ipfsUrl}`, { stdio: "inherit" });
         }
-        catch (err) {
-            dlSpinner.fail("IPFS download failed");
-            console.log(chalk.yellow("  Falling back to npm install..."));
-            console.log();
+        catch {
+            console.log(chalk.yellow("  IPFS install failed, falling back to npm..."));
             execSync(`npm install ${packageSpec}`, { stdio: "inherit" });
         }
     }
     else {
-        // No sourceCid — install from npm
         console.log(chalk.gray("  No IPFS source available, installing from npm..."));
         console.log();
         execSync(`npm install ${packageSpec}`, { stdio: "inherit" });

package/dist/contract.d.ts

@@ -0,0 +1,121 @@
+export declare const AUDIT_REQUEST_ADDRESS: `0x${string}`;
+export declare const AUDIT_REQUEST_ADDRESS_0G: `0x${string}`;
+export declare const AUDIT_REQUEST_ABI: readonly [{
+    readonly inputs: readonly [{
+        readonly name: "_auditFee";
+        readonly type: "uint256";
+    }];
+    readonly stateMutability: "nonpayable";
+    readonly type: "constructor";
+}, {
+    readonly anonymous: false;
+    readonly inputs: readonly [{
+        readonly indexed: false;
+        readonly name: "packageName";
+        readonly type: "string";
+    }, {
+        readonly indexed: false;
+        readonly name: "version";
+        readonly type: "string";
+    }, {
+        readonly indexed: true;
+        readonly name: "requester";
+        readonly type: "address";
+    }];
+    readonly name: "AuditRequested";
+    readonly type: "event";
+}, {
+    readonly anonymous: false;
+    readonly inputs: readonly [{
+        readonly indexed: true;
+        readonly name: "key";
+        readonly type: "bytes32";
+    }, {
+        readonly indexed: true;
+        readonly name: "requester";
+        readonly type: "address";
+    }];
+    readonly name: "AuditRequestedByKey";
+    readonly type: "event";
+}, {
+    readonly inputs: readonly [{
+        readonly name: "packageName";
+        readonly type: "string";
+    }, {
+        readonly name: "version";
+        readonly type: "string";
+    }];
+    readonly name: "requestAudit";
+    readonly outputs: readonly [];
+    readonly stateMutability: "payable";
+    readonly type: "function";
+}, {
+    readonly inputs: readonly [{
+        readonly name: "key";
+        readonly type: "bytes32";
+    }];
+    readonly name: "requestAuditByKey";
+    readonly outputs: readonly [];
+    readonly stateMutability: "payable";
+    readonly type: "function";
+}, {
+    readonly inputs: readonly [];
+    readonly name: "auditFee";
+    readonly outputs: readonly [{
+        readonly name: "";
+        readonly type: "uint256";
+    }];
+    readonly stateMutability: "view";
+    readonly type: "function";
+}, {
+    readonly inputs: readonly [];
+    readonly name: "owner";
+    readonly outputs: readonly [{
+        readonly name: "";
+        readonly type: "address";
+    }];
+    readonly stateMutability: "view";
+    readonly type: "function";
+}, {
+    readonly inputs: readonly [{
+        readonly name: "packageName";
+        readonly type: "string";
+    }, {
+        readonly name: "version";
+        readonly type: "string";
+    }];
+    readonly name: "isRequested";
+    readonly outputs: readonly [{
+        readonly name: "";
+        readonly type: "bool";
+    }];
+    readonly stateMutability: "view";
+    readonly type: "function";
+}, {
+    readonly inputs: readonly [{
+        readonly name: "";
+        readonly type: "bytes32";
+    }];
+    readonly name: "requested";
+    readonly outputs: readonly [{
+        readonly name: "";
+        readonly type: "bool";
+    }];
+    readonly stateMutability: "view";
+    readonly type: "function";
+}, {
+    readonly inputs: readonly [{
+        readonly name: "_fee";
+        readonly type: "uint256";
+    }];
+    readonly name: "setFee";
+    readonly outputs: readonly [];
+    readonly stateMutability: "nonpayable";
+    readonly type: "function";
+}, {
+    readonly inputs: readonly [];
+    readonly name: "withdraw";
+    readonly outputs: readonly [];
+    readonly stateMutability: "nonpayable";
+    readonly type: "function";
+}];

package/dist/contract.js

@@ -0,0 +1,92 @@
+// NpmGuardAuditRequest contract — deployed on Sepolia + 0G Galileo Testnet
+// Update these addresses after running: cd contracts && npm run deploy
+export const AUDIT_REQUEST_ADDRESS = "0x4bbaf196bde9e02594631e03c28ebe16719214f3"; // Sepolia
+export const AUDIT_REQUEST_ADDRESS_0G = "0x1201448ae5f00e1783036439569e71ab3757d0de"; // 0G Galileo Testnet
+export const AUDIT_REQUEST_ABI = [
+    {
+        inputs: [{ name: "_auditFee", type: "uint256" }],
+        stateMutability: "nonpayable",
+        type: "constructor",
+    },
+    {
+        anonymous: false,
+        inputs: [
+            { indexed: false, name: "packageName", type: "string" },
+            { indexed: false, name: "version", type: "string" },
+            { indexed: true, name: "requester", type: "address" },
+        ],
+        name: "AuditRequested",
+        type: "event",
+    },
+    {
+        anonymous: false,
+        inputs: [
+            { indexed: true, name: "key", type: "bytes32" },
+            { indexed: true, name: "requester", type: "address" },
+        ],
+        name: "AuditRequestedByKey",
+        type: "event",
+    },
+    {
+        inputs: [
+            { name: "packageName", type: "string" },
+            { name: "version", type: "string" },
+        ],
+        name: "requestAudit",
+        outputs: [],
+        stateMutability: "payable",
+        type: "function",
+    },
+    {
+        inputs: [{ name: "key", type: "bytes32" }],
+        name: "requestAuditByKey",
+        outputs: [],
+        stateMutability: "payable",
+        type: "function",
+    },
+    {
+        inputs: [],
+        name: "auditFee",
+        outputs: [{ name: "", type: "uint256" }],
+        stateMutability: "view",
+        type: "function",
+    },
+    {
+        inputs: [],
+        name: "owner",
+        outputs: [{ name: "", type: "address" }],
+        stateMutability: "view",
+        type: "function",
+    },
+    {
+        inputs: [
+            { name: "packageName", type: "string" },
+            { name: "version", type: "string" },
+        ],
+        name: "isRequested",
+        outputs: [{ name: "", type: "bool" }],
+        stateMutability: "view",
+        type: "function",
+    },
+    {
+        inputs: [{ name: "", type: "bytes32" }],
+        name: "requested",
+        outputs: [{ name: "", type: "bool" }],
+        stateMutability: "view",
+        type: "function",
+    },
+    {
+        inputs: [{ name: "_fee", type: "uint256" }],
+        name: "setFee",
+        outputs: [],
+        stateMutability: "nonpayable",
+        type: "function",
+    },
+    {
+        inputs: [],
+        name: "withdraw",
+        outputs: [],
+        stateMutability: "nonpayable",
+        type: "function",
+    },
+];

package/dist/ens-source.js

@@ -1,30 +1,51 @@
 import { createPublicClient, http } from "viem";
 import { sepolia } from "viem/chains";
-const client = createPublicClient({
-    chain: sepolia,
-    transport: http("https://ethereum-sepolia-rpc.publicnode.com"),
-});
+const RPC_URLS = process.env.SEPOLIA_RPC_URL
+    ? [process.env.SEPOLIA_RPC_URL]
+    : [
+        "https://ethereum-sepolia-rpc.publicnode.com",
+        "https://rpc.sepolia.org",
+        "https://sepolia.drpc.org",
+    ];
+function makeClient(url) {
+    return createPublicClient({ chain: sepolia, transport: http(url) });
+}
+async function getText(ensName, key) {
+    for (const url of RPC_URLS) {
+        try {
+            return await makeClient(url).getEnsText({ name: ensName, key });
+        }
+        catch {
+            continue;
+        }
+    }
+    return null;
+}
 export class ENSAuditSource {
     async getAudit(packageName, version) {
-        // 1.14.0 → 1-14-0
-        const versionSlug = version.replace(/\./g, "-");
+        const versionSlug = version
+            .replace(/[^a-z0-9]+/gi, "-")
+            .replace(/^-+|-+$/g, "")
+            .toLowerCase();
         const ensName = `${versionSlug}.${packageName}.npmguard.eth`;
         try {
             const [verdict, score, capabilities, reportCid, sourceCid] = await Promise.all([
-                client.getEnsText({ name: ensName, key: "verdict" }),
-                client.getEnsText({ name: ensName, key: "score" }),
-                client.getEnsText({ name: ensName, key: "capabilities" }),
-                client.getEnsText({ name: ensName, key: "reportCid" }),
-                client.getEnsText({ name: ensName, key: "sourceCid" }),
+                getText(ensName, "npmguard.verdict"),
+                getText(ensName, "npmguard.score"),
+                getText(ensName, "npmguard.capabilities"),
+                getText(ensName, "npmguard.report_cid"),
+                getText(ensName, "npmguard.source_cid"),
             ]);
             if (!verdict)
                 return null;
             return {
                 packageName,
                 version,
-                verdict: verdict,
+                verdict: verdict.toUpperCase(),
                 score: score ? parseInt(score, 10) : 0,
-                capabilities: capabilities ? capabilities.split(",") : [],
+                capabilities: capabilities
+                    ? capabilities.split(",").map((c) => c.trim()).filter(Boolean)
+                    : [],
                 reportCid: reportCid ?? undefined,
                 sourceCid: sourceCid ?? undefined,
             };

package/dist/index.d.ts

@@ -1,2 +1,2 @@
 #!/usr/bin/env node
-export {};
+import "dotenv/config";

package/dist/index.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import "dotenv/config";
 import { Command } from "commander";
 import { resolve } from "node:path";
 import { ENSAuditSource } from "./ens-source.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "npmguard-cli",
-  "version": "0.3.1",
+  "version": "0.5.0",
   "type": "module",
   "description": "Check npm packages against NpmGuard security audits on ENS before installing",
   "bin": "./dist/index.js",
@@ -22,10 +22,13 @@
   ],
   "license": "MIT",
   "dependencies": {
+    "@walletconnect/sign-client": "^2.23.9",
     "chalk": "^5.4.0",
     "cli-table3": "^0.6.5",
     "commander": "^13.1.0",
+    "dotenv": "^17.4.0",
     "ora": "^8.2.0",
+    "qrcode-terminal": "^0.12.0",
     "viem": "^2.34.0"
   },
   "devDependencies": {