run402-mcp 2.26.0 → 2.28.0

package/README.md

@@ -545,7 +545,8 @@ The full MCP surface — every tool is a thin shim over an SDK call.
 | Variable | Default | Purpose |
 |----------|---------|---------|
 | `RUN402_API_BASE`        | `https://api.run402.com`         | API base URL (override for staging) |
-| `RUN402_CONFIG_DIR`      | `~/.config/run402`               | Local credential storage directory |
+| `RUN402_CONFIG_DIR`      | `~/.config/run402`               | Local credential storage base directory (named wallets live under `profiles/<name>/`) |
+| `RUN402_WALLET`          | `default`                        | Active named wallet (profile). Overridden by `--wallet <name>` and per-directory `.run402.json`; `RUN402_PROFILE` is an alias. See `run402 wallets`. |
 | `RUN402_ALLOWANCE_PATH`  | `{config_dir}/allowance.json`    | Custom allowance file path |
 
 Local state lives at:

package/core/dist/allowance.d.ts

@@ -6,26 +6,6 @@ export interface AllowanceData {
     lastFaucet?: string;
     rail?: "x402" | "mpp";
 }
-/**
- * Load the agent allowance from disk.
- *
- * Returns `null` for the two "no allowance configured" cases:
- *   - the file does not exist
- *   - the file exists but is not parseable JSON (preserve existing UX —
- *     consumers print "no_allowance" and tell the user to run init)
- *
- * Throws a structured `Error` (GH-194) when the file parses as JSON but the
- * shape is wrong (missing/wrong-type/wrong-length fields). Without this guard
- * downstream callers crash with raw stack traces:
- *   - `cli/lib/status.mjs` reaches for `allowance.address.toLowerCase()`
- *     and crashes with `TypeError: Cannot read properties of undefined`.
- *   - `core/src/allowance-auth.ts` passes a malformed `privateKey` to
- *     `@noble/curves` which throws "expected 32 bytes, got N".
- *
- * The CLI's `cli/lib/config.mjs:readAllowance()` wrapper and the MCP
- * `src/tools/{status,init}.ts` callers translate the throw into their own
- * structured envelopes (`code: BAD_ALLOWANCE_FILE`).
- */
 export declare function readAllowance(path?: string): AllowanceData | null;
 export declare function saveAllowance(data: AllowanceData, path?: string): void;
 //# sourceMappingURL=allowance.d.ts.map

package/core/dist/allowance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"allowance.d.ts","sourceRoot":"","sources":["../src/allowance.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;CACvB;AAOD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,aAAa,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAuCjE;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAQtE"}
+{"version":3,"file":"allowance.d.ts","sourceRoot":"","sources":["../src/allowance.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;CACvB;AAkDD,wBAAgB,aAAa,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAwCjE;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAQtE"}

package/core/dist/allowance.js

@@ -1,4 +1,4 @@
-import { readFileSync, writeFileSync, mkdirSync, existsSync, chmodSync, renameSync } from "node:fs";
+import { readFileSync, writeFileSync, mkdirSync, existsSync, chmodSync, renameSync, statSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { randomBytes } from "node:crypto";
 import { getAllowancePath } from "./config.js";
@@ -26,10 +26,33 @@ const PRIVATE_KEY_RE = /^0x[a-fA-F0-9]{64}$/;
  * `src/tools/{status,init}.ts` callers translate the throw into their own
  * structured envelopes (`code: BAD_ALLOWANCE_FILE`).
  */
+/**
+ * If an allowance file is readable by group or other (any of the low 0o077
+ * bits set), tighten it to 0600 and warn once on stderr. This self-heals the
+ * historical case where a legacy world-readable `wallet.json` (mode 0644) was
+ * migrated to `allowance.json` via a mode-preserving rename, leaving the
+ * private key exposed on a shared machine. Best-effort: POSIX-only and silent
+ * on platforms without meaningful Unix modes (e.g. Windows).
+ */
+function selfHealPermissions(p) {
+    if (process.platform === "win32")
+        return;
+    try {
+        const mode = statSync(p).mode & 0o777;
+        if ((mode & 0o077) !== 0) {
+            chmodSync(p, 0o600);
+            process.stderr.write(`warning: tightened permissions on ${p} from ${mode.toString(8)} to 600 (was readable by other users).\n`);
+        }
+    }
+    catch {
+        // Best-effort; never block a read on a chmod/stat failure.
+    }
+}
 export function readAllowance(path) {
     const p = path ?? getAllowancePath();
     if (!existsSync(p))
         return null;
+    selfHealPermissions(p);
     let raw;
     try {
         raw = readFileSync(p, "utf-8");

package/core/dist/allowance.js.map

@@ -1 +1 @@
-{"version":3,"file":"allowance.js","sourceRoot":"","sources":["../src/allowance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACpG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAW/C,kCAAkC;AAClC,MAAM,UAAU,GAAG,qBAAqB,CAAC;AACzC,uDAAuD;AACvD,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAE7C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,aAAa,CAAC,IAAa;IACzC,MAAM,CAAC,GAAG,IAAI,IAAI,gBAAgB,EAAE,CAAC;IACrC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,0EAA0E;QAC1E,oDAAoD;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CACb,kDACE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,MACtE,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAgC,CAAC;IAC9C,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,+EAA+E;YAC7E,wDAAwD,CAC3D,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,KAAK,CACb,kFAAkF;YAChF,wDAAwD,CAC3D,CAAC;IACJ,CAAC;IACD,OAAO,IAAqB,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAmB,EAAE,IAAa;IAC9D,MAAM,CAAC,GAAG,IAAI,IAAI,gBAAgB,EAAE,CAAC;IACrC,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACvB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1E,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnE,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACnB,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACtB,CAAC"}
+{"version":3,"file":"allowance.js","sourceRoot":"","sources":["../src/allowance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC9G,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAW/C,kCAAkC;AAClC,MAAM,UAAU,GAAG,qBAAqB,CAAC;AACzC,uDAAuD;AACvD,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAE7C;;;;;;;;;;;;;;;;;;;GAmBG;AACH;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAAC,CAAS;IACpC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO;IACzC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,qCAAqC,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,0CAA0C,CAC1G,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,2DAA2D;IAC7D,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAa;IACzC,MAAM,CAAC,GAAG,IAAI,IAAI,gBAAgB,EAAE,CAAC;IACrC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,mBAAmB,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,0EAA0E;QAC1E,oDAAoD;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CACb,kDACE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,MACtE,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAgC,CAAC;IAC9C,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,+EAA+E;YAC7E,wDAAwD,CAC3D,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,KAAK,CACb,kFAAkF;YAChF,wDAAwD,CAC3D,CAAC;IACJ,CAAC;IACD,OAAO,IAAqB,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAmB,EAAE,IAAa;IAC9D,MAAM,CAAC,GAAG,IAAI,IAAI,gBAAgB,EAAE,CAAC;IACrC,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACvB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1E,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnE,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACnB,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACtB,CAAC"}

package/core/dist/config.d.ts

@@ -7,6 +7,32 @@ export declare function getApiBase(): string;
  * should not need this override.
  */
 export declare function getDeployApiBase(): string;
+/**
+ * The base credential directory — the root under which the `default` wallet
+ * lives directly and named wallets live under `profiles/<name>/`. This is the
+ * value `RUN402_CONFIG_DIR` overrides; profiles nest *within* it.
+ */
+export declare function getConfigBaseDir(): string;
+export declare const DEFAULT_PROFILE = "default";
+export declare function isValidProfileName(name: string): boolean;
+/**
+ * The active wallet/profile name from the environment. `RUN402_WALLET` is
+ * canonical; `RUN402_PROFILE` is accepted as an alias. Empty/unset → the
+ * reserved `default`. The CLI edge resolves the `--wallet` flag and any
+ * per-directory `.run402.json` binding into `RUN402_WALLET` *before* dispatch,
+ * so core stays env-only and never reads argv or cwd.
+ */
+export declare function getActiveProfile(): string;
+/** Directory holding all named wallets: `{base}/profiles`. */
+export declare function getProfilesDir(): string;
+/**
+ * The effective config directory for the *active* wallet. The `default` wallet
+ * resolves to the base dir (zero migration for existing single-wallet
+ * installs); any named wallet resolves to `{base}/profiles/<name>`. Because
+ * keystore, allowance, and meta paths all derive from this, switching the
+ * profile env var moves the whole wallet bundle atomically — and the SDK/MCP
+ * inherit profile selection for free.
+ */
 export declare function getConfigDir(): string;
 export declare function getKeystorePath(): string;
 export declare function getAllowancePath(): string;

package/core/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAwCA,wBAAgB,UAAU,IAAI,MAAM,CAGnC;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAIzC;AAED,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED,wBAAgB,gBAAgB,IAAI,MAAM,CAWzC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAwCA,wBAAgB,UAAU,IAAI,MAAM,CAGnC;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAIzC;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED,eAAO,MAAM,eAAe,YAAY,CAAC;AASzC,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAExD;AAmBD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAMzC;AAED,8DAA8D;AAC9D,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAIrC;AAED,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED,wBAAgB,gBAAgB,IAAI,MAAM,CAoBzC"}

package/core/dist/config.js

@@ -1,6 +1,6 @@
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { existsSync, renameSync, mkdirSync } from "node:fs";
+import { existsSync, renameSync, mkdirSync, chmodSync } from "node:fs";
 const DEFAULT_API_BASE = "https://api.run402.com";
 /**
  * Validate a user-supplied API base URL. Throws a clear error message that
@@ -47,9 +47,71 @@ export function getDeployApiBase() {
     const validated = validateApiBase("RUN402_DEPLOY_API_BASE", process.env.RUN402_DEPLOY_API_BASE, fallback);
     return validated ?? fallback;
 }
-export function getConfigDir() {
+/**
+ * The base credential directory — the root under which the `default` wallet
+ * lives directly and named wallets live under `profiles/<name>/`. This is the
+ * value `RUN402_CONFIG_DIR` overrides; profiles nest *within* it.
+ */
+export function getConfigBaseDir() {
     return process.env.RUN402_CONFIG_DIR || join(homedir(), ".config", "run402");
 }
+export const DEFAULT_PROFILE = "default";
+// Filesystem-safe wallet/profile name. Lowercase only (avoids collisions on
+// case-insensitive filesystems like macOS), starts alphanumeric, then
+// alphanumeric/underscore/hyphen, max 64 chars. The CLI edge enforces this for
+// nice UX; core re-checks it as a defense-in-depth guard so a hostile
+// `RUN402_WALLET`/`RUN402_PROFILE` cannot traverse outside the profiles dir.
+const PROFILE_NAME_RE = /^[a-z0-9][a-z0-9_-]{0,63}$/;
+export function isValidProfileName(name) {
+    return PROFILE_NAME_RE.test(name);
+}
+/**
+ * Guard against path traversal from the profile env vars. The reserved
+ * `default` profile is always allowed (it maps to the base dir). Any other
+ * name must pass the filesystem-safe pattern; otherwise we throw rather than
+ * silently resolve a surprising path.
+ */
+function assertSafeProfileName(name) {
+    if (name === DEFAULT_PROFILE)
+        return;
+    if (!isValidProfileName(name)) {
+        throw new Error(`Invalid wallet/profile name ${JSON.stringify(name)}. ` +
+            "Names must match /^[a-z0-9][a-z0-9_-]{0,63}$/ (lowercase letters, digits, '_' and '-'). " +
+            "Check the RUN402_WALLET / RUN402_PROFILE env var.");
+    }
+}
+/**
+ * The active wallet/profile name from the environment. `RUN402_WALLET` is
+ * canonical; `RUN402_PROFILE` is accepted as an alias. Empty/unset → the
+ * reserved `default`. The CLI edge resolves the `--wallet` flag and any
+ * per-directory `.run402.json` binding into `RUN402_WALLET` *before* dispatch,
+ * so core stays env-only and never reads argv or cwd.
+ */
+export function getActiveProfile() {
+    const raw = process.env.RUN402_WALLET ?? process.env.RUN402_PROFILE;
+    const name = raw == null ? "" : raw.trim();
+    if (!name)
+        return DEFAULT_PROFILE;
+    assertSafeProfileName(name);
+    return name;
+}
+/** Directory holding all named wallets: `{base}/profiles`. */
+export function getProfilesDir() {
+    return join(getConfigBaseDir(), "profiles");
+}
+/**
+ * The effective config directory for the *active* wallet. The `default` wallet
+ * resolves to the base dir (zero migration for existing single-wallet
+ * installs); any named wallet resolves to `{base}/profiles/<name>`. Because
+ * keystore, allowance, and meta paths all derive from this, switching the
+ * profile env var moves the whole wallet bundle atomically — and the SDK/MCP
+ * inherit profile selection for free.
+ */
+export function getConfigDir() {
+    const base = getConfigBaseDir();
+    const profile = getActiveProfile();
+    return profile === DEFAULT_PROFILE ? base : join(base, "profiles", profile);
+}
 export function getKeystorePath() {
     return join(getConfigDir(), "projects.json");
 }
@@ -59,10 +121,20 @@ export function getAllowancePath() {
     const dir = getConfigDir();
     const newPath = join(dir, "allowance.json");
     const oldPath = join(dir, "wallet.json");
-    // Auto-migrate from wallet.json → allowance.json
+    // Auto-migrate from wallet.json → allowance.json. renameSync preserves the
+    // source file's mode, so a legacy world-readable wallet.json (mode 0644)
+    // would otherwise carry that mode forward and leave the private key
+    // world-readable on a shared machine. Tighten to 0600 after the rename.
     if (!existsSync(newPath) && existsSync(oldPath)) {
         mkdirSync(dir, { recursive: true });
         renameSync(oldPath, newPath);
+        try {
+            chmodSync(newPath, 0o600);
+        }
+        catch {
+            // Best-effort (e.g. Windows / exotic filesystems). Read-time self-heal
+            // in readAllowance() is the backstop.
+        }
     }
     return newPath;
 }

package/core/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAE5D,MAAM,gBAAgB,GAAG,wBAAwB,CAAC;AAElD;;;;;;;;;GASG;AACH,SAAS,eAAe,CAAC,MAAc,EAAE,GAAuB,EAAE,QAAgB;IAChF,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,YAAY,MAAM,kFAAkF,CACrG,CAAC;QACF,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,CAAM,CAAC;IACX,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,GAAG,MAAM,wBAAwB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,wDAAwD,CAC7G,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CACb,GAAG,MAAM,2BAA2B,CAAC,CAAC,QAAQ,iBAAiB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CACvF,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,MAAM,SAAS,GAAG,eAAe,CAAC,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,gBAAgB,CAAC,CAAC;IACpG,OAAO,SAAS,IAAI,gBAAgB,CAAC;AACvC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAG,eAAe,CAAC,wBAAwB,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,QAAQ,CAAC,CAAC;IAC1G,OAAO,SAAS,IAAI,QAAQ,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,IAAI,CAAC,YAAY,EAAE,EAAE,eAAe,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IAChF,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IACzC,iDAAiD;IACjD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEvE,MAAM,gBAAgB,GAAG,wBAAwB,CAAC;AAElD;;;;;;;;;GASG;AACH,SAAS,eAAe,CAAC,MAAc,EAAE,GAAuB,EAAE,QAAgB;IAChF,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,YAAY,MAAM,kFAAkF,CACrG,CAAC;QACF,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,CAAM,CAAC;IACX,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,GAAG,MAAM,wBAAwB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,wDAAwD,CAC7G,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CACb,GAAG,MAAM,2BAA2B,CAAC,CAAC,QAAQ,iBAAiB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CACvF,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,MAAM,SAAS,GAAG,eAAe,CAAC,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,gBAAgB,CAAC,CAAC;IACpG,OAAO,SAAS,IAAI,gBAAgB,CAAC;AACvC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAG,eAAe,CAAC,wBAAwB,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,QAAQ,CAAC,CAAC;IAC1G,OAAO,SAAS,IAAI,QAAQ,CAAC;AAC/B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,SAAS,CAAC;AAEzC,4EAA4E;AAC5E,sEAAsE;AACtE,+EAA+E;AAC/E,sEAAsE;AACtE,6EAA6E;AAC7E,MAAM,eAAe,GAAG,4BAA4B,CAAC;AAErD,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,IAAY;IACzC,IAAI,IAAI,KAAK,eAAe;QAAE,OAAO;IACrC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,+BAA+B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI;YACrD,0FAA0F;YAC1F,mDAAmD,CACtD,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IACpE,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3C,IAAI,CAAC,IAAI;QAAE,OAAO,eAAe,CAAC;IAClC,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,cAAc;IAC5B,OAAO,IAAI,CAAC,gBAAgB,EAAE,EAAE,UAAU,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY;IAC1B,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;IAChC,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;IACnC,OAAO,OAAO,KAAK,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,IAAI,CAAC,YAAY,EAAE,EAAE,eAAe,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IAChF,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IACzC,2EAA2E;IAC3E,yEAAyE;IACzE,oEAAoE;IACpE,wEAAwE;IACxE,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7B,IAAI,CAAC;YACH,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;YACvE,sCAAsC;QACxC,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/core/dist/profiles.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Named-wallet profile storage.
+ *
+ * A "wallet" is a whole config directory. The reserved `default` wallet lives
+ * at the base config dir (zero migration for existing installs); every named
+ * wallet lives under `{base}/profiles/<name>/` with its own `allowance.json`,
+ * `projects.json`, and this module's non-secret `meta.json`.
+ *
+ * Two levels of active state, mirroring the wallet → project model:
+ *   - base `{base}/config.json` `active_wallet`  — which wallet is the default
+ *   - per-wallet `projects.json` `active_project_id` — which project within it
+ *
+ * All writes are atomic (temp-file + rename) and owner-only (0600 files,
+ * 0700 dirs). `meta.json` holds only public/display data (no private key), so
+ * listing and name display never need to load key material.
+ */
+export interface BaseConfig {
+    active_wallet?: string;
+}
+export interface ProfileMeta {
+    name: string;
+    address?: string;
+    /** Cached server-side display label; null when unknown/unset. */
+    label?: string | null;
+    rail?: "x402" | "mpp";
+    created?: string;
+}
+export declare function readBaseConfig(): BaseConfig;
+export declare function writeBaseConfig(cfg: BaseConfig): void;
+/**
+ * The globally-selected default wallet (set via `wallets use`), or the
+ * reserved `default` when unset/invalid. This is precedence rung 4 — below the
+ * flag, env var, and per-directory binding.
+ */
+export declare function getDefaultWallet(): string;
+export declare function setDefaultWallet(name: string): void;
+/** Absolute directory for a wallet. `default` → base dir; named → profiles/<name>. */
+export declare function profileDir(name: string): string;
+/** Create (if needed) a wallet's directory with owner-only (0700) perms. */
+export declare function ensureProfileDir(name: string): string;
+export declare function readMeta(name: string): ProfileMeta | null;
+export declare function writeMeta(name: string, meta: ProfileMeta): void;
+/** True when a wallet's `allowance.json` exists on disk. */
+export declare function profileExists(name: string): boolean;
+/**
+ * All wallet names on disk: `default` (only if a root allowance.json exists)
+ * plus every valid directory under `profiles/`.
+ */
+export declare function listProfileNames(): string[];
+/** Delete a named wallet's directory. Refuses to remove the reserved default. */
+export declare function removeProfile(name: string): void;
+/**
+ * Move a wallet to a new name. Renaming `default` migrates the root-level
+ * credential files into `profiles/<newName>/` (so a named wallet is always a
+ * directory). Does NOT update the `active_wallet` pointer — the caller owns
+ * that orchestration. Throws if the destination already exists or the source
+ * is missing.
+ */
+export declare function renameProfile(oldName: string, newName: string): void;
+//# sourceMappingURL=profiles.d.ts.map

package/core/dist/profiles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profiles.d.ts","sourceRoot":"","sources":["../src/profiles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAqBH,MAAM,WAAW,UAAU;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iEAAiE;IACjE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAqBD,wBAAgB,cAAc,IAAI,UAAU,CAU3C;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,CAErD;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAGzC;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAInD;AAID,sFAAsF;AACtF,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED,4EAA4E;AAC5E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAoBrD;AAMD,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAUzD;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAG/D;AAID,4DAA4D;AAC5D,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,EAAE,CAa3C;AAED,iFAAiF;AACjF,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAKhD;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAuCpE"}

package/core/dist/profiles.js

@@ -0,0 +1,196 @@
+/**
+ * Named-wallet profile storage.
+ *
+ * A "wallet" is a whole config directory. The reserved `default` wallet lives
+ * at the base config dir (zero migration for existing installs); every named
+ * wallet lives under `{base}/profiles/<name>/` with its own `allowance.json`,
+ * `projects.json`, and this module's non-secret `meta.json`.
+ *
+ * Two levels of active state, mirroring the wallet → project model:
+ *   - base `{base}/config.json` `active_wallet`  — which wallet is the default
+ *   - per-wallet `projects.json` `active_project_id` — which project within it
+ *
+ * All writes are atomic (temp-file + rename) and owner-only (0600 files,
+ * 0700 dirs). `meta.json` holds only public/display data (no private key), so
+ * listing and name display never need to load key material.
+ */
+import { readFileSync, writeFileSync, mkdirSync, renameSync, chmodSync, existsSync, readdirSync, rmSync, } from "node:fs";
+import { dirname, join } from "node:path";
+import { randomBytes } from "node:crypto";
+import { getConfigBaseDir, getProfilesDir, DEFAULT_PROFILE, isValidProfileName, } from "./config.js";
+function atomicWrite(p, content, mode) {
+    const dir = dirname(p);
+    mkdirSync(dir, { recursive: true });
+    const tmp = join(dir, `.${randomBytes(4).toString("hex")}.tmp`);
+    writeFileSync(tmp, content, { mode });
+    renameSync(tmp, p);
+    try {
+        chmodSync(p, mode);
+    }
+    catch {
+        /* best-effort on non-POSIX */
+    }
+}
+// --- base config.json (global default wallet pointer) ---
+function baseConfigPath() {
+    return join(getConfigBaseDir(), "config.json");
+}
+export function readBaseConfig() {
+    try {
+        const parsed = JSON.parse(readFileSync(baseConfigPath(), "utf-8"));
+        if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+            return parsed;
+        }
+    }
+    catch {
+        /* missing / unreadable / malformed → empty */
+    }
+    return {};
+}
+export function writeBaseConfig(cfg) {
+    atomicWrite(baseConfigPath(), JSON.stringify(cfg, null, 2), 0o600);
+}
+/**
+ * The globally-selected default wallet (set via `wallets use`), or the
+ * reserved `default` when unset/invalid. This is precedence rung 4 — below the
+ * flag, env var, and per-directory binding.
+ */
+export function getDefaultWallet() {
+    const w = readBaseConfig().active_wallet;
+    return w && (w === DEFAULT_PROFILE || isValidProfileName(w)) ? w : DEFAULT_PROFILE;
+}
+export function setDefaultWallet(name) {
+    const cfg = readBaseConfig();
+    cfg.active_wallet = name;
+    writeBaseConfig(cfg);
+}
+// --- per-profile directory + meta.json ---
+/** Absolute directory for a wallet. `default` → base dir; named → profiles/<name>. */
+export function profileDir(name) {
+    return name === DEFAULT_PROFILE ? getConfigBaseDir() : join(getProfilesDir(), name);
+}
+/** Create (if needed) a wallet's directory with owner-only (0700) perms. */
+export function ensureProfileDir(name) {
+    const dir = profileDir(name);
+    if (name === DEFAULT_PROFILE) {
+        mkdirSync(dir, { recursive: true });
+        return dir;
+    }
+    const profilesRoot = getProfilesDir();
+    mkdirSync(profilesRoot, { recursive: true });
+    try {
+        chmodSync(profilesRoot, 0o700);
+    }
+    catch {
+        /* best-effort */
+    }
+    mkdirSync(dir, { recursive: true });
+    try {
+        chmodSync(dir, 0o700);
+    }
+    catch {
+        /* best-effort */
+    }
+    return dir;
+}
+function metaPath(name) {
+    return join(profileDir(name), "meta.json");
+}
+export function readMeta(name) {
+    try {
+        const parsed = JSON.parse(readFileSync(metaPath(name), "utf-8"));
+        if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+            return parsed;
+        }
+    }
+    catch {
+        /* missing / unreadable / malformed → null */
+    }
+    return null;
+}
+export function writeMeta(name, meta) {
+    ensureProfileDir(name);
+    atomicWrite(metaPath(name), JSON.stringify(meta, null, 2), 0o600);
+}
+// --- enumeration + lifecycle ---
+/** True when a wallet's `allowance.json` exists on disk. */
+export function profileExists(name) {
+    return existsSync(join(profileDir(name), "allowance.json"));
+}
+/**
+ * All wallet names on disk: `default` (only if a root allowance.json exists)
+ * plus every valid directory under `profiles/`.
+ */
+export function listProfileNames() {
+    const names = [];
+    if (existsSync(join(getConfigBaseDir(), "allowance.json"))) {
+        names.push(DEFAULT_PROFILE);
+    }
+    try {
+        for (const entry of readdirSync(getProfilesDir(), { withFileTypes: true })) {
+            if (entry.isDirectory() && isValidProfileName(entry.name))
+                names.push(entry.name);
+        }
+    }
+    catch {
+        /* no profiles dir yet */
+    }
+    return names;
+}
+/** Delete a named wallet's directory. Refuses to remove the reserved default. */
+export function removeProfile(name) {
+    if (name === DEFAULT_PROFILE) {
+        throw new Error("Refusing to remove the reserved 'default' wallet");
+    }
+    rmSync(profileDir(name), { recursive: true, force: true });
+}
+/**
+ * Move a wallet to a new name. Renaming `default` migrates the root-level
+ * credential files into `profiles/<newName>/` (so a named wallet is always a
+ * directory). Does NOT update the `active_wallet` pointer — the caller owns
+ * that orchestration. Throws if the destination already exists or the source
+ * is missing.
+ */
+export function renameProfile(oldName, newName) {
+    if (!isValidProfileName(newName)) {
+        throw new Error(`Invalid wallet name ${JSON.stringify(newName)}.`);
+    }
+    if (newName === oldName)
+        return;
+    const dest = join(getProfilesDir(), newName);
+    if (existsSync(dest)) {
+        throw new Error(`A wallet named '${newName}' already exists.`);
+    }
+    mkdirSync(getProfilesDir(), { recursive: true });
+    try {
+        chmodSync(getProfilesDir(), 0o700);
+    }
+    catch {
+        /* best-effort */
+    }
+    if (oldName === DEFAULT_PROFILE) {
+        if (!profileExists(DEFAULT_PROFILE)) {
+            throw new Error("No 'default' wallet to rename.");
+        }
+        mkdirSync(dest, { recursive: true });
+        try {
+            chmodSync(dest, 0o700);
+        }
+        catch {
+            /* best-effort */
+        }
+        const base = getConfigBaseDir();
+        for (const f of ["allowance.json", "projects.json", "meta.json"]) {
+            const src = join(base, f);
+            if (existsSync(src))
+                renameSync(src, join(dest, f));
+        }
+        return;
+    }
+    const src = join(getProfilesDir(), oldName);
+    if (!existsSync(src)) {
+        throw new Error(`Wallet '${oldName}' not found.`);
+    }
+    renameSync(src, dest);
+}
+//# sourceMappingURL=profiles.js.map

package/core/dist/profiles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profiles.js","sourceRoot":"","sources":["../src/profiles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EACL,YAAY,EACZ,aAAa,EACb,SAAS,EACT,UAAU,EACV,SAAS,EACT,UAAU,EACV,WAAW,EACX,MAAM,GACP,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAerB,SAAS,WAAW,CAAC,CAAS,EAAE,OAAe,EAAE,IAAY;IAC3D,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACvB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChE,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACnB,IAAI,CAAC;QACH,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,8BAA8B;IAChC,CAAC;AACH,CAAC;AAED,2DAA2D;AAE3D,SAAS,cAAc;IACrB,OAAO,IAAI,CAAC,gBAAgB,EAAE,EAAE,aAAa,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,cAAc,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QACnE,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,OAAO,MAAoB,CAAC;QAC9B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,8CAA8C;IAChD,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAe;IAC7C,WAAW,CAAC,cAAc,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACrE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,CAAC,GAAG,cAAc,EAAE,CAAC,aAAa,CAAC;IACzC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,eAAe,IAAI,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC;AACrF,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,GAAG,CAAC,aAAa,GAAG,IAAI,CAAC;IACzB,eAAe,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC;AAED,4CAA4C;AAE5C,sFAAsF;AACtF,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,IAAI,CAAC,CAAC;AACtF,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;QAC7B,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,OAAO,GAAG,CAAC;IACb,CAAC;IACD,MAAM,YAAY,GAAG,cAAc,EAAE,CAAC;IACtC,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC;QACH,SAAS,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;IACD,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,WAAW,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QACjE,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,OAAO,MAAqB,CAAC;QAC/B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,6CAA6C;IAC/C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,IAAiB;IACvD,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvB,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACpE,CAAC;AAED,kCAAkC;AAElC,4DAA4D;AAC5D,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,UAAU,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,gBAAgB,CAAC,CAAC,EAAE,CAAC;QAC3D,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,CAAC;QACH,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,cAAc,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAC3E,IAAI,KAAK,CAAC,WAAW,EAAE,IAAI,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,yBAAyB;IAC3B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,OAAe;IAC5D,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,OAAO,KAAK,OAAO;QAAE,OAAO;IAChC,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,EAAE,EAAE,OAAO,CAAC,CAAC;IAC7C,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,mBAAmB,CAAC,CAAC;IACjE,CAAC;IACD,SAAS,CAAC,cAAc,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,IAAI,CAAC;QACH,SAAS,CAAC,cAAc,EAAE,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;IAED,IAAI,OAAO,KAAK,eAAe,EAAE,CAAC;QAChC,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QACD,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC;YACH,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;QACD,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;QAChC,KAAK,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,eAAe,EAAE,WAAW,CAAC,EAAE,CAAC;YACjE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAC1B,IAAI,UAAU,CAAC,GAAG,CAAC;gBAAE,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,EAAE,EAAE,OAAO,CAAC,CAAC;IAC5C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,WAAW,OAAO,cAAc,CAAC,CAAC;IACpD,CAAC;IACD,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACxB,CAAC"}

package/dist/config.d.ts

@@ -1,2 +1,3 @@
-export { getApiBase, getConfigDir, getKeystorePath, getAllowancePath } from "../core/dist/config.js";
+export { getApiBase, getConfigDir, getKeystorePath, getAllowancePath, getActiveProfile } from "../core/dist/config.js";
+export { readMeta } from "../core/dist/profiles.js";
 //# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACvH,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/config.js

@@ -1,2 +1,3 @@
-export { getApiBase, getConfigDir, getKeystorePath, getAllowancePath } from "../core/dist/config.js";
+export { getApiBase, getConfigDir, getKeystorePath, getAllowancePath, getActiveProfile } from "../core/dist/config.js";
+export { readMeta } from "../core/dist/profiles.js";
 //# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACvH,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/tools/status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../src/tools/status.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,YAAY,IAAK,CAAC;AAE/B,KAAK,SAAS,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAEvF,wBAAsB,YAAY,CAChC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAC3B,OAAO,CAAC,SAAS,CAAC,CA+FpB"}
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../src/tools/status.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,YAAY,IAAK,CAAC;AAE/B,KAAK,SAAS,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAEvF,wBAAsB,YAAY,CAChC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAC3B,OAAO,CAAC,SAAS,CAAC,CAwGpB"}

package/dist/tools/status.js

@@ -1,5 +1,6 @@
 import { readAllowance } from "../allowance.js";
 import { loadKeyStore, getActiveProjectId } from "../keystore.js";
+import { getActiveProfile, readMeta } from "../config.js";
 import { getSdk } from "../sdk.js";
 export const statusSchema = {};
 export async function handleStatus(_args) {
@@ -45,12 +46,19 @@ export async function handleStatus(_args) {
     const store = loadKeyStore();
     const activeId = getActiveProjectId();
     const projects = remote?.projects || Object.keys(store.projects).map((id) => ({ id }));
+    // Active named wallet (from RUN402_WALLET in the MCP server env, else default).
+    const walletName = getActiveProfile();
+    const walletMeta = readMeta(walletName);
+    const walletDisplay = walletMeta?.label && walletMeta.label !== walletName
+        ? `${walletName} (label: ${walletMeta.label})`
+        : walletName;
     // Build summary
     const lines = [
         `## Account Status`,
         ``,
         `| Field | Value |`,
         `|-------|-------|`,
+        `| wallet | ${walletDisplay} |`,
         `| allowance | \`${allowance.address}\` |`,
         `| funded | ${allowance.funded ? "yes" : "no"} |`,
         `| rail | ${allowance.rail || "x402"} |`,

package/dist/tools/status.js.map

@@ -1 +1 @@
-{"version":3,"file":"status.js","sourceRoot":"","sources":["../../src/tools/status.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAEnC,MAAM,CAAC,MAAM,YAAY,GAAG,EAAE,CAAC;AAI/B,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAA4B;IAE5B,0EAA0E;IAC1E,2EAA2E;IAC3E,IAAI,SAAS,CAAC;IACd,IAAI,CAAC;QACH,SAAS,GAAG,aAAa,EAAE,CAAC;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,gCAAgC,GAAG,EAAE;iBAC5C;aACF;YACD,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,2EAA2E;iBAClF;aACF;YACD,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;IAC/C,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IAErB,uEAAuE;IACvE,kCAAkC;IAClC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAChD,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;QACnC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;QAClD,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;KAC5C,CAAC,CAAC;IAEH,iBAAiB;IACjB,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAEvF,gBAAgB;IAChB,MAAM,KAAK,GAAa;QACtB,mBAAmB;QACnB,EAAE;QACF,mBAAmB;QACnB,mBAAmB;QACnB,mBAAmB,SAAS,CAAC,OAAO,MAAM;QAC1C,cAAc,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI;QACjD,YAAY,SAAS,CAAC,IAAI,IAAI,MAAM,IAAI;KACzC,CAAC;IAEF,UAAU;IACV,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACxE,KAAK,CAAC,IAAI,CAAC,gBAAgB,SAAS,cAAc,CAAC,CAAC;IACtD,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO;IACP,IAAI,IAAI,EAAE,IAAI,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACvF,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,KAAK,KAAK,aAAa,MAAM,KAAK,CAAC,CAAC;IACtE,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAClC,CAAC;IAED,WAAW;IACX,KAAK,CAAC,IAAI,CAAC,gBAAgB,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;IAChD,KAAK,CAAC,IAAI,CAAC,cAAc,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC;IAEtE,eAAe;IACf,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC3B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAED,YAAY;IACZ,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;QAChB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;IACnE,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AACjE,CAAC"}
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../../src/tools/status.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAEnC,MAAM,CAAC,MAAM,YAAY,GAAG,EAAE,CAAC;AAI/B,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAA4B;IAE5B,0EAA0E;IAC1E,2EAA2E;IAC3E,IAAI,SAAS,CAAC;IACd,IAAI,CAAC;QACH,SAAS,GAAG,aAAa,EAAE,CAAC;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,gCAAgC,GAAG,EAAE;iBAC5C;aACF;YACD,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,2EAA2E;iBAClF;aACF;YACD,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;IAC/C,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IAErB,uEAAuE;IACvE,kCAAkC;IAClC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAChD,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;QACnC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;QAClD,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;KAC5C,CAAC,CAAC;IAEH,iBAAiB;IACjB,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAEvF,gFAAgF;IAChF,MAAM,UAAU,GAAG,gBAAgB,EAAE,CAAC;IACtC,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;IACxC,MAAM,aAAa,GACjB,UAAU,EAAE,KAAK,IAAI,UAAU,CAAC,KAAK,KAAK,UAAU;QAClD,CAAC,CAAC,GAAG,UAAU,YAAY,UAAU,CAAC,KAAK,GAAG;QAC9C,CAAC,CAAC,UAAU,CAAC;IAEjB,gBAAgB;IAChB,MAAM,KAAK,GAAa;QACtB,mBAAmB;QACnB,EAAE;QACF,mBAAmB;QACnB,mBAAmB;QACnB,cAAc,aAAa,IAAI;QAC/B,mBAAmB,SAAS,CAAC,OAAO,MAAM;QAC1C,cAAc,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI;QACjD,YAAY,SAAS,CAAC,IAAI,IAAI,MAAM,IAAI;KACzC,CAAC;IAEF,UAAU;IACV,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACxE,KAAK,CAAC,IAAI,CAAC,gBAAgB,SAAS,cAAc,CAAC,CAAC;IACtD,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO;IACP,IAAI,IAAI,EAAE,IAAI,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACvF,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,KAAK,KAAK,aAAa,MAAM,KAAK,CAAC,CAAC;IACtE,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAClC,CAAC;IAED,WAAW;IACX,KAAK,CAAC,IAAI,CAAC,gBAAgB,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;IAChD,KAAK,CAAC,IAAI,CAAC,cAAc,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC;IAEtE,eAAe;IACf,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC3B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAED,YAAY;IACZ,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;QAChB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;IACnE,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AACjE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "run402-mcp",
-  "version": "2.26.0",
+  "version": "2.28.0",
   "description": "MCP server for Run402 — AI-native Postgres databases with REST API, auth, storage, and row-level security. Pay with x402 USDC micropayments.",
   "type": "module",
   "main": "dist/index.js",
@@ -29,8 +29,8 @@
     "test:skill": "node --test --import tsx SKILL.test.ts",
     "test:sync": "node --test --import tsx sync.test.ts",
     "test:docs": "npm run check:docs --workspace=@run402/sdk -- --skip-build",
-    "test": "node --experimental-test-module-mocks --test --import tsx SKILL.test.ts sync.test.ts 'core/src/**/*.test.ts' 'sdk/src/**/*.test.ts' 'src/**/*.test.ts' && node --test cli-output-contract.test.mjs cli-e2e.test.mjs cli-help.test.mjs cli-provision-active.test.mjs cli-argv.test.mjs cli-env.test.mjs && npm run test:docs",
-    "test:e2e": "node --test cli-output-contract.test.mjs cli-e2e.test.mjs cli-help.test.mjs cli-provision-active.test.mjs cli-argv.test.mjs cli-env.test.mjs",
+    "test": "node --experimental-test-module-mocks --test --import tsx SKILL.test.ts sync.test.ts 'core/src/**/*.test.ts' 'sdk/src/**/*.test.ts' 'src/**/*.test.ts' && node --test cli-output-contract.test.mjs cli-e2e.test.mjs cli-help.test.mjs cli-provision-active.test.mjs cli-argv.test.mjs cli-env.test.mjs cli-wallets.test.mjs && npm run test:docs",
+    "test:e2e": "node --test cli-output-contract.test.mjs cli-e2e.test.mjs cli-help.test.mjs cli-provision-active.test.mjs cli-argv.test.mjs cli-env.test.mjs cli-wallets.test.mjs",
     "test:help": "node --test cli-help.test.mjs",
     "test:integration": "node --test --import tsx core/src/siwx-integration.integ.ts",
     "test:integration:full": "node --test --import tsx cli-integration.test.ts",