run402 1.57.5 → 1.58.1

package/core-dist/wallet-auth.js

@@ -0,0 +1,62 @@
+/**
+ * Wallet auth helper — generates EIP-191 signature headers for Run402 API.
+ * Uses @noble/curves (lighter than viem) for signing.
+ */
+import { secp256k1 } from "@noble/curves/secp256k1.js";
+import { keccak_256 } from "@noble/hashes/sha3.js";
+import { bytesToHex } from "@noble/hashes/utils.js";
+import { readWallet } from "./wallet.js";
+/**
+ * EIP-191 personal_sign: sign a message with the wallet's private key.
+ */
+function personalSign(privateKeyHex, address, message) {
+    const msgBytes = new TextEncoder().encode(message);
+    const prefix = new TextEncoder().encode(`\x19Ethereum Signed Message:\n${msgBytes.length}`);
+    const prefixed = new Uint8Array(prefix.length + msgBytes.length);
+    prefixed.set(prefix);
+    prefixed.set(msgBytes, prefix.length);
+    const hash = keccak_256(prefixed);
+    const pkHex = privateKeyHex.startsWith("0x")
+        ? privateKeyHex.slice(2)
+        : privateKeyHex;
+    const pkBytes = Uint8Array.from(Buffer.from(pkHex, "hex"));
+    const rawSig = secp256k1.sign(hash, pkBytes);
+    const sig = secp256k1.Signature.fromBytes(rawSig);
+    // Determine recovery bit by trying both and matching the address
+    let recovery = 0;
+    for (const v of [0, 1]) {
+        try {
+            const recovered = sig.addRecoveryBit(v).recoverPublicKey(hash);
+            const pubBytes = recovered.toBytes(false).slice(1); // uncompressed, drop 04 prefix
+            const addrBytes = keccak_256(pubBytes).slice(-20);
+            if ("0x" + bytesToHex(addrBytes) === address.toLowerCase()) {
+                recovery = v;
+                break;
+            }
+        }
+        catch {
+            continue;
+        }
+    }
+    const r = sig.r.toString(16).padStart(64, "0");
+    const s = sig.s.toString(16).padStart(64, "0");
+    const vHex = (recovery + 27).toString(16).padStart(2, "0");
+    return "0x" + r + s + vHex;
+}
+/**
+ * Get wallet auth headers for the Run402 API.
+ * Returns null if no wallet is configured.
+ */
+export function getWalletAuthHeaders(walletPath) {
+    const wallet = readWallet(walletPath);
+    if (!wallet || !wallet.address || !wallet.privateKey)
+        return null;
+    const timestamp = Math.floor(Date.now() / 1000).toString();
+    const signature = personalSign(wallet.privateKey, wallet.address, `run402:${timestamp}`);
+    return {
+        "X-Run402-Wallet": wallet.address,
+        "X-Run402-Signature": signature,
+        "X-Run402-Timestamp": timestamp,
+    };
+}
+//# sourceMappingURL=wallet-auth.js.map

package/core-dist/wallet.js

@@ -0,0 +1,25 @@
+import { readFileSync, writeFileSync, mkdirSync, existsSync, chmodSync, renameSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { randomBytes } from "node:crypto";
+import { getWalletPath } from "./config.js";
+export function readWallet(path) {
+    const p = path ?? getWalletPath();
+    if (!existsSync(p))
+        return null;
+    try {
+        return JSON.parse(readFileSync(p, "utf-8"));
+    }
+    catch {
+        return null;
+    }
+}
+export function saveWallet(data, path) {
+    const p = path ?? getWalletPath();
+    const dir = dirname(p);
+    mkdirSync(dir, { recursive: true });
+    const tmp = join(dir, `.wallet.${randomBytes(4).toString("hex")}.tmp`);
+    writeFileSync(tmp, JSON.stringify(data, null, 2), { mode: 0o600 });
+    renameSync(tmp, p);
+    chmodSync(p, 0o600);
+}
+//# sourceMappingURL=wallet.js.map

package/lib/auth.mjs

@@ -9,25 +9,50 @@ Usage:
 
 Subcommands:
   magic-link --email <addr> --redirect <url> [--project <id>]
-    Send a passwordless login link to the given email. Auto-creates user on first use.
+    Send a passwordless login link. Use --intent invite with a service key-backed project.
 
   verify --token <token> [--project <id>]
     Exchange a magic link token for access_token + refresh_token.
 
+  create-user --email <addr> [--admin <true|false>] [--invite] [--redirect <url>] [--project <id>]
+    Create or update a project auth user with the service key.
+
+  invite-user --email <addr> --redirect <url> [--admin <true|false>] [--project <id>]
+    Create/update a user and send a trusted invite magic link.
+
   set-password --token <bearer> --new <password> [--current <password>] [--project <id>]
     Change, reset, or set a user's password. Requires the user's access_token.
 
-  settings --allow-password-set <true|false> [--project <id>]
+  settings [--allow-password-set <true|false>] [--preferred <method|null>] [--public-signup <policy>] [--require-admin-passkey <true|false>] [--project <id>]
     Update project auth settings (requires service_key).
 
+  passkey-register-options --token <bearer> --app-origin <origin> [--project <id>]
+    Create WebAuthn registration options for the authenticated user.
+
+  passkey-register-verify --token <bearer> --challenge <id> --response <json> [--label <text>] [--project <id>]
+    Verify and store a passkey registration response.
+
+  passkey-login-options --app-origin <origin> [--email <addr>] [--project <id>]
+    Create WebAuthn login options.
+
+  passkey-login-verify --challenge <id> --response <json> [--project <id>]
+    Verify a passkey login response and return session tokens.
+
+  passkeys --token <bearer> [--project <id>]
+    List the authenticated user's passkeys.
+
+  delete-passkey --token <bearer> --id <passkey_id> [--project <id>]
+    Delete one authenticated-user passkey.
+
   providers [--project <id>]
     List available auth providers for the project.
 
 Examples:
   run402 auth magic-link --email user@example.com --redirect https://myapp.run402.com/cb
   run402 auth verify --token abc123def456
+  run402 auth invite-user --email admin@example.com --redirect https://myapp.run402.com/cb --admin true
   run402 auth set-password --token eyJ... --new "new-pass" --current "old-pass"
-  run402 auth settings --allow-password-set true
+  run402 auth settings --preferred passkey --require-admin-passkey true
   run402 auth providers
 `;
 
@@ -40,6 +65,8 @@ Usage:
 Options:
   --email <addr>      Required: recipient email address
   --redirect <url>    Required: URL to redirect to after the user clicks
+  --intent <intent>   signin (default), invite, claim, or recovery
+  --state <value>     Optional client_state preserved through verification
   --project <id>      Project ID (defaults to active project)
 
 Notes:
@@ -48,6 +75,36 @@ Notes:
 Examples:
   run402 auth magic-link --email user@example.com \\
     --redirect https://myapp.run402.com/cb
+`,
+  "create-user": `run402 auth create-user — Create or update an auth user
+
+Usage:
+  run402 auth create-user --email <addr> [options]
+
+Options:
+  --email <addr>      Required: auth user email
+  --admin <bool>      Optional: set project_admin status
+  --invite            Send a trusted invite magic link
+  --redirect <url>    Required when --invite is used
+  --state <value>     Optional client_state for the invite
+  --project <id>      Project ID (defaults to active project)
+
+Examples:
+  run402 auth create-user --email user@example.com
+  run402 auth create-user --email admin@example.com --admin true \\
+    --invite --redirect https://myapp.run402.com/cb
+`,
+  "invite-user": `run402 auth invite-user — Send a trusted auth invite
+
+Usage:
+  run402 auth invite-user --email <addr> --redirect <url> [options]
+
+Options:
+  --email <addr>      Required: auth user email
+  --redirect <url>    Required: allowed auth redirect URL
+  --admin <bool>      Optional: set project_admin status before inviting
+  --state <value>     Optional client_state for the invite
+  --project <id>      Project ID (defaults to active project)
 `,
   verify: `run402 auth verify — Exchange a magic-link token for session tokens
 
@@ -82,18 +139,82 @@ Examples:
   settings: `run402 auth settings — Update project auth settings
 
 Usage:
-  run402 auth settings --allow-password-set <true|false> [options]
+  run402 auth settings [options]
 
 Options:
-  --allow-password-set <true|false>  Required: toggle password-set flow
-  --project <id>                     Project ID (defaults to active project)
+  --allow-password-set <true|false>     Toggle password-set flow
+  --preferred <method|null>             password, magic_link, oauth_google, passkey, or null
+  --public-signup <policy>              open, known_email, or invite_only
+  --require-admin-passkey <true|false>  Require passkey auth for project_admin sessions
+  --project <id>                        Project ID (defaults to active project)
 
 Notes:
   Requires the project's service_key (admin-level).
 
 Examples:
   run402 auth settings --allow-password-set true
-  run402 auth settings --allow-password-set false --project prj_abc123
+  run402 auth settings --preferred passkey --require-admin-passkey true
+`,
+  "passkey-register-options": `run402 auth passkey-register-options — Create passkey registration options
+
+Usage:
+  run402 auth passkey-register-options --token <bearer> --app-origin <origin> [options]
+
+Options:
+  --token <bearer>       Required: authenticated user's access_token
+  --app-origin <origin>  Required: exact app origin for WebAuthn
+  --project <id>         Project ID (defaults to active project)
+`,
+  "passkey-register-verify": `run402 auth passkey-register-verify — Verify passkey registration
+
+Usage:
+  run402 auth passkey-register-verify --token <bearer> --challenge <id> --response <json> [options]
+
+Options:
+  --token <bearer>       Required: authenticated user's access_token
+  --challenge <id>       Required: challenge_id returned by passkey-register-options
+  --response <json>      Required: browser PublicKeyCredential JSON
+  --label <text>         Optional passkey label
+  --project <id>         Project ID (defaults to active project)
+`,
+  "passkey-login-options": `run402 auth passkey-login-options — Create passkey login options
+
+Usage:
+  run402 auth passkey-login-options --app-origin <origin> [options]
+
+Options:
+  --app-origin <origin>  Required: exact app origin for WebAuthn
+  --email <addr>         Optional email hint
+  --project <id>         Project ID (defaults to active project)
+`,
+  "passkey-login-verify": `run402 auth passkey-login-verify — Verify passkey login
+
+Usage:
+  run402 auth passkey-login-verify --challenge <id> --response <json> [options]
+
+Options:
+  --challenge <id>       Required: challenge_id returned by passkey-login-options
+  --response <json>      Required: browser PublicKeyCredential JSON
+  --project <id>         Project ID (defaults to active project)
+`,
+  passkeys: `run402 auth passkeys — List passkeys
+
+Usage:
+  run402 auth passkeys --token <bearer> [options]
+
+Options:
+  --token <bearer>       Required: authenticated user's access_token
+  --project <id>         Project ID (defaults to active project)
+`,
+  "delete-passkey": `run402 auth delete-passkey — Delete a passkey
+
+Usage:
+  run402 auth delete-passkey --token <bearer> --id <passkey_id> [options]
+
+Options:
+  --token <bearer>       Required: authenticated user's access_token
+  --id <passkey_id>      Required: passkey ID to delete
+  --project <id>         Project ID (defaults to active project)
 `,
   providers: `run402 auth providers — List available auth providers
 
@@ -116,6 +237,40 @@ function parseFlag(args, flag) {
   return null;
 }
 
+function parseOptionalBool(args, flag) {
+  const value = parseFlag(args, flag);
+  if (value === null) {
+    if (args.includes(flag)) {
+      fail({ code: "BAD_USAGE", message: `Missing ${flag} <true|false>` });
+    }
+    return undefined;
+  }
+  if (value !== "true" && value !== "false") {
+    fail({
+      code: "BAD_FLAG",
+      message: `${flag} must be 'true' or 'false'`,
+      hint: "Use the literal strings 'true' or 'false'.",
+    });
+  }
+  return value === "true";
+}
+
+function parseJsonFlag(args, flag) {
+  const value = parseFlag(args, flag);
+  if (!value) {
+    fail({ code: "BAD_USAGE", message: `Missing ${flag} <json>` });
+  }
+  try {
+    return JSON.parse(value);
+  } catch (err) {
+    fail({
+      code: "BAD_JSON",
+      message: `${flag} must be valid JSON`,
+      hint: err instanceof Error ? err.message : undefined,
+    });
+  }
+}
+
 async function magicLink(args) {
   const email = parseFlag(args, "--email");
   const redirect = parseFlag(args, "--redirect");
@@ -129,8 +284,74 @@ async function magicLink(args) {
   }
 
   try {
-    await getSdk().auth.requestMagicLink(projectId, { email, redirectUrl: redirect });
-    console.log(JSON.stringify({ status: "ok", email, redirect_url: redirect }));
+    const intent = parseFlag(args, "--intent");
+    if (intent && !["signin", "invite", "claim", "recovery"].includes(intent)) {
+      fail({ code: "BAD_FLAG", message: "--intent must be signin, invite, claim, or recovery" });
+    }
+    const state = parseFlag(args, "--state");
+    await getSdk().auth.requestMagicLink(projectId, {
+      email,
+      redirectUrl: redirect,
+      intent: intent ?? undefined,
+      clientState: state ?? undefined,
+    });
+    console.log(JSON.stringify({ status: "ok", email, redirect_url: redirect, intent: intent || "signin" }));
+  } catch (err) {
+    reportSdkError(err);
+  }
+}
+
+async function createUser(args) {
+  const email = parseFlag(args, "--email");
+  const projectId = resolveProjectId(parseFlag(args, "--project"));
+  const isAdmin = parseOptionalBool(args, "--admin");
+  const sendInvite = args.includes("--invite");
+  const redirectUrl = parseFlag(args, "--redirect");
+  const clientState = parseFlag(args, "--state");
+
+  if (!email) {
+    fail({ code: "BAD_USAGE", message: "Missing --email" });
+  }
+  if (sendInvite && !redirectUrl) {
+    fail({ code: "BAD_USAGE", message: "Missing --redirect <url> when --invite is used" });
+  }
+
+  try {
+    const data = await getSdk().auth.createUser(projectId, {
+      email,
+      isAdmin,
+      sendInvite,
+      redirectUrl: redirectUrl ?? undefined,
+      clientState: clientState ?? undefined,
+    });
+    console.log(JSON.stringify({ status: "ok", ...data }));
+  } catch (err) {
+    reportSdkError(err);
+  }
+}
+
+async function inviteUser(args) {
+  const email = parseFlag(args, "--email");
+  const redirectUrl = parseFlag(args, "--redirect");
+  const projectId = resolveProjectId(parseFlag(args, "--project"));
+  const isAdmin = parseOptionalBool(args, "--admin");
+  const clientState = parseFlag(args, "--state");
+
+  if (!email) {
+    fail({ code: "BAD_USAGE", message: "Missing --email" });
+  }
+  if (!redirectUrl) {
+    fail({ code: "BAD_USAGE", message: "Missing --redirect <url>" });
+  }
+
+  try {
+    const data = await getSdk().auth.inviteUser(projectId, {
+      email,
+      redirectUrl,
+      isAdmin,
+      clientState: clientState ?? undefined,
+    });
+    console.log(JSON.stringify({ status: "ok", ...data }));
   } catch (err) {
     reportSdkError(err);
   }
@@ -178,32 +399,147 @@ async function setPassword(args) {
 }
 
 async function settings(args) {
-  const allowPasswordSet = parseFlag(args, "--allow-password-set");
   const projectId = resolveProjectId(parseFlag(args, "--project"));
-
-  if (allowPasswordSet === null) {
+  const allow = parseOptionalBool(args, "--allow-password-set");
+  const requireAdminPasskey = parseOptionalBool(args, "--require-admin-passkey");
+  const preferredRaw = parseFlag(args, "--preferred");
+  const publicSignup = parseFlag(args, "--public-signup");
+
+  if (
+    allow === undefined &&
+    requireAdminPasskey === undefined &&
+    preferredRaw === null &&
+    publicSignup === null
+  ) {
     fail({
       code: "BAD_USAGE",
-      message: "Missing --allow-password-set <true|false>",
+      message: "Set at least one auth setting flag",
     });
   }
-  // Reject anything that isn't literally "true" or "false". Without this guard,
-  // the previous `=== "true"` coercion silently turned every other input
-  // (including "1", "yes", "TRUE", "bogus") into `false` and printed
-  // `{"status":"ok"}`, giving the user the OPPOSITE of what they likely
-  // intended for this security-adjacent flag. See GH-204.
-  if (allowPasswordSet !== "true" && allowPasswordSet !== "false") {
+  if (
+    preferredRaw !== null &&
+    !["password", "magic_link", "oauth_google", "passkey", "null"].includes(preferredRaw)
+  ) {
     fail({
       code: "BAD_FLAG",
-      message: "--allow-password-set must be 'true' or 'false'",
-      hint: "Use the literal strings 'true' or 'false'.",
+      message: "--preferred must be password, magic_link, oauth_google, passkey, or null",
+    });
+  }
+  if (publicSignup !== null && !["open", "known_email", "invite_only"].includes(publicSignup)) {
+    fail({
+      code: "BAD_FLAG",
+      message: "--public-signup must be open, known_email, or invite_only",
     });
   }
 
-  const allow = allowPasswordSet === "true";
   try {
-    await getSdk().auth.settings(projectId, { allow_password_set: allow });
-    console.log(JSON.stringify({ status: "ok", allow_password_set: allow }));
+    const patch = {
+      allow_password_set: allow,
+      preferred_sign_in_method: preferredRaw === "null" ? null : preferredRaw ?? undefined,
+      public_signup: publicSignup ?? undefined,
+      require_passkey_for_project_admin: requireAdminPasskey,
+    };
+    const data = await getSdk().auth.settings(projectId, patch);
+    console.log(JSON.stringify({ status: "ok", ...patch, ...data }));
+  } catch (err) {
+    reportSdkError(err);
+  }
+}
+
+async function passkeyRegisterOptions(args) {
+  const accessToken = parseFlag(args, "--token");
+  const appOrigin = parseFlag(args, "--app-origin");
+  const projectId = resolveProjectId(parseFlag(args, "--project"));
+  if (!accessToken) fail({ code: "BAD_USAGE", message: "Missing --token <bearer_token>" });
+  if (!appOrigin) fail({ code: "BAD_USAGE", message: "Missing --app-origin <origin>" });
+  try {
+    const data = await getSdk().auth.createPasskeyRegistrationOptions(projectId, {
+      accessToken,
+      appOrigin,
+    });
+    console.log(JSON.stringify(data, null, 2));
+  } catch (err) {
+    reportSdkError(err);
+  }
+}
+
+async function passkeyRegisterVerify(args) {
+  const accessToken = parseFlag(args, "--token");
+  const challengeId = parseFlag(args, "--challenge");
+  const label = parseFlag(args, "--label");
+  const projectId = resolveProjectId(parseFlag(args, "--project"));
+  if (!accessToken) fail({ code: "BAD_USAGE", message: "Missing --token <bearer_token>" });
+  if (!challengeId) fail({ code: "BAD_USAGE", message: "Missing --challenge <id>" });
+  const response = parseJsonFlag(args, "--response");
+  try {
+    const data = await getSdk().auth.verifyPasskeyRegistration(projectId, {
+      accessToken,
+      challengeId,
+      response,
+      label: label ?? undefined,
+    });
+    console.log(JSON.stringify({ status: "ok", ...data }));
+  } catch (err) {
+    reportSdkError(err);
+  }
+}
+
+async function passkeyLoginOptions(args) {
+  const appOrigin = parseFlag(args, "--app-origin");
+  const email = parseFlag(args, "--email");
+  const projectId = resolveProjectId(parseFlag(args, "--project"));
+  if (!appOrigin) fail({ code: "BAD_USAGE", message: "Missing --app-origin <origin>" });
+  try {
+    const data = await getSdk().auth.createPasskeyLoginOptions(projectId, {
+      appOrigin,
+      email: email ?? undefined,
+    });
+    console.log(JSON.stringify(data, null, 2));
+  } catch (err) {
+    reportSdkError(err);
+  }
+}
+
+async function passkeyLoginVerify(args) {
+  const challengeId = parseFlag(args, "--challenge");
+  const projectId = resolveProjectId(parseFlag(args, "--project"));
+  if (!challengeId) fail({ code: "BAD_USAGE", message: "Missing --challenge <id>" });
+  const response = parseJsonFlag(args, "--response");
+  try {
+    const data = await getSdk().auth.verifyPasskeyLogin(projectId, {
+      challengeId,
+      response,
+    });
+    console.log(JSON.stringify({ status: "ok", ...data }));
+  } catch (err) {
+    reportSdkError(err);
+  }
+}
+
+async function passkeys(args) {
+  const accessToken = parseFlag(args, "--token");
+  const projectId = resolveProjectId(parseFlag(args, "--project"));
+  if (!accessToken) fail({ code: "BAD_USAGE", message: "Missing --token <bearer_token>" });
+  try {
+    const data = await getSdk().auth.listPasskeys(projectId, { accessToken });
+    console.log(JSON.stringify(data, null, 2));
+  } catch (err) {
+    reportSdkError(err);
+  }
+}
+
+async function deletePasskey(args) {
+  const accessToken = parseFlag(args, "--token");
+  const passkeyId = parseFlag(args, "--id");
+  const projectId = resolveProjectId(parseFlag(args, "--project"));
+  if (!accessToken) fail({ code: "BAD_USAGE", message: "Missing --token <bearer_token>" });
+  if (!passkeyId) fail({ code: "BAD_USAGE", message: "Missing --id <passkey_id>" });
+  try {
+    await getSdk().auth.deletePasskey(projectId, {
+      accessToken,
+      passkeyId,
+    });
+    console.log(JSON.stringify({ status: "ok", passkey_id: passkeyId }));
   } catch (err) {
     reportSdkError(err);
   }
@@ -237,8 +573,16 @@ export async function run(sub, args) {
   switch (sub) {
     case "magic-link": await magicLink(args); break;
     case "verify": await verify(args); break;
+    case "create-user": await createUser(args); break;
+    case "invite-user": await inviteUser(args); break;
     case "set-password": await setPassword(args); break;
     case "settings": await settings(args); break;
+    case "passkey-register-options": await passkeyRegisterOptions(args); break;
+    case "passkey-register-verify": await passkeyRegisterVerify(args); break;
+    case "passkey-login-options": await passkeyLoginOptions(args); break;
+    case "passkey-login-verify": await passkeyLoginVerify(args); break;
+    case "passkeys": await passkeys(args); break;
+    case "delete-passkey": await deletePasskey(args); break;
     case "providers": await providers(args); break;
     default:
       console.error(`Unknown subcommand: ${sub}\n`);

package/lib/projects.mjs

@@ -25,7 +25,7 @@ Subcommands:
   apply-expose [id] --file <path>         Apply a manifest from a JSON file
   get-expose   [id]                       Get the current authorization manifest
   delete [id] --confirm                   Immediately and irreversibly delete a project (cascade purge) and remove from local state. Requires --confirm.
-  pin   [id]                              Pin a project (admin only; project owners get 403 admin_required)
+  pin   [id]                              Pin a project (admin only; uses admin allowance wallet)
   promote-user [id] <email>               Promote a user to project_admin role
   demote-user  [id] <email>               Demote a user from project_admin role
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "run402",
-  "version": "1.57.5",
+  "version": "1.58.1",
   "description": "CLI for Run402 — provision Postgres databases, deploy static sites, generate images, and manage wallets via x402 and MPP micropayments.",
   "type": "module",
   "bin": {

package/sdk/core-dist/wallet-auth.js

@@ -0,0 +1,62 @@
+/**
+ * Wallet auth helper — generates EIP-191 signature headers for Run402 API.
+ * Uses @noble/curves (lighter than viem) for signing.
+ */
+import { secp256k1 } from "@noble/curves/secp256k1.js";
+import { keccak_256 } from "@noble/hashes/sha3.js";
+import { bytesToHex } from "@noble/hashes/utils.js";
+import { readWallet } from "./wallet.js";
+/**
+ * EIP-191 personal_sign: sign a message with the wallet's private key.
+ */
+function personalSign(privateKeyHex, address, message) {
+    const msgBytes = new TextEncoder().encode(message);
+    const prefix = new TextEncoder().encode(`\x19Ethereum Signed Message:\n${msgBytes.length}`);
+    const prefixed = new Uint8Array(prefix.length + msgBytes.length);
+    prefixed.set(prefix);
+    prefixed.set(msgBytes, prefix.length);
+    const hash = keccak_256(prefixed);
+    const pkHex = privateKeyHex.startsWith("0x")
+        ? privateKeyHex.slice(2)
+        : privateKeyHex;
+    const pkBytes = Uint8Array.from(Buffer.from(pkHex, "hex"));
+    const rawSig = secp256k1.sign(hash, pkBytes);
+    const sig = secp256k1.Signature.fromBytes(rawSig);
+    // Determine recovery bit by trying both and matching the address
+    let recovery = 0;
+    for (const v of [0, 1]) {
+        try {
+            const recovered = sig.addRecoveryBit(v).recoverPublicKey(hash);
+            const pubBytes = recovered.toBytes(false).slice(1); // uncompressed, drop 04 prefix
+            const addrBytes = keccak_256(pubBytes).slice(-20);
+            if ("0x" + bytesToHex(addrBytes) === address.toLowerCase()) {
+                recovery = v;
+                break;
+            }
+        }
+        catch {
+            continue;
+        }
+    }
+    const r = sig.r.toString(16).padStart(64, "0");
+    const s = sig.s.toString(16).padStart(64, "0");
+    const vHex = (recovery + 27).toString(16).padStart(2, "0");
+    return "0x" + r + s + vHex;
+}
+/**
+ * Get wallet auth headers for the Run402 API.
+ * Returns null if no wallet is configured.
+ */
+export function getWalletAuthHeaders(walletPath) {
+    const wallet = readWallet(walletPath);
+    if (!wallet || !wallet.address || !wallet.privateKey)
+        return null;
+    const timestamp = Math.floor(Date.now() / 1000).toString();
+    const signature = personalSign(wallet.privateKey, wallet.address, `run402:${timestamp}`);
+    return {
+        "X-Run402-Wallet": wallet.address,
+        "X-Run402-Signature": signature,
+        "X-Run402-Timestamp": timestamp,
+    };
+}
+//# sourceMappingURL=wallet-auth.js.map

package/sdk/core-dist/wallet.js

@@ -0,0 +1,25 @@
+import { readFileSync, writeFileSync, mkdirSync, existsSync, chmodSync, renameSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { randomBytes } from "node:crypto";
+import { getWalletPath } from "./config.js";
+export function readWallet(path) {
+    const p = path ?? getWalletPath();
+    if (!existsSync(p))
+        return null;
+    try {
+        return JSON.parse(readFileSync(p, "utf-8"));
+    }
+    catch {
+        return null;
+    }
+}
+export function saveWallet(data, path) {
+    const p = path ?? getWalletPath();
+    const dir = dirname(p);
+    mkdirSync(dir, { recursive: true });
+    const tmp = join(dir, `.wallet.${randomBytes(4).toString("hex")}.tmp`);
+    writeFileSync(tmp, JSON.stringify(data, null, 2), { mode: 0o600 });
+    renameSync(tmp, p);
+    chmodSync(p, 0o600);
+}
+//# sourceMappingURL=wallet.js.map