tenjin-cli 0.1.0-alpha.1 → 0.1.0-alpha.2

package/dist/{chunk-EXBMF5X7.js → chunk-Z6MFJV5Z.js}

@@ -1,4 +1,25 @@
 import { createRequire as __tenjinCreateRequire } from 'node:module'; const require = __tenjinCreateRequire(import.meta.url);
+import {
+  PRIVATE_KEY_RE,
+  readWalletRecord,
+  walletFileMode,
+  writeWalletRecord
+} from "./chunk-YN5SHIXQ.js";
+import {
+  withFileLock
+} from "./chunk-YBMMV4Y4.js";
+import {
+  evaluateSpendPolicy
+} from "./chunk-UO22YNY4.js";
+import {
+  writeFileAtomic
+} from "./chunk-MUBUQVC3.js";
+import {
+  CliError,
+  external_exports,
+  passphraseBlobPath,
+  walletPath
+} from "./chunk-OYMYCW7J.js";
 import {
   hashAuthorization,
   hashMessage,
@@ -7,12 +28,12 @@ import {
   publicKeyToAddress,
   serializeSignature,
   serializeTransaction
-} from "./chunk-T4LKNY7T.js";
+} from "./chunk-NCE5NSN6.js";
 import {
   hmac,
   secp256k1,
   sha256
-} from "./chunk-Q53IYV2G.js";
+} from "./chunk-QVX5MWJZ.js";
 import {
   InvalidAddressError,
   concat3 as concat,
@@ -27,7 +48,7 @@ import {
   slice3 as slice,
   toHex,
   toHex2
-} from "./chunk-BRJHUQSY.js";
+} from "./chunk-YALGASEU.js";
 import {
   ahash,
   anumber,
@@ -39,21 +60,7 @@ import {
   rotl,
   swap32IfBE,
   u32
-} from "./chunk-CUWUHTIL.js";
-import {
-  PRIVATE_KEY_RE,
-  readWalletRecord,
-  walletFileMode,
-  writeWalletRecord
-} from "./chunk-DXPYFVKG.js";
-import {
-  writeFileAtomic
-} from "./chunk-ZPZFPVDN.js";
-import {
-  CliError,
-  passphraseBlobPath,
-  walletPath
-} from "./chunk-YG2DO46P.js";
+} from "./chunk-5CLSD5YN.js";
 
 // node_modules/.pnpm/@noble+hashes@1.8.0/node_modules/@noble/hashes/esm/pbkdf2.js
 function pbkdf2Init(hash, _password, _salt, _opts) {
@@ -1166,11 +1173,134 @@ function walletRecord(address, keystore) {
   };
 }
 
+// src/lib/wallet/spend.ts
+import { mkdir, readFile as readFile2 } from "fs/promises";
+import { randomUUID } from "crypto";
+import { join } from "path";
+var DEFAULT_WINDOW_MS = 864e5;
+var RESERVATION_TTL_MS = 6e5;
+var ReservationSchema = external_exports.object({
+  id: external_exports.string(),
+  amountAtomic: external_exports.string().regex(/^\d+$/),
+  atMs: external_exports.number()
+});
+var LedgerSchema = external_exports.object({
+  schemaVersion: external_exports.literal(2),
+  windowStartMs: external_exports.number(),
+  committedAtomic: external_exports.string().regex(/^\d+$/),
+  reservations: external_exports.array(ReservationSchema)
+});
+function emptyLedger(nowMs) {
+  return { schemaVersion: 2, windowStartMs: nowMs, committedAtomic: "0", reservations: [] };
+}
+function createLocalSpendAuthorizer(deps) {
+  const windowMs = deps.windowMs ?? DEFAULT_WINDOW_MS;
+  const now = deps.now ?? Date.now;
+  const path = join(deps.dir, "session.json");
+  const lockPath = `${path}.lock`;
+  const freshen = (ledger, nowMs) => {
+    if (ledger === null || nowMs - ledger.windowStartMs >= windowMs) return emptyLedger(nowMs);
+    return {
+      ...ledger,
+      reservations: ledger.reservations.filter((r) => nowMs - r.atMs < RESERVATION_TTL_MS)
+    };
+  };
+  const spentOf = (ledger) => ledger.reservations.reduce(
+    (sum, r) => sum + BigInt(r.amountAtomic),
+    BigInt(ledger.committedAtomic)
+  );
+  const persist = async (ledger) => {
+    await writeFileAtomic(path, `${JSON.stringify(ledger, null, 2)}
+`, {
+      mode: 384,
+      dirMode: 448
+    });
+  };
+  async function withLedger(fn) {
+    await mkdir(deps.dir, { recursive: true, mode: 448 });
+    return withFileLock(lockPath, async () => {
+      const nowMs = now();
+      const ledger = freshen(await readLedger(path), nowMs);
+      return fn(ledger, nowMs);
+    });
+  }
+  return {
+    policyEnforcement: "client-only",
+    async authorize(req) {
+      return withLedger(async (ledger) => {
+        const sessionSpentAtomic = spentOf(ledger);
+        const evaluation = evaluateSpendPolicy(deps.policy, {
+          amountAtomic: req.amountAtomic,
+          creator: req.creator,
+          ...req.maxPriceAtomic !== void 0 ? { maxPriceAtomic: req.maxPriceAtomic } : {},
+          sessionSpentAtomic
+        });
+        const base = {
+          ...evaluation,
+          amountAtomic: req.amountAtomic,
+          sessionSpentAtomic,
+          sessionBudgetAtomic: deps.policy.sessionBudgetAtomic,
+          policyEnforcement: "client-only"
+        };
+        if (evaluation.decision === "deny" || deps.policy.sessionBudgetAtomic === 0n) {
+          return base;
+        }
+        const reservation = {
+          id: randomUUID(),
+          amountAtomic: req.amountAtomic.toString(),
+          atMs: now()
+        };
+        await persist({ ...ledger, reservations: [...ledger.reservations, reservation] });
+        return { ...base, reservationId: reservation.id };
+      });
+    },
+    async commit(reservationId, amountAtomic) {
+      await withLedger(async (ledger) => {
+        const reservation = reservationId !== void 0 ? ledger.reservations.find((r) => r.id === reservationId) : void 0;
+        const settled = reservation !== void 0 ? BigInt(reservation.amountAtomic) : amountAtomic;
+        await persist({
+          ...ledger,
+          committedAtomic: (BigInt(ledger.committedAtomic) + settled).toString(),
+          reservations: reservationId !== void 0 ? ledger.reservations.filter((r) => r.id !== reservationId) : ledger.reservations
+        });
+      });
+    },
+    async release(reservationId) {
+      if (reservationId === void 0) return;
+      await withLedger(async (ledger) => {
+        if (!ledger.reservations.some((r) => r.id === reservationId)) return;
+        await persist({
+          ...ledger,
+          reservations: ledger.reservations.filter((r) => r.id !== reservationId)
+        });
+      });
+    }
+  };
+}
+async function readLedger(path) {
+  let raw;
+  try {
+    raw = await readFile2(path, "utf8");
+  } catch {
+    return null;
+  }
+  try {
+    const parsed = LedgerSchema.safeParse(JSON.parse(raw));
+    return parsed.success ? parsed.data : null;
+  } catch {
+    return null;
+  }
+}
+
 // src/lib/wallet/index.ts
 function resolveWalletProvider(ctx, opts = {}) {
   if (opts.provider !== void 0) return opts.provider;
   return createLocalProvider({ dir: ctx.dataDir, env: process.env });
 }
+function resolveSpendAuthorizer(ctx, policy, opts = {}) {
+  if (opts.authorizer !== void 0) return opts.authorizer;
+  return createLocalSpendAuthorizer({ dir: ctx.dataDir, policy });
+}
 async function describeWallet(provider) {
   try {
     return await provider.describe();
@@ -1187,7 +1317,9 @@ async function describeWallet(provider) {
 export {
   resolvePassphraseForCreate,
   createLocalWallet,
+  createLocalSpendAuthorizer,
   resolveWalletProvider,
+  resolveSpendAuthorizer,
   describeWallet
 };
 /*! Bundled license information:
@@ -1195,4 +1327,4 @@ export {
 @noble/ciphers/esm/utils.js:
   (*! noble-ciphers - MIT License (c) 2023 Paul Miller (paulmillr.com) *)
 */
-//# sourceMappingURL=chunk-EXBMF5X7.js.map
+//# sourceMappingURL=chunk-Z6MFJV5Z.js.map