thaifi-wallet-cli 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ThaiFi
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,54 @@
+# ThaiFi Wallet CLI (`thaifi`)
+
+Command-line wallet for AI agents on the **ThaiFi** chain (chain 17) — pairs with
+**wallet.thaifi.com** and signs with an on-chain **access key** whose spending
+limit is enforced by the chain itself (AccountKeychain precompile, TIP-1011).
+
+Agent setup guide for AI agents: https://wallet.thaifi.com/SKILL.md
+
+## How it works
+
+```
+~/.thaifi/store.json (agent P256 key, chmod 600)
+        │  1. thaifi login → POST /api/agent/pair/start {keyId, name}
+        ▼
+wallet.thaifi.com/pair?id=…&code=…   ← user approves (passkey / PIN)
+        │  2. web sends authorizeKey(keyId, P256, expiry, limits) on-chain
+        ▼
+access key authorized on-chain → the CLI signs transactions directly,
+spending up to the limit (pathUSD), fees paid from the user's balance.
+```
+
+- Non-custodial: the private key never leaves the machine; the web wallet
+  never sees it.
+- One wallet per account: revoking an app on the web cuts access immediately.
+- Limits are on-chain: `SpendingLimitExceeded` when exceeded; keys expire.
+
+## Install / run
+
+```bash
+npm install
+npx tsx src/index.ts --help        # dev
+npm run build && node dist/index.js # compiled
+```
+
+Set `THAIFI_WALLET_URL` / `THAIFI_RPC_URL` to target other deployments.
+
+## Commands
+
+| Command | Description |
+|---|---|
+| `login [--no-browser]` | Pair with the web wallet (approval URL for headless machines) |
+| `whoami` | Account, agent key, balance, remaining spend limit |
+| `balance [--token <addr>]` | TIP-20 balance |
+| `transfer <to> <amount> [--token <addr>]` | Send tokens (limit enforced on-chain) |
+| `request <url> [-X -H -d --json --dry-run --max-spend]` | HTTP with automatic x402/MPP payment |
+| `services [--search q]` | Discover services from the MPP registry (`THAIFI_MPP_REGISTRY`) |
+| `logout` | Remove the local key (revoke on-chain from the web wallet) |
+
+## Security notes
+
+- The recovery password / passphrase is never involved here — the agent key is
+  authorized by the account owner via the web wallet.
+- Losing the machine = losing the agent key: re-pair a new key from the web
+  wallet and revoke the old one under Authorized Apps.

package/dist/chain.js

@@ -0,0 +1,58 @@
+/** ThaiFi chain client (viem/tempo) for the agent access key. */
+import { http, defineChain } from "viem";
+import { createClient, tempoActions } from "viem/tempo";
+import { Actions, Account, Addresses, Chain as TempoChains } from "viem/tempo";
+import { CONFIG } from "./config.js";
+/** ThaiFi chain 17 — clone of the tempo chain definition (formatters/serializers) with our ids. */
+export const thaiFi = defineChain({
+    ...TempoChains.mainnet,
+    id: CONFIG.chainId,
+    name: "ThaiFi",
+    network: "thaifi",
+    nativeCurrency: { name: "pathUSD", symbol: "pathUSD", decimals: 6 },
+    rpcUrls: { default: { http: [CONFIG.rpcUrl] } },
+    blockExplorers: {
+        default: { name: "ThaiFi Explorer", url: "https://exp.thaifi.com" },
+    },
+});
+/** The account keychain precompile (access keys, TIP-1011). */
+export const accountKeychain = Addresses.accountKeychain;
+export function createAgentClient(store) {
+    if (!store.userAddress)
+        throw new Error("Not paired yet — run `thaifi login` first.");
+    const account = Account.fromP256(store.privateKey, {
+        access: store.userAddress,
+    });
+    return createClient({
+        account,
+        chain: thaiFi,
+        feeToken: CONFIG.pathUsd,
+        transport: http(store.rpcUrl),
+    }).extend(tempoActions());
+}
+export async function pathUsdBalance(client, address) {
+    return client.readContract({
+        address: CONFIG.pathUsd,
+        abi: [
+            {
+                name: "balanceOf",
+                type: "function",
+                stateMutability: "view",
+                inputs: [{ type: "address" }],
+                outputs: [{ type: "uint256" }],
+            },
+        ],
+        functionName: "balanceOf",
+        args: [address],
+    });
+}
+/** Remaining spend allowance of the agent key (pathUSD, raw units). */
+export async function remainingLimit(client, userAddress, keyId) {
+    const res = await client.accessKey.getRemainingLimit({
+        account: userAddress,
+        accessKey: keyId,
+        token: CONFIG.pathUsd,
+    });
+    return res.remaining;
+}
+export { Actions };

package/dist/commands/balance.js

@@ -0,0 +1,48 @@
+/** `thaifi balance [token]` — TIP-20 balance of the paired account. */
+import { loadStore } from "../store.js";
+import { createAgentClient } from "../chain.js";
+import { CONFIG, PATHUSD_DECIMALS } from "../config.js";
+export async function balance(options = {}) {
+    const store = loadStore();
+    if (!store?.userAddress) {
+        console.error("Not paired. Run `thaifi login` first.");
+        process.exitCode = 1;
+        return;
+    }
+    const token = (options.token ?? CONFIG.pathUsd);
+    const client = createAgentClient(store);
+    const [balance, symbol] = await Promise.all([
+        client.readContract({
+            address: token,
+            abi: [
+                {
+                    name: "balanceOf",
+                    type: "function",
+                    stateMutability: "view",
+                    inputs: [{ type: "address" }],
+                    outputs: [{ type: "uint256" }],
+                },
+            ],
+            functionName: "balanceOf",
+            args: [store.userAddress],
+        }),
+        client
+            .readContract({
+            address: token,
+            abi: [
+                {
+                    name: "symbol",
+                    type: "function",
+                    stateMutability: "view",
+                    inputs: [],
+                    outputs: [{ type: "string" }],
+                },
+            ],
+            functionName: "symbol",
+        })
+            .catch(() => "TOKEN"),
+    ]);
+    const value = Number(balance) / 10 ** PATHUSD_DECIMALS;
+    console.log(symbol + " " + value.toLocaleString("en-US", { maximumFractionDigits: 6 }));
+    console.log("(" + store.userAddress + ")");
+}

package/dist/commands/login.js

@@ -0,0 +1,102 @@
+/** `thaifi login` — pair this CLI with a wallet.thaifi.com account. */
+import { hostname } from "node:os";
+import { generatePrivateKey } from "viem/accounts";
+import { Account } from "viem/tempo";
+import { CONFIG } from "../config.js";
+import { loadStore, saveStore, storePath } from "../store.js";
+const signatureType = "p256";
+async function openBrowser(url) {
+    const { exec } = await import("node:child_process");
+    const cmd = process.platform === "darwin"
+        ? `open "${url}"`
+        : process.platform === "win32"
+            ? `start "" "${url}"`
+            : `xdg-open "${url}"`;
+    exec(cmd, () => undefined);
+}
+export async function login(options = {}) {
+    if (loadStore()) {
+        console.error("Already paired (found " + storePath + "). Run `thaifi logout` first to re-pair.");
+        process.exitCode = 1;
+        return;
+    }
+    // 1. Generate the agent access key (P256 — never leaves this machine).
+    const privateKey = generatePrivateKey();
+    const name = hostname();
+    const keyId = Account.fromP256(privateKey).address;
+    console.log("Agent key:  " + keyId);
+    console.log("Machine:    " + name);
+    console.log("");
+    // 2. Start pairing with the web wallet.
+    const startRes = await fetch(CONFIG.walletUrl + "/api/agent/pair/start", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ keyId, name, signatureType }),
+    });
+    if (!startRes.ok) {
+        console.error("Pairing failed to start: HTTP " + startRes.status + " " + (await startRes.text()));
+        process.exitCode = 1;
+        return;
+    }
+    const { pairingId, code } = (await startRes.json());
+    const url = `${CONFIG.walletUrl}/pair?id=${pairingId}&code=${code}`;
+    console.log("Authorize this CLI in the ThaiFi Wallet:");
+    console.log("");
+    console.log("  " + url);
+    console.log("");
+    console.log("Pairing code: " + code);
+    if (options.browser !== false) {
+        await openBrowser(url);
+        console.log("(opened in your browser — use --no-browser on a headless machine)");
+    }
+    console.log("");
+    console.log("Waiting for approval (timeout " + CONFIG.pollTimeoutMs / 60000 + " min)…");
+    // 3. Poll until approved.
+    const deadline = Date.now() + CONFIG.pollTimeoutMs;
+    let status = null;
+    while (Date.now() < deadline) {
+        await new Promise((r) => setTimeout(r, CONFIG.pollIntervalMs));
+        const res = await fetch(`${CONFIG.walletUrl}/api/agent/pair/status/${pairingId}`);
+        if (!res.ok)
+            continue;
+        status = (await res.json());
+        if (status.status === "approved")
+            break;
+        if (status.status === "rejected" || status.status === "claimed") {
+            console.error("Pairing was " + status.status + " on the web wallet.");
+            process.exitCode = 1;
+            return;
+        }
+        process.stdout.write(".");
+    }
+    if (status?.status !== "approved") {
+        console.error("\nPairing timed out.");
+        process.exitCode = 1;
+        return;
+    }
+    // 4. Persist.
+    saveStore({
+        privateKey,
+        keyId,
+        name,
+        walletUrl: CONFIG.walletUrl,
+        rpcUrl: CONFIG.rpcUrl,
+        chainId: CONFIG.chainId,
+        userAddress: status.userAddress,
+        pairedAt: Date.now(),
+        limitAmount: status.limitAmount,
+        limitPeriod: status.limitPeriod,
+        keyExpiry: status.expiry,
+    });
+    console.log("");
+    console.log("✓ Paired!");
+    console.log("  Wallet account: " + status.userAddress);
+    console.log("  Spend limit:    " +
+        Number(status.limitAmount ?? 0) / 10 ** 6 +
+        " pathUSD / " +
+        Math.round((status.limitPeriod ?? 0) / 86400) +
+        " days");
+    console.log("  Key expires:    " + (status.expiry ? new Date(status.expiry * 1000).toISOString() : "never"));
+    console.log("");
+    console.log("Try: thaifi whoami");
+}

package/dist/commands/logout.js

@@ -0,0 +1,14 @@
+/** `thaifi logout` — remove the local agent key (revoke on the web to cut on-chain access). */
+import { loadStore, clearStore, storePath } from "../store.js";
+export async function logout() {
+    const store = loadStore();
+    if (!store) {
+        console.log("No local key found.");
+        return;
+    }
+    clearStore();
+    console.log("✓ Removed local key " + store.keyId + " (" + storePath + ")");
+    console.log("Note: the key may still be authorized on-chain — revoke it at " +
+        store.walletUrl +
+        " → Authorized Apps.");
+}

package/dist/commands/request.js

@@ -0,0 +1,123 @@
+/** `thaifi request <url>` — curl-like HTTP client with x402/MPP auto-payments. */
+import { loadStore } from "../store.js";
+import { createAgentClient } from "../chain.js";
+import { CONFIG, PATHUSD_DECIMALS } from "../config.js";
+/**
+ * Extract an x402/MPP payment challenge from a 402 response.
+ * Supports the common shapes: JSON body `{ accepts: [...] }` (x402) and
+ * `payTo`/`amount` fields; falls back to the `X-Payment-Required` header.
+ */
+async function parseChallenge(res, defaultToken) {
+    let body = null;
+    try {
+        body = await res.json();
+    }
+    catch {
+        body = null;
+    }
+    const accept = body?.accepts?.[0] ?? body?.payments?.[0] ?? body;
+    const payTo = accept?.payTo ?? accept?.payToAddress ?? accept?.recipient;
+    const maxAmount = accept?.maxAmountRequired ?? accept?.amount ?? accept?.price;
+    if (!payTo || maxAmount === undefined) {
+        const header = res.headers.get("x-payment-required");
+        if (!header)
+            return null;
+        try {
+            const h = JSON.parse(Buffer.from(header, "base64").toString());
+            return parseChallenge(new Response(JSON.stringify(h), { status: 200 }), defaultToken);
+        }
+        catch {
+            return null;
+        }
+    }
+    const amount = typeof maxAmount === "string" && /^\d+$/.test(maxAmount)
+        ? BigInt(maxAmount)
+        : BigInt(Math.round(Number(maxAmount) * 10 ** PATHUSD_DECIMALS));
+    return {
+        payTo: payTo,
+        amount,
+        token: accept?.asset ?? accept?.token ?? defaultToken,
+        raw: body,
+    };
+}
+export async function request(url, options) {
+    const store = loadStore();
+    if (!store?.userAddress) {
+        console.error("Not paired. Run `thaifi login` first.");
+        process.exitCode = 1;
+        return;
+    }
+    if (options.dryRun) {
+        console.log("→ " + options.method + " " + url);
+        for (const [k, v] of Object.entries(options.headers))
+            console.log("   " + k + ": " + v);
+        if (options.body)
+            console.log("   body: " + options.body);
+        return;
+    }
+    let res = await fetch(url, {
+        method: options.method,
+        headers: options.headers,
+        body: options.body,
+    });
+    // 402 → pay on-chain (TIP-20 transfer from the agent's spend limit) → retry once.
+    if (res.status === 402) {
+        const challenge = await parseChallenge(res, CONFIG.pathUsd);
+        if (!challenge) {
+            console.error("402 Payment Required — could not parse the challenge.");
+            console.error((await res.text()).slice(0, 400));
+            process.exitCode = 1;
+            return;
+        }
+        const usd = Number(challenge.amount) / 10 ** PATHUSD_DECIMALS;
+        if (options.maxSpend !== undefined && usd > options.maxSpend) {
+            console.error("Payment of $" + usd + " exceeds --max-spend $" + options.maxSpend + " — aborting.");
+            process.exitCode = 1;
+            return;
+        }
+        const token = (challenge.token ?? CONFIG.pathUsd);
+        console.log("402 — paying $" + usd + " to " + challenge.payTo + " …");
+        const client = createAgentClient(store);
+        const hash = await client.token.transfer({
+            to: challenge.payTo,
+            amount: challenge.amount,
+            token,
+        });
+        const receipt = await client.waitForTransactionReceipt({ hash });
+        if (receipt.status !== "success") {
+            console.error("Payment transaction reverted: " + hash);
+            process.exitCode = 1;
+            return;
+        }
+        console.log("Paid. Tx: " + hash);
+        const proof = Buffer.from(JSON.stringify({
+            scheme: "exact",
+            txHash: hash,
+            from: store.userAddress,
+            to: challenge.payTo,
+            amount: "0x" + challenge.amount.toString(16),
+            token,
+        })).toString("base64");
+        res = await fetch(url, {
+            method: options.method,
+            headers: { ...options.headers, "X-Payment": proof },
+            body: options.body,
+        });
+    }
+    console.log("← HTTP " + res.status);
+    const contentType = res.headers.get("content-type") ?? "";
+    const text = await res.text();
+    if (contentType.includes("json")) {
+        try {
+            console.log(JSON.stringify(JSON.parse(text), null, 2));
+        }
+        catch {
+            console.log(text);
+        }
+    }
+    else {
+        console.log(text.slice(0, 4000));
+    }
+    if (!res.ok)
+        process.exitCode = 1;
+}

package/dist/commands/services.js

@@ -0,0 +1,41 @@
+/** `thaifi services [--search q]` — discover paid services from an MPP/x402 registry. */
+const REGISTRY = process.env.THAIFI_MPP_REGISTRY ?? "https://mpp.thaifi.com";
+export async function services(options = {}) {
+    const base = REGISTRY.replace(/\/$/, "");
+    const url = options.search ? `${base}/services?search=${encodeURIComponent(options.search)}` : `${base}/services`;
+    console.log("Registry: " + base);
+    let res;
+    try {
+        res = await fetch(url, { headers: { Accept: "application/json" } });
+    }
+    catch (err) {
+        console.error("Registry unreachable (" + (err instanceof Error ? err.message : err) + ").");
+        console.error("Set THAIFI_MPP_REGISTRY to your MPP/x402 registry URL.");
+        process.exitCode = 1;
+        return;
+    }
+    if (!res.ok) {
+        console.error("Registry returned HTTP " + res.status);
+        process.exitCode = 1;
+        return;
+    }
+    const data = (await res.json());
+    const list = Array.isArray(data) ? data : (data.services ?? []);
+    if (list.length === 0) {
+        console.log("No services found.");
+        return;
+    }
+    for (const s of list) {
+        const id = s.id ?? s.serviceId ?? "?";
+        console.log("");
+        console.log(id + " — " + (s.name ?? id));
+        if (s.description)
+            console.log("  " + s.description);
+        if (s.url || s.endpoint)
+            console.log("  " + (s.url ?? s.endpoint));
+        if (s.price !== undefined)
+            console.log("  price: " + s.price);
+    }
+    console.log("");
+    console.log("Call a service: thaifi request <SERVICE_URL>");
+}

package/dist/commands/transfer.js

@@ -0,0 +1,38 @@
+/** `thaifi transfer <to> <amount> [token]` — TIP-20 transfer signed by the agent access key. */
+import { parseUnits, formatUnits } from "viem";
+import { loadStore } from "../store.js";
+import { createAgentClient } from "../chain.js";
+import { CONFIG, PATHUSD_DECIMALS } from "../config.js";
+export async function transfer(to, amount, options = {}) {
+    const store = loadStore();
+    if (!store?.userAddress) {
+        console.error("Not paired. Run `thaifi login` first.");
+        process.exitCode = 1;
+        return;
+    }
+    if (!/^0x[0-9a-fA-F]{40}$/.test(to)) {
+        console.error("Invalid recipient address: " + to);
+        process.exitCode = 1;
+        return;
+    }
+    const token = (options.token ?? CONFIG.pathUsd);
+    const client = createAgentClient(store);
+    console.log("To:     " + to);
+    console.log("Amount: " + amount + " (raw " + parseUnits(amount, PATHUSD_DECIMALS) + ")");
+    // Signed locally by the agent access key; the on-chain spending limit is
+    // enforced by the AccountKeychain precompile (SpendingLimitExceeded on overflow).
+    const hash = await client.token.transfer({
+        to: to,
+        amount: parseUnits(amount, PATHUSD_DECIMALS),
+        token,
+    });
+    console.log("Tx:     " + hash);
+    console.log("Waiting for receipt…");
+    const receipt = await client.waitForTransactionReceipt({ hash });
+    console.log(receipt.status === "success"
+        ? "✓ Transferred " + amount + " (gas " + receipt.gasUsed + ")"
+        : "✗ Transaction reverted (status " + receipt.status + ")");
+    if (receipt.status !== "success")
+        process.exitCode = 1;
+    void formatUnits;
+}

package/dist/commands/whoami.js

@@ -0,0 +1,30 @@
+/** `thaifi whoami` — account, agent key, balances and remaining spend limit. */
+import { loadStore } from "../store.js";
+import { createAgentClient, pathUsdBalance, remainingLimit } from "../chain.js";
+const fmt = (raw) => (Number(raw) / 1e6).toLocaleString("en-US", { maximumFractionDigits: 6 });
+export async function whoami() {
+    const store = loadStore();
+    if (!store?.userAddress) {
+        console.error("Not paired. Run `thaifi login` first.");
+        process.exitCode = 1;
+        return;
+    }
+    const client = createAgentClient(store);
+    const userAddress = store.userAddress;
+    const keyId = store.keyId;
+    const [balance, remaining] = await Promise.all([
+        pathUsdBalance(client, userAddress),
+        remainingLimit(client, userAddress, keyId).catch(() => null),
+    ]);
+    console.log("Account:     " + userAddress);
+    console.log("Agent key:   " + keyId);
+    console.log("pathUSD:     $" + fmt(balance));
+    if (remaining !== null) {
+        console.log("Limit left:  $" + fmt(remaining) + " of $" + fmt(BigInt(store.limitAmount ?? "0")));
+    }
+    else {
+        console.log("Limit left:  (unavailable — key may have been revoked)");
+    }
+    console.log("Key expires: " + (store.keyExpiry ? new Date(store.keyExpiry * 1000).toISOString() : "never"));
+    console.log("Wallet:      " + store.walletUrl);
+}

package/dist/config.js

@@ -0,0 +1,19 @@
+/** ThaiFi Wallet CLI configuration — overridable via env for testing. */
+export const CONFIG = {
+    rpcUrl: process.env.THAIFI_RPC_URL ?? "https://rpc.thaifi.com",
+    walletUrl: process.env.THAIFI_WALLET_URL ?? "https://wallet.thaifi.com",
+    chainId: Number(process.env.THAIFI_CHAIN_ID ?? 17),
+    /** pathUSD — ThaiFi fee/stable token (TIP-20, 6 decimals). */
+    pathUsd: (process.env.THAIFI_PATHUSD ??
+        "0x20c0000000000000000000000000000000000000"),
+    /** Default spending limit: 100 pathUSD. */
+    defaultLimit: 100n * 10n ** 6n,
+    /** Default limit period: 30 days (seconds). */
+    defaultPeriod: 60 * 60 * 24 * 30,
+    /** Default key expiry: 90 days (seconds). */
+    defaultExpiryDays: 90,
+    /** Pairing poll interval / timeout. */
+    pollIntervalMs: 3_000,
+    pollTimeoutMs: 15 * 60 * 1_000,
+};
+export const PATHUSD_DECIMALS = 6;

package/dist/index.js

@@ -0,0 +1,78 @@
+#!/usr/bin/env node
+/** ThaiFi Wallet CLI — agent wallet for the ThaiFi chain (chain 17). */
+import { Command } from "commander";
+import { login } from "./commands/login.js";
+import { logout } from "./commands/logout.js";
+import { whoami } from "./commands/whoami.js";
+import { balance } from "./commands/balance.js";
+import { transfer } from "./commands/transfer.js";
+import { request } from "./commands/request.js";
+import { services } from "./commands/services.js";
+const program = new Command();
+program
+    .name("thaifi")
+    .description("ThaiFi Wallet CLI — pair with wallet.thaifi.com and sign with on-chain access keys")
+    .version("0.1.0");
+program
+    .command("login")
+    .description("Pair this CLI with your ThaiFi Wallet (opens the browser to approve)")
+    .option("--no-browser", "Print the approval URL instead of opening a browser (headless machines)")
+    .action(login);
+program
+    .command("logout")
+    .description("Remove the local agent key (revoke on-chain access from the web wallet)")
+    .action(logout);
+program
+    .command("whoami")
+    .description("Show the paired account, agent key, balances and remaining spend limit")
+    .action(whoami);
+program
+    .command("balance")
+    .description("Show the TIP-20 token balance of the paired account")
+    .option("--token <address>", "Token contract (default: pathUSD)")
+    .action(balance);
+program
+    .command("transfer")
+    .description("Transfer tokens signed by the agent access key (spend limit enforced on-chain)")
+    .argument("<to>", "Recipient address (0x…)")
+    .argument("<amount>", "Amount in human units (e.g. 1.5)")
+    .option("--token <address>", "Token contract (default: pathUSD)")
+    .action(transfer);
+program
+    .command("request")
+    .description("HTTP request with automatic x402/MPP payments (curl-like)")
+    .argument("<url>")
+    .option("-X, --method <method>", "HTTP method", "GET")
+    .option("-H, --header <pairs...>", "Headers as 'Key: Value'", [])
+    .option("-d, --data <body>", "Request body")
+    .option("--json <json>", "JSON body shorthand (sets method POST + content-type)")
+    .option("--dry-run", "Print the request without sending")
+    .option("--max-spend <usd>", "Maximum automatic payment (USD)", Number)
+    .action(async (url, opts) => {
+    const headers = {};
+    for (const h of opts.header ?? []) {
+        const idx = h.indexOf(":");
+        if (idx > 0)
+            headers[h.slice(0, idx).trim()] = h.slice(idx + 1).trim();
+    }
+    let body = opts.data;
+    let method = opts.method;
+    if (opts.json) {
+        body = opts.json;
+        method = "POST";
+        headers["Content-Type"] = "application/json";
+    }
+    await request(url, {
+        method,
+        headers,
+        body,
+        dryRun: opts.dryRun,
+        maxSpend: opts.maxSpend,
+    });
+});
+program
+    .command("services")
+    .description("Discover paid services from the MPP/x402 registry")
+    .option("--search <query>", "Search services")
+    .action(services);
+program.parseAsync();

package/dist/store.js

@@ -0,0 +1,33 @@
+// Local agent key store — ~/.thaifi/store.json (chmod 600).
+// The private key NEVER leaves this file; the web wallet only ever sees the
+// derived address (key_id).
+import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+const DIR = join(homedir(), ".thaifi");
+const FILE = join(DIR, "store.json");
+export function loadStore() {
+    if (!existsSync(FILE))
+        return null;
+    try {
+        return JSON.parse(readFileSync(FILE, "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+export function saveStore(store) {
+    mkdirSync(DIR, { recursive: true });
+    writeFileSync(FILE, JSON.stringify(store, null, 2), { mode: 0o600 });
+    try {
+        chmodSync(FILE, 0o600);
+    }
+    catch {
+        // best-effort on platforms without chmod
+    }
+}
+export function clearStore() {
+    if (existsSync(FILE))
+        rmSync(FILE);
+}
+export const storePath = FILE;

package/package.json

@@ -0,0 +1,44 @@
+{
+  "name": "thaifi-wallet-cli",
+  "version": "0.1.0",
+  "description": "ThaiFi Wallet CLI for AI agents — pair with wallet.thaifi.com, sign with on-chain access keys (spending limits enforced on-chain), x402/MPP payments",
+  "type": "module",
+  "bin": {
+    "thaifi": "dist/index.js"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "typecheck": "tsc --noEmit",
+    "build": "tsc",
+    "prepare": "npm run build",
+    "cli": "tsx src/index.ts"
+  },
+  "keywords": [
+    "thaifi",
+    "wallet",
+    "agent",
+    "ai",
+    "x402",
+    "mpp",
+    "tempo",
+    "cli",
+    "payments"
+  ],
+  "license": "MIT",
+  "engines": {
+    "node": ">=20"
+  },
+  "dependencies": {
+    "commander": "^14.0.0",
+    "viem": "^2.56.0"
+  },
+  "devDependencies": {
+    "@types/node": "^24.13.2",
+    "tsx": "^4.19.0",
+    "typescript": "^5.9.0"
+  }
+}