thaifi-wallet-cli 0.1.2 → 0.2.0

package/README.md

@@ -16,13 +16,14 @@ wallet.thaifi.com/pair?id=…&code=…   ← user approves (passkey / PIN)
         │  2. web sends authorizeKey(keyId, P256, expiry, limits) on-chain
         ▼
 access key authorized on-chain → the CLI signs transactions directly,
-spending up to the limit (pathUSD), fees paid from the user's balance.
+spending up to the limit per token, fees (gas) paid in pathUSD.
 ```
 
 - Non-custodial: the private key never leaves the machine; the web wallet
   never sees it.
 - One wallet per account: revoking an app on the web cuts access immediately.
-- Limits are on-chain: `SpendingLimitExceeded` when exceeded; keys expire.
+- Limits are on-chain, per token: `SpendingLimitExceeded` when exceeded; keys expire.
+- Supported tokens (TIP-20, 6 decimals): **pathUSD** (gas), **THCFI**, **THCOC**.
 
 ## Install / run
 
@@ -39,13 +40,17 @@ Set `THAIFI_WALLET_URL` / `THAIFI_RPC_URL` to target other deployments.
 | Command | Description |
 |---|---|
 | `login [--no-browser]` | Pair with the web wallet (approval URL for headless machines) |
-| `whoami` | Account, agent key, balance, remaining spend limit |
-| `balance [--token <addr>]` | TIP-20 balance |
-| `transfer <to> <amount> [--token <addr>]` | Send tokens (limit enforced on-chain) |
+| `whoami` | Account, agent key, balances, remaining spend limits |
+| `tokens` | List supported TIP-20 tokens (symbol, decimals, address) |
+| `balance [--token <symbol\|addr>]` | Balances (default: all supported tokens) |
+| `transfer <to> <amount> [--token <symbol\|addr>]` | Send tokens (default: pathUSD; limit enforced on-chain) |
 | `request <url> [-X -H -d --json --dry-run --max-spend]` | HTTP with automatic x402/MPP payment |
 | `services [--search q]` | Discover services from the MPP registry (`THAIFI_MPP_REGISTRY`) |
 | `logout` | Remove the local key (revoke on-chain from the web wallet) |
 
+`--token` accepts a symbol (case-insensitive) or a contract address; unknown
+addresses are treated as custom TIP-20s (6 decimals).
+
 ## Security notes
 
 - The recovery password / passphrase is never involved here — the agent key is

package/dist/chain.js

@@ -30,9 +30,9 @@ export function createAgentClient(store) {
         transport: http(store.rpcUrl),
     }).extend(tempoActions());
 }
-export async function pathUsdBalance(client, address) {
+export async function tokenBalance(client, token, address) {
     return client.readContract({
-        address: CONFIG.pathUsd,
+        address: token,
         abi: [
             {
                 name: "balanceOf",
@@ -46,12 +46,12 @@ export async function pathUsdBalance(client, address) {
         args: [address],
     });
 }
-/** Remaining spend allowance of the agent key (pathUSD, raw units). */
-export async function remainingLimit(client, userAddress, keyId) {
+/** Remaining spend allowance of the agent key (raw units of `token`). */
+export async function remainingLimit(client, userAddress, keyId, token = CONFIG.pathUsd) {
     const res = await client.accessKey.getRemainingLimit({
         account: userAddress,
         accessKey: keyId,
-        token: CONFIG.pathUsd,
+        token,
     });
     return res.remaining;
 }

package/dist/commands/balance.js

@@ -1,7 +1,25 @@
-/** `thaifi balance [token]` — TIP-20 balance of the paired account. */
+/** `thaifi balance [--token <symbol|address>]` — TIP-20 balances of the paired account. */
 import { loadStore } from "../store.js";
 import { createAgentClient } from "../chain.js";
-import { CONFIG, PATHUSD_DECIMALS } from "../config.js";
+import { TOKENS, resolveToken } from "../tokens.js";
+const BALANCE_ABI = [
+    {
+        name: "balanceOf",
+        type: "function",
+        stateMutability: "view",
+        inputs: [{ type: "address" }],
+        outputs: [{ type: "uint256" }],
+    },
+];
+const SYMBOL_ABI = [
+    {
+        name: "symbol",
+        type: "function",
+        stateMutability: "view",
+        inputs: [],
+        outputs: [{ type: "string" }],
+    },
+];
 export async function balance(options = {}) {
     const store = loadStore();
     if (!store?.userAddress) {
@@ -9,40 +27,41 @@ export async function balance(options = {}) {
         process.exitCode = 1;
         return;
     }
-    const token = (options.token ?? CONFIG.pathUsd);
+    let tokens;
+    if (options.token) {
+        try {
+            tokens = [resolveToken(options.token)];
+        }
+        catch (err) {
+            console.error(err instanceof Error ? err.message : String(err));
+            process.exitCode = 1;
+            return;
+        }
+    }
+    else {
+        tokens = TOKENS;
+    }
     const client = createAgentClient(store);
-    const [balance, symbol] = await Promise.all([
-        client.readContract({
-            address: token,
-            abi: [
-                {
-                    name: "balanceOf",
-                    type: "function",
-                    stateMutability: "view",
-                    inputs: [{ type: "address" }],
-                    outputs: [{ type: "uint256" }],
-                },
-            ],
+    const userAddress = store.userAddress;
+    const rows = await Promise.all(tokens.map(async (t) => {
+        const raw = await client.readContract({
+            address: t.address,
+            abi: BALANCE_ABI,
             functionName: "balanceOf",
-            args: [store.userAddress],
-        }),
-        client
-            .readContract({
-            address: token,
-            abi: [
-                {
-                    name: "symbol",
-                    type: "function",
-                    stateMutability: "view",
-                    inputs: [],
-                    outputs: [{ type: "string" }],
-                },
-            ],
-            functionName: "symbol",
-        })
-            .catch(() => "TOKEN"),
-    ]);
-    const value = Number(balance) / 10 ** PATHUSD_DECIMALS;
-    console.log(symbol + " " + value.toLocaleString("en-US", { maximumFractionDigits: 6 }));
+            args: [userAddress],
+        });
+        // Registry tokens already know their symbol; custom ones read it from the chain.
+        const symbol = t.symbol === "TOKEN"
+            ? await client
+                .readContract({ address: t.address, abi: SYMBOL_ABI, functionName: "symbol" })
+                .catch(() => "TOKEN")
+            : t.symbol;
+        const value = Number(raw) / 10 ** t.decimals;
+        return { symbol, value, token: t };
+    }));
+    const width = Math.max(...rows.map((r) => r.symbol.length));
+    for (const r of rows) {
+        console.log(r.symbol.padEnd(width) + "  " + r.value.toLocaleString("en-US", { maximumFractionDigits: r.token.decimals }));
+    }
     console.log("(" + store.userAddress + ")");
 }

package/dist/commands/fund.js

@@ -19,8 +19,8 @@ export async function fund(options = {}) {
     console.log("Deposit address (your wallet):");
     console.log("  " + store.userAddress);
     console.log("");
-    console.log("Send pathUSD (or any ThaiFi TIP-20 token) to this address");
-    console.log("from any ThaiFi wallet.");
+    console.log("Send pathUSD, THCFI or THCOC (or any ThaiFi TIP-20 token) to this");
+    console.log("address from any ThaiFi wallet. Keep some pathUSD — gas is paid in it.");
     console.log("");
     console.log("Deposit page: " + store.walletUrl + "/deposit");
     console.log("(Bridge USDC from other chains — coming soon)");

package/dist/commands/login.js

@@ -93,7 +93,7 @@ export async function login(options = {}) {
     console.log("  Wallet account: " + status.userAddress);
     console.log("  Spend limit:    " +
         Number(status.limitAmount ?? 0) / 10 ** 6 +
-        " pathUSD / " +
+        " per token / " +
         Math.round((status.limitPeriod ?? 0) / 86400) +
         " days");
     console.log("  Key expires:    " + (status.expiry ? new Date(status.expiry * 1000).toISOString() : "never"));

package/dist/commands/request.js

@@ -1,13 +1,124 @@
-/** `thaifi request <url>` — curl-like HTTP client with x402/MPP auto-payments. */
+/** `thaifi request <url>` — curl-like HTTP client with MPP/x402 auto-payments. */
+import { concatHex, keccak256, slice, stringToBytes } from "viem";
 import { loadStore } from "../store.js";
 import { createAgentClient } from "../chain.js";
 import { CONFIG, PATHUSD_DECIMALS } from "../config.js";
+function b64uDecode(s) {
+    return Buffer.from(s.replace(/-/g, "+").replace(/_/g, "/"), "base64").toString("utf8");
+}
+function b64uEncode(s) {
+    return Buffer.from(s, "utf8")
+        .toString("base64")
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_")
+        .replace(/=+$/, "");
+}
+/**
+ * Parse an MPP `WWW-Authenticate: Payment id="…", request="<b64u json>"` header.
+ * See https://mpp.dev — Machine Payments Protocol.
+ */
+export function parseMppChallenge(header) {
+    const m = /^Payment\s+(.+)$/i.exec(header.trim());
+    if (!m)
+        return null;
+    const params = {};
+    const re = /([a-zA-Z]+)=((?:"((?:[^"\\]|\\.)*)")|[^\s,]+)/g;
+    let pm;
+    while ((pm = re.exec(m[1]))) {
+        const value = pm[3] !== undefined ? pm[3].replace(/\\(.)/g, "$1") : pm[2];
+        params[pm[1].toLowerCase()] = value;
+    }
+    if (!params.id || !params.request || !params.method)
+        return null;
+    let request;
+    try {
+        request = JSON.parse(b64uDecode(params.request));
+    }
+    catch {
+        return null;
+    }
+    const challenge = {
+        id: params.id,
+        realm: params.realm ?? "",
+        method: params.method,
+        intent: params.intent ?? "charge",
+        request,
+        requestRaw: params.request,
+    };
+    if (params.opaque !== undefined)
+        challenge.opaque = params.opaque;
+    if (params.expires !== undefined)
+        challenge.expires = params.expires;
+    return challenge;
+}
+/** MPP tempo charge → on-chain TIP-20 transfer (push mode: we broadcast, then send the hash). */
+function mppTempoChallenge(challenge) {
+    const req = challenge.request;
+    if (!req.amount || !req.recipient)
+        return null;
+    const amount = BigInt(req.amount);
+    // mppx omits `decimals` for pathUSD-denominated challenges.
+    const decimals = req.decimals ?? 6;
+    return {
+        payTo: req.recipient,
+        amount,
+        token: req.currency,
+        memo: req.memo ?? attributionMemo(challenge.realm, challenge.id),
+        decimals,
+        proofHeader: (txHash) => {
+            // Wire format: challenge.request is the base64url string, not a nested object.
+            const credential = {
+                challenge: {
+                    id: challenge.id,
+                    realm: challenge.realm,
+                    method: challenge.method,
+                    intent: challenge.intent,
+                    request: challenge.requestRaw,
+                    ...(challenge.opaque !== undefined && { opaque: challenge.opaque }),
+                    ...(challenge.expires !== undefined && { expires: challenge.expires }),
+                },
+                payload: { type: "hash", hash: txHash },
+                source: `did:pkh:eip155:${CONFIG.chainId}:${storeAddress()}`,
+            };
+            return "Payment " + b64uEncode(JSON.stringify(credential));
+        },
+    };
+}
+function storeAddress() {
+    const store = loadStore();
+    return store?.userAddress ?? "0x0";
+}
+const fingerprint = (value) => slice(keccak256(stringToBytes(value)), 0, 10);
+/**
+ * MPP attribution memo (bytes32) per mppx Attribution encoding:
+ * tag = keccak256("mpp")[0..4], version 0x01, serverId = realm fingerprint,
+ * clientId = CLI fingerprint, nonce = keccak256(challengeId)[0..7 bytes].
+ * Required by servers that don't pre-assign a memo to the challenge.
+ */
+function attributionMemo(realm, challengeId) {
+    const tag = slice(keccak256(stringToBytes("mpp")), 0, 4);
+    return concatHex([
+        tag,
+        "0x01",
+        fingerprint(realm),
+        fingerprint("thaifi-wallet-cli"),
+        slice(keccak256(stringToBytes(challengeId)), 0, 7),
+    ]);
+}
 /**
- * Extract an x402/MPP payment challenge from a 402 response.
- * Supports the common shapes: JSON body `{ accepts: [...] }` (x402) and
- * `payTo`/`amount` fields; falls back to the `X-Payment-Required` header.
+ * Extract a payment challenge from a 402 response.
+ * MPP (`WWW-Authenticate: Payment …`) first; legacy x402 JSON body as fallback.
  */
 async function parseChallenge(res, defaultToken) {
+    const wwwAuth = res.headers.get("www-authenticate");
+    if (wwwAuth) {
+        const mpp = parseMppChallenge(wwwAuth);
+        if (mpp && mpp.method === "tempo" && mpp.intent === "charge") {
+            const parsed = mppTempoChallenge(mpp);
+            if (parsed)
+                return parsed;
+        }
+    }
     let body = null;
     try {
         body = await res.json();
@@ -18,18 +129,8 @@ async function parseChallenge(res, defaultToken) {
     const accept = body?.accepts?.[0] ?? body?.payments?.[0] ?? body;
     const payTo = accept?.payTo ?? accept?.payToAddress ?? accept?.recipient;
     const maxAmount = accept?.maxAmountRequired ?? accept?.amount ?? accept?.price;
-    if (!payTo || maxAmount === undefined) {
-        const header = res.headers.get("x-payment-required");
-        if (!header)
-            return null;
-        try {
-            const h = JSON.parse(Buffer.from(header, "base64").toString());
-            return parseChallenge(new Response(JSON.stringify(h), { status: 200 }), defaultToken);
-        }
-        catch {
-            return null;
-        }
-    }
+    if (!payTo || maxAmount === undefined)
+        return null;
     const amount = typeof maxAmount === "string" && /^\d+$/.test(maxAmount)
         ? BigInt(maxAmount)
         : BigInt(Math.round(Number(maxAmount) * 10 ** PATHUSD_DECIMALS));
@@ -37,9 +138,38 @@ async function parseChallenge(res, defaultToken) {
         payTo: payTo,
         amount,
         token: accept?.asset ?? accept?.token ?? defaultToken,
-        raw: body,
+        decimals: PATHUSD_DECIMALS,
+        proofHeader: (txHash) => Buffer.from(JSON.stringify({
+            scheme: "exact",
+            txHash,
+            from: storeAddress(),
+            to: payTo,
+            amount: "0x" + amount.toString(16),
+            token: accept?.asset ?? accept?.token ?? defaultToken,
+        })).toString("base64"),
     };
 }
+/** If the JSON response carries a generated image, save it and print a summary. */
+async function maybeSaveImage(text) {
+    let body;
+    try {
+        body = JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+    const b64 = body?.image_base64 ?? body?.data?.image_base64;
+    if (typeof b64 !== "string" || b64.length < 1000)
+        return null;
+    const id = (body?.id ?? body?.data?.id ?? "image").toString().replace(/[^\w-]/g, "");
+    const mime = (body?.mime_type ?? body?.data?.mime_type ?? "image/png").toString();
+    const ext = mime.includes("jpeg") ? "jpg" : mime.includes("webp") ? "webp" : "png";
+    const file = `iapp-${id}.${ext}`;
+    const { writeFileSync } = await import("node:fs");
+    writeFileSync(file, Buffer.from(b64, "base64"));
+    const { width, height, time } = body;
+    return `${file} (${mime}${width ? `, ${width}x${height}` : ""}${time?.total ? `, ${time.total}s` : ""})`;
+}
 export async function request(url, options) {
     const store = loadStore();
     if (!store?.userAddress) {
@@ -69,7 +199,7 @@ export async function request(url, options) {
             process.exitCode = 1;
             return;
         }
-        const usd = Number(challenge.amount) / 10 ** PATHUSD_DECIMALS;
+        const usd = Number(challenge.amount) / 10 ** (challenge.decimals ?? PATHUSD_DECIMALS);
         if (options.maxSpend !== undefined && usd > options.maxSpend) {
             console.error("Payment of $" + usd + " exceeds --max-spend $" + options.maxSpend + " — aborting.");
             process.exitCode = 1;
@@ -82,6 +212,7 @@ export async function request(url, options) {
             to: challenge.payTo,
             amount: challenge.amount,
             token,
+            ...(challenge.memo ? { memo: challenge.memo } : {}),
         });
         const receipt = await client.waitForTransactionReceipt({ hash });
         if (receipt.status !== "success") {
@@ -90,17 +221,9 @@ export async function request(url, options) {
             return;
         }
         console.log("Paid. Tx: " + hash);
-        const proof = Buffer.from(JSON.stringify({
-            scheme: "exact",
-            txHash: hash,
-            from: store.userAddress,
-            to: challenge.payTo,
-            amount: "0x" + challenge.amount.toString(16),
-            token,
-        })).toString("base64");
         res = await fetch(url, {
             method: options.method,
-            headers: { ...options.headers, "X-Payment": proof },
+            headers: { ...options.headers, Authorization: challenge.proofHeader(hash) },
             body: options.body,
         });
     }
@@ -109,10 +232,21 @@ export async function request(url, options) {
     const text = await res.text();
     if (contentType.includes("json")) {
         try {
-            console.log(JSON.stringify(JSON.parse(text), null, 2));
+            const saved = await maybeSaveImage(text);
+            if (saved) {
+                console.log("Saved image → " + saved);
+                const body = JSON.parse(text);
+                for (const k of ["status", "id", "width", "height", "mime_type", "font"]) {
+                    if (body[k] !== undefined)
+                        console.log("  " + k + ": " + body[k]);
+                }
+            }
+            else {
+                console.log(JSON.stringify(JSON.parse(text), null, 2));
+            }
         }
         catch {
-            console.log(text);
+            console.log(text.slice(0, 4000));
         }
     }
     else {

package/dist/commands/tokens.js

@@ -0,0 +1,9 @@
+/** `thaifi tokens` — list TIP-20 tokens supported by the CLI. */
+import { TOKENS } from "../tokens.js";
+export async function tokens() {
+    const width = Math.max(...TOKENS.map((t) => t.symbol.length));
+    console.log("SYMBOL".padEnd(width) + "  DECIMALS  ADDRESS");
+    for (const t of TOKENS) {
+        console.log(t.symbol.padEnd(width) + "  " + String(t.decimals).padEnd(8) + "  " + t.address);
+    }
+}

package/dist/commands/transfer.js

@@ -1,8 +1,8 @@
-/** `thaifi transfer <to> <amount> [token]` — TIP-20 transfer signed by the agent access key. */
-import { parseUnits, formatUnits } from "viem";
+/** `thaifi transfer <to> <amount> [--token <symbol|address>]` — TIP-20 transfer signed by the agent access key. */
+import { parseUnits } from "viem";
 import { loadStore } from "../store.js";
-import { createAgentClient } from "../chain.js";
-import { CONFIG, PATHUSD_DECIMALS } from "../config.js";
+import { createAgentClient, tokenBalance } from "../chain.js";
+import { PATHUSD, resolveToken } from "../tokens.js";
 export async function transfer(to, amount, options = {}) {
     const store = loadStore();
     if (!store?.userAddress) {
@@ -15,24 +15,44 @@ export async function transfer(to, amount, options = {}) {
         process.exitCode = 1;
         return;
     }
-    const token = (options.token ?? CONFIG.pathUsd);
+    let token;
+    try {
+        token = resolveToken(options.token ?? PATHUSD.symbol);
+    }
+    catch (err) {
+        console.error(err instanceof Error ? err.message : String(err));
+        process.exitCode = 1;
+        return;
+    }
     const client = createAgentClient(store);
+    const userAddress = store.userAddress;
+    const rawAmount = parseUnits(amount, token.decimals);
+    // Gas is always paid in pathUSD — a non-pathUSD transfer with an empty
+    // pathUSD balance can never land.
+    if (token.address.toLowerCase() !== PATHUSD.address.toLowerCase()) {
+        const gasBalance = await tokenBalance(client, PATHUSD.address, userAddress).catch(() => null);
+        if (gasBalance !== null && gasBalance <= 0n) {
+            console.error(`✗ pathUSD balance is 0 — gas is paid in pathUSD, so this ${token.symbol} transfer would fail. Receive some pathUSD first.`);
+            process.exitCode = 1;
+            return;
+        }
+    }
+    console.log("Token:  " + token.symbol + " (" + token.address + ")");
     console.log("To:     " + to);
-    console.log("Amount: " + amount + " (raw " + parseUnits(amount, PATHUSD_DECIMALS) + ")");
+    console.log("Amount: " + amount + " (raw " + rawAmount + ")");
     // Signed locally by the agent access key; the on-chain spending limit is
     // enforced by the AccountKeychain precompile (SpendingLimitExceeded on overflow).
     const hash = await client.token.transfer({
         to: to,
-        amount: parseUnits(amount, PATHUSD_DECIMALS),
-        token,
+        amount: rawAmount,
+        token: token.address,
     });
     console.log("Tx:     " + hash);
     console.log("Waiting for receipt…");
     const receipt = await client.waitForTransactionReceipt({ hash });
     console.log(receipt.status === "success"
-        ? "✓ Transferred " + amount + " (gas " + receipt.gasUsed + ")"
+        ? "✓ Transferred " + amount + " " + token.symbol + " (gas " + receipt.gasUsed + ")"
         : "✗ Transaction reverted (status " + receipt.status + ")");
     if (receipt.status !== "success")
         process.exitCode = 1;
-    void formatUnits;
 }

package/dist/commands/whoami.js

@@ -1,7 +1,8 @@
-/** `thaifi whoami` — account, agent key, balances and remaining spend limit. */
+/** `thaifi whoami` — account, agent key, balances and remaining spend limits. */
 import { loadStore } from "../store.js";
-import { createAgentClient, pathUsdBalance, remainingLimit } from "../chain.js";
-const fmt = (raw) => (Number(raw) / 1e6).toLocaleString("en-US", { maximumFractionDigits: 6 });
+import { createAgentClient, tokenBalance, remainingLimit } from "../chain.js";
+import { TOKENS, PATHUSD } from "../tokens.js";
+const fmt = (raw, decimals = 6) => (Number(raw) / 10 ** decimals).toLocaleString("en-US", { maximumFractionDigits: decimals });
 export async function whoami() {
     const store = loadStore();
     if (!store?.userAddress) {
@@ -12,19 +13,31 @@ export async function whoami() {
     const client = createAgentClient(store);
     const userAddress = store.userAddress;
     const keyId = store.keyId;
-    const [balance, remaining] = await Promise.all([
-        pathUsdBalance(client, userAddress),
-        remainingLimit(client, userAddress, keyId).catch(() => null),
+    const [balances, remaining] = await Promise.all([
+        Promise.all(TOKENS.map((t) => tokenBalance(client, t.address, userAddress)
+            .then((raw) => [t.symbol, raw])
+            .catch(() => [t.symbol, null]))),
+        Promise.all(TOKENS.map((t) => remainingLimit(client, userAddress, keyId, t.address)
+            .then((raw) => [t.symbol, raw])
+            .catch(() => [t.symbol, null]))),
     ]);
     console.log("Account:     " + userAddress);
     console.log("Agent key:   " + keyId);
-    console.log("pathUSD:     $" + fmt(balance));
-    if (remaining !== null) {
-        console.log("Limit left:  $" + fmt(remaining) + " of $" + fmt(BigInt(store.limitAmount ?? "0")));
+    const width = Math.max(...TOKENS.map((t) => t.symbol.length));
+    for (const [symbol, raw] of balances) {
+        const prefix = symbol === PATHUSD.symbol ? "$" : "";
+        console.log((symbol + ":").padEnd(width + 1) + " " + (raw === null ? "(read failed)" : prefix + fmt(raw)));
     }
-    else {
+    if (remaining.every(([, raw]) => raw === null)) {
         console.log("Limit left:  (unavailable — key may have been revoked)");
     }
+    else {
+        const parts = remaining
+            .filter(([, raw]) => raw !== null)
+            .map(([symbol, raw]) => `${symbol} ${fmt(raw)}`)
+            .join(", ");
+        console.log("Limit left:  " + parts + " (of " + Number(store.limitAmount ?? 0) / 10 ** 6 + " per token)");
+    }
     console.log("Key expires: " + (store.keyExpiry ? new Date(store.keyExpiry * 1000).toISOString() : "never"));
     console.log("Wallet:      " + store.walletUrl);
 }

package/dist/index.js

@@ -9,11 +9,12 @@ import { transfer } from "./commands/transfer.js";
 import { request } from "./commands/request.js";
 import { services } from "./commands/services.js";
 import { fund } from "./commands/fund.js";
+import { tokens } from "./commands/tokens.js";
 const program = new Command();
 program
     .name("thaifi")
     .description("ThaiFi Wallet CLI — pair with wallet.thaifi.com and sign with on-chain access keys")
-    .version("0.1.0");
+    .version("0.2.0");
 program
     .command("login")
     .description("Pair this CLI with your ThaiFi Wallet (opens the browser to approve)")
@@ -27,17 +28,21 @@ program
     .command("whoami")
     .description("Show the paired account, agent key, balances and remaining spend limit")
     .action(whoami);
+program
+    .command("tokens")
+    .description("List supported TIP-20 tokens (symbol, decimals, address)")
+    .action(tokens);
 program
     .command("balance")
-    .description("Show the TIP-20 token balance of the paired account")
-    .option("--token <address>", "Token contract (default: pathUSD)")
+    .description("Show TIP-20 token balances of the paired account")
+    .option("--token <symbol|address>", "Token symbol (pathUSD, THCFI, THCOC) or contract address (default: all)")
     .action(balance);
 program
     .command("transfer")
     .description("Transfer tokens signed by the agent access key (spend limit enforced on-chain)")
     .argument("<to>", "Recipient address (0x…)")
     .argument("<amount>", "Amount in human units (e.g. 1.5)")
-    .option("--token <address>", "Token contract (default: pathUSD)")
+    .option("--token <symbol|address>", "Token symbol or contract address (default: pathUSD)")
     .action(transfer);
 program
     .command("fund")

package/dist/tokens.js

@@ -0,0 +1,39 @@
+/** TIP-20 tokens surfaced by the CLI — all ThaiFi TIP-20s use 6 decimals. */
+import { CONFIG } from "./config.js";
+export const PATHUSD = {
+    address: CONFIG.pathUsd,
+    symbol: "pathUSD",
+    name: "pathUSD",
+    decimals: 6,
+};
+export const THCFI = {
+    address: "0x185cd24d61D400d4A22469B311B3915d04e10DCF",
+    symbol: "THCFI",
+    name: "ThaiCoin ThaiFi",
+    decimals: 6,
+};
+export const THCOC = {
+    address: "0x5c4B54cf00Df2be0169E05DfAF34eE754cace9a4",
+    symbol: "THCOC",
+    name: "THCOC",
+    decimals: 6,
+};
+/** Tokens listed by `thaifi tokens` / shown by default in `thaifi balance`. */
+export const TOKENS = [PATHUSD, THCFI, THCOC];
+/**
+ * Resolve a token by symbol (case-insensitive) or 0x address. Addresses
+ * outside the registry are treated as custom TIP-20s (6 decimals); the
+ * symbol is read from the chain by the caller.
+ */
+export function resolveToken(arg) {
+    const bySymbol = TOKENS.find((t) => t.symbol.toLowerCase() === arg.toLowerCase());
+    if (bySymbol)
+        return bySymbol;
+    if (/^0x[0-9a-fA-F]{40}$/.test(arg)) {
+        const known = TOKENS.find((t) => t.address.toLowerCase() === arg.toLowerCase());
+        if (known)
+            return known;
+        return { address: arg, symbol: "TOKEN", name: "Custom TIP-20", decimals: 6 };
+    }
+    throw new Error(`Unknown token "${arg}" — use a symbol (pathUSD, THCFI, THCOC) or a 0x contract address.`);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thaifi-wallet-cli",
-  "version": "0.1.2",
+  "version": "0.2.0",
   "description": "ThaiFi Wallet CLI for AI agents — pair with wallet.thaifi.com, sign with on-chain access keys (spending limits enforced on-chain), x402/MPP payments",
   "type": "module",
   "bin": {