thaifi-wallet-cli 0.2.1 → 0.3.0

package/README.md

@@ -44,7 +44,7 @@ Set `THAIFI_WALLET_URL` / `THAIFI_RPC_URL` to target other deployments.
 | `tokens` | List supported TIP-20 tokens (symbol, decimals, address) |
 | `balance [--token <symbol\|addr>]` | Balances (default: all supported tokens) |
 | `transfer <to> <amount> [--token <symbol\|addr>]` | Send tokens (default: pathUSD; limit enforced on-chain) |
-| `request <url> [-X -H -d --json --dry-run --max-spend]` | HTTP with automatic x402/MPP payment |
+| `request <url> [-X -H -d --json --dry-run --max-spend]` | HTTP with automatic x402/MPP payment **and ThaiFiAgent identity auth (401/403 answered by signing the challenge)** |
 | `services [--search q]` | Discover services from the MPP registry (`THAIFI_MPP_REGISTRY`) |
 | `logout` | Remove the local key (revoke on-chain from the web wallet) |
 

package/dist/agentAuth.js

@@ -0,0 +1,55 @@
+/**
+ * ThaiFi Agent Auth (TAA) — client-side helper.
+ *
+ * Signs a server challenge with the agent access key (P256, keychain
+ * envelope binding the wallet account) so the server can verify on-chain
+ * that this key is authorized (AccountKeychain, TIP-1011). Server-side
+ * reference implementation: thaifi/mpp repo, src/agentAuth.ts.
+ *
+ * Signed hash (must match the server byte-for-byte):
+ *   keccak256(tag4("thaifi-agent-auth") ‖ 0x01 ‖ keccak256(realm)[0:10]
+ *             ‖ nonceBytes ‖ utf8(METHOD) ‖ utf8(pathWithQuery)
+ *             ‖ sha256(body) | 0x00*32 ‖ uint64be(timestamp))
+ */
+import { concatHex, keccak256, sha256, slice, stringToBytes, stringToHex, toHex } from "viem";
+import { Account } from "viem/tempo";
+const AUTH_TAG = slice(keccak256(stringToBytes("thaifi-agent-auth")), 0, 4);
+const ZERO_BODY_HASH = `0x${"00".repeat(32)}`;
+function b64uDecodeBytes(value) {
+    return new Uint8Array(Buffer.from(value.replace(/-/g, "+").replace(/_/g, "/"), "base64"));
+}
+export function agentAuthHash(params) {
+    const bodyHash = params.body && params.body.length > 0 ? sha256(stringToBytes(params.body)) : ZERO_BODY_HASH;
+    return keccak256(concatHex([
+        AUTH_TAG,
+        "0x01",
+        slice(keccak256(stringToBytes(params.realm)), 0, 10),
+        params.nonce,
+        stringToHex(params.method.toUpperCase()),
+        stringToHex(params.path),
+        bodyHash,
+        toHex(BigInt(params.ts), { size: 8 }),
+    ]));
+}
+/** Sign the ThaiFiAgent challenge → the b64u credential for the retry header. */
+export async function buildAgentAuthCredential(store, challenge, req) {
+    if (!store.userAddress)
+        throw new Error("Not paired.");
+    const url = new URL(req.url);
+    const path = url.pathname + url.search;
+    const ts = Math.floor(Date.now() / 1000);
+    const nonce = toHex(b64uDecodeBytes(challenge.nonce));
+    const hash = agentAuthHash({
+        realm: challenge.realm,
+        nonce,
+        method: req.method,
+        path,
+        body: req.body ?? null,
+        ts,
+    });
+    const account = Account.fromP256(store.privateKey, {
+        access: store.userAddress,
+    });
+    const signature = await account.sign({ hash });
+    return { v: 1, ts, nonce: challenge.nonce, signature };
+}

package/dist/commands/request.js

@@ -2,6 +2,7 @@
 import { concatHex, keccak256, slice, stringToBytes } from "viem";
 import { loadStore } from "../store.js";
 import { createAgentClient } from "../chain.js";
+import { buildAgentAuthCredential } from "../agentAuth.js";
 import { CONFIG, PATHUSD_DECIMALS } from "../config.js";
 function b64uDecode(s) {
     return Buffer.from(s.replace(/-/g, "+").replace(/_/g, "/"), "base64").toString("utf8");
@@ -51,6 +52,26 @@ export function parseMppChallenge(header) {
         challenge.expires = params.expires;
     return challenge;
 }
+/**
+ * Parse a `WWW-Authenticate: ThaiFiAgent realm="…", challenge="<b64u>"`
+ * header — ThaiFi Agent Auth (identity proof, no payment). The server
+ * verifies our signature against the AccountKeychain precompile.
+ */
+function parseAgentChallenge(header) {
+    const m = /^ThaiFiAgent\s+(.+)$/i.exec(header.trim());
+    if (!m)
+        return null;
+    const params = {};
+    const re = /([a-zA-Z]+)=((?:"((?:[^"\\]|\\.)*)")|[^\s,]+)/g;
+    let pm;
+    while ((pm = re.exec(m[1]))) {
+        const value = pm[3] !== undefined ? pm[3].replace(/\\(.)/g, "$1") : pm[2];
+        params[pm[1].toLowerCase()] = value;
+    }
+    if (!params.realm || !params.challenge)
+        return null;
+    return { realm: params.realm, nonce: params.challenge };
+}
 /** MPP tempo charge → on-chain TIP-20 transfer (push mode: we broadcast, then send the hash). */
 function mppTempoChallenge(challenge) {
     const req = challenge.request;
@@ -190,6 +211,28 @@ export async function request(url, options) {
         headers: options.headers,
         body: options.body,
     });
+    // 401/403 → ThaiFi Agent Auth: sign the challenge with the agent access key
+    // (identity proof, no payment) → retry once. The server verifies the key
+    // against the AccountKeychain precompile.
+    if (res.status === 401 || res.status === 403) {
+        const agentChallenge = parseAgentChallenge(res.headers.get("www-authenticate") ?? "");
+        if (agentChallenge) {
+            console.log("401 — signing agent auth challenge …");
+            const credential = await buildAgentAuthCredential(store, agentChallenge, {
+                method: options.method,
+                url,
+                body: options.body,
+            });
+            res = await fetch(url, {
+                method: options.method,
+                headers: {
+                    ...options.headers,
+                    Authorization: "ThaiFiAgent " + b64uEncode(JSON.stringify(credential)),
+                },
+                body: options.body,
+            });
+        }
+    }
     // 402 → pay on-chain (TIP-20 transfer from the agent's spend limit) → retry once.
     if (res.status === 402) {
         const challenge = await parseChallenge(res, CONFIG.pathUsd);

package/dist/index.js

@@ -14,7 +14,7 @@ const program = new Command();
 program
     .name("thaifi")
     .description("ThaiFi Wallet CLI — pair with wallet.thaifi.com and sign with on-chain access keys")
-    .version("0.2.1");
+    .version("0.3.0");
 program
     .command("login")
     .description("Pair this CLI with your ThaiFi Wallet (opens the browser to approve)")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thaifi-wallet-cli",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "ThaiFi Wallet CLI for AI agents — pair with wallet.thaifi.com, sign with on-chain access keys (spending limits enforced on-chain), x402/MPP payments",
   "type": "module",
   "bin": {