@agentgrant.cash/cli 1.0.0

package/dist/lib/money-input.js

@@ -0,0 +1,176 @@
+/**
+ * Money INPUT resolution — the safety-critical counterpart to currency.ts
+ * (which handles money OUTPUT/display).
+ *
+ * The backend operates entirely in USD (the "cash" stablecoin ≈ 1 USD, and all
+ * trade/borrow/withdraw amounts are USD-denominated decimal strings). But a user
+ * thinks in their own currency: an INR user who says "buy ₹50 of gold" means ₹50,
+ * NOT $50. Sending the raw number through would overspend by the FX rate (~83×).
+ *
+ * This module resolves a user-entered amount into a USD decimal string for the
+ * backend, with two rules:
+ *   1. A bare number is interpreted in the currency the user is *viewing*
+ *      (their display currency) — local if they view local, else USD.
+ *   2. An explicit currency on the amount ("$10", "100 EUR", "₹50") always wins.
+ *
+ * Hard safety property: if the amount is in a non-USD currency and we cannot get
+ * an authoritative FX rate, we THROW rather than guess — a wrong-currency money
+ * transaction is never acceptable.
+ */
+import { assertDecimal } from './amounts.js';
+import { usesLocalCurrency } from './currency.js';
+const SYMBOL_TO_CURRENCY = {
+    $: 'USD',
+    '₹': 'INR',
+    '€': 'EUR',
+    '£': 'GBP',
+    '¥': 'JPY',
+};
+/**
+ * Parse a money input that may carry an explicit currency:
+ *   "50"  "$50"  "₹50"  "€10.5"  "50 INR"  "50inr"  "usd 10"  "$1,234.56"
+ * Returns the numeric amount and the explicit currency (uppercased) if present.
+ * Throws on anything that isn't a positive number.
+ */
+export function parseMoneyInput(raw) {
+    if (raw == null)
+        throw new Error('Amount is required.');
+    let s = String(raw).trim();
+    if (!s)
+        throw new Error('Amount is required.');
+    s = s.replace(/,/g, ''); // thousands separators
+    let currency;
+    // Leading symbol ($, ₹, €, …)
+    const lead = s[0];
+    if (SYMBOL_TO_CURRENCY[lead]) {
+        currency = SYMBOL_TO_CURRENCY[lead];
+        s = s.slice(1).trim();
+    }
+    // Leading ISO code: "USD 50" / "usd50"
+    let m = s.match(/^([A-Za-z]{3})\s*([\d.].*)$/);
+    if (m) {
+        currency = currency ?? m[1].toUpperCase();
+        s = m[2].trim();
+    }
+    // Trailing ISO code: "50 USD" / "50usd"
+    m = s.match(/^([\d.]+)\s*([A-Za-z]{3})$/);
+    if (m) {
+        currency = currency ?? m[2].toUpperCase();
+        s = m[1].trim();
+    }
+    if (!/^\d+(\.\d+)?$/.test(s))
+        throw new Error(`Invalid amount: "${raw}"`);
+    const amount = Number(s);
+    if (!Number.isFinite(amount) || amount <= 0) {
+        throw new Error(`Amount must be greater than 0: "${raw}"`);
+    }
+    return currency ? { amount, currency } : { amount };
+}
+/** Round a number to at most `decimals` places, returning a trimmed decimal string. */
+function roundToDecimalString(n, decimals) {
+    const fixed = n.toFixed(Math.max(0, decimals));
+    // Trim trailing zeros and a dangling dot: "0.602410" → "0.60241", "50.00" → "50".
+    const trimmed = decimals > 0 ? fixed.replace(/\.?0+$/, '') : fixed;
+    return trimmed === '' || trimmed === '-0' ? '0' : trimmed;
+}
+/** The currency a bare (unitless) amount is assumed to be in — matches what the user sees. */
+export function defaultInputCurrency(prefs) {
+    return usesLocalCurrency(prefs) ? prefs.currency.toUpperCase() : 'USD';
+}
+/**
+ * Resolve a user-entered cash amount into a USD decimal string for the backend.
+ *
+ * `fetchRate(currency)` must return local-units-per-USD for that currency. For any
+ * non-USD source currency we ALWAYS fetch an authoritative rate (we never trust a
+ * possibly-stale `prefs.rate`, which falls back to 1 when FX is unavailable — and a
+ * rate of 1 would silently treat ₹50 as $50). If the rate can't be obtained, we throw.
+ */
+export async function resolveCashToUsd(raw, prefs, decimals, fetchRate) {
+    const parsed = parseMoneyInput(raw);
+    const sourceCurrency = (parsed.currency ?? defaultInputCurrency(prefs)).toUpperCase();
+    if (sourceCurrency === 'USD') {
+        const usdString = assertDecimal(roundToDecimalString(parsed.amount, decimals), decimals);
+        return {
+            usd: Number(usdString),
+            usdString,
+            sourceAmount: parsed.amount,
+            sourceCurrency: 'USD',
+            rate: 1,
+            converted: false,
+        };
+    }
+    let rate;
+    try {
+        rate = await fetchRate(sourceCurrency);
+    }
+    catch {
+        throw new Error(`Couldn't get the ${sourceCurrency} exchange rate to convert your amount — ` +
+            `refusing to risk a wrong-currency transaction. Try again, or specify the amount in USD (e.g. "$10").`);
+    }
+    if (!Number.isFinite(rate) || rate <= 0) {
+        throw new Error(`Invalid ${sourceCurrency} exchange rate; refusing to guess. Specify the amount in USD (e.g. "$10").`);
+    }
+    const usd = parsed.amount / rate;
+    const usdString = roundToDecimalString(usd, decimals);
+    if (Number(usdString) <= 0) {
+        throw new Error(`${parsed.amount} ${sourceCurrency} is too small to transact (≈ $0 at the current rate).`);
+    }
+    return {
+        usd: Number(usdString),
+        usdString: assertDecimal(usdString, decimals),
+        sourceAmount: parsed.amount,
+        sourceCurrency,
+        rate,
+        converted: true,
+    };
+}
+function fmtCurrency(amount, currency) {
+    try {
+        return new Intl.NumberFormat('en-US', { style: 'currency', currency }).format(amount);
+    }
+    catch {
+        return `${amount} ${currency}`;
+    }
+}
+/**
+ * Human description of a resolved cash amount — shows the source amount and its
+ * USD equivalent when a conversion happened, so the user can see exactly what
+ * will be transacted (e.g. "₹50.00 (≈ $0.60)").
+ */
+export function describeCashResolution(m) {
+    if (!m.converted)
+        return fmtCurrency(m.usd, 'USD');
+    return `${fmtCurrency(m.sourceAmount, m.sourceCurrency)} (≈ ${fmtCurrency(m.usd, 'USD')})`;
+}
+/**
+ * Resolve a cash-denominated SELL target into a quantity of the asset to sell.
+ *
+ * "Sell ₹100 of gold" means: realize ~₹100 of cash by selling gold. Swaps are
+ * exact-input (you specify how much to sell), so we size the sale from the live
+ * USD unit price: `quantity = targetUSD / unitPriceUsd`. The result is therefore
+ * an approximation of the cash proceeds (slippage/fees move the exact figure) —
+ * hence "~₹100 worth", which is what the user means.
+ *
+ * `unitPriceUsd` is the live USD price per asset unit (gold price/oz for XAUT,
+ * BTC price for WBTC, ETH price for WETH, 1 for stables). If it isn't available
+ * (≤ 0) we throw rather than guess — a mis-sized money sale is never acceptable.
+ */
+export async function resolveCashTargetToAssetQty(raw, prefs, decimals, fetchRate, unitPriceUsd) {
+    // Reuse the cash→USD resolution (handles bare-number default currency + explicit
+    // prefixes + refuse-when-no-FX). We pass a high precision here (USD target is an
+    // intermediate, not the on-wire amount), then size the asset quantity from it.
+    const m = await resolveCashToUsd(raw, prefs, 8, fetchRate);
+    if (!Number.isFinite(unitPriceUsd) || unitPriceUsd <= 0) {
+        throw new Error('No live price available to size this sale — refusing to guess. Try again in a moment.');
+    }
+    const quantity = roundToDecimalString(m.usd / unitPriceUsd, decimals);
+    if (Number(quantity) <= 0) {
+        throw new Error(`${fmtCurrency(m.sourceAmount, m.sourceCurrency)} is too small to sell (≈ 0 units at the current price).`);
+    }
+    return {
+        ...m,
+        quantity: assertDecimal(quantity, decimals),
+        quantityNum: Number(quantity),
+        unitPriceUsd,
+    };
+}

package/dist/lib/output.js

@@ -0,0 +1,45 @@
+import pc from "picocolors";
+import { friendlyError } from "./errors.js";
+export function isJsonMode(flag) {
+    return Boolean(flag) || !process.stdout.isTTY;
+}
+export function emit(ctx, data, human) {
+    if (ctx.json) {
+        process.stdout.write(JSON.stringify({ ok: true, ...data }) + "\n");
+    }
+    else {
+        process.stdout.write(human() + "\n");
+    }
+}
+/** Print a failure in the active mode and return the process exit code. */
+export function printError(json, err) {
+    const e = (err ?? {});
+    const message = friendlyError(e.status, e.code) ??
+        e.message ??
+        (e.code
+            ? `Request failed: ${e.code}`
+            : `Request failed${e.status ? ` (HTTP ${e.status})` : ""}.`);
+    if (json) {
+        process.stderr.write(JSON.stringify({
+            ok: false,
+            error: {
+                code: e.code ?? "ERROR",
+                message,
+                recoverable: e.recoverable ?? false,
+            },
+        }) + "\n");
+    }
+    else {
+        process.stderr.write(pc.red(`✖ ${message}`) + "\n");
+    }
+    return 1;
+}
+/* Small pretty helpers (human mode only). */
+export const ui = {
+    title: (s) => pc.bold(s),
+    dim: (s) => pc.dim(s),
+    green: (s) => pc.green(s),
+    amber: (s) => pc.yellow(s),
+    red: (s) => pc.red(s),
+    label: (s) => pc.dim(s),
+};

package/dist/lib/polygon-balance.js

@@ -0,0 +1,125 @@
+/**
+ * Read a deposit wallet's prediction-balance (pUSD) on Polygon — client-side,
+ * with no backend change and no web3 dependency.
+ *
+ * The prediction balance lives as pUSD (Polymarket USD: a standard ERC-20 on
+ * Polygon, 6 decimals, USDC-backed) in the user's Polymarket deposit wallet.
+ * The Perfolio backend only exposes the wallet ADDRESS, not its balance, and we
+ * are not allowed to change the backend — so we read the balance directly from a
+ * public Polygon RPC with a single `eth_call` to `balanceOf`, encoded/decoded by
+ * hand (no viem). The CLI ships only `commander` + `picocolors`; this keeps it
+ * that way.
+ *
+ * Everything here is best-effort: a balance read must NEVER break a command, so
+ * `fetchPusdBalanceUsd` returns `null` on any failure rather than throwing.
+ */
+/** pUSD (Polymarket USD) — ERC-20 on Polygon mainnet, 6 decimals. */
+export const PUSD_ADDRESS = '0xC011a7E12a19f7B1f670d46F03B03f3342E82DFB';
+export const PUSD_DECIMALS = 6;
+/** ERC-20 `balanceOf(address)` selector = first 4 bytes of keccak256("balanceOf(address)"). */
+const BALANCE_OF_SELECTOR = '0x70a08231';
+/**
+ * Free, no-key public Polygon RPCs, tried in order until one answers — a single
+ * public endpoint can start gating requests without notice (polygon-rpc.com did),
+ * so we fall through a small list for resilience. Override with PERFOLIO_POLYGON_RPC
+ * (a single endpoint) to pin your own.
+ */
+const DEFAULT_POLYGON_RPCS = [
+    'https://polygon-bor-rpc.publicnode.com',
+    'https://polygon.drpc.org',
+    'https://1rpc.io/matic',
+];
+/** Per-request timeout — a balance read is a courtesy, never worth a long hang. */
+const RPC_TIMEOUT_MS = 5_000;
+/**
+ * ABI-encode `balanceOf(address)` calldata: the 4-byte selector followed by the
+ * address left-padded to a 32-byte word. Throws on a malformed address so the
+ * caller (which swallows failures) reports "unavailable" rather than querying junk.
+ */
+export function encodeBalanceOf(address) {
+    const a = address.trim().toLowerCase();
+    if (!/^0x[0-9a-f]{40}$/.test(a))
+        throw new Error(`Invalid address: ${address}`);
+    return BALANCE_OF_SELECTOR + a.slice(2).padStart(64, '0');
+}
+/** Decode a 32-byte hex word (an eth_call uint256 result) to a bigint. `0x`/empty → 0n. */
+export function decodeUint(hex) {
+    if (typeof hex !== 'string')
+        return 0n;
+    const h = hex.trim();
+    if (!/^0x[0-9a-fA-F]*$/.test(h) || h === '0x')
+        return 0n;
+    return BigInt(h);
+}
+/** Convert a base-unit bigint to a decimal number given the token's decimals. */
+export function baseUnitsToNumber(units, decimals) {
+    if (units === 0n)
+        return 0;
+    const divisor = 10 ** decimals;
+    // 6-decimal balances are tiny relative to Number's safe integer range, so a
+    // direct Number() conversion is exact enough for display money.
+    return Number(units) / divisor;
+}
+/** One `eth_call` to a single RPC endpoint. Returns USD, or `null` on any failure. */
+async function callBalanceOf(rpcUrl, data, f) {
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), RPC_TIMEOUT_MS);
+    try {
+        const res = await f(rpcUrl, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                jsonrpc: '2.0',
+                id: 1,
+                method: 'eth_call',
+                params: [{ to: PUSD_ADDRESS, data }, 'latest'],
+            }),
+            signal: ctrl.signal,
+        });
+        if (!res.ok)
+            return null;
+        const json = (await res.json());
+        if (json.error || typeof json.result !== 'string')
+            return null;
+        return baseUnitsToNumber(decodeUint(json.result), PUSD_DECIMALS);
+    }
+    catch {
+        return null;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * Read the pUSD balance (in USD; 1 pUSD ≈ $1) for a Polygon address via an
+ * `eth_call` to `balanceOf`. Returns the USD amount, or `null` on ANY failure —
+ * a balance read must never throw or break the command that called it.
+ *
+ * Endpoint selection: an explicit `opts.rpcUrl` or `PERFOLIO_POLYGON_RPC` pins a
+ * single endpoint; otherwise we try the public defaults in order and return the
+ * first that answers (so one endpoint going dark doesn't kill the feature).
+ */
+export async function fetchPusdBalanceUsd(address, opts = {}) {
+    let data;
+    try {
+        data = encodeBalanceOf(address);
+    }
+    catch {
+        return null;
+    }
+    const f = opts.fetchImpl ?? fetch;
+    const pinned = opts.rpcUrl || process.env.PERFOLIO_POLYGON_RPC;
+    const endpoints = pinned ? [pinned] : DEFAULT_POLYGON_RPCS;
+    // Two passes over the endpoint list: an intermittent blip can briefly take out
+    // every public RPC at once, and a balance read should survive that rather than
+    // reporting "unavailable" for a perfectly funded account.
+    const PASSES = 2;
+    for (let pass = 0; pass < PASSES; pass++) {
+        for (const rpcUrl of endpoints) {
+            const usd = await callBalanceOf(rpcUrl, data, f);
+            if (usd != null)
+                return usd;
+        }
+    }
+    return null;
+}

package/dist/lib/portfolio-format.js

@@ -0,0 +1,224 @@
+/**
+ * Friendly multi-asset portfolio rendering for the MONEY (investment) side —
+ * ported from the standalone Perfolio CLI so the merged Grant Cash CLI shows the
+ * same rich breakdown.
+ *
+ * Consumes the `GET /api/portfolio/summary?view=full` shape. When the optional
+ * `multiAsset` block is present it renders every spot asset (gold, cash, bitcoin,
+ * ethereum, …) plus the Hyperliquid perps bucket and its per-category breakdown.
+ * When it is absent (gold-only response) it degrades to a gold + cash summary so
+ * the command never shows raw JSON.
+ *
+ * All money is rendered through `formatMoney`, which applies the user's display
+ * currency. Callers pass USD values straight through — never pre-convert.
+ */
+import { formatMoney, DEFAULT_PREFS } from "./currency.js";
+/** Pad a label to a fixed width for aligned columns (plain-text terminals). */
+function pad(label, width) {
+    return label.length >= width ? label : label + " ".repeat(width - label.length);
+}
+function pct(n) {
+    return `${Number(n.toFixed(1))}%`;
+}
+function signed(amountUsd, prefs) {
+    const sign = amountUsd >= 0 ? "+" : "-";
+    return `${sign}${formatMoney(Math.abs(amountUsd), prefs)}`;
+}
+function earnTotalUsd(extras) {
+    return (extras?.earn ?? []).reduce((s, e) => s + (e.valueUsd || 0), 0);
+}
+function predictionTotalUsd(extras) {
+    return (extras?.predictionAvailableUsd ?? 0) + (extras?.predictionPositionsUsd ?? 0);
+}
+function hasExtras(extras) {
+    return earnTotalUsd(extras) > 0 || predictionTotalUsd(extras) > 0;
+}
+export function formatPortfolioView(summary, prefs = DEFAULT_PREFS, extras) {
+    if (hasExtras(extras))
+        return formatWithExtras(summary, prefs, extras);
+    const ma = summary.multiAsset;
+    const lines = [];
+    // ── Gold-only fallback (no multiAsset block) ──
+    if (!ma) {
+        const c = summary.current;
+        lines.push(`Net worth: ${formatMoney(c.netWorthUsd, prefs)}`);
+        lines.push("");
+        lines.push("Holdings");
+        lines.push(`  ${pad("Gold", 12)} ${formatMoney(c.goldValueUsd, prefs)}`);
+        lines.push(`  ${pad("Cash", 12)} ${formatMoney(c.usdtBalance, prefs)}`);
+        if (c.totalDebtUsd > 0) {
+            lines.push("");
+            lines.push(`Borrowed: ${formatMoney(c.totalDebtUsd, prefs)}`);
+        }
+        return lines.join("\n");
+    }
+    // ── Full multi-asset view ──
+    lines.push(`Net worth: ${formatMoney(ma.netWorthUsd, prefs)}`);
+    lines.push("");
+    lines.push("Allocation");
+    const labelWidth = Math.max(8, ...ma.holdings.map((h) => h.label.length), ma.perps ? "Perps".length : 0);
+    for (const h of ma.holdings) {
+        lines.push(`  ${pad(h.label, labelWidth)} ${pad(formatMoney(h.valueUsd, prefs), 14)} ${pct(h.allocationPct)}`);
+    }
+    if (ma.perps) {
+        const p = ma.perps;
+        lines.push(`  ${pad("Perps", labelWidth)} ${pad(formatMoney(p.equityUsd, prefs), 14)} ${pct(p.allocationPct)}`);
+        if (p.byCategory.length > 0) {
+            lines.push("");
+            lines.push("Perps detail");
+            for (const cat of p.byCategory) {
+                const plural = cat.positions === 1 ? "position" : "positions";
+                lines.push(`  ${pad(cat.label, labelWidth)} ${pad(formatMoney(cat.valueUsd, prefs), 14)} ` +
+                    `(PnL ${signed(cat.unrealizedPnlUsd, prefs)}, ${cat.positions} ${plural})`);
+            }
+        }
+    }
+    // Loan context, if any.
+    if (summary.current.totalDebtUsd > 0) {
+        lines.push("");
+        lines.push(`Borrowed: ${formatMoney(summary.current.totalDebtUsd, prefs)}`);
+    }
+    return lines.join("\n");
+}
+/**
+ * The single, honest net worth (USD) including ALL pools: holdings (or gold+cash),
+ * perps equity, earning, and predictions — minus debt.
+ *
+ * The backend exposes `multiAsset.totalUsd` / `multiAsset.netWorthUsd` /
+ * `current.netWorthUsd`, but ALL of them EXCLUDE predictions and earn — which
+ * caused a real ~$190 under-report. This is the one number a programmatic consumer
+ * should trust, and it's emitted as `netWorthUsd` in `portfolio --json`.
+ */
+export function computeNetWorthUsd(summary, extras) {
+    const ma = summary.multiAsset;
+    let gross = 0;
+    if (ma) {
+        gross += ma.holdings.reduce((s, h) => s + h.valueUsd, 0);
+    }
+    else {
+        gross += summary.current.goldValueUsd + summary.current.usdtBalance;
+    }
+    if (ma?.perps)
+        gross += ma.perps.equityUsd;
+    gross += earnTotalUsd(extras);
+    gross += predictionTotalUsd(extras);
+    return gross - summary.current.totalDebtUsd;
+}
+/**
+ * Net-worth view INCLUSIVE of the extra pools (earning + predictions). Used
+ * whenever the user has staked funds or a prediction balance; otherwise the
+ * plain (backend-only) view above is rendered verbatim.
+ */
+function formatWithExtras(summary, prefs, extras) {
+    const ma = summary.multiAsset;
+    const lines = [];
+    const rows = [];
+    if (ma) {
+        for (const h of ma.holdings)
+            rows.push({ label: h.label, valueUsd: h.valueUsd });
+    }
+    else {
+        rows.push({ label: "Gold", valueUsd: summary.current.goldValueUsd });
+        rows.push({ label: "Cash", valueUsd: summary.current.usdtBalance });
+    }
+    const perps = ma?.perps ?? null;
+    if (perps)
+        rows.push({ label: "Perps", valueUsd: perps.equityUsd });
+    const earnTotal = earnTotalUsd(extras);
+    if (earnTotal > 0)
+        rows.push({ label: "Earning", valueUsd: earnTotal });
+    const predTotal = predictionTotalUsd(extras);
+    if (predTotal > 0)
+        rows.push({ label: "Predictions", valueUsd: predTotal });
+    const gross = rows.reduce((s, r) => s + r.valueUsd, 0);
+    const debt = summary.current.totalDebtUsd;
+    // Use the shared computation so the displayed Net worth and the JSON `netWorthUsd`
+    // are always identical.
+    const netWorth = computeNetWorthUsd(summary, extras);
+    lines.push(`Net worth: ${formatMoney(netWorth, prefs)}`);
+    lines.push("");
+    lines.push("Allocation");
+    const labelWidth = Math.max(8, ...rows.map((r) => r.label.length));
+    for (const r of rows) {
+        const allocation = gross > 0 ? (r.valueUsd / gross) * 100 : 0;
+        lines.push(`  ${pad(r.label, labelWidth)} ${pad(formatMoney(r.valueUsd, prefs), 14)} ${pct(allocation)}`);
+    }
+    if (perps && perps.byCategory.length > 0) {
+        lines.push("");
+        lines.push("Perps detail");
+        for (const cat of perps.byCategory) {
+            const plural = cat.positions === 1 ? "position" : "positions";
+            lines.push(`  ${pad(cat.label, labelWidth)} ${pad(formatMoney(cat.valueUsd, prefs), 14)} ` +
+                `(PnL ${signed(cat.unrealizedPnlUsd, prefs)}, ${cat.positions} ${plural})`);
+        }
+    }
+    const earn = (extras.earn ?? []).filter((e) => (e.valueUsd || 0) > 0);
+    if (earn.length > 0) {
+        lines.push("");
+        lines.push("Earning detail");
+        for (const e of earn) {
+            const bits = [];
+            if (e.earnedUsd != null && e.earnedUsd > 0)
+                bits.push(`+${formatMoney(e.earnedUsd, prefs)} earned`);
+            if (e.apy != null)
+                bits.push(`${(e.apy * 100).toFixed(1)}% APY`);
+            const tail = bits.length ? `  (${bits.join(", ")})` : "";
+            lines.push(`  ${pad(e.label, labelWidth)} ${pad(formatMoney(e.valueUsd, prefs), 14)}${tail}`);
+        }
+    }
+    if (predTotal > 0) {
+        lines.push("");
+        lines.push("Predictions detail");
+        const avail = extras.predictionAvailableUsd ?? 0;
+        const inBets = extras.predictionPositionsUsd ?? 0;
+        lines.push(`  ${pad("Available to bet", labelWidth)} ${formatMoney(avail, prefs)}`);
+        if (inBets > 0) {
+            const pnlTail = extras.predictionPnlUsd != null ? ` (PnL ${signed(extras.predictionPnlUsd, prefs)})` : "";
+            lines.push(`  ${pad("In open bets", labelWidth)} ${formatMoney(inBets, prefs)}${pnlTail}`);
+        }
+    }
+    if (debt > 0) {
+        lines.push("");
+        lines.push(`Borrowed: ${formatMoney(debt, prefs)}`);
+    }
+    return lines.join("\n");
+}
+function usdcMinorPlain(minor) {
+    if (minor === undefined || minor === null)
+        return "—";
+    const n = Number(minor) / 1e6;
+    return `$${n.toFixed(n !== 0 && Math.abs(n) < 0.01 ? 4 : 2)}`;
+}
+/** Render the agent (spending) funds block as indented lines (no section title). */
+export function formatAgentFunds(bal) {
+    const status = bal.status;
+    if (status === "not_set_up" || status === "no_active_session") {
+        return [
+            "  Not set up to spend yet.",
+            "  Approve spending limits with `grant login`, or fund the address below.",
+            bal.address ? `  Address: ${bal.address}` : "",
+        ]
+            .filter(Boolean)
+            .join("\n");
+    }
+    if (status === "credit_exhausted") {
+        return [
+            `  Sign-up credit used up — balance ${usdcMinorPlain(bal.totalMinor)}`,
+            "  Add funds to keep spending (`grant fetch`/`grant transfer` need a balance).",
+        ].join("\n");
+    }
+    // active. A funded on-chain session carries live USDC/USDT; a grant-only user
+    // carries the chain-agnostic sign-up credit total in minor units.
+    if (bal.USDC !== undefined || bal.USDT !== undefined) {
+        const lines = [
+            `  Spendable: ${usdcMinorPlain(bal.USDC)} USDC + ${usdcMinorPlain(bal.USDT)} USDT`,
+        ];
+        if (bal.address)
+            lines.push(`  Address:   ${bal.address}`);
+        return lines.join("\n");
+    }
+    const lines = [`  Spendable: ${usdcMinorPlain(bal.totalMinor)} (sign-up credit)`];
+    if (bal.address)
+        lines.push(`  Address:   ${bal.address}`);
+    return lines.join("\n");
+}

package/dist/lib/relay.js

@@ -0,0 +1,19 @@
+import { randomUUID } from 'node:crypto';
+export function newSid() { return randomUUID(); }
+export async function pollRelay(widgetBase, sid, opts = {}) {
+    const f = opts.fetchImpl ?? fetch;
+    const interval = opts.intervalMs ?? 3000;
+    const timeout = opts.timeoutMs ?? 120000;
+    const start = Date.now();
+    while (Date.now() - start < timeout) {
+        try {
+            const res = await f(`${widgetBase}/relay/${sid}`);
+            const json = (await res.json());
+            if (json.data)
+                return json.data;
+        }
+        catch { /* keep polling */ }
+        await new Promise((r) => setTimeout(r, interval));
+    }
+    return null;
+}

package/dist/lib/sign.js

@@ -0,0 +1,29 @@
+/**
+ * Browser-sign poll helper for user-signed operations (withdrawal, gift).
+ *
+ * The CLI prepares the operation and hands the payload to the sign relay
+ * (via PerfolioClient.signStart), opens the browser, then polls here until the
+ * user signs + executes in the browser. Poll is public (the sid is the secret).
+ */
+export async function pollSign(api, sid, f = fetch) {
+    const res = await f(`${api}/cli/sign/poll`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ sid }),
+    });
+    const j = (await res.json().catch(() => ({})));
+    if (!res.ok || !j.success || !j.data)
+        return { status: 'expired' };
+    return j.data;
+}
+/** Poll until the browser signs (complete), the user cancels (denied), or it expires. */
+export async function waitForSign(api, sid, intervalMs, timeoutMs, f = fetch) {
+    const start = Date.now();
+    while (Date.now() - start < timeoutMs) {
+        const r = await pollSign(api, sid, f);
+        if (r.status !== 'pending')
+            return r;
+        await new Promise((res) => setTimeout(res, intervalMs));
+    }
+    return { status: 'expired' };
+}

package/dist/lib/tx-wait.js

@@ -0,0 +1,35 @@
+/** Terminal backend states. (Source: backend TxStatus = submitted|processing|executing|success|failed.) */
+const TERMINAL = new Set(["success", "failed"]);
+/**
+ * After a session-key write (buy/sell), never trust "submitted". Poll the
+ * authoritative per-tx status endpoint for THIS exact txHash until it reaches
+ * success/failed or we time out. MEE/cross-chain settlement can take a while, so
+ * the timeout is generous. Ported from the standalone Perfolio CLI so the merged
+ * CLI reports honestly — never a premature "✓ done".
+ */
+export async function waitForTx(money, txHash, opts = {}) {
+    if (!txHash)
+        return { status: "timeout" };
+    const timeout = opts.timeoutMs ?? 180_000; // 3 min — MEE/cross-chain headroom
+    const interval = opts.intervalMs ?? 4_000;
+    // A just-submitted tx isn't queryable for a beat (the DB row commits slightly
+    // after the submit response). Wait once up front so the FIRST poll doesn't 404.
+    const initialDelay = opts.initialDelayMs ?? 2_500;
+    const start = Date.now();
+    let last;
+    if (initialDelay > 0)
+        await new Promise((r) => setTimeout(r, initialDelay));
+    while (Date.now() - start < timeout) {
+        try {
+            last = await money.getTxStatus(txHash);
+            if (last && TERMINAL.has(last.status)) {
+                return { status: last.status, txHash, receipt: last.receipt };
+            }
+        }
+        catch {
+            // 404 right after submit (row not indexed yet) or a transient blip — keep polling.
+        }
+        await new Promise((r) => setTimeout(r, interval));
+    }
+    return { status: last?.status === "failed" ? "failed" : "timeout", txHash, receipt: last?.receipt };
+}

package/dist/lib/types.js

@@ -0,0 +1,10 @@
+/**
+ * Shared types for the merged Grant Cash CLI.
+ *
+ * Two engines, one identity (one Privy app underneath): the MONEY side
+ * (Perfolio backend — gold, portfolio, cash) authenticates with a Bearer
+ * device token (`pfk_`), and the AGENT side (Agent-mode backend — pay-per-use
+ * services) authenticates with an `X-API-Key` (`grant_live_`). Both credentials
+ * live in one file so a single `grant login` connects everything.
+ */
+export {};