@allscale/cli 0.1.0

package/oclif.manifest.json

@@ -0,0 +1,3329 @@
+{
+  "commands": {
+    "build-info": {
+      "aliases": [],
+      "args": {},
+      "description": "Show which API base (if any) this build is bound to, and its signing-key id. Never prints the signing key itself — only its (non-secret, already-forgeable) id.",
+      "examples": [
+        "$ allscale build-info"
+      ],
+      "flags": {
+        "json": {
+          "description": "Format output as json.",
+          "helpGroup": "GLOBAL",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "profile": {
+          "description": "Named profile from ~/.allscale/config.toml",
+          "helpGroup": "GLOBAL",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "token": {
+          "description": "Override the access token for this invocation (precedence: --token > ALLSCALE_TOKEN > --profile)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base": {
+          "description": "Override the API base URL (public builds accept only https://app.allscale.io)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "api-base",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "insecure-storage": {
+          "description": "Force POSIX plaintext token storage at ~/.allscale/credentials.json (mode 0600) instead of the OS keychain — for headless / CI / agent use. Unavailable on Windows because Node cannot verify owner-only ACL/link safety. Also via ALLSCALE_INSECURE_STORAGE=1.",
+          "helpGroup": "GLOBAL",
+          "name": "insecure-storage",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "build-info",
+      "pluginAlias": "@allscale/cli",
+      "pluginName": "@allscale/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": true,
+      "legacyStagingNoticeShown": false,
+      "emitsOwnOutput": false,
+      "requiresEscapeHatch": false,
+      "requiresInput": false,
+      "isLocalOnly": true,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "build-info.js"
+      ]
+    },
+    "describe": {
+      "aliases": [],
+      "args": {
+        "name": {
+          "description": "Operation name",
+          "name": "name",
+          "required": true
+        }
+      },
+      "description": "Show full type info for one operation: args, return type, default-selection example document. Disabled by default (exit 10); set ALLSCALE_ALLOW_RAW=1 to enable.",
+      "examples": [
+        "$ allscale describe business",
+        "$ allscale describe create_payment"
+      ],
+      "flags": {
+        "json": {
+          "description": "Format output as json.",
+          "helpGroup": "GLOBAL",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "profile": {
+          "description": "Named profile from ~/.allscale/config.toml",
+          "helpGroup": "GLOBAL",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "token": {
+          "description": "Override the access token for this invocation (precedence: --token > ALLSCALE_TOKEN > --profile)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base": {
+          "description": "Override the API base URL (public builds accept only https://app.allscale.io)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "api-base",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "insecure-storage": {
+          "description": "Force POSIX plaintext token storage at ~/.allscale/credentials.json (mode 0600) instead of the OS keychain — for headless / CI / agent use. Unavailable on Windows because Node cannot verify owner-only ACL/link safety. Also via ALLSCALE_INSECURE_STORAGE=1.",
+          "helpGroup": "GLOBAL",
+          "name": "insecure-storage",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "describe",
+      "pluginAlias": "@allscale/cli",
+      "pluginName": "@allscale/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": true,
+      "legacyStagingNoticeShown": false,
+      "emitsOwnOutput": false,
+      "requiresEscapeHatch": true,
+      "requiresInput": false,
+      "isLocalOnly": true,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "describe.js"
+      ]
+    },
+    "device-login": {
+      "aliases": [],
+      "args": {},
+      "description": "Log in via browser-confirmed device pairing. Use an existing web session or sign in there with Passkey or Email (enter the Email OTP on the webpage), then approve the CLI. The backend mints a scoped agent key — the only credential this CLI issues; no web sign-in secret is entered in the terminal.",
+      "examples": [
+        "$ allscale device-login",
+        "$ allscale device-login --device-label tom-mbp-2026",
+        "$ allscale device-login --device-label CI-runner --scopes invoice:read_only --scopes claim_link:all"
+      ],
+      "flags": {
+        "json": {
+          "description": "Format output as json.",
+          "helpGroup": "GLOBAL",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "profile": {
+          "description": "Named profile from ~/.allscale/config.toml",
+          "helpGroup": "GLOBAL",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "token": {
+          "description": "Override the access token for this invocation (precedence: --token > ALLSCALE_TOKEN > --profile)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base": {
+          "description": "Override the API base URL (public builds accept only https://app.allscale.io)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "api-base",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "insecure-storage": {
+          "description": "Force POSIX plaintext token storage at ~/.allscale/credentials.json (mode 0600) instead of the OS keychain — for headless / CI / agent use. Unavailable on Windows because Node cannot verify owner-only ACL/link safety. Also via ALLSCALE_INSECURE_STORAGE=1.",
+          "helpGroup": "GLOBAL",
+          "name": "insecure-storage",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "device-label": {
+          "description": "Human-readable label shown in the browser approval UI so the user can confirm they're authorizing the right device.",
+          "name": "device-label",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "scopes": {
+          "description": "Requested scopes for the eventual agent key, repeatable. Scope strings use `<category>:<tier>`; `:all` implies `:read_only` for the same category. Pairs the approval screen can grant: invoice:{read_only,all}, contact:{read_only,all}, transaction:read_only, wallet:read_only, claim_link:{read_only,all}, store:all. The final set is chosen — and can be overridden — on that screen, and is ENFORCED server-side on every request. The Wallets toggle is on by default and grants `wallet:read_only`, which `invoice pay` and `wallet list` both need.",
+          "name": "scopes",
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "type": "option"
+        },
+        "no-browser": {
+          "description": "Skip launching the browser; print the verification URL only. Open it in a browser to sign in with Passkey or Email and approve (the Email OTP stays on the webpage). Useful for CI or ssh sessions.",
+          "name": "no-browser",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "yes": {
+          "char": "y",
+          "description": "Skip the interactive confirmation and start the pairing immediately. Only a BARE invocation is ever prompted, so passing any flag already skips it; use this to say so explicitly. Automation that allocates a pty for stdin/stdout/stderr and runs the command bare is indistinguishable from a human — that is the case this flag exists for.",
+          "name": "yes",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "device-login",
+      "pluginAlias": "@allscale/cli",
+      "pluginName": "@allscale/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": true,
+      "legacyStagingNoticeShown": false,
+      "emitsOwnOutput": false,
+      "requiresEscapeHatch": false,
+      "requiresInput": false,
+      "isLocalOnly": false,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "device-login.js"
+      ]
+    },
+    "logout": {
+      "aliases": [],
+      "args": {},
+      "description": "Clear cached credentials (session token + store keys) for a profile. By default, clears BOTH the OS keychain and plaintext file store. With --insecure-storage or ALLSCALE_INSECURE_STORAGE=1, clears only plaintext files and never probes the keychain; omit/unset that opt-in when a full-machine sweep is wanted. If the keychain is suppressed or unavailable, a bare logout fails closed after attempting the plaintext-file cleanup.",
+      "examples": [
+        "$ allscale logout",
+        "$ allscale logout --profile staging"
+      ],
+      "flags": {
+        "json": {
+          "description": "Format output as json.",
+          "helpGroup": "GLOBAL",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "profile": {
+          "description": "Named profile from ~/.allscale/config.toml",
+          "helpGroup": "GLOBAL",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "token": {
+          "description": "Override the access token for this invocation (precedence: --token > ALLSCALE_TOKEN > --profile)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base": {
+          "description": "Override the API base URL (public builds accept only https://app.allscale.io)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "api-base",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "insecure-storage": {
+          "description": "Force POSIX plaintext token storage at ~/.allscale/credentials.json (mode 0600) instead of the OS keychain — for headless / CI / agent use. Unavailable on Windows because Node cannot verify owner-only ACL/link safety. Also via ALLSCALE_INSECURE_STORAGE=1.",
+          "helpGroup": "GLOBAL",
+          "name": "insecure-storage",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "logout",
+      "pluginAlias": "@allscale/cli",
+      "pluginName": "@allscale/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": true,
+      "legacyStagingNoticeShown": false,
+      "emitsOwnOutput": false,
+      "requiresEscapeHatch": false,
+      "requiresInput": false,
+      "isLocalOnly": true,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "logout.js"
+      ]
+    },
+    "operations": {
+      "aliases": [],
+      "args": {},
+      "description": "List every operation exposed by the schema (queries and mutations). Disabled by default (exit 10); set ALLSCALE_ALLOW_RAW=1 to enable.",
+      "examples": [
+        "$ allscale operations",
+        "$ allscale operations --kind mutation",
+        "$ allscale operations --grep invoice"
+      ],
+      "flags": {
+        "json": {
+          "description": "Format output as json.",
+          "helpGroup": "GLOBAL",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "profile": {
+          "description": "Named profile from ~/.allscale/config.toml",
+          "helpGroup": "GLOBAL",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "token": {
+          "description": "Override the access token for this invocation (precedence: --token > ALLSCALE_TOKEN > --profile)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base": {
+          "description": "Override the API base URL (public builds accept only https://app.allscale.io)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "api-base",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "insecure-storage": {
+          "description": "Force POSIX plaintext token storage at ~/.allscale/credentials.json (mode 0600) instead of the OS keychain — for headless / CI / agent use. Unavailable on Windows because Node cannot verify owner-only ACL/link safety. Also via ALLSCALE_INSECURE_STORAGE=1.",
+          "helpGroup": "GLOBAL",
+          "name": "insecure-storage",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "kind": {
+          "char": "k",
+          "description": "Filter by operation kind",
+          "name": "kind",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "query",
+            "mutation"
+          ],
+          "type": "option"
+        },
+        "grep": {
+          "char": "g",
+          "description": "Filter by substring match against name + description (case-insensitive)",
+          "name": "grep",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "operations",
+      "pluginAlias": "@allscale/cli",
+      "pluginName": "@allscale/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": true,
+      "legacyStagingNoticeShown": false,
+      "emitsOwnOutput": false,
+      "requiresEscapeHatch": true,
+      "requiresInput": false,
+      "isLocalOnly": true,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "operations.js"
+      ]
+    },
+    "otp-login": {
+      "aliases": [],
+      "args": {},
+      "description": "Terminal-only Email OTP login for headless / scripted shells. Works with any account email (external domains included; the account must already exist). Sends the code (unless --otp-id is supplied), reads it in the terminal, and mints a scope-ENFORCED agent API key — the only credential this CLI issues. Scopes are set with --scopes (required; no full-permission default exists).",
+      "examples": [
+        "$ allscale otp-login --email me@example.com --scopes invoice:read_only  # interactive: prompts on stdin",
+        "$ printf '%s' \"$OTP\" | allscale otp-login --email me@example.com --scopes invoice:all --otp-stdin",
+        "$ ALLSCALE_OTP=$(read-from-mailbox) allscale otp-login --email me@example.com --scopes claim_link:all",
+        "$ allscale otp-login --email me@example.com --scopes invoice:read_only --otp-id <id> --otp <code>"
+      ],
+      "flags": {
+        "json": {
+          "description": "Format output as json.",
+          "helpGroup": "GLOBAL",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "profile": {
+          "description": "Named profile from ~/.allscale/config.toml",
+          "helpGroup": "GLOBAL",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "token": {
+          "description": "Override the access token for this invocation (precedence: --token > ALLSCALE_TOKEN > --profile)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base": {
+          "description": "Override the API base URL (public builds accept only https://app.allscale.io)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "api-base",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "insecure-storage": {
+          "description": "Force POSIX plaintext token storage at ~/.allscale/credentials.json (mode 0600) instead of the OS keychain — for headless / CI / agent use. Unavailable on Windows because Node cannot verify owner-only ACL/link safety. Also via ALLSCALE_INSECURE_STORAGE=1.",
+          "helpGroup": "GLOBAL",
+          "name": "insecure-storage",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "email": {
+          "char": "e",
+          "description": "Account email",
+          "helpGroup": "REQUIRED",
+          "name": "email",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "scopes": {
+          "description": "Scopes the minted agent key should carry, repeatable. Scope strings use `<category>:<tier>`; `:all` implies `:read_only` for the same category. Pairs that reach a real operation today: invoice:{read_only,all}, contact:{read_only,all}, claim_link:{read_only,all}, transaction:read_only, store:all, wallet:read_only. Other pairs are accepted by the catalog but grant nothing, and this command does NOT warn when a requested scope is clipped — verify with `allscale scope` after minting. Required — the backend deliberately has no full-permission default. Requested scopes are clipped to your account's role; keys are ENFORCED server-side on every request.",
+          "helpGroup": "REQUIRED",
+          "name": "scopes",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "type": "option"
+        },
+        "otp-id": {
+          "description": "Skip the send step and use this otp_id (e.g. from a previous `otp-send`)",
+          "name": "otp-id",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "otp": {
+          "description": "OTP code from the email. Prefer ALLSCALE_OTP or --otp-stdin to keep it out of shell history.",
+          "exclusive": [
+            "otp-stdin"
+          ],
+          "name": "otp",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "otp-stdin": {
+          "description": "Read the OTP code as one line from stdin",
+          "exclusive": [
+            "otp"
+          ],
+          "name": "otp-stdin",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "no-existence-check": {
+          "description": "(DEPRECATED — now errors) Registration via the CLI OTP flow was removed: the CLI-only login endpoint signs in existing accounts only. Create the account in the AllScale web app first, then log in without this flag.",
+          "hidden": true,
+          "name": "no-existence-check",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "device-label": {
+          "description": "Human-readable device/agent label recorded on the minted key so it is identifiable in the key management list.",
+          "name": "device-label",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "otp-login",
+      "pluginAlias": "@allscale/cli",
+      "pluginName": "@allscale/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": true,
+      "legacyStagingNoticeShown": false,
+      "emitsOwnOutput": false,
+      "requiresEscapeHatch": false,
+      "requiresInput": false,
+      "isLocalOnly": false,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "otp-login.js"
+      ]
+    },
+    "otp-send": {
+      "aliases": [],
+      "args": {},
+      "description": "Send an email OTP for login. Works with any account email (external domains included). Returns the otp_id; the user receives the code by email. Login only: the account must already exist.",
+      "examples": [
+        "$ allscale otp-send --email me@example.com"
+      ],
+      "flags": {
+        "json": {
+          "description": "Format output as json.",
+          "helpGroup": "GLOBAL",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "profile": {
+          "description": "Named profile from ~/.allscale/config.toml",
+          "helpGroup": "GLOBAL",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "token": {
+          "description": "Override the access token for this invocation (precedence: --token > ALLSCALE_TOKEN > --profile)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base": {
+          "description": "Override the API base URL (public builds accept only https://app.allscale.io)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "api-base",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "insecure-storage": {
+          "description": "Force POSIX plaintext token storage at ~/.allscale/credentials.json (mode 0600) instead of the OS keychain — for headless / CI / agent use. Unavailable on Windows because Node cannot verify owner-only ACL/link safety. Also via ALLSCALE_INSECURE_STORAGE=1.",
+          "helpGroup": "GLOBAL",
+          "name": "insecure-storage",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "email": {
+          "char": "e",
+          "description": "Account email",
+          "helpGroup": "REQUIRED",
+          "name": "email",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "no-existence-check": {
+          "description": "(DEPRECATED — now errors) Registration via the CLI OTP flow was removed: the CLI-only login endpoint signs in existing accounts only. Create the account in the AllScale web app first, then log in without this flag.",
+          "hidden": true,
+          "name": "no-existence-check",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "otp-send",
+      "pluginAlias": "@allscale/cli",
+      "pluginName": "@allscale/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": true,
+      "legacyStagingNoticeShown": false,
+      "emitsOwnOutput": false,
+      "requiresEscapeHatch": false,
+      "requiresInput": false,
+      "isLocalOnly": false,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "otp-send.js"
+      ]
+    },
+    "scope": {
+      "aliases": [],
+      "args": {},
+      "description": "Show the capabilities granted to the current CLI session (chosen on the browser approval screen at `device-login`, or via --scopes on `otp-login`). Scopes are ENFORCED server-side on every request. Read from the cached token bundle; no network call.",
+      "examples": [
+        "$ allscale scope",
+        "$ allscale scope --profile prod"
+      ],
+      "flags": {
+        "json": {
+          "description": "Format output as json.",
+          "helpGroup": "GLOBAL",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "profile": {
+          "description": "Named profile from ~/.allscale/config.toml",
+          "helpGroup": "GLOBAL",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "token": {
+          "description": "Override the access token for this invocation (precedence: --token > ALLSCALE_TOKEN > --profile)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base": {
+          "description": "Override the API base URL (public builds accept only https://app.allscale.io)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "api-base",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "insecure-storage": {
+          "description": "Force POSIX plaintext token storage at ~/.allscale/credentials.json (mode 0600) instead of the OS keychain — for headless / CI / agent use. Unavailable on Windows because Node cannot verify owner-only ACL/link safety. Also via ALLSCALE_INSECURE_STORAGE=1.",
+          "helpGroup": "GLOBAL",
+          "name": "insecure-storage",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "scope",
+      "pluginAlias": "@allscale/cli",
+      "pluginName": "@allscale/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": true,
+      "legacyStagingNoticeShown": false,
+      "emitsOwnOutput": false,
+      "requiresEscapeHatch": false,
+      "requiresInput": false,
+      "isLocalOnly": true,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "scope.js"
+      ]
+    },
+    "whoami": {
+      "aliases": [],
+      "args": {},
+      "description": "Show the current authenticated identity from the stored credential (agent-key sessions report business_id / scopes / expiry; legacy password sessions decode the cached JWT). No network call.",
+      "examples": [
+        "$ allscale whoami",
+        "$ allscale whoami --profile prod"
+      ],
+      "flags": {
+        "json": {
+          "description": "Format output as json.",
+          "helpGroup": "GLOBAL",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "profile": {
+          "description": "Named profile from ~/.allscale/config.toml",
+          "helpGroup": "GLOBAL",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "token": {
+          "description": "Override the access token for this invocation (precedence: --token > ALLSCALE_TOKEN > --profile)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base": {
+          "description": "Override the API base URL (public builds accept only https://app.allscale.io)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "api-base",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "insecure-storage": {
+          "description": "Force POSIX plaintext token storage at ~/.allscale/credentials.json (mode 0600) instead of the OS keychain — for headless / CI / agent use. Unavailable on Windows because Node cannot verify owner-only ACL/link safety. Also via ALLSCALE_INSECURE_STORAGE=1.",
+          "helpGroup": "GLOBAL",
+          "name": "insecure-storage",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "whoami",
+      "pluginAlias": "@allscale/cli",
+      "pluginName": "@allscale/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": true,
+      "legacyStagingNoticeShown": false,
+      "emitsOwnOutput": false,
+      "requiresEscapeHatch": false,
+      "requiresInput": false,
+      "isLocalOnly": true,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "whoami.js"
+      ]
+    },
+    "claim-link:claim": {
+      "aliases": [],
+      "args": {},
+      "description": "Claim a Claim Link. Anonymous claims require --to; authenticated business receivers can use --to-wallet. Only an on-chain-proven claimed outcome exits 0.",
+      "examples": [
+        "$ allscale claim-link claim --claim-token <token> --to 0xabc...",
+        "$ allscale claim-link claim --claim-url https://app.allscale.io/claim/<token> --to-wallet"
+      ],
+      "flags": {
+        "json": {
+          "description": "Format output as json.",
+          "helpGroup": "GLOBAL",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "profile": {
+          "description": "Named profile from ~/.allscale/config.toml",
+          "helpGroup": "GLOBAL",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "token": {
+          "description": "Override the access token for this invocation (precedence: --token > ALLSCALE_TOKEN > --profile)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base": {
+          "description": "Override the API base URL (public builds accept only https://app.allscale.io)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "api-base",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "insecure-storage": {
+          "description": "Force POSIX plaintext token storage at ~/.allscale/credentials.json (mode 0600) instead of the OS keychain — for headless / CI / agent use. Unavailable on Windows because Node cannot verify owner-only ACL/link safety. Also via ALLSCALE_INSECURE_STORAGE=1.",
+          "helpGroup": "GLOBAL",
+          "name": "insecure-storage",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "claim-token": {
+          "description": "Raw bearer claim token. Secret: prefer env/history-safe invocation.",
+          "helpGroup": "REQUIRED (ONE OF)",
+          "name": "claim-token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "claim-url": {
+          "description": "Canonical claim URL, or a same-origin /s/ short URL resolved with one unauthenticated 302.",
+          "helpGroup": "REQUIRED (ONE OF)",
+          "name": "claim-url",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "to": {
+          "description": "Receiver EVM address for anonymous Path-A claims.",
+          "exclusive": [
+            "to-wallet"
+          ],
+          "helpGroup": "REQUIRED (ONE OF)",
+          "name": "to",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "to-wallet": {
+          "description": "Claim into the authenticated receiver business's AllScale wallet for the link's chain. Requires login/token.",
+          "exclusive": [
+            "to"
+          ],
+          "helpGroup": "REQUIRED (ONE OF)",
+          "name": "to-wallet",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "claim-link:claim",
+      "pluginAlias": "@allscale/cli",
+      "pluginName": "@allscale/cli",
+      "pluginType": "core",
+      "strict": true,
+      "usage": "claim-link claim (--claim-token <value> | --claim-url <value>) [--json] [--profile <value>] [--insecure-storage] [--to <value> | --to-wallet]",
+      "enableJsonFlag": true,
+      "legacyStagingNoticeShown": false,
+      "emitsOwnOutput": false,
+      "requiresEscapeHatch": false,
+      "requiresInput": true,
+      "isLocalOnly": false,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "claim-link",
+        "claim.js"
+      ]
+    },
+    "claim-link:create": {
+      "aliases": [],
+      "args": {},
+      "description": "Create and fund a fixed-intent Claim Link in one browser authorization ceremony, then confirm the authoritative lifecycle state. Requires claim_link:all for an agent-key session.",
+      "examples": [
+        "$ allscale claim-link create --idempotency-key order-1042 --amount 10 --chain base",
+        "$ allscale claim-link create --idempotency-key order-1043 --amount 25.50 --stable-coin USDC --chain polygon --expires 7d --message 'Invoice 1043'",
+        "$ allscale claim-link create --idempotency-key order-1044 --amount 5 --chain base --receiver-email client@example.com --sender-display-name 'Acme' --no-browser"
+      ],
+      "flags": {
+        "json": {
+          "description": "Format output as json.",
+          "helpGroup": "GLOBAL",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "profile": {
+          "description": "Named profile from ~/.allscale/config.toml",
+          "helpGroup": "GLOBAL",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "token": {
+          "description": "Override the access token for this invocation (precedence: --token > ALLSCALE_TOKEN > --profile)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base": {
+          "description": "Override the API base URL (public builds accept only https://app.allscale.io)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "api-base",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "insecure-storage": {
+          "description": "Force POSIX plaintext token storage at ~/.allscale/credentials.json (mode 0600) instead of the OS keychain — for headless / CI / agent use. Unavailable on Windows because Node cannot verify owner-only ACL/link safety. Also via ALLSCALE_INSECURE_STORAGE=1.",
+          "helpGroup": "GLOBAL",
+          "name": "insecure-storage",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "amount": {
+          "description": "Exact amount the receiver can claim, as a decimal string. Range 0.1-10000; at most 6 effective decimal places. The CLI never rounds it.",
+          "helpGroup": "REQUIRED",
+          "name": "amount",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "chain": {
+          "description": "EVM chain for the Claim Link.",
+          "helpGroup": "REQUIRED",
+          "name": "chain",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "ethereum",
+            "bsc",
+            "base",
+            "polygon",
+            "arbitrum",
+            "optimism"
+          ],
+          "type": "option"
+        },
+        "idempotency-key": {
+          "description": "Required stable key for this logical Claim Link create/fund operation (1-128 characters). Reuse it after an ambiguous result; use a new key only for an intentional second link.",
+          "helpGroup": "REQUIRED",
+          "name": "idempotency-key",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "stable-coin": {
+          "description": "Stablecoin for the Claim Link.",
+          "name": "stable-coin",
+          "default": "USDT",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "USDT",
+            "USDC"
+          ],
+          "type": "option"
+        },
+        "receiver-email": {
+          "description": "Optional sender-only receiver label. AllScale does not email the receiver; you still share the resulting link yourself.",
+          "name": "receiver-email",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "sender-display-name": {
+          "description": "Optional sender name shown to the receiver. Max 100 characters.",
+          "name": "sender-display-name",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "message": {
+          "description": "Optional purpose/message shown on the Claim Link page. Max 200 characters.",
+          "name": "message",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "expires": {
+          "description": "Claim window as a duration using m/h/d (1m-30d). The window starts after funding confirms.",
+          "name": "expires",
+          "default": "14d",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "bridge-timeout": {
+          "description": "Shorten the browser confirmation deadline, in milliseconds. By default the CLI waits for the broker op TTL.",
+          "name": "bridge-timeout",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "browser-base": {
+          "description": "Override the trusted base URL of the printed /cli bridge link (defaults to the session API base).",
+          "name": "browser-base",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "no-browser": {
+          "description": "Do not auto-open a local browser. The command still prints the bridge URL and waits for its callback or a pasted receipt.",
+          "name": "no-browser",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "claim-link:create",
+      "pluginAlias": "@allscale/cli",
+      "pluginName": "@allscale/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": true,
+      "legacyStagingNoticeShown": false,
+      "emitsOwnOutput": false,
+      "requiresEscapeHatch": false,
+      "requiresInput": false,
+      "isLocalOnly": false,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "claim-link",
+        "create.js"
+      ]
+    },
+    "claim-link:get": {
+      "aliases": [],
+      "args": {
+        "id": {
+          "description": "Claim Link id_str.",
+          "name": "id",
+          "required": true
+        }
+      },
+      "description": "Fetch one of your own Claim Links by id. Unknown or non-owned ids are indistinguishable on the backend.",
+      "examples": [
+        "$ allscale claim-link get 65ab1234567890abcdef0123",
+        "$ allscale claim-link get 65ab... --select 'id status amount token_symbol chain'"
+      ],
+      "flags": {
+        "json": {
+          "description": "Format output as json.",
+          "helpGroup": "GLOBAL",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "profile": {
+          "description": "Named profile from ~/.allscale/config.toml",
+          "helpGroup": "GLOBAL",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "token": {
+          "description": "Override the access token for this invocation (precedence: --token > ALLSCALE_TOKEN > --profile)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base": {
+          "description": "Override the API base URL (public builds accept only https://app.allscale.io)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "api-base",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "insecure-storage": {
+          "description": "Force POSIX plaintext token storage at ~/.allscale/credentials.json (mode 0600) instead of the OS keychain — for headless / CI / agent use. Unavailable on Windows because Node cannot verify owner-only ACL/link safety. Also via ALLSCALE_INSECURE_STORAGE=1.",
+          "helpGroup": "GLOBAL",
+          "name": "insecure-storage",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "select": {
+          "char": "s",
+          "description": "Override the default selection set with a GraphQL fragment. Default: 'id business_id status amount token_symbol chain sender_display_name sender_message receiver_email reference_id expected_deposit_total funded_amount funded_tx_hash expiry_at claimed_via claim_tx_hash refund_tx_hash refunded_at created_at updated_at'. Other selectable fields on ClaimLink: service_fee, network_fee, cancel_requested_at, claim_url. Pass --show-doc to print the exact GraphQL document that gets sent.",
+          "name": "select",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "show-doc": {
+          "description": "Print the GraphQL document to stderr.",
+          "name": "show-doc",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "claim-link:get",
+      "pluginAlias": "@allscale/cli",
+      "pluginName": "@allscale/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": true,
+      "legacyStagingNoticeShown": false,
+      "emitsOwnOutput": false,
+      "requiresEscapeHatch": false,
+      "requiresInput": false,
+      "isLocalOnly": false,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "claim-link",
+        "get.js"
+      ]
+    },
+    "claim-link:list": {
+      "aliases": [],
+      "args": {},
+      "description": "List your own Claim Links newest first. Defaults to the first 50 rows; pass --input or --all to override.",
+      "examples": [
+        "$ allscale claim-link list",
+        "$ allscale claim-link list --status link_sent --input '{\"limit\":20}'",
+        "$ allscale claim-link list --all --select 'count items { id status amount token_symbol chain }'"
+      ],
+      "flags": {
+        "json": {
+          "description": "Format output as json.",
+          "helpGroup": "GLOBAL",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "profile": {
+          "description": "Named profile from ~/.allscale/config.toml",
+          "helpGroup": "GLOBAL",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "token": {
+          "description": "Override the access token for this invocation (precedence: --token > ALLSCALE_TOKEN > --profile)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base": {
+          "description": "Override the API base URL (public builds accept only https://app.allscale.io)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "api-base",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "insecure-storage": {
+          "description": "Force POSIX plaintext token storage at ~/.allscale/credentials.json (mode 0600) instead of the OS keychain — for headless / CI / agent use. Unavailable on Windows because Node cannot verify owner-only ACL/link safety. Also via ALLSCALE_INSECURE_STORAGE=1.",
+          "helpGroup": "GLOBAL",
+          "name": "insecure-storage",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "status": {
+          "description": "Optional ClaimLinkStatus filter. Accepts 1..6 or pending_deposit/link_sent/claiming/claimed/expired/cancelled.",
+          "name": "status",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "input": {
+          "char": "i",
+          "description": "QueryInput as JSON, e.g. '{\"skip\":0,\"limit\":50,\"order_by\":[]}'. Overrides the default limit=50.",
+          "exclusive": [
+            "all"
+          ],
+          "name": "input",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "all": {
+          "description": "Request all rows in one response (equivalent to --input '{\"limit\":0}'); the CLI rejects read-only responses over 32 MiB.",
+          "exclusive": [
+            "input"
+          ],
+          "name": "all",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "select": {
+          "char": "s",
+          "description": "Override the default selection set with a GraphQL fragment. Default: 'count items { id business_id status amount token_symbol chain sender_display_name sender_message receiver_email reference_id expected_deposit_total funded_amount funded_tx_hash expiry_at claimed_via claim_tx_hash refund_tx_hash refunded_at created_at updated_at }'. Other selectable fields on ClaimLinkPaginatedResponse.items (ClaimLink): service_fee, network_fee, cancel_requested_at, claim_url. Pass --show-doc to print the exact GraphQL document that gets sent.",
+          "name": "select",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "show-doc": {
+          "description": "Print the GraphQL document to stderr.",
+          "name": "show-doc",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "claim-link:list",
+      "pluginAlias": "@allscale/cli",
+      "pluginName": "@allscale/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": true,
+      "legacyStagingNoticeShown": false,
+      "emitsOwnOutput": false,
+      "requiresEscapeHatch": false,
+      "requiresInput": false,
+      "isLocalOnly": false,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "claim-link",
+        "list.js"
+      ]
+    },
+    "claim-link:preview": {
+      "aliases": [],
+      "args": {},
+      "description": "Preview Claim Link fees without creating a link. Mirrors create_claim_link validation.",
+      "examples": [
+        "$ allscale claim-link preview --amount 10 --chain base --per-transfer-gas 0.02"
+      ],
+      "flags": {
+        "json": {
+          "description": "Format output as json.",
+          "helpGroup": "GLOBAL",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "profile": {
+          "description": "Named profile from ~/.allscale/config.toml",
+          "helpGroup": "GLOBAL",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "token": {
+          "description": "Override the access token for this invocation (precedence: --token > ALLSCALE_TOKEN > --profile)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base": {
+          "description": "Override the API base URL (public builds accept only https://app.allscale.io)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "api-base",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "insecure-storage": {
+          "description": "Force POSIX plaintext token storage at ~/.allscale/credentials.json (mode 0600) instead of the OS keychain — for headless / CI / agent use. Unavailable on Windows because Node cannot verify owner-only ACL/link safety. Also via ALLSCALE_INSECURE_STORAGE=1.",
+          "helpGroup": "GLOBAL",
+          "name": "insecure-storage",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "amount": {
+          "description": "Receiver amount as a decimal string in token units; at most 6 effective decimals, or 18 on BSC.",
+          "helpGroup": "REQUIRED",
+          "name": "amount",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "chain": {
+          "description": "EVM chain for the claim link.",
+          "helpGroup": "REQUIRED",
+          "name": "chain",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "ethereum",
+            "bsc",
+            "base",
+            "polygon",
+            "arbitrum",
+            "optimism"
+          ],
+          "type": "option"
+        },
+        "per-transfer-gas": {
+          "description": "One ERC-20 transfer's gas estimate in token units.",
+          "helpGroup": "REQUIRED",
+          "name": "per-transfer-gas",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "stable-coin": {
+          "description": "Stablecoin for the link.",
+          "name": "stable-coin",
+          "default": "USDT",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "USDT",
+            "USDC"
+          ],
+          "type": "option"
+        },
+        "show-doc": {
+          "description": "Print the GraphQL document to stderr.",
+          "name": "show-doc",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "claim-link:preview",
+      "pluginAlias": "@allscale/cli",
+      "pluginName": "@allscale/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": true,
+      "legacyStagingNoticeShown": false,
+      "emitsOwnOutput": false,
+      "requiresEscapeHatch": false,
+      "requiresInput": false,
+      "isLocalOnly": false,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "claim-link",
+        "preview.js"
+      ]
+    },
+    "claim-link:status": {
+      "aliases": [],
+      "args": {},
+      "description": "Read the public receiver-facing status snapshot for a Claim Link bearer token or URL.",
+      "examples": [
+        "$ allscale claim-link status --claim-token <token>",
+        "$ allscale claim-link status --claim-url https://app.allscale.io/claim/<token>"
+      ],
+      "flags": {
+        "json": {
+          "description": "Format output as json.",
+          "helpGroup": "GLOBAL",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "profile": {
+          "description": "Named profile from ~/.allscale/config.toml",
+          "helpGroup": "GLOBAL",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "token": {
+          "description": "Override the access token for this invocation (precedence: --token > ALLSCALE_TOKEN > --profile)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base": {
+          "description": "Override the API base URL (public builds accept only https://app.allscale.io)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "api-base",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "insecure-storage": {
+          "description": "Force POSIX plaintext token storage at ~/.allscale/credentials.json (mode 0600) instead of the OS keychain — for headless / CI / agent use. Unavailable on Windows because Node cannot verify owner-only ACL/link safety. Also via ALLSCALE_INSECURE_STORAGE=1.",
+          "helpGroup": "GLOBAL",
+          "name": "insecure-storage",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "claim-token": {
+          "description": "Raw bearer claim token. Secret: prefer env/history-safe invocation.",
+          "helpGroup": "REQUIRED (ONE OF)",
+          "name": "claim-token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "claim-url": {
+          "description": "Canonical claim URL, or a same-origin /s/ short URL resolved with one unauthenticated 302.",
+          "helpGroup": "REQUIRED (ONE OF)",
+          "name": "claim-url",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "claim-link:status",
+      "pluginAlias": "@allscale/cli",
+      "pluginName": "@allscale/cli",
+      "pluginType": "core",
+      "strict": true,
+      "usage": "claim-link status (--claim-token <value> | --claim-url <value>) [--json] [--profile <value>] [--insecure-storage]",
+      "enableJsonFlag": true,
+      "legacyStagingNoticeShown": false,
+      "emitsOwnOutput": false,
+      "requiresEscapeHatch": false,
+      "requiresInput": true,
+      "isLocalOnly": false,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "claim-link",
+        "status.js"
+      ]
+    },
+    "invoice:get": {
+      "aliases": [],
+      "args": {
+        "id": {
+          "description": "Invoice id_str (the backend's Payment.id_str)",
+          "name": "id",
+          "required": true
+        }
+      },
+      "description": "Fetch one invoice by id. Wraps the `payment` GraphQL query.",
+      "examples": [
+        "$ allscale invoice get 65ab1234567890abcdef0123",
+        "$ allscale invoice get 65ab... --select 'id status amount currency'"
+      ],
+      "flags": {
+        "json": {
+          "description": "Format output as json.",
+          "helpGroup": "GLOBAL",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "profile": {
+          "description": "Named profile from ~/.allscale/config.toml",
+          "helpGroup": "GLOBAL",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "token": {
+          "description": "Override the access token for this invocation (precedence: --token > ALLSCALE_TOKEN > --profile)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base": {
+          "description": "Override the API base URL (public builds accept only https://app.allscale.io)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "api-base",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "insecure-storage": {
+          "description": "Force POSIX plaintext token storage at ~/.allscale/credentials.json (mode 0600) instead of the OS keychain — for headless / CI / agent use. Unavailable on Windows because Node cannot verify owner-only ACL/link safety. Also via ALLSCALE_INSECURE_STORAGE=1.",
+          "helpGroup": "GLOBAL",
+          "name": "insecure-storage",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "select": {
+          "char": "s",
+          "description": "Override the default selection set with a GraphQL fragment. Default: 'created_at updated_at id recipient_business_id sender_business_id sender_contact_id payment_type accepted_stable_coins payment_extra_info currency status amount_cents amount_coins invoice_url invoice_visible_id tax_id error_message memo due_datetime display_amount encrypted_id'. Pass --show-doc to print the exact GraphQL document that gets sent.",
+          "name": "select",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "show-doc": {
+          "description": "Print the generated GraphQL document to stderr",
+          "name": "show-doc",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "invoice:get",
+      "pluginAlias": "@allscale/cli",
+      "pluginName": "@allscale/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": true,
+      "legacyStagingNoticeShown": false,
+      "emitsOwnOutput": false,
+      "requiresEscapeHatch": false,
+      "requiresInput": false,
+      "isLocalOnly": false,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "invoice",
+        "get.js"
+      ]
+    },
+    "invoice:list": {
+      "aliases": [],
+      "args": {},
+      "description": "List invoices for a business. Wraps the `payments` GraphQL query. Defaults to the first 50 rows; pass --input '{\"limit\":N,\"skip\":M}' to paginate, or --all to request one unpaginated response. Filter with --status / --payment-type (repeatable), the creation-date range --from / --to (half-open: --from inclusive, --to exclusive), and --to-email, which narrows this both-directions view to the invoices you ISSUED to that contact.",
+      "examples": [
+        "$ allscale invoice list",
+        "$ allscale invoice list --business-id <id>",
+        "$ allscale invoice list --input '{\"limit\":50,\"skip\":50}'   # second page",
+        "$ allscale invoice list --all                                 # everything (be careful)",
+        "$ allscale invoice list --input '{\"limit\":5}' --select 'count items { id status amount }'",
+        "$ allscale invoice list --status SENT --status OVERDUE      # unpaid work",
+        "$ allscale invoice list --payment-type USDC                 # only USDC invoices",
+        "$ allscale invoice list --from 2026-07-01 --to 2026-08-01   # exactly July (--to is exclusive)",
+        "$ allscale invoice list --to-email client@example.com       # what you billed that customer"
+      ],
+      "flags": {
+        "json": {
+          "description": "Format output as json.",
+          "helpGroup": "GLOBAL",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "profile": {
+          "description": "Named profile from ~/.allscale/config.toml",
+          "helpGroup": "GLOBAL",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "token": {
+          "description": "Override the access token for this invocation (precedence: --token > ALLSCALE_TOKEN > --profile)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base": {
+          "description": "Override the API base URL (public builds accept only https://app.allscale.io)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "api-base",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "insecure-storage": {
+          "description": "Force POSIX plaintext token storage at ~/.allscale/credentials.json (mode 0600) instead of the OS keychain — for headless / CI / agent use. Unavailable on Windows because Node cannot verify owner-only ACL/link safety. Also via ALLSCALE_INSECURE_STORAGE=1.",
+          "helpGroup": "GLOBAL",
+          "name": "insecure-storage",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "business-id": {
+          "char": "b",
+          "description": "Business id_str. Defaults to the logged-in user's business when omitted.",
+          "name": "business-id",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "input": {
+          "char": "i",
+          "description": "QueryInput as JSON. Supported fields: limit (0 = unbounded), skip, order_by (array of field names, '-field' for descending), created_at_gte / created_at_lte (both INCLUSIVE, format YYYY-MM-DDTHH:MM:SS.ffffffZ — the fractional seconds and trailing Z are required). Only these fields are accepted. Overrides the default limit=50. Prefer --from / --to, which accept ordinary dates, normalize them for you, and give you a half-open range.",
+          "exclusive": [
+            "all"
+          ],
+          "name": "input",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "status": {
+          "description": "Only invoices in this status. Repeatable (matches any of them). Accepted: OVERDUE, FAILED, DRAFT, SENT, ACKNOWLEDGED, PROCESSING, PAID (case-insensitive), or a raw integer.",
+          "name": "status",
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "type": "option"
+        },
+        "payment-type": {
+          "description": "Only invoices denominated in this currency. Repeatable (matches any of them). Accepted: CURRENCY (fiat), USDT, USDC, BUSD, DAI, TUSD, PAX, GUSD, USTC, FRAX, EURS (case-insensitive), or a raw integer.",
+          "name": "payment-type",
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "type": "option"
+        },
+        "from": {
+          "description": "Only invoices created at or after this time. INCLUSIVE — an invoice created at exactly this instant is included. Accepts a date (2026-08-05), a naive datetime (2026-08-05T12:30:00, read as UTC), or an offset datetime (2026-08-05T20:30:00+08:00); the CLI converts to UTC and pads it to the backend's required YYYY-MM-DDTHH:MM:SS.ffffffZ.",
+          "name": "from",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "to": {
+          "description": "Only invoices created strictly before this time. EXCLUSIVE — an invoice created at exactly this instant is NOT included, so --from 2026-07-01 --to 2026-08-01 is exactly July and consecutive ranges never overlap. A bare date therefore covers the whole day before it. Accepts a date (2026-08-05), a naive datetime (2026-08-05T12:30:00, read as UTC), or an offset datetime (2026-08-05T20:30:00+08:00); the CLI converts to UTC and pads it to the backend's required YYYY-MM-DDTHH:MM:SS.ffffffZ.",
+          "name": "to",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "to-email": {
+          "description": "Only invoices you ISSUED to the contact with this email. The invoice's contact record belongs to the business that issued it, so this filter is inherently issue-side: on `invoice received` it is exactly 'invoices I billed to them', and on `invoice list` it narrows the both-directions view to the ones you issued. The email must match a contact in your business EXACTLY (no fuzzy match); an email with no contact is an error, not an empty list, because every invoice is issued to a contact. Under an agent key the contact lookup additionally requires the contact:read_only scope.",
+          "name": "to-email",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "all": {
+          "description": "Request all rows in one response (equivalent to --input '{\"limit\":0}'); the CLI rejects read-only responses over 32 MiB.",
+          "exclusive": [
+            "input"
+          ],
+          "name": "all",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "select": {
+          "char": "s",
+          "description": "Override the default selection set with a GraphQL fragment. Default: 'count items { created_at updated_at id recipient_business_id sender_business_id sender_contact_id payment_type accepted_stable_coins payment_extra_info currency status amount_cents amount_coins invoice_url invoice_visible_id tax_id error_message memo due_datetime display_amount encrypted_id }'. Pass --show-doc to print the exact GraphQL document that gets sent.",
+          "name": "select",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "show-doc": {
+          "description": "Print the generated GraphQL document to stderr",
+          "name": "show-doc",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "invoice:list",
+      "pluginAlias": "@allscale/cli",
+      "pluginName": "@allscale/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": true,
+      "legacyStagingNoticeShown": false,
+      "emitsOwnOutput": false,
+      "requiresEscapeHatch": false,
+      "requiresInput": false,
+      "isLocalOnly": false,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "invoice",
+        "list.js"
+      ]
+    },
+    "invoice:pay": {
+      "aliases": [],
+      "args": {
+        "id": {
+          "description": "Invoice id_str (the backend Payment.id_str) to pay.",
+          "name": "id",
+          "required": true
+        }
+      },
+      "description": "Pay a received invoice from your AllScale wallet. Resolves the invoice's destination + amount, moves the funds via the same signing path as `wallet send` (confirmed in the browser at /cli), then reports and confirms the payment. Needs TWO scopes: `invoice:all` to create, report and confirm the pay intent, and `wallet:read_only` to look up the address you are paying FROM. Neither flow grants `invoice:all` for you: on `device-login` the Invoices toggle starts at Read, so tick its write tier on the approval screen; on `otp-login` pass BOTH --scopes invoice:all --scopes wallet:read_only, because naming any scope turns every unnamed category off.",
+      "examples": [
+        "$ allscale invoice pay 65ab1234567890abcdef0123",
+        "$ allscale invoice pay 65ab... --chain bsc --stable-coin USDT"
+      ],
+      "flags": {
+        "json": {
+          "description": "Format output as json.",
+          "helpGroup": "GLOBAL",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "profile": {
+          "description": "Named profile from ~/.allscale/config.toml",
+          "helpGroup": "GLOBAL",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "token": {
+          "description": "Override the access token for this invocation (precedence: --token > ALLSCALE_TOKEN > --profile)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base": {
+          "description": "Override the API base URL (public builds accept only https://app.allscale.io)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "api-base",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "insecure-storage": {
+          "description": "Force POSIX plaintext token storage at ~/.allscale/credentials.json (mode 0600) instead of the OS keychain — for headless / CI / agent use. Unavailable on Windows because Node cannot verify owner-only ACL/link safety. Also via ALLSCALE_INSECURE_STORAGE=1.",
+          "helpGroup": "GLOBAL",
+          "name": "insecure-storage",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "business-id": {
+          "description": "Your own business id. Optional and redundant — payment always comes from the wallet of the business you are signed in as. Supplying a different business id is rejected rather than silently paying from your own wallet; omit the flag unless a script needs to assert which business it is acting as.",
+          "name": "business-id",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "chain": {
+          "description": "Chain to pay on. Optional when the invoice lists a single receiving wallet; required when it lists several.",
+          "name": "chain",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "ethereum",
+            "bsc",
+            "base",
+            "polygon",
+            "arbitrum",
+            "optimism"
+          ],
+          "type": "option"
+        },
+        "stable-coin": {
+          "description": "Stablecoin to pay with. Defaults to the invoice's own currency (from its payment_type); only needed to disambiguate an invoice that doesn't pin one. A value that conflicts with the invoice is rejected.",
+          "name": "stable-coin",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "USDT",
+            "USDC"
+          ],
+          "type": "option"
+        },
+        "browser-base": {
+          "description": "Override the base URL of the /cli confirmation link (defaults to the session API base). (Browser-bridge only — not valid with --headless.)",
+          "exclusive": [
+            "headless"
+          ],
+          "name": "browser-base",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "bridge-timeout": {
+          "description": "Override the confirmation deadline in milliseconds (default 180000). (Browser-bridge only — not valid with --headless.)",
+          "exclusive": [
+            "headless"
+          ],
+          "name": "bridge-timeout",
+          "default": 180000,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "headless": {
+          "description": "Pay without a browser via Turnkey email-OTP (accounts with email-OTP enabled and no passkey; passkey accounts must use the browser flow). Supply the OTP via --otp-stdin (recommended for automation) or interactively; --otp / ALLSCALE_OTP work ONLY combined with --otp-id. This removes the in-browser human confirmation, so use it only on a trusted machine. Requires an existing legacy JWT session, which this build cannot create — use the browser-bridge flow instead.",
+          "name": "headless",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "otp": {
+          "dependsOn": [
+            "headless"
+          ],
+          "description": "Turnkey signing OTP code (with --headless). Only works combined with --otp-id (an externally-triggered flow): without --otp-id the CLI emails a FRESH code at run time, so any pre-set --otp / ALLSCALE_OTP value is stale and fails with 'Invalid or expired OTP code'. For automation prefer --otp-stdin (CLI emails; pipe the fresh code back). Passing --otp as a flag also exposes it in shell history AND the process list (ps / /proc/<pid>/cmdline).",
+          "exclusive": [
+            "otp-stdin"
+          ],
+          "name": "otp",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "otp-stdin": {
+          "dependsOn": [
+            "headless"
+          ],
+          "description": "Read the Turnkey signing OTP as one line from stdin (with --headless).",
+          "name": "otp-stdin",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "otp-id": {
+          "dependsOn": [
+            "headless"
+          ],
+          "description": "Skip the OTP-send step and reuse a prior Turnkey otpId (with --headless). The OTP code itself is still required via --otp / ALLSCALE_OTP / --otp-stdin.",
+          "name": "otp-id",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "invoice:pay",
+      "pluginAlias": "@allscale/cli",
+      "pluginName": "@allscale/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": true,
+      "legacyStagingNoticeShown": false,
+      "emitsOwnOutput": false,
+      "requiresEscapeHatch": false,
+      "requiresInput": false,
+      "isLocalOnly": false,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "invoice",
+        "pay.js"
+      ]
+    },
+    "invoice:received": {
+      "aliases": [],
+      "args": {},
+      "description": "List invoices you are the PAYEE on — where the money is owed to your business. Wraps `recipient_payments` (the backend's `recipient` is the payee). This INCLUDES every invoice you issued with `invoice send`. Defaults to the first 50 rows; pass --input or --all to override. Filter with --status / --payment-type (repeatable), the creation-date range --from / --to (half-open: --from inclusive, --to exclusive), and --to-email to narrow to the invoices you billed to one contact.",
+      "examples": [
+        "$ allscale invoice received",
+        "$ allscale invoice received --business-id <id> --input '{\"limit\":10}'",
+        "$ allscale invoice received --all",
+        "$ allscale invoice received --status SENT --status OVERDUE",
+        "$ allscale invoice received --from 2026-07-01 --to 2026-08-01",
+        "$ allscale invoice received --to-email client@example.com"
+      ],
+      "flags": {
+        "json": {
+          "description": "Format output as json.",
+          "helpGroup": "GLOBAL",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "profile": {
+          "description": "Named profile from ~/.allscale/config.toml",
+          "helpGroup": "GLOBAL",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "token": {
+          "description": "Override the access token for this invocation (precedence: --token > ALLSCALE_TOKEN > --profile)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base": {
+          "description": "Override the API base URL (public builds accept only https://app.allscale.io)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "api-base",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "insecure-storage": {
+          "description": "Force POSIX plaintext token storage at ~/.allscale/credentials.json (mode 0600) instead of the OS keychain — for headless / CI / agent use. Unavailable on Windows because Node cannot verify owner-only ACL/link safety. Also via ALLSCALE_INSECURE_STORAGE=1.",
+          "helpGroup": "GLOBAL",
+          "name": "insecure-storage",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "business-id": {
+          "char": "b",
+          "description": "Business id_str. Defaults to the logged-in user's business when omitted.",
+          "name": "business-id",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "input": {
+          "char": "i",
+          "description": "QueryInput as JSON. Supported fields: limit (0 = unbounded), skip, order_by (array of field names, '-field' for descending), created_at_gte / created_at_lte (both INCLUSIVE, format YYYY-MM-DDTHH:MM:SS.ffffffZ — the fractional seconds and trailing Z are required). Only these fields are accepted. Overrides the default limit=50. Prefer --from / --to, which accept ordinary dates, normalize them for you, and give you a half-open range.",
+          "exclusive": [
+            "all"
+          ],
+          "name": "input",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "status": {
+          "description": "Only invoices in this status. Repeatable (matches any of them). Accepted: OVERDUE, FAILED, DRAFT, SENT, ACKNOWLEDGED, PROCESSING, PAID (case-insensitive), or a raw integer.",
+          "name": "status",
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "type": "option"
+        },
+        "payment-type": {
+          "description": "Only invoices denominated in this currency. Repeatable (matches any of them). Accepted: CURRENCY (fiat), USDT, USDC, BUSD, DAI, TUSD, PAX, GUSD, USTC, FRAX, EURS (case-insensitive), or a raw integer.",
+          "name": "payment-type",
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "type": "option"
+        },
+        "from": {
+          "description": "Only invoices created at or after this time. INCLUSIVE — an invoice created at exactly this instant is included. Accepts a date (2026-08-05), a naive datetime (2026-08-05T12:30:00, read as UTC), or an offset datetime (2026-08-05T20:30:00+08:00); the CLI converts to UTC and pads it to the backend's required YYYY-MM-DDTHH:MM:SS.ffffffZ.",
+          "name": "from",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "to": {
+          "description": "Only invoices created strictly before this time. EXCLUSIVE — an invoice created at exactly this instant is NOT included, so --from 2026-07-01 --to 2026-08-01 is exactly July and consecutive ranges never overlap. A bare date therefore covers the whole day before it. Accepts a date (2026-08-05), a naive datetime (2026-08-05T12:30:00, read as UTC), or an offset datetime (2026-08-05T20:30:00+08:00); the CLI converts to UTC and pads it to the backend's required YYYY-MM-DDTHH:MM:SS.ffffffZ.",
+          "name": "to",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "to-email": {
+          "description": "Only invoices you ISSUED to the contact with this email. The invoice's contact record belongs to the business that issued it, so this filter is inherently issue-side: on `invoice received` it is exactly 'invoices I billed to them', and on `invoice list` it narrows the both-directions view to the ones you issued. The email must match a contact in your business EXACTLY (no fuzzy match); an email with no contact is an error, not an empty list, because every invoice is issued to a contact. Under an agent key the contact lookup additionally requires the contact:read_only scope.",
+          "name": "to-email",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "all": {
+          "description": "Request all rows in one response; the CLI rejects read-only responses over 32 MiB.",
+          "exclusive": [
+            "input"
+          ],
+          "name": "all",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "select": {
+          "char": "s",
+          "description": "Override the default selection set with a GraphQL fragment. Default: 'count items { created_at updated_at id recipient_business_id sender_business_id sender_contact_id payment_type accepted_stable_coins payment_extra_info currency status amount_cents amount_coins invoice_url invoice_visible_id tax_id error_message memo due_datetime display_amount encrypted_id }'. Pass --show-doc to print the exact GraphQL document that gets sent.",
+          "name": "select",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "show-doc": {
+          "description": "Print the generated GraphQL document to stderr",
+          "name": "show-doc",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "invoice:received",
+      "pluginAlias": "@allscale/cli",
+      "pluginName": "@allscale/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": true,
+      "legacyStagingNoticeShown": false,
+      "emitsOwnOutput": false,
+      "requiresEscapeHatch": false,
+      "requiresInput": false,
+      "isLocalOnly": false,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "invoice",
+        "received.js"
+      ]
+    },
+    "invoice:send": {
+      "aliases": [],
+      "args": {},
+      "description": "Send an invoice by email. Resolves the contact, selects receiving wallets, renders a minimal HTML invoice, and submits create_payment through the authenticated session. No browser ceremony — the payer signs when they pay, not when you issue. Returns a fixed summary (payment_id, contact, amount, wallet count) rather than a GraphQL selection, which is why there is no --select here; read the created invoice back with `invoice get <payment_id> --select ...`. Note the direction: an invoice you send lists YOU as the payee, so it appears under `invoice received`, not `invoice sent`.",
+      "examples": [
+        "$ allscale invoice send --to-email client@example.com --amount 1.00",
+        "$ allscale invoice send --to-email client@example.com --amount 250 --payment-type 2 --currency-label USDC --memo \"January retainer\" --due 2026-06-01",
+        "$ allscale invoice send --to-contact-id 695da2cd3b9598f5edcdcb56 --amount 50 --line \"Design|1|30.00\" --line \"Copy|1|20.00\"",
+        "$ allscale invoice send --to-email client@example.com --amount 75 --line \"Consulting retainer\"",
+        "$ allscale invoice send --to-email client@example.com --amount 350 --line \"Discovery (4h)|4|25.00\" --line \"Implementation (10h)|10|25.00\"",
+        "$ allscale invoice send --to-email client@example.com --line \"Discovery (4h)|4|25.00\" --line \"Implementation (10h)|10|25.00\"",
+        "$ allscale invoice send --to-email client@example.com --amount 100 --wallet-id 66ac....",
+        "$ allscale invoice send --to-email newclient@example.com --amount 100 --auto-create-contact",
+        "$ allscale invoice send --to-email billing@acme.com --amount 100 --auto-create-contact --contact-name \"Acme Inc\""
+      ],
+      "flags": {
+        "json": {
+          "description": "Format output as json.",
+          "helpGroup": "GLOBAL",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "profile": {
+          "description": "Named profile from ~/.allscale/config.toml",
+          "helpGroup": "GLOBAL",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "token": {
+          "description": "Override the access token for this invocation (precedence: --token > ALLSCALE_TOKEN > --profile)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base": {
+          "description": "Override the API base URL (public builds accept only https://app.allscale.io)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "api-base",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "insecure-storage": {
+          "description": "Force POSIX plaintext token storage at ~/.allscale/credentials.json (mode 0600) instead of the OS keychain — for headless / CI / agent use. Unavailable on Windows because Node cannot verify owner-only ACL/link safety. Also via ALLSCALE_INSECURE_STORAGE=1.",
+          "helpGroup": "GLOBAL",
+          "name": "insecure-storage",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "to-email": {
+          "description": "Email of the contact to invoice. Resolves via contact_by_email. If no contact exists for the email, add --auto-create-contact to create one before invoicing. Mutually exclusive with --to-contact-id.",
+          "exclusive": [
+            "to-contact-id"
+          ],
+          "helpGroup": "REQUIRED (ONE OF)",
+          "name": "to-email",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "to-contact-id": {
+          "description": "Contact id_str directly (skip the email lookup). Mutually exclusive with --to-email.",
+          "exclusive": [
+            "to-email"
+          ],
+          "helpGroup": "REQUIRED (ONE OF)",
+          "name": "to-contact-id",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "amount": {
+          "description": "Decimal amount in coin units (e.g. \"1.00\" for one USDT; minimum 0.10 for USDT/USDC). Optional when every --line is the three-field \"<description>|<quantity>|<amount>\" form — in that case the CLI sums the lines to derive the invoice total. Required otherwise.",
+          "helpGroup": "CONDITIONAL",
+          "name": "amount",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "auto-create-contact": {
+          "description": "If --to-email doesn't resolve to an existing contact, auto-create the contact (using the email + your business as owner; name defaults to the full email address, override with --contact-name) and proceed with the invoice. Ignored when the contact already exists (safe to leave on in scripts). Requires --to-email; not valid with --to-contact-id.",
+          "exclusive": [
+            "to-contact-id"
+          ],
+          "name": "auto-create-contact",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "contact-name": {
+          "description": "Display name to use when --auto-create-contact creates a new contact. Optional — defaults to the full email address (unique enough to avoid the BE's per-business name-uniqueness collision). Has no effect when the contact already exists or when --auto-create-contact is not set.",
+          "exclusive": [
+            "to-contact-id"
+          ],
+          "name": "contact-name",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "currency-label": {
+          "description": "Label shown next to the amount in the rendered invoice (e.g. USDT, USDC). Display only; select the stablecoin with --payment-type=1 (USDT) or --payment-type=2 (USDC). --currency-int applies only to --payment-type=0 fiat invoices. Default: USDT.",
+          "name": "currency-label",
+          "default": "USDT",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "currency-int": {
+          "description": "Backend Currency enum value (USD=1, AED=2, ...). Only sent when --payment-type=0 (CURRENCY/fiat invoice); ignored for stablecoin payment types. Default: 1 (USD).",
+          "name": "currency-int",
+          "default": 1,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "payment-type": {
+          "description": "CreatePaymentInput.payment_type. Run `allscale describe create_payment` for the enum. Default: 1.",
+          "name": "payment-type",
+          "default": 1,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "memo": {
+          "description": "Free-form invoice memo / description shown to the payer.",
+          "name": "memo",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "due": {
+          "description": "Invoice due date / datetime (ISO 8601), e.g. 2026-06-01, 2026-06-01T09:30:00, 2026-06-01T09:30:00Z, or 2026-06-01T09:30:00+08:00. A value without a UTC offset is read as UTC (so 2026-06-01 means 2026-06-01T00:00:00Z) — stated explicitly because interpreting it in the local timezone would make the same command mean different things on different machines. Rendered in the HTML body exactly as you typed it.",
+          "name": "due",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "tax-id": {
+          "description": "Optional taxpayer identification shown in the invoice footer.",
+          "name": "tax-id",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "line": {
+          "description": "Line item on the rendered invoice. Repeatable. Two forms: \"<description>\" (qty=1, amount=full --amount) or \"<description>|<quantity>|<amount>\" (all explicit; same decimal units as --amount). Use the three-field form for more than one line: the single-field form gives EVERY line the full --amount, so two such lines sum to twice --amount and trigger the totals-mismatch warning. With three-field lines you may omit --amount entirely and the CLI sums them. The backend charges --amount regardless; --line only shapes the rendered HTML.",
+          "name": "line",
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "type": "option"
+        },
+        "wallet-id": {
+          "description": "id_str of a wallet to receive payment. Repeatable. When given, the backend resolves and validates the ids (no wallet read needed — works with an invoice-scope-only agent key). When omitted, the CLI fetches your wallets via the narrow `business_wallets` query, which requires the wallet:read_only scope on an agent key.",
+          "name": "wallet-id",
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "type": "option"
+        },
+        "business-id": {
+          "description": "Your own business id_str. Optional and redundant — the invoice is always issued as the business you are signed in as, and contacts and wallets always resolve against it. Supplying a different business id is rejected rather than silently ignored; omit the flag unless a script needs to assert which business it is acting as.",
+          "name": "business-id",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "show-doc": {
+          "description": "Print the generated GraphQL document to stderr.",
+          "name": "show-doc",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "invoice:send",
+      "pluginAlias": "@allscale/cli",
+      "pluginName": "@allscale/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": true,
+      "legacyStagingNoticeShown": false,
+      "emitsOwnOutput": false,
+      "requiresEscapeHatch": false,
+      "requiresInput": true,
+      "isLocalOnly": false,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "invoice",
+        "send.js"
+      ]
+    },
+    "invoice:sent": {
+      "aliases": [],
+      "args": {},
+      "description": "List invoices you are the PAYER on — where your business owes the money. Wraps `sender_payments` (the backend's `sender` is the payer). NOTE: invoices you issued with `invoice send` are NOT here — you are the payee on those, so they appear under `invoice received`. Defaults to the first 50 rows; pass --input or --all to override. Filter with --status / --payment-type (repeatable) and the creation-date range --from / --to, which is half-open: --from is inclusive, --to exclusive. There is no --to-email here: an invoice's contact record belongs to the business that issued it, so filtering the invoices you OWE by your own contacts is not possible — use `invoice received --to-email`.",
+      "examples": [
+        "$ allscale invoice sent",
+        "$ allscale invoice sent --business-id <id> --input '{\"limit\":10}'",
+        "$ allscale invoice sent --all",
+        "$ allscale invoice sent --status SENT --status OVERDUE",
+        "$ allscale invoice sent --from 2026-07-01 --to 2026-08-01"
+      ],
+      "flags": {
+        "json": {
+          "description": "Format output as json.",
+          "helpGroup": "GLOBAL",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "profile": {
+          "description": "Named profile from ~/.allscale/config.toml",
+          "helpGroup": "GLOBAL",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "token": {
+          "description": "Override the access token for this invocation (precedence: --token > ALLSCALE_TOKEN > --profile)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base": {
+          "description": "Override the API base URL (public builds accept only https://app.allscale.io)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "api-base",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "insecure-storage": {
+          "description": "Force POSIX plaintext token storage at ~/.allscale/credentials.json (mode 0600) instead of the OS keychain — for headless / CI / agent use. Unavailable on Windows because Node cannot verify owner-only ACL/link safety. Also via ALLSCALE_INSECURE_STORAGE=1.",
+          "helpGroup": "GLOBAL",
+          "name": "insecure-storage",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "business-id": {
+          "char": "b",
+          "description": "Business id_str. Defaults to the logged-in user's business when omitted.",
+          "name": "business-id",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "input": {
+          "char": "i",
+          "description": "QueryInput as JSON. Supported fields: limit (0 = unbounded), skip, order_by (array of field names, '-field' for descending), created_at_gte / created_at_lte (both INCLUSIVE, format YYYY-MM-DDTHH:MM:SS.ffffffZ — the fractional seconds and trailing Z are required). Only these fields are accepted. Overrides the default limit=50. Prefer --from / --to, which accept ordinary dates, normalize them for you, and give you a half-open range.",
+          "exclusive": [
+            "all"
+          ],
+          "name": "input",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "status": {
+          "description": "Only invoices in this status. Repeatable (matches any of them). Accepted: OVERDUE, FAILED, DRAFT, SENT, ACKNOWLEDGED, PROCESSING, PAID (case-insensitive), or a raw integer.",
+          "name": "status",
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "type": "option"
+        },
+        "payment-type": {
+          "description": "Only invoices denominated in this currency. Repeatable (matches any of them). Accepted: CURRENCY (fiat), USDT, USDC, BUSD, DAI, TUSD, PAX, GUSD, USTC, FRAX, EURS (case-insensitive), or a raw integer.",
+          "name": "payment-type",
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "type": "option"
+        },
+        "from": {
+          "description": "Only invoices created at or after this time. INCLUSIVE — an invoice created at exactly this instant is included. Accepts a date (2026-08-05), a naive datetime (2026-08-05T12:30:00, read as UTC), or an offset datetime (2026-08-05T20:30:00+08:00); the CLI converts to UTC and pads it to the backend's required YYYY-MM-DDTHH:MM:SS.ffffffZ.",
+          "name": "from",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "to": {
+          "description": "Only invoices created strictly before this time. EXCLUSIVE — an invoice created at exactly this instant is NOT included, so --from 2026-07-01 --to 2026-08-01 is exactly July and consecutive ranges never overlap. A bare date therefore covers the whole day before it. Accepts a date (2026-08-05), a naive datetime (2026-08-05T12:30:00, read as UTC), or an offset datetime (2026-08-05T20:30:00+08:00); the CLI converts to UTC and pads it to the backend's required YYYY-MM-DDTHH:MM:SS.ffffffZ.",
+          "name": "to",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "to-email": {
+          "description": "Not supported on `invoice sent` — see the runtime error.",
+          "hidden": true,
+          "name": "to-email",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "all": {
+          "description": "Request all rows in one response; the CLI rejects read-only responses over 32 MiB.",
+          "exclusive": [
+            "input"
+          ],
+          "name": "all",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "select": {
+          "char": "s",
+          "description": "Override the default selection set with a GraphQL fragment. Default: 'count items { created_at updated_at id recipient_business_id sender_business_id sender_contact_id payment_type accepted_stable_coins payment_extra_info currency status amount_cents amount_coins invoice_url invoice_visible_id tax_id error_message memo due_datetime display_amount encrypted_id }'. Pass --show-doc to print the exact GraphQL document that gets sent.",
+          "name": "select",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "show-doc": {
+          "description": "Print the generated GraphQL document to stderr",
+          "name": "show-doc",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "invoice:sent",
+      "pluginAlias": "@allscale/cli",
+      "pluginName": "@allscale/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": true,
+      "legacyStagingNoticeShown": false,
+      "emitsOwnOutput": false,
+      "requiresEscapeHatch": false,
+      "requiresInput": false,
+      "isLocalOnly": false,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "invoice",
+        "sent.js"
+      ]
+    },
+    "invoice:update": {
+      "aliases": [],
+      "args": {
+        "id": {
+          "description": "Invoice id_str (the backend's Payment.id_str)",
+          "name": "id",
+          "required": true
+        }
+      },
+      "description": "Update an existing invoice's memo, payer, or (for an overdue invoice) its due date. Only those three fields can be changed; anything else is rejected by the backend.",
+      "examples": [
+        "$ allscale invoice update 65ab... --input '{\"memo\":\"corrected memo\"}'",
+        "$ allscale invoice update 65ab... --input '{\"due_datetime\":\"2026-12-31T00:00:00Z\"}'",
+        "$ allscale invoice update 65ab... --input '{\"sender_business_id\":\"6a288fb5f9b4689d8b09a50a\"}'"
+      ],
+      "flags": {
+        "json": {
+          "description": "Format output as json.",
+          "helpGroup": "GLOBAL",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "profile": {
+          "description": "Named profile from ~/.allscale/config.toml",
+          "helpGroup": "GLOBAL",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "token": {
+          "description": "Override the access token for this invocation (precedence: --token > ALLSCALE_TOKEN > --profile)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base": {
+          "description": "Override the API base URL (public builds accept only https://app.allscale.io)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "api-base",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "insecure-storage": {
+          "description": "Force POSIX plaintext token storage at ~/.allscale/credentials.json (mode 0600) instead of the OS keychain — for headless / CI / agent use. Unavailable on Windows because Node cannot verify owner-only ACL/link safety. Also via ALLSCALE_INSECURE_STORAGE=1.",
+          "helpGroup": "GLOBAL",
+          "name": "insecure-storage",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "input": {
+          "char": "i",
+          "description": "JSON object of fields to change. Exactly three are accepted: \"memo\" (free text), \"sender_business_id\" (the payer's business id), and \"due_datetime\" (ISO 8601, e.g. 2026-12-31 or 2026-12-31T00:00:00Z — a value without a UTC offset is read as UTC, exactly as `invoice send --due` does). Note that due_datetime only applies to an OVERDUE invoice and may only move FORWARD; extending past now also revives the invoice so buyers can pay again. Any other field is rejected by the backend.",
+          "helpGroup": "REQUIRED",
+          "name": "input",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "select": {
+          "char": "s",
+          "description": "Override the default selection set with a GraphQL fragment. Default: 'created_at updated_at id recipient_business_id sender_business_id sender_contact_id payment_type accepted_stable_coins payment_extra_info currency status amount_cents amount_coins invoice_url invoice_visible_id tax_id error_message memo due_datetime display_amount encrypted_id'. Pass --show-doc to print the exact GraphQL document that gets sent.",
+          "name": "select",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "show-doc": {
+          "description": "Print the generated GraphQL document to stderr",
+          "name": "show-doc",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "invoice:update",
+      "pluginAlias": "@allscale/cli",
+      "pluginName": "@allscale/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": true,
+      "legacyStagingNoticeShown": false,
+      "emitsOwnOutput": false,
+      "requiresEscapeHatch": false,
+      "requiresInput": false,
+      "isLocalOnly": false,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "invoice",
+        "update.js"
+      ]
+    },
+    "payout:send": {
+      "aliases": [],
+      "args": {},
+      "description": "Create and auto-fund a claim link from this store's enabled auto-payout wallet. Authenticates with the store API key/secret (NOT your login), so it needs a store that has completed Payout onboarding. Idempotent on --reference-id.",
+      "examples": [
+        "$ ALLSCALE_STORE_API_SECRET=… allscale payout send --api-key ak_… --amount 10 --chain base --reference-id order-1042",
+        "$ allscale payout send --payout-api-base https://openapi.allscale.io --api-key ak_… --api-secret … --amount 25 --stable-coin USDC --chain polygon --reference-id inv-77 --receiver-email client@example.com"
+      ],
+      "flags": {
+        "json": {
+          "description": "Format output as json.",
+          "helpGroup": "GLOBAL",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "profile": {
+          "description": "Named profile from ~/.allscale/config.toml",
+          "helpGroup": "GLOBAL",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "token": {
+          "description": "Override the access token for this invocation (precedence: --token > ALLSCALE_TOKEN > --profile)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base": {
+          "description": "Override the API base URL (public builds accept only https://app.allscale.io)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "api-base",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "insecure-storage": {
+          "description": "Force POSIX plaintext token storage at ~/.allscale/credentials.json (mode 0600) instead of the OS keychain — for headless / CI / agent use. Unavailable on Windows because Node cannot verify owner-only ACL/link safety. Also via ALLSCALE_INSECURE_STORAGE=1.",
+          "helpGroup": "GLOBAL",
+          "name": "insecure-storage",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "amount": {
+          "description": "Claimable amount in token units (decimal string, e.g. 10 or 25.50); at most 6 effective decimals, or 18 on BSC.",
+          "helpGroup": "REQUIRED",
+          "name": "amount",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "chain": {
+          "description": "EVM mainnet chain slug.",
+          "helpGroup": "REQUIRED",
+          "name": "chain",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "ethereum",
+            "bsc",
+            "base",
+            "polygon",
+            "arbitrum",
+            "optimism"
+          ],
+          "type": "option"
+        },
+        "reference-id": {
+          "description": "Your idempotency key (e.g. your order id). REQUIRED — a retry with the same value is safe (no double-fund).",
+          "helpGroup": "REQUIRED",
+          "name": "reference-id",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "payout-api-base": {
+          "description": "Standalone partner API origin for store-HMAC payouts. Defaults to https://openapi.allscale.io. Also via ALLSCALE_PAYOUT_API_BASE.",
+          "name": "payout-api-base",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "stable-coin": {
+          "description": "Stablecoin to fund in.",
+          "name": "stable-coin",
+          "default": "USDT",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "USDT",
+            "USDC"
+          ],
+          "type": "option"
+        },
+        "receiver-email": {
+          "description": "Optional email to send the claim invite to.",
+          "name": "receiver-email",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "sender-display-name": {
+          "description": "Optional display name shown to the receiver. Max 100 chars.",
+          "name": "sender-display-name",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "message": {
+          "description": "Optional message shown to the receiver. Max 200 chars.",
+          "name": "message",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-key": {
+          "description": "Store API key (public id). Falls back to ALLSCALE_STORE_API_KEY.",
+          "name": "api-key",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-secret": {
+          "description": "Store API secret. Prefer the ALLSCALE_STORE_API_SECRET env var (a flag value can leak via shell history / process list).",
+          "name": "api-secret",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "payout:send",
+      "pluginAlias": "@allscale/cli",
+      "pluginName": "@allscale/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": true,
+      "legacyStagingNoticeShown": false,
+      "emitsOwnOutput": false,
+      "requiresEscapeHatch": false,
+      "requiresInput": false,
+      "isLocalOnly": false,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "payout",
+        "send.js"
+      ]
+    },
+    "payout:status": {
+      "aliases": [],
+      "args": {},
+      "description": "Show this merchant's claim-link auto-payout session: whether it's enabled, the spending caps, remaining budget, and expiry. Read-only — a non-enabled account returns provisioned=false.",
+      "examples": [
+        "$ allscale payout status",
+        "$ allscale payout status --select 'provisioned active remaining_usd session_expires_at'"
+      ],
+      "flags": {
+        "json": {
+          "description": "Format output as json.",
+          "helpGroup": "GLOBAL",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "profile": {
+          "description": "Named profile from ~/.allscale/config.toml",
+          "helpGroup": "GLOBAL",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "token": {
+          "description": "Override the access token for this invocation (precedence: --token > ALLSCALE_TOKEN > --profile)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base": {
+          "description": "Override the API base URL (public builds accept only https://app.allscale.io)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "api-base",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "insecure-storage": {
+          "description": "Force POSIX plaintext token storage at ~/.allscale/credentials.json (mode 0600) instead of the OS keychain — for headless / CI / agent use. Unavailable on Windows because Node cannot verify owner-only ACL/link safety. Also via ALLSCALE_INSECURE_STORAGE=1.",
+          "helpGroup": "GLOBAL",
+          "name": "insecure-storage",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "select": {
+          "char": "s",
+          "description": "Override the default selection set with a GraphQL fragment. Default: 'provisioned active session_expires_at total_cap_usd used_usd remaining_usd per_transaction_limit authorized_pairs { chain token_symbol policy_id }'. Other selectable fields on AutoPayoutSessionStatus: sponsor_address. Pass --show-doc to print the exact GraphQL document that gets sent.",
+          "name": "select",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "show-doc": {
+          "description": "Print the GraphQL document to stderr.",
+          "name": "show-doc",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "payout:status",
+      "pluginAlias": "@allscale/cli",
+      "pluginName": "@allscale/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": true,
+      "legacyStagingNoticeShown": false,
+      "emitsOwnOutput": false,
+      "requiresEscapeHatch": false,
+      "requiresInput": false,
+      "isLocalOnly": false,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "payout",
+        "status.js"
+      ]
+    },
+    "store:create": {
+      "aliases": [],
+      "args": {},
+      "description": "Create a store for the logged-in business. Returns the API key and one-time API secret in stdout; capture the result securely. Business must have checkout enabled; only one sandbox store is allowed per business.",
+      "examples": [
+        "$ allscale store create --name \"My Shop\"",
+        "$ allscale store create --name \"Live Shop\" --live",
+        "$ allscale store create --name \"Acme\" --business-id 665f0c..."
+      ],
+      "flags": {
+        "json": {
+          "description": "Format output as json.",
+          "helpGroup": "GLOBAL",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "profile": {
+          "description": "Named profile from ~/.allscale/config.toml",
+          "helpGroup": "GLOBAL",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "token": {
+          "description": "Override the access token for this invocation (precedence: --token > ALLSCALE_TOKEN > --profile)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base": {
+          "description": "Override the API base URL (public builds accept only https://app.allscale.io)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "api-base",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "insecure-storage": {
+          "description": "Force POSIX plaintext token storage at ~/.allscale/credentials.json (mode 0600) instead of the OS keychain — for headless / CI / agent use. Unavailable on Windows because Node cannot verify owner-only ACL/link safety. Also via ALLSCALE_INSECURE_STORAGE=1.",
+          "helpGroup": "GLOBAL",
+          "name": "insecure-storage",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "name": {
+          "description": "Store display name (required).",
+          "helpGroup": "REQUIRED",
+          "name": "name",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "business-id": {
+          "description": "Owning business id. Defaults to the logged-in business (decoded from the session token). Admins creating for another business must pass this.",
+          "name": "business-id",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "live": {
+          "description": "Create a live store. Default is a sandbox store (backend allows only one sandbox store per business).",
+          "name": "live",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "type": {
+          "description": "Store type (backend StoreType int). Omit for the default.",
+          "name": "type",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "description": {
+          "description": "Optional store description.",
+          "name": "description",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "store:create",
+      "pluginAlias": "@allscale/cli",
+      "pluginName": "@allscale/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": true,
+      "legacyStagingNoticeShown": false,
+      "emitsOwnOutput": false,
+      "requiresEscapeHatch": false,
+      "requiresInput": false,
+      "isLocalOnly": false,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "store",
+        "create.js"
+      ]
+    },
+    "transaction:get": {
+      "aliases": [],
+      "args": {
+        "id": {
+          "description": "Transaction id_str",
+          "name": "id",
+          "required": true
+        }
+      },
+      "description": "Fetch one transaction by id. Wraps the `transaction` query.",
+      "examples": [
+        "$ allscale transaction get 65ab1234567890abcdef0123",
+        "$ allscale transaction get 65ab... --select 'id status type direction'"
+      ],
+      "flags": {
+        "json": {
+          "description": "Format output as json.",
+          "helpGroup": "GLOBAL",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "profile": {
+          "description": "Named profile from ~/.allscale/config.toml",
+          "helpGroup": "GLOBAL",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "token": {
+          "description": "Override the access token for this invocation (precedence: --token > ALLSCALE_TOKEN > --profile)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base": {
+          "description": "Override the API base URL (public builds accept only https://app.allscale.io)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "api-base",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "insecure-storage": {
+          "description": "Force POSIX plaintext token storage at ~/.allscale/credentials.json (mode 0600) instead of the OS keychain — for headless / CI / agent use. Unavailable on Windows because Node cannot verify owner-only ACL/link safety. Also via ALLSCALE_INSECURE_STORAGE=1.",
+          "helpGroup": "GLOBAL",
+          "name": "insecure-storage",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "select": {
+          "char": "s",
+          "description": "Override the default selection set with a GraphQL fragment. Default: 'created_at updated_at id owner_type owner_business_id owner_employee_id transaction_type direction reference_type payment_id counterparty_business_id counterparty_employee_id counterparty_name payment_type currency amount_cents amount_coins status memo transaction_time tx_hash tx_block_chain tx_from tx_to tx_block_number total_fee network_fee service_fee'. Pass --show-doc to print the exact GraphQL document that gets sent.",
+          "name": "select",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "show-doc": {
+          "description": "Print the generated GraphQL document to stderr",
+          "name": "show-doc",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "transaction:get",
+      "pluginAlias": "@allscale/cli",
+      "pluginName": "@allscale/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": true,
+      "legacyStagingNoticeShown": false,
+      "emitsOwnOutput": false,
+      "requiresEscapeHatch": false,
+      "requiresInput": false,
+      "isLocalOnly": false,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "transaction",
+        "get.js"
+      ]
+    },
+    "transaction:list": {
+      "aliases": [],
+      "args": {},
+      "description": "List transactions. --scope picks between mine (default; backend my_transactions), business (business_transaction_records), or activities. All scopes default to the first 50 rows; pass --input or --all to override.",
+      "examples": [
+        "$ allscale transaction list",
+        "$ allscale transaction list --scope business --input '{\"limit\":20}'",
+        "$ allscale transaction list --scope activities --skip 0 --limit 25",
+        "$ allscale transaction list --scope activities --all"
+      ],
+      "flags": {
+        "json": {
+          "description": "Format output as json.",
+          "helpGroup": "GLOBAL",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "profile": {
+          "description": "Named profile from ~/.allscale/config.toml",
+          "helpGroup": "GLOBAL",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "token": {
+          "description": "Override the access token for this invocation (precedence: --token > ALLSCALE_TOKEN > --profile)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base": {
+          "description": "Override the API base URL (public builds accept only https://app.allscale.io)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "api-base",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "insecure-storage": {
+          "description": "Force POSIX plaintext token storage at ~/.allscale/credentials.json (mode 0600) instead of the OS keychain — for headless / CI / agent use. Unavailable on Windows because Node cannot verify owner-only ACL/link safety. Also via ALLSCALE_INSECURE_STORAGE=1.",
+          "helpGroup": "GLOBAL",
+          "name": "insecure-storage",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "scope": {
+          "description": "Which transaction-list query to call: mine (backend my_transactions), business (business_transaction_records), or activities",
+          "name": "scope",
+          "default": "mine",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "mine",
+            "business",
+            "activities"
+          ],
+          "type": "option"
+        },
+        "input": {
+          "char": "i",
+          "description": "QueryInput (mine/business) or ActivityFilterInput (activities) as JSON. For mine/business this overrides the default limit=50.",
+          "exclusive": [
+            "all"
+          ],
+          "name": "input",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "all": {
+          "description": "Request all rows in one response (mine/business query_input.limit=0; activities top-level limit=0); the CLI rejects read-only responses over 32 MiB.",
+          "exclusive": [
+            "input"
+          ],
+          "name": "all",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "skip": {
+          "description": "Pagination skip (activities scope only)",
+          "name": "skip",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "limit": {
+          "description": "Pagination limit (activities scope only). Defaults to 50; --all requests one unpaginated response.",
+          "name": "limit",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "select": {
+          "char": "s",
+          "description": "Override the default selection set with a GraphQL fragment. Default (--scope mine, --scope business): 'count items { created_at updated_at id owner_type owner_business_id owner_employee_id transaction_type direction reference_type payment_id counterparty_business_id counterparty_employee_id counterparty_name payment_type currency amount_cents amount_coins status memo transaction_time tx_hash tx_block_chain tx_from tx_to tx_block_number total_fee network_fee service_fee }'. Default (--scope activities): 'count items { transaction_id amount_coins amount_cents transaction_time created_at transaction_status payment_id transaction_type direction wallet_address tx_hash tx_block_chain tx_block_number memo payment_type currency total_fee network_fee service_fee counterparty_business_id claim_link_id }'. Pass --show-doc to print the exact GraphQL document that gets sent.",
+          "name": "select",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "show-doc": {
+          "description": "Print the generated GraphQL document to stderr",
+          "name": "show-doc",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "transaction:list",
+      "pluginAlias": "@allscale/cli",
+      "pluginName": "@allscale/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": true,
+      "legacyStagingNoticeShown": false,
+      "emitsOwnOutput": false,
+      "requiresEscapeHatch": false,
+      "requiresInput": false,
+      "isLocalOnly": false,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "transaction",
+        "list.js"
+      ]
+    },
+    "wallet:list": {
+      "aliases": [],
+      "args": {},
+      "description": "List your noncustodial wallets and their per-coin balances via the narrow `business_wallets` query. Works with an agent key holding wallet:read_only (and with legacy password sessions); the owner is derived from the authenticated identity, so no business id is needed.",
+      "examples": [
+        "$ allscale wallet list",
+        "$ allscale wallet list --select 'id_str address'"
+      ],
+      "flags": {
+        "json": {
+          "description": "Format output as json.",
+          "helpGroup": "GLOBAL",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "profile": {
+          "description": "Named profile from ~/.allscale/config.toml",
+          "helpGroup": "GLOBAL",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "token": {
+          "description": "Override the access token for this invocation (precedence: --token > ALLSCALE_TOKEN > --profile)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base": {
+          "description": "Override the API base URL (public builds accept only https://app.allscale.io)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "api-base",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "insecure-storage": {
+          "description": "Force POSIX plaintext token storage at ~/.allscale/credentials.json (mode 0600) instead of the OS keychain — for headless / CI / agent use. Unavailable on Windows because Node cannot verify owner-only ACL/link safety. Also via ALLSCALE_INSECURE_STORAGE=1.",
+          "helpGroup": "GLOBAL",
+          "name": "insecure-storage",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "select": {
+          "char": "s",
+          "description": "Override the default selection set with a GraphQL fragment. Default: 'id_str chain address coin_balances { coin_type balance }'. Passing a non-blank --select also disables the chain/coin label enrichment this command adds by default, since the selection is then entirely caller-controlled. Pass --show-doc to print the exact GraphQL document that gets sent.",
+          "name": "select",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "show-doc": {
+          "description": "Print the generated GraphQL document to stderr",
+          "name": "show-doc",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "wallet:list",
+      "pluginAlias": "@allscale/cli",
+      "pluginName": "@allscale/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": true,
+      "legacyStagingNoticeShown": false,
+      "emitsOwnOutput": false,
+      "requiresEscapeHatch": false,
+      "requiresInput": false,
+      "isLocalOnly": false,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "wallet",
+        "list.js"
+      ]
+    },
+    "wallet:send": {
+      "aliases": [],
+      "args": {},
+      "description": "Withdraw a stablecoin from your AllScale wallet to an EVM address. Confirms in the browser by default; the CLI prints the transaction hash and explorer URL when the network accepts the transfer. Accounts with Turnkey email-OTP enabled and no passkey can sign without a browser via --headless. Requires an existing legacy JWT session, which this build cannot create — use the browser-bridge flow instead.",
+      "examples": [
+        "$ allscale wallet send --idempotency-key order-1042 --to 0xabc... --amount 100 --chain ethereum",
+        "$ allscale wallet send --idempotency-key order-1043 --to 0xabc... --amount 50 --chain polygon --stable-coin USDC",
+        "$ allscale wallet send --idempotency-key order-1044 --to 0xabc... --amount 1 --chain base --bridge-timeout 300000",
+        "$ allscale wallet send --idempotency-key order-1045 --to 0xabc... --amount 1 --chain bsc  # over SSH: open the printed URL on any device, paste the tx hash back",
+        "$ allscale wallet send --to 0xabc... --amount 1 --chain base --headless --otp-stdin --idempotency-key order-1042  # reuse the same key only when retrying this operation"
+      ],
+      "flags": {
+        "json": {
+          "description": "Format output as json.",
+          "helpGroup": "GLOBAL",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "profile": {
+          "description": "Named profile from ~/.allscale/config.toml",
+          "helpGroup": "GLOBAL",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "token": {
+          "description": "Override the access token for this invocation (precedence: --token > ALLSCALE_TOKEN > --profile)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base": {
+          "description": "Override the API base URL (public builds accept only https://app.allscale.io)",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "api-base",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "insecure-storage": {
+          "description": "Force POSIX plaintext token storage at ~/.allscale/credentials.json (mode 0600) instead of the OS keychain — for headless / CI / agent use. Unavailable on Windows because Node cannot verify owner-only ACL/link safety. Also via ALLSCALE_INSECURE_STORAGE=1.",
+          "helpGroup": "GLOBAL",
+          "name": "insecure-storage",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "to": {
+          "description": "Recipient EVM address (0x… 40-hex).",
+          "helpGroup": "REQUIRED",
+          "name": "to",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "amount": {
+          "description": "Amount to send as a decimal string (e.g. '100', '1.50'). Min 0.1; at most 6 effective decimals, or 18 on BSC.",
+          "helpGroup": "REQUIRED",
+          "name": "amount",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "chain": {
+          "description": "EVM chain to send on.",
+          "helpGroup": "REQUIRED",
+          "name": "chain",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "ethereum",
+            "bsc",
+            "base",
+            "polygon",
+            "arbitrum",
+            "optimism"
+          ],
+          "type": "option"
+        },
+        "idempotency-key": {
+          "description": "Stable key for retrying this same logical transfer (1-128 characters); use a new key for an intentional second payment.",
+          "helpGroup": "REQUIRED",
+          "name": "idempotency-key",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "stable-coin": {
+          "description": "Stablecoin to withdraw.",
+          "name": "stable-coin",
+          "default": "USDT",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "USDT",
+            "USDC"
+          ],
+          "type": "option"
+        },
+        "bridge-timeout": {
+          "description": "Shorten the confirmation deadline, in milliseconds. By default the CLI waits the full broker op TTL (~5 min, shared by the loopback and paste channels); pass this to abort sooner. (Browser-bridge only — not valid with --headless.)",
+          "exclusive": [
+            "headless"
+          ],
+          "name": "bridge-timeout",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "browser-base": {
+          "description": "Override the base URL of the printed /cli confirmation link (defaults to the session API base). (Browser-bridge only — not valid with --headless.)",
+          "exclusive": [
+            "headless"
+          ],
+          "name": "browser-base",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "headless": {
+          "description": "Sign without a browser via Turnkey email-OTP (accounts with email-OTP enabled and no passkey; passkey accounts must use the browser flow). Supply the OTP via --otp-stdin (recommended for automation) or interactively; --otp / ALLSCALE_OTP work ONLY combined with --otp-id. This removes the in-browser human confirmation, so use it only on a trusted machine. Requires an existing legacy JWT session, which this build cannot create — use the browser-bridge flow instead.",
+          "name": "headless",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "otp": {
+          "dependsOn": [
+            "headless"
+          ],
+          "description": "Turnkey signing OTP code (with --headless). Only works combined with --otp-id (an externally-triggered flow): without --otp-id the CLI emails a FRESH code at run time, so any pre-set --otp / ALLSCALE_OTP value is stale and fails with 'Invalid or expired OTP code'. For automation prefer --otp-stdin (CLI emails; pipe the fresh code back). Passing --otp as a flag also exposes it in shell history AND the process list (ps / /proc/<pid>/cmdline).",
+          "exclusive": [
+            "otp-stdin"
+          ],
+          "name": "otp",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "otp-stdin": {
+          "dependsOn": [
+            "headless"
+          ],
+          "description": "Read the Turnkey signing OTP as one line from stdin (with --headless).",
+          "name": "otp-stdin",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "otp-id": {
+          "dependsOn": [
+            "headless"
+          ],
+          "description": "Skip the OTP-send step and reuse a prior Turnkey otpId (with --headless). The OTP code itself is still required via --otp / ALLSCALE_OTP / --otp-stdin.",
+          "name": "otp-id",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "wallet:send",
+      "pluginAlias": "@allscale/cli",
+      "pluginName": "@allscale/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": true,
+      "legacyStagingNoticeShown": false,
+      "emitsOwnOutput": false,
+      "requiresEscapeHatch": false,
+      "requiresInput": false,
+      "isLocalOnly": false,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "wallet",
+        "send.js"
+      ]
+    }
+  },
+  "version": "0.1.0"
+}