@arcadiasystems/morse-cli 0.7.0 → 0.8.0

package/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to `@arcadiasystems/morse-cli` are documented here. The
 format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.8.0] - 2026-09-10
+
+Usability pass. Nothing is renamed or removed; every existing spelling keeps working.
+
+### Added
+
+- **Verb aliases, so the word you guess is the word that works.** The command surface had grown four inconsistencies where one concept had two names depending on the noun: fetching one thing was `get` on publication, entry and file but `show` on account; deleting was `delete` everywhere except `config remove`; transferring was `transfer-ownership` on publication and file but `transfer` on cap; and reading content was `entry read` but `file download`, despite both taking `--out` and `--via-aggregator`.
+
+  Each now accepts both spellings: `account show|get`, `publication get|show`, `entry get|show`, `file get|show`, `config remove|delete`, `cap transfer|transfer-ownership`, `entry read|download`, `file download|read`. Aliases, not renames, so nothing published breaks.
+- **`entry list --all`** does what `entry scan` does. `scan` is accurate but undiscoverable; people look for `--all` and conclude pagination is unsupported. `scan` stays. Combining `--all` with `--limit` or `--cursor` is refused rather than silently ignoring one.
+- **`account import` reads a key piped on stdin.** Previously it required an interactive terminal or `MORSE_PRIVATE_KEY`, so the obvious scripted form failed outright. Still never a flag: argv is visible in `ps` and shell history. The error when no key can be found now names all three routes.
+
 ## [0.7.0] - 2026-09-09
 
 ### Added

package/README.md

@@ -6,7 +6,7 @@ content entries from your terminal, signing with a locally encrypted key.
 Content is stored on [Walrus](https://walrus.xyz); private entries are encrypted
 with [Seal](https://github.com/MystenLabs/seal).
 
-> Status: v0.7.0. Mainnet and testnet are both supported for public content;
+> Status: v0.8.0. Mainnet and testnet are both supported for public content;
 > the command surface is stable.
 >
 > **Encrypted commands are testnet-only.** `entry add-encrypted`, `entry
@@ -173,9 +173,9 @@ and `-C, --collection <name>`, both defaulting to the active context.
 | Command | Purpose |
 | --- | --- |
 | `config add <name> --network <net> [--rpc <url>] [--upload-relay <url\|auto>]` | Create or update a profile. |
+| `config remove <name>` | Delete a profile. Also `config delete`. |
 | `config list` | List profiles; `*` marks the default. |
 | `config use <name>` | Set the default profile. |
-| `config remove <name>` | Delete a profile. |
 | `config path` | Print the config file path. |
 
 ### account
@@ -352,6 +352,25 @@ to fetch the full record per file (one read each) when you need them.
   retired, so it needs `--indexer-url` pointing at a source that serves the same
   query. This affects testnet as well as mainnet.
 
+## Command spellings
+
+Several commands accept two verbs for the same action, so whichever you reach
+for works. These are aliases, not separate commands:
+
+| Canonical | Also accepts |
+| --- | --- |
+| `account show` | `account get` |
+| `publication get` | `publication show` |
+| `entry get` | `entry show` |
+| `file get` | `file show` |
+| `config remove` | `config delete` |
+| `cap transfer` | `cap transfer-ownership` |
+| `entry read` | `entry download` |
+| `file download` | `file read` |
+| `entry scan` | `entry list --all` |
+
+`publication` also answers to `pub`.
+
 ## When uploads fail: the upload relay
 
 A Walrus upload pushes slivers to every storage node in the committee at once,

package/dist/index.js

@@ -148,7 +148,7 @@ import { Command } from "commander";
 // package.json
 var package_default = {
   name: "@arcadiasystems/morse-cli",
-  version: "0.7.0",
+  version: "0.8.0",
   description: "Command-line interface for the Morse decentralized CMS on Sui.",
   license: "MIT",
   type: "module",
@@ -224,6 +224,33 @@ function buildProgram() {
   return program;
 }
 
+// src/cli/io.ts
+import { access, readFile, writeFile } from "node:fs/promises";
+async function fileExists(path) {
+  try {
+    await access(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function readBytes(path) {
+  return new Uint8Array(await readFile(path));
+}
+async function readJson(path) {
+  return JSON.parse(await readFile(path, "utf8"));
+}
+async function writeFileContents(path, data) {
+  await writeFile(path, data);
+}
+async function readStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin) {
+    chunks.push(chunk);
+  }
+  return new Uint8Array(Buffer.concat(chunks));
+}
+
 // src/cli/prompts.ts
 import * as readline from "node:readline";
 function isInteractive() {
@@ -487,33 +514,6 @@ function malformed(source, detail) {
 // src/config/store.ts
 import { chmod, mkdir, rename } from "node:fs/promises";
 
-// src/cli/io.ts
-import { access, readFile, writeFile } from "node:fs/promises";
-async function fileExists(path) {
-  try {
-    await access(path);
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function readBytes(path) {
-  return new Uint8Array(await readFile(path));
-}
-async function readJson(path) {
-  return JSON.parse(await readFile(path, "utf8"));
-}
-async function writeFileContents(path, data) {
-  await writeFile(path, data);
-}
-async function readStdin() {
-  const chunks = [];
-  for await (const chunk of process.stdin) {
-    chunks.push(chunk);
-  }
-  return new Uint8Array(Buffer.concat(chunks));
-}
-
 // src/config/paths.ts
 import { homedir } from "node:os";
 import { join } from "node:path";
@@ -925,7 +925,7 @@ function registerAccountCommands(program) {
   account.command("list").description("List imported accounts").action(async (_options, command) => {
     await runAccountList(outputFor(command), globalOptions(command));
   });
-  account.command("show").description("Print the active account address").action(async (_options, command) => {
+  account.command("show").alias("get").description("Print the active account address").action(async (_options, command) => {
     await runAccountShow(outputFor(command), globalOptions(command));
   });
   account.command("use <address>").description("Set the active account for the current profile").action(async (address, _options, command) => {
@@ -940,8 +940,15 @@ async function readSecretToImport(env, signal) {
   if (raw !== undefined && raw.length > 0) {
     return raw;
   }
+  if (!process.stdin.isTTY) {
+    const piped = new TextDecoder().decode(await readStdin()).trim();
+    if (piped.length > 0) {
+      return piped;
+    }
+    throw new UsageError("Cannot read a private key: pipe it on stdin, set MORSE_PRIVATE_KEY, or run in an interactive terminal.");
+  }
   if (!isInteractive()) {
-    throw new UsageError("Cannot read a private key: set MORSE_PRIVATE_KEY or run in an interactive terminal.");
+    throw new UsageError("Cannot read a private key: pipe it on stdin, set MORSE_PRIVATE_KEY, or run in an interactive terminal.");
   }
   process.stderr.write(`Paste your Sui private key (starts with suiprivkey1...), then press Enter. Input is hidden.
 `);
@@ -1502,7 +1509,7 @@ function registerCapCommands(program) {
   publicationOption(destroy).action(async (publisherCapId, options, command) => {
     await runCapDestroy(await buildWriteContext(command), publisherCapId, options, globalOptions(command));
   });
-  cap.command("transfer <publisherCapId> <recipient>").description("Transfer a PublisherCap object to another address").action(async (publisherCapId, recipient, _options, command) => {
+  cap.command("transfer <publisherCapId> <recipient>").alias("transfer-ownership").description("Transfer a PublisherCap object to another address").action(async (publisherCapId, recipient, _options, command) => {
     await runCapTransfer(await buildWriteContext(command), publisherCapId, recipient, globalOptions(command));
   });
 }
@@ -1646,7 +1653,7 @@ function registerConfigCommands(program) {
   config.command("use <name>").description("Set the default profile").action(async (name, _options, command) => {
     await runConfigUse(outputFor(command), name);
   });
-  config.command("remove <name>").description("Delete a profile").action(async (name, _options, command) => {
+  config.command("remove <name>").alias("delete").description("Delete a profile").action(async (name, _options, command) => {
     await runConfigRemove(outputFor(command), name);
   });
 }
@@ -1850,6 +1857,12 @@ async function runEntryGet(ctx, entryId, options) {
   ctx.output.result(renderEntry(result), result);
 }
 async function runEntryList(ctx, options) {
+  if (options.all) {
+    if (options.limit !== undefined || options.cursor !== undefined) {
+      throw new UsageError("--all cannot be combined with --limit or --cursor.");
+    }
+    return runEntryScan(ctx, options);
+  }
   const id = await resolvePublication(ctx, options.publication);
   const collection = resolveCollection(ctx, options.collection);
   const page = await ctx.reader.listEntries(id, collection, {
@@ -1961,11 +1974,11 @@ async function runEntryRead(ctx, entryId, revisionId, options) {
 }
 function registerEntryCommands(program) {
   const entry = program.command("entry").description("Read, add, and delete entries in a collection");
-  const get = entry.command("get <entryId>").description("Fetch a single entry");
+  const get = entry.command("get <entryId>").alias("show").description("Fetch a single entry");
   collectionOption(publicationOption(get)).action(async (entryId, options, command) => {
     await runEntryGet(await buildReadContext(command), entryId, options);
   });
-  const list = entry.command("list").description("List entries in a collection").option("--limit <n>", "Maximum results per page").option("--cursor <cursor>", "Continue from a previous page cursor").option("--drafts-only", "Show only entries with a pending (unpublished) draft");
+  const list = entry.command("list").description("List entries in a collection").option("--limit <n>", "Maximum results per page").option("--cursor <cursor>", "Continue from a previous page cursor").option("--all", "Fetch every page (same as `entry scan`)").option("--drafts-only", "Show only entries with a pending (unpublished) draft");
   collectionOption(publicationOption(list)).action(async (options, command) => {
     await runEntryList(await buildReadContext(command), options);
   });
@@ -1981,7 +1994,7 @@ function registerEntryCommands(program) {
   collectionOption(publicationOption(publisherCapOption(remove))).action(async (entryId, options, command) => {
     await runEntryDelete(await buildWriteContext(command), entryId, options, globalOptions(command));
   });
-  const read = entry.command("read <entryId> [revisionIndex]").description("Fetch a public entry's content to stdout or a file").option("--out <path>", "Write content to a file instead of stdout");
+  const read = entry.command("read <entryId> [revisionIndex]").alias("download").description("Fetch a public entry's content to stdout or a file").option("--out <path>", "Write content to a file instead of stdout");
   collectionOption(publicationOption(viaAggregatorOption(read))).action(async (entryId, revisionId, options, command) => {
     await runEntryRead(await buildReadContentContext(command, {
       viaAggregator: options.viaAggregator
@@ -2411,13 +2424,13 @@ function registerFileCommands(program) {
       indexerUrl: options.indexerUrl
     }), options);
   });
-  const download = file.command("download [file]").description("Download a file's content; decrypts in place when encrypted").option("--out <path>", "Write content to a file instead of stdout").option("--share <string>", "Share string from upload (bundles file id, prefix, nonce)").option("--prefix <hex>", "Seal prefix (with --nonce) to decrypt").option("--nonce <hex>", "Seal nonce (with --prefix) to decrypt").option("--raw", "Write the raw (still-encrypted) bytes when no decrypt input is given");
+  const download = file.command("download [file]").alias("read").description("Download a file's content; decrypts in place when encrypted").option("--out <path>", "Write content to a file instead of stdout").option("--share <string>", "Share string from upload (bundles file id, prefix, nonce)").option("--prefix <hex>", "Seal prefix (with --nonce) to decrypt").option("--nonce <hex>", "Seal nonce (with --prefix) to decrypt").option("--raw", "Write the raw (still-encrypted) bytes when no decrypt input is given");
   viaAggregatorOption(download).action(async (target, options, command) => {
     await runFileDownload(await buildFileDownloadContext(command, {
       viaAggregator: options.viaAggregator
     }), target, options);
   });
-  file.command("get <file>").description("Fetch a file's on-chain metadata").action(async (target, _options, command) => {
+  file.command("get <file>").alias("show").description("Fetch a file's on-chain metadata").action(async (target, _options, command) => {
     await runFileGet(await buildFilesReadContext(command), target);
   });
   const register = file.command("register").description("Register on-chain metadata for a blob already on Walrus").requiredOption("--blob-id <id>", "Walrus content id").requiredOption("-n, --name <name>", "File name").requiredOption("--content-type <mime>", "MIME content type").requiredOption("--size <bytes>", "Plaintext byte length").option("--public", "Register a world-readable (unencrypted) file").option("--encrypted", "Register an encrypted file (needs --seal-prefix)").option("--seal-prefix <hex>", "Seal prefix the blob was encrypted under").option("--blob-object-id <id>", "On-chain Walrus Blob object id, if known");
@@ -2553,7 +2566,7 @@ async function runPublicationTransferOwnership(ctx, recipient, options, gopts) {
 }
 function registerPublicationCommands(program) {
   const publication = program.command("publication").alias("pub").description("Work with publications");
-  publication.command("get [publication]").description("Fetch a publication (slug or id; default: the active publication)").action(async (target, _options, command) => {
+  publication.command("get [publication]").alias("show").description("Fetch a publication (slug or id; default: the active publication)").action(async (target, _options, command) => {
     await runPublicationGet(await buildReadContext(command), target);
   });
   publication.command("list [address]").description("List publications owned by an address (default: the active account)").option("--limit <n>", "Maximum results per page").option("--cursor <cursor>", "Continue from a previous page cursor").option("--ids-only", "Skip slug/name resolution (one RPC, no per-publication reads)").action(async (address, options, command) => {

package/docs/QUICKSTART.md

@@ -43,6 +43,18 @@ Saved profile "testnet" (testnet).
 
 ## 2. Import your key
 
+Three ways to give the CLI a key. It is never accepted as a flag, because argv
+is visible in `ps` and shell history.
+
+- **Interactive**: run `morse account import` and paste at the hidden prompt.
+- **Piped**: `echo "$KEY" | morse account import`
+- **No keystore at all**: export `MORSE_PRIVATE_KEY` and skip the import; every
+  command picks it up.
+
+The first two store the key encrypted and need `MORSE_KEYSTORE_PASSWORD` (or an
+interactive password prompt).
+
+
 `account import` prompts for the secret key and a keystore password, both hidden.
 The key is encrypted at rest (scrypt + AES-256-GCM) and never stored in plaintext.
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@arcadiasystems/morse-cli",
-	"version": "0.7.0",
+	"version": "0.8.0",
 	"description": "Command-line interface for the Morse decentralized CMS on Sui.",
 	"license": "MIT",
 	"type": "module",