@bankr/cli 0.3.13 → 0.3.23

package/dist/commands/llm.js

@@ -5,7 +5,13 @@ import { spawn } from "child_process";
 import { CLI_USER_AGENT, getApiUrl, getLlmKey, getLlmUrl, requireApiKey, } from "../lib/config.js";
 import { getBalances } from "../lib/api.js";
 import * as output from "../lib/output.js";
+import { getErrorMessage } from "../lib/errors.js";
+import { isHelpRequest } from "../lib/passthrough.js";
 const ERR_LLM_NOT_ENABLED = "LLM Gateway not enabled on this API key. Enable at bankr.bot/api-keys";
+/** True when the model serves chat completions (image-only models don't). */
+function supportsChat(m) {
+    return (m.output ?? ["text"]).includes("text");
+}
 /**
  * Fallback model catalog — used when the gateway is unreachable or unauthenticated.
  * resolveModels() fetches live data from GET /v1/models; this list is the offline safety net.
@@ -87,6 +93,24 @@ const GATEWAY_MODELS = [
         cost: { input: 1.0, output: 5.0, cacheRead: 0.1, cacheWrite: 1.25 },
     },
     // Gemini
+    {
+        id: "gemini-3.6-flash",
+        name: "Gemini 3.6 Flash",
+        owned_by: "google",
+        contextWindow: 1048576,
+        maxTokens: 65536,
+        input: IMAGE_INPUT,
+        cost: { input: 1.5, output: 7.5, cacheRead: 0.15, cacheWrite: 0.08333 },
+    },
+    {
+        id: "gemini-3.5-flash-lite",
+        name: "Gemini 3.5 Flash Lite",
+        owned_by: "google",
+        contextWindow: 1048576,
+        maxTokens: 65536,
+        input: IMAGE_INPUT,
+        cost: { input: 0.3, output: 2.5, cacheRead: 0.03, cacheWrite: 0.08333 },
+    },
     {
         id: "gemini-3.1-pro",
         name: "Gemini 3.1 Pro",
@@ -133,6 +157,18 @@ const GATEWAY_MODELS = [
         cost: { input: 0.3, output: 2.5, cacheRead: 0.03, cacheWrite: 0.0833 },
     },
     // OpenAI
+    {
+        id: "gpt-image-2",
+        name: "GPT Image 2",
+        owned_by: "openai",
+        contextWindow: 32000,
+        maxTokens: 16384,
+        input: TEXT_INPUT,
+        output: ["image"],
+        // Image model — served via /v1/images/generations; output rate is per
+        // million image tokens.
+        cost: { input: 5.0, output: 30.0, cacheRead: 0, cacheWrite: 0 },
+    },
     {
         id: "gpt-5.5",
         name: "GPT 5.5",
@@ -278,6 +314,15 @@ const GATEWAY_MODELS = [
         input: TEXT_INPUT,
         cost: { input: 0.1, output: 0.4, cacheRead: 0, cacheWrite: 0 },
     },
+    {
+        id: "kimi-k3",
+        name: "Kimi K3",
+        owned_by: "moonshotai",
+        contextWindow: 1048576,
+        maxTokens: 131072,
+        input: IMAGE_INPUT,
+        cost: { input: 3.0, output: 15.0, cacheRead: 0.3, cacheWrite: 0 },
+    },
     {
         id: "kimi-k2.7-code",
         name: "Kimi K2.7 Code",
@@ -373,6 +418,9 @@ async function resolveModels() {
                 contextWindow: m.context_window ?? fallback?.contextWindow ?? 128000,
                 maxTokens: m.max_output_tokens ?? fallback?.maxTokens ?? 32768,
                 input: m.input_modalities ?? fallback?.input ?? TEXT_INPUT,
+                ...((m.output_modalities ?? fallback?.output) && {
+                    output: m.output_modalities ?? fallback?.output,
+                }),
                 cost: m.pricing
                     ? {
                         input: m.pricing.input,
@@ -388,6 +436,7 @@ async function resolveModels() {
                     }),
                 ...(m.deprecation && { deprecation: m.deprecation }),
                 ...(m.private && { private: true }),
+                ...(m.zdr && { zdr: true }),
             };
         });
         return { models, live: true };
@@ -426,46 +475,142 @@ function installConfigFile(configFile, toolName, merge) {
     output.success(`Bankr provider installed to ${configFile}`);
 }
 /* ───────────────────────────── bankr llm models ───────────────────────────── */
+/**
+ * The tier filters. Both flags read the gateway's own capability flags from
+ * /v1/models, so they track the live registry rather than a hardcoded list.
+ */
+const TIER_VIEWS = {
+    private: {
+        title: "Bankr LLM Gateway — Private Models",
+        match: (m) => m.private === true,
+        empty: "No models currently offer a private (TEE) compute environment.",
+        countSuffix: " support :private",
+    },
+    zdr: {
+        title: "Bankr LLM Gateway — Zero-Retention Models",
+        match: (m) => m.zdr === true,
+        empty: "No models currently guarantee zero data retention.",
+        countSuffix: " support :zdr",
+    },
+};
 export async function modelsCommand(opts = {}) {
     const spin = output.spinner("Fetching models…");
     const { models, live } = await resolveModels();
     spin.stop();
-    // `private` is the gateway's own "supports :private" flag from
-    // /v1/models (driven by each model's NEAR slot + NEARAI_API_KEY), so this
-    // tracks the live registry rather than a hardcoded CLI list.
-    const shown = opts.private ? models.filter((m) => m.private) : models;
-    output.brandBold(opts.private
-        ? "Bankr LLM Gateway — Private Models"
-        : "Bankr LLM Gateway — Available Models");
+    // `--private` wins when both are passed: private is the narrower set (every
+    // private model is also ZDR), so it's the more specific of the two requests.
+    const view = opts.private
+        ? TIER_VIEWS.private
+        : opts.zdr
+            ? TIER_VIEWS.zdr
+            : undefined;
+    const shown = view ? models.filter(view.match) : models;
+    output.brandBold(view?.title ?? "Bankr LLM Gateway — Available Models");
     console.log();
-    if (opts.private && shown.length === 0) {
+    if (view && shown.length === 0) {
         output.warn(live
-            ? "No models currently offer a private (TEE) compute environment."
-            : "Private status needs a live gateway — set BANKR_LLM_KEY (and BANKR_LLM_URL).");
+            ? view.empty
+            : "Tier status needs a live gateway — set BANKR_LLM_KEY (and BANKR_LLM_URL).");
         return;
     }
-    const COL = { id: 24, name: 24, provider: 12 };
-    const hasNotes = shown.some((m) => m.deprecation || m.private);
-    console.log(`  ${output.fmt.brandBold("Model ID".padEnd(COL.id))} ${output.fmt.brandBold("Name".padEnd(COL.name))} ${output.fmt.brandBold("Provider".padEnd(COL.provider))}${hasNotes ? ` ${output.fmt.brandBold("Notes")}` : ""}`);
-    console.log(output.fmt.dim(`  ${"─".repeat(COL.id + COL.name + COL.provider + (hasNotes ? 24 : 2))}`));
-    for (const m of shown) {
-        let notes = "";
+    // Widths are sized to the longest real value (`minimax-m2.7-highspeed` /
+    // `MiniMax M2.7 Highspeed` are both 22), keeping the table under ~90 columns
+    // once the tier list is included.
+    const COL = { id: 23, name: 23, provider: 11, privacy: 28 };
+    const isImageGen = (m) => m.output?.includes("image") === true;
+    /**
+     * Every tier this model can serve, not just the strongest.
+     *
+     * The tiers nest, so a private model is also reachable at zdr and standard —
+     * listing only the top one made the ladder look like three separate offers
+     * and hid that `glm-5.2` (no suffix) is a perfectly valid standard request.
+     * Read straight off the flags rather than inferring `zdr` from `private`, so
+     * the column reports what the gateway actually advertises.
+     */
+    const supportedTiers = (m) => {
+        // Each tier is painted individually. Colouring the joined string instead
+        // made "standard" grey on a standard-only row and green on a ZDR one — the
+        // same word changing colour purely because of what followed it.
+        const tiers = [
+            // The baseline, on every row, so it recedes rather than competing.
+            { label: "standard", paint: output.fmt.dim },
+        ];
+        if (m.zdr)
+            tiers.push({ label: "zdr", paint: output.fmt.success });
+        if (m.private) {
+            // Distinct from zdr: they are two rungs, not one capability.
+            tiers.push({ label: "private (tee)", paint: output.fmt.magic });
+        }
+        return tiers;
+    };
+    /**
+     * Pad from the PLAIN text — ANSI escapes have zero display width but count
+     * toward `.length`, so padding the painted string misaligns every coloured
+     * row against the header.
+     */
+    const tierCell = (m) => {
+        const tiers = supportedTiers(m);
+        const plain = tiers.map((t) => t.label).join(", ");
+        const painted = tiers
+            .map((t) => t.paint(t.label))
+            .join(output.fmt.dim(", "));
+        return painted + " ".repeat(Math.max(0, COL.privacy - plain.length));
+    };
+    /**
+     * Everything that is NOT a privacy tier. Kept in its own column because
+     * sharing one cell forced an `else if` chain where a deprecated ZDR model
+     * showed only "deprecated" and its tier silently disappeared.
+     */
+    const modelNotes = (m) => {
+        const parts = [];
         if (m.deprecation) {
-            notes = m.deprecation.replaced_by
+            parts.push(m.deprecation.replaced_by
                 ? `deprecated → ${m.deprecation.replaced_by}`
-                : "deprecated";
+                : "deprecated");
         }
-        else if (m.private) {
-            notes = "Private (TEE)";
-        }
-        console.log(`  ${output.fmt.brand(m.id.padEnd(COL.id))} ${m.name.padEnd(COL.name)} ${output.fmt.dim(m.owned_by.padEnd(COL.provider))} ${notes ? output.fmt.dim(notes) : ""}`);
+        if (isImageGen(m))
+            parts.push("Image gen (/v1/images/generations)");
+        return parts.join(" · ");
+    };
+    const showNotes = shown.some((m) => modelNotes(m) !== "");
+    const line = (cells) => console.log(`  ${cells.join(" ")}`.trimEnd());
+    line([
+        output.fmt.brandBold("Model ID".padEnd(COL.id)),
+        output.fmt.brandBold("Name".padEnd(COL.name)),
+        output.fmt.brandBold("Provider".padEnd(COL.provider)),
+        output.fmt.brandBold("Privacy Tier".padEnd(COL.privacy)),
+        ...(showNotes ? [output.fmt.brandBold("Notes")] : []),
+    ]);
+    // Measured, not guessed: a fixed fudge factor for the last column left the
+    // rule hanging well past the header once the tier list widened it.
+    const notesWidth = showNotes
+        ? Math.max(...shown.map((m) => modelNotes(m).length))
+        : 0;
+    const rule = COL.id +
+        COL.name +
+        COL.provider +
+        COL.privacy +
+        3 +
+        (showNotes ? notesWidth + 1 : 0);
+    console.log(output.fmt.dim(`  ${"─".repeat(rule)}`));
+    for (const m of shown) {
+        line([
+            output.fmt.brand(m.id.padEnd(COL.id)),
+            m.name.padEnd(COL.name),
+            output.fmt.dim(m.owned_by.padEnd(COL.provider)),
+            tierCell(m),
+            ...(showNotes ? [output.fmt.dim(modelNotes(m))] : []),
+        ]);
     }
     console.log();
     output.dim(`  Gateway: ${getLlmUrl()}`);
-    output.dim(`  ${shown.length} model${shown.length === 1 ? "" : "s"}${opts.private ? " support :private" : " available"}${live ? "" : " (cached)"}`);
-    if (!opts.private && shown.some((m) => m.private)) {
+    output.dim(`  ${shown.length} model${shown.length === 1 ? "" : "s"}${view?.countSuffix ?? " available"}${live ? "" : " (cached)"}`);
+    if (!view && shown.some((m) => m.private)) {
         output.dim("  Private (TEE) — append :private to the model id (e.g. glm-5.2:private). List: bankr llm models --private");
     }
+    if (!view && shown.some((m) => m.zdr)) {
+        output.dim("  Zero data retention — append :zdr to the model id (e.g. glm-5.2:zdr), or turn it on account-wide under Settings in the web terminal. List: bankr llm models --zdr");
+    }
 }
 /* ─────────────────────── bankr llm credits ─────────────────────────────────── */
 export async function creditsCommand() {
@@ -507,7 +652,7 @@ export async function creditsCommand() {
     }
     catch (err) {
         spin.stop();
-        output.error(`Failed to fetch credits: ${err.message}`);
+        output.error(`Failed to fetch credits: ${getErrorMessage(err)}`);
         process.exit(1);
     }
 }
@@ -560,7 +705,7 @@ function resolveTokenAcrossChains(input, balances) {
                     symbol: nativeSym,
                     name: nativeSym,
                     decimals: 18,
-                    balance: parseFloat(chainBal.nativeBalance || "0"),
+                    balance: chainBal.nativeBalance || "0",
                     balanceUsd: nativeUsd,
                 });
             }
@@ -627,7 +772,7 @@ export async function creditsAddCommand(amount, opts) {
         catch (err) {
             balSpin.stop();
             // Non-fatal — proceed without balance display
-            output.dim(`  (Could not fetch balance: ${err.message})`);
+            output.dim(`  (Could not fetch balance: ${getErrorMessage(err)})`);
         }
     }
     // When --token is passed, the chain holding the highest USD balance of
@@ -642,7 +787,7 @@ export async function creditsAddCommand(amount, opts) {
         }
         catch (err) {
             resolveSpin.stop();
-            output.warn(`Could not fetch balances: ${err.message}`);
+            output.warn(`Could not fetch balances: ${getErrorMessage(err)}`);
         }
         if (!resolved) {
             output.error(`Token "${opts.token}" not found in your wallet on any supported chain.`);
@@ -720,7 +865,7 @@ export async function creditsAddCommand(amount, opts) {
     }
     catch (err) {
         spin.stop();
-        output.error(`Failed to add credits: ${err.message}`);
+        output.error(`Failed to add credits: ${getErrorMessage(err)}`);
         process.exit(1);
     }
 }
@@ -782,7 +927,7 @@ export async function creditsAutoCommand(opts) {
         }
         catch (err) {
             spin.stop();
-            output.error(`Failed to fetch config: ${err.message}`);
+            output.error(`Failed to fetch config: ${getErrorMessage(err)}`);
             process.exit(1);
         }
         return;
@@ -907,7 +1052,7 @@ export async function creditsAutoCommand(opts) {
     }
     catch (err) {
         spin.stop();
-        output.error(`Failed to update config: ${err.message}`);
+        output.error(`Failed to update config: ${getErrorMessage(err)}`);
         process.exit(1);
     }
 }
@@ -916,13 +1061,31 @@ export async function setupOpenclawCommand(opts) {
     const llmKey = getLlmKey();
     const llmUrl = getLlmUrl();
     const { models } = await resolveModels();
-    const activeModels = models.filter((m) => !m.deprecation);
+    // Coding-tool config lists chat models only — image-only models can't chat.
+    const activeModels = models.filter((m) => !m.deprecation && supportsChat(m));
+    // --images routes OpenClaw's built-in image_generate tool through the gateway.
+    // That tool only uses OpenClaw's known image providers (not custom ones like
+    // `bankr`), so enabling it takes over the `openai` provider slot. OpenClaw's
+    // OpenAI provider expects a `/v1`-suffixed base; normalize so a llmUrl that
+    // already ends in /v1 (or a trailing slash) doesn't produce `/v1/v1`.
+    const imageBaseUrl = `${llmUrl.replace(/\/+$/, "").replace(/\/v1$/, "")}/v1`;
+    const imageProvider = opts.images
+        ? { baseUrl: imageBaseUrl, apiKey: llmKey ?? "${BANKR_API_KEY}" }
+        : null;
+    const imageGenerationModel = opts.images
+        ? { primary: "openai/gpt-image-2", timeoutMs: 180000 }
+        : null;
+    const warnImagesSlot = () => {
+        if (opts.images)
+            output.warn("--images points OpenClaw's `openai` provider at the gateway; image_generate (and any OpenAI-format request) now routes through Bankr. Skip --images if you use real OpenAI in OpenClaw.");
+    };
     const providerConfig = {
         baseUrl: llmUrl,
         apiKey: llmKey ?? "${BANKR_API_KEY}",
         api: "openai-completions",
-        // Private models get both entries: the plain id and a `:private`
-        // twin that routes through the TEE compute environment — so users can pick either.
+        // Models get a twin entry per privacy tier they support, so users can pick
+        // one from the model dropdown in tools that expose no other configuration.
+        // Base first, then weakest tier to strongest.
         models: activeModels.flatMap((m) => {
             const base = {
                 id: m.id,
@@ -933,12 +1096,15 @@ export async function setupOpenclawCommand(opts) {
                 maxTokens: m.maxTokens,
                 cost: m.cost,
             };
-            return m.private
-                ? [
-                    base,
-                    { ...base, id: `${m.id}:private`, name: `${m.name} (Private)` },
-                ]
-                : [base];
+            return [
+                base,
+                ...(m.zdr
+                    ? [{ ...base, id: `${m.id}:zdr`, name: `${m.name} (ZDR)` }]
+                    : []),
+                ...(m.private
+                    ? [{ ...base, id: `${m.id}:private`, name: `${m.name} (Private)` }]
+                    : []),
+            ];
         }),
     };
     if (opts.install) {
@@ -947,17 +1113,43 @@ export async function setupOpenclawCommand(opts) {
             const models = existing.models ?? {};
             const providers = models.providers ?? {};
             providers.bankr = providerConfig;
+            if (imageProvider) {
+                providers.openai = {
+                    ...(providers.openai ?? {}),
+                    ...imageProvider,
+                };
+            }
             models.providers = providers;
             existing.models = models;
+            if (imageGenerationModel) {
+                const agents = existing.agents ?? {};
+                const defaults = agents.defaults ?? {};
+                defaults.imageGenerationModel = imageGenerationModel;
+                agents.defaults = defaults;
+                existing.agents = agents;
+            }
         });
         warnIfNoKey(llmKey);
+        warnImagesSlot();
         return;
     }
-    console.log(JSON.stringify({ models: { providers: { bankr: providerConfig } } }, null, 2));
+    const printed = {
+        models: {
+            providers: {
+                bankr: providerConfig,
+                ...(imageProvider ? { openai: imageProvider } : {}),
+            },
+        },
+        ...(imageGenerationModel
+            ? { agents: { defaults: { imageGenerationModel } } }
+            : {}),
+    };
+    console.log(JSON.stringify(printed, null, 2));
     console.log();
     if (!llmKey) {
         output.warn("No API key set. Replace ${BANKR_API_KEY} with your key or run: bankr login");
     }
+    warnImagesSlot();
     output.dim("Add to ~/.openclaw/openclaw.json or run: bankr llm setup openclaw --install");
 }
 /* ──────────────────────── bankr llm setup opencode ─────────────────────────── */
@@ -965,11 +1157,15 @@ export async function setupOpenCodeCommand(opts) {
     const llmKey = getLlmKey();
     const llmUrl = getLlmUrl();
     const { models } = await resolveModels();
-    const activeModels = models.filter((m) => !m.deprecation);
+    // Coding-tool config lists chat models only — image-only models can't chat.
+    const activeModels = models.filter((m) => !m.deprecation && supportsChat(m));
     const modelsObj = {};
     for (const m of activeModels) {
         modelsObj[m.id] = { name: m.name };
-        // Private models also expose a `:private` variant (TEE compute environment).
+        // One variant per privacy tier the model supports, weakest to strongest.
+        if (m.zdr) {
+            modelsObj[`${m.id}:zdr`] = { name: `${m.name} (ZDR)` };
+        }
         if (m.private) {
             modelsObj[`${m.id}:private`] = { name: `${m.name} (Private)` };
         }
@@ -1122,6 +1318,9 @@ function translateClaudeModelArgs(args) {
     return out;
 }
 export async function claudeCommand(args) {
+    if (isHelpRequest(args)) {
+        return launchTool("claude", args, {}, "https://docs.anthropic.com/en/docs/claude-code");
+    }
     const llmKey = requireAuth();
     const llmUrl = getLlmUrl();
     const translated = translateClaudeModelArgs(args);
@@ -1130,6 +1329,9 @@ export async function claudeCommand(args) {
 }
 /* ────────────────────────── bankr llm opencode ───────────────────────────── */
 export async function opencodeCommand(args) {
+    if (isHelpRequest(args)) {
+        return launchTool("opencode", args, {}, "https://opencode.ai");
+    }
     const llmKey = requireAuth();
     const llmUrl = getLlmUrl();
     const configFile = join(homedir(), ".config", "opencode", "opencode.json");

package/dist/commands/login.d.ts

@@ -1,3 +1,16 @@
+/**
+ * Both Privy credentials minted by the OTP exchange. The identity token alone
+ * authenticates, but only the ACCESS token carries the session `sid` claim —
+ * so sending it too is what makes a CLI login show up in Active Sessions and
+ * be killable by "log out this device". Keep them paired; never send just one.
+ */
+interface CliAuthTokens {
+    identityToken: string;
+    accessToken: string;
+}
+/** The auth headers every authenticated CLI call sends — one place, so a new
+ * endpoint can't silently omit the access token and go unrevocable again. */
+export declare function authHeaders(tokens: CliAuthTokens): Record<string, string>;
 export declare function loginCommand(opts: {
     apiUrl?: string;
     apiKey?: string;
@@ -16,4 +29,5 @@ export declare function loginCommand(opts: {
     allowedIps?: string;
     allowedRecipients?: string;
 }): Promise<void>;
+export {};
 //# sourceMappingURL=login.d.ts.map

package/dist/commands/login.js

@@ -4,6 +4,7 @@ import open from "open";
 import { isAddress } from "viem";
 import { CLI_USER_AGENT, DEFAULT_API_URL, getApiUrl, getConfigPath, readConfig, writeConfig, } from "../lib/config.js";
 import * as output from "../lib/output.js";
+import { getErrorMessage } from "../lib/errors.js";
 const DEFAULT_DASHBOARD_URL = "https://bankr.bot/api-keys";
 const MAX_OTP_ATTEMPTS = 3;
 const INVALID_CODE_STATUSES = [400, 401, 422];
@@ -45,6 +46,16 @@ async function sendPrivyOtp(privyConfig, email) {
         throw new Error(`Failed to send verification code: ${body || res.status}`);
     }
 }
+/** The auth headers every authenticated CLI call sends — one place, so a new
+ * endpoint can't silently omit the access token and go unrevocable again. */
+export function authHeaders(tokens) {
+    return {
+        "Content-Type": "application/json",
+        "User-Agent": CLI_USER_AGENT,
+        "privy-id-token": tokens.identityToken,
+        "x-access-token": tokens.accessToken,
+    };
+}
 async function verifyPrivyOtp(privyConfig, email, code) {
     const res = await fetch("https://auth.privy.io/api/v1/passwordless/authenticate", {
         method: "POST",
@@ -66,14 +77,10 @@ async function verifyPrivyOtp(privyConfig, email, code) {
     }
     return (await res.json());
 }
-async function callGenerateWallet(apiUrl, identityToken) {
+async function callGenerateWallet(apiUrl, tokens) {
     const res = await fetch(`${apiUrl}/cli/generate-wallet`, {
         method: "POST",
-        headers: {
-            "Content-Type": "application/json",
-            "User-Agent": CLI_USER_AGENT,
-            "privy-id-token": identityToken,
-        },
+        headers: authHeaders(tokens),
     });
     const body = (await res.json());
     if (!res.ok) {
@@ -81,28 +88,20 @@ async function callGenerateWallet(apiUrl, identityToken) {
     }
     return body;
 }
-async function callAcceptTerms(apiUrl, identityToken) {
+async function callAcceptTerms(apiUrl, tokens) {
     const res = await fetch(`${apiUrl}/user/accept-terms`, {
         method: "POST",
-        headers: {
-            "Content-Type": "application/json",
-            "User-Agent": CLI_USER_AGENT,
-            "privy-id-token": identityToken,
-        },
+        headers: authHeaders(tokens),
     });
     if (!res.ok) {
         const body = (await res.json().catch(() => ({})));
         throw new Error(body.message || body.error || `Accept terms failed (${res.status})`);
     }
 }
-async function callGenerateApiKey(apiUrl, identityToken, opts) {
+async function callGenerateApiKey(apiUrl, tokens, opts) {
     const res = await fetch(`${apiUrl}/api-keys`, {
         method: "POST",
-        headers: {
-            "Content-Type": "application/json",
-            "User-Agent": CLI_USER_AGENT,
-            "privy-id-token": identityToken,
-        },
+        headers: authHeaders(tokens),
         body: JSON.stringify(opts),
     });
     const body = (await res.json());
@@ -127,7 +126,7 @@ async function sendOtpWithSpinner(privyConfig, email) {
     }
     catch (err) {
         spin.fail("Failed to send verification code");
-        fatal(err.message);
+        fatal(getErrorMessage(err));
     }
 }
 async function verifyOtpWithSpinner(privyConfig, email, code) {
@@ -138,7 +137,7 @@ async function verifyOtpWithSpinner(privyConfig, email, code) {
         return result;
     }
     catch (err) {
-        const errMsg = err.message;
+        const errMsg = getErrorMessage(err);
         spin.fail("Verification failed");
         fatal(errMsg === "INVALID_CODE" ? "Invalid verification code." : errMsg);
     }
@@ -162,7 +161,13 @@ async function authenticateWithEmail(apiUrl, providedEmail, providedCode) {
     // Headless: code already provided, verify directly
     if (providedCode) {
         const result = await verifyOtpWithSpinner(privyConfig, email, providedCode.trim());
-        return { identityToken: result.identity_token, email };
+        return {
+            tokens: {
+                identityToken: result.identity_token,
+                accessToken: result.token,
+            },
+            email,
+        };
     }
     // Interactive: send OTP, then prompt for code with retries
     await sendOtpWithSpinner(privyConfig, email);
@@ -176,10 +181,16 @@ async function authenticateWithEmail(apiUrl, providedEmail, providedCode) {
         try {
             const result = await verifyPrivyOtp(privyConfig, email, code.trim());
             verifySpin.succeed("Email verified");
-            return { identityToken: result.identity_token, email };
+            return {
+                tokens: {
+                    identityToken: result.identity_token,
+                    accessToken: result.token,
+                },
+                email,
+            };
         }
         catch (err) {
-            const errMsg = err.message;
+            const errMsg = getErrorMessage(err);
             if (errMsg === "INVALID_CODE") {
                 if (attempt < MAX_OTP_ATTEMPTS - 1) {
                     verifySpin.fail("Invalid code, please try again");
@@ -197,17 +208,17 @@ async function authenticateWithEmail(apiUrl, providedEmail, providedCode) {
 // ── Email login flow ────────────────────────────────────────────────
 async function emailLoginFlow(apiUrl, opts) {
     // Step 1: Authenticate via email OTP
-    const { identityToken } = await authenticateWithEmail(apiUrl, opts.email, opts.code);
+    const { tokens } = await authenticateWithEmail(apiUrl, opts.email, opts.code);
     // Step 2: Generate/resolve wallet
     const walletSpin = output.spinner("Setting up wallet...");
     let wallet;
     try {
-        wallet = await callGenerateWallet(apiUrl, identityToken);
+        wallet = await callGenerateWallet(apiUrl, tokens);
         walletSpin.stop();
     }
     catch (err) {
         walletSpin.fail("Wallet setup failed");
-        fatal(err.message);
+        fatal(getErrorMessage(err));
     }
     // Show wallet info
     output.blank();
@@ -241,12 +252,12 @@ async function emailLoginFlow(apiUrl, opts) {
         }
         const termsSpin = output.spinner("Accepting terms...");
         try {
-            await callAcceptTerms(apiUrl, identityToken);
+            await callAcceptTerms(apiUrl, tokens);
             termsSpin.succeed("Terms accepted");
         }
         catch (err) {
             termsSpin.fail("Failed to accept terms");
-            fatal(err.message);
+            fatal(getErrorMessage(err));
         }
     }
     // Step 4: Generate API key
@@ -281,7 +292,7 @@ async function emailLoginFlow(apiUrl, opts) {
     const keySpin = output.spinner("Generating API key...");
     let apiKeyResult;
     try {
-        apiKeyResult = await callGenerateApiKey(apiUrl, identityToken, {
+        apiKeyResult = await callGenerateApiKey(apiUrl, tokens, {
             name: keyName.trim(),
             walletApiEnabled: enableWallet,
             agentApiEnabled: enableAgent,
@@ -295,7 +306,7 @@ async function emailLoginFlow(apiUrl, opts) {
     }
     catch (err) {
         keySpin.fail("Failed to generate API key");
-        fatal(err.message);
+        fatal(getErrorMessage(err));
     }
     // Show result
     output.blank();