@bankr/cli 0.3.35 → 0.3.37

package/README.md

@@ -94,9 +94,11 @@ bankr launch --name "TESTCOIN" --image "https://example.com/img.png" \
 # Quick launch (name only, skip confirmation)
 bankr launch --name "TESTCOIN" -y
 
-# Pair the pool with a tokenized stock instead of WETH (Robinhood Chain or Base)
+# Pair the pool with a tokenized stock or another listed quote token instead of WETH (Robinhood Chain or Base)
 bankr launch quotes --chain robinhood        # list the quote tokens you can pair with
 bankr launch --name "TESTCOIN" --chain robinhood --quote TSLA -y
+bankr launch --name "TESTCOIN" --chain robinhood --quote musebook -y
+bankr launch --name "TESTCOIN" --chain robinhood --quote BNKR -y      # the Robinhood Chain BNKR contract
 
 # Fee recipient types: x, farcaster, ens, wallet
 bankr launch --name "TESTCOIN" --fee "vitalik.eth" --fee-type ens -y

package/dist/cli.js

@@ -126,8 +126,10 @@ loginCmd
     .option("--accept-terms", "Accept Terms of Service (skips prompt)")
     .option("--key-name <name>", "API key name (default: CLI)")
     .optionsGroup("API Permissions")
-    .option("--read-write", "Disable read-only mode (allow transactions)")
+    .option("--read-only", "Restrict the API key to read operations")
+    .option("--read-write", "Allow transactions (the default for new keys)")
     .option("--no-wallet-api", "Disable Wallet API (enabled by default)")
+    .option("--no-agent-api", "Disable Agent API (enabled by default)")
     .option("--no-token-launch", "Disable Token Launch API (enabled by default)")
     .option("--llm", "Enable LLM gateway on the API key")
     .optionsGroup("Security")
@@ -142,8 +144,10 @@ loginCmd
         code: opts.code,
         acceptTerms: opts.acceptTerms,
         keyName: opts.keyName,
+        readOnly: opts.readOnly,
         readWrite: opts.readWrite,
         walletApi: opts.walletApi,
+        agentApi: opts.agentApi,
         tokenLaunch: opts.tokenLaunch,
         llm: opts.llm,
         allowedIps: opts.allowedIps,
@@ -158,6 +162,7 @@ loginCmd
     .optionsGroup("API Permissions")
     .option("--read-write", "Disable read-only mode (allow transactions)")
     .option("--no-wallet-api", "Disable Wallet API (enabled by default)")
+    .option("--no-agent-api", "Disable Agent API (enabled by default)")
     .option("--no-token-launch", "Disable Token Launch API (enabled by default)")
     .optionsGroup("Security")
     .option("--allowed-ips <ips>", "Comma-separated IP/CIDR allowlist, e.g. 1.2.3.4,10.0.0.0/24")
@@ -171,6 +176,7 @@ loginCmd
         keyName: opts.keyName,
         readWrite: opts.readWrite,
         walletApi: opts.walletApi,
+        agentApi: opts.agentApi,
         tokenLaunch: opts.tokenLaunch,
         allowedIps: opts.allowedIps,
         allowedRecipients: opts.allowedRecipients,

package/dist/commands/llm.js

@@ -869,10 +869,10 @@ export async function modelsCommand(opts = {}) {
     output.dim(`  Gateway: ${getLlmUrl()}`);
     output.dim(`  ${shown.length} model${shown.length === 1 ? "" : "s"}${view?.countSuffix ?? " available"}${live ? "" : " (cached)"}`);
     if (!view && shown.some((m) => m.private)) {
-        output.dim("  Private (TEE) — append :private to the model id (e.g. glm-5.2:private). List: bankr llm models --private");
+        output.dim("  Private (TEE) — append :private to the model id (e.g. glm-5.3-flash:private). List: bankr llm models --private");
     }
     if (!view && shown.some((m) => m.zdr)) {
-        output.dim("  Zero data retention — append :zdr to the model id (e.g. glm-5.2:zdr), or turn it on account-wide under Settings in the web terminal. List: bankr llm models --zdr");
+        output.dim("  Zero data retention — append :zdr to the model id (e.g. glm-5.3-flash:zdr), or turn it on account-wide under Settings in the web terminal. List: bankr llm models --zdr");
     }
 }
 /* ─────────────────────── bankr llm credits ─────────────────────────────────── */

package/dist/commands/login.d.ts

@@ -11,6 +11,19 @@ interface CliAuthTokens {
 /** The auth headers every authenticated CLI call sends — one place, so a new
  * endpoint can't silently omit the access token and go unrevocable again. */
 export declare function authHeaders(tokens: CliAuthTokens): Record<string, string>;
+/**
+ * Maps the permission opt-out flags to the create-key body. Omitted fields
+ * are dropped by JSON.stringify so the server's API_KEY_CREATE_DEFAULTS
+ * decide them; only an explicit flag sends a value.
+ */
+export declare function resolveKeyPermissionOverrides(opts: {
+    readOnly?: boolean;
+    readWrite?: boolean;
+    agentApi?: boolean;
+}): {
+    readOnly?: boolean;
+    agentApiEnabled?: boolean;
+};
 export declare function loginCommand(opts: {
     apiUrl?: string;
     apiKey?: string;
@@ -18,8 +31,10 @@ export declare function loginCommand(opts: {
     code?: string;
     acceptTerms?: boolean;
     keyName?: string;
+    readOnly?: boolean;
     readWrite?: boolean;
     walletApi?: boolean;
+    agentApi?: boolean;
     tokenLaunch?: boolean;
     llm?: boolean;
     llmKey?: string;

package/dist/commands/login.js

@@ -52,6 +52,26 @@ export function authHeaders(tokens) {
         "x-access-token": tokens.accessToken,
     };
 }
+/**
+ * Maps the permission opt-out flags to the create-key body. Omitted fields
+ * are dropped by JSON.stringify so the server's API_KEY_CREATE_DEFAULTS
+ * decide them; only an explicit flag sends a value.
+ */
+export function resolveKeyPermissionOverrides(opts) {
+    if (opts.readOnly && opts.readWrite) {
+        throw new Error("--read-only and --read-write are mutually exclusive");
+    }
+    // Build conditionally: an own `undefined` key would clobber a value the
+    // caller set before spreading this in.
+    const overrides = {};
+    if (opts.readOnly)
+        overrides.readOnly = true;
+    else if (opts.readWrite)
+        overrides.readOnly = false;
+    if (opts.agentApi === false)
+        overrides.agentApiEnabled = false;
+    return overrides;
+}
 async function verifyPrivyOtp(privyConfig, email, code) {
     const res = await fetch("https://auth.privy.io/api/v1/passwordless/authenticate", {
         method: "POST",
@@ -266,10 +286,12 @@ async function emailLoginFlow(apiUrl, opts) {
                 validate: (v) => v.trim().length >= 3 ? true : "Name must be at least 3 characters.",
             }));
     // Fine-grained API flags. walletApi and tokenLaunch default to enabled.
-    // --read-write only controls readOnly, not which APIs are enabled.
+    // --read-only/--read-write only control readOnly, not which APIs are enabled.
     const enableWallet = opts.walletApi ?? true;
-    // Agent API must be enabled from the website (bankr.bot/api-keys), not the CLI.
-    const enableAgent = false;
+    // readOnly and agentApiEnabled are only sent when a flag asks for it, so the
+    // server's API_KEY_CREATE_DEFAULTS (the bankr.bot/api-keys form) decide them.
+    // The --read-only/--read-write conflict was already rejected in loginCommand.
+    const overrides = resolveKeyPermissionOverrides(opts);
     const enableTokenLaunch = opts.tokenLaunch ?? true;
     const enableLlm = opts.llm ??
         (headless
@@ -279,17 +301,13 @@ async function emailLoginFlow(apiUrl, opts) {
                 default: false,
                 theme: output.bankrTheme,
             }));
-    if (opts.readWrite && !enableWallet) {
-        output.warn("--read-write has no effect when Wallet API is disabled");
-    }
     const keySpin = output.spinner("Generating API key...");
     let apiKeyResult;
     try {
         apiKeyResult = await callGenerateApiKey(apiUrl, tokens, {
             name: keyName.trim(),
             walletApiEnabled: enableWallet,
-            agentApiEnabled: enableAgent,
-            readOnly: opts.readWrite ? false : undefined,
+            ...overrides,
             tokenLaunchApiEnabled: enableTokenLaunch,
             llmGatewayEnabled: enableLlm,
             allowedIps: opts.allowedIps,
@@ -304,7 +322,7 @@ async function emailLoginFlow(apiUrl, opts) {
     output.blank();
     const features = [
         enableWallet && "Wallet",
-        enableAgent && "Agent",
+        apiKeyResult.agentApiEnabled && "Agent",
         enableTokenLaunch && "Token Launch",
         enableLlm && "LLM",
     ].filter(Boolean);
@@ -321,7 +339,6 @@ async function emailLoginFlow(apiUrl, opts) {
         ];
         output.dim(`  Recipients: ${parts.join(", ")}`);
     }
-    output.dim("  Agent API: enable at bankr.bot/api-keys");
     output.dim("  Manage keys at bankr.bot/api-keys");
     return apiKeyResult.apiKey;
 }
@@ -372,7 +389,7 @@ async function siweLoginFlow(apiUrl, opts) {
             keyName: opts.keyName ?? `SIWE-${new Date().toISOString().slice(0, 10)}`,
             readOnly: opts.readOnly ?? false,
             walletApiEnabled: opts.walletApi ?? true,
-            agentApiEnabled: false,
+            ...resolveKeyPermissionOverrides({ agentApi: opts.agentApi }),
             tokenLaunchApiEnabled: opts.tokenLaunch ?? true,
             allowedIps: opts.allowedIps,
             allowedRecipients: opts.allowedRecipients,
@@ -492,6 +509,11 @@ export async function loginCommand(opts) {
     if (opts.apiKey !== undefined && !opts.apiKey.trim()) {
         output.fatal("--api-key requires a non-empty value");
     }
+    // Reject conflicting permission flags before any network call, so a
+    // headless step-2 login doesn't burn its one-time code on a usage error.
+    if (opts.readOnly && opts.readWrite) {
+        output.fatal("--read-only and --read-write are mutually exclusive");
+    }
     // Non-interactive mode requires a headless flag combo. Without one, the
     // command would hang on a prompt — fail fast with the available paths.
     // Email step 1 (`login email <addr>` without --code) is also headless:
@@ -569,6 +591,7 @@ export async function loginCommand(opts) {
             keyName: opts.keyName,
             readOnly: !opts.readWrite,
             walletApi: opts.walletApi,
+            agentApi: opts.agentApi,
             tokenLaunch: opts.tokenLaunch,
             ...getParsedRestrictions(),
         });

package/dist/lib/api.d.ts

@@ -224,7 +224,8 @@ export interface DeployTokenRequest {
     provider?: LaunchProvider;
     /** Quote the pool in a tokenized stock (Robinhood Chain / Base, Doppler). */
     pairedStockAddress?: string;
-    /** Quote the pool in one of the fixed Base allowlist tokens (Doppler). */
+    /** Quote the pool in one of the chain's fixed Doppler allowlist tokens
+     *  (Base or Robinhood Chain). */
     pairedTokenAddress?: string;
     /** Bankr Launch v3 options; `quoteAddress` picks the pool's quote token. */
     launchV3?: {
@@ -243,7 +244,7 @@ export interface LaunchQuoteTokenOption {
     deployField: LaunchQuoteTokenDeployField | null;
     /** Stocks only: advisory thin-pool verdict, null when unmeasured. */
     illiquid?: boolean | null;
-    /** Base allowlist only: reviewed-liquidity gate. */
+    /** Doppler allowlist tokens only (pairedTokenAddress): reviewed-liquidity gate. */
     readiness?: "live" | "pending" | "unknown";
 }
 export interface LaunchQuoteTokensResponse {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bankr/cli",
-  "version": "0.3.35",
+  "version": "0.3.37",
   "description": "Official CLI for the Bankr AI agent platform",
   "type": "module",
   "bin": {