@chainalert/cli 0.0.1

package/dist/repl-Q43IBAFT.js

@@ -0,0 +1,1657 @@
+#!/usr/bin/env node
+import {
+  confirm
+} from "./chunk-6FDEYAAT.js";
+import {
+  addRpcConfig,
+  createChannel,
+  createDetection,
+  deleteChannel,
+  deleteDetection,
+  getAlert,
+  getAlertStats,
+  getDetection,
+  getEvent,
+  getStorageSlots,
+  getTemplate,
+  listAlerts,
+  listChannels,
+  listDetections,
+  listEvents,
+  listNetworks,
+  listOrgContracts,
+  listRpcConfigs,
+  listStateChanges,
+  listTemplates,
+  registerOrgContract,
+  resolveContract,
+  testChannel,
+  testDetection,
+  updateDetection
+} from "./chunk-IC5RERFB.js";
+import {
+  getApiKey,
+  getApiUrl,
+  loadConfig
+} from "./chunk-K2BGDX7X.js";
+import {
+  bold,
+  cyan,
+  dim,
+  print,
+  printDim,
+  printError,
+  printWarn
+} from "./chunk-WPW7UBVR.js";
+
+// src/repl/repl.ts
+import { createInterface } from "readline";
+
+// src/ai/client.ts
+import OpenAI from "openai";
+function createOpenAIClient() {
+  const config = loadConfig();
+  if (config.openaiKey) {
+    return new OpenAI({ apiKey: config.openaiKey });
+  }
+  if (config.apiKey) {
+    return new OpenAI({
+      apiKey: config.apiKey,
+      baseURL: `${getApiUrl()}/ai/v1`
+    });
+  }
+  throw new Error(
+    "No OpenAI key configured. Run: chainalert config set openai-key <your-key>"
+  );
+}
+
+// src/ai/registry.ts
+var registry = [
+  // ---------------------------------------------------------------------------
+  // Networks
+  // ---------------------------------------------------------------------------
+  {
+    name: "list_networks",
+    description: "List all blockchain networks supported by ChainAlert. Returns network names, slugs, chain IDs, and status. Use this when the user asks about supported chains or networks.",
+    parameters: { type: "object", properties: {}, required: [] },
+    execute: () => listNetworks()
+  },
+  // ---------------------------------------------------------------------------
+  // Templates
+  // ---------------------------------------------------------------------------
+  {
+    name: "list_templates",
+    description: "List available detection templates. Templates are pre-built monitoring configurations that users can activate. Optionally filter by category or search term.",
+    parameters: {
+      type: "object",
+      properties: {
+        category: {
+          type: "string",
+          description: 'Filter by template category, e.g. "token-activity", "balance", "governance", "custom".'
+        },
+        search: {
+          type: "string",
+          description: "Free-text search across template names and descriptions."
+        }
+      },
+      required: []
+    },
+    execute: (args) => listTemplates(args)
+  },
+  {
+    name: "get_template",
+    description: "Get full details of a specific detection template by its slug. Returns the template definition including all required/optional inputs, rule configuration, and metadata.",
+    parameters: {
+      type: "object",
+      properties: {
+        slug: {
+          type: "string",
+          description: 'The template slug, e.g. "large-transfer", "fund-drainage", "ownership-transfer".'
+        }
+      },
+      required: ["slug"]
+    },
+    execute: (args) => getTemplate(args.slug)
+  },
+  // ---------------------------------------------------------------------------
+  // Detections
+  // ---------------------------------------------------------------------------
+  {
+    name: "list_detections",
+    description: "List the user's detections (active monitoring configurations). Detections are created from templates and watch specific contracts on specific networks. Optionally filter by status or network.",
+    parameters: {
+      type: "object",
+      properties: {
+        status: {
+          type: "string",
+          description: 'Filter by status: "active", "paused", or "error".'
+        },
+        networkId: {
+          type: "string",
+          description: 'Filter by network ID, e.g. "ethereum-mainnet", "arbitrum-one".'
+        },
+        page: { type: "number", description: "Page number (1-based)." },
+        limit: { type: "number", description: "Results per page (default 20, max 100)." }
+      },
+      required: []
+    },
+    execute: (args) => listDetections(
+      args
+    )
+  },
+  {
+    name: "get_detection",
+    description: "Get full details of a specific detection by ID, including its configuration, rules, status, associated channels, and recent activity.",
+    parameters: {
+      type: "object",
+      properties: {
+        id: { type: "string", description: "The detection ID." }
+      },
+      required: ["id"]
+    },
+    execute: (args) => getDetection(args.id)
+  },
+  {
+    name: "create_detection",
+    description: "Create a new detection from a template. This activates blockchain monitoring for the specified contract and network. Requires the template slug, a name, a network ID, and the template-specific inputs. The user should confirm before this runs.",
+    parameters: {
+      type: "object",
+      properties: {
+        templateSlug: {
+          type: "string",
+          description: 'The slug of the template to use, e.g. "large-transfer", "fund-drainage".'
+        },
+        name: {
+          type: "string",
+          description: "A human-readable name for this detection."
+        },
+        networkId: {
+          type: "string",
+          description: 'The network ID to monitor, e.g. "ethereum-mainnet", "arbitrum-one", "base-mainnet", "polygon-mainnet".'
+        },
+        inputs: {
+          type: "object",
+          description: "Template-specific input values. Keys must match the template's input definitions."
+        },
+        contractAddress: {
+          type: "string",
+          description: "The contract address to monitor (0x-prefixed hex)."
+        },
+        channelIds: {
+          type: "array",
+          items: { type: "string" },
+          description: "IDs of notification channels to attach."
+        },
+        severity: {
+          type: "string",
+          description: 'Override severity: "info", "low", "medium", "high", or "critical".'
+        },
+        cooldownMinutes: {
+          type: "number",
+          description: "Minimum minutes between repeated alerts for the same detection (default varies by template)."
+        }
+      },
+      required: ["templateSlug", "name", "networkId", "inputs"]
+    },
+    execute: (args) => createDetection(
+      args
+    ),
+    confirm: (args) => `Creating detection "${args.name}" using template "${args.templateSlug}" on network "${args.networkId}"`
+  },
+  {
+    name: "update_detection",
+    description: "Update an existing detection. Can change its name, status (pause/resume), inputs, notification channels, or cooldown. The user should confirm before this runs.",
+    parameters: {
+      type: "object",
+      properties: {
+        id: { type: "string", description: "The detection ID to update." },
+        name: { type: "string", description: "New name for the detection." },
+        status: {
+          type: "string",
+          description: 'New status: "active" or "paused".'
+        },
+        inputs: {
+          type: "object",
+          description: "Updated template input values."
+        },
+        channelIds: {
+          type: "array",
+          items: { type: "string" },
+          description: "Updated list of notification channel IDs."
+        },
+        cooldownMinutes: {
+          type: "number",
+          description: "New cooldown in minutes between repeated alerts."
+        }
+      },
+      required: ["id"]
+    },
+    execute: (args) => {
+      const { id, ...body } = args;
+      return updateDetection(id, body);
+    },
+    confirm: (args) => `Updating detection ${args.id}${args.status ? ` (status -> ${args.status})` : ""}`
+  },
+  {
+    name: "delete_detection",
+    description: "Permanently delete a detection. This stops all monitoring and removes the detection. The user should confirm before this runs.",
+    parameters: {
+      type: "object",
+      properties: {
+        id: { type: "string", description: "The detection ID to delete." }
+      },
+      required: ["id"]
+    },
+    execute: (args) => deleteDetection(args.id),
+    confirm: (args) => `Deleting detection ${args.id}`
+  },
+  {
+    name: "test_detection",
+    description: "Test a detection against a specific historical block. This runs the detection rules against the block's data and returns whether the detection would have fired. Useful for validating configurations.",
+    parameters: {
+      type: "object",
+      properties: {
+        id: { type: "string", description: "The detection ID to test." },
+        blockNumber: {
+          type: "number",
+          description: "The block number to test against."
+        }
+      },
+      required: ["id", "blockNumber"]
+    },
+    execute: (args) => testDetection(args.id, { blockNumber: args.blockNumber }),
+    confirm: (args) => `Testing detection ${args.id} against block ${args.blockNumber}`
+  },
+  // ---------------------------------------------------------------------------
+  // Alerts
+  // ---------------------------------------------------------------------------
+  {
+    name: "list_alerts",
+    description: "List alerts that have been triggered by the user's detections. Alerts are the actual notifications generated when a detection rule fires. Optionally filter by detection, severity, or date range.",
+    parameters: {
+      type: "object",
+      properties: {
+        detectionId: {
+          type: "string",
+          description: "Filter alerts to a specific detection ID."
+        },
+        severity: {
+          type: "string",
+          description: 'Filter by severity: "info", "low", "medium", "high", or "critical".'
+        },
+        from: {
+          type: "string",
+          description: "Start date (ISO 8601 format, e.g. 2024-01-01)."
+        },
+        to: {
+          type: "string",
+          description: "End date (ISO 8601 format, e.g. 2024-12-31)."
+        },
+        page: { type: "number", description: "Page number (1-based)." },
+        limit: { type: "number", description: "Results per page (default 20, max 100)." }
+      },
+      required: []
+    },
+    execute: (args) => listAlerts(
+      args
+    )
+  },
+  {
+    name: "get_alert",
+    description: "Get full details of a specific alert by ID, including the triggering event, detection context, and notification delivery status.",
+    parameters: {
+      type: "object",
+      properties: {
+        id: { type: "string", description: "The alert ID." }
+      },
+      required: ["id"]
+    },
+    execute: (args) => getAlert(args.id)
+  },
+  {
+    name: "get_alert_stats",
+    description: "Get aggregate alert statistics for the user's organization. Returns counts by severity, detection, and time period. Use this when the user asks for a summary or overview of their alerts.",
+    parameters: { type: "object", properties: {}, required: [] },
+    execute: () => getAlertStats()
+  },
+  // ---------------------------------------------------------------------------
+  // Events
+  // ---------------------------------------------------------------------------
+  {
+    name: "list_events",
+    description: "List blockchain events captured by the user's detections. Events are the raw on-chain occurrences (e.g. Transfer, Approval) that detections monitor. Optionally filter by detection, event name, transaction hash, or date range.",
+    parameters: {
+      type: "object",
+      properties: {
+        detectionId: {
+          type: "string",
+          description: "Filter events to a specific detection ID."
+        },
+        eventName: {
+          type: "string",
+          description: 'Filter by event name, e.g. "Transfer", "Approval".'
+        },
+        txHash: {
+          type: "string",
+          description: "Filter by transaction hash (0x-prefixed)."
+        },
+        from: { type: "string", description: "Start date (ISO 8601)." },
+        to: { type: "string", description: "End date (ISO 8601)." },
+        page: { type: "number", description: "Page number (1-based)." },
+        limit: { type: "number", description: "Results per page (default 20, max 100)." }
+      },
+      required: []
+    },
+    execute: (args) => listEvents(
+      args
+    )
+  },
+  {
+    name: "get_event",
+    description: "Get full details of a specific blockchain event by ID, including decoded parameters and the associated transaction.",
+    parameters: {
+      type: "object",
+      properties: {
+        id: { type: "string", description: "The event ID." }
+      },
+      required: ["id"]
+    },
+    execute: (args) => getEvent(args.id)
+  },
+  // ---------------------------------------------------------------------------
+  // State Changes
+  // ---------------------------------------------------------------------------
+  {
+    name: "list_state_changes",
+    description: "List storage state changes detected by state-polling detections (e.g. proxy upgrades, custom storage slot monitors). Shows previous and current values.",
+    parameters: {
+      type: "object",
+      properties: {
+        detectionId: {
+          type: "string",
+          description: "Filter to a specific detection ID."
+        },
+        page: { type: "number", description: "Page number (1-based)." },
+        limit: { type: "number", description: "Results per page (default 20, max 100)." }
+      },
+      required: []
+    },
+    execute: (args) => listStateChanges(args)
+  },
+  // ---------------------------------------------------------------------------
+  // Channels
+  // ---------------------------------------------------------------------------
+  {
+    name: "list_channels",
+    description: "List notification channels configured by the user. Channels are destinations where alerts are sent (e.g. Slack, Discord, email, webhook). Optionally filter by type.",
+    parameters: {
+      type: "object",
+      properties: {
+        type: {
+          type: "string",
+          description: 'Filter by channel type: "slack", "discord", "email", "webhook", "telegram", "pagerduty".'
+        }
+      },
+      required: []
+    },
+    execute: (args) => listChannels(args)
+  },
+  {
+    name: "create_channel",
+    description: "Create a new notification channel. The config object varies by type: Slack needs webhookUrl, Discord needs webhookUrl, email needs address, webhook needs url and optional headers, Telegram needs chatId and botToken, PagerDuty needs routingKey. The user should confirm before this runs.",
+    parameters: {
+      type: "object",
+      properties: {
+        name: {
+          type: "string",
+          description: "A human-readable name for this channel."
+        },
+        type: {
+          type: "string",
+          description: 'Channel type: "slack", "discord", "email", "webhook", "telegram", "pagerduty".'
+        },
+        config: {
+          type: "object",
+          description: "Channel-specific configuration. For Slack/Discord: { webhookUrl }. For email: { address }. For webhook: { url, headers? }. For Telegram: { chatId, botToken }. For PagerDuty: { routingKey }."
+        }
+      },
+      required: ["name", "type", "config"]
+    },
+    execute: (args) => createChannel(
+      args
+    ),
+    confirm: (args) => `Creating ${args.type} notification channel "${args.name}"`
+  },
+  {
+    name: "delete_channel",
+    description: "Delete a notification channel. Any detections using this channel will stop receiving notifications through it. The user should confirm before this runs.",
+    parameters: {
+      type: "object",
+      properties: {
+        id: { type: "string", description: "The channel ID to delete." }
+      },
+      required: ["id"]
+    },
+    execute: (args) => deleteChannel(args.id),
+    confirm: (args) => `Deleting notification channel ${args.id}`
+  },
+  {
+    name: "test_channel",
+    description: "Send a test notification to a channel to verify it is configured correctly. The user should confirm before this runs.",
+    parameters: {
+      type: "object",
+      properties: {
+        id: { type: "string", description: "The channel ID to test." }
+      },
+      required: ["id"]
+    },
+    execute: (args) => testChannel(args.id),
+    confirm: (args) => `Sending test notification to channel ${args.id}`
+  },
+  // ---------------------------------------------------------------------------
+  // Contracts
+  // ---------------------------------------------------------------------------
+  {
+    name: "resolve_contract",
+    description: "Resolve a contract address on a specific network. Fetches the contract's ABI, name, and other metadata from the block explorer. Use this before creating detections to verify the contract exists and see its available events.",
+    parameters: {
+      type: "object",
+      properties: {
+        address: {
+          type: "string",
+          description: "The contract address (0x-prefixed hex)."
+        },
+        networkId: {
+          type: "string",
+          description: 'The network ID, e.g. "ethereum-mainnet", "arbitrum-one".'
+        }
+      },
+      required: ["address", "networkId"]
+    },
+    execute: (args) => resolveContract(args),
+    confirm: (args) => `Resolving contract ${args.address} on ${args.networkId}`
+  },
+  {
+    name: "get_storage_slots",
+    description: "Get the known storage slot layout of a resolved contract. Returns variable names, types, and their storage slot positions. Useful for setting up storage-monitoring detections.",
+    parameters: {
+      type: "object",
+      properties: {
+        contractId: {
+          type: "string",
+          description: "The resolved contract ID (returned by resolve_contract)."
+        }
+      },
+      required: ["contractId"]
+    },
+    execute: (args) => getStorageSlots(args.contractId)
+  },
+  // ---------------------------------------------------------------------------
+  // Org Contracts
+  // ---------------------------------------------------------------------------
+  {
+    name: "list_org_contracts",
+    description: "List contracts registered to the user's organization. These are contracts the org has explicitly added for monitoring.",
+    parameters: {
+      type: "object",
+      properties: {
+        page: { type: "number", description: "Page number (1-based)." },
+        limit: { type: "number", description: "Results per page (default 20, max 100)." }
+      },
+      required: []
+    },
+    execute: (args) => listOrgContracts(args)
+  },
+  {
+    name: "register_org_contract",
+    description: "Register a contract to the user's organization. This resolves the contract and adds it to the org's contract list for easy reference when creating detections. The user should confirm before this runs.",
+    parameters: {
+      type: "object",
+      properties: {
+        address: {
+          type: "string",
+          description: "The contract address (0x-prefixed hex)."
+        },
+        networkId: {
+          type: "string",
+          description: 'The network ID, e.g. "ethereum-mainnet", "arbitrum-one".'
+        },
+        label: {
+          type: "string",
+          description: 'Optional human-readable label for the contract, e.g. "USDC Proxy".'
+        }
+      },
+      required: ["address", "networkId"]
+    },
+    execute: (args) => registerOrgContract(args),
+    confirm: (args) => `Registering contract ${args.address} on ${args.networkId}${args.label ? ` as "${args.label}"` : ""}`
+  },
+  // ---------------------------------------------------------------------------
+  // RPC Configs
+  // ---------------------------------------------------------------------------
+  {
+    name: "list_rpc_configs",
+    description: "List custom RPC endpoint configurations. Users can add their own RPC endpoints for better performance or to access private/premium nodes.",
+    parameters: { type: "object", properties: {}, required: [] },
+    execute: () => listRpcConfigs()
+  },
+  {
+    name: "add_rpc_config",
+    description: "Add a custom RPC endpoint for a specific network. This overrides the default public RPC for that network. The user should confirm before this runs.",
+    parameters: {
+      type: "object",
+      properties: {
+        networkId: {
+          type: "string",
+          description: 'The network ID to configure, e.g. "ethereum-mainnet", "arbitrum-one".'
+        },
+        rpcUrl: {
+          type: "string",
+          description: "The RPC endpoint URL (https or wss)."
+        }
+      },
+      required: ["networkId", "rpcUrl"]
+    },
+    execute: (args) => addRpcConfig(args),
+    confirm: (args) => `Adding custom RPC endpoint for ${args.networkId}: ${args.rpcUrl}`
+  }
+];
+
+// src/ai/tools.ts
+var tools = registry.map((t) => ({
+  type: "function",
+  function: { name: t.name, description: t.description, parameters: t.parameters }
+}));
+
+// src/ai/executor.ts
+var toolMap = new Map(registry.map((t) => [t.name, t]));
+async function executeTool(name, args) {
+  const tool = toolMap.get(name);
+  if (!tool) return { error: `Unknown tool: ${name}` };
+  if (tool.confirm) {
+    printWarn(tool.confirm(args));
+    const ok = await confirm("Proceed?");
+    if (!ok) return { cancelled: true, message: "User cancelled the operation." };
+  }
+  return tool.execute(args);
+}
+
+// ../../packages/shared/dist/templates/index.js
+var MVP_TEMPLATES = [
+  // -------------------------------------------------------------------------
+  // 1. Large Transfer
+  // -------------------------------------------------------------------------
+  {
+    id: "tpl_large_transfer",
+    slug: "large-transfer",
+    name: "Large Transfer",
+    description: "Alert when an ERC-20 Transfer event moves more than a specified amount of tokens.",
+    category: "token-activity",
+    icon: "arrow-up-right",
+    severityDefault: "high",
+    tier: "free",
+    inputs: [
+      {
+        key: "threshold",
+        label: "Transfer threshold (token units)",
+        type: "number",
+        required: true,
+        min: 0,
+        help: "Transfers with a value above this amount will fire the alert."
+      },
+      {
+        key: "tokenAddress",
+        label: "Token contract address",
+        type: "address",
+        required: false,
+        help: "Leave blank to monitor the contract added to the detection."
+      }
+    ],
+    ruleTemplates: [
+      {
+        type: "event-match",
+        config: {
+          eventSignature: "Transfer(address,address,uint256)",
+          eventName: "Transfer",
+          filter: {
+            field: "value",
+            op: ">",
+            value: "{{threshold}}"
+          }
+        }
+      }
+    ],
+    isActive: true
+  },
+  // -------------------------------------------------------------------------
+  // 2. Fund Drainage
+  // -------------------------------------------------------------------------
+  {
+    id: "tpl_fund_drainage",
+    slug: "fund-drainage",
+    name: "Fund Drainage",
+    description: "Alert when the native or token balance of a contract drops by a specified percentage within a time window.",
+    category: "balance",
+    icon: "trending-down",
+    severityDefault: "critical",
+    tier: "free",
+    inputs: [
+      {
+        key: "dropPercent",
+        label: "Drop percentage",
+        type: "number",
+        required: true,
+        min: 1,
+        max: 100,
+        default: 50,
+        help: "Fire the alert when the balance decreases by at least this percentage."
+      },
+      {
+        key: "windowMinutes",
+        label: "Time window (minutes)",
+        type: "duration",
+        required: true,
+        default: 60,
+        min: 1,
+        help: "The rolling window over which the balance drop is measured."
+      },
+      {
+        key: "tokenAddress",
+        label: "Token contract (blank = native)",
+        type: "address",
+        required: false,
+        help: "Leave blank to track the native asset (ETH, MATIC, etc.)."
+      }
+    ],
+    ruleTemplates: [
+      {
+        type: "balance-track",
+        config: {
+          asset: "{{tokenAddress}}",
+          windowMinutes: "{{windowMinutes}}",
+          condition: {
+            type: "percent_change",
+            value: "{{dropPercent}}"
+          }
+        }
+      }
+    ],
+    isActive: true
+  },
+  // -------------------------------------------------------------------------
+  // 3. Balance Low
+  // -------------------------------------------------------------------------
+  {
+    id: "tpl_balance_low",
+    slug: "balance-low",
+    name: "Balance Low",
+    description: "Alert when the native or token balance of a contract falls below a fixed threshold.",
+    category: "balance",
+    icon: "alert-triangle",
+    severityDefault: "medium",
+    tier: "free",
+    inputs: [
+      {
+        key: "minBalance",
+        label: "Minimum balance",
+        type: "number",
+        required: true,
+        min: 0,
+        help: "Fire the alert when the balance drops below this value."
+      },
+      {
+        key: "tokenAddress",
+        label: "Token contract (blank = native)",
+        type: "address",
+        required: false,
+        help: "Leave blank to track the native asset (ETH, MATIC, etc.)."
+      }
+    ],
+    ruleTemplates: [
+      {
+        type: "balance-track",
+        config: {
+          asset: "{{tokenAddress}}",
+          condition: {
+            op: "<",
+            value: "{{minBalance}}"
+          }
+        }
+      }
+    ],
+    isActive: true
+  },
+  // -------------------------------------------------------------------------
+  // 4. Repeated Transfer
+  // -------------------------------------------------------------------------
+  {
+    id: "tpl_repeated_transfer",
+    slug: "repeated-transfer",
+    name: "Repeated Transfer",
+    description: "Alert when a specified number of Transfer events to the same recipient occur within a time window.",
+    category: "token-activity",
+    icon: "repeat",
+    severityDefault: "medium",
+    tier: "pro",
+    inputs: [
+      {
+        key: "countThreshold",
+        label: "Transfer count",
+        type: "number",
+        required: true,
+        min: 2,
+        default: 5,
+        help: "Number of transfers to the same address that triggers the alert."
+      },
+      {
+        key: "windowMinutes",
+        label: "Time window (minutes)",
+        type: "duration",
+        required: true,
+        default: 60,
+        min: 1,
+        help: "The rolling window in which transfers are counted."
+      }
+    ],
+    ruleTemplates: [
+      {
+        type: "windowed-count",
+        config: {
+          eventSignature: "Transfer(address,address,uint256)",
+          eventName: "Transfer",
+          groupByField: "to",
+          windowMinutes: "{{windowMinutes}}",
+          condition: {
+            op: ">=",
+            value: "{{countThreshold}}"
+          }
+        }
+      }
+    ],
+    isActive: true
+  },
+  // -------------------------------------------------------------------------
+  // 5. Ownership Transfer
+  // -------------------------------------------------------------------------
+  {
+    id: "tpl_ownership_transfer",
+    slug: "ownership-transfer",
+    name: "Ownership Transfer",
+    description: "Alert when ownership changes or a transfer is initiated (OpenZeppelin Ownable / Ownable2Step).",
+    category: "governance",
+    icon: "shield",
+    severityDefault: "critical",
+    tier: "free",
+    inputs: [],
+    ruleTemplates: [
+      {
+        type: "event-match",
+        config: {
+          eventSignature: "OwnershipTransferred(address,address)",
+          eventName: "OwnershipTransferred"
+        }
+      },
+      {
+        type: "event-match",
+        config: {
+          eventSignature: "OwnershipTransferStarted(address,address)",
+          eventName: "OwnershipTransferStarted"
+        }
+      }
+    ],
+    isActive: true
+  },
+  // -------------------------------------------------------------------------
+  // 6. Role Change
+  // -------------------------------------------------------------------------
+  {
+    id: "tpl_role_change",
+    slug: "role-change",
+    name: "Role Change",
+    description: "Alert when a RoleGranted or RoleRevoked event is emitted (OpenZeppelin AccessControl).",
+    category: "governance",
+    icon: "users",
+    severityDefault: "high",
+    tier: "free",
+    inputs: [
+      {
+        key: "roleHash",
+        label: "Role identifier (bytes32, optional)",
+        type: "text",
+        required: false,
+        help: "Restrict to a specific role hash. Leave blank to match all roles."
+      }
+    ],
+    ruleTemplates: [
+      {
+        type: "event-match",
+        config: {
+          eventSignature: "RoleGranted(bytes32,address,address)",
+          eventName: "RoleGranted",
+          filter: {
+            field: "role",
+            op: "==",
+            value: "{{roleHash}}",
+            skipIfEmpty: true
+          }
+        }
+      },
+      {
+        type: "event-match",
+        config: {
+          eventSignature: "RoleRevoked(bytes32,address,address)",
+          eventName: "RoleRevoked",
+          filter: {
+            field: "role",
+            op: "==",
+            value: "{{roleHash}}",
+            skipIfEmpty: true
+          }
+        }
+      }
+    ],
+    isActive: true
+  },
+  // -------------------------------------------------------------------------
+  // 7. Proxy Upgrade
+  // -------------------------------------------------------------------------
+  {
+    id: "tpl_proxy_upgrade",
+    slug: "proxy-upgrade",
+    name: "Proxy Upgrade",
+    description: "Alert when the Upgraded event is emitted on a UUPS or Transparent proxy.",
+    category: "governance",
+    icon: "zap",
+    severityDefault: "critical",
+    tier: "free",
+    inputs: [],
+    ruleTemplates: [
+      {
+        type: "event-match",
+        config: {
+          eventSignature: "Upgraded(address)",
+          eventName: "Upgraded"
+        }
+      }
+    ],
+    isActive: true
+  },
+  // -------------------------------------------------------------------------
+  // 8. Multisig Signer Change
+  // -------------------------------------------------------------------------
+  {
+    id: "tpl_multisig_signer",
+    slug: "multisig-signer",
+    name: "Multisig Signer Change",
+    description: "Alert when an owner is added or removed on a Gnosis Safe (AddedOwner / RemovedOwner).",
+    category: "governance",
+    icon: "key",
+    severityDefault: "high",
+    tier: "free",
+    inputs: [],
+    ruleTemplates: [
+      {
+        type: "event-match",
+        config: {
+          eventSignature: "AddedOwner(address)",
+          eventName: "AddedOwner"
+        }
+      },
+      {
+        type: "event-match",
+        config: {
+          eventSignature: "RemovedOwner(address)",
+          eventName: "RemovedOwner"
+        }
+      }
+    ],
+    isActive: true
+  },
+  // -------------------------------------------------------------------------
+  // 9. Pause State
+  // -------------------------------------------------------------------------
+  {
+    id: "tpl_pause_state",
+    slug: "pause-state",
+    name: "Pause State Change",
+    description: "Alert when a Paused or Unpaused event is emitted (OpenZeppelin Pausable).",
+    category: "governance",
+    icon: "pause-circle",
+    severityDefault: "high",
+    tier: "free",
+    inputs: [],
+    ruleTemplates: [
+      {
+        type: "event-match",
+        config: {
+          eventSignature: "Paused(address)",
+          eventName: "Paused"
+        }
+      },
+      {
+        type: "event-match",
+        config: {
+          eventSignature: "Unpaused(address)",
+          eventName: "Unpaused"
+        }
+      }
+    ],
+    isActive: true
+  },
+  // -------------------------------------------------------------------------
+  // 10. Proxy Upgrade (Storage Slot)
+  // -------------------------------------------------------------------------
+  {
+    id: "tpl_proxy_upgrade_slot",
+    slug: "proxy-upgrade-slot",
+    name: "Proxy Upgrade (Storage Slot)",
+    description: "Poll the ERC-1967 implementation slot directly to detect proxy upgrades \u2014 catches silent upgrades that bypass the Upgraded event.",
+    category: "governance",
+    icon: "eye",
+    severityDefault: "critical",
+    tier: "free",
+    inputs: [
+      {
+        key: "pollIntervalMs",
+        label: "Poll interval (seconds)",
+        type: "number",
+        required: false,
+        default: 60,
+        min: 10,
+        help: "How often to read the storage slot (in seconds)."
+      }
+    ],
+    ruleTemplates: [
+      {
+        type: "state-poll",
+        config: {
+          slot: "0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc",
+          poll_interval_ms: "{{pollIntervalMs:seconds_to_ms}}",
+          condition: {
+            type: "changed"
+          }
+        }
+      }
+    ],
+    isActive: true
+  },
+  // -------------------------------------------------------------------------
+  // 11. Custom Storage Slot
+  // -------------------------------------------------------------------------
+  {
+    id: "tpl_custom_storage_slot",
+    slug: "custom-storage-slot",
+    name: "Custom Storage Slot",
+    description: "Monitor any EVM storage slot for changes or threshold crossings. Use for protocol parameters, implementation slots, or any on-chain variable.",
+    category: "custom",
+    icon: "database",
+    severityDefault: "high",
+    tier: "pro",
+    inputs: [
+      {
+        key: "slot",
+        label: "Storage slot (hex)",
+        type: "text",
+        required: true,
+        help: "The 32-byte hex slot to monitor, e.g. 0x360894\u2026bbc."
+      },
+      {
+        key: "conditionType",
+        label: "Condition",
+        type: "text",
+        required: true,
+        default: "changed",
+        help: 'Condition type: "changed", "threshold_above", or "threshold_below".'
+      },
+      {
+        key: "conditionValue",
+        label: "Threshold value",
+        type: "number",
+        required: false,
+        help: "Required for threshold conditions. The value to compare against.",
+        showIf: "conditionType"
+      },
+      {
+        key: "pollIntervalMs",
+        label: "Poll interval (seconds)",
+        type: "number",
+        required: false,
+        default: 60,
+        min: 10,
+        help: "How often to read the storage slot (in seconds)."
+      }
+    ],
+    ruleTemplates: [
+      {
+        type: "state-poll",
+        config: {
+          slot: "{{slot}}",
+          poll_interval_ms: "{{pollIntervalMs:seconds_to_ms}}",
+          condition: {
+            type: "{{conditionType}}",
+            value: "{{conditionValue}}"
+          }
+        }
+      }
+    ],
+    isActive: true
+  },
+  // -------------------------------------------------------------------------
+  // 12. Storage Anomaly
+  // -------------------------------------------------------------------------
+  {
+    id: "tpl_storage_anomaly",
+    slug: "storage-anomaly",
+    name: "Storage Anomaly",
+    description: "Detect when a storage variable's value suddenly deviates from its rolling average. Useful for spotting parameter manipulation in DeFi protocols.",
+    category: "governance",
+    icon: "activity",
+    severityDefault: "high",
+    tier: "pro",
+    inputs: [
+      {
+        key: "slot",
+        label: "Storage slot (hex)",
+        type: "text",
+        required: true,
+        help: "The 32-byte hex slot to monitor."
+      },
+      {
+        key: "percentThreshold",
+        label: "Deviation threshold (%)",
+        type: "number",
+        required: true,
+        default: 200,
+        min: 1,
+        help: "Alert when the current value deviates from the rolling mean by more than this percentage."
+      },
+      {
+        key: "pollIntervalMs",
+        label: "Poll interval (seconds)",
+        type: "number",
+        required: false,
+        default: 60,
+        min: 10,
+        help: "How often to read the storage slot (in seconds)."
+      }
+    ],
+    ruleTemplates: [
+      {
+        type: "state-poll",
+        config: {
+          slot: "{{slot}}",
+          poll_interval_ms: "{{pollIntervalMs:seconds_to_ms}}",
+          condition: {
+            type: "windowed_percent_change",
+            percentThreshold: "{{percentThreshold}}"
+          }
+        }
+      }
+    ],
+    isActive: true
+  },
+  // -------------------------------------------------------------------------
+  // 13. Native Balance Anomaly (Internal Transfer Detection)
+  // -------------------------------------------------------------------------
+  {
+    id: "tpl_native_balance_anomaly",
+    slug: "native-balance-anomaly",
+    name: "Native Balance Anomaly",
+    description: "Detect significant native balance changes that may indicate internal transactions (ETH moved between contracts without Transfer events).",
+    category: "balance",
+    icon: "eye-off",
+    severityDefault: "high",
+    tier: "free",
+    inputs: [
+      {
+        key: "dropPercent",
+        label: "Change threshold (%)",
+        type: "number",
+        required: true,
+        default: 25,
+        min: 1,
+        max: 100,
+        help: "Alert when native balance changes by at least this percentage within the time window."
+      },
+      {
+        key: "windowMinutes",
+        label: "Time window (minutes)",
+        type: "duration",
+        required: true,
+        default: 30,
+        min: 1,
+        help: "The rolling window over which the balance change is measured."
+      },
+      {
+        key: "pollIntervalMs",
+        label: "Poll interval (seconds)",
+        type: "number",
+        required: false,
+        default: 30,
+        min: 10,
+        help: "How often to check the native balance. Shorter intervals catch more internal transfers."
+      }
+    ],
+    ruleTemplates: [
+      {
+        type: "balance-track",
+        config: {
+          poll_interval_ms: "{{pollIntervalMs:seconds_to_ms}}",
+          windowMinutes: "{{windowMinutes}}",
+          condition: {
+            type: "percent_change",
+            value: "{{dropPercent}}",
+            bidirectional: true
+          }
+        }
+      }
+    ],
+    isActive: true
+  },
+  // -------------------------------------------------------------------------
+  // 14. Custom Event Frequency (Windowed Count)
+  // -------------------------------------------------------------------------
+  {
+    id: "tpl_custom_windowed_count",
+    slug: "custom-windowed-count",
+    name: "Custom Event Frequency",
+    description: "Alert when a specific event fires more than N times within a rolling time window. Optionally group by a decoded event parameter.",
+    category: "custom",
+    icon: "activity",
+    severityDefault: "medium",
+    tier: "pro",
+    inputs: [
+      {
+        key: "eventSignature",
+        label: "Event signature",
+        type: "text",
+        required: true,
+        help: 'Full Solidity event signature, e.g. "WithdrawInitiated(address,uint256)".'
+      },
+      {
+        key: "eventName",
+        label: "Event name",
+        type: "text",
+        required: true,
+        help: "Human-readable name shown in alerts."
+      },
+      {
+        key: "countThreshold",
+        label: "Count threshold",
+        type: "number",
+        required: true,
+        default: 5,
+        min: 2,
+        help: "Alert when this many events occur within the window."
+      },
+      {
+        key: "windowMinutes",
+        label: "Time window (minutes)",
+        type: "duration",
+        required: true,
+        default: 60,
+        min: 1,
+        help: "Rolling time window in minutes."
+      },
+      {
+        key: "groupByField",
+        label: "Group by parameter",
+        type: "text",
+        required: false,
+        help: 'Optional: decoded event parameter to group counts by (e.g. "to", "sender"). Leave blank for global count.'
+      }
+    ],
+    ruleTemplates: [
+      {
+        type: "windowed-count",
+        config: {
+          eventSignature: "{{eventSignature}}",
+          eventName: "{{eventName}}",
+          groupByField: "{{groupByField}}",
+          windowMinutes: "{{windowMinutes}}",
+          condition: {
+            op: ">=",
+            value: "{{countThreshold}}"
+          }
+        }
+      }
+    ],
+    isActive: true
+  },
+  // -------------------------------------------------------------------------
+  // 15. Event Frequency Spike
+  // -------------------------------------------------------------------------
+  {
+    id: "tpl_event_frequency_spike",
+    slug: "event-frequency-spike",
+    name: "Event Frequency Spike",
+    description: "Alert when an event's firing rate increases by more than X% compared to a baseline period.",
+    category: "custom",
+    icon: "trending-up",
+    severityDefault: "high",
+    tier: "pro",
+    inputs: [
+      {
+        key: "eventSignature",
+        label: "Event signature",
+        type: "text",
+        required: true,
+        help: 'Full Solidity event signature, e.g. "WithdrawInitiated(address,uint256)".'
+      },
+      {
+        key: "eventName",
+        label: "Event name",
+        type: "text",
+        required: true,
+        help: "Human-readable name shown in alerts."
+      },
+      {
+        key: "observationMinutes",
+        label: "Observation window (minutes)",
+        type: "duration",
+        required: true,
+        default: 5,
+        min: 1,
+        help: "Short rolling window to measure current event rate."
+      },
+      {
+        key: "baselineMinutes",
+        label: "Baseline window (minutes)",
+        type: "duration",
+        required: true,
+        default: 60,
+        min: 10,
+        help: "Longer window used to compute the average baseline rate."
+      },
+      {
+        key: "increasePercent",
+        label: "Spike threshold (%)",
+        type: "number",
+        required: true,
+        default: 200,
+        min: 50,
+        help: "Alert when the current rate exceeds the baseline average by at least this percentage."
+      },
+      {
+        key: "minBaselineCount",
+        label: "Minimum baseline events",
+        type: "number",
+        required: true,
+        default: 3,
+        min: 1,
+        help: "Minimum events in the baseline window to avoid false positives from near-zero baselines."
+      },
+      {
+        key: "groupByField",
+        label: "Group by parameter",
+        type: "text",
+        required: false,
+        help: 'Optional: decoded event parameter to group spike detection by (e.g. "to", "sender"). Leave blank for global rate.'
+      }
+    ],
+    ruleTemplates: [
+      {
+        type: "windowed-spike",
+        config: {
+          eventSignature: "{{eventSignature}}",
+          eventName: "{{eventName}}",
+          groupByField: "{{groupByField}}",
+          observationMinutes: "{{observationMinutes}}",
+          baselineMinutes: "{{baselineMinutes}}",
+          increasePercent: "{{increasePercent}}",
+          minBaselineCount: "{{minBaselineCount}}"
+        }
+      }
+    ],
+    isActive: true
+  },
+  // -------------------------------------------------------------------------
+  // 16. Custom Event
+  // -------------------------------------------------------------------------
+  {
+    id: "tpl_custom_event",
+    slug: "custom-event",
+    name: "Custom Event",
+    description: "Watch for any event from the contract ABI. Select the event and optionally add a filter on one of its parameters.",
+    category: "custom",
+    icon: "code",
+    severityDefault: "medium",
+    tier: "free",
+    inputs: [
+      {
+        key: "eventSignature",
+        label: "Event signature",
+        type: "text",
+        required: true,
+        help: 'Full Solidity event signature, e.g. "Transfer(address,address,uint256)".'
+      },
+      {
+        key: "eventName",
+        label: "Event name",
+        type: "text",
+        required: true,
+        help: "Human-readable name shown in alerts."
+      },
+      {
+        key: "filterField",
+        label: "Filter parameter name",
+        type: "text",
+        required: false,
+        help: "Optional: parameter name to filter on."
+      },
+      {
+        key: "filterOp",
+        label: "Filter operator",
+        type: "text",
+        required: false,
+        default: "==",
+        help: "Comparison operator (>, <, >=, <=, ==, !=).",
+        showIf: "filterField"
+      },
+      {
+        key: "filterValue",
+        label: "Filter value",
+        type: "text",
+        required: false,
+        help: "Value to compare the parameter against.",
+        showIf: "filterField"
+      }
+    ],
+    ruleTemplates: [
+      {
+        type: "event-match",
+        config: {
+          eventSignature: "{{eventSignature}}",
+          eventName: "{{eventName}}",
+          filter: {
+            field: "{{filterField}}",
+            op: "{{filterOp}}",
+            value: "{{filterValue}}",
+            skipIfEmpty: true
+          }
+        }
+      }
+    ],
+    isActive: true
+  }
+];
+
+// ../../packages/shared/dist/chains.js
+var ETHEREUM_MAINNET = {
+  id: "ethereum-mainnet",
+  name: "Ethereum Mainnet",
+  slug: "ethereum",
+  chainId: 1,
+  rpcUrl: "https://ethereum-rpc.publicnode.com",
+  blockTimeMs: 12e3,
+  explorerUrl: "https://etherscan.io",
+  explorerApi: "https://api.etherscan.io/api",
+  isActive: true
+};
+var ETHEREUM_SEPOLIA = {
+  id: "ethereum-sepolia",
+  name: "Ethereum Sepolia",
+  slug: "sepolia",
+  chainId: 11155111,
+  rpcUrl: "https://rpc.sepolia.org",
+  blockTimeMs: 12e3,
+  explorerUrl: "https://sepolia.etherscan.io",
+  explorerApi: "https://api-sepolia.etherscan.io/api",
+  isActive: true
+};
+var ARBITRUM_ONE = {
+  id: "arbitrum-one",
+  name: "Arbitrum One",
+  slug: "arbitrum",
+  chainId: 42161,
+  rpcUrl: "https://arb1.arbitrum.io/rpc",
+  blockTimeMs: 250,
+  explorerUrl: "https://arbiscan.io",
+  explorerApi: "https://api.arbiscan.io/api",
+  isActive: true
+};
+var BASE = {
+  id: "base-mainnet",
+  name: "Base",
+  slug: "base",
+  chainId: 8453,
+  rpcUrl: "https://mainnet.base.org",
+  blockTimeMs: 2e3,
+  explorerUrl: "https://basescan.org",
+  explorerApi: "https://api.basescan.org/api",
+  isActive: true
+};
+var POLYGON = {
+  id: "polygon-mainnet",
+  name: "Polygon",
+  slug: "polygon",
+  chainId: 137,
+  rpcUrl: "https://polygon-rpc.com",
+  blockTimeMs: 2e3,
+  explorerUrl: "https://polygonscan.com",
+  explorerApi: "https://api.polygonscan.com/api",
+  isActive: true
+};
+var SUPPORTED_CHAINS = {
+  [ETHEREUM_MAINNET.slug]: ETHEREUM_MAINNET,
+  [ETHEREUM_SEPOLIA.slug]: ETHEREUM_SEPOLIA,
+  [ARBITRUM_ONE.slug]: ARBITRUM_ONE,
+  [BASE.slug]: BASE,
+  [POLYGON.slug]: POLYGON
+};
+var SUPPORTED_CHAINS_LIST = Object.values(SUPPORTED_CHAINS);
+
+// src/ai/system-prompt.ts
+function buildSystemPrompt() {
+  const templateList = MVP_TEMPLATES.map((t) => {
+    const inputs = t.inputs.length > 0 ? t.inputs.map(
+      (i) => `    - ${i.key} (${i.type}${i.required ? ", required" : ", optional"}): ${i.help || i.label}`
+    ).join("\n") : "    (no inputs required)";
+    return `  ${t.slug}: ${t.name}
+    ${t.description}
+    Category: ${t.category} | Default severity: ${t.severityDefault} | Tier: ${t.tier}
+    Inputs:
+${inputs}`;
+  }).join("\n\n");
+  const chainList = SUPPORTED_CHAINS_LIST.map(
+    (c) => `  - ${c.slug} (${c.name}, chain ID ${c.chainId}, network ID "${c.id}")`
+  ).join("\n");
+  return `You are ChainAlert Assistant, an AI that helps users manage blockchain monitoring through natural language.
+
+## What You Can Do
+
+You help users with:
+- Creating, viewing, updating, pausing, resuming, and deleting detections (blockchain monitors)
+- Browsing detection templates to find the right monitoring setup
+- Viewing and analyzing alerts that have been triggered
+- Managing notification channels (Slack, Discord, email, webhook, Telegram, PagerDuty)
+- Resolving and registering smart contracts
+- Viewing blockchain events and storage state changes
+- Configuring custom RPC endpoints
+- Providing general guidance on blockchain monitoring best practices
+
+## Supported Networks
+
+${chainList}
+
+When users mention a chain by name (e.g. "Ethereum", "Arbitrum"), map it to the correct network ID (e.g. "ethereum-mainnet", "arbitrum-one"). For testnets, users must specify explicitly (e.g. "Sepolia" maps to "ethereum-sepolia").
+
+## Detection Templates
+
+These are the available monitoring templates users can activate:
+
+${templateList}
+
+## Key Concepts
+
+- **Detection**: An active monitoring configuration created from a template. It watches a specific contract on a specific network and fires alerts when conditions are met.
+- **Template**: A pre-built detection blueprint. Users pick a template and fill in its inputs (like threshold values, addresses) to create a detection.
+- **Alert**: A notification generated when a detection's rules fire. Alerts have severity levels: info, low, medium, high, critical.
+- **Channel**: A notification destination (Slack, Discord, email, webhook, Telegram, PagerDuty). Detections can be linked to one or more channels.
+- **Event**: A raw on-chain event (e.g. Transfer, Approval) captured by the monitoring pipeline.
+- **State Change**: A change in a monitored storage slot's value, captured by state-polling detections.
+- **Org Contract**: A smart contract registered to the user's organization for easy reference.
+
+## Guidelines
+
+- Be concise and direct. Users are developers who prefer efficient communication.
+- Always use the available tools to fetch real data rather than making assumptions.
+- When creating or modifying resources, summarize what you are about to do so the user can confirm.
+- If a user's request is ambiguous, ask a clarifying question rather than guessing.
+- When listing items, provide the most relevant fields. Do not dump raw JSON unless the user asks for it.
+- For contract addresses, always use the full 0x-prefixed hex format.
+- When suggesting detection templates, explain why a particular template fits the user's needs.
+- If a user asks about something outside blockchain monitoring, politely redirect them.
+- When an operation fails, explain the error clearly and suggest how to fix it.
+- Use network IDs (e.g. "ethereum-mainnet") when calling tools, not chain names or slugs.`;
+}
+
+// src/ai/conversation.ts
+var MAX_MESSAGES = 50;
+var Conversation = class {
+  messages = [];
+  constructor(systemPrompt) {
+    this.messages = [{ role: "system", content: systemPrompt }];
+  }
+  add(message) {
+    this.messages.push(message);
+    this.trim();
+  }
+  getMessages() {
+    return this.messages;
+  }
+  getMessageCount() {
+    return this.messages.length - 1;
+  }
+  clear() {
+    const system = this.messages[0];
+    this.messages = [system];
+  }
+  trim() {
+    if (this.messages.length > MAX_MESSAGES + 1) {
+      const system = this.messages[0];
+      this.messages = [system, ...this.messages.slice(-MAX_MESSAGES)];
+    }
+  }
+};
+
+// src/repl/repl.ts
+async function startRepl() {
+  if (!getApiKey()) {
+    printError("Not authenticated. Run: chainalert login");
+    process.exit(1);
+  }
+  const openai = createOpenAIClient();
+  const conversation = new Conversation(buildSystemPrompt());
+  print(bold("ChainAlert Interactive Mode"));
+  print(
+    dim(
+      "Type your questions in natural language. Use /help for commands, /quit to exit.\n"
+    )
+  );
+  const rl = createInterface({
+    input: process.stdin,
+    output: process.stdout,
+    prompt: cyan("chainalert> ")
+  });
+  rl.prompt();
+  rl.on("line", async (line) => {
+    const input = line.trim();
+    if (!input) {
+      rl.prompt();
+      return;
+    }
+    if (input === "/quit" || input === "/exit") {
+      rl.close();
+      return;
+    }
+    if (input === "/clear") {
+      conversation.clear();
+      print("Conversation cleared.");
+      rl.prompt();
+      return;
+    }
+    if (input === "/help") {
+      printHelp();
+      rl.prompt();
+      return;
+    }
+    if (input === "/history") {
+      print(
+        `Conversation has ${conversation.getMessageCount()} messages (excluding system prompt).`
+      );
+      rl.prompt();
+      return;
+    }
+    conversation.add({ role: "user", content: input });
+    try {
+      let done = false;
+      while (!done) {
+        const response = await openai.chat.completions.create({
+          model: "gpt-4o",
+          messages: conversation.getMessages(),
+          tools,
+          tool_choice: "auto"
+        });
+        const choice = response.choices[0];
+        const message = choice.message;
+        conversation.add(message);
+        if (message.tool_calls && message.tool_calls.length > 0) {
+          for (const toolCall of message.tool_calls) {
+            const args = JSON.parse(toolCall.function.arguments);
+            printDim(`  [calling ${toolCall.function.name}...]`);
+            try {
+              const result = await executeTool(toolCall.function.name, args);
+              conversation.add({
+                role: "tool",
+                tool_call_id: toolCall.id,
+                content: JSON.stringify(result)
+              });
+            } catch (err) {
+              const errorMsg = err.message ?? "Tool execution failed";
+              printError(errorMsg);
+              conversation.add({
+                role: "tool",
+                tool_call_id: toolCall.id,
+                content: JSON.stringify({ error: errorMsg })
+              });
+            }
+          }
+        } else {
+          if (message.content) {
+            print("\n" + message.content + "\n");
+          }
+          done = true;
+        }
+      }
+    } catch (err) {
+      printError(err.message ?? "AI request failed");
+    }
+    rl.prompt();
+  });
+  rl.on("close", () => {
+    print("\nGoodbye!");
+    process.exit(0);
+  });
+}
+function printHelp() {
+  print(bold("\nSlash Commands:"));
+  print("  /help     Show this help message");
+  print("  /clear    Clear conversation history");
+  print("  /history  Show conversation message count");
+  print("  /quit     Exit interactive mode");
+  print("");
+  print(bold("Examples:"));
+  print('  "Show me my active detections"');
+  print(
+    '  "Create a large transfer detection on Ethereum for USDC with threshold 1000000"'
+  );
+  print('  "What detection templates are available?"');
+  print('  "Show my alert stats"');
+  print('  "Set up a Slack channel for notifications"');
+  print('  "Pause detection det_abc123"');
+  print("");
+}
+export {
+  startRepl
+};