@clanker-chain/clanker-cli 2026.9.7-2 → 2026.9.7-4

package/bin/clanker.mjs

@@ -25,6 +25,13 @@ import {
 } from "../lib/identity-query.mjs";
 import { resolveForRead, resolveOperatorKey, resolveReadIdentity } from "../lib/resolve.mjs";
 import { runSetup } from "../lib/setup.mjs";
+import { runDoctor } from "../lib/doctor.mjs";
+import {
+  c,
+  confirmPlan,
+  exitCliError,
+  nextHint,
+} from "../lib/ui.mjs";
 
 function resolveFoundryBinary(name) {
   const home = os.homedir();
@@ -146,16 +153,17 @@ function usage() {
 
 Usage:
   clanker setup [--preset sepolia|local] [--operator <label>] [--address 0x…] [--key-file path] [--force]
+  clanker doctor [--json]
   clanker init --preset sepolia|local [--force]
-  clanker whoami [--json] [--operator <label>] [--address 0x…]
-  clanker operator mint <label> [--json]
-  clanker operator transfer propose <label> <newOwner>
-  clanker operator transfer accept <label>
-  clanker bot mint <label> [operator] [--json]
+  clanker whoami [--json] [--operator <label>] [--address 0x…] [--with-bots]
+  clanker operator mint <label> [--json] [--yes]
+  clanker operator transfer propose <label> <newOwner> [--yes]
+  clanker operator transfer accept <label> [--yes]
+  clanker bot mint <label> [operator] [--json] [--yes]
   clanker bots [--json] [--operator <label>] [--address 0x…]
   clanker bot status <label> [--json]
-  clanker bot revoke <label> [--json]
-  clanker bot rotate <label> <newKeyAddress> [--json]
+  clanker bot revoke <label> [--json] [--yes]
+  clanker bot rotate <label> <newKeyAddress> [--json] [--yes]
   clanker init-openclaw
   clanker chain up|deploy|mint-operator|mint-bot|rotate-bot-key|revoke-bot ...
   clanker check mqtt <bot_id> <operator_id>
@@ -166,11 +174,9 @@ Profile:
   ~/.clanker/operator.json   label + owner + optional key pointer (never raw hex)
   ~/.clanker/keys/           bot keys (also written to ~/.openclaw/keys/)
 
-Humans: prefer \`clanker setup\` (detects Foundry/OpenClaw hints, writes profile).
-Key resolution (mutating commands):
-  --key > --key-file > OPERATOR_PRIVATE_KEY > profile keyFile > profile env
-  Anvil account #0 is allowed only on localhost RPC.
-  Reads (whoami/bots) can use profile owner without a signing key.
+Humans: \`clanker setup\` then \`clanker doctor\` / \`whoami\`.
+Mutates print a plan and confirm unless --yes or --json.
+whoami is fast by default; pass --with-bots to enrich child bots (or use \`clanker bots\`).
 
 See docs/operator-cli.md.
 `);
@@ -223,10 +229,14 @@ async function cmdWhoami(argv) {
     source = resolved.source;
     network = resolved.network;
   } catch (err) {
-    console.error(err.message);
-    process.exit(1);
+    exitCliError({
+      error: err.message,
+      because: "whoami needs an owner address from --address, a key, or operator.json",
+      try: ["clanker setup", "clanker doctor", "clanker whoami --address 0x…"],
+    });
   }
 
+  const withBots = hasFlag(argv, "--with-bots");
   const pub = await publicClientFromRpc(network.rpc);
   const preferred =
     flagValue(argv, "--operator") ?? loadOperator(network.home)?.label ?? null;
@@ -239,9 +249,14 @@ async function cmdWhoami(argv) {
       owner: getAddress(address),
     });
     if (resolved.error) {
-      const err = new Error(resolved.error);
-      err.candidates = resolved.candidates;
-      throw err;
+      exitCliError({
+        error: resolved.error,
+        because: "preferred operator label did not match this owner on-chain",
+        try: [
+          "clanker whoami --address 0x…",
+          "clanker setup --force   # fix label/owner",
+        ],
+      });
     }
     selected = [resolved.operator];
   } else {
@@ -252,12 +267,14 @@ async function cmdWhoami(argv) {
     });
   }
 
-  for (const op of selected) {
-    op.bots = await findBotsByOperator(pub, {
-      registry: network.registry,
-      operatorId: op.id,
-      fromBlock: network.fromBlock,
-    });
+  if (withBots) {
+    for (const op of selected) {
+      op.bots = await findBotsByOperator(pub, {
+        registry: network.registry,
+        operatorId: op.id,
+        fromBlock: network.fromBlock,
+      });
+    }
   }
 
   const data = {
@@ -273,18 +290,26 @@ async function cmdWhoami(argv) {
       active: o.active,
       registeredAt: o.registeredAt.toString(),
       revokedAt: o.revokedAt.toString(),
-      bots: (o.bots ?? []).map((b) => ({
-        label: b.label,
-        botKey: b.botKey,
-        active: b.active,
-        registeredAt: b.registeredAt.toString(),
-        revokedAt: b.revokedAt.toString(),
-      })),
+      bots: withBots
+        ? (o.bots ?? []).map((b) => ({
+            label: b.label,
+            botKey: b.botKey,
+            active: b.active,
+            registeredAt: b.registeredAt.toString(),
+            revokedAt: b.revokedAt.toString(),
+          }))
+        : [],
     })),
   };
 
   if (hasFlag(argv, "--json")) printJson(data);
-  else printHumanWhoami(data);
+  else {
+    printHumanWhoami(data);
+    if (!withBots && data.operators.length) {
+      console.log(c.dim("(bots omitted — pass --with-bots or run clanker bots)"));
+    }
+    nextHint(["clanker bots", "clanker doctor"]);
+  }
 }
 
 async function cmdBots(argv) {
@@ -362,12 +387,23 @@ async function main() {
     try {
       await runSetup(rest);
     } catch (err) {
-      console.error(err.message);
-      process.exit(1);
+      exitCliError({
+        error: err.message,
+        because: "setup could not write a valid local profile",
+        try: [
+          "clanker setup --preset sepolia --operator org.you --address 0x… --yes --force",
+          "clanker doctor",
+        ],
+      });
     }
     return;
   }
 
+  if (cmd === "doctor") {
+    const { exitCode } = await runDoctor(rest);
+    process.exit(exitCode);
+  }
+
   if (cmd === "init") {
     const preset = flagValue(rest, "--preset") ?? rest.find((a) => !a.startsWith("--"));
     if (!preset || preset === "init") {
@@ -414,13 +450,38 @@ async function main() {
         console.error("Usage: clanker operator mint <label>");
         process.exit(1);
       }
+      let planRows;
+      try {
+        const preview = resolveOperatorKey(flags);
+        planRows = [
+          ["action", "registerOperator"],
+          ["label", label],
+          ["owner", preview.address],
+          ["rpc", preview.network.rpc],
+          ["registry", preview.network.registry ?? "(none)"],
+          ["key", preview.source],
+        ];
+      } catch (err) {
+        exitCliError({
+          error: err.message,
+          because: "operator mint needs a signing key on this network",
+          try: [
+            "export OPERATOR_PRIVATE_KEY=0x…",
+            "clanker operator mint " + label + " --key-file ~/.clanker/op.key --yes",
+            "clanker doctor",
+          ],
+        });
+      }
+      const ok = await confirmPlan(flags, planRows, `Mint operator ${label}?`);
+      if (!ok) process.exit(0);
       const result = await chainMintOperator(label, flags);
       if (hasFlag(flags, "--json") || hasFlag(opArgv, "--json")) printJson(result);
       else {
-        console.log(`Minted operator ${label}`);
+        console.log(c.green(`Minted operator ${label}`));
         console.log(`owner: ${result.owner}`);
         console.log(`tx:    ${result.tx}`);
         console.log(`Wrote ~/.clanker/operator.json`);
+        nextHint([`clanker bot mint <bot_label>`, "clanker whoami"]);
       }
       return;
     }
@@ -432,9 +493,23 @@ async function main() {
           console.error("Usage: clanker operator transfer propose <label> <newOwner>");
           process.exit(1);
         }
+        const ok = await confirmPlan(
+          flags,
+          [
+            ["action", "proposeOperatorTransfer"],
+            ["label", label],
+            ["newOwner", getAddress(newOwner)],
+          ],
+          `Propose transfer of ${label}?`,
+        );
+        if (!ok) process.exit(0);
         const result = await chainProposeOperatorTransfer(label, getAddress(newOwner), flags);
         if (hasFlag(flags, "--json")) printJson(result);
-        else console.log(`Proposed transfer of ${label} → ${newOwner}\ntx: ${result.tx}`);
+        else {
+          console.log(c.green(`Proposed transfer of ${label} → ${newOwner}`));
+          console.log(`tx: ${result.tx}`);
+          nextHint([`clanker operator transfer accept ${label}   # as new owner`]);
+        }
         return;
       }
       if (action === "accept") {
@@ -442,9 +517,23 @@ async function main() {
           console.error("Usage: clanker operator transfer accept <label>");
           process.exit(1);
         }
+        const ok = await confirmPlan(
+          flags,
+          [
+            ["action", "acceptOperatorTransfer"],
+            ["label", label],
+          ],
+          `Accept transfer of ${label}?`,
+        );
+        if (!ok) process.exit(0);
         const result = await chainAcceptOperatorTransfer(label, flags);
         if (hasFlag(flags, "--json")) printJson(result);
-        else console.log(`Accepted transfer of ${label}\nowner: ${result.owner}\ntx: ${result.tx}`);
+        else {
+          console.log(c.green(`Accepted transfer of ${label}`));
+          console.log(`owner: ${result.owner}`);
+          console.log(`tx: ${result.tx}`);
+          nextHint(["clanker whoami", "clanker bots"]);
+        }
         return;
       }
       console.error("Usage: clanker operator transfer propose|accept ...");
@@ -484,20 +573,45 @@ async function main() {
       }
       let operatorLabel = operatorArg ?? flagValue(flags, "--operator") ?? null;
       if (!operatorLabel) {
-        const { address, network } = resolveOperatorKey(flags);
-        const inferred = await resolveOperatorLabel(flags, address, network);
-        operatorLabel = inferred.label;
+        try {
+          const { address, network } = resolveOperatorKey(flags);
+          const inferred = await resolveOperatorLabel(flags, address, network);
+          operatorLabel = inferred.label;
+        } catch (err) {
+          exitCliError({
+            error: err.message,
+            because: "bot mint needs an operator label or a resolvable signing key",
+            try: [
+              `clanker bot mint ${botLabel} <operator_label> --yes`,
+              "clanker setup",
+            ],
+          });
+        }
       }
+      const ok = await confirmPlan(
+        flags,
+        [
+          ["action", "registerBot"],
+          ["bot", botLabel],
+          ["operator", operatorLabel],
+        ],
+        `Mint bot ${botLabel} under ${operatorLabel}?`,
+      );
+      if (!ok) process.exit(0);
       const result = await chainMintBot(botLabel, operatorLabel, flags);
       if (hasFlag(flags, "--json")) printJson(result);
       else {
-        console.log(`Minted bot ${botLabel} under ${operatorLabel}`);
+        console.log(c.green(`Minted bot ${botLabel} under ${operatorLabel}`));
         console.log(`botKey:   ${result.bot_key}`);
         console.log(`key file: ${result.key_path}`);
         console.log(`also:     ${result.clanker_key_path}`);
         console.log(`tx:       ${result.tx}`);
         console.log("\nchannels.mqtt stub:");
         console.log(JSON.stringify(result.channels_mqtt, null, 2));
+        nextHint([
+          "Paste channels.mqtt into openclaw.json",
+          "openclaw plugins install @clanker-chain/mqtt-channel-plugin@…",
+        ]);
       }
       return;
     }
@@ -508,9 +622,22 @@ async function main() {
         console.error("Usage: clanker bot revoke <label>");
         process.exit(1);
       }
+      const ok = await confirmPlan(
+        flags,
+        [
+          ["action", "revokeBot"],
+          ["bot", botLabel],
+        ],
+        `Revoke bot ${botLabel}?`,
+      );
+      if (!ok) process.exit(0);
       const result = await chainRevokeBot(botLabel, flags);
       if (hasFlag(flags, "--json")) printJson(result);
-      else console.log(`Revoked ${botLabel}\ntx: ${result.tx}`);
+      else {
+        console.log(c.yellow(`Revoked ${botLabel}`));
+        console.log(`tx: ${result.tx}`);
+        nextHint(["clanker bots", "clanker bot status " + botLabel]);
+      }
       return;
     }
 
@@ -520,9 +647,23 @@ async function main() {
         console.error("Usage: clanker bot rotate <label> <newKeyAddress>");
         process.exit(1);
       }
+      const ok = await confirmPlan(
+        flags,
+        [
+          ["action", "rotateBotKey"],
+          ["bot", botLabel],
+          ["newKey", getAddress(newKey)],
+        ],
+        `Rotate key for ${botLabel}?`,
+      );
+      if (!ok) process.exit(0);
       const result = await chainRotateBotKey(botLabel, getAddress(newKey), flags);
       if (hasFlag(flags, "--json")) printJson(result);
-      else console.log(`Rotated ${botLabel} → ${newKey}\ntx: ${result.tx}`);
+      else {
+        console.log(c.green(`Rotated ${botLabel} → ${newKey}`));
+        console.log(`tx: ${result.tx}`);
+        nextHint(["Update ~/.openclaw/keys/" + botLabel + ".key", "clanker bot status " + botLabel]);
+      }
       return;
     }
 

package/lib/doctor.mjs

@@ -0,0 +1,185 @@
+/**
+ * `clanker doctor` — local readiness checks (mise-doctor habit).
+ */
+
+import { getAddress } from "viem";
+import {
+  ANVIL_DEFAULT_ADDRESS,
+  isLocalRpc,
+  loadConfig,
+  loadOperator,
+  clankerHome,
+} from "./profile.mjs";
+import { detectSetupHints, formatSetupDetectTable } from "./setup-detect.mjs";
+import { c, nextHint } from "./ui.mjs";
+
+/**
+ * @param {{ home?: string, env?: NodeJS.ProcessEnv, openclawDir?: string, castBin?: string, spawn?: Function }} [opts]
+ */
+export function runDoctorChecks(opts = {}) {
+  const env = opts.env ?? process.env;
+  const home = opts.home ?? clankerHome(env);
+  const hints = detectSetupHints({
+    home,
+    env,
+    openclawDir: opts.openclawDir,
+    castBin: opts.castBin,
+    spawn: opts.spawn,
+  });
+  const config = hints.config ?? loadConfig(home);
+  const operator = hints.operator ?? loadOperator(home);
+
+  /** @type {{ id: string, ok: boolean, level: 'pass'|'warn'|'fail', message: string }[]} */
+  const checks = [];
+
+  checks.push({
+    id: "config",
+    ok: Boolean(config),
+    level: config ? "pass" : "fail",
+    message: config
+      ? `config.json present (preset=${config.preset})`
+      : "config.json missing — run clanker setup",
+  });
+
+  const registry = config?.registryAddress;
+  const rpc = config?.chainRpcUrl ?? "";
+  checks.push({
+    id: "registry",
+    ok: Boolean(registry && /^0x[0-9a-fA-F]{40}$/.test(registry)),
+    level: registry && /^0x[0-9a-fA-F]{40}$/.test(registry) ? "pass" : "fail",
+    message:
+      registry && /^0x[0-9a-fA-F]{40}$/.test(registry)
+        ? `registry ${registry}`
+        : "registry missing — run clanker setup --preset sepolia (or set after local deploy)",
+  });
+
+  const hasOwner =
+    Boolean(operator?.owner) && /^0x[0-9a-fA-F]{40}$/.test(operator.owner);
+  const hasLabel = Boolean(operator?.label);
+  checks.push({
+    id: "operator",
+    ok: hasOwner && hasLabel,
+    level: hasOwner && hasLabel ? "pass" : "fail",
+    message:
+      hasOwner && hasLabel
+        ? `operator.json ${operator.label} · ${operator.owner}`
+        : "operator.json incomplete — run clanker setup",
+  });
+
+  if (hasOwner && rpc && !isLocalRpc(rpc)) {
+    const anvil =
+      getAddress(operator.owner).toLowerCase() ===
+      ANVIL_DEFAULT_ADDRESS.toLowerCase();
+    checks.push({
+      id: "anvil_public",
+      ok: !anvil,
+      level: anvil ? "fail" : "pass",
+      message: anvil
+        ? "owner is Anvil #0 on a public RPC — refuse for mutate; fix owner address"
+        : "owner is not Anvil #0",
+    });
+  }
+
+  const hasKey =
+    Boolean(operator?.key?.type === "keyFile" && operator.key.value) ||
+    Boolean(operator?.key?.type === "env" && operator.key.value) ||
+    Boolean(env.OPERATOR_PRIVATE_KEY);
+  checks.push({
+    id: "signing",
+    ok: true,
+    level: hasKey ? "pass" : "warn",
+    message: hasKey
+      ? "signing key pointer available (mint/revoke OK)"
+      : "read-only profile — whoami/bots OK; mint needs --key-file or OPERATOR_PRIVATE_KEY",
+  });
+
+  checks.push({
+    id: "foundry",
+    ok: true,
+    level: hints.foundryAvailable ? "pass" : "warn",
+    message: hints.foundryAvailable
+      ? `Foundry cast OK (${hints.foundryAccounts.length} account(s))`
+      : "Foundry cast not on PATH (optional)",
+  });
+
+  const readyWhoami = checks
+    .filter((ch) => ch.id === "config" || ch.id === "registry" || ch.id === "operator")
+    .every((ch) => ch.ok);
+  const readyMint = readyWhoami && hasKey &&
+    !checks.some((ch) => ch.id === "anvil_public" && !ch.ok);
+
+  return {
+    home,
+    hints,
+    checks,
+    readyWhoami,
+    readyMint,
+    ok: readyWhoami,
+  };
+}
+
+/**
+ * @param {string[]} argv
+ * @param {{ home?: string, env?: NodeJS.ProcessEnv }} [opts]
+ * @returns {Promise<{ exitCode: number, report: object }>}
+ */
+export async function runDoctor(argv = [], opts = {}) {
+  const json = argv.includes("--json");
+  const report = runDoctorChecks(opts);
+
+  if (json) {
+    console.log(
+      JSON.stringify(
+        {
+          ok: report.ok,
+          readyWhoami: report.readyWhoami,
+          readyMint: report.readyMint,
+          home: report.home,
+          checks: report.checks,
+        },
+        null,
+        2,
+      ),
+    );
+    return { exitCode: report.ok ? 0 : 1, report };
+  }
+
+  console.log(c.bold("clanker doctor"));
+  console.log("");
+  console.log(formatSetupDetectTable(report.hints));
+  console.log("");
+  console.log(c.bold("Checks"));
+  for (const ch of report.checks) {
+    const mark =
+      ch.level === "pass"
+        ? c.green("pass")
+        : ch.level === "warn"
+          ? c.yellow("warn")
+          : c.red("fail");
+    console.log(`  [${mark}] ${ch.message}`);
+  }
+  console.log("");
+  if (report.readyWhoami) {
+    console.log(c.green("Ready for: clanker whoami"));
+  } else {
+    console.log(c.red("Not ready for whoami"));
+  }
+  if (report.readyMint) {
+    console.log(c.green("Ready for: clanker operator mint / bot mint"));
+  } else {
+    console.log(c.dim("Mint/revoke: need signing key (and non-Anvil owner on public RPC)"));
+  }
+
+  if (!report.readyWhoami) {
+    nextHint(["clanker setup"]);
+  } else if (!report.readyMint) {
+    nextHint([
+      "clanker whoami",
+      "clanker setup --key-file ~/.clanker/op.key --force   # to enable mint",
+    ]);
+  } else {
+    nextHint(["clanker whoami", "clanker bots"]);
+  }
+
+  return { exitCode: report.ok ? 0 : 1, report };
+}

package/lib/profile.mjs

@@ -17,11 +17,14 @@ export const ANVIL_DEFAULT_ADDRESS = "0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266
 export const SEPOLIA_REGISTRY = "0xD650467f9D7A20f37E55ec23Ca1c711598f97958";
 
 /**
- * Safe floor for Sepolia getLogs (before registry deploy). Documented so scans
- * stay cheap; bump only if you redeploy the registry earlier.
+ * Safe floor for Sepolia getLogs (before registry deploy). Use for full historical
+ * scans via --from-block; default preset uses the faster public-RPC floor below.
  */
 export const SEPOLIA_FROM_BLOCK = 35_000_000n;
 
+/** Default Sepolia fromBlock for public RPC (faster whoami/bots scans). */
+export const SEPOLIA_FAST_FROM_BLOCK = 46_000_000n;
+
 export const PRESETS = {
   local: {
     preset: "local",
@@ -37,7 +40,7 @@ export const PRESETS = {
     chainRpcUrl: "https://sepolia.base.org",
     brokerUrl: "mqtts://mqtt.clanker-chain.com:8883",
     mqttAuthServiceUrl: "https://mqtt-auth.clanker-chain.com",
-    fromBlock: SEPOLIA_FROM_BLOCK,
+    fromBlock: SEPOLIA_FAST_FROM_BLOCK,
   },
 };
 
@@ -187,7 +190,7 @@ export function resolveNetwork(argv = [], opts = {}) {
   }
 
   if (fromBlock == null) {
-    fromBlock = isLocalRpc(rpc) ? 0n : SEPOLIA_FROM_BLOCK;
+    fromBlock = isLocalRpc(rpc) ? 0n : SEPOLIA_FAST_FROM_BLOCK;
   }
 
   return {

package/lib/setup-detect.mjs

@@ -12,11 +12,11 @@ import {
   loadConfig,
   loadOperator,
   openclawKeysDir,
+  SEPOLIA_FAST_FROM_BLOCK,
 } from "./profile.mjs";
 import { normalizePrivateKey } from "./resolve.mjs";
 
-/** Faster Sepolia log floor for public RPC (registry floor remains SEPOLIA_FROM_BLOCK). */
-export const SEPOLIA_FAST_FROM_BLOCK = 46_000_000n;
+export { SEPOLIA_FAST_FROM_BLOCK };
 
 /**
  * Parse `cast wallet list` stdout into account names.
@@ -134,3 +134,91 @@ export function detectSetupHints(opts = {}) {
     anvilDefaultAddress: ANVIL_DEFAULT_ADDRESS,
   };
 }
+
+/**
+ * Pad string to width (truncate with … if longer).
+ * @param {string} s
+ * @param {number} width
+ */
+function cell(s, width) {
+  const t = String(s ?? "");
+  if (t.length === width) return t;
+  if (t.length < width) return t + " ".repeat(width - t.length);
+  if (width <= 1) return "…";
+  return `${t.slice(0, width - 1)}…`;
+}
+
+/**
+ * Render detection hints as an aligned two-column table for the terminal.
+ * @param {ReturnType<typeof detectSetupHints>} hints
+ * @returns {string}
+ */
+export function formatSetupDetectTable(hints) {
+  /** @type {[string, string][]} */
+  const rows = [];
+  rows.push(["Profile dir", hints.home]);
+
+  if (hints.hasConfig) {
+    rows.push(["config.json", `present · preset=${hints.config?.preset ?? "?"}`]);
+    rows.push([
+      "registry",
+      hints.config?.registryAddress ? String(hints.config.registryAddress) : "(none)",
+    ]);
+  } else {
+    rows.push(["config.json", "missing · will create"]);
+  }
+
+  if (hints.hasOperator) {
+    rows.push([
+      "operator.json",
+      `present · ${hints.operator?.label ?? "?"} · ${hints.operator?.owner ?? "?"}`,
+    ]);
+  } else {
+    rows.push(["operator.json", "missing · needed for whoami"]);
+  }
+
+  if (hints.foundryAvailable && hints.foundryAccounts.length) {
+    rows.push([
+      "Foundry accounts",
+      `${hints.foundryAccounts.length}: ${hints.foundryAccounts.join(", ")}`,
+    ]);
+  } else if (hints.foundryAvailable) {
+    rows.push(["Foundry accounts", "none listed"]);
+  } else {
+    rows.push(["Foundry cast", "not on PATH"]);
+  }
+
+  if (hints.openclawBots.length) {
+    rows.push([
+      "OpenClaw bot keys",
+      `${hints.openclawBots.length} files (bot signing only)`,
+    ]);
+    for (const b of hints.openclawBots) {
+      rows.push(["  ·", b]);
+    }
+  } else {
+    rows.push(["OpenClaw bot keys", "none"]);
+  }
+
+  if (hints.hasOperatorPrivateKeyEnv) {
+    rows.push([
+      "OPERATOR_PRIVATE_KEY",
+      hints.envAddress ? `set · ${hints.envAddress}` : "set · (invalid)",
+    ]);
+  } else {
+    rows.push(["OPERATOR_PRIVATE_KEY", "unset"]);
+  }
+
+  const col0 = Math.min(
+    22,
+    Math.max(4, ...rows.map(([k]) => k.length)),
+  );
+  const lines = [
+    `${cell("What", col0)}  Value`,
+    `${"-".repeat(col0)}  ${"-".repeat(48)}`,
+  ];
+  for (const [k, v] of rows) {
+    lines.push(`${cell(k, col0)}  ${v}`);
+  }
+  return lines.join("\n");
+}