@etherscan-npm/cli 1.0.1 → 1.0.3

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 Etherscan
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 Etherscan
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -54,6 +54,8 @@ npx @etherscan-npm/cli version
 
 The npm package downloads the matching native release archive and verifies its SHA-256 checksum during installation. Lifecycle scripts must be enabled.
 
+> The package is currently published as `@etherscan-npm/cli` while the `@etherscan` npm scope is being transferred. The `etherscan` command is unchanged.
+
 ### Installation script — macOS and Linux
 
 ```sh
@@ -92,6 +94,30 @@ Ensure your Go binary directory (`GOBIN`, or `GOPATH/bin` by default) is on `PAT
 
 Download the archive for your operating system and architecture plus `checksums.txt` from [GitHub Releases](https://github.com/etherscan/etherscan-cli/releases/latest). Verify the archive's SHA-256 checksum, extract it, and place `etherscan` (or `etherscan.exe`) on your `PATH`.
 
+## Uninstall
+
+Run:
+
+```sh
+etherscan uninstall
+```
+
+The command shows the exact package-manager action or executable and configuration paths before asking for confirmation. Use `--yes` to skip the prompt. Homebrew and npm installations are removed through their owning package manager. Installer, Go, manual, and source builds remove only the exact running executable; custom directories and `PATH` entries are left alone unless the installer recorded that it added them and the directory contains no other files.
+
+The command never requests administrator privileges. If a manually copied binary is in a protected location, it leaves the saved configuration intact and prints the exact command needed to remove the binary. Manually created aliases or separate symlinks may also need to be removed by hand.
+
+The installer scripts can remove a script installation without downloading a release archive:
+
+```sh
+curl -fsSL https://raw.githubusercontent.com/etherscan/etherscan-cli/master/scripts/install.sh | sh -s -- --uninstall
+```
+
+```powershell
+& ([scriptblock]::Create((irm https://raw.githubusercontent.com/etherscan/etherscan-cli/master/scripts/install.ps1))) -Uninstall
+```
+
+Uninstall removes the saved configuration directory. If `ETHERSCAN_API_KEY` is set, unset it separately in the shell or environment where it is defined.
+
 ## Get started
 
 ### 1. Create an API key
@@ -141,7 +167,7 @@ Run `etherscan tui` to open the full-screen endpoint explorer:
 etherscan tui
 ```
 
-The explorer can be opened before authentication and asks you to validate and save a key when you submit an API-backed endpoint. Running `etherscan` with no command prints the Quick Start guide.
+The explorer can be opened before authentication and asks you to validate and save a key when you submit an API-backed endpoint. It is read-only; source and proxy verification submissions remain available through the traditional commands. Running `etherscan` with no command prints the Quick Start guide.
 
 ## Practical workflows
 
@@ -166,6 +192,33 @@ etherscan contract getabi 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2
 etherscan contract getsourcecode 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2
 ```
 
+### Verify a contract
+
+Verification lives in its own command group, `etherscan contractverification`, so that `etherscan contract` stays purely for reading on-chain contract data. Both groups call the same `contract` API module.
+
+Use `--file` for Solidity, Abstract zkSync-stack, or Vyper source payloads. Stylus verification takes a public Git repository URL instead.
+
+```sh
+# Solidity standard JSON
+etherscan contractverification verify 0xYourContract --file input.json --codeformat solidity-standard-json-input --contractname contracts/Verified.sol:Verified --compilerversion v0.8.24+commit.e11b9ed9
+
+# Abstract uses the zkSync compiler stack (Abstract Mainnet and Sepolia only)
+etherscan --chain abstract contractverification verify-zksync 0xYourContract --file input.json --codeformat solidity-standard-json-input --contractname contracts/Verified.sol:Verified --compilerversion v0.8.24+commit.e11b9ed9 --zksolc-version v1.5.7
+
+# Vyper JSON verification, and Stylus repository verification (Arbitrum One and Sepolia only)
+etherscan contractverification verify-vyper 0xYourContract --file input.json --contractname contracts/Verified.vy:Verified --compilerversion vyper:0.4.0 --optimization-used 0
+etherscan --chain arbitrum contractverification verify-stylus 0xYourContract --source-code https://github.com/example/project --contractname project --compilerversion stylus:0.5.3 --license-type 3
+```
+
+Each submission returns a GUID. Poll it with `check-status` for source verification, or `check-proxy` for a proxy submission:
+
+```sh
+etherscan contractverification check-status <guid>
+etherscan contractverification check-proxy <guid>
+```
+
+Constructor arguments may be supplied as bare ABI-encoded hex or with a `0x` prefix; the CLI sends the documented bare form. Verification source files are limited to 3,000,000 bytes. Run any verification command with `--help` for its exact options.
+
 ### Switch chains
 
 ```sh
@@ -207,7 +260,7 @@ Every command includes built-in parameter and usage help:
 ```sh
 etherscan --help
 etherscan account txlist --help
-etherscan contract verify --help
+etherscan contractverification verify --help
 ```
 
 <details>
@@ -221,7 +274,7 @@ etherscan contract verify --help
 | `etherscan tui` | Launch the interactive explorer |
 | `etherscan login` | Validate and store an API key |
 | `etherscan logout` | Remove the stored API key |
-| `etherscan uninstall` | Remove all CLI configuration |
+| `etherscan uninstall` | Remove the CLI and saved configuration |
 | `etherscan update` | Update a Homebrew or installer-script installation |
 | `etherscan whoami` | Show the active chain and masked API key |
 | `etherscan config` | Get, list, or set CLI configuration |
@@ -262,10 +315,20 @@ etherscan contract verify --help
 | `etherscan contract getabi` | Get a verified contract's ABI | [getabi](https://docs.etherscan.io/api-reference/endpoint/getabi.md) |
 | `etherscan contract getsourcecode` | Get verified source code and contract metadata | [getsourcecode](https://docs.etherscan.io/api-reference/endpoint/getsourcecode.md) |
 | `etherscan contract getcontractcreation` | Get creator and creation transaction data for contracts | [getcontractcreation](https://docs.etherscan.io/api-reference/endpoint/getcontractcreation.md) |
-| `etherscan contract verify` | Submit contract source code for verification | [verifysourcecode](https://docs.etherscan.io/api-reference/endpoint/verifysourcecode.md) |
-| `etherscan contract verify-status` | Check a source verification submission | [checkverifystatus](https://docs.etherscan.io/api-reference/endpoint/checkverifystatus.md) |
-| `etherscan contract verify-proxy` | Submit a proxy contract for verification | [verifyproxycontract](https://docs.etherscan.io/api-reference/endpoint/verifyproxycontract.md) |
-| `etherscan contract check-proxy` | Check a proxy verification submission | [checkproxyverification](https://docs.etherscan.io/api-reference/endpoint/checkproxyverification.md) |
+
+### Contract verification
+
+Grouped separately from the contract data commands above. All of these call the `contract` API module.
+
+| Command | Description | API docs |
+| --- | --- | --- |
+| `etherscan contractverification verify` | Submit Solidity source code for verification | [verifysourcecode](https://docs.etherscan.io/api-reference/endpoint/verifysourcecode.md) |
+| `etherscan contractverification verify-zksync` | Submit zkSync-stack source code on Abstract | [verifyzksyncsourcecode](https://docs.etherscan.io/api-reference/endpoint/verifyzksyncsourcecode.md) |
+| `etherscan contractverification verify-vyper` | Submit Vyper source code for verification | [verifyvyper](https://docs.etherscan.io/api-reference/endpoint/verifyvyper.md) |
+| `etherscan contractverification verify-stylus` | Submit Stylus source code for verification | [verifystylus](https://docs.etherscan.io/api-reference/endpoint/verifystylus.md) |
+| `etherscan contractverification verify-proxy` | Submit a proxy contract for verification | [verifyproxycontract](https://docs.etherscan.io/api-reference/endpoint/verifyproxycontract.md) |
+| `etherscan contractverification check-status` | Check a source verification submission | [checkverifystatus](https://docs.etherscan.io/api-reference/endpoint/checkverifystatus.md) |
+| `etherscan contractverification check-proxy` | Check a proxy verification submission | [checkproxyverification](https://docs.etherscan.io/api-reference/endpoint/checkproxyverification.md) |
 
 ### Transaction
 

package/npm/bin/etherscan.js

@@ -5,6 +5,7 @@
 const fs = require("node:fs");
 const path = require("node:path");
 const { spawnSync } = require("node:child_process");
+const packageInfo = require("../../package.json");
 
 const packageRoot = path.resolve(__dirname, "..", "..");
 const executable = path.join(
@@ -26,6 +27,8 @@ const result = spawnSync(executable, process.argv.slice(2), {
   env: {
     ...process.env,
     ETHERSCAN_INSTALL_METHOD: "npm",
+    ETHERSCAN_NPM_PACKAGE: packageInfo.name,
+    ETHERSCAN_NPM_WRAPPER_PID: String(process.pid),
   },
 });
 

package/npm/postinstall.js

@@ -1,58 +1,58 @@
-"use strict";
-
-const fs = require("node:fs");
-const path = require("node:path");
-const { spawnSync } = require("node:child_process");
-const packageInfo = require("../package.json");
-
-const packageRoot = path.resolve(__dirname, "..");
-const installDir = path.join(packageRoot, "vendor");
-const version = `v${packageInfo.version}`;
-
-let command;
-let args;
-if (process.platform === "win32") {
-  command = "powershell.exe";
-  args = [
-    "-NoLogo",
-    "-NoProfile",
-    "-NonInteractive",
-    "-ExecutionPolicy",
-    "Bypass",
-    "-File",
-    path.join(packageRoot, "scripts", "install.ps1"),
-    "-Version",
-    version,
-    "-InstallDir",
-    installDir,
-    "-NoPathUpdate",
-  ];
-} else {
-  command = "sh";
-  args = [
-    path.join(packageRoot, "scripts", "install.sh"),
-    "--version",
-    version,
-    "--install-dir",
-    installDir,
-    "--no-path-update",
-  ];
-}
-
-const result = spawnSync(command, args, { stdio: "inherit", env: process.env });
-if (result.error) {
-  console.error(`Unable to run the Etherscan CLI installer: ${result.error.message}`);
-  process.exit(1);
-}
-if (result.status !== 0) {
-  process.exit(result.status === null ? 1 : result.status);
-}
-
-const executable = path.join(
-  installDir,
-  process.platform === "win32" ? "etherscan.exe" : "etherscan",
-);
-if (!fs.existsSync(executable)) {
-  console.error(`The installer did not create ${executable}.`);
-  process.exit(1);
-}
+"use strict";
+
+const fs = require("node:fs");
+const path = require("node:path");
+const { spawnSync } = require("node:child_process");
+const packageInfo = require("../package.json");
+
+const packageRoot = path.resolve(__dirname, "..");
+const installDir = path.join(packageRoot, "vendor");
+const version = `v${packageInfo.version}`;
+
+let command;
+let args;
+if (process.platform === "win32") {
+  command = "powershell.exe";
+  args = [
+    "-NoLogo",
+    "-NoProfile",
+    "-NonInteractive",
+    "-ExecutionPolicy",
+    "Bypass",
+    "-File",
+    path.join(packageRoot, "scripts", "install.ps1"),
+    "-Version",
+    version,
+    "-InstallDir",
+    installDir,
+    "-NoPathUpdate",
+  ];
+} else {
+  command = "sh";
+  args = [
+    path.join(packageRoot, "scripts", "install.sh"),
+    "--version",
+    version,
+    "--install-dir",
+    installDir,
+    "--no-path-update",
+  ];
+}
+
+const result = spawnSync(command, args, { stdio: "inherit", env: process.env });
+if (result.error) {
+  console.error(`Unable to run the Etherscan CLI installer: ${result.error.message}`);
+  process.exit(1);
+}
+if (result.status !== 0) {
+  process.exit(result.status === null ? 1 : result.status);
+}
+
+const executable = path.join(
+  installDir,
+  process.platform === "win32" ? "etherscan.exe" : "etherscan",
+);
+if (!fs.existsSync(executable)) {
+  console.error(`The installer did not create ${executable}.`);
+  process.exit(1);
+}

package/npm/prepublish-check.js

@@ -1,15 +1,81 @@
-"use strict";
-
-const packageInfo = require("../package.json");
-
-try {
-  if (packageInfo.version === "0.0.0-development") {
-    throw new Error("the development placeholder version cannot be published");
-  }
-  if (!/^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(packageInfo.version)) {
-    throw new Error(`invalid release version: ${packageInfo.version}`);
-  }
-} catch (error) {
-  console.error(`Refusing to publish @etherscan/cli: ${error.message}`);
-  process.exit(1);
-}
+"use strict";
+
+const fs = require("node:fs");
+const path = require("node:path");
+const packageInfo = require("../package.json");
+
+const versionPattern =
+  /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+
+// npm treats these as glob metacharacters in package.json "files".
+const globPattern = /[*?[\]{}]/;
+
+function checkVersion(version) {
+  if (version === "0.0.0-development") {
+    throw new Error("the development placeholder version cannot be published");
+  }
+  if (!versionPattern.test(version)) {
+    throw new Error(`invalid release version: ${version}`);
+  }
+}
+
+// `npm pack` copies the working tree, not the committed blobs. On Windows a
+// checkout with core.autocrlf=true turns the LF blobs into CRLF, and a CRLF
+// scripts/install.sh cannot be run by /bin/sh on Linux or macOS, which is how
+// @etherscan-npm/cli@1.0.1 shipped an installer that failed on both.
+function checkFileLineEndings(filePath, label) {
+  const contents = fs.readFileSync(filePath);
+  // Skip binaries using the same NUL-byte heuristic git applies for text=auto.
+  if (contents.includes(0x00)) {
+    return;
+  }
+  if (contents.includes(0x0d)) {
+    throw new Error(`${label} contains CRLF line endings`);
+  }
+}
+
+// Checks the literal entries of package.json "files". This fails closed: npm
+// also accepts globs and directories there, and silently skipping what it cannot
+// resolve would let a future "files" edit disable the gate while leaving the
+// publish green — the same silent-pass shape that let 1.0.1 ship.
+function checkLineEndings(baseDir, files = packageInfo.files) {
+  for (const entry of files) {
+    if (globPattern.test(entry)) {
+      throw new Error(
+        `${entry} is a glob pattern; this check only understands literal file paths, so update it before publishing`,
+      );
+    }
+    const filePath = path.join(baseDir, entry);
+    let stats;
+    try {
+      stats = fs.statSync(filePath);
+    } catch (error) {
+      if (error.code === "ENOENT") {
+        throw new Error(`${entry} is listed in package.json "files" but does not exist`);
+      }
+      throw error;
+    }
+    if (stats.isDirectory()) {
+      throw new Error(
+        `${entry} is a directory; this check only understands literal file paths, so update it before publishing`,
+      );
+    }
+    checkFileLineEndings(filePath, entry);
+  }
+}
+
+function main() {
+  checkVersion(packageInfo.version);
+  checkLineEndings(path.resolve(__dirname, ".."));
+}
+
+module.exports = { checkVersion, checkFileLineEndings, checkLineEndings };
+
+if (require.main === module) {
+  try {
+    main();
+  } catch (error) {
+    console.error(`Refusing to publish @etherscan/cli: ${error.message}`);
+    process.exit(1);
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@etherscan-npm/cli",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "description": "Command-line client and interactive explorer for the Etherscan V2 API",
   "license": "MIT",
   "homepage": "https://github.com/etherscan/etherscan-cli",
@@ -19,7 +19,8 @@
     "postinstall": "node npm/postinstall.js",
     "prepublishOnly": "node npm/prepublish-check.js",
     "test:package": "npm pack --dry-run",
-    "test:release": "node npm/publish.test.js"
+    "test:release": "node npm/publish.test.js",
+    "test:eol": "node npm/check-tarball-eol.js"
   },
   "files": [
     "npm/bin/etherscan.js",