@getcofund/cli 0.0.0 → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Cofund
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,228 @@
 # @getcofund/cli
 
-Placeholder. The first release is published from Strata-Labs/cofund-webapp.
+`cofund-chain`: the Cofund protocol from the command line, on
+[`@getcofund/protocol`](https://www.npmjs.com/package/@getcofund/protocol) alone. It reads from and sends to the
+chain and nowhere else: no Cofund API, no server. Co-signers pass signatures
+and PSBTs to each other as files, over whatever channel they choose.
+
+```sh
+npm i -g @getcofund/cli
+cofund-chain --help
+```
+
+Node 20 or later.
+
+## Settings
+
+| Setting | Flag | Environment |
+|---|---|---|
+| The keystore | `--keystore <file>` | `COFUND_KEYSTORE` (default `~/.cofund/keystore.json`) |
+| The EVM deployment: a `deployments/<chainId>.json` | `--deployment <file>` | `COFUND_DEPLOYMENT` |
+| The EVM chain's RPC | `--rpc <url>` | `COFUND_RPC_URL` |
+| An Esplora API, for Bitcoin | `--esplora <url>` | `COFUND_ESPLORA_URL` |
+
+A flag wins over its variable; a command that needs a setting neither gives
+says which is missing. The deployment is checked against its chain before
+anything is signed under it (`loadEvmDeployment`): its domain, the chain id,
+and every helper State registers.
+
+`--via direct` (the default) sends a call from the keystore's EVM key, which
+pays gas. `--via guard --sponsor-key-file <file>` wraps it in the
+deployment's guard (`sponsorGuard.relay`) and sends it from the sponsor's key
+(a hex private key, or a keystore), which the guard must accept. Founding a
+cofund (`createClient`) and seating a member (`addUser`) only accept the guard
+or a Cofund admin as their sender, so they go through the guard.
+
+## The keystore
+
+The same file as the API CLI `cofund`'s (`Keystore` from
+`@getcofund/protocol/keys`), with mode 0600: one EVM key and one BIP-86
+Bitcoin account, generated locally, so one key serves both CLIs. It pins the
+company each cofund's messages carry: `found` and `join` pin it, and a command
+acts in the keystore's only pinned cofund unless `--company` names another.
+A key signs a file for a cofund it has not pinned only when `--company` names
+that cofund.
+
+`COFUND_BTC_NETWORK` (`mainnet`, `testnet` or `regtest`) picks the network of
+new keys and vaults; regtest uses testnet keys.
+
+## Signature files
+
+A signature is a JSON file:
+
+```json
+{
+  "version": 1,
+  "type": "Transfer",
+  "domain": { "name": "Cofund", "version": "1", "chainId": 1, "verifyingContract": "0xD59e…02C0" },
+  "message": { "company": "acme", "policyId": "…", "messageType": "Operational_Expense", "amount": "50000000", "token": "0x…", "recipient": "0x…", "authId": "…" },
+  "signer": "0x…",
+  "signature": "0x…"
+}
+```
+
+`type` is one of the protocol's EIP-712 types (`InviteUser`, `RemoveUser`,
+`RotateUser`, `CompleteOnboarding`, `TransferPolicyActivation`,
+`TransactionPolicyActivation`, `PolicyDeactivation`, `Transfer`,
+`Transaction`); a `Transaction` file also carries the `instructions` it signs
+by hash. Every file is checked when it is loaded: the message is exactly its
+type's fields (the types are always the package's, never the file's), the
+domain is the deployment's, the signature recovers to the `signer` the file
+claims, and every file a command takes is of a type it takes and over the
+same message. Files are never overwritten.
+
+## Commands
+
+Every command that signs or sends prints what it is about to do, checked by
+the package's builders, and asks before it acts unless `--yes` is given. A
+call is also run as an `eth_call` from its sender before anyone is asked, so
+the checks that turn on the sender (the guard's sponsors, the platform gate,
+the vault's broadcasters) are shown too. A refusal is shown with the
+contract's error and why, and nothing is sent.
+
+| Command | Does |
+|---|---|
+| `keys init [--force]` | Make the keystore |
+| `keys show` | Its EVM address, its Bitcoin account xpub, the cofunds it pins |
+| `found --name <name> [--company <company>] [--tier <tier>]` | Sign the founder's own seat and send `createClient`; the company is the name normalized unless `--company` gives it, the tier `BUSINESS` unless `--tier` names another |
+| `show` | The cofund, its vault, its phase, its admins, its policies, this key's seat |
+| `members` | Everyone ever seated, as State holds them now |
+| `policies show <id>` | A policy, its signers by user id |
+| `invite --user-id <id> --position <title> [--admin] --out <file>` | An admin signs a seat |
+| `invite cosign <file>… --out <file>` | Another admin co-signs an admin seat |
+| `join <file>…` | The invitee signs its half and sends `addUser` with the files' signatures |
+| `members remove <user-id> [<file>…] [--out <file>]` | With `--out`, sign; without, send with the files' signatures, this key's added if it is an admin's not among them |
+| `members rotate [<file>…] [--new-address <address>] [--user-id <id>] [--out <file>]` | The current key (or, for a lost key, admins) signs with `--out`; the new key adds its own and sends |
+| `policies sign (--name … --signers <id,…> --threshold <n> (--token <address> --max-amount <amount> [--recipients <address,…>] \| --wrapper <address>) [--type <policy type>] \| <file>…) --out <file>` | An admin signs a policy's activation, new or the files' |
+| `policies activate <file>…` | Send it with the admins' signatures |
+| `policies deactivate <id> [<file>] [--out <file>]` | One admin's signature, this key's or the file's, sent |
+| `transfers sign (--policy <id> --to <address> --amount <amount> \| <file>…) --out <file>` | A signer of a transfer policy signs a transfer |
+| `transfers send <file>…` | Send it from the vault once signed often enough |
+| `calls sign (--policy <id> --instructions <hex> [--allowance <token>:<amount>]… \| <file>…) --out <file>` | A signer of a call policy signs a call through its wrapper |
+| `calls send <file>…` | Send it from the vault |
+| `calls simulate <file>…` | Its effect on every balance it moves, simulated (`eth_simulateV1`) before the threshold is met |
+| `onboarding complete [<file>] [--out <file>]` | One admin's `CompleteOnboarding`, sent |
+| `btc vault create --xpubs <xpub,…> --threshold <k> [--type ALL\|ADMINS_INCLUDED\|ADMINS_REQUIRED] [--admins <xpub,…>] --out <file>` | A vault's definition from its members' account xpubs, and its address |
+| `btc spend build --vault <file> --to <address> --amount <sats> [--fee-rate <sat/vB>] --out <file>` | The vault's confirmed coins selected through Esplora, and the unsigned PSBT |
+| `btc spend sign <psbt> --vault <file> --to <address> --amount <sats> --out <file>` | Sign it, after checking it pays exactly that and spends only the vault |
+| `btc spend combine <psbt>… --out <file>` | One PSBT with every signature |
+| `btc spend finalize <psbt> --vault <file> --out <file>` | The witnesses, once a leaf has its threshold; writes the transaction's hex |
+| `btc spend broadcast <hex or file>` | Send it through Esplora |
+
+On EVM, amounts are whole tokens, converted with the token's own decimals,
+and every preview shows the base units too. On Bitcoin they are sats. A vault
+file holds `{ id, address, definition }`; every command that takes one
+rebuilds the vault from its definition (`verifyBtcVault`) and refuses one
+that does not derive its address. A PSBT file is base64.
+
+## A cofund, end to end
+
+Three people, three machines. The deployment is one the founder trusts, its
+guard accepts the sponsor's key, and each person's shell has
+`COFUND_DEPLOYMENT` and `COFUND_RPC_URL` set.
+
+```sh
+# Each of them.
+cofund-chain keys init
+
+# Ada founds Acme through the guard, and invites Ben as an admin and Cy as a member.
+cofund-chain found --name Acme --via guard --sponsor-key-file sponsor.key
+cofund-chain invite --user-id ben --position CFO --admin --out ben.json
+cofund-chain invite --user-id cy --position Engineer --out cy.json
+
+# Ben and Cy join with their invites (and pin "acme").
+cofund-chain join ben.json --via guard --sponsor-key-file sponsor.key
+cofund-chain join cy.json --via guard --sponsor-key-file sponsor.key
+
+# A transfer policy: Ben and Cy, two of two, up to 1000 USDC a transfer.
+cofund-chain policies sign --name Operations --signers ben,cy --threshold 2 \
+  --token 0xA0b8…eB48 --max-amount 1000 --out ops-ada.json        # Ada
+cofund-chain policies sign ops-ada.json --out ops-ben.json         # Ben
+cofund-chain policies activate ops-ada.json ops-ben.json           # anyone
+cofund-chain show                                                  # lists its id
+
+# A transfer: both signers sign, either sends it from the vault.
+cofund-chain transfers sign --policy <id> --to 0x… --amount 50 --out t-ben.json   # Ben
+cofund-chain transfers sign t-ben.json --out t-cy.json                            # Cy
+cofund-chain transfers send t-ben.json t-cy.json                                  # Cy
+
+# Cy moves to a new key: the old key signs, the new keystore adds its own and sends.
+cofund-chain members rotate --new-address 0x… --out rotate.json
+cofund-chain members rotate rotate.json --company acme --keystore new.json
+
+# Ada closes the founding phase: from now on admin seats and policies take the admins' consensus.
+cofund-chain onboarding complete
+```
+
+## A Bitcoin vault, end to end
+
+```sh
+# Each member: COFUND_BTC_NETWORK=testnet cofund-chain keys init, and shares the xpub keys show prints.
+cofund-chain btc vault create --xpubs tpubA…,tpubB…,tpubC… --threshold 2 --out vault.json
+# Fund the address it prints. Then, with COFUND_ESPLORA_URL set:
+cofund-chain btc spend build --vault vault.json --to tb1q… --amount 700000 --out spend.psbt
+# Two members, each on their machine, sign what they agreed it pays:
+cofund-chain btc spend sign spend.psbt --vault vault.json --to tb1q… --amount 700000 --out b.psbt
+cofund-chain btc spend sign spend.psbt --vault vault.json --to tb1q… --amount 700000 --out c.psbt
+# Whoever collects them:
+cofund-chain btc spend combine b.psbt c.psbt --out signed.psbt
+cofund-chain btc spend finalize signed.psbt --vault vault.json --out spend.hex
+cofund-chain btc spend broadcast spend.hex
+```
+
+## Local stack
+
+From this repo, with Foundry, a cofund-solidity checkout and (for `--btc`)
+Docker:
+
+```sh
+# 1. Up: an Anvil with cofund-solidity's e2e contracts and a guard sponsor's key.
+#    Progress goes to stderr, the exports to stdout. A rerun reuses what is up.
+pnpm -s --filter @getcofund/cli local-up            # [--port <n>] [--btc]
+
+# 2. The exports in this shell (fish: `pnpm -s --filter @getcofund/cli local-up | source`).
+eval "$(pnpm -s --filter @getcofund/cli local-up)"
+
+# 3. cofund-chain against it (here: `node packages/cli/src/cli.ts`).
+cofund-chain keys init
+cast rpc anvil_setBalance <its evm address> 0x56bc75e2d63100000 --rpc-url "$COFUND_RPC_URL"
+cofund-chain found --name Acme --via guard --sponsor-key-file ~/.cofund/local/sponsor.key
+
+# Done: stops only what local-up started.
+pnpm --filter @getcofund/cli local-down
+```
+
+`local-up` starts Anvil on a free port (or `--port`, or `LOCAL_ANVIL_PORT`),
+never on one where a node it did not start answers, runs cofund-solidity's
+`script/e2e-deploy.sh` on it, and writes `<chainId>.json` and `sponsor.key`
+(Anvil account 10, one of the guard's sponsors) into its state dir,
+`COFUND_LOCAL_DIR` (default `~/.cofund/local`). For Bitcoin it uses the shared
+regtest Esplora at `http://127.0.0.1:3002` when it answers; otherwise `--btc`
+starts a bitcoind and an electrs of its own in Docker. cofund-solidity is
+`COFUND_SOLIDITY_DIR`, else the sibling of this repo's main checkout (as
+`apps/cofund/scripts/e2e-up.sh` finds it).
+
+## Tests
+
+`pnpm --filter @getcofund/cli test` runs the unit tests: each command's
+arguments, previews and refusals against an in-memory chain, the signature
+file checks, and the settings' precedence. Two integration tests run the
+`cofund-chain` binary, one process per command, against real chains:
+
+```sh
+# The EVM: cofund-solidity's e2e deploy script on a throwaway Anvil, a cofund's life
+# sent directly and through the guard. Needs Foundry.
+CLI_ANVIL=1 COFUND_SOLIDITY_DIR=../cofund-solidity pnpm --filter @getcofund/cli test
+
+# Bitcoin: a bitcoind -regtest and an electrs of its own in Docker, a 2-of-3 vault
+# created, funded, spent through PSBTs signed by two keystores, broadcast and mined.
+CLI_REGTEST=1 pnpm --filter @getcofund/cli test
+```
+
+`pnpm --filter @getcofund/cli smoke` packs the package, installs it outside
+the repo next to the packed protocol, and runs `cofund-chain --help` and
+`keys init`.
+
+## License
+
+MIT

package/dist/chain.js

@@ -0,0 +1,115 @@
+import { formatUnitsAmount, readContract, readUser, readUserIdByAddress, stateAbi, } from "@getcofund/protocol/evm";
+import { decodeEventLog, encodeEventTopics, erc20Abi, keccak256, stringToHex, } from "viem";
+/** The seat `address` holds in the cofund, active or not; null when none. */
+export async function seatOf(evm, clientId, address) {
+    const userId = await readUserIdByAddress(evm.reader, evm.deployment, clientId, address);
+    if (userId === null) {
+        return null;
+    }
+    const user = await readUser(evm.reader, evm.deployment, clientId, userId);
+    return user ? { userId, user } : null;
+}
+/** `address`'s seat, which must be an active admin's, or why not. */
+export async function requireAdmin(evm, clientId, address) {
+    const seat = await seatOf(evm, clientId, address);
+    if (!seat) {
+        throw new Error(`${address} holds no seat in this cofund`);
+    }
+    if (!(seat.user.active && seat.user.isAdmin)) {
+        throw new Error(`${address} (${seat.userId}) is not an active admin of this cofund`);
+    }
+    return seat;
+}
+/** A seat as previews name it: `id (admin, CFO, 0x…)`. */
+export function seatText({ userId, user }) {
+    const role = user.isAdmin ? "admin" : "member";
+    const state = user.active ? "" : ", removed";
+    return `${userId} (${role}, ${user.position}, ${user.address}${state})`;
+}
+/** A symbol a token claims, shown only when it is a plain one. */
+const SYMBOL = /^[\w.$-]{1,32}$/;
+export async function tokenInfo(evm, address) {
+    let decimals;
+    try {
+        decimals = await readContract(evm.reader, {
+            address,
+            abi: erc20Abi,
+            functionName: "decimals",
+            args: [],
+        });
+    }
+    catch {
+        throw new Error(`${address} reports no decimals: it is not a token this CLI can take an amount in`);
+    }
+    const symbol = await readContract(evm.reader, {
+        address,
+        abi: erc20Abi,
+        functionName: "symbol",
+        args: [],
+    }).catch(() => null);
+    return {
+        address,
+        symbol: symbol && SYMBOL.test(symbol) ? symbol : null,
+        decimals,
+    };
+}
+const AMOUNT = /^(\d*)\.?(\d*)$/;
+const NOT_ZERO = /[^0]/;
+/**
+ * `--flag`'s whole-token amount in base units, exactly: positive, and no
+ * finer than the token's decimals (never rounded).
+ */
+export function baseUnits(amount, token, flag) {
+    const match = AMOUNT.exec(amount);
+    const fraction = match?.[2] ?? "";
+    if (!match ||
+        match[1].length + fraction.length === 0 ||
+        NOT_ZERO.test(fraction.slice(token.decimals))) {
+        throw new Error(`${flag} takes whole tokens, to at most ${token.decimals} decimals, not ${amount}`);
+    }
+    const units = BigInt(`${match[1] || "0"}${fraction.padEnd(token.decimals, "0").slice(0, token.decimals)}`);
+    if (units <= 0n) {
+        throw new Error(`${flag} must be positive`);
+    }
+    return units;
+}
+/** `units` of `token` as every preview prints them: whole tokens and base units. */
+export function amountText(units, token) {
+    const symbol = token.symbol ? `"${token.symbol}"` : "tokens";
+    return `${formatUnitsAmount(units, token.decimals)} ${symbol} (${units} base units of ${token.address})`;
+}
+/** State's `events` for the cofund, oldest first: there is no index, so they are read from the chain. */
+async function stateEvents(evm, clientId, events) {
+    const logs = (await evm.reader.request({
+        method: "eth_getLogs",
+        params: [
+            {
+                address: evm.deployment.state,
+                fromBlock: "earliest",
+                toBlock: "latest",
+                topics: [
+                    events.map((eventName) => encodeEventTopics({ abi: stateAbi, eventName })[0]),
+                    clientId,
+                ],
+            },
+        ],
+    }));
+    return logs.map((log) => decodeEventLog({ abi: stateAbi, data: log.data, topics: log.topics }));
+}
+/** Every user id ever seated in the cofund, the founder first. */
+export async function memberIds(evm, clientId) {
+    const ids = (await stateEvents(evm, clientId, ["NewClientCreated", "UserAdded"])).map((event) => event.eventName === "NewClientCreated"
+        ? event.args.adminId
+        : event.args.userId);
+    return [...new Set(ids)];
+}
+/** Every policy id ever activated in the cofund. */
+export async function policyIds(evm, clientId) {
+    const ids = (await stateEvents(evm, clientId, ["PolicyActivated"])).map((event) => event.args.policyId);
+    return [...new Set(ids)];
+}
+/** A policy's signer ids (State keeps `keccak256(userId)`) named by the members they hash. */
+export function signerNames(signerIds, members) {
+    const byHash = new Map(members.map((id) => [keccak256(stringToHex(id)), id]));
+    return signerIds.map((hash) => byHash.get(hash) ?? hash);
+}

package/dist/cli.js

@@ -0,0 +1,153 @@
+#!/usr/bin/env node
+/**
+ * `cofund-chain`: the Cofund protocol from the command line, on
+ * `@getcofund/protocol` alone. It reads and sends to the chain and nowhere
+ * else; co-signers pass signatures and PSBTs as files. `--help` lists the
+ * commands.
+ */
+import { realpathSync } from "node:fs";
+import { createInterface } from "node:readline/promises";
+import { pathToFileURL } from "node:url";
+import { parseArgs } from "node:util";
+import { btcSpendBroadcast, btcSpendBuild, btcSpendCombine, btcSpendFinalize, btcSpendSign, btcVaultCreate, } from "./commands/btc.js";
+import { callsSend, callsSign, callsSimulate } from "./commands/calls.js";
+import { found } from "./commands/found.js";
+import { invite, inviteCosign, join } from "./commands/invite.js";
+import { keysInit, keysShow } from "./commands/keys.js";
+import { membersRemove, membersRotate } from "./commands/members.js";
+import { onboardingComplete } from "./commands/onboarding.js";
+import { policiesActivate, policiesDeactivate, policiesSign, } from "./commands/policies.js";
+import { members, policiesShow, show } from "./commands/reads.js";
+import { transfersSend, transfersSign } from "./commands/transfers.js";
+import { errorLines } from "./context.js";
+import { USAGE } from "./usage.js";
+const OPTIONS = {
+    keystore: { type: "string" },
+    deployment: { type: "string" },
+    rpc: { type: "string" },
+    esplora: { type: "string" },
+    via: { type: "string" },
+    "sponsor-key-file": { type: "string" },
+    company: { type: "string" },
+    out: { type: "string" },
+    yes: { type: "boolean", short: "y" },
+    force: { type: "boolean" },
+    help: { type: "boolean", short: "h" },
+    name: { type: "string" },
+    tier: { type: "string" },
+    "user-id": { type: "string" },
+    position: { type: "string" },
+    admin: { type: "boolean" },
+    "new-address": { type: "string" },
+    signers: { type: "string" },
+    threshold: { type: "string" },
+    token: { type: "string" },
+    "max-amount": { type: "string" },
+    recipients: { type: "string" },
+    wrapper: { type: "string" },
+    type: { type: "string" },
+    policy: { type: "string" },
+    to: { type: "string" },
+    amount: { type: "string" },
+    instructions: { type: "string" },
+    allowance: { type: "string", multiple: true },
+    xpubs: { type: "string" },
+    admins: { type: "string" },
+    vault: { type: "string" },
+    "fee-rate": { type: "string" },
+};
+/** A command that takes no positionals. */
+const bare = (run) => (io, flags, args) => args.length === 0 ? run(io, flags) : usage(io);
+/** Every command by its name, the longest name a line starts with winning. */
+const COMMANDS = {
+    "keys init": bare(keysInit),
+    "keys show": bare(keysShow),
+    found: bare(found),
+    show: bare(show),
+    members: bare(members),
+    "members remove": (io, flags, [userId, ...files]) => membersRemove(io, flags, userId, files),
+    "members rotate": membersRotate,
+    invite: bare(invite),
+    "invite cosign": inviteCosign,
+    join,
+    "policies show": (io, flags, [id, ...rest]) => rest.length === 0 ? policiesShow(io, flags, id) : usage(io),
+    "policies sign": policiesSign,
+    "policies activate": policiesActivate,
+    "policies deactivate": (io, flags, [id, ...files]) => policiesDeactivate(io, flags, id, files),
+    "transfers sign": transfersSign,
+    "transfers send": transfersSend,
+    "calls sign": callsSign,
+    "calls send": callsSend,
+    "calls simulate": callsSimulate,
+    "onboarding complete": onboardingComplete,
+    "btc vault create": bare(btcVaultCreate),
+    "btc spend build": bare(btcSpendBuild),
+    "btc spend sign": btcSpendSign,
+    "btc spend combine": btcSpendCombine,
+    "btc spend finalize": btcSpendFinalize,
+    "btc spend broadcast": btcSpendBroadcast,
+};
+function dispatch(io, flags, positionals) {
+    for (const words of [3, 2, 1]) {
+        const name = positionals.slice(0, words).join(" ");
+        if (positionals.length >= words && Object.hasOwn(COMMANDS, name)) {
+            return COMMANDS[name](io, flags, positionals.slice(words));
+        }
+    }
+    return usage(io);
+}
+function usage(io) {
+    io.err(USAGE);
+    return 1;
+}
+export async function runCli(argv, io) {
+    let parsed;
+    try {
+        parsed = parseArgs({
+            args: argv,
+            allowPositionals: true,
+            options: OPTIONS,
+        });
+    }
+    catch (error) {
+        io.err(error instanceof Error ? error.message : String(error));
+        io.err("`cofund-chain --help` lists the commands and their flags");
+        return 1;
+    }
+    const { values, positionals } = parsed;
+    if (values.help) {
+        io.out(USAGE);
+        return 0;
+    }
+    try {
+        return await dispatch(io, values, positionals);
+    }
+    catch (error) {
+        for (const text of errorLines(error)) {
+            io.err(text);
+        }
+        return 1;
+    }
+}
+if (process.argv[1] &&
+    import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href) {
+    const tty = process.stdin.isTTY && process.stdout.isTTY;
+    runCli(process.argv.slice(2), {
+        env: process.env,
+        out: (text) => process.stdout.write(`${text}\n`),
+        err: (text) => process.stderr.write(`${text}\n`),
+        confirm: tty
+            ? async (question) => {
+                const rl = createInterface({
+                    input: process.stdin,
+                    output: process.stdout,
+                });
+                const answer = await rl.question(`${question} [y/N] `);
+                rl.close();
+                return answer.trim().toLowerCase() === "y";
+            }
+            : undefined,
+    }).then((code) => {
+        process.exitCode = code;
+    });
+}