@kashdao/cli 0.1.0

package/SECURITY.md

@@ -0,0 +1,110 @@
+# Security policy
+
+## Non-custodial design
+
+`@kashdao/cli` is **non-custodial software**. The following invariants
+hold across both of its execution modes (Kash-orchestrated and
+self-orchestrated):
+
+- **Kash never holds or controls user funds.** Customer USDC,
+  outcome tokens, and any other on-chain assets always sit at an
+  on-chain address the user controls. The CLI holds zero balances on
+  the user's behalf; the Kash backend holds zero balances on the
+  user's behalf.
+- **Kash never has access to user signing keys.** Smart-account keys
+  are split via Privy's MPC across the user's device and Privy's
+  HSM-backed enclave; Kash operates no key share. In self-orchestrated
+  mode the user's private key lives wherever they put it (file ref,
+  env var, KMS, Fireblocks, hardware wallet) and never leaves the
+  CLI process boundary.
+- **The CLI never persists user keys.** API keys persist to
+  `~/.kash/config.json` at mode `0600`; raw private keys are never
+  written to disk by the CLI. The `signerKeyRef` config field is a
+  _reference_ (`file:<path>` / `env:<NAME>`) — the underlying secret
+  is resolved at invocation time and never persisted by the CLI.
+- **Kash never signs transactions or UserOps on the user's behalf.**
+  Every state-changing on-chain action is signed inside the user's
+  Privy MPC enclave or by the consumer's own signer; no signature ever
+  originates on a Kash server or inside the Kash backend's process
+  boundary.
+- **Kash never moves user funds.** Settlement is on-chain via
+  open-source protocol contracts; there is no Kash-controlled pool of
+  funds in the path, no Kash-controlled balance ledger, and no
+  Kash-controlled relay that can re-route value.
+- **The API-key delegation is scoped and revocable.** A `kash_live_*`
+  / `kash_test_*` key carries narrowly-scoped limits (per-trade caps,
+  daily caps, allowed operations, allowlisted IPs) the customer sets
+  themselves. Revocation via `kash auth revoke <id>` (or the Kash
+  dashboard) takes effect on the next request.
+- **Kash is not a money-services business, custodian, exchange, or
+  broker-dealer.** Kash publishes software and protocol contracts;
+  customers run the software and interact with the protocol from
+  accounts they control.
+
+Equivalent statements hold for `@kashdao/sdk`, `@kashdao/protocol-sdk`,
+and `kashdao-protocol-sdk` (Python).
+
+## Reporting a vulnerability
+
+**Please do not file a public GitHub issue for security vulnerabilities.**
+
+Email: `security@kash.bot`
+
+Include:
+
+- A clear description of the issue
+- Reproduction steps or proof-of-concept
+- The version of `@kashdao/cli` (and any relevant runtime info: Node version,
+  shell, OS)
+- Whether the issue affects the CLI, the underlying SDK, the public API,
+  or some combination
+
+We aim to:
+
+1. Acknowledge receipt within **2 business days**.
+2. Confirm or reject the report within **7 business days**.
+3. Ship a fix within **30 days** for accepted reports, faster for issues
+   actively being exploited.
+
+Once the fix has shipped and a reasonable upgrade window has elapsed, we
+publish a coordinated disclosure crediting the reporter (with consent).
+
+## Scope
+
+In scope:
+
+- Vulnerabilities in `@kashdao/cli` itself (this package).
+- Issues that compromise the security guarantees of the local CLI surface:
+  - API key leakage to disk in plaintext outside `~/.kash/config.json`
+  - `~/.kash/config.json` being created or rewritten with permissions
+    looser than `0600` on POSIX systems
+  - Shell completion files being installed without user consent
+  - JSON output containing API keys, webhook secrets, or other plaintext
+    credentials when not explicitly requested
+  - Path-traversal or arbitrary-file-write through any CLI argument
+
+Out of scope (please report to `security@kash.bot` separately if relevant):
+
+- Vulnerabilities in `@kashdao/sdk` — see that package's `SECURITY.md`
+- Vulnerabilities in the Kash public API
+- Vulnerabilities in transitive dependencies (`commander`, `chalk`,
+  `cli-table3`, `ora`, `omelette`, `zod`) — report upstream first; we'll
+  respond to coordinated disclosures
+- Issues requiring physical access to the user's machine, or the user
+  having already lost local credentials
+- Permission tightening failing on Windows or non-POSIX filesystems
+  (chmod is best-effort; documented in `src/utils/config-store.ts`)
+
+## Supported versions
+
+| Version | Supported            |
+| ------- | -------------------- |
+| 0.x     | ✅ Latest minor only |
+
+While the package is `0.x`, only the latest published `0.x.y` receives
+security fixes. After 1.0, we'll publish a long-term-support policy here.
+
+## Disclosure
+
+Acknowledged researchers are listed in `CHANGELOG.md` against the patched
+release.

package/dist/account-AVFLEM5D.js

@@ -0,0 +1,90 @@
+#!/usr/bin/env node
+import {
+  buildClient
+} from "./chunk-QJMF73M5.js";
+import "./chunk-KMBMQIZ7.js";
+import "./chunk-YHCG2SUC.js";
+import "./chunk-BN2CUM42.js";
+import {
+  readGlobals
+} from "./chunk-LBIRQHX5.js";
+import {
+  print,
+  printJson,
+  style
+} from "./chunk-VIADBYFY.js";
+import "./chunk-MIXOZU2S.js";
+import {
+  toCliError
+} from "./chunk-UZNSYATZ.js";
+
+// src/commands/account/index.ts
+import { Command as Command2 } from "commander";
+
+// src/commands/account/usage.ts
+import { Command } from "commander";
+var usageCommand = new Command("usage").description("Show per-key telemetry summary (24h / 7d / 30d windows).").addHelpText(
+  "after",
+  `
+Examples:
+  $ kash account usage
+  $ kash account usage --json | jq '.trades["24h"].successRate'
+  $ kash account usage --json --quiet | jq -r '.trades["7d"].successRate * 100'
+`
+).action(async (_opts, cmd) => {
+  const globals = readGlobals(cmd);
+  let usage;
+  try {
+    const { client } = await buildClient({ requireAuth: true, globals });
+    usage = await client.account.usage();
+  } catch (cause) {
+    throw toCliError(cause);
+  }
+  if (globals.json) {
+    printJson(usage);
+    return;
+  }
+  print("");
+  print(`  ${style.dim("API key       ")} ${usage.apiKeyId}`);
+  print(`  ${style.dim("Generated at  ")} ${usage.generatedAt}`);
+  print("");
+  print(`  ${style.dim("Trades")}`);
+  renderTradeWindow("  24h", usage.trades["24h"]);
+  print(
+    `        latency p50 ${formatMs(usage.trades["24h"].latencyMs.p50)}  p99 ${formatMs(usage.trades["24h"].latencyMs.p99)}`
+  );
+  renderTradeWindow("   7d", usage.trades["7d"]);
+  renderTradeWindow("  30d", usage.trades["30d"]);
+  print("");
+  print(`  ${style.dim("Webhooks (7d)")}`);
+  const wh = usage.webhooks["7d"];
+  print(
+    `        emitted=${wh.emitted}  delivered=${wh.delivered}  failed=${wh.failed}  success=${formatRate(wh.successRate)}`
+  );
+  print("");
+  print(`  ${style.dim("Auth (24h)")}`);
+  print(
+    `        failures=${usage.auth["24h"].failures}  rate-limit-rejections=${usage.auth["24h"].rateLimitRejections}`
+  );
+  print("");
+});
+function renderTradeWindow(label, w) {
+  print(
+    `    ${label}  total=${w.total}  completed=${w.completed}  failed=${w.failed}  success=${formatRate(w.successRate)}`
+  );
+}
+function formatRate(rate) {
+  if (rate === null) return style.dim("\u2014");
+  return `${(rate * 100).toFixed(2)}%`;
+}
+function formatMs(value) {
+  if (value === null) return style.dim("\u2014");
+  return `${value}ms`;
+}
+
+// src/commands/account/index.ts
+var accountCommand = new Command2("account").description("Read-only account surfaces (usage telemetry, etc.).").addCommand(usageCommand);
+export {
+  accountCommand
+};
+//# sourceMappingURL=account-AVFLEM5D.js.map

package/dist/account-AVFLEM5D.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/commands/account/index.ts","../src/commands/account/usage.ts"],"sourcesContent":["/**\n * `kash account` — read-only account-scoped surfaces for the\n * authenticating API key.\n *\n * Currently just `usage` (per-key telemetry). Future siblings could\n * include `keys list / revoke` if those flows ever migrate from the\n * webapp Settings page into the CLI.\n */\n\nimport { Command } from 'commander';\n\nimport { usageCommand } from './usage.js';\n\nexport const accountCommand = new Command('account')\n  .description('Read-only account surfaces (usage telemetry, etc.).')\n  .addCommand(usageCommand);\n","/**\n * `kash account usage` — per-key telemetry summary.\n *\n * Wraps `GET /v1/account/usage` (DX7). Returns rolling-window stats\n * for the calling key: trade volume + success rate (24h / 7d / 30d),\n * end-to-end latency p50/p99, webhook delivery success, and recent\n * auth + rate-limit signals.\n */\n\nimport { Command } from 'commander';\n\nimport { toCliError } from '../../errors.js';\nimport { buildClient } from '../../utils/client.js';\nimport { readGlobals } from '../../utils/global-options.js';\nimport { print, printJson, style } from '../../utils/output.js';\n\nimport type { AccountUsage } from '@kashdao/sdk';\n\nexport const usageCommand = new Command('usage')\n  .description('Show per-key telemetry summary (24h / 7d / 30d windows).')\n  .addHelpText(\n    'after',\n    `\nExamples:\n  $ kash account usage\n  $ kash account usage --json | jq '.trades[\"24h\"].successRate'\n  $ kash account usage --json --quiet | jq -r '.trades[\"7d\"].successRate * 100'\n`\n  )\n  .action(async (_opts, cmd: Command) => {\n    const globals = readGlobals(cmd);\n    let usage: AccountUsage;\n    try {\n      const { client } = await buildClient({ requireAuth: true, globals });\n      usage = await client.account.usage();\n    } catch (cause) {\n      throw toCliError(cause);\n    }\n\n    if (globals.json) {\n      printJson(usage);\n      return;\n    }\n\n    print('');\n    print(`  ${style.dim('API key       ')} ${usage.apiKeyId}`);\n    print(`  ${style.dim('Generated at  ')} ${usage.generatedAt}`);\n\n    print('');\n    print(`  ${style.dim('Trades')}`);\n    renderTradeWindow('  24h', usage.trades['24h']);\n    print(\n      `        latency p50 ${formatMs(usage.trades['24h'].latencyMs.p50)}  ` +\n        `p99 ${formatMs(usage.trades['24h'].latencyMs.p99)}`\n    );\n    renderTradeWindow('   7d', usage.trades['7d']);\n    renderTradeWindow('  30d', usage.trades['30d']);\n\n    print('');\n    print(`  ${style.dim('Webhooks (7d)')}`);\n    const wh = usage.webhooks['7d'];\n    print(\n      `        emitted=${wh.emitted}  delivered=${wh.delivered}  failed=${wh.failed}  ` +\n        `success=${formatRate(wh.successRate)}`\n    );\n\n    print('');\n    print(`  ${style.dim('Auth (24h)')}`);\n    print(\n      `        failures=${usage.auth['24h'].failures}  ` +\n        `rate-limit-rejections=${usage.auth['24h'].rateLimitRejections}`\n    );\n    print('');\n  });\n\nfunction renderTradeWindow(\n  label: string,\n  w: AccountUsage['trades']['24h'] | AccountUsage['trades']['7d']\n): void {\n  print(\n    `    ${label}  total=${w.total}  completed=${w.completed}  ` +\n      `failed=${w.failed}  success=${formatRate(w.successRate)}`\n  );\n}\n\nfunction formatRate(rate: number | null): string {\n  if (rate === null) return style.dim('—');\n  return `${(rate * 100).toFixed(2)}%`;\n}\n\nfunction formatMs(value: number | null): string {\n  if (value === null) return style.dim('—');\n  return `${value}ms`;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AASA,SAAS,WAAAA,gBAAe;;;ACAxB,SAAS,eAAe;AASjB,IAAM,eAAe,IAAI,QAAQ,OAAO,EAC5C,YAAY,0DAA0D,EACtE;AAAA,EACC;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAMF,EACC,OAAO,OAAO,OAAO,QAAiB;AACrC,QAAM,UAAU,YAAY,GAAG;AAC/B,MAAI;AACJ,MAAI;AACF,UAAM,EAAE,OAAO,IAAI,MAAM,YAAY,EAAE,aAAa,MAAM,QAAQ,CAAC;AACnE,YAAQ,MAAM,OAAO,QAAQ,MAAM;AAAA,EACrC,SAAS,OAAO;AACd,UAAM,WAAW,KAAK;AAAA,EACxB;AAEA,MAAI,QAAQ,MAAM;AAChB,cAAU,KAAK;AACf;AAAA,EACF;AAEA,QAAM,EAAE;AACR,QAAM,KAAK,MAAM,IAAI,gBAAgB,CAAC,IAAI,MAAM,QAAQ,EAAE;AAC1D,QAAM,KAAK,MAAM,IAAI,gBAAgB,CAAC,IAAI,MAAM,WAAW,EAAE;AAE7D,QAAM,EAAE;AACR,QAAM,KAAK,MAAM,IAAI,QAAQ,CAAC,EAAE;AAChC,oBAAkB,SAAS,MAAM,OAAO,KAAK,CAAC;AAC9C;AAAA,IACE,uBAAuB,SAAS,MAAM,OAAO,KAAK,EAAE,UAAU,GAAG,CAAC,SACzD,SAAS,MAAM,OAAO,KAAK,EAAE,UAAU,GAAG,CAAC;AAAA,EACtD;AACA,oBAAkB,SAAS,MAAM,OAAO,IAAI,CAAC;AAC7C,oBAAkB,SAAS,MAAM,OAAO,KAAK,CAAC;AAE9C,QAAM,EAAE;AACR,QAAM,KAAK,MAAM,IAAI,eAAe,CAAC,EAAE;AACvC,QAAM,KAAK,MAAM,SAAS,IAAI;AAC9B;AAAA,IACE,mBAAmB,GAAG,OAAO,eAAe,GAAG,SAAS,YAAY,GAAG,MAAM,aAChE,WAAW,GAAG,WAAW,CAAC;AAAA,EACzC;AAEA,QAAM,EAAE;AACR,QAAM,KAAK,MAAM,IAAI,YAAY,CAAC,EAAE;AACpC;AAAA,IACE,oBAAoB,MAAM,KAAK,KAAK,EAAE,QAAQ,2BACnB,MAAM,KAAK,KAAK,EAAE,mBAAmB;AAAA,EAClE;AACA,QAAM,EAAE;AACV,CAAC;AAEH,SAAS,kBACP,OACA,GACM;AACN;AAAA,IACE,OAAO,KAAK,WAAW,EAAE,KAAK,eAAe,EAAE,SAAS,YAC5C,EAAE,MAAM,aAAa,WAAW,EAAE,WAAW,CAAC;AAAA,EAC5D;AACF;AAEA,SAAS,WAAW,MAA6B;AAC/C,MAAI,SAAS,KAAM,QAAO,MAAM,IAAI,QAAG;AACvC,SAAO,IAAI,OAAO,KAAK,QAAQ,CAAC,CAAC;AACnC;AAEA,SAAS,SAAS,OAA8B;AAC9C,MAAI,UAAU,KAAM,QAAO,MAAM,IAAI,QAAG;AACxC,SAAO,GAAG,KAAK;AACjB;;;ADhFO,IAAM,iBAAiB,IAAIC,SAAQ,SAAS,EAChD,YAAY,qDAAqD,EACjE,WAAW,YAAY;","names":["Command","Command"]}

package/dist/auth-GUJCVKTD.js

@@ -0,0 +1,239 @@
+#!/usr/bin/env node
+import {
+  redact
+} from "./chunk-BRK7KJ4O.js";
+import {
+  clearConfigField,
+  readConfig,
+  setCurrentProfile,
+  updateConfig
+} from "./chunk-KMBMQIZ7.js";
+import "./chunk-YHCG2SUC.js";
+import {
+  readGlobals
+} from "./chunk-LBIRQHX5.js";
+import {
+  log,
+  print,
+  printJson,
+  style
+} from "./chunk-VIADBYFY.js";
+import "./chunk-MIXOZU2S.js";
+import {
+  CliValidationError,
+  toCliError
+} from "./chunk-UZNSYATZ.js";
+
+// src/commands/auth/index.ts
+import { Command as Command4 } from "commander";
+
+// src/commands/auth/logout.ts
+import { Command } from "commander";
+var logoutCommand = new Command("logout").description("Remove the stored API key from ~/.kash/config.json.").addHelpText(
+  "after",
+  `
+Examples:
+  $ kash auth logout
+  $ kash auth logout --profile staging
+`
+).action(async (_opts, cmd) => {
+  const globals = readGlobals(cmd);
+  const scope = {
+    ...globals.profile === void 0 ? {} : { profile: globals.profile },
+    ...globals.configPath === void 0 ? {} : { configPath: globals.configPath }
+  };
+  const before = await readConfig(scope);
+  await clearConfigField("apiKey", scope);
+  const envWillOverride = Boolean(process.env["KASH_API_KEY"]);
+  if (globals.json) {
+    printJson({
+      ok: true,
+      profile: before.profile,
+      cleared: Boolean(before.apiKey && before.sources.apiKey === "file"),
+      envOverride: envWillOverride
+    });
+    return;
+  }
+  if (before.apiKey === void 0) {
+    log.info(`No API key was stored for profile "${before.profile}".`);
+  } else {
+    log.success(`API key cleared from profile "${before.profile}".`);
+  }
+  if (envWillOverride) {
+    log.warn("KASH_API_KEY is still set in your environment. Unset it to fully log out.");
+  }
+});
+
+// src/commands/auth/set-key.ts
+import { Command as Command2 } from "commander";
+var setKeyCommand = new Command2("set-key").description("Store an API key in ~/.kash/config.json (mode 0600).").argument("[key]", 'API key starting with "kash_" (omit to read from stdin or prompt)').option("--from-stdin", "read the key from stdin (preferred for secret-store integration)").option(
+  "--activate",
+  "also switch the active profile to the one being written (default: leave the active profile unchanged \u2014 `kash auth set-key --profile staging` updates 'staging' but doesn't make it active; pass --activate or run `kash config use staging` separately)"
+).addHelpText(
+  "after",
+  `
+Examples:
+  # Interactive prompt (no shell history footprint).
+  $ kash auth set-key
+
+  # Pipe from a secret store.
+  $ pass show kash/api-key | kash auth set-key --from-stdin
+  $ op read "op://Private/kash/api-key" | kash auth set-key --from-stdin
+
+  # Positional (convenient but shows up in ~/.bash_history).
+  $ kash auth set-key kash_live_abc...
+  $ kash auth set-key kash_test_abc... --profile staging
+`
+).action(async (positional, options, cmd) => {
+  const globals = readGlobals(cmd);
+  const key = await resolveKey(positional, options);
+  if (!key.startsWith("kash_")) {
+    throw new CliValidationError(
+      'API keys must start with "kash_".',
+      "Request a `kash_test_*` staging key by emailing `engineering@kash.bot` with your intended use case. Self-service issuance and `kash_live_*` keys land with the production launch."
+    );
+  }
+  let result;
+  try {
+    result = await updateConfig(
+      { apiKey: key },
+      {
+        ...globals.profile === void 0 ? {} : { profile: globals.profile },
+        ...globals.configPath === void 0 ? {} : { configPath: globals.configPath }
+      }
+    );
+    if (options.activate === true) {
+      await setCurrentProfile(
+        result.profile,
+        globals.configPath === void 0 ? void 0 : { configPath: globals.configPath }
+      );
+    }
+  } catch (cause) {
+    throw toCliError(cause);
+  }
+  if (globals.json) {
+    printJson({
+      ok: true,
+      apiKey: redact(key),
+      profile: result.profile,
+      // Whether this run also flipped the file's currentProfile.
+      // Agents driving multi-profile workflows can chain off this
+      // to know if a follow-up `kash config use` is needed.
+      activated: options.activate === true
+    });
+    return;
+  }
+  log.success(`API key saved to profile "${result.profile}" (${redact(key)}).`);
+  log.detail("Location", globals.configPath ?? "~/.kash/config.json (mode 0600)");
+  if (options.activate === true) {
+    log.success(`Active profile is now "${result.profile}".`);
+  }
+});
+async function resolveKey(positional, options) {
+  if (positional !== void 0 && positional !== "" && options.fromStdin === true) {
+    throw new CliValidationError(
+      "Pass either the positional <key> OR --from-stdin, not both.",
+      "The positional key would silently win and the piped value would be dropped."
+    );
+  }
+  if (positional !== void 0 && positional !== "") {
+    return positional;
+  }
+  if (options.fromStdin === true) {
+    return readFromStdin();
+  }
+  if (process.stdin.isTTY) {
+    return promptInteractively();
+  }
+  throw new CliValidationError(
+    "No API key provided.",
+    "Pass the key positionally, use --from-stdin to read it from a pipe, or run interactively for a prompt."
+  );
+}
+async function readFromStdin() {
+  const { readStdinTrimmed } = await import("./stdin-YW2CEQXU.js");
+  return readStdinTrimmed();
+}
+async function promptInteractively() {
+  const { password } = await import("@inquirer/prompts");
+  const answer = await password({
+    message: "Paste your API key (kash_live_\u2026 or kash_test_\u2026):",
+    mask: "*"
+  });
+  return answer.trim();
+}
+
+// src/commands/auth/status.ts
+import { Command as Command3 } from "commander";
+var statusCommand = new Command3("status").description("Show locally-configured credentials. Does not call the API.").addHelpText(
+  "after",
+  `
+Examples:
+  $ kash auth status
+  $ kash auth status --profile prod
+  $ kash auth status --json --quiet | jq -r '.apiKey'
+`
+).action(async (_opts, cmd) => {
+  const globals = readGlobals(cmd);
+  const config = await readConfig({
+    ...globals.profile === void 0 ? {} : { profile: globals.profile },
+    ...globals.configPath === void 0 ? {} : { configPath: globals.configPath }
+  });
+  if (globals.json) {
+    printJson({
+      // Pure local-state field. `true` means "an API key is in
+      // scope for this profile" (file or env), NOT "this key is
+      // accepted by the server" — `kash auth status` is offline by
+      // design. Use `kash health --json --quiet | jq .ok` for a
+      // server-side check.
+      configured: Boolean(config.apiKey),
+      // Backward-compat alias. Same value as `configured`. Kept
+      // for downstream scripts that pin to the old field name —
+      // will be removed in a major bump after the rename has
+      // burned in.
+      authenticated: Boolean(config.apiKey),
+      apiKey: config.apiKey ? redact(config.apiKey) : null,
+      profile: config.profile,
+      baseUrl: config.baseUrl,
+      defaultChainId: config.defaultChainId,
+      // Direct-mode fields (`kash protocol …` / `kash eoa …`). Always
+      // emitted (`null` when unset) so direct-mode operators can
+      // introspect their own profile via JSON without falling back
+      // to reading `~/.kash/config.json` directly. The signerKeyRef
+      // is the reference shape (`file:<path>` / `env:<NAME>`),
+      // never the raw private key — the CLI never persists keys.
+      rpcUrl: config.rpcUrl ?? null,
+      smartAccount: config.smartAccount ?? null,
+      bundlerUrl: config.bundlerUrl ?? null,
+      bundlerProvider: config.bundlerProvider ?? null,
+      signerKeyRef: config.signerKeyRef ?? null,
+      sources: config.sources
+    });
+    return;
+  }
+  if (!config.apiKey) {
+    log.warn(`No API key configured for profile "${config.profile}".`);
+    log.detail(
+      "Hint",
+      "Run 'kash setup' for the wizard, or 'kash auth set-key' for the bare key. Or set KASH_API_KEY."
+    );
+    return;
+  }
+  print(`${style.success("\u2713")} API key configured (profile: ${config.profile})`);
+  print(
+    `  ${style.dim("Note      ")} not verified against the server \u2014 run \`kash health\` to probe`
+  );
+  print(`  ${style.dim("API key   ")} ${redact(config.apiKey)} (${config.sources.apiKey})`);
+  print(`  ${style.dim("Profile   ")} ${config.profile} (${config.sources.profile})`);
+  print(`  ${style.dim("Base URL  ")} ${config.baseUrl} (${config.sources.baseUrl})`);
+  print(
+    `  ${style.dim("Chain id  ")} ${String(config.defaultChainId)} (${config.sources.defaultChainId})`
+  );
+});
+
+// src/commands/auth/index.ts
+var authCommand = new Command4("auth").description("Manage local API credentials.").addCommand(setKeyCommand).addCommand(statusCommand).addCommand(logoutCommand);
+export {
+  authCommand
+};
+//# sourceMappingURL=auth-GUJCVKTD.js.map

package/dist/auth-GUJCVKTD.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/commands/auth/index.ts","../src/commands/auth/logout.ts","../src/commands/auth/set-key.ts","../src/commands/auth/status.ts"],"sourcesContent":["/**\n * `kash auth` — credential management.\n *\n * Users issue a key from the Kash dashboard and run `auth set-key`\n * (or set `KASH_API_KEY` in their environment). A future browser-based\n * login flow may be added; for now, key issuance lives on the dashboard.\n */\n\nimport { Command } from 'commander';\n\nimport { logoutCommand } from './logout.js';\nimport { setKeyCommand } from './set-key.js';\nimport { statusCommand } from './status.js';\n\nexport const authCommand = new Command('auth')\n  .description('Manage local API credentials.')\n  .addCommand(setKeyCommand)\n  .addCommand(statusCommand)\n  .addCommand(logoutCommand);\n","/**\n * `kash auth logout` — remove the stored API key.\n *\n * Only clears the `apiKey` field; the rest of the config (baseUrl,\n * chain id) survives so logging back in doesn't lose unrelated\n * preferences. If `KASH_API_KEY` is set in the environment, we warn\n * the user that env vars take precedence so the \"logout\" is partial.\n */\n\nimport { Command } from 'commander';\n\nimport { clearConfigField, readConfig } from '../../utils/config-store.js';\nimport { readGlobals } from '../../utils/global-options.js';\nimport { log, printJson } from '../../utils/output.js';\n\nexport const logoutCommand = new Command('logout')\n  .description('Remove the stored API key from ~/.kash/config.json.')\n  .addHelpText(\n    'after',\n    `\nExamples:\n  $ kash auth logout\n  $ kash auth logout --profile staging\n`\n  )\n  .action(async (_opts, cmd: Command) => {\n    const globals = readGlobals(cmd);\n    const scope = {\n      ...(globals.profile === undefined ? {} : { profile: globals.profile }),\n      ...(globals.configPath === undefined ? {} : { configPath: globals.configPath }),\n    };\n    const before = await readConfig(scope);\n    await clearConfigField('apiKey', scope);\n\n    const envWillOverride = Boolean(process.env['KASH_API_KEY']);\n\n    if (globals.json) {\n      printJson({\n        ok: true,\n        profile: before.profile,\n        cleared: Boolean(before.apiKey && before.sources.apiKey === 'file'),\n        envOverride: envWillOverride,\n      });\n      return;\n    }\n\n    if (before.apiKey === undefined) {\n      log.info(`No API key was stored for profile \"${before.profile}\".`);\n    } else {\n      log.success(`API key cleared from profile \"${before.profile}\".`);\n    }\n    if (envWillOverride) {\n      log.warn('KASH_API_KEY is still set in your environment. Unset it to fully log out.');\n    }\n  });\n","/**\n * `kash auth set-key [key]` — store an API key in `~/.kash/config.json`.\n *\n * Three input paths, each leaves no trace of the key in shell history:\n *\n *   1. Positional `<key>` — convenient for one-off use, but shows up\n *      in `~/.bash_history`. Kept for backward compat.\n *   2. `--from-stdin` — pipe a key from a secret-store (`pass kash`,\n *      `1password read`, `aws secretsmanager`, …). The key is\n *      `.trim()`-ed so trailing newlines from the source are ignored.\n *   3. Interactive prompt (no positional, no flag, TTY available) —\n *      reads from stderr-bound readline so the prompt doesn't taint\n *      stdout pipes. Single newline of input.\n *\n * Validates the prefix client-side (the SDK's config schema enforces\n * the same shape, but failing here gives a clearer error than the\n * generic config error chain). The persisted file is `0600`.\n */\n\nimport { Command } from 'commander';\n\nimport { CliValidationError, toCliError } from '../../errors.js';\nimport { setCurrentProfile, updateConfig } from '../../utils/config-store.js';\nimport { redact } from '../../utils/formatting.js';\nimport { readGlobals } from '../../utils/global-options.js';\nimport { log, printJson } from '../../utils/output.js';\n\ntype SetKeyOptions = {\n  fromStdin?: boolean;\n  activate?: boolean;\n};\n\nexport const setKeyCommand = new Command('set-key')\n  .description('Store an API key in ~/.kash/config.json (mode 0600).')\n  .argument('[key]', 'API key starting with \"kash_\" (omit to read from stdin or prompt)')\n  .option('--from-stdin', 'read the key from stdin (preferred for secret-store integration)')\n  .option(\n    '--activate',\n    \"also switch the active profile to the one being written (default: leave the active profile unchanged — `kash auth set-key --profile staging` updates 'staging' but doesn't make it active; pass --activate or run `kash config use staging` separately)\"\n  )\n  .addHelpText(\n    'after',\n    `\nExamples:\n  # Interactive prompt (no shell history footprint).\n  $ kash auth set-key\n\n  # Pipe from a secret store.\n  $ pass show kash/api-key | kash auth set-key --from-stdin\n  $ op read \"op://Private/kash/api-key\" | kash auth set-key --from-stdin\n\n  # Positional (convenient but shows up in ~/.bash_history).\n  $ kash auth set-key kash_live_abc...\n  $ kash auth set-key kash_test_abc... --profile staging\n`\n  )\n  .action(async (positional: string | undefined, options: SetKeyOptions, cmd: Command) => {\n    const globals = readGlobals(cmd);\n    const key = await resolveKey(positional, options);\n\n    if (!key.startsWith('kash_')) {\n      throw new CliValidationError(\n        'API keys must start with \"kash_\".',\n        'Request a `kash_test_*` staging key by emailing `engineering@kash.bot` with your intended use case. Self-service issuance and `kash_live_*` keys land with the production launch.'\n      );\n    }\n    let result;\n    try {\n      result = await updateConfig(\n        { apiKey: key },\n        {\n          ...(globals.profile === undefined ? {} : { profile: globals.profile }),\n          ...(globals.configPath === undefined ? {} : { configPath: globals.configPath }),\n        }\n      );\n      // `--activate` flips the file's `currentProfile` so the next\n      // command picks up this profile without needing\n      // `kash config use <name>`. Mirrors the all-in-one wizard\n      // behaviour of `kash setup`.\n      if (options.activate === true) {\n        await setCurrentProfile(\n          result.profile,\n          globals.configPath === undefined ? undefined : { configPath: globals.configPath }\n        );\n      }\n    } catch (cause) {\n      throw toCliError(cause);\n    }\n\n    if (globals.json) {\n      // Surface the actually-written profile (resolved from --profile,\n      // KASH_PROFILE, file's currentProfile, or \"default\") so the JSON\n      // contract reports truth, not the unresolved flag value.\n      printJson({\n        ok: true,\n        apiKey: redact(key),\n        profile: result.profile,\n        // Whether this run also flipped the file's currentProfile.\n        // Agents driving multi-profile workflows can chain off this\n        // to know if a follow-up `kash config use` is needed.\n        activated: options.activate === true,\n      });\n      return;\n    }\n    log.success(`API key saved to profile \"${result.profile}\" (${redact(key)}).`);\n    log.detail('Location', globals.configPath ?? '~/.kash/config.json (mode 0600)');\n    if (options.activate === true) {\n      log.success(`Active profile is now \"${result.profile}\".`);\n    }\n  });\n\n/**\n * Resolve the API key from the three supported sources. Order:\n *   1. Positional argument (legacy, less secure — still works).\n *   2. `--from-stdin` (read until EOF, trim, single key per stream).\n *   3. Interactive prompt (TTY only).\n *\n * **Mutual-exclusion guard.** Pre-fix, `kash auth set-key <key>\n * --from-stdin` silently used the positional and dropped the piped\n * secret. That's a real footgun: the operator sees \"API key saved\"\n * for the WRONG key (the one on argv, possibly a stale value from\n * shell history). We refuse to guess and require the operator to\n * pick one source.\n */\nasync function resolveKey(positional: string | undefined, options: SetKeyOptions): Promise<string> {\n  if (positional !== undefined && positional !== '' && options.fromStdin === true) {\n    throw new CliValidationError(\n      'Pass either the positional <key> OR --from-stdin, not both.',\n      'The positional key would silently win and the piped value would be dropped.'\n    );\n  }\n  if (positional !== undefined && positional !== '') {\n    return positional;\n  }\n  if (options.fromStdin === true) {\n    return readFromStdin();\n  }\n  if (process.stdin.isTTY) {\n    return promptInteractively();\n  }\n  // No positional, no --from-stdin, no TTY — caller's intent is\n  // ambiguous. Surface a clear validation error rather than reading\n  // stdin silently (which would surprise CI runs that pipe other\n  // data into the command).\n  throw new CliValidationError(\n    'No API key provided.',\n    'Pass the key positionally, use --from-stdin to read it from a pipe, or run interactively for a prompt.'\n  );\n}\n\nasync function readFromStdin(): Promise<string> {\n  // Use the shared BOM-aware reader. Notepad-saved files (and VSCode\n  // with `files.encoding=utf8bom`) prepend U+FEFF; without the strip,\n  // the leading three bytes leak into the API key and fail the\n  // `kash_` prefix check.\n  const { readStdinTrimmed } = await import('../../utils/stdin.js');\n  return readStdinTrimmed();\n}\n\nasync function promptInteractively(): Promise<string> {\n  // Use the masked-input prompt so the key never echoes to the\n  // terminal (defends against shoulder-surfing, screen recordings,\n  // and scroll-back capture). The previous `readline.question` path\n  // echoed every keystroke which defeated the \"no shell history\"\n  // promise of this command. Lazy-load `@inquirer/prompts` to keep\n  // it off the cold path for non-interactive invocations.\n  const { password } = await import('@inquirer/prompts');\n  const answer = await password({\n    message: 'Paste your API key (kash_live_… or kash_test_…):',\n    mask: '*',\n  });\n  return answer.trim();\n}\n","/**\n * `kash auth status` — report the locally-stored credentials.\n *\n * Does NOT call the API. There is no `whoami` endpoint on the public\n * API today (the only auth-flavoured route is webhook-secret rotation,\n * which is a write). Reporting purely-local state keeps the command\n * cheap and side-effect-free; the moment the user issues a real call\n * (e.g. `kash markets list`) the SDK raises `KashAuthenticationError`\n * if the key is invalid.\n */\n\nimport { Command } from 'commander';\n\nimport { readConfig } from '../../utils/config-store.js';\nimport { redact } from '../../utils/formatting.js';\nimport { readGlobals } from '../../utils/global-options.js';\nimport { log, print, printJson, style } from '../../utils/output.js';\n\nexport const statusCommand = new Command('status')\n  .description('Show locally-configured credentials. Does not call the API.')\n  .addHelpText(\n    'after',\n    `\nExamples:\n  $ kash auth status\n  $ kash auth status --profile prod\n  $ kash auth status --json --quiet | jq -r '.apiKey'\n`\n  )\n  .action(async (_opts, cmd: Command) => {\n    const globals = readGlobals(cmd);\n    const config = await readConfig({\n      ...(globals.profile === undefined ? {} : { profile: globals.profile }),\n      ...(globals.configPath === undefined ? {} : { configPath: globals.configPath }),\n    });\n\n    if (globals.json) {\n      printJson({\n        // Pure local-state field. `true` means \"an API key is in\n        // scope for this profile\" (file or env), NOT \"this key is\n        // accepted by the server\" — `kash auth status` is offline by\n        // design. Use `kash health --json --quiet | jq .ok` for a\n        // server-side check.\n        configured: Boolean(config.apiKey),\n        // Backward-compat alias. Same value as `configured`. Kept\n        // for downstream scripts that pin to the old field name —\n        // will be removed in a major bump after the rename has\n        // burned in.\n        authenticated: Boolean(config.apiKey),\n        apiKey: config.apiKey ? redact(config.apiKey) : null,\n        profile: config.profile,\n        baseUrl: config.baseUrl,\n        defaultChainId: config.defaultChainId,\n        // Direct-mode fields (`kash protocol …` / `kash eoa …`). Always\n        // emitted (`null` when unset) so direct-mode operators can\n        // introspect their own profile via JSON without falling back\n        // to reading `~/.kash/config.json` directly. The signerKeyRef\n        // is the reference shape (`file:<path>` / `env:<NAME>`),\n        // never the raw private key — the CLI never persists keys.\n        rpcUrl: config.rpcUrl ?? null,\n        smartAccount: config.smartAccount ?? null,\n        bundlerUrl: config.bundlerUrl ?? null,\n        bundlerProvider: config.bundlerProvider ?? null,\n        signerKeyRef: config.signerKeyRef ?? null,\n        sources: config.sources,\n      });\n      return;\n    }\n\n    if (!config.apiKey) {\n      log.warn(`No API key configured for profile \"${config.profile}\".`);\n      log.detail(\n        'Hint',\n        \"Run 'kash setup' for the wizard, or 'kash auth set-key' for the bare key. Or set KASH_API_KEY.\"\n      );\n      return;\n    }\n\n    print(`${style.success('✓')} API key configured (profile: ${config.profile})`);\n    print(\n      `  ${style.dim('Note      ')} not verified against the server — run \\`kash health\\` to probe`\n    );\n    print(`  ${style.dim('API key   ')} ${redact(config.apiKey)} (${config.sources.apiKey})`);\n    print(`  ${style.dim('Profile   ')} ${config.profile} (${config.sources.profile})`);\n    print(`  ${style.dim('Base URL  ')} ${config.baseUrl} (${config.sources.baseUrl})`);\n    print(\n      `  ${style.dim('Chain id  ')} ${String(config.defaultChainId)} (${config.sources.defaultChainId})`\n    );\n  });\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAQA,SAAS,WAAAA,gBAAe;;;ACCxB,SAAS,eAAe;AAMjB,IAAM,gBAAgB,IAAI,QAAQ,QAAQ,EAC9C,YAAY,qDAAqD,EACjE;AAAA,EACC;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAKF,EACC,OAAO,OAAO,OAAO,QAAiB;AACrC,QAAM,UAAU,YAAY,GAAG;AAC/B,QAAM,QAAQ;AAAA,IACZ,GAAI,QAAQ,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;AAAA,IACpE,GAAI,QAAQ,eAAe,SAAY,CAAC,IAAI,EAAE,YAAY,QAAQ,WAAW;AAAA,EAC/E;AACA,QAAM,SAAS,MAAM,WAAW,KAAK;AACrC,QAAM,iBAAiB,UAAU,KAAK;AAEtC,QAAM,kBAAkB,QAAQ,QAAQ,IAAI,cAAc,CAAC;AAE3D,MAAI,QAAQ,MAAM;AAChB,cAAU;AAAA,MACR,IAAI;AAAA,MACJ,SAAS,OAAO;AAAA,MAChB,SAAS,QAAQ,OAAO,UAAU,OAAO,QAAQ,WAAW,MAAM;AAAA,MAClE,aAAa;AAAA,IACf,CAAC;AACD;AAAA,EACF;AAEA,MAAI,OAAO,WAAW,QAAW;AAC/B,QAAI,KAAK,sCAAsC,OAAO,OAAO,IAAI;AAAA,EACnE,OAAO;AACL,QAAI,QAAQ,iCAAiC,OAAO,OAAO,IAAI;AAAA,EACjE;AACA,MAAI,iBAAiB;AACnB,QAAI,KAAK,2EAA2E;AAAA,EACtF;AACF,CAAC;;;ACnCH,SAAS,WAAAC,gBAAe;AAajB,IAAM,gBAAgB,IAAIC,SAAQ,SAAS,EAC/C,YAAY,sDAAsD,EAClE,SAAS,SAAS,mEAAmE,EACrF,OAAO,gBAAgB,kEAAkE,EACzF;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAaF,EACC,OAAO,OAAO,YAAgC,SAAwB,QAAiB;AACtF,QAAM,UAAU,YAAY,GAAG;AAC/B,QAAM,MAAM,MAAM,WAAW,YAAY,OAAO;AAEhD,MAAI,CAAC,IAAI,WAAW,OAAO,GAAG;AAC5B,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI;AACJ,MAAI;AACF,aAAS,MAAM;AAAA,MACb,EAAE,QAAQ,IAAI;AAAA,MACd;AAAA,QACE,GAAI,QAAQ,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;AAAA,QACpE,GAAI,QAAQ,eAAe,SAAY,CAAC,IAAI,EAAE,YAAY,QAAQ,WAAW;AAAA,MAC/E;AAAA,IACF;AAKA,QAAI,QAAQ,aAAa,MAAM;AAC7B,YAAM;AAAA,QACJ,OAAO;AAAA,QACP,QAAQ,eAAe,SAAY,SAAY,EAAE,YAAY,QAAQ,WAAW;AAAA,MAClF;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,UAAM,WAAW,KAAK;AAAA,EACxB;AAEA,MAAI,QAAQ,MAAM;AAIhB,cAAU;AAAA,MACR,IAAI;AAAA,MACJ,QAAQ,OAAO,GAAG;AAAA,MAClB,SAAS,OAAO;AAAA;AAAA;AAAA;AAAA,MAIhB,WAAW,QAAQ,aAAa;AAAA,IAClC,CAAC;AACD;AAAA,EACF;AACA,MAAI,QAAQ,6BAA6B,OAAO,OAAO,MAAM,OAAO,GAAG,CAAC,IAAI;AAC5E,MAAI,OAAO,YAAY,QAAQ,cAAc,iCAAiC;AAC9E,MAAI,QAAQ,aAAa,MAAM;AAC7B,QAAI,QAAQ,0BAA0B,OAAO,OAAO,IAAI;AAAA,EAC1D;AACF,CAAC;AAeH,eAAe,WAAW,YAAgC,SAAyC;AACjG,MAAI,eAAe,UAAa,eAAe,MAAM,QAAQ,cAAc,MAAM;AAC/E,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,eAAe,UAAa,eAAe,IAAI;AACjD,WAAO;AAAA,EACT;AACA,MAAI,QAAQ,cAAc,MAAM;AAC9B,WAAO,cAAc;AAAA,EACvB;AACA,MAAI,QAAQ,MAAM,OAAO;AACvB,WAAO,oBAAoB;AAAA,EAC7B;AAKA,QAAM,IAAI;AAAA,IACR;AAAA,IACA;AAAA,EACF;AACF;AAEA,eAAe,gBAAiC;AAK9C,QAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,qBAAsB;AAChE,SAAO,iBAAiB;AAC1B;AAEA,eAAe,sBAAuC;AAOpD,QAAM,EAAE,SAAS,IAAI,MAAM,OAAO,mBAAmB;AACrD,QAAM,SAAS,MAAM,SAAS;AAAA,IAC5B,SAAS;AAAA,IACT,MAAM;AAAA,EACR,CAAC;AACD,SAAO,OAAO,KAAK;AACrB;;;ACjKA,SAAS,WAAAC,gBAAe;AAOjB,IAAM,gBAAgB,IAAIC,SAAQ,QAAQ,EAC9C,YAAY,6DAA6D,EACzE;AAAA,EACC;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAMF,EACC,OAAO,OAAO,OAAO,QAAiB;AACrC,QAAM,UAAU,YAAY,GAAG;AAC/B,QAAM,SAAS,MAAM,WAAW;AAAA,IAC9B,GAAI,QAAQ,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;AAAA,IACpE,GAAI,QAAQ,eAAe,SAAY,CAAC,IAAI,EAAE,YAAY,QAAQ,WAAW;AAAA,EAC/E,CAAC;AAED,MAAI,QAAQ,MAAM;AAChB,cAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAMR,YAAY,QAAQ,OAAO,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA,MAKjC,eAAe,QAAQ,OAAO,MAAM;AAAA,MACpC,QAAQ,OAAO,SAAS,OAAO,OAAO,MAAM,IAAI;AAAA,MAChD,SAAS,OAAO;AAAA,MAChB,SAAS,OAAO;AAAA,MAChB,gBAAgB,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAOvB,QAAQ,OAAO,UAAU;AAAA,MACzB,cAAc,OAAO,gBAAgB;AAAA,MACrC,YAAY,OAAO,cAAc;AAAA,MACjC,iBAAiB,OAAO,mBAAmB;AAAA,MAC3C,cAAc,OAAO,gBAAgB;AAAA,MACrC,SAAS,OAAO;AAAA,IAClB,CAAC;AACD;AAAA,EACF;AAEA,MAAI,CAAC,OAAO,QAAQ;AAClB,QAAI,KAAK,sCAAsC,OAAO,OAAO,IAAI;AACjE,QAAI;AAAA,MACF;AAAA,MACA;AAAA,IACF;AACA;AAAA,EACF;AAEA,QAAM,GAAG,MAAM,QAAQ,QAAG,CAAC,iCAAiC,OAAO,OAAO,GAAG;AAC7E;AAAA,IACE,KAAK,MAAM,IAAI,YAAY,CAAC;AAAA,EAC9B;AACA,QAAM,KAAK,MAAM,IAAI,YAAY,CAAC,IAAI,OAAO,OAAO,MAAM,CAAC,KAAK,OAAO,QAAQ,MAAM,GAAG;AACxF,QAAM,KAAK,MAAM,IAAI,YAAY,CAAC,IAAI,OAAO,OAAO,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClF,QAAM,KAAK,MAAM,IAAI,YAAY,CAAC,IAAI,OAAO,OAAO,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClF;AAAA,IACE,KAAK,MAAM,IAAI,YAAY,CAAC,IAAI,OAAO,OAAO,cAAc,CAAC,KAAK,OAAO,QAAQ,cAAc;AAAA,EACjG;AACF,CAAC;;;AH1EI,IAAM,cAAc,IAAIC,SAAQ,MAAM,EAC1C,YAAY,+BAA+B,EAC3C,WAAW,aAAa,EACxB,WAAW,aAAa,EACxB,WAAW,aAAa;","names":["Command","Command","Command","Command","Command","Command"]}

package/dist/chunk-BN2CUM42.js

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+
+// src/version.ts
+var CLI_VERSION = "0.1.0";
+
+export {
+  CLI_VERSION
+};
+//# sourceMappingURL=chunk-BN2CUM42.js.map

package/dist/chunk-BN2CUM42.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/version.ts"],"sourcesContent":["/**\n * Package version stamp.\n *\n * Hardcoded rather than imported from `package.json` because:\n *\n *   1. JSON imports vary across runtimes; the bundled CLI must work\n *      under Node 22+ regardless of how the consumer's tsconfig is\n *      shaped.\n *   2. tsup's JSON-bundling behaviour is bundler-version-specific and\n *      we'd rather not depend on it.\n *   3. A simple constant is auditable: `git grep CLI_VERSION` finds\n *      every reference instantly.\n *\n * **Maintenance**: bumped in lockstep with `package.json#version` by\n * the changesets release flow. The unit test in\n * `tests/unit/version.test.ts` reads `package.json` and asserts the\n * two stay in sync, so a forgotten bump fails CI before the bad\n * release ships to npm.\n */\nexport const CLI_VERSION = '0.1.0';\n"],"mappings":";;;AAmBO,IAAM,cAAc;","names":[]}

package/dist/chunk-BRK7KJ4O.js

@@ -0,0 +1,154 @@
+#!/usr/bin/env node
+import {
+  style
+} from "./chunk-VIADBYFY.js";
+
+// src/utils/formatting.ts
+import Table from "cli-table3";
+var ELLIPSIS = "...";
+function codepointSlice(s, start, end) {
+  return Array.from(s).slice(start, end).join("");
+}
+function codepointLength(s) {
+  return Array.from(s).length;
+}
+function shortId(id, prefix = 8) {
+  if (codepointLength(id) <= prefix + ELLIPSIS.length) return id;
+  return `${codepointSlice(id, 0, prefix)}${ELLIPSIS}`;
+}
+function truncate(s, max) {
+  return codepointLength(s) > max ? `${codepointSlice(s, 0, max - ELLIPSIS.length)}${ELLIPSIS}` : s;
+}
+function redact(key) {
+  if (codepointLength(key) <= 8) return "***";
+  return `${codepointSlice(key, 0, 8)}${ELLIPSIS}${codepointSlice(key, -4)}`;
+}
+function capitalize(s) {
+  if (s.length === 0) return s;
+  return s.charAt(0).toUpperCase() + s.slice(1);
+}
+function formatAddress(address, lead = 6, tail = 4) {
+  if (codepointLength(address) <= lead + tail + ELLIPSIS.length) return address;
+  return `${codepointSlice(address, 0, lead)}${ELLIPSIS}${codepointSlice(address, -tail)}`;
+}
+function formatDate(value) {
+  if (!value) return "-";
+  const d = typeof value === "string" ? new Date(value) : value;
+  if (Number.isNaN(d.getTime())) return "-";
+  return d.toLocaleString();
+}
+function formatUsdcAtomic(atomic) {
+  if (typeof atomic === "string" && atomic.includes(".")) {
+    const n = Number.parseFloat(atomic);
+    if (Number.isNaN(n)) return "$0.00";
+    return n.toLocaleString("en-US", {
+      style: "currency",
+      currency: "USD",
+      minimumFractionDigits: 2,
+      maximumFractionDigits: 2
+    });
+  }
+  let big;
+  try {
+    big = typeof atomic === "bigint" ? atomic : BigInt(atomic);
+  } catch {
+    return "$0.00";
+  }
+  const negative = big < 0n;
+  const abs = negative ? -big : big;
+  const whole = abs / 1000000n;
+  const frac = abs % 1000000n;
+  const wholeStr = whole.toLocaleString("en-US");
+  const cents = (frac / 10000n).toString().padStart(2, "0");
+  return `${negative ? "-" : ""}$${wholeStr}.${cents}`;
+}
+function formatUsdcDecimal(value) {
+  const n = Number.parseFloat(value);
+  if (Number.isNaN(n)) return value;
+  return n.toLocaleString("en-US", {
+    style: "currency",
+    currency: "USD",
+    minimumFractionDigits: 2,
+    maximumFractionDigits: 2
+  });
+}
+function formatProbability(p) {
+  if (p === null || p === void 0 || Number.isNaN(p)) return "-";
+  return `${(p * 100).toFixed(1)}%`;
+}
+function formatBigDecimal(value, options) {
+  const { baseDecimals, displayDecimals } = options;
+  const useThousandSeparator = options.thousandSeparator ?? true;
+  let big;
+  try {
+    big = typeof value === "bigint" ? value : BigInt(value);
+  } catch {
+    return typeof value === "string" ? value : "0";
+  }
+  const negative = big < 0n;
+  const abs = negative ? -big : big;
+  const baseScale = 10n ** BigInt(baseDecimals);
+  const whole = abs / baseScale;
+  const frac = abs % baseScale;
+  const truncated = (frac / 10n ** BigInt(baseDecimals - displayDecimals)).toString().padStart(displayDecimals, "0");
+  const wholeStr = useThousandSeparator ? whole.toLocaleString("en-US") : whole.toString();
+  return `${negative ? "-" : ""}${wholeStr}.${truncated}`;
+}
+function formatWad(wad) {
+  return formatBigDecimal(wad, { baseDecimals: 18, displayDecimals: 4 });
+}
+function formatGwei(wei) {
+  return formatBigDecimal(wei, {
+    baseDecimals: 9,
+    displayDecimals: 3,
+    thousandSeparator: false
+  });
+}
+function colorStatus(value) {
+  if (!value) return style.dim("-");
+  switch (value.toUpperCase()) {
+    case "ACTIVE":
+    case "COMPLETED":
+      return style.success(value);
+    case "EXECUTING":
+    case "VALIDATING":
+    case "PENDING":
+      return style.cyan(value);
+    case "PENDING_CONFIRMATION":
+      return style.warn(value);
+    case "RESOLVED":
+      return style.info(value);
+    case "REJECTED":
+    case "FAILED":
+      return style.error(value);
+    case "UNSEEDED":
+    case "FROZEN":
+      return style.dim(value);
+    default:
+      return value;
+  }
+}
+function createTable(headers) {
+  return new Table({
+    head: headers.map((h) => style.bold(h)),
+    style: { head: [], border: [] }
+  });
+}
+
+export {
+  shortId,
+  truncate,
+  redact,
+  capitalize,
+  formatAddress,
+  formatDate,
+  formatUsdcAtomic,
+  formatUsdcDecimal,
+  formatProbability,
+  formatBigDecimal,
+  formatWad,
+  formatGwei,
+  colorStatus,
+  createTable
+};
+//# sourceMappingURL=chunk-BRK7KJ4O.js.map