@kashdao/cli 0.1.0

package/dist/chunk-BRK7KJ4O.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/utils/formatting.ts"],"sourcesContent":["/**\n * Display formatters: tables, addresses, USDC amounts, status colors.\n *\n * Atomic USDC values from the API are integer strings (6 decimals). The\n * SDK does not assume a math library, so we format with simple integer\n * division here — the precision constraint is purely cosmetic.\n */\n\nimport Table from 'cli-table3';\n\nimport { style } from './output.js';\n\n/**\n * ASCII ellipsis used for all truncation glyphs. We use three dots\n * rather than the Unicode horizontal-ellipsis (U+2026) because the\n * latter renders as `?` on Windows cmd.exe and in restricted locales\n * — `gh`, `aws`, and `stripe` all standardise on ASCII.\n */\nconst ELLIPSIS = '...';\n\n/**\n * Code-point-safe slice. `String.prototype.slice` operates on UTF-16\n * code units, so an emoji or other surrogate pair near a boundary\n * could split. None of the inputs we slice (API keys, hex addresses,\n * UUIDs) carry surrogates today — but defensive slicing matches\n * `gh`/`aws` and the cost is negligible.\n */\nfunction codepointSlice(s: string, start: number, end?: number): string {\n  return Array.from(s).slice(start, end).join('');\n}\n\nfunction codepointLength(s: string): number {\n  return Array.from(s).length;\n}\n\n/** Truncate a UUID/long ID to \"abcdef12...\" for tables. */\nexport function shortId(id: string, prefix = 8): string {\n  if (codepointLength(id) <= prefix + ELLIPSIS.length) return id;\n  return `${codepointSlice(id, 0, prefix)}${ELLIPSIS}`;\n}\n\n/**\n * Truncate a free-form string to fit within a column. Appends an\n * ellipsis when shortened so the user sees that data was elided.\n * Different from `shortId`, which uses a leading-prefix heuristic\n * suited to UUIDs and tx hashes.\n */\nexport function truncate(s: string, max: number): string {\n  return codepointLength(s) > max ? `${codepointSlice(s, 0, max - ELLIPSIS.length)}${ELLIPSIS}` : s;\n}\n\n/**\n * Redact an API key for display. Always shows enough leading\n * characters (`kash_live_` / `kash_test_` prefix) to confirm the key\n * type, plus the last four characters so users can match it to a\n * value they have on record. Inputs shorter than 8 characters are\n * masked entirely so we never accidentally leak a partial key from\n * truncated input.\n */\nexport function redact(key: string): string {\n  if (codepointLength(key) <= 8) return '***';\n  return `${codepointSlice(key, 0, 8)}${ELLIPSIS}${codepointSlice(key, -4)}`;\n}\n\n/** Capitalise the first letter. Empty strings pass through. */\nexport function capitalize(s: string): string {\n  if (s.length === 0) return s;\n  return s.charAt(0).toUpperCase() + s.slice(1);\n}\n\n/** Format an EVM address as `0x1234...abcd`. */\nexport function formatAddress(address: string, lead = 6, tail = 4): string {\n  if (codepointLength(address) <= lead + tail + ELLIPSIS.length) return address;\n  return `${codepointSlice(address, 0, lead)}${ELLIPSIS}${codepointSlice(address, -tail)}`;\n}\n\n/** Format a UTC ISO string as a local-readable date+time. */\nexport function formatDate(value: string | Date | null | undefined): string {\n  if (!value) return '-';\n  const d = typeof value === 'string' ? new Date(value) : value;\n  if (Number.isNaN(d.getTime())) return '-';\n  return d.toLocaleString();\n}\n\n/**\n * Format a USDC value as `$1,234.56`.\n *\n * Two input shapes are accepted:\n *\n *   1. **Atomic** — bigint, integer string, or finite Number,\n *      interpreted as micro-USDC (6 decimals). This is the canonical\n *      shape on every API response (`totalCostBasisAtomic`,\n *      `tokensOut`, etc.). Formatted with bigint math so values past\n *      Number.MAX_SAFE_INTEGER round-trip exactly.\n *   2. **Decimal string** — only used by analytics endpoints that\n *      return human-formatted dollar amounts (e.g. `\"1234.56\"`).\n *      These pass through `Number.parseFloat`, which means values\n *      with more than ~15 significant decimal digits round at IEEE-754\n *      precision. This is acceptable for *display* (the underlying\n *      authoritative value is always atomic), but consumers writing\n *      reconciliation logic should call the upstream atomic field\n *      directly rather than re-parsing a formatted decimal.\n *\n * The atomic branch rounds the cents column **toward zero** (cheaper\n * than half-even for tables; the trade engine reconciles to atomic\n * precision elsewhere). Cosmetic only.\n */\nexport function formatUsdcAtomic(atomic: string | bigint | number): string {\n  if (typeof atomic === 'string' && atomic.includes('.')) {\n    // Decimal-string branch (analytics only). Documented loss: values\n    // > 15 significant digits round at parseFloat precision.\n    const n = Number.parseFloat(atomic);\n    if (Number.isNaN(n)) return '$0.00';\n    return n.toLocaleString('en-US', {\n      style: 'currency',\n      currency: 'USD',\n      minimumFractionDigits: 2,\n      maximumFractionDigits: 2,\n    });\n  }\n  let big: bigint;\n  try {\n    big = typeof atomic === 'bigint' ? atomic : BigInt(atomic);\n  } catch {\n    return '$0.00';\n  }\n  const negative = big < 0n;\n  const abs = negative ? -big : big;\n  const whole = abs / 1_000_000n;\n  const frac = abs % 1_000_000n;\n  const wholeStr = whole.toLocaleString('en-US');\n  const cents = (frac / 10_000n).toString().padStart(2, '0');\n  return `${negative ? '-' : ''}$${wholeStr}.${cents}`;\n}\n\n/**\n * Format a human USDC decimal string (e.g. `'12.5'`) as `$12.50`.\n * Used when the API hands back already-decimal amounts (the trade\n * resource's `amount` field).\n */\nexport function formatUsdcDecimal(value: string): string {\n  const n = Number.parseFloat(value);\n  if (Number.isNaN(n)) return value;\n  return n.toLocaleString('en-US', {\n    style: 'currency',\n    currency: 'USD',\n    minimumFractionDigits: 2,\n    maximumFractionDigits: 2,\n  });\n}\n\n/** Format a probability in [0,1] as a percentage string. */\nexport function formatProbability(p: number | null | undefined): string {\n  if (p === null || p === undefined || Number.isNaN(p)) return '-';\n  return `${(p * 100).toFixed(1)}%`;\n}\n\n/**\n * Generic fixed-point bigint→decimal-display formatter. Used by every\n * CLI helper that needs to render an atomic-units bigint (WAD-18,\n * gwei-9, ETH-18, USDC-6) as a human-readable decimal string.\n *\n * Two parameters control shape:\n *\n *   - `baseDecimals` — the unit's atomic precision (18 for WAD/ETH,\n *     9 for gwei, 6 for USDC).\n *   - `displayDecimals` — how many fractional digits to emit. Must\n *     be ≤ `baseDecimals`. Truncates rather than rounds — display\n *     only, `--json` preserves the full atomic-string precision.\n *\n * Sign is extracted before the magnitude split so `-` rendering\n * lives at one site. The whole part is rendered with thousand-\n * separator commas via `toLocaleString` (consistent with\n * `formatUsdcAtomic`); call sites that need the raw integer-shape\n * (e.g. `formatGwei`'s historical \"no commas\" form) opt out via\n * `thousandSeparator: false`.\n *\n * Accepts `string | bigint` for the same reason `formatWad` did:\n * direct-mode SDKs return `bigint`, indexer-backed views return\n * integer-string. The `try/catch` around `BigInt(value)` is the\n * defensive never-throw guarantee on display paths — a malformed\n * input falls through to the input itself rather than crashing.\n */\nexport function formatBigDecimal(\n  value: string | bigint,\n  options: { baseDecimals: number; displayDecimals: number; thousandSeparator?: boolean }\n): string {\n  const { baseDecimals, displayDecimals } = options;\n  const useThousandSeparator = options.thousandSeparator ?? true;\n  let big: bigint;\n  try {\n    big = typeof value === 'bigint' ? value : BigInt(value);\n  } catch {\n    return typeof value === 'string' ? value : '0';\n  }\n  const negative = big < 0n;\n  const abs = negative ? -big : big;\n  const baseScale = 10n ** BigInt(baseDecimals);\n  const whole = abs / baseScale;\n  const frac = abs % baseScale;\n  const truncated = (frac / 10n ** BigInt(baseDecimals - displayDecimals))\n    .toString()\n    .padStart(displayDecimals, '0');\n  const wholeStr = useThousandSeparator ? whole.toLocaleString('en-US') : whole.toString();\n  return `${negative ? '-' : ''}${wholeStr}.${truncated}`;\n}\n\n/**\n * Format a WAD-18 (1e18) value as a 4-decimal token display string.\n * Twin of `formatUsdcAtomic` but for outcome-token quantities.\n * Direct-mode SDK returns bigint; indexer-backed views return string.\n */\nexport function formatWad(wad: string | bigint): string {\n  return formatBigDecimal(wad, { baseDecimals: 18, displayDecimals: 4 });\n}\n\n/**\n * Format a wei bigint as a 3-decimal gwei display string. Used by\n * direct-mode commands that emit gas balances and fee estimates.\n * Truncates rather than rounds — fees are display-only and operators\n * who need exact wei should use `--json` (which preserves the bigint\n * as a decimal string).\n *\n * No thousand-separator on the whole part: the gwei convention in\n * the broader EVM ecosystem (etherscan, foundry, viem's display\n * helpers) renders bare integers, and operators piping our output\n * through `awk '{print $2 + 0}'` or similar rely on it.\n */\nexport function formatGwei(wei: bigint): string {\n  return formatBigDecimal(wei, {\n    baseDecimals: 9,\n    displayDecimals: 3,\n    thousandSeparator: false,\n  });\n}\n\n/** Apply a status color (green/yellow/red/blue/gray) by status string. */\nexport function colorStatus(value: string | null | undefined): string {\n  if (!value) return style.dim('-');\n  switch (value.toUpperCase()) {\n    case 'ACTIVE':\n    case 'COMPLETED':\n      return style.success(value);\n    case 'EXECUTING':\n    case 'VALIDATING':\n    case 'PENDING':\n      return style.cyan(value);\n    case 'PENDING_CONFIRMATION':\n      return style.warn(value);\n    case 'RESOLVED':\n      return style.info(value);\n    case 'REJECTED':\n    case 'FAILED':\n      return style.error(value);\n    case 'UNSEEDED':\n    case 'FROZEN':\n      return style.dim(value);\n    default:\n      return value;\n  }\n}\n\n/** Build a cli-table3 with bold headers and consistent style. */\nexport function createTable(headers: string[]): Table.Table {\n  return new Table({\n    head: headers.map((h) => style.bold(h)),\n    style: { head: [], border: [] },\n  });\n}\n"],"mappings":";;;;;;AAQA,OAAO,WAAW;AAUlB,IAAM,WAAW;AASjB,SAAS,eAAe,GAAW,OAAe,KAAsB;AACtE,SAAO,MAAM,KAAK,CAAC,EAAE,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE;AAChD;AAEA,SAAS,gBAAgB,GAAmB;AAC1C,SAAO,MAAM,KAAK,CAAC,EAAE;AACvB;AAGO,SAAS,QAAQ,IAAY,SAAS,GAAW;AACtD,MAAI,gBAAgB,EAAE,KAAK,SAAS,SAAS,OAAQ,QAAO;AAC5D,SAAO,GAAG,eAAe,IAAI,GAAG,MAAM,CAAC,GAAG,QAAQ;AACpD;AAQO,SAAS,SAAS,GAAW,KAAqB;AACvD,SAAO,gBAAgB,CAAC,IAAI,MAAM,GAAG,eAAe,GAAG,GAAG,MAAM,SAAS,MAAM,CAAC,GAAG,QAAQ,KAAK;AAClG;AAUO,SAAS,OAAO,KAAqB;AAC1C,MAAI,gBAAgB,GAAG,KAAK,EAAG,QAAO;AACtC,SAAO,GAAG,eAAe,KAAK,GAAG,CAAC,CAAC,GAAG,QAAQ,GAAG,eAAe,KAAK,EAAE,CAAC;AAC1E;AAGO,SAAS,WAAW,GAAmB;AAC5C,MAAI,EAAE,WAAW,EAAG,QAAO;AAC3B,SAAO,EAAE,OAAO,CAAC,EAAE,YAAY,IAAI,EAAE,MAAM,CAAC;AAC9C;AAGO,SAAS,cAAc,SAAiB,OAAO,GAAG,OAAO,GAAW;AACzE,MAAI,gBAAgB,OAAO,KAAK,OAAO,OAAO,SAAS,OAAQ,QAAO;AACtE,SAAO,GAAG,eAAe,SAAS,GAAG,IAAI,CAAC,GAAG,QAAQ,GAAG,eAAe,SAAS,CAAC,IAAI,CAAC;AACxF;AAGO,SAAS,WAAW,OAAiD;AAC1E,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,IAAI,OAAO,UAAU,WAAW,IAAI,KAAK,KAAK,IAAI;AACxD,MAAI,OAAO,MAAM,EAAE,QAAQ,CAAC,EAAG,QAAO;AACtC,SAAO,EAAE,eAAe;AAC1B;AAyBO,SAAS,iBAAiB,QAA0C;AACzE,MAAI,OAAO,WAAW,YAAY,OAAO,SAAS,GAAG,GAAG;AAGtD,UAAM,IAAI,OAAO,WAAW,MAAM;AAClC,QAAI,OAAO,MAAM,CAAC,EAAG,QAAO;AAC5B,WAAO,EAAE,eAAe,SAAS;AAAA,MAC/B,OAAO;AAAA,MACP,UAAU;AAAA,MACV,uBAAuB;AAAA,MACvB,uBAAuB;AAAA,IACzB,CAAC;AAAA,EACH;AACA,MAAI;AACJ,MAAI;AACF,UAAM,OAAO,WAAW,WAAW,SAAS,OAAO,MAAM;AAAA,EAC3D,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,WAAW,MAAM;AACvB,QAAM,MAAM,WAAW,CAAC,MAAM;AAC9B,QAAM,QAAQ,MAAM;AACpB,QAAM,OAAO,MAAM;AACnB,QAAM,WAAW,MAAM,eAAe,OAAO;AAC7C,QAAM,SAAS,OAAO,QAAS,SAAS,EAAE,SAAS,GAAG,GAAG;AACzD,SAAO,GAAG,WAAW,MAAM,EAAE,IAAI,QAAQ,IAAI,KAAK;AACpD;AAOO,SAAS,kBAAkB,OAAuB;AACvD,QAAM,IAAI,OAAO,WAAW,KAAK;AACjC,MAAI,OAAO,MAAM,CAAC,EAAG,QAAO;AAC5B,SAAO,EAAE,eAAe,SAAS;AAAA,IAC/B,OAAO;AAAA,IACP,UAAU;AAAA,IACV,uBAAuB;AAAA,IACvB,uBAAuB;AAAA,EACzB,CAAC;AACH;AAGO,SAAS,kBAAkB,GAAsC;AACtE,MAAI,MAAM,QAAQ,MAAM,UAAa,OAAO,MAAM,CAAC,EAAG,QAAO;AAC7D,SAAO,IAAI,IAAI,KAAK,QAAQ,CAAC,CAAC;AAChC;AA4BO,SAAS,iBACd,OACA,SACQ;AACR,QAAM,EAAE,cAAc,gBAAgB,IAAI;AAC1C,QAAM,uBAAuB,QAAQ,qBAAqB;AAC1D,MAAI;AACJ,MAAI;AACF,UAAM,OAAO,UAAU,WAAW,QAAQ,OAAO,KAAK;AAAA,EACxD,QAAQ;AACN,WAAO,OAAO,UAAU,WAAW,QAAQ;AAAA,EAC7C;AACA,QAAM,WAAW,MAAM;AACvB,QAAM,MAAM,WAAW,CAAC,MAAM;AAC9B,QAAM,YAAY,OAAO,OAAO,YAAY;AAC5C,QAAM,QAAQ,MAAM;AACpB,QAAM,OAAO,MAAM;AACnB,QAAM,aAAa,OAAO,OAAO,OAAO,eAAe,eAAe,GACnE,SAAS,EACT,SAAS,iBAAiB,GAAG;AAChC,QAAM,WAAW,uBAAuB,MAAM,eAAe,OAAO,IAAI,MAAM,SAAS;AACvF,SAAO,GAAG,WAAW,MAAM,EAAE,GAAG,QAAQ,IAAI,SAAS;AACvD;AAOO,SAAS,UAAU,KAA8B;AACtD,SAAO,iBAAiB,KAAK,EAAE,cAAc,IAAI,iBAAiB,EAAE,CAAC;AACvE;AAcO,SAAS,WAAW,KAAqB;AAC9C,SAAO,iBAAiB,KAAK;AAAA,IAC3B,cAAc;AAAA,IACd,iBAAiB;AAAA,IACjB,mBAAmB;AAAA,EACrB,CAAC;AACH;AAGO,SAAS,YAAY,OAA0C;AACpE,MAAI,CAAC,MAAO,QAAO,MAAM,IAAI,GAAG;AAChC,UAAQ,MAAM,YAAY,GAAG;AAAA,IAC3B,KAAK;AAAA,IACL,KAAK;AACH,aAAO,MAAM,QAAQ,KAAK;AAAA,IAC5B,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO,MAAM,KAAK,KAAK;AAAA,IACzB,KAAK;AACH,aAAO,MAAM,KAAK,KAAK;AAAA,IACzB,KAAK;AACH,aAAO,MAAM,KAAK,KAAK;AAAA,IACzB,KAAK;AAAA,IACL,KAAK;AACH,aAAO,MAAM,MAAM,KAAK;AAAA,IAC1B,KAAK;AAAA,IACL,KAAK;AACH,aAAO,MAAM,IAAI,KAAK;AAAA,IACxB;AACE,aAAO;AAAA,EACX;AACF;AAGO,SAAS,YAAY,SAAgC;AAC1D,SAAO,IAAI,MAAM;AAAA,IACf,MAAM,QAAQ,IAAI,CAAC,MAAM,MAAM,KAAK,CAAC,CAAC;AAAA,IACtC,OAAO,EAAE,MAAM,CAAC,GAAG,QAAQ,CAAC,EAAE;AAAA,EAChC,CAAC;AACH;","names":[]}

package/dist/chunk-KMBMQIZ7.js

@@ -0,0 +1,393 @@
+#!/usr/bin/env node
+import {
+  HEX_ADDRESS_REGEX
+} from "./chunk-YHCG2SUC.js";
+import {
+  CliConfigurationError
+} from "./chunk-UZNSYATZ.js";
+
+// src/utils/config-store.ts
+import { existsSync } from "fs";
+import { chmod, mkdir, readFile, unlink, writeFile } from "fs/promises";
+import { homedir } from "os";
+import { dirname, join } from "path";
+import { z } from "zod";
+function omitKey(obj, key) {
+  const result = {};
+  for (const k of Object.keys(obj)) {
+    if (k !== key) result[k] = obj[k];
+  }
+  return result;
+}
+function resolveConfigPaths(home = homedir()) {
+  const dir = join(home, ".kash");
+  return { home, dir, file: join(dir, "config.json") };
+}
+function resolveConfigPathsForOverride(override, envOverride = process.env["KASH_CONFIG"]) {
+  const explicit = override ?? envOverride;
+  if (explicit) {
+    const dir = dirname(explicit);
+    return { home: dirname(dir), dir, file: explicit };
+  }
+  return resolveConfigPaths();
+}
+var DEFAULT_PROFILE = "default";
+var RESERVED_PROFILE_NAMES = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+var profileNameSchema = z.string().min(1, "profile name cannot be empty").max(64, "profile name must be \u2264 64 characters").regex(/^[A-Za-z0-9_.-]+$/, "profile name allows letters, digits, underscore, dot, and dash only").refine((name) => !RESERVED_PROFILE_NAMES.has(name), {
+  message: "profile name uses a reserved word (__proto__, constructor, prototype) \u2014 would walk the object prototype chain"
+});
+var signerKeyRefSchema = z.string().regex(/^(file:|env:)\S+$/, 'signerKeyRef must start with "file:<path>" or "env:<NAME>"');
+var bundlerProviderSchema = z.enum(["flashbots", "pimlico", "alchemy", "generic"]);
+var hexAddressSchema = z.string().regex(HEX_ADDRESS_REGEX, "must be a 0x-prefixed 40-char hex address");
+var customChainSchema = z.object({
+  /** Human-readable label, surfaced on `client.addresses.name`. */
+  name: z.string().min(1, "customChain.name must not be empty").optional(),
+  factoryAddress: hexAddressSchema.optional(),
+  usdcAddress: hexAddressSchema.optional(),
+  oracleAddress: hexAddressSchema.optional(),
+  vaultAddress: hexAddressSchema.optional(),
+  tokens1155Address: hexAddressSchema.optional(),
+  paramRegistryAddress: hexAddressSchema.optional(),
+  /** Smart-account factory + EntryPoint config (SA mode only). */
+  smartAccount: z.object({
+    factoryAddress: hexAddressSchema.optional(),
+    implementationAddress: hexAddressSchema.optional(),
+    entryPointAddress: hexAddressSchema.optional()
+  }).strict().optional()
+}).strict();
+var cliConfigSchema = z.object({
+  // ── Kash-orchestrated mode (API-backed) ─────────────────────────────
+  apiKey: z.string().startsWith("kash_", 'API keys start with "kash_"').min(16, "API key looks too short").optional(),
+  baseUrl: z.string().url("baseUrl must be a valid URL").optional(),
+  defaultChainId: z.number().int().positive().optional(),
+  // ── Direct mode (`kash protocol …`, on-chain) ───────────────
+  /** RPC endpoint for the chain. Consumer-owned; the CLI never proxies. */
+  rpcUrl: z.string().url("rpcUrl must be a valid URL").optional(),
+  /** Smart account address (the ERC-4337 account whose funds are used). */
+  smartAccount: z.string().regex(HEX_ADDRESS_REGEX, "smartAccount must be a 0x-prefixed 40-char hex address").optional(),
+  /** Bundler URL (overrides the protocol-sdk's Flashbots Protect default). */
+  bundlerUrl: z.string().url("bundlerUrl must be a valid URL").optional(),
+  /** Bundler provider preset (selects the right header dialect). */
+  bundlerProvider: bundlerProviderSchema.optional(),
+  /** Reference to the EOA private key that owns the smart account. */
+  signerKeyRef: signerKeyRefSchema.optional(),
+  /**
+   * Custom-chain addresses for chains outside the static registry
+   * (local Anvil, forks, sidechains). When present, the CLI's
+   * direct-mode and EOA-mode commands use these addresses instead
+   * of looking the chain up in the registry. Required for chainId
+   * 31337 (Anvil); optional for Base mainnet/testnet (registry covers them).
+   */
+  customChain: customChainSchema.optional()
+}).strict();
+var cliFileSchema = z.object({
+  version: z.literal(1),
+  currentProfile: profileNameSchema.optional(),
+  profiles: z.record(profileNameSchema, cliConfigSchema).default({})
+}).strict();
+var PRODUCTION_BASE_URL = "https://api.kash.bot/v1";
+var STAGING_BASE_URL = "https://api-staging.kash.bot/v1";
+function inferBaseUrlFromApiKey(apiKey) {
+  if (!apiKey) return void 0;
+  if (apiKey.startsWith("kash_test_")) return STAGING_BASE_URL;
+  if (apiKey.startsWith("kash_live_")) return PRODUCTION_BASE_URL;
+  return void 0;
+}
+var DEFAULTS = {
+  baseUrl: PRODUCTION_BASE_URL,
+  defaultChainId: 8453
+};
+async function readConfig(opts = {}) {
+  const paths = resolveConfigPathsForOverride(opts.configPath);
+  const file = await readFileConfig(paths);
+  return resolveActive(file, opts.profile);
+}
+async function readFileConfig(paths) {
+  if (!existsSync(paths.file)) return emptyFile();
+  let raw;
+  try {
+    raw = await readFile(paths.file, "utf8");
+  } catch (cause) {
+    throw new CliConfigurationError(
+      `Failed to read config file at ${paths.file}: ${cause.message}`,
+      "Run 'kash config reset' to start fresh."
+    );
+  }
+  return parseFileContents(raw, paths.file);
+}
+function parseFileContents(raw, file) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (cause) {
+    throw new CliConfigurationError(
+      `Config file at ${file} is not valid JSON: ${cause.message}`,
+      "Run 'kash config reset' to overwrite it with defaults."
+    );
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new CliConfigurationError(
+      `Config file at ${file} must contain a JSON object at the top level (got ${describeJsonRoot(parsed)}).`,
+      "Run 'kash config reset' to overwrite it with defaults."
+    );
+  }
+  const migrated = migrateLegacyShape(parsed);
+  const result = cliFileSchema.safeParse(migrated);
+  if (!result.success) {
+    const first = result.error.issues[0];
+    const path = first?.path.join(".") ?? "(root)";
+    throw new CliConfigurationError(
+      `Config file at ${file} is invalid (${path}): ${first?.message ?? "validation failed"}`,
+      "Run 'kash config reset' to overwrite it with defaults."
+    );
+  }
+  return result.data;
+}
+function describeJsonRoot(value) {
+  if (value === null) return "null";
+  if (Array.isArray(value)) return "array";
+  return typeof value;
+}
+function migrateLegacyShape(parsed) {
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return parsed;
+  }
+  const obj = parsed;
+  if ("version" in obj || "profiles" in obj) {
+    return parsed;
+  }
+  const flat = cliConfigSchema.safeParse(obj);
+  if (!flat.success) {
+    return parsed;
+  }
+  return {
+    version: 1,
+    currentProfile: DEFAULT_PROFILE,
+    profiles: { [DEFAULT_PROFILE]: flat.data }
+  };
+}
+function emptyFile() {
+  return cliFileSchema.parse({ version: 1 });
+}
+function pickProfileName(file, flagOverride) {
+  if (flagOverride !== void 0) {
+    validateProfileName(flagOverride, "--profile flag");
+    return { name: flagOverride, source: "flag" };
+  }
+  const env = process.env["KASH_PROFILE"];
+  if (env !== void 0 && env.length > 0) {
+    validateProfileName(env, "KASH_PROFILE environment variable");
+    return { name: env, source: "env" };
+  }
+  if (file.currentProfile !== void 0) {
+    return { name: file.currentProfile, source: "file" };
+  }
+  return { name: DEFAULT_PROFILE, source: "default" };
+}
+function validateProfileName(value, source) {
+  const result = profileNameSchema.safeParse(value);
+  if (!result.success) {
+    const issue = result.error.issues[0];
+    throw new CliConfigurationError(
+      `Profile name from ${source} is invalid: ${issue?.message ?? "validation failed"}.`,
+      "Profile names accept letters, digits, underscore, dot, and dash; must be 1-64 characters."
+    );
+  }
+}
+function resolveActive(file, flagOverride) {
+  const { name: profileName, source: profileSource } = pickProfileName(file, flagOverride);
+  const profile = file.profiles[profileName];
+  if (profile === void 0 && (profileSource === "env" || profileSource === "flag") && Object.keys(file.profiles).length > 0 && !isTruthyEnv(process.env["KASH_QUIET"])) {
+    const known = Object.keys(file.profiles).sort().join(", ");
+    const sourceLabel = profileSource === "env" ? "KASH_PROFILE" : "--profile";
+    process.stderr.write(
+      `\u26A0  Profile "${profileName}" (${sourceLabel}) is not in the config file. Known profiles: ${known}. Did you typo the name? (Set KASH_QUIET=1 to mute this warning.)
+`
+    );
+  }
+  return mergeWithEnv(profile ?? {}, profileName, profileSource);
+}
+function isTruthyEnv(value) {
+  if (value === void 0) return false;
+  const v = value.trim().toLowerCase();
+  return v === "1" || v === "true" || v === "yes" || v === "on";
+}
+function mergeWithEnv(profile, profileName, profileSource) {
+  const envApiKey = process.env["KASH_API_KEY"];
+  const envBaseUrl = process.env["KASH_BASE_URL"];
+  const envChainIdRaw = process.env["KASH_CHAIN_ID"];
+  const envRpcUrl = process.env["KASH_RPC_URL"];
+  const envSmartAccount = process.env["KASH_SMART_ACCOUNT"];
+  const envBundlerUrl = process.env["KASH_BUNDLER_URL"];
+  const envBundlerProviderRaw = process.env["KASH_BUNDLER_PROVIDER"];
+  const envSignerKeyRef = process.env["KASH_SIGNER_KEY_REF"];
+  let envChainId;
+  if (envChainIdRaw !== void 0) {
+    const n = Number.parseInt(envChainIdRaw, 10);
+    if (Number.isNaN(n) || n <= 0) {
+      throw new CliConfigurationError(
+        `KASH_CHAIN_ID is not a positive integer: ${envChainIdRaw}`,
+        "Set KASH_CHAIN_ID to a chain id like 8453 or 84532, or unset it to use the default."
+      );
+    }
+    envChainId = n;
+  }
+  let envBundlerProvider;
+  if (envBundlerProviderRaw !== void 0) {
+    const allowed = ["flashbots", "pimlico", "alchemy", "generic"];
+    if (!allowed.includes(envBundlerProviderRaw)) {
+      throw new CliConfigurationError(
+        `KASH_BUNDLER_PROVIDER must be one of ${allowed.join(", ")} (got "${envBundlerProviderRaw}").`,
+        "Unset the variable or set it to a supported preset."
+      );
+    }
+    envBundlerProvider = envBundlerProviderRaw;
+  }
+  const apiKey = envApiKey ?? profile.apiKey;
+  const baseUrl = envBaseUrl ?? profile.baseUrl ?? inferBaseUrlFromApiKey(apiKey) ?? DEFAULTS.baseUrl;
+  const defaultChainId = envChainId ?? profile.defaultChainId ?? DEFAULTS.defaultChainId;
+  const rpcUrl = envRpcUrl ?? profile.rpcUrl;
+  const smartAccount = envSmartAccount ?? profile.smartAccount;
+  const bundlerUrl = envBundlerUrl ?? profile.bundlerUrl;
+  const bundlerProvider = envBundlerProvider ?? profile.bundlerProvider;
+  const signerKeyRef = envSignerKeyRef ?? profile.signerKeyRef;
+  const customChain = profile.customChain;
+  return {
+    apiKey,
+    baseUrl,
+    defaultChainId,
+    rpcUrl,
+    smartAccount,
+    bundlerUrl,
+    bundlerProvider,
+    signerKeyRef,
+    customChain,
+    profile: profileName,
+    sources: {
+      apiKey: envApiKey ? "env" : profile.apiKey ? "file" : "unset",
+      baseUrl: envBaseUrl ? "env" : profile.baseUrl ? "file" : inferBaseUrlFromApiKey(apiKey) ? "inferred" : "default",
+      defaultChainId: envChainId !== void 0 ? "env" : profile.defaultChainId !== void 0 ? "file" : "default",
+      profile: profileSource,
+      rpcUrl: envRpcUrl ? "env" : profile.rpcUrl ? "file" : "unset",
+      smartAccount: envSmartAccount ? "env" : profile.smartAccount ? "file" : "unset",
+      bundlerUrl: envBundlerUrl ? "env" : profile.bundlerUrl ? "file" : "unset",
+      bundlerProvider: envBundlerProvider ? "env" : profile.bundlerProvider ? "file" : "unset",
+      signerKeyRef: envSignerKeyRef ? "env" : profile.signerKeyRef ? "file" : "unset",
+      customChain: profile.customChain ? "file" : "unset"
+    }
+  };
+}
+async function updateConfig(patch, opts = {}) {
+  const paths = resolveConfigPathsForOverride(opts.configPath);
+  const file = await readFileConfig(paths);
+  const profileName = opts.profile ?? file.currentProfile ?? DEFAULT_PROFILE;
+  profileNameSchema.parse(profileName);
+  const current = file.profiles[profileName] ?? {};
+  const next = cliConfigSchema.parse({ ...current, ...patch });
+  const updated = {
+    ...file,
+    profiles: { ...file.profiles, [profileName]: next }
+  };
+  await writeFileConfig(paths, updated);
+  return { profile: profileName, stored: next };
+}
+async function clearConfigField(field, opts = {}) {
+  const paths = resolveConfigPathsForOverride(opts.configPath);
+  const file = await readFileConfig(paths);
+  const profileName = opts.profile ?? file.currentProfile ?? DEFAULT_PROFILE;
+  const current = file.profiles[profileName] ?? {};
+  if (!(field in current)) return { profile: profileName, stored: current };
+  const next = cliConfigSchema.parse(omitKey(current, field));
+  const updated = {
+    ...file,
+    profiles: { ...file.profiles, [profileName]: next }
+  };
+  await writeFileConfig(paths, updated);
+  return { profile: profileName, stored: next };
+}
+async function listProfiles(opts = {}) {
+  const paths = resolveConfigPathsForOverride(opts.configPath);
+  const file = await readFileConfig(paths);
+  return {
+    current: file.currentProfile ?? DEFAULT_PROFILE,
+    profiles: Object.keys(file.profiles).sort()
+  };
+}
+async function setCurrentProfile(name, opts = {}) {
+  profileNameSchema.parse(name);
+  const paths = resolveConfigPathsForOverride(opts.configPath);
+  const file = await readFileConfig(paths);
+  const updated = { ...file, currentProfile: name };
+  await writeFileConfig(paths, updated);
+  return updated;
+}
+async function deleteProfile(name, opts = {}) {
+  profileNameSchema.parse(name);
+  const paths = resolveConfigPathsForOverride(opts.configPath);
+  const file = await readFileConfig(paths);
+  if (file.currentProfile === name) {
+    throw new CliConfigurationError(
+      `Cannot delete the active profile "${name}".`,
+      "Switch to another profile first with `kash config use <name>`."
+    );
+  }
+  if (!(name in file.profiles)) {
+    return file;
+  }
+  const updated = { ...file, profiles: omitKey(file.profiles, name) };
+  await writeFileConfig(paths, updated);
+  return updated;
+}
+async function deleteConfig(opts = {}) {
+  const paths = resolveConfigPathsForOverride(opts.configPath);
+  if (!existsSync(paths.file)) return;
+  await unlink(paths.file);
+}
+async function readWholeFile(opts = {}) {
+  const paths = resolveConfigPathsForOverride(opts.configPath);
+  return await readFileConfig(paths);
+}
+async function writeWholeFile(file, opts = {}) {
+  const paths = resolveConfigPathsForOverride(opts.configPath);
+  const validated = cliFileSchema.parse(file);
+  await writeFileConfig(paths, validated);
+}
+async function writeFileConfig(paths, file) {
+  await ensureDir(paths.dir);
+  await writeFile(paths.file, JSON.stringify(file, null, 2), "utf8");
+  await chmodSafe(paths.file, 384);
+}
+async function ensureDir(dir) {
+  await mkdir(dir, { recursive: true, mode: 448 });
+  await chmodSafe(dir, 448);
+}
+async function chmodSafe(target, mode) {
+  if (mode === void 0) return;
+  if (process.platform === "win32") return;
+  try {
+    await chmod(target, mode);
+  } catch {
+  }
+}
+
+export {
+  resolveConfigPaths,
+  resolveConfigPathsForOverride,
+  DEFAULT_PROFILE,
+  cliConfigSchema,
+  cliFileSchema,
+  PRODUCTION_BASE_URL,
+  STAGING_BASE_URL,
+  inferBaseUrlFromApiKey,
+  DEFAULTS,
+  readConfig,
+  updateConfig,
+  clearConfigField,
+  listProfiles,
+  setCurrentProfile,
+  deleteProfile,
+  deleteConfig,
+  readWholeFile,
+  writeWholeFile
+};
+//# sourceMappingURL=chunk-KMBMQIZ7.js.map

package/dist/chunk-KMBMQIZ7.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/utils/config-store.ts"],"sourcesContent":["/**\n * Persistent CLI configuration with multi-profile support.\n *\n * The on-disk shape (v1+):\n *\n *   {\n *     \"version\": 1,\n *     \"currentProfile\": \"default\",\n *     \"profiles\": {\n *       \"default\": { \"apiKey\": \"kash_live_…\", \"baseUrl\": \"…\", \"defaultChainId\": 8453 },\n *       \"test\":    { \"apiKey\": \"kash_test_…\" }\n *     }\n *   }\n *\n * Flat-shape configs from earlier CLI versions are migrated transparently\n * on first read into a `default` profile. The on-disk file is rewritten\n * in the new shape only on the next write — readers don't mutate state.\n *\n * The file is created and re-written at mode `0600` on POSIX. The\n * directory is created with `0700`. chmod is best-effort — Windows and\n * some network filesystems silently ignore it.\n *\n * Resolution order (highest precedence first):\n *\n *   1. Environment variables: `KASH_API_KEY`, `KASH_BASE_URL`,\n *      `KASH_CHAIN_ID`. Always win.\n *   2. The active profile's fields.\n *   3. Built-in defaults (api.kash.bot/v1, chain 8453).\n *\n * Active-profile resolution (highest precedence first):\n *\n *   1. Explicit `--profile <name>` flag (via `options.profile`).\n *   2. `KASH_PROFILE` env var.\n *   3. `currentProfile` field in the config file.\n *   4. `'default'`.\n *\n * Pinning env-var precedence makes CI runs predictable and lets a\n * human override a profile field without editing the file.\n */\n\nimport { existsSync } from 'node:fs';\nimport { chmod, mkdir, readFile, unlink, writeFile } from 'node:fs/promises';\nimport { homedir } from 'node:os';\nimport { dirname, join } from 'node:path';\n\nimport { z } from 'zod';\n\nimport { CliConfigurationError } from '../errors.js';\n\nimport { HEX_ADDRESS_REGEX } from './trade-input.js';\n\n/**\n * Return a shallow copy of `obj` without the named property. Cleaner\n * than the `const { [k]: _removed, ...rest } = obj` rest-spread idiom\n * because it avoids the unused-variable lint dance.\n */\nfunction omitKey<T extends Record<string, unknown>, K extends keyof T>(obj: T, key: K): Omit<T, K> {\n  const result: Record<string, unknown> = {};\n  for (const k of Object.keys(obj)) {\n    if (k !== key) result[k] = obj[k];\n  }\n  return result as Omit<T, K>;\n}\n\n/** Filesystem layout for the config — exposed for tests to override `home`. */\nexport type ConfigPaths = {\n  readonly home: string;\n  readonly dir: string;\n  readonly file: string;\n};\n\nexport function resolveConfigPaths(home: string = homedir()): ConfigPaths {\n  const dir = join(home, '.kash');\n  return { home, dir, file: join(dir, 'config.json') };\n}\n\n/**\n * Resolve config paths with an optional explicit override path\n * (typically from the `--config` flag or `KASH_CONFIG` env var). The\n * explicit override sets the file directly and derives `dir`/`home`\n * from it for chmod-on-write.\n */\nexport function resolveConfigPathsForOverride(\n  override: string | undefined,\n  envOverride: string | undefined = process.env['KASH_CONFIG']\n): ConfigPaths {\n  const explicit = override ?? envOverride;\n  if (explicit) {\n    const dir = dirname(explicit);\n    return { home: dirname(dir), dir, file: explicit };\n  }\n  return resolveConfigPaths();\n}\n\nexport const DEFAULT_PROFILE = 'default';\n\n/**\n * Profile-name reserved words. Even though the regex below already\n * blocks the most-dangerous shapes (no `[`, no `<`, no whitespace),\n * the `__proto__` / `constructor` / `prototype` strings ARE allowed\n * by `[A-Za-z0-9_.-]+` — and using them as keys on a plain object\n * (`file.profiles`) walks the prototype chain on read. The denylist\n * makes the prototype-walk impossible at the schema layer.\n *\n * Defence-in-depth: the file format already uses `Object.create(null)`\n * boundaries downstream where possible, but pinning the validator\n * here makes the invariant grep-discoverable.\n */\nconst RESERVED_PROFILE_NAMES = new Set(['__proto__', 'constructor', 'prototype']);\n\n/** Profile name validator — keeps file structure deterministic. */\nconst profileNameSchema = z\n  .string()\n  .min(1, 'profile name cannot be empty')\n  .max(64, 'profile name must be ≤ 64 characters')\n  .regex(/^[A-Za-z0-9_.-]+$/, 'profile name allows letters, digits, underscore, dot, and dash only')\n  .refine((name) => !RESERVED_PROFILE_NAMES.has(name), {\n    message:\n      'profile name uses a reserved word (__proto__, constructor, prototype) — would walk the object prototype chain',\n  });\n\n/**\n * Schema for a single profile. Every field is optional so the profile\n * can hold partial state — e.g. only override `baseUrl` while\n * inheriting the API key from env.\n */\n/**\n * Reference to a private key the CLI will load when constructing the\n * direct-mode signer. We never persist the raw key — only a reference\n * to where to read it from at invocation time:\n *\n *   - `file:<path>`   — read the key from a file (mode 0600 enforced\n *                       at read time, not write).\n *   - `env:<name>`    — read the key from an environment variable.\n *\n * This keeps `~/.kash/config.json` free of secret material; the\n * config file itself is only `0600`-protected for the API key, not\n * for arbitrary private keys that could fund-drain a smart account.\n *\n * Future extensions: `keystore:<path>`, `aws-kms:<key-id>`,\n * `gcp-kms:<resource>`, `ledger:<derivation-path>`.\n */\nconst signerKeyRefSchema = z\n  .string()\n  .regex(/^(file:|env:)\\S+$/, 'signerKeyRef must start with \"file:<path>\" or \"env:<NAME>\"');\n\n/** Bundler provider preset. */\nconst bundlerProviderSchema = z.enum(['flashbots', 'pimlico', 'alchemy', 'generic']);\n\nconst hexAddressSchema = z\n  .string()\n  .regex(HEX_ADDRESS_REGEX, 'must be a 0x-prefixed 40-char hex address');\n\n/**\n * Custom-chain config — bypasses the protocol-sdk's static chain\n * registry. Required for any chain Kash hasn't deployed canonical\n * contracts on (local Anvil, Hardhat, Tenderly forks, sidechains).\n *\n * The CLI derives the `viemChain` argument the SDK needs from the\n * profile's `defaultChainId` + `rpcUrl` + `customChain.name`; the\n * consumer never has to hand-construct a viem Chain. `addresses`\n * mirrors the SDK's `CustomChainAddresses`. `smartAccount` is required\n * only when the consumer is using SA mode (`kash protocol …`) on a\n * custom chain — EOA mode ignores it.\n */\n/**\n * Custom-chain schema. Every field is optional at the persistence\n * layer because `kash config set customChain.<leaf>` writes one leaf\n * at a time — requiring the full shape at write time would force the\n * user into a single mega-set call. Completeness (name +\n * factoryAddress + usdcAddress required, smartAccount triple all-or-\n * nothing) is enforced at use time in `resolveCliCustomChain`,\n * where the missing field has actionable error context (the SDK call\n * that needs it).\n */\nconst customChainSchema = z\n  .object({\n    /** Human-readable label, surfaced on `client.addresses.name`. */\n    name: z.string().min(1, 'customChain.name must not be empty').optional(),\n    factoryAddress: hexAddressSchema.optional(),\n    usdcAddress: hexAddressSchema.optional(),\n    oracleAddress: hexAddressSchema.optional(),\n    vaultAddress: hexAddressSchema.optional(),\n    tokens1155Address: hexAddressSchema.optional(),\n    paramRegistryAddress: hexAddressSchema.optional(),\n    /** Smart-account factory + EntryPoint config (SA mode only). */\n    smartAccount: z\n      .object({\n        factoryAddress: hexAddressSchema.optional(),\n        implementationAddress: hexAddressSchema.optional(),\n        entryPointAddress: hexAddressSchema.optional(),\n      })\n      .strict()\n      .optional(),\n  })\n  .strict();\n\nexport const cliConfigSchema = z\n  .object({\n    // ── Kash-orchestrated mode (API-backed) ─────────────────────────────\n    apiKey: z\n      .string()\n      .startsWith('kash_', 'API keys start with \"kash_\"')\n      .min(16, 'API key looks too short')\n      .optional(),\n    baseUrl: z.string().url('baseUrl must be a valid URL').optional(),\n    defaultChainId: z.number().int().positive().optional(),\n\n    // ── Direct mode (`kash protocol …`, on-chain) ───────────────\n    /** RPC endpoint for the chain. Consumer-owned; the CLI never proxies. */\n    rpcUrl: z.string().url('rpcUrl must be a valid URL').optional(),\n    /** Smart account address (the ERC-4337 account whose funds are used). */\n    smartAccount: z\n      .string()\n      .regex(HEX_ADDRESS_REGEX, 'smartAccount must be a 0x-prefixed 40-char hex address')\n      .optional(),\n    /** Bundler URL (overrides the protocol-sdk's Flashbots Protect default). */\n    bundlerUrl: z.string().url('bundlerUrl must be a valid URL').optional(),\n    /** Bundler provider preset (selects the right header dialect). */\n    bundlerProvider: bundlerProviderSchema.optional(),\n    /** Reference to the EOA private key that owns the smart account. */\n    signerKeyRef: signerKeyRefSchema.optional(),\n    /**\n     * Custom-chain addresses for chains outside the static registry\n     * (local Anvil, forks, sidechains). When present, the CLI's\n     * direct-mode and EOA-mode commands use these addresses instead\n     * of looking the chain up in the registry. Required for chainId\n     * 31337 (Anvil); optional for Base mainnet/testnet (registry covers them).\n     */\n    customChain: customChainSchema.optional(),\n  })\n  .strict();\n\nexport type CliConfig = z.infer<typeof cliConfigSchema>;\n\n/**\n * Schema for the v1 multi-profile file shape.\n *\n * `currentProfile` is intentionally optional (no `.default()`) so the\n * source-attribution logic in `pickProfileName` can distinguish\n * \"user explicitly persisted `default` via `kash config use default`\"\n * (source: 'file') from \"we fell through to the built-in default\n * because the file didn't carry a `currentProfile` field\" (source:\n * 'default'). Both result in `'default'` as the active profile, but\n * the source attribution they report is different.\n */\nconst cliFileSchema = z\n  .object({\n    version: z.literal(1),\n    currentProfile: profileNameSchema.optional(),\n    profiles: z.record(profileNameSchema, cliConfigSchema).default({}),\n  })\n  .strict();\n\nexport type CliFile = z.infer<typeof cliFileSchema>;\n\n/**\n * Canonical API base URLs by environment. The CLI auto-routes based on\n * the API-key prefix: a `kash_test_*` key targets staging, a\n * `kash_live_*` key (or no key) targets production. An explicit\n * `baseUrl` config or `KASH_BASE_URL` env var always wins so consumers\n * can target a private mirror, a local mock, or a future region.\n *\n * Mirrors the `inferBaseUrlFromApiKey()` logic in `@kashdao/sdk`'s\n * `internal/config.ts` so the CLI and the SDK route a given key to the\n * same environment without the user having to configure two places.\n */\nexport const PRODUCTION_BASE_URL = 'https://api.kash.bot/v1' as const;\nexport const STAGING_BASE_URL = 'https://api-staging.kash.bot/v1' as const;\n\n/**\n * Derive the API base URL from an API key when neither config nor env\n * sets one explicitly. Returns `undefined` if the key shape isn't\n * recognised — the caller then falls back to {@link DEFAULTS.baseUrl}.\n */\nexport function inferBaseUrlFromApiKey(apiKey: string | undefined): string | undefined {\n  if (!apiKey) return undefined;\n  if (apiKey.startsWith('kash_test_')) return STAGING_BASE_URL;\n  if (apiKey.startsWith('kash_live_')) return PRODUCTION_BASE_URL;\n  return undefined;\n}\n\n/** Default values applied when a field is missing from both file and env. */\nexport const DEFAULTS = {\n  baseUrl: PRODUCTION_BASE_URL,\n  defaultChainId: 8453,\n} as const;\n\nexport type ResolvedConfig = {\n  // ── Kash-orchestrated fields ──────────────────────────────────────────\n  readonly apiKey: string | undefined;\n  readonly baseUrl: string;\n  readonly defaultChainId: number;\n  // ── Direct-mode fields (`kash protocol …`) ────────────────────\n  readonly rpcUrl: string | undefined;\n  readonly smartAccount: string | undefined;\n  readonly bundlerUrl: string | undefined;\n  readonly bundlerProvider: 'flashbots' | 'pimlico' | 'alchemy' | 'generic' | undefined;\n  readonly signerKeyRef: string | undefined;\n  /**\n   * Custom-chain config — present only when the profile explicitly sets\n   * `customChain.*`. Bypasses the protocol-sdk's static chain registry\n   * and is required for chains the registry doesn't cover (Anvil,\n   * forks, sidechains).\n   */\n  readonly customChain: CliConfig['customChain'];\n  // ── Meta ──────────────────────────────────────────────────────\n  /** Active profile name. */\n  readonly profile: string;\n  /** Where each non-default value came from — useful for `kash config show`. */\n  readonly sources: {\n    readonly apiKey: 'env' | 'file' | 'unset';\n    readonly baseUrl: 'env' | 'file' | 'inferred' | 'default';\n    readonly defaultChainId: 'env' | 'file' | 'default';\n    readonly profile: 'flag' | 'env' | 'file' | 'default';\n    readonly rpcUrl: 'env' | 'file' | 'unset';\n    readonly smartAccount: 'env' | 'file' | 'unset';\n    readonly bundlerUrl: 'env' | 'file' | 'unset';\n    readonly bundlerProvider: 'env' | 'file' | 'unset';\n    readonly signerKeyRef: 'env' | 'file' | 'unset';\n    readonly customChain: 'file' | 'unset';\n  };\n};\n\nexport type ReadConfigOptions = {\n  /** Override which profile to read; takes precedence over env + file. */\n  readonly profile?: string;\n  /** Override the config file path; takes precedence over `KASH_CONFIG`. */\n  readonly configPath?: string;\n};\n\n/**\n * Read the config file and return the resolved active profile merged\n * with environment variables and defaults.\n */\nexport async function readConfig(opts: ReadConfigOptions = {}): Promise<ResolvedConfig> {\n  const paths = resolveConfigPathsForOverride(opts.configPath);\n  const file = await readFileConfig(paths);\n  return resolveActive(file, opts.profile);\n}\n\nasync function readFileConfig(paths: ConfigPaths): Promise<CliFile> {\n  if (!existsSync(paths.file)) return emptyFile();\n  let raw: string;\n  try {\n    raw = await readFile(paths.file, 'utf8');\n  } catch (cause) {\n    throw new CliConfigurationError(\n      `Failed to read config file at ${paths.file}: ${(cause as Error).message}`,\n      \"Run 'kash config reset' to start fresh.\"\n    );\n  }\n  return parseFileContents(raw, paths.file);\n}\n\nfunction parseFileContents(raw: string, file: string): CliFile {\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (cause) {\n    throw new CliConfigurationError(\n      `Config file at ${file} is not valid JSON: ${(cause as Error).message}`,\n      \"Run 'kash config reset' to overwrite it with defaults.\"\n    );\n  }\n  // Guard against valid-JSON-but-wrong-top-level (e.g. someone wrote\n  // a string, a number, an array, or `null` to the file). Without this,\n  // the v1 schema's \"Expected object, received string\" Zod error\n  // bubbles up with no actionable hint.\n  if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {\n    throw new CliConfigurationError(\n      `Config file at ${file} must contain a JSON object at the top level (got ${describeJsonRoot(parsed)}).`,\n      \"Run 'kash config reset' to overwrite it with defaults.\"\n    );\n  }\n  const migrated = migrateLegacyShape(parsed);\n  const result = cliFileSchema.safeParse(migrated);\n  if (!result.success) {\n    const first = result.error.issues[0];\n    const path = first?.path.join('.') ?? '(root)';\n    throw new CliConfigurationError(\n      `Config file at ${file} is invalid (${path}): ${first?.message ?? 'validation failed'}`,\n      \"Run 'kash config reset' to overwrite it with defaults.\"\n    );\n  }\n  return result.data;\n}\n\n/** Describe a non-object JSON root for the user-facing error message. */\nfunction describeJsonRoot(value: unknown): string {\n  if (value === null) return 'null';\n  if (Array.isArray(value)) return 'array';\n  return typeof value;\n}\n\n/**\n * If the file looks like the legacy flat shape ({ apiKey?, baseUrl?,\n * defaultChainId? } at the root), wrap it as the default profile of a\n * v1 file. Otherwise pass through.\n */\nfunction migrateLegacyShape(parsed: unknown): unknown {\n  if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {\n    return parsed;\n  }\n  const obj = parsed as Record<string, unknown>;\n  if ('version' in obj || 'profiles' in obj) {\n    return parsed; // already in v1 shape\n  }\n  // Legacy flat shape — wrap it as the default profile.\n  const flat = cliConfigSchema.safeParse(obj);\n  if (!flat.success) {\n    return parsed; // let the v1 schema raise the structured error\n  }\n  return {\n    version: 1,\n    currentProfile: DEFAULT_PROFILE,\n    profiles: { [DEFAULT_PROFILE]: flat.data },\n  };\n}\n\nfunction emptyFile(): CliFile {\n  return cliFileSchema.parse({ version: 1 });\n}\n\n/**\n * Compute the active profile name. Order: explicit flag > env >\n * file's `currentProfile` (when present) > built-in `'default'`.\n *\n * Crucially, when the file persists `currentProfile: \"default\"`\n * (e.g. after `kash config use default`), source is `'file'` — not\n * `'default'`. That keeps the JSON contract honest: agents debugging\n * \"why is my profile X?\" need to know it came from a write, not a\n * fallback.\n */\nfunction pickProfileName(\n  file: CliFile,\n  flagOverride: string | undefined\n): { name: string; source: 'flag' | 'env' | 'file' | 'default' } {\n  if (flagOverride !== undefined) {\n    validateProfileName(flagOverride, '--profile flag');\n    return { name: flagOverride, source: 'flag' };\n  }\n  const env = process.env['KASH_PROFILE'];\n  if (env !== undefined && env.length > 0) {\n    validateProfileName(env, 'KASH_PROFILE environment variable');\n    return { name: env, source: 'env' };\n  }\n  if (file.currentProfile !== undefined) {\n    return { name: file.currentProfile, source: 'file' };\n  }\n  return { name: DEFAULT_PROFILE, source: 'default' };\n}\n\n/**\n * Wrap `profileNameSchema.parse` so a malformed value surfaces as a\n * typed `CliConfigurationError` with a `check_input`-friendly\n * suggestion, instead of a raw `ZodError` that the top-level\n * boundary maps to `UNEXPECTED`.\n */\nfunction validateProfileName(value: string, source: string): void {\n  const result = profileNameSchema.safeParse(value);\n  if (!result.success) {\n    const issue = result.error.issues[0];\n    throw new CliConfigurationError(\n      `Profile name from ${source} is invalid: ${issue?.message ?? 'validation failed'}.`,\n      'Profile names accept letters, digits, underscore, dot, and dash; must be 1-64 characters.'\n    );\n  }\n}\n\nfunction resolveActive(file: CliFile, flagOverride: string | undefined): ResolvedConfig {\n  const { name: profileName, source: profileSource } = pickProfileName(file, flagOverride);\n  const profile = file.profiles[profileName];\n  // It's not an error to ask for a profile that isn't in the file —\n  // env-only setups (CI, agents) are normal. We surface this via the\n  // `sources.apiKey === 'unset'` value if no env var fills the gap.\n  //\n  // BUT: when the missing profile was named via `KASH_PROFILE` or\n  // `--profile`, an intentional env-only setup is the rare case and\n  // a typo (e.g. `KASH_PROFILE=staing` vs `staging`) is the common\n  // case. The operator otherwise sees an empty config + a confusing\n  // `AUTH_REQUIRED` later. Nudge them on stderr (no JSON pollution,\n  // no behaviour change). `KASH_QUIET=1` mutes the warning for CI.\n  if (\n    profile === undefined &&\n    (profileSource === 'env' || profileSource === 'flag') &&\n    Object.keys(file.profiles).length > 0 &&\n    !isTruthyEnv(process.env['KASH_QUIET'])\n  ) {\n    const known = Object.keys(file.profiles).sort().join(', ');\n    const sourceLabel = profileSource === 'env' ? 'KASH_PROFILE' : '--profile';\n    process.stderr.write(\n      `\\u26a0  Profile \"${profileName}\" (${sourceLabel}) is not in the config file. ` +\n        `Known profiles: ${known}. ` +\n        `Did you typo the name? (Set KASH_QUIET=1 to mute this warning.)\\n`\n    );\n  }\n  return mergeWithEnv(profile ?? {}, profileName, profileSource);\n}\n\n/** Same truthy-env recognizer as `utils/global-options.ts:isTruthyEnv`. */\nfunction isTruthyEnv(value: string | undefined): boolean {\n  if (value === undefined) return false;\n  const v = value.trim().toLowerCase();\n  return v === '1' || v === 'true' || v === 'yes' || v === 'on';\n}\n\nfunction mergeWithEnv(\n  profile: CliConfig,\n  profileName: string,\n  profileSource: 'flag' | 'env' | 'file' | 'default'\n): ResolvedConfig {\n  const envApiKey = process.env['KASH_API_KEY'];\n  const envBaseUrl = process.env['KASH_BASE_URL'];\n  const envChainIdRaw = process.env['KASH_CHAIN_ID'];\n  // Direct-mode env vars\n  const envRpcUrl = process.env['KASH_RPC_URL'];\n  const envSmartAccount = process.env['KASH_SMART_ACCOUNT'];\n  const envBundlerUrl = process.env['KASH_BUNDLER_URL'];\n  const envBundlerProviderRaw = process.env['KASH_BUNDLER_PROVIDER'];\n  const envSignerKeyRef = process.env['KASH_SIGNER_KEY_REF'];\n\n  let envChainId: number | undefined;\n  if (envChainIdRaw !== undefined) {\n    const n = Number.parseInt(envChainIdRaw, 10);\n    if (Number.isNaN(n) || n <= 0) {\n      throw new CliConfigurationError(\n        `KASH_CHAIN_ID is not a positive integer: ${envChainIdRaw}`,\n        'Set KASH_CHAIN_ID to a chain id like 8453 or 84532, or unset it to use the default.'\n      );\n    }\n    envChainId = n;\n  }\n\n  let envBundlerProvider: ResolvedConfig['bundlerProvider'];\n  if (envBundlerProviderRaw !== undefined) {\n    const allowed = ['flashbots', 'pimlico', 'alchemy', 'generic'] as const;\n    if (!(allowed as readonly string[]).includes(envBundlerProviderRaw)) {\n      throw new CliConfigurationError(\n        `KASH_BUNDLER_PROVIDER must be one of ${allowed.join(', ')} (got \"${envBundlerProviderRaw}\").`,\n        'Unset the variable or set it to a supported preset.'\n      );\n    }\n    envBundlerProvider = envBundlerProviderRaw as ResolvedConfig['bundlerProvider'];\n  }\n\n  const apiKey = envApiKey ?? profile.apiKey;\n  // Resolution order for `baseUrl`:\n  //   1. KASH_BASE_URL env var       — always wins\n  //   2. profile.baseUrl             — explicit profile config\n  //   3. inferred from apiKey prefix — kash_test_* → staging, kash_live_* → production\n  //   4. DEFAULTS.baseUrl            — production (final fallback)\n  //\n  // Step 3 mirrors `@kashdao/sdk`'s `inferBaseUrlFromApiKey()` so the\n  // CLI and the SDK route the same key to the same environment without\n  // requiring the user to configure two places. Without this, a user\n  // with only a `kash_test_*` key would hit production (and a DNS error\n  // pre-launch) until they remembered to also set `--base-url`.\n  const baseUrl =\n    envBaseUrl ?? profile.baseUrl ?? inferBaseUrlFromApiKey(apiKey) ?? DEFAULTS.baseUrl;\n  const defaultChainId = envChainId ?? profile.defaultChainId ?? DEFAULTS.defaultChainId;\n  const rpcUrl = envRpcUrl ?? profile.rpcUrl;\n  const smartAccount = envSmartAccount ?? profile.smartAccount;\n  const bundlerUrl = envBundlerUrl ?? profile.bundlerUrl;\n  const bundlerProvider = envBundlerProvider ?? profile.bundlerProvider;\n  const signerKeyRef = envSignerKeyRef ?? profile.signerKeyRef;\n  // customChain has no env-var override — it's a structured object,\n  // not a single string, and the right place to set it is `kash\n  // config set customChain.<leaf>` so partial sets compose. CI use\n  // cases that need a custom chain mount the config file directly\n  // (KASH_CONFIG=...).\n  const customChain = profile.customChain;\n\n  return {\n    apiKey,\n    baseUrl,\n    defaultChainId,\n    rpcUrl,\n    smartAccount,\n    bundlerUrl,\n    bundlerProvider,\n    signerKeyRef,\n    customChain,\n    profile: profileName,\n    sources: {\n      apiKey: envApiKey ? 'env' : profile.apiKey ? 'file' : 'unset',\n      baseUrl: envBaseUrl\n        ? 'env'\n        : profile.baseUrl\n          ? 'file'\n          : inferBaseUrlFromApiKey(apiKey)\n            ? 'inferred'\n            : 'default',\n      defaultChainId:\n        envChainId !== undefined\n          ? 'env'\n          : profile.defaultChainId !== undefined\n            ? 'file'\n            : 'default',\n      profile: profileSource,\n      rpcUrl: envRpcUrl ? 'env' : profile.rpcUrl ? 'file' : 'unset',\n      smartAccount: envSmartAccount ? 'env' : profile.smartAccount ? 'file' : 'unset',\n      bundlerUrl: envBundlerUrl ? 'env' : profile.bundlerUrl ? 'file' : 'unset',\n      bundlerProvider: envBundlerProvider ? 'env' : profile.bundlerProvider ? 'file' : 'unset',\n      signerKeyRef: envSignerKeyRef ? 'env' : profile.signerKeyRef ? 'file' : 'unset',\n      customChain: profile.customChain ? 'file' : 'unset',\n    },\n  };\n}\n\nexport type WriteConfigOptions = {\n  /** Profile to write to. Defaults to the current active profile. */\n  readonly profile?: string;\n  /** Override the config file path. */\n  readonly configPath?: string;\n};\n\n/**\n * Result of {@link updateConfig} / {@link clearConfigField}. Carries\n * the resolved profile name so callers can render an accurate\n * \"wrote to profile X\" message instead of guessing — important for\n * the JSON contract that `kash auth set-key --json` ships, since\n * `--profile` may be unset and we want to report the actually-written\n * profile (which falls back to the file's `currentProfile`).\n */\nexport type UpdateConfigResult = {\n  readonly profile: string;\n  readonly stored: CliConfig;\n};\n\n/**\n * Mutate (and persist) a single field of the active (or named) profile.\n * Used by `auth set-key`, `auth logout`, `config set`. Writes the file\n * with `0600` permissions.\n */\nexport async function updateConfig(\n  patch: Partial<CliConfig>,\n  opts: WriteConfigOptions = {}\n): Promise<UpdateConfigResult> {\n  const paths = resolveConfigPathsForOverride(opts.configPath);\n  const file = await readFileConfig(paths);\n  const profileName = opts.profile ?? file.currentProfile ?? DEFAULT_PROFILE;\n  profileNameSchema.parse(profileName);\n  const current = file.profiles[profileName] ?? {};\n  const next = cliConfigSchema.parse({ ...current, ...patch });\n  const updated: CliFile = {\n    ...file,\n    profiles: { ...file.profiles, [profileName]: next },\n  };\n  await writeFileConfig(paths, updated);\n  return { profile: profileName, stored: next };\n}\n\n/** Wipe a single field from a profile (used by `auth logout`). */\nexport async function clearConfigField(\n  field: keyof CliConfig,\n  opts: WriteConfigOptions = {}\n): Promise<UpdateConfigResult> {\n  const paths = resolveConfigPathsForOverride(opts.configPath);\n  const file = await readFileConfig(paths);\n  const profileName = opts.profile ?? file.currentProfile ?? DEFAULT_PROFILE;\n  const current = file.profiles[profileName] ?? {};\n  if (!(field in current)) return { profile: profileName, stored: current };\n  const next = cliConfigSchema.parse(omitKey(current, field));\n  const updated: CliFile = {\n    ...file,\n    profiles: { ...file.profiles, [profileName]: next },\n  };\n  await writeFileConfig(paths, updated);\n  return { profile: profileName, stored: next };\n}\n\n/** List every profile name present in the config file. */\nexport async function listProfiles(\n  opts: { configPath?: string } = {}\n): Promise<{ readonly current: string; readonly profiles: readonly string[] }> {\n  const paths = resolveConfigPathsForOverride(opts.configPath);\n  const file = await readFileConfig(paths);\n  return {\n    current: file.currentProfile ?? DEFAULT_PROFILE,\n    profiles: Object.keys(file.profiles).sort(),\n  };\n}\n\n/** Set the file's `currentProfile` field. Validates the name. */\nexport async function setCurrentProfile(\n  name: string,\n  opts: { configPath?: string } = {}\n): Promise<CliFile> {\n  profileNameSchema.parse(name);\n  const paths = resolveConfigPathsForOverride(opts.configPath);\n  const file = await readFileConfig(paths);\n  const updated: CliFile = { ...file, currentProfile: name };\n  await writeFileConfig(paths, updated);\n  return updated;\n}\n\n/** Remove a named profile. Refuses to remove the active one. */\nexport async function deleteProfile(\n  name: string,\n  opts: { configPath?: string } = {}\n): Promise<CliFile> {\n  profileNameSchema.parse(name);\n  const paths = resolveConfigPathsForOverride(opts.configPath);\n  const file = await readFileConfig(paths);\n  if (file.currentProfile === name) {\n    throw new CliConfigurationError(\n      `Cannot delete the active profile \"${name}\".`,\n      'Switch to another profile first with `kash config use <name>`.'\n    );\n  }\n  if (!(name in file.profiles)) {\n    return file;\n  }\n  const updated: CliFile = { ...file, profiles: omitKey(file.profiles, name) };\n  await writeFileConfig(paths, updated);\n  return updated;\n}\n\n/** Delete the entire config file. Used by `config reset`. */\nexport async function deleteConfig(opts: { configPath?: string } = {}): Promise<void> {\n  const paths = resolveConfigPathsForOverride(opts.configPath);\n  if (!existsSync(paths.file)) return;\n  await unlink(paths.file);\n}\n\n/**\n * Return the full multi-profile file as-is. Used by `kash config\n * export` to dump every profile (vs `readConfig` which resolves a\n * single active profile). When the file doesn't exist, returns an\n * empty file shape so callers don't have to special-case \"no config\n * yet\".\n */\nexport async function readWholeFile(opts: { configPath?: string } = {}): Promise<CliFile> {\n  const paths = resolveConfigPathsForOverride(opts.configPath);\n  return await readFileConfig(paths);\n}\n\n/**\n * Replace the entire on-disk file with the supplied shape. Used by\n * `kash config import`. Validates against the `cliFileSchema` to\n * prevent garbage from landing on disk.\n *\n * Caller-side concerns (merge vs. overwrite, redaction policy, etc.)\n * are handled in the import command — this helper is pure persistence.\n */\nexport async function writeWholeFile(\n  file: CliFile,\n  opts: { configPath?: string } = {}\n): Promise<void> {\n  const paths = resolveConfigPathsForOverride(opts.configPath);\n  const validated = cliFileSchema.parse(file);\n  await writeFileConfig(paths, validated);\n}\n\n/** Public re-export of the file-level schema for the import command. */\nexport { cliFileSchema };\n\nasync function writeFileConfig(paths: ConfigPaths, file: CliFile): Promise<void> {\n  await ensureDir(paths.dir);\n  // Use writeFile + chmod rather than writeFile({mode}) because the\n  // mode flag only takes effect on first creation; rewrites would\n  // keep the old (potentially looser) permissions.\n  await writeFile(paths.file, JSON.stringify(file, null, 2), 'utf8');\n  await chmodSafe(paths.file, 0o600);\n}\n\nasync function ensureDir(dir: string): Promise<void> {\n  await mkdir(dir, { recursive: true, mode: 0o700 });\n  await chmodSafe(dir, 0o700);\n}\n\nasync function chmodSafe(target: string, mode: number | undefined): Promise<void> {\n  if (mode === undefined) return;\n  if (process.platform === 'win32') return;\n  try {\n    await chmod(target, mode);\n  } catch {\n    // chmod can fail on some filesystems (e.g. mounted FAT volumes,\n    // network shares). Treat as best-effort — the user's data still\n    // landed, we just couldn't tighten perms.\n  }\n}\n"],"mappings":";;;;;;;;;AAwCA,SAAS,kBAAkB;AAC3B,SAAS,OAAO,OAAO,UAAU,QAAQ,iBAAiB;AAC1D,SAAS,eAAe;AACxB,SAAS,SAAS,YAAY;AAE9B,SAAS,SAAS;AAWlB,SAAS,QAA8D,KAAQ,KAAoB;AACjG,QAAM,SAAkC,CAAC;AACzC,aAAW,KAAK,OAAO,KAAK,GAAG,GAAG;AAChC,QAAI,MAAM,IAAK,QAAO,CAAC,IAAI,IAAI,CAAC;AAAA,EAClC;AACA,SAAO;AACT;AASO,SAAS,mBAAmB,OAAe,QAAQ,GAAgB;AACxE,QAAM,MAAM,KAAK,MAAM,OAAO;AAC9B,SAAO,EAAE,MAAM,KAAK,MAAM,KAAK,KAAK,aAAa,EAAE;AACrD;AAQO,SAAS,8BACd,UACA,cAAkC,QAAQ,IAAI,aAAa,GAC9C;AACb,QAAM,WAAW,YAAY;AAC7B,MAAI,UAAU;AACZ,UAAM,MAAM,QAAQ,QAAQ;AAC5B,WAAO,EAAE,MAAM,QAAQ,GAAG,GAAG,KAAK,MAAM,SAAS;AAAA,EACnD;AACA,SAAO,mBAAmB;AAC5B;AAEO,IAAM,kBAAkB;AAc/B,IAAM,yBAAyB,oBAAI,IAAI,CAAC,aAAa,eAAe,WAAW,CAAC;AAGhF,IAAM,oBAAoB,EACvB,OAAO,EACP,IAAI,GAAG,8BAA8B,EACrC,IAAI,IAAI,2CAAsC,EAC9C,MAAM,qBAAqB,qEAAqE,EAChG,OAAO,CAAC,SAAS,CAAC,uBAAuB,IAAI,IAAI,GAAG;AAAA,EACnD,SACE;AACJ,CAAC;AAuBH,IAAM,qBAAqB,EACxB,OAAO,EACP,MAAM,qBAAqB,4DAA4D;AAG1F,IAAM,wBAAwB,EAAE,KAAK,CAAC,aAAa,WAAW,WAAW,SAAS,CAAC;AAEnF,IAAM,mBAAmB,EACtB,OAAO,EACP,MAAM,mBAAmB,2CAA2C;AAwBvE,IAAM,oBAAoB,EACvB,OAAO;AAAA;AAAA,EAEN,MAAM,EAAE,OAAO,EAAE,IAAI,GAAG,oCAAoC,EAAE,SAAS;AAAA,EACvE,gBAAgB,iBAAiB,SAAS;AAAA,EAC1C,aAAa,iBAAiB,SAAS;AAAA,EACvC,eAAe,iBAAiB,SAAS;AAAA,EACzC,cAAc,iBAAiB,SAAS;AAAA,EACxC,mBAAmB,iBAAiB,SAAS;AAAA,EAC7C,sBAAsB,iBAAiB,SAAS;AAAA;AAAA,EAEhD,cAAc,EACX,OAAO;AAAA,IACN,gBAAgB,iBAAiB,SAAS;AAAA,IAC1C,uBAAuB,iBAAiB,SAAS;AAAA,IACjD,mBAAmB,iBAAiB,SAAS;AAAA,EAC/C,CAAC,EACA,OAAO,EACP,SAAS;AACd,CAAC,EACA,OAAO;AAEH,IAAM,kBAAkB,EAC5B,OAAO;AAAA;AAAA,EAEN,QAAQ,EACL,OAAO,EACP,WAAW,SAAS,6BAA6B,EACjD,IAAI,IAAI,yBAAyB,EACjC,SAAS;AAAA,EACZ,SAAS,EAAE,OAAO,EAAE,IAAI,6BAA6B,EAAE,SAAS;AAAA,EAChE,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA,EAIrD,QAAQ,EAAE,OAAO,EAAE,IAAI,4BAA4B,EAAE,SAAS;AAAA;AAAA,EAE9D,cAAc,EACX,OAAO,EACP,MAAM,mBAAmB,wDAAwD,EACjF,SAAS;AAAA;AAAA,EAEZ,YAAY,EAAE,OAAO,EAAE,IAAI,gCAAgC,EAAE,SAAS;AAAA;AAAA,EAEtE,iBAAiB,sBAAsB,SAAS;AAAA;AAAA,EAEhD,cAAc,mBAAmB,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQ1C,aAAa,kBAAkB,SAAS;AAC1C,CAAC,EACA,OAAO;AAeV,IAAM,gBAAgB,EACnB,OAAO;AAAA,EACN,SAAS,EAAE,QAAQ,CAAC;AAAA,EACpB,gBAAgB,kBAAkB,SAAS;AAAA,EAC3C,UAAU,EAAE,OAAO,mBAAmB,eAAe,EAAE,QAAQ,CAAC,CAAC;AACnE,CAAC,EACA,OAAO;AAeH,IAAM,sBAAsB;AAC5B,IAAM,mBAAmB;AAOzB,SAAS,uBAAuB,QAAgD;AACrF,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI,OAAO,WAAW,YAAY,EAAG,QAAO;AAC5C,MAAI,OAAO,WAAW,YAAY,EAAG,QAAO;AAC5C,SAAO;AACT;AAGO,IAAM,WAAW;AAAA,EACtB,SAAS;AAAA,EACT,gBAAgB;AAClB;AAiDA,eAAsB,WAAW,OAA0B,CAAC,GAA4B;AACtF,QAAM,QAAQ,8BAA8B,KAAK,UAAU;AAC3D,QAAM,OAAO,MAAM,eAAe,KAAK;AACvC,SAAO,cAAc,MAAM,KAAK,OAAO;AACzC;AAEA,eAAe,eAAe,OAAsC;AAClE,MAAI,CAAC,WAAW,MAAM,IAAI,EAAG,QAAO,UAAU;AAC9C,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,SAAS,MAAM,MAAM,MAAM;AAAA,EACzC,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR,iCAAiC,MAAM,IAAI,KAAM,MAAgB,OAAO;AAAA,MACxE;AAAA,IACF;AAAA,EACF;AACA,SAAO,kBAAkB,KAAK,MAAM,IAAI;AAC1C;AAEA,SAAS,kBAAkB,KAAa,MAAuB;AAC7D,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR,kBAAkB,IAAI,uBAAwB,MAAgB,OAAO;AAAA,MACrE;AAAA,IACF;AAAA,EACF;AAKA,MAAI,WAAW,QAAQ,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAC1E,UAAM,IAAI;AAAA,MACR,kBAAkB,IAAI,qDAAqD,iBAAiB,MAAM,CAAC;AAAA,MACnG;AAAA,IACF;AAAA,EACF;AACA,QAAM,WAAW,mBAAmB,MAAM;AAC1C,QAAM,SAAS,cAAc,UAAU,QAAQ;AAC/C,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,QAAQ,OAAO,MAAM,OAAO,CAAC;AACnC,UAAM,OAAO,OAAO,KAAK,KAAK,GAAG,KAAK;AACtC,UAAM,IAAI;AAAA,MACR,kBAAkB,IAAI,gBAAgB,IAAI,MAAM,OAAO,WAAW,mBAAmB;AAAA,MACrF;AAAA,IACF;AAAA,EACF;AACA,SAAO,OAAO;AAChB;AAGA,SAAS,iBAAiB,OAAwB;AAChD,MAAI,UAAU,KAAM,QAAO;AAC3B,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO;AACjC,SAAO,OAAO;AAChB;AAOA,SAAS,mBAAmB,QAA0B;AACpD,MAAI,WAAW,QAAQ,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAC1E,WAAO;AAAA,EACT;AACA,QAAM,MAAM;AACZ,MAAI,aAAa,OAAO,cAAc,KAAK;AACzC,WAAO;AAAA,EACT;AAEA,QAAM,OAAO,gBAAgB,UAAU,GAAG;AAC1C,MAAI,CAAC,KAAK,SAAS;AACjB,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,SAAS;AAAA,IACT,gBAAgB;AAAA,IAChB,UAAU,EAAE,CAAC,eAAe,GAAG,KAAK,KAAK;AAAA,EAC3C;AACF;AAEA,SAAS,YAAqB;AAC5B,SAAO,cAAc,MAAM,EAAE,SAAS,EAAE,CAAC;AAC3C;AAYA,SAAS,gBACP,MACA,cAC+D;AAC/D,MAAI,iBAAiB,QAAW;AAC9B,wBAAoB,cAAc,gBAAgB;AAClD,WAAO,EAAE,MAAM,cAAc,QAAQ,OAAO;AAAA,EAC9C;AACA,QAAM,MAAM,QAAQ,IAAI,cAAc;AACtC,MAAI,QAAQ,UAAa,IAAI,SAAS,GAAG;AACvC,wBAAoB,KAAK,mCAAmC;AAC5D,WAAO,EAAE,MAAM,KAAK,QAAQ,MAAM;AAAA,EACpC;AACA,MAAI,KAAK,mBAAmB,QAAW;AACrC,WAAO,EAAE,MAAM,KAAK,gBAAgB,QAAQ,OAAO;AAAA,EACrD;AACA,SAAO,EAAE,MAAM,iBAAiB,QAAQ,UAAU;AACpD;AAQA,SAAS,oBAAoB,OAAe,QAAsB;AAChE,QAAM,SAAS,kBAAkB,UAAU,KAAK;AAChD,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,QAAQ,OAAO,MAAM,OAAO,CAAC;AACnC,UAAM,IAAI;AAAA,MACR,qBAAqB,MAAM,gBAAgB,OAAO,WAAW,mBAAmB;AAAA,MAChF;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,cAAc,MAAe,cAAkD;AACtF,QAAM,EAAE,MAAM,aAAa,QAAQ,cAAc,IAAI,gBAAgB,MAAM,YAAY;AACvF,QAAM,UAAU,KAAK,SAAS,WAAW;AAWzC,MACE,YAAY,WACX,kBAAkB,SAAS,kBAAkB,WAC9C,OAAO,KAAK,KAAK,QAAQ,EAAE,SAAS,KACpC,CAAC,YAAY,QAAQ,IAAI,YAAY,CAAC,GACtC;AACA,UAAM,QAAQ,OAAO,KAAK,KAAK,QAAQ,EAAE,KAAK,EAAE,KAAK,IAAI;AACzD,UAAM,cAAc,kBAAkB,QAAQ,iBAAiB;AAC/D,YAAQ,OAAO;AAAA,MACb,oBAAoB,WAAW,MAAM,WAAW,gDAC3B,KAAK;AAAA;AAAA,IAE5B;AAAA,EACF;AACA,SAAO,aAAa,WAAW,CAAC,GAAG,aAAa,aAAa;AAC/D;AAGA,SAAS,YAAY,OAAoC;AACvD,MAAI,UAAU,OAAW,QAAO;AAChC,QAAM,IAAI,MAAM,KAAK,EAAE,YAAY;AACnC,SAAO,MAAM,OAAO,MAAM,UAAU,MAAM,SAAS,MAAM;AAC3D;AAEA,SAAS,aACP,SACA,aACA,eACgB;AAChB,QAAM,YAAY,QAAQ,IAAI,cAAc;AAC5C,QAAM,aAAa,QAAQ,IAAI,eAAe;AAC9C,QAAM,gBAAgB,QAAQ,IAAI,eAAe;AAEjD,QAAM,YAAY,QAAQ,IAAI,cAAc;AAC5C,QAAM,kBAAkB,QAAQ,IAAI,oBAAoB;AACxD,QAAM,gBAAgB,QAAQ,IAAI,kBAAkB;AACpD,QAAM,wBAAwB,QAAQ,IAAI,uBAAuB;AACjE,QAAM,kBAAkB,QAAQ,IAAI,qBAAqB;AAEzD,MAAI;AACJ,MAAI,kBAAkB,QAAW;AAC/B,UAAM,IAAI,OAAO,SAAS,eAAe,EAAE;AAC3C,QAAI,OAAO,MAAM,CAAC,KAAK,KAAK,GAAG;AAC7B,YAAM,IAAI;AAAA,QACR,4CAA4C,aAAa;AAAA,QACzD;AAAA,MACF;AAAA,IACF;AACA,iBAAa;AAAA,EACf;AAEA,MAAI;AACJ,MAAI,0BAA0B,QAAW;AACvC,UAAM,UAAU,CAAC,aAAa,WAAW,WAAW,SAAS;AAC7D,QAAI,CAAE,QAA8B,SAAS,qBAAqB,GAAG;AACnE,YAAM,IAAI;AAAA,QACR,wCAAwC,QAAQ,KAAK,IAAI,CAAC,UAAU,qBAAqB;AAAA,QACzF;AAAA,MACF;AAAA,IACF;AACA,yBAAqB;AAAA,EACvB;AAEA,QAAM,SAAS,aAAa,QAAQ;AAYpC,QAAM,UACJ,cAAc,QAAQ,WAAW,uBAAuB,MAAM,KAAK,SAAS;AAC9E,QAAM,iBAAiB,cAAc,QAAQ,kBAAkB,SAAS;AACxE,QAAM,SAAS,aAAa,QAAQ;AACpC,QAAM,eAAe,mBAAmB,QAAQ;AAChD,QAAM,aAAa,iBAAiB,QAAQ;AAC5C,QAAM,kBAAkB,sBAAsB,QAAQ;AACtD,QAAM,eAAe,mBAAmB,QAAQ;AAMhD,QAAM,cAAc,QAAQ;AAE5B,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT,SAAS;AAAA,MACP,QAAQ,YAAY,QAAQ,QAAQ,SAAS,SAAS;AAAA,MACtD,SAAS,aACL,QACA,QAAQ,UACN,SACA,uBAAuB,MAAM,IAC3B,aACA;AAAA,MACR,gBACE,eAAe,SACX,QACA,QAAQ,mBAAmB,SACzB,SACA;AAAA,MACR,SAAS;AAAA,MACT,QAAQ,YAAY,QAAQ,QAAQ,SAAS,SAAS;AAAA,MACtD,cAAc,kBAAkB,QAAQ,QAAQ,eAAe,SAAS;AAAA,MACxE,YAAY,gBAAgB,QAAQ,QAAQ,aAAa,SAAS;AAAA,MAClE,iBAAiB,qBAAqB,QAAQ,QAAQ,kBAAkB,SAAS;AAAA,MACjF,cAAc,kBAAkB,QAAQ,QAAQ,eAAe,SAAS;AAAA,MACxE,aAAa,QAAQ,cAAc,SAAS;AAAA,IAC9C;AAAA,EACF;AACF;AA2BA,eAAsB,aACpB,OACA,OAA2B,CAAC,GACC;AAC7B,QAAM,QAAQ,8BAA8B,KAAK,UAAU;AAC3D,QAAM,OAAO,MAAM,eAAe,KAAK;AACvC,QAAM,cAAc,KAAK,WAAW,KAAK,kBAAkB;AAC3D,oBAAkB,MAAM,WAAW;AACnC,QAAM,UAAU,KAAK,SAAS,WAAW,KAAK,CAAC;AAC/C,QAAM,OAAO,gBAAgB,MAAM,EAAE,GAAG,SAAS,GAAG,MAAM,CAAC;AAC3D,QAAM,UAAmB;AAAA,IACvB,GAAG;AAAA,IACH,UAAU,EAAE,GAAG,KAAK,UAAU,CAAC,WAAW,GAAG,KAAK;AAAA,EACpD;AACA,QAAM,gBAAgB,OAAO,OAAO;AACpC,SAAO,EAAE,SAAS,aAAa,QAAQ,KAAK;AAC9C;AAGA,eAAsB,iBACpB,OACA,OAA2B,CAAC,GACC;AAC7B,QAAM,QAAQ,8BAA8B,KAAK,UAAU;AAC3D,QAAM,OAAO,MAAM,eAAe,KAAK;AACvC,QAAM,cAAc,KAAK,WAAW,KAAK,kBAAkB;AAC3D,QAAM,UAAU,KAAK,SAAS,WAAW,KAAK,CAAC;AAC/C,MAAI,EAAE,SAAS,SAAU,QAAO,EAAE,SAAS,aAAa,QAAQ,QAAQ;AACxE,QAAM,OAAO,gBAAgB,MAAM,QAAQ,SAAS,KAAK,CAAC;AAC1D,QAAM,UAAmB;AAAA,IACvB,GAAG;AAAA,IACH,UAAU,EAAE,GAAG,KAAK,UAAU,CAAC,WAAW,GAAG,KAAK;AAAA,EACpD;AACA,QAAM,gBAAgB,OAAO,OAAO;AACpC,SAAO,EAAE,SAAS,aAAa,QAAQ,KAAK;AAC9C;AAGA,eAAsB,aACpB,OAAgC,CAAC,GAC4C;AAC7E,QAAM,QAAQ,8BAA8B,KAAK,UAAU;AAC3D,QAAM,OAAO,MAAM,eAAe,KAAK;AACvC,SAAO;AAAA,IACL,SAAS,KAAK,kBAAkB;AAAA,IAChC,UAAU,OAAO,KAAK,KAAK,QAAQ,EAAE,KAAK;AAAA,EAC5C;AACF;AAGA,eAAsB,kBACpB,MACA,OAAgC,CAAC,GACf;AAClB,oBAAkB,MAAM,IAAI;AAC5B,QAAM,QAAQ,8BAA8B,KAAK,UAAU;AAC3D,QAAM,OAAO,MAAM,eAAe,KAAK;AACvC,QAAM,UAAmB,EAAE,GAAG,MAAM,gBAAgB,KAAK;AACzD,QAAM,gBAAgB,OAAO,OAAO;AACpC,SAAO;AACT;AAGA,eAAsB,cACpB,MACA,OAAgC,CAAC,GACf;AAClB,oBAAkB,MAAM,IAAI;AAC5B,QAAM,QAAQ,8BAA8B,KAAK,UAAU;AAC3D,QAAM,OAAO,MAAM,eAAe,KAAK;AACvC,MAAI,KAAK,mBAAmB,MAAM;AAChC,UAAM,IAAI;AAAA,MACR,qCAAqC,IAAI;AAAA,MACzC;AAAA,IACF;AAAA,EACF;AACA,MAAI,EAAE,QAAQ,KAAK,WAAW;AAC5B,WAAO;AAAA,EACT;AACA,QAAM,UAAmB,EAAE,GAAG,MAAM,UAAU,QAAQ,KAAK,UAAU,IAAI,EAAE;AAC3E,QAAM,gBAAgB,OAAO,OAAO;AACpC,SAAO;AACT;AAGA,eAAsB,aAAa,OAAgC,CAAC,GAAkB;AACpF,QAAM,QAAQ,8BAA8B,KAAK,UAAU;AAC3D,MAAI,CAAC,WAAW,MAAM,IAAI,EAAG;AAC7B,QAAM,OAAO,MAAM,IAAI;AACzB;AASA,eAAsB,cAAc,OAAgC,CAAC,GAAqB;AACxF,QAAM,QAAQ,8BAA8B,KAAK,UAAU;AAC3D,SAAO,MAAM,eAAe,KAAK;AACnC;AAUA,eAAsB,eACpB,MACA,OAAgC,CAAC,GAClB;AACf,QAAM,QAAQ,8BAA8B,KAAK,UAAU;AAC3D,QAAM,YAAY,cAAc,MAAM,IAAI;AAC1C,QAAM,gBAAgB,OAAO,SAAS;AACxC;AAKA,eAAe,gBAAgB,OAAoB,MAA8B;AAC/E,QAAM,UAAU,MAAM,GAAG;AAIzB,QAAM,UAAU,MAAM,MAAM,KAAK,UAAU,MAAM,MAAM,CAAC,GAAG,MAAM;AACjE,QAAM,UAAU,MAAM,MAAM,GAAK;AACnC;AAEA,eAAe,UAAU,KAA4B;AACnD,QAAM,MAAM,KAAK,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AACjD,QAAM,UAAU,KAAK,GAAK;AAC5B;AAEA,eAAe,UAAU,QAAgB,MAAyC;AAChF,MAAI,SAAS,OAAW;AACxB,MAAI,QAAQ,aAAa,QAAS;AAClC,MAAI;AACF,UAAM,MAAM,QAAQ,IAAI;AAAA,EAC1B,QAAQ;AAAA,EAIR;AACF;","names":[]}

package/dist/chunk-LBIRQHX5.js

@@ -0,0 +1,133 @@
+#!/usr/bin/env node
+import {
+  parseFieldsList,
+  parseFilter
+} from "./chunk-MIXOZU2S.js";
+import {
+  CliValidationError
+} from "./chunk-UZNSYATZ.js";
+
+// src/utils/global-options.ts
+function readGlobals(cmd) {
+  const opts = cmd.optsWithGlobals();
+  return {
+    json: opts.json === true,
+    quiet: opts.quiet === true,
+    noColor: opts.color === false,
+    // `KASH_DEBUG=1` (or any truthy value) mirrors `--debug`. Common
+    // case: CI matrix configs and parent processes that can't easily
+    // edit the invocation. Explicit `--debug` always wins (a user can
+    // force it on even when the env says off).
+    debug: opts.debug === true || isTruthyEnv(process.env["KASH_DEBUG"]),
+    profile: opts.profile,
+    configPath: opts.config,
+    baseUrl: opts.baseUrl === void 0 ? void 0 : parseUrl(opts.baseUrl, "base-url"),
+    maxRetries: opts.maxRetries === void 0 ? void 0 : (
+      // Cap at 10 to match the SDK's `kashClientConfigSchema`
+      // (`maxRetries: z.number().int().min(0).max(10)`). Bouncing
+      // out-of-range values here gives the agent an `INVALID_INPUT`
+      // with a clear field, instead of a cryptic SDK
+      // `KashConfigurationError` after the client tries to construct.
+      parseBoundedUnsigned(opts.maxRetries, "max-retries", 0, 10)
+    ),
+    timeoutMs: opts.timeoutMs === void 0 ? void 0 : parsePositive(opts.timeoutMs, "timeout-ms"),
+    // `--api-version` is forwarded to the SDK as `apiVersion`. Format
+    // validation (`YYYY-MM-DD`) is enforced by the SDK's
+    // `kashClientConfigSchema`. We don't pre-validate here — letting
+    // the SDK be the single source of truth keeps the format rule in
+    // one place. A malformed value surfaces as
+    // `KashConfigurationError` from client construction, which the
+    // CLI's error mapper converts to a structured envelope.
+    apiVersion: opts.apiVersion,
+    fields: opts.fields === void 0 ? void 0 : parseFieldsList(opts.fields),
+    filter: opts.filter === void 0 ? void 0 : parseFilter(opts.filter)
+  };
+}
+function parseBoundedUnsigned(raw, name, min, max) {
+  if (!/^\+?\d+$/.test(raw)) {
+    throw new CliValidationError(
+      `--${name} must be an integer between ${String(min)} and ${String(max)}.`,
+      `Got "${raw}". Pass digits only \u2014 no decimals or scientific notation.`,
+      name
+    );
+  }
+  const n = Number.parseInt(raw, 10);
+  if (!Number.isFinite(n) || n < min || n > max) {
+    throw new CliValidationError(
+      `--${name} must be an integer between ${String(min)} and ${String(max)}.`,
+      `Got "${raw}".`,
+      name
+    );
+  }
+  return n;
+}
+function parseUrl(raw, name) {
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    throw new CliValidationError(
+      `--${name} must be a valid URL.`,
+      `Got "${raw}". Include the scheme, e.g. https://api.kash.bot/v1.`,
+      name
+    );
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    throw new CliValidationError(
+      `--${name} must use http:// or https:// (got "${url.protocol}").`,
+      `Schemes like file:, data:, javascript:, and about: are rejected \u2014 they would either silently fail in the SDK or open an attack vector.`,
+      name
+    );
+  }
+  return raw;
+}
+function parsePositiveInt(raw, name) {
+  if (!/^\+?\d+$/.test(raw)) {
+    throw new CliValidationError(
+      `--${name} must be a positive integer.`,
+      `Got "${raw}". Pass digits only \u2014 no decimals, scientific notation, or sign except a leading +.`,
+      name
+    );
+  }
+  const n = Number.parseInt(raw, 10);
+  if (!Number.isFinite(n) || n <= 0) {
+    throw new CliValidationError(
+      `--${name} must be a positive integer.`,
+      `Got "${raw}". Pass an integer > 0.`,
+      name
+    );
+  }
+  return n;
+}
+var parsePositive = parsePositiveInt;
+function parseOptionalPositiveInt(raw, name) {
+  return raw === void 0 ? void 0 : parsePositiveInt(raw, name);
+}
+function parsePositiveFloat(raw, name) {
+  const n = Number.parseFloat(raw);
+  if (!Number.isFinite(n) || n <= 0) {
+    throw new CliValidationError(
+      `--${name} must be a positive number.`,
+      `Got "${raw}". Pass a finite number > 0.`,
+      name
+    );
+  }
+  return n;
+}
+function parseOptionalPositiveFloat(raw, name) {
+  return raw === void 0 ? void 0 : parsePositiveFloat(raw, name);
+}
+function isTruthyEnv(value) {
+  if (value === void 0) return false;
+  const v = value.trim().toLowerCase();
+  return v === "1" || v === "true" || v === "yes" || v === "on";
+}
+
+export {
+  readGlobals,
+  parsePositiveInt,
+  parseOptionalPositiveInt,
+  parsePositiveFloat,
+  parseOptionalPositiveFloat
+};
+//# sourceMappingURL=chunk-LBIRQHX5.js.map