@sage-protocol/cli 0.3.6 → 0.3.9

package/dist/cli/commands/premium-pre.js

@@ -1,887 +1,35 @@
 const { Command } = require('commander');
-const { ethers } = require('ethers');
 
-function requireLit() {
-  // Try resolving from normal Node resolution, then fall back to the cli/ directory
-  try {
-    const { LitNodeClient } = require('@lit-protocol/lit-node-client');
-    const { decryptToUint8Array, encryptUint8Array } = require('@lit-protocol/encryption');
-    return { LitNodeClient, decryptToUint8Array, encryptUint8Array };
-  } catch (_) {
-    try {
-      const path = require('path');
-      const { createRequire } = require('module');
-      // Base at cli/ (two levels up from this file: cli/commands → cli)
-      const cliBase = path.resolve(__dirname, '..', '..');
-      const reqCli = createRequire(path.join(cliBase, 'package.json'));
-      const { LitNodeClient } = reqCli('@lit-protocol/lit-node-client');
-      const { decryptToUint8Array, encryptUint8Array } = reqCli('@lit-protocol/encryption');
-      return { LitNodeClient, decryptToUint8Array, encryptUint8Array };
-    } catch (e2) {
-      const hint = 'Install Lit SDK at root with Yarn workspaces (yarn add -W @lit-protocol/lit-node-client) or inside ./cli (cd cli && npm i @lit-protocol/lit-node-client).';
-      throw new Error(`Lit SDK not found in root or cli package. ${hint}`);
-    }
-  }
-}
-
-function requireLitAuthHelpers() {
-  // Try resolving from normal Node resolution, then fall back to the cli/ directory
-  try {
-    const { LitAccessControlConditionResource } = require('@lit-protocol/auth-helpers');
-    return { LitAccessControlConditionResource };
-  } catch (_) {
-    try {
-      const path = require('path');
-      const { createRequire } = require('module');
-      const cliBase = path.resolve(__dirname, '..', '..');
-      const reqCli = createRequire(path.join(cliBase, 'package.json'));
-      const { LitAccessControlConditionResource } = reqCli('@lit-protocol/auth-helpers');
-      return { LitAccessControlConditionResource };
-    } catch (e2) {
-      throw new Error('Lit auth-helpers not found. Install @lit-protocol/auth-helpers in root or cli package.');
-    }
-  }
-}
-
-function loadAuthSig(pathOrEnv) {
-  const fs = require('fs'); const path = require('path');
-  const candidate = pathOrEnv || process.env.LIT_AUTH_SIG;
-  if (!candidate) throw new Error('AuthSig not provided. Pass --auth-sig <file> or set LIT_AUTH_SIG=<file>');
-  const p = path.resolve(candidate);
-  if (!fs.existsSync(p)) throw new Error(`AuthSig file not found: ${p}`);
-  try { return JSON.parse(fs.readFileSync(p, 'utf8')); } catch (e) { throw new Error('Invalid AuthSig JSON'); }
-}
-
-function toB64(buf) { return Buffer.from(buf).toString('base64'); }
-function fromB64(b64) { return Buffer.from(b64, 'base64'); }
+/**
+ * Premium PRE (Proxy Re-Encryption) CLI
+ *
+ * This command was part of the SubDAO-based premium prompts model.
+ * Use `sage personal` commands instead for personal premium.
+ *
+ * See docs/specs/premium-endorsement-model.md for the new architecture.
+ */
 
 function register(program) {
-  const cmd = new Command('premium-pre').description('Premium encryption via PRE (Lit) with on-chain ERC-1155 gating (no on-chain key storage)');
-
-  // Helpers
-  const inferLitChain = async (provider, explicit) => {
-    if (explicit && String(explicit).trim()) return explicit;
-    try {
-      const net = await provider.getNetwork();
-      const id = Number(net.chainId);
-      // Minimal mapping for common test/prod nets used here
-      if (id === 84532) return 'baseSepolia';
-      if (id === 8453) return 'base';
-      if (id === 1) return 'ethereum';
-      if (id === 137) return 'polygon';
-      if (id === 80001) return 'mumbai';
-      if (id === 11155111) return 'sepolia';
-    } catch(_) {}
-    return process.env.LIT_CHAIN || 'baseSepolia';
-  };
-
-  cmd
-    .command('doctor')
-    .description('Diagnose PRE/Lit v7 setup and manifests (chain key, tokenId decimal, conditions)')
-    .option('--cid <manifestCID>', 'Manifest CID to inspect (optional)')
-    .option('--chain <litChain>', 'Expected Lit chain key (default: infer from RPC or env)')
-    .option('--json', 'Output JSON', false)
-    .action(async (opts)=>{
-      try {
-        const out = { ok: true, notes: [], warnings: [], manifest: null };
-        const WM = require('../wallet-manager'); const wm = new WM(); await wm.connect();
-        const provider = wm.getProvider();
-        const litChain = await inferLitChain(provider, opts.chain);
-        out.notes.push(`Lit chain: ${litChain}`);
-        const net = await provider.getNetwork(); out.notes.push(`RPC chainId: ${Number(net.chainId)}`);
-        if (opts.cid) {
-          const IPFSManager = require('../ipfs-manager');
-          const ipfs = new IPFSManager(); await ipfs.initialize();
-          const manifest = await ipfs.downloadJson(opts.cid);
-          out.manifest = { cid: opts.cid };
-          if (!manifest?.pre || manifest.pre.provider !== 'lit') {
-            out.ok = false; out.warnings.push('Manifest missing PRE payload (pre.provider!=lit)');
-          } else {
-            const { normalizeCidV1Base32 } = require('../utils/cid');
-            const { ethers } = require('ethers');
-            const encCid = manifest.encryptedCID;
-            const acc = manifest.pre.evmContractConditions;
-            let chain = manifest.pre.chain || '';
-            if (chain === 'base-sepolia') { out.warnings.push('Legacy chain key base-sepolia found; should be baseSepolia'); chain = 'baseSepolia'; }
-            if (chain !== litChain) out.warnings.push(`Chain mismatch: manifest=${manifest.pre.chain} vs expected=${litChain}`);
-            // tokenId decimal check
-            const tok = String(manifest.pre.tokenId || '').trim();
-            if (!tok || /^0x[0-9a-fA-F]+$/.test(tok)) {
-              out.ok = false; out.warnings.push('pre.tokenId must be decimal for Lit v7. Republish to store decimal tokenId.');
-            }
-            // expected id derived from encryptedCID (CIDv1 base32 then keccak256 of utf8)
-            if (encCid) {
-              const tokenIdHex = ethers.keccak256(ethers.toUtf8Bytes(normalizeCidV1Base32(encCid)));
-              const tokenIdDecExpected = BigInt(tokenIdHex).toString();
-              if (tok && tok !== tokenIdDecExpected) {
-                out.warnings.push(`tokenId mismatch: manifest=${tok}, expected=${tokenIdDecExpected} (derived from encryptedCID)`);
-              }
-            } else {
-              out.warnings.push('Manifest missing encryptedCID');
-            }
-            // ACC param normalization
-            if (Array.isArray(acc) && acc[0]?.functionName === 'balanceOf') {
-              const p = acc[0].functionParams || [];
-              const tokParam = String(p[1] || '');
-              if (/^0x[0-9a-fA-F]+$/.test(tokParam)) out.warnings.push('Access condition tokenId should be decimal, not hex');
-              if (acc[0].chain === 'base-sepolia') out.warnings.push('Access condition chain should be baseSepolia');
-            } else {
-              out.warnings.push('evmContractConditions missing or not in expected balanceOf format');
-            }
-          }
-        }
-        if (opts.json) { process.stdout.write(JSON.stringify(out, null, 2) + '\n'); return; }
-        console.log('🔍 PRE Doctor');
-        out.notes.forEach(n => console.log(' -', n));
-        if (out.manifest) console.log(' - Manifest CID:', out.manifest.cid);
-        if (out.warnings.length) {
-          console.log('\nWarnings:'); out.warnings.forEach(w => console.log(' -', w));
-        }
-        console.log('\nTips: ensure decimal pre.tokenId, chain=baseSepolia, and session signatures enabled.');
-      } catch (e) { console.error('❌ premium-pre doctor failed:', e.message); process.exit(1); }
-    });
-
-  cmd
-    .command('publish')
-    .description('Encrypt content; save AES key with Lit using ERC-1155 receipt gating; store PRE payload in manifest')
-    .requiredOption('--in <path>', 'Path to plaintext file')
-    .requiredOption('--name <name>', 'Name')
-    .requiredOption('--description <text>', 'Description')
-    .requiredOption('--subdao <address>', 'SubDAO to receive proceeds (for price registration via existing premium create flow)')
-    .requiredOption('--price <usdc>', 'Price in USDC (6dp)')
-    .option('--receipt <address>', 'PremiumReceipt address (defaults to PREMIUM_RECEIPT_ADDRESS)', process.env.PREMIUM_RECEIPT_ADDRESS)
-    .option('--chain <name>', 'Lit EVM chain identifier (e.g., base-sepolia). Defaults inferred from connected RPC')
-    .requiredOption('--auth-sig <path>', 'Path to Lit AuthSig JSON (SIWE signature)')
-    .option('--no-auto-self-delegate', 'Do not attempt auto self-delegation on the voting token when preparing a proposal')
-    .option('--lit-network <name>', 'Lit network: serrano (default) | datil-test | datil-dev', process.env.LIT_NETWORK || 'serrano')
-    .action(async (opts) => {
-      try {
-        const fs = require('fs'); const path = require('path');
-        const IPFSManager = require('../ipfs-manager');
-        const { encryptAesGcm, randomBytes, toB64: b64 } = require('../utils/aes');
-        const { normalizeCidV1Base32 } = require('../utils/cid');
-        const ipfs = new IPFSManager(); await ipfs.initialize();
-
-        if (!opts.receipt) throw new Error('PREMIUM_RECEIPT_ADDRESS not set; pass --receipt');
-        const receipt = ethers.getAddress(opts.receipt);
-
-        const content = fs.readFileSync(path.resolve(opts.in), 'utf8');
-        const key = randomBytes(32);
-        const { ciphertext, iv, tag } = encryptAesGcm(content, key);
-        const encPayload = { type: 'sage-premium-encrypted', enc: 'aes-256-gcm', name: opts.name, description: opts.description, iv: b64(iv), tag: b64(tag), ciphertext: b64(ciphertext) };
-        const cipherCID = await ipfs.uploadJson(encPayload, `${opts.name}.encrypted`);
-        // Derive stable tokenId from encryptedCID to avoid self-referential manifest CID loops
-        const tokenIdHex = ethers.keccak256(ethers.toUtf8Bytes(normalizeCidV1Base32(cipherCID)));
-        // Convert to decimal for Lit Protocol compatibility
-        const tokenId = BigInt(tokenIdHex).toString();
-        const manifest = { type: 'sage-premium-manifest-pre', version: '1.0.0', encryptedCID: cipherCID, cipher: 'aes-256-gcm', name: opts.name, description: opts.description };
-
-        // PRE: save AES key with Lit under ERC-1155 gating
-        const { LitNodeClient, decryptToUint8Array } = requireLit();
-        let litNetworkPub = opts.litNetwork || process.env.LIT_NETWORK || 'serrano';
-        if (litNetworkPub === 'jalapeno') { console.log('⚠️  Lit network "jalapeno" is deprecated; using "serrano".'); litNetworkPub = 'serrano'; }
-        const client = new LitNodeClient({ litNetwork: litNetworkPub });
-        await client.connect();
-        // Back-compat: AuthSig file may still be provided. We'll prefer sessionSigs below.
-        const hasAuthSigFile = !!opts.authSig;
-        const authSig = hasAuthSigFile ? loadAuthSig(opts.authSig) : null;
-
-        // Infer Lit chain from connected provider if not provided
-        const wm = new (require('../wallet-manager'))(); await wm.connect();
-        const provider = wm.getProvider();
-        const litChain = await inferLitChain(provider, opts.chain);
-
-        // Upload a preliminary manifest (not used for id derivation anymore)
-        const manifestCID = await ipfs.uploadJson(manifest, `${opts.name}.manifest`);
-
-        // evmContractConditions for ERC-1155 balanceOf(address,uint256) > 0
-        const evmContractConditions = [
-          {
-            contractAddress: receipt,
-            functionName: 'balanceOf',
-            functionParams: [':userAddress', tokenId],
-            functionAbi: { name: 'balanceOf', type: 'function', stateMutability: 'view', inputs: [{ name: 'account', type: 'address' }, { name: 'id', type: 'uint256' }], outputs: [{ name: '', type: 'uint256' }] },
-            chain: litChain,
-            returnValueTest: { key: '', comparator: '>', value: '0' }
-          }
-        ];
-
-        // Build a session for Lit v7 using session signatures (preferred over AuthSig)
-        // Resource must reflect both ACC hash and the private data hash; derive via client helper
-        const symmetricKey = new Uint8Array(key);
-        const resource = await client.getLitResourceForEncryption({ evmContractConditions, chain: litChain, dataToEncrypt: symmetricKey });
+  const cmd = new Command('premium-pre')
+    .description('Premium PRE encryption - use "sage personal" instead')
+    .action(() => {
+      console.log(`
+Premium PRE (Proxy Re-Encryption)
 
-        // Create session signatures by signing a SIWE message via our CLI signer
-        const sessionSigs = await client.getSessionSigs({
-          chain: 'ethereum',
-          resourceAbilityRequests: [
-            {
-              resource,
-              ability: 'access-control-condition-decryption'
-            }
-          ],
-          authNeededCallback: async ({ uri, expiration, resources, nonce, domain }) => {
-            const signer = wm.getSigner();
-            const address = await signer.getAddress();
-            const siweDomain = domain || process.env.LIT_SIWE_DOMAIN || 'localhost';
-            const siweUri = uri || 'lit:session';
-            const issuedAt = new Date().toISOString();
-            const chainId = 1; // ethereum for SIWE
-            const statement = 'Authorize access to Sage premium content via Lit';
-            const lines = [
-              `${siweDomain} wants you to sign in with your Ethereum account:`,
-              `${address}`,
-              '',
-              `${statement}`,
-              '',
-              `URI: ${siweUri}`,
-              `Version: 1`,
-              `Chain ID: ${chainId}`,
-              `Nonce: ${nonce}`,
-              `Issued At: ${issuedAt}`,
-              `Expiration Time: ${expiration}`
-            ];
-            if (Array.isArray(resources) && resources.length) {
-              lines.push('Resources:');
-              for (const r of resources) lines.push(`- ${r}`);
-            }
-            const message = lines.join('\n');
-            const sig = await signer.signMessage(message);
-            return { sig, derivedVia: 'web3.eth.personal.sign', signedMessage: message, address };
-          }
-        });
-
-        const { encryptUint8Array } = requireLit();
-
-        // v7 API: encrypt the symmetric key with access conditions
-        // Note: param name must be `dataToEncrypt` (not `data`)
-        const encResp = await encryptUint8Array({
-          evmContractConditions,
-          chain: litChain,
-          // Prefer sessionSigs; fall back to authSig if explicitly provided
-          ...(sessionSigs ? { sessionSigs } : {}),
-          ...(sessionSigs ? {} : (authSig ? { authSig } : {})),
-          dataToEncrypt: symmetricKey
-        }, client);
-        // encResp: { ciphertext, dataToEncryptHash }
-        const eskB64 = encResp.ciphertext;
-        const dataToEncryptHash = encResp.dataToEncryptHash;
-
-        // Write final manifest with PRE payload reference
-        manifest.pre = {
-          provider: 'lit',
-          version: '1.0.0',
-          chain: litChain,
-          receipt,
-          tokenId,
-          evmContractConditions,
-          encryptedSymmetricKey: eskB64,
-          dataToEncryptHash
-        };
-        const manifestFinalCID = await ipfs.uploadJson(manifest, `${opts.name}.manifest`);
-
-        // Register price / prompt via existing premium contract
-        const promptsAddr = process.env.PREMIUM_PROMPTS_ADDRESS; if (!promptsAddr) throw new Error('PREMIUM_PROMPTS_ADDRESS not set');
-        const signer = wm.getSigner(); const providerRO = wm.getProvider();
-        const price = ethers.parseUnits(String(opts.price), 6);
-        const ifaceV2 = new ethers.Interface(['function createPremiumPromptWithManifest(bytes32,address,uint256,string)']);
-        // Register using cidHash = tokenIdHex (derived from encryptedCID) to match ERC-1155 gating
-        const cidHash = tokenIdHex;
-        const data = ifaceV2.encodeFunctionData('createPremiumPromptWithManifest', [cidHash, ethers.getAddress(opts.subdao), price, manifestFinalCID]);
-        let sent = false;
-        try {
-          // Preflight: check MANAGER role (robust to contracts that revert on view)
-          const prRO = new ethers.Contract(promptsAddr, ['function hasRole(bytes32,address) view returns (bool)'], providerRO);
-          const MR = ethers.id('MANAGER_ROLE'); // keccak256("MANAGER_ROLE")
-          const me = await signer.getAddress();
-          let hasMgr = false;
-          try { hasMgr = await prRO.hasRole(MR, me); } catch(_) { hasMgr = false; }
-          if (!hasMgr) throw new Error('NO_MANAGER');
-        const tx = await signer.sendTransaction({ to: promptsAddr, data });
-        console.log('🧾 createPremiumPromptWithManifest tx:', tx.hash);
-          sent = true;
-        } catch (e) {
-          const msg = String(e?.message||'');
-          if (msg.includes('closed') || msg.includes('NO_MANAGER') || msg.includes('execution reverted')) {
-            console.log('ℹ️  Creator path closed or missing MANAGER_ROLE. Falling back to governance proposal.');
-            // Propose via GovernanceManager to ensure tuple is cached for reliable queue/execute
-            const GM = require('../governance-manager');
-            const gm = new GM();
-            await gm.initialize(opts.subdao || null);
-
-            // Preflight: ensure proposer meets threshold; auto self-delegate on voting token if needed
-            try {
-              const { ethers } = require('ethers');
-              const provider = gm.provider; const signer = gm.signer;
-              const me = await signer.getAddress();
-              // Resolve governor address for minimal ABI calls
-              const govAddr = (gm.governor.getAddress && typeof gm.governor.getAddress === 'function')
-                ? await gm.governor.getAddress() : gm.governor.target;
-              const govView = new ethers.Contract(govAddr, [
-                'function proposalThreshold() view returns (uint256)',
-                'function token() view returns (address)'
-              ], provider);
-              let votingToken = ethers.ZeroAddress;
-              try { votingToken = await govView.token(); } catch(_) { votingToken = ethers.ZeroAddress; }
-              if (votingToken === ethers.ZeroAddress) {
-                // Fallback to SubDAO stake token (common for GOVERNANCE/HYBRID modes)
-                try {
-                  const sub = new ethers.Contract(ethers.getAddress(opts.subdao), ['function stakeToken() view returns (address)'], provider);
-                  votingToken = await sub.stakeToken();
-                } catch(_) {}
-              }
-              // Read threshold and current votes
-              let threshold = 0n; let votes = 0n;
-              try { threshold = await govView.proposalThreshold(); } catch(_) { threshold = 0n; }
-              if (votingToken && votingToken !== ethers.ZeroAddress) {
-                const vAbi = [
-                  'function getVotes(address) view returns (uint256)',
-                  'function delegates(address) view returns (address)',
-                  'function delegate(address)'
-                ];
-                const vt = new ethers.Contract(votingToken, vAbi, signer);
-                try { votes = await vt.getVotes(me); } catch(_) { votes = 0n; }
-                if (threshold > 0n && votes < threshold) {
-                  // Auto self-delegate unless disabled via flag
-                  if (opts.autoSelfDelegate !== false) {
-                    try {
-                      let curDel = ethers.ZeroAddress;
-                      try { curDel = await vt.delegates(me); } catch(_) { curDel = ethers.ZeroAddress; }
-                      if (String(curDel).toLowerCase() !== me.toLowerCase()) {
-                        console.log('🪪 Auto self-delegating voting power on token', votingToken);
-                        const dtx = await vt.delegate(me);
-                        console.log('⏳ delegate tx:', dtx.hash);
-                        await dtx.wait();
-                        // Re-check votes post-delegation
-                        try { votes = await vt.getVotes(me); } catch(_) {}
-                        console.log('🗳️  Votes after delegation:', require('ethers').formatEther(votes));
-                      }
-                    } catch (delErr) {
-                      console.log('⚠️  Auto self-delegation skipped/failed:', String(delErr?.message||delErr));
-                    }
-                  }
-                  // Final advisory if still under threshold
-                  if (votes < threshold) {
-                    const fmt = (x)=>require('ethers').formatEther(x);
-                    console.log('❗ Proposer preflight: insufficient voting power.');
-                    console.log('   votes=', fmt(votes), ' threshold=', fmt(threshold));
-                    console.log('   Hint: stake into the SubDAO and self-delegate, or use timelock schedule-call.');
-                  }
-                }
-              }
-            } catch (pfErr) {
-              // Non-fatal; continue to attempt proposal (Governor will enforce)
-              console.log('⚠️  Preflight check failed (continuing):', String(pfErr?.message||pfErr));
-            }
-
-            const targets = [promptsAddr]; const values = [0n]; const calldatas = [data];
-            const desc = `Register premium prompt via PRE (Lit): ${opts.name}`;
-
-            // If after preflight+auto-delegate we still have insufficient votes, offer Timelock route now
-            try {
-              const { ethers } = require('ethers');
-              const provider = gm.provider; const signer = gm.signer; const me = await signer.getAddress();
-              const govAddr = (gm.governor.getAddress && typeof gm.governor.getAddress === 'function') ? await gm.governor.getAddress() : gm.governor.target;
-              const govView = new ethers.Contract(govAddr, ['function proposalThreshold() view returns (uint256)','function token() view returns (address)'], provider);
-              let threshold = 0n; try { threshold = await govView.proposalThreshold(); } catch(_) {}
-              if (threshold > 0n) {
-                let votingToken = ethers.ZeroAddress;
-                try { votingToken = await govView.token(); } catch(_) {}
-                if (votingToken === ethers.ZeroAddress) {
-                  try { const sub = new ethers.Contract(ethers.getAddress(opts.subdao), ['function stakeToken() view returns (address)'], provider); votingToken = await sub.stakeToken(); } catch(_) {}
-                }
-                let votes = 0n; if (votingToken && votingToken !== ethers.ZeroAddress) { try { votes = await new ethers.Contract(votingToken, ['function getVotes(address) view returns (uint256)'], provider).getVotes(me); } catch(_) {} }
-                if (votes < threshold) {
-                  const inquirer = (require('inquirer').default || require('inquirer'));
-                  const { route } = await inquirer.prompt([
-                    { type:'list', name:'route', message:'Insufficient voting power. Choose how to proceed:', choices:[
-                      { name:'Schedule via Timelock now (recommended)', value:'timelock' },
-                      { name:'Attempt creating a proposal anyway', value:'proposal' },
-                      { name:'Abort (I will stake/delegate first)', value:'abort' }
-                    ]}
-                  ]);
-                  if (route === 'timelock') {
-                    try {
-                      const tl = gm.timelock; if (!tl) throw new Error('Timelock not resolved');
-                      const tlAddr = (tl.getAddress && typeof tl.getAddress === 'function') ? await tl.getAddress() : tl.target;
-                      const PROPOSER = await tl.PROPOSER_ROLE();
-                      const has = await tl.hasRole(PROPOSER, me).catch(()=>false);
-                      if (!has) throw new Error('Current signer lacks PROPOSER_ROLE on Timelock');
-                      const delay = await tl.getMinDelay().catch(()=>0n);
-                      const salt = ethers.hexlify(ethers.randomBytes(32));
-                      const predecessor = ethers.ZeroHash;
-                      console.log('⏳ Scheduling via Timelock...', { timelock: tlAddr, target: promptsAddr, delay: String(delay) });
-                      const stx = await tl.schedule(promptsAddr, 0, data, predecessor, salt, delay);
-                      console.log('📨 schedule tx:', stx.hash); { const { waitForReceipt } = require('../utils/tx-wait'); const { ethers } = require('ethers'); const pr = new ethers.JsonRpcProvider(process.env.RPC_URL || process.env.BASE_SEPOLIA_RPC || process.env.BASE_RPC_URL || 'https://base-sepolia.publicnode.com'); await waitForReceipt(pr, stx, Number(process.env.SAGE_TX_WAIT_MS || 60000)); } console.log('✅ Scheduled');
-                      if (delay === 0n) {
-                        try { const etx = await tl.execute(promptsAddr, 0, data, predecessor, salt); console.log('⚡ execute tx:', etx.hash); { const { waitForReceipt } = require('../utils/tx-wait'); const { ethers } = require('ethers'); const pr = new ethers.JsonRpcProvider(process.env.RPC_URL || process.env.BASE_SEPOLIA_RPC || process.env.BASE_RPC_URL || 'https://base-sepolia.publicnode.com'); await waitForReceipt(pr, etx, Number(process.env.SAGE_TX_WAIT_MS || 60000)); } console.log('✅ Executed'); }
-                        catch(exErr) { console.log('⚠️  Execute failed or not ready:', String(exErr?.message||exErr)); }
-                      } else {
-                        console.log('ℹ️  Execute after delay:');
-                        console.log(`   sage timelock execute --subdao ${ethers.getAddress(opts.subdao)} --target ${promptsAddr} --value 0 --data ${data} --predecessor 0x${'0'.repeat(64)} --salt ${salt}`);
-                      }
-                      // Output identifiers and exit early (timelock route)
-                      console.log('🔗 Identifiers:');
-                      console.log('  encryptedCID:', cipherCID);
-                      console.log('  tokenId     :', tokenId);
-                      console.log('  cidHash     :', cidHash);
-                      console.log('  manifestCID :', manifestFinalCID);
-                      console.log(JSON.stringify({ manifestCID: manifestFinalCID, encryptedCID: cipherCID, cidHash, route: 'timelock', timelock: tlAddr }, null, 2));
-                      return;
-                    } catch (timErr) {
-                      console.log('❌ Timelock scheduling failed:', String(timErr?.message||timErr));
-                      console.log('   You can retry manually with:');
-                      console.log(`   sage timelock schedule-call --subdao ${ethers.getAddress(opts.subdao)} --to ${promptsAddr} --sig 'createPremiumPromptWithManifest(bytes32,address,uint256,string)' --args '${cidHash},${ethers.getAddress(opts.subdao)},${price.toString()},${manifestFinalCID}'`);
-                    }
-                  } else if (route === 'abort') {
-                    throw new Error('Aborted by user due to insufficient voting power.');
-                  }
-                }
-              }
-            } catch(_) {}
-            try {
-              const pid = await gm.createProposal(targets, values, calldatas, desc);
-              console.log('🗳️  proposal id:', pid);
-              try { const { execSync } = require('child_process'); console.log(`➡️  Watching proposal ${pid} for queue/execute...`); console.log(execSync(['node','packages/cli/src/index.js','governance','watch',String(pid),'--subdao',String(opts.subdao)].join(' '), { encoding:'utf8' })); } catch(_) {}
-            } catch (propErr) {
-              const em = String(propErr?.message||'');
-              if (em.includes('Operator mode detected') || em.toLowerCase().includes('not a timelock proposer')) {
-                console.log('ℹ️  Operator mode detected; scheduling on Timelock.');
-                const { resolveGovContext } = require('../utils/gov-context');
-                const ctx2 = await resolveGovContext({ govOpt: null, subdaoOpt: opts.subdao, provider: providerRO });
-                const tlAddr = ctx2.timelock || process.env.TIMELOCK || process.env.TIMELOCK_ADDRESS;
-                if (!tlAddr) throw new Error('Timelock not resolved for SubDAO');
-                const tlIface = new ethers.Interface(['function schedule(address,uint256,bytes,bytes32,bytes32,uint256)','function execute(address,uint256,bytes,bytes32,bytes32)','function getMinDelay() view returns (uint256)']);
-                const tl = new ethers.Contract(tlAddr, tlIface, signer);
-                const predecessor = ethers.ZeroHash; const salt = ethers.hexlify(ethers.randomBytes(32));
-                const delay = await tl.getMinDelay().catch(()=>0n);
-                const stx = await tl.schedule(promptsAddr, 0, data, predecessor, salt, delay);
-                console.log('⏳ Timelock schedule tx:', stx.hash); { const { waitForReceipt } = require('../utils/tx-wait'); const { ethers } = require('ethers'); const pr = new ethers.JsonRpcProvider(process.env.RPC_URL || process.env.BASE_SEPOLIA_RPC || process.env.BASE_RPC_URL || 'https://base-sepolia.publicnode.com'); await waitForReceipt(pr, stx, Number(process.env.SAGE_TX_WAIT_MS || 60000)); } console.log('✅ Scheduled');
-                if (delay === 0n) { const etx = await tl.execute(promptsAddr, 0, data, predecessor, salt); console.log('⚡ execute tx:', etx.hash); { const { waitForReceipt } = require('../utils/tx-wait'); const { ethers } = require('ethers'); const pr = new ethers.JsonRpcProvider(process.env.RPC_URL || process.env.BASE_SEPOLIA_RPC || process.env.BASE_RPC_URL || 'https://base-sepolia.publicnode.com'); await waitForReceipt(pr, etx, Number(process.env.SAGE_TX_WAIT_MS || 60000)); } console.log('✅ Executed'); }
-              } else { throw propErr; }
-            }
-            // Fall through to final JSON output
-          } else {
-            throw e;
-          }
-        }
-        console.log('🔗 Identifiers:');
-        console.log('  encryptedCID:', cipherCID);
-        console.log('  tokenId     :', tokenId);
-        console.log('  cidHash     :', cidHash);
-        console.log('  manifestCID :', manifestFinalCID);
-        console.log(JSON.stringify({ manifestCID: manifestFinalCID, encryptedCID: cipherCID, cidHash, route: sent?'direct':'governance', pre: { provider: 'lit', chain: litChain, receipt, tokenId, encryptedSymmetricKey: eskB64 } }, null, 2));
-      } catch (e) { console.error('❌ premium-pre publish failed:', e.message); process.exit(1); }
-    });
-
-  cmd
-    .command('manifest')
-    .description('Resolve the manifest CID for a PRE (Lit) premium from subgraph/logs/cache or raw calldata')
-    .option('--proposal <id>', 'Proposal ID that registered the premium (uses ./.sage/proposals.json)')
-    .option('--gov <address>', 'Governor address (overrides --subdao/context)')
-    .option('--subdao <address>', 'SubDAO address to derive Governor from')
-    .option('--calldata <0xdata>', 'Raw calldata to decode (skips lookups)')
-    .option('--cid-hash <hex>', 'cidHash (bytes32 hex) to search via subgraph/logs')
-    .option('--subgraph <url>', 'Subgraph URL (defaults to SUBGRAPH_URL env)')
-    .option('--prompts <address>', 'PremiumPrompts contract address for logs fallback')
-    .option('--from <block>', 'Logs scan start block (default: current-100000)')
-    .option('--json', 'Output JSON', false)
-    .action(async (opts) => {
-      try {
-        const fs = require('fs'); const path = require('path'); const axios = require('axios');
-        let dataHex = null; let used = '';
-        if (opts.calldata && String(opts.calldata).startsWith('0x')) {
-          dataHex = String(opts.calldata); used = 'calldata';
-        } else {
-          // 1) Subgraph fast-path
-          const subgraphUrl = String(opts.subgraph || process.env.SUBGRAPH_URL || '').trim();
-          if (subgraphUrl && (opts['cid-hash'] || opts.subdao)) {
-            try {
-              if (opts['cid-hash']) {
-                const q = { query: 'query($id: ID!){ premiumPrompt(id:$id){ id manifestCID subdao price } }', variables: { id: String(opts['cid-hash']).toLowerCase() } };
-                const { data } = await axios.post(subgraphUrl, q, { headers: { 'content-type': 'application/json' } });
-                const manifestCID = data?.data?.premiumPrompt?.manifestCID || null;
-                if (manifestCID) { if (opts.json) console.log(JSON.stringify({ manifestCID, source: 'subgraph:id' }, null, 2)); else console.log('Manifest CID:', manifestCID); return; }
-              } else if (opts.subdao) {
-                const q = { query: 'query($sub: Bytes!){ premiumPrompts(where:{ subdao:$sub }, orderBy:blockTimestamp, orderDirection: desc, first: 20){ id manifestCID subdao price } }', variables: { sub: String(opts.subdao).toLowerCase() } };
-                const { data } = await axios.post(subgraphUrl, q, { headers: { 'content-type': 'application/json' } });
-                const list = data?.data?.premiumPrompts || [];
-                if (list.length) { if (opts.json) console.log(JSON.stringify({ results: list, source: 'subgraph:subdao' }, null, 2)); else { console.log('Premium prompts (latest 20):'); for (const it of list) console.log(`- cidHash: ${it.id}  manifestCID: ${it.manifestCID || 'n/a'}  price: ${it.price}`); } return; }
-              }
-            } catch (_) { /* fallthrough */ }
-          }
-
-          // 2) Logs fallback if prompts address provided
-          if (opts.prompts) {
-            const { ethers } = require('ethers');
-            const provider = new ethers.JsonRpcProvider(process.env.RPC_URL || 'https://base-sepolia.publicnode.com');
-            const ifaceEv = new ethers.Interface(['event PremiumPromptCreatedV2(bytes32 indexed cidHash, address indexed subdao, uint256 price, string manifestCID)']);
-            const topic0 = ifaceEv.getEvent('PremiumPromptCreatedV2').topicHash;
-            const topics = [topic0];
-            if (opts['cid-hash']) topics.push(ethers.zeroPadValue(String(opts['cid-hash']), 32));
-            const current = await provider.getBlockNumber();
-            const fromBlock = opts.from ? Number(opts.from) : Math.max(0, current - 100000);
-            const logs = await provider.getLogs({ address: ethers.getAddress(opts.prompts), topics, fromBlock, toBlock: 'latest' });
-            if (logs.length) {
-              const last = logs[logs.length-1];
-              const parsed = ifaceEv.parseLog(last);
-              const manifestCID = String(parsed?.args?.manifestCID || '');
-              if (manifestCID) { if (opts.json) console.log(JSON.stringify({ manifestCID, source: `logs:${opts.prompts}` }, null, 2)); else console.log('Manifest CID:', manifestCID); return; }
-            }
-          }
-
-          // 3) Proposals cache fallback
-          const { ethers } = require('ethers');
-          const { resolveGovContext } = require('../utils/gov-context');
-          const provider = new ethers.JsonRpcProvider(process.env.RPC_URL || 'https://base-sepolia.publicnode.com');
-          const ctx = await resolveGovContext({ govOpt: opts.gov, subdaoOpt: opts.subdao, provider });
-          const govAddr = (ctx.governor || process.env.GOV || '').toLowerCase();
-          const cachePath = path.join(process.cwd(), '.sage', 'proposals.json');
-          if (fs.existsSync(cachePath) && govAddr) {
-            const cache = JSON.parse(fs.readFileSync(cachePath, 'utf8')||'{}');
-            const entries = cache[govAddr] || {};
-            let pid = opts.proposal ? String(opts.proposal) : null;
-            if (!pid) { const keys = Object.keys(entries); if (keys.length) pid = keys[keys.length-1]; }
-            const t = entries[pid || ''] || null;
-            if (t && Array.isArray(t.calldatas) && t.calldatas.length) { dataHex = String(t.calldatas[0]); used = `cache:${ctx.governor}:${pid}`; }
-          }
-          if (!dataHex) throw new Error('No source available. Provide --calldata, or set SUBGRAPH_URL and use --cid-hash/--subdao, or pass --prompts for logs.');
-        }
-
-        // Decode calldata as createPremiumPromptWithManifest(bytes32,address,uint256,string)
-        const { ethers: E } = require('ethers');
-        const iface = new E.Interface(['function createPremiumPromptWithManifest(bytes32,address,uint256,string)']);
-        let cid = null;
-        try { const decoded = iface.decodeFunctionData('createPremiumPromptWithManifest', dataHex); cid = String(decoded?.[3] || ''); }
-        catch (_) {
-          try { const buf = Buffer.from(dataHex.replace(/^0x/, ''), 'hex'); const s = buf.toString('utf8'); const m = s.match(/Qm[1-9A-HJ-NP-Za-km-z]{44,}/); if (m) cid = m[0]; } catch (_) {}
-        }
-        if (!cid) throw new Error('Could not extract manifest CID from calldata');
-        if (opts.json) console.log(JSON.stringify({ manifestCID: cid, source: used || 'decoded-calldata' }, null, 2));
-        else console.log('Manifest CID:', cid);
-      } catch (e) { console.error('❌ manifest resolve failed:', e.message); process.exit(1); }
-    });
-
-  cmd
-    .command('view')
-    .description('For buyers: request key from Lit via ERC-1155 gating and decrypt locally (no centralized reveal)')
-    .requiredOption('--cid <manifestCID>', 'Manifest CID')
-    .option('--auth-sig <path>', 'Path to Lit AuthSig JSON (buyer wallet SIWE signature)')
-    .option('--auto-auth', 'Auto-generate AuthSig from a keystore that owns the receipt', false)
-    .option('--chain <litChain>', 'Override Lit chain key (e.g., baseSepolia)')
-    .action(async (opts) => {
-      try {
-        const IPFSManager = require('../ipfs-manager');
-        const { fromB64, decryptAesGcm } = require('../utils/aes');
-        const ipfs = new IPFSManager(); await ipfs.initialize();
-        const manifest = await ipfs.downloadJson(opts.cid);
-        if (!manifest?.encryptedCID || !manifest?.pre || manifest.pre.provider !== 'lit') throw new Error('Manifest missing PRE payload');
-        const enc = await ipfs.downloadJson(manifest.encryptedCID);
-        const eskB64 = manifest.pre.encryptedSymmetricKey;
-        const dataToEncryptHash = manifest.pre.dataToEncryptHash;
-        let evmContractConditions = manifest.pre.evmContractConditions;
-        let chain = opts.chain || manifest.pre.chain || process.env.LIT_CHAIN || 'baseSepolia';
-        // Normalize chain key used historically
-        if (chain === 'base-sepolia') chain = 'baseSepolia';
-        // Normalize tokenId param to decimal string for Lit nodes AND update chain in access conditions
-        try {
-          if (Array.isArray(evmContractConditions) && evmContractConditions.length) {
-            const cond = evmContractConditions[0];
-            let updatedCond = { ...cond };
-            
-            // Update chain identifier to normalized version
-            if (updatedCond.chain === 'base-sepolia') {
-              updatedCond.chain = 'baseSepolia';
-            }
-            
-            // Update tokenId to decimal format
-            if (cond?.functionName === 'balanceOf' && Array.isArray(cond.functionParams) && cond.functionParams.length >= 2) {
-              const p1 = String(cond.functionParams[1] || '').trim();
-              if (/^0x[0-9a-fA-F]+$/.test(p1)) {
-                const dec = BigInt(p1).toString();
-                updatedCond.functionParams = [cond.functionParams[0], dec];
-              }
-            }
-            
-            evmContractConditions = [updatedCond];
-          }
-        } catch (_) {}
-        // Strong preflight: confirm tokenId matches on-chain receipt id expected by purchase path
-        try {
-          const { ethers } = require('ethers');
-          const { normalizeCidV1Base32 } = require('../utils/cid');
-          const expectedId = ethers.keccak256(ethers.toUtf8Bytes(normalizeCidV1Base32(manifest.encryptedCID)));
-          if (manifest.pre.tokenId?.toLowerCase?.() !== expectedId.toLowerCase()) {
-            console.log('⚠️  Warning: Manifest tokenId does not match encryptedCID-derived id.');
-            console.log('   manifest.pre.tokenId:', manifest.pre.tokenId);
-            console.log('   expected:', expectedId);
-            console.log('   If decryption fails, republish so tokenId is derived from encryptedCID.');
-          }
-        } catch(_) {}
-        const { LitNodeClient, decryptToUint8Array } = requireLit();
-        let litNetworkView = opts.litNetwork || process.env.LIT_NETWORK || 'serrano';
-        if (litNetworkView === 'jalapeno') { console.log('⚠️  Lit network "jalapeno" is deprecated; using "serrano".'); litNetworkView = 'serrano'; }
-        const client = new LitNodeClient({ litNetwork: litNetworkView }); 
-        await client.connect();
-        let authSig;
-        if (opts.authSig) {
-          authSig = loadAuthSig(opts.authSig);
-        } else if (opts.autoAuth) {
-          // Find an address with receipt balance>0 and sign SIWE via Cast keystore
-          const { ethers } = require('ethers');
-          const receipt = manifest.pre.receipt; const tokenId = manifest.pre.tokenId;
-          const provider = new ethers.JsonRpcProvider(process.env.RPC_URL || 'https://base-sepolia.publicnode.com');
-          const rcpt = new ethers.Contract(receipt, ['function balanceOf(address,uint256) view returns (uint256)'], provider);
-          const Cast = require('../cast-wallet-manager'); const cast = new Cast(); await cast.connect();
-          const ksDir = cast.keystoreDir; const fs = require('fs'); const path = require('path'); const { spawnSync } = require('child_process');
-          if (!fs.existsSync(ksDir)) throw new Error('No Cast keystores found. Provide --auth-sig <file>.');
-          const files = fs.readdirSync(ksDir);
-          let match = null;
-          for (const f of files) {
-            const p = path.join(ksDir, f);
-            const res = spawnSync(cast.castCommand, ['wallet', 'address', p], { encoding: 'utf8' });
-            const addr = (res.stdout || '').trim();
-            if (!addr) continue;
-            try { const bal = await rcpt.balanceOf(addr, tokenId); if (BigInt(bal.toString()) > 0n) { match = { addr, ks: p }; break; } } catch (_) {}
-          }
-          if (!match) throw new Error('No keystore address holds the required receipt. Generate an AuthSig for the buyer wallet.');
-          // Build SIWE
-          const net = await provider.getNetwork(); const chainId = Number(net.chainId);
-          const nonce = Math.random().toString(36).slice(2); const issuedAt = new Date().toISOString();
-          const message = [`localhost wants you to sign in with your Ethereum account:`, `${match.addr}`, '', `Authorize with Lit Protocol`, '', `URI: http://localhost`, `Version: 1`, `Chain ID: ${chainId}`, `Nonce: ${nonce}`, `Issued At: ${issuedAt}`].join('\n');
-          const pw = await cast.promptForPassword();
-          const sigRes = spawnSync(cast.castCommand, ['wallet', 'sign', '--keystore', match.ks, '--password', pw, message], { encoding: 'utf8' });
-          if (sigRes.status !== 0) throw new Error(sigRes.stderr || 'cast wallet sign failed');
-          authSig = { sig: (sigRes.stdout||'').trim(), derivedVia: 'cast.personal_sign', signedMessage: message, address: match.addr };
-        } else {
-          throw new Error('Provide --auth-sig <file> or use --auto-auth');
-        }
-        // Build session signatures for Lit v7 (preferred over AuthSig)
-        // Compute the resource manually: hashOfConditions/hashOfPrivateData, using the proper Resource class
-        const { hashEVMContractConditions } = require('@lit-protocol/access-control-conditions');
-        const { uint8arrayToString } = require('@lit-protocol/uint8arrays');
-        const { LitAccessControlConditionResource } = requireLitAuthHelpers();
-        const condHashBuf = await hashEVMContractConditions(evmContractConditions);
-        const condHash = uint8arrayToString(new Uint8Array(condHashBuf), 'base16');
-        const resource = new LitAccessControlConditionResource(`${condHash}/${dataToEncryptHash}`);
-        
-        // Get wallet manager for session signatures
-        const WalletManager = require('../wallet-manager');
-        const wm = new WalletManager();
-        await wm.connect();
-        
-        // Create session signatures by signing a SIWE message via our CLI signer
-        const sessionSigs = await client.getSessionSigs({
-          chain: 'ethereum',
-          resourceAbilityRequests: [
-            {
-              resource,
-              ability: 'access-control-condition-decryption'
-            }
-          ],
-          authNeededCallback: async ({ uri, expiration, resources, nonce, domain }) => {
-            const signer = wm.getSigner();
-            const address = await signer.getAddress();
-            const siweDomain = domain || process.env.LIT_SIWE_DOMAIN || 'localhost';
-            const siweUri = uri || 'lit:session';
-            const issuedAt = new Date().toISOString();
-            const chainId = 1; // ethereum for SIWE
-            const statement = 'Authorize access to Sage premium content via Lit';
-            const lines = [
-              `${siweDomain} wants you to sign in with your Ethereum account:`,
-              `${address}`,
-              '',
-              `${statement}`,
-              '',
-              `URI: ${siweUri}`,
-              `Version: 1`,
-              `Chain ID: ${chainId}`,
-              `Nonce: ${nonce}`,
-              `Issued At: ${issuedAt}`,
-              `Expiration Time: ${expiration}`
-            ];
-            if (Array.isArray(resources) && resources.length) {
-              lines.push('Resources:');
-              for (const r of resources) lines.push(`- ${r}`);
-            }
-            const message = lines.join('\n');
-            const sig = await signer.signMessage(message);
-            return { sig, derivedVia: 'web3.eth.personal.sign', signedMessage: message, address };
-          }
-        });
-
-        // Optional preflight: ensure buyer holds ERC-1155
-        try {
-          const { ethers } = require('ethers');
-          const receipt = manifest.pre.receipt; const tokenId = manifest.pre.tokenId;
-          const provider = new ethers.JsonRpcProvider(process.env.RPC_URL || 'https://base-sepolia.publicnode.com');
-          const rcpt = new ethers.Contract(receipt, ['function balanceOf(address,uint256) view returns (uint256)'], provider);
-          const owner = (authSig.address || authSig.siwe?.address || '').toString();
-          if (owner && owner.startsWith('0x')) {
-            const bal = await rcpt.balanceOf(owner, tokenId).catch(()=>null);
-            if (bal !== null && BigInt(bal.toString()) === 0n) {
-              console.log('❌ AuthSig address does not own the required receipt for this manifest.');
-              console.log('   Address:', owner);
-              console.log('   TokenId:', tokenId);
-              console.log('   Hint: generate an AuthSig for the buyer wallet that holds the receipt.');
-              console.log('   Example: sage wallet use <0xBuyer>; sage premium-pre authsig --account <0xBuyer> --out ./authSig.buyer.json');
-            }
-          }
-        } catch(_) {}
-        
-        // Try multiple tokenId formats and chain combinations for backward compatibility
-        const tokenId = manifest.pre.tokenId;
-        // Preserve original tokenId format from manifest for exact condition matching
-        const originalTokenId = String(tokenId);
-        // Also prepare decimal format for legacy compatibility
-        const decimalTokenId = (/^0x[0-9a-fA-F]+$/.test(originalTokenId)) ? BigInt(originalTokenId).toString() : originalTokenId;
-        const attempts = [
-          // Primary: baseSepolia + original tokenId format from manifest (preserves publishing format)
-          { evmContractConditions: evmContractConditions.map(cond => ({
-            ...cond,
-            functionParams: [cond.functionParams[0], originalTokenId] // Use exact tokenId format from manifest
-          })), chain: 'baseSepolia' },
-          // Fallback: baseSepolia + decimal tokenId (for legacy compatibility)
-          { evmContractConditions, chain: 'baseSepolia' },
-          // Legacy: base-sepolia + original tokenId format
-          { evmContractConditions: evmContractConditions.map(cond => ({
-            ...cond,
-            functionParams: [cond.functionParams[0], originalTokenId],
-            chain: 'base-sepolia'
-          })), chain: 'base-sepolia' }
-        ];
-
-        let symmetricKey = null;
-        let lastError = null;
-        
-        for (let i = 0; i < attempts.length; i++) {
-          const attempt = attempts[i];
-          try {
-            console.log(`🔍 Attempt ${i + 1}/${attempts.length}: chain=${attempt.chain}, tokenId=${attempt.evmContractConditions[0].functionParams[1]}`);
-            
-            // v7 API: decrypt using session signatures  
-            const decryptedKey = await decryptToUint8Array(
-              {
-                evmContractConditions: attempt.evmContractConditions,
-                chain: attempt.chain,
-                ciphertext: eskB64,
-                dataToEncryptHash,
-                // Prefer sessionSigs; fall back to authSig if explicitly provided
-                ...(sessionSigs ? { sessionSigs } : {}),
-                ...(sessionSigs ? {} : (authSig ? { authSig } : {}))
-              },
-              client
-            );
-            
-            symmetricKey = decryptedKey;
-            console.log(`✅ Success with attempt ${i + 1}`);
-            break;
-          } catch (err) {
-            lastError = err;
-            console.log(`❌ Attempt ${i + 1} failed: ${err.message}`);
-            if (i === attempts.length - 1) {
-              throw new Error(`All decryption attempts failed. Last error: ${lastError.message}`);
-            }
-          }
-        }
-        
-        // symmetricKey is Uint8Array
-        const keyBytes = Buffer.from(symmetricKey);
-        const plaintext = decryptAesGcm(fromB64(enc.ciphertext), keyBytes, fromB64(enc.iv), fromB64(enc.tag));
-        console.log(plaintext);
-      } catch (e) { console.error('❌ premium-pre view failed:', e.message); process.exit(1); }
-    });
+This command has been replaced by personal premium.
 
-  cmd
-    .command('authsig')
-    .description('Generate a Lit AuthSig (SIWE-style)')
-    .option('--out <path>', 'Output JSON file', './authSig.json')
-    .option('--domain <domain>', 'SIWE domain', 'localhost')
-    .option('--uri <uri>', 'SIWE URI', 'http://localhost')
-    .option('--statement <text>', 'SIWE statement', 'Authorize with Lit Protocol')
-    .option('--chain-id <id>', 'Chain ID for SIWE (defaults to connected RPC)')
-    .option('--account <address>', 'Explicit account address to sign with (Cast keystore)')
-    .option('--wallet-type <type>', 'Signer type: cast|pk (default: cast)', 'cast')
-    .option('--private-key <hex>', 'Private key (0x...) when --wallet-type=pk')
-    .action(async (opts) => {
-      try {
-        const fs = require('fs'); const path = require('path');
-        const { ethers } = require('ethers');
-        const rpcUrl = process.env.RPC_URL || 'https://base-sepolia.publicnode.com';
-        const provider = new ethers.JsonRpcProvider(rpcUrl);
-        const net = await provider.getNetwork();
-        const chainId = opts['chain-id'] ? Number(opts['chain-id']) : Number(net.chainId);
+For personal premium prompts:
 
-        // Helper to build SIWE
-        const buildSiwe = (addr) => {
-        const nonce = Math.random().toString(36).slice(2);
-        const issuedAt = new Date().toISOString();
-        const message = [
-          `${opts.domain} wants you to sign in with your Ethereum account:`,
-          `${addr}`,
-          '',
-          `${opts.statement}`,
-          '',
-          `URI: ${opts.uri}`,
-          `Version: 1`,
-          `Chain ID: ${chainId}`,
-          `Nonce: ${nonce}`,
-          `Issued At: ${issuedAt}`
-        ].join('\n');
-          return message;
-        };
+  sage personal sell <key> <price> --encrypt --file <path>   # List encrypted content
+  sage personal buy <creator> <key>                          # Purchase license
+  sage personal access <creator> <key>                       # Decrypt purchased content
 
-        let address = null; let signature = null; let derivedVia = '';
-        if (opts.walletType === 'pk') {
-          if (!opts.privateKey) throw new Error('Provide --private-key when using --wallet-type=pk');
-          const pk = opts.privateKey.startsWith('0x') ? opts.privateKey : ('0x' + opts.privateKey);
-          const signer = new ethers.Wallet(pk, provider);
-          address = await signer.getAddress();
-          const msg = buildSiwe(address);
-          signature = await signer.signMessage(msg);
-          derivedVia = 'pk.personal_sign';
-          const outPath = path.resolve(opts.out);
-          fs.writeFileSync(outPath, JSON.stringify({ sig: signature, derivedVia, signedMessage: msg, address }, null, 2));
-          console.log('✅ Wrote AuthSig to', outPath);
-          return;
-        }
+Enable personal commands:
+  export SAGE_ENABLE_PERSONAL=1
 
-        // Cast keystore path
-        const Cast = require('../cast-wallet-manager');
-        const cast = new Cast();
-        await cast.connect();
-        let targetAddr = cast.account;
-        let keystorePath = null;
-        if (opts.account && opts.account.startsWith('0x')) {
-          // Try resolve a keystore file matching the requested account
-          const ksDir = cast.keystoreDir;
-          if (!fs.existsSync(ksDir)) throw new Error('Cast keystore directory not found');
-          const files = fs.readdirSync(ksDir);
-          const { spawnSync } = require('child_process');
-          for (const f of files) {
-            const p = path.join(ksDir, f);
-            const res = spawnSync(cast.castCommand, ['wallet', 'address', p], { encoding: 'utf8' });
-            const addr = (res.stdout || '').trim();
-            if (addr && addr.toLowerCase() === opts.account.toLowerCase()) { keystorePath = p; targetAddr = addr; break; }
-          }
-          if (!keystorePath) throw new Error('No keystore found for --account');
-        } else {
-          // Use saved keystore from cast manager
-          const saved = cast.loadCastWallet();
-          if (!saved?.keystorePath) throw new Error('No Cast wallet configured');
-          keystorePath = saved.keystorePath; targetAddr = saved.address;
-        }
-        const msg = buildSiwe(targetAddr);
-        // Prompt for password
-        const pw = await cast.promptForPassword();
-        const { spawnSync } = require('child_process');
-        const res = spawnSync(cast.castCommand, ['wallet', 'sign', '--keystore', keystorePath, '--password', pw, msg], { encoding: 'utf8' });
-        if (res.status !== 0) throw new Error(res.stderr || 'cast wallet sign failed');
-        signature = (res.stdout || '').trim(); derivedVia = 'cast.personal_sign';
-        const outPath = path.resolve(opts.out);
-        fs.writeFileSync(outPath, JSON.stringify({ sig: signature, derivedVia, signedMessage: msg, address: targetAddr }, null, 2));
-        console.log('✅ Wrote AuthSig to', outPath);
-      } catch (e) { console.error('❌ authsig failed:', e.message); process.exit(1); }
+For more information:
+  docs/specs/premium-endorsement-model.md
+`);
     });
 
   program.addCommand(cmd);