@sage-protocol/cli 0.3.7 → 0.3.10

package/dist/cli/commands/premium.js

@@ -1,675 +1,245 @@
 const { Command } = require('commander');
-const { ethers } = require('ethers');
-const { handleCLIError } = require('../utils/error-handler');
-let normalizeCidV1Base32;
-try { ({ normalizeCidV1Base32 } = require('-protocol/shared')); }
-catch (_) { ({ normalizeCidV1Base32 } = require('../utils/cid')); }
+
+/**
+ * Premium Prompts CLI
+ *
+ * SubDAO‑based premium prompts are no longer the recommended user path.
+ * Personal premium is the default for creators; the remaining premium commands
+ * are focused on diagnostics and governance wiring for the PremiumPrompts/
+ * SimpleKeyStore system.
+ *
+ * Personal premium (recommended):
+ *
+ *   sage personal sell <key> <price> --encrypt --file <path>
+ *   sage personal buy <creator> <key>
+ *   sage personal access <creator> <key>
+ *
+ * See docs/specs/premium-endorsement-model.md for the new architecture.
+ */
+
+async function runPremiumDoctor(opts) {
+  const { ethers } = require('ethers');
+  const cfg = require('../config');
+  const { resolveGovContext } = require('../utils/gov-context');
+  const colors = require('../utils/chalk-adapter');
+
+  const rpcUrl = (cfg.resolveRpcUrl && cfg.resolveRpcUrl()) || process.env.RPC_URL || 'https://base-sepolia.publicnode.com';
+  const provider = new ethers.JsonRpcProvider(rpcUrl);
+
+  let signerAddress = null;
+  try {
+    const WM = require('@sage-protocol/wallet-manager');
+    const wm = new WM();
+    await wm.connect();
+    signerAddress = wm.getAccount();
+  } catch (_) {
+    // Best-effort; signerAddress may remain null for read-only checks
+  }
+
+  let ctx;
+  try {
+    ctx = await resolveGovContext({
+      govOpt: opts.gov || null,
+      subdaoOpt: opts.dao || opts.subdao || null,
+      provider
+    });
+  } catch (e) {
+    const msg = `Failed to resolve governance context: ${e.message}`;
+    if (opts.json) {
+      const out = {
+        ok: false,
+        error: msg,
+        context: { dao: opts.dao || opts.subdao || null }
+      };
+      process.stdout.write(JSON.stringify(out, null, 2) + '\n');
+    } else {
+      console.error(colors.red(`❌ ${msg}`));
+      console.error('Pass --dao <address> or configure context via `sage context use`.');
+    }
+    process.exit(1);
+  }
+
+  const subdao = ctx.subdao || process.env.WORKING_SUBDAO_ADDRESS || process.env.SUBDAO || null;
+  const governor = ctx.governor || process.env.GOV || process.env.GOVERNOR_ADDRESS || null;
+  const timelock = ctx.timelock || process.env.TIMELOCK || process.env.TIMELOCK_ADDRESS || null;
+
+  if (!timelock) {
+    const msg = 'Timelock not resolved. Pass --dao <address> or configure context via `sage context use`.';
+    if (opts.json) {
+      process.stdout.write(JSON.stringify({ ok: false, error: msg, context: { subdao, governor } }, null, 2) + '\n');
+    } else {
+      console.error(colors.red(`❌ ${msg}`));
+    }
+    process.exit(1);
+  }
+
+  const promptsAddr = process.env.PREMIUM_PROMPTS_ADDRESS || null;
+  const receiptAddr = process.env.PREMIUM_RECEIPT_ADDRESS || null;
+  const keystoreAddr = process.env.SIMPLE_KEY_STORE_ADDRESS || null;
+
+  const result = {
+    ok: true,
+    rpcUrl,
+    subdao,
+    governor,
+    timelock,
+    signer: signerAddress,
+    prompts: { address: promptsAddr || null },
+    receipt: { address: receiptAddr || null },
+    keystore: { address: keystoreAddr || null }
+  };
+
+  if (!opts.json) {
+    console.log(colors.cyan('💎 Premium Doctor'));
+    console.log(` RPC      : ${rpcUrl}`);
+    console.log(` DAO      : ${subdao || '-'}${subdao ? '' : ' (not resolved)'}`);
+    console.log(` Governor : ${governor || '-'}${governor ? '' : ' (not resolved)'}`);
+    console.log(` Timelock : ${timelock}`);
+    console.log(` Signer   : ${signerAddress || '-'}${signerAddress ? '' : ' (no default signer detected)'}`);
+    console.log('');
+  }
+
+  // PremiumReceipt → PremiumPrompts (MINTER_ROLE)
+  if (receiptAddr && promptsAddr) {
+    try {
+      const rcptAbi = ['function MINTER_ROLE() view returns (bytes32)', 'function hasRole(bytes32,address) view returns (bool)'];
+      const receipt = new ethers.Contract(receiptAddr, rcptAbi, provider);
+      const MINTER = await receipt.MINTER_ROLE();
+      const has = await receipt.hasRole(MINTER, promptsAddr).catch(() => false);
+      result.receipt.minterRoleGrantedToPrompts = !!has;
+      if (!opts.json) {
+        console.log(colors.cyan('📜 PremiumReceipt → PremiumPrompts'));
+        console.log(`  MINTER_ROLE(PremiumPrompts): ${has ? '✅' : '❌'}`);
+      }
+    } catch (e) {
+      result.receipt.error = e.message;
+      if (!opts.json) {
+        console.log(colors.red(`❌ Failed to inspect PremiumReceipt roles: ${e.message}`));
+      }
+    }
+  }
+
+  // PremiumPrompts Timelock/admin checks
+  if (promptsAddr) {
+    try {
+      const ppAbi = [
+        'function MANAGER_ROLE() view returns (bytes32)',
+        'function DEFAULT_ADMIN_ROLE() view returns (bytes32)',
+        'function hasRole(bytes32,address) view returns (bool)'
+      ];
+      const pp = new ethers.Contract(promptsAddr, ppAbi, provider);
+      const MANAGER = await pp.MANAGER_ROLE();
+      const ADMIN = await pp.DEFAULT_ADMIN_ROLE();
+
+      let signerIsAdmin = null;
+      if (signerAddress) {
+        signerIsAdmin = await pp.hasRole(ADMIN, signerAddress).catch(() => null);
+      }
+      const timelockIsManager = await pp.hasRole(MANAGER, timelock).catch(() => null);
+      const timelockIsAdmin = await pp.hasRole(ADMIN, timelock).catch(() => null);
+
+      result.prompts.signerIsAdmin = signerIsAdmin;
+      result.prompts.timelockIsManager = timelockIsManager;
+      result.prompts.timelockIsAdmin = timelockIsAdmin;
+
+      if (!opts.json) {
+        console.log(colors.cyan('🏛️  PremiumPrompts Roles'));
+        console.log(`  Address               : ${promptsAddr}`);
+        if (signerAddress != null && signerIsAdmin != null) {
+          console.log(`  DEFAULT_ADMIN_ROLE(signer)  : ${signerIsAdmin ? '✅' : '❌'}`);
+        }
+        if (timelockIsManager != null) {
+          console.log(`  MANAGER_ROLE(timelock)      : ${timelockIsManager ? '✅' : '❌'}`);
+        }
+        if (timelockIsAdmin != null) {
+          console.log(`  DEFAULT_ADMIN_ROLE(timelock): ${timelockIsAdmin ? '✅' : '❌'}`);
+        }
+      }
+    } catch (e) {
+      result.prompts.error = e.message;
+      if (!opts.json) {
+        console.log(colors.red(`❌ Failed to inspect PremiumPrompts roles: ${e.message}`));
+      }
+    }
+  }
+
+  // SimpleKeyStore Timelock/admin checks
+  if (keystoreAddr) {
+    try {
+      const ksAbi = [
+        'function DEFAULT_ADMIN_ROLE() view returns (bytes32)',
+        'function MANAGER_ROLE() view returns (bytes32)',
+        'function hasRole(bytes32,address) view returns (bool)'
+      ];
+      const ks = new ethers.Contract(keystoreAddr, ksAbi, provider);
+      const ADMIN = await ks.DEFAULT_ADMIN_ROLE();
+      const MANAGER = await ks.MANAGER_ROLE();
+
+      const tlIsAdmin = await ks.hasRole(ADMIN, timelock).catch(() => null);
+      const tlIsManager = await ks.hasRole(MANAGER, timelock).catch(() => null);
+
+      result.keystore.timelockIsAdmin = tlIsAdmin;
+      result.keystore.timelockIsManager = tlIsManager;
+
+      if (!opts.json) {
+        console.log(colors.cyan('🔑 SimpleKeyStore Roles'));
+        console.log(`  Address                      : ${keystoreAddr}`);
+        if (tlIsAdmin != null) {
+          console.log(`  DEFAULT_ADMIN_ROLE(timelock) : ${tlIsAdmin ? '✅' : '❌'}`);
+        }
+        if (tlIsManager != null) {
+          console.log(`  MANAGER_ROLE(timelock)       : ${tlIsManager ? '✅' : '❌'}`);
+        }
+      }
+    } catch (e) {
+      result.keystore.error = e.message;
+      if (!opts.json) {
+        console.log(colors.red(`❌ Failed to inspect SimpleKeyStore roles: ${e.message}`));
+      }
+    }
+  }
+
+  if (!opts.json) {
+    console.log('');
+    console.log('Next steps:');
+    console.log(' - Use `sage timelock doctor --dao <dao>` to inspect broader governance wiring.');
+    console.log(' - Use `sage timelock fix-roles --dao <dao>` to repair Timelock roles (admin only).');
+    console.log(' - Use `sage governance enable-proposals --dao <dao>` to grant PROPOSER_ROLE via governance.');
+  } else {
+    process.stdout.write(JSON.stringify(result, null, 2) + '\n');
+  }
+}
 
 function register(program) {
   const premium = new Command('premium')
-    .description('Premium prompts (ERC1155 receipts)')
-    .addCommand(
-      new Command('buy')
-        .description('Approve USDC if needed and purchase access for a manifest CID')
-        .requiredOption('--cid <manifestCID>', 'Manifest CID of the premium prompt')
-        .option('--prompts <address>', 'PremiumPrompts address (defaults to PREMIUM_PROMPTS_ADDRESS)')
-        .action(async (opts) => {
-          try {
-            const { ethers } = require('ethers');
-            const { normalizeCidV1Base32 } = require('../utils/cid');
-            const IPFSManager = require('../ipfs-manager');
-            const WM = require('@sage-protocol/wallet-manager');
-            const wm = new WM(); await wm.connect();
-            const signer = wm.getSigner(); const provider = wm.getProvider();
-            const me = await signer.getAddress();
-            const prAddr = ethers.getAddress(opts.prompts || process.env.PREMIUM_PROMPTS_ADDRESS);
-            if (!prAddr) throw new Error('PREMIUM_PROMPTS_ADDRESS not set');
-            // Read usdc() and price from prompts mapping
-            const iface = new ethers.Interface([
-              'function usdc() view returns (address)',
-              'function prompts(bytes32) view returns (address subdao, uint256 price, bool exists)',
-              'function purchaseAccess(bytes32)'
-            ]);
-            const pr = new ethers.Contract(prAddr, iface, provider);
-            // Derive tokenId from encryptedCID inside manifest (stable id used for ERC-1155)
-            const ipfs = new IPFSManager(); await ipfs.initialize();
-            const manifest = await ipfs.downloadJson(opts.cid);
-            if (!manifest?.encryptedCID) throw new Error('Manifest missing encryptedCID');
-            const cidHash = ethers.keccak256(ethers.toUtf8Bytes(normalizeCidV1Base32(manifest.encryptedCID)));
-            const [usdcAddr, tuple] = await Promise.all([
-              pr.usdc().catch(()=>{ throw new Error('Failed to read usdc() from PremiumPrompts'); }),
-              pr.prompts(cidHash).catch(()=>{ throw new Error('Prompt not registered (prompts[cidHash].exists=false)'); })
-            ]);
-            const price = BigInt(tuple.price?.toString?.() || tuple[1]?.toString?.() || '0');
-            const exists = Boolean(tuple.exists ?? tuple[2]);
-            if (!exists) throw new Error('Prompt not registered on PremiumPrompts');
-            const usdc = new ethers.Contract(usdcAddr, ['function allowance(address,address) view returns (uint256)','function approve(address,uint256) returns (bool)'], provider);
-            const currentAllowance = await usdc.allowance(me, prAddr).catch(()=>0n);
-            if (BigInt(currentAllowance.toString()) < price) {
-              console.log('🪙 Approving USDC...', `needed=${price.toString()}`);
-              const usdcW = new ethers.Contract(usdcAddr, ['function approve(address,uint256) returns (bool)'], signer);
-              const txa = await usdcW.approve(prAddr, price);
-              console.log('⏳ approve tx:', txa.hash);
-              { const { waitForReceipt } = require('../utils/tx-wait'); const { ethers } = require('ethers'); const pr = new ethers.JsonRpcProvider(process.env.RPC_URL || process.env.BASE_SEPOLIA_RPC || process.env.BASE_RPC_URL || 'https://base-sepolia.publicnode.com'); await waitForReceipt(pr, txa, Number(process.env.SAGE_TX_WAIT_MS || 60000)); }
-              console.log('✅ Approved');
-            } else {
-              console.log('✅ Allowance sufficient');
-            }
-            // Purchase
-            const prW = new ethers.Contract(prAddr, ['function purchaseAccess(bytes32)'], signer);
-            const txp = await prW.purchaseAccess(cidHash);
-            console.log('🧾 purchaseAccess tx:', txp.hash);
-            { const { waitForReceipt } = require('../utils/tx-wait'); const { ethers } = require('ethers'); const pr = new ethers.JsonRpcProvider(process.env.RPC_URL || process.env.BASE_SEPOLIA_RPC || process.env.BASE_RPC_URL || 'https://base-sepolia.publicnode.com'); await waitForReceipt(pr, txp, Number(process.env.SAGE_TX_WAIT_MS || 60000)); }
-            console.log('✅ Purchase complete');
-            console.log('Next: generate an AuthSig for this wallet and decrypt:');
-            console.log('  sage premium-pre authsig --account', me, '--out ./authSig.buyer.json');
-            console.log('  sage premium-pre view --cid', opts.cid, '--auth-sig ./authSig.buyer.json');
-          } catch (e) {
-            handleCLIError('premium:buy', e);
-          }
-        })
-    )
-    .addCommand(
-      new Command('setup-roles')
-        .description('One-shot: wire PremiumPrompts + SimpleKeyStore roles to the SubDAO Timelock (auto: bootstrap | timelock | governor)')
-        .requiredOption('--subdao <address>', 'SubDAO address to resolve Governor/Timelock')
-        .option('--prompts <address>', 'PremiumPrompts address (defaults to PREMIUM_PROMPTS_ADDRESS)')
-        .option('--keystore <address>', 'SimpleKeyStore address (defaults to SIMPLE_KEY_STORE_ADDRESS)')
-        .option('--bootstrap', 'Force direct admin grants from current signer (deployer/Safe) without timelock/governor)', false)
-        .action(async (opts) => {
-          try {
-            const { ethers } = require('ethers');
-            const WM = require('@sage-protocol/wallet-manager');
-            const wm = new WM(); await wm.connect();
-            const signer = wm.getSigner(); const provider = wm.getProvider();
-            const { resolveGovContext } = require('../utils/gov-context');
-            const ctx = await resolveGovContext({ govOpt: null, subdaoOpt: opts.subdao, provider });
-            const tl = ctx.timelock; const gov = ctx.governor;
-            if (!tl || !gov) throw new Error('Failed to resolve Governor/Timelock from --subdao');
-            const prAddr = ethers.getAddress(opts.prompts || process.env.PREMIUM_PROMPTS_ADDRESS);
-            const ksAddr = ethers.getAddress(opts.keystore || process.env.SIMPLE_KEY_STORE_ADDRESS);
-            if (!prAddr) throw new Error('PREMIUM_PROMPTS_ADDRESS not set');
-            if (!ksAddr) throw new Error('SIMPLE_KEY_STORE_ADDRESS not set');
-
-            // Read role ids
-            const pr = new ethers.Contract(prAddr, ['function DEFAULT_ADMIN_ROLE() view returns (bytes32)','function MANAGER_ROLE() view returns (bytes32)','function hasRole(bytes32,address) view returns (bool)','function getRoleAdmin(bytes32) view returns (bytes32)'], provider);
-            const ks = new ethers.Contract(ksAddr, ['function DEFAULT_ADMIN_ROLE() view returns (bytes32)','function MANAGER_ROLE() view returns (bytes32)','function hasRole(bytes32,address) view returns (bool)','function getRoleAdmin(bytes32) view returns (bytes32)'], provider);
-            const [PR_ADMIN, PR_MANAGER] = await Promise.all([pr.DEFAULT_ADMIN_ROLE(), pr.MANAGER_ROLE()]);
-            const [KS_ADMIN, KS_MANAGER] = await Promise.all([ks.DEFAULT_ADMIN_ROLE(), ks.MANAGER_ROLE()]);
-            const need = [];
-            const hasPRadm = await pr.hasRole(PR_ADMIN, tl).catch(()=>false);
-            const hasPRman = await pr.hasRole(PR_MANAGER, tl).catch(()=>false);
-            const hasKSadm = await ks.hasRole(KS_ADMIN, tl).catch(()=>false);
-            const hasKSman = await ks.hasRole(KS_MANAGER, tl).catch(()=>false);
-            if (!hasPRadm) need.push({ target: prAddr, role: PR_ADMIN, label: 'PremiumPrompts.DEFAULT_ADMIN_ROLE', where: 'PremiumPrompts' });
-            if (!hasPRman) need.push({ target: prAddr, role: PR_MANAGER, label: 'PremiumPrompts.MANAGER_ROLE', where: 'PremiumPrompts' });
-            if (!hasKSadm) need.push({ target: ksAddr, role: KS_ADMIN, label: 'SimpleKeyStore.DEFAULT_ADMIN_ROLE', where: 'SimpleKeyStore' });
-            if (!hasKSman) need.push({ target: ksAddr, role: KS_MANAGER, label: 'SimpleKeyStore.MANAGER_ROLE', where: 'SimpleKeyStore' });
-            if (!need.length) { console.log('✅ No wiring needed.'); return; }
-
-            // Try bootstrap (admin direct grant) for both contracts
-            const tryBootstrap = async () => {
-              let okAny = false; let okAll = true;
-              for (const n of need) {
-                try {
-                  const admin = new ethers.Contract(n.target, ['function hasRole(bytes32,address) view returns (bool)','function grantRole(bytes32,address)','function DEFAULT_ADMIN_ROLE() view returns (bytes32)','function getRoleAdmin(bytes32) view returns (bytes32)'], signer);
-                  const signerAddr = await signer.getAddress();
-                  const roleAdmin = await admin.getRoleAdmin(n.role).catch(async()=> admin.DEFAULT_ADMIN_ROLE());
-                  const isAdmin = await admin.hasRole(roleAdmin, signerAddr).catch(()=>false);
-                  if (!isAdmin) { okAll = false; continue; }
-                  const tx = await admin.grantRole(n.role, tl); console.log('⚙️  grantRole bootstrap', n.label, '->', tl, 'tx:', tx.hash); await tx.wait(); okAny = true;
-                } catch (_) { okAll = false; }
-              }
-              return { okAny, okAll };
-            };
-
-            if (opts.bootstrap) {
-              const boot = await tryBootstrap();
-              if (!boot.okAll) {
-                console.log('❌ Bootstrap incomplete. Some roles could not be granted.');
-                console.log('Reason: current signer likely lacks admin rights for one or more roles.');
-                console.log('Tip: run: sage premium roles-wizard --subdao', opts.subdao, '--format safe  (generate Safe TX Builder JSON)');
-                process.exit(1);
-              }
-              console.log('✅ Wired via bootstrap');
-              return;
-            }
-
-            const boot = await tryBootstrap();
-            if (boot.okAll) { console.log('✅ Wired via bootstrap'); return; }
-
-            // Try Timelock schedule (requires PROPOSER_ROLE on signer)
-            const tlc = new ethers.Contract(tl, ['function PROPOSER_ROLE() view returns (bytes32)','function hasRole(bytes32,address) view returns (bool)','function getMinDelay() view returns (uint256)','function schedule(address,uint256,bytes,bytes32,bytes32,uint256)','function execute(address,uint256,bytes,bytes32,bytes32)'], signer);
-            let canSchedule = false; try { const PR = await tlc.PROPOSER_ROLE(); const signerAddr = await signer.getAddress(); canSchedule = await tlc.hasRole(PR, signerAddr); } catch(_) {}
-            const iface = new ethers.Interface(['function grantRole(bytes32,address)']);
-            if (canSchedule) {
-              const delay = await tlc.getMinDelay().catch(()=>0n);
-              const pred = ethers.ZeroHash;
-              for (const n of need) {
-                const salt = ethers.hexlify(ethers.randomBytes(32));
-                const data = iface.encodeFunctionData('grantRole', [n.role, tl]);
-                const stx = await tlc.schedule(n.target, 0, data, pred, salt, delay); console.log('⏳ schedule', n.label, 'tx:', stx.hash);
-                if (delay === 0n) { const etx = await tlc.execute(n.target, 0, data, pred, salt); console.log('⚡ execute', n.label, 'tx:', etx.hash); }
-                else console.log(`ℹ️ Execute later: cast send ${tl} "execute(address,uint256,bytes,bytes32,bytes32)" ${n.target} 0 ${data} ${pred} ${salt}`);
-              }
-              console.log('✅ Wired via timelock schedule'); return;
-            }
-
-            // Fallback: Governor proposal batching all grantRole calls
-            const govCtr = new ethers.Contract(gov, ['function propose(address[],uint256[],bytes[],string) returns (uint256)'], signer);
-            const targets = []; const values = []; const calldatas = [];
-            for (const n of need) { targets.push(n.target); values.push(0); calldatas.push(iface.encodeFunctionData('grantRole', [n.role, tl])); }
-            const desc = 'Wire PremiumPrompts + SimpleKeyStore roles to SubDAO Timelock';
-            const { makeProposalDescription } = require('../utils/format');
-            const salted = makeProposalDescription(desc || '');
-            if (process.env.SAGE_USE_PRIVATE_TX === '1' && process.env.SAGE_PRIVATE_RPC) {
-              const { loadSdk } = require('../utils/sdk-resolver'); const sdk = loadSdk();
-              const calldata = govCtr.interface.encodeFunctionData('propose', [targets, values, calldatas, salted]);
-              const { hash } = await sdk.utils.privateTx.sendTransaction({ signer, tx: { to: govAddr, data: calldata, value: 0n } });
-              console.log('🗳️  propose (private) tx:', hash);
-            } else {
-              const tx = await govCtr.propose(targets, values, calldatas, salted); console.log('🗳️  propose tx:', tx.hash);
-            }
-            console.log('➡️  Next: vote/queue/execute or run:');
-            console.log(`   sage governance watch <proposalId> --subdao ${opts.subdao}`);
-          } catch (e) {
-            handleCLIError('premium:setup-roles', e, {
-              context: { subdao: opts.subdao }
-            });
-          }
-        })
-    )
-    .addCommand(
-      new Command('bootstrap-proposal')
-        .description('Create a governance proposal to finalize team-only wiring: grant Timelock roles and revoke deployer/admin roles')
-        .requiredOption('--subdao <address>', 'SubDAO to derive Governor/Timelock')
-        .option('--prompts <address>', 'PremiumPrompts address (defaults to env)')
-        .option('--keystore <address>', 'SimpleKeyStore address (defaults to env)')
-        .option('--deployer <address>', 'Address to revoke roles from (can be comma-separated)')
-        .option('--ensure-proposer', 'Ensure Governor has PROPOSER_ROLE on Timelock (adds grantRole)', false)
-        .action(async (opts) => {
-          try {
-            const { ethers } = require('ethers');
-            const WM = require('@sage-protocol/wallet-manager');
-            const wm = new WM(); await wm.connect();
-            const signer = wm.getSigner(); const provider = wm.getProvider();
-            const { resolveGovContext } = require('../utils/gov-context');
-            const ctx = await resolveGovContext({ govOpt: null, subdaoOpt: opts.subdao, provider });
-            const govAddr = ctx.governor; const tlAddr = ctx.timelock;
-            if (!govAddr || !tlAddr) throw new Error('Failed to resolve Governor/Timelock from --subdao');
-            const prAddr = ethers.getAddress(opts.prompts || process.env.PREMIUM_PROMPTS_ADDRESS);
-            const ksAddr = ethers.getAddress(opts.keystore || process.env.SIMPLE_KEY_STORE_ADDRESS);
-            if (!prAddr) throw new Error('PREMIUM_PROMPTS_ADDRESS not set');
-            if (!ksAddr) throw new Error('SIMPLE_KEY_STORE_ADDRESS not set');
-
-            const pr = new ethers.Contract(prAddr, ['function DEFAULT_ADMIN_ROLE() view returns (bytes32)','function MANAGER_ROLE() view returns (bytes32)','function hasRole(bytes32,address) view returns (bool)'], provider);
-            const ks = new ethers.Contract(ksAddr, ['function DEFAULT_ADMIN_ROLE() view returns (bytes32)','function MANAGER_ROLE() view returns (bytes32)','function hasRole(bytes32,address) view returns (bool)'], provider);
-            const [PR_ADMIN, PR_MANAGER, KS_ADMIN, KS_MANAGER] = await Promise.all([pr.DEFAULT_ADMIN_ROLE(), pr.MANAGER_ROLE(), ks.DEFAULT_ADMIN_ROLE(), ks.MANAGER_ROLE()]);
-
-            const ops = [];
-            const addGrant = (to, role, target) => ops.push({ type:'grant', target, role, to });
-            const addRevoke = (from, role, target) => ops.push({ type:'revoke', target, role, from });
-            const needs = await Promise.all([
-              pr.hasRole(PR_ADMIN, tlAddr).catch(()=>false),
-              pr.hasRole(PR_MANAGER, tlAddr).catch(()=>false),
-              ks.hasRole(KS_ADMIN, tlAddr).catch(()=>false),
-              ks.hasRole(KS_MANAGER, tlAddr).catch(()=>false),
-            ]);
-            if (!needs[0]) addGrant(tlAddr, PR_ADMIN, prAddr);
-            if (!needs[1]) addGrant(tlAddr, PR_MANAGER, prAddr);
-            if (!needs[2]) addGrant(tlAddr, KS_ADMIN, ksAddr);
-            if (!needs[3]) addGrant(tlAddr, KS_MANAGER, ksAddr);
-
-            // Optional revoke step(s)
-            const revokeList = [];
-            if (opts.deployer) {
-              for (const a of String(opts.deployer).split(',').map(s=>s.trim())) { if (a) revokeList.push(ethers.getAddress(a)); }
-            }
-            for (const addr of revokeList) {
-              if (addr.toLowerCase() !== tlAddr.toLowerCase()) {
-                const [pra, prm, ksa, ksm] = await Promise.all([
-                  pr.hasRole(PR_ADMIN, addr).catch(()=>false),
-                  pr.hasRole(PR_MANAGER, addr).catch(()=>false),
-                  ks.hasRole(KS_ADMIN, addr).catch(()=>false),
-                  ks.hasRole(KS_MANAGER, addr).catch(()=>false),
-                ]);
-                if (pra) addRevoke(addr, PR_ADMIN, prAddr);
-                if (prm) addRevoke(addr, PR_MANAGER, prAddr);
-                if (ksa) addRevoke(addr, KS_ADMIN, ksAddr);
-                if (ksm) addRevoke(addr, KS_MANAGER, ksAddr);
-              }
-            }
-
-            // Optional ensure Governor has PROPOSER on Timelock
-            if (opts.ensureProposer) {
-              const tl = new ethers.Contract(tlAddr, ['function PROPOSER_ROLE() view returns (bytes32)','function hasRole(bytes32,address) view returns (bool)'], provider);
-              const PR = await tl.PROPOSER_ROLE();
-              const has = await tl.hasRole(PR, govAddr).catch(()=>false);
-              if (!has) ops.push({ type:'timelockGrant', roleName:'PROPOSER_ROLE' });
-            }
-
-            if (!ops.length) { console.log('✅ Nothing to do; roles already correct'); return; }
-
-            // Build proposal
-            const tlAbi = resolveArtifact('contracts/cloneable/TimelockControllerCloneable.sol/TimelockControllerCloneable.json').abi;
-            const tlIface = new ethers.Interface(tlAbi);
-            const iface = new ethers.Interface(['function grantRole(bytes32,address)','function revokeRole(bytes32,address)']);
-            const targets = []; const values = []; const calldatas = [];
-            for (const op of ops) {
-              if (op.type === 'grant') { targets.push(op.target); values.push(0); calldatas.push(iface.encodeFunctionData('grantRole', [op.role, tlAddr])); }
-              else if (op.type === 'revoke') { targets.push(op.target); values.push(0); calldatas.push(iface.encodeFunctionData('revokeRole', [op.role, op.from])); }
-              else if (op.type === 'timelockGrant') {
-                const tlRO = new ethers.Contract(tlAddr, ['function PROPOSER_ROLE() view returns (bytes32)'], provider);
-                const PR = await tlRO.PROPOSER_ROLE();
-                targets.push(tlAddr); values.push(0); calldatas.push(tlIface.encodeFunctionData('grantRole', [PR, govAddr]));
-              }
-            }
-            const gov = new ethers.Contract(govAddr, ['function propose(address[],uint256[],bytes[],string) returns (uint256)'], signer);
-            const desc = 'Finalize team-only premium wiring (grant Timelock roles, revoke deployer roles)';
-            const { makeProposalDescription } = require('../utils/format');
-            const salted2 = makeProposalDescription(desc || '');
-            if (process.env.SAGE_USE_PRIVATE_TX === '1' && process.env.SAGE_PRIVATE_RPC) {
-              const { loadSdk } = require('../utils/sdk-resolver'); const sdk = loadSdk();
-              const calldata2 = gov.interface.encodeFunctionData('propose', [targets, values, calldatas, salted2]);
-              const { hash } = await sdk.utils.privateTx.sendTransaction({ signer, tx: { to: govAddr, data: calldata2, value: 0n } });
-              console.log('🗳️  propose (private) tx:', hash);
-            } else {
-              const tx = await gov.propose(targets, values, calldatas, salted2);
-              console.log('🗳️  propose tx:', tx.hash);
-            }
-            // Compute id
-            let id = null; try { const gi = new ethers.Interface(['function hashProposal(address[],uint256[],bytes[],bytes32) view returns (uint256)']); const govRO = new ethers.Contract(govAddr, gi, provider); const descHash = ethers.keccak256(ethers.toUtf8Bytes(desc)); id = (await govRO.hashProposal(targets, values, calldatas, descHash)).toString(); } catch(_) {}
-            if (id) {
-              console.log(`➡️  Watching proposal ${id} ...`);
-              try { const { execSync } = require('child_process'); console.log(execSync(['node','packages/cli/src/index.js','governance','watch',String(id),'--subdao',String(opts.subdao)].join(' '), { encoding:'utf8' })); } catch(e) { console.log('⚠️ watch failed:', e.message); }
-            }
-          } catch (e) {
-            handleCLIError('premium:bootstrap-proposal', e, {
-              context: { subdao: opts.subdao }
-            });
-          }
-        })
-    )
-    .addCommand(
-      new Command('roles-wizard')
-        .description('Interactive plan + exporters for PremiumPrompts/SimpleKeyStore role wiring (plan|safe|cast|governor)')
-        .requiredOption('--subdao <address>', 'SubDAO address to resolve Governor/Timelock')
-        .option('--prompts <address>', 'PremiumPrompts address (defaults to PREMIUM_PROMPTS_ADDRESS)')
-        .option('--keystore <address>', 'SimpleKeyStore address (defaults to SIMPLE_KEY_STORE_ADDRESS)')
-        .option('--format <fmt>', 'plan|safe|cast|governor', 'plan')
-        .option('--out <path>', 'Write JSON output to file (safe/governor only)')
-        .action(async (opts) => {
-          try {
-            const { ethers } = require('ethers');
-            let colors; try { colors = (require('chalk').default || require('chalk')); } catch (_) { colors = { cyan:(s)=>s, green:(s)=>s, yellow:(s)=>s, red:(s)=>s, gray:(s)=>s }; }
-            const WM = require('@sage-protocol/wallet-manager');
-            const wm = new WM(); await wm.connect();
-            const provider = wm.getProvider();
-            const { resolveGovContext } = require('../utils/gov-context');
-            const ctx = await resolveGovContext({ govOpt: null, subdaoOpt: opts.subdao, provider });
-            const timelock = ctx.timelock; const governor = ctx.governor;
-            if (!timelock || !governor) throw new Error('Failed to resolve Governor/Timelock from --subdao');
-            const prAddr = ethers.getAddress(opts.prompts || process.env.PREMIUM_PROMPTS_ADDRESS);
-            const ksAddr = ethers.getAddress(opts.keystore || process.env.SIMPLE_KEY_STORE_ADDRESS);
-            if (!prAddr) throw new Error('PREMIUM_PROMPTS_ADDRESS not set');
-            if (!ksAddr) throw new Error('SIMPLE_KEY_STORE_ADDRESS not set');
-
-            const pr = new ethers.Contract(prAddr, [
-              'function DEFAULT_ADMIN_ROLE() view returns (bytes32)',
-              'function MANAGER_ROLE() view returns (bytes32)',
-              'function hasRole(bytes32,address) view returns (bool)',
-              'function getRoleAdmin(bytes32) view returns (bytes32)'
-            ], provider);
-            const ks = new ethers.Contract(ksAddr, [
-              'function DEFAULT_ADMIN_ROLE() view returns (bytes32)',
-              'function MANAGER_ROLE() view returns (bytes32)',
-              'function hasRole(bytes32,address) view returns (bool)',
-              'function getRoleAdmin(bytes32) view returns (bytes32)'
-            ], provider);
-
-            const [PR_ADMIN, PR_MANAGER, KS_ADMIN, KS_MANAGER] = await Promise.all([
-              pr.DEFAULT_ADMIN_ROLE(), pr.MANAGER_ROLE(), ks.DEFAULT_ADMIN_ROLE(), ks.MANAGER_ROLE()
-            ]);
-
-            const needed = [];
-            const checks = [
-              { where: 'PremiumPrompts', addr: prAddr, role: PR_ADMIN, label: 'DEFAULT_ADMIN_ROLE' },
-              { where: 'PremiumPrompts', addr: prAddr, role: PR_MANAGER, label: 'MANAGER_ROLE' },
-              { where: 'SimpleKeyStore', addr: ksAddr, role: KS_ADMIN, label: 'DEFAULT_ADMIN_ROLE' },
-              { where: 'SimpleKeyStore', addr: ksAddr, role: KS_MANAGER, label: 'MANAGER_ROLE' },
-            ];
-            for (const c of checks) {
-              const cctr = (c.where === 'PremiumPrompts') ? pr : ks;
-              const has = await cctr.hasRole(c.role, timelock).catch(()=>false);
-              if (!has) {
-                const admin = await cctr.getRoleAdmin(c.role).catch(async()=> (c.where==='PremiumPrompts'? PR_ADMIN : KS_ADMIN));
-                const tlIsAdmin = await cctr.hasRole(admin, timelock).catch(()=>false);
-                needed.push({ ...c, admin, tlIsAdmin });
-              }
-            }
-
-            if (!needed.length) { console.log(colors.green('✅ No wiring needed. Timelock already has required roles.')); return; }
-
-            console.log(colors.cyan('Premium Roles Plan'));
-            console.log('Timelock:', timelock);
-            console.log('Governor:', governor);
-            console.log('— Required Grants —');
-            for (const n of needed) {
-              const reason = n.tlIsAdmin ? 'grantable via timelock/governor' : 'cannot be granted by timelock (no admin) — bootstrap required';
-              console.log(` ${n.where}.${n.label} → Timelock: ❌  (${reason})`);
-            }
-
-            const iface = new ethers.Interface(['function grantRole(bytes32,address)']);
-            const actions = needed.map(n => ({ to: n.addr, data: iface.encodeFunctionData('grantRole', [n.role, timelock]) }));
-
-            // Output formatter
-            const fmt = String(opts.format||'plan').toLowerCase();
-            if (fmt === 'plan') {
-              console.log('\nNext steps (choose one path):');
-              const anyBootstrap = needed.some(n => !n.tlIsAdmin);
-              if (anyBootstrap) console.log(' - Bootstrap once from an admin signer (or Safe): sage premium setup-roles --subdao', opts.subdao, '--bootstrap');
-              console.log(' - Operator path (if signer has PROPOSER_ROLE): sage premium setup-roles --subdao', opts.subdao);
-              console.log(' - Pure governance path:');
-              console.log('     sage premium setup-roles --subdao', opts.subdao);
-              console.log('     sage governance watch <proposalId> --subdao', opts.subdao);
-              return;
-            }
-
-            if (fmt === 'cast') {
-              const rpc = process.env.RPC_URL || 'https://base-sepolia.publicnode.com';
-              console.log('\ncast commands (run from an admin account):');
-              for (const n of needed) {
-                console.log(`cast send ${n.addr} "grantRole(bytes32,address)" ${n.role} ${timelock} --rpc-url ${rpc}`);
-              }
-              return;
-            }
-
-            if (fmt === 'safe') {
-              const net = await provider.getNetwork();
-              const bundle = {
-                version: '1.0',
-                chainId: String(net.chainId),
-                createdAt: Date.now(),
-                meta: { name: 'Sage Premium Roles Wiring', description: 'Grant roles to Timelock (PremiumPrompts + SimpleKeyStore)' },
-                transactions: actions.map(a => ({ to: a.to, value: '0', data: a.data, operation: 0 }))
-              };
-              const out = JSON.stringify(bundle, null, 2);
-              if (opts.out) { require('fs').writeFileSync(require('path').resolve(opts.out), out); console.log('✅ Wrote Safe TX bundle to', opts.out); }
-              else console.log(out);
-              return;
-            }
-
-            if (fmt === 'governor') {
-              const targets = actions.map(a => a.to);
-              const values = actions.map(() => 0);
-              const calldatas = actions.map(a => a.data);
-              const desc = 'Wire PremiumPrompts + SimpleKeyStore roles to SubDAO Timelock';
-              const out = JSON.stringify({ governor, targets, values, calldatas, description: desc }, null, 2);
-              if (opts.out) { require('fs').writeFileSync(require('path').resolve(opts.out), out); console.log('✅ Wrote Governor proposal bundle to', opts.out); }
-              else console.log(out);
-              return;
-            }
-
-            console.log('Unknown --format. Use one of: plan|safe|cast|governor');
-          } catch (e) {
-            handleCLIError('premium:roles-wizard', e, {
-              context: { subdao: opts.subdao }
-            });
-          }
-        })
-    )
-    .addCommand(
-      new Command('create')
-        .description('Create/register a premium prompt')
-        .requiredOption('--cid <cid>', 'CID of premium prompt (normalized to CIDv1 base32)')
-        .requiredOption('--subdao <address>', 'SubDAO address to receive proceeds')
-        .requiredOption('--price <usdc>', 'Price in USDC (6 decimals, human value e.g., 2.50)')
-        .action(async (opts) => {
-          try {
-            const addr = process.env.PREMIUM_PROMPTS_ADDRESS;
-            if (!addr) throw new Error('PREMIUM_PROMPTS_ADDRESS not set');
-            const provider = new ethers.JsonRpcProvider(process.env.RPC_URL || 'https://base-sepolia.publicnode.com');
-            const wm = new (require('@sage-protocol/wallet-manager'))(); await wm.connect();
-            const signer = wm.getSigner();
-            const { resolveArtifact } = require('../utils/artifacts');
-            const abi = resolveArtifact('contracts/premium/PremiumPrompts.sol/PremiumPrompts.json').abi;
-            const ctr = new ethers.Contract(addr, abi, signer);
-
-            // Preflight: signer or resolved Timelock must have MANAGER_ROLE
-            try {
-              const MANAGER = await ctr.MANAGER_ROLE();
-              const signerAddr = await signer.getAddress();
-              const signerHas = await ctr.hasRole(MANAGER, signerAddr).catch(()=>false);
-              if (!signerHas) {
-                const { resolveGovContext } = require('../utils/gov-context');
-                const ctx = await resolveGovContext({ govOpt: null, subdaoOpt: opts.subdao, provider });
-                const tl = ctx?.timelock || process.env.TIMELOCK || process.env.TIMELOCK_ADDRESS;
-                if (tl) {
-                  const tlHas = await ctr.hasRole(MANAGER, tl).catch(()=>false);
-                  if (!tlHas) {
-                    const rpc = process.env.RPC_URL || 'https://base-sepolia.publicnode.com';
-                    console.log('❌ Preflight: Timelock lacks MANAGER_ROLE on PremiumPrompts.');
-                    console.log('Grant roles (from PremiumPrompts admin):');
-                    console.log(`  cast send ${addr} "grantRole(bytes32,address)" $(cast call ${addr} "DEFAULT_ADMIN_ROLE() returns (bytes32)") ${tl} --rpc-url ${rpc}`);
-                    console.log(`  cast send ${addr} "grantRole(bytes32,address)" $(cast call ${addr} "MANAGER_ROLE() returns (bytes32)") ${tl} --rpc-url ${rpc}`);
-                    console.log('\nOr schedule via timelock:');
-                    console.log(`  sage timelock premium-roles --prompts ${addr} --subdao ${opts.subdao} --fix`);
-                    console.log('\nIf you intend to create directly, the current signer must hold MANAGER_ROLE.');
-                    return process.exit(1);
-                  }
-                } else {
-                  console.log('❌ Preflight: No Timelock resolved and signer lacks MANAGER_ROLE.');
-                  console.log('Grant the signer MANAGER_ROLE or use timelock premium-roles to set up team mode.');
-                  return process.exit(1);
-                }
-              }
-            } catch (_) { /* non-fatal */ }
-            const hash = ethers.keccak256(ethers.toUtf8Bytes(normalizeCidV1Base32(opts.cid)));
-            const price = ethers.parseUnits(String(opts.price), 6);
-            const tx = await ctr.createPremiumPrompt(hash, ethers.getAddress(opts.subdao), price);
-            console.log('⏳ createPremiumPrompt tx:', tx.hash); { const { waitForReceipt } = require('../utils/tx-wait'); const { ethers } = require('ethers'); const pr = new ethers.JsonRpcProvider(process.env.RPC_URL || process.env.BASE_SEPOLIA_RPC || process.env.BASE_RPC_URL || 'https://base-sepolia.publicnode.com'); await waitForReceipt(pr, tx, Number(process.env.SAGE_TX_WAIT_MS || 60000)); }
-            console.log('✅ Premium prompt created');
-          } catch (e) {
-            handleCLIError('premium:create', e, {
-              context: { subdao: opts.subdao }
-            });
-          }
-        })
-    )
-    .addCommand(
-      new Command('check')
-        .description('Check ERC1155 receipt balance for a premium prompt')
-        .requiredOption('--cid <cid>', 'CID of premium prompt')
-        .option('--address <address>', 'Wallet address (defaults to current)')
-        .action(async (opts) => {
-          try {
-            const rcptAddr = process.env.PREMIUM_RECEIPT_ADDRESS;
-            if (!rcptAddr) throw new Error('PREMIUM_RECEIPT_ADDRESS not set');
-            const wm = new (require('@sage-protocol/wallet-manager'))(); await wm.connect();
-            const provider = wm.getProvider();
-            const target = opts.address || wm.getAccount();
-            const { resolveArtifact } = require('../utils/artifacts');
-            const abi = resolveArtifact('contracts/premium/PremiumReceipt.sol/PremiumReceipt.json').abi;
-            const r = new ethers.Contract(rcptAddr, abi, provider);
-            const id = BigInt(ethers.keccak256(ethers.toUtf8Bytes(normalizeCidV1Base32(opts.cid))));
-            const bal = await r.balanceOf(target, id);
-            console.log(`balanceOf(${target}, tokenId=${id}) = ${bal.toString()}`);
-          } catch (e) {
-            handleCLIError('premium:check', e);
-          }
-        })
-    )
-    .addCommand(
-      new Command('info')
-        .description('Show premium prompt configuration')
-        .requiredOption('--cid <cid>', 'CID of premium prompt')
-        .action(async (opts) => {
-          try {
-            const promptsAddr = process.env.PREMIUM_PROMPTS_ADDRESS; if (!promptsAddr) throw new Error('PREMIUM_PROMPTS_ADDRESS not set');
-            const factoryAddr = process.env.SUBDAO_FACTORY_ADDRESS; if (!factoryAddr) throw new Error('SUBDAO_FACTORY_ADDRESS not set');
-            const provider = new ethers.JsonRpcProvider(process.env.RPC_URL || 'https://base-sepolia.publicnode.com');
-            const { resolveArtifact } = require('../utils/artifacts');
-            const pa = resolveArtifact('contracts/premium/PremiumPrompts.sol/PremiumPrompts.json').abi;
-            const fa = resolveArtifact('contracts/SubDAOFactoryOptimized.sol/SubDAOFactoryOptimized.json').abi;
-            const pr = new ethers.Contract(promptsAddr, pa, provider);
-            const f = new ethers.Contract(factoryAddr, fa, provider);
-            const hash = ethers.keccak256(ethers.toUtf8Bytes(normalizeCidV1Base32(opts.cid)));
-            const p = await pr.prompts(hash);
-            if (!p.exists) { console.log('No premium prompt found'); return; }
-            const treasury = await f.resolveTreasury(p.subdao);
-            console.log(JSON.stringify({ cid: opts.cid, cidHash: hash, subdao: p.subdao, price: p.price.toString(), treasury }, null, 2));
-          } catch (e) {
-            handleCLIError('premium:info', e);
-          }
-        })
-    )
-    .addCommand(new Command('encrypt').description('[removed] Use premium-simple encrypt/publish').action(()=>{ console.log('This command has been removed. Use: sage premium-simple encrypt/publish'); process.exit(1); }))
-    .addCommand(
-      new Command('publish')
-        .description('Encrypt, upload, and register a premium prompt (Lit-gated)')
-        .requiredOption('--in <path>', 'Path to plaintext file')
-        .requiredOption('--name <name>', 'Name')
-        .requiredOption('--description <text>', 'Description')
-        .requiredOption('--subdao <address>', 'SubDAO')
-        .requiredOption('--price <usdc>', 'Price, e.g., 2.50')
-        .action(async (opts) => {
-          try {
-            const fs = require('fs'); const path = require('path');
-            const IPFSManager = require('../ipfs-manager'); const ipfs = new IPFSManager(); await ipfs.initialize();
-            const rcpt = process.env.PREMIUM_RECEIPT_ADDRESS; if (!rcpt) throw new Error('PREMIUM_RECEIPT_ADDRESS not set');
-            const { encryptStringWithLit, buildNodeAuthSig } = require('../utils/lit');
-            const content = fs.readFileSync(path.resolve(opts.in), 'utf8');
-            // reuse signer below; do not redeclare later
-            const wm = new (require('@sage-protocol/wallet-manager'))(); await wm.connect(); const signer = wm.getSigner();
-            const authSig = await buildNodeAuthSig(signer, 'base-sepolia');
-            const { encryptedBlob, encryptedSymmetricKey, accessControlConditions } = await (async () => {
-              const fakeTokenId = '0';
-              return await encryptStringWithLit({ content, receiptAddress: rcpt, tokenId: fakeTokenId, authSig });
-            })();
-            const encPayload = {
-              type: 'lit-encrypted-prompt', name: opts.name, description: opts.description,
-              encryptedSymmetricKey, accessControlConditions, encoding: 'base64',
-              encryptedData: Buffer.from(await encryptedBlob.arrayBuffer?.() || encryptedBlob).toString('base64')
-            };
-            const encryptedCID = await ipfs.uploadJson(encPayload, `${opts.name}.encrypted`);
-            const manifest = { type: 'sage-premium-manifest', version: '1.0.0', encryptedCID,
-              lit: { receiptAddress: rcpt, encryptedSymmetricKey, accessControlConditions, chain: 'base-sepolia' } };
-            const manifestCID = await ipfs.uploadJson(manifest, `${opts.name}.manifest`);
-            // signer already initialized above
-            const { resolveArtifact } = require('../utils/artifacts');
-            const prAddr = process.env.PREMIUM_PROMPTS_ADDRESS; if (!prAddr) throw new Error('PREMIUM_PROMPTS_ADDRESS not set');
-            // Preflight: signer or Timelock must be authorized (MANAGER_ROLE) to create prompts
-            try {
-              const { ethers } = require('ethers');
-              const abiPre = resolveArtifact('contracts/premium/PremiumPrompts.sol/PremiumPrompts.json').abi;
-              const ctrPre = new ethers.Contract(prAddr, abiPre, signer);
-              const MANAGER = await ctrPre.MANAGER_ROLE();
-              const signerAddr = await signer.getAddress();
-              const signerHas = await ctrPre.hasRole(MANAGER, signerAddr).catch(()=>false);
-              if (!signerHas) {
-                const provider = wm.getProvider();
-                const { resolveGovContext } = require('../utils/gov-context');
-                const ctx = await resolveGovContext({ govOpt: null, subdaoOpt: opts.subdao, provider });
-                const tl = ctx?.timelock || process.env.TIMELOCK || process.env.TIMELOCK_ADDRESS;
-                if (!tl) {
-                  console.log('❌ Preflight: No Timelock resolved and signer lacks MANAGER_ROLE on PremiumPrompts.');
-                  console.log('Grant MANAGER to signer or set up team mode via timelock premium-roles.');
-                  return process.exit(1);
-                }
-                const tlHas = await ctrPre.hasRole(MANAGER, tl).catch(()=>false);
-                if (!tlHas) {
-                  const rpc = process.env.RPC_URL || 'https://base-sepolia.publicnode.com';
-                  console.log('❌ Preflight: Timelock lacks MANAGER_ROLE on PremiumPrompts.');
-                  console.log(`  sage timelock premium-roles --prompts ${prAddr} --subdao ${opts.subdao} --fix`);
-                  console.log('Or bootstrap once from an admin:');
-                  console.log(`  sage timelock premium-roles --prompts ${prAddr} --subdao ${opts.subdao} --bootstrap`);
-                  console.log(`  cast send ${prAddr} \"grantRole(bytes32,address)\" $(cast call ${prAddr} \"MANAGER_ROLE() returns (bytes32)\") <TIMELOCK> --rpc-url ${rpc}`);
-                  return process.exit(1);
-                }
-              }
-            } catch (_) { /* non-fatal guard */ }
-            const cidHash = ethers.keccak256(ethers.toUtf8Bytes(manifestCID));
-            const price = ethers.parseUnits(String(opts.price), 6);
-            // Prefer V2 if available
-            const ifaceV2 = new ethers.Interface(['function createPremiumPromptWithManifest(bytes32,address,uint256,string)']);
-            let tx;
-            try {
-              // staticcall to detect function existence
-              await signer.provider.call({ to: prAddr, data: ifaceV2.encodeFunctionData('createPremiumPromptWithManifest',[cidHash, ethers.getAddress(opts.subdao), price, manifestCID]) });
-              tx = await signer.sendTransaction({ to: prAddr, data: ifaceV2.encodeFunctionData('createPremiumPromptWithManifest',[cidHash, ethers.getAddress(opts.subdao), price, manifestCID]) });
-            } catch (_) {
-              const iface = new ethers.Interface(['function createPremiumPrompt(bytes32,address,uint256)']);
-              tx = await signer.sendTransaction({ to: prAddr, data: iface.encodeFunctionData('createPremiumPrompt',[cidHash, ethers.getAddress(opts.subdao), price]) });
-            }
-            console.log('⏳ createPremiumPrompt tx:', tx.hash); { const { waitForReceipt } = require('../utils/tx-wait'); const { ethers } = require('ethers'); const pr = new ethers.JsonRpcProvider(process.env.RPC_URL || process.env.BASE_SEPOLIA_RPC || process.env.BASE_RPC_URL || 'https://base-sepolia.publicnode.com'); await waitForReceipt(pr, tx, Number(process.env.SAGE_TX_WAIT_MS || 60000)); }
-            console.log(JSON.stringify({ manifestCID, encryptedCID, tx: tx.hash }, null, 2));
-          } catch (e) {
-            console.error('❌ premium publish failed:', e.message);
-            if (e.code === 'LIT_DEP_MISSING') console.error('ℹ️  npm i @lit-protocol/lit-node-client @lit-protocol/encryption');
-            process.exit(1);
-          }
-        })
-    )
-    .addCommand(new Command('reveal').description('[removed] Use premium-simple view').action(()=>{ console.log('This command has been removed. Use: sage premium-simple view'); process.exit(1); }))
+    .description('Premium prompts tooling (diagnostics; use "sage personal" for creator flows)')
+    .action(() => {
+      console.log(`
+Premium Prompts
+
+For personal premium prompts (recommended):
+
+  sage personal sell <key> <price> --encrypt --file <path>   # List encrypted content
+  sage personal buy <creator> <key>                          # Purchase license
+  sage personal access <creator> <key>                       # Decrypt purchased content
+  sage personal list --mine                                  # List your listings
+  sage personal my-licenses                                  # Show owned licenses
+
+Enable personal commands:
+  export SAGE_FLAGS_ALLOW_ENV=1 SAGE_ENABLE_PERSONAL=1
+
+For more information:
+  docs/specs/premium-endorsement-model.md
+`);
+    })
     .addCommand(
-      new Command('open-creators')
-        .description('Enable/disable open creators for a SubDAO (manager/admin or via Timelock)')
-        .requiredOption('--subdao <address>', 'SubDAO address')
-        .requiredOption('--enable <bool>', 'true|false')
-        .option('--via-timelock', 'Schedule via resolved Timelock instead of sending directly', false)
-        .action(async (opts) => {
-          try {
-            const promptsAddr = process.env.PREMIUM_PROMPTS_ADDRESS; if (!promptsAddr) throw new Error('PREMIUM_PROMPTS_ADDRESS not set');
-            const provider = new ethers.JsonRpcProvider(process.env.RPC_URL || 'https://base-sepolia.publicnode.com');
-            const wm = new (require('@sage-protocol/wallet-manager'))(); await wm.connect();
-            const signer = wm.getSigner();
-            const enable = String(opts.enable).toLowerCase();
-            const flag = (enable === 'true' || enable === '1' || enable === 'yes');
-            const iface = new ethers.Interface(['function setOpenCreators(address,bool)']);
-            const data = iface.encodeFunctionData('setOpenCreators', [ethers.getAddress(opts.subdao), flag]);
-            if (!opts.viaTimelock) {
-              const tx = await signer.sendTransaction({ to: promptsAddr, data });
-              console.log('tx:', tx.hash); return;
-            }
-            // via timelock: resolve and schedule
-            const { resolveGovContext } = require('../utils/gov-context');
-            const ctx = await resolveGovContext({ govOpt: null, subdaoOpt: opts.subdao, provider });
-            const tl = ctx?.timelock || process.env.TIMELOCK || process.env.TIMELOCK_ADDRESS; if (!tl) throw new Error('Timelock not resolved');
-            const tlc = new ethers.Contract(tl, [
-              'function schedule(address,uint256,bytes,bytes32,bytes32,uint256)',
-              'function getMinDelay() view returns (uint256)',
-              'function PROPOSER_ROLE() view returns (bytes32)',
-              'function hasRole(bytes32,address) view returns (bool)'
-            ], signer);
-            // Preflight: ensure current signer has PROPOSER_ROLE on Timelock; otherwise guide next steps
-            try {
-              const signerAddr = await signer.getAddress();
-              const PROPOSER = await tlc.PROPOSER_ROLE();
-              const ok = await tlc.hasRole(PROPOSER, signerAddr);
-              if (!ok) {
-                console.log('❌ Missing PROPOSER_ROLE on Timelock for current signer.');
-                console.log('Options:');
-                console.log(' - Run: sage timelock doctor --subdao', opts.subdao, '--fix   (grants PROPOSER to Governor if signer is admin)');
-                console.log(' - Or schedule from a wallet that holds PROPOSER_ROLE on the Timelock');
-                console.log(' - Or create a governance proposal that calls setOpenCreators()');
-                return process.exit(1);
-              }
-            } catch (_) {}
-            const delay = await tlc.getMinDelay().catch(()=>0n);
-            const salt = ethers.hexlify(ethers.randomBytes(32));
-            const predecessor = ethers.ZeroHash;
-            const stx = await tlc.schedule(promptsAddr, 0, data, predecessor, salt, delay);
-            console.log('schedule tx:', stx.hash);
-            if (delay === 0n) {
-              const exe = new ethers.Interface(['function execute(address,uint256,bytes,bytes32,bytes32)']);
-              const txe = await signer.sendTransaction({ to: tl, data: exe.encodeFunctionData('execute', [promptsAddr, 0, data, predecessor, salt]) });
-              console.log('execute tx:', txe.hash);
-            } else {
-              console.log('Execute later with:');
-              console.log(`cast send ${tl} "execute(address,uint256,bytes,bytes32,bytes32)" ${promptsAddr} 0 ${data} ${predecessor} ${salt} --rpc-url ${process.env.RPC_URL || 'https://base-sepolia.publicnode.com'}`);
-            }
-          } catch (e) { console.error('❌ open-creators failed:', e.message); process.exit(1); }
-        })
+      new Command('doctor')
+        .description('Inspect PremiumPrompts / SimpleKeyStore roles for a DAO')
+        .option('--dao <address>', 'DAO context for governance wiring')
+        .option('--subdao <address>', 'Alias for --dao (deprecated)')
+        .option('--gov <address>', 'Explicit Governor address (optional)')
+        .option('--json', 'Output machine-readable JSON only', false)
+        .action(runPremiumDoctor)
     );
 
   program.addCommand(premium);