@tangle-network/tcloud 0.1.0

package/dist/cli.cjs

@@ -0,0 +1,895 @@
+#!/usr/bin/env node
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+// src/cli.ts
+var import_commander = require("commander");
+
+// src/client.ts
+var DEFAULT_BASE_URL = "https://api.tangleai.cloud/v1";
+async function proxiedFetch(privacy, url, init, streaming) {
+  if (!privacy || privacy.mode === "direct") {
+    return fetch(url, init);
+  }
+  if (privacy.mode === "relayer") {
+    if (!privacy.relayerUrl) {
+      throw new Error('relayerUrl is required when privacy mode is "relayer"');
+    }
+    const proxyPath = streaming ? "/relay/proxy-stream" : "/relay/proxy";
+    const hdrs = {};
+    if (init.headers) {
+      const entries = init.headers instanceof Headers ? Array.from(init.headers.entries()) : Object.entries(init.headers);
+      for (const [k, v] of entries) hdrs[k] = v;
+    }
+    return fetch(`${privacy.relayerUrl}${proxyPath}`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        target: url,
+        body: typeof init.body === "string" ? JSON.parse(init.body) : init.body,
+        headers: hdrs
+      })
+    });
+  }
+  if (privacy.mode === "socks5") {
+    if (!privacy.socksProxy) {
+      throw new Error('socksProxy is required when privacy mode is "socks5"');
+    }
+    const { SocksProxyAgent } = await import("socks-proxy-agent");
+    const agent = new SocksProxyAgent(privacy.socksProxy);
+    return fetch(url, {
+      ...init,
+      // @ts-expect-error agent is supported by Node's undici but not in the standard RequestInit type
+      agent
+    });
+  }
+  return fetch(url, init);
+}
+var TCloudClient = class {
+  baseURL;
+  apiKey;
+  model;
+  headers;
+  spendAuthFn;
+  privacy;
+  limits;
+  _totalSpent = 0;
+  _requestCount = 0;
+  constructor(config = {}) {
+    this.baseURL = (config.baseURL || DEFAULT_BASE_URL).replace(/\/$/, "");
+    this.apiKey = config.apiKey || process.env.TCLOUD_API_KEY || process.env.OPENAI_API_KEY;
+    this.model = config.model || "gpt-4o-mini";
+    this.privacy = config.privacy;
+    this.limits = config.limits;
+    this.headers = {
+      "Content-Type": "application/json",
+      "X-Tangle-Client": "tcloud-sdk/0.1.0"
+    };
+    if (this.apiKey) {
+      this.headers["Authorization"] = `Bearer ${this.apiKey}`;
+    }
+    if (config.routing?.prefer) {
+      this.headers["X-Tangle-Operator"] = config.routing.prefer;
+    }
+    if (config.routing?.region) {
+      this.headers["X-Tangle-Region"] = config.routing.region;
+    }
+  }
+  /** Set the SpendAuth signer for private mode */
+  setSpendAuthSigner(fn) {
+    this.spendAuthFn = fn;
+  }
+  /** Current metering stats */
+  get usage() {
+    return {
+      totalSpent: this._totalSpent,
+      requestCount: this._requestCount,
+      limits: this.limits ? { ...this.limits } : void 0
+    };
+  }
+  /** Check spending limits before a request. Throws TCloudError if blocked. */
+  checkLimits() {
+    if (!this.limits) return;
+    if (this.limits.maxRequests && this._requestCount >= this.limits.maxRequests) {
+      this.limits.onLimitReached?.({ type: "requests", current: this._requestCount, limit: this.limits.maxRequests });
+      throw new TCloudError(429, `Request limit reached (${this._requestCount}/${this.limits.maxRequests})`);
+    }
+    if (this.limits.maxTotalSpend && this._totalSpent >= this.limits.maxTotalSpend) {
+      this.limits.onLimitReached?.({ type: "total", current: this._totalSpent, limit: this.limits.maxTotalSpend });
+      throw new TCloudError(429, `Spending limit reached ($${this._totalSpent.toFixed(6)}/$${this.limits.maxTotalSpend})`);
+    }
+    if (this.limits.maxRequests && this.limits.onLimitWarning) {
+      const pct = this._requestCount / this.limits.maxRequests;
+      if (pct >= 0.8) this.limits.onLimitWarning({ type: "requests", current: this._requestCount, limit: this.limits.maxRequests });
+    }
+    if (this.limits.maxTotalSpend && this.limits.onLimitWarning) {
+      const pct = this._totalSpent / this.limits.maxTotalSpend;
+      if (pct >= 0.8) this.limits.onLimitWarning({ type: "total", current: this._totalSpent, limit: this.limits.maxTotalSpend });
+    }
+  }
+  /** Track cost after a response */
+  trackCost(completion) {
+    this._requestCount++;
+    if (completion.usage) {
+      const tokens = completion.usage.total_tokens || 0;
+      const estimatedCost = tokens * 1e-6;
+      this._totalSpent += estimatedCost;
+      if (this.limits?.maxCostPerRequest && estimatedCost > this.limits.maxCostPerRequest) {
+        this.limits.onLimitReached?.({ type: "cost", current: estimatedCost, limit: this.limits.maxCostPerRequest });
+      }
+    }
+  }
+  /** Chat completion (non-streaming) */
+  async chat(options) {
+    this.checkLimits();
+    const headers = { ...this.headers };
+    if (this.spendAuthFn) {
+      const auth2 = await this.spendAuthFn();
+      headers["X-Payment-Signature"] = JSON.stringify(auth2);
+      delete headers["Authorization"];
+    }
+    const res = await proxiedFetch(this.privacy, `${this.baseURL}/chat/completions`, {
+      method: "POST",
+      headers,
+      body: JSON.stringify({
+        model: options.model || this.model,
+        messages: options.messages,
+        temperature: options.temperature,
+        max_tokens: options.maxTokens,
+        stream: false,
+        stop: options.stop,
+        top_p: options.topP,
+        frequency_penalty: options.frequencyPenalty,
+        presence_penalty: options.presencePenalty,
+        response_format: options.responseFormat,
+        tools: options.tools
+      })
+    }, false);
+    if (!res.ok) {
+      const err = await res.json().catch(() => ({ error: res.statusText }));
+      throw new TCloudError(res.status, err.error?.message || err.error || err.message || res.statusText);
+    }
+    const completion = await res.json();
+    this.trackCost(completion);
+    return completion;
+  }
+  /** Chat completion (streaming) — returns an async iterator of chunks */
+  async *chatStream(options) {
+    this.checkLimits();
+    const headers = { ...this.headers };
+    if (this.spendAuthFn) {
+      const auth2 = await this.spendAuthFn();
+      headers["X-Payment-Signature"] = JSON.stringify(auth2);
+      delete headers["Authorization"];
+    }
+    const res = await proxiedFetch(this.privacy, `${this.baseURL}/chat/completions`, {
+      method: "POST",
+      headers,
+      body: JSON.stringify({
+        model: options.model || this.model,
+        messages: options.messages,
+        temperature: options.temperature,
+        max_tokens: options.maxTokens,
+        stream: true,
+        stop: options.stop,
+        top_p: options.topP
+      })
+    }, true);
+    if (!res.ok) {
+      const err = await res.json().catch(() => ({ error: res.statusText }));
+      throw new TCloudError(res.status, err.error || err.message || res.statusText);
+    }
+    const reader = res.body.getReader();
+    const decoder = new TextDecoder();
+    let buf = "";
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      buf += decoder.decode(value, { stream: true });
+      const lines = buf.split("\n");
+      buf = lines.pop() || "";
+      for (const line of lines) {
+        if (!line.startsWith("data: ")) continue;
+        const data = line.slice(6).trim();
+        if (data === "[DONE]") {
+          this._requestCount++;
+          return;
+        }
+        try {
+          yield JSON.parse(data);
+        } catch {
+        }
+      }
+    }
+  }
+  /** Convenience: send a single message and get the text response */
+  async ask(message, modelOrOptions) {
+    const options = typeof modelOrOptions === "string" ? { model: modelOrOptions } : modelOrOptions;
+    const completion = await this.chat({
+      messages: [{ role: "user", content: message }],
+      ...options
+    });
+    return completion.choices[0]?.message?.content || "";
+  }
+  /** Convenience: send a single message and get the full completion (with usage) */
+  async askFull(message, modelOrOptions) {
+    const options = typeof modelOrOptions === "string" ? { model: modelOrOptions } : modelOrOptions;
+    return this.chat({
+      messages: [{ role: "user", content: message }],
+      ...options
+    });
+  }
+  /** Convenience: stream a single message and yield text chunks */
+  async *askStream(message, modelOrOptions) {
+    const options = typeof modelOrOptions === "string" ? { model: modelOrOptions } : modelOrOptions;
+    for await (const chunk of this.chatStream({
+      messages: [{ role: "user", content: message }],
+      ...options
+    })) {
+      const content = chunk.choices[0]?.delta?.content;
+      if (content) yield content;
+    }
+  }
+  /** List available models */
+  async models() {
+    const res = await proxiedFetch(this.privacy, `${this.baseURL}/models`, { headers: this.headers }, false);
+    if (!res.ok) throw new TCloudError(res.status, "Failed to fetch models");
+    const data = await res.json();
+    return data.data || [];
+  }
+  /** List active operators */
+  async operators() {
+    const apiRoot = this.baseURL.replace(/\/v1$/, "");
+    const res = await proxiedFetch(this.privacy, `${apiRoot}/api/operators`, { headers: this.headers }, false);
+    if (!res.ok) throw new TCloudError(res.status, "Failed to fetch operators");
+    return res.json();
+  }
+  /** Get credit balance */
+  async credits() {
+    const apiRoot = this.baseURL.replace(/\/v1$/, "");
+    const res = await proxiedFetch(this.privacy, `${apiRoot}/api/billing`, { headers: this.headers }, false);
+    if (!res.ok) throw new TCloudError(res.status, "Failed to fetch credits");
+    return res.json();
+  }
+  /** Add credits */
+  async addCredits(amount) {
+    const apiRoot = this.baseURL.replace(/\/v1$/, "");
+    const res = await proxiedFetch(this.privacy, `${apiRoot}/api/billing`, {
+      method: "POST",
+      headers: this.headers,
+      body: JSON.stringify({ amount })
+    }, false);
+    if (!res.ok) throw new TCloudError(res.status, "Failed to add credits");
+    return res.json();
+  }
+  /** Create a new API key */
+  async createKey(name) {
+    const apiRoot = this.baseURL.replace(/\/v1$/, "");
+    const res = await proxiedFetch(this.privacy, `${apiRoot}/api/keys`, {
+      method: "POST",
+      headers: this.headers,
+      body: JSON.stringify({ name })
+    }, false);
+    if (!res.ok) throw new TCloudError(res.status, "Failed to create API key");
+    return res.json();
+  }
+  /** List API keys */
+  async keys() {
+    const apiRoot = this.baseURL.replace(/\/v1$/, "");
+    const res = await proxiedFetch(this.privacy, `${apiRoot}/api/keys`, { headers: this.headers }, false);
+    if (!res.ok) throw new TCloudError(res.status, "Failed to fetch keys");
+    return res.json();
+  }
+  /** Revoke an API key */
+  async revokeKey(id) {
+    const apiRoot = this.baseURL.replace(/\/v1$/, "");
+    const res = await proxiedFetch(this.privacy, `${apiRoot}/api/keys/${id}`, {
+      method: "DELETE",
+      headers: this.headers
+    }, false);
+    if (!res.ok) throw new TCloudError(res.status, "Failed to revoke key");
+  }
+  /** Search models by name, provider, or capability */
+  async searchModels(query) {
+    const all = await this.models();
+    const q = query.toLowerCase();
+    return all.filter(
+      (m) => m.id.toLowerCase().includes(q) || m.name.toLowerCase().includes(q) || m._provider && m._provider.toLowerCase().includes(q)
+    );
+  }
+  /** Estimate cost for a request (without sending it) */
+  async estimateCost(options) {
+    const models = await this.models();
+    const model = models.find((m) => m.id === (options.model || this.model));
+    if (!model) return { inputCost: 0, outputCost: 0, total: 0 };
+    const inputCost = options.inputTokens * parseFloat(model.pricing.prompt);
+    const outputCost = options.outputTokens * parseFloat(model.pricing.completion);
+    return { inputCost, outputCost, total: inputCost + outputCost };
+  }
+};
+var TCloudError = class extends Error {
+  constructor(status, message) {
+    super(message);
+    this.status = status;
+    this.name = "TCloudError";
+  }
+};
+
+// src/shielded.ts
+var import_accounts = require("viem/accounts");
+var import_viem = require("viem");
+var SPEND_TYPEHASH = (0, import_viem.keccak256)(
+  (0, import_viem.toBytes)(
+    "SpendAuthorization(bytes32 commitment,uint64 serviceId,uint8 jobIndex,uint256 amount,address operator,uint256 nonce,uint64 expiry)"
+  )
+);
+var DEFAULT_DOMAIN = {
+  name: "ShieldedCredits",
+  version: "1"
+};
+function generateWallet() {
+  const privateKeyBytes = crypto.getRandomValues(new Uint8Array(32));
+  const privateKey = "0x" + Array.from(privateKeyBytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+  const saltBytes = crypto.getRandomValues(new Uint8Array(32));
+  const salt = "0x" + Array.from(saltBytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+  const account = (0, import_accounts.privateKeyToAccount)(privateKey);
+  const commitment = (0, import_viem.keccak256)(
+    (0, import_viem.encodeAbiParameters)(
+      (0, import_viem.parseAbiParameters)("address, bytes32"),
+      [account.address, salt]
+    )
+  );
+  return { privateKey, address: account.address, commitment, salt };
+}
+async function signSpendAuth(wallet2, params) {
+  const account = (0, import_accounts.privateKeyToAccount)(wallet2.privateKey);
+  const domainSeparator = (0, import_viem.keccak256)(
+    (0, import_viem.encodeAbiParameters)(
+      (0, import_viem.parseAbiParameters)("bytes32, bytes32, bytes32, uint256, address"),
+      [
+        (0, import_viem.keccak256)((0, import_viem.toBytes)("EIP712Domain(string name,string version,uint256 chainId,address verifyingContract)")),
+        (0, import_viem.keccak256)((0, import_viem.toBytes)(DEFAULT_DOMAIN.name)),
+        (0, import_viem.keccak256)((0, import_viem.toBytes)(DEFAULT_DOMAIN.version)),
+        BigInt(params.chainId),
+        params.creditsAddress
+      ]
+    )
+  );
+  const structHash = (0, import_viem.keccak256)(
+    (0, import_viem.encodeAbiParameters)(
+      (0, import_viem.parseAbiParameters)("bytes32, bytes32, uint64, uint8, uint256, address, uint256, uint64"),
+      [
+        SPEND_TYPEHASH,
+        wallet2.commitment,
+        params.serviceId,
+        params.jobIndex,
+        params.amount,
+        params.operator,
+        params.nonce,
+        params.expiry
+      ]
+    )
+  );
+  const digest = (0, import_viem.keccak256)(
+    (0, import_viem.concat)([(0, import_viem.toBytes)("0x1901"), (0, import_viem.toBytes)(domainSeparator), (0, import_viem.toBytes)(structHash)])
+  );
+  const signature = await account.sign({ hash: digest });
+  return {
+    commitment: wallet2.commitment,
+    serviceId: params.serviceId.toString(),
+    jobIndex: params.jobIndex,
+    amount: params.amount.toString(),
+    operator: params.operator,
+    nonce: params.nonce.toString(),
+    expiry: params.expiry.toString(),
+    signature
+  };
+}
+function estimateCost(inputTokens, maxOutputTokens, inputPricePerM = 0.15, outputPricePerM = 0.6) {
+  const cost = inputTokens / 1e6 * inputPricePerM + maxOutputTokens / 1e6 * outputPricePerM;
+  return BigInt(Math.ceil(cost * 1e6));
+}
+function createShieldedClient(config = {}) {
+  const wallet2 = config.wallet || generateWallet();
+  const chainId = config.chainId || 3799;
+  const creditsAddress = config.creditsAddress || "0x0000000000000000000000000000000000000000";
+  const operatorAddress = config.operatorAddress || "0x0000000000000000000000000000000000000000";
+  const serviceId = config.serviceId || 1n;
+  let nonce = 0n;
+  const client = new TCloudClient({
+    ...config,
+    apiKey: void 0
+    // no API key in private mode
+  });
+  client.setSpendAuthSigner(async () => {
+    const currentNonce = nonce++;
+    const amount = estimateCost(500, 4096);
+    const buffered = amount + amount / 5n;
+    return signSpendAuth(wallet2, {
+      serviceId,
+      jobIndex: 0,
+      amount: buffered,
+      operator: operatorAddress,
+      nonce: currentNonce,
+      expiry: BigInt(Math.floor(Date.now() / 1e3) + 300),
+      chainId,
+      creditsAddress
+    });
+  });
+  const monitor = { lastBalance: 0n, timer: null, replenishing: false };
+  if (config.autoReplenish) {
+    const ar = config.autoReplenish;
+    const intervalMs = ar.checkIntervalMs ?? 3e4;
+    const check = async () => {
+      try {
+        const balance = await fetchBalance(wallet2.commitment, creditsAddress, chainId);
+        monitor.lastBalance = balance;
+        if (balance < ar.minBalance && !monitor.replenishing) {
+          monitor.replenishing = true;
+          try {
+            if (ar.fundingSource === "relayer") {
+              await replenishViaRelayer(ar.relayerUrl, wallet2.commitment, wallet2.privateKey);
+            } else {
+              await replenishDirect(
+                ar.fundingWalletKey,
+                ar.tokenAddress,
+                ar.replenishAmount,
+                wallet2.commitment,
+                wallet2.address,
+                creditsAddress,
+                chainId
+              );
+            }
+            monitor.lastBalance = await fetchBalance(wallet2.commitment, creditsAddress, chainId);
+            console.log(`[tcloud/shielded] replenished. balance=${monitor.lastBalance}`);
+          } finally {
+            monitor.replenishing = false;
+          }
+        }
+      } catch (err) {
+        console.error("[tcloud/shielded] auto-replenish error:", err instanceof Error ? err.message : String(err));
+      }
+    };
+    void check();
+    monitor.timer = setInterval(() => void check(), intervalMs);
+  }
+  function stopAutoReplenish() {
+    if (monitor.timer) {
+      clearInterval(monitor.timer);
+      monitor.timer = null;
+    }
+  }
+  return Object.assign(client, { wallet: wallet2, stopAutoReplenish });
+}
+var GET_ACCOUNT_ABI = [{
+  type: "function",
+  name: "getAccount",
+  inputs: [{ name: "commitment", type: "bytes32" }],
+  outputs: [{
+    name: "",
+    type: "tuple",
+    components: [
+      { name: "spendingKey", type: "address" },
+      { name: "token", type: "address" },
+      { name: "balance", type: "uint256" },
+      { name: "totalFunded", type: "uint256" },
+      { name: "totalSpent", type: "uint256" },
+      { name: "nonce", type: "uint256" }
+    ]
+  }],
+  stateMutability: "view"
+}];
+var FUND_CREDITS_ABI = [{
+  type: "function",
+  name: "fundCredits",
+  inputs: [
+    { name: "token", type: "address" },
+    { name: "amount", type: "uint256" },
+    { name: "commitment", type: "bytes32" },
+    { name: "spendingKey", type: "address" }
+  ],
+  outputs: [],
+  stateMutability: "nonpayable"
+}];
+var ERC20_APPROVE_ABI = [{
+  type: "function",
+  name: "approve",
+  inputs: [
+    { name: "spender", type: "address" },
+    { name: "amount", type: "uint256" }
+  ],
+  outputs: [{ name: "", type: "bool" }],
+  stateMutability: "nonpayable"
+}];
+function makeChain(chainId, rpcUrl) {
+  return {
+    id: chainId,
+    name: `chain-${chainId}`,
+    nativeCurrency: { name: "Ether", symbol: "ETH", decimals: 18 },
+    rpcUrls: { default: { http: [rpcUrl] } }
+  };
+}
+function getRpcUrl(chainId) {
+  if (chainId === 3799) return "https://testnet-rpc.tangle.tools";
+  if (chainId === 5845) return "https://rpc.tangle.tools";
+  return "http://localhost:8545";
+}
+async function fetchBalance(commitment, creditsAddress, chainId) {
+  const { createPublicClient, http } = await import("viem");
+  const rpcUrl = getRpcUrl(chainId);
+  const client = createPublicClient({ chain: makeChain(chainId, rpcUrl), transport: http(rpcUrl) });
+  const result = await client.readContract({
+    address: creditsAddress,
+    abi: GET_ACCOUNT_ABI,
+    functionName: "getAccount",
+    args: [commitment]
+  });
+  return result.balance;
+}
+async function replenishViaRelayer(relayerUrl, commitment, spendingKey) {
+  const res = await fetch(`${relayerUrl.replace(/\/$/, "")}/relay/fund-credits`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      anchorProof: { proof: "0x", auxPublicInputs: "0x", externalData: "0x", publicInputs: "0x", encryptions: "0x" },
+      commitment,
+      spendingKey
+    })
+  });
+  if (!res.ok) {
+    const body = await res.text();
+    throw new Error(`relayer fund-credits failed (${res.status}): ${body}`);
+  }
+}
+async function replenishDirect(fundingKey, tokenAddress, amount, commitment, spendingKeyAddress, creditsAddress, chainId) {
+  const { createPublicClient, createWalletClient, http } = await import("viem");
+  const { privateKeyToAccount: toAccount } = await import("viem/accounts");
+  const rpcUrl = getRpcUrl(chainId);
+  const chain = makeChain(chainId, rpcUrl);
+  const account = toAccount(fundingKey);
+  const pub = createPublicClient({ chain, transport: http(rpcUrl) });
+  const wal = createWalletClient({ account, chain, transport: http(rpcUrl) });
+  const approveHash = await wal.writeContract({
+    address: tokenAddress,
+    abi: ERC20_APPROVE_ABI,
+    functionName: "approve",
+    args: [creditsAddress, amount]
+  });
+  await pub.waitForTransactionReceipt({ hash: approveHash });
+  const fundHash = await wal.writeContract({
+    address: creditsAddress,
+    abi: FUND_CREDITS_ABI,
+    functionName: "fundCredits",
+    args: [tokenAddress, amount, commitment, spendingKeyAddress]
+  });
+  const receipt = await pub.waitForTransactionReceipt({ hash: fundHash });
+  if (receipt.status !== "success") {
+    throw new Error(`fundCredits reverted (tx: ${fundHash})`);
+  }
+}
+
+// src/index.ts
+var TCloud = class _TCloud extends TCloudClient {
+  constructor(config) {
+    super(config);
+  }
+  /**
+   * Create a standard client with API key authentication.
+   *
+   * ```ts
+   * const client = TCloud.create({ apiKey: 'sk-tan-...' })
+   * ```
+   */
+  static create(config) {
+    return new _TCloud(config);
+  }
+  /**
+   * Create a shielded (private) client.
+   * Generates an ephemeral wallet and signs SpendAuth automatically.
+   * No API key needed. The operator never learns your identity.
+   *
+   * ```ts
+   * const client = TCloud.shielded()
+   * const response = await client.ask('Hello from the shadows')
+   * console.log(client.wallet.commitment) // anonymous credit account
+   * ```
+   */
+  static shielded(config) {
+    return createShieldedClient(config);
+  }
+  /**
+   * Generate a new ephemeral wallet (without creating a client).
+   *
+   * ```ts
+   * const wallet = TCloud.generateWallet()
+   * console.log(wallet.address, wallet.commitment)
+   * ```
+   */
+  static generateWallet = generateWallet;
+};
+
+// src/cli.ts
+var fs = __toESM(require("fs"), 1);
+var path = __toESM(require("path"), 1);
+var readline = __toESM(require("readline"), 1);
+var CONFIG_DIR = path.join(process.env.HOME || "~", ".tcloud");
+var CONFIG_FILE = path.join(CONFIG_DIR, "config.json");
+var WALLETS_FILE = path.join(CONFIG_DIR, "wallets.json");
+function ensureDir() {
+  if (!fs.existsSync(CONFIG_DIR)) fs.mkdirSync(CONFIG_DIR, { recursive: true, mode: 448 });
+}
+function loadConfig() {
+  ensureDir();
+  if (fs.existsSync(CONFIG_FILE)) return JSON.parse(fs.readFileSync(CONFIG_FILE, "utf-8"));
+  return { apiUrl: "https://api.tangleai.cloud", defaultModel: "gpt-4o-mini", chainId: 3799 };
+}
+function saveConfig(c) {
+  ensureDir();
+  fs.writeFileSync(CONFIG_FILE, JSON.stringify(c, null, 2), { mode: 384 });
+}
+function loadWallets() {
+  ensureDir();
+  if (fs.existsSync(WALLETS_FILE)) return JSON.parse(fs.readFileSync(WALLETS_FILE, "utf-8"));
+  return [];
+}
+function saveWallets(w) {
+  ensureDir();
+  fs.writeFileSync(WALLETS_FILE, JSON.stringify(w, null, 2), { mode: 384 });
+}
+function getClient(opts) {
+  const config = loadConfig();
+  if (opts?.private) {
+    const wallets = loadWallets();
+    if (wallets.length === 0) {
+      console.error("No shielded wallets. Run: tcloud wallet generate");
+      process.exit(1);
+    }
+    return TCloud.shielded({ baseURL: `${config.apiUrl}/v1`, wallet: wallets[0] });
+  }
+  return new TCloud({ baseURL: `${config.apiUrl}/v1`, apiKey: config.apiKey, model: config.defaultModel });
+}
+var program = new import_commander.Command();
+program.name("tcloud").description("Tangle AI Cloud CLI").version("0.1.0");
+program.command("config").description("View or update configuration").option("--api-url <url>", "API base URL").option("--api-key <key>", "API key").option("--model <model>", "Default model").option("--chain <id>", "Chain ID").action((opts) => {
+  const c = loadConfig();
+  if (opts.apiUrl) c.apiUrl = opts.apiUrl;
+  if (opts.apiKey) c.apiKey = opts.apiKey;
+  if (opts.model) c.defaultModel = opts.model;
+  if (opts.chain) c.chainId = parseInt(opts.chain);
+  saveConfig(c);
+  console.log(JSON.stringify(c, null, 2));
+});
+var auth = program.command("auth").description("Authentication");
+auth.command("login").description("Log in via browser (device flow)").action(async () => {
+  const config = loadConfig();
+  try {
+    const res = await fetch(`${config.apiUrl}/api/auth/device`, { method: "POST" });
+    if (!res.ok) {
+      console.error("Auth server error");
+      process.exit(1);
+    }
+    const d = await res.json();
+    console.log(`
+  Open: ${d.verification_url}
+  Code: ${d.user_code}
+
+  Waiting...`);
+    const deadline = Date.now() + (d.expires_in || 600) * 1e3;
+    while (Date.now() < deadline) {
+      await new Promise((r2) => setTimeout(r2, (d.interval || 5) * 1e3));
+      const r = await fetch(`${config.apiUrl}/api/auth/device/token`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ device_code: d.device_code })
+      });
+      const t = await r.json();
+      if (t.access_token) {
+        config.apiKey = t.access_token;
+        saveConfig(config);
+        console.log("\n  Authenticated!");
+        return;
+      }
+      if (t.error === "expired_token") {
+        console.error("\n  Code expired.");
+        process.exit(1);
+      }
+      process.stdout.write(".");
+    }
+    console.error("\n  Timed out.");
+  } catch (e) {
+    console.error("Failed:", e.message);
+  }
+});
+auth.command("set-key").description("Set API key directly").argument("<key>").action((key) => {
+  const c = loadConfig();
+  c.apiKey = key;
+  saveConfig(c);
+  console.log("API key saved.");
+});
+auth.command("status").description("Show auth status").action(() => {
+  const c = loadConfig();
+  console.log(c.apiKey ? `Authenticated: ${c.apiKey.slice(0, 15)}...` : "Not authenticated");
+  const w = loadWallets();
+  if (w.length) console.log(`Shielded wallets: ${w.length}`);
+});
+var wallet = program.command("wallet").description("Shielded wallet management");
+wallet.command("generate").description("Generate ephemeral wallet").option("-l, --label <name>").action((opts) => {
+  const w = generateWallet();
+  const wallets = loadWallets();
+  wallets.push({ ...w, label: opts.label, createdAt: (/* @__PURE__ */ new Date()).toISOString() });
+  saveWallets(wallets);
+  console.log(`Wallet generated:`);
+  console.log(`  Address:    ${w.address}`);
+  console.log(`  Commitment: ${w.commitment}`);
+  console.log(`  Saved to:   ${WALLETS_FILE}`);
+  console.log(`
+Fund with: tcloud credits fund`);
+});
+wallet.command("list").description("List wallets").action(() => {
+  const wallets = loadWallets();
+  if (!wallets.length) {
+    console.log("No wallets. Run: tcloud wallet generate");
+    return;
+  }
+  wallets.forEach((w, i) => console.log(`  [${i}] ${(w.label || "default").padEnd(15)} ${w.commitment.slice(0, 20)}...`));
+});
+program.command("chat").description("Chat with a model").argument("[message]", "Message (or interactive if omitted)").option("-m, --model <model>", "Model").option("--private", "Use shielded credits (anonymous)").option("--stream", "Stream output", true).action(async (message, opts) => {
+  const client = getClient({ private: opts.private });
+  const model = opts.model || loadConfig().defaultModel;
+  if (!message) {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    console.log(`tcloud chat \u2014 ${model}${opts.private ? " (private)" : ""}
+Ctrl+C to exit.
+`);
+    const ask = () => rl.question("> ", async (input) => {
+      if (!input.trim()) {
+        ask();
+        return;
+      }
+      try {
+        for await (const chunk of client.askStream(input.trim(), { model })) {
+          process.stdout.write(chunk);
+        }
+        process.stdout.write("\n\n");
+      } catch (e) {
+        console.error("Error:", e.message);
+      }
+      ask();
+    });
+    ask();
+    return;
+  }
+  try {
+    if (opts.stream) {
+      for await (const chunk of client.askStream(message, { model })) {
+        process.stdout.write(chunk);
+      }
+      process.stdout.write("\n");
+    } else {
+      const completion = await client.askFull(message, { model });
+      const text = completion.choices[0]?.message?.content || "";
+      const usedModel = completion.model || model;
+      const usage = completion.usage;
+      process.stdout.write(`[${usedModel}] ${text}
+`);
+      if (usage) {
+        const cost = usage.total_tokens * 1e-6;
+        process.stdout.write(`  \u21B3 ${usage.total_tokens} tokens \xB7 $${cost.toFixed(6)}
+`);
+      }
+    }
+  } catch (e) {
+    console.error("Error:", e.message);
+    if (e.status === 402) console.error("Add credits: tcloud credits fund");
+  }
+});
+program.command("models").description("List available models").option("-s, --search <query>", "Search").action(async (opts) => {
+  const client = getClient();
+  try {
+    let models = await client.models();
+    if (opts.search) {
+      const q = opts.search.toLowerCase();
+      models = models.filter((m) => m.id.toLowerCase().includes(q) || m.name.toLowerCase().includes(q));
+    }
+    console.log(`${models.length} models:`);
+    models.slice(0, 30).forEach((m) => console.log(`  ${m.id.padEnd(40)} ${m.name || ""}`));
+    if (models.length > 30) console.log(`  ... +${models.length - 30} more`);
+  } catch (e) {
+    console.error("Error:", e.message);
+  }
+});
+program.command("operators").description("List active operators").action(async () => {
+  const client = getClient();
+  try {
+    const { operators, stats } = await client.operators();
+    console.log(`${stats.activeOperators} operators, ${stats.totalModels} models:
+`);
+    operators.forEach(
+      (o) => console.log(`  ${o.slug.padEnd(20)} ${o.status.padEnd(10)} ${String(o.models.length).padEnd(3)} models  ${o.reputationScore}% rep  ${o.avgLatencyMs}ms`)
+    );
+  } catch (e) {
+    console.error("Error:", e.message);
+  }
+});
+var credits = program.command("credits").description("Credit management");
+credits.command("balance").description("Check balance").action(async () => {
+  const client = getClient();
+  try {
+    const data = await client.credits();
+    console.log(`Balance: $${data.balance.toFixed(4)}`);
+    if (data.transactions.length) {
+      console.log("\nRecent transactions:");
+      data.transactions.slice(0, 5).forEach(
+        (t) => console.log(`  ${t.amount > 0 ? "+" : ""}$${Math.abs(t.amount).toFixed(4).padEnd(10)} ${t.description}`)
+      );
+    }
+  } catch (e) {
+    console.error("Error:", e.message);
+  }
+});
+credits.command("add").description("Add credits").argument("<amount>").action(async (amount) => {
+  const client = getClient();
+  try {
+    const data = await client.addCredits(parseFloat(amount));
+    console.log(`Credits added. New balance: $${data.balance.toFixed(4)}`);
+  } catch (e) {
+    console.error("Error:", e.message);
+  }
+});
+credits.command("fund").description("Fund shielded credits from pool").action(() => {
+  console.log("Shielded credit funding requires integration with the VAnchor pool.");
+  console.log("See: https://docs.tangleai.cloud/privacy/funding");
+});
+var keys = program.command("keys").description("API key management");
+keys.command("create").description("Create API key").argument("<name>").action(async (name) => {
+  const config = loadConfig();
+  try {
+    const res = await fetch(`${config.apiUrl}/api/keys`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", ...config.apiKey ? { Authorization: `Bearer ${config.apiKey}` } : {} },
+      body: JSON.stringify({ name })
+    });
+    const data = await res.json();
+    if (data.key) {
+      console.log(`Key created: ${data.key}
+Save this \u2014 shown once only.`);
+    } else console.error("Error:", data.error);
+  } catch (e) {
+    console.error("Error:", e.message);
+  }
+});
+keys.command("list").description("List API keys").action(async () => {
+  const config = loadConfig();
+  try {
+    const res = await fetch(`${config.apiUrl}/api/keys`, {
+      headers: config.apiKey ? { Authorization: `Bearer ${config.apiKey}` } : {}
+    });
+    const data = await res.json();
+    if (data.keys?.length) data.keys.forEach((k) => console.log(`  ${k.id.slice(0, 8)} ${k.name.padEnd(20)} ${k.keyPrefix}`));
+    else console.log("No keys.");
+  } catch (e) {
+    console.error("Error:", e.message);
+  }
+});
+program.parse();