@thawgate/cli 0.1.0

package/dist/index.js

@@ -0,0 +1,1092 @@
+#!/usr/bin/env node
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+// src/index.ts
+var import_commander = require("commander");
+var import_sdk3 = require("@thawgate/sdk");
+
+// src/commands.ts
+var fs3 = __toESM(require("fs"));
+var os3 = __toESM(require("os"));
+var readline = __toESM(require("readline"));
+var import_web3 = require("@solana/web3.js");
+var import_spl_token = require("@solana/spl-token");
+var import_anchor = require("@coral-xyz/anchor");
+var import_sdk = require("@thawgate/sdk");
+
+// src/config.ts
+var fs = __toESM(require("fs"));
+var path = __toESM(require("path"));
+var os = __toESM(require("os"));
+var dotenv = __toESM(require("dotenv"));
+dotenv.config();
+var CONFIG_DIR = path.join(os.homedir(), ".thawgate");
+var CONFIG_FILE = path.join(CONFIG_DIR, "config.json");
+var LEGACY_CONFIG_FILE = path.join(os.homedir(), ".sss-token", "config.json");
+var DEFAULTS = {
+  rpcUrl: "https://api.devnet.solana.com",
+  commitment: "confirmed",
+  programId: "",
+  hookProgramId: "",
+  keypairPath: path.join(os.homedir(), ".config", "solana", "id.json"),
+  outputFormat: "text"
+};
+function loadConfig(overrides) {
+  let fileConfig = {};
+  const file = fs.existsSync(CONFIG_FILE) ? CONFIG_FILE : fs.existsSync(LEGACY_CONFIG_FILE) ? LEGACY_CONFIG_FILE : void 0;
+  if (file) {
+    try {
+      const raw = fs.readFileSync(file, "utf-8");
+      fileConfig = JSON.parse(raw);
+    } catch {
+    }
+  }
+  const envConfig = {};
+  if (process.env.SSS_RPC_URL) envConfig.rpcUrl = process.env.SSS_RPC_URL;
+  if (process.env.SSS_COMMITMENT)
+    envConfig.commitment = process.env.SSS_COMMITMENT;
+  if (process.env.SSS_PROGRAM_ID)
+    envConfig.programId = process.env.SSS_PROGRAM_ID;
+  if (process.env.SSS_HOOK_PROGRAM_ID)
+    envConfig.hookProgramId = process.env.SSS_HOOK_PROGRAM_ID;
+  if (process.env.SSS_KEYPAIR_PATH)
+    envConfig.keypairPath = process.env.SSS_KEYPAIR_PATH;
+  const given = Object.fromEntries(Object.entries(overrides ?? {}).filter(([, v]) => v !== void 0));
+  return {
+    ...DEFAULTS,
+    ...fileConfig,
+    ...envConfig,
+    ...given
+  };
+}
+function saveConfig(config2) {
+  if (!fs.existsSync(CONFIG_DIR)) {
+    fs.mkdirSync(CONFIG_DIR, { recursive: true });
+  }
+  const existing = fs.existsSync(CONFIG_FILE) ? JSON.parse(fs.readFileSync(CONFIG_FILE, "utf-8")) : {};
+  const merged = { ...existing, ...config2 };
+  fs.writeFileSync(CONFIG_FILE, JSON.stringify(merged, null, 2));
+}
+function loadKeypair(keypairPath) {
+  const raw = fs.readFileSync(keypairPath, "utf-8");
+  return Uint8Array.from(JSON.parse(raw));
+}
+
+// src/logger.ts
+var fs2 = __toESM(require("fs"));
+var path2 = __toESM(require("path"));
+var os2 = __toESM(require("os"));
+var LOG_DIR = path2.join(os2.homedir(), ".thawgate");
+var LOG_FILE = path2.join(LOG_DIR, "audit.log");
+var Logger = class {
+  verbose;
+  jsonOutput;
+  constructor(verbose = false, jsonOutput = false) {
+    this.verbose = verbose;
+    this.jsonOutput = jsonOutput;
+    this.ensureLogDir();
+  }
+  ensureLogDir() {
+    if (!fs2.existsSync(LOG_DIR)) {
+      fs2.mkdirSync(LOG_DIR, { recursive: true });
+    }
+  }
+  /**
+   * Formats and writes a log entry.
+   */
+  log(level, message, data) {
+    const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+    const entry = {
+      timestamp,
+      level,
+      message,
+      ...data ? { data } : {}
+    };
+    const line = JSON.stringify(entry) + "\n";
+    try {
+      fs2.appendFileSync(LOG_FILE, line);
+    } catch {
+    }
+    if (this.jsonOutput) {
+      if (level !== "DEBUG" /* DEBUG */ || this.verbose) console.error(JSON.stringify(entry));
+    } else if (level !== "DEBUG" /* DEBUG */ || this.verbose) {
+      const prefix = level === "ERROR" /* ERROR */ ? "\u2717" : level === "WARN" /* WARN */ ? "\u26A0" : "\u2713";
+      console.log(`${prefix} ${message}`);
+      if (data && this.verbose) {
+        console.log("  Data:", JSON.stringify(data, null, 2));
+      }
+    }
+  }
+  debug(message, data) {
+    this.log("DEBUG" /* DEBUG */, message, data);
+  }
+  info(message, data) {
+    this.log("INFO" /* INFO */, message, data);
+  }
+  warn(message, data) {
+    this.log("WARN" /* WARN */, message, data);
+  }
+  error(message, data) {
+    this.log("ERROR" /* ERROR */, message, data);
+  }
+  /**
+   * Logs a transaction result.
+   */
+  transaction(action, signature, details) {
+    this.info(`${action}: ${signature}`, details);
+  }
+  /**
+   * Outputs structured data (for --json mode).
+   */
+  output(data) {
+    if (this.jsonOutput) {
+      console.log(JSON.stringify(data, null, 2));
+    } else {
+      for (const [key, value] of Object.entries(data)) {
+        console.log(`  ${key}: ${value}`);
+      }
+    }
+  }
+};
+
+// src/utils.ts
+async function simulateTransaction(connection, transaction, signers) {
+  const { blockhash } = await connection.getLatestBlockhash("confirmed");
+  transaction.recentBlockhash = blockhash;
+  transaction.feePayer = signers[0].publicKey;
+  transaction.sign(...signers);
+  const simulation = await connection.simulateTransaction(transaction);
+  console.log("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  console.log("DRY RUN RESULT (transaction NOT submitted)");
+  console.log("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  if (simulation.value.err) {
+    console.log("Status:       \u274C WOULD FAIL");
+    console.log("Error:        ", JSON.stringify(simulation.value.err));
+  } else {
+    console.log("Status:       \u2705 WOULD SUCCEED");
+    console.log("Units:        ", simulation.value.unitsConsumed ?? "unknown");
+  }
+  if (simulation.value.logs && simulation.value.logs.length > 0) {
+    console.log("Program logs:");
+    simulation.value.logs.forEach((log) => console.log(" ", log));
+  }
+  console.log("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  console.log("(No transaction submitted \u2014 dry run only)");
+}
+
+// src/commands.ts
+function createClient(opts) {
+  const config2 = loadConfig({
+    rpcUrl: opts.rpcUrl,
+    commitment: opts.commitment,
+    keypairPath: opts.keypair
+  });
+  const logger = new Logger(Boolean(opts.verbose), Boolean(opts.json));
+  const keypairBytes = loadKeypair(config2.keypairPath);
+  const keypair = import_web3.Keypair.fromSecretKey(keypairBytes);
+  const connection = new import_web3.Connection(config2.rpcUrl, config2.commitment);
+  const client = import_sdk.SolanaStablecoin.fromConfig(
+    {
+      rpcUrl: config2.rpcUrl,
+      commitment: config2.commitment,
+      programId: config2.programId ? new import_web3.PublicKey(config2.programId) : void 0,
+      hookProgramId: config2.hookProgramId ? new import_web3.PublicKey(config2.hookProgramId) : void 0
+    },
+    keypair
+  );
+  return { client, keypair, logger, connection };
+}
+async function confirmSSS2Warning() {
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve) => {
+    console.log("\n\u26A0\uFE0F  WARNING: SSS-2 Compliance Notice");
+    console.log("\u2500".repeat(60));
+    console.log("SSS-2 enables PERMANENT DELEGATE and TRANSFER HOOK extensions.");
+    console.log("These extensions are IMMUTABLE after initialization.");
+    console.log("Once enabled, they CANNOT be disabled without migrating");
+    console.log("all token holders to a new mint.");
+    console.log("");
+    console.log("Ensure you understand the compliance implications before");
+    console.log("deploying this token in a production environment.");
+    console.log("\u2500".repeat(60));
+    rl.question("Type 'yes' to continue, anything else to cancel: ", (answer) => {
+      rl.close();
+      resolve(answer.toLowerCase() === "yes");
+    });
+  });
+}
+function auditLog(entry) {
+  const config2 = loadConfig({});
+  const logPath = config2.auditLogPath || `${os3.homedir()}/.thawgate/audit.log`;
+  const dir = logPath.substring(0, logPath.lastIndexOf("/"));
+  if (dir && !fs3.existsSync(dir)) {
+    fs3.mkdirSync(dir, { recursive: true });
+  }
+  const line = JSON.stringify({ ...entry, timestamp: (/* @__PURE__ */ new Date()).toISOString() }) + "\n";
+  fs3.appendFileSync(logPath, line, "utf-8");
+}
+function registerCommands(program2) {
+  program2.command("init").description("Initialize a new SSS stablecoin").option("--name <name>", "Stablecoin name (max 32 chars)").option("--symbol <symbol>", "Token symbol (max 10 chars)").option("--uri <uri>", "Metadata URI").option("--decimals <n>", "Decimal places", "6").option("--preset <preset>", "Preset: sss1 or sss2", "sss1").option("--custom <path>", "Path to custom config file (.toml or .json)").option("--hook-program <pubkey>", "Transfer hook program ID (SSS-2)").option("--confirm", "Skip confirmation prompt").action(async (opts) => {
+    if (opts.custom && opts.preset && opts.preset !== "sss1") {
+      console.error("\u274C Cannot use --custom and --preset together");
+      process.exit(1);
+    }
+    let name = opts.name;
+    let symbol = opts.symbol;
+    let uri = opts.uri;
+    let decimals = parseInt(opts.decimals, 10);
+    let preset = opts.preset;
+    if (opts.custom) {
+      const { extname } = require("path");
+      const raw = fs3.readFileSync(opts.custom, "utf-8");
+      const ext = extname(opts.custom).toLowerCase();
+      let customConfig;
+      if (ext === ".toml") {
+        try {
+          const toml = require("@iarna/toml");
+          customConfig = toml.parse(raw);
+        } catch {
+          customConfig = {};
+          for (const line of raw.split("\n")) {
+            const trimmed = line.trim();
+            if (!trimmed || trimmed.startsWith("#") || trimmed.startsWith("[")) continue;
+            const eqIdx = trimmed.indexOf("=");
+            if (eqIdx === -1) continue;
+            const key = trimmed.slice(0, eqIdx).trim();
+            let value = trimmed.slice(eqIdx + 1).trim();
+            if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+              value = value.slice(1, -1);
+            }
+            if (value === "true") customConfig[key] = true;
+            else if (value === "false") customConfig[key] = false;
+            else if (/^\d+$/.test(value)) customConfig[key] = parseInt(value, 10);
+            else customConfig[key] = value;
+          }
+        }
+      } else {
+        customConfig = JSON.parse(raw);
+      }
+      console.log(`Loading custom config from ${opts.custom}`);
+      console.log("Config:", JSON.stringify(customConfig, null, 2));
+      if (!customConfig.name || !customConfig.symbol) {
+        console.error("\u274C Custom config must include: name, symbol");
+        process.exit(1);
+      }
+      name = customConfig.name;
+      symbol = customConfig.symbol;
+      uri = customConfig.uri || opts.uri || "";
+      decimals = customConfig.decimals ?? decimals;
+      if (customConfig.preset) preset = customConfig.preset;
+    }
+    preset = parsePreset(preset);
+    if (!name || !symbol) {
+      console.error("\u274C --name and --symbol are required (or provide --custom <path>)");
+      process.exit(1);
+    }
+    if (preset === "sss2" && !opts.confirm) {
+      const confirmed = await confirmSSS2Warning();
+      if (!confirmed) {
+        console.log("Initialization cancelled.");
+        process.exit(0);
+      }
+    }
+    const { client, keypair, logger, connection } = createClient(program2.opts());
+    const args = preset === "sss2" ? (0, import_sdk.sss2Preset)(
+      name,
+      symbol,
+      uri || "",
+      new import_web3.PublicKey(opts.hookProgram),
+      decimals
+    ) : (0, import_sdk.sss1Preset)(name, symbol, uri || "", decimals);
+    logger.info(`Initializing ${preset.toUpperCase()} stablecoin: ${name}`);
+    const { instructions, mint, mintKeypair } = await client.initialize(
+      keypair.publicKey,
+      args
+    );
+    const tx = new import_web3.Transaction().add(...instructions);
+    const sig = await (0, import_web3.sendAndConfirmTransaction)(connection, tx, [keypair, mintKeypair]);
+    logger.transaction("init", sig, {
+      mint: mint.toBase58(),
+      preset,
+      custom: opts.custom || void 0
+    });
+    logger.output({ mint: mint.toBase58(), signature: sig });
+    auditLog({ command: "init", mint: mint.toBase58(), preset, custom: opts.custom, result: sig });
+  });
+  program2.command("mint").description("Mint tokens to a recipient").requiredOption("--mint <pubkey>", "Mint address").requiredOption("--recipient <pubkey>", "Recipient wallet address").requiredOption("--amount <amount>", "Amount to mint (raw units)").option("--dry-run", "Simulate the transaction without submitting").option("--memo <memo>", "Optional memo").action(async (opts) => {
+    const { client, keypair, logger, connection } = createClient(program2.opts());
+    const mint = new import_web3.PublicKey(opts.mint);
+    const recipient = new import_web3.PublicKey(opts.recipient);
+    const amount = new import_anchor.BN(opts.amount);
+    const instructions = await client.mintTokens(mint, keypair.publicKey, recipient, amount);
+    const tx = new import_web3.Transaction().add(...instructions);
+    if (opts.dryRun) {
+      await simulateTransaction(connection, tx, [keypair]);
+      return;
+    }
+    logger.info(`Minting ${opts.amount} tokens to ${recipient.toBase58()}`);
+    const sig = await (0, import_web3.sendAndConfirmTransaction)(connection, tx, [keypair]);
+    logger.transaction("mint", sig, {
+      mint: mint.toBase58(),
+      recipient: recipient.toBase58(),
+      amount: opts.amount
+    });
+    auditLog({ command: "mint", mint: mint.toBase58(), recipient: recipient.toBase58(), amount: opts.amount, result: sig });
+  });
+  program2.command("burn").description("Burn tokens from your account").requiredOption("--mint <pubkey>", "Mint address").requiredOption("--amount <amount>", "Amount to burn (raw units)").option("--dry-run", "Simulate the transaction without submitting").action(async (opts) => {
+    const { client, keypair, logger, connection } = createClient(program2.opts());
+    const mint = new import_web3.PublicKey(opts.mint);
+    const amount = new import_anchor.BN(opts.amount);
+    const instructions = await client.burnTokens(mint, keypair.publicKey, amount);
+    const tx = new import_web3.Transaction().add(...instructions);
+    if (opts.dryRun) {
+      await simulateTransaction(connection, tx, [keypair]);
+      return;
+    }
+    logger.info(`Burning ${opts.amount} tokens`);
+    const sig = await (0, import_web3.sendAndConfirmTransaction)(connection, tx, [keypair]);
+    logger.transaction("burn", sig, { mint: mint.toBase58(), amount: opts.amount });
+    auditLog({ command: "burn", mint: mint.toBase58(), amount: opts.amount, result: sig });
+  });
+  program2.command("freeze").description("Freeze a token account").requiredOption("--mint <pubkey>", "Mint address").requiredOption("--target <pubkey>", "Target token account to freeze").option("--dry-run", "Simulate the transaction without submitting").option("--confirm", "Confirm this irreversible action").action(async (opts) => {
+    if (!opts.confirm && !opts.dryRun) {
+      console.error(
+        `ERROR: Freeze is irreversible.
+Re-run with --confirm to proceed:
+  thawgate freeze --mint ${opts.mint} --target ${opts.target} --confirm`
+      );
+      process.exit(1);
+    }
+    const { client, keypair, logger, connection } = createClient(program2.opts());
+    const mint = new import_web3.PublicKey(opts.mint);
+    const target = new import_web3.PublicKey(opts.target);
+    const instructions = await client.freezeAccount(mint, keypair.publicKey, target);
+    const tx = new import_web3.Transaction().add(...instructions);
+    if (opts.dryRun) {
+      await simulateTransaction(connection, tx, [keypair]);
+      return;
+    }
+    logger.info(`Freezing token account ${target.toBase58()}`);
+    const sig = await (0, import_web3.sendAndConfirmTransaction)(connection, tx, [keypair]);
+    logger.transaction("freeze", sig, { target: target.toBase58() });
+    auditLog({ command: "freeze", mint: mint.toBase58(), target: target.toBase58(), result: sig });
+  });
+  program2.command("thaw").description("Thaw a frozen token account").requiredOption("--mint <pubkey>", "Mint address").requiredOption("--target <pubkey>", "Target token account to thaw").option("--dry-run", "Simulate the transaction without submitting").action(async (opts) => {
+    const { client, keypair, logger, connection } = createClient(program2.opts());
+    const mint = new import_web3.PublicKey(opts.mint);
+    const target = new import_web3.PublicKey(opts.target);
+    const instructions = await client.thawAccount(mint, keypair.publicKey, target);
+    const tx = new import_web3.Transaction().add(...instructions);
+    if (opts.dryRun) {
+      await simulateTransaction(connection, tx, [keypair]);
+      return;
+    }
+    logger.info(`Thawing token account ${target.toBase58()}`);
+    const sig = await (0, import_web3.sendAndConfirmTransaction)(connection, tx, [keypair]);
+    logger.transaction("thaw", sig, { target: target.toBase58() });
+    auditLog({ command: "thaw", mint: mint.toBase58(), target: target.toBase58(), result: sig });
+  });
+  program2.command("pause").description("Pause all token operations").requiredOption("--mint <pubkey>", "Mint address").action(async (opts) => {
+    const { client, keypair, logger, connection } = createClient(program2.opts());
+    const mint = new import_web3.PublicKey(opts.mint);
+    logger.info("Pausing token operations");
+    const instructions = await client.pause(mint, keypair.publicKey);
+    const tx = new import_web3.Transaction().add(...instructions);
+    const sig = await (0, import_web3.sendAndConfirmTransaction)(connection, tx, [keypair]);
+    logger.transaction("pause", sig, { mint: mint.toBase58() });
+    auditLog({ command: "pause", mint: mint.toBase58(), result: sig });
+  });
+  program2.command("unpause").description("Resume token operations").requiredOption("--mint <pubkey>", "Mint address").action(async (opts) => {
+    const { client, keypair, logger, connection } = createClient(program2.opts());
+    const mint = new import_web3.PublicKey(opts.mint);
+    logger.info("Resuming token operations");
+    const instructions = await client.unpause(mint, keypair.publicKey);
+    const tx = new import_web3.Transaction().add(...instructions);
+    const sig = await (0, import_web3.sendAndConfirmTransaction)(connection, tx, [keypair]);
+    logger.transaction("unpause", sig, { mint: mint.toBase58() });
+    auditLog({ command: "unpause", mint: mint.toBase58(), result: sig });
+  });
+  program2.command("grant-role").description("Grant a role to a wallet").requiredOption("--mint <pubkey>", "Mint address").requiredOption("--holder <pubkey>", "Wallet to grant role to").requiredOption("--role <role>", "Role: minter, burner, pauser, blacklister, seizer").action(async (opts) => {
+    const { client, keypair, logger, connection } = createClient(program2.opts());
+    const mint = new import_web3.PublicKey(opts.mint);
+    const holder = new import_web3.PublicKey(opts.holder);
+    const role = parseRoleType(opts.role);
+    logger.info(`Granting ${opts.role} role to ${holder.toBase58()}`);
+    const instructions = await client.updateRoles(mint, keypair.publicKey, holder, role, true);
+    const tx = new import_web3.Transaction().add(...instructions);
+    const sig = await (0, import_web3.sendAndConfirmTransaction)(connection, tx, [keypair]);
+    logger.transaction("grant-role", sig, {
+      holder: holder.toBase58(),
+      role: opts.role
+    });
+    auditLog({ command: "grant-role", mint: mint.toBase58(), holder: holder.toBase58(), role: opts.role, result: sig });
+  });
+  program2.command("revoke-role").description("Revoke a role from a wallet").requiredOption("--mint <pubkey>", "Mint address").requiredOption("--holder <pubkey>", "Wallet to revoke role from").requiredOption("--role <role>", "Role: minter, burner, pauser, blacklister, seizer").action(async (opts) => {
+    const { client, keypair, logger, connection } = createClient(program2.opts());
+    const mint = new import_web3.PublicKey(opts.mint);
+    const holder = new import_web3.PublicKey(opts.holder);
+    const role = parseRoleType(opts.role);
+    logger.info(`Revoking ${opts.role} role from ${holder.toBase58()}`);
+    const instructions = await client.updateRoles(mint, keypair.publicKey, holder, role, false);
+    const tx = new import_web3.Transaction().add(...instructions);
+    const sig = await (0, import_web3.sendAndConfirmTransaction)(connection, tx, [keypair]);
+    logger.transaction("revoke-role", sig, {
+      holder: holder.toBase58(),
+      role: opts.role
+    });
+    auditLog({ command: "revoke-role", mint: mint.toBase58(), holder: holder.toBase58(), role: opts.role, result: sig });
+  });
+  const rolesCmd = program2.command("roles").description("Manage roles (grant or revoke). Use: roles grant | roles revoke");
+  rolesCmd.command("grant").description("Grant a role to a wallet").requiredOption("--mint <pubkey>", "Mint address").requiredOption("--holder <pubkey>", "Wallet to grant role to").requiredOption("--role <role>", "Role: minter, burner, pauser, blacklister, seizer").action(async (opts) => {
+    const { client, keypair, logger, connection } = createClient(program2.opts());
+    const mint = new import_web3.PublicKey(opts.mint);
+    const holder = new import_web3.PublicKey(opts.holder);
+    const role = parseRoleType(opts.role);
+    logger.info(`Granting ${opts.role} role to ${holder.toBase58()}`);
+    const instructions = await client.updateRoles(mint, keypair.publicKey, holder, role, true);
+    const tx = new import_web3.Transaction().add(...instructions);
+    const sig = await (0, import_web3.sendAndConfirmTransaction)(connection, tx, [keypair]);
+    logger.transaction("roles grant", sig, {
+      holder: holder.toBase58(),
+      role: opts.role
+    });
+    auditLog({ command: "roles grant", mint: mint.toBase58(), holder: holder.toBase58(), role: opts.role, result: sig });
+  });
+  rolesCmd.command("revoke").description("Revoke a role from a wallet").requiredOption("--mint <pubkey>", "Mint address").requiredOption("--holder <pubkey>", "Wallet to revoke role from").requiredOption("--role <role>", "Role: minter, burner, pauser, blacklister, seizer").action(async (opts) => {
+    const { client, keypair, logger, connection } = createClient(program2.opts());
+    const mint = new import_web3.PublicKey(opts.mint);
+    const holder = new import_web3.PublicKey(opts.holder);
+    const role = parseRoleType(opts.role);
+    logger.info(`Revoking ${opts.role} role from ${holder.toBase58()}`);
+    const instructions = await client.updateRoles(mint, keypair.publicKey, holder, role, false);
+    const tx = new import_web3.Transaction().add(...instructions);
+    const sig = await (0, import_web3.sendAndConfirmTransaction)(connection, tx, [keypair]);
+    logger.transaction("roles revoke", sig, {
+      holder: holder.toBase58(),
+      role: opts.role
+    });
+    auditLog({ command: "roles revoke", mint: mint.toBase58(), holder: holder.toBase58(), role: opts.role, result: sig });
+  });
+  rolesCmd.command("list").description("List all active role assignments").requiredOption("--mint <pubkey>", "Mint address").option("--json", "Output as JSON").action(async (opts) => {
+    const { client } = createClient(program2.opts());
+    const mint = new import_web3.PublicKey(opts.mint);
+    const allRoles = await client.program.account.roleRecord.all([
+      { memcmp: { offset: 8, bytes: mint.toBase58() } }
+    ]);
+    const active = allRoles.map((r) => r.account).filter((r) => r.active);
+    if (opts.json) {
+      console.log(JSON.stringify({ success: true, data: active, error: null }));
+    } else {
+      if (active.length === 0) {
+        console.log("No active role assignments.");
+      } else {
+        active.forEach((r) => {
+          console.log(`${r.holder.toBase58()}  role: ${Object.keys(r.role)[0]}`);
+        });
+      }
+    }
+  });
+  program2.command("transfer-authority").description("Transfer MasterAuthority to a new wallet").requiredOption("--mint <pubkey>", "Mint address").requiredOption("--new-authority <pubkey>", "New MasterAuthority wallet").option("--confirm", "Confirm this irreversible action").action(async (opts) => {
+    if (!opts.confirm) {
+      console.error(
+        `ERROR: Transferring authority is irreversible without a follow-up transfer-back.
+Re-run with --confirm to proceed:
+  thawgate transfer-authority --mint ${opts.mint} --new-authority ${opts.newAuthority} --confirm`
+      );
+      process.exit(1);
+    }
+    const { client, keypair, logger, connection } = createClient(program2.opts());
+    const mint = new import_web3.PublicKey(opts.mint);
+    const newAuthority = new import_web3.PublicKey(opts.newAuthority);
+    logger.info(`Transferring authority to ${newAuthority.toBase58()}`);
+    const instructions = await client.transferAuthority(
+      mint,
+      keypair.publicKey,
+      newAuthority
+    );
+    const tx = new import_web3.Transaction().add(...instructions);
+    const sig = await (0, import_web3.sendAndConfirmTransaction)(connection, tx, [keypair]);
+    logger.transaction("transfer-authority", sig, {
+      newAuthority: newAuthority.toBase58()
+    });
+    auditLog({ command: "transfer-authority", mint: mint.toBase58(), newAuthority: newAuthority.toBase58(), result: sig });
+  });
+  program2.command("blacklist").description("Add a wallet to the blacklist (Blacklister role); on Token ACL mints its passed account is frozen too").requiredOption("--mint <pubkey>", "Mint address").requiredOption("--target <pubkey>", "Wallet to blacklist").requiredOption("--reason <reason>", "Reason for blacklisting").option("--token-account <pubkey>", "A token account owned by the target (default: its associated token account)").option("--confirm", "Confirm this irreversible action").action(async (opts) => {
+    if (!opts.confirm) {
+      console.error(
+        `ERROR: Blacklisting is irreversible without a separate unblacklist operation.
+Re-run with --confirm to proceed:
+  thawgate blacklist --mint ${opts.mint} --target ${opts.target} --reason "${opts.reason}" --confirm`
+      );
+      process.exit(1);
+    }
+    const { client, keypair, logger, connection } = createClient(program2.opts());
+    const mint = new import_web3.PublicKey(opts.mint);
+    const target = new import_web3.PublicKey(opts.target);
+    logger.info(`Blacklisting ${target.toBase58()}: ${opts.reason}`);
+    const compliance = client.compliance(mint);
+    const instructions = await compliance.addToBlacklist(
+      keypair.publicKey,
+      target,
+      opts.reason,
+      { targetTokenAccount: opts.tokenAccount ? new import_web3.PublicKey(opts.tokenAccount) : void 0 }
+    );
+    const tx = new import_web3.Transaction().add(...instructions);
+    const sig = await (0, import_web3.sendAndConfirmTransaction)(connection, tx, [keypair]);
+    logger.transaction("blacklist", sig, {
+      target: target.toBase58(),
+      reason: opts.reason
+    });
+    auditLog({ command: "blacklist", mint: mint.toBase58(), target: target.toBase58(), reason: opts.reason, result: sig });
+  });
+  program2.command("unblacklist").description("Remove a wallet from the blacklist (SSS-2)").requiredOption("--mint <pubkey>", "Mint address").requiredOption("--target <pubkey>", "Wallet to remove from blacklist").option("--confirm", "Confirm this action").action(async (opts) => {
+    if (!opts.confirm) {
+      console.error(
+        `ERROR: Confirm required for this operation.
+Re-run with --confirm:
+  thawgate unblacklist --mint ${opts.mint} --target ${opts.target} --confirm`
+      );
+      process.exit(1);
+    }
+    const { client, keypair, logger, connection } = createClient(program2.opts());
+    const mint = new import_web3.PublicKey(opts.mint);
+    const target = new import_web3.PublicKey(opts.target);
+    logger.info(`Removing ${target.toBase58()} from blacklist`);
+    const compliance = client.compliance(mint);
+    const instructions = await compliance.removeFromBlacklist(
+      keypair.publicKey,
+      target
+    );
+    const tx = new import_web3.Transaction().add(...instructions);
+    const sig = await (0, import_web3.sendAndConfirmTransaction)(connection, tx, [keypair]);
+    logger.transaction("unblacklist", sig, { target: target.toBase58() });
+    auditLog({ command: "unblacklist", mint: mint.toBase58(), target: target.toBase58(), result: sig });
+  });
+  program2.command("seize").description("Seize tokens from a blacklisted frozen account (SSS-2 only)").requiredOption("--mint <pubkey>", "Mint address").requiredOption("--source <pubkey>", "Source token account (ATA) to seize from").requiredOption("--source-authority <pubkey>", "Wallet that owns the source token account (the blacklisted address)").requiredOption("--treasury <pubkey>", "Treasury token account (ATA) to receive seized tokens").option("--confirm", "Confirm this irreversible action").action(async (opts) => {
+    if (!opts.confirm) {
+      console.error(
+        `ERROR: Seize is irreversible. Re-run with --confirm to proceed:
+  thawgate seize --mint ${opts.mint} --source ${opts.source} --source-authority ${opts.sourceAuthority} --treasury ${opts.treasury} --confirm`
+      );
+      process.exit(1);
+    }
+    const { client, keypair, logger, connection } = createClient(program2.opts());
+    const mint = new import_web3.PublicKey(opts.mint);
+    const sourceAccount = new import_web3.PublicKey(opts.source);
+    const sourceAuthority = new import_web3.PublicKey(opts.sourceAuthority);
+    const treasuryAccount = new import_web3.PublicKey(opts.treasury);
+    logger.info(`Seizing tokens from ${sourceAccount.toBase58()} to ${treasuryAccount.toBase58()}`);
+    const compliance = client.compliance(mint);
+    const instructions = await compliance.seize(
+      keypair.publicKey,
+      sourceAuthority,
+      sourceAccount,
+      treasuryAccount
+    );
+    const tx = new import_web3.Transaction().add(...instructions);
+    const sig = await (0, import_web3.sendAndConfirmTransaction)(connection, tx, [keypair]);
+    logger.transaction("seize", sig, {
+      source: sourceAccount.toBase58(),
+      treasury: treasuryAccount.toBase58()
+    });
+    auditLog({ command: "seize", mint: mint.toBase58(), source: sourceAccount.toBase58(), treasury: treasuryAccount.toBase58(), result: sig });
+  });
+  program2.command("supply").description("Display the current total token supply").requiredOption("--mint <pubkey>", "Mint address").option("--json", "Output as JSON").action(async (opts) => {
+    const { client, logger } = createClient(program2.opts());
+    const mint = new import_web3.PublicKey(opts.mint);
+    const config2 = await client.getConfig(mint);
+    const supply = config2.totalMinted;
+    if (opts.json) {
+      console.log(JSON.stringify({ success: true, data: { supply: supply.toString(), totalMinted: config2.totalMinted.toString(), totalBurned: config2.totalBurned.toString() }, error: null }));
+    } else {
+      console.log(`Total Minted: ${config2.totalMinted.toString()}`);
+      console.log(`Total Burned: ${config2.totalBurned.toString()}`);
+      console.log(`Net Supply:   ${supply.toString()}`);
+    }
+  });
+  const mintersCmd = program2.command("minters").description("Manage minter roles");
+  mintersCmd.command("list").description("List all active minters and their quotas").requiredOption("--mint <pubkey>", "Mint address").option("--json", "Output as JSON").action(async (opts) => {
+    const { client } = createClient(program2.opts());
+    const mint = new import_web3.PublicKey(opts.mint);
+    const allRoles = await client.program.account.roleRecord.all([
+      { memcmp: { offset: 8, bytes: mint.toBase58() } }
+    ]);
+    const minterRoles = allRoles.map((r) => r.account).filter((r) => r.active && Object.keys(r.role)[0] === "minter");
+    if (opts.json) {
+      console.log(JSON.stringify({ success: true, data: minterRoles, error: null }));
+    } else {
+      if (minterRoles.length === 0) {
+        console.log("No active minters.");
+      } else {
+        minterRoles.forEach((m) => {
+          console.log(`${m.holder.toBase58()}  limit: ${m.limit?.toString() || "unlimited"}`);
+        });
+      }
+    }
+  });
+  mintersCmd.command("add <address>").description("Add a minter role").requiredOption("--mint <pubkey>", "Mint address").requiredOption("--limit <amount>", "Minting quota limit (0 = unlimited)").option("--period <period>", "Quota period: daily|weekly|monthly|lifetime", "lifetime").option("--confirm", "Confirm the action").action(async (address, opts) => {
+    if (!opts.confirm) {
+      console.error("Error: --confirm flag required for this operation");
+      process.exit(1);
+    }
+    const { client, keypair, logger, connection } = createClient(program2.opts());
+    const mint = new import_web3.PublicKey(opts.mint);
+    const holder = new import_web3.PublicKey(address);
+    const instructions = await client.updateMinter(
+      mint,
+      keypair.publicKey,
+      holder,
+      new import_anchor.BN(opts.limit),
+      parseQuotaPeriod(opts.period)
+    );
+    const tx = new import_web3.Transaction().add(...instructions);
+    const sig = await (0, import_web3.sendAndConfirmTransaction)(connection, tx, [keypair]);
+    console.log(`Minter added. TX: ${sig}`);
+    auditLog({ command: "minters add", address, limit: opts.limit, result: sig });
+  });
+  mintersCmd.command("remove <address>").description("Remove a minter role").requiredOption("--mint <pubkey>", "Mint address").option("--confirm", "Confirm the action").action(async (address, opts) => {
+    if (!opts.confirm) {
+      console.error("Error: --confirm flag required for this operation");
+      process.exit(1);
+    }
+    const { client, keypair, logger, connection } = createClient(program2.opts());
+    const mint = new import_web3.PublicKey(opts.mint);
+    const holder = new import_web3.PublicKey(address);
+    const instructions = await client.updateRoles(mint, keypair.publicKey, holder, import_sdk.RoleType.Minter, false);
+    const tx = new import_web3.Transaction().add(...instructions);
+    const sig = await (0, import_web3.sendAndConfirmTransaction)(connection, tx, [keypair]);
+    console.log(`Minter removed. TX: ${sig}`);
+    auditLog({ command: "minters remove", address, result: sig });
+  });
+  program2.command("holders").description("List token holders").requiredOption("--mint <pubkey>", "Mint address").option("--min-balance <amount>", "Minimum balance filter", "0").option("--format <format>", "Output format: table|json|csv", "table").action(async (opts) => {
+    const { connection } = createClient(program2.opts());
+    const mint = new import_web3.PublicKey(opts.mint);
+    const accounts = await connection.getProgramAccounts(import_spl_token.TOKEN_2022_PROGRAM_ID, {
+      filters: [
+        { dataSize: 165 },
+        { memcmp: { offset: 0, bytes: mint.toBase58() } }
+      ]
+    });
+    const minBalance = BigInt(opts.minBalance);
+    const holders = accounts.map((acc) => ({
+      address: acc.pubkey.toString(),
+      balance: BigInt(acc.account.data.readBigUInt64LE ? acc.account.data.readBigUInt64LE(64) : 0)
+    })).filter((h) => h.balance >= minBalance);
+    if (opts.format === "json") {
+      console.log(JSON.stringify({ success: true, data: holders.map((h) => ({ ...h, balance: h.balance.toString() })), error: null }));
+    } else if (opts.format === "csv") {
+      console.log("address,balance");
+      holders.forEach((h) => console.log(`${h.address},${h.balance}`));
+    } else {
+      console.table(holders.map((h) => ({ ...h, balance: h.balance.toString() })));
+    }
+  });
+  program2.command("audit-log").description("Display the local audit log").option("--action <type>", "Filter by action type").option("--from <date>", "Start date (ISO 8601)").option("--to <date>", "End date (ISO 8601)").option("--format <format>", "Output format: json|csv", "json").action((opts) => {
+    const config2 = loadConfig({});
+    const logPath = config2.auditLogPath || `${os3.homedir()}/.thawgate/audit.log`;
+    if (!fs3.existsSync(logPath)) {
+      console.log("No audit log found.");
+      return;
+    }
+    const lines = fs3.readFileSync(logPath, "utf-8").split("\n").filter(Boolean).map((l) => JSON.parse(l));
+    let filtered = lines;
+    if (opts.action) filtered = filtered.filter((e) => e.command?.includes(opts.action));
+    if (opts.from) filtered = filtered.filter((e) => new Date(e.timestamp) >= new Date(opts.from));
+    if (opts.to) filtered = filtered.filter((e) => new Date(e.timestamp) <= new Date(opts.to));
+    if (opts.format === "csv") {
+      console.log("timestamp,command,result");
+      filtered.forEach((e) => console.log(`${e.timestamp},${e.command},${e.result}`));
+    } else {
+      console.log(JSON.stringify(filtered, null, 2));
+    }
+  });
+  const configCmd = program2.command("config").description("Manage CLI configuration");
+  configCmd.command("show").description("Display current configuration").action(() => {
+    const config2 = loadConfig({});
+    const safe = { ...config2, keypairPath: config2.keypairPath ? "[set]" : "[not set]" };
+    console.log(JSON.stringify(safe, null, 2));
+  });
+  configCmd.command("set").description("Set a configuration value").option("--rpc-url <url>", "Solana RPC URL").option("--keypair-path <path>", "Path to keypair JSON file").option("--program-id <id>", "SSS Token program ID").option("--mint-address <address>", "Token mint address").action((opts) => {
+    const updates = {};
+    if (opts.rpcUrl) updates.rpcUrl = opts.rpcUrl;
+    if (opts.keypairPath) updates.keypairPath = opts.keypairPath;
+    if (opts.programId) updates.programId = opts.programId;
+    if (opts.mintAddress) updates.mintAddress = opts.mintAddress;
+    if (Object.keys(updates).length === 0) {
+      console.error("No configuration options provided. Use --help for available options.");
+      process.exit(1);
+    }
+    try {
+      saveConfig(updates);
+      console.log("Configuration saved to ~/.thawgate/config.json");
+      for (const [key, value] of Object.entries(updates)) {
+        console.log(`  ${key}: ${value}`);
+      }
+    } catch (err) {
+      console.error(`Failed to save configuration: ${err.message}`);
+      process.exit(1);
+    }
+  });
+  program2.command("status").description("Display stablecoin configuration and status").requiredOption("--mint <pubkey>", "Mint address").action(async (opts) => {
+    const { client, logger } = createClient(program2.opts());
+    const mint = new import_web3.PublicKey(opts.mint);
+    const config2 = await client.getConfig(mint);
+    const pauseState = await client.getPauseState(mint);
+    logger.output({
+      mint: config2.mint.toBase58(),
+      name: config2.name,
+      symbol: config2.symbol,
+      decimals: config2.decimals,
+      authority: config2.authority.toBase58(),
+      paused: pauseState.paused,
+      permanentDelegate: config2.enablePermanentDelegate,
+      transferHook: config2.enableTransferHook,
+      defaultFrozen: config2.defaultAccountFrozen,
+      totalMinted: config2.totalMinted.toString(),
+      totalBurned: config2.totalBurned.toString()
+    });
+  });
+}
+function parseRoleType(role) {
+  const map = {
+    minter: import_sdk.RoleType.Minter,
+    burner: import_sdk.RoleType.Burner,
+    pauser: import_sdk.RoleType.Pauser,
+    blacklister: import_sdk.RoleType.Blacklister,
+    seizer: import_sdk.RoleType.Seizer
+  };
+  const result = map[role.toLowerCase()];
+  if (result === void 0) {
+    throw new Error(
+      `Invalid role: ${role}. Valid roles: ${Object.keys(map).join(", ")}`
+    );
+  }
+  return result;
+}
+function parsePreset(preset) {
+  const p = String(preset).toLowerCase();
+  if (p !== "sss1" && p !== "sss2") {
+    throw new Error(`Invalid preset: ${preset}. Valid presets: sss1, sss2 (for an SSS-ACL mint gated by ThawGate, use create-stablecoin)`);
+  }
+  return p;
+}
+function parseQuotaPeriod(period) {
+  const map = {
+    daily: import_sdk.QuotaPeriod.Daily,
+    weekly: import_sdk.QuotaPeriod.Weekly,
+    monthly: import_sdk.QuotaPeriod.Monthly,
+    lifetime: import_sdk.QuotaPeriod.Lifetime
+  };
+  const result = map[period.toLowerCase()];
+  if (result === void 0) {
+    throw new Error(`Invalid period: ${period}. Valid periods: ${Object.keys(map).join(", ")}`);
+  }
+  return result;
+}
+
+// src/gate.ts
+var import_anchor2 = require("@coral-xyz/anchor");
+var import_web32 = require("@solana/web3.js");
+var import_sdk2 = require("@thawgate/sdk");
+var ALLOWLIST_MODES = ["off", "allowOnly", "bypassForPdas"];
+function onOff(v, flag) {
+  if (v === "on" || v === "true") return true;
+  if (v === "off" || v === "false") return false;
+  throw new Error(`${flag} takes on or off, not ${v}`);
+}
+function policyFromFlags(f, current) {
+  const p = {};
+  if (f.blacklist !== void 0) p.checkBlacklist = onOff(f.blacklist, "--blacklist");
+  if (f.allowlist !== void 0) {
+    if (!ALLOWLIST_MODES.includes(f.allowlist)) throw new Error(`--allowlist takes ${ALLOWLIST_MODES.join(", ")}, not ${f.allowlist}`);
+    p.allowlistMode = f.allowlist;
+  }
+  const sasGiven = f.sasCredential !== void 0 || f.sasSchema !== void 0 || f.minKyc !== void 0;
+  if (f.sas === false) {
+    if (sasGiven) throw new Error("--no-sas can't be combined with --sas-credential, --sas-schema or --min-kyc");
+    p.sas = null;
+  } else if (sasGiven) {
+    const stored = current?.requireSas ? current : void 0;
+    const credential = f.sasCredential ? new import_web32.PublicKey(f.sasCredential) : stored?.sasCredential;
+    const schema = f.sasSchema ? new import_web32.PublicKey(f.sasSchema) : stored?.sasSchema;
+    if (!credential || !schema) throw new Error("a SAS policy needs both --sas-credential and --sas-schema");
+    const minKycLevel = f.minKyc !== void 0 ? Number(f.minKyc) : stored?.minKycLevel ?? 0;
+    if (!Number.isInteger(minKycLevel) || minKycLevel < 0 || minKycLevel > 255) throw new Error("--min-kyc takes 0-255");
+    p.sas = { credential, schema, minKycLevel };
+  }
+  return p;
+}
+function withPolicyFlags(cmd, negatable = false) {
+  cmd.option("--blacklist <on|off>", "Deny holders on the issuer blacklist").option("--allowlist <mode>", `Issuer allowlist: ${ALLOWLIST_MODES.join(" | ")}`).option("--sas-credential <pubkey>", "Require a SAS attestation under this credential...").option("--sas-schema <pubkey>", "...and this schema (nonce = the holder's wallet)").option("--min-kyc <n>", "Minimum kyc_level (the attestation's first byte); 0 = any");
+  if (negatable) cmd.option("--no-sas", "Turn the SAS requirement off");
+  return cmd;
+}
+var pk = (v, flag) => {
+  if (typeof v !== "string") throw new Error(`${flag} is required`);
+  return new import_web32.PublicKey(v);
+};
+function u64Arg(v, flag) {
+  if (typeof v !== "string" || !/^\d+$/.test(v)) throw new Error(`${flag} takes a whole number, not ${String(v)}`);
+  const n = new import_anchor2.BN(v);
+  if (n.bitLength() > 64) throw new Error(`${flag} is larger than a u64`);
+  return n;
+}
+function explanationOut(e, verbose) {
+  return {
+    mint: e.mint.toBase58(),
+    wallet: e.wallet.toBase58(),
+    tokenAccount: e.tokenAccount.toBase58(),
+    account: e.account,
+    status: e.status,
+    code: e.code,
+    reason: e.reason,
+    simulated: e.simulated,
+    gatingProgram: e.gatingProgram?.toBase58() ?? null,
+    ...verbose ? { logs: e.logs } : {}
+  };
+}
+function policyOut(p) {
+  return {
+    policy: p.address.toBase58(),
+    authority: p.authority.toBase58(),
+    issuerProgram: p.issuerProgram.toBase58(),
+    checkBlacklist: p.checkBlacklist,
+    allowlistMode: p.allowlistMode,
+    requireSas: p.requireSas,
+    sasCredential: p.requireSas ? p.sasCredential.toBase58() : null,
+    sasSchema: p.requireSas ? p.sasSchema.toBase58() : null,
+    minKycLevel: p.minKycLevel
+  };
+}
+function registerGateCommands(program2) {
+  const ctx = () => createClient(program2.opts());
+  const verbose = () => Boolean(program2.opts().verbose);
+  withPolicyFlags(
+    program2.command("create-stablecoin").description("Create an SSS-ACL stablecoin gated by ThawGate: initialize, enable_token_acl, minter role and reserves (3 txs)").requiredOption("--name <name>", "Name (max 32 chars)").requiredOption("--symbol <symbol>", "Symbol (max 10 chars)").option("--uri <uri>", "Metadata URI", "").option("--decimals <n>", "Decimals", "6").requiredOption("--reserves <amount>", "Reserves to post now, in base units (the supply can't exceed them)").requiredOption("--report-uri <uri>", "Link to the reserve report (max 200 bytes)").option("--max-staleness <seconds>", "Minting stops when the last reserve post is older than this", "86400").option("--attestor <pubkey>", "Who posts reserves (default: you, and you post --reserves now)")
+  ).action(async (opts) => {
+    const { client, logger } = ctx();
+    const policy2 = policyFromFlags(opts);
+    logger.info(`Creating ${opts.symbol} (SSS-ACL, gated by ThawGate)`);
+    const created = await client.createStablecoin({
+      name: opts.name,
+      symbol: opts.symbol,
+      uri: opts.uri,
+      decimals: Number(opts.decimals),
+      policy: policy2,
+      reserves: {
+        amount: opts.reserves,
+        reportUri: opts.reportUri,
+        maxStalenessSeconds: Number(opts.maxStaleness),
+        attestor: opts.attestor ? pk(opts.attestor, "--attestor") : void 0
+      }
+    });
+    logger.output({ mint: created.mint.toBase58(), ...created.signatures });
+  });
+  withPolicyFlags(
+    program2.command("enable-token-acl").description("sss-token enable_token_acl on an Acl-mode mint: Token ACL config + ThawGate policy (MasterAuthority)").requiredOption("--mint <pubkey>", "Mint address")
+  ).action(async (opts) => {
+    const { client, logger } = ctx();
+    const sig = await client.send(await client.enableTokenAcl(pk(opts.mint, "--mint"), policyFromFlags(opts)));
+    logger.output({ signature: sig });
+  });
+  const policy = program2.command("policy").description("A mint's ThawGate policy");
+  policy.command("show").description("Show the policy and the mint's Token ACL config").requiredOption("--mint <pubkey>", "Mint address").action(async (opts) => {
+    const { client, logger } = ctx();
+    const mint = pk(opts.mint, "--mint");
+    const [p, config2] = await Promise.all([client.gate.getPolicy(mint), client.gate.getMintConfig(mint)]);
+    logger.output({
+      mint: mint.toBase58(),
+      gatingProgram: config2?.gatingProgram.toBase58() ?? null,
+      freezeAuthority: config2?.freezeAuthority.toBase58() ?? null,
+      permissionlessThaw: config2?.enablePermissionlessThaw ?? null,
+      permissionlessFreeze: config2?.enablePermissionlessFreeze ?? null,
+      ...p ? policyOut(p) : { policy: null }
+    });
+  });
+  withPolicyFlags(
+    policy.command("init").description("Create the policy of a Token ACL mint whose freeze authority is your key (sss-token mints: enable-token-acl)").requiredOption("--mint <pubkey>", "Mint address").option("--authority <pubkey>", "Policy admin (default: you)")
+  ).action(async (opts) => {
+    const { client, logger } = ctx();
+    const input = policyFromFlags(opts);
+    if (opts.authority) input.authority = pk(opts.authority, "--authority");
+    const sig = await client.send(await client.gate.initPolicy(pk(opts.mint, "--mint"), input));
+    logger.output({ signature: sig });
+  });
+  withPolicyFlags(
+    policy.command("update").description("Change the policy (only the flags given) and rewrite its extra metas; holders who no longer comply become freezable").requiredOption("--mint <pubkey>", "Mint address"),
+    true
+  ).action(async (opts) => {
+    const { client, logger } = ctx();
+    const mint = pk(opts.mint, "--mint");
+    const changes = policyFromFlags(opts, await client.gate.getPolicy(mint));
+    const sig = await client.send(await client.gate.updatePolicy(mint, changes));
+    logger.output({ signature: sig, ...policyOut(await client.gate.getPolicy(mint)) });
+  });
+  policy.command("setup-extra-metas").description("Rewrite both extra-metas lists from the stored policy (idempotent)").requiredOption("--mint <pubkey>", "Mint address").action(async (opts) => {
+    const { client, logger } = ctx();
+    const sig = await client.send(await client.gate.setupExtraMetas(pk(opts.mint, "--mint")));
+    logger.output({ signature: sig });
+  });
+  withPolicyFlags(
+    program2.command("swap-gate").description("Move an existing Token ACL mint to ThawGate in one tx: policy, set_gating_program, toggles, token_acl metadata").requiredOption("--mint <pubkey>", "Mint address (its Token ACL freeze authority is your key)").option("--skip-metadata", "Leave the mint's token_acl metadata field as it is").option("--confirm", "Confirm: holders are judged by the new policy from this transaction on")
+  ).action(async (opts) => {
+    const mint = pk(opts.mint, "--mint");
+    if (!opts.confirm) {
+      console.error(`ERROR: swap-gate changes who may hold this token.
+Re-run with --confirm:
+  thawgate swap-gate --mint ${mint.toBase58()} ... --confirm`);
+      process.exit(1);
+    }
+    const { client, logger } = ctx();
+    const ixs = await client.gate.swapGate(mint, policyFromFlags(opts), { skipMetadata: Boolean(opts.skipMetadata) });
+    const sig = await client.send(ixs);
+    logger.output({ signature: sig, instructions: ixs.length });
+  });
+  program2.command("explain").description("Why may (or can't) this wallet hold the token? Simulates the thaw (or the freeze, if thawed); sends nothing").requiredOption("--mint <pubkey>", "Mint address").requiredOption("--wallet <pubkey>", "Holder wallet").option("--token-account <pubkey>", "A token account of the wallet (default: its associated token account)").action(async (opts) => {
+    const { client, logger } = ctx();
+    const tokenAccount = opts.tokenAccount ? pk(opts.tokenAccount, "--token-account") : void 0;
+    const e = await client.gate.explain(pk(opts.mint, "--mint"), pk(opts.wallet, "--wallet"), { tokenAccount });
+    logger.output(explanationOut(e, verbose()));
+  });
+  program2.command("unlock").description("Create the owner's associated token account if needed and thaw it through the gate (you pay; the owner signs nothing)").requiredOption("--mint <pubkey>", "Mint address").option("--owner <pubkey>", "Holder wallet (default: you)").action(async (opts) => {
+    const { client, keypair, logger } = ctx();
+    const mint = pk(opts.mint, "--mint");
+    const owner = opts.owner ? pk(opts.owner, "--owner") : keypair.publicKey;
+    const e = await client.gate.explain(mint, owner);
+    if (e.account === "thawed") {
+      logger.output({ status: "already_unlocked", tokenAccount: e.tokenAccount.toBase58(), reason: e.reason });
+      return;
+    }
+    if (e.status !== "can_unlock") {
+      logger.output({ status: e.status, code: e.code, reason: e.reason });
+      process.exitCode = 1;
+      return;
+    }
+    const sig = await client.send(await client.gate.createAtaAndThaw(mint, owner));
+    logger.output({ status: "unlocked", tokenAccount: e.tokenAccount.toBase58(), signature: sig, reason: e.reason });
+  });
+  program2.command("freeze-if-invalid").description("Freeze a token account permissionlessly if the policy flags its owner; sends nothing if it complies").requiredOption("--token-account <pubkey>", "Token account").action(async (opts) => {
+    const { client, logger } = ctx();
+    const r = await client.gate.freezeIfInvalid(pk(opts.tokenAccount, "--token-account"));
+    logger.output({ ...r, signature: r.signature ?? null });
+  });
+  const sasCmd = program2.command("sas").description("Solana Attestation Service: credentials, the KYC schema, attestations");
+  sasCmd.command("create-credential").description("Create a SAS credential you issue under (a self-issued test credential)").requiredOption("--name <name>", "Credential name (1-32 bytes)").option("--signer <pubkey...>", "Keys that may attest (default: you)").action(async (opts) => {
+    const { client, keypair, logger } = ctx();
+    const signers = opts.signer?.map((s) => new import_web32.PublicKey(s));
+    const { instruction, credential } = import_sdk2.sas.createCredentialIx({ payer: keypair.publicKey, authority: keypair.publicKey, name: opts.name, signers });
+    const sig = await client.send([instruction]);
+    logger.output({ credential: credential.toBase58(), signature: sig });
+  });
+  sasCmd.command("create-schema").description("Create the KYC schema ThawGate reads (kyc_level: u8, country: String) under your credential").requiredOption("--credential <pubkey>", "Credential").requiredOption("--name <name>", "Schema name (1-32 bytes)").option("--description <text>", "Description", "KYC level and country (ThawGate)").action(async (opts) => {
+    const { client, keypair, logger } = ctx();
+    const { instruction, schema } = import_sdk2.sas.createSchemaIx({
+      payer: keypair.publicKey,
+      authority: keypair.publicKey,
+      credential: pk(opts.credential, "--credential"),
+      name: opts.name,
+      description: opts.description,
+      layout: [...import_sdk2.sas.KYC_SCHEMA.layout],
+      fieldNames: [...import_sdk2.sas.KYC_SCHEMA.fieldNames]
+    });
+    const sig = await client.send([instruction]);
+    logger.output({ schema: schema.toBase58(), signature: sig });
+  });
+  sasCmd.command("attest").description("Attest a wallet's KYC (nonce = the wallet), as a signer of the credential").requiredOption("--credential <pubkey>", "Credential").requiredOption("--schema <pubkey>", "Schema (the KYC layout)").requiredOption("--wallet <pubkey>", "Holder wallet").requiredOption("--kyc-level <n>", "kyc_level, 0-255").option("--country <code>", "Country", "IN").option("--expiry-days <days>", "Days until it expires; 0 = never", "365").action(async (opts) => {
+    const { client, keypair, logger } = ctx();
+    const days = Number(opts.expiryDays);
+    const expiry = days === 0 ? 0 : await client.clusterTime() + Math.round(days * 86400);
+    const { instruction, attestation } = import_sdk2.sas.createAttestationIx({
+      payer: keypair.publicKey,
+      authority: keypair.publicKey,
+      credential: pk(opts.credential, "--credential"),
+      schema: pk(opts.schema, "--schema"),
+      nonce: pk(opts.wallet, "--wallet"),
+      data: import_sdk2.sas.encodeKycData({ kycLevel: Number(opts.kycLevel), country: opts.country }),
+      expiry
+    });
+    const sig = await client.send([instruction]);
+    logger.output({ attestation: attestation.toBase58(), expiry, signature: sig });
+  });
+  sasCmd.command("revoke").description("Close a wallet's attestation; under a SAS policy its accounts become freezable").requiredOption("--credential <pubkey>", "Credential").requiredOption("--schema <pubkey>", "Schema").requiredOption("--wallet <pubkey>", "Holder wallet").action(async (opts) => {
+    const { client, keypair, logger } = ctx();
+    const credential = pk(opts.credential, "--credential");
+    const attestation = import_sdk2.sas.findAttestationPda(credential, pk(opts.schema, "--schema"), pk(opts.wallet, "--wallet"));
+    const sig = await client.send([import_sdk2.sas.closeAttestationIx({ payer: keypair.publicKey, authority: keypair.publicKey, credential, attestation })]);
+    logger.output({ attestation: attestation.toBase58(), signature: sig });
+  });
+  const allowlist = program2.command("allowlist").description("The sss-token issuer allowlist (MasterAuthority)");
+  for (const [name, add] of [["add", true], ["remove", false]]) {
+    allowlist.command(name).description(add ? "Add a wallet to the allowlist" : "Deactivate a wallet's allowlist entry").requiredOption("--mint <pubkey>", "Mint address").requiredOption("--wallet <pubkey>", "Wallet").action(async (opts) => {
+      const { client, keypair, logger } = ctx();
+      const compliance = client.compliance(pk(opts.mint, "--mint"));
+      const wallet = pk(opts.wallet, "--wallet");
+      const ixs = add ? await compliance.addToAllowlist(keypair.publicKey, wallet) : await compliance.removeFromAllowlist(keypair.publicKey, wallet);
+      logger.output({ signature: await client.send(ixs) });
+    });
+  }
+  const reservesCmd = program2.command("reserves").description("A mint's reserve attestation: mint_tokens refuses supply past it");
+  reservesCmd.command("post").description("Post the mint's reserves as its attestor (--keypair). Minting may rely on them until as-of + max staleness").requiredOption("--mint <pubkey>", "Mint address").requiredOption("--amount <base units>", "Reserves in the mint's base units (1.00 of a 6-decimal coin = 1000000)").option("--report-uri <uri>", "Link to the reserve report, max 200 bytes (default: the one posted last)").option("--as-of <unix seconds>", "When the reserves were measured (default: the cluster's time now)").action(async (opts) => {
+    const { client, keypair, logger } = ctx();
+    const mint = pk(opts.mint, "--mint");
+    const amount = u64Arg(opts.amount, "--amount");
+    const reserves = client.reserves(mint);
+    const current = await reserves.fetch();
+    if (!current) throw new Error(`${mint.toBase58()} has no reserve attestation: its MasterAuthority sets the attestor first (set_reserve_attestor)`);
+    if (!current.attestor.equals(keypair.publicKey)) {
+      throw new Error(`only the mint's attestor ${current.attestor.toBase58()} can post its reserves (--keypair is ${keypair.publicKey.toBase58()})`);
+    }
+    const asOf = opts.asOf !== void 0 ? u64Arg(opts.asOf, "--as-of").toNumber() : await client.clusterTime();
+    if (asOf < current.asOf.toNumber()) throw new Error(`--as-of ${asOf} is older than the posted as_of ${current.asOf.toString()}`);
+    const reportUri = opts.reportUri ?? current.reportUri;
+    const signature = await client.send(await reserves.attestReserves(keypair.publicKey, amount, asOf, reportUri));
+    const freshUntil = asOf + current.maxStaleness.toNumber();
+    logger.output({
+      signature,
+      mint: mint.toBase58(),
+      attestor: keypair.publicKey.toBase58(),
+      reserves: amount.toString(),
+      asOf,
+      freshUntil,
+      freshUntilUtc: new Date(freshUntil * 1e3).toISOString(),
+      reportUri
+    });
+  });
+}
+
+// src/index.ts
+var program = new import_commander.Command();
+program.name("thawgate").description("ThawGate CLI: Token ACL gate policies, SSS-ACL stablecoins and SAS credentials (devnet IDs by default)").version("0.1.0").option("--rpc-url <url>", "Solana RPC endpoint URL (or SSS_RPC_URL; default devnet)").option("--commitment <level>", "Commitment level", "confirmed").option("--keypair <path>", "Path to keypair file (or SSS_KEYPAIR_PATH; default ~/.config/solana/id.json)").option("--json", "Output in JSON format (progress lines go to stderr)").option("--verbose", "Enable verbose logging");
+registerGateCommands(program);
+registerCommands(program);
+program.parseAsync(process.argv).catch((err) => {
+  console.error("Error:", err.message);
+  const logs = err?.logs ?? err?.transactionLogs;
+  const decision = logs ? (0, import_sdk3.parseGateLogs)(logs).decision : null;
+  if (decision) console.error(`Gate: TG:${decision.kind}:${decision.code}`);
+  if (logs && program.opts().verbose) console.error(logs.join("\n"));
+  process.exit(1);
+});
+//# sourceMappingURL=index.js.map