@thetanuts-finance/odette-cli 0.0.0-stage → 0.1.1

package/dist/config.js

@@ -0,0 +1,146 @@
+// Adapted from thetanuts-sdk cli/src/config.ts at 9e72aef1ab5c008ccc92352fa5048bd08c452ede.
+// MIT License, Copyright (c) 2026 Thetanuts Finance.
+// Changes: path ~/.config/odette; no referrer or rfqKeysDir fields; a config
+// that holds a `referrer` key is an error (exit 4), not ignored. `--dry-run`
+// never writes or deletes the file (stopForDryRun). saveConfig chmods the
+// directory only when it created it.
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { randomBytes } from 'node:crypto';
+/**
+ * `--dry-run` never writes or deletes the config file. Every command that
+ * changes it calls this first and returns when it gives true. Upstream checked
+ * dry-run only inside confirm(), which `--force` skips: `wallet create --force
+ * --dry-run` replaced the key and `config unset privateKey --dry-run` deleted it.
+ * Output goes to stderr so `-o json` stdout stays empty.
+ */
+export function stopForDryRun(dryRun, action, configPath) {
+    if (!dryRun)
+        return false;
+    process.stderr.write(`Dry-run: ${action} would change ${configPath}. Nothing was written.\n`);
+    return true;
+}
+/** Thrown for a config file the CLI must not use. Commands exit with `exitCode` (4). */
+export class ConfigError extends Error {
+    exitCode = 4;
+}
+export function defaultConfigPath() {
+    // Honor XDG_CONFIG_HOME if set, else ~/.config.
+    const xdg = process.env.XDG_CONFIG_HOME;
+    const base = xdg && xdg.length > 0 ? xdg : path.join(os.homedir(), '.config');
+    return path.join(base, 'odette', 'config.json');
+}
+export function loadConfig(configPath) {
+    const p = configPath ?? defaultConfigPath();
+    if (!fs.existsSync(p))
+        return null;
+    // Open with O_NOFOLLOW so a pre-planted symlink cannot redirect the read to
+    // an attacker-controlled path (TNU-AUDIT-0078). O_NOFOLLOW is unsupported
+    // on Windows — fall back to the previous read path there.
+    let raw;
+    if (process.platform !== 'win32') {
+        const NOFOLLOW = fs.constants.O_NOFOLLOW;
+        if (typeof NOFOLLOW === 'number') {
+            const fd = fs.openSync(p, fs.constants.O_RDONLY | NOFOLLOW);
+            try {
+                raw = fs.readFileSync(fd, 'utf8');
+            }
+            finally {
+                fs.closeSync(fd);
+            }
+        }
+        else {
+            raw = fs.readFileSync(p, 'utf8');
+        }
+    }
+    else {
+        raw = fs.readFileSync(p, 'utf8');
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new ConfigError(`Config file ${p} is not valid JSON. Fix it, or run \`odette setup\`.`);
+    }
+    // The Odette referrer is a constant. A `referrer` key means the file was
+    // written for another tool (or edited by hand); refuse it rather than
+    // silently ignore an address the user thinks is in effect.
+    if (parsed !== null && typeof parsed === 'object' && 'referrer' in parsed) {
+        throw new ConfigError(`Config file ${p} has a "referrer" key. The Odette referrer is fixed and cannot be configured. Remove the key.`);
+    }
+    // Auto-tighten loose perms rather than just warning to stderr — CI piping
+    // stderr to /dev/null silently swallowed the warning (TNU-AUDIT-0079).
+    if (process.platform !== 'win32') {
+        try {
+            const stat = fs.statSync(p);
+            if ((stat.mode & 0o077) !== 0) {
+                const oct = (stat.mode & 0o777).toString(8);
+                try {
+                    fs.chmodSync(p, 0o600);
+                    process.stderr.write(`notice: tightened ${p} from mode ${oct} → 600 (was world/group-readable).\n`);
+                }
+                catch {
+                    // chmod may fail on non-owned file or unusual FS — keep the warning.
+                    process.stderr.write(`warning: ${p} has loose permissions (mode ${oct}); run 'chmod 600 <path>' to tighten\n`);
+                }
+            }
+        }
+        catch {
+            // best-effort; never block load on a stat failure
+        }
+    }
+    return parsed;
+}
+export function saveConfig(cfg, configPath) {
+    const p = configPath ?? defaultConfigPath();
+    const dir = path.dirname(p);
+    // Tighten the directory only when we create it: `--config ./config.json`
+    // must not chmod the user's current directory (upstream chmod'ed any parent).
+    const createdDir = !fs.existsSync(dir);
+    if (createdDir) {
+        fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    }
+    // Write atomically: temp file in the same directory, then rename(2).
+    //
+    // `wallet create` discards the BIP-39 mnemonic and tells the user this file
+    // is now the ONLY copy of their key. A crash, SIGINT, or ENOSPC partway
+    // through an in-place writeFileSync would leave a truncated config and
+    // permanently destroy that key. rename(2) within a filesystem is atomic, so
+    // a reader sees either the old file or the new one — never a partial write.
+    //
+    // Writing to a fresh temp path also means we never follow a symlink planted
+    // at `p`: rename replaces the link itself rather than writing through it,
+    // which closes the write-side gap left by the O_NOFOLLOW read in loadConfig.
+    const tempPath = `${p}.${randomBytes(8).toString('hex')}.tmp`;
+    try {
+        fs.writeFileSync(tempPath, JSON.stringify(cfg, null, 2) + '\n', { mode: 0o600 });
+        // `mode` on writeFileSync is honored only at creation and is masked by
+        // umask. Force it before the rename so the key is never briefly readable.
+        try {
+            fs.chmodSync(tempPath, 0o600);
+        }
+        catch {
+            // ignore (Windows / unsupported FS)
+        }
+        fs.renameSync(tempPath, p);
+    }
+    catch (err) {
+        try {
+            fs.unlinkSync(tempPath);
+        }
+        catch {
+            // ignore cleanup errors — the original file is still intact
+        }
+        throw err;
+    }
+    if (createdDir) {
+        try {
+            fs.chmodSync(dir, 0o700);
+        }
+        catch {
+            // ignore (Windows / unsupported FS)
+        }
+    }
+}

package/dist/confirm.js

@@ -0,0 +1,39 @@
+// Adapted from thetanuts-sdk cli/src/confirm.ts at 9e72aef1ab5c008ccc92352fa5048bd08c452ede.
+// MIT License, Copyright (c) 2026 Thetanuts Finance.
+import prompts from 'prompts';
+/**
+ * Ask the user to confirm a write operation.
+ *
+ * Returns:
+ *   - `true`  → proceed
+ *   - `false` → abort (caller should `process.exit(3)` to signal user cancel)
+ *
+ * Semantics (precedence order — money is on the line, safer behavior wins):
+ *   - `--dry-run` ALWAYS wins. If set, prints "Dry-run: aborted" and returns
+ *     `false` without prompting, even when `--yes` is also passed. This is
+ *     defense-in-depth: if any caller forgets to short-circuit on `dryRun`
+ *     upstream and falls through to `confirm()`, we must not broadcast.
+ *   - `--yes` short-circuits to `true` only when `--dry-run` is absent.
+ *   - Otherwise prompts via `prompts` with the supplied message.
+ *   - If stdin is not a TTY and no `--yes`, returns `false` (we never block
+ *     non-interactive sessions on a prompt that nobody can answer).
+ */
+export async function confirm(message, opts = {}) {
+    if (opts.dryRun) {
+        process.stderr.write('Dry-run: aborted\n');
+        return false;
+    }
+    if (opts.yes)
+        return true;
+    if (!process.stdin.isTTY) {
+        process.stderr.write('Refusing to prompt for confirmation on a non-TTY stdin. Re-run with --yes to bypass.\n');
+        return false;
+    }
+    const response = await prompts({
+        type: 'confirm',
+        name: 'ok',
+        message,
+        initial: false,
+    });
+    return Boolean(response.ok);
+}

package/dist/defaults.js

@@ -0,0 +1,17 @@
+// Adapted from thetanuts-sdk cli/src/defaults.ts at 9e72aef1ab5c008ccc92352fa5048bd08c452ede.
+// MIT License, Copyright (c) 2026 Thetanuts Finance.
+// Changes: comments.
+/**
+ * Single source of truth for CLI defaults. Bump these here, not at call sites.
+ *
+ * The CLI is Base-only by design (chainId 8453). Keep this aligned with the
+ * SDK (`@thetanuts-finance/odette-sdk`) — see `src/chain.ts` there for
+ * addresses and tokens.
+ *
+ * The default RPC is PUBLIC and shared — fine for read-only smoke and
+ * onboarding, but will rate-limit under load. Users should override via
+ * ODETTE_RPC_URL or `odette config set rpcUrl <url>` for any serious
+ * usage.
+ */
+export const DEFAULT_CHAIN_ID = 8453; // Base mainnet
+export const DEFAULT_RPC_URL = 'https://mainnet.base.org';

package/dist/format.js

@@ -0,0 +1,130 @@
+// Adapted from thetanuts-sdk cli/src/format.ts at 9e72aef1ab5c008ccc92352fa5048bd08c452ede.
+// MIT License, Copyright (c) 2026 Thetanuts Finance.
+/**
+ * Shared formatting helpers for humanized CLI output.
+ *
+ * These render values for table-mode display only; JSON/CSV/YAML output paths
+ * must continue to emit the raw bigint strings the SDK returns so that
+ * scripting consumers stay byte-stable across patch releases.
+ *
+ * Centralized here (not inlined per-command) so `book` and `rfq` agree on the
+ * exact ticker string and money formatting — users compare them across
+ * commands and any drift is confusing.
+ */
+const MONTHS = [
+    'JAN',
+    'FEB',
+    'MAR',
+    'APR',
+    'MAY',
+    'JUN',
+    'JUL',
+    'AUG',
+    'SEP',
+    'OCT',
+    'NOV',
+    'DEC',
+];
+/**
+ * Format an option ticker in the dApp-canonical style:
+ *   ETH-19MAY26-2100-P
+ *   ETH-19MAY26-2050/2100-P  (multi-leg)
+ * `strikesUsd` are USD floats (already divided by 1e8 if you started from raw).
+ */
+export function formatTicker(underlying, expirySec, strikesUsd, type) {
+    const d = new Date(expirySec * 1000);
+    const day = d.getUTCDate();
+    const month = MONTHS[d.getUTCMonth()];
+    const year = d.getUTCFullYear().toString().slice(-2);
+    const strikeStr = strikesUsd.length === 1 ? `${strikesUsd[0]}` : strikesUsd.join('/');
+    return `${underlying}-${day}${month}${year}-${strikeStr}-${type === 'PUT' ? 'P' : 'C'}`;
+}
+/**
+ * Render a strike (or comma-separated multi-leg strikes) in `$2100` form.
+ * Inputs are USD floats.
+ */
+export function formatStrikeUsd(strikesUsd) {
+    if (strikesUsd.length === 0)
+        return '';
+    if (strikesUsd.length === 1)
+        return `$${formatNumber(strikesUsd[0])}`;
+    return strikesUsd.map((s) => `$${formatNumber(s)}`).join(',');
+}
+/**
+ * Render a USD dollar amount with up to 2 decimals and thousands separators.
+ * Used for premium / available / collateral surfacing in table mode.
+ */
+export function formatUsd(amount, maxFractionDigits = 2) {
+    return `$${formatNumber(amount, maxFractionDigits)}`;
+}
+function formatNumber(n, maxFractionDigits = 2) {
+    // Drop trailing zeros: $2100 not $2,100.00 for clean strikes, but $1.77
+    // still renders.
+    const opts = {
+        minimumFractionDigits: 0,
+        maximumFractionDigits: maxFractionDigits,
+    };
+    return new Intl.NumberFormat('en-US', opts).format(n);
+}
+/**
+ * Format an expiry timestamp as `<unix> (<iso-date>)`. ISO is UTC-trimmed to
+ * minutes — the seconds are always zero for option expiries and the user
+ * rarely cares about exact-second granularity at the orderbook level.
+ */
+export function formatExpiry(expirySec) {
+    const d = new Date(expirySec * 1000);
+    const iso = d.toISOString().slice(0, 16) + 'Z'; // YYYY-MM-DDTHH:mmZ
+    return `${expirySec} (${iso})`;
+}
+/**
+ * Reverse-lookup helper: given a token address and a chain config tokens map,
+ * return the symbol (USDC, WETH, ...). Returns undefined when unmatched.
+ *
+ * Typed loosely on purpose — different SDK consumer shapes have slightly
+ * different tokens map types; we only need `{ address, ... }`.
+ */
+export function tokenSymbolByAddress(address, tokens) {
+    if (!address)
+        return undefined;
+    const lower = address.toLowerCase();
+    for (const [sym, cfg] of Object.entries(tokens)) {
+        if (cfg.address.toLowerCase() === lower)
+            return sym;
+    }
+    return undefined;
+}
+/**
+ * Reverse-lookup helper: given a price-feed address and a price-feeds map
+ * (symbol -> feed address), return the underlying symbol ('ETH', 'BTC', ...).
+ */
+export function underlyingSymbolByPriceFeed(priceFeed, priceFeeds) {
+    if (!priceFeed)
+        return undefined;
+    const lower = priceFeed.toLowerCase();
+    for (const [sym, addr] of Object.entries(priceFeeds)) {
+        if (addr.toLowerCase() === lower)
+            return sym;
+    }
+    return undefined;
+}
+/**
+ * Ticker for a structure (spread / fly / condor / ranger). Multi-leg orders
+ * must never render with a bare `-C` / `-P` suffix: `book check` used to label
+ * a 4-strike RANGER `ETH-28AUG26-2150-C`, which reads as a vanilla call and
+ * misled callers into pricing it as one.
+ *
+ * Falls back to `formatTicker` for single-leg orders, or when the structure
+ * name is unknown (an implementation address absent from chain config).
+ * Strikes are rendered in the order the order stores them — that same order is
+ * what `book preview --strikes` expects back.
+ */
+export function formatStructureTicker(underlying, expirySec, strikesUsd, type, structureName) {
+    if (strikesUsd.length <= 1 || !structureName) {
+        return formatTicker(underlying, expirySec, strikesUsd, type);
+    }
+    const d = new Date(expirySec * 1000);
+    const day = d.getUTCDate();
+    const month = MONTHS[d.getUTCMonth()];
+    const year = d.getUTCFullYear().toString().slice(-2);
+    return `${underlying}-${day}${month}${year}-${strikesUsd.join('/')}-${structureName}`;
+}

package/dist/index.js

@@ -0,0 +1,84 @@
+#!/usr/bin/env node
+// Adapted from thetanuts-sdk cli/src/index.ts at 9e72aef1ab5c008ccc92352fa5048bd08c452ede.
+// MIT License, Copyright (c) 2026 Thetanuts Finance.
+// Changes: name and description. The fallback error print is redacted.
+import { Command } from 'commander';
+import { createRequire } from 'node:module';
+import { registerCommands } from './commands/registry.js';
+import { addGlobalOptions } from './options.js';
+import { renderError, redactSecrets } from './output.js';
+// Resolve the CLI version from package.json at runtime so bumping
+// `cli/package.json` is the only edit needed for a release. `createRequire`
+// keeps package.json outside the TypeScript `rootDir` (./src) while still
+// resolving relative to either `cli/src/index.ts` (dev via tsx) or
+// `cli/dist/index.js` (production bin) — both reach `cli/package.json`.
+const requireFromHere = createRequire(import.meta.url);
+const pkg = requireFromHere('../package.json');
+// Exit cleanly when downstream (e.g. `| head`) closes the pipe early.
+process.stdout.on('error', (err) => {
+    if (err.code === 'EPIPE')
+        process.exit(0);
+    throw err;
+});
+const program = new Command();
+program
+    .name('odette')
+    .description('Odette command-line interface: trade Odette orders on the Thetanuts OptionBook (Base)')
+    .version(pkg.version);
+// Global flags live on the root command, so `odette fill --help`
+// would not list `--dry-run` / `--output` at all — making a
+// present flag look missing from the help path people actually use.
+program.configureHelp({ showGlobalOptions: true });
+addGlobalOptions(program);
+registerCommands(program);
+// Commander exits 1 for every parse failure, but the CLI documents exit 2 as
+// "usage error (bad flags, missing required arg)" and reserves 1 for generic
+// runtime failures — network, RPC, contract revert. Without this mapping,
+// automation cannot tell a typo'd flag apart from a reverted transaction.
+//
+// The set is Commander's own error codes for input the user got wrong. Anything
+// unrecognised keeps Commander's exit code rather than being coerced, so a new
+// error code in a future Commander release fails visibly instead of silently
+// reporting itself as a usage error.
+const USAGE_ERROR_CODES = new Set([
+    'commander.missingArgument',
+    'commander.missingMandatoryOptionValue',
+    'commander.optionMissingArgument',
+    'commander.unknownOption',
+    'commander.unknownCommand',
+    'commander.invalidArgument',
+    'commander.excessArguments',
+    'commander.conflictingOption',
+    // A group command invoked with no subcommand (`odette wallet`, or bare
+    // `odette`) prints help via help({ error: true }), which throws
+    // `commander.help` with exitCode 1. That is an incomplete command — a usage
+    // error by the README's own definition — not a runtime failure. Safe to map
+    // here because successful `--help` uses the distinct `commander.helpDisplayed`
+    // code with exitCode 0, which the guard below returns on before reaching this.
+    'commander.help',
+]);
+// exitOverride is per-Command and is NOT inherited by subcommands, so walk the
+// whole tree — `odette wallet approve` is a grandchild of the root command.
+function mapUsageExitCodes(cmd) {
+    cmd.exitOverride((err) => {
+        // --help and --version are successful terminations, not failures.
+        if (err.exitCode === 0)
+            process.exit(0);
+        process.exit(USAGE_ERROR_CODES.has(err.code) ? 2 : err.exitCode);
+    });
+    for (const sub of cmd.commands)
+        mapUsageExitCodes(sub);
+}
+mapUsageExitCodes(program);
+program.parseAsync(process.argv).catch((err) => {
+    // Try to use the structured error renderer if we can detect --json-errors,
+    // otherwise print just the message — never the stack
+    const jsonErrors = process.argv.includes('--json-errors');
+    try {
+        renderError(err, { jsonErrors });
+    }
+    catch {
+        process.stderr.write(redactSecrets(err?.message ?? String(err)) + '\n');
+    }
+    process.exit(1);
+});

package/dist/options.js

@@ -0,0 +1,50 @@
+// Adapted from thetanuts-sdk cli/src/options.ts at 9e72aef1ab5c008ccc92352fa5048bd08c452ede.
+// MIT License, Copyright (c) 2026 Thetanuts Finance.
+// Changes: --chain dropped (Base only); --referrer dropped (the Odette referrer is fixed);
+// --private-key dropped (keys come from ODETTE_PRIVATE_KEY or the 0600 config only);
+// env var and path names. --output accepts only its listed formats.
+import { Option } from 'commander';
+/**
+ * Global option spec for the root `odette` command.
+ * implementer agents extend per-command options but should NOT add new global
+ * flags without coordination.
+ *
+ * Note: commander emits `--no-color` automatically as the negation of
+ * `--color` (default true). We declare it that way so users still see
+ * `--no-color` in `--help`.
+ */
+export function addGlobalOptions(program) {
+    program
+        .addOption(new Option('-o, --output <fmt>', 'output format').choices(['table', 'json', 'csv', 'yaml']).default('table'))
+        .option('--dry-run', 'simulate without sending transactions', false)
+        .option('--yes', 'skip interactive confirmation prompts', false)
+        .option('--rpc-url <url>', 'override the RPC endpoint for the active chain')
+        .option('--config <path>', 'path to a config file (default: ~/.config/odette/config.json)')
+        .option('--json-errors', 'emit errors as JSON on stderr', false)
+        .option('--color', 'enable ANSI color output', true)
+        .option('--no-color', 'disable ANSI color output');
+}
+/**
+ * Walk up `cmd.parent` to collect options from every ancestor command, so a
+ * subcommand action can read both its own opts and the root global opts.
+ *
+ * Commander does this implicitly with `inheritedOptionValues`, but we wrap it
+ * here so implementer code has a single helper to reach for and a clearer
+ * call site.
+ */
+export function getGlobalOpts(cmd) {
+    // commander supports cmd.optsWithGlobals() in v12; prefer that when
+    // available, fall back to manual ancestor walk otherwise.
+    const withGlobals = cmd
+        .optsWithGlobals;
+    if (typeof withGlobals === 'function') {
+        return withGlobals.call(cmd);
+    }
+    const merged = {};
+    let cursor = cmd;
+    while (cursor) {
+        Object.assign(merged, cursor.opts());
+        cursor = cursor.parent;
+    }
+    return merged;
+}