@wenrwa/marketplace-cli 0.5.23 → 0.6.2

package/dist/commands/auth.js

@@ -1,37 +1,129 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.authCommand = void 0;
+/**
+ * wha-08 (docs/prd/retire-wallet-header-auth.md, docs/CONTEXT-identity.md) —
+ * `wen-market auth login` / `auth logout` / `auth whoami`.
+ *
+ * `login` runs the device-code flow (lws-14's mechanism, purpose=cli_login —
+ * see auth/login.ts): a code is minted and printed with the approval URL
+ * (https://marketplace.wenrwa.com/settings/cli-login?code=<CODE>), the
+ * browser is opened as best-effort convenience, and the CLI polls until a
+ * human approves or denies it there. `--api-key` skips all of that for CI:
+ * an existing key is verified with one authenticated call and saved
+ * directly. Either way the CLI authenticates as an API key (X-API-Key) —
+ * never the retired X-Wallet-Pubkey header (see utils/client.ts).
+ *
+ * `logout` revokes the stored key server-side (DELETE /keys/:id — see
+ * ApiKeyController#revoke's wha-08 self-revoke-only guard) before deleting
+ * it locally, so a copied config file stops working too.
+ */
 const commander_1 = require("commander");
+const os = __importStar(require("os"));
 const chalk_1 = __importDefault(require("chalk"));
 const config_1 = require("../utils/config");
+const client_1 = require("../utils/client");
+const apiClient_1 = require("../bridge/apiClient");
+const login_1 = require("../auth/login");
+const identity_1 = require("../auth/identity");
+const prompt_1 = require("../utils/prompt");
+const openBrowser_1 = require("../utils/openBrowser");
+const apiKeyFormat_1 = require("../utils/apiKeyFormat");
 const format_1 = require("../utils/format");
+const WEB_URL = process.env.WENRWA_WEB_URL || 'https://marketplace.wenrwa.com';
+const SETTINGS_KEYS_URL = `${WEB_URL}/settings`;
 exports.authCommand = new commander_1.Command('auth').description('Authentication commands');
 exports.authCommand
     .command('login')
-    .description('Authenticate with the marketplace')
-    .requiredOption('--api-key <key>', 'API key or wallet pubkey')
+    .description('Sign in via your browser, or provide a CI key with --api-key')
+    .option('--api-key <key>', 'Use an existing API key non-interactively (for CI)')
     .option('--api-url <url>', 'Marketplace API URL')
     .action(async (opts) => {
     const apiUrl = opts.apiUrl || (0, config_1.getApiUrl)();
+    const existing = (0, config_1.loadConfig)();
+    if (existing) {
+        const proceed = await confirmReplaceExistingLogin(existing);
+        if (!proceed)
+            return;
+    }
+    if (opts.apiKey) {
+        await loginWithApiKey(opts.apiKey, apiUrl);
+        return;
+    }
+    await runDeviceLogin(apiUrl);
+});
+exports.authCommand
+    .command('logout')
+    .description('Sign out and revoke the stored API key')
+    .action(async () => {
+    const config = (0, config_1.loadConfig)();
+    if (!config) {
+        (0, format_1.info)('Not signed in.');
+        return;
+    }
+    let revokedServerSide = false;
+    let warning = null;
     try {
-        const res = await fetch(`${apiUrl}/agents/${opts.apiKey}`);
-        if (res.ok) {
-            (0, format_1.info)(`Authenticated as agent: ${opts.apiKey}`);
+        const client = (0, client_1.getClient)();
+        const data = await client.get('/keys');
+        const prefix = config.apiKey.slice(0, 16);
+        const match = (data.keys || []).find((k) => k.keyPrefix === prefix);
+        if (match) {
+            await client.del(`/keys/${match.id}`);
+            revokedServerSide = true;
         }
         else {
-            (0, format_1.info)('API key stored (agent not found — may be a poster or new user)');
+            warning = 'Could not find this key on the server (it may already be revoked).';
         }
     }
-    catch {
-        (0, format_1.info)('API key stored (could not reach server — will validate on next request)');
+    catch (err) {
+        warning = `Could not revoke the key on the server: ${err?.message || err}`;
+    }
+    // Local credentials come out regardless of the server outcome — a stale
+    // or unreachable server must never leave the CLI looking "signed in".
+    (0, config_1.clearConfig)();
+    if (revokedServerSide) {
+        console.log(chalk_1.default.green('✓ Signed out. API key revoked.'));
+    }
+    else {
+        (0, format_1.error)(`${warning} Removed the key locally — it may still work server-side until it expires or is revoked another way.`);
     }
-    (0, config_1.saveConfig)({ apiKey: opts.apiKey, apiUrl });
-    (0, format_1.success)(`Logged in. Config saved.`);
-    console.log(`  API URL: ${chalk_1.default.dim(apiUrl)}`);
-    console.log(`  Key:     ${chalk_1.default.dim(opts.apiKey.slice(0, 8))}...`);
 });
 exports.authCommand
     .command('whoami')
@@ -39,25 +131,108 @@ exports.authCommand
     .action(async () => {
     const config = (0, config_1.loadConfig)();
     if (!config) {
-        (0, format_1.error)('Not logged in. Run: wen-market auth login --api-key <key>');
+        (0, format_1.error)('Not signed in. Run: wen-market auth login');
         process.exit(1);
+        return;
     }
     console.log(chalk_1.default.bold('Current session:'));
     console.log(`  API URL: ${config.apiUrl}`);
-    console.log(`  Key:     ${config.apiKey}`);
-    try {
-        const res = await fetch(`${config.apiUrl}/agents/${config.apiKey}`);
-        if (res.ok) {
-            const data = await res.json();
-            const agent = data.agent;
-            if (agent) {
-                console.log(`  Name:    ${agent.name || 'N/A'}`);
-                console.log(`  Status:  ${agent.status || 'active'}`);
-                console.log(`  Rep:     ${agent.weighted_reputation ?? 'N/A'}`);
-            }
-        }
+    console.log(`  Key:     ${(0, apiKeyFormat_1.shortenKey)(config.apiKey)}`);
+    const identity = await (0, identity_1.resolveIdentity)({ apiUrl: config.apiUrl, apiKey: config.apiKey });
+    if (identity.ok) {
+        if (identity.name)
+            console.log(`  Name:    ${identity.name}`);
     }
-    catch {
-        (0, format_1.info)('Could not reach API to verify identity');
+    else {
+        (0, format_1.info)(`Could not verify identity: ${identity.message}`);
     }
 });
+// ── Already-signed-in gate ────────────────────────────────────────────
+async function confirmReplaceExistingLogin(existing) {
+    const label = (0, apiKeyFormat_1.shortenKey)(existing.apiKey);
+    if (!(0, prompt_1.isInteractive)()) {
+        (0, format_1.error)(`Already signed in (${label}). Run this in an interactive terminal to confirm, or \`wen-market auth logout\` first.`);
+        return false;
+    }
+    const yes = await (0, prompt_1.confirm)(`Already signed in as ${label}. Sign in again? (y/N) `, false);
+    if (!yes) {
+        (0, format_1.info)('Cancelled — staying signed in.');
+    }
+    return yes;
+}
+// ── --api-key (CI) path ─────────────────────────────────────────────────
+async function loginWithApiKey(key, apiUrl) {
+    if ((0, apiKeyFormat_1.looksLikeWalletPubkey)(key)) {
+        (0, format_1.error)(`That's a wallet address, not an API key. Run \`wen-market auth login\` or create a key at ${SETTINGS_KEYS_URL}`);
+        process.exit(1);
+        return;
+    }
+    if (!(0, apiKeyFormat_1.isRealApiKey)(key)) {
+        (0, format_1.error)(`Not a valid API key (expected one starting with wm_sk_). Run \`wen-market auth login\` or create a key at ${SETTINGS_KEYS_URL}`);
+        process.exit(1);
+        return;
+    }
+    const identity = await (0, identity_1.resolveIdentity)({ apiUrl, apiKey: key });
+    if (!identity.ok) {
+        (0, format_1.error)(`Could not verify this API key: ${identity.message}`);
+        process.exit(1);
+        return;
+    }
+    (0, config_1.saveConfig)({ apiKey: key, apiUrl });
+    console.log(chalk_1.default.green(`✓ Signed in as ${identity.name || (0, apiKeyFormat_1.shortenKey)(key)}`));
+}
+// ── Browser device flow ─────────────────────────────────────────────────
+async function runDeviceLogin(apiUrl) {
+    let cancelled = false;
+    const onSigint = () => {
+        cancelled = true;
+        console.log(chalk_1.default.yellow('\nCancelling — finishing the in-flight request…'));
+    };
+    process.on('SIGINT', onSigint);
+    try {
+        const outcome = await (0, login_1.loginCore)({ apiUrl }, {
+            requestPairingCode: apiClient_1.requestPairingCode,
+            pollPairingCode: apiClient_1.pollPairingCode,
+            hostname: () => os.hostname(),
+            sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+            now: () => Date.now(),
+            isCancelled: () => cancelled,
+            onCodeReady: ({ code, expiresAt }) => {
+                const url = `${WEB_URL}/settings/cli-login?code=${code}`;
+                const minutesLeft = Math.max(1, Math.round((new Date(expiresAt).getTime() - Date.now()) / 60000));
+                console.log('');
+                console.log(chalk_1.default.bold.cyan(`  ${code}`));
+                console.log('');
+                console.log(chalk_1.default.dim(`Approve at ${chalk_1.default.underline(url)}`));
+                console.log(chalk_1.default.dim(`Expires in ~${minutesLeft} min. Waiting for approval… (Ctrl+C to cancel)`));
+                (0, openBrowser_1.openBrowser)(url);
+            },
+        });
+        await reportLoginOutcome(outcome, apiUrl);
+    }
+    finally {
+        process.off('SIGINT', onSigint);
+    }
+}
+async function reportLoginOutcome(outcome, apiUrl) {
+    switch (outcome.result.outcome) {
+        case 'approved': {
+            (0, config_1.saveConfig)({ apiKey: outcome.result.apiKey, apiUrl });
+            const identity = await (0, identity_1.resolveIdentity)({ apiUrl, apiKey: outcome.result.apiKey });
+            const name = identity.ok && identity.name ? identity.name : (0, apiKeyFormat_1.shortenKey)(outcome.result.apiKey);
+            console.log(chalk_1.default.green(`✓ Signed in as ${name}`));
+            return;
+        }
+        case 'denied':
+            (0, format_1.error)('Login denied in the browser.');
+            return;
+        case 'expired':
+        case 'timeout':
+            (0, format_1.error)('Code expired — run `wen-market auth login` again.');
+            return;
+        case 'cancelled':
+        default:
+            console.log(chalk_1.default.yellow('Login cancelled — no changes made.'));
+            return;
+    }
+}

package/dist/commands/bridge.js

@@ -73,6 +73,7 @@ const repoCheckout_1 = require("../bridge/repoCheckout");
 const bundleInstaller_1 = require("../bridge/bundleInstaller");
 const agentLaunch_1 = require("../bridge/agentLaunch");
 const contextWriter_1 = require("../bridge/contextWriter");
+const memoryBrief_1 = require("../bridge/memoryBrief");
 const containerFileRelay_1 = require("../bridge/containerFileRelay");
 const claudeTranscriptReader_1 = require("../bridge/claudeTranscriptReader");
 const config_2 = require("../utils/config");
@@ -704,9 +705,17 @@ exports.bridgeCommand = new commander_1.Command('bridge')
                     reposBaseDir,
                     mkdirp: (dir) => fs.mkdirSync(dir, { recursive: true }),
                     writeFile: (p, content) => fs.writeFileSync(p, content),
+                    // Crew swap: replace the previous crew's members instead of
+                    // piling on top of them. The installer decides WHAT may go (only
+                    // marker-carrying files in .claude/agents that this bundle does
+                    // not include); these three only give it eyes and hands.
+                    listDir: (dir) => (fs.existsSync(dir) ? fs.readdirSync(dir) : []),
+                    readFile: (p) => fs.readFileSync(p, 'utf-8'),
+                    remove: (p) => fs.rmSync(p, { force: true }),
                 });
                 console.log(chalk_1.default.green(`✓ Installed crew bundle → workspace ${workspaceId} (${result.written.length} files` +
                     (result.skipped.length ? `, ${result.skipped.length} skipped` : '') +
+                    (result.pruned.length ? `, ${result.pruned.length} stale crew member(s) removed` : '') +
                     ')'));
                 return result;
             },
@@ -714,7 +723,44 @@ exports.bridgeCommand = new commander_1.Command('bridge')
             // into a fenced managed region of /data/repos/<workspaceId>/CLAUDE.md so
             // Claude Code reads it natively next turn. A FILE, never PTY input;
             // path-safe + idempotent; empty content removes the region.
-            writeContext: ({ workspaceId, content }) => {
+            /*
+              wmr-07 — the pointer refresh the hosted bridge fires when a session
+              opens. Same writer, same gate, same fetch as the manifest path below;
+              the only difference is `pointersOnly`, which keeps whatever file
+              content the region already holds.
+    
+              It exists because the manifest frame is not a reliable trigger: arena
+              only sends one when the pilot has files selected, so most workspaces
+              never got the pointers at all.
+            */
+            refreshContextPointers: async ({ workspaceId }) => {
+                const memoryAvailable = Boolean(process.env.WENRWA_CONNECT_TOKEN);
+                const memoryBrief = memoryAvailable ? await (0, memoryBrief_1.fetchMemoryBrief)(workspaceId) : null;
+                const result = (0, contextWriter_1.writeContext)({
+                    workspaceId,
+                    pointersOnly: true,
+                    workGraphAvailable: Boolean(process.env.WENRWA_CONNECT_TOKEN),
+                    memoryAvailable,
+                    memoryBrief,
+                }, {
+                    reposBaseDir,
+                    exists: (p) => fs.existsSync(p),
+                    readFile: (p) => fs.readFileSync(p, 'utf-8'),
+                    writeFile: (p, content) => fs.writeFileSync(p, content),
+                    mkdirp: (dir) => fs.mkdirSync(dir, { recursive: true }),
+                });
+                if (result.action !== 'noop') {
+                    console.log(chalk_1.default.green(`✓ Context pointers ${result.action} → workspace ${workspaceId}`));
+                }
+            },
+            writeContext: async ({ workspaceId, content }) => {
+                // wmr-03 — the workspace's memory brief, fetched at manifest time so
+                // the agent has it in context from its next turn. Never blocks the
+                // write: fetchMemoryBrief resolves null on any failure (PRD D2), and
+                // carries its own bounded timeout so a hanging backend cannot stall a
+                // terminal opening.
+                const memoryAvailable = Boolean(process.env.WENRWA_CONNECT_TOKEN);
+                const memoryBrief = memoryAvailable ? await (0, memoryBrief_1.fetchMemoryBrief)(workspaceId) : null;
                 const result = (0, contextWriter_1.writeContext)({
                     workspaceId,
                     content,
@@ -724,6 +770,10 @@ exports.bridgeCommand = new commander_1.Command('bridge')
                     // means the MCP tools this pointer names are not registered here —
                     // pointing at tools that do not exist is worse than silence.
                     workGraphAvailable: Boolean(process.env.WENRWA_CONNECT_TOKEN),
+                    // wmr-01 — same gate, same reason: the token is what proves the
+                    // MCP tools named by the memory pointer are registered here.
+                    memoryAvailable,
+                    memoryBrief,
                 }, {
                     reposBaseDir,
                     exists: (p) => fs.existsSync(p),
@@ -1019,10 +1069,30 @@ exports.bridgeCommand = new commander_1.Command('bridge')
         // lws-08 (PRD D9) — a context-manifest frame writes ONLY
         // `.hiveop/context.md` under the resolved local workspace's project
         // root; unknown workspaceId → null (server.ts errors the frame).
-        writeLocalContext: ({ workspaceId, content }) => {
+        // wmr-07 — the local twin of refreshContextPointers above.
+        refreshLocalContextPointers: async ({ workspaceId }) => {
+            const entry = (0, folderRegistry_1.findEntryByWorkspaceId)((0, folderRegistry_1.loadFolderRegistry)(), workspaceId);
+            if (!entry)
+                return;
+            const memoryAvailable = mcp.action !== 'claude-not-found';
+            const memoryBrief = memoryAvailable ? await (0, memoryBrief_1.fetchMemoryBrief)(workspaceId) : null;
+            (0, localContextWriter_1.writeLocalContext)({
+                projectRoot: entry.path,
+                pointersOnly: true,
+                workGraphAvailable: mcp.action !== 'claude-not-found',
+                memoryAvailable,
+                memoryBrief,
+            }, realLocalContextWriterDeps());
+        },
+        writeLocalContext: async ({ workspaceId, content }) => {
             const entry = (0, folderRegistry_1.findEntryByWorkspaceId)((0, folderRegistry_1.loadFolderRegistry)(), workspaceId);
             if (!entry)
                 return null;
+            // wmr-04 — same gate as the work-graph pointer on this lane: whether
+            // THIS bridge run actually registered the MCP server. Fetch failures
+            // resolve null and leave the standing instruction in place (PRD D2).
+            const memoryAvailable = mcp.action !== 'claude-not-found';
+            const memoryBrief = memoryAvailable ? await (0, memoryBrief_1.fetchMemoryBrief)(workspaceId) : null;
             return (0, localContextWriter_1.writeLocalContext)({
                 projectRoot: entry.path,
                 content,
@@ -1034,6 +1104,8 @@ exports.bridgeCommand = new commander_1.Command('bridge')
                 // for "are the tools this pointer names actually registered" —
                 // pointing at tools that do not exist is worse than silence.
                 workGraphAvailable: mcp.action !== 'claude-not-found',
+                memoryAvailable,
+                memoryBrief,
             }, realLocalContextWriterDeps());
         },
         // lws-06 — best-effort `claude` binary check before spawning an
@@ -1182,9 +1254,17 @@ exports.bridgeCommand = new commander_1.Command('bridge')
                     workspaceRoot: entry.path,
                     mkdirp: (dir) => fs.mkdirSync(dir, { recursive: true }),
                     writeFile: (p, content) => fs.writeFileSync(p, content),
+                    // Crew swap: replace the previous crew's members instead of
+                    // piling on top of them. The installer decides WHAT may go (only
+                    // marker-carrying files in .claude/agents that this bundle does
+                    // not include); these three only give it eyes and hands.
+                    listDir: (dir) => (fs.existsSync(dir) ? fs.readdirSync(dir) : []),
+                    readFile: (p) => fs.readFileSync(p, 'utf-8'),
+                    remove: (p) => fs.rmSync(p, { force: true }),
                 });
                 console.log(chalk_1.default.green(`✓ Installed crew bundle → ${entry.path} (${result.written.length} files` +
                     (result.skipped.length ? `, ${result.skipped.length} skipped` : '') +
+                    (result.pruned.length ? `, ${result.pruned.length} stale crew member(s) removed` : '') +
                     ')'));
                 return result;
             },

package/dist/utils/apiKeyFormat.d.ts

@@ -0,0 +1,9 @@
+/**
+ * wha-08 — distinguishing a real API key from the old habit of pasting a
+ * bare Solana wallet public key into --api-key (docs/CONTEXT-identity.md:
+ * "an API key is always a secret credential, never a public key").
+ */
+export declare function isRealApiKey(value: string): boolean;
+export declare function looksLikeWalletPubkey(value: string): boolean;
+/** Short, safe-to-print reference to a secret — never the whole key. */
+export declare function shortenKey(value: string): string;

package/dist/utils/apiKeyFormat.js

@@ -0,0 +1,26 @@
+"use strict";
+/**
+ * wha-08 — distinguishing a real API key from the old habit of pasting a
+ * bare Solana wallet public key into --api-key (docs/CONTEXT-identity.md:
+ * "an API key is always a secret credential, never a public key").
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isRealApiKey = isRealApiKey;
+exports.looksLikeWalletPubkey = looksLikeWalletPubkey;
+exports.shortenKey = shortenKey;
+// Matches ApiKeyService#generateKey in backend/src/services/api-key.service.ts.
+const API_KEY_PREFIX = 'wm_sk_';
+// Solana public keys are base58 (no 0, O, I, l), typically 32-44 chars.
+const BASE58_PUBKEY_RE = /^[1-9A-HJ-NP-Za-km-z]{32,44}$/;
+function isRealApiKey(value) {
+    return typeof value === 'string' && value.startsWith(API_KEY_PREFIX) && value.length > API_KEY_PREFIX.length;
+}
+function looksLikeWalletPubkey(value) {
+    return typeof value === 'string' && !value.startsWith(API_KEY_PREFIX) && BASE58_PUBKEY_RE.test(value);
+}
+/** Short, safe-to-print reference to a secret — never the whole key. */
+function shortenKey(value) {
+    if (!value)
+        return value;
+    return value.length <= 14 ? value : `${value.slice(0, 12)}…`;
+}

package/dist/utils/client.js

@@ -13,9 +13,15 @@ class ApiClient {
     }
     async request(method, path, body) {
         const url = `${this.apiUrl}${path}`;
+        // wha-08 (docs/CONTEXT-identity.md, docs/prd/retire-wallet-header-auth.md):
+        // the interactive CLI authenticates with an API key, sent as X-API-Key.
+        // X-Wallet-Pubkey (the retired header) is never sent by this client —
+        // requireConfig() already refuses to load a config whose "apiKey" is
+        // actually a bare wallet public key, so `this.apiKey` here is always a
+        // real wm_sk_ credential.
         const headers = {
             'Content-Type': 'application/json',
-            'X-Wallet-Pubkey': this.apiKey,
+            'X-API-Key': this.apiKey,
         };
         const res = await fetch(url, {
             method,

package/dist/utils/config.d.ts

@@ -4,5 +4,8 @@ export interface CliConfig {
 }
 export declare function loadConfig(): CliConfig | null;
 export declare function saveConfig(config: CliConfig): void;
+/** wha-08: deletes the local config file — used by `auth logout`. Silent no-op
+ *  if it's already gone (e.g. a previous logout, or never logged in). */
+export declare function clearConfig(): void;
 export declare function requireConfig(): CliConfig;
 export declare function getApiUrl(): string;

package/dist/utils/config.js

@@ -35,14 +35,17 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.loadConfig = loadConfig;
 exports.saveConfig = saveConfig;
+exports.clearConfig = clearConfig;
 exports.requireConfig = requireConfig;
 exports.getApiUrl = getApiUrl;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const os = __importStar(require("os"));
+const apiKeyFormat_1 = require("./apiKeyFormat");
 const CONFIG_DIR = path.join(os.homedir(), '.wen-market');
 const CONFIG_FILE = path.join(CONFIG_DIR, 'config.json');
-const DEFAULT_API_URL = 'http://localhost:3002/api/v1';
+// Published CLI: default to production. Local development sets MARKETPLACE_API_URL.
+const DEFAULT_API_URL = 'https://api.wenrwa.com/api/v1';
 function loadConfig() {
     try {
         const raw = fs.readFileSync(CONFIG_FILE, 'utf-8');
@@ -56,11 +59,34 @@ function saveConfig(config) {
     fs.mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
     fs.writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2) + '\n', { mode: 0o600 });
 }
+/** wha-08: deletes the local config file — used by `auth logout`. Silent no-op
+ *  if it's already gone (e.g. a previous logout, or never logged in). */
+function clearConfig() {
+    try {
+        fs.unlinkSync(CONFIG_FILE);
+    }
+    catch {
+        // already gone — nothing to do
+    }
+}
 function requireConfig() {
     const config = loadConfig();
     if (!config) {
-        console.error('Not logged in. Run: wen-market auth login --api-key <key>');
+        console.error('Not logged in. Run: wen-market auth login');
+        process.exit(1);
+        return config;
+    }
+    // wha-08 (docs/CONTEXT-identity.md): the interactive CLI used to store a
+    // bare wallet public key as "apiKey" and send it as X-Wallet-Pubkey (the
+    // retired header — public keys are public, so that proved nothing). An
+    // existing config left over from that era must not be silently reused —
+    // fail fast with guidance rather than let the client send a header that
+    // no longer authenticates anything.
+    if (!(0, apiKeyFormat_1.isRealApiKey)(config.apiKey)) {
+        console.error('Your saved credential looks like a wallet address, not an API key.');
+        console.error('Run: wen-market auth login');
         process.exit(1);
+        return config;
     }
     return config;
 }

package/dist/utils/openBrowser.d.ts

@@ -0,0 +1,16 @@
+/**
+ * wha-08 — best-effort "open the approval URL in a browser" for
+ * `wen-market auth login`. The code + URL are always printed regardless of
+ * whether this works (over SSH there is no browser at all), so any failure
+ * here is swallowed — never surfaced as an error.
+ */
+import { SpawnOptions } from 'child_process';
+export type SpawnedChild = {
+    unref(): void;
+    on(event: 'error', cb: (err: Error) => void): void;
+};
+export type SpawnFn = (command: string, args: string[], options?: SpawnOptions) => SpawnedChild;
+export declare function openBrowser(url: string, opts?: {
+    platform?: NodeJS.Platform;
+    spawnFn?: SpawnFn;
+}): void;

package/dist/utils/openBrowser.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.openBrowser = openBrowser;
+/**
+ * wha-08 — best-effort "open the approval URL in a browser" for
+ * `wen-market auth login`. The code + URL are always printed regardless of
+ * whether this works (over SSH there is no browser at all), so any failure
+ * here is swallowed — never surfaced as an error.
+ */
+const child_process_1 = require("child_process");
+function commandFor(platform, url) {
+    if (platform === 'darwin')
+        return { command: 'open', args: [url] };
+    if (platform === 'win32')
+        return { command: 'cmd', args: ['/c', 'start', '""', url] };
+    return { command: 'xdg-open', args: [url] };
+}
+function openBrowser(url, opts = {}) {
+    const platform = opts.platform ?? process.platform;
+    const spawnFn = opts.spawnFn ?? child_process_1.spawn;
+    try {
+        const { command, args } = commandFor(platform, url);
+        const child = spawnFn(command, args, { stdio: 'ignore', detached: true });
+        child.on('error', () => { });
+        child.unref();
+    }
+    catch {
+        // best-effort — nothing to do, the user still has the printed URL
+    }
+}

package/dist/utils/prompt.d.ts

@@ -0,0 +1,9 @@
+export interface ConfirmStreams {
+    input: NodeJS.ReadableStream;
+    output: NodeJS.WritableStream;
+}
+export declare function isInteractive(stdin?: Pick<NodeJS.ReadStream, 'isTTY'>, stdout?: Pick<NodeJS.WriteStream, 'isTTY'>): boolean;
+/** Asks `question`, returns `defaultValue` on a bare Enter. Only "y"/"yes"
+ *  (case-insensitive) count as yes — everything else, including garbage
+ *  input, is a no. */
+export declare function confirm(question: string, defaultValue?: boolean, streams?: ConfirmStreams): Promise<boolean>;

package/dist/utils/prompt.js

@@ -0,0 +1,63 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isInteractive = isInteractive;
+exports.confirm = confirm;
+/**
+ * wha-08 — minimal y/N confirmation prompt for "Already signed in as X.
+ * Sign in again? (y/N)". Streams are injectable so this is testable without
+ * a real TTY.
+ */
+const readline = __importStar(require("readline"));
+function isInteractive(stdin = process.stdin, stdout = process.stdout) {
+    return Boolean(stdin.isTTY && stdout.isTTY);
+}
+/** Asks `question`, returns `defaultValue` on a bare Enter. Only "y"/"yes"
+ *  (case-insensitive) count as yes — everything else, including garbage
+ *  input, is a no. */
+function confirm(question, defaultValue = false, streams = { input: process.stdin, output: process.stdout }) {
+    const rl = readline.createInterface({ input: streams.input, output: streams.output });
+    return new Promise((resolve) => {
+        rl.question(question, (answer) => {
+            rl.close();
+            const trimmed = answer.trim().toLowerCase();
+            if (!trimmed) {
+                resolve(defaultValue);
+                return;
+            }
+            resolve(trimmed === 'y' || trimmed === 'yes');
+        });
+    });
+}