@zan_team/cli 0.0.1 → 0.0.3

package/README.md

@@ -28,8 +28,7 @@ pnpm build
 node dist/cli.js --help
 ```
 
-下文统一使用 `zan`。测试构建产物时，将 `zan` 替换为 `node dist/cli.js`；
-本地源码联调推荐使用下方的 `cli:local` 入口，无需反复构建。
+下文统一使用 `zan`。运行源码构建产物时，将 `zan` 替换为 `node dist/cli.js`。
 
 ### 配置服务地址
 
@@ -37,74 +36,12 @@ CLI 未显式配置服务地址时默认连接生产环境 `https://zan.top`。
 环境变量覆盖 Auth/API Origin：
 
 ```sh
-export ZAN_ENV=dev
 export ZAN_AUTH_BASE_URL=https://auth.example.com
 export ZAN_API_BASE_URL=https://api.example.com
 ```
 
-仓库提供 DEV、SIT、PRE 和 PROD 四套调试配置：
-
-| 环境 | 配置文件    | Origin                                 |
-| ---- | ----------- | -------------------------------------- |
-| DEV  | `.env.dev`  | `http://127.0.0.1:8088`                |
-| SIT  | `.env.sit`  | `https://zan.unchartedw3s.com`         |
-| PRE  | `.env.pre`  | `https://pre.zan.top`                  |
-| PROD | `.env.prod` | `https://zan.top`                      |
-
-### 本地源码联调
-
-开发者可在 CLI 仓库中通过 `pnpm cli:local` 选择一次环境，后续命令会自动沿用；
-源码修改后下一次调用立即生效：
-
-```sh
-pnpm cli:local -- env use dev
-pnpm cli:local -- env status
-pnpm cli:local -- --json --no-interactive usage
-
-# 切换到 SIT
-pnpm cli:local -- env use sit
-
-# 仅本次使用 DEV，不改变保存的选择；--env 必须放在最前面
-pnpm cli:local -- --env dev --json --no-interactive usage
-```
-
-选择保存在当前工作目录的 `.zan-dev.json`，只包含 `environment`，支持
-`dev`、`sit`、`pre`。仅读取当前目录，不向上查找；未选择环境时会报错，
-也可以直接用 `--env sit` 单次指定。`env status` 始终以 JSON 返回环境、
-配置路径、工作目录、源码仓库和 Auth/API 地址，不包含凭据。
-
-测试 Agent 应直接通过 Node 调用源码入口，避免 pnpm 的脚本横幅影响 JSON 解析。
-在其他业务项目中，保留该项目的工作目录，使用源码入口的绝对路径：
-
-```sh
-node /absolute/path/to/zan-cli/scripts/zan-dev.mjs env use sit
-node /absolute/path/to/zan-cli/scripts/zan-dev.mjs --json --no-interactive usage
-```
-
-该入口从 CLI 仓库读取依赖、源码和环境文件，保留调用方工作目录。
-每个测试项目分别保存环境选择；登录、Project/Network 等仍是用户级、按环境共享的状态。
-同目录并发测试不同环境时，各命令显式使用 `--env`。
-
-此功能仅用于源码联调：正式 `zan` 和发布的 CLI 不读取 `.zan-dev.json`，
-开发脚本不随 npm 包发布。给最终用户的 Skill 只保留正式 CLI 用法。
-Agent 入口约定、写文件命令和状态隔离说明见[本地开发指南](docs/local-development.md)。
-
-也可以通过 DEV、SIT、PRE 和 PROD 脚本直接指定环境，`--` 后的参数会完整传给 CLI：
-
-```sh
-pnpm cli:dev -- auth login
-pnpm cli:sit -- auth status --verify
-pnpm cli:pre -- --json project list
-pnpm cli:prod -- auth login
-pnpm cli:prod -- --json project list
-pnpm cli:prod -- usage
-```
-
-环境脚本会覆盖当前终端残留的 `ZAN_ENV`、`ZAN_AUTH_BASE_URL` 和
-`ZAN_API_BASE_URL`。DEV、SIT、PRE 分别使用独立的系统凭据 Profile、Session、
-Project/Network 设置和 Endpoint 缓存；PROD 继续使用兼容既有安装的
-`profile-default`、`session.json` 和 `settings.json`。非生产设置分别保存在
-`settings.dev.json`、`settings.sit.json` 和 `settings.pre.json`。
+上述 `example.com` 地址仅用于展示配置方式，不能直接使用。日常使用无需覆盖
+服务地址；内部环境地址和配置请通过授权渠道获取，不要写入公开文档或示例。
 
 ### 登录
 
@@ -400,27 +337,17 @@ zan project cache clear
 Project 使用不同缓存文件与密钥。普通设置文件仍只保存 Project ID 和 Network
 ID，不保存 Endpoint 或 API Key。
 
-#### SIT 调试与 RPC API Key 覆盖
-
-源码调试时可以直接使用环境脚本：
-
-```sh
-pnpm cli:sit -- project use <project-id>
-pnpm cli:sit -- evm networks
-pnpm cli:sit -- evm networks --refresh
-pnpm cli:sit -- project cache status
-pnpm cli:sit -- project cache clear
-```
+#### RPC API Key 覆盖
 
 需要临时替换当前 Project 的 RPC API Key 时，通过隐藏输入或 stdin 写入系统
 凭据库：
 
 ```sh
-pnpm cli:sit -- project rpc-key set
+zan project rpc-key set
 printf '%s\n' "$TEST_RPC_API_KEY" \
-  | pnpm cli:sit -- project rpc-key set --stdin
-pnpm cli:sit -- project rpc-key status
-pnpm cli:sit -- project rpc-key clear
+  | zan project rpc-key set --stdin
+zan project rpc-key status
+zan project rpc-key clear
 ```
 
 覆盖值不会出现在命令参数、普通配置、Endpoint 缓存或命令输出中。启用覆盖后，
@@ -430,20 +357,34 @@ RPC 401/403 不会自动换回服务端下发的 Key，便于稳定测试指定
 
 ```sh
 zan project rpc-key pull
-# 源码 SIT 调试：
-pnpm cli:sit -- project rpc-key pull
 ```
 
 命令写入当前工作目录中固定的 `ZAN_API_KEY`：已存在时替换，缺少时追加，文件
-不存在时创建。实际生效的测试覆盖 Key 优先，否则从加密 Endpoint 缓存中提取
-服务端下发的 Project Key；不要求选择 Network。命令不接受 Key、stdin、变量名
+不存在时创建。API Key 按环境和 Project ID 独立保存在系统凭据库（macOS Keychain
+等），与 Endpoint 缓存的加密密钥、手动覆盖值分别存储。`pull` 优先使用手动覆盖值，
+否则直接读取所选 Project 已保存的 API Key，不需要读取网络缓存或请求后端。
+
+首次缺失时，CLI 请求该 Project 的网络列表，从首个可识别的 RPC 地址提取 API Key
+并保存到系统凭据库；现有后端接口通过地址携带 Key。刷新网络列表时同步更新保存的
+API Key，服务端不再返回可识别 Key 时移除旧记录。`zan project cache clear` 会同时
+清理当前项目保存的 API Key；退出登录会清理当前环境各项目的 Key 和覆盖值。
+
+API Key 属于所选 Project，不要求选择 Network。未选择 Project 时，交互终端会
+列出项目供选择，非交互模式需使用 `--project <id>` 或先执行 `zan project use <id>`。
+命令不接受 Key、stdin、变量名
 或输出路径，也不会在人工输出、JSON 输出、错误或日志中包含 Key。新文件及更新
 后的文件在 POSIX 系统上使用 `0600` 权限，并通过文件锁和原子替换写入；符号链接
 或非普通 `.env` 会被拒绝。
 
-`pull` 只写 `.env`，不会修改 `.env.dev`、`.env.sit`、`.env.pre` 或
-`.env.prod`。它不会检查 Git 跟踪状态或自动更新 `.gitignore`，请自行确保 `.env`
-不会被提交。写入后，任何拥有当前目录读取权限的进程或 Agent 都可能读取这个明文
+`pull` 会确保 `.env` 被 Git 忽略：已有生效规则（包括父目录、通配符和全局规则）时
+不修改 `.gitignore`，否则在当前目录的 `.gitignore` 末尾追加 `/.env`。尚未初始化 Git
+仓库的目录也支持此行为，不会自动创建项目仓库。此检查使用本机 Git；Git 不可用时会提示风险。
+
+若 `.env` 已被 Git 跟踪，或无法检查、更新忽略规则，命令仍写入 Key，并在终端提示
+误提交 Key 的风险；JSON 结果通过 `warnings` 返回同样的提示。已跟踪时可执行
+`git rm --cached -- .env` 取消跟踪，并在提交前检查暂存内容；CLI 不会自动修改 Git
+索引，忽略规则也不能清除历史提交中的内容。其他环境配置文件不会被修改。
+写入后，任何拥有当前目录读取权限的进程或 Agent 都可能读取这个明文
 文件；“不泄露”保证只覆盖该命令自身的参数、输出、错误和日志边界。
 
 管理默认 Project 和 Network：
@@ -518,7 +459,9 @@ printf '["0x0000000000000000000000000000000000000000","latest"]' \
 ~/.zan-cli/config.yaml
 ```
 
-`~` 由操作系统用户目录 API 解析。该文件是个人 CLI 策略，与 `.env.dev`、`.env.sit`、`.env.pre`、`.env.prod`、`ZAN_ENV` 及所选 ZAN 后端环境完全无关；`ZAN_HOME` 不会改变它的位置，DEV、SIT、PRE、PROD 读取同一个文件。
+`~` 由操作系统用户目录 API 解析。该文件是个人 CLI 策略，与环境配置文件、
+`ZAN_ENV` 及所选 ZAN 后端环境无关；`ZAN_HOME` 不会改变它的位置，所有环境
+读取同一个文件。
 
 YAML schema 支持两个顶层属性，分别控制 Raw JSON-RPC 和 Hyperliquid Info 方法：
 
@@ -683,17 +626,6 @@ Agent 可用 `inspect` 检查本地状态；`ready: false` 需结合实际命令
 Project/Network 选择、套餐与 Key 用量、EVM/Hyperliquid 查询、RPC Key 拉取及钱包签名指引。
 `skills/` 随 npm 包发布；安装 CLI 后仍需将技能目录放入 Agent 的发现路径。
 
-本仓库已通过 `.agents/skills/zan-cli` 软链接指向 `skills/zan-cli`。在 Codex
-中打开本仓库即可发现技能，修改源文件无需复制。若未显示，重启 Codex 后尝试：
-
-```text
-使用 $zan-cli 列出当前支持的命令。本任务把技能中的 zan 统一替换为
-node /absolute/path/to/zan-cli/scripts/zan-dev.mjs --env sit。
-```
-
-将示例路径替换为实际 CLI 仓库路径。该入口约定仅用于本地测试；
-环境选择和状态隔离说明见[本地开发指南](docs/local-development.md)。
-
 npm 包发布后，安装 CLI 并选择 Agent 安装技能：
 
 ```sh
@@ -796,13 +728,6 @@ zan completions fish
 名称，或通过 `zan project list` 查找项目后执行 `zan project use <id>` 使用已有
 项目；此错误不可重试，仍使用 `ZAN_API_ERROR` 和退出码 `8`。
 
-本地联调遇到 “No free Node Service plan is configured for this environment” 时，
-需在 `webtservice` 的本地数据库中配置 `/default/AVAILABLE_FREE_SPEC`，其中
-`AVAILABLE_FREE_SPEC.NODE_SERVICE.specId` 必须指向有效的 `drw3_service_spec`
-商品规格。只启动 MySQL、Redis 或重新登录不会生成这些商品数据；应导入环境
-对应的测试商品配置，并确认该规格所需的套餐开通及回调链路可用。后端代码
-修改后，需要重新编译并重启实际监听本地 API 端口的进程。
-
 已认证的 Project 与 Network 请求如果通过 HTTP 401 或已发布的 WebResult
 语义表明 Access Token 无效，会刷新一次 Access Token 并重放一次请求。第二次
 仍失败时返回 `AUTH_EXPIRED`，不会继续刷新。普通 HTTP 403 和 Scope 不足不会
@@ -810,6 +735,8 @@ zan completions fish
 
 ### 安全注意事项
 
+- 对外文档、截图和问题反馈中不要包含内部开发、测试或预发域名、IP、端口及环境配置；
+  示例统一使用 `example.com` 等占位地址，分享命令输出前先检查并脱敏。
 - 不要把 Access Token、Refresh Token、Project Token 或完整 Endpoint 写入脚本、日志和普通配置。
 - 不要使用 `--verbose` 输出处理结果中的敏感字段。
 - 完整 RPC Endpoint 只在当前进程内解密使用；本地仅保存 AES-256-GCM 密文，

package/dist/cli.js

@@ -1809,6 +1809,10 @@ function registerProject(program, outputWriter, getRuntimeContext, input, rpcKey
   rpcKey.command("pull").description("Write the active Project RPC API Key to .env").action(async () => {
     const { rpcKeyPullService } = await getRuntimeContext();
     const result = await rpcKeyPullService.pull();
+    for (const warning of result.warnings ?? []) {
+      outputWriter.writeStderr(`Warning: ${warning}
+`);
+    }
     outputWriter.success(
       result,
       "ZAN_API_KEY was written to .env"
@@ -1891,7 +1895,7 @@ function registerSign(program, outputWriter, getRuntimeContext) {
 }
 
 // src/version.ts
-var CLI_VERSION = true ? "0.0.1" : pkg.version;
+var CLI_VERSION = true ? "0.0.3" : pkg.version;
 
 // src/commands/version.ts
 function registerVersion(program, outputWriter) {
@@ -2166,7 +2170,7 @@ var ReadlineProjectPrompt = class {
 
 // src/runtime/context.ts
 import { homedir as readHomedir2 } from "os";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 
 // src/auth/session-metadata-store.ts
 import { z as z8 } from "zod";
@@ -2630,9 +2634,9 @@ var BrowserFlow = class {
 // src/auth/browser-opener.ts
 import { execFile as nodeExecFile } from "child_process";
 var BrowserOpener = class {
-  constructor(platform = process.platform, execFile = nodeExecFile) {
+  constructor(platform = process.platform, execFile2 = nodeExecFile) {
     this.platform = platform;
-    this.execFile = execFile;
+    this.execFile = execFile2;
   }
   platform;
   execFile;
@@ -5133,7 +5137,7 @@ var NetworkSelector = class {
 };
 
 // src/projects/dotenv-api-key-writer.ts
-import { randomUUID as randomUUID3 } from "crypto";
+import { randomUUID as randomUUID4 } from "crypto";
 import {
   chmod as nodeChmod2,
   lstat as nodeLstat2,
@@ -5142,7 +5146,111 @@ import {
   rename as nodeRename,
   unlink as nodeUnlink
 } from "fs/promises";
-import { isAbsolute as isAbsolute3, join as join4 } from "path";
+import { isAbsolute as isAbsolute3, join as join5 } from "path";
+
+// src/projects/dotenv-gitignore.ts
+import { execFile } from "child_process";
+import { randomUUID as randomUUID3 } from "crypto";
+import { lstat as lstat4, mkdtemp as mkdtemp2, open as open2, readFile as readFile3, rename as rename2, rm as rm2 } from "fs/promises";
+import { tmpdir } from "os";
+import { join as join4 } from "path";
+import { promisify } from "util";
+var execute = promisify(execFile);
+var UNCONFIRMED_WARNING = "Unable to confirm .env is ignored by Git; there is a risk of committing the API Key. Check Git and .gitignore before committing.";
+function protectionFailure() {
+  return new Error("Unable to verify Git ignore rules.");
+}
+async function appendRule(directory) {
+  const filename = join4(directory, ".gitignore");
+  let current = "";
+  let mode = 420;
+  try {
+    const info = await lstat4(filename);
+    if (!info.isFile() || info.isSymbolicLink()) throw protectionFailure();
+    mode = info.mode & 511;
+    current = await readFile3(filename, "utf8");
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+  const newline = current.includes("\r\n") ? "\r\n" : "\n";
+  const separator = current.length === 0 || current.endsWith("\n") ? "" : newline;
+  const temporary = join4(directory, `.gitignore.${randomUUID3()}.tmp`);
+  try {
+    const handle = await open2(temporary, "wx", mode);
+    try {
+      await handle.writeFile(`${current}${separator}/.env${newline}`, "utf8");
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
+    await rename2(temporary, filename);
+  } finally {
+    await rm2(temporary, { force: true });
+  }
+}
+async function ensureDotenvIgnored(directory) {
+  const warnings = [];
+  const env = { ...process.env, LC_ALL: "C" };
+  for (const name of ["GIT_DIR", "GIT_WORK_TREE", "GIT_INDEX_FILE", "GIT_COMMON_DIR", "GIT_PREFIX"]) {
+    delete env[name];
+  }
+  const git = async (args) => {
+    try {
+      return { code: 0, ...await execute("git", args, {
+        cwd: directory,
+        env,
+        encoding: "utf8",
+        timeout: 1e4,
+        maxBuffer: 64 * 1024
+      }) };
+    } catch (error) {
+      const failure = error;
+      if (typeof failure.code !== "number") throw protectionFailure();
+      return { code: failure.code, stdout: failure.stdout ?? "", stderr: failure.stderr ?? "" };
+    }
+  };
+  let temporaryRepository;
+  try {
+    const repository = await git(["rev-parse", "--is-inside-work-tree"]);
+    let prefix = [];
+    if (repository.code === 0 && repository.stdout.trim() === "true") {
+      const tracked = await git(["ls-files", "--error-unmatch", "--", ".env"]);
+      if (tracked.code === 0) {
+        warnings.push(
+          ".env is already tracked by Git; there is a risk of committing the API Key even with .gitignore. Run: git rm --cached -- .env, and review staged changes before committing."
+        );
+      } else if (tracked.code !== 1) {
+        throw protectionFailure();
+      }
+    } else if (repository.code === 128 && repository.stderr.includes("not a git repository")) {
+      temporaryRepository = await mkdtemp2(join4(tmpdir(), "zan-ignore-"));
+      const initialized = await git(["init", "--bare", "--quiet", "--template=", temporaryRepository]);
+      if (initialized.code !== 0) throw protectionFailure();
+      prefix = [`--git-dir=${temporaryRepository}`, `--work-tree=${directory}`, "-c", "core.bare=false"];
+    } else {
+      throw protectionFailure();
+    }
+    const ignored = await git([...prefix, "check-ignore", "--quiet", "--no-index", "--", ".env"]);
+    if (ignored.code === 0) return warnings;
+    if (ignored.code !== 1) throw protectionFailure();
+    await appendRule(directory);
+    const verified = await git([...prefix, "check-ignore", "--quiet", "--no-index", "--", ".env"]);
+    if (verified.code !== 0) throw protectionFailure();
+  } catch {
+    warnings.push(UNCONFIRMED_WARNING);
+  } finally {
+    if (temporaryRepository !== void 0) {
+      try {
+        await rm2(temporaryRepository, { recursive: true, force: true });
+      } catch {
+        warnings.push("Temporary Git metadata could not be removed; review the system temporary directory.");
+      }
+    }
+  }
+  return warnings;
+}
+
+// src/projects/dotenv-api-key-writer.ts
 var API_KEY_ASSIGNMENT = /^[ \t]*(?:export[ \t]+)?ZAN_API_KEY[ \t]*=/u;
 function unsafeKeyFailure() {
   return new CliFailure(
@@ -5220,7 +5328,7 @@ var DotenvApiKeyWriter = class {
     this.options = options;
     this.platform = options.platform ?? process.platform;
     this.fileSystem = options.fileSystem ?? nodeDotenvApiKeyFileSystem;
-    this.createTemporaryId = options.createTemporaryId ?? randomUUID3;
+    this.createTemporaryId = options.createTemporaryId ?? randomUUID4;
   }
   options;
   platform;
@@ -5234,8 +5342,9 @@ var DotenvApiKeyWriter = class {
     if (!isAbsolute3(this.options.directory)) {
       throw unsafeDotenvPathFailure();
     }
-    const lockPath = join4(this.options.directory, ".env.zan.lock");
+    const lockPath = join5(this.options.directory, ".env.zan.lock");
     let renamed = false;
+    let warnings = [];
     try {
       await this.assertSafeOptionalPath(lockPath);
       const lock = new FileLock(lockPath, {
@@ -5244,11 +5353,15 @@ var DotenvApiKeyWriter = class {
       await lock.withLock(async () => {
         const current = await this.readExistingFile();
         const next = updateApiKeyAssignment(current, parsed.data);
+        warnings = await ensureDotenvIgnored(this.options.directory);
         await this.replaceAtomically(next, () => {
           renamed = true;
         });
       });
     } catch (error) {
+      if (error instanceof CliFailure) {
+        throw error;
+      }
       if (error instanceof UnsafeDotenvPathError) {
         throw unsafeDotenvPathFailure();
       }
@@ -5257,6 +5370,9 @@ var DotenvApiKeyWriter = class {
       }
       throw dotenvWriteFailure();
     }
+    if (warnings.length > 0) {
+      return { warnings };
+    }
   }
   async assertSafeOptionalPath(path) {
     try {
@@ -5272,7 +5388,7 @@ var DotenvApiKeyWriter = class {
     }
   }
   async readExistingFile() {
-    const filename = join4(this.options.directory, ".env");
+    const filename = join5(this.options.directory, ".env");
     await this.assertSafeOptionalPath(filename);
     try {
       return await this.fileSystem.readFile(filename, "utf8");
@@ -5284,8 +5400,8 @@ var DotenvApiKeyWriter = class {
     }
   }
   async replaceAtomically(content, onRenamed) {
-    const filename = join4(this.options.directory, ".env");
-    const temporaryFile = join4(
+    const filename = join5(this.options.directory, ".env");
+    const temporaryFile = join5(
       this.options.directory,
       `.env.${process.pid}.${this.createTemporaryId()}.tmp`
     );
@@ -5479,22 +5595,22 @@ import { posix, win32 } from "path";
 // src/storage/atomic-json.ts
 import {
   chmod as chmod3,
-  lstat as lstat4,
+  lstat as lstat5,
   mkdir as mkdir3,
-  open as open2,
-  readFile as readFile3,
-  rename as rename2,
+  open as open3,
+  readFile as readFile4,
+  rename as rename3,
   unlink as unlink2
 } from "fs/promises";
 import { dirname as dirname2 } from "path";
-import { randomUUID as randomUUID4 } from "crypto";
+import { randomUUID as randomUUID5 } from "crypto";
 var nodeAtomicJsonFileSystem = Object.freeze({
   chmod: chmod3,
-  lstat: lstat4,
+  lstat: lstat5,
   mkdir: mkdir3,
-  open: open2,
-  readFile: readFile3,
-  rename: rename2,
+  open: open3,
+  readFile: readFile4,
+  rename: rename3,
   unlink: unlink2
 });
 function hasErrorCode5(error, code) {
@@ -5538,7 +5654,7 @@ var AtomicJsonStore = class {
     this.filename = filename;
     this.fileSystem = options.fileSystem ?? nodeAtomicJsonFileSystem;
     this.platform = options.platform ?? process.platform;
-    this.createTemporaryId = options.createTemporaryId ?? randomUUID4;
+    this.createTemporaryId = options.createTemporaryId ?? randomUUID5;
   }
   schema;
   filename;
@@ -5840,6 +5956,13 @@ var ProjectEndpointCache = class {
     ).toString("base64url");
     return `endpoint-cache-key-${scope}`;
   }
+  apiKeyAccount(projectId) {
+    const scope = Buffer6.from(
+      `${this.options.environment}:${projectId}`,
+      "utf8"
+    ).toString("base64url");
+    return `project-rpc-key-${scope}`;
+  }
   overrideAccount(projectId) {
     const scope = Buffer6.from(
       `${this.options.environment}:${projectId}`,
@@ -5895,6 +6018,18 @@ var ProjectEndpointCache = class {
       }
       throw error;
     }
+    let apiKey;
+    for (const network of networks) {
+      apiKey = this.extractCredential(network.endpoints.https);
+      if (apiKey !== void 0) {
+        break;
+      }
+    }
+    if (apiKey === void 0) {
+      await this.options.secretStore.delete(this.apiKeyAccount(projectId));
+    } else {
+      await this.options.secretStore.write(this.apiKeyAccount(projectId), apiKey);
+    }
     return networks;
   }
   status(projectId) {
@@ -5903,7 +6038,8 @@ var ProjectEndpointCache = class {
   async clear(projectId) {
     const results = await Promise.allSettled([
       this.options.store.delete(projectId),
-      this.options.secretStore.delete(this.cacheKeyAccount(projectId))
+      this.options.secretStore.delete(this.cacheKeyAccount(projectId)),
+      this.options.secretStore.delete(this.apiKeyAccount(projectId))
     ]);
     const failure = results.find(
       (result) => result.status === "rejected"
@@ -5962,20 +6098,23 @@ var ProjectEndpointCache = class {
       this.overrideAccount(projectId)
     );
     if (override !== null) {
-      const parsed = rpcApiKeySchema.safeParse(override);
-      if (!parsed.success) {
+      const parsed2 = rpcApiKeySchema.safeParse(override);
+      if (!parsed2.success) {
         throw unavailableApiKey();
       }
-      return parsed.data;
+      return parsed2.data;
     }
-    const candidates = (await this.list(projectId)).map(
-      (network) => this.extractCredential(network)
-    );
-    const unique = new Set(candidates);
-    if (candidates.length === 0 || unique.size !== 1) {
+    const account = this.apiKeyAccount(projectId);
+    let key = await this.options.secretStore.read(account);
+    if (key === null) {
+      await this.refresh(projectId);
+      key = await this.options.secretStore.read(account);
+    }
+    const parsed = rpcApiKeySchema.safeParse(key);
+    if (!parsed.success) {
       throw unavailableApiKey();
     }
-    return candidates[0];
+    return parsed.data;
   }
   async applyOverride(projectId, network) {
     const key = await this.options.secretStore.read(
@@ -6032,33 +6171,39 @@ var ProjectEndpointCache = class {
       );
     }
   }
-  extractCredential(network) {
+  extractCredential(endpoint) {
     try {
-      const url = new URL(network.endpoints.https);
+      const url = new URL(endpoint);
       const trustedHost = url.hostname === "zan.top" || url.hostname.endsWith(".zan.top");
       const segments = url.pathname.slice(1).split("/");
       if (url.protocol !== "https:" || !trustedHost || url.port.length > 0 || url.username.length > 0 || url.password.length > 0 || url.search.length > 0 || url.hash.length > 0 || !url.pathname.startsWith("/") || segments.some((segment) => segment.length === 0) || url.pathname !== `/${segments.join("/")}`) {
         throw new Error("unsafe");
       }
-      let candidate;
-      if (network.ecosystem === "hyperliquid") {
-        if (segments.length !== 6 || segments[0] !== "node" || segments[1] !== "v1" || segments[2] !== "hyperliquid" || segments[3] !== network.network || segments[5] !== "evm") {
-          throw new Error("unsafe");
-        }
-        candidate = segments[4];
-      } else {
-        if (segments.length !== 5 || segments[0] !== "node" || segments[1] !== "v1" || !networkIdSchema.safeParse(segments[2]).success || segments[3] !== network.network) {
-          throw new Error("unsafe");
-        }
-        candidate = segments[4];
+      if (segments[0] !== "node" || segments[1] !== "v1" || !networkIdSchema.safeParse(segments[2]).success || !networkIdSchema.safeParse(segments[3]).success) {
+        return void 0;
+      }
+      let suffix = "";
+      switch (segments[2]) {
+        case "hyperliquid":
+          suffix = "evm";
+          break;
+        case "avax":
+          suffix = "ext/bc/C/rpc";
+          break;
+        case "tron":
+          suffix = "jsonrpc";
+          break;
       }
-      const parsed = rpcApiKeySchema.safeParse(candidate);
+      if (segments.slice(5).join("/") !== suffix) {
+        return void 0;
+      }
+      const parsed = rpcApiKeySchema.safeParse(segments[4]);
       if (!parsed.success) {
         throw new Error("unsafe");
       }
       return parsed.data;
     } catch {
-      throw unavailableApiKey();
+      return void 0;
     }
   }
 };
@@ -6072,21 +6217,22 @@ var RpcKeyPullService = class {
   async pull() {
     const projectId = await this.dependencies.projects.activeId();
     const key = await this.dependencies.keys.effectiveApiKey(projectId);
-    await this.dependencies.writer.write(key);
+    const result = await this.dependencies.writer.write(key);
     return {
       file: ".env",
       variable: "ZAN_API_KEY",
-      updated: true
+      updated: true,
+      ...result?.warnings.length ? { warnings: result.warnings } : {}
     };
   }
 };
 
 // src/projects/project-service.ts
-import { randomUUID as randomUUID5 } from "crypto";
+import { randomUUID as randomUUID6 } from "crypto";
 var ProjectService = class {
   constructor(options) {
     this.options = options;
-    this.createIdempotencyKey = options.createIdempotencyKey ?? randomUUID5;
+    this.createIdempotencyKey = options.createIdempotencyKey ?? randomUUID6;
   }
   options;
   createIdempotencyKey;
@@ -6480,7 +6626,7 @@ var SettingsStore = class {
 };
 
 // src/settings/paths.ts
-import { join as join5, posix as posix2, win32 as win322 } from "path";
+import { join as join6, posix as posix2, win32 as win322 } from "path";
 function nonEmpty(value) {
   return value === void 0 || value.length === 0 ? void 0 : value;
 }
@@ -6513,7 +6659,7 @@ function resolveZanHome(env, platform, homedir2) {
   }
   if (platform === "darwin") {
     return validateHomePath(
-      join5(readHomedir(homedir2), "Library", "Application Support", "zan"),
+      join6(readHomedir(homedir2), "Library", "Application Support", "zan"),
       platform
     );
   }
@@ -7336,7 +7482,7 @@ function createRuntimeContext(input) {
     walletService ??= new WalletService({
       index: new AtomicJsonStore(
         walletIndexSchema,
-        join6(home, "wallets.json"),
+        join7(home, "wallets.json"),
         { platform }
       ),
       secrets: secretStore,
@@ -7652,4 +7798,3 @@ export {
   isMainModule,
   runCli
 };
-//# sourceMappingURL=cli.js.map

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "@zan_team/cli",
-  "version": "0.0.1",
+  "version": "0.0.3",
   "description": "Unified ZAN command-line interface for developers, automation, and AI agents",
   "type": "module",
   "bin": {
     "zan": "./dist/cli.js"
   },
   "files": [
-    "dist",
+    "dist/cli.js",
     "skills",
     "README.md"
   ],