dipcoin-cli 1.2.1 → 1.3.0

package/README.md

@@ -29,7 +29,7 @@ dipcoin-cli setup import                  # mainnet (default)
 dipcoin-cli setup import --network testnet
 ```
 
-You'll be prompted for your `suiprivkey1...` private key with hidden input.
+Paste either your `suiprivkey1...` private key **or** a 12-word (or 15/18/21/24) BIP39 mnemonic at the hidden prompt. The input is auto-detected; mnemonics are validated against the BIP39 wordlist and checksum.
 
 **Or generate a new wallet:**
 
@@ -46,10 +46,11 @@ The generated `~/.config/dipcoin/env` contains:
 
 | Variable | Required | Description |
 |----------|----------|-------------|
-| `DIPCOIN_PRIVATE_KEY` | Yes | Sui private key (`suiprivkey1...`), supports ED25519/Secp256k1/Secp256r1 |
+| `DIPCOIN_PRIVATE_KEY` | One of these | Sui private key (`suiprivkey1...`), supports ED25519/Secp256k1/Secp256r1 |
+| `DIPCOIN_MNEMONIC` | is required | 12/15/18/21/24-word BIP39 mnemonic |
 | `DIPCOIN_NETWORK` | No | `mainnet` or `testnet` (default: `mainnet`) |
 
-Manual editing is supported but discouraged — prefer the `setup` commands so format and permissions stay correct.
+If both are set, `DIPCOIN_PRIVATE_KEY` takes precedence. Manual editing is supported but discouraged — prefer the `setup` commands so format and permissions stay correct.
 
 ### Quick Start
 

package/dist/cli.cjs

@@ -7,6 +7,8 @@ var path = require('path');
 var os = require('os');
 var fs = require('fs');
 var ed25519 = require('@mysten/sui/keypairs/ed25519');
+var bip39 = require('@scure/bip39');
+var cryptography = require('@mysten/sui/cryptography');
 var utils = require('@mysten/sui/utils');
 var BigNumber = require('bignumber.js');
 var buffer = require('buffer');
@@ -15,6 +17,7 @@ var transactions = require('@mysten/sui/transactions');
 var pythSuiJs = require('@pythnetwork/pyth-sui-js');
 var child_process = require('child_process');
 var Table = require('cli-table3');
+var english_js = require('@scure/bip39/wordlists/english.js');
 var readline = require('readline');
 
 function _interopDefaultLegacy (e) { return e && typeof e === 'object' && 'default' in e ? e : { 'default': e }; }
@@ -195,16 +198,6 @@ function toBytes(data) {
     abytes$1(data);
     return data;
 }
-/**
- * Helper for KDFs: consumes uint8array or string.
- * When string is passed, does utf8 decoding, using TextDecoder.
- */
-function kdfInputToBytes(data) {
-    if (typeof data === 'string')
-        data = utf8ToBytes(data);
-    abytes$1(data);
-    return data;
-}
 /** Copies several Uint8Arrays into one. */
 function concatBytes(...arrays) {
     let sum = 0;
@@ -221,12 +214,6 @@ function concatBytes(...arrays) {
     }
     return res;
 }
-function checkOpts(defaults, opts) {
-    if (opts !== undefined && {}.toString.call(opts) !== '[object Object]')
-        throw new Error('options should be object or undefined');
-    const merged = Object.assign(defaults, opts);
-    return merged;
-}
 /** For runtime check if class implements interface */
 class Hash {
 }
@@ -3785,7 +3772,7 @@ function padding(bits, chr = '=') {
 /**
  * @__NO_SIDE_EFFECTS__
  */
-function normalize$1(fn) {
+function normalize(fn) {
     afn(fn);
     return { encode: (from) => from, decode: (to) => fn(to) };
 }
@@ -4040,7 +4027,7 @@ chain(radix2(5), alphabet('0123456789ABCDEFGHIJKLMNOPQRSTUV'), join$1(''));
  * // => Uint8Array.from([0x12, 0xab])
  * ```
  */
-chain(radix2(5), alphabet('0123456789ABCDEFGHJKMNPQRSTVWXYZ'), join$1(''), normalize$1((s) => s.toUpperCase().replace(/O/g, '0').replace(/[IL]/g, '1')));
+chain(radix2(5), alphabet('0123456789ABCDEFGHJKMNPQRSTVWXYZ'), join$1(''), normalize((s) => s.toUpperCase().replace(/O/g, '0').replace(/[IL]/g, '1')));
 // Built-in base64 conversion https://caniuse.com/mdn-javascript_builtins_uint8array_frombase64
 // prettier-ignore
 const hasBase64Builtin = /* @__PURE__ */ (() => typeof Uint8Array.from([]).toBase64 === 'function' &&
@@ -4265,7 +4252,7 @@ const hexBuiltin = {
  */
 hasHexBuiltin
     ? hexBuiltin
-    : chain(radix2(4), alphabet('0123456789abcdef'), join$1(''), normalize$1((s) => {
+    : chain(radix2(4), alphabet('0123456789abcdef'), join$1(''), normalize((s) => {
         if (typeof s !== 'string' || s.length % 2 !== 0)
             throw new TypeError(`hex.decode: expected string, got ${typeof s} with length ${s.length}`);
         return s.toLowerCase();
@@ -12413,7 +12400,6 @@ function parseSerializedSignature(serializedSignature) {
 }
 
 const PRIVATE_KEY_SIZE = 32;
-const LEGACY_PRIVATE_KEY_SIZE = 64;
 const SUI_PRIVATE_KEY_PREFIX = "suiprivkey";
 class Signer {
   /**
@@ -12495,131 +12481,6 @@ function encodeSuiPrivateKey(bytes, scheme) {
   return bech32.encode(SUI_PRIVATE_KEY_PREFIX, bech32.toWords(privKeyBytes));
 }
 
-/**
- * PBKDF (RFC 2898). Can be used to create a key from password and salt.
- * @module
- */
-// Common prologue and epilogue for sync/async functions
-function pbkdf2Init(hash, _password, _salt, _opts) {
-    ahash(hash);
-    const opts = checkOpts({ dkLen: 32, asyncTick: 10 }, _opts);
-    const { c, dkLen, asyncTick } = opts;
-    anumber$1(c);
-    anumber$1(dkLen);
-    anumber$1(asyncTick);
-    if (c < 1)
-        throw new Error('iterations (c) should be >= 1');
-    const password = kdfInputToBytes(_password);
-    const salt = kdfInputToBytes(_salt);
-    // DK = PBKDF2(PRF, Password, Salt, c, dkLen);
-    const DK = new Uint8Array(dkLen);
-    // U1 = PRF(Password, Salt + INT_32_BE(i))
-    const PRF = hmac.create(hash, password);
-    const PRFSalt = PRF._cloneInto().update(salt);
-    return { c, dkLen, asyncTick, DK, PRF, PRFSalt };
-}
-function pbkdf2Output(PRF, PRFSalt, DK, prfW, u) {
-    PRF.destroy();
-    PRFSalt.destroy();
-    if (prfW)
-        prfW.destroy();
-    clean(u);
-    return DK;
-}
-/**
- * PBKDF2-HMAC: RFC 2898 key derivation function
- * @param hash - hash function that would be used e.g. sha256
- * @param password - password from which a derived key is generated
- * @param salt - cryptographic salt
- * @param opts - {c, dkLen} where c is work factor and dkLen is output message size
- * @example
- * const key = pbkdf2(sha256, 'password', 'salt', { dkLen: 32, c: Math.pow(2, 18) });
- */
-function pbkdf2(hash, password, salt, opts) {
-    const { c, dkLen, DK, PRF, PRFSalt } = pbkdf2Init(hash, password, salt, opts);
-    let prfW; // Working copy
-    const arr = new Uint8Array(4);
-    const view = createView(arr);
-    const u = new Uint8Array(PRF.outputLen);
-    // DK = T1 + T2 + ⋯ + Tdklen/hlen
-    for (let ti = 1, pos = 0; pos < dkLen; ti++, pos += PRF.outputLen) {
-        // Ti = F(Password, Salt, c, i)
-        const Ti = DK.subarray(pos, pos + PRF.outputLen);
-        view.setInt32(0, ti, false);
-        // F(Password, Salt, c, i) = U1 ^ U2 ^ ⋯ ^ Uc
-        // U1 = PRF(Password, Salt + INT_32_BE(i))
-        (prfW = PRFSalt._cloneInto(prfW)).update(arr).digestInto(u);
-        Ti.set(u.subarray(0, Ti.length));
-        for (let ui = 1; ui < c; ui++) {
-            // Uc = PRF(Password, Uc−1)
-            PRF._cloneInto(prfW).update(u).digestInto(u);
-            for (let i = 0; i < Ti.length; i++)
-                Ti[i] ^= u[i];
-        }
-    }
-    return pbkdf2Output(PRF, PRFSalt, DK, prfW, u);
-}
-
-/**
- * Audited & minimal JS implementation of
- * [BIP39 mnemonic phrases](https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki).
- * @module
- * @example
-```js
-import * as bip39 from '@scure/bip39';
-import { wordlist } from '@scure/bip39/wordlists/english';
-const mn = bip39.generateMnemonic(wordlist);
-console.log(mn);
-const ent = bip39.mnemonicToEntropy(mn, wordlist)
-bip39.entropyToMnemonic(ent, wordlist);
-bip39.validateMnemonic(mn, wordlist);
-await bip39.mnemonicToSeed(mn, 'password');
-bip39.mnemonicToSeedSync(mn, 'password');
-
-// Wordlists
-import { wordlist as czech } from '@scure/bip39/wordlists/czech';
-import { wordlist as english } from '@scure/bip39/wordlists/english';
-import { wordlist as french } from '@scure/bip39/wordlists/french';
-import { wordlist as italian } from '@scure/bip39/wordlists/italian';
-import { wordlist as japanese } from '@scure/bip39/wordlists/japanese';
-import { wordlist as korean } from '@scure/bip39/wordlists/korean';
-import { wordlist as portuguese } from '@scure/bip39/wordlists/portuguese';
-import { wordlist as simplifiedChinese } from '@scure/bip39/wordlists/simplified-chinese';
-import { wordlist as spanish } from '@scure/bip39/wordlists/spanish';
-import { wordlist as traditionalChinese } from '@scure/bip39/wordlists/traditional-chinese';
-```
- */
-// Normalization replaces equivalent sequences of characters
-// so that any two texts that are equivalent will be reduced
-// to the same sequence of code points, called the normal form of the original text.
-// https://tonsky.me/blog/unicode/#why-is-a----
-function nfkd(str) {
-    if (typeof str !== 'string')
-        throw new TypeError('invalid mnemonic type: ' + typeof str);
-    return str.normalize('NFKD');
-}
-function normalize(str) {
-    const norm = nfkd(str);
-    const words = norm.split(' ');
-    if (![12, 15, 18, 21, 24].includes(words.length))
-        throw new Error('Invalid mnemonic');
-    return { nfkd: norm, words };
-}
-const psalt = (passphrase) => nfkd('mnemonic' + passphrase);
-/**
- * Irreversible: Uses KDF to derive 64 bytes of key data from mnemonic + optional password.
- * @param mnemonic 12-24 words
- * @param passphrase string that will additionally protect the key
- * @returns 64 bytes of key data
- * @example
- * const mnem = 'legal winner thank year wave sausage worth useful legal winner thank yellow';
- * mnemonicToSeedSync(mnem, 'password');
- * // new Uint8Array([...64 bytes])
- */
-function mnemonicToSeedSync(mnemonic, passphrase = '') {
-    return pbkdf2(sha512, normalize(mnemonic).nfkd, psalt(passphrase), { c: 2048, dkLen: 64 });
-}
-
 function isValidBIP32Path(path) {
   if (!new RegExp("^m\\/(54|74)'\\/784'\\/[0-9]+'\\/[0-9]+\\/[0-9]+$").test(path)) {
     return false;
@@ -12627,7 +12488,7 @@ function isValidBIP32Path(path) {
   return true;
 }
 function mnemonicToSeed(mnemonics) {
-  return mnemonicToSeedSync(mnemonics, "");
+  return bip39.mnemonicToSeedSync(mnemonics, "");
 }
 
 const SECP256K1_PUBLIC_KEY_SIZE = 33;
@@ -13018,16 +12879,16 @@ function fromExportedKeypair(secret, legacySupport = false) {
         schema = secret.schema;
     }
     else {
-        const decoded = decodeSuiPrivateKey(secret);
+        const decoded = cryptography.decodeSuiPrivateKey(secret);
         schema = decoded.schema;
         secretKey = decoded.secretKey;
     }
     switch (schema) {
         case "ED25519": {
             let pureSecretKey = secretKey;
-            if (secretKey.length === LEGACY_PRIVATE_KEY_SIZE) {
+            if (secretKey.length === cryptography.LEGACY_PRIVATE_KEY_SIZE) {
                 // Legacy secret key, strip public key bytes
-                pureSecretKey = secretKey.slice(0, PRIVATE_KEY_SIZE);
+                pureSecretKey = secretKey.slice(0, cryptography.PRIVATE_KEY_SIZE);
             }
             return ed25519.Ed25519Keypair.fromSecretKey(pureSecretKey);
         }
@@ -13059,7 +12920,7 @@ async function signMessage(keypair, messageBytes) {
  * @returns Formatted signature string
  */
 function buildSignature(signature, isKeyPair = false) {
-    const signatureData = parseSerializedSignature(signature);
+    const signatureData = cryptography.parseSerializedSignature(signature);
     let signatureHex = buffer.Buffer.from(signatureData.signature).toString("hex");
     let publicKey = buffer.Buffer.from(signatureData.publicKey).toString("base64");
     let flag = SignerTypes.KP_SECP256;
@@ -16735,6 +16596,13 @@ function getPerpetualId(deployment, market) {
         throw new Error(`Deployment config missing Perpetual id for ${m}`);
     return id;
 }
+function getPriceFeedId(deployment) {
+    const id = deployment?.objects?.PriceFeed?.id;
+    if (!id) {
+        throw new Error("Deployment config missing PriceFeed id. Add objects.PriceFeed to the network's main_contract.json — required for v6+ on-chain margin/vault writes.");
+    }
+    return id;
+}
 function getPriceOracleObjectId(deployment, market) {
     const m = market?.toUpperCase() || "ETH-PERP";
     const id = deployment?.markets?.[m]?.Objects?.PriceInfoObject?.id;
@@ -16780,7 +16648,7 @@ function buildAddMarginTx(deployment, args, tx, gasBudget, sender) {
         t.setSender(sender);
     const packageId = getPackageId(deployment);
     t.moveCall({
-        target: `${packageId}::exchange::add_margin_v2`,
+        target: `${packageId}::exchange::add_margin_v3`,
         arguments: [
             t.object(getProtocolConfigId(deployment)),
             t.object(CLOCK_OBJECT_ID),
@@ -16788,7 +16656,7 @@ function buildAddMarginTx(deployment, args, tx, gasBudget, sender) {
             t.object(getBankId(deployment)),
             t.object(args.subAccountsMapID || getSubAccountsId(deployment)),
             t.object(getTxIndexerId(deployment)),
-            t.object(getPriceOracleObjectId(deployment, args.market)),
+            t.object(getPriceFeedId(deployment)),
             t.pure.address(args.account || sender || ""),
             t.pure.u128(args.amount.toString()),
         ],
@@ -16804,7 +16672,7 @@ function buildRemoveMarginTx(deployment, args, tx, gasBudget, sender) {
         t.setSender(sender);
     const packageId = getPackageId(deployment);
     t.moveCall({
-        target: `${packageId}::exchange::remove_margin_v2`,
+        target: `${packageId}::exchange::remove_margin_v3`,
         arguments: [
             t.object(getProtocolConfigId(deployment)),
             t.object(CLOCK_OBJECT_ID),
@@ -16812,7 +16680,7 @@ function buildRemoveMarginTx(deployment, args, tx, gasBudget, sender) {
             t.object(getBankId(deployment)),
             t.object(args.subAccountsMapID || getSubAccountsId(deployment)),
             t.object(getTxIndexerId(deployment)),
-            t.object(getPriceOracleObjectId(deployment, args.market)),
+            t.object(getPriceFeedId(deployment)),
             t.pure.address(args.account || sender || ""),
             t.pure.u128(args.amount.toString()),
         ],
@@ -16883,17 +16751,6 @@ function buildSetOraclePriceTx(deployment, args, tx, gasBudget, sender) {
     });
     return t;
 }
-function buildBatchSetOraclePriceTx(deployment, args, tx, gasBudget, sender) {
-    let t = tx || new transactions.Transaction();
-    for (const priceArgs of args.prices) {
-        t = buildSetOraclePriceTx(deployment, priceArgs, t, undefined, undefined);
-    }
-    if (gasBudget)
-        t.setGasBudget(gasBudget);
-    if (sender)
-        t.setSender(sender);
-    return t;
-}
 
 // Copyright (c) 2025 Dipcoin LLC
 async function executeTxBlock(suiClient, tx, signer) {
@@ -18763,10 +18620,9 @@ class DipCoinPerpSDK {
     }
     async buildMarginTransaction(params, action) {
         const payload = this.buildMarginCallArgs(params, action);
-        const updatePriceTx = payload.market
-            ? await this.buildUpdatePriceTransaction(payload.market)
-            : undefined;
-        const baseTx = updatePriceTx || new transactions.Transaction();
+        // v6+ uses add_margin_v3/remove_margin_v3 which read &PriceFeed (a shared object
+        // maintained off-band by an operator). No Pyth update is needed on the user-side tx.
+        const baseTx = new transactions.Transaction();
         if (action === "add") {
             return buildAddMarginTx(this.deploymentConfig, payload, baseTx, params.gasBudget);
         }
@@ -19052,45 +18908,40 @@ class DipCoinPerpSDK {
             throw new Error(`Deployment config missing PriceInfoObject id for ${symbol}`);
         return id;
     }
-    async buildVaultNavTransaction(vaultID, markets, tx) {
+    getPriceFeedId() {
+        const id = this.deploymentConfig?.objects?.PriceFeed?.id;
+        if (!id) {
+            throw new Error("Deployment config missing PriceFeed id. Add objects.PriceFeed to the network's main_contract.json — required for v6+ vault/margin writes.");
+        }
+        return id;
+    }
+    async getOnChainPerpetualIds() {
+        const pcId = this.getDeploymentProtocolConfigId();
+        const df = await this.suiClient.getDynamicFieldObject({
+            parentId: pcId,
+            name: {
+                type: "vector<u8>",
+                value: Array.from(Buffer.from("perpetual_registry", "utf8")),
+            },
+        });
+        const content = df.data?.content;
+        const contents = content?.fields?.value?.fields?.perpetuals?.fields?.contents;
+        if (!Array.isArray(contents)) {
+            throw new Error("Could not read perpetual_registry from on-chain ProtocolConfig. Vault NAV requires the full list of perpetuals registered in the protocol.");
+        }
+        return contents;
+    }
+    async buildVaultNavTransaction(vaultID, _markets, tx) {
         const t = tx || new transactions.Transaction();
         const vaultPkg = this.getVaultPackageId();
         const currencyType = this.getCurrencyType();
-        const symbols = markets && markets.length > 0 ? markets : this.getMarketSymbols();
-        if (this.options.network === "mainnet") {
-            // On mainnet, use Pyth to fetch fresh price VAAs and update on-chain oracles
-            this.ensurePythClients();
-            if (this.priceServiceConnection && this.pythClient) {
-                const priceIds = [];
-                for (const sym of symbols) {
-                    const feedId = await this.resolvePriceFeedId(sym);
-                    if (feedId)
-                        priceIds.push(feedId);
-                }
-                if (priceIds.length > 0) {
-                    const priceUpdateData = await this.priceServiceConnection.getPriceFeedsUpdateData(priceIds);
-                    await this.pythClient.updatePriceFeeds(t, priceUpdateData, priceIds);
-                }
-            }
-        }
-        else {
-            // On testnet, prepend price oracle updates so PriceInfoObjects are fresh
-            const prices = [];
-            for (const sym of symbols) {
-                try {
-                    const oraclePrice = await getOraclePrice(this.suiClient, this.deploymentConfig, sym);
-                    if (oraclePrice !== undefined && oraclePrice !== null) {
-                        prices.push({ price: Number(oraclePrice), market: sym });
-                    }
-                }
-                catch {
-                    // skip symbols where oracle price is unavailable
-                }
-            }
-            if (prices.length > 0) {
-                buildBatchSetOraclePriceTx(this.deploymentConfig, { prices }, t);
-            }
-        }
+        // v6+: PriceFeed is a single shared object maintained by an operator off-band.
+        // new_vault_nav populates `perpetuals` from ProtocolConfig.perpetual_registry, and
+        // is_nav_filled requires EVERY registered perpetual to have a position value entry.
+        // So we must compute against the on-chain registry, not the local deployment.markets
+        // list (which can drift behind chain additions).
+        const priceFeedId = this.getPriceFeedId();
+        const perpetualIds = await this.getOnChainPerpetualIds();
         const [nav] = t.moveCall({
             target: `${vaultPkg}::vault::new_vault_nav`,
             arguments: [
@@ -19101,12 +18952,10 @@ class DipCoinPerpSDK {
             ],
             typeArguments: [currencyType],
         });
-        for (const sym of symbols) {
-            const perpId = this.getVaultPerpetualId(sym);
-            const priceInfoId = this.getVaultPriceInfoObjectId(sym);
+        for (const perpId of perpetualIds) {
             t.moveCall({
-                target: `${vaultPkg}::vault::compute_perpetual_position_value`,
-                arguments: [nav, t.object("0x6"), t.object(perpId), t.object(priceInfoId)],
+                target: `${vaultPkg}::vault::compute_perpetual_position_value_v2`,
+                arguments: [nav, t.object("0x6"), t.object(perpId), t.object(priceFeedId)],
                 typeArguments: [],
             });
         }
@@ -20135,11 +19984,16 @@ function registerPositionCommands(program) {
         .description("Add margin to position")
         .argument("<symbol>", "Trading pair")
         .argument("<amount>", "Amount in USDC")
-        .action(async (symbol, amount) => {
+        .option("--vault <address>", "Target a vault's position (vault id) instead of personal account")
+        .action(async (symbol, amount, opts) => {
         try {
             const sdk = getSDK();
             symbol = normalizeSymbol(symbol);
-            const tx = await sdk.addMargin({ symbol, amount: parseAmount(amount) });
+            const tx = await sdk.addMargin({
+                symbol,
+                amount: parseAmount(amount),
+                accountAddress: opts.vault,
+            });
             if (isJson(program))
                 return printJson({ digest: tx?.digest, status: "ok" });
             console.log(`Added ${amount} margin to ${symbol}. Tx: ${tx?.digest || JSON.stringify(tx)}`);
@@ -20153,11 +20007,16 @@ function registerPositionCommands(program) {
         .description("Remove margin from position")
         .argument("<symbol>", "Trading pair")
         .argument("<amount>", "Amount in USDC")
-        .action(async (symbol, amount) => {
+        .option("--vault <address>", "Target a vault's position (vault id) instead of personal account")
+        .action(async (symbol, amount, opts) => {
         try {
             const sdk = getSDK();
             symbol = normalizeSymbol(symbol);
-            const tx = await sdk.removeMargin({ symbol, amount: parseAmount(amount) });
+            const tx = await sdk.removeMargin({
+                symbol,
+                amount: parseAmount(amount),
+                accountAddress: opts.vault,
+            });
             if (isJson(program))
                 return printJson({ digest: tx?.digest, status: "ok" });
             console.log(`Removed ${amount} margin from ${symbol}. Tx: ${tx?.digest || JSON.stringify(tx)}`);
@@ -21061,9 +20920,12 @@ function readHiddenInput(prompt) {
         stdin.on("data", onData);
     });
 }
-function writeEnvFile(privateKey, network) {
+function writeEnvFile(cred, network) {
     fs__default["default"].mkdirSync(CONFIG_DIR, { recursive: true });
-    const content = `DIPCOIN_PRIVATE_KEY=${privateKey}\nDIPCOIN_NETWORK=${network}\n`;
+    const line = cred.kind === "privateKey"
+        ? `DIPCOIN_PRIVATE_KEY=${cred.value}`
+        : `DIPCOIN_MNEMONIC=${cred.value}`;
+    const content = `${line}\nDIPCOIN_NETWORK=${network}\n`;
     fs__default["default"].writeFileSync(ENV_PATH, content, { mode: 0o600 });
     try {
         fs__default["default"].chmodSync(ENV_PATH, 0o600);
@@ -21072,6 +20934,11 @@ function writeEnvFile(privateKey, network) {
         // best-effort on platforms without POSIX perms
     }
 }
+const VALID_MNEMONIC_WORD_COUNTS = new Set([12, 15, 18, 21, 24]);
+function looksLikeMnemonic(input) {
+    const words = input.split(/\s+/).filter(Boolean);
+    return VALID_MNEMONIC_WORD_COUNTS.has(words.length);
+}
 function resolveNetwork(input) {
     return input === "testnet" ? "testnet" : "mainnet";
 }
@@ -21081,7 +20948,7 @@ function registerSetupCommands(program) {
         .description("Configure credentials (~/.config/dipcoin/env)");
     setup
         .command("import")
-        .description("Import an existing Sui private key (interactive, hidden input)")
+        .description("Import an existing Sui private key or mnemonic (interactive, hidden input)")
         .option("--network <network>", "mainnet | testnet", "mainnet")
         .action(async (opts) => {
         try {
@@ -21090,27 +20957,48 @@ function registerSetupCommands(program) {
                 console.error("Aborted.");
                 process.exit(1);
             }
-            const key = (await readHiddenInput("Paste your Sui private key (suiprivkey1...): ")).trim();
-            if (!key) {
+            const raw = (await readHiddenInput("Paste your Sui private key (suiprivkey1...) or 12-word mnemonic: ")).trim();
+            if (!raw) {
                 console.error("No input provided.");
                 process.exit(1);
             }
-            if (!key.startsWith("suiprivkey1")) {
-                console.error("Invalid format. Sui private keys must start with 'suiprivkey1'.");
-                process.exit(1);
-            }
+            let cred;
             let address;
-            try {
-                decodeSuiPrivateKey(key);
-                address = fromExportedKeypair(key).toSuiAddress();
+            if (raw.startsWith("suiprivkey1")) {
+                try {
+                    cryptography.decodeSuiPrivateKey(raw);
+                    address = fromExportedKeypair(raw).toSuiAddress();
+                }
+                catch (e) {
+                    const msg = e instanceof Error ? e.message : String(e);
+                    console.error(`Failed to decode private key: ${msg}`);
+                    process.exit(1);
+                }
+                cred = { kind: "privateKey", value: raw };
             }
-            catch (e) {
-                const msg = e instanceof Error ? e.message : String(e);
-                console.error(`Failed to decode private key: ${msg}`);
+            else if (looksLikeMnemonic(raw)) {
+                const normalized = raw.split(/\s+/).filter(Boolean).join(" ").toLowerCase();
+                if (!bip39.validateMnemonic(normalized, english_js.wordlist)) {
+                    console.error("Invalid mnemonic: words must be from the BIP39 English wordlist and the checksum must match.");
+                    process.exit(1);
+                }
+                try {
+                    address = ed25519.Ed25519Keypair.deriveKeypair(normalized, `m/44'/784'/0'/0'/0'`).toSuiAddress();
+                }
+                catch (e) {
+                    const msg = e instanceof Error ? e.message : String(e);
+                    console.error(`Failed to derive keypair from mnemonic: ${msg}`);
+                    process.exit(1);
+                }
+                cred = { kind: "mnemonic", value: normalized };
+            }
+            else {
+                console.error("Unrecognized format. Expected a Sui private key (starts with 'suiprivkey1') or a 12/15/18/21/24-word mnemonic.");
                 process.exit(1);
             }
-            writeEnvFile(key, network);
+            writeEnvFile(cred, network);
             console.log(`Saved to ${ENV_PATH} (chmod 600).`);
+            console.log(`Type: ${cred.kind === "privateKey" ? "private key" : "mnemonic"}`);
             console.log(`Network: ${network}`);
             console.log(`Address: ${address}`);
         }
@@ -21134,7 +21022,7 @@ function registerSetupCommands(program) {
             const kp = new ed25519.Ed25519Keypair();
             const privateKey = kp.getSecretKey();
             const address = kp.toSuiAddress();
-            writeEnvFile(privateKey, network);
+            writeEnvFile({ kind: "privateKey", value: privateKey }, network);
             console.log(`Generated new keypair and saved to ${ENV_PATH} (chmod 600).`);
             console.log(`Network: ${network}`);
             console.log(`Address: ${address}`);