leak-cli 2026.2.17-beta.0 → 2026.2.17

package/scripts/buy.js

@@ -11,20 +11,23 @@ import {
 } from "@x402/core/http";
 import { registerExactEvmScheme } from "@x402/evm/exact/client";
 import { privateKeyToAccount } from "viem/accounts";
+import { DOWNLOAD_CODE_HEADER } from "../src/download_code.js";
+import { createUi } from "./ui.js";
 
-const SKILL_NAME = "leak";
+const SKILL_NAME = "leak-buy";
+const outUi = createUi(process.stdout);
+const errUi = createUi(process.stderr);
 
 function usageAndExit(code = 1) {
-  console.log(
-    "Usage: leak buy <promo_or_download_url> (--buyer-private-key-file <path> | --buyer-private-key-stdin) [--out <path> | --basename <name>]",
-  );
-  console.log("Examples:");
-  console.log(
-    "  leak buy https://xxxx.trycloudflare.com/ --buyer-private-key-file ./buyer.key",
-  );
-  console.log(
-    "  cat ./buyer.key | leak buy https://xxxx.trycloudflare.com/download --buyer-private-key-stdin --basename myfile",
-  );
+  console.log(outUi.heading("Leak Buy CLI"));
+  console.log("");
+  console.log(outUi.section("Usage"));
+  console.log("  leak buy <promo_or_download_url> [--download-code <code> | --download-code-stdin] [--buyer-private-key-file <path> | --buyer-private-key-stdin] [--out <path> | --basename <name>]");
+  console.log("");
+  console.log(outUi.section("Examples"));
+  console.log("  leak buy https://xxxx.trycloudflare.com/ --buyer-private-key-file ./buyer.key");
+  console.log("  leak buy https://xxxx.trycloudflare.com/download --download-code friends-only --buyer-private-key-file ./buyer.key --basename myfile");
+  console.log("  printf '%s\\n' 'friends-only' | leak buy https://xxxx.trycloudflare.com/download --download-code-stdin --out ./downloads/file.bin");
   process.exit(code);
 }
 
@@ -83,20 +86,24 @@ function readPrivateKeyFromFile(filePath) {
   return firstLine;
 }
 
-function readPrivateKeyFromStdin() {
+function readFirstLineFromStdin(kindLabel) {
   let data = "";
   try {
     data = fs.readFileSync(0, "utf8");
   } catch {
-    throw new Error("Failed to read private key from stdin");
+    throw new Error(`Failed to read ${kindLabel} from stdin`);
   }
   const firstLine = String(data).split(/\r?\n/, 1)[0]?.trim() || "";
   if (!firstLine) {
-    throw new Error("No private key received on stdin");
+    throw new Error(`No ${kindLabel} received on stdin`);
   }
   return firstLine;
 }
 
+function readPrivateKeyFromStdin() {
+  return readFirstLineFromStdin("buyer private key");
+}
+
 function resolveBuyerPrivateKey(args) {
   if (typeof args["buyer-private-key"] !== "undefined") {
     throw new Error(
@@ -121,8 +128,31 @@ function resolveBuyerPrivateKey(args) {
   );
 }
 
+function resolveDownloadCode(args) {
+  const hasInlineCode = typeof args["download-code"] !== "undefined";
+  const hasStdinCode = Boolean(args["download-code-stdin"]);
+
+  if (hasInlineCode && hasStdinCode) {
+    throw new Error("Use exactly one download code input: --download-code or --download-code-stdin");
+  }
+  if (hasInlineCode && args["download-code"] === true) {
+    throw new Error("--download-code requires a value");
+  }
+  if (hasStdinCode && Boolean(args["buyer-private-key-stdin"])) {
+    throw new Error("--download-code-stdin cannot be combined with --buyer-private-key-stdin");
+  }
+  if (hasInlineCode) {
+    const code = String(args["download-code"] || "").trim();
+    if (!code) throw new Error("--download-code cannot be empty");
+    return code;
+  }
+  if (hasStdinCode) {
+    return readFirstLineFromStdin("download code");
+  }
+  return "";
+}
+
 function filenameFromContentDisposition(cd) {
-  // Very small parser: attachment; filename="foo.ext"
   if (!cd) return null;
   const m = String(cd).match(/filename\*=UTF-8''([^;]+)|filename="?([^";]+)"?/i);
   const raw = m ? (m[1] || m[2]) : null;
@@ -147,11 +177,6 @@ function explorerTxUrl(network, transaction) {
   return null;
 }
 
-function formatTriedEndpoints(tried) {
-  if (!Array.isArray(tried) || tried.length === 0) return "";
-  return `\nTried:\n- ${tried.join("\n- ")}`;
-}
-
 function normalizeInputUrl(value) {
   let parsed;
   try {
@@ -180,23 +205,6 @@ function normalizeSameOriginDownloadUrl(candidate, origin, sourceLabel) {
   return parsed.toString();
 }
 
-async function probeX402Endpoint(url) {
-  try {
-    const response = await fetch(url, { method: "GET" });
-    if (response.status === 402) {
-      const paymentRequiredHeader = getHeaderCaseInsensitive(response.headers, "PAYMENT-REQUIRED");
-      if (paymentRequiredHeader) return { kind: "x402", response, paymentRequiredHeader };
-      return { kind: "not-x402", response };
-    }
-    if (response.status === 410) {
-      return { kind: "ended", response };
-    }
-    return { kind: "other", response };
-  } catch (err) {
-    return { kind: "error", error: err };
-  }
-}
-
 async function fetchJsonPayload(url) {
   try {
     const response = await fetch(url, {
@@ -220,221 +228,248 @@ async function fetchJsonPayload(url) {
 
 async function resolveDownloadUrl(input) {
   const inputUrl = normalizeInputUrl(input);
-  const tried = [];
   const isRootPath = inputUrl.pathname === "/" || inputUrl.pathname === "";
   const isDownloadPath = inputUrl.pathname === "/download";
 
-  tried.push(`direct probe ${inputUrl.toString()}`);
-  const directProbe = await probeX402Endpoint(inputUrl.toString());
-  if (directProbe.kind === "x402") {
-    return {
-      downloadUrl: inputUrl.toString(),
-      firstProbe: directProbe,
-      tried,
-    };
+  if (isDownloadPath) {
+    return { downloadUrl: inputUrl.toString() };
   }
-  if (directProbe.kind === "ended") {
-    throw new Error(`Sale has ended at ${inputUrl.toString()}${formatTriedEndpoints(tried)}`);
-  }
-  if (!isRootPath && !isDownloadPath) {
+
+  if (!isRootPath) {
     throw new Error(
-      `Unsupported path for buy flow: ${inputUrl.pathname}. Use a promo URL (/) or /download URL.${formatTriedEndpoints(tried)}`,
+      `Unsupported path for buy flow: ${inputUrl.pathname}. Use a promo URL (/) or /download URL.`,
     );
   }
 
   const rfcResourceUrl = new URL(`/.well-known/skills/${SKILL_NAME}/resource.json`, inputUrl.origin).toString();
-  tried.push(`rfc resource ${rfcResourceUrl}`);
   const rfcFetch = await fetchJsonPayload(rfcResourceUrl);
   if (rfcFetch.ok && (rfcFetch.response.status === 200 || rfcFetch.response.status === 410)) {
     const resourceStatus = String(rfcFetch.body?.status || "").toLowerCase();
     if (rfcFetch.response.status === 410 || resourceStatus === "ended") {
-      throw new Error(`Sale has ended according to ${rfcResourceUrl}${formatTriedEndpoints(tried)}`);
+      throw new Error(`Sale has ended according to ${rfcResourceUrl}`);
     }
     if (typeof rfcFetch.body?.download_url === "string" && rfcFetch.body.download_url) {
-      const rfcDownloadUrl = normalizeSameOriginDownloadUrl(
-        rfcFetch.body.download_url,
-        inputUrl.origin,
-        rfcResourceUrl,
-      );
-      tried.push(`probe discovered RFC download ${rfcDownloadUrl}`);
-      const rfcProbe = await probeX402Endpoint(rfcDownloadUrl);
-      if (rfcProbe.kind === "x402") {
-        return {
-          downloadUrl: rfcDownloadUrl,
-          firstProbe: rfcProbe,
-          tried,
-        };
-      }
-      if (rfcProbe.kind === "ended") {
-        throw new Error(`Sale has ended at ${rfcDownloadUrl}${formatTriedEndpoints(tried)}`);
-      }
+      return {
+        downloadUrl: normalizeSameOriginDownloadUrl(
+          rfcFetch.body.download_url,
+          inputUrl.origin,
+          rfcResourceUrl,
+        ),
+        discovery: rfcFetch.body,
+      };
     }
   }
 
   const legacyDiscoveryUrl = new URL("/.well-known/leak", inputUrl.origin).toString();
-  tried.push(`legacy discovery ${legacyDiscoveryUrl}`);
   const legacyFetch = await fetchJsonPayload(legacyDiscoveryUrl);
   if (legacyFetch.ok && (legacyFetch.response.status === 200 || legacyFetch.response.status === 410)) {
     if (legacyFetch.response.status === 410) {
-      throw new Error(`Sale has ended according to ${legacyDiscoveryUrl}${formatTriedEndpoints(tried)}`);
+      throw new Error(`Sale has ended according to ${legacyDiscoveryUrl}`);
     }
     if (typeof legacyFetch.body?.resource?.download_url === "string" && legacyFetch.body.resource.download_url) {
-      const legacyDownloadUrl = normalizeSameOriginDownloadUrl(
-        legacyFetch.body.resource.download_url,
-        inputUrl.origin,
-        legacyDiscoveryUrl,
-      );
-      tried.push(`probe discovered legacy download ${legacyDownloadUrl}`);
-      const legacyProbe = await probeX402Endpoint(legacyDownloadUrl);
-      if (legacyProbe.kind === "x402") {
-        return {
-          downloadUrl: legacyDownloadUrl,
-          firstProbe: legacyProbe,
-          tried,
-        };
-      }
-      if (legacyProbe.kind === "ended") {
-        throw new Error(`Sale has ended at ${legacyDownloadUrl}${formatTriedEndpoints(tried)}`);
-      }
+      return {
+        downloadUrl: normalizeSameOriginDownloadUrl(
+          legacyFetch.body.resource.download_url,
+          inputUrl.origin,
+          legacyDiscoveryUrl,
+        ),
+        discovery: legacyFetch.body.resource,
+      };
     }
   }
 
-  if (isRootPath) {
-    const fallbackDownloadUrl = new URL("/download", inputUrl.origin).toString();
-    tried.push(`root fallback ${fallbackDownloadUrl}`);
-    const fallbackProbe = await probeX402Endpoint(fallbackDownloadUrl);
-    if (fallbackProbe.kind === "x402") {
-      return {
-        downloadUrl: fallbackDownloadUrl,
-        firstProbe: fallbackProbe,
-        tried,
-      };
+  return { downloadUrl: new URL("/download", inputUrl.origin).toString() };
+}
+
+function responseBodyText(response) {
+  return response.text().catch(() => "");
+}
+
+function resolveOutputPath(args, serverFilename) {
+  const safeServerFilename = sanitizeFilename(serverFilename || "downloaded.bin");
+  if (args.out) {
+    return String(args.out);
+  }
+  if (args.basename) {
+    const safeBase = sanitizeFilename(args.basename);
+    const ext = path.extname(safeServerFilename) || "";
+    return `./${safeBase}${ext}`;
+  }
+  return `./${safeServerFilename}`;
+}
+
+async function saveBinaryResponse(response, args, suggestedFilename) {
+  const serverFilename =
+    suggestedFilename ||
+    filenameFromContentDisposition(response.headers.get("content-disposition")) ||
+    "downloaded.bin";
+
+  const outPath = resolveOutputPath(args, serverFilename);
+  const buf = Buffer.from(await response.arrayBuffer());
+  fs.mkdirSync(path.dirname(outPath), { recursive: true });
+  fs.writeFileSync(outPath, buf);
+  console.log(outUi.statusLine("ok", `Saved ${buf.length} bytes -> ${outPath}`));
+}
+
+async function finalizeDownloadResponse(response, { args, downloadUrl }) {
+  const contentType = (response.headers.get("content-type") || "").toLowerCase();
+  if (!contentType.includes("application/json")) {
+    await saveBinaryResponse(response, args, null);
+    return;
+  }
+
+  const data = await response.json().catch(() => null);
+  if (!data || typeof data !== "object") {
+    throw new Error("Unexpected non-download JSON response");
+  }
+
+  if (typeof data.token === "string" && data.token) {
+    const tokenUrl = new URL(downloadUrl);
+    tokenUrl.searchParams.set("token", data.token);
+
+    const r3 = await fetch(tokenUrl.toString(), { method: "GET" });
+    if (!r3.ok) {
+      const text = await responseBodyText(r3);
+      throw new Error(`Download failed ${r3.status}: ${text}`);
     }
-    if (fallbackProbe.kind === "ended") {
-      throw new Error(`Sale has ended at ${fallbackDownloadUrl}${formatTriedEndpoints(tried)}`);
+
+    await saveBinaryResponse(r3, args, data.filename || null);
+    return;
+  }
+
+  if (typeof data.download_url === "string" && data.download_url) {
+    const sameOriginDownload = normalizeSameOriginDownloadUrl(
+      data.download_url,
+      new URL(downloadUrl).origin,
+      downloadUrl,
+    );
+    const r3 = await fetch(sameOriginDownload, { method: "GET" });
+    if (!r3.ok) {
+      const text = await responseBodyText(r3);
+      throw new Error(`Download failed ${r3.status}: ${text}`);
     }
+    await saveBinaryResponse(r3, args, data.filename || null);
+    return;
   }
 
-  throw new Error(
-    `Could not resolve an x402 download endpoint from ${inputUrl.toString()}${formatTriedEndpoints(tried)}`,
-  );
+  throw new Error(`Unexpected JSON response from download endpoint: ${JSON.stringify(data)}`);
 }
 
-async function main() {
-  const args = parseArgs(process.argv.slice(2));
-  const inputUrl = args._[0];
-  if (!inputUrl) usageAndExit(1);
+function maybePrintPaymentReceipt(response) {
+  const paymentResponseHeader =
+    getHeaderCaseInsensitive(response.headers, "PAYMENT-RESPONSE") ||
+    getHeaderCaseInsensitive(response.headers, "X-PAYMENT-RESPONSE");
+  if (!paymentResponseHeader) return;
 
-  let buyerPk;
   try {
-    buyerPk = resolveBuyerPrivateKey(args);
+    const receipt = decodePaymentResponseHeader(paymentResponseHeader);
+    const explorer = explorerTxUrl(receipt.network, receipt.transaction);
+    console.log("");
+    console.log(outUi.section("Payment Receipt"));
+    const rows = [
+      { key: "network", value: receipt.network },
+      receipt.payer ? { key: "payer", value: receipt.payer } : null,
+      { key: "tx", value: receipt.transaction },
+      explorer ? { key: "explorer", value: explorer } : null,
+    ];
+    for (const line of outUi.formatRows(rows)) {
+      console.log(line);
+    }
   } catch (err) {
-    console.error(err.message || String(err));
-    process.exit(1);
+    console.error(
+      errUi.statusLine(
+        "warn",
+        `Could not decode PAYMENT-RESPONSE header (${err.message || String(err)})`,
+      ),
+    );
   }
+}
 
-  let account;
-  try {
-    account = privateKeyToAccount(normalizePrivateKey(buyerPk));
-  } catch {
-    console.error("Invalid buyer private key format.");
-    process.exit(1);
-  }
-  const client = new x402Client();
-  registerExactEvmScheme(client, { signer: account });
+async function main() {
+  const args = parseArgs(process.argv.slice(2));
+  const inputUrl = args._[0];
+  if (!inputUrl) usageAndExit(1);
+
+  const downloadCode = resolveDownloadCode(args);
 
   const resolved = await resolveDownloadUrl(inputUrl);
   const downloadUrl = resolved.downloadUrl;
   if (downloadUrl !== inputUrl) {
-    console.log(`[buy] resolved purchase endpoint: ${downloadUrl}`);
-  }
-
-  // 1) Request: expect 402 with PAYMENT-REQUIRED header.
-  const r1 = resolved.firstProbe?.response || await fetch(downloadUrl, { method: "GET" });
-  if (r1.status !== 402) {
-    const text = await r1.text().catch(() => "");
-    throw new Error(`Expected 402, got ${r1.status}: ${text}`);
+    console.log(outUi.statusLine("info", `Resolved purchase endpoint: ${downloadUrl}`));
   }
 
-  const paymentRequiredHeader =
-    resolved.firstProbe?.paymentRequiredHeader || getHeaderCaseInsensitive(r1.headers, "PAYMENT-REQUIRED");
-  if (!paymentRequiredHeader) throw new Error("Missing PAYMENT-REQUIRED header");
-
-  const paymentRequired = decodePaymentRequiredHeader(paymentRequiredHeader);
-  const payload = await client.createPaymentPayload(paymentRequired);
-  const paymentHeader = encodePaymentSignatureHeader(payload);
+  const initialHeaders = {};
+  if (downloadCode) initialHeaders[DOWNLOAD_CODE_HEADER] = downloadCode;
 
-  // 2) Retry with payment signature, expect token JSON.
-  const r2 = await fetch(downloadUrl, {
+  const r1 = await fetch(downloadUrl, {
     method: "GET",
-    headers: {
-      "PAYMENT-SIGNATURE": paymentHeader,
-    },
+    headers: initialHeaders,
   });
 
-  if (!r2.ok) {
-    const text = await r2.text().catch(() => "");
-    throw new Error(`Payment failed ${r2.status}: ${text}`);
+  if (r1.status === 410) {
+    throw new Error(`Sale has ended at ${downloadUrl}`);
   }
 
-  const paymentResponseHeader =
-    getHeaderCaseInsensitive(r2.headers, "PAYMENT-RESPONSE")
-    || getHeaderCaseInsensitive(r2.headers, "X-PAYMENT-RESPONSE");
-  if (paymentResponseHeader) {
+  if (r1.status === 401) {
+    const text = await responseBodyText(r1);
+    throw new Error(
+      `Download code required or invalid (send header ${DOWNLOAD_CODE_HEADER}). ${text}`,
+    );
+  }
+
+  if (r1.status === 402) {
+    const paymentRequiredHeader = getHeaderCaseInsensitive(r1.headers, "PAYMENT-REQUIRED");
+    if (!paymentRequiredHeader) throw new Error("Missing PAYMENT-REQUIRED header");
+
+    let buyerPk;
     try {
-      const receipt = decodePaymentResponseHeader(paymentResponseHeader);
-      const explorer = explorerTxUrl(receipt.network, receipt.transaction);
-      console.log("Payment receipt:");
-      console.log(`- network: ${receipt.network}`);
-      if (receipt.payer) console.log(`- payer:   ${receipt.payer}`);
-      console.log(`- tx:      ${receipt.transaction}`);
-      if (explorer) console.log(`- explorer: ${explorer}`);
+      buyerPk = resolveBuyerPrivateKey(args);
     } catch (err) {
-      console.error(`[buy] warning: could not decode PAYMENT-RESPONSE header (${err.message || String(err)})`);
+      throw new Error(`${err.message || String(err)} (payment required by seller)`);
+    }
+
+    let account;
+    try {
+      account = privateKeyToAccount(normalizePrivateKey(buyerPk));
+    } catch {
+      throw new Error("Invalid buyer private key format.");
     }
-  }
 
-  const data = await r2.json();
-  const token = data?.token;
-  if (!token) throw new Error(`Missing token in response: ${JSON.stringify(data)}`);
+    const client = new x402Client();
+    registerExactEvmScheme(client, { signer: account });
 
-  // Determine download URL for the token step.
-  const base = new URL(downloadUrl);
-  const tokenUrl = new URL(base.toString());
-  tokenUrl.searchParams.set("token", token);
+    const paymentRequired = decodePaymentRequiredHeader(paymentRequiredHeader);
+    const payload = await client.createPaymentPayload(paymentRequired);
+    const paymentHeader = encodePaymentSignatureHeader(payload);
 
-  // 3) Download with token.
-  const r3 = await fetch(tokenUrl.toString(), { method: "GET" });
-  if (!r3.ok) {
-    const text = await r3.text().catch(() => "");
-    throw new Error(`Download failed ${r3.status}: ${text}`);
-  }
+    const r2 = await fetch(downloadUrl, {
+      method: "GET",
+      headers: {
+        ...initialHeaders,
+        "PAYMENT-SIGNATURE": paymentHeader,
+      },
+    });
 
-  const serverFilename =
-    data?.filename ||
-    filenameFromContentDisposition(r3.headers.get("content-disposition")) ||
-    "downloaded.bin";
-  const safeServerFilename = sanitizeFilename(serverFilename);
+    if (!r2.ok) {
+      const text = await responseBodyText(r2);
+      throw new Error(`Payment failed ${r2.status}: ${text}`);
+    }
 
-  let outPath;
-  if (args.out) {
-    outPath = String(args.out);
-  } else if (args.basename) {
-    const safeBase = sanitizeFilename(args.basename);
-    const ext = path.extname(safeServerFilename) || "";
-    outPath = `./${safeBase}${ext}`;
-  } else {
-    outPath = `./${safeServerFilename}`;
+    maybePrintPaymentReceipt(r2);
+    await finalizeDownloadResponse(r2, { args, downloadUrl });
+    return;
   }
 
-  const buf = Buffer.from(await r3.arrayBuffer());
-  fs.mkdirSync(path.dirname(outPath), { recursive: true });
-  fs.writeFileSync(outPath, buf);
+  if (!r1.ok) {
+    const text = await responseBodyText(r1);
+    throw new Error(`Download failed ${r1.status}: ${text}`);
+  }
 
-  console.log(`Saved ${buf.length} bytes -> ${outPath}`);
+  await finalizeDownloadResponse(r1, { args, downloadUrl });
 }
 
 main().catch((e) => {
-  console.error(e);
+  const detail = e?.stack || e?.message || String(e);
+  console.error(errUi.statusLine("error", detail));
   process.exit(1);
 });

package/scripts/cli.js

@@ -1,13 +1,81 @@
 #!/usr/bin/env node
+import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { spawn } from "node:child_process";
+import { createUi } from "./ui.js";
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
+const PACKAGE_JSON_PATH = path.resolve(__dirname, "..", "package.json");
+const outUi = createUi(process.stdout);
+const errUi = createUi(process.stderr);
 
 const sub = process.argv[2];
 
+function readVersion() {
+  try {
+    const parsed = JSON.parse(fs.readFileSync(PACKAGE_JSON_PATH, "utf8"));
+    const version = String(parsed?.version || "").trim();
+    return version || "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+
+function printVersion() {
+  console.log(outUi.section(`leak-cli ${readVersion()}`));
+}
+
+function printHelp() {
+  console.log(outUi.heading("Leak CLI"));
+  console.log(outUi.muted(`version ${readVersion()}`));
+  console.log("");
+  console.log(outUi.section("Usage"));
+  console.log("  leak publish [prefill flags]");
+  console.log("  leak --file <path> [publish flags]");
+  console.log("  leak buy <promo_or_download_url> [buy flags]");
+  console.log("  leak host --config <path> [host flags]");
+  console.log("  leak config [show|--write-env]");
+  console.log("  leak version");
+  console.log("");
+  console.log(outUi.section("Publish Flags"));
+  console.log("  --access-mode <mode>");
+  console.log("  --download-code <code> | --download-code-stdin");
+  console.log("  --price <usdc> --window <duration>");
+  console.log("  --pay-to <address> --network <caip2> --port <port>");
+  console.log("  --confirmed --public --og-title --og-description --og-image-url");
+  console.log("");
+  console.log(outUi.section("Buy Flags"));
+  console.log("  --download-code <code> | --download-code-stdin");
+  console.log("  --buyer-private-key-file <path> | --buyer-private-key-stdin");
+  console.log("  --out <path> | --basename <name>");
+  console.log("");
+  console.log(outUi.section("Host Flags"));
+  console.log("  --config <path>");
+  console.log("  --proxy-host <host> --proxy-port <port>");
+  console.log("  --public --public-confirm I_UNDERSTAND_PUBLIC_EXPOSURE");
+  console.log("  --dry-run");
+  console.log("");
+  console.log(outUi.section("Examples"));
+  console.log("  leak publish");
+  console.log("  leak publish --file ./song.mp3 --access-mode download-code-only-no-payment");
+  console.log("  leak --file ./song.mp3 --access-mode payment-only-no-download-code");
+  console.log("  leak --file ./song.mp3 --access-mode download-code-only-no-payment --download-code \"friends-only\"");
+  console.log("  leak buy https://xxxx.trycloudflare.com/ --download-code \"friends-only\"");
+  console.log("  leak host --config ./examples/multi-host.example.json --dry-run");
+  console.log("  leak host --config ./examples/multi-host.example.json --public --public-confirm I_UNDERSTAND_PUBLIC_EXPOSURE");
+  console.log("  leak config");
+  console.log("  leak version");
+  console.log("");
+  console.log(outUi.section("Notes"));
+  console.log("  share / as promo (social card); buy can start from / or /download.");
+  console.log("  buyer private key is required only when seller access mode includes payment.");
+  console.log("");
+  console.log(outUi.section("Backward-compatible"));
+  console.log("  leak leak --file <path> ...");
+}
+
 function runSubcommand(scriptName, argv) {
   const scriptPath = path.resolve(__dirname, scriptName);
   const child = spawn(process.execPath, [scriptPath, ...argv], {
@@ -15,38 +83,37 @@ function runSubcommand(scriptName, argv) {
   });
 
   child.on("error", (err) => {
-    console.error(`Failed to launch ${scriptName}: ${err.message}`);
+    console.error(errUi.statusLine("error", `Failed to launch ${scriptName}: ${err.message}`));
     process.exit(1);
   });
 
   child.on("exit", (code, signal) => {
     if (signal) {
-      console.error(`${scriptName} exited via signal ${signal}`);
+      console.error(errUi.statusLine("error", `${scriptName} exited via signal ${signal}`));
       process.exit(1);
     }
     process.exit(code ?? 1);
   });
 }
 
-if (!sub || sub === "--help" || sub === "-h") {
-  console.log("Usage:");
-  console.log("  leak --file <path> [--price <usdc>] [--window <duration>] [--pay-to <address>] [--network <caip2>] [--port <port>] [--confirmed] [--public] [--og-title <text>] [--og-description <text>] [--og-image-url <https://...|./image.png>] [--ended-window-seconds <seconds>]");
-  console.log("  leak buy <promo_or_download_url> (--buyer-private-key-file <path> | --buyer-private-key-stdin) [--out <path> | --basename <name>]");
-  console.log("  leak config");
-  console.log("  leak config show");
-  console.log("  leak config --write-env");
-  console.log("");
-  console.log("Notes:");
-  console.log("  share / as promo (social card); buy can start from / or /download.");
-  console.log("Backward-compatible:");
-  console.log("  leak leak --file <path> ...");
+if (!sub || sub === "--help" || sub === "-h" || sub === "help") {
+  printHelp();
+  process.exit(0);
+}
+
+if (sub === "--version" || sub === "-v" || sub === "version") {
+  printVersion();
   process.exit(0);
 }
 
 if (sub === "leak") {
   runSubcommand("leak.js", process.argv.slice(3));
+} else if (sub === "publish") {
+  runSubcommand("leak.js", ["--wizard", ...process.argv.slice(3)]);
 } else if (sub === "buy") {
   runSubcommand("buy.js", process.argv.slice(3));
+} else if (sub === "host") {
+  runSubcommand("host.js", process.argv.slice(3));
 } else if (sub === "config") {
   runSubcommand("config.js", process.argv.slice(3));
 } else {