{"_id":"@allscale/cli","_rev":"5-67a7b953f439554444760805ac5b6819","name":"@allscale/cli","dist-tags":{"latest":"1.0.4"},"versions":{"0.1.0":{"name":"@allscale/cli","version":"0.1.0","keywords":["allscale","cli","payments","stablecoin","wallet","graphql","typescript","oclif"],"license":"UNLICENSED","_id":"@allscale/cli@0.1.0","maintainers":[{"name":"shawnpang","email":"shawnpangcanada@gmail.com"},{"name":"allscale_2025","email":"tom@allscale.io"}],"homepage":"https://app.allscale.io","bugs":{"email":"hi@allscale.io"},"bin":{"allscale":"bin/run.js"},"dist":{"shasum":"06902d504c7db71ada2205041dd02ea619bd3374","tarball":"https://registry.npmjs.org/@allscale/cli/-/cli-0.1.0.tgz","fileCount":38,"integrity":"sha512-vvZk7XUPegnq2hNbkhZRf2c9Ck/k9/Ym5S0zTO3EUTtdxfvbaTjto3qP7mqrvxadPiJqicu1AnPJ3J4NexIgqg==","signatures":[{"sig":"MEUCIQDKJA9JghJ+JCu/yJC1cstezgQJAB5QqYFudE3MuhBmfwIgWp0yNK6usjYNQtrTe39mU8Dl3hPBPJS07A735xaNVgo=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":2870075},"main":"dist/index.js","type":"commonjs","_from":"file:/tmp/release/allscale-cli-0.1.0.tgz","oclif":{"bin":"allscale","hooks":{"finally":["./dist/hooks/version-suffix"]},"topics":{"store":{"description":"Create stores and issue store API credentials."},"payout":{"description":"Auto-payout authorization is set up in the AllScale dashboard: Store Settings → Payout Authorization. This CLI inspects the resulting session (`payout status`) and sends payouts from it (`payout send`)."},"wallet":{"description":"List wallets and send supported stablecoins."},"invoice":{"description":"Create, list, inspect, update, and pay invoices."},"claim-link":{"description":"Create and fund Claim Links through the browser bridge; inspect, list, claim, and preview them."},"transaction":{"description":"List and inspect transactions."}},"commands":"./dist/commands","helpClass":"./dist/lib/help","helpOptions":{"flagSortOrder":"none"},"topicSeparator":" ","additionalHelpFlags":["-h"],"additionalVersionFlags":["-v"]},"engines":{"node":">=20.10"},"scripts":{"dev":"node ./bin/dev.js","lint":"eslint src tests scripts *.mjs *.ts","test":"vitest run","build":"tsup","codegen":"ts-node codegen/run.ts","prepack":"npm run build && npm run manifest","manifest":"oclif manifest","test:e2e":"vitest run --config vitest.e2e.config.ts","typecheck":"tsc --noEmit -p tsconfig.json && tsc --noEmit -p tsconfig.typecheck.json","report:e2e":"node scripts/coverage-report.mjs","test:watch":"vitest","pretest:e2e":"bash scripts/build-e2e-target.sh","sync-schema":"ts-node codegen/sync-schema.ts","coverage:gate":"node scripts/assert-coverage.mjs","build:internal":"ALLSCALE_BUILD_TARGET=internal tsup","prepublishOnly":"npm run build && npm run manifest && node scripts/assert-publish-safe.mjs","test:e2e:watch":"vitest --config vitest.e2e.config.ts","coverage:merged":"vitest run --coverage && npm run test:e2e:coverage && node scripts/coverage-report.mjs --merged","test:e2e:coverage":"bash scripts/build-e2e-target.sh && rm -rf coverage-e2e && E2E_COVERAGE_DIR=coverage-e2e/v8 vitest run --config vitest.e2e.config.ts && npm run report:e2e","test:smoke:public":"node scripts/smoke-public-build.mjs","verify:publish-safe":"node scripts/assert-publish-safe.mjs","codegen:accept-descriptions":"ts-node codegen/run.ts --accept-descriptions"},"_npmUser":{"name":"allscale_2025","email":"tom@allscale.io"},"_resolved":"/tmp/release/allscale-cli-0.1.0.tgz","overrides":{"esbuild":"0.28.1","js-yaml":"4.3.0","postcss":"8.5.18","brace-expansion":"5.0.8"},"_integrity":"sha512-vvZk7XUPegnq2hNbkhZRf2c9Ck/k9/Ym5S0zTO3EUTtdxfvbaTjto3qP7mqrvxadPiJqicu1AnPJ3J4NexIgqg==","_npmVersion":"10.8.2","description":"Command-line interface for AllScale — drives the same actions a user can take in app.allscale.io","directories":{},"_nodeVersion":"20.20.2","dependencies":{"handlebars":"^4.7.9","@iarna/toml":"^2.2.5","@oclif/core":"^4.5.4","@noble/hashes":"^1.8.0","@turnkey/http":"^3.17.0","@turnkey/crypto":"^2.8.11","@turnkey/api-key-stamper":"^0.6.2"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.3.0","oclif":"^4.15.0","eslint":"^9.13.0","vitest":"^4.1.10","globals":"^14.0.0","graphql":"^16.14.2","ts-node":"^10.9.2","@eslint/js":"^9.39.4","typescript":"^5.6.3","@oclif/test":"^4.0.10","@types/node":"^20.14.10","typescript-eslint":"^8.59.2","@vitest/coverage-v8":"^4.1.10","monocart-coverage-reports":"^2.12.12"},"optionalDependencies":{"keytar":"^7.9.0"},"_npmOperationalInternal":{"tmp":"tmp/cli_0.1.0_1786499048017_0.31492616055267275","host":"s3://npm-registry-packages-npm-production"}},"1.0.1":{"name":"@allscale/cli","version":"1.0.1","keywords":["allscale","cli","payments","stablecoin","wallet","graphql","typescript","oclif"],"license":"UNLICENSED","_id":"@allscale/cli@1.0.1","maintainers":[{"name":"shawnpang","email":"shawnpangcanada@gmail.com"},{"name":"allscale_2025","email":"tom@allscale.io"}],"homepage":"https://app.allscale.io","bugs":{"email":"hi@allscale.io"},"bin":{"allscale":"bin/run.js"},"dist":{"shasum":"b0bf66640a404ead615f809673c626e1647d8f86","tarball":"https://registry.npmjs.org/@allscale/cli/-/cli-1.0.1.tgz","fileCount":38,"integrity":"sha512-cr3aeEPHKZCH1XKCaI6nKagl39xcryetTuRtUUVmaXh+L0EdMgh00IfVliSMLCSgcdC7WYPjBReZICWEpIIV1A==","signatures":[{"sig":"MEQCIH+5mxp7YHH0XvyNYL47awByZzdFT784QvuOCcEeGQ2yAiADNin2jHRlGLlgT+lR3Zgveif4ItLvFKfXyjgQZ+Dj/A==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":2929101},"main":"dist/index.js","type":"commonjs","_from":"file:/tmp/release/allscale-cli-1.0.1.tgz","oclif":{"bin":"allscale","hooks":{"finally":["./dist/hooks/version-suffix"]},"topics":{"store":{"description":"Create stores and issue store API credentials."},"payout":{"description":"Auto-payout authorization is set up in the AllScale dashboard: Store Settings → Payout Authorization. This CLI inspects the resulting session (`payout status`) and sends payouts from it (`payout send`)."},"wallet":{"description":"List wallets and send supported stablecoins."},"invoice":{"description":"Create, list, inspect, update, and pay invoices."},"claim-link":{"description":"Create and fund Claim Links through the browser bridge; inspect, list, claim, and check their status."},"transaction":{"description":"List and inspect transactions."}},"commands":"./dist/commands","helpClass":"./dist/lib/help","helpOptions":{"flagSortOrder":"none"},"topicSeparator":" ","additionalHelpFlags":["-h"],"additionalVersionFlags":["-v"]},"engines":{"node":">=20.10"},"scripts":{"dev":"node ./bin/dev.js","lint":"eslint src tests scripts *.mjs *.ts","test":"vitest run","build":"tsup","codegen":"ts-node codegen/run.ts","prepack":"npm run build && npm run manifest","manifest":"oclif manifest","test:e2e":"vitest run --config vitest.e2e.config.ts","typecheck":"tsc --noEmit -p tsconfig.json && tsc --noEmit -p tsconfig.typecheck.json","report:e2e":"node scripts/coverage-report.mjs","test:watch":"vitest","pretest:e2e":"bash scripts/build-e2e-target.sh","sync-schema":"ts-node codegen/sync-schema.ts","coverage:gate":"node scripts/assert-coverage.mjs","build:internal":"ALLSCALE_BUILD_TARGET=internal tsup","prepublishOnly":"npm run build && npm run manifest && node scripts/assert-publish-safe.mjs","test:e2e:watch":"vitest --config vitest.e2e.config.ts","coverage:merged":"vitest run --coverage && npm run test:e2e:coverage && node scripts/coverage-report.mjs --merged","test:e2e:coverage":"bash scripts/build-e2e-target.sh && rm -rf coverage-e2e && E2E_COVERAGE_DIR=coverage-e2e/v8 vitest run --config vitest.e2e.config.ts && npm run report:e2e","test:smoke:public":"node scripts/smoke-public-build.mjs","verify:publish-safe":"node scripts/assert-publish-safe.mjs","sync:not-found-codes":"node scripts/sync-not-found-codes.mjs","codegen:accept-descriptions":"ts-node codegen/run.ts --accept-descriptions"},"_npmUser":{"name":"allscale_2025","email":"tom@allscale.io"},"_resolved":"/tmp/release/allscale-cli-1.0.1.tgz","overrides":{"esbuild":"0.28.1","js-yaml":"4.3.0","postcss":"8.5.18","brace-expansion":"5.0.8"},"_integrity":"sha512-cr3aeEPHKZCH1XKCaI6nKagl39xcryetTuRtUUVmaXh+L0EdMgh00IfVliSMLCSgcdC7WYPjBReZICWEpIIV1A==","_npmVersion":"10.8.2","description":"Command-line interface for AllScale — drives the same actions a user can take in app.allscale.io","directories":{},"_nodeVersion":"20.20.2","dependencies":{"handlebars":"^4.7.9","@iarna/toml":"^2.2.5","@oclif/core":"^4.5.4","@noble/hashes":"^1.8.0"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.3.0","oclif":"^4.15.0","eslint":"^9.13.0","vitest":"^4.1.10","globals":"^14.0.0","graphql":"^16.14.2","ts-node":"^10.9.2","@eslint/js":"^9.39.4","typescript":"^5.6.3","@oclif/test":"^4.0.10","@types/node":"^20.14.10","typescript-eslint":"^8.59.2","@vitest/coverage-v8":"^4.1.10","monocart-coverage-reports":"^2.12.12"},"optionalDependencies":{"keytar":"^7.9.0"},"_npmOperationalInternal":{"tmp":"tmp/cli_1.0.1_1787016608563_0.6323521781199279","host":"s3://npm-registry-packages-npm-production"}},"1.0.2":{"name":"@allscale/cli","version":"1.0.2","keywords":["allscale","cli","payments","stablecoin","wallet","graphql","typescript","oclif"],"license":"UNLICENSED","_id":"@allscale/cli@1.0.2","maintainers":[{"name":"shawnpang","email":"shawnpangcanada@gmail.com"},{"name":"allscale_2025","email":"tom@allscale.io"}],"homepage":"https://app.allscale.io","bugs":{"email":"hi@allscale.io"},"bin":{"allscale":"bin/run.js"},"dist":{"shasum":"9a3162faaea5292fd659acc130d8159c5443b3db","tarball":"https://registry.npmjs.org/@allscale/cli/-/cli-1.0.2.tgz","fileCount":38,"integrity":"sha512-SuEiiu+4vCKOwpIOvAvppJ2WEAZWbPoPAp/JmFDw9r+KN+65E3f9ykpCemWOen9bPJnJv0jxHyXAHl9uzlBMew==","signatures":[{"sig":"MEQCIHSLpAHUTGPWos6zI/I2a31PUeFRQb67S3PksdueLnRBAiAvkAIOmHX1UCfWMgygcmr4+ZZzs7AJdsDpsBPf4eNJbA==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":3020200},"main":"dist/index.js","type":"commonjs","_from":"file:/tmp/release/allscale-cli-1.0.2.tgz","oclif":{"bin":"allscale","hooks":{"finally":["./dist/hooks/version-suffix"]},"topics":{"store":{"description":"Create stores and issue store API credentials."},"payout":{"description":"Auto-payout authorization is set up in the AllScale dashboard: Store Settings → Payout Authorization. This CLI inspects the resulting session (`payout status`) and sends payouts from it (`payout send`)."},"wallet":{"description":"List wallets and send supported stablecoins."},"invoice":{"description":"Create, list, inspect, update, and pay invoices."},"claim-link":{"description":"Create and fund Claim Links through the browser bridge; inspect, list, claim, and check their status."},"transaction":{"description":"List and inspect transactions."}},"commands":"./dist/commands","helpClass":"./dist/lib/help","helpOptions":{"flagSortOrder":"none"},"topicSeparator":" ","additionalHelpFlags":["-h"],"additionalVersionFlags":["-v"]},"engines":{"node":">=20.10"},"scripts":{"dev":"node ./bin/dev.js","lint":"eslint src tests scripts *.mjs *.ts","test":"vitest run","build":"tsup","codegen":"ts-node codegen/run.ts","prepack":"npm run build && npm run manifest","manifest":"oclif manifest","test:e2e":"vitest run --config vitest.e2e.config.ts","typecheck":"tsc --noEmit -p tsconfig.json && tsc --noEmit -p tsconfig.typecheck.json","report:e2e":"node scripts/coverage-report.mjs","test:watch":"vitest","pretest:e2e":"bash scripts/build-e2e-target.sh","sync-schema":"ts-node codegen/sync-schema.ts","coverage:gate":"node scripts/assert-coverage.mjs","build:internal":"ALLSCALE_BUILD_TARGET=internal tsup","prepublishOnly":"npm run build && npm run manifest && node scripts/assert-publish-safe.mjs","test:e2e:watch":"vitest --config vitest.e2e.config.ts","coverage:merged":"vitest run --coverage && npm run test:e2e:coverage && node scripts/coverage-report.mjs --merged","test:e2e:coverage":"bash scripts/build-e2e-target.sh && rm -rf coverage-e2e && E2E_COVERAGE_DIR=coverage-e2e/v8 vitest run --config vitest.e2e.config.ts && npm run report:e2e","test:smoke:public":"node scripts/smoke-public-build.mjs","verify:publish-safe":"node scripts/assert-publish-safe.mjs","sync:not-found-codes":"node scripts/sync-not-found-codes.mjs","codegen:accept-descriptions":"ts-node codegen/run.ts --accept-descriptions"},"_npmUser":{"name":"allscale_2025","email":"tom@allscale.io"},"_resolved":"/tmp/release/allscale-cli-1.0.2.tgz","overrides":{"esbuild":"0.28.1","js-yaml":"4.3.0","postcss":"8.5.18","brace-expansion":"5.0.8"},"_integrity":"sha512-SuEiiu+4vCKOwpIOvAvppJ2WEAZWbPoPAp/JmFDw9r+KN+65E3f9ykpCemWOen9bPJnJv0jxHyXAHl9uzlBMew==","_npmVersion":"10.8.2","description":"Command-line interface for AllScale — drives the same actions a user can take in app.allscale.io","directories":{},"_nodeVersion":"20.20.2","dependencies":{"handlebars":"^4.7.9","@iarna/toml":"^2.2.5","@oclif/core":"^4.5.4","@noble/hashes":"^1.8.0"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.3.0","oclif":"^4.15.0","eslint":"^9.13.0","vitest":"^4.1.10","globals":"^14.0.0","graphql":"^16.14.2","ts-node":"^10.9.2","@eslint/js":"^9.39.4","typescript":"^5.6.3","@oclif/test":"^4.0.10","@types/node":"^20.14.10","typescript-eslint":"^8.59.2","@vitest/coverage-v8":"^4.1.10","monocart-coverage-reports":"^2.12.12"},"optionalDependencies":{"keytar":"^7.9.0"},"_npmOperationalInternal":{"tmp":"tmp/cli_1.0.2_1787615517636_0.4004019141018882","host":"s3://npm-registry-packages-npm-production"}},"1.0.3":{"name":"@allscale/cli","version":"1.0.3","keywords":["allscale","cli","payments","stablecoin","wallet","graphql","typescript","oclif"],"license":"UNLICENSED","_id":"@allscale/cli@1.0.3","maintainers":[{"name":"shawnpang","email":"shawnpangcanada@gmail.com"},{"name":"allscale_2025","email":"tom@allscale.io"}],"homepage":"https://app.allscale.io","bugs":{"email":"hi@allscale.io"},"bin":{"allscale":"bin/run.js"},"dist":{"shasum":"51cd53eb2c891eaec87f2fdf49b142f1bba54789","tarball":"https://registry.npmjs.org/@allscale/cli/-/cli-1.0.3.tgz","fileCount":38,"integrity":"sha512-9NgEeYMtfxfq/4Fdo1dcjwNIgaXuhRHE6Uv39nU45/1hOFbihkAL2qK5AhfjvqxVFJP3ILHVIegPlZAXsQVUXA==","signatures":[{"sig":"MEUCIQDOmYEAwdJm12PYFsMwrKHv6uUl8H/CyMGjRQyCJ35xMAIgC+rDkT5paNVkr2/t5F7iy0MFMJ8d6GdU3pV2aGMPwgI=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":3037756},"main":"dist/index.js","type":"commonjs","_from":"file:/tmp/release/allscale-cli-1.0.3.tgz","oclif":{"bin":"allscale","hooks":{"finally":["./dist/hooks/version-suffix"]},"topics":{"store":{"description":"Create stores and issue store API credentials."},"payout":{"description":"Auto-payout authorization is set up in the AllScale dashboard: Store Settings → Payout Authorization. This CLI inspects the resulting session (`payout status`) and sends payouts from it (`payout send`)."},"wallet":{"description":"List wallets and send supported stablecoins."},"invoice":{"description":"Create, list, inspect, update, and pay invoices."},"claim-link":{"description":"Create and fund Claim Links through the browser bridge; inspect, list, claim, and check their status."},"transaction":{"description":"List and inspect transactions."}},"commands":"./dist/commands","helpClass":"./dist/lib/help","helpOptions":{"flagSortOrder":"none"},"topicSeparator":" ","additionalHelpFlags":["-h"],"additionalVersionFlags":["-v"]},"engines":{"node":">=20.10"},"scripts":{"dev":"node ./bin/dev.js","lint":"eslint src tests scripts *.mjs *.ts","test":"vitest run","build":"tsup","codegen":"ts-node codegen/run.ts","prepack":"npm run build && npm run manifest","manifest":"oclif manifest","test:e2e":"vitest run --config vitest.e2e.config.ts","typecheck":"tsc --noEmit -p tsconfig.json && tsc --noEmit -p tsconfig.typecheck.json","report:e2e":"node scripts/coverage-report.mjs","test:watch":"vitest","pretest:e2e":"bash scripts/build-e2e-target.sh","sync-schema":"ts-node codegen/sync-schema.ts","coverage:gate":"node scripts/assert-coverage.mjs","build:internal":"ALLSCALE_BUILD_TARGET=internal tsup","prepublishOnly":"npm run build && npm run manifest && node scripts/assert-publish-safe.mjs","test:e2e:watch":"vitest --config vitest.e2e.config.ts","coverage:merged":"vitest run --coverage && npm run test:e2e:coverage && node scripts/coverage-report.mjs --merged","test:e2e:coverage":"bash scripts/build-e2e-target.sh && rm -rf coverage-e2e && E2E_COVERAGE_DIR=coverage-e2e/v8 vitest run --config vitest.e2e.config.ts && npm run report:e2e","test:smoke:public":"node scripts/smoke-public-build.mjs","verify:publish-safe":"node scripts/assert-publish-safe.mjs","sync:not-found-codes":"node scripts/sync-not-found-codes.mjs","codegen:accept-descriptions":"ts-node codegen/run.ts --accept-descriptions"},"_npmUser":{"name":"allscale_2025","email":"tom@allscale.io"},"_resolved":"/tmp/release/allscale-cli-1.0.3.tgz","overrides":{"esbuild":"0.28.1","js-yaml":"4.3.0","postcss":"8.5.18","brace-expansion":"5.0.8"},"_integrity":"sha512-9NgEeYMtfxfq/4Fdo1dcjwNIgaXuhRHE6Uv39nU45/1hOFbihkAL2qK5AhfjvqxVFJP3ILHVIegPlZAXsQVUXA==","_npmVersion":"10.8.2","description":"Command-line interface for AllScale — drives the same actions a user can take in app.allscale.io","directories":{},"_nodeVersion":"20.20.2","dependencies":{"handlebars":"^4.7.9","@iarna/toml":"^2.2.5","@oclif/core":"^4.5.4","@noble/hashes":"^1.8.0"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.3.0","oclif":"^4.15.0","eslint":"^9.13.0","vitest":"^4.1.10","globals":"^14.0.0","graphql":"^16.14.2","ts-node":"^10.9.2","@eslint/js":"^9.39.4","typescript":"^5.6.3","@oclif/test":"^4.0.10","@types/node":"^20.14.10","typescript-eslint":"^8.59.2","@vitest/coverage-v8":"^4.1.10","monocart-coverage-reports":"^2.12.12"},"optionalDependencies":{"keytar":"^7.9.0"},"_npmOperationalInternal":{"tmp":"tmp/cli_1.0.3_1788562294192_0.13583153147283866","host":"s3://npm-registry-packages-npm-production"}},"1.0.4":{"_id":"@allscale/cli@1.0.4","bin":{"allscale":"bin/run.js"},"bugs":{"email":"hi@allscale.io"},"dist":{"shasum":"9470f9a4394b0674a4c702a12d4923db1cf55df9","tarball":"https://registry.npmjs.org/@allscale/cli/-/cli-1.0.4.tgz","fileCount":38,"integrity":"sha512-QUp1SimJx/QZ87i4J4My35JoLpcTpli6qIQ8uDApHzOWpVRKKS2sT56x5dwH7OqKaShm3Ns3AXT1Ui5llfK1xw==","signatures":[{"sig":"MEYCIQCFbURYPS5/Kcy08gGGkbHfnZY5F1HDjD3FR1cOUdB0IQIhAL1AOJEKm7mo0AQBLjawo4XdcuHTRlzoBI/sqMfSlSN9","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEQCIDYSpaen/5RCSn3BGSr9TOeBfFpWB6d40NiyAOeRoCntAiBPz5PIm9B9esN7kvZ25AXNQAqUqkr75FjPPYVCFGB5Ww=="}],"unpackedSize":3038855},"main":"dist/index.js","name":"@allscale/cli","type":"commonjs","_from":"file:/tmp/release/allscale-cli-1.0.4.tgz","oclif":{"bin":"allscale","hooks":{"finally":["./dist/hooks/version-suffix"]},"topics":{"store":{"description":"Create stores and issue store API credentials."},"payout":{"description":"Auto-payout authorization is set up in the AllScale dashboard: Store Settings → Payout Authorization. This CLI inspects the resulting session (`payout status`) and sends payouts from it (`payout send`)."},"wallet":{"description":"List wallets and send supported stablecoins."},"invoice":{"description":"Create, list, inspect, update, and pay invoices."},"claim-link":{"description":"Create and fund Claim Links through the browser bridge; inspect, list, claim, and check their status."},"transaction":{"description":"List and inspect transactions."}},"commands":"./dist/commands","helpClass":"./dist/lib/help","helpOptions":{"flagSortOrder":"none"},"topicSeparator":" ","additionalHelpFlags":["-h"],"additionalVersionFlags":["-v"]},"engines":{"node":">=20.10"},"license":"UNLICENSED","scripts":{"dev":"node ./bin/dev.js","lint":"eslint src tests scripts *.mjs *.ts","test":"vitest run","build":"tsup","codegen":"ts-node codegen/run.ts","prepack":"npm run build && npm run manifest","manifest":"oclif manifest","test:e2e":"vitest run --config vitest.e2e.config.ts","typecheck":"tsc --noEmit -p tsconfig.json && tsc --noEmit -p tsconfig.typecheck.json","report:e2e":"node scripts/coverage-report.mjs","test:watch":"vitest","pretest:e2e":"bash scripts/build-e2e-target.sh","sync-schema":"ts-node codegen/sync-schema.ts","coverage:gate":"node scripts/assert-coverage.mjs","build:internal":"ALLSCALE_BUILD_TARGET=internal tsup","prepublishOnly":"npm run build && npm run manifest && node scripts/assert-publish-safe.mjs","test:e2e:watch":"vitest --config vitest.e2e.config.ts","coverage:merged":"vitest run --coverage && npm run test:e2e:coverage && node scripts/coverage-report.mjs --merged","test:e2e:coverage":"bash scripts/build-e2e-target.sh && rm -rf coverage-e2e && E2E_COVERAGE_DIR=coverage-e2e/v8 vitest run --config vitest.e2e.config.ts && npm run report:e2e","test:smoke:public":"node scripts/smoke-public-build.mjs","verify:publish-safe":"node scripts/assert-publish-safe.mjs","sync:not-found-codes":"node scripts/sync-not-found-codes.mjs","codegen:accept-descriptions":"ts-node codegen/run.ts --accept-descriptions"},"version":"1.0.4","_npmUser":{"name":"allscale_2025","email":"tom@allscale.io"},"homepage":"https://app.allscale.io","keywords":["allscale","cli","payments","stablecoin","wallet","graphql","typescript","oclif"],"_resolved":"/tmp/release/allscale-cli-1.0.4.tgz","overrides":{"esbuild":"0.28.1","js-yaml":"4.3.0","postcss":"8.5.18","brace-expansion":"5.0.8"},"_integrity":"sha512-QUp1SimJx/QZ87i4J4My35JoLpcTpli6qIQ8uDApHzOWpVRKKS2sT56x5dwH7OqKaShm3Ns3AXT1Ui5llfK1xw==","_npmVersion":"10.8.2","description":"Command-line interface for AllScale — drives the same actions a user can take in app.allscale.io","directories":{},"maintainers":[{"name":"shawnpang","email":"shawnpangcanada@gmail.com"},{"name":"allscale_2025","email":"tom@allscale.io"}],"_nodeVersion":"20.20.2","dependencies":{"handlebars":"^4.7.9","@iarna/toml":"^2.2.5","@oclif/core":"^4.5.4","@noble/hashes":"^1.8.0"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.3.0","oclif":"^4.15.0","eslint":"^9.13.0","vitest":"^4.1.10","globals":"^14.0.0","graphql":"^16.14.2","ts-node":"^10.9.2","@eslint/js":"^9.39.4","typescript":"^5.6.3","@oclif/test":"^4.0.10","@types/node":"^20.14.10","typescript-eslint":"^8.59.2","@vitest/coverage-v8":"^4.1.10","monocart-coverage-reports":"^2.12.12"},"optionalDependencies":{"keytar":"^7.9.0"},"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/cli_1.0.4_1789507258347_0.4423419139413025"}}},"time":{"created":"2026-08-12T01:44:07.828Z","modified":"2026-09-15T21:20:58.672Z","0.1.0":"2026-08-12T01:44:08.271Z","1.0.1":"2026-08-18T01:30:08.756Z","1.0.2":"2026-08-24T23:51:57.849Z","1.0.3":"2026-09-04T22:51:34.451Z","1.0.4":"2026-09-15T21:20:58.483Z"},"bugs":{"email":"hi@allscale.io"},"license":"UNLICENSED","homepage":"https://app.allscale.io","keywords":["allscale","cli","payments","stablecoin","wallet","graphql","typescript","oclif"],"description":"Command-line interface for AllScale — drives the same actions a user can take in app.allscale.io","maintainers":[{"name":"shawnpang","email":"shawnpangcanada@gmail.com"},{"name":"allscale_2025","email":"tom@allscale.io"}],"readme":"# `@allscale/cli`\n\nCommand-line interface for AllScale — drives the same actions a user can take in [app.allscale.io](https://app.allscale.io). Designed for AI agents and humans alike.\n\nSign in, issue and pay invoices, create claim links, inspect transactions, and withdraw stablecoins from your AllScale wallet — with JSON on stdout and stable exit codes, so scripts and agents can drive it without screen-scraping.\n\n## Important legal, risk, security, and privacy notice\n\nThis CLI provides command-line access to supported AllScale features. Availability depends on your account, permissions, jurisdiction, applicable law, risk controls, and service version. Use of AllScale services is governed by the [Terms of Use](https://www.allscale.io/agreement), [Privacy Policy](https://www.allscale.io/policy), and applicable risk disclosures. AllScale's role and the non-custodial features of the services are described in the Terms of Use.\n\nAllScale Services are available only to eligible users in supported jurisdictions. Transactions may be delayed, rejected, suspended, returned, or require additional information to comply with applicable law, sanctions, AML/CTF requirements, fraud controls, network conditions, or service-provider requirements.\n\nDigital assets and stablecoins are not bank deposits, may not be protected by deposit insurance, and may lose value. Blockchain transactions may be irreversible. Verify the recipient, wallet address, network, token, amount, and fees before approving any transaction. AllScale does not provide investment, legal, tax, or accounting advice.\n\nDo not expose passwords, agent keys, OTPs, API secrets, Claim Link tokens, or personal data in shell history, logs, prompts, tickets, or shared files. CLI output and optional event logs may contain personal, confidential, and transaction data.\n\n### AI and automation use\n\nCommands submitted through scripts, AI agents, or other automation may create legal, financial, and irreversible consequences. Scope controls limit categories of permitted calls but do not verify an agent's authority, accuracy, business purpose, recipient, legality, or safety. You are responsible for configuring and supervising third-party agents and models. Use least-privilege scopes, short-lived credentials, idempotency controls, testing, and appropriate human review for irreversible actions.\n\n## Install\n\n```bash\nnpm install -g @allscale/cli\nallscale --help\n```\n\nRequires Node.js >= 20.10.\n\nTo upgrade: `npm install -g @allscale/cli@latest`. To remove: `npm uninstall -g @allscale/cli`.\n\n## Quick start\n\n```bash\n# Device-pairing login — the browser approves the CLI session. Use an existing\n# web session or sign in there with Passkey or Email; enter any Email OTP on the\n# webpage, never in this terminal flow.\n# The current CLI login flows issue a SCOPED AGENT KEY:\n# the backend checks requests against the scopes chosen on the approval screen, and the\n# key expires (re-run device-login to renew).\n# A BARE run at a terminal first says what it is about to do (register a\n# pairing session, open the browser, wait for approval) and asks to confirm;\n# declining exits 12 having created nothing. Any flag skips the prompt, as do\n# piped/--json/non-tty-CI callers and a redirected stderr. (A pty-allocating\n# harness running it BARE looks human and is prompted — pass --yes.)\n# Polling stops at the\n# pairing's expiry or after 15 minutes, whichever comes first — the CLI prints\n# that deadline before it starts waiting.\nallscale device-login # opens browser; sign in there if needed, then approve\nallscale device-login --yes # explicit \"don't prompt me\"\nallscale device-login --device-label my-laptop # add a label shown in the approval UI\n\n# Or, terminal-only Email OTP (headless/scripted). The OTP enters this CLI and\n# the backend mints the same scoped agent key — pass the scopes with --scopes\n# (required; there is deliberately no full-permission default).\nallscale otp-login --email me@example.com --scopes invoice:read_only # interactive: prompts for OTP\nallscale otp-login --email me@example.com --scopes invoice:all --otp-id --otp # scripted: reuse a prior `otp-send`\n\n# Who am I signed in as?\nallscale whoami\n\n# What capabilities did this CLI session get? (chosen on the approval screen)\nallscale scope\n\n# Create a store for your business — returns its API secret on stdout (shown\n# only once; it cannot be retrieved again, so save it now).\n# `payout send` requires a live store credential from Payout onboarding.\nallscale store create --name \"My Shop\"\n\n# List your invoices (defaults to 50 rows; --all requests one bounded response)\nallscale invoice list\nallscale invoice list --input '{\"limit\":50,\"skip\":50}' # second page\n\n# Filter without hand-writing a query: repeat a flag to match any of its values.\nallscale invoice list --status SENT --status OVERDUE # still owed\nallscale invoice list --payment-type USDC # only USDC invoices\nallscale invoice list --from 2026-07-01 --to 2026-08-01 # exactly July: --from is\n # inclusive, --to exclusive\nallscale invoice list --to-email client@example.com # what you billed that\n # customer (email must match\n # an existing contact)\n\n# IMPORTANT: Financial commands are available only to eligible users in supported\n# jurisdictions and are subject to applicable law, sanctions/AML/CTF checks,\n# risk controls, network conditions, and service-provider requirements.\n# Transactions may be delayed, rejected, suspended, returned, or require\n# additional information.\n\n# Send a new invoice — authenticated `create_payment` mutation, no browser\n# ceremony. USDT/USDC totals must be at least 0.10. --wallet-id is OPTIONAL:\n# pin one or more receiving wallets (the backend resolves them, so an\n# invoice-scope-only key works), or omit it to auto-select your eligible\n# wallets (that read needs the wallet:read_only scope on an agent key).\nallscale invoice send --to-email client@example.com --amount 1.00\nallscale invoice send --to-email client@example.com --amount 1.00 --wallet-id \n\n# Itemized invoice — `--line \"||\"` carries per-line\n# qty + amount. `--amount` is optional when EVERY --line uses the 3-field form —\n# the CLI sums the lines to derive the total.\nallscale invoice send --to-email client@example.com \\\n --wallet-id \\\n --line \"Discovery (4h)|4|25.00\" --line \"Implementation (10h)|10|25.00\" \\\n --memo \"Q2 engagement\"\n\n# Explicit --amount + a display-only line. With single-field --line, `--amount`\n# is required (there is nothing to derive from). Note the ONE single-field line:\n# each such line is worth the FULL --amount, so two of them would sum to 2 x\n# --amount and print a totals-mismatch warning. Use the 3-field form above when\n# you want several rows.\nallscale invoice send --to-email client@example.com --amount 250 --wallet-id \\\n --payment-type 2 --currency-label USDC --memo \"January retainer\" \\\n --due \"$(node -p 'new Date(Date.now()+30*864e5).toISOString().slice(0,10)')\" \\\n --line \"Discovery + implementation\"\n\n# First-time invoice to a new email? Add --auto-create-contact to create the\n# contact in one shot. Name defaults to the FULL email address (essentially\n# unique — sidesteps the per-business name-uniqueness rule).\n# Override with --contact-name for a curated display name.\n# If the contact already exists, no new contact is created. Before using this\n# option, confirm that you are authorized to provide the recipient's information\n# and send the invoice, and comply with applicable privacy, marketing, and\n# recordkeeping requirements.\nallscale invoice send --to-email newclient@example.com --amount 100 \\\n --wallet-id --auto-create-contact\nallscale invoice send --to-email billing@acme.com --amount 100 \\\n --wallet-id --auto-create-contact --contact-name \"Acme Inc\"\n\n# Send a stablecoin from your AllScale wallet to an external EVM address.\n# The transfer is confirmed in the browser, which waits for the on-chain\n# receipt; over SSH, open the printed URL on any device and paste the full\n# result JSON back.\nallscale wallet send --idempotency-key order-1042 \\\n --to 0xabc... --amount 0.1 --chain base --stable-coin USDC\n\n# Drop credentials. `--profile` takes a LITERAL profile name, not \"whichever\n# one is currently the default\" — substitute yours. A bare `allscale logout`\n# at a terminal now says what it will delete and asks first; `--yes` skips\n# that prompt for a script.\nallscale logout --profile \n```\n\n> **Windows note.** The invoice examples above compute the due date with POSIX\n> command substitution. `sh`, `bash`, `zsh` and PowerShell all expand it;\n> `cmd.exe` passes the token through literally, so the CLI receives the text\n> itself and rejects it with a validation error. On `cmd.exe`, pass an explicit\n> ISO date instead.\n\n## Commands\n\n### Auth\n| Command | Description |\n|---|---|\n| `device-login` | **Recommended for AllScale Pay Accounts.** Opens the browser; use an existing web-app session or sign in there with **Passkey or Email**. On the Email path, enter the **Email OTP on the webpage**, not in the terminal, then approve the CLI. The backend mints a **scoped agent API key** — the credential issued by the current CLI login flows. Scopes chosen on the approval screen are **checked by the backend**. Scope controls reduce access but do not prevent credential compromise, misuse within a granted scope, configuration errors, or unauthorized actions by an otherwise authenticated caller. The key expires and does not refresh (re-run `device-login` when it does; the CLI prints the expiry). A **bare** `device-login` at a terminal first prints what it is about to do and asks to confirm; declining exits **12** (`user.cancelled`) having created nothing. The prompt is bare-invocation only — any flag (including `--yes`) skips it — and never appears for `--json`, a pipe, a sidecar, ordinary non-tty CI, or a redirected stderr. Automation that allocates a pty for all three streams *and* runs the command bare is indistinguishable from a human and is prompted; pass `--yes`. Polling stops at the pairing's expiry or **15 minutes**, whichever is earlier; the CLI prints that deadline before it starts waiting. If the window closes with nobody approving, that is **`auth.device_pairing_timeout`** / exit **3** — no credential was issued and nothing was written locally; re-run to get a new verification code. (Should you approve in the browser just as the window closes, the pairing can still mint a key that never reaches the CLI, so the message points you at the web dashboard to review and revoke it.) With a sidecar configured, pairing initiation also appends a sidecar-v2 `type: \"device_authorization\"` event containing `verification_url`, `verification_code`, and `polling_deadline_at`, so a supervisor need not parse stderr. |\n| `otp-login` | **Terminal-only** Email-OTP path for headless / scripted shells. Works with **any account email** — external domains included, not just `@allscale.io` (the account must already exist — sign up in the web app first). Sends the code and reads it in the terminal (flag / env / stdin / interactive prompt), then mints the same **scoped agent API key** with the scopes passed via `--scopes` (required — there is deliberately no full-permission default). |\n| `otp-send` | Granular: send the email OTP only (login only, any account email). Returns the otp_id; pair with `otp-login --otp-id --otp ` for scripted flows. |\n| `whoami` | Show the current authenticated identity. No network call. Agent-key sessions (the normal case) print the key-mode identity from the stored bundle: `credential: \"agent_key\"`, `business_id`, `user_type`, `scopes`, and the key expiry. |\n| `scope` | Show the capabilities granted to the current CLI session (chosen on the browser approval screen at `device-login`, or via `--scopes` on `otp-login`). Scopes are **checked by the backend** for each request. Scope controls reduce access but do not prevent credential compromise, misuse within a granted scope, configuration errors, or unauthorized actions by an otherwise authenticated caller; the key expiry is shown. No network call. |\n| `logout` | Drop cached session and store credentials for a profile. A **bare** `logout` at a terminal first prints what it is about to delete and asks to confirm; declining exits **12** (`user.cancelled`) having removed nothing. That prompt follows the same rules as `device-login`'s (bare invocation only, `--yes` or any flag skips it, never for `--json` / pipe / sidecar / non-tty CI / redirected stderr; a bare run under a full pty is prompted). A bare logout requests a full plaintext + OS-keychain sweep and exits non-zero after file cleanup if the keychain cannot be inspected; `--insecure-storage` performs an explicit file-only cleanup and never probes keychain. JSON output keeps the legacy session-token-only `removed` boolean and adds `removal_status`: `removed` when any session or store credential was deleted, `nothing_to_remove` only when a complete sweep found none, or `skipped` when a file-only sweep deleted nothing because keychain inspection was intentionally skipped. When a sweep comes back partial, the error `details` also carry `uncleared_backends` (`keychain` / `insecure-file`), so a script can tell \"everything readable was cleared, the keychain is unknown\" from \"nothing was removed\". |\n\n#### `device-login` failure reasons\n\nA terminal `device-login` error may carry `error.details.reason`. The values in\nthe table below are a stable, CLI-owned contract for subprocess and agent\nconsumers: branch on `error.code` first, then use `reason` to narrow that error.\nThe human-readable message is prose and may change. Published values and\nmeanings remain backward-compatible; future releases may add values. Not every\nfailure has a reason, so consumers must tolerate a missing or unknown value\nrather than treating this table as an exhaustive switch.\n\n| `details.reason` | `error.code` / exit | Meaning |\n| --- | --- | --- |\n| `init_fetch_failure` | `transport.network` / 3 | The pairing-init request failed before a response arrived. |\n| `init_request_timeout` | `transport.timeout` / 3 | The pairing-init request reached its request deadline before a response arrived. |\n| `init_body_failure` | `transport.network` / 3 | An init response arrived, but reading its body failed. |\n| `init_body_timeout` | `transport.timeout` / 3 | An init response arrived, but its body did not finish before the init deadline. |\n| `approved_credential_mismatch` | `backend.internal` / 9 | The backend reported approval without the requested scoped agent key. The CLI stores nothing because an older or rolling backend may instead have minted a broader legacy credential; `details.outcome_ambiguous` is `true`. |\n| `pairing_expired_backend_ttl` | `auth.device_pairing_timeout` / 3 | The backend returned business code 7510, its explicit signal that the pairing TTL elapsed. |\n| `pairing_token_unrecognized` | `auth.no_token` / 4 | The backend returned 7511, but the CLI cannot authoritatively prove the window closed. The record may be unknown, evicted, or already consumed; a missing backend `Date` header also keeps this neutral classification. |\n| `pairing_token_unrecognized_after_window_closed` | `auth.device_pairing_timeout` / 3 | With no unresolved transient failure, a poll returned 7511 and the backend's own clock was at or past the backend-minted `expires_at`. |\n| `pairing_deadline_backend_ttl` | `auth.device_pairing_timeout` / 3 | With no unresolved transient failure, the poll loop stopped at an effective deadline selected from the backend's `expires_at`, rather than the CLI ceiling. This identifies the bound that fired; because the loop observes that bound with the local clock, it does not by itself prove what the backend clock says now. |\n| `pairing_deadline_cli_ceiling` | `auth.device_pairing_timeout` / 3 | With no unresolved transient failure, the poll loop reached the CLI's own ceiling before `expires_at`; the pairing may still be live server-side, so a later browser approval can mint a key that this process will not collect. |\n| `invalid_polling_token_after_transient_failure` | `backend.internal` / 9 | After an unresolved transient poll failure, a later poll returned 7511. The one-shot approval response may have been consumed and lost; `details.outcome_ambiguous` is `true`. |\n| `transient_retry_budget_exhausted` | `backend.internal` / 9 | Retryable poll failures exhausted the bounded retry budget without a definitive pending response; `details.outcome_ambiguous` is `true`. |\n| `pairing_deadline_elapsed_after_transient_failure` | `backend.internal` / 9 | The effective pairing deadline elapsed while a transient poll failure remained unresolved; `details.outcome_ambiguous` is `true`. |\n\nThe single-attempt poll helper also uses six retry-only reasons internally.\n`runDevicePairingLogin` catches these and either receives a later definitive\nresponse or converts the terminal outcome into one of the three\n`backend.internal` reasons above. They therefore do **not** appear directly in\nthe terminal `allscale device-login` subprocess envelope and are not part of its\nstable consumer contract:\n\n| Retry-only reason | Meaning before the orchestrator retries |\n| --- | --- |\n| `poll_fetch_failure` | The poll request failed before a response arrived. |\n| `poll_request_timeout` | The poll request reached its request deadline before a response arrived. |\n| `poll_body_failure` | A poll response arrived, but reading its body failed. |\n| `poll_body_timeout` | A poll response arrived, but its body did not finish before the poll deadline. |\n| `empty_response` | The poll returned HTTP 200 with an empty body. |\n| `invalid_response` | The poll returned HTTP 200 with malformed JSON or an unexpected response shape/status. |\n\n### Authorization model\n\nOne page, no archaeology:\n\n- **The current CLI auth flows issue a scoped agent API key.** Both `device-login` (browser approval) and `otp-login` (terminal OTP, for headless/CI) mint one. There is no cookie mode and no full-permission default — every key carries an explicit scope set.\n- **Scopes** are `:` strings (e.g. `invoice:read_only`, `claim_link:all`), chosen on the browser approval screen (`device-login`) or via `--scopes` (`otp-login`). Requested scopes are clipped to your account's role at mint; the granted set is echoed back and recorded locally (`allscale scope` shows it without a network call). The backend **checks** the set on each request; an out-of-scope call is expected to fail with exit 6. Scope controls limit permitted call categories but do not verify the caller's authority, purpose, accuracy, legality, or safety. Both commands check the *values* locally first: an unrecognised `:` string fails with `input.invalid` (exit 2) before anything is sent — no OTP, and no pairing session — so a script can rely on one contract for the flag whichever login it uses.\n- **Keys expire and do not refresh.** The CLI prints the expiry at login and in `scope` / `whoami`; re-run `device-login` or `otp-login` to mint a new key. Revoke keys in the AllScale web dashboard, then log in again for a fresh one — the CLI has no key-management command (see the Keys section).\n- **Some actions stay human-only by design.** Two of them are not CLI commands at all — key management lives in the dashboard (see the Keys section) and payout authorization lives in Store Settings → Payout Authorization. The browser-bridge flows (`wallet send`, `invoice pay`) work under an agent key: the human approves in the browser — note `invoice pay` needs **two** scopes, `invoice:all` to create, report and confirm the pay intent and `wallet:all` to register the withdrawal (the same broker op as `wallet send`; it also covers the payer-address lookup, since `:all` implies `:read_only`). A bare `device-login` starts every category OFF: request BOTH `--scopes invoice:all --scopes wallet:all` to preselect them, or turn on both Allow-changes switches on the approval screen. With `otp-login`, pass the same two `--scopes` values: it requests only explicitly supplied scopes, has no implicit scope defaults, and the final grants are clipped to your account's role.\n- **Password login is not a public flow.** AllScale Pay Accounts are passkey-only and have no usable password; `device-login` and `otp-login` are the two ways in. Accounts specially provisioned with a password authenticate through an internal-only flow that mints the same scoped, expiring agent key (`--scopes` required, no full-permission default).\n\n### Discovery\n\nThe schema-introspection commands below are opt-in (default off) — enable with `ALLSCALE_ALLOW_RAW=1`.\n\n| Command | Description |\n|---|---|\n| `operations` | List every operation in the schema (filter by `--kind`, `--grep`). |\n| `describe ` | Full type info for one operation: args, return type, example document. |\n\n### Ergonomic wrappers\n\nThe CLI's user-facing surface matches the AllScale web app: what users call an **invoice** is internally a `Payment` in the backend GraphQL. The `invoice *` commands below wrap `payments` / `payment` / `sender_payments` / `recipient_payments` / `create_payment` / `update_payment` accordingly.\n\n**Important:** The financial commands below are available only to eligible users in supported jurisdictions. Execution may be delayed, rejected, suspended, returned, or require additional information to comply with applicable law, sanctions, AML/CTF requirements, fraud controls, network conditions, or service-provider requirements.\n\n| Command | Description |\n|---|---|\n| `invoice list` | List invoices for a business. Wraps `payments`. Defaults `--business-id` from the JWT. **Defaults to the first 50 rows** — pass `--input '{\"limit\":N,\"skip\":M}'` to paginate, or `--all` to request the backend's unpaginated result in one response. Read-only responses remain subject to the CLI's 32 MiB safety limit. Filter with `--status` / `--payment-type` (both repeatable — repeated values match any of them) and the creation-date range `--from` / `--to`. **The range is half-open: `--from` is inclusive, `--to` is exclusive**, so `--from 2026-07-01 --to 2026-08-01` is exactly July and consecutive ranges tile without double-counting a boundary row. Both accept a plain date, a naive datetime (read as UTC), or an offset datetime, and are normalized to the backend's required `YYYY-MM-DDTHH:MM:SS.ffffffZ`. `--to-email ` narrows to the invoices you **issued** to that contact — an invoice's contact record belongs to the business that issued it, so on this both-directions view the flag selects the issued half. The email is resolved to an existing contact first, and an email with no contact is a structured `input.invalid` error (exit 2), not an empty list. On an agent key that lookup additionally needs the `contact:read_only` scope. `--input` accepts only the documented QueryInput fields. |\n| `invoice get ` | Fetch one invoice by id. Wraps `payment`. |\n| `invoice sent` | Invoices where **you are the payer** — your business owes the money. Wraps `sender_payments` (the backend's `sender` is the payer). Invoices you issued with `invoice send` are **not** here; see `invoice received`. Same pagination defaults and the same `--status` / `--payment-type` / `--from` / `--to` filters as `invoice list`. **No `--to-email`**: an invoice's contact record belongs to the business that issued it, so your own contacts never appear on the invoices you owe — the flag is refused here with `input.invalid` rather than answering with a misleading empty page. |\n| `invoice received` | Invoices where **you are the payee** — the money is owed to your business. Wraps `recipient_payments` (the backend's `recipient` is the payee). **Includes everything you issued with `invoice send`.** Same pagination defaults and the same `--status` / `--payment-type` / `--from` / `--to` / `--to-email` filters as `invoice list`; this is the command `--to-email` fits exactly, since every row here is one you issued. |\n| `invoice send` | Issue an invoice by email. Resolves `--to-email` to a contact (auto-creates via `--auto-create-contact` if missing), renders the invoice HTML body locally, and submits `create_payment` through the authenticated session. The recipient does **not** need any prior relationship with you — any valid email can be invoiced — but auto-creating its contact record needs `contact:all` on an agent key. The full send also needs `invoice:all`, plus `wallet:read_only` when you omit `--wallet-id`. A bare `device-login` starts every category OFF and its new key replaces the old one, so select Contacts write and Invoices Allow changes plus Wallets read (unless using `--wallet-id`) in the same re-login; the CLI detects a key that can't create contacts and fails fast with this complete remediation instead of relaying the backend's scope refusal. USDT/USDC totals below 0.10 are rejected before contact or wallet lookup, and `--payment-type` accepts only its documented values (0 fiat / 1 USDT / 2 USDC) — anything else is rejected locally as `input.invalid` (exit 2) and never sent. Pass `--wallet-id` to pin receiving wallets (backend-resolved — works with an invoice-scope-only key), or omit it to auto-select from your wallets via the narrow `business_wallets` query. **No browser ceremony** — the payer signs when paying; the inviter doesn't sign at issue. |\n| `invoice update ` | Update an existing invoice. Wraps `update_payment`. |\n| `invoice pay ` | Pay an invoice where **you are the payer**, from your AllScale wallet — list them with `invoice sent`, NOT `invoice received`. Resolves the invoice's destination + amount, moves the funds via the same signing path as `wallet send` (the transfer is confirmed in the browser at `/cli`), then reports and confirms the payment. **Needs TWO scopes** — `invoice:all` to create, report and confirm the pay intent, and `wallet:all` to register the withdrawal (the same `withdraw_token` broker op as `wallet send`; it also covers the payer-address lookup via the narrow `business_wallets` query). A bare `device-login` starts every category OFF: request BOTH `--scopes invoice:all --scopes wallet:all` to preselect them, or turn on both Allow-changes switches on the approval screen. On `otp-login`, pass the same two values: it requests only explicitly supplied scopes, has no implicit scope defaults, and the final grants are clipped to your account's role. |\n| `transaction list` | Paginated transactions. `--scope mine\\|business\\|activities`. Wraps `my_transactions` / `business_transaction_records` / `activities`. Defaults to the first 50 rows; pass `--input` (mine/business) or `--limit N` (activities) to override, or `--all` to request one unpaginated response (still capped at 32 MiB by the CLI). Filter by time with `--from` / `--to` in every scope — the same **half-open** range as `invoice list` (`--from` inclusive, `--to` exclusive, same accepted datetime spellings), applied to `created_at` under `mine`/`business` and to `transaction_time` under `activities`. Under `--scope business`, additionally filter with `--direction` (`INFLOW`/`OUTFLOW`), `--transaction-type` (`PAYMENT`, `WITHDRAWAL`, `CLAIM_LINK`, …) and `--status` (`NEW`/`SUCCESS`/`FAILED`/`CONFIRMING` — transaction statuses, not invoice statuses); these map to `business_transaction_records`' typed GraphQL arguments, each accepting the enum name (case-insensitive) or a raw integer. The other scopes reject them with the typed alternative they do have (`activities` takes list-valued `directions` / `transaction_types` / `transaction_statuses` via `--input`). |\n| `transaction get ` | Fetch one transaction by id. |\n| `wallet list` | Your noncustodial wallets and per-coin balances via the narrow `business_wallets` query. Works with an agent key holding `wallet:read_only`; the owner is derived from the authenticated identity. |\n| `wallet send` | Withdraw USDT/USDC from your AllScale wallet to an external EVM address. **Needs `wallet:all`** on an agent key — that scope is what the broker checks before registering the withdrawal (`wallet:read_only` alone cannot). Registers a `withdraw_token` op with the broker, opens the browser at `/cli` for the passkey + Turnkey signing ceremony, and succeeds only after the browser confirms the on-chain receipt — the receipt-aware result comes back through the loopback listener (a mined revert exits `12`, an unconfirmable receipt exits `9`). The transfer is always confirmed in the browser; over SSH, open the printed URL on any device and paste the full result JSON back. |\n\n### Claim links\n\n**Important:** The financial commands below are available only to eligible users in supported jurisdictions. Execution may be delayed, rejected, suspended, returned, or require additional information to comply with applicable law, sanctions, AML/CTF requirements, fraud controls, network conditions, or service-provider requirements.\n\nSender-side reads (`get` / `list`) need a CLI login and `claim_link:read_only` under an agent-key session. `claim-link create` needs `claim_link:all`: the CLI fixes the amount, stablecoin, chain, claim window, optional sender metadata, and caller-stable idempotency key before registering the `create_claim_link` broker op. The AllScale-hosted browser approval page shows that immutable intent as a read-only review, then performs creation, signing, and funding after the payer authorizes it; verify the exact AllScale origin before approval. It does not ask the payer to re-enter or edit the payment. Before opening the browser and again after any callback, cancellation, invalid receipt, or timeout, the CLI reconciles the complete intent through `claim_link_funding_by_idempotency_key`; the browser receipt is advisory. `status` and `claim` drive the public receiver-facing REST surface — no login; the bearer claim token IS the credential.\n\n| Command | Description |\n|---|---|\n| `claim-link create` | Create and fund a fixed-intent Claim Link through an AllScale-hosted browser approval flow. Verify the exact AllScale origin before approval. Requires `--idempotency-key` (1–128 trimmed characters), `--amount` (exact decimal string, 0.1–10000, at most 6 effective decimal places), `--chain`, and agent-key scope `claim_link:all`; `--stable-coin` defaults to USDT and `--expires` to 14d. `--no-browser` skips only local auto-open: the CLI still prints the `/cli` URL and waits for callback/paste. A recovered key must match every immutable field; a pre-browser mismatch exits 2 as `claim_link.intent_conflict` without opening the browser. Success is emitted only when the authoritative lookup returns the same intent, a validated AllScale claim URL, and either `LINK_SENT`, `CLAIMING`, or `CLAIMED`, or returns `EXPIRED` or `CANCELLED` with a validated non-empty funding transaction hash. A signed/broadcast/unknown, still-pending, failed-reconciliation, post-browser intent race, or `EXPIRED`/`CANCELLED` result without that funding proof exits 9 as `claim_link.funding_ambiguous`; follow its retry metadata and never substitute a new key. Only an explicit cancellation before creation plus a successful authoritative miss exits 12 as `claim_link.browser_cancelled`. |\n| `claim-link get ` | Fetch one of your own Claim Links by id. Wraps `claim_link`; a non-owned id is indistinguishable from an unknown one. Agent-key scope: `claim_link:read_only`. |\n| `claim-link list` | Your own Claim Links, newest first. Wraps `my_claim_links`. Defaults to the first 50 rows; `--input` paginates and `--all` requests one unpaginated response (still capped at 32 MiB by the CLI); `--status` filters. Agent-key scope: `claim_link:read_only`. |\n| `claim-link status` | Public receiver-facing status snapshot for a bearer claim token/URL. Canonical URLs are parsed locally; a same-origin `/s/` URL is resolved through one credential-free 302. No login — the token is the credential. |\n| `claim-link claim` | Claim a link from a raw token, canonical URL, or same-origin `/s/` short URL: Path A without AllScale account sign-in with `--to <0x address>` (no login), or `--to-wallet` into the authenticated business's AllScale wallet (cookie session). This does not make the transaction anonymous: network, request, compliance, and public blockchain data may still be processed or observable. Only the on-chain-proven `claimed` outcome exits 0; an expired or not-claimable link exits 12, a token the backend will not resolve at all exits 7 (404), while pending/unproven payouts exit 9 and must be reconciled before another claim. |\n\n### Store\n\n| Command | Description |\n|---|---|\n| `store create` | Create a store for the logged-in business (no store key, no browser ceremony). Wraps `create_store`. Defaults `--business-id` from the session token — the JWT `user_id` for cookie sessions, or the owner business id stored at login for agent-key sessions (re-run `device-login` if an older agent-key login has none stored); `--live` creates a live store (default is sandbox). Returns the API key and an API secret that is **shown only once** on stdout (it cannot be retrieved later — capture it now; the credential itself stays valid). This command does not enroll the store for Payout. Business must have checkout enabled; only one sandbox store is allowed per business. |\n\n### Payout\n\n**Important:** The financial commands below are available only to eligible users in supported jurisdictions. Execution may be delayed, rejected, suspended, returned, or require additional information to comply with applicable law, sanctions, AML/CTF requirements, fraud controls, network conditions, or service-provider requirements.\n\n**Authorization is set up in the dashboard, not here.** Enabling auto-payout,\nchanging its limits, and turning it off all complete with a passkey in a human\nweb session — a credential this CLI's logins never mint. Do those in **Store\nSettings → Payout Authorization**. The CLI reads the resulting session and\nspends from it.\n\n| Command | Description |\n|---|---|\n| `payout status` | Read the current claim-link auto-payout session, limits, remaining budget, and expiry. |\n| `payout send` | Create and synchronously fund a claim link using a live, Payout-onboarded store key. `--reference-id` is required for idempotent retry. Store HMACs go only to the standalone partner API at `https://openapi.allscale.io`, which is the default — `--payout-api-base` / `ALLSCALE_PAYOUT_API_BASE` exist to set it explicitly, not because you need to change it. |\n\n### Keys\n\nAgent API keys are managed in the **AllScale web dashboard**: Settings → Security → Sessions · Agents & Devices. It lists every credential and offers per-key revoke plus a revoke-all kill-switch. Creating a key stays where it always was — the login flows below — and rotation is revoke-then-log-in-again; there is no separate rotate control.\n\nThe CLI mints a key for its own session when you log in (`device-login` / `otp-login`) and prints its scopes and expiry via `allscale scope` / `allscale whoami`. It does not provide key administration: those are control-plane actions that the current backend is designed to reject for an agent-key session, which is the credential type issued by the current CLI login flows.\n\n## Configuration\n\n- **Tokens**: stored in the OS keychain (macOS Keychain / Windows Credential Manager / libsecret) by default. On POSIX, pass `--insecure-storage` (or set `ALLSCALE_INSECURE_STORAGE=1`) to **force** a plaintext file at `~/.allscale/credentials.json` (mode 0600) instead of the keychain — it takes precedence and is intended for headless / CI / agent use where a keychain is unavailable. Plaintext credential storage is not supported on Windows in the current implementation because Node's POSIX mode APIs cannot reliably verify owner-only ACL/link safety; use Windows Credential Manager instead. Without the opt-in, the CLI is designed to return an error rather than silently downgrade when the keychain is unavailable. `ALLSCALE_NO_KEYCHAIN=1` makes the CLI treat the keychain as unavailable at runtime and is designed not to probe it.\n- **Store credentials**: `store create` returns the one-time secret on stdout and does not persist it. Historical credentials in the OS keychain or `~/.allscale/store-credentials.json` are still removed by `logout`; the current implementation does not write them to config.toml.\n- **Logout confirmation**: a bare `allscale logout` at an interactive terminal states what it will delete and asks for confirmation first; declining exits 12 (`user.cancelled`) with nothing removed. The prompt is bare-invocation only — any flag (including `--yes`) skips it — and never appears for `--json`, a pipe, a sidecar, ordinary non-tty CI, or a redirected stderr. Automation that allocates a pty for all three streams *and* runs the command bare is indistinguishable from a human and is prompted; pass `--yes`. Unlike `device-login`, whose prompt shipped with the command, `logout`'s bare form predates this gate, so an existing pty-allocating job that relied on it wiping unattended must add `--yes` (without stdin it now declines and exits 12, having removed nothing).\n- **Logout storage scope**: `allscale logout` with no insecure-storage flag or environment opt-in requests a full sweep of both plaintext credential files and the OS keychain. If keychain access is suppressed, missing, or broken, it still clears the files but exits non-zero because historical keychain credentials may remain. `allscale logout --insecure-storage` (or `ALLSCALE_INSECURE_STORAGE=1`) is designed as file-only and does not intentionally probe the keychain, to avoid GUI prompts for headless/CI agents. On Windows, an absent plaintext target is treated as a no-op; logout can remove a valid legacy file when the requested profile is its only remaining profile. A shared, malformed, or unverifiable legacy file is expected to remain unchanged and requires deliberate manual cleanup.\n- **Profile metadata**: `~/.allscale/config.toml` (mode 0600) records `api_base` and `user_type` per profile. Non-secret.\n- **Profiles pin their backend.** Logging in saves the backend it used into `~/.allscale/config.toml`, and a saved profile beats the built-in default. The CLI does **not** switch a configured endpoint automatically: stored credentials are bound to the origin used at login.\n- **Default backend**: `https://app.allscale.io` (production). Published builds are configured for their bound AllScale environment. The current implementation accepts a credential-bearing api-base only for exact AllScale origins (plus an explicit loopback origin for development), and validates session credentials against the origin recorded at login. `payout send` uses a separate approved partner API origin selected with `--payout-api-base` / `ALLSCALE_PAYOUT_API_BASE`. Embedded URL userinfo (`user:password@host`) is rejected. Browser targets must be `https://`, or `http://` to loopback only. The current implementation is designed not to follow redirects when a request carries credentials; callers should still verify the destination origin and TLS before approving or transmitting sensitive data.\n- **Sidecar event log** (opt-in, off by default): set **`ALLSCALE_OUTPUT_FILE_PATH=/path/to/run.ndjson`** to append a machine-readable NDJSON event stream for the run, or **`ALLSCALE_OUTPUT_FILE_DIRECTORY=/path/to/dir`** to give every run its own randomly named file in that directory. Events may cover the command, argv fields designed to redact specified authentication secrets, request URLs, responses, refreshes, bridge steps, and errors — intended for agent supervisors and orchestrators that need structured progress without parsing stdout. Redaction is not a guarantee that the log contains no sensitive information.\n\n `device-login` writes its short-lived pairing code and URL as the sidecar-v2 `device_authorization` event before polling. Treat that event as sensitive and do not publish it to an untrusted log sink.\n\n **Important:** Sidecar logs are designed to redact specified authentication secrets, but may still contain personal, business-confidential, and transaction data. Treat them as sensitive. Do not place them in shared directories or transmit them to third-party agents or support channels without review. Configure appropriate access controls, retention, and secure deletion.\n\n On POSIX systems, the current implementation attempts to create files with mode 0600. A directory selected through `ALLSCALE_OUTPUT_FILE_DIRECTORY` is intended to be created owner-only; if it already grants group/other access, the CLI is designed to refuse writing rather than change a potentially shared directory such as `/tmp`. For an explicit `_PATH`, the current implementation does not change permissions on an existing parent directory, so choose a private parent yourself; it is designed to refuse an existing output file unless it is owner-only (rotate/remove an older loose file first). Sidecar output is currently disabled on Windows because Node's mode APIs cannot reliably enforce or verify owner-only NTFS ACLs. **It is still a file on disk that describes your session**: prefer `_DIRECTORY`, which generates an unpredictable filename, over a fixed `_PATH` on a shared machine. A `_PATH` that is a symlink is designed to be refused rather than written through. The file is append-only with no rotation and is currently capped at 64 MB, after which the sidecar is designed to disable itself for the run with a warning on stderr.\n\n## Output contract\n\nJSON to stdout by default. Stable shapes — agents can parse without quoting hacks.\n\n```bash\n$ allscale whoami\n{\n \"data\": {\n \"profile\": \"default\",\n \"api_base\": \"https://app.allscale.io\",\n \"credential\": \"cookie\",\n \"user_id\": \"...\",\n \"user_email\": \"you@example.com\",\n \"expires_at\": \"2026-05-07T03:35:02.000Z\",\n \"expired\": false,\n \"storage\": \"keychain\"\n }\n}\n```\n\nIn an agent-key session (no JWT) the shape is key-mode instead:\n\n```bash\n$ allscale whoami\n{\n \"data\": {\n \"profile\": \"default\",\n \"api_base\": \"https://app.allscale.io\",\n \"credential\": \"agent_key\",\n \"business_id\": \"...\",\n \"user_type\": \"business\",\n \"scopes\": [\"invoice:all\", \"contact:read_only\"],\n \"expires_at\": \"2026-05-07T03:35:02.000Z\",\n \"expired\": false,\n \"storage\": \"keychain\"\n }\n}\n```\n\nErrors go to stderr as JSON with stable codes:\n\n```bash\n$ allscale whoami\n# stderr:\n{\n \"error\": {\n \"code\": \"auth.no_token\",\n \"message\": \"No tokens stored for profile 'default'. Run `allscale device-login --profile default` (recommended), or use `allscale otp-login --profile default --email --scopes --otp-stdin` for headless automation.\"\n }\n}\n# exit code: 4\n```\n\n### Exit codes\n\nStable contract — branch on these. Every error code the CLI can emit maps to\nexactly one of them, and a mapping is never renumbered once shipped.\n\n| Exit | Meaning | Error codes |\n| ---- | ------- | ----------- |\n| `0` | success | — |\n| `1` | generic / unexpected | `internal` |\n| `2` | caller-actionable input or local limit — fix the invocation and re-run | `input.invalid`, `storage.unavailable`, `transport.response_too_large`, `auth.unknown_profile`, `claim_link.intent_conflict`, `signing.key_unavailable` |\n| `3` | network / transport failure, or a confirmation deadline passed (**see the retry warning below**) | `transport.network`, `transport.timeout`, `auth.credential_changed`, `wallet.bridge_timeout`, `wallet.bridge_op_expired`, `auth.device_pairing_timeout` |\n| `4` | not authenticated — run `allscale device-login` | `auth.no_token` |\n| `5` | credential expired or malformed — re-authenticate | `auth.token_expired`, `auth.token_invalid` |\n| `6` | not fixable by this invocation: permission denied, or a capability gap | `auth.permission_denied`, `wallet.requires_browser_auth` |\n| `7` | not found — the object you named does not exist | `not_found` |\n| `8` | rate limited, or a payout create for the same `reference_id` still in flight — **the two share this code**, so read `details` before deciding whether to retry or to poll | `rate_limited` |\n| `9` | backend internal, or an **ambiguous** mutation or transaction result | `backend.internal`, `claim.payout_ambiguous`, `claim_link.funding_ambiguous`, `wallet.bridge_invalid_response`, `wallet.transaction_status_unknown` |\n| `10` | escape hatch disabled — export `ALLSCALE_ALLOW_RAW=1` | `raw.disabled` |\n| `11` | this build's request signature was rejected — **upgrade the CLI** (re-login does not help) | `auth.signature_rejected` |\n| `12` | did not complete; nothing was created, or an on-chain attempt reverted without transferring | `claim.not_claimable`, `claim.expired`, `claim_link.browser_cancelled`, `user.cancelled`, `wallet.transaction_reverted` |\n\n> **An exit code is NOT a retry-safety signal. Branch on the `code` string when\n> you need to decide whether re-running is safe.**\n>\n> Exit `3` is the trap: `transport.network` never reached the server, but\n> `wallet.bridge_timeout` and `wallet.bridge_op_expired` are **post-signing** —\n> the browser may already have signed and the backend may already have\n> broadcast. Retrying blindly on exit `3` can **double-pay**. Exit `9` mixes a\n> plain 5xx with the `*_ambiguous` codes **and `wallet.transaction_status_unknown`**\n> (a broadcast whose receipt never confirmed — funds may already have moved),\n> all of which must be reconciled against the original idempotency key rather\n> than retried. Exit `12` now also carries a post-signing code:\n> `wallet.transaction_reverted` means the transaction was mined and reverted —\n> nothing transferred, but gas was spent — so treat any retry as a new\n> transfer decision.\n\n> **`wallet.bridge_timeout` vs `wallet.bridge_op_expired`.** Both mean \"no\n> confirmation came back\", but they need different follow-ups:\n>\n> - `wallet.bridge_timeout` — a deadline **the CLI itself** reached, which is not\n> proof the link died. Which one it was decides what helps, and the message says\n> so: your own `--bridge-timeout` running out while the link was still valid (a\n> longer one genuinely helps next run); the link's own lifetime running out (a\n> longer one cannot help, and this is the ONLY case the error message names — it\n> tells you the link is expired or about to be, and that a longer wait is useless;\n> the remedy itself comes later in the message, after the check-your-wallet\n> warning); that same lifetime measured\n> against your machine's clock, when the response carried no server timestamp to\n> check it against (same remedy, but approximate — a fast local clock makes the\n> wait short, a slow one makes it long); the fallback used when the server gave\n> no usable expiry at all; or a clamp at Node's ~24.8-day timer limit.\n> Apart from the lifetime case, these share one message, so don't try to tell\n> them apart by parsing it — when the CLI shortens or ignores your value it says\n> which constraint bound the wait in a `Note:` line on stderr as it starts.\n> - `wallet.bridge_op_expired` — **the server** reported the operation behind the\n> link as expired, so the link is definitively dead. **Raising\n> `--bridge-timeout` cannot help** — it is capped at the link's remaining life\n> precisely because the link cannot outlive its operation. A fresh link is the\n> remedy, but check the wallet/transfer first: this error means the browser may\n> already have signed, so the message puts that warning before the retry advice.\n>\n> The link's remaining life is normally measured against the **server's** clock,\n> not your machine's — the CLI reads the server's own timestamp from the same\n> response — so a wrong local clock cannot shorten your wait or turn a live link\n> into a reported expiry. The CLI's own deadline is set slightly early on purpose,\n> which is why reaching it reports a timeout — saying the link \"has expired or is\n> about to\" — rather than asserting the link is gone; only the server does that.\n>\n> One exception, and the CLI tells you when you are in it: if something between you\n> and the server strips the timestamp (some proxies do), the CLI has to fall back to\n> your machine's clock, and says so in the note it prints. That reading is\n> approximate in both directions — a fast clock makes the wait shorter than the\n> link's real life, a slow one can make it longer — so it is treated as a bound,\n> never as a fact, and it is additionally capped at 15 minutes so a badly wrong\n> clock cannot buy an open-ended wait. If your waits look wrong, check the clock\n> (`sntp`/`timedatectl`) before anything else.\n>\n> In both cases check the wallet/invoice first: the browser may have signed just\n> before the deadline.\n\nExit `7` covers both a REST `404` and a GraphQL response whose backend code\nmeans \"no such object\" — the two paths are deliberately aligned, so\n`allscale transaction get ` and a login for an unregistered\naccount both exit `7`.\n\nOne documented asymmetry, because \"not found\" does not always describe an\nobject **you** named: on the login path, \"this email has no AllScale account\"\nis exit `7`, but a data query failing because the signed-in account has no\nbusiness is exit `2` — there is no id you could supply to fix the second, so\nsending you hunting for one would be wrong. Two further backend \"not found\"\nconditions are likewise **not** exit `7` on the GraphQL path: an unknown agent\nkey and an un-provisioned Turnkey wallet sub-org both fall into the generic\nexit `2` bucket there. (A *rejected* credential is a different thing and does\nexit `5`, but that comes from a real `401`, not from translating a backend\n\"not found\" code — so do not branch on exit 5 for these conditions on a\nGraphQL call.)\n\n`transaction get` applies the same local rule: an id that is not 24 hexadecimal\ncharacters is `input.invalid` (exit `2`) and never sent, so a typo cannot come\nback as GraphQL transport text. A well-formed id the backend will not return is\na normal `not_found` (exit `7`).\n\nClaim links follow the same rule on the **sender** side: `claim-link get` exits\n`7` for a **syntactically valid** id (24 hex characters) that the backend will\nnot return — unknown, or owned by another business. It answers those two\nidentically on purpose, so a link cannot be probed for existence. An id that is\nnot 24 hex characters is rejected locally as `input.invalid` (exit `2`) before\nany request is sent, so a malformed argument never reads as a missing link.\n\n`claim-link claim`, the **receiver** command, splits along the same seam — the\nline is *\"did the backend resolve the token\"*, not sender-versus-receiver:\n\n- a token that is empty, or not 16–256 characters of `[A-Za-z0-9_-]`, is\n rejected **locally** as `input.invalid` (exit `2`) and never sent, exactly as a\n malformed id is on `claim-link get`;\n- a **syntactically valid** token that reaches the backend and resolves to no\n link the caller may see is a `404` and exits **`7`** — the same code, and the\n same anti-oracle reasoning, as the sender side;\n- only a link that *did* resolve and whose claim attempt was then refused —\n `expired` or `not_claimable`, returned as HTTP `200` with an `outcome` — exits\n **`12`**.\n\nSo branch on `7` for \"no such link\" on either command, keep `2` for input you\ngot wrong, and reserve `12` for a real link you were not allowed to claim.\n\n`claim-link status` reads the same token through the same public route, so it\nanswers the same way: a token that resolves to no link is a `404` and exits\n**`7`**, carrying the same written explanation rather than the backend's raw\nenvelope. An expired or already-claimed link is not that error — it resolves\nand comes back as an ordinary status snapshot.\n\n**Under `--json`, stderr is parseable too — for `payout send` and\n`device-login`.** On those, human progress prose is suppressed entirely and\nevery stderr line is one complete JSON object: the `{error}` envelope above is\nrendered compact in that mode, and notices you may need before the stdout\ndocument exists arrive as structured event lines:\n\n```bash\n$ allscale payout send --json --amount 10 --chain base ...\n# stderr:\n{\"version\":\"1\",\"event\":\"payout_destination\",\"payout_api_base\":\"https://...\"}\n{\"error\":{\"code\":\"input.invalid\",\"message\":\"Missing store API key...\"}}\n```\n\nBranch on `version` (currently `\"1\"`), ignore an `event` type you don't\nrecognise, and note that a stderr JSON line is not necessarily an error —\ncheck for the `error` key. Event fields are designed to be scrubbed and length-bounded, so\ntreat them as best-effort: an oversize record degrades to\n`{\"version\", \"event\", \"output_truncated\": true}`.\n\n**Treat the two commands named above as an allow-list, not a caveat: any other\ncommand still writes human prose to stderr, so do not read its stderr as\nNDJSON.** That includes the browser-bridge money paths (`wallet send`,\n`invoice pay`, `claim-link create`) and the ordinary read and auth commands\n(`scope`, `whoami`, `otp-send`, `otp-login`, `invoice send`, `store create`).\nConverting those is tracked separately. The `--show-doc` debug flag also prints\na raw GraphQL document to stderr wherever it is offered; that one is\ncaller-requested and stays that way, so don't combine it with a machine-parsed\nstderr. stdout stays a single JSON document on every command either way — this\nrule is about stderr only, and the compact `{error}` envelope is global.\n\nOne deliberate exception to \"every failure is an `{error}` document\": a command\nthat cannot run without input, invoked with **no arguments at all**, prints its\nhelp on stdout and exits 0 instead — the same as a bare topic\n(`allscale wallet`). Machine callers never take that path. A partial call still\nexits 2 with `input.invalid`, and a bare call is treated as machine mode —\nerror document, exit 2 — whenever **any** of these applies:\n\n- **stdin and stdout are not both a terminal** — a pipe, `$(...)`, a CI runner,\n an agent harness, or a terminal script with either stream redirected\n (`allscale wallet send < /dev/null`). This is the one signal that needs no\n opt-in, and it is how most machine callers show up.\n- `--json`\n- `ALLSCALE_CONTENT_TYPE=json`\n- a configured sidecar (`ALLSCALE_OUTPUT_FILE_PATH` / `ALLSCALE_OUTPUT_FILE_DIRECTORY`)\n\nThe last three matter even at a terminal, because none of them appear in argv:\n`--json` is an argument so it never reaches a bare call, while oclif resolves\nJSON mode from its env var before it inspects argv, and the sidecar is pure\nenvironment.\n\nThe sidecar counts because it is the audit stream a supervisor consumes: a bare\ncall there must record `command-end` with `ok: false`, never a success for a\ncommand that did not run. **Setting the variable is what counts** — a sidecar the\nCLI *refuses* to open (Windows, a `_DIRECTORY` that is not owner-only, a stale\n`0644` file) still means a supervisor is watching, and that is the worst moment\nto change the outcome, since no stream then exists to contradict the exit code.\n\n**Known limit:** two terminals are treated as a human, and that is not a proof.\nA harness that allocates a pty for *both* streams — `expect`, a PTY-configured CI\njob — will get help and exit 0 on a bare invocation. Set any one of the three\nopt-ins above in those harnesses to restore the `{error}` / exit 2 contract.\n\n```bash\n$ allscale wallet send # at a terminal: help on stdout, exit 0\n$ allscale wallet send | cat # piped: {\"error\": ...} on stderr, exit 2\n$ allscale wallet send --json # → {\"error\": {\"code\": \"input.invalid\", ...}}, exit 2\n$ ALLSCALE_CONTENT_TYPE=json allscale wallet send # → same {\"error\": ...}, exit 2\n$ ALLSCALE_OUTPUT_FILE_PATH=run.ndjson allscale wallet send # → same, and the stream ends ok:false\n```\n\n## Auto-refresh\n\nCookie-session tokens are refreshed automatically when the backend returns 401 — single-flight per process (concurrent calls share one refresh round-trip). When the refresh token itself is rejected, the CLI exits with `auth.token_expired` (code 5) and asks the user to re-login. If the profile's credential changes to an agent key while a refresh is in flight, the refresh is abandoned rather than overwriting it and the CLI exits with `auth.credential_changed` (code 3) — a valid credential exists, so the command just needs re-running, not a re-login.\n\n**Agent keys don't refresh.** A 401 in agent-key mode means the key expired or was revoked; the CLI surfaces `auth.token_expired` with a clear \"re-run `allscale device-login`\" message and does not attempt the refresh endpoint in the current implementation.\n\n## Upgrade-required signal\n\nRequests include a build identifier and an `x-allscale-cli-version` header. The service may use these values to enforce minimum supported versions, but they are not proof that a client build, environment, or request is uncompromised. If a release is no longer accepted, the CLI exits with **`auth.signature_rejected` (code 11)** and directs the user to install the latest version with `npm install -g @allscale/cli@latest`. If the latest version is already installed and the same code persists, contact AllScale support. When running from source or an internal build without a baked key for the selected destination, configure `ALLSCALE_SIGNING_KEY` or `ALLSCALE_BUILD_PAIRS`; if no signing key resolves for that destination, the CLI exits **2** (`signing.key_unavailable`). Do not rely on this version-enforcement mechanism as an authentication or integrity boundary.\n\n## Credential precedence\n\nHighest priority first:\n\n1. `ALLSCALE_TOKEN` env var\n2. `--profile ` flag → keychain entry for that profile. A name with no\n entry in `~/.allscale/config.toml` errors with `auth.unknown_profile`\n (exit 2) when no credential is found for it and at least one profile is\n saved. The error names only the requested profile; saved profile names are\n not disclosed. A typo'd profile is an input error, not a login prompt. (An\n empty registry is a fresh machine: that stays `auth.no_token`.)\n3. `ALLSCALE_PROFILE` env var → keychain entry (same `auth.unknown_profile`\n rule as the flag).\n4. Default profile from `~/.allscale/config.toml`\n5. Otherwise → `auth.no_token` (exit 4)\n\n`auth.unknown_profile` deliberately shares exit 2 with other input errors\n(e.g. `input.invalid`, `storage.unavailable`); when an exit-2 branch needs to\nknow which one fired, the `error.code` field is the load-bearing\ndiscriminator, not the exit number.\n\n## Capabilities\n\n- Codegen-driven `operations` / `describe` discovery commands (opt-in escape hatches).\n- Ergonomic wrappers: `invoice`, `transaction`, `claim-link`, `wallet list`.\n- Agent-key invoice creation: explicit, backend-resolved `--wallet-id`s, or automatic wallet selection via the narrow `business_wallets` query; invoice issuance itself needs no browser ceremony.\n- `device-login` (device-pairing OAuth) / `otp-login` (terminal OTP for headless shells), and `wallet send` (Turnkey-direct EVM withdraw through the `/cli` bridge).\n- Current CLI login flows issue scoped agent-key sessions: `device-login` and `otp-login` both mint an agent API key checked against its granted scopes; `scope` reports the granted set + key expiry.\n- Agent-key sessions store the owner `business_id` at login, so `--business-id` auto-fills (no JWT needed) and `whoami` prints a key-mode identity instead of erroring.\n- Store creation returns its API secret (shown once, not retrievable later) through the structured stdout result.\n\n## Security\n\nReport a vulnerability by email to **security@allscale.io** — please do **not**\nopen a public issue. Include the impact, a minimal reproduction (commands,\nenvironment, `allscale --version`), and whether it is exploitable without an\nAllScale account. We aim to acknowledge within 3 business days and to ship a fix\nor mitigation for high-severity issues within 30 days, coordinating disclosure\nwith you.\n\nIn scope: this package and its bundled code — the loopback browser bridge, token\nstorage (keychain vs. plaintext-file fallback and its file permissions), and\nargv/URL redaction in the sidecar event log. Out of scope, and best reported to\nthe AllScale platform team through the same address: the backend API and the web\napp at `https://app.allscale.io`.\n\n**Two values baked into the shipped bundle are not secrets, by design**: the\nrequest-signing key and the static API bearer. Both are recoverable from any\ninstalled copy and are build-identity markers only — they assert \"this request\ncame from an official AllScale client build\" and are not intended as an\nauthorization boundary. In the current implementation, the backend is designed\nto authorize requests using the per-user credential — a session JWT, or an agent\nkey whose granted scopes it checks on each request.\nExtracting either value from the bundle is expected behavior rather than a\nfinding, unless you can also show the backend making an **authorization**\ndecision from one of them.\n\nOnly the latest published version on npm receives security fixes; pin a recent\nversion in CI.\n\n## License\n\nProprietary — `@allscale/cli` is licensed, not sold, and is not open source.\nYour use of it, and of the AllScale services it reaches, is governed by the\nAllScale User Agreement & Terms of Service:\n\nhttps://www.allscale.io/agreement\n\nThat agreement is the whole of the terms — this package ships no separate\nlicence file, and `package.json` declares `UNLICENSED` to say there is no\nopen-source grant. Runtime dependencies are installed separately by your\npackage manager and keep their own licenses.\n","readmeFilename":"README.md"}