# CLI command reference

Every subcommand of the `kryard` CLI/TUI. Verified directly against `kryard
--help` on the latest release (`0.1.0`).

If you just want the install + quickstart, start at [CLI overview](/cli/). The flags
below are the full surface — including the global flags every subcommand inherits.

::: tip Global flags
These apply to **every** command:

| Flag | Purpose |
|---|---|
| `--json` | machine-readable output (skip the human formatting) |
| `--org <id>` | organization id (overrides the saved default in `~/.config/kryard/config.toml`) |
| `--profile <name>` | select a named config profile (default profile name lives in config) |

Secrets are never accepted as a flag — they come from stdin or the OS keychain.
:::

## `kryard login`

Store credentials in the OS keychain. Two forms, one per [auth tier](/cli/#two-tiers-two-logins):

```bash
kryard login --api-key --generate    # mint a P-256 API key; prints the PUBLIC half
kryard login --api-key               # import an existing API key: private key read from stdin
kryard login                         # device login (browser + paste-phrase flow → /dashboard/v1/*)
```

| Flag | Tier | Purpose |
|---|---|---|
| `--api-key` | api-key | use the X-Stamp (`/public/v1/*`) tier |
| `--generate` | api-key | generate a fresh P-256 key instead of importing one |

After `--api-key --generate`, register the printed **public** half in the console's
API-Keys panel before the key can authenticate. Importing reads the **private** key
hex from stdin (never argv) so it does not appear in `ps` or shell history.

The device-login flow opens a URL, you sign in with email/passkey in the browser,
approve, and paste the printed phrase back into the CLI. The refresh token is stored
in the OS keychain, the access JWT is cached in-memory, and rotation on expiry is
automatic.

## `kryard logout`

Revoke the device session and clear stored tokens.

```bash
kryard logout
```

API-key login (an offline key in the keychain) is unaffected — `logout` revokes the
**device session**, not an API key. To remove an API key, delete the profile or
[harden-delete the key from the console](/signing/).

## `kryard org`

Select and inspect the active organization. Multi-org users need to pick one before
any tier-specific operation (X-Stamp API keys are scoped to one org; the device
tier surfaces all of them).

```bash
kryard org ls                  # list every org this user belongs to (device-login tier)
kryard org show                # show the effective org for the current profile
kryard org use <organization-id>  # persist the default org in the config file
```

`org ls` is the one read path unique to the device tier — a single API key cannot
list the orgs the underlying human user belongs to.

## `kryard whoami`

Show the organization the current API key / session is bound to. Verifies the
keychain + config wiring against the live server in one round-trip.

```bash
kryard whoami
```

## `kryard wallets`

List and inspect Kryard-custodied wallets. (`wallet` is an alias.)

```bash
kryard wallets ls
kryard wallets get <wallet-id>
```

## `kryard activities`

List and inspect activities (the immutable unit of work + idempotency + audit).

```bash
kryard activities ls
kryard activities get <activity-id>
```

`get` returns the full activity envelope (status, intent, result, failure) in the
shape documented under [`/signing/`](/signing/). With `--json` it is byte-identical
to what `@kryard/sdk` returns from `/public/v1/query/get_activity`.

## `kryard sign`

Sign with a Kryard-custodied key. Two subcommands:

### `sign raw`

```bash
kryard sign raw --key <addr-or-id> --payload 0x…
# default hash: HASH_FUNCTION_KECCAK256 (EVM-style)
kryard sign raw --key <id> --payload 0x… --hash HASH_FUNCTION_SHA256
```

| Flag | Required | Purpose |
|---|---|---|
| `--key` | yes | `signWith`: wallet address or private-key id |
| `--payload` | yes | hex payload to sign |
| `--hash` | no | hash function (default `HASH_FUNCTION_KECCAK256`); use `HASH_FUNCTION_NOT_APPLICABLE` for ed25519 chains that sign the message bytes directly (Solana, Sui) |

### `sign tx`

```bash
kryard sign tx --key <addr-or-id> --unsigned 0x…
```

| Flag | Required | Purpose |
|---|---|---|
| `--key` | yes | `signWith`: wallet address or private-key id |
| `--unsigned` | yes | hex unsigned transaction |

`sign tx` is the EVM transaction-signing path — see [Signing](/signing/signing) for
the on-the-wire shape.

## `kryard eoa`

Manage the **local** EOA signing key for the relay & sponsorship lanes (your own
account, NOT a Kryard-custodied one). The relayer key itself is Kryard-custodied;
this is just what signs the 7702 authorization for sponsored execution.

```bash
kryard eoa import          # paste EOA private key hex from stdin → prints the address
kryard eoa address         # show the stored EOA address
```

Only the **address** is ever printed — the private key is read from stdin, stored in
the OS keychain, and never re-exported.

## `kryard relay`

Managed relay (gas tank): balance, submit, status.

### `relay balance`

```bash
kryard relay balance
```

### `relay submit`

```bash
kryard relay submit --key <relayer-addr-or-id> --chain 11155111 --to 0x… \
    [--value <wei>] [--data 0x…]
# EIP-7702 sponsored execution — signs a 7702 authorization with the stored EOA:
kryard relay submit --key <relayer> --chain 11155111 --to 0x… \
    --authorize <delegate-contract> --auth-nonce <eoa-account-nonce> \
    [--data 0x…] [--value <wei>]
```

| Flag | Required | Purpose |
|---|---|---|
| `--key` | yes | relayer `signWith`: address or private-key id |
| `--chain` | yes | decimal chain id |
| `--to` | yes | recipient address |
| `--value` | no | value in wei (decimal or `0x`-hex) |
| `--data` | no | calldata `0x…` |
| `--authorize` | no | EIP-7702 delegate contract to authorize (signs the auth with the stored EOA) |
| `--auth-nonce` | w/ `--authorize` | EOA account nonce for the 7702 authorization |
| `--gas-limit` | no | explicit gas limit (else estimated server-side) |
| `--gas-token` | no | ERC-20 gas-token address (paymaster lane — see [Pay gas in any token](/relay/erc20-gas)) |
| `--gas-token-amount` | no | agreed token fee the user reimburses on-chain |
| `--speed` | no | fee tier: `slow` / `average` / `fast` |
| `--idempotency-key` | no | dedupe key; a repeat returns the existing tx |

Flags you cannot pass: the relayer nonce, fees, and (default) gas estimation are
sourced server-side by the relay pipeline. `--auth-nonce` is the one EOA-state value
the CLI requires you to source explicitly so it does not race a stale nonce.

### `relay status`

```bash
kryard relay status <transaction-id>
```

Returns the relay transaction's lifecycle state — `pending` → `confirmed` / `failed`
/ `expired`. With `--json`, the same shape the SDK's `client.get(id)` returns.

## `kryard sponsor`

Request ERC-4337 gas sponsorship for a v0.7 UserOperation. Kryard signs the
paymaster hash; a **bundler broadcasts** (you supply it).

```bash
kryard sponsor --chain 11155111 --user-op ./userop.json \
    [--valid-after <unix-sec>] [--valid-until <unix-sec>]
# UserOp JSON from stdin:
cat userop.json | kryard sponsor --chain 11155111 --user-op -
```

| Flag | Required | Purpose |
|---|---|---|
| `--chain` | yes | decimal chain id |
| `--user-op` | yes | path to a v0.7 UserOperation JSON file (`-` for stdin) |
| `--valid-after` | no | sponsorship signature validity lower bound (unix seconds) |
| `--valid-until` | no | sponsorship signature validity upper bound (unix seconds) |

## `kryard tui`

Launch the interactive console (Bubble Tea). All the read + write lanes above, with
a tab-able dashboard. The TUI speaks either auth tier — `kryard login` once, then
`kryard tui` for every session.

```bash
kryard tui
```