yp CLI — Overview & Installation

Quick summary

Use the yp CLI to plan, review, apply, and verify software protection. Start with yp doctor; commands involving a platform account require a running backend.

Read Quickstart for a complete example and Commands when you need flags.

yp (@yetdapay/cli, tools/devpay-cli/) is the single developer entry point for the platform. It is stdlib-only Node (node:util parseArgs, node:fs, fetch) — no dependencies, no build step — and requires Node ≥ 18.17.

Two command families:

• Protect workflow — init, doctor, protect plan|review|apply|verify. These delegate to the auto-protection machinery (experiments/auto-protection/); the CLI never reimplements the analyzer, planner, or partitioner.
• Platform commands — auth login|status, project list|inspect, license status|verify, integration check. These talk to a running backend over the REST contract (API docs).

Current version: 0.2.0 (yp --version).

Honest-UX contract

The CLI's core promise — planned ≠ applied ≠ verified:

• A plan-only stage never claims anything was applied.
• Verification verdicts come only from executed checks.
• Backend coverage gaps surface as NOT_AVAILABLE, never as fake success.

Install

# in-repo, zero install
node tools/devpay-cli/devpay.mjs --help
tools/devpay-cli/bin/devpay --help

# packed tarball (vendored, self-contained)
cd tools/yp && npm pack
npm install -g yetdapay-cli-0.2.0.tgz

npm pack vendors the auto-protection toolkit subset plus sdk/license/server into vendor/nougat-devpay/ via the prepack script, preserving repo-relative path resolution inside an installed package. vendor/ is generated and gitignored. The package is private: true — unpublished-by-design; npm publish is blocked, npm pack works.

See Installation for the full matrix.

Global flags & conventions

Flag	Effect
--json	Print exactly one structured JSON object (for agents/MCP).
--help	Bare → full usage; yp <cmd> [sub] --help → per-command help.
--version	Print 0.2.0 (--json → {"version":"0.2.0"}).
--api-base <url>	Per-command API base override (default http://127.0.0.1:8787).

Exit codes (uniform across all commands):

Code	Name	Meaning
0	ok	The stage completed. Plan-only stages never imply apply.
1	fail	A stage ran and failed (equivalence FAIL_ADOPTION, invalid evidence, doctor FAIL, bad login, invalid license key).
2	needs-approval	Missing input, invalid spec, or approval required.
3	refused	Fail-closed refusal — pipeline refused apply, or an auth-required command ran without valid credentials (401/403 → "run yp auth login").

Credentials

auth login stores credentials at $XDG_CONFIG_HOME/yp/credentials.json (when XDG_CONFIG_HOME is set) else ~/.yp/credentials.json — directory 0700, file 0600. YP_CONFIG_DIR overrides the directory (tests/CI). Passwords and issued tokens are never echoed or logged. See Configuration for the credential shape per backend.