Squid for Agents

Every signing command in waap-cli has a Squid counterpart under the squid namespace. The agent-facing contract is the same as the standard-mode commands. Same chain identifiers, same transaction inputs, same JSON output, same exit codes so moving an agent from standard mode to Squid is a prefix change plus a one-time init.

Squid resolves its on-chain deployment from a reviewed manifest. Development and staging target test networks; production commands fail closed until the reviewed production deployment is published.

Set up once


waap-cli login --json
waap-cli squid init --json
waap-cli squid status --json

squid init creates or reconciles both dWallets. sqd1 (secp256k1, EVM) and sqd2 (ed25519, Sui and Solana). It is safe to re-run: pending and active operations are rechecked and restored without another distributed key generation.

send-tx and sign-tx never create dWallets. If you skip init, signing fails rather than silently provisioning. Do not put squid init in a hot path or a retry loop. Run it once during agent setup.

Inspect


waap-cli squid status --json      # provisioning state, network, sign-service URL
waap-cli squid addresses --json   # Squid addresses for EVM, Sui, and Solana

Squid addresses are distinct from the account’s standard-mode addresses. Fund the Squid address to spend from Squid.

Send and sign


# Native transfer
waap-cli squid send-tx --chain evm:8453 --to 0xRecipient --value 0.01 --json
 
# Contract call
waap-cli squid send-tx --chain evm:8453 --to 0xContract --data 0xa9059cbb… --json
 
# Wait for terminal status
waap-cli squid send-tx --chain sui:mainnet --to 0xRecipient --value 0.5 --wait --json
 
# Sign without broadcasting — emits a portable artifact
waap-cli squid sign-tx --chain evm:8453 --to 0xRecipient --value 0.01 --json
 
# Message and EIP-712
waap-cli squid sign-message --chain evm:8453 --message "hello" --json
waap-cli squid sign-typed-data --chain evm:8453 --data '{"types":…}' --json

sign-tx produces an artifact for an external broadcaster; the CLI does not submit saved artifacts. sign-typed-data is EVM-only, signed by sqd1.

Transaction options

squid send-tx and squid sign-tx accept the same options as their standard-mode equivalents:

Option	Notes
`--chain <id>`	Required. `evm:8453`, `sui:mainnet`, `solana:mainnet`.
`--to <address>`	Recipient.
`--value <amount>`	Whole units. ETH, SUI, or SOL.
`--tx <input>`	Chain-native input; `-` reads stdin. `@file` is not supported.
`--tx-format`	EVM `json\|hex`; Sui `json\|base64`; Solana `json\|legacy-message\|v0-message`.
`--privilege-stdin`	Read an encoded Privilege from stdin.
`--data <hex>`	EVM only. Calldata. `send-tx` only.
`--nonce <n>`	EVM only. Replace or cancel a stuck transaction. `send-tx` only.
`--wait`	Wait for confirmed or failed status. `send-tx` only.

Treat a Privilege as a bearer secret: pipe it with --privilege-stdin rather than placing it in argv or the environment.

Presign pool

Squid signing draws from a pool of presignatures. The sign path self-heals when the pool is empty, so this is only needed to pre-warm before a burst:


waap-cli squid refill --json

refill mints presign capacity up to the buffer depth without re-onboarding or re-running key generation, and is gasless under the default sponsor.

Command reference

Command	Purpose
`squid init`	Create or reconcile `sqd1` and `sqd2`. Run once at setup.
`squid status`	Provisioning state, addresses, network, sign-service URL.
`squid addresses`	Squid addresses for EVM, Sui, and Solana.
`squid refill`	Pre-warm the presign pool.
`squid send-tx`	Build, sign, and broadcast.
`squid sign-tx`	Sign only; emits a portable artifact.
`squid sign-message`	Sign a UTF-8 or hex message.
`squid sign-typed-data`	EIP-712. EVM only, via `sqd1`.

Run waap-cli commands --json for the authoritative machine-readable schema, including every option and each command’s authentication boundary. Prefer it over scraping --help.

What stays the same

Squid changes where key material lives, not how requests are reviewed. Exact chain bytes are verified before any decision, the Policy Engine authorizes against your spend limits and risk thresholds, 2FA escalates the same way, and Privileges scope autonomy identically. Exit codes and error codes are unchanged . Branch on the stable code, never on message text.

Squid Mode overview: what Squid is and when to choose it
Squid for Apps: the browser SDK path
CLI Commands: the full standard-mode command reference
Privileges: scoped, time-bounded autonomy