Build the layerx binary with cargo and drive the LayerX agent domain from your shell. Every write prints its full disclosure to stderr, signs against the OS keyring or an encrypted file store, and then checks the returned receipt against the activity ID you computed locally. Add --json to turn any command into one object for scripts. Commands without authenticated evidence return typed unavailable errors rather than guessed values.

What it does

platform/cli builds a single layerx binary that is the hands-on developer surface for the LayerX agent domain. Seventeen command groups cover wallets, tokens, keys, developer accounts, identity registration, the faucet, payments, receipts, deterministic programs, the local emulator and the two agent transports. Every write is signed locally against the OS keyring or an encrypted file store, disclosed to stderr before signing, and then checked against a receipt bound to the locally computed activity ID. --json turns any command into one JSON object for scripting.

Key capabilities

• Seventeen command groups: wallet, token, new, workspace, environment, key, auth, account, register, faucet, payment, receipt, program, emulator, install, mcp, a2a.
• Signs locally from the OS keyring or an AES-256-GCM encrypted file store, never uploading secret material.
• Verifies receipts at executed, batched or finalised against the locally recomputed activity ID.
• Provisions and runs the local emulator, then points the CLI at it with environment use.
• Builds, deploys and generates digest-bound bindings for deterministic WASM programs.
• Installs and serves the MCP and agent-to-agent transports from the same binary.

Differentiators

Commands that lack authenticated evidence return typed unavailable errors instead of inventing data: DID enumeration, asset listing and fee estimation never return an empty list or a guessed estimate, and wallet history is hidden rather than approximated because no authenticated DID activity-history backend is published. Receipt trust comes from an independently supplied policy file, so trust pins are never derived from the RPC response being verified.

Outcomes

• Sign every write locally; no secret material leaves your machine
• Verify receipts at executed, batched or finalised against your computed activity ID
• Exercise wallets, transfers and program deploys on the local emulator

Technical notes

• No prebuilt artifact ships. Build with cargo build --manifest-path platform/cli/Cargo.toml; the binary lands at platform/target/debug/layerx. Rust is pinned to 1.91.1.
• --json, --rpc and --gateway-credential are global; --gateway-credential is additionally a required per-command argument on a2a serve. --rpc must end in /rpc, and remote endpoints require HTTPS.
• --fee-limit defaults to 0. Public writes require --rpc, a trusted receipt policy and a fee limit. Funded public execution additionally requires a configured authenticated deployment, which local fixture tests do not establish.
• Public wallet registration and DID activity history are not published and return typed unavailable errors without signing. wallet send is unavailable on the emulator.
• The encrypted file store uses PBKDF2-HMAC-SHA256 at 600,000 iterations with a fresh salt and nonce per update, mode 0600 files in a mode 0700 directory, and Unix permissions only. There is no fallback or migration between stores, and a lost passphrase cannot be recovered.
• --timeout-seconds is bounded to 1-300 and defaults to 60. Live wallet watch notifications are marked verified: false and establish no commitment.
• The repository root also holds an unrelated Bash workspace dashboard named layerx, so PATH order decides which one runs.
• The tree carries 27 source modules beside main.rs, 13 Rust integration test files, and the install-journey.sh and clean-bootstrap.sh end-to-end scripts.

cargo build --manifest-path platform/cli/Cargo.toml
export PATH="$PWD/platform/target/debug:$PATH"

layerx emulator provision
layerx emulator up --sequencer-seed-file "$HOME/.config/layerx/emulator/sequencer.seed"

# in a second terminal, same LAYERX_CONFIG and credential store
layerx environment use emulator --endpoint http://127.0.0.1:9402 \
  --network-id 402 \
  --sequencer-trust-anchor-file "$HOME/.config/layerx/emulator/sequencer.anchor"
layerx wallet create alice
layerx --json wallet balance

More in Developers