@absol-labs/agent 0.10.0 → 0.12.0-rc.1

package/dist/cli/commands/mcp.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../../../src/cli/commands/mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAG7D,mFAAmF;AACnF,MAAM,OAAO,GAAG,YAAY,CAAC;AAC7B,MAAM,YAAY,GAAG,mBAAmB,CAAC;AAEzC,8EAA8E;AAC9E,MAAM,mBAAmB,GAAG,QAAQ,CAAC;AAErC;;;;;;;;GAQG;AACH,MAAM,YAAY,GAA2C;IAC3D;QACE,0CAA0C;QAC1C,kCAAkC;KACnC;IACD,CAAC,qCAAqC,EAAE,gCAAgC,CAAC;IACzE;QACE,+CAA+C;QAC/C,kCAAkC;KACnC;IACD;QACE,2CAA2C;QAC3C,kCAAkC;KACnC;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAgB;IACrC,IAAI,EAAE,KAAK;IACX,OAAO,EAAE,iEAAiE;IAC1E,KAAK,EAAE,6CAA6C;IACpD,KAAK,EAAE,CAAC,cAAc,EAAE,MAAM,CAAC;IAC/B,KAAK,EAAE,KAAK;IACZ,KAAK,CAAC,GAAG,CAAC,OAAuB;QAC/B,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;QAC3C,yEAAyE;QACzE,oEAAoE;QACpE,wEAAwE;QACxE,2EAA2E;QAC3E,2EAA2E;QAC3E,kDAAkD;QAClD,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,IAAI,CACN,gOAAgO,CACjO,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,mBAAmB,CAAC;QAE7D,uEAAuE;QACvE,0EAA0E;QAC1E,mDAAmD;QACnD,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;QAEjC,MAAM,QAAQ,GAAG;YACf,UAAU,EAAE;gBACV,CAAC,IAAI,CAAC,EAAE;oBACN,OAAO,EAAE,KAAK;oBACd,IAAI,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,YAAY,IAAI,OAAO,EAAE,EAAE,OAAO,CAAC;oBAChE,GAAG,EAAE;wBACH,mEAAmE;wBACnE,gEAAgE;wBAChE,iEAAiE;wBACjE,iCAAiC;wBACjC,qBAAqB,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;wBAC7C,oBAAoB,EAAE,MAAM,CAAC,MAAM;wBACnC,mBAAmB,EAAE,MAAM,CAAC,MAAM;wBAClC,iBAAiB,EAAE,MAAM,CAAC,IAAI;wBAC9B,GAAG,SAAS,CAAC,GAAG,CAAC;wBACjB,GAAG,UAAU,CAAC,GAAG,CAAC;qBACnB;iBACF;aACF;SACF,CAAC;QAEF,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACrB,GAAG,CAAC,KAAK,CACP,4HAA4H,CAC7H,CAAC;QACF,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACd,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7C,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACd,GAAG,CAAC,KAAK,CACP,oCAAoC,YAAY,IAAI,OAAO,IAAI,OAAO,kGAAkG,CACzK,CAAC;QACF,GAAG,CAAC,KAAK,CACP,gHAAgH,CACjH,CAAC;IACJ,CAAC;CACF,CAAC;AAEF;;;;;;;GAOG;AACH,SAAS,SAAS,CAAC,GAAsB;IACvC,MAAM,OAAO,GACX,GAAG,CAAC,eAAe,CAAC,KAAK,SAAS;QAClC,YAAY,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACpE,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,MAAM,CAAC,WAAW,CACvB,YAAY,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,SAAS,QAAQ,GAAG,CAAC,CAAC,CACjE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,CAAC,eAAe,CAAC,EAAE,sCAAsC;KAC1D,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,GAAsB;IACxC,OAAO,MAAM,CAAC,WAAW,CACvB,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC;QAC5C,QAAQ;QACR,GAAG,CAAC,QAAQ,CAAC,IAAI,WAAW;KAC7B,CAAC,CACH,CAAC;AACJ,CAAC"}
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../../../src/cli/commands/mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAG7E,mFAAmF;AACnF,MAAM,OAAO,GAAG,YAAY,CAAC;AAC7B,MAAM,YAAY,GAAG,mBAAmB,CAAC;AAEzC,8EAA8E;AAC9E,MAAM,mBAAmB,GAAG,QAAQ,CAAC;AAErC;;;;;;;;GAQG;AACH,MAAM,YAAY,GAA2C;IAC3D;QACE,0CAA0C;QAC1C,kCAAkC;KACnC;IACD,CAAC,qCAAqC,EAAE,gCAAgC,CAAC;IACzE;QACE,+CAA+C;QAC/C,kCAAkC;KACnC;IACD;QACE,2CAA2C;QAC3C,kCAAkC;KACnC;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAgB;IACrC,IAAI,EAAE,KAAK;IACX,OAAO,EAAE,iEAAiE;IAC1E,KAAK,EAAE,6CAA6C;IACpD,KAAK,EAAE,CAAC,cAAc,EAAE,MAAM,CAAC;IAC/B,KAAK,EAAE,KAAK;IACZ,KAAK,CAAC,GAAG,CAAC,OAAuB;QAC/B,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;QAC3C,yEAAyE;QACzE,oEAAoE;QACpE,wEAAwE;QACxE,2EAA2E;QAC3E,2EAA2E;QAC3E,kDAAkD;QAClD,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,IAAI,CACN,gOAAgO,CACjO,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,mBAAmB,CAAC;QAE7D,uEAAuE;QACvE,0EAA0E;QAC1E,mDAAmD;QACnD,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;QAEjC,MAAM,QAAQ,GAAG;YACf,UAAU,EAAE;gBACV,CAAC,IAAI,CAAC,EAAE;oBACN,OAAO,EAAE,KAAK;oBACd,IAAI,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,YAAY,IAAI,OAAO,EAAE,EAAE,OAAO,CAAC;oBAChE,GAAG,EAAE;wBACH,mEAAmE;wBACnE,gEAAgE;wBAChE,iEAAiE;wBACjE,iCAAiC;wBACjC,qBAAqB,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;wBAC7C,oBAAoB,EAAE,MAAM,CAAC,MAAM;wBACnC,mBAAmB,EAAE,MAAM,CAAC,MAAM;wBAClC,iBAAiB,EAAE,MAAM,CAAC,IAAI;wBAC9B,GAAG,SAAS,CAAC,GAAG,CAAC;wBACjB,GAAG,UAAU,CAAC,GAAG,CAAC;qBACnB;iBACF;aACF;SACF,CAAC;QAEF,uEAAuE;QACvE,uEAAuE;QACvE,2EAA2E;QAC3E,wEAAwE;QACxE,2EAA2E;QAC3E,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,IAAI,CACN,iFAAiF,OAAO,yCAAyC,eAAe,kIAAkI,CACnR,CAAC;QACJ,CAAC;QAED,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACrB,GAAG,CAAC,KAAK,CACP,4HAA4H,CAC7H,CAAC;QACF,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACd,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7C,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACd,GAAG,CAAC,KAAK,CACP,oCAAoC,YAAY,IAAI,OAAO,IAAI,OAAO,kGAAkG,CACzK,CAAC;QACF,GAAG,CAAC,KAAK,CACP,gHAAgH,CACjH,CAAC;IACJ,CAAC;CACF,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,SAAS,SAAS,CAAC,GAAsB;IACvC,MAAM,OAAO,GACX,GAAG,CAAC,eAAe,CAAC,KAAK,SAAS;QAClC,YAAY,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACpE,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,MAAM,CAAC,WAAW,CACvB,YAAY,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,SAAS,QAAQ,GAAG,CAAC,CAAC,CACjE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,CAAC,eAAe,CAAC,EAAE,4BAA4B;KAChD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,GAAsB;IACxC,OAAO,MAAM,CAAC,WAAW,CACvB,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC;QAC5C,QAAQ;QACR,GAAG,CAAC,QAAQ,CAAC,IAAI,WAAW;KAC7B,CAAC,CACH,CAAC;AACJ,CAAC"}

package/dist/cli/commands/open.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"open.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/open.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAkB,WAAW,EAAE,MAAM,eAAe,CAAC;AAEjE,eAAO,MAAM,WAAW,EAAE,WAqQzB,CAAC"}
+{"version":3,"file":"open.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/open.ts"],"names":[],"mappings":"AA+BA,OAAO,KAAK,EAAkB,WAAW,EAAE,MAAM,eAAe,CAAC;AAEjE,eAAO,MAAM,WAAW,EAAE,WAuUzB,CAAC"}

package/dist/cli/commands/open.js

@@ -2,11 +2,14 @@ import { MandateDeniedError } from "../../sdk/client.js";
 import { booleanFlag, requiredStringFlag, stringFlag } from "../args.js";
 import { formatDuration, formatUsdc, parseAmountUnits, parseDurationSeconds, parseUsdcAmount, } from "../amounts.js";
 import { assertTestnetRpc, parseBytes32 } from "../config.js";
+import { writeClientOptions } from "../deps.js";
 import { CliError, configError } from "../errors.js";
+import { assertWithinOperatorCaps, assertWithinSpendPolicy, } from "../spend-policy.js";
 import { cliMandateCaps, signCliMandate } from "../mandate.js";
 import { assertCanFundStream, assertCanPayGas } from "../preflight.js";
-import { optionalCliWallet, resolveCliWallet, PRIVATE_KEY_ENV, } from "../wallet.js";
-import { resolveListing } from "../listings.js";
+import { isPolicyEnforced, optionalCliWallet, resolveCliWallet, PRIVATE_KEY_ENV, } from "../wallet.js";
+import { resolveListingRecord } from "../listings.js";
+import { listingRateBand, rateBandRefusal, SignedRateBoundsError, } from "../../discovery/rate-band.js";
 export const openCommand = {
     name: "open",
     summary: "Hire a verified service: escrow USDC into a metered stream",
@@ -44,34 +47,54 @@ export const openCommand = {
         // the intended call and says which parts (allowance, simulation, mandate
         // signature) could not be produced, rather than inventing them.
         const wallet = dryRun
-            ? await optionalCliWallet(env, { note: out.note })
-            : await resolveCliWallet(env, { note: out.note });
+            ? await optionalCliWallet(env, { note: out.note, rpcUrl: config.rpcUrl })
+            : await resolveCliWallet(env, { note: out.note, rpcUrl: config.rpcUrl });
         const account = wallet?.account ?? null;
         const read = deps.createReadClient(config);
         await assertTestnetRpc(config, () => read.getChainId());
         if (account !== null && !dryRun) {
             // Both balances, before anything is signed. Gas first: a wallet with no
             // ETH cannot send the approval that the USDC check exists to protect.
-            await assertCanPayGas(read, account.address);
-            await assertCanFundStream(read, account.address, budgetUsdc);
+            await assertCanPayGas(read, account.address, config.network);
+            await assertCanFundStream(read, account.address, budgetUsdc, config.network);
         }
         const operatorOverride = stringFlag(args, "operator");
-        const listing = await resolveListing(context, serviceRef, {
+        const resolution = await resolveListingRecord(context, serviceRef, {
             required: operatorOverride === undefined,
         });
+        const listing = resolution.listing;
+        await assertRateInSignedBand(context, resolution, ratePerSecondUsdc);
         const operator = (operatorOverride ?? listing?.operator);
         if (operator === undefined) {
             throw configError(`serviceRef ${serviceRef} is not in the registry and no --operator was given`, "run `metrik discover` to find a listed service, or pass --operator explicitly.");
         }
         const spend = { operator, budgetUsdc, ratePerSecondUsdc, durationSeconds };
-        const mandate = account === null
+        const mandateCaps = cliMandateCaps(spend, env);
+        // A policy-enforced wallet (Privy) is capped by its broker, not by a
+        // mandate this process signs for itself. Read the REAL ceiling and hold it
+        // to that instead — see `../spend-policy.ts` for why that substitution is
+        // the stronger of the two, and why re-adding the self-signed mandate here
+        // would both weaken it and break the wallet outright.
+        const policy = wallet !== null && isPolicyEnforced(wallet)
+            ? await wallet.readSpendPolicy()
+            : null;
+        if (policy !== null && !dryRun) {
+            assertWithinSpendPolicy(policy, spend);
+            // The operator's own standing ceiling still applies, and may be TIGHTER
+            // than the broker's. Enforced here because no mandate is signed to carry
+            // it — "policy-enforced" retires the self-signed mandate, not the caps
+            // the operator deliberately configured.
+            if (mandateCaps.source === "env") {
+                assertWithinOperatorCaps(mandateCaps.caps, spend);
+            }
+        }
+        const mandate = account === null || policy !== null
             ? null
             : await signCliMandate(account, spend, {
                 chainId: config.chainId,
                 env,
             });
-        const mandateCaps = cliMandateCaps(spend, env);
-        const write = deps.createWriteClient(config, account);
+        const write = deps.createWriteClient(config, account, writeClientOptions(wallet));
         const hire = {
             operator,
             serviceRef,
@@ -104,6 +127,17 @@ export const openCommand = {
                 durationSeconds,
                 mandateSource: mandateCaps.source,
                 mandateSigned: mandate !== null,
+                spendPolicy: policy === null
+                    ? null
+                    : {
+                        brokerUrl: policy.brokerUrl,
+                        maxTotalUsdc: policy.maxTotalUsdc,
+                        maxRatePerSecondUsdc: policy.maxRatePerSecondUsdc,
+                        maxDurationSeconds: policy.maxDurationSeconds,
+                        fits: budgetUsdc <= policy.maxTotalUsdc &&
+                            ratePerSecondUsdc <= policy.maxRatePerSecondUsdc &&
+                            durationSeconds <= policy.maxDurationSeconds,
+                    },
                 to: preview.to,
                 data: preview.data,
                 chainId: preview.chainId,
@@ -139,10 +173,28 @@ export const openCommand = {
                 ["duration", formatDuration(durationSeconds)],
                 [
                     "mandate",
-                    mandate === null
-                        ? `not signed (no wallet); caps would come from ${mandateCaps.source}`
-                        : `self-signed, caps from ${mandateCaps.source}`,
+                    mandate !== null
+                        ? `self-signed, caps from ${mandateCaps.source}`
+                        : policy !== null
+                            ? "not signed — this wallet's ceiling is enforced by its broker, which is stronger"
+                            : `not signed (no wallet); caps would come from ${mandateCaps.source}`,
                 ],
+                ...(policy === null
+                    ? []
+                    : [
+                        [
+                            "spend policy",
+                            `${formatUsdc(policy.maxTotalUsdc)} total, ${policy.maxRatePerSecondUsdc} atomic/second, ${formatDuration(policy.maxDurationSeconds)} max — enforced by ${policy.brokerUrl}`,
+                        ],
+                        [
+                            "fits policy",
+                            budgetUsdc <= policy.maxTotalUsdc &&
+                                ratePerSecondUsdc <= policy.maxRatePerSecondUsdc &&
+                                durationSeconds <= policy.maxDurationSeconds
+                                ? "yes"
+                                : "NO — a real open would be refused before broadcasting",
+                        ],
+                    ]),
                 ["escrow", preview.to],
                 [
                     "usdc balance",
@@ -175,7 +227,7 @@ export const openCommand = {
         out.note(`opening a stream on chain ${config.chainId} for ${formatUsdc(budgetUsdc)} …`);
         // Unreachable without a wallet: `resolveCliWallet` above throws when the
         // command is not a dry run. The narrowing keeps that a type-level fact.
-        if (account === null || mandate === null) {
+        if (account === null) {
             throw configError("this command signs a transaction and needs a wallet, and none was resolved");
         }
         let result;
@@ -186,7 +238,10 @@ export const openCommand = {
                 budgetUsdc,
                 ratePerSecondUsdc,
                 maxDurationSeconds: durationSeconds,
-                signedMandate: mandate.signed,
+                // `null` for a policy-enforced wallet: the ceiling was checked against
+                // the broker's own policy above, and the broker checks it again on the
+                // transaction it signs.
+                signedMandate: mandate === null ? null : mandate.signed,
                 spentSoFarUsdc: 0n,
                 nowSeconds: deps.nowSeconds(),
             });
@@ -233,6 +288,57 @@ export const openCommand = {
         out.print(`Next:  metrik status ${result.streamId}`);
     },
 };
+/**
+ * Refuse a `--rate` outside the band the operator SIGNED, before anything is
+ * signed or broadcast — dry run included, because the rate is an invalid input
+ * for this service exactly like `--rate 0` is.
+ *
+ * The escrow accepts any non-zero rate; the seller's capability gateway does
+ * not, and answers every request on an out-of-band stream with
+ * `403 stream-rate-out-of-bounds`. Without this check the CLI locked a buyer's
+ * deposit in a stream that could never be served, and said nothing.
+ *
+ * - Listing found: its signed descriptor is re-verified and the band enforced.
+ *   A descriptor that does not verify is a refusal (exit 4), never "no band".
+ *   A legacy binding signs no commercial terms, so there is nothing to enforce.
+ * - No listing: only reachable with `--operator`, the CLI's existing,
+ *   explicit escape hatch for a service the registry cannot vouch for. The
+ *   check cannot run, so it is skipped LOUDLY rather than silently. Without
+ *   `--operator` an unreachable registry or a missing listing has already
+ *   failed the command before this point (`resolveListingRecord`).
+ */
+async function assertRateInSignedBand(context, resolution, ratePerSecondUsdc) {
+    const { out } = context;
+    if (resolution.record === null) {
+        out.note(resolution.registryUnreachable
+            ? "warning: the operator-signed rate band could NOT be checked because the registry is unreachable. If --rate is outside the band the operator signed, the service's gateway will refuse every request while the deposit stays escrowed. Re-run when the registry answers to have it checked."
+            : "note: this serviceRef has no verified listing, so there is no operator-signed rate band to check --rate against.");
+        return;
+    }
+    let bounds;
+    try {
+        bounds = await listingRateBand(resolution.record);
+    }
+    catch (error) {
+        if (error instanceof SignedRateBoundsError) {
+            throw new CliError(`the listing's operator-signed rate band could not be verified: ${error.message}`, {
+                exitCode: 4,
+                hint: "nothing was broadcast. The CLI will not open a stream against a rate band it cannot verify.",
+                cause: error,
+            });
+        }
+        throw error;
+    }
+    if (bounds === null)
+        return;
+    const refusal = rateBandRefusal(ratePerSecondUsdc, bounds, "--rate");
+    if (refusal !== undefined) {
+        throw new CliError(refusal, {
+            exitCode: 2,
+            hint: "pick a --rate inside the signed band (`--units atomic` takes base units; see `metrik discover` for each listing's band).",
+        });
+    }
+}
 /**
  * What the buyer is actually paying for.
  *

package/dist/cli/commands/open.js.map

@@ -1 +1 @@
-{"version":3,"file":"open.js","sourceRoot":"","sources":["../../../src/cli/commands/open.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACzE,OAAO,EACL,cAAc,EACd,UAAU,EACV,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,GAChB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvE,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,GAChB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAGhD,MAAM,CAAC,MAAM,WAAW,GAAgB;IACtC,IAAI,EAAE,MAAM;IACZ,OAAO,EAAE,4DAA4D;IACrE,KAAK,EACH,sHAAsH;IACxH,KAAK,EAAE;QACL,SAAS;QACT,MAAM;QACN,QAAQ;QACR,UAAU;QACV,OAAO;QACP,UAAU;QACV,SAAS;KACV;IACD,KAAK,EAAE,IAAI;IACX,KAAK,CAAC,GAAG,CAAC,OAAuB;QAC/B,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;QACjD,MAAM,KAAK,GAAG,gBAAgB,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1D,MAAM,UAAU,GAAG,YAAY,CAC7B,kBAAkB,CAAC,IAAI,EAAE,SAAS,CAAC,EACnC,WAAW,CACZ,CAAC;QACF,MAAM,UAAU,GAAG,eAAe,CAChC,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,EAClC,KAAK,EACL,QAAQ,CACT,CAAC;QACF,MAAM,iBAAiB,GAAG,eAAe,CACvC,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,EAChC,KAAK,EACL,MAAM,CACP,CAAC;QACF,MAAM,eAAe,GAAG,oBAAoB,CAC1C,kBAAkB,CAAC,IAAI,EAAE,UAAU,CAAC,CACrC,CAAC;QACF,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAE5C,IAAI,UAAU,IAAI,EAAE,IAAI,iBAAiB,IAAI,EAAE,EAAE,CAAC;YAChD,MAAM,IAAI,QAAQ,CAAC,oDAAoD,EAAE;gBACvE,QAAQ,EAAE,CAAC;aACZ,CAAC,CAAC;QACL,CAAC;QACD,MAAM,QAAQ,GAAG,iBAAiB,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;QAC7D,IAAI,QAAQ,GAAG,UAAU,EAAE,CAAC;YAC1B,GAAG,CAAC,IAAI,CACN,8BAA8B,UAAU,CAAC,QAAQ,CAAC,kHAAkH,CACrK,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,0EAA0E;QAC1E,4EAA4E;QAC5E,yEAAyE;QACzE,gEAAgE;QAChE,MAAM,MAAM,GAAG,MAAM;YACnB,CAAC,CAAC,MAAM,iBAAiB,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;YAClD,CAAC,CAAC,MAAM,gBAAgB,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,IAAI,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QACxD,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,wEAAwE;YACxE,sEAAsE;YACtE,MAAM,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YAC7C,MAAM,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,gBAAgB,GAAG,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE;YACxD,QAAQ,EAAE,gBAAgB,KAAK,SAAS;SACzC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,CAAC,gBAAgB,IAAI,OAAO,EAAE,QAAQ,CAE1C,CAAC;QACd,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,WAAW,CACf,cAAc,UAAU,qDAAqD,EAC7E,gFAAgF,CACjF,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,iBAAiB,EAAE,eAAe,EAAE,CAAC;QAC3E,MAAM,OAAO,GACX,OAAO,KAAK,IAAI;YACd,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,MAAM,cAAc,CAAC,OAAO,EAAE,KAAK,EAAE;gBACnC,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,GAAG;aACJ,CAAC,CAAC;QACT,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAE/C,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG;YACX,QAAQ;YACR,UAAU;YACV,UAAU;YACV,aAAa,EAAE,iBAAiB;YAChC,kBAAkB,EAAE,eAAe;SACpC,CAAC;QAEF,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YAC9C,uEAAuE;YACvE,0EAA0E;YAC1E,sEAAsE;YACtE,0EAA0E;YAC1E,mEAAmE;YACnE,0EAA0E;YAC1E,MAAM,wBAAwB,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAC7D,gEAAgE;YAChE,uEAAuE;YACvE,4DAA4D;YAC5D,MAAM,WAAW,GACf,OAAO,KAAK,IAAI;gBACd,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YAChE,GAAG,CAAC,MAAM,CAAC;gBACT,MAAM,EAAE,IAAI;gBACZ,KAAK,EAAE,OAAO,EAAE,OAAO,IAAI,IAAI;gBAC/B,QAAQ;gBACR,UAAU;gBACV,UAAU;gBACV,iBAAiB;gBACjB,eAAe;gBACf,aAAa,EAAE,WAAW,CAAC,MAAM;gBACjC,aAAa,EAAE,OAAO,KAAK,IAAI;gBAC/B,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,QAAQ,EAAE;oBACR,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ;oBACnC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM;oBAC/B,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,OAAO;oBACjC,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK;iBAC9B;gBACD,WAAW;gBACX,cAAc,EAAE,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,UAAU;gBACvE,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;gBAC5C,sEAAsE;gBACtE,mEAAmE;gBACnE,oEAAoE;gBACpE,gCAAgC;gBAChC,yBAAyB,EAAE,wBAAwB;gBACnD,GAAG,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS,IAAI,wBAAwB;oBACnE,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC;aAClD,CAAC,CAAC;YACH,GAAG,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;YAC9C,GAAG,CAAC,KAAK,CAAC;gBACR;oBACE,OAAO;oBACP,OAAO,EAAE,OAAO;wBACd,uCAAuC,eAAe,uDAAuD;iBAChH;gBACD,CAAC,UAAU,EAAE,QAAQ,CAAC;gBACtB,CAAC,YAAY,EAAE,UAAU,CAAC;gBAC1B,CAAC,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;gBAClC,CAAC,MAAM,EAAE,GAAG,UAAU,CAAC,iBAAiB,CAAC,WAAW,CAAC;gBACrD,CAAC,UAAU,EAAE,cAAc,CAAC,eAAe,CAAC,CAAC;gBAC7C;oBACE,SAAS;oBACT,OAAO,KAAK,IAAI;wBACd,CAAC,CAAC,gDAAgD,WAAW,CAAC,MAAM,EAAE;wBACtE,CAAC,CAAC,0BAA0B,WAAW,CAAC,MAAM,EAAE;iBACnD;gBACD,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;gBACtB;oBACE,cAAc;oBACd,WAAW,KAAK,IAAI;wBAClB,CAAC,CAAC,+BAA+B;wBACjC,CAAC,CAAC,WAAW,IAAI,UAAU;4BACzB,CAAC,CAAC,GAAG,UAAU,CAAC,WAAW,CAAC,sBAAsB;4BAClD,CAAC,CAAC,GAAG,UAAU,CAAC,WAAW,CAAC,mBAAmB,UAAU,CAAC,UAAU,CAAC,uCAAuC;iBACjH;gBACD;oBACE,eAAe;oBACf,OAAO,CAAC,QAAQ,CAAC,QAAQ,KAAK,IAAI;wBAChC,CAAC,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,qBAAqB;wBAC7D,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ;4BACzB,CAAC,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa;4BACrD,CAAC,CAAC,oBAAoB;iBAC3B;gBACD;oBACE,oBAAoB;oBACpB,OAAO,CAAC,iBAAiB;wBACvB,CAAC,wBAAwB;4BACvB,CAAC,CAAC,mLAAmL;4BACrL,CAAC,CAAC,gBAAgB,OAAO,CAAC,eAAe,IAAI,wBAAwB,GAAG,CAAC;iBAC9E;aACF,CAAC,CAAC;YACH,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACd,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;YACzB,OAAO;QACT,CAAC;QAED,GAAG,CAAC,IAAI,CACN,6BAA6B,MAAM,CAAC,OAAO,QAAQ,UAAU,CAAC,UAAU,CAAC,IAAI,CAC9E,CAAC;QACF,yEAAyE;QACzE,wEAAwE;QACxE,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACzC,MAAM,WAAW,CACf,4EAA4E,CAC7E,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC;gBACtC,QAAQ;gBACR,UAAU;gBACV,UAAU;gBACV,iBAAiB;gBACjB,kBAAkB,EAAE,eAAe;gBACnC,aAAa,EAAE,OAAO,CAAC,MAAM;gBAC7B,cAAc,EAAE,EAAE;gBAClB,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE;aAC9B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;gBACxC,MAAM,IAAI,QAAQ,CAAC,mCAAmC,KAAK,CAAC,MAAM,EAAE,EAAE;oBACpE,QAAQ,EAAE,CAAC;oBACX,IAAI,EACF,WAAW,CAAC,MAAM,KAAK,KAAK;wBAC1B,CAAC,CAAC,iEAAiE;wBACnE,CAAC,CAAC,sDAAsD;oBAC5D,KAAK,EAAE,KAAK;iBACb,CAAC,CAAC;YACL,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,GAAG,CAAC,MAAM,CAAC;YACT,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,KAAK,EAAE,OAAO,CAAC,OAAO;YACtB,QAAQ;YACR,UAAU;YACV,UAAU;YACV,iBAAiB;YACjB,eAAe;YACf,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO;SAC/B,CAAC,CAAC;QACH,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC5B,GAAG,CAAC,KAAK,CAAC;YACR,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC;YAC7B,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;YACrB,CAAC,YAAY,EAAE,MAAM,CAAC,aAAa,IAAI,YAAY,CAAC;YACpD,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC;YAC1B,CAAC,UAAU,EAAE,QAAQ,CAAC;YACtB,CAAC,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;YAClC,CAAC,MAAM,EAAE,GAAG,UAAU,CAAC,iBAAiB,CAAC,WAAW,CAAC;YACrD,CAAC,UAAU,EAAE,cAAc,CAAC,eAAe,CAAC,CAAC;SAC9C,CAAC,CAAC;QACH,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACd,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACzB,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACd,GAAG,CAAC,KAAK,CAAC,wBAAwB,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IACvD,CAAC;CACF,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,aAAa,GACjB,sUAAsU,CAAC;AAEzU;;;;;;;GAOG;AACH,MAAM,mBAAmB,GAAsB;IAC7C,oCAAoC;IACpC,yBAAyB;IACzB,4BAA4B;CAC7B,CAAC;AAEF;;;;;;;;GAQG;AACH,SAAS,kBAAkB,CAAC,OAI3B;IACC,MAAM,KAAK,GAAG,OAAO,CAAC,eAAe,CAAC;IACtC,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,iBAAiB,IAAI,IAAI;QAAE,OAAO,KAAK,CAAC;IAC3E,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IACtD,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAClD,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AACpE,CAAC"}
+{"version":3,"file":"open.js","sourceRoot":"","sources":["../../../src/cli/commands/open.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACzE,OAAO,EACL,cAAc,EACd,UAAU,EACV,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,GAChB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,EACL,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvE,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,GAChB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EACL,eAAe,EACf,eAAe,EACf,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AAGtC,MAAM,CAAC,MAAM,WAAW,GAAgB;IACtC,IAAI,EAAE,MAAM;IACZ,OAAO,EAAE,4DAA4D;IACrE,KAAK,EACH,sHAAsH;IACxH,KAAK,EAAE;QACL,SAAS;QACT,MAAM;QACN,QAAQ;QACR,UAAU;QACV,OAAO;QACP,UAAU;QACV,SAAS;KACV;IACD,KAAK,EAAE,IAAI;IACX,KAAK,CAAC,GAAG,CAAC,OAAuB;QAC/B,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;QACjD,MAAM,KAAK,GAAG,gBAAgB,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1D,MAAM,UAAU,GAAG,YAAY,CAC7B,kBAAkB,CAAC,IAAI,EAAE,SAAS,CAAC,EACnC,WAAW,CACZ,CAAC;QACF,MAAM,UAAU,GAAG,eAAe,CAChC,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,EAClC,KAAK,EACL,QAAQ,CACT,CAAC;QACF,MAAM,iBAAiB,GAAG,eAAe,CACvC,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,EAChC,KAAK,EACL,MAAM,CACP,CAAC;QACF,MAAM,eAAe,GAAG,oBAAoB,CAC1C,kBAAkB,CAAC,IAAI,EAAE,UAAU,CAAC,CACrC,CAAC;QACF,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAE5C,IAAI,UAAU,IAAI,EAAE,IAAI,iBAAiB,IAAI,EAAE,EAAE,CAAC;YAChD,MAAM,IAAI,QAAQ,CAAC,oDAAoD,EAAE;gBACvE,QAAQ,EAAE,CAAC;aACZ,CAAC,CAAC;QACL,CAAC;QACD,MAAM,QAAQ,GAAG,iBAAiB,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;QAC7D,IAAI,QAAQ,GAAG,UAAU,EAAE,CAAC;YAC1B,GAAG,CAAC,IAAI,CACN,8BAA8B,UAAU,CAAC,QAAQ,CAAC,kHAAkH,CACrK,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,0EAA0E;QAC1E,4EAA4E;QAC5E,yEAAyE;QACzE,gEAAgE;QAChE,MAAM,MAAM,GAAG,MAAM;YACnB,CAAC,CAAC,MAAM,iBAAiB,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;YACzE,CAAC,CAAC,MAAM,gBAAgB,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3E,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,IAAI,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QACxD,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,wEAAwE;YACxE,sEAAsE;YACtE,MAAM,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAC7D,MAAM,mBAAmB,CACvB,IAAI,EACJ,OAAO,CAAC,OAAO,EACf,UAAU,EACV,MAAM,CAAC,OAAO,CACf,CAAC;QACJ,CAAC;QAED,MAAM,gBAAgB,GAAG,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,UAAU,EAAE;YACjE,QAAQ,EAAE,gBAAgB,KAAK,SAAS;SACzC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;QACnC,MAAM,sBAAsB,CAAC,OAAO,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAC;QACrE,MAAM,QAAQ,GAAG,CAAC,gBAAgB,IAAI,OAAO,EAAE,QAAQ,CAE1C,CAAC;QACd,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,WAAW,CACf,cAAc,UAAU,qDAAqD,EAC7E,gFAAgF,CACjF,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,iBAAiB,EAAE,eAAe,EAAE,CAAC;QAC3E,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAE/C,qEAAqE;QACrE,2EAA2E;QAC3E,0EAA0E;QAC1E,0EAA0E;QAC1E,sDAAsD;QACtD,MAAM,MAAM,GACV,MAAM,KAAK,IAAI,IAAI,gBAAgB,CAAC,MAAM,CAAC;YACzC,CAAC,CAAC,MAAM,MAAM,CAAC,eAAe,EAAE;YAChC,CAAC,CAAC,IAAI,CAAC;QACX,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC/B,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACvC,wEAAwE;YACxE,yEAAyE;YACzE,uEAAuE;YACvE,wCAAwC;YACxC,IAAI,WAAW,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBACjC,wBAAwB,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GACX,OAAO,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI;YACjC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,MAAM,cAAc,CAAC,OAAO,EAAE,KAAK,EAAE;gBACnC,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,GAAG;aACJ,CAAC,CAAC;QAET,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAClC,MAAM,EACN,OAAO,EACP,kBAAkB,CAAC,MAAM,CAAC,CAC3B,CAAC;QACF,MAAM,IAAI,GAAG;YACX,QAAQ;YACR,UAAU;YACV,UAAU;YACV,aAAa,EAAE,iBAAiB;YAChC,kBAAkB,EAAE,eAAe;SACpC,CAAC;QAEF,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YAC9C,uEAAuE;YACvE,0EAA0E;YAC1E,sEAAsE;YACtE,0EAA0E;YAC1E,mEAAmE;YACnE,0EAA0E;YAC1E,MAAM,wBAAwB,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAC7D,gEAAgE;YAChE,uEAAuE;YACvE,4DAA4D;YAC5D,MAAM,WAAW,GACf,OAAO,KAAK,IAAI;gBACd,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YAChE,GAAG,CAAC,MAAM,CAAC;gBACT,MAAM,EAAE,IAAI;gBACZ,KAAK,EAAE,OAAO,EAAE,OAAO,IAAI,IAAI;gBAC/B,QAAQ;gBACR,UAAU;gBACV,UAAU;gBACV,iBAAiB;gBACjB,eAAe;gBACf,aAAa,EAAE,WAAW,CAAC,MAAM;gBACjC,aAAa,EAAE,OAAO,KAAK,IAAI;gBAC/B,WAAW,EACT,MAAM,KAAK,IAAI;oBACb,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC;wBACE,SAAS,EAAE,MAAM,CAAC,SAAS;wBAC3B,YAAY,EAAE,MAAM,CAAC,YAAY;wBACjC,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;wBACjD,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;wBAC7C,IAAI,EACF,UAAU,IAAI,MAAM,CAAC,YAAY;4BACjC,iBAAiB,IAAI,MAAM,CAAC,oBAAoB;4BAChD,eAAe,IAAI,MAAM,CAAC,kBAAkB;qBAC/C;gBACP,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,QAAQ,EAAE;oBACR,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ;oBACnC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM;oBAC/B,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,OAAO;oBACjC,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK;iBAC9B;gBACD,WAAW;gBACX,cAAc,EAAE,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,UAAU;gBACvE,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;gBAC5C,sEAAsE;gBACtE,mEAAmE;gBACnE,oEAAoE;gBACpE,gCAAgC;gBAChC,yBAAyB,EAAE,wBAAwB;gBACnD,GAAG,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS,IAAI,wBAAwB;oBACnE,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC;aAClD,CAAC,CAAC;YACH,GAAG,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;YAC9C,GAAG,CAAC,KAAK,CAAC;gBACR;oBACE,OAAO;oBACP,OAAO,EAAE,OAAO;wBACd,uCAAuC,eAAe,uDAAuD;iBAChH;gBACD,CAAC,UAAU,EAAE,QAAQ,CAAC;gBACtB,CAAC,YAAY,EAAE,UAAU,CAAC;gBAC1B,CAAC,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;gBAClC,CAAC,MAAM,EAAE,GAAG,UAAU,CAAC,iBAAiB,CAAC,WAAW,CAAC;gBACrD,CAAC,UAAU,EAAE,cAAc,CAAC,eAAe,CAAC,CAAC;gBAC7C;oBACE,SAAS;oBACT,OAAO,KAAK,IAAI;wBACd,CAAC,CAAC,0BAA0B,WAAW,CAAC,MAAM,EAAE;wBAChD,CAAC,CAAC,MAAM,KAAK,IAAI;4BACf,CAAC,CAAC,iFAAiF;4BACnF,CAAC,CAAC,gDAAgD,WAAW,CAAC,MAAM,EAAE;iBAC3E;gBACD,GAAG,CAAC,MAAM,KAAK,IAAI;oBACjB,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAE;wBACC;4BACE,cAAc;4BACd,GAAG,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW,MAAM,CAAC,oBAAoB,mBAAmB,cAAc,CAAC,MAAM,CAAC,kBAAkB,CAAC,sBAAsB,MAAM,CAAC,SAAS,EAAE;yBAC7K;wBACD;4BACE,aAAa;4BACb,UAAU,IAAI,MAAM,CAAC,YAAY;gCACjC,iBAAiB,IAAI,MAAM,CAAC,oBAAoB;gCAChD,eAAe,IAAI,MAAM,CAAC,kBAAkB;gCAC1C,CAAC,CAAC,KAAK;gCACP,CAAC,CAAC,uDAAuD;yBAC5D;qBACqB,CAAC;gBAC7B,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;gBACtB;oBACE,cAAc;oBACd,WAAW,KAAK,IAAI;wBAClB,CAAC,CAAC,+BAA+B;wBACjC,CAAC,CAAC,WAAW,IAAI,UAAU;4BACzB,CAAC,CAAC,GAAG,UAAU,CAAC,WAAW,CAAC,sBAAsB;4BAClD,CAAC,CAAC,GAAG,UAAU,CAAC,WAAW,CAAC,mBAAmB,UAAU,CAAC,UAAU,CAAC,uCAAuC;iBACjH;gBACD;oBACE,eAAe;oBACf,OAAO,CAAC,QAAQ,CAAC,QAAQ,KAAK,IAAI;wBAChC,CAAC,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,qBAAqB;wBAC7D,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ;4BACzB,CAAC,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa;4BACrD,CAAC,CAAC,oBAAoB;iBAC3B;gBACD;oBACE,oBAAoB;oBACpB,OAAO,CAAC,iBAAiB;wBACvB,CAAC,wBAAwB;4BACvB,CAAC,CAAC,mLAAmL;4BACrL,CAAC,CAAC,gBAAgB,OAAO,CAAC,eAAe,IAAI,wBAAwB,GAAG,CAAC;iBAC9E;aACF,CAAC,CAAC;YACH,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACd,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;YACzB,OAAO;QACT,CAAC;QAED,GAAG,CAAC,IAAI,CACN,6BAA6B,MAAM,CAAC,OAAO,QAAQ,UAAU,CAAC,UAAU,CAAC,IAAI,CAC9E,CAAC;QACF,yEAAyE;QACzE,wEAAwE;QACxE,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,WAAW,CACf,4EAA4E,CAC7E,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC;gBACtC,QAAQ;gBACR,UAAU;gBACV,UAAU;gBACV,iBAAiB;gBACjB,kBAAkB,EAAE,eAAe;gBACnC,uEAAuE;gBACvE,uEAAuE;gBACvE,wBAAwB;gBACxB,aAAa,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM;gBACvD,cAAc,EAAE,EAAE;gBAClB,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE;aAC9B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;gBACxC,MAAM,IAAI,QAAQ,CAAC,mCAAmC,KAAK,CAAC,MAAM,EAAE,EAAE;oBACpE,QAAQ,EAAE,CAAC;oBACX,IAAI,EACF,WAAW,CAAC,MAAM,KAAK,KAAK;wBAC1B,CAAC,CAAC,iEAAiE;wBACnE,CAAC,CAAC,sDAAsD;oBAC5D,KAAK,EAAE,KAAK;iBACb,CAAC,CAAC;YACL,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,GAAG,CAAC,MAAM,CAAC;YACT,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,KAAK,EAAE,OAAO,CAAC,OAAO;YACtB,QAAQ;YACR,UAAU;YACV,UAAU;YACV,iBAAiB;YACjB,eAAe;YACf,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO;SAC/B,CAAC,CAAC;QACH,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC5B,GAAG,CAAC,KAAK,CAAC;YACR,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC;YAC7B,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;YACrB,CAAC,YAAY,EAAE,MAAM,CAAC,aAAa,IAAI,YAAY,CAAC;YACpD,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC;YAC1B,CAAC,UAAU,EAAE,QAAQ,CAAC;YACtB,CAAC,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;YAClC,CAAC,MAAM,EAAE,GAAG,UAAU,CAAC,iBAAiB,CAAC,WAAW,CAAC;YACrD,CAAC,UAAU,EAAE,cAAc,CAAC,eAAe,CAAC,CAAC;SAC9C,CAAC,CAAC;QACH,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACd,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACzB,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACd,GAAG,CAAC,KAAK,CAAC,wBAAwB,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IACvD,CAAC;CACF,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,KAAK,UAAU,sBAAsB,CACnC,OAAuB,EACvB,UAA4D,EAC5D,iBAAyB;IAEzB,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IACxB,IAAI,UAAU,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC/B,GAAG,CAAC,IAAI,CACN,UAAU,CAAC,mBAAmB;YAC5B,CAAC,CAAC,4RAA4R;YAC9R,CAAC,CAAC,kHAAkH,CACvH,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,eAAe,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;YAC3C,MAAM,IAAI,QAAQ,CAChB,kEAAkE,KAAK,CAAC,OAAO,EAAE,EACjF;gBACE,QAAQ,EAAE,CAAC;gBACX,IAAI,EAAE,6FAA6F;gBACnG,KAAK,EAAE,KAAK;aACb,CACF,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO;IAC5B,MAAM,OAAO,GAAG,eAAe,CAAC,iBAAiB,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACrE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE;YAC1B,QAAQ,EAAE,CAAC;YACX,IAAI,EAAE,0HAA0H;SACjI,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,aAAa,GACjB,sUAAsU,CAAC;AAEzU;;;;;;;GAOG;AACH,MAAM,mBAAmB,GAAsB;IAC7C,oCAAoC;IACpC,yBAAyB;IACzB,4BAA4B;CAC7B,CAAC;AAEF;;;;;;;;GAQG;AACH,SAAS,kBAAkB,CAAC,OAI3B;IACC,MAAM,KAAK,GAAG,OAAO,CAAC,eAAe,CAAC;IACtC,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,iBAAiB,IAAI,IAAI;QAAE,OAAO,KAAK,CAAC;IAC3E,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IACtD,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAClD,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AACpE,CAAC"}

package/dist/cli/commands/pay.d.ts

@@ -0,0 +1,19 @@
+import { type ServerMandateCaps } from "../../mandates/env.js";
+import type { CommandSpec } from "../context.js";
+export declare const payCommand: CommandSpec;
+/**
+ * The mandate this command signs: a standing `METRIK_AGENT_MANDATE_*` ceiling
+ * INTERSECTED with every flag (the most restrictive value wins), or, with no
+ * standing ceiling, one sized to the flags. A flag can only tighten a
+ * standing ceiling, never loosen or bypass it; an `--operator` outside a
+ * standing allowlist is refused outright.
+ */
+export declare function intersectCaps(envCaps: ServerMandateCaps | null, flags: {
+    readonly maxAmount: bigint | undefined;
+    readonly maxRate: bigint | undefined;
+    readonly maxDuration: number | undefined;
+    readonly operator: `0x${string}` | undefined;
+}): ServerMandateCaps;
+/** Map the SDK's and the mandate's typed failures onto CLI exit codes. */
+export declare function explainPayFailure(error: unknown): unknown;
+//# sourceMappingURL=pay.d.ts.map

package/dist/cli/commands/pay.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pay.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/pay.ts"],"names":[],"mappings":"AAEA,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,uBAAuB,CAAC;AAsB/B,OAAO,KAAK,EAAkB,WAAW,EAAE,MAAM,eAAe,CAAC;AAOjE,eAAO,MAAM,UAAU,EAAE,WAsNxB,CAAC;AAKF;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,iBAAiB,GAAG,IAAI,EACjC,KAAK,EAAE;IACL,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,QAAQ,EAAE,KAAK,MAAM,EAAE,GAAG,SAAS,CAAC;CAC9C,GACA,iBAAiB,CA4CnB;AAqFD,0EAA0E;AAC1E,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAyCzD"}

package/dist/cli/commands/pay.js

@@ -0,0 +1,355 @@
+import { DEFAULT_SERVER_MANDATE_TTL_SECONDS, parseServerMandateCapsEnv, signServerMandate, } from "../../mandates/env.js";
+import { booleanFlag, integerFlag, jsonBodyFlag, stringFlag, stringFlags, } from "../args.js";
+import { formatDuration, formatUsdc, parseAmountUnits, parseDurationSeconds, parseUsdcAmount, } from "../amounts.js";
+import { assertTestnetRpc } from "../config.js";
+import { rpcTransport } from "../deps.js";
+import { CliError, configError, usageError } from "../errors.js";
+import { usdcFundingHint } from "../../network.js";
+import { isPrivyWalletSource, resolveCliWallet } from "../wallet.js";
+import { hasHeader, parseHeaders } from "./invoke.js";
+/** Default stream window a request-sized mandate allows (one day). */
+const DEFAULT_MAX_DURATION_SECONDS = 86_400;
+/** Longest response body printed in human mode before it is truncated. */
+const MAX_PRINTED_BODY_CHARS = 64 * 1024;
+export const payCommand = {
+    name: "pay",
+    summary: "Pay an x402 endpoint into a recoverable escrow stream, under a spend mandate",
+    usage: 'metrik pay <url> [--json \'{"text":"hi"}\' | --data <body>] [--method POST] [--header "K: V"] --max-amount <usdc> [--max-rate <usdc/s>] [--max-duration <seconds>] [--min-duration <seconds>] [--operator <address>] [--units atomic]',
+    flags: [
+        "data",
+        "json-body",
+        "method",
+        "header",
+        "max-amount",
+        "max-rate",
+        "max-duration",
+        "min-duration",
+        "operator",
+        "units",
+        "allow-legacy-factory",
+    ],
+    // It moves the payer's USDC (an EIP-3009 authorization the facilitator
+    // settles into the escrow). The PAYER broadcasts nothing and needs no gas,
+    // but it is a fund-moving command and is gated like one.
+    signs: true,
+    async run(context) {
+        const { args, config, env, out, deps } = context;
+        const x402 = requireX402(deps.x402);
+        const [urlArg] = args.positionals;
+        if (urlArg === undefined) {
+            throw usageError("metrik pay requires the <url> of an x402 endpoint");
+        }
+        const url = parseResourceUrl(urlArg);
+        const units = parseAmountUnits(stringFlag(args, "units"));
+        const maxAmountRaw = stringFlag(args, "max-amount");
+        const maxAmount = maxAmountRaw === undefined
+            ? undefined
+            : parseUsdcAmount(maxAmountRaw, units, "max-amount");
+        const maxRateRaw = stringFlag(args, "max-rate");
+        const maxRate = maxRateRaw === undefined
+            ? undefined
+            : parseUsdcAmount(maxRateRaw, units, "max-rate");
+        const maxDurationRaw = stringFlag(args, "max-duration");
+        const maxDuration = maxDurationRaw === undefined
+            ? undefined
+            : parseDurationSeconds(maxDurationRaw);
+        const minDuration = integerFlag(args, "min-duration");
+        const operator = stringFlag(args, "operator");
+        if (operator !== undefined && !/^0x[0-9a-fA-F]{40}$/.test(operator)) {
+            throw usageError(`--operator must be an EVM address (got "${operator}")`);
+        }
+        if (maxAmount !== undefined && maxAmount <= 0n) {
+            throw usageError("--max-amount must be greater than zero");
+        }
+        if (maxRate !== undefined && maxRate <= 0n) {
+            throw usageError("--max-rate must be greater than zero");
+        }
+        const init = buildRequest(context);
+        // The mandate: an operator-set standing ceiling (METRIK_AGENT_MANDATE_*),
+        // or one sized to exactly this payment. Either way it is SIGNED and
+        // `checkMandate()` gates the quote before anything is signed for the
+        // seller. There is no unbounded path: without standing caps, --max-amount
+        // is required.
+        const envCaps = parseServerMandateCapsEnv(env);
+        if (envCaps === null && maxAmount === undefined) {
+            throw usageError("metrik pay needs a spend ceiling: pass --max-amount <usdc> (or configure a standing mandate with METRIK_AGENT_MANDATE_*)", "no spend without a mandate: the seller picks the price, so the buyer must cap it. Nothing was sent.");
+        }
+        const caps = intersectCaps(envCaps, {
+            maxAmount,
+            maxRate,
+            maxDuration,
+            operator: operator,
+        });
+        const wallet = await resolveCliWallet(env, {
+            note: out.note,
+            rpcUrl: config.rpcUrl,
+        });
+        if (isPrivyWalletSource(wallet.source)) {
+            throw configError("metrik pay cannot sign with a Privy wallet", "an x402 payment is an EIP-3009 TransferWithAuthorization signature, and the Privy broker's typed-data policy allows only an InvocationCapability. Pay with METRIK_AGENT_PRIVATE_KEY or a CDP wallet.");
+        }
+        const { account } = wallet;
+        const read = deps.createReadClient(config);
+        await assertTestnetRpc(config, () => read.getChainId());
+        // The payer needs USDC only — no gas: the facilitator's relayer submits
+        // the authorization. A zero balance is a knowable fact before signing.
+        const balance = await read.usdcBalance(account.address).catch(() => null);
+        if (balance === 0n) {
+            throw new CliError(`wallet ${account.address} holds 0 USDC on ${config.network.name}, so it cannot pay`, {
+                exitCode: 3,
+                hint: `${usdcFundingHint(config.network)}, then re-run. (An x402 payer needs USDC only; no gas.)`,
+            });
+        }
+        const signedMandate = await signServerMandate(account, caps, {
+            chainId: config.chainId,
+        });
+        out.note(`paying ${url} (ceiling ${formatUsdc(maxAmount === undefined ? caps.maxPerStreamUsdc : maxAmount < caps.maxPerStreamUsdc ? maxAmount : caps.maxPerStreamUsdc)}, mandate from ${envCaps === null ? "this command" : "METRIK_AGENT_MANDATE_*"}) …`);
+        const result = await payOrExplain(x402, {
+            url,
+            init,
+            signer: account,
+            network: config.network,
+            signedMandate,
+            spentSoFarUsdc: 0n,
+            nowSeconds: deps.nowSeconds(),
+            ...(maxAmount === undefined ? {} : { maxAmount }),
+            ...(maxRate === undefined ? {} : { maxRatePerSecond: maxRate }),
+            ...(minDuration === undefined ? {} : { minDurationSeconds: minDuration }),
+            sdkOptions: {
+                transport: rpcTransport(config),
+                // A LEGACY deployment's factory is refused by the SDK unless the
+                // buyer opts in: streams there can still be closed and reclaimed, but
+                // nothing new should open on a generation being retired by default.
+                ...(booleanFlag(args, "allow-legacy-factory")
+                    ? { allowLegacyFactory: true }
+                    : {}),
+            },
+        });
+        const bodyText = await result.response.text();
+        const opener = result.metrikStreamOpener;
+        const quote = result.quote;
+        out.result({
+            paid: result.paid,
+            httpStatus: result.response.status,
+            contentType: result.response.headers.get("content-type"),
+            body: bodyText,
+            streamId: opener?.streamId ?? null,
+            opener: opener?.opener ?? null,
+            refundUrl: opener?.refundUrl ?? null,
+            escrow: opener?.escrow ?? null,
+            deposit: opener?.deposit ?? null,
+            ratePerSecond: opener?.ratePerSecond ?? null,
+            expiresAt: opener?.expiresAt ?? null,
+            operator: quote?.operator ?? null,
+            serviceRef: quote?.serviceRef ?? null,
+            minEarnSeconds: quote?.minEarnSeconds ?? null,
+            mandateSource: envCaps === null ? "request" : "env",
+            refundIsAutomatic: false,
+        });
+        if (!result.paid) {
+            out.print(`The endpoint answered ${result.response.status} without asking for payment; nothing was signed or paid.`);
+            out.print(truncate(bodyText));
+            return;
+        }
+        out.print(`Paid. HTTP ${result.response.status}`);
+        out.print(truncate(bodyText));
+        out.print("");
+        if (opener !== null) {
+            out.table([
+                ["streamId", opener.streamId],
+                ["opener", opener.opener],
+                ["payer", account.address],
+                ...(opener.deposit === null
+                    ? []
+                    : [["deposit", formatUsdc(opener.deposit)]]),
+                ...(opener.ratePerSecond === null
+                    ? []
+                    : [
+                        ["rate", `${formatUsdc(opener.ratePerSecond)} / verified second`],
+                    ]),
+                ...(quote?.minEarnSeconds === null ||
+                    quote?.minEarnSeconds === undefined
+                    ? []
+                    : [
+                        [
+                            "fully earned after",
+                            `${formatDuration(Number(quote.minEarnSeconds))} of verified delivery`,
+                        ],
+                    ]),
+                ...(opener.expiresAt === null
+                    ? []
+                    : [
+                        ["expires", new Date(opener.expiresAt * 1000).toISOString()],
+                    ]),
+                ["refund url", opener.refundUrl ?? "(the seller advertised no relay)"],
+            ]);
+            out.print("");
+            // A stream on another (e.g. legacy) registered escrow is reached by
+            // naming that escrow; the CLI defaults to the network's current one.
+            const escrowFlag = opener.escrow !== null &&
+                opener.escrow.toLowerCase() !== config.escrow.toLowerCase()
+                ? ` --escrow ${opener.escrow}`
+                : "";
+            out.print("Refunds are NOT automatic. The seller earns only for verified seconds; whatever is unearned stays in the escrow until someone reclaims it for you:");
+            out.print(opener.refundUrl === null
+                ? `  metrik reclaim ${opener.streamId}${escrowFlag}      (anyone may send it; the refund always goes to the payer)`
+                : `  metrik refund ${opener.streamId} --refund-url ${opener.refundUrl}${escrowFlag} --close --reclaim`);
+        }
+    },
+};
+const minBig = (a, b) => b !== undefined && b < a ? b : a;
+/**
+ * The mandate this command signs: a standing `METRIK_AGENT_MANDATE_*` ceiling
+ * INTERSECTED with every flag (the most restrictive value wins), or, with no
+ * standing ceiling, one sized to the flags. A flag can only tighten a
+ * standing ceiling, never loosen or bypass it; an `--operator` outside a
+ * standing allowlist is refused outright.
+ */
+export function intersectCaps(envCaps, flags) {
+    if (envCaps === null) {
+        const amount = flags.maxAmount;
+        return {
+            maxPerStreamUsdc: amount,
+            maxTotalUsdc: amount,
+            // No --max-rate: the price is the only cap on how fast the seller can
+            // earn it. Reported as minEarnSeconds so the buyer can see it.
+            maxRatePerSecondUsdc: flags.maxRate ?? amount,
+            maxDurationSeconds: flags.maxDuration ?? DEFAULT_MAX_DURATION_SECONDS,
+            allowedOperators: flags.operator === undefined ? [] : [flags.operator],
+            ttlSeconds: DEFAULT_SERVER_MANDATE_TTL_SECONDS,
+        };
+    }
+    let allowedOperators = envCaps.allowedOperators;
+    if (flags.operator !== undefined) {
+        if (allowedOperators.length > 0 &&
+            !allowedOperators.some((entry) => entry.toLowerCase() === flags.operator?.toLowerCase())) {
+            throw new CliError(`--operator ${flags.operator} is not in METRIK_AGENT_MANDATE_ALLOWED_OPERATORS`, {
+                exitCode: 3,
+                hint: "a flag can only narrow the standing mandate, never widen it. Nothing was sent.",
+            });
+        }
+        allowedOperators = [flags.operator];
+    }
+    return {
+        maxPerStreamUsdc: minBig(envCaps.maxPerStreamUsdc, flags.maxAmount),
+        maxTotalUsdc: minBig(envCaps.maxTotalUsdc, flags.maxAmount),
+        maxRatePerSecondUsdc: minBig(envCaps.maxRatePerSecondUsdc, flags.maxRate),
+        maxDurationSeconds: flags.maxDuration !== undefined &&
+            flags.maxDuration < envCaps.maxDurationSeconds
+            ? flags.maxDuration
+            : envCaps.maxDurationSeconds,
+        allowedOperators,
+        ttlSeconds: envCaps.ttlSeconds,
+    };
+}
+function requireX402(x402) {
+    if (x402 === undefined) {
+        throw new CliError("this CLI build has no x402 dependency wired (CliDependencies.x402)", { exitCode: 4 });
+    }
+    return x402;
+}
+function parseResourceUrl(raw) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        throw usageError(`<url> must be an absolute http(s) URL (got "${raw}")`);
+    }
+    if (url.protocol !== "https:" && url.protocol !== "http:") {
+        throw usageError(`<url> must be http(s) (got "${url.protocol}")`);
+    }
+    return url.toString();
+}
+function buildRequest(context) {
+    const { args } = context;
+    const data = stringFlag(args, "data");
+    const jsonValue = jsonBodyFlag(args);
+    const jsonAlias = stringFlag(args, "json-body");
+    if (jsonValue !== undefined && jsonAlias !== undefined) {
+        throw usageError("give the JSON body once: --json <body> or --json-body <body>");
+    }
+    const jsonBody = jsonValue ?? jsonAlias;
+    if (data !== undefined && jsonBody !== undefined) {
+        throw usageError("give either --data or --json <body>, not both");
+    }
+    if (jsonBody !== undefined) {
+        try {
+            JSON.parse(jsonBody);
+        }
+        catch {
+            throw usageError("--json <body> must be valid JSON");
+        }
+    }
+    const body = jsonBody ?? data;
+    const method = (stringFlag(args, "method") ?? (body === undefined ? "GET" : "POST")).toUpperCase();
+    const headers = parseHeaders(stringFlags(args, "header"));
+    if (jsonBody !== undefined && !hasHeader(headers, "content-type")) {
+        headers["content-type"] = "application/json";
+    }
+    for (const name of Object.keys(headers)) {
+        if (name === "payment-signature" || name === "x-payment") {
+            throw usageError(`do not set the ${name} header: the payment is signed by this command, after the quote passes the mandate`);
+        }
+    }
+    return {
+        method,
+        headers,
+        ...(body === undefined ? {} : { body }),
+    };
+}
+function truncate(text) {
+    return text.length <= MAX_PRINTED_BODY_CHARS
+        ? text
+        : `${text.slice(0, MAX_PRINTED_BODY_CHARS)}\n… (${text.length - MAX_PRINTED_BODY_CHARS} more characters; use --json for the whole body)`;
+}
+async function payOrExplain(x402, input) {
+    try {
+        return await x402.pay(input);
+    }
+    catch (error) {
+        throw explainPayFailure(error);
+    }
+}
+/** Map the SDK's and the mandate's typed failures onto CLI exit codes. */
+export function explainPayFailure(error) {
+    if (!(error instanceof Error))
+        return error;
+    switch (error.name) {
+        case "X402MandateDeniedError":
+            return new CliError(error.message, {
+                exitCode: 3,
+                hint: "raise --max-amount / --max-rate / --max-duration (or METRIK_AGENT_MANDATE_*) only if you mean to pay that much, that fast, for that long.",
+                cause: error,
+            });
+        case "X402PaymentRefusedError":
+            return new CliError(error.message, {
+                exitCode: 3,
+                hint: /exceeds maxAmount|exceeds maxRatePerSecond/.test(error.message)
+                    ? "that ceiling is your spend mandate's (--max-amount / --max-rate or METRIK_AGENT_MANDATE_*), handed to the SDK as a second gate. Nothing was signed."
+                    : "the quote failed one of the SDK's protections (wrong network or token, unknown factory, payTo != factory.predict(terms), not an opener payment, ...). Nothing was signed.",
+                cause: error,
+            });
+        case "X402PostSignatureError": {
+            // The signature was handed out: never say "nothing moved" unless the
+            // chain proves the authorization can never be used.
+            const post = error;
+            const recover = post.streamId === null
+                ? ""
+                : ` Recover the unearned part: metrik refund ${post.streamId} --refund-url <the seller's relay> --close --reclaim (or metrik reclaim ${post.streamId}).`;
+            return new CliError(error.message, {
+                exitCode: 4,
+                hint: post.state === "used"
+                    ? `the money LEFT the payer.${post.streamId === null ? " Its stream could not be identified on-chain; keep this output as evidence (see docs/x402.md)." : ` It is in stream ${post.streamId} (opener ${post.opener}).`}${recover}`
+                    : post.state === "possibly-used"
+                        ? "whether the authorization was used could not be established: treat the payment as SPENT and check USDC.authorizationState before paying again (see docs/x402.md)."
+                        : post.state === "unused-but-valid"
+                            ? "it has not moved yet, but the seller holds a signature valid until its validBefore: treat it as spent, or cancel it with USDC.cancelAuthorization (needs gas). See docs/x402.md."
+                            : "the authorization was never used and has expired: nothing moved.",
+                cause: error,
+            });
+        }
+        default:
+            return error;
+    }
+}
+//# sourceMappingURL=pay.js.map