@absol-labs/agent 0.9.1 → 0.11.0

package/dist/cli/escape-hatch.d.ts

@@ -0,0 +1,50 @@
+import type { StreamV2 } from "@absol-labs/sdk";
+import type { CliReadClient } from "./deps.js";
+/**
+ * The buyer's no-proof escape hatch, as the CLI reasons about it.
+ *
+ * Every OTHER route the CLI has to a buyer's money goes through
+ * `reclaimWithProof`, which needs a Merkle proof fetched from the oracle. So the
+ * whole proof-based path is only as available as the oracle is.
+ * `StreamEscrowV2.reclaimUnverified` is the path that is not: buyer-only, no
+ * proof, no signer quorum, no guardian. It is gated on one thing —
+ *
+ *     block.timestamp >= expiresAt + escapeGraceSeconds
+ *
+ * — and `escapeGraceSeconds` is a public immutable on the escrow, so readiness
+ * is fully computable before a single wei of gas is spent.
+ *
+ * Note which timestamp the escrow uses: `expiresAt`, NEVER `closedAt`. Closing a
+ * stream early does not bring the escape hatch forward, and the CLI must not
+ * imply that it does.
+ */
+export interface EscapeHatchWindow {
+    /** `escapeGraceSeconds` as read from the escrow. */
+    readonly graceSeconds: number;
+    /** The exact unix second at which `reclaimUnverified` stops reverting. */
+    readonly readyAt: number;
+    readonly ready: boolean;
+    /** Seconds left until `readyAt`; `0` once the window is open. */
+    readonly secondsRemaining: number;
+}
+export declare function escapeHatchWindow(stream: Pick<StreamV2, "expiresAt">, graceSeconds: number, nowSeconds: number): EscapeHatchWindow;
+/** `2026-09-17T09:15:00.000Z (1789…)`, or `-` for an unset timestamp. */
+export declare function formatTimestamp(seconds: number): string;
+/** One line describing where the escape hatch stands, for humans. */
+export declare function describeEscapeHatch(window: EscapeHatchWindow): string;
+export interface ChainNow {
+    readonly seconds: number;
+    /** `local` means the chain would not answer and the caller's clock was used. */
+    readonly source: "chain" | "local";
+}
+/**
+ * The time the ESCROW will compare against, not the time this machine thinks it
+ * is. `reclaimUnverified` reverts on `block.timestamp`, so a readiness answer
+ * computed from a skewed laptop clock could tell a buyer to spend gas on a
+ * guaranteed revert — or tell them to wait when the hatch is already open.
+ *
+ * A failed read is not fatal: the caller's clock is the fallback, and the
+ * `source` field is reported so the difference is never hidden.
+ */
+export declare function readChainNow(read: Pick<CliReadClient, "latestBlockTimestamp">, fallbackSeconds: number): Promise<ChainNow>;
+//# sourceMappingURL=escape-hatch.d.ts.map

package/dist/cli/escape-hatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"escape-hatch.d.ts","sourceRoot":"","sources":["../../src/cli/escape-hatch.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAGhD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE/C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,iBAAiB;IAChC,oDAAoD;IACpD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,iEAAiE;IACjE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC;AAED,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,EACnC,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,GACjB,iBAAiB,CASnB;AAED,yEAAyE;AACzE,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGvD;AAED,qEAAqE;AACrE,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,CAMrE;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,gFAAgF;IAChF,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC;CACpC;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,sBAAsB,CAAC,EACjD,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,QAAQ,CAAC,CAUnB"}

package/dist/cli/escape-hatch.js

@@ -0,0 +1,45 @@
+import { formatDuration } from "./amounts.js";
+export function escapeHatchWindow(stream, graceSeconds, nowSeconds) {
+    const readyAt = stream.expiresAt + graceSeconds;
+    const secondsRemaining = readyAt - nowSeconds;
+    return {
+        graceSeconds,
+        readyAt,
+        ready: secondsRemaining <= 0,
+        secondsRemaining: secondsRemaining > 0 ? secondsRemaining : 0,
+    };
+}
+/** `2026-09-17T09:15:00.000Z (1789…)`, or `-` for an unset timestamp. */
+export function formatTimestamp(seconds) {
+    if (seconds <= 0)
+        return "-";
+    return `${new Date(seconds * 1000).toISOString()} (${seconds})`;
+}
+/** One line describing where the escape hatch stands, for humans. */
+export function describeEscapeHatch(window) {
+    return window.ready
+        ? `open since ${formatTimestamp(window.readyAt)}`
+        : `opens ${formatTimestamp(window.readyAt)} — in ${formatDuration(window.secondsRemaining)}`;
+}
+/**
+ * The time the ESCROW will compare against, not the time this machine thinks it
+ * is. `reclaimUnverified` reverts on `block.timestamp`, so a readiness answer
+ * computed from a skewed laptop clock could tell a buyer to spend gas on a
+ * guaranteed revert — or tell them to wait when the hatch is already open.
+ *
+ * A failed read is not fatal: the caller's clock is the fallback, and the
+ * `source` field is reported so the difference is never hidden.
+ */
+export async function readChainNow(read, fallbackSeconds) {
+    try {
+        const seconds = await read.latestBlockTimestamp();
+        if (Number.isFinite(seconds) && seconds > 0) {
+            return { seconds, source: "chain" };
+        }
+    }
+    catch {
+        // fall through to the caller's clock
+    }
+    return { seconds: fallbackSeconds, source: "local" };
+}
+//# sourceMappingURL=escape-hatch.js.map

package/dist/cli/escape-hatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"escape-hatch.js","sourceRoot":"","sources":["../../src/cli/escape-hatch.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AA+B9C,MAAM,UAAU,iBAAiB,CAC/B,MAAmC,EACnC,YAAoB,EACpB,UAAkB;IAElB,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,GAAG,YAAY,CAAC;IAChD,MAAM,gBAAgB,GAAG,OAAO,GAAG,UAAU,CAAC;IAC9C,OAAO;QACL,YAAY;QACZ,OAAO;QACP,KAAK,EAAE,gBAAgB,IAAI,CAAC;QAC5B,gBAAgB,EAAE,gBAAgB,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;KAC9D,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,IAAI,OAAO,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC;IAC7B,OAAO,GAAG,IAAI,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,OAAO,GAAG,CAAC;AAClE,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,mBAAmB,CAAC,MAAyB;IAC3D,OAAO,MAAM,CAAC,KAAK;QACjB,CAAC,CAAC,cAAc,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE;QACjD,CAAC,CAAC,SAAS,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,cAAc,CAC7D,MAAM,CAAC,gBAAgB,CACxB,EAAE,CAAC;AACV,CAAC;AAQD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAiD,EACjD,eAAuB;IAEvB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAClD,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QACtC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,qCAAqC;IACvC,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AACvD,CAAC"}

package/dist/cli/index.d.ts

@@ -0,0 +1,8 @@
+export { runCli, renderHelp, COMMANDS, type RunCliOptions } from "./run.js";
+export { parseArgs, type ParsedArgs } from "./args.js";
+export { TESTNET_CHAIN_IDS, assertTestnetChainId, assertTestnetRpc, resolveConfig, type CliConfig, } from "./config.js";
+export { CliError, describeError } from "./errors.js";
+export { defaultCliDependencies, type CliDependencies, type CliReadClient, type CliWriteClient, type OpenedStream, type StreamOpenedQuery, } from "./deps.js";
+export { CDP_ENV_VARS, PRIVATE_KEY_ENV, optionalCliWallet, resolveCliWallet, type CliWallet, type CliWalletSource, } from "./wallet.js";
+export type { CommandContext, CommandSpec } from "./context.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/cli/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,aAAa,EAAE,MAAM,UAAU,CAAC;AAC5E,OAAO,EAAE,SAAS,EAAE,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,aAAa,EACb,KAAK,SAAS,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EACL,sBAAsB,EACtB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,iBAAiB,GACvB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,YAAY,EACZ,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,KAAK,SAAS,EACd,KAAK,eAAe,GACrB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC"}

package/dist/cli/index.js

@@ -0,0 +1,7 @@
+export { runCli, renderHelp, COMMANDS } from "./run.js";
+export { parseArgs } from "./args.js";
+export { TESTNET_CHAIN_IDS, assertTestnetChainId, assertTestnetRpc, resolveConfig, } from "./config.js";
+export { CliError, describeError } from "./errors.js";
+export { defaultCliDependencies, } from "./deps.js";
+export { CDP_ENV_VARS, PRIVATE_KEY_ENV, optionalCliWallet, resolveCliWallet, } from "./wallet.js";
+//# sourceMappingURL=index.js.map

package/dist/cli/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAsB,MAAM,UAAU,CAAC;AAC5E,OAAO,EAAE,SAAS,EAAmB,MAAM,WAAW,CAAC;AACvD,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,aAAa,GAEd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EACL,sBAAsB,GAMvB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,YAAY,EACZ,eAAe,EACf,iBAAiB,EACjB,gBAAgB,GAGjB,MAAM,aAAa,CAAC"}

package/dist/cli/listings.d.ts

@@ -0,0 +1,15 @@
+import type { CommandContext } from "./context.js";
+import type { ServiceListing } from "./deps.js";
+/**
+ * Finds the verified listing for a `serviceRef`.
+ *
+ * The registry is an untrusted transport: `discoverServices` re-derives every
+ * `serviceRef` from the signed record and recovers the operator signature, so a
+ * compromised registry can neither invent an operator to pay nor redirect an
+ * invocation URL. That verification is the reason the CLI routes through
+ * discovery instead of taking a `--url`.
+ */
+export declare function resolveListing(context: CommandContext, serviceRef: `0x${string}`, options: {
+    readonly required: boolean;
+}): Promise<ServiceListing | null>;
+//# sourceMappingURL=listings.d.ts.map

package/dist/cli/listings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"listings.d.ts","sourceRoot":"","sources":["../../src/cli/listings.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEhD;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,cAAc,EACvB,UAAU,EAAE,KAAK,MAAM,EAAE,EACzB,OAAO,EAAE;IAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,GACtC,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAyDhC"}

package/dist/cli/listings.js

@@ -0,0 +1,56 @@
+import { RegistryUnavailableError } from "../discovery/registry.js";
+import { CliError } from "./errors.js";
+/**
+ * Finds the verified listing for a `serviceRef`.
+ *
+ * The registry is an untrusted transport: `discoverServices` re-derives every
+ * `serviceRef` from the signed record and recovers the operator signature, so a
+ * compromised registry can neither invent an operator to pay nor redirect an
+ * invocation URL. That verification is the reason the CLI routes through
+ * discovery instead of taking a `--url`.
+ */
+export async function resolveListing(context, serviceRef, options) {
+    const { config, out, deps } = context;
+    let services;
+    try {
+        services = (await deps.discover({
+            registryUrl: config.registryUrl,
+            logger: { warn: (...parts) => out.note(parts.map(String).join(" ")) },
+        })).services;
+    }
+    catch (error) {
+        if (error instanceof RegistryUnavailableError && !options.required) {
+            out.note(`warning: the registry at ${config.registryUrl} is unreachable; continuing without a verified listing.`);
+            return null;
+        }
+        throw new CliError(`the service registry at ${config.registryUrl} could not be read`, { exitCode: 4, cause: error });
+    }
+    const wanted = serviceRef.toLowerCase();
+    const match = services.find((service) => service.serviceRef.toLowerCase() === wanted);
+    if (match === undefined) {
+        if (!options.required)
+            return null;
+        throw new CliError(`no verified listing in the registry matches serviceRef ${serviceRef}`, {
+            exitCode: 4,
+            hint: "run `metrik discover` to see what is listed. A listing that fails signature verification is dropped, so it will not appear here.",
+        });
+    }
+    if (match.accessUrl === null) {
+        if (!options.required)
+            return null;
+        throw new CliError(`listing ${serviceRef} carries no signed invocation URL`, {
+            exitCode: 4,
+            hint: "the CLI refuses to call an origin that the operator did not sign.",
+        });
+    }
+    return {
+        serviceRef: match.serviceRef,
+        operator: match.operator,
+        publicUrl: match.publicUrl,
+        access: match.access,
+        accessUrl: match.accessUrl,
+        signed: match.signed,
+        category: match.category,
+    };
+}
+//# sourceMappingURL=listings.js.map

package/dist/cli/listings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"listings.js","sourceRoot":"","sources":["../../src/cli/listings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAEpE,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAIvC;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAuB,EACvB,UAAyB,EACzB,OAAuC;IAEvC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;IACtC,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,CACT,MAAM,IAAI,CAAC,QAAQ,CAAC;YAClB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE;SACtE,CAAC,CACH,CAAC,QAAQ,CAAC;IACb,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,wBAAwB,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACnE,GAAG,CAAC,IAAI,CACN,4BAA4B,MAAM,CAAC,WAAW,yDAAyD,CACxG,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,QAAQ,CAChB,2BAA2B,MAAM,CAAC,WAAW,oBAAoB,EACjE,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAC9B,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;IACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CACzB,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,MAAM,CACzD,CAAC;IACF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,CAAC,OAAO,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,IAAI,QAAQ,CAChB,0DAA0D,UAAU,EAAE,EACtE;YACE,QAAQ,EAAE,CAAC;YACX,IAAI,EAAE,kIAAkI;SACzI,CACF,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,OAAO,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,IAAI,QAAQ,CAChB,WAAW,UAAU,mCAAmC,EACxD;YACE,QAAQ,EAAE,CAAC;YACX,IAAI,EAAE,mEAAmE;SAC1E,CACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC;AACJ,CAAC"}

package/dist/cli/mandate.d.ts

@@ -0,0 +1,66 @@
+import type { Account } from "viem";
+import { type ServerMandateCaps } from "../mandates/env.js";
+import type { SignedSpendMandate } from "../mandates/mandate.js";
+/**
+ * Spend mandates in the CLI.
+ *
+ * Every fund-moving path in this package goes through `checkMandate()` — that is
+ * a golden rule of the agent layer, and the CLI is not exempt. The CLI's twist
+ * is that the person typing the command IS the mandate owner: they hold the key
+ * and they just stated the exact spend on the command line. So the mandate is
+ * self-signed from the same wallet that funds the stream, exactly as the MCP
+ * server does (`signServerMandate`).
+ *
+ * Two sources, in priority order:
+ *
+ *  1. `METRIK_AGENT_MANDATE_*` in the environment — an explicit standing ceiling.
+ *     If the requested hire exceeds it, `checkMandate` DENIES it. This is the
+ *     path to use when a CLI runs unattended under a policy.
+ *  2. No env caps configured — the mandate is sized to exactly this hire and
+ *     scoped to exactly this operator. It authorizes the command that was typed
+ *     and nothing wider.
+ *
+ * Neither path is an unbounded mandate.
+ */
+export interface RequestedSpend {
+    readonly operator: `0x${string}`;
+    readonly budgetUsdc: bigint;
+    readonly ratePerSecondUsdc: bigint;
+    readonly durationSeconds: number;
+}
+export interface CliMandate {
+    readonly signed: SignedSpendMandate;
+    /** Where the caps came from, for the human-readable output. */
+    readonly source: "env" | "request";
+}
+/**
+ * The caps this hire would be authorized under, WITHOUT signing anything. Split
+ * out so `open --dry-run` can report the mandate it would use even when there is
+ * no key to sign it with.
+ */
+export declare function cliMandateCaps(request: RequestedSpend, env: NodeJS.ProcessEnv): {
+    readonly caps: ServerMandateCaps;
+    readonly source: "env" | "request";
+};
+export declare function signCliMandate(account: Account, request: RequestedSpend, options: {
+    readonly chainId: number;
+    readonly env: NodeJS.ProcessEnv;
+}): Promise<CliMandate>;
+/**
+ * The operator's claim is not a SPEND: it redeems value the stream already
+ * earned under an oracle-verified checkpoint, and the escrow pays it to the
+ * stream's operator and nobody else. But `checkMandate()` gates every
+ * fund-moving path in this package without exception, so the claim carries a
+ * mandate too. The caps below are placeholders that satisfy the schema against a
+ * zero-valued request; the real gate is the escrow's own `NotOperator()`.
+ */
+export declare function signClaimMandate(account: Account, chainId: number): Promise<SignedSpendMandate>;
+/**
+ * Close and reclaim are BUYER-RECOVERY actions: they stop payment or return
+ * unspent funds to the buyer, and `VerifiedStreamAgentClient` authorizes them on
+ * the mandate owner's signature alone — never on caps or expiry, so a lapsed
+ * mandate can never strand a buyer's own money. The caps below are therefore
+ * placeholders that satisfy the schema; they gate nothing.
+ */
+export declare function signRecoveryMandate(account: Account, chainId: number): Promise<SignedSpendMandate>;
+//# sourceMappingURL=mandate.d.ts.map

package/dist/cli/mandate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mandate.d.ts","sourceRoot":"","sources":["../../src/cli/mandate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEpC,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,KAAK,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,EAAE,KAAK,GAAG,SAAS,CAAC;CACpC;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,cAAc,EACvB,GAAG,EAAE,MAAM,CAAC,UAAU,GACrB;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,GAAG,SAAS,CAAA;CAAE,CAc1E;AAED,wBAAsB,cAAc,CAClC,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAA;CAAE,GACrE,OAAO,CAAC,UAAU,CAAC,CAMrB;AAED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,kBAAkB,CAAC,CAE7B;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,kBAAkB,CAAC,CAE7B"}

package/dist/cli/mandate.js

@@ -0,0 +1,61 @@
+import { parseServerMandateCapsEnv, signServerMandate, DEFAULT_SERVER_MANDATE_TTL_SECONDS, } from "../mandates/env.js";
+/**
+ * The caps this hire would be authorized under, WITHOUT signing anything. Split
+ * out so `open --dry-run` can report the mandate it would use even when there is
+ * no key to sign it with.
+ */
+export function cliMandateCaps(request, env) {
+    const envCaps = parseServerMandateCapsEnv(env);
+    if (envCaps !== null)
+        return { caps: envCaps, source: "env" };
+    return {
+        caps: {
+            maxPerStreamUsdc: request.budgetUsdc,
+            maxTotalUsdc: request.budgetUsdc,
+            maxRatePerSecondUsdc: request.ratePerSecondUsdc,
+            maxDurationSeconds: request.durationSeconds,
+            allowedOperators: [request.operator],
+            ttlSeconds: DEFAULT_SERVER_MANDATE_TTL_SECONDS,
+        },
+        source: "request",
+    };
+}
+export async function signCliMandate(account, request, options) {
+    const { caps, source } = cliMandateCaps(request, options.env);
+    const signed = await signServerMandate(account, caps, {
+        chainId: options.chainId,
+    });
+    return { signed, source };
+}
+/**
+ * The operator's claim is not a SPEND: it redeems value the stream already
+ * earned under an oracle-verified checkpoint, and the escrow pays it to the
+ * stream's operator and nobody else. But `checkMandate()` gates every
+ * fund-moving path in this package without exception, so the claim carries a
+ * mandate too. The caps below are placeholders that satisfy the schema against a
+ * zero-valued request; the real gate is the escrow's own `NotOperator()`.
+ */
+export async function signClaimMandate(account, chainId) {
+    return await signPlaceholderMandate(account, chainId);
+}
+/**
+ * Close and reclaim are BUYER-RECOVERY actions: they stop payment or return
+ * unspent funds to the buyer, and `VerifiedStreamAgentClient` authorizes them on
+ * the mandate owner's signature alone — never on caps or expiry, so a lapsed
+ * mandate can never strand a buyer's own money. The caps below are therefore
+ * placeholders that satisfy the schema; they gate nothing.
+ */
+export async function signRecoveryMandate(account, chainId) {
+    return await signPlaceholderMandate(account, chainId);
+}
+async function signPlaceholderMandate(account, chainId) {
+    return await signServerMandate(account, {
+        maxPerStreamUsdc: 1n,
+        maxTotalUsdc: 1n,
+        maxRatePerSecondUsdc: 1n,
+        maxDurationSeconds: 1,
+        allowedOperators: [],
+        ttlSeconds: DEFAULT_SERVER_MANDATE_TTL_SECONDS,
+    }, { chainId });
+}
+//# sourceMappingURL=mandate.js.map

package/dist/cli/mandate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mandate.js","sourceRoot":"","sources":["../../src/cli/mandate.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,kCAAkC,GAEnC,MAAM,oBAAoB,CAAC;AAqC5B;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAuB,EACvB,GAAsB;IAEtB,MAAM,OAAO,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC9D,OAAO;QACL,IAAI,EAAE;YACJ,gBAAgB,EAAE,OAAO,CAAC,UAAU;YACpC,YAAY,EAAE,OAAO,CAAC,UAAU;YAChC,oBAAoB,EAAE,OAAO,CAAC,iBAAiB;YAC/C,kBAAkB,EAAE,OAAO,CAAC,eAAe;YAC3C,gBAAgB,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;YACpC,UAAU,EAAE,kCAAkC;SAC/C;QACD,MAAM,EAAE,SAAS;KAClB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAgB,EAChB,OAAuB,EACvB,OAAsE;IAEtE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,OAAO,EAAE,IAAI,EAAE;QACpD,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAgB,EAChB,OAAe;IAEf,OAAO,MAAM,sBAAsB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAgB,EAChB,OAAe;IAEf,OAAO,MAAM,sBAAsB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,OAAgB,EAChB,OAAe;IAEf,OAAO,MAAM,iBAAiB,CAC5B,OAAO,EACP;QACE,gBAAgB,EAAE,EAAE;QACpB,YAAY,EAAE,EAAE;QAChB,oBAAoB,EAAE,EAAE;QACxB,kBAAkB,EAAE,CAAC;QACrB,gBAAgB,EAAE,EAAE;QACpB,UAAU,EAAE,kCAAkC;KAC/C,EACD,EAAE,OAAO,EAAE,CACZ,CAAC;AACJ,CAAC"}

package/dist/cli/output.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Output shape. Human-readable by default; `--json` emits one JSON object on
+ * stdout per command so a script can pipe it into `jq` without parsing prose.
+ *
+ * Warnings and progress go to stderr in BOTH modes, so `--json` stdout stays a
+ * single parseable document even when discovery drops a row or a reclaim
+ * retries.
+ */
+export interface CliStreams {
+    readonly stdout: (line: string) => void;
+    readonly stderr: (line: string) => void;
+}
+export interface Printer extends CliStreams {
+    readonly json: boolean;
+    /** Human-readable body. Suppressed entirely in `--json` mode. */
+    readonly print: (line: string) => void;
+    /** Key/value block, aligned. Suppressed in `--json` mode. */
+    readonly table: (rows: readonly (readonly [string, string])[]) => void;
+    /** Progress / warnings. Always stderr, always shown. */
+    readonly note: (line: string) => void;
+    /** The machine-readable result. Emitted only in `--json` mode. */
+    readonly result: (value: unknown) => void;
+    /**
+     * One COMPACT JSON object on a single stdout line — JSON Lines. Used by
+     * commands that emit a record per tick (`watch`), where every line must parse
+     * standalone so a consumer can react as each one lands. `result` is the
+     * pretty-printed single-document form and is wrong for a stream: a multi-line
+     * object means not one of its lines parses on its own.
+     */
+    readonly resultLine: (value: unknown) => void;
+}
+export declare function createPrinter(streams: CliStreams, json: boolean): Printer;
+//# sourceMappingURL=output.d.ts.map

package/dist/cli/output.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../../src/cli/output.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACzC;AAED,MAAM,WAAW,OAAQ,SAAQ,UAAU;IACzC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,iEAAiE;IACjE,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC,6DAA6D;IAC7D,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC;IACvE,wDAAwD;IACxD,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACtC,kEAAkE;IAClE,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IAC1C;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;CAC/C;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAwBzE"}

package/dist/cli/output.js

@@ -0,0 +1,34 @@
+export function createPrinter(streams, json) {
+    return {
+        ...streams,
+        json,
+        print(line) {
+            if (!json)
+                streams.stdout(line);
+        },
+        table(rows) {
+            if (json)
+                return;
+            const width = rows.reduce((max, [key]) => Math.max(max, key.length), 0);
+            for (const [key, value] of rows) {
+                streams.stdout(`  ${key.padEnd(width)}  ${value}`);
+            }
+        },
+        note(line) {
+            streams.stderr(line);
+        },
+        result(value) {
+            if (json)
+                streams.stdout(JSON.stringify(value, jsonReplacer, 2));
+        },
+        resultLine(value) {
+            if (json)
+                streams.stdout(JSON.stringify(value, jsonReplacer));
+        },
+    };
+}
+/** bigints are the natural amount type here; JSON has no bigint. */
+function jsonReplacer(_key, value) {
+    return typeof value === "bigint" ? value.toString() : value;
+}
+//# sourceMappingURL=output.js.map

package/dist/cli/output.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"output.js","sourceRoot":"","sources":["../../src/cli/output.ts"],"names":[],"mappings":"AAiCA,MAAM,UAAU,aAAa,CAAC,OAAmB,EAAE,IAAa;IAC9D,OAAO;QACL,GAAG,OAAO;QACV,IAAI;QACJ,KAAK,CAAC,IAAI;YACR,IAAI,CAAC,IAAI;gBAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC;QACD,KAAK,CAAC,IAAI;YACR,IAAI,IAAI;gBAAE,OAAO;YACjB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YACxE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;gBAChC,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QACD,IAAI,CAAC,IAAI;YACP,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;QACD,MAAM,CAAC,KAAK;YACV,IAAI,IAAI;gBAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC;QACnE,CAAC;QACD,UAAU,CAAC,KAAK;YACd,IAAI,IAAI;gBAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC;QAChE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,SAAS,YAAY,CAAC,IAAY,EAAE,KAAc;IAChD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;AAC9D,CAAC"}

package/dist/cli/preflight.d.ts

@@ -0,0 +1,38 @@
+import type { CliReadClient } from "./deps.js";
+/** Where a Base Sepolia test wallet gets its gas. */
+export declare const BASE_SEPOLIA_FAUCET_URL = "https://www.alchemy.com/faucets/base-sepolia";
+/** Where a Base Sepolia test wallet gets the USDC it escrows. */
+export declare const CIRCLE_USDC_FAUCET_URL = "https://faucet.circle.com";
+/**
+ * Refuse to broadcast from a wallet that cannot pay for gas.
+ *
+ * Without this, the first thing an unfunded wallet sees is the node's own
+ * phrasing — `USDC approve transaction failed: Execution reverted with reason:
+ * gas required exceeds allowance (0)` — which reads like a USDC allowance
+ * problem and sends the reader looking at approvals. The actual fact is "this
+ * address holds no ETH", and it is knowable with one read before anything is
+ * signed.
+ *
+ * Deliberately only a ZERO check, not an estimate: predicting the gas a hire
+ * will cost means simulating it, and a wallet with a little ETH that still runs
+ * short should get the real revert rather than a guess from this CLI.
+ */
+export declare function assertCanPayGas(read: CliReadClient, address: `0x${string}`): Promise<void>;
+/**
+ * Refuse to broadcast a hire the wallet cannot fund.
+ *
+ * The sibling of `assertCanPayGas`, for the OTHER balance. Gas is ETH and the
+ * deposit is USDC: they are separate balances on separate tokens, so a wallet
+ * that passes the gas check can still hold no USDC at all. Without this the
+ * `open` path sends the USDC approval FIRST — which succeeds, because approving
+ * an amount you do not hold is legal — and then reverts inside `transferFrom`,
+ * having already spent gas to learn something that was one `balanceOf` away.
+ *
+ * Deliberately NOT an allowance check. The CLI's own open path grants the
+ * bounded approval it needs (`approveTxHash` in the result), so a missing
+ * allowance is a step of the command, not a precondition for it; gating on it
+ * would refuse a hire that was about to work. Balance is the fact the CLI
+ * cannot fix for you.
+ */
+export declare function assertCanFundStream(read: CliReadClient, address: `0x${string}`, budgetUsdc: bigint): Promise<void>;
+//# sourceMappingURL=preflight.d.ts.map

package/dist/cli/preflight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.d.ts","sourceRoot":"","sources":["../../src/cli/preflight.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE/C,qDAAqD;AACrD,eAAO,MAAM,uBAAuB,iDACY,CAAC;AAEjD,iEAAiE;AACjE,eAAO,MAAM,sBAAsB,8BAA8B,CAAC;AAElE;;;;;;;;;;;;;GAaG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,aAAa,EACnB,OAAO,EAAE,KAAK,MAAM,EAAE,GACrB,OAAO,CAAC,IAAI,CAAC,CAkBf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,aAAa,EACnB,OAAO,EAAE,KAAK,MAAM,EAAE,EACtB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAmBf"}

package/dist/cli/preflight.js

@@ -0,0 +1,72 @@
+import { formatUsdc } from "./amounts.js";
+import { CliError } from "./errors.js";
+/** Where a Base Sepolia test wallet gets its gas. */
+export const BASE_SEPOLIA_FAUCET_URL = "https://www.alchemy.com/faucets/base-sepolia";
+/** Where a Base Sepolia test wallet gets the USDC it escrows. */
+export const CIRCLE_USDC_FAUCET_URL = "https://faucet.circle.com";
+/**
+ * Refuse to broadcast from a wallet that cannot pay for gas.
+ *
+ * Without this, the first thing an unfunded wallet sees is the node's own
+ * phrasing — `USDC approve transaction failed: Execution reverted with reason:
+ * gas required exceeds allowance (0)` — which reads like a USDC allowance
+ * problem and sends the reader looking at approvals. The actual fact is "this
+ * address holds no ETH", and it is knowable with one read before anything is
+ * signed.
+ *
+ * Deliberately only a ZERO check, not an estimate: predicting the gas a hire
+ * will cost means simulating it, and a wallet with a little ETH that still runs
+ * short should get the real revert rather than a guess from this CLI.
+ */
+export async function assertCanPayGas(read, address) {
+    let balance;
+    try {
+        balance = await read.nativeBalance(address);
+    }
+    catch {
+        // A balance read is a courtesy, not a gate. If the RPC will not answer it,
+        // let the command proceed and fail with the real error.
+        return;
+    }
+    if (balance > 0n)
+        return;
+    throw new CliError(`wallet ${address} has 0 ETH on Base Sepolia, so it cannot pay for gas`, {
+        exitCode: 3,
+        hint: `fund it at ${BASE_SEPOLIA_FAUCET_URL}, then re-run. (Gas is ETH; the stream itself is escrowed in USDC, which is a separate balance.)`,
+    });
+}
+/**
+ * Refuse to broadcast a hire the wallet cannot fund.
+ *
+ * The sibling of `assertCanPayGas`, for the OTHER balance. Gas is ETH and the
+ * deposit is USDC: they are separate balances on separate tokens, so a wallet
+ * that passes the gas check can still hold no USDC at all. Without this the
+ * `open` path sends the USDC approval FIRST — which succeeds, because approving
+ * an amount you do not hold is legal — and then reverts inside `transferFrom`,
+ * having already spent gas to learn something that was one `balanceOf` away.
+ *
+ * Deliberately NOT an allowance check. The CLI's own open path grants the
+ * bounded approval it needs (`approveTxHash` in the result), so a missing
+ * allowance is a step of the command, not a precondition for it; gating on it
+ * would refuse a hire that was about to work. Balance is the fact the CLI
+ * cannot fix for you.
+ */
+export async function assertCanFundStream(read, address, budgetUsdc) {
+    let balance;
+    try {
+        balance = await read.usdcBalance(address);
+    }
+    catch {
+        // Same courtesy rule as the gas check: an RPC that will not answer a
+        // balance read must not become this command's failure mode. Proceed and let
+        // the real error surface.
+        return;
+    }
+    if (balance >= budgetUsdc)
+        return;
+    throw new CliError(`wallet ${address} holds ${formatUsdc(balance)} but --budget is ${formatUsdc(budgetUsdc)}`, {
+        exitCode: 3,
+        hint: `the deposit is escrowed in USDC — fund the wallet at ${CIRCLE_USDC_FAUCET_URL} (Base Sepolia), then re-run. (Gas is a separate ETH balance.)`,
+    });
+}
+//# sourceMappingURL=preflight.js.map

package/dist/cli/preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.js","sourceRoot":"","sources":["../../src/cli/preflight.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAGvC,qDAAqD;AACrD,MAAM,CAAC,MAAM,uBAAuB,GAClC,8CAA8C,CAAC;AAEjD,iEAAiE;AACjE,MAAM,CAAC,MAAM,sBAAsB,GAAG,2BAA2B,CAAC;AAElE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAmB,EACnB,OAAsB;IAEtB,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,wDAAwD;QACxD,OAAO;IACT,CAAC;IACD,IAAI,OAAO,GAAG,EAAE;QAAE,OAAO;IAEzB,MAAM,IAAI,QAAQ,CAChB,UAAU,OAAO,sDAAsD,EACvE;QACE,QAAQ,EAAE,CAAC;QACX,IAAI,EAAE,cAAc,uBAAuB,kGAAkG;KAC9I,CACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAmB,EACnB,OAAsB,EACtB,UAAkB;IAElB,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,4EAA4E;QAC5E,0BAA0B;QAC1B,OAAO;IACT,CAAC;IACD,IAAI,OAAO,IAAI,UAAU;QAAE,OAAO;IAElC,MAAM,IAAI,QAAQ,CAChB,UAAU,OAAO,UAAU,UAAU,CAAC,OAAO,CAAC,oBAAoB,UAAU,CAAC,UAAU,CAAC,EAAE,EAC1F;QACE,QAAQ,EAAE,CAAC;QACX,IAAI,EAAE,wDAAwD,sBAAsB,gEAAgE;KACrJ,CACF,CAAC;AACJ,CAAC"}

package/dist/cli/privy.d.ts

@@ -0,0 +1,83 @@
+import { type Account, type Transport } from "viem";
+import { type AutonomousWalletCredentialStore } from "../wallet/autonomous-wallet.js";
+/**
+ * The CLI's two Privy wallet shapes.
+ *
+ * Privy differs from the private-key and CDP paths in ONE structural way: the
+ * account it yields has no local `signTransaction`. It signs and broadcasts by
+ * sending `eth_sendTransaction` / `eth_signTypedData_v4` to a provider, so the
+ * viem wallet client's TRANSPORT must be that provider rather than a plain HTTP
+ * RPC. That is the whole difference, and it is what `transport` below carries.
+ *
+ * Neither shape puts a wallet key on this machine. The signing key lives at
+ * Privy; the broker holds the Privy authorization key. What the CLI holds is
+ * either a short-lived session token (`session`) or a P-256 authorization key
+ * in the host credential store (`autonomous`) — a key that authorizes a
+ * policy-bounded request, not a key that can move funds by itself.
+ */
+export type PrivyCliWalletSource = "privy-autonomous" | "privy-session";
+/** The store key naming the agent-owned wallet in the host credential store. */
+export declare const PRIVY_WALLET_KEY_ENV = "METRIK_AGENT_PRIVY_WALLET_KEY";
+/** Broker base URL. Optional for `autonomous`, REQUIRED for `session`. */
+export declare const PRIVY_BROKER_URL_ENV = "METRIK_AGENT_PRIVY_BROKER_URL";
+/** A scoped session token minted by the broker's `POST /v1/sessions`. */
+export declare const PRIVY_SESSION_TOKEN_ENV = "METRIK_AGENT_PRIVY_SESSION_TOKEN";
+/** The embedded wallet address the session is bound to. */
+export declare const PRIVY_ADDRESS_ENV = "METRIK_AGENT_PRIVY_ADDRESS";
+/** The PUBLIC Privy app id. Not a secret — the broker serves it at `/v1/config`. */
+export declare const PRIVY_APP_ID_ENV = "METRIK_AGENT_PRIVY_APP_ID";
+/** Every variable either Privy shape reads. Named in errors, never printed. */
+export declare const PRIVY_ENV_VARS: readonly ["METRIK_AGENT_PRIVY_WALLET_KEY", "METRIK_AGENT_PRIVY_BROKER_URL", "METRIK_AGENT_PRIVY_SESSION_TOKEN", "METRIK_AGENT_PRIVY_ADDRESS", "METRIK_AGENT_PRIVY_APP_ID"];
+/** The variables the user-owned session shape needs, all of them. */
+export declare const PRIVY_SESSION_ENV_VARS: readonly ["METRIK_AGENT_PRIVY_BROKER_URL", "METRIK_AGENT_PRIVY_SESSION_TOKEN", "METRIK_AGENT_PRIVY_ADDRESS", "METRIK_AGENT_PRIVY_APP_ID"];
+/**
+ * The spend ceiling a broker enforces server-side, read from `GET /v1/config`.
+ *
+ * These are the SAME numbers the broker checks `openStream` against
+ * (`deposit <= maxTotalUsdc`, `ratePerSecond <= maxRatePerSecondUsdc`,
+ * `duration <= maxDurationSeconds`), which is why the CLI can use them to
+ * refuse an over-ceiling hire locally instead of paying gas to learn a knowable
+ * fact. It reads them rather than hardcoding them: the ceiling belongs to the
+ * broker, and a copy in this file would be a second source of truth that goes
+ * stale silently.
+ */
+export interface PrivySpendPolicy {
+    readonly brokerUrl: string;
+    readonly chainId: number;
+    readonly maxTotalUsdc: bigint;
+    readonly maxRatePerSecondUsdc: bigint;
+    readonly maxDurationSeconds: number;
+}
+/** Reads a broker's public policy. No credential is sent; nothing secret is served. */
+export declare function fetchPrivySpendPolicy(brokerUrl: string, fetchImpl?: typeof fetch): Promise<PrivySpendPolicy>;
+export interface ResolvedPrivyCliWallet {
+    readonly source: PrivyCliWalletSource;
+    /** A JSON-RPC account: `signTypedData` works, `signTransaction` does not exist. */
+    readonly account: Account;
+    /** The provider-as-transport. Without this every write goes to a plain RPC and fails. */
+    readonly transport: Transport;
+    /** One line naming the wallet's origin. Safe to print: no credential in it. */
+    readonly description: string;
+    /** Reads the broker ceiling this wallet is capped at. Bound to its broker URL. */
+    readonly readSpendPolicy: () => Promise<PrivySpendPolicy>;
+}
+export interface ResolvePrivyCliWalletOptions {
+    /** `--rpc-url`, so a Privy wallet's READS use the same endpoint as everything else. */
+    readonly rpcUrl?: string;
+    readonly note?: (line: string) => void;
+    /** Test seam. Defaults to the real credential store selected from `env`. */
+    readonly store?: AutonomousWalletCredentialStore;
+    /** Test seam for the broker HTTP contract. */
+    readonly fetchImpl?: typeof fetch;
+}
+/**
+ * Resolves a Privy wallet from the environment, or `null` when no Privy
+ * variable is set at all.
+ *
+ * A PARTIALLY configured Privy setup is an error, not a `null` — "you set the
+ * session token but not the address" and "you configured no Privy wallet" are
+ * different facts, and rendering the first as the second sends the reader
+ * looking in the wrong place. This mirrors the CDP path exactly.
+ */
+export declare function resolvePrivyCliWallet(env: NodeJS.ProcessEnv, options?: ResolvePrivyCliWalletOptions): Promise<ResolvedPrivyCliWallet | null>;
+//# sourceMappingURL=privy.d.ts.map