@ariestools/aries-witness-cli 0.1.6

package/dist/node/index.mjs

@@ -0,0 +1,3829 @@
+// src/actions/bank/capitalOne.ts
+import { createHash } from "node:crypto";
+import { hashBinary } from "@ariestools/aries-witness-core";
+
+// src/actions/bank/config.ts
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  writeFileSync
+} from "node:fs";
+import { homedir } from "node:os";
+import path from "node:path";
+import chalk from "chalk";
+var CAPITAL_ONE_CONFIG_KEYS = [
+  "env",
+  "base-url",
+  "token-url",
+  "client-id",
+  "client-secret",
+  "scope",
+  "accounts-path",
+  "balances-path",
+  "transactions-path"
+];
+var SECRET_KEYS = /* @__PURE__ */ new Set(["client-secret"]);
+var KEY_ALIASES = {
+  "accountsPath": "accounts-path",
+  "accounts-path": "accounts-path",
+  "balancesPath": "balances-path",
+  "balances-path": "balances-path",
+  "baseUrl": "base-url",
+  "base-url": "base-url",
+  "clientId": "client-id",
+  "client-id": "client-id",
+  "clientSecret": "client-secret",
+  "client-secret": "client-secret",
+  "env": "env",
+  "environment": "env",
+  "scope": "scope",
+  "tokenUrl": "token-url",
+  "token-url": "token-url",
+  "transactionsPath": "transactions-path",
+  "transactions-path": "transactions-path"
+};
+var ENV_KEY_MAP = {
+  "accounts-path": "ARIES_CAPITALONE_ACCOUNTS_PATH",
+  "balances-path": "ARIES_CAPITALONE_BALANCES_PATH",
+  "base-url": "ARIES_CAPITALONE_BASE_URL",
+  "client-id": "ARIES_CAPITALONE_CLIENT_ID",
+  "client-secret": "ARIES_CAPITALONE_CLIENT_SECRET",
+  "env": "ARIES_CAPITALONE_ENV",
+  "scope": "ARIES_CAPITALONE_SCOPE",
+  "token-url": "ARIES_CAPITALONE_TOKEN_URL",
+  "transactions-path": "ARIES_CAPITALONE_TRANSACTIONS_PATH"
+};
+function ariesHome() {
+  return process.env.ARIES_HOME ?? path.join(homedir(), ".aries");
+}
+function bankConfigDir(root = ariesHome()) {
+  return path.join(root, "bank");
+}
+function capitalOneConfigPath(root = ariesHome()) {
+  return path.join(bankConfigDir(root), "capitalone.json");
+}
+function defaultCapitalOneConfig() {
+  return { env: "sandbox" };
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function readString(value, key) {
+  if (typeof value === "string") return value;
+  throw new Error(`bank.capitalone.${key} must be a string`);
+}
+function parseEnvironment(value, key) {
+  if (value === "sandbox" || value === "production") return value;
+  throw new Error(`bank.capitalone.${key} must be one of: sandbox, production`);
+}
+function readConfigValue(key, value) {
+  const text = readString(value, key);
+  return key === "env" ? parseEnvironment(text, key) : text;
+}
+function parseConfigValue(key, raw) {
+  return key === "env" ? parseEnvironment(raw, key) : raw;
+}
+function normalizeConfig(config) {
+  const next = {};
+  for (const key of CAPITAL_ONE_CONFIG_KEYS) {
+    const value = config[key];
+    if (value !== void 0) next[key] = readConfigValue(key, value);
+  }
+  return next;
+}
+function orderedConfig(config) {
+  const out = {};
+  for (const key of CAPITAL_ONE_CONFIG_KEYS) {
+    const value = config[key];
+    if (value !== void 0) out[key] = value;
+  }
+  return out;
+}
+function envConfig(env = process.env) {
+  const config = {};
+  for (const key of CAPITAL_ONE_CONFIG_KEYS) {
+    const value = env[ENV_KEY_MAP[key]];
+    if (value !== void 0 && value.length > 0) {
+      config[key] = parseConfigValue(key, value);
+    }
+  }
+  return config;
+}
+function displayValue(key, value, showSecrets) {
+  if (value === void 0) return "";
+  if (!showSecrets && SECRET_KEYS.has(key)) return "********";
+  return value;
+}
+function outputValue(key, value, showSecrets) {
+  if (value === void 0) return null;
+  if (!showSecrets && SECRET_KEYS.has(key)) return "********";
+  return value;
+}
+function normalizeCapitalOneConfigKey(value) {
+  const withoutPrefix = value.startsWith("bank.capitalone.") ? value.slice("bank.capitalone.".length) : value;
+  const key = withoutPrefix.startsWith("capitalone.") ? withoutPrefix.slice("capitalone.".length) : withoutPrefix;
+  const normalized = KEY_ALIASES[key];
+  if (normalized) return normalized;
+  throw new Error(`Unknown bank.capitalone config key "${value}". Known: ${CAPITAL_ONE_CONFIG_KEYS.join(", ")}`);
+}
+function readCapitalOneConfig(root = ariesHome()) {
+  const filePath = capitalOneConfigPath(root);
+  if (!existsSync(filePath)) return {};
+  const raw = readFileSync(filePath, "utf8");
+  if (raw.trim().length === 0) return {};
+  const parsed = JSON.parse(raw);
+  if (!isRecord(parsed)) throw new Error(`${filePath} must contain a JSON object`);
+  const config = {};
+  for (const key of CAPITAL_ONE_CONFIG_KEYS) {
+    if (parsed[key] !== void 0) config[key] = readConfigValue(key, parsed[key]);
+  }
+  return config;
+}
+function writeCapitalOneConfig(config, root = ariesHome()) {
+  const normalized = normalizeConfig(config);
+  const dir = bankConfigDir(root);
+  mkdirSync(dir, { recursive: true, mode: 448 });
+  const filePath = capitalOneConfigPath(root);
+  const tmp = `${filePath}.tmp`;
+  writeFileSync(tmp, `${JSON.stringify(orderedConfig(normalized), null, 2)}
+`, { encoding: "utf8", mode: 384 });
+  renameSync(tmp, filePath);
+  try {
+    chmodSync(filePath, 384);
+  } catch {
+  }
+}
+function resolveCapitalOneConfig(overrides = {}, root = ariesHome(), env = process.env) {
+  return normalizeConfig({
+    ...defaultCapitalOneConfig(),
+    ...readCapitalOneConfig(root),
+    ...envConfig(env),
+    ...normalizeConfig(overrides)
+  });
+}
+function capitalOneConfigSet(options) {
+  const current = readCapitalOneConfig();
+  const next = {
+    ...current,
+    [options.key]: parseConfigValue(options.key, options.value)
+  };
+  writeCapitalOneConfig(next);
+  const display = displayValue(options.key, next[options.key], false);
+  console.log(`${chalk.green("set")} bank.capitalone.${options.key}=${display}`);
+}
+function capitalOneConfigGet(options = {}) {
+  const config = resolveCapitalOneConfig();
+  const keys = options.key ? [options.key] : CAPITAL_ONE_CONFIG_KEYS;
+  const showSecrets = options.showSecrets === true;
+  if (options.json === true) {
+    const out = {};
+    for (const key of keys) {
+      out[`bank.capitalone.${key}`] = outputValue(key, config[key], showSecrets);
+    }
+    console.log(JSON.stringify(out, null, 2));
+    return;
+  }
+  for (const key of keys) {
+    console.log(`${chalk.cyan(`bank.capitalone.${key}`)}=${displayValue(key, config[key], showSecrets)}`);
+  }
+}
+
+// src/actions/bank/capitalOne.ts
+var BANK_ACCOUNT_SNAPSHOT_SCHEMA = "network.xyo.bank.account-snapshot";
+var DEFAULT_HEADERS = { Accept: "application/json" };
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function stringValue(value) {
+  if (typeof value === "string" && value.length > 0) return value;
+  if (typeof value === "number" && Number.isFinite(value)) return String(value);
+  return void 0;
+}
+function getPath(value, path7) {
+  let current = value;
+  for (const part of path7) {
+    if (!isRecord2(current)) return void 0;
+    current = current[part];
+  }
+  return current;
+}
+function firstValue(source, paths) {
+  for (const path7 of paths) {
+    const value = getPath(source, path7);
+    if (value !== void 0 && value !== null) return value;
+  }
+  return void 0;
+}
+function firstString(source, paths) {
+  return stringValue(firstValue(source, paths));
+}
+function itemsAt(raw, paths) {
+  for (const path7 of paths) {
+    const value = getPath(raw, path7);
+    if (Array.isArray(value)) return value;
+    if (isRecord2(value)) return [value];
+  }
+  return [];
+}
+function hashIdentifier(provider, kind, value) {
+  if (!value) return void 0;
+  return createHash("sha256").update(`${provider}:${kind}:${value}`).digest("hex");
+}
+function maybeRedactedId(provider, kind, value, redaction, clearKey) {
+  if (!value) return {};
+  if (redaction === "none") return { [clearKey]: value };
+  return { [`${clearKey}Hash`]: hashIdentifier(provider, kind, value) ?? "" };
+}
+function extractLast4(value) {
+  if (!value) return void 0;
+  const digits = value.replaceAll(/\D/gu, "");
+  if (digits.length >= 4) return digits.slice(-4);
+  return value.length >= 4 ? value.slice(-4) : value;
+}
+function normalizeAmount(source) {
+  const amount = firstString(source, [
+    ["Amount", "Amount"],
+    ["amount", "amount"],
+    ["amount"],
+    ["currentBalance"],
+    ["availableBalance"],
+    ["balance"]
+  ]);
+  const currency = firstString(source, [
+    ["Amount", "Currency"],
+    ["amount", "currency"],
+    ["currency"],
+    ["Currency"]
+  ]);
+  if (!amount && !currency) return void 0;
+  return { amount, currency };
+}
+function normalizeAccount(source, provider, redaction) {
+  const accountId = firstString(source, [
+    ["AccountId"],
+    ["accountId"],
+    ["id"],
+    ["account_id"]
+  ]);
+  const identification = firstString(source, [
+    ["Account", "Identification"],
+    ["account", "identification"],
+    ["identification"],
+    ["mask"],
+    ["last4"]
+  ]);
+  return {
+    ...maybeRedactedId(provider, "account", accountId, redaction, "accountId"),
+    accountSubType: firstString(source, [["AccountSubType"], ["accountSubType"], ["subtype"], ["subType"]]),
+    accountType: firstString(source, [["AccountType"], ["accountType"], ["type"]]),
+    currency: firstString(source, [["Currency"], ["currency"]]),
+    description: firstString(source, [["Description"], ["description"]]),
+    last4: extractLast4(identification),
+    name: firstString(source, [["Account", "Name"], ["account", "name"], ["name"], ["displayName"]])
+  };
+}
+function normalizeBalance(source, provider, redaction) {
+  const accountId = firstString(source, [
+    ["AccountId"],
+    ["accountId"],
+    ["account_id"]
+  ]);
+  return {
+    ...maybeRedactedId(provider, "account", accountId, redaction, "accountId"),
+    amount: normalizeAmount(source),
+    creditDebitIndicator: firstString(source, [["CreditDebitIndicator"], ["creditDebitIndicator"]]),
+    dateTime: firstString(source, [["DateTime"], ["dateTime"], ["datetime"], ["asOf"]]),
+    type: firstString(source, [["Type"], ["type"]])
+  };
+}
+function normalizeTransaction(source, provider, redaction) {
+  const accountId = firstString(source, [
+    ["AccountId"],
+    ["accountId"],
+    ["account_id"]
+  ]);
+  const transactionId = firstString(source, [
+    ["TransactionId"],
+    ["TransactionReference"],
+    ["transactionId"],
+    ["transactionReference"],
+    ["id"]
+  ]);
+  return {
+    ...maybeRedactedId(provider, "account", accountId, redaction, "accountId"),
+    ...maybeRedactedId(provider, "transaction", transactionId, redaction, "transactionId"),
+    amount: normalizeAmount(source),
+    bookingDateTime: firstString(source, [["BookingDateTime"], ["bookingDateTime"], ["postedAt"], ["postedDate"]]),
+    creditDebitIndicator: firstString(source, [["CreditDebitIndicator"], ["creditDebitIndicator"], ["type"]]),
+    description: firstString(source, [["TransactionInformation"], ["transactionInformation"], ["description"], ["memo"]]),
+    merchantName: firstString(source, [["MerchantDetails", "MerchantName"], ["merchantDetails", "merchantName"], ["merchantName"]]),
+    status: firstString(source, [["Status"], ["status"]]),
+    valueDateTime: firstString(source, [["ValueDateTime"], ["valueDateTime"], ["authorizedAt"], ["transactionDate"]])
+  };
+}
+function cleanObject(value) {
+  for (const key of Object.keys(value)) {
+    const child = value[key];
+    if (child === void 0) {
+      delete value[key];
+    } else if (isRecord2(child)) {
+      cleanObject(child);
+      if (Object.keys(child).length === 0) delete value[key];
+    }
+  }
+  return value;
+}
+function jsonBinary(name, raw) {
+  const data = Buffer.from(`${JSON.stringify(raw, null, 2)}
+`, "utf8");
+  return {
+    data,
+    ref: {
+      filename: `capitalone-${name}.json`,
+      hash: hashBinary(data),
+      mimeType: "application/json",
+      size: data.length
+    }
+  };
+}
+function requireConfig(config, key, reason) {
+  const value = config[key];
+  if (typeof value === "string" && value.length > 0) return value;
+  throw new Error(`Capital One ${reason} is required: set bank.capitalone.${key} or ARIES_CAPITALONE_${String(key).replaceAll("-", "_").toUpperCase()}.`);
+}
+function endpointUrl(baseUrl, pathTemplate, replacements, query) {
+  let resolvedPath = pathTemplate;
+  for (const [key, value] of Object.entries(replacements)) {
+    if (value !== void 0) resolvedPath = resolvedPath.replaceAll(`{${key}}`, encodeURIComponent(value));
+  }
+  const url = new URL(resolvedPath.startsWith("http") ? resolvedPath : resolvedPath.replace(/^\//u, ""), baseUrl.endsWith("/") ? baseUrl : `${baseUrl}/`);
+  for (const [key, value] of Object.entries(query)) {
+    if (value !== void 0 && value.length > 0) url.searchParams.set(key, value);
+  }
+  return url;
+}
+async function fetchJson(url, init, label) {
+  const response = await fetch(url, init);
+  const bodyText = await response.text();
+  if (!response.ok) {
+    const snippet = bodyText.trim().slice(0, 400);
+    throw new Error(`Capital One ${label} request failed (${response.status} ${response.statusText}): ${snippet}`);
+  }
+  try {
+    return { bodyText, json: bodyText.length > 0 ? JSON.parse(bodyText) : null };
+  } catch (error) {
+    throw new Error(`Capital One ${label} response was not valid JSON`, { cause: error });
+  }
+}
+async function mintAccessToken(config) {
+  const tokenUrl = requireConfig(config, "token-url", "token URL");
+  const clientId = requireConfig(config, "client-id", "client id");
+  const clientSecret = requireConfig(config, "client-secret", "client secret");
+  const body = new URLSearchParams();
+  body.set("client_id", clientId);
+  body.set("client_secret", clientSecret);
+  body.set("grant_type", "client_credentials");
+  if (config.scope) body.set("scope", config.scope);
+  const result = await fetchJson(tokenUrl, {
+    body: body.toString(),
+    headers: {
+      ...DEFAULT_HEADERS,
+      "Content-Type": "application/x-www-form-urlencoded"
+    },
+    method: "POST"
+  }, "token");
+  const token = result.json?.access_token;
+  if (!token) throw new Error("Capital One token response did not include access_token");
+  return token;
+}
+async function resolveAccessToken(options, config) {
+  const token = options["access-token"] ?? process.env.ARIES_CAPITALONE_ACCESS_TOKEN;
+  if (token && token.length > 0) return token;
+  return mintAccessToken(config);
+}
+function accountQuery(accountId, pathTemplate) {
+  return pathTemplate.includes("{accountId}") ? {} : { accountId };
+}
+function environment(config) {
+  return config.env ?? "sandbox";
+}
+async function observeCapitalOne(args) {
+  const options = args;
+  const config = resolveCapitalOneConfig({
+    "accounts-path": options["accounts-path"],
+    "balances-path": options["balances-path"],
+    "base-url": options["base-url"],
+    "client-id": options["client-id"],
+    "client-secret": options["client-secret"],
+    "env": options.env,
+    "scope": options.scope,
+    "token-url": options["token-url"],
+    "transactions-path": options["transactions-path"]
+  });
+  const redaction = options.redaction ?? "default";
+  const baseUrl = requireConfig(config, "base-url", "base URL");
+  const accountsPath = requireConfig(config, "accounts-path", "accounts endpoint path");
+  const balancesPath = requireConfig(config, "balances-path", "balances endpoint path");
+  const transactionsPath = requireConfig(config, "transactions-path", "transactions endpoint path");
+  const accessToken = await resolveAccessToken(options, config);
+  const authHeaders = {
+    ...DEFAULT_HEADERS,
+    Authorization: `Bearer ${accessToken}`
+  };
+  const accountId = options["account-id"];
+  const accounts = await fetchJson(endpointUrl(baseUrl, accountsPath, {}, {}), {
+    headers: authHeaders,
+    method: "GET"
+  }, "accounts");
+  const balances = await fetchJson(endpointUrl(baseUrl, balancesPath, { accountId }, accountQuery(accountId, balancesPath)), {
+    headers: authHeaders,
+    method: "GET"
+  }, "balances");
+  const transactions = await fetchJson(endpointUrl(baseUrl, transactionsPath, { accountId }, {
+    ...accountQuery(accountId, transactionsPath),
+    from: options.from,
+    to: options.to
+  }), {
+    headers: authHeaders,
+    method: "GET"
+  }, "transactions");
+  const accountItems = itemsAt(accounts.json, [
+    ["Data", "Account"],
+    ["Data", "Accounts"],
+    ["data", "accounts"],
+    ["accounts"]
+  ]);
+  const balanceItems = itemsAt(balances.json, [
+    ["Data", "Balance"],
+    ["Data", "Balances"],
+    ["data", "balances"],
+    ["balances"]
+  ]);
+  const transactionItems = itemsAt(transactions.json, [
+    ["Data", "Transaction"],
+    ["Data", "Transactions"],
+    ["data", "transactions"],
+    ["transactions"]
+  ]);
+  const rawArtifacts = options["include-raw"] === true ? {
+    accounts: jsonBinary("accounts", accounts.json),
+    balances: jsonBinary("balances", balances.json),
+    transactions: jsonBinary("transactions", transactions.json)
+  } : void 0;
+  const payload = cleanObject({
+    accounts: accountItems.map((item) => cleanObject(normalizeAccount(item, "capitalone", redaction))),
+    balances: balanceItems.map((item) => cleanObject(normalizeBalance(item, "capitalone", redaction))),
+    environment: environment(config),
+    observedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    provider: "capitalone",
+    raw: rawArtifacts ? {
+      accounts: rawArtifacts.accounts.ref,
+      balances: rawArtifacts.balances.ref,
+      transactions: rawArtifacts.transactions.ref
+    } : void 0,
+    request: cleanObject({
+      accountId: redaction === "none" ? accountId : void 0,
+      accountIdHash: redaction === "default" ? hashIdentifier("capitalone", "account", accountId) : void 0,
+      from: options.from,
+      to: options.to
+    }),
+    schema: BANK_ACCOUNT_SNAPSHOT_SCHEMA,
+    transactions: transactionItems.map((item) => cleanObject(normalizeTransaction(item, "capitalone", redaction)))
+  });
+  return {
+    binaries: rawArtifacts ? Object.values(rawArtifacts) : void 0,
+    payloads: [payload]
+  };
+}
+var capitalOneProvider = {
+  name: "capitalone",
+  observe: observeCapitalOne
+};
+
+// src/actions/bank/capitalOneProducts.ts
+import { readFileSync as readFileSync2 } from "node:fs";
+import { hashBinary as hashBinary2 } from "@ariestools/aries-witness-core";
+var BANK_PRODUCT_CATALOG_SCHEMA = "network.xyo.bank.product-catalog";
+var CAPITAL_ONE_PRODUCTS_DEVEX_PRODUCT_ID = "1359-5";
+var CAPITAL_ONE_PRODUCTS_NAME = "Retrieve Consumer Bank Products";
+var DEFAULT_API_VERSION = "5";
+var DEFAULT_PRODUCTS_OPERATION = "search";
+var DEFAULT_PRODUCTS_PATH_PRODUCT_ID = "~";
+var SANDBOX_BASE_URL = "https://api-sandbox.capitalone.com";
+var SANDBOX_TOKEN_URL = `${SANDBOX_BASE_URL}/oauth2/token`;
+var PRODUCT_ENDPOINTS = {
+  "retrieve-products": {
+    method: "POST",
+    path: "/deposits/products/retrieve-products",
+    requiresProductId: false
+  },
+  "retail-products": {
+    method: "GET",
+    path: "/deposits/products/{productId}/retail-products",
+    requiresProductId: true
+  },
+  "search": {
+    method: "POST",
+    path: "/deposits/products/{productId}/search",
+    requiresProductId: true
+  }
+};
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function stringValue2(value) {
+  if (typeof value === "string" && value.length > 0) return value;
+  if (typeof value === "number" && Number.isFinite(value)) return String(value);
+  return void 0;
+}
+function getPath2(value, path7) {
+  let current = value;
+  for (const part of path7) {
+    if (!isRecord3(current)) return void 0;
+    current = current[part];
+  }
+  return current;
+}
+function firstValue2(source, paths) {
+  for (const path7 of paths) {
+    const value = getPath2(source, path7);
+    if (value !== void 0 && value !== null) return value;
+  }
+  return void 0;
+}
+function firstString2(source, paths) {
+  return stringValue2(firstValue2(source, paths));
+}
+function itemsAt2(raw, operation) {
+  const paths = operation === "retail-products" ? [["retailProducts"], ["RetailProducts"], ["data", "retailProducts"], ["Data", "RetailProducts"]] : [["products"], ["Products"], ["data", "products"], ["Data", "Products"]];
+  for (const path7 of paths) {
+    const value = getPath2(raw, path7);
+    if (Array.isArray(value)) return value;
+    if (isRecord3(value)) return [value];
+  }
+  return [];
+}
+function cleanObject2(value) {
+  for (const key of Object.keys(value)) {
+    const child = value[key];
+    if (child === void 0) {
+      delete value[key];
+    } else if (isRecord3(child)) {
+      cleanObject2(child);
+      if (Object.keys(child).length === 0) delete value[key];
+    } else if (Array.isArray(child)) {
+      for (const item of child) {
+        if (isRecord3(item)) cleanObject2(item);
+      }
+      if (child.length === 0) delete value[key];
+    }
+  }
+  return value;
+}
+function jsonBinary2(name, raw) {
+  const data = Buffer.from(`${JSON.stringify(raw, null, 2)}
+`, "utf8");
+  return {
+    data,
+    ref: {
+      filename: `capitalone-${name}.json`,
+      hash: hashBinary2(data),
+      mimeType: "application/json",
+      size: data.length
+    }
+  };
+}
+function parseJsonInput(raw, label) {
+  try {
+    return JSON.parse(raw);
+  } catch (error) {
+    throw new Error(`Capital One products ${label} must be valid JSON`, { cause: error });
+  }
+}
+function gatewayHint(label, status, bodyText) {
+  if (status !== 403 || !bodyText.toLowerCase().includes("no endpoint matched for request")) return "";
+  if (label === "token") {
+    return " For direct CLI token minting, use https://api-sandbox.capitalone.com/oauth2/token; /sandbox/oauth2/token is a DevExchange-host relative route.";
+  }
+  return [
+    " Capital One token minting succeeded, but the sandbox API gateway did not match the product endpoint.",
+    "Verify the app is connected to DevExchange product 1359-5 in the sandbox and confirm the live sandbox base path with Capital One."
+  ].join(" ");
+}
+function requestBody(options, method, operation) {
+  if (method === "GET") return void 0;
+  if (options["body-file"]) return parseJsonInput(readFileSync2(options["body-file"], "utf8"), "body file");
+  if (options.body) return parseJsonInput(options.body, "body");
+  if (operation === "search") return { isCollapseRate: true };
+  return {};
+}
+function environment2(config) {
+  return config.env ?? "sandbox";
+}
+function requireConfig2(config, key, reason) {
+  const value = config[key];
+  if (typeof value === "string" && value.length > 0) return value;
+  throw new Error(`Capital One products ${reason} is required: set bank.capitalone.${key} or ARIES_CAPITALONE_${String(key).replaceAll("-", "_").toUpperCase()}.`);
+}
+function configuredOrSandboxDefault(config, key, sandboxDefault, reason) {
+  const configured = config[key];
+  if (configured && configured.length > 0) return configured;
+  if (environment2(config) === "sandbox") return sandboxDefault;
+  return requireConfig2(config, key, reason);
+}
+async function fetchJson2(url, init, label) {
+  const response = await fetch(url, init);
+  const bodyText = await response.text();
+  if (!response.ok) {
+    const snippet = bodyText.trim().slice(0, 400);
+    throw new Error(`Capital One products ${label} request failed (${response.status} ${response.statusText}): ${snippet}${gatewayHint(label, response.status, bodyText)}`);
+  }
+  try {
+    return { bodyText, json: bodyText.length > 0 ? JSON.parse(bodyText) : null };
+  } catch (error) {
+    throw new Error(`Capital One products ${label} response was not valid JSON`, { cause: error });
+  }
+}
+async function mintAccessToken2(config) {
+  const tokenUrl = configuredOrSandboxDefault(config, "token-url", SANDBOX_TOKEN_URL, "token URL");
+  const clientId = requireConfig2(config, "client-id", "client id");
+  const clientSecret = requireConfig2(config, "client-secret", "client secret");
+  const body = new URLSearchParams();
+  body.set("client_id", clientId);
+  body.set("client_secret", clientSecret);
+  body.set("grant_type", "client_credentials");
+  if (config.scope) body.set("scope", config.scope);
+  const result = await fetchJson2(tokenUrl, {
+    body: body.toString(),
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    method: "POST"
+  }, "token");
+  const token = result.json?.access_token;
+  if (!token) throw new Error("Capital One products token response did not include access_token");
+  return token;
+}
+async function resolveAccessToken2(options, config) {
+  const token = options["access-token"] ?? process.env.ARIES_CAPITALONE_ACCESS_TOKEN;
+  if (token && token.length > 0) return token;
+  return mintAccessToken2(config);
+}
+function endpointUrl2(baseUrl, pathTemplate, productId) {
+  const resolvedPath = productId === void 0 ? pathTemplate : pathTemplate.replaceAll("{productId}", encodeURIComponent(productId));
+  return new URL(resolvedPath.replace(/^\//u, ""), baseUrl.endsWith("/") ? baseUrl : `${baseUrl}/`);
+}
+function normalizeProduct(source) {
+  const rates = firstValue2(source, [["interest", "rates"], ["rates"]]);
+  const features = firstValue2(source, [["features"], ["retailProductfeatures"], ["retailProductFeatures"]]);
+  return cleanObject2({
+    baseCurrency: firstString2(source, [["base", "baseCurrency"], ["baseCurrency"]]),
+    features: Array.isArray(features) ? features : void 0,
+    lineOfBusiness: firstString2(source, [["base", "lineOfBusiness"], ["productDefinition", "lineOfBusiness"], ["lineOfBusiness"]]),
+    productDescription: firstString2(source, [["productDefinition", "productDescription"], ["productDescription"]]),
+    productFamily: firstString2(source, [
+      ["base", "productFamily"],
+      ["productDefinition", "productGroup"],
+      ["productFamily"],
+      ["productFamilyName"]
+    ]),
+    productGroup: firstString2(source, [["productDefinition", "productGroup"], ["productGroup"]]),
+    productId: firstString2(source, [
+      ["base", "productId"],
+      ["base", "productLineId"],
+      ["productDefinition", "productCode"],
+      ["retailProductDefinition", "retailProductCode"],
+      ["retailProductDefinition", "productCode"],
+      ["productId"],
+      ["productLineId"]
+    ]),
+    productLineId: firstString2(source, [["base", "productLineId"], ["productLineId"]]),
+    productName: firstString2(source, [["productDefinition", "productName"], ["retailProductfeatures", "productName"], ["productName"]]),
+    productSourceId: firstString2(source, [["base", "productSourceId"], ["productSourceId"]]),
+    productStatus: firstString2(source, [["productDefinition", "productStatus"], ["productStatus"]]),
+    productType: firstString2(source, [["base", "productType"], ["productDefinition", "productType"], ["productType"]]),
+    rates: Array.isArray(rates) ? rates : void 0
+  });
+}
+async function observeCapitalOneProducts(args) {
+  const options = args;
+  const config = resolveCapitalOneConfig({
+    "base-url": options["base-url"],
+    "client-id": options["client-id"],
+    "client-secret": options["client-secret"],
+    "env": options.env,
+    "scope": options.scope,
+    "token-url": options["token-url"]
+  });
+  const operation = options.operation ?? DEFAULT_PRODUCTS_OPERATION;
+  const endpoint = PRODUCT_ENDPOINTS[operation];
+  const productId = options["product-id"] ?? (endpoint.requiresProductId ? DEFAULT_PRODUCTS_PATH_PRODUCT_ID : void 0);
+  if (endpoint.requiresProductId && (!productId || productId.length === 0)) {
+    throw new Error(`Capital One products operation "${operation}" requires --product-id.`);
+  }
+  const baseUrl = configuredOrSandboxDefault(config, "base-url", SANDBOX_BASE_URL, "base URL");
+  const apiVersion = options["api-version"] ?? DEFAULT_API_VERSION;
+  const accessToken = await resolveAccessToken2(options, config);
+  const body = requestBody(options, endpoint.method, operation);
+  const headers = {
+    Accept: `application/json;v=${apiVersion}`,
+    Authorization: `Bearer ${accessToken}`
+  };
+  if (endpoint.method === "POST") headers["Content-Type"] = `application/json;v=${apiVersion}`;
+  const response = await fetchJson2(endpointUrl2(baseUrl, endpoint.path, productId), {
+    body: body === void 0 ? void 0 : JSON.stringify(body),
+    headers,
+    method: endpoint.method
+  }, operation);
+  const rawArtifact = options["include-raw"] === true ? jsonBinary2("bank-products-response", response.json) : void 0;
+  const products = itemsAt2(response.json, operation).map(normalizeProduct);
+  const payload = cleanObject2({
+    apiVersion,
+    devExchangeProductId: CAPITAL_ONE_PRODUCTS_DEVEX_PRODUCT_ID,
+    environment: environment2(config),
+    observedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    operation,
+    productCount: products.length,
+    productId,
+    productName: CAPITAL_ONE_PRODUCTS_NAME,
+    products,
+    provider: "capitalone",
+    raw: rawArtifact?.ref,
+    request: cleanObject2({
+      body,
+      method: endpoint.method,
+      path: endpoint.path,
+      productId
+    }),
+    schema: BANK_PRODUCT_CATALOG_SCHEMA
+  });
+  return {
+    binaries: rawArtifact ? [rawArtifact] : void 0,
+    payloads: [payload]
+  };
+}
+var capitalOneProductsProvider = {
+  name: "capitalone-products",
+  observe: observeCapitalOneProducts
+};
+
+// src/actions/pentair/circuit.ts
+import chalk3 from "chalk";
+
+// src/actions/pentair/screenlogic.ts
+import { FindUnits, screenlogic } from "node-screenlogic";
+
+// src/actions/pentair/config.ts
+import {
+  chmodSync as chmodSync2,
+  existsSync as existsSync2,
+  mkdirSync as mkdirSync2,
+  readFileSync as readFileSync3,
+  renameSync as renameSync2,
+  writeFileSync as writeFileSync2
+} from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import path2 from "node:path";
+import chalk2 from "chalk";
+var PENTAIR_CONFIG_KEYS = [
+  "address",
+  "port",
+  "password",
+  "system-name",
+  "response-timeout",
+  "search-timeout",
+  "search-attempts",
+  "series-file"
+];
+var NUMBER_KEYS = /* @__PURE__ */ new Set(["port", "response-timeout", "search-timeout", "search-attempts"]);
+var SECRET_KEYS2 = /* @__PURE__ */ new Set(["password"]);
+var KEY_ALIASES2 = {
+  "address": "address",
+  "password": "password",
+  "port": "port",
+  "responseTimeout": "response-timeout",
+  "response-timeout": "response-timeout",
+  "searchAttempts": "search-attempts",
+  "search-attempts": "search-attempts",
+  "searchTimeout": "search-timeout",
+  "search-timeout": "search-timeout",
+  "seriesFile": "series-file",
+  "series-file": "series-file",
+  "systemName": "system-name",
+  "system-name": "system-name"
+};
+function ariesHome2() {
+  return process.env.ARIES_HOME ?? path2.join(homedir2(), ".aries");
+}
+function pentairConfigDir(root = ariesHome2()) {
+  return path2.join(root, "pentair");
+}
+function pentairConfigPath(root = ariesHome2()) {
+  return path2.join(pentairConfigDir(root), "config.json");
+}
+function defaultPentairSeriesFile(root = ariesHome2()) {
+  return path2.join(pentairConfigDir(root), "intellichem.jsonl");
+}
+function defaultPentairConfig(root = ariesHome2()) {
+  return {
+    "port": 80,
+    "response-timeout": 15e3,
+    "search-attempts": 3,
+    "search-timeout": 5e3,
+    "series-file": defaultPentairSeriesFile(root),
+    "system-name": "Pentair ScreenLogic"
+  };
+}
+function isRecord4(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function readNumber(value, key) {
+  if (typeof value === "number" && Number.isFinite(value) && value > 0) return value;
+  throw new Error(`pentair.${key} must be a positive number`);
+}
+function readString2(value, key) {
+  if (typeof value === "string") return value;
+  throw new Error(`pentair.${key} must be a string`);
+}
+function parseNumber(raw, key) {
+  const parsed = Number(raw);
+  if (Number.isFinite(parsed) && parsed > 0) return parsed;
+  throw new Error(`pentair.${key} must be a positive number`);
+}
+function readConfigValue2(key, value) {
+  return NUMBER_KEYS.has(key) ? readNumber(value, key) : readString2(value, key);
+}
+function parseConfigValue2(key, raw) {
+  return NUMBER_KEYS.has(key) ? parseNumber(raw, key) : raw;
+}
+function normalizeConfig2(config) {
+  const next = {};
+  for (const key of PENTAIR_CONFIG_KEYS) {
+    const value = config[key];
+    if (value !== void 0) next[key] = readConfigValue2(key, value);
+  }
+  return next;
+}
+function orderedConfig2(config) {
+  const out = {};
+  for (const key of PENTAIR_CONFIG_KEYS) {
+    const value = config[key];
+    if (value !== void 0) out[key] = value;
+  }
+  return out;
+}
+function displayValue2(key, value, showSecrets) {
+  if (value === void 0) return "";
+  if (!showSecrets && SECRET_KEYS2.has(key)) return "********";
+  return String(value);
+}
+function outputValue2(key, value, showSecrets) {
+  if (value === void 0) return null;
+  if (!showSecrets && SECRET_KEYS2.has(key)) return "********";
+  return value;
+}
+function normalizePentairConfigKey(value) {
+  const key = value.startsWith("pentair.") ? value.slice("pentair.".length) : value;
+  const normalized = KEY_ALIASES2[key];
+  if (normalized) return normalized;
+  throw new Error(`Unknown pentair config key "${value}". Known: ${PENTAIR_CONFIG_KEYS.join(", ")}`);
+}
+function readPentairConfig(root = ariesHome2()) {
+  const filePath = pentairConfigPath(root);
+  if (!existsSync2(filePath)) return {};
+  const raw = readFileSync3(filePath, "utf8");
+  if (raw.trim().length === 0) return {};
+  const parsed = JSON.parse(raw);
+  if (!isRecord4(parsed)) throw new Error(`${filePath} must contain a JSON object`);
+  const config = {};
+  for (const key of PENTAIR_CONFIG_KEYS) {
+    if (parsed[key] !== void 0) config[key] = readConfigValue2(key, parsed[key]);
+  }
+  return config;
+}
+function writePentairConfig(config, root = ariesHome2()) {
+  const normalized = normalizeConfig2(config);
+  const dir = pentairConfigDir(root);
+  mkdirSync2(dir, { recursive: true, mode: 448 });
+  const filePath = pentairConfigPath(root);
+  const tmp = `${filePath}.tmp`;
+  writeFileSync2(tmp, `${JSON.stringify(orderedConfig2(normalized), null, 2)}
+`, { encoding: "utf8", mode: 384 });
+  renameSync2(tmp, filePath);
+  try {
+    chmodSync2(filePath, 384);
+  } catch {
+  }
+}
+function resolvePentairConfig(overrides = {}, root = ariesHome2()) {
+  return normalizeConfig2({
+    ...defaultPentairConfig(root),
+    ...readPentairConfig(root),
+    ...normalizeConfig2(overrides)
+  });
+}
+function pentairConfigSet(options) {
+  const current = readPentairConfig();
+  const next = {
+    ...current,
+    [options.key]: parseConfigValue2(options.key, options.value)
+  };
+  writePentairConfig(next);
+  const display = displayValue2(options.key, next[options.key], false);
+  console.log(`${chalk2.green("set")} pentair.${options.key}=${display}`);
+}
+function pentairConfigGet(options = {}) {
+  const config = resolvePentairConfig();
+  const keys = options.key ? [options.key] : PENTAIR_CONFIG_KEYS;
+  const showSecrets = options.showSecrets === true;
+  if (options.json === true) {
+    const out = {};
+    for (const key of keys) {
+      out[`pentair.${key}`] = outputValue2(key, config[key], showSecrets);
+    }
+    console.log(JSON.stringify(out, null, 2));
+    return;
+  }
+  for (const key of keys) {
+    console.log(`${chalk2.cyan(`pentair.${key}`)}=${displayValue2(key, config[key], showSecrets)}`);
+  }
+}
+
+// src/actions/pentair/screenlogic.ts
+async function findLocalUnit(searchTimeout, searchAttempts) {
+  for (let attempt = 0; attempt < searchAttempts; attempt += 1) {
+    const finder = new FindUnits();
+    const localUnit = (await finder.searchAsync(searchTimeout)).shift();
+    if (localUnit) return localUnit;
+  }
+  return;
+}
+async function withScreenLogic(overrides, callback) {
+  const options = resolvePentairConfig(overrides);
+  if (options.address) {
+    const password = options.password ?? process.env.SCREENLOGIC_PASSWORD;
+    screenlogic.init(options["system-name"] ?? "Pentair ScreenLogic", options.address, options.port ?? 80, password);
+  } else {
+    const localUnit = await findLocalUnit(options["search-timeout"] ?? 5e3, options["search-attempts"] ?? 3);
+    if (!localUnit) throw new Error("No local ScreenLogic unit found");
+    screenlogic.initUnit(localUnit);
+  }
+  screenlogic.netTimeout = options["response-timeout"] ?? 15e3;
+  if (!await screenlogic.connectAsync()) {
+    throw new Error("Failed to connect to ScreenLogic");
+  }
+  try {
+    return await callback(screenlogic);
+  } finally {
+    await screenlogic.closeAsync().catch(() => false);
+  }
+}
+
+// src/actions/pentair/circuit.ts
+function readPositiveInteger(value, name) {
+  if (value === void 0) return void 0;
+  if (Number.isInteger(value) && value > 0) return value;
+  throw new Error(`${name} must be a positive integer`);
+}
+function resolveCircuitRuntimeMinutes(options) {
+  const hours = readPositiveInteger(options.hours, "--hours");
+  const minutes = readPositiveInteger(options.minutes, "--minutes");
+  if (hours !== void 0 && minutes !== void 0) {
+    throw new Error("Use either --hours or --minutes, not both");
+  }
+  if (hours === void 0 && minutes === void 0) {
+    throw new Error("Either --hours or --minutes is required");
+  }
+  if (minutes !== void 0) return minutes;
+  if (hours !== void 0) return hours * 60;
+  throw new Error("Either --hours or --minutes is required");
+}
+async function setPentairCircuitRuntime(options) {
+  const circuitId = readPositiveInteger(options["circuit-id"], "--circuit-id");
+  if (circuitId === void 0) throw new Error("--circuit-id is required");
+  const runTimeMinutes = resolveCircuitRuntimeMinutes(options);
+  const turnOn = options.on === true;
+  await withScreenLogic(options, async (unit) => {
+    await unit.circuits.setCircuitRuntimebyIdAsync(circuitId, runTimeMinutes);
+    if (turnOn) await unit.circuits.setCircuitStateAsync(circuitId, true);
+  });
+  const result = {
+    circuitId,
+    runTimeMinutes,
+    ...turnOn && { state: "on" }
+  };
+  if (options.json === true) {
+    console.log(JSON.stringify(result, null, 2));
+    return;
+  }
+  console.log(`${chalk3.green("set")} pentair.circuit.${circuitId}.runtime=${runTimeMinutes}m`);
+  if (turnOn) console.log(`${chalk3.green("set")} pentair.circuit.${circuitId}.state=on`);
+}
+
+// src/actions/witness/discoverPlugins.ts
+import {
+  existsSync as existsSync3,
+  readdirSync,
+  readFileSync as readFileSync4
+} from "node:fs";
+import { homedir as homedir3 } from "node:os";
+import path3 from "node:path";
+var PLUGIN_PREFIX_SCOPED = /^@(ariestools|xylabs)\/aries-witness-.+/;
+var PLUGIN_PREFIX_UNSCOPED = /^aries-witness-.+/;
+var CONFIG_PATH = path3.join(homedir3(), ".aries", "witness-plugins.json");
+function isWitnessPlugin(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const obj = value;
+  if (typeof obj.meta !== "object" || obj.meta === null) return false;
+  const meta = obj.meta;
+  return typeof meta.name === "string" && typeof meta.description === "string" && typeof meta.schema === "string" && typeof obj.observe === "function";
+}
+function readConfigPlugins() {
+  if (!existsSync3(CONFIG_PATH)) return [];
+  try {
+    const raw = readFileSync4(CONFIG_PATH, "utf8");
+    const parsed = JSON.parse(raw);
+    const plugins = parsed.plugins;
+    return Array.isArray(plugins) ? plugins : [];
+  } catch {
+    return [];
+  }
+}
+function scanConventionPlugins() {
+  const packageNames = [];
+  const nodeModulesPath = path3.resolve("node_modules");
+  if (!existsSync3(nodeModulesPath)) return packageNames;
+  for (const scope of ["@ariestools", "@xylabs"]) {
+    const scopePath = path3.join(nodeModulesPath, scope);
+    if (!existsSync3(scopePath)) continue;
+    for (const entry of readdirSync(scopePath)) {
+      const fullName = `${scope}/${entry}`;
+      if (PLUGIN_PREFIX_SCOPED.test(fullName)) {
+        packageNames.push(fullName);
+      }
+    }
+  }
+  for (const entry of readdirSync(nodeModulesPath)) {
+    if (PLUGIN_PREFIX_UNSCOPED.test(entry)) {
+      packageNames.push(entry);
+    }
+  }
+  return packageNames;
+}
+async function discoverPlugins() {
+  const configNames = readConfigPlugins();
+  const conventionNames = scanConventionPlugins();
+  const allNames = [.../* @__PURE__ */ new Set([...configNames, ...conventionNames])];
+  const plugins = [];
+  for (const name of allNames) {
+    try {
+      const mod = await import(name);
+      const plugin = mod.default ?? mod;
+      if (isWitnessPlugin(plugin)) {
+        plugins.push(plugin);
+      }
+    } catch {
+    }
+  }
+  return plugins;
+}
+
+// src/actions/witness/executeWitness.ts
+import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync4 } from "node:fs";
+import { homedir as homedir4 } from "node:os";
+import path4 from "node:path";
+import { hashPayload } from "@ariestools/aries-witness-core";
+
+// src/actions/witness/formatOutput.ts
+import { writeFileSync as writeFileSync3 } from "node:fs";
+import chalk4 from "chalk";
+function formatPayloadValue(value) {
+  if (value === null || value === void 0) return JSON.stringify(value);
+  switch (typeof value) {
+    case "string":
+    case "number":
+    case "boolean":
+    case "bigint": {
+      return String(value);
+    }
+    default: {
+      return JSON.stringify(value, null, 2);
+    }
+  }
+}
+function formatHuman(result) {
+  console.log(chalk4.cyan(`
+Witness: ${result.witnessName}`));
+  console.log(chalk4.gray(`Time:    ${new Date(result.timestamp).toISOString()}`));
+  if (result.boundWitness) {
+    console.log(chalk4.yellow("\nBound Witness"));
+    console.log(chalk4.gray(`  payload_hashes: ${result.boundWitness.payload_hashes.length}`));
+    console.log(chalk4.gray(`  payload_schemas: ${result.boundWitness.payload_schemas.join(", ")}`));
+  }
+  for (const payload of result.payloads) {
+    console.log(chalk4.green(`
+Schema: ${payload.schema}`));
+    for (const [key, value] of Object.entries(payload)) {
+      if (key === "schema") continue;
+      console.log(`  ${chalk4.white(key)}: ${formatPayloadValue(value)}`);
+    }
+  }
+  if (result.binaries && result.binaries.length > 0) {
+    console.log(chalk4.yellow(`
+Binaries: ${result.binaries.length}`));
+    for (const bin of result.binaries) {
+      console.log(`  ${chalk4.gray(bin.hash.slice(0, 12))}... ${bin.mimeType} (${bin.size} bytes)`);
+      if (bin.path) {
+        console.log(`    ${chalk4.gray(`saved: ${bin.path}`)}`);
+      }
+    }
+  }
+  console.log(chalk4.gray(`
+${result.payloads.length} payload(s) observed`));
+}
+function toJson(result, pretty) {
+  return JSON.stringify(result, null, pretty ? 2 : void 0);
+}
+function formatOutput(result, options) {
+  if (options.output) {
+    const json = toJson(result, options.pretty);
+    writeFileSync3(options.output, json + "\n", "utf8");
+    console.error(chalk4.green(`Written to ${options.output}`));
+    return;
+  }
+  if (options.json) {
+    console.log(toJson(result, options.pretty));
+    return;
+  }
+  formatHuman(result);
+}
+
+// src/actions/witness/executeWitness.ts
+function mimeToExtension(mimeType) {
+  const map = {
+    "application/json": "json",
+    "application/pdf": "pdf",
+    "image/gif": "gif",
+    "image/jpeg": "jpg",
+    "image/png": "png",
+    "image/svg+xml": "svg",
+    "image/webp": "webp",
+    "text/html": "html",
+    "text/plain": "txt"
+  };
+  return map[mimeType] ?? "bin";
+}
+function writeBinaries(binaries, binaryDir) {
+  mkdirSync3(binaryDir, { recursive: true });
+  const results = [];
+  for (const { ref, data } of binaries) {
+    const ext = mimeToExtension(ref.mimeType);
+    const filePath = path4.join(binaryDir, `${ref.hash}.${ext}`);
+    writeFileSync4(filePath, data);
+    results.push({
+      hash: ref.hash,
+      mimeType: ref.mimeType,
+      path: filePath,
+      size: ref.size
+    });
+  }
+  return results;
+}
+function buildBoundWitness(payloads) {
+  return {
+    addresses: [],
+    payload_hashes: payloads.map((p) => hashPayload(p)),
+    payload_schemas: payloads.map((p) => p.schema),
+    previous_hashes: [null],
+    schema: "network.xyo.boundwitness"
+  };
+}
+async function executeWitness(plugin, argv) {
+  const observation = await plugin.observe(argv);
+  const defaultBinaryDir = path4.join(homedir4(), ".aries", "binaries");
+  const binaryDir = argv["binary-dir"] ?? defaultBinaryDir;
+  let savedBinaries;
+  if (observation.binaries && observation.binaries.length > 0) {
+    savedBinaries = writeBinaries(observation.binaries, binaryDir);
+  }
+  const result = {
+    binaries: savedBinaries,
+    payloads: observation.payloads,
+    timestamp: Date.now(),
+    witnessName: plugin.meta.name
+  };
+  if (argv["bound-witness"]) {
+    result.boundWitness = buildBoundWitness(observation.payloads);
+  }
+  formatOutput(result, {
+    json: argv.json ?? false,
+    output: argv.output,
+    pretty: argv.pretty ?? true
+  });
+}
+
+// src/actions/witness/registerWitnessCommand.ts
+function registerWitnessCommand(plugin) {
+  return {
+    builder: (yargs) => {
+      yargs.option("json", {
+        default: false,
+        describe: "Output raw JSON",
+        type: "boolean"
+      }).option("output", {
+        alias: "o",
+        describe: "Write output to file",
+        type: "string"
+      }).option("pretty", {
+        default: true,
+        describe: "Pretty-print JSON output",
+        type: "boolean"
+      }).option("bound-witness", {
+        default: false,
+        describe: "Wrap payloads in a BoundWitness",
+        type: "boolean"
+      }).option("binary-dir", {
+        describe: "Directory for binary artifacts (default: ~/.aries/binaries/)",
+        type: "string"
+      });
+      if (plugin.builder) plugin.builder(yargs);
+      return yargs;
+    },
+    command: plugin.meta.name,
+    describe: plugin.meta.description,
+    handler: async (argv) => {
+      await executeWitness(plugin, argv);
+    }
+  };
+}
+
+// src/commands/bankCommand.ts
+import { noopHandler } from "@ariestools/aries-cli-core";
+var capitalOneConfigGetCommand = {
+  command: "get [key]",
+  describe: "Read Capital One bank witness config",
+  builder: (yargs) => yargs.positional("key", {
+    describe: "Config key; omit to list all Capital One config",
+    type: "string"
+  }).option("json", {
+    default: false,
+    describe: "Output as JSON",
+    type: "boolean"
+  }).option("show-secrets", {
+    default: false,
+    describe: "Show secret values instead of redacting them",
+    type: "boolean"
+  }),
+  handler: (argv) => {
+    const keyArg = argv.key;
+    capitalOneConfigGet({
+      ...keyArg && { key: normalizeCapitalOneConfigKey(keyArg) },
+      json: argv.json === true,
+      showSecrets: argv["show-secrets"] === true
+    });
+  }
+};
+var capitalOneConfigSetCommand = {
+  command: "set <key> <value>",
+  describe: "Set Capital One bank witness config",
+  builder: (yargs) => yargs.positional("key", {
+    demandOption: true,
+    describe: "Config key",
+    type: "string"
+  }).positional("value", {
+    demandOption: true,
+    describe: "New value",
+    type: "string"
+  }),
+  handler: (argv) => {
+    capitalOneConfigSet({
+      key: normalizeCapitalOneConfigKey(argv.key),
+      value: argv.value
+    });
+  }
+};
+var capitalOneConfigCommand = {
+  command: "config",
+  describe: "Manage Capital One bank witness config",
+  builder: (yargs) => yargs.command(capitalOneConfigGetCommand).command(capitalOneConfigSetCommand).demandCommand(1).strictCommands(),
+  handler: noopHandler
+};
+var capitalOneCommand = {
+  command: "capitalone",
+  describe: "Manage Capital One bank witness settings",
+  builder: (yargs) => yargs.command(capitalOneConfigCommand).demandCommand(1).strictCommands(),
+  handler: noopHandler
+};
+var bankCommand = {
+  command: "bank",
+  describe: "Manage bank witness settings",
+  builder: (yargs) => yargs.command(capitalOneCommand).demandCommand(1).strictCommands(),
+  handler: noopHandler
+};
+
+// src/commands/pentairCommand.ts
+import { noopHandler as noopHandler2 } from "@ariestools/aries-cli-core";
+function addConnectionOptions(yargs) {
+  return yargs.option("address", {
+    describe: "ScreenLogic adapter IP for direct connection",
+    type: "string"
+  }).option("port", {
+    describe: "ScreenLogic adapter TCP port for direct connection",
+    type: "number"
+  }).option("password", {
+    describe: "ScreenLogic password for direct connection",
+    type: "string"
+  }).option("system-name", {
+    describe: "ScreenLogic system name for direct connection",
+    type: "string"
+  }).option("search-timeout", {
+    describe: "Milliseconds to wait for each UDP discovery attempt",
+    type: "number"
+  }).option("search-attempts", {
+    describe: "Number of UDP discovery attempts before failing",
+    type: "number"
+  }).option("response-timeout", {
+    describe: "Milliseconds to wait for each ScreenLogic command response",
+    type: "number"
+  });
+}
+var pentairConfigGetCommand = {
+  command: "get [key]",
+  describe: "Read Pentair ScreenLogic config",
+  builder: (yargs) => yargs.positional("key", {
+    type: "string",
+    describe: "Config key; omit to list all Pentair config"
+  }).option("json", {
+    type: "boolean",
+    default: false,
+    describe: "Output as JSON"
+  }).option("show-secrets", {
+    type: "boolean",
+    default: false,
+    describe: "Show secret values instead of redacting them"
+  }),
+  handler: (argv) => {
+    const keyArg = argv.key;
+    pentairConfigGet({
+      ...keyArg && { key: normalizePentairConfigKey(keyArg) },
+      json: argv.json === true,
+      showSecrets: argv["show-secrets"] === true
+    });
+  }
+};
+var pentairConfigSetCommand = {
+  command: "set <key> <value>",
+  describe: "Set Pentair ScreenLogic config",
+  builder: (yargs) => yargs.positional("key", {
+    type: "string",
+    demandOption: true,
+    describe: "Config key"
+  }).positional("value", {
+    type: "string",
+    demandOption: true,
+    describe: "New value"
+  }),
+  handler: (argv) => {
+    pentairConfigSet({
+      key: normalizePentairConfigKey(argv.key),
+      value: argv.value
+    });
+  }
+};
+var pentairConfigCommand = {
+  command: "config",
+  describe: "Manage Pentair ScreenLogic config",
+  builder: (yargs) => yargs.command(pentairConfigGetCommand).command(pentairConfigSetCommand).demandCommand(1).strictCommands(),
+  handler: noopHandler2
+};
+var pentairCircuitRuntimeSetCommand = {
+  command: "set",
+  describe: "Set a circuit egg-timer runtime",
+  builder: (yargs) => addConnectionOptions(yargs).option("circuit-id", {
+    type: "number",
+    demandOption: true,
+    describe: "Pentair circuit id to update"
+  }).option("hours", {
+    type: "number",
+    describe: "Runtime in hours"
+  }).option("minutes", {
+    type: "number",
+    describe: "Runtime in minutes"
+  }).option("on", {
+    type: "boolean",
+    default: false,
+    describe: "Turn the circuit on after setting the runtime"
+  }).option("json", {
+    type: "boolean",
+    default: false,
+    describe: "Output as JSON"
+  }).check((argv) => {
+    const hasHours = argv.hours !== void 0;
+    const hasMinutes = argv.minutes !== void 0;
+    if (hasHours === hasMinutes) throw new Error("Use exactly one of --hours or --minutes");
+    return true;
+  }),
+  handler: async (argv) => {
+    await setPentairCircuitRuntime({
+      "address": argv.address,
+      "circuit-id": argv["circuit-id"],
+      "hours": argv.hours,
+      "json": argv.json === true,
+      "minutes": argv.minutes,
+      "on": argv.on === true,
+      "password": argv.password,
+      "port": argv.port,
+      "response-timeout": argv["response-timeout"],
+      "search-attempts": argv["search-attempts"],
+      "search-timeout": argv["search-timeout"],
+      "system-name": argv["system-name"]
+    });
+  }
+};
+var pentairCircuitRuntimeCommand = {
+  command: "runtime",
+  describe: "Manage circuit egg-timer runtimes",
+  builder: (yargs) => yargs.command(pentairCircuitRuntimeSetCommand).demandCommand(1).strictCommands(),
+  handler: noopHandler2
+};
+var pentairCircuitCommand = {
+  command: "circuit",
+  describe: "Manage Pentair ScreenLogic circuits",
+  builder: (yargs) => yargs.command(pentairCircuitRuntimeCommand).demandCommand(1).strictCommands(),
+  handler: noopHandler2
+};
+var pentairCommand = {
+  command: "pentair",
+  describe: "Manage Pentair ScreenLogic systems",
+  builder: (yargs) => yargs.command(pentairCircuitCommand).command(pentairConfigCommand).demandCommand(1).strictCommands(),
+  handler: noopHandler2
+};
+
+// src/commands/witnessAppListCommand.ts
+import { homedir as homedir6 } from "node:os";
+import PATH2 from "node:path";
+
+// src/actions/witness/app/scanApps.ts
+import { execFile as execFileCb } from "node:child_process";
+import { existsSync as existsSync4, readdirSync as readdirSync2 } from "node:fs";
+import { homedir as homedir5 } from "node:os";
+import PATH from "node:path";
+import { promisify } from "node:util";
+var execFile = promisify(execFileCb);
+async function readPlist(appPath) {
+  const plistPath = PATH.join(appPath, "Contents", "Info.plist");
+  try {
+    const { stdout } = await execFile("plutil", ["-convert", "json", "-o", "-", plistPath]);
+    return JSON.parse(stdout);
+  } catch {
+    return null;
+  }
+}
+async function readCodesign(appPath) {
+  try {
+    const { stderr } = await execFile("codesign", ["-dv", "--verbose=2", appPath]);
+    const authorityMatch = /^Authority=(.+)$/m.exec(stderr);
+    const teamMatch = /^TeamIdentifier=(.+)$/m.exec(stderr);
+    let developer = null;
+    let obtainedFrom = "unknown";
+    if (authorityMatch) {
+      const authority = authorityMatch[1];
+      const devIdMatch = /^Developer ID Application: (.+?)(?:\s*\([A-Z\d]+\))?$/.exec(authority);
+      if (devIdMatch) {
+        developer = devIdMatch[1];
+        obtainedFrom = "developer-id";
+      } else if (authority === "Software Signing") {
+        developer = "Apple";
+        obtainedFrom = "apple-system";
+      } else if (authority === "Apple Mac OS Application Signing") {
+        obtainedFrom = "mac-app-store";
+      } else {
+        developer = authority;
+      }
+    }
+    const teamId = teamMatch?.[1];
+    const teamIdentifier = teamId && teamId !== "not set" ? teamId : null;
+    return {
+      developer,
+      obtainedFrom,
+      teamIdentifier
+    };
+  } catch {
+    return {
+      developer: null,
+      obtainedFrom: "unknown",
+      teamIdentifier: null
+    };
+  }
+}
+async function lookupAppStoreDeveloper(bundleId) {
+  try {
+    const url = `https://itunes.apple.com/lookup?bundleId=${encodeURIComponent(bundleId)}&entity=macSoftware`;
+    const response = await fetch(url);
+    const data = await response.json();
+    if (data.resultCount > 0 && data.results[0].artistName) {
+      return data.results[0].artistName;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+function appNameFromDir(dirName) {
+  return dirName.replace(/\.app$/i, "");
+}
+async function scanDirectory(dir) {
+  if (!existsSync4(dir.path)) return [];
+  const entries = readdirSync2(dir.path, { withFileTypes: true });
+  const appEntries = entries.filter((e) => e.name.endsWith(".app") && e.isDirectory());
+  const results = await Promise.allSettled(
+    appEntries.map(async (entry) => {
+      const appPath = PATH.join(dir.path, entry.name);
+      const [plist, codesign] = await Promise.all([
+        readPlist(appPath),
+        readCodesign(appPath)
+      ]);
+      const bundleIdentifier = plist?.CFBundleIdentifier ?? null;
+      let { developer } = codesign;
+      if (!developer && codesign.obtainedFrom === "mac-app-store" && bundleIdentifier) {
+        developer = await lookupAppStoreDeveloper(bundleIdentifier);
+      }
+      const name = plist?.CFBundleDisplayName ?? plist?.CFBundleName ?? appNameFromDir(entry.name);
+      return {
+        buildVersion: plist?.CFBundleVersion ?? null,
+        bundleIdentifier,
+        copyright: plist?.NSHumanReadableCopyright ?? null,
+        developer,
+        name,
+        obtainedFrom: codesign.obtainedFrom,
+        path: appPath,
+        scope: dir.scope,
+        teamIdentifier: codesign.teamIdentifier,
+        version: plist?.CFBundleShortVersionString ?? null
+      };
+    })
+  );
+  return results.filter((r) => r.status === "fulfilled").map((r) => r.value);
+}
+async function scanApps() {
+  if (process.platform !== "darwin") return [];
+  const dirs = [
+    { path: "/Applications", scope: "global" },
+    { path: "/System/Applications", scope: "system" },
+    { path: PATH.join(homedir5(), "Applications"), scope: "user" }
+  ];
+  const results = await Promise.all(dirs.map((d) => scanDirectory(d)));
+  return results.flat().toSorted((a, b) => a.name.localeCompare(b.name));
+}
+
+// src/actions/witness/app/types.ts
+var APP_LIST_SCHEMA = "network.xyo.macos.app.list";
+var APP_INFO_SCHEMA = "network.xyo.macos.app.info";
+
+// src/commands/witnessAppListCommand.ts
+var witnessAppListCommand = {
+  command: "list",
+  describe: "List installed macOS applications",
+  builder: (yargs) => yargs.option("json", {
+    default: false,
+    describe: "Output raw JSON",
+    type: "boolean"
+  }).option("output", {
+    alias: "o",
+    describe: "Write output to file",
+    type: "string"
+  }).option("pretty", {
+    default: true,
+    describe: "Pretty-print JSON output",
+    type: "boolean"
+  }).option("bound-witness", {
+    default: false,
+    describe: "Wrap payloads in a BoundWitness",
+    type: "boolean"
+  }).option("binary-dir", {
+    describe: "Directory for binary artifacts (default: ~/.aries/binaries/)",
+    type: "string"
+  }).option("scope", {
+    choices: ["all", "global", "system", "user"],
+    default: "all",
+    describe: "Filter by install scope",
+    type: "string"
+  }),
+  handler: async (argv) => {
+    const scope = argv.scope;
+    const allApps = await scanApps();
+    const apps = scope === "all" ? allApps : allApps.filter((a) => a.scope === scope);
+    const searchPaths = [
+      "/Applications",
+      "/System/Applications",
+      PATH2.join(homedir6(), "Applications")
+    ];
+    const plugin = {
+      meta: {
+        description: "List installed macOS applications",
+        name: "app-list",
+        schema: APP_LIST_SCHEMA
+      },
+      observe: async () => ({
+        payloads: [
+          {
+            appCount: apps.length,
+            schema: APP_LIST_SCHEMA,
+            scannedAt: Date.now(),
+            searchPaths
+          },
+          ...apps.map((app) => ({
+            buildVersion: app.buildVersion,
+            bundleIdentifier: app.bundleIdentifier,
+            copyright: app.copyright,
+            developer: app.developer,
+            name: app.name,
+            obtainedFrom: app.obtainedFrom,
+            path: app.path,
+            schema: APP_INFO_SCHEMA,
+            scope: app.scope,
+            teamIdentifier: app.teamIdentifier,
+            version: app.version
+          }))
+        ]
+      })
+    };
+    await executeWitness(plugin, argv);
+  }
+};
+
+// src/commands/witnessAppCommand.ts
+var witnessAppCommand = {
+  command: "app",
+  describe: "Inspect installed applications",
+  builder: (yargs) => yargs.command(witnessAppListCommand).demandCommand(1).strictCommands(),
+  // eslint-disable-next-line @typescript-eslint/no-empty-function
+  handler: () => {
+  }
+};
+
+// src/commands/witnessCommand.ts
+import { noopHandler as noopHandler3 } from "@ariestools/aries-cli-core";
+
+// src/actions/witness/witnesses/bank.ts
+var BANK_WITNESS_SCHEMA = "network.xyo.bank.account-snapshot";
+var bankWitness = {
+  builder: (yargs) => {
+    return yargs.option("provider", {
+      choices: ["capitalone"],
+      default: "capitalone",
+      describe: "Bank provider to witness",
+      type: "string"
+    }).option("resource", {
+      choices: ["accounts", "products"],
+      default: "accounts",
+      describe: "Capital One resource to witness",
+      type: "string"
+    }).option("from", {
+      describe: "Transaction window start passed to the provider endpoint",
+      type: "string"
+    }).option("to", {
+      describe: "Transaction window end passed to the provider endpoint",
+      type: "string"
+    }).option("account-id", {
+      describe: "Provider account id to filter balances and transactions",
+      type: "string"
+    }).option("include-raw", {
+      default: false,
+      describe: "Store raw provider JSON responses as witness binary artifacts",
+      type: "boolean"
+    }).option("redaction", {
+      choices: ["default", "none"],
+      default: "default",
+      describe: "Redaction mode for provider account and transaction ids",
+      type: "string"
+    }).option("env", {
+      choices: ["sandbox", "production"],
+      describe: "Capital One environment label",
+      type: "string"
+    }).option("base-url", {
+      describe: "Capital One API base URL",
+      type: "string"
+    }).option("token-url", {
+      describe: "Capital One OAuth client-credentials token URL",
+      type: "string"
+    }).option("access-token", {
+      describe: "Pre-issued Capital One bearer token; not persisted",
+      type: "string"
+    }).option("client-id", {
+      describe: "Capital One OAuth client id",
+      type: "string"
+    }).option("client-secret", {
+      describe: "Capital One OAuth client secret",
+      type: "string"
+    }).option("scope", {
+      describe: "Optional Capital One OAuth client-credentials scope",
+      type: "string"
+    }).option("api-version", {
+      default: "5",
+      describe: "Capital One products API media-type version",
+      type: "string"
+    }).option("operation", {
+      choices: ["retrieve-products", "retail-products", "search"],
+      default: "search",
+      describe: "Capital One products operation",
+      type: "string"
+    }).option("product-id", {
+      describe: "Capital One deposit product id for product-specific operations (default: ~)",
+      type: "string"
+    }).option("body", {
+      describe: "JSON request body for Capital One products POST operations",
+      type: "string"
+    }).option("body-file", {
+      describe: "Path to JSON request body for Capital One products POST operations",
+      type: "string"
+    }).option("accounts-path", {
+      describe: "Capital One accounts endpoint path, relative to --base-url",
+      type: "string"
+    }).option("balances-path", {
+      describe: "Capital One balances endpoint path; may include {accountId}",
+      type: "string"
+    }).option("transactions-path", {
+      describe: "Capital One transactions endpoint path; may include {accountId}",
+      type: "string"
+    });
+  },
+  meta: {
+    description: "Capture bank accounts, balances, transactions, or product catalog data",
+    name: "bank",
+    schema: BANK_WITNESS_SCHEMA
+  },
+  observe: async (args) => {
+    const provider = args.provider ?? "capitalone";
+    if (provider !== "capitalone") throw new Error(`Unsupported bank provider: ${provider}`);
+    const resource = args.resource ?? "accounts";
+    if (resource === "products") return capitalOneProductsProvider.observe(args);
+    if (resource !== "accounts") throw new Error(`Unsupported Capital One bank resource: ${resource}`);
+    return capitalOneProvider.observe(args);
+  }
+};
+
+// src/actions/witness/witnesses/netflixCatalog.ts
+import { readFile } from "node:fs/promises";
+import PATH4 from "node:path";
+import {
+  ingestStreamingCatalogSnapshot
+} from "@ariestools/aries-streaming-catalog-core";
+import { hashBinary as hashBinary4 } from "@ariestools/aries-witness-core";
+
+// src/actions/witness/witnesses/netflixCatalogBrowser.ts
+import { spawn } from "node:child_process";
+import FS from "node:fs";
+import NET from "node:net";
+import OS from "node:os";
+import PATH3 from "node:path";
+async function captureNetflixPagesWithChrome(urls, options) {
+  const chromePath = resolveChromePath(options.chromePath);
+  const port = await freePort();
+  ensureDir(options.profileDir);
+  const chrome = launchChrome(chromePath, port, options);
+  const readStderr = collectProcessStderr(chrome);
+  try {
+    await waitForDevTools(port, options.devtoolsTimeoutMs, chrome, readStderr);
+    const snapshots = [];
+    for (const url of urls) {
+      snapshots.push(...await captureUrl(port, url, options));
+    }
+    return snapshots;
+  } finally {
+    stopChrome(chrome);
+  }
+}
+function defaultChromeProfileDir() {
+  return PATH3.join(process.env.ARIES_HOME ?? PATH3.join(OS.homedir(), ".aries"), "browser-profiles", "netflix-catalog");
+}
+async function captureUrl(port, url, options) {
+  const target = await openTarget(port, url);
+  const client = await CdpClient.connect(target.webSocketDebuggerUrl);
+  try {
+    await client.send("Page.enable");
+    await client.send("Runtime.enable");
+    await sleep(options.waitMs);
+    return await captureScrolledSnapshots(client, url, options);
+  } finally {
+    client.close();
+    await closeTarget(port, target.id);
+  }
+}
+async function captureScrolledSnapshots(client, url, options) {
+  const snapshots = [];
+  for (let index = 0; index <= options.scrolls; index += 1) {
+    snapshots.push({
+      content: await evaluateString(client, 'document.documentElement ? document.documentElement.outerHTML : ""'),
+      sourceName: `browser:${url}#${index}`,
+      sourceUrl: url
+    });
+    if (index < options.scrolls) {
+      await client.send("Runtime.evaluate", {
+        awaitPromise: true,
+        expression: "window.scrollBy(0, Math.max(1, Math.floor(window.innerHeight * 0.85)))",
+        returnByValue: true
+      });
+      await sleep(options.scrollWaitMs);
+    }
+  }
+  return snapshots;
+}
+async function evaluateString(client, expression) {
+  const result = await client.send("Runtime.evaluate", {
+    awaitPromise: true,
+    expression,
+    returnByValue: true
+  });
+  if (result.exceptionDetails !== void 0) throw new Error(`Chrome evaluation failed for expression: ${expression}`);
+  return typeof result.result?.value === "string" ? result.result.value : "";
+}
+function launchChrome(chromePath, port, options) {
+  const args = [
+    `--remote-debugging-port=${port}`,
+    "--remote-debugging-address=127.0.0.1",
+    `--user-data-dir=${options.profileDir}`,
+    "--no-first-run",
+    "--no-default-browser-check",
+    `--window-size=${options.viewportWidth},${options.viewportHeight}`,
+    ...options.headless ? ["--headless=new", "--disable-gpu"] : [],
+    "about:blank"
+  ];
+  return spawn(chromePath, args, { stdio: ["ignore", "ignore", "pipe"] });
+}
+function collectProcessStderr(chrome) {
+  let stderr = "";
+  chrome.stderr?.setEncoding("utf8");
+  chrome.stderr?.on("data", (chunk) => {
+    stderr = `${stderr}${String(chunk)}`.slice(-4e3);
+  });
+  return () => stderr.trim();
+}
+function stopChrome(chrome) {
+  if (chrome.exitCode !== null || chrome.signalCode !== null) return;
+  chrome.kill("SIGTERM");
+}
+async function openTarget(port, url) {
+  const endpoint = `http://127.0.0.1:${port}/json/new?${encodeURIComponent(url)}`;
+  const response = await fetch(endpoint, { method: "PUT" });
+  if (!response.ok) throw new Error(`Chrome failed to open ${url}: HTTP ${response.status}`);
+  return response.json();
+}
+async function closeTarget(port, targetId) {
+  try {
+    await fetch(`http://127.0.0.1:${port}/json/close/${encodeURIComponent(targetId)}`);
+  } catch {
+  }
+}
+async function waitForDevTools(port, timeoutMs, chrome, readStderr) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (chrome.exitCode !== null || chrome.signalCode !== null) {
+      throw chromeDevToolsError(`Chrome exited before exposing a DevTools endpoint (${exitStatus(chrome)}).`, readStderr);
+    }
+    try {
+      const response = await fetch(`http://127.0.0.1:${port}/json/version`);
+      if (response.ok) return;
+    } catch {
+    }
+    await sleep(100);
+  }
+  throw chromeDevToolsError(`Chrome did not expose a DevTools endpoint within ${timeoutMs} ms.`, readStderr);
+}
+function chromeDevToolsError(message, readStderr) {
+  const stderr = readStderr();
+  return new Error(stderr.length === 0 ? message : `${message} Chrome stderr: ${stderr}`);
+}
+function exitStatus(chrome) {
+  if (chrome.exitCode !== null) return `exit code ${chrome.exitCode}`;
+  return `signal ${chrome.signalCode ?? "unknown"}`;
+}
+function resolveChromePath(chromePath) {
+  if (chromePath !== void 0 && chromePath.length > 0) {
+    if (FS.existsSync(chromePath)) return chromePath;
+    throw new Error(`Chrome executable not found at --chrome-path: ${chromePath}`);
+  }
+  if (process.env.CHROME_PATH !== void 0 && process.env.CHROME_PATH.length > 0) {
+    if (FS.existsSync(process.env.CHROME_PATH)) return process.env.CHROME_PATH;
+    throw new Error(`Chrome executable not found at CHROME_PATH: ${process.env.CHROME_PATH}`);
+  }
+  const candidates = platformChromeCandidates();
+  const found = candidates.find((candidate) => FS.existsSync(candidate));
+  if (found !== void 0) return found;
+  throw new Error("Chrome executable not found. Install Chrome/Chromium or pass --chrome-path with the executable path.");
+}
+function platformChromeCandidates() {
+  if (process.platform === "darwin") {
+    return [
+      "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
+      PATH3.join(OS.homedir(), "Applications/Google Chrome.app/Contents/MacOS/Google Chrome"),
+      "/Applications/Chromium.app/Contents/MacOS/Chromium"
+    ];
+  }
+  if (process.platform === "win32") {
+    return [
+      process.env.PROGRAMFILES === void 0 ? void 0 : PATH3.join(process.env.PROGRAMFILES, "Google/Chrome/Application/chrome.exe"),
+      process.env["PROGRAMFILES(X86)"] === void 0 ? void 0 : PATH3.join(process.env["PROGRAMFILES(X86)"], "Google/Chrome/Application/chrome.exe"),
+      process.env.LOCALAPPDATA === void 0 ? void 0 : PATH3.join(process.env.LOCALAPPDATA, "Google/Chrome/Application/chrome.exe")
+    ].filter((candidate) => candidate !== void 0);
+  }
+  return [
+    "/usr/bin/google-chrome",
+    "/usr/bin/google-chrome-stable",
+    "/usr/bin/chromium",
+    "/usr/bin/chromium-browser"
+  ];
+}
+async function freePort() {
+  const server = NET.createServer();
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", resolve);
+  });
+  const address = server.address();
+  await new Promise((resolve) => server.close(() => resolve()));
+  if (typeof address === "object" && address !== null) return address.port;
+  throw new Error("Failed to allocate a local Chrome debugging port.");
+}
+function ensureDir(dir) {
+  FS.mkdirSync(dir, { recursive: true, mode: 448 });
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+var CdpClient = class _CdpClient {
+  #nextId = 1;
+  #pending = /* @__PURE__ */ new Map();
+  #socket;
+  constructor(socket) {
+    this.#socket = socket;
+    socket.addEventListener("message", (event) => this.handleMessage(event.data));
+    socket.addEventListener("error", () => this.rejectAll(new Error("Chrome DevTools WebSocket failed.")));
+    socket.addEventListener("close", () => this.rejectAll(new Error("Chrome DevTools WebSocket closed.")));
+  }
+  static async connect(url) {
+    if (typeof WebSocket !== "function") {
+      throw new TypeError("Browser capture requires a Node.js runtime with global WebSocket support.");
+    }
+    const socket = await new Promise((resolve, reject) => {
+      const ws = new WebSocket(url);
+      ws.addEventListener("open", () => resolve(ws), { once: true });
+      ws.addEventListener("error", () => reject(new Error("Failed to connect to Chrome DevTools WebSocket.")), { once: true });
+    });
+    return new _CdpClient(socket);
+  }
+  close() {
+    this.#socket.close();
+  }
+  send(method, params) {
+    const id = this.#nextId;
+    this.#nextId += 1;
+    const promise = new Promise((resolve, reject) => {
+      this.#pending.set(id, {
+        reject,
+        resolve: (value) => resolve(value)
+      });
+    });
+    const message = params === void 0 ? {
+      id,
+      method
+    } : {
+      id,
+      method,
+      params
+    };
+    this.#socket.send(JSON.stringify(message));
+    return promise;
+  }
+  handleMessage(data) {
+    const message = JSON.parse(messageText(data));
+    if (message.id === void 0) return;
+    const pending = this.#pending.get(message.id);
+    if (pending === void 0) return;
+    this.#pending.delete(message.id);
+    if (message.error === void 0) {
+      pending.resolve(message.result);
+    } else {
+      pending.reject(new Error(`Chrome DevTools error ${message.error.code}: ${message.error.message}`));
+    }
+  }
+  rejectAll(error) {
+    for (const pending of this.#pending.values()) {
+      pending.reject(error);
+    }
+    this.#pending.clear();
+  }
+};
+function messageText(data) {
+  if (typeof data === "string") return data;
+  if (data instanceof ArrayBuffer) return Buffer.from(data).toString("utf8");
+  return String(data);
+}
+
+// src/actions/witness/witnesses/netflixCatalogDetail.ts
+import { hashBinary as hashBinary3 } from "@ariestools/aries-witness-core";
+
+// src/actions/witness/witnesses/netflixCatalogExtract.ts
+var TITLE_URL_PATTERN = /(?:href|src)=["'][^"']*(?:\/(?:watch|title)\/|netflix:\/\/title\/)(\d+)[^"']*["']/giu;
+var QUALITY_BADGES = [
+  { badge: "Dolby Vision", pattern: /\bDolby\s+Vision\b/iu },
+  { badge: "Atmos", pattern: /\b(?:Dolby\s+)?Atmos\b/iu },
+  { badge: "HDR", pattern: /\bHDR\b/iu },
+  { badge: "4K", pattern: /\b(?:4K|Ultra\s+HD|UHD)\b/iu },
+  { badge: "HD", pattern: /\bHD\b/iu }
+];
+var WEAK_TITLE_PATTERNS = [
+  /^-/u,
+  /\baudio description\b/iu,
+  /\b(?:episodes|more info|netflix home|sign in|subtitles|trailers? & more)\b/iu,
+  /\b(?:add to my list|remove from my list|start with)\b/iu
+];
+function extractNetflixCatalogObservations(html, context) {
+  const observations = /* @__PURE__ */ new Map();
+  for (const match of html.matchAll(TITLE_URL_PATTERN)) {
+    const sourceTitleId = match[1];
+    if (sourceTitleId === void 0) continue;
+    const windowText = nearbyHtml(html, match.index ?? 0);
+    const title = extractBestTitle(windowText) ?? fallbackTitle(sourceTitleId);
+    const existing = observations.get(sourceTitleId);
+    const badges = qualityBadges(windowText);
+    if (existing && !isWeakNetflixTitle(existing.title, sourceTitleId)) {
+      existing.quality = mergeQualityBadges(existing.quality?.badges ?? [], badges);
+      continue;
+    }
+    observations.set(sourceTitleId, {
+      available: true,
+      evidence: {
+        rawResponseHash: context.rawResponseHash,
+        region: context.region,
+        source: context.sourceName
+      },
+      observedAt: context.observedAt,
+      provider: "netflix",
+      quality: mergeQualityBadges(existing?.quality?.badges ?? [], badges),
+      region: context.region,
+      sourceKind: "browser-witness",
+      sourceTitleId,
+      title,
+      type: "unknown",
+      url: netflixTitleUrl(sourceTitleId)
+    });
+  }
+  return [...observations.values()].toSorted((a, b) => a.sourceTitleId.localeCompare(b.sourceTitleId));
+}
+function extractNetflixTitleDetails(html, context) {
+  const jsonLdRecords = extractJsonLdRecords(html);
+  const detail = {
+    evidence: {
+      rawResponseHash: context.rawResponseHash,
+      region: context.region,
+      source: context.sourceName
+    },
+    quality: mergeQualityBadges([], qualityBadges(html)),
+    sourceTitleId: context.sourceTitleId,
+    url: netflixTitleUrl(context.sourceTitleId)
+  };
+  assignDetailString(detail, "title", extractDetailTitle(html, jsonLdRecords));
+  assignDetailString(detail, "type", extractTitleType(html, jsonLdRecords));
+  assignDetailString(detail, "maturityRating", firstString3([
+    ...jsonLdRecords.map((record) => record.contentRating),
+    jsonStringValue(html, "contentRating"),
+    jsonStringValue(html, "maturityRating"),
+    jsonStringValue(html, "rating")
+  ]));
+  assignDetailString(detail, "synopsis", firstString3([
+    ...jsonLdRecords.map((record) => record.description),
+    metaContent(html, "description"),
+    metaContent(html, "og:description"),
+    jsonStringValue(html, "synopsis"),
+    jsonStringValue(html, "description"),
+    jsonStringValue(html, "summary")
+  ]));
+  const year = extractYear(html, jsonLdRecords);
+  if (year !== void 0) detail.year = year;
+  const runtime = extractRuntimeMinutes(html, jsonLdRecords);
+  if (runtime !== void 0) detail.runtime = runtime;
+  assignDetailStrings(detail, "genres", [
+    ...jsonLdRecords.flatMap((record) => stringsFromUnknown(record.genre)),
+    ...jsonStringArrayValues(html, "genre"),
+    ...jsonStringArrayValues(html, "genres")
+  ]);
+  assignDetailStrings(detail, "cast", [
+    ...jsonLdRecords.flatMap((record) => namesFromUnknown(record.actor)),
+    ...jsonLdRecords.flatMap((record) => namesFromUnknown(record.actors)),
+    ...jsonStringArrayValues(html, "cast")
+  ]);
+  assignDetailStrings(detail, "creators", [
+    ...jsonLdRecords.flatMap((record) => namesFromUnknown(record.creator)),
+    ...jsonLdRecords.flatMap((record) => namesFromUnknown(record.creators)),
+    ...jsonLdRecords.flatMap((record) => namesFromUnknown(record.director)),
+    ...jsonLdRecords.flatMap((record) => namesFromUnknown(record.directors)),
+    ...jsonStringArrayValues(html, "creators"),
+    ...jsonStringArrayValues(html, "directors")
+  ]);
+  return detail;
+}
+function isWeakNetflixTitle(title, sourceTitleId) {
+  const cleaned = cleanTitleText(title);
+  return cleaned === void 0 || cleaned === fallbackTitle(sourceTitleId) || WEAK_TITLE_PATTERNS.some((pattern) => pattern.test(cleaned));
+}
+function netflixTitleIdFromUrl(url) {
+  return /(?:\/(?:watch|title)\/|netflix:\/\/title\/)(\d+)/iu.exec(url)?.[1];
+}
+function netflixTitleUrl(sourceTitleId) {
+  return `https://www.netflix.com/title/${sourceTitleId}`;
+}
+function nearbyHtml(html, index) {
+  return html.slice(Math.max(0, index - 1200), Math.min(html.length, index + 1200));
+}
+function extractBestTitle(html) {
+  const attributes = [
+    attributeValue(html, "aria-label"),
+    attributeValue(html, "alt"),
+    attributeValue(html, "title"),
+    attributeValue(html, "data-title"),
+    jsonStringValue(html, "title"),
+    jsonStringValue(html, "name")
+  ];
+  return attributes.map(cleanTitleText).find((value) => value !== void 0);
+}
+function attributeValue(html, name) {
+  const match = new RegExp(String.raw`${name}\s*=\s*["']([^"']+)["']`, "iu").exec(html);
+  return match?.[1];
+}
+function jsonStringValue(html, name) {
+  const match = new RegExp(String.raw`["']${name}["']\s*:\s*["']((?:\\.|[^"'])+)["']`, "iu").exec(html);
+  return unescapeJsonString(match?.[1]);
+}
+function cleanTitleText(value) {
+  if (value === void 0) return void 0;
+  const decoded = decodeHtml(value).replaceAll(/\s+/gu, " ").replace(/\s*\|\s*Netflix(?:\s+Official\s+Site)?\s*$/iu, "").replace(/\s*-\s*Netflix(?:\s+Official\s+Site)?\s*$/iu, "").replace(/^\s*(?:go\s+to|watch|play)\s+/iu, "").trim();
+  if (decoded.length === 0 || decoded.length > 120 || /^\d+$/u.test(decoded)) return void 0;
+  if (WEAK_TITLE_PATTERNS.some((pattern) => pattern.test(decoded))) return void 0;
+  return decoded;
+}
+function cleanDetailText(value) {
+  if (value === void 0) return void 0;
+  const decoded = decodeHtml(value).replaceAll(/\s+/gu, " ").trim();
+  return decoded.length === 0 ? void 0 : decoded;
+}
+function decodeHtml(value) {
+  return value.replaceAll(/&#(\d+);/gu, (_match, code) => String.fromCodePoint(Number.parseInt(code, 10))).replaceAll(/&#x([a-f0-9]+);/giu, (_match, code) => String.fromCodePoint(Number.parseInt(code, 16))).replaceAll("&amp;", "&").replaceAll("&quot;", '"').replaceAll("&#39;", "'").replaceAll("&apos;", "'").replaceAll("&lt;", "<").replaceAll("&gt;", ">");
+}
+function extractDetailTitle(html, jsonLdRecords) {
+  return [
+    ...jsonLdRecords.map((record) => record.name),
+    metaContent(html, "og:title"),
+    metaContent(html, "twitter:title"),
+    metaContent(html, "title"),
+    tagText(html, "title"),
+    jsonStringValue(html, "title"),
+    jsonStringValue(html, "name")
+  ].map((value) => cleanTitleText(stringFromUnknown(value))).find((value) => value !== void 0);
+}
+function extractTitleType(html, jsonLdRecords) {
+  for (const rawType of [
+    ...jsonLdRecords.map((record) => record["@type"]),
+    jsonStringValue(html, "type"),
+    jsonStringValue(html, "videoType")
+  ]) {
+    const type = stringFromUnknown(rawType)?.toLowerCase();
+    if (type === void 0) continue;
+    if (/\b(?:movie|film)\b/u.test(type)) return "movie";
+    if (/\b(?:series|tvseries|show|season)\b/u.test(type)) return "series";
+  }
+  return void 0;
+}
+function extractYear(html, jsonLdRecords) {
+  for (const value of [
+    ...jsonLdRecords.flatMap((record) => [record.dateCreated, record.datePublished, record.releaseDate, record.releaseYear]),
+    jsonNumberValue(html, "releaseYear"),
+    jsonNumberValue(html, "year"),
+    jsonStringValue(html, "datePublished"),
+    jsonStringValue(html, "releaseDate")
+  ]) {
+    const year = yearFromUnknown(value);
+    if (year !== void 0) return year;
+  }
+  return void 0;
+}
+function extractRuntimeMinutes(html, jsonLdRecords) {
+  for (const value of [
+    ...jsonLdRecords.flatMap((record) => [record.duration, record.runtime]),
+    jsonStringValue(html, "duration"),
+    jsonStringValue(html, "runtime"),
+    jsonNumberValue(html, "runtime")
+  ]) {
+    const runtime = runtimeMinutesFromUnknown(value);
+    if (runtime !== void 0) return runtime;
+  }
+  return runtimeMinutesFromText(html);
+}
+function extractJsonLdRecords(html) {
+  const records = [];
+  for (const match of html.matchAll(/<script\b[^>]*type=["']application\/ld\+json["'][^>]*>([\s\S]*?)<\/script>/giu)) {
+    const json = cleanDetailText(match[1]);
+    if (json === void 0) continue;
+    try {
+      records.push(...flattenJsonLd(JSON.parse(json)));
+    } catch {
+    }
+  }
+  return records;
+}
+function flattenJsonLd(value) {
+  if (Array.isArray(value)) return value.flatMap(flattenJsonLd);
+  if (!isRecord5(value)) return [];
+  const graph = value["@graph"];
+  return [
+    value,
+    ...Array.isArray(graph) ? graph.flatMap(flattenJsonLd) : []
+  ];
+}
+function metaContent(html, target) {
+  for (const tag of html.matchAll(/<meta\b[^>]*>/giu)) {
+    const attributes = tagAttributes(tag[0]);
+    if (attributes.property !== target && attributes.name !== target) continue;
+    const content = cleanDetailText(attributes.content);
+    if (content !== void 0) return content;
+  }
+  return void 0;
+}
+function tagText(html, tagName) {
+  const match = new RegExp(String.raw`<${tagName}\b[^>]*>([\s\S]*?)<\/${tagName}>`, "iu").exec(html);
+  return cleanDetailText(match?.[1]?.replaceAll(/<[^>]+>/gu, " "));
+}
+function tagAttributes(tag) {
+  const attributes = {};
+  for (const match of tag.matchAll(/([a-z0-9:_-]+)\s*=\s*(["'])(.*?)\2/giu)) {
+    const key = match[1];
+    const value = match[3];
+    if (key !== void 0 && value !== void 0) attributes[key.toLowerCase()] = decodeHtml(value);
+  }
+  return attributes;
+}
+function jsonStringArrayValues(html, name) {
+  const values = [];
+  const pattern = new RegExp(String.raw`["']${name}["']\s*:\s*\[([\s\S]{0,3000}?)\]`, "giu");
+  for (const match of html.matchAll(pattern)) {
+    const content = match[1] ?? "";
+    if (/[{}]/u.test(content)) continue;
+    for (const stringMatch of content.matchAll(/["']((?:\\.|[^"'])+)["']/gu)) {
+      const value = cleanDetailText(unescapeJsonString(stringMatch[1]));
+      if (value !== void 0) values.push(value);
+    }
+  }
+  return values;
+}
+function jsonNumberValue(html, name) {
+  const match = new RegExp(String.raw`["']${name}["']\s*:\s*(\d+)`, "iu").exec(html);
+  return match?.[1] === void 0 ? void 0 : Number.parseInt(match[1], 10);
+}
+function firstString3(values) {
+  return values.map((value) => cleanDetailText(stringFromUnknown(value))).find((value) => value !== void 0);
+}
+function namesFromUnknown(value) {
+  if (Array.isArray(value)) return value.flatMap(namesFromUnknown);
+  if (isRecord5(value)) return stringsFromUnknown(value.name);
+  return stringsFromUnknown(value);
+}
+function stringsFromUnknown(value) {
+  if (Array.isArray(value)) return value.flatMap(stringsFromUnknown);
+  const text = cleanDetailText(stringFromUnknown(value));
+  return text === void 0 ? [] : [text];
+}
+function stringFromUnknown(value) {
+  return typeof value === "string" ? value : void 0;
+}
+function yearFromUnknown(value) {
+  if (typeof value === "number" && Number.isInteger(value) && value >= 1888 && value <= 3e3) return value;
+  const text = stringFromUnknown(value);
+  const match = text === void 0 ? void 0 : /\b(19|20|21)\d{2}\b/u.exec(text);
+  return match?.[0] === void 0 ? void 0 : Number.parseInt(match[0], 10);
+}
+function runtimeMinutesFromUnknown(value) {
+  if (typeof value === "number" && Number.isFinite(value) && value > 0) return Math.round(value);
+  const text = stringFromUnknown(value);
+  if (text === void 0) return void 0;
+  const isoMatch = /^P(?:T)?(?:(\d+)H)?(?:(\d+)M)?$/iu.exec(text);
+  if (isoMatch !== null) {
+    const hours = isoMatch[1] === void 0 ? 0 : Number.parseInt(isoMatch[1], 10);
+    const minutes = isoMatch[2] === void 0 ? 0 : Number.parseInt(isoMatch[2], 10);
+    const total = hours * 60 + minutes;
+    return total > 0 ? total : void 0;
+  }
+  return runtimeMinutesFromText(text);
+}
+function runtimeMinutesFromText(text) {
+  const match = /\b(?:(\d+)\s*h(?:ours?)?)?\s*(?:(\d+)\s*m(?:in(?:utes?)?)?)\b/iu.exec(decodeHtml(text));
+  if (match === null || match[1] === void 0 && match[2] === void 0) return void 0;
+  const hours = match[1] === void 0 ? 0 : Number.parseInt(match[1], 10);
+  const minutes = match[2] === void 0 ? 0 : Number.parseInt(match[2], 10);
+  const total = hours * 60 + minutes;
+  return total > 0 ? total : void 0;
+}
+function assignDetailString(target, key, value) {
+  const parsed = cleanDetailText(value);
+  if (parsed !== void 0) target[key] = parsed;
+}
+function assignDetailStrings(target, key, value) {
+  const strings = [...new Set(value.map(cleanDetailText).filter((item) => item !== void 0))].toSorted((a, b) => a.localeCompare(b));
+  if (strings.length > 0) target[key] = strings;
+}
+function isRecord5(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function unescapeJsonString(value) {
+  return value?.replaceAll(String.raw`\"`, '"').replaceAll(String.raw`\'`, "'").replaceAll(String.raw`\/`, "/");
+}
+function fallbackTitle(sourceTitleId) {
+  return `Netflix title ${sourceTitleId}`;
+}
+function qualityBadges(html) {
+  return QUALITY_BADGES.filter(({ pattern }) => pattern.test(html)).map(({ badge }) => badge);
+}
+function mergeQualityBadges(existing, next) {
+  return {
+    badges: [.../* @__PURE__ */ new Set([...existing, ...next])].toSorted((a, b) => a.localeCompare(b)),
+    encodes: []
+  };
+}
+
+// src/actions/witness/witnesses/netflixCatalogDetail.ts
+async function enrichNetflixCatalogObservations(observations, options) {
+  if (observations.length === 0) {
+    return {
+      detailSourceCount: 0,
+      observations: []
+    };
+  }
+  const detailUrls = [...new Set(observations.slice(0, options.detailLimit).map((observation) => observation.url ?? netflixTitleUrl(observation.sourceTitleId)))];
+  const detailSources = await resolveDetailSources(detailUrls, options);
+  const detailsByTitleId = /* @__PURE__ */ new Map();
+  for (const source of detailSources) {
+    const sourceTitleId = source.titleId ?? netflixTitleIdFromUrl(source.sourceUrl ?? "");
+    if (sourceTitleId === void 0) continue;
+    const rawResponseHash = hashBinary3(Buffer.from(source.content));
+    const detail = extractNetflixTitleDetails(source.content, {
+      observedAt: options.observedAt,
+      rawResponseHash,
+      region: options.region,
+      sourceName: source.sourceName,
+      sourceTitleId,
+      sourceUrl: source.sourceUrl
+    });
+    detailsByTitleId.set(sourceTitleId, mergeDetailPatch(detailsByTitleId.get(sourceTitleId), detail));
+  }
+  return {
+    detailSourceCount: detailSources.length,
+    observations: observations.map((observation) => mergeObservationDetail(observation, detailsByTitleId.get(observation.sourceTitleId)))
+  };
+}
+async function resolveDetailSources(urls, options) {
+  if (options.captureMethod === "browser") {
+    return (await captureNetflixPagesWithChrome(urls, {
+      chromePath: options.chromePath,
+      devtoolsTimeoutMs: options.devtoolsTimeoutMs,
+      headless: options.headless,
+      profileDir: options.profileDir,
+      scrolls: options.detailScrolls,
+      scrollWaitMs: options.detailScrollWaitMs,
+      viewportHeight: options.viewportHeight,
+      viewportWidth: options.viewportWidth,
+      waitMs: options.detailWaitMs
+    })).map(browserSnapshotToCaptureSource);
+  }
+  return Promise.all(urls.map(async (url) => ({
+    content: await options.fetchText(url),
+    sourceName: `detail-url:${url}`,
+    sourceUrl: url,
+    titleId: netflixTitleIdFromUrl(url)
+  })));
+}
+function browserSnapshotToCaptureSource(snapshot) {
+  return {
+    content: snapshot.content,
+    sourceName: `detail-${snapshot.sourceName}`,
+    sourceUrl: snapshot.sourceUrl,
+    titleId: netflixTitleIdFromUrl(snapshot.sourceUrl)
+  };
+}
+function mergeObservationDetail(observation, detail) {
+  if (detail === void 0 || !hasDetailData(detail)) return observation;
+  return {
+    ...observation,
+    cast: mergeStringList(observation.cast, detail.cast),
+    creators: mergeStringList(observation.creators, detail.creators),
+    evidence: detail.evidence ?? observation.evidence,
+    genres: mergeStringList(observation.genres, detail.genres),
+    maturityRating: detail.maturityRating ?? observation.maturityRating,
+    quality: mergeQuality(observation.quality, detail.quality),
+    runtime: detail.runtime ?? observation.runtime,
+    synopsis: detail.synopsis ?? observation.synopsis,
+    title: chooseMergedTitle(observation, detail),
+    type: detail.type ?? observation.type,
+    url: detail.url ?? observation.url,
+    year: detail.year ?? observation.year
+  };
+}
+function mergeDetailPatch(existing, next) {
+  if (existing === void 0) return next;
+  return {
+    ...existing,
+    cast: mergeStringList(existing.cast, next.cast),
+    creators: mergeStringList(existing.creators, next.creators),
+    evidence: next.evidence ?? existing.evidence,
+    genres: mergeStringList(existing.genres, next.genres),
+    maturityRating: next.maturityRating ?? existing.maturityRating,
+    quality: mergeQuality(existing.quality, next.quality),
+    runtime: next.runtime ?? existing.runtime,
+    sourceTitleId: existing.sourceTitleId ?? next.sourceTitleId,
+    synopsis: next.synopsis ?? existing.synopsis,
+    title: next.title ?? existing.title,
+    type: next.type ?? existing.type,
+    url: next.url ?? existing.url,
+    year: next.year ?? existing.year
+  };
+}
+function hasDetailData(detail) {
+  const values = [
+    detail.title,
+    detail.year,
+    detail.runtime,
+    detail.maturityRating,
+    detail.synopsis
+  ];
+  const arrays = [
+    detail.genres,
+    detail.cast,
+    detail.creators,
+    detail.quality?.badges,
+    detail.quality?.encodes
+  ];
+  return values.some((value) => value !== void 0) || arrays.some((value) => (value?.length ?? 0) > 0);
+}
+function chooseMergedTitle(observation, detail) {
+  if (detail.title === void 0) return observation.title;
+  if (isWeakNetflixTitle(observation.title, observation.sourceTitleId)) return detail.title;
+  return observation.title;
+}
+function mergeQuality(existing, next) {
+  return {
+    badges: mergeStringList(existing?.badges, next?.badges) ?? [],
+    encodes: [...existing?.encodes ?? [], ...next?.encodes ?? []]
+  };
+}
+function mergeStringList(existing, next) {
+  const merged = [...new Set([...existing ?? [], ...next ?? []].map((item) => item.trim()).filter((item) => item.length > 0))].toSorted((a, b) => a.localeCompare(b));
+  return merged.length === 0 ? void 0 : merged;
+}
+
+// src/actions/witness/witnesses/netflixCatalog.ts
+var NETFLIX_CATALOG_SCHEMA = "network.xyo.streaming.catalog.snapshot";
+var JSONL_MIME_TYPE = "application/x-ndjson";
+var netflixCatalogWitness = {
+  builder: (yargs) => {
+    return yargs.option("mode", {
+      choices: ["genre", "html-file", "search", "title", "url", "url-file"],
+      describe: "Netflix capture mode; inferred from the supplied target option when omitted",
+      type: "string"
+    }).option("region", {
+      default: "US",
+      describe: "Netflix catalog region label to attach to observations",
+      type: "string"
+    }).option("query", {
+      describe: "Search query for mode=search",
+      type: "string"
+    }).option("genre-id", {
+      describe: "Netflix genre id for mode=genre",
+      type: "string"
+    }).option("title-id", {
+      describe: "Netflix title id for mode=title",
+      type: "string"
+    }).option("url", {
+      array: true,
+      describe: "Netflix URL to fetch for mode=url",
+      type: "string"
+    }).option("url-file", {
+      describe: "File containing one Netflix URL per line for mode=url-file",
+      type: "string"
+    }).option("html-file", {
+      array: true,
+      describe: "Saved Netflix HTML or DOM file to parse for mode=html-file",
+      type: "string"
+    }).option("limit", {
+      default: 100,
+      describe: "Maximum observations to keep from extracted title links",
+      type: "number"
+    }).option("scope-key", {
+      describe: "Override the snapshot scope key stored in the catalog index",
+      type: "string"
+    }).option("observed-at", {
+      describe: "Override observation timestamp",
+      type: "string"
+    }).option("save", {
+      default: false,
+      describe: "Ingest the snapshot into ARIES_HOME/streaming-catalog",
+      type: "boolean"
+    }).option("allow-empty", {
+      default: false,
+      describe: "Allow --save to ingest a successful snapshot with zero extracted titles",
+      type: "boolean"
+    }).option("include-details", {
+      default: false,
+      describe: "Navigate captured title URLs and merge detail-page metadata into observations",
+      type: "boolean"
+    }).option("detail-limit", {
+      describe: "Maximum captured titles to enrich when --include-details is set",
+      type: "number"
+    }).option("detail-wait-ms", {
+      default: 5e3,
+      describe: "Milliseconds to wait after opening each Netflix title detail page",
+      type: "number"
+    }).option("detail-scrolls", {
+      default: 1,
+      describe: "Number of vertical scroll steps to run on each detail page",
+      type: "number"
+    }).option("detail-scroll-wait-ms", {
+      default: 750,
+      describe: "Milliseconds to wait after each detail-page scroll step",
+      type: "number"
+    }).option("capture-method", {
+      choices: ["browser", "fetch"],
+      describe: "How to load Netflix URL/search/genre/title pages; browser renders the live site, fetch retrieves static HTML only",
+      type: "string"
+    }).option("chrome-path", {
+      describe: "Chrome/Chromium executable path for browser capture",
+      type: "string"
+    }).option("browser-profile-dir", {
+      describe: "Persistent Chrome profile directory for Netflix login/session state",
+      type: "string"
+    }).option("devtools-timeout-ms", {
+      default: 3e4,
+      describe: "Milliseconds to wait for Chrome to expose its DevTools endpoint before capture starts",
+      type: "number"
+    }).option("headless", {
+      default: false,
+      describe: "Run Chrome in headless mode for browser capture",
+      type: "boolean"
+    }).option("wait-ms", {
+      default: 8e3,
+      describe: "Milliseconds to wait after opening each Netflix page before extracting the first DOM snapshot",
+      type: "number"
+    }).option("scrolls", {
+      default: 8,
+      describe: "Number of vertical scroll steps to run before final extraction",
+      type: "number"
+    }).option("scroll-wait-ms", {
+      default: 1e3,
+      describe: "Milliseconds to wait after each scroll step",
+      type: "number"
+    }).option("viewport-width", {
+      default: 1440,
+      describe: "Browser viewport width for rendered Netflix capture",
+      type: "number"
+    }).option("viewport-height", {
+      default: 1200,
+      describe: "Browser viewport height for rendered Netflix capture",
+      type: "number"
+    });
+  },
+  meta: {
+    description: "Snapshot visible Netflix catalog title links as scoped streaming catalog observations",
+    name: "netflix-catalog",
+    schema: NETFLIX_CATALOG_SCHEMA
+  },
+  observe: async (args) => {
+    const observedAt = normalizeObservedAt(args["observed-at"]);
+    const mode = inferMode(args);
+    const region = normalizeRegion(args.region);
+    const limit = normalizeLimit(args.limit);
+    const sources = await resolveCaptureSources(mode, args);
+    const scope = buildScope(mode, args, sources, limit);
+    const scopeKey = stringArg(args["scope-key"]) ?? defaultScopeKey(scope);
+    let observations = collectObservations(sources, {
+      limit,
+      observedAt,
+      region
+    });
+    if (mode === "title") {
+      const titleId = requiredString(args["title-id"], "--title-id is required for mode=title");
+      observations = observations.filter((observation) => observation.sourceTitleId === titleId);
+      if (observations.length === 0) observations.push(fallbackTitleObservation(titleId, observedAt, region));
+    }
+    const detailResult = await enrichObservationsWithDetails(observations, args, {
+      limit,
+      observedAt,
+      region
+    });
+    observations = detailResult.observations;
+    assertNonEmptySave(args, observations.length);
+    const jsonl = Buffer.from(`${observations.map((observation) => JSON.stringify(observation)).join("\n")}${observations.length > 0 ? "\n" : ""}`);
+    const observationsHash = hashBinary4(jsonl);
+    const snapshot = args.save === true ? ingestStreamingCatalogSnapshot({
+      complete: false,
+      observations,
+      observedAt,
+      provider: "netflix",
+      region,
+      removalPolicy: "scope",
+      scope,
+      scopeKey,
+      sourceKind: "browser-witness",
+      sourceName: "netflix-catalog-witness",
+      status: "success"
+    }) : void 0;
+    const binaryRef = {
+      filename: `netflix-catalog-${region.toLowerCase()}-${scopeKey}-${observedAt.slice(0, 10)}.jsonl`,
+      hash: observationsHash,
+      mimeType: JSONL_MIME_TYPE,
+      size: jsonl.length
+    };
+    const payload = {
+      complete: false,
+      observedAt,
+      observations: binaryRef,
+      observationsHash,
+      observationsMimeType: JSONL_MIME_TYPE,
+      provider: "netflix",
+      region,
+      removalPolicy: "scope",
+      schema: NETFLIX_CATALOG_SCHEMA,
+      scope,
+      scopeKey,
+      sourceCount: sources.length,
+      sourceKind: "browser-witness",
+      titleCount: observations.length,
+      ...detailResult.detailSourceCount > 0 && { detailSourceCount: detailResult.detailSourceCount },
+      ...snapshot !== void 0 && { snapshot }
+    };
+    return {
+      binaries: [{ data: jsonl, ref: binaryRef }],
+      payloads: [payload]
+    };
+  }
+};
+function assertNonEmptySave(args, titleCount) {
+  if (args.save !== true || booleanArg(args["allow-empty"]) || titleCount > 0) return;
+  throw new Error([
+    "Refusing to save an empty Netflix catalog snapshot.",
+    "The capture returned 0 titles; rerun after login/profile selection or pass --allow-empty",
+    "to intentionally record an empty successful snapshot."
+  ].join(" "));
+}
+function collectObservations(sources, options) {
+  const byTitleId = /* @__PURE__ */ new Map();
+  for (const source of sources) {
+    const rawResponseHash = hashBinary4(Buffer.from(source.content));
+    for (const observation of extractNetflixCatalogObservations(source.content, {
+      observedAt: options.observedAt,
+      rawResponseHash,
+      region: options.region,
+      sourceName: source.sourceName,
+      sourceUrl: source.sourceUrl
+    })) {
+      byTitleId.set(observation.sourceTitleId, observation);
+      if (byTitleId.size >= options.limit) break;
+    }
+    if (byTitleId.size >= options.limit) break;
+  }
+  return [...byTitleId.values()].toSorted((a, b) => a.sourceTitleId.localeCompare(b.sourceTitleId));
+}
+async function enrichObservationsWithDetails(observations, args, options) {
+  if (!booleanArg(args["include-details"]) || observations.length === 0) {
+    return {
+      detailSourceCount: 0,
+      observations: [...observations]
+    };
+  }
+  return enrichNetflixCatalogObservations(observations, {
+    captureMethod: captureMethod(args),
+    chromePath: stringArg(args["chrome-path"]),
+    devtoolsTimeoutMs: normalizePositiveInteger(args["devtools-timeout-ms"], "--devtools-timeout-ms", 3e4),
+    detailLimit: normalizeDetailLimit(args["detail-limit"], options.limit),
+    detailScrolls: normalizeNonNegativeInteger(args["detail-scrolls"], "--detail-scrolls", 1),
+    detailScrollWaitMs: normalizePositiveInteger(args["detail-scroll-wait-ms"], "--detail-scroll-wait-ms", 750),
+    detailWaitMs: normalizeNonNegativeInteger(args["detail-wait-ms"], "--detail-wait-ms", 5e3),
+    fetchText,
+    headless: args.headless === true,
+    observedAt: options.observedAt,
+    profileDir: stringArg(args["browser-profile-dir"]) ?? defaultChromeProfileDir(),
+    region: options.region,
+    viewportHeight: normalizePositiveInteger(args["viewport-height"], "--viewport-height", 1200),
+    viewportWidth: normalizePositiveInteger(args["viewport-width"], "--viewport-width", 1440)
+  });
+}
+async function resolveCaptureSources(mode, args) {
+  if (mode === "html-file") {
+    const files = arrayArg(args["html-file"]);
+    if (files.length === 0) throw new Error("--html-file is required for mode=html-file");
+    return Promise.all(files.map(async (file) => ({
+      content: await readRequiredTextFile(
+        file,
+        `Netflix HTML file not found: ${file}. Pass an existing saved Netflix HTML/DOM file, or use --query, --genre-id, --title-id, or --url to fetch a page directly.`
+      ),
+      sourceName: `html-file:${PATH4.basename(file)}`
+    })));
+  }
+  const urls = await urlsForMode(mode, args);
+  if (captureMethod(args) === "browser") {
+    return (await captureNetflixPagesWithChrome(urls, {
+      chromePath: stringArg(args["chrome-path"]),
+      devtoolsTimeoutMs: normalizePositiveInteger(args["devtools-timeout-ms"], "--devtools-timeout-ms", 3e4),
+      headless: args.headless === true,
+      profileDir: stringArg(args["browser-profile-dir"]) ?? defaultChromeProfileDir(),
+      scrolls: normalizeNonNegativeInteger(args.scrolls, "--scrolls", 8),
+      scrollWaitMs: normalizePositiveInteger(args["scroll-wait-ms"], "--scroll-wait-ms", 1e3),
+      viewportHeight: normalizePositiveInteger(args["viewport-height"], "--viewport-height", 1200),
+      viewportWidth: normalizePositiveInteger(args["viewport-width"], "--viewport-width", 1440),
+      waitMs: normalizeNonNegativeInteger(args["wait-ms"], "--wait-ms", 8e3)
+    })).map(browserSnapshotToCaptureSource2);
+  }
+  return Promise.all(urls.map(async (url) => ({
+    content: await fetchText(url),
+    sourceName: `url:${url}`,
+    sourceUrl: url,
+    titleId: netflixTitleIdFromUrl(url)
+  })));
+}
+function browserSnapshotToCaptureSource2(snapshot) {
+  return {
+    content: snapshot.content,
+    sourceName: snapshot.sourceName,
+    sourceUrl: snapshot.sourceUrl,
+    titleId: netflixTitleIdFromUrl(snapshot.sourceUrl)
+  };
+}
+function captureMethod(args) {
+  const method = stringArg(args["capture-method"]);
+  if (method === void 0) return "browser";
+  if (method === "browser" || method === "fetch") return method;
+  throw new Error(`Invalid --capture-method value: ${method}`);
+}
+async function urlsForMode(mode, args) {
+  if (mode === "search") {
+    const query = requiredString(args.query, "--query is required for mode=search");
+    return [`https://www.netflix.com/search?q=${encodeURIComponent(query)}`];
+  }
+  if (mode === "genre") {
+    const genreId = requiredString(args["genre-id"], "--genre-id is required for mode=genre");
+    return [`https://www.netflix.com/browse/genre/${genreId}`];
+  }
+  if (mode === "title") {
+    const titleId = requiredString(args["title-id"], "--title-id is required for mode=title");
+    return [netflixTitleUrl(titleId)];
+  }
+  if (mode === "url") {
+    const urls = arrayArg(args.url);
+    if (urls.length === 0) throw new Error("--url is required for mode=url");
+    return urls;
+  }
+  if (mode === "url-file") {
+    const file = requiredString(args["url-file"], "--url-file is required for mode=url-file");
+    return (await readRequiredTextFile(file, `Netflix URL file not found: ${file}. Pass an existing file with one Netflix URL per line.`)).split(/\r?\n/u).map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#"));
+  }
+  throw new Error(`Unsupported Netflix catalog mode: ${mode}`);
+}
+async function fetchText(url) {
+  const response = await fetch(url, {
+    headers: {
+      "accept-language": "en-US,en;q=0.9",
+      "user-agent": "Mozilla/5.0 AriesNetflixCatalogWitness/0.1"
+    }
+  });
+  return response.text();
+}
+async function readRequiredTextFile(file, missingMessage) {
+  try {
+    return await readFile(file, "utf8");
+  } catch (error) {
+    if (isNodeFileNotFoundError(error)) throw new Error(missingMessage, { cause: error });
+    throw error;
+  }
+}
+function isNodeFileNotFoundError(error) {
+  return error instanceof Error && "code" in error && error.code === "ENOENT";
+}
+function inferMode(args) {
+  const mode = stringArg(args.mode);
+  if (mode !== void 0) return mode;
+  if (arrayArg(args["html-file"]).length > 0) return "html-file";
+  if (stringArg(args["url-file"]) !== void 0) return "url-file";
+  if (arrayArg(args.url).length > 0) return "url";
+  if (stringArg(args["title-id"]) !== void 0) return "title";
+  if (stringArg(args["genre-id"]) !== void 0) return "genre";
+  if (stringArg(args.query) !== void 0) return "search";
+  throw new Error("Netflix catalog witness requires one target: --query, --genre-id, --title-id, --url, --url-file, or --html-file.");
+}
+function buildScope(mode, args, sources, limit) {
+  const scope = { limit, mode };
+  if (mode !== "html-file") assignScopeValue(scope, "captureMethod", captureMethod(args));
+  if (booleanArg(args["include-details"])) {
+    scope.includeDetails = true;
+    scope.detailLimit = normalizeDetailLimit(args["detail-limit"], limit);
+  }
+  assignScopeValue(scope, "query", stringArg(args.query));
+  assignScopeValue(scope, "genreId", stringArg(args["genre-id"]));
+  assignScopeValue(scope, "titleId", stringArg(args["title-id"]));
+  if (sources.length > 0) scope.sources = sources.map((source) => source.sourceUrl ?? source.sourceName);
+  return scope;
+}
+function defaultScopeKey(scope) {
+  if (scope.mode === "search" && typeof scope.query === "string") return slug(`search-${scope.query}`);
+  if (scope.mode === "genre" && typeof scope.genreId === "string") return slug(`genre-${scope.genreId}`);
+  if (scope.mode === "title" && typeof scope.titleId === "string") return slug(`title-${scope.titleId}`);
+  return slug(`${scope.mode}-${hashBinary4(Buffer.from(JSON.stringify(scope))).slice(0, 12)}`);
+}
+function fallbackTitleObservation(titleId, observedAt, region) {
+  return {
+    available: true,
+    evidence: {
+      region,
+      source: "netflix-catalog-witness"
+    },
+    observedAt,
+    provider: "netflix",
+    quality: { badges: [], encodes: [] },
+    region,
+    sourceKind: "browser-witness",
+    sourceTitleId: titleId,
+    title: `Netflix title ${titleId}`,
+    type: "unknown",
+    url: netflixTitleUrl(titleId)
+  };
+}
+function normalizeObservedAt(value) {
+  const parsed = new Date(stringArg(value) ?? Date.now());
+  if (Number.isNaN(parsed.getTime())) throw new Error(`Invalid --observed-at value: ${String(value)}`);
+  return parsed.toISOString();
+}
+function normalizeRegion(value) {
+  return (stringArg(value) ?? "US").toUpperCase();
+}
+function normalizeLimit(value) {
+  const limit = normalizePositiveInteger(value, "--limit", 100);
+  return Math.min(limit, 1e3);
+}
+function normalizeDetailLimit(value, limit) {
+  const detailLimit = normalizePositiveInteger(value, "--detail-limit", Math.min(limit, 25));
+  return Math.min(detailLimit, limit, 1e3);
+}
+function normalizePositiveInteger(value, field, defaultValue) {
+  const integer = numberArg(value, defaultValue);
+  if (!Number.isInteger(integer) || integer <= 0) throw new Error(`${field} must be a positive integer.`);
+  return integer;
+}
+function normalizeNonNegativeInteger(value, field, defaultValue) {
+  const integer = numberArg(value, defaultValue);
+  if (!Number.isInteger(integer) || integer < 0) throw new Error(`${field} must be a non-negative integer.`);
+  return integer;
+}
+function numberArg(value, defaultValue) {
+  if (typeof value === "number") return value;
+  const parsed = stringArg(value);
+  return parsed === void 0 ? defaultValue : Number(parsed);
+}
+function requiredString(value, message) {
+  const parsed = stringArg(value);
+  if (parsed === void 0) throw new Error(message);
+  return parsed;
+}
+function stringArg(value) {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
+}
+function arrayArg(value) {
+  if (Array.isArray(value)) return value.map(String).map((item) => item.trim()).filter((item) => item.length > 0);
+  const parsed = stringArg(value);
+  return parsed === void 0 ? [] : [parsed];
+}
+function booleanArg(value) {
+  return value === true || value === "true";
+}
+function assignScopeValue(scope, key, value) {
+  if (value !== void 0) scope[key] = value;
+}
+function slug(value) {
+  return value.toLowerCase().replaceAll(/[^a-z0-9._-]+/gu, "-").replaceAll(/^-|-$/gu, "") || "netflix";
+}
+
+// src/actions/witness/witnesses/pentair.ts
+import { SchedTypes } from "node-screenlogic";
+var PENTAIR_SCHEMA = "network.xyo.pentair.screenlogic";
+var pentairWitness = {
+  meta: {
+    description: "Capture Pentair ScreenLogic pool equipment state",
+    name: "pentair",
+    schema: PENTAIR_SCHEMA
+  },
+  observe: async (args) => {
+    const payload = await withScreenLogic(args, async (unit) => ({
+      chem: await unit.chem.getChemicalDataAsync(),
+      chlor: await unit.chlor.getIntellichlorConfigAsync(),
+      equipment: {
+        circuitNames: await unit.equipment.getAllCircuitNamesAsync(),
+        config: await unit.equipment.getEquipmentConfigurationAsync(),
+        controllerConfig: await unit.equipment.getControllerConfigAsync(),
+        customNames: await unit.equipment.getCustomNamesAsync(),
+        state: await unit.equipment.getEquipmentStateAsync(),
+        systemTime: await unit.equipment.getSystemTimeAsync(),
+        weatherForecast: await unit.equipment.getWeatherForecastAsync()
+      },
+      schedule: {
+        once: await unit.schedule.getScheduleDataAsync(SchedTypes.RUNONCE),
+        recurring: await unit.schedule.getScheduleDataAsync(SchedTypes.RECURRING)
+      },
+      schema: PENTAIR_SCHEMA,
+      version: await unit.getVersionAsync()
+    }));
+    return { payloads: [payload] };
+  }
+};
+
+// src/actions/witness/witnesses/pentairIntellichem.ts
+import {
+  existsSync as existsSync5,
+  mkdirSync as mkdirSync5,
+  readFileSync as readFileSync5,
+  writeFileSync as writeFileSync6
+} from "node:fs";
+import path6 from "node:path";
+
+// src/actions/witness/witnesses/pentairIntellichemGraph.ts
+import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync5 } from "node:fs";
+import path5 from "node:path";
+var DATA_GAP_MS = 2 * 60 * 60 * 1e3;
+function assertNumber(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+function escapeHtml(value) {
+  return String(value).replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
+}
+function mergeSamples(samples) {
+  const byTimestamp = /* @__PURE__ */ new Map();
+  for (const sample of samples) {
+    const existing = byTimestamp.get(sample.timestamp);
+    byTimestamp.set(sample.timestamp, existing ? { ...existing, ...sample } : sample);
+  }
+  return [...byTimestamp.values()].toSorted((a, b) => Date.parse(a.timestamp) - Date.parse(b.timestamp));
+}
+function pointPath(points, scaleX, scaleY, gapMs = Number.POSITIVE_INFINITY) {
+  let previous;
+  return points.map((point, index) => {
+    const startsSegment = index === 0 || previous !== void 0 && point.time - previous.time > gapMs;
+    previous = point;
+    return `${startsSegment ? "M" : "L"} ${scaleX(point.time).toFixed(1)} ${scaleY(point.value).toFixed(1)}`;
+  }).join(" ");
+}
+function tickValues(min, max, count) {
+  if (count <= 1 || min === max) return [min];
+  return Array.from({ length: count }, (_, index) => min + (max - min) * index / (count - 1));
+}
+function metricPoints(samples, metric) {
+  return samples.map((sample) => ({ time: Date.parse(sample.timestamp), value: assertNumber(sample[metric]) })).filter((point) => Number.isFinite(point.time) && point.value !== void 0);
+}
+function dataGaps(points) {
+  const gaps = [];
+  for (let index = 1; index < points.length; index += 1) {
+    const previous = points[index - 1];
+    const point = points[index];
+    if (previous && point && point.time - previous.time > DATA_GAP_MS) {
+      gaps.push({
+        end: point.time,
+        hours: (point.time - previous.time) / (60 * 60 * 1e3),
+        start: previous.time
+      });
+    }
+  }
+  return gaps;
+}
+function renderLineChart(samples, metric, label, color, setPointMetric) {
+  const width = 1040;
+  const height = 340;
+  const margin = {
+    bottom: 48,
+    left: 58,
+    right: 22,
+    top: 32
+  };
+  const points = metricPoints(samples, metric);
+  if (points.length === 0) {
+    return `<section class="chart"><h2>${escapeHtml(label)}</h2><div class="empty">No ${escapeHtml(label)} samples yet.</div></section>`;
+  }
+  const setPoints = setPointMetric ? metricPoints(samples, setPointMetric) : [];
+  const latestSetPoint = setPoints.at(-1);
+  const minTime = Math.min(...points.map((point) => point.time));
+  const maxTime = Math.max(...points.map((point) => point.time));
+  const values = [...points.map((point) => point.value), ...latestSetPoint ? [latestSetPoint.value] : []];
+  const minValue = Math.min(...values);
+  const maxValue = Math.max(...values);
+  const padding = Math.max((maxValue - minValue) * 0.12, metric === "pH" ? 0.1 : 10);
+  const yMin = Math.max(0, minValue - padding);
+  const yMax = metric === "pH" ? Math.min(14, maxValue + padding) : maxValue + padding;
+  const chartWidth = width - margin.left - margin.right;
+  const chartHeight = height - margin.top - margin.bottom;
+  const span = Math.max(maxTime - minTime, 1);
+  const valueSpan = Math.max(yMax - yMin, 1);
+  const scaleX = (time) => margin.left + (time - minTime) / span * chartWidth;
+  const scaleY = (value) => margin.top + chartHeight - (value - yMin) / valueSpan * chartHeight;
+  const xTicks = tickValues(minTime, maxTime, 5);
+  const yTicks = tickValues(yMin, yMax, 5);
+  const latest = points.at(-1);
+  const latestLabel = latest ? `${latest.value.toFixed(metric === "pH" ? 2 : 0)} ${metric}` : "";
+  const gaps = dataGaps(points);
+  const setPointY = latestSetPoint ? scaleY(latestSetPoint.value).toFixed(1) : void 0;
+  const setPointLine = setPointY ? `<line x1="${margin.left}" x2="${width - margin.right}" y1="${setPointY}" y2="${setPointY}" class="setpoint" />` : "";
+  return `
+    <section class="chart">
+      <div class="chart-title">
+        <h2>${escapeHtml(label)}</h2>
+        <span>${escapeHtml(latestLabel)}${gaps.length > 0 ? ` \xB7 ${gaps.length} data gaps shaded` : ""}</span>
+      </div>
+      <svg viewBox="0 0 ${width} ${height}" role="img" aria-label="${escapeHtml(label)} over time">
+        <rect x="${margin.left}" y="${margin.top}" width="${chartWidth}" height="${chartHeight}" class="plot" />
+        ${gaps.map((gap) => {
+    const x = scaleX(gap.start);
+    const gapWidth = Math.max(scaleX(gap.end) - x, 1);
+    return `<rect x="${x.toFixed(1)}" y="${margin.top}" width="${gapWidth.toFixed(1)}" height="${chartHeight}" class="gap-band">
+            <title>No ${escapeHtml(label)} samples for ${escapeHtml(gap.hours.toFixed(1))} hours</title>
+          </rect>`;
+  }).join("")}
+        ${yTicks.map((tick) => {
+    const y = scaleY(tick);
+    return `<line x1="${margin.left}" x2="${width - margin.right}" y1="${y.toFixed(1)}" y2="${y.toFixed(1)}" class="grid" />
+            <text x="${margin.left - 10}" y="${(y + 4).toFixed(1)}" text-anchor="end" class="axis">${escapeHtml(tick.toFixed(metric === "pH" ? 2 : 0))}</text>`;
+  }).join("")}
+        ${xTicks.map((tick) => {
+    const x = scaleX(tick);
+    const labelText = new Date(tick).toLocaleString();
+    return `<line x1="${x.toFixed(1)}" x2="${x.toFixed(1)}" y1="${margin.top}" y2="${height - margin.bottom}" class="grid-soft" />
+            <text x="${x.toFixed(1)}" y="${height - 16}" text-anchor="middle" class="axis">${escapeHtml(labelText)}</text>`;
+  }).join("")}
+        <path d="${pointPath(points, scaleX, scaleY, DATA_GAP_MS)}" fill="none" stroke="${color}" stroke-width="3" stroke-linecap="round" stroke-linejoin="round" />
+        ${setPointLine}
+      </svg>
+    </section>
+  `;
+}
+function renderGraph({
+  generatedAt,
+  samples,
+  sourcePath,
+  title
+}) {
+  const merged = mergeSamples(samples);
+  const latest = merged.findLast((sample) => sample.pH !== void 0 || sample.orp !== void 0);
+  const firstTimestamp = merged.at(0)?.timestamp;
+  const lastTimestamp = merged.at(-1)?.timestamp;
+  const timeRange = merged.length > 0 ? `${new Date(firstTimestamp ?? generatedAt).toLocaleString()} to ${new Date(lastTimestamp ?? generatedAt).toLocaleString()}` : "No samples";
+  return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>${escapeHtml(title)}</title>
+  <style>
+    :root {
+      color-scheme: light;
+      font-family: Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
+      background: #f8fafc;
+      color: #172033;
+    }
+    body {
+      margin: 0;
+    }
+    main {
+      max-width: 1120px;
+      margin: 0 auto;
+      padding: 28px 20px 40px;
+    }
+    header {
+      display: flex;
+      flex-wrap: wrap;
+      gap: 18px;
+      justify-content: space-between;
+      align-items: flex-end;
+      border-bottom: 1px solid #d7dee8;
+      padding-bottom: 18px;
+      margin-bottom: 22px;
+    }
+    h1, h2, p {
+      margin: 0;
+    }
+    h1 {
+      font-size: 28px;
+      font-weight: 720;
+      letter-spacing: 0;
+    }
+    h2 {
+      font-size: 17px;
+      letter-spacing: 0;
+    }
+    .meta {
+      color: #506174;
+      font-size: 13px;
+      line-height: 1.55;
+      text-align: right;
+    }
+    .metrics {
+      display: grid;
+      grid-template-columns: repeat(auto-fit, minmax(150px, 1fr));
+      gap: 10px;
+      margin: 18px 0 20px;
+    }
+    .metric {
+      background: #ffffff;
+      border: 1px solid #d7dee8;
+      border-radius: 6px;
+      padding: 12px 14px;
+    }
+    .metric span {
+      display: block;
+      color: #64748b;
+      font-size: 12px;
+      margin-bottom: 4px;
+    }
+    .metric strong {
+      font-size: 22px;
+      letter-spacing: 0;
+    }
+    .chart {
+      background: #ffffff;
+      border: 1px solid #d7dee8;
+      border-radius: 6px;
+      margin-top: 14px;
+      padding: 16px;
+    }
+    .chart-title {
+      display: flex;
+      justify-content: space-between;
+      align-items: baseline;
+      gap: 12px;
+      margin-bottom: 8px;
+    }
+    .chart-title span {
+      color: #506174;
+      font-size: 13px;
+    }
+    svg {
+      width: 100%;
+      height: auto;
+      display: block;
+    }
+    .plot {
+      fill: #fbfdff;
+      stroke: #d7dee8;
+    }
+    .gap-band {
+      fill: #eef2f6;
+      opacity: 0.7;
+    }
+    .grid {
+      stroke: #dbe4ee;
+      stroke-width: 1;
+    }
+    .grid-soft {
+      stroke: #eef3f8;
+      stroke-width: 1;
+    }
+    .axis {
+      fill: #64748b;
+      font-size: 11px;
+    }
+    .setpoint {
+      stroke: #64748b;
+      stroke-width: 2;
+      stroke-dasharray: 7 6;
+    }
+    .empty {
+      color: #64748b;
+      padding: 36px 0;
+      text-align: center;
+    }
+  </style>
+</head>
+<body>
+  <main>
+    <header>
+      <div>
+        <h1>${escapeHtml(title)}</h1>
+        <p>${escapeHtml(timeRange)}</p>
+      </div>
+      <div class="meta">
+        <div>Generated: ${escapeHtml(new Date(generatedAt).toLocaleString())}</div>
+        ${sourcePath ? `<div>Series: ${escapeHtml(sourcePath)}</div>` : ""}
+        <div>Samples: ${merged.length}</div>
+      </div>
+    </header>
+    <section class="metrics">
+      <div class="metric"><span>Latest pH</span><strong>${escapeHtml(latest?.pH?.toFixed(2) ?? "n/a")}</strong></div>
+      <div class="metric"><span>Latest ORP</span><strong>${escapeHtml(latest?.orp?.toFixed(0) ?? "n/a")}</strong></div>
+      <div class="metric"><span>pH tank</span><strong>${escapeHtml(latest?.pHTankLevel ?? "n/a")}</strong></div>
+      <div class="metric"><span>ORP tank</span><strong>${escapeHtml(latest?.orpTankLevel ?? "n/a")}</strong></div>
+    </section>
+    ${renderLineChart(merged, "pH", "pH", "#0f8b8d", "pHSetPoint")}
+    ${renderLineChart(merged, "orp", "ORP", "#d95d39", "orpSetPoint")}
+  </main>
+</body>
+</html>
+`;
+}
+function writeGraph(filePath, series) {
+  mkdirSync4(path5.dirname(filePath), { recursive: true });
+  writeFileSync5(filePath, renderGraph(series), "utf8");
+}
+
+// src/actions/witness/witnesses/pentairIntellichem.ts
+var DAY_MS = 24 * 60 * 60 * 1e3;
+var DEFAULT_HISTORY_AGE = "24h";
+var INTELLICHEM_SCHEMA = "network.xyo.pentair.screenlogic.intellichem";
+function assertNumber2(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+function parseDateOrAge(value, now, fallback) {
+  if (!value) return fallback;
+  const age = /^(\d+)(m|h|d)$/i.exec(value.trim());
+  if (age) {
+    const amount = Number(age[1]);
+    const unit = age[2]?.toLowerCase();
+    const multiplier = unit === "m" ? 60 * 1e3 : unit === "h" ? 60 * 60 * 1e3 : DAY_MS;
+    return new Date(now.getTime() - amount * multiplier);
+  }
+  const date = new Date(value);
+  if (Number.isNaN(date.getTime())) {
+    throw new TypeError(`Invalid date or relative age: ${value}`);
+  }
+  return date;
+}
+function sampleKey(sample) {
+  return sample.timestamp;
+}
+function mergeSamples2(samples) {
+  const byTimestamp = /* @__PURE__ */ new Map();
+  for (const sample of samples) {
+    const existing = byTimestamp.get(sampleKey(sample));
+    byTimestamp.set(sampleKey(sample), existing ? { ...existing, ...sample } : sample);
+  }
+  return [...byTimestamp.values()].toSorted((a, b) => Date.parse(a.timestamp) - Date.parse(b.timestamp));
+}
+function currentChemSample(chem, observedAt) {
+  return {
+    alkalinity: assertNumber2(chem.alkalinity),
+    calcium: assertNumber2(chem.calcium),
+    corrosive: chem.corrosive,
+    cyanuricAcid: assertNumber2(chem.cyanuricAcid),
+    error: chem.error,
+    orp: assertNumber2(chem.orp),
+    orpSetPoint: assertNumber2(chem.orpSetPoint),
+    orpTankLevel: assertNumber2(chem.orpTankLevel),
+    pH: assertNumber2(chem.pH),
+    pHSetPoint: assertNumber2(chem.pHSetPoint),
+    pHTankLevel: assertNumber2(chem.pHTankLevel),
+    saltPPM: assertNumber2(chem.saltPPM),
+    saturation: assertNumber2(chem.saturation),
+    scaling: chem.scaling,
+    source: "current",
+    temperature: assertNumber2(chem.temperature),
+    timestamp: observedAt.toISOString()
+  };
+}
+function historySamples(history) {
+  const samples = /* @__PURE__ */ new Map();
+  for (const point of history.phPoints ?? []) {
+    const timestamp = point.time.toISOString();
+    samples.set(timestamp, {
+      ...samples.get(timestamp),
+      pH: point.pH,
+      source: "history",
+      timestamp
+    });
+  }
+  for (const point of history.orpPoints ?? []) {
+    const timestamp = point.time.toISOString();
+    samples.set(timestamp, {
+      ...samples.get(timestamp),
+      orp: point.orp,
+      source: "history",
+      timestamp
+    });
+  }
+  return mergeSamples2([...samples.values()]);
+}
+function loadSamples(filePath) {
+  if (!existsSync5(filePath)) return [];
+  const raw = readFileSync5(filePath, "utf8");
+  const samples = [];
+  for (const line of raw.split(/\r?\n/)) {
+    if (!line.trim()) continue;
+    try {
+      const parsed = JSON.parse(line);
+      if (typeof parsed.timestamp === "string" && typeof parsed.source === "string") {
+        samples.push(parsed);
+      }
+    } catch {
+    }
+  }
+  return mergeSamples2(samples);
+}
+function saveSamples(filePath, samples) {
+  const merged = mergeSamples2([...loadSamples(filePath), ...samples]);
+  mkdirSync5(path6.dirname(filePath), { recursive: true });
+  writeFileSync6(filePath, `${merged.map((sample) => JSON.stringify(sample)).join("\n")}
+`, "utf8");
+  return merged;
+}
+var pentairIntellichemWitness = {
+  builder: (yargs) => {
+    return yargs.option("history", {
+      default: false,
+      describe: "Fetch IntelliChem controller history for the time window",
+      type: "boolean"
+    }).option("from", {
+      default: DEFAULT_HISTORY_AGE,
+      describe: "History start as ISO date or relative age like 30m, 6h, 7d",
+      type: "string"
+    }).option("to", {
+      describe: "History end as ISO date or relative age (default: now)",
+      type: "string"
+    }).option("address", {
+      describe: "Connect directly to a ScreenLogic adapter IP instead of UDP discovery",
+      type: "string"
+    }).option("port", {
+      describe: "ScreenLogic adapter TCP port for direct connection (default: config or 80)",
+      type: "number"
+    }).option("password", {
+      describe: "ScreenLogic password for direct connection, if configured",
+      type: "string"
+    }).option("system-name", {
+      describe: "ScreenLogic system name for direct connection (default: config or Pentair ScreenLogic)",
+      type: "string"
+    }).option("search-timeout", {
+      describe: "Milliseconds to wait for each UDP discovery attempt (default: config or 5000)",
+      type: "number"
+    }).option("search-attempts", {
+      describe: "Number of UDP discovery attempts before failing (default: config or 3)",
+      type: "number"
+    }).option("response-timeout", {
+      describe: "Milliseconds to wait for each ScreenLogic command response (default: config or 15000)",
+      type: "number"
+    }).option("save", {
+      default: false,
+      describe: "Save normalized IntelliChem samples to the series file",
+      type: "boolean"
+    }).option("series-file", {
+      describe: `JSONL file used for saved IntelliChem samples and graphing (default: config or ${defaultPentairSeriesFile()})`,
+      type: "string"
+    }).option("graph", {
+      describe: "Write a standalone HTML graph to this path",
+      type: "string"
+    }).option("graph-only", {
+      default: false,
+      describe: "Render a graph from the series file without connecting to ScreenLogic",
+      type: "boolean"
+    });
+  },
+  meta: {
+    description: "Capture and graph Pentair IntelliChem chemistry data",
+    name: "pentair-intellichem",
+    schema: INTELLICHEM_SCHEMA
+  },
+  observe: async (args) => {
+    const options = args;
+    const pentairOptions = resolvePentairConfig(options);
+    const now = /* @__PURE__ */ new Date();
+    const wantsHistory = options.history === true || typeof options.graph === "string";
+    const from = parseDateOrAge(options.from, now, new Date(now.getTime() - DAY_MS));
+    const to = parseDateOrAge(options.to, now, now);
+    const seriesFile = pentairOptions["series-file"] ?? defaultPentairSeriesFile();
+    if (from.getTime() >= to.getTime()) {
+      throw new Error("History start must be before history end");
+    }
+    if (options["graph-only"]) {
+      if (!options.graph) throw new Error("--graph-only requires --graph");
+      const graphSamples2 = loadSamples(seriesFile);
+      writeGraph(options.graph, {
+        generatedAt: now.toISOString(),
+        samples: graphSamples2,
+        sourcePath: seriesFile,
+        title: "Pentair IntelliChem"
+      });
+      return {
+        payloads: [{
+          graph: {
+            path: options.graph,
+            samples: graphSamples2.length
+          },
+          samples: {
+            seriesFile,
+            stored: graphSamples2.length
+          },
+          schema: INTELLICHEM_SCHEMA
+        }]
+      };
+    }
+    const observed = await withScreenLogic(options, async (unit) => ({
+      current: await unit.chem.getChemicalDataAsync(),
+      history: wantsHistory ? await unit.chem.getChemHistoryDataAsync(from, to) : void 0
+    }));
+    const currentSample = currentChemSample(observed.current, now);
+    const observedSamples = mergeSamples2([
+      ...observed.history ? historySamples(observed.history) : [],
+      currentSample
+    ]);
+    const savedSamples = options.save ? saveSamples(seriesFile, observedSamples) : void 0;
+    const graphSamples = options.graph ? mergeSamples2([...loadSamples(seriesFile), ...observedSamples]) : void 0;
+    if (options.graph && graphSamples) {
+      writeGraph(options.graph, {
+        generatedAt: now.toISOString(),
+        samples: graphSamples,
+        sourcePath: seriesFile,
+        title: "Pentair IntelliChem"
+      });
+    }
+    const payload = {
+      current: observed.current,
+      graph: options.graph ? {
+        path: options.graph,
+        samples: graphSamples?.length ?? 0
+      } : void 0,
+      history: observed.history,
+      historyWindow: wantsHistory ? {
+        from: from.toISOString(),
+        to: to.toISOString()
+      } : void 0,
+      samples: {
+        observed: observedSamples.length,
+        saved: savedSamples?.length,
+        seriesFile: options.save || options.graph ? seriesFile : void 0
+      },
+      schema: INTELLICHEM_SCHEMA
+    };
+    return { payloads: [payload] };
+  }
+};
+
+// src/actions/witness/witnesses/pentairSchedules.ts
+import { SchedTypes as SchedTypes2 } from "node-screenlogic";
+var PENTAIR_SCHEDULES_SCHEMA = "network.xyo.pentair.screenlogic.schedules";
+function circuitName(circuit) {
+  return circuit?.name && circuit.name.length > 0 ? circuit.name : void 0;
+}
+function normalizePumpProfile(pump, pumpCircuit, circuitsById) {
+  const name = circuitName(circuitsById.get(pumpCircuit.circuit));
+  return {
+    circuitId: pumpCircuit.circuit,
+    ...name && { circuitName: name },
+    ...!(pumpCircuit.flow === void 0) && { flow: pumpCircuit.flow },
+    pumpId: pump.id,
+    pumpName: pump.name,
+    ...!(pumpCircuit.speed === void 0) && { speed: pumpCircuit.speed },
+    units: pumpCircuit.units
+  };
+}
+function normalizePump(pump, circuitsById, pumpStatuses) {
+  const status = pumpStatuses.get(pump.id);
+  return {
+    circuits: pump.circuits.map((pumpCircuit) => normalizePumpProfile(pump, pumpCircuit, circuitsById)),
+    id: pump.id,
+    maxSpeed: pump.maxSpeed,
+    minSpeed: pump.minSpeed,
+    name: pump.name,
+    ...typeof status === "string" && { statusError: status },
+    ...typeof status === "object" && { status }
+  };
+}
+function normalizeSchedules(rows, scheduleType, circuitsById, statesById, profilesByCircuitId) {
+  return rows.map((schedule) => {
+    const circuit = circuitsById.get(schedule.circuitId);
+    const name = circuitName(circuit);
+    const currentState = statesById.get(schedule.circuitId);
+    const pumpProfile = profilesByCircuitId.get(schedule.circuitId);
+    return {
+      ...schedule,
+      ...name && { circuitName: name },
+      ...!(currentState === void 0) && { currentState },
+      ...!(circuit?.eggTimer === void 0) && { eggTimer: circuit.eggTimer },
+      ...!(pumpProfile === void 0) && { pumpProfile },
+      scheduleType
+    };
+  });
+}
+function buildPentairSchedulesPayload({
+  controllerCircuits,
+  equipmentState,
+  pumps,
+  pumpStatuses = /* @__PURE__ */ new Map(),
+  recurring,
+  runOnce,
+  systemTime
+}) {
+  const circuitsById = new Map(controllerCircuits.map((circuit) => [circuit.circuitId, circuit]));
+  const statesById = new Map(equipmentState.circuitArray.map((circuit) => [circuit.id, circuit.state]));
+  const pumpSummaries = pumps.map((pump) => normalizePump(pump, circuitsById, pumpStatuses));
+  const profilesByCircuitId = new Map(
+    pumpSummaries.flatMap((pump) => pump.circuits.map((profile) => [profile.circuitId, profile]))
+  );
+  const recurringSchedules = normalizeSchedules(
+    recurring.data,
+    "recurring",
+    circuitsById,
+    statesById,
+    profilesByCircuitId
+  );
+  const runOnceSchedules = normalizeSchedules(
+    runOnce.data,
+    "runOnce",
+    circuitsById,
+    statesById,
+    profilesByCircuitId
+  );
+  const allSchedules = [...recurringSchedules, ...runOnceSchedules].toSorted((a, b) => a.scheduleType.localeCompare(b.scheduleType) || a.scheduleId - b.scheduleId || a.circuitId - b.circuitId);
+  return {
+    circuits: controllerCircuits.map((circuit) => ({
+      circuitId: circuit.circuitId,
+      eggTimer: circuit.eggTimer,
+      function: circuit.function,
+      interface: circuit.interface,
+      name: circuit.name,
+      state: statesById.get(circuit.circuitId)
+    })),
+    counts: {
+      all: allSchedules.length,
+      recurring: recurringSchedules.length,
+      runOnce: runOnceSchedules.length
+    },
+    pumps: pumpSummaries,
+    schedules: {
+      all: allSchedules,
+      recurring: recurringSchedules,
+      runOnce: runOnceSchedules
+    },
+    systemTime
+  };
+}
+function addPentairConnectionOptions(yargs) {
+  return yargs.option("address", {
+    describe: "Connect directly to a ScreenLogic adapter IP instead of UDP discovery",
+    type: "string"
+  }).option("port", {
+    describe: "ScreenLogic adapter TCP port for direct connection (default: config or 80)",
+    type: "number"
+  }).option("password", {
+    describe: "ScreenLogic password for direct connection, if configured",
+    type: "string"
+  }).option("system-name", {
+    describe: "ScreenLogic system name for direct connection (default: config or Pentair ScreenLogic)",
+    type: "string"
+  }).option("search-timeout", {
+    describe: "Milliseconds to wait for each UDP discovery attempt (default: config or 5000)",
+    type: "number"
+  }).option("search-attempts", {
+    describe: "Number of UDP discovery attempts before failing (default: config or 3)",
+    type: "number"
+  }).option("response-timeout", {
+    describe: "Milliseconds to wait for each ScreenLogic command response (default: config or 15000)",
+    type: "number"
+  });
+}
+var pentairSchedulesWitness = {
+  builder: (yargs) => addPentairConnectionOptions(yargs),
+  meta: {
+    description: "Capture Pentair ScreenLogic schedules with circuit and pump context",
+    name: "pentair-schedules",
+    schema: PENTAIR_SCHEDULES_SCHEMA
+  },
+  observe: async (args) => {
+    const payload = await withScreenLogic(args, async (unit) => {
+      const equipmentConfig = await unit.equipment.getEquipmentConfigurationAsync();
+      const controllerConfig = await unit.equipment.getControllerConfigAsync();
+      const equipmentState = await unit.equipment.getEquipmentStateAsync();
+      const systemTime = await unit.equipment.getSystemTimeAsync();
+      const recurring = await unit.schedule.getScheduleDataAsync(SchedTypes2.RECURRING);
+      const runOnce = await unit.schedule.getScheduleDataAsync(SchedTypes2.RUNONCE);
+      const pumpStatuses = /* @__PURE__ */ new Map();
+      for (const pump of equipmentConfig.pumps) {
+        try {
+          pumpStatuses.set(pump.id, await unit.pump.getPumpStatusAsync(pump.id));
+        } catch (error) {
+          pumpStatuses.set(pump.id, error instanceof Error ? error.message : String(error));
+        }
+      }
+      return {
+        ...buildPentairSchedulesPayload({
+          controllerCircuits: controllerConfig.circuitArray,
+          equipmentState,
+          pumps: equipmentConfig.pumps,
+          pumpStatuses,
+          recurring,
+          runOnce,
+          systemTime
+        }),
+        schema: PENTAIR_SCHEDULES_SCHEMA
+      };
+    });
+    return { payloads: [payload] };
+  }
+};
+
+// src/actions/witness/witnesses/systemInfo.ts
+import {
+  arch,
+  cpus,
+  freemem,
+  hostname,
+  platform,
+  release,
+  totalmem,
+  uptime
+} from "node:os";
+var systemInfoWitness = {
+  meta: {
+    description: "Capture system information (OS, CPU, memory, etc.)",
+    name: "system-info",
+    schema: "network.xyo.system.info"
+  },
+  observe: async () => ({
+    payloads: [{
+      arch: arch(),
+      cpus: cpus().length,
+      freeMemory: freemem(),
+      hostname: hostname(),
+      nodeVersion: process.version,
+      os: release(),
+      platform: platform(),
+      schema: "network.xyo.system.info",
+      totalMemory: totalmem(),
+      uptime: uptime()
+    }]
+  })
+};
+
+// src/actions/witness/witnesses/timestamp.ts
+var timestampWitness = {
+  meta: {
+    description: "Capture the current timestamp",
+    name: "timestamp",
+    schema: "network.xyo.timestamp"
+  },
+  observe: async () => ({
+    payloads: [{
+      schema: "network.xyo.timestamp",
+      timestamp: Date.now()
+    }]
+  })
+};
+
+// src/actions/witness/witnesses/url.ts
+import { hashBinary as hashBinary5 } from "@ariestools/aries-witness-core";
+async function fetchUrl(url) {
+  const response = await fetch(url);
+  const arrayBuffer = await response.arrayBuffer();
+  const body = Buffer.from(arrayBuffer);
+  const headers = Object.fromEntries(response.headers.entries());
+  return {
+    body,
+    headers,
+    statusCode: response.status
+  };
+}
+function extractTitle(html) {
+  const match = /<title[^>]*>([^<]*)<\/title>/i.exec(html);
+  return match?.[1]?.trim();
+}
+function isBinaryContentType(contentType) {
+  return contentType.startsWith("image/") || contentType.startsWith("audio/") || contentType.startsWith("video/") || contentType === "application/pdf" || contentType === "application/octet-stream";
+}
+var urlWitness = {
+  builder: (yargs) => {
+    return yargs.option("url", {
+      demandOption: true,
+      describe: "The URL to fetch",
+      type: "string"
+    });
+  },
+  meta: {
+    description: "Capture metadata and content from a URL",
+    name: "url",
+    schema: "network.xyo.url"
+  },
+  observe: async (args) => {
+    const url = args.url;
+    const {
+      body,
+      statusCode,
+      headers
+    } = await fetchUrl(url);
+    const contentType = headers["content-type"]?.split(";", 1)[0]?.trim() ?? "application/octet-stream";
+    const contentHash = hashBinary5(body);
+    const payload = {
+      contentHash,
+      contentLength: body.length,
+      contentType,
+      fetchedAt: Date.now(),
+      schema: "network.xyo.url",
+      statusCode,
+      url
+    };
+    if (contentType === "text/html") {
+      const html = body.toString("utf8");
+      const title = extractTitle(html);
+      if (title) payload.title = title;
+    }
+    const binaries = [];
+    if (isBinaryContentType(contentType)) {
+      const ref = {
+        filename: url.split("/").pop()?.split("?", 1)[0],
+        hash: contentHash,
+        mimeType: contentType,
+        size: body.length
+      };
+      binaries.push({ data: body, ref });
+    }
+    return { binaries, payloads: [payload] };
+  }
+};
+
+// src/actions/witness/witnesses/index.ts
+var builtInWitnesses = [
+  timestampWitness,
+  systemInfoWitness,
+  urlWitness,
+  bankWitness,
+  netflixCatalogWitness,
+  pentairWitness,
+  pentairIntellichemWitness,
+  pentairSchedulesWitness
+];
+
+// src/commands/witnessCommand.ts
+var buildWitnessCommands = async (yargs) => {
+  for (const plugin of builtInWitnesses) {
+    yargs.command(registerWitnessCommand(plugin));
+  }
+  const discovered = await discoverPlugins();
+  for (const plugin of discovered) {
+    yargs.command(registerWitnessCommand(plugin));
+  }
+  yargs.command(witnessAppCommand);
+  return yargs.demandCommand(1).strictCommands();
+};
+var witnessCommand = {
+  command: "witness",
+  describe: "Observe data and produce XYO-compliant payloads",
+  builder: buildWitnessCommands,
+  handler: noopHandler3
+};
+
+// src/witness.ts
+import { runYargsCli } from "@ariestools/aries-cli-core";
+var witness = async () => {
+  await runYargsCli({
+    configure: buildWitnessCommands,
+    demandCommand: false,
+    scriptName: "aries-witness",
+    strictCommands: false,
+    usage: "$0 <command> [options]"
+  });
+};
+export {
+  BANK_ACCOUNT_SNAPSHOT_SCHEMA,
+  BANK_PRODUCT_CATALOG_SCHEMA,
+  CAPITAL_ONE_CONFIG_KEYS,
+  PENTAIR_CONFIG_KEYS,
+  bankCommand,
+  bankConfigDir,
+  buildWitnessCommands,
+  capitalOneConfigGet,
+  capitalOneConfigPath,
+  capitalOneConfigSet,
+  capitalOneProductsProvider,
+  capitalOneProvider,
+  defaultCapitalOneConfig,
+  defaultPentairConfig,
+  defaultPentairSeriesFile,
+  discoverPlugins,
+  executeWitness,
+  formatOutput,
+  normalizeCapitalOneConfigKey,
+  normalizePentairConfigKey,
+  pentairCommand,
+  pentairConfigDir,
+  pentairConfigGet,
+  pentairConfigPath,
+  pentairConfigSet,
+  readCapitalOneConfig,
+  readPentairConfig,
+  registerWitnessCommand,
+  resolveCapitalOneConfig,
+  resolveCircuitRuntimeMinutes,
+  resolvePentairConfig,
+  setPentairCircuitRuntime,
+  withScreenLogic,
+  witness,
+  witnessAppCommand,
+  witnessAppListCommand,
+  witnessCommand,
+  writeCapitalOneConfig,
+  writePentairConfig
+};
+//# sourceMappingURL=index.mjs.map