@catena/cli 0.8.0 → 0.9.0

package/dist/index.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import{a as e,i as t,n,r,t as i}from"./rolldown-runtime-B0Z9INg1.mjs";import{D as a,E as o,O as s}from"./dist-w03V0QPF.mjs";import{defineCommand as c,renderUsage as l,runMain as u}from"citty";import*as d from"valibot";import{ECDH as f,createECDH as p,createHash as m,createPrivateKey as h,randomBytes as g,sign as _}from"node:crypto";import{execFile as v,spawn as y}from"node:child_process";import{accessSync as b,chmodSync as x,constants as S,existsSync as C,mkdirSync as w,readFileSync as T,realpathSync as E,renameSync as D,rmSync as O,statSync as k,writeFileSync as A}from"node:fs";import{homedir as ee}from"node:os";import{dirname as j,isAbsolute as M,join as te,resolve as ne}from"node:path";import{createServer as re}from"node:http";import{constants as N,isUtf8 as ie}from"node:buffer";import ae from"semver";var P=`@catena/cli`,oe=`0.8.0`;function se(e){return e instanceof Error?e.message:String(e)}function ce(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function le(e){if(!ce(e))return!1;let t=Object.getPrototypeOf(e);return t===Object.prototype||t===null}var F=class{container;constructor(e){this.container=e}};function ue(e,t){let n=Object.getOwnPropertyDescriptor(e,t);return n!==void 0&&n.enumerable===!0&&`value`in n}function de(e){if(Object.getOwnPropertySymbols(e).length>0)return null;let t=Object.getOwnPropertyNames(e);for(let n of t)if(!ue(e,n))return null;return t}function fe(e){if(Object.getPrototypeOf(e)!==Array.prototype||Object.getOwnPropertySymbols(e).length>0)return!1;let t=Object.getOwnPropertyNames(e);if(t.length!==e.length+1)return!1;for(let n=0;n<e.length;n++)if(t[n]!==String(n)||!ue(e,t[n]))return!1;return!0}function pe(e){let t=new Set,n=new Set,r=[e];for(;r.length>0;){let e=r.pop();if(e instanceof F){t.delete(e.container),n.add(e.container);continue}if(e===null||typeof e==`string`||typeof e==`boolean`)continue;if(typeof e==`number`){if(!Number.isFinite(e))return!1;continue}if(Array.isArray(e)){if(t.has(e))return!1;if(n.has(e))continue;if(!fe(e))return!1;t.add(e),r.push(new F(e));for(let t of e)r.push(t);continue}if(!le(e)||Object.hasOwn(e,`__proto__`)||t.has(e))return!1;if(n.has(e))continue;let i=de(e);if(i===null)return!1;t.add(e),r.push(new F(e));for(let t of i)r.push(e[t])}return!0}function me(e){return t=>{try{return e(t)}catch{return!1}}}d.custom(me(pe),`Expected a JSON value`),d.custom(me(e=>le(e)&&pe(e)),`Expected a JSON object`),d.custom(me(e=>Array.isArray(e)&&pe(e)),`Expected a JSON array`);function I(e){return ge(L(e))}function he(e,t){let n=e.padStart(Math.ceil(e.length/2)*2,`0`);return I(a(n,t).reduce((e,t)=>e+String.fromCharCode(t),``))}function ge(e){return e.replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=/g,``)}function L(e){if(arguments.length===0)throw TypeError(`1 argument required, but only 0 present.`);let t;for(e=`${e}`,t=0;t<e.length;t++)if(e.charCodeAt(t)>255)throw Error(`InvalidCharacterError: found code point greater than 255:${e.charCodeAt(t)} at position ${t}`);let n=``;for(t=0;t<e.length;t+=3){let r=[void 0,void 0,void 0,void 0];r[0]=e.charCodeAt(t)>>2,r[1]=(e.charCodeAt(t)&3)<<4,e.length>t+1&&(r[1]|=e.charCodeAt(t+1)>>4,r[2]=(e.charCodeAt(t+1)&15)<<2),e.length>t+2&&(r[2]|=e.charCodeAt(t+2)>>6,r[3]=e.charCodeAt(t+2)&63);for(let e=0;e<r.length;e++)r[e]===void 0?n+=`=`:n+=_e(r[e])}return n}function _e(e){if(e>=0&&e<64)return`ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/`[e]}var R=[`u8`,`u16`,`u32`,`u64`,`u128`,`i8`,`i16`,`i32`,`i64`,`i128`,`f32`,`f64`],ve=function(){function e(){this.offset=0,this.buffer_size=256,this.buffer=new ArrayBuffer(this.buffer_size),this.view=new DataView(this.buffer)}return e.prototype.resize_if_necessary=function(e){if(this.buffer_size-this.offset<e){this.buffer_size=Math.max(this.buffer_size*2,this.buffer_size+e);var t=new ArrayBuffer(this.buffer_size);new Uint8Array(t).set(new Uint8Array(this.buffer)),this.buffer=t,this.view=new DataView(t)}},e.prototype.get_used_buffer=function(){return new Uint8Array(this.buffer).slice(0,this.offset)},e.prototype.store_value=function(e,t){var n=t.substring(1),r=parseInt(n)/8;this.resize_if_necessary(r);var i=t[0]===`f`?`setFloat${n}`:t[0]===`i`?`setInt${n}`:`setUint${n}`;this.view[i](this.offset,e,!0),this.offset+=r},e.prototype.store_bytes=function(e){this.resize_if_necessary(e.length),new Uint8Array(this.buffer).set(new Uint8Array(e),this.offset),this.offset+=e.length},e}(),ye=function(){function e(e){this.offset=0,this.buffer_size=e.length,this.buffer=new ArrayBuffer(e.length),new Uint8Array(this.buffer).set(e),this.view=new DataView(this.buffer)}return e.prototype.assert_enough_buffer=function(e){if(this.offset+e>this.buffer.byteLength)throw Error(`Error in schema, the buffer is smaller than expected`)},e.prototype.consume_value=function(e){var t=e.substring(1),n=parseInt(t)/8;this.assert_enough_buffer(n);var r=e[0]===`f`?`getFloat${t}`:e[0]===`i`?`getInt${t}`:`getUint${t}`,i=this.view[r](this.offset,!0);return this.offset+=n,i},e.prototype.consume_bytes=function(e){this.assert_enough_buffer(e);var t=this.buffer.slice(this.offset,this.offset+e);return this.offset+=e,t},e}(),be=(function(){var e=function(t,n){return e=Object.setPrototypeOf||{__proto__:[]}instanceof Array&&function(e,t){e.__proto__=t}||function(e,t){for(var n in t)Object.prototype.hasOwnProperty.call(t,n)&&(e[n]=t[n])},e(t,n)};return function(t,n){if(typeof n!=`function`&&n!==null)throw TypeError(`Class extends value `+String(n)+` is not a constructor or null`);e(t,n);function r(){this.constructor=t}t.prototype=n===null?Object.create(n):(r.prototype=n.prototype,new r)}})();function xe(e){return Array.isArray(e)||!!e&&typeof e==`object`&&`length`in e&&typeof e.length==`number`&&(e.length===0||e.length>0&&e.length-1 in e)}function Se(e,t,n){if(typeof e!==t)throw Error(`Expected ${t} not ${typeof e}(${e}) at ${n.join(`.`)}`)}function z(e,t){var n=[`number`,`string`,`bigint`,`boolean`].includes(typeof e),r=typeof e==`object`&&!!e&&`toString`in e;if(!n&&!r)throw Error(`Expected bigint, number, boolean or string not ${typeof e}(${e}) at ${t.join(`.`)}`)}function Ce(e,t,n){if(e!==t)throw Error(`Array length ${e} does not match schema length ${t} at ${n.join(`.`)}`)}function we(e,t){if(typeof e!=`object`||!e)throw Error(`Expected object not ${typeof e}(${e}) at ${t.join(`.`)}`)}R.concat([`bool`,`string`]),function(e){be(t,e);function t(t,n){var r=`Invalid schema: ${JSON.stringify(t)} expected ${n}`;return e.call(this,r)||this}return t}(Error),function(){function e(e){this.encoded=new ve,this.fieldPath=[`value`],this.checkTypes=e}return e.prototype.encode=function(e,t){return this.encode_value(e,t),this.encoded.get_used_buffer()},e.prototype.encode_value=function(e,t){if(typeof t==`string`){if(R.includes(t))return this.encode_integer(e,t);if(t===`string`)return this.encode_string(e);if(t===`bool`)return this.encode_boolean(e)}if(typeof t==`object`){if(`option`in t)return this.encode_option(e,t);if(`enum`in t)return this.encode_enum(e,t);if(`array`in t)return this.encode_array(e,t);if(`set`in t)return this.encode_set(e,t);if(`map`in t)return this.encode_map(e,t);if(`struct`in t)return this.encode_struct(e,t)}},e.prototype.encode_integer=function(e,t){var n=parseInt(t.substring(1));n<=32||t==`f64`?(this.checkTypes&&Se(e,`number`,this.fieldPath),this.encoded.store_value(e,t)):(this.checkTypes&&z(e,this.fieldPath),this.encode_bigint(BigInt(e),n))},e.prototype.encode_bigint=function(e,t){for(var n=t/8,r=new Uint8Array(n),i=0;i<n;i++)r[i]=Number(e&BigInt(255)),e>>=BigInt(8);this.encoded.store_bytes(new Uint8Array(r))},e.prototype.encode_string=function(e){this.checkTypes&&Se(e,`string`,this.fieldPath);for(var t=e,n=[],r=0;r<t.length;r++){var i=t.charCodeAt(r);i<128?n.push(i):i<2048?n.push(192|i>>6,128|i&63):i<55296||i>=57344?n.push(224|i>>12,128|i>>6&63,128|i&63):(r++,i=65536+((i&1023)<<10|t.charCodeAt(r)&1023),n.push(240|i>>18,128|i>>12&63,128|i>>6&63,128|i&63))}this.encoded.store_value(n.length,`u32`),this.encoded.store_bytes(new Uint8Array(n))},e.prototype.encode_boolean=function(e){this.checkTypes&&Se(e,`boolean`,this.fieldPath),this.encoded.store_value(+!!e,`u8`)},e.prototype.encode_option=function(e,t){e==null?this.encoded.store_value(0,`u8`):(this.encoded.store_value(1,`u8`),this.encode_value(e,t.option))},e.prototype.encode_enum=function(e,t){this.checkTypes&&we(e,this.fieldPath);for(var n=Object.keys(e)[0],r=0;r<t.enum.length;r++){var i=t.enum[r];if(n===Object.keys(i.struct)[0])return this.encoded.store_value(r,`u8`),this.encode_struct(e,i)}throw Error(`Enum key (${n}) not found in enum schema: ${JSON.stringify(t)} at ${this.fieldPath.join(`.`)}`)},e.prototype.encode_array=function(e,t){if(xe(e))return this.encode_arraylike(e,t);if(e instanceof ArrayBuffer)return this.encode_buffer(e,t);throw Error(`Expected Array-like not ${typeof e}(${e}) at ${this.fieldPath.join(`.`)}`)},e.prototype.encode_arraylike=function(e,t){t.array.len?Ce(e.length,t.array.len,this.fieldPath):this.encoded.store_value(e.length,`u32`);for(var n=0;n<e.length;n++)this.encode_value(e[n],t.array.type)},e.prototype.encode_buffer=function(e,t){t.array.len?Ce(e.byteLength,t.array.len,this.fieldPath):this.encoded.store_value(e.byteLength,`u32`),this.encoded.store_bytes(new Uint8Array(e))},e.prototype.encode_set=function(e,t){this.checkTypes&&Se(e,`object`,this.fieldPath);var n=e instanceof Set?Array.from(e.values()):Object.values(e);this.encoded.store_value(n.length,`u32`);for(var r=0,i=n;r<i.length;r++){var a=i[r];this.encode_value(a,t.set)}},e.prototype.encode_map=function(e,t){this.checkTypes&&Se(e,`object`,this.fieldPath);var n=e instanceof Map,r=n?Array.from(e.keys()):Object.keys(e);this.encoded.store_value(r.length,`u32`);for(var i=0,a=r;i<a.length;i++){var o=a[i];this.encode_value(o,t.map.key),this.encode_value(n?e.get(o):e[o],t.map.value)}},e.prototype.encode_struct=function(e,t){this.checkTypes&&Se(e,`object`,this.fieldPath);for(var n=0,r=Object.keys(t.struct);n<r.length;n++){var i=r[n];this.fieldPath.push(i),this.encode_value(e[i],t.struct[i]),this.fieldPath.pop()}},e}(),function(){function e(e){this.buffer=new ye(e)}return e.prototype.decode=function(e){return this.decode_value(e)},e.prototype.decode_value=function(e){if(typeof e==`string`){if(R.includes(e))return this.decode_integer(e);if(e===`string`)return this.decode_string();if(e===`bool`)return this.decode_boolean()}if(typeof e==`object`){if(`option`in e)return this.decode_option(e);if(`enum`in e)return this.decode_enum(e);if(`array`in e)return this.decode_array(e);if(`set`in e)return this.decode_set(e);if(`map`in e)return this.decode_map(e);if(`struct`in e)return this.decode_struct(e)}throw Error(`Unsupported type: ${e}`)},e.prototype.decode_integer=function(e){var t=parseInt(e.substring(1));return t<=32||e==`f64`?this.buffer.consume_value(e):this.decode_bigint(t,e.startsWith(`i`))},e.prototype.decode_bigint=function(e,t){t===void 0&&(t=!1);var n=e/8,r=new Uint8Array(this.buffer.consume_bytes(n)),i=r.reduceRight(function(e,t){return e+t.toString(16).padStart(2,`0`)},``);return t&&r[n-1]?BigInt.asIntN(e,BigInt(`0x${i}`)):BigInt(`0x${i}`)},e.prototype.decode_string=function(){for(var e=this.decode_integer(`u32`),t=new Uint8Array(this.buffer.consume_bytes(e)),n=[],r=0;r<e;++r){var i=t[r];if(i<128)n.push(i);else if(i<224)n.push((i&31)<<6|t[++r]&63);else if(i<240)n.push((i&15)<<12|(t[++r]&63)<<6|t[++r]&63);else{var a=(i&7)<<18|(t[++r]&63)<<12|(t[++r]&63)<<6|t[++r]&63;n.push(a)}}return String.fromCodePoint.apply(String,n)},e.prototype.decode_boolean=function(){return this.buffer.consume_value(`u8`)>0},e.prototype.decode_option=function(e){var t=this.buffer.consume_value(`u8`);if(t===1)return this.decode_value(e.option);if(t!==0)throw Error(`Invalid option ${t}`);return null},e.prototype.decode_enum=function(e){var t,n=this.buffer.consume_value(`u8`);if(n>e.enum.length)throw Error(`Enum option ${n} is not available`);var r=e.enum[n].struct,i=Object.keys(r)[0];return t={},t[i]=this.decode_value(r[i]),t},e.prototype.decode_array=function(e){for(var t=[],n=e.array.len?e.array.len:this.decode_integer(`u32`),r=0;r<n;++r)t.push(this.decode_value(e.array.type));return t},e.prototype.decode_set=function(e){for(var t=this.decode_integer(`u32`),n=new Set,r=0;r<t;++r)n.add(this.decode_value(e.set));return n},e.prototype.decode_map=function(e){for(var t=this.decode_integer(`u32`),n=new Map,r=0;r<t;++r){var i=this.decode_value(e.map.key),a=this.decode_value(e.map.value);n.set(i,a)}return n},e.prototype.decode_struct=function(e){var t={};for(var n in e.struct)t[n]=this.decode_value(e.struct[n]);return t},e}(),new Uint8Array([75,69,77,0,16]),new Uint8Array([72,80,75,69,0,16,0,1,0,2]),new Uint8Array([72,80,75,69,45,118,49]),new Uint8Array([115,101,99,114,101,116]),new Uint8Array([101,97,101,95,112,114,107]),new Uint8Array([115,104,97,114,101,100,95,115,101,99,114,101,116]),new Uint8Array([0,32,72,80,75,69,45,118,49,72,80,75,69,0,16,0,1,0,2,107,101,121,0,143,195,174,184,50,73,10,75,90,179,228,32,35,40,125,178,154,31,75,199,194,34,192,223,34,135,39,183,10,64,33,18,47,63,4,233,32,108,209,36,19,80,53,41,180,122,198,166,48,185,46,196,207,125,35,69,8,208,175,151,113,201,158,80]),new Uint8Array([0,12,72,80,75,69,45,118,49,72,80,75,69,0,16,0,1,0,2,98,97,115,101,95,110,111,110,99,101,0,143,195,174,184,50,73,10,75,90,179,228,32,35,40,125,178,154,31,75,199,194,34,192,223,34,135,39,183,10,64,33,18,47,63,4,233,32,108,209,36,19,80,53,41,180,122,198,166,48,185,46,196,207,125,35,69,8,208,175,151,113,201,158,80]),new Uint8Array([113,111,115,95,101,110,99,114,121,112,116,105,111,110,95,104,109,97,99,95,109,101,115,115,97,103,101]);const Te=e=>{let t=a(e);if(t.length<2)throw Error(`failed to convert DER-encoded signature: insufficient length`);if(t[0]!==48)throw Error(`failed to convert DER-encoded signature: invalid format (missing SEQUENCE tag)`);let n=1,r=t[n];if(r<=127){if(t.length<2+r)throw Error(`failed to convert DER-encoded signature: inconsistent message length header`);n+=1}else throw Error(`failed to convert DER-encoded signature: unexpectedly large or invalid signature length`);if(t[n]!==2)throw Error(`failed to convert DER-encoded signature: invalid tag for r`);n++;let i=t[n];if(i>33)throw Error(`failed to convert DER-encoded signature: unexpected length for r`);n++;let s=t.slice(n,n+i);if(n+=i,t[n]!==2)throw Error(`failed to convert DER-encoded signature: invalid tag for s`);n++;let c=t[n];if(c>33)throw Error(`failed to convert DER-encoded signature: unexpected length for s`);n++;let l=t.slice(n,n+c),u=o(s,32),d=o(l,32);return new Uint8Array([...u,...d])};var Ee;(function(e){e.NOTARIZER=`notarizer`,e.SIGNER=`signer`,e.EVM_PARSER=`evm-parser`,e.TLS_FETCHER=`tls-fetcher`,e.UMP=`ump`})(Ee||={});var De=i(((e,t)=>{(function(e,n){var r=2**-24,i=2**32,a=2**53;function o(e){var t=new ArrayBuffer(256),r=new DataView(t),o,s=0;function c(e){for(var n=t.byteLength,i=s+e;n<i;)n*=2;if(n!==t.byteLength){var a=r;t=new ArrayBuffer(n),r=new DataView(t);for(var c=s+3>>2,l=0;l<c;++l)r.setUint32(l*4,a.getUint32(l*4))}return o=e,r}function l(){s+=o}function u(e){l(c(8).setFloat64(s,e))}function d(e){l(c(1).setUint8(s,e))}function f(e){for(var t=c(e.length),n=0;n<e.length;++n)t.setUint8(s+n,e[n]);l()}function p(e){l(c(2).setUint16(s,e))}function m(e){l(c(4).setUint32(s,e))}function h(e){var t=e%i,n=(e-t)/i,r=c(8);r.setUint32(s,n),r.setUint32(s+4,t),l()}function g(e,t){t<24?d(e<<5|t):t<256?(d(e<<5|24),d(t)):t<65536?(d(e<<5|25),p(t)):t<4294967296?(d(e<<5|26),m(t)):(d(e<<5|27),h(t))}function _(e){var t;if(e===!1)return d(244);if(e===!0)return d(245);if(e===null)return d(246);if(e===n)return d(247);switch(typeof e){case`number`:if(Math.floor(e)===e){if(0<=e&&e<=a)return g(0,e);if(-a<=e&&e<0)return g(1,-(e+1))}return d(251),u(e);case`string`:var r=[];for(t=0;t<e.length;++t){var i=e.charCodeAt(t);i<128?r.push(i):i<2048?(r.push(192|i>>6),r.push(128|i&63)):i<55296?(r.push(224|i>>12),r.push(128|i>>6&63),r.push(128|i&63)):(i=(i&1023)<<10,i|=e.charCodeAt(++t)&1023,i+=65536,r.push(240|i>>18),r.push(128|i>>12&63),r.push(128|i>>6&63),r.push(128|i&63))}return g(3,r.length),f(r);default:var o;if(Array.isArray(e))for(o=e.length,g(4,o),t=0;t<o;++t)_(e[t]);else if(e instanceof Uint8Array)g(2,e.length),f(e);else{var s=Object.keys(e);for(o=s.length,g(5,o),t=0;t<o;++t){var c=s[t];_(c),_(e[c])}}}}if(_(e),`slice`in t)return t.slice(0,s);for(var v=new ArrayBuffer(s),y=new DataView(v),b=0;b<s;++b)y.setUint8(b,r.getUint8(b));return v}function s(e,t,a){var o=new DataView(e),s=0;typeof t!=`function`&&(t=function(e){return e}),typeof a!=`function`&&(a=function(){return n});function c(e,t){return s+=t,e}function l(t){return c(new Uint8Array(e,s,t),t)}function u(){var e=new DataView(new ArrayBuffer(4)),t=m(),n=t&32768,i=t&31744,a=t&1023;if(i===31744)i=261120;else if(i!==0)i+=114688;else if(a!==0)return a*r;return e.setUint32(0,n<<16|i<<13|a<<13),e.getFloat32(0)}function d(){return c(o.getFloat32(s),4)}function f(){return c(o.getFloat64(s),8)}function p(){return c(o.getUint8(s),1)}function m(){return c(o.getUint16(s),2)}function h(){return c(o.getUint32(s),4)}function g(){return h()*i+h()}function _(){return o.getUint8(s)===255&&(s+=1,!0)}function v(e){if(e<24)return e;if(e===24)return p();if(e===25)return m();if(e===26)return h();if(e===27)return g();if(e===31)return-1;throw`Invalid length encoding`}function y(e){var t=p();if(t===255)return-1;var n=v(t&31);if(n<0||t>>5!==e)throw`Invalid indefinite length element`;return n}function b(e,t){for(var n=0;n<t;++n){var r=p();r&128&&(r<224?(r=(r&31)<<6|p()&63,--t):r<240?(r=(r&15)<<12|(p()&63)<<6|p()&63,t-=2):(r=(r&15)<<18|(p()&63)<<12|(p()&63)<<6|p()&63,t-=3)),r<65536?e.push(r):(r-=65536,e.push(55296|r>>10),e.push(56320|r&1023))}}function x(){var e=p(),r=e>>5,i=e&31,o,s;if(r===7)switch(i){case 25:return u();case 26:return d();case 27:return f()}if(s=v(i),s<0&&(r<2||6<r))throw`Invalid length`;switch(r){case 0:return s;case 1:return-1-s;case 2:if(s<0){for(var c=[],m=0;(s=y(r))>=0;)m+=s,c.push(l(s));var h=new Uint8Array(m),g=0;for(o=0;o<c.length;++o)h.set(c[o],g),g+=c[o].length;return h}return l(s);case 3:var S=[];if(s<0)for(;(s=y(r))>=0;)b(S,s);else b(S,s);return String.fromCharCode.apply(null,S);case 4:var C;if(s<0)for(C=[];!_();)C.push(x());else for(C=Array(s),o=0;o<s;++o)C[o]=x();return C;case 5:var w={};for(o=0;o<s||s<0&&!_();++o){var T=x();w[T]=x()}return w;case 6:return t(x(),s);case 7:switch(s){case 20:return!1;case 21:return!0;case 22:return null;case 23:return n;default:return a(s)}}}var S=x();if(s!==e.byteLength)throw`Remaining bytes`;return S}var c={encode:o,decode:s};typeof define==`function`&&define.amd?define(`cbor/cbor`,c):t!==void 0&&t.exports?t.exports=c:e.CBOR||=c})(e)})),Oe=i((()=>{
+import{a as e,i as t,n,r,t as i}from"./rolldown-runtime-B0Z9INg1.mjs";import{D as a,E as o,O as s}from"./dist-w03V0QPF.mjs";import{defineCommand as c,renderUsage as l,runMain as u}from"citty";import*as d from"valibot";import{ECDH as f,createECDH as p,createHash as m,createPrivateKey as h,randomBytes as g,sign as _}from"node:crypto";import{execFile as v,spawn as y}from"node:child_process";import{accessSync as b,chmodSync as x,constants as S,existsSync as C,mkdirSync as w,readFileSync as T,realpathSync as E,renameSync as D,rmSync as O,statSync as k,writeFileSync as A}from"node:fs";import{homedir as ee}from"node:os";import{dirname as j,isAbsolute as M,join as te,resolve as ne}from"node:path";import{createServer as re}from"node:http";import{constants as N,isUtf8 as ie}from"node:buffer";import ae from"semver";var P=`@catena/cli`,oe=`0.9.0`;function se(e){return e instanceof Error?e.message:String(e)}function ce(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function le(e){if(!ce(e))return!1;let t=Object.getPrototypeOf(e);return t===Object.prototype||t===null}var F=class{container;constructor(e){this.container=e}};function ue(e,t){let n=Object.getOwnPropertyDescriptor(e,t);return n!==void 0&&n.enumerable===!0&&`value`in n}function de(e){if(Object.getOwnPropertySymbols(e).length>0)return null;let t=Object.getOwnPropertyNames(e);for(let n of t)if(!ue(e,n))return null;return t}function fe(e){if(Object.getPrototypeOf(e)!==Array.prototype||Object.getOwnPropertySymbols(e).length>0)return!1;let t=Object.getOwnPropertyNames(e);if(t.length!==e.length+1)return!1;for(let n=0;n<e.length;n++)if(t[n]!==String(n)||!ue(e,t[n]))return!1;return!0}function pe(e){let t=new Set,n=new Set,r=[e];for(;r.length>0;){let e=r.pop();if(e instanceof F){t.delete(e.container),n.add(e.container);continue}if(e===null||typeof e==`string`||typeof e==`boolean`)continue;if(typeof e==`number`){if(!Number.isFinite(e))return!1;continue}if(Array.isArray(e)){if(t.has(e))return!1;if(n.has(e))continue;if(!fe(e))return!1;t.add(e),r.push(new F(e));for(let t of e)r.push(t);continue}if(!le(e)||Object.hasOwn(e,`__proto__`)||t.has(e))return!1;if(n.has(e))continue;let i=de(e);if(i===null)return!1;t.add(e),r.push(new F(e));for(let t of i)r.push(e[t])}return!0}function me(e){return t=>{try{return e(t)}catch{return!1}}}d.custom(me(pe),`Expected a JSON value`),d.custom(me(e=>le(e)&&pe(e)),`Expected a JSON object`),d.custom(me(e=>Array.isArray(e)&&pe(e)),`Expected a JSON array`);function I(e){return ge(L(e))}function he(e,t){let n=e.padStart(Math.ceil(e.length/2)*2,`0`);return I(a(n,t).reduce((e,t)=>e+String.fromCharCode(t),``))}function ge(e){return e.replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=/g,``)}function L(e){if(arguments.length===0)throw TypeError(`1 argument required, but only 0 present.`);let t;for(e=`${e}`,t=0;t<e.length;t++)if(e.charCodeAt(t)>255)throw Error(`InvalidCharacterError: found code point greater than 255:${e.charCodeAt(t)} at position ${t}`);let n=``;for(t=0;t<e.length;t+=3){let r=[void 0,void 0,void 0,void 0];r[0]=e.charCodeAt(t)>>2,r[1]=(e.charCodeAt(t)&3)<<4,e.length>t+1&&(r[1]|=e.charCodeAt(t+1)>>4,r[2]=(e.charCodeAt(t+1)&15)<<2),e.length>t+2&&(r[2]|=e.charCodeAt(t+2)>>6,r[3]=e.charCodeAt(t+2)&63);for(let e=0;e<r.length;e++)r[e]===void 0?n+=`=`:n+=_e(r[e])}return n}function _e(e){if(e>=0&&e<64)return`ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/`[e]}var R=[`u8`,`u16`,`u32`,`u64`,`u128`,`i8`,`i16`,`i32`,`i64`,`i128`,`f32`,`f64`],ve=function(){function e(){this.offset=0,this.buffer_size=256,this.buffer=new ArrayBuffer(this.buffer_size),this.view=new DataView(this.buffer)}return e.prototype.resize_if_necessary=function(e){if(this.buffer_size-this.offset<e){this.buffer_size=Math.max(this.buffer_size*2,this.buffer_size+e);var t=new ArrayBuffer(this.buffer_size);new Uint8Array(t).set(new Uint8Array(this.buffer)),this.buffer=t,this.view=new DataView(t)}},e.prototype.get_used_buffer=function(){return new Uint8Array(this.buffer).slice(0,this.offset)},e.prototype.store_value=function(e,t){var n=t.substring(1),r=parseInt(n)/8;this.resize_if_necessary(r);var i=t[0]===`f`?`setFloat${n}`:t[0]===`i`?`setInt${n}`:`setUint${n}`;this.view[i](this.offset,e,!0),this.offset+=r},e.prototype.store_bytes=function(e){this.resize_if_necessary(e.length),new Uint8Array(this.buffer).set(new Uint8Array(e),this.offset),this.offset+=e.length},e}(),ye=function(){function e(e){this.offset=0,this.buffer_size=e.length,this.buffer=new ArrayBuffer(e.length),new Uint8Array(this.buffer).set(e),this.view=new DataView(this.buffer)}return e.prototype.assert_enough_buffer=function(e){if(this.offset+e>this.buffer.byteLength)throw Error(`Error in schema, the buffer is smaller than expected`)},e.prototype.consume_value=function(e){var t=e.substring(1),n=parseInt(t)/8;this.assert_enough_buffer(n);var r=e[0]===`f`?`getFloat${t}`:e[0]===`i`?`getInt${t}`:`getUint${t}`,i=this.view[r](this.offset,!0);return this.offset+=n,i},e.prototype.consume_bytes=function(e){this.assert_enough_buffer(e);var t=this.buffer.slice(this.offset,this.offset+e);return this.offset+=e,t},e}(),be=(function(){var e=function(t,n){return e=Object.setPrototypeOf||{__proto__:[]}instanceof Array&&function(e,t){e.__proto__=t}||function(e,t){for(var n in t)Object.prototype.hasOwnProperty.call(t,n)&&(e[n]=t[n])},e(t,n)};return function(t,n){if(typeof n!=`function`&&n!==null)throw TypeError(`Class extends value `+String(n)+` is not a constructor or null`);e(t,n);function r(){this.constructor=t}t.prototype=n===null?Object.create(n):(r.prototype=n.prototype,new r)}})();function xe(e){return Array.isArray(e)||!!e&&typeof e==`object`&&`length`in e&&typeof e.length==`number`&&(e.length===0||e.length>0&&e.length-1 in e)}function Se(e,t,n){if(typeof e!==t)throw Error(`Expected ${t} not ${typeof e}(${e}) at ${n.join(`.`)}`)}function z(e,t){var n=[`number`,`string`,`bigint`,`boolean`].includes(typeof e),r=typeof e==`object`&&!!e&&`toString`in e;if(!n&&!r)throw Error(`Expected bigint, number, boolean or string not ${typeof e}(${e}) at ${t.join(`.`)}`)}function Ce(e,t,n){if(e!==t)throw Error(`Array length ${e} does not match schema length ${t} at ${n.join(`.`)}`)}function we(e,t){if(typeof e!=`object`||!e)throw Error(`Expected object not ${typeof e}(${e}) at ${t.join(`.`)}`)}R.concat([`bool`,`string`]),function(e){be(t,e);function t(t,n){var r=`Invalid schema: ${JSON.stringify(t)} expected ${n}`;return e.call(this,r)||this}return t}(Error),function(){function e(e){this.encoded=new ve,this.fieldPath=[`value`],this.checkTypes=e}return e.prototype.encode=function(e,t){return this.encode_value(e,t),this.encoded.get_used_buffer()},e.prototype.encode_value=function(e,t){if(typeof t==`string`){if(R.includes(t))return this.encode_integer(e,t);if(t===`string`)return this.encode_string(e);if(t===`bool`)return this.encode_boolean(e)}if(typeof t==`object`){if(`option`in t)return this.encode_option(e,t);if(`enum`in t)return this.encode_enum(e,t);if(`array`in t)return this.encode_array(e,t);if(`set`in t)return this.encode_set(e,t);if(`map`in t)return this.encode_map(e,t);if(`struct`in t)return this.encode_struct(e,t)}},e.prototype.encode_integer=function(e,t){var n=parseInt(t.substring(1));n<=32||t==`f64`?(this.checkTypes&&Se(e,`number`,this.fieldPath),this.encoded.store_value(e,t)):(this.checkTypes&&z(e,this.fieldPath),this.encode_bigint(BigInt(e),n))},e.prototype.encode_bigint=function(e,t){for(var n=t/8,r=new Uint8Array(n),i=0;i<n;i++)r[i]=Number(e&BigInt(255)),e>>=BigInt(8);this.encoded.store_bytes(new Uint8Array(r))},e.prototype.encode_string=function(e){this.checkTypes&&Se(e,`string`,this.fieldPath);for(var t=e,n=[],r=0;r<t.length;r++){var i=t.charCodeAt(r);i<128?n.push(i):i<2048?n.push(192|i>>6,128|i&63):i<55296||i>=57344?n.push(224|i>>12,128|i>>6&63,128|i&63):(r++,i=65536+((i&1023)<<10|t.charCodeAt(r)&1023),n.push(240|i>>18,128|i>>12&63,128|i>>6&63,128|i&63))}this.encoded.store_value(n.length,`u32`),this.encoded.store_bytes(new Uint8Array(n))},e.prototype.encode_boolean=function(e){this.checkTypes&&Se(e,`boolean`,this.fieldPath),this.encoded.store_value(+!!e,`u8`)},e.prototype.encode_option=function(e,t){e==null?this.encoded.store_value(0,`u8`):(this.encoded.store_value(1,`u8`),this.encode_value(e,t.option))},e.prototype.encode_enum=function(e,t){this.checkTypes&&we(e,this.fieldPath);for(var n=Object.keys(e)[0],r=0;r<t.enum.length;r++){var i=t.enum[r];if(n===Object.keys(i.struct)[0])return this.encoded.store_value(r,`u8`),this.encode_struct(e,i)}throw Error(`Enum key (${n}) not found in enum schema: ${JSON.stringify(t)} at ${this.fieldPath.join(`.`)}`)},e.prototype.encode_array=function(e,t){if(xe(e))return this.encode_arraylike(e,t);if(e instanceof ArrayBuffer)return this.encode_buffer(e,t);throw Error(`Expected Array-like not ${typeof e}(${e}) at ${this.fieldPath.join(`.`)}`)},e.prototype.encode_arraylike=function(e,t){t.array.len?Ce(e.length,t.array.len,this.fieldPath):this.encoded.store_value(e.length,`u32`);for(var n=0;n<e.length;n++)this.encode_value(e[n],t.array.type)},e.prototype.encode_buffer=function(e,t){t.array.len?Ce(e.byteLength,t.array.len,this.fieldPath):this.encoded.store_value(e.byteLength,`u32`),this.encoded.store_bytes(new Uint8Array(e))},e.prototype.encode_set=function(e,t){this.checkTypes&&Se(e,`object`,this.fieldPath);var n=e instanceof Set?Array.from(e.values()):Object.values(e);this.encoded.store_value(n.length,`u32`);for(var r=0,i=n;r<i.length;r++){var a=i[r];this.encode_value(a,t.set)}},e.prototype.encode_map=function(e,t){this.checkTypes&&Se(e,`object`,this.fieldPath);var n=e instanceof Map,r=n?Array.from(e.keys()):Object.keys(e);this.encoded.store_value(r.length,`u32`);for(var i=0,a=r;i<a.length;i++){var o=a[i];this.encode_value(o,t.map.key),this.encode_value(n?e.get(o):e[o],t.map.value)}},e.prototype.encode_struct=function(e,t){this.checkTypes&&Se(e,`object`,this.fieldPath);for(var n=0,r=Object.keys(t.struct);n<r.length;n++){var i=r[n];this.fieldPath.push(i),this.encode_value(e[i],t.struct[i]),this.fieldPath.pop()}},e}(),function(){function e(e){this.buffer=new ye(e)}return e.prototype.decode=function(e){return this.decode_value(e)},e.prototype.decode_value=function(e){if(typeof e==`string`){if(R.includes(e))return this.decode_integer(e);if(e===`string`)return this.decode_string();if(e===`bool`)return this.decode_boolean()}if(typeof e==`object`){if(`option`in e)return this.decode_option(e);if(`enum`in e)return this.decode_enum(e);if(`array`in e)return this.decode_array(e);if(`set`in e)return this.decode_set(e);if(`map`in e)return this.decode_map(e);if(`struct`in e)return this.decode_struct(e)}throw Error(`Unsupported type: ${e}`)},e.prototype.decode_integer=function(e){var t=parseInt(e.substring(1));return t<=32||e==`f64`?this.buffer.consume_value(e):this.decode_bigint(t,e.startsWith(`i`))},e.prototype.decode_bigint=function(e,t){t===void 0&&(t=!1);var n=e/8,r=new Uint8Array(this.buffer.consume_bytes(n)),i=r.reduceRight(function(e,t){return e+t.toString(16).padStart(2,`0`)},``);return t&&r[n-1]?BigInt.asIntN(e,BigInt(`0x${i}`)):BigInt(`0x${i}`)},e.prototype.decode_string=function(){for(var e=this.decode_integer(`u32`),t=new Uint8Array(this.buffer.consume_bytes(e)),n=[],r=0;r<e;++r){var i=t[r];if(i<128)n.push(i);else if(i<224)n.push((i&31)<<6|t[++r]&63);else if(i<240)n.push((i&15)<<12|(t[++r]&63)<<6|t[++r]&63);else{var a=(i&7)<<18|(t[++r]&63)<<12|(t[++r]&63)<<6|t[++r]&63;n.push(a)}}return String.fromCodePoint.apply(String,n)},e.prototype.decode_boolean=function(){return this.buffer.consume_value(`u8`)>0},e.prototype.decode_option=function(e){var t=this.buffer.consume_value(`u8`);if(t===1)return this.decode_value(e.option);if(t!==0)throw Error(`Invalid option ${t}`);return null},e.prototype.decode_enum=function(e){var t,n=this.buffer.consume_value(`u8`);if(n>e.enum.length)throw Error(`Enum option ${n} is not available`);var r=e.enum[n].struct,i=Object.keys(r)[0];return t={},t[i]=this.decode_value(r[i]),t},e.prototype.decode_array=function(e){for(var t=[],n=e.array.len?e.array.len:this.decode_integer(`u32`),r=0;r<n;++r)t.push(this.decode_value(e.array.type));return t},e.prototype.decode_set=function(e){for(var t=this.decode_integer(`u32`),n=new Set,r=0;r<t;++r)n.add(this.decode_value(e.set));return n},e.prototype.decode_map=function(e){for(var t=this.decode_integer(`u32`),n=new Map,r=0;r<t;++r){var i=this.decode_value(e.map.key),a=this.decode_value(e.map.value);n.set(i,a)}return n},e.prototype.decode_struct=function(e){var t={};for(var n in e.struct)t[n]=this.decode_value(e.struct[n]);return t},e}(),new Uint8Array([75,69,77,0,16]),new Uint8Array([72,80,75,69,0,16,0,1,0,2]),new Uint8Array([72,80,75,69,45,118,49]),new Uint8Array([115,101,99,114,101,116]),new Uint8Array([101,97,101,95,112,114,107]),new Uint8Array([115,104,97,114,101,100,95,115,101,99,114,101,116]),new Uint8Array([0,32,72,80,75,69,45,118,49,72,80,75,69,0,16,0,1,0,2,107,101,121,0,143,195,174,184,50,73,10,75,90,179,228,32,35,40,125,178,154,31,75,199,194,34,192,223,34,135,39,183,10,64,33,18,47,63,4,233,32,108,209,36,19,80,53,41,180,122,198,166,48,185,46,196,207,125,35,69,8,208,175,151,113,201,158,80]),new Uint8Array([0,12,72,80,75,69,45,118,49,72,80,75,69,0,16,0,1,0,2,98,97,115,101,95,110,111,110,99,101,0,143,195,174,184,50,73,10,75,90,179,228,32,35,40,125,178,154,31,75,199,194,34,192,223,34,135,39,183,10,64,33,18,47,63,4,233,32,108,209,36,19,80,53,41,180,122,198,166,48,185,46,196,207,125,35,69,8,208,175,151,113,201,158,80]),new Uint8Array([113,111,115,95,101,110,99,114,121,112,116,105,111,110,95,104,109,97,99,95,109,101,115,115,97,103,101]);const Te=e=>{let t=a(e);if(t.length<2)throw Error(`failed to convert DER-encoded signature: insufficient length`);if(t[0]!==48)throw Error(`failed to convert DER-encoded signature: invalid format (missing SEQUENCE tag)`);let n=1,r=t[n];if(r<=127){if(t.length<2+r)throw Error(`failed to convert DER-encoded signature: inconsistent message length header`);n+=1}else throw Error(`failed to convert DER-encoded signature: unexpectedly large or invalid signature length`);if(t[n]!==2)throw Error(`failed to convert DER-encoded signature: invalid tag for r`);n++;let i=t[n];if(i>33)throw Error(`failed to convert DER-encoded signature: unexpected length for r`);n++;let s=t.slice(n,n+i);if(n+=i,t[n]!==2)throw Error(`failed to convert DER-encoded signature: invalid tag for s`);n++;let c=t[n];if(c>33)throw Error(`failed to convert DER-encoded signature: unexpected length for s`);n++;let l=t.slice(n,n+c),u=o(s,32),d=o(l,32);return new Uint8Array([...u,...d])};var Ee;(function(e){e.NOTARIZER=`notarizer`,e.SIGNER=`signer`,e.EVM_PARSER=`evm-parser`,e.TLS_FETCHER=`tls-fetcher`,e.UMP=`ump`})(Ee||={});var De=i(((e,t)=>{(function(e,n){var r=2**-24,i=2**32,a=2**53;function o(e){var t=new ArrayBuffer(256),r=new DataView(t),o,s=0;function c(e){for(var n=t.byteLength,i=s+e;n<i;)n*=2;if(n!==t.byteLength){var a=r;t=new ArrayBuffer(n),r=new DataView(t);for(var c=s+3>>2,l=0;l<c;++l)r.setUint32(l*4,a.getUint32(l*4))}return o=e,r}function l(){s+=o}function u(e){l(c(8).setFloat64(s,e))}function d(e){l(c(1).setUint8(s,e))}function f(e){for(var t=c(e.length),n=0;n<e.length;++n)t.setUint8(s+n,e[n]);l()}function p(e){l(c(2).setUint16(s,e))}function m(e){l(c(4).setUint32(s,e))}function h(e){var t=e%i,n=(e-t)/i,r=c(8);r.setUint32(s,n),r.setUint32(s+4,t),l()}function g(e,t){t<24?d(e<<5|t):t<256?(d(e<<5|24),d(t)):t<65536?(d(e<<5|25),p(t)):t<4294967296?(d(e<<5|26),m(t)):(d(e<<5|27),h(t))}function _(e){var t;if(e===!1)return d(244);if(e===!0)return d(245);if(e===null)return d(246);if(e===n)return d(247);switch(typeof e){case`number`:if(Math.floor(e)===e){if(0<=e&&e<=a)return g(0,e);if(-a<=e&&e<0)return g(1,-(e+1))}return d(251),u(e);case`string`:var r=[];for(t=0;t<e.length;++t){var i=e.charCodeAt(t);i<128?r.push(i):i<2048?(r.push(192|i>>6),r.push(128|i&63)):i<55296?(r.push(224|i>>12),r.push(128|i>>6&63),r.push(128|i&63)):(i=(i&1023)<<10,i|=e.charCodeAt(++t)&1023,i+=65536,r.push(240|i>>18),r.push(128|i>>12&63),r.push(128|i>>6&63),r.push(128|i&63))}return g(3,r.length),f(r);default:var o;if(Array.isArray(e))for(o=e.length,g(4,o),t=0;t<o;++t)_(e[t]);else if(e instanceof Uint8Array)g(2,e.length),f(e);else{var s=Object.keys(e);for(o=s.length,g(5,o),t=0;t<o;++t){var c=s[t];_(c),_(e[c])}}}}if(_(e),`slice`in t)return t.slice(0,s);for(var v=new ArrayBuffer(s),y=new DataView(v),b=0;b<s;++b)y.setUint8(b,r.getUint8(b));return v}function s(e,t,a){var o=new DataView(e),s=0;typeof t!=`function`&&(t=function(e){return e}),typeof a!=`function`&&(a=function(){return n});function c(e,t){return s+=t,e}function l(t){return c(new Uint8Array(e,s,t),t)}function u(){var e=new DataView(new ArrayBuffer(4)),t=m(),n=t&32768,i=t&31744,a=t&1023;if(i===31744)i=261120;else if(i!==0)i+=114688;else if(a!==0)return a*r;return e.setUint32(0,n<<16|i<<13|a<<13),e.getFloat32(0)}function d(){return c(o.getFloat32(s),4)}function f(){return c(o.getFloat64(s),8)}function p(){return c(o.getUint8(s),1)}function m(){return c(o.getUint16(s),2)}function h(){return c(o.getUint32(s),4)}function g(){return h()*i+h()}function _(){return o.getUint8(s)===255&&(s+=1,!0)}function v(e){if(e<24)return e;if(e===24)return p();if(e===25)return m();if(e===26)return h();if(e===27)return g();if(e===31)return-1;throw`Invalid length encoding`}function y(e){var t=p();if(t===255)return-1;var n=v(t&31);if(n<0||t>>5!==e)throw`Invalid indefinite length element`;return n}function b(e,t){for(var n=0;n<t;++n){var r=p();r&128&&(r<224?(r=(r&31)<<6|p()&63,--t):r<240?(r=(r&15)<<12|(p()&63)<<6|p()&63,t-=2):(r=(r&15)<<18|(p()&63)<<12|(p()&63)<<6|p()&63,t-=3)),r<65536?e.push(r):(r-=65536,e.push(55296|r>>10),e.push(56320|r&1023))}}function x(){var e=p(),r=e>>5,i=e&31,o,s;if(r===7)switch(i){case 25:return u();case 26:return d();case 27:return f()}if(s=v(i),s<0&&(r<2||6<r))throw`Invalid length`;switch(r){case 0:return s;case 1:return-1-s;case 2:if(s<0){for(var c=[],m=0;(s=y(r))>=0;)m+=s,c.push(l(s));var h=new Uint8Array(m),g=0;for(o=0;o<c.length;++o)h.set(c[o],g),g+=c[o].length;return h}return l(s);case 3:var S=[];if(s<0)for(;(s=y(r))>=0;)b(S,s);else b(S,s);return String.fromCharCode.apply(null,S);case 4:var C;if(s<0)for(C=[];!_();)C.push(x());else for(C=Array(s),o=0;o<s;++o)C[o]=x();return C;case 5:var w={};for(o=0;o<s||s<0&&!_();++o){var T=x();w[T]=x()}return w;case 6:return t(x(),s);case 7:switch(s){case 20:return!1;case 21:return!0;case 22:return null;case 23:return n;default:return a(s)}}}var S=x();if(s!==e.byteLength)throw`Remaining bytes`;return S}var c={encode:o,decode:s};typeof define==`function`&&define.amd?define(`cbor/cbor`,c):t!==void 0&&t.exports?t.exports=c:e.CBOR||=c})(e)})),Oe=i((()=>{
 /*! *****************************************************************************
 Copyright (C) Microsoft. All rights reserved.
 Licensed under the Apache License, Version 2.0 (the "License"); you may not use
@@ -135,87 +135,138 @@ Oe();var n=q(),r=Y(),i=st(),a=_r(),o=wr(),s=Pr(),c=(K(),t(B)),l=zi(),u=ra(),d=sa
 `);case`asn`:return n.AsnConvert.toString(t);case`hex`:return i.Convert.ToHex(t);case`base64`:return i.Convert.ToBase64(t);case`base64url`:return i.Convert.ToBase64Url(t);case`text`:return ve.serialize(this.toTextObject());default:throw TypeError(`Argument 'format' is unsupported value`)}}toTextObject(){let e=n.AsnConvert.parse(this.export(`raw`),m.ContentInfo),t=n.AsnConvert.parse(e.content,m.SignedData);return new L(`X509Certificates`,{"Content Type":R.toString(e.contentType),Content:new L(``,{Version:`${m.CMSVersion[t.version]} (${t.version})`,Certificates:new L(``,{Certificate:this.map(e=>e.toTextObject())})})})}},_t=class{constructor(e={}){this.certificates=[],e.certificates&&(this.certificates=e.certificates)}async build(e,t=z.get()){let n=new gt(e),r=e;for(;r=await this.findIssuer(r,t);){let e=await r.getThumbprint(t);for(let r of n){let n=await r.getThumbprint(t);if(i.isEqual(e,n))throw Error(`Cannot build a certificate chain. Circular dependency.`)}n.push(r)}return n}async findIssuer(e,t=z.get()){if(!await e.isSelfSigned(t)){let r=e.getExtension(p.id_ce_authorityKeyIdentifier);for(let a of this.certificates)if(a.subject===e.issuer){if(r){if(r.keyId){let e=a.getExtension(p.id_ce_subjectKeyIdentifier);if(e&&e.keyId!==r.keyId)continue}else if(r.certId){let e=a.getExtension(p.id_ce_subjectAltName);if(e&&!(r.certId.serialNumber===a.serialNumber&&i.isEqual(n.AsnConvert.serialize(r.certId.name),n.AsnConvert.serialize(e))))continue}}try{let n={...a.publicKey.algorithm,...e.signatureAlgorithm},r=await a.publicKey.export(n,[`verify`],t);if(!await e.verify({publicKey:r,signatureOnly:!0},t))continue}catch{continue}return a}}return null}},vt=class{static async createSelfSigned(e,t=z.get()){if(!e.keys.privateKey)throw Error(`Bad field 'keys' in 'params' argument. 'privateKey' is empty`);if(!e.keys.publicKey)throw Error(`Bad field 'keys' in 'params' argument. 'publicKey' is empty`);return this.create({serialNumber:e.serialNumber,subject:e.name,issuer:e.name,notBefore:e.notBefore,notAfter:e.notAfter,publicKey:e.keys.publicKey,signingKey:e.keys.privateKey,signingAlgorithm:e.signingAlgorithm,extensions:e.extensions},t)}static async create(e,t=z.get()){let r;r=e.publicKey instanceof Ve?e.publicKey.rawData:`publicKey`in e.publicKey?e.publicKey.publicKey.rawData:i.BufferSourceConverter.isBufferSource(e.publicKey)?e.publicKey:await t.subtle.exportKey(`spki`,e.publicKey);let a=e.serialNumber?i.BufferSourceConverter.toUint8Array(i.Convert.FromHex(e.serialNumber)):t.getRandomValues(new Uint8Array(16));a[0]>127&&(a[0]&=127),a.length>1&&a[0]===0&&(a[1]|=128);let o=e.notBefore||new Date,s=e.notAfter||new Date(o.getTime()+31536e6),c=new p.Certificate({tbsCertificate:new p.TBSCertificate({version:p.Version.v3,serialNumber:a,validity:new p.Validity({notBefore:o,notAfter:s}),extensions:new p.Extensions(e.extensions?.map(e=>n.AsnConvert.parse(e.rawData,p.Extension))||[]),subjectPublicKeyInfo:n.AsnConvert.parse(r,p.SubjectPublicKeyInfo)})});if(e.subject){let t=e.subject instanceof V?e.subject:new V(e.subject);c.tbsCertificate.subject=n.AsnConvert.parse(t.toArrayBuffer(),p.Name)}if(e.issuer){let t=e.issuer instanceof V?e.issuer:new V(e.issuer);c.tbsCertificate.issuer=n.AsnConvert.parse(t.toArrayBuffer(),p.Name)}let u={hash:`SHA-256`},d=`signingKey`in e?{...u,...e.signingAlgorithm,...e.signingKey.algorithm}:{...u,...e.signingAlgorithm},f=l.container.resolve(b);c.tbsCertificate.signature=c.signatureAlgorithm=f.toAsnAlgorithm(d);let m=n.AsnConvert.serialize(c.tbsCertificate),h=`signingKey`in e?await t.subtle.sign(d,e.signingKey,m):e.signature,g=l.container.resolveAll(it).reverse(),_=null;for(let e of g)if(_=e.toAsnSignature(d,h),_)break;if(!_)throw Error(`Cannot convert ASN.1 signature value to WebCrypto format`);return c.signatureValue=_,new ht(n.AsnConvert.serialize(c))}};e.X509CrlReason=void 0,(function(e){e[e.unspecified=0]=`unspecified`,e[e.keyCompromise=1]=`keyCompromise`,e[e.cACompromise=2]=`cACompromise`,e[e.affiliationChanged=3]=`affiliationChanged`,e[e.superseded=4]=`superseded`,e[e.cessationOfOperation=5]=`cessationOfOperation`,e[e.certificateHold=6]=`certificateHold`,e[e.removeFromCRL=8]=`removeFromCRL`,e[e.privilegeWithdrawn=9]=`privilegeWithdrawn`,e[e.aACompromise=10]=`aACompromise`})(e.X509CrlReason||={});var yt=class extends ye{constructor(...e){let t;t=i.BufferSourceConverter.isBufferSource(e[0])?i.BufferSourceConverter.toArrayBuffer(e[0]):n.AsnConvert.serialize(new r.RevokedCertificate({userCertificate:e[0],revocationDate:new r.Time(e[1]),crlEntryExtensions:e[2]})),super(t,r.RevokedCertificate)}onInit(e){this.serialNumber=i.Convert.ToHex(e.userCertificate),this.revocationDate=e.revocationDate.getTime(),this.extensions=[],e.crlEntryExtensions&&(this.extensions=e.crlEntryExtensions.map(e=>{let t=G.create(n.AsnConvert.serialize(e));switch(t.type){case r.id_ce_cRLReasons:this.reason=n.AsnConvert.parse(t.value,r.CRLReason).reason;break;case r.id_ce_invalidityDate:this.invalidity=n.AsnConvert.parse(t.value,r.InvalidityDate).value}return t}))}},bt=class extends W{constructor(e){W.isAsnEncoded(e)?super(e,r.CertificateList):super(e),this.tag=U.CrlTag}onInit(e){let t=e.tbsCertList;this.tbs=n.AsnConvert.serialize(t),this.version=t.version;let r=l.container.resolve(b);this.signatureAlgorithm=r.toWebAlgorithm(e.signatureAlgorithm),this.tbsCertListSignatureAlgorithm=t.signature,this.certListSignatureAlgorithm=e.signatureAlgorithm,this.signature=e.signature,this.issuerName=new V(t.issuer),this.issuer=this.issuerName.toString();let i=t.thisUpdate.getTime();if(!i)throw Error(`Cannot get 'thisUpdate' value`);this.thisUpdate=i;let a=t.nextUpdate?.getTime();this.nextUpdate=a,this.entries=t.revokedCertificates?.map(e=>new yt(n.AsnConvert.serialize(e)))||[],this.extensions=[],t.crlExtensions&&(this.extensions=t.crlExtensions.map(e=>G.create(n.AsnConvert.serialize(e))))}getExtension(e){for(let t of this.extensions)if(typeof e==`string`){if(t.type===e)return t}else if(t instanceof e)return t;return null}getExtensions(e){return this.extensions.filter(t=>typeof e==`string`?t.type===e:t instanceof e)}async verify(e,t=z.get()){if(!this.certListSignatureAlgorithm.isEqual(this.tbsCertListSignatureAlgorithm))throw Error(`algorithm identifier in the sequence tbsCertList and CertificateList mismatch`);let n,r,i=e.publicKey;try{i instanceof ht?(n={...i.publicKey.algorithm,...i.signatureAlgorithm},r=await i.publicKey.export(n,[`verify`])):i instanceof Ve?(n={...i.algorithm,...this.signature},r=await i.export(n,[`verify`])):(n={...i.algorithm,...this.signature},r=i)}catch{return!1}let a=l.container.resolveAll(it).reverse(),o=null;for(let e of a)if(o=e.toWebSignature(n,this.signature),o)break;if(!o)throw Error(`Cannot convert ASN.1 signature value to WebCrypto format`);return await t.subtle.verify(this.signatureAlgorithm,r,o,this.tbs)}async getThumbprint(...e){let t,n=`SHA-1`;return e[0]&&(e[0].subtle?t=e[0]:(n=e[0]||n,t=e[1])),t??=z.get(),await t.subtle.digest(n,this.rawData)}findRevoked(e){let t=typeof e==`string`?e:e.serialNumber;for(let e of this.entries)if(e.serialNumber===t)return e;return null}},xt=class{static async create(e,t=z.get()){let a=e.issuer instanceof V?e.issuer:new V(e.issuer),o=new p.CertificateList({tbsCertList:new p.TBSCertList({version:p.Version.v2,issuer:n.AsnConvert.parse(a.toArrayBuffer(),p.Name),thisUpdate:new r.Time(e.thisUpdate||new Date)})});if(e.nextUpdate&&(o.tbsCertList.nextUpdate=new r.Time(e.nextUpdate)),e.extensions&&e.extensions.length&&(o.tbsCertList.crlExtensions=new p.Extensions(e.extensions.map(e=>n.AsnConvert.parse(e.rawData,p.Extension))||[])),e.entries&&e.entries.length){o.tbsCertList.revokedCertificates=[];for(let t of e.entries){let a=W.toArrayBuffer(t.serialNumber);if(o.tbsCertList.revokedCertificates.findIndex(e=>i.isEqual(e.userCertificate,a))>-1)throw Error(`Certificate serial number ${t.serialNumber} already exists in tbsCertList`);let s=new r.RevokedCertificate({userCertificate:a,revocationDate:new r.Time(t.revocationDate||new Date)});if(s.crlEntryExtensions=`extensions`in t&&t.extensions?.length?t.extensions.map(e=>n.AsnConvert.parse(e.rawData,p.Extension)):[],!(t instanceof yt)&&(t.reason&&s.crlEntryExtensions.push(new p.Extension({extnID:p.id_ce_cRLReasons,critical:!1,extnValue:new n.OctetString(n.AsnConvert.serialize(new p.CRLReason(t.reason)))})),t.invalidity&&s.crlEntryExtensions.push(new p.Extension({extnID:p.id_ce_invalidityDate,critical:!1,extnValue:new n.OctetString(n.AsnConvert.serialize(new p.InvalidityDate(t.invalidity)))})),t.issuer)){let t=e.issuer instanceof V?e.issuer:new V(e.issuer);s.crlEntryExtensions.push(new p.Extension({extnID:p.id_ce_certificateIssuer,critical:!1,extnValue:new n.OctetString(n.AsnConvert.serialize(n.AsnConvert.parse(t.toArrayBuffer(),p.Name)))}))}o.tbsCertList.revokedCertificates.push(s)}}let s={...e.signingAlgorithm,...e.signingKey.algorithm},c=l.container.resolve(b);o.tbsCertList.signature=o.signatureAlgorithm=c.toAsnAlgorithm(s);let u=n.AsnConvert.serialize(o.tbsCertList),d=await t.subtle.sign(s,e.signingKey,u),f=l.container.resolveAll(it).reverse(),m=null;for(let e of f)if(m=e.toAsnSignature(s,d),m)break;if(!m)throw Error(`Cannot convert ASN.1 signature value to WebCrypto format`);return o.signature=m,new bt(n.AsnConvert.serialize(o))}};G.register(p.id_ce_basicConstraints,We),G.register(p.id_ce_extKeyUsage,Ge),G.register(p.id_ce_keyUsage,Ke),G.register(p.id_ce_subjectKeyIdentifier,qe),G.register(p.id_ce_authorityKeyIdentifier,Ue),G.register(p.id_ce_subjectAltName,Je),G.register(p.id_ce_cRLDistributionPoints,Xe),G.register(p.id_pe_authorityInfoAccess,Ze),rt.register(_.id_pkcs9_at_challengePassword,tt),rt.register(_.id_pkcs9_at_extensionRequest,nt),l.container.registerSingleton(it,at),l.container.registerSingleton(it,ct),ct.namedCurveSize.set(`P-256`,32),ct.namedCurveSize.set(`K-256`,32),ct.namedCurveSize.set(`P-384`,48),ct.namedCurveSize.set(`P-521`,66),e.AlgorithmProvider=y,e.AsnData=ye,e.AsnDefaultSignatureFormatter=at,e.AsnEcSignatureFormatter=ct,e.Attribute=et,e.AttributeFactory=rt,e.AuthorityInfoAccessExtension=Ze,e.AuthorityKeyIdentifierExtension=Ue,e.BasicConstraintsExtension=We,e.CRLDistributionPointsExtension=Xe,e.CertificatePolicyExtension=Ye,e.ChallengePasswordAttribute=tt,e.CryptoProvider=Se,e.DefaultAlgorithmSerializer=_e,e.ExtendedKeyUsageExtension=Ge,e.Extension=be,e.ExtensionFactory=G,e.ExtensionsAttribute=nt,e.GeneralName=Re,e.GeneralNames=ze,e.KeyUsagesExtension=Ke,e.Name=V,e.NameIdentifier=Te,e.OidSerializer=R,e.PemConverter=U,e.Pkcs10CertificateRequest=pt,e.Pkcs10CertificateRequestGenerator=mt,e.PublicKey=Ve,e.SubjectAlternativeNameExtension=Je,e.SubjectKeyIdentifierExtension=qe,e.TextConverter=ve,e.TextObject=L,e.X509Certificate=ht,e.X509CertificateGenerator=vt,e.X509Certificates=gt,e.X509ChainBuilder=_t,e.X509Crl=bt,e.X509CrlEntry=yt,e.X509CrlGenerator=xt,e.cryptoProvider=z,e.diAlgorithm=v,e.diAlgorithmProvider=b,e.diAsnSignatureFormatter=it,e.idEd25519=dt,e.idEd448=ft,e.idX25519=lt,e.idX448=ut}));De(),ca();var la;(function(e){e.Der=`der`,e.Raw=`raw`})(la||={});const ua=typeof window<`u`&&window.document!==void 0&&typeof crypto<`u`&&crypto.subtle!==void 0,da=typeof process<`u`&&process.versions!=null&&process.versions.node!=null,fa=()=>ua?`browser`:da?`node`:`purejs`,pa=async(e,t)=>{let n=t??fa();switch(n){case`browser`:return(await import(`./webcrypto-BeKbrVgs.mjs`)).signWithApiKey(e);case`node`:return(await import(`./nodecrypto-BSdTIm8T.mjs`)).signWithApiKey(e);case`purejs`:return(await import(`./purejs-xzcexc4T.mjs`)).signWithApiKey(e);default:throw Error(`Unsupported runtime: ${n}`)}};var ma=class{constructor(e){this.apiPublicKey=e.apiPublicKey,this.apiPrivateKey=e.apiPrivateKey,this.runtimeOverride=e.runtimeOverride}async stamp(e){let t=await pa({publicKey:this.apiPublicKey,privateKey:this.apiPrivateKey,content:e},this.runtimeOverride),n={publicKey:this.apiPublicKey,scheme:`SIGNATURE_SCHEME_TK_API_P256`,signature:t};return{stampHeaderName:`X-Stamp`,stampHeaderValue:I(JSON.stringify(n))}}async sign(e,t){switch(t){case la.Raw:{let t=await pa({publicKey:this.apiPublicKey,privateKey:this.apiPrivateKey,content:e},this.runtimeOverride),n=Te(t);return s(n)}case la.Der:return pa({publicKey:this.apiPublicKey,privateKey:this.apiPrivateKey,content:e},this.runtimeOverride);default:throw Error(`Unsupported signature format: ${t}`)}}},ha=class extends Error{constructor(e){super(e),this.name=`InvalidKeyError`}};function ga(){let e=p(`prime256v1`);return e.generateKeys(),va(e.getPrivateKey().toString(`hex`).padStart(64,`0`))}const _a=/^[0-9a-f]{64}$/i;function va(e){if(!_a.test(e))throw new ha(`P-256 private key must be 64 hex characters`);let t=e.toLowerCase(),n=p(`prime256v1`);try{n.setPrivateKey(Buffer.from(t,`hex`))}catch{throw new ha(`value is not a valid P-256 private key (scalar out of range)`)}return{algorithm:`p256`,privateKeyHex:t,publicKeyHex:n.getPublicKey(`hex`,`compressed`)}}function ya(e){try{let t=f.convertKey(e,`prime256v1`,`hex`,`hex`,`uncompressed`),n=Buffer.isBuffer(t)?t:Buffer.from(t,`hex`);return n.length===65?n:null}catch{return null}}function ba(e){let t=ya(e);if(t===null)throw new ha(`value is not a valid P-256 public key`);return xa(t)}function xa(e){let t=e.subarray(1,33).toString(`base64url`),n=e.subarray(33,65).toString(`base64url`);return m(`sha256`).update(`{"crv":"P-256","kty":"EC","x":"${t}","y":"${n}"}`,`utf8`).digest(`base64url`)}const Sa=/^https?:\/\/[\x21\x23-\x7e]{1,255}$/,Ca=/^[\x21\x23-\x3a\x3c-\x7e]{1,128}$/;function wa(e,t){return`${e.replace(/\/+$/,``)}/agent-keys/${t}`}function Ta(e){let t=Ea(e.keypair),n={...t,identityUrl:Da(e.identityUrl??wa(e.baseUrl,t.keyId))};return{sign:async e=>{let t=new Uint8Array(await e.clone().arrayBuffer()),r=Oa(n,{method:e.method,url:e.url,body:t},{nonce:g(16).toString(`base64url`),createdAt:new Date}),i=new Headers(e.headers);for(let[e,t]of Object.entries(r))i.set(e,t);return new Request(e,{headers:i})}}}function Ea(e){let t=ya(e.publicKeyHex);if(t===null)throw Error(`signer keypair has an invalid P-256 public key`);return{signingKey:Ma(t,e.privateKeyHex),keyId:xa(t)}}function Da(e){if(!Sa.test(e))throw Error(`identity URL is outside the signature profile: "${e}"`);return e}function Oa(e,t,n){if(!Ca.test(n.nonce))throw Error(`nonce is outside the signature profile`);let r=ka(t.body),i=`"${e.identityUrl}"`,a=`("@method" "@target-uri" "content-digest" "signature-agent");created=${Math.floor(n.createdAt.getTime()/1e3)};keyid="${e.keyId}";nonce="${n.nonce}";alg="ecdsa-p256-sha256"`,o=[`"@method": ${t.method.toUpperCase()}`,`"@target-uri": ${Aa(new URL(t.url))}`,`"content-digest": ${r}`,`"signature-agent": ${i}`,`"@signature-params": ${a}`].join(`
 `),s=_(`sha256`,Buffer.from(o,`utf8`),{key:e.signingKey,dsaEncoding:`ieee-p1363`});return{"Content-Digest":r,"Signature-Agent":i,"Signature-Input":`sig=${a}`,Signature:`sig=:${s.toString(`base64`)}:`}}function ka(e){return`sha-256=:${m(`sha256`).update(e??``).digest(`base64`)}:`}function Aa(e){return`${e.protocol}//${ja(e)}${e.pathname}${e.search}`}function ja(e){let t=e.host.toLowerCase();return e.protocol===`https:`&&e.port===`443`||e.protocol===`http:`&&e.port===`80`?e.hostname.toLowerCase():t}function Ma(e,t){return h({key:{kty:`EC`,crv:`P-256`,d:Buffer.from(t,`hex`).toString(`base64url`),x:e.subarray(1,33).toString(`base64url`),y:e.subarray(33,65).toString(`base64url`)},format:`jwk`})}var Na=`0.1.0`;const Pa=/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/,Fa=Na;function Ia(e,t){if(!Pa.test(e))throw Error(`${t} must be a valid HTTP token`)}function La(e,t){let n=!1;for(let t=0;t<e.length;t+=1){let r=e.charCodeAt(t);if(r<32||r===127||r>255){n=!0;break}}if(n||/[()\\]/.test(e))throw Error(`${t} must not contain parentheses, backslashes, control characters, or characters outside Latin-1`)}function Ra(e){let t=`catena-agent-client/${Fa}`;if(!e)return t;Ia(e.name,`appInfo.name`),e.version!==void 0&&Ia(e.version,`appInfo.version`),e.url!==void 0&&La(e.url,`appInfo.url`);let n=e.version===void 0?e.name:`${e.name}/${e.version}`;return`${e.url===void 0?n:`${n} (${e.url})`} ${t}`}const za=d.object({paymentCredential:d.object({protocol:d.picklist([`mpp`,`x402`]),value:d.string()})});function Ba(e,t){let n=d.safeParse(za,e);return n.success&&n.output.paymentCredential.protocol===t?n.output.paymentCredential.value:void 0}const Va=`offer-receipt`,Ha=8192,Ua=d.pipe(d.string(),d.maxLength(Ha),d.regex(/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/,`Expected a JWS compact serialization`)),Wa=d.optional(d.pipe(d.number(),d.integer(),d.minValue(0))),Ga=d.pipe(d.string(),d.regex(/^0x[0-9a-fA-F]{130}$/,`Expected a 65-byte hex signature`)),Ka=d.variant(`format`,[d.looseObject({format:d.literal(`eip712`),acceptIndex:Wa,payload:d.record(d.string(),d.unknown()),signature:Ga}),d.looseObject({format:d.literal(`jws`),acceptIndex:Wa,signature:Ua})]),qa=d.variant(`format`,[d.looseObject({format:d.literal(`eip712`),payload:d.record(d.string(),d.unknown()),signature:Ga}),d.looseObject({format:d.literal(`jws`),signature:Ua})]),Ja=d.object({[Va]:d.object({info:d.object({offers:d.array(d.unknown())})})}),Ya=d.object({[Va]:d.object({info:d.object({receipt:d.unknown()})})}),Xa=d.looseObject({version:d.literal(1),resourceUrl:d.pipe(d.string(),d.maxLength(2048)),scheme:d.pipe(d.string(),d.maxLength(64)),network:d.pipe(d.string(),d.maxLength(64)),asset:d.pipe(d.string(),d.maxLength(128)),payTo:d.pipe(d.string(),d.maxLength(128)),amount:d.pipe(d.string(),d.regex(/^\d+$/),d.maxLength(78)),validUntil:d.optional(d.pipe(d.number(),d.integer(),d.minValue(0)))});function Za(e){let t=e.replaceAll(`-`,`+`).replaceAll(`_`,`/`),n=Uint8Array.from(atob(t),e=>e.charCodeAt(0));return JSON.parse(new TextDecoder().decode(n))}function Qa(e){if(e.format===`eip712`){let t=d.safeParse(Xa,e.payload);return t.success?t.output:void 0}let t=e.signature.split(`.`)[1];try{let e=d.safeParse(Xa,Za(t));return e.success?e.output:void 0}catch{return}}function $a(e,t){return e.toLowerCase()===t.toLowerCase()}function eo(e,t){return e.scheme===t.scheme&&e.network===t.network&&$a(e.asset,t.asset)&&$a(e.payTo,t.payTo)&&e.amount===t.amount}function to(e){return new TextEncoder().encode(JSON.stringify(e)).length<=Ha}function no(e,t){let n=d.safeParse(Ja,e);if(n.success)for(let e of n.output[Va].info.offers){let n=d.safeParse(Ka,e);if(!n.success)continue;let r=Qa(n.output);if(r!==void 0&&eo(r,t)&&to(n.output))return n.output}}function ro(e){let t=d.safeParse(Ya,e);if(!t.success)return;let n=d.safeParse(qa,t.output[Va].info.receipt);if(n.success&&to(n.output))return n.output}const io=d.pipe(d.string(),d.regex(/\S/,`Response enum values must not be blank`));function ao(e){return io}const oo=d.object({amount:d.string(),asset_id:d.string()}),so=d.pipe(d.string(),d.isoTimestamp()),co=d.object({success:d.literal(!0)}),lo=d.object({id:d.string(),name:d.string(),status:d.string(),organizationId:d.string()}),uo=d.object({agent:lo}),fo=[`per_transaction_amount`,`daily_amount`,`weekly_amount`,`monthly_amount`,`hourly_count`,`daily_count`],po=d.object({id:d.string(),ruleType:ao(fo),thresholdAmount:d.optional(oo),thresholdCount:d.optional(d.number()),action:ao([`block`,`require_approval`]),requiredApprovals:d.number(),accountAggregationScope:ao([`per_account`,`across_accounts`]),actorAggregationScope:ao([`per_agent`,`per_policy`]),displayOrder:d.number()}),mo=d.object({id:d.string(),organizationId:d.string(),policyId:d.string(),capability:ao([`query_balance`,`read`,`send`,`transfer`]),accountId:d.string(),rules:d.array(po),createdAt:so,updatedAt:so}),ho=[`allow`,`block`,`require_approval`],go=[`open`,`restricted`],_o=ao(ho),vo=d.object({mode:ao(go),allowedCounterparties:d.optional(d.array(d.string())),createAction:d.optional(_o),requestPaymentDetailsAction:d.optional(_o),allowCreate:d.optional(d.boolean())}),yo=d.object({id:d.optional(d.string()),description:d.optional(d.string()),version:d.optional(d.number()),name:d.string(),capabilities:d.array(d.string()),counterpartyRules:d.optional(vo),policyCapabilities:d.array(mo),kind:d.optional(d.picklist([`base`,`override`])),expiresAt:d.optional(d.string())}),bo=d.object({policy:yo}),xo=d.object({accounts:d.array(d.object({id:d.string(),name:d.string(),type:d.string(),currency:d.string()}))}),So=d.object({accountId:d.string(),balance:oo,balances:d.optional(d.object({total:oo,available:oo}))}),Co=[`operator-send`,`operator-transfer`,`operator-deposit`,`operator-refund`,`microdeposit`],wo=[`pending`,`processing`,`completed`,`failed`,`reversed`],To=[`initiated`,`provider_pending`,`processing`,`completed`,`failed`,`reversed`,`manual_review`],Eo=[`ach`,`wire`,`on-chain`],Do=d.object({id:d.string(),type:ao(Co),action:d.optional(d.string()),status:ao(wo),movementStatus:ao(To),direction:d.picklist([`incoming`,`outgoing`]),amount:oo,fee:oo,currency:d.string(),counterpartyName:d.optional(d.string()),method:d.optional(ao([`ach`,`wire`,`on-chain`])),memo:d.optional(d.string()),description:d.optional(d.string()),txHash:d.optional(d.string()),createdAt:so,completedAt:d.optional(so)}),Oo=d.object({accountId:d.string(),transactions:d.array(Do),total:d.number()}),ko=d.object({accountId:d.string(),address:d.string(),liquidationAddressId:d.optional(d.string()),source:ao([`wallet`,`liquidation`])}),Ao=d.object({id:d.string(),name:d.string(),status:d.optional(d.string()),rails:d.array(d.object({id:d.string(),type:d.string(),walletAddress:d.optional(d.string()),network:d.optional(d.string()),bankName:d.optional(d.string()),accountNumber:d.optional(d.string())}))}),jo=d.object({counterparties:d.array(Ao)}),Mo=d.picklist([`pending`,`processing`,`completed`,`blocked`,`failed`]),No=d.object({type:d.literal(`submit_stamp`),signingRequestId:d.string(),signer:d.object({algorithm:d.literal(`p256`),publicKeyHex:d.string()}),preparedBody:d.object({body:d.string(),bodyHash:d.string(),expiresAt:so,prepareToken:d.string()})}),Po=d.object({id:d.string(),accountId:d.optional(d.string()),type:ao([`send`,`transfer`,`create_counterparty`,`request_counterparty_details`,`x402`,`mpp`,`policy_override`]),status:Mo,reasons:d.array(d.string()),expiresAt:d.optional(d.nullable(so),null),replayed:d.optional(d.boolean(),!1),data:d.optional(d.nullable(d.record(d.string(),d.unknown())),null),metadata:d.optional(d.object({dataUrl:d.nullable(d.string())})),nextAction:d.optional(No)});function Fo(e){let{nextAction:t,...n}=e;return n}const Io=d.object({x402:d.object({paymentSignature:d.string()})});function Lo(e){let t=Ba(e,`x402`);if(t!==void 0)return t;let n=d.safeParse(Io,e);return n.success?n.output.x402.paymentSignature:void 0}const Ro=d.picklist(Eo),zo=d.object({type:d.literal(`send`),accountId:d.optional(d.pipe(d.string(),d.minLength(1))),counterpartyRailId:d.string(),amount:d.string(),method:Ro,memo:d.optional(d.string()),description:d.optional(d.string())}),Bo=d.object({type:d.literal(`transfer`),accountId:d.string(),toAccountId:d.string(),amount:d.string(),memo:d.optional(d.string()),description:d.optional(d.string())}),Vo={type:d.literal(`create_counterparty`),name:d.string()},Ho=d.union([d.object({...Vo,email:d.optional(d.string()),rail:d.nonOptional(d.unknown())}),d.object({...Vo,email:d.string()})]),Uo=d.object({type:d.literal(`request_counterparty_details`),counterpartyId:d.string(),methods:d.pipe(d.object({bank:d.boolean(),wallet:d.boolean()}),d.check(({bank:e,wallet:t})=>e||t,`Select at least one payment method to request`))}),Wo=d.looseObject({scheme:d.string(),network:d.string(),asset:d.string(),amount:d.string(),payTo:d.string(),maxTimeoutSeconds:d.number()}),Go=d.looseObject({url:d.string(),serviceName:d.fallback(d.optional(d.pipe(d.string(),d.maxLength(255))),void 0)}),Ko=d.pipe(d.string(),d.regex(/^0x[0-9a-fA-F]{40}$/,`Expected a 20-byte hex address`)),qo=d.pipe(d.string(),d.maxLength(78),d.regex(/^(0|[1-9]\d*)$/,`Expected a canonical decimal integer string`)),Jo=d.object({from:Ko,to:Ko,value:qo,validAfter:qo,validBefore:qo,nonce:d.pipe(d.string(),d.regex(/^0x[0-9a-fA-F]{64}$/,`Expected a 32-byte hex nonce`))}),Yo=d.object({type:d.literal(`x402`),accountId:d.string(),paymentRequirements:Wo,resource:d.optional(Go),authorization:d.optional(Jo),signedOffer:d.optional(Ka)}),Xo=d.object({id:d.string(),realm:d.string(),method:d.picklist([`evm`,`usdc`]),intent:d.literal(`charge`),request:d.string(),description:d.optional(d.string()),digest:d.optional(d.string()),expires:d.string(),header:d.optional(d.literal(`Payment-Authorization`)),opaque:d.optional(d.string())}),Zo=d.object({url:d.string(),serviceName:d.optional(d.string())}),Qo=d.object({type:d.literal(`mpp`),accountId:d.string(),challenge:Xo,resource:d.optional(Zo)}),$o=[`send`,`transfer`],es=d.strictObject({type:d.literal(`increase_limit`),accountId:d.pipe(d.string(),d.minLength(1)),capability:d.picklist($o),limitType:d.picklist([`per_transaction_amount`,`daily_amount`,`weekly_amount`,`monthly_amount`]),newLimit:d.strictObject({amount:d.pipe(d.string(),d.regex(/^\d+(\.\d{1,6})?$/),d.check(e=>Number(e)>0,`The amount must be greater than zero`)),assetId:d.literal(`USD`)})}),ts=d.strictObject({type:d.literal(`increase_limit`),accountId:d.pipe(d.string(),d.minLength(1)),capability:d.picklist($o),limitType:d.picklist([`hourly_count`,`daily_count`]),newLimit:d.strictObject({count:d.pipe(d.number(),d.integer(),d.minValue(1))})}),ns=d.pipe(d.array(d.union([es,ts])),d.minLength(1),d.maxLength(10),d.check(e=>new Set(e.map(e=>`${e.accountId}|${e.capability}|${e.limitType}`)).size===e.length,`Each account, capability, and limit type may appear only once`)),rs=d.object({type:d.literal(`policy_override`),operations:ns,durationSeconds:d.pipe(d.number(),d.integer(),d.minValue(60),d.maxValue(604800)),reason:d.pipe(d.string(),d.trim(),d.minLength(1),d.maxLength(280))}),is=d.union([zo,Bo,Ho,Uo,Yo,Qo,rs]);function as(e){let t=d.parse(is,e);return t.type===`send`||t.type===`transfer`?{...t,amount:{amount:t.amount,asset_id:`USD`}}:t.type===`policy_override`?{...t,schemaVersion:1}:t}const os=d.object({intent:Po});var ss=class extends Error{status;code;details;constructor(e,t,n,r){super(n?`API error ${e} [${n}]: ${t}`:`API error ${e}: ${t}`),this.name=`ApiError`,this.status=e,this.code=n,this.details=r}},cs=class extends Error{timeoutMs;constructor(e){super(`Request timed out after ${e}ms. The server may still have processed a state-changing request; follow that operation's documented recovery procedure before retrying.`),this.name=`TimeoutError`,this.timeoutMs=e}};const ls=d.object({error:d.nullish(d.string()),message:d.nullish(d.string()),code:d.nullish(d.string()),details:d.nullish(d.record(d.string(),d.unknown()))});async function us(e){let t=d.safeParse(ls,await e.json().catch(()=>void 0)),n=t.success?t.output:{};return n.error!=null&&n.message!=null?new ss(e.status,n.message,n.code??n.error,n.details??void 0):new ss(e.status,n.error??n.message??e.statusText,n.code??void 0,n.details??void 0)}async function ds(e,t){if(!e.ok)throw await us(e);return d.parse(t,await e.json())}var fs=class extends Error{intentId;outcome;constructor(e){let t=e.cause instanceof Error?e.cause.message:String(e.cause);super(e.outcome===`not-submitted`?`Intent ${e.intentId} was created but never submitted; no money moved: ${t}`:`Intent ${e.intentId} submission could not be confirmed: ${t}; poll getIntent("${e.intentId}") to a terminal status and resubmit only after blocked or failed`,{cause:e.cause}),this.name=`IntentSubmitError`,this.intentId=e.intentId,this.outcome=e.outcome}};const ps=2147483647;var ms=class{#e;#t;#n;#r;#i;#a;#o;constructor(e){let t=e.timeout===void 0?8e4:e.timeout;if(!Number.isInteger(t)||t<=0||t>ps)throw TypeError(`timeout must be a positive integer no greater than ${ps}`);this.#e=e.baseUrl??`https://api.catena.com`,this.#t=Ra(e.appInfo),this.#n=e.defaultHeaders??{},this.#r=va(e.privateKeyHex),this.#a=(e.fetch??globalThis.fetch).bind(globalThis),this.#o=t,this.#i=Ta({keypair:this.#r,baseUrl:this.#e,identityUrl:e.identityUrl})}#s(e){let t=new Headers({"Content-Type":`application/json`});for(let[e,n]of Object.entries(this.#n))t.set(e,n);for(let[n,r]of Object.entries(e??{}))t.set(n,r);return t.set(`User-Agent`,this.#t),t.delete(`Authorization`),t}async#c(e){let t=new URL(`${this.#e}/v1/agent-api${e.path}`);for(let[n,r]of Object.entries(e.query??{}))r!==void 0&&t.searchParams.set(n,r);let n=new Request(t,{method:e.method,headers:this.#s(e.headers),body:e.body===void 0?null:JSON.stringify(e.body)});return this.#i.sign(n)}async#l(e,t){return this.#u(await this.#c(e),t)}async#u(e,t){let n=new AbortController,r=new Request(e,{signal:n.signal}),i;try{let e=new Promise((e,t)=>{i=setTimeout(()=>{let e=new cs(this.#o);t(e),n.abort(e)},this.#o)}),a=this.#a(r).then(e=>ds(e,t));return await Promise.race([a,e])}finally{i!==void 0&&clearTimeout(i)}}async whoami(){return(await this.#l({method:`GET`,path:`/me`},uo)).agent}async submitFeedback(e){await this.#l({method:`POST`,path:`/feedback`,body:{body:e}},co)}async getPolicy(){return(await this.#l({method:`GET`,path:`/policy`},bo)).policy}async listAccounts(){return this.#l({method:`GET`,path:`/accounts`},xo)}async getAccountBalance(e){return this.#l({method:`GET`,path:`/accounts/${encodeURIComponent(e)}/balance`},So)}async listAccountTransactions(e,t={}){return this.#l({method:`GET`,path:`/accounts/${encodeURIComponent(e)}/transactions`,query:{start:t.start,end:t.end,limit:t.limit?.toString(),offset:t.offset?.toString()}},Oo)}async getAccountDepositAddress(e,t){return this.#l({method:`GET`,path:`/accounts/${encodeURIComponent(e)}/deposit-address`,query:{network:t.network,asset:t.asset}},ko)}async listCounterparties(e={}){return this.#l({method:`GET`,path:`/counterparties`,query:{address:e.address,network:e.network}},jo)}async submitIntent(e){let t=await this.#d({...e,idempotencyKey:e.idempotencyKey??crypto.randomUUID()}),n=t.nextAction;if(!n)return Fo(t);let r;try{let e=await this.#f(n);r=await this.#c({method:`POST`,path:`/intents/${encodeURIComponent(t.id)}/submit-stamp`,body:{preparedBody:n.preparedBody,stamp:e}})}catch(e){throw new fs({intentId:t.id,outcome:`not-submitted`,cause:e})}try{return await this.#p(r,t.replayed)}catch(e){throw new fs({intentId:t.id,outcome:`unknown`,cause:e})}}async#d(e){return this.#l({method:`POST`,path:`/intents`,body:{action:as(e.action)},headers:{"Idempotency-Key":e.idempotencyKey}},Po)}async#f(e){if(e.signer.publicKeyHex.toLowerCase()!==this.#r.publicKeyHex.toLowerCase())throw Error(`Local signer public key does not match requested signer ${e.signer.publicKeyHex}; linked credential has ${this.#r.publicKeyHex}`);let t=await new ma({apiPublicKey:this.#r.publicKeyHex,apiPrivateKey:this.#r.privateKeyHex}).stamp(e.preparedBody.body);return{publicKeyHex:this.#r.publicKeyHex,stampHeaderName:t.stampHeaderName,stampHeaderValue:t.stampHeaderValue}}async#p(e,t){let n=Fo((await this.#u(e,os)).intent);return t?{...n,replayed:!0}:n}async getIntent(e){return Fo(await this.#l({method:`GET`,path:`/intents/${encodeURIComponent(e)}`},Po))}async unlinkAgent(){await this.#l({method:`POST`,path:`/unlink`},co)}async reportSettlement(e){await this.#l({method:`POST`,path:`/intents/${encodeURIComponent(e.intentId)}/settlement-report`,body:{txHash:e.txHash,...e.receipt!==void 0&&{receipt:e.receipt}}},co)}};function hs(e={}){let t=e.privateKeyHex===void 0?process.env.CATENA_SECRET_KEY:e.privateKeyHex;if(t===void 0)throw new ha(`privateKeyHex is required; pass it explicitly or set CATENA_SECRET_KEY`);return new ms({...e,privateKeyHex:t})}function gs(e){let t=se(e);return e instanceof ss&&e.details!==void 0?`${t}\nDetails:\n${JSON.stringify(e.details,null,2)}`:t}function X(e){console.error(gs(e)),process.exit(1)}const _s=d.string(),vs=d.boolean();function ys(e){return e===void 0}function bs(e){return e.issues?.[0]?.message??`Invalid value`}function xs(e,t,n,r){return X(`${e}: ${t}${r?` (got: ${String(n)})`:``}`)}function Ss(e,t,n,r){let i=d.safeParse(e,t);return i.success?i.output:xs(n,bs(i),t,r)}function Cs(e,t){let n=t.schema??_s;return{type:e,description:t.description,negativeDescription:t.negativeDescription,required:t.required,default:t.default,parseValue(e,r){let i=ys(e)?t.default:e;if(ys(i)){t.required===!0&&X(`${r} is required`);return}return Ss(n,i,r,t.showValueInError===!0)}}}function Z(e){return Cs(`string`,e)}function ws(e){return Cs(`positional`,e)}function Ts(e){let t=e.schema??_s;return{type:`string`,description:e.description,repeatable:!0,parseValue(n,r){return(Array.isArray(n)?n:[]).map(n=>Ss(t,n,r,e.showValueInError===!0))}}}function Es(e){return{type:`boolean`,description:e.description,negativeDescription:e.negativeDescription,required:e.required,default:e.default,parseValue(t,n){let r=ys(t)?e.default:t;if(ys(r)){e.required===!0&&X(`${n} is required`);return}return Ss(vs,r,n,!1)}}}function Ds(e){return Os(`string`,e)}function Os(e,t){return Cs(e,{description:t.description,required:t.required,default:t.default,schema:d.picklist(t.choices,`must be one of ${t.choices.join(`|`)}`),showValueInError:!0})}function ks(e,t){return t.type===`positional`?`<${e}>`:`--${e}`}function As(e){return e.replace(/([a-z])([A-Z])/g,`$1 $2`).replace(/([A-Z0-9])([A-Z][a-z])/g,`$1 $2`).split(/[ _-]/).filter(e=>e.length>0)}function js(e){return As(e).join(`-`).toLowerCase()}function Ms(e){return As(e).map((e,t)=>t===0?e.charAt(0).toLowerCase()+e.slice(1):e.charAt(0).toUpperCase()+e.slice(1)).join(``)}function Ns(e){return[`--${e}`,`--${js(e)}`,`--${Ms(e)}`]}function Ps(e){let t=e.indexOf(`=`);return t===-1?[e,void 0]:[e.slice(0,t),e.slice(t+1)]}function Fs(e,t,n){let r=e.indexOf(`--`),i=r===-1?e.length:r,a=[...e.slice(0,i).filter(e=>!e.startsWith(`--no-`)),...e.slice(i)],o=new Set(Ns(t)),s=new Set(Object.entries(n).filter(([e,n])=>e!==t&&n.type===`string`).flatMap(([e])=>Ns(e))),c=[];for(let e=0;e<a.length;e++){let t=a[e];if(t===`--`)break;let[n,r]=Ps(t);if(o.has(n)){r===void 0?(c.push(a[e+1]??``),e++):c.push(r);continue}s.has(n)&&r===void 0&&e++}return c}function Is(e){let t=e.required??(e.type!==`positional`&&void 0);return e.type===`boolean`?{type:e.type,description:e.description,negativeDescription:e.negativeDescription,required:t,default:typeof e.default==`boolean`?e.default:void 0}:{type:e.type,description:e.description,required:t,default:typeof e.default==`string`?e.default:void 0}}function Q(e){return{args:Object.fromEntries(Object.entries(e).map(([e,t])=>[e,Is(t)])),label(t){return ks(t,e[t])},parse(t,n){let r=(r,i)=>{if(i.repeatable!==!0)return t[r];if(n===void 0)throw Error(`parse() needs the command's raw argv to collect the repeatable --${r} flag`);return Fs(n,r,e)};return Object.fromEntries(Object.entries(e).map(([e,t])=>[e,t.parseValue(r(e,t),ks(e,t))]))}}}const Ls=Z({description:`Credential profile name`}),Rs=Es({description:`Print compact single-line JSON (for piping)`,default:!1}),zs=/^[a-zA-Z0-9_-]+$/,Bs=d.pipe(d.string(`ID must be a string`),d.minLength(1,`ID must not be empty`),d.maxLength(256,`ID is too long (max 256 characters)`),d.regex(zs,`ID may only contain letters, digits, hyphens, and underscores`));d.picklist([`base`,`base-sepolia`,`arc`,`solana`]),d.picklist([`usdc`]),d.picklist([`evm`,`svm`]);const Vs=/^0x[0-9a-fA-F]{40}$/;d.pipe(d.string(),d.trim(),d.regex(Vs,`Must be a 0x-prefixed hex wallet address`),d.brand(`EvmAddress`)),d.picklist([`always`,`testnet`,`preview`]),d.picklist([`bridge-internal-transfer`,`bridge-wallet-transfer`,`wallet-bridge-transfer`,`wallet-wallet-transfer`]);const Hs=[`bridge-internal-transfer`,`bridge-wallet-transfer`,`wallet-bridge-transfer`,`wallet-wallet-transfer`],Us=[`wallet-wallet-transfer`],Ws=[{network:`base`,networkLabel:`Base`,addressFamily:`evm`,blockExplorerUrl:`https://basescan.org`,blockExplorerName:`Basescan`,asset:`usdc`,assetLabel:`USDC`,assetDecimals:6,contractAddress:`0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913`,caip2:`eip155:8453`,caip19:`eip155:8453/erc20:0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913`,finality:`finalized`,gasTokenIsTrackedAsset:!1,availabilityGate:`always`,customerAccess:`enabled`,chainFeeUsd:`0`,walletTransferFeeUsd:`0`,transferRoutes:Hs,provider:{alchemyNetwork:`base`,alchemyDeposit:{transferEmitterAddress:`0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913`,transferDecimals:6,webhook:`enabled`},bridgePaymentRail:`base`}},{network:`base-sepolia`,networkLabel:`Base Sepolia`,addressFamily:`evm`,isTestnet:!0,blockExplorerUrl:`https://sepolia.basescan.org`,blockExplorerName:`Sepolia Basescan`,asset:`usdc`,assetLabel:`USDC`,assetDecimals:6,contractAddress:`0x036CbD53842c5426634e7929541eC2318f3dCF7e`,caip2:`eip155:84532`,caip19:`eip155:84532/erc20:0x036CbD53842c5426634e7929541eC2318f3dCF7e`,finality:`finalized`,gasTokenIsTrackedAsset:!1,availabilityGate:`testnet`,customerAccess:`enabled`,chainFeeUsd:`0`,walletTransferFeeUsd:`0`,transferRoutes:Us,provider:{alchemyNetwork:`base-sepolia`,alchemyDeposit:{transferEmitterAddress:`0x036CbD53842c5426634e7929541eC2318f3dCF7e`,transferDecimals:6,webhook:`enabled`}}},{network:`arc`,networkLabel:`Arc`,addressFamily:`evm`,blockExplorerUrl:`https://arc-scan.org`,blockExplorerName:`ArcScan`,asset:`usdc`,assetLabel:`USDC`,assetDecimals:6,contractAddress:`0x3600000000000000000000000000000000000000`,caip2:`eip155:5042`,caip19:`eip155:5042/erc20:0x3600000000000000000000000000000000000000`,finality:`block-inclusion`,gasTokenIsTrackedAsset:!0,availabilityGate:`preview`,customerAccess:`enabled`,chainFeeUsd:`0`,walletTransferFeeUsd:`0`,transferRoutes:Us,provider:{alchemyNetwork:`arc`,alchemyDeposit:{transferEmitterAddress:`0xfffffffffffffffffffffffffffffffffffffffe`,transferDecimals:18,webhook:`disabled`},sendMode:`self-broadcast`}},{network:`solana`,networkLabel:`Solana`,addressFamily:`svm`,blockExplorerUrl:`https://solscan.io`,blockExplorerName:`Solscan`,asset:`usdc`,assetLabel:`USDC`,assetDecimals:6,contractAddress:`EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v`,caip2:`solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp`,caip19:`solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp/token:EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v`,finality:`finalized`,gasTokenIsTrackedAsset:!1,availabilityGate:`preview`,customerAccess:`enabled`,chainFeeUsd:`0`,walletTransferFeeUsd:`0`,transferRoutes:Hs,provider:{alchemyNotify:{webhook:`enabled`},bridgePaymentRail:`solana`}}];function Gs(e){if(typeof e==`object`&&e&&!Object.isFrozen(e)){for(let t of Object.values(e))Gs(t);Object.freeze(e)}}Gs(Ws);const Ks=Ws;function qs(e){return{id:e.network,label:e.networkLabel,addressFamily:e.addressFamily,blockExplorerUrl:e.blockExplorerUrl,blockExplorerName:e.blockExplorerName,...e.isTestnet?{isTestnet:!0}:{}}}function Js(e){return{id:e.asset,label:e.assetLabel,decimals:e.assetDecimals}}function Ys(e){return{network:e.network,asset:e.asset,contractAddress:e.contractAddress}}function Xs(e){return{id:`${e.network}-usdc`,label:`${e.networkLabel} USDC`,network:e.network,asset:`usdc`}}function Zs(e){let t=[];for(let n of e)t.some(e=>e.id===n.network)||t.push(qs(n));return t}function Qs(e){let t=[],n=new Set;for(let r of e)n.has(r.asset)||(n.add(r.asset),t.push(Js(r)));return t}function $s(e){return e.asset===`usdc`}const ec=Zs(Ks);Qs(Ks),Ks.map(Ys),Ks.filter($s).map(Xs);function tc(e,t){return`${e}:${t}`}new Map(Ks.map(e=>[tc(e.network,e.asset),e])),new Map(ec.map(e=>[e.id,e]));const nc=[`base`,`base-sepolia`],rc=[`usdc`],ic=`base`,ac=d.pipe(d.string(),d.trim(),d.guard(e=>Vs.test(e),`Must be a 0x-prefixed hex wallet address`));function oc(e){return Ds({description:e.description,choices:nc,...e.default===void 0?{}:{default:e.default}})}const sc=[`registered`,`already_registered`,`not_applicable`,`registration_failed`],cc=d.pipe(d.string(),d.regex(/^0[23][0-9a-f]{64}$/)),lc=d.pipe(d.string(),d.regex(/^[0-9a-f]{64}$/)),uc=d.object({status:d.picklist(sc),publicKeyHex:d.optional(cc),reason:d.optional(d.string())}),dc=d.object({algorithm:d.literal(`p256`),privateKeyHex:lc,publicKeyHex:cc,registration:uc}),fc=d.object({version:d.literal(`signer-1`),signer:dc}),pc=d.object({version:d.literal(1),refreshToken:d.pipe(d.string(),d.minLength(1)),sessionToken:d.pipe(d.string(),d.minLength(1)),expiresAt:d.pipe(d.string(),d.isoTimestamp())}),mc=d.object({version:d.literal(2),refreshToken:d.pipe(d.string(),d.minLength(1)),sessionToken:d.pipe(d.string(),d.minLength(1)),expiresAt:d.pipe(d.string(),d.isoTimestamp()),signer:dc}),hc=d.object({version:d.literal(3),signer:dc}),gc=d.variant(`version`,[pc,mc,hc]),_c=d.variant(`version`,[fc,pc,mc,hc]);function vc(e){return d.parse(gc,e)}function yc(e){return d.parse(_c,e)}function bc(e){let t=d.safeParse(_c,e);return t.success?t.output:null}function xc(e){return{version:`signer-1`,signer:{algorithm:e.algorithm,privateKeyHex:e.privateKeyHex,publicKeyHex:e.publicKeyHex,registration:{status:`not_applicable`,reason:`pending_claim`}}}}function Sc(e,t){try{return yc(JSON.parse(e))}catch(e){throw Error(`${t} credential has an unsupported format`,{cause:e})}}function Cc(e){return vc({version:3,signer:e})}function wc(e){return JSON.stringify(e)}function Tc(e,t){return JSON.stringify(e)===JSON.stringify(t)}function Ec(e){return(t,n)=>Dc(e,t,n)}function Dc(e,t,n){return new Promise((r,i)=>{let a=y(e,[...t],{stdio:[`pipe`,`pipe`,`pipe`]}),o=[],s=[],c=!1,l=!1,u=null,d=null,f=null,p=e=>{c||(c=!0,d!==null&&clearTimeout(d),f!==null&&clearTimeout(f),r(e))},m=e=>{c||(c=!0,d!==null&&clearTimeout(d),f!==null&&clearTimeout(f),i(e))};d=setTimeout(()=>{l=!0,a.kill(`SIGTERM`),f=setTimeout(()=>{a.kill(`SIGKILL`),p({stdout:o.join(``),stderr:s.join(``),status:124})},1e3)},3e4),a.stdout.setEncoding(`utf8`),a.stderr.setEncoding(`utf8`),a.stdout.on(`data`,e=>o.push(e)),a.stderr.on(`data`,e=>s.push(e)),a.on(`error`,t=>{m(Error(`Unable to run ${e}: ${t.message}`))}),a.on(`close`,t=>{if(u!==null&&t===0){m(Error(`Unable to write to ${e} stdin: ${u.message}`));return}p({stdout:o.join(``),stderr:s.join(``),status:l?124:t})}),a.stdin.on(`error`,e=>{u=e});try{a.stdin.end(n)}catch(t){m(t instanceof Error?Error(`Unable to write to ${e} stdin: ${t.message}`):Error(`Unable to write to ${e} stdin`))}})}const Oc=`catena-agent`;function kc(e){if(!zs.test(e))throw Error(`Invalid credential location for credential storage: "${e}"`);return e}const Ac=Ec(`/usr/bin/secret-tool`);function jc(e){return e.status===1&&e.stdout===``&&e.stderr.trim()===``}function Mc(e,t){if(t.status===0)return;let n=Nc(t);throw Error(`Linux Secret Service credential ${e} failed (secret-tool exited ${t.status??`without status`}): ${n}`)}function Nc(e){let t=e.stderr.toLowerCase();return e.status===124?`secret service operation timed out`:t.includes(`cannot autolaunch`)||t.includes(`dbus`)||t.includes(`d-bus`)||t.includes(`org.freedesktop.secrets`)?`secret service session is unavailable`:/\blocked\b/.test(t)?`secret service keyring appears to be locked`:t.includes(`authorization`)||t.includes(`denied`)||t.includes(`not authorized`)?`secret service authorization was denied`:`secret service operation failed; ensure the Secret Service session is available and unlocked`}function Pc(e){return e instanceof Error?e.message.includes(`ENOENT`)?Error(`Linux Secret Service credential operation failed: /usr/bin/secret-tool was not found. Install libsecret-tools and ensure a Secret Service keyring is available.`,{cause:e}):e:Error(String(e))}var Fc=class{runSecretTool;constructor(e={}){if((e.platform??process.platform)!==`linux`)throw Error(`Linux Secret Service credential storage is only supported on Linux`);this.runSecretTool=e.runSecretTool??Ac}async save(e,t){let n=yc(t),r=kc(e);if(await this.savePassword(r,wc(n)),!Tc(await this.resolveDirectPassword(r),n))throw Error(`Linux Secret Service credential save verification failed`)}async resolve(e){return this.resolveDirectPassword(kc(e))}async delete(e){await this.deletePassword(kc(e))}async savePassword(e,t){Mc(`save`,await this.runSecretToolCommand([`store`,`--label`,`${Oc} ${e}`,`app`,Oc,`account`,e],t))}async resolvePassword(e){let t=await this.runSecretToolCommand([`lookup`,`app`,Oc,`account`,e]);return jc(t)?null:(Mc(`resolve`,t),t.stdout.replace(/\r?\n$/,``))}async resolveDirectPassword(e){let t=await this.resolvePassword(e);return t===null?null:Sc(t,`Linux Secret Service`)}async deletePassword(e){let t=await this.runSecretToolCommand([`clear`,`app`,Oc,`account`,e]);jc(t)||Mc(`delete`,t)}async runSecretToolCommand(e,t){try{return await this.runSecretTool(e,t)}catch(e){throw Pc(e)}}};const Ic=Ec(`/usr/bin/security`),Lc=d.object({version:d.literal(1),encoding:d.literal(`base64-json`),chunks:d.pipe(d.number(),d.integer(),d.minValue(1),d.maxValue(64)),sha256:d.pipe(d.string(),d.regex(/^[a-f0-9]{64}$/))});function Rc(e){return e.status===44}function zc(e,t){return`${e}:chunk:${t}`}function Bc(e){let t=JSON.parse(e),n=bc(t);if(n!==null)return{kind:`direct`,payload:n};let r=d.safeParse(Lc,t);if(r.success)return{kind:`legacy`,manifest:r.output};throw Error(`macOS Keychain credential has an unsupported format`)}function Vc(e,t){if(t.status===0)return;let n=Hc(t);throw Error(`macOS Keychain credential ${e} failed (security exited ${t.status??`without status`})${n===null?``:`: ${n}`}`)}function Hc(e){let t=e.stderr.toLowerCase();return e.status===124?`keychain operation timed out`:t.includes(`stdin isn't a terminal`)?`parent process has no terminal`:t.includes(`user interaction is not allowed`)?`keychain user interaction is not allowed`:t.includes(`authorization`)||t.includes(`denied`)?`keychain authorization was denied`:t.includes(`locked`)?`keychain appears to be locked`:null}function Uc(e){for(let t=0;t<e.length;t++){let n=e.charCodeAt(t);if(n<32||n===127)throw Error(`macOS Keychain credential values cannot contain control characters`)}return`"${e.replace(/\\/g,`\\\\`).replace(/"/g,`\\"`)}"`}function Wc(e,t){return[`add-generic-password`,`-s`,Uc(Oc),`-a`,Uc(e),`-w`,Uc(t),`-U`].join(` `)+`
 `}var Gc=class{runSecurity;constructor(e={}){if((e.platform??process.platform)!==`darwin`)throw Error(`macOS Keychain credential storage is only supported on macOS`);this.runSecurity=e.runSecurity??Ic}async save(e,t){let n=yc(t),r=kc(e),i=await this.resolveLegacyChunkCount(r,64);if(await this.savePassword(r,wc(n)),!Tc(await this.resolveDirectPassword(r),n))throw Error(`macOS Keychain credential save verification failed`);await this.deleteChunks(r,i)}async resolve(e){let t=kc(e),n=await this.resolveKeychainItem(t);return n===null?null:n.kind===`direct`?n.payload:this.resolveLegacyPayload(t,n.manifest)}async delete(e){let t=kc(e),n=await this.resolveLegacyChunkCount(t,64);await this.deleteChunks(t,n),await this.deletePassword(t)}async savePassword(e,t){Vc(`save`,await this.runSecurity([`-i`],Wc(e,t)))}async resolvePassword(e){let t=await this.runSecurity([`find-generic-password`,`-a`,e,`-s`,Oc,`-w`]);return Rc(t)?null:(Vc(`resolve`,t),t.stdout.replace(/\r?\n$/,``))}async resolveKeychainItem(e){let t=await this.resolvePassword(e);return t===null?null:Bc(t)}async resolveDirectPassword(e){let t=await this.resolveKeychainItem(e);if(t===null)return null;if(t.kind!==`direct`)throw Error(`macOS Keychain credential direct verification failed`);return t.payload}async resolveLegacyPayload(e,t){let n=[];for(let r=0;r<t.chunks;r++){let t=await this.resolvePassword(zc(e,r));if(t===null)throw Error(`macOS Keychain credential chunk is missing`);n.push(t)}let r=n.join(``);if(m(`sha256`).update(r).digest(`hex`)!==t.sha256)throw Error(`macOS Keychain credential checksum mismatch`);return yc(JSON.parse(Buffer.from(r,`base64`).toString(`utf8`)))}async resolveLegacyChunkCount(e,t){let n=await this.resolvePassword(e);if(n===null)return 0;try{let e=Bc(n);return e.kind===`legacy`?e.manifest.chunks:0}catch{return t}}async deleteChunks(e,t){for(let n=0;n<t;n++)await this.deletePassword(zc(e,n))}async deletePassword(e){let t=await this.runSecurity([`delete-generic-password`,`-a`,e,`-s`,Oc]);Rc(t)||Vc(`delete`,t)}};function Kc(e={}){let t=e.platform??process.platform;if(t===`darwin`)return new Gc({platform:t});if(t===`linux`)return new Fc({platform:t});throw Error(`Catena credential storage is only supported on macOS and Linux`)}const qc=/^127(?:\.(?:25[0-5]|2[0-4]\d|1?\d?\d)){3}$/;function Jc(e){let t=e.replace(/^\[|\]$/g,``);return t===`localhost`||t===`::1`||qc.test(t)}function Yc(e){let t;try{t=new URL(e)}catch{return!1}return t.protocol===`https:`||t.protocol===`http:`&&Jc(t.hostname)}function Xc(e,t){if(!Yc(e))throw Error(`${t} must be an https:// URL (http:// is allowed only for a loopback host): "${e}"`)}const Zc=/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,63}$/,Qc=d.object({status:d.optional(d.literal(`linked`),`linked`),bank_url:d.pipe(d.string(),d.minLength(1)),agent_id:d.pipe(d.string(),d.minLength(1)),client_instance_id:d.pipe(d.string(),d.regex(zs))}),$c=d.object({status:d.literal(`pending_connection`),bank_url:d.pipe(d.string(),d.minLength(1)),client_instance_id:d.pipe(d.string(),d.regex(zs)),created_at:d.pipe(d.string(),d.isoTimestamp())}),el=d.variant(`status`,[Qc,$c]);d.object({version:d.literal(1),default_profile:d.optional(d.string()),profiles:d.record(d.string(),el),directories:d.optional(d.record(d.string(),d.string()))});const tl=d.object({version:d.literal(1),default_profile:d.optional(d.string()),profiles:d.record(d.string(),d.unknown()),directories:d.optional(d.record(d.string(),d.unknown()))});function nl(){return te(process.env.HOME??ee(),`.catena`)}function rl(){return te(nl(),`profiles.json`)}function il(e){return Zc.test(e)}function al(e){if(!il(e))throw Error(`invalid profile name "${e}" (expected [a-zA-Z0-9][a-zA-Z0-9._-]{0,63})`)}function ol(e){return typeof e!=`object`||!e||!(`code`in e)?!1:typeof e.code==`string`}function sl(e,t){let n;try{n=JSON.parse(e)}catch(e){throw Error(`profiles.json is not valid JSON: ${gs(e)}`,{cause:e})}if(typeof n==`object`&&n&&`version`in n){let e=n;if(e.version!==1)throw Error(`profiles.json version ${String(e.version)} is not supported (expected 1)`)}let r=d.parse(tl,n),i={};for(let[e,n]of Object.entries(r.profiles)){if(!il(e)){t?.(`profiles: dropping invalid profile name "${e}"`);continue}let r=d.safeParse(el,n);if(!r.success){t?.(`profiles: dropping malformed profile "${e}"`);continue}i[e]=r.output}if(r.default_profile!==void 0&&(al(r.default_profile),!Object.hasOwn(i,r.default_profile)))throw Error(`profiles.json default_profile "${r.default_profile}" is not linked`);let a={};for(let[e,n]of Object.entries(r.directories??{})){if(!M(e)){t?.(`profiles: dropping directory binding with relative path "${e}"`);continue}if(typeof n!=`string`||!il(n)){t?.(`profiles: dropping malformed directory binding "${e}"`);continue}a[e]=n}return{version:1,...r.default_profile===void 0?{}:{default_profile:r.default_profile},profiles:i,...Object.keys(a).length===0?{}:{directories:a}}}function cl(e){try{return sl(T(rl(),`utf-8`),e)}catch(e){if(e instanceof Error&&ol(e)&&e.code===`ENOENT`)return{version:1,profiles:{}};throw e}}function ll(){w(nl(),{recursive:!0,mode:448}),x(nl(),448)}function ul(e){ll();let t=rl(),n=`${t}.${g(6).toString(`hex`)}.tmp`;A(n,JSON.stringify(e,null,2)+`
-`,{encoding:`utf-8`,mode:384}),D(n,t)}function dl(e,t){al(e);let n=d.parse(el,t);Xc(n.bank_url,`profile "${e}" bank_url`);let r=cl();ul({...r,profiles:{...r.profiles,[e]:n}})}function fl(e){return e.status===`linked`}function pl(e,t){return e.replace(/\/+$/,``)===t.replace(/\/+$/,``)}function ml(e,t){let n=Object.entries(cl().profiles).toSorted(([e],[t])=>e.localeCompare(t)).find(([,n])=>fl(n)&&n.agent_id===e&&pl(n.bank_url,t));return n===void 0?null:n[0]}function hl(e,t){let n=Object.fromEntries(Object.entries(e??{}).filter(([,e])=>t(e)));return Object.keys(n).length===0?{}:{directories:n}}function gl(e){al(e);let t=cl(),{[e]:n,...r}=t.profiles;ul({version:1,...t.default_profile===e||t.default_profile===void 0?{}:{default_profile:t.default_profile},profiles:r,...hl(t.directories,t=>t!==e)})}function _l(e){try{return E(ne(e))}catch{return ne(e)}}function vl(e){return cl().directories?.[_l(e)]??null}function yl(e,t){al(t);let n=cl();if(!Object.hasOwn(n.profiles,t))throw Error(`Profile "${t}" is not linked. Run catena link --profile ${t} <agent-id>.`);let r=_l(e);return ul({...n,directories:{...n.directories,[r]:t}}),r}function bl(e){let t=cl(),n=_l(e);if(t.directories===void 0||!Object.hasOwn(t.directories,n))return{directory:n,removed:!1};let{[n]:r,...i}=t.directories,{directories:a,...o}=t;return ul({...o,...Object.keys(i).length===0?{}:{directories:i}}),{directory:n,removed:!0}}function xl(e){return al(e),cl().profiles[e]??null}function Sl(){return`client_${g(16).toString(`hex`)}`}function Cl(e,t){let n=xl(e);return t.agent_id===void 0?wl(e,t.bank_url,n):Tl(e,t.bank_url,t.agent_id,n)}function wl(e,t,n){if(n?.status===`linked`)throw Error(`Profile "${e}" is already linked. Choose a different profile name to start agent connection.`);let r=(n?.status===`pending_connection`&&pl(n.bank_url,t)?n.client_instance_id:null)??Sl();return dl(e,{status:`pending_connection`,bank_url:t,client_instance_id:r,created_at:n?.status===`pending_connection`?n.created_at:new Date().toISOString()}),r}function Tl(e,t,n,r){if(r?.status===`linked`){if(r.agent_id!==n)throw Error(`Profile "${e}" is already linked to a different agent (${r.agent_id}). Link ${n} under a different --profile, or run 'catena unlink --profile ${e}' first to repoint it (add --force if that agent's credential is missing or revoked).`);if(!pl(r.bank_url,t))throw Error(`Profile "${e}" is already linked to this agent on a different bank (${r.bank_url}). Link under a different --profile, or run 'catena unlink --profile ${e}' first (add --force if that credential is missing or revoked).`);return r.client_instance_id}let i=(r?.status===`pending_connection`&&pl(r.bank_url,t)?r.client_instance_id:null)??Sl();return dl(e,{status:`linked`,bank_url:t,agent_id:n,client_instance_id:i}),i}function El(e){al(e);let t=cl();if(!Object.hasOwn(t.profiles,e))throw Error(`Profile "${e}" is not linked. Run catena link --profile ${e} <agent-id>.`);ul({...t,default_profile:e})}function Dl(e){let t=e.toLowerCase().replace(/[^a-z0-9._-]+/g,`-`).replace(/^[^a-z0-9]+/,``).slice(0,64);return il(t)?t:`agent`}function Ol(e,t){if(!t(e))return e;for(let n=2;;n++){let r=`${e.slice(0,64-String(n).length-1)}-${n}`;if(!t(r))return r}}function kl(e){al(e.reservationName),al(e.profileName);let t=d.parse(el,e.profile);Xc(t.bank_url,`profile "${e.profileName}" bank_url`);let n=cl(),{[e.reservationName]:r,...i}=n.profiles;if(!Object.hasOwn(n.profiles,e.reservationName)||r.client_instance_id!==t.client_instance_id)throw Error(`Link reservation "${e.reservationName}" changed during setup (a concurrent link from this directory?). Re-run 'catena link'.`);if(e.profileName!==e.reservationName&&Object.hasOwn(i,e.profileName))throw Error(`Profile "${e.profileName}" already exists; cannot finalize link under that name.`);let a=Object.fromEntries(Object.entries(n.directories??{}).map(([t,n])=>[t,n===e.reservationName?e.profileName:n]));ul({version:1,...n.default_profile===void 0?{}:{default_profile:n.default_profile===e.reservationName?e.profileName:n.default_profile},profiles:{...i,[e.profileName]:t},...Object.keys(a).length===0?{}:{directories:a}})}function Al(e){return e??Kc()}async function jl(e,t){let n;try{n=xl(e.profileName)}catch(t){return{ok:!1,profileName:e.profileName,bankUrl:e.fallbackBankUrl,message:gs(t)}}if(n===null)return{ok:!1,profileName:e.profileName,bankUrl:e.fallbackBankUrl,message:`Profile "${e.profileName}" is not linked. Run 'catena link --profile ${e.profileName}' to authenticate.`};try{Xc(n.bank_url,`profile "${e.profileName}" bank_url`)}catch(t){return{ok:!1,profileName:e.profileName,bankUrl:e.fallbackBankUrl,message:gs(t)}}if(n.status===`pending_connection`)return{ok:!1,profileName:e.profileName,bankUrl:n.bank_url,message:`Profile "${e.profileName}" is waiting for agent connection approval. Run 'catena link --profile ${e.profileName}' to finish setup.`};let r;try{r=await Al(t).resolve(n.client_instance_id)}catch(t){return{ok:!1,profileName:e.profileName,bankUrl:n.bank_url,message:`Profile "${e.profileName}" credential unavailable for ${n.agent_id}: ${gs(t)}. Run 'catena link --profile ${e.profileName} ${n.agent_id}' to authenticate.`}}return r===null||r.version===`signer-1`?{ok:!1,profileName:e.profileName,bankUrl:n.bank_url,message:`Profile "${e.profileName}" credential unavailable for ${n.agent_id}. Run 'catena link --profile ${e.profileName} ${n.agent_id}' to authenticate.`}:r.version===1?{ok:!1,profileName:e.profileName,bankUrl:n.bank_url,message:`Profile "${e.profileName}" credential for ${n.agent_id} has no signing key. Run 'catena link --profile ${e.profileName} ${n.agent_id}' to authenticate.`}:{ok:!0,profileName:e.profileName,bankUrl:n.bank_url,agentId:n.agent_id,clientInstanceId:n.client_instance_id,signer:r.signer}}const Ml={name:`catena-cli`,version:oe},Nl=/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;function Pl(e,t){if(!Nl.test(e))throw Error(`${t} must be a valid HTTP token`)}function Fl(e,t){let n=!1;for(let t=0;t<e.length;t+=1){let r=e.charCodeAt(t);if(r<32||r===127||r>255){n=!0;break}}if(n||/[()\\]/.test(e))throw Error(`${t} must not contain parentheses, backslashes, control characters, or characters outside Latin-1`)}function Il(e){Pl(e.name,`appInfo.name`),e.version!==void 0&&Pl(e.version,`appInfo.version`),e.url!==void 0&&Fl(e.url,`appInfo.url`);let t=e.version===void 0?e.name:`${e.name}/${e.version}`;return{"User-Agent":e.url===void 0?t:`${t} (${e.url})`}}const Ll=`https://api.catena.com`,Rl=`CATENA_PROFILE`;function zl(e,t,n,r){if(e.directories===void 0)return null;let i;try{i=E(t)}catch{return null}let a=Object.entries(e.directories).map(([e,t])=>[e.replace(/\/+$/,``)||`/`,t]).filter(([e])=>i===e||i.startsWith(e===`/`?`/`:`${e}/`)).toSorted(([e],[t])=>t.length-e.length),o=null;for(let[t,n]of a){if(Object.hasOwn(e.profiles,n))return n;o??=`${t} -> "${n}"`}if(o===null)return null;if(n===`error`)throw Error(`This directory is bound to a profile that no longer exists (${o}). Run 'catena profiles unbind' here, bind it with 'catena profiles bind <name>', or run 'catena link' to re-establish it.`);return r?.(`profiles: ignoring stale directory binding ${o}`),null}function Bl(e,t,n){if(e.flag!==void 0&&e.flag.length>0)return al(e.flag),{name:e.flag,source:`flag`};if(e.env!==void 0&&e.env.length>0){if(!il(e.env))throw Error(`${Rl} is set to an invalid profile name "${e.env}"`);return{name:e.env,source:`env`}}if(e.cwd!==void 0){let r=zl(t,e.cwd,n,e.log);if(r!==null)return{name:r,source:`directory`}}return t.default_profile===void 0?null:{name:t.default_profile,source:`default`}}function Vl(e){return Bl(e,cl(e.log),`ignore`)}function Hl(e){let t=cl(e.log),n=Bl(e,t,`error`);if(n!==null)return n;let r=Object.keys(t.profiles),i=Object.entries(t.profiles).filter(([,e])=>fl(e)).map(([e])=>e);if(i.length===1){let[e]=i;return{name:e,source:`single`}}if(i.length===0){if(r.length===1){let[e]=r;return{name:e,source:`single`}}return r.length>1&&e.log?.(`profiles: ignoring ${r.length} pending profiles (${r.toSorted().join(`, `)}); none is linked`),{name:`default`,source:`fallback`}}throw Error(`Multiple profiles exist and none is selected (${i.toSorted().join(`, `)}). Pass --profile <name>, set ${Rl}, run 'catena profiles use <name>', or run 'catena link' from an agent directory to bind it.`)}function Ul(e){return hs({baseUrl:e.bankUrl,privateKeyHex:e.signer.privateKeyHex,appInfo:Ml})}function Wl(){return Kc()}async function Gl(e){let t;try{t=Hl({flag:e,env:process.env[Rl],cwd:process.cwd(),log:e=>console.error(e)}).name}catch(e){return X(e)}let n=await jl({profileName:t,fallbackBankUrl:Ll},void 0);return n.ok||X(n.message),Ul(n)}const Kl=new Set([`unknown_key`,`key_revoked`,`client_unlinked`]),ql=new Set([`signature_auth_disabled`,`missing_auth`]);function Jl(e,t){if(!(e instanceof ss)||e.code===void 0)return e;let n=t===void 0?`catena link`:`catena link --profile ${t}`;return Kl.has(e.code)?Error(`This machine's signing key was rejected by the bank (${e.code}). Run '${n}' to re-authenticate.`):e.code===`client_upgrade_required`?Error(`This CLI version (${Ml.version}) is no longer supported by the bank. Run 'npm i -g @catena/cli' and retry.`):ql.has(e.code)?Error(`This bank does not support key-based authentication (${e.code}). Upgrade the bank, or use an older CLI release that authenticates with session tokens.`):e.code===`invalid_signature`&&e.message.includes(`created_out_of_window`)?Error(`The bank rejected this request's timestamp (created_out_of_window). Check this machine's system clock and retry.`):e}function Yl(e,t){console.log(t?.compact?JSON.stringify(e):JSON.stringify(e,null,2))}function Xl(e){return e.profile===void 0||e.profile.length===0?void 0:e.profile}async function Zl(e,t){try{return await t(await Gl(e))}catch(t){return X(Jl(t,e))}}function Ql(e,t){return async(n,r)=>{let i=await Zl(e,n);return Yl(i,t),await new Promise(e=>{process.stdout.write(``,()=>e())}),process.exit(r?.exitCode?r.exitCode(i):0)}}function $(e){return Ql(Xl(e),{compact:e.json===!0})}const $l=d.pipe(d.string(),d.regex(/^\d+$/,`must be a non-negative integer`),d.transform(Number),d.maxValue(2**53-1,`must be at most ${2**53-1}`)),eu=d.pipe($l,d.maxValue(200,`must be at most 200`)),tu={profile:Ls,json:Rs},nu=Q(tu),ru=Q({account:ws({description:`Account id`,required:!0,schema:Bs}),...tu}),iu=Q({account:ws({description:`Account id`,required:!0,schema:Bs}),start:Z({description:`Only include transactions at or after this ISO 8601 time`}),end:Z({description:`Only include transactions at or before this ISO 8601 time`}),limit:Z({description:`Maximum transactions to return (default 50, max 200)`,schema:eu}),offset:Z({description:`Number of transactions to skip for pagination`,schema:$l}),...tu}),au=Q({account:ws({description:`Account id`,required:!0,schema:Bs}),network:oc({description:`Deposit network; defaults to ${ic}. Availability depends on the connected environment.`,default:ic}),asset:Ds({description:`Deposit asset (${rc.join(`|`)})`,choices:rc,default:`usdc`}),...tu}),ou=c({meta:{name:`list`,description:`List accounts accessible under the agent's policy`},args:nu.args,async run({args:e}){await $(nu.parse(e))(e=>e.listAccounts())}}),su=c({meta:{name:`balance`,description:`Request an account balance through the policy engine`},args:ru.args,async run({args:e}){let t=ru.parse(e);await $(t)(e=>e.getAccountBalance(t.account))}}),cu=c({meta:{name:`transactions`,description:`Read an account's transaction history through the policy engine`},args:iu.args,async run({args:e}){let t=iu.parse(e);await $(t)(e=>e.listAccountTransactions(t.account,{start:t.start,end:t.end,limit:t.limit,offset:t.offset}))}}),lu=c({meta:{name:`deposit-address`,description:`Read an account deposit address through the policy engine`},args:au.args,async run({args:e}){let t=au.parse(e);await $(t)(e=>e.getAccountDepositAddress(t.account,{network:t.network,asset:t.asset}))}}),uu=c({meta:{name:`accounts`,description:`Inspect bank accounts`},subCommands:{list:ou,balance:su,transactions:cu,"deposit-address":lu}}),du=d.pipe(d.string(`Idempotency key must be a string`),d.minLength(1,`Idempotency key must not be empty`),d.maxLength(255,`Idempotency key is too long (max 255 characters)`)),fu=d.pipe(d.string(),d.minLength(1,`must not be empty`)),pu=d.pipe(d.string(),d.trim(),d.email(`must be a valid email address`)),mu={profile:Ls,json:Rs},hu=Q({address:Z({description:`Only counterparties with a wallet rail matching this address (0x…)`,schema:ac}),network:oc({description:`Only counterparties with a wallet rail on this network (e.g. base)`}),...mu}),gu=Z({description:`Counterparty name`,required:!0,schema:fu}),_u=Z({description:`Optional contact email`,schema:pu}),vu=Z({description:`Optional operation key. Reuse the same value only when retrying the same submission; omitted generates a fresh key for this invocation.`,schema:du}),yu=Q({name:gu,email:Z({description:`Contact email; creating the counterparty sends no email`,required:!0,schema:pu}),"idempotency-key":vu,...mu}),bu=Q({name:Z({description:`Counterparty name; required without a subcommand`,schema:fu}),email:Z({description:`Contact email; required without a subcommand; creating the counterparty sends no email`,schema:pu}),"idempotency-key":vu,...mu}),xu=Q({name:gu,"bank-name":Z({description:`Receiving bank name`,required:!0,schema:fu}),"routing-number":Z({description:`9-digit ABA routing number`,required:!0,schema:fu}),"account-number":Z({description:`Receiving bank account number`,required:!0,schema:fu}),"account-type":Ds({description:`checking | savings (default checking)`,choices:[`checking`,`savings`]}),"address-street":Z({description:`Street address of the receiving bank account holder`,required:!0,schema:fu}),"address-city":Z({description:`City`,required:!0,schema:fu}),"address-state":Z({description:`State (e.g. NY)`,required:!0,schema:fu}),"address-postal-code":Z({description:`Postal code`,required:!0,schema:fu}),"address-country":Z({description:`Default USA`}),email:_u,"idempotency-key":vu,...mu}),Su=Q({name:gu,address:Z({description:`Wallet address (0x… or ENS name on EVM networks)`,required:!0,schema:fu}),network:oc({description:`Wallet network; defaults to ${ic}. Availability depends on the connected environment.`,default:ic}),email:_u,"idempotency-key":vu,...mu}),Cu=Q({counterparty:ws({description:`Counterparty id`,required:!0,schema:Bs}),bank:Es({description:`Request bank account details`,default:!1}),wallet:Es({description:`Request wallet details`,default:!1}),"idempotency-key":vu,...mu}),wu=c({meta:{name:`list`,description:`List counterparties available under the agent's policy`},args:hu.args,async run({args:e}){let t=hu.parse(e);await $(t)(e=>e.listCounterparties({address:t.address,network:t.network}))}});function Tu(e){return e&&e.length>0?e:void 0}function Eu(e){let t=Tu(e.email);return{type:`create_counterparty`,name:e.name,email:t,rail:{type:`bank`,bankName:e[`bank-name`],routingNumber:e[`routing-number`],accountNumber:e[`account-number`],addressStreet:e[`address-street`],addressCity:e[`address-city`],addressState:e[`address-state`],addressPostalCode:e[`address-postal-code`],...e[`account-type`]?{accountType:e[`account-type`]}:{},...e[`address-country`]?{addressCountry:e[`address-country`]}:{}}}}function Du(e){let t=Tu(e.email);return{type:`create_counterparty`,name:e.name,email:t,rail:{type:`wallet`,walletAddress:e.address,network:e.network}}}function Ou(e){return{type:`create_counterparty`,name:e.name,email:e.email}}const ku=c({meta:{name:`email`,description:`Create a counterparty with an email and no payment details. Sends no email.`},args:yu.args,async run({args:e}){let t=yu.parse(e);await $(t)(e=>e.submitIntent({action:Ou(t),...t[`idempotency-key`]!==void 0&&{idempotencyKey:t[`idempotency-key`]}}))}}),Au=c({meta:{name:`bank`,description:`Request bank counterparty creation through the policy engine. Prints an intent envelope.`},args:xu.args,async run({args:e}){let t=xu.parse(e),n=Eu(t);await $(t)(e=>e.submitIntent({action:n,...t[`idempotency-key`]!==void 0&&{idempotencyKey:t[`idempotency-key`]}}))}}),ju=c({meta:{name:`wallet`,description:`Request wallet counterparty creation through the policy engine. Prints an intent envelope.`},args:Su.args,async run({args:e}){let t=Su.parse(e);await $(t)(e=>e.submitIntent({action:Du(t),...t[`idempotency-key`]!==void 0&&{idempotencyKey:t[`idempotency-key`]}}))}}),Mu=c({meta:{name:`create`,description:`Request counterparty creation through the policy engine. Without a subcommand, --name and --email create a record without payment details and send no email.`},args:bu.args,default:`email`,subCommands:{email:ku,bank:Au,wallet:ju}}),Nu=c({meta:{name:`request-details`,description:`Ask a counterparty to provide bank details, wallet details, or both through the policy engine.`},args:Cu.args,async run({args:e}){let t=Cu.parse(e);!t.bank&&!t.wallet&&X(`Select at least one of --bank or --wallet`),await $(t)(e=>e.submitIntent({action:{type:`request_counterparty_details`,counterpartyId:t.counterparty,methods:{bank:t.bank,wallet:t.wallet}},...t[`idempotency-key`]?{idempotencyKey:t[`idempotency-key`]}:{}}))}}),Pu=c({meta:{name:`counterparties`,description:`Inspect, create, and request details from counterparties`},subCommands:{list:wu,create:Mu,"request-details":Nu}}),Fu=4e3;async function Iu(){process.stdin.setEncoding(`utf8`);let e=``;for await(let t of process.stdin)e+=t;return e}async function Lu(e){return e===void 0?(process.stdin.isTTY&&X(`<message>: pass a quoted message or pipe it on stdin; a message starting with "-" needs -- before it (catena feedback -- "<message>") or stdin`),Iu()):e}const Ru=Q({message:ws({description:`Plain-text feedback (1-4000 chars); omit to pipe on stdin`}),profile:Ls,json:Rs}),zu=c({meta:{name:`feedback`,description:`Send free-form feedback about Catena to the Catena team`},args:Ru.args,async run({args:e}){(Array.isArray(e._)?e._:[]).length>1&&X(`<message>: pass the message as a single quoted argument`);let t=Ru.parse(e),n=(await Lu(t.message)).trim();n.length===0&&X(`<message>: must not be empty`),n.length>Fu&&X(`<message>: must be at most ${Fu} characters (got: ${n.length})`),await $(t)(async e=>(await e.submitFeedback(n),{ok:!0}))}});function Bu(e){return`# Catena CLI Agent Guide
+`,{encoding:`utf-8`,mode:384}),D(n,t)}function dl(e,t){al(e);let n=d.parse(el,t);Xc(n.bank_url,`profile "${e}" bank_url`);let r=cl();ul({...r,profiles:{...r.profiles,[e]:n}})}function fl(e){return e.status===`linked`}function pl(e,t){return e.replace(/\/+$/,``)===t.replace(/\/+$/,``)}function ml(e,t){let n=Object.entries(cl().profiles).toSorted(([e],[t])=>e.localeCompare(t)).find(([,n])=>fl(n)&&n.agent_id===e&&pl(n.bank_url,t));return n===void 0?null:n[0]}function hl(e,t){let n=Object.fromEntries(Object.entries(e??{}).filter(([,e])=>t(e)));return Object.keys(n).length===0?{}:{directories:n}}function gl(e){al(e);let t=cl(),{[e]:n,...r}=t.profiles;ul({version:1,...t.default_profile===e||t.default_profile===void 0?{}:{default_profile:t.default_profile},profiles:r,...hl(t.directories,t=>t!==e)})}function _l(e){try{return E(ne(e))}catch{return ne(e)}}function vl(e){return cl().directories?.[_l(e)]??null}function yl(e,t){al(t);let n=cl();if(!Object.hasOwn(n.profiles,t))throw Error(`Profile "${t}" is not linked. Run catena link --profile ${t} <agent-id>.`);let r=_l(e);return ul({...n,directories:{...n.directories,[r]:t}}),r}function bl(e){let t=cl(),n=_l(e);if(t.directories===void 0||!Object.hasOwn(t.directories,n))return{directory:n,removed:!1};let{[n]:r,...i}=t.directories,{directories:a,...o}=t;return ul({...o,...Object.keys(i).length===0?{}:{directories:i}}),{directory:n,removed:!0}}function xl(e){return al(e),cl().profiles[e]??null}function Sl(){return`client_${g(16).toString(`hex`)}`}function Cl(e,t){let n=xl(e);return t.agent_id===void 0?wl(e,t.bank_url,n):Tl(e,t.bank_url,t.agent_id,n)}function wl(e,t,n){if(n?.status===`linked`)throw Error(`Profile "${e}" is already linked. Choose a different profile name to start agent connection.`);let r=(n?.status===`pending_connection`&&pl(n.bank_url,t)?n.client_instance_id:null)??Sl();return dl(e,{status:`pending_connection`,bank_url:t,client_instance_id:r,created_at:n?.status===`pending_connection`?n.created_at:new Date().toISOString()}),r}function Tl(e,t,n,r){if(r?.status===`linked`){if(r.agent_id!==n)throw Error(`Profile "${e}" is already linked to a different agent (${r.agent_id}). Link ${n} under a different --profile, or run 'catena unlink --profile ${e}' first to repoint it (add --force if that agent's credential is missing or revoked).`);if(!pl(r.bank_url,t))throw Error(`Profile "${e}" is already linked to this agent on a different bank (${r.bank_url}). Link under a different --profile, or run 'catena unlink --profile ${e}' first (add --force if that credential is missing or revoked).`);return r.client_instance_id}let i=(r?.status===`pending_connection`&&pl(r.bank_url,t)?r.client_instance_id:null)??Sl();return dl(e,{status:`linked`,bank_url:t,agent_id:n,client_instance_id:i}),i}function El(e){al(e);let t=cl();if(!Object.hasOwn(t.profiles,e))throw Error(`Profile "${e}" is not linked. Run catena link --profile ${e} <agent-id>.`);ul({...t,default_profile:e})}function Dl(e){let t=e.toLowerCase().replace(/[^a-z0-9._-]+/g,`-`).replace(/^[^a-z0-9]+/,``).slice(0,64);return il(t)?t:`agent`}function Ol(e,t){if(!t(e))return e;for(let n=2;;n++){let r=`${e.slice(0,64-String(n).length-1)}-${n}`;if(!t(r))return r}}function kl(e){al(e.reservationName),al(e.profileName);let t=d.parse(el,e.profile);Xc(t.bank_url,`profile "${e.profileName}" bank_url`);let n=cl(),{[e.reservationName]:r,...i}=n.profiles;if(!Object.hasOwn(n.profiles,e.reservationName)||r.client_instance_id!==t.client_instance_id)throw Error(`Link reservation "${e.reservationName}" changed during setup (a concurrent link from this directory?). Re-run 'catena link'.`);if(e.profileName!==e.reservationName&&Object.hasOwn(i,e.profileName))throw Error(`Profile "${e.profileName}" already exists; cannot finalize link under that name.`);let a=Object.fromEntries(Object.entries(n.directories??{}).map(([t,n])=>[t,n===e.reservationName?e.profileName:n]));ul({version:1,...n.default_profile===void 0?{}:{default_profile:n.default_profile===e.reservationName?e.profileName:n.default_profile},profiles:{...i,[e.profileName]:t},...Object.keys(a).length===0?{}:{directories:a}})}function Al(e){return e??Kc()}async function jl(e,t){let n;try{n=xl(e.profileName)}catch(t){return{ok:!1,profileName:e.profileName,bankUrl:e.fallbackBankUrl,message:gs(t)}}if(n===null)return{ok:!1,profileName:e.profileName,bankUrl:e.fallbackBankUrl,message:`Profile "${e.profileName}" is not linked. Run 'catena link --profile ${e.profileName}' to authenticate.`};try{Xc(n.bank_url,`profile "${e.profileName}" bank_url`)}catch(t){return{ok:!1,profileName:e.profileName,bankUrl:e.fallbackBankUrl,message:gs(t)}}if(n.status===`pending_connection`)return{ok:!1,profileName:e.profileName,bankUrl:n.bank_url,message:`Profile "${e.profileName}" is waiting for agent connection approval. Run 'catena link --profile ${e.profileName}' to finish setup.`};let r;try{r=await Al(t).resolve(n.client_instance_id)}catch(t){return{ok:!1,profileName:e.profileName,bankUrl:n.bank_url,message:`Profile "${e.profileName}" credential unavailable for ${n.agent_id}: ${gs(t)}. Run 'catena link --profile ${e.profileName} ${n.agent_id}' to authenticate.`}}return r===null||r.version===`signer-1`?{ok:!1,profileName:e.profileName,bankUrl:n.bank_url,message:`Profile "${e.profileName}" credential unavailable for ${n.agent_id}. Run 'catena link --profile ${e.profileName} ${n.agent_id}' to authenticate.`}:r.version===1?{ok:!1,profileName:e.profileName,bankUrl:n.bank_url,message:`Profile "${e.profileName}" credential for ${n.agent_id} has no signing key. Run 'catena link --profile ${e.profileName} ${n.agent_id}' to authenticate.`}:{ok:!0,profileName:e.profileName,bankUrl:n.bank_url,agentId:n.agent_id,clientInstanceId:n.client_instance_id,signer:r.signer}}const Ml=`https://api.catena.com`,Nl=`CATENA_SECRET_KEY`;function Pl(e,t){let n=e[t]?.trim();return n===void 0||n.length===0?void 0:n}function Fl(e=process.env){return Pl(e,Nl)!==void 0}function Il(e=process.env){let t=Pl(e,Nl);if(t===void 0)return null;let n=Pl(e,`CATENA_API_URL`)??`https://api.catena.com`;return Xc(n,`CATENA_API_URL`),{bankUrl:n,privateKeyHex:t}}const Ll=`CATENA_PROFILE`;function Rl(e,t,n,r){if(e.directories===void 0)return null;let i;try{i=E(t)}catch{return null}let a=Object.entries(e.directories).map(([e,t])=>[e.replace(/\/+$/,``)||`/`,t]).filter(([e])=>i===e||i.startsWith(e===`/`?`/`:`${e}/`)).toSorted(([e],[t])=>t.length-e.length),o=null;for(let[t,n]of a){if(Object.hasOwn(e.profiles,n))return n;o??=`${t} -> "${n}"`}if(o===null)return null;if(n===`error`)throw Error(`This directory is bound to a profile that no longer exists (${o}). Run 'catena profiles unbind' here, bind it with 'catena profiles bind <name>', or run 'catena link' to re-establish it.`);return r?.(`profiles: ignoring stale directory binding ${o}`),null}function zl(e,t,n){if(e.flag!==void 0&&e.flag.length>0)return al(e.flag),{name:e.flag,source:`flag`};if(e.env!==void 0&&e.env.length>0){if(!il(e.env))throw Error(`${Ll} is set to an invalid profile name "${e.env}"`);return{name:e.env,source:`env`}}if(e.cwd!==void 0){let r=Rl(t,e.cwd,n,e.log);if(r!==null)return{name:r,source:`directory`}}return t.default_profile===void 0?null:{name:t.default_profile,source:`default`}}function Bl(e){return zl(e,cl(e.log),`ignore`)}function Vl(e){let t=cl(e.log),n=zl(e,t,`error`);if(n!==null)return n;let r=Object.keys(t.profiles),i=Object.entries(t.profiles).filter(([,e])=>fl(e)).map(([e])=>e);if(i.length===1){let[e]=i;return{name:e,source:`single`}}if(i.length===0){if(r.length===1){let[e]=r;return{name:e,source:`single`}}return r.length>1&&e.log?.(`profiles: ignoring ${r.length} pending profiles (${r.toSorted().join(`, `)}); none is linked`),{name:`default`,source:`fallback`}}throw Error(`Multiple profiles exist and none is selected (${i.toSorted().join(`, `)}). Pass --profile <name>, set ${Ll}, run 'catena profiles use <name>', or run 'catena link' from an agent directory to bind it.`)}function Hl(){try{return Object.entries(cl().profiles).filter(([,e])=>fl(e)).map(([e])=>e).toSorted()}catch{return[]}}function Ul(e=process.env){let t=e[Ll]?.trim();if(t!==void 0&&t.length>0)return`profiles: signing with ${Nl}; ${Ll}=${t} is ignored. Pass --profile ${t} to use that profile.`;let n=Hl();if(n.length===0)return null;let r=n.length===1?`profile`:`profiles`;return`profiles: signing with ${Nl}; ${n.length} linked ${r} ignored (${n.join(`, `)}). Pass --profile <name> to use one.`}const Wl={name:`catena-cli`,version:oe},Gl=/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;function Kl(e,t){if(!Gl.test(e))throw Error(`${t} must be a valid HTTP token`)}function ql(e,t){let n=!1;for(let t=0;t<e.length;t+=1){let r=e.charCodeAt(t);if(r<32||r===127||r>255){n=!0;break}}if(n||/[()\\]/.test(e))throw Error(`${t} must not contain parentheses, backslashes, control characters, or characters outside Latin-1`)}function Jl(e){Kl(e.name,`appInfo.name`),e.version!==void 0&&Kl(e.version,`appInfo.version`),e.url!==void 0&&ql(e.url,`appInfo.url`);let t=e.version===void 0?e.name:`${e.name}/${e.version}`;return{"User-Agent":e.url===void 0?t:`${t} (${e.url})`}}function Yl(e){return hs({baseUrl:e.bankUrl,privateKeyHex:e.signer.privateKeyHex,appInfo:Wl})}function Xl(){return Kc()}function Zl(e){try{return hs({baseUrl:e.bankUrl,privateKeyHex:e.privateKeyHex,appInfo:Wl})}catch(e){return X(`${Nl} is not usable: ${gs(e)}`)}}async function Ql(e){if(e===void 0){let e;try{e=Il()}catch(e){return X(e)}if(e!==null){let t=Ul();return t!==null&&console.error(t),Zl(e)}}let t;try{t=Vl({flag:e,env:process.env[Ll],cwd:process.cwd(),log:e=>console.error(e)}).name}catch(e){return X(e)}let n=await jl({profileName:t,fallbackBankUrl:Ml},void 0);return n.ok||X(n.message),Yl(n)}const $l=new Set([`unknown_key`,`key_revoked`,`client_unlinked`]),eu=new Set([`signature_auth_disabled`,`missing_auth`]);function tu(e,t,n=process.env){if(!(e instanceof ss)||e.code===void 0)return e;let r=t===void 0?`catena link`:`catena link --profile ${t}`;return $l.has(e.code)?t===void 0&&Fl(n)?Error(`The bank rejected the ${Nl} signing key (${e.code}). Create a secret key in the Catena console under the agent's Secret keys tab, then update ${Nl}.`):Error(`This machine's signing key was rejected by the bank (${e.code}). Run '${r}' to re-authenticate.`):e.code===`client_upgrade_required`?Error(`This CLI version (${Wl.version}) is no longer supported by the bank. Run 'npm i -g @catena/cli' and retry.`):eu.has(e.code)?Error(`This bank does not support key-based authentication (${e.code}). Upgrade the bank, or use an older CLI release that authenticates with session tokens.`):e.code===`invalid_signature`&&e.message.includes(`created_out_of_window`)?Error(`The bank rejected this request's timestamp (created_out_of_window). Check this machine's system clock and retry.`):e}function nu(e,t){console.log(t?.compact?JSON.stringify(e):JSON.stringify(e,null,2))}function ru(e){return e.profile===void 0||e.profile.length===0?void 0:e.profile}async function iu(e,t){try{return await t(await Ql(e))}catch(t){return X(tu(t,e))}}function au(e,t){return async(n,r)=>{let i=await iu(e,n);return nu(i,t),await new Promise(e=>{process.stdout.write(``,()=>e())}),process.exit(r?.exitCode?r.exitCode(i):0)}}function $(e){return au(ru(e),{compact:e.json===!0})}const ou=d.pipe(d.string(),d.regex(/^\d+$/,`must be a non-negative integer`),d.transform(Number),d.maxValue(2**53-1,`must be at most ${2**53-1}`)),su=d.pipe(ou,d.maxValue(200,`must be at most 200`)),cu={profile:Ls,json:Rs},lu=Q(cu),uu=Q({account:ws({description:`Account id`,required:!0,schema:Bs}),...cu}),du=Q({account:ws({description:`Account id`,required:!0,schema:Bs}),start:Z({description:`Only include transactions at or after this ISO 8601 time`}),end:Z({description:`Only include transactions at or before this ISO 8601 time`}),limit:Z({description:`Maximum transactions to return (default 50, max 200)`,schema:su}),offset:Z({description:`Number of transactions to skip for pagination`,schema:ou}),...cu}),fu=Q({account:ws({description:`Account id`,required:!0,schema:Bs}),network:oc({description:`Deposit network; defaults to ${ic}. Availability depends on the connected environment.`,default:ic}),asset:Ds({description:`Deposit asset (${rc.join(`|`)})`,choices:rc,default:`usdc`}),...cu}),pu=c({meta:{name:`list`,description:`List accounts accessible under the agent's policy`},args:lu.args,async run({args:e}){await $(lu.parse(e))(e=>e.listAccounts())}}),mu=c({meta:{name:`balance`,description:`Request an account balance through the policy engine`},args:uu.args,async run({args:e}){let t=uu.parse(e);await $(t)(e=>e.getAccountBalance(t.account))}}),hu=c({meta:{name:`transactions`,description:`Read an account's transaction history through the policy engine`},args:du.args,async run({args:e}){let t=du.parse(e);await $(t)(e=>e.listAccountTransactions(t.account,{start:t.start,end:t.end,limit:t.limit,offset:t.offset}))}}),gu=c({meta:{name:`deposit-address`,description:`Read an account deposit address through the policy engine`},args:fu.args,async run({args:e}){let t=fu.parse(e);await $(t)(e=>e.getAccountDepositAddress(t.account,{network:t.network,asset:t.asset}))}}),_u=c({meta:{name:`accounts`,description:`Inspect bank accounts`},subCommands:{list:pu,balance:mu,transactions:hu,"deposit-address":gu}}),vu=d.pipe(d.string(`Idempotency key must be a string`),d.minLength(1,`Idempotency key must not be empty`),d.maxLength(255,`Idempotency key is too long (max 255 characters)`)),yu=d.pipe(d.string(),d.minLength(1,`must not be empty`)),bu=d.pipe(d.string(),d.trim(),d.email(`must be a valid email address`)),xu={profile:Ls,json:Rs},Su=Q({address:Z({description:`Only counterparties with a wallet rail matching this address (0x…)`,schema:ac}),network:oc({description:`Only counterparties with a wallet rail on this network (e.g. base)`}),...xu}),Cu=Z({description:`Counterparty name`,required:!0,schema:yu}),wu=Z({description:`Optional contact email`,schema:bu}),Tu=Z({description:`Optional operation key. Reuse the same value only when retrying the same submission; omitted generates a fresh key for this invocation.`,schema:vu}),Eu=Q({name:Cu,email:Z({description:`Contact email; creating the counterparty sends no email`,required:!0,schema:bu}),"idempotency-key":Tu,...xu}),Du=Q({name:Z({description:`Counterparty name; required without a subcommand`,schema:yu}),email:Z({description:`Contact email; required without a subcommand; creating the counterparty sends no email`,schema:bu}),"idempotency-key":Tu,...xu}),Ou=Q({name:Cu,"bank-name":Z({description:`Receiving bank name`,required:!0,schema:yu}),"routing-number":Z({description:`9-digit ABA routing number`,required:!0,schema:yu}),"account-number":Z({description:`Receiving bank account number`,required:!0,schema:yu}),"account-type":Ds({description:`checking | savings (default checking)`,choices:[`checking`,`savings`]}),"address-street":Z({description:`Street address of the receiving bank account holder`,required:!0,schema:yu}),"address-city":Z({description:`City`,required:!0,schema:yu}),"address-state":Z({description:`State (e.g. NY)`,required:!0,schema:yu}),"address-postal-code":Z({description:`Postal code`,required:!0,schema:yu}),"address-country":Z({description:`Default USA`}),email:wu,"idempotency-key":Tu,...xu}),ku=Q({name:Cu,address:Z({description:`Wallet address (0x… or ENS name on EVM networks)`,required:!0,schema:yu}),network:oc({description:`Wallet network; defaults to ${ic}. Availability depends on the connected environment.`,default:ic}),email:wu,"idempotency-key":Tu,...xu}),Au=Q({counterparty:ws({description:`Counterparty id`,required:!0,schema:Bs}),bank:Es({description:`Request bank account details`,default:!1}),wallet:Es({description:`Request wallet details`,default:!1}),"idempotency-key":Tu,...xu}),ju=c({meta:{name:`list`,description:`List counterparties available under the agent's policy`},args:Su.args,async run({args:e}){let t=Su.parse(e);await $(t)(e=>e.listCounterparties({address:t.address,network:t.network}))}});function Mu(e){return e&&e.length>0?e:void 0}function Nu(e){let t=Mu(e.email);return{type:`create_counterparty`,name:e.name,email:t,rail:{type:`bank`,bankName:e[`bank-name`],routingNumber:e[`routing-number`],accountNumber:e[`account-number`],addressStreet:e[`address-street`],addressCity:e[`address-city`],addressState:e[`address-state`],addressPostalCode:e[`address-postal-code`],...e[`account-type`]?{accountType:e[`account-type`]}:{},...e[`address-country`]?{addressCountry:e[`address-country`]}:{}}}}function Pu(e){let t=Mu(e.email);return{type:`create_counterparty`,name:e.name,email:t,rail:{type:`wallet`,walletAddress:e.address,network:e.network}}}function Fu(e){return{type:`create_counterparty`,name:e.name,email:e.email}}const Iu=c({meta:{name:`email`,description:`Create a counterparty with an email and no payment details. Sends no email.`},args:Eu.args,async run({args:e}){let t=Eu.parse(e);await $(t)(e=>e.submitIntent({action:Fu(t),...t[`idempotency-key`]!==void 0&&{idempotencyKey:t[`idempotency-key`]}}))}}),Lu=c({meta:{name:`bank`,description:`Request bank counterparty creation through the policy engine. Prints an intent envelope.`},args:Ou.args,async run({args:e}){let t=Ou.parse(e),n=Nu(t);await $(t)(e=>e.submitIntent({action:n,...t[`idempotency-key`]!==void 0&&{idempotencyKey:t[`idempotency-key`]}}))}}),Ru=c({meta:{name:`wallet`,description:`Request wallet counterparty creation through the policy engine. Prints an intent envelope.`},args:ku.args,async run({args:e}){let t=ku.parse(e);await $(t)(e=>e.submitIntent({action:Pu(t),...t[`idempotency-key`]!==void 0&&{idempotencyKey:t[`idempotency-key`]}}))}}),zu=c({meta:{name:`create`,description:`Request counterparty creation through the policy engine. Without a subcommand, --name and --email create a record without payment details and send no email.`},args:Du.args,default:`email`,subCommands:{email:Iu,bank:Lu,wallet:Ru}}),Bu=c({meta:{name:`request-details`,description:`Ask a counterparty to provide bank details, wallet details, or both through the policy engine.`},args:Au.args,async run({args:e}){let t=Au.parse(e);!t.bank&&!t.wallet&&X(`Select at least one of --bank or --wallet`),await $(t)(e=>e.submitIntent({action:{type:`request_counterparty_details`,counterpartyId:t.counterparty,methods:{bank:t.bank,wallet:t.wallet}},...t[`idempotency-key`]?{idempotencyKey:t[`idempotency-key`]}:{}}))}}),Vu=c({meta:{name:`counterparties`,description:`Inspect, create, and request details from counterparties`},subCommands:{list:ju,create:zu,"request-details":Bu}}),Hu=4e3;async function Uu(){process.stdin.setEncoding(`utf8`);let e=``;for await(let t of process.stdin)e+=t;return e}async function Wu(e){return e===void 0?(process.stdin.isTTY&&X(`<message>: pass a quoted message or pipe it on stdin; a message starting with "-" needs -- before it (catena feedback -- "<message>") or stdin`),Uu()):e}const Gu=Q({message:ws({description:`Plain-text feedback (1-4000 chars); omit to pipe on stdin`}),profile:Ls,json:Rs}),Ku=c({meta:{name:`feedback`,description:`Send free-form feedback about Catena to the Catena team`},args:Gu.args,async run({args:e}){(Array.isArray(e._)?e._:[]).length>1&&X(`<message>: pass the message as a single quoted argument`);let t=Gu.parse(e),n=(await Wu(t.message)).trim();n.length===0&&X(`<message>: must not be empty`),n.length>Hu&&X(`<message>: must be at most ${Hu} characters (got: ${n.length})`),await $(t)(async e=>(await e.submitFeedback(n),{ok:!0}))}});function qu(e){return`# Catena CLI Agent Guide
 
 CLI version: ${e}
 
-Examples below use \`catena\`. If it is not on PATH, or a command warns that a
-newer version is available, run \`npm i -g @catena/cli\`. Every non-\`link\`
-command resolves credentials from the selected profile and prints JSON on
-stdout; errors and upgrade notices go to stderr. The \`guide\` command is
-documentation, so it prints this Markdown guide on stdout.
+Examples below use \`catena\`. Run \`npm i -g @catena/cli\` if \`catena\` is not
+on PATH, or if a command warns that a newer version exists.
 
-The stored credential is a per-profile signing key: the CLI signs every request
-with it, so there are no sessions to expire or refresh. When the bank rejects
-the key, the error says to run \`catena link\`; follow it rather than retrying.
+Every command except \`link\` reads its credential from the selected profile.
+Each one prints JSON on stdout. Errors and upgrade notices go to stderr.
 
-Every command supports \`--help\`; use it for exact syntax, choices, and
-defaults rather than guessing. This guide covers what \`--help\` cannot: when to
-run each command, how ids flow between them, and how to read the results.
+Two roles appear in this guide. The **user** is the person who gives you
+instructions. An **operator** is a person who can sign in to the Catena console
+and approve requests. They are often the same person.
+
+The stored credential is one signing key for each profile. The CLI signs every
+request with that key. No session expires, and nothing refreshes. If the bank
+rejects the key, the error tells you to run \`catena link\`. Obey the error. Do
+not retry the command first. A host that sets \`CATENA_SECRET_KEY\` gets
+different guidance and must not run \`link\`. See Hosts Without a Keychain.
+
+Use \`<command> --help\` for exact syntax, choices, and defaults. Do not guess.
+This guide gives what \`--help\` cannot: when to run each command, how ids move
+between commands, and how to read the results.
 
 ## Setup
 
-1. Run \`catena whoami\`. If it returns an agent, you are
-   linked and can continue.
-2. Otherwise run \`link\`. There are three flows:
-   - Link an existing agent on the customer's own machine: ask the customer for
-     the agent id (\`agent_...\`) shown in the Catena console, then run
-     \`catena link <agent-id>\`. A browser opens for approval
-     and writes the profile on success.
-   - Create a new agent: run \`catena link\` with no agent id.
-     The CLI starts a console approval flow and prints a verification URL and
-     short code. Relay both to the customer to approve in the Catena console.
-     Add \`--name "Agent name"\` to suggest a name for the new agent.
-   - Remote or headless: \`catena link <agent-id> --no-browser\`
-     uses the device-code flow. Relay the printed URL and code, and keep the
-     command running until the customer approves from their own device.
-
-\`--bank-url\` defaults to \`$CATENA_API_URL\` or production. Re-run \`link\`
-after denial or revocation, when a command reports the bank rejected this
-machine's signing key, and if a send or transfer fails with a local-signer
-error. Failures that relinking does not fix: a timestamp error
-(\`created_out_of_window\`) means this machine's clock is wrong; a bank
-that does not support key-based authentication needs a bank upgrade or an
-older CLI release; and an upgrade-required error
-(\`client_upgrade_required\`) means the bank no longer accepts this CLI
-version — run \`npm i -g @catena/cli\` and retry. A successful \`link\`
-names the profile after the agent when no profile is selected, and binds the
-working directory to it (the home
-directory is never bound), so later commands in that directory select the same
-agent automatically.
-
-\`catena unlink\` disconnects the selected profile. Add
-\`--profile <name>\` to target another profile. Add \`--force\` to clear a
-profile locally without contacting the server when its credential is missing,
-revoked, or a link was interrupted.
-
-## Deployed services (humans only)
-
-\`link --service\` provisions a signing credential for an agent deployed to a
-hosted runtime (Vercel, Cloudflare Workers, a server): approval registers a
-P-256 public key, no session tokens are minted, and nothing is written to this
-machine. It prints the signing-key thumbprint before approval and prints the
-env vars for the deployment once. Add
-\`--public-key <hex>\` when the deployment already generated its own keypair.
-Re-running with the same key is idempotent: it reuses the existing link and
-re-drives wallet-send signer registration, the recovery path when the org was
-not signing-ready at link time. Pass the linked agent ID as the final argument
-when re-running for recovery.
-This is a human setup wizard for deploying services — an agent running
-interactively (MCP, CLI, terminal) must use plain \`link\`, never
+1. Run \`catena whoami\`. If it returns an agent, you are linked. Continue.
+2. If it does not, run \`link\`. There are three flows:
+   - **An existing agent, on the user's own machine.** Ask the user for the
+     agent id (\`agent_...\` in the Catena console). Run
+     \`catena link <agent-id>\`. A browser opens for approval. The CLI writes
+     the profile after approval.
+   - **A new agent.** Run \`catena link\` with no agent id. The CLI prints a
+     verification URL and a short code. Give both to the user, who approves in
+     the Catena console. Add \`--name "Agent name"\` to suggest a name for the
+     new agent.
+   - **A remote or headless machine.** Run
+     \`catena link <agent-id> --no-browser\`. This uses the device-code flow.
+     Give the printed URL and code to the user. Keep the command running until
+     the user approves from their own device.
+
+Run \`link\` again in three cases: after a denial or a revocation, after a
+command reports that the bank rejected this machine's signing key, and after a
+send or transfer fails with a local-signer error.
+
+Three failures do not improve after you run \`link\` again:
+
+- \`created_out_of_window\`. The clock on this machine is wrong.
+- The bank does not support key-based authentication. It needs an upgrade, or
+  you need an older CLI release.
+- \`client_upgrade_required\`. The bank no longer accepts this CLI version. Run
+  \`npm i -g @catena/cli\`, then try again.
+
+\`link\` names the profile after the agent when no profile is selected. It also
+binds the working directory to that profile, but it never binds the home
+directory. Later commands in that directory then select the same agent.
+
+\`catena unlink\` disconnects the selected profile. Add \`--profile <name>\` to
+target a different profile. Add \`--force\` to clear a profile on this machine
+without a call to the server. Use \`--force\` when the credential is missing or
+revoked, or when a link stopped part way.
+
+## Hosts Without a Keychain
+
+A container, a CI job, or a serverless runtime has no OS keychain and no
+browser. \`link\` cannot store a credential there. Set \`CATENA_SECRET_KEY\` to
+the agent's P-256 secret key instead. Each command then signs with that key and
+reads no profile. The host runs no link step.
+
+An operator makes the key in the Catena console. They open the agent, select
+the \`Secret keys\` tab, then select \`Create secret key\`. The console shows the
+key one time. \`link --service\` prints the same value for a deployment.
+
+\`CATENA_SECRET_KEY\` has a higher rank than every profile tier below. An
+explicit \`--profile\` still wins. A workstation that exports a key can thus
+also drive a linked profile.
+
+On a machine that also holds a linked profile or sets \`CATENA_PROFILE\`, each
+command prints one line to stderr. The line names \`CATENA_SECRET_KEY\` as the
+signing credential and gives the \`--profile\` flag to use a profile instead.
+Stdout keeps only the command result.
+
+\`unlink\` does not apply to this credential, and it tells you so. An operator
+must revoke the key in the Catena console. Only \`unlink --force\` still runs,
+because it clears a profile on this machine and never signs.
+
+If the bank rejects the key, the error names \`CATENA_SECRET_KEY\`. Ask an
+operator for a new key, then set the variable again. Do not run \`link\` to
+repair this credential.
+
+While the key is set, \`profiles current\` reports the credential and not a
+profile. \`.source\` is \`"secret-key"\`, \`.credential\` names the variable, and
+\`.bankUrl\` gives the target bank. The \`.profile\` and \`.agentId\` fields are
+absent. \`profiles list\` adds \`.shadowedBy\` and reports \`current: false\`
+for every profile.
+
+## Deployed Services (Humans Only)
+
+\`link --service\` makes a signing credential for an agent on a hosted runtime,
+such as Vercel, Cloudflare Workers, or a server. Approval registers a P-256
+public key. The flow makes no session token and writes nothing to this machine.
+
+The command prints the signing-key thumbprint before approval. It then prints
+\`CATENA_SECRET_KEY\` one time. That variable is the whole credential. The
+command also prints the public key as a record to keep, not as a variable to
+set. Add \`--public-key <hex>\` when the deployment already made its own
+keypair.
+
+A second run with the same key is safe. It uses the existing link again, and it
+registers the wallet-send signer again. This is how you recover when the
+organization was not signing-ready at the time of the link. Give the linked
+agent ID as the final argument when you run the command for recovery.
+
+This is a setup wizard for an operator. An agent that runs interactively
+through MCP, a CLI, or a terminal must use plain \`link\`. It must never use
 \`--service\`.
 
 ## Profiles
 
-One machine can hold several linked agents, each as a named profile. A profile
-binds to a single agent: re-running \`link\` on a profile only re-links its own
-agent; linking a different agent into an existing profile is refused, so choose
-a new profile name or reset the old one with
+One machine can hold several linked agents. Each one is a named profile. A
+profile binds to a single agent. A second \`link\` on a profile links only that
+same agent again. The CLI refuses a different agent in an existing profile.
+Choose a new profile name, or clear the old profile with
 \`unlink --profile <name> --force\`.
 
-Every credentialed command selects its profile through the same chain, first
-match wins (\`link\` differs: it binds only on \`--profile\` or the directory
-binding and otherwise derives a name from the agent):
+A set \`CATENA_SECRET_KEY\` bypasses the chain below, unless the command also
+passes \`--profile\`. See Hosts Without a Keychain.
+
+Every command that needs a credential selects its profile through this chain.
+The first tier that gives a name wins. \`link\` is different: it binds only on
+\`--profile\` or on the directory binding, and it otherwise makes a name from
+the agent.
 
 1. \`--profile <name>\` on the command.
 2. \`$CATENA_PROFILE\`.
@@ -225,9 +276,9 @@ binding and otherwise derives a name from the agent):
 5. The only linked profile, when exactly one is linked (even if pending
    profiles also exist).
 
-When several profiles exist and none is selected, credentialed commands fail
-with the profile list instead of guessing an agent identity; select one with
-any tier above. Manage profiles with:
+If several profiles exist and no tier selects one, the command fails and prints
+the profile list. It never guesses an agent identity. Select a profile with any
+tier above. Manage profiles with these commands:
 
     catena profiles current
     catena profiles list
@@ -235,22 +286,22 @@ any tier above. Manage profiles with:
     catena profiles bind <name> [path]
     catena profiles unbind [path]
 
-\`profiles current\` reports which tier selected the profile on \`.source\`.
-\`profiles list\` shows each profile's bound directories. \`bind\` and
-\`unbind\` default to the working directory, and the profile must already
-exist (a pending, not-yet-linked profile is fine).
+\`profiles current\` reports the tier that selected the profile on \`.source\`.
+\`profiles list\` shows the bound directories of each profile. \`bind\` and
+\`unbind\` use the working directory by default. The profile must already exist.
+A pending profile that is not yet linked is acceptable.
 
-Agent hosts should pin identity explicitly by exporting \`CATENA_PROFILE\`
-(\`link\` prints the exact value on success) rather than relying on the
-directory binding: the env var follows the agent wherever it changes
-directory, while bindings are a convenience for interactive use.
+An agent host must pin its identity: export \`CATENA_PROFILE\`, which \`link\`
+prints after a successful link. Do not depend on the directory binding. The
+environment variable follows the agent to every directory. A binding is only a
+convenience for interactive use.
 
 ## Reads Before Money Movement
 
-Run \`accounts list\` when choosing an explicit send source or making a
-transfer. Account ids (\`acct_...\`) feed \`--account\`, \`--from\`, or \`--to\`.
-For sends, run \`counterparties list\`;
-\`--rail\` takes a rail id (\`cprl_...\`), not a counterparty id.
+Run \`accounts list\` before you choose an explicit send source, and before a
+transfer. Account ids (\`acct_...\`) go into \`--account\`, \`--from\`, or
+\`--to\`. Run \`counterparties list\` before a send. \`--rail\` takes a rail id
+(\`cprl_...\`), not a counterparty id.
 
 Direct per-account reads are plain reads, not intents:
 
@@ -258,22 +309,19 @@ Direct per-account reads are plain reads, not intents:
     catena accounts transactions acct_...
     catena accounts deposit-address acct_...
 
-\`accounts transactions\` returns \`.transactions[]\` newest first plus a
-\`.total\` count. Page with \`--limit\` and \`--offset\`. A transaction's
-\`status\` is separate from intent status; use it to confirm a movement settled.
-\`accounts deposit-address\` returns the account's on-chain funding address on
-\`.address\`. \`policy show\` prints the linked agent's policy when the user asks
-about access.
-
-Available networks depend on the connected environment, and \`--network\` must
-match the account's own network. Production serves \`base\`; non-production
-environments may also serve testnet rails such as \`base-sepolia\`. A network
-the connected environment does not enable fails with a server error listing the
-enabled networks. Requesting a
-network the account is not on fails with a configured-network error. No command
-returns an account's network directly: default to \`base\`, and on a
-configured-network error retry with another enabled network rather than
-inventing one.
+\`accounts transactions\` returns \`.transactions[]\` with the newest first, and
+a \`.total\` count. Use \`--limit\` and \`--offset\` to read more pages. The
+\`status\` of a transaction is not the status of an intent. Read it to confirm
+that money moved. \`accounts deposit-address\` returns the on-chain funding
+address of the account on \`.address\`. Run \`policy show\` when the user asks
+what the agent can do.
+
+\`--network\` must match the network of the account. A bank does not always
+enable every network. A network that the bank does not enable fails with a
+server error that lists the enabled networks. A network that the account is not
+on fails with a configured-network error. No command returns the network of an
+account. Use \`base\` by default. After either error, run the command again with
+a network that the error names. Do not invent a network.
 
 ## Counterparties
 
@@ -283,98 +331,102 @@ saved:
     catena counterparties list \\
       --address 0x... --network base
 
-Both filters must hold on the same rail, so an address saved on another
-network is not a match. A match returns the whole counterparty; reuse the
-\`rails[].id\` (\`cprl_...\`) of the rail whose \`walletAddress\` and
-\`network\` match rather than creating a duplicate. An empty
-\`counterparties\` array means no counterparty visible to this agent has that
-rail (one outside the agent's allow-list stays hidden); bad input errors
-rather than returning an empty list. \`--address\` accepts only 0x hex
-addresses: an ENS name errors, and a rail saved under an ENS name is not
-matched by its resolved address.
+Both filters must agree on the same rail. An address saved on a different
+network is not a match. A match returns the full counterparty. Use the
+\`rails[].id\` (\`cprl_...\`) of the rail whose \`walletAddress\` and \`network\`
+both match. Do not make a duplicate.
+
+An empty \`counterparties\` array means that no counterparty you can see holds
+that rail. A counterparty outside the allow-list of the agent stays hidden. Bad
+input gives an error, not an empty list. \`--address\` accepts only 0x hex
+addresses. An ENS name gives an error. A rail saved under an ENS name does not
+match its resolved address.
 
-Create an email-only counterparty directly when the user does not have payment
-details yet:
+Make an email-only counterparty when the user does not yet have payment
+details:
 
     catena counterparties create \\
       --name "Acme Vendor" --email billing@acme.test
 
-This saves a counterparty with \`status: "awaiting_details"\` and \`rails: []\`,
-so it cannot receive a send. It does not send an email or request payment
-details. Do not imply otherwise to the user. The explicit
-\`counterparties create email\` form is equivalent.
+This saves a counterparty with \`status: "awaiting_details"\` and \`rails: []\`.
+It cannot receive a send. The command sends no email, and it requests no
+payment details. Do not tell the user anything different. The
+\`counterparties create email\` form does the same thing.
 
-Use the \`bank\` or \`wallet\` subcommand when payment details are available.
-Use the rail-specific help for exact required fields, choices, and defaults:
+Use the \`bank\` or \`wallet\` subcommand when you have payment details. Use the
+help of that subcommand for the necessary fields, choices, and defaults:
 
     catena counterparties create bank --help
     catena counterparties create wallet --help
 
-Pass destination details from the user. Do not invent missing routing, account,
-address, wallet, network, or contact details.
+Use the destination details that the user gives you. Do not invent a routing
+number, an account number, an address, a wallet, a network, or a contact.
 
-When an existing counterparty has an email but no usable payment details, ask
-for bank details, wallet details, or both:
+If a counterparty has an email but no usable payment details, ask for bank
+details, wallet details, or both:
 
     catena counterparties request-details cp_... --bank
 
-Pass at least one of \`--bank\` or \`--wallet\`. The request goes through policy
-and may wait for human approval. It returns before the counterparty responds;
-use \`intents get <id>\` to follow the intent and \`counterparties list\` to see
-details after they are provided.
+Give at least one of \`--bank\` or \`--wallet\`. Policy examines the request, and
+the request can wait for approval by an operator. The command returns before
+the counterparty answers. Use \`intents get <id>\` to follow the intent. Use
+\`counterparties list\` to read the details after the counterparty gives them.
 
-All forms return an intent envelope. When \`.status\` is \`completed\`, the new
-counterparty is on \`.data.counterparty\`; a rail-specific creation also returns
-its \`rails[].id\` for a follow-up send. Creation routed to approval is
-\`pending\`; re-check with \`intents get\`.
+Every form returns an intent envelope. When \`.status\` is \`completed\`, read
+the new counterparty on \`.data.counterparty\`. A rail-specific form also
+returns its \`rails[].id\` for a send that comes after. A creation that goes to
+approval is \`pending\`. Read it again with \`intents get\`.
 
 ## Timeouts and Safe Retries
 
-Each HTTP exchange times out after 80 seconds by default, from request dispatch
-through response-body validation; local request signing happens before that
-clock starts. A timeout means the client stopped waiting, not that the server
-did no work.
+Each HTTP exchange stops after 80 seconds by default. The clock starts when the
+command sends the request. It stops after the command checks the response body.
+The CLI signs the request before that clock starts. A timeout means that the
+client stopped waiting. It does not mean that the server did no work.
 
-Read-only commands are safe to run again. Intent commands generate a fresh UUID
-when \`--idempotency-key\` is omitted: identical inputs do not identify a retry.
-For recovery across invocations, choose and save a key before the first attempt,
-then reuse it with unchanged inputs for the same agent. Changed inputs with the
-same key return 409; use a new key for a new operation. Without a saved key,
-reconcile an ambiguous submission before repeating it.
+A read-only command is safe to run again. An intent command makes a new UUID
+when you omit \`--idempotency-key\`. The same inputs alone do not identify a
+retry. To recover across two commands, choose a key and save it before the first
+attempt. Then use that key again, with the same inputs and the same agent.
+Different inputs with the same key return 409. Use a new key for a new
+operation. Without a saved key, reconcile an unclear submission before you
+repeat it.
 
 A same-key retry keeps the original source account, even after a policy change.
 Without an explicit source, new operations use the current policy.
 
-Payment errors override the general same-key retry advice:
+Three payment errors replace the same-key rule above:
 
-- "Already prepared" (409 \`wallet_send_intent_not_executing\`): the original
-  wallet signing body cannot be recovered. Check \`intents get <id>\` if you
-  have the id; otherwise ask an operator to reconcile it. Do not bypass this
+- **"Already prepared"** (409 \`wallet_send_intent_not_executing\`). You cannot
+  recover the original wallet signing body. Run \`intents get <id>\` if you have
+  the id. If you do not, ask an operator to reconcile it. Do not get past this
   error with a new key.
-- "Created but never submitted; no money moved": fix the reported problem,
-  then use a new key (omit the flag or supply a different value). The original
-  key cannot restart signing.
-- "Could not be confirmed": poll \`intents get <id>\` even if you saved the
-  key. Submit again only after \`blocked\` or \`failed\`; see Intents below.
-
-A bare x402 or MPP create-phase timeout is before payment authorization and is
-safe to retry. An unconfirmed payment follows the polling rule above. If
-\`.paid\` and \`.retryFailed\` are set, the payment already completed. For x402,
-recover the \`PAYMENT-SIGNATURE\` as described below. For MPP, inspect the intent
-with \`intents get <id>\` and do not pay again blindly.
+- **"Created but never submitted; no money moved."** Correct the problem in the
+  message. Then use a new key: omit the flag, or give a different value. The
+  original key cannot start the signing again.
+- **"Could not be confirmed."** Read \`intents get <id>\` again and again, even
+  if you saved the key. Submit again only after \`blocked\` or \`failed\`. See
+  Intents below.
+
+An x402 or MPP timeout in the create phase happens before the payment gets
+authorization. That timeout is safe to retry. An unconfirmed payment obeys the
+rule above. If \`.paid\` and \`.retryFailed\` are both set, the payment already
+finished. For x402, recover the \`PAYMENT-SIGNATURE\` as shown below. For MPP,
+examine the intent with \`intents get <id>\`. Do not pay a second time before
+you do this.
 
 ## Money Movement
 
 \`send\` submits a USD send to a counterparty rail. \`transfer\` moves USD
 between two of the agent's own accounts.
 
-Before either:
+Do these three things before either command:
 
-- Confirm the user explicitly provided the amount and destination details.
-- Use rail ids from \`counterparties list\` and explicit account ids from
+- Confirm that the user gave you the amount and the destination details.
+- Use rail ids from \`counterparties list\`, and explicit account ids from
   \`accounts list\`.
-- USD only. Pass \`--amount\` as a plain decimal string such as \`100.50\`. Do
-  not use scientific notation or signed values.
+- Use USD only. Give \`--amount\` as a plain decimal string, such as \`100.50\`.
+  Do not use scientific notation. Do not use a sign.
 
 Examples:
 
@@ -383,143 +435,172 @@ Examples:
     catena transfer --from acct_... --to acct_... \\
       --amount 125.00
 
-\`--method\` must match the rail type: \`ach\` and \`wire\` require a bank
-rail, \`on-chain\` requires a wallet rail. A mismatch fails with
-\`rail_method_mismatch\`. See \`--help\` for memo and description flags.
+\`--method\` must match the rail type. \`ach\` and \`wire\` need a bank rail.
+\`on-chain\` needs a wallet rail. A wrong pair fails with
+\`rail_method_mismatch\`. See \`--help\` for the memo and description flags.
 
 An intent's source account stays fixed through approval.
 
-Both create the intent and return immediately. There is no wait or poll flag.
-The command exits 0 once the intent is submitted even if the intent is later
-blocked, pending, or failed. Always read \`.status\` and \`.reasons\` on the
-returned envelope, then follow up with \`intents get <id>\` for anything not
-already \`completed\`.
+Both commands make the intent and return immediately. There is no flag to wait
+or to poll. The command exits 0 after it submits the intent, even if the intent
+becomes blocked, pending, or failed later. Always read \`.status\` and
+\`.reasons\` on the envelope. Then run \`intents get <id>\` for every intent that
+is not yet \`completed\`.
 
 ## Paying x402 (HTTP 402) Endpoints
 
-\`x402\` fetches a URL and, when the server answers 402 with an x402 v2
-challenge, pays it in USDC from a non-custodial wallet account, then retries
-the request with the payment attached:
+\`x402\` fetches a URL. If the server answers 402 with an x402 v2 challenge, the
+command pays it in USDC from a non-custodial wallet account. It then sends the
+request again with the payment attached:
 
     catena x402 --url https://api.example.com/paid \\
       --account acct_... --max-amount 0.25
 
-\`x402\` manages its own keys, generating a fresh one per payment challenge
-attempt. Re-running after success can pay again, even for the same URL and price.
+\`x402\` manages its own keys. It makes a new key for each payment attempt. A
+second run after a success can pay a second time, even for the same URL and the
+same price.
 
-To POST a request body (e.g. an OpenAI-compatible chat-completions call), pass
-\`--data\`; it implies \`POST\` and a JSON content type unless overridden with
-\`--method\` / \`--content-type\`. Use \`@path\` to read the body from a file or
-\`@-\` for stdin:
+To send a request body, such as an OpenAI-compatible chat-completions call, pass
+\`--data\`. That flag selects \`POST\` and a JSON content type. \`--method\` and
+\`--content-type\` override those two defaults. Use \`@path\` to read the body
+from a file, or \`@-\` to read it from stdin:
 
     catena x402 --url https://api.example.com/chat \\
       --account acct_... --max-amount 0.05 \\
       --data '{"model":"...","messages":[{"role":"user","content":"hi"}]}'
 
-If the endpoint needs extra request headers, pass them with repeatable
-\`--header "Name: Value"\` flags (curl -H style); each is sent on both the
-initial request and the paid retry. \`PAYMENT-SIGNATURE\` cannot be set this
-way — the payment loop attaches it itself after paying.
-
-Constraints: the source account must be a wallet account on the challenge's
-network (a mainnet wallet cannot pay a testnet challenge and vice versa). If it
-is not, nothing is charged: the result carries \`.networkMismatch\`
-(\`.requiredNetworks\` as onchain slugs like \`base\`, \`.requiredNetworkIds\` as
-the raw CAIP-2 ids) and the command exits non-zero — re-run with \`--account\`
-set to a wallet on one of those networks (account ids are in \`accounts list\`).
-The challenge's \`payTo\` address must also already exist as a saved counterparty
-wallet rail — Catena never auto-adds it (a 402's \`payTo\` is untrusted), so
-creating one stays a deliberate, policy-gated step. You can precheck with
+If the endpoint needs more request headers, pass each one with a
+\`--header "Name: Value"\` flag, in the style of \`curl -H\`. You can repeat the
+flag. The CLI sends each header on the first request and on the paid request.
+You cannot set \`PAYMENT-SIGNATURE\` this way. The payment loop attaches that
+header itself after it pays.
+
+**The account and the network must match.** The source account must be a wallet
+account on the network of the challenge. If it is not, the CLI charges nothing
+and exits non-zero. The result carries \`.networkMismatch\`, which holds
+\`.requiredNetworks\` as onchain slugs such as \`base\`, and
+\`.requiredNetworkIds\` as the raw CAIP-2 ids. Run the command again with
+\`--account\` set to a wallet on one of those networks. \`accounts list\` gives
+the account ids.
+
+**The recipient must be a saved counterparty.** The \`payTo\` address of the
+challenge must already exist as a counterparty wallet rail. Catena never adds it
+for you, because the \`payTo\` of a 402 response is untrusted. Making it stays a
+deliberate step, and policy examines it.
+
+You can check first with
 \`counterparties list --address <payTo> --network <network>\`, but you do not
-need the address up front: if it is unsaved, nothing is charged and the result
-carries \`.counterpartyNotFound\` (\`payTo\`, \`network\` slug, \`networkId\`,
-\`serviceName\` when advertised, \`.nameIsPlaceholder\`, and \`.createCommand\`
-— the \`counterparties create wallet\` command to run, also embedded in
-\`.error\` for humans), and the command exits non-zero. When
-\`.nameIsPlaceholder\` is false the \`--name\` in that command is the endpoint's
-own advertised name: it is unverified, so confirm it names a service you trust
-before creating, since it becomes the counterparty's allowlist label. When
-\`.nameIsPlaceholder\` is true the endpoint advertised no usable name and
-\`--name '<name>'\` is a literal placeholder — replace it with a name you choose
-rather than running the command as-is.
-Create the counterparty (it may itself require approval), then re-run
-the SAME x402 command. Always pass \`--max-amount\`
-(USD decimal) when the user named a price ceiling; challenges above it are
-refused before any payment. Payments follow the same policy as sends
-(send capability, counterparty allowlist, spend limits). A payment over the
-policy's approval threshold parks for a human approval instead of paying:
-the result carries \`.approvalPending\` (intent id, expiry, reasons) and the
-command exits non-zero. Ask an operator to approve it in the console, then
-re-run the SAME command — the retry consumes the matching approval and pays
-without re-approving; if the approval expires unused, the re-run parks a fresh
-one. Approval matching is independent of keys and requires the same agent,
-source account, payment requirements, and resource — not just URL and price.
-The JSON result carries \`.paid\`, \`.payment\` (intent id, atomic
-USDC amount, recipient), and the response \`.body\`. When \`.bodyTruncated\` is
-true, read the complete body from the file at \`.bodyPath\` (if \`.bodyPath\`
-is absent, \`.error\` says what survived); never re-fetch to see more of a
-body — a re-run pays again. To recover a completed payment after an interrupted
-submission or failed paid request, read \`intents get <id>\`:
-\`.data.paymentCredential.value\` is the
-\`PAYMENT-SIGNATURE\` header value to retry with manually while the
-authorization is still valid.
-
-When a seller implements the x402 offer-receipt extension, the payment loop
-relays the seller's signed offer and signed receipt to Catena automatically;
-Catena verifies them and stores them on the intent as evidence for audit and
-disputes. This changes nothing about the payment itself, and sellers without
-the extension behave exactly as before.
+need the address before you start. If the address is not saved, the CLI charges
+nothing and exits non-zero. The result then carries \`.counterpartyNotFound\`
+with \`payTo\`, the \`network\` slug, \`networkId\`, \`serviceName\` when the
+endpoint gives one, \`.nameIsPlaceholder\`, and \`.createCommand\`.
+\`.createCommand\` holds the \`counterparties create wallet\` command to run, and
+\`.error\` holds the same command for a person to read.
+
+Read \`.nameIsPlaceholder\` before you run that command:
+
+- **\`false\`** — the \`--name\` is the name that the endpoint gives for itself.
+  Nobody verified it. It becomes the allow-list label of the counterparty.
+  Confirm that it names a service you trust before you make the counterparty.
+- **\`true\`** — the endpoint gave no usable name, and \`--name '<name>'\` is a
+  literal placeholder. Replace it with a name that you choose. Do not run the
+  command as it is.
+
+Make the counterparty, which can itself need approval. Then run the SAME x402
+command again.
+
+**Price and policy.** Always pass \`--max-amount\` as a USD decimal when the
+user gives a price ceiling. The CLI refuses a larger challenge before it pays
+anything. A payment obeys the same policy as a send: the send capability, the
+counterparty allow-list, and the spend limits.
+
+A payment above the approval threshold of the policy waits for an operator
+instead of paying. The result carries \`.approvalPending\` with the intent id,
+the expiry, and the reasons, and the command exits non-zero. Ask an operator to
+approve it in the console, then run the SAME command again. That run uses the
+matching approval and pays, with no second approval. If the approval expires
+before you use it, the next run waits for a new one.
+
+A key does not affect the match. The match needs the same agent, the same source
+account, the same payment requirements, and the same resource. The URL and the
+price alone are not sufficient.
+
+**Reading the result.** The JSON result carries \`.paid\`, \`.payment\` with the
+intent id, the atomic USDC amount and the recipient, and the response \`.body\`.
+If \`.bodyTruncated\` is true, read the full body from the file at
+\`.bodyPath\`. If \`.bodyPath\` is absent, \`.error\` tells you what remains.
+Never fetch the URL again to see more of a body, because a second run pays
+again.
+
+To recover a payment that finished after an interrupted submission or a failed
+paid request, read \`intents get <id>\`. The field
+\`.data.paymentCredential.value\` holds the \`PAYMENT-SIGNATURE\` header value.
+Retry with that header while the authorization is still valid.
+
+**Offer receipts.** Some sellers use the x402 offer-receipt extension. For those
+sellers, the payment loop sends the signed offer and the signed receipt of the
+seller to Catena. Catena verifies both and keeps them on the intent as evidence
+for an audit or a dispute. This changes nothing about the payment. A seller
+without the extension behaves as before.
 
 ## Paying MPP (HTTP 402) Endpoints
 
-\`mpp\` fetches a URL and pays a supported MPP charge in USDC from a
-non-custodial wallet account before retrying the request:
+\`mpp\` fetches a URL. It pays a supported MPP charge in USDC from a
+non-custodial wallet account, then sends the request again:
 
     catena mpp --url https://api.example.com/paid \\
       --account acct_... --max-amount 0.25
 
-Initial support is limited to \`evm/charge\` and \`usdc/charge\` for native USDC
-on Base and Base Sepolia. See \`mpp --help\` for request-body, header, output,
-profile, and JSON flags. Always set \`--max-amount\` when the user gives a price
-ceiling; larger challenges are refused before an intent is created.
-
-MPP payments use the same send capability, counterparty allowlist, spend
-limits, and human approval flow as other agent payments. The challenge's
-recipient must be a saved counterparty wallet rail on the requested network.
-When \`.counterpartyNotFound\` is present, replace the \`<name>\` placeholder in
-its \`.createCommand\`, create the counterparty, and re-run the SAME MPP
-command. When \`.approvalPending\` is present, ask an operator to approve the
-intent and then re-run the SAME MPP command unchanged. When
-\`.networkMismatch\` is present, the wallet account cannot pay on a network the
-challenge requires; re-run with \`--account\` set to an account on one of
-\`.networkMismatch.requiredNetworks\` (the CAIP-2 ids are in
-\`.networkMismatch.requiredNetworkIds\`).
-
-The result reports \`.paid\`, the HTTP status and body, and—after payment—a
-credential-free \`.payment\` summary with the intent id, selected method,
-atomic USDC amount, recipient, and network. When \`.bodyTruncated\` is true,
-read the complete body from the file at \`.bodyPath\` (if \`.bodyPath\` is
-absent, \`.error\` says what survived). Do not re-fetch to see more of a body—a
-re-run pays again. The CLI never accepts an MPP payment credential through
-\`--header\`. Ordinary application
-\`Authorization\`, such as a bearer token, is preserved when the seller asks
-for the payment in \`Payment-Authorization\`.
-
-If \`.paid\` and \`.retryFailed\` are both true, or reading the paid response
-body fails, the payment already completed. Use \`intents get <id>\` to inspect
-the reported intent and do not run the command again blindly. An interrupted
-submission can also leave the outcome unknown; run the error's
-\`catena intents get <id>\` command before trying another payment.
+Support at this time covers \`evm/charge\` and \`usdc/charge\` only, for native
+USDC on Base and Base Sepolia. See \`mpp --help\` for the request-body, header,
+output, profile, and JSON flags. Always set \`--max-amount\` when the user gives
+a price ceiling. The CLI refuses a larger challenge before it makes an intent.
+
+An MPP payment uses the same send capability, counterparty allowlist, spend
+limits, and operator approval flow as every other agent payment. The recipient
+of the challenge must be a saved counterparty wallet rail on the network that
+the challenge asks for.
+
+Three fields tell you what to do next:
+
+- **\`.counterpartyNotFound\`** — replace the \`<name>\` placeholder in
+  \`.createCommand\`, make the counterparty, then run the SAME MPP command
+  again.
+- **\`.approvalPending\`** — ask an operator to approve the intent. Then run the
+  SAME MPP command again, with no change.
+- **\`.networkMismatch\`** — the wallet account cannot pay on a network that the
+  challenge needs. Run the command again with \`--account\` set to an account on
+  one of \`.networkMismatch.requiredNetworks\`. The CAIP-2 ids are in
+  \`.networkMismatch.requiredNetworkIds\`.
+
+The result reports \`.paid\`, the HTTP status, and the body. After a payment it
+also reports \`.payment\`, which holds the intent id, the selected method, the
+atomic USDC amount, the recipient, and the network. \`.payment\` holds no
+credential. If \`.bodyTruncated\` is true, read the full body from the file at
+\`.bodyPath\`. If \`.bodyPath\` is absent, \`.error\` tells you what remains. Do
+not fetch the URL again to see more of a body, because a second run pays again.
+
+The CLI never accepts an MPP payment credential through \`--header\`. It keeps
+an ordinary application \`Authorization\` header, such as a bearer token, when
+the seller asks for the payment in \`Payment-Authorization\`.
+
+The payment already finished in two cases: \`.paid\` and \`.retryFailed\` are
+both true, or the CLI cannot read the paid response body. Use
+\`intents get <id>\` to examine the intent in the result, and do not run the
+command again blindly. An interrupted submission can also leave the outcome
+unknown. Run the \`catena intents get <id>\` command from the error before you
+try another payment.
 
 ## Temporary Policy Overrides
 
-When policy blocks a task the user asked for, the agent may ask a human to
-raise the specific limit it hit, for a bounded time — if the policy allows
-override requests at all, which only a workspace administrator can change.
-Request the minimum the task needs; this is for completing the user's task,
-not for widening policy. Every request parks for a person, nothing takes
-effect without approval, and the override expires on its own with nothing to
-undo.
+If policy blocks a task that the user asked for, you can ask an operator to
+raise the one limit that stopped you, for a limited time. The policy must allow
+override requests, and only a workspace administrator can change that setting.
+
+Ask for the minimum that the task needs. An override completes the task of the
+user. It does not widen the policy. Every request waits for an operator.
+Nothing takes effect before approval. The override expires by itself, and there
+is nothing to undo.
 
 Request one with:
 
@@ -527,101 +608,104 @@ Request one with:
       --amount 500 --duration 4h \\
       --reason "Vendor invoice INV-4471 is $420"
 
-Send and transfer hard limits can be raised, for the one account named by
---account — other accounts' limits are untouched. The default is a send
-limit; pass \`--capability transfer\` for a transfer limit, where --account
-is the source account, since transfer limits govern the account funds move
-out of. The MCP equivalent is
-\`request_policy_override\`; over REST, an intent with a \`policy_override\`
-action.
-
-One request may be pending per agent, independently of idempotency keys.
-Repeating it returns the pending one. Different limits with the same key return
-409; with a fresh key they are not recorded — the reply says so, and the person
-still sees the original. Wait for a decision rather than re-asking.
-
-Status follows the usual intent vocabulary, with two collapses worth knowing:
-a person declining shows as \`blocked\`, not a state of its own, and should not
-be re-filed; a request that expires unapproved shows as \`failed\`.
-\`.data.policyOverride.policyId\` names the override once it is live, and
-\`.replayed\` is true when the reply is an earlier pending request.
-
-While it is pending, share the approvals link from \`metadata.dataUrl\` so an
-operator can act on it. After approval, re-run the same blocked command
-unchanged — the raised limits apply immediately, and \`policy show\` reflects
-them until the override expires.
+An override can raise a hard limit on a send or a transfer. It applies only to
+the one account that \`--account\` names. The limits of every other account stay
+the same. The command raises a send limit by default. Pass
+\`--capability transfer\` for a transfer limit. \`--account\` is then the source
+account, because a transfer limit governs the account that money moves out of.
+The MCP equivalent is \`request_policy_override\`. Over REST, use an intent with
+a \`policy_override\` action.
+
+Each agent can have one pending request. An idempotency key does not change
+this. A repeat of the request returns the pending one. Different limits with the
+same key return 409. Different limits with a new key are not recorded: the reply
+says so, and the operator still sees the original request. Wait for a decision.
+Do not ask again.
+
+Status uses the usual intent words, with two special cases. An operator who
+declines makes the status \`blocked\`, not a status of its own. Do not file that
+request again. A request that expires without approval makes the status
+\`failed\`. \`.data.policyOverride.policyId\` names the override after it is
+live. \`.replayed\` is true when the reply is an earlier pending request.
+
+While the request is pending, give the operator the approvals link from
+\`metadata.dataUrl\`. After approval, run the blocked command again with no
+change. The raised limits apply immediately. \`policy show\` reports them until
+the override expires.
 
 ## Intents
 
-Money movement, counterparty creation, counterparty detail requests, and policy
-override requests return intents. Balance, transaction, and deposit-address
-reads do not. Match the simplified \`.status\` value, not raw backend status
-strings.
+Four operations return an intent: money movement, counterparty creation, a
+counterparty detail request, and a policy override request. A balance,
+transaction, or deposit-address read does not. Match the simplified \`.status\`
+value. Do not match a raw backend status string.
 
-Treat \`completed\`, \`blocked\`, and \`failed\` as final. Re-check \`pending\` or
-\`processing\` with \`intents get\`; \`pending\` can still advance without agent
-action. \`reasons\` explains policy decisions or approval routing, and should be
-summarized when present.
+\`completed\`, \`blocked\`, and \`failed\` are final. Read \`pending\` or
+\`processing\` again with \`intents get\`. A \`pending\` intent can advance
+without any action by the agent. \`reasons\` gives the policy decision or the
+approval route. Summarize \`reasons\` for the user when it is present.
 
-After a policy block is resolved, retrying unchanged inputs with the same key
-creates a new intent evaluated under current policy; the old intent stays
-\`blocked\`. Respect human denials rather than retrying them. A \`failed\`
-intent's key still identifies that failed attempt: use a new key if another
-attempt is appropriate. Never repay a \`completed\` intent as recovery.
+After somebody clears a policy block, the same inputs with the same key make a
+new intent, and policy examines that new intent as it is now. The old intent
+stays \`blocked\`. Accept a denial by an operator. Do not send the request
+again. The key of a \`failed\` intent still identifies that failed attempt. Use
+a new key if another attempt is correct. Never pay a \`completed\` intent again
+to recover.
 
 Re-read current state with:
 
     catena intents get int_...
 
-\`.data\` carries the result once one exists: the linked transaction for send or
-transfer, or the created counterparty for creation. It is \`null\` when there is
-none yet. A successful \`send\` or \`transfer\` replay returns the original
-intent's current result, not a second movement. \`.replayed\` identifies a
-returned existing intent; it does not mean the operation executed again.
+\`.data\` carries the result after one exists. For a send or a transfer, that is
+the linked transaction. For a creation, that is the new counterparty. \`.data\`
+is \`null\` while no result exists. A repeat of a successful \`send\` or
+\`transfer\` returns the current result of the original intent. It does not move
+money a second time. \`.replayed\` identifies an intent that already existed. It
+does not mean that the operation ran again.
 
 ## Output, Exit Codes, and Scripting
 
-Credentialed command stdout is JSON; parse it rather than scraping text. Every
-credentialed command accepts \`--json\` for compact single-line output.
+Each of these commands prints JSON on stdout. Parse that JSON. Do not read the
+text. Each one accepts \`--json\` for compact output on one line.
 \`catena --version\` prints the CLI version.
 
-The exit code reflects whether the command ran, not an intent's policy outcome.
-A submitted-but-blocked send still exits 0, so read \`.status\` and \`.reasons\`.
+The exit code tells you whether the command ran. It does not tell you the policy
+outcome of an intent. A send that submits and then becomes blocked still exits
+0. Read \`.status\` and \`.reasons\`.
 
-Every credentialed command exits 0 after printing its JSON result, or 1 on error
-with the message on stderr. The \`x402\` and \`mpp\` commands also exit non-zero
-(with their JSON still on stdout) whenever the result carries \`.error\` — the
-outcome needs follow-up, so read \`.error\` instead of treating the exit as a
-plain failure.
+Each of these commands exits 0 after it prints its JSON result. It exits 1 on an
+error, with the message on stderr. \`x402\` and \`mpp\` also exit non-zero when
+the result carries \`.error\`, and they still print their JSON on stdout. That
+outcome needs an action from you. Read \`.error\`. Do not treat the exit code as
+a simple failure.
 
 ## Persisting Across Sessions
 
-This guide is only found by an agent that already knows to use the CLI; the
-Catena skill is what makes that knowledge survive across sessions and
-projects. When it is not installed and setting this machine up for future
-Catena work makes sense, offer to install it:
+Only an agent that already knows about the CLI finds this guide. The Catena
+skill keeps that knowledge across sessions and projects. If the skill is not
+installed, and this machine will do more Catena work, offer to install it:
 
     npx -y skills add catena-labs/skills --skill catena-cli --global --yes
 
-Do not persist the routing by writing to CLAUDE.md, AGENTS.md, or harness
-memory instead; the skill is the only sanctioned mechanism.
+Do not write this routing into CLAUDE.md, AGENTS.md, or harness memory. The
+skill is the only approved method.
 
 ## Feedback
 
-If the CLI is confusing, missing a capability, or cannot express the operation
-you need, tell the Catena team:
+Tell the Catena team if the CLI is unclear, if it has no command for what you
+need, or if it cannot express your operation:
 
     catena feedback "Plain-text message (max 4000 chars)"
 
-The message must be 1-4000 characters and is write-only. Longer messages can be
-piped on stdin instead of passed as an argument.
-`}const Vu=c({meta:{name:`guide`,description:`Print the Catena CLI agent operating guide`},run(){console.log(Bu(oe))}}),Hu=Q({id:ws({description:`Intent id (e.g. int_…)`,required:!0,schema:Bs}),profile:Ls,json:Rs}),Uu=c({meta:{name:`get`,description:`Look up the current state of an intent created by this agent`},args:Hu.args,async run({args:e}){let t=Hu.parse(e);await $(t)(e=>e.getIntent(t.id))}}),Wu=c({meta:{name:`intents`,description:`Inspect intent receipts returned by governed operations`},subCommands:{get:Uu}});function Gu(e=process.env,t=process.platform){return!!(e.SSH_CONNECTION||e.SSH_TTY||t===`linux`&&!e.DISPLAY&&!e.WAYLAND_DISPLAY)}function Ku(e){let t;try{t=E(ne(e))}catch{return!1}if(t===`/`)return!0;try{let e=E(process.env.HOME??ee());return t===e||e.startsWith(`${t}/`)}catch{return!0}}function qu(e){e&&process.stderr.write(`Failed to open browser: ${e.message}\n`)}function Ju(e){process.platform===`darwin`?v(`open`,[e],qu):process.platform===`win32`?v(`cmd`,[`/c`,`start`,``,e],qu):v(`xdg-open`,[e],qu)}function Yu(e){if(typeof e!=`object`||!e)return;let t=e;return typeof t.message==`string`?t.message:typeof t.error==`string`?t.error:void 0}function Xu(e){return typeof e!=`object`||!e||!(`access_token`in e)?!1:typeof e.access_token==`string`}function Zu(e){if(typeof e!=`object`||!e)return!1;let t=e;return typeof t.agentId==`string`&&typeof t.name==`string`&&typeof t.sessionToken==`string`&&(t.activated===void 0||typeof t.activated==`boolean`)}function Qu(e){if(typeof e!=`object`||!e)return!1;let t=e;return sc.some(e=>e===t.status)&&(t.publicKeyHex===void 0||typeof t.publicKeyHex==`string`)&&(t.reason===void 0||typeof t.reason==`string`)}async function $u(e){let{bankUrl:t,authCode:n,verifier:r,redirectUri:i,agentId:a,clientInstanceId:o,clientId:s,clientLabel:c,log:l=()=>{},appInfo:u,existingSigner:d,generateSignerKeypair:f=ga}=e,p=Il(u);l(`Exchanging authorization code...`);let m=await fetch(`${t}/v1/auth/oauth2/token`,{method:`POST`,headers:{"Content-Type":`application/x-www-form-urlencoded`,...p},body:new URLSearchParams({grant_type:`authorization_code`,code:n,code_verifier:r,client_id:s,redirect_uri:i}).toString()});if(!m.ok)return{ok:!1,message:Yu(await m.json().catch(()=>({message:`Token exchange failed`})))??m.statusText};let h=await m.json();if(!Xu(h))return{ok:!1,message:`Token exchange response missing access_token`};l(`Claiming agent...`);let g=d?{algorithm:d.algorithm,privateKeyHex:d.privateKeyHex,publicKeyHex:d.publicKeyHex}:f(),_=await fetch(`${t}/v1/agent-api/claim`,{method:`POST`,headers:{"Content-Type":`application/json`,...p,Authorization:`Bearer ${h.access_token}`},body:JSON.stringify({agentId:a,clientInstanceId:o,...c===void 0?{}:{clientLabel:c}})});if(!_.ok)return{ok:!1,message:Yu(await _.json().catch(()=>({message:`Claim failed`})))??_.statusText};let v=await _.json();return Zu(v)?ed({bankUrl:t,claim:v,clientInstanceId:o,signerKeypair:g,identityHeaders:p,log:l}):{ok:!1,message:`Claim response missing required fields`}}async function ed(e){let{bankUrl:t,claim:n,clientInstanceId:r,signerKeypair:i,identityHeaders:a}=e;(e.log??(()=>{}))(`Registering signer...`);let o=await nd({bankUrl:t,sessionToken:n.sessionToken,keypair:i,identityHeaders:a});return o.status===`registration_failed`?(n.activated!==!1&&await rd({bankUrl:t,sessionToken:n.sessionToken,identityHeaders:a}),o.reason===`public_key_conflict`?{ok:!1,message:`This device's signing key conflicts with the one the bank already holds for this agent, or that key is already registered to another agent. Re-running link will not fix this; this agent's signing key cannot be reset automatically, so ask an operator or support to reset it before linking again.`}:{ok:!1,message:`Signer registration failed (${o.reason??`unknown`}). Run link again to retry.`}):{ok:!0,result:{agentId:n.agentId,clientInstanceId:r,agentName:n.name,signer:{...i,registration:o}}}}function td(e){return typeof e!=`object`||!e||!(`signer`in e)?!1:Qu(e.signer)}async function nd(e){let t;try{t=await fetch(`${e.bankUrl}/v1/agent-api/signer/register`,{method:`POST`,headers:{"Content-Type":`application/json`,...e.identityHeaders,Authorization:`Bearer ${e.sessionToken}`},body:JSON.stringify({signer:{algorithm:e.keypair.algorithm,publicKeyHex:e.keypair.publicKeyHex}})})}catch{return{status:`registration_failed`,reason:`registration_request_failed`}}if(t.status===409)return{status:`registration_failed`,reason:`public_key_conflict`};if(!t.ok)return{status:`registration_failed`,reason:`provider_registration_failed`};let n=await t.json().catch(()=>null);return td(n)?n.signer:{status:`registration_failed`,reason:`registration_response_malformed`}}async function rd(e){try{await fetch(`${e.bankUrl}/v1/agent-api/unlink`,{method:`POST`,headers:{...e.identityHeaders,Authorization:`Bearer ${e.sessionToken}`}})}catch{}}function id(e){return`${e}-signer`}async function ad(e,t){let n=await e.resolve(t);if(n!==null&&`signer`in n)return n.signer;let r=await e.resolve(id(t));if(r!==null&&`signer`in r)return r.signer}async function od(e,t,n=ga){let r=await ad(e,t);if(r!==void 0)return r;let i=xc(n());return await e.save(id(t),i),i.signer}const sd=[53682,53683,53684,53685,53686,53687];function cd(e){return new Promise((t,n)=>{let r=0,i=()=>{if(r>=sd.length){n(Error(`No registered loopback callback ports are available`));return}let a=sd[r],o=t=>{if(e.off(`error`,o),t.code===`EADDRINUSE`){r++,i();return}n(t)};e.once(`error`,o),e.listen(a,`127.0.0.1`,()=>{e.off(`error`,o),t(a)})};i()})}async function ld(e){let{bankUrl:t,agentId:n,clientInstanceId:r,clientId:i,clientLabel:a,timeoutMs:o=3e5,log:s=()=>{},appInfo:c,existingSigner:l}=e;Xc(t,`bankUrl`);let u=g(32).toString(`base64url`),d=m(`sha256`).update(u).digest(`base64url`),f=g(16).toString(`hex`),p=e=>{let n=new URL(`${t}/link-complete`);return n.searchParams.set(`linked`,e),n.toString()},h=e=>{let n=new URL(`${t}/link-complete`);return n.searchParams.set(`error`,e),n.toString()};return new Promise((e,m)=>{let g=0,_=!1,v=null,y=t=>{_||(_=!0,v&&clearTimeout(v),S.close(),e(t))},b=e=>{_||(_=!0,v&&clearTimeout(v),S.close(),m(e))},x=e=>{s(`Link failed: ${e}`),y(null)},S=re((e,t)=>{C(e,t).catch(e=>{let n=Yu(e)??`Unexpected error`;t.headersSent||(t.writeHead(302,{Location:h(n)}),t.end()),s(`Link failed: ${n}`),y(null)})});async function C(e,o){let d=new URL(e.url??`/`,`http://localhost`);if(d.pathname!==`/callback`){o.writeHead(404),o.end(`Not found`);return}let m=d.searchParams.get(`error`);if(m){let e=d.searchParams.get(`error_description`)??m;o.writeHead(302,{Location:h(e)}),o.end(),x(`OAuth error: ${e}`);return}if(d.searchParams.get(`state`)!==f){o.writeHead(302,{Location:h(`State mismatch during OAuth callback`)}),o.end(),x(`State mismatch during OAuth callback`);return}let _=d.searchParams.get(`code`);if(!_){o.writeHead(302,{Location:h(`Missing authorization code`)}),o.end(),x(`Missing authorization code`);return}let v=`http://127.0.0.1:${g}/callback`,b=await $u({bankUrl:t,authCode:_,verifier:u,redirectUri:v,agentId:n,clientInstanceId:r,clientId:i,clientLabel:a,log:s,appInfo:c,existingSigner:l});if(!b.ok){o.writeHead(302,{Location:h(b.message)}),o.end(),s(`Link failed: ${b.message}`),y(null);return}o.writeHead(302,{Location:p(b.result.agentId)}),o.end(),y(b.result)}cd(S).then(e=>{g=e;let n=`http://127.0.0.1:${g}/callback`,r=`${t}/v1/auth/oauth2/authorize?`+new URLSearchParams({response_type:`code`,client_id:i,redirect_uri:n,scope:`openid email profile offline_access`,code_challenge:d,code_challenge_method:`S256`,state:f}).toString();s(`Opening browser for authentication...`),Ju(r),s(`If browser didn't open, visit: ${r}`)}).catch(b),v=setTimeout(()=>{x(`Timed out waiting for authentication`)},o),v.unref()})}function ud(e){if(typeof e!=`object`||!e)return!1;let t=e;return typeof t.deviceCode==`string`&&typeof t.userCode==`string`&&typeof t.verificationUri==`string`&&typeof t.verificationUriComplete==`string`&&typeof t.expiresIn==`number`&&typeof t.interval==`number`}function dd(e){if(typeof e!=`object`||!e)return{};let t=e;return{code:typeof t.code==`string`?t.code:void 0,message:typeof t.error==`string`?t.error:void 0}}function fd(e){return new Promise(t=>{setTimeout(t,e)})}function pd(e){let t={clientInstanceId:e.clientInstanceId,...e.clientLabel===void 0?{}:{clientLabel:e.clientLabel}};return e.scope===`agent:connect`?{scope:`agent:connect`,...t,...e.suggestedAgentName===void 0?{}:{suggestedAgentName:e.suggestedAgentName}}:e.scope===`agent:link`?{scope:`agent:link`,agentId:e.agentId,...t}:{agentId:e.agentId,...t}}async function md(e){let{bankUrl:t,clientInstanceId:n,onUserCode:r,log:i=()=>{},appInfo:a,existingSigner:o,generateSignerKeypair:s=ga,sleep:c=fd}=e;Xc(t,`bankUrl`);let l=Il(a),u=e=>(i(`Link failed: ${e}`),null),d;try{d=await fetch(`${t}/v1/agent-link/device/code`,{method:`POST`,headers:{"Content-Type":`application/json`,...l},body:JSON.stringify(pd(e))})}catch{return u(`Could not reach the bank to start the device flow`)}if(!d.ok)return u(dd(await d.json().catch(()=>null)).message??d.statusText);let f=await d.json();if(!ud(f))return u(`Device authorization response missing required fields`);r({userCode:f.userCode,verificationUri:f.verificationUri,verificationUriComplete:f.verificationUriComplete,expiresInSeconds:f.expiresIn});let p=await hd({bankUrl:t,grant:f,identityHeaders:l,sleep:c});if(!p.ok)return u(p.message);let m=p.body;if(!Zu(m))return u(`Device token response missing required fields`);i(`Approved. Claiming agent...`);let h=await ed({bankUrl:t,claim:m,clientInstanceId:n,signerKeypair:o?{algorithm:o.algorithm,privateKeyHex:o.privateKeyHex,publicKeyHex:o.publicKeyHex}:s(),identityHeaders:l,log:i});return h.ok?h.result:u(h.message)}async function hd(e){let{bankUrl:t,grant:n,identityHeaders:r,sleep:i}=e,a=Date.now()+n.expiresIn*1e3,o=Math.max(n.interval,1)*1e3,s=o;for(;Date.now()+o<=a;){await i(o);let e;try{e=await fetch(`${t}/v1/agent-link/device/token`,{method:`POST`,headers:{"Content-Type":`application/json`,...r},body:JSON.stringify({deviceCode:n.deviceCode})})}catch{s=Math.min(s*2,6e4),o=Math.max(o,s);continue}if(s=o,e.ok){let t=await e.json().catch(()=>null);return t===null?{ok:!1,message:`The bank returned an unreadable token response`}:{ok:!0,body:t}}let a=dd(await e.json().catch(()=>null));if(a.code!==`authorization_pending`){if(a.code===`slow_down`){o+=5e3;continue}return a.code===`expired_token`?{ok:!1,message:`The device code expired before approval. Run link again`}:{ok:!1,message:a.message??`The request was denied`}}}return{ok:!1,message:`Timed out waiting for approval`}}function gd(e){if(typeof e!=`object`||!e)return!1;let t=e,n=t.signer;return t.credential===`signing_key`&&typeof t.agentId==`string`&&typeof t.name==`string`&&typeof t.keyThumbprint==`string`&&typeof t.activated==`boolean`&&typeof n==`object`&&!!n&&typeof n.status==`string`}async function _d(e){let{bankUrl:t,clientInstanceId:n,onUserCode:r,log:i=()=>{},appInfo:a,sleep:o=fd}=e;Xc(t,`bankUrl`);let s=Il(a),c=e=>(i(`Link failed: ${e}`),null),l={clientInstanceId:n,signer:{algorithm:`p256`,publicKeyHex:e.publicKeyHex},...e.clientLabel===void 0?{}:{clientLabel:e.clientLabel}},u=e.agentId===void 0?{scope:`agent:connect:service`,...l,...e.suggestedAgentName===void 0?{}:{suggestedAgentName:e.suggestedAgentName}}:{scope:`agent:link:service`,agentId:e.agentId,...l},d;try{d=await fetch(`${t}/v1/agent-link/device/code`,{method:`POST`,headers:{"Content-Type":`application/json`,...s},body:JSON.stringify(u)})}catch{return c(`Could not reach the bank to start the device flow`)}if(!d.ok){let e=dd(await d.json().catch(()=>null));return e.code===`validation_failed`?c(`The bank rejected the request, which usually means it does not support --service yet. Nothing was created. Upgrade the bank and retry`):c(e.message??d.statusText)}let f=await d.json();if(!ud(f))return c(`Device authorization response missing required fields`);r({userCode:f.userCode,verificationUri:f.verificationUri,verificationUriComplete:f.verificationUriComplete,expiresInSeconds:f.expiresIn});let p=await hd({bankUrl:t,grant:f,identityHeaders:s,sleep:o});return p.ok?Zu(p.body)?c(`This bank does not support --service yet: it created a session link for agent ${p.body.agentId}. Unlink it in the console before retrying`):gd(p.body)?(i(`Approved. Signing key registered.`),{agentId:p.body.agentId,agentName:p.body.name,keyThumbprint:p.body.keyThumbprint,activated:p.body.activated,signerStatus:p.body.signer.status,...p.body.signer.reason===void 0?{}:{signerReason:p.body.signer.reason}}):c(`Device token response missing required fields`):c(p.message)}const vd=Q({"agent-id":ws({description:`Optional agent ID shown in the Catena console; omit to create and link a new agent`,schema:Bs}),"bank-url":Z({description:`Bank API URL (defaults to $CATENA_API_URL or prod)`,default:process.env.CATENA_API_URL??`https://api.catena.com`}),browser:Es({description:`Open the browser PKCE flow (default)`,negativeDescription:`Skip the browser and link with a device code you approve from another machine`,default:!0}),name:Z({description:`Suggested name for an agent created from this link; only used when agent-id is omitted`}),service:Es({description:`Provision a deployed-service signing credential instead of linking this machine: approval registers a P-256 key, no session tokens are minted, and nothing is stored locally. Interactive agent hosts must NOT use this`,default:!1}),"public-key":Z({description:`With --service: register this existing compressed P-256 public key (the deployment already holds the private key) instead of generating a keypair`}),profile:Ls}),yd=/^0[23][0-9a-f]{64}$/;function bd(e){let t=Math.round(e.expiresInSeconds/60);console.log(`\n  To approve this link, visit:  ${e.verificationUri}`),console.log(`  and enter the code:           ${e.userCode}`),console.log(`\n  Or open: ${e.verificationUriComplete}`),console.log(`\n  Waiting for approval (expires in ${t} minutes)...`)}function xd(e){console.log(`
-Keep this generated keypair if the approval completed before the CLI failed:`),console.log(`\n  CATENA_AGENT_PUBLIC_KEY=${e.publicKeyHex}`),console.log(`  CATENA_AGENT_PRIVATE_KEY=${e.privateKeyHex}`)}function Sd(e){switch(e){case`signer_key_conflict`:return`  Wallet-send signer: not registered (signer key conflict); unlink the conflicting service link or re-run with the linked agent ID`;case`provider_registration_failed`:return`  Wallet-send signer: not registered (provider registration failed); retry after the provider recovers`;case void 0:return`  Wallet-send signer: not registered (registration failed); retry after checking the link status`;default:return`  Wallet-send signer: not registered (${e}); retry after checking the link status`}}function Cd({agentId:e,suggestedAgentName:t,browserRequested:n,isHeadless:r}){return e===void 0?{kind:`device-connect`,deviceTarget:{scope:`agent:connect`,...t===void 0?{}:{suggestedAgentName:t}}}:n?r()?{kind:`device-link`,deviceTarget:{agentId:e},notice:`No browser available — using device code flow.`}:{kind:`pkce-link`,agentId:e}:{kind:`device-link`,deviceTarget:{agentId:e}}}function wd(e){let t=m(`sha256`).update(E(process.cwd())).digest(`hex`).slice(0,16);return`${Dl(e??`agent`).slice(0,47)}-${t}`}function Td(e){try{let t=process.cwd();if(Ku(t))return null;let n=vl(t);return{directory:yl(t,e),reboundFrom:n!==null&&n!==e?n:null}}catch{return console.error(`Warning: could not bind the current directory to profile "${e}".`),null}}const Ed=c({meta:{name:`link`,description:`Link an existing agent, or create and link a new agent when agent-id is omitted`},args:vd.args,async run({args:e}){let t=vd.parse(e),n=t[`bank-url`],r=t[`agent-id`],i=t.name;if(t.service){await Dd({bankUrl:n,agentId:r,suggestedAgentName:i,publicKeyHex:t[`public-key`]});return}let a,o,s;try{if(Xc(n,`--bank-url`),t[`public-key`]!==void 0)throw Error(`--public-key requires --service`);if(r!==void 0&&i!==void 0)throw Error(`--name can only be used when agent-id is omitted`);let e=Vl({flag:Xl(t),cwd:process.cwd(),log:e=>console.error(e)});a=(e!==null&&e.source!=="default"?e.name:null)??(r===void 0?null:ml(r,n)),o=a??(r===void 0?wd(i):Dl(r)),s=Cl(o,{bank_url:n,agent_id:r})}catch(e){X(e)}console.log(`
-Catena — Agent Setup`),console.log(`─`.repeat(25));let c=Kc(),l=await od(c,s),u={bankUrl:n,clientInstanceId:s,log:e=>console.log(`  ${e}`),appInfo:Ml,existingSigner:l},d=Cd({agentId:r,suggestedAgentName:i,browserRequested:t.browser,isHeadless:Gu});d.kind===`device-link`&&d.notice!==void 0&&console.log(`  ${d.notice}`);let f=d.kind===`pkce-link`?await ld({...u,agentId:d.agentId,clientId:`catena-cli`,timeoutMs:3e5}):await md({...u,...d.deviceTarget,onUserCode:bd});f||X(`
-Failed to link agent. Run the command again to try again.`),await c.save(s,Cc(f.signer));let p=a??Ol(Dl(f.agentName),e=>e!==o&&xl(e)!==null);try{p===o?dl(p,{bank_url:n,agent_id:f.agentId,client_instance_id:s}):kl({reservationName:o,profileName:p,profile:{bank_url:n,agent_id:f.agentId,client_instance_id:s}})}catch(e){X(e)}console.log(`\n  Wrote profile "${p}"`);let m=Td(p);m!==null&&console.log(m.reboundFrom===null?`  Bound ${m.directory} to profile "${p}"`:`  Rebound ${m.directory} from profile "${m.reboundFrom}" to "${p}"`),console.log(`  To pin this identity for an agent host, set ${Rl}=${p}`),console.log(`\nDone. Agent "${f.agentName}" linked.`),process.exit(0)}});async function Dd(e){try{if(Xc(e.bankUrl,`--bank-url`),e.agentId!==void 0&&e.suggestedAgentName!==void 0)throw Error(`--name can only be used when agent-id is omitted`);if(e.publicKeyHex!==void 0&&!yd.test(e.publicKeyHex.toLowerCase()))throw Error(`--public-key must be compressed P-256 public key hex (66 chars)`)}catch(e){X(e)}console.log(`
-Catena — Deployed Service Setup`),console.log(`─`.repeat(31));let t=e.publicKeyHex===void 0?ga():null,n=t?.publicKeyHex??e.publicKeyHex?.toLowerCase()??``,r;try{r=ba(n)}catch(e){e instanceof ha||X(e),X(`Signing key public key is not a valid P-256 point`)}console.log(`  Signing key (RFC 7638 thumbprint): ${r}`);let i=`service-${m(`sha256`).update(n).digest(`hex`).slice(0,32)}`,a=!1,o=()=>{t&&a&&xd({publicKeyHex:n,privateKeyHex:t.privateKeyHex})},s;try{s=await _d({bankUrl:e.bankUrl,clientInstanceId:i,publicKeyHex:n,...e.agentId===void 0?{}:{agentId:e.agentId},...e.suggestedAgentName===void 0?{}:{suggestedAgentName:e.suggestedAgentName},onUserCode:e=>{a=!0,bd(e)},log:e=>console.log(`  ${e}`),appInfo:Ml})}catch(e){o(),X(e)}s||(o(),X(`
-Failed to link the service. Run the command again to try again.`)),s.keyThumbprint!==r&&(o(),X(`The bank registered signing key thumbprint ${s.keyThumbprint}, which does not match the local key (${r}). Do not deploy this credential. Unlink the agent in the console and run link again`)),console.log(`\nDone. Agent "${s.agentName}" linked as a deployed service.`),console.log(`  Agent ID: ${s.agentId}`),console.log(`  Signing key (RFC 7638 thumbprint): ${s.keyThumbprint}`),s.signerStatus===`registered`||s.signerStatus===`already_registered`?console.log(`  Wallet-send signer: registered`):s.signerStatus===`not_applicable`?console.log(`  Wallet-send signer: deferred (${s.signerReason??`topology not ready`}); the org must be signing-ready before live sends`):s.signerStatus===`registration_failed`?console.log(Sd(s.signerReason)):console.log(`  Wallet-send signer: not registered (${s.signerReason??s.signerStatus}); retry after checking the link status`),console.log(`
-Set these in the deployment environment:`),console.log(`\n  CATENA_API_URL=${e.bankUrl}`),console.log(`  CATENA_AGENT_PUBLIC_KEY=${n}`),t&&console.log(`  CATENA_AGENT_PRIVATE_KEY=${t.privateKeyHex}`),console.log(`  CATENA_AGENT_IDENTITY_URL=<the deployment's public https origin>`),t&&console.log(`
+The message must have 1 to 4000 characters. You cannot read it again after you
+send it. Give a longer message on stdin instead of as an argument.
+`}const Ju=c({meta:{name:`guide`,description:`Print the Catena CLI agent operating guide`},run(){console.log(qu(oe))}}),Yu=Q({id:ws({description:`Intent id (e.g. int_…)`,required:!0,schema:Bs}),profile:Ls,json:Rs}),Xu=c({meta:{name:`get`,description:`Look up the current state of an intent created by this agent`},args:Yu.args,async run({args:e}){let t=Yu.parse(e);await $(t)(e=>e.getIntent(t.id))}}),Zu=c({meta:{name:`intents`,description:`Inspect intent receipts returned by governed operations`},subCommands:{get:Xu}});function Qu(e=process.env,t=process.platform){return!!(e.SSH_CONNECTION||e.SSH_TTY||t===`linux`&&!e.DISPLAY&&!e.WAYLAND_DISPLAY)}function $u(e){let t;try{t=E(ne(e))}catch{return!1}if(t===`/`)return!0;try{let e=E(process.env.HOME??ee());return t===e||e.startsWith(`${t}/`)}catch{return!0}}function ed(e){e&&process.stderr.write(`Failed to open browser: ${e.message}\n`)}function td(e){process.platform===`darwin`?v(`open`,[e],ed):process.platform===`win32`?v(`cmd`,[`/c`,`start`,``,e],ed):v(`xdg-open`,[e],ed)}function nd(e){if(typeof e!=`object`||!e)return;let t=e;return typeof t.message==`string`?t.message:typeof t.error==`string`?t.error:void 0}function rd(e){return typeof e!=`object`||!e||!(`access_token`in e)?!1:typeof e.access_token==`string`}function id(e){if(typeof e!=`object`||!e)return!1;let t=e;return typeof t.agentId==`string`&&typeof t.name==`string`&&typeof t.sessionToken==`string`&&(t.activated===void 0||typeof t.activated==`boolean`)}function ad(e){if(typeof e!=`object`||!e)return!1;let t=e;return sc.some(e=>e===t.status)&&(t.publicKeyHex===void 0||typeof t.publicKeyHex==`string`)&&(t.reason===void 0||typeof t.reason==`string`)}async function od(e){let{bankUrl:t,authCode:n,verifier:r,redirectUri:i,agentId:a,clientInstanceId:o,clientId:s,clientLabel:c,log:l=()=>{},appInfo:u,existingSigner:d,generateSignerKeypair:f=ga}=e,p=Jl(u);l(`Exchanging authorization code...`);let m=await fetch(`${t}/v1/auth/oauth2/token`,{method:`POST`,headers:{"Content-Type":`application/x-www-form-urlencoded`,...p},body:new URLSearchParams({grant_type:`authorization_code`,code:n,code_verifier:r,client_id:s,redirect_uri:i}).toString()});if(!m.ok)return{ok:!1,message:nd(await m.json().catch(()=>({message:`Token exchange failed`})))??m.statusText};let h=await m.json();if(!rd(h))return{ok:!1,message:`Token exchange response missing access_token`};l(`Claiming agent...`);let g=d?{algorithm:d.algorithm,privateKeyHex:d.privateKeyHex,publicKeyHex:d.publicKeyHex}:f(),_=await fetch(`${t}/v1/agent-api/claim`,{method:`POST`,headers:{"Content-Type":`application/json`,...p,Authorization:`Bearer ${h.access_token}`},body:JSON.stringify({agentId:a,clientInstanceId:o,...c===void 0?{}:{clientLabel:c}})});if(!_.ok)return{ok:!1,message:nd(await _.json().catch(()=>({message:`Claim failed`})))??_.statusText};let v=await _.json();return id(v)?sd({bankUrl:t,claim:v,clientInstanceId:o,signerKeypair:g,identityHeaders:p,log:l}):{ok:!1,message:`Claim response missing required fields`}}async function sd(e){let{bankUrl:t,claim:n,clientInstanceId:r,signerKeypair:i,identityHeaders:a}=e;(e.log??(()=>{}))(`Registering signer...`);let o=await ld({bankUrl:t,sessionToken:n.sessionToken,keypair:i,identityHeaders:a});return o.status===`registration_failed`?(n.activated!==!1&&await ud({bankUrl:t,sessionToken:n.sessionToken,identityHeaders:a}),o.reason===`public_key_conflict`?{ok:!1,message:`This device's signing key conflicts with the one the bank already holds for this agent, or that key is already registered to another agent. Re-running link will not fix this; this agent's signing key cannot be reset automatically, so ask an operator or support to reset it before linking again.`}:{ok:!1,message:`Signer registration failed (${o.reason??`unknown`}). Run link again to retry.`}):{ok:!0,result:{agentId:n.agentId,clientInstanceId:r,agentName:n.name,signer:{...i,registration:o}}}}function cd(e){return typeof e!=`object`||!e||!(`signer`in e)?!1:ad(e.signer)}async function ld(e){let t;try{t=await fetch(`${e.bankUrl}/v1/agent-api/signer/register`,{method:`POST`,headers:{"Content-Type":`application/json`,...e.identityHeaders,Authorization:`Bearer ${e.sessionToken}`},body:JSON.stringify({signer:{algorithm:e.keypair.algorithm,publicKeyHex:e.keypair.publicKeyHex}})})}catch{return{status:`registration_failed`,reason:`registration_request_failed`}}if(t.status===409)return{status:`registration_failed`,reason:`public_key_conflict`};if(!t.ok)return{status:`registration_failed`,reason:`provider_registration_failed`};let n=await t.json().catch(()=>null);return cd(n)?n.signer:{status:`registration_failed`,reason:`registration_response_malformed`}}async function ud(e){try{await fetch(`${e.bankUrl}/v1/agent-api/unlink`,{method:`POST`,headers:{...e.identityHeaders,Authorization:`Bearer ${e.sessionToken}`}})}catch{}}function dd(e){return`${e}-signer`}async function fd(e,t){let n=await e.resolve(t);if(n!==null&&`signer`in n)return n.signer;let r=await e.resolve(dd(t));if(r!==null&&`signer`in r)return r.signer}async function pd(e,t,n=ga){let r=await fd(e,t);if(r!==void 0)return r;let i=xc(n());return await e.save(dd(t),i),i.signer}const md=[53682,53683,53684,53685,53686,53687];function hd(e){return new Promise((t,n)=>{let r=0,i=()=>{if(r>=md.length){n(Error(`No registered loopback callback ports are available`));return}let a=md[r],o=t=>{if(e.off(`error`,o),t.code===`EADDRINUSE`){r++,i();return}n(t)};e.once(`error`,o),e.listen(a,`127.0.0.1`,()=>{e.off(`error`,o),t(a)})};i()})}async function gd(e){let{bankUrl:t,agentId:n,clientInstanceId:r,clientId:i,clientLabel:a,timeoutMs:o=3e5,log:s=()=>{},appInfo:c,existingSigner:l}=e;Xc(t,`bankUrl`);let u=g(32).toString(`base64url`),d=m(`sha256`).update(u).digest(`base64url`),f=g(16).toString(`hex`),p=e=>{let n=new URL(`${t}/link-complete`);return n.searchParams.set(`linked`,e),n.toString()},h=e=>{let n=new URL(`${t}/link-complete`);return n.searchParams.set(`error`,e),n.toString()};return new Promise((e,m)=>{let g=0,_=!1,v=null,y=t=>{_||(_=!0,v&&clearTimeout(v),S.close(),e(t))},b=e=>{_||(_=!0,v&&clearTimeout(v),S.close(),m(e))},x=e=>{s(`Link failed: ${e}`),y(null)},S=re((e,t)=>{C(e,t).catch(e=>{let n=nd(e)??`Unexpected error`;t.headersSent||(t.writeHead(302,{Location:h(n)}),t.end()),s(`Link failed: ${n}`),y(null)})});async function C(e,o){let d=new URL(e.url??`/`,`http://localhost`);if(d.pathname!==`/callback`){o.writeHead(404),o.end(`Not found`);return}let m=d.searchParams.get(`error`);if(m){let e=d.searchParams.get(`error_description`)??m;o.writeHead(302,{Location:h(e)}),o.end(),x(`OAuth error: ${e}`);return}if(d.searchParams.get(`state`)!==f){o.writeHead(302,{Location:h(`State mismatch during OAuth callback`)}),o.end(),x(`State mismatch during OAuth callback`);return}let _=d.searchParams.get(`code`);if(!_){o.writeHead(302,{Location:h(`Missing authorization code`)}),o.end(),x(`Missing authorization code`);return}let v=`http://127.0.0.1:${g}/callback`,b=await od({bankUrl:t,authCode:_,verifier:u,redirectUri:v,agentId:n,clientInstanceId:r,clientId:i,clientLabel:a,log:s,appInfo:c,existingSigner:l});if(!b.ok){o.writeHead(302,{Location:h(b.message)}),o.end(),s(`Link failed: ${b.message}`),y(null);return}o.writeHead(302,{Location:p(b.result.agentId)}),o.end(),y(b.result)}hd(S).then(e=>{g=e;let n=`http://127.0.0.1:${g}/callback`,r=`${t}/v1/auth/oauth2/authorize?`+new URLSearchParams({response_type:`code`,client_id:i,redirect_uri:n,scope:`openid email profile offline_access`,code_challenge:d,code_challenge_method:`S256`,state:f}).toString();s(`Opening browser for authentication...`),td(r),s(`If browser didn't open, visit: ${r}`)}).catch(b),v=setTimeout(()=>{x(`Timed out waiting for authentication`)},o),v.unref()})}function _d(e){if(typeof e!=`object`||!e)return!1;let t=e;return typeof t.deviceCode==`string`&&typeof t.userCode==`string`&&typeof t.verificationUri==`string`&&typeof t.verificationUriComplete==`string`&&typeof t.expiresIn==`number`&&typeof t.interval==`number`}function vd(e){if(typeof e!=`object`||!e)return{};let t=e;return{code:typeof t.code==`string`?t.code:void 0,message:typeof t.error==`string`?t.error:void 0}}function yd(e){return new Promise(t=>{setTimeout(t,e)})}function bd(e){let t={clientInstanceId:e.clientInstanceId,...e.clientLabel===void 0?{}:{clientLabel:e.clientLabel}};return e.scope===`agent:connect`?{scope:`agent:connect`,...t,...e.suggestedAgentName===void 0?{}:{suggestedAgentName:e.suggestedAgentName}}:e.scope===`agent:link`?{scope:`agent:link`,agentId:e.agentId,...t}:{agentId:e.agentId,...t}}async function xd(e){let{bankUrl:t,clientInstanceId:n,onUserCode:r,log:i=()=>{},appInfo:a,existingSigner:o,generateSignerKeypair:s=ga,sleep:c=yd}=e;Xc(t,`bankUrl`);let l=Jl(a),u=e=>(i(`Link failed: ${e}`),null),d;try{d=await fetch(`${t}/v1/agent-link/device/code`,{method:`POST`,headers:{"Content-Type":`application/json`,...l},body:JSON.stringify(bd(e))})}catch{return u(`Could not reach the bank to start the device flow`)}if(!d.ok)return u(vd(await d.json().catch(()=>null)).message??d.statusText);let f=await d.json();if(!_d(f))return u(`Device authorization response missing required fields`);r({userCode:f.userCode,verificationUri:f.verificationUri,verificationUriComplete:f.verificationUriComplete,expiresInSeconds:f.expiresIn});let p=await Sd({bankUrl:t,grant:f,identityHeaders:l,sleep:c});if(!p.ok)return u(p.message);let m=p.body;if(!id(m))return u(`Device token response missing required fields`);i(`Approved. Claiming agent...`);let h=await sd({bankUrl:t,claim:m,clientInstanceId:n,signerKeypair:o?{algorithm:o.algorithm,privateKeyHex:o.privateKeyHex,publicKeyHex:o.publicKeyHex}:s(),identityHeaders:l,log:i});return h.ok?h.result:u(h.message)}async function Sd(e){let{bankUrl:t,grant:n,identityHeaders:r,sleep:i}=e,a=Date.now()+n.expiresIn*1e3,o=Math.max(n.interval,1)*1e3,s=o;for(;Date.now()+o<=a;){await i(o);let e;try{e=await fetch(`${t}/v1/agent-link/device/token`,{method:`POST`,headers:{"Content-Type":`application/json`,...r},body:JSON.stringify({deviceCode:n.deviceCode})})}catch{s=Math.min(s*2,6e4),o=Math.max(o,s);continue}if(s=o,e.ok){let t=await e.json().catch(()=>null);return t===null?{ok:!1,message:`The bank returned an unreadable token response`}:{ok:!0,body:t}}let a=vd(await e.json().catch(()=>null));if(a.code!==`authorization_pending`){if(a.code===`slow_down`){o+=5e3;continue}return a.code===`expired_token`?{ok:!1,message:`The device code expired before approval. Run link again`}:{ok:!1,message:a.message??`The request was denied`}}}return{ok:!1,message:`Timed out waiting for approval`}}function Cd(e){if(typeof e!=`object`||!e)return!1;let t=e,n=t.signer;return t.credential===`signing_key`&&typeof t.agentId==`string`&&typeof t.name==`string`&&typeof t.keyThumbprint==`string`&&typeof t.activated==`boolean`&&typeof n==`object`&&!!n&&typeof n.status==`string`}async function wd(e){let{bankUrl:t,clientInstanceId:n,onUserCode:r,log:i=()=>{},appInfo:a,sleep:o=yd}=e;Xc(t,`bankUrl`);let s=Jl(a),c=e=>(i(`Link failed: ${e}`),null),l={clientInstanceId:n,signer:{algorithm:`p256`,publicKeyHex:e.publicKeyHex},...e.clientLabel===void 0?{}:{clientLabel:e.clientLabel}},u=e.agentId===void 0?{scope:`agent:connect:service`,...l,...e.suggestedAgentName===void 0?{}:{suggestedAgentName:e.suggestedAgentName}}:{scope:`agent:link:service`,agentId:e.agentId,...l},d;try{d=await fetch(`${t}/v1/agent-link/device/code`,{method:`POST`,headers:{"Content-Type":`application/json`,...s},body:JSON.stringify(u)})}catch{return c(`Could not reach the bank to start the device flow`)}if(!d.ok){let e=vd(await d.json().catch(()=>null));return e.code===`validation_failed`?c(`The bank rejected the request, which usually means it does not support --service yet. Nothing was created. Upgrade the bank and retry`):c(e.message??d.statusText)}let f=await d.json();if(!_d(f))return c(`Device authorization response missing required fields`);r({userCode:f.userCode,verificationUri:f.verificationUri,verificationUriComplete:f.verificationUriComplete,expiresInSeconds:f.expiresIn});let p=await Sd({bankUrl:t,grant:f,identityHeaders:s,sleep:o});return p.ok?id(p.body)?c(`This bank does not support --service yet: it created a session link for agent ${p.body.agentId}. Unlink it in the console before retrying`):Cd(p.body)?(i(`Approved. Signing key registered.`),{agentId:p.body.agentId,agentName:p.body.name,keyThumbprint:p.body.keyThumbprint,activated:p.body.activated,signerStatus:p.body.signer.status,...p.body.signer.reason===void 0?{}:{signerReason:p.body.signer.reason}}):c(`Device token response missing required fields`):c(p.message)}const Td=Q({"agent-id":ws({description:`Optional agent ID shown in the Catena console; omit to create and link a new agent`,schema:Bs}),"bank-url":Z({description:`Bank API URL (defaults to $CATENA_API_URL or prod)`,default:process.env.CATENA_API_URL??`https://api.catena.com`}),browser:Es({description:`Open the browser PKCE flow (default)`,negativeDescription:`Skip the browser and link with a device code you approve from another machine`,default:!0}),name:Z({description:`Suggested name for an agent created from this link; only used when agent-id is omitted`}),service:Es({description:`Provision a deployed-service signing credential instead of linking this machine: approval registers a P-256 key, no session tokens are minted, and nothing is stored locally. Interactive agent hosts must NOT use this`,default:!1}),"public-key":Z({description:`With --service: register this existing compressed P-256 public key (the deployment already holds the private key) instead of generating a keypair`}),profile:Ls}),Ed=/^0[23][0-9a-f]{64}$/;function Dd(e){let t=Math.round(e.expiresInSeconds/60);console.log(`\n  To approve this link, visit:  ${e.verificationUri}`),console.log(`  and enter the code:           ${e.userCode}`),console.log(`\n  Or open: ${e.verificationUriComplete}`),console.log(`\n  Waiting for approval (expires in ${t} minutes)...`)}function Od(e){console.log(`
+Keep this generated keypair if the approval completed before the CLI failed:`),console.log(`\n  ${Nl}=${e.privateKeyHex}`),console.log(`\nKeep this public key with your deployment notes. It is not an\nenvironment variable; signer recovery needs it:\n\n  ${e.publicKeyHex}`)}function kd(e){switch(e){case`signer_key_conflict`:return`  Wallet-send signer: not registered (signer key conflict); unlink the conflicting service link or re-run with the linked agent ID`;case`provider_registration_failed`:return`  Wallet-send signer: not registered (provider registration failed); retry after the provider recovers`;case void 0:return`  Wallet-send signer: not registered (registration failed); retry after checking the link status`;default:return`  Wallet-send signer: not registered (${e}); retry after checking the link status`}}function Ad({agentId:e,suggestedAgentName:t,browserRequested:n,isHeadless:r}){return e===void 0?{kind:`device-connect`,deviceTarget:{scope:`agent:connect`,...t===void 0?{}:{suggestedAgentName:t}}}:n?r()?{kind:`device-link`,deviceTarget:{agentId:e},notice:`No browser available — using device code flow.`}:{kind:`pkce-link`,agentId:e}:{kind:`device-link`,deviceTarget:{agentId:e}}}function jd(e){let t=m(`sha256`).update(E(process.cwd())).digest(`hex`).slice(0,16);return`${Dl(e??`agent`).slice(0,47)}-${t}`}function Md(e){try{let t=process.cwd();if($u(t))return null;let n=vl(t);return{directory:yl(t,e),reboundFrom:n!==null&&n!==e?n:null}}catch{return console.error(`Warning: could not bind the current directory to profile "${e}".`),null}}const Nd=c({meta:{name:`link`,description:`Link an existing agent, or create and link a new agent when agent-id is omitted`},args:Td.args,async run({args:e}){let t=Td.parse(e),n=t[`bank-url`],r=t[`agent-id`],i=t.name;if(t.service){await Pd({bankUrl:n,agentId:r,suggestedAgentName:i,publicKeyHex:t[`public-key`]});return}let a,o,s;try{if(Xc(n,`--bank-url`),t[`public-key`]!==void 0)throw Error(`--public-key requires --service`);if(r!==void 0&&i!==void 0)throw Error(`--name can only be used when agent-id is omitted`);let e=Bl({flag:ru(t),cwd:process.cwd(),log:e=>console.error(e)});a=(e!==null&&e.source!=="default"?e.name:null)??(r===void 0?null:ml(r,n)),o=a??(r===void 0?jd(i):Dl(r)),s=Cl(o,{bank_url:n,agent_id:r})}catch(e){X(e)}console.log(`
+Catena — Agent Setup`),console.log(`─`.repeat(25));let c=Kc(),l=await pd(c,s),u={bankUrl:n,clientInstanceId:s,log:e=>console.log(`  ${e}`),appInfo:Wl,existingSigner:l},d=Ad({agentId:r,suggestedAgentName:i,browserRequested:t.browser,isHeadless:Qu});d.kind===`device-link`&&d.notice!==void 0&&console.log(`  ${d.notice}`);let f=d.kind===`pkce-link`?await gd({...u,agentId:d.agentId,clientId:`catena-cli`,timeoutMs:3e5}):await xd({...u,...d.deviceTarget,onUserCode:Dd});f||X(`
+Failed to link agent. Run the command again to try again.`),await c.save(s,Cc(f.signer));let p=a??Ol(Dl(f.agentName),e=>e!==o&&xl(e)!==null);try{p===o?dl(p,{bank_url:n,agent_id:f.agentId,client_instance_id:s}):kl({reservationName:o,profileName:p,profile:{bank_url:n,agent_id:f.agentId,client_instance_id:s}})}catch(e){X(e)}console.log(`\n  Wrote profile "${p}"`);let m=Md(p);m!==null&&console.log(m.reboundFrom===null?`  Bound ${m.directory} to profile "${p}"`:`  Rebound ${m.directory} from profile "${m.reboundFrom}" to "${p}"`),console.log(`  To pin this identity for an agent host, set ${Ll}=${p}`),Fl()&&console.log(`  ${Nl} is set and outranks ${Ll}; unset it, or pass --profile ${p}, to use this profile`),console.log(`\nDone. Agent "${f.agentName}" linked.`),process.exit(0)}});async function Pd(e){try{if(Xc(e.bankUrl,`--bank-url`),e.agentId!==void 0&&e.suggestedAgentName!==void 0)throw Error(`--name can only be used when agent-id is omitted`);if(e.publicKeyHex!==void 0&&!Ed.test(e.publicKeyHex.toLowerCase()))throw Error(`--public-key must be compressed P-256 public key hex (66 chars)`)}catch(e){X(e)}console.log(`
+Catena — Deployed Service Setup`),console.log(`─`.repeat(31));let t=e.publicKeyHex===void 0?ga():null,n=t?.publicKeyHex??e.publicKeyHex?.toLowerCase()??``,r;try{r=ba(n)}catch(e){e instanceof ha||X(e),X(`Signing key public key is not a valid P-256 point`)}console.log(`  Signing key (RFC 7638 thumbprint): ${r}`);let i=`service-${m(`sha256`).update(n).digest(`hex`).slice(0,32)}`,a=!1,o=()=>{t&&a&&Od({publicKeyHex:n,privateKeyHex:t.privateKeyHex})},s;try{s=await wd({bankUrl:e.bankUrl,clientInstanceId:i,publicKeyHex:n,...e.agentId===void 0?{}:{agentId:e.agentId},...e.suggestedAgentName===void 0?{}:{suggestedAgentName:e.suggestedAgentName},onUserCode:e=>{a=!0,Dd(e)},log:e=>console.log(`  ${e}`),appInfo:Wl})}catch(e){o(),X(e)}s||(o(),X(`
+Failed to link the service. Run the command again to try again.`)),s.keyThumbprint!==r&&(o(),X(`The bank registered signing key thumbprint ${s.keyThumbprint}, which does not match the local key (${r}). Do not deploy this credential. Unlink the agent in the console and run link again`)),console.log(`\nDone. Agent "${s.agentName}" linked as a deployed service.`),console.log(`  Agent ID: ${s.agentId}`),console.log(`  Signing key (RFC 7638 thumbprint): ${s.keyThumbprint}`),s.signerStatus===`registered`||s.signerStatus===`already_registered`?console.log(`  Wallet-send signer: registered`):s.signerStatus===`not_applicable`?console.log(`  Wallet-send signer: deferred (${s.signerReason??`topology not ready`}); the org must be signing-ready before live sends`):s.signerStatus===`registration_failed`?console.log(kd(s.signerReason)):console.log(`  Wallet-send signer: not registered (${s.signerReason??s.signerStatus}); retry after checking the link status`),console.log(`
+Set this in the deployment environment:`),console.log(t?`\n  ${Nl}=${t.privateKeyHex}`:`\n  ${Nl}=<the private key this deployment already holds>`),e.bankUrl!==`https://api.catena.com`&&console.log(`  CATENA_API_URL=${e.bankUrl}`),console.log(`\nKeep the agent ID and this public key with your deployment notes. They\nare not environment variables; signer recovery needs them:\n\n  ${n}`),t&&console.log(`
 The private key is shown once and is not stored on this machine.`),process.exit(0)}
 /*! decimal.js-light v2.5.1 https://github.com/MikeMcl/decimal.js-light/LICENCE */
-const Od=e(i(((e,t)=>{(function(e){var n=1e9,r={precision:20,rounding:4,toExpNeg:-7,toExpPos:21,LN10:`2.302585092994045684017991454684364207601101488628772976033327900967572609677352480235997205089598298341967784042286`},i=!0,a=`[DecimalError] `,o=a+`Invalid argument: `,s=a+`Exponent out of range: `,c=Math.floor,l=Math.pow,u=/^(\d+(\.\d*)?|\.\d+)(e[+-]?\d+)?$/i,d,f=1e7,p=7,m=9007199254740991,h=c(m/p),g={};g.absoluteValue=g.abs=function(){var e=new this.constructor(this);return e.s&&=1,e},g.comparedTo=g.cmp=function(e){var t,n,r,i,a=this;if(e=new a.constructor(e),a.s!==e.s)return a.s||-e.s;if(a.e!==e.e)return a.e>e.e^a.s<0?1:-1;for(r=a.d.length,i=e.d.length,t=0,n=r<i?r:i;t<n;++t)if(a.d[t]!==e.d[t])return a.d[t]>e.d[t]^a.s<0?1:-1;return r===i?0:r>i^a.s<0?1:-1},g.decimalPlaces=g.dp=function(){var e=this,t=e.d.length-1,n=(t-e.e)*p;if(t=e.d[t],t)for(;t%10==0;t/=10)n--;return n<0?0:n},g.dividedBy=g.div=function(e){return b(this,new this.constructor(e))},g.dividedToIntegerBy=g.idiv=function(e){var t=this,n=t.constructor;return D(b(t,new n(e),0,1),n.precision)},g.equals=g.eq=function(e){return!this.cmp(e)},g.exponent=function(){return S(this)},g.greaterThan=g.gt=function(e){return this.cmp(e)>0},g.greaterThanOrEqualTo=g.gte=function(e){return this.cmp(e)>=0},g.isInteger=g.isint=function(){return this.e>this.d.length-2},g.isNegative=g.isneg=function(){return this.s<0},g.isPositive=g.ispos=function(){return this.s>0},g.isZero=function(){return this.s===0},g.lessThan=g.lt=function(e){return this.cmp(e)<0},g.lessThanOrEqualTo=g.lte=function(e){return this.cmp(e)<1},g.logarithm=g.log=function(e){var t,n=this,r=n.constructor,o=r.precision,s=o+5;if(e===void 0)e=new r(10);else if(e=new r(e),e.s<1||e.eq(d))throw Error(a+`NaN`);if(n.s<1)throw Error(a+(n.s?`NaN`:`-Infinity`));return n.eq(d)?new r(0):(i=!1,t=b(T(n,s),T(e,s),s),i=!0,D(t,o))},g.minus=g.sub=function(e){var t=this;return e=new t.constructor(e),t.s==e.s?O(t,e):_(t,(e.s=-e.s,e))},g.modulo=g.mod=function(e){var t,n=this,r=n.constructor,o=r.precision;if(e=new r(e),!e.s)throw Error(a+`NaN`);return n.s?(i=!1,t=b(n,e,0,1).times(e),i=!0,n.minus(t)):D(new r(n),o)},g.naturalExponential=g.exp=function(){return x(this)},g.naturalLogarithm=g.ln=function(){return T(this)},g.negated=g.neg=function(){var e=new this.constructor(this);return e.s=-e.s||0,e},g.plus=g.add=function(e){var t=this;return e=new t.constructor(e),t.s==e.s?_(t,e):O(t,(e.s=-e.s,e))},g.precision=g.sd=function(e){var t,n,r,i=this;if(e!==void 0&&e!==!!e&&e!==1&&e!==0)throw Error(o+e);if(t=S(i)+1,r=i.d.length-1,n=r*p+1,r=i.d[r],r){for(;r%10==0;r/=10)n--;for(r=i.d[0];r>=10;r/=10)n++}return e&&t>n?t:n},g.squareRoot=g.sqrt=function(){var e,t,n,r,o,s,l,u=this,d=u.constructor;if(u.s<1){if(!u.s)return new d(0);throw Error(a+`NaN`)}for(e=S(u),i=!1,o=Math.sqrt(+u),o==0||o==1/0?(t=y(u.d),(t.length+e)%2==0&&(t+=`0`),o=Math.sqrt(t),e=c((e+1)/2)-(e<0||e%2),o==1/0?t=`5e`+e:(t=o.toExponential(),t=t.slice(0,t.indexOf(`e`)+1)+e),r=new d(t)):r=new d(o.toString()),n=d.precision,o=l=n+3;;)if(s=r,r=s.plus(b(u,s,l+2)).times(.5),y(s.d).slice(0,l)===(t=y(r.d)).slice(0,l)){if(t=t.slice(l-3,l+1),o==l&&t==`4999`){if(D(s,n+1,0),s.times(s).eq(u)){r=s;break}}else if(t!=`9999`)break;l+=4}return i=!0,D(r,n)},g.times=g.mul=function(e){var t,n,r,a,o,s,c,l,u,d=this,p=d.constructor,m=d.d,h=(e=new p(e)).d;if(!d.s||!e.s)return new p(0);for(e.s*=d.s,n=d.e+e.e,l=m.length,u=h.length,l<u&&(o=m,m=h,h=o,s=l,l=u,u=s),o=[],s=l+u,r=s;r--;)o.push(0);for(r=u;--r>=0;){for(t=0,a=l+r;a>r;)c=o[a]+h[r]*m[a-r-1]+t,o[a--]=c%f|0,t=c/f|0;o[a]=(o[a]+t)%f|0}for(;!o[--s];)o.pop();return t?++n:o.shift(),e.d=o,e.e=n,i?D(e,p.precision):e},g.toDecimalPlaces=g.todp=function(e,t){var r=this,i=r.constructor;return r=new i(r),e===void 0?r:(v(e,0,n),t===void 0?t=i.rounding:v(t,0,8),D(r,e+S(r)+1,t))},g.toExponential=function(e,t){var r,i=this,a=i.constructor;return e===void 0?r=k(i,!0):(v(e,0,n),t===void 0?t=a.rounding:v(t,0,8),i=D(new a(i),e+1,t),r=k(i,!0,e+1)),r},g.toFixed=function(e,t){var r,i,a=this,o=a.constructor;return e===void 0?k(a):(v(e,0,n),t===void 0?t=o.rounding:v(t,0,8),i=D(new o(a),e+S(a)+1,t),r=k(i.abs(),!1,e+S(i)+1),a.isneg()&&!a.isZero()?`-`+r:r)},g.toInteger=g.toint=function(){var e=this,t=e.constructor;return D(new t(e),S(e)+1,t.rounding)},g.toNumber=function(){return+this},g.toPower=g.pow=function(e){var t,n,r,o,s,l,u=this,f=u.constructor,h=12,g=+(e=new f(e));if(!e.s)return new f(d);if(u=new f(u),!u.s){if(e.s<1)throw Error(a+`Infinity`);return u}if(u.eq(d))return u;if(r=f.precision,e.eq(d))return D(u,r);if(t=e.e,n=e.d.length-1,l=t>=n,s=u.s,!l){if(s<0)throw Error(a+`NaN`)}else if((n=g<0?-g:g)<=m){for(o=new f(d),t=Math.ceil(r/p+4),i=!1;n%2&&(o=o.times(u),A(o.d,t)),n=c(n/2),n!==0;)u=u.times(u),A(u.d,t);return i=!0,e.s<0?new f(d).div(o):D(o,r)}return s=s<0&&e.d[Math.max(t,n)]&1?-1:1,u.s=1,i=!1,o=e.times(T(u,r+h)),i=!0,o=x(o),o.s=s,o},g.toPrecision=function(e,t){var r,i,a=this,o=a.constructor;return e===void 0?(r=S(a),i=k(a,r<=o.toExpNeg||r>=o.toExpPos)):(v(e,1,n),t===void 0?t=o.rounding:v(t,0,8),a=D(new o(a),e,t),r=S(a),i=k(a,e<=r||r<=o.toExpNeg,e)),i},g.toSignificantDigits=g.tosd=function(e,t){var r=this,i=r.constructor;return e===void 0?(e=i.precision,t=i.rounding):(v(e,1,n),t===void 0?t=i.rounding:v(t,0,8)),D(new i(r),e,t)},g.toString=g.valueOf=g.val=g.toJSON=function(){var e=this,t=S(e),n=e.constructor;return k(e,t<=n.toExpNeg||t>=n.toExpPos)};function _(e,t){var n,r,a,o,s,c,l,u,d=e.constructor,m=d.precision;if(!e.s||!t.s)return t.s||(t=new d(e)),i?D(t,m):t;if(l=e.d,u=t.d,s=e.e,a=t.e,l=l.slice(),o=s-a,o){for(o<0?(r=l,o=-o,c=u.length):(r=u,a=s,c=l.length),s=Math.ceil(m/p),c=s>c?s+1:c+1,o>c&&(o=c,r.length=1),r.reverse();o--;)r.push(0);r.reverse()}for(c=l.length,o=u.length,c-o<0&&(o=c,r=u,u=l,l=r),n=0;o;)n=(l[--o]=l[o]+u[o]+n)/f|0,l[o]%=f;for(n&&(l.unshift(n),++a),c=l.length;l[--c]==0;)l.pop();return t.d=l,t.e=a,i?D(t,m):t}function v(e,t,n){if(e!==~~e||e<t||e>n)throw Error(o+e)}function y(e){var t,n,r,i=e.length-1,a=``,o=e[0];if(i>0){for(a+=o,t=1;t<i;t++)r=e[t]+``,n=p-r.length,n&&(a+=w(n)),a+=r;o=e[t],r=o+``,n=p-r.length,n&&(a+=w(n))}else if(o===0)return`0`;for(;o%10==0;)o/=10;return a+o}var b=(function(){function e(e,t){var n,r=0,i=e.length;for(e=e.slice();i--;)n=e[i]*t+r,e[i]=n%f|0,r=n/f|0;return r&&e.unshift(r),e}function t(e,t,n,r){var i,a;if(n!=r)a=n>r?1:-1;else for(i=a=0;i<n;i++)if(e[i]!=t[i]){a=e[i]>t[i]?1:-1;break}return a}function n(e,t,n){for(var r=0;n--;)e[n]-=r,r=+(e[n]<t[n]),e[n]=r*f+e[n]-t[n];for(;!e[0]&&e.length>1;)e.shift()}return function(r,i,o,s){var c,l,u,d,m,h,g,_,v,y,b,x,C,w,T,E,O,k,A=r.constructor,ee=r.s==i.s?1:-1,j=r.d,M=i.d;if(!r.s)return new A(r);if(!i.s)throw Error(a+`Division by zero`);for(l=r.e-i.e,O=M.length,T=j.length,g=new A(ee),_=g.d=[],u=0;M[u]==(j[u]||0);)++u;if(M[u]>(j[u]||0)&&--l,x=o==null?o=A.precision:s?o+(S(r)-S(i))+1:o,x<0)return new A(0);if(x=x/p+2|0,u=0,O==1)for(d=0,M=M[0],x++;(u<T||d)&&x--;u++)C=d*f+(j[u]||0),_[u]=C/M|0,d=C%M|0;else{for(d=f/(M[0]+1)|0,d>1&&(M=e(M,d),j=e(j,d),O=M.length,T=j.length),w=O,v=j.slice(0,O),y=v.length;y<O;)v[y++]=0;k=M.slice(),k.unshift(0),E=M[0],M[1]>=f/2&&++E;do d=0,c=t(M,v,O,y),c<0?(b=v[0],O!=y&&(b=b*f+(v[1]||0)),d=b/E|0,d>1?(d>=f&&(d=f-1),m=e(M,d),h=m.length,y=v.length,c=t(m,v,h,y),c==1&&(d--,n(m,O<h?k:M,h))):(d==0&&(c=d=1),m=M.slice()),h=m.length,h<y&&m.unshift(0),n(v,m,y),c==-1&&(y=v.length,c=t(M,v,O,y),c<1&&(d++,n(v,O<y?k:M,y))),y=v.length):c===0&&(d++,v=[0]),_[u++]=d,c&&v[0]?v[y++]=j[w]||0:(v=[j[w]],y=1);while((w++<T||v[0]!==void 0)&&x--)}return _[0]||_.shift(),g.e=l,D(g,s?o+S(g)+1:o)}})();function x(e,t){var n,r,a,o,c,u,f=0,p=0,m=e.constructor,h=m.precision;if(S(e)>16)throw Error(s+S(e));if(!e.s)return new m(d);for(t==null?(i=!1,u=h):u=t,c=new m(.03125);e.abs().gte(.1);)e=e.times(c),p+=5;for(r=Math.log(l(2,p))/Math.LN10*2+5|0,u+=r,n=a=o=new m(d),m.precision=u;;){if(a=D(a.times(e),u),n=n.times(++f),c=o.plus(b(a,n,u)),y(c.d).slice(0,u)===y(o.d).slice(0,u)){for(;p--;)o=D(o.times(o),u);return m.precision=h,t==null?(i=!0,D(o,h)):o}o=c}}function S(e){for(var t=e.e*p,n=e.d[0];n>=10;n/=10)t++;return t}function C(e,t,n){if(t>e.LN10.sd())throw i=!0,n&&(e.precision=n),Error(a+`LN10 precision limit exceeded`);return D(new e(e.LN10),t)}function w(e){for(var t=``;e--;)t+=`0`;return t}function T(e,t){var n,r,o,s,c,l,u,f,p,m=1,h=10,g=e,_=g.d,v=g.constructor,x=v.precision;if(g.s<1)throw Error(a+(g.s?`NaN`:`-Infinity`));if(g.eq(d))return new v(0);if(t==null?(i=!1,f=x):f=t,g.eq(10))return t??(i=!0),C(v,f);if(f+=h,v.precision=f,n=y(_),r=n.charAt(0),s=S(g),Math.abs(s)<0x5543df729c000){for(;r<7&&r!=1||r==1&&n.charAt(1)>3;)g=g.times(e),n=y(g.d),r=n.charAt(0),m++;s=S(g),r>1?(g=new v(`0.`+n),s++):g=new v(r+`.`+n.slice(1))}else return u=C(v,f+2,x).times(s+``),g=T(new v(r+`.`+n.slice(1)),f-h).plus(u),v.precision=x,t==null?(i=!0,D(g,x)):g;for(l=c=g=b(g.minus(d),g.plus(d),f),p=D(g.times(g),f),o=3;;){if(c=D(c.times(p),f),u=l.plus(b(c,new v(o),f)),y(u.d).slice(0,f)===y(l.d).slice(0,f))return l=l.times(2),s!==0&&(l=l.plus(C(v,f+2,x).times(s+``))),l=b(l,new v(m),f),v.precision=x,t==null?(i=!0,D(l,x)):l;l=u,o+=2}}function E(e,t){var n,r,a;for((n=t.indexOf(`.`))>-1&&(t=t.replace(`.`,``)),(r=t.search(/e/i))>0?(n<0&&(n=r),n+=+t.slice(r+1),t=t.substring(0,r)):n<0&&(n=t.length),r=0;t.charCodeAt(r)===48;)++r;for(a=t.length;t.charCodeAt(a-1)===48;)--a;if(t=t.slice(r,a),t){if(a-=r,n=n-r-1,e.e=c(n/p),e.d=[],r=(n+1)%p,n<0&&(r+=p),r<a){for(r&&e.d.push(+t.slice(0,r)),a-=p;r<a;)e.d.push(+t.slice(r,r+=p));t=t.slice(r),r=p-t.length}else r-=a;for(;r--;)t+=`0`;if(e.d.push(+t),i&&(e.e>h||e.e<-h))throw Error(s+n)}else e.s=0,e.e=0,e.d=[0];return e}function D(e,t,n){var r,a,o,u,d,m,g,_,v=e.d;for(u=1,o=v[0];o>=10;o/=10)u++;if(r=t-u,r<0)r+=p,a=t,g=v[_=0];else{if(_=Math.ceil((r+1)/p),o=v.length,_>=o)return e;for(g=o=v[_],u=1;o>=10;o/=10)u++;r%=p,a=r-p+u}if(n!==void 0&&(o=l(10,u-a-1),d=g/o%10|0,m=t<0||v[_+1]!==void 0||g%o,m=n<4?(d||m)&&(n==0||n==(e.s<0?3:2)):d>5||d==5&&(n==4||m||n==6&&(r>0?a>0?g/l(10,u-a):0:v[_-1])%10&1||n==(e.s<0?8:7))),t<1||!v[0])return m?(o=S(e),v.length=1,t=t-o-1,v[0]=l(10,(p-t%p)%p),e.e=c(-t/p)||0):(v.length=1,v[0]=e.e=e.s=0),e;if(r==0?(v.length=_,o=1,_--):(v.length=_+1,o=l(10,p-r),v[_]=a>0?(g/l(10,u-a)%l(10,a)|0)*o:0),m)for(;;)if(_==0){(v[0]+=o)==f&&(v[0]=1,++e.e);break}else{if(v[_]+=o,v[_]!=f)break;v[_--]=0,o=1}for(r=v.length;v[--r]===0;)v.pop();if(i&&(e.e>h||e.e<-h))throw Error(s+S(e));return e}function O(e,t){var n,r,a,o,s,c,l,u,d,m,h=e.constructor,g=h.precision;if(!e.s||!t.s)return t.s?t.s=-t.s:t=new h(e),i?D(t,g):t;if(l=e.d,m=t.d,r=t.e,u=e.e,l=l.slice(),s=u-r,s){for(d=s<0,d?(n=l,s=-s,c=m.length):(n=m,r=u,c=l.length),a=Math.max(Math.ceil(g/p),c)+2,s>a&&(s=a,n.length=1),n.reverse(),a=s;a--;)n.push(0);n.reverse()}else{for(a=l.length,c=m.length,d=a<c,d&&(c=a),a=0;a<c;a++)if(l[a]!=m[a]){d=l[a]<m[a];break}s=0}for(d&&(n=l,l=m,m=n,t.s=-t.s),c=l.length,a=m.length-c;a>0;--a)l[c++]=0;for(a=m.length;a>s;){if(l[--a]<m[a]){for(o=a;o&&l[--o]===0;)l[o]=f-1;--l[o],l[a]+=f}l[a]-=m[a]}for(;l[--c]===0;)l.pop();for(;l[0]===0;l.shift())--r;return l[0]?(t.d=l,t.e=r,i?D(t,g):t):new h(0)}function k(e,t,n){var r,i=S(e),a=y(e.d),o=a.length;return t?(n&&(r=n-o)>0?a=a.charAt(0)+`.`+a.slice(1)+w(r):o>1&&(a=a.charAt(0)+`.`+a.slice(1)),a=a+(i<0?`e`:`e+`)+i):i<0?(a=`0.`+w(-i-1)+a,n&&(r=n-o)>0&&(a+=w(r))):i>=o?(a+=w(i+1-o),n&&(r=n-i-1)>0&&(a=a+`.`+w(r))):((r=i+1)<o&&(a=a.slice(0,r)+`.`+a.slice(r)),n&&(r=n-o)>0&&(i+1===o&&(a+=`.`),a+=w(r))),e.s<0?`-`+a:a}function A(e,t){if(e.length>t)return e.length=t,!0}function ee(e){var t,n,r;function i(e){var t=this;if(!(t instanceof i))return new i(e);if(t.constructor=i,e instanceof i){t.s=e.s,t.e=e.e,t.d=(e=e.d)?e.slice():e;return}if(typeof e==`number`){if(e*0!=0)throw Error(o+e);if(e>0)t.s=1;else if(e<0)e=-e,t.s=-1;else{t.s=0,t.e=0,t.d=[0];return}if(e===~~e&&e<1e7){t.e=0,t.d=[e];return}return E(t,e.toString())}if(typeof e!=`string`)throw Error(o+e);if(e.charCodeAt(0)===45?(e=e.slice(1),t.s=-1):t.s=1,u.test(e))E(t,e);else throw Error(o+e)}if(i.prototype=g,i.ROUND_UP=0,i.ROUND_DOWN=1,i.ROUND_CEIL=2,i.ROUND_FLOOR=3,i.ROUND_HALF_UP=4,i.ROUND_HALF_DOWN=5,i.ROUND_HALF_EVEN=6,i.ROUND_HALF_CEIL=7,i.ROUND_HALF_FLOOR=8,i.clone=ee,i.config=i.set=j,e===void 0&&(e={}),e)for(r=[`precision`,`rounding`,`toExpNeg`,`toExpPos`,`LN10`],t=0;t<r.length;)e.hasOwnProperty(n=r[t++])||(e[n]=this[n]);return i.config(e),i}function j(e){if(!e||typeof e!=`object`)throw Error(a+`Object expected`);var t,r,i,s=[`precision`,1,n,`rounding`,0,8,`toExpNeg`,-1/0,0,`toExpPos`,0,1/0];for(t=0;t<s.length;t+=3)if((i=e[r=s[t]])!==void 0){if(c(i)===i&&i>=s[t+1]&&i<=s[t+2])this[r]=i;else throw Error(o+r+`: `+i)}if((i=e[r=`LN10`])!==void 0){if(i==Math.LN10)this[r]=new this(i);else throw Error(o+r+`: `+i)}return this}r=ee(r),r.default=r.Decimal=r,d=new r(1),typeof define==`function`&&define.amd?define(function(){return r}):t!==void 0&&t.exports?t.exports=r:(e||=typeof self<`u`&&self&&self.self==self?self:Function(`return this`)(),e.Decimal=r)})(e)}))(),1).default;Od.set({rounding:Od.ROUND_HALF_EVEN});const kd=new Map,Ad=/^[A-Z]{3}$/,jd=/^[A-Z0-9]{2,6}$/;function Md(e,t,n,r){if(kd.has(e))throw Error(`duplicate asset id ${e}`);let i=new Od(r);if(i.isNegative())throw Error(`dustThreshold must be a non-negative decimal`);if(i.decimalPlaces()>t)throw Error(`dustThreshold (${r}) must not be finer than the asset's ${t} decimals`);if(!Number.isInteger(t)||!Number.isInteger(n)||t<0||n<0)throw Error(`decimals and presentmentDecimals must be non-negative integers`);if(n>t)throw Error(`presentment decimals should be less than or equal to decimals`)}function Nd(e,t,n,r,i){if(!Ad.test(e))throw Error(`fiat asset ids must be 3-letter ISO-4217 codes`);Md(e,n,r,i.dustThreshold);let a=e;return kd.set(e,{id:a,symbol:e,name:t,kind:`fiat`,decimals:n,presentmentDecimals:r,denomination:e,valuation:{type:`par`},dustThreshold:i.dustThreshold}),a}function Pd(e,t,n,r,i){if(!jd.test(e)||Ad.test(e))throw Error(`stablecoin tickers must be 2-6 uppercase alphanumerics and not a 3-letter ISO-4217 shape`);let a=kd.get(i.denomination);if(!a||a.kind!==`fiat`)throw Error(`stablecoin denomination must be a registered fiat asset, got ${i.denomination}`);if(n>a.decimals)throw Error(`par stablecoin decimals (${n}) must not exceed its denomination fiat's (${a.decimals})`);Md(e,n,r,i.dustThreshold);let o=e;return kd.set(e,{id:o,symbol:e,name:t,kind:`stablecoin`,decimals:n,presentmentDecimals:r,denomination:a.denomination,valuation:{type:`par`},dustThreshold:i.dustThreshold}),o}Pd(`USDC`,`USD Coin`,6,2,{denomination:Nd(`USD`,`US Dollar`,6,2,{dustThreshold:`0.01`}),dustThreshold:`0.01`}),new Od(1e6),new Od(1e3);const Fd=d.pipe(d.string(`Amount must be a string`),d.nonEmpty(`Amount must not be empty`),d.check(e=>e.trim()===e,`Amount must not have leading or trailing whitespace`),d.check(e=>!e.includes(`e`)&&!e.includes(`E`),`Scientific notation is not supported (e.g. use 1000000 instead of 1e6)`),d.check(e=>!e.startsWith(`+`),`Amount must not have a '+' prefix`),d.check(e=>!e.startsWith(`-`),`Amount must be non-negative`),d.check(e=>{try{return new Od(e).gte(0)}catch{return!1}},`Amount must be a valid decimal (e.g. 100 or 100.50)`)),Id=d.pipe(d.string(`Count must be a string`),d.transform(e=>e.trim()),d.check(e=>/^\d+$/.test(e),`Count must be a whole number of transactions (e.g. 20)`),d.transform(Number),d.check(e=>Number.isSafeInteger(e),`Count is too large`),d.check(e=>e>=1,`Count must be at least 1`)),Ld={s:1,m:60,h:3600,d:86400},Rd=d.pipe(d.string(`Duration must be a string`),d.transform(e=>e.trim()),d.check(e=>/^\d+[smhd]?$/.test(e),`Duration must be a number of seconds or a value with a unit (e.g. 90s, 30m, 4h, 2d)`),d.transform(e=>{let t=e.at(-1)??``;return t in Ld?Number(e.slice(0,-1))*Ld[t]:Number(e)}),d.check(e=>e>=60,`Duration must be at least 1 minute`),d.check(e=>e<=604800,`Duration must be at most 7 days`)),zd=Q({profile:Ls,json:Rs}),Bd=c({meta:{name:`show`,description:`Show the agent's assigned policy`},args:zd.args,async run({args:e}){await $(zd.parse(e))(e=>e.getPolicy())}}),Vd=Q({account:Z({description:`Account whose existing hard limit should increase. For a transfer limit, the source account funds move out of.`,required:!0}),capability:Ds({description:`Which capability's limit to increase: send (payments to counterparties) or transfer (between the user's own accounts)`,choices:$o,default:`send`}),rule:Ds({description:`Which limit to adjust`,choices:fo,default:`per_transaction_amount`}),amount:Z({description:`New threshold for an amount limit, as a decimal USD string (e.g. 500.00)`,schema:Fd,showValueInError:!0}),count:Z({description:`New threshold for a transaction-count limit (e.g. 20)`,schema:Id,showValueInError:!0}),duration:Z({description:`How long the override should last once approved (e.g. 90s, 30m, 4h, 2d). One minute to seven days.`,required:!0,schema:Rd,showValueInError:!0}),reason:Z({description:`Why the task needs this, for the person who reviews the request`,required:!0}),idempotencyKey:Z({description:`Optional operation key. Reuse the same value only when retrying the same submission; omitted generates a fresh key for this invocation.`,schema:du}),profile:Ls,json:Rs}),Hd=c({meta:{name:`request-override`,description:`Ask a person to approve a temporary change to this agent's limits`},args:Vd.args,async run({args:e}){let t=Vd.parse(e),n=$(t),r={type:`policy_override`,operations:[Ud(t)],durationSeconds:t.duration,reason:t.reason};await n(e=>e.submitIntent({action:r,...t.idempotencyKey!==void 0&&{idempotencyKey:t.idempotencyKey}}))}});function Ud(e){return e.rule===`hourly_count`||e.rule===`daily_count`?(e.amount!==void 0&&X(`--amount does not apply to ${e.rule}; use --count`),e.count===void 0&&X(`--count is required for ${e.rule}`),{type:`increase_limit`,accountId:e.account,capability:e.capability,limitType:e.rule,newLimit:{count:e.count}}):(e.count!==void 0&&X(`--count does not apply to ${e.rule}; use --amount`),e.amount===void 0&&X(`--amount is required for ${e.rule}`),{type:`increase_limit`,accountId:e.account,capability:e.capability,limitType:e.rule,newLimit:{amount:e.amount,assetId:`USD`}})}const Wd=c({meta:{name:`policy`,description:`Inspect the agent's policy`},subCommands:{show:Bd,"request-override":Hd}}),Gd=Q({profile:ws({description:`Profile name`,required:!0})});function Kd(){try{return Hl({env:process.env[Rl],cwd:process.cwd(),log:e=>console.error(e)})}catch(e){return X(e)}}const qd=c({meta:{name:`use`,description:`Set the default credential profile`},args:Gd.args,async run({args:e}){let t=Gd.parse(e);try{El(t.profile),Yl({defaultProfile:t.profile})}catch(e){X(e)}}}),Jd=c({meta:{name:`current`,description:`Show the selected credential profile and how it was chosen`},async run(){let e=Kd(),t;try{t=xl(e.name)}catch(e){X(e)}t===null&&X(`Profile "${e.name}" is not linked.\nRun 'catena link --profile ${e.name} <agent-id>' to authenticate.`),Yl({profile:e.name,source:e.source,bankUrl:t.bank_url,agentId:fl(t)?t.agent_id:void 0})}}),Yd=c({meta:{name:`list`,description:`List credential profiles and their directory bindings`},async run(){let e;try{e=cl()}catch(e){X(e)}let t;try{t=Hl({env:process.env[Rl],cwd:process.cwd()}).name}catch{t=null}let n=Object.entries(e.directories??{});Yl({defaultProfile:e.default_profile,profiles:Object.entries(e.profiles).toSorted(([e],[t])=>e.localeCompare(t)).map(([e,r])=>({name:e,bankUrl:r.bank_url,agentId:fl(r)?r.agent_id:void 0,directories:n.filter(([,t])=>t===e).map(([e])=>e).toSorted(),current:e===t}))})}}),Xd=Q({profile:ws({description:`Profile name to bind`,required:!0}),path:ws({description:`Directory to bind (defaults to the current directory)`})}),Zd=c({meta:{name:`bind`,description:`Bind a directory to a profile for automatic selection`},args:Xd.args,async run({args:e}){let t=Xd.parse(e);try{let e=t.path??process.cwd();if(Ku(e))throw Error(`Refusing to bind the home directory or an ancestor of it — that would shadow the default profile for every directory beneath it. Bind a specific agent directory instead.`);let n=yl(e,t.profile);Yl({profile:t.profile,directory:n})}catch(e){X(e)}}}),Qd=Q({path:ws({description:`Directory to unbind (defaults to the current directory)`})}),$d=c({meta:{name:`unbind`,description:`Remove a directory's profile binding`},args:Qd.args,async run({args:e}){let t=Qd.parse(e);try{Yl(bl(t.path??process.cwd()))}catch(e){X(e)}}}),ef=c({meta:{name:`profiles`,description:`Manage credential profiles`},subCommands:{use:qd,current:Jd,list:Yd,bind:Zd,unbind:$d}}),tf=Q({account:Z({description:`Source account id; omit when the policy allows sends from exactly one account`,schema:Bs}),rail:Z({description:`Destination counterparty rail id (cprl_...)`,required:!0,schema:Bs}),amount:Z({description:`USD amount as a decimal string (e.g. 125.00)`,required:!0,schema:Fd,showValueInError:!0}),method:Ds({description:`ach | wire | on-chain; ach and wire require a bank rail, on-chain a wallet rail`,required:!0,choices:Eo}),memo:Z({description:`Memo on the underlying transfer`}),description:Z({description:`Operator-facing description`}),idempotencyKey:Z({description:`Optional operation key. Reuse the same value only when retrying the same submission; omitted generates a fresh key for this invocation.`,schema:du}),profile:Ls,json:Rs}),nf=c({meta:{name:`send`,description:`Submit a USD send intent to a counterparty rail`},args:tf.args,async run({args:e}){let t=tf.parse(e),n=$(t),r={type:`send`,...t.account!==void 0&&{accountId:t.account},counterpartyRailId:t.rail,amount:t.amount,method:t.method,...t.memo?{memo:t.memo}:{},...t.description?{description:t.description}:{}};await n(e=>e.submitIntent({action:r,...t.idempotencyKey?{idempotencyKey:t.idempotencyKey}:{}}))}}),rf=Q({from:Z({description:`Source account id`,required:!0,schema:Bs}),to:Z({description:`Destination account id`,required:!0,schema:Bs}),amount:Z({description:`USD amount as a decimal string (e.g. 125.00)`,required:!0,schema:Fd,showValueInError:!0}),memo:Z({description:`Memo on the underlying transfer`}),description:Z({description:`Operator-facing description`}),idempotencyKey:Z({description:`Optional operation key. Reuse the same value only when retrying the same submission; omitted generates a fresh key for this invocation.`,schema:du}),profile:Ls,json:Rs}),af=c({meta:{name:`transfer`,description:`Submit a USD transfer intent between two of this agent's accounts`},args:rf.args,async run({args:e}){let t=rf.parse(e),n=$(t),r={type:`transfer`,accountId:t.from,toAccountId:t.to,amount:t.amount,...t.memo?{memo:t.memo}:{},...t.description?{description:t.description}:{}};await n(e=>e.submitIntent({action:r,...t.idempotencyKey?{idempotencyKey:t.idempotencyKey}:{}}))}}),of=Q({profile:Ls,force:Es({description:`Remove the profile and its local credentials without contacting the server; use when the credential is missing, revoked, or a link was interrupted`,default:!1}),json:Rs}),sf=c({meta:{name:`unlink`,description:`Disconnect the selected agent profile`},args:of.args,async run({args:e}){let t=of.parse(e),n=Wl(),r;try{r=Hl({flag:Xl(t),env:process.env[Rl],cwd:process.cwd(),log:e=>console.error(e)}).name}catch(e){X(e)}if(t.force){let e;try{if(e=xl(r),e===null)throw Error(`Profile "${r}" not found`);await n.delete(e.client_instance_id),await n.delete(id(e.client_instance_id)),gl(r)}catch(e){X(e)}Yl({success:!0,profile:r,...fl(e)?{agentId:e.agent_id}:{},local:!0},{compact:t.json});return}let i=`To remove only this machine's copy, run 'catena unlink --profile ${r} --force'.`,a=await jl({profileName:r,fallbackBankUrl:Ll},n);a.ok||X(`${a.message} ${i}`);let o=Ul(a);try{await o.unlinkAgent(),await n.delete(a.clientInstanceId),await n.delete(id(a.clientInstanceId)),gl(r)}catch(e){X(`${gs(Jl(e,r))} ${i}`)}Yl({success:!0,profile:r,agentId:a.agentId},{compact:t.json})}}),cf=Q({profile:Ls,json:Rs}),lf=c({meta:{name:`whoami`,description:`Show which agent you are currently acting as`},args:cf.args,async run({args:e}){await $(cf.parse(e))(e=>e.whoami())}});function uf(e){throw Error(`Unhandled case: ${String(e)}`)}function df(e,t){return t?.body!==void 0&&t.body!==null&&typeof t.body!=`string`&&!(t.body instanceof URLSearchParams)&&!(t.body instanceof Blob)&&!(t.body instanceof ArrayBuffer)&&!ArrayBuffer.isView(t.body)?!1:typeof Request<`u`&&e instanceof Request?e.body===null&&!e.bodyUsed:!0}function ff(e,t){let n=new Headers(typeof Request<`u`&&e instanceof Request?e.headers:void 0);return new Headers(t?.headers).forEach((e,t)=>{n.set(t,e)}),n}const pf=/^0x[0-9a-fA-F]{64}$/;async function mf(e,t,n,r){try{await e.reportSettlement({intentId:t,txHash:n,...r!==void 0&&{receipt:r}})}catch{return}}const hf=[`PAYMENT-REQUIRED`,`X-Payment-Required`],gf=/^0x[0-9a-fA-F]{40}$/,_f=d.looseObject({success:d.boolean(),transaction:d.string(),extensions:d.optional(d.unknown())}),vf=d.looseObject({x402Version:d.literal(2),accepts:d.array(Wo),resource:d.optional(Go),extensions:d.optional(d.unknown())}),yf=`x402_network_mismatch`,bf=`x402_counterparty_rail_not_found`,xf=new Set([`x402_requirement_not_payable`,yf,bf]),Sf={"eip155:8453":`Base`,"eip155:84532":`Base Sepolia`};function Cf(e){let t=Object.hasOwn(Sf,e)?Sf[e]:void 0;return t?`${t} (${e})`:e}function wf(e){let t=e.replaceAll(`-`,`+`).replaceAll(`_`,`/`),n=Uint8Array.from(atob(t),e=>e.charCodeAt(0));return JSON.parse(new TextDecoder().decode(n))}function Tf(e){let t=hf.map(t=>e.headers.get(t)).find(e=>e!==null);if(t)try{let e=d.safeParse(vf,wf(t));return e.success?e.output:void 0}catch{return}}async function Ef(e,t,n){try{let r=n.headers.get(`PAYMENT-RESPONSE`);if(!r)return;let i=d.safeParse(_f,wf(r));if(!i.success||!i.output.success||!pf.test(i.output.transaction))return;let a=ro(i.output.extensions);await mf(e,t,i.output.transaction,a)}catch{}}var Df=class extends Error{reasons;constructor(e,t=[],n={}){super(t.length>0&&(n.appendReasonsToMessage??!0)?`${e}: ${t.join(`; `)}`:e),this.name=`X402PaymentError`,this.reasons=t}},Of=class extends Df{accountId;requiredNetworks;constructor(e,t,n=[]){super(`Account ${e} cannot fund this 402 challenge: it must be paid from a wallet account on ${t.map(Cf).join(` or `)}`,n,{appendReasonsToMessage:!1}),this.name=`X402NetworkMismatchError`,this.accountId=e,this.requiredNetworks=t}},kf=class extends Df{payTo;network;serviceName;constructor(e,t,n,r=[]){super(`This 402 pays ${e} on ${Cf(t)}, which is not a saved counterparty wallet rail; add it as a counterparty before paying`,r,{appendReasonsToMessage:!1}),this.name=`X402CounterpartyNotFoundError`,this.payTo=e,this.network=t,this.serviceName=n}},Af=class extends Df{intentId;expiresAt;constructor(e,t,n){super(`The payment is awaiting a human approval (intent ${e}); once an operator approves it, retry the request to complete the payment`,t),this.name=`X402ApprovalPendingError`,this.intentId=e,this.expiresAt=n}},jf=class extends Df{receipt;constructor(e,t){super(`The payment settled (intent ${e.intentId}) but the post-payment continuation failed; retry the request with the PAYMENT-SIGNATURE header from the receipt (or getIntent("${e.intentId}") data.paymentCredential.value) instead of paying again`),this.name=`X402RetryFailedError`,this.receipt=e,this.cause=t}};async function Mf(e,t){try{return await t()}catch(t){throw new jf(e,t)}}var Nf=class extends Df{intentId;requirements;constructor(e,t,n){super(`The payment could not be confirmed (intent ${e}); check getIntent("${e}") — completed: reuse its data.paymentCredential.value as the PAYMENT-SIGNATURE header; processing: poll until terminal; pay again only after blocked or failed`),this.name=`X402SubmitInterruptedError`,this.intentId=e,this.requirements=t,this.cause=n}};async function Pf(e,t){let n=t.paymentRequired.accepts.filter(e=>e.scheme===`exact`),r=n.filter(e=>t.maxAtomicAmount===void 0||/^\d+$/.test(e.amount)&&BigInt(e.amount)<=t.maxAtomicAmount).slice(0,5);if(r.length===0)throw new Df(n.length>0&&t.maxAtomicAmount!==void 0?`Every requirement in the 402 challenge costs more than the caller's maximum amount`:`The 402 challenge offers no exact-scheme requirement Catena can pay`);let i=t.resource??t.paymentRequired.resource,a=[];for(let n of r){let r=await Ff(e,{accountId:t.accountId,requirements:n,resource:i,signedOffer:no(t.paymentRequired.extensions,n)}).catch(e=>{if(e instanceof ss&&e.code!==void 0&&xf.has(e.code)){a.push({error:e,requirement:n});return}throw e});if(r)return r}let o=a.filter(e=>e.error.code===bf),s=a.filter(e=>e.error.code===yf),c=a.filter(e=>e.error.code!==bf&&e.error.code!==yf),l=[...new Set([...o,...s,...c].map(e=>e.error.message))],u=o.find(e=>e.error.status===404&&gf.test(e.requirement.payTo));throw u?new kf(u.requirement.payTo,u.requirement.network,i?.serviceName,l):s.length>0&&o.length===0?new Of(t.accountId,[...new Set(s.map(e=>e.requirement.network))],l):new Df(`No requirement in the 402 challenge is payable from this account`,l)}async function Ff(e,t){let n=await e.submitIntent({action:{type:`x402`,accountId:t.accountId,paymentRequirements:t.requirements,...t.resource!==void 0&&{resource:t.resource},...t.signedOffer!==void 0&&{signedOffer:t.signedOffer}},idempotencyKey:crypto.randomUUID()}).catch(e=>{throw e instanceof fs&&e.outcome===`unknown`?new Nf(e.intentId,t.requirements,e):e});if(n.status===`completed`){let e=Lo(n.data);if(e!==void 0)return{intentId:n.id,paymentSignature:e,requirements:t.requirements};throw new Df(`The completed payment did not carry an x402 payment signature`)}switch(n.status){case`pending`:throw new Af(n.id,n.reasons,n.expiresAt);case`processing`:throw new Df(`The payment is still processing (intent ${n.id}); this client cannot resume an in-flight x402 settlement`);case`blocked`:case`failed`:throw new Df(`Catena declined the payment`,n.reasons)}return uf(n.status)}function If(e,t){let n=(t.baseFetch??globalThis.fetch).bind(globalThis);return async(r,i)=>{let a=await n(r,i);if(a.status!==402)return a;let o=Tf(a);if(!o)return a;if(!df(r,i))throw new Df(`The request body cannot be replayed after payment; buffer the body (string, Blob, or ArrayBuffer) before using the x402 fetch wrapper`);let s=await Pf(e,{accountId:t.accountId,paymentRequired:o,...t.maxAtomicAmount!==void 0&&{maxAtomicAmount:t.maxAtomicAmount}});await Mf(s,()=>t.onPayment?.(s));let c=ff(r,i);c.set(`PAYMENT-SIGNATURE`,s.paymentSignature);let l=await Mf(s,()=>n(r,{...i,headers:c}));return Ef(e,s.intentId,l),l}}function Lf(e){if(e===`@-`)return Rf(0,`stdin`);if(e.startsWith(`@`)){let t=e.slice(1);return t===``?X(`--data @<path>: no file path given`):Rf(t,`@${t}`)}return e}function Rf(e,t){try{return T(e,`utf8`)}catch(e){return X(`--data ${t}: ${gs(e)}`)}}function zf(e){let[t,n=``]=e.split(`.`);return BigInt(`${t}${n.padEnd(6,`0`)}`)}const Bf=d.pipe(d.string(),d.check(e=>Nl.test(e.slice(0,Math.max(e.indexOf(`:`),0))),`must be "Name: Value" with a valid HTTP header name`),d.transform(e=>{let t=e.indexOf(`:`);return{name:e.slice(0,t),value:e.slice(t+1).trimStart()}}),d.check(e=>/^[\t\x20-\x7e\x80-\xff]*$/.test(e.value),`header value contains characters not allowed in an HTTP header`));function Vf(e,t){return e.some(e=>e.name.toLowerCase()===t)}function Hf(e,t){Vf(e,`content-type`)&&t!==void 0&&X(`--header "Content-Type: ..." conflicts with --content-type`)}function Uf(e,t,n){let r=[...n!==void 0&&!Vf(e,`content-type`)?[[`content-type`,t??`application/json`]]:[],...e.map(e=>[e.name,e.value])];return r.length>0?new Headers(r):void 0}const Wf={"eip155:8453":`base`,"eip155:84532":`base-sepolia`};function Gf(e){return Object.hasOwn(Wf,e)?Wf[e]:void 0}function Kf(e){return`'${e.replaceAll(`'`,`'\\''`)}'`}function qf(e){return e===void 0?``:` --profile ${Kf(e)}`}function Jf(e,t){return`Payment submission could not be confirmed (intent ${e}). It may have succeeded. Before paying again, run \`catena intents get ${e}${qf(t)}\`.`}function Yf(e,t,n,r){let i=Gf(t)??Kf(t);return`catena counterparties create wallet --name ${Kf(n??`<name>`)} --address ${Kf(e)} --network ${i}${qf(r)}`}function Xf(e,t){try{w(e,{recursive:!0,mode:448}),x(e,448);let n=te(e,t);return w(n,{recursive:!0,mode:448}),x(n,448),n}catch{return}}const Zf=4e3;function Qf(e){try{return k(e)}catch{return}}function $f(e,t,n){try{b(e,t)}catch{X(n)}}function ep(e){let t=ne(e),n=j(t),r=Qf(n);(r===void 0||!r.isDirectory())&&X(`--output ${e}: directory ${n} does not exist`);let i=Qf(t);return i===void 0?($f(n,S.W_OK|S.X_OK,`--output ${e}: directory ${n} is not writable`),t):(i.isDirectory()&&X(`--output ${e}: destination is a directory`),i.isFile()||X(`--output ${e}: destination is not a regular file`),$f(t,S.W_OK,`--output ${e}: destination is not writable`),t)}const tp=/^(?:con|prn|aux|nul|com\d|lpt\d)$/i;function np(e){if(e!==void 0&&zs.test(e)&&!tp.test(e))return`${e}.body`;let t=`${Date.now()}-${g(4).toString(`hex`)}.body`;return e===void 0?`unpaid-${t}`:`paid-${t}`}function rp(e,t){let n=Xf(nl(),`responses`);if(n===void 0)return;let r=te(n,np(t));try{return A(r,e,{mode:384}),r}catch{return}}function ip(e){let t=e.subarray(0,Zf*4),n=t.toString(`utf8`);return{decoded:n,complete:t.length===e.length&&n.length<=Zf&&ie(e)}}function ap({decoded:e,complete:t}){let n=e.slice(0,Zf),r=n.charCodeAt(n.length-1);return{body:r>=55296&&r<=56319?n.slice(0,-1):n,...!t&&{bodyTruncated:!0}}}function op(e,t){if(t.complete)return{body:t.decoded};if(e.length>268435456)return{...ap(t),error:`no writable location for the ${e.length}-byte body and it is too large to inline; only the .body preview survived`};if(ie(e)){let t=e.toString(`utf8`);if(6*t.length+2<=N.MAX_STRING_LENGTH)return{body:t};try{return JSON.stringify(t),{body:t}}catch{}}return{body:e.toString(`base64`),bodyEncoding:`base64`}}function sp(e){return e.error===void 0?e.bodyEncoding===void 0?`the full body is inlined in the result's .body field`:`the full body is inlined base64-encoded in the result's .body field`:e.error}function cp(e,t,n){let r=rp(e,t);return r===void 0?op(e,n):{...ap(n),bodyPath:r}}function lp(e,t,n){let r=ip(e);if(n===void 0)return r.complete?{body:r.decoded}:cp(e,t,r);try{A(n,e,{mode:384})}catch(i){let a=cp(e,t,r),o=`--output ${n}: ${gs(i)}`;return`bodyPath`in a?{...a,error:`${o}; the full body was saved to ${a.bodyPath}`}:{...a,error:`${o}; ${sp(a)}`}}return{...ap(r),bodyPath:n}}function up(e){return{intentId:e.intentId,amountAtomicUsdc:e.requirements.amount,payTo:e.requirements.payTo,network:e.requirements.network}}function dp(e){let t=e?.replaceAll(/[\p{C}\s]/gu,` `).replaceAll(/ {2,}/g,` `).trim();return t!==void 0&&t.length>0?t:void 0}function fp(e,t){Vf(e,`payment-signature`)&&X(`--header cannot set PAYMENT-SIGNATURE; the payment loop attaches it after paying`),Hf(e,t)}const pp=Q({url:Z({description:`The paywalled URL to fetch (an x402 v2 endpoint)`,required:!0,schema:d.pipe(d.string(),d.url())}),account:Z({description:`Source wallet account id the payment draws from`,required:!0,schema:Bs}),maxAmount:Z({description:`Refuse challenges above this USD amount (decimal string, e.g. 0.25). Policy limits still apply server-side.`,schema:d.pipe(d.string(),d.regex(/^\d+(\.\d{1,6})?$/))}),method:Ds({description:`HTTP method for the request`,choices:[`GET`,`POST`]}),data:Z({description:`Request body. Use @path to read a file or @- for stdin. Implies POST and a JSON content type unless overridden.`}),contentType:Z({description:`Content-Type header for the request body (default application/json when --data is set)`}),output:Z({description:`Write the full response body to this file (must be a regular file; written for any HTTP status — check .status). Without it .body is capped at 4000 characters; longer or non-UTF-8 bodies are saved to a file (path reported in .bodyPath)`}),header:Ts({description:`Request header as "Name: Value" (repeatable, like curl -H); sent on the initial request and the paid retry`,schema:Bf}),profile:Ls,json:Rs}),mp=c({meta:{name:`x402`,description:`Fetch a URL, paying its x402 (HTTP 402) challenge via USDC`},args:pp.args,async run({args:e,rawArgs:t}){let n=pp.parse(e,t),r=n.method??(n.data===void 0?`GET`:`POST`);n.data!==void 0&&r!==`POST`&&X(`--data cannot be sent with --method ${r}; a body requires POST`),n.contentType!==void 0&&n.data===void 0&&X(`--content-type has no effect without --data`),fp(n.header,n.contentType);let i=n.output===void 0?void 0:ep(n.output),a=n.data===void 0?void 0:Lf(n.data),o=Uf(n.header,n.contentType,a);await $(n)(async e=>{let t,s=If(e,{accountId:n.account,...n.maxAmount!==void 0&&{maxAtomicAmount:zf(n.maxAmount)},onPayment:e=>{t=e}}),c;try{c=await s(n.url,{method:r,...a!==void 0&&{body:a},...o!==void 0&&{headers:o}})}catch(e){if(e instanceof Nf)throw Error(Jf(e.intentId,n.profile),{cause:e});if(e instanceof jf)return{status:null,paid:!0,retryFailed:!0,payment:up(e.receipt),error:e.message};if(e instanceof Of){let t=e.requiredNetworks.map(e=>Gf(e)??e);return{status:null,paid:!1,retryFailed:!1,networkMismatch:{account:e.accountId,requiredNetworks:t,requiredNetworkIds:[...e.requiredNetworks]},error:`${e.message}. Re-run with --account set to a wallet account on ${t.join(` or `)} (your account ids are in \`catena accounts list${qf(n.profile)}\`).`}}if(e instanceof kf){let t=dp(e.serviceName),r=t!==void 0&&t.length<=40?t:void 0,i=Yf(e.payTo,e.network,r,n.profile),a=t===void 0?``:` The endpoint calls itself "${t.length>40?`${t.slice(0,40)}…`:t}" (unverified) — rename it if that is not a service you recognize.`;return{status:null,paid:!1,retryFailed:!1,counterpartyNotFound:{payTo:e.payTo,network:Gf(e.network)??e.network,networkId:e.network,createCommand:i,nameIsPlaceholder:r===void 0,...t!==void 0&&{serviceName:t}},error:`${e.message}. Add it, then re-run:\n  ${i}\n(counterparty creation may require approval per your policy)${a}`}}if(e instanceof Af)return{status:null,paid:!1,retryFailed:!1,approvalPending:{intentId:e.intentId,expiresAt:e.expiresAt,reasons:[...e.reasons]},error:e.message};throw e}let l={status:c.status,paid:t!==void 0,retryFailed:!1,...t!==void 0&&{payment:up(t)}},u;try{u=Buffer.from(await c.arrayBuffer())}catch(e){let r=t===void 0?``:`; the payment settled — re-read the PAYMENT-SIGNATURE with \`catena intents get ${t.intentId}${qf(n.profile)}\` to retry manually`;return{...l,error:`failed to read the response body: ${gs(e)}${r}`}}return{...l,...lp(u,t?.intentId,i)}},{exitCode:e=>+(`error`in e)})}}),hp=d.object({version:d.literal(1),result:d.literal(`latest-version`),latestVersion:d.string(),checkedAt:d.pipe(d.string(),d.isoTimestamp())}),gp=d.object({version:d.literal(1),result:d.literal(`fetch-failure`),checkedAt:d.pipe(d.string(),d.isoTimestamp())}),_p=d.variant(`result`,[hp,gp]),vp=d.object({"dist-tags":d.object({latest:d.string()})}),yp=`cache`;function bp(){return te(nl(),yp,`cli-version.json`)}function xp(e){return new URL(encodeURIComponent(e),`https://registry.npmjs.org/`).href}function Sp(e){try{let t=JSON.parse(T(e,`utf8`)),n=d.safeParse(_p,t);return n.success?n.output:void 0}catch{return}}function Cp(e){let t=Sp(e);if(!t)return;let n=Date.parse(t.checkedAt);if(!Number.isFinite(n))return;let r=Date.now()-n,i=t.result===`fetch-failure`?36e5:864e5;if(!(r<0||r>=i))return t}function wp(e){try{return!C(e)||k(e).isFile()}catch{return!1}}function Tp(e){let t=Xf(nl(),yp);if(t===void 0||!wp(e))return!1;let n=te(t,`.cli-version-check-${g(6).toString(`hex`)}.tmp`);try{return A(n,``,{encoding:`utf8`,mode:384}),O(n,{force:!0}),!0}catch{try{O(n,{force:!0})}catch{}return!1}}function Ep(e,t){if(Xf(nl(),yp)===void 0)return!1;try{let n=`${e}.${g(6).toString(`hex`)}.tmp`;return A(n,`${JSON.stringify({version:1,...t,checkedAt:new Date().toISOString()},null,2)}\n`,{encoding:`utf8`,mode:384}),D(n,e),!0}catch{return!1}}async function Dp(e){let t=new AbortController,n=setTimeout(()=>t.abort(),750);n.unref();try{let n=await fetch(xp(e.packageName),{headers:{accept:`application/json`},signal:t.signal});if(!n.ok)return;let r=await n.json(),i=d.safeParse(vp,r);return i.success?i.output[`dist-tags`].latest:void 0}catch{return}finally{clearTimeout(n)}}function Op(e){let t=ae.valid(e.currentVersion),n=ae.valid(e.latestVersion);t!==null&&n!==null&&ae.gt(n,t)&&console.error(`A newer ${e.packageName} version is available: ${n} (current ${t}).`)}async function kp({packageName:e,currentVersion:t}){let n=bp(),r=Cp(n);if(r?.result===`latest-version`){Op({packageName:e,currentVersion:t,latestVersion:r.latestVersion});return}if(r?.result===`fetch-failure`||!Tp(n))return;let i=await Dp({packageName:e});if(i===void 0){Ep(n,{result:`fetch-failure`});return}Ep(n,{result:`latest-version`,latestVersion:i}),Op({packageName:e,currentVersion:t,latestVersion:i})}async function Ap(e){return typeof e==`function`?await e():await e}async function jp(e){return typeof e==`function`?await e():await e}async function Mp(e){return typeof e==`function`?await e():await e}async function Np(e,t,n=[]){if(e===t)return n;let r=await Mp(e.subCommands??{});return(await Promise.all(Object.entries(r).map(async([e,r])=>Np(await Ap(r),t,[...n,e])))).find(e=>e!==void 0)}async function Pp(e,t){if(!e||!t||t.length<2)return e;let n=await jp(e.meta??{});return{...e,meta:{...n,name:t.slice(0,-1).join(` `)}}}function Fp(e){return async(t,n)=>{let r=await l(t,await Pp(n,await Np(e,t)));console.log(`${r}\n`)}}function Ip({shouldCheckCliVersionFreshness:e}){return c({meta:{name:`catena`,version:oe,description:`Catena CLI`},async setup({rawArgs:t}){e&&t.length!==0&&await kp({packageName:P,currentVersion:oe})},subCommands:{link:Ed,unlink:sf,profiles:ef,whoami:lf,policy:Wd,accounts:uu,intents:Wu,send:nf,transfer:af,mpp:()=>import(`./mpp-Dr8gzsL-.mjs`).then(e=>e.mppCommand),x402:mp,counterparties:Pu,feedback:zu,guide:Vu}})}const Lp=Ip({shouldCheckCliVersionFreshness:!0});Ip({shouldCheckCliVersionFreshness:!1});function Rp(){u(Lp,{showUsage:Fp(Lp)})}Rp();export{Ba as A,Q as C,gs as D,X as E,ss as O,Z as S,Ls as T,uf as _,Yf as a,Ds as b,Bf as c,Lf as d,zf as f,df as g,ff as h,Uf as i,he as j,fs as k,qf as l,mf as m,ep as n,Vf as o,pf as p,Hf as r,Gf as s,lp as t,Jf as u,$ as v,Rs as w,Ts as x,Bs as y};
+const Fd=e(i(((e,t)=>{(function(e){var n=1e9,r={precision:20,rounding:4,toExpNeg:-7,toExpPos:21,LN10:`2.302585092994045684017991454684364207601101488628772976033327900967572609677352480235997205089598298341967784042286`},i=!0,a=`[DecimalError] `,o=a+`Invalid argument: `,s=a+`Exponent out of range: `,c=Math.floor,l=Math.pow,u=/^(\d+(\.\d*)?|\.\d+)(e[+-]?\d+)?$/i,d,f=1e7,p=7,m=9007199254740991,h=c(m/p),g={};g.absoluteValue=g.abs=function(){var e=new this.constructor(this);return e.s&&=1,e},g.comparedTo=g.cmp=function(e){var t,n,r,i,a=this;if(e=new a.constructor(e),a.s!==e.s)return a.s||-e.s;if(a.e!==e.e)return a.e>e.e^a.s<0?1:-1;for(r=a.d.length,i=e.d.length,t=0,n=r<i?r:i;t<n;++t)if(a.d[t]!==e.d[t])return a.d[t]>e.d[t]^a.s<0?1:-1;return r===i?0:r>i^a.s<0?1:-1},g.decimalPlaces=g.dp=function(){var e=this,t=e.d.length-1,n=(t-e.e)*p;if(t=e.d[t],t)for(;t%10==0;t/=10)n--;return n<0?0:n},g.dividedBy=g.div=function(e){return b(this,new this.constructor(e))},g.dividedToIntegerBy=g.idiv=function(e){var t=this,n=t.constructor;return D(b(t,new n(e),0,1),n.precision)},g.equals=g.eq=function(e){return!this.cmp(e)},g.exponent=function(){return S(this)},g.greaterThan=g.gt=function(e){return this.cmp(e)>0},g.greaterThanOrEqualTo=g.gte=function(e){return this.cmp(e)>=0},g.isInteger=g.isint=function(){return this.e>this.d.length-2},g.isNegative=g.isneg=function(){return this.s<0},g.isPositive=g.ispos=function(){return this.s>0},g.isZero=function(){return this.s===0},g.lessThan=g.lt=function(e){return this.cmp(e)<0},g.lessThanOrEqualTo=g.lte=function(e){return this.cmp(e)<1},g.logarithm=g.log=function(e){var t,n=this,r=n.constructor,o=r.precision,s=o+5;if(e===void 0)e=new r(10);else if(e=new r(e),e.s<1||e.eq(d))throw Error(a+`NaN`);if(n.s<1)throw Error(a+(n.s?`NaN`:`-Infinity`));return n.eq(d)?new r(0):(i=!1,t=b(T(n,s),T(e,s),s),i=!0,D(t,o))},g.minus=g.sub=function(e){var t=this;return e=new t.constructor(e),t.s==e.s?O(t,e):_(t,(e.s=-e.s,e))},g.modulo=g.mod=function(e){var t,n=this,r=n.constructor,o=r.precision;if(e=new r(e),!e.s)throw Error(a+`NaN`);return n.s?(i=!1,t=b(n,e,0,1).times(e),i=!0,n.minus(t)):D(new r(n),o)},g.naturalExponential=g.exp=function(){return x(this)},g.naturalLogarithm=g.ln=function(){return T(this)},g.negated=g.neg=function(){var e=new this.constructor(this);return e.s=-e.s||0,e},g.plus=g.add=function(e){var t=this;return e=new t.constructor(e),t.s==e.s?_(t,e):O(t,(e.s=-e.s,e))},g.precision=g.sd=function(e){var t,n,r,i=this;if(e!==void 0&&e!==!!e&&e!==1&&e!==0)throw Error(o+e);if(t=S(i)+1,r=i.d.length-1,n=r*p+1,r=i.d[r],r){for(;r%10==0;r/=10)n--;for(r=i.d[0];r>=10;r/=10)n++}return e&&t>n?t:n},g.squareRoot=g.sqrt=function(){var e,t,n,r,o,s,l,u=this,d=u.constructor;if(u.s<1){if(!u.s)return new d(0);throw Error(a+`NaN`)}for(e=S(u),i=!1,o=Math.sqrt(+u),o==0||o==1/0?(t=y(u.d),(t.length+e)%2==0&&(t+=`0`),o=Math.sqrt(t),e=c((e+1)/2)-(e<0||e%2),o==1/0?t=`5e`+e:(t=o.toExponential(),t=t.slice(0,t.indexOf(`e`)+1)+e),r=new d(t)):r=new d(o.toString()),n=d.precision,o=l=n+3;;)if(s=r,r=s.plus(b(u,s,l+2)).times(.5),y(s.d).slice(0,l)===(t=y(r.d)).slice(0,l)){if(t=t.slice(l-3,l+1),o==l&&t==`4999`){if(D(s,n+1,0),s.times(s).eq(u)){r=s;break}}else if(t!=`9999`)break;l+=4}return i=!0,D(r,n)},g.times=g.mul=function(e){var t,n,r,a,o,s,c,l,u,d=this,p=d.constructor,m=d.d,h=(e=new p(e)).d;if(!d.s||!e.s)return new p(0);for(e.s*=d.s,n=d.e+e.e,l=m.length,u=h.length,l<u&&(o=m,m=h,h=o,s=l,l=u,u=s),o=[],s=l+u,r=s;r--;)o.push(0);for(r=u;--r>=0;){for(t=0,a=l+r;a>r;)c=o[a]+h[r]*m[a-r-1]+t,o[a--]=c%f|0,t=c/f|0;o[a]=(o[a]+t)%f|0}for(;!o[--s];)o.pop();return t?++n:o.shift(),e.d=o,e.e=n,i?D(e,p.precision):e},g.toDecimalPlaces=g.todp=function(e,t){var r=this,i=r.constructor;return r=new i(r),e===void 0?r:(v(e,0,n),t===void 0?t=i.rounding:v(t,0,8),D(r,e+S(r)+1,t))},g.toExponential=function(e,t){var r,i=this,a=i.constructor;return e===void 0?r=k(i,!0):(v(e,0,n),t===void 0?t=a.rounding:v(t,0,8),i=D(new a(i),e+1,t),r=k(i,!0,e+1)),r},g.toFixed=function(e,t){var r,i,a=this,o=a.constructor;return e===void 0?k(a):(v(e,0,n),t===void 0?t=o.rounding:v(t,0,8),i=D(new o(a),e+S(a)+1,t),r=k(i.abs(),!1,e+S(i)+1),a.isneg()&&!a.isZero()?`-`+r:r)},g.toInteger=g.toint=function(){var e=this,t=e.constructor;return D(new t(e),S(e)+1,t.rounding)},g.toNumber=function(){return+this},g.toPower=g.pow=function(e){var t,n,r,o,s,l,u=this,f=u.constructor,h=12,g=+(e=new f(e));if(!e.s)return new f(d);if(u=new f(u),!u.s){if(e.s<1)throw Error(a+`Infinity`);return u}if(u.eq(d))return u;if(r=f.precision,e.eq(d))return D(u,r);if(t=e.e,n=e.d.length-1,l=t>=n,s=u.s,!l){if(s<0)throw Error(a+`NaN`)}else if((n=g<0?-g:g)<=m){for(o=new f(d),t=Math.ceil(r/p+4),i=!1;n%2&&(o=o.times(u),A(o.d,t)),n=c(n/2),n!==0;)u=u.times(u),A(u.d,t);return i=!0,e.s<0?new f(d).div(o):D(o,r)}return s=s<0&&e.d[Math.max(t,n)]&1?-1:1,u.s=1,i=!1,o=e.times(T(u,r+h)),i=!0,o=x(o),o.s=s,o},g.toPrecision=function(e,t){var r,i,a=this,o=a.constructor;return e===void 0?(r=S(a),i=k(a,r<=o.toExpNeg||r>=o.toExpPos)):(v(e,1,n),t===void 0?t=o.rounding:v(t,0,8),a=D(new o(a),e,t),r=S(a),i=k(a,e<=r||r<=o.toExpNeg,e)),i},g.toSignificantDigits=g.tosd=function(e,t){var r=this,i=r.constructor;return e===void 0?(e=i.precision,t=i.rounding):(v(e,1,n),t===void 0?t=i.rounding:v(t,0,8)),D(new i(r),e,t)},g.toString=g.valueOf=g.val=g.toJSON=function(){var e=this,t=S(e),n=e.constructor;return k(e,t<=n.toExpNeg||t>=n.toExpPos)};function _(e,t){var n,r,a,o,s,c,l,u,d=e.constructor,m=d.precision;if(!e.s||!t.s)return t.s||(t=new d(e)),i?D(t,m):t;if(l=e.d,u=t.d,s=e.e,a=t.e,l=l.slice(),o=s-a,o){for(o<0?(r=l,o=-o,c=u.length):(r=u,a=s,c=l.length),s=Math.ceil(m/p),c=s>c?s+1:c+1,o>c&&(o=c,r.length=1),r.reverse();o--;)r.push(0);r.reverse()}for(c=l.length,o=u.length,c-o<0&&(o=c,r=u,u=l,l=r),n=0;o;)n=(l[--o]=l[o]+u[o]+n)/f|0,l[o]%=f;for(n&&(l.unshift(n),++a),c=l.length;l[--c]==0;)l.pop();return t.d=l,t.e=a,i?D(t,m):t}function v(e,t,n){if(e!==~~e||e<t||e>n)throw Error(o+e)}function y(e){var t,n,r,i=e.length-1,a=``,o=e[0];if(i>0){for(a+=o,t=1;t<i;t++)r=e[t]+``,n=p-r.length,n&&(a+=w(n)),a+=r;o=e[t],r=o+``,n=p-r.length,n&&(a+=w(n))}else if(o===0)return`0`;for(;o%10==0;)o/=10;return a+o}var b=(function(){function e(e,t){var n,r=0,i=e.length;for(e=e.slice();i--;)n=e[i]*t+r,e[i]=n%f|0,r=n/f|0;return r&&e.unshift(r),e}function t(e,t,n,r){var i,a;if(n!=r)a=n>r?1:-1;else for(i=a=0;i<n;i++)if(e[i]!=t[i]){a=e[i]>t[i]?1:-1;break}return a}function n(e,t,n){for(var r=0;n--;)e[n]-=r,r=+(e[n]<t[n]),e[n]=r*f+e[n]-t[n];for(;!e[0]&&e.length>1;)e.shift()}return function(r,i,o,s){var c,l,u,d,m,h,g,_,v,y,b,x,C,w,T,E,O,k,A=r.constructor,ee=r.s==i.s?1:-1,j=r.d,M=i.d;if(!r.s)return new A(r);if(!i.s)throw Error(a+`Division by zero`);for(l=r.e-i.e,O=M.length,T=j.length,g=new A(ee),_=g.d=[],u=0;M[u]==(j[u]||0);)++u;if(M[u]>(j[u]||0)&&--l,x=o==null?o=A.precision:s?o+(S(r)-S(i))+1:o,x<0)return new A(0);if(x=x/p+2|0,u=0,O==1)for(d=0,M=M[0],x++;(u<T||d)&&x--;u++)C=d*f+(j[u]||0),_[u]=C/M|0,d=C%M|0;else{for(d=f/(M[0]+1)|0,d>1&&(M=e(M,d),j=e(j,d),O=M.length,T=j.length),w=O,v=j.slice(0,O),y=v.length;y<O;)v[y++]=0;k=M.slice(),k.unshift(0),E=M[0],M[1]>=f/2&&++E;do d=0,c=t(M,v,O,y),c<0?(b=v[0],O!=y&&(b=b*f+(v[1]||0)),d=b/E|0,d>1?(d>=f&&(d=f-1),m=e(M,d),h=m.length,y=v.length,c=t(m,v,h,y),c==1&&(d--,n(m,O<h?k:M,h))):(d==0&&(c=d=1),m=M.slice()),h=m.length,h<y&&m.unshift(0),n(v,m,y),c==-1&&(y=v.length,c=t(M,v,O,y),c<1&&(d++,n(v,O<y?k:M,y))),y=v.length):c===0&&(d++,v=[0]),_[u++]=d,c&&v[0]?v[y++]=j[w]||0:(v=[j[w]],y=1);while((w++<T||v[0]!==void 0)&&x--)}return _[0]||_.shift(),g.e=l,D(g,s?o+S(g)+1:o)}})();function x(e,t){var n,r,a,o,c,u,f=0,p=0,m=e.constructor,h=m.precision;if(S(e)>16)throw Error(s+S(e));if(!e.s)return new m(d);for(t==null?(i=!1,u=h):u=t,c=new m(.03125);e.abs().gte(.1);)e=e.times(c),p+=5;for(r=Math.log(l(2,p))/Math.LN10*2+5|0,u+=r,n=a=o=new m(d),m.precision=u;;){if(a=D(a.times(e),u),n=n.times(++f),c=o.plus(b(a,n,u)),y(c.d).slice(0,u)===y(o.d).slice(0,u)){for(;p--;)o=D(o.times(o),u);return m.precision=h,t==null?(i=!0,D(o,h)):o}o=c}}function S(e){for(var t=e.e*p,n=e.d[0];n>=10;n/=10)t++;return t}function C(e,t,n){if(t>e.LN10.sd())throw i=!0,n&&(e.precision=n),Error(a+`LN10 precision limit exceeded`);return D(new e(e.LN10),t)}function w(e){for(var t=``;e--;)t+=`0`;return t}function T(e,t){var n,r,o,s,c,l,u,f,p,m=1,h=10,g=e,_=g.d,v=g.constructor,x=v.precision;if(g.s<1)throw Error(a+(g.s?`NaN`:`-Infinity`));if(g.eq(d))return new v(0);if(t==null?(i=!1,f=x):f=t,g.eq(10))return t??(i=!0),C(v,f);if(f+=h,v.precision=f,n=y(_),r=n.charAt(0),s=S(g),Math.abs(s)<0x5543df729c000){for(;r<7&&r!=1||r==1&&n.charAt(1)>3;)g=g.times(e),n=y(g.d),r=n.charAt(0),m++;s=S(g),r>1?(g=new v(`0.`+n),s++):g=new v(r+`.`+n.slice(1))}else return u=C(v,f+2,x).times(s+``),g=T(new v(r+`.`+n.slice(1)),f-h).plus(u),v.precision=x,t==null?(i=!0,D(g,x)):g;for(l=c=g=b(g.minus(d),g.plus(d),f),p=D(g.times(g),f),o=3;;){if(c=D(c.times(p),f),u=l.plus(b(c,new v(o),f)),y(u.d).slice(0,f)===y(l.d).slice(0,f))return l=l.times(2),s!==0&&(l=l.plus(C(v,f+2,x).times(s+``))),l=b(l,new v(m),f),v.precision=x,t==null?(i=!0,D(l,x)):l;l=u,o+=2}}function E(e,t){var n,r,a;for((n=t.indexOf(`.`))>-1&&(t=t.replace(`.`,``)),(r=t.search(/e/i))>0?(n<0&&(n=r),n+=+t.slice(r+1),t=t.substring(0,r)):n<0&&(n=t.length),r=0;t.charCodeAt(r)===48;)++r;for(a=t.length;t.charCodeAt(a-1)===48;)--a;if(t=t.slice(r,a),t){if(a-=r,n=n-r-1,e.e=c(n/p),e.d=[],r=(n+1)%p,n<0&&(r+=p),r<a){for(r&&e.d.push(+t.slice(0,r)),a-=p;r<a;)e.d.push(+t.slice(r,r+=p));t=t.slice(r),r=p-t.length}else r-=a;for(;r--;)t+=`0`;if(e.d.push(+t),i&&(e.e>h||e.e<-h))throw Error(s+n)}else e.s=0,e.e=0,e.d=[0];return e}function D(e,t,n){var r,a,o,u,d,m,g,_,v=e.d;for(u=1,o=v[0];o>=10;o/=10)u++;if(r=t-u,r<0)r+=p,a=t,g=v[_=0];else{if(_=Math.ceil((r+1)/p),o=v.length,_>=o)return e;for(g=o=v[_],u=1;o>=10;o/=10)u++;r%=p,a=r-p+u}if(n!==void 0&&(o=l(10,u-a-1),d=g/o%10|0,m=t<0||v[_+1]!==void 0||g%o,m=n<4?(d||m)&&(n==0||n==(e.s<0?3:2)):d>5||d==5&&(n==4||m||n==6&&(r>0?a>0?g/l(10,u-a):0:v[_-1])%10&1||n==(e.s<0?8:7))),t<1||!v[0])return m?(o=S(e),v.length=1,t=t-o-1,v[0]=l(10,(p-t%p)%p),e.e=c(-t/p)||0):(v.length=1,v[0]=e.e=e.s=0),e;if(r==0?(v.length=_,o=1,_--):(v.length=_+1,o=l(10,p-r),v[_]=a>0?(g/l(10,u-a)%l(10,a)|0)*o:0),m)for(;;)if(_==0){(v[0]+=o)==f&&(v[0]=1,++e.e);break}else{if(v[_]+=o,v[_]!=f)break;v[_--]=0,o=1}for(r=v.length;v[--r]===0;)v.pop();if(i&&(e.e>h||e.e<-h))throw Error(s+S(e));return e}function O(e,t){var n,r,a,o,s,c,l,u,d,m,h=e.constructor,g=h.precision;if(!e.s||!t.s)return t.s?t.s=-t.s:t=new h(e),i?D(t,g):t;if(l=e.d,m=t.d,r=t.e,u=e.e,l=l.slice(),s=u-r,s){for(d=s<0,d?(n=l,s=-s,c=m.length):(n=m,r=u,c=l.length),a=Math.max(Math.ceil(g/p),c)+2,s>a&&(s=a,n.length=1),n.reverse(),a=s;a--;)n.push(0);n.reverse()}else{for(a=l.length,c=m.length,d=a<c,d&&(c=a),a=0;a<c;a++)if(l[a]!=m[a]){d=l[a]<m[a];break}s=0}for(d&&(n=l,l=m,m=n,t.s=-t.s),c=l.length,a=m.length-c;a>0;--a)l[c++]=0;for(a=m.length;a>s;){if(l[--a]<m[a]){for(o=a;o&&l[--o]===0;)l[o]=f-1;--l[o],l[a]+=f}l[a]-=m[a]}for(;l[--c]===0;)l.pop();for(;l[0]===0;l.shift())--r;return l[0]?(t.d=l,t.e=r,i?D(t,g):t):new h(0)}function k(e,t,n){var r,i=S(e),a=y(e.d),o=a.length;return t?(n&&(r=n-o)>0?a=a.charAt(0)+`.`+a.slice(1)+w(r):o>1&&(a=a.charAt(0)+`.`+a.slice(1)),a=a+(i<0?`e`:`e+`)+i):i<0?(a=`0.`+w(-i-1)+a,n&&(r=n-o)>0&&(a+=w(r))):i>=o?(a+=w(i+1-o),n&&(r=n-i-1)>0&&(a=a+`.`+w(r))):((r=i+1)<o&&(a=a.slice(0,r)+`.`+a.slice(r)),n&&(r=n-o)>0&&(i+1===o&&(a+=`.`),a+=w(r))),e.s<0?`-`+a:a}function A(e,t){if(e.length>t)return e.length=t,!0}function ee(e){var t,n,r;function i(e){var t=this;if(!(t instanceof i))return new i(e);if(t.constructor=i,e instanceof i){t.s=e.s,t.e=e.e,t.d=(e=e.d)?e.slice():e;return}if(typeof e==`number`){if(e*0!=0)throw Error(o+e);if(e>0)t.s=1;else if(e<0)e=-e,t.s=-1;else{t.s=0,t.e=0,t.d=[0];return}if(e===~~e&&e<1e7){t.e=0,t.d=[e];return}return E(t,e.toString())}if(typeof e!=`string`)throw Error(o+e);if(e.charCodeAt(0)===45?(e=e.slice(1),t.s=-1):t.s=1,u.test(e))E(t,e);else throw Error(o+e)}if(i.prototype=g,i.ROUND_UP=0,i.ROUND_DOWN=1,i.ROUND_CEIL=2,i.ROUND_FLOOR=3,i.ROUND_HALF_UP=4,i.ROUND_HALF_DOWN=5,i.ROUND_HALF_EVEN=6,i.ROUND_HALF_CEIL=7,i.ROUND_HALF_FLOOR=8,i.clone=ee,i.config=i.set=j,e===void 0&&(e={}),e)for(r=[`precision`,`rounding`,`toExpNeg`,`toExpPos`,`LN10`],t=0;t<r.length;)e.hasOwnProperty(n=r[t++])||(e[n]=this[n]);return i.config(e),i}function j(e){if(!e||typeof e!=`object`)throw Error(a+`Object expected`);var t,r,i,s=[`precision`,1,n,`rounding`,0,8,`toExpNeg`,-1/0,0,`toExpPos`,0,1/0];for(t=0;t<s.length;t+=3)if((i=e[r=s[t]])!==void 0){if(c(i)===i&&i>=s[t+1]&&i<=s[t+2])this[r]=i;else throw Error(o+r+`: `+i)}if((i=e[r=`LN10`])!==void 0){if(i==Math.LN10)this[r]=new this(i);else throw Error(o+r+`: `+i)}return this}r=ee(r),r.default=r.Decimal=r,d=new r(1),typeof define==`function`&&define.amd?define(function(){return r}):t!==void 0&&t.exports?t.exports=r:(e||=typeof self<`u`&&self&&self.self==self?self:Function(`return this`)(),e.Decimal=r)})(e)}))(),1).default;Fd.set({rounding:Fd.ROUND_HALF_EVEN});const Id=new Map,Ld=/^[A-Z]{3}$/,Rd=/^[A-Z0-9]{2,6}$/;function zd(e,t,n,r){if(Id.has(e))throw Error(`duplicate asset id ${e}`);let i=new Fd(r);if(i.isNegative())throw Error(`dustThreshold must be a non-negative decimal`);if(i.decimalPlaces()>t)throw Error(`dustThreshold (${r}) must not be finer than the asset's ${t} decimals`);if(!Number.isInteger(t)||!Number.isInteger(n)||t<0||n<0)throw Error(`decimals and presentmentDecimals must be non-negative integers`);if(n>t)throw Error(`presentment decimals should be less than or equal to decimals`)}function Bd(e,t,n,r,i){if(!Ld.test(e))throw Error(`fiat asset ids must be 3-letter ISO-4217 codes`);zd(e,n,r,i.dustThreshold);let a=e;return Id.set(e,{id:a,symbol:e,name:t,kind:`fiat`,decimals:n,presentmentDecimals:r,denomination:e,valuation:{type:`par`},dustThreshold:i.dustThreshold}),a}function Vd(e,t,n,r,i){if(!Rd.test(e)||Ld.test(e))throw Error(`stablecoin tickers must be 2-6 uppercase alphanumerics and not a 3-letter ISO-4217 shape`);let a=Id.get(i.denomination);if(!a||a.kind!==`fiat`)throw Error(`stablecoin denomination must be a registered fiat asset, got ${i.denomination}`);if(n>a.decimals)throw Error(`par stablecoin decimals (${n}) must not exceed its denomination fiat's (${a.decimals})`);zd(e,n,r,i.dustThreshold);let o=e;return Id.set(e,{id:o,symbol:e,name:t,kind:`stablecoin`,decimals:n,presentmentDecimals:r,denomination:a.denomination,valuation:{type:`par`},dustThreshold:i.dustThreshold}),o}Vd(`USDC`,`USD Coin`,6,2,{denomination:Bd(`USD`,`US Dollar`,6,2,{dustThreshold:`0.01`}),dustThreshold:`0.01`}),new Fd(1e6),new Fd(1e3);const Hd=d.pipe(d.string(`Amount must be a string`),d.nonEmpty(`Amount must not be empty`),d.check(e=>e.trim()===e,`Amount must not have leading or trailing whitespace`),d.check(e=>!e.includes(`e`)&&!e.includes(`E`),`Scientific notation is not supported (e.g. use 1000000 instead of 1e6)`),d.check(e=>!e.startsWith(`+`),`Amount must not have a '+' prefix`),d.check(e=>!e.startsWith(`-`),`Amount must be non-negative`),d.check(e=>{try{return new Fd(e).gte(0)}catch{return!1}},`Amount must be a valid decimal (e.g. 100 or 100.50)`)),Ud=d.pipe(d.string(`Count must be a string`),d.transform(e=>e.trim()),d.check(e=>/^\d+$/.test(e),`Count must be a whole number of transactions (e.g. 20)`),d.transform(Number),d.check(e=>Number.isSafeInteger(e),`Count is too large`),d.check(e=>e>=1,`Count must be at least 1`)),Wd={s:1,m:60,h:3600,d:86400},Gd=d.pipe(d.string(`Duration must be a string`),d.transform(e=>e.trim()),d.check(e=>/^\d+[smhd]?$/.test(e),`Duration must be a number of seconds or a value with a unit (e.g. 90s, 30m, 4h, 2d)`),d.transform(e=>{let t=e.at(-1)??``;return t in Wd?Number(e.slice(0,-1))*Wd[t]:Number(e)}),d.check(e=>e>=60,`Duration must be at least 1 minute`),d.check(e=>e<=604800,`Duration must be at most 7 days`)),Kd=Q({profile:Ls,json:Rs}),qd=c({meta:{name:`show`,description:`Show the agent's assigned policy`},args:Kd.args,async run({args:e}){await $(Kd.parse(e))(e=>e.getPolicy())}}),Jd=Q({account:Z({description:`Account whose existing hard limit should increase. For a transfer limit, the source account funds move out of.`,required:!0}),capability:Ds({description:`Which capability's limit to increase: send (payments to counterparties) or transfer (between the user's own accounts)`,choices:$o,default:`send`}),rule:Ds({description:`Which limit to adjust`,choices:fo,default:`per_transaction_amount`}),amount:Z({description:`New threshold for an amount limit, as a decimal USD string (e.g. 500.00)`,schema:Hd,showValueInError:!0}),count:Z({description:`New threshold for a transaction-count limit (e.g. 20)`,schema:Ud,showValueInError:!0}),duration:Z({description:`How long the override should last once approved (e.g. 90s, 30m, 4h, 2d). One minute to seven days.`,required:!0,schema:Gd,showValueInError:!0}),reason:Z({description:`Why the task needs this, for the person who reviews the request`,required:!0}),idempotencyKey:Z({description:`Optional operation key. Reuse the same value only when retrying the same submission; omitted generates a fresh key for this invocation.`,schema:vu}),profile:Ls,json:Rs}),Yd=c({meta:{name:`request-override`,description:`Ask a person to approve a temporary change to this agent's limits`},args:Jd.args,async run({args:e}){let t=Jd.parse(e),n=$(t),r={type:`policy_override`,operations:[Xd(t)],durationSeconds:t.duration,reason:t.reason};await n(e=>e.submitIntent({action:r,...t.idempotencyKey!==void 0&&{idempotencyKey:t.idempotencyKey}}))}});function Xd(e){return e.rule===`hourly_count`||e.rule===`daily_count`?(e.amount!==void 0&&X(`--amount does not apply to ${e.rule}; use --count`),e.count===void 0&&X(`--count is required for ${e.rule}`),{type:`increase_limit`,accountId:e.account,capability:e.capability,limitType:e.rule,newLimit:{count:e.count}}):(e.count!==void 0&&X(`--count does not apply to ${e.rule}; use --amount`),e.amount===void 0&&X(`--amount is required for ${e.rule}`),{type:`increase_limit`,accountId:e.account,capability:e.capability,limitType:e.rule,newLimit:{amount:e.amount,assetId:`USD`}})}const Zd=c({meta:{name:`policy`,description:`Inspect the agent's policy`},subCommands:{show:qd,"request-override":Yd}}),Qd=Q({profile:ws({description:`Profile name`,required:!0})});function $d(){try{return Vl({env:process.env[Ll],cwd:process.cwd(),log:e=>console.error(e)})}catch(e){return X(e)}}const ef=c({meta:{name:`use`,description:`Set the default credential profile`},args:Qd.args,async run({args:e}){let t=Qd.parse(e);try{El(t.profile),nu({defaultProfile:t.profile})}catch(e){X(e)}}}),tf=c({meta:{name:`current`,description:`Show the selected credential profile and how it was chosen`},async run(){let e;try{e=Il()}catch(e){return X(e)}if(e!==null){nu({source:`secret-key`,credential:Nl,bankUrl:e.bankUrl});return}let t=$d(),n;try{n=xl(t.name)}catch(e){X(e)}n===null&&X(`Profile "${t.name}" is not linked.\nRun 'catena link --profile ${t.name} <agent-id>' to authenticate.`),nu({profile:t.name,source:t.source,bankUrl:n.bank_url,agentId:fl(n)?n.agent_id:void 0})}}),nf=c({meta:{name:`list`,description:`List credential profiles and their directory bindings`},async run(){let e;try{e=cl()}catch(e){X(e)}let t=Fl(),n;try{n=t?null:Vl({env:process.env[Ll],cwd:process.cwd()}).name}catch{n=null}let r=Object.entries(e.directories??{});nu({defaultProfile:e.default_profile,...t?{shadowedBy:Nl}:{},profiles:Object.entries(e.profiles).toSorted(([e],[t])=>e.localeCompare(t)).map(([e,t])=>({name:e,bankUrl:t.bank_url,agentId:fl(t)?t.agent_id:void 0,directories:r.filter(([,t])=>t===e).map(([e])=>e).toSorted(),current:e===n}))})}}),rf=Q({profile:ws({description:`Profile name to bind`,required:!0}),path:ws({description:`Directory to bind (defaults to the current directory)`})}),af=c({meta:{name:`bind`,description:`Bind a directory to a profile for automatic selection`},args:rf.args,async run({args:e}){let t=rf.parse(e);try{let e=t.path??process.cwd();if($u(e))throw Error(`Refusing to bind the home directory or an ancestor of it — that would shadow the default profile for every directory beneath it. Bind a specific agent directory instead.`);let n=yl(e,t.profile);nu({profile:t.profile,directory:n})}catch(e){X(e)}}}),of=Q({path:ws({description:`Directory to unbind (defaults to the current directory)`})}),sf=c({meta:{name:`unbind`,description:`Remove a directory's profile binding`},args:of.args,async run({args:e}){let t=of.parse(e);try{nu(bl(t.path??process.cwd()))}catch(e){X(e)}}}),cf=c({meta:{name:`profiles`,description:`Manage credential profiles`},subCommands:{use:ef,current:tf,list:nf,bind:af,unbind:sf}}),lf=Q({account:Z({description:`Source account id; omit when the policy allows sends from exactly one account`,schema:Bs}),rail:Z({description:`Destination counterparty rail id (cprl_...)`,required:!0,schema:Bs}),amount:Z({description:`USD amount as a decimal string (e.g. 125.00)`,required:!0,schema:Hd,showValueInError:!0}),method:Ds({description:`ach | wire | on-chain; ach and wire require a bank rail, on-chain a wallet rail`,required:!0,choices:Eo}),memo:Z({description:`Memo on the underlying transfer`}),description:Z({description:`Operator-facing description`}),idempotencyKey:Z({description:`Optional operation key. Reuse the same value only when retrying the same submission; omitted generates a fresh key for this invocation.`,schema:vu}),profile:Ls,json:Rs}),uf=c({meta:{name:`send`,description:`Submit a USD send intent to a counterparty rail`},args:lf.args,async run({args:e}){let t=lf.parse(e),n=$(t),r={type:`send`,...t.account!==void 0&&{accountId:t.account},counterpartyRailId:t.rail,amount:t.amount,method:t.method,...t.memo?{memo:t.memo}:{},...t.description?{description:t.description}:{}};await n(e=>e.submitIntent({action:r,...t.idempotencyKey?{idempotencyKey:t.idempotencyKey}:{}}))}}),df=Q({from:Z({description:`Source account id`,required:!0,schema:Bs}),to:Z({description:`Destination account id`,required:!0,schema:Bs}),amount:Z({description:`USD amount as a decimal string (e.g. 125.00)`,required:!0,schema:Hd,showValueInError:!0}),memo:Z({description:`Memo on the underlying transfer`}),description:Z({description:`Operator-facing description`}),idempotencyKey:Z({description:`Optional operation key. Reuse the same value only when retrying the same submission; omitted generates a fresh key for this invocation.`,schema:vu}),profile:Ls,json:Rs}),ff=c({meta:{name:`transfer`,description:`Submit a USD transfer intent between two of this agent's accounts`},args:df.args,async run({args:e}){let t=df.parse(e),n=$(t),r={type:`transfer`,accountId:t.from,toAccountId:t.to,amount:t.amount,...t.memo?{memo:t.memo}:{},...t.description?{description:t.description}:{}};await n(e=>e.submitIntent({action:r,...t.idempotencyKey?{idempotencyKey:t.idempotencyKey}:{}}))}});function pf(){return`${Nl} is set, and this command removes only a linked profile. Revoke the key in the Catena console under the agent's Secret keys tab, or pass --profile <name> to target a profile on this machine.`}const mf=Q({profile:Ls,force:Es({description:`Remove the profile and its local credentials without contacting the server; use when the credential is missing, revoked, or a link was interrupted`,default:!1}),json:Rs}),hf=c({meta:{name:`unlink`,description:`Disconnect the selected agent profile`},args:mf.args,async run({args:e}){let t=mf.parse(e),n=Xl();!t.force&&ru(t)===void 0&&Fl()&&X(pf());let r;try{r=Vl({flag:ru(t),env:process.env[Ll],cwd:process.cwd(),log:e=>console.error(e)}).name}catch(e){X(e)}if(t.force){let e;try{if(e=xl(r),e===null)throw Error(Fl()?`Profile "${r}" not found, and this machine holds no profile to clear. Revoke the key in the Catena console under the agent's Secret keys tab.`:`Profile "${r}" not found`);await n.delete(e.client_instance_id),await n.delete(dd(e.client_instance_id)),gl(r)}catch(e){X(e)}nu({success:!0,profile:r,...fl(e)?{agentId:e.agent_id}:{},local:!0},{compact:t.json});return}let i=`To remove only this machine's copy, run 'catena unlink --profile ${r} --force'.`,a=await jl({profileName:r,fallbackBankUrl:Ml},n);a.ok||X(`${a.message} ${i}`);let o=Yl(a);try{await o.unlinkAgent(),await n.delete(a.clientInstanceId),await n.delete(dd(a.clientInstanceId)),gl(r)}catch(e){X(`${gs(tu(e,r))} ${i}`)}nu({success:!0,profile:r,agentId:a.agentId},{compact:t.json})}}),gf=Q({profile:Ls,json:Rs}),_f=c({meta:{name:`whoami`,description:`Show which agent you are currently acting as`},args:gf.args,async run({args:e}){await $(gf.parse(e))(e=>e.whoami())}});function vf(e){throw Error(`Unhandled case: ${String(e)}`)}function yf(e,t){return t?.body!==void 0&&t.body!==null&&typeof t.body!=`string`&&!(t.body instanceof URLSearchParams)&&!(t.body instanceof Blob)&&!(t.body instanceof ArrayBuffer)&&!ArrayBuffer.isView(t.body)?!1:typeof Request<`u`&&e instanceof Request?e.body===null&&!e.bodyUsed:!0}function bf(e,t){let n=new Headers(typeof Request<`u`&&e instanceof Request?e.headers:void 0);return new Headers(t?.headers).forEach((e,t)=>{n.set(t,e)}),n}const xf=/^0x[0-9a-fA-F]{64}$/;async function Sf(e,t,n,r){try{await e.reportSettlement({intentId:t,txHash:n,...r!==void 0&&{receipt:r}})}catch{return}}const Cf=[`PAYMENT-REQUIRED`,`X-Payment-Required`],wf=/^0x[0-9a-fA-F]{40}$/,Tf=d.looseObject({success:d.boolean(),transaction:d.string(),extensions:d.optional(d.unknown())}),Ef=d.looseObject({x402Version:d.literal(2),accepts:d.array(Wo),resource:d.optional(Go),extensions:d.optional(d.unknown())}),Df=`x402_network_mismatch`,Of=`x402_counterparty_rail_not_found`,kf=new Set([`x402_requirement_not_payable`,Df,Of]),Af={"eip155:8453":`Base`,"eip155:84532":`Base Sepolia`};function jf(e){let t=Object.hasOwn(Af,e)?Af[e]:void 0;return t?`${t} (${e})`:e}function Mf(e){let t=e.replaceAll(`-`,`+`).replaceAll(`_`,`/`),n=Uint8Array.from(atob(t),e=>e.charCodeAt(0));return JSON.parse(new TextDecoder().decode(n))}function Nf(e){let t=Cf.map(t=>e.headers.get(t)).find(e=>e!==null);if(t)try{let e=d.safeParse(Ef,Mf(t));return e.success?e.output:void 0}catch{return}}async function Pf(e,t,n){try{let r=n.headers.get(`PAYMENT-RESPONSE`);if(!r)return;let i=d.safeParse(Tf,Mf(r));if(!i.success||!i.output.success||!xf.test(i.output.transaction))return;let a=ro(i.output.extensions);await Sf(e,t,i.output.transaction,a)}catch{}}var Ff=class extends Error{reasons;constructor(e,t=[],n={}){super(t.length>0&&(n.appendReasonsToMessage??!0)?`${e}: ${t.join(`; `)}`:e),this.name=`X402PaymentError`,this.reasons=t}},If=class extends Ff{accountId;requiredNetworks;constructor(e,t,n=[]){super(`Account ${e} cannot fund this 402 challenge: it must be paid from a wallet account on ${t.map(jf).join(` or `)}`,n,{appendReasonsToMessage:!1}),this.name=`X402NetworkMismatchError`,this.accountId=e,this.requiredNetworks=t}},Lf=class extends Ff{payTo;network;serviceName;constructor(e,t,n,r=[]){super(`This 402 pays ${e} on ${jf(t)}, which is not a saved counterparty wallet rail; add it as a counterparty before paying`,r,{appendReasonsToMessage:!1}),this.name=`X402CounterpartyNotFoundError`,this.payTo=e,this.network=t,this.serviceName=n}},Rf=class extends Ff{intentId;expiresAt;constructor(e,t,n){super(`The payment is awaiting a human approval (intent ${e}); once an operator approves it, retry the request to complete the payment`,t),this.name=`X402ApprovalPendingError`,this.intentId=e,this.expiresAt=n}},zf=class extends Ff{receipt;constructor(e,t){super(`The payment settled (intent ${e.intentId}) but the post-payment continuation failed; retry the request with the PAYMENT-SIGNATURE header from the receipt (or getIntent("${e.intentId}") data.paymentCredential.value) instead of paying again`),this.name=`X402RetryFailedError`,this.receipt=e,this.cause=t}};async function Bf(e,t){try{return await t()}catch(t){throw new zf(e,t)}}var Vf=class extends Ff{intentId;requirements;constructor(e,t,n){super(`The payment could not be confirmed (intent ${e}); check getIntent("${e}") — completed: reuse its data.paymentCredential.value as the PAYMENT-SIGNATURE header; processing: poll until terminal; pay again only after blocked or failed`),this.name=`X402SubmitInterruptedError`,this.intentId=e,this.requirements=t,this.cause=n}};async function Hf(e,t){let n=t.paymentRequired.accepts.filter(e=>e.scheme===`exact`),r=n.filter(e=>t.maxAtomicAmount===void 0||/^\d+$/.test(e.amount)&&BigInt(e.amount)<=t.maxAtomicAmount).slice(0,5);if(r.length===0)throw new Ff(n.length>0&&t.maxAtomicAmount!==void 0?`Every requirement in the 402 challenge costs more than the caller's maximum amount`:`The 402 challenge offers no exact-scheme requirement Catena can pay`);let i=t.resource??t.paymentRequired.resource,a=[];for(let n of r){let r=await Uf(e,{accountId:t.accountId,requirements:n,resource:i,signedOffer:no(t.paymentRequired.extensions,n)}).catch(e=>{if(e instanceof ss&&e.code!==void 0&&kf.has(e.code)){a.push({error:e,requirement:n});return}throw e});if(r)return r}let o=a.filter(e=>e.error.code===Of),s=a.filter(e=>e.error.code===Df),c=a.filter(e=>e.error.code!==Of&&e.error.code!==Df),l=[...new Set([...o,...s,...c].map(e=>e.error.message))],u=o.find(e=>e.error.status===404&&wf.test(e.requirement.payTo));throw u?new Lf(u.requirement.payTo,u.requirement.network,i?.serviceName,l):s.length>0&&o.length===0?new If(t.accountId,[...new Set(s.map(e=>e.requirement.network))],l):new Ff(`No requirement in the 402 challenge is payable from this account`,l)}async function Uf(e,t){let n=await e.submitIntent({action:{type:`x402`,accountId:t.accountId,paymentRequirements:t.requirements,...t.resource!==void 0&&{resource:t.resource},...t.signedOffer!==void 0&&{signedOffer:t.signedOffer}},idempotencyKey:crypto.randomUUID()}).catch(e=>{throw e instanceof fs&&e.outcome===`unknown`?new Vf(e.intentId,t.requirements,e):e});if(n.status===`completed`){let e=Lo(n.data);if(e!==void 0)return{intentId:n.id,paymentSignature:e,requirements:t.requirements};throw new Ff(`The completed payment did not carry an x402 payment signature`)}switch(n.status){case`pending`:throw new Rf(n.id,n.reasons,n.expiresAt);case`processing`:throw new Ff(`The payment is still processing (intent ${n.id}); this client cannot resume an in-flight x402 settlement`);case`blocked`:case`failed`:throw new Ff(`Catena declined the payment`,n.reasons)}return vf(n.status)}function Wf(e,t){let n=(t.baseFetch??globalThis.fetch).bind(globalThis);return async(r,i)=>{let a=await n(r,i);if(a.status!==402)return a;let o=Nf(a);if(!o)return a;if(!yf(r,i))throw new Ff(`The request body cannot be replayed after payment; buffer the body (string, Blob, or ArrayBuffer) before using the x402 fetch wrapper`);let s=await Hf(e,{accountId:t.accountId,paymentRequired:o,...t.maxAtomicAmount!==void 0&&{maxAtomicAmount:t.maxAtomicAmount}});await Bf(s,()=>t.onPayment?.(s));let c=bf(r,i);c.set(`PAYMENT-SIGNATURE`,s.paymentSignature);let l=await Bf(s,()=>n(r,{...i,headers:c}));return Pf(e,s.intentId,l),l}}function Gf(e){if(e===`@-`)return Kf(0,`stdin`);if(e.startsWith(`@`)){let t=e.slice(1);return t===``?X(`--data @<path>: no file path given`):Kf(t,`@${t}`)}return e}function Kf(e,t){try{return T(e,`utf8`)}catch(e){return X(`--data ${t}: ${gs(e)}`)}}function qf(e){let[t,n=``]=e.split(`.`);return BigInt(`${t}${n.padEnd(6,`0`)}`)}const Jf=d.pipe(d.string(),d.check(e=>Gl.test(e.slice(0,Math.max(e.indexOf(`:`),0))),`must be "Name: Value" with a valid HTTP header name`),d.transform(e=>{let t=e.indexOf(`:`);return{name:e.slice(0,t),value:e.slice(t+1).trimStart()}}),d.check(e=>/^[\t\x20-\x7e\x80-\xff]*$/.test(e.value),`header value contains characters not allowed in an HTTP header`));function Yf(e,t){return e.some(e=>e.name.toLowerCase()===t)}function Xf(e,t){Yf(e,`content-type`)&&t!==void 0&&X(`--header "Content-Type: ..." conflicts with --content-type`)}function Zf(e,t,n){let r=[...n!==void 0&&!Yf(e,`content-type`)?[[`content-type`,t??`application/json`]]:[],...e.map(e=>[e.name,e.value])];return r.length>0?new Headers(r):void 0}const Qf={"eip155:8453":`base`,"eip155:84532":`base-sepolia`};function $f(e){return Object.hasOwn(Qf,e)?Qf[e]:void 0}function ep(e){return`'${e.replaceAll(`'`,`'\\''`)}'`}function tp(e){return e===void 0?``:` --profile ${ep(e)}`}function np(e,t){return`Payment submission could not be confirmed (intent ${e}). It may have succeeded. Before paying again, run \`catena intents get ${e}${tp(t)}\`.`}function rp(e,t,n,r){let i=$f(t)??ep(t);return`catena counterparties create wallet --name ${ep(n??`<name>`)} --address ${ep(e)} --network ${i}${tp(r)}`}function ip(e,t){try{w(e,{recursive:!0,mode:448}),x(e,448);let n=te(e,t);return w(n,{recursive:!0,mode:448}),x(n,448),n}catch{return}}const ap=4e3;function op(e){try{return k(e)}catch{return}}function sp(e,t,n){try{b(e,t)}catch{X(n)}}function cp(e){let t=ne(e),n=j(t),r=op(n);(r===void 0||!r.isDirectory())&&X(`--output ${e}: directory ${n} does not exist`);let i=op(t);return i===void 0?(sp(n,S.W_OK|S.X_OK,`--output ${e}: directory ${n} is not writable`),t):(i.isDirectory()&&X(`--output ${e}: destination is a directory`),i.isFile()||X(`--output ${e}: destination is not a regular file`),sp(t,S.W_OK,`--output ${e}: destination is not writable`),t)}const lp=/^(?:con|prn|aux|nul|com\d|lpt\d)$/i;function up(e){if(e!==void 0&&zs.test(e)&&!lp.test(e))return`${e}.body`;let t=`${Date.now()}-${g(4).toString(`hex`)}.body`;return e===void 0?`unpaid-${t}`:`paid-${t}`}function dp(e,t){let n=ip(nl(),`responses`);if(n===void 0)return;let r=te(n,up(t));try{return A(r,e,{mode:384}),r}catch{return}}function fp(e){let t=e.subarray(0,ap*4),n=t.toString(`utf8`);return{decoded:n,complete:t.length===e.length&&n.length<=ap&&ie(e)}}function pp({decoded:e,complete:t}){let n=e.slice(0,ap),r=n.charCodeAt(n.length-1);return{body:r>=55296&&r<=56319?n.slice(0,-1):n,...!t&&{bodyTruncated:!0}}}function mp(e,t){if(t.complete)return{body:t.decoded};if(e.length>268435456)return{...pp(t),error:`no writable location for the ${e.length}-byte body and it is too large to inline; only the .body preview survived`};if(ie(e)){let t=e.toString(`utf8`);if(6*t.length+2<=N.MAX_STRING_LENGTH)return{body:t};try{return JSON.stringify(t),{body:t}}catch{}}return{body:e.toString(`base64`),bodyEncoding:`base64`}}function hp(e){return e.error===void 0?e.bodyEncoding===void 0?`the full body is inlined in the result's .body field`:`the full body is inlined base64-encoded in the result's .body field`:e.error}function gp(e,t,n){let r=dp(e,t);return r===void 0?mp(e,n):{...pp(n),bodyPath:r}}function _p(e,t,n){let r=fp(e);if(n===void 0)return r.complete?{body:r.decoded}:gp(e,t,r);try{A(n,e,{mode:384})}catch(i){let a=gp(e,t,r),o=`--output ${n}: ${gs(i)}`;return`bodyPath`in a?{...a,error:`${o}; the full body was saved to ${a.bodyPath}`}:{...a,error:`${o}; ${hp(a)}`}}return{...pp(r),bodyPath:n}}function vp(e){return{intentId:e.intentId,amountAtomicUsdc:e.requirements.amount,payTo:e.requirements.payTo,network:e.requirements.network}}function yp(e){let t=e?.replaceAll(/[\p{C}\s]/gu,` `).replaceAll(/ {2,}/g,` `).trim();return t!==void 0&&t.length>0?t:void 0}function bp(e,t){Yf(e,`payment-signature`)&&X(`--header cannot set PAYMENT-SIGNATURE; the payment loop attaches it after paying`),Xf(e,t)}const xp=Q({url:Z({description:`The paywalled URL to fetch (an x402 v2 endpoint)`,required:!0,schema:d.pipe(d.string(),d.url())}),account:Z({description:`Source wallet account id the payment draws from`,required:!0,schema:Bs}),maxAmount:Z({description:`Refuse challenges above this USD amount (decimal string, e.g. 0.25). Policy limits still apply server-side.`,schema:d.pipe(d.string(),d.regex(/^\d+(\.\d{1,6})?$/))}),method:Ds({description:`HTTP method for the request`,choices:[`GET`,`POST`]}),data:Z({description:`Request body. Use @path to read a file or @- for stdin. Implies POST and a JSON content type unless overridden.`}),contentType:Z({description:`Content-Type header for the request body (default application/json when --data is set)`}),output:Z({description:`Write the full response body to this file (must be a regular file; written for any HTTP status — check .status). Without it .body is capped at 4000 characters; longer or non-UTF-8 bodies are saved to a file (path reported in .bodyPath)`}),header:Ts({description:`Request header as "Name: Value" (repeatable, like curl -H); sent on the initial request and the paid retry`,schema:Jf}),profile:Ls,json:Rs}),Sp=c({meta:{name:`x402`,description:`Fetch a URL, paying its x402 (HTTP 402) challenge via USDC`},args:xp.args,async run({args:e,rawArgs:t}){let n=xp.parse(e,t),r=n.method??(n.data===void 0?`GET`:`POST`);n.data!==void 0&&r!==`POST`&&X(`--data cannot be sent with --method ${r}; a body requires POST`),n.contentType!==void 0&&n.data===void 0&&X(`--content-type has no effect without --data`),bp(n.header,n.contentType);let i=n.output===void 0?void 0:cp(n.output),a=n.data===void 0?void 0:Gf(n.data),o=Zf(n.header,n.contentType,a);await $(n)(async e=>{let t,s=Wf(e,{accountId:n.account,...n.maxAmount!==void 0&&{maxAtomicAmount:qf(n.maxAmount)},onPayment:e=>{t=e}}),c;try{c=await s(n.url,{method:r,...a!==void 0&&{body:a},...o!==void 0&&{headers:o}})}catch(e){if(e instanceof Vf)throw Error(np(e.intentId,n.profile),{cause:e});if(e instanceof zf)return{status:null,paid:!0,retryFailed:!0,payment:vp(e.receipt),error:e.message};if(e instanceof If){let t=e.requiredNetworks.map(e=>$f(e)??e);return{status:null,paid:!1,retryFailed:!1,networkMismatch:{account:e.accountId,requiredNetworks:t,requiredNetworkIds:[...e.requiredNetworks]},error:`${e.message}. Re-run with --account set to a wallet account on ${t.join(` or `)} (your account ids are in \`catena accounts list${tp(n.profile)}\`).`}}if(e instanceof Lf){let t=yp(e.serviceName),r=t!==void 0&&t.length<=40?t:void 0,i=rp(e.payTo,e.network,r,n.profile),a=t===void 0?``:` The endpoint calls itself "${t.length>40?`${t.slice(0,40)}…`:t}" (unverified) — rename it if that is not a service you recognize.`;return{status:null,paid:!1,retryFailed:!1,counterpartyNotFound:{payTo:e.payTo,network:$f(e.network)??e.network,networkId:e.network,createCommand:i,nameIsPlaceholder:r===void 0,...t!==void 0&&{serviceName:t}},error:`${e.message}. Add it, then re-run:\n  ${i}\n(counterparty creation may require approval per your policy)${a}`}}if(e instanceof Rf)return{status:null,paid:!1,retryFailed:!1,approvalPending:{intentId:e.intentId,expiresAt:e.expiresAt,reasons:[...e.reasons]},error:e.message};throw e}let l={status:c.status,paid:t!==void 0,retryFailed:!1,...t!==void 0&&{payment:vp(t)}},u;try{u=Buffer.from(await c.arrayBuffer())}catch(e){let r=t===void 0?``:`; the payment settled — re-read the PAYMENT-SIGNATURE with \`catena intents get ${t.intentId}${tp(n.profile)}\` to retry manually`;return{...l,error:`failed to read the response body: ${gs(e)}${r}`}}return{...l,..._p(u,t?.intentId,i)}},{exitCode:e=>+(`error`in e)})}}),Cp=d.object({version:d.literal(1),result:d.literal(`latest-version`),latestVersion:d.string(),checkedAt:d.pipe(d.string(),d.isoTimestamp())}),wp=d.object({version:d.literal(1),result:d.literal(`fetch-failure`),checkedAt:d.pipe(d.string(),d.isoTimestamp())}),Tp=d.variant(`result`,[Cp,wp]),Ep=d.object({"dist-tags":d.object({latest:d.string()})}),Dp=`cache`;function Op(){return te(nl(),Dp,`cli-version.json`)}function kp(e){return new URL(encodeURIComponent(e),`https://registry.npmjs.org/`).href}function Ap(e){try{let t=JSON.parse(T(e,`utf8`)),n=d.safeParse(Tp,t);return n.success?n.output:void 0}catch{return}}function jp(e){let t=Ap(e);if(!t)return;let n=Date.parse(t.checkedAt);if(!Number.isFinite(n))return;let r=Date.now()-n,i=t.result===`fetch-failure`?36e5:864e5;if(!(r<0||r>=i))return t}function Mp(e){try{return!C(e)||k(e).isFile()}catch{return!1}}function Np(e){let t=ip(nl(),Dp);if(t===void 0||!Mp(e))return!1;let n=te(t,`.cli-version-check-${g(6).toString(`hex`)}.tmp`);try{return A(n,``,{encoding:`utf8`,mode:384}),O(n,{force:!0}),!0}catch{try{O(n,{force:!0})}catch{}return!1}}function Pp(e,t){if(ip(nl(),Dp)===void 0)return!1;try{let n=`${e}.${g(6).toString(`hex`)}.tmp`;return A(n,`${JSON.stringify({version:1,...t,checkedAt:new Date().toISOString()},null,2)}\n`,{encoding:`utf8`,mode:384}),D(n,e),!0}catch{return!1}}async function Fp(e){let t=new AbortController,n=setTimeout(()=>t.abort(),750);n.unref();try{let n=await fetch(kp(e.packageName),{headers:{accept:`application/json`},signal:t.signal});if(!n.ok)return;let r=await n.json(),i=d.safeParse(Ep,r);return i.success?i.output[`dist-tags`].latest:void 0}catch{return}finally{clearTimeout(n)}}function Ip(e){let t=ae.valid(e.currentVersion),n=ae.valid(e.latestVersion);t!==null&&n!==null&&ae.gt(n,t)&&console.error(`A newer ${e.packageName} version is available: ${n} (current ${t}).`)}async function Lp({packageName:e,currentVersion:t}){let n=Op(),r=jp(n);if(r?.result===`latest-version`){Ip({packageName:e,currentVersion:t,latestVersion:r.latestVersion});return}if(r?.result===`fetch-failure`||!Np(n))return;let i=await Fp({packageName:e});if(i===void 0){Pp(n,{result:`fetch-failure`});return}Pp(n,{result:`latest-version`,latestVersion:i}),Ip({packageName:e,currentVersion:t,latestVersion:i})}async function Rp(e){return typeof e==`function`?await e():await e}async function zp(e){return typeof e==`function`?await e():await e}async function Bp(e){return typeof e==`function`?await e():await e}async function Vp(e,t,n=[]){if(e===t)return n;let r=await Bp(e.subCommands??{});return(await Promise.all(Object.entries(r).map(async([e,r])=>Vp(await Rp(r),t,[...n,e])))).find(e=>e!==void 0)}async function Hp(e,t){if(!e||!t||t.length<2)return e;let n=await zp(e.meta??{});return{...e,meta:{...n,name:t.slice(0,-1).join(` `)}}}function Up(e){return async(t,n)=>{let r=await l(t,await Hp(n,await Vp(e,t)));console.log(`${r}\n`)}}function Wp({shouldCheckCliVersionFreshness:e}){return c({meta:{name:`catena`,version:oe,description:`Catena CLI`},async setup({rawArgs:t}){e&&t.length!==0&&await Lp({packageName:P,currentVersion:oe})},subCommands:{link:Nd,unlink:hf,profiles:cf,whoami:_f,policy:Zd,accounts:_u,intents:Zu,send:uf,transfer:ff,mpp:()=>import(`./mpp-CZl4wkkp.mjs`).then(e=>e.mppCommand),x402:Sp,counterparties:Vu,feedback:Ku,guide:Ju}})}const Gp=Wp({shouldCheckCliVersionFreshness:!0});Wp({shouldCheckCliVersionFreshness:!1});function Kp(){u(Gp,{showUsage:Up(Gp)})}Kp();export{Ba as A,Q as C,gs as D,X as E,ss as O,Z as S,Ls as T,vf as _,rp as a,Ds as b,Jf as c,Gf as d,qf as f,yf as g,bf as h,Zf as i,he as j,fs as k,tp as l,Sf as m,cp as n,Yf as o,xf as p,Xf as r,$f as s,_p as t,np as u,$ as v,Rs as w,Ts as x,Bs as y};