@dev.sail.money/sailor 1.3.0-95 → 1.4.0-242

package/packages/cli/dist/index.cjs

@@ -4581,8 +4581,8 @@ var init_encoding = __esm({
   "../../node_modules/.pnpm/viem@2.51.3_bufferutil@4.1.0_typescript@5.9.3_utf-8-validate@5.0.10_zod@4.4.3/node_modules/viem/_esm/errors/encoding.js"() {
     init_base();
     IntegerOutOfRangeError = class extends BaseError2 {
-      constructor({ max, min: min2, signed, size: size5, value }) {
-        super(`Number "${value}" is not in safe ${size5 ? `${size5 * 8}-bit ${signed ? "signed" : "unsigned"} ` : ""}integer range ${max ? `(${min2} to ${max})` : `(above ${min2})`}`, { name: "IntegerOutOfRangeError" });
+      constructor({ max, min, signed, size: size5, value }) {
+        super(`Number "${value}" is not in safe ${size5 ? `${size5 * 8}-bit ${signed ? "signed" : "unsigned"} ` : ""}integer range ${max ? `(${min} to ${max})` : `(above ${min})`}`, { name: "IntegerOutOfRangeError" });
       }
     };
     InvalidBytesBooleanError = class extends BaseError2 {
@@ -4945,9 +4945,9 @@ function aexists(instance, checkFinished = true) {
 }
 function aoutput(out, instance) {
   abytes(out);
-  const min2 = instance.outputLen;
-  if (out.length < min2) {
-    throw new Error("digestInto() expects output buffer of length at least " + min2);
+  const min = instance.outputLen;
+  if (out.length < min) {
+    throw new Error("digestInto() expects output buffer of length at least " + min);
   }
 }
 function u32(arr) {
@@ -5751,11 +5751,11 @@ function encodeBool(value) {
 function encodeNumber(value, { signed, size: size5 = 256 }) {
   if (typeof size5 === "number") {
     const max = 2n ** (BigInt(size5) - (signed ? 1n : 0n)) - 1n;
-    const min2 = signed ? -max - 1n : 0n;
-    if (value > max || value < min2)
+    const min = signed ? -max - 1n : 0n;
+    if (value > max || value < min)
       throw new IntegerOutOfRangeError({
         max: max.toString(),
-        min: min2.toString(),
+        min: min.toString(),
         signed,
         size: size5 / 8,
         value: value.toString()
@@ -8574,12 +8574,12 @@ function utf8ToBytes2(str) {
     throw new Error("string expected");
   return new Uint8Array(new TextEncoder().encode(str));
 }
-function inRange(n, min2, max) {
-  return isPosBig(n) && isPosBig(min2) && isPosBig(max) && min2 <= n && n < max;
+function inRange(n, min, max) {
+  return isPosBig(n) && isPosBig(min) && isPosBig(max) && min <= n && n < max;
 }
-function aInRange(title, n, min2, max) {
-  if (!inRange(n, min2, max))
-    throw new Error("expected valid " + title + ": " + min2 + " <= n < " + max + ", got " + n);
+function aInRange(title, n, min, max) {
+  if (!inRange(n, min, max))
+    throw new Error("expected valid " + title + ": " + min + " <= n < " + max + ", got " + n);
 }
 function bitLen(n) {
   let len;
@@ -13526,8 +13526,8 @@ var init_Hex = __esm({
     encoder4 = /* @__PURE__ */ new TextEncoder();
     hexes4 = /* @__PURE__ */ Array.from({ length: 256 }, (_v, i) => i.toString(16).padStart(2, "0"));
     IntegerOutOfRangeError2 = class extends BaseError3 {
-      constructor({ max, min: min2, signed, size: size5, value }) {
-        super(`Number \`${value}\` is not in safe${size5 ? ` ${size5 * 8}-bit` : ""}${signed ? " signed" : " unsigned"} integer range ${max ? `(\`${min2}\` to \`${max}\`)` : `(above \`${min2}\`)`}`);
+      constructor({ max, min, signed, size: size5, value }) {
+        super(`Number \`${value}\` is not in safe${size5 ? ` ${size5 * 8}-bit` : ""}${signed ? " signed" : " unsigned"} integer range ${max ? `(\`${min}\` to \`${max}\`)` : `(above \`${min}\`)`}`);
         Object.defineProperty(this, "name", {
           enumerable: true,
           configurable: true,
@@ -15767,13 +15767,13 @@ var init_getCallError = __esm({
 
 // ../../node_modules/.pnpm/viem@2.51.3_bufferutil@4.1.0_typescript@5.9.3_utf-8-validate@5.0.10_zod@4.4.3/node_modules/viem/_esm/utils/promise/withResolvers.js
 function withResolvers() {
-  let resolve3 = () => void 0;
+  let resolve4 = () => void 0;
   let reject = () => void 0;
   const promise = new Promise((resolve_, reject_) => {
-    resolve3 = resolve_;
+    resolve4 = resolve_;
     reject = reject_;
   });
-  return { promise, resolve: resolve3, reject };
+  return { promise, resolve: resolve4, reject };
 }
 var init_withResolvers = __esm({
   "../../node_modules/.pnpm/viem@2.51.3_bufferutil@4.1.0_typescript@5.9.3_utf-8-validate@5.0.10_zod@4.4.3/node_modules/viem/_esm/utils/promise/withResolvers.js"() {
@@ -15792,8 +15792,8 @@ function createBatchScheduler({ fn, id, shouldSplitBatch, wait: wait2 = 0, sort
       if (sort && Array.isArray(data))
         data.sort(sort);
       for (let i = 0; i < scheduler.length; i++) {
-        const { resolve: resolve3 } = scheduler[i];
-        resolve3?.([data[i], data]);
+        const { resolve: resolve4 } = scheduler[i];
+        resolve4?.([data[i], data]);
       }
     }).catch((err) => {
       for (let i = 0; i < scheduler.length; i++) {
@@ -15809,16 +15809,16 @@ function createBatchScheduler({ fn, id, shouldSplitBatch, wait: wait2 = 0, sort
   return {
     flush,
     async schedule(args) {
-      const { promise, resolve: resolve3, reject } = withResolvers();
+      const { promise, resolve: resolve4, reject } = withResolvers();
       const split2 = shouldSplitBatch?.([...getBatchedArgs(), args]);
       if (split2)
         exec();
       const hasActiveScheduler = getScheduler().length > 0;
       if (hasActiveScheduler) {
-        setScheduler({ args, resolve: resolve3, reject });
+        setScheduler({ args, resolve: resolve4, reject });
         return promise;
       }
-      setScheduler({ args, resolve: resolve3, reject });
+      setScheduler({ args, resolve: resolve4, reject });
       setTimeout(exec, wait2);
       return promise;
     }
@@ -16595,7 +16595,7 @@ var init_observe = __esm({
 
 // ../../node_modules/.pnpm/viem@2.51.3_bufferutil@4.1.0_typescript@5.9.3_utf-8-validate@5.0.10_zod@4.4.3/node_modules/viem/_esm/utils/wait.js
 async function wait(time, { signal } = {}) {
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve4, reject) => {
     if (signal?.aborted) {
       reject(getAbortError(signal));
       return;
@@ -16603,7 +16603,7 @@ async function wait(time, { signal } = {}) {
     const cleanup = () => signal?.removeEventListener("abort", onAbort);
     const timeout = setTimeout(() => {
       cleanup();
-      resolve3();
+      resolve4();
     }, time);
     const onAbort = () => {
       clearTimeout(timeout);
@@ -17419,7 +17419,7 @@ var init_calls = __esm({
 
 // ../../node_modules/.pnpm/viem@2.51.3_bufferutil@4.1.0_typescript@5.9.3_utf-8-validate@5.0.10_zod@4.4.3/node_modules/viem/_esm/utils/promise/withRetry.js
 function withRetry(fn, { delay: delay_ = 100, retryCount = 2, shouldRetry: shouldRetry2 = () => true, signal } = {}) {
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve4, reject) => {
     const attemptRetry = async ({ count = 0 } = {}) => {
       if (signal?.aborted) {
         reject(getAbortError(signal));
@@ -17439,7 +17439,7 @@ function withRetry(fn, { delay: delay_ = 100, retryCount = 2, shouldRetry: shoul
       };
       try {
         const data = await fn();
-        resolve3(data);
+        resolve4(data);
       } catch (err) {
         if (signal?.aborted) {
           reject(getAbortError(signal));
@@ -17586,7 +17586,7 @@ async function sendCalls(client, parameters) {
           results.push({ reason, status: "rejected" });
         }
         if (experimental_fallbackDelay > 0)
-          await new Promise((resolve3) => setTimeout(resolve3, experimental_fallbackDelay));
+          await new Promise((resolve4) => setTimeout(resolve4, experimental_fallbackDelay));
       }
       if (results.every((r) => r.status === "rejected"))
         throw results[0].reason;
@@ -17716,9 +17716,9 @@ async function waitForCallsStatus(client, parameters) {
     throwOnFailure = false
   } = parameters;
   const observerId = stringify(["waitForCallsStatus", client.uid, id]);
-  const { promise, resolve: resolve3, reject } = withResolvers();
+  const { promise, resolve: resolve4, reject } = withResolvers();
   let timer;
-  const unobserve = observe(observerId, { resolve: resolve3, reject }, (emit2) => {
+  const unobserve = observe(observerId, { resolve: resolve4, reject }, (emit2) => {
     const unpoll = poll(async () => {
       const done = (fn) => {
         clearTimeout(timer);
@@ -18123,13 +18123,13 @@ async function isImageUri(uri) {
     }
     if (!Object.hasOwn(globalThis, "Image"))
       return false;
-    return new Promise((resolve3) => {
+    return new Promise((resolve4) => {
       const img = new Image();
       img.onload = () => {
-        resolve3(true);
+        resolve4(true);
       };
       img.onerror = () => {
-        resolve3(false);
+        resolve4(false);
       };
       img.src = uri;
     });
@@ -20077,7 +20077,7 @@ var init_nonceManager = __esm({
 
 // ../../node_modules/.pnpm/viem@2.51.3_bufferutil@4.1.0_typescript@5.9.3_utf-8-validate@5.0.10_zod@4.4.3/node_modules/viem/_esm/utils/promise/withTimeout.js
 function withTimeout(fn, { errorInstance = new Error("timed out"), timeout, signal }) {
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve4, reject) => {
     ;
     (async () => {
       let timeoutId;
@@ -20092,7 +20092,7 @@ function withTimeout(fn, { errorInstance = new Error("timed out"), timeout, sign
             }
           }, timeout);
         }
-        resolve3(await fn({ signal: controller?.signal || null }));
+        resolve4(await fn({ signal: controller?.signal || null }));
       } catch (err) {
         if (controller?.signal.aborted && isAbortError(err)) {
           reject(errorInstance);
@@ -24137,10 +24137,10 @@ async function getWebSocketRpcClient(url, options = {}) {
       socket.addEventListener("error", onError);
       socket.addEventListener("open", onOpen);
       if (socket.readyState === WebSocket5.CONNECTING) {
-        await new Promise((resolve3, reject) => {
+        await new Promise((resolve4, reject) => {
           if (!socket)
             return;
-          socket.onopen = resolve3;
+          socket.onopen = resolve4;
           socket.onerror = reject;
         });
       }
@@ -25269,11 +25269,11 @@ function encodeBoolean(value) {
 function encodeNumber2(value, { signed, size: size5 }) {
   if (typeof size5 === "number") {
     const max = 2n ** (BigInt(size5) - (signed ? 1n : 0n)) - 1n;
-    const min2 = signed ? -max - 1n : 0n;
-    if (value > max || value < min2)
+    const min = signed ? -max - 1n : 0n;
+    if (value > max || value < min)
       throw new IntegerOutOfRangeError2({
         max: max.toString(),
-        min: min2.toString(),
+        min: min.toString(),
         signed,
         size: size5 / 8,
         value: value.toString()
@@ -28321,13 +28321,13 @@ async function waitForTransactionReceipt(client, parameters) {
   let retrying = false;
   let _unobserve;
   let _unwatch;
-  const { promise, resolve: resolve3, reject } = withResolvers();
+  const { promise, resolve: resolve4, reject } = withResolvers();
   const timer = timeout ? setTimeout(() => {
     _unwatch?.();
     _unobserve?.();
     reject(new WaitForTransactionReceiptTimeoutError({ hash: hash3 }));
   }, timeout) : void 0;
-  _unobserve = observe(observerId, { onReplaced, resolve: resolve3, reject }, async (emit2) => {
+  _unobserve = observe(observerId, { onReplaced, resolve: resolve4, reject }, async (emit2) => {
     receipt = await getAction(client, getTransactionReceipt, "getTransactionReceipt")({ hash: hash3 }).catch(() => void 0);
     if (receipt && confirmations <= 1) {
       clearTimeout(timer);
@@ -30586,7 +30586,7 @@ function webSocket(url, config = {}) {
       },
       async subscribe({ params, onData, onError }) {
         const rpcClient = await getWebSocketRpcClient(url_, wsRpcClientOpts);
-        const { result: subscriptionId } = await new Promise((resolve3, reject) => rpcClient.request({
+        const { result: subscriptionId } = await new Promise((resolve4, reject) => rpcClient.request({
           body: {
             method: "eth_subscribe",
             params
@@ -30603,7 +30603,7 @@ function webSocket(url, config = {}) {
               return;
             }
             if (typeof response.id === "number") {
-              resolve3(response);
+              resolve4(response);
               return;
             }
             if (response.method !== "eth_subscription")
@@ -30614,12 +30614,12 @@ function webSocket(url, config = {}) {
         return {
           subscriptionId,
           async unsubscribe() {
-            return new Promise((resolve3) => rpcClient.request({
+            return new Promise((resolve4) => rpcClient.request({
               body: {
                 method: "eth_unsubscribe",
                 params: [subscriptionId]
               },
-              onResponse: resolve3
+              onResponse: resolve4
             }));
           }
         };
@@ -35190,8 +35190,8 @@ var require_websocket_server2 = __commonJS({
 });
 
 // src/index.ts
-var import_node_fs21 = require("node:fs");
-var import_node_path17 = require("node:path");
+var import_node_fs22 = require("node:fs");
+var import_node_path18 = require("node:path");
 
 // ../../node_modules/.pnpm/commander@12.1.0/node_modules/commander/esm.mjs
 var import_index = __toESM(require_commander(), 1);
@@ -35211,16 +35211,18 @@ var {
 } = import_index.default;
 
 // ../sdk/dist/chains.js
+var CREATE2_KERNEL = "0x38b508756c976e876EFF05a29E731A4d348BA6ED";
+var CREATE2_MANDATE_FACTORY = "0x6d2C802ffa0d9A8Ed69A5Bf22c1b63ccB566B8Fc";
+var CREATE2_GOVERNANCE = "0x4315B37cA4A315A7042af1Fcb37F8436f4D24356";
 var chains = {
   // Ethereum mainnet
   1: {
     chainId: 1,
     name: "Ethereum",
     rpcEnvVar: "ETH_MAINNET_RPC_URL",
-    // CREATE2 deterministic deploy (2026-06-09, gitCommit 1199b33).
-    kernel: "0x02ABC18B65A328de2e749F56ba79ACF2718a6659",
-    mandateFactory: "0x14EDd6c2a56EfC0d71E215ab13094B9AF90543d2",
-    governance: "0x7A478118715791728BDE3bc7A4D7ECfdEB89C6EC",
+    kernel: CREATE2_KERNEL,
+    mandateFactory: CREATE2_MANDATE_FACTORY,
+    governance: CREATE2_GOVERNANCE,
     dispatchModel: "selective",
     protocols: {}
   },
@@ -35229,11 +35231,9 @@ var chains = {
     chainId: 8453,
     name: "Base",
     rpcEnvVar: "BASE_RPC_URL",
-    // CREATE2 deterministic deploy (2026-06-09, gitCommit 1199b33).
-    // Supersedes 0x6319d3dfDDe3804ba93D65752b00c52bFb05a1ab (SAIL-405).
-    kernel: "0x02ABC18B65A328de2e749F56ba79ACF2718a6659",
-    mandateFactory: "0x14EDd6c2a56EfC0d71E215ab13094B9AF90543d2",
-    governance: "0x7A478118715791728BDE3bc7A4D7ECfdEB89C6EC",
+    kernel: CREATE2_KERNEL,
+    mandateFactory: CREATE2_MANDATE_FACTORY,
+    governance: CREATE2_GOVERNANCE,
     dispatchModel: "selective",
     protocols: {}
   },
@@ -35242,11 +35242,20 @@ var chains = {
     chainId: 42161,
     name: "Arbitrum",
     rpcEnvVar: "ARBITRUM_RPC_URL",
-    // CREATE2 deterministic deploy (2026-06-09, gitCommit 1199b33).
-    // Supersedes 0x2716B12832DED0EF5688519c5Fe069EFc0374E02 (SAIL-405).
-    kernel: "0x02ABC18B65A328de2e749F56ba79ACF2718a6659",
-    mandateFactory: "0x14EDd6c2a56EfC0d71E215ab13094B9AF90543d2",
-    governance: "0x7A478118715791728BDE3bc7A4D7ECfdEB89C6EC",
+    kernel: CREATE2_KERNEL,
+    mandateFactory: CREATE2_MANDATE_FACTORY,
+    governance: CREATE2_GOVERNANCE,
+    dispatchModel: "selective",
+    protocols: {}
+  },
+  // Optimism mainnet
+  10: {
+    chainId: 10,
+    name: "Optimism",
+    rpcEnvVar: "OPTIMISM_RPC_URL",
+    kernel: CREATE2_KERNEL,
+    mandateFactory: CREATE2_MANDATE_FACTORY,
+    governance: CREATE2_GOVERNANCE,
     dispatchModel: "selective",
     protocols: {}
   },
@@ -35255,11 +35264,53 @@ var chains = {
     chainId: 130,
     name: "Unichain",
     rpcEnvVar: "UNICHAIN_RPC_URL",
-    // CREATE2 deterministic deploy (2026-06-09, gitCommit 1199b33).
-    // Supersedes 0xD985029960a9B7C2E7E38e102C448b8b8539B156 (SAIL-406).
-    kernel: "0x02ABC18B65A328de2e749F56ba79ACF2718a6659",
-    mandateFactory: "0x14EDd6c2a56EfC0d71E215ab13094B9AF90543d2",
-    governance: "0x7A478118715791728BDE3bc7A4D7ECfdEB89C6EC",
+    kernel: CREATE2_KERNEL,
+    mandateFactory: CREATE2_MANDATE_FACTORY,
+    governance: CREATE2_GOVERNANCE,
+    dispatchModel: "selective",
+    protocols: {}
+  },
+  // BSC mainnet
+  56: {
+    chainId: 56,
+    name: "BSC",
+    rpcEnvVar: "BSC_RPC_URL",
+    kernel: CREATE2_KERNEL,
+    mandateFactory: CREATE2_MANDATE_FACTORY,
+    governance: CREATE2_GOVERNANCE,
+    dispatchModel: "selective",
+    protocols: {}
+  },
+  // World Chain mainnet
+  480: {
+    chainId: 480,
+    name: "World Chain",
+    rpcEnvVar: "WORLD_RPC_URL",
+    kernel: CREATE2_KERNEL,
+    mandateFactory: CREATE2_MANDATE_FACTORY,
+    governance: CREATE2_GOVERNANCE,
+    dispatchModel: "selective",
+    protocols: {}
+  },
+  // HyperEVM mainnet
+  999: {
+    chainId: 999,
+    name: "HyperEVM",
+    rpcEnvVar: "HYPEREVM_RPC_URL",
+    kernel: CREATE2_KERNEL,
+    mandateFactory: CREATE2_MANDATE_FACTORY,
+    governance: CREATE2_GOVERNANCE,
+    dispatchModel: "selective",
+    protocols: {}
+  },
+  // MegaETH mainnet
+  4326: {
+    chainId: 4326,
+    name: "MegaETH",
+    rpcEnvVar: "MEGAETH_RPC_URL",
+    kernel: CREATE2_KERNEL,
+    mandateFactory: CREATE2_MANDATE_FACTORY,
+    governance: CREATE2_GOVERNANCE,
     dispatchModel: "selective",
     protocols: {}
   },
@@ -35268,11 +35319,9 @@ var chains = {
     chainId: 84532,
     name: "Base Sepolia",
     rpcEnvVar: "BASE_SEPOLIA_RPC_URL",
-    // CREATE2 deterministic deploy (2026-06-09, gitCommit 1199b33).
-    // Supersedes 0xf1D0F4C9893612627409948BAa9d82a01a373799 (SAIL-405).
-    kernel: "0x02ABC18B65A328de2e749F56ba79ACF2718a6659",
-    mandateFactory: "0x14EDd6c2a56EfC0d71E215ab13094B9AF90543d2",
-    governance: "0x7A478118715791728BDE3bc7A4D7ECfdEB89C6EC",
+    kernel: CREATE2_KERNEL,
+    mandateFactory: CREATE2_MANDATE_FACTORY,
+    governance: CREATE2_GOVERNANCE,
     dispatchModel: "selective",
     protocols: {}
   },
@@ -35281,10 +35330,9 @@ var chains = {
     chainId: 11155111,
     name: "Eth Sepolia",
     rpcEnvVar: "SEPOLIA_RPC_URL",
-    // CREATE2 deterministic deploy (2026-06-09, gitCommit 1199b33).
-    kernel: "0x02ABC18B65A328de2e749F56ba79ACF2718a6659",
-    mandateFactory: "0x14EDd6c2a56EfC0d71E215ab13094B9AF90543d2",
-    governance: "0x7A478118715791728BDE3bc7A4D7ECfdEB89C6EC",
+    kernel: CREATE2_KERNEL,
+    mandateFactory: CREATE2_MANDATE_FACTORY,
+    governance: CREATE2_GOVERNANCE,
     dispatchModel: "selective",
     protocols: {}
   }
@@ -35292,7 +35340,7 @@ var chains = {
 function getChain(chainId) {
   const config = chains[chainId];
   if (!config) {
-    throw new Error(`Chain ${chainId} is not supported. Supported chains: 1 (Ethereum), 8453 (Base), 42161 (Arbitrum), 130 (Unichain), 84532 (Base Sepolia), 11155111 (Eth Sepolia).`);
+    throw new Error(`Chain ${chainId} is not supported. Supported chains: 1 (Ethereum), 8453 (Base), 42161 (Arbitrum), 10 (Optimism), 130 (Unichain), 56 (BSC), 480 (World Chain), 999 (HyperEVM), 4326 (MegaETH), 84532 (Base Sepolia), 11155111 (Eth Sepolia).`);
   }
   return config;
 }
@@ -35319,6 +35367,10 @@ var SailKernelAbi = [
     ],
     outputs: [{ name: "account", type: "address" }]
   },
+  // Post-#53: two-step registration. Requires msg.sender == the Safe (trusted-proxy
+  // codehash + trusted-singleton pin) and a Safe owner signature over the
+  // RegisterAccount EIP-712 digest (verified via checkSignatures). Must be submitted
+  // through the Safe's execTransaction, not the owner EOA. See buildRegisterAccountTypedData.
   {
     type: "function",
     name: "registerAccount",
@@ -35326,7 +35378,10 @@ var SailKernelAbi = [
     inputs: [
       { name: "permissionSigner", type: "address" },
       { name: "manager", type: "address" },
-      { name: "feePolicy", type: "address" }
+      { name: "feePolicy", type: "address" },
+      { name: "feeAsset", type: "address" },
+      { name: "deadline", type: "uint256" },
+      { name: "ownerSig", type: "bytes" }
     ],
     outputs: []
   },
@@ -35377,6 +35432,32 @@ var SailKernelAbi = [
     ],
     outputs: []
   },
+  // ── Session kill switch ───────────────────────────────────────────────────
+  // Suspend/resume manager dispatch rights. Both are permissionSigner-signed
+  // (RevokeSession/ActivateSession EIP-712, nonce = signerNonces[account]) and
+  // rotate the manager/batch nonce epochs so any pre-signed dispatch is invalidated.
+  {
+    type: "function",
+    name: "revokeSession",
+    stateMutability: "nonpayable",
+    inputs: [
+      { name: "account", type: "address" },
+      { name: "deadline", type: "uint256" },
+      { name: "sig", type: "bytes" }
+    ],
+    outputs: []
+  },
+  {
+    type: "function",
+    name: "activateSession",
+    stateMutability: "nonpayable",
+    inputs: [
+      { name: "account", type: "address" },
+      { name: "deadline", type: "uint256" },
+      { name: "sig", type: "bytes" }
+    ],
+    outputs: []
+  },
   // ── Manager dispatch ──────────────────────────────────────────────────────
   {
     type: "function",
@@ -35516,6 +35597,7 @@ var SailKernelAbi = [
       { name: "permissionSigner", type: "address" },
       { name: "manager", type: "address" },
       { name: "feePolicy", type: "address" },
+      { name: "feeAsset", type: "address" },
       { name: "sessionActive", type: "bool" }
     ]
   },
@@ -35709,148 +35791,142 @@ async function detectKernelCapabilities(publicClient, kernel, opts) {
 }
 
 // ../sdk/dist/deployments.js
-var CREATE2_KERNEL = "0x02ABC18B65A328de2e749F56ba79ACF2718a6659";
-var CREATE2_GOVERNANCE = "0x7A478118715791728BDE3bc7A4D7ECfdEB89C6EC";
-var CREATE2_TIMELOCK = "0xE48Ba8DB6d748adafD13155c3590f62e58a77f56";
+var CREATE2_KERNEL2 = "0x38b508756c976e876EFF05a29E731A4d348BA6ED";
+var CREATE2_GOVERNANCE2 = "0x4315B37cA4A315A7042af1Fcb37F8436f4D24356";
+var CREATE2_TIMELOCK = "0xC1E5F9A581D4100Aa949f80204540a33aD97A7b6";
 var CREATE2_SAFE_MODULE_ENABLER = "0x7897Cb53a4be4a2eaAf46D60573C4Fd83b33fE1F";
-var CREATE2_MANDATE_FACTORY = "0x14EDd6c2a56EfC0d71E215ab13094B9AF90543d2";
-var CREATE2_STANDARD_FEE_POLICY = "0xe7B5901b839cFFDEd9D4108A22712C8BfdA1D80D";
-var CREATE2_TREASURY = "0xB01dCE443d052e44b7D13726c0EC9fFB7f5815B6";
+var CREATE2_MANDATE_FACTORY2 = "0x6d2C802ffa0d9A8Ed69A5Bf22c1b63ccB566B8Fc";
+var CREATE2_STANDARD_FEE_POLICY = "0x1087312447C8a2BfA15EB9cE23590E3502DBA04b";
+var CREATE2_DEPLOYER = "0xB01dCE443d052e44b7D13726c0EC9fFB7f5815B6";
+var CREATE2_TREASURY = "0x7b37F85575F1568a37dBA342BC5FE6d393F0872f";
+var CREATE2_MAX_PERMISSION_FEE_WEI = 10000000000000000n;
+var CREATE2_TEMPLATES = {
+  swap: "0x35cEEa0db96997Cc3CF3beB42FFa36A499342F7C",
+  swapNoOracle: "0x34Ba96CbEd1f46c88A5265E645DC5fe41662b519",
+  borrow: "0x3e2666051599223cEAb10De55C89A0842857d8AF",
+  deposit: "0xBfB5e13a97b12Ee89d2F2b9B65eCf7e0E371911f",
+  withdraw: "0xF5eF5dda450a130e3020d54f565E830e4a7531f8",
+  transfer: "0xda909a1CC584fb7559Ce4A828b008B473Da095e1",
+  approveAndCallBatch: "0x0535A4D51333484ef583103DAB1a9449756ab732"
+};
+var CREATE2_KNOWN_TEMPLATES = [
+  { kind: "SwapPermission", address: CREATE2_TEMPLATES.swap, label: "Swap" },
+  {
+    kind: "SwapPermissionNoOracle",
+    address: CREATE2_TEMPLATES.swapNoOracle,
+    label: "Swap (no oracle)"
+  },
+  { kind: "BorrowPermission", address: CREATE2_TEMPLATES.borrow, label: "Borrow" },
+  { kind: "DepositPermission", address: CREATE2_TEMPLATES.deposit, label: "Deposit" },
+  { kind: "WithdrawPermission", address: CREATE2_TEMPLATES.withdraw, label: "Withdraw" },
+  { kind: "TransferPermission", address: CREATE2_TEMPLATES.transfer, label: "Transfer" },
+  {
+    kind: "ApproveAndCallBatchPermission",
+    address: CREATE2_TEMPLATES.approveAndCallBatch,
+    label: "Approve + call batch"
+  }
+];
+var COMMON_DEPLOYMENT_FIELDS = {
+  deployer: CREATE2_DEPLOYER,
+  governance: CREATE2_GOVERNANCE2,
+  timelock: CREATE2_TIMELOCK,
+  kernel: CREATE2_KERNEL2,
+  mandateFactory: CREATE2_MANDATE_FACTORY2,
+  standardFeePolicy: CREATE2_STANDARD_FEE_POLICY,
+  safeModuleEnabler: CREATE2_SAFE_MODULE_ENABLER,
+  treasury: CREATE2_TREASURY,
+  maxPermissionFeeWei: CREATE2_MAX_PERMISSION_FEE_WEI,
+  initialBaseFee: 0n,
+  initialComplexityRate: 0n,
+  dispatchModel: "selective",
+  // The seven launch templates are SHARED multi-tenant ConfigurablePermission instances
+  // (registered by address, configured via configure()), NOT EIP-1167 clone logic. They
+  // belong in knownTemplates only. standaloneTemplates is the clone-implementation registry
+  // (the `impl` arg to MandateFactory.deployAndAttach) — empty until standalone clones deploy.
+  // Populating it with shared templates mislabels them as unaudited community clones in
+  // `sailor mandate templates` and makes capabilities advertise them as deployAndAttach-able.
+  standaloneTemplates: {}
+};
+function knownTemplatesFor(chainId) {
+  return CREATE2_KNOWN_TEMPLATES.map((t) => ({ ...t, chainId }));
+}
 var sailDeployments = {
   // ── Ethereum mainnet ─────────────────────────────────────────────────────────
   1: {
-    // CREATE2 deterministic deploy (2026-06-09, gitCommit 1199b33).
-    // allowlistBootstrapped=true (genesis bootstrap), zero fees, 48h timelock.
+    ...COMMON_DEPLOYMENT_FIELDS,
     chainId: 1,
-    blockNumber: 25280925,
-    deployer: CREATE2_TREASURY,
-    governance: CREATE2_GOVERNANCE,
-    timelock: CREATE2_TIMELOCK,
-    kernel: CREATE2_KERNEL,
-    mandateFactory: CREATE2_MANDATE_FACTORY,
-    standardFeePolicy: CREATE2_STANDARD_FEE_POLICY,
-    safeModuleEnabler: CREATE2_SAFE_MODULE_ENABLER,
-    treasury: CREATE2_TREASURY,
-    maxPermissionFeeWei: 1000000000000000n,
-    initialBaseFee: 0n,
-    initialComplexityRate: 0n,
-    dispatchModel: "selective",
-    knownTemplates: [],
-    standaloneTemplates: {}
+    blockNumber: 25432741,
+    knownTemplates: knownTemplatesFor(1)
   },
   // ── Base mainnet ─────────────────────────────────────────────────────────────
   8453: {
-    // CREATE2 deterministic deploy (2026-06-09, gitCommit 1199b33). Supersedes
-    // 0x6319d3dfDDe3804ba93D65752b00c52bFb05a1ab (SAIL-405 redeploy).
-    // allowlistBootstrapped=true, zero fees, 48h timelock.
+    ...COMMON_DEPLOYMENT_FIELDS,
     chainId: 8453,
-    blockNumber: 47115338,
-    deployer: CREATE2_TREASURY,
-    governance: CREATE2_GOVERNANCE,
-    timelock: CREATE2_TIMELOCK,
-    kernel: CREATE2_KERNEL,
-    mandateFactory: CREATE2_MANDATE_FACTORY,
-    standardFeePolicy: CREATE2_STANDARD_FEE_POLICY,
-    safeModuleEnabler: CREATE2_SAFE_MODULE_ENABLER,
-    treasury: CREATE2_TREASURY,
-    maxPermissionFeeWei: 1000000000000000n,
-    initialBaseFee: 0n,
-    initialComplexityRate: 0n,
-    dispatchModel: "selective",
-    knownTemplates: [],
-    standaloneTemplates: {}
+    blockNumber: 48029413,
+    knownTemplates: knownTemplatesFor(8453)
   },
   // ── Arbitrum mainnet ─────────────────────────────────────────────────────────
   42161: {
-    // CREATE2 deterministic deploy (2026-06-09, gitCommit 1199b33). Supersedes
-    // 0x2716B12832DED0EF5688519c5Fe069EFc0374E02 (SAIL-405 redeploy).
-    // allowlistBootstrapped=true, zero fees, 48h timelock.
+    ...COMMON_DEPLOYMENT_FIELDS,
     chainId: 42161,
-    blockNumber: 471736462,
-    deployer: CREATE2_TREASURY,
-    governance: CREATE2_GOVERNANCE,
-    timelock: CREATE2_TIMELOCK,
-    kernel: CREATE2_KERNEL,
-    mandateFactory: CREATE2_MANDATE_FACTORY,
-    standardFeePolicy: CREATE2_STANDARD_FEE_POLICY,
-    safeModuleEnabler: CREATE2_SAFE_MODULE_ENABLER,
-    treasury: CREATE2_TREASURY,
-    maxPermissionFeeWei: 1000000000000000n,
-    initialBaseFee: 0n,
-    initialComplexityRate: 0n,
-    dispatchModel: "selective",
-    knownTemplates: [],
-    standaloneTemplates: {}
+    blockNumber: 25432669,
+    knownTemplates: knownTemplatesFor(42161)
+  },
+  // ── Optimism mainnet ─────────────────────────────────────────────────────────
+  10: {
+    ...COMMON_DEPLOYMENT_FIELDS,
+    chainId: 10,
+    blockNumber: 153625159,
+    knownTemplates: knownTemplatesFor(10)
   },
   // ── Unichain mainnet ─────────────────────────────────────────────────────────
   130: {
-    // CREATE2 deterministic deploy (2026-06-09, gitCommit 1199b33). Supersedes
-    // 0xD985029960a9B7C2E7E38e102C448b8b8539B156 (SAIL-406 deploy).
-    // NOTE: knownTemplates and standaloneTemplates from SAIL-406 were deployed
-    // against the old kernel 0xD985029... and are now invalid. They must be
-    // redeployed against the new kernel 0x02ABC1... and re-populated here.
+    ...COMMON_DEPLOYMENT_FIELDS,
     chainId: 130,
-    blockNumber: 50271704,
-    deployer: CREATE2_TREASURY,
-    governance: CREATE2_GOVERNANCE,
-    timelock: CREATE2_TIMELOCK,
-    kernel: CREATE2_KERNEL,
-    mandateFactory: CREATE2_MANDATE_FACTORY,
-    standardFeePolicy: CREATE2_STANDARD_FEE_POLICY,
-    safeModuleEnabler: CREATE2_SAFE_MODULE_ENABLER,
-    treasury: CREATE2_TREASURY,
-    maxPermissionFeeWei: 1000000000000000n,
-    initialBaseFee: 0n,
-    initialComplexityRate: 0n,
-    dispatchModel: "selective",
-    // Templates cleared: the SAIL-406 shared + standalone templates were deployed
-    // against the old kernel (0xD985029...) and are invalid against the new one.
-    // Re-populate after redeploying templates against 0x02ABC1...
-    knownTemplates: [],
-    standaloneTemplates: {}
+    blockNumber: 52100873,
+    knownTemplates: knownTemplatesFor(130)
+  },
+  // ── BSC mainnet ──────────────────────────────────────────────────────────────
+  56: {
+    ...COMMON_DEPLOYMENT_FIELDS,
+    chainId: 56,
+    blockNumber: 107312662,
+    knownTemplates: knownTemplatesFor(56)
+  },
+  // ── World Chain mainnet ──────────────────────────────────────────────────────
+  480: {
+    ...COMMON_DEPLOYMENT_FIELDS,
+    chainId: 480,
+    blockNumber: 31756901,
+    knownTemplates: knownTemplatesFor(480)
+  },
+  // ── HyperEVM mainnet ─────────────────────────────────────────────────────────
+  999: {
+    ...COMMON_DEPLOYMENT_FIELDS,
+    chainId: 999,
+    blockNumber: 39238629,
+    knownTemplates: knownTemplatesFor(999)
+  },
+  // ── MegaETH mainnet ──────────────────────────────────────────────────────────
+  4326: {
+    ...COMMON_DEPLOYMENT_FIELDS,
+    chainId: 4326,
+    blockNumber: 20056530,
+    knownTemplates: knownTemplatesFor(4326)
   },
   // ── Base Sepolia (testnet) ───────────────────────────────────────────────────
   84532: {
-    // CREATE2 deterministic deploy (2026-06-09, gitCommit 1199b33). Supersedes
-    // 0xf1D0F4C9893612627409948BAa9d82a01a373799 (SAIL-405 redeploy).
-    // allowlistBootstrapped=true, zero fees, 48h timelock.
+    ...COMMON_DEPLOYMENT_FIELDS,
     chainId: 84532,
-    blockNumber: 42625843,
-    deployer: CREATE2_TREASURY,
-    governance: CREATE2_GOVERNANCE,
-    timelock: CREATE2_TIMELOCK,
-    kernel: CREATE2_KERNEL,
-    mandateFactory: CREATE2_MANDATE_FACTORY,
-    standardFeePolicy: CREATE2_STANDARD_FEE_POLICY,
-    safeModuleEnabler: CREATE2_SAFE_MODULE_ENABLER,
-    treasury: CREATE2_TREASURY,
-    maxPermissionFeeWei: 1000000000000000n,
-    initialBaseFee: 0n,
-    initialComplexityRate: 0n,
-    dispatchModel: "selective",
-    knownTemplates: [],
-    standaloneTemplates: {}
+    blockNumber: 43539604,
+    knownTemplates: knownTemplatesFor(84532)
   },
   // ── Eth Sepolia (testnet) ────────────────────────────────────────────────────
   11155111: {
-    // CREATE2 deterministic deploy (2026-06-09, gitCommit 1199b33).
-    // allowlistBootstrapped=true, zero fees, 48h timelock.
+    ...COMMON_DEPLOYMENT_FIELDS,
     chainId: 11155111,
-    blockNumber: 11023571,
-    deployer: CREATE2_TREASURY,
-    governance: CREATE2_GOVERNANCE,
-    timelock: CREATE2_TIMELOCK,
-    kernel: CREATE2_KERNEL,
-    mandateFactory: CREATE2_MANDATE_FACTORY,
-    standardFeePolicy: CREATE2_STANDARD_FEE_POLICY,
-    safeModuleEnabler: CREATE2_SAFE_MODULE_ENABLER,
-    treasury: CREATE2_TREASURY,
-    maxPermissionFeeWei: 1000000000000000n,
-    initialBaseFee: 0n,
-    initialComplexityRate: 0n,
-    dispatchModel: "selective",
-    knownTemplates: [],
-    standaloneTemplates: {}
+    blockNumber: 11174750,
+    knownTemplates: knownTemplatesFor(11155111)
   }
 };
 function getSailDeployment(chainId) {
@@ -35861,122 +35937,6 @@ function getSailDeployment(chainId) {
   return deployment;
 }
 
-// ../sdk/dist/errors.js
-init_esm2();
-var KERNEL_ERROR_SIGNATURES = [
-  "error AccountAlreadyRegistered(address account)",
-  "error AccountNotRegistered(address account)",
-  "error AccountSelfTarget()",
-  "error ArrayLengthMismatch()",
-  "error BatchPermissionDenied()",
-  "error BatchSubcallFailed(uint256 index, address target)",
-  "error BatchTooLong(uint256 length)",
-  "error BatchZeroTarget(uint256 index)",
-  "error DeadlineExpired(uint256 deadline, uint256 current)",
-  "error DistributorBpsTooLarge(uint256 bps)",
-  "error EmptyBatch()",
-  "error FeePolicyNotSet()",
-  "error FeeTokenMismatch(address provided, address expected)",
-  "error FeeTooLarge(uint256 requested, uint256 maxAllowed)",
-  "error FeeTransferFailed()",
-  "error InsufficientFee(uint256 required, uint256 provided)",
-  "error InvalidInitializer()",
-  "error InvalidManagerSignature()",
-  "error InvalidSignerSignature()",
-  "error KernelSelfTarget(uint256 index)",
-  // SAIL-405: setManager rejects a no-op rotation (newManager == current).
-  "error ManagerUnchanged()",
-  "error ModuleNotEnabled()",
-  // Present in the deployed conjunctive kernel; dropped in the latest source.
-  "error NoPermissionsRegistered(address account)",
-  "error NotAContract(address addr)",
-  "error NotGovernance()",
-  "error NotManager(address caller, address expected)",
-  "error NotPermissionSigner()",
-  "error NotTimelock()",
-  "error PermissionAlreadyRegistered(address permission)",
-  "error PermissionDenied(address permission)",
-  "error PermissionNotBatchAware(address permission)",
-  "error PermissionNotRegistered(address permission)",
-  "error ProtocolPaused()",
-  "error SafeExecutionFailed()",
-  "error SessionInactive(address account)",
-  "error TooManyPermissions(address account, uint256 limit)",
-  "error UntrustedFactory(address factory)",
-  "error UntrustedFeePolicy(address policy)",
-  "error UntrustedModuleSetup(address setup)",
-  "error UntrustedProxyCodehash(bytes32 codehash)",
-  "error UntrustedSingleton(address singleton)",
-  "error ZeroAddress()",
-  "error ZeroFee()"
-];
-var KERNEL_ERROR_ABI = parseAbi(KERNEL_ERROR_SIGNATURES);
-var ERROR_HINTS = {
-  InvalidManagerSignature: "The manager's EIP-712 Dispatch signature did not recover to the registered manager. Most common cause: a stale manager nonce (the kernel's managerNonces advanced between signing and submission \u2014 e.g. a load-balanced RPC returned a lagging value, or two dispatches were signed against the same nonce). Re-read managerNonces and re-sign, or track the nonce locally and increment it across sequential dispatches. Can also mean the wrong EIP-712 Dispatch type was used for this kernel version \u2014 see detectKernelCapabilities.",
-  PermissionDenied: "A registered permission's evaluate() returned false (or reverted / ran out of gas) for this call. In a conjunctive kernel EVERY registered permission must approve EVERY call, so a permission that does not pass through calls outside its own domain will block unrelated dispatches. Check that each permission either matches this call or returns true for calls it doesn't govern.",
-  NoPermissionsRegistered: "The account has zero registered permissions, so the kernel denies by default. Register at least one permission (kernel.registerPermission / registerPermissions) before dispatching.",
-  PermissionNotRegistered: "The named permission is not registered for this account. Register it first, or (on a conjunctive kernel) drop the permission argument \u2014 that kernel checks all registered permissions automatically.",
-  SessionInactive: "The manager's session is revoked. Re-activate it (session.activate) before dispatching.",
-  DeadlineExpired: "The signature deadline is in the past. Use a deadline comfortably ahead of block.timestamp.",
-  SafeExecutionFailed: "The underlying Safe module call reverted. The permission passed, but the target call itself failed (e.g. slippage too tight, insufficient allowance/balance, or a failing swap route).",
-  ModuleNotEnabled: "The Sail module is not enabled on the Safe. Complete account onboarding (enable the module) first.",
-  ProtocolPaused: "The protocol is paused by governance. Dispatches are blocked until it is unpaused.",
-  NotManager: "The submitting address is not the registered manager for this account.",
-  TooManyPermissions: "Registering this permission would exceed the kernel's per-account permission cap. Revoke an unused permission first."
-};
-async function decode2(data) {
-  const { decodeErrorResult: decodeErrorResult2 } = await Promise.resolve().then(() => (init_esm2(), esm_exports2));
-  try {
-    const decoded = decodeErrorResult2({ abi: KERNEL_ERROR_ABI, data });
-    const name = decoded.errorName;
-    const args = decoded.args ?? [];
-    const selector = data.slice(0, 10);
-    const hint = ERROR_HINTS[name];
-    const argStr = args.length ? `(${args.map(String).join(", ")})` : "()";
-    const message = hint ? `${name}${argStr} \u2014 ${hint}` : `${name}${argStr}`;
-    return { name, args, selector, hint, message };
-  } catch {
-    return null;
-  }
-}
-function decodeKernelError(data) {
-  if (!data || data === "0x")
-    return Promise.resolve(null);
-  return decode2(data);
-}
-async function explainKernelRevert(err) {
-  const data = extractRevertData(err);
-  if (!data)
-    return null;
-  return decodeKernelError(data);
-}
-function extractRevertData(err) {
-  const seen = /* @__PURE__ */ new Set();
-  let cursor = err;
-  let depth = 0;
-  while (cursor && typeof cursor === "object" && !seen.has(cursor) && depth < 12) {
-    seen.add(cursor);
-    depth++;
-    const obj = cursor;
-    const data = obj["data"];
-    if (typeof data === "string" && data.startsWith("0x") && data.length >= 10) {
-      return data;
-    }
-    if (data && typeof data === "object") {
-      const inner = data["data"];
-      if (typeof inner === "string" && inner.startsWith("0x") && inner.length >= 10) {
-        return inner;
-      }
-    }
-    const raw = obj["raw"];
-    if (typeof raw === "string" && raw.startsWith("0x") && raw.length >= 10) {
-      return raw;
-    }
-    cursor = obj["cause"];
-  }
-  return null;
-}
-
 // ../sdk/dist/eip712.js
 init_esm2();
 function sailKernelDomain(args) {
@@ -36114,6 +36074,197 @@ function buildRegisterPermissionsBatchTypedData(args) {
     }
   };
 }
+var TEMPLATE_EIP712_DOMAIN_ABI = [
+  {
+    type: "function",
+    name: "eip712Domain",
+    stateMutability: "view",
+    inputs: [],
+    outputs: [
+      { name: "fields", type: "bytes1" },
+      { name: "name", type: "string" },
+      { name: "version", type: "string" },
+      { name: "chainId", type: "uint256" },
+      { name: "verifyingContract", type: "address" },
+      { name: "salt", type: "bytes32" },
+      { name: "extensions", type: "uint256[]" }
+    ]
+  }
+];
+var REGISTRATION_EPOCH_ABI = [
+  {
+    type: "function",
+    name: "registrationEpoch",
+    stateMutability: "view",
+    inputs: [
+      { name: "account", type: "address" },
+      { name: "permission", type: "address" }
+    ],
+    outputs: [{ type: "uint256" }]
+  }
+];
+var CONFIGURE_FIELDS_V1 = [
+  { name: "account", type: "address" },
+  { name: "paramsHash", type: "bytes32" },
+  { name: "nonce", type: "uint256" },
+  { name: "deadline", type: "uint256" }
+];
+var CONFIGURE_FIELDS_V2 = [...CONFIGURE_FIELDS_V1, { name: "epoch", type: "uint256" }];
+async function buildConfigureTypedData(args) {
+  const [, name, version4, chainId] = await args.publicClient.readContract({
+    address: args.template,
+    abi: TEMPLATE_EIP712_DOMAIN_ABI,
+    functionName: "eip712Domain"
+  });
+  if (version4 !== "1" && version4 !== "2") {
+    throw new Error(`Unsupported template EIP-712 domain version "${version4}" for ${args.template}. This SDK signs Configure schema v1 or v2; upgrade the SDK for newer templates.`);
+  }
+  const isV2 = version4 === "2";
+  const message = {
+    account: args.account,
+    paramsHash: keccak256(args.params),
+    nonce: args.nonce.toString(),
+    deadline: args.deadline.toString()
+  };
+  if (isV2) {
+    const epoch = await args.publicClient.readContract({
+      address: args.kernel,
+      abi: REGISTRATION_EPOCH_ABI,
+      functionName: "registrationEpoch",
+      args: [args.account, args.template]
+    });
+    message.epoch = epoch.toString();
+  }
+  return {
+    domain: {
+      name,
+      version: version4,
+      chainId: Number(chainId),
+      verifyingContract: args.template
+    },
+    types: {
+      Configure: isV2 ? CONFIGURE_FIELDS_V2 : CONFIGURE_FIELDS_V1
+    },
+    primaryType: "Configure",
+    message
+  };
+}
+
+// ../sdk/dist/errors.js
+init_esm2();
+var KERNEL_ERROR_SIGNATURES = [
+  "error AccountAlreadyRegistered(address account)",
+  "error AccountNotRegistered(address account)",
+  "error AccountSelfTarget()",
+  "error ArrayLengthMismatch()",
+  "error BatchPermissionDenied()",
+  "error BatchSubcallFailed(uint256 index, address target)",
+  "error BatchTooLong(uint256 length)",
+  "error BatchZeroTarget(uint256 index)",
+  "error DeadlineExpired(uint256 deadline, uint256 current)",
+  "error DistributorBpsTooLarge(uint256 bps)",
+  "error EmptyBatch()",
+  "error FeePolicyNotSet()",
+  "error FeeTokenMismatch(address provided, address expected)",
+  "error FeeTooLarge(uint256 requested, uint256 maxAllowed)",
+  "error FeeTransferFailed()",
+  "error InsufficientFee(uint256 required, uint256 provided)",
+  "error InvalidInitializer()",
+  "error InvalidManagerSignature()",
+  "error InvalidSignerSignature()",
+  "error KernelSelfTarget(uint256 index)",
+  // SAIL-405: setManager rejects a no-op rotation (newManager == current).
+  "error ManagerUnchanged()",
+  "error ModuleNotEnabled()",
+  // Present in the deployed conjunctive kernel; dropped in the latest source.
+  "error NoPermissionsRegistered(address account)",
+  "error NotAContract(address addr)",
+  "error NotGovernance()",
+  "error NotManager(address caller, address expected)",
+  "error NotPermissionSigner()",
+  "error NotTimelock()",
+  "error PermissionAlreadyRegistered(address permission)",
+  "error PermissionDenied(address permission)",
+  "error PermissionNotBatchAware(address permission)",
+  "error PermissionNotRegistered(address permission)",
+  "error ProtocolPaused()",
+  "error SafeExecutionFailed()",
+  "error SessionInactive(address account)",
+  "error TooManyPermissions(address account, uint256 limit)",
+  "error UntrustedFactory(address factory)",
+  "error UntrustedFeePolicy(address policy)",
+  "error UntrustedModuleSetup(address setup)",
+  "error UntrustedProxyCodehash(bytes32 codehash)",
+  "error UntrustedSingleton(address singleton)",
+  "error ZeroAddress()",
+  "error ZeroFee()"
+];
+var KERNEL_ERROR_ABI = parseAbi(KERNEL_ERROR_SIGNATURES);
+var ERROR_HINTS = {
+  InvalidManagerSignature: "The manager's EIP-712 Dispatch signature did not recover to the registered manager. Most common cause: a stale manager nonce (the kernel's managerNonces advanced between signing and submission \u2014 e.g. a load-balanced RPC returned a lagging value, or two dispatches were signed against the same nonce). Re-read managerNonces and re-sign, or track the nonce locally and increment it across sequential dispatches. Can also mean the wrong EIP-712 Dispatch type was used for this kernel version \u2014 see detectKernelCapabilities.",
+  PermissionDenied: "A registered permission's evaluate() returned false (or reverted / ran out of gas) for this call. In a conjunctive kernel EVERY registered permission must approve EVERY call, so a permission that does not pass through calls outside its own domain will block unrelated dispatches. Check that each permission either matches this call or returns true for calls it doesn't govern.",
+  NoPermissionsRegistered: "The account has zero registered permissions, so the kernel denies by default. Register at least one permission (kernel.registerPermission / registerPermissions) before dispatching.",
+  PermissionNotRegistered: "The named permission is not registered for this account. Register it first, or (on a conjunctive kernel) drop the permission argument \u2014 that kernel checks all registered permissions automatically.",
+  SessionInactive: "The manager's session is revoked. Re-activate it (session.activate) before dispatching.",
+  DeadlineExpired: "The signature deadline is in the past. Use a deadline comfortably ahead of block.timestamp.",
+  SafeExecutionFailed: "The underlying Safe module call reverted. The permission passed, but the target call itself failed (e.g. slippage too tight, insufficient allowance/balance, or a failing swap route).",
+  ModuleNotEnabled: "The Sail module is not enabled on the Safe. Complete account onboarding (enable the module) first.",
+  ProtocolPaused: "The protocol is paused by governance. Dispatches are blocked until it is unpaused.",
+  NotManager: "The submitting address is not the registered manager for this account.",
+  TooManyPermissions: "Registering this permission would exceed the kernel's per-account permission cap. Revoke an unused permission first."
+};
+async function decode2(data) {
+  const { decodeErrorResult: decodeErrorResult2 } = await Promise.resolve().then(() => (init_esm2(), esm_exports2));
+  try {
+    const decoded = decodeErrorResult2({ abi: KERNEL_ERROR_ABI, data });
+    const name = decoded.errorName;
+    const args = decoded.args ?? [];
+    const selector = data.slice(0, 10);
+    const hint = ERROR_HINTS[name];
+    const argStr = args.length ? `(${args.map(String).join(", ")})` : "()";
+    const message = hint ? `${name}${argStr} \u2014 ${hint}` : `${name}${argStr}`;
+    return { name, args, selector, hint, message };
+  } catch {
+    return null;
+  }
+}
+function decodeKernelError(data) {
+  if (!data || data === "0x")
+    return Promise.resolve(null);
+  return decode2(data);
+}
+async function explainKernelRevert(err) {
+  const data = extractRevertData(err);
+  if (!data)
+    return null;
+  return decodeKernelError(data);
+}
+function extractRevertData(err) {
+  const seen = /* @__PURE__ */ new Set();
+  let cursor = err;
+  let depth = 0;
+  while (cursor && typeof cursor === "object" && !seen.has(cursor) && depth < 12) {
+    seen.add(cursor);
+    depth++;
+    const obj = cursor;
+    const data = obj["data"];
+    if (typeof data === "string" && data.startsWith("0x") && data.length >= 10) {
+      return data;
+    }
+    if (data && typeof data === "object") {
+      const inner = data["data"];
+      if (typeof inner === "string" && inner.startsWith("0x") && inner.length >= 10) {
+        return inner;
+      }
+    }
+    const raw = obj["raw"];
+    if (typeof raw === "string" && raw.startsWith("0x") && raw.length >= 10) {
+      return raw;
+    }
+    cursor = obj["cause"];
+  }
+  return null;
+}
 
 // ../sdk/dist/lifi.js
 init_esm2();
@@ -36181,9 +36332,30 @@ function buildPublicClient(config) {
 function defaultDeadline() {
   return BigInt(Math.floor(Date.now() / 1e3) + 300);
 }
+var CONFIGURABLE_PERMISSION_ABI = [
+  {
+    type: "function",
+    name: "configNonces",
+    stateMutability: "view",
+    inputs: [{ name: "account", type: "address" }],
+    outputs: [{ type: "uint256" }]
+  },
+  {
+    type: "function",
+    name: "configure",
+    stateMutability: "nonpayable",
+    inputs: [
+      { name: "account", type: "address" },
+      { name: "params", type: "bytes" },
+      { name: "deadline", type: "uint256" },
+      { name: "sig", type: "bytes" }
+    ],
+    outputs: []
+  }
+];
 var DEFAULT_DISPATCH_GAS = 2000000n;
 function delay(ms) {
-  return new Promise((resolve3) => setTimeout(resolve3, ms));
+  return new Promise((resolve4) => setTimeout(resolve4, ms));
 }
 var CALL_COMPONENTS = [
   { name: "target", type: "address" },
@@ -36337,8 +36509,47 @@ var MandateNamespace = class extends KernelNamespace {
       value: 0n
     });
   }
-  reconfigure(_safe, _template, _params, _signer) {
-    return notImplemented();
+  /**
+   * Re-configure the per-account bounds of an already-registered shared template.
+   * The permission signer signs the template's `Configure` EIP-712 struct — built by
+   * `buildConfigureTypedData`, which reads the template's live ERC-5267 domain and emits
+   * the v1 or v2 (epoch-bound) schema to match whatever is deployed — and the attached
+   * wallet submits `configure(account, params, deadline, sig)`.
+   *
+   * The config nonce is read fresh on-chain immediately before signing (the template
+   * increments it only after a successful verify), so a re-config never reuses a stale nonce.
+   */
+  async reconfigure(safe, template, params, signer) {
+    const kernel = this.requireKernel();
+    const wallet = this.requireSigner();
+    const encoded = template.encoder.encode(params);
+    const deadline = defaultDeadline();
+    const nonce = await this.publicClient.readContract({
+      address: template.address,
+      abi: CONFIGURABLE_PERMISSION_ABI,
+      functionName: "configNonces",
+      args: [safe]
+    });
+    const td = await buildConfigureTypedData({
+      publicClient: this.publicClient,
+      kernel,
+      template: template.address,
+      account: safe,
+      params: encoded,
+      nonce,
+      deadline
+    });
+    const sig = await signer.signTyped(td.domain, { primaryType: td.primaryType, types: td.types }, td.message);
+    const txHash = await wallet.writeContract({
+      address: template.address,
+      abi: CONFIGURABLE_PERMISSION_ABI,
+      functionName: "configure",
+      args: [safe, encoded, deadline, sig]
+    });
+    const receipt = await this.publicClient.waitForTransactionReceipt({ hash: txHash });
+    if (receipt.status !== "success") {
+      throw new Error(`configure reverted (tx ${txHash})`);
+    }
   }
   replace(_safe, _oldTemplate, _newTemplate, _params, _signer) {
     return notImplemented();
@@ -36637,14 +36848,67 @@ var StrategyNamespace = class extends KernelNamespace {
   }
 };
 var SessionNamespace = class extends KernelNamespace {
-  revoke(_safe, _signer) {
-    return notImplemented();
+  /**
+   * Suspend (`revokeSession`) or resume (`activateSession`) the manager's dispatch rights.
+   * Both are permissionSigner-signed over the RevokeSession/ActivateSession EIP-712 struct,
+   * with `nonce` read fresh from `signerNonces[account]` immediately before signing — the
+   * kernel bumps that nonce by a full epoch on revoke (#70), so it must never be cached. The
+   * kernel also rotates the manager/batch nonce epochs, invalidating any pre-signed dispatch.
+   */
+  async revoke(safe, signer) {
+    await this.#submitSessionOp(safe, signer, "RevokeSession", "revokeSession");
   }
-  activate(_safe, _signer) {
-    return notImplemented();
+  async activate(safe, signer) {
+    await this.#submitSessionOp(safe, signer, "ActivateSession", "activateSession");
   }
-  status(_safe) {
-    return notImplemented();
+  async #submitSessionOp(safe, signer, primaryType, fn) {
+    const kernel = this.requireKernel();
+    const wallet = this.requireSigner();
+    const deadline = defaultDeadline();
+    const nonce = await this.publicClient.readContract({
+      address: kernel,
+      abi: SailKernelAbi,
+      functionName: "signerNonces",
+      args: [safe]
+    });
+    const sig = await signer.signTyped(sailKernelDomain({ chainId: this.config.chainId, kernel }), {
+      primaryType,
+      types: {
+        [primaryType]: [
+          { name: "account", type: "address" },
+          { name: "nonce", type: "uint256" },
+          { name: "deadline", type: "uint256" }
+        ]
+      }
+    }, { account: safe, nonce, deadline });
+    const txHash = await wallet.writeContract({
+      address: kernel,
+      abi: SailKernelAbi,
+      functionName: fn,
+      args: [safe, deadline, sig]
+    });
+    const receipt = await this.publicClient.waitForTransactionReceipt({ hash: txHash });
+    if (receipt.status !== "success") {
+      throw new Error(`${fn} reverted (tx ${txHash})`);
+    }
+  }
+  async status(safe) {
+    const kernel = this.requireKernel();
+    const cfg = await this.publicClient.readContract({
+      address: kernel,
+      abi: SailKernelAbi,
+      functionName: "configs",
+      args: [safe]
+    });
+    return {
+      safe,
+      active: cfg[4],
+      manager: cfg[1],
+      // Block-level markers require an event scan; expose live active/manager state and
+      // leave the historical timestamps null.
+      activatedAtBlock: null,
+      revokedAtBlock: null
+    };
   }
 };
 var FeesNamespace = class extends KernelNamespace {
@@ -37613,6 +37877,60 @@ var SailGovernanceAbi = [
   }
 ];
 
+// ../sdk/dist/abis/ConfigurablePermission.js
+var ConfigurablePermissionAbi = [
+  {
+    type: "function",
+    name: "configure",
+    stateMutability: "nonpayable",
+    inputs: [
+      { name: "account", type: "address" },
+      { name: "params", type: "bytes" },
+      { name: "deadline", type: "uint256" },
+      { name: "sig", type: "bytes" }
+    ],
+    outputs: []
+  },
+  {
+    type: "function",
+    name: "configureDirect",
+    stateMutability: "nonpayable",
+    inputs: [
+      { name: "account", type: "address" },
+      { name: "params", type: "bytes" }
+    ],
+    outputs: []
+  },
+  {
+    type: "function",
+    name: "isConfigured",
+    stateMutability: "view",
+    inputs: [{ name: "account", type: "address" }],
+    outputs: [{ name: "", type: "bool" }]
+  },
+  {
+    type: "function",
+    name: "configNonces",
+    stateMutability: "view",
+    inputs: [{ name: "account", type: "address" }],
+    outputs: [{ name: "", type: "uint256" }]
+  },
+  {
+    type: "function",
+    name: "configuredEpoch",
+    stateMutability: "view",
+    inputs: [{ name: "account", type: "address" }],
+    outputs: [{ name: "", type: "uint256" }]
+  },
+  {
+    type: "function",
+    name: "hashTypedDataV4",
+    stateMutability: "view",
+    inputs: [{ name: "structHash", type: "bytes32" }],
+    outputs: [{ name: "", type: "bytes32" }]
+  }
+];
+
 // ../sdk/dist/safe.js
 init_esm2();
 var setManagerAbi = [
@@ -37811,38 +38129,43 @@ async function discoverSafesForOwner(owner2, chainId) {
 }
 
 // ../sdk/dist/fees.js
-function min(a, b) {
-  return a < b ? a : b;
+init_esm2();
+async function readPermissionRegistrationFee(publicClient, governance) {
+  return publicClient.readContract({
+    address: governance,
+    abi: SailGovernanceAbi,
+    functionName: "permissionRegistrationFee"
+  });
 }
-async function estimatePermissionFee(publicClient, governance, permission) {
-  try {
-    const [baseFee, complexityRate, cap, code] = await Promise.all([
-      publicClient.readContract({
-        address: governance,
-        abi: SailGovernanceAbi,
-        functionName: "baseFee"
-      }),
-      publicClient.readContract({
-        address: governance,
-        abi: SailGovernanceAbi,
-        functionName: "complexityRate"
-      }),
-      publicClient.readContract({
-        address: governance,
-        abi: SailGovernanceAbi,
-        functionName: "MAX_PERMISSION_FEE_WEI"
-      }),
-      publicClient.getBytecode({ address: permission })
-    ]);
-    const byteLength = code ? BigInt((code.length - 2) / 2) : 0n;
-    const fee = min(baseFee, cap) + min(byteLength * complexityRate, cap);
-    return min(fee, cap);
-  } catch {
-    return publicClient.readContract({
-      address: governance,
-      abi: SailGovernanceAbi,
-      functionName: "permissionRegistrationFee"
-    });
+async function estimateMandateRegistrationFee(publicClient, governance, permissions) {
+  const flatFeeWei = await readPermissionRegistrationFee(publicClient, governance);
+  const perPermission = permissions.map((permission) => ({ permission, feeWei: flatFeeWei }));
+  const totalWei = flatFeeWei * BigInt(permissions.length);
+  return { totalWei, perPermission };
+}
+function describeMandateFee(estimate) {
+  const count = estimate.perPermission.length;
+  if (count === 0)
+    return "Registration fee: 0 ETH (no new permissions to register)";
+  const noun = count === 1 ? "permission" : "permissions";
+  const perFeeWei = estimate.perPermission[0].feeWei;
+  return `Registration fee: ${formatEther(estimate.totalWei)} ETH (${count} ${noun} \xD7 ${formatEther(perFeeWei)} ETH)`;
+}
+var RegistrationFeeError = class extends Error {
+  /** Total fee required (wei). */
+  requiredWei;
+  /** Signer balance available (wei). */
+  balanceWei;
+  constructor(message, requiredWei, balanceWei) {
+    super(message);
+    this.name = "RegistrationFeeError";
+    this.requiredWei = requiredWei;
+    this.balanceWei = balanceWei;
+  }
+};
+function assertFeeAffordable(balanceWei, totalFeeWei) {
+  if (balanceWei < totalFeeWei) {
+    throw new RegistrationFeeError(`Insufficient ETH for the ${formatEther(totalFeeWei)} ETH registration fee; signer balance is ${formatEther(balanceWei)} ETH.`, totalFeeWei, balanceWei);
   }
 }
 
@@ -37853,6 +38176,9 @@ var SAIL_INTELLIGENCE_DOCS_URL = "https://api.sail.money/docs";
 // src/commands/account.ts
 init_esm2();
 
+// src/lib/chain.ts
+init_esm2();
+
 // ../../node_modules/.pnpm/viem@2.51.3_bufferutil@4.1.0_typescript@5.9.3_utf-8-validate@5.0.10_zod@4.4.3/node_modules/viem/_esm/op-stack/contracts.js
 var contracts = {
   gasPriceOracle: { address: "0x420000000000000000000000000000000000000F" },
@@ -38124,6 +38450,35 @@ var baseSepoliaPreconf = /* @__PURE__ */ defineChain({
   }
 });
 
+// ../../node_modules/.pnpm/viem@2.51.3_bufferutil@4.1.0_typescript@5.9.3_utf-8-validate@5.0.10_zod@4.4.3/node_modules/viem/_esm/chains/definitions/bsc.js
+init_defineChain();
+var bsc = /* @__PURE__ */ defineChain({
+  id: 56,
+  name: "BNB Smart Chain",
+  blockTime: 750,
+  nativeCurrency: {
+    decimals: 18,
+    name: "BNB",
+    symbol: "BNB"
+  },
+  rpcUrls: {
+    default: { http: ["https://56.rpc.thirdweb.com"] }
+  },
+  blockExplorers: {
+    default: {
+      name: "BscScan",
+      url: "https://bscscan.com",
+      apiUrl: "https://api.bscscan.com/api"
+    }
+  },
+  contracts: {
+    multicall3: {
+      address: "0xca11bde05977b3631167028862be2a173976ca11",
+      blockCreated: 15921452
+    }
+  }
+});
+
 // ../../node_modules/.pnpm/viem@2.51.3_bufferutil@4.1.0_typescript@5.9.3_utf-8-validate@5.0.10_zod@4.4.3/node_modules/viem/_esm/chains/definitions/mainnet.js
 init_defineChain();
 var mainnet = /* @__PURE__ */ defineChain({
@@ -38155,6 +38510,56 @@ var mainnet = /* @__PURE__ */ defineChain({
   }
 });
 
+// ../../node_modules/.pnpm/viem@2.51.3_bufferutil@4.1.0_typescript@5.9.3_utf-8-validate@5.0.10_zod@4.4.3/node_modules/viem/_esm/chains/definitions/optimism.js
+init_defineChain();
+var sourceId3 = 1;
+var optimism = /* @__PURE__ */ defineChain({
+  ...chainConfig,
+  id: 10,
+  name: "OP Mainnet",
+  nativeCurrency: { name: "Ether", symbol: "ETH", decimals: 18 },
+  rpcUrls: {
+    default: {
+      http: ["https://mainnet.optimism.io"]
+    }
+  },
+  blockExplorers: {
+    default: {
+      name: "Optimism Explorer",
+      url: "https://optimistic.etherscan.io",
+      apiUrl: "https://api-optimistic.etherscan.io/api"
+    }
+  },
+  contracts: {
+    ...chainConfig.contracts,
+    disputeGameFactory: {
+      [sourceId3]: {
+        address: "0xe5965Ab5962eDc7477C8520243A95517CD252fA9"
+      }
+    },
+    l2OutputOracle: {
+      [sourceId3]: {
+        address: "0xdfe97868233d1aa22e815a266982f2cf17685a27"
+      }
+    },
+    multicall3: {
+      address: "0xca11bde05977b3631167028862be2a173976ca11",
+      blockCreated: 4286263
+    },
+    portal: {
+      [sourceId3]: {
+        address: "0xbEb5Fc579115071764c7423A4f12eDde41f106Ed"
+      }
+    },
+    l1StandardBridge: {
+      [sourceId3]: {
+        address: "0x99C9fc46f92E8a1c0deC1b1747d010903E884bE1"
+      }
+    }
+  },
+  sourceId: sourceId3
+});
+
 // ../../node_modules/.pnpm/viem@2.51.3_bufferutil@4.1.0_typescript@5.9.3_utf-8-validate@5.0.10_zod@4.4.3/node_modules/viem/_esm/chains/definitions/sepolia.js
 init_defineChain();
 var sepolia = /* @__PURE__ */ defineChain({
@@ -38188,7 +38593,7 @@ var sepolia = /* @__PURE__ */ defineChain({
 
 // ../../node_modules/.pnpm/viem@2.51.3_bufferutil@4.1.0_typescript@5.9.3_utf-8-validate@5.0.10_zod@4.4.3/node_modules/viem/_esm/chains/definitions/unichain.js
 init_defineChain();
-var sourceId3 = 1;
+var sourceId4 = 1;
 var unichain = /* @__PURE__ */ defineChain({
   ...chainConfig,
   id: 130,
@@ -38214,22 +38619,77 @@ var unichain = /* @__PURE__ */ defineChain({
       blockCreated: 0
     },
     disputeGameFactory: {
-      [sourceId3]: {
+      [sourceId4]: {
         address: "0x2F12d621a16e2d3285929C9996f478508951dFe4"
       }
     },
     portal: {
-      [sourceId3]: {
+      [sourceId4]: {
         address: "0x0bd48f6B86a26D3a217d0Fa6FfE2B491B956A7a2"
       }
     },
     l1StandardBridge: {
-      [sourceId3]: {
+      [sourceId4]: {
         address: "0x81014F44b0a345033bB2b3B21C7a1A308B35fEeA"
       }
     }
   },
-  sourceId: sourceId3
+  sourceId: sourceId4
+});
+
+// ../../node_modules/.pnpm/viem@2.51.3_bufferutil@4.1.0_typescript@5.9.3_utf-8-validate@5.0.10_zod@4.4.3/node_modules/viem/_esm/chains/definitions/worldchain.js
+init_defineChain();
+var sourceId5 = 1;
+var worldchain = /* @__PURE__ */ defineChain({
+  ...chainConfig,
+  id: 480,
+  name: "World Chain",
+  network: "worldchain",
+  nativeCurrency: { name: "Ether", symbol: "ETH", decimals: 18 },
+  rpcUrls: {
+    default: { http: ["https://worldchain-mainnet.g.alchemy.com/public"] }
+  },
+  blockExplorers: {
+    default: {
+      name: "Worldscan",
+      url: "https://worldscan.org",
+      apiUrl: "https://api.worldscan.org/api"
+    },
+    blockscout: {
+      name: "Blockscout",
+      url: "https://worldchain-mainnet.explorer.alchemy.com",
+      apiUrl: "https://worldchain-mainnet.explorer.alchemy.com/api"
+    }
+  },
+  contracts: {
+    ...chainConfig.contracts,
+    multicall3: {
+      address: "0xca11bde05977b3631167028862be2a173976ca11",
+      blockCreated: 0
+    },
+    disputeGameFactory: {
+      [sourceId5]: {
+        address: "0x069c4c579671f8c120b1327a73217D01Ea2EC5ea"
+      }
+    },
+    l2OutputOracle: {
+      [sourceId5]: {
+        address: "0x19A6d1E9034596196295CF148509796978343c5D"
+      }
+    },
+    portal: {
+      [sourceId5]: {
+        address: "0xd5ec14a83B7d95BE1E2Ac12523e2dEE12Cbeea6C"
+      }
+    },
+    l1StandardBridge: {
+      [sourceId5]: {
+        address: "0x470458C91978D2d929704489Ad730DC3E3001113"
+      }
+    }
+  },
+  testnet: false,
+  sourceId: sourceId5
 });
 
 // src/lib/io.ts
@@ -38353,14 +38813,14 @@ function getRl() {
 function ask(query) {
   getRl();
   process.stdout.write(query);
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     const buffered = lineQueue.shift();
     if (buffered !== void 0) {
-      resolve3(buffered);
+      resolve4(buffered);
     } else if (inputClosed) {
-      resolve3("");
+      resolve4("");
     } else {
-      waiters.push(resolve3);
+      waiters.push(resolve4);
     }
   });
 }
@@ -38392,11 +38852,28 @@ async function promptHidden(question) {
 }
 
 // src/lib/chain.ts
+var hyperevm = defineChain({
+  id: 999,
+  name: "HyperEVM",
+  nativeCurrency: { name: "HYPE", symbol: "HYPE", decimals: 18 },
+  rpcUrls: { default: { http: ["https://rpc.hyperliquid.xyz/evm"] } }
+});
+var megaeth = defineChain({
+  id: 4326,
+  name: "MegaETH",
+  nativeCurrency: { name: "Ether", symbol: "ETH", decimals: 18 },
+  rpcUrls: { default: { http: ["https://carrot.megaeth.com/rpc"] } }
+});
 var CHAINS = {
   1: mainnet,
   8453: base,
   42161: arbitrum,
+  10: optimism,
   130: unichain,
+  56: bsc,
+  480: worldchain,
+  999: hyperevm,
+  4326: megaeth,
   84532: baseSepolia,
   11155111: sepolia
 };
@@ -38404,7 +38881,7 @@ function getChainById(chainId) {
   const chain2 = CHAINS[chainId];
   if (!chain2) {
     throw new Error(
-      `Unsupported chainId: ${chainId}. Supported: 1 (Ethereum), 8453 (Base), 42161 (Arbitrum), 130 (Unichain), 84532 (Base Sepolia), 11155111 (Eth Sepolia)`
+      `Unsupported chainId: ${chainId}. Supported: 1 (Ethereum), 8453 (Base), 42161 (Arbitrum), 10 (Optimism), 130 (Unichain), 56 (BSC), 480 (World Chain), 999 (HyperEVM), 4326 (MegaETH), 84532 (Base Sepolia), 11155111 (Eth Sepolia)`
     );
   }
   return chain2;
@@ -38534,11 +39011,11 @@ function isProcessAlive(pid) {
   }
 }
 function findFreePort(from14) {
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve4, reject) => {
     const server = import_node_net.default.createServer();
     server.unref();
-    server.on("error", () => findFreePort(from14 + 1).then(resolve3, reject));
-    server.listen(from14, "127.0.0.1", () => server.close(() => resolve3(from14)));
+    server.on("error", () => findFreePort(from14 + 1).then(resolve4, reject));
+    server.listen(from14, "127.0.0.1", () => server.close(() => resolve4(from14)));
   });
 }
 
@@ -39152,8 +39629,9 @@ var SigningServer = class {
       }
     }
     if (!(0, import_node_fs6.existsSync)(this.runtimeDir)) (0, import_node_fs6.mkdirSync)(this.runtimeDir, { recursive: true });
+    const serverStatePath = (0, import_node_path4.join)(this.runtimeDir, SERVER_STATE_FILE);
     (0, import_node_fs6.writeFileSync)(
-      (0, import_node_path4.join)(this.runtimeDir, SERVER_STATE_FILE),
+      serverStatePath,
       JSON.stringify(
         {
           url: this._url,
@@ -39165,8 +39643,10 @@ var SigningServer = class {
         },
         null,
         2
-      )
+      ),
+      { mode: 384 }
     );
+    (0, import_node_fs6.chmodSync)(serverStatePath, 384);
   }
   removeRuntimeState() {
     const path11 = (0, import_node_path4.join)(this.runtimeDir, SERVER_STATE_FILE);
@@ -39295,7 +39775,7 @@ async function createSigningChannel(projectRoot = process.cwd()) {
 }
 
 // src/commands/account.ts
-var SAIL_MAINNET_CHAINS = [1, 8453, 42161, 130];
+var SAIL_MAINNET_CHAINS = [1, 8453, 42161, 10, 130, 56, 480, 999, 4326];
 async function fetchProxyCreationCode(preferredChainId) {
   const rpcUrl = getRpcUrl(preferredChainId) ?? void 0;
   const publicClient = createPublicClient({
@@ -40065,15 +40545,36 @@ var IPERMISSION_ABI = [
           { name: "selector", type: "bytes4" },
           { name: "value", type: "uint256" },
           { name: "blockTimestamp", type: "uint256" },
-          { name: "blockNumber", type: "uint256" }
+          { name: "blockNumber", type: "uint256" },
+          { name: "configEpoch", type: "uint256" }
         ]
       }
     ],
     outputs: [{ type: "bool" }]
   }
 ];
+var REGISTRATION_EPOCH_ABI2 = [
+  {
+    type: "function",
+    name: "registrationEpoch",
+    stateMutability: "view",
+    inputs: [
+      { name: "account", type: "address" },
+      { name: "permission", type: "address" }
+    ],
+    outputs: [{ type: "uint256" }]
+  }
+];
+async function readRegistrationEpoch(publicClient, kernel, account2, permission) {
+  return await publicClient.readContract({
+    address: kernel,
+    abi: REGISTRATION_EPOCH_ABI2,
+    functionName: "registrationEpoch",
+    args: [account2, permission]
+  });
+}
 function buildPermissionContext(params) {
-  const { account: account2, manager, call: call2, blockInfo } = params;
+  const { account: account2, manager, call: call2, blockInfo, configEpoch } = params;
   const selector = call2.data.length >= 10 ? call2.data.slice(0, 10) : "0x00000000";
   return {
     account: account2,
@@ -40084,12 +40585,23 @@ function buildPermissionContext(params) {
     selector,
     value: call2.value,
     blockTimestamp: blockInfo.timestamp,
-    blockNumber: blockInfo.number
+    blockNumber: blockInfo.number,
+    configEpoch
   };
 }
 async function probePermissionForCall(params) {
-  const { publicClient, permission, account: account2, manager, call: call2, blockInfo } = params;
-  const ctx = buildPermissionContext({ account: account2, manager, call: call2, blockInfo });
+  const { publicClient, kernel, permission, account: account2, manager, call: call2, blockInfo } = params;
+  let configEpoch;
+  try {
+    configEpoch = await readRegistrationEpoch(publicClient, kernel, account2, permission);
+  } catch (err) {
+    return {
+      accepted: false,
+      reverted: true,
+      error: `could not read registrationEpoch from kernel ${kernel} (${err.message.split("\n")[0]})`
+    };
+  }
+  const ctx = buildPermissionContext({ account: account2, manager, call: call2, blockInfo, configEpoch });
   try {
     const accepted = await publicClient.readContract({
       address: permission,
@@ -40103,10 +40615,11 @@ async function probePermissionForCall(params) {
   }
 }
 async function resolvePermissionForCall(params) {
-  const { publicClient, account: account2, manager, call: call2, registeredPermissions, blockInfo } = params;
-  const ctx = buildPermissionContext({ account: account2, manager, call: call2, blockInfo });
+  const { publicClient, kernel, account: account2, manager, call: call2, registeredPermissions, blockInfo } = params;
   for (const permission of registeredPermissions) {
     try {
+      const configEpoch = await readRegistrationEpoch(publicClient, kernel, account2, permission);
+      const ctx = buildPermissionContext({ account: account2, manager, call: call2, blockInfo, configEpoch });
       const accepted = await publicClient.readContract({
         address: permission,
         abi: IPERMISSION_ABI,
@@ -40176,7 +40689,10 @@ async function probePassThrough(pc, permission, account2) {
           selector: PROBE_SELECTOR,
           value: 0n,
           blockTimestamp: 0n,
-          blockNumber: 0n
+          blockNumber: 0n,
+          // Pass-through probes only run on conjunctive kernels, which predate
+          // registrationEpoch — there is no live epoch to read, so probe with 0.
+          configEpoch: 0n
         }
       ]
     });
@@ -40352,7 +40868,7 @@ async function doctor(options = {}) {
   console.log(`Account: ${safe}`);
   if (stored?.saltNonce != null) {
     const saltNonce = BigInt(stored.saltNonce);
-    const MAINNET_CHAINS = [1, 8453, 42161, 130];
+    const MAINNET_CHAINS = [1, 8453, 42161, 10, 130, 56, 480, 999, 4326];
     try {
       const proxyCreationCode = await pc.readContract({
         address: SAFE_V141.proxyFactory,
@@ -40472,6 +40988,10 @@ struct Context {
     uint256 value;          // native ETH forwarded (wei)
     uint256 blockTimestamp; // block.timestamp at dispatch
     uint256 blockNumber;    // block.number at dispatch
+    uint256 configEpoch;    // kernel registrationEpoch(account, permission) at dispatch;
+                            // configurable permissions fail closed on a mismatch with the
+                            // epoch stamped at configure() time. Custom permissions that
+                            // take no post-deploy configuration can ignore it.
 }
 
 /// @title  IPermission
@@ -40507,6 +41027,8 @@ struct BatchContext {
     bytes32 batchHash;      // keccak256(abi.encode(calls)) \u2014 stable id for the exact sequence
     uint256 blockTimestamp; // block.timestamp at dispatch
     uint256 blockNumber;    // block.number at dispatch
+    uint256 configEpoch;    // kernel registrationEpoch(account, permission) at dispatch \u2014
+                            // same fail-closed freshness check as Context.configEpoch
 }
 
 /// @title  IBatchPermission
@@ -40672,19 +41194,16 @@ AI coding agents should read the project's \`AGENTS.md\` and this folder's \`con
 before changing strategy code or running commands that touch funds.
 `;
 var CANONICAL_PKG = "@sail.money/sailor";
-var DEV_PKG = "@dev.sail.money/sailor";
-function cliPackageInfo() {
+function cliVersion() {
+  const manifest = import_node_path8.default.join(packageRoot(), "package.json");
+  let version4;
   try {
-    const pkg = JSON.parse(
-      import_node_fs10.default.readFileSync(import_node_path8.default.join(packageRoot(), "package.json"), "utf-8")
-    );
-    return {
-      name: pkg.name ?? CANONICAL_PKG,
-      version: pkg.version ?? "0.0.0"
-    };
-  } catch {
-    return { name: CANONICAL_PKG, version: "0.0.0" };
+    version4 = JSON.parse(import_node_fs10.default.readFileSync(manifest, "utf-8")).version;
+  } catch (err) {
+    throw new Error(`Cannot read CLI package manifest at ${manifest}: ${err.message}`);
   }
+  if (!version4) throw new Error(`CLI package manifest at ${manifest} has no version`);
+  return version4;
 }
 function scaffoldProjectWorkspace(dest, name, options) {
   const chainId = options.chain ? (() => {
@@ -40811,30 +41330,12 @@ Pass --force to scaffold into it anyway (existing files with the same name are o
     }
   })() : null;
   copyDirSync(templateSrc, dest);
-  if (options.skills === false) {
-    import_node_fs10.default.rmSync(import_node_path8.default.join(dest, ".agents", "skills"), { recursive: true, force: true });
-  }
-  const pkgRoot = packageRoot();
-  const examplesPermSrc = import_node_path8.default.join(pkgRoot, "examples", "permissions");
-  if (import_node_fs10.default.existsSync(examplesPermSrc)) {
-    copyDirSync(examplesPermSrc, import_node_path8.default.join(dest, "examples", "permissions"));
-  }
-  const customMandateSrc = import_node_path8.default.join(pkgRoot, "examples", "custom-mandate");
-  if (import_node_fs10.default.existsSync(customMandateSrc)) {
-    copyDirSync(customMandateSrc, import_node_path8.default.join(dest, "examples", "custom-mandate"));
-  }
-  const permModelSrc = import_node_path8.default.join(pkgRoot, "docs", "PERMISSION_MODEL.md");
-  if (import_node_fs10.default.existsSync(permModelSrc)) {
-    import_node_fs10.default.mkdirSync(import_node_path8.default.join(dest, "docs"), { recursive: true });
-    writeIfMissing2(import_node_path8.default.join(dest, "docs", "PERMISSION_MODEL.md"), import_node_fs10.default.readFileSync(permModelSrc, "utf-8"));
-  }
   const pkgPath = import_node_path8.default.join(dest, "package.json");
   if (import_node_fs10.default.existsSync(pkgPath)) {
     const pkg = JSON.parse(import_node_fs10.default.readFileSync(pkgPath, "utf-8"));
     pkg.name = name;
     const devDeps = pkg.devDependencies ?? {};
-    const { name: cliName, version: cliVer } = cliPackageInfo();
-    devDeps[CANONICAL_PKG] = cliName === DEV_PKG ? `npm:${DEV_PKG}@^${cliVer}` : `^${cliVer}`;
+    devDeps[CANONICAL_PKG] = `^${cliVersion()}`;
     pkg.devDependencies = devDeps;
     import_node_fs10.default.writeFileSync(pkgPath, `${JSON.stringify(pkg, null, 2)}
 `);
@@ -40922,7 +41423,7 @@ function printWelcome(dest, name, inPlace, _hasRpc, freshInit = false) {
     console.log("Next:");
     console.log("  sailor ui start");
     console.log("  Connect your wallet and deploy your SMA in the browser.\n");
-    console.log('Or open this folder in your AI coding assistant and say: "continue"');
+    console.log('Or open this folder in your AI coding agent and say: "continue"');
     return;
   }
   if (state.kind === "C") {
@@ -40939,7 +41440,7 @@ function printWelcome(dest, name, inPlace, _hasRpc, freshInit = false) {
     console.log("  forge build");
     console.log(`  sailor mandate deploy --contract <Name> --attach --sma ${state.sma}
 `);
-    console.log('Or open this folder in your AI coding assistant and say: "continue"');
+    console.log('Or open this folder in your AI coding agent and say: "continue"');
     return;
   }
   if (state.kind === "D") {
@@ -40948,7 +41449,7 @@ function printWelcome(dest, name, inPlace, _hasRpc, freshInit = false) {
     console.log(`SMA: ${state.sma} on ${state.chain}`);
     console.log(`Permissions: ${state.permissionCount} registered
 `);
-    console.log('Open this folder in your AI coding assistant and say: "continue"');
+    console.log('Open this folder in your AI coding agent and say: "continue"');
     return;
   }
   if (!inPlace) console.log(`
@@ -41094,13 +41595,13 @@ Added (new in template):`);
 var import_node_fs12 = __toESM(require("node:fs"), 1);
 var import_node_path10 = __toESM(require("node:path"), 1);
 function readStdin() {
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve4, reject) => {
     let data = "";
     process.stdin.setEncoding("utf8");
     process.stdin.on("data", (c) => {
       data += c;
     });
-    process.stdin.on("end", () => resolve3(data));
+    process.stdin.on("end", () => resolve4(data));
     process.stdin.on("error", reject);
   });
 }
@@ -41408,6 +41909,22 @@ var MandateStore = class {
     this.write(data);
     return mandate2;
   }
+  /**
+   * Track a permission only if no record at its address exists yet, returning the
+   * record either way. Used by `mandate attach` for addresses that were never
+   * deployed from this project — e.g. a shared permission singleton the operator
+   * attaches by address. Without a store record, `recordAttachment` is a no-op and
+   * the permission stays invisible to `mandate prepare`/`sign`. Unlike `add`, this
+   * never overwrites an existing record (so richer deploy-time metadata such as
+   * `sourcePath` is preserved). For attach-only records, `txHash`/`deployedAt`
+   * reflect the registration/first-tracked moment, not an on-chain deployment.
+   */
+  ensureTracked(mandate2) {
+    const existing = this.read().mandates.find(
+      (m) => m.address.toLowerCase() === mandate2.address.toLowerCase()
+    );
+    return existing ?? this.add(mandate2);
+  }
   /** Update mutable metadata fields on a tracked mandate (name, sourcePath, artifactPath). */
   update(addressOrName, patch) {
     const data = this.read();
@@ -41441,6 +41958,21 @@ var MandateStore = class {
 
 // src/commands/onboard.ts
 init_esm2();
+
+// src/lib/registration-fee.ts
+function registrationGate(args) {
+  const { estimate, agentBalanceWei } = args;
+  if (agentBalanceWei !== void 0) {
+    assertFeeAffordable(agentBalanceWei, estimate.totalWei);
+  }
+  return {
+    totalFeeWei: estimate.totalWei,
+    permissionCount: estimate.perPermission.length,
+    disclosure: describeMandateFee(estimate)
+  };
+}
+
+// src/commands/onboard.ts
 async function onboard(options) {
   if (!ProjectContext.exists()) {
     emit(options.json, () => console.log('No Sailor project found. Run "sailor init" first.'), {
@@ -41819,6 +42351,17 @@ async function attachMandate(project, channel, publicClient, agentSigner, smaAdd
     hasDeadline: registerPermissionHasDeadline,
     deadline: registrationDeadline
   });
+  const feeEstimate = await estimateMandateRegistrationFee(
+    publicClient,
+    project.contracts.governance,
+    [templateAddress]
+  );
+  const fee = feeEstimate.totalWei;
+  const agentBalanceWei = await publicClient.getBalance({
+    address: agentSigner.viemAccount.address
+  });
+  const gate = registrationGate({ estimate: feeEstimate, agentBalanceWei });
+  say(() => console.log(gate.disclosure));
   say(() => console.log(`
 Pushing signing request for "${template.label}" permission\u2026`));
   say(
@@ -41841,6 +42384,13 @@ Pushing signing request for "${template.label}" permission\u2026`));
       { label: "Mandate signer", value: permissionSigner }
     ],
     explanation: permExplanation,
+    // Disclose the fee in the signing card so the owner sees what the agent
+    // will pay before signing. Only included when non-zero or when there is a
+    // fee to disclose (zero-fee chains pass 0 ETH, still informative).
+    registrationFee: {
+      totalEth: formatEther(fee),
+      permissionCount: 1
+    },
     typedData
   });
   if (response.status === "rejected") {
@@ -41867,12 +42417,6 @@ Connect the owner wallet (mandate signer) in the browser \u2014 the agent wallet
   } catch (err) {
     if (err.message.startsWith("Security:")) throw err;
   }
-  say(() => console.log("Estimating permission fee\u2026"));
-  const fee = await estimatePermissionFee(
-    publicClient,
-    project.contracts.governance,
-    templateAddress
-  );
   say(() => console.log(`Submitting mandate registration (agent pays gas; fee ${fee} wei)\u2026`));
   const walletClient = createWalletClient({
     account: agentSigner.viemAccount,
@@ -41922,7 +42466,10 @@ Connect the owner wallet (mandate signer) in the browser \u2014 the agent wallet
     name: template.label,
     sma: smaAddress,
     txHash,
-    chainId: project.chainId
+    chainId: project.chainId,
+    // Registration fee actually paid by the agent for this permission.
+    fee: fee.toString(),
+    feeEth: formatEther(fee)
   });
   return txHash;
 }
@@ -42024,6 +42571,14 @@ function publicClientFor(project) {
     transport: http(getRpcUrl(project.chainId))
   }).extend(publicActions);
 }
+function knownTemplateLabel(chainId, address) {
+  try {
+    const known = getSailDeployment(chainId).knownTemplates ?? [];
+    return known.find((t) => t.address.toLowerCase() === address.toLowerCase())?.label;
+  } catch {
+    return void 0;
+  }
+}
 async function mandateDeploy(options) {
   const project = requireProject();
   const channel = await createSigningChannel(process.cwd());
@@ -42339,6 +42894,7 @@ ${spec.label} clone (${options.template})`);
     hasDeadline: registerPermissionHasDeadline,
     deadline
   });
+  const fee = await readPermissionRegistrationFee(publicClient, project.contracts.governance);
   const label = options.label ?? `${spec.label} (${options.template})`;
   say(
     () => console.log(
@@ -42358,6 +42914,10 @@ ${spec.label} clone (${options.template})`);
       { label: "Mandate signer", value: permissionSigner },
       ...spec.describe(initParams)
     ],
+    registrationFee: {
+      totalEth: formatEther(fee),
+      permissionCount: 1
+    },
     typedData
   });
   if (response.status === "rejected") {
@@ -42384,7 +42944,6 @@ Connect the owner wallet (mandate signer) in the browser \u2014 the agent wallet
   } catch (err) {
     if (err.message.startsWith("Security:")) throw err;
   }
-  const fee = await estimatePermissionFee(publicClient, project.contracts.governance, clone);
   if (!registerPermissionHasDeadline || deadline === void 0) {
     throw new Error(
       "deploy-clone requires a selective kernel (RegisterPermission with deadline). This chain's kernel does not match."
@@ -42437,7 +42996,10 @@ Connect the owner wallet (mandate signer) in the browser \u2014 the agent wallet
     name: storedClone.name,
     sma,
     txHash,
-    chainId: project.chainId
+    chainId: project.chainId,
+    // Registration fee actually paid by the agent for this permission.
+    fee: fee.toString(),
+    feeEth: formatEther(fee)
   });
   emit(json, () => {
   }, {
@@ -42486,7 +43048,14 @@ async function runAttach(project, channel, options) {
     label,
     json
   );
-  if (tracked) store.recordAttachment(mandateAddress, { sma, txHash });
+  store.ensureTracked({
+    name: label,
+    address: mandateAddress,
+    txHash,
+    chainId: project.chainId,
+    deployedAt: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  store.recordAttachment(mandateAddress, { sma, txHash });
   emit(json, () => {
   }, {
     status: "ok",
@@ -42500,7 +43069,14 @@ async function runAttachBatch(project, channel, options, sma, store) {
   announceSigningUrl(json);
   const txHash = await attachBatchToSma(project, channel, publicClient, sma, permissions, json);
   for (const permission of permissions) {
-    if (store.find(permission)) store.recordAttachment(permission, { sma, txHash });
+    store.ensureTracked({
+      name: knownTemplateLabel(project.chainId, permission) ?? permission,
+      address: permission,
+      txHash,
+      chainId: project.chainId,
+      deployedAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    store.recordAttachment(permission, { sma, txHash });
   }
   emit(json, () => {
   }, {
@@ -42756,6 +43332,8 @@ Attaching ${permissions.length} permissions in one signature \u2014 the mandate
       explanation: (rec ? explainPermission(rec.name, rec.sourcePath) : null) ?? void 0
     };
   });
+  const flatFee = await readPermissionRegistrationFee(publicClient, project.contracts.governance);
+  const fee = flatFee * BigInt(permissions.length);
   const response = await channel.requestSignature({
     type: "typed-data",
     kind: "register-permission",
@@ -42768,6 +43346,11 @@ Attaching ${permissions.length} permissions in one signature \u2014 the mandate
       { label: "Mandate signer", value: permissionSigner }
     ],
     permissions: permExplanations,
+    registrationFee: {
+      totalEth: formatEther(fee),
+      permissionCount: permissions.length,
+      ...permissions.length > 1 ? { perPermissionEth: formatEther(flatFee) } : {}
+    },
     typedData
   });
   if (response.status === "rejected") {
@@ -42776,10 +43359,6 @@ Attaching ${permissions.length} permissions in one signature \u2014 the mandate
   if (response.status !== "signature") {
     throw new Error(`Expected an EIP-712 signature response, got: ${response.status}`);
   }
-  let fee = 0n;
-  for (const permission of permissions) {
-    fee += await estimatePermissionFee(publicClient, project.contracts.governance, permission);
-  }
   const chain2 = getChainById(project.chainId);
   const walletClient = createWalletClient({
     account: agentSigner.viemAccount,
@@ -42812,7 +43391,10 @@ Attaching ${permissions.length} permissions in one signature \u2014 the mandate
       permission,
       sma,
       txHash,
-      chainId: project.chainId
+      chainId: project.chainId,
+      // Each permission in the batch is charged the same flat fee.
+      fee: flatFee.toString(),
+      feeEth: formatEther(flatFee)
     });
     say(() => {
       if (!present) {
@@ -43024,6 +43606,35 @@ function runForgeBuild() {
 
 // src/commands/mandate.ts
 init_esm2();
+function chargeablePermissions(tracked) {
+  return tracked.filter((p) => !p.revokedOnChain && !p.registeredOnSma);
+}
+async function liveMandateFee(chainId, permissionAddresses) {
+  if (permissionAddresses.length === 0) return { totalWei: 0n, perPermission: [] };
+  try {
+    const deployment = getSailDeployment(chainId);
+    const rpcUrl = getRpcUrl(chainId) ?? getChainById(chainId).rpcUrls.default.http[0];
+    const pc = createPublicClient({ chain: getChainById(chainId), transport: http(rpcUrl) });
+    return await estimateMandateRegistrationFee(
+      pc,
+      deployment.governance,
+      permissionAddresses
+    );
+  } catch {
+    return null;
+  }
+}
+function draftFeeFromEstimate(estimate) {
+  const perFeeWei = estimate.perPermission[0]?.feeWei ?? 0n;
+  return {
+    perPermissionWei: perFeeWei.toString(),
+    perPermissionEth: formatEther(perFeeWei),
+    totalWei: estimate.totalWei.toString(),
+    totalEth: formatEther(estimate.totalWei),
+    permissionCount: estimate.perPermission.length,
+    disclosure: describeMandateFee(estimate)
+  };
+}
 function resolveActiveChain(account2) {
   try {
     const project = new ProjectContext();
@@ -43061,14 +43672,37 @@ async function trackedPermissionsFor(account2, chainId, kernel) {
     };
   });
   const onChain = kernel ? await fetchOnChainPermissions(account2.safe, chainId, kernel) : null;
-  if (onChain !== null) {
-    for (const p of local) {
-      if (p.registeredOnSma && !onChain.has(p.address.toLowerCase())) {
-        p.revokedOnChain = true;
-      }
+  if (onChain === null) return local;
+  return mergeOnChainPermissions(local, onChain, knownTemplateLabeler(chainId));
+}
+function mergeOnChainPermissions(local, onChain, labelFor = () => void 0) {
+  for (const p of local) {
+    if (p.registeredOnSma && !onChain.has(p.address.toLowerCase())) {
+      p.revokedOnChain = true;
+    }
+  }
+  const localAddrs = new Set(local.map((p) => p.address.toLowerCase()));
+  const extra = [];
+  for (const addr of onChain) {
+    if (!localAddrs.has(addr)) {
+      extra.push({
+        address: addr,
+        label: labelFor(addr) ?? `permission ${addr.slice(0, 10)}\u2026`,
+        registeredOnSma: true
+      });
+    }
+  }
+  return [...local, ...extra];
+}
+function knownTemplateLabeler(chainId) {
+  const map = /* @__PURE__ */ new Map();
+  try {
+    for (const t of getSailDeployment(chainId).knownTemplates ?? []) {
+      map.set(t.address.toLowerCase(), t.label);
     }
+  } catch {
   }
-  return local;
+  return (addr) => map.get(addr.toLowerCase());
 }
 function printNoPermissionsGuidance() {
   console.log(
@@ -43096,19 +43730,28 @@ ${permissions.length} permission(s) tracked for SMA ${account2.safe}:
     console.log(`    ${status2}`);
   }
   const store = new MandateStore();
+  const chargeable = chargeablePermissions(permissions);
+  const draftPermissions = chargeable.map((p) => {
+    const mandate2 = store.find(p.address);
+    const explanation = explainPermission(p.label, mandate2?.sourcePath) ?? void 0;
+    return { address: p.address, label: p.label, explanation };
+  });
+  let registrationFee;
+  const unregisteredAddresses = chargeable.map((p) => p.address);
+  if (unregisteredAddresses.length > 0) {
+    const estimate = await liveMandateFee(chainId, unregisteredAddresses);
+    if (estimate !== null) registrationFee = draftFeeFromEstimate(estimate);
+  }
   const draft = {
     account: account2.safe,
     chainId,
-    // Only permissions not already registered on this SMA belong in the signing
-    // draft — re-registering an already-registered permission reverts on-chain.
-    permissions: permissions.filter((p) => !p.revokedOnChain && !p.registeredOnSma).map((p) => {
-      const mandate2 = store.find(p.address);
-      const explanation = explainPermission(p.label, mandate2?.sourcePath) ?? void 0;
-      return { address: p.address, label: p.label, explanation };
-    }),
-    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+    permissions: draftPermissions,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+    ...registrationFee ? { registrationFee } : {}
   };
   writeJsonFile(sailPath("mandate-draft.json"), draft);
+  if (registrationFee) console.log(`
+${registrationFee.disclosure}`);
   console.log("\nDraft written to .sail/mandate-draft.json for the UI to display.");
 }
 async function mandateSign(opts = {}) {
@@ -43135,6 +43778,15 @@ Permissions tracked for SMA ${account2.safe}:
     "\nNote: `sailor mandate sign` reviews and confirms the permissions attached to your SMA.\nOn-chain registration happens via `sailor mandate attach` (or `sailor mandate deploy --attach`)."
   );
   const activePermissions = permissions.filter((p) => !p.revokedOnChain);
+  const unregistered = chargeablePermissions(permissions);
+  if (unregistered.length > 0) {
+    const estimate = await liveMandateFee(chainId, unregistered.map((p) => p.address));
+    if (estimate !== null) {
+      console.log(`
+${describeMandateFee(estimate)}`);
+      console.log("  Paid by the agent wallet on registration, per permission.");
+    }
+  }
   const proceed = opts.yes || await confirm(
     `Confirm these ${activePermissions.length} permission(s) are authorized for your SMA?`
   );
@@ -43142,7 +43794,6 @@ Permissions tracked for SMA ${account2.safe}:
     console.log("No permissions confirmed.");
     return;
   }
-  const unregistered = activePermissions.filter((p) => !p.registeredOnSma);
   if (unregistered.length === 0) {
     console.log(`
 \u2713 Confirmed ${activePermissions.length} permission(s) for ${account2.safe}.`);
@@ -43173,8 +43824,451 @@ ${unregistered.length} permission(s) are not yet registered on this SMA. Initiat
 \u2713 Saved to .sail/mandate.json \u2014 agent is ready to run.`);
 }
 
-// src/commands/mandate-simulate.ts
+// src/commands/mandate-configure.ts
 var import_node_fs15 = require("node:fs");
+var import_node_path13 = require("node:path");
+
+// ../sdk/dist/templates/boundedSwap.js
+init_esm2();
+var ABI = [
+  { name: "routers", type: "address[]" },
+  { name: "tokensIn", type: "address[]" },
+  { name: "tokensOut", type: "address[]" },
+  { name: "maxAmountPerTx", type: "uint256" },
+  { name: "maxSlippageBps", type: "uint256" },
+  { name: "priceOracle", type: "address" },
+  { name: "maxPriceAgeSec", type: "uint256" }
+];
+var ZERO_ADDRESS = "0x0000000000000000000000000000000000000000";
+var boundedSwapTemplate = {
+  name: "SharedBoundedSwapPermission",
+  address: "0x0000000000000000000000000000000000000000",
+  encoder: {
+    encode(params) {
+      return encodeAbiParameters(ABI, [
+        params.routers,
+        params.tokensIn,
+        params.tokensOut,
+        params.maxAmountPerTx,
+        BigInt(params.maxSlippageBps),
+        params.priceOracle,
+        BigInt(params.maxPriceAgeSec)
+      ]);
+    },
+    decode(data) {
+      const decoded = decodeAbiParameters(ABI, data);
+      return {
+        routers: [...decoded[0]],
+        tokensIn: [...decoded[1]],
+        tokensOut: [...decoded[2]],
+        maxAmountPerTx: decoded[3],
+        maxSlippageBps: Number(decoded[4]),
+        priceOracle: decoded[5],
+        maxPriceAgeSec: Number(decoded[6])
+      };
+    }
+  },
+  explainer: {
+    explain(params) {
+      const warnings = [];
+      if (params.maxSlippageBps > 100) {
+        warnings.push(`High slippage tolerance: ${params.maxSlippageBps / 100}%`);
+      }
+      if (params.priceOracle === ZERO_ADDRESS) {
+        warnings.push("No price oracle configured \u2014 swaps are not checked against a reference price");
+      }
+      return {
+        templateName: "SharedBoundedSwapPermission",
+        humanReadable: [
+          `Maximum input per swap: ${params.maxAmountPerTx.toString()} (input-token base units)`,
+          `Maximum slippage: ${params.maxSlippageBps / 100}%`,
+          `Allowed routers: ${params.routers.join(", ")}`,
+          `Allowed input tokens: ${params.tokensIn.join(", ")}`,
+          `Allowed output tokens: ${params.tokensOut.join(", ")}`,
+          params.priceOracle === ZERO_ADDRESS ? "Price oracle: none" : `Price oracle: ${params.priceOracle} (max age ${params.maxPriceAgeSec}s)`
+        ],
+        warnings
+      };
+    }
+  }
+};
+
+// src/commands/mandate-configure.ts
+init_esm2();
+var TEMPLATE_REGISTRY = {
+  SwapPermission: {
+    label: "Bounded Swap (Uniswap V3)",
+    bigintFields: ["maxAmountPerTx"],
+    encode: (raw) => boundedSwapTemplate.encoder.encode(coerceSwapParams(raw)),
+    decode: (blob) => {
+      const p = boundedSwapTemplate.encoder.decode(blob);
+      return {
+        routers: p.routers,
+        tokensIn: p.tokensIn,
+        tokensOut: p.tokensOut,
+        maxAmountPerTx: p.maxAmountPerTx.toString(),
+        maxSlippageBps: p.maxSlippageBps,
+        priceOracle: p.priceOracle,
+        maxPriceAgeSec: p.maxPriceAgeSec
+      };
+    }
+  }
+};
+function asAddressArray(v, field) {
+  if (!Array.isArray(v)) throw new Error(`${field}: expected an array of addresses`);
+  return v.map((x, i) => {
+    if (typeof x !== "string" || !isAddress(x, { strict: false })) {
+      throw new Error(`${field}[${i}]: invalid address "${String(x)}"`);
+    }
+    return getAddress(x);
+  });
+}
+function asAddress(v, field) {
+  if (typeof v !== "string" || !isAddress(v, { strict: false })) {
+    throw new Error(`${field}: invalid address "${String(v)}"`);
+  }
+  return getAddress(v);
+}
+function asUint(v, field) {
+  if (v === void 0 || v === null) throw new Error(`${field}: missing`);
+  try {
+    return BigInt(typeof v === "string" || typeof v === "number" ? v : String(v));
+  } catch {
+    throw new Error(`${field}: expected an integer, got "${String(v)}"`);
+  }
+}
+function asInt(v, field) {
+  const n = asUint(v, field);
+  return Number(n);
+}
+function coerceSwapParams(raw) {
+  return {
+    routers: asAddressArray(raw.routers, "routers"),
+    tokensIn: asAddressArray(raw.tokensIn, "tokensIn"),
+    tokensOut: asAddressArray(raw.tokensOut, "tokensOut"),
+    maxAmountPerTx: asUint(raw.maxAmountPerTx, "maxAmountPerTx"),
+    maxSlippageBps: asInt(raw.maxSlippageBps, "maxSlippageBps"),
+    priceOracle: asAddress(raw.priceOracle, "priceOracle"),
+    maxPriceAgeSec: asInt(raw.maxPriceAgeSec, "maxPriceAgeSec")
+  };
+}
+function requireProject2() {
+  if (!ProjectContext.exists()) {
+    console.log('No Sailor project found. Run "sailor init" first.');
+    process.exit(1);
+  }
+  return new ProjectContext();
+}
+function fail2(err, json = false) {
+  const msg = err instanceof Error ? err.message : String(err);
+  emit(json, () => console.error(`
+Mandate configure failed: ${msg}`), {
+    status: "error",
+    error: msg
+  });
+  process.exit(1);
+}
+function publicClientFor2(project) {
+  return createPublicClient({
+    chain: getChainById(project.chainId),
+    transport: http(getRpcUrl(project.chainId))
+  }).extend(publicActions);
+}
+function announceSigningUrl2(json) {
+  const url = signingPageUrl(projectPort(process.cwd()));
+  if (json) {
+    process.stdout.write(`${JSON.stringify({ status: "waiting_for_signature", url })}
+`);
+  } else {
+    console.log(`
+\u2192 Open the Sailor dashboard to approve signing requests:
+  ${url}
+`);
+  }
+}
+function resolveBlob(options) {
+  const hasParams = options.params !== void 0;
+  const hasArgsFile = options.argsFile !== void 0;
+  if (hasParams && hasArgsFile) {
+    throw new Error("Provide EITHER --params <hex> OR --args-file <path>, not both.");
+  }
+  if (!hasParams && !hasArgsFile) {
+    throw new Error(
+      "Provide the config blob as --params <0x-hex>, or as --args-file <path> paired with --template <Name>."
+    );
+  }
+  if (hasParams) {
+    const raw2 = options.params.trim();
+    if (!isHex(raw2) || raw2.length <= 2) {
+      throw new Error(`--params must be 0x-prefixed hex; got "${options.params}".`);
+    }
+    return { blob: raw2, via: "params" };
+  }
+  const templateName = options.template;
+  if (!templateName) {
+    throw new Error("--args-file requires --template <Name> (e.g. SwapPermission).");
+  }
+  const entry = TEMPLATE_REGISTRY[templateName];
+  if (!entry) {
+    throw new Error(
+      `Unknown --template "${templateName}". Known: ${Object.keys(TEMPLATE_REGISTRY).join(", ")}. Pass a pre-encoded blob with --params for any other template.`
+    );
+  }
+  const argsFilePath = (0, import_node_path13.resolve)(options.argsFile);
+  let raw;
+  try {
+    raw = (0, import_node_fs15.readFileSync)(argsFilePath, "utf8").trim();
+  } catch {
+    throw new Error(`Cannot read --args-file: ${argsFilePath}`);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new Error(`--args-file is not valid JSON: ${err.message}`);
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("--args-file must contain a JSON object of template params.");
+  }
+  const blob = entry.encode(parsed);
+  return { blob, via: `template:${templateName}` };
+}
+async function mandateConfigure(options) {
+  const project = requireProject2();
+  const channel = await createSigningChannel(process.cwd());
+  try {
+    await channel.start();
+    await runConfigure(project, channel, options);
+  } catch (err) {
+    fail2(err, options.json);
+  } finally {
+    channel.stop();
+  }
+}
+async function runConfigure(project, channel, options) {
+  const json = !!options.json;
+  const say = (fn) => {
+    if (!json) fn();
+  };
+  if (!isAddress(options.sma, { strict: false })) {
+    throw new Error(`Invalid --sma address: ${options.sma}`);
+  }
+  if (!isAddress(options.address, { strict: false })) {
+    throw new Error(
+      `--address must be a deployed shared-template singleton address: ${options.address}`
+    );
+  }
+  const sma = getAddress(options.sma);
+  const singleton = getAddress(options.address);
+  const { blob, via } = resolveBlob(options);
+  const publicClient = publicClientFor2(project);
+  const registered = await publicClient.readContract({
+    address: project.contracts.kernel,
+    abi: SailKernelAbi,
+    functionName: "registered",
+    args: [sma]
+  });
+  if (!registered) {
+    throw new Error(`SMA ${sma} is not registered with SailKernel; cannot configure a permission for it.`);
+  }
+  const kernelConfig = await publicClient.readContract({
+    address: project.contracts.kernel,
+    abi: SailKernelAbi,
+    functionName: "configs",
+    args: [sma]
+  });
+  const permissionSigner = kernelConfig[0];
+  if (!permissionSigner || permissionSigner === getAddress("0x0000000000000000000000000000000000000000")) {
+    throw new Error(`SMA ${sma} has no on-chain permissionSigner; cannot configure.`);
+  }
+  const alreadyConfigured = await publicClient.readContract({
+    address: singleton,
+    abi: ConfigurablePermissionAbi,
+    functionName: "isConfigured",
+    args: [sma]
+  });
+  if (alreadyConfigured && !options.force) {
+    say(
+      () => console.log(
+        `
+\u2713 ${singleton} is already configured for ${sma} (isConfigured == true).
+  Re-run with --force to overwrite the current bounds.`
+      )
+    );
+    emit(
+      json,
+      () => {
+      },
+      { status: "ok", alreadyConfigured: true, singleton, sma, chainId: project.chainId }
+    );
+    return;
+  }
+  const nonce = await publicClient.readContract({
+    address: singleton,
+    abi: ConfigurablePermissionAbi,
+    functionName: "configNonces",
+    args: [sma]
+  });
+  say(() => {
+    console.log(`
+configure ${singleton}`);
+    console.log(`  SMA:              ${sma}`);
+    console.log(`  permissionSigner: ${permissionSigner}  (must sign in the browser \u2014 owner tx)`);
+    console.log(`  current nonce:   ${nonce}`);
+    console.log(`  already set:     ${alreadyConfigured ? "yes (--force will overwrite)" : "no"}`);
+    console.log(`  config blob:     ${blob}  (via ${via}, ${Math.floor((blob.length - 2) / 2)} bytes)`);
+  });
+  const configureDirectData = encodeFunctionData({
+    abi: ConfigurablePermissionAbi,
+    functionName: "configureDirect",
+    args: [sma, blob]
+  });
+  say(() => console.log(`
+Pre-flight (eth_call of configureDirect, no gas)\u2026`));
+  try {
+    await publicClient.simulateContract({
+      address: singleton,
+      abi: ConfigurablePermissionAbi,
+      functionName: "configureDirect",
+      args: [sma, blob],
+      account: permissionSigner
+    });
+  } catch (err) {
+    const ce = getContractError(err, {
+      abi: ConfigurablePermissionAbi,
+      address: singleton,
+      args: [sma, blob],
+      functionName: "configureDirect"
+    });
+    const reason = ce?.message ?? err?.message ?? String(err);
+    throw new Error(
+      `Pre-flight reverted \u2014 the config blob is invalid for ${singleton} on ${sma}.
+  Revert: ${reason}
+  This is the encoding gotcha (flat params vs wrapped struct) or an internal bound check. Re-encode per the template's _applyConfig tuple and retry.`
+    );
+  }
+  say(() => console.log("\u2713 pre-flight passed (configureDirect would succeed)."));
+  let decoded;
+  if (options.template && TEMPLATE_REGISTRY[options.template]) {
+    try {
+      decoded = TEMPLATE_REGISTRY[options.template].decode(blob);
+      say(() => {
+        console.log("\nDecoded bounds (what the singleton will store):");
+        for (const [k, v] of Object.entries(decoded)) {
+          const display = Array.isArray(v) ? v.join(", ") : String(v);
+          console.log(`  ${k}: ${display}`);
+        }
+      });
+    } catch {
+    }
+  }
+  if (options.simulateOnly) {
+    emit(
+      json,
+      () => {
+        console.log("\n--simulate-only: stopping after pre-flight (no signing, no gas).");
+      },
+      {
+        status: "ok",
+        simulateOnly: true,
+        singleton,
+        sma,
+        permissionSigner,
+        nonce: nonce.toString(),
+        alreadyConfigured,
+        blob,
+        blobBytes: Math.floor((blob.length - 2) / 2),
+        decoded,
+        chainId: project.chainId
+      }
+    );
+    return;
+  }
+  const label = options.label ?? (options.template ?? "shared-template");
+  announceSigningUrl2(json);
+  say(
+    () => console.log(
+      `Pushing configure request \u2014 the mandate signer (${permissionSigner}) must approve in the browser\u2026`
+    )
+  );
+  const response = await channel.requestSignature({
+    type: "transaction",
+    kind: "arbitrary-tx",
+    title: `Configure "${label}"`,
+    description: `Write per-account bounds on the shared permission ${singleton}.
+You (the mandate signer) send the transaction \u2014 configureDirect requires msg.sender to be the permissionSigner.`,
+    chainId: project.chainId,
+    to: singleton,
+    data: configureDirectData,
+    details: [
+      { label: "SMA", value: sma },
+      { label: "Singleton", value: singleton },
+      { label: "Template", value: options.template ?? "(raw blob)" },
+      { label: "Mandate signer", value: permissionSigner },
+      { label: "Config blob (bytes)", value: String(Math.floor((blob.length - 2) / 2)) },
+      ...decoded ? Object.entries(decoded).map(([k, v]) => ({
+        label: k,
+        value: Array.isArray(v) ? v.join(", ") : String(v)
+      })) : []
+    ]
+  });
+  if (response.status === "rejected") {
+    throw new Error(`User rejected configure: ${response.reason ?? "no reason given"}`);
+  }
+  if (response.status !== "signed") {
+    throw new Error(`Expected a signed transaction, got: ${response.status}`);
+  }
+  say(() => console.log("Waiting for confirmation\u2026"));
+  const receipt = await publicClient.waitForTransactionReceipt({ hash: response.txHash });
+  if (receipt.status !== "success") {
+    throw new Error(`configureDirect transaction failed (tx ${response.txHash})`);
+  }
+  const configuredNow = await publicClient.readContract({
+    address: singleton,
+    abi: ConfigurablePermissionAbi,
+    functionName: "isConfigured",
+    args: [sma]
+  });
+  if (!configuredNow) {
+    throw new Error(
+      `Tx ${response.txHash} mined, but isConfigured(${sma}) is still false. Verify on-chain.`
+    );
+  }
+  say(() => console.log("\u2713", `Configured ${singleton} for ${sma} (isConfigured == true).`));
+  appendActivity({
+    ts: nowIso(),
+    actor: "owner",
+    type: "permission_configured",
+    permission: singleton,
+    name: label,
+    sma,
+    txHash: response.txHash,
+    chainId: project.chainId
+  });
+  emit(
+    json,
+    () => {
+      console.log(
+        `
+Next: prove it accepts/rejects the right calls before dispatching:
+  sailor mandate simulate --address ${singleton} --sma ${sma} --calls ./probe.json`
+      );
+    },
+    {
+      status: "ok",
+      singleton,
+      sma,
+      template: options.template,
+      permissionSigner,
+      txHash: response.txHash,
+      blob,
+      chainId: project.chainId
+    }
+  );
+}
+
+// src/commands/mandate-simulate.ts
+var import_node_fs16 = require("node:fs");
 init_esm2();
 function parseExpect(raw, where) {
   if (raw === void 0) return void 0;
@@ -43190,7 +44284,7 @@ function resolveSampleCalls(options) {
   if (options.calls) {
     let raw;
     try {
-      raw = JSON.parse((0, import_node_fs15.readFileSync)(options.calls, "utf8"));
+      raw = JSON.parse((0, import_node_fs16.readFileSync)(options.calls, "utf8"));
     } catch (err) {
       throw new Error(`Could not read --calls file "${options.calls}": ${err.message}`);
     }
@@ -43294,6 +44388,7 @@ async function mandateSimulate(options) {
       const [probe, codeCheck] = await Promise.all([
         probePermissionForCall({
           publicClient: pc,
+          kernel: project.contracts.kernel,
           permission,
           account: account2,
           manager,
@@ -43406,7 +44501,7 @@ async function mandateSimulate(options) {
 }
 
 // src/commands/rotate-signer.ts
-var import_node_fs16 = require("node:fs");
+var import_node_fs17 = require("node:fs");
 init_esm2();
 var PENDING_REATTACH_FILE = ["state", "pending-reattach.json"];
 async function rotateSigner(options) {
@@ -43684,10 +44779,8 @@ Re-approving ${permissions.length} mandate(s) \u2014 the mandate signer (${permi
   if (response.status !== "signature") {
     throw new Error(`Expected an EIP-712 signature response, got: ${response.status}`);
   }
-  let fee = 0n;
-  for (const permission of permissions) {
-    fee += await estimatePermissionFee(publicClient, project.contracts.governance, permission);
-  }
+  const flatFee = await readPermissionRegistrationFee(publicClient, project.contracts.governance);
+  const fee = flatFee * BigInt(permissions.length);
   const agentSigner = await loadManagerSigner();
   const chain2 = getChainById(project.chainId);
   const walletClient = createWalletClient({
@@ -43794,7 +44887,7 @@ ensure the agent that signs dispatches holds this key.`
   const keystore = await keyring.exportKeystore(password);
   writeJsonFile(target, keystore, 384);
   const perManagerPath = managerKeystorePath(keyring.address);
-  (0, import_node_fs16.mkdirSync)(sailPath("keys", "managers"), { recursive: true });
+  (0, import_node_fs17.mkdirSync)(sailPath("keys", "managers"), { recursive: true });
   writeJsonFile(perManagerPath, keystore, 384);
   say(
     () => console.log(
@@ -43806,7 +44899,7 @@ ensure the agent that signs dispatches holds this key.`
 function promoteManagerKeystore(newManager, say) {
   const stored = readJsonFile(managerKeystorePath(newManager));
   if (!stored) return;
-  (0, import_node_fs16.mkdirSync)(sailPath("keys", "managers"), { recursive: true });
+  (0, import_node_fs17.mkdirSync)(sailPath("keys", "managers"), { recursive: true });
   const activeTarget = keyPath("manager");
   const displaced = readJsonFile(activeTarget);
   if (displaced?.address) {
@@ -43858,7 +44951,7 @@ function writePending(pending) {
 }
 function clearPending() {
   try {
-    (0, import_node_fs16.rmSync)(sailPath(...PENDING_REATTACH_FILE), { force: true });
+    (0, import_node_fs17.rmSync)(sailPath(...PENDING_REATTACH_FILE), { force: true });
   } catch {
   }
 }
@@ -43957,12 +45050,12 @@ function ownerShow(options) {
 }
 
 // src/commands/run.ts
-var import_node_fs17 = __toESM(require("node:fs"), 1);
-var import_node_path13 = __toESM(require("node:path"), 1);
+var import_node_fs18 = __toESM(require("node:fs"), 1);
+var import_node_path14 = __toESM(require("node:path"), 1);
 var import_node_url = require("node:url");
 init_esm2();
 var DEFAULT_INTERVAL_SEC = 60;
-var sleep2 = (ms) => new Promise((resolve3) => setTimeout(resolve3, ms));
+var sleep2 = (ms) => new Promise((resolve4) => setTimeout(resolve4, ms));
 var ERC20_READ_ABI = [
   {
     type: "function",
@@ -43992,7 +45085,7 @@ var ERC20_READ_ABI = [
 function loadAgentData(filePath) {
   if (!filePath) return {};
   try {
-    const parsed = JSON.parse(import_node_fs17.default.readFileSync(filePath, "utf-8"));
+    const parsed = JSON.parse(import_node_fs18.default.readFileSync(filePath, "utf-8"));
     return parsed && typeof parsed === "object" ? parsed : {};
   } catch {
     return {};
@@ -44001,8 +45094,8 @@ function loadAgentData(filePath) {
 async function loadAgent() {
   const candidates = ["src/agent.ts", "src/agent.js", "dist/agent.js", "dist/src/agent.js"];
   for (const rel of candidates) {
-    const abs = import_node_path13.default.join(process.cwd(), rel);
-    if (!import_node_fs17.default.existsSync(abs)) continue;
+    const abs = import_node_path14.default.join(process.cwd(), rel);
+    if (!import_node_fs18.default.existsSync(abs)) continue;
     let mod2;
     if (abs.endsWith(".ts")) {
       const { tsImport } = await import("tsx/esm/api");
@@ -44255,6 +45348,8 @@ Configure the chain in the SDK chain registry or set KERNEL_ADDRESS in .sail/.en
         } else {
           permission = await resolvePermissionForCall({
             publicClient,
+            kernel,
+            // narrowed: runCommand validates kernel before runTick runs
             account: accountAddr,
             manager: agentManager.address,
             call: firstCall,
@@ -44297,7 +45392,7 @@ Configure the chain in the SDK chain registry or set KERNEL_ADDRESS in .sail/.en
         if (isConjunctive && result.txHash) {
           try {
             await publicClient.waitForTransactionReceipt({ hash: result.txHash, timeout: 3e4 });
-            await new Promise((resolve3) => setTimeout(resolve3, 500));
+            await new Promise((resolve4) => setTimeout(resolve4, 500));
           } catch {
           }
         }
@@ -44430,7 +45525,7 @@ async function scan(options) {
           args: [address]
         })
       ]);
-      const [permissionSigner, manager, , sessionActive] = config;
+      const [permissionSigner, manager, , , sessionActive] = config;
       smas.push({ address, registered: true, manager, permissionSigner, sessionActive, mandates });
     } catch (err) {
       smas.push({
@@ -44478,9 +45573,9 @@ async function scan(options) {
 
 // src/commands/service.ts
 var import_node_child_process2 = require("node:child_process");
-var import_node_fs18 = __toESM(require("node:fs"), 1);
+var import_node_fs19 = __toESM(require("node:fs"), 1);
 var import_node_os = __toESM(require("node:os"), 1);
-var import_node_path14 = __toESM(require("node:path"), 1);
+var import_node_path15 = __toESM(require("node:path"), 1);
 function sanitizeName(raw) {
   const s = raw.toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "");
   return s || "agent";
@@ -44599,21 +45694,21 @@ function buildWindowsTaskXml(cfg) {
 `;
 }
 function isTccProtected(projectDir, home = import_node_os.default.homedir()) {
-  const rel = import_node_path14.default.relative(home, import_node_path14.default.resolve(projectDir));
-  if (rel.startsWith("..") || import_node_path14.default.isAbsolute(rel)) return false;
-  const top = rel.split(import_node_path14.default.sep)[0];
+  const rel = import_node_path15.default.relative(home, import_node_path15.default.resolve(projectDir));
+  if (rel.startsWith("..") || import_node_path15.default.isAbsolute(rel)) return false;
+  const top = rel.split(import_node_path15.default.sep)[0];
   return ["Desktop", "Documents", "Downloads"].includes(top ?? "");
 }
 function resolveCliEntry() {
   try {
-    return import_node_fs18.default.realpathSync(process.argv[1]);
+    return import_node_fs19.default.realpathSync(process.argv[1]);
   } catch {
-    return import_node_path14.default.resolve(process.argv[1]);
+    return import_node_path15.default.resolve(process.argv[1]);
   }
 }
 function resolveProjectDir(explicit) {
-  const dir = import_node_path14.default.resolve(explicit ?? process.cwd());
-  if (!import_node_fs18.default.existsSync(import_node_path14.default.join(dir, ".sail"))) {
+  const dir = import_node_path15.default.resolve(explicit ?? process.cwd());
+  if (!import_node_fs19.default.existsSync(import_node_path15.default.join(dir, ".sail"))) {
     throw new Error(
       `No .sail/ found in ${dir}.
 Run this from your Sailor project root, or pass --project <path>. (The installer does not search parent directories \u2014 that would risk targeting the wrong project.)`
@@ -44625,7 +45720,7 @@ function passphraseReadiness(projectDir) {
   const account2 = (() => {
     try {
       return JSON.parse(
-        import_node_fs18.default.readFileSync(import_node_path14.default.join(projectDir, ".sail", "account.json"), "utf-8")
+        import_node_fs19.default.readFileSync(import_node_path15.default.join(projectDir, ".sail", "account.json"), "utf-8")
       );
     } catch {
       return null;
@@ -44641,28 +45736,28 @@ function passphraseReadiness(projectDir) {
   } finally {
     process.chdir(prevCwd);
   }
-  const env = parseEnvFile(import_node_path14.default.join(projectDir, ".sail", ".env.local"));
+  const env = parseEnvFile(import_node_path15.default.join(projectDir, ".sail", ".env.local"));
   const passphraseInEnvFile = Boolean(env.SAIL_PASSPHRASE);
   return { keystorePresent, passphraseInEnvFile, ready: keystorePresent && passphraseInEnvFile };
 }
 function buildConfig(opts) {
   const projectDir = resolveProjectDir(opts.project);
   return {
-    projectName: sanitizeName(import_node_path14.default.basename(projectDir)),
+    projectName: sanitizeName(import_node_path15.default.basename(projectDir)),
     projectDir,
     nodePath: process.execPath,
     cliEntry: resolveCliEntry(),
-    logPath: import_node_path14.default.join(projectDir, ".sail", "agent.log"),
+    logPath: import_node_path15.default.join(projectDir, ".sail", "agent.log"),
     interval: opts.interval != null ? Number(opts.interval) : void 0,
     chain: opts.chain != null ? Number(opts.chain) : void 0,
     restartSec: 30
   };
 }
 function plistPath(projectName) {
-  return import_node_path14.default.join(import_node_os.default.homedir(), "Library", "LaunchAgents", `${launchdLabel(projectName)}.plist`);
+  return import_node_path15.default.join(import_node_os.default.homedir(), "Library", "LaunchAgents", `${launchdLabel(projectName)}.plist`);
 }
 function systemdPath(projectName) {
-  return import_node_path14.default.join(import_node_os.default.homedir(), ".config", "systemd", "user", systemdUnitName(projectName));
+  return import_node_path15.default.join(import_node_os.default.homedir(), ".config", "systemd", "user", systemdUnitName(projectName));
 }
 async function serviceInstall(opts = {}) {
   const cfg = buildConfig(opts);
@@ -44686,12 +45781,12 @@ Run "sailor keys generate" (and save the passphrase) or set it in .sail/.env.loc
     console.warn(`\u26A0 ${msg}
   Proceeding because --force was given.`);
   }
-  import_node_fs18.default.mkdirSync(import_node_path14.default.dirname(cfg.logPath), { recursive: true });
+  import_node_fs19.default.mkdirSync(import_node_path15.default.dirname(cfg.logPath), { recursive: true });
   if (platform === "darwin") {
     const plist = buildLaunchdPlist(cfg);
     const dest = plistPath(cfg.projectName);
-    import_node_fs18.default.mkdirSync(import_node_path14.default.dirname(dest), { recursive: true });
-    import_node_fs18.default.writeFileSync(dest, plist);
+    import_node_fs19.default.mkdirSync(import_node_path15.default.dirname(dest), { recursive: true });
+    import_node_fs19.default.writeFileSync(dest, plist);
     const uid2 = process.getuid?.() ?? 0;
     try {
       try {
@@ -44710,8 +45805,8 @@ Run "sailor keys generate" (and save the passphrase) or set it in .sail/.env.loc
   if (platform === "linux") {
     const unit = buildSystemdUnit(cfg);
     const dest = systemdPath(cfg.projectName);
-    import_node_fs18.default.mkdirSync(import_node_path14.default.dirname(dest), { recursive: true });
-    import_node_fs18.default.writeFileSync(dest, unit);
+    import_node_fs19.default.mkdirSync(import_node_path15.default.dirname(dest), { recursive: true });
+    import_node_fs19.default.writeFileSync(dest, unit);
     try {
       (0, import_node_child_process2.execFileSync)("systemctl", ["--user", "daemon-reload"], { stdio: "inherit" });
       (0, import_node_child_process2.execFileSync)("systemctl", ["--user", "enable", "--now", systemdUnitName(cfg.projectName)], {
@@ -44725,8 +45820,8 @@ Run "sailor keys generate" (and save the passphrase) or set it in .sail/.env.loc
   }
   if (platform === "win32") {
     const xml = buildWindowsTaskXml(cfg);
-    const dest = import_node_path14.default.join(import_node_os.default.tmpdir(), `${windowsTaskName(cfg.projectName)}.xml`);
-    import_node_fs18.default.writeFileSync(dest, xml, "utf-8");
+    const dest = import_node_path15.default.join(import_node_os.default.tmpdir(), `${windowsTaskName(cfg.projectName)}.xml`);
+    import_node_fs19.default.writeFileSync(dest, xml, "utf-8");
     try {
       (0, import_node_child_process2.execFileSync)(
         "schtasks",
@@ -44737,7 +45832,7 @@ Run "sailor keys generate" (and save the passphrase) or set it in .sail/.env.loc
       throw new Error(`schtasks /Create failed: ${err.message}`);
     } finally {
       try {
-        import_node_fs18.default.rmSync(dest, { force: true });
+        import_node_fs19.default.rmSync(dest, { force: true });
       } catch {
       }
     }
@@ -44763,14 +45858,14 @@ function okInstall(cfg, unit) {
   );
 }
 async function serviceStatus(opts = {}) {
-  const projectName = sanitizeName(import_node_path14.default.basename(resolveProjectDir(opts.project)));
+  const projectName = sanitizeName(import_node_path15.default.basename(resolveProjectDir(opts.project)));
   const platform = process.platform;
   let installed = false;
   let running = false;
   let detail = "";
   try {
     if (platform === "darwin") {
-      installed = import_node_fs18.default.existsSync(plistPath(projectName));
+      installed = import_node_fs19.default.existsSync(plistPath(projectName));
       const uid2 = process.getuid?.() ?? 0;
       try {
         detail = (0, import_node_child_process2.execFileSync)("launchctl", ["print", `gui/${uid2}/${launchdLabel(projectName)}`], {
@@ -44782,7 +45877,7 @@ async function serviceStatus(opts = {}) {
       } catch {
       }
     } else if (platform === "linux") {
-      installed = import_node_fs18.default.existsSync(systemdPath(projectName));
+      installed = import_node_fs19.default.existsSync(systemdPath(projectName));
       try {
         detail = (0, import_node_child_process2.execFileSync)("systemctl", ["--user", "is-active", systemdUnitName(projectName)], {
           encoding: "utf-8",
@@ -44818,7 +45913,7 @@ async function serviceStatus(opts = {}) {
   );
 }
 async function serviceStop(opts = {}) {
-  const projectName = sanitizeName(import_node_path14.default.basename(resolveProjectDir(opts.project)));
+  const projectName = sanitizeName(import_node_path15.default.basename(resolveProjectDir(opts.project)));
   const platform = process.platform;
   if (platform === "darwin") {
     const uid2 = process.getuid?.() ?? 0;
@@ -44837,7 +45932,7 @@ async function serviceStop(opts = {}) {
   });
 }
 async function serviceUninstall(opts = {}) {
-  const projectName = sanitizeName(import_node_path14.default.basename(resolveProjectDir(opts.project)));
+  const projectName = sanitizeName(import_node_path15.default.basename(resolveProjectDir(opts.project)));
   const platform = process.platform;
   if (platform === "darwin") {
     const uid2 = process.getuid?.() ?? 0;
@@ -44847,7 +45942,7 @@ async function serviceUninstall(opts = {}) {
       });
     } catch {
     }
-    import_node_fs18.default.rmSync(plistPath(projectName), { force: true });
+    import_node_fs19.default.rmSync(plistPath(projectName), { force: true });
   } else if (platform === "linux") {
     try {
       (0, import_node_child_process2.execFileSync)("systemctl", ["--user", "disable", "--now", systemdUnitName(projectName)], {
@@ -44855,7 +45950,7 @@ async function serviceUninstall(opts = {}) {
       });
     } catch {
     }
-    import_node_fs18.default.rmSync(systemdPath(projectName), { force: true });
+    import_node_fs19.default.rmSync(systemdPath(projectName), { force: true });
     try {
       (0, import_node_child_process2.execFileSync)("systemctl", ["--user", "daemon-reload"], { stdio: "ignore" });
     } catch {
@@ -44873,21 +45968,21 @@ async function serviceUninstall(opts = {}) {
 }
 async function serviceLogs(opts = {}) {
   const projectDir = resolveProjectDir(opts.project);
-  const logPath = import_node_path14.default.join(projectDir, ".sail", "agent.log");
-  if (!import_node_fs18.default.existsSync(logPath)) {
+  const logPath = import_node_path15.default.join(projectDir, ".sail", "agent.log");
+  if (!import_node_fs19.default.existsSync(logPath)) {
     console.log(`No log yet at ${logPath}. The service writes here once it runs.`);
     return;
   }
   if (opts.follow) {
     if (process.platform === "win32") {
-      console.log(import_node_fs18.default.readFileSync(logPath, "utf-8"));
+      console.log(import_node_fs19.default.readFileSync(logPath, "utf-8"));
       console.log("(follow mode is not supported on Windows here \u2014 re-run to refresh)");
       return;
     }
     (0, import_node_child_process2.execFileSync)("tail", ["-f", logPath], { stdio: "inherit" });
     return;
   }
-  const lines = import_node_fs18.default.readFileSync(logPath, "utf-8").split("\n");
+  const lines = import_node_fs19.default.readFileSync(logPath, "utf-8").split("\n");
   console.log(lines.slice(-200).join("\n"));
 }
 
@@ -45043,14 +46138,14 @@ async function sessionResume(opts = {}) {
 }
 
 // src/commands/station.ts
-var import_node_fs19 = require("node:fs");
-var import_node_path15 = require("node:path");
-var RUNTIME_SERVER_FILE2 = (0, import_node_path15.join)(".sail", "runtime", "server.json");
+var import_node_fs20 = require("node:fs");
+var import_node_path16 = require("node:path");
+var RUNTIME_SERVER_FILE2 = (0, import_node_path16.join)(".sail", "runtime", "server.json");
 function readState(projectRoot) {
-  const file = (0, import_node_path15.join)(projectRoot, RUNTIME_SERVER_FILE2);
-  if (!(0, import_node_fs19.existsSync)(file)) return null;
+  const file = (0, import_node_path16.join)(projectRoot, RUNTIME_SERVER_FILE2);
+  if (!(0, import_node_fs20.existsSync)(file)) return null;
   try {
-    return JSON.parse((0, import_node_fs19.readFileSync)(file, "utf8"));
+    return JSON.parse((0, import_node_fs20.readFileSync)(file, "utf8"));
   } catch {
     return null;
   }
@@ -45122,9 +46217,9 @@ async function stationStop(options) {
   }
   const daemon = await discoverDaemon(projectRoot);
   if (!daemon) {
-    const file = (0, import_node_path15.join)(projectRoot, RUNTIME_SERVER_FILE2);
+    const file = (0, import_node_path16.join)(projectRoot, RUNTIME_SERVER_FILE2);
     try {
-      if ((0, import_node_fs19.existsSync)(file)) (0, import_node_fs19.rmSync)(file);
+      if ((0, import_node_fs20.existsSync)(file)) (0, import_node_fs20.rmSync)(file);
     } catch {
     }
     emit(options.json, () => console.log("Station process not found; cleared stale state."), {
@@ -45140,9 +46235,9 @@ async function stationStop(options) {
       pid: state.pid
     });
   } catch {
-    const file = (0, import_node_path15.join)(projectRoot, RUNTIME_SERVER_FILE2);
+    const file = (0, import_node_path16.join)(projectRoot, RUNTIME_SERVER_FILE2);
     try {
-      if ((0, import_node_fs19.existsSync)(file)) (0, import_node_fs19.rmSync)(file);
+      if ((0, import_node_fs20.existsSync)(file)) (0, import_node_fs20.rmSync)(file);
     } catch {
     }
     emit(options.json, () => console.log("Station process not found; cleared stale state."), {
@@ -45204,9 +46299,9 @@ async function status() {
 
 // src/commands/ui.ts
 var import_node_child_process5 = require("node:child_process");
-var import_node_fs20 = __toESM(require("node:fs"), 1);
+var import_node_fs21 = __toESM(require("node:fs"), 1);
 var import_node_net2 = __toESM(require("node:net"), 1);
-var import_node_path16 = __toESM(require("node:path"), 1);
+var import_node_path17 = __toESM(require("node:path"), 1);
 
 // src/lib/tailscale.ts
 var import_node_child_process4 = require("node:child_process");
@@ -45252,12 +46347,12 @@ function tailscaleServeDown() {
 }
 
 // src/commands/ui.ts
-var UI_STATE_FILE = import_node_path16.default.join(".sail", "runtime", "ui.json");
+var UI_STATE_FILE = import_node_path17.default.join(".sail", "runtime", "ui.json");
 function readState2(projectRoot) {
-  const file = import_node_path16.default.join(projectRoot, UI_STATE_FILE);
-  if (!import_node_fs20.default.existsSync(file)) return null;
+  const file = import_node_path17.default.join(projectRoot, UI_STATE_FILE);
+  if (!import_node_fs21.default.existsSync(file)) return null;
   try {
-    return JSON.parse(import_node_fs20.default.readFileSync(file, "utf-8"));
+    return JSON.parse(import_node_fs21.default.readFileSync(file, "utf-8"));
   } catch {
     return null;
   }
@@ -45265,7 +46360,7 @@ function readState2(projectRoot) {
 function installedCliVersion() {
   try {
     const pkg = JSON.parse(
-      import_node_fs20.default.readFileSync(import_node_path16.default.join(packageRoot(), "package.json"), "utf-8")
+      import_node_fs21.default.readFileSync(import_node_path17.default.join(packageRoot(), "package.json"), "utf-8")
     );
     return pkg.version ?? null;
   } catch {
@@ -45292,16 +46387,16 @@ async function warnIfVersionSkew(port) {
 }
 function waitForPort(port, timeoutMs) {
   const deadline = Date.now() + timeoutMs;
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     const attempt = () => {
       const socket = import_node_net2.default.connect(port, "127.0.0.1");
       socket.once("connect", () => {
         socket.destroy();
-        resolve3(true);
+        resolve4(true);
       });
       socket.once("error", () => {
         socket.destroy();
-        if (Date.now() > deadline) resolve3(false);
+        if (Date.now() > deadline) resolve4(false);
         else setTimeout(attempt, 150);
       });
     };
@@ -45310,16 +46405,16 @@ function waitForPort(port, timeoutMs) {
 }
 async function uiCommand(opts = {}) {
   const distDir = cliDistDir();
-  const uiDistDir = import_node_path16.default.join(packageRoot(), "packages", "ui", "dist");
-  const serverBundle = import_node_path16.default.resolve(distDir, "server.cjs");
+  const uiDistDir = import_node_path17.default.join(packageRoot(), "packages", "ui", "dist");
+  const serverBundle = import_node_path17.default.resolve(distDir, "server.cjs");
   const projectRoot = process.cwd();
-  const sailDir2 = import_node_path16.default.join(projectRoot, ".sail");
+  const sailDir2 = import_node_path17.default.join(projectRoot, ".sail");
   const envPort = Number(process.env.PORT);
   const port = await findFreePort(Number.isInteger(envPort) && envPort > 0 && envPort <= 65535 ? envPort : projectPort(projectRoot));
-  if (!import_node_fs20.default.existsSync(serverBundle)) {
+  if (!import_node_fs21.default.existsSync(serverBundle)) {
     throw new Error(`Server bundle not found at ${serverBundle}. Re-run the sailor build.`);
   }
-  if (!import_node_fs20.default.existsSync(import_node_path16.default.join(uiDistDir, "index.html"))) {
+  if (!import_node_fs21.default.existsSync(import_node_path17.default.join(uiDistDir, "index.html"))) {
     throw new Error(`UI dist not found at ${uiDistDir}. Re-run the sailor build.`);
   }
   let tailnetUrl = null;
@@ -45349,10 +46444,10 @@ async function uiCommand(opts = {}) {
     await warnIfVersionSkew(existing.port);
     return;
   }
-  const runtimeDir = import_node_path16.default.join(projectRoot, ".sail", "runtime");
-  import_node_fs20.default.mkdirSync(runtimeDir, { recursive: true });
-  const logFile = import_node_path16.default.join(runtimeDir, "ui.log");
-  const logFd = import_node_fs20.default.openSync(logFile, "a");
+  const runtimeDir = import_node_path17.default.join(projectRoot, ".sail", "runtime");
+  import_node_fs21.default.mkdirSync(runtimeDir, { recursive: true });
+  const logFile = import_node_path17.default.join(runtimeDir, "ui.log");
+  const logFd = import_node_fs21.default.openSync(logFile, "a");
   const corsOrigins = [process.env.SAILOR_CORS_ORIGINS, tailnetUrl].filter(Boolean).join(",");
   const child = (0, import_node_child_process5.spawn)(process.execPath, [serverBundle], {
     detached: true,
@@ -45367,7 +46462,7 @@ async function uiCommand(opts = {}) {
     }
   });
   child.unref();
-  import_node_fs20.default.closeSync(logFd);
+  import_node_fs21.default.closeSync(logFd);
   const READY_TIMEOUT_MS = 1e4;
   const deadline = Date.now() + READY_TIMEOUT_MS;
   let ready = false;
@@ -45381,14 +46476,14 @@ async function uiCommand(opts = {}) {
   if (!ready) {
     let tail = "";
     try {
-      tail = import_node_fs20.default.readFileSync(logFile, "utf-8").split("\n").filter(Boolean).slice(-15).join("\n");
+      tail = import_node_fs21.default.readFileSync(logFile, "utf-8").split("\n").filter(Boolean).slice(-15).join("\n");
     } catch {
     }
     throw new Error(
       `Sailor UI failed to start within ${READY_TIMEOUT_MS / 1e3}s on port ${port}.` + (tail ? `
 
 Server output:
-${tail}` : ` See ${import_node_path16.default.relative(projectRoot, logFile)}.`)
+${tail}` : ` See ${import_node_path17.default.relative(projectRoot, logFile)}.`)
     );
   }
   let exposed = false;
@@ -45403,8 +46498,8 @@ ${tail}` : ` See ${import_node_path16.default.relative(projectRoot, logFile)}.`)
       );
     }
   }
-  import_node_fs20.default.writeFileSync(
-    import_node_path16.default.join(projectRoot, UI_STATE_FILE),
+  import_node_fs21.default.writeFileSync(
+    import_node_path17.default.join(projectRoot, UI_STATE_FILE),
     JSON.stringify({ pid: child.pid, port, startedAt: (/* @__PURE__ */ new Date()).toISOString(), exposed }, null, 2)
   );
   console.log(`Sailor UI started at http://localhost:${port}  (pid ${child.pid})`);
@@ -45417,7 +46512,7 @@ async function uiStatus() {
     console.log(`\u25CF running  http://localhost:${state.port}  (pid ${state.pid})`);
     await warnIfVersionSkew(state.port);
   } else {
-    if (state) import_node_fs20.default.rmSync(import_node_path16.default.join(process.cwd(), UI_STATE_FILE), { force: true });
+    if (state) import_node_fs21.default.rmSync(import_node_path17.default.join(process.cwd(), UI_STATE_FILE), { force: true });
     console.log("\u25CB Sailor UI is not running");
   }
 }
@@ -45429,7 +46524,7 @@ function uiStop() {
     return;
   }
   if (!isProcessAlive(state.pid)) {
-    import_node_fs20.default.rmSync(import_node_path16.default.join(projectRoot, UI_STATE_FILE), { force: true });
+    import_node_fs21.default.rmSync(import_node_path17.default.join(projectRoot, UI_STATE_FILE), { force: true });
     console.log("Sailor UI is not running (stale state file removed).");
     return;
   }
@@ -45438,21 +46533,21 @@ function uiStop() {
     tailscaleServeDown();
     console.log("Tailnet exposure removed.");
   }
-  import_node_fs20.default.rmSync(import_node_path16.default.join(projectRoot, UI_STATE_FILE), { force: true });
+  import_node_fs21.default.rmSync(import_node_path17.default.join(projectRoot, UI_STATE_FILE), { force: true });
   console.log(`Stopped Sailor UI (pid ${state.pid}).`);
 }
 
 // src/index.ts
-function cliVersion() {
+function cliVersion2() {
   try {
-    const pkg = JSON.parse((0, import_node_fs21.readFileSync)((0, import_node_path17.join)(packageRoot(), "package.json"), "utf-8"));
+    const pkg = JSON.parse((0, import_node_fs22.readFileSync)((0, import_node_path18.join)(packageRoot(), "package.json"), "utf-8"));
     return pkg.version ?? "0.0.0";
   } catch {
     return "0.0.0";
   }
 }
 var program2 = new Command();
-program2.name("sailor").description("Operator toolkit for Sail Protocol").version(cliVersion());
+program2.name("sailor").description("Operator toolkit for Sail Protocol").version(cliVersion2());
 function action(fn) {
   return async () => {
     try {
@@ -45477,7 +46572,7 @@ function actionWith(fn) {
     closePrompts();
   };
 }
-program2.command("init [dir]").description("Scaffold a new Sail agent into the current directory (or [dir] subdirectory)").option("--template <name>", "Template to scaffold from (default: default)").option("--chain <id>", "Default EVM chain id written to .sail/config.json and .env.example").option("--rpc-url <url>", "Default RPC_URL written to .sail/.env.local").option("--force", "Re-initialize even if already initialized (overwrites scaffold files; keys/ and state/ are preserved)").option("--no-skills", "Skip scaffolding the sailor skills (use under the Sailor plugin, which already provides them to the agent)").action(
+program2.command("init [dir]").description("Scaffold a new Sail agent into the current directory (or [dir] subdirectory)").option("--template <name>", "Template to scaffold from (default: default)").option("--chain <id>", "Default EVM chain id written to .sail/config.json and .env.example").option("--rpc-url <url>", "Default RPC_URL written to .sail/.env.local").option("--force", "Re-initialize even if already initialized (overwrites scaffold files; keys/ and state/ are preserved)").action(
   async (name, opts) => {
     try {
       await initCommand(name, opts);
@@ -45516,6 +46611,9 @@ mandate.command("attach").description("Register one or more already-deployed per
   "--address <mandateOrName>",
   "Permission address or locally-tracked name; or a comma-separated list of addresses to register together in one signature"
 ).requiredOption("--sma <address>", "SMA to register the permission on").option("--label <label>", "Human-readable label shown in the signing UI").option("--json", "Emit machine-readable JSON").action(actionWith(mandateAttach));
+mandate.command("configure").description(
+  "Write per-account bounds on an already-deployed shared permission singleton (configureDirect; owner tx via the signing station). Pairs with `mandate attach`, which only registers \u2014 a registered-but-unconfigured singleton denies every call."
+).requiredOption("--address <singleton>", "Shared permission singleton address (deployed on this chain)").requiredOption("--sma <address>", "SMA to configure the singleton for").option("--params <hex>", "Pre-encoded config blob (0x-prefixed hex)").option("--args-file <path>", "JSON file of typed params (paired with --template)").option("--template <name>", "Template name (e.g. SwapPermission) \u2014 resolves the encoder for --args-file").option("--label <label>", "Human-readable label shown in the signing UI").option("--simulate-only", "Stop after the off-chain pre-flight (no signing, no gas)").option("--force", "Re-configure even if isConfigured is already true").option("--json", "Emit machine-readable JSON").action(actionWith(mandateConfigure));
 mandate.command("deploy-clone").description("[currently unavailable \u2014 no clone templates deployed on any chain; use `mandate deploy`] Deploy + register a standalone clone permission via the signing UI").requiredOption("--template <key>", "Standalone clone template key (e.g. boundedApprove)").requiredOption("--sma <address>", "SMA to deploy the clone for and register it on").option("--tokens <csv>", "Comma-separated allowed token addresses").option("--spenders <csv>", "Comma-separated allowed spender addresses").option("--max <amount>", "Max amount per tx in base units (default: uint256 max)").option("--label <label>", "Human-readable label to track this permission under").option("--json", "Emit machine-readable JSON").action(actionWith(mandateDeployClone));
 mandate.command("revoke").description("Revoke permission(s) from an SMA (EIP-712 RevokePermissions, owner-authorized)").option("--address <permissionOrName>", "Permission address, or a name tracked locally").requiredOption("--sma <address>", "Safe (SMA) to revoke the permission(s) from").option("--all", "Revoke every permission currently registered on the SMA").option("--json", "Output JSON").action(actionWith(mandateRevoke));
 mandate.command("templates").description("Show how to author your own permission contract (and any community-deployed addresses)").option("--json", "Emit machine-readable JSON").action(actionWith(mandateTemplates));