@finchtech/cli 0.3.3 → 0.3.5

package/dist/finch.js

@@ -6606,11 +6606,478 @@ var require_ajv = __commonJS({
   }
 });
 
+// src/state.ts
+import { execFile } from "node:child_process";
+import { constants } from "node:fs";
+import {
+  chmod,
+  lstat,
+  mkdir,
+  open,
+  readFile,
+  realpath,
+  rename,
+  rm
+} from "node:fs/promises";
+import {
+  dirname,
+  isAbsolute,
+  join,
+  normalize,
+  parse,
+  relative,
+  resolve,
+  sep
+} from "node:path";
+import { homedir } from "node:os";
+import { promisify } from "node:util";
+function resolveFinchtechHome(environment3, userHome = homedir()) {
+  const explicit = environment3.FINCHTECH_HOME;
+  if (typeof explicit === "string" && explicit.length > 0) return explicit;
+  return resolve(userHome, ".finchtech");
+}
+function windowsSystemExecutable(name) {
+  const systemRoot = process.env.SystemRoot;
+  if (typeof systemRoot !== "string" || systemRoot.length === 0 || !isAbsolute(systemRoot)) {
+    throw new CliStateError("CLI_STATE_PERMISSIONS_INVALID");
+  }
+  return join(systemRoot, "System32", name);
+}
+async function queryCurrentWindowsSid() {
+  try {
+    const { stdout } = await execFileAsync(
+      windowsSystemExecutable("whoami.exe"),
+      ["/user", "/fo", "csv", "/nh"],
+      { windowsHide: true }
+    );
+    const match = /,"(S-[0-9-]+)"\s*$/u.exec(stdout.trim());
+    if (!match?.[1]) throw new CliStateError("CLI_STATE_PERMISSIONS_INVALID");
+    return match[1];
+  } catch (cause) {
+    if (cause instanceof CliStateError) throw cause;
+    throw new CliStateError("CLI_STATE_PERMISSIONS_INVALID", { cause });
+  }
+}
+function currentWindowsSid() {
+  windowsSidPromise ??= queryCurrentWindowsSid();
+  return windowsSidPromise;
+}
+async function hardenWindows(path2, directory) {
+  const sid = await currentWindowsSid();
+  const permission = directory ? `*${sid}:(OI)(CI)F` : `*${sid}:F`;
+  try {
+    await execFileAsync(
+      windowsSystemExecutable("icacls.exe"),
+      [path2, "/setowner", `*${sid}`],
+      { windowsHide: true }
+    );
+    await execFileAsync(
+      windowsSystemExecutable("icacls.exe"),
+      [path2, "/inheritance:r", "/grant:r", permission],
+      { windowsHide: true }
+    );
+  } catch (cause) {
+    if (cause instanceof CliStateError) throw cause;
+    throw new CliStateError("CLI_STATE_PERMISSIONS_INVALID", { cause });
+  }
+}
+async function verifyWindowsAcl(path2) {
+  const expectedSid = await currentWindowsSid();
+  try {
+    const arguments_ = ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", inspectWindowsAclScript];
+    const options = {
+      env: { ...process.env, FINCHTECH_ACL_PATH: path2 },
+      windowsHide: true
+    };
+    let stdout;
+    try {
+      ({ stdout } = await execFileAsync("pwsh.exe", arguments_, options));
+    } catch {
+      ({ stdout } = await execFileAsync("powershell.exe", arguments_, options));
+    }
+    const inspection = JSON.parse(stdout);
+    const unrelatedRule = inspection.rules.some((rule) => rule.sid !== expectedSid && !WINDOWS_PLATFORM_ADMINISTRATOR_SIDS.has(rule.sid) || rule.type !== "Allow");
+    if (inspection.ownerSid !== expectedSid || !inspection.protected || inspection.rules.length < 1 || inspection.rules.some((rule) => rule.inherited) || unrelatedRule) {
+      throw new CliStateError("CLI_STATE_PERMISSIONS_INVALID");
+    }
+  } catch (cause) {
+    if (cause instanceof CliStateError) throw cause;
+    throw new CliStateError("CLI_STATE_PERMISSIONS_INVALID", { cause });
+  }
+}
+async function harden(path2, directory) {
+  if (process.platform === "win32") {
+    await hardenWindows(path2, directory);
+  } else {
+    await chmod(path2, directory ? 448 : 384);
+  }
+}
+async function writeExclusiveProtectedFile(path2, value) {
+  const target = resolve(path2);
+  const parent = dirname(target);
+  if (!isAbsolute(path2) || parse(target).root === target) {
+    throw new CliStateError("CLI_STATE_PERMISSIONS_INVALID");
+  }
+  let handle;
+  let created = false;
+  try {
+    await assertSafePathComponents(parent);
+    await defaultPermissionPolicy.verify(parent, true);
+    handle = await open(target, "wx", 384);
+    created = true;
+    const opened = await handle.stat();
+    const pathAfterOpen = await lstat(target);
+    if (!opened.isFile() || opened.nlink !== 1 || !sameIdentity(opened, pathAfterOpen)) {
+      throw new CliStateError("CLI_STATE_PERMISSIONS_INVALID");
+    }
+    await defaultPermissionPolicy.hardenNew(target, false);
+    await defaultPermissionPolicy.verify(target, false);
+    const openedAfterAcl = await handle.stat();
+    const pathAfterAcl = await lstat(target);
+    if (!sameIdentity(opened, openedAfterAcl) || !sameIdentity(opened, pathAfterAcl) || openedAfterAcl.nlink !== 1) {
+      throw new CliStateError("CLI_STATE_PERMISSIONS_INVALID");
+    }
+    await handle.writeFile(value);
+    await handle.sync();
+    await handle.close();
+    handle = void 0;
+    await defaultSyncDirectory(parent);
+  } catch (cause) {
+    await handle?.close().catch(() => void 0);
+    if (cause.code === "EEXIST") {
+      throw new CliStateError("CLI_STATE_CONFLICT", { cause });
+    }
+    if (created) {
+      await rm(target, { force: true }).catch(() => void 0);
+      await defaultSyncDirectory(parent).catch(() => void 0);
+    }
+    throw permissionFailure(cause);
+  }
+}
+async function assertSafeNode(path2, directory) {
+  const metadata = await lstat(path2);
+  if (metadata.isSymbolicLink() || (directory ? !metadata.isDirectory() : !metadata.isFile())) {
+    throw new CliStateError("CLI_STATE_PERMISSIONS_INVALID");
+  }
+  if (!directory && metadata.nlink !== 1) {
+    throw new CliStateError("CLI_STATE_PERMISSIONS_INVALID");
+  }
+  if (process.platform !== "win32") {
+    const expected = directory ? 448 : 384;
+    if ((metadata.mode & 511) !== expected || typeof process.getuid === "function" && metadata.uid !== process.getuid()) {
+      throw new CliStateError("CLI_STATE_PERMISSIONS_INVALID");
+    }
+  } else {
+    await verifyWindowsAcl(path2);
+  }
+}
+async function defaultSyncDirectory(path2) {
+  const handle = await open(path2, process.platform === "win32" ? "r+" : "r");
+  try {
+    await handle.sync();
+  } finally {
+    await handle.close();
+  }
+}
+function samePath(left, right) {
+  const normalizedLeft = normalize(left);
+  const normalizedRight = normalize(right);
+  return process.platform === "win32" ? normalizedLeft.toLowerCase() === normalizedRight.toLowerCase() : normalizedLeft === normalizedRight;
+}
+async function assertSafePathComponents(path2) {
+  const target = resolve(path2);
+  const root = parse(target).root;
+  let cursor = root;
+  for (const component of relative(root, target).split(sep).filter(Boolean)) {
+    cursor = resolve(cursor, component);
+    const metadata = await lstat(cursor);
+    if (metadata.isSymbolicLink()) {
+      const darwinSystemTarget = process.platform === "darwin" ? DARWIN_SYSTEM_LINK_TARGETS.get(cursor) : void 0;
+      if (darwinSystemTarget === void 0 || !samePath(await realpath(cursor), darwinSystemTarget)) {
+        throw new CliStateError("CLI_STATE_PERMISSIONS_INVALID");
+      }
+    }
+  }
+}
+function permissionFailure(cause) {
+  return cause instanceof CliStateError ? cause : new CliStateError("CLI_STATE_PERMISSIONS_INVALID", { cause });
+}
+function sameIdentity(left, right) {
+  return left.dev === right.dev && left.ino === right.ino;
+}
+async function readProtectedFile(path2, maximumBytes) {
+  const target = resolve(path2);
+  const parent = dirname(target);
+  if (!isAbsolute(path2) || !Number.isInteger(maximumBytes) || maximumBytes < 1) {
+    throw new CliStateError("CLI_STATE_PERMISSIONS_INVALID");
+  }
+  let handle;
+  try {
+    await assertSafePathComponents(parent);
+    await defaultPermissionPolicy.verify(parent, true);
+    const before = await lstat(target);
+    const noFollow = constants.O_NOFOLLOW ?? 0;
+    handle = await open(target, constants.O_RDONLY | noFollow);
+    const opened = await handle.stat();
+    const afterOpen = await lstat(target);
+    if (!sameIdentity(before, opened) || !sameIdentity(opened, afterOpen) || !opened.isFile() || opened.nlink !== 1 || opened.size < 1 || opened.size > maximumBytes) {
+      throw new CliStateError("CLI_STATE_PERMISSIONS_INVALID");
+    }
+    if (process.platform === "win32") {
+      await verifyWindowsAcl(target);
+    } else if ((opened.mode & 511) !== 384 || typeof process.getuid === "function" && opened.uid !== process.getuid()) {
+      throw new CliStateError("CLI_STATE_PERMISSIONS_INVALID");
+    }
+    const afterAcl = await lstat(target);
+    if (!sameIdentity(opened, afterAcl)) throw new CliStateError("CLI_STATE_PERMISSIONS_INVALID");
+    const body = Buffer.alloc(opened.size);
+    let offset = 0;
+    while (offset < body.length) {
+      const chunk = await handle.read(body, offset, body.length - offset, offset);
+      if (chunk.bytesRead === 0) throw new CliStateError("CLI_STATE_PERMISSIONS_INVALID");
+      offset += chunk.bytesRead;
+    }
+    const stable = await handle.stat();
+    if (!sameIdentity(opened, stable) || stable.size !== opened.size) {
+      throw new CliStateError("CLI_STATE_PERMISSIONS_INVALID");
+    }
+    return body;
+  } catch (cause) {
+    throw permissionFailure(cause);
+  } finally {
+    await handle?.close().catch(() => void 0);
+  }
+}
+var execFileAsync, DARWIN_SYSTEM_LINK_TARGETS, CliStateError, windowsSidPromise, WINDOWS_PLATFORM_ADMINISTRATOR_SIDS, inspectWindowsAclScript, defaultPermissionPolicy, HardenedFileStore;
+var init_state = __esm({
+  "src/state.ts"() {
+    "use strict";
+    execFileAsync = promisify(execFile);
+    DARWIN_SYSTEM_LINK_TARGETS = /* @__PURE__ */ new Map([
+      ["/etc", "/private/etc"],
+      ["/tmp", "/private/tmp"],
+      ["/var", "/private/var"]
+    ]);
+    CliStateError = class extends Error {
+      code;
+      diagnostic;
+      constructor(code, options) {
+        super(code, options);
+        this.name = "CliStateError";
+        this.code = code;
+        this.diagnostic = options?.diagnostic ?? null;
+      }
+    };
+    WINDOWS_PLATFORM_ADMINISTRATOR_SIDS = /* @__PURE__ */ new Set([
+      "S-1-5-18",
+      // LocalSystem
+      "S-1-5-32-544"
+      // BUILTIN\Administrators
+    ]);
+    inspectWindowsAclScript = String.raw`
+$ErrorActionPreference = 'Stop'
+$acl = Get-Acl -LiteralPath $env:FINCHTECH_ACL_PATH
+$ownerSid = ([System.Security.Principal.NTAccount]$acl.Owner).Translate([System.Security.Principal.SecurityIdentifier]).Value
+$rules = @($acl.Access | ForEach-Object {
+  $sid = $_.IdentityReference.Translate([System.Security.Principal.SecurityIdentifier]).Value
+  [pscustomobject]@{ sid = $sid; inherited = $_.IsInherited; type = $_.AccessControlType.ToString() }
+})
+[pscustomobject]@{ ownerSid = $ownerSid; protected = $acl.AreAccessRulesProtected; rules = $rules } |
+  ConvertTo-Json -Compress -Depth 4
+`;
+    defaultPermissionPolicy = Object.freeze({
+      hardenNew: harden,
+      verify: assertSafeNode
+    });
+    HardenedFileStore = class {
+      root;
+      permissions;
+      syncDirectory;
+      constructor(root, options = {}) {
+        const resolved = resolve(root);
+        if (!isAbsolute(root) || samePath(resolved, parse(resolved).root)) {
+          throw new CliStateError("CLI_STATE_PERMISSIONS_INVALID");
+        }
+        this.root = resolved;
+        this.permissions = options.permissions ?? defaultPermissionPolicy;
+        this.syncDirectory = options.syncDirectory ?? defaultSyncDirectory;
+      }
+      resolveRelative(path2) {
+        if (path2.length === 0 || isAbsolute(path2) || path2.includes("\0")) {
+          throw new CliStateError("CLI_STATE_PERMISSIONS_INVALID");
+        }
+        const target = resolve(this.root, path2);
+        const fromRoot = relative(this.root, target);
+        if (fromRoot === ".." || fromRoot.startsWith(`..${sep}`) || isAbsolute(fromRoot)) {
+          throw new CliStateError("CLI_STATE_PERMISSIONS_INVALID");
+        }
+        return target;
+      }
+      async ensureDirectory(path2) {
+        try {
+          const metadata = await lstat(path2);
+          if (metadata.isSymbolicLink() || !metadata.isDirectory()) {
+            throw new CliStateError("CLI_STATE_PERMISSIONS_INVALID");
+          }
+          await assertSafePathComponents(path2);
+          await this.permissions.verify(path2, true);
+          return;
+        } catch (cause) {
+          if (cause.code !== "ENOENT") throw permissionFailure(cause);
+        }
+        const parent = dirname(path2);
+        await assertSafePathComponents(parent);
+        let created = false;
+        try {
+          await mkdir(path2, { recursive: false, mode: 448 });
+          created = true;
+          await this.permissions.hardenNew(path2, true);
+          await this.permissions.verify(path2, true);
+          await this.syncDirectory(parent);
+        } catch (cause) {
+          if (created) {
+            await rm(path2, { recursive: true, force: true }).catch(() => void 0);
+            await this.syncDirectory(parent).catch(() => void 0);
+          }
+          throw permissionFailure(cause);
+        }
+      }
+      async ensureParent(target) {
+        await this.ensureDirectory(this.root);
+        const parent = resolve(target, "..");
+        const fromRoot = relative(this.root, parent);
+        let cursor = this.root;
+        for (const component of fromRoot.split(sep).filter(Boolean)) {
+          cursor = resolve(cursor, component);
+          await this.ensureDirectory(cursor);
+        }
+      }
+      async writeSecret(path2, value, options) {
+        if (!options.exclusive) throw new CliStateError("CLI_STATE_PERMISSIONS_INVALID");
+        const target = this.resolveRelative(path2);
+        await this.ensureParent(target);
+        let handle;
+        let created = false;
+        try {
+          handle = await open(target, "wx", 384);
+          created = true;
+          await this.permissions.hardenNew(target, false);
+          await this.permissions.verify(target, false);
+          await handle.writeFile(value);
+          await handle.sync();
+          await handle.close();
+          handle = void 0;
+          await this.syncDirectory(dirname(target));
+        } catch (cause) {
+          await handle?.close().catch(() => void 0);
+          if (cause.code === "EEXIST") {
+            throw new CliStateError("CLI_STATE_CONFLICT", { cause });
+          }
+          if (created) {
+            await rm(target, { force: true }).catch(() => void 0);
+            await this.syncDirectory(dirname(target)).catch(() => void 0);
+          }
+          throw permissionFailure(cause);
+        }
+      }
+      async writeJson(path2, value) {
+        const target = this.resolveRelative(path2);
+        const temporary = `${target}.tmp-${process.pid}-${Date.now()}`;
+        await this.ensureParent(target);
+        try {
+          await this.writeSecret(relative(this.root, temporary), Buffer.from(`${JSON.stringify(value)}
+`, "utf8"), {
+            exclusive: true
+          });
+          try {
+            await lstat(target);
+            await this.permissions.verify(target, false);
+          } catch (cause) {
+            if (cause.code !== "ENOENT") throw cause;
+          }
+          await rename(temporary, target);
+          await this.permissions.verify(target, false);
+          await this.syncDirectory(dirname(target));
+        } catch (cause) {
+          await rm(temporary, { force: true }).catch(() => void 0);
+          throw cause;
+        }
+      }
+      async readSecret(path2) {
+        const target = this.resolveRelative(path2);
+        try {
+          await this.permissions.verify(target, false);
+          return await readFile(target);
+        } catch (cause) {
+          if (cause.code === "ENOENT") {
+            throw new CliStateError("CLI_STATE_NOT_FOUND", { cause });
+          }
+          if (cause instanceof CliStateError) throw cause;
+          throw new CliStateError("CLI_STATE_PERMISSIONS_INVALID", { cause });
+        }
+      }
+      async readJson(path2) {
+        try {
+          return JSON.parse((await this.readSecret(path2)).toString("utf8"));
+        } catch (cause) {
+          if (cause instanceof CliStateError && cause.code !== "CLI_STATE_CORRUPT") throw cause;
+          throw new CliStateError("CLI_STATE_CORRUPT", { cause });
+        }
+      }
+      async remove(path2, options = {}) {
+        const target = this.resolveRelative(path2);
+        await rm(target, { force: true, recursive: options.recursive ?? false });
+        await this.syncDirectory(dirname(target)).catch((cause) => {
+          if (cause.code !== "ENOENT") throw cause;
+        });
+      }
+    };
+  }
+});
+
 // src/cli-error.ts
+function localFailureMessage(error51) {
+  if (error51 instanceof CliStateError) {
+    if (error51.code === "CLI_STATE_PERMISSIONS_INVALID") {
+      return process.platform === "win32" ? "Protected local state has unsafe ownership or ACLs. Restrict it to the current Windows user and retry." : "Protected local state has unsafe permissions. Directories must be mode 0700 and files mode 0600.";
+    }
+    if (error51.diagnostic === "profile") {
+      return error51.code === "CLI_STATE_NOT_FOUND" ? "Finch endpoint override is missing. Remove the override to use PROD, or provision protected FINCHTECH_HOME/profile.json." : "Finch endpoint override is invalid. Remove it to use PROD, or reprovision protected FINCHTECH_HOME/profile.json.";
+    }
+    if (error51.diagnostic === "wallet_bootstrap") {
+      return "Local authorization remains without a wallet. Restore the original wallet state, or run finch logout --local to discard local authorization before importing.";
+    }
+    if (error51.diagnostic === "wallet") {
+      return error51.code === "CLI_STATE_NOT_FOUND" ? "No current wallet was found in FINCHTECH_HOME (default: ~/.finchtech). Run finch wallet create, or finch wallet use --file <PATH> to import an existing private key into a new wallet store." : "Local wallet state in FINCHTECH_HOME (default: ~/.finchtech) is incomplete or invalid. Restore the wallet files from backup; do not overwrite the existing wallet.";
+    }
+    if (error51.diagnostic === "session") {
+      return error51.code === "CLI_STATE_NOT_FOUND" ? "No active Finch login was found. Run finch login --help for supported authentication chains, then finch login --chain-id <CHAIN_ID>." : "The active Finch login is invalid. Run finch logout --local, then finch login --help to select an authentication chain and log in again.";
+    }
+    if (error51.code === "CLI_STATE_NOT_FOUND") {
+      return "Required protected local state is missing. Check the command prerequisites and retry.";
+    }
+    if (error51.code === "CLI_STATE_CONFLICT") {
+      return "Protected local state already exists or changed concurrently. Refresh state and retry.";
+    }
+    return "Protected local state is corrupt. Recreate the affected profile, login, grant, or recovery state.";
+  }
+  if (error51.message === "FINCHTECH_HOME is required.") {
+    return "FINCHTECH_HOME is required. Set it to the protected Finch Agent CLI state directory.";
+  }
+  const missingScope = /^No active MCP grant with ([a-z_:]+) is available for this account and endpoint\.$/u.exec(error51.message);
+  if (missingScope !== null) {
+    return `Required MCP grant scope ${missingScope[1]} is missing. Create or refresh that scoped grant.`;
+  }
+  if (/^The selected .* MCP grant is invalid\.$/u.test(error51.message)) {
+    return "The selected MCP grant is invalid. Recreate the grant for the active account and endpoint.";
+  }
+  return "Command input does not match the expected schema. Check finch help for this command.";
+}
 var CliAuthorityError, CliProductionUnavailableError, BrowserOpenError, PUBLIC_RECOVERY_COMMAND, CliRecoveryBlockedError, CliSkillSourceError, CliSkillPublicationError;
 var init_cli_error = __esm({
   "src/cli-error.ts"() {
     "use strict";
+    init_state();
     CliAuthorityError = class extends Error {
       code = "MCP_CLI_WALLET_MISMATCH";
       constructor(code = "MCP_CLI_WALLET_MISMATCH") {
@@ -6757,11 +7224,32 @@ var init_delivery_message = __esm({
   }
 });
 
+// ../../packages/skill-content/src/image-signature.ts
+function matchesAscii(bytes, offset, tag) {
+  if (bytes.length < offset + tag.length) return false;
+  return [...tag].every((character, index2) => bytes[offset + index2] === character.charCodeAt(0));
+}
+function detectedImageMediaType(bytes) {
+  if (bytes.length >= PNG_SIGNATURE.length && PNG_SIGNATURE.every((byte, index2) => bytes[index2] === byte)) return "image/png";
+  if (bytes.length >= 3 && bytes[0] === 255 && bytes[1] === 216 && bytes[2] === 255) return "image/jpeg";
+  if (matchesAscii(bytes, 0, "GIF87a") || matchesAscii(bytes, 0, "GIF89a")) return "image/gif";
+  if (matchesAscii(bytes, 0, "RIFF") && matchesAscii(bytes, 8, "WEBP")) return "image/webp";
+  return null;
+}
+var PNG_SIGNATURE;
+var init_image_signature = __esm({
+  "../../packages/skill-content/src/image-signature.ts"() {
+    "use strict";
+    PNG_SIGNATURE = [137, 80, 78, 71, 13, 10, 26, 10];
+  }
+});
+
 // ../../packages/skill-content/src/static-detail.ts
 var MAX_SKILL_DETAIL_OBJECT_BYTES, MAX_SKILL_DETAIL_DOCUMENT_BYTES, NAMED_REFERENCES;
 var init_static_detail = __esm({
   "../../packages/skill-content/src/static-detail.ts"() {
     "use strict";
+    init_image_signature();
     MAX_SKILL_DETAIL_OBJECT_BYTES = 4 * 1024 * 1024;
     MAX_SKILL_DETAIL_DOCUMENT_BYTES = MAX_SKILL_DETAIL_OBJECT_BYTES;
     NAMED_REFERENCES = Object.freeze({
@@ -11270,6 +11758,7 @@ var init_src2 = __esm({
     init_crypto();
     init_delivery_message();
     init_detail_documents();
+    init_image_signature();
     init_manifest();
     init_packaging();
     init_static_detail();
@@ -14454,11 +14943,13 @@ function assertSortedIdentityScopes(scopes) {
     previous = scope;
   }
 }
-var identityScopeValues, IDENTITY_SCOPE_ORDER_CONTRACT, identityEnvironmentValues, environmentSchema, chainIdSchema, dateTimeSchema, grantScopesSchema, identityChallengeRequestSchema, identityChallengeResponseSchema, identityLoginRequestSchema, identitySessionResponseSchema, identitySessionStatusResponseSchema, identityLogoutRequestSchema, identityMcpActorResponseSchema, identityGrantCreateRequestSchema, identityGrantCreateResponseSchema, identityGrantShowResponseSchema, identityGrantRevokeRequestSchema, identityErrorCodes, identityErrorEnvelopeSchema, IDENTITY_V1_ROUTES, IDENTITY_V1_OPERATIONS, IDENTITY_MCP_V1_MANIFEST, CLI_GRANT_SHOW_WIRE;
+var PRODUCTION_AUTH_CHAIN_IDS, TEST_AUTH_CHAIN_IDS, identityScopeValues, IDENTITY_SCOPE_ORDER_CONTRACT, identityEnvironmentValues, environmentSchema, chainIdSchema, dateTimeSchema, grantScopesSchema, identityChallengeRequestSchema, identityChallengeResponseSchema, identityLoginRequestSchema, identitySessionResponseSchema, identitySessionStatusResponseSchema, identityLogoutRequestSchema, identityMcpActorResponseSchema, identityGrantCreateRequestSchema, identityGrantCreateResponseSchema, identityGrantShowResponseSchema, identityGrantRevokeRequestSchema, identityErrorCodes, identityErrorEnvelopeSchema, IDENTITY_V1_ROUTES, IDENTITY_V1_OPERATIONS, IDENTITY_MCP_V1_MANIFEST, CLI_GRANT_SHOW_WIRE;
 var init_identity = __esm({
   "../../packages/agent-market-contracts/src/v1/identity.ts"() {
     "use strict";
     init_common2();
+    PRODUCTION_AUTH_CHAIN_IDS = Object.freeze([1, 10, 56, 8453, 42161]);
+    TEST_AUTH_CHAIN_IDS = Object.freeze([84532]);
     identityScopeValues = [
       "account:read",
       "agent_market:buyer:invoke",
@@ -15025,7 +15516,7 @@ var init_merchant = __esm({
     });
     publicationOperationResultSchema = strictObjectSchema({
       serviceVersionId: canonicalUuidSchema,
-      publicationGeneration: nonNegativeGenerationSchema,
+      publicationGeneration: { anyOf: [nonNegativeGenerationSchema, nullSchema3] },
       activeVersionRevision: positiveRevisionSchema
     });
     localPurchaseOperationResultSchema = strictObjectSchema({
@@ -16915,6 +17406,7 @@ var init_schemas = __esm({
       perPage: { type: "integer", minimum: 1, maximum: 100 }
     }, []);
     createTaskDraftRequestSchema = strictObjectSchema2({
+      expectedUpdatedAt: { type: "string", format: "date-time" },
       title: { type: "string", minLength: 1, maxLength: 80 },
       description: { type: "string", minLength: 1, maxLength: 500 },
       goal: { type: "string", minLength: 1, maxLength: 2e3 },
@@ -16940,7 +17432,7 @@ var init_schemas = __esm({
       startAt: nullableString,
       goals: { type: "array", maxItems: 5, items: openObjectSchema },
       publishNow: { const: false }
-    }, ["title", "description", "goal", "rewardAmount", "publishNow"]);
+    }, ["title", "goal", "rewardAmount", "publishNow"]);
     taskSubmissionRequestSchema = strictObjectSchema2({
       content: { type: "string", minLength: 1, maxLength: 1e5 },
       proofUrl: nullableString,
@@ -18051,7 +18543,7 @@ var init_errors2 = __esm({
 });
 
 // ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/core/parse.js
-var _parse, parse, _parseAsync, parseAsync, _safeParse, safeParse, _safeParseAsync, safeParseAsync, _encode, encode5, _decode, decode7, _encodeAsync, encodeAsync, _decodeAsync, decodeAsync, _safeEncode, safeEncode, _safeDecode, safeDecode, _safeEncodeAsync, safeEncodeAsync, _safeDecodeAsync, safeDecodeAsync;
+var _parse, parse2, _parseAsync, parseAsync, _safeParse, safeParse, _safeParseAsync, safeParseAsync, _encode, encode5, _decode, decode7, _encodeAsync, encodeAsync, _decodeAsync, decodeAsync, _safeEncode, safeEncode, _safeDecode, safeDecode, _safeEncodeAsync, safeEncodeAsync, _safeDecodeAsync, safeDecodeAsync;
 var init_parse = __esm({
   "../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/core/parse.js"() {
     init_core();
@@ -18070,7 +18562,7 @@ var init_parse = __esm({
       }
       return result2.value;
     };
-    parse = /* @__PURE__ */ _parse($ZodRealError);
+    parse2 = /* @__PURE__ */ _parse($ZodRealError);
     _parseAsync = (_Err) => async (schema4, value, _ctx, params) => {
       const ctx = _ctx ? { ..._ctx, async: true } : { async: true };
       let result2 = schema4._zod.run({ value, issues: [] }, ctx);
@@ -20916,10 +21408,10 @@ var init_schemas2 = __esm({
           throw new Error("implement() must be called with a function");
         }
         return function(...args) {
-          const parsedArgs = inst._def.input ? parse(inst._def.input, args) : args;
+          const parsedArgs = inst._def.input ? parse2(inst._def.input, args) : args;
           const result2 = Reflect.apply(func, this, parsedArgs);
           if (inst._def.output) {
-            return parse(inst._def.output, result2);
+            return parse2(inst._def.output, result2);
           }
           return result2;
         };
@@ -29714,7 +30206,7 @@ __export(core_exports2, {
   isValidJWT: () => isValidJWT,
   locales: () => locales_exports,
   meta: () => meta,
-  parse: () => parse,
+  parse: () => parse2,
   parseAsync: () => parseAsync,
   prettifyError: () => prettifyError,
   process: () => process2,
@@ -29889,12 +30381,12 @@ var init_errors3 = __esm({
 });
 
 // ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/parse.js
-var parse2, parseAsync2, safeParse2, safeParseAsync2, encode6, decode8, encodeAsync2, decodeAsync2, safeEncode2, safeDecode2, safeEncodeAsync2, safeDecodeAsync2;
+var parse3, parseAsync2, safeParse2, safeParseAsync2, encode6, decode8, encodeAsync2, decodeAsync2, safeEncode2, safeDecode2, safeEncodeAsync2, safeDecodeAsync2;
 var init_parse2 = __esm({
   "../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/parse.js"() {
     init_core2();
     init_errors3();
-    parse2 = /* @__PURE__ */ _parse(ZodRealError);
+    parse3 = /* @__PURE__ */ _parse(ZodRealError);
     parseAsync2 = /* @__PURE__ */ _parseAsync(ZodRealError);
     safeParse2 = /* @__PURE__ */ _safeParse(ZodRealError);
     safeParseAsync2 = /* @__PURE__ */ _safeParseAsync(ZodRealError);
@@ -30614,7 +31106,7 @@ var init_schemas3 = __esm({
       inst.def = def;
       inst.type = def.type;
       Object.defineProperty(inst, "_def", { value: def });
-      inst.parse = (data, params) => parse2(inst, data, params, { callee: inst.parse });
+      inst.parse = (data, params) => parse3(inst, data, params, { callee: inst.parse });
       inst.safeParse = (data, params) => safeParse2(inst, data, params);
       inst.parseAsync = async (data, params) => parseAsync2(inst, data, params, { callee: inst.parseAsync });
       inst.safeParseAsync = async (data, params) => safeParseAsync2(inst, data, params);
@@ -32114,7 +32606,7 @@ __export(external_exports, {
   object: () => object,
   optional: () => optional,
   overwrite: () => _overwrite,
-  parse: () => parse2,
+  parse: () => parse3,
   parseAsync: () => parseAsync2,
   partialRecord: () => partialRecord,
   pipe: () => pipe,
@@ -32470,12 +32962,12 @@ var init_skill_protocol = __esm({
                 name: "BNB Smart Chain",
                 explorerUrl: "https://bscscan.com",
                 defaultRpcUrls: [
+                  "https://bsc.rpc.blxrbdn.com",
                   "https://0.48.club",
-                  "https://bsc-mainnet.public.blastapi.io",
                   "https://bsc-dataseed.binance.org",
                   "https://bsc-dataseed1.defibit.io"
                 ],
-                maxLogBlockRange: 500
+                maxLogBlockRange: 5e3
               },
               sourceRepository: "FinchipAI/finchip-protocol",
               sourceCommit: "89e54d6ff46dbfba61122e90c5e77f409f02fe5e",
@@ -32501,8 +32993,7 @@ var init_skill_protocol = __esm({
                 name: "Base",
                 explorerUrl: "https://basescan.org",
                 defaultRpcUrls: [
-                  "https://mainnet.base.org",
-                  "https://base.drpc.org"
+                  "https://mainnet.base.org"
                 ],
                 maxLogBlockRange: 2e3
               },
@@ -33160,7 +33651,7 @@ var init_web_localization = __esm({
           languageSwitchEnabled: true
         },
         production: {
-          languageSwitchEnabled: false
+          languageSwitchEnabled: true
         }
       }
     };
@@ -33388,12 +33879,12 @@ var init_merchant_avatar_video = __esm({
         test: {
           enabled: true,
           offerId: "e72aeda7-da44-5685-b5a0-4d90cfa63c2d",
-          dailyLimit: 10
+          dailyLimit: 3
         },
         production: {
           enabled: true,
           offerId: "1cf22f74-a451-54f0-894a-baff6221693d",
-          dailyLimit: 10
+          dailyLimit: 3
         }
       }
     };
@@ -54610,6 +55101,7 @@ var init_api2 = __esm({
     ajv = new import_ajv.default({ allErrors: true, strict: false });
     ajv.addFormat("date-time", (value) => Number.isFinite(Date.parse(value)));
     ajv.addFormat("uri", (value) => URL.canParse(value));
+    ajv.addFormat("uuid", new RegExp(canonicalUuidPattern, "u"));
     validatorCache = /* @__PURE__ */ new WeakMap();
     skillUnsignedIntentResponseSchema = {
       type: "object",
@@ -55576,435 +56068,6 @@ var init_accounts = __esm({
   }
 });
 
-// src/state.ts
-import { execFile } from "node:child_process";
-import { constants } from "node:fs";
-import {
-  chmod,
-  lstat,
-  mkdir,
-  open,
-  readFile,
-  realpath,
-  rename,
-  rm
-} from "node:fs/promises";
-import {
-  dirname,
-  isAbsolute,
-  join,
-  normalize,
-  parse as parse3,
-  relative,
-  resolve,
-  sep
-} from "node:path";
-import { homedir } from "node:os";
-import { promisify } from "node:util";
-function resolveFinchtechHome(environment3, userHome = homedir()) {
-  const explicit = environment3.FINCHTECH_HOME;
-  if (typeof explicit === "string" && explicit.length > 0) return explicit;
-  return resolve(userHome, ".finchtech");
-}
-function windowsSystemExecutable(name) {
-  const systemRoot = process.env.SystemRoot;
-  if (typeof systemRoot !== "string" || systemRoot.length === 0 || !isAbsolute(systemRoot)) {
-    throw new CliStateError("CLI_STATE_PERMISSIONS_INVALID");
-  }
-  return join(systemRoot, "System32", name);
-}
-async function queryCurrentWindowsSid() {
-  try {
-    const { stdout } = await execFileAsync(
-      windowsSystemExecutable("whoami.exe"),
-      ["/user", "/fo", "csv", "/nh"],
-      { windowsHide: true }
-    );
-    const match = /,"(S-[0-9-]+)"\s*$/u.exec(stdout.trim());
-    if (!match?.[1]) throw new CliStateError("CLI_STATE_PERMISSIONS_INVALID");
-    return match[1];
-  } catch (cause) {
-    if (cause instanceof CliStateError) throw cause;
-    throw new CliStateError("CLI_STATE_PERMISSIONS_INVALID", { cause });
-  }
-}
-function currentWindowsSid() {
-  windowsSidPromise ??= queryCurrentWindowsSid();
-  return windowsSidPromise;
-}
-async function hardenWindows(path2, directory) {
-  const sid = await currentWindowsSid();
-  const permission = directory ? `*${sid}:(OI)(CI)F` : `*${sid}:F`;
-  try {
-    await execFileAsync(
-      windowsSystemExecutable("icacls.exe"),
-      [path2, "/setowner", `*${sid}`],
-      { windowsHide: true }
-    );
-    await execFileAsync(
-      windowsSystemExecutable("icacls.exe"),
-      [path2, "/inheritance:r", "/grant:r", permission],
-      { windowsHide: true }
-    );
-  } catch (cause) {
-    if (cause instanceof CliStateError) throw cause;
-    throw new CliStateError("CLI_STATE_PERMISSIONS_INVALID", { cause });
-  }
-}
-async function verifyWindowsAcl(path2) {
-  const expectedSid = await currentWindowsSid();
-  try {
-    const arguments_ = ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", inspectWindowsAclScript];
-    const options = {
-      env: { ...process.env, FINCHTECH_ACL_PATH: path2 },
-      windowsHide: true
-    };
-    let stdout;
-    try {
-      ({ stdout } = await execFileAsync("pwsh.exe", arguments_, options));
-    } catch {
-      ({ stdout } = await execFileAsync("powershell.exe", arguments_, options));
-    }
-    const inspection = JSON.parse(stdout);
-    const unrelatedRule = inspection.rules.some((rule) => rule.sid !== expectedSid && !WINDOWS_PLATFORM_ADMINISTRATOR_SIDS.has(rule.sid) || rule.type !== "Allow");
-    if (inspection.ownerSid !== expectedSid || !inspection.protected || inspection.rules.length < 1 || inspection.rules.some((rule) => rule.inherited) || unrelatedRule) {
-      throw new CliStateError("CLI_STATE_PERMISSIONS_INVALID");
-    }
-  } catch (cause) {
-    if (cause instanceof CliStateError) throw cause;
-    throw new CliStateError("CLI_STATE_PERMISSIONS_INVALID", { cause });
-  }
-}
-async function harden(path2, directory) {
-  if (process.platform === "win32") {
-    await hardenWindows(path2, directory);
-  } else {
-    await chmod(path2, directory ? 448 : 384);
-  }
-}
-async function writeExclusiveProtectedFile(path2, value) {
-  const target = resolve(path2);
-  const parent = dirname(target);
-  if (!isAbsolute(path2) || parse3(target).root === target) {
-    throw new CliStateError("CLI_STATE_PERMISSIONS_INVALID");
-  }
-  let handle;
-  let created = false;
-  try {
-    await assertSafePathComponents(parent);
-    await defaultPermissionPolicy.verify(parent, true);
-    handle = await open(target, "wx", 384);
-    created = true;
-    const opened = await handle.stat();
-    const pathAfterOpen = await lstat(target);
-    if (!opened.isFile() || opened.nlink !== 1 || !sameIdentity(opened, pathAfterOpen)) {
-      throw new CliStateError("CLI_STATE_PERMISSIONS_INVALID");
-    }
-    await defaultPermissionPolicy.hardenNew(target, false);
-    await defaultPermissionPolicy.verify(target, false);
-    const openedAfterAcl = await handle.stat();
-    const pathAfterAcl = await lstat(target);
-    if (!sameIdentity(opened, openedAfterAcl) || !sameIdentity(opened, pathAfterAcl) || openedAfterAcl.nlink !== 1) {
-      throw new CliStateError("CLI_STATE_PERMISSIONS_INVALID");
-    }
-    await handle.writeFile(value);
-    await handle.sync();
-    await handle.close();
-    handle = void 0;
-    await defaultSyncDirectory(parent);
-  } catch (cause) {
-    await handle?.close().catch(() => void 0);
-    if (cause.code === "EEXIST") {
-      throw new CliStateError("CLI_STATE_CONFLICT", { cause });
-    }
-    if (created) {
-      await rm(target, { force: true }).catch(() => void 0);
-      await defaultSyncDirectory(parent).catch(() => void 0);
-    }
-    throw permissionFailure(cause);
-  }
-}
-async function assertSafeNode(path2, directory) {
-  const metadata = await lstat(path2);
-  if (metadata.isSymbolicLink() || (directory ? !metadata.isDirectory() : !metadata.isFile())) {
-    throw new CliStateError("CLI_STATE_PERMISSIONS_INVALID");
-  }
-  if (!directory && metadata.nlink !== 1) {
-    throw new CliStateError("CLI_STATE_PERMISSIONS_INVALID");
-  }
-  if (process.platform !== "win32") {
-    const expected = directory ? 448 : 384;
-    if ((metadata.mode & 511) !== expected || typeof process.getuid === "function" && metadata.uid !== process.getuid()) {
-      throw new CliStateError("CLI_STATE_PERMISSIONS_INVALID");
-    }
-  } else {
-    await verifyWindowsAcl(path2);
-  }
-}
-async function defaultSyncDirectory(path2) {
-  const handle = await open(path2, process.platform === "win32" ? "r+" : "r");
-  try {
-    await handle.sync();
-  } finally {
-    await handle.close();
-  }
-}
-function samePath(left, right) {
-  const normalizedLeft = normalize(left);
-  const normalizedRight = normalize(right);
-  return process.platform === "win32" ? normalizedLeft.toLowerCase() === normalizedRight.toLowerCase() : normalizedLeft === normalizedRight;
-}
-async function assertSafePathComponents(path2) {
-  const target = resolve(path2);
-  const root = parse3(target).root;
-  let cursor = root;
-  for (const component of relative(root, target).split(sep).filter(Boolean)) {
-    cursor = resolve(cursor, component);
-    const metadata = await lstat(cursor);
-    if (metadata.isSymbolicLink()) {
-      const darwinSystemTarget = process.platform === "darwin" ? DARWIN_SYSTEM_LINK_TARGETS.get(cursor) : void 0;
-      if (darwinSystemTarget === void 0 || !samePath(await realpath(cursor), darwinSystemTarget)) {
-        throw new CliStateError("CLI_STATE_PERMISSIONS_INVALID");
-      }
-    }
-  }
-}
-function permissionFailure(cause) {
-  return cause instanceof CliStateError ? cause : new CliStateError("CLI_STATE_PERMISSIONS_INVALID", { cause });
-}
-function sameIdentity(left, right) {
-  return left.dev === right.dev && left.ino === right.ino;
-}
-async function readProtectedFile(path2, maximumBytes) {
-  const target = resolve(path2);
-  const parent = dirname(target);
-  if (!isAbsolute(path2) || !Number.isInteger(maximumBytes) || maximumBytes < 1) {
-    throw new CliStateError("CLI_STATE_PERMISSIONS_INVALID");
-  }
-  let handle;
-  try {
-    await assertSafePathComponents(parent);
-    await defaultPermissionPolicy.verify(parent, true);
-    const before = await lstat(target);
-    const noFollow = constants.O_NOFOLLOW ?? 0;
-    handle = await open(target, constants.O_RDONLY | noFollow);
-    const opened = await handle.stat();
-    const afterOpen = await lstat(target);
-    if (!sameIdentity(before, opened) || !sameIdentity(opened, afterOpen) || !opened.isFile() || opened.nlink !== 1 || opened.size < 1 || opened.size > maximumBytes) {
-      throw new CliStateError("CLI_STATE_PERMISSIONS_INVALID");
-    }
-    if (process.platform === "win32") {
-      await verifyWindowsAcl(target);
-    } else if ((opened.mode & 511) !== 384 || typeof process.getuid === "function" && opened.uid !== process.getuid()) {
-      throw new CliStateError("CLI_STATE_PERMISSIONS_INVALID");
-    }
-    const afterAcl = await lstat(target);
-    if (!sameIdentity(opened, afterAcl)) throw new CliStateError("CLI_STATE_PERMISSIONS_INVALID");
-    const body = Buffer.alloc(opened.size);
-    let offset = 0;
-    while (offset < body.length) {
-      const chunk = await handle.read(body, offset, body.length - offset, offset);
-      if (chunk.bytesRead === 0) throw new CliStateError("CLI_STATE_PERMISSIONS_INVALID");
-      offset += chunk.bytesRead;
-    }
-    const stable = await handle.stat();
-    if (!sameIdentity(opened, stable) || stable.size !== opened.size) {
-      throw new CliStateError("CLI_STATE_PERMISSIONS_INVALID");
-    }
-    return body;
-  } catch (cause) {
-    throw permissionFailure(cause);
-  } finally {
-    await handle?.close().catch(() => void 0);
-  }
-}
-var execFileAsync, DARWIN_SYSTEM_LINK_TARGETS, CliStateError, windowsSidPromise, WINDOWS_PLATFORM_ADMINISTRATOR_SIDS, inspectWindowsAclScript, defaultPermissionPolicy, HardenedFileStore;
-var init_state = __esm({
-  "src/state.ts"() {
-    "use strict";
-    execFileAsync = promisify(execFile);
-    DARWIN_SYSTEM_LINK_TARGETS = /* @__PURE__ */ new Map([
-      ["/etc", "/private/etc"],
-      ["/tmp", "/private/tmp"],
-      ["/var", "/private/var"]
-    ]);
-    CliStateError = class extends Error {
-      code;
-      diagnostic;
-      constructor(code, options) {
-        super(code, options);
-        this.name = "CliStateError";
-        this.code = code;
-        this.diagnostic = options?.diagnostic ?? null;
-      }
-    };
-    WINDOWS_PLATFORM_ADMINISTRATOR_SIDS = /* @__PURE__ */ new Set([
-      "S-1-5-18",
-      // LocalSystem
-      "S-1-5-32-544"
-      // BUILTIN\Administrators
-    ]);
-    inspectWindowsAclScript = String.raw`
-$ErrorActionPreference = 'Stop'
-$acl = Get-Acl -LiteralPath $env:FINCHTECH_ACL_PATH
-$ownerSid = ([System.Security.Principal.NTAccount]$acl.Owner).Translate([System.Security.Principal.SecurityIdentifier]).Value
-$rules = @($acl.Access | ForEach-Object {
-  $sid = $_.IdentityReference.Translate([System.Security.Principal.SecurityIdentifier]).Value
-  [pscustomobject]@{ sid = $sid; inherited = $_.IsInherited; type = $_.AccessControlType.ToString() }
-})
-[pscustomobject]@{ ownerSid = $ownerSid; protected = $acl.AreAccessRulesProtected; rules = $rules } |
-  ConvertTo-Json -Compress -Depth 4
-`;
-    defaultPermissionPolicy = Object.freeze({
-      hardenNew: harden,
-      verify: assertSafeNode
-    });
-    HardenedFileStore = class {
-      root;
-      permissions;
-      syncDirectory;
-      constructor(root, options = {}) {
-        const resolved = resolve(root);
-        if (!isAbsolute(root) || samePath(resolved, parse3(resolved).root)) {
-          throw new CliStateError("CLI_STATE_PERMISSIONS_INVALID");
-        }
-        this.root = resolved;
-        this.permissions = options.permissions ?? defaultPermissionPolicy;
-        this.syncDirectory = options.syncDirectory ?? defaultSyncDirectory;
-      }
-      resolveRelative(path2) {
-        if (path2.length === 0 || isAbsolute(path2) || path2.includes("\0")) {
-          throw new CliStateError("CLI_STATE_PERMISSIONS_INVALID");
-        }
-        const target = resolve(this.root, path2);
-        const fromRoot = relative(this.root, target);
-        if (fromRoot === ".." || fromRoot.startsWith(`..${sep}`) || isAbsolute(fromRoot)) {
-          throw new CliStateError("CLI_STATE_PERMISSIONS_INVALID");
-        }
-        return target;
-      }
-      async ensureDirectory(path2) {
-        try {
-          const metadata = await lstat(path2);
-          if (metadata.isSymbolicLink() || !metadata.isDirectory()) {
-            throw new CliStateError("CLI_STATE_PERMISSIONS_INVALID");
-          }
-          await assertSafePathComponents(path2);
-          await this.permissions.verify(path2, true);
-          return;
-        } catch (cause) {
-          if (cause.code !== "ENOENT") throw permissionFailure(cause);
-        }
-        const parent = dirname(path2);
-        await assertSafePathComponents(parent);
-        let created = false;
-        try {
-          await mkdir(path2, { recursive: false, mode: 448 });
-          created = true;
-          await this.permissions.hardenNew(path2, true);
-          await this.permissions.verify(path2, true);
-          await this.syncDirectory(parent);
-        } catch (cause) {
-          if (created) {
-            await rm(path2, { recursive: true, force: true }).catch(() => void 0);
-            await this.syncDirectory(parent).catch(() => void 0);
-          }
-          throw permissionFailure(cause);
-        }
-      }
-      async ensureParent(target) {
-        await this.ensureDirectory(this.root);
-        const parent = resolve(target, "..");
-        const fromRoot = relative(this.root, parent);
-        let cursor = this.root;
-        for (const component of fromRoot.split(sep).filter(Boolean)) {
-          cursor = resolve(cursor, component);
-          await this.ensureDirectory(cursor);
-        }
-      }
-      async writeSecret(path2, value, options) {
-        if (!options.exclusive) throw new CliStateError("CLI_STATE_PERMISSIONS_INVALID");
-        const target = this.resolveRelative(path2);
-        await this.ensureParent(target);
-        let handle;
-        let created = false;
-        try {
-          handle = await open(target, "wx", 384);
-          created = true;
-          await this.permissions.hardenNew(target, false);
-          await this.permissions.verify(target, false);
-          await handle.writeFile(value);
-          await handle.sync();
-          await handle.close();
-          handle = void 0;
-          await this.syncDirectory(dirname(target));
-        } catch (cause) {
-          await handle?.close().catch(() => void 0);
-          if (cause.code === "EEXIST") {
-            throw new CliStateError("CLI_STATE_CONFLICT", { cause });
-          }
-          if (created) {
-            await rm(target, { force: true }).catch(() => void 0);
-            await this.syncDirectory(dirname(target)).catch(() => void 0);
-          }
-          throw permissionFailure(cause);
-        }
-      }
-      async writeJson(path2, value) {
-        const target = this.resolveRelative(path2);
-        const temporary = `${target}.tmp-${process.pid}-${Date.now()}`;
-        await this.ensureParent(target);
-        try {
-          await this.writeSecret(relative(this.root, temporary), Buffer.from(`${JSON.stringify(value)}
-`, "utf8"), {
-            exclusive: true
-          });
-          try {
-            await lstat(target);
-            await this.permissions.verify(target, false);
-          } catch (cause) {
-            if (cause.code !== "ENOENT") throw cause;
-          }
-          await rename(temporary, target);
-          await this.permissions.verify(target, false);
-          await this.syncDirectory(dirname(target));
-        } catch (cause) {
-          await rm(temporary, { force: true }).catch(() => void 0);
-          throw cause;
-        }
-      }
-      async readSecret(path2) {
-        const target = this.resolveRelative(path2);
-        try {
-          await this.permissions.verify(target, false);
-          return await readFile(target);
-        } catch (cause) {
-          if (cause.code === "ENOENT") {
-            throw new CliStateError("CLI_STATE_NOT_FOUND", { cause });
-          }
-          if (cause instanceof CliStateError) throw cause;
-          throw new CliStateError("CLI_STATE_PERMISSIONS_INVALID", { cause });
-        }
-      }
-      async readJson(path2) {
-        try {
-          return JSON.parse((await this.readSecret(path2)).toString("utf8"));
-        } catch (cause) {
-          if (cause instanceof CliStateError && cause.code !== "CLI_STATE_CORRUPT") throw cause;
-          throw new CliStateError("CLI_STATE_CORRUPT", { cause });
-        }
-      }
-      async remove(path2, options = {}) {
-        const target = this.resolveRelative(path2);
-        await rm(target, { force: true, recursive: options.recursive ?? false });
-        await this.syncDirectory(dirname(target)).catch((cause) => {
-          if (cause.code !== "ENOENT") throw cause;
-        });
-      }
-    };
-  }
-});
-
 // src/skill-local-flow.ts
 import { createHash } from "node:crypto";
 import { lstat as lstat2, readFile as readFile2, readdir } from "node:fs/promises";
@@ -56262,15 +56325,6 @@ function assetPlan(value, walletAddress2) {
   }
   return { chainId, skillId, acceptedMediaTypes: accepted, maxBytes: plan.maxBytes };
 }
-function coverMediaType(bytes) {
-  const png = [137, 80, 78, 71, 13, 10, 26, 10];
-  if (bytes.length >= 8 && png.every((byte, index2) => bytes[index2] === byte)) return "image/png";
-  if (bytes.length >= 3 && bytes[0] === 255 && bytes[1] === 216 && bytes[2] === 255) return "image/jpeg";
-  const head = new TextDecoder().decode(bytes.slice(0, 12));
-  if (head.startsWith("GIF87a") || head.startsWith("GIF89a")) return "image/gif";
-  if (head.startsWith("RIFF") && head.slice(8, 12) === "WEBP") return "image/webp";
-  return null;
-}
 function isPlaintextSkillDelivery(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value) && value.plaintext === true;
 }
@@ -57147,7 +57201,7 @@ var init_skill_local_flow = __esm({
         if (!stat.isFile() || stat.isSymbolicLink()) throw new TypeError("Skill cover path must be one regular file.");
         if (stat.size < 1 || stat.size > plan.maxBytes) throw new TypeError("Skill cover size is outside the prepared bound.");
         const bytes = new Uint8Array(await readFile2(absolute));
-        const mediaType = coverMediaType(bytes);
+        const mediaType = detectedImageMediaType(bytes);
         if (mediaType === null || !plan.acceptedMediaTypes.includes(mediaType)) {
           throw new TypeError("Skill cover bytes do not match an accepted image type.");
         }
@@ -58100,32 +58154,89 @@ var init_application = __esm({
         return result2;
       }
       async doctorMcp() {
-        const profile = await this.authorizedProfile();
-        const session = await this.networkSession(profile);
-        const wallet = await required3(this.state.readWalletAddress, "state.readWalletAddress").call(this.state);
-        const remoteSession = asObject(await required3(this.api.getSession, "api.getSession").call(this.api, session.rawBearer), "MCP doctor Session");
-        if (remoteSession.sessionId !== session.sessionId || remoteSession.accountId !== session.accountId || remoteSession.walletAddress !== session.walletAddress || wallet.walletAddress !== session.walletAddress || remoteSession.environment !== session.environment || remoteSession.audience !== "agent_cli" || typeof remoteSession.sessionExpiresAt !== "string" || Date.parse(remoteSession.sessionExpiresAt) <= Date.now()) {
-          throw new TypeError("MCP doctor Session authority does not match the active wallet and profile.");
-        }
-        const mcp = await required3(this.api.inspectRemoteMcp, "api.inspectRemoteMcp").call(this.api);
-        if (mcp.url !== `${profile.origin}/mcp` || mcp.authorization !== "oauth" || JSON.stringify(mcp.supportedClients) !== JSON.stringify(["codex"])) {
-          throw new TypeError("MCP doctor discovery does not match the authoritative profile.");
-        }
+        const inspect = async (run, guidance) => {
+          try {
+            const value = await run();
+            return [value, { status: "ok" }];
+          } catch (cause) {
+            if (cause instanceof CliStateError) {
+              return [null, {
+                status: cause.code === "CLI_STATE_NOT_FOUND" ? "missing" : "invalid",
+                message: localFailureMessage(cause)
+              }];
+            } else if (cause instanceof CliHttpError) {
+              return [null, { status: cause.status === 401 || cause.status === 403 || cause.code === "CLI_RESPONSE_INVALID" ? "invalid" : "unavailable", message: guidance }];
+            } else if (cause instanceof TypeError || cause instanceof CliAuthorityError) {
+              return [null, { status: "invalid", message: guidance }];
+            } else {
+              throw cause;
+            }
+          }
+        };
+        const [profile, endpointCheck] = await inspect(
+          () => this.authorizedProfile(),
+          "Check the protected FINCHTECH_HOME/profile.json endpoint override."
+        );
+        const [wallet, walletCheck] = await inspect(
+          () => required3(this.state.readWalletAddress, "state.readWalletAddress").call(this.state),
+          "Restore the current wallet from backup."
+        );
+        const [session, sessionCheck] = await inspect(
+          () => required3(this.state.readSession, "state.readSession").call(this.state),
+          "Run finch logout --local, then finch login --help to log in again."
+        );
+        let remoteSession = null;
+        let remoteSessionCheck;
+        if (profile !== null && session !== null && wallet !== null) {
+          [remoteSession, remoteSessionCheck] = await inspect(async () => {
+            if (session.origin !== profile.origin || wallet.walletAddress !== session.walletAddress) {
+              throw new CliAuthorityError();
+            }
+            const remote = asObject(await required3(this.api.getSession, "api.getSession").call(this.api, session.rawBearer), "MCP doctor Session");
+            if (remote.sessionId !== session.sessionId || remote.accountId !== session.accountId || remote.walletAddress !== session.walletAddress || remote.environment !== session.environment || remote.audience !== "agent_cli" || typeof remote.sessionExpiresAt !== "string" || !Number.isFinite(Date.parse(remote.sessionExpiresAt)) || Date.parse(remote.sessionExpiresAt) <= Date.now()) throw new CliAuthorityError();
+            return { sessionExpiresAt: remote.sessionExpiresAt };
+          }, "Verify the endpoint and current wallet, then run finch login --help to renew the CLI login. If the server is unavailable, retry later.");
+        } else {
+          remoteSessionCheck = { status: "skipped", message: "Requires a valid endpoint, local wallet, and CLI Session." };
+        }
+        let mcp = null;
+        let mcpDiscoveryCheck;
+        if (profile !== null) {
+          [mcp, mcpDiscoveryCheck] = await inspect(async () => {
+            const discovery = await required3(this.api.inspectRemoteMcp, "api.inspectRemoteMcp").call(this.api);
+            if (discovery.url !== `${profile.origin}/mcp` || discovery.authorization !== "oauth" || JSON.stringify(discovery.supportedClients) !== JSON.stringify(["codex"])) {
+              throw new TypeError("MCP discovery authority mismatch.");
+            }
+            return discovery;
+          }, "Check endpoint connectivity and MCP OAuth discovery configuration, then retry finch mcp doctor.");
+        } else {
+          mcpDiscoveryCheck = { status: "skipped", message: "Requires a valid endpoint." };
+        }
+        const checks = {
+          endpoint: endpointCheck,
+          wallet: walletCheck,
+          session: sessionCheck,
+          remoteSession: remoteSessionCheck,
+          mcpDiscovery: mcpDiscoveryCheck
+        };
         return Object.freeze({
-          ready: true,
+          ready: Object.values(checks).every((check2) => check2.status === "ok"),
           readinessScope: "cli_session_and_mcp_discovery",
-          harnessOAuth: Object.freeze({
+          checks,
+          harnessOAuth: {
             status: "not_checked",
             guidance: "Verify the connected MCP identity with identity_actor_get and compare it with finch status. If the Harness reports missing or expired OAuth credentials, reauthorize through its native MCP login flow."
-          }),
-          environment: session.environment,
-          origin: profile.origin,
-          loginChainId: session.loginChainId,
-          accountId: session.accountId,
-          walletAddress: session.walletAddress,
-          sessionId: session.sessionId,
-          sessionExpiresAt: remoteSession.sessionExpiresAt,
-          mcp
+          },
+          ...profile === null ? {} : { origin: profile.origin },
+          ...wallet === null ? {} : { walletAddress: wallet.walletAddress },
+          ...session === null ? {} : {
+            environment: session.environment,
+            loginChainId: session.loginChainId,
+            accountId: session.accountId,
+            sessionId: session.sessionId
+          },
+          ...remoteSession === null ? {} : { sessionExpiresAt: remoteSession.sessionExpiresAt },
+          ...mcp === null ? {} : { mcp }
         });
       }
       async assertNoBlockingRecoveries() {
@@ -58185,7 +58296,16 @@ var init_application = __esm({
           throw new TypeError("wallet use requires exactly one registered address or --file path.");
         }
         await this.assertNoBlockingRecoveries();
-        const current = await required3(this.state.readWallet, "state.readWallet").call(this.state);
+        let current;
+        try {
+          current = await required3(this.state.readWallet, "state.readWallet").call(this.state);
+        } catch (cause) {
+          if (!(cause instanceof CliStateError) || cause.code !== "CLI_STATE_NOT_FOUND" || input.file === void 0) throw cause;
+          const wallets = await required3(this.state.listWalletAddresses, "state.listWalletAddresses").call(this.state);
+          if (wallets.length !== 0) throw new CliStateError("CLI_STATE_CORRUPT", { cause, diagnostic: "wallet" });
+          await required3(this.state.assertWalletBootstrap, "state.assertWalletBootstrap").call(this.state);
+          return required3(this.state.importWallet, "state.importWallet").call(this.state, input.file);
+        }
         const target = input.file === void 0 ? { walletAddress: normalizeCliEvmAddress(input.address, "Wallet address") } : await required3(this.state.importWallet, "state.importWallet").call(this.state, input.file);
         if (!/^0x[0-9a-f]{40}$/u.test(target.walletAddress)) throw new TypeError("Wallet address is invalid.");
         if (input.file === void 0) {
@@ -58937,7 +59057,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@finchtech/cli",
-      version: "0.3.3",
+      version: "0.3.5",
       description: "Finch Agent CLI for wallet-owned marketplace and MCP workflows.",
       type: "module",
       bin: {
@@ -59066,7 +59186,11 @@ async function routeCommand(arguments_, application) {
       return Object.freeze({
         command: "help",
         topic: commandTopic,
-        usage: FINCH_COMMAND_USAGE[commandTopic]
+        usage: FINCH_COMMAND_USAGE[commandTopic],
+        ...commandTopic === "login" ? {
+          authenticationChainIds: PRODUCTION_AUTH_CHAIN_IDS,
+          guidance: "Choose an authentication chain, for example finch login --chain-id 56. The server validates support; market transaction chains are independent."
+        } : {}
       });
     }
     const commands = FINCH_COMMANDS.filter((command) => command.startsWith(`${topic} `));
@@ -59422,6 +59546,7 @@ var init_command_router = __esm({
   "src/command-router.ts"() {
     "use strict";
     init_package();
+    init_v1();
     FINCH_COMMANDS = Object.freeze([
       "wallet create",
       "wallet show",
@@ -59899,7 +60024,14 @@ var init_wallet_store = __esm({
         await this.migrateLegacy();
         const current = record4(await this.files.readJson("wallet/current.json"));
         if (current.version !== 1) throw new CliStateError("CLI_STATE_CORRUPT");
-        return this.readRegistered(walletAddress(current.walletAddress));
+        try {
+          return await this.readRegistered(walletAddress(current.walletAddress));
+        } catch (cause) {
+          if (cause instanceof CliStateError && cause.code === "CLI_STATE_NOT_FOUND") {
+            throw new CliStateError("CLI_STATE_CORRUPT", { cause });
+          }
+          throw cause;
+        }
       }
       async readCurrentAddress() {
         const current = await this.readCurrent();
@@ -59911,6 +60043,8 @@ var init_wallet_store = __esm({
 
 // src/local-state.ts
 import { createHash as createHash4, randomBytes as randomBytes2 } from "node:crypto";
+import { lstat as lstat3 } from "node:fs/promises";
+import { join as join3 } from "node:path";
 function object5(value, name) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) {
     throw new CliStateError("CLI_STATE_CORRUPT", { cause: new TypeError(`${name} must be an object.`) });
@@ -60183,10 +60317,27 @@ var init_local_state = __esm({
         await this.wallets.register(input);
       }
       async readWallet() {
-        return this.wallets.readCurrent();
+        try {
+          return await this.wallets.readCurrent();
+        } catch (cause) {
+          if (cause instanceof CliStateError) throw new CliStateError(cause.code, { cause, diagnostic: "wallet" });
+          throw cause;
+        }
       }
       async readWalletAddress() {
-        return this.wallets.readCurrentAddress();
+        const wallet = await this.readWallet();
+        return Object.freeze({ walletAddress: wallet.walletAddress });
+      }
+      async assertWalletBootstrap() {
+        for (const path2 of ["session", "grants"]) {
+          try {
+            await lstat3(join3(this.files.root, path2));
+          } catch (cause) {
+            if (cause.code === "ENOENT") continue;
+            throw cause;
+          }
+          throw new CliStateError("CLI_STATE_CONFLICT", { diagnostic: "wallet_bootstrap" });
+        }
       }
       async importWallet(path2) {
         return this.wallets.importFromFile(path2);
@@ -61985,7 +62136,7 @@ async function resolveInstalledProfile(readProfile) {
 }
 function commandNeedsHttp(arguments_) {
   if (arguments_.length === 0 || arguments_.length === 1 && ["--help", "help", "--version"].includes(arguments_[0]) || arguments_[0] === "help" && arguments_.length > 1 || arguments_.length > 1 && arguments_.at(-1) === "--help" && arguments_.filter((argument) => argument === "--help").length === 1) return false;
-  return arguments_[0] !== "wallet" && !(arguments_.length === 2 && arguments_[0] === "logout" && arguments_[1] === "--local");
+  return (arguments_[0] !== "wallet" || arguments_[1] === "use") && !(arguments_.length === 2 && arguments_[0] === "logout" && arguments_[1] === "--local");
 }
 async function runInstalledCli(arguments_, environment3 = process.env, authorities = {}) {
   const profileFree = arguments_.length === 0 || arguments_.length === 1 && ["--help", "help", "--version"].includes(arguments_[0]) || arguments_[0] === "help" && arguments_.length > 1 || arguments_.length > 1 && arguments_.at(-1) === "--help" && arguments_.filter((argument) => argument === "--help").length === 1;
@@ -61993,7 +62144,14 @@ async function runInstalledCli(arguments_, environment3 = process.env, authoriti
   const home = resolveFinchtechHome(environment3);
   const state = new LocalCliState(home);
   const needsHttp = commandNeedsHttp(arguments_);
-  const profile = needsHttp ? await resolveInstalledProfile(async () => state.readProfile()) : void 0;
+  let profile;
+  if (needsHttp) {
+    try {
+      profile = await resolveInstalledProfile(async () => state.readProfile());
+    } catch (cause) {
+      if (!(cause instanceof CliStateError) || arguments_.length !== 2 || arguments_[0] !== "mcp" || arguments_[1] !== "doctor") throw cause;
+    }
+  }
   const api = profile === void 0 ? {} : new AgentCliHttpClient(profile.origin);
   const signer = new InstalledWalletSigner();
   const skillIntentSender = profile === void 0 || arguments_[0] !== "skill" ? void 0 : new InstalledSkillIntentSender();
@@ -62043,37 +62201,6 @@ function remoteExitCode(status) {
   }
   return AGENT_CLI_OUTPUT_CONTRACT.exitCodes.remoteOrProviderUnavailable;
 }
-function localFailureMessage(error51) {
-  if (error51 instanceof CliStateError) {
-    if (error51.code === "CLI_STATE_PERMISSIONS_INVALID") {
-      return process.platform === "win32" ? "Protected local state has unsafe ownership or ACLs. Restrict it to the current Windows user and retry." : "Protected local state has unsafe permissions. Directories must be mode 0700 and files mode 0600.";
-    }
-    if (error51.diagnostic === "profile") {
-      return error51.code === "CLI_STATE_NOT_FOUND" ? "Finch endpoint override is missing. Remove the override to use PROD, or provision protected FINCHTECH_HOME/profile.json." : "Finch endpoint override is invalid. Remove it to use PROD, or reprovision protected FINCHTECH_HOME/profile.json.";
-    }
-    if (error51.diagnostic === "session") {
-      return error51.code === "CLI_STATE_NOT_FOUND" ? "No active Finch login was found. Run finch login --chain-id <SUPPORTED_AUTH_CHAIN_ID>." : "The active Finch login is invalid. Run finch logout --local, then finch login --chain-id <SUPPORTED_AUTH_CHAIN_ID>.";
-    }
-    if (error51.code === "CLI_STATE_NOT_FOUND") {
-      return "Required protected local state is missing. Check the command prerequisites and retry.";
-    }
-    if (error51.code === "CLI_STATE_CONFLICT") {
-      return "Protected local state already exists or changed concurrently. Refresh state and retry.";
-    }
-    return "Protected local state is corrupt. Recreate the affected profile, login, grant, or recovery state.";
-  }
-  if (error51.message === "FINCHTECH_HOME is required.") {
-    return "FINCHTECH_HOME is required. Set it to the protected Finch Agent CLI state directory.";
-  }
-  const missingScope = /^No active MCP grant with ([a-z_:]+) is available for this account and endpoint\.$/u.exec(error51.message);
-  if (missingScope !== null) {
-    return `Required MCP grant scope ${missingScope[1]} is missing. Create or refresh that scoped grant.`;
-  }
-  if (/^The selected .* MCP grant is invalid\.$/u.test(error51.message)) {
-    return "The selected MCP grant is invalid. Recreate the grant for the active account and endpoint.";
-  }
-  return "Command input does not match the expected schema. Check finch help for this command.";
-}
 function failure(error51) {
   if (error51 instanceof CliSkillSourceError) {
     return {
@@ -62123,6 +62250,9 @@ function emitCliOutcome(outcome, sinks) {
   if (!(outcome instanceof Error)) {
     sinks.stdout(`${JSON.stringify(outcome)}
 `);
+    if (typeof outcome === "object" && outcome !== null && "command" in outcome && outcome.command === "mcp.doctor" && "data" in outcome && typeof outcome.data === "object" && outcome.data !== null && "ready" in outcome.data && outcome.data.ready === false) {
+      return AGENT_CLI_OUTPUT_CONTRACT.exitCodes.usageOrLocalSchema;
+    }
     return AGENT_CLI_OUTPUT_CONTRACT.exitCodes.success;
   }
   if (outcome instanceof CliSkillPublicationError) {