@ftptech/canton-agent-wallet 0.1.4 → 0.1.6

package/README.md

@@ -70,12 +70,16 @@ then retries the request with the on-ledger proof.
   commands that talk to a relay (`create`, `pay`); there is intentionally no
   built-in default (a stale default would silently send payments to a dead
   host). Supply it here or via `--relay-url <url>`. The current FTP facilitator
-  is `http://46.225.91.251:4022` (plain HTTP, by IP — a TLS domain such as
-  `facilitator.ftptech.xyz` is planned but not yet live).
+  is `https://facilitator.ftptech.xyz`.
 - `CANTON_AGENT_NETWORK` — `canton:testnet` (default) or `canton:mainnet`; also
   settable via `--network <net>`.
 - `CANTON_AGENT_API_KEY` — only if the relay requires one (sent as the
   `X-Agent-Key` header).
+- `HTTPS_PROXY` / `HTTP_PROXY` (or `ALL_PROXY`) — if set, the CLI routes all
+  relay calls through that proxy. Node's `fetch` does NOT honor these on its
+  own, so behind a corporate/regional proxy you must set one of them or every
+  call fails with `fetch failed`. Credentials are supported
+  (`http://user:pass@host:port`) and never logged.
 - `CANTON_AGENT_HOME` — override the wallet directory (default `~/.canton-agent`;
   used by tests and power users).
 

package/dist/cli-args.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-args.d.ts","sourceRoot":"","sources":["../src/cli-args.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,eAAO,MAAM,eAAe,mBAAmB,CAAC;AAEhD,8EAA8E;AAC9E,eAAO,MAAM,WAAW,EAAE,WAAW,CAAC,MAAM,CAK1C,CAAC;AAEH,gEAAgE;AAChE,wBAAgB,IAAI,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG9E;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAW7D;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,SAAS,CAEpB;AAED,+EAA+E;AAC/E,wBAAgB,cAAc,CAC5B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAER;AAED,iEAAiE;AACjE,eAAO,MAAM,kBAAkB,QAGwD,CAAC"}
+{"version":3,"file":"cli-args.d.ts","sourceRoot":"","sources":["../src/cli-args.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,eAAO,MAAM,eAAe,mBAAmB,CAAC;AAEhD,8EAA8E;AAC9E,eAAO,MAAM,WAAW,EAAE,WAAW,CAAC,MAAM,CAK1C,CAAC;AAEH,gEAAgE;AAChE,wBAAgB,IAAI,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG9E;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAW7D;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,SAAS,CAEpB;AAED,+EAA+E;AAC/E,wBAAgB,cAAc,CAC5B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAER;AAED,iEAAiE;AACjE,eAAO,MAAM,kBAAkB,QAEkD,CAAC"}

package/dist/cli-args.js

@@ -51,6 +51,5 @@ export function resolveNetwork(args, env = process.env) {
 }
 /** Message shown when no relay URL is supplied (flag or env). */
 export const MISSING_RELAY_HELP = "no relay URL — pass --relay-url <url> or set CANTON_AGENT_RELAY_URL.\n" +
-    "  e.g. canton-agent-wallet create --relay-url http://46.225.91.251:4022\n" +
-    "  (the FTP facilitator is currently plain HTTP by IP; a TLS domain is not yet live)";
+    "  e.g. canton-agent-wallet create --relay-url https://facilitator.ftptech.xyz";
 //# sourceMappingURL=cli-args.js.map

package/dist/cli-args.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli-args.js","sourceRoot":"","sources":["../src/cli-args.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,gBAAgB,CAAC;AAEhD,8EAA8E;AAC9E,MAAM,CAAC,MAAM,WAAW,GAAwB,IAAI,GAAG,CAAC;IACtD,aAAa;IACb,WAAW;IACX,MAAM;IACN,UAAU;CACX,CAAC,CAAC;AAEH,gEAAgE;AAChE,MAAM,UAAU,IAAI,CAAC,IAAuB,EAAE,IAAY;IACxD,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,IAAuB;IACjD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QAC5B,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACvB,CAAC,IAAI,CAAC,CAAC,CAAC,yBAAyB;YACjC,SAAS;QACX,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAuB,EACvB,MAAyB,OAAO,CAAC,GAAG;IAEpC,OAAO,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,IAAI,GAAG,CAAC,sBAAsB,IAAI,SAAS,CAAC;AAC9E,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,cAAc,CAC5B,IAAuB,EACvB,MAAyB,OAAO,CAAC,GAAG;IAEpC,OAAO,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,GAAG,CAAC,oBAAoB,IAAI,eAAe,CAAC;AAChF,CAAC;AAED,iEAAiE;AACjE,MAAM,CAAC,MAAM,kBAAkB,GAC7B,wEAAwE;IACxE,2EAA2E;IAC3E,qFAAqF,CAAC"}
+{"version":3,"file":"cli-args.js","sourceRoot":"","sources":["../src/cli-args.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,gBAAgB,CAAC;AAEhD,8EAA8E;AAC9E,MAAM,CAAC,MAAM,WAAW,GAAwB,IAAI,GAAG,CAAC;IACtD,aAAa;IACb,WAAW;IACX,MAAM;IACN,UAAU;CACX,CAAC,CAAC;AAEH,gEAAgE;AAChE,MAAM,UAAU,IAAI,CAAC,IAAuB,EAAE,IAAY;IACxD,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,IAAuB;IACjD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QAC5B,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACvB,CAAC,IAAI,CAAC,CAAC,CAAC,yBAAyB;YACjC,SAAS;QACX,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAuB,EACvB,MAAyB,OAAO,CAAC,GAAG;IAEpC,OAAO,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,IAAI,GAAG,CAAC,sBAAsB,IAAI,SAAS,CAAC;AAC9E,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,cAAc,CAC5B,IAAuB,EACvB,MAAyB,OAAO,CAAC,GAAG;IAEpC,OAAO,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,GAAG,CAAC,oBAAoB,IAAI,eAAe,CAAC;AAChF,CAAC;AAED,iEAAiE;AACjE,MAAM,CAAC,MAAM,kBAAkB,GAC7B,wEAAwE;IACxE,+EAA+E,CAAC"}

package/dist/cli.js

@@ -14,10 +14,12 @@
  * relay (`create`, `pay`). There is intentionally no built-in default — a
  * wrong/stale default would silently send an agent's payments to a dead host.
  * Supply it via `--relay-url <url>` or the `CANTON_AGENT_RELAY_URL` env var.
- * The current FTP facilitator is `http://46.225.91.251:4022` (plain HTTP, by
- * IP — a TLS domain is planned but not yet live). `address`, `balance`,
- * `claim`, `withdraw` and `export` reuse the relay stored in the wallet at
- * `create` time and do not need the flag.
+ * The current FTP facilitator is `https://facilitator.ftptech.xyz`. `address`,
+ * `balance`, `claim`, `withdraw` and `export` reuse the relay stored in the
+ * wallet at `create` time and do not need the flag.
+ *
+ * Behind a proxy? Node's fetch ignores HTTP(S)_PROXY by default; this CLI wires
+ * an undici ProxyAgent when HTTPS_PROXY/HTTP_PROXY/ALL_PROXY is set (see proxy.ts).
  *
  * Config via env: CANTON_AGENT_RELAY_URL, CANTON_AGENT_NETWORK,
  * CANTON_AGENT_API_KEY. Wallet lives at ~/.canton-agent/wallet.json (0600).
@@ -29,6 +31,7 @@ import { makePayingFetch } from "./pay.js";
 import { RelayClient } from "./relay-client.js";
 import { claimAll } from "./tx.js";
 import { withdraw } from "./withdraw.js";
+import { installProxyFromEnv } from "./proxy.js";
 import { flag, positionals, resolveNetwork, resolveRelayUrl, MISSING_RELAY_HELP, } from "./cli-args.js";
 const API_KEY = process.env.CANTON_AGENT_API_KEY;
 function fail(msg) {
@@ -40,6 +43,12 @@ function requireRelay(args) {
     return resolveRelayUrl(args) ?? fail(MISSING_RELAY_HELP);
 }
 async function main() {
+    // Route outbound fetch through HTTP(S)_PROXY when set — node's fetch does not
+    // honor those env vars on its own, so an agent behind a proxy would otherwise
+    // see every relay call fail with an opaque `fetch failed`.
+    const proxy = installProxyFromEnv(process.env);
+    if (proxy)
+        console.error(`(using proxy ${proxy})`);
     const [cmd, ...args] = process.argv.slice(2);
     switch (cmd) {
         case "create": {
@@ -82,10 +91,14 @@ async function main() {
             const url = positionals(args)[0];
             if (!url)
                 return fail("usage: canton-agent-wallet pay [--relay-url <url>] <url>");
-            const relayUrl = requireRelay(args);
+            // Reuse the wallet's stored relay (like claim/balance) when neither
+            // --relay-url nor CANTON_AGENT_RELAY_URL is given, so an already-created
+            // agent can pay without re-specifying the relay each time.
+            const existing = loadWallet();
+            const relayUrl = resolveRelayUrl(args) ?? existing?.relayUrl ?? fail(MISSING_RELAY_HELP);
             const f = await makePayingFetch({
                 relayUrl,
-                network: resolveNetwork(args),
+                network: existing?.network ?? resolveNetwork(args),
                 apiKey: API_KEY,
             });
             const res = await f(url);
@@ -117,7 +130,25 @@ async function main() {
     }
 }
 main().catch((e) => {
-    console.error("error:", e instanceof Error ? e.message : String(e));
+    const msg = e instanceof Error ? e.message : String(e);
+    // Surface the underlying cause — node's `fetch failed` is opaque without it;
+    // the cause carries the real reason (ENOTFOUND / ECONNREFUSED / proxy auth).
+    const rawCause = e && typeof e === "object" && "cause" in e
+        ? e.cause
+        : undefined;
+    const causeMsg = rawCause instanceof Error
+        ? rawCause.message
+        : rawCause != null
+            ? String(rawCause)
+            : "";
+    console.error("error:", causeMsg ? `${msg} (cause: ${causeMsg})` : msg);
+    // Network-reachability hint: the most common real-world failure is a proxy /
+    // blocked egress, which the env-proxy support above fixes once configured.
+    if (/fetch failed|ENOTFOUND|ECONNREFUSED|ETIMEDOUT|EAI_AGAIN|UND_ERR/i.test(`${msg} ${causeMsg}`)) {
+        console.error("  could not reach the relay. If you are behind a proxy, export HTTPS_PROXY " +
+            "(e.g. HTTPS_PROXY=http://user:pass@host:port) — the CLI routes through it. " +
+            "Otherwise verify the relay URL is reachable from this machine (try: curl <relay-url>/health).");
+    }
     process.exit(1);
 });
 //# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,+EAA+E;AAC/E,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EACL,IAAI,EACJ,WAAW,EACX,cAAc,EACd,eAAe,EACf,kBAAkB,GACnB,MAAM,eAAe,CAAC;AAEvB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;AAEjD,SAAS,IAAI,CAAC,GAAW;IACvB,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,oEAAoE;AACpE,SAAS,YAAY,CAAC,IAAc;IAClC,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,kBAAkB,CAAC,CAAC;AAC3D,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7C,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YACpC,MAAM,CAAC,GAAG,MAAM,YAAY,CAAC;gBAC3B,QAAQ;gBACR,OAAO,EAAE,cAAc,CAAC,IAAI,CAAC;gBAC7B,MAAM,EAAE,OAAO;aAChB,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,CACT,iBAAiB,CAAC,CAAC,OAAO,KAAK;gBAC7B,cAAc,CAAC,CAAC,KAAK,IAAI;gBACzB,4EAA4E;gBAC5E,4EAA4E,CAC/E,CAAC;YACF,MAAM;QACR,CAAC;QACD,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,CAAC,GAAG,UAAU,EAAE,CAAC;YACvB,IAAI,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC,iDAAiD,CAAC,CAAC;YACvE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACrB,MAAM;QACR,CAAC;QACD,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,CAAC,GAAG,UAAU,EAAE,CAAC;YACvB,IAAI,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC,iDAAiD,CAAC,CAAC;YACvE,MAAM,CAAC,GAAG,MAAM,IAAI,WAAW,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAC5F,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,MAAM,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;YAC7E,MAAM;QACR,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,CAAC,GAAG,UAAU,EAAE,CAAC;YACvB,IAAI,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC,iDAAiD,CAAC,CAAC;YACvE,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,IAAI,WAAW,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YACxF,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,OAAO,uBAAuB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;YAC1F,MAAM;QACR,CAAC;QACD,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACjC,IAAI,CAAC,GAAG;gBACN,OAAO,IAAI,CAAC,0DAA0D,CAAC,CAAC;YAC1E,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YACpC,MAAM,CAAC,GAAG,MAAM,eAAe,CAAC;gBAC9B,QAAQ;gBACR,OAAO,EAAE,cAAc,CAAC,IAAI,CAAC;gBAC7B,MAAM,EAAE,OAAO;aAChB,CAAC,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;YAC/C,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YAC9B,MAAM;QACR,CAAC;QACD,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC9B,IAAI,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC,kEAAkE,CAAC,CAAC;YACzF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YACtC,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;YACjF,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM,UAAU,EAAE,iBAAiB,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC3E,MAAM;QACR,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,CAAC,GAAG,UAAU,EAAE,CAAC;YACvB,IAAI,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC,iDAAiD,CAAC,CAAC;YACvE,OAAO,CAAC,KAAK,CACX,oFAAoF,CACrF,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;YAClC,MAAM;QACR,CAAC;QACD;YACE,OAAO,CAAC,KAAK,CACX,wGAAwG;gBACtG,8EAA8E,CACjF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE;IAC1B,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,+EAA+E;AAC/E,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EACL,IAAI,EACJ,WAAW,EACX,cAAc,EACd,eAAe,EACf,kBAAkB,GACnB,MAAM,eAAe,CAAC;AAEvB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;AAEjD,SAAS,IAAI,CAAC,GAAW;IACvB,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,oEAAoE;AACpE,SAAS,YAAY,CAAC,IAAc;IAClC,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,kBAAkB,CAAC,CAAC;AAC3D,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,8EAA8E;IAC9E,8EAA8E;IAC9E,2DAA2D;IAC3D,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,KAAK;QAAE,OAAO,CAAC,KAAK,CAAC,gBAAgB,KAAK,GAAG,CAAC,CAAC;IAEnD,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7C,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YACpC,MAAM,CAAC,GAAG,MAAM,YAAY,CAAC;gBAC3B,QAAQ;gBACR,OAAO,EAAE,cAAc,CAAC,IAAI,CAAC;gBAC7B,MAAM,EAAE,OAAO;aAChB,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,CACT,iBAAiB,CAAC,CAAC,OAAO,KAAK;gBAC7B,cAAc,CAAC,CAAC,KAAK,IAAI;gBACzB,4EAA4E;gBAC5E,4EAA4E,CAC/E,CAAC;YACF,MAAM;QACR,CAAC;QACD,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,CAAC,GAAG,UAAU,EAAE,CAAC;YACvB,IAAI,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC,iDAAiD,CAAC,CAAC;YACvE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACrB,MAAM;QACR,CAAC;QACD,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,CAAC,GAAG,UAAU,EAAE,CAAC;YACvB,IAAI,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC,iDAAiD,CAAC,CAAC;YACvE,MAAM,CAAC,GAAG,MAAM,IAAI,WAAW,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAC5F,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,MAAM,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;YAC7E,MAAM;QACR,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,CAAC,GAAG,UAAU,EAAE,CAAC;YACvB,IAAI,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC,iDAAiD,CAAC,CAAC;YACvE,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,IAAI,WAAW,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YACxF,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,OAAO,uBAAuB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;YAC1F,MAAM;QACR,CAAC;QACD,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACjC,IAAI,CAAC,GAAG;gBACN,OAAO,IAAI,CAAC,0DAA0D,CAAC,CAAC;YAC1E,oEAAoE;YACpE,yEAAyE;YACzE,2DAA2D;YAC3D,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;YAC9B,MAAM,QAAQ,GACZ,eAAe,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE,QAAQ,IAAI,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAC1E,MAAM,CAAC,GAAG,MAAM,eAAe,CAAC;gBAC9B,QAAQ;gBACR,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,cAAc,CAAC,IAAI,CAAC;gBAClD,MAAM,EAAE,OAAO;aAChB,CAAC,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;YAC/C,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YAC9B,MAAM;QACR,CAAC;QACD,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC9B,IAAI,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC,kEAAkE,CAAC,CAAC;YACzF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YACtC,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;YACjF,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM,UAAU,EAAE,iBAAiB,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC3E,MAAM;QACR,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,CAAC,GAAG,UAAU,EAAE,CAAC;YACvB,IAAI,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC,iDAAiD,CAAC,CAAC;YACvE,OAAO,CAAC,KAAK,CACX,oFAAoF,CACrF,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;YAClC,MAAM;QACR,CAAC;QACD;YACE,OAAO,CAAC,KAAK,CACX,wGAAwG;gBACtG,8EAA8E,CACjF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE;IAC1B,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACvD,6EAA6E;IAC7E,6EAA6E;IAC7E,MAAM,QAAQ,GACZ,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC;QACxC,CAAC,CAAE,CAAyB,CAAC,KAAK;QAClC,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,QAAQ,GACZ,QAAQ,YAAY,KAAK;QACvB,CAAC,CAAC,QAAQ,CAAC,OAAO;QAClB,CAAC,CAAC,QAAQ,IAAI,IAAI;YAChB,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;YAClB,CAAC,CAAC,EAAE,CAAC;IACX,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,GAAG,YAAY,QAAQ,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACxE,6EAA6E;IAC7E,2EAA2E;IAC3E,IAAI,kEAAkE,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,QAAQ,EAAE,CAAC,EAAE,CAAC;QAClG,OAAO,CAAC,KAAK,CACX,6EAA6E;YAC3E,6EAA6E;YAC7E,+FAA+F,CAClG,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/proxy.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Proxy support for the CLI's outbound HTTP.
+ *
+ * Node's global `fetch` (undici) does NOT honor the conventional
+ * HTTP_PROXY/HTTPS_PROXY environment variables on its own — unlike curl/git.
+ * An agent running behind a corporate or regional proxy therefore sees every
+ * relay call fail with an opaque `fetch failed`, even after exporting
+ * HTTP_PROXY, because the request still goes out directly.
+ *
+ * We close that gap by installing an undici `ProxyAgent` as the global
+ * dispatcher whenever a proxy env var is present, so `fetch` (and thus every
+ * RelayClient call) is tunneled through it. No proxy env -> no-op, direct
+ * connections are unaffected.
+ */
+import { type Dispatcher } from "undici";
+/**
+ * Pick the proxy URL from the conventional env vars, same precedence as curl:
+ * explicit HTTPS_PROXY/HTTP_PROXY (either case) win over the catch-all
+ * ALL_PROXY. Returns undefined when none is set.
+ */
+export declare function resolveProxyUrl(env: NodeJS.ProcessEnv): string | undefined;
+/**
+ * Mask any `user:pass@` credentials in a proxy URL so it is safe to log.
+ * Falls back to a regex redaction if the URL does not parse.
+ */
+export declare function redactProxyUrl(url: string): string;
+/** Injectable seams so tests can assert behavior without mutating the
+ *  process-global dispatcher. Production calls leave these unset. */
+export interface InstallProxyDeps {
+    makeAgent?: (url: string) => Dispatcher;
+    setDispatcher?: (d: Dispatcher) => void;
+}
+/**
+ * If a proxy env var is set, route all global `fetch` through it and return the
+ * REDACTED proxy URL (for logging). Returns undefined and touches nothing when
+ * no proxy env is present, so direct connections stay direct.
+ */
+export declare function installProxyFromEnv(env: NodeJS.ProcessEnv, deps?: InstallProxyDeps): string | undefined;
+//# sourceMappingURL=proxy.d.ts.map

package/dist/proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAmC,KAAK,UAAU,EAAE,MAAM,QAAQ,CAAC;AAE1E;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,GAAG,SAAS,CAgB1E;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAWlD;AAED;qEACqE;AACrE,MAAM,WAAW,gBAAgB;IAC/B,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,UAAU,CAAC;IACxC,aAAa,CAAC,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,IAAI,CAAC;CACzC;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,IAAI,GAAE,gBAAqB,GAC1B,MAAM,GAAG,SAAS,CAQpB"}

package/dist/proxy.js

@@ -0,0 +1,63 @@
+/**
+ * Proxy support for the CLI's outbound HTTP.
+ *
+ * Node's global `fetch` (undici) does NOT honor the conventional
+ * HTTP_PROXY/HTTPS_PROXY environment variables on its own — unlike curl/git.
+ * An agent running behind a corporate or regional proxy therefore sees every
+ * relay call fail with an opaque `fetch failed`, even after exporting
+ * HTTP_PROXY, because the request still goes out directly.
+ *
+ * We close that gap by installing an undici `ProxyAgent` as the global
+ * dispatcher whenever a proxy env var is present, so `fetch` (and thus every
+ * RelayClient call) is tunneled through it. No proxy env -> no-op, direct
+ * connections are unaffected.
+ */
+import { ProxyAgent, setGlobalDispatcher } from "undici";
+/**
+ * Pick the proxy URL from the conventional env vars, same precedence as curl:
+ * explicit HTTPS_PROXY/HTTP_PROXY (either case) win over the catch-all
+ * ALL_PROXY. Returns undefined when none is set.
+ */
+export function resolveProxyUrl(env) {
+    const pick = (...names) => {
+        for (const n of names) {
+            const v = env[n];
+            if (typeof v === "string" && v.trim() !== "")
+                return v.trim();
+        }
+        return undefined;
+    };
+    return pick("HTTPS_PROXY", "https_proxy", "HTTP_PROXY", "http_proxy", "ALL_PROXY", "all_proxy");
+}
+/**
+ * Mask any `user:pass@` credentials in a proxy URL so it is safe to log.
+ * Falls back to a regex redaction if the URL does not parse.
+ */
+export function redactProxyUrl(url) {
+    try {
+        const u = new URL(url);
+        if (u.username || u.password) {
+            u.username = "***";
+            u.password = "";
+        }
+        return u.toString();
+    }
+    catch {
+        return url.replace(/\/\/[^/@]*@/, "//***@");
+    }
+}
+/**
+ * If a proxy env var is set, route all global `fetch` through it and return the
+ * REDACTED proxy URL (for logging). Returns undefined and touches nothing when
+ * no proxy env is present, so direct connections stay direct.
+ */
+export function installProxyFromEnv(env, deps = {}) {
+    const url = resolveProxyUrl(env);
+    if (!url)
+        return undefined;
+    const makeAgent = deps.makeAgent ?? ((u) => new ProxyAgent(u));
+    const setDispatcher = deps.setDispatcher ?? ((d) => setGlobalDispatcher(d));
+    setDispatcher(makeAgent(url));
+    return redactProxyUrl(url);
+}
+//# sourceMappingURL=proxy.js.map

package/dist/proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAmB,MAAM,QAAQ,CAAC;AAE1E;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,GAAsB;IACpD,MAAM,IAAI,GAAG,CAAC,GAAG,KAAe,EAAsB,EAAE;QACtD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;YACjB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;gBAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAChE,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IACF,OAAO,IAAI,CACT,aAAa,EACb,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,WAAW,CACZ,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC7B,CAAC,CAAC,QAAQ,GAAG,KAAK,CAAC;YACnB,CAAC,CAAC,QAAQ,GAAG,EAAE,CAAC;QAClB,CAAC;QACD,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AASD;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAsB,EACtB,OAAyB,EAAE;IAE3B,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,MAAM,aAAa,GACjB,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC,CAAa,EAAE,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,aAAa,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC"}

package/dist/relay-signer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"relay-signer.d.ts","sourceRoot":"","sources":["../src/relay-signer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAKhE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE/D,wBAAgB,eAAe,CAC7B,MAAM,EAAE,WAAW,EACnB,IAAI,GAAE;IACJ,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC;;;yEAGqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAC;CAChB,GACL,YAAY,CAsCd"}
+{"version":3,"file":"relay-signer.d.ts","sourceRoot":"","sources":["../src/relay-signer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAKhE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE/D,wBAAgB,eAAe,CAC7B,MAAM,EAAE,WAAW,EACnB,IAAI,GAAE;IACJ,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC;;;yEAGqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAC;CAChB,GACL,YAAY,CAuCd"}

package/dist/relay-signer.js

@@ -14,7 +14,7 @@ export function makeRelaySigner(wallet, opts = {}) {
     // safely exclude the honest DSO that legitimately appears in the transfer's
     // consequence. Without it, value-moving prepared bytes carrying the DSO outside
     // the root choice arg are refused (fail-closed).
-    const trustedDso = opts.trustedDso ?? resolveTrustedDsoParty();
+    const trustedDso = opts.trustedDso ?? resolveTrustedDsoParty(process.env, wallet.network);
     return {
         party: wallet.party,
         async signCip56Transfer(input) {

package/dist/relay-signer.js.map

@@ -1 +1 @@
-{"version":3,"file":"relay-signer.js","sourceRoot":"","sources":["../src/relay-signer.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAI1D,MAAM,UAAU,eAAe,CAC7B,MAAmB,EACnB,OAQI,EAAE;IAEN,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAClF,6EAA6E;IAC7E,2DAA2D;IAC3D,+EAA+E;IAC/E,qCAAqC;IACrC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,kBAAkB,EAAE,CAAC;IAC7D,gFAAgF;IAChF,4EAA4E;IAC5E,4EAA4E;IAC5E,gFAAgF;IAChF,iDAAiD;IACjD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,sBAAsB,EAAE,CAAC;IAC/D,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,KAAK,CAAC,iBAAiB,CAAC,KAAK;YAC3B,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE;gBAC7C,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3D,WAAW;gBACX,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3E,CAAC,CAAC;YACH,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC;QAC9E,CAAC;QACD,KAAK,CAAC,mBAAmB,CAAC,KAAK;YAC7B,OAAO,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE;gBAC1C,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9E,WAAW;gBACX,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjE,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"relay-signer.js","sourceRoot":"","sources":["../src/relay-signer.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAI1D,MAAM,UAAU,eAAe,CAC7B,MAAmB,EACnB,OAQI,EAAE;IAEN,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAClF,6EAA6E;IAC7E,2DAA2D;IAC3D,+EAA+E;IAC/E,qCAAqC;IACrC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,kBAAkB,EAAE,CAAC;IAC7D,gFAAgF;IAChF,4EAA4E;IAC5E,4EAA4E;IAC5E,gFAAgF;IAChF,iDAAiD;IACjD,MAAM,UAAU,GACd,IAAI,CAAC,UAAU,IAAI,sBAAsB,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACzE,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,KAAK,CAAC,iBAAiB,CAAC,KAAK;YAC3B,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE;gBAC7C,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3D,WAAW;gBACX,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3E,CAAC,CAAC;YACH,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC;QAC9E,CAAC;QACD,KAAK,CAAC,mBAAmB,CAAC,KAAK;YAC7B,OAAO,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE;gBAC1C,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9E,WAAW;gBACX,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjE,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/trusted-dso.d.ts

@@ -26,8 +26,25 @@
 /** The env var an operator sets to the network's Amulet DSO (instrument admin). */
 export declare const TRUSTED_DSO_PARTY_ENV = "CANTON_AGENT_DSO_PARTY";
 /**
- * The independently-trusted DSO/instrument-admin party id, or undefined when the
- * operator has not configured one. Trimmed; empty ⇒ undefined.
+ * Known Amulet DSO party ids per Canton network. The DSO is a NETWORK-WIDE
+ * CONSTANT — the Super-Validator collective party that signs AmuletRules — so it
+ * is safe to bake in as an independently-trusted anchor (it is NOT learned from
+ * the relay). This lets the CLI auto-pin the DSO for the common networks so a v1
+ * `pay` works out of the box; the env var still overrides if a network's DSO is
+ * ever rotated or for a network not listed here.
+ *
+ * mainnet DSO confirmed live from Scan `/api/scan/v0/dso-party-id` (2026-06).
+ * Other networks are intentionally absent until confirmed — they fall back to
+ * the env var (fail-closed if also unset).
+ */
+export declare const KNOWN_DSO_BY_NETWORK: Readonly<Record<string, string>>;
+/**
+ * The independently-trusted DSO/instrument-admin party id, or undefined when
+ * neither the env var nor a baked-in network constant supplies one.
+ *
+ * Precedence: explicit `CANTON_AGENT_DSO_PARTY` env (trimmed) wins, else the
+ * baked-in {@link KNOWN_DSO_BY_NETWORK} value for `network`, else undefined
+ * (value-moving transfers then fail closed — the secure default).
  */
-export declare function resolveTrustedDsoParty(env?: NodeJS.ProcessEnv): string | undefined;
+export declare function resolveTrustedDsoParty(env?: NodeJS.ProcessEnv, network?: string): string | undefined;
 //# sourceMappingURL=trusted-dso.d.ts.map

package/dist/trusted-dso.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"trusted-dso.d.ts","sourceRoot":"","sources":["../src/trusted-dso.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,mFAAmF;AACnF,eAAO,MAAM,qBAAqB,2BAA2B,CAAC;AAE9D;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,SAAS,CAGpB"}
+{"version":3,"file":"trusted-dso.d.ts","sourceRoot":"","sources":["../src/trusted-dso.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,mFAAmF;AACnF,eAAO,MAAM,qBAAqB,2BAA2B,CAAC;AAE9D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGjE,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,OAAO,CAAC,EAAE,MAAM,GACf,MAAM,GAAG,SAAS,CAOpB"}

package/dist/trusted-dso.js

@@ -26,11 +26,35 @@
 /** The env var an operator sets to the network's Amulet DSO (instrument admin). */
 export const TRUSTED_DSO_PARTY_ENV = "CANTON_AGENT_DSO_PARTY";
 /**
- * The independently-trusted DSO/instrument-admin party id, or undefined when the
- * operator has not configured one. Trimmed; empty ⇒ undefined.
+ * Known Amulet DSO party ids per Canton network. The DSO is a NETWORK-WIDE
+ * CONSTANT — the Super-Validator collective party that signs AmuletRules — so it
+ * is safe to bake in as an independently-trusted anchor (it is NOT learned from
+ * the relay). This lets the CLI auto-pin the DSO for the common networks so a v1
+ * `pay` works out of the box; the env var still overrides if a network's DSO is
+ * ever rotated or for a network not listed here.
+ *
+ * mainnet DSO confirmed live from Scan `/api/scan/v0/dso-party-id` (2026-06).
+ * Other networks are intentionally absent until confirmed — they fall back to
+ * the env var (fail-closed if also unset).
+ */
+export const KNOWN_DSO_BY_NETWORK = {
+    "canton:mainnet": "DSO::1220b1431ef217342db44d516bb9befde802be7d8899637d290895fa58880f19accc",
+};
+/**
+ * The independently-trusted DSO/instrument-admin party id, or undefined when
+ * neither the env var nor a baked-in network constant supplies one.
+ *
+ * Precedence: explicit `CANTON_AGENT_DSO_PARTY` env (trimmed) wins, else the
+ * baked-in {@link KNOWN_DSO_BY_NETWORK} value for `network`, else undefined
+ * (value-moving transfers then fail closed — the secure default).
  */
-export function resolveTrustedDsoParty(env = process.env) {
+export function resolveTrustedDsoParty(env = process.env, network) {
     const v = (env[TRUSTED_DSO_PARTY_ENV] ?? "").trim();
-    return v.length > 0 ? v : undefined;
+    if (v.length > 0)
+        return v;
+    if (network && KNOWN_DSO_BY_NETWORK[network]) {
+        return KNOWN_DSO_BY_NETWORK[network];
+    }
+    return undefined;
 }
 //# sourceMappingURL=trusted-dso.js.map

package/dist/trusted-dso.js.map

@@ -1 +1 @@
-{"version":3,"file":"trusted-dso.js","sourceRoot":"","sources":["../src/trusted-dso.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,mFAAmF;AACnF,MAAM,CAAC,MAAM,qBAAqB,GAAG,wBAAwB,CAAC;AAE9D;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACtC,CAAC"}
+{"version":3,"file":"trusted-dso.js","sourceRoot":"","sources":["../src/trusted-dso.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,mFAAmF;AACnF,MAAM,CAAC,MAAM,qBAAqB,GAAG,wBAAwB,CAAC;AAE9D;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAqC;IACpE,gBAAgB,EACd,2EAA2E;CAC9E,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAyB,OAAO,CAAC,GAAG,EACpC,OAAgB;IAEhB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IAC3B,IAAI,OAAO,IAAI,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/withdraw.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"withdraw.d.ts","sourceRoot":"","sources":["../src/withdraw.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE/D,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,+EAA+E;IAC/E,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC;;yEAEqE;IACrE,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAiB/C"}
+{"version":3,"file":"withdraw.d.ts","sourceRoot":"","sources":["../src/withdraw.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE/D,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,+EAA+E;IAC/E,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC;;yEAEqE;IACrE,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAkB/C"}

package/dist/withdraw.js

@@ -19,7 +19,7 @@ export async function withdraw(opts) {
         const bal = await relay.balance(wallet.party);
         amount = bal.cc;
     }
-    const instrumentAdmin = opts.instrumentAdmin ?? resolveTrustedDsoParty();
+    const instrumentAdmin = opts.instrumentAdmin ?? resolveTrustedDsoParty(process.env, wallet.network);
     const updateId = await transfer(relay, wallet, {
         receiver: opts.to,
         amount,

package/dist/withdraw.js.map

@@ -1 +1 @@
-{"version":3,"file":"withdraw.js","sourceRoot":"","sources":["../src/withdraw.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAgB1D,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,IAAkB;IAElB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAClF,IAAI,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IACzB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC;IAClB,CAAC;IACD,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,sBAAsB,EAAE,CAAC;IACzE,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE;QAC7C,QAAQ,EAAE,IAAI,CAAC,EAAE;QACjB,MAAM;QACN,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,kBAAkB,EAAE;QACrD,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrF,CAAC,CAAC;IACH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC"}
+{"version":3,"file":"withdraw.js","sourceRoot":"","sources":["../src/withdraw.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAgB1D,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,IAAkB;IAElB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAClF,IAAI,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IACzB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC;IAClB,CAAC;IACD,MAAM,eAAe,GACnB,IAAI,CAAC,eAAe,IAAI,sBAAsB,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9E,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE;QAC7C,QAAQ,EAAE,IAAI,CAAC,EAAE;QACjB,MAAM;QACN,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,kBAAkB,EAAE;QACrD,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrF,CAAC,CAAC;IACH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ftptech/canton-agent-wallet",
   "private": false,
-  "version": "0.1.4",
+  "version": "0.1.6",
   "description": "Self-custody Canton wallet + x402 autopay for AI agents. One CLI: create, pay, balance, withdraw, export. Backs the canton-x402-agent skill.",
   "license": "Apache-2.0",
   "author": "FTP team",
@@ -18,6 +18,7 @@
   "dependencies": {
     "@canton-network/core-tx-visualizer": "~1.4.0",
     "@canton-network/core-ledger-proto": "~1.4.0",
+    "undici": "^7.1.0",
     "@ftptech/x402-canton-client": "0.1.0",
     "@ftptech/x402-canton-ledger": "0.1.0"
   },