@heyanon-arp/cli 0.0.20 → 0.0.22

package/dist/cli.js

@@ -729,12 +729,11 @@ var init_api = __esm({
 // src/cli.ts
 var import_shield3 = require("@heyanon-arp/shield");
 var import_commander = require("commander");
-var import_simple_update_notifier = __toESM(require("simple-update-notifier"));
 
 // package.json
 var package_default = {
   name: "@heyanon-arp/cli",
-  version: "0.0.20",
+  version: "0.0.22",
   description: "Command-line client for the Agent Relationship Protocol \u2014 register agents, sign envelopes, run escrowed work cycles on Solana.",
   license: "MIT",
   keywords: ["arp", "agent-relationship-protocol", "did", "solana", "escrow", "ed25519", "agents", "a2a", "cli"],
@@ -763,8 +762,7 @@ var package_default = {
     "@solana/web3.js": "^1.98.4",
     chalk: "^4.1.2",
     commander: "^12.1.0",
-    prompts: "^2.4.2",
-    "simple-update-notifier": "^2.0.0"
+    prompts: "^2.4.2"
   },
   devDependencies: {
     "@types/jest": "^29.5.2",
@@ -832,6 +830,16 @@ function toCliErrorJson(err, includeStack = false) {
     if (details !== void 0) out2.details = details;
     return out2;
   }
+  if (err instanceof Error && err.code === "OUTBOUND_BLOCKED") {
+    const e = err;
+    const reasons = e.verdict?.reasons ?? e.reasons;
+    const out2 = { code: e.code, message: err.message };
+    const details = {};
+    if (Array.isArray(reasons) && reasons.length > 0) details.reasons = reasons;
+    if (includeStack && err.stack) details.stack = err.stack;
+    if (Object.keys(details).length > 0) out2.details = details;
+    return out2;
+  }
   const message = err instanceof Error ? err.message : String(err);
   const out = { code: "CLI_ERROR", message };
   if (includeStack && err instanceof Error && err.stack) {
@@ -1780,9 +1788,10 @@ var UNTIL_PHASES = [
 ];
 var WAIT_DEFAULT_INTERVAL_SEC = 3;
 var WAIT_DEFAULT_TIMEOUT_SEC = 300;
-var WAIT_ABS_MAX_SEC = 86400;
+var WAIT_ABS_MAX_SEC = 7 * 86400;
 var WAIT_CONTRACT_LAG_MARGIN_SEC = 300;
 var WAIT_CONTRACT_CAP_FALLBACK_SEC = 3600;
+var WAIT_LOCK_FINALIZATION_DEFAULT_SEC = 1200;
 function registerStatusCommand(root) {
   root.command("status").description("Where am I in the work cycle? FSM state + next-action hint for ONE relationship (signed reads)").argument("<relationship-id>", "Relationship UUID").option("--server <url>", "Override ARP server base URL").option("--from-did <did>", "Signer DID \u2014 required only if multiple agents are registered against this server").option("--from <name>", "Signer agent NAME (handle) \u2014 alternative to --from-did, resolved against your local agents").option("--json", "Machine-readable: single JSON object with the composed summary. Pipe-safe.", false).option(
     "--wait",
@@ -1790,8 +1799,10 @@ function registerStatusCommand(root) {
     false
   ).option(
     "--wait-timeout <seconds>",
-    `Max wall-clock seconds to wait when --wait is set (default ${WAIT_DEFAULT_TIMEOUT_SEC}; with --until it defaults to the live on-chain budget = work+review+dispute windows + margin, read from the contract). Capped at that same on-chain budget. Process exits code 124 on timeout (unix \`timeout\` convention).`,
-    String(WAIT_DEFAULT_TIMEOUT_SEC)
+    `Max wall-clock seconds to wait when --wait is set. Default ${WAIT_DEFAULT_TIMEOUT_SEC}s, with two phase-aware exceptions when --until is set: (1) delegation.locked uses a generous lock-finalization default (on-chain confirmation + indexer projection latency, not the lifecycle windows); (2) a lifecycle phase (work/review/dispute-governed, e.g. work.responded) auto-sizes to the live on-chain budget (work+review+dispute windows + margin, read from the contract) so it tracks the windows. An explicit value is always honored as-is (it may legitimately exceed the budget \u2014 a wait can span pre-lock acceptance/funding too); only a generous 7-day wait-loop safety cap is enforced. Exit code 124 on timeout (unix \`timeout\` convention).`
+    // NB: no Commander default — an omitted value must reach resolveWaitTimeoutSec
+    // as `undefined` so it can phase-size the default (a literal '300' here would
+    // mask the contract-budget auto-sizing for --until waits).
   ).option(
     "--wait-interval <seconds>",
     `Seconds between polls when --wait is set (default ${WAIT_DEFAULT_INTERVAL_SEC}). Bound to [1, 60].`,
@@ -1828,7 +1839,7 @@ async function runStatus(relationshipId, opts) {
   }
   const until = parseUntilPhase(opts.until);
   const waitInterval = parseWaitInterval(opts.waitInterval);
-  const waitTimeout = await resolveWaitTimeoutSec(api, opts.waitTimeout, { hasUntil: !!until });
+  const waitTimeout = await resolveWaitTimeoutSec(api, opts.waitTimeout, { untilPhase: until });
   const outcome = await runWaitLoop({
     fetchSummary: () => composeStatus(api, sender.did, relationshipId, signer),
     waitIntervalSec: waitInterval,
@@ -1990,7 +2001,7 @@ function parseWaitTimeout(raw) {
     throw new Error(`status: --wait-timeout must be a positive integer number of seconds (got '${raw}')`);
   }
   if (n > WAIT_ABS_MAX_SEC) {
-    throw new Error(`status: --wait-timeout must be <= ${WAIT_ABS_MAX_SEC} seconds (24h, the max envelope TTL). Got ${n}.`);
+    throw new Error(`status: --wait-timeout must be <= ${WAIT_ABS_MAX_SEC} seconds (the 7-day wait-loop safety cap). Got ${n}.`);
   }
   return n;
 }
@@ -2001,21 +2012,25 @@ function contractWaitCapSec(cfg) {
   if (![w, r, d].every((n) => Number.isFinite(n) && n > 0)) return WAIT_CONTRACT_CAP_FALLBACK_SEC;
   return Math.min(WAIT_ABS_MAX_SEC, w + r + d + WAIT_CONTRACT_LAG_MARGIN_SEC);
 }
+var LOCK_FINALIZATION_PHASES = /* @__PURE__ */ new Set(["delegation.locked"]);
+var CONTRACT_BUDGETED_PHASES = /* @__PURE__ */ new Set([
+  "delegation.disputing",
+  "work.requested",
+  "work.responded",
+  "receipt.proposed",
+  "cycle.released",
+  "cycle.complete"
+]);
 async function resolveWaitTimeoutSec(api, raw, opts) {
-  let cap;
+  if (raw !== void 0) return parseWaitTimeout(raw);
+  if (opts.untilPhase !== void 0 && LOCK_FINALIZATION_PHASES.has(opts.untilPhase)) return WAIT_LOCK_FINALIZATION_DEFAULT_SEC;
+  const contractBudgeted = opts.untilPhase !== void 0 && CONTRACT_BUDGETED_PHASES.has(opts.untilPhase);
+  if (!contractBudgeted) return WAIT_DEFAULT_TIMEOUT_SEC;
   try {
-    cap = contractWaitCapSec(await api.getEscrowConfig());
+    return contractWaitCapSec(await api.getEscrowConfig());
   } catch {
-    cap = WAIT_CONTRACT_CAP_FALLBACK_SEC;
+    return WAIT_CONTRACT_CAP_FALLBACK_SEC;
   }
-  if (raw === void 0) return opts.hasUntil ? cap : WAIT_DEFAULT_TIMEOUT_SEC;
-  const n = parseWaitTimeout(raw);
-  if (n > cap) {
-    throw new Error(
-      `status: --wait-timeout ${n}s exceeds the live on-chain budget of ${cap}s (work+review+dispute windows + ${WAIT_CONTRACT_LAG_MARGIN_SEC}s lag, read from the contract). Nothing stays pending longer; lower it or script a loop around \`heyarp status\`.`
-    );
-  }
-  return n;
 }
 function parseUntilPhase(raw) {
   if (raw === void 0 || raw === "") return void 0;
@@ -2334,9 +2349,8 @@ function nextAction(input) {
   }
   const iAmCaller = latestReceipt.callerDid === signerDid;
   return {
-    // There is no cosign step — buyer consent is the on-chain
-    // claim_work_payment tx, worker recourse is the
-    // review-window self-claim.
+    // Consent is the on-chain claim_work_payment tx (the buyer's), and
+    // worker recourse is the review-window self-claim.
     hint: iAmCaller ? `Receipt PROPOSED \u2014 you (caller): review the deliverable and approve payment ON-CHAIN with \`heyarp escrow claim ${latestReceipt.delegationId}\` (irreversible release; \`heyarp escrow dispute open ${latestReceipt.delegationId}\` within the review window if the work is unacceptable)` : `Receipt PROPOSED \u2014 counterparty (the buyer) owes the on-chain approval (\`heyarp escrow claim\`); once the review window lapses you may self-claim with \`heyarp escrow claim ${latestReceipt.delegationId}\``,
     owner: iAmCaller ? "me" : "counterparty",
     complete: false
@@ -2977,7 +2991,7 @@ function registerOffer(parent) {
     'Block after delivery until the named FSM phase is reached (e.g. delegation.accepted). One of the UNTIL_PHASES from `heyarp status --help`. Exit code 124 on --wait-timeout. Recovers the "sub-agent exits before counterparty accepts" antipattern.'
   ).option(
     "--wait-timeout <seconds>",
-    "When --wait-until is set: max wall-clock wait. Omitted \u2192 auto-sized to the live on-chain budget (work+review+dispute windows + margin, read from the contract); explicit values are capped at that budget. Exit code 124 on timeout."
+    "When --wait-until is set: max wall-clock wait. Omitted \u2192 delegation.locked uses a generous lock-finalization default (on-chain confirmation + indexer projection); later lifecycle phases (work/review/dispute-governed) auto-size to the live on-chain budget (read from the contract); other phases default to 300s. An explicit value is always honored as-is (a wait may span pre-lock acceptance/funding, so it can exceed the budget), bounded only by a generous 7-day wait-loop safety cap. Exit code 124 on timeout."
   ).option("--wait-interval <seconds>", "When --wait-until is set: poll cadence (default 3, bound [1, 60]).").option(
     "--wait-verbose",
     'When --wait-until is set: emit one dim line per poll tick showing the current FSM state. Useful for "is it alive or stuck?" diagnosis on long blocks.',
@@ -3204,7 +3218,7 @@ After the worker accepts, fund the escrow lock:`));
       untilPhase,
       waitIntervalSec: parseWaitInterval(opts.waitInterval),
       // Cap/default the wait against the live on-chain windows (work+review+dispute).
-      waitTimeoutSec: await resolveWaitTimeoutSec(api, opts.waitTimeout, { hasUntil: true }),
+      waitTimeoutSec: await resolveWaitTimeoutSec(api, opts.waitTimeout, { untilPhase }),
       waitVerbose: !!opts.waitVerbose,
       json: false
       // delegation offer is a human-text command (printIngestResult is human-text); JSON mode would be a follow-up.
@@ -3230,7 +3244,7 @@ function registerFund(parent) {
     "Block after delivery until the named FSM phase is reached (typically delegation.locked \u2014 resolves once the escrow lock confirms on chain). One of the UNTIL_PHASES from `heyarp status --help`. Exit code 124 on --wait-timeout."
   ).option(
     "--wait-timeout <seconds>",
-    "When --wait-until is set: max wall-clock wait. Omitted \u2192 auto-sized to the live on-chain budget (work+review+dispute windows + margin, read from the contract); explicit values are capped at that budget. Exit code 124 on timeout."
+    "When --wait-until is set: max wall-clock wait. Omitted \u2192 delegation.locked uses a generous lock-finalization default (on-chain confirmation + indexer projection); later lifecycle phases (work/review/dispute-governed) auto-size to the live on-chain budget (read from the contract); other phases default to 300s. An explicit value is always honored as-is (a wait may span pre-lock acceptance/funding, so it can exceed the budget), bounded only by a generous 7-day wait-loop safety cap. Exit code 124 on timeout."
   ).option("--wait-interval <seconds>", "When --wait-until is set: poll cadence (default 3, bound [1, 60]).").option("--wait-verbose", "When --wait-until is set: emit one dim line per poll tick showing the current FSM state.", false).action(async (delegationId, opts) => {
     await runFund(delegationId, opts);
   });
@@ -3333,7 +3347,7 @@ async function runFund(delegationId, opts) {
       // slow, so an omitted timeout auto-sizes to the live on-chain
       // budget (work+review+dispute + margin) — generous by design;
       // a timeout here is almost never a failure, just a slow chain.
-      waitTimeoutSec: await resolveWaitTimeoutSec(api, opts.waitTimeout, { hasUntil: true }),
+      waitTimeoutSec: await resolveWaitTimeoutSec(api, opts.waitTimeout, { untilPhase }),
       waitVerbose: !!opts.waitVerbose,
       json: false
     });
@@ -6396,8 +6410,8 @@ async function runPropose(recipientDid, delegationId, requestHashArg, responseHa
     );
   }
   recipientDid = await resolveRecipient(opts.server, "receipt propose", recipientDid, { json: opts.json });
-  delegationId = requireUuidNormalised2("receipt propose", delegationId, "<delegation-id>");
-  if (opts.relId) opts.relId = requireUuidNormalised2("receipt propose", opts.relId, "--rel-id");
+  delegationId = requireUuidNormalised("receipt propose", delegationId, "<delegation-id>");
+  if (opts.relId) opts.relId = requireUuidNormalised("receipt propose", opts.relId, "--rel-id");
   const verdict = parseVerdict("receipt propose", opts.verdict);
   const ttlSeconds = parseTtl2("receipt propose", opts.ttl);
   if (opts.notesHash) requireSha256("receipt propose", opts.notesHash, "--notes-hash");
@@ -6658,10 +6672,6 @@ function parseInteger(cmdName, flag, raw) {
   }
   return n;
 }
-function requireUuidNormalised2(cmdName, raw, label) {
-  requireUuid3(cmdName, raw, label);
-  return raw.toLowerCase();
-}
 function requireUuid3(cmdName, raw, label) {
   requireUuid(cmdName, raw, label);
 }
@@ -7897,7 +7907,7 @@ async function runRequest(recipientDid, delegationId, opts) {
     );
   }
   recipientDid = await resolveRecipient(opts.server, "work request", recipientDid, { json: opts.json });
-  delegationId = requireUuidNormalised3("work request", delegationId, "<delegation-id>");
+  delegationId = requireUuidNormalised("work request", delegationId, "<delegation-id>");
   const ttlSeconds = parseTtl5("work request", opts.ttl);
   const params = parseParamsInput("work request", opts);
   const requestId = parseRequestId("work request", opts.requestId);
@@ -7954,8 +7964,8 @@ async function runRespond(relationshipId, delegationId, requestId, opts) {
       "work respond: --verbose and --json are mutually exclusive. --json emits the structured server response; --verbose adds dumps that would break `--json | jq`."
     );
   }
-  relationshipId = requireUuidNormalised3("work respond", relationshipId, "<relationship-id>");
-  delegationId = requireUuidNormalised3("work respond", delegationId, "<delegation-id>");
+  relationshipId = requireUuidNormalised("work respond", relationshipId, "<relationship-id>");
+  delegationId = requireUuidNormalised("work respond", delegationId, "<delegation-id>");
   const ttlSeconds = parseTtl5("work respond", opts.ttl);
   const responsePayload = parseResponsePayload("work respond", opts);
   const api = new ArpApiClient(opts.server);
@@ -8098,13 +8108,13 @@ function parseParamsInput(cmdName, opts) {
   return parseJsonObject(cmdName, "--params", opts.params ?? "{}");
 }
 function readJsonObjectFile(cmdName, flagName, path) {
-  const { existsSync: existsSync7, readFileSync: readFileSync9 } = require("fs");
+  const { existsSync: existsSync7, readFileSync: readFileSync10 } = require("fs");
   if (!existsSync7(path)) {
     throw new Error(`${cmdName}: ${flagName} file not found at ${path}`);
   }
   let raw;
   try {
-    raw = readFileSync9(path, "utf8");
+    raw = readFileSync10(path, "utf8");
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
     throw new Error(`${cmdName}: failed to read ${flagName} (${path}): ${detail}`);
@@ -8159,13 +8169,6 @@ function parseRequestId(cmdName, raw) {
   }
   return raw;
 }
-function requireUuidNormalised3(cmdName, raw, label) {
-  requireUuid4(cmdName, raw, label);
-  return raw.toLowerCase();
-}
-function requireUuid4(cmdName, raw, label) {
-  requireUuid(cmdName, raw, label);
-}
 
 // src/commands/work-list.ts
 var import_sdk32 = require("@heyanon-arp/sdk");
@@ -8324,19 +8327,104 @@ function unknownOptionHint(program, err) {
   }
 }
 
-// src/cli.ts
-async function checkForUpdates() {
-  if (package_default.private === true) return;
+// src/version-gate.ts
+var import_node_fs10 = require("fs");
+var import_node_path7 = require("path");
+init_paths();
+var CHECK_INTERVAL_MS = 60 * 60 * 1e3;
+var REGISTRY_TIMEOUT_MS = 1500;
+var VERSION_GATE_BYPASS_ENV = "HEYARP_IGNORE_VERSION_GATE";
+var cacheFile = () => (0, import_node_path7.join)(arpHomeDir(), "update-check.json");
+function compareVersions(a, b) {
+  const seg = (v, i) => Number.parseInt(v.split(".")[i] ?? "0", 10) || 0;
+  for (let i = 0; i < 3; i++) {
+    const d = seg(a, i) - seg(b, i);
+    if (d !== 0) return d > 0 ? 1 : -1;
+  }
+  return 0;
+}
+function isClientBlocked(current, latest) {
+  if (!latest) return false;
+  return compareVersions(current, latest) < 0;
+}
+function isVersionGateExempt(argv) {
+  if (argv.length === 0) return true;
+  if (argv[0] === "help") return true;
+  return argv.includes("--version") || argv.includes("-V") || argv.includes("--help") || argv.includes("-h");
+}
+async function fetchLatest(pkgName) {
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(), REGISTRY_TIMEOUT_MS);
   try {
-    await (0, import_simple_update_notifier.default)({
-      pkg: { name: package_default.name, version: package_default.version },
-      updateCheckInterval: 1e3 * 60 * 60 * 24
+    const res = await fetch(`https://registry.npmjs.org/-/package/${pkgName.replace("/", "%2F")}/dist-tags`, {
+      signal: ctrl.signal,
+      headers: { accept: "application/json" }
     });
+    if (!res.ok) return null;
+    const body = await res.json();
+    return typeof body.latest === "string" ? body.latest : null;
   } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
   }
 }
+async function resolveLatest(pkgName) {
+  try {
+    const cached = JSON.parse((0, import_node_fs10.readFileSync)(cacheFile(), "utf8"));
+    if (typeof cached.latest === "string" && typeof cached.checkedAt === "number" && Date.now() - cached.checkedAt < CHECK_INTERVAL_MS) {
+      return cached.latest;
+    }
+  } catch {
+  }
+  const fresh = await fetchLatest(pkgName);
+  if (!fresh) return null;
+  try {
+    const file = cacheFile();
+    (0, import_node_fs10.mkdirSync)((0, import_node_path7.dirname)(file), { recursive: true });
+    (0, import_node_fs10.writeFileSync)(file, JSON.stringify({ checkedAt: Date.now(), latest: fresh }));
+  } catch {
+  }
+  return fresh;
+}
+async function enforceMinClientVersion(pkg, argv) {
+  if (process.env[VERSION_GATE_BYPASS_ENV]) return;
+  if (isVersionGateExempt(argv)) return;
+  let latest;
+  try {
+    latest = await resolveLatest(pkg.name);
+  } catch {
+    return;
+  }
+  if (!isClientBlocked(pkg.version, latest)) return;
+  const update = `npm i -g ${pkg.name}@latest`;
+  if (argv.includes("--json")) {
+    console.error(
+      JSON.stringify({
+        code: "CLI_VERSION_TOO_OLD",
+        message: `heyarp ${pkg.version} is out of date and blocked; the current release is ${latest}. Update with \`${update}\`, then re-run.`,
+        details: { current: pkg.version, latest, update, bypassEnv: VERSION_GATE_BYPASS_ENV }
+      })
+    );
+  } else {
+    process.stderr.write(
+      `
+  heyarp ${pkg.version} is out of date and is blocked.
+  The current release is ${latest}. Update, then re-run:
+
+    ${update}
+
+  (emergency bypass: set ${VERSION_GATE_BYPASS_ENV}=1)
+
+`
+    );
+  }
+  process.exit(1);
+}
+
+// src/cli.ts
 async function main() {
-  void checkForUpdates();
+  await enforceMinClientVersion(package_default, process.argv.slice(2));
   const program = new import_commander.Command();
   program.name("heyarp").description("ARP \u2014 Agent Relationship Protocol CLI (talks to apps/arp-server)").version(package_default.version).usage("[global-options] <command> [options]").option("--trace", "Surface stack traces and error details on failure.", false);
   program.exitOverride();