@lucid-agents/taskmarket 1.25.0 → 1.26.0

package/dist/chunk-Q2FZSDFG.js

@@ -0,0 +1,933 @@
+import { createRequire as __tmCreateRequire } from 'node:module'; import { fileURLToPath as __tmFileURLToPath } from 'node:url'; import { dirname as __tmDirname } from 'node:path'; const require = __tmCreateRequire(import.meta.url); const __tmFilename = __tmFileURLToPath(import.meta.url); const __tmDirnameValue = __tmDirname(__tmFilename);
+import {
+  IDEMPOTENCY_KEY_HEADER,
+  NetworkInfoSchema,
+  apiErrorEnvelopeOf,
+  buildLegalReceiptHeaders,
+  getTaskmarketHome,
+  isInFlightApiError,
+  paymentProtocolFor,
+  taskmarketChain,
+  verifierProviderId
+} from "./chunk-VTMYCZLT.js";
+
+// src/lib/idempotency.ts
+import { randomUUID } from "crypto";
+var pendingEnvKey = process.env.TASKMARKET_IDEMPOTENCY_KEY?.trim() || void 0;
+var keyByError = /* @__PURE__ */ new WeakMap();
+function rememberIdempotencyKeyFor(error, key) {
+  if (error === null || typeof error !== "object" && typeof error !== "function") return;
+  if (keyByError.has(error)) return;
+  keyByError.set(error, key);
+}
+function idempotencyKeyForError(error) {
+  if (error === null || typeof error !== "object" && typeof error !== "function")
+    return void 0;
+  return keyByError.get(error);
+}
+function newIdempotencyKey() {
+  return randomUUID();
+}
+function resolveIdempotencyKey(explicit) {
+  if (explicit !== void 0) {
+    return explicit;
+  }
+  if (pendingEnvKey !== void 0) {
+    const fromEnv = pendingEnvKey;
+    pendingEnvKey = void 0;
+    return fromEnv;
+  }
+  return newIdempotencyKey();
+}
+async function withIdempotentWrite(key, fn) {
+  try {
+    return await fn();
+  } catch (error) {
+    rememberIdempotencyKeyFor(error, key);
+    throw error;
+  }
+}
+function idempotencyHeaders(key) {
+  return { [IDEMPOTENCY_KEY_HEADER]: key };
+}
+
+// src/lib/keystore.ts
+import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
+import { promises as fs } from "fs";
+import path from "path";
+import { privateKeyToAccount } from "viem/accounts";
+function getKeystorePath() {
+  return path.join(getTaskmarketHome(), "keystore.json");
+}
+function generateKeypair() {
+  const keyBytes = randomBytes(32);
+  const privateKey = "0x" + keyBytes.toString("hex");
+  const account = privateKeyToAccount(privateKey);
+  return { privateKey, address: account.address };
+}
+function encryptPrivateKey(deviceEncryptionKeyHex, privateKey) {
+  const key = Buffer.from(deviceEncryptionKeyHex, "hex");
+  const iv = randomBytes(12);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const plaintext = Buffer.from(privateKey, "utf8");
+  const encrypted = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return Buffer.concat([iv, tag, encrypted]).toString("hex");
+}
+function decryptPrivateKey(deviceEncryptionKeyHex, encryptedHex) {
+  const key = Buffer.from(deviceEncryptionKeyHex, "hex");
+  const data = Buffer.from(encryptedHex, "hex");
+  const iv = data.subarray(0, 12);
+  const tag = data.subarray(12, 28);
+  const ciphertext = data.subarray(28);
+  const decipher = createDecipheriv("aes-256-gcm", key, iv);
+  decipher.setAuthTag(tag);
+  const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+  return decrypted.toString("utf8");
+}
+async function saveKeystore(keystore, keystorePath) {
+  const p = keystorePath ?? getKeystorePath();
+  await fs.mkdir(path.dirname(p), { recursive: true });
+  await fs.writeFile(p, JSON.stringify(keystore, null, 2), { encoding: "utf8", mode: 384 });
+  await fs.chmod(p, 384);
+}
+var KeystoreExistsError = class extends Error {
+  constructor(keystorePath) {
+    super(`A keystore already exists at ${keystorePath}.`);
+    this.name = "KeystoreExistsError";
+  }
+};
+async function createKeystore(keystore, keystorePath) {
+  const p = keystorePath ?? getKeystorePath();
+  await fs.mkdir(path.dirname(p), { recursive: true });
+  try {
+    await fs.writeFile(p, JSON.stringify(keystore, null, 2), {
+      encoding: "utf8",
+      mode: 384,
+      flag: "wx"
+    });
+  } catch (error) {
+    if (error.code === "EEXIST") throw new KeystoreExistsError(p);
+    throw error;
+  }
+}
+async function loadKeystore(keystorePath) {
+  const p = keystorePath ?? getKeystorePath();
+  let data;
+  try {
+    data = await fs.readFile(p, "utf8");
+  } catch {
+    throw new Error(`Keystore not found at ${p}. Run 'taskmarket init' first.`);
+  }
+  return JSON.parse(data);
+}
+async function keystoreExists(keystorePath) {
+  const p = keystorePath ?? getKeystorePath();
+  try {
+    await fs.access(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function readKeystoreNetwork(keystorePath) {
+  try {
+    const keystore = JSON.parse(
+      await fs.readFile(keystorePath ?? getKeystorePath(), "utf8")
+    );
+    return typeof keystore.network === "string" ? keystore.network : void 0;
+  } catch {
+    return void 0;
+  }
+}
+
+// src/lib/network.ts
+var NETWORK_NAMES = [
+  "base",
+  "base-sepolia",
+  "tempo",
+  "tempo-testnet",
+  "robinhood",
+  "robinhood-testnet",
+  "solana",
+  "solana-devnet"
+];
+var PRODUCTION_API_URL = "https://api.taskmarket.dev";
+var TESTNET_API_URL = "https://testnet-api-market.daydreams.systems";
+var NETWORKS = {
+  base: { name: "base", apiUrl: PRODUCTION_API_URL, chainId: 8453, available: true },
+  "base-sepolia": {
+    name: "base-sepolia",
+    apiUrl: TESTNET_API_URL,
+    chainId: 84532,
+    available: true
+  },
+  tempo: {
+    name: "tempo",
+    apiUrl: PRODUCTION_API_URL,
+    chainId: 4217,
+    available: true
+  },
+  "tempo-testnet": {
+    name: "tempo-testnet",
+    apiUrl: TESTNET_API_URL,
+    chainId: 42431,
+    available: true
+  },
+  // Robinhood Chain serves Sponsored Tasks only. Whether a chain is served is the API's own
+  // per-chain setting (ADR-0327): `chainInfoFor` refuses one its network.info does not list.
+  robinhood: {
+    name: "robinhood",
+    apiUrl: PRODUCTION_API_URL,
+    chainId: 4663,
+    available: true
+  },
+  "robinhood-testnet": {
+    name: "robinhood-testnet",
+    apiUrl: TESTNET_API_URL,
+    chainId: 46630,
+    available: true
+  },
+  // Solana runs Sponsored Tasks only; its API requests name the Base chain of the same network.
+  solana: {
+    name: "solana",
+    apiUrl: PRODUCTION_API_URL,
+    chainId: 8453,
+    available: true,
+    solana: { chainId: 101, cluster: "mainnet-beta" }
+  },
+  "solana-devnet": {
+    name: "solana-devnet",
+    apiUrl: TESTNET_API_URL,
+    chainId: 84532,
+    available: true,
+    solana: { chainId: 103, cluster: "devnet" }
+  }
+};
+var SPONSORED_ONLY_COMMANDS = ["sponsored-task", "wallet", "address"];
+function coreNetworkNames() {
+  return liveNetworkNames().filter(
+    (name) => !NETWORKS[name].solana && taskmarketChain(NETWORKS[name].chainId).isCore
+  );
+}
+function assertNetworkServesCommand(network, command) {
+  if (!network || !network.solana && taskmarketChain(network.chainId).isCore) return;
+  if (SPONSORED_ONLY_COMMANDS.includes(command)) return;
+  const name = network.solana ? `Solana (${network.name})` : taskmarketChain(network.chainId).name;
+  throw new Error(
+    `${name} serves Sponsored Tasks only: \`taskmarket ${command}\` needs a core network (${coreNetworkNames().join(", ")}). On --network ${network.name}, use: ${SPONSORED_ONLY_COMMANDS.join(", ")}.`
+  );
+}
+function networkNameForChain(chainId) {
+  return NETWORK_NAMES.find(
+    (name) => NETWORKS[name].solana ? NETWORKS[name].solana.chainId === chainId : NETWORKS[name].chainId === chainId
+  );
+}
+function taskmarketCommandFor(chainId) {
+  const name = networkNameForChain(chainId);
+  return name ? `taskmarket --network ${name}` : "taskmarket";
+}
+function isNetworkName(value) {
+  return NETWORK_NAMES.includes(value);
+}
+function getNetwork(nameOrChainId) {
+  const raw = nameOrChainId.trim().toLowerCase();
+  const name = /^\d+$/.test(raw) ? networkNameForChain(Number(raw)) ?? raw : raw;
+  if (!isNetworkName(name)) {
+    throw new Error(
+      `Unknown network '${name}'. Expected one of: ${NETWORK_NAMES.join(", ")}, or its chain id.`
+    );
+  }
+  const network = NETWORKS[name];
+  if (!network.available) {
+    const live = liveNetworkNames().join(", ");
+    throw new Error(
+      `${network.unavailableMessage ?? `Network '${name}' is not available yet.`} Choose one of: ${live}.`
+    );
+  }
+  return network;
+}
+function liveNetworkNames() {
+  return NETWORK_NAMES.filter((n) => NETWORKS[n].available);
+}
+var NetworkRequiredError = class extends Error {
+  code = "network_required";
+  constructor() {
+    super(
+      `No network selected. The CLI has no default network: pass --network <name> or set TASKMARKET_NETWORK (one of: ${liveNetworkNames().join(", ")}).`
+    );
+    this.name = "NetworkRequiredError";
+  }
+};
+function resolveNetwork(sources) {
+  const name = sources.flag || sources.env || sources.keystore;
+  return name ? getNetwork(name) : void 0;
+}
+var selected;
+function setSelectedNetwork(network) {
+  selected = network;
+}
+function selectedNetworkOrUndefined() {
+  return selected ?? resolveNetwork({ env: process.env.TASKMARKET_NETWORK });
+}
+function selectedNetwork() {
+  const network = selectedNetworkOrUndefined();
+  if (!network) throw new NetworkRequiredError();
+  return network;
+}
+function withChainId(path2, chainId = selectedNetwork().chainId) {
+  return `${path2}${path2.includes("?") ? "&" : "?"}chainId=${chainId}`;
+}
+function apiUrl() {
+  return process.env.TASKMARKET_API_URL || selectedNetwork().apiUrl;
+}
+function paymentProtocolOf(chainId) {
+  return paymentProtocolFor(taskmarketChain(chainId).payment.method);
+}
+function apiOrigin() {
+  return new URL(apiUrl()).origin;
+}
+function networkToStamp() {
+  return process.env.TASKMARKET_API_URL ? void 0 : selectedNetwork().name;
+}
+function chainInfoFor(raw, chainId) {
+  const full = NetworkInfoSchema.safeParse(raw);
+  if (!full.success) return void 0;
+  const chain = full.data.chains.find((entry) => entry.chainId === chainId);
+  if (chain) return chain;
+  const selected2 = selectedNetworkOrUndefined();
+  const subject = selected2?.chainId === chainId ? `network "${selected2.name}" (chain ${chainId})` : `chain ${chainId}`;
+  const served = full.data.chains.map((entry) => entry.chainId).join(", ");
+  throw new Error(
+    `The selected ${subject} is not available: the API at ${process.env.TASKMARKET_API_URL || selected2?.apiUrl || "the selected URL"} does not serve it (it serves chain ${served}). Choose a network it serves with --network, or point TASKMARKET_API_URL at an API that serves this one.`
+  );
+}
+
+// src/lib/tap.ts
+import {
+  constants,
+  createPrivateKey,
+  createHash,
+  createPublicKey,
+  generateKeyPairSync,
+  randomBytes as randomBytes2,
+  sign as cryptoSign
+} from "crypto";
+
+// src/lib/signer.ts
+import { privateKeyToAccount as privateKeyToAccount2 } from "viem/accounts";
+async function fetchDeviceKey(deviceId, apiToken, keyServerUrl) {
+  const base = keyServerUrl ?? apiUrl();
+  const res = await fetch(`${base}/api/devices/${deviceId}/key`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ deviceId, apiToken })
+  });
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new Error(`Failed to fetch device key (${res.status}): ${text}`);
+  }
+  const data = await res.json();
+  return data.deviceEncryptionKey;
+}
+async function signTypedData(typedData, keystore) {
+  const account = await createWalletAccountFromKeystore(keystore);
+  const sig = await account.signTypedData(typedData);
+  return sig;
+}
+async function signMessage(message, keystore) {
+  const account = await createWalletAccountFromKeystore(keystore);
+  const sig = await account.signMessage({ message });
+  return sig;
+}
+async function createWalletAccountFromKeystore(keystore) {
+  const dek = await fetchDeviceKey(keystore.deviceId, keystore.apiToken, keystore.keyServerUrl);
+  const privateKey = decryptPrivateKey(dek, keystore.encryptedKey);
+  return privateKeyToAccount2(privateKey);
+}
+async function getWalletAddress() {
+  const keystore = await loadKeystore();
+  return keystore.walletAddress;
+}
+
+// src/lib/tap.ts
+var TAP_ALGORITHMS = ["ed25519", "rsa-pss-sha256", "rsa-pss-sha512"];
+var TAP_MAX_LIFETIME_SECONDS = 8 * 60;
+var TAP_DEFAULT_LIFETIME_SECONDS = 5 * 60;
+var ED25519_PKCS8_PREFIX = Buffer.from("302e020100300506032b657004220420", "hex");
+function isTapAlgorithm(value) {
+  return TAP_ALGORITHMS.includes(value);
+}
+function algorithmsFor(key) {
+  if (key.asymmetricKeyType === "ed25519") return ["ed25519"];
+  if (key.asymmetricKeyType === "rsa" || key.asymmetricKeyType === "rsa-pss") {
+    return ["rsa-pss-sha256", "rsa-pss-sha512"];
+  }
+  return [];
+}
+function parseTapPrivateKey(text, alg) {
+  const trimmed = text.trim();
+  let privateKey;
+  if (/^(0x)?[0-9a-fA-F]{64}$/.test(trimmed)) {
+    privateKey = createPrivateKey({
+      key: Buffer.concat([ED25519_PKCS8_PREFIX, Buffer.from(trimmed.replace(/^0x/, ""), "hex")]),
+      format: "der",
+      type: "pkcs8"
+    });
+  } else if (trimmed.includes("-----BEGIN")) {
+    try {
+      privateKey = createPrivateKey(trimmed);
+    } catch {
+      throw new Error("The TAP key is not a readable PEM private key");
+    }
+  } else {
+    throw new Error(
+      "The TAP key must be a PEM private key or a 32-byte ed25519 seed as 64 hex characters"
+    );
+  }
+  const supported = algorithmsFor(privateKey);
+  if (supported.length === 0) {
+    throw new Error(
+      `TAP keys must be ed25519 or RSA, not ${privateKey.asymmetricKeyType ?? "unknown"}`
+    );
+  }
+  if (alg !== void 0) {
+    if (!isTapAlgorithm(alg)) {
+      throw new Error(`--alg must be one of: ${TAP_ALGORITHMS.join(", ")}`);
+    }
+    if (!supported.includes(alg)) {
+      throw new Error(`A ${privateKey.asymmetricKeyType} key cannot sign ${alg}`);
+    }
+    return { privateKey, alg };
+  }
+  if (supported.length > 1) {
+    throw new Error("An RSA TAP key needs --alg rsa-pss-sha256 or --alg rsa-pss-sha512");
+  }
+  return { privateKey, alg: supported[0] };
+}
+function validateTapKeyId(keyId) {
+  const trimmed = keyId.trim();
+  if (!/^[A-Za-z0-9._:~\-/+=]{1,256}$/.test(trimmed)) {
+    throw new Error("--key-id must be 1 to 256 characters of letters, digits and . _ : ~ - / + =");
+  }
+  return trimmed;
+}
+function validateTapSignatureAgent(value) {
+  const trimmed = value.trim();
+  let url;
+  try {
+    url = new URL(trimmed);
+  } catch {
+    throw new Error("--signature-agent must be an https URL");
+  }
+  if (url.protocol !== "https:") throw new Error("--signature-agent must be an https URL");
+  if (url.username !== "" || url.password !== "") {
+    throw new Error("--signature-agent must not carry credentials");
+  }
+  if (!/^[\x20-\x7e]+$/.test(trimmed) || /["\\]/.test(trimmed)) {
+    throw new Error("--signature-agent must be printable ASCII with no quotes or backslashes");
+  }
+  return trimmed;
+}
+function simulatedTapSignatureAgent(apiBase, chainId) {
+  return `${new URL(apiBase).origin}/api/tap/simulated/${chainId}`;
+}
+function tapSignatureAgentFor(stored, apiBase = apiUrl) {
+  if (stored.simulated === true && stored.chainId !== void 0) {
+    return simulatedTapSignatureAgent(apiBase(), stored.chainId);
+  }
+  return stored.signatureAgent;
+}
+function generateTapKey() {
+  return { privateKey: generateKeyPairSync("ed25519").privateKey, alg: "ed25519" };
+}
+function storedTapKey(deviceEncryptionKeyHex, keyId, key, now = /* @__PURE__ */ new Date(), source = "imported") {
+  const pem = key.privateKey.export({ type: "pkcs8", format: "pem" }).toString();
+  return {
+    keyId,
+    alg: key.alg,
+    encryptedKey: encryptPrivateKey(deviceEncryptionKeyHex, pem),
+    publicKey: createPublicKey(key.privateKey).export({ type: "spki", format: "pem" }).toString(),
+    importedAt: now.toISOString(),
+    source
+  };
+}
+function tapKeySummary(stored) {
+  return {
+    keyId: stored.keyId,
+    enrolled: stored.keyId !== null,
+    alg: stored.alg,
+    publicKey: stored.publicKey,
+    publicKeyJwk: createPublicKey(stored.publicKey).export({ format: "jwk" }),
+    source: stored.source ?? "imported",
+    importedAt: stored.importedAt,
+    /** The chain the CLI enrolled the key on, or null when it did not enrol it. */
+    chainId: stored.chainId ?? null,
+    /** True for a key id from the simulated directory, null when the CLI did not enrol it. */
+    simulated: stored.simulated ?? null,
+    /** The directory URL given at import for `Signature-Agent`, or null when none was. */
+    signatureAgent: stored.signatureAgent ?? null
+  };
+}
+async function loadTapSigningKey(keystore, deviceKey, taskId, apiBase = apiUrl) {
+  const stored = keystore.tapKey;
+  if (!stored) return void 0;
+  if (stored.keyId === null) throw new TapKeyNotEnrolledError(taskId);
+  const dek = deviceKey ? await deviceKey() : await fetchDeviceKey(keystore.deviceId, keystore.apiToken, keystore.keyServerUrl);
+  const signatureAgent = tapSignatureAgentFor(stored, apiBase);
+  return {
+    keyId: stored.keyId,
+    alg: stored.alg,
+    privateKey: createPrivateKey(decryptPrivateKey(dek, stored.encryptedKey)),
+    ...signatureAgent !== void 0 ? { signatureAgent } : {}
+  };
+}
+var TAP_OPTIONAL_HEADERS = ["x-taskmarket-idempotency-key", "authorization"];
+var TAP_OWN_HEADERS = /* @__PURE__ */ new Set([
+  "signature",
+  "signature-input",
+  "content-digest",
+  "signature-agent"
+]);
+function tapSignatureParams(p) {
+  return `(${p.components.map((c) => `"${c}"`).join(" ")});created=${p.created};expires=${p.expires};keyid="${p.keyId}";alg="${p.alg}";nonce="${p.nonce}";tag="${p.tag}"`;
+}
+function bodyBytes(body) {
+  return typeof body === "string" ? Buffer.from(body, "utf8") : Buffer.from(body);
+}
+function tapContentDigest(body) {
+  return `sha-256=:${createHash("sha256").update(bodyBytes(body)).digest("base64")}:`;
+}
+function tapSignatureAgentHeader(url) {
+  return `"${url}"`;
+}
+function tapCoveredComponents(request) {
+  const u = new URL(request.url);
+  const headers = new Headers(request.headers);
+  const out = [
+    { name: "@method", value: request.method.toUpperCase() },
+    { name: "@scheme", value: u.protocol.replace(/:$/, "").toLowerCase() },
+    { name: "@authority", value: u.host.toLowerCase() },
+    { name: "@path", value: u.pathname || "/" },
+    // `?` and the raw query, or a bare `?` when there is none (RFC 9421 section 2.2.7).
+    { name: "@query", value: u.search === "" ? "?" : u.search }
+  ];
+  const header = (name) => {
+    const value = headers.get(name);
+    if (value !== null) out.push({ name, value: value.trim() });
+  };
+  if (request.body !== void 0 && request.body !== null) {
+    header("content-digest");
+    header("content-type");
+  }
+  header("signature-agent");
+  for (const name of TAP_OPTIONAL_HEADERS) header(name);
+  return out;
+}
+function tapSignatureBase(components, signatureParams) {
+  return [
+    ...components.map((c) => `"${c.name}": ${c.value}`),
+    `"@signature-params": ${signatureParams}`
+  ].join("\n");
+}
+function rawSign(alg, privateKey, data) {
+  if (alg === "ed25519") return cryptoSign(null, data, privateKey);
+  return cryptoSign(alg === "rsa-pss-sha256" ? "sha256" : "sha512", data, {
+    key: privateKey,
+    padding: constants.RSA_PKCS1_PSS_PADDING,
+    saltLength: alg === "rsa-pss-sha256" ? 32 : 64
+  });
+}
+function withoutTapHeaders(headers) {
+  const out = {};
+  for (const [name, value] of Object.entries(headers ?? {})) {
+    if (!TAP_OWN_HEADERS.has(name.toLowerCase())) out[name] = value;
+  }
+  return out;
+}
+function signTapRequest(opts) {
+  const created = opts.created ?? Math.floor(Date.now() / 1e3);
+  const lifetime = Math.min(
+    opts.lifetimeSeconds ?? TAP_DEFAULT_LIFETIME_SECONDS,
+    TAP_MAX_LIFETIME_SECONDS
+  );
+  const added = {};
+  if (opts.body !== void 0 && opts.body !== null) {
+    added["Content-Digest"] = tapContentDigest(opts.body);
+  }
+  if (opts.key.signatureAgent !== void 0) {
+    added["Signature-Agent"] = tapSignatureAgentHeader(opts.key.signatureAgent);
+  }
+  const components = tapCoveredComponents({
+    ...opts,
+    headers: { ...withoutTapHeaders(opts.headers), ...added }
+  });
+  const params = tapSignatureParams({
+    components: components.map((c) => c.name),
+    keyId: opts.key.keyId,
+    alg: opts.key.alg,
+    tag: opts.tag ?? "agent-browser-auth",
+    created,
+    expires: created + lifetime,
+    nonce: opts.nonce ?? randomBytes2(16).toString("base64url")
+  });
+  const base = tapSignatureBase(components, params);
+  const sig = rawSign(opts.key.alg, opts.key.privateKey, Buffer.from(base, "utf8"));
+  return {
+    ...added,
+    "Signature-Input": `sig1=${params}`,
+    Signature: `sig1=:${sig.toString("base64")}:`
+  };
+}
+function withTapSignature(request, tap) {
+  if (!tap) return { ...request.headers ?? {} };
+  const headers = withoutTapHeaders(request.headers);
+  return { ...headers, ...signTapRequest({ ...request, headers, key: tap.key, tag: tap.tag }) };
+}
+function headerRecord(init) {
+  const out = {};
+  new Headers(init ?? {}).forEach((value, name) => {
+    out[name] = value;
+  });
+  return out;
+}
+async function fetchBody(input, init) {
+  const body = init?.body ?? null;
+  if (body === null) {
+    if (input instanceof Request && input.body !== null) {
+      return new Uint8Array(await input.clone().arrayBuffer());
+    }
+    return null;
+  }
+  if (typeof body === "string" || body instanceof Uint8Array) return body;
+  if (body instanceof ArrayBuffer) return new Uint8Array(body);
+  if (ArrayBuffer.isView(body)) {
+    return new Uint8Array(body.buffer, body.byteOffset, body.byteLength);
+  }
+  throw new Error("A TAP-signed request body must be a string or bytes");
+}
+function tapSigningFetch(base, tap) {
+  return (async (input, init) => {
+    const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+    const method = (init?.method ?? (input instanceof Request ? input.method : "GET")).toUpperCase();
+    if (method !== "POST") return base(input, init);
+    const headers = {
+      ...headerRecord(input instanceof Request ? input.headers : void 0),
+      ...headerRecord(init?.headers)
+    };
+    const body = await fetchBody(input, init);
+    return base(input, { ...init, headers: withTapSignature({ method, url, headers, body }, tap) });
+  });
+}
+function taskRequiresTap(task) {
+  return (task?.verifiedBy ?? []).some((id) => verifierProviderId(id) === "tap");
+}
+var TapKeyMissingError = class extends Error {
+  code = "tap_key_missing";
+  constructor(taskId) {
+    super(
+      `Task ${taskId} requires TAP verification and no TAP key is configured. Import one with 'taskmarket tap import --key-id <id> --key-file <path>', or create one with 'taskmarket tap create' and enrol it with 'taskmarket tap enrol'.`
+    );
+    this.name = "TapKeyMissingError";
+  }
+};
+var TapKeyNotEnrolledError = class extends Error {
+  code = "tap_key_not_enrolled";
+  constructor(taskId) {
+    super(
+      `${taskId ? `Task ${taskId} requires TAP verification and the` : "The"} TAP key is not enrolled: it has no key id. Enrol it with 'taskmarket tap enrol' on a chain that uses the simulated directory; enrolment with the verifier is not available from the CLI yet. Nothing was sent.`
+    );
+    this.name = "TapKeyNotEnrolledError";
+  }
+};
+async function runWorkerAction(input) {
+  if (!taskRequiresTap(input.task)) return input.run(void 0);
+  const key = await loadTapSigningKey(input.keystore, input.deviceKey, input.taskId);
+  if (!key) throw new TapKeyMissingError(input.taskId);
+  return input.run({ key, tag: input.tag ?? "agent-browser-auth" });
+}
+var TASK_REQUIREMENT_HINTS = {
+  identity_missing: "The worker wallet has no identity under this protocol. Register one with 'taskmarket identity register'.",
+  verification_failed: "The verifier did not accept the request. For TAP, import a key with 'taskmarket tap import' or, if none is configured, create one with 'taskmarket tap create' and enrol it with 'taskmarket tap enrol', then check 'taskmarket tap show': the key id must be in the verifier's key directory, the algorithm must match it, the key must not be bound to another wallet, and the local clock must be correct.",
+  verifier_unavailable: "The verifier is not configured on this server, could not be reached, or does not run on this task's chain (TAP is Tempo only). Nothing was charged; try again later, or pick a task on Tempo.",
+  wallet_unidentified: "The request did not say which wallet is acting. Update the CLI; it identifies the worker on gated actions.",
+  batched_request: "A gated action was sent in a batched request. Send it on its own."
+};
+function taskRequirementHints(requirements) {
+  return requirements.map((r) => ({
+    ...r,
+    hint: requirementHint(r)
+  }));
+}
+function requirementHint(r) {
+  if (r.id === "erc8004:reputation:reputable" && r.reason === "verification_failed") {
+    return `${r.message ? `This wallet ${r.message}. ` : ""}Accepted jobs are counted from Taskmarket's own records; 'taskmarket stats' shows your count. Nothing was charged.`;
+  }
+  return TASK_REQUIREMENT_HINTS[r.reason] ?? "This requirement is not met.";
+}
+
+// src/lib/api.ts
+var ApiError = class extends Error {
+  status;
+  /**
+   * The idempotency key the failed write was sent under, when the request was a write. This is
+   * the only identifier the caller can still hold after a failure -- the intent id is minted by
+   * the backend and reaches the caller only in the response the failure destroyed -- so it
+   * travels on the error rather than being recoverable from the response. See
+   * apps/cli/src/index.ts and lib/output.ts, which surface it on the CLI's JSON envelope.
+   */
+  idempotencyKey;
+  /**
+   * The backend's machine-readable classification of the failure (ADR-0058).
+   *
+   * Before it existed the CLI rendered every failure identically, which is why
+   * `docs/guides/CLI_GUIDE.md` had to tell script authors never to auto-retry a paid command: there was
+   * no way to tell a write that is still landing from one that was definitively rejected, and
+   * retrying the first is a second payment. `reason` is that way.
+   *
+   * Absent when the backend answered with no envelope -- an older deployment, or a failure that
+   * never reached the API at all -- in which case a caller must fall back to the old rule and
+   * treat the outcome as unknown rather than as safe to retry.
+   */
+  envelope;
+  constructor(status, message, idempotencyKey, envelope) {
+    super(message);
+    this.name = "ApiError";
+    this.status = status;
+    this.idempotencyKey = idempotencyKey;
+    this.envelope = envelope;
+  }
+};
+async function readFailureBody(res) {
+  return parseFailureBody(await res.text().catch(() => ""));
+}
+function parseFailureBody(text) {
+  try {
+    return { body: JSON.parse(text), text };
+  } catch {
+    return { body: void 0, text };
+  }
+}
+function failureMessage(prefix, status, read) {
+  return `${prefix} (${status}): ${read.body !== void 0 ? JSON.stringify(read.body) : read.text}`;
+}
+function withErrorContext(error, context) {
+  const message = error instanceof Error ? error.message : String(error);
+  const wrapped = error instanceof ApiError ? new ApiError(error.status, `${context}: ${message}`, error.idempotencyKey, error.envelope) : new Error(`${context}: ${message}`);
+  const key = idempotencyKeyForError(error);
+  if (key !== void 0) {
+    rememberIdempotencyKeyFor(wrapped, key);
+  }
+  return wrapped;
+}
+function isPendingApiError(error) {
+  return error instanceof ApiError && isInFlightApiError(error.envelope);
+}
+function legalReceiptHeadersForKeystore(keystore, path2, method) {
+  const canSend = keystore.legalAcceptanceApiOrigin === apiOrigin() && (method === "POST" || path2 === "/api/legal/status");
+  return canSend ? buildLegalReceiptHeaders(keystore.legalAcceptanceReceipt) : {};
+}
+async function legalReceiptHeaders(path2, method) {
+  try {
+    const keystore = await loadKeystore();
+    return legalReceiptHeadersForKeystore(keystore, path2, method);
+  } catch {
+    return {};
+  }
+}
+async function apiGet(path2, options) {
+  const legalHeaders = await legalReceiptHeaders(path2, "GET");
+  const res = await fetch(`${apiUrl()}${path2}`, {
+    method: "GET",
+    redirect: "error",
+    signal: options?.signal,
+    headers: {
+      "Content-Type": "application/json",
+      ...legalHeaders,
+      ...options?.headers ?? {}
+    }
+  });
+  if (!res.ok) {
+    const read = await readFailureBody(res);
+    throw new ApiError(
+      res.status,
+      failureMessage(`GET ${path2} failed`, res.status, read),
+      void 0,
+      apiErrorEnvelopeOf(read.body) ?? void 0
+    );
+  }
+  return res.json();
+}
+async function apiReadPost(path2, body, options) {
+  const legalHeaders = await legalReceiptHeaders(path2, "POST");
+  const res = await fetch(`${apiUrl()}${path2}`, {
+    method: "POST",
+    redirect: "error",
+    headers: { "Content-Type": "application/json", ...legalHeaders, ...options?.headers ?? {} },
+    body: JSON.stringify(body)
+  });
+  if (!res.ok) {
+    const read = await readFailureBody(res);
+    throw new ApiError(
+      res.status,
+      failureMessage(`POST ${path2} failed`, res.status, read),
+      void 0,
+      apiErrorEnvelopeOf(read.body) ?? void 0
+    );
+  }
+  return res.json();
+}
+async function apiPost(path2, body, options) {
+  const legalHeaders = await legalReceiptHeaders(path2, "POST");
+  const idempotencyKey = resolveIdempotencyKey(options?.idempotencyKey);
+  return withIdempotentWrite(idempotencyKey, async () => {
+    const url = `${apiUrl()}${path2}`;
+    const payload = JSON.stringify(body);
+    const res = await fetch(url, {
+      method: "POST",
+      redirect: "error",
+      // Signed over this exact request with a fresh nonce when the write carries an attestation.
+      headers: withTapSignature(
+        {
+          method: "POST",
+          url,
+          headers: {
+            "Content-Type": "application/json",
+            ...legalHeaders,
+            ...idempotencyHeaders(idempotencyKey),
+            ...options?.headers ?? {}
+          },
+          body: payload
+        },
+        options?.tap
+      ),
+      body: payload
+    });
+    if (!res.ok) {
+      const read = await readFailureBody(res);
+      throw new ApiError(
+        res.status,
+        failureMessage(`POST ${path2} failed`, res.status, read),
+        idempotencyKey,
+        apiErrorEnvelopeOf(read.body) ?? void 0
+      );
+    }
+    return { data: await res.json(), idempotencyKey };
+  });
+}
+async function apiDelete(path2, options) {
+  const legalHeaders = await legalReceiptHeaders(path2, "POST");
+  const idempotencyKey = resolveIdempotencyKey(options?.idempotencyKey);
+  return withIdempotentWrite(idempotencyKey, async () => {
+    const res = await fetch(`${apiUrl()}${path2}`, {
+      method: "DELETE",
+      redirect: "error",
+      headers: {
+        "Content-Type": "application/json",
+        ...legalHeaders,
+        ...idempotencyHeaders(idempotencyKey),
+        ...options?.headers ?? {}
+      }
+    });
+    if (!res.ok) {
+      const read = await readFailureBody(res);
+      throw new ApiError(
+        res.status,
+        failureMessage(`DELETE ${path2} failed`, res.status, read),
+        idempotencyKey,
+        apiErrorEnvelopeOf(read.body) ?? void 0
+      );
+    }
+    return { data: await res.json(), idempotencyKey };
+  });
+}
+async function apiPut(path2, body, options) {
+  const legalHeaders = await legalReceiptHeaders(path2, "POST");
+  const idempotencyKey = resolveIdempotencyKey(options?.idempotencyKey);
+  return withIdempotentWrite(idempotencyKey, async () => {
+    const res = await fetch(`${apiUrl()}${path2}`, {
+      method: "PUT",
+      redirect: "error",
+      headers: {
+        "Content-Type": "application/json",
+        ...legalHeaders,
+        ...idempotencyHeaders(idempotencyKey),
+        ...options?.headers ?? {}
+      },
+      body: JSON.stringify(body)
+    });
+    if (!res.ok) {
+      const read = await readFailureBody(res);
+      throw new ApiError(
+        res.status,
+        failureMessage(`PUT ${path2} failed`, res.status, read),
+        idempotencyKey,
+        apiErrorEnvelopeOf(read.body) ?? void 0
+      );
+    }
+    return { data: await res.json(), idempotencyKey };
+  });
+}
+
+export {
+  generateKeypair,
+  encryptPrivateKey,
+  decryptPrivateKey,
+  saveKeystore,
+  KeystoreExistsError,
+  createKeystore,
+  loadKeystore,
+  keystoreExists,
+  readKeystoreNetwork,
+  idempotencyKeyForError,
+  resolveIdempotencyKey,
+  withIdempotentWrite,
+  idempotencyHeaders,
+  NETWORK_NAMES,
+  NETWORKS,
+  coreNetworkNames,
+  assertNetworkServesCommand,
+  taskmarketCommandFor,
+  isNetworkName,
+  getNetwork,
+  NetworkRequiredError,
+  resolveNetwork,
+  setSelectedNetwork,
+  selectedNetworkOrUndefined,
+  selectedNetwork,
+  withChainId,
+  apiUrl,
+  paymentProtocolOf,
+  apiOrigin,
+  networkToStamp,
+  chainInfoFor,
+  fetchDeviceKey,
+  signTypedData,
+  signMessage,
+  createWalletAccountFromKeystore,
+  getWalletAddress,
+  TAP_ALGORITHMS,
+  parseTapPrivateKey,
+  validateTapKeyId,
+  validateTapSignatureAgent,
+  generateTapKey,
+  storedTapKey,
+  tapKeySummary,
+  withTapSignature,
+  tapSigningFetch,
+  taskRequiresTap,
+  runWorkerAction,
+  taskRequirementHints,
+  ApiError,
+  readFailureBody,
+  parseFailureBody,
+  failureMessage,
+  withErrorContext,
+  isPendingApiError,
+  legalReceiptHeadersForKeystore,
+  apiGet,
+  apiReadPost,
+  apiPost,
+  apiDelete,
+  apiPut
+};