@lucid-agents/taskmarket 1.7.3 → 1.9.0

package/dist/index.js

@@ -6,7 +6,7 @@ var __export = (target, all) => {
 };
 
 // src/index.ts
-import { Command as Command66 } from "commander";
+import { Command as Command68 } from "commander";
 import { createRequire } from "module";
 
 // src/commands/init.ts
@@ -4271,7 +4271,10 @@ var TaskCreateSchema = external_exports.object({
   taskVisibility: TaskVisibility.optional().default("public"),
   submissionVisibility: SubmissionVisibility.optional().default("public"),
   stakeRequired: external_exports.boolean().optional().default(false),
-  stakeBps: external_exports.number().min(0).max(1e4).optional().default(0),
+  // Integral: this is client-supplied and lands in a `uint16` on chain, where a fraction is
+  // not representable at all. Without `.int()` a 12.5 was accepted here and silently became
+  // something else by the time it reached the contract (ADR-0069).
+  stakeBps: external_exports.number().int().min(0).max(1e4).optional().default(0),
   pitchDeadline: external_exports.number().positive().optional(),
   bidDeadline: external_exports.number().positive().optional(),
   maxPrice: PositiveUsdcBaseUnitsSchema.optional(),
@@ -4283,7 +4286,8 @@ var TaskCreateSchema = external_exports.object({
   hookContract: external_exports.string().optional(),
   hookData: external_exports.string().regex(/^0x(?:[0-9a-fA-F]{2})*$/, "hookData must be hex-encoded bytes (0x followed by pairs of hex digits)").optional(),
   evaluator: external_exports.string().optional(),
-  evaluatorFeeBps: external_exports.number().min(0).max(1e4).optional(),
+  // Integral for the same reason as `stakeBps` above: client-supplied, `uint16` on chain.
+  evaluatorFeeBps: external_exports.number().int().min(0).max(1e4).optional(),
   evaluationWindowHours: external_exports.number().positive().optional(),
   appealWindowHours: external_exports.number().positive().optional(),
   disputeResolver: external_exports.string().optional(),
@@ -4399,7 +4403,9 @@ var TaskResponseSchema = external_exports.object({
   // never the hash itself, and never returned for a non-private task.
   hasAccessPassword: external_exports.boolean().optional(),
   stakeRequired: external_exports.boolean(),
-  stakeBps: external_exports.number(),
+  // Same shape the request side already enforces (ADR-0069): a `uint16` fraction of the escrow,
+  // so the response cannot describe a stake the contract could not have held.
+  stakeBps: external_exports.number().int().min(0).max(1e4),
   pitchDeadline: external_exports.string().nullable(),
   bidDeadline: external_exports.string().nullable(),
   maxPrice: external_exports.string().nullable(),
@@ -4407,7 +4413,10 @@ var TaskResponseSchema = external_exports.object({
   metricTarget: external_exports.string().nullable(),
   claimedBy: external_exports.string().nullable(),
   claimedAt: external_exports.string().nullable(),
-  platformFeeBps: external_exports.number(),
+  // Required, never optional: this is the multiplier every net-reward figure a client shows is
+  // derived from, and the column behind it has been `NOT NULL` since the first migration. A
+  // reader that had to supply its own value on absence would be guessing at money.
+  platformFeeBps: external_exports.number().int().min(0).max(1e4),
   submissionCount: external_exports.number().optional().default(0),
   awardCount: external_exports.number().int().nonnegative().optional(),
   // Read-time projection of the rank-1 task_awards row -- not a separately
@@ -4433,7 +4442,9 @@ var TaskResponseSchema = external_exports.object({
   hookContract: external_exports.string().nullable().optional(),
   evaluator: external_exports.string().nullable().optional(),
   evaluatorStake: external_exports.string().nullable().optional(),
-  evaluatorFeeBps: external_exports.number().nullable().optional(),
+  // Genuinely absent when no evaluator is configured -- unlike `platformFeeBps`, null here means
+  // "no evaluator fee", which is the same thing as zero, so a reader coalescing to 0 is right.
+  evaluatorFeeBps: external_exports.number().int().min(0).max(1e4).nullable().optional(),
   evaluationWindow: external_exports.number().nullable().optional(),
   appealWindow: external_exports.number().nullable().optional(),
   disputeResolver: external_exports.string().nullable().optional(),
@@ -4488,11 +4499,66 @@ var TaskInboxResponseSchema = external_exports.object({
   // than a separate notification-center feature.
   invitedPrivateTasks: external_exports.array(TaskResponseSchema).optional().default([])
 });
+var TaskActionIntent = external_exports.enum([
+  "review_work",
+  "select_worker",
+  "submit_work",
+  "settle_expired",
+  "evaluate_work",
+  "appeal_verdict",
+  "resolve_dispute",
+  "finalize_verdict",
+  "rate_workers",
+  "select_auction_winner"
+]);
+var TaskActionPriority = external_exports.enum(["urgent", "required", "follow_up"]);
+var TaskActionProgressSchema = external_exports.object({
+  completed: external_exports.number().int().nonnegative(),
+  total: external_exports.number().int().positive()
+}).refine(({ completed, total }) => completed <= total, {
+  message: "Completed progress cannot exceed the target total",
+  path: ["completed"]
+});
+var TaskActionQueueItemSchema = external_exports.object({
+  id: external_exports.string(),
+  task: TaskResponseSchema,
+  role: PendingActionSchema.shape.role,
+  intent: TaskActionIntent,
+  actions: PendingActionSchema.array().min(1),
+  priority: TaskActionPriority,
+  dueAt: external_exports.string().nullable(),
+  progress: TaskActionProgressSchema.nullable().optional()
+});
+var TaskActionWaitingReason = external_exports.enum([
+  "waiting_for_submissions",
+  "waiting_for_worker",
+  "waiting_for_review",
+  "waiting_for_evaluator",
+  "waiting_for_appeal_window",
+  "waiting_for_settlement"
+]);
+var TaskActionWaitingItemSchema = external_exports.object({
+  id: external_exports.string(),
+  task: TaskResponseSchema,
+  role: PendingActionSchema.shape.role,
+  reason: TaskActionWaitingReason,
+  dueAt: external_exports.string().nullable()
+});
+var TaskActionQueueResponseSchema = external_exports.object({
+  items: TaskActionQueueItemSchema.array(),
+  total: external_exports.number().int().nonnegative(),
+  urgentTotal: external_exports.number().int().nonnegative(),
+  waiting: TaskActionWaitingItemSchema.array()
+});
 var TaskDetailResponseSchema = TaskResponseSchema.extend({
   pendingActions: PendingActionSchema.array(),
   awards: TaskAwardSchema.array().optional(),
   dreamsPerUsdc: external_exports.string().optional(),
-  bonusBps: external_exports.number().optional(),
+  // Optional as a set, not individually: the router emits `dreamsPerUsdc`, `bonusBps` and every
+  // `estimated*` field together or not at all, depending on whether the task carries the DREAMS
+  // hook. No client multiplies this by a split of its own -- the worker/requester estimates are
+  // computed server-side -- so the absent case needs no fallback multiplier anywhere.
+  bonusBps: external_exports.number().int().min(0).max(1e4).optional(),
   estimatedUsdBonusValue: external_exports.string().optional(),
   estimatedWorkerUsdBonusValue: external_exports.string().optional(),
   estimatedRequesterUsdBonusValue: external_exports.string().optional(),
@@ -4506,6 +4572,16 @@ var RejectSubmissionInputSchema = external_exports.object({
   taskId: external_exports.string(),
   worker: external_exports.string()
 });
+var AssignEvaluatorInputSchema = external_exports.object({
+  taskId: external_exports.string(),
+  evaluator: external_exports.string(),
+  // Integral: same field, same `uint16`, and the two request-side schemas must not disagree
+  // about what a caller may send.
+  evaluatorFeeBps: external_exports.number().int().min(0).max(1e4).optional(),
+  evaluationWindowHours: external_exports.number().positive().optional(),
+  appealWindowHours: external_exports.number().positive().optional(),
+  disputeResolver: external_exports.string().optional()
+});
 var RefundExpiredInputSchema = external_exports.object({
   taskId: external_exports.string()
 });
@@ -4714,7 +4790,47 @@ var FeedbackSchema = external_exports.object({
 var HealthResponseSchema = external_exports.object({
   status: external_exports.literal("ok"),
   timestamp: external_exports.string(),
-  environment: external_exports.string()
+  environment: external_exports.string(),
+  /**
+   * The submission limits this process is actually enforcing, after any environment
+   * override. Reported because a limit a caller cannot observe is a limit a test can only
+   * guess at: smoke-rate-limit.ts asserted against its own copy of the ceiling and had no
+   * way to notice the backend was started with a different one, so it failed with a
+   * confusing boundary error instead of saying the two disagreed.
+   */
+  limits: external_exports.object({
+    freeSubmissionAllowance: external_exports.number().int().positive(),
+    hardSubmissionCeiling: external_exports.number().int().positive()
+  }),
+  /**
+   * Relayed-intent facts a caller can poll for, in the same spirit as `limits`: a queryable
+   * number, not an alert (ADR-0053).
+   *
+   * Optional because health is what tells you the service is up. If no count is available the
+   * object is omitted rather than reported as a sentinel -- absence under an optional field is
+   * unambiguous, whereas a `-1` or an `"unknown"` string is a value every consumer has to learn
+   * not to plot, and it is also exactly how this endpoint already reads to a caller running
+   * against a build from before the field existed.
+   *
+   * Absent means "no answer here", and it covers a process whose sweep has not run yet as well
+   * as one that does not sweep at all. It never means zero.
+   */
+  intents: external_exports.object({
+    /**
+     * When the count below was computed, not when it was served.
+     *
+     * These numbers come from a periodic sweep rather than from the request, so the response
+     * is a cache and says so. Without this a consumer cannot tell a live zero from a zero
+     * left behind by a worker that stopped running -- and the second is the more urgent of
+     * the two, because a sweep that is not running is a queue nothing is draining.
+     */
+    measuredAt: external_exports.string(),
+    /**
+     * Intents that are neither completed nor failed and have not been touched for well past
+     * normal settlement. A count only -- the endpoint is public.
+     */
+    staleNonTerminal: external_exports.number().int().nonnegative()
+  }).optional()
 });
 
 // ../../packages/shared/dist/schemas/pitch.schemas.js
@@ -4873,8 +4989,12 @@ var WithdrawDreamsOutputSchema = external_exports.object({
 });
 var ExchangeRateOutputSchema = external_exports.object({
   dreamsPerUsdc: external_exports.string(),
-  workerSplitBps: external_exports.number(),
-  bonusBps: external_exports.number()
+  // Both are read straight off `TaskTokenRewardHook`, which rejects either above 10000
+  // (`InvalidBps`), and both are required here rather than optional: a client that had to
+  // default the split would default it to the whole reward, and one that had to default the
+  // bonus would report no bonus at all. Neither is a fact this endpoint may leave to the reader.
+  workerSplitBps: external_exports.number().int().min(0).max(1e4),
+  bonusBps: external_exports.number().int().min(0).max(1e4)
 });
 
 // ../../packages/shared/dist/schemas/xmtp.schemas.js
@@ -5204,6 +5324,225 @@ var AllowedViewerResponseSchema = external_exports.object({
 });
 var ListAllowedViewersResponseSchema = external_exports.array(AllowedViewerResponseSchema);
 
+// ../../packages/shared/dist/schemas/api-error.schemas.js
+var API_ERROR_REASONS = [
+  /**
+   * No terminal outcome has been established. The write is owned by the settlement path and
+   * may still succeed. **This is not a failure and not a success**, and it makes no claim about
+   * whether the payment moved (ADR-0049 point 3). Never resubmit; poll `intents.get`.
+   */
+  "intent_in_flight",
+  /**
+   * A write carrying this idempotency key already exists, and this request neither charged the
+   * caller nor submitted anything a second time. Idempotency working, reported as a conflict --
+   * see ADR-0058 for why this is not a 200 carrying the original result.
+   */
+  "idempotency_key_reused",
+  /**
+   * The request arrived with no `X-Taskmarket-Idempotency-Key` header (the value of
+   * `IDEMPOTENCY_KEY_HEADER`), or one that is not a UUID. Rejected before the 402 challenge,
+   * so nothing was charged (ADR-0052).
+   */
+  "idempotency_key_required",
+  /**
+   * The key is already bound to a *different* operation, or to a different caller's write. Not
+   * the benign repeat: nothing here can be waited on, and the caller must generate a fresh key.
+   * Distinguished from `idempotency_key_reused` because the correct client response is opposite
+   * -- poll there, resubmit under a new key here.
+   */
+  "idempotency_key_conflict",
+  /**
+   * The key names the *same* operation by the *same* caller, but with different arguments. One
+   * level finer than `idempotency_key_conflict`, and a distinct reason because the caller's
+   * mistake is distinct: they reused a key while changing what they were asking for, so the
+   * write they just described never happened and the one the key already names is not it
+   * (ADR-0061). Re-send the original arguments to retry the original write, or generate a fresh
+   * key for the new one.
+   */
+  "idempotency_key_payload_mismatch",
+  /**
+   * The settled payment behind this request has already funded another intent. A retry that
+   * failed to reuse its key, or a replayed payment. The money is spent and this write did not
+   * happen; the caller reads the intent that did consume it from `intents.get`.
+   */
+  "payment_already_spent",
+  /**
+   * The idempotency precondition could not be read, so the request was refused rather than
+   * risking a double charge on an unverified assumption. Safe to retry with the same key.
+   */
+  "idempotency_check_unavailable",
+  /**
+   * The chain call is confirmed and the work happened, but recording it did not finish. There
+   * is nothing to refund and nothing to resubmit; the intent is retried automatically.
+   */
+  "intent_completion_deferred",
+  /**
+   * No intent answers to that id or key *for this caller*. Deliberately one reason for both "no
+   * such intent" and "not yours": telling them apart would make this surface an oracle for which
+   * intent ids and idempotency keys exist (ADR-0049 point 6).
+   */
+  "intent_not_found",
+  /** The x402 exchange did not produce a settled payment. Nothing was charged. */
+  "payment_rejected",
+  /** A pre-settlement check on the request's own inputs or on task state rejected it. */
+  "payment_preflight_rejected",
+  /**
+   * The settled payment came from an address other than the one the request is authenticated as
+   * acting for. The write was refused; the payment had already settled when the mismatch was
+   * seen, so the fee is not returned by this path.
+   */
+  "payment_payer_mismatch",
+  /**
+   * The error carries no more specific classification. Present so that every error has a
+   * reason field and a client's switch is total; not a licence to leave one here.
+   */
+  "unclassified"
+];
+var ApiErrorReasonSchema = external_exports.enum(API_ERROR_REASONS);
+var ApiErrorIntentStatusSchema = external_exports.enum([
+  "reserved",
+  "recorded",
+  "broadcast",
+  "completed",
+  "failed"
+]);
+var REASONS_WITHOUT_REQUIRED_INTENT_STATUS = API_ERROR_REASONS.filter((reason) => reason !== "idempotency_key_reused");
+var ENVELOPE_FIELDS = {
+  /** The durable handle to the write, where one was recorded. Key on this, not on `txHash`. */
+  intentId: external_exports.string().optional(),
+  /** The operation the intent stands for, e.g. `tasks.create`. */
+  operation: external_exports.string().optional(),
+  /** The caller's own key for the operation, echoed so a dropped response is still traceable. */
+  idempotencyKey: external_exports.string().optional(),
+  /**
+   * Known once something has been broadcast, and explicitly not the handle: the reconciler may
+   * land a replacement at the same nonce, which is a different hash for the same intent.
+   */
+  txHash: external_exports.string().optional()
+};
+var ApiErrorEnvelopeSchema = external_exports.discriminatedUnion("reason", [
+  external_exports.object({
+    reason: external_exports.literal("idempotency_key_reused"),
+    /** Required here: the reason means an intent under this key exists, so it has a status. */
+    intentStatus: ApiErrorIntentStatusSchema,
+    ...ENVELOPE_FIELDS
+  }),
+  external_exports.object({
+    reason: external_exports.enum(REASONS_WITHOUT_REQUIRED_INTENT_STATUS),
+    /** The intent's status at the moment this answer was produced, where there is an intent. */
+    intentStatus: ApiErrorIntentStatusSchema.optional(),
+    ...ENVELOPE_FIELDS
+  })
+]);
+var IN_FLIGHT_REASONS = /* @__PURE__ */ new Set([
+  "intent_in_flight",
+  "idempotency_key_reused",
+  // Not "may still succeed" but "already succeeded, still being written down". Both are
+  // answered the same way -- poll, never resubmit -- and reporting this one as settled told a
+  // script following the documented rule that re-running it was an ordinary retry. It is not:
+  // the chain call is confirmed, so a re-run is a second paid action for work already done.
+  "intent_completion_deferred"
+]);
+function isInFlightApiError(envelope) {
+  if (!envelope || !IN_FLIGHT_REASONS.has(envelope.reason))
+    return false;
+  if (envelope.reason !== "idempotency_key_reused")
+    return true;
+  return envelope.intentStatus !== "completed" && envelope.intentStatus !== "failed";
+}
+function apiErrorEnvelopeOf(value) {
+  if (!value || typeof value !== "object")
+    return null;
+  const at = (source, key) => source && typeof source === "object" ? source[key] : void 0;
+  const candidate = at(value, "taskmarket") ?? at(at(value, "data"), "taskmarket") ?? at(at(at(value, "error"), "data"), "taskmarket") ?? value;
+  const parsed = ApiErrorEnvelopeSchema.safeParse(candidate);
+  return parsed.success ? parsed.data : null;
+}
+
+// ../../packages/shared/dist/schemas/intent.schemas.js
+var IntentStatusInputSchema = external_exports.object({
+  intentId: external_exports.string().min(1).optional(),
+  idempotencyKey: external_exports.string().min(1).optional()
+}).refine((value) => Boolean(value.intentId) !== Boolean(value.idempotencyKey), {
+  message: "Provide exactly one of intentId or idempotencyKey"
+});
+var IntentRefundStateSchema = external_exports.object({
+  status: external_exports.enum(["pending", "refunding", "refunded", "failed"]),
+  txHash: external_exports.string().nullable()
+});
+var IntentStatusResponseSchema = external_exports.object({
+  intentId: external_exports.string(),
+  idempotencyKey: external_exports.string(),
+  /** The operation kind, e.g. `tasks.create`. */
+  operation: external_exports.string(),
+  /**
+   * `reserved` is the pre-payment state (ADR-0067): the key is claimed and the caller has been
+   * challenged, but no payment has landed and nothing has been sent to the chain. It is
+   * non-terminal, it is never broadcastable, and it expires if it is never filled.
+   */
+  status: external_exports.enum(["reserved", "recorded", "broadcast", "completed", "failed"]),
+  /**
+   * Known once something has been broadcast, and explicitly not the handle: the reconciler
+   * may land a replacement at the same nonce, which is a different hash for the same intent.
+   */
+  txHash: external_exports.string().nullable(),
+  /** Why it failed, where it did. Null on every non-terminal status. */
+  terminalReason: external_exports.string().nullable(),
+  /**
+   * The task a completed `tasks.create` produced.
+   *
+   * This is where a caller whose creation went in flight learns the id. The id does not
+   * exist until the transaction runs -- the contract derives it from a requester nonce it
+   * increments as it goes -- so an in-flight creation has no id to report, and reporting one
+   * would be a guess of the kind that made concurrent creates overwrite each other. Null
+   * until the intent completes, and null for every other operation.
+   */
+  taskId: external_exports.string().nullable(),
+  /**
+   * Only present where the intent carried a payment and that payment has been written off.
+   * Null means no refund has been decided -- which is not the same as "no refund is coming"
+   * while the intent is still in flight.
+   */
+  refund: IntentRefundStateSchema.nullable()
+}).superRefine((value, ctx) => {
+  if (value.status === "reserved") {
+    for (const field of ["txHash", "terminalReason", "taskId"]) {
+      if (value[field] !== null) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: [field],
+          message: `A reserved intent has not been sent to the chain, so ${field} must be null`
+        });
+      }
+    }
+    return;
+  }
+  if (value.terminalReason !== null && value.status !== "failed") {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["terminalReason"],
+      message: "Only a failed intent has a terminal reason"
+    });
+  }
+  if (value.taskId === null)
+    return;
+  if (value.status !== "completed") {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["taskId"],
+      message: "taskId is only known once the intent has completed"
+    });
+    return;
+  }
+  if (value.operation !== "tasks.create") {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["taskId"],
+      message: "Only a tasks.create intent produces a taskId"
+    });
+  }
+});
+
 // ../../packages/shared/dist/platform.constants.js
 var USDC_DECIMALS = 6;
 
@@ -5508,6 +5847,7 @@ function buildReadAuthMessage(address) {
 var READ_AUTH_ADDRESS_HEADER = "X-Taskmarket-Caller-Address";
 var READ_AUTH_SIGNATURE_HEADER = "X-Taskmarket-Caller-Signature";
 var TASK_ACCESS_GRANT_HEADER = "X-Taskmarket-Task-Access-Grant";
+var IDEMPOTENCY_KEY_HEADER = "X-Taskmarket-Idempotency-Key";
 function buildSubmitMessage(taskId, contentBindings) {
   return contentBindings ? `taskmarket:submit:${taskId}:${contentBindings.join(",")}` : `taskmarket:submit:${taskId}`;
 }
@@ -6035,17 +6375,103 @@ async function keystoreExists(keystorePath) {
   }
 }
 
+// src/lib/idempotency.ts
+import { randomUUID } from "crypto";
+var pendingEnvKey = process.env.TASKMARKET_IDEMPOTENCY_KEY?.trim() || void 0;
+var keyByError = /* @__PURE__ */ new WeakMap();
+function rememberIdempotencyKeyFor(error, key) {
+  if (error === null || typeof error !== "object" && typeof error !== "function") return;
+  if (keyByError.has(error)) return;
+  keyByError.set(error, key);
+}
+function idempotencyKeyForError(error) {
+  if (error === null || typeof error !== "object" && typeof error !== "function")
+    return void 0;
+  return keyByError.get(error);
+}
+function newIdempotencyKey() {
+  return randomUUID();
+}
+function resolveIdempotencyKey(explicit) {
+  if (explicit !== void 0) {
+    return explicit;
+  }
+  if (pendingEnvKey !== void 0) {
+    const fromEnv = pendingEnvKey;
+    pendingEnvKey = void 0;
+    return fromEnv;
+  }
+  return newIdempotencyKey();
+}
+async function withIdempotentWrite(key, fn) {
+  try {
+    return await fn();
+  } catch (error) {
+    rememberIdempotencyKeyFor(error, key);
+    throw error;
+  }
+}
+function idempotencyHeaders(key) {
+  return { [IDEMPOTENCY_KEY_HEADER]: key };
+}
+
 // src/lib/api.ts
 var API_URL = process.env.TASKMARKET_API_URL ?? "https://api.taskmarket.dev";
 var API_ORIGIN = new URL(API_URL).origin;
 var ApiError = class extends Error {
   status;
-  constructor(status, message) {
+  /**
+   * The idempotency key the failed write was sent under, when the request was a write. This is
+   * the only identifier the caller can still hold after a failure -- the intent id is minted by
+   * the backend and reaches the caller only in the response the failure destroyed -- so it
+   * travels on the error rather than being recoverable from the response. See
+   * apps/cli/src/index.ts and lib/output.ts, which surface it on the CLI's JSON envelope.
+   */
+  idempotencyKey;
+  /**
+   * The backend's machine-readable classification of the failure (ADR-0058).
+   *
+   * Before it existed the CLI rendered every failure identically, which is why
+   * `docs/CLI_GUIDE.md` had to tell script authors never to auto-retry a paid command: there was
+   * no way to tell a write that is still landing from one that was definitively rejected, and
+   * retrying the first is a second payment. `reason` is that way.
+   *
+   * Absent when the backend answered with no envelope -- an older deployment, or a failure that
+   * never reached the API at all -- in which case a caller must fall back to the old rule and
+   * treat the outcome as unknown rather than as safe to retry.
+   */
+  envelope;
+  constructor(status, message, idempotencyKey, envelope) {
     super(message);
     this.name = "ApiError";
     this.status = status;
+    this.idempotencyKey = idempotencyKey;
+    this.envelope = envelope;
   }
 };
+async function readFailureBody(res) {
+  const text = await res.text().catch(() => "");
+  try {
+    return { body: JSON.parse(text), text };
+  } catch {
+    return { body: void 0, text };
+  }
+}
+function failureMessage(prefix, status, read) {
+  return `${prefix} (${status}): ${read.body !== void 0 ? JSON.stringify(read.body) : read.text}`;
+}
+function withErrorContext(error, context) {
+  const message = error instanceof Error ? error.message : String(error);
+  const wrapped = error instanceof ApiError ? new ApiError(error.status, `${context}: ${message}`, error.idempotencyKey, error.envelope) : new Error(`${context}: ${message}`);
+  const key = idempotencyKeyForError(error);
+  if (key !== void 0) {
+    rememberIdempotencyKeyFor(wrapped, key);
+  }
+  return wrapped;
+}
+function isPendingApiError(error) {
+  return error instanceof ApiError && isInFlightApiError(error.envelope);
+}
 function legalReceiptHeadersForKeystore(keystore, path4, method) {
   const canSend = keystore.legalAcceptanceApiOrigin === API_ORIGIN && (method === "POST" || path4 === "/api/legal/status");
   return canSend ? buildLegalReceiptHeaders(keystore.legalAcceptanceReceipt) : {};
@@ -6069,61 +6495,100 @@ async function apiGet(path4, options) {
       ...options?.headers ?? {}
     }
   });
-  const body = await res.json();
   if (!res.ok) {
-    throw new ApiError(res.status, `GET ${path4} failed (${res.status}): ${JSON.stringify(body)}`);
+    const read = await readFailureBody(res);
+    throw new ApiError(
+      res.status,
+      failureMessage(`GET ${path4} failed`, res.status, read),
+      void 0,
+      apiErrorEnvelopeOf(read.body) ?? void 0
+    );
   }
-  return body;
+  return res.json();
 }
 async function apiPost(path4, body, options) {
   const legalHeaders = await legalReceiptHeaders(path4, "POST");
-  const res = await fetch(`${API_URL}${path4}`, {
-    method: "POST",
-    redirect: "error",
-    headers: {
-      "Content-Type": "application/json",
-      ...legalHeaders,
-      ...options?.headers ?? {}
-    },
-    body: JSON.stringify(body)
+  const idempotencyKey = resolveIdempotencyKey(options?.idempotencyKey);
+  return withIdempotentWrite(idempotencyKey, async () => {
+    const res = await fetch(`${API_URL}${path4}`, {
+      method: "POST",
+      redirect: "error",
+      headers: {
+        "Content-Type": "application/json",
+        ...legalHeaders,
+        ...idempotencyHeaders(idempotencyKey),
+        ...options?.headers ?? {}
+      },
+      body: JSON.stringify(body)
+    });
+    if (!res.ok) {
+      const read = await readFailureBody(res);
+      throw new ApiError(
+        res.status,
+        failureMessage(`POST ${path4} failed`, res.status, read),
+        idempotencyKey,
+        apiErrorEnvelopeOf(read.body) ?? void 0
+      );
+    }
+    return { data: await res.json(), idempotencyKey };
   });
-  const result = await res.json();
-  if (!res.ok) {
-    throw new ApiError(
-      res.status,
-      `POST ${path4} failed (${res.status}): ${JSON.stringify(result)}`
-    );
-  }
-  return result;
 }
 async function apiDelete(path4, options) {
   const legalHeaders = await legalReceiptHeaders(path4, "POST");
-  const res = await fetch(`${API_URL}${path4}`, {
-    method: "DELETE",
-    redirect: "error",
-    headers: {
-      "Content-Type": "application/json",
-      ...legalHeaders,
-      ...options?.headers ?? {}
+  const idempotencyKey = resolveIdempotencyKey(options?.idempotencyKey);
+  return withIdempotentWrite(idempotencyKey, async () => {
+    const res = await fetch(`${API_URL}${path4}`, {
+      method: "DELETE",
+      redirect: "error",
+      headers: {
+        "Content-Type": "application/json",
+        ...legalHeaders,
+        ...idempotencyHeaders(idempotencyKey),
+        ...options?.headers ?? {}
+      }
+    });
+    if (!res.ok) {
+      const read = await readFailureBody(res);
+      throw new ApiError(
+        res.status,
+        failureMessage(`DELETE ${path4} failed`, res.status, read),
+        idempotencyKey,
+        apiErrorEnvelopeOf(read.body) ?? void 0
+      );
     }
+    return { data: await res.json(), idempotencyKey };
   });
-  const result = await res.json();
-  if (!res.ok) {
-    throw new ApiError(
-      res.status,
-      `DELETE ${path4} failed (${res.status}): ${JSON.stringify(result)}`
-    );
-  }
-  return result;
 }
 
 // src/lib/output.ts
-function printResult(data) {
-  console.log(JSON.stringify({ ok: true, data }));
+function printResult(data, options) {
+  const idempotencyKey = options?.idempotencyKey;
+  console.log(
+    JSON.stringify({ ok: true, data, ...idempotencyKey !== void 0 ? { idempotencyKey } : {} })
+  );
+}
+function renderFailure(error, options) {
+  const message = error instanceof Error ? error.message : options?.fallback ?? String(error);
+  const apiError = error instanceof ApiError ? error : void 0;
+  const idempotencyKey = options?.idempotencyKey ?? apiError?.idempotencyKey ?? idempotencyKeyForError(error);
+  const envelope = apiError?.envelope;
+  process.stderr.write(
+    JSON.stringify({
+      ok: false,
+      error: message,
+      ...apiError !== void 0 ? { status: apiError.status } : {},
+      ...idempotencyKey !== void 0 ? { idempotencyKey } : {},
+      ...envelope !== void 0 ? { ...envelope, pending: isInFlightApiError(envelope) } : {},
+      ...options?.details ?? {}
+    }) + "\n"
+  );
+  process.exitCode = 1;
 }
-function printError(message) {
+function printError(message, options) {
+  return renderFailure(new Error(message), options);
+}
+function printWarning(message) {
   process.stderr.write(JSON.stringify({ ok: false, error: message }) + "\n");
-  process.exit(1);
 }
 
 // src/lib/agent.ts
@@ -6372,21 +6837,21 @@ async function acceptLegalBundle(options) {
   }
   await confirmAcceptance(bundle, options.assumeYes);
   const challenge = LegalChallengeResponseSchema.parse(
-    await apiPost("/api/legal/challenge", {
+    (await apiPost("/api/legal/challenge", {
       walletAddress: options.walletAddress
-    })
+    })).data
   );
   validateLegalChallenge(bundle, challenge, options.walletAddress);
   const signature = await options.signMessage(challenge.message);
   const result = LegalAcceptanceResponseSchema.parse(
-    await apiPost("/api/legal/accept/wallet", {
+    (await apiPost("/api/legal/accept/wallet", {
       ...affirmations,
       bundleDigest: bundle.bundleDigest,
       bundleVersion: bundle.version,
       nonce: challenge.nonce,
       signature,
       walletAddress: options.walletAddress
-    })
+    })).data
   );
   if (result.bundleDigest !== bundle.bundleDigest || result.bundleVersion !== bundle.version) {
     throw new Error("The server returned a receipt for a different legal bundle.");
@@ -6458,7 +6923,7 @@ function sanitizeEmailUsername(agentId, suffix) {
 }
 async function tryRegisterEmail(deviceId, apiToken, username, explicit) {
   try {
-    const reg = await apiPost("/api/emails/register", {
+    const { data: reg } = await apiPost("/api/emails/register", {
       deviceId,
       apiToken,
       username
@@ -6467,11 +6932,8 @@ async function tryRegisterEmail(deviceId, apiToken, username, explicit) {
   } catch (err) {
     if (explicit) {
       const msg = err instanceof Error ? err.message : String(err);
-      process.stderr.write(
-        JSON.stringify({
-          ok: false,
-          error: `Email registration failed: ${msg}. Run: taskmarket email register --username ${username}`
-        }) + "\n"
+      printWarning(
+        `Email registration failed: ${msg}. Run: taskmarket email register --username ${username}`
       );
     }
     return null;
@@ -6490,6 +6952,7 @@ var initCommand = new Command2("init").description("Create and register a new ag
     );
     if (!check.available) {
       printError(`Email username "${opts.email}" is not available.`);
+      return;
     }
   }
   if (await keystoreExists()) {
@@ -6606,68 +7069,80 @@ var addressCommand = new Command3("address").description("Print the wallet addre
 import { Command as Command4 } from "commander";
 
 // src/lib/x402.ts
-async function x402Post(path4, body) {
+async function x402Post(path4, body, options) {
   const url = `${API_URL}${path4}`;
   const keystore = await loadKeystore();
   const legalHeaders = legalReceiptHeadersForKeystore(keystore, path4, "POST");
-  const r1 = await fetch(url, {
-    method: "POST",
-    redirect: "error",
-    headers: { "Content-Type": "application/json", ...legalHeaders },
-    body: JSON.stringify(body)
-  });
-  if (r1.status !== 402) {
-    if (r1.ok) {
-      return r1.json();
-    }
-    const text = await r1.text().catch(() => "");
-    throw new ApiError(r1.status, `POST ${path4} failed (${r1.status}): ${text}`);
-  }
-  const requirements = await r1.json();
-  if (!requirements.accepts || requirements.accepts.length === 0) {
-    throw new Error("No payment methods accepted by server");
-  }
-  const accept = requirements.accepts[0];
-  const { authorization, signature } = await createTransferAuthorization(accept, keystore);
-  const paymentPayload = {
-    x402Version: 2,
-    resource: requirements.resource,
-    accepted: {
-      scheme: accept.scheme,
-      network: accept.network,
-      amount: accept.amount,
-      asset: accept.asset,
-      payTo: accept.payTo,
-      maxTimeoutSeconds: accept.maxTimeoutSeconds,
-      extra: accept.extra
-    },
-    payload: { authorization, signature }
-  };
-  const r2 = await fetch(url, {
-    method: "POST",
-    redirect: "error",
-    headers: {
-      "Content-Type": "application/json",
-      ...legalHeaders,
-      "PAYMENT-SIGNATURE": Buffer.from(JSON.stringify(paymentPayload)).toString("base64")
-    },
-    body: JSON.stringify(body)
+  const idempotencyKey = resolveIdempotencyKey(options?.idempotencyKey);
+  const idempotency = idempotencyHeaders(idempotencyKey);
+  return withIdempotentWrite(idempotencyKey, async () => {
+    const r1 = await fetch(url, {
+      method: "POST",
+      redirect: "error",
+      headers: { "Content-Type": "application/json", ...legalHeaders, ...idempotency },
+      body: JSON.stringify(body)
+    });
+    if (r1.status !== 402) {
+      if (r1.ok) {
+        return { data: await r1.json(), idempotencyKey };
+      }
+      const read = await readFailureBody(r1);
+      throw new ApiError(
+        r1.status,
+        `POST ${path4} failed (${r1.status}): ${read.text}`,
+        idempotencyKey,
+        apiErrorEnvelopeOf(read.body) ?? void 0
+      );
+    }
+    const requirements = await r1.json();
+    if (!requirements.accepts || requirements.accepts.length === 0) {
+      throw new Error("No payment methods accepted by server");
+    }
+    const accept = requirements.accepts[0];
+    const { authorization, signature } = await createTransferAuthorization(accept, keystore);
+    const paymentPayload = {
+      x402Version: 2,
+      resource: requirements.resource,
+      accepted: {
+        scheme: accept.scheme,
+        network: accept.network,
+        amount: accept.amount,
+        asset: accept.asset,
+        payTo: accept.payTo,
+        maxTimeoutSeconds: accept.maxTimeoutSeconds,
+        extra: accept.extra
+      },
+      payload: { authorization, signature }
+    };
+    const r2 = await fetch(url, {
+      method: "POST",
+      redirect: "error",
+      headers: {
+        "Content-Type": "application/json",
+        ...legalHeaders,
+        ...idempotency,
+        "PAYMENT-SIGNATURE": Buffer.from(JSON.stringify(paymentPayload)).toString("base64")
+      },
+      body: JSON.stringify(body)
+    });
+    if (!r2.ok) {
+      const read = await readFailureBody(r2);
+      throw new ApiError(
+        r2.status,
+        failureMessage(`POST ${path4} failed after payment`, r2.status, read),
+        idempotencyKey,
+        apiErrorEnvelopeOf(read.body) ?? void 0
+      );
+    }
+    return { data: await r2.json(), idempotencyKey };
   });
-  const result = await r2.json();
-  if (!r2.ok) {
-    throw new ApiError(
-      r2.status,
-      `POST ${path4} failed after payment (${r2.status}): ${JSON.stringify(result)}`
-    );
-  }
-  return result;
 }
 
 // src/commands/identity.ts
 var identityCommand = new Command4("identity").description("Manage agent identity");
 identityCommand.command("register").description("Register ERC-8004 agent identity (costs 0.001 USDC)").action(async () => {
-  const result = await x402Post("/api/identity/register", {});
-  printResult({ agentId: result.agentId });
+  const { data: result, idempotencyKey } = await x402Post("/api/identity/register", {});
+  printResult({ agentId: result.agentId }, { idempotencyKey });
 });
 identityCommand.command("status").description("Check identity registration status").action(async () => {
   const keystore = await loadKeystore();
@@ -6723,7 +7198,7 @@ var statsCommand = new Command5("stats").description("View agent statistics").op
 });
 
 // src/commands/task/index.ts
-import { Command as Command40 } from "commander";
+import { Command as Command41 } from "commander";
 
 // src/commands/task/create.ts
 import { Command as Command6 } from "commander";
@@ -6759,9 +7234,8 @@ var createCmd = new Command6("create").description("Create a new task (costs rew
     try {
       rewardBaseUnits = usdcToBaseUnits(opts.reward);
     } catch (err) {
-      return void printError(
-        `Invalid --reward: ${err instanceof Error ? err.message : String(err)}`
-      );
+      renderFailure(withErrorContext(err, "Invalid --reward"));
+      return;
     }
     const duration = Number(opts.duration);
     if (!Number.isFinite(duration) || duration <= 0) {
@@ -6821,9 +7295,8 @@ var createCmd = new Command6("create").description("Create a new task (costs rew
       try {
         maxPriceBaseUnits = usdcToBaseUnits(opts.maxPrice);
       } catch (err) {
-        return void printError(
-          `Invalid --max-price: ${err instanceof Error ? err.message : String(err)}`
-        );
+        renderFailure(withErrorContext(err, "Invalid --max-price"));
+        return;
       }
       if (maxPriceBaseUnits !== rewardBaseUnits) {
         return void printError(
@@ -6865,18 +7338,16 @@ var createCmd = new Command6("create").description("Create a new task (costs rew
       try {
         body.auctionStartPrice = usdcToBaseUnits(opts.auctionStartPrice, { allowZero: true });
       } catch (err) {
-        return void printError(
-          `Invalid --auction-start-price: ${err instanceof Error ? err.message : String(err)}`
-        );
+        renderFailure(withErrorContext(err, "Invalid --auction-start-price"));
+        return;
       }
     }
     if (opts.auctionFloorPrice) {
       try {
         body.auctionFloorPrice = usdcToBaseUnits(opts.auctionFloorPrice, { allowZero: true });
       } catch (err) {
-        return void printError(
-          `Invalid --auction-floor-price: ${err instanceof Error ? err.message : String(err)}`
-        );
+        renderFailure(withErrorContext(err, "Invalid --auction-floor-price"));
+        return;
       }
     }
     for (const [flag, value] of [
@@ -6924,8 +7395,11 @@ var createCmd = new Command6("create").description("Create a new task (costs rew
       if (opts.appealWindow) body.appealWindowHours = parseFloat(opts.appealWindow);
       if (opts.disputeResolver) body.disputeResolver = opts.disputeResolver;
     }
-    const result = await x402Post("/api/tasks", body);
-    printResult({ taskId: result.taskId });
+    const { data: result, idempotencyKey } = await x402Post(
+      "/api/tasks",
+      body
+    );
+    printResult({ taskId: result.taskId }, { idempotencyKey });
   }
 );
 
@@ -7036,6 +7510,7 @@ var getCmd = new Command8("get").description("Get task details").argument("<task
     printError(
       `Task not found: ${taskId} (or this is a private task you don't have access to -- if you have a password for it, run: taskmarket task unlock ${taskId} --password <password>)`
     );
+    return;
   }
   printResult(task);
 });
@@ -7136,6 +7611,7 @@ var submitCmd = new Command9("submit").description("Submit work for a task").arg
   try {
     if (!opts.file || opts.file.length === 0) {
       printError("--file is required");
+      return;
     }
     const keystore = await loadKeystore();
     const signature = await signMessage(buildSubmitMessage(taskId), keystore);
@@ -7144,9 +7620,11 @@ var submitCmd = new Command9("submit").description("Submit work for a task").arg
         const mimeType = mimeTypeForPath(filePath);
         const data = await fsPromises.readFile(filePath);
         if (data.length === 0) {
-          printError(`File is empty: ${basename(filePath)}`);
+          throw new Error(`File is empty: ${basename(filePath)}`);
         }
-        const { uploadUrl, artifactKey } = await apiPost(
+        const {
+          data: { uploadUrl, artifactKey }
+        } = await apiPost(
           `/api/tasks/${taskId}/submissions/request-upload-url`,
           {
             taskId,
@@ -7181,13 +7659,16 @@ var submitCmd = new Command9("submit").description("Submit work for a task").arg
       ),
       keystore
     );
-    const result = await x402Post(`/api/tasks/${taskId}/submissions/from-keys`, {
-      taskId,
-      workerAddress: keystore.walletAddress,
-      artifacts: artifactInputs,
-      signature: submitSignature
-    });
-    printResult({ submissionId: result.submissionId });
+    const { data: result, idempotencyKey } = await x402Post(
+      `/api/tasks/${taskId}/submissions/from-keys`,
+      {
+        taskId,
+        workerAddress: keystore.walletAddress,
+        artifacts: artifactInputs,
+        signature: submitSignature
+      }
+    );
+    printResult({ submissionId: result.submissionId }, { idempotencyKey });
   } finally {
     submitCmd.setOptionValue("file", []);
   }
@@ -7199,7 +7680,6 @@ var acceptCmd = new Command10("accept").description("Accept a submission (costs
   const task = await apiGet(`/api/tasks/${taskId}`);
   if (!task) {
     printError("Task not found");
-    process.exit(1);
     return;
   }
   const canAccept = task.pendingActions?.some(
@@ -7215,14 +7695,13 @@ var acceptCmd = new Command10("accept").description("Accept a submission (costs
     printError(
       hasRefund ? "Task has expired with no submissions. Use taskmarket task refund-expired to recover escrow." : hasSelectWorker ? "Pitch window has closed. Use taskmarket task select-worker to pick from received pitches, or cancel the task." : "Accept is not available for this task in its current state."
     );
-    process.exit(1);
     return;
   }
-  await x402Post(`/api/tasks/${taskId}/accept`, {
+  const { idempotencyKey } = await x402Post(`/api/tasks/${taskId}/accept`, {
     taskId,
     worker: opts.worker
   });
-  printResult({ accepted: true });
+  printResult({ accepted: true }, { idempotencyKey });
 });
 
 // src/commands/task/accept-submissions.ts
@@ -7257,13 +7736,16 @@ var acceptSubmissionsCmd = new Command11("accept-submissions").description(
     if (sum !== 1e4) {
       throw new Error(`Winner shares must sum to 10000 basis points (got ${sum})`);
     }
-    const result = await x402Post(`/api/tasks/${taskId}/accept-submissions`, {
-      taskId,
-      winners
-    });
-    printResult({ accepted: result.success, winners: winners.length });
+    const { data: result, idempotencyKey } = await x402Post(
+      `/api/tasks/${taskId}/accept-submissions`,
+      {
+        taskId,
+        winners
+      }
+    );
+    printResult({ accepted: result.success, winners: winners.length }, { idempotencyKey });
   } catch (err) {
-    printError(err instanceof Error ? err.message : String(err));
+    renderFailure(err);
   }
 });
 
@@ -7273,14 +7755,15 @@ var rateCmd = new Command12("rate").description("Rate a worker (costs 0.001 USDC
   const rating = parseInt(opts.rating, 10);
   if (rating < 0 || rating > 100) {
     printError("Rating must be between 0 and 100");
+    return;
   }
-  const result = await x402Post(`/api/tasks/${taskId}/rate`, {
+  const { data: result, idempotencyKey } = await x402Post(`/api/tasks/${taskId}/rate`, {
     taskId,
     worker: opts.worker,
     rating,
     ...opts.feedback ? { feedbackText: opts.feedback } : {}
   });
-  printResult({ feedbackId: result.feedbackId });
+  printResult({ feedbackId: result.feedbackId }, { idempotencyKey });
 });
 
 // src/commands/task/claim.ts
@@ -7289,11 +7772,14 @@ var claimCmd = new Command13("claim").description("Claim a task as a worker").ar
   const keystore = await loadKeystore();
   const message = buildClaimMessage(taskId);
   const signature = await signMessage(message, keystore);
-  const result = await apiPost(`/api/tasks/${taskId}/claim`, {
-    workerAddress: keystore.walletAddress,
-    signature
-  });
-  printResult({ claimId: result.claimId });
+  const { data: result, idempotencyKey } = await apiPost(
+    `/api/tasks/${taskId}/claim`,
+    {
+      workerAddress: keystore.walletAddress,
+      signature
+    }
+  );
+  printResult({ claimId: result.claimId }, { idempotencyKey });
 });
 
 // src/commands/task/pitch.ts
@@ -7301,14 +7787,17 @@ import { Command as Command14 } from "commander";
 var pitchCmd = new Command14("pitch").description("Submit a pitch for a task (costs 0.001 USDC, anchors hash on-chain)").argument("<taskId>", "Task ID (0x-prefixed hex)").requiredOption("--text <text>", "Pitch text").option("--duration <hours>", "Estimated duration in hours").action(async (taskId, opts) => {
   const keystore = await loadKeystore();
   const signature = await signMessage(`taskmarket:pitch:${taskId}`, keystore);
-  const result = await x402Post(`/api/tasks/${taskId}/pitches`, {
-    taskId,
-    workerAddress: keystore.walletAddress,
-    pitchText: opts.text,
-    ...opts.duration ? { estimatedDuration: parseInt(opts.duration, 10) } : {},
-    signature
-  });
-  printResult({ pitchId: result.pitchId });
+  const { data: result, idempotencyKey } = await x402Post(
+    `/api/tasks/${taskId}/pitches`,
+    {
+      taskId,
+      workerAddress: keystore.walletAddress,
+      pitchText: opts.text,
+      ...opts.duration ? { estimatedDuration: parseInt(opts.duration, 10) } : {},
+      signature
+    }
+  );
+  printResult({ pitchId: result.pitchId }, { idempotencyKey });
 });
 
 // src/commands/task/pitches.ts
@@ -7319,7 +7808,7 @@ var pitchesCmd = new Command15("pitches").description("List pitches for a task")
     const headers = { ...auth?.headers ?? {}, ...await taskAccessGrantHeaders(taskId) };
     printResult(await apiGet(`/api/tasks/${taskId}/pitches`, { headers }));
   } catch (err) {
-    printError(err instanceof Error ? err.message : String(err));
+    renderFailure(err);
   }
 });
 
@@ -7329,13 +7818,13 @@ var selectWorkerCmd = new Command16("select-worker").description("Select a worke
   const keystore = await loadKeystore();
   const message = buildSelectWorkerMessage(taskId, opts.pitch, opts.worker);
   const signature = await signMessage(message, keystore);
-  await apiPost(`/api/tasks/${taskId}/pitches/select`, {
+  const { idempotencyKey } = await apiPost(`/api/tasks/${taskId}/pitches/select`, {
     taskId,
     pitchId: opts.pitch,
     workerAddress: opts.worker,
     signature
   });
-  printResult({ selected: true });
+  printResult({ selected: true }, { idempotencyKey });
 });
 
 // src/commands/task/proof.ts
@@ -7343,7 +7832,7 @@ import { Command as Command17 } from "commander";
 var proofCmd = new Command17("proof").description("Submit a benchmark proof (costs 0.001 USDC, anchors hash on-chain)").argument("<taskId>", "Task ID (0x-prefixed hex)").requiredOption("--data <data>", "Proof data").requiredOption("--type <type>", "Proof type").option("--metric <val>", "Metric value").action(async (taskId, opts) => {
   const keystore = await loadKeystore();
   const signature = await signMessage(`taskmarket:proof:${taskId}`, keystore);
-  const result = await x402Post(`/api/tasks/${taskId}/proofs`, {
+  const { data: result, idempotencyKey } = await x402Post(`/api/tasks/${taskId}/proofs`, {
     taskId,
     workerAddress: keystore.walletAddress,
     proofData: opts.data,
@@ -7351,7 +7840,7 @@ var proofCmd = new Command17("proof").description("Submit a benchmark proof (cos
     ...opts.metric ? { metricValue: opts.metric } : {},
     signature
   });
-  printResult({ proofId: result.proofId, submissionId: result.submissionId });
+  printResult({ proofId: result.proofId, submissionId: result.submissionId }, { idempotencyKey });
 });
 
 // src/commands/task/proofs.ts
@@ -7362,7 +7851,7 @@ var proofsCmd = new Command18("proofs").description("List proofs for a benchmark
     const headers = { ...auth?.headers ?? {}, ...await taskAccessGrantHeaders(taskId) };
     printResult(await apiGet(`/api/tasks/${taskId}/proofs`, { headers }));
   } catch (err) {
-    printError(err instanceof Error ? err.message : String(err));
+    renderFailure(err);
   }
 });
 
@@ -7373,15 +7862,17 @@ var bidCmd = new Command19("bid").description("Submit a bid on an auction task")
   try {
     priceBaseUnits = usdcToBaseUnits(opts.price);
   } catch (err) {
-    return void printError(
-      `Invalid --price: ${err instanceof Error ? err.message : String(err)}`
-    );
+    renderFailure(withErrorContext(err, "Invalid --price"));
+    return;
   }
-  const result = await x402Post(`/api/tasks/${taskId}/bids`, {
-    taskId,
-    price: priceBaseUnits
-  });
-  printResult({ bidId: result.bidId });
+  const { data: result, idempotencyKey } = await x402Post(
+    `/api/tasks/${taskId}/bids`,
+    {
+      taskId,
+      price: priceBaseUnits
+    }
+  );
+  printResult({ bidId: result.bidId }, { idempotencyKey });
 });
 
 // src/commands/task/auction-accept.ts
@@ -7395,17 +7886,19 @@ var auctionAcceptCmd = new Command20("auction-accept").description("Accept curre
     try {
       body.minPrice = usdcToBaseUnits(opts.minPrice, { allowZero: true });
     } catch (error) {
-      return void printError(
-        `Invalid --min-price: ${error instanceof Error ? error.message : String(error)}`
-      );
+      renderFailure(withErrorContext(error, "Invalid --min-price"));
+      return;
     }
   }
-  const result = await x402Post(`/api/tasks/${taskId}/bids/accept`, body);
-  printResult({
-    acceptedPrice: result.acceptedPrice,
-    acceptedPriceUsdc: formatUsdcBaseUnits(result.acceptedPrice),
-    workerAddress: result.workerAddress
-  });
+  const { data: result, idempotencyKey } = await x402Post(`/api/tasks/${taskId}/bids/accept`, body);
+  printResult(
+    {
+      acceptedPrice: result.acceptedPrice,
+      acceptedPriceUsdc: formatUsdcBaseUnits(result.acceptedPrice),
+      workerAddress: result.workerAddress
+    },
+    { idempotencyKey }
+  );
 });
 
 // src/commands/task/submissions.ts
@@ -7416,8 +7909,8 @@ var submissionsCmd = new Command21("submissions").description("List submissions
   try {
     subs = await apiGet(`/api/tasks/${taskId}/submissions`, { headers: auth?.headers ?? {} });
   } catch (err) {
-    const msg = err instanceof Error ? err.message : "Failed to fetch submissions.";
-    printError(msg);
+    renderFailure(err, { fallback: "Failed to fetch submissions." });
+    return;
   }
   printResult(subs);
 });
@@ -7426,15 +7919,17 @@ var submissionsCmd = new Command21("submissions").description("List submissions
 import { Command as Command22 } from "commander";
 var selectWinnerCmd = new Command22("select-winner").description("Permissionlessly finalize the lowest bidder after the auction deadline").argument("<taskId>", "Task ID (0x-prefixed hex)").action(async (taskId) => {
   let result;
+  let idempotencyKey;
   try {
-    result = await apiPost(`/api/tasks/${taskId}/bids/select-winner`, {
-      taskId
-    });
+    ({ data: result, idempotencyKey } = await apiPost(
+      `/api/tasks/${taskId}/bids/select-winner`,
+      { taskId }
+    ));
   } catch (err) {
-    const msg = err instanceof Error ? err.message : "Failed to select winner.";
-    printError(msg);
+    renderFailure(err, { fallback: "Failed to select winner." });
+    return;
   }
-  printResult(result);
+  printResult(result, { idempotencyKey });
 });
 
 // src/commands/task/download.ts
@@ -7457,18 +7952,19 @@ var downloadCmd = new Command23("download").description("Download a submission f
       if (opts.artifact) {
         body.artifactId = opts.artifact;
       }
-      const result = await apiPost(
+      const { data: result } = await apiPost(
         `/api/tasks/${taskId}/submissions/${opts.submission}/preview`,
         body
       );
       presignedUrl = result.presignedUrl;
     } catch (err) {
-      const msg = err instanceof Error ? err.message : "Failed to get download URL.";
-      printError(msg);
+      renderFailure(err, { fallback: "Failed to get download URL." });
+      return;
     }
     const res = await fetch(presignedUrl);
     if (!res.ok) {
       printError(`Failed to download file: ${res.status}`);
+      return;
     }
     const content = Buffer.from(await res.arrayBuffer());
     if (opts.output) {
@@ -7482,6 +7978,7 @@ var downloadCmd = new Command23("download").description("Download a submission f
         printError(
           "Downloaded content is not valid UTF-8 text and cannot be safely printed to the terminal. Use --output <path> to save it to a file instead."
         );
+        return;
       }
       process.stdout.write(sanitizeForTerminal(decoded));
     }
@@ -7491,8 +7988,11 @@ var downloadCmd = new Command23("download").description("Download a submission f
 // src/commands/task/cancel.ts
 import { Command as Command24 } from "commander";
 var cancelCmd = new Command24("cancel").description("Cancel an open task and refund the escrowed reward (costs 0.001 USDC)").argument("<taskId>", "Task ID (0x-prefixed hex)").action(async (taskId) => {
-  const result = await x402Post(`/api/tasks/${taskId}/cancel`, { taskId });
-  printResult(result);
+  const { data: result, idempotencyKey } = await x402Post(
+    `/api/tasks/${taskId}/cancel`,
+    { taskId }
+  );
+  printResult(result, { idempotencyKey });
 });
 
 // src/commands/task/refund-expired.ts
@@ -7501,11 +8001,13 @@ var refundExpiredCmd = new Command25("refund-expired").description(
   "Refund an expired task with no submissions back to the requester (costs 0.001 USDC)"
 ).argument("<taskId>", "Task ID (0x-prefixed hex)").action(async (taskId) => {
   try {
-    const result = await x402Post(`/api/tasks/${taskId}/refund-expired`, { taskId });
-    printResult(result);
+    const { data: result, idempotencyKey } = await x402Post(
+      `/api/tasks/${taskId}/refund-expired`,
+      { taskId }
+    );
+    printResult(result, { idempotencyKey });
   } catch (err) {
-    printError(err instanceof Error ? err.message : String(err));
-    process.exit(1);
+    renderFailure(err);
   }
 });
 
@@ -7515,14 +8017,16 @@ var rejectSubmissionCmd = new Command26("reject-submission").description(
   "Reject a spam or low-quality submission (costs 0.001 USDC relay fee). Once all submissions are rejected, the task can be cancelled to recover escrow."
 ).argument("<taskId>", "Task ID (0x-prefixed hex)").requiredOption("--worker <address>", "Worker address whose submission to reject").action(async (taskId, opts) => {
   try {
-    const result = await x402Post(`/api/tasks/${taskId}/reject-submission`, {
-      taskId,
-      worker: opts.worker
-    });
-    printResult(result);
+    const { data: result, idempotencyKey } = await x402Post(
+      `/api/tasks/${taskId}/reject-submission`,
+      {
+        taskId,
+        worker: opts.worker
+      }
+    );
+    printResult(result, { idempotencyKey });
   } catch (err) {
-    printError(err instanceof Error ? err.message : String(err));
-    process.exit(1);
+    renderFailure(err);
   }
 });
 
@@ -7544,7 +8048,8 @@ var rejectAllSubmissionsCmd = new Command27("reject-all-submissions").descriptio
   try {
     submissions = await apiGet(`/api/tasks/${taskId}/submissions`);
   } catch (err) {
-    return printError(err instanceof Error ? err.message : String(err));
+    renderFailure(err);
+    return;
   }
   const workers = activeSubmissionWorkers(submissions);
   if (workers.length === 0) {
@@ -7554,20 +8059,40 @@ var rejectAllSubmissionsCmd = new Command27("reject-all-submissions").descriptio
   const results = [];
   for (const worker of workers) {
     try {
-      const res = await x402Post(`/api/tasks/${taskId}/reject-submission`, {
-        taskId,
-        worker
-      });
-      results.push({ worker, txHash: res.txHash });
+      const { data: res, idempotencyKey } = await x402Post(
+        `/api/tasks/${taskId}/reject-submission`,
+        { taskId, worker }
+      );
+      results.push({ worker, txHash: res.txHash, idempotencyKey });
     } catch (err) {
-      results.push({ worker, error: err instanceof Error ? err.message : String(err) });
+      results.push({
+        worker,
+        error: err instanceof Error ? err.message : String(err),
+        idempotencyKey: idempotencyKeyForError(err),
+        cause: err
+      });
     }
   }
-  const failed = results.filter((r) => r.error);
+  const failed = results.filter((r) => r.error !== void 0);
   if (failed.length > 0) {
-    return printError(
-      `${failed.length} of ${results.length} rejection(s) failed: ` + failed.map((r) => `${r.worker}: ${r.error}`).join("; ")
+    const representative = failed.find((r) => isPendingApiError(r.cause)) ?? failed[0];
+    renderFailure(
+      withErrorContext(
+        representative.cause,
+        `${failed.length} of ${results.length} rejection(s) failed`
+      ),
+      {
+        details: {
+          results: results.map(({ worker, txHash, idempotencyKey, error }) => ({
+            worker,
+            txHash,
+            idempotencyKey,
+            error
+          }))
+        }
+      }
     );
+    return;
   }
   if (!opts.cancel) {
     printResult({ rejected: results.length, results });
@@ -7575,11 +8100,15 @@ var rejectAllSubmissionsCmd = new Command27("reject-all-submissions").descriptio
   }
   let cancelRes;
   try {
-    cancelRes = await x402Post(`/api/tasks/${taskId}/cancel`, { taskId });
+    ({ data: cancelRes } = await x402Post(
+      `/api/tasks/${taskId}/cancel`,
+      { taskId }
+    ));
   } catch (err) {
-    return printError(
-      `All ${results.length} submission(s) rejected but cancel failed: ${err instanceof Error ? err.message : String(err)}`
+    renderFailure(
+      withErrorContext(err, `All ${results.length} submission(s) rejected but cancel failed`)
     );
+    return;
   }
   printResult({ rejected: results.length, results, cancelTxHash: cancelRes.txHash });
 });
@@ -7599,8 +8128,7 @@ var mySubmissionsCmd = new Command28("my-submissions").description("List all sub
     );
     printResult(result);
   } catch (err) {
-    printError(err instanceof Error ? err.message : String(err));
-    process.exit(1);
+    renderFailure(err);
   }
 });
 
@@ -7613,9 +8141,8 @@ var updateCmd = new Command29("update").description("Update an open task (costs
       try {
         body.reward = usdcToBaseUnits(opts.reward);
       } catch (err) {
-        return void printError(
-          `Invalid --reward: ${err instanceof Error ? err.message : String(err)}`
-        );
+        renderFailure(withErrorContext(err, "Invalid --reward"));
+        return;
       }
     }
     if (opts.extendExpiry !== void 0) {
@@ -7624,10 +8151,12 @@ var updateCmd = new Command29("update").description("Update an open task (costs
         printError(
           `--extend-expiry must be a positive integer (seconds), got: ${opts.extendExpiry}`
         );
+        return;
       }
       const task = await apiGet(`/api/tasks/${taskId}`);
       if (!task) {
         printError(`Task not found: ${taskId}`);
+        return;
       }
       const currentExpiry = Math.floor(new Date(task.expiryTime).getTime() / 1e3);
       const newExpiry = currentExpiry + delta;
@@ -7637,6 +8166,7 @@ var updateCmd = new Command29("update").description("Update an open task (costs
         printError(
           `--extend-expiry would set expiry in the past. Task expired ${expiredAgo}s ago; pass at least ${expiredAgo + 1} seconds to extend beyond now.`
         );
+        return;
       }
       body.expiryTime = newExpiry;
     }
@@ -7644,6 +8174,7 @@ var updateCmd = new Command29("update").description("Update an open task (costs
       const ts = Math.floor(new Date(opts.bidDeadline).getTime() / 1e3);
       if (ts <= Math.floor(Date.now() / 1e3)) {
         printError("--bid-deadline must be in the future");
+        return;
       } else {
         body.bidDeadline = ts;
       }
@@ -7652,6 +8183,7 @@ var updateCmd = new Command29("update").description("Update an open task (costs
       const ts = Math.floor(new Date(opts.pitchDeadline).getTime() / 1e3);
       if (ts <= Math.floor(Date.now() / 1e3)) {
         printError("--pitch-deadline must be in the future");
+        return;
       } else {
         body.pitchDeadline = ts;
       }
@@ -7660,18 +8192,16 @@ var updateCmd = new Command29("update").description("Update an open task (costs
       try {
         body.auctionFloorPrice = usdcToBaseUnits(opts.auctionFloorPrice, { allowZero: true });
       } catch (err) {
-        return void printError(
-          `Invalid --auction-floor-price: ${err instanceof Error ? err.message : String(err)}`
-        );
+        renderFailure(withErrorContext(err, "Invalid --auction-floor-price"));
+        return;
       }
     }
     if (opts.auctionStartPrice !== void 0) {
       try {
         body.auctionStartPrice = usdcToBaseUnits(opts.auctionStartPrice, { allowZero: true });
       } catch (err) {
-        return void printError(
-          `Invalid --auction-start-price: ${err instanceof Error ? err.message : String(err)}`
-        );
+        renderFailure(withErrorContext(err, "Invalid --auction-start-price"));
+        return;
       }
     }
     if (opts.description !== void 0) {
@@ -7683,8 +8213,11 @@ var updateCmd = new Command29("update").description("Update an open task (costs
     if (opts.metricDescription !== void 0) {
       body.metricDescription = opts.metricDescription;
     }
-    const result = await x402Post(`/api/tasks/${taskId}/update`, body);
-    printResult(result);
+    const { data: result, idempotencyKey } = await x402Post(
+      `/api/tasks/${taskId}/update`,
+      body
+    );
+    printResult(result, { idempotencyKey });
   }
 );
 
@@ -7695,20 +8228,77 @@ var forfeitCmd = new Command30("forfeit").description("Reclaim a claim-mode task
     const keystore = await loadKeystore();
     const message = buildForfeitMessage(taskId);
     const signature = await signMessage(message, keystore);
-    const result = await apiPost(`/api/tasks/${taskId}/forfeit`, {
-      taskId,
-      requesterAddress: keystore.walletAddress,
-      signature
-    });
-    printResult(result);
+    const { data: result, idempotencyKey } = await apiPost(
+      `/api/tasks/${taskId}/forfeit`,
+      {
+        taskId,
+        requesterAddress: keystore.walletAddress,
+        signature
+      }
+    );
+    printResult(result, { idempotencyKey });
   } catch (err) {
-    printError(err instanceof Error ? err.message : String(err));
+    renderFailure(err);
   }
 });
 
-// src/commands/task/evaluate.ts
+// src/commands/task/assign-evaluator.ts
 import { Command as Command31 } from "commander";
-var evaluateCmd = new Command31("evaluate").description("Submit an evaluation verdict for a task in Review state").argument("<taskId>", "Task ID (0x-prefixed hex)").requiredOption("--verdict <type>", "Verdict: approve, reject, or partial").option("--score <n>", "Score 0-1000 (default: 1000)", "1000").option("--confidence <n>", "Confidence 0-1000 (default: 1000)", "1000").option("--evidence-hash <hash>", "Evidence hash (32-byte hex)").option(
+var ADDRESS_PATTERN = /^0x[0-9a-fA-F]{40}$/;
+var assignEvaluatorCmd = new Command31("assign-evaluator").description(
+  "Assign an evaluator to an open, unclaimed task you requested (costs 0.001 USDC). Only possible before a worker claims the task."
+).argument("<taskId>", "Task ID (0x-prefixed hex)").requiredOption("--evaluator <address>", "Evaluator wallet address").option("--evaluator-fee-bps <bps>", "Evaluator fee in basis points, 0-10000 (default: 0)").option("--evaluation-window <hours>", "Hours the evaluator has to issue a verdict (default: 24)").option("--appeal-window <hours>", "Hours the worker has to appeal a verdict (default: 24)").option("--dispute-resolver <address>", "Address allowed to resolve an appealed verdict").action(
+  async (taskId, opts) => {
+    if (!ADDRESS_PATTERN.test(opts.evaluator)) {
+      return void printError(`--evaluator must be a wallet address, got: ${opts.evaluator}`);
+    }
+    if (opts.disputeResolver !== void 0 && !ADDRESS_PATTERN.test(opts.disputeResolver)) {
+      return void printError(
+        `--dispute-resolver must be a wallet address, got: ${opts.disputeResolver}`
+      );
+    }
+    const body = { taskId, evaluator: opts.evaluator };
+    if (opts.evaluatorFeeBps !== void 0) {
+      const bps = Number(opts.evaluatorFeeBps);
+      if (!Number.isInteger(bps) || bps < 0 || bps > 1e4) {
+        return void printError(
+          `--evaluator-fee-bps must be an integer between 0 and 10000, got: ${opts.evaluatorFeeBps}`
+        );
+      }
+      body.evaluatorFeeBps = bps;
+    }
+    if (opts.evaluationWindow !== void 0) {
+      const hours = Number(opts.evaluationWindow);
+      if (!Number.isFinite(hours) || hours <= 0) {
+        return void printError(
+          `--evaluation-window must be a positive number of hours, got: ${opts.evaluationWindow}`
+        );
+      }
+      body.evaluationWindowHours = hours;
+    }
+    if (opts.appealWindow !== void 0) {
+      const hours = Number(opts.appealWindow);
+      if (!Number.isFinite(hours) || hours <= 0) {
+        return void printError(
+          `--appeal-window must be a positive number of hours, got: ${opts.appealWindow}`
+        );
+      }
+      body.appealWindowHours = hours;
+    }
+    if (opts.disputeResolver !== void 0) {
+      body.disputeResolver = opts.disputeResolver;
+    }
+    const { data: result, idempotencyKey } = await x402Post(
+      `/api/tasks/${taskId}/evaluator`,
+      body
+    );
+    printResult(result, { idempotencyKey });
+  }
+);
+
+// src/commands/task/evaluate.ts
+import { Command as Command32 } from "commander";
+var evaluateCmd = new Command32("evaluate").description("Submit an evaluation verdict for a task in Review state").argument("<taskId>", "Task ID (0x-prefixed hex)").requiredOption("--verdict <type>", "Verdict: approve, reject, or partial").option("--score <n>", "Score 0-1000 (default: 1000)", "1000").option("--confidence <n>", "Confidence 0-1000 (default: 1000)", "1000").option("--evidence-hash <hash>", "Evidence hash (32-byte hex)").option(
   "--award <worker:amount:rank>",
   "Award entry (repeatable): worker:amountUSDC:rank",
   collect,
@@ -7737,9 +8327,8 @@ var evaluateCmd = new Command31("evaluate").description("Submit an evaluation ve
       try {
         microUnits = usdcToBaseUnits(amountUSDC);
       } catch (err) {
-        return void printError(
-          `Invalid amount in '${entry}': ${err instanceof Error ? err.message : String(err)}`
-        );
+        renderFailure(withErrorContext(err, `Invalid amount in '${entry}'`));
+        return;
       }
       const parsedRank = Number(rankStr);
       if (!Number.isInteger(parsedRank) || parsedRank < 1) {
@@ -7762,8 +8351,11 @@ var evaluateCmd = new Command31("evaluate").description("Submit an evaluation ve
       }
       body.evidenceHash = opts.evidenceHash;
     }
-    const result = await x402Post(`/api/tasks/${taskId}/evaluate`, body);
-    printResult({ txHash: result.txHash });
+    const { data: result, idempotencyKey } = await x402Post(
+      `/api/tasks/${taskId}/evaluate`,
+      body
+    );
+    printResult({ txHash: result.txHash }, { idempotencyKey });
   }
 );
 function collect(val, prev) {
@@ -7771,28 +8363,28 @@ function collect(val, prev) {
 }
 
 // src/commands/task/appeal.ts
-import { Command as Command32 } from "commander";
-var appealCmd = new Command32("appeal").description("Appeal an evaluator verdict while in Appealing state").argument("<taskId>", "Task ID (0x-prefixed hex)").action(async (taskId) => {
-  const result = await x402Post(`/api/tasks/${taskId}/appeal`, { taskId });
-  printResult({ txHash: result.txHash });
+import { Command as Command33 } from "commander";
+var appealCmd = new Command33("appeal").description("Appeal an evaluator verdict while in Appealing state").argument("<taskId>", "Task ID (0x-prefixed hex)").action(async (taskId) => {
+  const { data: result, idempotencyKey } = await x402Post(`/api/tasks/${taskId}/appeal`, { taskId });
+  printResult({ txHash: result.txHash }, { idempotencyKey });
 });
 
 // src/commands/task/evaluator-timeout.ts
-import { Command as Command33 } from "commander";
-var evaluatorTimeoutCmd = new Command33("evaluator-timeout").description("Trigger evaluator timeout after the evaluation window expires (requester only)").argument("<taskId>", "Task ID (0x-prefixed hex)").action(async (taskId) => {
-  const result = await x402Post(`/api/tasks/${taskId}/evaluator-timeout`, { taskId });
-  printResult({ txHash: result.txHash });
+import { Command as Command34 } from "commander";
+var evaluatorTimeoutCmd = new Command34("evaluator-timeout").description("Trigger evaluator timeout after the evaluation window expires (requester only)").argument("<taskId>", "Task ID (0x-prefixed hex)").action(async (taskId) => {
+  const { data: result, idempotencyKey } = await x402Post(`/api/tasks/${taskId}/evaluator-timeout`, { taskId });
+  printResult({ txHash: result.txHash }, { idempotencyKey });
 });
 
 // src/commands/task/finalize-verdict.ts
-import { Command as Command34 } from "commander";
-var finalizeVerdictCmd = new Command34("finalize-verdict").description("Finalize an evaluator verdict after the appeal window expires (permissionless)").argument("<taskId>", "Task ID (0x-prefixed hex)").action(async (taskId) => {
-  const result = await apiPost(`/api/tasks/${taskId}/finalize-verdict`, { taskId });
-  printResult({ txHash: result.txHash });
+import { Command as Command35 } from "commander";
+var finalizeVerdictCmd = new Command35("finalize-verdict").description("Finalize an evaluator verdict after the appeal window expires (permissionless)").argument("<taskId>", "Task ID (0x-prefixed hex)").action(async (taskId) => {
+  const { data: result, idempotencyKey } = await apiPost(`/api/tasks/${taskId}/finalize-verdict`, { taskId });
+  printResult({ txHash: result.txHash }, { idempotencyKey });
 });
 
 // src/commands/task/resolve-dispute.ts
-import { Command as Command35 } from "commander";
+import { Command as Command36 } from "commander";
 function parseAward(spec) {
   const parts = spec.split(":");
   if (parts.length !== 3) {
@@ -7813,7 +8405,7 @@ function parseAward(spec) {
     rank
   };
 }
-var resolveDisputeCmd = new Command35("resolve-dispute").description(
+var resolveDisputeCmd = new Command36("resolve-dispute").description(
   "Resolve a disputed task as the designated dispute resolver (X402 required).\n\nExamples:\n  task resolve-dispute 0x\u2026 --verdict approve --award 0xAlice:5:1\n  task resolve-dispute 0x\u2026 --verdict partial --award 0xAlice:3:1 --award 0xBob:2:2"
 ).argument("<taskId>", "Task ID (0x-prefixed hex)").requiredOption("--verdict <type>", "Verdict type: approve or partial").requiredOption(
   "--award <spec...>",
@@ -7827,76 +8419,80 @@ var resolveDisputeCmd = new Command35("resolve-dispute").description(
   try {
     awards = opts.award.map(parseAward);
   } catch (err) {
-    printError(err instanceof Error ? err.message : String(err));
+    renderFailure(err);
     return;
   }
-  const result = await x402Post(`/api/tasks/${taskId}/resolve-dispute`, {
-    taskId,
-    verdict: opts.verdict,
-    awards
-  });
-  printResult({ txHash: result.txHash });
+  const { data: result, idempotencyKey } = await x402Post(
+    `/api/tasks/${taskId}/resolve-dispute`,
+    {
+      taskId,
+      verdict: opts.verdict,
+      awards
+    }
+  );
+  printResult({ txHash: result.txHash }, { idempotencyKey });
 });
 
 // src/commands/task/unlock.ts
-import { Command as Command36 } from "commander";
-var unlockCmd = new Command36("unlock").description("Unlock a private task with its password, caching a task-scoped access grant").argument("<taskId>", "Task ID (0x-prefixed hex)").requiredOption("--password <password>", "The private task's password").action(async (taskId, opts) => {
+import { Command as Command37 } from "commander";
+var unlockCmd = new Command37("unlock").description("Unlock a private task with its password, caching a task-scoped access grant").argument("<taskId>", "Task ID (0x-prefixed hex)").requiredOption("--password <password>", "The private task's password").action(async (taskId, opts) => {
   let result;
+  let idempotencyKey;
   try {
-    result = await apiPost(`/api/tasks/${taskId}/private-access/verify`, {
-      taskId,
-      password: opts.password
-    });
+    ({ data: result, idempotencyKey } = await apiPost(
+      `/api/tasks/${taskId}/private-access/verify`,
+      { taskId, password: opts.password }
+    ));
   } catch (err) {
-    printError(err instanceof Error ? err.message : "Failed to unlock task.");
+    renderFailure(err, { fallback: "Failed to unlock task." });
     return;
   }
   await saveTaskAccessGrant(taskId, result.grant, result.expiresAt);
-  printResult({ taskId, expiresAt: result.expiresAt });
+  printResult({ taskId, expiresAt: result.expiresAt }, { idempotencyKey });
 });
 
 // src/commands/task/invite.ts
-import { Command as Command37 } from "commander";
-var inviteCmd = new Command37("invite").description("Invite a wallet to view a private task (requester only)").argument("<taskId>", "Task ID (0x-prefixed hex)").argument("<address>", "Wallet address to invite").action(async (taskId, address) => {
+import { Command as Command38 } from "commander";
+var inviteCmd = new Command38("invite").description("Invite a wallet to view a private task (requester only)").argument("<taskId>", "Task ID (0x-prefixed hex)").argument("<address>", "Wallet address to invite").action(async (taskId, address) => {
   const auth = await signReadAuth();
   if (!auth || Object.keys(auth.headers).length === 0) {
     printError("No keystore found. Run `taskmarket init` first.");
     return;
   }
   try {
-    const result = await apiPost(
+    const { data: result, idempotencyKey } = await apiPost(
       `/api/tasks/${taskId}/private-access/viewers`,
       { taskId, viewerAddress: address },
       { headers: auth.headers }
     );
-    printResult(result);
+    printResult(result, { idempotencyKey });
   } catch (err) {
-    printError(err instanceof Error ? err.message : "Failed to invite viewer.");
+    renderFailure(err, { fallback: "Failed to invite viewer." });
   }
 });
 
 // src/commands/task/uninvite.ts
-import { Command as Command38 } from "commander";
-var uninviteCmd = new Command38("uninvite").description("Remove a wallet from a private task's allowlist (requester only)").argument("<taskId>", "Task ID (0x-prefixed hex)").argument("<address>", "Wallet address to remove").action(async (taskId, address) => {
+import { Command as Command39 } from "commander";
+var uninviteCmd = new Command39("uninvite").description("Remove a wallet from a private task's allowlist (requester only)").argument("<taskId>", "Task ID (0x-prefixed hex)").argument("<address>", "Wallet address to remove").action(async (taskId, address) => {
   const auth = await signReadAuth();
   if (!auth || Object.keys(auth.headers).length === 0) {
     printError("No keystore found. Run `taskmarket init` first.");
     return;
   }
   try {
-    const result = await apiDelete(
+    const { data: result, idempotencyKey } = await apiDelete(
       `/api/tasks/${taskId}/private-access/viewers/${encodeURIComponent(address)}`,
       { headers: auth.headers }
     );
-    printResult(result);
+    printResult(result, { idempotencyKey });
   } catch (err) {
-    printError(err instanceof Error ? err.message : "Failed to remove viewer.");
+    renderFailure(err, { fallback: "Failed to remove viewer." });
   }
 });
 
 // src/commands/task/viewers.ts
-import { Command as Command39 } from "commander";
-var viewersCmd = new Command39("viewers").description("List a private task's wallet allowlist (requester only)").argument("<taskId>", "Task ID (0x-prefixed hex)").action(async (taskId) => {
+import { Command as Command40 } from "commander";
+var viewersCmd = new Command40("viewers").description("List a private task's wallet allowlist (requester only)").argument("<taskId>", "Task ID (0x-prefixed hex)").action(async (taskId) => {
   const auth = await signReadAuth();
   if (!auth || Object.keys(auth.headers).length === 0) {
     printError("No keystore found. Run `taskmarket init` first.");
@@ -7908,12 +8504,12 @@ var viewersCmd = new Command39("viewers").description("List a private task's wal
     });
     printResult(result);
   } catch (err) {
-    printError(err instanceof Error ? err.message : "Failed to list viewers.");
+    renderFailure(err, { fallback: "Failed to list viewers." });
   }
 });
 
 // src/commands/task/index.ts
-var taskCommand = new Command40("task").description("Manage tasks");
+var taskCommand = new Command41("task").description("Manage tasks");
 taskCommand.addCommand(createCmd);
 taskCommand.addCommand(listCmd);
 taskCommand.addCommand(getCmd);
@@ -7939,6 +8535,7 @@ taskCommand.addCommand(rejectAllSubmissionsCmd);
 taskCommand.addCommand(mySubmissionsCmd);
 taskCommand.addCommand(updateCmd);
 taskCommand.addCommand(forfeitCmd);
+taskCommand.addCommand(assignEvaluatorCmd);
 taskCommand.addCommand(evaluateCmd);
 taskCommand.addCommand(appealCmd);
 taskCommand.addCommand(evaluatorTimeoutCmd);
@@ -7950,8 +8547,8 @@ taskCommand.addCommand(uninviteCmd);
 taskCommand.addCommand(viewersCmd);
 
 // src/commands/agents.ts
-import { Command as Command41 } from "commander";
-var agentsCommand = new Command41("agents").description("Browse the agent directory").option("--sort <order>", "Sort order: reputation or tasks", "reputation").option("--skill <tag>", "Filter by skill tag").option("--search <query>", "Search by agentId or wallet address").option("--limit <n>", "Maximum results to return", "20").action(async (opts) => {
+import { Command as Command42 } from "commander";
+var agentsCommand = new Command42("agents").description("Browse the agent directory").option("--sort <order>", "Sort order: reputation or tasks", "reputation").option("--skill <tag>", "Filter by skill tag").option("--search <query>", "Search by agentId or wallet address").option("--limit <n>", "Maximum results to return", "20").action(async (opts) => {
   const params = new URLSearchParams();
   if (opts.sort) params.set("sort", opts.sort);
   if (opts.skill) params.set("skill", opts.skill);
@@ -7962,11 +8559,12 @@ var agentsCommand = new Command41("agents").description("Browse the agent direct
 });
 
 // src/commands/inbox.ts
-import { Command as Command42 } from "commander";
-var inboxCommand = new Command42("inbox").description("Show tasks you created and tasks you are working on").action(async () => {
+import { Command as Command43 } from "commander";
+var inboxCommand = new Command43("inbox").description("Show tasks you created and tasks you are working on").action(async () => {
   const auth = await signReadAuth();
   if (!auth) {
     printError("No keystore found. Run `taskmarket init` first.");
+    return;
   }
   const address = auth.walletAddress;
   const hasReadAuth = Object.keys(auth.headers).length > 0;
@@ -7982,23 +8580,38 @@ var inboxCommand = new Command42("inbox").description("Show tasks you created an
   printResult({ ...taskResult, pendingBids });
 });
 
+// src/commands/actions.ts
+import { Command as Command44 } from "commander";
+var actionsCommand = new Command44("actions").description("Show lifecycle actions awaiting you, grouped and prioritized by the server").action(async () => {
+  const auth = await signReadAuth();
+  if (!auth) {
+    printError("No keystore found. Run `taskmarket init` first.");
+    return;
+  }
+  const params = new URLSearchParams({ address: auth.walletAddress });
+  const queue = await apiGet(`/api/agents/action-queue?${params.toString()}`, {
+    headers: auth.headers
+  });
+  printResult(queue);
+});
+
 // src/commands/deposit.ts
-import { Command as Command43 } from "commander";
-var depositCommand = new Command43("deposit").description("Show wallet address and network info for funding").action(async () => {
+import { Command as Command45 } from "commander";
+var depositCommand = new Command45("deposit").description("Show wallet address and network info for funding").action(async () => {
   let address;
   try {
     address = await getWalletAddress();
   } catch (err) {
-    const msg = err instanceof Error ? err.message : "No keystore found. Run `taskmarket init` first.";
-    printError(msg);
+    renderFailure(err, { fallback: "No keystore found. Run `taskmarket init` first." });
+    return;
   }
   let networkInfo;
   try {
     const response = await apiGet("/trpc/network.info");
     networkInfo = response.result.data;
   } catch (err) {
-    const msg = err instanceof Error ? err.message : "Failed to fetch network info from backend.";
-    printError(msg);
+    renderFailure(err, { fallback: "Failed to fetch network info from backend." });
+    return;
   }
   const data = {
     address,
@@ -8011,11 +8624,11 @@ var depositCommand = new Command43("deposit").description("Show wallet address a
 });
 
 // src/commands/wallet/index.ts
-import { Command as Command49 } from "commander";
+import { Command as Command51 } from "commander";
 
 // src/commands/wallet/balance.ts
-import { Command as Command44 } from "commander";
-var walletBalanceCommand = new Command44("balance").description("Show USDC balance").option("--address <addr>", "Address to check (defaults to own wallet)").action(async (opts) => {
+import { Command as Command46 } from "commander";
+var walletBalanceCommand = new Command46("balance").description("Show USDC balance").option("--address <addr>", "Address to check (defaults to own wallet)").action(async (opts) => {
   let address = opts.address;
   if (!address) {
     const keystore = await loadKeystore();
@@ -8026,7 +8639,7 @@ var walletBalanceCommand = new Command44("balance").description("Show USDC balan
 });
 
 // src/commands/wallet/import.ts
-import { Command as Command45 } from "commander";
+import { Command as Command47 } from "commander";
 import { createInterface as createInterface2 } from "readline";
 import { privateKeyToAccount as privateKeyToAccount4 } from "viem/accounts";
 function normalizePrivateKey(raw) {
@@ -8061,7 +8674,7 @@ function promptHiddenInput(prompt) {
     });
   });
 }
-var walletImportCommand = new Command45("import").description("Import an existing private key as the agent wallet").option("--key <privateKey>", "Private key to import (64 hex chars, with or without 0x prefix)").option(
+var walletImportCommand = new Command47("import").description("Import an existing private key as the agent wallet").option("--key <privateKey>", "Private key to import (64 hex chars, with or without 0x prefix)").option(
   "--yes",
   "Confirm legal acceptance non-interactively after reviewing every current policy"
 ).action(async (opts) => {
@@ -8140,69 +8753,77 @@ var walletImportCommand = new Command45("import").description("Import an existin
 });
 
 // src/commands/wallet/set-withdrawal-address.ts
-import { Command as Command46 } from "commander";
+import { Command as Command48 } from "commander";
 function isValidAddress(addr) {
   return /^0x[a-fA-F0-9]{40}$/.test(addr);
 }
-var setWithdrawalAddressCommand = new Command46("set-withdrawal-address").description("Set a withdrawal address for USDC withdrawals (one-time, free)").argument("<address>", "Ethereum address to receive withdrawals").action(async (address) => {
+var setWithdrawalAddressCommand = new Command48("set-withdrawal-address").description("Set a withdrawal address for USDC withdrawals (one-time, free)").argument("<address>", "Ethereum address to receive withdrawals").action(async (address) => {
   if (!isValidAddress(address)) {
     printError("Invalid Ethereum address: must be 0x followed by 40 hex characters");
+    return;
   }
   let keystore;
   try {
     keystore = await loadKeystore();
   } catch {
     printError("No keystore found. Run `taskmarket init` first.");
+    return;
   }
   const walletAddress = keystore.walletAddress;
   const message = buildSetWithdrawalAddressMessage(address);
   const signature = await signMessage(message, keystore);
-  const result = await apiPost("/api/wallet/set-withdrawal-address", {
-    walletAddress,
-    withdrawalAddress: address,
-    signature
-  });
-  printResult({ withdrawalAddress: result.withdrawalAddress });
+  const { data: result, idempotencyKey } = await apiPost(
+    "/api/wallet/set-withdrawal-address",
+    {
+      walletAddress,
+      withdrawalAddress: address,
+      signature
+    }
+  );
+  printResult({ withdrawalAddress: result.withdrawalAddress }, { idempotencyKey });
 });
 
 // src/commands/wallet/publish-key.ts
-import { Command as Command47 } from "commander";
-var publishKeyCommand = new Command47("publish-key").description("Publish your secp256k1 public key so others can encrypt files for you").action(async () => {
+import { Command as Command49 } from "commander";
+var publishKeyCommand = new Command49("publish-key").description("Publish your secp256k1 public key so others can encrypt files for you").action(async () => {
   let keystore;
   try {
     keystore = await loadKeystore();
   } catch {
     printError("No keystore found. Run `taskmarket init` first.");
+    return;
   }
   const dek = await fetchDeviceKey(keystore.deviceId, keystore.apiToken);
   const privateKey = decryptPrivateKey(dek, keystore.encryptedKey);
   const publicKey = deriveCompressedPublicKey(privateKey);
-  const result = await apiPost("/trpc/agents.setPublicKey", {
+  const { data: result, idempotencyKey } = await apiPost("/trpc/agents.setPublicKey", {
     deviceId: keystore.deviceId,
     apiToken: keystore.apiToken,
     publicKey
   });
-  printResult({ publicKey: result.result.data.publicKey });
+  printResult({ publicKey: result.result.data.publicKey }, { idempotencyKey });
 });
 
 // src/commands/wallet/withdraw-dreams.ts
-import { Command as Command48 } from "commander";
+import { Command as Command50 } from "commander";
 import { toHex as toHex2 } from "viem";
 var AUTHORIZATION_VALIDITY_SECONDS = 300;
 function isValidAddress2(addr) {
   return /^0x[a-fA-F0-9]{40}$/.test(addr);
 }
-var withdrawDreamsCommand = new Command48("withdraw-dreams").description("Withdraw accumulated DREAMS rewards to the withdrawal address").option("--destination <addr>", "Destination address (defaults to registered withdrawal address)").action(async (opts) => {
+var withdrawDreamsCommand = new Command50("withdraw-dreams").description("Withdraw accumulated DREAMS rewards to the withdrawal address").option("--destination <addr>", "Destination address (defaults to registered withdrawal address)").action(async (opts) => {
   let keystore;
   try {
     keystore = await loadKeystore();
   } catch {
     printError("No keystore found. Run `taskmarket init` first.");
+    return;
   }
   const workerAddress = keystore.walletAddress;
   let destination = opts.destination;
   if (destination !== void 0 && !isValidAddress2(destination)) {
     printError("Invalid Ethereum address: must be 0x followed by 40 hex characters");
+    return;
   }
   if (!destination) {
     const addressResponse = await apiGet(
@@ -8212,6 +8833,7 @@ var withdrawDreamsCommand = new Command48("withdraw-dreams").description("Withdr
       printError(
         "No withdrawal address set. Run: taskmarket wallet set-withdrawal-address <address>"
       );
+      return;
     }
     destination = addressResponse.withdrawalAddress;
   }
@@ -8219,25 +8841,31 @@ var withdrawDreamsCommand = new Command48("withdraw-dreams").description("Withdr
   const validBefore = String(Math.floor(Date.now() / 1e3) + AUTHORIZATION_VALIDITY_SECONDS);
   const message = buildWithdrawDreamsMessage(destination, nonce, validBefore);
   const signature = await signMessage(message, keystore);
-  const result = await apiPost("/api/wallet/withdraw-dreams", {
-    workerAddress,
-    destination,
-    nonce,
-    validBefore,
-    signature
-  });
-  printResult({
-    txHash: result.txHash,
-    destination: result.destination,
-    claimedBaseUnits: result.claimedBaseUnits,
-    claimedDreams: formatDreams(result.claimedBaseUnits),
-    dreamsPerUsdc: result.dreamsPerUsdc,
-    usdEquivalent: result.usdEquivalent
-  });
+  const { data: result, idempotencyKey } = await apiPost(
+    "/api/wallet/withdraw-dreams",
+    {
+      workerAddress,
+      destination,
+      nonce,
+      validBefore,
+      signature
+    }
+  );
+  printResult(
+    {
+      txHash: result.txHash,
+      destination: result.destination,
+      claimedBaseUnits: result.claimedBaseUnits,
+      claimedDreams: formatDreams(result.claimedBaseUnits),
+      dreamsPerUsdc: result.dreamsPerUsdc,
+      usdEquivalent: result.usdEquivalent
+    },
+    { idempotencyKey }
+  );
 });
 
 // src/commands/wallet/index.ts
-var walletCommand = new Command49("wallet").description("Wallet management commands");
+var walletCommand = new Command51("wallet").description("Wallet management commands");
 walletCommand.addCommand(walletBalanceCommand);
 walletCommand.addCommand(walletImportCommand);
 walletCommand.addCommand(setWithdrawalAddressCommand);
@@ -8245,7 +8873,7 @@ walletCommand.addCommand(publishKeyCommand);
 walletCommand.addCommand(withdrawDreamsCommand);
 
 // src/commands/withdraw.ts
-import { Command as Command50 } from "commander";
+import { Command as Command52 } from "commander";
 import { toHex as toHex3 } from "viem";
 var USDC_TYPES = {
   TransferWithAuthorization: [
@@ -8257,10 +8885,11 @@ var USDC_TYPES = {
     { name: "nonce", type: "bytes32" }
   ]
 };
-var withdrawCommand = new Command50("withdraw").description("Withdraw USDC to the registered withdrawal address").argument("<amount>", "Amount in USDC (e.g. 5 for 5 USDC)").action(async (amount) => {
+var withdrawCommand = new Command52("withdraw").description("Withdraw USDC to the registered withdrawal address").argument("<amount>", "Amount in USDC (e.g. 5 for 5 USDC)").action(async (amount) => {
   const parsed = parseFloat(amount);
   if (isNaN(parsed) || parsed <= 0) {
     printError("Invalid amount: must be a positive number (e.g. 5 for 5 USDC)");
+    return;
   }
   const amountBaseUnits = String(Math.round(parsed * 1e6));
   let keystore;
@@ -8268,6 +8897,7 @@ var withdrawCommand = new Command50("withdraw").description("Withdraw USDC to th
     keystore = await loadKeystore();
   } catch {
     printError("No keystore found. Run `taskmarket init` first.");
+    return;
   }
   const from = keystore.walletAddress;
   const addressResponse = await apiGet(
@@ -8277,6 +8907,7 @@ var withdrawCommand = new Command50("withdraw").description("Withdraw USDC to th
     printError(
       "No withdrawal address set. Run: taskmarket wallet set-withdrawal-address <address>"
     );
+    return;
   }
   const { withdrawalAddress, usdcDomain } = addressResponse;
   const now = Math.floor(Date.now() / 1e3);
@@ -8297,30 +8928,38 @@ var withdrawCommand = new Command50("withdraw").description("Withdraw USDC to th
     },
     keystore
   );
-  const result = await apiPost("/api/wallet/withdraw", {
-    from,
-    amountBaseUnits,
-    authorization,
-    signature
-  });
-  printResult({ txHash: result.txHash, amountBaseUnits: result.amountBaseUnits, to: result.to });
+  const { data: result, idempotencyKey } = await apiPost(
+    "/api/wallet/withdraw",
+    {
+      from,
+      amountBaseUnits,
+      authorization,
+      signature
+    }
+  );
+  printResult(
+    { txHash: result.txHash, amountBaseUnits: result.amountBaseUnits, to: result.to },
+    { idempotencyKey }
+  );
 });
 
 // src/commands/encrypt.ts
-import { Command as Command51 } from "commander";
+import { Command as Command53 } from "commander";
 import { promises as fs3 } from "fs";
-var encryptCommand = new Command51("encrypt").description("Encrypt a file with ECIES using wallet keys").argument("<file>", "Path to the file to encrypt").option("--recipient <address>", "Recipient wallet address (default: self)").option("--output <path>", "Output path (default: <file>.enc)").action(async (file, opts) => {
+var encryptCommand = new Command53("encrypt").description("Encrypt a file with ECIES using wallet keys").argument("<file>", "Path to the file to encrypt").option("--recipient <address>", "Recipient wallet address (default: self)").option("--output <path>", "Output path (default: <file>.enc)").action(async (file, opts) => {
   let plaintext;
   try {
     plaintext = await fs3.readFile(file);
   } catch {
     printError(`Cannot read file: ${file}`);
+    return;
   }
   let keystore;
   try {
     keystore = await loadKeystore();
   } catch {
     printError("No keystore found. Run `taskmarket init` first.");
+    return;
   }
   let recipientPubKey;
   let recipientAddress;
@@ -8333,12 +8972,9 @@ var encryptCommand = new Command51("encrypt").description("Encrypt a file with E
       );
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
-      if (msg.includes("publish their public key") || msg.includes("NOT_FOUND")) {
-        printError(
-          `Recipient has not published their public key. Ask them to run: taskmarket wallet publish-key`
-        );
-      }
-      printError(`Failed to fetch recipient public key: ${msg}`);
+      const context = msg.includes("publish their public key") || msg.includes("NOT_FOUND") ? "Recipient has not published their public key. Ask them to run: taskmarket wallet publish-key" : "Failed to fetch recipient public key";
+      renderFailure(withErrorContext(err, context));
+      return;
     }
     recipientPubKey = result.result.data.publicKey;
   } else {
@@ -8358,20 +8994,22 @@ var encryptCommand = new Command51("encrypt").description("Encrypt a file with E
 });
 
 // src/commands/decrypt.ts
-import { Command as Command52 } from "commander";
+import { Command as Command54 } from "commander";
 import { promises as fs4 } from "fs";
-var decryptCommand = new Command52("decrypt").description("Decrypt a file using your wallet key").argument("<file>", "Path to the encrypted file").option("--output <path>", "Output path (default: strips .enc, otherwise appends .dec)").action(async (file, opts) => {
+var decryptCommand = new Command54("decrypt").description("Decrypt a file using your wallet key").argument("<file>", "Path to the encrypted file").option("--output <path>", "Output path (default: strips .enc, otherwise appends .dec)").action(async (file, opts) => {
   let ciphertext;
   try {
     ciphertext = await fs4.readFile(file);
   } catch {
     printError(`Cannot read file: ${file}`);
+    return;
   }
   let keystore;
   try {
     keystore = await loadKeystore();
   } catch {
     printError("No keystore found. Run `taskmarket init` first.");
+    return;
   }
   const dek = await fetchDeviceKey(keystore.deviceId, keystore.apiToken);
   const privateKey = decryptPrivateKey(dek, keystore.encryptedKey);
@@ -8379,8 +9017,8 @@ var decryptCommand = new Command52("decrypt").description("Decrypt a file using
   try {
     plaintext = decryptWithPrivateKey(ciphertext, privateKey);
   } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    printError(msg);
+    renderFailure(err);
+    return;
   }
   let outputPath;
   if (opts.output) {
@@ -8398,21 +9036,21 @@ var decryptCommand = new Command52("decrypt").description("Decrypt a file using
 });
 
 // src/commands/xmtp.ts
-import { Command as Command53 } from "commander";
+import { Command as Command55 } from "commander";
 
 // src/lib/xmtp-client.ts
 import os3 from "os";
 import path3 from "path";
-import { randomUUID as randomUUID2, hkdfSync as hkdfSync2 } from "crypto";
+import { randomUUID as randomUUID3, hkdfSync as hkdfSync2 } from "crypto";
 import { privateKeyToAccount as privateKeyToAccount5 } from "viem/accounts";
 
 // src/lib/xmtp-envelope.ts
-import { randomUUID } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
 function buildEnvelope(input) {
   return AgentMessageEnvelopeSchema.parse({
     schemaVersion: 1,
     type: input.type,
-    requestId: input.requestId ?? randomUUID(),
+    requestId: input.requestId ?? randomUUID2(),
     replyToRequestId: input.replyToRequestId,
     senderInboxId: input.senderInboxId,
     senderAddress: input.senderAddress,
@@ -8565,7 +9203,7 @@ function defaultDbPath(walletAddress) {
 }
 async function createDevClient(input) {
   const inboxId = input.existingInboxId ?? `dev-inbox-${input.walletAddress.slice(2, 10).toLowerCase()}`;
-  const installationId = input.existingInstallationId ?? randomUUID2();
+  const installationId = input.existingInstallationId ?? randomUUID3();
   const dbPath = input.existingDbPath ?? defaultDbPath(input.walletAddress);
   return {
     inboxId,
@@ -8994,7 +9632,7 @@ async function createProductionClient(input) {
       "non-retryable"
     );
   }
-  const installationId = extractString(client, ["installationId", "installationID"]) ?? extractString(asObject(client)?.installation, ["id", "installationId"]) ?? input.existingInstallationId ?? randomUUID2();
+  const installationId = extractString(client, ["installationId", "installationID"]) ?? extractString(asObject(client)?.installation, ["id", "installationId"]) ?? input.existingInstallationId ?? randomUUID3();
   return {
     inboxId,
     installationId,
@@ -9162,7 +9800,7 @@ function getDefaultQueryTimeoutMs() {
   }
   return Math.floor(parsed);
 }
-var xmtpCommand = new Command53("xmtp").description("Manage XMTP messaging for this agent");
+var xmtpCommand = new Command55("xmtp").description("Manage XMTP messaging for this agent");
 xmtpCommand.command("init").description("Initialize XMTP client and register installation metadata with backend").action(async () => {
   const keystore = await loadKeystore();
   const client = await createXmtpClient({
@@ -9172,7 +9810,7 @@ xmtpCommand.command("init").description("Initialize XMTP client and register ins
     existingDbPath: keystore.xmtpDbPath,
     keystore
   });
-  const status = await apiPost("/api/xmtp/bootstrap", {
+  const { data: status, idempotencyKey } = await apiPost("/api/xmtp/bootstrap", {
     deviceId: keystore.deviceId,
     apiToken: keystore.apiToken,
     inboxId: client.inboxId,
@@ -9186,7 +9824,7 @@ xmtpCommand.command("init").description("Initialize XMTP client and register ins
     xmtpInstallationId: status.installationId,
     xmtpDbPath: client.dbPath
   });
-  printResult({ policyMode: status.policyMode });
+  printResult({ policyMode: status.policyMode }, { idempotencyKey });
 });
 xmtpCommand.command("status").description("Check XMTP status and active installation state").action(async () => {
   const keystore = await loadKeystore();
@@ -9299,12 +9937,15 @@ xmtpCommand.command("heartbeat").description("Send a one-shot heartbeat to keep
   if (!keystore.xmtpInstallationId) {
     throw new Error("XMTP not initialized. Run `taskmarket xmtp init` first.");
   }
-  const result = await apiPost("/api/xmtp/heartbeat", {
-    deviceId: keystore.deviceId,
-    apiToken: keystore.apiToken,
-    installationId: keystore.xmtpInstallationId
-  });
-  printResult(result);
+  const { data: result, idempotencyKey } = await apiPost(
+    "/api/xmtp/heartbeat",
+    {
+      deviceId: keystore.deviceId,
+      apiToken: keystore.apiToken,
+      installationId: keystore.xmtpInstallationId
+    }
+  );
+  printResult(result, { idempotencyKey });
 });
 var peersCommand = xmtpCommand.command("peers").description("Manage taskmarket peer messaging policies");
 peersCommand.command("list").description("List per-peer messaging policies stored on the backend").action(async () => {
@@ -9322,14 +9963,17 @@ peersCommand.command("set").description("Set messaging policy for a specific pee
   }
   const keystore = await loadKeystore();
   const peerInboxId = await resolveInboxId(options.to);
-  const result = await apiPost("/api/xmtp/peers", {
-    deviceId: keystore.deviceId,
-    apiToken: keystore.apiToken,
-    peerInboxId,
-    policy: options.policy,
-    reason: options.reason
-  });
-  printResult(result);
+  const { data: result, idempotencyKey } = await apiPost(
+    "/api/xmtp/peers",
+    {
+      deviceId: keystore.deviceId,
+      apiToken: keystore.apiToken,
+      peerInboxId,
+      policy: options.policy,
+      reason: options.reason
+    }
+  );
+  printResult(result, { idempotencyKey });
 });
 var allowlistCommand = xmtpCommand.command("allowlist").description("Manage XMTP SDK consent allowlist (protocol-level)");
 allowlistCommand.command("add").description("Allow messages from a peer inbox (XMTP SDK consent)").requiredOption("--to <agentIdOrAddrOrInboxId>", "Target agent ID, wallet address, or inboxId").action(async (options) => {
@@ -9382,15 +10026,18 @@ allowlistCommand.command("check").description("Check the XMTP SDK consent state
 });
 xmtpCommand.command("purge").description("Revoke stale XMTP installations that have missed heartbeats").action(async () => {
   const keystore = await loadKeystore();
-  const result = await apiPost("/api/xmtp/purge", {
-    deviceId: keystore.deviceId,
-    apiToken: keystore.apiToken
-  });
-  printResult(result);
+  const { data: result, idempotencyKey } = await apiPost(
+    "/api/xmtp/purge",
+    {
+      deviceId: keystore.deviceId,
+      apiToken: keystore.apiToken
+    }
+  );
+  printResult(result, { idempotencyKey });
 });
 
 // src/commands/daemon.ts
-import { Command as Command54 } from "commander";
+import { Command as Command56 } from "commander";
 function diffTaskStatuses(prev, next) {
   const changes = [];
   for (const [taskId, newStatus] of next) {
@@ -9418,7 +10065,7 @@ function sleepOrAbort(ms, signal) {
   });
 }
 var MAX_SEEN_TASK_IDS = 2e3;
-var daemonCommand = new Command54("daemon").description("Long-running agent daemon: XMTP stream, heartbeats, and task polling").option("--heartbeat-interval <ms>", "Heartbeat interval in milliseconds", "1800000").option("--inbox-interval <ms>", "Inbox poll interval in milliseconds", "15000").option("--task-interval <ms>", "New task poll interval in milliseconds", "15000").option(
+var daemonCommand = new Command56("daemon").description("Long-running agent daemon: XMTP stream, heartbeats, and task polling").option("--heartbeat-interval <ms>", "Heartbeat interval in milliseconds", "1800000").option("--inbox-interval <ms>", "Inbox poll interval in milliseconds", "15000").option("--task-interval <ms>", "New task poll interval in milliseconds", "15000").option(
   "--auction-poll-interval <ms>",
   "Poll interval for clock-based auction tasks (dutch/reverse_dutch) in milliseconds",
   "15000"
@@ -9502,12 +10149,15 @@ var daemonCommand = new Command54("daemon").description("Long-running agent daem
           await sleepOrAbort(heartbeatIntervalMs, abortController.signal);
           if (stopped) break;
           try {
-            await apiPost("/trpc/xmtp.heartbeat", {
+            const { idempotencyKey } = await apiPost("/trpc/xmtp.heartbeat", {
               deviceId: keystore.deviceId,
               apiToken: keystore.apiToken,
               installationId: client.installationId
             });
-            printResult({ event: "xmtp.heartbeat", installationId: client.installationId });
+            printResult(
+              { event: "xmtp.heartbeat", installationId: client.installationId },
+              { idempotencyKey }
+            );
           } catch (err) {
             process.stderr.write(
               `Heartbeat failed: ${err instanceof Error ? err.message : String(err)}
@@ -9739,29 +10389,33 @@ var daemonCommand = new Command54("daemon").description("Long-running agent daem
 );
 
 // src/commands/email/index.ts
-import { Command as Command63 } from "commander";
+import { Command as Command65 } from "commander";
 
 // src/commands/email/register.ts
-import { Command as Command55 } from "commander";
-var registerCommand = new Command55("register").description("Register an email address for this agent").requiredOption("--username <name>", "Desired username (e.g. myagent)").action(async (opts) => {
+import { Command as Command57 } from "commander";
+var registerCommand = new Command57("register").description("Register an email address for this agent").requiredOption("--username <name>", "Desired username (e.g. myagent)").action(async (opts) => {
   const check = await apiGet(
     `/api/emails/check-username?username=${encodeURIComponent(opts.username)}`
   );
   if (!check.available) {
     printError(`Username "${opts.username}" is not available.`);
+    return;
   }
   const keystore = await loadKeystore();
-  const result = await apiPost("/api/emails/register", {
-    deviceId: keystore.deviceId,
-    apiToken: keystore.apiToken,
-    username: opts.username
-  });
-  printResult({ emailAddress: result.emailAddress });
+  const { data: result, idempotencyKey } = await apiPost(
+    "/api/emails/register",
+    {
+      deviceId: keystore.deviceId,
+      apiToken: keystore.apiToken,
+      username: opts.username
+    }
+  );
+  printResult({ emailAddress: result.emailAddress }, { idempotencyKey });
 });
 
 // src/commands/email/inbox.ts
-import { Command as Command56 } from "commander";
-var inboxCommand2 = new Command56("inbox").description("List emails in your inbox").option("--limit <n>", "Number of emails to return", "20").option("--unread", "Show only unread emails").action(async (opts) => {
+import { Command as Command58 } from "commander";
+var inboxCommand2 = new Command58("inbox").description("List emails in your inbox").option("--limit <n>", "Number of emails to return", "20").option("--unread", "Show only unread emails").action(async (opts) => {
   const keystore = await loadKeystore();
   const params = new URLSearchParams({
     deviceId: keystore.deviceId,
@@ -9776,8 +10430,8 @@ var inboxCommand2 = new Command56("inbox").description("List emails in your inbo
 });
 
 // src/commands/email/read.ts
-import { Command as Command57 } from "commander";
-var readCommand = new Command57("read").description("Read an email by ID (marks it as read)").argument("<id>", "Email ID").action(async (id) => {
+import { Command as Command59 } from "commander";
+var readCommand = new Command59("read").description("Read an email by ID (marks it as read)").argument("<id>", "Email ID").action(async (id) => {
   const keystore = await loadKeystore();
   const params = new URLSearchParams({
     deviceId: keystore.deviceId,
@@ -9789,22 +10443,22 @@ var readCommand = new Command57("read").description("Read an email by ID (marks
 });
 
 // src/commands/email/send.ts
-import { Command as Command58 } from "commander";
-var sendCommand = new Command58("send").description("Send an email").requiredOption("--to <address>", "Recipient email address").requiredOption("--subject <subject>", "Email subject").requiredOption("--body <text>", "Email body text").action(async (opts) => {
+import { Command as Command60 } from "commander";
+var sendCommand = new Command60("send").description("Send an email").requiredOption("--to <address>", "Recipient email address").requiredOption("--subject <subject>", "Email subject").requiredOption("--body <text>", "Email body text").action(async (opts) => {
   const keystore = await loadKeystore();
-  const result = await apiPost("/api/emails/send", {
+  const { data: result, idempotencyKey } = await apiPost("/api/emails/send", {
     deviceId: keystore.deviceId,
     apiToken: keystore.apiToken,
     to: opts.to,
     subject: opts.subject,
     bodyText: opts.body
   });
-  printResult({ sent: result.sent });
+  printResult({ sent: result.sent }, { idempotencyKey });
 });
 
 // src/commands/email/reply.ts
-import { Command as Command59 } from "commander";
-var replyCommand = new Command59("reply").description("Reply to an email").argument("<id>", "Email ID to reply to").requiredOption("--body <text>", "Reply body text").action(async (id, opts) => {
+import { Command as Command61 } from "commander";
+var replyCommand = new Command61("reply").description("Reply to an email").argument("<id>", "Email ID to reply to").requiredOption("--body <text>", "Reply body text").action(async (id, opts) => {
   const keystore = await loadKeystore();
   const params = new URLSearchParams({
     deviceId: keystore.deviceId,
@@ -9815,54 +10469,60 @@ var replyCommand = new Command59("reply").description("Reply to an email").argum
   const to = original.fromAddress;
   const rawSubject = original.subject ?? "";
   const subject = rawSubject.startsWith("Re: ") ? rawSubject : `Re: ${rawSubject}`;
-  const result = await apiPost("/api/emails/send", {
+  const { data: result, idempotencyKey } = await apiPost("/api/emails/send", {
     deviceId: keystore.deviceId,
     apiToken: keystore.apiToken,
     to,
     subject,
     bodyText: opts.body
   });
-  printResult({ sent: result.sent });
+  printResult({ sent: result.sent }, { idempotencyKey });
 });
 
 // src/commands/email/delete.ts
-import { Command as Command60 } from "commander";
-var deleteCommand = new Command60("delete").description("Delete an email by ID").argument("<id>", "Email ID").action(async (id) => {
+import { Command as Command62 } from "commander";
+var deleteCommand = new Command62("delete").description("Delete an email by ID").argument("<id>", "Email ID").action(async (id) => {
   const keystore = await loadKeystore();
-  const result = await apiPost("/api/emails/delete", {
-    deviceId: keystore.deviceId,
-    apiToken: keystore.apiToken,
-    id
-  });
-  printResult({ deleted: result.deleted });
+  const { data: result, idempotencyKey } = await apiPost(
+    "/api/emails/delete",
+    {
+      deviceId: keystore.deviceId,
+      apiToken: keystore.apiToken,
+      id
+    }
+  );
+  printResult({ deleted: result.deleted }, { idempotencyKey });
 });
 
 // src/commands/email/address.ts
-import { Command as Command61 } from "commander";
-var addressCommand2 = new Command61("address").description("Show your registered email address").action(async () => {
+import { Command as Command63 } from "commander";
+var addressCommand2 = new Command63("address").description("Show your registered email address").action(async () => {
   const keystore = await loadKeystore();
   const result = await apiGet(`/api/agents/stats?address=${keystore.walletAddress}`);
   printResult({ emailAddress: result.emailAddress ?? null });
 });
 
 // src/commands/email/mark-read.ts
-import { Command as Command62 } from "commander";
+import { Command as Command64 } from "commander";
 async function setReadStatus(id, read) {
   const keystore = await loadKeystore();
-  const result = await apiPost("/api/emails/mark-read", {
-    deviceId: keystore.deviceId,
-    apiToken: keystore.apiToken,
-    id,
-    read
-  });
-  printResult({ id: result.id, isRead: result.isRead });
+  const { data: result, idempotencyKey } = await apiPost(
+    "/api/emails/mark-read",
+    {
+      deviceId: keystore.deviceId,
+      apiToken: keystore.apiToken,
+      id,
+      read
+    }
+  );
+  printResult({ id: result.id, isRead: result.isRead }, { idempotencyKey });
 }
-var markReadCommand = new Command62("mark-read").description("Mark an email as read or unread").argument("<id>", "Email ID").option("--unread", "Mark as unread instead of read").action(async (id, opts) => {
+var markReadCommand = new Command64("mark-read").description("Mark an email as read or unread").argument("<id>", "Email ID").option("--unread", "Mark as unread instead of read").action(async (id, opts) => {
   await setReadStatus(id, !opts.unread);
 });
 
 // src/commands/email/index.ts
-var emailCommand = new Command63("email").description("Email management commands");
+var emailCommand = new Command65("email").description("Email management commands");
 emailCommand.addCommand(registerCommand);
 emailCommand.addCommand(inboxCommand2);
 emailCommand.addCommand(readCommand);
@@ -9873,32 +10533,30 @@ emailCommand.addCommand(addressCommand2);
 emailCommand.addCommand(markReadCommand);
 
 // src/commands/requester/index.ts
-import { Command as Command65 } from "commander";
+import { Command as Command67 } from "commander";
 
 // src/commands/requester/stats.ts
-import { Command as Command64 } from "commander";
-var requesterStatsCmd = new Command64("stats").description("Get requester reputation stats for an address").argument("<address>", "Wallet address of the requester").action(async (address) => {
+import { Command as Command66 } from "commander";
+var requesterStatsCmd = new Command66("stats").description("Get requester reputation stats for an address").argument("<address>", "Wallet address of the requester").action(async (address) => {
   if (!/^0x[0-9a-fA-F]{40}$/.test(address)) {
     printError("Address must be a 0x-prefixed 20-byte hex string");
-    process.exit(1);
     return;
   }
   const data = await apiGet(`/api/requester/${address}/stats`);
   if (!data) {
     printError("No stats found for address");
-    process.exit(1);
     return;
   }
   printResult(data);
 });
 
 // src/commands/requester/index.ts
-var requesterCmd = new Command65("requester").description("Requester reputation commands").addCommand(requesterStatsCmd);
+var requesterCmd = new Command67("requester").description("Requester reputation commands").addCommand(requesterStatsCmd);
 
 // src/index.ts
 var require2 = createRequire(import.meta.url);
 var { version } = require2("../package.json");
-var program = new Command66();
+var program = new Command68();
 program.name("taskmarket").description("Taskmarket CLI for AI agents").version(version);
 program.addCommand(initCommand);
 program.addCommand(walletCommand);
@@ -9908,6 +10566,7 @@ program.addCommand(statsCommand);
 program.addCommand(taskCommand);
 program.addCommand(agentsCommand);
 program.addCommand(inboxCommand);
+program.addCommand(actionsCommand);
 program.addCommand(depositCommand);
 program.addCommand(withdrawCommand);
 program.addCommand(encryptCommand);
@@ -9917,10 +10576,10 @@ program.addCommand(daemonCommand);
 program.addCommand(emailCommand);
 program.addCommand(requesterCmd);
 program.addCommand(legalCommand);
-program.parseAsync(process.argv).catch((err) => {
-  const status = err instanceof ApiError ? err.status : void 0;
-  process.stderr.write(
-    JSON.stringify({ ok: false, error: err.message, ...status !== void 0 ? { status } : {} }) + "\n"
-  );
-  process.exit(1);
-});
+void (async () => {
+  try {
+    await program.parseAsync(process.argv);
+  } catch (err) {
+    renderFailure(err);
+  }
+})();