@namera-ai/cli 0.1.4 → 1.0.0

package/dist/index.js

@@ -0,0 +1,1660 @@
+#!/usr/bin/env node
+import { NodeRuntime, NodeServices } from "@effect/platform-node";
+import { Clock, Console, Context, DateTime, Deferred, Effect, Fiber, FileSystem, Layer, Logger, Option, Predicate, Redacted, Schema, Stdio, Stream } from "effect";
+import { Argument, Command, Flag, Prompt } from "effect/unstable/cli";
+import { NAMERA_API_ORIGIN, NameraClient, openLocalSessionKey, sealLocalSessionKey } from "@namera-ai/sdk";
+import { chmod, link, lstat, mkdir, open, readFile, rename, unlink, writeFile } from "node:fs/promises";
+import { homedir, platform } from "node:os";
+import { dirname, join } from "node:path";
+import { Entry } from "@napi-rs/keyring";
+import { privateKeyToAccount } from "viem/accounts";
+import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import { constants } from "node:fs";
+import { EthereumAddress, EvmTypedData, ExecutionId, ExecutionSubmissionId, Hex, SessionKeyId, SupportedEvmChainId, WalletId } from "@namera-ai/protocol";
+import { EncryptedLocalSessionKey } from "@namera-ai/protocol/local";
+import { stripVTControlCharacters } from "node:util";
+import { arbitrum, arbitrumSepolia, base, baseSepolia, mainnet, optimism, optimismSepolia, sepolia } from "viem/chains";
+import { spawn } from "node:child_process";
+import { CompleteExecutionResponse, ExecuteRequest, GetExecutionSubmissionResponse, GetSessionKeyResponse, GetWalletResponse, ListExecutionsResponse, ListSessionKeysForOrganizationResponse, ListWalletsResponse, McpExecuteTransactionRequest, McpGetExecutionsRequest, McpGetSessionKeyRequest, McpGetTransactionStatusRequest, McpGetWalletRequest, McpListSessionKeysRequest, McpSignRequest, McpSimulateTransactionRequest, McpToolError, McpToolErrorCode, McpVerifySignatureRequest, OAuthDynamicClientRegistrationResponse, OAuthTokenResponse, PrepareSignatureRequest, SignResponse, SimulateExecutionRequest, SimulateExecutionResponse, VerifySignatureRequest, VerifySignatureResponse } from "@namera-ai/protocol/dto";
+import { DatabaseSync } from "node:sqlite";
+import { FetchHttpClient, HttpClient, HttpClientRequest, HttpIncomingMessage } from "effect/unstable/http";
+import { createServer } from "node:http";
+import { McpProtocol, McpSchema, McpServer, Tool } from "effect/unstable/ai";
+
+//#region src/commands/common.ts
+const profileFlag = Flag.string("profile").pipe(Flag.withDescription("CLI profile name"), Flag.withDefault("personal"));
+const paramsFlag = Flag.string("params").pipe(Flag.withDescription("Inline JSON command payload"), Flag.optional);
+const resolveParams = (params, schema, prompt) => Option.match(params, {
+	onNone: () => prompt,
+	onSome: (value) => Schema.decodeUnknownEffect(Schema.fromJsonString(schema))(value)
+});
+
+//#endregion
+//#region src/services/config.ts
+const configDirectory = () => {
+	if (process.env.XDG_CONFIG_HOME) return join(process.env.XDG_CONFIG_HOME, "namera");
+	if (process.platform === "darwin") return join(homedir(), "Library", "Application Support", "namera");
+	if (process.platform === "win32") return join(process.env.APPDATA ?? join(homedir(), "AppData", "Roaming"), "Namera");
+	return join(homedir(), ".config", "namera");
+};
+const cliConfigPath = join(configDirectory(), "config.json");
+const cliLockPath = (profile) => join(configDirectory(), `${profile}.refresh.lock`);
+const readCliConfig = async () => {
+	try {
+		return JSON.parse(await readFile(cliConfigPath, "utf8"));
+	} catch (error) {
+		if (error.code !== "ENOENT") throw error;
+		return {
+			activeProfile: "personal",
+			profiles: {}
+		};
+	}
+};
+const writeCliConfig = async (config) => {
+	await mkdir(dirname(cliConfigPath), {
+		recursive: true,
+		mode: 448
+	});
+	const temporaryPath = `${cliConfigPath}.${process.pid}.tmp`;
+	await writeFile(temporaryPath, `${JSON.stringify(config, null, 2)}\n`, { mode: 384 });
+	await rename(temporaryPath, cliConfigPath);
+};
+const getProfile = async (name) => {
+	const config = await readCliConfig();
+	const profileName = name ?? config.activeProfile;
+	const profile = config.profiles[profileName];
+	if (profile === void 0) throw new Error(`Profile "${profileName}" is not logged in.`);
+	return {
+		config,
+		profile,
+		profileName
+	};
+};
+const saveProfile = async (name, profile) => {
+	const config = await readCliConfig();
+	await writeCliConfig({
+		activeProfile: name,
+		profiles: {
+			...config.profiles,
+			[name]: profile
+		}
+	});
+};
+const removeProfile = async (name) => {
+	const config = await readCliConfig();
+	const profiles = { ...config.profiles };
+	delete profiles[name];
+	await writeCliConfig({
+		activeProfile: config.activeProfile === name ? Object.keys(profiles)[0] ?? "personal" : config.activeProfile,
+		profiles
+	});
+};
+
+//#endregion
+//#region src/services/credentials.ts
+const entry$1 = (profile) => new Entry("namera-cli", profile);
+const readCredentials = (profile) => {
+	const value = entry$1(profile).getPassword();
+	return value === null ? void 0 : JSON.parse(value);
+};
+const writeCredentials = (profile, credentials) => {
+	entry$1(profile).setPassword(JSON.stringify(credentials));
+};
+const deleteCredentials = (profile) => {
+	try {
+		entry$1(profile).deletePassword();
+	} catch {}
+};
+
+//#endregion
+//#region src/services/oauth.ts
+const clientId = "namera-cli";
+const resourceScopes = [
+	"wallet:read",
+	"session-key:read",
+	"execution:read",
+	"execution:execute",
+	"signature:create",
+	"offline_access"
+];
+var OAuthRequestError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.code = code;
+	}
+};
+const postForm = async (url, body) => {
+	const response = await fetch(url, {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded" },
+		body
+	});
+	const data = await response.json();
+	if (!response.ok) throw new OAuthRequestError(typeof data.error === "string" ? data.error : "oauth_error", typeof data.error_description === "string" ? data.error_description : "OAuth request failed");
+	return data;
+};
+const startDeviceAuthorization = (baseUrl, metadata) => postForm(`${baseUrl}/oauth/device/authorize`, new URLSearchParams({
+	client_id: clientId,
+	scope: resourceScopes.join(" "),
+	resource: new URL(baseUrl).origin,
+	device_name: metadata.deviceName,
+	cli_version: metadata.cliVersion,
+	platform: metadata.platform
+}));
+const toCredentials = (token) => ({
+	accessToken: token.access_token,
+	refreshToken: token.refresh_token ?? null,
+	expiresAt: Date.now() + token.expires_in * 1e3,
+	scopes: token.scope.split(/\s+/).filter(Boolean)
+});
+const pollDeviceToken = async (baseUrl, deviceCode) => {
+	const token = await postForm(`${baseUrl}/oauth/token`, new URLSearchParams({
+		grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+		device_code: deviceCode,
+		client_id: clientId,
+		resource: new URL(baseUrl).origin
+	}));
+	return toCredentials(token);
+};
+const acquireRefreshLock = async (profile) => {
+	const path = cliLockPath(profile);
+	for (let attempt = 0; attempt < 40; attempt += 1) try {
+		const handle = await open(path, "wx", 384);
+		return async () => {
+			await handle.close();
+			await unlink(path).catch(() => void 0);
+		};
+	} catch (error) {
+		if (error.code !== "EEXIST") throw error;
+		await new Promise((resolve) => setTimeout(resolve, 100));
+	}
+	throw new Error("Timed out waiting for another Namera command to refresh credentials.");
+};
+const getValidAccessToken = async (profile, baseUrl) => {
+	const release = await acquireRefreshLock(profile);
+	try {
+		const credentials = readCredentials(profile);
+		if (credentials === void 0) throw new Error(`Profile "${profile}" is not logged in.`);
+		if (credentials.expiresAt > Date.now() + 3e4) return credentials.accessToken;
+		if (credentials.refreshToken === null) throw new Error("The CLI session expired. Run namera login.");
+		const token = await postForm(`${baseUrl}/oauth/token`, new URLSearchParams({
+			grant_type: "refresh_token",
+			refresh_token: credentials.refreshToken,
+			client_id: clientId,
+			resource: new URL(baseUrl).origin
+		}));
+		const refreshed = toCredentials(token);
+		writeCredentials(profile, refreshed);
+		return refreshed.accessToken;
+	} finally {
+		await release();
+	}
+};
+
+//#endregion
+//#region src/services/session-keystore/resolver.ts
+const makeSessionSignerResolver = (store, apiOrigin, maxGasCostWei) => async (request) => {
+	const material = await store.readKey(apiOrigin, request.sessionKeyId);
+	const binding = material.bindings.find((installation) => installation.chainId === request.chainId && installation.walletId === request.walletId);
+	if (binding === void 0) throw new Error("No local installation for the selected wallet and chain.");
+	const account = privateKeyToAccount(Redacted.value(material.privateKey));
+	return {
+		binding,
+		...maxGasCostWei === void 0 ? {} : { maxGasCostWei },
+		signMessage: (message) => account.signMessage({ message }),
+		signTypedData: (typedData) => account.signTypedData(typedData)
+	};
+};
+
+//#endregion
+//#region src/services/session-keystore/storage.ts
+const StoredSession = Schema.Struct({
+	version: Schema.Literal(1),
+	keyringId: Schema.String.check(Schema.isPattern(/^[0-9a-f-]{36}$/)),
+	encrypted: EncryptedLocalSessionKey
+});
+var SessionKeystoreError = class extends Schema.TaggedError()("SessionKeystoreError", { code: Schema.Literals([
+	"IMPORT_FAILED",
+	"ORIGIN_MISMATCH",
+	"READ_FAILED",
+	"UNLOCK_UNAVAILABLE"
+]) }) {};
+const createSessionKeystore = (directory, keyring) => {
+	const pathFor = (apiOrigin, sessionKeyId) => {
+		const id = Schema.decodeUnknownSync(SessionKeyId)(sessionKeyId);
+		const host = createHash("sha256").update(apiOrigin).digest("hex");
+		return join(directory, `${host}-${id}.json`);
+	};
+	const importKey = async (input, password, apiOrigin) => {
+		const material = await openLocalSessionKey(input, password);
+		if (material.apiOrigin !== apiOrigin) throw new SessionKeystoreError({ code: "ORIGIN_MISMATCH" });
+		const binding = material.bindings[0];
+		if (binding === void 0) throw new SessionKeystoreError({ code: "IMPORT_FAILED" });
+		const keyringId = randomUUID();
+		const unlockSecret = randomBytes(32).toString("base64url");
+		const encrypted = await sealLocalSessionKey(material, Redacted.make(unlockSecret));
+		const temporaryPath = join(directory, `.${randomUUID()}.tmp`);
+		let savedSecret = false;
+		let temporaryCreated = false;
+		let installed = false;
+		let failed = false;
+		try {
+			await mkdir(directory, {
+				recursive: true,
+				mode: 448
+			});
+			const directoryStat = await lstat(directory);
+			if (!directoryStat.isDirectory() || directoryStat.isSymbolicLink()) throw new Error("Unsafe directory");
+			if (process.platform !== "win32") await chmod(directory, 448);
+			keyring.set(keyringId, unlockSecret);
+			savedSecret = true;
+			const handle = await open(temporaryPath, "wx", 384);
+			temporaryCreated = true;
+			try {
+				await handle.writeFile(JSON.stringify({
+					version: 1,
+					keyringId,
+					encrypted
+				}));
+				await handle.sync();
+			} finally {
+				await handle.close();
+			}
+			await link(temporaryPath, pathFor(apiOrigin, binding.sessionKeyId));
+			installed = true;
+		} catch {
+			failed = true;
+		}
+		try {
+			if (temporaryCreated) await unlink(temporaryPath);
+		} catch {
+			failed = true;
+		}
+		try {
+			if (!installed && savedSecret) keyring.delete(keyringId);
+		} catch {
+			failed = true;
+		}
+		if (failed) throw new SessionKeystoreError({ code: "IMPORT_FAILED" });
+		return {
+			sessionKeyId: binding.sessionKeyId,
+			walletId: binding.walletId,
+			chains: material.bindings.map((entry) => entry.chainId)
+		};
+	};
+	const readKey = async (apiOrigin, sessionKeyId) => {
+		let record;
+		try {
+			const handle = await open(pathFor(apiOrigin, sessionKeyId), constants.O_RDONLY | constants.O_NOFOLLOW);
+			try {
+				const stat = await handle.stat();
+				if (!stat.isFile() || stat.size > 131072 || process.platform !== "win32" && (stat.mode & 63) !== 0) throw new Error("Unsafe keystore file");
+				record = Schema.decodeUnknownSync(StoredSession)(JSON.parse(await handle.readFile("utf8")));
+			} finally {
+				await handle.close();
+			}
+		} catch {
+			throw new SessionKeystoreError({ code: "READ_FAILED" });
+		}
+		let password;
+		try {
+			password = keyring.get(record.keyringId);
+		} catch {
+			throw new SessionKeystoreError({ code: "UNLOCK_UNAVAILABLE" });
+		}
+		if (password === null) throw new SessionKeystoreError({ code: "UNLOCK_UNAVAILABLE" });
+		const material = await openLocalSessionKey(record.encrypted, Redacted.make(password));
+		if (material.apiOrigin !== apiOrigin || material.bindings.some((binding) => binding.sessionKeyId !== sessionKeyId)) throw new SessionKeystoreError({ code: "ORIGIN_MISMATCH" });
+		return material;
+	};
+	return {
+		importKey,
+		readKey
+	};
+};
+
+//#endregion
+//#region src/services/session-keystore/index.ts
+const entry = (id) => new Entry("namera-session-keystore", id);
+const sessionKeystore = createSessionKeystore(join(dirname(cliConfigPath), "session-keys"), {
+	get: (id) => entry(id).getPassword(),
+	set: (id, secret) => entry(id).setPassword(secret),
+	delete: (id) => entry(id).deletePassword()
+});
+const resolveCliSessionSigner = (apiOrigin, maxGasCostWei) => makeSessionSignerResolver(sessionKeystore, apiOrigin, maxGasCostWei);
+
+//#endregion
+//#region src/services/client.ts
+const makeCliClient = async (profile, maxGasCostWei) => {
+	const apiKey = process.env.NAMERA_API_KEY;
+	if (apiKey !== void 0) {
+		const baseUrl = process.env.NAMERA_API_URL ?? NAMERA_API_ORIGIN;
+		return {
+			config: {
+				activeProfile: "automation",
+				profiles: {}
+			},
+			profile: { baseUrl },
+			profileName: "automation",
+			client: new NameraClient({
+				apiKey,
+				baseUrl,
+				resolveSessionSigner: resolveCliSessionSigner(new URL(baseUrl).origin, maxGasCostWei)
+			})
+		};
+	}
+	const resolved = await getProfile(profile);
+	return {
+		...resolved,
+		client: new NameraClient({
+			baseUrl: resolved.profile.baseUrl,
+			getAccessToken: () => getValidAccessToken(resolved.profileName, resolved.profile.baseUrl),
+			resolveSessionSigner: resolveCliSessionSigner(new URL(resolved.profile.baseUrl).origin, maxGasCostWei)
+		})
+	};
+};
+
+//#endregion
+//#region src/commands/root.ts
+const outputFlag = Flag.choice("output", [
+	"pretty",
+	"json",
+	"ndjson"
+]).pipe(Flag.withAlias("o"), Flag.withDescription("Output format"), Flag.withDefault("pretty"));
+const quietFlag = Flag.boolean("quiet").pipe(Flag.withAlias("q"), Flag.withDescription("Suppress command output"));
+const nameraCommand = Command.make("namera").pipe(Command.withSharedFlags({
+	output: outputFlag,
+	quiet: quietFlag
+}), Command.withDescription("Manage Namera wallets through delegated session-key grants"));
+
+//#endregion
+//#region src/services/output.ts
+const replacer = (_, item) => typeof item === "bigint" ? item.toString() : item;
+const color = (code, value, enabled) => enabled ? `\u001B[${code}m${value}\u001B[0m` : value;
+const prettyScalar = (value, colors) => {
+	if (value === null) return color(90, "null", colors);
+	if (value === void 0) return color(90, "undefined", colors);
+	if (Predicate.isString(value)) return color(32, value, colors);
+	if (Predicate.isNumber(value) || Predicate.isBigInt(value)) return color(33, String(value), colors);
+	if (Predicate.isBoolean(value)) return color(35, String(value), colors);
+	if (Predicate.isDate(value)) return color(32, value.toISOString(), colors);
+	if (DateTime.isDateTime(value)) return color(32, DateTime.formatIso(value), colors);
+	return color(32, String(value), colors);
+};
+const prettyValue = (value, colors, depth = 0) => {
+	const indentation = "  ".repeat(depth);
+	if (Array.isArray(value)) {
+		if (value.length === 0) return `${indentation}${color(90, "(none)", colors)}`;
+		return value.map((item, index) => `${indentation}${color(1, `${index + 1}.`, colors)}\n${prettyValue(item, colors, depth + 1)}`).join("\n");
+	}
+	if (Predicate.isObject(value) && !Predicate.isDate(value) && !DateTime.isDateTime(value)) {
+		const entries = Object.entries(value);
+		if (entries.length === 0) return `${indentation}${color(90, "(empty)", colors)}`;
+		return entries.map(([key, item]) => {
+			const label = `${indentation}${color(36, key, colors)}:`;
+			return Array.isArray(item) || Predicate.isObject(item) ? `${label}\n${prettyValue(item, colors, depth + 1)}` : `${label} ${prettyScalar(item, colors)}`;
+		}).join("\n");
+	}
+	return `${indentation}${prettyScalar(value, colors)}`;
+};
+const formatValue = (value, output, options = {}) => {
+	if (output === "pretty") return [options.pretty ? options.pretty(value, options.colors ?? false) : prettyValue(value, options.colors ?? false)];
+	if (output === "json") return [JSON.stringify(value, replacer)];
+	if (Array.isArray(value)) return value.map((item) => JSON.stringify(item, replacer));
+	return [JSON.stringify(value, replacer)];
+};
+const printValue = Effect.fn("cli.output.printValue")(function* (value, pretty) {
+	const { output, quiet } = yield* nameraCommand;
+	if (quiet) return;
+	const colors = output === "pretty" && process.stdout.isTTY && process.env.NO_COLOR === void 0;
+	for (const line of formatValue(value, output, {
+		colors,
+		...pretty ? { pretty } : {}
+	})) yield* Console.log(line);
+});
+const printLine = Effect.fn("cli.output.printLine")(function* (value) {
+	const { quiet } = yield* nameraCommand;
+	if (!quiet) yield* Console.log(value);
+});
+const unwrapResult = (result) => result.success ? Effect.succeed(result.data) : Effect.fail(new Error(result.error.kind === "api" ? result.error.code === void 0 ? result.error.message : `${result.error.code}: ${result.error.message}` : result.error.message));
+const runPromise = (promise) => Effect.tryPromise(() => promise).pipe(Effect.flatMap(unwrapResult));
+
+//#endregion
+//#region src/services/output/document.ts
+const networks = [
+	arbitrum,
+	arbitrumSepolia,
+	base,
+	baseSepolia,
+	mainnet,
+	optimism,
+	optimismSepolia,
+	sepolia
+];
+const network = (chainId) => {
+	const chain = networks.find((entry) => `eip155:${entry.id}` === chainId);
+	return chain ? `${chain.name} (${chainId})` : chainId;
+};
+const terminalText = (value) => stripVTControlCharacters(value).replace(/[\u0000-\u001f\u007f-\u009f\u202a-\u202e\u2066-\u2069]/g, " ");
+const heading = (value, colors) => colors ? `\u001b[1m${terminalText(value)}\u001b[0m` : terminalText(value);
+const humanize = (value) => {
+	const words = value.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/[-_]/g, " ");
+	return (words.charAt(0).toUpperCase() + words.slice(1)).replace(/\bId\b/g, "ID").replace(/\bApi\b/g, "API");
+};
+const date = (value) => `${DateTime.format(value, {
+	dateStyle: "medium",
+	timeStyle: "medium",
+	timeZone: "UTC",
+	locale: "en-GB"
+})} UTC`;
+const timestamp = (seconds) => date(DateTime.makeUnsafe(seconds * 1e3));
+const scalar = (value) => {
+	if (value === null || value === void 0) return "None";
+	if (DateTime.isDateTime(value)) return date(value);
+	if (Predicate.isDate(value)) return date(DateTime.makeUnsafe(value));
+	if (typeof value === "boolean") return value ? "Yes" : "No";
+	return terminalText(String(value));
+};
+const nested = (value) => Predicate.isObject(value) && !DateTime.isDateTime(value) && !Predicate.isDate(value);
+const fields = (entries, colors, indent = 2) => entries.filter(([, value]) => value !== void 0).map(([label, value]) => {
+	const prefix = " ".repeat(indent) + heading(label + ":", colors);
+	if (Array.isArray(value)) {
+		if (!value.length) return `${prefix} None`;
+		if (value.every((entry) => !nested(entry))) return `${prefix} ${value.map(scalar).join(", ")}`;
+		return `${prefix}\n${value.map((entry, index) => fields([[String(index + 1), entry]], colors, indent + 2)).join("\n")}`;
+	}
+	if (nested(value)) return `${prefix}\n${fields(Object.entries(value).map(([key, entry]) => [humanize(key), entry]), colors, indent + 2)}`;
+	return `${prefix} ${scalar(value)}`;
+}).join("\n");
+const section = (title, entries, colors) => `${heading(title, colors)}\n${fields(entries, colors)}`;
+const collection = (values, singular, plural, render, colors) => values.length === 0 ? `No ${plural} found.` : `${heading(`Found ${values.length} ${values.length === 1 ? singular : plural}:`, colors)}\n\n${values.map((value) => render(value, colors)).join("\n\n")}`;
+const named = (metadata) => metadata.logo?.type === "emoji" ? `${metadata.logo.value} ${metadata.name}` : metadata.name;
+const recordView = (title) => (value, colors) => section(title, Object.entries(value).map(([key, entry]) => [humanize(key), entry]), colors);
+
+//#endregion
+//#region src/services/output/auth.ts
+const authView = ({ profile, actor }, colors) => section("CLI authorization", [
+	["Profile", profile],
+	["Authenticated via", actor.type === "api-key" ? "API key" : actor.type.toUpperCase()],
+	["Organization ID", actor.type === "user" ? actor.data.organization.id : actor.data.organizationId],
+	..."authorization" in actor.data ? [
+		["Authorization ID", actor.data.authorization.id],
+		["Scopes", actor.data.authorization.scopes],
+		["Expires", actor.data.authorization.expiresAt]
+	] : [],
+	..."grants" in actor.data ? [["Granted session keys", actor.data.grants.map(({ sessionKey }) => ({
+		name: sessionKey.metadata.name,
+		sessionKeyId: sessionKey.id,
+		walletId: sessionKey.walletId,
+		status: humanize(sessionKey.status)
+	}))]] : []
+], colors);
+
+//#endregion
+//#region src/commands/auth/status.ts
+const authStatusCommand = Command.make("status", { profile: profileFlag }, Effect.fn(function* ({ profile }) {
+	const { client, profileName } = yield* Effect.tryPromise(() => makeCliClient(profile));
+	const actor = yield* runPromise(client.auth.currentActor());
+	yield* printValue({
+		profile: profileName,
+		actor
+	}, authView);
+})).pipe(Command.withDescription("Show the current delegated CLI actor"));
+
+//#endregion
+//#region package.json
+var version$1 = "1.0.0";
+
+//#endregion
+//#region src/version.ts
+const version = version$1;
+
+//#endregion
+//#region src/commands/auth/login.ts
+const openBrowser = (url) => {
+	const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
+	const args = process.platform === "win32" ? [
+		"/c",
+		"start",
+		"",
+		url
+	] : [url];
+	spawn(command, args, {
+		detached: true,
+		stdio: "ignore"
+	}).unref();
+};
+const waitForToken = async (baseUrl, deviceCode, expiresIn, initialInterval) => {
+	const deadline = Date.now() + expiresIn * 1e3;
+	let interval = initialInterval;
+	while (Date.now() < deadline) {
+		await new Promise((resolve) => setTimeout(resolve, interval * 1e3));
+		try {
+			return await pollDeviceToken(baseUrl, deviceCode);
+		} catch (error) {
+			if (!(error instanceof OAuthRequestError)) throw error;
+			if (error.code === "authorization_pending") continue;
+			if (error.code === "slow_down") {
+				interval += 5;
+				continue;
+			}
+			throw error;
+		}
+	}
+	throw new Error("The device authorization expired. Run namera login again.");
+};
+const loginCommand = Command.make("login", {
+	profile: profileFlag,
+	host: Flag.string("host").pipe(Flag.withDescription("Namera API origin"), Flag.withDefault(NAMERA_API_ORIGIN)),
+	deviceName: Flag.string("device-name").pipe(Flag.withDescription("Friendly name shown on the consent screen"), Flag.withDefault(`Namera CLI on ${platform()}`))
+}, Effect.fn(function* ({ profile, host, deviceName }) {
+	const baseUrl = new URL(host).origin;
+	const request = yield* Effect.tryPromise(() => startDeviceAuthorization(baseUrl, {
+		deviceName,
+		cliVersion: version,
+		platform: platform()
+	}));
+	yield* printLine(`Open ${request.verification_uri}`);
+	yield* printLine(`Confirm code: ${request.user_code}`);
+	yield* Effect.sync(() => openBrowser(request.verification_uri_complete));
+	const credentials = yield* Effect.tryPromise(() => waitForToken(baseUrl, request.device_code, request.expires_in, request.interval));
+	writeCredentials(profile, credentials);
+	const actor = yield* runPromise(new NameraClient({
+		accessToken: credentials.accessToken,
+		baseUrl
+	}).auth.currentActor());
+	if (actor.type !== "cli") return yield* Effect.fail(/* @__PURE__ */ new Error("Expected a CLI actor token."));
+	yield* Effect.tryPromise(() => saveProfile(profile, {
+		baseUrl,
+		authorizationId: actor.data.authorization.id,
+		organizationId: actor.data.organizationId
+	}));
+	yield* printLine(`Logged in as profile "${profile}".`);
+})).pipe(Command.withDescription("Authorize this CLI using the browser device flow"));
+
+//#endregion
+//#region src/commands/auth/logout.ts
+const logoutCommand = Command.make("logout", { profile: profileFlag }, Effect.fn(function* ({ profile }) {
+	yield* Effect.sync(() => deleteCredentials(profile));
+	yield* Effect.tryPromise(() => removeProfile(profile));
+	yield* printLine(`Logged out profile "${profile}".`);
+})).pipe(Command.withDescription("Remove a CLI profile and its stored credentials"));
+
+//#endregion
+//#region src/commands/auth/index.ts
+const authCommand = Command.make("auth").pipe(Command.withDescription("Inspect CLI authentication"), Command.withSubcommands([authStatusCommand]));
+
+//#endregion
+//#region src/services/output/execution.ts
+const executionStatusView = (result, colors) => [section(`Execution ${humanize(result.status).toLowerCase()}`, [
+	["Status", humanize(result.status)],
+	["Submission ID", result.submissionId],
+	["User operation", "userOperationHash" in result ? result.userOperationHash ?? void 0 : void 0],
+	...result.status === "confirmed" && "execution" in result ? [
+		["Execution ID", result.execution.id],
+		["Network", network(result.execution.data.chainId)],
+		["Transaction", result.execution.data.transactionHash],
+		["Created", result.execution.createdAt]
+	] : []
+], colors), ...[
+	"reserved",
+	"prepared",
+	"submitted"
+].includes(result.status) ? [`Not confirmed yet. Check again with:\n  namera execution status ${result.submissionId}`] : []].join("\n\n");
+const executionsView = (result, colors) => [collection(result.items, "confirmed execution", "confirmed executions", (item, useColors) => section(item.wallet.metadata.name, [
+	["Execution ID", item.details.id],
+	["Network", network(item.details.chainId)],
+	["Transaction", item.details.transactionHash],
+	["Session key", item.sessionKey.metadata.name],
+	["Created", item.details.createdAt]
+], useColors), colors), ...result.nextCursor ? [`Next page:\n  namera execution list --cursor ${result.nextCursor}`] : []].join("\n\n");
+const simulationView = (result, colors) => [
+	section("Execution simulation", [
+		["Policy decision", result.allowed ? "Allowed" : "Denied"],
+		["Calls", result.callsSucceeded ? "Succeeded" : "Failed"],
+		["Wallet ID", result.walletId],
+		["Account", result.account],
+		["Network", network(result.chainId)],
+		["Session key ID", result.allowed ? result.sessionKeyId : void 0],
+		["Denials", result.allowed ? void 0 : result.denials]
+	], colors),
+	section("Simulation details", [["Gas estimate", result.simulation.userOperation], ["Calls", result.simulation.calls]], colors),
+	"Simulation only. No transaction was submitted."
+].join("\n\n");
+const signatureView = (result, colors) => section("Signature created", [
+	["Type", result.type === "typed-data" ? "Typed data (EIP-712)" : "Message"],
+	["Account", result.account],
+	["Wallet ID", result.walletId],
+	["Network", network(result.chainId)],
+	["Signature", result.signature]
+], colors);
+const verificationView = (result, colors) => section(result.valid ? "Signature valid" : "Signature invalid", [
+	["Valid", result.valid],
+	["Account", result.account],
+	["Wallet ID", result.walletId],
+	["Network", network(result.chainId)],
+	["Type", humanize(result.type)]
+], colors);
+
+//#endregion
+//#region src/services/prompts.ts
+const schemaText = (message, schema, defaultValue) => Prompt.text({
+	message,
+	...defaultValue === void 0 ? {} : { default: defaultValue },
+	validate: (value) => Schema.decodeUnknownEffect(schema)(value).pipe(Effect.as(value), Effect.mapError((error) => error.message))
+});
+const makePrompts = () => ({
+	namespace: Prompt.run(Prompt.select({
+		message: "Namespace",
+		choices: [{
+			title: "EVM",
+			description: "Ethereum and EVM-compatible networks",
+			value: "eip155"
+		}]
+	})),
+	walletId: (message = "Wallet ID") => Prompt.run(schemaText(message, WalletId)).pipe(Effect.flatMap(Schema.decodeUnknownEffect(WalletId))),
+	chainId: (message = "Chain") => Prompt.run(schemaText(message, SupportedEvmChainId, "eip155:11155111")).pipe(Effect.flatMap(Schema.decodeUnknownEffect(SupportedEvmChainId))),
+	sessionKeyId: (message = "Session key ID") => Prompt.run(schemaText(message, SessionKeyId)).pipe(Effect.flatMap(Schema.decodeUnknownEffect(SessionKeyId))),
+	ethereumAddress: (message) => Prompt.run(schemaText(message, EthereumAddress)).pipe(Effect.flatMap(Schema.decodeUnknownEffect(EthereumAddress))),
+	ethereumValue: (message = "Native value (wei)") => Prompt.run(schemaText(message, Schema.BigIntFromString.check(Schema.isGreaterThanOrEqualToBigInt(0n)), "0")).pipe(Effect.flatMap(Schema.decodeUnknownEffect(Schema.BigIntFromString))),
+	hex: (message, defaultValue = "0x") => Prompt.run(schemaText(message, Hex, defaultValue)).pipe(Effect.flatMap(Schema.decodeUnknownEffect(Hex))),
+	integer: (message, options) => Prompt.run(Prompt.integer({
+		message,
+		...options
+	})),
+	confirm: (message, initial = false) => Prompt.run(Prompt.confirm({
+		message,
+		initial
+	})),
+	signatureType: Prompt.run(Prompt.select({
+		message: "Signature type",
+		choices: [{
+			title: "Message",
+			description: "Sign or verify a UTF-8 message",
+			value: "message"
+		}, {
+			title: "Typed data",
+			description: "Sign or verify an EIP-712 typed-data object",
+			value: "typed-data"
+		}]
+	})),
+	message: (message = "Message") => Prompt.run(Prompt.text({ message })),
+	typedData: Prompt.run(Prompt.text({
+		message: "EIP-712 typed data (JSON)",
+		validate: (value) => Schema.decodeUnknownEffect(Schema.fromJsonString(EvmTypedData))(value).pipe(Effect.as(value), Effect.mapError((error) => error.message))
+	})).pipe(Effect.flatMap(Schema.decodeUnknownEffect(Schema.fromJsonString(EvmTypedData)))),
+	date: (message) => Prompt.run(Prompt.date({ message }))
+});
+var CliPrompts = class CliPrompts extends Context.Service()("@namera-ai/cli/CliPrompts") {
+	static layer = Layer.succeed(CliPrompts, CliPrompts.of(makePrompts()));
+};
+
+//#endregion
+//#region src/commands/execution/index.ts
+const promptTransactionRequest = Effect.fn("cli.execution.promptTransactionRequest")(function* () {
+	const prompts = yield* CliPrompts;
+	const namespace = yield* prompts.namespace;
+	const walletId = yield* prompts.walletId();
+	const sessionKeyId = yield* prompts.sessionKeyId();
+	const chainId = yield* prompts.chainId();
+	const callCount = yield* prompts.integer("Number of calls", {
+		min: 1,
+		default: 1
+	});
+	return {
+		namespace,
+		walletId,
+		sessionKeyId,
+		chainId,
+		calls: yield* Effect.forEach(Array.from({ length: callCount }, (_, index) => index), (index) => Effect.gen(function* () {
+			const number = callCount === 1 ? "" : ` ${index + 1}`;
+			return {
+				to: yield* prompts.ethereumAddress(`Recipient${number}`),
+				value: yield* prompts.ethereumValue(`Native value${number} (wei)`),
+				data: yield* prompts.hex(`Calldata${number}`)
+			};
+		}))
+	};
+});
+const promptExecutionRequest = Effect.fn("cli.execution.promptExecutionRequest")(function* () {
+	const prompts = yield* CliPrompts;
+	const request = yield* promptTransactionRequest();
+	const sponsor = yield* prompts.confirm("Sponsor gas with Namera?", true);
+	return {
+		...request,
+		sponsor
+	};
+});
+const execute = Command.make("execute", {
+	params: paramsFlag,
+	profile: profileFlag,
+	maxGasCost: Flag.string("max-gas-cost-wei").pipe(Flag.withDescription("Local fee ceiling for self-funded operations, in wei"), Flag.optional)
+}, Effect.fn(function* ({ params, profile, maxGasCost }) {
+	const request = yield* resolveParams(params, ExecuteRequest, promptExecutionRequest());
+	let maxGasCostWei;
+	if (Option.isSome(maxGasCost)) maxGasCostWei = yield* Schema.decodeUnknownEffect(Schema.BigIntFromString.check(Schema.isGreaterThanOrEqualToBigInt(0n)))(maxGasCost.value);
+	else if (request.sponsor === false && Option.isNone(params)) maxGasCostWei = yield* (yield* CliPrompts).ethereumValue("Maximum total gas cost (wei)");
+	const { client } = yield* Effect.tryPromise(() => makeCliClient(profile, maxGasCostWei));
+	yield* printValue(yield* runPromise(client.executions.execute(request)), executionStatusView);
+})).pipe(Command.withDescription("Execute EVM calls after validating an inline or prompted request"));
+const simulate = Command.make("simulate", {
+	params: paramsFlag,
+	profile: profileFlag
+}, Effect.fn(function* ({ params, profile }) {
+	const request = yield* resolveParams(params, SimulateExecutionRequest, promptTransactionRequest());
+	const { client } = yield* Effect.tryPromise(() => makeCliClient(profile));
+	yield* printValue(yield* runPromise(client.executions.simulate(request)), simulationView);
+})).pipe(Command.withDescription("Simulate calls and evaluate session-key policies without signing or submitting"));
+const status$1 = Command.make("status", {
+	submissionId: Argument.string("submission-id"),
+	profile: profileFlag
+}, Effect.fn(function* ({ submissionId, profile }) {
+	const id = yield* Schema.decodeUnknownEffect(ExecutionSubmissionId)(submissionId);
+	const { client } = yield* Effect.tryPromise(() => makeCliClient(profile));
+	yield* printValue(yield* runPromise(client.executions.getStatus(id)), executionStatusView);
+}));
+const list$2 = Command.make("list", {
+	cursor: Flag.string("cursor").pipe(Flag.optional),
+	profile: profileFlag
+}, Effect.fn(function* ({ cursor, profile }) {
+	const decodedCursor = Option.isSome(cursor) ? yield* Schema.decodeUnknownEffect(ExecutionId)(cursor.value) : void 0;
+	const { client } = yield* Effect.tryPromise(() => makeCliClient(profile));
+	yield* printValue(yield* runPromise(client.executions.list(decodedCursor === void 0 ? {} : { cursor: decodedCursor })), executionsView);
+}));
+const executionCommand = Command.make("execution").pipe(Command.withDescription("Execute and inspect onchain operations"), Command.withSubcommands([
+	execute,
+	simulate,
+	status$1,
+	list$2
+]));
+
+//#endregion
+//#region src/services/mcp/oauth-contracts.ts
+var LocalOAuthError = class extends Schema.TaggedError()("LocalOAuthError", { code: Schema.Literals([
+	"invalid_grant",
+	"invalid_token",
+	"temporarily_unavailable"
+]) }) {};
+var McpOAuthUpstream = class extends Context.Service()("@namera-ai/cli/McpOAuthUpstream") {};
+
+//#endregion
+//#region src/services/mcp/api-client.ts
+var McpAuthentication = class extends Context.Service()("@namera-ai/cli/McpAuthentication") {};
+const makeMcpApiClient = Effect.fn("LocalMcpApi.authenticate")(function* (config, authorization) {
+	const resolveSigner = config.resolveSessionSigner;
+	const client = new NameraClient({
+		baseUrl: config.apiOrigin,
+		accessToken: Redacted.value(authorization.accessToken),
+		fetch: (input, init) => {
+			const timeout = AbortSignal.timeout(3e4);
+			return (config.fetch ?? globalThis.fetch)(input, {
+				...init,
+				redirect: "error",
+				signal: init?.signal ? AbortSignal.any([init.signal, timeout]) : timeout
+			});
+		},
+		...resolveSigner === void 0 ? {} : { resolveSessionSigner: async (request) => {
+			if (!actor.data.grants.some(({ sessionKey }) => sessionKey.id === request.sessionKeyId && sessionKey.walletId === request.walletId && sessionKey.namespace === request.namespace && sessionKey.status === "active")) throw new Error("The selected session is not authorized.");
+			return resolveSigner(request);
+		} }
+	});
+	const result = yield* Effect.tryPromise({
+		try: () => client.auth.currentActor(),
+		catch: () => new LocalOAuthError({ code: "temporarily_unavailable" })
+	});
+	if (!result.success) return yield* new LocalOAuthError({ code: result.error.status === 401 || result.error.status === 403 || result.error.kind === "api" && (result.error.tag === "Unauthorized" || result.error.tag === "Forbidden") ? "invalid_token" : "temporarily_unavailable" });
+	if (result.data.type !== "mcp") return yield* new LocalOAuthError({ code: "invalid_token" });
+	const actor = result.data;
+	const scopes = authorization.scopes.filter((scope) => actor.data.authorization.scopes.some((allowed) => allowed === scope));
+	if (!scopes.includes("mcp:read")) return yield* new LocalOAuthError({ code: "invalid_token" });
+	return {
+		client,
+		actor,
+		scopes
+	};
+});
+
+//#endregion
+//#region src/services/mcp/credential-store.ts
+const McpProfile = Schema.String.check(Schema.isPattern(/^[a-zA-Z0-9_-]{1,64}$/));
+const McpCredential = Schema.Struct({
+	version: Schema.Literal(1),
+	generation: Schema.String,
+	phase: Schema.Literals([
+		"ready",
+		"refreshing",
+		"authorizing",
+		"signed-out"
+	]),
+	clientId: Schema.String,
+	accessToken: Schema.String,
+	refreshToken: Schema.NullOr(Schema.String),
+	expiresAt: Schema.Number,
+	scopes: Schema.Array(Schema.Literals([
+		"mcp:read",
+		"mcp:execute",
+		"offline_access"
+	]))
+});
+const withCredentialLock = async (path, run) => {
+	await mkdir(dirname(path), {
+		recursive: true,
+		mode: 448
+	});
+	const database = new DatabaseSync(path);
+	try {
+		if (process.platform !== "win32") await chmod(path, 384);
+		database.exec("PRAGMA busy_timeout = 0");
+		for (let attempt = 0; attempt < 200; attempt += 1) {
+			try {
+				database.exec("BEGIN IMMEDIATE");
+			} catch (error) {
+				if (error.errcode !== 5) throw error;
+				await new Promise((resolve) => setTimeout(resolve, 100));
+				continue;
+			}
+			try {
+				return await run();
+			} finally {
+				database.exec("ROLLBACK");
+			}
+		}
+		throw new Error("Another Namera process is updating MCP credentials. Try again.");
+	} finally {
+		database.close();
+	}
+};
+const mcpCredentialStore = (apiOrigin, profile) => {
+	Schema.decodeUnknownSync(McpProfile)(profile);
+	const key = createHash("sha256").update(`${apiOrigin}\n${profile}`).digest("hex");
+	const entry = () => new Entry("namera-mcp", key);
+	return {
+		read: () => {
+			try {
+				const raw = entry().getPassword();
+				return raw === null ? void 0 : Schema.decodeUnknownSync(Schema.fromJsonString(McpCredential))(raw);
+			} catch {
+				throw new Error("MCP credentials could not be read from the OS keyring.");
+			}
+		},
+		write: (credentials) => {
+			try {
+				entry().setPassword(JSON.stringify(credentials));
+			} catch {
+				throw new Error("MCP credentials could not be saved to the OS keyring.");
+			}
+		},
+		lock: (run) => withCredentialLock(join(dirname(cliConfigPath), "mcp", `${key}.lock.sqlite`), run)
+	};
+};
+
+//#endregion
+//#region src/services/mcp/callback.ts
+const openAuthorizationBrowser = (url) => new Promise((resolve, reject) => {
+	const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "rundll32" : "xdg-open";
+	const args = process.platform === "win32" ? ["url.dll,FileProtocolHandler", url] : [url];
+	const child = spawn(command, args, {
+		stdio: "ignore",
+		timeout: 1e4
+	});
+	child.once("error", () => reject(/* @__PURE__ */ new Error("Open the authorization URL in your browser.")));
+	child.once("exit", (code) => {
+		if (code === 0) resolve();
+		else reject(/* @__PURE__ */ new Error("Open the authorization URL in your browser."));
+	});
+});
+const listenForAuthorization = async (state, signal) => {
+	let accept;
+	let deny;
+	let consumed = false;
+	const code = new Promise((resolve, reject) => {
+		accept = resolve;
+		deny = reject;
+	});
+	code.catch(() => void 0);
+	let authority = "";
+	const server = createServer({
+		headersTimeout: 1e4,
+		requestTimeout: 1e4
+	}, (request, response) => {
+		response.setHeader("Cache-Control", "no-store");
+		response.setHeader("Content-Type", "text/plain; charset=utf-8");
+		response.setHeader("Referrer-Policy", "no-referrer");
+		response.setHeader("Content-Security-Policy", "default-src 'none'; frame-ancestors 'none'");
+		const url = URL.parse(request.url ?? "/", `http://${authority}`);
+		if (!url) {
+			response.writeHead(400).end("Invalid authorization callback.");
+			return;
+		}
+		const received = url.searchParams.get("state") ?? "";
+		const params = [...url.searchParams.keys()];
+		const receivedBytes = Buffer.from(received);
+		const expectedBytes = Buffer.from(state);
+		const validState = receivedBytes.length === expectedBytes.length && timingSafeEqual(receivedBytes, expectedBytes);
+		if (request.method !== "GET" || request.headers.host !== authority || url.origin !== `http://${authority}` || request.headers.origin !== void 0 || (request.url?.length ?? 0) > 8192 || url.pathname !== "/oauth/callback" || consumed || params.length !== new Set(params).size || !validState || url.searchParams.has("code") === url.searchParams.has("error")) {
+			response.writeHead(400).end("Invalid authorization callback.");
+			return;
+		}
+		consumed = true;
+		const value = url.searchParams.get("code");
+		if (!value || value.length > 2048) {
+			deny(/* @__PURE__ */ new Error("Authorization was denied. Run namera mcp login to try again."));
+			response.writeHead(400).end("Authorization was not completed. Return to Namera.");
+		} else {
+			accept(value);
+			response.end("Authorization received. You can close this tab and return to your agent.");
+		}
+	});
+	await new Promise((resolve, reject) => {
+		server.once("error", reject);
+		server.listen(0, "127.0.0.1", resolve);
+	});
+	const address = server.address();
+	if (!address || typeof address === "string") throw new Error("Could not open OAuth callback.");
+	authority = `127.0.0.1:${address.port}`;
+	const abort = () => {
+		deny(/* @__PURE__ */ new Error("Authorization cancelled."));
+		server.closeAllConnections();
+		server.close();
+	};
+	signal.addEventListener("abort", abort, { once: true });
+	if (signal.aborted) abort();
+	return {
+		callback: `http://${authority}/oauth/callback`,
+		code,
+		close: () => {
+			signal.removeEventListener("abort", abort);
+			server.closeAllConnections();
+			server.close();
+		}
+	};
+};
+
+//#endregion
+//#region src/services/mcp/oauth-upstream.ts
+const mcpOAuthUpstreamLayer = (config) => Layer.effect(McpOAuthUpstream, Effect.gen(function* () {
+	const client = yield* HttpClient.HttpClient;
+	const requestJson = Effect.fn("McpOAuthUpstream.request")(function* (request) {
+		const response = yield* client.execute(request).pipe(Effect.mapError(() => new LocalOAuthError({ code: "temporarily_unavailable" })));
+		if (response.status < 200 || response.status >= 300) return yield* new LocalOAuthError({ code: response.status >= 500 || response.status === 429 ? "temporarily_unavailable" : "invalid_grant" });
+		return yield* response.json.pipe(Effect.mapError(() => new LocalOAuthError({ code: "temporarily_unavailable" })));
+	}, Effect.provideService(FetchHttpClient.RequestInit, { redirect: "error" }), Effect.provideService(HttpIncomingMessage.MaxBodySize, FileSystem.KiB(32)), Effect.timeout("15 seconds"), Effect.catchTag("TimeoutError", () => Effect.fail(new LocalOAuthError({ code: "temporarily_unavailable" }))), Effect.scoped);
+	const tokenRequest = Effect.fn("McpOAuthUpstream.token")(function* (body) {
+		const json = yield* requestJson(HttpClientRequest.post(`${config.apiOrigin}/oauth/token`).pipe(HttpClientRequest.bodyUrlParams({
+			...body,
+			resource: config.apiOrigin
+		})));
+		const token = yield* Schema.decodeUnknownEffect(OAuthTokenResponse)(json).pipe(Effect.mapError(() => new LocalOAuthError({ code: "temporarily_unavailable" })));
+		const now = yield* Clock.currentTimeMillis;
+		return {
+			accessToken: Redacted.make(token.access_token),
+			...token.refresh_token === void 0 ? {} : { refreshToken: Redacted.make(token.refresh_token) },
+			expiresAt: now + token.expires_in * 1e3,
+			scopes: token.scope.split(/\s+/).filter(Boolean)
+		};
+	});
+	return McpOAuthUpstream.of({
+		register: Effect.fn("McpOAuthUpstream.register")(function* (name) {
+			const json = yield* requestJson(HttpClientRequest.post(`${config.apiOrigin}/oauth/register`).pipe(HttpClientRequest.bodyJsonUnsafe({
+				client_name: `Namera local MCP: ${name}`.slice(0, 128),
+				redirect_uris: [config.callback],
+				token_endpoint_auth_method: "none",
+				grant_types: ["authorization_code", "refresh_token"],
+				response_types: ["code"],
+				application_type: "native"
+			})));
+			const registered = yield* Schema.decodeUnknownEffect(OAuthDynamicClientRegistrationResponse)(json).pipe(Effect.mapError(() => new LocalOAuthError({ code: "temporarily_unavailable" })));
+			if (registered.redirect_uris.length !== 1 || registered.redirect_uris[0] !== config.callback || registered.token_endpoint_auth_method !== "none") return yield* new LocalOAuthError({ code: "temporarily_unavailable" });
+			return registered.client_id;
+		}),
+		exchange: ({ clientId, code, verifier }) => tokenRequest({
+			grant_type: "authorization_code",
+			client_id: clientId,
+			redirect_uri: config.callback,
+			code,
+			code_verifier: Redacted.value(verifier)
+		}),
+		refresh: ({ clientId, refreshToken, scopes }) => tokenRequest({
+			grant_type: "refresh_token",
+			client_id: clientId,
+			refresh_token: Redacted.value(refreshToken),
+			scope: scopes.join(" ")
+		}),
+		revoke: Effect.fn("McpOAuthUpstream.revoke")(function* (clientId, token) {
+			const response = yield* client.execute(HttpClientRequest.post(`${config.apiOrigin}/oauth/revoke`).pipe(HttpClientRequest.bodyUrlParams({
+				client_id: clientId,
+				token: Redacted.value(token)
+			}))).pipe(Effect.mapError(() => new LocalOAuthError({ code: "temporarily_unavailable" })));
+			if (response.status < 200 || response.status >= 300) return yield* new LocalOAuthError({ code: "temporarily_unavailable" });
+		}, Effect.provideService(FetchHttpClient.RequestInit, { redirect: "error" }), Effect.timeout("15 seconds"), Effect.catchTag("TimeoutError", () => Effect.fail(new LocalOAuthError({ code: "temporarily_unavailable" }))), Effect.scoped)
+	});
+}));
+
+//#endregion
+//#region src/services/mcp/session.ts
+const mcpOAuthProvider = (apiOrigin, callback) => {
+	const layer = mcpOAuthUpstreamLayer({
+		apiOrigin,
+		callback
+	}).pipe(Layer.provide(FetchHttpClient.layer));
+	const run = (call) => Effect.runPromise(Effect.flatMap(McpOAuthUpstream, call).pipe(Effect.provide(layer)));
+	return {
+		register: (name) => run((provider) => provider.register(name)),
+		exchange: (clientId, code, verifier) => run((provider) => provider.exchange({
+			clientId,
+			code,
+			verifier: Redacted.make(verifier)
+		})),
+		refresh: (saved) => run((provider) => provider.refresh({
+			clientId: saved.clientId,
+			refreshToken: Redacted.make(saved.refreshToken ?? ""),
+			scopes: saved.scopes
+		})),
+		revoke: (saved) => run((provider) => provider.revoke(saved.clientId, Redacted.make(saved.refreshToken ?? saved.accessToken)))
+	};
+};
+const scopeSchema = Schema.Array(Schema.Literals([
+	"mcp:read",
+	"mcp:execute",
+	"offline_access"
+]));
+const ready = (generation, clientId, token) => {
+	const scopes = Schema.decodeUnknownSync(scopeSchema)(token.scopes);
+	if (!scopes.includes("mcp:read")) throw new Error("MCP read permission was not granted.");
+	return {
+		version: 1,
+		generation,
+		phase: "ready",
+		clientId,
+		accessToken: Redacted.value(token.accessToken),
+		refreshToken: token.refreshToken ? Redacted.value(token.refreshToken) : null,
+		expiresAt: token.expiresAt,
+		scopes
+	};
+};
+const signedOut = () => ({
+	version: 1,
+	generation: randomUUID(),
+	phase: "signed-out",
+	clientId: "",
+	accessToken: "",
+	refreshToken: null,
+	expiresAt: 0,
+	scopes: []
+});
+const createMcpSession = (config) => {
+	const { store } = config;
+	const provider = config.provider ?? ((callback) => mcpOAuthProvider(config.apiOrigin, callback));
+	const now = config.now ?? Date.now;
+	const notify = config.notify ?? ((message) => process.stderr.write(`${message}\n`));
+	let attempted = false;
+	let pending;
+	const lifetime = new AbortController();
+	const login = async () => {
+		const signal = AbortSignal.any([lifetime.signal, AbortSignal.timeout(3e5)]);
+		const state = randomBytes(32).toString("base64url");
+		const verifier = randomBytes(32).toString("base64url");
+		const generation = randomUUID();
+		await store.lock(async () => {
+			const previous = store.read();
+			if (previous?.accessToken) await provider("").revoke(previous);
+			store.write({
+				...signedOut(),
+				generation,
+				phase: "authorizing"
+			});
+		});
+		const callback = await listenForAuthorization(state, signal);
+		try {
+			const oauth = provider(callback.callback);
+			const clientId = await oauth.register(config.profile);
+			const url = new URL("/oauth/authorize", config.apiOrigin);
+			url.search = new URLSearchParams({
+				client_id: clientId,
+				redirect_uri: callback.callback,
+				resource: config.apiOrigin,
+				response_type: "code",
+				code_challenge_method: "S256",
+				code_challenge: createHash("sha256").update(verifier).digest("base64url"),
+				scope: "mcp:read mcp:execute offline_access",
+				state
+			}).toString();
+			notify(`Authorize Namera (${config.profile}): ${url}`);
+			try {
+				await (config.openBrowser ?? openAuthorizationBrowser)(url.toString());
+			} catch {
+				notify("Could not open your browser. Open the URL above manually.");
+			}
+			const code = await callback.code;
+			signal.throwIfAborted();
+			const token = await oauth.exchange(clientId, code, verifier);
+			const saved = ready(generation, clientId, token);
+			try {
+				await store.lock(async () => {
+					if (signal.aborted || store.read()?.generation !== generation) throw new Error("Authorization was cancelled or replaced.");
+					store.write(saved);
+				});
+			} catch (error) {
+				await oauth.revoke(saved);
+				throw error;
+			}
+			notify(`Namera MCP profile "${config.profile}" is connected.`);
+		} finally {
+			callback.close();
+		}
+	};
+	const startLogin = () => {
+		if (!pending) {
+			attempted = true;
+			pending = login().finally(() => {
+				pending = void 0;
+			});
+		}
+		return pending;
+	};
+	const credentials = () => store.lock(async () => {
+		const saved = store.read();
+		if (saved?.phase !== "ready") return void 0;
+		if (saved.expiresAt > now() + 3e4) return saved;
+		if (!saved.refreshToken) return void 0;
+		store.write({
+			...saved,
+			phase: "refreshing"
+		});
+		const token = await provider("").refresh(saved);
+		if (token.scopes.some((scope) => !saved.scopes.includes(scope))) throw new Error("Refreshed MCP permissions expanded unexpectedly.");
+		const refreshed = ready(saved.generation, saved.clientId, token);
+		store.write(refreshed);
+		return refreshed;
+	});
+	return {
+		login: startLogin,
+		credentials,
+		requestLogin: () => {
+			if (!attempted) startLogin().catch(() => notify(`MCP login did not finish. Run namera mcp login --profile ${config.profile} --host ${config.apiOrigin}`));
+		},
+		status: () => {
+			const saved = store.read();
+			return {
+				profile: config.profile,
+				apiOrigin: config.apiOrigin,
+				status: saved?.phase === "ready" ? saved.expiresAt > now() ? "connected" : saved.refreshToken ? "refresh-required" : "login-required" : "login-required",
+				scopes: saved?.phase === "ready" ? saved.scopes : []
+			};
+		},
+		logout: () => store.lock(async () => {
+			const saved = store.read();
+			store.write(signedOut());
+			if (saved?.accessToken) await provider("").revoke(saved);
+		}),
+		close: () => lifetime.abort()
+	};
+};
+
+//#endregion
+//#region src/services/mcp/tool-errors.ts
+const messages = {
+	NETWORK_PAUSED: "New operations on this network are paused. Do not retry until it is re-enabled.",
+	INVALID_ARGUMENT: "Invalid tool input. Use returned IDs and the documented field formats.",
+	UNAUTHORIZED: "The authorization expired or was revoked. Reconnect Namera.",
+	INSUFFICIENT_SCOPE: "Reauthorize Namera with permission to execute and sign.",
+	WALLET_NOT_FOUND: "Wallet not delegated or not found. Use a walletId from list_wallets.",
+	SESSION_KEY_NOT_FOUND: "Session not delegated or not found. Use list_session_keys.",
+	EXECUTION_SUBMISSION_NOT_FOUND: "Use the submissionId returned by execute_transaction.",
+	NO_AUTHORIZED_SESSION_KEY: "The selected session does not authorize this wallet operation.",
+	POLICY_DENIED: "The selected session's policy denied the operation. Inspect policyCode and simulate again.",
+	IDEMPOTENCY_CONFLICT: "The operation conflicts with an earlier request.",
+	EXECUTION_FAILED: "The execution failed. Inspect its status before submitting another operation.",
+	EXECUTION_UNAVAILABLE: "Execution is unavailable. Check submission status before retrying a transfer.",
+	SIGNING_FAILED: "The signature could not be created.",
+	SIGNATURE_UNAVAILABLE: "Signature creation is unavailable.",
+	VERIFICATION_FAILED: "Signature verification could not be completed on this chain.",
+	LIMIT_EXCEEDED: "The workspace has reached its plan limit.",
+	RATE_LIMITED: "Too many requests. Wait before retrying.",
+	INTERNAL_ERROR: "Namera could not complete the operation.",
+	UPSTREAM_UNAVAILABLE: "The API is unavailable. Check transaction status before repeating a transfer.",
+	LOCAL_SIGNER_REQUIRED: "Configure a local signer before executing or signing.",
+	LOCAL_SIGNER_UNAVAILABLE: "The authorized session's local key is unavailable. Import it with namera session-key import.",
+	PREPARED_EXECUTION_INVALID: "The preparation does not match local session authorization or fee consent. Do not sign it.",
+	PREPARED_SIGNATURE_INVALID: "The challenge does not match the original payload or local signature consent. Do not sign it.",
+	LOCAL_SIGNATURE_INVALID: "Local signature verification failed. Check the imported session key."
+};
+const localToolError = (code) => ({
+	code,
+	message: messages[code],
+	retryable: false
+});
+const unwrapMcpSdk = Effect.fn("LocalMcp.unwrapSdk")(function* (call) {
+	const result = yield* Effect.tryPromise({
+		try: call,
+		catch: () => localToolError("INTERNAL_ERROR")
+	});
+	if (result.success) return result.data;
+	const error = result.error;
+	const code = error.kind === "contract" ? "INVALID_ARGUMENT" : error.kind === "network" ? "UPSTREAM_UNAVAILABLE" : error.status === 401 || error.kind === "api" && error.tag === "Unauthorized" ? "UNAUTHORIZED" : error.status === 403 || error.kind === "api" && error.tag === "Forbidden" ? "INSUFFICIENT_SCOPE" : "code" in error && Schema.is(McpToolErrorCode)(error.code) ? error.code : error.status === 429 ? "RATE_LIMITED" : "INTERNAL_ERROR";
+	const cause = error.cause;
+	const base = localToolError(code);
+	const diagnostic = Predicate.isObject(cause) ? {
+		...base,
+		...Reflect.get(cause, "policyId") === void 0 ? {} : { policyId: Reflect.get(cause, "policyId") },
+		...Reflect.get(cause, "policyCode") === void 0 ? {} : { policyCode: Reflect.get(cause, "policyCode") }
+	} : base;
+	return yield* Effect.fail(Schema.is(McpToolError)(diagnostic) ? diagnostic : base);
+});
+const toolErrorResult = (failure) => {
+	const error = Schema.is(McpToolError)(failure) ? failure : localToolError(Schema.isSchemaError(failure) ? "INVALID_ARGUMENT" : "INTERNAL_ERROR");
+	return new McpSchema.CallToolResult({
+		isError: true,
+		structuredContent: { error },
+		content: [{
+			type: "text",
+			text: JSON.stringify({ error })
+		}]
+	});
+};
+
+//#endregion
+//#region src/services/mcp/tools.ts
+const rootObject = (schema) => {
+	const ref = Reflect.get(schema, "$ref");
+	const defs = Reflect.get(schema, "$defs");
+	if (typeof ref !== "string" || !ref.startsWith("#/$defs/") || typeof defs !== "object" || defs === null) return schema;
+	const root = Reflect.get(defs, ref.slice(8));
+	return typeof root === "object" && root !== null ? {
+		...root,
+		$defs: defs
+	} : schema;
+};
+const register = Effect.fn("LocalMcp.registerTool")(function* (tool, scope, destructive, handle) {
+	const authentication = yield* McpAuthentication;
+	yield* (yield* McpServer.McpServer).addTool({
+		tool: new McpSchema.Tool({
+			name: tool.name,
+			description: tool.description,
+			inputSchema: rootObject(Tool.getJsonSchema(tool)),
+			outputSchema: rootObject(Tool.getJsonSchemaFromSchema(tool.successSchema)),
+			annotations: {
+				readOnlyHint: scope === "mcp:read" || tool.name === "simulate_transaction",
+				destructiveHint: destructive,
+				idempotentHint: tool.name !== "execute_transaction" && tool.name !== "sign",
+				openWorldHint: true
+			}
+		}),
+		annotations: Context.empty(),
+		handle: (payload) => Effect.gen(function* () {
+			const principal = yield* authentication.principal;
+			if (!principal.scopes.includes(scope)) return toolErrorResult(localToolError("INSUFFICIENT_SCOPE"));
+			const value = yield* handle(yield* Schema.decodeUnknownEffect(tool.parametersSchema)(payload), principal.client);
+			const encoded = yield* Schema.encodeUnknownEffect(tool.successSchema)(value);
+			return new McpSchema.CallToolResult({
+				structuredContent: encoded,
+				content: [{
+					type: "text",
+					text: JSON.stringify(encoded)
+				}]
+			});
+		}).pipe(Effect.catch((error) => Effect.succeed(toolErrorResult(error))), Effect.withSpan("cli.mcp.tool", { attributes: { tool: tool.name } }))
+	});
+});
+const localMcpTools = Effect.gen(function* () {
+	yield* register(Tool.make("list_wallets", {
+		description: "List delegated wallets. Use a returned wallet id as walletId, never an address or session-key ID.",
+		success: Schema.Struct({ wallets: ListWalletsResponse })
+	}), "mcp:read", false, (_, client) => unwrapMcpSdk(() => client.wallets.list()).pipe(Effect.map((wallets) => ({ wallets }))));
+	yield* register(Tool.make("get_wallet", {
+		description: "Get one delegated wallet by walletId from list_wallets.",
+		parameters: McpGetWalletRequest,
+		success: Schema.Struct({ wallet: GetWalletResponse })
+	}), "mcp:read", false, ({ walletId }, client) => unwrapMcpSdk(() => client.wallets.get(walletId)).pipe(Effect.map((wallet) => ({ wallet }))));
+	yield* register(Tool.make("list_session_keys", {
+		description: "List delegated session keys and their wallet IDs. Execute and sign require both walletId and sessionKeyId; do not interchange them. The local key must also be imported on this machine.",
+		parameters: McpListSessionKeysRequest,
+		success: Schema.Struct({ sessionKeys: ListSessionKeysForOrganizationResponse })
+	}), "mcp:read", false, (input, client) => unwrapMcpSdk(() => client.sessionKeys.list(input)).pipe(Effect.map((sessionKeys) => ({ sessionKeys }))));
+	yield* register(Tool.make("get_session_key", {
+		description: "Get one delegated session key and its policies by sessionKeyId.",
+		parameters: McpGetSessionKeyRequest,
+		success: Schema.Struct({ sessionKey: GetSessionKeyResponse })
+	}), "mcp:read", false, ({ sessionKeyId }, client) => unwrapMcpSdk(() => client.sessionKeys.get(sessionKeyId)).pipe(Effect.map((sessionKey) => ({ sessionKey }))));
+	yield* register(Tool.make("simulate_transaction", {
+		description: "Simulate the exact session and calls without signing or consuming operation usage. Execute only when allowed and callsSucceeded are true.",
+		parameters: McpSimulateTransactionRequest,
+		success: Schema.Struct({ simulation: SimulateExecutionResponse })
+	}), "mcp:execute", false, (input, client) => unwrapMcpSdk(() => client.executions.simulate(input)).pipe(Effect.map((simulation) => ({ simulation }))));
+	yield* register(Tool.make("execute_transaction", {
+		description: "Execute exact calls using walletId and sessionKeyId from discovery tools. Simulate first. Signs locally using an imported session key. Gas is sponsored by default; sponsor:false requires a fee cap configured by the user when starting local MCP. Prepared means queued, not confirmed: poll get_transaction_status. Repeating this tool can transfer assets twice.",
+		parameters: McpExecuteTransactionRequest,
+		success: Schema.Struct({ execution: CompleteExecutionResponse })
+	}), "mcp:execute", true, (input, client) => unwrapMcpSdk(() => client.executions.execute(input)).pipe(Effect.map((execution) => ({ execution }))));
+	yield* register(Tool.make("get_transaction_status", {
+		description: "Poll the submissionId returned by execute_transaction until confirmed or failed. Prepared and submitted are still pending.",
+		parameters: McpGetTransactionStatusRequest,
+		success: Schema.Struct({ submission: GetExecutionSubmissionResponse })
+	}), "mcp:read", false, ({ submissionId }, client) => unwrapMcpSdk(() => client.executions.getStatus(submissionId)).pipe(Effect.map((submission) => ({ submission }))));
+	yield* register(Tool.make("get_executions", {
+		description: "Read confirmed execution history for this authorization. Pass nextCursor to fetch the next page. Pending submissions use get_transaction_status.",
+		parameters: McpGetExecutionsRequest,
+		success: ListExecutionsResponse
+	}), "mcp:read", false, (input, client) => unwrapMcpSdk(() => client.executions.list(input)));
+	yield* register(Tool.make("sign", {
+		description: "Sign an exact UTF-8 message or EIP-712 object locally, using an explicit walletId and sessionKeyId. Requires imported signature consent and installed onchain signature permission plus passing API policies. Does not submit a transaction.",
+		parameters: McpSignRequest,
+		success: Schema.Struct({ signature: SignResponse })
+	}), "mcp:execute", false, ({ request }, client) => unwrapMcpSdk(() => client.sign(request)).pipe(Effect.map((signature) => ({ signature }))));
+	yield* register(Tool.make("verify_signature", {
+		description: "Verify a smart-account signature against the original unmodified payload and walletId. A false validity result is not a tool failure.",
+		parameters: McpVerifySignatureRequest,
+		success: Schema.Struct({ verification: VerifySignatureResponse })
+	}), "mcp:read", false, ({ request }, client) => unwrapMcpSdk(() => client.verifySignature(request)).pipe(Effect.map((verification) => ({ verification }))));
+});
+
+//#endregion
+//#region src/services/mcp/stdio.ts
+const mcpStdio = Layer.effectDiscard(localMcpTools).pipe(Layer.provide(McpServer.layerStdio({
+	name: "Namera",
+	version,
+	protocols: [McpProtocol.v2025_06_18]
+})));
+
+//#endregion
+//#region src/services/mcp/transport-security.ts
+const LocalMcpApiOrigin = Schema.NonEmptyString.check(Schema.makeFilter((value) => {
+	const url = URL.parse(value);
+	return url !== null && url.username === "" && url.password === "" && url.pathname === "/" && url.search === "" && url.hash === "" && (url.protocol === "https:" || url.protocol === "http:" && [
+		"localhost",
+		"127.0.0.1",
+		"[::1]"
+	].includes(url.hostname));
+}, { message: "Use an HTTPS API origin, or HTTP localhost for development, without credentials, path, query or fragment" }));
+
+//#endregion
+//#region src/commands/mcp/index.ts
+const flags = {
+	profile: Flag.string("profile").pipe(Flag.withDefault("default")),
+	host: Flag.string("host").pipe(Flag.withDefault(NAMERA_API_ORIGIN), Flag.withDescription("Namera API origin"))
+};
+const session = Effect.fn("Mcp.session")(function* (options) {
+	const apiOrigin = new URL(yield* Schema.decodeUnknownEffect(LocalMcpApiOrigin)(options.host)).origin;
+	const profile = yield* Schema.decodeUnknownEffect(McpProfile)(options.profile);
+	return yield* Effect.acquireRelease(Effect.try(() => createMcpSession({
+		apiOrigin,
+		profile,
+		store: mcpCredentialStore(apiOrigin, profile)
+	})), (value) => Effect.sync(() => value.close()));
+});
+const serve = Command.make("serve", {
+	...flags,
+	maxGasCost: Flag.string("max-gas-cost-wei").pipe(Flag.optional, Flag.withDescription("Fee ceiling for self-funded operations; default is sponsored only"))
+}, Effect.fn("Mcp.serve")(function* (options) {
+	const connection = yield* session(options);
+	const apiOrigin = new URL(options.host).origin;
+	const maxGasCostWei = Option.isSome(options.maxGasCost) ? yield* Schema.decodeUnknownEffect(Schema.BigIntFromString.check(Schema.isGreaterThanOrEqualToBigInt(0n)))(options.maxGasCost.value) : void 0;
+	const principal = Effect.gen(function* () {
+		const credentials = yield* Effect.tryPromise({
+			try: connection.credentials,
+			catch: () => localToolError("UNAUTHORIZED")
+		});
+		if (!credentials) {
+			connection.requestLogin();
+			return yield* Effect.fail({
+				...localToolError("UNAUTHORIZED"),
+				message: `Authorize Namera in your browser, or run namera mcp login --profile ${options.profile} --host ${apiOrigin}. Then retry.`
+			});
+		}
+		return yield* makeMcpApiClient({
+			apiOrigin,
+			resolveSessionSigner: resolveCliSessionSigner(apiOrigin, maxGasCostWei)
+		}, {
+			accessToken: Redacted.make(credentials.accessToken),
+			clientId: credentials.clientId,
+			scopes: credentials.scopes
+		}).pipe(Effect.mapError((error) => localToolError(error.code === "temporarily_unavailable" ? "UPSTREAM_UNAVAILABLE" : "UNAUTHORIZED")));
+	});
+	const io = yield* Stdio.Stdio;
+	const ended = yield* Deferred.make();
+	const transport = Stdio.make({
+		...io,
+		stdin: io.stdin.pipe(Stream.ensuring(Deferred.succeed(ended, void 0)))
+	});
+	yield* Layer.build(mcpStdio.pipe(Layer.provide(Layer.succeed(McpAuthentication, { principal })), Layer.provide(Layer.succeed(Stdio.Stdio, transport)))).pipe(Effect.forkScoped, Effect.flatMap(Fiber.join));
+	yield* Deferred.await(ended);
+}, Effect.scoped, Effect.provide(Logger.layer([Logger.withConsoleError(Logger.formatSimple)]))));
+const login = Command.make("login", flags, Effect.fn("Mcp.login")(function* (options) {
+	const connection = yield* session(options);
+	yield* Effect.tryPromise({
+		try: connection.login,
+		catch: () => /* @__PURE__ */ new Error("MCP login failed. Check the browser consent and API connection, then try again.")
+	});
+	yield* printValue(connection.status(), recordView("MCP connection"));
+}, Effect.scoped));
+const status = Command.make("status", flags, Effect.fn("Mcp.status")(function* (options) {
+	const connection = yield* session(options);
+	yield* printValue(yield* Effect.try(connection.status), recordView("MCP connection"));
+}, Effect.scoped));
+const logout = Command.make("logout", flags, Effect.fn("Mcp.logout")(function* (options) {
+	const connection = yield* session(options);
+	yield* Effect.tryPromise({
+		try: connection.logout,
+		catch: () => /* @__PURE__ */ new Error("MCP logout could not be completed. Check your OS keyring and revoke the connection in Namera settings.")
+	});
+	yield* printValue({
+		profile: options.profile,
+		status: "signed-out"
+	}, recordView("MCP signed out"));
+}, Effect.scoped));
+const mcpCommand = Command.make("mcp").pipe(Command.withDescription("Local stdio MCP with persistent OAuth authorization"), Command.withSubcommands([
+	serve,
+	login,
+	status,
+	logout
+]));
+
+//#endregion
+//#region src/services/output/session-key.ts
+const sessionKeyView = (key, colors) => [
+	section(named(key.metadata), [
+		["Status", humanize(key.status)],
+		["Session key ID", key.id],
+		["Wallet", key.wallet.metadata.name],
+		["Wallet ID", key.walletId],
+		["Description", key.metadata.description ?? void 0],
+		["Created", key.createdAt],
+		["Revoked", key.revokedAt ?? void 0]
+	], colors),
+	...key.installations.map((installation) => section(network(installation.chainId), [
+		["Status", humanize(installation.status)],
+		["Signer", installation.authorization.signerAddress],
+		["Starts", installation.authorization.validAfter === 0 ? "Immediately after installation" : timestamp(installation.authorization.validAfter)],
+		["Expires", timestamp(installation.authorization.validUntil)],
+		["Signatures", installation.authorization.allowSignatures === true ? "Enabled" : "Disabled"],
+		["Onchain permissions", installation.authorization.permissions.map((permission) => {
+			const { type, ...parameters } = permission;
+			return {
+				policy: type === "root" ? "Unrestricted account access" : humanize(type),
+				...parameters,
+				...type === "native-token-transfer" ? { unit: "wei" } : {},
+				...type === "erc20-token-transfer" ? { unit: "token base units" } : {},
+				...type === "gas-limit" ? { unit: "gas units" } : {}
+			};
+		})]
+	], colors)),
+	...key.installations.length === 0 ? ["  No network installations."] : [],
+	section("Offchain policies", [["Policies", key.policies.map(({ type, ...parameters }) => ({
+		policy: humanize(type.replace(/^evm\./, "")),
+		...parameters
+	}))]], colors)
+].join("\n\n");
+const sessionKeysView = (keys, colors) => collection(keys, "session key", "session keys", (key, useColors) => section(named(key.metadata), [
+	["Status", humanize(key.status)],
+	["Session key ID", key.id],
+	["Wallet", key.wallet.metadata.name],
+	["Wallet ID", key.walletId],
+	["Networks", key.installations.map((installation) => `${network(installation.chainId)}: ${humanize(installation.status)}`)],
+	["Created", key.createdAt]
+], useColors), colors);
+
+//#endregion
+//#region src/commands/session-key/import.ts
+const importSessionKeyCommand = Command.make("import", {
+	encryptedExport: Argument.string("encrypted-export"),
+	profile: profileFlag
+}, Effect.fn("cli.sessionKey.import")(function* ({ encryptedExport, profile }) {
+	const envelope = yield* Effect.try({
+		try: () => {
+			if (encryptedExport.length > 131072 || !/^[A-Za-z0-9_-]+$/.test(encryptedExport)) throw new Error("Invalid export");
+			return Schema.decodeUnknownSync(Schema.fromJsonString(EncryptedLocalSessionKey))(Buffer.from(encryptedExport, "base64url").toString("utf8"));
+		},
+		catch: () => new SessionKeystoreError({ code: "IMPORT_FAILED" })
+	});
+	const { profile: activeProfile } = yield* Effect.tryPromise(() => makeCliClient(profile));
+	const password = yield* Prompt.password({ message: "Export passphrase" });
+	const result = yield* Effect.tryPromise({
+		try: () => sessionKeystore.importKey(envelope, password, new URL(activeProfile.baseUrl).origin),
+		catch: () => new SessionKeystoreError({ code: "IMPORT_FAILED" })
+	});
+	yield* printValue({
+		status: "imported",
+		...result
+	}, recordView("Session key imported"));
+})).pipe(Command.withDescription("Import an encrypted dashboard session export; passphrase is entered securely"));
+
+//#endregion
+//#region src/commands/session-key/index.ts
+const list$1 = Command.make("list", {
+	wallet: Flag.string("wallet").pipe(Flag.withDescription("Only list keys for one wallet"), Flag.optional),
+	profile: profileFlag
+}, Effect.fn(function* ({ wallet, profile }) {
+	const { client } = yield* Effect.tryPromise(() => makeCliClient(profile));
+	const result = yield* runPromise(client.sessionKeys.list(Option.isSome(wallet) ? { walletId: yield* Schema.decodeUnknownEffect(WalletId)(wallet.value) } : {}));
+	yield* printValue(result, sessionKeysView);
+}));
+const get$1 = Command.make("get", {
+	sessionKeyId: Argument.string("session-key-id"),
+	profile: profileFlag
+}, Effect.fn(function* ({ sessionKeyId, profile }) {
+	const id = yield* Schema.decodeUnknownEffect(SessionKeyId)(sessionKeyId);
+	const { client } = yield* Effect.tryPromise(() => makeCliClient(profile));
+	yield* printValue(yield* runPromise(client.sessionKeys.get(id)), sessionKeyView);
+}));
+const sessionKeyCommand = Command.make("session-key").pipe(Command.withDescription("Read granted session keys and import local signing material"), Command.withSubcommands([
+	list$1,
+	get$1,
+	importSessionKeyCommand
+]));
+
+//#endregion
+//#region src/commands/sign.ts
+const promptSignRequest = Effect.fn("cli.sign.promptRequest")(function* () {
+	const prompts = yield* CliPrompts;
+	const namespace = yield* prompts.namespace;
+	const walletId = yield* prompts.walletId();
+	const sessionKeyId = yield* prompts.sessionKeyId();
+	const chainId = yield* prompts.chainId();
+	const type = yield* prompts.signatureType;
+	return type === "message" ? {
+		namespace,
+		walletId,
+		sessionKeyId,
+		chainId,
+		type,
+		message: yield* prompts.message()
+	} : {
+		namespace,
+		walletId,
+		sessionKeyId,
+		chainId,
+		type,
+		typedData: yield* prompts.typedData
+	};
+});
+const signCommand = Command.make("sign", {
+	params: paramsFlag,
+	profile: profileFlag
+}, Effect.fn(function* ({ params, profile }) {
+	const request = yield* resolveParams(params, PrepareSignatureRequest, promptSignRequest());
+	const { client } = yield* Effect.tryPromise(() => makeCliClient(profile));
+	yield* printValue(yield* runPromise(client.sign(request)), signatureView);
+})).pipe(Command.withDescription("Sign an EVM message or typed-data request"));
+
+//#endregion
+//#region src/commands/verify-signature.ts
+const promptVerifySignatureRequest = Effect.fn("cli.verifySignature.promptRequest")(function* () {
+	const prompts = yield* CliPrompts;
+	const namespace = yield* prompts.namespace;
+	const walletId = yield* prompts.walletId();
+	const chainId = yield* prompts.chainId();
+	const type = yield* prompts.signatureType;
+	const signature = yield* prompts.hex("Signature");
+	return type === "message" ? {
+		namespace,
+		walletId,
+		chainId,
+		type,
+		signature,
+		message: yield* prompts.message()
+	} : {
+		namespace,
+		walletId,
+		chainId,
+		type,
+		signature,
+		typedData: yield* prompts.typedData
+	};
+});
+const verifySignatureCommand = Command.make("verify-signature", {
+	params: paramsFlag,
+	profile: profileFlag
+}, Effect.fn(function* ({ params, profile }) {
+	const request = yield* resolveParams(params, VerifySignatureRequest, promptVerifySignatureRequest());
+	const { client } = yield* Effect.tryPromise(() => makeCliClient(profile));
+	yield* printValue(yield* runPromise(client.verifySignature(request)), verificationView);
+})).pipe(Command.withDescription("Verify an EVM smart-account signature"));
+
+//#endregion
+//#region src/services/output/wallet.ts
+const walletView = (wallet, colors) => section(named(wallet.metadata), [
+	["Status", humanize(wallet.status)],
+	["Address", wallet.address],
+	["Wallet ID", wallet.id],
+	["Network type", "EVM"],
+	["Key custody", wallet.owner.custody === "local" ? "Local (user-owned)" : "Namera-managed"],
+	["Implementation", "Alchemy Modular V2"],
+	["Description", wallet.metadata.description ?? void 0],
+	["Created", wallet.createdAt]
+], colors);
+const walletsView = (wallets, colors) => collection(wallets, "delegated wallet", "delegated wallets", walletView, colors);
+
+//#endregion
+//#region src/commands/wallet/index.ts
+const list = Command.make("list", { profile: profileFlag }, Effect.fn(function* ({ profile }) {
+	const { client } = yield* Effect.tryPromise(() => makeCliClient(profile));
+	yield* printValue(yield* runPromise(client.wallets.list()), walletsView);
+}));
+const get = Command.make("get", {
+	walletId: Argument.string("wallet-id"),
+	profile: profileFlag
+}, Effect.fn(function* ({ walletId, profile }) {
+	const id = yield* Schema.decodeUnknownEffect(WalletId)(walletId);
+	const { client } = yield* Effect.tryPromise(() => makeCliClient(profile));
+	yield* printValue(yield* runPromise(client.wallets.get(id)), walletView);
+}));
+const walletCommand = Command.make("wallet").pipe(Command.withDescription("Read wallets granted to this CLI"), Command.withSubcommands([list, get]));
+
+//#endregion
+//#region src/index.ts
+nameraCommand.pipe(Command.withSubcommands([
+	loginCommand,
+	logoutCommand,
+	authCommand,
+	walletCommand,
+	sessionKeyCommand,
+	executionCommand,
+	mcpCommand,
+	signCommand,
+	verifySignatureCommand
+])).pipe(Command.run({ version }), Effect.provide(CliPrompts.layer), Effect.provide(NodeServices.layer), NodeRuntime.runMain);
+
+//#endregion
+export {  };
+//# sourceMappingURL=index.js.map