@palmyr/cli 1.0.0

package/dist/sdk.js

@@ -0,0 +1,944 @@
+/**
+ * Palmyr SDK — programmatic access to all Palmyr services.
+ */
+const DEFAULT_API = 'https://palmyr.ai';
+// -------------------- Client-side executor helpers --------------------
+/** Topological order of plan steps using their `depends_on` arrays. */
+function topoOrderSteps(steps) {
+    const byId = new Map(steps.map(s => [s.step_id, s]));
+    const indegree = new Map();
+    const outgoing = new Map();
+    for (const s of steps) {
+        indegree.set(s.step_id, Array.isArray(s.depends_on) ? s.depends_on.length : 0);
+        for (const dep of s.depends_on ?? []) {
+            if (!byId.has(dep))
+                throw new Error(`step ${s.step_id} depends on unknown step ${dep}`);
+            if (!outgoing.has(dep))
+                outgoing.set(dep, []);
+            outgoing.get(dep).push(s.step_id);
+        }
+        if (!outgoing.has(s.step_id))
+            outgoing.set(s.step_id, []);
+    }
+    const order = [];
+    const ready = [];
+    for (const [id, deg] of indegree)
+        if (deg === 0)
+            ready.push(id);
+    while (ready.length > 0) {
+        const id = ready.shift();
+        order.push(byId.get(id));
+        for (const dep of outgoing.get(id) ?? []) {
+            const next = (indegree.get(dep) ?? 0) - 1;
+            indegree.set(dep, next);
+            if (next === 0)
+                ready.push(dep);
+        }
+    }
+    if (order.length !== steps.length)
+        throw new Error('plan has a dependency cycle');
+    return order;
+}
+/**
+ * Resolve a $STEPS.sN.output.path expression against prior outputs.
+ * Two modes:
+ *   - whole-field: "$STEPS.s1.output.field" → returns the resolved value verbatim
+ *     (could be any type — object, array, string, number)
+ *   - embedded: "hello $STEPS.s1.output.field" → scans and substitutes the match
+ *     (resolved values are coerced to strings)
+ */
+function resolveOne(stepId, path, priorOutputs) {
+    const base = priorOutputs[stepId];
+    if (base === undefined)
+        return undefined;
+    if (!path)
+        return base;
+    const segments = path.split(/\.|\[(\d+)\]/).filter(s => s !== undefined && s !== '');
+    let cursor = base;
+    for (const seg of segments) {
+        if (cursor === null || cursor === undefined)
+            return undefined;
+        if (/^\d+$/.test(seg) && Array.isArray(cursor)) {
+            cursor = cursor[parseInt(seg, 10)];
+        }
+        else if (typeof cursor === 'object') {
+            // Try exact, then camelCase, then snake_case — schemas drift from
+            // actual server responses; the resolver shouldn't punish either side.
+            if (seg in cursor) {
+                cursor = cursor[seg];
+            }
+            else {
+                const camel = seg.replace(/_([a-zA-Z0-9])/g, (_, c) => c.toUpperCase());
+                const snake = seg.replace(/([A-Z])/g, '_$1').toLowerCase().replace(/^_/, '');
+                if (camel in cursor)
+                    cursor = cursor[camel];
+                else if (snake in cursor)
+                    cursor = cursor[snake];
+                else
+                    return undefined;
+            }
+        }
+        else {
+            return undefined;
+        }
+    }
+    return cursor;
+}
+function resolveTemplateValue(value, priorOutputs) {
+    if (typeof value !== 'string')
+        return value;
+    // Whole-field match: the string is *only* a template expression. Return the
+    // resolved value verbatim (may be non-string).
+    const whole = value.match(/^\$STEPS\.([a-zA-Z0-9_]+)\.output(?:\.(.+))?$/);
+    if (whole) {
+        const resolved = resolveOne(whole[1], whole[2], priorOutputs);
+        if (resolved === undefined) {
+            const stepOutput = priorOutputs[whole[1]];
+            const detail = stepOutput === undefined
+                ? `step '${whole[1]}' has not run yet (missing depends_on?)`
+                : `step '${whole[1]}' produced ${JSON.stringify(stepOutput)} which has no '${whole[2]}' field`;
+            throw new Error(`Could not resolve template "${value}" — ${detail}`);
+        }
+        return resolved;
+    }
+    // Embedded match: substitute every $STEPS.X.output(.path) occurrence with its
+    // string-coerced resolved value. Path is a sequence of .name or [n] segments.
+    const embeddedPattern = /\$STEPS\.([a-zA-Z0-9_]+)\.output((?:\.[a-zA-Z0-9_]+|\[\d+\])*)/g;
+    if (!embeddedPattern.test(value))
+        return value;
+    // Re-run since test() advances lastIndex on /g patterns
+    return value.replace(/\$STEPS\.([a-zA-Z0-9_]+)\.output((?:\.[a-zA-Z0-9_]+|\[\d+\])*)/g, (match, stepId, pathChain) => {
+        const path = pathChain.replace(/^\./, '') || undefined;
+        const resolved = resolveOne(stepId, path, priorOutputs);
+        if (resolved === undefined) {
+            const stepOutput = priorOutputs[stepId];
+            const detail = stepOutput === undefined
+                ? `step '${stepId}' has not run yet`
+                : `step '${stepId}' has no '${path}' field`;
+            throw new Error(`Could not resolve template "${match}" inside "${value}" — ${detail}`);
+        }
+        return typeof resolved === 'string' ? resolved : JSON.stringify(resolved);
+    });
+}
+/** Walk an input object deeply, resolving every templated string leaf. */
+function resolveStepInput(input, priorOutputs) {
+    if (input === null || input === undefined)
+        return input;
+    if (typeof input === 'string')
+        return resolveTemplateValue(input, priorOutputs);
+    if (Array.isArray(input))
+        return input.map(v => resolveStepInput(v, priorOutputs));
+    if (typeof input === 'object') {
+        const out = {};
+        for (const [k, v] of Object.entries(input))
+            out[k] = resolveStepInput(v, priorOutputs);
+        return out;
+    }
+    return input;
+}
+/**
+ * Detect whether a step's capability is a social operation that needs a
+ * vault-managed session (cookies, login creds). Twitter/TikTok provisioning
+ * (buy/account) and any non-social capability return false.
+ */
+function socialPlatformForCapability(capability) {
+    if (!capability)
+        return null;
+    if (capability === 'twitter_buy_account')
+        return null;
+    if (capability.startsWith('twitter_'))
+        return 'twitter';
+    if (capability.startsWith('tiktok_'))
+        return 'tiktok';
+    return null;
+}
+/**
+ * For a planner-emitted social step, resolve the `handle` field to the local
+ * vault entry, ensure a fresh login session (auto-login if stale), and return
+ * an enriched HTTP body. The `handle` field is consumed (removed from the
+ * outgoing body) and replaced with the server-expected `account_id` plus
+ * cookies + proxy_session_id + (for change_username) password.
+ *
+ * Credentials NEVER appear in the persisted plan/step.input — only in the
+ * immediate HTTP body to the social endpoint.
+ *
+ * If the session is stale or missing, performs a paid login call (~$0.005)
+ * and yields a 'session_refresh' event so the CLI can render it inline.
+ *
+ * Throws if the account isn't in the local vault (the caller turns this into
+ * a step_error).
+ */
+async function* injectSocialCredentials(opts) {
+    const sv = await import('./social-vault.js');
+    const { paidRequest } = await import('./pay.js');
+    // Accept `handle` (current schema) or `account_id` (legacy). Remove both
+    // from the outgoing body — the server only wants `account_id` set to the
+    // real internal id, which we inject below.
+    const rawHandle = String(opts.resolvedInput.handle ?? opts.resolvedInput.account_id ?? '').replace(/^@/, '').trim();
+    if (!rawHandle) {
+        throw new Error(`${opts.capability} requires a handle in 'handle' (e.g. 'ArianneAgent'). ` +
+            `The planner left it blank.`);
+    }
+    const acc = sv.getAccount(opts.platform, rawHandle);
+    if (!acc) {
+        throw new Error(`${opts.platform} account "@${rawHandle}" is not in the local vault. ` +
+            `Run: palmyr ${opts.platform} import @${rawHandle}`);
+    }
+    const SESSION_TTL_HOURS = 12;
+    let session = sv.loadSession(acc.id);
+    const ageHours = sv.sessionAgeHours(acc.id);
+    const stale = !session || session.cookies.length === 0 || (ageHours !== undefined && ageHours > SESSION_TTL_HOURS);
+    if (stale) {
+        yield { type: 'session_refresh_started', platform: opts.platform, handle: rawHandle };
+        const creds = sv.unlockCredentials(opts.platform, rawHandle);
+        const psid = sv.getProxySessionId(opts.platform, rawHandle);
+        const loginPath = `/social/${opts.platform}/login`;
+        const loginBody = { account_id: acc.id, ...(psid ? { proxy_session_id: psid } : {}) };
+        if (opts.platform === 'twitter') {
+            if (creds.auth_token)
+                loginBody.auth_token = creds.auth_token;
+            if (creds.ct0)
+                loginBody.ct0 = creds.ct0;
+            if (creds.login)
+                loginBody.login = creds.login;
+            if (creds.password)
+                loginBody.password = creds.password;
+            if (creds.totp_seed)
+                loginBody.totp_seed = creds.totp_seed;
+        }
+        else {
+            if (creds.tiktok_sessionid)
+                loginBody.sessionid = creds.tiktok_sessionid;
+            if (creds.tiktok_csrf)
+                loginBody.tt_csrf_token = creds.tiktok_csrf;
+            if (creds.tiktok_webid)
+                loginBody.tt_webid_v2 = creds.tiktok_webid;
+            if (creds.login)
+                loginBody.login = creds.login;
+            if (creds.password)
+                loginBody.password = creds.password;
+            if (creds.email)
+                loginBody.email = creds.email;
+            if (creds.email_password)
+                loginBody.email_password = creds.email_password;
+        }
+        const result = await paidRequest(opts.api, 'POST', loginPath, loginBody, opts.passphrase);
+        const cookies = (result.data?.cookies ?? []);
+        if (!Array.isArray(cookies) || cookies.length === 0) {
+            throw new Error(`${opts.platform} login for @${rawHandle} returned no cookies`);
+        }
+        session = sv.saveSession(acc.id, opts.platform, cookies);
+        sv.updateMeta(opts.platform, rawHandle, { last_action_at: new Date().toISOString() });
+        yield {
+            type: 'session_refresh_done',
+            platform: opts.platform,
+            handle: rawHandle,
+            costChargedUsdc: 0.005,
+            txSignature: result.txHash,
+        };
+    }
+    // Build the enriched body. Start from resolvedInput so operation-specific
+    // fields (text, target_user, etc.) flow through. Strip the planner's
+    // handle/account_id fields, then inject the real internal account_id,
+    // cookies, proxy_session_id, and (for change_username) the vault password.
+    const enriched = { ...opts.resolvedInput };
+    delete enriched.handle;
+    enriched.account_id = acc.id;
+    enriched.cookies = session.cookies;
+    const psid2 = sv.getProxySessionId(opts.platform, rawHandle);
+    if (psid2)
+        enriched.proxy_session_id = psid2;
+    if (opts.capability === 'twitter_change_username') {
+        const creds = sv.unlockCredentials(opts.platform, rawHandle);
+        if (!creds.password) {
+            throw new Error(`twitter_change_username needs the vault password for @${rawHandle}, but none is stored.`);
+        }
+        enriched.password = creds.password;
+    }
+    return enriched;
+}
+/**
+ * Substitute {field_name} placeholders in an endpoint URL from the step's input.
+ * Fields consumed into the path are REMOVED from the returned body so they
+ * don't get sent twice. If a placeholder has no matching input, throws — the
+ * executor surfaces that as a step_error.
+ */
+function substitutePathParams(endpoint, input) {
+    const body = { ...input };
+    const url = endpoint.replace(/\{([a-zA-Z_][a-zA-Z0-9_]*)\}/g, (_match, field) => {
+        if (!(field in body)) {
+            const present = Object.keys(input).join(', ') || '(empty)';
+            throw new Error(`endpoint ${endpoint} requires path param '${field}' but step input has no such field. ` +
+                `Input fields present: ${present}. ` +
+                `If '${field}' should come from a prior step, the planner must include it as "$STEPS.sN.output.FIELD".`);
+        }
+        const value = body[field];
+        delete body[field];
+        return encodeURIComponent(String(value));
+    });
+    return { url, body };
+}
+export class Palmyr {
+    api;
+    token;
+    passphrase;
+    autoPay;
+    constructor(apiUrl, autoPay, token, passphrase) {
+        this.api = apiUrl || process.env.PALMYR_API || DEFAULT_API;
+        this.token = token || process.env.PALMYR_TOKEN || process.env.PALMYR_API_KEY;
+        this.passphrase = passphrase || process.env.PALMYR_WALLET_PASSPHRASE;
+        this.autoPay = autoPay ?? true;
+    }
+    async request(method, path, body) {
+        const headers = { 'Content-Type': 'application/json' };
+        if (this.token)
+            headers['Authorization'] = `Bearer ${this.token}`;
+        const opts = { method, headers };
+        if (body)
+            opts.body = JSON.stringify(body);
+        const res = await fetch(this.api + path, opts);
+        // Some edge layers (CDN, nginx) return HTML error pages for transient
+        // upstream failures. Detect that before trying JSON.parse so the agent
+        // gets a usable error instead of "Unexpected token '<'".
+        const contentType = res.headers.get('content-type') || '';
+        let data;
+        if (contentType.includes('application/json')) {
+            data = await res.json().catch(() => ({ error: 'Invalid JSON response from server' }));
+        }
+        else {
+            const text = await res.text().catch(() => '');
+            if (res.status === 402) {
+                // 402 without JSON body still handled by paidRequest below.
+                data = {};
+            }
+            else {
+                throw new Error(`Server returned ${res.status} ${res.statusText} with non-JSON body ` +
+                    `(${contentType || 'no content-type'}). This is usually a transient CDN/nginx error — retry in a moment. ` +
+                    `First 200 chars: ${text.slice(0, 200)}`);
+            }
+        }
+        // If 402 and autoPay enabled, try to pay (uses local vault wallet via pay.ts)
+        if (res.status === 402 && this.autoPay) {
+            try {
+                const { paidRequest } = await import('./pay.js');
+                const result = await paidRequest(this.api, method, path, body, this.passphrase);
+                return result.data;
+            }
+            catch (e) {
+                throw new Error(e.message);
+            }
+        }
+        if (data.error) {
+            // Surface the server's `message` and `hint` if present — the bare
+            // `error` field is often a category label ("Invalid install recipe")
+            // while the actual specifics (which recipe, what's allowed) live in
+            // `message` and `hint`. CLI's err() formatter renders multi-line
+            // messages cleanly.
+            const parts = [String(data.error)];
+            if (data.message && data.message !== data.error)
+                parts.push(String(data.message));
+            if (data.hint)
+                parts.push(`Hint: ${data.hint}`);
+            throw new Error(parts.join(' — '));
+        }
+        return data;
+    }
+    // ── Phone ──
+    async phoneSearch(country, limit) {
+        return this.request('GET', `/phone/numbers/search?country=${country}${limit ? '&limit=' + limit : ''}`);
+    }
+    async phoneBuy(country, areaCode) {
+        return this.request('POST', '/phone/numbers', { country, ...(areaCode ? { areaCode } : {}) });
+    }
+    async phoneSms(phoneId, to, body) {
+        return this.request('POST', `/phone/numbers/${phoneId}/send`, { to, body });
+    }
+    async phoneCall(phoneId, to, tts) {
+        return this.request('POST', `/phone/numbers/${phoneId}/call`, { to, tts });
+    }
+    // ── Email ──
+    async emailCreate(name, walletAddress, domain) {
+        const body = { name };
+        if (walletAddress)
+            body.walletAddress = walletAddress;
+        if (domain)
+            body.domain = domain;
+        return this.request('POST', '/email/inboxes', body);
+    }
+    async emailListInboxes() {
+        return this.request('GET', '/email/inboxes');
+    }
+    async emailDomainStatus(domain) {
+        return this.request('GET', `/email/domains/${encodeURIComponent(domain)}/status`);
+    }
+    async emailRegisterDomain(domain) {
+        return this.request('POST', `/email/domains/${encodeURIComponent(domain)}/register`);
+    }
+    async emailRead(inboxId) {
+        return this.request('GET', `/email/inboxes/${inboxId}/messages`);
+    }
+    async emailSend(inboxId, to, subject, body) {
+        return this.request('POST', `/email/inboxes/${inboxId}/send`, { to, subject, body });
+    }
+    async emailThreads(inboxId) {
+        return this.request('GET', `/email/inboxes/${inboxId}/threads`);
+    }
+    // ── Compute ──
+    async computePlans(opts = {}) {
+        const qs = opts.location ? `?location=${encodeURIComponent(opts.location)}` : '';
+        return this.request('GET', `/compute/plans${qs}`);
+    }
+    async computeLocations() {
+        return this.request('GET', '/compute/locations');
+    }
+    /**
+     * Deploy a Hetzner Cloud server.
+     *
+     * `install` controls what cloud-init bootstraps on the server. When set
+     * (string or array), it overrides the legacy `installOpenClaw` boolean.
+     * Pass `[]` for a vanilla Ubuntu box (cloud-init skipped, password auth
+     * stays enabled). Discoverable via `GET /compute/install-recipes`.
+     *
+     * `location` picks a Hetzner datacenter slug (fsn1, nbg1, hel1, ash, hil,
+     * sin). The server validates type-vs-location compatibility pre-payment so
+     * cax11+ash fails as 400 with `Try one of: fsn1` instead of 422 after
+     * x402 settles. Discoverable via `GET /compute/locations`.
+     */
+    async computeDeploy(name, serverType, opts = {}) {
+        const body = {
+            name,
+            serverType,
+            image: 'ubuntu-24.04',
+        };
+        if (opts.install !== undefined) {
+            body.install = opts.install;
+        }
+        else if (opts.installOpenClaw !== undefined) {
+            body.installOpenClaw = opts.installOpenClaw;
+        }
+        if (opts.sshPublicKey)
+            body.sshPublicKey = opts.sshPublicKey;
+        if (opts.sshKeyIds?.length)
+            body.sshKeyIds = opts.sshKeyIds;
+        if (opts.location)
+            body.location = opts.location;
+        return this.request('POST', '/compute/servers', body);
+    }
+    /**
+     * Rename a deployed server. Metadata-only; doesn't reboot. Local server
+     * cache is updated by the CLI wrapper after a successful API call.
+     */
+    async computeRename(serverId, newName) {
+        return this.request('PUT', `/compute/servers/${serverId}`, { name: newName });
+    }
+    async computeInstallRecipes() {
+        return this.request('GET', '/compute/install-recipes');
+    }
+    async computeList() {
+        return this.request('GET', '/compute/servers');
+    }
+    async computeDelete(serverId) {
+        return this.request('DELETE', `/compute/servers/${serverId}`);
+    }
+    /**
+     * Inject your SSH public key into a freshly-deployed VPS, remove the
+     * platform's temporary key, and lock the root password. After this call,
+     * only your key can SSH into the box.
+     */
+    async computeSetupSsh(serverId, publicKey) {
+        return this.request('POST', `/compute/servers/${serverId}/setup-ssh`, { publicKey });
+    }
+    // ── SSH keys (Hetzner-managed, stable IDs) ──
+    //
+    // The numeric ID returned by `computeSshKeyAdd` is what `computeDeploy({
+    // sshKeyIds: [...] })` consumes. Hetzner injects them into authorized_keys
+    // at first boot — same outcome as inline `sshPublicKey`, but the key is
+    // reusable across deploys without re-uploading.
+    async computeSshKeyAdd(name, publicKey) {
+        return this.request('POST', '/compute/ssh-keys', { name, publicKey });
+    }
+    async computeSshKeyList() {
+        return this.request('GET', '/compute/ssh-keys');
+    }
+    async computeSshKeyDelete(id) {
+        return this.request('DELETE', `/compute/ssh-keys/${id}`);
+    }
+    async computeGet(serverId) {
+        return this.request('GET', `/compute/servers/${serverId}`);
+    }
+    /**
+     * Run a single command on a freshly-deployed server via the platform's
+     * SSH key. Pre-handoff only — once `compute setup-ssh` has run we no
+     * longer have access. `command` and `args` are POSIX-quoted server-side
+     * so they pass through as distinct argv elements on the remote shell.
+     */
+    async computeExec(serverId, command, args = [], opts = {}) {
+        const body = { command, args };
+        if (opts.timeoutSec)
+            body.timeoutSec = opts.timeoutSec;
+        return this.request('POST', `/compute/servers/${serverId}/exec`, body);
+    }
+    async computeAction(serverId, action, opts = {}) {
+        const body = { action };
+        if (opts.image)
+            body.image = opts.image;
+        return this.request('POST', `/compute/servers/${serverId}/actions`, body);
+    }
+    // ── Domains ──
+    async domainCheck(domain) {
+        return this.request('GET', `/domains/check?domain=${domain}`);
+    }
+    async domainList() {
+        return this.request('GET', '/domains');
+    }
+    async domainPricing(domain) {
+        return this.request('GET', `/domains/pricing?domain=${domain}`);
+    }
+    async domainBuy(domain) {
+        return this.request('POST', '/domains/register', { domain });
+    }
+    async domainDns(domain) {
+        return this.request('GET', `/domains/${domain}/dns`);
+    }
+    async domainTransferOwnership(domain, newOwner) {
+        return this.request('POST', `/domains/${domain}/transfer-ownership`, { new_owner: newOwner });
+    }
+    // ── Wallet ──
+    async walletCreate(label, chains, mode) {
+        return this.request('POST', '/wallet', { label, chains, mode });
+    }
+    async walletImport(mnemonic, label, mode) {
+        return this.request('POST', '/wallet/import', { mnemonic, label, mode });
+    }
+    async walletList() {
+        return this.request('GET', '/wallet');
+    }
+    async walletGet(walletId) {
+        return this.request('GET', `/wallet/${walletId}`);
+    }
+    async walletDelete(walletId) {
+        return this.request('DELETE', `/wallet/${walletId}`);
+    }
+    async walletAddresses(walletId) {
+        return this.request('GET', `/wallet/${walletId}/addresses`);
+    }
+    async walletDerive(walletId, chain) {
+        return this.request('POST', `/wallet/${walletId}/derive`, { chain });
+    }
+    /** Sign a transaction. Auth resolved from API key or session secret. */
+    async walletSign(walletId, chain, transaction) {
+        return this.request('POST', `/wallet/${walletId}/sign`, { chain, transaction });
+    }
+    async walletSignMessage(walletId, chain, message) {
+        return this.request('POST', `/wallet/${walletId}/sign-message`, { chain, message });
+    }
+    async walletSignTyped(walletId, chain, typedData) {
+        return this.request('POST', `/wallet/${walletId}/sign-typed`, { chain, typedData });
+    }
+    async walletPolicy(walletId, policy) {
+        return this.request('POST', `/wallet/${walletId}/policy`, { policy });
+    }
+    async walletGetPolicy(walletId) {
+        return this.request('GET', `/wallet/${walletId}/policy`);
+    }
+    async walletSpending(walletId) {
+        return this.request('GET', `/wallet/${walletId}/spending`);
+    }
+    async walletApiKey(walletId, name, sessionSecret, policyIds, expiresAt) {
+        return this.request('POST', `/wallet/${walletId}/api-key`, { name, sessionSecret, policyIds, expiresAt });
+    }
+    async walletRevokeApiKey(walletId, keyId) {
+        return this.request('DELETE', `/wallet/${walletId}/api-key`, { keyId });
+    }
+    async walletConfig(walletId, sessionSecret) {
+        return this.request('POST', `/wallet/${walletId}/config`, { sessionSecret });
+    }
+    async walletRequestApproval(walletId, action, params) {
+        return this.request('POST', `/wallet/${walletId}/request-approval`, { action, ...params });
+    }
+    // ── Social ──
+    async socialTwitterLogin(accountId, login, password, totpSeed, cookies, proxySessionId) {
+        return this.request('POST', '/social/twitter/login', {
+            account_id: accountId,
+            ...(proxySessionId ? { proxy_session_id: proxySessionId } : {}),
+            login,
+            password,
+            ...(totpSeed ? { totp_seed: totpSeed } : {}),
+            ...(cookies?.auth_token ? { auth_token: cookies.auth_token } : {}),
+            ...(cookies?.ct0 ? { ct0: cookies.ct0 } : {}),
+        });
+    }
+    async socialTwitterRegister(username, password, opts) {
+        return this.request('POST', '/social/twitter/register', {
+            username,
+            password,
+            ...(opts?.login ? { login: opts.login } : {}),
+            ...(opts?.email ? { email: opts.email } : {}),
+            ...(opts?.email_password ? { email_password: opts.email_password } : {}),
+            ...(opts?.totp_seed ? { totp_seed: opts.totp_seed } : {}),
+            ...(opts?.auth_token ? { auth_token: opts.auth_token } : {}),
+            ...(opts?.ct0 ? { ct0: opts.ct0 } : {}),
+            ...(opts?.country ? { country: opts.country } : {}),
+        });
+    }
+    async socialTwitterUnregister(accountId) {
+        return this.request('DELETE', `/social/twitter/register/${encodeURIComponent(accountId)}`);
+    }
+    async socialTwitterListRegistered() {
+        return this.request('GET', '/social/twitter/registered');
+    }
+    // ── Server-side scheduled posts ──
+    // Pay at schedule time; worker fires at post_at with no further charge.
+    // accountId is the 32-char hex returned by socialTwitterRegister().
+    async socialScheduledPost(accountId, text, postAt, communityId) {
+        return this.request('POST', '/social/scheduled/post', {
+            account_id: accountId, text, post_at: postAt,
+            ...(communityId ? { community_id: communityId } : {}),
+        });
+    }
+    async socialScheduledThread(accountId, texts, postAt, communityId) {
+        return this.request('POST', '/social/scheduled/thread', {
+            account_id: accountId, texts, post_at: postAt,
+            ...(communityId ? { community_id: communityId } : {}),
+        });
+    }
+    async socialScheduledMedia(accountId, text, media, postAt, communityId) {
+        return this.request('POST', '/social/scheduled/media', {
+            account_id: accountId, text, media, post_at: postAt,
+            ...(communityId ? { community_id: communityId } : {}),
+        });
+    }
+    async socialScheduledList(filter) {
+        const qs = new URLSearchParams();
+        if (filter?.accountId)
+            qs.set('account_id', filter.accountId);
+        if (filter?.status)
+            qs.set('status', filter.status);
+        if (filter?.from)
+            qs.set('from', filter.from);
+        if (filter?.to)
+            qs.set('to', filter.to);
+        if (filter?.limit)
+            qs.set('limit', String(filter.limit));
+        const path = '/social/scheduled' + (qs.toString() ? `?${qs}` : '');
+        return this.request('GET', path);
+    }
+    async socialScheduledCancel(id) {
+        return this.request('DELETE', `/social/scheduled/${encodeURIComponent(id)}`);
+    }
+    async socialTwitterPost(accountId, cookies, text, proxySessionId, communityId) {
+        return this.request('POST', '/social/twitter/post', { account_id: accountId, proxy_session_id: proxySessionId, cookies, text, ...(communityId ? { community_id: communityId } : {}) });
+    }
+    async socialTwitterPostThread(accountId, cookies, texts, proxySessionId, communityId) {
+        return this.request('POST', '/social/twitter/post-thread', { account_id: accountId, proxy_session_id: proxySessionId, cookies, texts, ...(communityId ? { community_id: communityId } : {}) });
+    }
+    async socialTwitterPostWithMedia(accountId, cookies, text, media, proxySessionId, communityId) {
+        return this.request('POST', '/social/twitter/post-media', { account_id: accountId, proxy_session_id: proxySessionId, cookies, text, media, ...(communityId ? { community_id: communityId } : {}) });
+    }
+    async socialTwitterListMyTweets(accountId, cookies, limit, proxySessionId) {
+        return this.request('POST', '/social/twitter/list-my-tweets', {
+            account_id: accountId,
+            proxy_session_id: proxySessionId,
+            cookies,
+            ...(typeof limit === 'number' ? { limit } : {}),
+        });
+    }
+    async socialTwitterReply(accountId, cookies, tweetUrl, text, proxySessionId) {
+        return this.request('POST', '/social/twitter/reply', { account_id: accountId, proxy_session_id: proxySessionId, cookies, tweet_url: tweetUrl, text });
+    }
+    async socialTwitterLike(accountId, cookies, tweetUrl, proxySessionId) {
+        return this.request('POST', '/social/twitter/like', { account_id: accountId, proxy_session_id: proxySessionId, cookies, tweet_url: tweetUrl });
+    }
+    async socialTwitterRetweet(accountId, cookies, tweetUrl, proxySessionId) {
+        return this.request('POST', '/social/twitter/retweet', { account_id: accountId, proxy_session_id: proxySessionId, cookies, tweet_url: tweetUrl });
+    }
+    async socialTwitterFollow(accountId, cookies, targetUser, proxySessionId) {
+        return this.request('POST', '/social/twitter/follow', { account_id: accountId, proxy_session_id: proxySessionId, cookies, target_user: targetUser });
+    }
+    async socialTwitterUnfollow(accountId, cookies, targetUser, proxySessionId) {
+        return this.request('POST', '/social/twitter/unfollow', { account_id: accountId, proxy_session_id: proxySessionId, cookies, target_user: targetUser });
+    }
+    async socialTwitterDelete(accountId, cookies, tweetUrl, proxySessionId) {
+        return this.request('POST', '/social/twitter/delete', { account_id: accountId, proxy_session_id: proxySessionId, cookies, tweet_url: tweetUrl });
+    }
+    async socialTwitterProfile(accountId, cookies, patch, proxySessionId) {
+        return this.request('POST', '/social/twitter/profile', { account_id: accountId, proxy_session_id: proxySessionId, cookies, ...patch });
+    }
+    async socialTwitterAvatar(accountId, cookies, image, proxySessionId) {
+        return this.request('POST', '/social/twitter/avatar', { account_id: accountId, proxy_session_id: proxySessionId, cookies, ...image });
+    }
+    async socialTwitterBanner(accountId, cookies, image, proxySessionId) {
+        return this.request('POST', '/social/twitter/banner', { account_id: accountId, proxy_session_id: proxySessionId, cookies, ...image });
+    }
+    async socialTwitterUsername(accountId, cookies, newUsername, password, proxySessionId) {
+        return this.request('POST', '/social/twitter/username', {
+            account_id: accountId,
+            proxy_session_id: proxySessionId,
+            cookies,
+            new_username: newUsername,
+            password,
+        });
+    }
+    async socialTwitterBuy(country, ageCategory) {
+        return this.request('POST', '/social/twitter/buy', {
+            ...(country ? { country } : {}),
+            ...(ageCategory ? { age_category: ageCategory } : {}),
+        });
+    }
+    // ── TikTok ──
+    /**
+     * Log a TikTok account in. Two paths:
+     *   - Cookie injection: pass `sessionid` (+ optional `tt_csrf_token`, `tt_webid_v2`).
+     *   - Form login:       pass `login` + `password` — server uses CapSolver
+     *                       to handle any captcha and harvests the cookies.
+     * Either path returns the full cookie jar for the caller to cache locally.
+     */
+    async socialTiktokLogin(accountId, opts) {
+        return this.request('POST', '/social/tiktok/login', {
+            account_id: accountId,
+            proxy_session_id: opts.proxySessionId,
+            country: opts.country,
+            sessionid: opts.sessionid,
+            tt_csrf_token: opts.ttCsrfToken,
+            tt_webid_v2: opts.ttWebidV2,
+            extra_cookies: opts.extraCookies,
+            login: opts.login,
+            password: opts.password,
+            email: opts.email,
+            email_password: opts.emailPassword,
+        });
+    }
+    async socialTiktokPost(accountId, cookies, caption, media, opts, proxySessionId, country) {
+        return this.request('POST', '/social/tiktok/post', {
+            account_id: accountId,
+            proxy_session_id: proxySessionId,
+            country,
+            cookies,
+            caption,
+            ...media,
+            ...(opts || {}),
+        });
+    }
+    async socialTiktokFollow(accountId, cookies, targetUser, proxySessionId, country) {
+        return this.request('POST', '/social/tiktok/follow', { account_id: accountId, proxy_session_id: proxySessionId, country, cookies, target_user: targetUser });
+    }
+    async socialTiktokLike(accountId, cookies, videoUrl, proxySessionId, country) {
+        return this.request('POST', '/social/tiktok/like', { account_id: accountId, proxy_session_id: proxySessionId, country, cookies, video_url: videoUrl });
+    }
+    async socialTiktokDelete(accountId, cookies, videoUrl, proxySessionId, country) {
+        return this.request('POST', '/social/tiktok/delete', { account_id: accountId, proxy_session_id: proxySessionId, country, cookies, video_url: videoUrl });
+    }
+    async socialTiktokProfile(accountId, cookies, patch, proxySessionId, country) {
+        return this.request('POST', '/social/tiktok/profile', { account_id: accountId, proxy_session_id: proxySessionId, country, cookies, ...patch });
+    }
+    async socialTiktokAvatar(accountId, cookies, image, proxySessionId, country) {
+        return this.request('POST', '/social/tiktok/avatar', { account_id: accountId, proxy_session_id: proxySessionId, country, cookies, ...image });
+    }
+    // ── Info ──
+    async pricing() {
+        return this.request('GET', '/pricing');
+    }
+    async health() {
+        return this.request('GET', '/health');
+    }
+    // ── i402 — intent layer for x402 ──
+    /**
+     * Generate an i402 plan from a natural-language intent.
+     * Returns the plan body (from the 402 response) or a clarification request.
+     * Auto-pays the $0.10 orchestration fee unless autoPay is disabled.
+     */
+    async chat(intent, options) {
+        const body = {
+            intent,
+            budget_usdc: options.budgetUsdc,
+        };
+        if (options.quality)
+            body.quality = options.quality;
+        if (options.params)
+            body.params = options.params;
+        if (options.constraints)
+            body.constraints = options.constraints;
+        if (options.deadlineSeconds)
+            body.deadline_seconds = options.deadlineSeconds;
+        if (options.approve !== undefined)
+            body.approve = options.approve;
+        if (options.autoApproveUnderUsdc !== undefined)
+            body.auto_approve_under_usdc = options.autoApproveUnderUsdc;
+        const extraHeaders = {};
+        if (options.sessionId)
+            extraHeaders['X-Session-Id'] = options.sessionId;
+        return this.requestWithHeaders('POST', '/chat', body, extraHeaders);
+    }
+    /**
+     * Client-side executor for an i402 plan.
+     *
+     * i402 v0.1 is agent-side-execution-only: the server returns a plan and stops;
+     * this function iterates the plan's steps in topological order, signs a real
+     * x402 payment for each step (via paidRequest), calls the endpoint, resolves
+     * $STEPS.sN.output.field references into later-step inputs locally, and yields
+     * events to the caller so a CLI or agent framework can render progress.
+     *
+     * Every step's x402 payment is a real on-chain transaction signed by this
+     * client's wallet — no server-side escrow, no custodial proxy.
+     *
+     * Usage:
+     *   const plan = await ao.chat("launch a brand", { budgetUsdc: 60 })
+     *   for await (const event of ao.chatExecute(plan)) {
+     *     console.log(event.type, event)
+     *   }
+     */
+    async *chatExecute(plan, options = {}) {
+        if (!plan?.plan_id || !Array.isArray(plan?.steps)) {
+            throw new Error('chatExecute requires a plan returned from chat()');
+        }
+        const stopOnFailure = options.stopOnFailure !== false;
+        yield { type: 'session', sessionId: plan.session_id };
+        yield {
+            type: 'plan',
+            planId: plan.plan_id,
+            steps: plan.steps.map((s) => ({
+                stepId: s.step_id,
+                provider: s.provider,
+                capability: s.capability,
+                costUsdc: s.cost_usdc,
+            })),
+            totalCostUsdc: plan.totals?.total_cost_usdc,
+        };
+        const ordered = topoOrderSteps(plan.steps);
+        const priorOutputs = {};
+        let encounteredFatal = false;
+        let totalSpent = 0;
+        const { paidRequest } = await import('./pay.js');
+        for (const step of ordered) {
+            const resolvedInput = resolveStepInput(step.input, priorOutputs);
+            yield {
+                type: 'step_start',
+                stepId: step.step_id,
+                provider: step.provider,
+                capability: step.capability,
+                costUsdc: step.cost_usdc,
+            };
+            const startMs = Date.now();
+            try {
+                // For social steps, ensure a vault session and replace handle/inject
+                // cookies BEFORE path-param substitution. Credentials only ever live
+                // in this local body — they never enter step.input or any persisted
+                // plan/session record.
+                let injectedInput = resolvedInput;
+                const platform = socialPlatformForCapability(step.capability);
+                if (platform) {
+                    const url0 = new URL(step.x402?.endpoint ?? '');
+                    const apiBase = `${url0.protocol}//${url0.host}`;
+                    const gen = injectSocialCredentials({
+                        platform,
+                        capability: step.capability,
+                        resolvedInput: resolvedInput,
+                        api: apiBase,
+                        passphrase: this.passphrase,
+                    });
+                    while (true) {
+                        const next = await gen.next();
+                        if (next.done) {
+                            injectedInput = next.value;
+                            break;
+                        }
+                        // Surface session_refresh events to the caller and bill them.
+                        if (next.value?.type === 'session_refresh_done') {
+                            totalSpent += Number(next.value.costChargedUsdc ?? 0);
+                        }
+                        yield next.value;
+                    }
+                }
+                // Substitute {placeholder} path params from input → concrete URL + pruned body
+                const { url: concreteUrl, body: postBody } = substitutePathParams(step.x402?.endpoint ?? '', injectedInput);
+                const url = new URL(concreteUrl);
+                const path = url.pathname + url.search;
+                const api = `${url.protocol}//${url.host}`;
+                const method = (step.x402?.method ?? 'POST').toUpperCase();
+                const result = await paidRequest(api, method, path, postBody, this.passphrase);
+                const latencyMs = Date.now() - startMs;
+                const output = result.data;
+                priorOutputs[step.step_id] = output;
+                totalSpent += Number(step.cost_usdc ?? 0);
+                yield {
+                    type: 'step_result',
+                    stepId: step.step_id,
+                    provider: step.provider,
+                    output,
+                    latencyMs,
+                    costChargedUsdc: step.cost_usdc,
+                    txSignature: result.txHash,
+                };
+            }
+            catch (err) {
+                const latencyMs = Date.now() - startMs;
+                const message = err?.message ?? String(err);
+                encounteredFatal = true;
+                yield {
+                    type: 'step_error',
+                    stepId: step.step_id,
+                    provider: step.provider,
+                    error: message,
+                    latencyMs,
+                    fatal: stopOnFailure,
+                };
+                if (stopOnFailure)
+                    break;
+            }
+        }
+        yield {
+            type: 'summary',
+            spentUsdc: totalSpent,
+            status: encounteredFatal ? 'failed' : 'completed',
+        };
+    }
+    async chatGetSession(sessionId) {
+        return this.request('GET', `/chat/${sessionId}`);
+    }
+    async chatCancel(sessionId) {
+        return this.request('POST', `/chat/${sessionId}/cancel`);
+    }
+    async chatListSessions() {
+        return this.request('GET', '/chat');
+    }
+    async chatListCapabilities() {
+        return this.request('GET', '/chat/capabilities');
+    }
+    async chatListProviders(capability) {
+        const qs = capability ? `?capability=${encodeURIComponent(capability)}` : '';
+        return this.request('GET', `/chat/providers${qs}`);
+    }
+    // ── Internal: variant of request() that supports extra headers ──
+    async requestWithHeaders(method, path, body, extraHeaders = {}) {
+        const headers = { 'Content-Type': 'application/json', ...extraHeaders };
+        if (this.token)
+            headers['Authorization'] = `Bearer ${this.token}`;
+        const opts = { method, headers };
+        if (body)
+            opts.body = JSON.stringify(body);
+        const res = await fetch(this.api + path, opts);
+        const contentType = res.headers.get('content-type') || '';
+        let data;
+        if (contentType.includes('application/json')) {
+            data = await res.json().catch(() => ({}));
+        }
+        else {
+            data = {};
+        }
+        if (res.status === 402 && this.autoPay) {
+            try {
+                const { paidRequest } = await import('./pay.js');
+                const result = await paidRequest(this.api, method, path, body, this.passphrase);
+                return result.data;
+            }
+            catch (e) {
+                throw new Error(e.message);
+            }
+        }
+        if (data.error && res.status >= 400)
+            throw new Error(data.error);
+        return data;
+    }
+}
+export default Palmyr;
+//# sourceMappingURL=sdk.js.map