@paybox-sh/sdk 0.1.0 → 0.3.0

package/README.md

@@ -21,9 +21,12 @@ npx @paybox-sh/sdk login     # or use the CLI directly
 
 ```bash
 # Authenticate: OAuth in the browser (approve with a passkey), or store a key.
-paybox login                              # OAuth 2.1 + PKCE loopback
-paybox login --key pbx_live_…             # personal API key instead
-paybox login --signing-key pbxk1.…        # add a wallet signing key (sign/swap)
+# `paybox login` is a guided two-step: OAuth, then it opens the app to provision
+# a wallet signing key and prompts you to paste the `pbxk1.` token back.
+paybox login                              # OAuth 2.1 + PKCE, then provision a key
+paybox login --no-provision               # OAuth only, skip the key step
+paybox login --key pbx_live_…             # personal API key instead (no OAuth)
+paybox login --signing-key pbxk1.…        # supply the signing key non-interactively
 
 paybox credentials                        # list usable credentials
 paybox pay --credential <id> --merchant Acme --url https://acme.com --amount 1999
@@ -36,9 +39,19 @@ paybox swap --credential <id> --src-chain eip155:8453 \
 paybox portfolio --address 0x… --networks 1,8453
 paybox request <request_id> --wait        # poll a pending request
 
+paybox version                            # installed version (+ update check)
+paybox update                             # update the global install to latest
+paybox uninstall                          # clear stored config (prints npm rm)
+
 paybox --json credentials                 # machine-readable output on any command
 ```
 
+`version`/`update`/`uninstall` are conveniences over npm: `update` runs
+`npm i -g @paybox-sh/sdk@latest` (use `--print` to just show it); `uninstall`
+clears `~/.config/paybox` and prints the `npm rm -g` line (a package can't remove
+its own binary). For project installs use `pnpm up`/`pnpm rm`, or `npx
+@paybox-sh/sdk@latest` to always run the latest without installing.
+
 `sign` and `swap` complete in-process when a `pbxk1.` signing key is configured
 and the operation clears immediately (autonomous grant). When the grant requires
 approval, the command returns `pending_approval`; approve in the app, then

package/dist/{chunk-23N5RHOB.js → chunk-KUOJ5BXR.js}

@@ -5,6 +5,21 @@ import { createServer } from "node:http";
 function mcpResource(baseUrl) {
   return `${baseUrl.replace(/\/+$/, "")}/mcp`;
 }
+function appBaseFrom(baseUrl, override) {
+  if (override) return override.replace(/\/+$/, "");
+  const m = baseUrl.replace(/\/+$/, "").match(/^(https?:\/\/)api\.(.+)$/);
+  return m ? `${m[1]}app.${m[2]}` : null;
+}
+function agentClientId(accessToken) {
+  const payload = accessToken.split(".")[1];
+  if (!payload) return null;
+  try {
+    const claims = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+    return claims.cid ?? null;
+  } catch {
+    return null;
+  }
+}
 async function metadata(baseUrl) {
   const url = `${baseUrl.replace(/\/+$/, "")}/.well-known/oauth-authorization-server`;
   const res = await fetch(url);
@@ -199,7 +214,7 @@ function parseToken(input) {
 }
 
 // node_modules/.pnpm/@paybox+mcp-app@file+..+mcp-app_@modelcontextprotocol+sdk@1.29.0_zod@4.4.3__bn.js@5.2.3_ac1e09a20c76a1143611be5dd3d4f9db/node_modules/@paybox/mcp-app/src/sign.ts
-import { Buffer } from "buffer";
+import { Buffer as Buffer2 } from "buffer";
 import nacl from "tweetnacl";
 import { MoonXEvmSigner, EvmSchemeMismatchError } from "@moon-x/evm-adapter";
 import { MoonXSolanaSigner, SolanaSchemeMismatchError } from "@moon-x/solana-adapter";
@@ -219,10 +234,10 @@ function reviveTx(w) {
   };
 }
 function hexToBytes(hex) {
-  return new Uint8Array(Buffer.from(hex.replace(/^0x/, ""), "hex"));
+  return new Uint8Array(Buffer2.from(hex.replace(/^0x/, ""), "hex"));
 }
 function bytesToHex(bytes) {
-  return Buffer.from(bytes).toString("hex");
+  return Buffer2.from(bytes).toString("hex");
 }
 function buildEnvelope(rawSigningPayloadHex, binding, creds) {
   const signedPayload = {
@@ -243,7 +258,7 @@ function eip1559SigningHash(tx) {
   return keccak256(serializeTransaction(reviveTx(tx)));
 }
 function solanaSigningPayload(base64Tx) {
-  const raw = Buffer.from(base64Tx, "base64");
+  const raw = Buffer2.from(base64Tx, "base64");
   let i = 0;
   let sigCount = 0;
   let shift = 0;
@@ -351,13 +366,13 @@ async function signIntent(intent, creds, binding, transport) {
         return { ok: true, artifact: { signature: bytesToHex(sig) } };
       }
       case "solanaTransaction": {
-        const tx = Transaction.from(Buffer.from(intent.transactionBase64, "base64"));
+        const tx = Transaction.from(Buffer2.from(intent.transactionBase64, "base64"));
         const signed = await new MoonXSolanaSigner(ed25519Sign, intent.address).signTransaction(
           tx
         );
         return {
           ok: true,
-          artifact: { signedTransactionBase64: Buffer.from(signed).toString("base64") }
+          artifact: { signedTransactionBase64: Buffer2.from(signed).toString("base64") }
         };
       }
       case "raw": {
@@ -609,8 +624,12 @@ var PayboxClient = class _PayboxClient {
 
 export {
   mcpResource,
+  appBaseFrom,
+  agentClientId,
+  openBrowser,
   loginLoopback,
   refreshTokens,
+  configDir,
   configFile,
   loadConfig,
   saveConfig,
@@ -618,4 +637,4 @@ export {
   PayboxError,
   PayboxClient
 };
-//# sourceMappingURL=chunk-23N5RHOB.js.map
+//# sourceMappingURL=chunk-KUOJ5BXR.js.map

package/dist/chunk-KUOJ5BXR.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/auth.ts","../src/config.ts","../node_modules/.pnpm/@paybox+mcp-app@file+..+mcp-app_@modelcontextprotocol+sdk@1.29.0_zod@4.4.3__bn.js@5.2.3_ac1e09a20c76a1143611be5dd3d4f9db/node_modules/@paybox/mcp-app/src/creds.ts","../node_modules/.pnpm/@paybox+mcp-app@file+..+mcp-app_@modelcontextprotocol+sdk@1.29.0_zod@4.4.3__bn.js@5.2.3_ac1e09a20c76a1143611be5dd3d4f9db/node_modules/@paybox/mcp-app/src/sign.ts","../src/signer.ts","../src/client.ts"],"sourcesContent":["// OAuth 2.1 + PKCE loopback login for the CLI, and refresh-token rotation.\n//\n// The server allows http://127.0.0.1:* loopback redirects, dynamic ports, public\n// (no-secret) PKCE clients, and refresh tokens for `offline_access` — so this is\n// a standard loopback flow needing no server changes. The user approves with a\n// passkey in the browser (the existing app consent flow); the CLI never sees a\n// secret to copy.\n\nimport { spawn } from \"node:child_process\";\nimport { createHash, randomBytes } from \"node:crypto\";\nimport { createServer } from \"node:http\";\nimport type { AddressInfo } from \"node:net\";\n\nimport type { OAuthTokens } from \"./config.js\";\n\n/** The MCP resource the access token is audience-bound to. */\nexport function mcpResource(baseUrl: string): string {\n  return `${baseUrl.replace(/\\/+$/, \"\")}/mcp`;\n}\n\n/** The Paybox app origin (where signing keys are provisioned), derived from the\n *  API origin by swapping the `api.` subdomain for `app.` (e.g.\n *  api.paybox.sh → app.paybox.sh). Returns null when it can't be derived (e.g.\n *  localhost) — pass an explicit override then. */\nexport function appBaseFrom(baseUrl: string, override?: string): string | null {\n  if (override) return override.replace(/\\/+$/, \"\");\n  const m = baseUrl.replace(/\\/+$/, \"\").match(/^(https?:\\/\\/)api\\.(.+)$/);\n  return m ? `${m[1]}app.${m[2]}` : null;\n}\n\n/** Read the paybox agent client id (`cid`) from an OAuth access token (JWT). */\nexport function agentClientId(accessToken: string): string | null {\n  const payload = accessToken.split(\".\")[1];\n  if (!payload) return null;\n  try {\n    const claims = JSON.parse(Buffer.from(payload, \"base64url\").toString(\"utf8\")) as {\n      cid?: string;\n    };\n    return claims.cid ?? null;\n  } catch {\n    return null;\n  }\n}\n\ninterface AsMetadata {\n  registration_endpoint: string;\n  authorization_endpoint: string;\n  token_endpoint: string;\n}\n\nasync function metadata(baseUrl: string): Promise<AsMetadata> {\n  const url = `${baseUrl.replace(/\\/+$/, \"\")}/.well-known/oauth-authorization-server`;\n  const res = await fetch(url);\n  if (!res.ok) {\n    throw new Error(`could not read OAuth metadata from ${url} (${res.status})`);\n  }\n  return (await res.json()) as AsMetadata;\n}\n\nfunction base64url(b: Buffer): string {\n  return b.toString(\"base64url\");\n}\n\nfunction pkce(): { verifier: string; challenge: string } {\n  const verifier = base64url(randomBytes(32));\n  const challenge = base64url(createHash(\"sha256\").update(verifier).digest());\n  return { verifier, challenge };\n}\n\nexport function openBrowser(url: string): void {\n  // On Windows, `cmd /c start <url>` mis-parses the OAuth URL: cmd treats the\n  // `&` before each query param as a command separator. rundll32 opens the\n  // default browser with the URL passed verbatim, no shell parsing.\n  const [cmd, args] =\n    process.platform === \"darwin\"\n      ? ([\"open\", [url]] as const)\n      : process.platform === \"win32\"\n        ? ([\"rundll32\", [\"url.dll,FileProtocolHandler\", url]] as const)\n        : ([\"xdg-open\", [url]] as const);\n  try {\n    spawn(cmd, [...args], { stdio: \"ignore\", detached: true }).unref();\n  } catch {\n    /* fall back to the printed URL */\n  }\n}\n\nconst CALLBACK_PAGE =\n  \"<!doctype html><meta charset=utf-8><title>Paybox</title>\" +\n  \"<body style=\\\"font:16px system-ui;padding:3rem;text-align:center\\\">\" +\n  \"<h2>Paybox CLI connected</h2><p>You can close this tab and return to the terminal.</p>\";\n\nexport interface LoginOptions {\n  scope?: string;\n  clientName?: string;\n  /** Sink for the \"open this URL\" prompt; defaults to console.error. */\n  log?: (msg: string) => void;\n  /** Abort with an error if no approval arrives in this long. Default 5 min. */\n  timeoutMs?: number;\n}\n\nexport async function loginLoopback(\n  baseUrl: string,\n  opts: LoginOptions = {},\n): Promise<OAuthTokens> {\n  const scope = opts.scope ?? \"mcp offline_access\";\n  const clientName = opts.clientName ?? \"Paybox CLI\";\n  const log = opts.log ?? ((m: string) => console.error(m));\n  const meta = await metadata(baseUrl);\n  const resource = mcpResource(baseUrl);\n\n  let resolveCode: (v: { code: string; state: string | null }) => void;\n  let rejectCode: (e: Error) => void;\n  const codePromise = new Promise<{ code: string; state: string | null }>((res, rej) => {\n    resolveCode = res;\n    rejectCode = rej;\n  });\n\n  const server = createServer((req, res) => {\n    const u = new URL(req.url ?? \"/\", \"http://127.0.0.1\");\n    if (u.pathname !== \"/callback\") {\n      res.writeHead(404).end();\n      return;\n    }\n    res.writeHead(200, { \"content-type\": \"text/html\" }).end(CALLBACK_PAGE);\n    const code = u.searchParams.get(\"code\");\n    if (code) resolveCode({ code, state: u.searchParams.get(\"state\") });\n    else rejectCode(new Error(u.searchParams.get(\"error\") ?? \"authorization failed\"));\n  });\n  await new Promise<void>((r) => server.listen(0, \"127.0.0.1\", r));\n  const port = (server.address() as AddressInfo).port;\n  const redirectUri = `http://127.0.0.1:${port}/callback`;\n\n  const timeoutMs = opts.timeoutMs ?? 300_000;\n  const timer = setTimeout(\n    () => rejectCode(new Error(`login timed out after ${Math.round(timeoutMs / 1000)}s — no approval received`)),\n    timeoutMs,\n  );\n  timer.unref();\n\n  try {\n    const reg = await fetch(meta.registration_endpoint, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/json\" },\n      body: JSON.stringify({\n        client_name: clientName,\n        redirect_uris: [redirectUri],\n        token_endpoint_auth_method: \"none\",\n        grant_types: [\"authorization_code\", \"refresh_token\"],\n        response_types: [\"code\"],\n      }),\n    });\n    if (!reg.ok) throw new Error(`client registration failed (${reg.status}): ${await reg.text()}`);\n    const { client_id: clientId } = (await reg.json()) as { client_id: string };\n\n    const { verifier, challenge } = pkce();\n    const state = base64url(randomBytes(16));\n    const authUrl =\n      `${meta.authorization_endpoint}?response_type=code` +\n      `&client_id=${encodeURIComponent(clientId)}` +\n      `&redirect_uri=${encodeURIComponent(redirectUri)}` +\n      `&code_challenge=${challenge}&code_challenge_method=S256` +\n      `&scope=${encodeURIComponent(scope)}` +\n      `&state=${state}&resource=${encodeURIComponent(resource)}`;\n\n    log(`Opening your browser to approve access:\\n  ${authUrl}\\n`);\n    openBrowser(authUrl);\n\n    const { code, state: returnedState } = await codePromise;\n    if (returnedState !== state) throw new Error(\"OAuth state mismatch — aborting\");\n\n    const form = new URLSearchParams({\n      grant_type: \"authorization_code\",\n      code,\n      redirect_uri: redirectUri,\n      client_id: clientId,\n      code_verifier: verifier,\n      resource,\n    });\n    const tok = await fetch(meta.token_endpoint, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n      body: form,\n    });\n    if (!tok.ok) throw new Error(`token exchange failed (${tok.status}): ${await tok.text()}`);\n    const t = (await tok.json()) as {\n      access_token: string;\n      refresh_token?: string;\n      expires_in?: number;\n    };\n    return {\n      clientId,\n      accessToken: t.access_token,\n      refreshToken: t.refresh_token,\n      expiresAt: t.expires_in ? Date.now() + t.expires_in * 1000 : undefined,\n      resource,\n    };\n  } finally {\n    clearTimeout(timer);\n    server.close();\n  }\n}\n\nexport async function refreshTokens(baseUrl: string, current: OAuthTokens): Promise<OAuthTokens> {\n  if (!current.refreshToken) throw new Error(\"no refresh token — run `paybox login` again\");\n  const meta = await metadata(baseUrl);\n  const resource = current.resource ?? mcpResource(baseUrl);\n  const form = new URLSearchParams({\n    grant_type: \"refresh_token\",\n    refresh_token: current.refreshToken,\n    client_id: current.clientId,\n    resource,\n  });\n  const res = await fetch(meta.token_endpoint, {\n    method: \"POST\",\n    headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n    body: form,\n  });\n  if (!res.ok) throw new Error(`token refresh failed (${res.status}): ${await res.text()}`);\n  const t = (await res.json()) as {\n    access_token: string;\n    refresh_token?: string;\n    expires_in?: number;\n  };\n  return {\n    ...current,\n    accessToken: t.access_token,\n    refreshToken: t.refresh_token ?? current.refreshToken,\n    expiresAt: t.expires_in ? Date.now() + t.expires_in * 1000 : undefined,\n    resource,\n  };\n}\n","// On-disk config: OAuth tokens, an optional pbx_live_ key, and an optional\n// pbxk1. signing key. Stored at ~/.config/paybox/config.json, mode 0600 (the\n// signing key is as sensitive as the iframe's localStorage copy).\n\nimport { chmodSync, mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { join } from \"node:path\";\n\nexport interface OAuthTokens {\n  clientId: string;\n  accessToken: string;\n  refreshToken?: string;\n  /** Epoch millis the access token expires. */\n  expiresAt?: number;\n  /** The audience the token is bound to (`<baseUrl>/mcp`). */\n  resource: string;\n}\n\nexport interface StoredConfig {\n  baseUrl?: string;\n  /** Paybox app origin used for signing-key provisioning (derived from baseUrl\n   *  when unset). */\n  appUrl?: string;\n  apiKey?: string;\n  oauth?: OAuthTokens;\n  signingKey?: string;\n}\n\nexport function configDir(): string {\n  if (process.env.PAYBOX_CONFIG_DIR) return process.env.PAYBOX_CONFIG_DIR;\n  const base = process.env.XDG_CONFIG_HOME ?? join(homedir(), \".config\");\n  return join(base, \"paybox\");\n}\n\nexport function configFile(): string {\n  return join(configDir(), \"config.json\");\n}\n\nexport function loadConfig(): StoredConfig {\n  try {\n    return JSON.parse(readFileSync(configFile(), \"utf8\")) as StoredConfig;\n  } catch {\n    return {};\n  }\n}\n\nexport function saveConfig(config: StoredConfig): void {\n  // 0700/0600 protect the signing key + refresh token on POSIX. On Windows the\n  // mode bits don't set ACLs (see README) — the file is not access-restricted.\n  mkdirSync(configDir(), { recursive: true, mode: 0o700 });\n  writeFileSync(configFile(), `${JSON.stringify(config, null, 2)}\\n`, { mode: 0o600 });\n  // writeFileSync's mode only applies on create; chmod also re-tightens an\n  // existing file on overwrite. Skip it on Windows where it's a no-op.\n  if (process.platform !== \"win32\") chmodSync(configFile(), 0o600);\n}\n","// localStorage-backed credential store.\n//\n// The agent's MoonX ephemeral-signer KEYPAIR lives ONLY here, in this iframe's\n// localStorage, scoped to the server-declared stable origin (`_meta.ui.domain`).\n// It is read into memory only to produce a signature and is sent ONLY to the\n// MoonX API — never to paybox or the AI assistant.\n//\n// Note what is NOT here: the `walletId` (MoonX `provider_wallet_id`). That is\n// not secret and paybox already holds it from the granted credential, so it\n// rides the `request_wallet_sign` operation instead of the pasted key. The user\n// therefore only pastes one thing: a single token carrying the keypair.\n\nconst STORAGE_KEY = \"paybox.walletSign.creds.v2\";\n\n/** The one-string token prefix. The body is base64url(JSON{p,s}). */\nexport const TOKEN_PREFIX = \"pbxk1.\";\n\n/** The agent's MoonX ephemeral-signer keypair. */\nexport interface Creds {\n  /** Ephemeral-signer API public key, hex (optional 0x prefix). */\n  apiPubHex: string;\n  /** Ephemeral-signer API private key, hex (optional 0x prefix). */\n  apiPrivHex: string;\n  /** Epoch millis the credential was saved. */\n  savedAt: number;\n}\n\n/**\n * Feature-detect a usable localStorage. Some hosts sandbox the iframe with an\n * opaque origin where storage access throws; we degrade to in-session entry.\n */\nexport function hasStorage(): boolean {\n  try {\n    const probe = \"__paybox_probe__\";\n    window.localStorage.setItem(probe, \"1\");\n    window.localStorage.removeItem(probe);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/** Load saved creds, or null if absent / unreadable / malformed. */\nexport function load(): Creds | null {\n  try {\n    const raw = window.localStorage.getItem(STORAGE_KEY);\n    if (!raw) return null;\n    const parsed = JSON.parse(raw) as Partial<Creds>;\n    if (\n      typeof parsed.apiPubHex === \"string\" &&\n      typeof parsed.apiPrivHex === \"string\" &&\n      parsed.apiPubHex &&\n      parsed.apiPrivHex\n    ) {\n      return {\n        apiPubHex: parsed.apiPubHex,\n        apiPrivHex: parsed.apiPrivHex,\n        savedAt: typeof parsed.savedAt === \"number\" ? parsed.savedAt : 0,\n      };\n    }\n    return null;\n  } catch {\n    return null;\n  }\n}\n\n/** Persist creds. Silently no-ops if storage is unavailable. */\nexport function save(c: Omit<Creds, \"savedAt\"> & { savedAt?: number }): void {\n  try {\n    const toStore: Creds = {\n      apiPubHex: c.apiPubHex,\n      apiPrivHex: c.apiPrivHex,\n      savedAt: c.savedAt ?? Date.now(),\n    };\n    window.localStorage.setItem(STORAGE_KEY, JSON.stringify(toStore));\n  } catch {\n    /* storage unavailable — caller keeps creds in memory for this session */\n  }\n}\n\n/** Forget the credential on this device. */\nexport function clear(): void {\n  try {\n    window.localStorage.removeItem(STORAGE_KEY);\n  } catch {\n    /* nothing to clear if storage is unavailable */\n  }\n}\n\n/**\n * Validate a hex string (optional 0x prefix, even length, hex digits only).\n * Returns an error string for display, or null when valid.\n */\nexport function validateHex(s: string, label: string): string | null {\n  const trimmed = s.trim();\n  if (!trimmed) return `${label} is required`;\n  const body = trimmed.startsWith(\"0x\") || trimmed.startsWith(\"0X\") ? trimmed.slice(2) : trimmed;\n  if (body.length === 0) return `${label} is empty`;\n  if (body.length % 2 !== 0) return `${label} must have an even number of hex digits`;\n  if (!/^[0-9a-fA-F]+$/.test(body)) return `${label} must be hexadecimal`;\n  return null;\n}\n\n// ---------------------------------------------------------------------------\n// One-string token codec — the single value the user copies from the paybox\n// app (OAuth consent / Agents) and pastes here. Format:\n//   pbxk1.<base64url(JSON.stringify({ p: apiPubHex, s: apiPrivHex }))>\n// It carries the keypair only — no walletId, no publishable key. It is the raw\n// secret in transit (same trust model as showing the key): it leaves the app\n// via the clipboard and is pasted here; it never goes to paybox.\n// ---------------------------------------------------------------------------\n\nfunction b64urlEncode(s: string): string {\n  return btoa(s).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\nfunction b64urlDecode(s: string): string {\n  let b = s.replace(/-/g, \"+\").replace(/_/g, \"/\");\n  while (b.length % 4) b += \"=\";\n  return atob(b);\n}\n\n/** Encode a keypair into the one-string token (mirrors the app side). */\nexport function encodeToken(c: { apiPubHex: string; apiPrivHex: string }): string {\n  return TOKEN_PREFIX + b64urlEncode(JSON.stringify({ p: c.apiPubHex, s: c.apiPrivHex }));\n}\n\n/**\n * Parse a pasted token into a keypair, or null if it isn't a well-formed token\n * with two hex values. Accepts the canonical `pbxk1.` token and also tolerates\n * a bare base64url(JSON) body (in case the prefix is stripped on copy/paste).\n */\nexport function parseToken(input: string): { apiPubHex: string; apiPrivHex: string } | null {\n  const t = input.trim();\n  if (!t) return null;\n  const body = t.startsWith(TOKEN_PREFIX) ? t.slice(TOKEN_PREFIX.length) : t;\n  let obj: unknown;\n  try {\n    obj = JSON.parse(b64urlDecode(body));\n  } catch {\n    return null;\n  }\n  if (!obj || typeof obj !== \"object\") return null;\n  const o = obj as Record<string, unknown>;\n  const apiPubHex = String(o.p ?? o.apiPubHex ?? \"\").trim();\n  const apiPrivHex = String(o.s ?? o.apiPrivHex ?? \"\").trim();\n  if (!apiPubHex || !apiPrivHex) return null;\n  if (validateHex(apiPubHex, \"key\") || validateHex(apiPrivHex, \"key\")) return null;\n  return { apiPubHex, apiPrivHex };\n}\n","// The signing core: intent → MoonX ephemeral-signer signature → artifact.\n//\n// SPLIT-TRUST signing (the whole point of this design):\n//   - This iframe holds the agent KEYPAIR (apiPub/apiPriv, from the pasted\n//     pbxk1 token) and NOTHING ELSE. It builds the chain-specific digest, then\n//     builds the MoonX request envelope and ed25519-signs it with apiPriv.\n//   - It does NOT call MoonX and does NOT hold the MoonX secret key. The\n//     secret-gated `/sign` HTTP call happens SERVER-SIDE, via the paybox\n//     `moonx_sign` MCP tool (see `transport`). paybox adds the secret key,\n//     which never reaches the browser.\n//\n// We reuse the @moon-x adapters purely for their CHAIN LOGIC (digest building +\n// signature assembly) by constructing them with a custom sign fn:\n//   - EVM:    new MoonXEvmSigner(ecdsaSign)   — ecdsaSign: (digest) => {r,s,yParity}\n//   - Solana: new MoonXSolanaSigner(ed25519Sign, address) — (bytes) => Uint8Array\n// Our custom fns build + ed25519-sign the envelope and delegate the actual\n// signing to `transport` (the moonx_sign tool). The envelope format mirrors\n// @moon-x/core's signWithEphemeralSigner exactly.\n//\n// The artifact returned is EXACTLY the old shape per op, so the paybox server\n// (which stores it via submit_signature) is unaffected.\n\nimport { Buffer } from \"buffer\";\nimport nacl from \"tweetnacl\";\nimport { MoonXEvmSigner, EvmSchemeMismatchError } from \"@moon-x/evm-adapter\";\nimport { MoonXSolanaSigner, SolanaSchemeMismatchError } from \"@moon-x/solana-adapter\";\nimport { Transaction } from \"@solana/web3.js\";\nimport { keccak256, serializeTransaction } from \"viem\";\nimport type {\n  Authorization,\n  TransactionSerializable,\n  TypedDataDefinition,\n} from \"viem\";\n\nimport type { Creds } from \"./creds.js\";\n\n// Transactions carry bigints (value/gas/fees), which JSON can't represent —\n// they arrive as decimal strings and are revived here. Mirrors the old path.\nexport interface WireTx {\n  to: `0x${string}`;\n  value: string;\n  data?: `0x${string}`;\n  chainId: number;\n  gas: string;\n  maxPriorityFeePerGas: string;\n  maxFeePerGas: string;\n  nonce: number;\n}\n\n/**\n * The intent to sign — the `op` discriminator + op-specific fields. The host\n * delivers this as `operation.intent` in the `request_wallet_sign` tool result.\n */\nexport type SignIntent =\n  | { op: \"message\"; message: string }\n  | { op: \"typedData\"; typedData: TypedDataDefinition }\n  | { op: \"transaction\"; transaction: WireTx }\n  | { op: \"authorization\"; authorization: Authorization }\n  | { op: \"solanaMessage\"; address: string; message: string }\n  | { op: \"solanaTransaction\"; address: string; transactionBase64: string }\n  | { op: \"raw\"; rawSigningPayloadHex: string };\n\n/** The wallet's MoonX binding, supplied by paybox on the request (NOT the\n *  pasted key). `keyId`/`derivationPath` are captured at provision time. */\nexport interface WalletBinding {\n  walletId: string;\n  keyId: string;\n  derivationPath: string;\n}\n\n/** MoonX's raw `/sign` response, relayed back through the moonx_sign tool. */\nexport interface MoonxSignResult {\n  scheme: string;\n  signature: {\n    /** ECDSA: lowercase-hex r/s (no 0x) + recovery_id 0..3. */\n    r?: string;\n    s?: string;\n    recovery_id?: number;\n    /** Ed25519: lowercase-hex 64-byte signature. */\n    signature?: string;\n  };\n}\n\n/**\n * Performs the secret-gated MoonX `/sign` call on the server. Given the envelope\n * this iframe built + signed, it returns MoonX's raw signature. Implemented by\n * the UI layer as a `moonx_sign` MCP tool call (the server adds the secret key\n * + the request_id/api_pub binding).\n */\nexport type MoonxSignTransport = (envelope: {\n  signed_body: string;\n  agent_signature: string;\n}) => Promise<MoonxSignResult>;\n\nexport type SignArtifactResult =\n  | { ok: true; artifact: Record<string, unknown> }\n  | { ok: false; error: string };\n\nfunction reviveTx(w: WireTx): TransactionSerializable {\n  return {\n    type: \"eip1559\",\n    to: w.to,\n    value: BigInt(w.value),\n    data: w.data,\n    chainId: w.chainId,\n    gas: BigInt(w.gas),\n    maxPriorityFeePerGas: BigInt(w.maxPriorityFeePerGas),\n    maxFeePerGas: BigInt(w.maxFeePerGas),\n    nonce: w.nonce,\n  };\n}\n\nfunction hexToBytes(hex: string): Uint8Array {\n  return new Uint8Array(Buffer.from(hex.replace(/^0x/, \"\"), \"hex\"));\n}\nfunction bytesToHex(bytes: Uint8Array): string {\n  return Buffer.from(bytes).toString(\"hex\");\n}\n\n/**\n * Build the MoonX `/sign` envelope and ed25519-sign it with the agent key.\n * Mirrors @moon-x/core `signWithEphemeralSigner` byte-for-byte: the signature\n * is over the UTF-8 JSON `{raw_signing_payload, key_id, derivation_path,\n * issued_at}` and `signed_body` is the hex of those exact bytes.\n */\nfunction buildEnvelope(\n  rawSigningPayloadHex: string,\n  binding: WalletBinding,\n  creds: Creds,\n): { signed_body: string; agent_signature: string } {\n  const signedPayload = {\n    raw_signing_payload: rawSigningPayloadHex.replace(/^0x/, \"\").toLowerCase(),\n    key_id: binding.keyId,\n    derivation_path: binding.derivationPath,\n    issued_at: new Date().toISOString(),\n  };\n  const signedBodyBytes = new TextEncoder().encode(JSON.stringify(signedPayload));\n  // apiPrivHex is the 32-byte Ed25519 seed (64 hex chars).\n  const keyPair = nacl.sign.keyPair.fromSeed(hexToBytes(creds.apiPrivHex));\n  const agentSig = nacl.sign.detached(signedBodyBytes, keyPair.secretKey);\n  return {\n    signed_body: bytesToHex(signedBodyBytes),\n    agent_signature: bytesToHex(agentSig),\n  };\n}\n\n/**\n * The EIP-1559 signing hash for an unsigned tx — `keccak256` of the typed,\n * RLP-serialized unsigned transaction. Matches the server's\n * `eth_tx::signing_hash` (alloy) byte-for-byte, so the agent signature is over\n * the exact digest the server re-derives, validates, and asks MoonX to sign.\n */\nexport function eip1559SigningHash(tx: WireTx): `0x${string}` {\n  return keccak256(serializeTransaction(reviveTx(tx)));\n}\n\n/**\n * The Solana signing payload (hex): the tx message — everything after the single\n * zeroed signature slot in `[shortvec sig_count=1][64-byte slot][message…]`.\n * MUST match the server's `solana::signing_payload` byte-for-byte.\n */\nexport function solanaSigningPayload(base64Tx: string): string {\n  const raw = Buffer.from(base64Tx, \"base64\");\n  // Decode the compact-u16 (\"shortvec\") signature count.\n  let i = 0;\n  let sigCount = 0;\n  let shift = 0;\n  for (;;) {\n    const b = raw[i++];\n    sigCount |= (b & 0x7f) << shift;\n    if ((b & 0x80) === 0) break;\n    shift += 7;\n  }\n  if (sigCount !== 1) {\n    throw new Error(`expected a single-signer solana tx, got ${sigCount} signature slot(s)`);\n  }\n  return bytesToHex(new Uint8Array(raw.subarray(i + 64)));\n}\n\n/** One agent-signed signing envelope for the server-completes swap path. */\nexport interface TxEnvelope {\n  api_pub: string;\n  signed_body: string;\n  agent_signature: string;\n}\n\n/** A sign-ready tx from the swap plan: an EVM `WireTx` (eip1559 fields), or a\n *  base64 Solana tx string tagged `vm:\"solana\"`. */\nexport interface PlanTx {\n  vm?: string;\n  transaction: WireTx | string;\n}\n\n/**\n * One agent-signed envelope per parked tx for `submit_envelope` — NO tx bytes,\n * just the agent signature over each tx's payload (EVM: EIP-1559 sighash;\n * Solana: the tx message). Throws if the wallet isn't provisioned.\n */\nexport function buildSwapEnvelopes(\n  txs: PlanTx[],\n  binding: WalletBinding,\n  creds: Creds,\n): TxEnvelope[] {\n  if (!binding.walletId) {\n    throw new Error(\"paybox did not supply a wallet id for this operation.\");\n  }\n  if (!binding.keyId || !binding.derivationPath) {\n    throw new Error(\n      \"This wallet isn't provisioned for signing yet (missing key binding). \" +\n        \"Re-provision it in the paybox app, then retry.\",\n    );\n  }\n  return txs.map((t) => {\n    const payload =\n      t.vm === \"solana\"\n        ? solanaSigningPayload(t.transaction as string)\n        : eip1559SigningHash(t.transaction as WireTx);\n    const { signed_body, agent_signature } = buildEnvelope(payload, binding, creds);\n    return { api_pub: creds.apiPubHex, signed_body, agent_signature };\n  });\n}\n\n/** A gasless (SPE-248) prepared digest the iframe must sign: the runtime digest\n *  `wallet_prepareCalls` returned (`signatureRequest.rawPayload`) plus its kind.\n *  `userOp` is the ERC-4337 UserOp hash; `authorization` is the EIP-7702\n *  authorization hash, present only on a wallet's first (delegating) gasless op. */\nexport interface GaslessDigest {\n  kind: \"userOp\" | \"authorization\";\n  /** The 32-byte digest as hex (Alchemy's `signatureRequest.rawPayload`). */\n  rawPayloadHex: string;\n}\n\n/**\n * Build one agent-signed envelope per gasless digest, for the server-completes\n * gasless path (SPE-248). The UserOp hash and the EIP-7702 authorization hash\n * are produced SERVER-SIDE at runtime by Alchemy's `wallet_prepareCalls`, so —\n * unlike a raw EVM tx — the iframe can't derive them; it signs the digests\n * Alchemy already computed (`signatureRequest.rawPayload`), exactly the\n * `WalletSignIntent::Raw` mechanism (`buildEnvelope(rawSigningPayloadHex)`). The\n * server (`gasless::sign_digest`) matches each envelope to a prepared item by\n * `raw_signing_payload`, runs the secret-gated MoonX `/sign`, assembles the\n * secp256k1 `r‖s‖v`, and submits via `wallet_sendPreparedCalls`.\n *\n * Both kinds sign as a raw digest here — the server already has Alchemy's auth\n * hash, so the iframe does NOT re-derive it from an `Authorization` object (the\n * interactive `request_wallet_sign` `authorization` op does that, for an agent\n * signing a standalone 7702 auth; the gasless batch path signs the prepared\n * digest directly). `runSwap` calls this (over `plan.gasless`) instead of\n * `buildSwapEnvelopes` for a gasless-quoted swap. Throws if the wallet isn't\n * provisioned.\n */\nexport function buildGaslessEnvelopes(\n  digests: GaslessDigest[],\n  binding: WalletBinding,\n  creds: Creds,\n): TxEnvelope[] {\n  if (!binding.walletId) {\n    throw new Error(\"paybox did not supply a wallet id for this operation.\");\n  }\n  if (!binding.keyId || !binding.derivationPath) {\n    throw new Error(\n      \"This wallet isn't provisioned for signing yet (missing key binding). \" +\n        \"Re-provision it in the paybox app, then retry.\",\n    );\n  }\n  return digests.map((d) => {\n    const { signed_body, agent_signature } = buildEnvelope(d.rawPayloadHex, binding, creds);\n    return { api_pub: creds.apiPubHex, signed_body, agent_signature };\n  });\n}\n\n/** Resolve a wallet binding (`key_id` + `derivation_path`) the authoritative\n *  way — via the server's secret-gated `/me/wallets`. Used when paybox hasn't\n *  pre-captured the binding (ambiguous grant). The iframe ed25519-signs an\n *  `{issued_at}` envelope; `resolve` (a `moonx_resolve_binding` tool call)\n *  returns the binding for the request's wallet. */\nexport type ResolveBindingTransport = (envelope: {\n  signed_body: string;\n  agent_signature: string;\n}) => Promise<{ key_id?: string; derivation_path?: string }>;\n\n/**\n * Build + ed25519-sign an `{issued_at}` envelope with the agent key. Used for\n * the secret-gated tools that authenticate the signer without a chain payload —\n * `moonx_resolve_binding` and `prepare_swap`. Mirrors the server's expectation:\n * the signature is over the UTF-8 JSON `{issued_at}` and `signed_body` is its hex.\n */\nexport function buildIssuedAtEnvelope(creds: Creds): {\n  signed_body: string;\n  agent_signature: string;\n} {\n  const signedBodyBytes = new TextEncoder().encode(\n    JSON.stringify({ issued_at: new Date().toISOString() }),\n  );\n  const keyPair = nacl.sign.keyPair.fromSeed(hexToBytes(creds.apiPrivHex));\n  const agentSig = nacl.sign.detached(signedBodyBytes, keyPair.secretKey);\n  return {\n    signed_body: bytesToHex(signedBodyBytes),\n    agent_signature: bytesToHex(agentSig),\n  };\n}\n\nexport async function resolveWalletBinding(\n  creds: Creds,\n  resolve: ResolveBindingTransport,\n): Promise<{ keyId: string; derivationPath: string }> {\n  const res = await resolve(buildIssuedAtEnvelope(creds));\n  if (!res.key_id || !res.derivation_path) {\n    throw new Error(\"MoonX returned no binding for this wallet\");\n  }\n  return { keyId: res.key_id, derivationPath: res.derivation_path };\n}\n\n/**\n * Sign `intent` for `binding` using the agent `creds`, delegating the\n * secret-gated MoonX call to `transport` (the server). Returns the artifact —\n * exactly the old per-op shape — or an error string. Never throws; never logs\n * the key.\n */\nexport async function signIntent(\n  intent: SignIntent,\n  creds: Creds,\n  binding: WalletBinding,\n  transport: MoonxSignTransport,\n): Promise<SignArtifactResult> {\n  if (!binding.walletId) {\n    return { ok: false, error: \"paybox did not supply a wallet id for this operation.\" };\n  }\n  if (!binding.keyId || !binding.derivationPath) {\n    return {\n      ok: false,\n      error:\n        \"This wallet isn't provisioned for signing yet (missing key binding). \" +\n        \"Re-provision it in the paybox app, then retry.\",\n    };\n  }\n\n  // EVM: the adapter builds the digest + assembles the signature; we own only\n  // the transport (envelope build + ed25519 + the server sign call).\n  const ecdsaSign = async (digest: `0x${string}`) => {\n    const result = await transport(buildEnvelope(digest, binding, creds));\n    const { r, s, recovery_id } = result.signature;\n    if (r == null || s == null || recovery_id == null) {\n      throw new Error(\"MoonX returned an ECDSA result without {r, s, recovery_id}\");\n    }\n    return {\n      r: `0x${r}` as `0x${string}`,\n      s: `0x${s}` as `0x${string}`,\n      yParity: recovery_id as 0 | 1,\n    };\n  };\n  // Solana: sign fn takes the raw message bytes, returns the 64-byte signature.\n  const ed25519Sign = async (message: Uint8Array) => {\n    const result = await transport(buildEnvelope(bytesToHex(message), binding, creds));\n    const sig = result.signature.signature;\n    if (!sig) throw new Error(\"MoonX returned an Ed25519 result without a signature\");\n    return hexToBytes(sig);\n  };\n\n  try {\n    switch (intent.op) {\n      case \"message\":\n        return {\n          ok: true,\n          artifact: { signature: await new MoonXEvmSigner(ecdsaSign).signMessage(intent.message) },\n        };\n      case \"typedData\":\n        return {\n          ok: true,\n          artifact: {\n            signature: await new MoonXEvmSigner(ecdsaSign).signTypedData(intent.typedData),\n          },\n        };\n      case \"transaction\":\n        return {\n          ok: true,\n          artifact: {\n            serializedTransaction: await new MoonXEvmSigner(ecdsaSign).signTransaction(\n              reviveTx(intent.transaction),\n            ),\n          },\n        };\n      case \"authorization\":\n        return {\n          ok: true,\n          artifact: {\n            authorization: await new MoonXEvmSigner(ecdsaSign).signAuthorization(\n              intent.authorization,\n            ),\n          },\n        };\n      case \"solanaMessage\": {\n        const sig = await new MoonXSolanaSigner(ed25519Sign, intent.address).signMessage(\n          intent.message,\n        );\n        return { ok: true, artifact: { signature: bytesToHex(sig) } };\n      }\n      case \"solanaTransaction\": {\n        const tx = Transaction.from(Buffer.from(intent.transactionBase64, \"base64\"));\n        const signed = await new MoonXSolanaSigner(ed25519Sign, intent.address).signTransaction(\n          tx,\n        );\n        return {\n          ok: true,\n          artifact: { signedTransactionBase64: Buffer.from(signed).toString(\"base64\") },\n        };\n      }\n      case \"raw\": {\n        // No chain logic — the digest is given. Build + sign + relay directly.\n        const result = await transport(buildEnvelope(intent.rawSigningPayloadHex, binding, creds));\n        return { ok: true, artifact: { scheme: result.scheme, signature: result.signature } };\n      }\n      default:\n        return { ok: false, error: `unknown op: ${(intent as { op?: string }).op}` };\n    }\n  } catch (err) {\n    if (err instanceof EvmSchemeMismatchError || err instanceof SolanaSchemeMismatchError) {\n      return { ok: false, error: err.message };\n    }\n    const message = err instanceof Error ? err.message : String(err);\n    return { ok: false, error: message };\n  }\n}\n","// In-process, non-custodial wallet signing — the SDK's replacement for the MCP\n// host iframe. The signing CORE is reused verbatim from the iframe\n// (@paybox/mcp-app/sign): it builds the chain digest, ed25519-signs the MoonX\n// envelope with the agent's pbxk1. keypair, and delegates the secret-gated MoonX\n// /sign to the server (the secret never reaches the client). Here we only swap\n// the iframe's MCP-tool transport for the SDK's REST calls.\n\nimport { parseToken } from \"@paybox/mcp-app/creds\";\nimport type { Creds } from \"@paybox/mcp-app/creds\";\nimport {\n  buildIssuedAtEnvelope,\n  buildSwapEnvelopes,\n  signIntent,\n} from \"@paybox/mcp-app/sign\";\nimport type {\n  MoonxSignResult,\n  SignIntent,\n  TxEnvelope,\n  WalletBinding,\n} from \"@paybox/mcp-app/sign\";\n\nimport type { BindingResponse, SwapPlan } from \"./types.js\";\n\n/** POST `{path}` (relative to the API base) with a JSON body, returning parsed\n *  JSON. Supplied by the client so the signer reuses its auth + base URL. */\nexport type Poster = (path: string, body: unknown) => Promise<unknown>;\n\n/** Parse the one-string `pbxk1.` token into the agent keypair the core expects. */\nexport function credsFromToken(token: string): Creds {\n  const kp = parseToken(token);\n  if (!kp) {\n    throw new Error(\"invalid signing key: expected a `pbxk1.` token (keypair only)\");\n  }\n  return { apiPubHex: kp.apiPubHex, apiPrivHex: kp.apiPrivHex, savedAt: Date.now() };\n}\n\nfunction toBinding(b: BindingResponse): WalletBinding {\n  return { walletId: b.wallet_id, keyId: b.key_id ?? \"\", derivationPath: b.derivation_path ?? \"\" };\n}\n\n/** Resolve the wallet binding (key_id + derivation_path) for a parked request via\n *  the server's secret-gated `/binding` route (the `moonx_resolve_binding` twin). */\nasync function resolveBinding(\n  post: Poster,\n  requestId: string,\n  creds: Creds,\n): Promise<WalletBinding> {\n  const env = buildIssuedAtEnvelope(creds);\n  const r = (await post(`/agent/requests/${requestId}/binding`, {\n    api_pub: creds.apiPubHex,\n    signed_body: env.signed_body,\n    agent_signature: env.agent_signature,\n  })) as BindingResponse;\n  return toBinding(r);\n}\n\n/** Sign a parked `request_wallet_sign` and submit the artifact. Uses the binding\n *  the server echoed on the wallet-sign response when it's complete (avoiding an\n *  extra secret-gated resolve), and only resolves when it isn't. The MoonX\n *  secret call runs server-side via `/moonx-sign`; the artifact lands via\n *  `/signature`. */\nexport async function signWalletRequest(\n  post: Poster,\n  requestId: string,\n  intent: SignIntent,\n  creds: Creds,\n  binding?: BindingResponse | null,\n): Promise<Record<string, unknown>> {\n  const resolved =\n    binding && binding.key_id && binding.derivation_path\n      ? toBinding(binding)\n      : await resolveBinding(post, requestId, creds);\n  const transport = (envelope: { signed_body: string; agent_signature: string }) =>\n    post(`/agent/requests/${requestId}/moonx-sign`, {\n      api_pub: creds.apiPubHex,\n      ...envelope,\n    }) as Promise<MoonxSignResult>;\n  const result = await signIntent(intent, creds, resolved, transport);\n  if (!result.ok) throw new Error(result.error);\n  await post(`/agent/requests/${requestId}/signature`, { artifact: result.artifact });\n  return result.artifact;\n}\n\n/** Sign every tx of a parked swap plan, in order, and submit the envelopes;\n *  the server verifies, signs (secret-gated), encodes, and broadcasts. */\nexport async function signSwapRequest(\n  post: Poster,\n  requestId: string,\n  plan: SwapPlan,\n  creds: Creds,\n): Promise<void> {\n  let binding: WalletBinding = {\n    walletId: plan.binding.wallet_id,\n    keyId: plan.binding.key_id ?? \"\",\n    derivationPath: plan.binding.derivation_path ?? \"\",\n  };\n  if (binding.walletId && (!binding.keyId || !binding.derivationPath)) {\n    binding = await resolveBinding(post, requestId, creds);\n  }\n  const envelopes: TxEnvelope[] = buildSwapEnvelopes(plan.txs, binding, creds);\n  await post(`/agent/requests/${requestId}/envelopes`, { envelopes });\n}\n","// PayboxClient — the typed REST client mirroring the MCP agent tools. Each method\n// maps to a `/agent/*` route; `request_wallet_sign` / `request_swap` additionally\n// drive in-process signing when a `pbxk1.` signing key is configured.\n\nimport { refreshTokens } from \"./auth.js\";\nimport { loadConfig, saveConfig, type OAuthTokens } from \"./config.js\";\nimport { credsFromToken, signSwapRequest, signWalletRequest, type Poster } from \"./signer.js\";\nimport type {\n  RequestPaymentArgs,\n  RequestSecretArgs,\n  RequestSwapArgs,\n  RequestWalletSignArgs,\n} from \"./types.generated.js\";\nimport type {\n  AgentResponse,\n  ClientGrantSummary,\n  PaymentArgs,\n  PortfolioArgs,\n  SecretArgs,\n  SwapArgs,\n  SwapResult,\n  WalletSignArgs,\n  WalletSignResult,\n} from \"./types.js\";\n\nconst DEFAULT_BASE_URL = \"https://api.paybox.sh\";\nconst EXPIRY_SKEW_MS = 60_000;\n\nexport class PayboxError extends Error {\n  constructor(\n    readonly status: number,\n    readonly body: string,\n    context: string,\n  ) {\n    super(`paybox ${context} failed (${status}): ${body}`);\n    this.name = \"PayboxError\";\n  }\n}\n\nexport interface PayboxClientOptions {\n  /** API origin (the OAuth issuer). Default `https://api.paybox.sh`. */\n  baseUrl?: string;\n  /** A `pbx_live_*` personal API key. */\n  apiKey?: string;\n  /** A raw OAuth access token (skips the stored-token path). */\n  token?: string;\n  /** A `pbxk1.` signing key token; enables in-process wallet/swap signing. */\n  signingKey?: string;\n  fetchImpl?: typeof fetch;\n}\n\nexport interface SignOptions {\n  /** Sign in-process when the request clears to `pending_signature`. Default true. */\n  autoSign?: boolean;\n}\n\nexport class PayboxClient {\n  readonly baseUrl: string;\n  private readonly opts: PayboxClientOptions;\n  private readonly fetchImpl: typeof fetch;\n  private oauth?: OAuthTokens;\n  private configBacked = false;\n\n  constructor(options: PayboxClientOptions = {}) {\n    this.opts = options;\n    this.baseUrl = (options.baseUrl ?? DEFAULT_BASE_URL).replace(/\\/+$/, \"\");\n    this.fetchImpl = options.fetchImpl ?? fetch;\n  }\n\n  /** Build a client from `~/.config/paybox/config.json` + env, with overrides. */\n  static fromConfig(overrides: PayboxClientOptions = {}): PayboxClient {\n    const cfg = loadConfig();\n    const client = new PayboxClient({\n      baseUrl: overrides.baseUrl ?? process.env.PAYBOX_API_URL ?? cfg.baseUrl,\n      apiKey: overrides.apiKey ?? process.env.PAYBOX_API_KEY ?? cfg.apiKey,\n      token: overrides.token ?? process.env.PAYBOX_ACCESS_TOKEN,\n      signingKey: overrides.signingKey ?? process.env.PAYBOX_SIGNING_KEY ?? cfg.signingKey,\n      fetchImpl: overrides.fetchImpl,\n    });\n    if (!client.opts.apiKey && !client.opts.token && cfg.oauth) {\n      client.oauth = cfg.oauth;\n      client.configBacked = true;\n    }\n    return client;\n  }\n\n  /** Whether in-process signing is available (a `pbxk1.` key is configured). */\n  get canSign(): boolean {\n    return Boolean(this.opts.signingKey);\n  }\n\n  private async bearer(): Promise<string> {\n    if (this.opts.token) return this.opts.token;\n    if (this.opts.apiKey) return this.opts.apiKey;\n    if (this.oauth) {\n      if (this.oauth.expiresAt && Date.now() > this.oauth.expiresAt - EXPIRY_SKEW_MS) {\n        this.oauth = await refreshTokens(this.baseUrl, this.oauth);\n        if (this.configBacked) {\n          const cfg = loadConfig();\n          cfg.oauth = this.oauth;\n          saveConfig(cfg);\n        }\n      }\n      return this.oauth.accessToken;\n    }\n    throw new Error(\n      \"not authenticated — run `paybox login`, set PAYBOX_API_KEY, or pass { apiKey } / { token }\",\n    );\n  }\n\n  private async request<T>(\n    method: string,\n    path: string,\n    init: { query?: Record<string, string | undefined>; body?: unknown } = {},\n  ): Promise<T> {\n    const url = new URL(this.baseUrl + path);\n    for (const [k, v] of Object.entries(init.query ?? {})) {\n      if (v != null) url.searchParams.set(k, v);\n    }\n    const headers: Record<string, string> = { authorization: `Bearer ${await this.bearer()}` };\n    let body: string | undefined;\n    if (init.body !== undefined) {\n      headers[\"content-type\"] = \"application/json\";\n      body = JSON.stringify(init.body);\n    }\n    const res = await this.fetchImpl(url, { method, headers, body });\n    const text = await res.text();\n    if (!res.ok) throw new PayboxError(res.status, text, `${method} ${path}`);\n    return (text ? JSON.parse(text) : undefined) as T;\n  }\n\n  private readonly poster: Poster = (path, body) => this.request<unknown>(\"POST\", path, { body });\n\n  /** List the credentials this client may use (the `list_credentials` tool). */\n  listCredentials(): Promise<ClientGrantSummary[]> {\n    return this.request(\"GET\", \"/agent/grants\");\n  }\n\n  /** Token balances across chains (the `get_portfolio` tool). */\n  getPortfolio(args: PortfolioArgs): Promise<unknown> {\n    return this.request(\"GET\", \"/agent/portfolio\", {\n      query: { address: args.address, network_ids: args.networkIds },\n    });\n  }\n\n  /** Charge a card credential (the `request_payment` tool). */\n  requestPayment(args: PaymentArgs): Promise<AgentResponse> {\n    const operation: RequestPaymentArgs & { type: \"payment\" } = {\n      type: \"payment\",\n      credential_id: args.credentialId,\n      merchant: args.merchant,\n      merchant_url: args.merchantUrl,\n      amount_cents: args.amountCents,\n      currency: args.currency ?? \"USD\",\n    };\n    return this.request(\"POST\", \"/agent/request\", { body: { operation } });\n  }\n\n  /** Reveal a secret credential (the `request_secret` tool). */\n  requestSecret(args: SecretArgs): Promise<AgentResponse> {\n    const operation: RequestSecretArgs & { type: \"secret\" } = {\n      type: \"secret\",\n      credential_id: args.credentialId,\n      raw: args.raw ?? false,\n      purpose: args.purpose ?? null,\n    };\n    return this.request(\"POST\", \"/agent/request\", { body: { operation } });\n  }\n\n  /** Sign with a wallet credential (the `request_wallet_sign` tool). Signs\n   *  in-process and returns the completed request when a signing key is set and\n   *  the request clears immediately; otherwise returns the pending response.\n   *  Uses `/agent/wallet-sign`, which echoes the wallet binding so the signer\n   *  need not resolve it separately. */\n  async requestWalletSign(args: WalletSignArgs, opts: SignOptions = {}): Promise<AgentResponse> {\n    const operation: RequestWalletSignArgs & { type: \"wallet_sign\" } = {\n      type: \"wallet_sign\",\n      credential_id: args.credentialId,\n      chain: args.chain,\n      contract: args.contract ?? null,\n      function: args.fn ?? null,\n      value_cents: args.valueCents ?? null,\n      intent: args.intent,\n    };\n    const { response, binding } = await this.request<WalletSignResult>(\n      \"POST\",\n      \"/agent/wallet-sign\",\n      { body: { operation } },\n    );\n    if (\n      (opts.autoSign ?? true) &&\n      response.status === \"pending_signature\" &&\n      this.opts.signingKey\n    ) {\n      await signWalletRequest(\n        this.poster,\n        response.request_id,\n        args.intent,\n        credsFromToken(this.opts.signingKey),\n        binding,\n      );\n      return this.getRequest(response.request_id);\n    }\n    return response;\n  }\n\n  /** Swap tokens from a wallet credential (the `request_swap` tool). Returns the\n   *  parked response + sign-ready plan; signs + submits in-process when a signing\n   *  key is set and the swap cleared immediately. */\n  async requestSwap(args: SwapArgs, opts: SignOptions = {}): Promise<SwapResult> {\n    const operation: RequestSwapArgs & { type: \"swap\" } = {\n      type: \"swap\",\n      credential_id: args.credentialId,\n      src_chain: args.srcChain,\n      dst_chain: args.dstChain ?? args.srcChain,\n      src_token: args.srcToken,\n      dst_token: args.dstToken,\n      amount: args.amount,\n      swap_direction: args.swapDirection ?? \"exact-amount-in\",\n      slippage_bps: args.slippageBps ?? 50,\n      recipient: args.recipient ?? null,\n      value_cents: args.valueCents ?? null,\n    };\n    const result = await this.request<SwapResult>(\"POST\", \"/agent/swap\", { body: { operation } });\n    if (\n      (opts.autoSign ?? true) &&\n      result.response.status === \"pending_signature\" &&\n      this.opts.signingKey\n    ) {\n      await signSwapRequest(\n        this.poster,\n        result.response.request_id,\n        result.plan,\n        credsFromToken(this.opts.signingKey),\n      );\n      return { ...result, response: await this.getRequest(result.response.request_id) };\n    }\n    return result;\n  }\n\n  /** Poll a request's status (the `get_request` tool). */\n  getRequest(requestId: string): Promise<AgentResponse> {\n    return this.request(\"GET\", `/agent/requests/${requestId}`);\n  }\n\n  /** Poll until the request leaves a pending state (or the timeout elapses). */\n  async waitForRequest(\n    requestId: string,\n    opts: { intervalMs?: number; timeoutMs?: number } = {},\n  ): Promise<AgentResponse> {\n    const interval = opts.intervalMs ?? 2000;\n    const deadline = Date.now() + (opts.timeoutMs ?? 300_000);\n    for (;;) {\n      const r = await this.getRequest(requestId);\n      const pending = r.status === \"pending_approval\" || r.status === \"pending_signature\";\n      if (!pending || Date.now() > deadline) return r;\n      await new Promise((res) => setTimeout(res, interval));\n    }\n  }\n}\n"],"mappings":";AAQA,SAAS,aAAa;AACtB,SAAS,YAAY,mBAAmB;AACxC,SAAS,oBAAoB;AAMtB,SAAS,YAAY,SAAyB;AACnD,SAAO,GAAG,QAAQ,QAAQ,QAAQ,EAAE,CAAC;AACvC;AAMO,SAAS,YAAY,SAAiB,UAAkC;AAC7E,MAAI,SAAU,QAAO,SAAS,QAAQ,QAAQ,EAAE;AAChD,QAAM,IAAI,QAAQ,QAAQ,QAAQ,EAAE,EAAE,MAAM,0BAA0B;AACtE,SAAO,IAAI,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK;AACpC;AAGO,SAAS,cAAc,aAAoC;AAChE,QAAM,UAAU,YAAY,MAAM,GAAG,EAAE,CAAC;AACxC,MAAI,CAAC,QAAS,QAAO;AACrB,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,OAAO,KAAK,SAAS,WAAW,EAAE,SAAS,MAAM,CAAC;AAG5E,WAAO,OAAO,OAAO;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAQA,eAAe,SAAS,SAAsC;AAC5D,QAAM,MAAM,GAAG,QAAQ,QAAQ,QAAQ,EAAE,CAAC;AAC1C,QAAM,MAAM,MAAM,MAAM,GAAG;AAC3B,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,IAAI,MAAM,sCAAsC,GAAG,KAAK,IAAI,MAAM,GAAG;AAAA,EAC7E;AACA,SAAQ,MAAM,IAAI,KAAK;AACzB;AAEA,SAAS,UAAU,GAAmB;AACpC,SAAO,EAAE,SAAS,WAAW;AAC/B;AAEA,SAAS,OAAgD;AACvD,QAAM,WAAW,UAAU,YAAY,EAAE,CAAC;AAC1C,QAAM,YAAY,UAAU,WAAW,QAAQ,EAAE,OAAO,QAAQ,EAAE,OAAO,CAAC;AAC1E,SAAO,EAAE,UAAU,UAAU;AAC/B;AAEO,SAAS,YAAY,KAAmB;AAI7C,QAAM,CAAC,KAAK,IAAI,IACd,QAAQ,aAAa,WAChB,CAAC,QAAQ,CAAC,GAAG,CAAC,IACf,QAAQ,aAAa,UAClB,CAAC,YAAY,CAAC,+BAA+B,GAAG,CAAC,IACjD,CAAC,YAAY,CAAC,GAAG,CAAC;AAC3B,MAAI;AACF,UAAM,KAAK,CAAC,GAAG,IAAI,GAAG,EAAE,OAAO,UAAU,UAAU,KAAK,CAAC,EAAE,MAAM;AAAA,EACnE,QAAQ;AAAA,EAER;AACF;AAEA,IAAM,gBACJ;AAaF,eAAsB,cACpB,SACA,OAAqB,CAAC,GACA;AACtB,QAAM,QAAQ,KAAK,SAAS;AAC5B,QAAM,aAAa,KAAK,cAAc;AACtC,QAAM,MAAM,KAAK,QAAQ,CAAC,MAAc,QAAQ,MAAM,CAAC;AACvD,QAAM,OAAO,MAAM,SAAS,OAAO;AACnC,QAAM,WAAW,YAAY,OAAO;AAEpC,MAAI;AACJ,MAAI;AACJ,QAAM,cAAc,IAAI,QAAgD,CAAC,KAAK,QAAQ;AACpF,kBAAc;AACd,iBAAa;AAAA,EACf,CAAC;AAED,QAAM,SAAS,aAAa,CAAC,KAAK,QAAQ;AACxC,UAAM,IAAI,IAAI,IAAI,IAAI,OAAO,KAAK,kBAAkB;AACpD,QAAI,EAAE,aAAa,aAAa;AAC9B,UAAI,UAAU,GAAG,EAAE,IAAI;AACvB;AAAA,IACF;AACA,QAAI,UAAU,KAAK,EAAE,gBAAgB,YAAY,CAAC,EAAE,IAAI,aAAa;AACrE,UAAM,OAAO,EAAE,aAAa,IAAI,MAAM;AACtC,QAAI,KAAM,aAAY,EAAE,MAAM,OAAO,EAAE,aAAa,IAAI,OAAO,EAAE,CAAC;AAAA,QAC7D,YAAW,IAAI,MAAM,EAAE,aAAa,IAAI,OAAO,KAAK,sBAAsB,CAAC;AAAA,EAClF,CAAC;AACD,QAAM,IAAI,QAAc,CAAC,MAAM,OAAO,OAAO,GAAG,aAAa,CAAC,CAAC;AAC/D,QAAM,OAAQ,OAAO,QAAQ,EAAkB;AAC/C,QAAM,cAAc,oBAAoB,IAAI;AAE5C,QAAM,YAAY,KAAK,aAAa;AACpC,QAAM,QAAQ;AAAA,IACZ,MAAM,WAAW,IAAI,MAAM,yBAAyB,KAAK,MAAM,YAAY,GAAI,CAAC,+BAA0B,CAAC;AAAA,IAC3G;AAAA,EACF;AACA,QAAM,MAAM;AAEZ,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,KAAK,uBAAuB;AAAA,MAClD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU;AAAA,QACnB,aAAa;AAAA,QACb,eAAe,CAAC,WAAW;AAAA,QAC3B,4BAA4B;AAAA,QAC5B,aAAa,CAAC,sBAAsB,eAAe;AAAA,QACnD,gBAAgB,CAAC,MAAM;AAAA,MACzB,CAAC;AAAA,IACH,CAAC;AACD,QAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,+BAA+B,IAAI,MAAM,MAAM,MAAM,IAAI,KAAK,CAAC,EAAE;AAC9F,UAAM,EAAE,WAAW,SAAS,IAAK,MAAM,IAAI,KAAK;AAEhD,UAAM,EAAE,UAAU,UAAU,IAAI,KAAK;AACrC,UAAM,QAAQ,UAAU,YAAY,EAAE,CAAC;AACvC,UAAM,UACJ,GAAG,KAAK,sBAAsB,iCAChB,mBAAmB,QAAQ,CAAC,iBACzB,mBAAmB,WAAW,CAAC,mBAC7B,SAAS,qCAClB,mBAAmB,KAAK,CAAC,UACzB,KAAK,aAAa,mBAAmB,QAAQ,CAAC;AAE1D,QAAI;AAAA,IAA8C,OAAO;AAAA,CAAI;AAC7D,gBAAY,OAAO;AAEnB,UAAM,EAAE,MAAM,OAAO,cAAc,IAAI,MAAM;AAC7C,QAAI,kBAAkB,MAAO,OAAM,IAAI,MAAM,sCAAiC;AAE9E,UAAM,OAAO,IAAI,gBAAgB;AAAA,MAC/B,YAAY;AAAA,MACZ;AAAA,MACA,cAAc;AAAA,MACd,WAAW;AAAA,MACX,eAAe;AAAA,MACf;AAAA,IACF,CAAC;AACD,UAAM,MAAM,MAAM,MAAM,KAAK,gBAAgB;AAAA,MAC3C,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,MAC/D,MAAM;AAAA,IACR,CAAC;AACD,QAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,0BAA0B,IAAI,MAAM,MAAM,MAAM,IAAI,KAAK,CAAC,EAAE;AACzF,UAAM,IAAK,MAAM,IAAI,KAAK;AAK1B,WAAO;AAAA,MACL;AAAA,MACA,aAAa,EAAE;AAAA,MACf,cAAc,EAAE;AAAA,MAChB,WAAW,EAAE,aAAa,KAAK,IAAI,IAAI,EAAE,aAAa,MAAO;AAAA,MAC7D;AAAA,IACF;AAAA,EACF,UAAE;AACA,iBAAa,KAAK;AAClB,WAAO,MAAM;AAAA,EACf;AACF;AAEA,eAAsB,cAAc,SAAiB,SAA4C;AAC/F,MAAI,CAAC,QAAQ,aAAc,OAAM,IAAI,MAAM,kDAA6C;AACxF,QAAM,OAAO,MAAM,SAAS,OAAO;AACnC,QAAM,WAAW,QAAQ,YAAY,YAAY,OAAO;AACxD,QAAM,OAAO,IAAI,gBAAgB;AAAA,IAC/B,YAAY;AAAA,IACZ,eAAe,QAAQ;AAAA,IACvB,WAAW,QAAQ;AAAA,IACnB;AAAA,EACF,CAAC;AACD,QAAM,MAAM,MAAM,MAAM,KAAK,gBAAgB;AAAA,IAC3C,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,IAC/D,MAAM;AAAA,EACR,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,yBAAyB,IAAI,MAAM,MAAM,MAAM,IAAI,KAAK,CAAC,EAAE;AACxF,QAAM,IAAK,MAAM,IAAI,KAAK;AAK1B,SAAO;AAAA,IACL,GAAG;AAAA,IACH,aAAa,EAAE;AAAA,IACf,cAAc,EAAE,iBAAiB,QAAQ;AAAA,IACzC,WAAW,EAAE,aAAa,KAAK,IAAI,IAAI,EAAE,aAAa,MAAO;AAAA,IAC7D;AAAA,EACF;AACF;;;AClOA,SAAS,WAAW,WAAW,cAAc,qBAAqB;AAClE,SAAS,eAAe;AACxB,SAAS,YAAY;AAsBd,SAAS,YAAoB;AAClC,MAAI,QAAQ,IAAI,kBAAmB,QAAO,QAAQ,IAAI;AACtD,QAAM,OAAO,QAAQ,IAAI,mBAAmB,KAAK,QAAQ,GAAG,SAAS;AACrE,SAAO,KAAK,MAAM,QAAQ;AAC5B;AAEO,SAAS,aAAqB;AACnC,SAAO,KAAK,UAAU,GAAG,aAAa;AACxC;AAEO,SAAS,aAA2B;AACzC,MAAI;AACF,WAAO,KAAK,MAAM,aAAa,WAAW,GAAG,MAAM,CAAC;AAAA,EACtD,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEO,SAAS,WAAW,QAA4B;AAGrD,YAAU,UAAU,GAAG,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AACvD,gBAAc,WAAW,GAAG,GAAG,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAAA,GAAM,EAAE,MAAM,IAAM,CAAC;AAGnF,MAAI,QAAQ,aAAa,QAAS,WAAU,WAAW,GAAG,GAAK;AACjE;;;ACvCO,IAAM,eAAe;AA8ErB,SAAS,YAAY,GAAW,OAA8B;AACnE,QAAM,UAAU,EAAE,KAAK;AACvB,MAAI,CAAC,QAAS,QAAO,GAAG,KAAK;AAC7B,QAAM,OAAO,QAAQ,WAAW,IAAI,KAAK,QAAQ,WAAW,IAAI,IAAI,QAAQ,MAAM,CAAC,IAAI;AACvF,MAAI,KAAK,WAAW,EAAG,QAAO,GAAG,KAAK;AACtC,MAAI,KAAK,SAAS,MAAM,EAAG,QAAO,GAAG,KAAK;AAC1C,MAAI,CAAC,iBAAiB,KAAK,IAAI,EAAG,QAAO,GAAG,KAAK;AACjD,SAAO;AACT;AAeA,SAAS,aAAa,GAAmB;AACvC,MAAI,IAAI,EAAE,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AAC9C,SAAO,EAAE,SAAS,EAAG,MAAK;AAC1B,SAAO,KAAK,CAAC;AACf;AAYO,SAAS,WAAW,OAAiE;AAC1F,QAAM,IAAI,MAAM,KAAK;AACrB,MAAI,CAAC,EAAG,QAAO;AACf,QAAM,OAAO,EAAE,WAAW,YAAY,IAAI,EAAE,MAAM,aAAa,MAAM,IAAI;AACzE,MAAI;AACJ,MAAI;AACF,UAAM,KAAK,MAAM,aAAa,IAAI,CAAC;AAAA,EACrC,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO;AAC5C,QAAM,IAAI;AACV,QAAM,YAAY,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,KAAK;AACxD,QAAM,aAAa,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,KAAK;AAC1D,MAAI,CAAC,aAAa,CAAC,WAAY,QAAO;AACtC,MAAI,YAAY,WAAW,KAAK,KAAK,YAAY,YAAY,KAAK,EAAG,QAAO;AAC5E,SAAO,EAAE,WAAW,WAAW;AACjC;;;AC/HA,SAAS,UAAAA,eAAc;AACvB,OAAO,UAAU;AACjB,SAAS,gBAAgB,8BAA8B;AACvD,SAAS,mBAAmB,iCAAiC;AAC7D,SAAS,mBAAmB;AAC5B,SAAS,WAAW,4BAA4B;AAuEhD,SAAS,SAAS,GAAoC;AACpD,SAAO;AAAA,IACL,MAAM;AAAA,IACN,IAAI,EAAE;AAAA,IACN,OAAO,OAAO,EAAE,KAAK;AAAA,IACrB,MAAM,EAAE;AAAA,IACR,SAAS,EAAE;AAAA,IACX,KAAK,OAAO,EAAE,GAAG;AAAA,IACjB,sBAAsB,OAAO,EAAE,oBAAoB;AAAA,IACnD,cAAc,OAAO,EAAE,YAAY;AAAA,IACnC,OAAO,EAAE;AAAA,EACX;AACF;AAEA,SAAS,WAAW,KAAyB;AAC3C,SAAO,IAAI,WAAWA,QAAO,KAAK,IAAI,QAAQ,OAAO,EAAE,GAAG,KAAK,CAAC;AAClE;AACA,SAAS,WAAW,OAA2B;AAC7C,SAAOA,QAAO,KAAK,KAAK,EAAE,SAAS,KAAK;AAC1C;AAQA,SAAS,cACP,sBACA,SACA,OACkD;AAClD,QAAM,gBAAgB;AAAA,IACpB,qBAAqB,qBAAqB,QAAQ,OAAO,EAAE,EAAE,YAAY;AAAA,IACzE,QAAQ,QAAQ;AAAA,IAChB,iBAAiB,QAAQ;AAAA,IACzB,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,EACpC;AACA,QAAM,kBAAkB,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,aAAa,CAAC;AAE9E,QAAM,UAAU,KAAK,KAAK,QAAQ,SAAS,WAAW,MAAM,UAAU,CAAC;AACvE,QAAM,WAAW,KAAK,KAAK,SAAS,iBAAiB,QAAQ,SAAS;AACtE,SAAO;AAAA,IACL,aAAa,WAAW,eAAe;AAAA,IACvC,iBAAiB,WAAW,QAAQ;AAAA,EACtC;AACF;AAQO,SAAS,mBAAmB,IAA2B;AAC5D,SAAO,UAAU,qBAAqB,SAAS,EAAE,CAAC,CAAC;AACrD;AAOO,SAAS,qBAAqB,UAA0B;AAC7D,QAAM,MAAMA,QAAO,KAAK,UAAU,QAAQ;AAE1C,MAAI,IAAI;AACR,MAAI,WAAW;AACf,MAAI,QAAQ;AACZ,aAAS;AACP,UAAM,IAAI,IAAI,GAAG;AACjB,iBAAa,IAAI,QAAS;AAC1B,SAAK,IAAI,SAAU,EAAG;AACtB,aAAS;AAAA,EACX;AACA,MAAI,aAAa,GAAG;AAClB,UAAM,IAAI,MAAM,2CAA2C,QAAQ,oBAAoB;AAAA,EACzF;AACA,SAAO,WAAW,IAAI,WAAW,IAAI,SAAS,IAAI,EAAE,CAAC,CAAC;AACxD;AAqBO,SAAS,mBACd,KACA,SACA,OACc;AACd,MAAI,CAAC,QAAQ,UAAU;AACrB,UAAM,IAAI,MAAM,uDAAuD;AAAA,EACzE;AACA,MAAI,CAAC,QAAQ,SAAS,CAAC,QAAQ,gBAAgB;AAC7C,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AACA,SAAO,IAAI,IAAI,CAAC,MAAM;AACpB,UAAM,UACJ,EAAE,OAAO,WACL,qBAAqB,EAAE,WAAqB,IAC5C,mBAAmB,EAAE,WAAqB;AAChD,UAAM,EAAE,aAAa,gBAAgB,IAAI,cAAc,SAAS,SAAS,KAAK;AAC9E,WAAO,EAAE,SAAS,MAAM,WAAW,aAAa,gBAAgB;AAAA,EAClE,CAAC;AACH;AAmEO,SAAS,sBAAsB,OAGpC;AACA,QAAM,kBAAkB,IAAI,YAAY,EAAE;AAAA,IACxC,KAAK,UAAU,EAAE,YAAW,oBAAI,KAAK,GAAE,YAAY,EAAE,CAAC;AAAA,EACxD;AACA,QAAM,UAAU,KAAK,KAAK,QAAQ,SAAS,WAAW,MAAM,UAAU,CAAC;AACvE,QAAM,WAAW,KAAK,KAAK,SAAS,iBAAiB,QAAQ,SAAS;AACtE,SAAO;AAAA,IACL,aAAa,WAAW,eAAe;AAAA,IACvC,iBAAiB,WAAW,QAAQ;AAAA,EACtC;AACF;AAmBA,eAAsB,WACpB,QACA,OACA,SACA,WAC6B;AAC7B,MAAI,CAAC,QAAQ,UAAU;AACrB,WAAO,EAAE,IAAI,OAAO,OAAO,wDAAwD;AAAA,EACrF;AACA,MAAI,CAAC,QAAQ,SAAS,CAAC,QAAQ,gBAAgB;AAC7C,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,OACE;AAAA,IAEJ;AAAA,EACF;AAIA,QAAM,YAAY,OAAO,WAA0B;AACjD,UAAM,SAAS,MAAM,UAAU,cAAc,QAAQ,SAAS,KAAK,CAAC;AACpE,UAAM,EAAE,GAAG,GAAG,YAAY,IAAI,OAAO;AACrC,QAAI,KAAK,QAAQ,KAAK,QAAQ,eAAe,MAAM;AACjD,YAAM,IAAI,MAAM,4DAA4D;AAAA,IAC9E;AACA,WAAO;AAAA,MACL,GAAG,KAAK,CAAC;AAAA,MACT,GAAG,KAAK,CAAC;AAAA,MACT,SAAS;AAAA,IACX;AAAA,EACF;AAEA,QAAM,cAAc,OAAO,YAAwB;AACjD,UAAM,SAAS,MAAM,UAAU,cAAc,WAAW,OAAO,GAAG,SAAS,KAAK,CAAC;AACjF,UAAM,MAAM,OAAO,UAAU;AAC7B,QAAI,CAAC,IAAK,OAAM,IAAI,MAAM,sDAAsD;AAChF,WAAO,WAAW,GAAG;AAAA,EACvB;AAEA,MAAI;AACF,YAAQ,OAAO,IAAI;AAAA,MACjB,KAAK;AACH,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,UAAU,EAAE,WAAW,MAAM,IAAI,eAAe,SAAS,EAAE,YAAY,OAAO,OAAO,EAAE;AAAA,QACzF;AAAA,MACF,KAAK;AACH,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,UAAU;AAAA,YACR,WAAW,MAAM,IAAI,eAAe,SAAS,EAAE,cAAc,OAAO,SAAS;AAAA,UAC/E;AAAA,QACF;AAAA,MACF,KAAK;AACH,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,UAAU;AAAA,YACR,uBAAuB,MAAM,IAAI,eAAe,SAAS,EAAE;AAAA,cACzD,SAAS,OAAO,WAAW;AAAA,YAC7B;AAAA,UACF;AAAA,QACF;AAAA,MACF,KAAK;AACH,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,UAAU;AAAA,YACR,eAAe,MAAM,IAAI,eAAe,SAAS,EAAE;AAAA,cACjD,OAAO;AAAA,YACT;AAAA,UACF;AAAA,QACF;AAAA,MACF,KAAK,iBAAiB;AACpB,cAAM,MAAM,MAAM,IAAI,kBAAkB,aAAa,OAAO,OAAO,EAAE;AAAA,UACnE,OAAO;AAAA,QACT;AACA,eAAO,EAAE,IAAI,MAAM,UAAU,EAAE,WAAW,WAAW,GAAG,EAAE,EAAE;AAAA,MAC9D;AAAA,MACA,KAAK,qBAAqB;AACxB,cAAM,KAAK,YAAY,KAAKC,QAAO,KAAK,OAAO,mBAAmB,QAAQ,CAAC;AAC3E,cAAM,SAAS,MAAM,IAAI,kBAAkB,aAAa,OAAO,OAAO,EAAE;AAAA,UACtE;AAAA,QACF;AACA,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,UAAU,EAAE,yBAAyBA,QAAO,KAAK,MAAM,EAAE,SAAS,QAAQ,EAAE;AAAA,QAC9E;AAAA,MACF;AAAA,MACA,KAAK,OAAO;AAEV,cAAM,SAAS,MAAM,UAAU,cAAc,OAAO,sBAAsB,SAAS,KAAK,CAAC;AACzF,eAAO,EAAE,IAAI,MAAM,UAAU,EAAE,QAAQ,OAAO,QAAQ,WAAW,OAAO,UAAU,EAAE;AAAA,MACtF;AAAA,MACA;AACE,eAAO,EAAE,IAAI,OAAO,OAAO,eAAgB,OAA2B,EAAE,GAAG;AAAA,IAC/E;AAAA,EACF,SAAS,KAAK;AACZ,QAAI,eAAe,0BAA0B,eAAe,2BAA2B;AACrF,aAAO,EAAE,IAAI,OAAO,OAAO,IAAI,QAAQ;AAAA,IACzC;AACA,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,WAAO,EAAE,IAAI,OAAO,OAAO,QAAQ;AAAA,EACrC;AACF;;;AC1YO,SAAS,eAAe,OAAsB;AACnD,QAAM,KAAK,WAAW,KAAK;AAC3B,MAAI,CAAC,IAAI;AACP,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AACA,SAAO,EAAE,WAAW,GAAG,WAAW,YAAY,GAAG,YAAY,SAAS,KAAK,IAAI,EAAE;AACnF;AAEA,SAAS,UAAU,GAAmC;AACpD,SAAO,EAAE,UAAU,EAAE,WAAW,OAAO,EAAE,UAAU,IAAI,gBAAgB,EAAE,mBAAmB,GAAG;AACjG;AAIA,eAAe,eACb,MACA,WACA,OACwB;AACxB,QAAM,MAAM,sBAAsB,KAAK;AACvC,QAAM,IAAK,MAAM,KAAK,mBAAmB,SAAS,YAAY;AAAA,IAC5D,SAAS,MAAM;AAAA,IACf,aAAa,IAAI;AAAA,IACjB,iBAAiB,IAAI;AAAA,EACvB,CAAC;AACD,SAAO,UAAU,CAAC;AACpB;AAOA,eAAsB,kBACpB,MACA,WACA,QACA,OACA,SACkC;AAClC,QAAM,WACJ,WAAW,QAAQ,UAAU,QAAQ,kBACjC,UAAU,OAAO,IACjB,MAAM,eAAe,MAAM,WAAW,KAAK;AACjD,QAAM,YAAY,CAAC,aACjB,KAAK,mBAAmB,SAAS,eAAe;AAAA,IAC9C,SAAS,MAAM;AAAA,IACf,GAAG;AAAA,EACL,CAAC;AACH,QAAM,SAAS,MAAM,WAAW,QAAQ,OAAO,UAAU,SAAS;AAClE,MAAI,CAAC,OAAO,GAAI,OAAM,IAAI,MAAM,OAAO,KAAK;AAC5C,QAAM,KAAK,mBAAmB,SAAS,cAAc,EAAE,UAAU,OAAO,SAAS,CAAC;AAClF,SAAO,OAAO;AAChB;AAIA,eAAsB,gBACpB,MACA,WACA,MACA,OACe;AACf,MAAI,UAAyB;AAAA,IAC3B,UAAU,KAAK,QAAQ;AAAA,IACvB,OAAO,KAAK,QAAQ,UAAU;AAAA,IAC9B,gBAAgB,KAAK,QAAQ,mBAAmB;AAAA,EAClD;AACA,MAAI,QAAQ,aAAa,CAAC,QAAQ,SAAS,CAAC,QAAQ,iBAAiB;AACnE,cAAU,MAAM,eAAe,MAAM,WAAW,KAAK;AAAA,EACvD;AACA,QAAM,YAA0B,mBAAmB,KAAK,KAAK,SAAS,KAAK;AAC3E,QAAM,KAAK,mBAAmB,SAAS,cAAc,EAAE,UAAU,CAAC;AACpE;;;AC5EA,IAAM,mBAAmB;AACzB,IAAM,iBAAiB;AAEhB,IAAM,cAAN,cAA0B,MAAM;AAAA,EACrC,YACW,QACA,MACT,SACA;AACA,UAAM,UAAU,OAAO,YAAY,MAAM,MAAM,IAAI,EAAE;AAJ5C;AACA;AAIT,SAAK,OAAO;AAAA,EACd;AACF;AAmBO,IAAM,eAAN,MAAM,cAAa;AAAA,EACf;AAAA,EACQ;AAAA,EACA;AAAA,EACT;AAAA,EACA,eAAe;AAAA,EAEvB,YAAY,UAA+B,CAAC,GAAG;AAC7C,SAAK,OAAO;AACZ,SAAK,WAAW,QAAQ,WAAW,kBAAkB,QAAQ,QAAQ,EAAE;AACvE,SAAK,YAAY,QAAQ,aAAa;AAAA,EACxC;AAAA;AAAA,EAGA,OAAO,WAAW,YAAiC,CAAC,GAAiB;AACnE,UAAM,MAAM,WAAW;AACvB,UAAM,SAAS,IAAI,cAAa;AAAA,MAC9B,SAAS,UAAU,WAAW,QAAQ,IAAI,kBAAkB,IAAI;AAAA,MAChE,QAAQ,UAAU,UAAU,QAAQ,IAAI,kBAAkB,IAAI;AAAA,MAC9D,OAAO,UAAU,SAAS,QAAQ,IAAI;AAAA,MACtC,YAAY,UAAU,cAAc,QAAQ,IAAI,sBAAsB,IAAI;AAAA,MAC1E,WAAW,UAAU;AAAA,IACvB,CAAC;AACD,QAAI,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO;AAC1D,aAAO,QAAQ,IAAI;AACnB,aAAO,eAAe;AAAA,IACxB;AACA,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,IAAI,UAAmB;AACrB,WAAO,QAAQ,KAAK,KAAK,UAAU;AAAA,EACrC;AAAA,EAEA,MAAc,SAA0B;AACtC,QAAI,KAAK,KAAK,MAAO,QAAO,KAAK,KAAK;AACtC,QAAI,KAAK,KAAK,OAAQ,QAAO,KAAK,KAAK;AACvC,QAAI,KAAK,OAAO;AACd,UAAI,KAAK,MAAM,aAAa,KAAK,IAAI,IAAI,KAAK,MAAM,YAAY,gBAAgB;AAC9E,aAAK,QAAQ,MAAM,cAAc,KAAK,SAAS,KAAK,KAAK;AACzD,YAAI,KAAK,cAAc;AACrB,gBAAM,MAAM,WAAW;AACvB,cAAI,QAAQ,KAAK;AACjB,qBAAW,GAAG;AAAA,QAChB;AAAA,MACF;AACA,aAAO,KAAK,MAAM;AAAA,IACpB;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,QACZ,QACA,MACA,OAAuE,CAAC,GAC5D;AACZ,UAAM,MAAM,IAAI,IAAI,KAAK,UAAU,IAAI;AACvC,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,GAAG;AACrD,UAAI,KAAK,KAAM,KAAI,aAAa,IAAI,GAAG,CAAC;AAAA,IAC1C;AACA,UAAM,UAAkC,EAAE,eAAe,UAAU,MAAM,KAAK,OAAO,CAAC,GAAG;AACzF,QAAI;AACJ,QAAI,KAAK,SAAS,QAAW;AAC3B,cAAQ,cAAc,IAAI;AAC1B,aAAO,KAAK,UAAU,KAAK,IAAI;AAAA,IACjC;AACA,UAAM,MAAM,MAAM,KAAK,UAAU,KAAK,EAAE,QAAQ,SAAS,KAAK,CAAC;AAC/D,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,QAAI,CAAC,IAAI,GAAI,OAAM,IAAI,YAAY,IAAI,QAAQ,MAAM,GAAG,MAAM,IAAI,IAAI,EAAE;AACxE,WAAQ,OAAO,KAAK,MAAM,IAAI,IAAI;AAAA,EACpC;AAAA,EAEiB,SAAiB,CAAC,MAAM,SAAS,KAAK,QAAiB,QAAQ,MAAM,EAAE,KAAK,CAAC;AAAA;AAAA,EAG9F,kBAAiD;AAC/C,WAAO,KAAK,QAAQ,OAAO,eAAe;AAAA,EAC5C;AAAA;AAAA,EAGA,aAAa,MAAuC;AAClD,WAAO,KAAK,QAAQ,OAAO,oBAAoB;AAAA,MAC7C,OAAO,EAAE,SAAS,KAAK,SAAS,aAAa,KAAK,WAAW;AAAA,IAC/D,CAAC;AAAA,EACH;AAAA;AAAA,EAGA,eAAe,MAA2C;AACxD,UAAM,YAAsD;AAAA,MAC1D,MAAM;AAAA,MACN,eAAe,KAAK;AAAA,MACpB,UAAU,KAAK;AAAA,MACf,cAAc,KAAK;AAAA,MACnB,cAAc,KAAK;AAAA,MACnB,UAAU,KAAK,YAAY;AAAA,IAC7B;AACA,WAAO,KAAK,QAAQ,QAAQ,kBAAkB,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAAA,EACvE;AAAA;AAAA,EAGA,cAAc,MAA0C;AACtD,UAAM,YAAoD;AAAA,MACxD,MAAM;AAAA,MACN,eAAe,KAAK;AAAA,MACpB,KAAK,KAAK,OAAO;AAAA,MACjB,SAAS,KAAK,WAAW;AAAA,IAC3B;AACA,WAAO,KAAK,QAAQ,QAAQ,kBAAkB,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAAA,EACvE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,kBAAkB,MAAsB,OAAoB,CAAC,GAA2B;AAC5F,UAAM,YAA6D;AAAA,MACjE,MAAM;AAAA,MACN,eAAe,KAAK;AAAA,MACpB,OAAO,KAAK;AAAA,MACZ,UAAU,KAAK,YAAY;AAAA,MAC3B,UAAU,KAAK,MAAM;AAAA,MACrB,aAAa,KAAK,cAAc;AAAA,MAChC,QAAQ,KAAK;AAAA,IACf;AACA,UAAM,EAAE,UAAU,QAAQ,IAAI,MAAM,KAAK;AAAA,MACvC;AAAA,MACA;AAAA,MACA,EAAE,MAAM,EAAE,UAAU,EAAE;AAAA,IACxB;AACA,SACG,KAAK,YAAY,SAClB,SAAS,WAAW,uBACpB,KAAK,KAAK,YACV;AACA,YAAM;AAAA,QACJ,KAAK;AAAA,QACL,SAAS;AAAA,QACT,KAAK;AAAA,QACL,eAAe,KAAK,KAAK,UAAU;AAAA,QACnC;AAAA,MACF;AACA,aAAO,KAAK,WAAW,SAAS,UAAU;AAAA,IAC5C;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,YAAY,MAAgB,OAAoB,CAAC,GAAwB;AAC7E,UAAM,YAAgD;AAAA,MACpD,MAAM;AAAA,MACN,eAAe,KAAK;AAAA,MACpB,WAAW,KAAK;AAAA,MAChB,WAAW,KAAK,YAAY,KAAK;AAAA,MACjC,WAAW,KAAK;AAAA,MAChB,WAAW,KAAK;AAAA,MAChB,QAAQ,KAAK;AAAA,MACb,gBAAgB,KAAK,iBAAiB;AAAA,MACtC,cAAc,KAAK,eAAe;AAAA,MAClC,WAAW,KAAK,aAAa;AAAA,MAC7B,aAAa,KAAK,cAAc;AAAA,IAClC;AACA,UAAM,SAAS,MAAM,KAAK,QAAoB,QAAQ,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAC5F,SACG,KAAK,YAAY,SAClB,OAAO,SAAS,WAAW,uBAC3B,KAAK,KAAK,YACV;AACA,YAAM;AAAA,QACJ,KAAK;AAAA,QACL,OAAO,SAAS;AAAA,QAChB,OAAO;AAAA,QACP,eAAe,KAAK,KAAK,UAAU;AAAA,MACrC;AACA,aAAO,EAAE,GAAG,QAAQ,UAAU,MAAM,KAAK,WAAW,OAAO,SAAS,UAAU,EAAE;AAAA,IAClF;AACA,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,WAAW,WAA2C;AACpD,WAAO,KAAK,QAAQ,OAAO,mBAAmB,SAAS,EAAE;AAAA,EAC3D;AAAA;AAAA,EAGA,MAAM,eACJ,WACA,OAAoD,CAAC,GAC7B;AACxB,UAAM,WAAW,KAAK,cAAc;AACpC,UAAM,WAAW,KAAK,IAAI,KAAK,KAAK,aAAa;AACjD,eAAS;AACP,YAAM,IAAI,MAAM,KAAK,WAAW,SAAS;AACzC,YAAM,UAAU,EAAE,WAAW,sBAAsB,EAAE,WAAW;AAChE,UAAI,CAAC,WAAW,KAAK,IAAI,IAAI,SAAU,QAAO;AAC9C,YAAM,IAAI,QAAQ,CAAC,QAAQ,WAAW,KAAK,QAAQ,CAAC;AAAA,IACtD;AAAA,EACF;AACF;","names":["Buffer","Buffer"]}

package/dist/cli.js

@@ -1,18 +1,26 @@
 #!/usr/bin/env node
 import {
   PayboxClient,
+  agentClientId,
+  appBaseFrom,
+  configDir,
   configFile,
   loadConfig,
   loginLoopback,
+  openBrowser,
   saveConfig
-} from "./chunk-23N5RHOB.js";
+} from "./chunk-KUOJ5BXR.js";
 
 // src/cli.ts
-import { readFileSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { readFileSync, rmSync } from "node:fs";
+import { createInterface } from "node:readline/promises";
 import { Command } from "commander";
 var DEFAULT_BASE_URL = "https://api.paybox.sh";
+var PKG = "@paybox-sh/sdk";
+var VERSION = "0.3.0";
 var program = new Command();
-program.name("paybox").description("Paybox agent CLI \u2014 vaulted cards, wallets, and secrets for agents").version("0.1.0").option("--base-url <url>", "API origin (default https://api.paybox.sh or stored)").option("--json", "machine-readable JSON output");
+program.name("paybox").description("Paybox agent CLI \u2014 vaulted cards, wallets, and secrets for agents").version(VERSION).option("--base-url <url>", "API origin (default https://api.paybox.sh or stored)").option("--json", "machine-readable JSON output");
 function jsonMode() {
   return Boolean(program.opts().json);
 }
@@ -37,6 +45,25 @@ function int(flag, value) {
 function optInt(flag, value) {
   return value === void 0 ? void 0 : int(flag, value);
 }
+function isNewer(a, b) {
+  const pa = a.split(".").map(Number);
+  const pb = b.split(".").map(Number);
+  for (let i = 0; i < 3; i++) {
+    const x = pa[i] ?? 0;
+    const y = pb[i] ?? 0;
+    if (x !== y) return x > y;
+  }
+  return false;
+}
+async function prompt(question) {
+  if (!process.stdin.isTTY) return "";
+  const rl = createInterface({ input: process.stdin, output: process.stderr });
+  try {
+    return (await rl.question(question)).trim();
+  } finally {
+    rl.close();
+  }
+}
 async function run(fn) {
   try {
     await fn();
@@ -45,11 +72,12 @@ async function run(fn) {
     process.exitCode = 1;
   }
 }
-program.command("login").description("Authenticate via OAuth (browser + passkey), or store a pbx_live_ key").option("--key <key>", "store a pbx_live_ personal API key instead of OAuth").option("--signing-key <token>", "store a pbxk1. wallet signing key (enables sign/swap)").action(
+program.command("login").description("Authenticate via OAuth (browser + passkey), or store a pbx_live_ key").option("--key <key>", "store a pbx_live_ personal API key instead of OAuth").option("--signing-key <token>", "store a pbxk1. wallet signing key (skips the prompt)").option("--app-url <url>", "Paybox app origin for key provisioning (default: derived from --base-url)").option("--no-provision", "skip the wallet signing-key provisioning step").action(
   (opts) => run(async () => {
     const cfg = loadConfig();
     const baseUrl = (program.opts().baseUrl ?? process.env.PAYBOX_API_URL ?? cfg.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
     cfg.baseUrl = baseUrl;
+    if (opts.appUrl) cfg.appUrl = opts.appUrl;
     if (opts.key) {
       cfg.apiKey = opts.key;
       delete cfg.oauth;
@@ -60,6 +88,31 @@ program.command("login").description("Authenticate via OAuth (browser + passkey)
     if (opts.signingKey) cfg.signingKey = opts.signingKey;
     saveConfig(cfg);
     console.error(`Saved credentials to ${configFile()}`);
+    if (!cfg.oauth || opts.signingKey || opts.provision === false) return;
+    const cid = agentClientId(cfg.oauth.accessToken);
+    const appBase = appBaseFrom(baseUrl, opts.appUrl ?? process.env.PAYBOX_APP_URL ?? cfg.appUrl);
+    if (!cid || !appBase) {
+      console.error(
+        "To enable wallet sign/swap, provision a signing key and run\n  paybox login --signing-key <pbxk1...>" + (cid && !appBase ? " (or pass --app-url <paybox app origin>)" : "")
+      );
+      return;
+    }
+    const url = `${appBase}/agent-key?client_id=${cid}`;
+    console.error(
+      `
+Next, provision a wallet signing key for this agent (needed for sign/swap):
+  ${url}
+`
+    );
+    openBrowser(url);
+    const key = await prompt("Paste the pbxk1. signing key when ready (or Enter to skip): ");
+    if (key) {
+      cfg.signingKey = key;
+      saveConfig(cfg);
+      console.error("Signing key saved \u2014 sign/swap enabled.");
+    } else {
+      console.error("Skipped \u2014 add it later with `paybox login --signing-key <pbxk1...>`.");
+    }
   })
 );
 program.command("logout").description("Forget stored credentials").action(
@@ -158,5 +211,53 @@ program.command("request <id>").description("Poll a request's status").option("-
     emit(o.wait ? await c.waitForRequest(id) : await c.getRequest(id));
   })
 );
+program.command("version").description("Show the installed CLI version (and whether an update is available)").action(
+  () => run(async () => {
+    let latest;
+    try {
+      const res = await fetch(`https://registry.npmjs.org/${PKG}/latest`);
+      if (res.ok) latest = (await res.json()).version;
+    } catch {
+    }
+    const updateAvailable = Boolean(latest && isNewer(latest, VERSION));
+    if (jsonMode()) {
+      emit({ version: VERSION, latest: latest ?? null, updateAvailable });
+      return;
+    }
+    console.log(`${PKG} v${VERSION}`);
+    if (updateAvailable) {
+      console.log(`Update available: v${latest} \u2014 run \`paybox update\`.`);
+    }
+  })
+);
+program.command("update").description("Update the globally-installed paybox CLI to the latest version").option("--print", "print the update command instead of running it").action(
+  (opts) => run(async () => {
+    const args = ["install", "-g", `${PKG}@latest`];
+    if (opts.print) {
+      console.log(`npm ${args.join(" ")}`);
+      return;
+    }
+    console.error(`Updating ${PKG} (npm ${args.join(" ")})\u2026`);
+    const r = spawnSync("npm", args, { stdio: "inherit" });
+    if (r.status !== 0) {
+      console.error(
+        `
+If this isn't a global install: run \`pnpm up ${PKG}\` in your project, or use \`npx ${PKG}@latest \u2026\` to always run the latest.`
+      );
+      process.exitCode = r.status ?? 1;
+    }
+  })
+);
+program.command("uninstall").description("Remove stored Paybox credentials/config (and show how to remove the CLI)").action(
+  () => run(async () => {
+    const dir = configDir();
+    rmSync(dir, { recursive: true, force: true });
+    console.error(`Removed stored config at ${dir}.`);
+    console.error(
+      `The CLI binary is managed by npm \u2014 remove it with:
+  npm rm -g ${PKG}`
+    );
+  })
+);
 program.parseAsync(process.argv);
 //# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/cli.ts"],"sourcesContent":["#!/usr/bin/env node\n// The `paybox` CLI — a thin wrapper over PayboxClient. Mirrors the MCP tools as\n// subcommands; `--json` on any command emits machine-readable output.\n\nimport { readFileSync } from \"node:fs\";\n\nimport { Command } from \"commander\";\n\nimport { loginLoopback } from \"./auth.js\";\nimport { PayboxClient } from \"./client.js\";\nimport { configFile, loadConfig, saveConfig } from \"./config.js\";\n\nconst DEFAULT_BASE_URL = \"https://api.paybox.sh\";\n\nconst program = new Command();\nprogram\n  .name(\"paybox\")\n  .description(\"Paybox agent CLI — vaulted cards, wallets, and secrets for agents\")\n  .version(\"0.1.0\")\n  .option(\"--base-url <url>\", \"API origin (default https://api.paybox.sh or stored)\")\n  .option(\"--json\", \"machine-readable JSON output\");\n\nfunction jsonMode(): boolean {\n  return Boolean(program.opts().json);\n}\n\nfunction emit(data: unknown): void {\n  if (jsonMode()) console.log(JSON.stringify(data, null, 2));\n  else console.dir(data, { depth: null, colors: process.stdout.isTTY });\n}\n\nfunction client(): PayboxClient {\n  return PayboxClient.fromConfig({ baseUrl: program.opts().baseUrl });\n}\n\nfunction readIntent(value: string): unknown {\n  const raw = value.startsWith(\"@\") ? readFileSync(value.slice(1), \"utf8\") : value;\n  return JSON.parse(raw);\n}\n\nfunction int(flag: string, value: string): number {\n  const n = Number(value);\n  if (!Number.isInteger(n)) {\n    throw new Error(`--${flag} must be an integer, got ${JSON.stringify(value)}`);\n  }\n  return n;\n}\n\nfunction optInt(flag: string, value: string | undefined): number | undefined {\n  return value === undefined ? undefined : int(flag, value);\n}\n\nasync function run(fn: () => Promise<void>): Promise<void> {\n  try {\n    await fn();\n  } catch (err) {\n    console.error(err instanceof Error ? err.message : String(err));\n    process.exitCode = 1;\n  }\n}\n\nprogram\n  .command(\"login\")\n  .description(\"Authenticate via OAuth (browser + passkey), or store a pbx_live_ key\")\n  .option(\"--key <key>\", \"store a pbx_live_ personal API key instead of OAuth\")\n  .option(\"--signing-key <token>\", \"store a pbxk1. wallet signing key (enables sign/swap)\")\n  .action((opts) =>\n    run(async () => {\n      const cfg = loadConfig();\n      const baseUrl = (\n        program.opts().baseUrl ??\n        process.env.PAYBOX_API_URL ??\n        cfg.baseUrl ??\n        DEFAULT_BASE_URL\n      ).replace(/\\/+$/, \"\");\n      cfg.baseUrl = baseUrl;\n      if (opts.key) {\n        cfg.apiKey = opts.key;\n        delete cfg.oauth;\n      } else {\n        cfg.oauth = await loginLoopback(baseUrl);\n        delete cfg.apiKey;\n      }\n      if (opts.signingKey) cfg.signingKey = opts.signingKey;\n      saveConfig(cfg);\n      console.error(`Saved credentials to ${configFile()}`);\n    }),\n  );\n\nprogram\n  .command(\"logout\")\n  .description(\"Forget stored credentials\")\n  .action(() =>\n    run(async () => {\n      const cfg = loadConfig();\n      delete cfg.apiKey;\n      delete cfg.oauth;\n      delete cfg.signingKey;\n      saveConfig(cfg);\n      console.error(\"Logged out.\");\n    }),\n  );\n\nprogram\n  .command(\"whoami\")\n  .description(\"Show the configured endpoint, auth mode, and signing capability\")\n  .action(() =>\n    run(async () => {\n      const cfg = loadConfig();\n      const c = client();\n      const mode = process.env.PAYBOX_ACCESS_TOKEN\n        ? \"oauth (env token)\"\n        : process.env.PAYBOX_API_KEY || cfg.apiKey\n          ? \"api key\"\n          : cfg.oauth\n            ? \"oauth\"\n            : \"none\";\n      emit({ baseUrl: c.baseUrl, auth: mode, canSign: c.canSign, configFile: configFile() });\n    }),\n  );\n\nprogram\n  .command(\"credentials\")\n  .description(\"List the credentials this client may use\")\n  .action(() => run(async () => emit(await client().listCredentials())));\n\nprogram\n  .command(\"pay\")\n  .description(\"Charge a card credential\")\n  .requiredOption(\"--credential <id>\")\n  .requiredOption(\"--merchant <name>\")\n  .requiredOption(\"--url <url>\", \"real merchant URL the card is bound to\")\n  .requiredOption(\"--amount <cents>\", \"amount in cents\")\n  .option(\"--currency <code>\", \"ISO 4217 currency\", \"USD\")\n  .action((o) =>\n    run(async () =>\n      emit(\n        await client().requestPayment({\n          credentialId: o.credential,\n          merchant: o.merchant,\n          merchantUrl: o.url,\n          amountCents: int(\"amount\", o.amount),\n          currency: o.currency,\n        }),\n      ),\n    ),\n  );\n\nprogram\n  .command(\"secret\")\n  .description(\"Reveal a secret credential (one-time token, or --raw value)\")\n  .requiredOption(\"--credential <id>\")\n  .option(\"--raw\", \"return the raw secret value (grant-gated)\")\n  .option(\"--purpose <text>\", \"why the secret is requested (shown on approval)\")\n  .action((o) =>\n    run(async () =>\n      emit(\n        await client().requestSecret({\n          credentialId: o.credential,\n          raw: Boolean(o.raw),\n          purpose: o.purpose,\n        }),\n      ),\n    ),\n  );\n\nprogram\n  .command(\"sign\")\n  .description(\"Sign with a wallet credential (intent JSON, or @file)\")\n  .requiredOption(\"--credential <id>\")\n  .requiredOption(\"--chain <caip2>\", 'e.g. \"eip155:8453\"')\n  .requiredOption(\"--intent <json>\", 'a SignIntent, e.g. \\'{\"op\":\"message\",\"message\":\"hi\"}\\' or @intent.json')\n  .option(\"--contract <addr>\")\n  .option(\"--fn <name>\", \"function/instruction name (display-only)\")\n  .option(\"--value-cents <n>\")\n  .action((o) =>\n    run(async () => {\n      const c = client();\n      const res = await c.requestWalletSign({\n        credentialId: o.credential,\n        chain: o.chain,\n        intent: readIntent(o.intent) as never,\n        contract: o.contract,\n        fn: o.fn,\n        valueCents: optInt(\"value-cents\", o.valueCents),\n      });\n      if (res.status === \"pending_signature\" && !c.canSign) {\n        console.error(\n          \"request is awaiting a signature but no signing key is set — \" +\n            \"run `paybox login --signing-key <pbxk1...>` or set PAYBOX_SIGNING_KEY, then poll `paybox request <id>`.\",\n        );\n      }\n      emit(res);\n    }),\n  );\n\nprogram\n  .command(\"swap\")\n  .description(\"Swap tokens from a wallet credential\")\n  .requiredOption(\"--credential <id>\")\n  .requiredOption(\"--src-chain <caip2>\")\n  .requiredOption(\"--src-token <addr>\", '\"native\" or a token address')\n  .requiredOption(\"--dst-token <addr>\")\n  .requiredOption(\"--amount <smallest-unit>\", \"source amount in smallest units\")\n  .option(\"--dst-chain <caip2>\", \"defaults to --src-chain\")\n  .option(\"--direction <dir>\", \"exact-amount-in | exact-amount-out\", \"exact-amount-in\")\n  .option(\"--slippage <bps>\", \"slippage in bps\", \"50\")\n  .option(\"--recipient <addr>\")\n  .option(\"--value-cents <n>\")\n  .action((o) =>\n    run(async () => {\n      const c = client();\n      const result = await c.requestSwap({\n        credentialId: o.credential,\n        srcChain: o.srcChain,\n        dstChain: o.dstChain,\n        srcToken: o.srcToken,\n        dstToken: o.dstToken,\n        amount: o.amount,\n        swapDirection: o.direction,\n        slippageBps: int(\"slippage\", o.slippage),\n        recipient: o.recipient,\n        valueCents: optInt(\"value-cents\", o.valueCents),\n      });\n      if (result.response.status === \"pending_signature\" && !c.canSign) {\n        console.error(\n          \"swap is awaiting signatures but no signing key is set — \" +\n            \"run `paybox login --signing-key <pbxk1...>` or set PAYBOX_SIGNING_KEY, then poll `paybox request <id>`.\",\n        );\n      }\n      emit(result);\n    }),\n  );\n\nprogram\n  .command(\"portfolio\")\n  .description(\"List a wallet address's token balances across chains\")\n  .requiredOption(\"--address <addr>\")\n  .option(\"--networks <ids>\", 'comma-separated network IDs, e.g. \"1,8453\"')\n  .action((o) =>\n    run(async () =>\n      emit(await client().getPortfolio({ address: o.address, networkIds: o.networks })),\n    ),\n  );\n\nprogram\n  .command(\"request <id>\")\n  .description(\"Poll a request's status\")\n  .option(\"--wait\", \"block until it leaves the pending state\")\n  .action((id, o) =>\n    run(async () => {\n      const c = client();\n      emit(o.wait ? await c.waitForRequest(id) : await c.getRequest(id));\n    }),\n  );\n\nprogram.parseAsync(process.argv);\n"],"mappings":";;;;;;;;;;AAIA,SAAS,oBAAoB;AAE7B,SAAS,eAAe;AAMxB,IAAM,mBAAmB;AAEzB,IAAM,UAAU,IAAI,QAAQ;AAC5B,QACG,KAAK,QAAQ,EACb,YAAY,wEAAmE,EAC/E,QAAQ,OAAO,EACf,OAAO,oBAAoB,sDAAsD,EACjF,OAAO,UAAU,8BAA8B;AAElD,SAAS,WAAoB;AAC3B,SAAO,QAAQ,QAAQ,KAAK,EAAE,IAAI;AACpC;AAEA,SAAS,KAAK,MAAqB;AACjC,MAAI,SAAS,EAAG,SAAQ,IAAI,KAAK,UAAU,MAAM,MAAM,CAAC,CAAC;AAAA,MACpD,SAAQ,IAAI,MAAM,EAAE,OAAO,MAAM,QAAQ,QAAQ,OAAO,MAAM,CAAC;AACtE;AAEA,SAAS,SAAuB;AAC9B,SAAO,aAAa,WAAW,EAAE,SAAS,QAAQ,KAAK,EAAE,QAAQ,CAAC;AACpE;AAEA,SAAS,WAAW,OAAwB;AAC1C,QAAM,MAAM,MAAM,WAAW,GAAG,IAAI,aAAa,MAAM,MAAM,CAAC,GAAG,MAAM,IAAI;AAC3E,SAAO,KAAK,MAAM,GAAG;AACvB;AAEA,SAAS,IAAI,MAAc,OAAuB;AAChD,QAAM,IAAI,OAAO,KAAK;AACtB,MAAI,CAAC,OAAO,UAAU,CAAC,GAAG;AACxB,UAAM,IAAI,MAAM,KAAK,IAAI,4BAA4B,KAAK,UAAU,KAAK,CAAC,EAAE;AAAA,EAC9E;AACA,SAAO;AACT;AAEA,SAAS,OAAO,MAAc,OAA+C;AAC3E,SAAO,UAAU,SAAY,SAAY,IAAI,MAAM,KAAK;AAC1D;AAEA,eAAe,IAAI,IAAwC;AACzD,MAAI;AACF,UAAM,GAAG;AAAA,EACX,SAAS,KAAK;AACZ,YAAQ,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAC9D,YAAQ,WAAW;AAAA,EACrB;AACF;AAEA,QACG,QAAQ,OAAO,EACf,YAAY,sEAAsE,EAClF,OAAO,eAAe,qDAAqD,EAC3E,OAAO,yBAAyB,uDAAuD,EACvF;AAAA,EAAO,CAAC,SACP,IAAI,YAAY;AACd,UAAM,MAAM,WAAW;AACvB,UAAM,WACJ,QAAQ,KAAK,EAAE,WACf,QAAQ,IAAI,kBACZ,IAAI,WACJ,kBACA,QAAQ,QAAQ,EAAE;AACpB,QAAI,UAAU;AACd,QAAI,KAAK,KAAK;AACZ,UAAI,SAAS,KAAK;AAClB,aAAO,IAAI;AAAA,IACb,OAAO;AACL,UAAI,QAAQ,MAAM,cAAc,OAAO;AACvC,aAAO,IAAI;AAAA,IACb;AACA,QAAI,KAAK,WAAY,KAAI,aAAa,KAAK;AAC3C,eAAW,GAAG;AACd,YAAQ,MAAM,wBAAwB,WAAW,CAAC,EAAE;AAAA,EACtD,CAAC;AACH;AAEF,QACG,QAAQ,QAAQ,EAChB,YAAY,2BAA2B,EACvC;AAAA,EAAO,MACN,IAAI,YAAY;AACd,UAAM,MAAM,WAAW;AACvB,WAAO,IAAI;AACX,WAAO,IAAI;AACX,WAAO,IAAI;AACX,eAAW,GAAG;AACd,YAAQ,MAAM,aAAa;AAAA,EAC7B,CAAC;AACH;AAEF,QACG,QAAQ,QAAQ,EAChB,YAAY,iEAAiE,EAC7E;AAAA,EAAO,MACN,IAAI,YAAY;AACd,UAAM,MAAM,WAAW;AACvB,UAAM,IAAI,OAAO;AACjB,UAAM,OAAO,QAAQ,IAAI,sBACrB,sBACA,QAAQ,IAAI,kBAAkB,IAAI,SAChC,YACA,IAAI,QACF,UACA;AACR,SAAK,EAAE,SAAS,EAAE,SAAS,MAAM,MAAM,SAAS,EAAE,SAAS,YAAY,WAAW,EAAE,CAAC;AAAA,EACvF,CAAC;AACH;AAEF,QACG,QAAQ,aAAa,EACrB,YAAY,0CAA0C,EACtD,OAAO,MAAM,IAAI,YAAY,KAAK,MAAM,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAEvE,QACG,QAAQ,KAAK,EACb,YAAY,0BAA0B,EACtC,eAAe,mBAAmB,EAClC,eAAe,mBAAmB,EAClC,eAAe,eAAe,wCAAwC,EACtE,eAAe,oBAAoB,iBAAiB,EACpD,OAAO,qBAAqB,qBAAqB,KAAK,EACtD;AAAA,EAAO,CAAC,MACP;AAAA,IAAI,YACF;AAAA,MACE,MAAM,OAAO,EAAE,eAAe;AAAA,QAC5B,cAAc,EAAE;AAAA,QAChB,UAAU,EAAE;AAAA,QACZ,aAAa,EAAE;AAAA,QACf,aAAa,IAAI,UAAU,EAAE,MAAM;AAAA,QACnC,UAAU,EAAE;AAAA,MACd,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEF,QACG,QAAQ,QAAQ,EAChB,YAAY,6DAA6D,EACzE,eAAe,mBAAmB,EAClC,OAAO,SAAS,2CAA2C,EAC3D,OAAO,oBAAoB,iDAAiD,EAC5E;AAAA,EAAO,CAAC,MACP;AAAA,IAAI,YACF;AAAA,MACE,MAAM,OAAO,EAAE,cAAc;AAAA,QAC3B,cAAc,EAAE;AAAA,QAChB,KAAK,QAAQ,EAAE,GAAG;AAAA,QAClB,SAAS,EAAE;AAAA,MACb,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEF,QACG,QAAQ,MAAM,EACd,YAAY,uDAAuD,EACnE,eAAe,mBAAmB,EAClC,eAAe,mBAAmB,oBAAoB,EACtD,eAAe,mBAAmB,sEAAwE,EAC1G,OAAO,mBAAmB,EAC1B,OAAO,eAAe,0CAA0C,EAChE,OAAO,mBAAmB,EAC1B;AAAA,EAAO,CAAC,MACP,IAAI,YAAY;AACd,UAAM,IAAI,OAAO;AACjB,UAAM,MAAM,MAAM,EAAE,kBAAkB;AAAA,MACpC,cAAc,EAAE;AAAA,MAChB,OAAO,EAAE;AAAA,MACT,QAAQ,WAAW,EAAE,MAAM;AAAA,MAC3B,UAAU,EAAE;AAAA,MACZ,IAAI,EAAE;AAAA,MACN,YAAY,OAAO,eAAe,EAAE,UAAU;AAAA,IAChD,CAAC;AACD,QAAI,IAAI,WAAW,uBAAuB,CAAC,EAAE,SAAS;AACpD,cAAQ;AAAA,QACN;AAAA,MAEF;AAAA,IACF;AACA,SAAK,GAAG;AAAA,EACV,CAAC;AACH;AAEF,QACG,QAAQ,MAAM,EACd,YAAY,sCAAsC,EAClD,eAAe,mBAAmB,EAClC,eAAe,qBAAqB,EACpC,eAAe,sBAAsB,6BAA6B,EAClE,eAAe,oBAAoB,EACnC,eAAe,4BAA4B,iCAAiC,EAC5E,OAAO,uBAAuB,yBAAyB,EACvD,OAAO,qBAAqB,sCAAsC,iBAAiB,EACnF,OAAO,oBAAoB,mBAAmB,IAAI,EAClD,OAAO,oBAAoB,EAC3B,OAAO,mBAAmB,EAC1B;AAAA,EAAO,CAAC,MACP,IAAI,YAAY;AACd,UAAM,IAAI,OAAO;AACjB,UAAM,SAAS,MAAM,EAAE,YAAY;AAAA,MACjC,cAAc,EAAE;AAAA,MAChB,UAAU,EAAE;AAAA,MACZ,UAAU,EAAE;AAAA,MACZ,UAAU,EAAE;AAAA,MACZ,UAAU,EAAE;AAAA,MACZ,QAAQ,EAAE;AAAA,MACV,eAAe,EAAE;AAAA,MACjB,aAAa,IAAI,YAAY,EAAE,QAAQ;AAAA,MACvC,WAAW,EAAE;AAAA,MACb,YAAY,OAAO,eAAe,EAAE,UAAU;AAAA,IAChD,CAAC;AACD,QAAI,OAAO,SAAS,WAAW,uBAAuB,CAAC,EAAE,SAAS;AAChE,cAAQ;AAAA,QACN;AAAA,MAEF;AAAA,IACF;AACA,SAAK,MAAM;AAAA,EACb,CAAC;AACH;AAEF,QACG,QAAQ,WAAW,EACnB,YAAY,sDAAsD,EAClE,eAAe,kBAAkB,EACjC,OAAO,oBAAoB,4CAA4C,EACvE;AAAA,EAAO,CAAC,MACP;AAAA,IAAI,YACF,KAAK,MAAM,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,YAAY,EAAE,SAAS,CAAC,CAAC;AAAA,EAClF;AACF;AAEF,QACG,QAAQ,cAAc,EACtB,YAAY,yBAAyB,EACrC,OAAO,UAAU,yCAAyC,EAC1D;AAAA,EAAO,CAAC,IAAI,MACX,IAAI,YAAY;AACd,UAAM,IAAI,OAAO;AACjB,SAAK,EAAE,OAAO,MAAM,EAAE,eAAe,EAAE,IAAI,MAAM,EAAE,WAAW,EAAE,CAAC;AAAA,EACnE,CAAC;AACH;AAEF,QAAQ,WAAW,QAAQ,IAAI;","names":[]}
+{"version":3,"sources":["../src/cli.ts"],"sourcesContent":["#!/usr/bin/env node\n// The `paybox` CLI — a thin wrapper over PayboxClient. Mirrors the MCP tools as\n// subcommands; `--json` on any command emits machine-readable output.\n\nimport { spawnSync } from \"node:child_process\";\nimport { readFileSync, rmSync } from \"node:fs\";\nimport { createInterface } from \"node:readline/promises\";\n\nimport { Command } from \"commander\";\n\nimport { agentClientId, appBaseFrom, loginLoopback, openBrowser } from \"./auth.js\";\nimport { PayboxClient } from \"./client.js\";\nimport { configDir, configFile, loadConfig, saveConfig } from \"./config.js\";\n\nconst DEFAULT_BASE_URL = \"https://api.paybox.sh\";\nconst PKG = \"@paybox-sh/sdk\";\nconst VERSION = \"0.3.0\";\n\nconst program = new Command();\nprogram\n  .name(\"paybox\")\n  .description(\"Paybox agent CLI — vaulted cards, wallets, and secrets for agents\")\n  .version(VERSION)\n  .option(\"--base-url <url>\", \"API origin (default https://api.paybox.sh or stored)\")\n  .option(\"--json\", \"machine-readable JSON output\");\n\nfunction jsonMode(): boolean {\n  return Boolean(program.opts().json);\n}\n\nfunction emit(data: unknown): void {\n  if (jsonMode()) console.log(JSON.stringify(data, null, 2));\n  else console.dir(data, { depth: null, colors: process.stdout.isTTY });\n}\n\nfunction client(): PayboxClient {\n  return PayboxClient.fromConfig({ baseUrl: program.opts().baseUrl });\n}\n\nfunction readIntent(value: string): unknown {\n  const raw = value.startsWith(\"@\") ? readFileSync(value.slice(1), \"utf8\") : value;\n  return JSON.parse(raw);\n}\n\nfunction int(flag: string, value: string): number {\n  const n = Number(value);\n  if (!Number.isInteger(n)) {\n    throw new Error(`--${flag} must be an integer, got ${JSON.stringify(value)}`);\n  }\n  return n;\n}\n\nfunction optInt(flag: string, value: string | undefined): number | undefined {\n  return value === undefined ? undefined : int(flag, value);\n}\n\n/** True when semver `a` is strictly greater than `b` (plain x.y.z). */\nfunction isNewer(a: string, b: string): boolean {\n  const pa = a.split(\".\").map(Number);\n  const pb = b.split(\".\").map(Number);\n  for (let i = 0; i < 3; i++) {\n    const x = pa[i] ?? 0;\n    const y = pb[i] ?? 0;\n    if (x !== y) return x > y;\n  }\n  return false;\n}\n\nasync function prompt(question: string): Promise<string> {\n  if (!process.stdin.isTTY) return \"\"; // non-interactive: skip\n  const rl = createInterface({ input: process.stdin, output: process.stderr });\n  try {\n    return (await rl.question(question)).trim();\n  } finally {\n    rl.close();\n  }\n}\n\nasync function run(fn: () => Promise<void>): Promise<void> {\n  try {\n    await fn();\n  } catch (err) {\n    console.error(err instanceof Error ? err.message : String(err));\n    process.exitCode = 1;\n  }\n}\n\nprogram\n  .command(\"login\")\n  .description(\"Authenticate via OAuth (browser + passkey), or store a pbx_live_ key\")\n  .option(\"--key <key>\", \"store a pbx_live_ personal API key instead of OAuth\")\n  .option(\"--signing-key <token>\", \"store a pbxk1. wallet signing key (skips the prompt)\")\n  .option(\"--app-url <url>\", \"Paybox app origin for key provisioning (default: derived from --base-url)\")\n  .option(\"--no-provision\", \"skip the wallet signing-key provisioning step\")\n  .action((opts) =>\n    run(async () => {\n      const cfg = loadConfig();\n      const baseUrl = (\n        program.opts().baseUrl ??\n        process.env.PAYBOX_API_URL ??\n        cfg.baseUrl ??\n        DEFAULT_BASE_URL\n      ).replace(/\\/+$/, \"\");\n      cfg.baseUrl = baseUrl;\n      if (opts.appUrl) cfg.appUrl = opts.appUrl;\n\n      // Step 1 — authenticate.\n      if (opts.key) {\n        cfg.apiKey = opts.key;\n        delete cfg.oauth;\n      } else {\n        cfg.oauth = await loginLoopback(baseUrl);\n        delete cfg.apiKey;\n      }\n      if (opts.signingKey) cfg.signingKey = opts.signingKey;\n      saveConfig(cfg);\n      console.error(`Saved credentials to ${configFile()}`);\n\n      // Step 2 — provision a wallet signing key. Runs only after OAuth (the app\n      // session is warm) and only when one wasn't supplied or disabled. The app\n      // mints a key scoped to this agent and shows a `pbxk1.` token to paste back.\n      if (!cfg.oauth || opts.signingKey || opts.provision === false) return;\n      const cid = agentClientId(cfg.oauth.accessToken);\n      const appBase = appBaseFrom(baseUrl, opts.appUrl ?? process.env.PAYBOX_APP_URL ?? cfg.appUrl);\n      if (!cid || !appBase) {\n        console.error(\n          \"To enable wallet sign/swap, provision a signing key and run\\n\" +\n            \"  paybox login --signing-key <pbxk1...>\" +\n            (cid && !appBase ? \" (or pass --app-url <paybox app origin>)\" : \"\"),\n        );\n        return;\n      }\n      const url = `${appBase}/agent-key?client_id=${cid}`;\n      console.error(\n        `\\nNext, provision a wallet signing key for this agent (needed for sign/swap):\\n  ${url}\\n`,\n      );\n      openBrowser(url);\n      const key = await prompt(\"Paste the pbxk1. signing key when ready (or Enter to skip): \");\n      if (key) {\n        cfg.signingKey = key;\n        saveConfig(cfg);\n        console.error(\"Signing key saved — sign/swap enabled.\");\n      } else {\n        console.error(\"Skipped — add it later with `paybox login --signing-key <pbxk1...>`.\");\n      }\n    }),\n  );\n\nprogram\n  .command(\"logout\")\n  .description(\"Forget stored credentials\")\n  .action(() =>\n    run(async () => {\n      const cfg = loadConfig();\n      delete cfg.apiKey;\n      delete cfg.oauth;\n      delete cfg.signingKey;\n      saveConfig(cfg);\n      console.error(\"Logged out.\");\n    }),\n  );\n\nprogram\n  .command(\"whoami\")\n  .description(\"Show the configured endpoint, auth mode, and signing capability\")\n  .action(() =>\n    run(async () => {\n      const cfg = loadConfig();\n      const c = client();\n      const mode = process.env.PAYBOX_ACCESS_TOKEN\n        ? \"oauth (env token)\"\n        : process.env.PAYBOX_API_KEY || cfg.apiKey\n          ? \"api key\"\n          : cfg.oauth\n            ? \"oauth\"\n            : \"none\";\n      emit({ baseUrl: c.baseUrl, auth: mode, canSign: c.canSign, configFile: configFile() });\n    }),\n  );\n\nprogram\n  .command(\"credentials\")\n  .description(\"List the credentials this client may use\")\n  .action(() => run(async () => emit(await client().listCredentials())));\n\nprogram\n  .command(\"pay\")\n  .description(\"Charge a card credential\")\n  .requiredOption(\"--credential <id>\")\n  .requiredOption(\"--merchant <name>\")\n  .requiredOption(\"--url <url>\", \"real merchant URL the card is bound to\")\n  .requiredOption(\"--amount <cents>\", \"amount in cents\")\n  .option(\"--currency <code>\", \"ISO 4217 currency\", \"USD\")\n  .action((o) =>\n    run(async () =>\n      emit(\n        await client().requestPayment({\n          credentialId: o.credential,\n          merchant: o.merchant,\n          merchantUrl: o.url,\n          amountCents: int(\"amount\", o.amount),\n          currency: o.currency,\n        }),\n      ),\n    ),\n  );\n\nprogram\n  .command(\"secret\")\n  .description(\"Reveal a secret credential (one-time token, or --raw value)\")\n  .requiredOption(\"--credential <id>\")\n  .option(\"--raw\", \"return the raw secret value (grant-gated)\")\n  .option(\"--purpose <text>\", \"why the secret is requested (shown on approval)\")\n  .action((o) =>\n    run(async () =>\n      emit(\n        await client().requestSecret({\n          credentialId: o.credential,\n          raw: Boolean(o.raw),\n          purpose: o.purpose,\n        }),\n      ),\n    ),\n  );\n\nprogram\n  .command(\"sign\")\n  .description(\"Sign with a wallet credential (intent JSON, or @file)\")\n  .requiredOption(\"--credential <id>\")\n  .requiredOption(\"--chain <caip2>\", 'e.g. \"eip155:8453\"')\n  .requiredOption(\"--intent <json>\", 'a SignIntent, e.g. \\'{\"op\":\"message\",\"message\":\"hi\"}\\' or @intent.json')\n  .option(\"--contract <addr>\")\n  .option(\"--fn <name>\", \"function/instruction name (display-only)\")\n  .option(\"--value-cents <n>\")\n  .action((o) =>\n    run(async () => {\n      const c = client();\n      const res = await c.requestWalletSign({\n        credentialId: o.credential,\n        chain: o.chain,\n        intent: readIntent(o.intent) as never,\n        contract: o.contract,\n        fn: o.fn,\n        valueCents: optInt(\"value-cents\", o.valueCents),\n      });\n      if (res.status === \"pending_signature\" && !c.canSign) {\n        console.error(\n          \"request is awaiting a signature but no signing key is set — \" +\n            \"run `paybox login --signing-key <pbxk1...>` or set PAYBOX_SIGNING_KEY, then poll `paybox request <id>`.\",\n        );\n      }\n      emit(res);\n    }),\n  );\n\nprogram\n  .command(\"swap\")\n  .description(\"Swap tokens from a wallet credential\")\n  .requiredOption(\"--credential <id>\")\n  .requiredOption(\"--src-chain <caip2>\")\n  .requiredOption(\"--src-token <addr>\", '\"native\" or a token address')\n  .requiredOption(\"--dst-token <addr>\")\n  .requiredOption(\"--amount <smallest-unit>\", \"source amount in smallest units\")\n  .option(\"--dst-chain <caip2>\", \"defaults to --src-chain\")\n  .option(\"--direction <dir>\", \"exact-amount-in | exact-amount-out\", \"exact-amount-in\")\n  .option(\"--slippage <bps>\", \"slippage in bps\", \"50\")\n  .option(\"--recipient <addr>\")\n  .option(\"--value-cents <n>\")\n  .action((o) =>\n    run(async () => {\n      const c = client();\n      const result = await c.requestSwap({\n        credentialId: o.credential,\n        srcChain: o.srcChain,\n        dstChain: o.dstChain,\n        srcToken: o.srcToken,\n        dstToken: o.dstToken,\n        amount: o.amount,\n        swapDirection: o.direction,\n        slippageBps: int(\"slippage\", o.slippage),\n        recipient: o.recipient,\n        valueCents: optInt(\"value-cents\", o.valueCents),\n      });\n      if (result.response.status === \"pending_signature\" && !c.canSign) {\n        console.error(\n          \"swap is awaiting signatures but no signing key is set — \" +\n            \"run `paybox login --signing-key <pbxk1...>` or set PAYBOX_SIGNING_KEY, then poll `paybox request <id>`.\",\n        );\n      }\n      emit(result);\n    }),\n  );\n\nprogram\n  .command(\"portfolio\")\n  .description(\"List a wallet address's token balances across chains\")\n  .requiredOption(\"--address <addr>\")\n  .option(\"--networks <ids>\", 'comma-separated network IDs, e.g. \"1,8453\"')\n  .action((o) =>\n    run(async () =>\n      emit(await client().getPortfolio({ address: o.address, networkIds: o.networks })),\n    ),\n  );\n\nprogram\n  .command(\"request <id>\")\n  .description(\"Poll a request's status\")\n  .option(\"--wait\", \"block until it leaves the pending state\")\n  .action((id, o) =>\n    run(async () => {\n      const c = client();\n      emit(o.wait ? await c.waitForRequest(id) : await c.getRequest(id));\n    }),\n  );\n\nprogram\n  .command(\"version\")\n  .description(\"Show the installed CLI version (and whether an update is available)\")\n  .action(() =>\n    run(async () => {\n      let latest: string | undefined;\n      try {\n        const res = await fetch(`https://registry.npmjs.org/${PKG}/latest`);\n        if (res.ok) latest = ((await res.json()) as { version?: string }).version;\n      } catch {\n        /* offline — just report the installed version */\n      }\n      const updateAvailable = Boolean(latest && isNewer(latest, VERSION));\n      if (jsonMode()) {\n        emit({ version: VERSION, latest: latest ?? null, updateAvailable });\n        return;\n      }\n      console.log(`${PKG} v${VERSION}`);\n      if (updateAvailable) {\n        console.log(`Update available: v${latest} — run \\`paybox update\\`.`);\n      }\n    }),\n  );\n\nprogram\n  .command(\"update\")\n  .description(\"Update the globally-installed paybox CLI to the latest version\")\n  .option(\"--print\", \"print the update command instead of running it\")\n  .action((opts) =>\n    run(async () => {\n      const args = [\"install\", \"-g\", `${PKG}@latest`];\n      if (opts.print) {\n        console.log(`npm ${args.join(\" \")}`);\n        return;\n      }\n      console.error(`Updating ${PKG} (npm ${args.join(\" \")})…`);\n      const r = spawnSync(\"npm\", args, { stdio: \"inherit\" });\n      if (r.status !== 0) {\n        console.error(\n          `\\nIf this isn't a global install: run \\`pnpm up ${PKG}\\` in your project, ` +\n            `or use \\`npx ${PKG}@latest …\\` to always run the latest.`,\n        );\n        process.exitCode = r.status ?? 1;\n      }\n    }),\n  );\n\nprogram\n  .command(\"uninstall\")\n  .description(\"Remove stored Paybox credentials/config (and show how to remove the CLI)\")\n  .action(() =>\n    run(async () => {\n      const dir = configDir();\n      rmSync(dir, { recursive: true, force: true });\n      console.error(`Removed stored config at ${dir}.`);\n      console.error(\n        `The CLI binary is managed by npm — remove it with:\\n  npm rm -g ${PKG}`,\n      );\n    }),\n  );\n\nprogram.parseAsync(process.argv);\n"],"mappings":";;;;;;;;;;;;;;AAIA,SAAS,iBAAiB;AAC1B,SAAS,cAAc,cAAc;AACrC,SAAS,uBAAuB;AAEhC,SAAS,eAAe;AAMxB,IAAM,mBAAmB;AACzB,IAAM,MAAM;AACZ,IAAM,UAAU;AAEhB,IAAM,UAAU,IAAI,QAAQ;AAC5B,QACG,KAAK,QAAQ,EACb,YAAY,wEAAmE,EAC/E,QAAQ,OAAO,EACf,OAAO,oBAAoB,sDAAsD,EACjF,OAAO,UAAU,8BAA8B;AAElD,SAAS,WAAoB;AAC3B,SAAO,QAAQ,QAAQ,KAAK,EAAE,IAAI;AACpC;AAEA,SAAS,KAAK,MAAqB;AACjC,MAAI,SAAS,EAAG,SAAQ,IAAI,KAAK,UAAU,MAAM,MAAM,CAAC,CAAC;AAAA,MACpD,SAAQ,IAAI,MAAM,EAAE,OAAO,MAAM,QAAQ,QAAQ,OAAO,MAAM,CAAC;AACtE;AAEA,SAAS,SAAuB;AAC9B,SAAO,aAAa,WAAW,EAAE,SAAS,QAAQ,KAAK,EAAE,QAAQ,CAAC;AACpE;AAEA,SAAS,WAAW,OAAwB;AAC1C,QAAM,MAAM,MAAM,WAAW,GAAG,IAAI,aAAa,MAAM,MAAM,CAAC,GAAG,MAAM,IAAI;AAC3E,SAAO,KAAK,MAAM,GAAG;AACvB;AAEA,SAAS,IAAI,MAAc,OAAuB;AAChD,QAAM,IAAI,OAAO,KAAK;AACtB,MAAI,CAAC,OAAO,UAAU,CAAC,GAAG;AACxB,UAAM,IAAI,MAAM,KAAK,IAAI,4BAA4B,KAAK,UAAU,KAAK,CAAC,EAAE;AAAA,EAC9E;AACA,SAAO;AACT;AAEA,SAAS,OAAO,MAAc,OAA+C;AAC3E,SAAO,UAAU,SAAY,SAAY,IAAI,MAAM,KAAK;AAC1D;AAGA,SAAS,QAAQ,GAAW,GAAoB;AAC9C,QAAM,KAAK,EAAE,MAAM,GAAG,EAAE,IAAI,MAAM;AAClC,QAAM,KAAK,EAAE,MAAM,GAAG,EAAE,IAAI,MAAM;AAClC,WAAS,IAAI,GAAG,IAAI,GAAG,KAAK;AAC1B,UAAM,IAAI,GAAG,CAAC,KAAK;AACnB,UAAM,IAAI,GAAG,CAAC,KAAK;AACnB,QAAI,MAAM,EAAG,QAAO,IAAI;AAAA,EAC1B;AACA,SAAO;AACT;AAEA,eAAe,OAAO,UAAmC;AACvD,MAAI,CAAC,QAAQ,MAAM,MAAO,QAAO;AACjC,QAAM,KAAK,gBAAgB,EAAE,OAAO,QAAQ,OAAO,QAAQ,QAAQ,OAAO,CAAC;AAC3E,MAAI;AACF,YAAQ,MAAM,GAAG,SAAS,QAAQ,GAAG,KAAK;AAAA,EAC5C,UAAE;AACA,OAAG,MAAM;AAAA,EACX;AACF;AAEA,eAAe,IAAI,IAAwC;AACzD,MAAI;AACF,UAAM,GAAG;AAAA,EACX,SAAS,KAAK;AACZ,YAAQ,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAC9D,YAAQ,WAAW;AAAA,EACrB;AACF;AAEA,QACG,QAAQ,OAAO,EACf,YAAY,sEAAsE,EAClF,OAAO,eAAe,qDAAqD,EAC3E,OAAO,yBAAyB,sDAAsD,EACtF,OAAO,mBAAmB,2EAA2E,EACrG,OAAO,kBAAkB,+CAA+C,EACxE;AAAA,EAAO,CAAC,SACP,IAAI,YAAY;AACd,UAAM,MAAM,WAAW;AACvB,UAAM,WACJ,QAAQ,KAAK,EAAE,WACf,QAAQ,IAAI,kBACZ,IAAI,WACJ,kBACA,QAAQ,QAAQ,EAAE;AACpB,QAAI,UAAU;AACd,QAAI,KAAK,OAAQ,KAAI,SAAS,KAAK;AAGnC,QAAI,KAAK,KAAK;AACZ,UAAI,SAAS,KAAK;AAClB,aAAO,IAAI;AAAA,IACb,OAAO;AACL,UAAI,QAAQ,MAAM,cAAc,OAAO;AACvC,aAAO,IAAI;AAAA,IACb;AACA,QAAI,KAAK,WAAY,KAAI,aAAa,KAAK;AAC3C,eAAW,GAAG;AACd,YAAQ,MAAM,wBAAwB,WAAW,CAAC,EAAE;AAKpD,QAAI,CAAC,IAAI,SAAS,KAAK,cAAc,KAAK,cAAc,MAAO;AAC/D,UAAM,MAAM,cAAc,IAAI,MAAM,WAAW;AAC/C,UAAM,UAAU,YAAY,SAAS,KAAK,UAAU,QAAQ,IAAI,kBAAkB,IAAI,MAAM;AAC5F,QAAI,CAAC,OAAO,CAAC,SAAS;AACpB,cAAQ;AAAA,QACN,0GAEG,OAAO,CAAC,UAAU,6CAA6C;AAAA,MACpE;AACA;AAAA,IACF;AACA,UAAM,MAAM,GAAG,OAAO,wBAAwB,GAAG;AACjD,YAAQ;AAAA,MACN;AAAA;AAAA,IAAoF,GAAG;AAAA;AAAA,IACzF;AACA,gBAAY,GAAG;AACf,UAAM,MAAM,MAAM,OAAO,8DAA8D;AACvF,QAAI,KAAK;AACP,UAAI,aAAa;AACjB,iBAAW,GAAG;AACd,cAAQ,MAAM,6CAAwC;AAAA,IACxD,OAAO;AACL,cAAQ,MAAM,2EAAsE;AAAA,IACtF;AAAA,EACF,CAAC;AACH;AAEF,QACG,QAAQ,QAAQ,EAChB,YAAY,2BAA2B,EACvC;AAAA,EAAO,MACN,IAAI,YAAY;AACd,UAAM,MAAM,WAAW;AACvB,WAAO,IAAI;AACX,WAAO,IAAI;AACX,WAAO,IAAI;AACX,eAAW,GAAG;AACd,YAAQ,MAAM,aAAa;AAAA,EAC7B,CAAC;AACH;AAEF,QACG,QAAQ,QAAQ,EAChB,YAAY,iEAAiE,EAC7E;AAAA,EAAO,MACN,IAAI,YAAY;AACd,UAAM,MAAM,WAAW;AACvB,UAAM,IAAI,OAAO;AACjB,UAAM,OAAO,QAAQ,IAAI,sBACrB,sBACA,QAAQ,IAAI,kBAAkB,IAAI,SAChC,YACA,IAAI,QACF,UACA;AACR,SAAK,EAAE,SAAS,EAAE,SAAS,MAAM,MAAM,SAAS,EAAE,SAAS,YAAY,WAAW,EAAE,CAAC;AAAA,EACvF,CAAC;AACH;AAEF,QACG,QAAQ,aAAa,EACrB,YAAY,0CAA0C,EACtD,OAAO,MAAM,IAAI,YAAY,KAAK,MAAM,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAEvE,QACG,QAAQ,KAAK,EACb,YAAY,0BAA0B,EACtC,eAAe,mBAAmB,EAClC,eAAe,mBAAmB,EAClC,eAAe,eAAe,wCAAwC,EACtE,eAAe,oBAAoB,iBAAiB,EACpD,OAAO,qBAAqB,qBAAqB,KAAK,EACtD;AAAA,EAAO,CAAC,MACP;AAAA,IAAI,YACF;AAAA,MACE,MAAM,OAAO,EAAE,eAAe;AAAA,QAC5B,cAAc,EAAE;AAAA,QAChB,UAAU,EAAE;AAAA,QACZ,aAAa,EAAE;AAAA,QACf,aAAa,IAAI,UAAU,EAAE,MAAM;AAAA,QACnC,UAAU,EAAE;AAAA,MACd,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEF,QACG,QAAQ,QAAQ,EAChB,YAAY,6DAA6D,EACzE,eAAe,mBAAmB,EAClC,OAAO,SAAS,2CAA2C,EAC3D,OAAO,oBAAoB,iDAAiD,EAC5E;AAAA,EAAO,CAAC,MACP;AAAA,IAAI,YACF;AAAA,MACE,MAAM,OAAO,EAAE,cAAc;AAAA,QAC3B,cAAc,EAAE;AAAA,QAChB,KAAK,QAAQ,EAAE,GAAG;AAAA,QAClB,SAAS,EAAE;AAAA,MACb,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEF,QACG,QAAQ,MAAM,EACd,YAAY,uDAAuD,EACnE,eAAe,mBAAmB,EAClC,eAAe,mBAAmB,oBAAoB,EACtD,eAAe,mBAAmB,sEAAwE,EAC1G,OAAO,mBAAmB,EAC1B,OAAO,eAAe,0CAA0C,EAChE,OAAO,mBAAmB,EAC1B;AAAA,EAAO,CAAC,MACP,IAAI,YAAY;AACd,UAAM,IAAI,OAAO;AACjB,UAAM,MAAM,MAAM,EAAE,kBAAkB;AAAA,MACpC,cAAc,EAAE;AAAA,MAChB,OAAO,EAAE;AAAA,MACT,QAAQ,WAAW,EAAE,MAAM;AAAA,MAC3B,UAAU,EAAE;AAAA,MACZ,IAAI,EAAE;AAAA,MACN,YAAY,OAAO,eAAe,EAAE,UAAU;AAAA,IAChD,CAAC;AACD,QAAI,IAAI,WAAW,uBAAuB,CAAC,EAAE,SAAS;AACpD,cAAQ;AAAA,QACN;AAAA,MAEF;AAAA,IACF;AACA,SAAK,GAAG;AAAA,EACV,CAAC;AACH;AAEF,QACG,QAAQ,MAAM,EACd,YAAY,sCAAsC,EAClD,eAAe,mBAAmB,EAClC,eAAe,qBAAqB,EACpC,eAAe,sBAAsB,6BAA6B,EAClE,eAAe,oBAAoB,EACnC,eAAe,4BAA4B,iCAAiC,EAC5E,OAAO,uBAAuB,yBAAyB,EACvD,OAAO,qBAAqB,sCAAsC,iBAAiB,EACnF,OAAO,oBAAoB,mBAAmB,IAAI,EAClD,OAAO,oBAAoB,EAC3B,OAAO,mBAAmB,EAC1B;AAAA,EAAO,CAAC,MACP,IAAI,YAAY;AACd,UAAM,IAAI,OAAO;AACjB,UAAM,SAAS,MAAM,EAAE,YAAY;AAAA,MACjC,cAAc,EAAE;AAAA,MAChB,UAAU,EAAE;AAAA,MACZ,UAAU,EAAE;AAAA,MACZ,UAAU,EAAE;AAAA,MACZ,UAAU,EAAE;AAAA,MACZ,QAAQ,EAAE;AAAA,MACV,eAAe,EAAE;AAAA,MACjB,aAAa,IAAI,YAAY,EAAE,QAAQ;AAAA,MACvC,WAAW,EAAE;AAAA,MACb,YAAY,OAAO,eAAe,EAAE,UAAU;AAAA,IAChD,CAAC;AACD,QAAI,OAAO,SAAS,WAAW,uBAAuB,CAAC,EAAE,SAAS;AAChE,cAAQ;AAAA,QACN;AAAA,MAEF;AAAA,IACF;AACA,SAAK,MAAM;AAAA,EACb,CAAC;AACH;AAEF,QACG,QAAQ,WAAW,EACnB,YAAY,sDAAsD,EAClE,eAAe,kBAAkB,EACjC,OAAO,oBAAoB,4CAA4C,EACvE;AAAA,EAAO,CAAC,MACP;AAAA,IAAI,YACF,KAAK,MAAM,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,YAAY,EAAE,SAAS,CAAC,CAAC;AAAA,EAClF;AACF;AAEF,QACG,QAAQ,cAAc,EACtB,YAAY,yBAAyB,EACrC,OAAO,UAAU,yCAAyC,EAC1D;AAAA,EAAO,CAAC,IAAI,MACX,IAAI,YAAY;AACd,UAAM,IAAI,OAAO;AACjB,SAAK,EAAE,OAAO,MAAM,EAAE,eAAe,EAAE,IAAI,MAAM,EAAE,WAAW,EAAE,CAAC;AAAA,EACnE,CAAC;AACH;AAEF,QACG,QAAQ,SAAS,EACjB,YAAY,qEAAqE,EACjF;AAAA,EAAO,MACN,IAAI,YAAY;AACd,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,MAAM,MAAM,8BAA8B,GAAG,SAAS;AAClE,UAAI,IAAI,GAAI,WAAW,MAAM,IAAI,KAAK,GAA4B;AAAA,IACpE,QAAQ;AAAA,IAER;AACA,UAAM,kBAAkB,QAAQ,UAAU,QAAQ,QAAQ,OAAO,CAAC;AAClE,QAAI,SAAS,GAAG;AACd,WAAK,EAAE,SAAS,SAAS,QAAQ,UAAU,MAAM,gBAAgB,CAAC;AAClE;AAAA,IACF;AACA,YAAQ,IAAI,GAAG,GAAG,KAAK,OAAO,EAAE;AAChC,QAAI,iBAAiB;AACnB,cAAQ,IAAI,sBAAsB,MAAM,gCAA2B;AAAA,IACrE;AAAA,EACF,CAAC;AACH;AAEF,QACG,QAAQ,QAAQ,EAChB,YAAY,gEAAgE,EAC5E,OAAO,WAAW,gDAAgD,EAClE;AAAA,EAAO,CAAC,SACP,IAAI,YAAY;AACd,UAAM,OAAO,CAAC,WAAW,MAAM,GAAG,GAAG,SAAS;AAC9C,QAAI,KAAK,OAAO;AACd,cAAQ,IAAI,OAAO,KAAK,KAAK,GAAG,CAAC,EAAE;AACnC;AAAA,IACF;AACA,YAAQ,MAAM,YAAY,GAAG,SAAS,KAAK,KAAK,GAAG,CAAC,SAAI;AACxD,UAAM,IAAI,UAAU,OAAO,MAAM,EAAE,OAAO,UAAU,CAAC;AACrD,QAAI,EAAE,WAAW,GAAG;AAClB,cAAQ;AAAA,QACN;AAAA,gDAAmD,GAAG,oCACpC,GAAG;AAAA,MACvB;AACA,cAAQ,WAAW,EAAE,UAAU;AAAA,IACjC;AAAA,EACF,CAAC;AACH;AAEF,QACG,QAAQ,WAAW,EACnB,YAAY,0EAA0E,EACtF;AAAA,EAAO,MACN,IAAI,YAAY;AACd,UAAM,MAAM,UAAU;AACtB,WAAO,KAAK,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAC5C,YAAQ,MAAM,4BAA4B,GAAG,GAAG;AAChD,YAAQ;AAAA,MACN;AAAA,cAAmE,GAAG;AAAA,IACxE;AAAA,EACF,CAAC;AACH;AAEF,QAAQ,WAAW,QAAQ,IAAI;","names":[]}

package/dist/index.d.ts

@@ -186,6 +186,9 @@ interface OAuthTokens {
 }
 interface StoredConfig {
     baseUrl?: string;
+    /** Paybox app origin used for signing-key provisioning (derived from baseUrl
+     *  when unset). */
+    appUrl?: string;
     apiKey?: string;
     oauth?: OAuthTokens;
     signingKey?: string;

package/dist/index.js

@@ -8,7 +8,7 @@ import {
   mcpResource,
   refreshTokens,
   saveConfig
-} from "./chunk-23N5RHOB.js";
+} from "./chunk-KUOJ5BXR.js";
 export {
   PayboxClient,
   PayboxError,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@paybox-sh/sdk",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "type": "module",
   "description": "Typed Node SDK + `paybox` CLI for the Paybox agent API. Mirrors the MCP tool surface (list_credentials, request_payment, request_wallet_sign, request_secret, request_swap, get_portfolio, get_request) over REST, with in-process non-custodial wallet signing.",
   "license": "Apache-2.0",
@@ -11,7 +11,16 @@
   },
   "homepage": "https://docs.paybox.sh/sdk-cli",
   "bugs": "https://github.com/moonpay/paybox/issues",
-  "keywords": ["paybox", "agent", "mcp", "wallet", "payments", "secrets", "sdk", "cli"],
+  "keywords": [
+    "paybox",
+    "agent",
+    "mcp",
+    "wallet",
+    "payments",
+    "secrets",
+    "sdk",
+    "cli"
+  ],
   "publishConfig": {
     "access": "public"
   },
@@ -27,7 +36,9 @@
       "import": "./dist/index.js"
     }
   },
-  "files": ["dist"],
+  "files": [
+    "dist"
+  ],
   "engines": {
     "node": ">=18"
   },

package/dist/chunk-23N5RHOB.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/auth.ts","../src/config.ts","../node_modules/.pnpm/@paybox+mcp-app@file+..+mcp-app_@modelcontextprotocol+sdk@1.29.0_zod@4.4.3__bn.js@5.2.3_ac1e09a20c76a1143611be5dd3d4f9db/node_modules/@paybox/mcp-app/src/creds.ts","../node_modules/.pnpm/@paybox+mcp-app@file+..+mcp-app_@modelcontextprotocol+sdk@1.29.0_zod@4.4.3__bn.js@5.2.3_ac1e09a20c76a1143611be5dd3d4f9db/node_modules/@paybox/mcp-app/src/sign.ts","../src/signer.ts","../src/client.ts"],"sourcesContent":["// OAuth 2.1 + PKCE loopback login for the CLI, and refresh-token rotation.\n//\n// The server allows http://127.0.0.1:* loopback redirects, dynamic ports, public\n// (no-secret) PKCE clients, and refresh tokens for `offline_access` — so this is\n// a standard loopback flow needing no server changes. The user approves with a\n// passkey in the browser (the existing app consent flow); the CLI never sees a\n// secret to copy.\n\nimport { spawn } from \"node:child_process\";\nimport { createHash, randomBytes } from \"node:crypto\";\nimport { createServer } from \"node:http\";\nimport type { AddressInfo } from \"node:net\";\n\nimport type { OAuthTokens } from \"./config.js\";\n\n/** The MCP resource the access token is audience-bound to. */\nexport function mcpResource(baseUrl: string): string {\n  return `${baseUrl.replace(/\\/+$/, \"\")}/mcp`;\n}\n\ninterface AsMetadata {\n  registration_endpoint: string;\n  authorization_endpoint: string;\n  token_endpoint: string;\n}\n\nasync function metadata(baseUrl: string): Promise<AsMetadata> {\n  const url = `${baseUrl.replace(/\\/+$/, \"\")}/.well-known/oauth-authorization-server`;\n  const res = await fetch(url);\n  if (!res.ok) {\n    throw new Error(`could not read OAuth metadata from ${url} (${res.status})`);\n  }\n  return (await res.json()) as AsMetadata;\n}\n\nfunction base64url(b: Buffer): string {\n  return b.toString(\"base64url\");\n}\n\nfunction pkce(): { verifier: string; challenge: string } {\n  const verifier = base64url(randomBytes(32));\n  const challenge = base64url(createHash(\"sha256\").update(verifier).digest());\n  return { verifier, challenge };\n}\n\nfunction openBrowser(url: string): void {\n  // On Windows, `cmd /c start <url>` mis-parses the OAuth URL: cmd treats the\n  // `&` before each query param as a command separator. rundll32 opens the\n  // default browser with the URL passed verbatim, no shell parsing.\n  const [cmd, args] =\n    process.platform === \"darwin\"\n      ? ([\"open\", [url]] as const)\n      : process.platform === \"win32\"\n        ? ([\"rundll32\", [\"url.dll,FileProtocolHandler\", url]] as const)\n        : ([\"xdg-open\", [url]] as const);\n  try {\n    spawn(cmd, [...args], { stdio: \"ignore\", detached: true }).unref();\n  } catch {\n    /* fall back to the printed URL */\n  }\n}\n\nconst CALLBACK_PAGE =\n  \"<!doctype html><meta charset=utf-8><title>Paybox</title>\" +\n  \"<body style=\\\"font:16px system-ui;padding:3rem;text-align:center\\\">\" +\n  \"<h2>Paybox CLI connected</h2><p>You can close this tab and return to the terminal.</p>\";\n\nexport interface LoginOptions {\n  scope?: string;\n  clientName?: string;\n  /** Sink for the \"open this URL\" prompt; defaults to console.error. */\n  log?: (msg: string) => void;\n  /** Abort with an error if no approval arrives in this long. Default 5 min. */\n  timeoutMs?: number;\n}\n\nexport async function loginLoopback(\n  baseUrl: string,\n  opts: LoginOptions = {},\n): Promise<OAuthTokens> {\n  const scope = opts.scope ?? \"mcp offline_access\";\n  const clientName = opts.clientName ?? \"Paybox CLI\";\n  const log = opts.log ?? ((m: string) => console.error(m));\n  const meta = await metadata(baseUrl);\n  const resource = mcpResource(baseUrl);\n\n  let resolveCode: (v: { code: string; state: string | null }) => void;\n  let rejectCode: (e: Error) => void;\n  const codePromise = new Promise<{ code: string; state: string | null }>((res, rej) => {\n    resolveCode = res;\n    rejectCode = rej;\n  });\n\n  const server = createServer((req, res) => {\n    const u = new URL(req.url ?? \"/\", \"http://127.0.0.1\");\n    if (u.pathname !== \"/callback\") {\n      res.writeHead(404).end();\n      return;\n    }\n    res.writeHead(200, { \"content-type\": \"text/html\" }).end(CALLBACK_PAGE);\n    const code = u.searchParams.get(\"code\");\n    if (code) resolveCode({ code, state: u.searchParams.get(\"state\") });\n    else rejectCode(new Error(u.searchParams.get(\"error\") ?? \"authorization failed\"));\n  });\n  await new Promise<void>((r) => server.listen(0, \"127.0.0.1\", r));\n  const port = (server.address() as AddressInfo).port;\n  const redirectUri = `http://127.0.0.1:${port}/callback`;\n\n  const timeoutMs = opts.timeoutMs ?? 300_000;\n  const timer = setTimeout(\n    () => rejectCode(new Error(`login timed out after ${Math.round(timeoutMs / 1000)}s — no approval received`)),\n    timeoutMs,\n  );\n  timer.unref();\n\n  try {\n    const reg = await fetch(meta.registration_endpoint, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/json\" },\n      body: JSON.stringify({\n        client_name: clientName,\n        redirect_uris: [redirectUri],\n        token_endpoint_auth_method: \"none\",\n        grant_types: [\"authorization_code\", \"refresh_token\"],\n        response_types: [\"code\"],\n      }),\n    });\n    if (!reg.ok) throw new Error(`client registration failed (${reg.status}): ${await reg.text()}`);\n    const { client_id: clientId } = (await reg.json()) as { client_id: string };\n\n    const { verifier, challenge } = pkce();\n    const state = base64url(randomBytes(16));\n    const authUrl =\n      `${meta.authorization_endpoint}?response_type=code` +\n      `&client_id=${encodeURIComponent(clientId)}` +\n      `&redirect_uri=${encodeURIComponent(redirectUri)}` +\n      `&code_challenge=${challenge}&code_challenge_method=S256` +\n      `&scope=${encodeURIComponent(scope)}` +\n      `&state=${state}&resource=${encodeURIComponent(resource)}`;\n\n    log(`Opening your browser to approve access:\\n  ${authUrl}\\n`);\n    openBrowser(authUrl);\n\n    const { code, state: returnedState } = await codePromise;\n    if (returnedState !== state) throw new Error(\"OAuth state mismatch — aborting\");\n\n    const form = new URLSearchParams({\n      grant_type: \"authorization_code\",\n      code,\n      redirect_uri: redirectUri,\n      client_id: clientId,\n      code_verifier: verifier,\n      resource,\n    });\n    const tok = await fetch(meta.token_endpoint, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n      body: form,\n    });\n    if (!tok.ok) throw new Error(`token exchange failed (${tok.status}): ${await tok.text()}`);\n    const t = (await tok.json()) as {\n      access_token: string;\n      refresh_token?: string;\n      expires_in?: number;\n    };\n    return {\n      clientId,\n      accessToken: t.access_token,\n      refreshToken: t.refresh_token,\n      expiresAt: t.expires_in ? Date.now() + t.expires_in * 1000 : undefined,\n      resource,\n    };\n  } finally {\n    clearTimeout(timer);\n    server.close();\n  }\n}\n\nexport async function refreshTokens(baseUrl: string, current: OAuthTokens): Promise<OAuthTokens> {\n  if (!current.refreshToken) throw new Error(\"no refresh token — run `paybox login` again\");\n  const meta = await metadata(baseUrl);\n  const resource = current.resource ?? mcpResource(baseUrl);\n  const form = new URLSearchParams({\n    grant_type: \"refresh_token\",\n    refresh_token: current.refreshToken,\n    client_id: current.clientId,\n    resource,\n  });\n  const res = await fetch(meta.token_endpoint, {\n    method: \"POST\",\n    headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n    body: form,\n  });\n  if (!res.ok) throw new Error(`token refresh failed (${res.status}): ${await res.text()}`);\n  const t = (await res.json()) as {\n    access_token: string;\n    refresh_token?: string;\n    expires_in?: number;\n  };\n  return {\n    ...current,\n    accessToken: t.access_token,\n    refreshToken: t.refresh_token ?? current.refreshToken,\n    expiresAt: t.expires_in ? Date.now() + t.expires_in * 1000 : undefined,\n    resource,\n  };\n}\n","// On-disk config: OAuth tokens, an optional pbx_live_ key, and an optional\n// pbxk1. signing key. Stored at ~/.config/paybox/config.json, mode 0600 (the\n// signing key is as sensitive as the iframe's localStorage copy).\n\nimport { chmodSync, mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { join } from \"node:path\";\n\nexport interface OAuthTokens {\n  clientId: string;\n  accessToken: string;\n  refreshToken?: string;\n  /** Epoch millis the access token expires. */\n  expiresAt?: number;\n  /** The audience the token is bound to (`<baseUrl>/mcp`). */\n  resource: string;\n}\n\nexport interface StoredConfig {\n  baseUrl?: string;\n  apiKey?: string;\n  oauth?: OAuthTokens;\n  signingKey?: string;\n}\n\nfunction configDir(): string {\n  if (process.env.PAYBOX_CONFIG_DIR) return process.env.PAYBOX_CONFIG_DIR;\n  const base = process.env.XDG_CONFIG_HOME ?? join(homedir(), \".config\");\n  return join(base, \"paybox\");\n}\n\nexport function configFile(): string {\n  return join(configDir(), \"config.json\");\n}\n\nexport function loadConfig(): StoredConfig {\n  try {\n    return JSON.parse(readFileSync(configFile(), \"utf8\")) as StoredConfig;\n  } catch {\n    return {};\n  }\n}\n\nexport function saveConfig(config: StoredConfig): void {\n  // 0700/0600 protect the signing key + refresh token on POSIX. On Windows the\n  // mode bits don't set ACLs (see README) — the file is not access-restricted.\n  mkdirSync(configDir(), { recursive: true, mode: 0o700 });\n  writeFileSync(configFile(), `${JSON.stringify(config, null, 2)}\\n`, { mode: 0o600 });\n  // writeFileSync's mode only applies on create; chmod also re-tightens an\n  // existing file on overwrite. Skip it on Windows where it's a no-op.\n  if (process.platform !== \"win32\") chmodSync(configFile(), 0o600);\n}\n","// localStorage-backed credential store.\n//\n// The agent's MoonX ephemeral-signer KEYPAIR lives ONLY here, in this iframe's\n// localStorage, scoped to the server-declared stable origin (`_meta.ui.domain`).\n// It is read into memory only to produce a signature and is sent ONLY to the\n// MoonX API — never to paybox or the AI assistant.\n//\n// Note what is NOT here: the `walletId` (MoonX `provider_wallet_id`). That is\n// not secret and paybox already holds it from the granted credential, so it\n// rides the `request_wallet_sign` operation instead of the pasted key. The user\n// therefore only pastes one thing: a single token carrying the keypair.\n\nconst STORAGE_KEY = \"paybox.walletSign.creds.v2\";\n\n/** The one-string token prefix. The body is base64url(JSON{p,s}). */\nexport const TOKEN_PREFIX = \"pbxk1.\";\n\n/** The agent's MoonX ephemeral-signer keypair. */\nexport interface Creds {\n  /** Ephemeral-signer API public key, hex (optional 0x prefix). */\n  apiPubHex: string;\n  /** Ephemeral-signer API private key, hex (optional 0x prefix). */\n  apiPrivHex: string;\n  /** Epoch millis the credential was saved. */\n  savedAt: number;\n}\n\n/**\n * Feature-detect a usable localStorage. Some hosts sandbox the iframe with an\n * opaque origin where storage access throws; we degrade to in-session entry.\n */\nexport function hasStorage(): boolean {\n  try {\n    const probe = \"__paybox_probe__\";\n    window.localStorage.setItem(probe, \"1\");\n    window.localStorage.removeItem(probe);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/** Load saved creds, or null if absent / unreadable / malformed. */\nexport function load(): Creds | null {\n  try {\n    const raw = window.localStorage.getItem(STORAGE_KEY);\n    if (!raw) return null;\n    const parsed = JSON.parse(raw) as Partial<Creds>;\n    if (\n      typeof parsed.apiPubHex === \"string\" &&\n      typeof parsed.apiPrivHex === \"string\" &&\n      parsed.apiPubHex &&\n      parsed.apiPrivHex\n    ) {\n      return {\n        apiPubHex: parsed.apiPubHex,\n        apiPrivHex: parsed.apiPrivHex,\n        savedAt: typeof parsed.savedAt === \"number\" ? parsed.savedAt : 0,\n      };\n    }\n    return null;\n  } catch {\n    return null;\n  }\n}\n\n/** Persist creds. Silently no-ops if storage is unavailable. */\nexport function save(c: Omit<Creds, \"savedAt\"> & { savedAt?: number }): void {\n  try {\n    const toStore: Creds = {\n      apiPubHex: c.apiPubHex,\n      apiPrivHex: c.apiPrivHex,\n      savedAt: c.savedAt ?? Date.now(),\n    };\n    window.localStorage.setItem(STORAGE_KEY, JSON.stringify(toStore));\n  } catch {\n    /* storage unavailable — caller keeps creds in memory for this session */\n  }\n}\n\n/** Forget the credential on this device. */\nexport function clear(): void {\n  try {\n    window.localStorage.removeItem(STORAGE_KEY);\n  } catch {\n    /* nothing to clear if storage is unavailable */\n  }\n}\n\n/**\n * Validate a hex string (optional 0x prefix, even length, hex digits only).\n * Returns an error string for display, or null when valid.\n */\nexport function validateHex(s: string, label: string): string | null {\n  const trimmed = s.trim();\n  if (!trimmed) return `${label} is required`;\n  const body = trimmed.startsWith(\"0x\") || trimmed.startsWith(\"0X\") ? trimmed.slice(2) : trimmed;\n  if (body.length === 0) return `${label} is empty`;\n  if (body.length % 2 !== 0) return `${label} must have an even number of hex digits`;\n  if (!/^[0-9a-fA-F]+$/.test(body)) return `${label} must be hexadecimal`;\n  return null;\n}\n\n// ---------------------------------------------------------------------------\n// One-string token codec — the single value the user copies from the paybox\n// app (OAuth consent / Agents) and pastes here. Format:\n//   pbxk1.<base64url(JSON.stringify({ p: apiPubHex, s: apiPrivHex }))>\n// It carries the keypair only — no walletId, no publishable key. It is the raw\n// secret in transit (same trust model as showing the key): it leaves the app\n// via the clipboard and is pasted here; it never goes to paybox.\n// ---------------------------------------------------------------------------\n\nfunction b64urlEncode(s: string): string {\n  return btoa(s).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\nfunction b64urlDecode(s: string): string {\n  let b = s.replace(/-/g, \"+\").replace(/_/g, \"/\");\n  while (b.length % 4) b += \"=\";\n  return atob(b);\n}\n\n/** Encode a keypair into the one-string token (mirrors the app side). */\nexport function encodeToken(c: { apiPubHex: string; apiPrivHex: string }): string {\n  return TOKEN_PREFIX + b64urlEncode(JSON.stringify({ p: c.apiPubHex, s: c.apiPrivHex }));\n}\n\n/**\n * Parse a pasted token into a keypair, or null if it isn't a well-formed token\n * with two hex values. Accepts the canonical `pbxk1.` token and also tolerates\n * a bare base64url(JSON) body (in case the prefix is stripped on copy/paste).\n */\nexport function parseToken(input: string): { apiPubHex: string; apiPrivHex: string } | null {\n  const t = input.trim();\n  if (!t) return null;\n  const body = t.startsWith(TOKEN_PREFIX) ? t.slice(TOKEN_PREFIX.length) : t;\n  let obj: unknown;\n  try {\n    obj = JSON.parse(b64urlDecode(body));\n  } catch {\n    return null;\n  }\n  if (!obj || typeof obj !== \"object\") return null;\n  const o = obj as Record<string, unknown>;\n  const apiPubHex = String(o.p ?? o.apiPubHex ?? \"\").trim();\n  const apiPrivHex = String(o.s ?? o.apiPrivHex ?? \"\").trim();\n  if (!apiPubHex || !apiPrivHex) return null;\n  if (validateHex(apiPubHex, \"key\") || validateHex(apiPrivHex, \"key\")) return null;\n  return { apiPubHex, apiPrivHex };\n}\n","// The signing core: intent → MoonX ephemeral-signer signature → artifact.\n//\n// SPLIT-TRUST signing (the whole point of this design):\n//   - This iframe holds the agent KEYPAIR (apiPub/apiPriv, from the pasted\n//     pbxk1 token) and NOTHING ELSE. It builds the chain-specific digest, then\n//     builds the MoonX request envelope and ed25519-signs it with apiPriv.\n//   - It does NOT call MoonX and does NOT hold the MoonX secret key. The\n//     secret-gated `/sign` HTTP call happens SERVER-SIDE, via the paybox\n//     `moonx_sign` MCP tool (see `transport`). paybox adds the secret key,\n//     which never reaches the browser.\n//\n// We reuse the @moon-x adapters purely for their CHAIN LOGIC (digest building +\n// signature assembly) by constructing them with a custom sign fn:\n//   - EVM:    new MoonXEvmSigner(ecdsaSign)   — ecdsaSign: (digest) => {r,s,yParity}\n//   - Solana: new MoonXSolanaSigner(ed25519Sign, address) — (bytes) => Uint8Array\n// Our custom fns build + ed25519-sign the envelope and delegate the actual\n// signing to `transport` (the moonx_sign tool). The envelope format mirrors\n// @moon-x/core's signWithEphemeralSigner exactly.\n//\n// The artifact returned is EXACTLY the old shape per op, so the paybox server\n// (which stores it via submit_signature) is unaffected.\n\nimport { Buffer } from \"buffer\";\nimport nacl from \"tweetnacl\";\nimport { MoonXEvmSigner, EvmSchemeMismatchError } from \"@moon-x/evm-adapter\";\nimport { MoonXSolanaSigner, SolanaSchemeMismatchError } from \"@moon-x/solana-adapter\";\nimport { Transaction } from \"@solana/web3.js\";\nimport { keccak256, serializeTransaction } from \"viem\";\nimport type {\n  Authorization,\n  TransactionSerializable,\n  TypedDataDefinition,\n} from \"viem\";\n\nimport type { Creds } from \"./creds.js\";\n\n// Transactions carry bigints (value/gas/fees), which JSON can't represent —\n// they arrive as decimal strings and are revived here. Mirrors the old path.\nexport interface WireTx {\n  to: `0x${string}`;\n  value: string;\n  data?: `0x${string}`;\n  chainId: number;\n  gas: string;\n  maxPriorityFeePerGas: string;\n  maxFeePerGas: string;\n  nonce: number;\n}\n\n/**\n * The intent to sign — the `op` discriminator + op-specific fields. The host\n * delivers this as `operation.intent` in the `request_wallet_sign` tool result.\n */\nexport type SignIntent =\n  | { op: \"message\"; message: string }\n  | { op: \"typedData\"; typedData: TypedDataDefinition }\n  | { op: \"transaction\"; transaction: WireTx }\n  | { op: \"authorization\"; authorization: Authorization }\n  | { op: \"solanaMessage\"; address: string; message: string }\n  | { op: \"solanaTransaction\"; address: string; transactionBase64: string }\n  | { op: \"raw\"; rawSigningPayloadHex: string };\n\n/** The wallet's MoonX binding, supplied by paybox on the request (NOT the\n *  pasted key). `keyId`/`derivationPath` are captured at provision time. */\nexport interface WalletBinding {\n  walletId: string;\n  keyId: string;\n  derivationPath: string;\n}\n\n/** MoonX's raw `/sign` response, relayed back through the moonx_sign tool. */\nexport interface MoonxSignResult {\n  scheme: string;\n  signature: {\n    /** ECDSA: lowercase-hex r/s (no 0x) + recovery_id 0..3. */\n    r?: string;\n    s?: string;\n    recovery_id?: number;\n    /** Ed25519: lowercase-hex 64-byte signature. */\n    signature?: string;\n  };\n}\n\n/**\n * Performs the secret-gated MoonX `/sign` call on the server. Given the envelope\n * this iframe built + signed, it returns MoonX's raw signature. Implemented by\n * the UI layer as a `moonx_sign` MCP tool call (the server adds the secret key\n * + the request_id/api_pub binding).\n */\nexport type MoonxSignTransport = (envelope: {\n  signed_body: string;\n  agent_signature: string;\n}) => Promise<MoonxSignResult>;\n\nexport type SignArtifactResult =\n  | { ok: true; artifact: Record<string, unknown> }\n  | { ok: false; error: string };\n\nfunction reviveTx(w: WireTx): TransactionSerializable {\n  return {\n    type: \"eip1559\",\n    to: w.to,\n    value: BigInt(w.value),\n    data: w.data,\n    chainId: w.chainId,\n    gas: BigInt(w.gas),\n    maxPriorityFeePerGas: BigInt(w.maxPriorityFeePerGas),\n    maxFeePerGas: BigInt(w.maxFeePerGas),\n    nonce: w.nonce,\n  };\n}\n\nfunction hexToBytes(hex: string): Uint8Array {\n  return new Uint8Array(Buffer.from(hex.replace(/^0x/, \"\"), \"hex\"));\n}\nfunction bytesToHex(bytes: Uint8Array): string {\n  return Buffer.from(bytes).toString(\"hex\");\n}\n\n/**\n * Build the MoonX `/sign` envelope and ed25519-sign it with the agent key.\n * Mirrors @moon-x/core `signWithEphemeralSigner` byte-for-byte: the signature\n * is over the UTF-8 JSON `{raw_signing_payload, key_id, derivation_path,\n * issued_at}` and `signed_body` is the hex of those exact bytes.\n */\nfunction buildEnvelope(\n  rawSigningPayloadHex: string,\n  binding: WalletBinding,\n  creds: Creds,\n): { signed_body: string; agent_signature: string } {\n  const signedPayload = {\n    raw_signing_payload: rawSigningPayloadHex.replace(/^0x/, \"\").toLowerCase(),\n    key_id: binding.keyId,\n    derivation_path: binding.derivationPath,\n    issued_at: new Date().toISOString(),\n  };\n  const signedBodyBytes = new TextEncoder().encode(JSON.stringify(signedPayload));\n  // apiPrivHex is the 32-byte Ed25519 seed (64 hex chars).\n  const keyPair = nacl.sign.keyPair.fromSeed(hexToBytes(creds.apiPrivHex));\n  const agentSig = nacl.sign.detached(signedBodyBytes, keyPair.secretKey);\n  return {\n    signed_body: bytesToHex(signedBodyBytes),\n    agent_signature: bytesToHex(agentSig),\n  };\n}\n\n/**\n * The EIP-1559 signing hash for an unsigned tx — `keccak256` of the typed,\n * RLP-serialized unsigned transaction. Matches the server's\n * `eth_tx::signing_hash` (alloy) byte-for-byte, so the agent signature is over\n * the exact digest the server re-derives, validates, and asks MoonX to sign.\n */\nexport function eip1559SigningHash(tx: WireTx): `0x${string}` {\n  return keccak256(serializeTransaction(reviveTx(tx)));\n}\n\n/**\n * The Solana signing payload (hex): the tx message — everything after the single\n * zeroed signature slot in `[shortvec sig_count=1][64-byte slot][message…]`.\n * MUST match the server's `solana::signing_payload` byte-for-byte.\n */\nexport function solanaSigningPayload(base64Tx: string): string {\n  const raw = Buffer.from(base64Tx, \"base64\");\n  // Decode the compact-u16 (\"shortvec\") signature count.\n  let i = 0;\n  let sigCount = 0;\n  let shift = 0;\n  for (;;) {\n    const b = raw[i++];\n    sigCount |= (b & 0x7f) << shift;\n    if ((b & 0x80) === 0) break;\n    shift += 7;\n  }\n  if (sigCount !== 1) {\n    throw new Error(`expected a single-signer solana tx, got ${sigCount} signature slot(s)`);\n  }\n  return bytesToHex(new Uint8Array(raw.subarray(i + 64)));\n}\n\n/** One agent-signed signing envelope for the server-completes swap path. */\nexport interface TxEnvelope {\n  api_pub: string;\n  signed_body: string;\n  agent_signature: string;\n}\n\n/** A sign-ready tx from the swap plan: an EVM `WireTx` (eip1559 fields), or a\n *  base64 Solana tx string tagged `vm:\"solana\"`. */\nexport interface PlanTx {\n  vm?: string;\n  transaction: WireTx | string;\n}\n\n/**\n * One agent-signed envelope per parked tx for `submit_envelope` — NO tx bytes,\n * just the agent signature over each tx's payload (EVM: EIP-1559 sighash;\n * Solana: the tx message). Throws if the wallet isn't provisioned.\n */\nexport function buildSwapEnvelopes(\n  txs: PlanTx[],\n  binding: WalletBinding,\n  creds: Creds,\n): TxEnvelope[] {\n  if (!binding.walletId) {\n    throw new Error(\"paybox did not supply a wallet id for this operation.\");\n  }\n  if (!binding.keyId || !binding.derivationPath) {\n    throw new Error(\n      \"This wallet isn't provisioned for signing yet (missing key binding). \" +\n        \"Re-provision it in the paybox app, then retry.\",\n    );\n  }\n  return txs.map((t) => {\n    const payload =\n      t.vm === \"solana\"\n        ? solanaSigningPayload(t.transaction as string)\n        : eip1559SigningHash(t.transaction as WireTx);\n    const { signed_body, agent_signature } = buildEnvelope(payload, binding, creds);\n    return { api_pub: creds.apiPubHex, signed_body, agent_signature };\n  });\n}\n\n/** Resolve a wallet binding (`key_id` + `derivation_path`) the authoritative\n *  way — via the server's secret-gated `/me/wallets`. Used when paybox hasn't\n *  pre-captured the binding (ambiguous grant). The iframe ed25519-signs an\n *  `{issued_at}` envelope; `resolve` (a `moonx_resolve_binding` tool call)\n *  returns the binding for the request's wallet. */\nexport type ResolveBindingTransport = (envelope: {\n  signed_body: string;\n  agent_signature: string;\n}) => Promise<{ key_id?: string; derivation_path?: string }>;\n\n/**\n * Build + ed25519-sign an `{issued_at}` envelope with the agent key. Used for\n * the secret-gated tools that authenticate the signer without a chain payload —\n * `moonx_resolve_binding` and `prepare_swap`. Mirrors the server's expectation:\n * the signature is over the UTF-8 JSON `{issued_at}` and `signed_body` is its hex.\n */\nexport function buildIssuedAtEnvelope(creds: Creds): {\n  signed_body: string;\n  agent_signature: string;\n} {\n  const signedBodyBytes = new TextEncoder().encode(\n    JSON.stringify({ issued_at: new Date().toISOString() }),\n  );\n  const keyPair = nacl.sign.keyPair.fromSeed(hexToBytes(creds.apiPrivHex));\n  const agentSig = nacl.sign.detached(signedBodyBytes, keyPair.secretKey);\n  return {\n    signed_body: bytesToHex(signedBodyBytes),\n    agent_signature: bytesToHex(agentSig),\n  };\n}\n\nexport async function resolveWalletBinding(\n  creds: Creds,\n  resolve: ResolveBindingTransport,\n): Promise<{ keyId: string; derivationPath: string }> {\n  const res = await resolve(buildIssuedAtEnvelope(creds));\n  if (!res.key_id || !res.derivation_path) {\n    throw new Error(\"MoonX returned no binding for this wallet\");\n  }\n  return { keyId: res.key_id, derivationPath: res.derivation_path };\n}\n\n/**\n * Sign `intent` for `binding` using the agent `creds`, delegating the\n * secret-gated MoonX call to `transport` (the server). Returns the artifact —\n * exactly the old per-op shape — or an error string. Never throws; never logs\n * the key.\n */\nexport async function signIntent(\n  intent: SignIntent,\n  creds: Creds,\n  binding: WalletBinding,\n  transport: MoonxSignTransport,\n): Promise<SignArtifactResult> {\n  if (!binding.walletId) {\n    return { ok: false, error: \"paybox did not supply a wallet id for this operation.\" };\n  }\n  if (!binding.keyId || !binding.derivationPath) {\n    return {\n      ok: false,\n      error:\n        \"This wallet isn't provisioned for signing yet (missing key binding). \" +\n        \"Re-provision it in the paybox app, then retry.\",\n    };\n  }\n\n  // EVM: the adapter builds the digest + assembles the signature; we own only\n  // the transport (envelope build + ed25519 + the server sign call).\n  const ecdsaSign = async (digest: `0x${string}`) => {\n    const result = await transport(buildEnvelope(digest, binding, creds));\n    const { r, s, recovery_id } = result.signature;\n    if (r == null || s == null || recovery_id == null) {\n      throw new Error(\"MoonX returned an ECDSA result without {r, s, recovery_id}\");\n    }\n    return {\n      r: `0x${r}` as `0x${string}`,\n      s: `0x${s}` as `0x${string}`,\n      yParity: recovery_id as 0 | 1,\n    };\n  };\n  // Solana: sign fn takes the raw message bytes, returns the 64-byte signature.\n  const ed25519Sign = async (message: Uint8Array) => {\n    const result = await transport(buildEnvelope(bytesToHex(message), binding, creds));\n    const sig = result.signature.signature;\n    if (!sig) throw new Error(\"MoonX returned an Ed25519 result without a signature\");\n    return hexToBytes(sig);\n  };\n\n  try {\n    switch (intent.op) {\n      case \"message\":\n        return {\n          ok: true,\n          artifact: { signature: await new MoonXEvmSigner(ecdsaSign).signMessage(intent.message) },\n        };\n      case \"typedData\":\n        return {\n          ok: true,\n          artifact: {\n            signature: await new MoonXEvmSigner(ecdsaSign).signTypedData(intent.typedData),\n          },\n        };\n      case \"transaction\":\n        return {\n          ok: true,\n          artifact: {\n            serializedTransaction: await new MoonXEvmSigner(ecdsaSign).signTransaction(\n              reviveTx(intent.transaction),\n            ),\n          },\n        };\n      case \"authorization\":\n        return {\n          ok: true,\n          artifact: {\n            authorization: await new MoonXEvmSigner(ecdsaSign).signAuthorization(\n              intent.authorization,\n            ),\n          },\n        };\n      case \"solanaMessage\": {\n        const sig = await new MoonXSolanaSigner(ed25519Sign, intent.address).signMessage(\n          intent.message,\n        );\n        return { ok: true, artifact: { signature: bytesToHex(sig) } };\n      }\n      case \"solanaTransaction\": {\n        const tx = Transaction.from(Buffer.from(intent.transactionBase64, \"base64\"));\n        const signed = await new MoonXSolanaSigner(ed25519Sign, intent.address).signTransaction(\n          tx,\n        );\n        return {\n          ok: true,\n          artifact: { signedTransactionBase64: Buffer.from(signed).toString(\"base64\") },\n        };\n      }\n      case \"raw\": {\n        // No chain logic — the digest is given. Build + sign + relay directly.\n        const result = await transport(buildEnvelope(intent.rawSigningPayloadHex, binding, creds));\n        return { ok: true, artifact: { scheme: result.scheme, signature: result.signature } };\n      }\n      default:\n        return { ok: false, error: `unknown op: ${(intent as { op?: string }).op}` };\n    }\n  } catch (err) {\n    if (err instanceof EvmSchemeMismatchError || err instanceof SolanaSchemeMismatchError) {\n      return { ok: false, error: err.message };\n    }\n    const message = err instanceof Error ? err.message : String(err);\n    return { ok: false, error: message };\n  }\n}\n","// In-process, non-custodial wallet signing — the SDK's replacement for the MCP\n// host iframe. The signing CORE is reused verbatim from the iframe\n// (@paybox/mcp-app/sign): it builds the chain digest, ed25519-signs the MoonX\n// envelope with the agent's pbxk1. keypair, and delegates the secret-gated MoonX\n// /sign to the server (the secret never reaches the client). Here we only swap\n// the iframe's MCP-tool transport for the SDK's REST calls.\n\nimport { parseToken } from \"@paybox/mcp-app/creds\";\nimport type { Creds } from \"@paybox/mcp-app/creds\";\nimport {\n  buildIssuedAtEnvelope,\n  buildSwapEnvelopes,\n  signIntent,\n} from \"@paybox/mcp-app/sign\";\nimport type {\n  MoonxSignResult,\n  SignIntent,\n  TxEnvelope,\n  WalletBinding,\n} from \"@paybox/mcp-app/sign\";\n\nimport type { BindingResponse, SwapPlan } from \"./types.js\";\n\n/** POST `{path}` (relative to the API base) with a JSON body, returning parsed\n *  JSON. Supplied by the client so the signer reuses its auth + base URL. */\nexport type Poster = (path: string, body: unknown) => Promise<unknown>;\n\n/** Parse the one-string `pbxk1.` token into the agent keypair the core expects. */\nexport function credsFromToken(token: string): Creds {\n  const kp = parseToken(token);\n  if (!kp) {\n    throw new Error(\"invalid signing key: expected a `pbxk1.` token (keypair only)\");\n  }\n  return { apiPubHex: kp.apiPubHex, apiPrivHex: kp.apiPrivHex, savedAt: Date.now() };\n}\n\nfunction toBinding(b: BindingResponse): WalletBinding {\n  return { walletId: b.wallet_id, keyId: b.key_id ?? \"\", derivationPath: b.derivation_path ?? \"\" };\n}\n\n/** Resolve the wallet binding (key_id + derivation_path) for a parked request via\n *  the server's secret-gated `/binding` route (the `moonx_resolve_binding` twin). */\nasync function resolveBinding(\n  post: Poster,\n  requestId: string,\n  creds: Creds,\n): Promise<WalletBinding> {\n  const env = buildIssuedAtEnvelope(creds);\n  const r = (await post(`/agent/requests/${requestId}/binding`, {\n    api_pub: creds.apiPubHex,\n    signed_body: env.signed_body,\n    agent_signature: env.agent_signature,\n  })) as BindingResponse;\n  return toBinding(r);\n}\n\n/** Sign a parked `request_wallet_sign` and submit the artifact. Uses the binding\n *  the server echoed on the wallet-sign response when it's complete (avoiding an\n *  extra secret-gated resolve), and only resolves when it isn't. The MoonX\n *  secret call runs server-side via `/moonx-sign`; the artifact lands via\n *  `/signature`. */\nexport async function signWalletRequest(\n  post: Poster,\n  requestId: string,\n  intent: SignIntent,\n  creds: Creds,\n  binding?: BindingResponse | null,\n): Promise<Record<string, unknown>> {\n  const resolved =\n    binding && binding.key_id && binding.derivation_path\n      ? toBinding(binding)\n      : await resolveBinding(post, requestId, creds);\n  const transport = (envelope: { signed_body: string; agent_signature: string }) =>\n    post(`/agent/requests/${requestId}/moonx-sign`, {\n      api_pub: creds.apiPubHex,\n      ...envelope,\n    }) as Promise<MoonxSignResult>;\n  const result = await signIntent(intent, creds, resolved, transport);\n  if (!result.ok) throw new Error(result.error);\n  await post(`/agent/requests/${requestId}/signature`, { artifact: result.artifact });\n  return result.artifact;\n}\n\n/** Sign every tx of a parked swap plan, in order, and submit the envelopes;\n *  the server verifies, signs (secret-gated), encodes, and broadcasts. */\nexport async function signSwapRequest(\n  post: Poster,\n  requestId: string,\n  plan: SwapPlan,\n  creds: Creds,\n): Promise<void> {\n  let binding: WalletBinding = {\n    walletId: plan.binding.wallet_id,\n    keyId: plan.binding.key_id ?? \"\",\n    derivationPath: plan.binding.derivation_path ?? \"\",\n  };\n  if (binding.walletId && (!binding.keyId || !binding.derivationPath)) {\n    binding = await resolveBinding(post, requestId, creds);\n  }\n  const envelopes: TxEnvelope[] = buildSwapEnvelopes(plan.txs, binding, creds);\n  await post(`/agent/requests/${requestId}/envelopes`, { envelopes });\n}\n","// PayboxClient — the typed REST client mirroring the MCP agent tools. Each method\n// maps to a `/agent/*` route; `request_wallet_sign` / `request_swap` additionally\n// drive in-process signing when a `pbxk1.` signing key is configured.\n\nimport { refreshTokens } from \"./auth.js\";\nimport { loadConfig, saveConfig, type OAuthTokens } from \"./config.js\";\nimport { credsFromToken, signSwapRequest, signWalletRequest, type Poster } from \"./signer.js\";\nimport type {\n  RequestPaymentArgs,\n  RequestSecretArgs,\n  RequestSwapArgs,\n  RequestWalletSignArgs,\n} from \"./types.generated.js\";\nimport type {\n  AgentResponse,\n  ClientGrantSummary,\n  PaymentArgs,\n  PortfolioArgs,\n  SecretArgs,\n  SwapArgs,\n  SwapResult,\n  WalletSignArgs,\n  WalletSignResult,\n} from \"./types.js\";\n\nconst DEFAULT_BASE_URL = \"https://api.paybox.sh\";\nconst EXPIRY_SKEW_MS = 60_000;\n\nexport class PayboxError extends Error {\n  constructor(\n    readonly status: number,\n    readonly body: string,\n    context: string,\n  ) {\n    super(`paybox ${context} failed (${status}): ${body}`);\n    this.name = \"PayboxError\";\n  }\n}\n\nexport interface PayboxClientOptions {\n  /** API origin (the OAuth issuer). Default `https://api.paybox.sh`. */\n  baseUrl?: string;\n  /** A `pbx_live_*` personal API key. */\n  apiKey?: string;\n  /** A raw OAuth access token (skips the stored-token path). */\n  token?: string;\n  /** A `pbxk1.` signing key token; enables in-process wallet/swap signing. */\n  signingKey?: string;\n  fetchImpl?: typeof fetch;\n}\n\nexport interface SignOptions {\n  /** Sign in-process when the request clears to `pending_signature`. Default true. */\n  autoSign?: boolean;\n}\n\nexport class PayboxClient {\n  readonly baseUrl: string;\n  private readonly opts: PayboxClientOptions;\n  private readonly fetchImpl: typeof fetch;\n  private oauth?: OAuthTokens;\n  private configBacked = false;\n\n  constructor(options: PayboxClientOptions = {}) {\n    this.opts = options;\n    this.baseUrl = (options.baseUrl ?? DEFAULT_BASE_URL).replace(/\\/+$/, \"\");\n    this.fetchImpl = options.fetchImpl ?? fetch;\n  }\n\n  /** Build a client from `~/.config/paybox/config.json` + env, with overrides. */\n  static fromConfig(overrides: PayboxClientOptions = {}): PayboxClient {\n    const cfg = loadConfig();\n    const client = new PayboxClient({\n      baseUrl: overrides.baseUrl ?? process.env.PAYBOX_API_URL ?? cfg.baseUrl,\n      apiKey: overrides.apiKey ?? process.env.PAYBOX_API_KEY ?? cfg.apiKey,\n      token: overrides.token ?? process.env.PAYBOX_ACCESS_TOKEN,\n      signingKey: overrides.signingKey ?? process.env.PAYBOX_SIGNING_KEY ?? cfg.signingKey,\n      fetchImpl: overrides.fetchImpl,\n    });\n    if (!client.opts.apiKey && !client.opts.token && cfg.oauth) {\n      client.oauth = cfg.oauth;\n      client.configBacked = true;\n    }\n    return client;\n  }\n\n  /** Whether in-process signing is available (a `pbxk1.` key is configured). */\n  get canSign(): boolean {\n    return Boolean(this.opts.signingKey);\n  }\n\n  private async bearer(): Promise<string> {\n    if (this.opts.token) return this.opts.token;\n    if (this.opts.apiKey) return this.opts.apiKey;\n    if (this.oauth) {\n      if (this.oauth.expiresAt && Date.now() > this.oauth.expiresAt - EXPIRY_SKEW_MS) {\n        this.oauth = await refreshTokens(this.baseUrl, this.oauth);\n        if (this.configBacked) {\n          const cfg = loadConfig();\n          cfg.oauth = this.oauth;\n          saveConfig(cfg);\n        }\n      }\n      return this.oauth.accessToken;\n    }\n    throw new Error(\n      \"not authenticated — run `paybox login`, set PAYBOX_API_KEY, or pass { apiKey } / { token }\",\n    );\n  }\n\n  private async request<T>(\n    method: string,\n    path: string,\n    init: { query?: Record<string, string | undefined>; body?: unknown } = {},\n  ): Promise<T> {\n    const url = new URL(this.baseUrl + path);\n    for (const [k, v] of Object.entries(init.query ?? {})) {\n      if (v != null) url.searchParams.set(k, v);\n    }\n    const headers: Record<string, string> = { authorization: `Bearer ${await this.bearer()}` };\n    let body: string | undefined;\n    if (init.body !== undefined) {\n      headers[\"content-type\"] = \"application/json\";\n      body = JSON.stringify(init.body);\n    }\n    const res = await this.fetchImpl(url, { method, headers, body });\n    const text = await res.text();\n    if (!res.ok) throw new PayboxError(res.status, text, `${method} ${path}`);\n    return (text ? JSON.parse(text) : undefined) as T;\n  }\n\n  private readonly poster: Poster = (path, body) => this.request<unknown>(\"POST\", path, { body });\n\n  /** List the credentials this client may use (the `list_credentials` tool). */\n  listCredentials(): Promise<ClientGrantSummary[]> {\n    return this.request(\"GET\", \"/agent/grants\");\n  }\n\n  /** Token balances across chains (the `get_portfolio` tool). */\n  getPortfolio(args: PortfolioArgs): Promise<unknown> {\n    return this.request(\"GET\", \"/agent/portfolio\", {\n      query: { address: args.address, network_ids: args.networkIds },\n    });\n  }\n\n  /** Charge a card credential (the `request_payment` tool). */\n  requestPayment(args: PaymentArgs): Promise<AgentResponse> {\n    const operation: RequestPaymentArgs & { type: \"payment\" } = {\n      type: \"payment\",\n      credential_id: args.credentialId,\n      merchant: args.merchant,\n      merchant_url: args.merchantUrl,\n      amount_cents: args.amountCents,\n      currency: args.currency ?? \"USD\",\n    };\n    return this.request(\"POST\", \"/agent/request\", { body: { operation } });\n  }\n\n  /** Reveal a secret credential (the `request_secret` tool). */\n  requestSecret(args: SecretArgs): Promise<AgentResponse> {\n    const operation: RequestSecretArgs & { type: \"secret\" } = {\n      type: \"secret\",\n      credential_id: args.credentialId,\n      raw: args.raw ?? false,\n      purpose: args.purpose ?? null,\n    };\n    return this.request(\"POST\", \"/agent/request\", { body: { operation } });\n  }\n\n  /** Sign with a wallet credential (the `request_wallet_sign` tool). Signs\n   *  in-process and returns the completed request when a signing key is set and\n   *  the request clears immediately; otherwise returns the pending response.\n   *  Uses `/agent/wallet-sign`, which echoes the wallet binding so the signer\n   *  need not resolve it separately. */\n  async requestWalletSign(args: WalletSignArgs, opts: SignOptions = {}): Promise<AgentResponse> {\n    const operation: RequestWalletSignArgs & { type: \"wallet_sign\" } = {\n      type: \"wallet_sign\",\n      credential_id: args.credentialId,\n      chain: args.chain,\n      contract: args.contract ?? null,\n      function: args.fn ?? null,\n      value_cents: args.valueCents ?? null,\n      intent: args.intent,\n    };\n    const { response, binding } = await this.request<WalletSignResult>(\n      \"POST\",\n      \"/agent/wallet-sign\",\n      { body: { operation } },\n    );\n    if (\n      (opts.autoSign ?? true) &&\n      response.status === \"pending_signature\" &&\n      this.opts.signingKey\n    ) {\n      await signWalletRequest(\n        this.poster,\n        response.request_id,\n        args.intent,\n        credsFromToken(this.opts.signingKey),\n        binding,\n      );\n      return this.getRequest(response.request_id);\n    }\n    return response;\n  }\n\n  /** Swap tokens from a wallet credential (the `request_swap` tool). Returns the\n   *  parked response + sign-ready plan; signs + submits in-process when a signing\n   *  key is set and the swap cleared immediately. */\n  async requestSwap(args: SwapArgs, opts: SignOptions = {}): Promise<SwapResult> {\n    const operation: RequestSwapArgs & { type: \"swap\" } = {\n      type: \"swap\",\n      credential_id: args.credentialId,\n      src_chain: args.srcChain,\n      dst_chain: args.dstChain ?? args.srcChain,\n      src_token: args.srcToken,\n      dst_token: args.dstToken,\n      amount: args.amount,\n      swap_direction: args.swapDirection ?? \"exact-amount-in\",\n      slippage_bps: args.slippageBps ?? 50,\n      recipient: args.recipient ?? null,\n      value_cents: args.valueCents ?? null,\n    };\n    const result = await this.request<SwapResult>(\"POST\", \"/agent/swap\", { body: { operation } });\n    if (\n      (opts.autoSign ?? true) &&\n      result.response.status === \"pending_signature\" &&\n      this.opts.signingKey\n    ) {\n      await signSwapRequest(\n        this.poster,\n        result.response.request_id,\n        result.plan,\n        credsFromToken(this.opts.signingKey),\n      );\n      return { ...result, response: await this.getRequest(result.response.request_id) };\n    }\n    return result;\n  }\n\n  /** Poll a request's status (the `get_request` tool). */\n  getRequest(requestId: string): Promise<AgentResponse> {\n    return this.request(\"GET\", `/agent/requests/${requestId}`);\n  }\n\n  /** Poll until the request leaves a pending state (or the timeout elapses). */\n  async waitForRequest(\n    requestId: string,\n    opts: { intervalMs?: number; timeoutMs?: number } = {},\n  ): Promise<AgentResponse> {\n    const interval = opts.intervalMs ?? 2000;\n    const deadline = Date.now() + (opts.timeoutMs ?? 300_000);\n    for (;;) {\n      const r = await this.getRequest(requestId);\n      const pending = r.status === \"pending_approval\" || r.status === \"pending_signature\";\n      if (!pending || Date.now() > deadline) return r;\n      await new Promise((res) => setTimeout(res, interval));\n    }\n  }\n}\n"],"mappings":";AAQA,SAAS,aAAa;AACtB,SAAS,YAAY,mBAAmB;AACxC,SAAS,oBAAoB;AAMtB,SAAS,YAAY,SAAyB;AACnD,SAAO,GAAG,QAAQ,QAAQ,QAAQ,EAAE,CAAC;AACvC;AAQA,eAAe,SAAS,SAAsC;AAC5D,QAAM,MAAM,GAAG,QAAQ,QAAQ,QAAQ,EAAE,CAAC;AAC1C,QAAM,MAAM,MAAM,MAAM,GAAG;AAC3B,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,IAAI,MAAM,sCAAsC,GAAG,KAAK,IAAI,MAAM,GAAG;AAAA,EAC7E;AACA,SAAQ,MAAM,IAAI,KAAK;AACzB;AAEA,SAAS,UAAU,GAAmB;AACpC,SAAO,EAAE,SAAS,WAAW;AAC/B;AAEA,SAAS,OAAgD;AACvD,QAAM,WAAW,UAAU,YAAY,EAAE,CAAC;AAC1C,QAAM,YAAY,UAAU,WAAW,QAAQ,EAAE,OAAO,QAAQ,EAAE,OAAO,CAAC;AAC1E,SAAO,EAAE,UAAU,UAAU;AAC/B;AAEA,SAAS,YAAY,KAAmB;AAItC,QAAM,CAAC,KAAK,IAAI,IACd,QAAQ,aAAa,WAChB,CAAC,QAAQ,CAAC,GAAG,CAAC,IACf,QAAQ,aAAa,UAClB,CAAC,YAAY,CAAC,+BAA+B,GAAG,CAAC,IACjD,CAAC,YAAY,CAAC,GAAG,CAAC;AAC3B,MAAI;AACF,UAAM,KAAK,CAAC,GAAG,IAAI,GAAG,EAAE,OAAO,UAAU,UAAU,KAAK,CAAC,EAAE,MAAM;AAAA,EACnE,QAAQ;AAAA,EAER;AACF;AAEA,IAAM,gBACJ;AAaF,eAAsB,cACpB,SACA,OAAqB,CAAC,GACA;AACtB,QAAM,QAAQ,KAAK,SAAS;AAC5B,QAAM,aAAa,KAAK,cAAc;AACtC,QAAM,MAAM,KAAK,QAAQ,CAAC,MAAc,QAAQ,MAAM,CAAC;AACvD,QAAM,OAAO,MAAM,SAAS,OAAO;AACnC,QAAM,WAAW,YAAY,OAAO;AAEpC,MAAI;AACJ,MAAI;AACJ,QAAM,cAAc,IAAI,QAAgD,CAAC,KAAK,QAAQ;AACpF,kBAAc;AACd,iBAAa;AAAA,EACf,CAAC;AAED,QAAM,SAAS,aAAa,CAAC,KAAK,QAAQ;AACxC,UAAM,IAAI,IAAI,IAAI,IAAI,OAAO,KAAK,kBAAkB;AACpD,QAAI,EAAE,aAAa,aAAa;AAC9B,UAAI,UAAU,GAAG,EAAE,IAAI;AACvB;AAAA,IACF;AACA,QAAI,UAAU,KAAK,EAAE,gBAAgB,YAAY,CAAC,EAAE,IAAI,aAAa;AACrE,UAAM,OAAO,EAAE,aAAa,IAAI,MAAM;AACtC,QAAI,KAAM,aAAY,EAAE,MAAM,OAAO,EAAE,aAAa,IAAI,OAAO,EAAE,CAAC;AAAA,QAC7D,YAAW,IAAI,MAAM,EAAE,aAAa,IAAI,OAAO,KAAK,sBAAsB,CAAC;AAAA,EAClF,CAAC;AACD,QAAM,IAAI,QAAc,CAAC,MAAM,OAAO,OAAO,GAAG,aAAa,CAAC,CAAC;AAC/D,QAAM,OAAQ,OAAO,QAAQ,EAAkB;AAC/C,QAAM,cAAc,oBAAoB,IAAI;AAE5C,QAAM,YAAY,KAAK,aAAa;AACpC,QAAM,QAAQ;AAAA,IACZ,MAAM,WAAW,IAAI,MAAM,yBAAyB,KAAK,MAAM,YAAY,GAAI,CAAC,+BAA0B,CAAC;AAAA,IAC3G;AAAA,EACF;AACA,QAAM,MAAM;AAEZ,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,KAAK,uBAAuB;AAAA,MAClD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU;AAAA,QACnB,aAAa;AAAA,QACb,eAAe,CAAC,WAAW;AAAA,QAC3B,4BAA4B;AAAA,QAC5B,aAAa,CAAC,sBAAsB,eAAe;AAAA,QACnD,gBAAgB,CAAC,MAAM;AAAA,MACzB,CAAC;AAAA,IACH,CAAC;AACD,QAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,+BAA+B,IAAI,MAAM,MAAM,MAAM,IAAI,KAAK,CAAC,EAAE;AAC9F,UAAM,EAAE,WAAW,SAAS,IAAK,MAAM,IAAI,KAAK;AAEhD,UAAM,EAAE,UAAU,UAAU,IAAI,KAAK;AACrC,UAAM,QAAQ,UAAU,YAAY,EAAE,CAAC;AACvC,UAAM,UACJ,GAAG,KAAK,sBAAsB,iCAChB,mBAAmB,QAAQ,CAAC,iBACzB,mBAAmB,WAAW,CAAC,mBAC7B,SAAS,qCAClB,mBAAmB,KAAK,CAAC,UACzB,KAAK,aAAa,mBAAmB,QAAQ,CAAC;AAE1D,QAAI;AAAA,IAA8C,OAAO;AAAA,CAAI;AAC7D,gBAAY,OAAO;AAEnB,UAAM,EAAE,MAAM,OAAO,cAAc,IAAI,MAAM;AAC7C,QAAI,kBAAkB,MAAO,OAAM,IAAI,MAAM,sCAAiC;AAE9E,UAAM,OAAO,IAAI,gBAAgB;AAAA,MAC/B,YAAY;AAAA,MACZ;AAAA,MACA,cAAc;AAAA,MACd,WAAW;AAAA,MACX,eAAe;AAAA,MACf;AAAA,IACF,CAAC;AACD,UAAM,MAAM,MAAM,MAAM,KAAK,gBAAgB;AAAA,MAC3C,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,MAC/D,MAAM;AAAA,IACR,CAAC;AACD,QAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,0BAA0B,IAAI,MAAM,MAAM,MAAM,IAAI,KAAK,CAAC,EAAE;AACzF,UAAM,IAAK,MAAM,IAAI,KAAK;AAK1B,WAAO;AAAA,MACL;AAAA,MACA,aAAa,EAAE;AAAA,MACf,cAAc,EAAE;AAAA,MAChB,WAAW,EAAE,aAAa,KAAK,IAAI,IAAI,EAAE,aAAa,MAAO;AAAA,MAC7D;AAAA,IACF;AAAA,EACF,UAAE;AACA,iBAAa,KAAK;AAClB,WAAO,MAAM;AAAA,EACf;AACF;AAEA,eAAsB,cAAc,SAAiB,SAA4C;AAC/F,MAAI,CAAC,QAAQ,aAAc,OAAM,IAAI,MAAM,kDAA6C;AACxF,QAAM,OAAO,MAAM,SAAS,OAAO;AACnC,QAAM,WAAW,QAAQ,YAAY,YAAY,OAAO;AACxD,QAAM,OAAO,IAAI,gBAAgB;AAAA,IAC/B,YAAY;AAAA,IACZ,eAAe,QAAQ;AAAA,IACvB,WAAW,QAAQ;AAAA,IACnB;AAAA,EACF,CAAC;AACD,QAAM,MAAM,MAAM,MAAM,KAAK,gBAAgB;AAAA,IAC3C,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,IAC/D,MAAM;AAAA,EACR,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,yBAAyB,IAAI,MAAM,MAAM,MAAM,IAAI,KAAK,CAAC,EAAE;AACxF,QAAM,IAAK,MAAM,IAAI,KAAK;AAK1B,SAAO;AAAA,IACL,GAAG;AAAA,IACH,aAAa,EAAE;AAAA,IACf,cAAc,EAAE,iBAAiB,QAAQ;AAAA,IACzC,WAAW,EAAE,aAAa,KAAK,IAAI,IAAI,EAAE,aAAa,MAAO;AAAA,IAC7D;AAAA,EACF;AACF;;;AC1MA,SAAS,WAAW,WAAW,cAAc,qBAAqB;AAClE,SAAS,eAAe;AACxB,SAAS,YAAY;AAmBrB,SAAS,YAAoB;AAC3B,MAAI,QAAQ,IAAI,kBAAmB,QAAO,QAAQ,IAAI;AACtD,QAAM,OAAO,QAAQ,IAAI,mBAAmB,KAAK,QAAQ,GAAG,SAAS;AACrE,SAAO,KAAK,MAAM,QAAQ;AAC5B;AAEO,SAAS,aAAqB;AACnC,SAAO,KAAK,UAAU,GAAG,aAAa;AACxC;AAEO,SAAS,aAA2B;AACzC,MAAI;AACF,WAAO,KAAK,MAAM,aAAa,WAAW,GAAG,MAAM,CAAC;AAAA,EACtD,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEO,SAAS,WAAW,QAA4B;AAGrD,YAAU,UAAU,GAAG,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AACvD,gBAAc,WAAW,GAAG,GAAG,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAAA,GAAM,EAAE,MAAM,IAAM,CAAC;AAGnF,MAAI,QAAQ,aAAa,QAAS,WAAU,WAAW,GAAG,GAAK;AACjE;;;ACpCO,IAAM,eAAe;AA8ErB,SAAS,YAAY,GAAW,OAA8B;AACnE,QAAM,UAAU,EAAE,KAAK;AACvB,MAAI,CAAC,QAAS,QAAO,GAAG,KAAK;AAC7B,QAAM,OAAO,QAAQ,WAAW,IAAI,KAAK,QAAQ,WAAW,IAAI,IAAI,QAAQ,MAAM,CAAC,IAAI;AACvF,MAAI,KAAK,WAAW,EAAG,QAAO,GAAG,KAAK;AACtC,MAAI,KAAK,SAAS,MAAM,EAAG,QAAO,GAAG,KAAK;AAC1C,MAAI,CAAC,iBAAiB,KAAK,IAAI,EAAG,QAAO,GAAG,KAAK;AACjD,SAAO;AACT;AAeA,SAAS,aAAa,GAAmB;AACvC,MAAI,IAAI,EAAE,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AAC9C,SAAO,EAAE,SAAS,EAAG,MAAK;AAC1B,SAAO,KAAK,CAAC;AACf;AAYO,SAAS,WAAW,OAAiE;AAC1F,QAAM,IAAI,MAAM,KAAK;AACrB,MAAI,CAAC,EAAG,QAAO;AACf,QAAM,OAAO,EAAE,WAAW,YAAY,IAAI,EAAE,MAAM,aAAa,MAAM,IAAI;AACzE,MAAI;AACJ,MAAI;AACF,UAAM,KAAK,MAAM,aAAa,IAAI,CAAC;AAAA,EACrC,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO;AAC5C,QAAM,IAAI;AACV,QAAM,YAAY,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,KAAK;AACxD,QAAM,aAAa,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,KAAK;AAC1D,MAAI,CAAC,aAAa,CAAC,WAAY,QAAO;AACtC,MAAI,YAAY,WAAW,KAAK,KAAK,YAAY,YAAY,KAAK,EAAG,QAAO;AAC5E,SAAO,EAAE,WAAW,WAAW;AACjC;;;AC/HA,SAAS,cAAc;AACvB,OAAO,UAAU;AACjB,SAAS,gBAAgB,8BAA8B;AACvD,SAAS,mBAAmB,iCAAiC;AAC7D,SAAS,mBAAmB;AAC5B,SAAS,WAAW,4BAA4B;AAuEhD,SAAS,SAAS,GAAoC;AACpD,SAAO;AAAA,IACL,MAAM;AAAA,IACN,IAAI,EAAE;AAAA,IACN,OAAO,OAAO,EAAE,KAAK;AAAA,IACrB,MAAM,EAAE;AAAA,IACR,SAAS,EAAE;AAAA,IACX,KAAK,OAAO,EAAE,GAAG;AAAA,IACjB,sBAAsB,OAAO,EAAE,oBAAoB;AAAA,IACnD,cAAc,OAAO,EAAE,YAAY;AAAA,IACnC,OAAO,EAAE;AAAA,EACX;AACF;AAEA,SAAS,WAAW,KAAyB;AAC3C,SAAO,IAAI,WAAW,OAAO,KAAK,IAAI,QAAQ,OAAO,EAAE,GAAG,KAAK,CAAC;AAClE;AACA,SAAS,WAAW,OAA2B;AAC7C,SAAO,OAAO,KAAK,KAAK,EAAE,SAAS,KAAK;AAC1C;AAQA,SAAS,cACP,sBACA,SACA,OACkD;AAClD,QAAM,gBAAgB;AAAA,IACpB,qBAAqB,qBAAqB,QAAQ,OAAO,EAAE,EAAE,YAAY;AAAA,IACzE,QAAQ,QAAQ;AAAA,IAChB,iBAAiB,QAAQ;AAAA,IACzB,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,EACpC;AACA,QAAM,kBAAkB,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,aAAa,CAAC;AAE9E,QAAM,UAAU,KAAK,KAAK,QAAQ,SAAS,WAAW,MAAM,UAAU,CAAC;AACvE,QAAM,WAAW,KAAK,KAAK,SAAS,iBAAiB,QAAQ,SAAS;AACtE,SAAO;AAAA,IACL,aAAa,WAAW,eAAe;AAAA,IACvC,iBAAiB,WAAW,QAAQ;AAAA,EACtC;AACF;AAQO,SAAS,mBAAmB,IAA2B;AAC5D,SAAO,UAAU,qBAAqB,SAAS,EAAE,CAAC,CAAC;AACrD;AAOO,SAAS,qBAAqB,UAA0B;AAC7D,QAAM,MAAM,OAAO,KAAK,UAAU,QAAQ;AAE1C,MAAI,IAAI;AACR,MAAI,WAAW;AACf,MAAI,QAAQ;AACZ,aAAS;AACP,UAAM,IAAI,IAAI,GAAG;AACjB,iBAAa,IAAI,QAAS;AAC1B,SAAK,IAAI,SAAU,EAAG;AACtB,aAAS;AAAA,EACX;AACA,MAAI,aAAa,GAAG;AAClB,UAAM,IAAI,MAAM,2CAA2C,QAAQ,oBAAoB;AAAA,EACzF;AACA,SAAO,WAAW,IAAI,WAAW,IAAI,SAAS,IAAI,EAAE,CAAC,CAAC;AACxD;AAqBO,SAAS,mBACd,KACA,SACA,OACc;AACd,MAAI,CAAC,QAAQ,UAAU;AACrB,UAAM,IAAI,MAAM,uDAAuD;AAAA,EACzE;AACA,MAAI,CAAC,QAAQ,SAAS,CAAC,QAAQ,gBAAgB;AAC7C,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AACA,SAAO,IAAI,IAAI,CAAC,MAAM;AACpB,UAAM,UACJ,EAAE,OAAO,WACL,qBAAqB,EAAE,WAAqB,IAC5C,mBAAmB,EAAE,WAAqB;AAChD,UAAM,EAAE,aAAa,gBAAgB,IAAI,cAAc,SAAS,SAAS,KAAK;AAC9E,WAAO,EAAE,SAAS,MAAM,WAAW,aAAa,gBAAgB;AAAA,EAClE,CAAC;AACH;AAkBO,SAAS,sBAAsB,OAGpC;AACA,QAAM,kBAAkB,IAAI,YAAY,EAAE;AAAA,IACxC,KAAK,UAAU,EAAE,YAAW,oBAAI,KAAK,GAAE,YAAY,EAAE,CAAC;AAAA,EACxD;AACA,QAAM,UAAU,KAAK,KAAK,QAAQ,SAAS,WAAW,MAAM,UAAU,CAAC;AACvE,QAAM,WAAW,KAAK,KAAK,SAAS,iBAAiB,QAAQ,SAAS;AACtE,SAAO;AAAA,IACL,aAAa,WAAW,eAAe;AAAA,IACvC,iBAAiB,WAAW,QAAQ;AAAA,EACtC;AACF;AAmBA,eAAsB,WACpB,QACA,OACA,SACA,WAC6B;AAC7B,MAAI,CAAC,QAAQ,UAAU;AACrB,WAAO,EAAE,IAAI,OAAO,OAAO,wDAAwD;AAAA,EACrF;AACA,MAAI,CAAC,QAAQ,SAAS,CAAC,QAAQ,gBAAgB;AAC7C,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,OACE;AAAA,IAEJ;AAAA,EACF;AAIA,QAAM,YAAY,OAAO,WAA0B;AACjD,UAAM,SAAS,MAAM,UAAU,cAAc,QAAQ,SAAS,KAAK,CAAC;AACpE,UAAM,EAAE,GAAG,GAAG,YAAY,IAAI,OAAO;AACrC,QAAI,KAAK,QAAQ,KAAK,QAAQ,eAAe,MAAM;AACjD,YAAM,IAAI,MAAM,4DAA4D;AAAA,IAC9E;AACA,WAAO;AAAA,MACL,GAAG,KAAK,CAAC;AAAA,MACT,GAAG,KAAK,CAAC;AAAA,MACT,SAAS;AAAA,IACX;AAAA,EACF;AAEA,QAAM,cAAc,OAAO,YAAwB;AACjD,UAAM,SAAS,MAAM,UAAU,cAAc,WAAW,OAAO,GAAG,SAAS,KAAK,CAAC;AACjF,UAAM,MAAM,OAAO,UAAU;AAC7B,QAAI,CAAC,IAAK,OAAM,IAAI,MAAM,sDAAsD;AAChF,WAAO,WAAW,GAAG;AAAA,EACvB;AAEA,MAAI;AACF,YAAQ,OAAO,IAAI;AAAA,MACjB,KAAK;AACH,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,UAAU,EAAE,WAAW,MAAM,IAAI,eAAe,SAAS,EAAE,YAAY,OAAO,OAAO,EAAE;AAAA,QACzF;AAAA,MACF,KAAK;AACH,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,UAAU;AAAA,YACR,WAAW,MAAM,IAAI,eAAe,SAAS,EAAE,cAAc,OAAO,SAAS;AAAA,UAC/E;AAAA,QACF;AAAA,MACF,KAAK;AACH,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,UAAU;AAAA,YACR,uBAAuB,MAAM,IAAI,eAAe,SAAS,EAAE;AAAA,cACzD,SAAS,OAAO,WAAW;AAAA,YAC7B;AAAA,UACF;AAAA,QACF;AAAA,MACF,KAAK;AACH,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,UAAU;AAAA,YACR,eAAe,MAAM,IAAI,eAAe,SAAS,EAAE;AAAA,cACjD,OAAO;AAAA,YACT;AAAA,UACF;AAAA,QACF;AAAA,MACF,KAAK,iBAAiB;AACpB,cAAM,MAAM,MAAM,IAAI,kBAAkB,aAAa,OAAO,OAAO,EAAE;AAAA,UACnE,OAAO;AAAA,QACT;AACA,eAAO,EAAE,IAAI,MAAM,UAAU,EAAE,WAAW,WAAW,GAAG,EAAE,EAAE;AAAA,MAC9D;AAAA,MACA,KAAK,qBAAqB;AACxB,cAAM,KAAK,YAAY,KAAK,OAAO,KAAK,OAAO,mBAAmB,QAAQ,CAAC;AAC3E,cAAM,SAAS,MAAM,IAAI,kBAAkB,aAAa,OAAO,OAAO,EAAE;AAAA,UACtE;AAAA,QACF;AACA,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,UAAU,EAAE,yBAAyB,OAAO,KAAK,MAAM,EAAE,SAAS,QAAQ,EAAE;AAAA,QAC9E;AAAA,MACF;AAAA,MACA,KAAK,OAAO;AAEV,cAAM,SAAS,MAAM,UAAU,cAAc,OAAO,sBAAsB,SAAS,KAAK,CAAC;AACzF,eAAO,EAAE,IAAI,MAAM,UAAU,EAAE,QAAQ,OAAO,QAAQ,WAAW,OAAO,UAAU,EAAE;AAAA,MACtF;AAAA,MACA;AACE,eAAO,EAAE,IAAI,OAAO,OAAO,eAAgB,OAA2B,EAAE,GAAG;AAAA,IAC/E;AAAA,EACF,SAAS,KAAK;AACZ,QAAI,eAAe,0BAA0B,eAAe,2BAA2B;AACrF,aAAO,EAAE,IAAI,OAAO,OAAO,IAAI,QAAQ;AAAA,IACzC;AACA,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,WAAO,EAAE,IAAI,OAAO,OAAO,QAAQ;AAAA,EACrC;AACF;;;ACzVO,SAAS,eAAe,OAAsB;AACnD,QAAM,KAAK,WAAW,KAAK;AAC3B,MAAI,CAAC,IAAI;AACP,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AACA,SAAO,EAAE,WAAW,GAAG,WAAW,YAAY,GAAG,YAAY,SAAS,KAAK,IAAI,EAAE;AACnF;AAEA,SAAS,UAAU,GAAmC;AACpD,SAAO,EAAE,UAAU,EAAE,WAAW,OAAO,EAAE,UAAU,IAAI,gBAAgB,EAAE,mBAAmB,GAAG;AACjG;AAIA,eAAe,eACb,MACA,WACA,OACwB;AACxB,QAAM,MAAM,sBAAsB,KAAK;AACvC,QAAM,IAAK,MAAM,KAAK,mBAAmB,SAAS,YAAY;AAAA,IAC5D,SAAS,MAAM;AAAA,IACf,aAAa,IAAI;AAAA,IACjB,iBAAiB,IAAI;AAAA,EACvB,CAAC;AACD,SAAO,UAAU,CAAC;AACpB;AAOA,eAAsB,kBACpB,MACA,WACA,QACA,OACA,SACkC;AAClC,QAAM,WACJ,WAAW,QAAQ,UAAU,QAAQ,kBACjC,UAAU,OAAO,IACjB,MAAM,eAAe,MAAM,WAAW,KAAK;AACjD,QAAM,YAAY,CAAC,aACjB,KAAK,mBAAmB,SAAS,eAAe;AAAA,IAC9C,SAAS,MAAM;AAAA,IACf,GAAG;AAAA,EACL,CAAC;AACH,QAAM,SAAS,MAAM,WAAW,QAAQ,OAAO,UAAU,SAAS;AAClE,MAAI,CAAC,OAAO,GAAI,OAAM,IAAI,MAAM,OAAO,KAAK;AAC5C,QAAM,KAAK,mBAAmB,SAAS,cAAc,EAAE,UAAU,OAAO,SAAS,CAAC;AAClF,SAAO,OAAO;AAChB;AAIA,eAAsB,gBACpB,MACA,WACA,MACA,OACe;AACf,MAAI,UAAyB;AAAA,IAC3B,UAAU,KAAK,QAAQ;AAAA,IACvB,OAAO,KAAK,QAAQ,UAAU;AAAA,IAC9B,gBAAgB,KAAK,QAAQ,mBAAmB;AAAA,EAClD;AACA,MAAI,QAAQ,aAAa,CAAC,QAAQ,SAAS,CAAC,QAAQ,iBAAiB;AACnE,cAAU,MAAM,eAAe,MAAM,WAAW,KAAK;AAAA,EACvD;AACA,QAAM,YAA0B,mBAAmB,KAAK,KAAK,SAAS,KAAK;AAC3E,QAAM,KAAK,mBAAmB,SAAS,cAAc,EAAE,UAAU,CAAC;AACpE;;;AC5EA,IAAM,mBAAmB;AACzB,IAAM,iBAAiB;AAEhB,IAAM,cAAN,cAA0B,MAAM;AAAA,EACrC,YACW,QACA,MACT,SACA;AACA,UAAM,UAAU,OAAO,YAAY,MAAM,MAAM,IAAI,EAAE;AAJ5C;AACA;AAIT,SAAK,OAAO;AAAA,EACd;AACF;AAmBO,IAAM,eAAN,MAAM,cAAa;AAAA,EACf;AAAA,EACQ;AAAA,EACA;AAAA,EACT;AAAA,EACA,eAAe;AAAA,EAEvB,YAAY,UAA+B,CAAC,GAAG;AAC7C,SAAK,OAAO;AACZ,SAAK,WAAW,QAAQ,WAAW,kBAAkB,QAAQ,QAAQ,EAAE;AACvE,SAAK,YAAY,QAAQ,aAAa;AAAA,EACxC;AAAA;AAAA,EAGA,OAAO,WAAW,YAAiC,CAAC,GAAiB;AACnE,UAAM,MAAM,WAAW;AACvB,UAAM,SAAS,IAAI,cAAa;AAAA,MAC9B,SAAS,UAAU,WAAW,QAAQ,IAAI,kBAAkB,IAAI;AAAA,MAChE,QAAQ,UAAU,UAAU,QAAQ,IAAI,kBAAkB,IAAI;AAAA,MAC9D,OAAO,UAAU,SAAS,QAAQ,IAAI;AAAA,MACtC,YAAY,UAAU,cAAc,QAAQ,IAAI,sBAAsB,IAAI;AAAA,MAC1E,WAAW,UAAU;AAAA,IACvB,CAAC;AACD,QAAI,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO;AAC1D,aAAO,QAAQ,IAAI;AACnB,aAAO,eAAe;AAAA,IACxB;AACA,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,IAAI,UAAmB;AACrB,WAAO,QAAQ,KAAK,KAAK,UAAU;AAAA,EACrC;AAAA,EAEA,MAAc,SAA0B;AACtC,QAAI,KAAK,KAAK,MAAO,QAAO,KAAK,KAAK;AACtC,QAAI,KAAK,KAAK,OAAQ,QAAO,KAAK,KAAK;AACvC,QAAI,KAAK,OAAO;AACd,UAAI,KAAK,MAAM,aAAa,KAAK,IAAI,IAAI,KAAK,MAAM,YAAY,gBAAgB;AAC9E,aAAK,QAAQ,MAAM,cAAc,KAAK,SAAS,KAAK,KAAK;AACzD,YAAI,KAAK,cAAc;AACrB,gBAAM,MAAM,WAAW;AACvB,cAAI,QAAQ,KAAK;AACjB,qBAAW,GAAG;AAAA,QAChB;AAAA,MACF;AACA,aAAO,KAAK,MAAM;AAAA,IACpB;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,QACZ,QACA,MACA,OAAuE,CAAC,GAC5D;AACZ,UAAM,MAAM,IAAI,IAAI,KAAK,UAAU,IAAI;AACvC,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,GAAG;AACrD,UAAI,KAAK,KAAM,KAAI,aAAa,IAAI,GAAG,CAAC;AAAA,IAC1C;AACA,UAAM,UAAkC,EAAE,eAAe,UAAU,MAAM,KAAK,OAAO,CAAC,GAAG;AACzF,QAAI;AACJ,QAAI,KAAK,SAAS,QAAW;AAC3B,cAAQ,cAAc,IAAI;AAC1B,aAAO,KAAK,UAAU,KAAK,IAAI;AAAA,IACjC;AACA,UAAM,MAAM,MAAM,KAAK,UAAU,KAAK,EAAE,QAAQ,SAAS,KAAK,CAAC;AAC/D,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,QAAI,CAAC,IAAI,GAAI,OAAM,IAAI,YAAY,IAAI,QAAQ,MAAM,GAAG,MAAM,IAAI,IAAI,EAAE;AACxE,WAAQ,OAAO,KAAK,MAAM,IAAI,IAAI;AAAA,EACpC;AAAA,EAEiB,SAAiB,CAAC,MAAM,SAAS,KAAK,QAAiB,QAAQ,MAAM,EAAE,KAAK,CAAC;AAAA;AAAA,EAG9F,kBAAiD;AAC/C,WAAO,KAAK,QAAQ,OAAO,eAAe;AAAA,EAC5C;AAAA;AAAA,EAGA,aAAa,MAAuC;AAClD,WAAO,KAAK,QAAQ,OAAO,oBAAoB;AAAA,MAC7C,OAAO,EAAE,SAAS,KAAK,SAAS,aAAa,KAAK,WAAW;AAAA,IAC/D,CAAC;AAAA,EACH;AAAA;AAAA,EAGA,eAAe,MAA2C;AACxD,UAAM,YAAsD;AAAA,MAC1D,MAAM;AAAA,MACN,eAAe,KAAK;AAAA,MACpB,UAAU,KAAK;AAAA,MACf,cAAc,KAAK;AAAA,MACnB,cAAc,KAAK;AAAA,MACnB,UAAU,KAAK,YAAY;AAAA,IAC7B;AACA,WAAO,KAAK,QAAQ,QAAQ,kBAAkB,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAAA,EACvE;AAAA;AAAA,EAGA,cAAc,MAA0C;AACtD,UAAM,YAAoD;AAAA,MACxD,MAAM;AAAA,MACN,eAAe,KAAK;AAAA,MACpB,KAAK,KAAK,OAAO;AAAA,MACjB,SAAS,KAAK,WAAW;AAAA,IAC3B;AACA,WAAO,KAAK,QAAQ,QAAQ,kBAAkB,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAAA,EACvE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,kBAAkB,MAAsB,OAAoB,CAAC,GAA2B;AAC5F,UAAM,YAA6D;AAAA,MACjE,MAAM;AAAA,MACN,eAAe,KAAK;AAAA,MACpB,OAAO,KAAK;AAAA,MACZ,UAAU,KAAK,YAAY;AAAA,MAC3B,UAAU,KAAK,MAAM;AAAA,MACrB,aAAa,KAAK,cAAc;AAAA,MAChC,QAAQ,KAAK;AAAA,IACf;AACA,UAAM,EAAE,UAAU,QAAQ,IAAI,MAAM,KAAK;AAAA,MACvC;AAAA,MACA;AAAA,MACA,EAAE,MAAM,EAAE,UAAU,EAAE;AAAA,IACxB;AACA,SACG,KAAK,YAAY,SAClB,SAAS,WAAW,uBACpB,KAAK,KAAK,YACV;AACA,YAAM;AAAA,QACJ,KAAK;AAAA,QACL,SAAS;AAAA,QACT,KAAK;AAAA,QACL,eAAe,KAAK,KAAK,UAAU;AAAA,QACnC;AAAA,MACF;AACA,aAAO,KAAK,WAAW,SAAS,UAAU;AAAA,IAC5C;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,YAAY,MAAgB,OAAoB,CAAC,GAAwB;AAC7E,UAAM,YAAgD;AAAA,MACpD,MAAM;AAAA,MACN,eAAe,KAAK;AAAA,MACpB,WAAW,KAAK;AAAA,MAChB,WAAW,KAAK,YAAY,KAAK;AAAA,MACjC,WAAW,KAAK;AAAA,MAChB,WAAW,KAAK;AAAA,MAChB,QAAQ,KAAK;AAAA,MACb,gBAAgB,KAAK,iBAAiB;AAAA,MACtC,cAAc,KAAK,eAAe;AAAA,MAClC,WAAW,KAAK,aAAa;AAAA,MAC7B,aAAa,KAAK,cAAc;AAAA,IAClC;AACA,UAAM,SAAS,MAAM,KAAK,QAAoB,QAAQ,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAC5F,SACG,KAAK,YAAY,SAClB,OAAO,SAAS,WAAW,uBAC3B,KAAK,KAAK,YACV;AACA,YAAM;AAAA,QACJ,KAAK;AAAA,QACL,OAAO,SAAS;AAAA,QAChB,OAAO;AAAA,QACP,eAAe,KAAK,KAAK,UAAU;AAAA,MACrC;AACA,aAAO,EAAE,GAAG,QAAQ,UAAU,MAAM,KAAK,WAAW,OAAO,SAAS,UAAU,EAAE;AAAA,IAClF;AACA,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,WAAW,WAA2C;AACpD,WAAO,KAAK,QAAQ,OAAO,mBAAmB,SAAS,EAAE;AAAA,EAC3D;AAAA;AAAA,EAGA,MAAM,eACJ,WACA,OAAoD,CAAC,GAC7B;AACxB,UAAM,WAAW,KAAK,cAAc;AACpC,UAAM,WAAW,KAAK,IAAI,KAAK,KAAK,aAAa;AACjD,eAAS;AACP,YAAM,IAAI,MAAM,KAAK,WAAW,SAAS;AACzC,YAAM,UAAU,EAAE,WAAW,sBAAsB,EAAE,WAAW;AAChE,UAAI,CAAC,WAAW,KAAK,IAAI,IAAI,SAAU,QAAO;AAC9C,YAAM,IAAI,QAAQ,CAAC,QAAQ,WAAW,KAAK,QAAQ,CAAC;AAAA,IACtD;AAAA,EACF;AACF;","names":[]}