@paybox-sh/sdk 0.8.1 → 0.8.5

package/README.md

@@ -24,7 +24,8 @@ npx @paybox-sh/sdk login     # or use the CLI directly
 Driving this CLI from an agent? [`SKILL.md`](SKILL.md) ships in the package and
 describes the install and login flow as an agent skill: what the human has to do
 (approve wallets, paste one signing key), and what the agent should not do
-around it.
+around it. Use the CLI on **Grok Bot**, **Grok Computer**, and any agent on a
+computer with no connector screen — not the grok.com MCP connector path.
 
 ## CLI
 

package/SKILL.md

@@ -1,5 +1,6 @@
 ---
 name: PayBox CLI setup
+version: 0.8.8
 description: >-
   Install and log in to the PayBox CLI (@paybox-sh/sdk) so an agent can pay,
   sign, and hold wallet, card, and secret credentials on the user's behalf. Use
@@ -9,6 +10,23 @@ description: >-
 
 # PayBox CLI setup
 
+The human and agent guide is `https://docs.paybox.sh` (start at
+getting-started and connect/mcp). This file is only the CLI film. Grok
+(grok.com) and Grok Bots are different hosts; do not treat one as the other.
+
+## Which host
+
+- **Grok Bot, Grok Computer, or any agent on a computer or VM with no connector
+  screen:** this skill is the path. Install and run `paybox login` on that
+  machine. Do not send the user to grok.com/connectors and do not paste the MCP
+  URL as setup.
+- **Grok at grok.com (chat in the browser):** the user adds the MCP connector at
+  grok.com/connectors. Do not run this CLI install flow unless they explicitly
+  want the CLI on a separate machine.
+
+When the user says "install PayBox" and you are Grok Bot or running on a
+computer, start here immediately.
+
 The user asks to install PayBox. Two things need them: they approve wallet
 access with a passkey, and they paste one signing key. Everything else is yours,
 and they should not see it happen.
@@ -19,6 +37,13 @@ and they should not see it happen.
 npm install -g @paybox-sh/sdk
 ```
 
+Then confirm what you got: `paybox --json version` reports the version and
+`binary`, the path that answered. Two things go wrong here and both are quiet.
+If the command is not found, the global prefix is not on this shell's `PATH`;
+`npm prefix -g` gives you that prefix, and the binary sits in its `bin`. If
+`binary` is under a different prefix, an older `paybox` sits earlier on `PATH`
+and will keep answering every command you run.
+
 The CLI runs wherever you run it, which is often not the user's own machine.
 That is fine: login uses an OAuth device-code grant, so the browser that
 approves does not have to be the one the CLI can reach.
@@ -27,6 +52,10 @@ Never delete or overwrite an existing config directory. To isolate a run from
 credentials the user already has, point `PAYBOX_CONFIG_DIR` at a fresh
 directory.
 
+Give each parallel run its own directory too. Commands sharing one config race
+each other's token refresh, and the loser fails with `refresh token has already
+been used`. Retry that one command once; do not run `login` again.
+
 ## Log in
 
 Run this once, in the same turn the user asks:
@@ -37,10 +66,16 @@ paybox login
 
 Add `--base-url` and `--app-url` for an environment other than the default.
 
+If a config directory already exists, check `paybox --json whoami` first. When
+`canSign` is already `true`, setup is done: do not run `login`, and do not send
+the authorize link or the key field again. A second authorize link in one chat
+reads as a setup that failed.
+
 The command drives the whole flow itself. Do not reimplement any of it: it
 registers a client, starts device authorization, prints a verification URL and a
-short user code, tries to open that URL locally, polls until the user approves,
-then opens the signing-key page and prompts for the key.
+short user code, tries to open that URL locally, and polls until the user
+approves. After this poll writes `oauth`, it may print an `/agent-key?client_id=`
+URL. Do not wait for that print if this run already saved `oauth`.
 
 Login writes progress to stderr as plain prose, not JSON. Watch for the
 verification URL and the `Code:` line.
@@ -55,27 +90,51 @@ Send that link even though the CLI also tries to open a browser. When the CLI
 is not on the user's machine, that local open is useless or invisible, and your
 message is the only way they reach the page.
 
-The user approves in the browser. If the link opens the PayBox mobile app and
-errors instead, have them open it in a browser.
+On a phone, Authorize wallets should open the PayBox app. That is the
+correct path. After they tap Connect CLI, the app opens Generate a signing
+key by itself. Do not tell them to come back to chat first.
 
 Then wait. The poll is the continue signal. Do not ask the user to type `done`,
 confirm, or send a screenshot, and do not end your turn while login is running.
 If the code expires before they approve, run `paybox login` again for a fresh
 one rather than reusing the old link.
 
+A `clientId` already on disk when this `paybox login` starts is the previous
+client. Ignore it. `login` registers a new client and only writes `oauth` after
+the poll succeeds. If you restart login for a fresh code, drop any signing-key
+link you already sent.
+
+After **this** login writes `oauth` (or prints `/agent-key?client_id=`), send
+the signing-key controls. Prefer that printed URL. If stderr never printed it
+but this run did save `oauth`, build
+`https://app.paybox.sh/agent-key?client_id=<cid>` from the `cid` claim on the
+access token this login just wrote. Never use `oauth.clientId`, a `pbx-oauth-`
+id, or a `clientId` that was already in `config.json` when the command started.
+Those are the OAuth registration, not the vault agent. `/agent-key` will say
+the agent was not found. Do not wait for a dropped Windows executor to
+reconnect before they see the box. Merge the key when the machine is back;
+showing the box does not need that machine.
+
 ### Step 2 — Paste the signing key
 
-After approval, login opens the signing-key page and prompts for the key.
-Present a **masked input** for the `pbxk1.` value and write what the user gives
-you to that prompt's stdin.
+The moment **this** login has an agent-key URL (stderr, or `cid` from the oauth
+it just saved), put **Generate Signing Key** in chat as that link plus a
+**masked input** for the `pbxk1.` value, in the same turn. Seconds after they
+finish Authorize wallets, not minutes. That chat link must use the JWT `cid`
+and must open the PayBox app on the first tap, the same way Authorize wallets
+does. Do not `Start-Process`, `open`, `rundll32`, or `xdg-open` the authorize,
+connect, or agent-key URL yourself. Write what they give you to login's
+prompt stdin when that prompt is alive. If login is wedged after this oauth
+write, keep the box on screen and merge `signingKey` when the host can write
+files again.
 
 Pass it through the prompt, or set `PAYBOX_SIGNING_KEY` before running `login`
 when nothing is attached to stdin. Never pass it as `login --signing-key <value>`
 on the command line: an argument lands in shell history and is visible to anyone
 who can list processes.
 
-Do not ask the user to click the signing-key link, it is already open. Do not
-show the key field before that page has opened, and do not open it twice.
+Do not ask the user to click a signing-key URL that never arrived. Do not open
+the page twice. Do not hold the box until login narrates success.
 
 Wallet signing is non-custodial: the key stays on the user's machine and PayBox
 never holds it. Never print, log, or echo it.
@@ -95,7 +154,8 @@ From the install request until `canSign` is `true`, exactly two messages, in
 this order:
 
 1. The **Authorize wallets** link plus the code.
-2. The masked `pbxk1.` field, after the signing-key page has opened.
+2. **Generate Signing Key** plus the masked `pbxk1.` field, as soon as
+   **this** login prints `/agent-key?client_id=` or writes a new `oauth`.
 
 Nothing else. No "Installing…", "Opening…", "Got it", no CLI version, package
 manager, config path, or request id, and no narration of a retry or fallback. If
@@ -104,18 +164,111 @@ to act on, send nothing.
 
 Match the user's language. Default to English unless they write otherwise.
 
-Once `canSign` is `true`, show them what they now have: `paybox --json
-credentials` for the granted wallets, then `paybox --json portfolio --address
-<wallet>` for balances. Every `--credential` takes the `credential.id` from that
-list; a wallet's name is not an id and the command will refuse it. Render a
-compact table, never addresses or raw JSON. The CLI cannot create wallets; it
-uses what the user granted during authorization.
+## Once setup is done
+
+The silence rules above are about setup, and end here.
+
+Show them what they now have: `paybox --json credentials` for the granted
+wallets, then `paybox --json portfolio --address <wallet>` for balances. Every
+`--credential` takes the `credential.id` from that list; a wallet's name is not
+an id and the command will refuse it. Render a compact Token / Amount / USD
+table, never addresses or raw JSON. The CLI cannot create wallets; it uses what
+the user granted during authorization.
+
+A wave is done only when every named task has a content recap in the main
+chat, a confirmed second failure, or an Auto-review block that you marked
+stopped. One specialist finishing is not the wave. Print the table **twice only**: once after the signing key is saved
+(then Welcome), and once when the wave is done. Do not reprint it after each
+recap or swap. Recaps can name a token, amount, and Solscan link without
+the book.
+
+Spawn work only for tasks they named. Do not start `paybox buy-link` or a
+buy-dollars / card-checkout specialist unless they asked to buy dollars or
+fund. Swap, BONK, a briefing, or an xStock is not that ask. "MoonPay on
+glim.sh" as a named task is a paid search payload, not a MoonPay checkout. A
+default film five is not a license to add checkout.
+
+Window count is 1 main chat plus **one specialist per named job**. If they
+state a count ("all five", "both", "the three"), that number is the specialist
+count. Do not add a window for discovery, picking a URL or service, setup, a
+retry, or a sub-step. Those stay inside the job that owns them.
+
+The human never sees `Approval needed`, Allow once, Always allow, or Deny for
+any command you or a specialist run: login, swap, use-service, discover, pay,
+portfolio, whoami, uninstall, anything else. Never set
+`request_smart_mode_approval` or retry an Auto-review block. If Auto-review
+blocks, that command is done: mark that named job stopped on the checklist,
+do not retry it, and do not nudge the specialist. One short main-chat line
+that the job stopped is the recap. If they say stop, abort immediately. Do
+not wait for Allow and do not raise a new card. A blocked command is not a
+prompt for them to authorize the CLI.
+
+When you run several operations at once, keep a checklist of the tasks they
+named. Recaps in the main chat are the bought content (amounts, tweets,
+briefing bullets). If a specialist is silent, open its transcript. If the
+last command was Auto-review blocked, mark that job stopped and do not
+nudge. Otherwise nudge it. Do not go idle waiting for a wake. Looking frozen
+is a failed take.
+Do not call the wave done, and do not print the summary or second table,
+until the wave-done rule above is true.
+
+Report each recap where the user is watching as it lands, without a new table.
+Each spends real money on its own. If a command fails and you will retry,
+retry once without telling them it failed. If the retry works, they only see
+success, or a single working beat. If it fails twice, then say so. A
+specialist may log the first fail in its own audit chat; the main recap stays
+clean. That retry still must not raise an approval card.
+
+Never tell them they had no money unless `paybox --json portfolio` shows they
+cannot cover that exact amount. A pre-broadcast reject, a dropped signature,
+or a token-refresh race is not insufficient funds. When the wave is done, one
+short summary of what they bought, then the second table.
+
+After the first table, do two things with plugins. Do not treat Welcome as a
+catalog index. There may be tens or thousands.
+
+1. Send them to enable plugins on the web: a markdown link labeled
+   **Plugins** to `https://app.paybox.sh/plugins`. That is the PayBox
+   app, not a host Settings → Plugins screen. Ask them to turn on what
+   they want to use, then say when they are back.
+
+2. Then call `discover_plugins` with `status` `enabled`, no `query`, and
+   a small `limit`. That page is what they have on, not the store. From
+   those plugins plus the portfolio, suggest a few concrete next moves
+   (about six, not one row per plugin). Use each result's `name` and
+   contract. Be specific: amounts, which wallet UUID, which market or
+   vault from the contract. Mix two enabled plugins in one suggestion
+   when that serves the same goal (for example fund or swap, then put
+   the result to work). If nothing is enabled, skip the suggestion list
+   and stay on the Plugins link.
+
+When they name a plugin or a job, search: `discover_plugins` with `query`
+set to what they asked, `status` `enabled` if they already turned it on,
+then page with `next_cursor` only while the current page has no match.
+Official plugin money uses MCP: `get_contract` with `contract_uri`
+unchanged → `use_plugin` with that contract's `plugin_id`, `tool_id`,
+and `input`. Do not invent a `paybox <plugin>` command; only use CLI
+groups that `paybox --help` already lists. Enabled plugin tools may also
+appear on `tools/list`. Plugin money always pauses for passkey.
+
+If prod MCP (`https://api.paybox.sh/mcp`) is `unreachable` or `needsAuth` while
+`paybox --json whoami` still works, say that. Do not send the human to Settings.
+Do not switch to staging. Do not report the dollar as sent.
 
 ## A setup that went wrong
 
 - The user had to prompt you after approving wallet access.
-- The key field appeared before the signing-key page opened.
-- You asked the user to click the signing-key link, or to type `done`.
+- The key field waited minutes after they finished Authorize wallets.
+- The signing-key URL used `oauth.clientId`, a `pbx-oauth-` id, or a
+  `clientId` that was already on disk before this `paybox login` started.
+- The first Generate Signing Key tap said the agent was not in the vault.
+- You asked the user to type `done`.
 - You opened either page twice.
+- You launched authorize, connect, or agent-key with `Start-Process` or an
+  equivalent local open.
+- The human saw Allow once, Always allow, or Deny for a CLI command.
+- You nudged a specialist after Auto-review blocked its last command.
+- You spawned more specialists than named jobs (discovery or a sub-step
+  got its own window).
 - Setup chat contained anything besides those two messages.
 - A token, API key, or `pbxk1.` value reached the transcript.

package/dist/{chunk-OBZSVPP7.js → chunk-WRPYONXW.js}

@@ -146,8 +146,6 @@ async function loginDevice(baseUrl, opts = {}) {
       token_endpoint_auth_method: "none",
       grant_types: ["urn:ietf:params:oauth:grant-type:device_code", "refresh_token"],
       response_types: ["code"],
-      // Must match (or be a superset of) what we ask for below — the server
-      // only grants scope that was declared at registration.
       scope
     })
   });
@@ -616,6 +614,9 @@ function signingResultForResponse(result, response) {
   const exposesPlan = response.status === "pending_approval" || response.status === "pending_signature";
   return { ...result, response, plan: exposesPlan ? result.plan : null };
 }
+function didNotHappen(r) {
+  return r?.status === "denied" || r?.status === "error";
+}
 var PayboxError = class extends Error {
   constructor(status, body, context) {
     super(`paybox ${context} failed (${status}): ${body}`);
@@ -635,7 +636,6 @@ var PayboxClient = class _PayboxClient {
     this.baseUrl = (options.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
     this.fetchImpl = options.fetchImpl ?? fetch;
   }
-  /** Build a client from `~/.config/paybox/config.json` + env, with overrides. */
   static fromConfig(overrides = {}) {
     const cfg = loadConfig();
     const client = new _PayboxClient({
@@ -659,7 +659,6 @@ var PayboxClient = class _PayboxClient {
       return null;
     }
   }
-  /** Whether in-process signing is available (a parseable `pbxk1.` key is set). */
   get canSign() {
     return this.signingCreds() !== null;
   }
@@ -698,19 +697,14 @@ var PayboxClient = class _PayboxClient {
     return text ? JSON.parse(text) : void 0;
   }
   poster = (path, body) => this.request("POST", path, { body });
-  /** List granted credentials plus the `ungranted` credentials (id, name, kind,
-   *  safe metadata) the user owns but hasn't granted this connector. */
   listCredentials() {
     return this.request("GET", "/agent/grants");
   }
-  /** Token balances across chains (the `get_portfolio` tool). */
   getPortfolio(args) {
     return this.request("GET", "/agent/portfolio", {
       query: { address: args.address, network_ids: args.networkIds }
     });
   }
-  /** Verify one confirmed Solana transaction's exact wallet/mint effect, then
-   *  read the current balance at or after its slot (`verify_solana_balance`). */
   verifySolanaBalance(args) {
     const body = {
       address: args.address,
@@ -719,7 +713,6 @@ var PayboxClient = class _PayboxClient {
     };
     return this.request("POST", "/agent/portfolio/verify-solana-balance", { body });
   }
-  /** Charge a card credential (the `request_payment` tool). */
   requestPayment(args) {
     const operation = {
       type: "payment",
@@ -731,7 +724,6 @@ var PayboxClient = class _PayboxClient {
     };
     return this.request("POST", "/agent/request", { body: { operation } });
   }
-  /** Reveal a secret credential (the `request_secret` tool). */
   requestSecret(args) {
     const operation = {
       type: "secret",
@@ -741,12 +733,6 @@ var PayboxClient = class _PayboxClient {
     };
     return this.request("POST", "/agent/request", { body: { operation } });
   }
-  /** Sign with a wallet credential (the `request_wallet_sign` tool). Signs
-   *  in-process and returns the completed request when a signing key is set and
-   *  the request clears immediately; otherwise returns the pending response.
-   *  Uses `/agent/wallet-sign`, which echoes the wallet binding only while
-   *  approval or signature is pending so the signer need not resolve it
-   *  separately. Terminal responses carry a null binding. */
   async requestWalletSign(args, opts = {}) {
     return this.withExpiryRetry(
       async () => {
@@ -771,10 +757,6 @@ var PayboxClient = class _PayboxClient {
       (r) => r
     );
   }
-  /** Swap tokens from a wallet credential (the `request_swap` tool). Returns the
-   *  parked response and its sign-ready plan while approval or signature is
-   *  pending; terminal responses carry a null plan. Signs + submits in-process
-   *  when a signing key is set and the swap cleared immediately. */
   async requestSwap(args, opts = {}) {
     return this.withExpiryRetry(
       async () => {
@@ -787,7 +769,6 @@ var PayboxClient = class _PayboxClient {
           dst_token: args.dstToken,
           amount: args.amount,
           swap_direction: args.swapDirection ?? "exact-amount-in",
-          // Keep in sync with the request_swap MCP tool default (server side).
           slippage_bps: args.slippageBps ?? 150,
           recipient: args.recipient ?? null,
           value_cents: args.valueCents ?? null
@@ -800,10 +781,6 @@ var PayboxClient = class _PayboxClient {
       (r) => r.response
     );
   }
-  /** Complete a swap request: optionally wait out a `pending_approval` dwell,
-   *  then sign the plan in-process and submit envelopes. Signing first refreshes
-   *  the parked request via `/agent/requests/{id}/refresh`, so a long approval
-   *  dwell never signs stale bytes. */
   async completeSwap(result, opts) {
     const creds = this.signingCreds();
     if (!(opts.autoSign ?? true) || !creds) {
@@ -827,8 +804,6 @@ var PayboxClient = class _PayboxClient {
       await this.requestAfterSign(response.request_id, opts.waitForApproval)
     );
   }
-  /** Poll while the request sits in `pending_approval` (the user is approving
-   *  with their passkey); returns the first non-approval state. */
   async waitWhileApproval(requestId, wait) {
     const o = typeof wait === "object" ? wait : {};
     const interval = o.intervalMs ?? 2e3;
@@ -839,25 +814,14 @@ var PayboxClient = class _PayboxClient {
       await new Promise((res) => setTimeout(res, interval));
     }
   }
-  /** Run an operation and, if it terminates on a server-marked expiry
-   *  (`retryable` on a terminal `error`/`denied`: the window elapsed and nothing
-   *  was signed or spent), re-issue it exactly once (SPE-456). Never loops: the
-   *  second attempt's result is returned as-is. */
   async withExpiryRetry(run, responseOf) {
     const first = await run();
     const r = responseOf(first);
-    if ((r.status === "error" || r.status === "denied") && r.retryable) {
+    if (didNotHappen(r) && r.retryable) {
       return run();
     }
     return first;
   }
-  /** Sign a parked request; if the sign/submit call fails, reconcile against the
-   *  authoritative state once (SPE-456). The server leaves a pre-broadcast
-   *  completion failure recoverable — the claim is released and the row stays
-   *  `pending_signature` — so re-sign a still-open request a single time; a
-   *  terminal or already-broadcast row is left as-is for the caller to read (and
-   *  for `withExpiryRetry` to re-issue if it is retryable). Bounded to one extra
-   *  attempt: a second failure propagates. */
   async signWithReconcile(requestId, sign) {
     try {
       await sign();
@@ -867,7 +831,6 @@ var PayboxClient = class _PayboxClient {
       await sign();
     }
   }
-  /** Discover x402 services with the original array-returning response. */
   async discoverServices(query, opts = {}) {
     const result = await this.request("GET", "/agent/services", {
       query: {
@@ -878,8 +841,6 @@ var PayboxClient = class _PayboxClient {
     });
     return result.services;
   }
-  /** Discover one bounded page of x402 services. Reuse the returned cursor with
-   * the same query and network while `has_more` is true. */
   async discoverServicesPage(query, opts = {}) {
     return this.request("GET", "/agent/services", {
       query: {
@@ -891,10 +852,6 @@ var PayboxClient = class _PayboxClient {
       }
     });
   }
-  /** Pay a paid x402 endpoint from a wallet credential (the `pay_x402` tool,
-   *  header mode). Signs in-process when a signing key is set and the payment
-   *  clears immediately — then the X-PAYMENT header is on the completed
-   *  response's `output.value.x_payment` (replay it on the original request). */
   async payX402(args, opts = {}) {
     return this.withExpiryRetry(
       async () => {
@@ -910,9 +867,6 @@ var PayboxClient = class _PayboxClient {
       (r) => r.response
     );
   }
-  /** Fetch a paid x402 resource and have paybox pay for it (the `use_service`
-   *  tool, gateway mode): paybox probes the url, pays the 402, re-fetches with the
-   *  payment, and returns the resource's reply on `output.value.response`. */
   async useService(args, opts = {}) {
     return this.withExpiryRetry(
       async () => {
@@ -929,9 +883,6 @@ var PayboxClient = class _PayboxClient {
       (r) => r.response
     );
   }
-  /** Shared completion for the two x402 entry points: optionally wait out a
-   *  `pending_approval` dwell, then sign the parked typed data in-process and
-   *  return the finished request, exactly like the swap path. */
   async completeX402(result, opts) {
     const creds = this.signingCreds();
     if (!(opts.autoSign ?? true) || !creds) {
@@ -955,20 +906,12 @@ var PayboxClient = class _PayboxClient {
       await this.requestAfterSign(response.request_id, opts.waitForApproval)
     );
   }
-  /** Claim the usable card credentials of an approved payment (the
-   *  `claim_payment_credentials` tool). One-time: the claim is consumed. */
   claimPaymentCredentials(requestId) {
     return this.request("POST", `/agent/requests/${requestId}/credentials`);
   }
-  /** Open the account-change flow (the `request_account_change` tool): returns a
-   *  `manage_url` deep link for the USER to open — they update this client's
-   *  access (or add a credential) in their own passkey-gated app session.
-   *  Nothing is parked or applied server-side. */
   requestAccountChange(note) {
     return this.request("POST", "/agent/account-change", { body: { note } });
   }
-  /** A signed MoonPay checkout URL funding a granted wallet (the `get_buy_link`
-   *  tool). Share the URL with the user; generating it charges nothing. */
   getBuyLink(args) {
     return this.request("GET", "/agent/buy-link", {
       query: {
@@ -979,8 +922,6 @@ var PayboxClient = class _PayboxClient {
       }
     });
   }
-  // ---- World REST discovery; money tools require the geofenced MCP window. ----
-  /** Browse World prediction markets (the `world_find_markets` tool). */
   worldMarkets(args = {}) {
     return this.request("GET", "/agent/world/markets", {
       query: {
@@ -993,25 +934,19 @@ var PayboxClient = class _PayboxClient {
       }
     });
   }
-  /** One World event with its markets (the `world_get_market` tool). Nested
-   *  markets default on, matching the tool — they carry the outcome mint ids
-   *  the orderbook/trade calls need. */
   worldMarket(eventTicker, withNestedMarkets = true) {
     return this.request("GET", "/agent/world/market", {
       query: {
         event_ticker: eventTicker,
-        // Omit when true (the server default); send only the explicit opt-out.
         with_nested_markets: withNestedMarkets ? void 0 : "false"
       }
     });
   }
-  /** A World market's orderbook (the `world_orderbook` tool). */
   worldOrderbook(id, byMint = false) {
     return this.request("GET", "/agent/world/orderbook", {
       query: { id, by_mint: byMint ? "true" : void 0 }
     });
   }
-  /** A World market's price history (the `world_market_prices` tool). */
   worldPrices(args) {
     return this.request("GET", "/agent/world/prices", {
       query: {
@@ -1022,45 +957,30 @@ var PayboxClient = class _PayboxClient {
       }
     });
   }
-  /** Filter addresses down to World outcome mints (the
-   *  `world_filter_outcome_mints` tool). */
   worldFilterOutcomeMints(addresses) {
     return this.request("POST", "/agent/world/filter-outcome-mints", {
       body: { addresses }
     });
   }
-  /** A wallet's World prediction-market positions: classified `positions` /
-   *  `settled` entries (each with a `position_result`) plus `settlement_cash`
-   *  for a settled winner's CASH cash-out (swap CASH to USDC via request_swap).
-   *  The `world_positions` tool. */
   worldPositions(address) {
     return this.request("GET", "/agent/world/positions", { query: { address } });
   }
-  // ---- Hyperliquid plugin (read-only spot discovery) — requires the user to
-  // have enabled the `hyperliquid` plugin in the paybox app. ----
-  /** Hyperliquid spot markets (the `hyperliquid_markets` tool). */
   hyperliquidMarkets() {
     return this.request("GET", "/agent/hyperliquid/markets");
   }
-  /** Hyperliquid spot prices (the `hyperliquid_prices` tool). */
   hyperliquidPrices() {
     return this.request("GET", "/agent/hyperliquid/prices");
   }
-  /** Resolve one Hyperliquid token by name (the `hyperliquid_token` tool). */
   hyperliquidToken(name) {
     return this.request("GET", "/agent/hyperliquid/token", { query: { name } });
   }
-  /** Poll a request's status (the `get_request` tool). */
   getRequest(requestId) {
     return this.request("GET", `/agent/requests/${requestId}`);
   }
-  /** After in-process sign, `--wait` polls through settlement/confirmation;
-   *  without it, return the first snapshot (the historical no-wait contract). */
   requestAfterSign(requestId, wait) {
     if (!wait) return this.getRequest(requestId);
     return this.waitForRequest(requestId, typeof wait === "object" ? wait : {});
   }
-  /** Poll until the request leaves a pending state (or the timeout elapses). */
   async waitForRequest(requestId, opts = {}) {
     const interval = opts.intervalMs ?? 2e3;
     const deadline = Date.now() + (opts.timeoutMs ?? 3e5);
@@ -1086,7 +1006,8 @@ export {
   loadConfig,
   saveConfig,
   credsFromToken,
+  didNotHappen,
   PayboxError,
   PayboxClient
 };
-//# sourceMappingURL=chunk-OBZSVPP7.js.map
+//# sourceMappingURL=chunk-WRPYONXW.js.map