@paybox-sh/sdk 1.0.0 → 2.0.0

package/README.md

@@ -3,7 +3,7 @@
 Typed Node SDK and `paybox` CLI for the PayBox agent API. It mirrors the MCP tool
 surface — `list_credentials`, `request_payment`, `claim_payment_credentials`,
 `request_wallet_sign`, `request_secret`, `request_swap`, `discover_services`,
-`pay_x402`, `use_service`, `get_portfolio`, `get_buy_link`,
+`pay_x402`, `use_service`, `get_portfolio`, `get_buy_link`, `get_deposit_link`,
 `request_account_change`, `get_request`, and the generic plugin discovery,
 contract, and invocation flow. Core operations use the REST API; plugins use
 the same MCP tools as connector hosts, with no hardcoded per-plugin paths.
@@ -22,22 +22,22 @@ npx @paybox-sh/sdk login     # or use the CLI directly
 
 Driving this CLI from an agent? [`SKILL.md`](SKILL.md) ships in the package and
 describes the install and login flow as an agent skill: what the human has to do
-(approve wallets, paste one signing key), and what the agent should not do
+(approve wallets, confirm one code), and what the agent should not do
 around it. Use the CLI on **Muse**, **Grok Bot**, **Grok Computer**, and any agent on a
 computer with no connector screen — not the grok.com MCP connector path.
 
 ## CLI
 
 ```bash
-# Authenticate: OAuth in the browser (approve with a passkey), or store a key.
-# `paybox login` is a guided two-step: OAuth, then it opens the app to provision
-# a wallet signing key and prompts you to paste the `pbxk1.` token back.
-# The OAuth step is a device-code grant, so the browser that approves does not
-# have to be on the machine running the CLI.
-paybox login                              # device-code OAuth, then provision a key
-paybox login --no-provision               # OAuth only, skip the key step
+# Setup is two commands. `login` authenticates; `connect` pairs a signing key.
+# Pairing prints eight emoji and a link; you open the link and pick that same
+# code in PayBox. The key is generated locally and never leaves this machine,
+# so there is nothing to copy. Neither command needs a browser on the machine
+# running the CLI — approve both from a phone if you like.
+paybox login                              # device-code OAuth (browser + passkey)
 paybox login --key pbx_live_…             # personal API key instead (no OAuth)
-PAYBOX_SIGNING_KEY=pbxk1.… paybox login   # supply the signing key non-interactively
+paybox connect                            # pair a signing key
+PAYBOX_SIGNING_KEY=pbxk1.… paybox …       # headless: reuse an already-paired key
 
 paybox credentials                        # list usable credentials
 # `--credential <id>` below is the `credential.id` from that list, not the wallet name.
@@ -150,6 +150,37 @@ macOS/Linux). On Windows the POSIX mode bits don't restrict access — the file
 is not access-protected there, so prefer `PAYBOX_API_KEY` / `PAYBOX_SIGNING_KEY`
 env vars on shared Windows machines.
 
+## Headless and CI
+
+Pairing needs a human to confirm the code, so CI cannot pair at run time. Pair
+once ahead of time **as the identity CI will use**, then carry both secrets:
+
+```bash
+# On a laptop. The pbx_live_ key comes from the PayBox app (Agents → create an
+# agent, pick its wallets); it is shown once.
+paybox login --key pbx_live_…      # authenticate as the client CI will use
+paybox connect                     # pick the code; approve on any device
+grep signingKey ~/.config/paybox/config.json
+```
+
+```yaml
+env:
+  PAYBOX_API_KEY: ${{ secrets.PAYBOX_API_KEY }}          # pbx_live_…
+  PAYBOX_SIGNING_KEY: ${{ secrets.PAYBOX_SIGNING_KEY }}  # pbxk1.…
+```
+
+`PayboxClient.fromConfig()` reads both from the environment, so the runner needs
+no config file, no browser, and no TTY.
+
+Those two secrets are a **matched pair**: a signer is bound to the client that
+paired it. Present a `pbxk1.` to a different client — including the throwaway
+client that a plain `paybox login` registers — and signing fails with `agent
+signer belongs to another client`. It reads like a revocation but means you
+paired under a different identity. Rotating the API key mints a new client, so
+re-pair after rotation — `paybox login` drops the stored key when it does this
+and tells you to run `paybox connect`, rather than leaving one that cannot
+sign.
+
 ## Develop
 
 `pnpm-lock.yaml` also contains the `../mcp-app` importer because this SDK

package/SKILL.md

@@ -28,12 +28,16 @@ When the user says "install PayBox" and you are Muse, Grok Bot, or running on a
 computer, start here immediately.
 
 The user asks to install PayBox. Two things need them: they approve wallet
-access with a passkey, and they paste one signing key. Everything else is yours,
-and they should not see it happen.
+access with a passkey, and they confirm one emoji code. Everything else is
+yours, and they should not see it happen.
+
+No secret ever passes through chat. The signing key is generated on the machine
+running the CLI and stays there; what you show the user is an eight-emoji code
+derived from its public half, which is safe to put in a transcript.
 
 ## Muse
 
-On Muse this section wins over Grok Bot phone-app and masked-field rules below.
+On Muse this section wins over the Grok Bot phone-app rules below.
 Prod is `https://api.paybox.sh` / `https://app.paybox.sh`. Stay quiet until they
 say install PayBox / install paybox / Install Paybox. English. Few words. No
 secret dumps. No invented click paths.
@@ -59,14 +63,12 @@ markdown pill with no "tap this" line is a failed take.
    (Safari or Chrome), not the native PayBox app and not inside Muse.
    You do not open the URL. Poll until OAuth is live. Do not end the
    turn while polling.
-2. When OAuth is live and the signing key is missing, send **Tap
-   [Provision agent key](https://app.paybox.sh/agent-key?client_id=<cid>)
-   on your phone browser.** Then this exact line: **Muse does not have a
-   secure field for the signing key yet; the team is working on it. For
-   now paste the pbxk1 here and rotate it after.** `cid` is the
-   access-token UUID, never `oauth.clientId`. Muse has no masked field.
-   Write `signingKey` into an isolated config. Never `login --signing-key`
-   on argv. Never echo the key.
+2. When OAuth is live and the signing key is missing, run `paybox connect`
+   and send **one** message: **Tap [Connect signing key](url) on your phone
+   browser and pick this code**, plus the eight emoji the CLI printed. Use
+   the URL and the code exactly as `connect` printed them — do not build
+   the URL yourself. Then poll; `connect` returns once they pick it. Do not
+   ask for the key, and do not ask them to come back to chat.
 
 Ready only when OAuth or an API key is live **and** `canSign` is true. Then
 Welcome to PayBox with two buttons: **Swap 20 USDC to SOL**, **Pay a Solana
@@ -79,7 +81,8 @@ visible, point only there. If MCP is already Connected under Manage your MCP
 servers, use that grant — still no Add custom story.
 
 Install the CLI only when this host still needs device-code:
-`npm install -g @paybox-sh/sdk@latest`, then `paybox --json version` (0.8.5+).
+`npm install -g @paybox-sh/sdk@latest`, then `paybox --json version` (2.0.0+;
+older builds pair no signing key and ask for a paste instead).
 Fresh `PAYBOX_CONFIG_DIR`. Unset `PAYBOX_API_URL` `PAYBOX_API_KEY`
 `PAYBOX_SIGNING_KEY` `PAYBOX_ACCESS_TOKEN`.
 
@@ -143,8 +146,7 @@ is not on the user's machine, that local open is useless or invisible, and your
 message is the only way they reach the page.
 
 On Grok Bot, Authorize wallets should open the PayBox app. That is the
-correct path there. After they tap Connect CLI, the app opens Generate a
-signing key by itself. Do not tell them to come back to chat first. On Muse
+correct path there. Do not tell them to come back to chat first. On Muse
 use the Muse section: phone browser, not the native app, not inside Muse.
 
 Then wait. The poll is the continue signal. Do not ask the user to type `done`,
@@ -154,46 +156,47 @@ one rather than reusing the old link.
 
 A `clientId` already on disk when this `paybox login` starts is the previous
 client. Ignore it. `login` registers a new client and only writes `oauth` after
-the poll succeeds. If you restart login for a fresh code, drop any signing-key
-link you already sent.
-
-After **this** login writes `oauth` (or prints `/agent-key?client_id=`), send
-the signing-key controls. Prefer that printed URL. If stderr never printed it
-but this run did save `oauth`, build
-`https://app.paybox.sh/agent-key?client_id=<cid>` from the `cid` claim on the
-access token this login just wrote. Never use `oauth.clientId`, a `pbx-oauth-`
-id, or a `clientId` that was already in `config.json` when the command started.
-Those are the OAuth registration, not the vault agent. `/agent-key` will say
-the agent was not found. Do not wait for a dropped Windows executor to
-reconnect before they see the box. Merge the key when the machine is back;
-showing the box does not need that machine.
-
-### Step 2 — Paste the signing key
-
-The moment **this** login has an agent-key URL (stderr, or `cid` from the oauth
-it just saved), put **Generate Signing Key** in chat as that link plus a
-**masked input** for the `pbxk1.` value, in the same turn. Seconds after they
-finish Authorize wallets, not minutes. That chat link must use the JWT `cid`.
-On Grok Bot it must open the PayBox app on the first tap, the same way
-Authorize wallets does. On Muse tell them to tap the link, then say Muse does
-not have a secure field for the signing key yet; the team is working
-on it. For now paste the pbxk1 here and rotate it after. There is no
-masked field. The link opens in the phone browser. Do not `Start-Process`, `open`, `rundll32`, or `xdg-open` the authorize,
-connect, or agent-key URL yourself. Write what they give you to login's
-prompt stdin when that prompt is alive. If login is wedged after this oauth
-write, keep the box on screen and merge `signingKey` when the host can write
-files again.
-
-Pass it through the prompt, or set `PAYBOX_SIGNING_KEY` before running `login`
-when nothing is attached to stdin. Never pass it as `login --signing-key <value>`
-on the command line: an argument lands in shell history and is visible to anyone
-who can list processes.
-
-Do not ask the user to click a signing-key URL that never arrived. Do not open
-the page twice. Do not hold the box until login narrates success.
-
-Wallet signing is non-custodial: the key stays on the user's machine and PayBox
-never holds it. Never print, log, or echo it.
+the poll succeeds. If you restart login for a fresh code, drop any pairing link
+and code you already sent — a pairing is bound to the client that started it.
+
+### Step 2 — Confirm the pairing code
+
+Run `paybox connect` as soon as `login` returns — it does not pair for you.
+Run it again any time the key is missing later. The CLI prints eight emoji and
+a link to stderr:
+
+```
+  🍕 🎸 🦊 🚀 🌵 🥁 🐙 🪐
+Open this on any device and pick that code to connect this machine:
+  https://app.paybox.sh/agent-key?client_id=…&pairing_id=…
+```
+
+Relay both in one message, seconds after they finish Authorize wallets, not
+minutes: the link plus that exact code. PayBox shows three codes and they pick
+yours. Use the printed URL verbatim — it carries the `pairing_id`, and the
+`client_id` comes from the server, so there is no id for you to choose. On Grok
+Bot the link must open the PayBox app on the first tap, the same way Authorize
+wallets does. On Muse tell them to tap it in the phone browser.
+
+Do not `Start-Process`, `open`, `rundll32`, or `xdg-open` the authorize,
+connect, or agent-key URL yourself. Then wait — `connect` polls and returns on
+its own. Do not ask the user to type `done`, do not send the link twice, and do
+not re-run `connect` while one is still polling; a second pairing invalidates
+the code they are looking at.
+
+Never ask the user for the key itself, and never accept one if they offer it —
+there is no step in this flow that needs it. The emoji code is safe to send;
+a `pbxk1.` value is not. Wallet signing is non-custodial: the key is generated
+on the user's machine and stays there, and PayBox never holds it.
+
+`PAYBOX_SIGNING_KEY` exists for headless runs that reuse a key paired earlier
+on another machine. It is not part of this flow, and there is no flag that
+takes a key on the command line — an argument would land in shell history and
+be visible to anyone who can list processes.
+
+`login` clears any stored signing key, because it registers a new client and a
+key paired to the previous one cannot sign. That is why pairing follows login
+rather than preceding it.
 
 ### Step 3 — Confirm
 
@@ -201,8 +204,9 @@ never holds it. Never print, log, or echo it.
 paybox --json whoami
 ```
 
-`canSign` must be `true`. If it is `false` the key did not save; redo step 2
-rather than continuing, because signing and swaps will fail without it.
+`canSign` must be `true`. If it is `false` the pairing did not complete; run
+`paybox connect` again for a fresh code rather than continuing, because signing
+and swaps will fail without it.
 
 ## What the user sees
 
@@ -212,12 +216,10 @@ this order:
 1. The **Authorize wallets** link plus the code. On Muse, the line says
    to tap that link on the phone browser. Grok Bot can omit that; it
    opens the link itself.
-2. **Generate Signing Key** plus the signing-key control, as soon as
-   **this** login prints `/agent-key?client_id=` or writes a new `oauth`.
-   Grok Bot: masked `pbxk1.` field. Muse: tell them to tap Provision
-   agent key on the phone browser, then: Muse does not have a secure
-   field for the signing key yet; the team is working on it. For now
-   paste the pbxk1 here and rotate it after.
+2. **Connect signing key** — the link `connect` printed, plus the eight
+   emoji, as soon as it prints them. Same on both hosts; there is no
+   input field and nothing for them to send back. Grok Bot opens the
+   link itself; on Muse tell them to tap it in the phone browser.
 
 Nothing else. No "Installing…", "Opening…", "Got it", no CLI version, package
 manager, config path, or request id, and no narration of a retry or fallback. If
@@ -326,10 +328,11 @@ Do not switch to staging. Do not report the dollar as sent.
 ## A setup that went wrong
 
 - The user had to prompt you after approving wallet access.
-- The key field waited minutes after they finished Authorize wallets.
-- The signing-key URL used `oauth.clientId`, a `pbx-oauth-` id, or a
-  `clientId` that was already on disk before this `paybox login` started.
-- The first Generate Signing Key tap said the agent was not in the vault.
+- The pairing code waited minutes after they finished Authorize wallets.
+- You rebuilt the pairing URL instead of relaying the one `connect` printed.
+- You sent a code from an earlier `connect` run, so none of the three
+  codes in PayBox matched.
+- You asked the user for the signing key, or accepted one they offered.
 - You asked the user to type `done`.
 - You opened either page twice.
 - You launched authorize, connect, or agent-key with `Start-Process` or an

package/dist/{chunk-SMPW2GUM.js → chunk-66FQ2R7G.js}

@@ -10,16 +10,6 @@ function appBaseFrom(baseUrl, override) {
   const m = baseUrl.replace(/\/+$/, "").match(/^(https?:\/\/)api\.(.+)$/);
   return m ? `${m[1]}app.${m[2]}` : null;
 }
-function agentClientId(accessToken) {
-  const payload = accessToken.split(".")[1];
-  if (!payload) return null;
-  try {
-    const claims = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
-    return claims.cid ?? null;
-  } catch {
-    return null;
-  }
-}
 async function metadata(baseUrl) {
   const url = `${baseUrl.replace(/\/+$/, "")}/.well-known/oauth-authorization-server`;
   const res = await fetch(url);
@@ -272,11 +262,17 @@ function validateHex(s, label) {
   if (!/^[0-9a-fA-F]+$/.test(body)) return `${label} must be hexadecimal`;
   return null;
 }
+function b64urlEncode(s) {
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
 function b64urlDecode(s) {
   let b = s.replace(/-/g, "+").replace(/_/g, "/");
   while (b.length % 4) b += "=";
   return atob(b);
 }
+function encodeToken(c) {
+  return TOKEN_PREFIX + b64urlEncode(JSON.stringify({ p: c.apiPubHex, s: c.apiPrivHex }));
+}
 function parseToken(input) {
   const t = input.trim();
   if (!t) return null;
@@ -842,9 +838,17 @@ var PayboxClient = class _PayboxClient {
   listCredentials() {
     return this.request("GET", "/agent/grants");
   }
+  checkOperationReadiness(args) {
+    return this.request("POST", "/agent/readiness", { body: args });
+  }
   getPortfolio(args) {
     return this.request("GET", "/agent/portfolio", {
-      query: { address: args.address, network_ids: args.networkIds }
+      query: {
+        address: args.address,
+        network_ids: args.networkIds,
+        token: args.token,
+        network_id: args.networkId != null ? String(args.networkId) : void 0
+      }
     });
   }
   verifySolanaBalance(args) {
@@ -1090,6 +1094,14 @@ var PayboxClient = class _PayboxClient {
       }
     });
   }
+  getDepositLink(args) {
+    return this.request("GET", "/agent/deposit-link", {
+      query: {
+        credential_id: args.credentialId,
+        amount_usd: args.amountUsd?.toString()
+      }
+    });
+  }
   getRequest(requestId) {
     return this.request("GET", `/agent/requests/${requestId}`);
   }
@@ -1112,7 +1124,6 @@ var PayboxClient = class _PayboxClient {
 export {
   mcpResource,
   appBaseFrom,
-  agentClientId,
   openBrowser,
   loginLoopback,
   loginDevice,
@@ -1121,9 +1132,10 @@ export {
   configFile,
   loadConfig,
   saveConfig,
+  encodeToken,
   credsFromToken,
   didNotHappen,
   PayboxError,
   PayboxClient
 };
-//# sourceMappingURL=chunk-SMPW2GUM.js.map
+//# sourceMappingURL=chunk-66FQ2R7G.js.map

package/dist/chunk-66FQ2R7G.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/auth.ts","../src/config.ts","../node_modules/.pnpm/@paybox+mcp-app@file+..+mcp-app_@modelcontextprotocol+sdk@1.29.0_zod@4.4.3__bn.js@5.2.3_ac1e09a20c76a1143611be5dd3d4f9db/node_modules/@paybox/mcp-app/src/signing/creds.ts","../node_modules/.pnpm/@paybox+mcp-app@file+..+mcp-app_@modelcontextprotocol+sdk@1.29.0_zod@4.4.3__bn.js@5.2.3_ac1e09a20c76a1143611be5dd3d4f9db/node_modules/@paybox/mcp-app/src/signing/sign.ts","../src/signer.ts","../src/mcp.ts","../src/client.ts"],"sourcesContent":["\nimport { spawn } from \"node:child_process\";\nimport { createHash, randomBytes } from \"node:crypto\";\nimport { createServer } from \"node:http\";\nimport type { AddressInfo } from \"node:net\";\n\nimport type { OAuthTokens } from \"./config.js\";\n\nexport function mcpResource(baseUrl: string): string {\n  return `${baseUrl.replace(/\\/+$/, \"\")}/mcp`;\n}\n\nexport function appBaseFrom(baseUrl: string, override?: string): string | null {\n  if (override) return override.replace(/\\/+$/, \"\");\n  const m = baseUrl.replace(/\\/+$/, \"\").match(/^(https?:\\/\\/)api\\.(.+)$/);\n  return m ? `${m[1]}app.${m[2]}` : null;\n}\n\nexport function agentClientId(accessToken: string): string | null {\n  const payload = accessToken.split(\".\")[1];\n  if (!payload) return null;\n  try {\n    const claims = JSON.parse(Buffer.from(payload, \"base64url\").toString(\"utf8\")) as {\n      cid?: string;\n    };\n    return claims.cid ?? null;\n  } catch {\n    return null;\n  }\n}\n\ninterface AsMetadata {\n  registration_endpoint: string;\n  authorization_endpoint: string;\n  token_endpoint: string;\n  device_authorization_endpoint?: string;\n}\n\nasync function metadata(baseUrl: string): Promise<AsMetadata> {\n  const url = `${baseUrl.replace(/\\/+$/, \"\")}/.well-known/oauth-authorization-server`;\n  const res = await fetch(url);\n  if (!res.ok) {\n    throw new Error(`could not read OAuth metadata from ${url} (${res.status})`);\n  }\n  return (await res.json()) as AsMetadata;\n}\n\nfunction base64url(b: Buffer): string {\n  return b.toString(\"base64url\");\n}\n\nfunction pkce(): { verifier: string; challenge: string } {\n  const verifier = base64url(randomBytes(32));\n  const challenge = base64url(createHash(\"sha256\").update(verifier).digest());\n  return { verifier, challenge };\n}\n\nexport function openBrowser(url: string): void {\n  const [cmd, args] =\n    process.platform === \"darwin\"\n      ? ([\"open\", [url]] as const)\n      : process.platform === \"win32\"\n        ? ([\"rundll32\", [\"url.dll,FileProtocolHandler\", url]] as const)\n        : ([\"xdg-open\", [url]] as const);\n  try {\n    spawn(cmd, [...args], { stdio: \"ignore\", detached: true }).unref();\n  } catch {\n  }\n}\n\nconst CALLBACK_PAGE =\n  \"<!doctype html><meta charset=utf-8><title>PayBox</title>\" +\n  \"<body style=\\\"font:16px system-ui;padding:3rem;text-align:center\\\">\" +\n  \"<h2>PayBox CLI connected</h2><p>You can close this tab and return to the terminal.</p>\";\n\nexport interface LoginOptions {\n  scope?: string;\n  clientName?: string;\n  log?: (msg: string) => void;\n  timeoutMs?: number;\n}\n\nexport async function loginLoopback(\n  baseUrl: string,\n  opts: LoginOptions = {},\n): Promise<OAuthTokens> {\n  const scope = opts.scope ?? \"mcp offline_access\";\n  const clientName = opts.clientName ?? \"PayBox CLI\";\n  const log = opts.log ?? ((m: string) => console.error(m));\n  const meta = await metadata(baseUrl);\n  const resource = mcpResource(baseUrl);\n\n  let resolveCode: (v: { code: string; state: string | null }) => void;\n  let rejectCode: (e: Error) => void;\n  const codePromise = new Promise<{ code: string; state: string | null }>((res, rej) => {\n    resolveCode = res;\n    rejectCode = rej;\n  });\n\n  const server = createServer((req, res) => {\n    const u = new URL(req.url ?? \"/\", \"http://127.0.0.1\");\n    if (u.pathname !== \"/callback\") {\n      res.writeHead(404).end();\n      return;\n    }\n    res.writeHead(200, { \"content-type\": \"text/html\" }).end(CALLBACK_PAGE);\n    const code = u.searchParams.get(\"code\");\n    if (code) resolveCode({ code, state: u.searchParams.get(\"state\") });\n    else rejectCode(new Error(u.searchParams.get(\"error\") ?? \"authorization failed\"));\n  });\n  await new Promise<void>((r) => server.listen(0, \"127.0.0.1\", r));\n  const port = (server.address() as AddressInfo).port;\n  const redirectUri = `http://127.0.0.1:${port}/callback`;\n\n  const timeoutMs = opts.timeoutMs ?? 300_000;\n  const timer = setTimeout(\n    () => rejectCode(new Error(`login timed out after ${Math.round(timeoutMs / 1000)}s — no approval received`)),\n    timeoutMs,\n  );\n  timer.unref();\n\n  try {\n    const reg = await fetch(meta.registration_endpoint, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/json\" },\n      body: JSON.stringify({\n        client_name: clientName,\n        redirect_uris: [redirectUri],\n        token_endpoint_auth_method: \"none\",\n        grant_types: [\"authorization_code\", \"refresh_token\"],\n        response_types: [\"code\"],\n      }),\n    });\n    if (!reg.ok) throw new Error(`client registration failed (${reg.status}): ${await reg.text()}`);\n    const { client_id: clientId } = (await reg.json()) as { client_id: string };\n\n    const { verifier, challenge } = pkce();\n    const state = base64url(randomBytes(16));\n    const authUrl =\n      `${meta.authorization_endpoint}?response_type=code` +\n      `&client_id=${encodeURIComponent(clientId)}` +\n      `&redirect_uri=${encodeURIComponent(redirectUri)}` +\n      `&code_challenge=${challenge}&code_challenge_method=S256` +\n      `&scope=${encodeURIComponent(scope)}` +\n      `&state=${state}&resource=${encodeURIComponent(resource)}`;\n\n    log(`Opening your browser to approve access:\\n  ${authUrl}\\n`);\n    openBrowser(authUrl);\n\n    const { code, state: returnedState } = await codePromise;\n    if (returnedState !== state) throw new Error(\"OAuth state mismatch — aborting\");\n\n    const form = new URLSearchParams({\n      grant_type: \"authorization_code\",\n      code,\n      redirect_uri: redirectUri,\n      client_id: clientId,\n      code_verifier: verifier,\n      resource,\n    });\n    const tok = await fetch(meta.token_endpoint, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n      body: form,\n    });\n    if (!tok.ok) throw new Error(`token exchange failed (${tok.status}): ${await tok.text()}`);\n    const t = (await tok.json()) as {\n      access_token: string;\n      refresh_token?: string;\n      expires_in?: number;\n    };\n    return {\n      clientId,\n      accessToken: t.access_token,\n      refreshToken: t.refresh_token,\n      expiresAt: t.expires_in ? Date.now() + t.expires_in * 1000 : undefined,\n      resource,\n    };\n  } finally {\n    clearTimeout(timer);\n    server.close();\n  }\n}\n\nexport async function loginDevice(\n  baseUrl: string,\n  opts: LoginOptions = {},\n): Promise<OAuthTokens> {\n  const scope = opts.scope ?? \"mcp offline_access\";\n  const clientName = opts.clientName ?? \"PayBox CLI\";\n  const log = opts.log ?? ((m: string) => console.error(m));\n  const meta = await metadata(baseUrl);\n  if (!meta.device_authorization_endpoint) {\n    throw new Error(\n      \"this PayBox API does not advertise device_authorization_endpoint — upgrade the API and retry `paybox login`\",\n    );\n  }\n  const resource = mcpResource(baseUrl);\n\n  const reg = await fetch(meta.registration_endpoint, {\n    method: \"POST\",\n    headers: { \"content-type\": \"application/json\" },\n    body: JSON.stringify({\n      client_name: clientName,\n      redirect_uris: [\"http://127.0.0.1/device\"],\n      token_endpoint_auth_method: \"none\",\n      grant_types: [\"urn:ietf:params:oauth:grant-type:device_code\", \"refresh_token\"],\n      response_types: [\"code\"],\n      scope,\n    }),\n  });\n  if (!reg.ok) throw new Error(`client registration failed (${reg.status}): ${await reg.text()}`);\n  const { client_id: clientId } = (await reg.json()) as { client_id: string };\n\n  const started = await fetch(meta.device_authorization_endpoint, {\n    method: \"POST\",\n    headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n    body: new URLSearchParams({ client_id: clientId, scope, resource }),\n  });\n  if (!started.ok) {\n    throw new Error(`device authorization failed (${started.status}): ${await started.text()}`);\n  }\n  const da = (await started.json()) as {\n    device_code: string;\n    user_code: string;\n    verification_uri: string;\n    verification_uri_complete: string;\n    expires_in: number;\n    interval?: number;\n  };\n\n  log(\n    `Open this URL on your phone (or this computer) to approve access:\\n  ${da.verification_uri_complete}\\n` +\n      `Code: ${da.user_code}\\n`,\n  );\n  openBrowser(da.verification_uri_complete);\n\n  const timeoutMs = opts.timeoutMs ?? da.expires_in * 1000;\n  const deadline = Date.now() + timeoutMs;\n  let intervalSec = da.interval && da.interval > 0 ? da.interval : 5;\n\n  while (Date.now() < deadline) {\n    await new Promise((r) => setTimeout(r, intervalSec * 1000));\n    const tok = await fetch(meta.token_endpoint, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n      body: new URLSearchParams({\n        grant_type: \"urn:ietf:params:oauth:grant-type:device_code\",\n        device_code: da.device_code,\n        client_id: clientId,\n      }),\n    });\n    const raw = await tok.text();\n    if (tok.ok) {\n      const t = JSON.parse(raw) as {\n        access_token: string;\n        refresh_token?: string;\n        expires_in?: number;\n      };\n      return {\n        clientId,\n        accessToken: t.access_token,\n        refreshToken: t.refresh_token,\n        expiresAt: t.expires_in ? Date.now() + t.expires_in * 1000 : undefined,\n        resource,\n      };\n    }\n    let err = raw || \"authorization failed\";\n    let code = \"\";\n    try {\n      const body = JSON.parse(raw) as { error?: string; error_description?: string };\n      code = body.error ?? \"\";\n      err = body.error_description ?? body.error ?? err;\n    } catch {\n    }\n    if (code === \"authorization_pending\") continue;\n    if (code === \"slow_down\") {\n      intervalSec += 5;\n      continue;\n    }\n    throw new Error(err);\n  }\n  throw new Error(`login timed out after ${Math.round(timeoutMs / 1000)}s — no approval received`);\n}\n\nexport async function refreshTokens(baseUrl: string, current: OAuthTokens): Promise<OAuthTokens> {\n  if (!current.refreshToken) throw new Error(\"no refresh token — run `paybox login` again\");\n  const meta = await metadata(baseUrl);\n  const resource = current.resource ?? mcpResource(baseUrl);\n  const form = new URLSearchParams({\n    grant_type: \"refresh_token\",\n    refresh_token: current.refreshToken,\n    client_id: current.clientId,\n    resource,\n  });\n  const res = await fetch(meta.token_endpoint, {\n    method: \"POST\",\n    headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n    body: form,\n  });\n  if (!res.ok) throw new Error(`token refresh failed (${res.status}): ${await res.text()}`);\n  const t = (await res.json()) as {\n    access_token: string;\n    refresh_token?: string;\n    expires_in?: number;\n  };\n  return {\n    ...current,\n    accessToken: t.access_token,\n    refreshToken: t.refresh_token ?? current.refreshToken,\n    expiresAt: t.expires_in ? Date.now() + t.expires_in * 1000 : undefined,\n    resource,\n  };\n}\n","\nimport { chmodSync, mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { join } from \"node:path\";\n\nexport interface OAuthTokens {\n  clientId: string;\n  accessToken: string;\n  refreshToken?: string;\n  expiresAt?: number;\n  resource: string;\n}\n\nexport interface StoredConfig {\n  baseUrl?: string;\n  appUrl?: string;\n  apiKey?: string;\n  oauth?: OAuthTokens;\n  signingKey?: string;\n}\n\nexport function configDir(): string {\n  if (process.env.PAYBOX_CONFIG_DIR) return process.env.PAYBOX_CONFIG_DIR;\n  const base = process.env.XDG_CONFIG_HOME ?? join(homedir(), \".config\");\n  return join(base, \"paybox\");\n}\n\nexport function configFile(): string {\n  return join(configDir(), \"config.json\");\n}\n\nexport function loadConfig(): StoredConfig {\n  try {\n    return JSON.parse(readFileSync(configFile(), \"utf8\")) as StoredConfig;\n  } catch {\n    return {};\n  }\n}\n\nexport function saveConfig(config: StoredConfig): void {\n  mkdirSync(configDir(), { recursive: true, mode: 0o700 });\n  writeFileSync(configFile(), `${JSON.stringify(config, null, 2)}\\n`, { mode: 0o600 });\n  if (process.platform !== \"win32\") chmodSync(configFile(), 0o600);\n}\n","\nconst STORAGE_KEY = \"paybox.walletSign.creds.v2\";\n\nexport const TOKEN_PREFIX = \"pbxk1.\";\n\nexport interface Creds {\n  apiPubHex: string;\n  apiPrivHex: string;\n  savedAt: number;\n}\n\nlet sessionCreds: Creds | null = null;\nlet sessionDecided = false;\nconst listeners = new Set<() => void>();\n\nexport function subscribe(listener: () => void): () => void {\n  listeners.add(listener);\n  return () => { listeners.delete(listener); };\n}\n\nfunction notify(): void { queueMicrotask(() => listeners.forEach(listener => listener())); }\n\nexport function hasStorage(): boolean {\n  try {\n    const probe = \"__paybox_probe__\";\n    window.localStorage.setItem(probe, \"1\");\n    window.localStorage.removeItem(probe);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nexport function load(): Creds | null {\n  if (sessionDecided) return sessionCreds;\n  try {\n    const raw = window.localStorage.getItem(STORAGE_KEY);\n    if (raw) {\n      const parsed = JSON.parse(raw) as Partial<Creds>;\n      if (\n        typeof parsed.apiPubHex === \"string\" &&\n        typeof parsed.apiPrivHex === \"string\" &&\n        parsed.apiPubHex &&\n        parsed.apiPrivHex\n      ) {\n        return {\n          apiPubHex: parsed.apiPubHex,\n          apiPrivHex: parsed.apiPrivHex,\n          savedAt: typeof parsed.savedAt === \"number\" ? parsed.savedAt : 0,\n        };\n      }\n    }\n  } catch {\n  }\n  return null;\n}\n\nexport function save(c: Omit<Creds, \"savedAt\"> & { savedAt?: number }): void {\n  const toStore: Creds = {\n    apiPubHex: c.apiPubHex,\n    apiPrivHex: c.apiPrivHex,\n    savedAt: c.savedAt ?? Date.now(),\n  };\n  sessionCreds = toStore;\n  sessionDecided = true;\n  try {\n    window.localStorage.setItem(STORAGE_KEY, JSON.stringify(toStore));\n  } catch {\n  }\n  notify();\n}\n\nexport function clear(): void {\n  sessionCreds = null;\n  sessionDecided = true;\n  try {\n    window.localStorage.removeItem(STORAGE_KEY);\n  } catch {\n  }\n  notify();\n}\n\nexport function validateHex(s: string, label: string): string | null {\n  const trimmed = s.trim();\n  if (!trimmed) return `${label} is required`;\n  const body = trimmed.startsWith(\"0x\") || trimmed.startsWith(\"0X\") ? trimmed.slice(2) : trimmed;\n  if (body.length === 0) return `${label} is empty`;\n  if (body.length % 2 !== 0) return `${label} must have an even number of hex digits`;\n  if (!/^[0-9a-fA-F]+$/.test(body)) return `${label} must be hexadecimal`;\n  return null;\n}\n\nfunction b64urlEncode(s: string): string {\n  return btoa(s).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\nfunction b64urlDecode(s: string): string {\n  let b = s.replace(/-/g, \"+\").replace(/_/g, \"/\");\n  while (b.length % 4) b += \"=\";\n  return atob(b);\n}\n\nexport function encodeToken(c: { apiPubHex: string; apiPrivHex: string }): string {\n  return TOKEN_PREFIX + b64urlEncode(JSON.stringify({ p: c.apiPubHex, s: c.apiPrivHex }));\n}\n\nexport function parseToken(input: string): { apiPubHex: string; apiPrivHex: string } | null {\n  const t = input.trim();\n  if (!t) return null;\n  const body = t.startsWith(TOKEN_PREFIX) ? t.slice(TOKEN_PREFIX.length) : t;\n  let obj: unknown;\n  try {\n    obj = JSON.parse(b64urlDecode(body));\n  } catch {\n    return null;\n  }\n  if (!obj || typeof obj !== \"object\") return null;\n  const o = obj as Record<string, unknown>;\n  const apiPubHex = String(o.p ?? o.apiPubHex ?? \"\").trim();\n  const apiPrivHex = String(o.s ?? o.apiPrivHex ?? \"\").trim();\n  if (!apiPubHex || !apiPrivHex) return null;\n  if (validateHex(apiPubHex, \"key\") || validateHex(apiPrivHex, \"key\")) return null;\n  return { apiPubHex, apiPrivHex };\n}\n","\nimport { Buffer } from \"buffer\";\nimport nacl from \"tweetnacl\";\nimport { MoonXEvmSigner, EvmSchemeMismatchError } from \"@moon-x/evm-adapter\";\nimport { MoonXSolanaSigner, SolanaSchemeMismatchError } from \"@moon-x/solana-adapter\";\nimport { Transaction, VersionedTransaction } from \"@solana/web3.js\";\nimport { hashTypedData, keccak256, serializeTransaction } from \"viem\";\nimport type {\n  Authorization,\n  TransactionSerializable,\n  TypedDataDefinition,\n} from \"viem\";\n\nimport type { Creds } from \"./creds.js\";\n\nexport interface WireTx {\n  to: `0x${string}`;\n  value?: string | number | bigint;\n  data?: `0x${string}`;\n  chainId: number;\n  gas?: string | number | bigint;\n  maxPriorityFeePerGas?: string | number | bigint;\n  maxFeePerGas?: string | number | bigint;\n  nonce: number;\n}\n\nexport function parseWireU128(value: unknown, field: string): bigint {\n  if (value === undefined || value === null) {\n    throw new Error(`transaction is missing ${field}`);\n  }\n  if (typeof value === \"bigint\") {\n    if (value < 0n) {\n      throw new Error(`transaction field ${field} must be a non-negative integer`);\n    }\n    return value;\n  }\n  if (typeof value === \"number\") {\n    if (!Number.isSafeInteger(value) || value < 0) {\n      throw new Error(`transaction field ${field} must be a non-negative integer`);\n    }\n    return BigInt(value);\n  }\n  if (typeof value === \"string\") {\n    const trimmed = value.trim();\n    if (!trimmed) {\n      throw new Error(`transaction field ${field} is empty`);\n    }\n    if (/^0[xX][0-9a-fA-F]+$/.test(trimmed)) {\n      return BigInt(trimmed);\n    }\n    if (!/^\\d+$/.test(trimmed)) {\n      throw new Error(`transaction field ${field} is not a valid integer`);\n    }\n    return BigInt(trimmed);\n  }\n  throw new Error(`transaction field ${field} has an invalid type`);\n}\n\nexport type SignIntent =\n  | { op: \"message\"; message: string }\n  | { op: \"typedData\"; typedData: TypedDataDefinition }\n  | { op: \"transaction\"; transaction: WireTx }\n  | { op: \"authorization\"; authorization: Authorization }\n  | { op: \"solanaMessage\"; address: string; message: string }\n  | { op: \"solanaTransaction\"; address: string; transactionBase64: string }\n  | { op: \"raw\"; rawSigningPayloadHex: string };\n\nexport interface WalletBinding {\n  walletId: string;\n  keyId: string;\n  derivationPath: string;\n}\n\nexport interface MoonxSignResult {\n  scheme: string;\n  signature: {\n    r?: string;\n    s?: string;\n    recovery_id?: number;\n    signature?: string;\n  };\n}\n\nexport type MoonxSignTransport = (envelope: {\n  signed_body: string;\n  agent_signature: string;\n}) => Promise<MoonxSignResult>;\n\nexport type SignArtifactResult =\n  | { ok: true; artifact: Record<string, unknown> }\n  | { ok: false; error: string };\n\nfunction reviveTx(w: WireTx): TransactionSerializable {\n  if (typeof w !== \"object\" || w === null || Array.isArray(w)) {\n    throw new Error(\"transaction must be an object, not a JSON-encoded string\");\n  }\n  return {\n    type: \"eip1559\",\n    to: w.to,\n    value: parseWireU128(w.value ?? \"0\", \"value\"),\n    data: w.data,\n    chainId: w.chainId,\n    gas: parseWireU128(w.gas, \"gas\"),\n    maxPriorityFeePerGas: parseWireU128(w.maxPriorityFeePerGas, \"maxPriorityFeePerGas\"),\n    maxFeePerGas: parseWireU128(w.maxFeePerGas, \"maxFeePerGas\"),\n    nonce: w.nonce,\n  };\n}\n\nfunction hexToBytes(hex: string): Uint8Array {\n  return new Uint8Array(Buffer.from(hex.replace(/^0x/, \"\"), \"hex\"));\n}\nfunction bytesToHex(bytes: Uint8Array): string {\n  return Buffer.from(bytes).toString(\"hex\");\n}\n\nfunction buildEnvelope(\n  rawSigningPayloadHex: string,\n  binding: WalletBinding,\n  creds: Creds,\n): { signed_body: string; agent_signature: string } {\n  const signedPayload = {\n    raw_signing_payload: rawSigningPayloadHex.replace(/^0x/, \"\").toLowerCase(),\n    key_id: binding.keyId,\n    derivation_path: binding.derivationPath,\n    issued_at: new Date().toISOString(),\n  };\n  const signedBodyBytes = new TextEncoder().encode(JSON.stringify(signedPayload));\n  const keyPair = nacl.sign.keyPair.fromSeed(hexToBytes(creds.apiPrivHex));\n  const agentSig = nacl.sign.detached(signedBodyBytes, keyPair.secretKey);\n  return {\n    signed_body: bytesToHex(signedBodyBytes),\n    agent_signature: bytesToHex(agentSig),\n  };\n}\n\nexport function eip1559SigningHash(tx: WireTx): `0x${string}` {\n  return keccak256(serializeTransaction(reviveTx(tx)));\n}\n\nexport function solanaSigningPayload(base64Tx: string): string {\n  const raw = Buffer.from(base64Tx, \"base64\");\n  let i = 0;\n  let sigCount = 0;\n  let shift = 0;\n  for (;;) {\n    const b = raw[i++];\n    sigCount |= (b & 0x7f) << shift;\n    if ((b & 0x80) === 0) break;\n    shift += 7;\n  }\n  if (sigCount < 1) {\n    throw new Error(\"solana tx has no signature slots\");\n  }\n  return bytesToHex(new Uint8Array(raw.subarray(i + sigCount * 64)));\n}\n\nexport function deserializeSolanaTx(base64Tx: string): Transaction | VersionedTransaction {\n  const raw = Buffer.from(base64Tx, \"base64\");\n  try {\n    return Transaction.from(raw);\n  } catch {\n    return VersionedTransaction.deserialize(new Uint8Array(raw));\n  }\n}\n\nexport interface TxEnvelope {\n  api_pub: string;\n  signed_body: string;\n  agent_signature: string;\n}\n\nexport interface PlanTx {\n  vm?: string;\n  transaction: WireTx | string;\n}\n\nexport function buildSwapEnvelopes(\n  txs: PlanTx[],\n  binding: WalletBinding,\n  creds: Creds,\n): TxEnvelope[] {\n  if (!binding.walletId) {\n    throw new Error(\"PayBox did not supply a wallet id for this operation.\");\n  }\n  if (!binding.keyId || !binding.derivationPath) {\n    throw new Error(\n      \"This wallet isn't provisioned for signing yet (missing key binding). \" +\n        \"Re-provision it in the PayBox app, then retry.\",\n    );\n  }\n  return txs.map((t) => {\n    const payload =\n      t.vm === \"solana\"\n        ? solanaSigningPayload(t.transaction as string)\n        : eip1559SigningHash(t.transaction as WireTx);\n    const { signed_body, agent_signature } = buildEnvelope(payload, binding, creds);\n    return { api_pub: creds.apiPubHex, signed_body, agent_signature };\n  });\n}\n\nexport function eip712SigningHash(typedData: TypedDataDefinition): `0x${string}` {\n  return hashTypedData(typedData);\n}\n\nexport function buildX402Envelope(\n  typedData: TypedDataDefinition,\n  binding: WalletBinding,\n  creds: Creds,\n): TxEnvelope {\n  if (!binding.walletId) {\n    throw new Error(\"PayBox did not supply a wallet id for this payment.\");\n  }\n  if (!binding.keyId || !binding.derivationPath) {\n    throw new Error(\n      \"This wallet isn't provisioned for signing yet (missing key binding). \" +\n        \"Re-provision it in the PayBox app, then retry.\",\n    );\n  }\n  const { signed_body, agent_signature } = buildEnvelope(\n    eip712SigningHash(typedData),\n    binding,\n    creds,\n  );\n  return { api_pub: creds.apiPubHex, signed_body, agent_signature };\n}\n\nexport function buildX402SolanaEnvelope(\n  transactionBase64: string,\n  binding: WalletBinding,\n  creds: Creds,\n): TxEnvelope {\n  if (!binding.walletId) {\n    throw new Error(\"PayBox did not supply a wallet id for this payment.\");\n  }\n  if (!binding.keyId || !binding.derivationPath) {\n    throw new Error(\n      \"This wallet isn't provisioned for signing yet (missing key binding). \" +\n        \"Re-provision it in the PayBox app, then retry.\",\n    );\n  }\n  const { signed_body, agent_signature } = buildEnvelope(\n    solanaSigningPayload(transactionBase64),\n    binding,\n    creds,\n  );\n  return { api_pub: creds.apiPubHex, signed_body, agent_signature };\n}\n\nexport interface GaslessDigest {\n  kind: \"userOp\" | \"authorization\";\n  rawPayloadHex: string;\n}\n\nexport function buildGaslessEnvelopes(\n  digests: GaslessDigest[],\n  binding: WalletBinding,\n  creds: Creds,\n): TxEnvelope[] {\n  if (digests.length === 0) {\n    throw new Error(\"gasless prepared calls have no signing items.\");\n  }\n  if (!binding.walletId) {\n    throw new Error(\"PayBox did not supply a wallet id for this operation.\");\n  }\n  if (!binding.keyId || !binding.derivationPath) {\n    throw new Error(\n      \"This wallet isn't provisioned for signing yet (missing key binding). \" +\n        \"Re-provision it in the PayBox app, then retry.\",\n    );\n  }\n  return digests.map((d) => {\n    const { signed_body, agent_signature } = buildEnvelope(d.rawPayloadHex, binding, creds);\n    return { api_pub: creds.apiPubHex, signed_body, agent_signature };\n  });\n}\n\nexport type ResolveBindingTransport = (envelope: {\n  signed_body: string;\n  agent_signature: string;\n}) => Promise<{ key_id?: string; derivation_path?: string }>;\n\nexport function buildIssuedAtEnvelope(creds: Creds): {\n  signed_body: string;\n  agent_signature: string;\n} {\n  const signedBodyBytes = new TextEncoder().encode(\n    JSON.stringify({ issued_at: new Date().toISOString() }),\n  );\n  const keyPair = nacl.sign.keyPair.fromSeed(hexToBytes(creds.apiPrivHex));\n  const agentSig = nacl.sign.detached(signedBodyBytes, keyPair.secretKey);\n  return {\n    signed_body: bytesToHex(signedBodyBytes),\n    agent_signature: bytesToHex(agentSig),\n  };\n}\n\nexport async function resolveWalletBinding(\n  creds: Creds,\n  resolve: ResolveBindingTransport,\n): Promise<{ keyId: string; derivationPath: string }> {\n  const res = await resolve(buildIssuedAtEnvelope(creds));\n  if (!res.key_id || !res.derivation_path) {\n    throw new Error(\"the signing service returned no binding for this wallet\");\n  }\n  return { keyId: res.key_id, derivationPath: res.derivation_path };\n}\n\nexport async function signIntent(\n  intent: SignIntent,\n  creds: Creds,\n  binding: WalletBinding,\n  transport: MoonxSignTransport,\n): Promise<SignArtifactResult> {\n  if (!binding.walletId) {\n    return { ok: false, error: \"PayBox did not supply a wallet id for this operation.\" };\n  }\n  if (!binding.keyId || !binding.derivationPath) {\n    return {\n      ok: false,\n      error:\n        \"This wallet isn't provisioned for signing yet (missing key binding). \" +\n        \"Re-provision it in the PayBox app, then retry.\",\n    };\n  }\n\n  const ecdsaSign = async (digest: `0x${string}`) => {\n    const result = await transport(buildEnvelope(digest, binding, creds));\n    const { r, s, recovery_id } = result.signature;\n    if (r == null || s == null || recovery_id == null) {\n      throw new Error(\"the signing service returned an ECDSA result without {r, s, recovery_id}\");\n    }\n    return {\n      r: `0x${r}` as `0x${string}`,\n      s: `0x${s}` as `0x${string}`,\n      yParity: recovery_id as 0 | 1,\n    };\n  };\n  const ed25519Sign = async (message: Uint8Array) => {\n    const result = await transport(buildEnvelope(bytesToHex(message), binding, creds));\n    const sig = result.signature.signature;\n    if (!sig) throw new Error(\"the signing service returned an Ed25519 result without a signature\");\n    return hexToBytes(sig);\n  };\n\n  try {\n    switch (intent.op) {\n      case \"message\":\n        return {\n          ok: true,\n          artifact: { signature: await new MoonXEvmSigner(ecdsaSign).signMessage(intent.message) },\n        };\n      case \"typedData\":\n        return {\n          ok: true,\n          artifact: {\n            signature: await new MoonXEvmSigner(ecdsaSign).signTypedData(intent.typedData),\n          },\n        };\n      case \"transaction\":\n        return {\n          ok: true,\n          artifact: {\n            serializedTransaction: await new MoonXEvmSigner(ecdsaSign).signTransaction(\n              reviveTx(intent.transaction),\n            ),\n          },\n        };\n      case \"authorization\":\n        return {\n          ok: true,\n          artifact: {\n            authorization: await new MoonXEvmSigner(ecdsaSign).signAuthorization(\n              intent.authorization,\n            ),\n          },\n        };\n      case \"solanaMessage\": {\n        const sig = await new MoonXSolanaSigner(ed25519Sign, intent.address).signMessage(\n          intent.message,\n        );\n        return { ok: true, artifact: { signature: bytesToHex(sig) } };\n      }\n      case \"solanaTransaction\": {\n        const tx = deserializeSolanaTx(intent.transactionBase64);\n        const signed = await new MoonXSolanaSigner(ed25519Sign, intent.address).signTransaction(\n          tx,\n        );\n        return {\n          ok: true,\n          artifact: { signedTransactionBase64: Buffer.from(signed).toString(\"base64\") },\n        };\n      }\n      case \"raw\": {\n        const result = await transport(buildEnvelope(intent.rawSigningPayloadHex, binding, creds));\n        return { ok: true, artifact: { scheme: result.scheme, signature: result.signature } };\n      }\n      default:\n        return { ok: false, error: `unknown op: ${(intent as { op?: string }).op}` };\n    }\n  } catch (err) {\n    if (err instanceof EvmSchemeMismatchError || err instanceof SolanaSchemeMismatchError) {\n      return { ok: false, error: err.message };\n    }\n    const message = err instanceof Error ? err.message : String(err);\n    return { ok: false, error: message };\n  }\n}\n","\nimport { parseToken } from \"@paybox/mcp-app/creds\";\nimport type { Creds } from \"@paybox/mcp-app/creds\";\nimport {\n  buildIssuedAtEnvelope,\n  buildSwapEnvelopes,\n  buildX402Envelope,\n  buildX402SolanaEnvelope,\n  signIntent,\n} from \"@paybox/mcp-app/sign\";\nimport type {\n  MoonxSignResult,\n  SignIntent,\n  TxEnvelope,\n  WalletBinding,\n} from \"@paybox/mcp-app/sign\";\n\nimport type { BindingResponse, SwapPlan, X402Plan } from \"./types.js\";\n\nexport type Poster = (path: string, body: unknown) => Promise<unknown>;\n\nexport function credsFromToken(token: string): Creds {\n  if (token.trim().startsWith(\"pbx_live_\")) {\n    throw new Error(\n      \"invalid signing key: got a `pbx_live_` API key; expected a `pbxk1.` token (keypair only)\",\n    );\n  }\n  const kp = parseToken(token);\n  if (!kp) {\n    throw new Error(\"invalid signing key: expected a `pbxk1.` token (keypair only)\");\n  }\n  return { apiPubHex: kp.apiPubHex, apiPrivHex: kp.apiPrivHex, savedAt: Date.now() };\n}\n\nfunction toBinding(b: BindingResponse): WalletBinding {\n  return { walletId: b.wallet_id, keyId: b.key_id ?? \"\", derivationPath: b.derivation_path ?? \"\" };\n}\n\nasync function resolveBinding(\n  post: Poster,\n  requestId: string,\n  creds: Creds,\n): Promise<WalletBinding> {\n  const env = buildIssuedAtEnvelope(creds);\n  const r = (await post(`/agent/requests/${requestId}/binding`, {\n    api_pub: creds.apiPubHex,\n    signed_body: env.signed_body,\n    agent_signature: env.agent_signature,\n  })) as BindingResponse;\n  return toBinding(r);\n}\n\nexport async function signWalletRequest(\n  post: Poster,\n  requestId: string,\n  intent: SignIntent,\n  creds: Creds,\n  binding?: BindingResponse | null,\n): Promise<Record<string, unknown>> {\n  const resolved =\n    binding && binding.key_id && binding.derivation_path\n      ? toBinding(binding)\n      : await resolveBinding(post, requestId, creds);\n  const transport = (envelope: { signed_body: string; agent_signature: string }) =>\n    post(`/agent/requests/${requestId}/moonx-sign`, {\n      api_pub: creds.apiPubHex,\n      ...envelope,\n    }) as Promise<MoonxSignResult>;\n  const result = await signIntent(intent, creds, resolved, transport);\n  if (!result.ok) throw new Error(result.error);\n  await post(`/agent/requests/${requestId}/signature`, { artifact: result.artifact });\n  return result.artifact;\n}\n\nfunction isSolanaRefreshablePlan(plan: SwapPlan): boolean {\n  const txs = plan.txs as Array<{ vm?: string; kind?: string }>;\n  const solana = txs.some((t) => t.vm === \"solana\");\n  return solana && txs.some(\n    (t) => t.kind === \"swap\" || t.kind === \"prediction_trade\" || t.kind === \"jupiter_swap\",\n  );\n}\n\nasync function refreshPlan(post: Poster, requestId: string): Promise<unknown> {\n  const r = (await post(`/agent/requests/${requestId}/refresh`, {})) as { plan?: unknown };\n  if (!r || typeof r.plan !== \"object\" || r.plan === null) {\n    throw new Error(\"refresh returned no plan\");\n  }\n  return r.plan;\n}\n\nasync function refreshSwapPlan(post: Poster, requestId: string): Promise<SwapPlan> {\n  const refreshed = (await refreshPlan(post, requestId)) as SwapPlan;\n  if (!Array.isArray(refreshed.txs) || refreshed.txs.length === 0) {\n    throw new Error(\"swap refresh returned a plan with no txs\");\n  }\n  return refreshed;\n}\n\nfunction isSolanaRailX402(plan: X402Plan): boolean {\n  return plan.x402?.rail === \"solana\";\n}\n\nasync function refreshX402SolanaTx(post: Poster, requestId: string): Promise<string> {\n  const refreshed = (await refreshPlan(post, requestId)) as X402Plan;\n  const tx = refreshed.solana?.transaction;\n  if (typeof tx !== \"string\" || tx.length === 0) {\n    throw new Error(\"x402 refresh returned a plan with no Solana transaction\");\n  }\n  return tx;\n}\n\nexport async function signSwapRequest(\n  post: Poster,\n  requestId: string,\n  plan: SwapPlan,\n  creds: Creds,\n): Promise<void> {\n  const signPlan = isSolanaRefreshablePlan(plan)\n    ? await refreshSwapPlan(post, requestId)\n    : plan;\n  let binding: WalletBinding = {\n    walletId: signPlan.binding.wallet_id,\n    keyId: signPlan.binding.key_id ?? \"\",\n    derivationPath: signPlan.binding.derivation_path ?? \"\",\n  };\n  if (binding.walletId && (!binding.keyId || !binding.derivationPath)) {\n    binding = await resolveBinding(post, requestId, creds);\n  }\n  const envelopes: TxEnvelope[] = buildSwapEnvelopes(signPlan.txs, binding, creds);\n  await post(`/agent/requests/${requestId}/envelopes`, { envelopes });\n}\n\nexport async function signX402Request(\n  post: Poster,\n  requestId: string,\n  plan: X402Plan,\n  creds: Creds,\n): Promise<void> {\n  let binding: WalletBinding = {\n    walletId: plan.binding.wallet_id,\n    keyId: plan.binding.key_id ?? \"\",\n    derivationPath: plan.binding.derivation_path ?? \"\",\n  };\n  if (binding.walletId && (!binding.keyId || !binding.derivationPath)) {\n    binding = await resolveBinding(post, requestId, creds);\n  }\n  const envelope: TxEnvelope = isSolanaRailX402(plan)\n    ? buildX402SolanaEnvelope(await refreshX402SolanaTx(post, requestId), binding, creds)\n    : buildX402Envelope(\n        plan.typed_data as Parameters<typeof buildX402Envelope>[0],\n        binding,\n        creds,\n      );\n  await post(`/agent/requests/${requestId}/envelopes`, { envelopes: [envelope] });\n}\n","import type { McpToolResult } from \"./types.js\";\n\nconst PROTOCOL_VERSION = \"2025-06-18\";\n\ninterface JsonRpcResponse<T> {\n  result?: T;\n  error?: {\n    code: number;\n    message: string;\n  };\n}\n\ninterface McpTransportOptions {\n  baseUrl: string;\n  bearer: () => Promise<string>;\n  fetchImpl: typeof fetch;\n}\n\nfunction responseBody(text: string): string {\n  const events = text\n    .split(/\\r?\\n/)\n    .filter((line) => line.startsWith(\"data:\"))\n    .map((line) => line.slice(5).trim());\n  return events.length === 0 ? text : events.join(\"\");\n}\n\nfunction errorText(result: McpToolResult): string {\n  return result.content\n    .filter((item) => item.type === \"text\" && typeof item.text === \"string\")\n    .map((item) => item.text)\n    .join(\"\\n\");\n}\n\nexport function toolJson<T>(tool: string, result: McpToolResult): T {\n  if (result.isError) {\n    throw new Error(errorText(result) || `paybox ${tool} failed`);\n  }\n  const text = result.content.find(\n    (item) => item.type === \"text\" && typeof item.text === \"string\",\n  )?.text;\n  if (typeof text !== \"string\") {\n    throw new Error(`paybox ${tool} returned no JSON content`);\n  }\n  return JSON.parse(text) as T;\n}\n\nexport class McpTransport {\n  private readonly endpoint: string;\n  private readonly bearer: () => Promise<string>;\n  private readonly fetchImpl: typeof fetch;\n  private nextId = 0;\n  private initialization?: Promise<void>;\n\n  constructor(options: McpTransportOptions) {\n    this.endpoint = `${options.baseUrl}/mcp`;\n    this.bearer = options.bearer;\n    this.fetchImpl = options.fetchImpl;\n  }\n\n  async callTool(\n    name: string,\n    args: Record<string, unknown>,\n  ): Promise<McpToolResult> {\n    await this.initialize();\n    return this.rpc(\"tools/call\", { name, arguments: args });\n  }\n\n  private async initialize(): Promise<void> {\n    this.initialization ??= this.rpc<unknown>(\"initialize\", {\n      protocolVersion: PROTOCOL_VERSION,\n      capabilities: {},\n      clientInfo: { name: \"paybox-sdk\", version: \"1\" },\n    }).then(() => this.notify(\"notifications/initialized\", {}));\n    try {\n      await this.initialization;\n    } catch (error) {\n      this.initialization = undefined;\n      throw error;\n    }\n  }\n\n  private async post(\n    payload: Record<string, unknown>,\n    method: string,\n  ): Promise<string> {\n    const response = await this.fetchImpl(this.endpoint, {\n      method: \"POST\",\n      headers: {\n        accept: \"application/json, text/event-stream\",\n        authorization: `Bearer ${await this.bearer()}`,\n        \"content-type\": \"application/json\",\n        \"mcp-protocol-version\": PROTOCOL_VERSION,\n      },\n      body: JSON.stringify(payload),\n    });\n    const text = await response.text();\n    if (!response.ok) {\n      throw new Error(\n        `paybox MCP ${method} failed (${response.status}): ${text}`,\n      );\n    }\n    return text;\n  }\n\n  private async notify(method: string, params: unknown): Promise<void> {\n    await this.post({ jsonrpc: \"2.0\", method, params }, method);\n  }\n\n  private async rpc<T>(method: string, params: unknown): Promise<T> {\n    const text = await this.post(\n      {\n        jsonrpc: \"2.0\",\n        id: ++this.nextId,\n        method,\n        params,\n      },\n      method,\n    );\n    const parsed = JSON.parse(responseBody(text)) as JsonRpcResponse<T>;\n    if (parsed.error) {\n      throw new Error(\n        `paybox MCP ${method} failed (${parsed.error.code}): ${parsed.error.message}`,\n      );\n    }\n    if (parsed.result === undefined) {\n      throw new Error(`paybox MCP ${method} returned no result`);\n    }\n    return parsed.result;\n  }\n}\n","\nimport { refreshTokens } from \"./auth.js\";\nimport { loadConfig, saveConfig, type OAuthTokens } from \"./config.js\";\nimport { McpTransport, toolJson } from \"./mcp.js\";\nimport {\n  credsFromToken,\n  signSwapRequest,\n  signWalletRequest,\n  signX402Request,\n  type Poster,\n} from \"./signer.js\";\nimport type {\n  RequestPaymentArgs,\n  RequestSecretArgs,\n  RequestSwapArgs,\n  RequestWalletSignArgs,\n  VerifySolanaBalanceArgs as VerifySolanaBalanceWireArgs,\n} from \"./types.generated.js\";\nimport type {\n  AccountChangeResult,\n  AgentResponse,\n  BuyLinkArgs,\n  BuyLinkResult,\n  DepositLinkArgs,\n  DepositLinkResult,\n  ClientCredentialList,\n  DiscoverServicesPage,\n  DiscoverServicesOptions,\n  DiscoverServicesPageOptions,\n  DiscoverPluginsArgs,\n  DiscoverPluginsPage,\n  McpToolResult,\n  OperationReadiness,\n  OperationReadinessArgs,\n  PaymentArgs,\n  PluginContractResult,\n  PortfolioArgs,\n  SecretArgs,\n  ServiceSummary,\n  SwapArgs,\n  SwapResult,\n  UseServiceArgs,\n  UsePluginArgs,\n  VerifySolanaBalanceArgs,\n  VerifySolanaBalanceResult,\n  WalletSignArgs,\n  WalletSignResult,\n  X402Args,\n  X402Result,\n} from \"./types.js\";\n\nconst DEFAULT_BASE_URL = \"https://api.paybox.sh\";\nconst EXPIRY_SKEW_MS = 60_000;\n\nfunction signingResultForResponse<TPlan>(\n  result: { response: AgentResponse; plan: TPlan | null },\n  response: AgentResponse,\n): { response: AgentResponse; plan: TPlan | null } {\n  const exposesPlan =\n    response.status === \"pending_approval\" || response.status === \"pending_signature\";\n  return { ...result, response, plan: exposesPlan ? result.plan : null };\n}\n\nexport function didNotHappen(r: { status?: unknown } | null | undefined): boolean {\n  return r?.status === \"denied\" || r?.status === \"error\";\n}\n\nexport class PayboxError extends Error {\n  constructor(\n    readonly status: number,\n    readonly body: string,\n    context: string,\n  ) {\n    super(`paybox ${context} failed (${status}): ${body}`);\n    this.name = \"PayboxError\";\n  }\n}\n\nexport interface PayboxClientOptions {\n  baseUrl?: string;\n  apiKey?: string;\n  token?: string;\n  signingKey?: string;\n  fetchImpl?: typeof fetch;\n}\n\nexport interface SignOptions {\n  autoSign?: boolean;\n  waitForApproval?: boolean | { intervalMs?: number; timeoutMs?: number };\n}\n\nexport class PayboxClient {\n  readonly baseUrl: string;\n  private readonly opts: PayboxClientOptions;\n  private readonly fetchImpl: typeof fetch;\n  private oauth?: OAuthTokens;\n  private configBacked = false;\n  private readonly mcp: McpTransport;\n\n  constructor(options: PayboxClientOptions = {}) {\n    this.opts = options;\n    this.baseUrl = (options.baseUrl ?? DEFAULT_BASE_URL).replace(/\\/+$/, \"\");\n    this.fetchImpl = options.fetchImpl ?? fetch;\n    this.mcp = new McpTransport({\n      baseUrl: this.baseUrl,\n      bearer: () => this.bearer(),\n      fetchImpl: this.fetchImpl,\n    });\n  }\n\n  static fromConfig(overrides: PayboxClientOptions = {}): PayboxClient {\n    const cfg = loadConfig();\n    const client = new PayboxClient({\n      baseUrl: overrides.baseUrl ?? process.env.PAYBOX_API_URL ?? cfg.baseUrl,\n      apiKey: overrides.apiKey ?? process.env.PAYBOX_API_KEY ?? cfg.apiKey,\n      token: overrides.token ?? process.env.PAYBOX_ACCESS_TOKEN,\n      signingKey: overrides.signingKey ?? process.env.PAYBOX_SIGNING_KEY ?? cfg.signingKey,\n      fetchImpl: overrides.fetchImpl,\n    });\n    if (!client.opts.apiKey && !client.opts.token && cfg.oauth) {\n      client.oauth = cfg.oauth;\n      client.configBacked = true;\n    }\n    return client;\n  }\n\n  private signingCreds() {\n    if (!this.opts.signingKey) return null;\n    try {\n      return credsFromToken(this.opts.signingKey);\n    } catch {\n      return null;\n    }\n  }\n\n  get canSign(): boolean {\n    return this.signingCreds() !== null;\n  }\n\n  private async bearer(): Promise<string> {\n    if (this.opts.token) return this.opts.token;\n    if (this.opts.apiKey) return this.opts.apiKey;\n    if (this.oauth) {\n      if (this.oauth.expiresAt && Date.now() > this.oauth.expiresAt - EXPIRY_SKEW_MS) {\n        this.oauth = await refreshTokens(this.baseUrl, this.oauth);\n        if (this.configBacked) {\n          const cfg = loadConfig();\n          cfg.oauth = this.oauth;\n          saveConfig(cfg);\n        }\n      }\n      return this.oauth.accessToken;\n    }\n    throw new Error(\n      \"not authenticated — run `paybox login`, set PAYBOX_API_KEY, or pass { apiKey } / { token }\",\n    );\n  }\n\n  private async request<T>(\n    method: string,\n    path: string,\n    init: { query?: Record<string, string | undefined>; body?: unknown } = {},\n  ): Promise<T> {\n    const url = new URL(this.baseUrl + path);\n    for (const [k, v] of Object.entries(init.query ?? {})) {\n      if (v != null) url.searchParams.set(k, v);\n    }\n    const headers: Record<string, string> = { authorization: `Bearer ${await this.bearer()}` };\n    let body: string | undefined;\n    if (init.body !== undefined) {\n      headers[\"content-type\"] = \"application/json\";\n      body = JSON.stringify(init.body);\n    }\n    const res = await this.fetchImpl(url, { method, headers, body });\n    const text = await res.text();\n    if (!res.ok) throw new PayboxError(res.status, text, `${method} ${path}`);\n    return (text ? JSON.parse(text) : undefined) as T;\n  }\n\n  private readonly poster: Poster = (path, body) => this.request<unknown>(\"POST\", path, { body });\n\n  listCredentials(): Promise<ClientCredentialList> {\n    return this.request(\"GET\", \"/agent/grants\");\n  }\n\n  checkOperationReadiness(args: OperationReadinessArgs): Promise<OperationReadiness> {\n    return this.request(\"POST\", \"/agent/readiness\", { body: args });\n  }\n\n  getPortfolio(args: PortfolioArgs): Promise<unknown> {\n    return this.request(\"GET\", \"/agent/portfolio\", {\n      query: {\n        address: args.address,\n        network_ids: args.networkIds,\n        token: args.token,\n        network_id: args.networkId != null ? String(args.networkId) : undefined,\n      },\n    });\n  }\n\n  verifySolanaBalance(args: VerifySolanaBalanceArgs): Promise<VerifySolanaBalanceResult> {\n    const body: VerifySolanaBalanceWireArgs = {\n      address: args.address,\n      token_mint: args.tokenMint,\n      transaction_signature: args.transactionSignature,\n    };\n    return this.request(\"POST\", \"/agent/portfolio/verify-solana-balance\", { body });\n  }\n\n  requestPayment(args: PaymentArgs): Promise<AgentResponse> {\n    const operation: RequestPaymentArgs & { type: \"payment\" } = {\n      type: \"payment\",\n      credential_id: args.credentialId,\n      merchant: args.merchant,\n      merchant_url: args.merchantUrl,\n      amount_cents: args.amountCents,\n      currency: args.currency ?? \"USD\",\n    };\n    return this.request(\"POST\", \"/agent/request\", { body: { operation } });\n  }\n\n  requestSecret(args: SecretArgs): Promise<AgentResponse> {\n    const operation: RequestSecretArgs & { type: \"secret\" } = {\n      type: \"secret\",\n      credential_id: args.credentialId,\n      raw: args.raw ?? false,\n      purpose: args.purpose ?? null,\n    };\n    return this.request(\"POST\", \"/agent/request\", { body: { operation } });\n  }\n\n  async requestWalletSign(args: WalletSignArgs, opts: SignOptions = {}): Promise<AgentResponse> {\n    return this.withExpiryRetry(\n      async () => {\n        const operation: RequestWalletSignArgs & { type: \"wallet_sign\" } = {\n          type: \"wallet_sign\",\n          credential_id: args.credentialId,\n          intent: args.intent,\n        };\n        const { response, binding } = await this.request<WalletSignResult>(\n          \"POST\",\n          \"/agent/wallet-sign\",\n          { body: { operation } },\n        );\n        const creds = this.signingCreds();\n        if (\n          (opts.autoSign ?? true) &&\n          response.status === \"pending_signature\" &&\n          creds\n        ) {\n          const sign = () =>\n            signWalletRequest(this.poster, response.request_id, args.intent, creds, binding);\n          await this.signWithReconcile(response.request_id, sign);\n          return this.getRequest(response.request_id);\n        }\n        return response;\n      },\n      (r) => r,\n    );\n  }\n\n  async requestSwap(args: SwapArgs, opts: SignOptions = {}): Promise<SwapResult> {\n    return this.withExpiryRetry(\n      async () => {\n        const operation: RequestSwapArgs & { type: \"swap\" } = {\n          type: \"swap\",\n          credential_id: args.credentialId,\n          src_chain: args.srcChain,\n          dst_chain: args.dstChain ?? args.srcChain,\n          src_token: args.srcToken,\n          dst_token: args.dstToken,\n          amount: args.amount,\n          swap_direction: args.swapDirection ?? \"exact-amount-in\",\n          slippage_bps: args.slippageBps ?? 150,\n          recipient: args.recipient ?? null,\n          value_cents: args.valueCents ?? null,\n        };\n        const result = await this.request<SwapResult>(\"POST\", \"/agent/swap\", {\n          body: { operation },\n        });\n        return this.completeSwap(result, opts);\n      },\n      (r) => r.response,\n    );\n  }\n\n  private async completeSwap(result: SwapResult, opts: SignOptions): Promise<SwapResult> {\n    const creds = this.signingCreds();\n    if (!(opts.autoSign ?? true) || !creds) {\n      return signingResultForResponse(result, result.response);\n    }\n    let response = result.response;\n    if (response.status === \"pending_approval\" && opts.waitForApproval) {\n      response = await this.waitWhileApproval(response.request_id, opts.waitForApproval);\n    }\n    if (response.status !== \"pending_signature\") {\n      return signingResultForResponse(result, response);\n    }\n    const plan = result.plan;\n    if (!plan) {\n      throw new Error(\"paybox returned pending_signature without a swap signing plan\");\n    }\n    const sign = () => signSwapRequest(this.poster, response.request_id, plan, creds);\n    await this.signWithReconcile(response.request_id, sign);\n    return signingResultForResponse(\n      result,\n      await this.requestAfterSign(response.request_id, opts.waitForApproval),\n    );\n  }\n\n  private async waitWhileApproval(\n    requestId: string,\n    wait: boolean | { intervalMs?: number; timeoutMs?: number },\n  ): Promise<AgentResponse> {\n    const o = typeof wait === \"object\" ? wait : {};\n    const interval = o.intervalMs ?? 2000;\n    const deadline = Date.now() + (o.timeoutMs ?? 300_000);\n    for (;;) {\n      const r = await this.getRequest(requestId);\n      if (r.status !== \"pending_approval\" || Date.now() > deadline) return r;\n      await new Promise((res) => setTimeout(res, interval));\n    }\n  }\n\n  private async withExpiryRetry<T>(\n    run: () => Promise<T>,\n    responseOf: (result: T) => AgentResponse,\n  ): Promise<T> {\n    const first = await run();\n    const r = responseOf(first);\n    if (didNotHappen(r) && r.retryable) {\n      return run();\n    }\n    return first;\n  }\n\n  private async signWithReconcile(requestId: string, sign: () => Promise<unknown>): Promise<void> {\n    try {\n      await sign();\n    } catch {\n      const reconciled = await this.getRequest(requestId);\n      if (reconciled.status !== \"pending_signature\") return;\n      await sign();\n    }\n  }\n\n  async discoverServices(\n    query?: string,\n    opts: DiscoverServicesOptions = {},\n  ): Promise<ServiceSummary[]> {\n    const result = await this.request<{ services: ServiceSummary[] }>(\"GET\", \"/agent/services\", {\n      query: {\n        query,\n        network: opts.network === \"all\" ? undefined : opts.network,\n        raw: opts.raw ? \"true\" : undefined,\n      },\n    });\n    return result.services;\n  }\n\n  async discoverServicesPage(\n    query?: string,\n    opts: DiscoverServicesPageOptions = {},\n  ): Promise<DiscoverServicesPage> {\n    return this.request<DiscoverServicesPage>(\"GET\", \"/agent/services\", {\n      query: {\n        query,\n        network: opts.network === \"all\" ? undefined : opts.network,\n        limit: (opts.limit ?? 10).toString(),\n        cursor: opts.cursor,\n        raw: opts.raw ? \"true\" : undefined,\n      },\n    });\n  }\n\n  async discoverPlugins(args: DiscoverPluginsArgs = {}): Promise<DiscoverPluginsPage> {\n    return toolJson(\n      \"discover_plugins\",\n      await this.mcp.callTool(\"discover_plugins\", {\n        query: args.query,\n        source: args.source,\n        status: args.status,\n        limit: args.limit,\n        cursor: args.cursor,\n      }),\n    );\n  }\n\n  async getPluginContract(contractUri: string): Promise<PluginContractResult> {\n    return toolJson(\n      \"get_contract\",\n      await this.mcp.callTool(\"get_contract\", { contract_uri: contractUri }),\n    );\n  }\n\n  usePlugin(args: UsePluginArgs): Promise<McpToolResult> {\n    return this.mcp.callTool(\"use_plugin\", {\n      plugin_id: args.pluginId,\n      tool_id: args.toolId,\n      input: args.input,\n      invocation_id: args.invocationId,\n    });\n  }\n\n  async payX402(args: X402Args, opts: SignOptions = {}): Promise<X402Result> {\n    return this.withExpiryRetry(\n      async () => {\n        const result = await this.request<X402Result>(\"POST\", \"/agent/x402\", {\n          body: {\n            credential_id: args.credentialId,\n            accepts: args.accepts,\n            resource_url: args.resourceUrl,\n          },\n        });\n        return this.completeX402(result, opts);\n      },\n      (r) => r.response,\n    );\n  }\n\n  async useService(args: UseServiceArgs, opts: SignOptions = {}): Promise<X402Result> {\n    return this.withExpiryRetry(\n      async () => {\n        const result = await this.request<X402Result>(\"POST\", \"/agent/use-service\", {\n          body: {\n            credential_id: args.credentialId,\n            url: args.url,\n            method: args.method,\n            body: args.body,\n          },\n        });\n        return this.completeX402(result, opts);\n      },\n      (r) => r.response,\n    );\n  }\n\n  private async completeX402(result: X402Result, opts: SignOptions): Promise<X402Result> {\n    const creds = this.signingCreds();\n    if (!(opts.autoSign ?? true) || !creds) {\n      return signingResultForResponse(result, result.response);\n    }\n    let response = result.response;\n    if (response.status === \"pending_approval\" && opts.waitForApproval) {\n      response = await this.waitWhileApproval(response.request_id, opts.waitForApproval);\n    }\n    if (response.status !== \"pending_signature\") {\n      return signingResultForResponse(result, response);\n    }\n    const plan = result.plan;\n    if (!plan) {\n      throw new Error(\"paybox returned pending_signature without an x402 signing plan\");\n    }\n    const sign = () => signX402Request(this.poster, response.request_id, plan, creds);\n    await this.signWithReconcile(response.request_id, sign);\n    return signingResultForResponse(\n      result,\n      await this.requestAfterSign(response.request_id, opts.waitForApproval),\n    );\n  }\n\n  claimPaymentCredentials(requestId: string): Promise<Record<string, unknown>> {\n    return this.request(\"POST\", `/agent/requests/${requestId}/credentials`);\n  }\n\n  requestAccountChange(note?: string): Promise<AccountChangeResult> {\n    return this.request(\"POST\", \"/agent/account-change\", { body: { note } });\n  }\n\n  getBuyLink(args: BuyLinkArgs): Promise<BuyLinkResult> {\n    return this.request(\"GET\", \"/agent/buy-link\", {\n      query: {\n        credential_id: args.credentialId,\n        destination_chain: args.destinationChain,\n        currency_code: args.currencyCode,\n        amount_usd: args.amountUsd?.toString(),\n      },\n    });\n  }\n\n  getDepositLink(args: DepositLinkArgs): Promise<DepositLinkResult> {\n    return this.request(\"GET\", \"/agent/deposit-link\", {\n      query: {\n        credential_id: args.credentialId,\n        amount_usd: args.amountUsd?.toString(),\n      },\n    });\n  }\n\n  getRequest(requestId: string): Promise<AgentResponse> {\n    return this.request(\"GET\", `/agent/requests/${requestId}`);\n  }\n\n  private requestAfterSign(\n    requestId: string,\n    wait: SignOptions[\"waitForApproval\"],\n  ): Promise<AgentResponse> {\n    if (!wait) return this.getRequest(requestId);\n    return this.waitForRequest(requestId, typeof wait === \"object\" ? wait : {});\n  }\n\n  async waitForRequest(\n    requestId: string,\n    opts: { intervalMs?: number; timeoutMs?: number } = {},\n  ): Promise<AgentResponse> {\n    const interval = opts.intervalMs ?? 2000;\n    const deadline = Date.now() + (opts.timeoutMs ?? 300_000);\n    for (;;) {\n      const r = await this.getRequest(requestId);\n      const pending =\n        r.status === \"pending_approval\" ||\n        r.status === \"pending_signature\" ||\n        r.status === \"pending_settlement\" ||\n        r.status === \"pending_confirmation\";\n      if (!pending || Date.now() > deadline) return r;\n      await new Promise((res) => setTimeout(res, interval));\n    }\n  }\n}\n"],"mappings":";AACA,SAAS,aAAa;AACtB,SAAS,YAAY,mBAAmB;AACxC,SAAS,oBAAoB;AAKtB,SAAS,YAAY,SAAyB;AACnD,SAAO,GAAG,QAAQ,QAAQ,QAAQ,EAAE,CAAC;AACvC;AAEO,SAAS,YAAY,SAAiB,UAAkC;AAC7E,MAAI,SAAU,QAAO,SAAS,QAAQ,QAAQ,EAAE;AAChD,QAAM,IAAI,QAAQ,QAAQ,QAAQ,EAAE,EAAE,MAAM,0BAA0B;AACtE,SAAO,IAAI,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK;AACpC;AAsBA,eAAe,SAAS,SAAsC;AAC5D,QAAM,MAAM,GAAG,QAAQ,QAAQ,QAAQ,EAAE,CAAC;AAC1C,QAAM,MAAM,MAAM,MAAM,GAAG;AAC3B,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,IAAI,MAAM,sCAAsC,GAAG,KAAK,IAAI,MAAM,GAAG;AAAA,EAC7E;AACA,SAAQ,MAAM,IAAI,KAAK;AACzB;AAEA,SAAS,UAAU,GAAmB;AACpC,SAAO,EAAE,SAAS,WAAW;AAC/B;AAEA,SAAS,OAAgD;AACvD,QAAM,WAAW,UAAU,YAAY,EAAE,CAAC;AAC1C,QAAM,YAAY,UAAU,WAAW,QAAQ,EAAE,OAAO,QAAQ,EAAE,OAAO,CAAC;AAC1E,SAAO,EAAE,UAAU,UAAU;AAC/B;AAEO,SAAS,YAAY,KAAmB;AAC7C,QAAM,CAAC,KAAK,IAAI,IACd,QAAQ,aAAa,WAChB,CAAC,QAAQ,CAAC,GAAG,CAAC,IACf,QAAQ,aAAa,UAClB,CAAC,YAAY,CAAC,+BAA+B,GAAG,CAAC,IACjD,CAAC,YAAY,CAAC,GAAG,CAAC;AAC3B,MAAI;AACF,UAAM,KAAK,CAAC,GAAG,IAAI,GAAG,EAAE,OAAO,UAAU,UAAU,KAAK,CAAC,EAAE,MAAM;AAAA,EACnE,QAAQ;AAAA,EACR;AACF;AAEA,IAAM,gBACJ;AAWF,eAAsB,cACpB,SACA,OAAqB,CAAC,GACA;AACtB,QAAM,QAAQ,KAAK,SAAS;AAC5B,QAAM,aAAa,KAAK,cAAc;AACtC,QAAM,MAAM,KAAK,QAAQ,CAAC,MAAc,QAAQ,MAAM,CAAC;AACvD,QAAM,OAAO,MAAM,SAAS,OAAO;AACnC,QAAM,WAAW,YAAY,OAAO;AAEpC,MAAI;AACJ,MAAI;AACJ,QAAM,cAAc,IAAI,QAAgD,CAAC,KAAK,QAAQ;AACpF,kBAAc;AACd,iBAAa;AAAA,EACf,CAAC;AAED,QAAM,SAAS,aAAa,CAAC,KAAK,QAAQ;AACxC,UAAM,IAAI,IAAI,IAAI,IAAI,OAAO,KAAK,kBAAkB;AACpD,QAAI,EAAE,aAAa,aAAa;AAC9B,UAAI,UAAU,GAAG,EAAE,IAAI;AACvB;AAAA,IACF;AACA,QAAI,UAAU,KAAK,EAAE,gBAAgB,YAAY,CAAC,EAAE,IAAI,aAAa;AACrE,UAAM,OAAO,EAAE,aAAa,IAAI,MAAM;AACtC,QAAI,KAAM,aAAY,EAAE,MAAM,OAAO,EAAE,aAAa,IAAI,OAAO,EAAE,CAAC;AAAA,QAC7D,YAAW,IAAI,MAAM,EAAE,aAAa,IAAI,OAAO,KAAK,sBAAsB,CAAC;AAAA,EAClF,CAAC;AACD,QAAM,IAAI,QAAc,CAAC,MAAM,OAAO,OAAO,GAAG,aAAa,CAAC,CAAC;AAC/D,QAAM,OAAQ,OAAO,QAAQ,EAAkB;AAC/C,QAAM,cAAc,oBAAoB,IAAI;AAE5C,QAAM,YAAY,KAAK,aAAa;AACpC,QAAM,QAAQ;AAAA,IACZ,MAAM,WAAW,IAAI,MAAM,yBAAyB,KAAK,MAAM,YAAY,GAAI,CAAC,+BAA0B,CAAC;AAAA,IAC3G;AAAA,EACF;AACA,QAAM,MAAM;AAEZ,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,KAAK,uBAAuB;AAAA,MAClD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU;AAAA,QACnB,aAAa;AAAA,QACb,eAAe,CAAC,WAAW;AAAA,QAC3B,4BAA4B;AAAA,QAC5B,aAAa,CAAC,sBAAsB,eAAe;AAAA,QACnD,gBAAgB,CAAC,MAAM;AAAA,MACzB,CAAC;AAAA,IACH,CAAC;AACD,QAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,+BAA+B,IAAI,MAAM,MAAM,MAAM,IAAI,KAAK,CAAC,EAAE;AAC9F,UAAM,EAAE,WAAW,SAAS,IAAK,MAAM,IAAI,KAAK;AAEhD,UAAM,EAAE,UAAU,UAAU,IAAI,KAAK;AACrC,UAAM,QAAQ,UAAU,YAAY,EAAE,CAAC;AACvC,UAAM,UACJ,GAAG,KAAK,sBAAsB,iCAChB,mBAAmB,QAAQ,CAAC,iBACzB,mBAAmB,WAAW,CAAC,mBAC7B,SAAS,qCAClB,mBAAmB,KAAK,CAAC,UACzB,KAAK,aAAa,mBAAmB,QAAQ,CAAC;AAE1D,QAAI;AAAA,IAA8C,OAAO;AAAA,CAAI;AAC7D,gBAAY,OAAO;AAEnB,UAAM,EAAE,MAAM,OAAO,cAAc,IAAI,MAAM;AAC7C,QAAI,kBAAkB,MAAO,OAAM,IAAI,MAAM,sCAAiC;AAE9E,UAAM,OAAO,IAAI,gBAAgB;AAAA,MAC/B,YAAY;AAAA,MACZ;AAAA,MACA,cAAc;AAAA,MACd,WAAW;AAAA,MACX,eAAe;AAAA,MACf;AAAA,IACF,CAAC;AACD,UAAM,MAAM,MAAM,MAAM,KAAK,gBAAgB;AAAA,MAC3C,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,MAC/D,MAAM;AAAA,IACR,CAAC;AACD,QAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,0BAA0B,IAAI,MAAM,MAAM,MAAM,IAAI,KAAK,CAAC,EAAE;AACzF,UAAM,IAAK,MAAM,IAAI,KAAK;AAK1B,WAAO;AAAA,MACL;AAAA,MACA,aAAa,EAAE;AAAA,MACf,cAAc,EAAE;AAAA,MAChB,WAAW,EAAE,aAAa,KAAK,IAAI,IAAI,EAAE,aAAa,MAAO;AAAA,MAC7D;AAAA,IACF;AAAA,EACF,UAAE;AACA,iBAAa,KAAK;AAClB,WAAO,MAAM;AAAA,EACf;AACF;AAEA,eAAsB,YACpB,SACA,OAAqB,CAAC,GACA;AACtB,QAAM,QAAQ,KAAK,SAAS;AAC5B,QAAM,aAAa,KAAK,cAAc;AACtC,QAAM,MAAM,KAAK,QAAQ,CAAC,MAAc,QAAQ,MAAM,CAAC;AACvD,QAAM,OAAO,MAAM,SAAS,OAAO;AACnC,MAAI,CAAC,KAAK,+BAA+B;AACvC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,WAAW,YAAY,OAAO;AAEpC,QAAM,MAAM,MAAM,MAAM,KAAK,uBAAuB;AAAA,IAClD,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU;AAAA,MACnB,aAAa;AAAA,MACb,eAAe,CAAC,yBAAyB;AAAA,MACzC,4BAA4B;AAAA,MAC5B,aAAa,CAAC,gDAAgD,eAAe;AAAA,MAC7E,gBAAgB,CAAC,MAAM;AAAA,MACvB;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,+BAA+B,IAAI,MAAM,MAAM,MAAM,IAAI,KAAK,CAAC,EAAE;AAC9F,QAAM,EAAE,WAAW,SAAS,IAAK,MAAM,IAAI,KAAK;AAEhD,QAAM,UAAU,MAAM,MAAM,KAAK,+BAA+B;AAAA,IAC9D,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,IAC/D,MAAM,IAAI,gBAAgB,EAAE,WAAW,UAAU,OAAO,SAAS,CAAC;AAAA,EACpE,CAAC;AACD,MAAI,CAAC,QAAQ,IAAI;AACf,UAAM,IAAI,MAAM,gCAAgC,QAAQ,MAAM,MAAM,MAAM,QAAQ,KAAK,CAAC,EAAE;AAAA,EAC5F;AACA,QAAM,KAAM,MAAM,QAAQ,KAAK;AAS/B;AAAA,IACE;AAAA,IAAwE,GAAG,yBAAyB;AAAA,QACzF,GAAG,SAAS;AAAA;AAAA,EACzB;AACA,cAAY,GAAG,yBAAyB;AAExC,QAAM,YAAY,KAAK,aAAa,GAAG,aAAa;AACpD,QAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,MAAI,cAAc,GAAG,YAAY,GAAG,WAAW,IAAI,GAAG,WAAW;AAEjE,SAAO,KAAK,IAAI,IAAI,UAAU;AAC5B,UAAM,IAAI,QAAQ,CAAC,MAAM,WAAW,GAAG,cAAc,GAAI,CAAC;AAC1D,UAAM,MAAM,MAAM,MAAM,KAAK,gBAAgB;AAAA,MAC3C,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,MAC/D,MAAM,IAAI,gBAAgB;AAAA,QACxB,YAAY;AAAA,QACZ,aAAa,GAAG;AAAA,QAChB,WAAW;AAAA,MACb,CAAC;AAAA,IACH,CAAC;AACD,UAAM,MAAM,MAAM,IAAI,KAAK;AAC3B,QAAI,IAAI,IAAI;AACV,YAAM,IAAI,KAAK,MAAM,GAAG;AAKxB,aAAO;AAAA,QACL;AAAA,QACA,aAAa,EAAE;AAAA,QACf,cAAc,EAAE;AAAA,QAChB,WAAW,EAAE,aAAa,KAAK,IAAI,IAAI,EAAE,aAAa,MAAO;AAAA,QAC7D;AAAA,MACF;AAAA,IACF;AACA,QAAI,MAAM,OAAO;AACjB,QAAI,OAAO;AACX,QAAI;AACF,YAAM,OAAO,KAAK,MAAM,GAAG;AAC3B,aAAO,KAAK,SAAS;AACrB,YAAM,KAAK,qBAAqB,KAAK,SAAS;AAAA,IAChD,QAAQ;AAAA,IACR;AACA,QAAI,SAAS,wBAAyB;AACtC,QAAI,SAAS,aAAa;AACxB,qBAAe;AACf;AAAA,IACF;AACA,UAAM,IAAI,MAAM,GAAG;AAAA,EACrB;AACA,QAAM,IAAI,MAAM,yBAAyB,KAAK,MAAM,YAAY,GAAI,CAAC,+BAA0B;AACjG;AAEA,eAAsB,cAAc,SAAiB,SAA4C;AAC/F,MAAI,CAAC,QAAQ,aAAc,OAAM,IAAI,MAAM,kDAA6C;AACxF,QAAM,OAAO,MAAM,SAAS,OAAO;AACnC,QAAM,WAAW,QAAQ,YAAY,YAAY,OAAO;AACxD,QAAM,OAAO,IAAI,gBAAgB;AAAA,IAC/B,YAAY;AAAA,IACZ,eAAe,QAAQ;AAAA,IACvB,WAAW,QAAQ;AAAA,IACnB;AAAA,EACF,CAAC;AACD,QAAM,MAAM,MAAM,MAAM,KAAK,gBAAgB;AAAA,IAC3C,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,IAC/D,MAAM;AAAA,EACR,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,yBAAyB,IAAI,MAAM,MAAM,MAAM,IAAI,KAAK,CAAC,EAAE;AACxF,QAAM,IAAK,MAAM,IAAI,KAAK;AAK1B,SAAO;AAAA,IACL,GAAG;AAAA,IACH,aAAa,EAAE;AAAA,IACf,cAAc,EAAE,iBAAiB,QAAQ;AAAA,IACzC,WAAW,EAAE,aAAa,KAAK,IAAI,IAAI,EAAE,aAAa,MAAO;AAAA,IAC7D;AAAA,EACF;AACF;;;ACxTA,SAAS,WAAW,WAAW,cAAc,qBAAqB;AAClE,SAAS,eAAe;AACxB,SAAS,YAAY;AAkBd,SAAS,YAAoB;AAClC,MAAI,QAAQ,IAAI,kBAAmB,QAAO,QAAQ,IAAI;AACtD,QAAM,OAAO,QAAQ,IAAI,mBAAmB,KAAK,QAAQ,GAAG,SAAS;AACrE,SAAO,KAAK,MAAM,QAAQ;AAC5B;AAEO,SAAS,aAAqB;AACnC,SAAO,KAAK,UAAU,GAAG,aAAa;AACxC;AAEO,SAAS,aAA2B;AACzC,MAAI;AACF,WAAO,KAAK,MAAM,aAAa,WAAW,GAAG,MAAM,CAAC;AAAA,EACtD,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEO,SAAS,WAAW,QAA4B;AACrD,YAAU,UAAU,GAAG,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AACvD,gBAAc,WAAW,GAAG,GAAG,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAAA,GAAM,EAAE,MAAM,IAAM,CAAC;AACnF,MAAI,QAAQ,aAAa,QAAS,WAAU,WAAW,GAAG,GAAK;AACjE;;;ACxCO,IAAM,eAAe;AA+ErB,SAAS,YAAY,GAAW,OAA8B;AACnE,QAAM,UAAU,EAAE,KAAK;AACvB,MAAI,CAAC,QAAS,QAAO,GAAG,KAAK;AAC7B,QAAM,OAAO,QAAQ,WAAW,IAAI,KAAK,QAAQ,WAAW,IAAI,IAAI,QAAQ,MAAM,CAAC,IAAI;AACvF,MAAI,KAAK,WAAW,EAAG,QAAO,GAAG,KAAK;AACtC,MAAI,KAAK,SAAS,MAAM,EAAG,QAAO,GAAG,KAAK;AAC1C,MAAI,CAAC,iBAAiB,KAAK,IAAI,EAAG,QAAO,GAAG,KAAK;AACjD,SAAO;AACT;AAEA,SAAS,aAAa,GAAmB;AACvC,SAAO,KAAK,CAAC,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC1E;AAEA,SAAS,aAAa,GAAmB;AACvC,MAAI,IAAI,EAAE,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AAC9C,SAAO,EAAE,SAAS,EAAG,MAAK;AAC1B,SAAO,KAAK,CAAC;AACf;AAEO,SAAS,YAAY,GAAsD;AAChF,SAAO,eAAe,aAAa,KAAK,UAAU,EAAE,GAAG,EAAE,WAAW,GAAG,EAAE,WAAW,CAAC,CAAC;AACxF;AAEO,SAAS,WAAW,OAAiE;AAC1F,QAAM,IAAI,MAAM,KAAK;AACrB,MAAI,CAAC,EAAG,QAAO;AACf,QAAM,OAAO,EAAE,WAAW,YAAY,IAAI,EAAE,MAAM,aAAa,MAAM,IAAI;AACzE,MAAI;AACJ,MAAI;AACF,UAAM,KAAK,MAAM,aAAa,IAAI,CAAC;AAAA,EACrC,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO;AAC5C,QAAM,IAAI;AACV,QAAM,YAAY,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,KAAK;AACxD,QAAM,aAAa,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,KAAK;AAC1D,MAAI,CAAC,aAAa,CAAC,WAAY,QAAO;AACtC,MAAI,YAAY,WAAW,KAAK,KAAK,YAAY,YAAY,KAAK,EAAG,QAAO;AAC5E,SAAO,EAAE,WAAW,WAAW;AACjC;;;AC1HA,SAAS,UAAAA,eAAc;AACvB,OAAO,UAAU;AACjB,SAAS,gBAAgB,8BAA8B;AACvD,SAAS,mBAAmB,iCAAiC;AAC7D,SAAS,aAAa,4BAA4B;AAClD,SAAS,eAAe,WAAW,4BAA4B;AAoBxD,SAAS,cAAc,OAAgB,OAAuB;AACnE,MAAI,UAAU,UAAa,UAAU,MAAM;AACzC,UAAM,IAAI,MAAM,0BAA0B,KAAK,EAAE;AAAA,EACnD;AACA,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,QAAQ,IAAI;AACd,YAAM,IAAI,MAAM,qBAAqB,KAAK,iCAAiC;AAAA,IAC7E;AACA,WAAO;AAAA,EACT;AACA,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,GAAG;AAC7C,YAAM,IAAI,MAAM,qBAAqB,KAAK,iCAAiC;AAAA,IAC7E;AACA,WAAO,OAAO,KAAK;AAAA,EACrB;AACA,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,MAAM,qBAAqB,KAAK,WAAW;AAAA,IACvD;AACA,QAAI,sBAAsB,KAAK,OAAO,GAAG;AACvC,aAAO,OAAO,OAAO;AAAA,IACvB;AACA,QAAI,CAAC,QAAQ,KAAK,OAAO,GAAG;AAC1B,YAAM,IAAI,MAAM,qBAAqB,KAAK,yBAAyB;AAAA,IACrE;AACA,WAAO,OAAO,OAAO;AAAA,EACvB;AACA,QAAM,IAAI,MAAM,qBAAqB,KAAK,sBAAsB;AAClE;AAoCA,SAAS,SAAS,GAAoC;AACpD,MAAI,OAAO,MAAM,YAAY,MAAM,QAAQ,MAAM,QAAQ,CAAC,GAAG;AAC3D,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,IAAI,EAAE;AAAA,IACN,OAAO,cAAc,EAAE,SAAS,KAAK,OAAO;AAAA,IAC5C,MAAM,EAAE;AAAA,IACR,SAAS,EAAE;AAAA,IACX,KAAK,cAAc,EAAE,KAAK,KAAK;AAAA,IAC/B,sBAAsB,cAAc,EAAE,sBAAsB,sBAAsB;AAAA,IAClF,cAAc,cAAc,EAAE,cAAc,cAAc;AAAA,IAC1D,OAAO,EAAE;AAAA,EACX;AACF;AAEA,SAAS,WAAW,KAAyB;AAC3C,SAAO,IAAI,WAAWA,QAAO,KAAK,IAAI,QAAQ,OAAO,EAAE,GAAG,KAAK,CAAC;AAClE;AACA,SAAS,WAAW,OAA2B;AAC7C,SAAOA,QAAO,KAAK,KAAK,EAAE,SAAS,KAAK;AAC1C;AAEA,SAAS,cACP,sBACA,SACA,OACkD;AAClD,QAAM,gBAAgB;AAAA,IACpB,qBAAqB,qBAAqB,QAAQ,OAAO,EAAE,EAAE,YAAY;AAAA,IACzE,QAAQ,QAAQ;AAAA,IAChB,iBAAiB,QAAQ;AAAA,IACzB,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,EACpC;AACA,QAAM,kBAAkB,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,aAAa,CAAC;AAC9E,QAAM,UAAU,KAAK,KAAK,QAAQ,SAAS,WAAW,MAAM,UAAU,CAAC;AACvE,QAAM,WAAW,KAAK,KAAK,SAAS,iBAAiB,QAAQ,SAAS;AACtE,SAAO;AAAA,IACL,aAAa,WAAW,eAAe;AAAA,IACvC,iBAAiB,WAAW,QAAQ;AAAA,EACtC;AACF;AAEO,SAAS,mBAAmB,IAA2B;AAC5D,SAAO,UAAU,qBAAqB,SAAS,EAAE,CAAC,CAAC;AACrD;AAEO,SAAS,qBAAqB,UAA0B;AAC7D,QAAM,MAAMA,QAAO,KAAK,UAAU,QAAQ;AAC1C,MAAI,IAAI;AACR,MAAI,WAAW;AACf,MAAI,QAAQ;AACZ,aAAS;AACP,UAAM,IAAI,IAAI,GAAG;AACjB,iBAAa,IAAI,QAAS;AAC1B,SAAK,IAAI,SAAU,EAAG;AACtB,aAAS;AAAA,EACX;AACA,MAAI,WAAW,GAAG;AAChB,UAAM,IAAI,MAAM,kCAAkC;AAAA,EACpD;AACA,SAAO,WAAW,IAAI,WAAW,IAAI,SAAS,IAAI,WAAW,EAAE,CAAC,CAAC;AACnE;AAEO,SAAS,oBAAoB,UAAsD;AACxF,QAAM,MAAMA,QAAO,KAAK,UAAU,QAAQ;AAC1C,MAAI;AACF,WAAO,YAAY,KAAK,GAAG;AAAA,EAC7B,QAAQ;AACN,WAAO,qBAAqB,YAAY,IAAI,WAAW,GAAG,CAAC;AAAA,EAC7D;AACF;AAaO,SAAS,mBACd,KACA,SACA,OACc;AACd,MAAI,CAAC,QAAQ,UAAU;AACrB,UAAM,IAAI,MAAM,uDAAuD;AAAA,EACzE;AACA,MAAI,CAAC,QAAQ,SAAS,CAAC,QAAQ,gBAAgB;AAC7C,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AACA,SAAO,IAAI,IAAI,CAAC,MAAM;AACpB,UAAM,UACJ,EAAE,OAAO,WACL,qBAAqB,EAAE,WAAqB,IAC5C,mBAAmB,EAAE,WAAqB;AAChD,UAAM,EAAE,aAAa,gBAAgB,IAAI,cAAc,SAAS,SAAS,KAAK;AAC9E,WAAO,EAAE,SAAS,MAAM,WAAW,aAAa,gBAAgB;AAAA,EAClE,CAAC;AACH;AAEO,SAAS,kBAAkB,WAA+C;AAC/E,SAAO,cAAc,SAAS;AAChC;AAEO,SAAS,kBACd,WACA,SACA,OACY;AACZ,MAAI,CAAC,QAAQ,UAAU;AACrB,UAAM,IAAI,MAAM,qDAAqD;AAAA,EACvE;AACA,MAAI,CAAC,QAAQ,SAAS,CAAC,QAAQ,gBAAgB;AAC7C,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AACA,QAAM,EAAE,aAAa,gBAAgB,IAAI;AAAA,IACvC,kBAAkB,SAAS;AAAA,IAC3B;AAAA,IACA;AAAA,EACF;AACA,SAAO,EAAE,SAAS,MAAM,WAAW,aAAa,gBAAgB;AAClE;AAEO,SAAS,wBACd,mBACA,SACA,OACY;AACZ,MAAI,CAAC,QAAQ,UAAU;AACrB,UAAM,IAAI,MAAM,qDAAqD;AAAA,EACvE;AACA,MAAI,CAAC,QAAQ,SAAS,CAAC,QAAQ,gBAAgB;AAC7C,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AACA,QAAM,EAAE,aAAa,gBAAgB,IAAI;AAAA,IACvC,qBAAqB,iBAAiB;AAAA,IACtC;AAAA,IACA;AAAA,EACF;AACA,SAAO,EAAE,SAAS,MAAM,WAAW,aAAa,gBAAgB;AAClE;AAmCO,SAAS,sBAAsB,OAGpC;AACA,QAAM,kBAAkB,IAAI,YAAY,EAAE;AAAA,IACxC,KAAK,UAAU,EAAE,YAAW,oBAAI,KAAK,GAAE,YAAY,EAAE,CAAC;AAAA,EACxD;AACA,QAAM,UAAU,KAAK,KAAK,QAAQ,SAAS,WAAW,MAAM,UAAU,CAAC;AACvE,QAAM,WAAW,KAAK,KAAK,SAAS,iBAAiB,QAAQ,SAAS;AACtE,SAAO;AAAA,IACL,aAAa,WAAW,eAAe;AAAA,IACvC,iBAAiB,WAAW,QAAQ;AAAA,EACtC;AACF;AAaA,eAAsB,WACpB,QACA,OACA,SACA,WAC6B;AAC7B,MAAI,CAAC,QAAQ,UAAU;AACrB,WAAO,EAAE,IAAI,OAAO,OAAO,wDAAwD;AAAA,EACrF;AACA,MAAI,CAAC,QAAQ,SAAS,CAAC,QAAQ,gBAAgB;AAC7C,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,OACE;AAAA,IAEJ;AAAA,EACF;AAEA,QAAM,YAAY,OAAO,WAA0B;AACjD,UAAM,SAAS,MAAM,UAAU,cAAc,QAAQ,SAAS,KAAK,CAAC;AACpE,UAAM,EAAE,GAAG,GAAG,YAAY,IAAI,OAAO;AACrC,QAAI,KAAK,QAAQ,KAAK,QAAQ,eAAe,MAAM;AACjD,YAAM,IAAI,MAAM,0EAA0E;AAAA,IAC5F;AACA,WAAO;AAAA,MACL,GAAG,KAAK,CAAC;AAAA,MACT,GAAG,KAAK,CAAC;AAAA,MACT,SAAS;AAAA,IACX;AAAA,EACF;AACA,QAAM,cAAc,OAAO,YAAwB;AACjD,UAAM,SAAS,MAAM,UAAU,cAAc,WAAW,OAAO,GAAG,SAAS,KAAK,CAAC;AACjF,UAAM,MAAM,OAAO,UAAU;AAC7B,QAAI,CAAC,IAAK,OAAM,IAAI,MAAM,oEAAoE;AAC9F,WAAO,WAAW,GAAG;AAAA,EACvB;AAEA,MAAI;AACF,YAAQ,OAAO,IAAI;AAAA,MACjB,KAAK;AACH,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,UAAU,EAAE,WAAW,MAAM,IAAI,eAAe,SAAS,EAAE,YAAY,OAAO,OAAO,EAAE;AAAA,QACzF;AAAA,MACF,KAAK;AACH,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,UAAU;AAAA,YACR,WAAW,MAAM,IAAI,eAAe,SAAS,EAAE,cAAc,OAAO,SAAS;AAAA,UAC/E;AAAA,QACF;AAAA,MACF,KAAK;AACH,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,UAAU;AAAA,YACR,uBAAuB,MAAM,IAAI,eAAe,SAAS,EAAE;AAAA,cACzD,SAAS,OAAO,WAAW;AAAA,YAC7B;AAAA,UACF;AAAA,QACF;AAAA,MACF,KAAK;AACH,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,UAAU;AAAA,YACR,eAAe,MAAM,IAAI,eAAe,SAAS,EAAE;AAAA,cACjD,OAAO;AAAA,YACT;AAAA,UACF;AAAA,QACF;AAAA,MACF,KAAK,iBAAiB;AACpB,cAAM,MAAM,MAAM,IAAI,kBAAkB,aAAa,OAAO,OAAO,EAAE;AAAA,UACnE,OAAO;AAAA,QACT;AACA,eAAO,EAAE,IAAI,MAAM,UAAU,EAAE,WAAW,WAAW,GAAG,EAAE,EAAE;AAAA,MAC9D;AAAA,MACA,KAAK,qBAAqB;AACxB,cAAM,KAAK,oBAAoB,OAAO,iBAAiB;AACvD,cAAM,SAAS,MAAM,IAAI,kBAAkB,aAAa,OAAO,OAAO,EAAE;AAAA,UACtE;AAAA,QACF;AACA,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,UAAU,EAAE,yBAAyBC,QAAO,KAAK,MAAM,EAAE,SAAS,QAAQ,EAAE;AAAA,QAC9E;AAAA,MACF;AAAA,MACA,KAAK,OAAO;AACV,cAAM,SAAS,MAAM,UAAU,cAAc,OAAO,sBAAsB,SAAS,KAAK,CAAC;AACzF,eAAO,EAAE,IAAI,MAAM,UAAU,EAAE,QAAQ,OAAO,QAAQ,WAAW,OAAO,UAAU,EAAE;AAAA,MACtF;AAAA,MACA;AACE,eAAO,EAAE,IAAI,OAAO,OAAO,eAAgB,OAA2B,EAAE,GAAG;AAAA,IAC/E;AAAA,EACF,SAAS,KAAK;AACZ,QAAI,eAAe,0BAA0B,eAAe,2BAA2B;AACrF,aAAO,EAAE,IAAI,OAAO,OAAO,IAAI,QAAQ;AAAA,IACzC;AACA,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,WAAO,EAAE,IAAI,OAAO,OAAO,QAAQ;AAAA,EACrC;AACF;;;AClYO,SAAS,eAAe,OAAsB;AACnD,MAAI,MAAM,KAAK,EAAE,WAAW,WAAW,GAAG;AACxC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,KAAK,WAAW,KAAK;AAC3B,MAAI,CAAC,IAAI;AACP,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AACA,SAAO,EAAE,WAAW,GAAG,WAAW,YAAY,GAAG,YAAY,SAAS,KAAK,IAAI,EAAE;AACnF;AAEA,SAAS,UAAU,GAAmC;AACpD,SAAO,EAAE,UAAU,EAAE,WAAW,OAAO,EAAE,UAAU,IAAI,gBAAgB,EAAE,mBAAmB,GAAG;AACjG;AAEA,eAAe,eACb,MACA,WACA,OACwB;AACxB,QAAM,MAAM,sBAAsB,KAAK;AACvC,QAAM,IAAK,MAAM,KAAK,mBAAmB,SAAS,YAAY;AAAA,IAC5D,SAAS,MAAM;AAAA,IACf,aAAa,IAAI;AAAA,IACjB,iBAAiB,IAAI;AAAA,EACvB,CAAC;AACD,SAAO,UAAU,CAAC;AACpB;AAEA,eAAsB,kBACpB,MACA,WACA,QACA,OACA,SACkC;AAClC,QAAM,WACJ,WAAW,QAAQ,UAAU,QAAQ,kBACjC,UAAU,OAAO,IACjB,MAAM,eAAe,MAAM,WAAW,KAAK;AACjD,QAAM,YAAY,CAAC,aACjB,KAAK,mBAAmB,SAAS,eAAe;AAAA,IAC9C,SAAS,MAAM;AAAA,IACf,GAAG;AAAA,EACL,CAAC;AACH,QAAM,SAAS,MAAM,WAAW,QAAQ,OAAO,UAAU,SAAS;AAClE,MAAI,CAAC,OAAO,GAAI,OAAM,IAAI,MAAM,OAAO,KAAK;AAC5C,QAAM,KAAK,mBAAmB,SAAS,cAAc,EAAE,UAAU,OAAO,SAAS,CAAC;AAClF,SAAO,OAAO;AAChB;AAEA,SAAS,wBAAwB,MAAyB;AACxD,QAAM,MAAM,KAAK;AACjB,QAAM,SAAS,IAAI,KAAK,CAAC,MAAM,EAAE,OAAO,QAAQ;AAChD,SAAO,UAAU,IAAI;AAAA,IACnB,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,SAAS,sBAAsB,EAAE,SAAS;AAAA,EAC1E;AACF;AAEA,eAAe,YAAY,MAAc,WAAqC;AAC5E,QAAM,IAAK,MAAM,KAAK,mBAAmB,SAAS,YAAY,CAAC,CAAC;AAChE,MAAI,CAAC,KAAK,OAAO,EAAE,SAAS,YAAY,EAAE,SAAS,MAAM;AACvD,UAAM,IAAI,MAAM,0BAA0B;AAAA,EAC5C;AACA,SAAO,EAAE;AACX;AAEA,eAAe,gBAAgB,MAAc,WAAsC;AACjF,QAAM,YAAa,MAAM,YAAY,MAAM,SAAS;AACpD,MAAI,CAAC,MAAM,QAAQ,UAAU,GAAG,KAAK,UAAU,IAAI,WAAW,GAAG;AAC/D,UAAM,IAAI,MAAM,0CAA0C;AAAA,EAC5D;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,MAAyB;AACjD,SAAO,KAAK,MAAM,SAAS;AAC7B;AAEA,eAAe,oBAAoB,MAAc,WAAoC;AACnF,QAAM,YAAa,MAAM,YAAY,MAAM,SAAS;AACpD,QAAM,KAAK,UAAU,QAAQ;AAC7B,MAAI,OAAO,OAAO,YAAY,GAAG,WAAW,GAAG;AAC7C,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AACA,SAAO;AACT;AAEA,eAAsB,gBACpB,MACA,WACA,MACA,OACe;AACf,QAAM,WAAW,wBAAwB,IAAI,IACzC,MAAM,gBAAgB,MAAM,SAAS,IACrC;AACJ,MAAI,UAAyB;AAAA,IAC3B,UAAU,SAAS,QAAQ;AAAA,IAC3B,OAAO,SAAS,QAAQ,UAAU;AAAA,IAClC,gBAAgB,SAAS,QAAQ,mBAAmB;AAAA,EACtD;AACA,MAAI,QAAQ,aAAa,CAAC,QAAQ,SAAS,CAAC,QAAQ,iBAAiB;AACnE,cAAU,MAAM,eAAe,MAAM,WAAW,KAAK;AAAA,EACvD;AACA,QAAM,YAA0B,mBAAmB,SAAS,KAAK,SAAS,KAAK;AAC/E,QAAM,KAAK,mBAAmB,SAAS,cAAc,EAAE,UAAU,CAAC;AACpE;AAEA,eAAsB,gBACpB,MACA,WACA,MACA,OACe;AACf,MAAI,UAAyB;AAAA,IAC3B,UAAU,KAAK,QAAQ;AAAA,IACvB,OAAO,KAAK,QAAQ,UAAU;AAAA,IAC9B,gBAAgB,KAAK,QAAQ,mBAAmB;AAAA,EAClD;AACA,MAAI,QAAQ,aAAa,CAAC,QAAQ,SAAS,CAAC,QAAQ,iBAAiB;AACnE,cAAU,MAAM,eAAe,MAAM,WAAW,KAAK;AAAA,EACvD;AACA,QAAM,WAAuB,iBAAiB,IAAI,IAC9C,wBAAwB,MAAM,oBAAoB,MAAM,SAAS,GAAG,SAAS,KAAK,IAClF;AAAA,IACE,KAAK;AAAA,IACL;AAAA,IACA;AAAA,EACF;AACJ,QAAM,KAAK,mBAAmB,SAAS,cAAc,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC;AAChF;;;ACxJA,IAAM,mBAAmB;AAgBzB,SAAS,aAAa,MAAsB;AAC1C,QAAM,SAAS,KACZ,MAAM,OAAO,EACb,OAAO,CAAC,SAAS,KAAK,WAAW,OAAO,CAAC,EACzC,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC;AACrC,SAAO,OAAO,WAAW,IAAI,OAAO,OAAO,KAAK,EAAE;AACpD;AAEA,SAAS,UAAU,QAA+B;AAChD,SAAO,OAAO,QACX,OAAO,CAAC,SAAS,KAAK,SAAS,UAAU,OAAO,KAAK,SAAS,QAAQ,EACtE,IAAI,CAAC,SAAS,KAAK,IAAI,EACvB,KAAK,IAAI;AACd;AAEO,SAAS,SAAY,MAAc,QAA0B;AAClE,MAAI,OAAO,SAAS;AAClB,UAAM,IAAI,MAAM,UAAU,MAAM,KAAK,UAAU,IAAI,SAAS;AAAA,EAC9D;AACA,QAAM,OAAO,OAAO,QAAQ;AAAA,IAC1B,CAAC,SAAS,KAAK,SAAS,UAAU,OAAO,KAAK,SAAS;AAAA,EACzD,GAAG;AACH,MAAI,OAAO,SAAS,UAAU;AAC5B,UAAM,IAAI,MAAM,UAAU,IAAI,2BAA2B;AAAA,EAC3D;AACA,SAAO,KAAK,MAAM,IAAI;AACxB;AAEO,IAAM,eAAN,MAAmB;AAAA,EACP;AAAA,EACA;AAAA,EACA;AAAA,EACT,SAAS;AAAA,EACT;AAAA,EAER,YAAY,SAA8B;AACxC,SAAK,WAAW,GAAG,QAAQ,OAAO;AAClC,SAAK,SAAS,QAAQ;AACtB,SAAK,YAAY,QAAQ;AAAA,EAC3B;AAAA,EAEA,MAAM,SACJ,MACA,MACwB;AACxB,UAAM,KAAK,WAAW;AACtB,WAAO,KAAK,IAAI,cAAc,EAAE,MAAM,WAAW,KAAK,CAAC;AAAA,EACzD;AAAA,EAEA,MAAc,aAA4B;AACxC,SAAK,mBAAmB,KAAK,IAAa,cAAc;AAAA,MACtD,iBAAiB;AAAA,MACjB,cAAc,CAAC;AAAA,MACf,YAAY,EAAE,MAAM,cAAc,SAAS,IAAI;AAAA,IACjD,CAAC,EAAE,KAAK,MAAM,KAAK,OAAO,6BAA6B,CAAC,CAAC,CAAC;AAC1D,QAAI;AACF,YAAM,KAAK;AAAA,IACb,SAAS,OAAO;AACd,WAAK,iBAAiB;AACtB,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAc,KACZ,SACA,QACiB;AACjB,UAAM,WAAW,MAAM,KAAK,UAAU,KAAK,UAAU;AAAA,MACnD,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,QAAQ;AAAA,QACR,eAAe,UAAU,MAAM,KAAK,OAAO,CAAC;AAAA,QAC5C,gBAAgB;AAAA,QAChB,wBAAwB;AAAA,MAC1B;AAAA,MACA,MAAM,KAAK,UAAU,OAAO;AAAA,IAC9B,CAAC;AACD,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,cAAc,MAAM,YAAY,SAAS,MAAM,MAAM,IAAI;AAAA,MAC3D;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,OAAO,QAAgB,QAAgC;AACnE,UAAM,KAAK,KAAK,EAAE,SAAS,OAAO,QAAQ,OAAO,GAAG,MAAM;AAAA,EAC5D;AAAA,EAEA,MAAc,IAAO,QAAgB,QAA6B;AAChE,UAAM,OAAO,MAAM,KAAK;AAAA,MACtB;AAAA,QACE,SAAS;AAAA,QACT,IAAI,EAAE,KAAK;AAAA,QACX;AAAA,QACA;AAAA,MACF;AAAA,MACA;AAAA,IACF;AACA,UAAM,SAAS,KAAK,MAAM,aAAa,IAAI,CAAC;AAC5C,QAAI,OAAO,OAAO;AAChB,YAAM,IAAI;AAAA,QACR,cAAc,MAAM,YAAY,OAAO,MAAM,IAAI,MAAM,OAAO,MAAM,OAAO;AAAA,MAC7E;AAAA,IACF;AACA,QAAI,OAAO,WAAW,QAAW;AAC/B,YAAM,IAAI,MAAM,cAAc,MAAM,qBAAqB;AAAA,IAC3D;AACA,WAAO,OAAO;AAAA,EAChB;AACF;;;AC9EA,IAAM,mBAAmB;AACzB,IAAM,iBAAiB;AAEvB,SAAS,yBACP,QACA,UACiD;AACjD,QAAM,cACJ,SAAS,WAAW,sBAAsB,SAAS,WAAW;AAChE,SAAO,EAAE,GAAG,QAAQ,UAAU,MAAM,cAAc,OAAO,OAAO,KAAK;AACvE;AAEO,SAAS,aAAa,GAAqD;AAChF,SAAO,GAAG,WAAW,YAAY,GAAG,WAAW;AACjD;AAEO,IAAM,cAAN,cAA0B,MAAM;AAAA,EACrC,YACW,QACA,MACT,SACA;AACA,UAAM,UAAU,OAAO,YAAY,MAAM,MAAM,IAAI,EAAE;AAJ5C;AACA;AAIT,SAAK,OAAO;AAAA,EACd;AACF;AAeO,IAAM,eAAN,MAAM,cAAa;AAAA,EACf;AAAA,EACQ;AAAA,EACA;AAAA,EACT;AAAA,EACA,eAAe;AAAA,EACN;AAAA,EAEjB,YAAY,UAA+B,CAAC,GAAG;AAC7C,SAAK,OAAO;AACZ,SAAK,WAAW,QAAQ,WAAW,kBAAkB,QAAQ,QAAQ,EAAE;AACvE,SAAK,YAAY,QAAQ,aAAa;AACtC,SAAK,MAAM,IAAI,aAAa;AAAA,MAC1B,SAAS,KAAK;AAAA,MACd,QAAQ,MAAM,KAAK,OAAO;AAAA,MAC1B,WAAW,KAAK;AAAA,IAClB,CAAC;AAAA,EACH;AAAA,EAEA,OAAO,WAAW,YAAiC,CAAC,GAAiB;AACnE,UAAM,MAAM,WAAW;AACvB,UAAM,SAAS,IAAI,cAAa;AAAA,MAC9B,SAAS,UAAU,WAAW,QAAQ,IAAI,kBAAkB,IAAI;AAAA,MAChE,QAAQ,UAAU,UAAU,QAAQ,IAAI,kBAAkB,IAAI;AAAA,MAC9D,OAAO,UAAU,SAAS,QAAQ,IAAI;AAAA,MACtC,YAAY,UAAU,cAAc,QAAQ,IAAI,sBAAsB,IAAI;AAAA,MAC1E,WAAW,UAAU;AAAA,IACvB,CAAC;AACD,QAAI,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO;AAC1D,aAAO,QAAQ,IAAI;AACnB,aAAO,eAAe;AAAA,IACxB;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,eAAe;AACrB,QAAI,CAAC,KAAK,KAAK,WAAY,QAAO;AAClC,QAAI;AACF,aAAO,eAAe,KAAK,KAAK,UAAU;AAAA,IAC5C,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,IAAI,UAAmB;AACrB,WAAO,KAAK,aAAa,MAAM;AAAA,EACjC;AAAA,EAEA,MAAc,SAA0B;AACtC,QAAI,KAAK,KAAK,MAAO,QAAO,KAAK,KAAK;AACtC,QAAI,KAAK,KAAK,OAAQ,QAAO,KAAK,KAAK;AACvC,QAAI,KAAK,OAAO;AACd,UAAI,KAAK,MAAM,aAAa,KAAK,IAAI,IAAI,KAAK,MAAM,YAAY,gBAAgB;AAC9E,aAAK,QAAQ,MAAM,cAAc,KAAK,SAAS,KAAK,KAAK;AACzD,YAAI,KAAK,cAAc;AACrB,gBAAM,MAAM,WAAW;AACvB,cAAI,QAAQ,KAAK;AACjB,qBAAW,GAAG;AAAA,QAChB;AAAA,MACF;AACA,aAAO,KAAK,MAAM;AAAA,IACpB;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,QACZ,QACA,MACA,OAAuE,CAAC,GAC5D;AACZ,UAAM,MAAM,IAAI,IAAI,KAAK,UAAU,IAAI;AACvC,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,GAAG;AACrD,UAAI,KAAK,KAAM,KAAI,aAAa,IAAI,GAAG,CAAC;AAAA,IAC1C;AACA,UAAM,UAAkC,EAAE,eAAe,UAAU,MAAM,KAAK,OAAO,CAAC,GAAG;AACzF,QAAI;AACJ,QAAI,KAAK,SAAS,QAAW;AAC3B,cAAQ,cAAc,IAAI;AAC1B,aAAO,KAAK,UAAU,KAAK,IAAI;AAAA,IACjC;AACA,UAAM,MAAM,MAAM,KAAK,UAAU,KAAK,EAAE,QAAQ,SAAS,KAAK,CAAC;AAC/D,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,QAAI,CAAC,IAAI,GAAI,OAAM,IAAI,YAAY,IAAI,QAAQ,MAAM,GAAG,MAAM,IAAI,IAAI,EAAE;AACxE,WAAQ,OAAO,KAAK,MAAM,IAAI,IAAI;AAAA,EACpC;AAAA,EAEiB,SAAiB,CAAC,MAAM,SAAS,KAAK,QAAiB,QAAQ,MAAM,EAAE,KAAK,CAAC;AAAA,EAE9F,kBAAiD;AAC/C,WAAO,KAAK,QAAQ,OAAO,eAAe;AAAA,EAC5C;AAAA,EAEA,wBAAwB,MAA2D;AACjF,WAAO,KAAK,QAAQ,QAAQ,oBAAoB,EAAE,MAAM,KAAK,CAAC;AAAA,EAChE;AAAA,EAEA,aAAa,MAAuC;AAClD,WAAO,KAAK,QAAQ,OAAO,oBAAoB;AAAA,MAC7C,OAAO;AAAA,QACL,SAAS,KAAK;AAAA,QACd,aAAa,KAAK;AAAA,QAClB,OAAO,KAAK;AAAA,QACZ,YAAY,KAAK,aAAa,OAAO,OAAO,KAAK,SAAS,IAAI;AAAA,MAChE;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,oBAAoB,MAAmE;AACrF,UAAM,OAAoC;AAAA,MACxC,SAAS,KAAK;AAAA,MACd,YAAY,KAAK;AAAA,MACjB,uBAAuB,KAAK;AAAA,IAC9B;AACA,WAAO,KAAK,QAAQ,QAAQ,0CAA0C,EAAE,KAAK,CAAC;AAAA,EAChF;AAAA,EAEA,eAAe,MAA2C;AACxD,UAAM,YAAsD;AAAA,MAC1D,MAAM;AAAA,MACN,eAAe,KAAK;AAAA,MACpB,UAAU,KAAK;AAAA,MACf,cAAc,KAAK;AAAA,MACnB,cAAc,KAAK;AAAA,MACnB,UAAU,KAAK,YAAY;AAAA,IAC7B;AACA,WAAO,KAAK,QAAQ,QAAQ,kBAAkB,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAAA,EACvE;AAAA,EAEA,cAAc,MAA0C;AACtD,UAAM,YAAoD;AAAA,MACxD,MAAM;AAAA,MACN,eAAe,KAAK;AAAA,MACpB,KAAK,KAAK,OAAO;AAAA,MACjB,SAAS,KAAK,WAAW;AAAA,IAC3B;AACA,WAAO,KAAK,QAAQ,QAAQ,kBAAkB,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAAA,EACvE;AAAA,EAEA,MAAM,kBAAkB,MAAsB,OAAoB,CAAC,GAA2B;AAC5F,WAAO,KAAK;AAAA,MACV,YAAY;AACV,cAAM,YAA6D;AAAA,UACjE,MAAM;AAAA,UACN,eAAe,KAAK;AAAA,UACpB,QAAQ,KAAK;AAAA,QACf;AACA,cAAM,EAAE,UAAU,QAAQ,IAAI,MAAM,KAAK;AAAA,UACvC;AAAA,UACA;AAAA,UACA,EAAE,MAAM,EAAE,UAAU,EAAE;AAAA,QACxB;AACA,cAAM,QAAQ,KAAK,aAAa;AAChC,aACG,KAAK,YAAY,SAClB,SAAS,WAAW,uBACpB,OACA;AACA,gBAAM,OAAO,MACX,kBAAkB,KAAK,QAAQ,SAAS,YAAY,KAAK,QAAQ,OAAO,OAAO;AACjF,gBAAM,KAAK,kBAAkB,SAAS,YAAY,IAAI;AACtD,iBAAO,KAAK,WAAW,SAAS,UAAU;AAAA,QAC5C;AACA,eAAO;AAAA,MACT;AAAA,MACA,CAAC,MAAM;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAM,YAAY,MAAgB,OAAoB,CAAC,GAAwB;AAC7E,WAAO,KAAK;AAAA,MACV,YAAY;AACV,cAAM,YAAgD;AAAA,UACpD,MAAM;AAAA,UACN,eAAe,KAAK;AAAA,UACpB,WAAW,KAAK;AAAA,UAChB,WAAW,KAAK,YAAY,KAAK;AAAA,UACjC,WAAW,KAAK;AAAA,UAChB,WAAW,KAAK;AAAA,UAChB,QAAQ,KAAK;AAAA,UACb,gBAAgB,KAAK,iBAAiB;AAAA,UACtC,cAAc,KAAK,eAAe;AAAA,UAClC,WAAW,KAAK,aAAa;AAAA,UAC7B,aAAa,KAAK,cAAc;AAAA,QAClC;AACA,cAAM,SAAS,MAAM,KAAK,QAAoB,QAAQ,eAAe;AAAA,UACnE,MAAM,EAAE,UAAU;AAAA,QACpB,CAAC;AACD,eAAO,KAAK,aAAa,QAAQ,IAAI;AAAA,MACvC;AAAA,MACA,CAAC,MAAM,EAAE;AAAA,IACX;AAAA,EACF;AAAA,EAEA,MAAc,aAAa,QAAoB,MAAwC;AACrF,UAAM,QAAQ,KAAK,aAAa;AAChC,QAAI,EAAE,KAAK,YAAY,SAAS,CAAC,OAAO;AACtC,aAAO,yBAAyB,QAAQ,OAAO,QAAQ;AAAA,IACzD;AACA,QAAI,WAAW,OAAO;AACtB,QAAI,SAAS,WAAW,sBAAsB,KAAK,iBAAiB;AAClE,iBAAW,MAAM,KAAK,kBAAkB,SAAS,YAAY,KAAK,eAAe;AAAA,IACnF;AACA,QAAI,SAAS,WAAW,qBAAqB;AAC3C,aAAO,yBAAyB,QAAQ,QAAQ;AAAA,IAClD;AACA,UAAM,OAAO,OAAO;AACpB,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,MAAM,+DAA+D;AAAA,IACjF;AACA,UAAM,OAAO,MAAM,gBAAgB,KAAK,QAAQ,SAAS,YAAY,MAAM,KAAK;AAChF,UAAM,KAAK,kBAAkB,SAAS,YAAY,IAAI;AACtD,WAAO;AAAA,MACL;AAAA,MACA,MAAM,KAAK,iBAAiB,SAAS,YAAY,KAAK,eAAe;AAAA,IACvE;AAAA,EACF;AAAA,EAEA,MAAc,kBACZ,WACA,MACwB;AACxB,UAAM,IAAI,OAAO,SAAS,WAAW,OAAO,CAAC;AAC7C,UAAM,WAAW,EAAE,cAAc;AACjC,UAAM,WAAW,KAAK,IAAI,KAAK,EAAE,aAAa;AAC9C,eAAS;AACP,YAAM,IAAI,MAAM,KAAK,WAAW,SAAS;AACzC,UAAI,EAAE,WAAW,sBAAsB,KAAK,IAAI,IAAI,SAAU,QAAO;AACrE,YAAM,IAAI,QAAQ,CAAC,QAAQ,WAAW,KAAK,QAAQ,CAAC;AAAA,IACtD;AAAA,EACF;AAAA,EAEA,MAAc,gBACZ,KACA,YACY;AACZ,UAAM,QAAQ,MAAM,IAAI;AACxB,UAAM,IAAI,WAAW,KAAK;AAC1B,QAAI,aAAa,CAAC,KAAK,EAAE,WAAW;AAClC,aAAO,IAAI;AAAA,IACb;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,kBAAkB,WAAmB,MAA6C;AAC9F,QAAI;AACF,YAAM,KAAK;AAAA,IACb,QAAQ;AACN,YAAM,aAAa,MAAM,KAAK,WAAW,SAAS;AAClD,UAAI,WAAW,WAAW,oBAAqB;AAC/C,YAAM,KAAK;AAAA,IACb;AAAA,EACF;AAAA,EAEA,MAAM,iBACJ,OACA,OAAgC,CAAC,GACN;AAC3B,UAAM,SAAS,MAAM,KAAK,QAAwC,OAAO,mBAAmB;AAAA,MAC1F,OAAO;AAAA,QACL;AAAA,QACA,SAAS,KAAK,YAAY,QAAQ,SAAY,KAAK;AAAA,QACnD,KAAK,KAAK,MAAM,SAAS;AAAA,MAC3B;AAAA,IACF,CAAC;AACD,WAAO,OAAO;AAAA,EAChB;AAAA,EAEA,MAAM,qBACJ,OACA,OAAoC,CAAC,GACN;AAC/B,WAAO,KAAK,QAA8B,OAAO,mBAAmB;AAAA,MAClE,OAAO;AAAA,QACL;AAAA,QACA,SAAS,KAAK,YAAY,QAAQ,SAAY,KAAK;AAAA,QACnD,QAAQ,KAAK,SAAS,IAAI,SAAS;AAAA,QACnC,QAAQ,KAAK;AAAA,QACb,KAAK,KAAK,MAAM,SAAS;AAAA,MAC3B;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,gBAAgB,OAA4B,CAAC,GAAiC;AAClF,WAAO;AAAA,MACL;AAAA,MACA,MAAM,KAAK,IAAI,SAAS,oBAAoB;AAAA,QAC1C,OAAO,KAAK;AAAA,QACZ,QAAQ,KAAK;AAAA,QACb,QAAQ,KAAK;AAAA,QACb,OAAO,KAAK;AAAA,QACZ,QAAQ,KAAK;AAAA,MACf,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAM,kBAAkB,aAAoD;AAC1E,WAAO;AAAA,MACL;AAAA,MACA,MAAM,KAAK,IAAI,SAAS,gBAAgB,EAAE,cAAc,YAAY,CAAC;AAAA,IACvE;AAAA,EACF;AAAA,EAEA,UAAU,MAA6C;AACrD,WAAO,KAAK,IAAI,SAAS,cAAc;AAAA,MACrC,WAAW,KAAK;AAAA,MAChB,SAAS,KAAK;AAAA,MACd,OAAO,KAAK;AAAA,MACZ,eAAe,KAAK;AAAA,IACtB,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,QAAQ,MAAgB,OAAoB,CAAC,GAAwB;AACzE,WAAO,KAAK;AAAA,MACV,YAAY;AACV,cAAM,SAAS,MAAM,KAAK,QAAoB,QAAQ,eAAe;AAAA,UACnE,MAAM;AAAA,YACJ,eAAe,KAAK;AAAA,YACpB,SAAS,KAAK;AAAA,YACd,cAAc,KAAK;AAAA,UACrB;AAAA,QACF,CAAC;AACD,eAAO,KAAK,aAAa,QAAQ,IAAI;AAAA,MACvC;AAAA,MACA,CAAC,MAAM,EAAE;AAAA,IACX;AAAA,EACF;AAAA,EAEA,MAAM,WAAW,MAAsB,OAAoB,CAAC,GAAwB;AAClF,WAAO,KAAK;AAAA,MACV,YAAY;AACV,cAAM,SAAS,MAAM,KAAK,QAAoB,QAAQ,sBAAsB;AAAA,UAC1E,MAAM;AAAA,YACJ,eAAe,KAAK;AAAA,YACpB,KAAK,KAAK;AAAA,YACV,QAAQ,KAAK;AAAA,YACb,MAAM,KAAK;AAAA,UACb;AAAA,QACF,CAAC;AACD,eAAO,KAAK,aAAa,QAAQ,IAAI;AAAA,MACvC;AAAA,MACA,CAAC,MAAM,EAAE;AAAA,IACX;AAAA,EACF;AAAA,EAEA,MAAc,aAAa,QAAoB,MAAwC;AACrF,UAAM,QAAQ,KAAK,aAAa;AAChC,QAAI,EAAE,KAAK,YAAY,SAAS,CAAC,OAAO;AACtC,aAAO,yBAAyB,QAAQ,OAAO,QAAQ;AAAA,IACzD;AACA,QAAI,WAAW,OAAO;AACtB,QAAI,SAAS,WAAW,sBAAsB,KAAK,iBAAiB;AAClE,iBAAW,MAAM,KAAK,kBAAkB,SAAS,YAAY,KAAK,eAAe;AAAA,IACnF;AACA,QAAI,SAAS,WAAW,qBAAqB;AAC3C,aAAO,yBAAyB,QAAQ,QAAQ;AAAA,IAClD;AACA,UAAM,OAAO,OAAO;AACpB,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,MAAM,gEAAgE;AAAA,IAClF;AACA,UAAM,OAAO,MAAM,gBAAgB,KAAK,QAAQ,SAAS,YAAY,MAAM,KAAK;AAChF,UAAM,KAAK,kBAAkB,SAAS,YAAY,IAAI;AACtD,WAAO;AAAA,MACL;AAAA,MACA,MAAM,KAAK,iBAAiB,SAAS,YAAY,KAAK,eAAe;AAAA,IACvE;AAAA,EACF;AAAA,EAEA,wBAAwB,WAAqD;AAC3E,WAAO,KAAK,QAAQ,QAAQ,mBAAmB,SAAS,cAAc;AAAA,EACxE;AAAA,EAEA,qBAAqB,MAA6C;AAChE,WAAO,KAAK,QAAQ,QAAQ,yBAAyB,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAAA,EACzE;AAAA,EAEA,WAAW,MAA2C;AACpD,WAAO,KAAK,QAAQ,OAAO,mBAAmB;AAAA,MAC5C,OAAO;AAAA,QACL,eAAe,KAAK;AAAA,QACpB,mBAAmB,KAAK;AAAA,QACxB,eAAe,KAAK;AAAA,QACpB,YAAY,KAAK,WAAW,SAAS;AAAA,MACvC;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,eAAe,MAAmD;AAChE,WAAO,KAAK,QAAQ,OAAO,uBAAuB;AAAA,MAChD,OAAO;AAAA,QACL,eAAe,KAAK;AAAA,QACpB,YAAY,KAAK,WAAW,SAAS;AAAA,MACvC;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,WAAW,WAA2C;AACpD,WAAO,KAAK,QAAQ,OAAO,mBAAmB,SAAS,EAAE;AAAA,EAC3D;AAAA,EAEQ,iBACN,WACA,MACwB;AACxB,QAAI,CAAC,KAAM,QAAO,KAAK,WAAW,SAAS;AAC3C,WAAO,KAAK,eAAe,WAAW,OAAO,SAAS,WAAW,OAAO,CAAC,CAAC;AAAA,EAC5E;AAAA,EAEA,MAAM,eACJ,WACA,OAAoD,CAAC,GAC7B;AACxB,UAAM,WAAW,KAAK,cAAc;AACpC,UAAM,WAAW,KAAK,IAAI,KAAK,KAAK,aAAa;AACjD,eAAS;AACP,YAAM,IAAI,MAAM,KAAK,WAAW,SAAS;AACzC,YAAM,UACJ,EAAE,WAAW,sBACb,EAAE,WAAW,uBACb,EAAE,WAAW,wBACb,EAAE,WAAW;AACf,UAAI,CAAC,WAAW,KAAK,IAAI,IAAI,SAAU,QAAO;AAC9C,YAAM,IAAI,QAAQ,CAAC,QAAQ,WAAW,KAAK,QAAQ,CAAC;AAAA,IACtD;AAAA,EACF;AACF;","names":["Buffer","Buffer"]}