@paybox-sh/sdk 1.0.0 → 2.1.0

package/dist/cli.js

@@ -1,23 +1,690 @@
 #!/usr/bin/env node
 import {
   PayboxClient,
-  agentClientId,
   appBaseFrom,
   configDir,
   configFile,
   didNotHappen,
+  encodeToken,
   loadConfig,
   loginDevice,
   openBrowser,
+  pendingFundingResponse,
+  pendingFundingToolResponse,
+  refreshTokens,
   saveConfig
-} from "./chunk-SMPW2GUM.js";
+} from "./chunk-OZ7KVOBT.js";
 
 // src/cli.ts
 import { spawnSync } from "node:child_process";
 import { readFileSync, rmSync } from "node:fs";
 import { createRequire } from "node:module";
-import { createInterface } from "node:readline/promises";
 import { Command } from "commander";
+
+// src/pairing.ts
+import nacl from "tweetnacl";
+
+// node_modules/.pnpm/@noble+hashes@1.8.0/node_modules/@noble/hashes/esm/utils.js
+function isBytes(a) {
+  return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array";
+}
+function abytes(b, ...lengths) {
+  if (!isBytes(b))
+    throw new Error("Uint8Array expected");
+  if (lengths.length > 0 && !lengths.includes(b.length))
+    throw new Error("Uint8Array expected of length " + lengths + ", got length=" + b.length);
+}
+function aexists(instance, checkFinished = true) {
+  if (instance.destroyed)
+    throw new Error("Hash instance has been destroyed");
+  if (checkFinished && instance.finished)
+    throw new Error("Hash#digest() has already been called");
+}
+function aoutput(out, instance) {
+  abytes(out);
+  const min = instance.outputLen;
+  if (out.length < min) {
+    throw new Error("digestInto() expects output buffer of length at least " + min);
+  }
+}
+function clean(...arrays) {
+  for (let i = 0; i < arrays.length; i++) {
+    arrays[i].fill(0);
+  }
+}
+function createView(arr) {
+  return new DataView(arr.buffer, arr.byteOffset, arr.byteLength);
+}
+function rotr(word, shift) {
+  return word << 32 - shift | word >>> shift;
+}
+function utf8ToBytes(str) {
+  if (typeof str !== "string")
+    throw new Error("string expected");
+  return new Uint8Array(new TextEncoder().encode(str));
+}
+function toBytes(data) {
+  if (typeof data === "string")
+    data = utf8ToBytes(data);
+  abytes(data);
+  return data;
+}
+var Hash = class {
+};
+function createHasher(hashCons) {
+  const hashC = (msg) => hashCons().update(toBytes(msg)).digest();
+  const tmp = hashCons();
+  hashC.outputLen = tmp.outputLen;
+  hashC.blockLen = tmp.blockLen;
+  hashC.create = () => hashCons();
+  return hashC;
+}
+
+// node_modules/.pnpm/@noble+hashes@1.8.0/node_modules/@noble/hashes/esm/_md.js
+function setBigUint64(view, byteOffset, value, isLE) {
+  if (typeof view.setBigUint64 === "function")
+    return view.setBigUint64(byteOffset, value, isLE);
+  const _32n = BigInt(32);
+  const _u32_max = BigInt(4294967295);
+  const wh = Number(value >> _32n & _u32_max);
+  const wl = Number(value & _u32_max);
+  const h = isLE ? 4 : 0;
+  const l = isLE ? 0 : 4;
+  view.setUint32(byteOffset + h, wh, isLE);
+  view.setUint32(byteOffset + l, wl, isLE);
+}
+function Chi(a, b, c) {
+  return a & b ^ ~a & c;
+}
+function Maj(a, b, c) {
+  return a & b ^ a & c ^ b & c;
+}
+var HashMD = class extends Hash {
+  constructor(blockLen, outputLen, padOffset, isLE) {
+    super();
+    this.finished = false;
+    this.length = 0;
+    this.pos = 0;
+    this.destroyed = false;
+    this.blockLen = blockLen;
+    this.outputLen = outputLen;
+    this.padOffset = padOffset;
+    this.isLE = isLE;
+    this.buffer = new Uint8Array(blockLen);
+    this.view = createView(this.buffer);
+  }
+  update(data) {
+    aexists(this);
+    data = toBytes(data);
+    abytes(data);
+    const { view, buffer, blockLen } = this;
+    const len = data.length;
+    for (let pos = 0; pos < len; ) {
+      const take = Math.min(blockLen - this.pos, len - pos);
+      if (take === blockLen) {
+        const dataView = createView(data);
+        for (; blockLen <= len - pos; pos += blockLen)
+          this.process(dataView, pos);
+        continue;
+      }
+      buffer.set(data.subarray(pos, pos + take), this.pos);
+      this.pos += take;
+      pos += take;
+      if (this.pos === blockLen) {
+        this.process(view, 0);
+        this.pos = 0;
+      }
+    }
+    this.length += data.length;
+    this.roundClean();
+    return this;
+  }
+  digestInto(out) {
+    aexists(this);
+    aoutput(out, this);
+    this.finished = true;
+    const { buffer, view, blockLen, isLE } = this;
+    let { pos } = this;
+    buffer[pos++] = 128;
+    clean(this.buffer.subarray(pos));
+    if (this.padOffset > blockLen - pos) {
+      this.process(view, 0);
+      pos = 0;
+    }
+    for (let i = pos; i < blockLen; i++)
+      buffer[i] = 0;
+    setBigUint64(view, blockLen - 8, BigInt(this.length * 8), isLE);
+    this.process(view, 0);
+    const oview = createView(out);
+    const len = this.outputLen;
+    if (len % 4)
+      throw new Error("_sha2: outputLen should be aligned to 32bit");
+    const outLen = len / 4;
+    const state = this.get();
+    if (outLen > state.length)
+      throw new Error("_sha2: outputLen bigger than state");
+    for (let i = 0; i < outLen; i++)
+      oview.setUint32(4 * i, state[i], isLE);
+  }
+  digest() {
+    const { buffer, outputLen } = this;
+    this.digestInto(buffer);
+    const res = buffer.slice(0, outputLen);
+    this.destroy();
+    return res;
+  }
+  _cloneInto(to) {
+    to || (to = new this.constructor());
+    to.set(...this.get());
+    const { blockLen, buffer, length, finished, destroyed, pos } = this;
+    to.destroyed = destroyed;
+    to.finished = finished;
+    to.length = length;
+    to.pos = pos;
+    if (length % blockLen)
+      to.buffer.set(buffer);
+    return to;
+  }
+  clone() {
+    return this._cloneInto();
+  }
+};
+var SHA256_IV = /* @__PURE__ */ Uint32Array.from([
+  1779033703,
+  3144134277,
+  1013904242,
+  2773480762,
+  1359893119,
+  2600822924,
+  528734635,
+  1541459225
+]);
+
+// node_modules/.pnpm/@noble+hashes@1.8.0/node_modules/@noble/hashes/esm/sha2.js
+var SHA256_K = /* @__PURE__ */ Uint32Array.from([
+  1116352408,
+  1899447441,
+  3049323471,
+  3921009573,
+  961987163,
+  1508970993,
+  2453635748,
+  2870763221,
+  3624381080,
+  310598401,
+  607225278,
+  1426881987,
+  1925078388,
+  2162078206,
+  2614888103,
+  3248222580,
+  3835390401,
+  4022224774,
+  264347078,
+  604807628,
+  770255983,
+  1249150122,
+  1555081692,
+  1996064986,
+  2554220882,
+  2821834349,
+  2952996808,
+  3210313671,
+  3336571891,
+  3584528711,
+  113926993,
+  338241895,
+  666307205,
+  773529912,
+  1294757372,
+  1396182291,
+  1695183700,
+  1986661051,
+  2177026350,
+  2456956037,
+  2730485921,
+  2820302411,
+  3259730800,
+  3345764771,
+  3516065817,
+  3600352804,
+  4094571909,
+  275423344,
+  430227734,
+  506948616,
+  659060556,
+  883997877,
+  958139571,
+  1322822218,
+  1537002063,
+  1747873779,
+  1955562222,
+  2024104815,
+  2227730452,
+  2361852424,
+  2428436474,
+  2756734187,
+  3204031479,
+  3329325298
+]);
+var SHA256_W = /* @__PURE__ */ new Uint32Array(64);
+var SHA256 = class extends HashMD {
+  constructor(outputLen = 32) {
+    super(64, outputLen, 8, false);
+    this.A = SHA256_IV[0] | 0;
+    this.B = SHA256_IV[1] | 0;
+    this.C = SHA256_IV[2] | 0;
+    this.D = SHA256_IV[3] | 0;
+    this.E = SHA256_IV[4] | 0;
+    this.F = SHA256_IV[5] | 0;
+    this.G = SHA256_IV[6] | 0;
+    this.H = SHA256_IV[7] | 0;
+  }
+  get() {
+    const { A, B, C, D, E, F, G, H } = this;
+    return [A, B, C, D, E, F, G, H];
+  }
+  // prettier-ignore
+  set(A, B, C, D, E, F, G, H) {
+    this.A = A | 0;
+    this.B = B | 0;
+    this.C = C | 0;
+    this.D = D | 0;
+    this.E = E | 0;
+    this.F = F | 0;
+    this.G = G | 0;
+    this.H = H | 0;
+  }
+  process(view, offset) {
+    for (let i = 0; i < 16; i++, offset += 4)
+      SHA256_W[i] = view.getUint32(offset, false);
+    for (let i = 16; i < 64; i++) {
+      const W15 = SHA256_W[i - 15];
+      const W2 = SHA256_W[i - 2];
+      const s0 = rotr(W15, 7) ^ rotr(W15, 18) ^ W15 >>> 3;
+      const s1 = rotr(W2, 17) ^ rotr(W2, 19) ^ W2 >>> 10;
+      SHA256_W[i] = s1 + SHA256_W[i - 7] + s0 + SHA256_W[i - 16] | 0;
+    }
+    let { A, B, C, D, E, F, G, H } = this;
+    for (let i = 0; i < 64; i++) {
+      const sigma1 = rotr(E, 6) ^ rotr(E, 11) ^ rotr(E, 25);
+      const T1 = H + sigma1 + Chi(E, F, G) + SHA256_K[i] + SHA256_W[i] | 0;
+      const sigma0 = rotr(A, 2) ^ rotr(A, 13) ^ rotr(A, 22);
+      const T2 = sigma0 + Maj(A, B, C) | 0;
+      H = G;
+      G = F;
+      F = E;
+      E = D + T1 | 0;
+      D = C;
+      C = B;
+      B = A;
+      A = T1 + T2 | 0;
+    }
+    A = A + this.A | 0;
+    B = B + this.B | 0;
+    C = C + this.C | 0;
+    D = D + this.D | 0;
+    E = E + this.E | 0;
+    F = F + this.F | 0;
+    G = G + this.G | 0;
+    H = H + this.H | 0;
+    this.set(A, B, C, D, E, F, G, H);
+  }
+  roundClean() {
+    clean(SHA256_W);
+  }
+  destroy() {
+    this.set(0, 0, 0, 0, 0, 0, 0, 0);
+    clean(this.buffer);
+  }
+};
+var sha256 = /* @__PURE__ */ createHasher(() => new SHA256());
+
+// node_modules/.pnpm/@noble+hashes@1.8.0/node_modules/@noble/hashes/esm/sha256.js
+var sha2562 = sha256;
+
+// node_modules/.pnpm/@paybox+mcp-app@file+..+mcp-app_@modelcontextprotocol+sdk@1.29.0_zod@4.4.3__bn.js@5.2.3_ac1e09a20c76a1143611be5dd3d4f9db/node_modules/@paybox/mcp-app/src/signing/agent-code.ts
+var ALPHABET = [
+  "\u{1F436}",
+  "\u{1F431}",
+  "\u{1F42D}",
+  "\u{1F430}",
+  "\u{1F98A}",
+  "\u{1F43B}",
+  "\u{1F43C}",
+  "\u{1F981}",
+  "\u{1F42E}",
+  "\u{1F437}",
+  "\u{1F438}",
+  "\u{1F435}",
+  "\u{1F414}",
+  "\u{1F427}",
+  "\u{1F426}",
+  "\u{1F424}",
+  "\u{1F986}",
+  "\u{1F985}",
+  "\u{1F989}",
+  "\u{1F987}",
+  "\u{1F417}",
+  "\u{1F434}",
+  "\u{1F984}",
+  "\u{1F41D}",
+  "\u{1F41B}",
+  "\u{1F98B}",
+  "\u{1F40C}",
+  "\u{1F41E}",
+  "\u{1F41C}",
+  "\u{1F422}",
+  "\u{1F40D}",
+  "\u{1F98E}",
+  "\u{1F419}",
+  "\u{1F990}",
+  "\u{1F980}",
+  "\u{1F421}",
+  "\u{1F420}",
+  "\u{1F42C}",
+  "\u{1F433}",
+  "\u{1F988}",
+  "\u{1F406}",
+  "\u{1F993}",
+  "\u{1F98D}",
+  "\u{1F418}",
+  "\u{1F98F}",
+  "\u{1F42A}",
+  "\u{1F992}",
+  "\u{1F411}",
+  "\u{1F98C}",
+  "\u{1F983}",
+  "\u{1F99A}",
+  "\u{1F335}",
+  "\u{1F384}",
+  "\u{1F333}",
+  "\u{1F334}",
+  "\u{1F331}",
+  "\u{1F340}",
+  "\u{1F38D}",
+  "\u{1F341}",
+  "\u{1F342}",
+  "\u{1F343}",
+  "\u{1F33B}",
+  "\u{1F339}",
+  "\u{1F337}",
+  "\u{1F338}",
+  "\u{1F33C}",
+  "\u{1F33E}",
+  "\u{1F490}",
+  "\u{1F344}",
+  "\u{1F330}",
+  "\u{1F30D}",
+  "\u{1F319}",
+  "\u2B50",
+  "\u{1F308}",
+  "\u{1F525}",
+  "\u{1F4A7}",
+  "\u{1F30A}",
+  "\u{1F32A}",
+  "\u{1F329}",
+  "\u{1F347}",
+  "\u{1F349}",
+  "\u{1F34A}",
+  "\u{1F34B}",
+  "\u{1F34C}",
+  "\u{1F34D}",
+  "\u{1F34E}",
+  "\u{1F350}",
+  "\u{1F351}",
+  "\u{1F352}",
+  "\u{1F353}",
+  "\u{1F95D}",
+  "\u{1F951}",
+  "\u{1F346}",
+  "\u{1F955}",
+  "\u{1F33D}",
+  "\u{1F966}",
+  "\u{1F952}",
+  "\u{1F95C}",
+  "\u{1F35E}",
+  "\u{1F950}",
+  "\u{1F9C0}",
+  "\u{1F373}",
+  "\u{1F95E}",
+  "\u{1F354}",
+  "\u{1F35F}",
+  "\u{1F355}",
+  "\u{1F32D}",
+  "\u{1F32E}",
+  "\u{1F32F}",
+  "\u{1F35C}",
+  "\u{1F360}",
+  "\u{1F364}",
+  "\u{1F365}",
+  "\u{1F366}",
+  "\u{1F368}",
+  "\u{1F369}",
+  "\u{1F36A}",
+  "\u{1F382}",
+  "\u{1F370}",
+  "\u{1F36B}",
+  "\u{1F36C}",
+  "\u{1F36D}",
+  "\u{1F36E}",
+  "\u{1F36F}",
+  "\u{1F37C}",
+  "\u{1F95B}",
+  "\u2615",
+  "\u{1F375}",
+  "\u{1F376}",
+  "\u{1F37E}",
+  "\u{1F377}",
+  "\u{1F378}",
+  "\u{1F379}",
+  "\u{1F37A}",
+  "\u{1F943}",
+  "\u26BD",
+  "\u{1F3C0}",
+  "\u{1F3C8}",
+  "\u26BE",
+  "\u{1F3BE}",
+  "\u{1F3B1}",
+  "\u{1F3D3}",
+  "\u{1F3F8}",
+  "\u{1F945}",
+  "\u{1F3D2}",
+  "\u{1F3F9}",
+  "\u{1F3A3}",
+  "\u{1F94A}",
+  "\u{1F3BF}",
+  "\u{1F6F7}",
+  "\u{1F3AF}",
+  "\u{1F3AE}",
+  "\u{1F3B2}",
+  "\u{1F3B8}",
+  "\u{1F3BA}",
+  "\u{1F941}",
+  "\u{1F3B9}",
+  "\u{1F3A4}",
+  "\u{1F3A7}",
+  "\u{1F4FB}",
+  "\u{1F3AC}",
+  "\u{1F3A8}",
+  "\u{1F3AA}",
+  "\u{1F680}",
+  "\u{1F6F8}",
+  "\u{1F681}",
+  "\u{1F682}",
+  "\u{1F684}",
+  "\u{1F68C}",
+  "\u{1F691}",
+  "\u{1F693}",
+  "\u{1F695}",
+  "\u{1F697}",
+  "\u{1F69A}",
+  "\u{1F69C}",
+  "\u{1F6B2}",
+  "\u26F5",
+  "\u{1F6F6}",
+  "\u{1F6A4}",
+  "\u{1F5FF}",
+  "\u{1F5FD}",
+  "\u{1F3A1}",
+  "\u{1F3A2}",
+  "\u{1F3A0}",
+  "\u26F2",
+  "\u{1F3F0}",
+  "\u{1F3DF}",
+  "\u{1F3AD}",
+  "\u{1F381}",
+  "\u{1F9ED}",
+  "\u231A",
+  "\u{1F4F1}",
+  "\u{1F4BB}",
+  "\u{1F4F7}",
+  "\u{1F4FA}",
+  "\u{1F4DE}",
+  "\u{1F4E0}",
+  "\u{1F50B}",
+  "\u{1F50C}",
+  "\u{1F4A1}",
+  "\u{1F526}",
+  "\u{1F56F}",
+  "\u{1F5D1}",
+  "\u{1F4B8}",
+  "\u{1F4B0}",
+  "\u{1F4B3}",
+  "\u{1F48E}",
+  "\u{1F527}",
+  "\u{1F528}",
+  "\u{1F529}",
+  "\u{1F52B}",
+  "\u{1F4A3}",
+  "\u{1F52A}",
+  "\u{1F52E}",
+  "\u{1F4FF}",
+  "\u{1F52C}",
+  "\u{1F4D4}",
+  "\u{1F4DA}",
+  "\u{1F31E}",
+  "\u26C4",
+  "\u2614",
+  "\u{1F30B}",
+  "\u{1F94C}",
+  "\u{1F3E0}",
+  "\u{1F3E5}",
+  "\u{1F3ED}",
+  "\u{1F511}",
+  "\u{1F512}",
+  "\u23F0",
+  "\u231B",
+  "\u{1F4C5}",
+  "\u{1F4CC}",
+  "\u{1F4CE}",
+  "\u{1F4CF}",
+  "\u{1F388}",
+  "\u{1F383}",
+  "\u{1F451}",
+  "\u{1F453}",
+  "\u{1F3A9}",
+  "\u{1F45F}",
+  "\u{1F462}",
+  "\u{1F45C}",
+  "\u{1F392}",
+  "\u{1F9F2}",
+  "\u{1F9EA}",
+  "\u{1F9EC}",
+  "\u{1F9F8}",
+  "\u{1F9E6}",
+  "\u{1F9E2}",
+  "\u{1F3C6}",
+  "\u{1F6F4}",
+  "\u{1FA90}",
+  "\u{1F3B3}",
+  "\u{1F6A6}",
+  "\u{1F9EF}",
+  "\u{1F9F9}"
+];
+function toHex(bytes) {
+  return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+var CODE_LENGTH = 8;
+if (ALPHABET.length !== 256) {
+  throw new Error(`agent-code alphabet must be exactly 256 entries, got ${ALPHABET.length}`);
+}
+function sha2563(bytes) {
+  return sha2562(bytes);
+}
+function codeFromDigest(digest) {
+  const code = [];
+  for (let i = 0; i < CODE_LENGTH; i += 1) code.push(ALPHABET[digest[i]]);
+  return code;
+}
+async function deriveAgentCode(publicKey) {
+  if (publicKey.length !== 32) {
+    throw new Error(`public key must be 32 bytes, got ${publicKey.length}`);
+  }
+  return codeFromDigest(sha2563(publicKey));
+}
+
+// src/pairing.ts
+var POLL_MS = 1500;
+var TIMEOUT_MS = 10 * 60 * 1e3;
+var MAX_BACKOFF_MS = 15e3;
+var GIVE_UP_AFTER_FAILING_MS = 9e4;
+async function json(url, init) {
+  const res = await fetch(url, init);
+  if (!res.ok) {
+    const body = await res.text().catch(() => "");
+    throw new Error(`${init.method ?? "GET"} ${new URL(url).pathname} failed (${res.status})${body ? `: ${body.slice(0, 200)}` : ""}`);
+  }
+  return res.json();
+}
+async function pairSigningKey(opts) {
+  const { pairing_token, client_id } = await json(`${opts.baseUrl}/api/agent-pairings/token`, {
+    method: "POST",
+    headers: { authorization: `Bearer ${opts.bearer}`, accept: "application/json" }
+  });
+  const seed = nacl.randomBytes(nacl.sign.seedLength);
+  const pair = nacl.sign.keyPair.fromSeed(seed);
+  const keypair = { apiPubHex: toHex(pair.publicKey), apiPrivHex: toHex(seed) };
+  const { pairing_id } = await json(`${opts.baseUrl}/iframe/pairing`, {
+    method: "POST",
+    headers: {
+      authorization: `Bearer ${pairing_token}`,
+      "content-type": "application/json",
+      accept: "application/json"
+    },
+    body: JSON.stringify({ api_pub_hex: keypair.apiPubHex })
+  });
+  const url = `${opts.appBase}/agent-key?client_id=${client_id}&pairing_id=${pairing_id}`;
+  opts.onCode(await deriveAgentCode(pair.publicKey), url);
+  const deadline = Date.now() + TIMEOUT_MS;
+  let failures = 0;
+  let failingSince = 0;
+  while (Date.now() < deadline) {
+    const backoff = failures ? Math.min(POLL_MS * 2 ** failures, MAX_BACKOFF_MS) : POLL_MS;
+    await new Promise((resolve) => setTimeout(resolve, backoff));
+    let status;
+    try {
+      status = (await json(`${opts.baseUrl}/iframe/pairing/${pairing_id}`, {
+        headers: { accept: "application/json" }
+      })).status;
+      failures = 0;
+      failingSince = 0;
+    } catch (err) {
+      failures += 1;
+      failingSince ||= Date.now();
+      if (Date.now() - failingSince >= GIVE_UP_AFTER_FAILING_MS) {
+        throw new Error(`lost contact with PayBox while waiting: ${err.message}`);
+      }
+      continue;
+    }
+    if (status === "completed") return encodeToken(keypair);
+    if (status === "cancelled") throw new Error("that request was declined in PayBox");
+    if (status === "expired") throw new Error("that request expired \u2014 run `paybox connect` again");
+  }
+  throw new Error("timed out waiting for you to pick the code in PayBox");
+}
+
+// src/cli.ts
 var DEFAULT_BASE_URL = "https://api.paybox.sh";
 var PKG = "@paybox-sh/sdk";
 var VERSION = createRequire(import.meta.url)("../package.json").version;
@@ -27,10 +694,16 @@ function jsonMode() {
   return Boolean(program.opts().json);
 }
 function emit(data) {
+  const funding = pendingFundingResponse(data) ?? (Array.isArray(data?.content) ? pendingFundingToolResponse(data) : null);
+  if (funding) {
+    console.error(
+      `Request incomplete; funding status is pending, not proof that funding has started or completed. Poll \`paybox request ${funding.request_id}\`; do not repeat the purchase.`
+    );
+  }
   if (jsonMode()) console.log(JSON.stringify(data, null, 2));
   else console.dir(data, { depth: null, colors: process.stdout.isTTY });
   const d = data;
-  if (didNotHappen(d) || didNotHappen(d?.response) || d?.isError === true) {
+  if (!funding && (didNotHappen(d) || didNotHappen(d?.response) || d?.isError === true)) {
     process.exitCode = 1;
   }
 }
@@ -87,15 +760,6 @@ function isNewer(a, b) {
   }
   return false;
 }
-async function prompt(question) {
-  if (!process.stdin.isTTY) return "";
-  const rl = createInterface({ input: process.stdin, output: process.stderr });
-  try {
-    return (await rl.question(question)).trim();
-  } finally {
-    rl.close();
-  }
-}
 async function run(fn) {
   try {
     await fn();
@@ -106,64 +770,72 @@ async function run(fn) {
     process.exitCode = 1;
   }
 }
-function warnIfUnsignable(c, status) {
-  if (status === "pending_signature" && !c.canSign) {
-    console.error(
-      "awaiting signatures but no valid pbxk1. signing key is set \u2014 set PAYBOX_SIGNING_KEY and re-run `paybox login`, then poll `paybox request <id>`."
-    );
+function withNextAction(c, result) {
+  const value = result;
+  const response = value.response;
+  if (response?.status) {
+    return {
+      ...value,
+      response: { ...response, next_action: c.nextAction(response) }
+    };
+  }
+  if (value.status) {
+    return { ...value, next_action: c.nextAction(value) };
   }
+  return result;
+}
+function resolveBaseUrl() {
+  const cfg = loadConfig();
+  return (program.opts().baseUrl ?? process.env.PAYBOX_API_URL ?? cfg.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
 }
-program.command("login").description("Authenticate via OAuth (browser + passkey), or store a pbx_live_ key").option("--key <key>", "store a pbx_live_ personal API key instead of OAuth").option(
-  "--signing-key <token>",
-  "store a pbxk1. wallet signing key; prefer PAYBOX_SIGNING_KEY (an argument is visible in shell history)"
-).option("--app-url <url>", "PayBox app origin for key provisioning (default: derived from --base-url)").option("--no-provision", "skip the wallet signing-key provisioning step").action(
+program.command("login").description("Authenticate via OAuth device approval, or store a pbx_live_ key").option("--key <key>", "store a pbx_live_ personal API key instead of OAuth").option("--no-open", "print the approval link without opening a browser").action(
   (opts) => run(async () => {
     const cfg = loadConfig();
-    const baseUrl = (program.opts().baseUrl ?? process.env.PAYBOX_API_URL ?? cfg.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
-    cfg.baseUrl = baseUrl;
-    if (opts.appUrl) cfg.appUrl = opts.appUrl;
-    const keepExistingLogin = Boolean(opts.signingKey) && Boolean(cfg.apiKey ?? cfg.oauth);
+    cfg.baseUrl = resolveBaseUrl();
     if (opts.key) {
       cfg.apiKey = opts.key;
       delete cfg.oauth;
-    } else if (!keepExistingLogin) {
-      cfg.oauth = await loginDevice(baseUrl);
+    } else {
+      cfg.oauth = await loginDevice(cfg.baseUrl, { open: opts.open });
       delete cfg.apiKey;
     }
-    if (opts.signingKey) cfg.signingKey = opts.signingKey;
+    delete cfg.signingKey;
     saveConfig(cfg);
     console.error(`Saved credentials to ${configFile()}`);
-    if (!cfg.oauth || opts.signingKey || opts.provision === false) return;
-    const cid = agentClientId(cfg.oauth.accessToken);
-    const appBase = appBaseFrom(baseUrl, opts.appUrl ?? process.env.PAYBOX_APP_URL ?? cfg.appUrl);
-    if (!cid || !appBase) {
-      console.error(
-        "To enable wallet sign/swap, provision a signing key, then set\n  PAYBOX_SIGNING_KEY=<pbxk1...>  and re-run `paybox login`" + (cid && !appBase ? " (or pass --app-url <paybox app origin>)" : "")
-      );
-      return;
+    if (!process.env.PAYBOX_SIGNING_KEY) {
+      console.error("Run `paybox connect` to connect a signing key; until then sign and swap stop at pending_signature.");
     }
-    const url = `${appBase}/agent-key?client_id=${cid}`;
-    console.error(
-      `
-Next, provision a wallet signing key for this agent (needed for sign/swap):
-  ${url}
-`
-    );
-    openBrowser(url);
-    const key = process.stdin.isTTY ? await prompt("Paste the pbxk1. signing key when ready (or Enter to skip): ") : (process.env.PAYBOX_SIGNING_KEY ?? "").trim();
-    if (key) {
-      cfg.signingKey = key;
+  })
+);
+program.command("connect").description("Connect a wallet signing key to this machine by picking a code in PayBox").option("--app-url <url>", "PayBox app origin (default: derived from --base-url)").option("--no-open", "print the pairing link without opening a browser").action(
+  (opts) => run(async () => {
+    const cfg = loadConfig();
+    const baseUrl = resolveBaseUrl();
+    const appBase = appBaseFrom(baseUrl, opts.appUrl ?? process.env.PAYBOX_APP_URL ?? cfg.appUrl);
+    if (!appBase) throw new Error("could not derive the PayBox app origin \u2014 pass --app-url");
+    if (opts.appUrl) cfg.appUrl = opts.appUrl;
+    if (!cfg.apiKey && cfg.oauth?.expiresAt && Date.now() > cfg.oauth.expiresAt - 3e4) {
+      cfg.oauth = await refreshTokens(baseUrl, cfg.oauth);
       saveConfig(cfg);
-      console.error("Signing key saved \u2014 sign/swap enabled.");
-    } else if (process.stdin.isTTY) {
-      console.error(
-        "Skipped \u2014 provision one later by setting PAYBOX_SIGNING_KEY and re-running `paybox login`."
-      );
-    } else {
-      console.error(
-        "No signing key configured, so sign and swap will stop at pending_signature.\nSet PAYBOX_SIGNING_KEY to the `pbxk1.` token and re-run `paybox login`."
-      );
     }
+    const bearer = cfg.apiKey ?? cfg.oauth?.accessToken;
+    if (!bearer) throw new Error("not authenticated \u2014 run `paybox login` first");
+    cfg.signingKey = await pairSigningKey({
+      baseUrl,
+      appBase,
+      bearer,
+      onCode(code, url) {
+        console.error(`
+  ${code.join("  ")}
+`);
+        console.error(`Open this on any device and pick that code to connect this machine:
+  ${url}
+`);
+        if (opts.open) openBrowser(url);
+      }
+    });
+    saveConfig(cfg);
+    console.error("Connected \u2014 sign and swap are enabled on this machine.");
   })
 );
 program.command("logout").description("Forget stored credentials").action(
@@ -216,8 +888,7 @@ program.command("sign").description("Sign with a wallet credential (intent JSON,
       credentialId: credentialId(o.credential),
       intent: readIntent(o.intent)
     });
-    warnIfUnsignable(c, res.status);
-    emit(res);
+    emit(withNextAction(c, res));
   })
 );
 program.command("swap").description("Swap tokens from a wallet credential").requiredOption("--credential <id>", "credential id from `paybox credentials`").requiredOption("--src-chain <caip2>").requiredOption("--src-token <addr>", '"native" or a token address').requiredOption("--dst-token <addr>").requiredOption("--amount <smallest-unit>", "source amount in smallest units").option("--dst-chain <caip2>", "defaults to --src-chain").option("--direction <dir>", "exact-amount-in | exact-amount-out", "exact-amount-in").option("--slippage <bps>", "slippage in bps", "150").option("--recipient <addr>").option("--value-cents <n>").option("--wait", "if approval is required, wait for it and then sign in-process").action(
@@ -238,8 +909,7 @@ program.command("swap").description("Swap tokens from a wallet credential").requ
       },
       { waitForApproval: Boolean(o.wait) }
     );
-    warnIfUnsignable(c, result.response.status);
-    emit(result);
+    emit(withNextAction(c, result));
   })
 );
 program.command("discover [query]").description("Discover curated paid x402 services from Bazaar (optional search)").option("--raw", "return uncurated compact Bazaar service summaries (debug)").action(
@@ -256,8 +926,7 @@ program.command("pay-x402").description("Pay a paid x402 endpoint (header mode \
       },
       { waitForApproval: Boolean(o.wait) }
     );
-    warnIfUnsignable(c, result.response.status);
-    emit(result);
+    emit(withNextAction(c, result));
   })
 );
 program.command("use-service").description("Fetch a paid x402 resource and have paybox pay for it (gateway mode)").requiredOption("--credential <id>", "credential id from `paybox credentials`").requiredOption("--url <url>", "the paid x402 resource URL").option("--method <verb>", "HTTP method", "GET").option("--body <json>", "request body (JSON or @file)").option("--wait", "if approval is required, wait for it and then sign in-process").action(
@@ -272,13 +941,19 @@ program.command("use-service").description("Fetch a paid x402 resource and have
       },
       { waitForApproval: Boolean(o.wait) }
     );
-    warnIfUnsignable(c, result.response.status);
-    emit(result);
+    emit(withNextAction(c, result));
   })
 );
-program.command("portfolio").description("List a wallet address's token balances across chains").requiredOption("--address <addr>").option("--networks <ids>", 'comma-separated network IDs, e.g. "1,8453"').action(
+program.command("portfolio").description("List a wallet address's token balances across chains").requiredOption("--address <addr>").option("--networks <ids>", 'comma-separated network IDs, e.g. "1,8453"').option("--token <addr>", "mint, ERC-20, or native").option("--network-id <id>", "MoonX network id required with --token").action(
   (o) => run(
-    async () => emit(await client().getPortfolio({ address: o.address, networkIds: o.networks }))
+    async () => emit(
+      await client().getPortfolio({
+        address: o.address,
+        networkIds: o.networks,
+        token: o.token,
+        networkId: o.networkId == null ? void 0 : Number(o.networkId)
+      })
+    )
   )
 );
 program.command("verify-solana-balance").description("Verify a Solana transaction's wallet/token effect and current balance").requiredOption("--address <addr>", "canonical Solana wallet address").requiredOption("--mint <addr>", "canonical SPL or Token-2022 mint").requiredOption("--transaction <signature>", "confirmed Solana transaction signature").action(
@@ -294,6 +969,16 @@ program.command("verify-solana-balance").description("Verify a Solana transactio
 );
 program.command("claim <request-id>").description("Claim the usable card credentials of an approved payment (one-time)").action((id) => run(async () => emit(await client().claimPaymentCredentials(requestId(id)))));
 program.command("account-change").description("Get a manage_url for the USER to update this client's access in the app").option("--note <text>", "why the change is needed (shown to the user)").action((o) => run(async () => emit(await client().requestAccountChange(o.note))));
+program.command("deposit-link").description("Open Deposit URL for a granted wallet (charges nothing)").requiredOption("--credential <id>", "a granted wallet credential").option("--amount-usd <n>", "optional amount hint in USD").action(
+  (o) => run(
+    async () => emit(
+      await client().getDepositLink({
+        credentialId: credentialId(o.credential),
+        amountUsd: o.amountUsd === void 0 ? void 0 : Number(o.amountUsd)
+      })
+    )
+  )
+);
 program.command("buy-link").description("Signed MoonPay checkout URL funding a granted wallet (charges nothing)").requiredOption("--credential <id>", "a granted wallet credential").option(
   "--destination <chain>",
   "exact network: eip155:8453 (default EVM), eip155:1, eip155:4663, or solana:mainnet"
@@ -342,11 +1027,12 @@ plugins.command("use <plugin-id> <tool-id>").description("Invoke a tool from its
     )
   )
 );
-program.command("request <id>").description("Poll a request's status").option("--wait", "block until it leaves the pending state").action(
+program.command("request <id>").description("Poll a request's status").option("--wait", "block until it leaves the pending state").option("--complete-signature", "sign an existing wallet-sign request with the local key").action(
   (id, o) => run(async () => {
     const c = client();
     const rid = requestId(id);
-    emit(o.wait ? await c.waitForRequest(rid) : await c.getRequest(rid));
+    const response = o.completeSignature ? await c.completeWalletSignRequest(rid) : await c.getRequest(rid);
+    emit(withNextAction(c, o.wait ? await c.waitForRequest(rid) : response));
   })
 );
 program.command("version").description("Show the installed CLI version (and whether an update is available)").action(
@@ -421,4 +1107,9 @@ function rejectUnknownCommand(argv) {
 }
 rejectUnknownCommand(process.argv);
 program.parseAsync(process.argv);
+/*! Bundled license information:
+
+@noble/hashes/esm/utils.js:
+  (*! noble-hashes - MIT License (c) 2022 Paul Miller (paulmillr.com) *)
+*/
 //# sourceMappingURL=cli.js.map