@paybox-sh/sdk 2.2.0 → 2.4.0

package/dist/cli.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import {
   PayboxClient,
+  PayboxError,
   appBaseFrom,
   configDir,
   configFile,
@@ -13,11 +14,10 @@ import {
   pendingFundingToolResponse,
   refreshTokens,
   saveConfig
-} from "./chunk-DWDC6W5P.js";
+} from "./chunk-ACNRTJGL.js";
 
 // src/cli.ts
-import { spawnSync } from "node:child_process";
-import { readFileSync, rmSync } from "node:fs";
+import { readFileSync as readFileSync2, rmSync as rmSync2 } from "node:fs";
 import { createRequire } from "node:module";
 import { Command } from "commander";
 
@@ -344,284 +344,20 @@ var sha256 = /* @__PURE__ */ createHasher(() => new SHA256());
 var sha2562 = sha256;
 
 // node_modules/.pnpm/@paybox+mcp-app@file+..+mcp-app_@modelcontextprotocol+sdk@1.29.0_zod@4.4.3__bn.js@5.2.3_ac1e09a20c76a1143611be5dd3d4f9db/node_modules/@paybox/mcp-app/src/signing/agent-code.ts
-var ALPHABET = [
-  "\u{1F436}",
-  "\u{1F431}",
-  "\u{1F42D}",
-  "\u{1F430}",
-  "\u{1F98A}",
-  "\u{1F43B}",
-  "\u{1F43C}",
-  "\u{1F981}",
-  "\u{1F42E}",
-  "\u{1F437}",
-  "\u{1F438}",
-  "\u{1F435}",
-  "\u{1F414}",
-  "\u{1F427}",
-  "\u{1F426}",
-  "\u{1F424}",
-  "\u{1F986}",
-  "\u{1F985}",
-  "\u{1F989}",
-  "\u{1F987}",
-  "\u{1F417}",
-  "\u{1F434}",
-  "\u{1F984}",
-  "\u{1F41D}",
-  "\u{1F41B}",
-  "\u{1F98B}",
-  "\u{1F40C}",
-  "\u{1F41E}",
-  "\u{1F41C}",
-  "\u{1F422}",
-  "\u{1F40D}",
-  "\u{1F98E}",
-  "\u{1F419}",
-  "\u{1F990}",
-  "\u{1F980}",
-  "\u{1F421}",
-  "\u{1F420}",
-  "\u{1F42C}",
-  "\u{1F433}",
-  "\u{1F988}",
-  "\u{1F406}",
-  "\u{1F993}",
-  "\u{1F98D}",
-  "\u{1F418}",
-  "\u{1F98F}",
-  "\u{1F42A}",
-  "\u{1F992}",
-  "\u{1F411}",
-  "\u{1F98C}",
-  "\u{1F983}",
-  "\u{1F99A}",
-  "\u{1F335}",
-  "\u{1F384}",
-  "\u{1F333}",
-  "\u{1F334}",
-  "\u{1F331}",
-  "\u{1F340}",
-  "\u{1F38D}",
-  "\u{1F341}",
-  "\u{1F342}",
-  "\u{1F343}",
-  "\u{1F33B}",
-  "\u{1F339}",
-  "\u{1F337}",
-  "\u{1F338}",
-  "\u{1F33C}",
-  "\u{1F33E}",
-  "\u{1F490}",
-  "\u{1F344}",
-  "\u{1F330}",
-  "\u{1F30D}",
-  "\u{1F319}",
-  "\u2B50",
-  "\u{1F308}",
-  "\u{1F525}",
-  "\u{1F4A7}",
-  "\u{1F30A}",
-  "\u{1F32A}",
-  "\u{1F329}",
-  "\u{1F347}",
-  "\u{1F349}",
-  "\u{1F34A}",
-  "\u{1F34B}",
-  "\u{1F34C}",
-  "\u{1F34D}",
-  "\u{1F34E}",
-  "\u{1F350}",
-  "\u{1F351}",
-  "\u{1F352}",
-  "\u{1F353}",
-  "\u{1F95D}",
-  "\u{1F951}",
-  "\u{1F346}",
-  "\u{1F955}",
-  "\u{1F33D}",
-  "\u{1F966}",
-  "\u{1F952}",
-  "\u{1F95C}",
-  "\u{1F35E}",
-  "\u{1F950}",
-  "\u{1F9C0}",
-  "\u{1F373}",
-  "\u{1F95E}",
-  "\u{1F354}",
-  "\u{1F35F}",
-  "\u{1F355}",
-  "\u{1F32D}",
-  "\u{1F32E}",
-  "\u{1F32F}",
-  "\u{1F35C}",
-  "\u{1F360}",
-  "\u{1F364}",
-  "\u{1F365}",
-  "\u{1F366}",
-  "\u{1F368}",
-  "\u{1F369}",
-  "\u{1F36A}",
-  "\u{1F382}",
-  "\u{1F370}",
-  "\u{1F36B}",
-  "\u{1F36C}",
-  "\u{1F36D}",
-  "\u{1F36E}",
-  "\u{1F36F}",
-  "\u{1F37C}",
-  "\u{1F95B}",
-  "\u2615",
-  "\u{1F375}",
-  "\u{1F376}",
-  "\u{1F37E}",
-  "\u{1F377}",
-  "\u{1F378}",
-  "\u{1F379}",
-  "\u{1F37A}",
-  "\u{1F943}",
-  "\u26BD",
-  "\u{1F3C0}",
-  "\u{1F3C8}",
-  "\u26BE",
-  "\u{1F3BE}",
-  "\u{1F3B1}",
-  "\u{1F3D3}",
-  "\u{1F3F8}",
-  "\u{1F945}",
-  "\u{1F3D2}",
-  "\u{1F3F9}",
-  "\u{1F3A3}",
-  "\u{1F94A}",
-  "\u{1F3BF}",
-  "\u{1F6F7}",
-  "\u{1F3AF}",
-  "\u{1F3AE}",
-  "\u{1F3B2}",
-  "\u{1F3B8}",
-  "\u{1F3BA}",
-  "\u{1F941}",
-  "\u{1F3B9}",
-  "\u{1F3A4}",
-  "\u{1F3A7}",
-  "\u{1F4FB}",
-  "\u{1F3AC}",
-  "\u{1F3A8}",
-  "\u{1F3AA}",
-  "\u{1F680}",
-  "\u{1F6F8}",
-  "\u{1F681}",
-  "\u{1F682}",
-  "\u{1F684}",
-  "\u{1F68C}",
-  "\u{1F691}",
-  "\u{1F693}",
-  "\u{1F695}",
-  "\u{1F697}",
-  "\u{1F69A}",
-  "\u{1F69C}",
-  "\u{1F6B2}",
-  "\u26F5",
-  "\u{1F6F6}",
-  "\u{1F6A4}",
-  "\u{1F5FF}",
-  "\u{1F5FD}",
-  "\u{1F3A1}",
-  "\u{1F3A2}",
-  "\u{1F3A0}",
-  "\u26F2",
-  "\u{1F3F0}",
-  "\u{1F3DF}",
-  "\u{1F3AD}",
-  "\u{1F381}",
-  "\u{1F9ED}",
-  "\u231A",
-  "\u{1F4F1}",
-  "\u{1F4BB}",
-  "\u{1F4F7}",
-  "\u{1F4FA}",
-  "\u{1F4DE}",
-  "\u{1F4E0}",
-  "\u{1F50B}",
-  "\u{1F50C}",
-  "\u{1F4A1}",
-  "\u{1F526}",
-  "\u{1F56F}",
-  "\u{1F5D1}",
-  "\u{1F4B8}",
-  "\u{1F4B0}",
-  "\u{1F4B3}",
-  "\u{1F48E}",
-  "\u{1F527}",
-  "\u{1F528}",
-  "\u{1F529}",
-  "\u{1F52B}",
-  "\u{1F4A3}",
-  "\u{1F52A}",
-  "\u{1F52E}",
-  "\u{1F4FF}",
-  "\u{1F52C}",
-  "\u{1F4D4}",
-  "\u{1F4DA}",
-  "\u{1F31E}",
-  "\u26C4",
-  "\u2614",
-  "\u{1F30B}",
-  "\u{1F94C}",
-  "\u{1F3E0}",
-  "\u{1F3E5}",
-  "\u{1F3ED}",
-  "\u{1F511}",
-  "\u{1F512}",
-  "\u23F0",
-  "\u231B",
-  "\u{1F4C5}",
-  "\u{1F4CC}",
-  "\u{1F4CE}",
-  "\u{1F4CF}",
-  "\u{1F388}",
-  "\u{1F383}",
-  "\u{1F451}",
-  "\u{1F453}",
-  "\u{1F3A9}",
-  "\u{1F45F}",
-  "\u{1F462}",
-  "\u{1F45C}",
-  "\u{1F392}",
-  "\u{1F9F2}",
-  "\u{1F9EA}",
-  "\u{1F9EC}",
-  "\u{1F9F8}",
-  "\u{1F9E6}",
-  "\u{1F9E2}",
-  "\u{1F3C6}",
-  "\u{1F6F4}",
-  "\u{1FA90}",
-  "\u{1F3B3}",
-  "\u{1F6A6}",
-  "\u{1F9EF}",
-  "\u{1F9F9}"
-];
 function toHex(bytes) {
   return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
 }
-var CODE_LENGTH = 8;
-if (ALPHABET.length !== 256) {
-  throw new Error(`agent-code alphabet must be exactly 256 entries, got ${ALPHABET.length}`);
-}
-function sha2563(bytes) {
-  return sha2562(bytes);
-}
+var CODE_MIN = 10;
+var CODE_SPAN = 90;
 function codeFromDigest(digest) {
-  const code = [];
-  for (let i = 0; i < CODE_LENGTH; i += 1) code.push(ALPHABET[digest[i]]);
-  return code;
+  const value = new DataView(digest.buffer, digest.byteOffset, 4).getUint32(0);
+  return String(CODE_MIN + value % CODE_SPAN);
 }
 async function deriveAgentCode(publicKey) {
   if (publicKey.length !== 32) {
     throw new Error(`public key must be 32 bytes, got ${publicKey.length}`);
   }
-  return codeFromDigest(sha2563(publicKey));
+  return codeFromDigest(sha2562(publicKey));
 }
 
 // src/pairing.ts
@@ -681,15 +417,153 @@ async function pairSigningKey(opts) {
     if (status === "cancelled") throw new Error("that request was declined in PayBox");
     if (status === "expired") throw new Error("that request expired \u2014 run `paybox connect` again");
   }
-  throw new Error("timed out waiting for you to pick the code in PayBox");
+  throw new Error("timed out waiting for you to pick the number in PayBox");
+}
+
+// src/self-update.ts
+import { spawnSync } from "node:child_process";
+import { closeSync, mkdirSync, openSync, readFileSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { constants } from "node:os";
+import { isAbsolute, join, relative } from "node:path";
+var PKG = "@paybox-sh/sdk";
+var DAY_MS = 24 * 60 * 60 * 1e3;
+var LOCK_STALE_MS = 10 * 60 * 1e3;
+var NPM_TIMEOUT_MS = 2 * 60 * 1e3;
+var SEMVER = /^\d+\.\d+\.\d+$/;
+var NO_AUTO_UPDATE = /* @__PURE__ */ new Set(["version", "update", "uninstall"]);
+function isNewer(a, b) {
+  const pa = a.split(".").map(Number);
+  const pb = b.split(".").map(Number);
+  for (let i = 0; i < 3; i++) {
+    const x = pa[i] ?? 0;
+    const y = pb[i] ?? 0;
+    if (x !== y) return x > y;
+  }
+  return false;
+}
+function registry() {
+  return (process.env.PAYBOX_UPDATE_REGISTRY || "https://registry.npmjs.org").replace(/\/+$/, "");
+}
+async function latestVersion() {
+  try {
+    const res = await fetch(`${registry()}/${PKG}/latest`, { signal: AbortSignal.timeout(3e3) });
+    if (!res.ok) return void 0;
+    const { version } = await res.json();
+    return typeof version === "string" && SEMVER.test(version) ? version : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function installArgs(version) {
+  const pinned = `${registry()}/`;
+  return ["install", "-g", `${PKG}@${version}`, "--registry", pinned, `--@paybox-sh:registry=${pinned}`];
+}
+function npm(args, stdio) {
+  const background = stdio === "pipe";
+  const env = Object.fromEntries(
+    Object.entries(process.env).filter(([key]) => !(background && /^npm_config_.*registry$/i.test(key)))
+  );
+  const options = {
+    stdio,
+    encoding: "utf8",
+    timeout: background ? NPM_TIMEOUT_MS : void 0,
+    cwd: background ? configDir() : void 0
+  };
+  if (process.platform !== "win32") return spawnSync("npm", args, { ...options, env });
+  return spawnSync(process.env.ComSpec ?? "cmd.exe", ["/d", "/s", "/c", "npm", ...args], {
+    ...options,
+    env: { ...env, NoDefaultCurrentDirectoryInExePath: "1" }
+  });
+}
+function available(latest, current) {
+  return `PayBox CLI v${latest} is available (this is v${current}). Run \`paybox update\`.`;
+}
+function globalCli() {
+  const root = npm(["root", "-g"], "pipe");
+  if (root.status !== 0 || !process.argv[1]) return void 0;
+  const pkgDir = join(root.stdout.trim(), PKG);
+  try {
+    const rel = relative(realpathSync(pkgDir), realpathSync(process.argv[1]));
+    return rel && !rel.startsWith("..") && !isAbsolute(rel) ? join(pkgDir, "dist", "cli.js") : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function unlock(lock) {
+  try {
+    rmSync(lock, { force: true });
+  } catch {
+  }
+}
+function startCheck(dir) {
+  const cache = join(dir, "update-check.json");
+  const lock = join(dir, "update.lock");
+  try {
+    const age = Date.now() - JSON.parse(readFileSync(cache, "utf8")).checkedAt;
+    if (age >= 0 && age < DAY_MS) return false;
+  } catch {
+  }
+  try {
+    mkdirSync(dir, { recursive: true, mode: 448 });
+    closeSync(openSync(lock, "wx"));
+  } catch {
+    try {
+      if (Date.now() - statSync(lock).mtimeMs > LOCK_STALE_MS) unlock(lock);
+    } catch {
+    }
+    return false;
+  }
+  try {
+    writeFileSync(cache, JSON.stringify({ checkedAt: Date.now() }));
+    return true;
+  } catch {
+    unlock(lock);
+    return false;
+  }
+}
+async function install(current) {
+  const latest = await latestVersion();
+  if (!latest || !isNewer(latest, current)) return void 0;
+  const cli = latest.split(".")[0] === current.split(".")[0] ? globalCli() : void 0;
+  if (!cli) {
+    console.error(available(latest, current));
+    return void 0;
+  }
+  if (npm(installArgs(latest), "pipe").status !== 0) {
+    console.error(`Could not update PayBox CLI to v${latest}; continuing with v${current}. Run \`paybox update\` to see why.`);
+    return void 0;
+  }
+  return { cli, latest };
+}
+async function autoUpdate(command, current) {
+  if (NO_AUTO_UPDATE.has(command) || process.env.PAYBOX_NO_AUTO_UPDATE === "1") return;
+  const updated = process.env.PAYBOX_AUTO_UPDATED;
+  if (updated) {
+    if (isNewer(updated, current)) console.error(available(updated, current));
+    return;
+  }
+  const dir = configDir();
+  if (!startCheck(dir)) return;
+  let next;
+  try {
+    next = await install(current);
+  } finally {
+    unlock(join(dir, "update.lock"));
+  }
+  if (!next) return;
+  console.error(`Updated PayBox CLI v${current} \u2192 v${next.latest}.`);
+  const child = spawnSync(process.execPath, [next.cli, ...process.argv.slice(2)], {
+    stdio: "inherit",
+    env: { ...process.env, PAYBOX_AUTO_UPDATED: next.latest }
+  });
+  process.exit(child.status ?? (child.signal ? 128 + constants.signals[child.signal] : 1));
 }
 
 // src/cli.ts
 var DEFAULT_BASE_URL = "https://api.paybox.sh";
-var PKG = "@paybox-sh/sdk";
 var VERSION = createRequire(import.meta.url)("../package.json").version;
 var program = new Command();
-program.name("paybox").description("PayBox agent CLI \u2014 vaulted cards, wallets, and secrets for agents").version(VERSION).option("--base-url <url>", "API origin (default https://api.paybox.sh or stored)").option("--json", "machine-readable JSON output");
+program.name("paybox").description("PayBox agent CLI \u2014 vaulted cards, wallets, and secrets for agents").version(VERSION).option("--base-url <url>", "API origin (default https://api.paybox.sh or stored)").option("--json", "machine-readable JSON output").hook("preAction", (_, command) => autoUpdate(command.name(), VERSION));
 function jsonMode() {
   return Boolean(program.opts().json);
 }
@@ -711,7 +585,7 @@ function client() {
   return PayboxClient.fromConfig({ baseUrl: program.opts().baseUrl });
 }
 function readIntent(value) {
-  const raw = value.startsWith("@") ? readFileSync(value.slice(1), "utf8") : value;
+  const raw = value.startsWith("@") ? readFileSync2(value.slice(1), "utf8") : value;
   return JSON.parse(raw);
 }
 function readObject(value) {
@@ -750,22 +624,13 @@ function uuid(value, what, hint) {
   if (UUID.test(value)) return value;
   throw new Error(`${what}: got ${JSON.stringify(value)}. ${hint}`);
 }
-function isNewer(a, b) {
-  const pa = a.split(".").map(Number);
-  const pb = b.split(".").map(Number);
-  for (let i = 0; i < 3; i++) {
-    const x = pa[i] ?? 0;
-    const y = pb[i] ?? 0;
-    if (x !== y) return x > y;
-  }
-  return false;
-}
 async function run(fn) {
   try {
     await fn();
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    if (jsonMode()) console.log(JSON.stringify({ error: message }, null, 2));
+    const reason = err instanceof PayboxError ? err.reason : void 0;
+    if (jsonMode()) console.log(JSON.stringify({ error: message, reason }, null, 2));
     else console.error(message);
     process.exitCode = 1;
   }
@@ -807,7 +672,7 @@ program.command("login").description("Authenticate via OAuth device approval, or
     }
   })
 );
-program.command("connect").description("Connect a wallet signing key to this machine by picking a code in PayBox").option("--app-url <url>", "PayBox app origin (default: derived from --base-url)").option("--no-open", "print the pairing link without opening a browser").action(
+program.command("connect").description("Connect a wallet signing key to this machine by picking a number in PayBox").option("--app-url <url>", "PayBox app origin (default: derived from --base-url)").option("--no-open", "print the pairing link without opening a browser").action(
   (opts) => run(async () => {
     const cfg = loadConfig();
     const baseUrl = resolveBaseUrl();
@@ -826,9 +691,9 @@ program.command("connect").description("Connect a wallet signing key to this mac
       bearer,
       onCode(code, url) {
         console.error(`
-  ${code.join("  ")}
+  ${code}
 `);
-        console.error(`Open this on any device and pick that code to connect this machine:
+        console.error(`Open this on any device and pick that number to connect this machine:
   ${url}
 `);
         if (opts.open) openBrowser(url);
@@ -1037,12 +902,7 @@ program.command("request <id>").description("Poll a request's status").option("-
 );
 program.command("version").description("Show the installed CLI version (and whether an update is available)").action(
   () => run(async () => {
-    let latest;
-    try {
-      const res = await fetch(`https://registry.npmjs.org/${PKG}/latest`);
-      if (res.ok) latest = (await res.json()).version;
-    } catch {
-    }
+    const latest = await latestVersion();
     const updateAvailable = Boolean(latest && isNewer(latest, VERSION));
     if (jsonMode()) {
       emit({
@@ -1061,13 +921,13 @@ program.command("version").description("Show the installed CLI version (and whet
 );
 program.command("update").description("Update the globally-installed paybox CLI to the latest version").option("--print", "print the update command instead of running it").action(
   (opts) => run(async () => {
-    const args = ["install", "-g", `${PKG}@latest`];
+    const args = installArgs("latest");
     if (opts.print) {
       console.log(`npm ${args.join(" ")}`);
       return;
     }
     console.error(`Updating ${PKG} (npm ${args.join(" ")})\u2026`);
-    const r = spawnSync("npm", args, { stdio: "inherit" });
+    const r = npm(args, "inherit");
     if (r.status !== 0) {
       console.error(
         `
@@ -1080,7 +940,7 @@ If this isn't a global install: run \`pnpm up ${PKG}\` in your project, or use \
 program.command("uninstall").description("Remove stored PayBox credentials/config (and show how to remove the CLI)").action(
   () => run(async () => {
     const dir = configDir();
-    rmSync(dir, { recursive: true, force: true });
+    rmSync2(dir, { recursive: true, force: true });
     console.error(`Removed stored config at ${dir}.`);
     console.error(
       `The CLI binary is managed by npm \u2014 remove it with: