@probemesh/sdk 0.1.0

package/dist/cli/provider-dossier-check.cjs

@@ -0,0 +1,2978 @@
+#!/usr/bin/env node
+"use strict";
+
+// src/cli/providerDossierCheckCli.ts
+var import_promises2 = require("fs/promises");
+var import_node_path2 = require("path");
+
+// src/cli/configLoader.ts
+var import_promises = require("fs/promises");
+var import_node_path = require("path");
+var import_node_url = require("url");
+async function loadCliConfigDefault(configPath, cwd) {
+  const resolvedPath = (0, import_node_path.resolve)(cwd, configPath);
+  const moduleUrl = (0, import_node_url.pathToFileURL)(resolvedPath);
+  try {
+    const loadedModule = await import(
+      /* @vite-ignore */
+      moduleUrl.href
+    );
+    return loadedModule.default;
+  } catch (error) {
+    return loadSelfContainedConfigFallback(resolvedPath, error);
+  }
+}
+async function loadSelfContainedConfigFallback(resolvedPath, importError) {
+  const source = await (0, import_promises.readFile)(resolvedPath, "utf8");
+  if (/\bimport\s/.test(source) || !/\bexport\s+default\b/.test(source)) {
+    throw importError;
+  }
+  const transformedSource = source.replace(
+    /\bexport\s+default\b/,
+    "const __probemeshDefault ="
+  );
+  try {
+    const factory = new Function(
+      `${transformedSource}
+return __probemeshDefault;`
+    );
+    return factory();
+  } catch {
+    throw importError;
+  }
+}
+
+// src/errors.ts
+var ProbeMeshError = class extends Error {
+  code;
+  status = "failed";
+  capability;
+  provider;
+  callId;
+  receiptRefs;
+  safety;
+  timeline;
+  retrySafety;
+  attempt;
+  route;
+  cause;
+  constructor(options) {
+    super(options.message);
+    this.name = "ProbeMeshError";
+    this.code = options.code;
+    this.capability = options.capability;
+    this.provider = options.provider;
+    this.callId = options.callId;
+    this.receiptRefs = options.receiptRefs;
+    this.safety = options.safety;
+    this.timeline = options.timeline;
+    this.retrySafety = options.retrySafety;
+    this.attempt = options.attempt;
+    this.route = options.route;
+    this.cause = options.cause;
+  }
+  toJSON() {
+    return {
+      name: this.name,
+      code: this.code,
+      message: this.message,
+      status: this.status,
+      capability: this.capability,
+      provider: this.provider,
+      callId: this.callId,
+      receiptRefs: this.receiptRefs,
+      safety: this.safety,
+      timeline: this.timeline,
+      retrySafety: this.retrySafety,
+      attempt: this.attempt,
+      route: this.route
+    };
+  }
+};
+
+// src/paymentOptions.ts
+function resolveProviderPaymentOption(input) {
+  const options = getProviderPaymentOptions(input);
+  const candidates = options.filter((option) => optionSupportsCapability(option, input.capability)).map((option, index) => ({
+    option,
+    index,
+    cost: pricingToCost(resolvePaymentOptionPricing(option, input.capability) ?? resolvePricing(input.pricing, input.capability)),
+    receiptTypes: option.receiptTypes ?? []
+  }));
+  const filtered = candidates.filter(
+    ({ option, receiptTypes }) => optionMatchesPaymentPreferences(option, receiptTypes, input.paymentPreferences)
+  );
+  if (filtered.length === 0) {
+    return {
+      options,
+      reason: createNoPaymentOptionReason(input, candidates.length)
+    };
+  }
+  const selected = choosePaymentOption(
+    filtered,
+    input.paymentPreferences,
+    input.paymentStrategy
+  );
+  return {
+    options,
+    selection: {
+      providerId: input.providerId,
+      optionId: selected.option.id,
+      protocolMode: selected.option.protocolMode,
+      cost: selected.cost,
+      receiptTypes: [...selected.receiptTypes],
+      score: selected.score,
+      scoreReasons: [...selected.scoreReasons],
+      metadata: cloneSerializable(selected.option.metadata)
+    }
+  };
+}
+function getProviderPaymentOptions(input) {
+  if (input.paymentOptions && input.paymentOptions.length > 0) {
+    return cloneSerializable(input.paymentOptions);
+  }
+  return [
+    {
+      id: "default",
+      protocolMode: input.providerMode ?? "local",
+      capabilities: [...input.capabilities],
+      ...input.pricing !== void 0 ? { pricing: cloneSerializable(input.pricing) } : {},
+      receiptTypes: [...input.defaultReceiptTypes ?? []]
+    }
+  ];
+}
+function validateProviderPaymentOptions(paymentOptions, path, capabilities, errors) {
+  if (paymentOptions === void 0) {
+    return;
+  }
+  if (!Array.isArray(paymentOptions) || paymentOptions.length === 0) {
+    errors.push({
+      path,
+      message: "paymentOptions must be a non-empty array when provided."
+    });
+    return;
+  }
+  const seen = /* @__PURE__ */ new Set();
+  paymentOptions.forEach((option, index) => {
+    const optionPath = `${path}.${index}`;
+    if (!isRecord(option)) {
+      errors.push({
+        path: optionPath,
+        message: "payment option must be an object."
+      });
+      return;
+    }
+    validateNonEmptyString(option.id, `${optionPath}.id`, errors);
+    validateNonEmptyString(option.protocolMode, `${optionPath}.protocolMode`, errors);
+    if (typeof option.id === "string") {
+      if (seen.has(option.id)) {
+        errors.push({
+          path: `${optionPath}.id`,
+          message: `duplicate payment option "${option.id}".`
+        });
+      }
+      seen.add(option.id);
+    }
+    if (option.capabilities !== void 0) {
+      validateStringArray(option.capabilities, `${optionPath}.capabilities`, errors);
+      if (Array.isArray(option.capabilities)) {
+        for (const capability of option.capabilities) {
+          if (typeof capability === "string" && capability.length > 0 && !capabilities.includes(capability)) {
+            errors.push({
+              path: `${optionPath}.capabilities`,
+              message: `payment option capability "${capability}" is not declared by the provider.`
+            });
+          }
+        }
+      }
+    }
+    if (option.pricing !== void 0) {
+      validatePricingDeclaration(option.pricing, `${optionPath}.pricing`, errors);
+    }
+    if (option.receiptTypes !== void 0) {
+      if (!Array.isArray(option.receiptTypes) || option.receiptTypes.some((receiptType) => !isReceiptType(receiptType))) {
+        errors.push({
+          path: `${optionPath}.receiptTypes`,
+          message: "payment option receiptTypes must contain known receipt types."
+        });
+      }
+    }
+    if (option.metadata !== void 0 && !isRecord(option.metadata)) {
+      errors.push({
+        path: `${optionPath}.metadata`,
+        message: "payment option metadata must be an object when provided."
+      });
+    }
+  });
+}
+function validatePaymentPreferences(paymentPreferences, capability) {
+  if (paymentPreferences === void 0) {
+    return;
+  }
+  if (!isRecord(paymentPreferences)) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: "paymentPreferences must be an object when provided.",
+      capability
+    });
+  }
+  validatePreferenceStringArray(
+    paymentPreferences.allowedProtocols,
+    "allowedProtocols",
+    capability
+  );
+  validatePreferenceStringArray(
+    paymentPreferences.preferredProtocols,
+    "preferredProtocols",
+    capability
+  );
+  validatePreferenceStringArray(
+    paymentPreferences.blockedProtocols,
+    "blockedProtocols",
+    capability
+  );
+  validatePreferenceStringArray(
+    paymentPreferences.allowedPaymentOptions,
+    "allowedPaymentOptions",
+    capability
+  );
+  validatePreferenceStringArray(
+    paymentPreferences.preferredPaymentOptions,
+    "preferredPaymentOptions",
+    capability
+  );
+  validatePreferenceStringArray(
+    paymentPreferences.blockedPaymentOptions,
+    "blockedPaymentOptions",
+    capability
+  );
+  if (paymentPreferences.requiredReceiptTypes !== void 0 && (!Array.isArray(paymentPreferences.requiredReceiptTypes) || paymentPreferences.requiredReceiptTypes.some((receiptType) => !isReceiptType(receiptType)))) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: "paymentPreferences.requiredReceiptTypes must contain known receipt types.",
+      capability
+    });
+  }
+}
+function validatePaymentStrategy(paymentStrategy, capability) {
+  if (paymentStrategy === void 0) {
+    return;
+  }
+  if (!isRecord(paymentStrategy)) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: "paymentStrategy must be an object when provided.",
+      capability
+    });
+  }
+  if (!isPaymentStrategyMode(paymentStrategy.mode)) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: 'paymentStrategy.mode must be one of "provider_order", "lowest_cost", "preferred_protocol", or "receipt_coverage".',
+      capability
+    });
+  }
+  if (paymentStrategy.preferredReceiptTypes !== void 0 && (!Array.isArray(paymentStrategy.preferredReceiptTypes) || paymentStrategy.preferredReceiptTypes.some(
+    (receiptType) => !isReceiptType(receiptType)
+  ))) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: "paymentStrategy.preferredReceiptTypes must contain known receipt types.",
+      capability
+    });
+  }
+}
+function mergePaymentPreferences(first, second) {
+  if (!first && !second) {
+    return void 0;
+  }
+  return compactPaymentPreferences({
+    allowedProtocols: intersectArrays(first?.allowedProtocols, second?.allowedProtocols),
+    preferredProtocols: second?.preferredProtocols ?? first?.preferredProtocols,
+    blockedProtocols: unionArrays(first?.blockedProtocols, second?.blockedProtocols),
+    allowedPaymentOptions: intersectArrays(
+      first?.allowedPaymentOptions,
+      second?.allowedPaymentOptions
+    ),
+    preferredPaymentOptions: second?.preferredPaymentOptions ?? first?.preferredPaymentOptions,
+    blockedPaymentOptions: unionArrays(
+      first?.blockedPaymentOptions,
+      second?.blockedPaymentOptions
+    ),
+    requiredReceiptTypes: unionArrays(
+      first?.requiredReceiptTypes,
+      second?.requiredReceiptTypes
+    )
+  });
+}
+function optionSupportsCapability(option, capability) {
+  return !option.capabilities || option.capabilities.includes(capability);
+}
+function optionMatchesPaymentPreferences(option, receiptTypes, preferences) {
+  if (!preferences) {
+    return true;
+  }
+  if (preferences.allowedProtocols && !preferences.allowedProtocols.includes(option.protocolMode)) {
+    return false;
+  }
+  if (preferences.blockedProtocols?.includes(option.protocolMode)) {
+    return false;
+  }
+  if (preferences.allowedPaymentOptions && !preferences.allowedPaymentOptions.includes(option.id)) {
+    return false;
+  }
+  if (preferences.blockedPaymentOptions?.includes(option.id)) {
+    return false;
+  }
+  const receiptSet = new Set(receiptTypes);
+  return (preferences.requiredReceiptTypes ?? []).every(
+    (receiptType) => receiptSet.has(receiptType)
+  );
+}
+function choosePaymentOption(candidates, preferences, strategy) {
+  const mode = strategy?.mode ?? "provider_order";
+  const ranked = [...candidates].sort(
+    (left, right) => comparePaymentOptions(left, right, preferences, strategy)
+  );
+  return ranked.map((candidate, rank) => ({
+    ...candidate,
+    score: rank,
+    scoreReasons: createScoreReasons(candidate, preferences, strategy, mode)
+  }))[0];
+}
+function preferenceIndex(preferences, value) {
+  const index = preferences.indexOf(value);
+  return index === -1 ? Number.MAX_SAFE_INTEGER : index;
+}
+function comparePaymentOptions(left, right, preferences, strategy) {
+  switch (strategy?.mode ?? "provider_order") {
+    case "lowest_cost":
+      return compareCost(left, right) || left.index - right.index;
+    case "preferred_protocol":
+      return comparePreferredProtocol(left, right, preferences) || compareCost(left, right) || left.index - right.index;
+    case "receipt_coverage":
+      return compareReceiptCoverage(left, right, preferences, strategy) || comparePreferredProtocol(left, right, preferences) || compareCost(left, right) || left.index - right.index;
+    case "provider_order":
+      return compareProviderOrder(left, right, preferences);
+  }
+}
+function compareProviderOrder(left, right, preferences) {
+  const optionPreference = preferences?.preferredPaymentOptions ?? [];
+  const protocolPreference = preferences?.preferredProtocols ?? [];
+  const optionPreferenceDelta = preferenceIndex(optionPreference, left.option.id) - preferenceIndex(optionPreference, right.option.id);
+  if (optionPreferenceDelta !== 0) {
+    return optionPreferenceDelta;
+  }
+  const protocolPreferenceDelta = preferenceIndex(protocolPreference, left.option.protocolMode) - preferenceIndex(protocolPreference, right.option.protocolMode);
+  if (protocolPreferenceDelta !== 0) {
+    return protocolPreferenceDelta;
+  }
+  return left.index - right.index;
+}
+function comparePreferredProtocol(left, right, preferences) {
+  const protocolPreference = preferences?.preferredProtocols ?? [];
+  return preferenceIndex(protocolPreference, left.option.protocolMode) - preferenceIndex(protocolPreference, right.option.protocolMode);
+}
+function compareCost(left, right) {
+  const leftCost = costSortValue(left.cost);
+  const rightCost = costSortValue(right.cost);
+  if (leftCost === rightCost) {
+    return 0;
+  }
+  return leftCost < rightCost ? -1 : 1;
+}
+function compareReceiptCoverage(left, right, preferences, strategy) {
+  return receiptCoverage(right, preferences, strategy) - receiptCoverage(left, preferences, strategy);
+}
+function receiptCoverage(candidate, preferences, strategy) {
+  const desiredReceiptTypes = strategy?.preferredReceiptTypes ?? preferences?.requiredReceiptTypes ?? [];
+  const receiptSet = new Set(candidate.receiptTypes);
+  if (desiredReceiptTypes.length > 0) {
+    return desiredReceiptTypes.filter((receiptType) => receiptSet.has(receiptType)).length;
+  }
+  return receiptSet.size;
+}
+function costSortValue(cost) {
+  return cost?.amountUsd ?? Number.POSITIVE_INFINITY;
+}
+function createScoreReasons(candidate, preferences, strategy, mode) {
+  const reasons = [`strategy:${mode}`];
+  if (mode === "provider_order") {
+    const preferredOptionIndex = preferenceIndex(
+      preferences?.preferredPaymentOptions ?? [],
+      candidate.option.id
+    );
+    const preferredProtocolIndex = preferenceIndex(
+      preferences?.preferredProtocols ?? [],
+      candidate.option.protocolMode
+    );
+    if (preferredOptionIndex !== Number.MAX_SAFE_INTEGER) {
+      reasons.push(`preferred_option:${candidate.option.id}`);
+    } else if (preferredProtocolIndex !== Number.MAX_SAFE_INTEGER) {
+      reasons.push(`preferred_protocol:${candidate.option.protocolMode}`);
+    } else {
+      reasons.push(`provider_order:${candidate.index}`);
+    }
+  }
+  if (mode === "lowest_cost" || mode === "preferred_protocol" || mode === "receipt_coverage") {
+    reasons.push(
+      candidate.cost ? `cost:${candidate.cost.amountUsd}` : "cost:unknown"
+    );
+  }
+  if (mode === "preferred_protocol") {
+    reasons.push(
+      isPreferredProtocol(candidate, preferences) ? `preferred_protocol:${candidate.option.protocolMode}` : `protocol:${candidate.option.protocolMode}`
+    );
+  }
+  if (mode === "receipt_coverage") {
+    const desiredReceiptTypes = strategy?.preferredReceiptTypes ?? preferences?.requiredReceiptTypes ?? [];
+    reasons.push(
+      desiredReceiptTypes.length > 0 ? `receipt_coverage:${receiptCoverage(candidate, preferences, strategy)}/${desiredReceiptTypes.length}` : `receipt_coverage:${candidate.receiptTypes.length}`
+    );
+    if (isPreferredProtocol(candidate, preferences)) {
+      reasons.push(`preferred_protocol:${candidate.option.protocolMode}`);
+    }
+  }
+  return reasons;
+}
+function isPreferredProtocol(candidate, preferences) {
+  return preferences?.preferredProtocols?.includes(candidate.option.protocolMode) ?? false;
+}
+function createNoPaymentOptionReason(input, capabilityCandidateCount) {
+  if (capabilityCandidateCount === 0) {
+    return `Provider "${input.providerId}" has no payment option for capability "${input.capability}".`;
+  }
+  return `Provider "${input.providerId}" has no payment option matching paymentPreferences for capability "${input.capability}".`;
+}
+function resolvePaymentOptionPricing(option, capability) {
+  return resolvePricing(option.pricing, capability);
+}
+function resolvePricing(pricing, capability) {
+  if (!pricing) {
+    return void 0;
+  }
+  if (isPricing(pricing)) {
+    return pricing;
+  }
+  const capabilityPricing = pricing[capability];
+  return isPricing(capabilityPricing) ? capabilityPricing : void 0;
+}
+function pricingToCost(pricing) {
+  if (!pricing) {
+    return void 0;
+  }
+  return {
+    amountUsd: pricing.amountUsd,
+    currency: pricing.currency ?? "USD",
+    unit: pricing.unit
+  };
+}
+function validatePreferenceStringArray(value, field, capability) {
+  if (value !== void 0 && (!Array.isArray(value) || value.some((entry) => typeof entry !== "string" || entry.length === 0))) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: `paymentPreferences.${field} must be an array of non-empty strings when provided.`,
+      capability
+    });
+  }
+}
+function validatePricingDeclaration(pricing, path, errors) {
+  if (!isRecord(pricing)) {
+    errors.push({
+      path,
+      message: "payment option pricing must be an object."
+    });
+    return;
+  }
+  if (isPricing(pricing)) {
+    validatePricing(pricing, path, errors);
+    return;
+  }
+  for (const [capability, capabilityPricing] of Object.entries(pricing)) {
+    validatePricing(capabilityPricing, `${path}.${capability}`, errors);
+  }
+}
+function validatePricing(pricing, path, errors) {
+  if (!isRecord(pricing)) {
+    errors.push({
+      path,
+      message: "payment option pricing entry must be an object."
+    });
+    return;
+  }
+  validateNonEmptyString(pricing.unit, `${path}.unit`, errors);
+  if (typeof pricing.amountUsd !== "number" || !Number.isFinite(pricing.amountUsd) || pricing.amountUsd < 0) {
+    errors.push({
+      path: `${path}.amountUsd`,
+      message: "amountUsd must be a non-negative number."
+    });
+  }
+  if (pricing.currency !== void 0 && typeof pricing.currency !== "string") {
+    errors.push({
+      path: `${path}.currency`,
+      message: "currency must be a string when provided."
+    });
+  }
+}
+function validateStringArray(value, path, errors) {
+  if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string" || entry.length === 0)) {
+    errors.push({
+      path,
+      message: `${path} must be an array of non-empty strings.`
+    });
+  }
+}
+function validateNonEmptyString(value, path, errors) {
+  if (typeof value !== "string" || value.length === 0) {
+    errors.push({
+      path,
+      message: `${path} must be a non-empty string.`
+    });
+  }
+}
+function isPricing(value) {
+  return isRecord(value) && typeof value.unit === "string" && value.unit.length > 0 && typeof value.amountUsd === "number" && Number.isFinite(value.amountUsd) && value.amountUsd >= 0 && (value.currency === void 0 || typeof value.currency === "string");
+}
+function isReceiptType(value) {
+  return value === "payment_proof" || value === "settlement_confirmation" || value === "provider_delivery" || value === "provider_response_evidence" || value === "authorization_decision";
+}
+function isPaymentStrategyMode(value) {
+  return value === "provider_order" || value === "lowest_cost" || value === "preferred_protocol" || value === "receipt_coverage";
+}
+function compactPaymentPreferences(preferences) {
+  const entries = Object.entries(preferences).filter(
+    ([, value]) => value !== void 0 && (!Array.isArray(value) || value.length > 0)
+  );
+  return entries.length > 0 ? Object.fromEntries(entries) : void 0;
+}
+function intersectArrays(first, second) {
+  if (first === void 0) {
+    return second === void 0 ? void 0 : [...second];
+  }
+  if (second === void 0) {
+    return [...first];
+  }
+  const secondValues = new Set(second);
+  return first.filter((value) => secondValues.has(value));
+}
+function unionArrays(first, second) {
+  const values = [...first ?? [], ...second ?? []];
+  return values.length > 0 ? [...new Set(values)] : void 0;
+}
+function isRecord(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function cloneSerializable(value) {
+  if (value === void 0) {
+    return value;
+  }
+  return JSON.parse(JSON.stringify(value));
+}
+
+// src/providerKit/manifest.ts
+var JSON_SCHEMA_HINT_KEYS = /* @__PURE__ */ new Set([
+  "$schema",
+  "$id",
+  "type",
+  "properties",
+  "required",
+  "items",
+  "enum",
+  "description",
+  "additionalProperties",
+  "oneOf",
+  "anyOf",
+  "allOf"
+]);
+function validateProviderManifest(manifest) {
+  const errors = [];
+  if (!isRecord2(manifest)) {
+    return {
+      valid: false,
+      errors: [
+        {
+          path: "$",
+          message: "Provider manifest must be an object."
+        }
+      ]
+    };
+  }
+  validateNonEmptyString2(manifest.id, "id", errors);
+  validateNonEmptyString2(manifest.displayName, "displayName", errors);
+  validateCapabilityList(manifest.capabilities, errors);
+  validateNonEmptyString2(manifest.protocolMode, "protocolMode", errors);
+  validateProviderPaymentOptions(
+    manifest.paymentOptions,
+    "paymentOptions",
+    Array.isArray(manifest.capabilities) ? manifest.capabilities : [],
+    errors
+  );
+  validatePricingDeclaration2(
+    manifest.pricing,
+    "pricing",
+    manifest.capabilities,
+    errors
+  );
+  validateSchemaDeclaration(
+    manifest.inputSchema,
+    "inputSchema",
+    manifest.capabilities,
+    errors
+  );
+  validateSchemaDeclaration(
+    manifest.outputSchema,
+    "outputSchema",
+    manifest.capabilities,
+    errors
+  );
+  validateReceipts(manifest.receipts, errors);
+  if (manifest.limits !== void 0) {
+    validateLimits(manifest.limits, errors);
+  }
+  return {
+    valid: errors.length === 0,
+    errors
+  };
+}
+function isSharedJsonSchemaLike(value) {
+  if (!isRecord2(value)) {
+    return false;
+  }
+  return Object.keys(value).some((key) => JSON_SCHEMA_HINT_KEYS.has(key));
+}
+function isSharedPricing(value) {
+  return isRecord2(value) && typeof value.unit === "string" && value.unit.length > 0 && typeof value.amountUsd === "number";
+}
+function validateCapabilityList(capabilities, errors) {
+  if (!Array.isArray(capabilities) || capabilities.length === 0) {
+    errors.push({
+      path: "capabilities",
+      message: "capabilities must be a non-empty array."
+    });
+    return;
+  }
+  const seen = /* @__PURE__ */ new Set();
+  capabilities.forEach((capability, index) => {
+    if (typeof capability !== "string" || capability.length === 0) {
+      errors.push({
+        path: `capabilities.${index}`,
+        message: "capability ids must be non-empty strings."
+      });
+      return;
+    }
+    if (seen.has(capability)) {
+      errors.push({
+        path: `capabilities.${index}`,
+        message: `duplicate capability "${capability}".`
+      });
+    }
+    seen.add(capability);
+  });
+}
+function validatePricingDeclaration2(pricing, path, capabilities, errors) {
+  if (!isRecord2(pricing)) {
+    errors.push({
+      path,
+      message: "pricing must be an object."
+    });
+    return;
+  }
+  if (isSharedPricing(pricing)) {
+    validatePricing2(pricing, path, errors);
+    return;
+  }
+  if (!Array.isArray(capabilities)) {
+    return;
+  }
+  for (const capability of capabilities) {
+    if (typeof capability !== "string" || capability.length === 0) {
+      continue;
+    }
+    validatePricing2(pricing[capability], `${path}.${capability}`, errors);
+  }
+}
+function validatePricing2(pricing, path, errors) {
+  if (!isRecord2(pricing)) {
+    errors.push({
+      path,
+      message: "pricing entry must be an object."
+    });
+    return;
+  }
+  validateNonEmptyString2(pricing.unit, `${path}.unit`, errors);
+  if (typeof pricing.amountUsd !== "number" || !Number.isFinite(pricing.amountUsd) || pricing.amountUsd < 0) {
+    errors.push({
+      path: `${path}.amountUsd`,
+      message: "amountUsd must be a non-negative number."
+    });
+  }
+  if (pricing.currency !== void 0 && typeof pricing.currency !== "string") {
+    errors.push({
+      path: `${path}.currency`,
+      message: "currency must be a string when provided."
+    });
+  }
+}
+function validateSchemaDeclaration(schema, path, capabilities, errors) {
+  if (!isRecord2(schema)) {
+    errors.push({
+      path,
+      message: `${path} must be an object.`
+    });
+    return;
+  }
+  if (isSharedJsonSchemaLike(schema)) {
+    validateSchemaLike(schema, path, errors);
+    return;
+  }
+  if (!Array.isArray(capabilities)) {
+    return;
+  }
+  for (const capability of capabilities) {
+    if (typeof capability !== "string" || capability.length === 0) {
+      continue;
+    }
+    validateSchemaLike(schema[capability], `${path}.${capability}`, errors);
+  }
+}
+function validateSchemaLike(schema, path, errors) {
+  if (!isRecord2(schema)) {
+    errors.push({
+      path,
+      message: "schema entry must be an object."
+    });
+    return;
+  }
+  if (schema.type !== void 0 && typeof schema.type !== "string") {
+    errors.push({
+      path: `${path}.type`,
+      message: "schema type must be a string when provided."
+    });
+  }
+  if (schema.properties !== void 0 && !isRecord2(schema.properties)) {
+    errors.push({
+      path: `${path}.properties`,
+      message: "schema properties must be an object when provided."
+    });
+  }
+  if (schema.required !== void 0 && (!Array.isArray(schema.required) || schema.required.some((field) => typeof field !== "string"))) {
+    errors.push({
+      path: `${path}.required`,
+      message: "schema required must be an array of strings when provided."
+    });
+  }
+}
+function validateReceipts(receipts, errors) {
+  if (!isRecord2(receipts)) {
+    errors.push({
+      path: "receipts",
+      message: "receipts must be an object."
+    });
+    return;
+  }
+  validateBoolean(receipts.payment, "receipts.payment", errors);
+  validateBoolean(receipts.delivery, "receipts.delivery", errors);
+  validateBoolean(
+    receipts.responseEvidence,
+    "receipts.responseEvidence",
+    errors
+  );
+}
+function validateLimits(limits, errors) {
+  if (!isRecord2(limits)) {
+    errors.push({
+      path: "limits",
+      message: "limits must be an object when provided."
+    });
+    return;
+  }
+  const typedLimits = limits;
+  if (typedLimits.maxRequestsPerMinute !== void 0 && (!Number.isFinite(typedLimits.maxRequestsPerMinute) || typedLimits.maxRequestsPerMinute <= 0)) {
+    errors.push({
+      path: "limits.maxRequestsPerMinute",
+      message: "maxRequestsPerMinute must be a positive number when provided."
+    });
+  }
+}
+function validateNonEmptyString2(value, path, errors) {
+  if (typeof value !== "string" || value.length === 0) {
+    errors.push({
+      path,
+      message: `${path} must be a non-empty string.`
+    });
+  }
+}
+function validateBoolean(value, path, errors) {
+  if (typeof value !== "boolean") {
+    errors.push({
+      path,
+      message: `${path} must be a boolean.`
+    });
+  }
+}
+function isRecord2(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+// src/protocols/x402Redaction.ts
+var DEFAULT_REPLACEMENT = "[REDACTED]";
+var DEFAULT_MAX_DEPTH = 12;
+var PRIVATE_KEY_PATTERN = /\b0x[a-fA-F0-9]{64}\b/g;
+var HEX_SIGNATURE_PATTERN = /\b0x[a-fA-F0-9]{130}\b/g;
+var SECRET_FIELD_NAMES = /* @__PURE__ */ new Set([
+  "api-key",
+  "apikey",
+  "authorization",
+  "bearer",
+  "payment-required",
+  "payment-response",
+  "payment-signature",
+  "privatekey",
+  "signature",
+  "x-api-key"
+]);
+function redactX402Secrets(value, options = {}) {
+  const replacement = options.replacement ?? DEFAULT_REPLACEMENT;
+  const maxDepth = options.maxDepth ?? DEFAULT_MAX_DEPTH;
+  const seen = /* @__PURE__ */ new WeakSet();
+  return redactValue(value, {
+    replacement,
+    maxDepth,
+    depth: 0,
+    seen,
+    key: void 0
+  });
+}
+function redactValue(value, context) {
+  if (context.key && shouldRedactKey(context.key)) {
+    return context.replacement;
+  }
+  if (typeof value === "string") {
+    return redactString(value, context.replacement);
+  }
+  if (value === null || typeof value !== "object" || value instanceof Date) {
+    return value;
+  }
+  if (context.depth >= context.maxDepth) {
+    return "[MaxDepth]";
+  }
+  if (context.seen.has(value)) {
+    return "[Circular]";
+  }
+  context.seen.add(value);
+  if (Array.isArray(value)) {
+    return value.map(
+      (entry) => redactValue(entry, {
+        ...context,
+        depth: context.depth + 1,
+        key: void 0
+      })
+    );
+  }
+  return Object.fromEntries(
+    Object.entries(value).map(([key, entry]) => [
+      key,
+      redactValue(entry, {
+        ...context,
+        depth: context.depth + 1,
+        key
+      })
+    ])
+  );
+}
+function shouldRedactKey(key) {
+  const normalized = key.toLowerCase().replace(/_/g, "-");
+  return SECRET_FIELD_NAMES.has(normalized) || normalized.includes("private-key") || normalized.includes("privatekey") || normalized.includes("payment-signature") || normalized.includes("payment-response") || normalized.includes("payment-required") || normalized.includes("api-key");
+}
+function redactString(value, replacement) {
+  return value.replace(PRIVATE_KEY_PATTERN, replacement).replace(HEX_SIGNATURE_PATTERN, replacement);
+}
+
+// src/providerCatalogArtifact.ts
+var PROVIDER_CATALOG_ARTIFACT_SCHEMA_VERSION = "probemesh.provider-catalog.v1";
+function validateProviderCatalogArtifact(artifact) {
+  const errors = [];
+  if (!isRecord3(artifact)) {
+    return {
+      valid: false,
+      errors: [
+        {
+          path: "$",
+          message: "Provider catalog artifact must be an object."
+        }
+      ]
+    };
+  }
+  if (artifact.schemaVersion !== PROVIDER_CATALOG_ARTIFACT_SCHEMA_VERSION) {
+    errors.push({
+      path: "schemaVersion",
+      message: `schemaVersion must be "${PROVIDER_CATALOG_ARTIFACT_SCHEMA_VERSION}".`
+    });
+  }
+  validateNonEmptyString3(artifact.artifactId, "artifactId", errors);
+  validateIsoTimestamp(artifact.generatedAt, "generatedAt", errors);
+  if (artifact.status !== "ready" && artifact.status !== "rejected") {
+    errors.push({
+      path: "status",
+      message: 'status must be "ready" or "rejected".'
+    });
+  }
+  const manifestValidation = validateProviderManifest(artifact.provider);
+  for (const manifestError of manifestValidation.errors) {
+    errors.push({
+      path: `provider.${manifestError.path}`,
+      message: manifestError.message
+    });
+  }
+  validateAcceptanceArtifact(artifact.acceptance, errors);
+  return {
+    valid: errors.length === 0,
+    errors
+  };
+}
+function validateAcceptanceArtifact(acceptance, errors) {
+  if (!isRecord3(acceptance)) {
+    errors.push({
+      path: "acceptance",
+      message: "acceptance must be an object."
+    });
+    return;
+  }
+  validateNonEmptyString3(acceptance.title, "acceptance.title", errors);
+  if (acceptance.status !== "passed" && acceptance.status !== "failed") {
+    errors.push({
+      path: "acceptance.status",
+      message: 'acceptance.status must be "passed" or "failed".'
+    });
+  }
+  if (!isRecord3(acceptance.gate)) {
+    errors.push({
+      path: "acceptance.gate",
+      message: "acceptance.gate must be an object."
+    });
+  } else {
+    if (typeof acceptance.gate.accepted !== "boolean") {
+      errors.push({
+        path: "acceptance.gate.accepted",
+        message: "acceptance.gate.accepted must be a boolean."
+      });
+    }
+    if (acceptance.gate.status !== "accepted" && acceptance.gate.status !== "rejected") {
+      errors.push({
+        path: "acceptance.gate.status",
+        message: 'acceptance.gate.status must be "accepted" or "rejected".'
+      });
+    }
+  }
+  validateStringArray2(
+    acceptance.failedChecks,
+    "acceptance.failedChecks",
+    errors
+  );
+  validateReceiptSummary(acceptance.receipts, errors);
+  validateStringArray2(
+    acceptance.timelineEventTypes,
+    "acceptance.timelineEventTypes",
+    errors
+  );
+  validateStringArray2(
+    acceptance.telemetryEventTypes,
+    "acceptance.telemetryEventTypes",
+    errors
+  );
+}
+function validateReceiptSummary(receipts, errors) {
+  if (!isRecord3(receipts)) {
+    errors.push({
+      path: "acceptance.receipts",
+      message: "acceptance.receipts must be an object."
+    });
+    return;
+  }
+  if (typeof receipts.total !== "number" || !Number.isFinite(receipts.total)) {
+    errors.push({
+      path: "acceptance.receipts.total",
+      message: "acceptance.receipts.total must be a number."
+    });
+  }
+  validateStringArray2(receipts.types, "acceptance.receipts.types", errors);
+  validateStringArray2(
+    receipts.providers,
+    "acceptance.receipts.providers",
+    errors
+  );
+  for (const key of [
+    "hasPaymentProof",
+    "hasSettlementConfirmation",
+    "hasProviderDelivery"
+  ]) {
+    if (typeof receipts[key] !== "boolean") {
+      errors.push({
+        path: `acceptance.receipts.${key}`,
+        message: `acceptance.receipts.${key} must be a boolean.`
+      });
+    }
+  }
+}
+function validateStringArray2(value, path, errors) {
+  if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string")) {
+    errors.push({
+      path,
+      message: `${path} must be an array of strings.`
+    });
+  }
+}
+function validateNonEmptyString3(value, path, errors) {
+  if (typeof value !== "string" || value.length === 0) {
+    errors.push({
+      path,
+      message: `${path} must be a non-empty string.`
+    });
+  }
+}
+function validateIsoTimestamp(value, path, errors) {
+  if (typeof value !== "string" || Number.isNaN(Date.parse(value))) {
+    errors.push({
+      path,
+      message: `${path} must be an ISO timestamp string.`
+    });
+  }
+}
+function isRecord3(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+
+// src/providerCatalog.ts
+var PROVIDER_CATALOG_SCHEMA_VERSION = "probemesh.provider-catalog.index.v1";
+function validateProviderCatalog(catalog) {
+  const errors = [];
+  if (!isRecord4(catalog)) {
+    return {
+      valid: false,
+      errors: [
+        {
+          path: "$",
+          message: "Provider catalog must be an object."
+        }
+      ]
+    };
+  }
+  if (catalog.schemaVersion !== PROVIDER_CATALOG_SCHEMA_VERSION) {
+    errors.push({
+      path: "schemaVersion",
+      message: `schemaVersion must be "${PROVIDER_CATALOG_SCHEMA_VERSION}".`
+    });
+  }
+  validateIsoTimestamp2(catalog.generatedAt, "generatedAt", errors);
+  if (!Array.isArray(catalog.entries)) {
+    errors.push({
+      path: "entries",
+      message: "entries must be an array."
+    });
+  } else {
+    catalog.entries.forEach(
+      (entry, index) => validateProviderCatalogEntry(entry, `entries.${index}`, errors)
+    );
+  }
+  return {
+    valid: errors.length === 0,
+    errors
+  };
+}
+function assertProviderCatalog(catalog) {
+  const result = validateProviderCatalog(catalog);
+  if (result.valid) {
+    return;
+  }
+  throw new ProbeMeshError({
+    code: "invalid_request",
+    message: `Invalid provider catalog: ${formatValidationErrors(result.errors)}`
+  });
+}
+function createProviderCatalog(options) {
+  assertProviderCatalogOptions(options);
+  const entries = options.artifacts.map((artifact, index) => {
+    const validation = validateProviderCatalogArtifact(artifact);
+    if (!validation.valid) {
+      throw new ProbeMeshError({
+        code: "invalid_request",
+        message: `Invalid provider catalog artifact at index ${index}: ${formatValidationErrors(
+          validation.errors
+        )}`
+      });
+    }
+    return createCatalogEntryFromArtifact(artifact);
+  });
+  const catalog = {
+    schemaVersion: PROVIDER_CATALOG_SCHEMA_VERSION,
+    generatedAt: options.generatedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+    entries
+  };
+  assertProviderCatalog(catalog);
+  return catalog;
+}
+function findProviderCatalogMatches(catalog, query) {
+  assertProviderCatalog(catalog);
+  assertProviderCatalogQuery(query);
+  const requiredStatus = query.status ?? "ready";
+  const requiredReceiptTypes = query.requiredReceiptTypes ?? [];
+  const providerIds = query.providerIds;
+  const blockedProviderIds = new Set(query.blockedProviderIds ?? []);
+  return catalog.entries.flatMap((entry) => {
+    const providerId = entry.provider.id;
+    if (entry.status !== requiredStatus) {
+      return [];
+    }
+    if (!entry.provider.capabilities.includes(query.capability)) {
+      return [];
+    }
+    if (query.protocolMode !== void 0 && entry.provider.protocolMode !== query.protocolMode) {
+      return [];
+    }
+    if (providerIds !== void 0 && !providerIds.includes(providerId)) {
+      return [];
+    }
+    if (blockedProviderIds.has(providerId)) {
+      return [];
+    }
+    const paymentPreferences = mergePaymentPreferences(
+      query.protocolMode ? {
+        allowedProtocols: [query.protocolMode]
+      } : void 0,
+      query.paymentPreferences
+    );
+    const paymentResolution = resolveProviderPaymentOption({
+      providerId,
+      providerMode: entry.provider.protocolMode,
+      capabilities: entry.provider.capabilities,
+      capability: query.capability,
+      pricing: entry.provider.pricing,
+      paymentOptions: entry.provider.paymentOptions,
+      paymentPreferences,
+      paymentStrategy: query.paymentStrategy,
+      defaultReceiptTypes: entry.acceptance.receipts.types
+    });
+    const cost = paymentSelectionCost(paymentResolution.selection) ?? resolveCatalogCost(entry, query.capability);
+    if (query.maxCostUsd !== void 0 && (cost === void 0 || cost.amountUsd > query.maxCostUsd)) {
+      return [];
+    }
+    if (!hasRequiredReceiptTypes(entry, requiredReceiptTypes)) {
+      return [];
+    }
+    if (!paymentResolution.selection) {
+      return [];
+    }
+    return [
+      {
+        entry,
+        providerId,
+        capability: query.capability,
+        status: entry.status,
+        cost,
+        paymentSelection: paymentResolution.selection,
+        reasons: createMatchReasons(
+          entry,
+          query,
+          cost,
+          paymentResolution.selection
+        )
+      }
+    ];
+  });
+}
+function summarizeProviderCatalog(catalog) {
+  assertProviderCatalog(catalog);
+  const providers = /* @__PURE__ */ new Set();
+  const capabilities = /* @__PURE__ */ new Set();
+  const protocolModes = /* @__PURE__ */ new Set();
+  let readyEntries = 0;
+  let rejectedEntries = 0;
+  for (const entry of catalog.entries) {
+    providers.add(entry.provider.id);
+    protocolModes.add(entry.provider.protocolMode);
+    for (const capability of entry.provider.capabilities) {
+      capabilities.add(capability);
+    }
+    if (entry.status === "ready") {
+      readyEntries += 1;
+    } else {
+      rejectedEntries += 1;
+    }
+  }
+  return {
+    schemaVersion: catalog.schemaVersion,
+    generatedAt: catalog.generatedAt,
+    totalEntries: catalog.entries.length,
+    readyEntries,
+    rejectedEntries,
+    providers: [...providers],
+    capabilities: [...capabilities],
+    protocolModes: [...protocolModes]
+  };
+}
+function assertProviderCatalogOptions(options) {
+  if (!isRecord4(options)) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: "Provider catalog options must be an object."
+    });
+  }
+  if (!Array.isArray(options.artifacts)) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: "Provider catalog options require an artifacts array."
+    });
+  }
+  if (options.generatedAt !== void 0 && (typeof options.generatedAt !== "string" || Number.isNaN(Date.parse(options.generatedAt)))) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: "Provider catalog generatedAt must be an ISO timestamp."
+    });
+  }
+}
+function assertProviderCatalogQuery(query) {
+  if (!isRecord4(query)) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: "Provider catalog query must be an object."
+    });
+  }
+  if (typeof query.capability !== "string" || query.capability.length === 0) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: "Provider catalog query capability must be a non-empty string."
+    });
+  }
+  if (query.protocolMode !== void 0 && (typeof query.protocolMode !== "string" || query.protocolMode.length === 0)) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: "Provider catalog query protocolMode must be a non-empty string."
+    });
+  }
+  validatePaymentPreferences(query.paymentPreferences, query.capability);
+  validatePaymentStrategy(query.paymentStrategy, query.capability);
+  if (query.maxCostUsd !== void 0 && (typeof query.maxCostUsd !== "number" || !Number.isFinite(query.maxCostUsd) || query.maxCostUsd < 0)) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: "Provider catalog query maxCostUsd must be a non-negative finite number."
+    });
+  }
+  if (query.status !== void 0 && query.status !== "ready" && query.status !== "rejected") {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: 'Provider catalog query status must be "ready" or "rejected".'
+    });
+  }
+  validateQueryStringArray(query.providerIds, "providerIds");
+  validateQueryStringArray(query.blockedProviderIds, "blockedProviderIds");
+  if (query.requiredReceiptTypes !== void 0 && (!Array.isArray(query.requiredReceiptTypes) || query.requiredReceiptTypes.some((receiptType) => !isReceiptType2(receiptType)))) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: "Provider catalog query requiredReceiptTypes must contain known receipt types."
+    });
+  }
+}
+function createCatalogEntryFromArtifact(artifact) {
+  return {
+    artifactId: artifact.artifactId,
+    generatedAt: artifact.generatedAt,
+    status: artifact.status,
+    provider: {
+      id: artifact.provider.id,
+      displayName: artifact.provider.displayName,
+      capabilities: [...artifact.provider.capabilities],
+      protocolMode: artifact.provider.protocolMode,
+      paymentOptions: cloneSerializable2(artifact.provider.paymentOptions),
+      pricing: cloneSerializable2(artifact.provider.pricing),
+      receipts: cloneSerializable2(artifact.provider.receipts),
+      limits: cloneSerializable2(artifact.provider.limits)
+    },
+    acceptance: {
+      gate: cloneSerializable2(artifact.acceptance.gate),
+      failedChecks: [...artifact.acceptance.failedChecks],
+      receipts: cloneSerializable2(artifact.acceptance.receipts),
+      safety: cloneSerializable2(artifact.acceptance.safety),
+      retrySafety: cloneSerializable2(artifact.acceptance.retrySafety),
+      route: cloneSerializable2(artifact.acceptance.route),
+      timelineEventTypes: [...artifact.acceptance.timelineEventTypes],
+      telemetryEventTypes: [...artifact.acceptance.telemetryEventTypes],
+      errorCode: artifact.acceptance.errorCode
+    }
+  };
+}
+function resolveCatalogCost(entry, capability) {
+  const pricing = entry.provider.pricing;
+  if (isProbeMeshPricing(pricing)) {
+    return pricingToCost2(pricing);
+  }
+  const capabilityPricing = pricing[capability];
+  if (!isProbeMeshPricing(capabilityPricing)) {
+    return void 0;
+  }
+  return pricingToCost2(capabilityPricing);
+}
+function pricingToCost2(pricing) {
+  return {
+    amountUsd: pricing.amountUsd,
+    currency: pricing.currency,
+    unit: pricing.unit
+  };
+}
+function hasRequiredReceiptTypes(entry, requiredReceiptTypes) {
+  const receiptTypes = new Set(entry.acceptance.receipts.types);
+  return requiredReceiptTypes.every(
+    (receiptType) => receiptTypes.has(receiptType)
+  );
+}
+function createMatchReasons(entry, query, cost, paymentSelection) {
+  const reasons = [
+    `status:${entry.status}`,
+    `capability:${query.capability}`,
+    `protocol:${entry.provider.protocolMode}`
+  ];
+  if (query.paymentPreferences !== void 0) {
+    reasons.push("payment_preferences:matched");
+  }
+  if (query.paymentStrategy !== void 0) {
+    reasons.push(`payment_strategy:${query.paymentStrategy.mode}`);
+  }
+  if (paymentSelection?.score !== void 0) {
+    reasons.push(`payment_score:${paymentSelection.score}`);
+  }
+  for (const scoreReason of paymentSelection?.scoreReasons ?? []) {
+    reasons.push(`payment_score_reason:${scoreReason}`);
+  }
+  if (query.providerIds !== void 0) {
+    reasons.push("provider:allowed");
+  }
+  if (query.maxCostUsd !== void 0 && cost !== void 0) {
+    reasons.push(`cost:${cost.amountUsd}<=${query.maxCostUsd}`);
+  }
+  if ((query.requiredReceiptTypes ?? []).length > 0) {
+    reasons.push(`receipts:${query.requiredReceiptTypes?.join(",")}`);
+  }
+  return reasons;
+}
+function paymentSelectionCost(selection) {
+  return selection?.cost;
+}
+function validateQueryStringArray(value, name) {
+  if (value !== void 0 && (!Array.isArray(value) || value.some((entry) => typeof entry !== "string" || entry.length === 0))) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: `Provider catalog query ${name} must be an array of non-empty strings.`
+    });
+  }
+}
+function isProbeMeshPricing(value) {
+  return isRecord4(value) && typeof value.unit === "string" && typeof value.amountUsd === "number" && Number.isFinite(value.amountUsd) && value.amountUsd >= 0 && (value.currency === void 0 || typeof value.currency === "string");
+}
+function isReceiptType2(value) {
+  return value === "payment_proof" || value === "settlement_confirmation" || value === "provider_delivery" || value === "provider_response_evidence" || value === "authorization_decision";
+}
+function cloneSerializable2(value) {
+  if (value === void 0) {
+    return value;
+  }
+  return JSON.parse(JSON.stringify(value));
+}
+function validateProviderCatalogEntry(entry, path, errors) {
+  if (!isRecord4(entry)) {
+    errors.push({
+      path,
+      message: "catalog entry must be an object."
+    });
+    return;
+  }
+  validateNonEmptyString4(entry.artifactId, `${path}.artifactId`, errors);
+  validateIsoTimestamp2(entry.generatedAt, `${path}.generatedAt`, errors);
+  if (entry.status !== "ready" && entry.status !== "rejected") {
+    errors.push({
+      path: `${path}.status`,
+      message: 'status must be "ready" or "rejected".'
+    });
+  }
+  validateEntryProvider(entry.provider, `${path}.provider`, errors);
+  validateEntryAcceptance(entry.acceptance, `${path}.acceptance`, errors);
+}
+function validateEntryProvider(provider, path, errors) {
+  if (!isRecord4(provider)) {
+    errors.push({
+      path,
+      message: "provider must be an object."
+    });
+    return;
+  }
+  validateNonEmptyString4(provider.id, `${path}.id`, errors);
+  validateNonEmptyString4(provider.displayName, `${path}.displayName`, errors);
+  validateStringArray3(provider.capabilities, `${path}.capabilities`, errors);
+  validateNonEmptyString4(provider.protocolMode, `${path}.protocolMode`, errors);
+  validateProviderPaymentOptions(
+    provider.paymentOptions,
+    `${path}.paymentOptions`,
+    Array.isArray(provider.capabilities) ? provider.capabilities : [],
+    errors
+  );
+  validatePricingDeclaration3(provider.pricing, `${path}.pricing`, errors);
+  validateReceiptSupport(provider.receipts, `${path}.receipts`, errors);
+  if (provider.limits !== void 0 && !isRecord4(provider.limits)) {
+    errors.push({
+      path: `${path}.limits`,
+      message: "limits must be an object when provided."
+    });
+  }
+}
+function validateEntryAcceptance(acceptance, path, errors) {
+  if (!isRecord4(acceptance)) {
+    errors.push({
+      path,
+      message: "acceptance must be an object."
+    });
+    return;
+  }
+  if (!isRecord4(acceptance.gate)) {
+    errors.push({
+      path: `${path}.gate`,
+      message: "gate must be an object."
+    });
+  } else {
+    if (typeof acceptance.gate.accepted !== "boolean") {
+      errors.push({
+        path: `${path}.gate.accepted`,
+        message: "gate.accepted must be a boolean."
+      });
+    }
+    if (acceptance.gate.status !== "accepted" && acceptance.gate.status !== "rejected") {
+      errors.push({
+        path: `${path}.gate.status`,
+        message: 'gate.status must be "accepted" or "rejected".'
+      });
+    }
+  }
+  validateStringArray3(acceptance.failedChecks, `${path}.failedChecks`, errors);
+  validateReceiptSummary2(acceptance.receipts, `${path}.receipts`, errors);
+  validateStringArray3(
+    acceptance.timelineEventTypes,
+    `${path}.timelineEventTypes`,
+    errors
+  );
+  validateStringArray3(
+    acceptance.telemetryEventTypes,
+    `${path}.telemetryEventTypes`,
+    errors
+  );
+}
+function validatePricingDeclaration3(pricing, path, errors) {
+  if (!isRecord4(pricing)) {
+    errors.push({
+      path,
+      message: "pricing must be an object."
+    });
+    return;
+  }
+  if (isPricingObject(pricing)) {
+    validatePricingObject(pricing, path, errors);
+    return;
+  }
+  for (const [capability, capabilityPricing] of Object.entries(pricing)) {
+    validateNonEmptyString4(capability, `${path}.${capability}`, errors);
+    validatePricingObject(capabilityPricing, `${path}.${capability}`, errors);
+  }
+}
+function validatePricingObject(pricing, path, errors) {
+  if (!isRecord4(pricing)) {
+    errors.push({
+      path,
+      message: "pricing entry must be an object."
+    });
+    return;
+  }
+  validateNonEmptyString4(pricing.unit, `${path}.unit`, errors);
+  if (typeof pricing.amountUsd !== "number" || !Number.isFinite(pricing.amountUsd) || pricing.amountUsd < 0) {
+    errors.push({
+      path: `${path}.amountUsd`,
+      message: "amountUsd must be a non-negative finite number."
+    });
+  }
+  if (pricing.currency !== void 0 && typeof pricing.currency !== "string") {
+    errors.push({
+      path: `${path}.currency`,
+      message: "currency must be a string when provided."
+    });
+  }
+}
+function validateReceiptSupport(receipts, path, errors) {
+  if (!isRecord4(receipts)) {
+    errors.push({
+      path,
+      message: "receipts must be an object."
+    });
+    return;
+  }
+  for (const key of ["payment", "delivery", "responseEvidence"]) {
+    if (typeof receipts[key] !== "boolean") {
+      errors.push({
+        path: `${path}.${key}`,
+        message: `${key} must be a boolean.`
+      });
+    }
+  }
+}
+function validateReceiptSummary2(receipts, path, errors) {
+  if (!isRecord4(receipts)) {
+    errors.push({
+      path,
+      message: "receipts must be an object."
+    });
+    return;
+  }
+  if (typeof receipts.total !== "number" || !Number.isFinite(receipts.total)) {
+    errors.push({
+      path: `${path}.total`,
+      message: "total must be a finite number."
+    });
+  }
+  validateStringArray3(receipts.types, `${path}.types`, errors);
+  validateStringArray3(receipts.providers, `${path}.providers`, errors);
+  for (const key of [
+    "hasPaymentProof",
+    "hasSettlementConfirmation",
+    "hasProviderDelivery"
+  ]) {
+    if (typeof receipts[key] !== "boolean") {
+      errors.push({
+        path: `${path}.${key}`,
+        message: `${key} must be a boolean.`
+      });
+    }
+  }
+}
+function isPricingObject(value) {
+  return "unit" in value || "amountUsd" in value || "currency" in value;
+}
+function validateStringArray3(value, path, errors) {
+  if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string" || entry.length === 0)) {
+    errors.push({
+      path,
+      message: `${path} must be an array of non-empty strings.`
+    });
+  }
+}
+function validateNonEmptyString4(value, path, errors) {
+  if (typeof value !== "string" || value.length === 0) {
+    errors.push({
+      path,
+      message: `${path} must be a non-empty string.`
+    });
+  }
+}
+function validateIsoTimestamp2(value, path, errors) {
+  if (typeof value !== "string" || Number.isNaN(Date.parse(value))) {
+    errors.push({
+      path,
+      message: `${path} must be an ISO timestamp string.`
+    });
+  }
+}
+function formatValidationErrors(errors) {
+  return errors.map((error) => `${error.path}: ${error.message}`).join("; ");
+}
+function isRecord4(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+
+// src/providerCatalogPolicy.ts
+function evaluateProviderCatalogPolicy(options) {
+  assertEvaluationOptions(options);
+  const catalogPolicy = resolveCatalogPolicy(options.catalogPolicy);
+  const adapterInventory = options.adapterInventory;
+  const adapterIds = new Set(adapterInventory.map((adapter) => adapter.id));
+  const catalogSummary = summarizeProviderCatalog(options.catalog);
+  const checks = [
+    {
+      name: "catalog_valid",
+      status: "passed",
+      message: "Provider catalog is valid."
+    },
+    {
+      name: "adapter_inventory_valid",
+      status: "passed",
+      message: "Adapter inventory is valid."
+    }
+  ];
+  const queryResults = options.queries.map(
+    (query) => evaluateQuery({
+      catalog: options.catalog,
+      catalogPolicy,
+      query,
+      adapterInventory,
+      adapterIds,
+      checks
+    })
+  );
+  const failedChecks = checks.filter((check) => check.status === "failed").length;
+  const routeableMatches = queryResults.reduce(
+    (total, result) => total + result.routeableMatches.length,
+    0
+  );
+  const missingAdapterMatches = queryResults.reduce(
+    (total, result) => total + result.missingAdapterMatches.length,
+    0
+  );
+  return {
+    status: failedChecks === 0 ? "passed" : "failed",
+    checks,
+    summary: {
+      ...catalogSummary,
+      totalQueries: options.queries.length,
+      passedChecks: checks.length - failedChecks,
+      failedChecks,
+      routeableMatches,
+      missingAdapterMatches
+    },
+    queryResults
+  };
+}
+function assertEvaluationOptions(options) {
+  if (!isRecord5(options)) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: "Provider catalog policy evaluation options must be an object."
+    });
+  }
+  assertProviderCatalog(options.catalog);
+  assertAdapterInventory(options.adapterInventory);
+  if (!Array.isArray(options.queries) || options.queries.length === 0) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: "Provider catalog policy evaluation requires at least one query."
+    });
+  }
+  options.queries.forEach(
+    (query, index) => assertExpectedQuery(query, `queries.${index}`)
+  );
+  assertCatalogPolicyOptions(options.catalogPolicy, "catalogPolicy");
+}
+function assertAdapterInventory(adapterInventory) {
+  if (!Array.isArray(adapterInventory)) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: "Provider catalog policy adapterInventory must be an array."
+    });
+  }
+  const seen = /* @__PURE__ */ new Set();
+  adapterInventory.forEach((adapter, index) => {
+    const path = `adapterInventory.${index}`;
+    if (!isRecord5(adapter)) {
+      throw new ProbeMeshError({
+        code: "invalid_request",
+        message: `${path} must be an object.`
+      });
+    }
+    if (typeof adapter.id !== "string" || adapter.id.length === 0) {
+      throw new ProbeMeshError({
+        code: "invalid_request",
+        message: `${path}.id must be a non-empty string.`
+      });
+    }
+    if (seen.has(adapter.id)) {
+      throw new ProbeMeshError({
+        code: "invalid_request",
+        message: `${path}.id duplicates adapter "${adapter.id}".`
+      });
+    }
+    seen.add(adapter.id);
+    if (!Array.isArray(adapter.capabilities) || adapter.capabilities.some(
+      (capability) => typeof capability !== "string" || capability.length === 0
+    )) {
+      throw new ProbeMeshError({
+        code: "invalid_request",
+        message: `${path}.capabilities must be an array of non-empty strings.`
+      });
+    }
+    if (adapter.paymentOptions !== void 0 && (!Array.isArray(adapter.paymentOptions) || adapter.paymentOptions.some(
+      (option) => !isRecord5(option) || typeof option.id !== "string" || option.id.length === 0 || typeof option.protocolMode !== "string" || option.protocolMode.length === 0
+    ))) {
+      throw new ProbeMeshError({
+        code: "invalid_request",
+        message: `${path}.paymentOptions must be an array of payment option objects when provided.`
+      });
+    }
+  });
+}
+function assertExpectedQuery(query, path) {
+  if (!isRecord5(query)) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: `${path} must be an object.`
+    });
+  }
+  if (typeof query.capability !== "string" || query.capability.length === 0) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: `${path}.capability must be a non-empty string.`
+    });
+  }
+  const minMatches = query.minMatches;
+  if (minMatches !== void 0 && (typeof minMatches !== "number" || !Number.isInteger(minMatches) || minMatches < 0)) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: `${path}.minMatches must be a non-negative integer.`
+    });
+  }
+  assertCatalogPolicyOptions(query, path);
+}
+function assertCatalogPolicyOptions(policy, path) {
+  if (policy === void 0) {
+    return;
+  }
+  if (!isRecord5(policy)) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: `${path} must be an object when provided.`
+    });
+  }
+  if (policy.status !== void 0 && policy.status !== "ready" && policy.status !== "rejected") {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: `${path}.status must be "ready" or "rejected".`
+    });
+  }
+  if (policy.protocolMode !== void 0 && (typeof policy.protocolMode !== "string" || policy.protocolMode.length === 0)) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: `${path}.protocolMode must be a non-empty string.`
+    });
+  }
+  validatePaymentPreferences(policy.paymentPreferences, `${path}.paymentPreferences`);
+  validatePaymentStrategy(policy.paymentStrategy, `${path}.paymentStrategy`);
+  if (policy.maxCostUsd !== void 0 && (typeof policy.maxCostUsd !== "number" || !Number.isFinite(policy.maxCostUsd) || policy.maxCostUsd < 0)) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: `${path}.maxCostUsd must be a non-negative finite number.`
+    });
+  }
+  validateStringArray4(policy.providerIds, `${path}.providerIds`);
+  validateStringArray4(policy.blockedProviderIds, `${path}.blockedProviderIds`);
+  if (policy.requiredReceiptTypes !== void 0 && (!Array.isArray(policy.requiredReceiptTypes) || policy.requiredReceiptTypes.some((receiptType) => !isReceiptType3(receiptType)))) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: `${path}.requiredReceiptTypes must contain known receipt types.`
+    });
+  }
+}
+function evaluateQuery(options) {
+  const resolvedQuery = resolveQuery(options.catalogPolicy, options.query);
+  const matches = findProviderCatalogMatches(options.catalog, resolvedQuery);
+  const routeableMatches = matches.filter(
+    (match) => hasRouteableAdapter(match, options.adapterInventory)
+  );
+  const missingAdapterMatches = matches.filter((match) => !options.adapterIds.has(match.providerId)).map((match) => ({
+    providerId: match.providerId,
+    capability: match.capability,
+    catalogArtifactId: match.entry.artifactId,
+    catalogStatus: match.entry.status,
+    reasons: [
+      ...match.reasons,
+      `missing_adapter:${match.providerId}`
+    ]
+  }));
+  const skippedProviders = createSkippedProviders(
+    options.catalog.entries,
+    options.query.capability,
+    matches,
+    resolvedQuery,
+    options.adapterInventory
+  );
+  const minMatches = options.query.minMatches ?? 1;
+  pushCheck(options.checks, {
+    name: "ready_matches",
+    status: matches.length >= minMatches ? "passed" : "failed",
+    capability: options.query.capability,
+    message: matches.length >= minMatches ? `Found ${matches.length} catalog match(es) for "${options.query.capability}".` : `Expected at least ${minMatches} catalog match(es) for "${options.query.capability}", found ${matches.length}.`
+  });
+  pushCheck(options.checks, {
+    name: "routeable_matches",
+    status: routeableMatches.length >= minMatches ? "passed" : "failed",
+    capability: options.query.capability,
+    message: routeableMatches.length >= minMatches ? `Found ${routeableMatches.length} routeable adapter-backed match(es) for "${options.query.capability}".` : `Expected at least ${minMatches} routeable adapter-backed match(es) for "${options.query.capability}", found ${routeableMatches.length}.`
+  });
+  for (const missingMatch of missingAdapterMatches) {
+    pushCheck(options.checks, {
+      name: "missing_adapter",
+      status: routeableMatches.length >= minMatches ? "passed" : "failed",
+      capability: missingMatch.capability,
+      providerId: missingMatch.providerId,
+      message: routeableMatches.length >= minMatches ? `Catalog provider "${missingMatch.providerId}" matches policy but is missing from adapter inventory; minimum routeable matches are still satisfied.` : `Catalog provider "${missingMatch.providerId}" matches policy but is missing from adapter inventory.`
+    });
+  }
+  return {
+    query: options.query,
+    matches,
+    routeableMatches,
+    missingAdapterMatches,
+    skippedProviders
+  };
+}
+function resolveCatalogPolicy(policy) {
+  return {
+    enabled: policy?.enabled ?? true,
+    status: policy?.status ?? "ready",
+    protocolMode: policy?.protocolMode,
+    paymentPreferences: policy?.paymentPreferences,
+    paymentStrategy: policy?.paymentStrategy,
+    maxCostUsd: policy?.maxCostUsd,
+    requiredReceiptTypes: policy?.requiredReceiptTypes,
+    providerIds: policy?.providerIds,
+    blockedProviderIds: policy?.blockedProviderIds
+  };
+}
+function resolveQuery(policy, query) {
+  const queryPolicy = resolveCatalogPolicy(query);
+  const activePolicy = policy.enabled ? policy : resolveCatalogPolicy(void 0);
+  return {
+    capability: query.capability,
+    protocolMode: queryPolicy.protocolMode ?? activePolicy.protocolMode,
+    paymentPreferences: mergePaymentPreferences(
+      activePolicy.paymentPreferences,
+      queryPolicy.paymentPreferences
+    ),
+    paymentStrategy: queryPolicy.paymentStrategy ?? activePolicy.paymentStrategy,
+    maxCostUsd: strictestMaxCostUsd(
+      queryPolicy.maxCostUsd,
+      activePolicy.maxCostUsd
+    ),
+    requiredReceiptTypes: unionProviderIds(
+      queryPolicy.requiredReceiptTypes,
+      activePolicy.requiredReceiptTypes
+    ),
+    providerIds: intersectProviderIds(
+      queryPolicy.providerIds,
+      activePolicy.providerIds
+    ),
+    blockedProviderIds: unionProviderIds(
+      queryPolicy.blockedProviderIds,
+      activePolicy.blockedProviderIds
+    ),
+    status: queryPolicy.status ?? activePolicy.status
+  };
+}
+function hasRouteableAdapter(match, adapterInventory) {
+  return adapterInventory.some(
+    (adapter) => adapter.id === match.providerId && adapter.capabilities.includes(match.capability) && (adapter.paymentOptions === void 0 || match.paymentSelection === void 0 || adapter.paymentOptions.some(
+      (option) => option.id === match.paymentSelection?.optionId
+    ))
+  );
+}
+function createSkippedProviders(entries, capability, matches, query, adapterInventory) {
+  const matchIds = new Set(matches.map((match) => match.providerId));
+  const adapterIds = new Set(adapterInventory.map((adapter) => adapter.id));
+  const catalogProviderIds = new Set(entries.map((entry) => entry.provider.id));
+  const skippedCatalogEntries = entries.filter((entry) => entry.provider.capabilities.includes(capability)).filter((entry) => !matchIds.has(entry.provider.id)).map((entry) => ({
+    providerId: entry.provider.id,
+    capability,
+    catalogArtifactId: entry.artifactId,
+    catalogStatus: entry.status,
+    reasons: explainSkippedEntry(entry, query, adapterIds)
+  }));
+  const inventoryOnlyAdapters = adapterInventory.filter((adapter) => adapter.capabilities.includes(capability)).filter((adapter) => !catalogProviderIds.has(adapter.id)).map((adapter) => ({
+    providerId: adapter.id,
+    capability,
+    inventoryOnly: true,
+    reasons: ["adapter:not_in_catalog"]
+  }));
+  return [...skippedCatalogEntries, ...inventoryOnlyAdapters];
+}
+function explainSkippedEntry(entry, query, adapterIds) {
+  const reasons = [];
+  const providerId = entry.provider.id;
+  if (entry.status !== (query.status ?? "ready")) {
+    reasons.push(`status:${entry.status}`);
+  }
+  if (query.protocolMode && entry.provider.protocolMode !== query.protocolMode) {
+    reasons.push(`protocol:${entry.provider.protocolMode}`);
+  }
+  if (query.paymentPreferences) {
+    const paymentMatch = findProviderCatalogMatches(
+      {
+        schemaVersion: "probemesh.provider-catalog.index.v1",
+        generatedAt: "1970-01-01T00:00:00.000Z",
+        entries: [entry]
+      },
+      {
+        capability: query.capability,
+        paymentPreferences: query.paymentPreferences,
+        status: entry.status
+      }
+    );
+    if (paymentMatch.length === 0) {
+      reasons.push("payment_preferences:not_matched");
+    }
+  }
+  if (query.providerIds && !query.providerIds.includes(providerId)) {
+    reasons.push("provider:not_allowed");
+  }
+  if (query.blockedProviderIds?.includes(providerId)) {
+    reasons.push("provider:blocked");
+  }
+  const cost = resolveCatalogCost2(entry, query.capability);
+  if (query.maxCostUsd !== void 0 && (cost === void 0 || cost.amountUsd > query.maxCostUsd)) {
+    reasons.push(`cost:${cost?.amountUsd ?? "unknown"}>${query.maxCostUsd}`);
+  }
+  const receiptTypes = new Set(entry.acceptance.receipts.types);
+  for (const receiptType of query.requiredReceiptTypes ?? []) {
+    if (!receiptTypes.has(receiptType)) {
+      reasons.push(`missing_receipt:${receiptType}`);
+    }
+  }
+  if (!adapterIds.has(providerId)) {
+    reasons.push(`missing_adapter:${providerId}`);
+  }
+  return reasons.length > 0 ? reasons : ["not_matched"];
+}
+function resolveCatalogCost2(entry, capability) {
+  const pricing = entry.provider.pricing;
+  if (isPricing2(pricing)) {
+    return pricing;
+  }
+  const capabilityPricing = pricing[capability];
+  return isPricing2(capabilityPricing) ? capabilityPricing : void 0;
+}
+function pushCheck(checks, check) {
+  checks.push(check);
+}
+function strictestMaxCostUsd(first, second) {
+  if (first === void 0) {
+    return second;
+  }
+  if (second === void 0) {
+    return first;
+  }
+  return Math.min(first, second);
+}
+function intersectProviderIds(first, second) {
+  if (!first) {
+    return second;
+  }
+  if (!second) {
+    return first;
+  }
+  return first.filter((providerId) => second.includes(providerId));
+}
+function unionProviderIds(first, second) {
+  return [.../* @__PURE__ */ new Set([...first ?? [], ...second ?? []])];
+}
+function validateStringArray4(value, path) {
+  if (value !== void 0 && (!Array.isArray(value) || value.some((entry) => typeof entry !== "string" || entry.length === 0))) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: `${path} must be an array of non-empty strings.`
+    });
+  }
+}
+function isPricing2(value) {
+  return isRecord5(value) && typeof value.unit === "string" && typeof value.amountUsd === "number" && Number.isFinite(value.amountUsd) && value.amountUsd >= 0 && (value.currency === void 0 || typeof value.currency === "string");
+}
+function isReceiptType3(value) {
+  return value === "payment_proof" || value === "settlement_confirmation" || value === "provider_delivery" || value === "provider_response_evidence" || value === "authorization_decision";
+}
+function isRecord5(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+
+// src/providerOnboardingDossier.ts
+var import_node_crypto2 = require("crypto");
+
+// src/providerConformanceArtifact.ts
+var import_node_crypto = require("crypto");
+var PROVIDER_CONFORMANCE_ARTIFACT_SCHEMA_VERSION = "probemesh.provider-conformance.v1";
+function validateProviderConformanceArtifact(artifact) {
+  const errors = [];
+  if (!isRecord6(artifact)) {
+    return {
+      valid: false,
+      errors: [
+        {
+          path: "$",
+          message: "Provider conformance artifact must be an object."
+        }
+      ]
+    };
+  }
+  if (artifact.schemaVersion !== PROVIDER_CONFORMANCE_ARTIFACT_SCHEMA_VERSION) {
+    errors.push({
+      path: "schemaVersion",
+      message: `schemaVersion must be "${PROVIDER_CONFORMANCE_ARTIFACT_SCHEMA_VERSION}".`
+    });
+  }
+  validateNonEmptyString5(artifact.artifactId, "artifactId", errors);
+  validateIsoTimestamp3(artifact.generatedAt, "generatedAt", errors);
+  if (artifact.status !== "verified" && artifact.status !== "failed") {
+    errors.push({
+      path: "status",
+      message: 'status must be "verified" or "failed".'
+    });
+  }
+  if (artifact.hashAlgorithm !== "sha256") {
+    errors.push({
+      path: "hashAlgorithm",
+      message: 'hashAlgorithm must be "sha256".'
+    });
+  }
+  validateHashes(artifact.hashes, errors);
+  validateManifestSummary(artifact.provider, errors);
+  validateConformanceSummary(artifact.conformance, errors);
+  return {
+    valid: errors.length === 0,
+    errors
+  };
+}
+function validateManifestSummary(provider, errors) {
+  if (!isRecord6(provider)) {
+    errors.push({
+      path: "provider",
+      message: "provider must be an object."
+    });
+    return;
+  }
+  validateNonEmptyString5(provider.id, "provider.id", errors);
+  validateNonEmptyString5(provider.displayName, "provider.displayName", errors);
+  if (!Array.isArray(provider.capabilities) || provider.capabilities.some((capability) => typeof capability !== "string")) {
+    errors.push({
+      path: "provider.capabilities",
+      message: "provider.capabilities must be an array of strings."
+    });
+  }
+  validateNonEmptyString5(provider.protocolMode, "provider.protocolMode", errors);
+  if (!isRecord6(provider.receipts)) {
+    errors.push({
+      path: "provider.receipts",
+      message: "provider.receipts must be an object."
+    });
+  }
+  if (!isRecord6(provider.schemas) || typeof provider.schemas.inputDeclared !== "boolean" || typeof provider.schemas.outputDeclared !== "boolean") {
+    errors.push({
+      path: "provider.schemas",
+      message: "provider.schemas must include inputDeclared and outputDeclared booleans."
+    });
+  }
+}
+function validateConformanceSummary(conformance, errors) {
+  if (!isRecord6(conformance)) {
+    errors.push({
+      path: "conformance",
+      message: "conformance must be an object."
+    });
+    return;
+  }
+  validateNonEmptyString5(conformance.title, "conformance.title", errors);
+  if (conformance.status !== "passed" && conformance.status !== "failed") {
+    errors.push({
+      path: "conformance.status",
+      message: 'conformance.status must be "passed" or "failed".'
+    });
+  }
+  if (!isRecord6(conformance.summary)) {
+    errors.push({
+      path: "conformance.summary",
+      message: "conformance.summary must be an object."
+    });
+  }
+  if (!Array.isArray(conformance.checks) || conformance.checks.some((check) => !isRecord6(check))) {
+    errors.push({
+      path: "conformance.checks",
+      message: "conformance.checks must be an array of check objects."
+    });
+  }
+  if (!Array.isArray(conformance.failedChecks) || conformance.failedChecks.some((checkName) => typeof checkName !== "string")) {
+    errors.push({
+      path: "conformance.failedChecks",
+      message: "conformance.failedChecks must be an array of strings."
+    });
+  }
+  if (!isRecord6(conformance.receipts)) {
+    errors.push({
+      path: "conformance.receipts",
+      message: "conformance.receipts must be an object."
+    });
+  }
+  if (!Array.isArray(conformance.timelineEventTypes) || conformance.timelineEventTypes.some((eventType) => typeof eventType !== "string")) {
+    errors.push({
+      path: "conformance.timelineEventTypes",
+      message: "conformance.timelineEventTypes must be an array of strings."
+    });
+  }
+  if (!Array.isArray(conformance.telemetryEventTypes) || conformance.telemetryEventTypes.some((eventType) => typeof eventType !== "string")) {
+    errors.push({
+      path: "conformance.telemetryEventTypes",
+      message: "conformance.telemetryEventTypes must be an array of strings."
+    });
+  }
+}
+function validateHashes(hashes, errors) {
+  if (!isRecord6(hashes)) {
+    errors.push({
+      path: "hashes",
+      message: "hashes must be an object."
+    });
+    return;
+  }
+  for (const field of ["manifest", "report", "checks", "artifact"]) {
+    const value = hashes[field];
+    if (typeof value !== "string" || !/^[a-f0-9]{64}$/.test(value)) {
+      errors.push({
+        path: `hashes.${field}`,
+        message: `${field} hash must be a sha256 hex string.`
+      });
+    }
+  }
+}
+function validateNonEmptyString5(value, path, errors) {
+  if (typeof value !== "string" || value.length === 0) {
+    errors.push({
+      path,
+      message: `${path} must be a non-empty string.`
+    });
+  }
+}
+function validateIsoTimestamp3(value, path, errors) {
+  if (typeof value !== "string" || Number.isNaN(Date.parse(value))) {
+    errors.push({
+      path,
+      message: `${path} must be an ISO timestamp.`
+    });
+  }
+}
+function isRecord6(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/providerOnboardingDossier.ts
+var PROVIDER_ONBOARDING_DOSSIER_SCHEMA_VERSION = "probemesh.provider-onboarding-dossier.v1";
+function validateProviderOnboardingDossier(dossier) {
+  const errors = [];
+  if (!isRecord7(dossier)) {
+    return {
+      valid: false,
+      errors: [
+        {
+          path: "$",
+          message: "Provider onboarding dossier must be an object."
+        }
+      ]
+    };
+  }
+  if (dossier.schemaVersion !== PROVIDER_ONBOARDING_DOSSIER_SCHEMA_VERSION) {
+    errors.push({
+      path: "schemaVersion",
+      message: `schemaVersion must be "${PROVIDER_ONBOARDING_DOSSIER_SCHEMA_VERSION}".`
+    });
+  }
+  validateNonEmptyString6(dossier.dossierId, "dossierId", errors);
+  validateIsoTimestamp4(dossier.generatedAt, "generatedAt", errors);
+  if (dossier.status !== "ready" && dossier.status !== "failed") {
+    errors.push({
+      path: "status",
+      message: 'status must be "ready" or "failed".'
+    });
+  }
+  if (dossier.hashAlgorithm !== "sha256") {
+    errors.push({
+      path: "hashAlgorithm",
+      message: 'hashAlgorithm must be "sha256".'
+    });
+  }
+  validateProviderSummary(dossier.provider, errors);
+  validateReadiness(dossier.readiness, errors);
+  validateEvidence(dossier.evidence, errors);
+  validateNestedArtifacts(dossier.artifacts, errors);
+  validateHashes2(dossier, errors);
+  return {
+    valid: errors.length === 0,
+    errors
+  };
+}
+function assertProviderOnboardingDossier(dossier) {
+  const result = validateProviderOnboardingDossier(dossier);
+  if (result.valid) {
+    return;
+  }
+  throw new ProbeMeshError({
+    code: "invalid_request",
+    message: `Invalid provider onboarding dossier: ${formatValidationErrors2(
+      result.errors
+    )}`
+  });
+}
+function validateProviderSummary(provider, errors) {
+  if (!isRecord7(provider)) {
+    errors.push({
+      path: "provider",
+      message: "provider must be an object."
+    });
+    return;
+  }
+  validateNonEmptyString6(provider.id, "provider.id", errors);
+  validateNonEmptyString6(provider.displayName, "provider.displayName", errors);
+  validateNonEmptyString6(provider.protocolMode, "provider.protocolMode", errors);
+  if (!Array.isArray(provider.capabilities) || provider.capabilities.some((capability) => typeof capability !== "string")) {
+    errors.push({
+      path: "provider.capabilities",
+      message: "provider.capabilities must be an array of strings."
+    });
+  }
+}
+function validateReadiness(readiness, errors) {
+  if (!isRecord7(readiness)) {
+    errors.push({
+      path: "readiness",
+      message: "readiness must be an object."
+    });
+    return;
+  }
+  if (typeof readiness.ready !== "boolean") {
+    errors.push({
+      path: "readiness.ready",
+      message: "readiness.ready must be a boolean."
+    });
+  }
+  if (readiness.status !== "ready" && readiness.status !== "failed") {
+    errors.push({
+      path: "readiness.status",
+      message: 'readiness.status must be "ready" or "failed".'
+    });
+  }
+  if (!Array.isArray(readiness.reasons) || readiness.reasons.some((reason) => typeof reason !== "string")) {
+    errors.push({
+      path: "readiness.reasons",
+      message: "readiness.reasons must be an array of strings."
+    });
+  }
+  if (!Array.isArray(readiness.failedChecks) || readiness.failedChecks.some((check) => typeof check !== "string")) {
+    errors.push({
+      path: "readiness.failedChecks",
+      message: "readiness.failedChecks must be an array of strings."
+    });
+  }
+}
+function validateEvidence(evidence, errors) {
+  if (!isRecord7(evidence)) {
+    errors.push({
+      path: "evidence",
+      message: "evidence must be an object."
+    });
+    return;
+  }
+  if (!isRecord7(evidence.catalog)) {
+    errors.push({
+      path: "evidence.catalog",
+      message: "evidence.catalog must be an object."
+    });
+  } else {
+    validateNonEmptyString6(
+      evidence.catalog.artifactId,
+      "evidence.catalog.artifactId",
+      errors
+    );
+    if (evidence.catalog.status !== "ready" && evidence.catalog.status !== "rejected") {
+      errors.push({
+        path: "evidence.catalog.status",
+        message: 'evidence.catalog.status must be "ready" or "rejected".'
+      });
+    }
+    if (typeof evidence.catalog.accepted !== "boolean") {
+      errors.push({
+        path: "evidence.catalog.accepted",
+        message: "evidence.catalog.accepted must be a boolean."
+      });
+    }
+  }
+  if (!isRecord7(evidence.conformance)) {
+    errors.push({
+      path: "evidence.conformance",
+      message: "evidence.conformance must be an object."
+    });
+  } else {
+    validateNonEmptyString6(
+      evidence.conformance.artifactId,
+      "evidence.conformance.artifactId",
+      errors
+    );
+    if (evidence.conformance.status !== "verified" && evidence.conformance.status !== "failed") {
+      errors.push({
+        path: "evidence.conformance.status",
+        message: 'evidence.conformance.status must be "verified" or "failed".'
+      });
+    }
+  }
+  if (!isRecord7(evidence.receipts)) {
+    errors.push({
+      path: "evidence.receipts",
+      message: "evidence.receipts must be an object."
+    });
+  }
+  if (!Array.isArray(evidence.timelineEventTypes) || evidence.timelineEventTypes.some((type) => typeof type !== "string")) {
+    errors.push({
+      path: "evidence.timelineEventTypes",
+      message: "evidence.timelineEventTypes must be an array of strings."
+    });
+  }
+  if (!Array.isArray(evidence.telemetryEventTypes) || evidence.telemetryEventTypes.some((type) => typeof type !== "string")) {
+    errors.push({
+      path: "evidence.telemetryEventTypes",
+      message: "evidence.telemetryEventTypes must be an array of strings."
+    });
+  }
+}
+function validateNestedArtifacts(artifacts, errors) {
+  if (!isRecord7(artifacts)) {
+    errors.push({
+      path: "artifacts",
+      message: "artifacts must be an object."
+    });
+    return;
+  }
+  const catalogValidation = validateProviderCatalogArtifact(artifacts.catalog);
+  for (const error of catalogValidation.errors) {
+    errors.push({
+      path: `artifacts.catalog.${error.path}`,
+      message: error.message
+    });
+  }
+  const conformanceValidation = validateProviderConformanceArtifact(
+    artifacts.conformance
+  );
+  for (const error of conformanceValidation.errors) {
+    errors.push({
+      path: `artifacts.conformance.${error.path}`,
+      message: error.message
+    });
+  }
+  if (isRecord7(artifacts.catalog) && isRecord7(artifacts.conformance) && isRecord7(artifacts.catalog.provider) && isRecord7(artifacts.conformance.provider) && artifacts.catalog.provider.id !== artifacts.conformance.provider.id) {
+    errors.push({
+      path: "artifacts",
+      message: "catalog and conformance artifacts must reference the same provider id."
+    });
+  }
+}
+function validateHashes2(dossier, errors) {
+  if (!isRecord7(dossier.hashes)) {
+    errors.push({
+      path: "hashes",
+      message: "hashes must be an object."
+    });
+    return;
+  }
+  for (const field of [
+    "catalogArtifact",
+    "conformanceArtifact",
+    "readiness",
+    "dossier"
+  ]) {
+    const value = dossier.hashes[field];
+    if (typeof value !== "string" || !/^[a-f0-9]{64}$/.test(value)) {
+      errors.push({
+        path: `hashes.${field}`,
+        message: `${field} hash must be a sha256 hex string.`
+      });
+    }
+  }
+  if (!isRecord7(dossier.artifacts) || !isRecord7(dossier.readiness) || errors.some((error) => error.path.startsWith("hashes."))) {
+    return;
+  }
+  const expectedHashes = {
+    catalogArtifact: hashStableJson(dossier.artifacts.catalog),
+    conformanceArtifact: hashStableJson(dossier.artifacts.conformance),
+    readiness: hashStableJson(dossier.readiness),
+    dossier: ""
+  };
+  const expectedDossierHash = hashDossierContent({
+    ...dossier,
+    hashes: expectedHashes
+  });
+  for (const [field, expected] of Object.entries({
+    ...expectedHashes,
+    dossier: expectedDossierHash
+  })) {
+    if (dossier.hashes[field] !== expected) {
+      errors.push({
+        path: `hashes.${field}`,
+        message: `${field} hash does not match dossier content.`
+      });
+    }
+  }
+}
+function hashStableJson(value) {
+  return (0, import_node_crypto2.createHash)("sha256").update(stableStringify(value)).digest("hex");
+}
+function hashDossierContent(dossier) {
+  return hashStableJson(dossier);
+}
+function stableStringify(value) {
+  if (value === null || typeof value !== "object") {
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map((entry) => stableStringify(entry)).join(",")}]`;
+  }
+  const entries = Object.entries(value).filter(([, entry]) => entry !== void 0).sort(([left], [right]) => left.localeCompare(right));
+  return `{${entries.map(([key, entry]) => `${JSON.stringify(key)}:${stableStringify(entry)}`).join(",")}}`;
+}
+function isRecord7(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function validateNonEmptyString6(value, path, errors) {
+  if (typeof value !== "string" || value.length === 0) {
+    errors.push({
+      path,
+      message: `${path} must be a non-empty string.`
+    });
+  }
+}
+function validateIsoTimestamp4(value, path, errors) {
+  if (typeof value !== "string" || Number.isNaN(Date.parse(value))) {
+    errors.push({
+      path,
+      message: `${path} must be an ISO timestamp.`
+    });
+  }
+}
+function formatValidationErrors2(errors) {
+  return errors.map((error) => `${error.path}: ${error.message}`).join("; ");
+}
+
+// src/providerOnboardingDossierImport.ts
+function parseProviderOnboardingDossierJson(json) {
+  if (typeof json !== "string") {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: "Provider onboarding dossier JSON must be a string."
+    });
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(json);
+  } catch (cause) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: "Provider onboarding dossier JSON must be valid JSON.",
+      cause
+    });
+  }
+  assertProviderOnboardingDossier(parsed);
+  return parsed;
+}
+function createProviderCatalogFromOnboardingDossiers(options) {
+  assertDossierListOptions(options);
+  const readyArtifacts = options.dossiers.filter((dossier) => dossier.status === "ready").map((dossier) => dossier.artifacts.catalog);
+  return createProviderCatalog({
+    artifacts: readyArtifacts,
+    generatedAt: options.generatedAt
+  });
+}
+function evaluateProviderOnboardingDossiers(options) {
+  assertEvaluationOptions2(options);
+  const catalog = createProviderCatalogFromOnboardingDossiers({
+    dossiers: options.dossiers,
+    generatedAt: options.generatedAt
+  });
+  const dossierResults = options.dossiers.map(summarizeDossierImport);
+  const readyDossiers = dossierResults.filter((dossier) => dossier.imported).length;
+  const failedDossiers = dossierResults.length - readyDossiers;
+  const checks = [
+    {
+      name: "dossiers_valid",
+      status: "passed",
+      message: `${options.dossiers.length} provider onboarding dossier(s) are valid.`
+    },
+    readyDossiers > 0 ? {
+      name: "ready_dossiers",
+      status: "passed",
+      message: `${readyDossiers} ready dossier(s) were imported into the buyer catalog.`
+    } : {
+      name: "ready_dossiers",
+      status: "failed",
+      message: "No ready dossiers were available for buyer catalog import."
+    }
+  ];
+  let policyEvaluation;
+  if (options.policy) {
+    policyEvaluation = evaluateProviderCatalogPolicy({
+      catalog,
+      catalogPolicy: options.policy.catalogPolicy,
+      adapterInventory: options.policy.adapterInventory,
+      queries: options.policy.queries
+    });
+    checks.push({
+      name: "catalog_policy",
+      status: policyEvaluation.status === "passed" ? "passed" : "failed",
+      message: policyEvaluation.status === "passed" ? "Imported dossier catalog passed the buyer catalog policy checks." : "Imported dossier catalog failed the buyer catalog policy checks."
+    });
+  }
+  if (failedDossiers > 0) {
+    checks.push({
+      name: "failed_dossiers_excluded",
+      status: "passed",
+      message: `${failedDossiers} failed dossier(s) were kept in the report and excluded from the buyer catalog.`
+    });
+  }
+  const failedChecks = checks.filter((check) => check.status === "failed").length;
+  const catalogSummary = summarizeProviderCatalog(catalog);
+  return {
+    status: failedChecks === 0 ? "passed" : "failed",
+    checks,
+    summary: {
+      ...catalogSummary,
+      totalDossiers: options.dossiers.length,
+      readyDossiers,
+      failedDossiers,
+      importedDossiers: readyDossiers,
+      excludedDossiers: failedDossiers,
+      policyStatus: policyEvaluation?.status
+    },
+    catalog,
+    dossiers: dossierResults,
+    policyEvaluation
+  };
+}
+function createProviderOnboardingDossierImportReport(result, options = {}) {
+  const report = {
+    title: options.title ?? "ProbeMesh Provider Onboarding Dossier Import Report",
+    generatedAt: options.generatedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+    status: result.status,
+    summary: cloneSerializable3(result.summary),
+    checks: cloneSerializable3(result.checks),
+    dossiers: cloneSerializable3(result.dossiers),
+    policyEvaluation: cloneSerializable3(result.policyEvaluation)
+  };
+  return sanitizeReport(report, options.forbiddenOutputValues ?? []);
+}
+function formatProviderOnboardingDossierImportReport(report, options = {}) {
+  if ((options.format ?? "json") === "markdown") {
+    return formatMarkdownReport(report);
+  }
+  return JSON.stringify(report, null, 2);
+}
+function assertDossierListOptions(options) {
+  if (!isRecord8(options)) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: "Provider onboarding dossier import options must be an object."
+    });
+  }
+  if (!Array.isArray(options.dossiers)) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: "Provider onboarding dossier import options require dossiers array."
+    });
+  }
+  options.dossiers.forEach((dossier, index) => {
+    const validation = validateProviderOnboardingDossier(dossier);
+    if (!validation.valid) {
+      throw new ProbeMeshError({
+        code: "invalid_request",
+        message: `Invalid provider onboarding dossier at index ${index}: ${formatValidationErrors3(
+          validation.errors
+        )}`
+      });
+    }
+  });
+  if (options.generatedAt !== void 0 && (typeof options.generatedAt !== "string" || Number.isNaN(Date.parse(options.generatedAt)))) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: "Provider onboarding dossier import generatedAt must be an ISO timestamp."
+    });
+  }
+}
+function assertEvaluationOptions2(options) {
+  assertDossierListOptions(options);
+  if (options.dossiers.length === 0) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: "Provider onboarding dossier evaluation requires at least one dossier."
+    });
+  }
+  if (options.policy === void 0) {
+    return;
+  }
+  if (!isRecord8(options.policy)) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: "Provider onboarding dossier policy options must be an object."
+    });
+  }
+  if (!Array.isArray(options.policy.adapterInventory)) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: "Provider onboarding dossier policy requires adapterInventory array."
+    });
+  }
+  if (!Array.isArray(options.policy.queries) || options.policy.queries.length === 0) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: "Provider onboarding dossier policy requires at least one query."
+    });
+  }
+}
+function summarizeDossierImport(dossier) {
+  return {
+    dossierId: dossier.dossierId,
+    providerId: dossier.provider.id,
+    status: dossier.status,
+    catalogArtifactId: dossier.evidence.catalog.artifactId,
+    conformanceArtifactId: dossier.evidence.conformance.artifactId,
+    imported: dossier.status === "ready",
+    reasons: [...dossier.readiness.reasons],
+    failedChecks: [...dossier.readiness.failedChecks]
+  };
+}
+function formatMarkdownReport(report) {
+  const lines = [
+    `# ${report.title}`,
+    "",
+    `Status: ${report.status}`,
+    `Generated: ${report.generatedAt}`,
+    "",
+    "## Summary",
+    `- Total dossiers: ${report.summary.totalDossiers}`,
+    `- Ready dossiers: ${report.summary.readyDossiers}`,
+    `- Failed dossiers: ${report.summary.failedDossiers}`,
+    `- Imported dossiers: ${report.summary.importedDossiers}`,
+    `- Excluded dossiers: ${report.summary.excludedDossiers}`,
+    `- Catalog entries: ${report.summary.totalEntries}`,
+    `- Providers: ${formatInlineList(report.summary.providers)}`,
+    `- Capabilities: ${formatInlineList(report.summary.capabilities)}`,
+    `- Policy status: ${report.summary.policyStatus ?? "not_run"}`,
+    "",
+    "## Checks",
+    ...report.checks.map(
+      (check) => `- [${check.status === "passed" ? "x" : " "}] ${check.name}: ${check.message}`
+    ),
+    "",
+    "## Dossiers",
+    ...report.dossiers.map(
+      (dossier) => `- ${dossier.dossierId}: ${dossier.status} / ${dossier.providerId} / ${dossier.imported ? "imported" : "excluded"}`
+    )
+  ];
+  if (report.policyEvaluation) {
+    lines.push(
+      "",
+      "## Policy",
+      `- Status: ${report.policyEvaluation.status}`,
+      `- Routeable matches: ${report.policyEvaluation.summary.routeableMatches}`,
+      `- Missing adapter matches: ${report.policyEvaluation.summary.missingAdapterMatches}`
+    );
+  }
+  return `${lines.join("\n")}
+`;
+}
+function sanitizeReport(value, forbiddenOutputValues) {
+  const forbiddenValues = forbiddenOutputValues.filter((entry) => entry.length > 0);
+  return redactX402Secrets(
+    replaceForbiddenValues(value, forbiddenValues, /* @__PURE__ */ new WeakSet())
+  );
+}
+function replaceForbiddenValues(value, forbiddenValues, seen) {
+  if (typeof value === "string") {
+    return forbiddenValues.reduce(
+      (current, forbidden) => current.split(forbidden).join("[REDACTED]"),
+      value
+    );
+  }
+  if (value === null || typeof value !== "object" || value instanceof Date) {
+    return value;
+  }
+  if (seen.has(value)) {
+    return "[Circular]";
+  }
+  seen.add(value);
+  if (Array.isArray(value)) {
+    const entries2 = value.map(
+      (entry) => replaceForbiddenValues(entry, forbiddenValues, seen)
+    );
+    seen.delete(value);
+    return entries2;
+  }
+  const entries = Object.fromEntries(
+    Object.entries(value).map(([key, entry]) => [
+      key,
+      replaceForbiddenValues(entry, forbiddenValues, seen)
+    ])
+  );
+  seen.delete(value);
+  return entries;
+}
+function cloneSerializable3(value) {
+  if (value === void 0) {
+    return value;
+  }
+  return JSON.parse(JSON.stringify(value));
+}
+function formatInlineList(values) {
+  return values.length > 0 ? values.join(", ") : "none";
+}
+function isRecord8(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function formatValidationErrors3(errors) {
+  return errors.map((error) => `${error.path}: ${error.message}`).join("; ");
+}
+
+// src/cli/providerDossierCheckCli.ts
+var USAGE = "Usage: probemesh-dossier-check --config <path> [--format markdown|json] [--out-json <path>] [--out-md <path>] [--out-catalog <path>] [--title <text>] [--generated-at <iso>]";
+async function runProviderDossierCheckCli(options = {}) {
+  const argv = options.argv ?? [];
+  const cwd = options.cwd ?? process.cwd();
+  try {
+    const parsedArgs = parseCliArgs(argv);
+    if (parsedArgs.help) {
+      return {
+        exitCode: 0,
+        skipped: true,
+        stdout: `${USAGE}
+`
+      };
+    }
+    if (!parsedArgs.configPath) {
+      return cliFailure("--config <path> is required.");
+    }
+    const configExport = await loadCliConfig(parsedArgs.configPath, {
+      argv,
+      cwd
+    });
+    if (isCliSkip(configExport)) {
+      return {
+        exitCode: 0,
+        skipped: true,
+        skip: configExport,
+        stdout: `provider dossier check skipped: ${configExport.reason}
+`
+      };
+    }
+    assertCliConfig(configExport);
+    const dossiers = await resolveDossiers(configExport, cwd);
+    const evaluation = evaluateProviderOnboardingDossiers({
+      dossiers,
+      generatedAt: parsedArgs.generatedAt ?? configExport.catalog?.generatedAt,
+      policy: configExport.policy
+    });
+    const report = createProviderOnboardingDossierImportReport(evaluation, {
+      ...configExport.report ?? {},
+      title: parsedArgs.title ?? configExport.report?.title,
+      generatedAt: parsedArgs.generatedAt ?? configExport.report?.generatedAt
+    });
+    const selectedFormat = parsedArgs.format ?? configExport.report?.format ?? "markdown";
+    const stdout = formatProviderOnboardingDossierImportReport(report, {
+      format: selectedFormat
+    });
+    const artifactPaths = await writeArtifacts({
+      cwd,
+      report,
+      catalog: evaluation.catalog,
+      outputs: {
+        json: parsedArgs.outJson ?? configExport.outputs?.json,
+        markdown: parsedArgs.outMarkdown ?? configExport.outputs?.markdown,
+        catalog: parsedArgs.outCatalog ?? configExport.outputs?.catalog
+      }
+    });
+    return {
+      exitCode: evaluation.status === "passed" ? 0 : 1,
+      skipped: false,
+      evaluation,
+      report,
+      catalog: evaluation.catalog,
+      stdout,
+      artifactPaths
+    };
+  } catch (error) {
+    return cliFailure(
+      error instanceof Error ? error.message : "Unknown provider dossier check CLI failure."
+    );
+  }
+}
+function parseCliArgs(argv) {
+  const parsedArgs = {};
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (arg === "--") {
+      continue;
+    }
+    if (arg === "--help" || arg === "-h") {
+      parsedArgs.help = true;
+      continue;
+    }
+    if (arg === "--config") {
+      parsedArgs.configPath = requireValue(argv, index, arg);
+      index += 1;
+      continue;
+    }
+    if (arg === "--format") {
+      const format = requireValue(argv, index, arg);
+      if (format !== "markdown" && format !== "json") {
+        throw new Error("--format must be markdown or json.");
+      }
+      parsedArgs.format = format;
+      index += 1;
+      continue;
+    }
+    if (arg === "--out-json") {
+      parsedArgs.outJson = requireValue(argv, index, arg);
+      index += 1;
+      continue;
+    }
+    if (arg === "--out-md") {
+      parsedArgs.outMarkdown = requireValue(argv, index, arg);
+      index += 1;
+      continue;
+    }
+    if (arg === "--out-catalog") {
+      parsedArgs.outCatalog = requireValue(argv, index, arg);
+      index += 1;
+      continue;
+    }
+    if (arg === "--title") {
+      parsedArgs.title = requireValue(argv, index, arg);
+      index += 1;
+      continue;
+    }
+    if (arg === "--generated-at") {
+      parsedArgs.generatedAt = requireValue(argv, index, arg);
+      index += 1;
+      continue;
+    }
+    throw new Error(`Unknown argument "${arg}".`);
+  }
+  return parsedArgs;
+}
+function requireValue(argv, index, flag) {
+  const value = argv[index + 1];
+  if (!value || value.startsWith("--")) {
+    throw new Error(`${flag} requires a value.`);
+  }
+  return value;
+}
+async function loadCliConfig(configPath, context) {
+  const configExport = await loadCliConfigDefault(configPath, context.cwd);
+  if (typeof configExport === "function") {
+    return configExport(context);
+  }
+  return configExport;
+}
+function isCliSkip(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value) && value.skip === true && typeof value.reason === "string";
+}
+function assertCliConfig(config) {
+  if (!config || typeof config !== "object" || Array.isArray(config)) {
+    throw new Error("Provider dossier check CLI config must be an object.");
+  }
+  const candidate = config;
+  if (candidate.dossiers !== void 0 && !Array.isArray(candidate.dossiers)) {
+    throw new Error("Provider dossier check CLI dossiers must be an array.");
+  }
+  if (candidate.dossierFiles !== void 0 && (!Array.isArray(candidate.dossierFiles) || candidate.dossierFiles.some((file) => typeof file !== "string"))) {
+    throw new Error("Provider dossier check CLI dossierFiles must be an array of strings.");
+  }
+  if ((candidate.dossiers?.length ?? 0) === 0 && (candidate.dossierFiles?.length ?? 0) === 0) {
+    throw new Error("Provider dossier check CLI config requires dossiers or dossierFiles.");
+  }
+  if (candidate.catalog !== void 0 && !isRecord9(candidate.catalog)) {
+    throw new Error("Provider dossier check CLI catalog config must be an object.");
+  }
+  if (candidate.policy !== void 0 && !isRecord9(candidate.policy)) {
+    throw new Error("Provider dossier check CLI policy config must be an object.");
+  }
+  if (candidate.outputs !== void 0) {
+    assertOutputs(candidate.outputs);
+  }
+}
+function assertOutputs(outputs) {
+  if (!isRecord9(outputs)) {
+    throw new Error("Provider dossier check CLI outputs must be an object.");
+  }
+  for (const [key, value] of Object.entries(outputs)) {
+    if (!["json", "markdown", "catalog"].includes(key) || value !== void 0 && typeof value !== "string") {
+      throw new Error(
+        "Provider dossier check CLI outputs may only include json, markdown, and catalog string paths."
+      );
+    }
+  }
+}
+async function resolveDossiers(config, cwd) {
+  const dossiers = [
+    ...config.dossiers ?? []
+  ];
+  for (const dossierFile of config.dossierFiles ?? []) {
+    const parsed = JSON.parse(await (0, import_promises2.readFile)((0, import_node_path2.resolve)(cwd, dossierFile), "utf8"));
+    const entries = Array.isArray(parsed) ? parsed : [parsed];
+    for (const entry of entries) {
+      dossiers.push(parseProviderOnboardingDossierJson(JSON.stringify(entry)));
+    }
+  }
+  return dossiers;
+}
+async function writeArtifacts(options) {
+  const artifactPaths = {};
+  if (options.outputs.json) {
+    const path = (0, import_node_path2.resolve)(options.cwd, options.outputs.json);
+    await writeTextFile(
+      path,
+      formatProviderOnboardingDossierImportReport(options.report, {
+        format: "json"
+      })
+    );
+    artifactPaths.json = path;
+  }
+  if (options.outputs.markdown) {
+    const path = (0, import_node_path2.resolve)(options.cwd, options.outputs.markdown);
+    await writeTextFile(
+      path,
+      formatProviderOnboardingDossierImportReport(options.report, {
+        format: "markdown"
+      })
+    );
+    artifactPaths.markdown = path;
+  }
+  if (options.outputs.catalog) {
+    const path = (0, import_node_path2.resolve)(options.cwd, options.outputs.catalog);
+    await writeTextFile(path, `${JSON.stringify(options.catalog, null, 2)}
+`);
+    artifactPaths.catalog = path;
+  }
+  return artifactPaths;
+}
+async function writeTextFile(path, body) {
+  await (0, import_promises2.mkdir)((0, import_node_path2.dirname)(path), {
+    recursive: true
+  });
+  await (0, import_promises2.writeFile)(path, body, "utf8");
+}
+function cliFailure(message) {
+  return {
+    exitCode: 2,
+    skipped: false,
+    stdout: "",
+    stderr: `Provider dossier check CLI failed: ${message}
+${USAGE}
+`
+  };
+}
+function isRecord9(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/cli/provider-dossier-check.ts
+void main();
+async function main() {
+  const result = await runProviderDossierCheckCli({
+    argv: process.argv.slice(2),
+    cwd: process.cwd()
+  });
+  if (result.stdout) {
+    process.stdout.write(result.stdout);
+  }
+  if (result.stderr) {
+    process.stderr.write(result.stderr);
+  }
+  process.exitCode = result.exitCode;
+}
+//# sourceMappingURL=provider-dossier-check.cjs.map