@probemesh/sdk 0.1.0

package/dist/cli/provider-dossier.cjs

@@ -0,0 +1,1753 @@
+#!/usr/bin/env node
+"use strict";
+
+// src/cli/providerOnboardingDossierCli.ts
+var import_promises2 = require("fs/promises");
+var import_node_path2 = require("path");
+
+// src/cli/configLoader.ts
+var import_promises = require("fs/promises");
+var import_node_path = require("path");
+var import_node_url = require("url");
+async function loadCliConfigDefault(configPath, cwd) {
+  const resolvedPath = (0, import_node_path.resolve)(cwd, configPath);
+  const moduleUrl = (0, import_node_url.pathToFileURL)(resolvedPath);
+  try {
+    const loadedModule = await import(
+      /* @vite-ignore */
+      moduleUrl.href
+    );
+    return loadedModule.default;
+  } catch (error) {
+    return loadSelfContainedConfigFallback(resolvedPath, error);
+  }
+}
+async function loadSelfContainedConfigFallback(resolvedPath, importError) {
+  const source = await (0, import_promises.readFile)(resolvedPath, "utf8");
+  if (/\bimport\s/.test(source) || !/\bexport\s+default\b/.test(source)) {
+    throw importError;
+  }
+  const transformedSource = source.replace(
+    /\bexport\s+default\b/,
+    "const __probemeshDefault ="
+  );
+  try {
+    const factory = new Function(
+      `${transformedSource}
+return __probemeshDefault;`
+    );
+    return factory();
+  } catch {
+    throw importError;
+  }
+}
+
+// src/errors.ts
+var ProbeMeshError = class extends Error {
+  code;
+  status = "failed";
+  capability;
+  provider;
+  callId;
+  receiptRefs;
+  safety;
+  timeline;
+  retrySafety;
+  attempt;
+  route;
+  cause;
+  constructor(options) {
+    super(options.message);
+    this.name = "ProbeMeshError";
+    this.code = options.code;
+    this.capability = options.capability;
+    this.provider = options.provider;
+    this.callId = options.callId;
+    this.receiptRefs = options.receiptRefs;
+    this.safety = options.safety;
+    this.timeline = options.timeline;
+    this.retrySafety = options.retrySafety;
+    this.attempt = options.attempt;
+    this.route = options.route;
+    this.cause = options.cause;
+  }
+  toJSON() {
+    return {
+      name: this.name,
+      code: this.code,
+      message: this.message,
+      status: this.status,
+      capability: this.capability,
+      provider: this.provider,
+      callId: this.callId,
+      receiptRefs: this.receiptRefs,
+      safety: this.safety,
+      timeline: this.timeline,
+      retrySafety: this.retrySafety,
+      attempt: this.attempt,
+      route: this.route
+    };
+  }
+};
+
+// src/paymentOptions.ts
+function validateProviderPaymentOptions(paymentOptions, path, capabilities, errors) {
+  if (paymentOptions === void 0) {
+    return;
+  }
+  if (!Array.isArray(paymentOptions) || paymentOptions.length === 0) {
+    errors.push({
+      path,
+      message: "paymentOptions must be a non-empty array when provided."
+    });
+    return;
+  }
+  const seen = /* @__PURE__ */ new Set();
+  paymentOptions.forEach((option, index) => {
+    const optionPath = `${path}.${index}`;
+    if (!isRecord(option)) {
+      errors.push({
+        path: optionPath,
+        message: "payment option must be an object."
+      });
+      return;
+    }
+    validateNonEmptyString(option.id, `${optionPath}.id`, errors);
+    validateNonEmptyString(option.protocolMode, `${optionPath}.protocolMode`, errors);
+    if (typeof option.id === "string") {
+      if (seen.has(option.id)) {
+        errors.push({
+          path: `${optionPath}.id`,
+          message: `duplicate payment option "${option.id}".`
+        });
+      }
+      seen.add(option.id);
+    }
+    if (option.capabilities !== void 0) {
+      validateStringArray(option.capabilities, `${optionPath}.capabilities`, errors);
+      if (Array.isArray(option.capabilities)) {
+        for (const capability of option.capabilities) {
+          if (typeof capability === "string" && capability.length > 0 && !capabilities.includes(capability)) {
+            errors.push({
+              path: `${optionPath}.capabilities`,
+              message: `payment option capability "${capability}" is not declared by the provider.`
+            });
+          }
+        }
+      }
+    }
+    if (option.pricing !== void 0) {
+      validatePricingDeclaration(option.pricing, `${optionPath}.pricing`, errors);
+    }
+    if (option.receiptTypes !== void 0) {
+      if (!Array.isArray(option.receiptTypes) || option.receiptTypes.some((receiptType) => !isReceiptType(receiptType))) {
+        errors.push({
+          path: `${optionPath}.receiptTypes`,
+          message: "payment option receiptTypes must contain known receipt types."
+        });
+      }
+    }
+    if (option.metadata !== void 0 && !isRecord(option.metadata)) {
+      errors.push({
+        path: `${optionPath}.metadata`,
+        message: "payment option metadata must be an object when provided."
+      });
+    }
+  });
+}
+function validatePricingDeclaration(pricing, path, errors) {
+  if (!isRecord(pricing)) {
+    errors.push({
+      path,
+      message: "payment option pricing must be an object."
+    });
+    return;
+  }
+  if (isPricing(pricing)) {
+    validatePricing(pricing, path, errors);
+    return;
+  }
+  for (const [capability, capabilityPricing] of Object.entries(pricing)) {
+    validatePricing(capabilityPricing, `${path}.${capability}`, errors);
+  }
+}
+function validatePricing(pricing, path, errors) {
+  if (!isRecord(pricing)) {
+    errors.push({
+      path,
+      message: "payment option pricing entry must be an object."
+    });
+    return;
+  }
+  validateNonEmptyString(pricing.unit, `${path}.unit`, errors);
+  if (typeof pricing.amountUsd !== "number" || !Number.isFinite(pricing.amountUsd) || pricing.amountUsd < 0) {
+    errors.push({
+      path: `${path}.amountUsd`,
+      message: "amountUsd must be a non-negative number."
+    });
+  }
+  if (pricing.currency !== void 0 && typeof pricing.currency !== "string") {
+    errors.push({
+      path: `${path}.currency`,
+      message: "currency must be a string when provided."
+    });
+  }
+}
+function validateStringArray(value, path, errors) {
+  if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string" || entry.length === 0)) {
+    errors.push({
+      path,
+      message: `${path} must be an array of non-empty strings.`
+    });
+  }
+}
+function validateNonEmptyString(value, path, errors) {
+  if (typeof value !== "string" || value.length === 0) {
+    errors.push({
+      path,
+      message: `${path} must be a non-empty string.`
+    });
+  }
+}
+function isPricing(value) {
+  return isRecord(value) && typeof value.unit === "string" && value.unit.length > 0 && typeof value.amountUsd === "number" && Number.isFinite(value.amountUsd) && value.amountUsd >= 0 && (value.currency === void 0 || typeof value.currency === "string");
+}
+function isReceiptType(value) {
+  return value === "payment_proof" || value === "settlement_confirmation" || value === "provider_delivery" || value === "provider_response_evidence" || value === "authorization_decision";
+}
+function isRecord(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+// src/providerKit/manifest.ts
+var JSON_SCHEMA_HINT_KEYS = /* @__PURE__ */ new Set([
+  "$schema",
+  "$id",
+  "type",
+  "properties",
+  "required",
+  "items",
+  "enum",
+  "description",
+  "additionalProperties",
+  "oneOf",
+  "anyOf",
+  "allOf"
+]);
+function validateProviderManifest(manifest) {
+  const errors = [];
+  if (!isRecord2(manifest)) {
+    return {
+      valid: false,
+      errors: [
+        {
+          path: "$",
+          message: "Provider manifest must be an object."
+        }
+      ]
+    };
+  }
+  validateNonEmptyString2(manifest.id, "id", errors);
+  validateNonEmptyString2(manifest.displayName, "displayName", errors);
+  validateCapabilityList(manifest.capabilities, errors);
+  validateNonEmptyString2(manifest.protocolMode, "protocolMode", errors);
+  validateProviderPaymentOptions(
+    manifest.paymentOptions,
+    "paymentOptions",
+    Array.isArray(manifest.capabilities) ? manifest.capabilities : [],
+    errors
+  );
+  validatePricingDeclaration2(
+    manifest.pricing,
+    "pricing",
+    manifest.capabilities,
+    errors
+  );
+  validateSchemaDeclaration(
+    manifest.inputSchema,
+    "inputSchema",
+    manifest.capabilities,
+    errors
+  );
+  validateSchemaDeclaration(
+    manifest.outputSchema,
+    "outputSchema",
+    manifest.capabilities,
+    errors
+  );
+  validateReceipts(manifest.receipts, errors);
+  if (manifest.limits !== void 0) {
+    validateLimits(manifest.limits, errors);
+  }
+  return {
+    valid: errors.length === 0,
+    errors
+  };
+}
+function isSharedJsonSchemaLike(value) {
+  if (!isRecord2(value)) {
+    return false;
+  }
+  return Object.keys(value).some((key) => JSON_SCHEMA_HINT_KEYS.has(key));
+}
+function isSharedPricing(value) {
+  return isRecord2(value) && typeof value.unit === "string" && value.unit.length > 0 && typeof value.amountUsd === "number";
+}
+function validateCapabilityList(capabilities, errors) {
+  if (!Array.isArray(capabilities) || capabilities.length === 0) {
+    errors.push({
+      path: "capabilities",
+      message: "capabilities must be a non-empty array."
+    });
+    return;
+  }
+  const seen = /* @__PURE__ */ new Set();
+  capabilities.forEach((capability, index) => {
+    if (typeof capability !== "string" || capability.length === 0) {
+      errors.push({
+        path: `capabilities.${index}`,
+        message: "capability ids must be non-empty strings."
+      });
+      return;
+    }
+    if (seen.has(capability)) {
+      errors.push({
+        path: `capabilities.${index}`,
+        message: `duplicate capability "${capability}".`
+      });
+    }
+    seen.add(capability);
+  });
+}
+function validatePricingDeclaration2(pricing, path, capabilities, errors) {
+  if (!isRecord2(pricing)) {
+    errors.push({
+      path,
+      message: "pricing must be an object."
+    });
+    return;
+  }
+  if (isSharedPricing(pricing)) {
+    validatePricing2(pricing, path, errors);
+    return;
+  }
+  if (!Array.isArray(capabilities)) {
+    return;
+  }
+  for (const capability of capabilities) {
+    if (typeof capability !== "string" || capability.length === 0) {
+      continue;
+    }
+    validatePricing2(pricing[capability], `${path}.${capability}`, errors);
+  }
+}
+function validatePricing2(pricing, path, errors) {
+  if (!isRecord2(pricing)) {
+    errors.push({
+      path,
+      message: "pricing entry must be an object."
+    });
+    return;
+  }
+  validateNonEmptyString2(pricing.unit, `${path}.unit`, errors);
+  if (typeof pricing.amountUsd !== "number" || !Number.isFinite(pricing.amountUsd) || pricing.amountUsd < 0) {
+    errors.push({
+      path: `${path}.amountUsd`,
+      message: "amountUsd must be a non-negative number."
+    });
+  }
+  if (pricing.currency !== void 0 && typeof pricing.currency !== "string") {
+    errors.push({
+      path: `${path}.currency`,
+      message: "currency must be a string when provided."
+    });
+  }
+}
+function validateSchemaDeclaration(schema, path, capabilities, errors) {
+  if (!isRecord2(schema)) {
+    errors.push({
+      path,
+      message: `${path} must be an object.`
+    });
+    return;
+  }
+  if (isSharedJsonSchemaLike(schema)) {
+    validateSchemaLike(schema, path, errors);
+    return;
+  }
+  if (!Array.isArray(capabilities)) {
+    return;
+  }
+  for (const capability of capabilities) {
+    if (typeof capability !== "string" || capability.length === 0) {
+      continue;
+    }
+    validateSchemaLike(schema[capability], `${path}.${capability}`, errors);
+  }
+}
+function validateSchemaLike(schema, path, errors) {
+  if (!isRecord2(schema)) {
+    errors.push({
+      path,
+      message: "schema entry must be an object."
+    });
+    return;
+  }
+  if (schema.type !== void 0 && typeof schema.type !== "string") {
+    errors.push({
+      path: `${path}.type`,
+      message: "schema type must be a string when provided."
+    });
+  }
+  if (schema.properties !== void 0 && !isRecord2(schema.properties)) {
+    errors.push({
+      path: `${path}.properties`,
+      message: "schema properties must be an object when provided."
+    });
+  }
+  if (schema.required !== void 0 && (!Array.isArray(schema.required) || schema.required.some((field) => typeof field !== "string"))) {
+    errors.push({
+      path: `${path}.required`,
+      message: "schema required must be an array of strings when provided."
+    });
+  }
+}
+function validateReceipts(receipts, errors) {
+  if (!isRecord2(receipts)) {
+    errors.push({
+      path: "receipts",
+      message: "receipts must be an object."
+    });
+    return;
+  }
+  validateBoolean(receipts.payment, "receipts.payment", errors);
+  validateBoolean(receipts.delivery, "receipts.delivery", errors);
+  validateBoolean(
+    receipts.responseEvidence,
+    "receipts.responseEvidence",
+    errors
+  );
+}
+function validateLimits(limits, errors) {
+  if (!isRecord2(limits)) {
+    errors.push({
+      path: "limits",
+      message: "limits must be an object when provided."
+    });
+    return;
+  }
+  const typedLimits = limits;
+  if (typedLimits.maxRequestsPerMinute !== void 0 && (!Number.isFinite(typedLimits.maxRequestsPerMinute) || typedLimits.maxRequestsPerMinute <= 0)) {
+    errors.push({
+      path: "limits.maxRequestsPerMinute",
+      message: "maxRequestsPerMinute must be a positive number when provided."
+    });
+  }
+}
+function validateNonEmptyString2(value, path, errors) {
+  if (typeof value !== "string" || value.length === 0) {
+    errors.push({
+      path,
+      message: `${path} must be a non-empty string.`
+    });
+  }
+}
+function validateBoolean(value, path, errors) {
+  if (typeof value !== "boolean") {
+    errors.push({
+      path,
+      message: `${path} must be a boolean.`
+    });
+  }
+}
+function isRecord2(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+// src/protocols/x402Redaction.ts
+var DEFAULT_REPLACEMENT = "[REDACTED]";
+var DEFAULT_MAX_DEPTH = 12;
+var PRIVATE_KEY_PATTERN = /\b0x[a-fA-F0-9]{64}\b/g;
+var HEX_SIGNATURE_PATTERN = /\b0x[a-fA-F0-9]{130}\b/g;
+var SECRET_FIELD_NAMES = /* @__PURE__ */ new Set([
+  "api-key",
+  "apikey",
+  "authorization",
+  "bearer",
+  "payment-required",
+  "payment-response",
+  "payment-signature",
+  "privatekey",
+  "signature",
+  "x-api-key"
+]);
+function redactX402Secrets(value, options = {}) {
+  const replacement = options.replacement ?? DEFAULT_REPLACEMENT;
+  const maxDepth = options.maxDepth ?? DEFAULT_MAX_DEPTH;
+  const seen = /* @__PURE__ */ new WeakSet();
+  return redactValue(value, {
+    replacement,
+    maxDepth,
+    depth: 0,
+    seen,
+    key: void 0
+  });
+}
+function redactValue(value, context) {
+  if (context.key && shouldRedactKey(context.key)) {
+    return context.replacement;
+  }
+  if (typeof value === "string") {
+    return redactString(value, context.replacement);
+  }
+  if (value === null || typeof value !== "object" || value instanceof Date) {
+    return value;
+  }
+  if (context.depth >= context.maxDepth) {
+    return "[MaxDepth]";
+  }
+  if (context.seen.has(value)) {
+    return "[Circular]";
+  }
+  context.seen.add(value);
+  if (Array.isArray(value)) {
+    return value.map(
+      (entry) => redactValue(entry, {
+        ...context,
+        depth: context.depth + 1,
+        key: void 0
+      })
+    );
+  }
+  return Object.fromEntries(
+    Object.entries(value).map(([key, entry]) => [
+      key,
+      redactValue(entry, {
+        ...context,
+        depth: context.depth + 1,
+        key
+      })
+    ])
+  );
+}
+function shouldRedactKey(key) {
+  const normalized = key.toLowerCase().replace(/_/g, "-");
+  return SECRET_FIELD_NAMES.has(normalized) || normalized.includes("private-key") || normalized.includes("privatekey") || normalized.includes("payment-signature") || normalized.includes("payment-response") || normalized.includes("payment-required") || normalized.includes("api-key");
+}
+function redactString(value, replacement) {
+  return value.replace(PRIVATE_KEY_PATTERN, replacement).replace(HEX_SIGNATURE_PATTERN, replacement);
+}
+
+// src/providerCatalogArtifact.ts
+var PROVIDER_CATALOG_ARTIFACT_SCHEMA_VERSION = "probemesh.provider-catalog.v1";
+function validateProviderCatalogArtifact(artifact) {
+  const errors = [];
+  if (!isRecord3(artifact)) {
+    return {
+      valid: false,
+      errors: [
+        {
+          path: "$",
+          message: "Provider catalog artifact must be an object."
+        }
+      ]
+    };
+  }
+  if (artifact.schemaVersion !== PROVIDER_CATALOG_ARTIFACT_SCHEMA_VERSION) {
+    errors.push({
+      path: "schemaVersion",
+      message: `schemaVersion must be "${PROVIDER_CATALOG_ARTIFACT_SCHEMA_VERSION}".`
+    });
+  }
+  validateNonEmptyString3(artifact.artifactId, "artifactId", errors);
+  validateIsoTimestamp(artifact.generatedAt, "generatedAt", errors);
+  if (artifact.status !== "ready" && artifact.status !== "rejected") {
+    errors.push({
+      path: "status",
+      message: 'status must be "ready" or "rejected".'
+    });
+  }
+  const manifestValidation = validateProviderManifest(artifact.provider);
+  for (const manifestError of manifestValidation.errors) {
+    errors.push({
+      path: `provider.${manifestError.path}`,
+      message: manifestError.message
+    });
+  }
+  validateAcceptanceArtifact(artifact.acceptance, errors);
+  return {
+    valid: errors.length === 0,
+    errors
+  };
+}
+function assertProviderCatalogArtifact(artifact) {
+  const result = validateProviderCatalogArtifact(artifact);
+  if (result.valid) {
+    return;
+  }
+  throw new ProbeMeshError({
+    code: "invalid_request",
+    message: `Invalid provider catalog artifact: ${formatValidationErrors(result.errors)}`
+  });
+}
+function validateAcceptanceArtifact(acceptance, errors) {
+  if (!isRecord3(acceptance)) {
+    errors.push({
+      path: "acceptance",
+      message: "acceptance must be an object."
+    });
+    return;
+  }
+  validateNonEmptyString3(acceptance.title, "acceptance.title", errors);
+  if (acceptance.status !== "passed" && acceptance.status !== "failed") {
+    errors.push({
+      path: "acceptance.status",
+      message: 'acceptance.status must be "passed" or "failed".'
+    });
+  }
+  if (!isRecord3(acceptance.gate)) {
+    errors.push({
+      path: "acceptance.gate",
+      message: "acceptance.gate must be an object."
+    });
+  } else {
+    if (typeof acceptance.gate.accepted !== "boolean") {
+      errors.push({
+        path: "acceptance.gate.accepted",
+        message: "acceptance.gate.accepted must be a boolean."
+      });
+    }
+    if (acceptance.gate.status !== "accepted" && acceptance.gate.status !== "rejected") {
+      errors.push({
+        path: "acceptance.gate.status",
+        message: 'acceptance.gate.status must be "accepted" or "rejected".'
+      });
+    }
+  }
+  validateStringArray2(
+    acceptance.failedChecks,
+    "acceptance.failedChecks",
+    errors
+  );
+  validateReceiptSummary(acceptance.receipts, errors);
+  validateStringArray2(
+    acceptance.timelineEventTypes,
+    "acceptance.timelineEventTypes",
+    errors
+  );
+  validateStringArray2(
+    acceptance.telemetryEventTypes,
+    "acceptance.telemetryEventTypes",
+    errors
+  );
+}
+function validateReceiptSummary(receipts, errors) {
+  if (!isRecord3(receipts)) {
+    errors.push({
+      path: "acceptance.receipts",
+      message: "acceptance.receipts must be an object."
+    });
+    return;
+  }
+  if (typeof receipts.total !== "number" || !Number.isFinite(receipts.total)) {
+    errors.push({
+      path: "acceptance.receipts.total",
+      message: "acceptance.receipts.total must be a number."
+    });
+  }
+  validateStringArray2(receipts.types, "acceptance.receipts.types", errors);
+  validateStringArray2(
+    receipts.providers,
+    "acceptance.receipts.providers",
+    errors
+  );
+  for (const key of [
+    "hasPaymentProof",
+    "hasSettlementConfirmation",
+    "hasProviderDelivery"
+  ]) {
+    if (typeof receipts[key] !== "boolean") {
+      errors.push({
+        path: `acceptance.receipts.${key}`,
+        message: `acceptance.receipts.${key} must be a boolean.`
+      });
+    }
+  }
+}
+function validateStringArray2(value, path, errors) {
+  if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string")) {
+    errors.push({
+      path,
+      message: `${path} must be an array of strings.`
+    });
+  }
+}
+function validateNonEmptyString3(value, path, errors) {
+  if (typeof value !== "string" || value.length === 0) {
+    errors.push({
+      path,
+      message: `${path} must be a non-empty string.`
+    });
+  }
+}
+function validateIsoTimestamp(value, path, errors) {
+  if (typeof value !== "string" || Number.isNaN(Date.parse(value))) {
+    errors.push({
+      path,
+      message: `${path} must be an ISO timestamp string.`
+    });
+  }
+}
+function formatValidationErrors(errors) {
+  return errors.map((error) => `${error.path}: ${error.message}`).join("; ");
+}
+function isRecord3(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+
+// src/providerConformanceArtifact.ts
+var import_node_crypto = require("crypto");
+var PROVIDER_CONFORMANCE_ARTIFACT_SCHEMA_VERSION = "probemesh.provider-conformance.v1";
+function validateProviderConformanceArtifact(artifact) {
+  const errors = [];
+  if (!isRecord4(artifact)) {
+    return {
+      valid: false,
+      errors: [
+        {
+          path: "$",
+          message: "Provider conformance artifact must be an object."
+        }
+      ]
+    };
+  }
+  if (artifact.schemaVersion !== PROVIDER_CONFORMANCE_ARTIFACT_SCHEMA_VERSION) {
+    errors.push({
+      path: "schemaVersion",
+      message: `schemaVersion must be "${PROVIDER_CONFORMANCE_ARTIFACT_SCHEMA_VERSION}".`
+    });
+  }
+  validateNonEmptyString4(artifact.artifactId, "artifactId", errors);
+  validateIsoTimestamp2(artifact.generatedAt, "generatedAt", errors);
+  if (artifact.status !== "verified" && artifact.status !== "failed") {
+    errors.push({
+      path: "status",
+      message: 'status must be "verified" or "failed".'
+    });
+  }
+  if (artifact.hashAlgorithm !== "sha256") {
+    errors.push({
+      path: "hashAlgorithm",
+      message: 'hashAlgorithm must be "sha256".'
+    });
+  }
+  validateHashes(artifact.hashes, errors);
+  validateManifestSummary(artifact.provider, errors);
+  validateConformanceSummary(artifact.conformance, errors);
+  return {
+    valid: errors.length === 0,
+    errors
+  };
+}
+function assertProviderConformanceArtifact(artifact) {
+  const result = validateProviderConformanceArtifact(artifact);
+  if (result.valid) {
+    return;
+  }
+  throw new ProbeMeshError({
+    code: "invalid_request",
+    message: `Invalid provider conformance artifact: ${formatValidationErrors2(
+      result.errors
+    )}`
+  });
+}
+function validateManifestSummary(provider, errors) {
+  if (!isRecord4(provider)) {
+    errors.push({
+      path: "provider",
+      message: "provider must be an object."
+    });
+    return;
+  }
+  validateNonEmptyString4(provider.id, "provider.id", errors);
+  validateNonEmptyString4(provider.displayName, "provider.displayName", errors);
+  if (!Array.isArray(provider.capabilities) || provider.capabilities.some((capability) => typeof capability !== "string")) {
+    errors.push({
+      path: "provider.capabilities",
+      message: "provider.capabilities must be an array of strings."
+    });
+  }
+  validateNonEmptyString4(provider.protocolMode, "provider.protocolMode", errors);
+  if (!isRecord4(provider.receipts)) {
+    errors.push({
+      path: "provider.receipts",
+      message: "provider.receipts must be an object."
+    });
+  }
+  if (!isRecord4(provider.schemas) || typeof provider.schemas.inputDeclared !== "boolean" || typeof provider.schemas.outputDeclared !== "boolean") {
+    errors.push({
+      path: "provider.schemas",
+      message: "provider.schemas must include inputDeclared and outputDeclared booleans."
+    });
+  }
+}
+function validateConformanceSummary(conformance, errors) {
+  if (!isRecord4(conformance)) {
+    errors.push({
+      path: "conformance",
+      message: "conformance must be an object."
+    });
+    return;
+  }
+  validateNonEmptyString4(conformance.title, "conformance.title", errors);
+  if (conformance.status !== "passed" && conformance.status !== "failed") {
+    errors.push({
+      path: "conformance.status",
+      message: 'conformance.status must be "passed" or "failed".'
+    });
+  }
+  if (!isRecord4(conformance.summary)) {
+    errors.push({
+      path: "conformance.summary",
+      message: "conformance.summary must be an object."
+    });
+  }
+  if (!Array.isArray(conformance.checks) || conformance.checks.some((check) => !isRecord4(check))) {
+    errors.push({
+      path: "conformance.checks",
+      message: "conformance.checks must be an array of check objects."
+    });
+  }
+  if (!Array.isArray(conformance.failedChecks) || conformance.failedChecks.some((checkName) => typeof checkName !== "string")) {
+    errors.push({
+      path: "conformance.failedChecks",
+      message: "conformance.failedChecks must be an array of strings."
+    });
+  }
+  if (!isRecord4(conformance.receipts)) {
+    errors.push({
+      path: "conformance.receipts",
+      message: "conformance.receipts must be an object."
+    });
+  }
+  if (!Array.isArray(conformance.timelineEventTypes) || conformance.timelineEventTypes.some((eventType) => typeof eventType !== "string")) {
+    errors.push({
+      path: "conformance.timelineEventTypes",
+      message: "conformance.timelineEventTypes must be an array of strings."
+    });
+  }
+  if (!Array.isArray(conformance.telemetryEventTypes) || conformance.telemetryEventTypes.some((eventType) => typeof eventType !== "string")) {
+    errors.push({
+      path: "conformance.telemetryEventTypes",
+      message: "conformance.telemetryEventTypes must be an array of strings."
+    });
+  }
+}
+function validateHashes(hashes, errors) {
+  if (!isRecord4(hashes)) {
+    errors.push({
+      path: "hashes",
+      message: "hashes must be an object."
+    });
+    return;
+  }
+  for (const field of ["manifest", "report", "checks", "artifact"]) {
+    const value = hashes[field];
+    if (typeof value !== "string" || !/^[a-f0-9]{64}$/.test(value)) {
+      errors.push({
+        path: `hashes.${field}`,
+        message: `${field} hash must be a sha256 hex string.`
+      });
+    }
+  }
+}
+function validateNonEmptyString4(value, path, errors) {
+  if (typeof value !== "string" || value.length === 0) {
+    errors.push({
+      path,
+      message: `${path} must be a non-empty string.`
+    });
+  }
+}
+function validateIsoTimestamp2(value, path, errors) {
+  if (typeof value !== "string" || Number.isNaN(Date.parse(value))) {
+    errors.push({
+      path,
+      message: `${path} must be an ISO timestamp.`
+    });
+  }
+}
+function formatValidationErrors2(errors) {
+  return errors.map((error) => `${error.path}: ${error.message}`).join("; ");
+}
+function isRecord4(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/providerOnboardingDossier.ts
+var import_node_crypto2 = require("crypto");
+var PROVIDER_ONBOARDING_DOSSIER_SCHEMA_VERSION = "probemesh.provider-onboarding-dossier.v1";
+function createProviderOnboardingDossier(options) {
+  assertProviderOnboardingDossierOptions(options);
+  const status = options.catalogArtifact.status === "ready" && options.conformanceArtifact.status === "verified" ? "ready" : "failed";
+  const readiness = summarizeReadiness(
+    options.catalogArtifact,
+    options.conformanceArtifact,
+    status
+  );
+  const baseContent = sanitizeDossierOutput(
+    {
+      schemaVersion: PROVIDER_ONBOARDING_DOSSIER_SCHEMA_VERSION,
+      dossierId: options.dossierId ?? `${options.catalogArtifact.provider.id}:${options.catalogArtifact.artifactId}:${options.conformanceArtifact.artifactId}:dossier`,
+      generatedAt: options.generatedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+      status,
+      hashAlgorithm: "sha256",
+      provider: summarizeProvider(options.catalogArtifact),
+      readiness,
+      evidence: summarizeEvidence(
+        options.catalogArtifact,
+        options.conformanceArtifact
+      ),
+      artifacts: {
+        catalog: cloneSerializable(options.catalogArtifact),
+        conformance: cloneSerializable(options.conformanceArtifact)
+      }
+    },
+    options.forbiddenOutputValues ?? []
+  );
+  const hashesWithoutDossier = {
+    catalogArtifact: hashStableJson(baseContent.artifacts.catalog),
+    conformanceArtifact: hashStableJson(baseContent.artifacts.conformance),
+    readiness: hashStableJson(baseContent.readiness),
+    dossier: ""
+  };
+  const dossier = {
+    ...baseContent,
+    hashes: {
+      ...hashesWithoutDossier,
+      dossier: hashDossierContent({
+        ...baseContent,
+        hashes: hashesWithoutDossier
+      })
+    }
+  };
+  assertProviderOnboardingDossier(dossier);
+  return dossier;
+}
+function validateProviderOnboardingDossier(dossier) {
+  const errors = [];
+  if (!isRecord5(dossier)) {
+    return {
+      valid: false,
+      errors: [
+        {
+          path: "$",
+          message: "Provider onboarding dossier must be an object."
+        }
+      ]
+    };
+  }
+  if (dossier.schemaVersion !== PROVIDER_ONBOARDING_DOSSIER_SCHEMA_VERSION) {
+    errors.push({
+      path: "schemaVersion",
+      message: `schemaVersion must be "${PROVIDER_ONBOARDING_DOSSIER_SCHEMA_VERSION}".`
+    });
+  }
+  validateNonEmptyString5(dossier.dossierId, "dossierId", errors);
+  validateIsoTimestamp3(dossier.generatedAt, "generatedAt", errors);
+  if (dossier.status !== "ready" && dossier.status !== "failed") {
+    errors.push({
+      path: "status",
+      message: 'status must be "ready" or "failed".'
+    });
+  }
+  if (dossier.hashAlgorithm !== "sha256") {
+    errors.push({
+      path: "hashAlgorithm",
+      message: 'hashAlgorithm must be "sha256".'
+    });
+  }
+  validateProviderSummary(dossier.provider, errors);
+  validateReadiness(dossier.readiness, errors);
+  validateEvidence(dossier.evidence, errors);
+  validateNestedArtifacts(dossier.artifacts, errors);
+  validateHashes2(dossier, errors);
+  return {
+    valid: errors.length === 0,
+    errors
+  };
+}
+function assertProviderOnboardingDossier(dossier) {
+  const result = validateProviderOnboardingDossier(dossier);
+  if (result.valid) {
+    return;
+  }
+  throw new ProbeMeshError({
+    code: "invalid_request",
+    message: `Invalid provider onboarding dossier: ${formatValidationErrors3(
+      result.errors
+    )}`
+  });
+}
+function formatProviderOnboardingDossier(dossier, options = {}) {
+  assertProviderOnboardingDossier(dossier);
+  if ((options.format ?? "json") === "markdown") {
+    return formatDossierMarkdown(dossier, options.title);
+  }
+  return JSON.stringify(dossier, null, 2);
+}
+function assertProviderOnboardingDossierOptions(options) {
+  if (!options || typeof options !== "object" || Array.isArray(options)) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: "Provider onboarding dossier options must be an object."
+    });
+  }
+  const catalogValidation = validateProviderCatalogArtifact(
+    options.catalogArtifact
+  );
+  if (!catalogValidation.valid) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: `Invalid provider onboarding catalog artifact: ${formatValidationErrors3(
+        catalogValidation.errors
+      )}`
+    });
+  }
+  const conformanceValidation = validateProviderConformanceArtifact(
+    options.conformanceArtifact
+  );
+  if (!conformanceValidation.valid) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: `Invalid provider onboarding conformance artifact: ${formatValidationErrors3(
+        conformanceValidation.errors
+      )}`
+    });
+  }
+  if (options.catalogArtifact.provider.id !== options.conformanceArtifact.provider.id) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: "Provider onboarding dossier requires catalog and conformance artifacts for the same provider id."
+    });
+  }
+  if (options.generatedAt !== void 0 && (typeof options.generatedAt !== "string" || Number.isNaN(Date.parse(options.generatedAt)))) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: "Provider onboarding dossier generatedAt must be an ISO timestamp."
+    });
+  }
+  if (options.dossierId !== void 0 && (typeof options.dossierId !== "string" || options.dossierId.length === 0)) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: "Provider onboarding dossier dossierId must be a non-empty string."
+    });
+  }
+  if (options.forbiddenOutputValues !== void 0 && (!Array.isArray(options.forbiddenOutputValues) || options.forbiddenOutputValues.some((value) => typeof value !== "string"))) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: "Provider onboarding dossier forbiddenOutputValues must be an array of strings."
+    });
+  }
+}
+function summarizeProvider(catalogArtifact) {
+  return {
+    id: catalogArtifact.provider.id,
+    displayName: catalogArtifact.provider.displayName,
+    capabilities: [...catalogArtifact.provider.capabilities],
+    protocolMode: catalogArtifact.provider.protocolMode,
+    pricing: cloneSerializable(catalogArtifact.provider.pricing),
+    paymentOptions: cloneSerializable(catalogArtifact.provider.paymentOptions)
+  };
+}
+function summarizeReadiness(catalogArtifact, conformanceArtifact, status) {
+  const reasons = [];
+  const failedChecks = [];
+  if (catalogArtifact.status === "ready") {
+    reasons.push("Catalog artifact is ready.");
+  } else {
+    reasons.push("Catalog artifact is rejected.");
+    failedChecks.push("catalog_not_ready");
+  }
+  if (conformanceArtifact.status === "verified") {
+    reasons.push("Conformance artifact is verified.");
+  } else {
+    reasons.push("Conformance artifact failed.");
+    failedChecks.push("conformance_not_verified");
+  }
+  for (const check of catalogArtifact.acceptance.failedChecks) {
+    failedChecks.push(`catalog:${check}`);
+  }
+  for (const check of conformanceArtifact.conformance.failedChecks) {
+    failedChecks.push(`conformance:${check}`);
+  }
+  return {
+    ready: status === "ready",
+    status,
+    reasons,
+    failedChecks: uniqueStrings(failedChecks)
+  };
+}
+function summarizeEvidence(catalogArtifact, conformanceArtifact) {
+  return {
+    catalog: {
+      artifactId: catalogArtifact.artifactId,
+      status: catalogArtifact.status,
+      acceptanceStatus: catalogArtifact.acceptance.status,
+      gateStatus: catalogArtifact.acceptance.gate.status,
+      accepted: catalogArtifact.acceptance.gate.accepted,
+      failedChecks: [...catalogArtifact.acceptance.failedChecks]
+    },
+    conformance: {
+      artifactId: conformanceArtifact.artifactId,
+      status: conformanceArtifact.status,
+      conformanceStatus: conformanceArtifact.conformance.status,
+      failedChecks: [...conformanceArtifact.conformance.failedChecks]
+    },
+    receipts: combineReceiptSummaries(
+      catalogArtifact.acceptance.receipts,
+      conformanceArtifact.conformance.receipts
+    ),
+    safety: {
+      acceptance: cloneSerializable(catalogArtifact.acceptance.safety),
+      conformance: cloneSerializable(conformanceArtifact.conformance.safety)
+    },
+    retrySafety: {
+      acceptance: cloneSerializable(catalogArtifact.acceptance.retrySafety),
+      conformance: cloneSerializable(conformanceArtifact.conformance.retrySafety)
+    },
+    route: {
+      acceptance: cloneSerializable(catalogArtifact.acceptance.route),
+      conformance: cloneSerializable(conformanceArtifact.conformance.route)
+    },
+    timelineEventTypes: uniqueStrings([
+      ...catalogArtifact.acceptance.timelineEventTypes,
+      ...conformanceArtifact.conformance.timelineEventTypes
+    ]),
+    telemetryEventTypes: uniqueStrings([
+      ...catalogArtifact.acceptance.telemetryEventTypes,
+      ...conformanceArtifact.conformance.telemetryEventTypes
+    ])
+  };
+}
+function combineReceiptSummaries(left, right) {
+  const byType = {};
+  for (const [type, count] of Object.entries(left.byType)) {
+    byType[type] = (byType[type] ?? 0) + Number(count);
+  }
+  for (const [type, count] of Object.entries(right.byType)) {
+    byType[type] = (byType[type] ?? 0) + Number(count);
+  }
+  return {
+    total: left.total + right.total,
+    types: uniqueStrings([...left.types, ...right.types]),
+    providers: uniqueStrings([...left.providers, ...right.providers]),
+    byType,
+    hasPaymentProof: left.hasPaymentProof || right.hasPaymentProof,
+    hasSettlementConfirmation: left.hasSettlementConfirmation || right.hasSettlementConfirmation,
+    hasProviderDelivery: left.hasProviderDelivery || right.hasProviderDelivery
+  };
+}
+function formatDossierMarkdown(dossier, title) {
+  const lines = [
+    `# ${title ?? `${dossier.provider.displayName} Onboarding Dossier`}`,
+    "",
+    `Status: ${dossier.status}`,
+    `Schema: ${dossier.schemaVersion}`,
+    `Dossier ID: ${dossier.dossierId}`,
+    `Generated: ${dossier.generatedAt}`,
+    `Provider: ${dossier.provider.id}`,
+    `Capabilities: ${formatInlineList(dossier.provider.capabilities)}`,
+    "",
+    "## Readiness",
+    `- Ready: ${String(dossier.readiness.ready)}`,
+    `- Reasons: ${formatInlineList(dossier.readiness.reasons)}`,
+    `- Failed checks: ${formatInlineList(dossier.readiness.failedChecks)}`,
+    "",
+    "## Evidence",
+    `- Catalog artifact: ${dossier.evidence.catalog.artifactId} (${dossier.evidence.catalog.status})`,
+    `- Conformance artifact: ${dossier.evidence.conformance.artifactId} (${dossier.evidence.conformance.status})`,
+    `- Receipts: ${formatInlineList(dossier.evidence.receipts.types)}`,
+    `- Timeline: ${formatInlineList(dossier.evidence.timelineEventTypes)}`,
+    "",
+    "## Safety",
+    `- Acceptance payment: ${dossier.evidence.safety.acceptance?.paymentStatus ?? "unknown"}`,
+    `- Conformance payment: ${dossier.evidence.safety.conformance?.paymentStatus ?? "unknown"}`,
+    `- Acceptance delivery: ${dossier.evidence.safety.acceptance?.deliveryStatus ?? "unknown"}`,
+    `- Conformance delivery: ${dossier.evidence.safety.conformance?.deliveryStatus ?? "unknown"}`,
+    "",
+    "## Hashes",
+    `- Catalog artifact: ${dossier.hashes.catalogArtifact}`,
+    `- Conformance artifact: ${dossier.hashes.conformanceArtifact}`,
+    `- Readiness: ${dossier.hashes.readiness}`,
+    `- Dossier: ${dossier.hashes.dossier}`
+  ];
+  return `${lines.join("\n")}
+`;
+}
+function validateProviderSummary(provider, errors) {
+  if (!isRecord5(provider)) {
+    errors.push({
+      path: "provider",
+      message: "provider must be an object."
+    });
+    return;
+  }
+  validateNonEmptyString5(provider.id, "provider.id", errors);
+  validateNonEmptyString5(provider.displayName, "provider.displayName", errors);
+  validateNonEmptyString5(provider.protocolMode, "provider.protocolMode", errors);
+  if (!Array.isArray(provider.capabilities) || provider.capabilities.some((capability) => typeof capability !== "string")) {
+    errors.push({
+      path: "provider.capabilities",
+      message: "provider.capabilities must be an array of strings."
+    });
+  }
+}
+function validateReadiness(readiness, errors) {
+  if (!isRecord5(readiness)) {
+    errors.push({
+      path: "readiness",
+      message: "readiness must be an object."
+    });
+    return;
+  }
+  if (typeof readiness.ready !== "boolean") {
+    errors.push({
+      path: "readiness.ready",
+      message: "readiness.ready must be a boolean."
+    });
+  }
+  if (readiness.status !== "ready" && readiness.status !== "failed") {
+    errors.push({
+      path: "readiness.status",
+      message: 'readiness.status must be "ready" or "failed".'
+    });
+  }
+  if (!Array.isArray(readiness.reasons) || readiness.reasons.some((reason) => typeof reason !== "string")) {
+    errors.push({
+      path: "readiness.reasons",
+      message: "readiness.reasons must be an array of strings."
+    });
+  }
+  if (!Array.isArray(readiness.failedChecks) || readiness.failedChecks.some((check) => typeof check !== "string")) {
+    errors.push({
+      path: "readiness.failedChecks",
+      message: "readiness.failedChecks must be an array of strings."
+    });
+  }
+}
+function validateEvidence(evidence, errors) {
+  if (!isRecord5(evidence)) {
+    errors.push({
+      path: "evidence",
+      message: "evidence must be an object."
+    });
+    return;
+  }
+  if (!isRecord5(evidence.catalog)) {
+    errors.push({
+      path: "evidence.catalog",
+      message: "evidence.catalog must be an object."
+    });
+  } else {
+    validateNonEmptyString5(
+      evidence.catalog.artifactId,
+      "evidence.catalog.artifactId",
+      errors
+    );
+    if (evidence.catalog.status !== "ready" && evidence.catalog.status !== "rejected") {
+      errors.push({
+        path: "evidence.catalog.status",
+        message: 'evidence.catalog.status must be "ready" or "rejected".'
+      });
+    }
+    if (typeof evidence.catalog.accepted !== "boolean") {
+      errors.push({
+        path: "evidence.catalog.accepted",
+        message: "evidence.catalog.accepted must be a boolean."
+      });
+    }
+  }
+  if (!isRecord5(evidence.conformance)) {
+    errors.push({
+      path: "evidence.conformance",
+      message: "evidence.conformance must be an object."
+    });
+  } else {
+    validateNonEmptyString5(
+      evidence.conformance.artifactId,
+      "evidence.conformance.artifactId",
+      errors
+    );
+    if (evidence.conformance.status !== "verified" && evidence.conformance.status !== "failed") {
+      errors.push({
+        path: "evidence.conformance.status",
+        message: 'evidence.conformance.status must be "verified" or "failed".'
+      });
+    }
+  }
+  if (!isRecord5(evidence.receipts)) {
+    errors.push({
+      path: "evidence.receipts",
+      message: "evidence.receipts must be an object."
+    });
+  }
+  if (!Array.isArray(evidence.timelineEventTypes) || evidence.timelineEventTypes.some((type) => typeof type !== "string")) {
+    errors.push({
+      path: "evidence.timelineEventTypes",
+      message: "evidence.timelineEventTypes must be an array of strings."
+    });
+  }
+  if (!Array.isArray(evidence.telemetryEventTypes) || evidence.telemetryEventTypes.some((type) => typeof type !== "string")) {
+    errors.push({
+      path: "evidence.telemetryEventTypes",
+      message: "evidence.telemetryEventTypes must be an array of strings."
+    });
+  }
+}
+function validateNestedArtifacts(artifacts, errors) {
+  if (!isRecord5(artifacts)) {
+    errors.push({
+      path: "artifacts",
+      message: "artifacts must be an object."
+    });
+    return;
+  }
+  const catalogValidation = validateProviderCatalogArtifact(artifacts.catalog);
+  for (const error of catalogValidation.errors) {
+    errors.push({
+      path: `artifacts.catalog.${error.path}`,
+      message: error.message
+    });
+  }
+  const conformanceValidation = validateProviderConformanceArtifact(
+    artifacts.conformance
+  );
+  for (const error of conformanceValidation.errors) {
+    errors.push({
+      path: `artifacts.conformance.${error.path}`,
+      message: error.message
+    });
+  }
+  if (isRecord5(artifacts.catalog) && isRecord5(artifacts.conformance) && isRecord5(artifacts.catalog.provider) && isRecord5(artifacts.conformance.provider) && artifacts.catalog.provider.id !== artifacts.conformance.provider.id) {
+    errors.push({
+      path: "artifacts",
+      message: "catalog and conformance artifacts must reference the same provider id."
+    });
+  }
+}
+function validateHashes2(dossier, errors) {
+  if (!isRecord5(dossier.hashes)) {
+    errors.push({
+      path: "hashes",
+      message: "hashes must be an object."
+    });
+    return;
+  }
+  for (const field of [
+    "catalogArtifact",
+    "conformanceArtifact",
+    "readiness",
+    "dossier"
+  ]) {
+    const value = dossier.hashes[field];
+    if (typeof value !== "string" || !/^[a-f0-9]{64}$/.test(value)) {
+      errors.push({
+        path: `hashes.${field}`,
+        message: `${field} hash must be a sha256 hex string.`
+      });
+    }
+  }
+  if (!isRecord5(dossier.artifacts) || !isRecord5(dossier.readiness) || errors.some((error) => error.path.startsWith("hashes."))) {
+    return;
+  }
+  const expectedHashes = {
+    catalogArtifact: hashStableJson(dossier.artifacts.catalog),
+    conformanceArtifact: hashStableJson(dossier.artifacts.conformance),
+    readiness: hashStableJson(dossier.readiness),
+    dossier: ""
+  };
+  const expectedDossierHash = hashDossierContent({
+    ...dossier,
+    hashes: expectedHashes
+  });
+  for (const [field, expected] of Object.entries({
+    ...expectedHashes,
+    dossier: expectedDossierHash
+  })) {
+    if (dossier.hashes[field] !== expected) {
+      errors.push({
+        path: `hashes.${field}`,
+        message: `${field} hash does not match dossier content.`
+      });
+    }
+  }
+}
+function sanitizeDossierOutput(value, forbiddenOutputValues) {
+  const forbiddenValues = forbiddenOutputValues.filter((entry) => entry.length > 0);
+  return redactX402Secrets(
+    replaceForbiddenValues(value, forbiddenValues, /* @__PURE__ */ new WeakSet())
+  );
+}
+function replaceForbiddenValues(value, forbiddenValues, seen) {
+  if (typeof value === "string") {
+    return forbiddenValues.reduce(
+      (current, forbidden) => current.split(forbidden).join("[REDACTED]"),
+      value
+    );
+  }
+  if (value === null || typeof value !== "object" || value instanceof Date) {
+    return value;
+  }
+  if (seen.has(value)) {
+    return "[Circular]";
+  }
+  seen.add(value);
+  if (Array.isArray(value)) {
+    const entries2 = value.map(
+      (entry) => replaceForbiddenValues(entry, forbiddenValues, seen)
+    );
+    seen.delete(value);
+    return entries2;
+  }
+  const entries = Object.fromEntries(
+    Object.entries(value).map(([key, entry]) => [
+      key,
+      replaceForbiddenValues(entry, forbiddenValues, seen)
+    ])
+  );
+  seen.delete(value);
+  return entries;
+}
+function cloneSerializable(value) {
+  if (value === void 0) {
+    return value;
+  }
+  return JSON.parse(JSON.stringify(value));
+}
+function hashStableJson(value) {
+  return (0, import_node_crypto2.createHash)("sha256").update(stableStringify(value)).digest("hex");
+}
+function hashDossierContent(dossier) {
+  return hashStableJson(dossier);
+}
+function stableStringify(value) {
+  if (value === null || typeof value !== "object") {
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map((entry) => stableStringify(entry)).join(",")}]`;
+  }
+  const entries = Object.entries(value).filter(([, entry]) => entry !== void 0).sort(([left], [right]) => left.localeCompare(right));
+  return `{${entries.map(([key, entry]) => `${JSON.stringify(key)}:${stableStringify(entry)}`).join(",")}}`;
+}
+function uniqueStrings(values) {
+  return [...new Set(values)].sort((left, right) => left.localeCompare(right));
+}
+function formatInlineList(values) {
+  return values.length > 0 ? values.join(", ") : "none";
+}
+function isRecord5(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function validateNonEmptyString5(value, path, errors) {
+  if (typeof value !== "string" || value.length === 0) {
+    errors.push({
+      path,
+      message: `${path} must be a non-empty string.`
+    });
+  }
+}
+function validateIsoTimestamp3(value, path, errors) {
+  if (typeof value !== "string" || Number.isNaN(Date.parse(value))) {
+    errors.push({
+      path,
+      message: `${path} must be an ISO timestamp.`
+    });
+  }
+}
+function formatValidationErrors3(errors) {
+  return errors.map((error) => `${error.path}: ${error.message}`).join("; ");
+}
+
+// src/cli/providerOnboardingDossierCli.ts
+var USAGE = "Usage: probemesh-dossier --config <path> [--format markdown|json] [--out-json <path>] [--out-md <path>] [--dossier-id <text>] [--generated-at <iso>] [--title <text>]";
+async function runProviderOnboardingDossierCli(options = {}) {
+  const argv = options.argv ?? [];
+  const cwd = options.cwd ?? process.cwd();
+  try {
+    const parsedArgs = parseCliArgs(argv);
+    if (parsedArgs.help) {
+      return {
+        exitCode: 0,
+        skipped: true,
+        stdout: `${USAGE}
+`
+      };
+    }
+    if (!parsedArgs.configPath) {
+      return cliFailure("--config <path> is required.");
+    }
+    const configExport = await loadCliConfig(parsedArgs.configPath, {
+      argv,
+      cwd
+    });
+    if (isCliSkip(configExport)) {
+      return {
+        exitCode: 0,
+        skipped: true,
+        skip: configExport,
+        stdout: `provider onboarding dossier skipped: ${configExport.reason}
+`
+      };
+    }
+    assertCliConfig(configExport);
+    const catalogArtifact = await resolveCatalogArtifact(configExport, cwd);
+    const conformanceArtifact = await resolveConformanceArtifact(
+      configExport,
+      cwd
+    );
+    const dossier = createProviderOnboardingDossier({
+      catalogArtifact,
+      conformanceArtifact,
+      dossierId: parsedArgs.dossierId ?? configExport.dossier?.dossierId,
+      generatedAt: parsedArgs.generatedAt ?? configExport.dossier?.generatedAt,
+      forbiddenOutputValues: configExport.dossier?.forbiddenOutputValues
+    });
+    const selectedFormat = parsedArgs.format ?? configExport.dossier?.format ?? "markdown";
+    const title = parsedArgs.title ?? configExport.dossier?.title;
+    const stdout = formatProviderOnboardingDossier(dossier, {
+      format: selectedFormat,
+      title
+    });
+    const artifactPaths = await writeArtifacts({
+      cwd,
+      dossier,
+      title,
+      outputs: {
+        json: parsedArgs.outJson ?? configExport.outputs?.json,
+        markdown: parsedArgs.outMarkdown ?? configExport.outputs?.markdown
+      }
+    });
+    return {
+      exitCode: dossier.status === "ready" ? 0 : 1,
+      skipped: false,
+      dossier,
+      stdout,
+      artifactPaths
+    };
+  } catch (error) {
+    return cliFailure(
+      error instanceof Error ? error.message : "Unknown provider onboarding dossier CLI failure."
+    );
+  }
+}
+function parseCliArgs(argv) {
+  const parsedArgs = {};
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (arg === "--") {
+      continue;
+    }
+    if (arg === "--help" || arg === "-h") {
+      parsedArgs.help = true;
+      continue;
+    }
+    if (arg === "--config") {
+      parsedArgs.configPath = requireValue(argv, index, arg);
+      index += 1;
+      continue;
+    }
+    if (arg === "--format") {
+      const format = requireValue(argv, index, arg);
+      if (format !== "markdown" && format !== "json") {
+        throw new Error("--format must be markdown or json.");
+      }
+      parsedArgs.format = format;
+      index += 1;
+      continue;
+    }
+    if (arg === "--out-json") {
+      parsedArgs.outJson = requireValue(argv, index, arg);
+      index += 1;
+      continue;
+    }
+    if (arg === "--out-md") {
+      parsedArgs.outMarkdown = requireValue(argv, index, arg);
+      index += 1;
+      continue;
+    }
+    if (arg === "--dossier-id") {
+      parsedArgs.dossierId = requireValue(argv, index, arg);
+      index += 1;
+      continue;
+    }
+    if (arg === "--generated-at") {
+      parsedArgs.generatedAt = requireValue(argv, index, arg);
+      index += 1;
+      continue;
+    }
+    if (arg === "--title") {
+      parsedArgs.title = requireValue(argv, index, arg);
+      index += 1;
+      continue;
+    }
+    throw new Error(`Unknown argument "${arg}".`);
+  }
+  return parsedArgs;
+}
+function requireValue(argv, index, flag) {
+  const value = argv[index + 1];
+  if (!value || value.startsWith("--")) {
+    throw new Error(`${flag} requires a value.`);
+  }
+  return value;
+}
+async function loadCliConfig(configPath, context) {
+  const configExport = await loadCliConfigDefault(configPath, context.cwd);
+  if (typeof configExport === "function") {
+    return configExport(context);
+  }
+  return configExport;
+}
+function isCliSkip(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value) && value.skip === true && typeof value.reason === "string";
+}
+function assertCliConfig(config) {
+  if (!config || typeof config !== "object" || Array.isArray(config)) {
+    throw new Error("Provider onboarding dossier CLI config must be an object.");
+  }
+  const candidate = config;
+  if (candidate.catalogArtifact !== void 0 && candidate.catalogArtifactFile !== void 0) {
+    throw new Error(
+      "Provider onboarding dossier CLI config may not provide both catalogArtifact and catalogArtifactFile."
+    );
+  }
+  if (candidate.conformanceArtifact !== void 0 && candidate.conformanceArtifactFile !== void 0) {
+    throw new Error(
+      "Provider onboarding dossier CLI config may not provide both conformanceArtifact and conformanceArtifactFile."
+    );
+  }
+  if (candidate.catalogArtifact === void 0 && candidate.catalogArtifactFile === void 0) {
+    throw new Error(
+      "Provider onboarding dossier CLI config requires catalogArtifact or catalogArtifactFile."
+    );
+  }
+  if (candidate.conformanceArtifact === void 0 && candidate.conformanceArtifactFile === void 0) {
+    throw new Error(
+      "Provider onboarding dossier CLI config requires conformanceArtifact or conformanceArtifactFile."
+    );
+  }
+  if (candidate.catalogArtifactFile !== void 0 && typeof candidate.catalogArtifactFile !== "string") {
+    throw new Error(
+      "Provider onboarding dossier CLI catalogArtifactFile must be a string."
+    );
+  }
+  if (candidate.conformanceArtifactFile !== void 0 && typeof candidate.conformanceArtifactFile !== "string") {
+    throw new Error(
+      "Provider onboarding dossier CLI conformanceArtifactFile must be a string."
+    );
+  }
+  if (candidate.dossier !== void 0 && !isRecord6(candidate.dossier)) {
+    throw new Error("Provider onboarding dossier CLI dossier config must be an object.");
+  }
+  if (candidate.outputs !== void 0) {
+    assertOutputs(candidate.outputs);
+  }
+}
+function assertOutputs(outputs) {
+  if (!isRecord6(outputs)) {
+    throw new Error("Provider onboarding dossier CLI outputs must be an object.");
+  }
+  for (const [key, value] of Object.entries(outputs)) {
+    if (!["json", "markdown"].includes(key) || value !== void 0 && typeof value !== "string") {
+      throw new Error(
+        "Provider onboarding dossier CLI outputs may only include json and markdown string paths."
+      );
+    }
+  }
+}
+async function resolveCatalogArtifact(config, cwd) {
+  if (config.catalogArtifact !== void 0) {
+    assertProviderCatalogArtifact(config.catalogArtifact);
+    return config.catalogArtifact;
+  }
+  const artifact = JSON.parse(
+    await (0, import_promises2.readFile)((0, import_node_path2.resolve)(cwd, config.catalogArtifactFile), "utf8")
+  );
+  assertProviderCatalogArtifact(artifact);
+  return artifact;
+}
+async function resolveConformanceArtifact(config, cwd) {
+  if (config.conformanceArtifact !== void 0) {
+    assertProviderConformanceArtifact(config.conformanceArtifact);
+    return config.conformanceArtifact;
+  }
+  const artifact = JSON.parse(
+    await (0, import_promises2.readFile)((0, import_node_path2.resolve)(cwd, config.conformanceArtifactFile), "utf8")
+  );
+  assertProviderConformanceArtifact(artifact);
+  return artifact;
+}
+async function writeArtifacts(options) {
+  const artifactPaths = {};
+  if (options.outputs.json) {
+    const path = (0, import_node_path2.resolve)(options.cwd, options.outputs.json);
+    await writeTextFile(
+      path,
+      formatProviderOnboardingDossier(options.dossier, {
+        format: "json",
+        title: options.title
+      })
+    );
+    artifactPaths.json = path;
+  }
+  if (options.outputs.markdown) {
+    const path = (0, import_node_path2.resolve)(options.cwd, options.outputs.markdown);
+    await writeTextFile(
+      path,
+      formatProviderOnboardingDossier(options.dossier, {
+        format: "markdown",
+        title: options.title
+      })
+    );
+    artifactPaths.markdown = path;
+  }
+  return artifactPaths;
+}
+async function writeTextFile(path, body) {
+  await (0, import_promises2.mkdir)((0, import_node_path2.dirname)(path), {
+    recursive: true
+  });
+  await (0, import_promises2.writeFile)(path, body, "utf8");
+}
+function cliFailure(message) {
+  return {
+    exitCode: 2,
+    skipped: false,
+    stdout: "",
+    stderr: `Provider onboarding dossier CLI failed: ${message}
+${USAGE}
+`
+  };
+}
+function isRecord6(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/cli/provider-dossier.ts
+void main();
+async function main() {
+  const result = await runProviderOnboardingDossierCli({
+    argv: process.argv.slice(2),
+    cwd: process.cwd()
+  });
+  if (result.stdout) {
+    process.stdout.write(result.stdout);
+  }
+  if (result.stderr) {
+    process.stderr.write(result.stderr);
+  }
+  process.exitCode = result.exitCode;
+}
+//# sourceMappingURL=provider-dossier.cjs.map