@sberpay-cli/cli-diagnostic 0.4.0-dev.7 → 0.4.0-dev.9

package/package/dist/cli.mjs

@@ -7375,7 +7375,7 @@ import { fileURLToPath } from "node:url";
 var NPM_PACKAGE = true ? "@sberpay-cli/cli-diagnostic" : "@sberpay-cli/cli";
 var kind = true ? "release" : "dev";
 var BUILD = {
-  sourceCommit: true ? "9a9b74aaa8ed8a80225fe2dd94e6205b2c99352e" : "dev",
+  sourceCommit: true ? "db0ec0c6594c1d28d55158cde8f6e5d564251e46" : "dev",
   profile: true ? "diagnostic" : "standard",
   kind,
   // Бандл — dist/cli.mjs в корне пакета; этот файл под tsx — packages/cli/src/core/.
@@ -27152,7 +27152,7 @@ import { join } from "node:path";
 import { mkdirSync, existsSync, openSync, writeFileSync, fsyncSync, closeSync, renameSync, rmSync } from "node:fs";
 import { dirname as dirname2 } from "node:path";
 import { randomUUID } from "node:crypto";
-function atomicJson(path2, value) {
+function atomicJson(path2, value, options = {}) {
   if (process.platform === "win32") {
     ensureWindowsPrivateDirectory(dirname2(path2));
     if (existsSync(path2)) assertWindowsPrivatePath(path2);
@@ -27161,7 +27161,7 @@ function atomicJson(path2, value) {
   try {
     const fd2 = openSync(temp, "wx", 384);
     try {
-      writeFileSync(fd2, JSON.stringify(value, null, 2) + "\n");
+      writeFileSync(fd2, (options.compact ? JSON.stringify(value) : JSON.stringify(value, null, 2)) + "\n");
       fsyncSync(fd2);
     } finally {
       closeSync(fd2);
@@ -27802,7 +27802,7 @@ async function exclusive(paths, recover, fn, installing2 = false) {
         JSON.stringify({ pid: process.pid }),
         { mode: 384, flag: "wx" }
       );
-    const fd2 = openSync4(join4(lock, "owner.json"), "r");
+    const fd2 = openSync4(join4(lock, "owner.json"), "r+");
     try {
       fsyncSync3(fd2);
     } finally {
@@ -28040,17 +28040,17 @@ async function probePay(ctx, opts, order, purchaseContext) {
   try {
     const store = await credentialStoreFor(ctx);
     await (async () => {
-      const snapshot = await withBindingLock(
+      const snapshot2 = await withBindingLock(
         bindingScope(ctx),
         async () => store.read()
       );
-      if (!snapshot)
+      if (!snapshot2)
         throw new CliError(
           EXIT.AUTH,
           "NO_CARD",
           "\u041A\u0430\u0440\u0442\u0430 \u0434\u043B\u044F \u0430\u0433\u0435\u043D\u0442\u0430 \u043D\u0435 \u043F\u0440\u0438\u0432\u044F\u0437\u0430\u043D\u0430"
         );
-      const prepared3 = prepareProbeToken(snapshot.value.agentToken);
+      const prepared3 = prepareProbeToken(snapshot2.value.agentToken);
       mutationApplied = true;
       journal.bindScope(store.scopeHash);
       try {
@@ -28496,7 +28496,7 @@ async function sendCase(caseId, env = process.env, deps = {}) {
 }
 
 // packages/cli/src/report/binding.ts
-import { readdir, realpath as realpath3, stat as stat3 } from "node:fs/promises";
+import { lstat as lstat2, readdir, realpath as realpath3, stat as stat3 } from "node:fs/promises";
 import { homedir as homedir3 } from "node:os";
 import { join as join9 } from "node:path";
 
@@ -28612,13 +28612,13 @@ async function collectTranscript(agent, parser3, binding, options = {}) {
       return result;
     }
     handle = await open5(path2, constants5.O_RDONLY | (constants5.O_NOFOLLOW ?? 0) | (constants5.O_NONBLOCK ?? 0));
-    const snapshot = await handle.stat();
-    if (!snapshot.isFile() || snapshot.ino !== before.ino || snapshot.dev !== before.dev || process.getuid && snapshot.uid !== process.getuid()) {
+    const snapshot2 = await handle.stat();
+    if (!snapshot2.isFile() || snapshot2.ino !== before.ino || snapshot2.dev !== before.dev || process.getuid && snapshot2.uid !== process.getuid()) {
       result.coverage = "failed";
       warn(result, "UNSAFE_SOURCE");
       return result;
     }
-    const length = Math.min(snapshot.size, maxBytes);
+    const length = Math.min(snapshot2.size, maxBytes);
     const buffer = Buffer.alloc(length);
     let offset = 0;
     while (offset < length) {
@@ -28632,10 +28632,10 @@ async function collectTranscript(agent, parser3, binding, options = {}) {
       offset += bytesRead;
     }
     result.snapshotBytes = offset;
-    if (snapshot.size > maxBytes) warn(result, "SIZE_LIMIT");
+    if (snapshot2.size > maxBytes) warn(result, "SIZE_LIMIT");
     if (offset < length) warn(result, "SOURCE_CHANGED");
     const after = await handle.stat();
-    if (after.size < snapshot.size || after.size === snapshot.size && after.mtimeMs !== snapshot.mtimeMs) warn(result, "SOURCE_CHANGED");
+    if (after.size < snapshot2.size || after.size === snapshot2.size && after.mtimeMs !== snapshot2.mtimeMs) warn(result, "SOURCE_CHANGED");
     const lines = buffer.subarray(0, offset).toString("utf8").split("\n");
     if (lines.at(-1) !== "") {
       lines.pop();
@@ -28920,12 +28920,34 @@ async function codexBinding(env) {
   return { sessionId, transcriptPath, allowedRoot, sourceVersion: runtimeVersion(meta3.cli_version) };
 }
 async function claudeBinding(env) {
-  const sessionId = requireId(env.SBERPAY_CLAUDE_SESSION_ID);
+  const hookId = env.SBERPAY_CLAUDE_SESSION_ID, hostId = env.CLAUDE_CODE_SESSION_ID;
+  if (hookId && hostId && hookId !== hostId) throw new BindingError("CONFLICTING_SESSION_IDS");
+  if (!hookId || hostId && (!env.SBERPAY_CLAUDE_TRANSCRIPT || !env.SBERPAY_CLAUDE_CONFIG_DIR)) return claudeHostBinding(env);
+  const sessionId = requireId(hookId);
   if (!env.SBERPAY_CLAUDE_TRANSCRIPT || !env.SBERPAY_CLAUDE_CONFIG_DIR) throw new BindingError("CLAUDE_HOOK_NOT_ACTIVE");
   const home = await realpath3(env.SBERPAY_CLAUDE_CONFIG_DIR);
   if (env.CLAUDE_CONFIG_DIR && await realpath3(env.CLAUDE_CONFIG_DIR) !== home) throw new BindingError("PROFILE_MISMATCH");
+  return claudeTranscript(sessionId, env.SBERPAY_CLAUDE_TRANSCRIPT, join9(home, "projects"));
+}
+async function claudeHostBinding(env) {
+  const sessionId = requireId(env.CLAUDE_CODE_SESSION_ID);
+  const home = await realpath3(env.CLAUDE_CONFIG_DIR || join9(homedir3(), ".claude"));
   const allowedRoot = join9(home, "projects");
-  const transcriptPath = env.SBERPAY_CLAUDE_TRANSCRIPT;
+  const matches = [];
+  for (const entry of await readdir(allowedRoot, { withFileTypes: true })) {
+    if (!entry.isDirectory()) continue;
+    const candidate = join9(allowedRoot, entry.name, `${sessionId}.jsonl`);
+    try {
+      if ((await lstat2(candidate)).isFile()) matches.push(candidate);
+    } catch (error62) {
+      if (error62.code !== "ENOENT") throw error62;
+    }
+    if (matches.length > 1) throw new BindingError("AMBIGUOUS_SESSION_SOURCE");
+  }
+  if (!matches.length) throw new BindingError("SOURCE_NOT_FOUND");
+  return claudeTranscript(sessionId, matches[0], allowedRoot);
+}
+async function claudeTranscript(sessionId, transcriptPath, allowedRoot) {
   const prefix = await readPrefix(allowedRoot, transcriptPath);
   const lines = prefix.split("\n");
   lines.pop();
@@ -28941,7 +28963,7 @@ async function claudeBinding(env) {
 async function resolveCurrentBinding(agent = "auto", env = process.env) {
   try {
     const hasCodex = !!(env.CODEX_THREAD_ID || env.CODEX_SESSION_ID);
-    const hasClaude = !!env.SBERPAY_CLAUDE_SESSION_ID;
+    const hasClaude = !!(env.SBERPAY_CLAUDE_SESSION_ID || env.CLAUDE_CODE_SESSION_ID);
     if (agent === "auto") {
       if (hasCodex && hasClaude) throw new BindingError("AMBIGUOUS_HOST");
       if (!hasCodex && !hasClaude) throw new BindingError("HOST_NOT_DETECTED");
@@ -28978,7 +29000,7 @@ function sessionSummary(result) {
 
 // packages/cli/src/report/package.ts
 import { createHash as createHash5, randomUUID as randomUUID6 } from "node:crypto";
-import { lstat as lstat2, readdir as readdir2, writeFile as writeFile2, rename as rename2, rm as rm2 } from "node:fs/promises";
+import { lstat as lstat3, readdir as readdir2, writeFile as writeFile2, rename as rename2, rm as rm2 } from "node:fs/promises";
 import { join as join11 } from "node:path";
 
 // node_modules/fflate/esm/index.mjs
@@ -29698,7 +29720,7 @@ function zipSync(data, opts) {
 }
 
 // packages/cli/src/core/version.ts
-var CLI_VERSION = "0.4.0-dev.7";
+var CLI_VERSION = "0.4.0-dev.9";
 
 // packages/cli/src/report/journal.ts
 import { closeSync as closeSync5, constants as constants6, openSync as openSync5, writeSync as writeSync2 } from "node:fs";
@@ -29798,7 +29820,7 @@ async function logs(dir2, sourceId) {
     for (const name of matching.slice(0, 1e3)) {
       try {
         const path2 = join11(dir2, name);
-        const info = await lstat2(path2);
+        const info = await lstat3(path2);
         if (!info.isFile() || info.isSymbolicLink() || info.size > 256 * 1024) throw new Error("unsafe");
         if (bytes + info.size > 8 * 1024 * 1024) {
           warnings.push("BYTE_LIMIT");
@@ -29879,9 +29901,11 @@ var enabled = (env = process.env) => env.SBERPAY_DIAGNOSTIC_CAPTURE === "1";
 function dir(env) {
   return privateDir2(join12(privateDir2(join12(cliPaths(env).stateDir, "diagnostics")), "episodes"));
 }
+var SESSION_HINT = "CLI \u043D\u0435 \u043D\u0430\u0448\u0451\u043B \u0438\u0441\u0442\u043E\u0440\u0438\u044E \u0442\u0435\u043A\u0443\u0449\u0435\u0433\u043E \u0447\u0430\u0442\u0430: \u043F\u0440\u043E\u0432\u0435\u0440\u044C\u0442\u0435 report session --json \u0438 \u043F\u0435\u0440\u0435\u0441\u043A\u0430\u0436\u0438\u0442\u0435 \u043A\u043B\u0438\u0435\u043D\u0442\u0443 \u043A\u043E\u0434. \u0412\u0440\u0443\u0447\u043D\u0443\u044E \u043F\u0435\u0440\u0435\u043C\u0435\u043D\u043D\u044B\u0435 \u043D\u0435 \u043F\u043E\u0434\u0441\u0442\u0430\u0432\u043B\u044F\u0439\u0442\u0435";
 async function session(env) {
   const s = await collectCurrentSession("auto", env);
-  if (s.status !== "bound" || s.transcript.identity !== "verified") throw Error("EPISODE_SESSION_UNAVAILABLE");
+  if (s.status !== "bound") throw new BindingError("EPISODE_SESSION_UNAVAILABLE", SESSION_HINT, s.code);
+  if (s.transcript.identity !== "verified") throw new BindingError("EPISODE_SESSION_UNAVAILABLE", SESSION_HINT, "IDENTITY_" + String(s.transcript.identity).toUpperCase());
   return s;
 }
 async function atomic(path2, value) {
@@ -30535,11 +30559,11 @@ async function livePay(ctx, opts) {
   const order = validatePayOptions(opts);
   const purchaseContext = parseContext(opts.context);
   const store = await credentialStoreFor(ctx);
-  const snapshot = await withBindingLock(
+  const snapshot2 = await withBindingLock(
     bindingScope(ctx),
     async () => store.read()
   );
-  if (!snapshot)
+  if (!snapshot2)
     throw new CliError(EXIT.AUTH, "NO_CARD", "\u041A\u0430\u0440\u0442\u0430 \u0434\u043B\u044F \u0430\u0433\u0435\u043D\u0442\u0430 \u043D\u0435 \u043F\u0440\u0438\u0432\u044F\u0437\u0430\u043D\u0430", {
       hint: RELINK_HINT
     });
@@ -30550,7 +30574,7 @@ async function livePay(ctx, opts) {
     currency: "643",
     ...purchaseContext ? { purchaseContext } : {}
   };
-  const res = await ctx.elcomV3.pay(input2, snapshot.value.agentToken).catch(withOutcomeHint);
+  const res = await ctx.elcomV3.pay(input2, snapshot2.value.agentToken).catch(withOutcomeHint);
   if (res.status === "SUCCESS") {
     try {
       await recordPayment(res.mdOrder ?? order.mdOrder, process.env, opts.merchant);
@@ -30570,7 +30594,7 @@ async function livePay(ctx, opts) {
   }
   const reason = res.reasonCode;
   if (reason === "TOKEN_EXPIRED" || reason === "TOKEN_REVOKED")
-    await forgetLocalToken(ctx, snapshot.fingerprint);
+    await forgetLocalToken(ctx, snapshot2.fingerprint);
   const hint = reason ? HINTS[reason] ?? unknownReasonHint(reason) : void 0;
   ctx.out.result(
     {
@@ -34168,11 +34192,11 @@ var program = new Command();
 
 // packages/cli/src/report/command.ts
 import { homedir as homedir5 } from "node:os";
-import { join as join16, dirname as dirname6, resolve as resolve2 } from "node:path";
+import { join as join16, dirname as dirname6, resolve as resolve2, isAbsolute as isAbsolute3 } from "node:path";
 
 // packages/cli/src/report/claudeHook.ts
 import { dirname as dirname5 } from "node:path";
-import { open as open7, chmod, lstat as lstat3, mkdir as mkdir2, readFile as readFile2, realpath as realpath4, rename as rename5, writeFile as writeFile4 } from "node:fs/promises";
+import { open as open7, chmod, lstat as lstat4, mkdir as mkdir2, readFile as readFile2, realpath as realpath4, rename as rename5, writeFile as writeFile4 } from "node:fs/promises";
 import { constants as constants7 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
 import { join as join15 } from "node:path";
@@ -34192,7 +34216,7 @@ async function captureClaudeBinding(input2, env = process.env) {
   if (process.platform === "win32") {
     assertWindowsPrivatePath(dirname5(env.CLAUDE_ENV_FILE));
     try {
-      await lstat3(env.CLAUDE_ENV_FILE);
+      await lstat4(env.CLAUDE_ENV_FILE);
       assertWindowsPrivatePath(env.CLAUDE_ENV_FILE);
     } catch (e) {
       if (e.code !== "ENOENT") throw e;
@@ -34207,13 +34231,16 @@ async function captureClaudeBinding(input2, env = process.env) {
     await file2.close();
   }
 }
-async function installClaudeHook(configDir, command) {
-  if (process.platform === "win32") ensureWindowsPrivateDirectory(configDir);
-  else await mkdir2(configDir, { recursive: true, mode: 448 });
+var claudeHookCommandFor = (args) => [...args, "report", "claude-hook"].map((s) => shellQuote(process.platform === "win32" ? s.replaceAll("\\", "/") : s)).join(" ");
+async function readSettings(configDir, create2) {
+  if (create2) {
+    if (process.platform === "win32") ensureWindowsPrivateDirectory(configDir);
+    else await mkdir2(configDir, { recursive: true, mode: 448 });
+  }
   const path2 = join15(configDir, "settings.json");
   let original;
   try {
-    const info = await lstat3(path2);
+    const info = await lstat4(path2);
     if (!info.isFile() || info.isSymbolicLink()) throw new BindingError("UNSAFE_SETTINGS");
     if (process.platform === "win32") assertWindowsPrivatePath(path2);
     original = await readFile2(path2, "utf8");
@@ -34226,6 +34253,18 @@ async function installClaudeHook(configDir, command) {
   if (!hooks) throw new BindingError("INVALID_HOOK_SETTINGS");
   const start = hooks.SessionStart === void 0 ? [] : hooks.SessionStart;
   if (!Array.isArray(start)) throw new BindingError("INVALID_HOOK_SETTINGS");
+  return { path: path2, original, settings, hooks, start };
+}
+async function writeSettings(path2, original, settings) {
+  const suffix = randomUUID9();
+  if (original !== void 0) await writeFile4(`${path2}.sberpay-${suffix}.bak`, original, { flag: "wx", mode: 384 });
+  const temp = `${path2}.sberpay-${suffix}.tmp`;
+  await writeFile4(temp, JSON.stringify(settings, null, 2) + "\n", { flag: "wx", mode: 384 });
+  await rename5(temp, path2);
+  await chmod(path2, 384);
+}
+async function installClaudeHook(configDir, command) {
+  const { path: path2, original, settings, hooks, start } = await readSettings(configDir, true);
   if (start.some((entry) => {
     const group = object2(entry);
     if (!group || group.matcher !== void 0 || !Array.isArray(group.hooks)) return false;
@@ -34236,18 +34275,14 @@ async function installClaudeHook(configDir, command) {
   })) return;
   hooks.SessionStart = [...start, { hooks: [{ type: "command", command, timeout: 10 }] }];
   settings.hooks = hooks;
-  const suffix = randomUUID9();
-  if (original !== void 0) await writeFile4(`${path2}.sberpay-${suffix}.bak`, original, { flag: "wx", mode: 384 });
-  const temp = `${path2}.sberpay-${suffix}.tmp`;
-  await writeFile4(temp, JSON.stringify(settings, null, 2) + "\n", { flag: "wx", mode: 384 });
-  await rename5(temp, path2);
-  await chmod(path2, 384);
+  await writeSettings(path2, original, settings);
 }
 
 // packages/cli/src/report/command.ts
-function claudeHookCommand() {
-  const args = BUILD.kind === "release" ? [process.execPath, join16(BUILD.root, "dist", "cli.mjs")] : [process.execPath, "--import", import.meta.resolve("tsx"), join16(BUILD.root, "packages", "cli", "src", "main.ts")];
-  return [...args, "report", "claude-hook"].map((s) => shellQuote(process.platform === "win32" ? s.replaceAll("\\", "/") : s)).join(" ");
+function claudeHookCommand(env = process.env) {
+  const launcher = env.SBERPAY_DIAGNOSTIC_LAUNCHER;
+  const args = BUILD.kind === "release" ? [process.execPath, launcher && isAbsolute3(launcher) ? launcher : join16(BUILD.root, "dist", "cli.mjs")] : [process.execPath, "--import", import.meta.resolve("tsx"), join16(BUILD.root, "packages", "cli", "src", "main.ts")];
+  return claudeHookCommandFor(args);
 }
 async function hookInput() {
   const chunks = [];
@@ -34296,7 +34331,7 @@ function registerReportCommands(program3) {
   });
   const output2 = () => createOutput(Boolean(program3.opts().json));
   const fail2 = (error62) => {
-    const code = error62 instanceof BindingError ? error62.code : "REPORT_FAILED";
+    const code = error62 instanceof BindingError ? error62.code : error62 instanceof Error && /^[A-Z][A-Z0-9_]{2,63}$/.test(error62.message) ? error62.message : "REPORT_FAILED";
     output2().error(new CliError(EXIT.CONFIG_OR_NETWORK, code, "\u041D\u0435 \u0443\u0434\u0430\u043B\u043E\u0441\u044C \u0432\u044B\u043F\u043E\u043B\u043D\u0438\u0442\u044C \u0434\u0438\u0430\u0433\u043D\u043E\u0441\u0442\u0438\u043A\u0443: " + code, error62 instanceof BindingError ? { hint: error62.hint, reasonCode: error62.reasonCode } : {}));
     process.exitCode = EXIT.CONFIG_OR_NETWORK;
   };
@@ -35146,7 +35181,7 @@ import { join as join19 } from "node:path";
 // packages/cli/src/core/keyHelper.ts
 import { spawnSync as spawnSync3 } from "node:child_process";
 import { existsSync as existsSync6, realpathSync as realpathSync2, statSync } from "node:fs";
-import { dirname as dirname8, isAbsolute as isAbsolute3, join as join18 } from "node:path";
+import { dirname as dirname8, isAbsolute as isAbsolute4, join as join18 } from "node:path";
 var PACKAGED = { "darwin-arm64": "darwin", "darwin-x64": "darwin", "linux-x64": "linux-x64", "linux-arm64": "linux-arm64", "win32-x64": "win32-x64", "win32-arm64": "win32-arm64" };
 function chipOf(platform2) {
   if (platform2 === "darwin") return "secure-enclave";
@@ -35202,7 +35237,7 @@ function unavailable(message2, hint) {
 }
 function findKeyHelper(opts) {
   const path2 = opts.override ?? opts.installed;
-  if (!isAbsolute3(path2)) throw unavailable(`\u041F\u0443\u0442\u044C \u043A \u0445\u0435\u043B\u043F\u0435\u0440\u0443 ${path2} \u0434\u043E\u043B\u0436\u0435\u043D \u0431\u044B\u0442\u044C \u0430\u0431\u0441\u043E\u043B\u044E\u0442\u043D\u044B\u043C`, "\u0423\u043A\u0430\u0436\u0438\u0442\u0435 \u043F\u043E\u043B\u043D\u044B\u0439 \u043F\u0443\u0442\u044C \u0432 SBERPAY_KEY_HELPER");
+  if (!isAbsolute4(path2)) throw unavailable(`\u041F\u0443\u0442\u044C \u043A \u0445\u0435\u043B\u043F\u0435\u0440\u0443 ${path2} \u0434\u043E\u043B\u0436\u0435\u043D \u0431\u044B\u0442\u044C \u0430\u0431\u0441\u043E\u043B\u044E\u0442\u043D\u044B\u043C`, "\u0423\u043A\u0430\u0436\u0438\u0442\u0435 \u043F\u043E\u043B\u043D\u044B\u0439 \u043F\u0443\u0442\u044C \u0432 SBERPAY_KEY_HELPER");
   if (!existsSync6(path2)) return void 0;
   if (!isTrustedFile(path2)) {
     throw unavailable(`\u0425\u0435\u043B\u043F\u0435\u0440 ${path2} \u043D\u0435 \u043F\u0440\u0438\u043D\u0430\u0434\u043B\u0435\u0436\u0438\u0442 \u043F\u043E\u043B\u044C\u0437\u043E\u0432\u0430\u0442\u0435\u043B\u044E \u0438\u043B\u0438 \u0434\u043E\u0441\u0442\u0443\u043F\u0435\u043D \u043D\u0430 \u0437\u0430\u043F\u0438\u0441\u044C \u0434\u0440\u0443\u0433\u0438\u043C`, "\u041F\u0435\u0440\u0435\u0443\u0441\u0442\u0430\u043D\u043E\u0432\u0438\u0442\u0435 sberpay-cli; \u043F\u0440\u0430\u0432\u0430 \u043D\u0430 \u0445\u0435\u043B\u043F\u0435\u0440 \u0438 \u0435\u0433\u043E \u043A\u0430\u0442\u0430\u043B\u043E\u0433: Unix 0755; Windows \u2014 \u0437\u0430\u043F\u0438\u0441\u044C \u0442\u043E\u043B\u044C\u043A\u043E \u0432\u043B\u0430\u0434\u0435\u043B\u044C\u0446\u0443, SYSTEM \u0438 Administrators");
@@ -35717,7 +35752,7 @@ var DeviceRequestClaims = external_exports.discriminatedUnion("op", [
 );
 
 // packages/contracts/src/v3/merchants.ts
-var MERCHANT_PATHS = { check: "/merchants/check" };
+var MERCHANT_PATHS = { check: "/merchants/check", domains: "/merchants/domains" };
 var Merchant2 = external_exports.object({
   merchantId: external_exports.string(),
   name: external_exports.string(),
@@ -35732,6 +35767,15 @@ var CheckMerchantResponse2 = external_exports.object({
   supported: external_exports.boolean(),
   merchant: Merchant2.optional()
 });
+var MerchantDomain = external_exports.object({
+  domain: external_exports.string().min(1).max(253),
+  includeSubdomains: external_exports.boolean()
+});
+var MerchantDomainsResponse = external_exports.object({
+  requestId: external_exports.string(),
+  count: external_exports.number().int().nonnegative(),
+  domains: external_exports.array(MerchantDomain).max(1e6)
+});
 
 // packages/cli/src/core/trustedRoots.ts
 import { createHash as createHash11, X509Certificate } from "node:crypto";
@@ -37409,8 +37453,9 @@ function createElcomClientV3(core, device2, options = {}) {
 
 // packages/cli/src/schemes/v2/merchantsClient.ts
 var PEER = "\u0424\u041F \u0423\u043C\u043D\u044B\u0435 \u043F\u043E\u043A\u0443\u043F\u043A\u0438";
+var DOMAINS_TIMEOUT_MS = 3e4;
 function createMerchantsClient(logger, baseUrl) {
-  const post = async (op, path2, body) => {
+  const post = async (op, path2, body, extra = {}) => {
     if (!baseUrl) {
       throw new CliError(
         EXIT.CONFIG_OR_NETWORK,
@@ -37427,7 +37472,8 @@ function createMerchantsClient(logger, baseUrl) {
       peer: PEER,
       url: `${baseUrl}${path2}`,
       body: { requestId, ...body },
-      headers: { [HEADER_REQUEST_ID]: requestId }
+      headers: { [HEADER_REQUEST_ID]: requestId },
+      ...extra
     });
   };
   return {
@@ -37437,7 +37483,17 @@ function createMerchantsClient(logger, baseUrl) {
         domain: normalizeDomain(domain2)
       }),
       PEER
-    )
+    ),
+    domains: async () => {
+      const res = expectResponse(
+        MerchantDomainsResponse,
+        await post("\u0441\u043F\u0438\u0441\u043E\u043A \u0434\u043E\u043C\u0435\u043D\u043E\u0432 \u043C\u0430\u0433\u0430\u0437\u0438\u043D\u043E\u0432", MERCHANT_PATHS.domains, {}, { timeoutMs: DOMAINS_TIMEOUT_MS, sensitive: true }),
+        PEER
+      );
+      if (res.count !== res.domains.length)
+        throw new CliError(EXIT.CONFIG_OR_NETWORK, "INVALID_RESPONSE", `${PEER}: count (${res.count}) \u043D\u0435 \u0441\u043E\u0432\u043F\u0430\u0434\u0430\u0435\u0442 \u0441 \u0447\u0438\u0441\u043B\u043E\u043C \u0434\u043E\u043C\u0435\u043D\u043E\u0432 (${res.domains.length})`);
+      return res;
+    }
   };
 }
 function normalizeDomain(input2) {
@@ -38428,11 +38484,6 @@ async function authLoginCommand(ctx, opts) {
       session2?.legacy ? "LEGACY_PENDING_NO_LINK" : "LOGIN_STARTING",
       "\u0421\u0441\u044B\u043B\u043A\u0430 \u0442\u0435\u043A\u0443\u0449\u0435\u0439 \u043F\u043E\u043F\u044B\u0442\u043A\u0438 \u043D\u0435\u0434\u043E\u0441\u0442\u0443\u043F\u043D\u0430. \u041F\u0440\u043E\u0432\u0435\u0440\u044C\u0442\u0435 auth status; \u0440\u0430\u043D\u0435\u0435 \u0432\u044B\u0434\u0430\u043D\u043D\u044B\u0439 \u0442\u043E\u043A\u0435\u043D \u043C\u043E\u0436\u043D\u043E \u043F\u0435\u0440\u0435\u0434\u0430\u0442\u044C \u0447\u0435\u0440\u0435\u0437 auth complete."
     );
-  process.stderr.write(`
-\u041C\u0435\u0442\u043A\u0430 \u0441\u0435\u0441\u0441\u0438\u0438:
-${session2.mark.text}
-${session2.mark.names}
-`);
   if (ctx.stand.cabinetMockUrl) process.stderr.write("\u041A\u0430\u0431\u0438\u043D\u0435\u0442 \u2014 \u043C\u043E\u043A, \u0430 \u043D\u0435 \u043D\u0430\u0441\u0442\u043E\u044F\u0449\u0438\u0439 \u043A\u0430\u0431\u0438\u043D\u0435\u0442 \u041A\u0413\u0421.\n");
   if (record2.mode === "local") await openInBrowser(session2.link, ctx.out, !opts.open);
   const update = updateForVersion(session2.cliLatest);
@@ -38484,19 +38535,19 @@ async function verifySavedToken(ctx, offline = false) {
   try {
     const store = await credentialStoreFor(ctx), scope = bindingScope(ctx);
     for (let attempt = 0; attempt < 3; attempt++) {
-      const { snapshot, meta: meta3 } = await withBindingLock(scope, async () => ({
+      const { snapshot: snapshot2, meta: meta3 } = await withBindingLock(scope, async () => ({
         snapshot: store.read(),
         meta: offline ? loadConfig(ctx.paths).tokenMetaV3?.[store.scopeHash] : void 0
       }));
-      if (!snapshot) return { loggedIn: false, canPay: false };
-      const { tokenId, subId } = snapshot.value;
+      if (!snapshot2) return { loggedIn: false, canPay: false };
+      const { tokenId, subId } = snapshot2.value;
       if (offline) {
         return {
           loggedIn: true,
           canPay: false,
           source: "local-cache",
           tokenId,
-          ...meta3 && meta3.credentialHash === snapshot.fingerprint ? { token: toView({ tokenStatus: "ACTIVE", ...meta3 }) } : {}
+          ...meta3 && meta3.credentialHash === snapshot2.fingerprint ? { token: toView({ tokenStatus: "ACTIVE", ...meta3 }) } : {}
         };
       }
       let response, networkError2;
@@ -38508,7 +38559,7 @@ async function verifySavedToken(ctx, offline = false) {
       const result = await withBindingLock(
         scope,
         async () => {
-          if (store.read()?.fingerprint !== snapshot.fingerprint) return;
+          if (store.read()?.fingerprint !== snapshot2.fingerprint) return;
           if (networkError2)
             return failure2(
               networkError2 instanceof CliError ? networkError2.code : "TOKEN_STATUS_UNAVAILABLE",
@@ -38529,7 +38580,7 @@ async function verifySavedToken(ctx, offline = false) {
             );
           const canPay = status.tokenStatus === "ACTIVE";
           if (!canPay) {
-            store.deleteIfUnchanged(snapshot.fingerprint);
+            store.deleteIfUnchanged(snapshot2.fingerprint);
             await ctx.updateConfig((c) => {
               const meta4 = { ...c.tokenMetaV3 };
               delete meta4[store.scopeHash];
@@ -38541,7 +38592,7 @@ async function verifySavedToken(ctx, offline = false) {
               tokenMetaV3: {
                 ...c.tokenMetaV3,
                 [store.scopeHash]: {
-                  credentialHash: snapshot.fingerprint,
+                  credentialHash: snapshot2.fingerprint,
                   cardMask: status.cardMask ?? "",
                   purchaseLimit: status.purchaseLimit,
                   dailyLimit: status.dailyLimit,
@@ -38655,8 +38706,8 @@ async function authLogoutCommand(ctx, opts) {
     cancelBindingLocked(ctx);
     ctx.secrets.delete("agentToken");
     const store = ctx.device.exists() ? await credentialStoreFor(ctx) : void 0;
-    const snapshot = store?.read();
-    if (snapshot) store.deleteIfUnchanged(snapshot.fingerprint);
+    const snapshot2 = store?.read();
+    if (snapshot2) store.deleteIfUnchanged(snapshot2.fingerprint);
     await ctx.updateConfig((c) => {
       const { token: _token, pendingSession: _pending, ...rest } = c;
       const tokenMetaV3 = { ...c.tokenMetaV3 };
@@ -38685,14 +38736,14 @@ var ALREADY = {
 };
 async function cardRevokeCommand(ctx) {
   const store = ctx.device.exists() ? await credentialStoreFor(ctx) : void 0;
-  const snapshot = await withBindingLock(bindingScope(ctx), async () => {
+  const snapshot2 = await withBindingLock(bindingScope(ctx), async () => {
     cancelBindingLocked(ctx);
     return store?.read();
   });
   const res = await ctx.elcomV3.revoke();
   if (res.tokenStatus === "ACTIVE")
     throw new Error("\u041E\u0442\u0437\u044B\u0432 \u043D\u0435 \u043F\u043E\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0451\u043D \u0431\u0430\u043D\u043A\u043E\u043C");
-  await forgetLocalToken(ctx, snapshot?.fingerprint);
+  await forgetLocalToken(ctx, snapshot2?.fingerprint);
   const concurrent = store?.read();
   const verification = concurrent ? await verifySavedToken(ctx) : void 0;
   const human = verification ? "\u041E\u0442\u0437\u044B\u0432 \u043F\u043E \u0443\u0441\u0442\u0440\u043E\u0439\u0441\u0442\u0432\u0443 \u0432\u044B\u043F\u043E\u043B\u043D\u0435\u043D. \u041B\u043E\u043A\u0430\u043B\u044C\u043D\u0430\u044F \u043F\u0440\u0438\u0432\u044F\u0437\u043A\u0430 \u0438\u0437\u043C\u0435\u043D\u0438\u043B\u0430\u0441\u044C \u0432\u043E \u0432\u0440\u0435\u043C\u044F \u0437\u0430\u043F\u0440\u043E\u0441\u0430; \u0435\u0451 \u0442\u0435\u043A\u0443\u0449\u0430\u044F \u0433\u043E\u0442\u043E\u0432\u043D\u043E\u0441\u0442\u044C \u043F\u0440\u043E\u0432\u0435\u0440\u0435\u043D\u0430 \u043E\u0442\u0434\u0435\u043B\u044C\u043D\u043E." : res.tokenStatus === "REVOKED" ? "\u2713 \u0414\u043E\u0441\u0442\u0443\u043F \u0430\u0433\u0435\u043D\u0442\u0430 \u043A \u043A\u0430\u0440\u0442\u0435 \u043E\u0442\u043E\u0437\u0432\u0430\u043D, \u043E\u043F\u043B\u0430\u0442\u044B \u0431\u043E\u043B\u044C\u0448\u0435 \u043D\u0435 \u043F\u0440\u043E\u0439\u0434\u0443\u0442." : `\u2713 \u041E\u0442\u0437\u044B\u0432\u0430\u0442\u044C \u043D\u0435\u0447\u0435\u0433\u043E: ${ALREADY[res.tokenStatus] ?? res.tokenStatus}. \u041E\u043F\u043B\u0430\u0442\u044B \u0441 \u044D\u0442\u043E\u0433\u043E \u043A\u043E\u043C\u043F\u044C\u044E\u0442\u0435\u0440\u0430 \u043D\u0435 \u043F\u0440\u043E\u0439\u0434\u0443\u0442.`;
@@ -38706,6 +38757,171 @@ async function cardRevokeCommand(ctx) {
   );
 }
 
+// packages/cli/src/schemes/v2/merchantsDomains.ts
+import { readFileSync as readFileSync12, rmSync as rmSync7 } from "node:fs";
+import { join as join24 } from "node:path";
+import { domainToUnicode } from "node:url";
+var DOMAINS_TTL_MS = 24 * 60 * 60 * 1e3;
+var REFRESH_BACKOFF_MS = 15 * 60 * 1e3;
+var LOCK_TIMEOUT_MS = 2e4;
+var CLOCK_SKEW_MS = 5 * 60 * 1e3;
+var CacheRecord = external_exports.object({
+  format: external_exports.literal(1),
+  stand: external_exports.string(),
+  merchantsUrl: external_exports.string(),
+  fetchedAt: external_exports.string(),
+  count: external_exports.number().int().nonnegative(),
+  domains: external_exports.array(MerchantDomain)
+});
+var AttemptRecord = external_exports.object({
+  format: external_exports.literal(1),
+  merchantsUrl: external_exports.string(),
+  failedAt: external_exports.string(),
+  code: external_exports.string()
+});
+function cacheFiles(ctx) {
+  const base2 = join24(ctx.paths.cacheDir, `merchants-domains.${ctx.standName}`);
+  return { data: `${base2}.json`, attempt: `${base2}.attempt.json`, lock: `${base2}.lock` };
+}
+function merchantsBase(ctx) {
+  const url2 = ctx.stand.merchantsUrl?.replace(/\/+$/, "");
+  if (!url2)
+    throw new CliError(EXIT.CONFIG_OR_NETWORK, "STAND_NOT_CONFIGURED", "\u041D\u0430 \u044D\u0442\u043E\u043C \u0441\u0442\u0435\u043D\u0434\u0435 \u043D\u0435\u0442 \u0440\u0435\u0435\u0441\u0442\u0440\u0430 \u043C\u0430\u0433\u0430\u0437\u0438\u043D\u043E\u0432 \u0424\u041F (merchantsUrl \u043D\u0435 \u0437\u0430\u0434\u0430\u043D)", {
+      hint: "\u0423\u043A\u0430\u0436\u0438\u0442\u0435 stands.<\u0441\u0442\u0435\u043D\u0434>.merchantsUrl \u0432 config.json"
+    });
+  return url2;
+}
+function readJson(file2, schema) {
+  try {
+    const parsed = schema.safeParse(JSON.parse(readFileSync12(file2, "utf8")));
+    return parsed.success ? parsed.data : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function readCache(ctx, url2) {
+  const record2 = readJson(cacheFiles(ctx).data, CacheRecord);
+  if (!record2 || record2.stand !== ctx.standName || record2.merchantsUrl !== url2) return void 0;
+  if (record2.count !== record2.domains.length || Number.isNaN(Date.parse(record2.fetchedAt))) return void 0;
+  return record2;
+}
+function isFresh(record2, now) {
+  const fetched = Date.parse(record2.fetchedAt);
+  return fetched <= now + CLOCK_SKEW_MS && now - fetched < DOMAINS_TTL_MS;
+}
+function snapshot(ctx, record2, source, now, refreshError) {
+  return {
+    stand: ctx.standName,
+    source,
+    fetchedAt: record2.fetchedAt,
+    ageHours: Math.max(0, Math.round((now - Date.parse(record2.fetchedAt)) / 36e5 * 10) / 10),
+    stale: refreshError !== void 0 || !isFresh(record2, now),
+    ...refreshError ? { refreshError } : {},
+    count: record2.count,
+    file: cacheFiles(ctx).data,
+    domains: record2.domains
+  };
+}
+function backoff(ctx, url2, now) {
+  const attempt = readJson(cacheFiles(ctx).attempt, AttemptRecord);
+  if (!attempt || attempt.merchantsUrl !== url2) return void 0;
+  const until = Date.parse(attempt.failedAt) + REFRESH_BACKOFF_MS;
+  return Number.isNaN(until) || until <= now ? void 0 : { until, code: attempt.code };
+}
+async function loadDomains(ctx, opts = {}) {
+  const now = () => ctx.now?.() ?? Date.now();
+  const url2 = merchantsBase(ctx);
+  const files = cacheFiles(ctx);
+  const cached2 = readCache(ctx, url2);
+  if (opts.offline) {
+    if (!cached2)
+      throw new CliError(EXIT.CONFIG_OR_NETWORK, "MERCHANTS_DOMAINS_NOT_CACHED", "\u0421\u043F\u0438\u0441\u043E\u043A \u0434\u043E\u043C\u0435\u043D\u043E\u0432 \u0435\u0449\u0451 \u043D\u0435 \u0441\u043A\u0430\u0447\u0430\u043D \u043D\u0430 \u044D\u0442\u043E\u043C \u043A\u043E\u043C\u043F\u044C\u044E\u0442\u0435\u0440\u0435", {
+        hint: "\u0417\u0430\u043F\u0443\u0441\u0442\u0438\u0442\u0435 sberpay-cli merchants domains \u0431\u0435\u0437 --offline"
+      });
+    return snapshot(ctx, cached2, "cache", now());
+  }
+  if (cached2 && !opts.refresh && isFresh(cached2, now())) return snapshot(ctx, cached2, "cache", now());
+  const blocked = backoff(ctx, url2, now());
+  if (blocked) {
+    const refreshError = {
+      code: blocked.code,
+      message: `\u041F\u0440\u043E\u0448\u043B\u043E\u0435 \u043E\u0431\u043D\u043E\u0432\u043B\u0435\u043D\u0438\u0435 \u0441\u043F\u0438\u0441\u043A\u0430 \u043D\u0435 \u0443\u0434\u0430\u043B\u043E\u0441\u044C; \u0441\u043B\u0435\u0434\u0443\u044E\u0449\u0430\u044F \u043F\u043E\u043F\u044B\u0442\u043A\u0430 \u043F\u043E\u0441\u043B\u0435 ${new Date(blocked.until).toISOString()}`
+    };
+    if (cached2) return snapshot(ctx, cached2, "cache", now(), refreshError);
+    throw new CliError(EXIT.CONFIG_OR_NETWORK, "MERCHANTS_DOMAINS_UNAVAILABLE", `\u0421\u043F\u0438\u0441\u043E\u043A \u0434\u043E\u043C\u0435\u043D\u043E\u0432 \u043D\u0435\u0434\u043E\u0441\u0442\u0443\u043F\u0435\u043D: ${refreshError.message}`, {
+      hint: "\u0414\u043B\u044F \u043E\u0442\u0434\u0435\u043B\u044C\u043D\u043E\u0433\u043E \u0441\u0430\u0439\u0442\u0430 \u0438\u0441\u043F\u043E\u043B\u044C\u0437\u0443\u0439\u0442\u0435 sberpay-cli merchants check <\u0434\u043E\u043C\u0435\u043D>"
+    });
+  }
+  try {
+    return await withFileLock(
+      files.lock,
+      async () => {
+        const latest = readCache(ctx, url2);
+        if (latest && latest.fetchedAt !== cached2?.fetchedAt && isFresh(latest, now())) return snapshot(ctx, latest, "cache", now());
+        let response;
+        try {
+          response = await ctx.merchants.domains();
+        } catch (error62) {
+          if (error62 instanceof CliError)
+            atomicJson(files.attempt, { format: 1, merchantsUrl: url2, failedAt: new Date(now()).toISOString(), code: error62.code });
+          throw error62;
+        }
+        const record2 = {
+          format: 1,
+          stand: ctx.standName,
+          merchantsUrl: url2,
+          fetchedAt: new Date(now()).toISOString(),
+          count: response.count,
+          domains: response.domains
+        };
+        atomicJson(files.data, record2, { compact: true });
+        rmSync7(files.attempt, { force: true });
+        return snapshot(ctx, record2, "network", now());
+      },
+      LOCK_TIMEOUT_MS
+    );
+  } catch (error62) {
+    if (!(error62 instanceof CliError)) throw error62;
+    const latest = error62.code === "BINDING_BUSY" ? readCache(ctx, url2) ?? cached2 : cached2;
+    ctx.warn(`merchants domains: \u043E\u0431\u043D\u043E\u0432\u043B\u0435\u043D\u0438\u0435 \u0441\u043F\u0438\u0441\u043A\u0430 \u043D\u0435 \u0443\u0434\u0430\u043B\u043E\u0441\u044C (${error62.code}): ${error62.message}`);
+    if (latest) return snapshot(ctx, latest, "cache", now(), { code: error62.code, message: error62.message });
+    if (error62.code === "BINDING_BUSY")
+      throw new CliError(EXIT.CONFIG_OR_NETWORK, "MERCHANTS_DOMAINS_BUSY", "\u0421\u043F\u0438\u0441\u043E\u043A \u0434\u043E\u043C\u0435\u043D\u043E\u0432 \u0441\u0435\u0439\u0447\u0430\u0441 \u043E\u0431\u043D\u043E\u0432\u043B\u044F\u0435\u0442 \u0434\u0440\u0443\u0433\u0430\u044F \u043A\u043E\u043C\u0430\u043D\u0434\u0430", {
+        hint: "\u041F\u043E\u0432\u0442\u043E\u0440\u0438\u0442\u0435 \u0447\u0435\u0440\u0435\u0437 \u043D\u0435\u0441\u043A\u043E\u043B\u044C\u043A\u043E \u0441\u0435\u043A\u0443\u043D\u0434"
+      });
+    throw error62;
+  }
+}
+var indexDomains = (domains) => new Map(domains.map((entry) => [entry.domain, entry.includeSubdomains]));
+function matchDomain(index, input2) {
+  let domain2;
+  try {
+    domain2 = normalizeDomain(input2);
+  } catch (error62) {
+    return { input: input2, supported: false, error: error62 instanceof CliError ? error62.code : "INVALID_ARGUMENT" };
+  }
+  if (index.has(domain2)) return { input: input2, domain: domain2, supported: true, registryDomain: domain2, matchedBy: "exact" };
+  for (let candidate = domain2; candidate.includes("."); ) {
+    candidate = candidate.slice(candidate.indexOf(".") + 1);
+    if (index.get(candidate) === true) return { input: input2, domain: domain2, supported: true, registryDomain: candidate, matchedBy: "parent" };
+  }
+  return { input: input2, domain: domain2, supported: false };
+}
+function searchDomains(domains, query, limit) {
+  const needle = query.trim().toLowerCase();
+  if (!needle) throw new CliError(EXIT.VALIDATION, "INVALID_ARGUMENT", "--search: \u043F\u0443\u0441\u0442\u0430\u044F \u0441\u0442\u0440\u043E\u043A\u0430 \u043F\u043E\u0438\u0441\u043A\u0430");
+  const hits = [];
+  let total = 0;
+  for (const entry of domains) {
+    const unicode = entry.domain.includes("xn--") ? domainToUnicode(entry.domain) : entry.domain;
+    if (!entry.domain.includes(needle) && !unicode.toLowerCase().includes(needle)) continue;
+    total++;
+    if (hits.length < limit)
+      hits.push({ domain: entry.domain, ...unicode && unicode !== entry.domain ? { unicode } : {}, includeSubdomains: entry.includeSubdomains });
+  }
+  return { total, truncated: total > hits.length, domains: hits };
+}
+
 // packages/cli/src/schemes/v2/commands/merchants.ts
 async function merchantsCheckCommand(ctx, domain2) {
   const res = await ctx.merchants.check(domain2);
@@ -38717,6 +38933,47 @@ ${entry.domain}:
 ${entry.payload}`).join("") ?? "")
   );
 }
+var DEFAULT_SEARCH_LIMIT = 50;
+var MAX_SEARCH_LIMIT = 1e3;
+var MAX_MATCH_INPUTS = 500;
+function searchLimit(raw) {
+  if (raw === void 0) return DEFAULT_SEARCH_LIMIT;
+  const limit = Number(raw);
+  if (!Number.isInteger(limit) || limit < 1 || limit > MAX_SEARCH_LIMIT)
+    throw new CliError(EXIT.VALIDATION, "INVALID_ARGUMENT", `--limit: \u0446\u0435\u043B\u043E\u0435 \u043E\u0442 1 \u0434\u043E ${MAX_SEARCH_LIMIT}`);
+  return limit;
+}
+async function merchantsDomainsCommand(ctx, opts) {
+  const match = opts.match ?? [];
+  if (match.length > MAX_MATCH_INPUTS)
+    throw new CliError(EXIT.VALIDATION, "INVALID_ARGUMENT", `--match: \u043D\u0435 \u0431\u043E\u043B\u044C\u0448\u0435 ${MAX_MATCH_INPUTS} \u0434\u043E\u043C\u0435\u043D\u043E\u0432 \u0437\u0430 \u0432\u044B\u0437\u043E\u0432`);
+  if (opts.refresh && opts.offline)
+    throw new CliError(EXIT.VALIDATION, "INVALID_ARGUMENT", "\u0423\u043A\u0430\u0436\u0438\u0442\u0435 \u043E\u0434\u043D\u043E: --refresh \u0438\u043B\u0438 --offline");
+  const limit = searchLimit(opts.limit);
+  const { domains, ...summary } = await loadDomains(ctx, { refresh: opts.refresh, offline: opts.offline });
+  const result = { ...summary };
+  const lines = [
+    `\u041C\u0430\u0433\u0430\u0437\u0438\u043D\u043E\u0432 \u0441 \u043E\u043F\u043B\u0430\u0442\u043E\u0439 \u0430\u0433\u0435\u043D\u0442\u043E\u043C: ${summary.count} (\u0441\u043F\u0438\u0441\u043E\u043A \u043E\u0442 ${summary.fetchedAt}${summary.stale ? ", \u043C\u043E\u0436\u0435\u0442 \u0431\u044B\u0442\u044C \u043D\u0435\u043F\u043E\u043B\u043D\u044B\u043C" : ""})`
+  ];
+  if (match.length) {
+    const index = indexDomains(domains);
+    const matches = match.map((input2) => matchDomain(index, input2));
+    result.matches = matches;
+    lines.push(
+      ...matches.map(
+        (m) => m.error ? `? ${m.input}: \u043D\u0435 \u0434\u043E\u043C\u0435\u043D \u0438 \u043D\u0435 URL` : m.supported ? `\u2713 ${m.domain}${m.matchedBy === "parent" ? ` (\u0447\u0435\u0440\u0435\u0437 ${m.registryDomain})` : ""}` : `\u2717 ${m.domain}`
+      )
+    );
+  }
+  if (opts.search !== void 0) {
+    const found = searchDomains(domains, opts.search, limit);
+    result.search = { query: opts.search, ...found };
+    lines.push(`\u041D\u0430\u0439\u0434\u0435\u043D\u043E \u043F\u043E \xAB${opts.search}\xBB: ${found.total}${found.truncated ? ` (\u043F\u043E\u043A\u0430\u0437\u0430\u043D\u044B \u043F\u0435\u0440\u0432\u044B\u0435 ${found.domains.length})` : ""}`);
+    lines.push(...found.domains.map((d) => `  ${d.unicode ?? d.domain}`));
+  }
+  if (!match.length && opts.search === void 0) lines.push(`\u041F\u043E\u043B\u043D\u044B\u0439 \u0441\u043F\u0438\u0441\u043E\u043A: ${summary.file}`);
+  ctx.out.result(result, lines.join("\n"));
+}
 
 // packages/cli/src/schemes/v2/commands/device.ts
 async function deviceInfo(ctx) {
@@ -38833,20 +39090,20 @@ function createAddressesClient(core, device2, credentials, options = {}) {
       );
     if (!device2.exists())
       throw new CliError(EXIT.AUTH, "NO_CARD", "\u0421\u043D\u0430\u0447\u0430\u043B\u0430 \u043F\u0440\u0438\u0432\u044F\u0436\u0438\u0442\u0435 \u043A\u0430\u0440\u0442\u0443");
-    const snapshot = await withBindingLock(
+    const snapshot2 = await withBindingLock(
       bindingScope(core),
       async () => credentials.read()
     );
-    if (!snapshot)
+    if (!snapshot2)
       throw new CliError(EXIT.AUTH, "NO_CARD", "\u0421\u043D\u0430\u0447\u0430\u043B\u0430 \u043F\u0440\u0438\u0432\u044F\u0436\u0438\u0442\u0435 \u043A\u0430\u0440\u0442\u0443");
-    if (!AddressSubId.safeParse(snapshot.value.subId).success)
+    if (!AddressSubId.safeParse(snapshot2.value.subId).success)
       throw new CliError(
         EXIT.AUTH,
         "TOKEN_MALFORMED",
         "subId \u0441\u043E\u0445\u0440\u0430\u043D\u0451\u043D\u043D\u043E\u0439 \u043F\u0440\u0438\u0432\u044F\u0437\u043A\u0438 \u043D\u0435 \u0441\u043E\u043E\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u043A\u043E\u043D\u0442\u0440\u0430\u043A\u0442\u0443 \u0424\u041F"
       );
     if (core.stand.addressesMode === "pilot-json")
-      return sendPilotAddress(core, path2, schema, snapshot.value.subId, deliveryAddress);
+      return sendPilotAddress(core, path2, schema, snapshot2.value.subId, deliveryAddress);
     const pub = await device2.ensure(), kid = await calculateJwkThumbprint(pub.encKey);
     for (let attempt = 0; attempt < 2; attempt++) {
       const key = await getEncryptionKey(core, attempt > 0, options), requestId = randomUUID15(), iat = Math.floor(Date.now() / 1e3);
@@ -38859,7 +39116,7 @@ function createAddressesClient(core, device2, credentials, options = {}) {
         exp: iat + 60,
         jti: randomBytes2(16).toString("base64url"),
         body: {
-          subId: snapshot.value.subId,
+          subId: snapshot2.value.subId,
           ...deliveryAddress ? { deliveryAddress } : {}
         }
       });
@@ -38997,6 +39254,10 @@ function createScheme(core) {
     addressGet: run3(addressGetCommand),
     addressSet: run3(addressSetCommand),
     merchantsCheck: async (domain2) => merchantsCheckCommand(merchantsCtx, domain2),
+    merchantsDomains: async (opts) => merchantsDomainsCommand(
+      { ...merchantsCtx, paths: core.paths, standName: core.standName, stand: core.stand, warn: (msg) => core.warn(msg) },
+      opts
+    ),
     deviceShow: run3(deviceShowCommand),
     deviceRegister: run3(deviceRegisterCommand)
   };
@@ -39013,9 +39274,9 @@ import { resolve as resolve5 } from "node:path";
 
 // packages/cli/src/ca/rootCa.ts
 import { randomBytes as randomBytes3, X509Certificate as X509Certificate2 } from "node:crypto";
-import { closeSync as closeSync8, existsSync as existsSync10, fchmodSync, lstatSync as lstatSync6, mkdirSync as mkdirSync12, mkdtempSync, openSync as openSync8, readFileSync as readFileSync12, renameSync as renameSync5, rmSync as rmSync7, writeFileSync as writeFileSync5, writeSync as writeSync4 } from "node:fs";
+import { closeSync as closeSync8, existsSync as existsSync10, fchmodSync, lstatSync as lstatSync6, mkdirSync as mkdirSync12, mkdtempSync, openSync as openSync8, readFileSync as readFileSync13, renameSync as renameSync5, rmSync as rmSync8, writeFileSync as writeFileSync5, writeSync as writeSync4 } from "node:fs";
 import { tmpdir } from "node:os";
-import { dirname as dirname10, join as join24, resolve as resolve3 } from "node:path";
+import { dirname as dirname10, join as join25, resolve as resolve3 } from "node:path";
 var FETCH_TIMEOUT_MS = 15e3;
 var LOGIN_KEYCHAIN = "Library/Keychains/login.keychain-db";
 var SECURITY_BIN = "/usr/bin/security";
@@ -39047,7 +39308,7 @@ function verifyRootCert(data, root, now = /* @__PURE__ */ new Date()) {
 }
 function readFetchedRoot(paths, root = RUSSIAN_TRUSTED_ROOT_CA) {
   const file2 = rootCaFile(paths, root);
-  return existsSync10(file2) ? verifyRootCert(readFileSync12(file2), root) : void 0;
+  return existsSync10(file2) ? verifyRootCert(readFileSync13(file2), root) : void 0;
 }
 function ensureCaDir(dir2) {
   mkdirSync12(dir2, { recursive: true, mode: 448 });
@@ -39060,7 +39321,7 @@ function ensureCaDir(dir2) {
   }
 }
 function writeAtomically(path2, data, mode) {
-  const tmp = join24(dirname10(path2), `.${randomBytes3(6).toString("hex")}.tmp`);
+  const tmp = join25(dirname10(path2), `.${randomBytes3(6).toString("hex")}.tmp`);
   const fd2 = openSync8(tmp, "wx", mode);
   try {
     fchmodSync(fd2, mode);
@@ -39071,7 +39332,7 @@ function writeAtomically(path2, data, mode) {
   try {
     renameSync5(tmp, path2);
   } catch (error62) {
-    rmSync7(tmp, { force: true });
+    rmSync8(tmp, { force: true });
     throw error62;
   }
 }
@@ -39104,7 +39365,7 @@ function installPlan(opts) {
   if (platform2 === "darwin") {
     return {
       kind: "run",
-      argv: [SECURITY_BIN, "add-trusted-cert", "-r", "trustRoot", "-p", "ssl", "-k", join24(opts.home, LOGIN_KEYCHAIN), file2],
+      argv: [SECURITY_BIN, "add-trusted-cert", "-r", "trustRoot", "-p", "ssl", "-k", join25(opts.home, LOGIN_KEYCHAIN), file2],
       say: "macOS \u0441\u043F\u0440\u043E\u0441\u0438\u0442 \u043F\u0430\u0440\u043E\u043B\u044C \u043F\u043E\u043B\u044C\u0437\u043E\u0432\u0430\u0442\u0435\u043B\u044F \u2014 \u044D\u0442\u043E \u043F\u043E\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043D\u0438\u0435. \u0414\u043E\u0432\u0435\u0440\u0438\u0435 \u2014 \u0442\u043E\u043B\u044C\u043A\u043E \u0434\u043B\u044F TLS (-p ssl), \u0432 \u0441\u0432\u044F\u0437\u043A\u0435 \xAB\u0432\u0445\u043E\u0434\xBB"
     };
   }
@@ -39145,33 +39406,33 @@ function installRootCa(deps) {
   const planFor = (file2) => installPlan({ platform: deps.platform, file: file2, home: deps.home, exists: deps.exists, cert });
   const manual = planFor(rootCaFile(deps.paths, root));
   if (manual.kind === "manual") return { installed: false, needsHuman: true, ...manual.command ? { command: manual.command } : {}, say: manual.say };
-  const dir2 = mkdtempSync(join24(tmpdir(), "sberpay-ca-"));
+  const dir2 = mkdtempSync(join25(tmpdir(), "sberpay-ca-"));
   try {
-    const copy = join24(dir2, root.fileName);
+    const copy = join25(dir2, root.fileName);
     writeFileSync5(copy, cert.toString(), { flag: "wx", mode: 384 });
     const plan = planFor(copy);
     const result = plan.kind === "run" ? deps.run(plan.argv) : { status: 1, stderr: "\u043D\u0435\u0442 \u043A\u043E\u043C\u0430\u043D\u0434\u044B \u0443\u0441\u0442\u0430\u043D\u043E\u0432\u043A\u0438" };
     if (result.status !== 0) throw securityError(result.stderr);
   } finally {
-    rmSync7(dir2, { recursive: true, force: true });
+    rmSync8(dir2, { recursive: true, force: true });
   }
   return { installed: true, already: false, say: `${root.name} \u0434\u043E\u0431\u0430\u0432\u043B\u0435\u043D \u0432 \u0434\u043E\u0432\u0435\u0440\u0435\u043D\u043D\u044B\u0435 \u043A\u043E\u0440\u043D\u0438. ${CHECK_AFTER}` };
 }
 
 // packages/cli/src/setup/skill.ts
 import { createHash as createHash16 } from "node:crypto";
-import { cpSync, existsSync as existsSync11, lstatSync as lstatSync7, mkdirSync as mkdirSync13, readdirSync as readdirSync3, readFileSync as readFileSync13, readlinkSync, realpathSync as realpathSync3, renameSync as renameSync6, rmSync as rmSync8, statSync as statSync2, symlinkSync, writeFileSync as writeFileSync6 } from "node:fs";
+import { cpSync, existsSync as existsSync11, lstatSync as lstatSync7, mkdirSync as mkdirSync13, readdirSync as readdirSync3, readFileSync as readFileSync14, readlinkSync, realpathSync as realpathSync3, renameSync as renameSync6, rmSync as rmSync9, statSync as statSync2, symlinkSync, writeFileSync as writeFileSync6 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
-import { basename, dirname as dirname11, join as join25, relative as relative3, resolve as resolve4 } from "node:path";
+import { basename, dirname as dirname11, join as join26, relative as relative3, resolve as resolve4 } from "node:path";
 var SKILL_NAME = "sberpay";
 var MANIFEST = ".sberpay-cli.json";
 var WORK_DIR = ".sberpay-cli";
 function skillSourceDir(build = BUILD) {
-  return join25(build.root, "skill", SKILL_NAME);
+  return join26(build.root, "skill", SKILL_NAME);
 }
 function claudeSkillDir(opts = {}) {
   const { env = process.env, home = homedir6(), cwd = process.cwd() } = opts;
-  const base2 = opts.project ? join25(cwd, ".claude") : env.CLAUDE_CONFIG_DIR || join25(home, ".claude");
+  const base2 = opts.project ? join26(cwd, ".claude") : env.CLAUDE_CONFIG_DIR || join26(home, ".claude");
   return resolve4(base2, "skills", SKILL_NAME);
 }
 function checkSkillDir(target) {
@@ -39180,13 +39441,13 @@ function checkSkillDir(target) {
 }
 function listFiles(dir2, root = dir2) {
   return readdirSync3(dir2, { withFileTypes: true }).flatMap((entry) => {
-    const path2 = join25(dir2, entry.name);
+    const path2 = join26(dir2, entry.name);
     if (entry.isDirectory()) return listFiles(path2, root);
     return entry.name === MANIFEST ? [] : [relative3(root, path2)];
   });
 }
 function hashFiles(dir2) {
-  return Object.fromEntries(listFiles(dir2).sort().map((file2) => [file2, createHash16("sha256").update(readFileSync13(join25(dir2, file2))).digest("hex")]));
+  return Object.fromEntries(listFiles(dir2).sort().map((file2) => [file2, createHash16("sha256").update(readFileSync14(join26(dir2, file2))).digest("hex")]));
 }
 var sameFiles = (a, b) => JSON.stringify(a) === JSON.stringify(b);
 function sameDir(a, b) {
@@ -39201,16 +39462,16 @@ function isLink(path2) {
   }
 }
 function readManifest(target) {
-  const file2 = join25(target, MANIFEST);
+  const file2 = join26(target, MANIFEST);
   if (!existsSync11(file2)) return void 0;
   try {
-    const data = JSON.parse(readFileSync13(file2, "utf8"));
+    const data = JSON.parse(readFileSync14(file2, "utf8"));
     return typeof data.version === "string" && data.files && typeof data.files === "object" ? data : void 0;
   } catch {
     return void 0;
   }
 }
-var isStaleOwnLink = (target) => !existsSync11(target) && readlinkSync(target).replace(/[\\/]+$/, "").endsWith(join25("skill", SKILL_NAME));
+var isStaleOwnLink = (target) => !existsSync11(target) && readlinkSync(target).replace(/[\\/]+$/, "").endsWith(join26("skill", SKILL_NAME));
 function inspectSkill(source, target) {
   if (isLink(target)) {
     if (existsSync11(target)) return sameDir(target, source) ? { state: "current", mode: "link" } : { state: "foreign" };
@@ -39223,20 +39484,20 @@ function inspectSkill(source, target) {
   return { state: sameFiles(manifest.files, hashFiles(source)) ? "current" : "outdated", mode: "copy" };
 }
 function prepare(source, work, mode, version2) {
-  const fresh = join25(work, `new-${process.pid}`);
-  rmSync8(fresh, { recursive: true, force: true });
+  const fresh = join26(work, `new-${process.pid}`);
+  rmSync9(fresh, { recursive: true, force: true });
   if (mode === "link") {
     symlinkSync(realpathSync3(source), fresh, process.platform === "win32" ? "junction" : "dir");
     return fresh;
   }
   cpSync(source, fresh, { recursive: true, dereference: true });
   const manifest = { version: version2, files: hashFiles(fresh) };
-  writeFileSync6(join25(fresh, MANIFEST), `${JSON.stringify(manifest, null, 2)}
+  writeFileSync6(join26(fresh, MANIFEST), `${JSON.stringify(manifest, null, 2)}
 `);
   return fresh;
 }
 function swap(fresh, target, aside, work) {
-  const previous = existsSync11(target) || isLink(target) ? aside ?? join25(work, `old-${process.pid}`) : void 0;
+  const previous = existsSync11(target) || isLink(target) ? aside ?? join26(work, `old-${process.pid}`) : void 0;
   if (previous) renameSync6(target, previous);
   try {
     renameSync6(fresh, target);
@@ -39244,7 +39505,7 @@ function swap(fresh, target, aside, work) {
     if (previous) renameSync6(previous, target);
     throw error62;
   }
-  if (previous && !aside) rmSync8(previous, { recursive: true, force: true });
+  if (previous && !aside) rmSync9(previous, { recursive: true, force: true });
 }
 function installSkill(source, target, opts) {
   const found = inspectSkill(source, target);
@@ -39256,14 +39517,14 @@ function installSkill(source, target, opts) {
       hint: "\u041F\u0435\u0440\u0435\u0443\u0441\u0442\u0430\u043D\u043E\u0432\u0438\u0442\u044C: sberpay-cli setup --force-skill \u2014 \u043F\u0440\u0435\u0436\u043D\u0438\u0439 \u043A\u0430\u0442\u0430\u043B\u043E\u0433 \u0443\u0439\u0434\u0451\u0442 \u0432 \u0431\u044D\u043A\u0430\u043F"
     });
   }
-  const work = join25(dirname11(target), WORK_DIR);
+  const work = join26(dirname11(target), WORK_DIR);
   mkdirSync13(work, { recursive: true });
-  const backup = ours ? void 0 : join25(work, `backup-${basename(target)}-${(opts.now ?? /* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`);
+  const backup = ours ? void 0 : join26(work, `backup-${basename(target)}-${(opts.now ?? /* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`);
   const fresh = prepare(source, work, opts.mode, opts.version);
   try {
     swap(fresh, target, backup, work);
   } finally {
-    rmSync8(fresh, { recursive: true, force: true });
+    rmSync9(fresh, { recursive: true, force: true });
   }
   return { state: "current", mode: opts.mode, changed: true, ...backup ? { backup } : {} };
 }
@@ -39791,10 +40052,237 @@ async function setupCommand(globals, opts) {
   }
 }
 
+// packages/cli/src/setup/environment.ts
+import { accessSync, constants as constants8, existsSync as existsSync13, readFileSync as readFileSync15 } from "node:fs";
+import { homedir as homedir8, release as release2 } from "node:os";
+var AGENT_TOKEN = "agentToken";
+var GATEWAY_CHECK_TIMEOUT_MS2 = 8e3;
+var OS_NAME = {
+  darwin: "macOS",
+  win32: "Windows",
+  linux: "Linux",
+  aix: void 0,
+  android: void 0,
+  freebsd: void 0,
+  haiku: void 0,
+  openbsd: void 0,
+  sunos: void 0,
+  cygwin: void 0,
+  netbsd: void 0
+};
+function hasToken2(core) {
+  try {
+    if (osSecretStore(core.standName, core.stand).get(AGENT_TOKEN) !== void 0) return true;
+  } catch {
+  }
+  try {
+    return fileSecretStore(core.paths, core.standName).get(AGENT_TOKEN) !== void 0;
+  } catch {
+    return false;
+  }
+}
+async function probeHelper(platform2) {
+  const status = await keyHelperStatus(platform2);
+  let missing = [];
+  if (status.kind) {
+    try {
+      const backend = keyHelperBackend(platform2);
+      if (backend) {
+        const path2 = findKeyHelper({ installed: backend.path });
+        if (path2) missing = missingLibraries(path2, platform2);
+      }
+    } catch {
+      missing = [];
+    }
+  }
+  return { ...status, missingLibraries: missing };
+}
+async function probeStorage(core) {
+  const softwareAllowed = core.stand.allowSoftwareKeys;
+  const helper = await probeHelper(process.platform);
+  let osAvailable = false;
+  try {
+    osSecretStore(core.standName, core.stand).get(AGENT_TOKEN);
+    osAvailable = true;
+  } catch {
+  }
+  let fileWritable = false;
+  try {
+    accessSync(core.paths.configDir, constants8.W_OK);
+    fileWritable = true;
+  } catch {
+  }
+  const candidate = softwareAllowed ? ["hardware", "os", "file"] : ["hardware"];
+  const avail = {
+    hardware: helper.available,
+    os: osAvailable,
+    file: fileWritable
+  };
+  return {
+    hardware: { kind: helper.kind ?? null, available: helper.available },
+    os: { available: osAvailable },
+    file: { writable: fileWritable },
+    recommended: candidate.find((s) => avail[s]) ?? null,
+    helper,
+    softwareAllowed
+  };
+}
+function nodeFits(node2) {
+  const [major = 0, minor = 0] = node2.split(".").map(Number);
+  return major > LAST_LISTED_MAJOR || MIN_NODE_MINOR[major] !== void 0 && minor >= MIN_NODE_MINOR[major];
+}
+function osMeets(platform2, releaseVersion) {
+  const major = Number(releaseVersion.split(".")[0]);
+  if (!Number.isFinite(major)) return null;
+  if (platform2 === "darwin") return major >= 22;
+  if (platform2 === "win32") return major >= 10;
+  return true;
+}
+function targetOf(platform2, arch2) {
+  if (platform2 === "darwin") return arch2 === "arm64" ? "macOS-ARM64" : "macOS-Intel";
+  if (platform2 === "win32") return "Windows";
+  if (platform2 === "linux") return "Linux";
+  return "other";
+}
+function probeRootCa(core) {
+  const url2 = new URL(core.stand.gatewayUrl);
+  if (url2.protocol !== "https:") return "not-required";
+  const root = PINNED_ROOTS.find((r) => coversHost(r, url2.hostname));
+  if (!root) return "not-required";
+  const found = findRoot(root);
+  if (!found) return "missing";
+  return found.expired ? "expired" : "present";
+}
+function probePersistence() {
+  const home = homedir8();
+  if (/(^|\/)(tmp|var\/tmp|run)(\/|$)/.test(home)) return "likely-ephemeral";
+  try {
+    if (existsSync13("/.dockerenv") || existsSync13("/run/.containerenv")) return "likely-ephemeral";
+  } catch {
+  }
+  return "assumed-persistent";
+}
+async function probeGateway(core, offline) {
+  if (offline) return { gateway: "unknown" };
+  try {
+    await getEncryptionKey(core, true, { timeoutMs: GATEWAY_CHECK_TIMEOUT_MS2 });
+    return { gateway: "ok" };
+  } catch (error62) {
+    return { gateway: "fail", gatewayError: error62 instanceof CliError ? error62.code : "UNKNOWN" };
+  }
+}
+async function collectEnvironment(core, offline = false) {
+  const platform2 = process.platform;
+  const arch2 = process.arch;
+  const node2 = process.versions.node;
+  const wsl = platform2 === "linux" ? (() => {
+    try {
+      return /microsoft/i.test(readFileSync15("/proc/version", "utf8"));
+    } catch {
+      return null;
+    }
+  })() : null;
+  const environment = {
+    platform: platform2,
+    arch: arch2,
+    osName: OS_NAME[platform2],
+    osVersion: release2(),
+    osMeets: osMeets(platform2, release2()),
+    node: node2,
+    nodeFits: nodeFits(node2),
+    wsl,
+    configDir: core.paths.configDir,
+    configWritable: (() => {
+      try {
+        accessSync(core.paths.configDir, constants8.W_OK);
+        return true;
+      } catch {
+        return false;
+      }
+    })(),
+    persistence: probePersistence()
+  };
+  const storage = await probeStorage(core);
+  const deviceKeys = deviceKeysExist(core);
+  const existing = {
+    deviceKeys,
+    binding: deviceKeys && hasToken2(core),
+    ...core.config.deviceKeys?.[core.standName] ? { keyStorage: core.config.deviceKeys[core.standName] } : {}
+  };
+  const rootCa = probeRootCa(core);
+  const network = await probeGateway(core, offline);
+  const target = targetOf(platform2, arch2);
+  const implementation = platform2 === "darwin" || platform2 === "win32" || platform2 === "linux" ? "done" : "none";
+  const e2e = platform2 === "darwin" && arch2 === "arm64" ? "confirmed" : "pending";
+  const reasons = [];
+  let next;
+  let fit = "ok";
+  if (!environment.nodeFits) {
+    fit = "fail";
+    reasons.push(`Node ${node2} \u043D\u0435 \u043F\u043E\u0434\u0445\u043E\u0434\u0438\u0442 (\u043D\u0443\u0436\u043D\u043E 22.19+ \u0438\u043B\u0438 24.5+)`);
+    next = "\u041E\u0431\u043D\u043E\u0432\u0438\u0442\u0435 Node \u0434\u043E 22.19+ \u0438\u043B\u0438 24.5+ \u0438 \u043F\u043E\u0432\u0442\u043E\u0440\u0438\u0442\u0435 sberpay-cli setup doctor";
+  }
+  if (platform2 === "darwin" && environment.osMeets === false) {
+    fit = "fail";
+    reasons.push("macOS \u043D\u0438\u0436\u0435 13.0");
+    next = "\u041E\u0431\u043D\u043E\u0432\u0438\u0442\u0435 macOS \u0434\u043E 13.0+ \u0438\u043B\u0438 \u0438\u0441\u043F\u043E\u043B\u044C\u0437\u0443\u0439\u0442\u0435 Mac \u043D\u0430 \u0431\u043E\u043B\u0435\u0435 \u043D\u043E\u0432\u043E\u0439 \u0432\u0435\u0440\u0441\u0438\u0438";
+  }
+  if (implementation === "none") {
+    fit = "fail";
+    reasons.push("\u043F\u043B\u0430\u0442\u0444\u043E\u0440\u043C\u0430 \u043D\u0435 \u043F\u043E\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044F");
+  } else if (!storage.softwareAllowed && !storage.hardware.available) {
+    if (!storage.helper.found) {
+      fit = "unknown";
+      reasons.push("\u0445\u0435\u043B\u043F\u0435\u0440 \u043A\u043B\u044E\u0447\u0435\u0439 \u043D\u0435 \u043F\u0440\u043E\u0432\u0435\u0440\u0435\u043D, \u0447\u0438\u043F \u043D\u0435 \u043F\u043E\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0451\u043D");
+      next = "\u0421\u043E\u0431\u0435\u0440\u0438\u0442\u0435/\u043F\u0435\u0440\u0435\u0443\u0441\u0442\u0430\u043D\u043E\u0432\u0438\u0442\u0435 \u0445\u0435\u043B\u043F\u0435\u0440 \u0438 \u043F\u043E\u0432\u0442\u043E\u0440\u0438\u0442\u0435; \u0438\u043D\u0430\u0447\u0435 \u043D\u0443\u0436\u043D\u0430 \u043C\u0430\u0448\u0438\u043D\u0430 \u0441 Secure Enclave/TPM";
+    } else {
+      fit = "fail";
+      reasons.push("\u0447\u0438\u043F \u043D\u0435\u0434\u043E\u0441\u0442\u0443\u043F\u0435\u043D, \u0430 \u043F\u0440\u043E\u0433\u0440\u0430\u043C\u043C\u043D\u044B\u0435 \u043A\u043B\u044E\u0447\u0438 \u043D\u0430 \u0441\u0442\u0435\u043D\u0434\u0435 \u0437\u0430\u043F\u0440\u0435\u0449\u0435\u043D\u044B");
+      next = "\u0418\u0441\u043F\u043E\u043B\u044C\u0437\u0443\u0439\u0442\u0435 \u043C\u0430\u0448\u0438\u043D\u0443 \u0441 Secure Enclave/TPM \u0438\u043B\u0438 \u0440\u0430\u0437\u0440\u0435\u0448\u0438\u0442\u0435 \u043F\u0440\u043E\u0433\u0440\u0430\u043C\u043C\u043D\u044B\u0435 \u043A\u043B\u044E\u0447\u0438 (allowSoftwareKeys: true)";
+    }
+  }
+  const suitable = fit === "fail" ? false : fit === "unknown" ? "unknown" : true;
+  return {
+    schemaVersion: 1,
+    environment,
+    storage,
+    existing,
+    rootCa,
+    network,
+    verdict: {
+      target,
+      implementation,
+      e2e,
+      fit,
+      suitable,
+      ...reasons.length ? { reason: reasons.join("; ") } : {},
+      ...next ? { next } : {}
+    }
+  };
+}
+async function doctorCommand(globals, opts) {
+  const core = buildCoreContext(globals);
+  const result = await collectEnvironment(core, Boolean(opts.offline));
+  const v = result.verdict;
+  const label = result.environment.wsl ? `${v.target} (WSL)` : v.target;
+  const human = v.suitable === true ? [
+    `\u0421\u0440\u0435\u0434\u0430: ${label} \xB7 Node ${result.environment.node} \xB7 \u0445\u0440\u0430\u043D\u0438\u043B\u0438\u0449\u0435: ${result.storage.recommended ?? "\u2014"}`,
+    `\u041A\u043E\u0440\u0435\u043D\u044C \u041C\u0438\u043D\u0446\u0438\u0444\u0440\u044B: ${result.rootCa === "not-required" ? "\u043D\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044F" : result.rootCa} \xB7 \u0428\u043B\u044E\u0437 \u042D\u041A: ${result.network.gateway}`,
+    ...result.existing.binding ? ["\u041F\u0440\u0438\u0432\u044F\u0437\u043A\u0430 \u0443\u0436\u0435 \u0435\u0441\u0442\u044C \u2014 \u043D\u043E\u0432\u0430\u044F \u043D\u0435 \u043D\u0430\u0447\u043D\u0451\u0442\u0441\u044F \u043F\u043E\u0432\u0435\u0440\u0445 \u043D\u0435\u0451"] : [],
+    "\u041F\u0440\u0438\u0433\u043E\u0434\u043D\u043E\u0441\u0442\u044C \u043F\u043E\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043D\u0430 \u2014 \u043C\u043E\u0436\u043D\u043E \u043F\u0440\u043E\u0434\u043E\u043B\u0436\u0430\u0442\u044C \u0443\u0441\u0442\u0430\u043D\u043E\u0432\u043A\u0443 (sberpay-cli setup --skill-dir \u2026)"
+  ].join("\n") : [
+    `\u0421\u0440\u0435\u0434\u0430 \u043D\u0435 \u0433\u043E\u0442\u043E\u0432\u0430: ${v.reason ?? "\u043D\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043D\u043E"}`,
+    ...v.next ? [`\u2192 ${v.next}`] : [],
+    "(\u043F\u043E\u043B\u043D\u044B\u0439 \u043E\u0442\u0447\u0451\u0442: sberpay-cli setup doctor --json)"
+  ].join("\n");
+  core.out.result(result, human);
+  if (v.suitable === false) process.exitCode = EXIT.API;
+}
+
 // packages/cli/src/ca/command.ts
 import { spawnSync as spawnSync5 } from "node:child_process";
-import { existsSync as existsSync13 } from "node:fs";
-import { homedir as homedir8 } from "node:os";
+import { existsSync as existsSync14 } from "node:fs";
+import { homedir as homedir9 } from "node:os";
 var INSTALL_TIMEOUT_MS = 12e4;
 var WHERE = { system: "\u0432 \u0434\u043E\u0432\u0435\u0440\u0435\u043D\u043D\u044B\u0445 \u043A\u043E\u0440\u043D\u044F\u0445 \u0441\u0438\u0441\u0442\u0435\u043C\u044B", extra: "\u0438\u0437 NODE_EXTRA_CA_CERTS (\u0441\u0438\u0441\u0442\u0435\u043C\u0430 \u0435\u0433\u043E \u043D\u0435 \u0437\u043D\u0430\u0435\u0442)" };
 function runSecurity(argv) {
@@ -39834,7 +40322,7 @@ async function caFetchCommand(globals) {
 function caInstallCommand(globals) {
   const out = createOutput(Boolean(globals.json));
   out.progress("\u0414\u043E\u0431\u0430\u0432\u043B\u044F\u044E \u043A\u043E\u0440\u0435\u043D\u044C \u0432 \u0434\u043E\u0432\u0435\u0440\u0435\u043D\u043D\u044B\u0435 \u043A\u043E\u0440\u043D\u0438 \u0441\u0438\u0441\u0442\u0435\u043C\u044B \u2014 \u0441\u0438\u0441\u0442\u0435\u043C\u0430 \u043C\u043E\u0436\u0435\u0442 \u0441\u043F\u0440\u043E\u0441\u0438\u0442\u044C \u043F\u0430\u0440\u043E\u043B\u044C\u2026");
-  const result = installRootCa({ paths: cliPaths(), platform: process.platform, home: homedir8(), exists: existsSync13, run: runSecurity });
+  const result = installRootCa({ paths: cliPaths(), platform: process.platform, home: homedir9(), exists: existsSync14, run: runSecurity });
   const human = result.installed ? `\u2713 ${result.say}` : [`\u041A\u043E\u043C\u0430\u043D\u0434\u0443 \u0432\u044B\u043F\u043E\u043B\u043D\u044F\u0435\u0442 \u0447\u0435\u043B\u043E\u0432\u0435\u043A: ${result.command ?? "\u2014"}`, `  ${result.say}`].join("\n");
   out.result(result, human);
 }
@@ -39896,6 +40384,14 @@ setup.option("--no-skill", "\u043D\u0435 \u0441\u0442\u0430\u0432\u0438\u0442\u0
     fail(globals, error62);
   }
 });
+setup.command("doctor").description("\u043F\u0440\u043E\u0432\u0435\u0440\u043A\u0430 \u0433\u043E\u0442\u043E\u0432\u043D\u043E\u0441\u0442\u0438 \u0441\u0440\u0435\u0434\u044B \u043F\u0435\u0440\u0435\u0434 \u0443\u0441\u0442\u0430\u043D\u043E\u0432\u043A\u043E\u0439: \u0442\u043E\u043B\u044C\u043A\u043E \u0447\u0442\u0435\u043D\u0438\u0435, \u043D\u0438\u0447\u0435\u0433\u043E \u043D\u0435 \u043C\u0435\u043D\u044F\u0435\u0442").option("--offline", "\u043D\u0435 \u0445\u043E\u0434\u0438\u0442\u044C \u0432 \u0441\u0435\u0442\u044C, \u0448\u043B\u044E\u0437 \u043D\u0435 \u043F\u0440\u043E\u0432\u0435\u0440\u044F\u0442\u044C").action(async (opts) => {
+  const globals = program2.opts();
+  try {
+    await doctorCommand(globals, { offline: Boolean(opts.offline) });
+  } catch (error62) {
+    fail(globals, error62);
+  }
+});
 function standalone(fn) {
   return async () => {
     const globals = program2.opts();
@@ -39970,6 +40466,13 @@ address.command("get").description("\u043F\u043E\u043B\u0443\u0447\u0438\u0442\u
 address.command("set").description("\u0434\u043E\u0431\u0430\u0432\u0438\u0442\u044C, \u0438\u0437\u043C\u0435\u043D\u0438\u0442\u044C \u0438\u043B\u0438 \u0434\u0435\u0430\u043A\u0442\u0438\u0432\u0438\u0440\u043E\u0432\u0430\u0442\u044C \u0430\u0434\u0440\u0435\u0441").requiredOption("--json-file <path>", "JSON-\u0444\u0430\u0439\u043B \u0430\u0434\u0440\u0435\u0441\u0430; - \u0434\u043B\u044F stdin").action(action((s, opts) => s.addressSet(opts)));
 var merchants = program2.command("merchants").description("\u043C\u0430\u0433\u0430\u0437\u0438\u043D\u044B, \u0433\u0434\u0435 \u0430\u0433\u0435\u043D\u0442 \u043C\u043E\u0436\u0435\u0442 \u043F\u043B\u0430\u0442\u0438\u0442\u044C SberPay");
 merchants.command("check <domain>").description("\u043F\u0440\u0438\u043D\u0438\u043C\u0430\u0435\u0442 \u043B\u0438 \u0441\u0430\u0439\u0442 \u043E\u043F\u043B\u0430\u0442\u0443 \u0430\u0433\u0435\u043D\u0442\u043E\u043C; \u0434\u043E\u043C\u0435\u043D \u0438\u043B\u0438 URL").action(action((s, domain2) => s.merchantsCheck(domain2)));
+merchants.command("domains").description(
+  "\u0433\u0434\u0435 \u0440\u0430\u0431\u043E\u0442\u0430\u0435\u0442 \u043E\u043F\u043B\u0430\u0442\u0430 \u0430\u0433\u0435\u043D\u0442\u043E\u043C: \u043B\u043E\u043A\u0430\u043B\u044C\u043D\u044B\u0439 \u0444\u0430\u0439\u043B \u0434\u043E\u043C\u0435\u043D\u043E\u0432 \u0440\u0435\u0435\u0441\u0442\u0440\u0430, \u043E\u0431\u043D\u043E\u0432\u043B\u044F\u0435\u0442\u0441\u044F \u0440\u0430\u0437 \u0432 \u0441\u0443\u0442\u043A\u0438 \u043F\u0440\u0438 \u043E\u0431\u0440\u0430\u0449\u0435\u043D\u0438\u0438; \u043F\u0435\u0440\u0435\u0434 \u043E\u043F\u043B\u0430\u0442\u043E\u0439 \u2014 \u0432\u0441\u0451 \u0440\u0430\u0432\u043D\u043E check"
+).option("--match <domain...>", "\u043A\u0430\u043A\u0438\u0435 \u0438\u0437 \u044D\u0442\u0438\u0445 \u0434\u043E\u043C\u0435\u043D\u043E\u0432 \u0438\u043B\u0438 URL \u043F\u0440\u0438\u043D\u0438\u043C\u0430\u044E\u0442 \u043E\u043F\u043B\u0430\u0442\u0443 \u0430\u0433\u0435\u043D\u0442\u043E\u043C").option("--search <text>", "\u0434\u043E\u043C\u0435\u043D\u044B, \u0441\u043E\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0435 \u0442\u0435\u043A\u0441\u0442 (\u043B\u0430\u0442\u0438\u043D\u0438\u0446\u0430 \u0438\u043B\u0438 \u043A\u0438\u0440\u0438\u043B\u043B\u0438\u0446\u0430)").option("--limit <n>", "\u0441\u043A\u043E\u043B\u044C\u043A\u043E \u0440\u0435\u0437\u0443\u043B\u044C\u0442\u0430\u0442\u043E\u0432 --search \u043F\u043E\u043A\u0430\u0437\u0430\u0442\u044C (\u043F\u043E \u0443\u043C\u043E\u043B\u0447\u0430\u043D\u0438\u044E 50)").option("--refresh", "\u0441\u043A\u0430\u0447\u0430\u0442\u044C \u0441\u043F\u0438\u0441\u043E\u043A \u0437\u0430\u043D\u043E\u0432\u043E, \u043D\u0435 \u0434\u043E\u0436\u0438\u0434\u0430\u044F\u0441\u044C \u0441\u0443\u0442\u043E\u043A").option("--offline", "\u0442\u043E\u043B\u044C\u043A\u043E \u043B\u043E\u043A\u0430\u043B\u044C\u043D\u044B\u0439 \u0444\u0430\u0439\u043B, \u0431\u0435\u0437 \u0441\u0435\u0442\u0438").action(
+  action(
+    (s, opts) => s.merchantsDomains(opts)
+  )
+);
 if (BUILD.profile === "diagnostic") registerReportCommands(program2);
 if (BUILD.profile === "diagnostic") registerPaymentModeCommands(program2);
 program2.hook("preAction", async (_root, command) => {