@supercuts-walrus/backend 0.1.1 → 0.1.2

package/README.md

@@ -77,7 +77,7 @@ bytes under that operation ID; retrying another payload with the same ID fails.
 
 ## Procurement demo
 
-For the Codex buyer with three remote Claude-backed sellers, Supabase-backed seller state, and the separate Render facilitator, follow [the remote demo guide](../docs/remote-codex-demo.md). The remote path is live-only and gives Codex a buyer role MCP server; the three seller panes use the safe `supercuts-seller-watch` event stream.
+For the Codex buyer with three remote sellers, Claude-researched and owner-reviewed artifacts, Supabase-backed seller state, and the separate Render facilitator, follow [the remote demo guide](../docs/remote-codex-demo.md). The remote path is live-only and gives Codex a buyer role MCP server; the three seller panes use the safe `supercuts-seller-watch` event stream.
 
 `supercuts-demo` is the operator entry point:
 
@@ -116,9 +116,11 @@ For a Claude-agent recording, export `CLAUDE_API_KEY` or provide
 `live --claude-key-file <owner-only-file>`; a repository `.env` file is not
 loaded automatically. Validate the credential against Anthropic before starting
 a funded take.
-The live path calls Claude for bounded buyer and seller decisions and records
-only the model, action, and token counts. The backend still enforces capability,
-amount, rail, and agreement bindings. Validate that recording with
+The recorded workflow can call Claude for bounded buyer decisions and records
+only the model, action, and token counts. Hosted seller price and agreement
+decisions are deterministic after backend validation; Claude web research runs
+before provisioning so model availability cannot interrupt a paid request. The
+backend still enforces capability, amount, rail, and agreement bindings. Validate that recording with
 `supercuts-demo check --require-claude`; an earlier funded run without these
 agent-decision events does not satisfy that gate.
 
@@ -185,7 +187,28 @@ signer, pool notes, Walrus and Walrus Memory configuration. A missing file
 returns `DEAL_SELLERS_NOT_CONFIGURED`. An owner-only `deal-ports.mjs` exporting
 `createDealPorts(app, mandate)` remains available as an advanced override.
 
-The seller service is `supercuts-seller-live <seller-home> <config.json>`.
+Create a seller home with `supercuts onboard seller --home <seller-home>` or
+its noninteractive `--config <owner-only-setup.json>` form. It generates a
+fresh seller signer by default, writes a seller MCP stanza, and explicitly
+reports that the seller should not receive faucet funds. The seller service is
+`supercuts-seller-live <seller-home> <config.json>`.
+Use `supercuts seller scaffold` to generate the offer spec, replaceable handler,
+future expiry, environment-based facilitator config, and exact next commands.
+The npm tarball includes pinned metadata for x402-only sellers; shielded sellers
+still install the proof artifacts required for recovery and exits.
+
+Research sellers can create a source-backed draft before packaging:
+
+```sh
+CLAUDE_API_KEY=... supercuts seller research --kind market-brief \
+  --topic "Current Sui ecosystem market structure and risks" \
+  --output <owner-only-draft.json>
+```
+
+The command uses Anthropic web search, rejects citations absent from the search
+evidence, and writes a mode-0600 draft marked `draft-needs-owner-review`.
+Optional `--allowed-domains` constrains sources. It never publishes or changes
+live seller state; an owner must review and approve the immutable bytes first.
 Register each capability first with
 `supercuts-seller-register <seller-home> <spec.json> <registration.json>`.
 The spec contains `capabilityId`, `capability`, `description`, `inputSchema`,

package/config/phase1.testnet.json

@@ -0,0 +1,20 @@
+{
+  "network": "testnet",
+  "sender": "0x66fdfe84ff521627c93910c93ec0bc26934ee1fef3a1a0a5ce14b7dc4567ec00",
+  "coinType": "0x2::sui::SUI",
+  "coinTypeHash": "be4507e04f555448ca05c0c9f8345c5ea9f3e40e8616a20f5d5c18b40ef399eb",
+  "packageId": "0x32d104c1ab422d497df4ae3a6861258694949c86428f886ca338e07bd055cf76",
+  "poolId": "0x8fd22140c906495bb5334a497dcdd9112479c638e21c5df4b4cfb66f633a106b",
+  "poolCreateTransaction": "BnzMqokgQVWwSkRYCCrMTyWwHN6HVdDKWwVDJXTZqC6b",
+  "deploymentCheckpoint": "401762744",
+  "deploymentDomain": "3082f331660eb38075e250a810a701bc4b0de2ca329eda70b2d76e3795517305",
+  "initialRoot": "2134e76ac5d21aab186c2be1dd8f84ee880a1e46eaf712f9d371b6df22191f3e",
+  "verifierVersion": 2,
+  "testOnly": true,
+  "artifactManifest": "config/proving-manifest.json",
+  "artifacts": {
+    "deposit": { "r1csSha256": "f36a1a18bf9d243e089e6ab14436e5a921d2b839d81bea95db319a4cdb80a197", "zkeySha256": "d398776a54628c390e8bf822007e47ed8fac00e92e8ea95bb17d20db517998dc", "verifyingKeySha256": "838404ff0ae3a9fc82da0856b68a11428cf3ffef335b4c6539fa1860d8e1ba26" },
+    "transfer": { "r1csSha256": "055ea2ec8f689c48e59f89fe06db6fb980dc575982214bfe60f675e8f08485c3", "zkeySha256": "6e7bcac98b8d2a78fd1811e2caadd83d0d6a301951f8cf27ac55a67006b001c2", "verifyingKeySha256": "8a6896f3f330769aa69e0dc1251a19fb69c4d6264b5729d0104df8d262e573ba" },
+    "withdraw": { "r1csSha256": "85cf1542ab2f2ece4bbd8757def48d526ba0951a832a2e0ebbf97ace2c611308", "zkeySha256": "fd303dd0dd53b9b752dac0de546dabdd03198a7a4defde5e8d6018bccd419c56", "verifyingKeySha256": "445c1982bea5e465fb0f5665023bb279637d820a9425f16a4c2f2ee7460e7e4a" }
+  }
+}

package/config/proving-manifest.json

@@ -0,0 +1,11 @@
+{
+  "version": "supercuts-pool-v2",
+  "testOnly": true,
+  "warning": "Per-circuit contributions are locally generated and unaudited; never use these keys with production assets.",
+  "powersOfTauSha256": "3f428d1a407e4704ef906960e000b03089e5e6ec29bf65b07bb5e3de005f4700",
+  "circuits": {
+    "deposit": { "r1csSha256": "f36a1a18bf9d243e089e6ab14436e5a921d2b839d81bea95db319a4cdb80a197", "zkeySha256": "d398776a54628c390e8bf822007e47ed8fac00e92e8ea95bb17d20db517998dc", "verificationKeySha256": "838404ff0ae3a9fc82da0856b68a11428cf3ffef335b4c6539fa1860d8e1ba26", "proofSha256": "9b7835852cd9ced7c02828e5c563191ac597f7175b04fa9bb01c66cc93a93e58", "publicInputsSha256": "23569e5994ddd08b555dcbcf12c735ec303e000f6e7e90c9b63667dec60b6aeb" },
+    "transfer": { "r1csSha256": "055ea2ec8f689c48e59f89fe06db6fb980dc575982214bfe60f675e8f08485c3", "zkeySha256": "6e7bcac98b8d2a78fd1811e2caadd83d0d6a301951f8cf27ac55a67006b001c2", "verificationKeySha256": "8a6896f3f330769aa69e0dc1251a19fb69c4d6264b5729d0104df8d262e573ba", "proofSha256": "ff9a902e91e7d7b64e278cc7e17c22ad3f031f350aacb43f610771adafbf3f35", "publicInputsSha256": "903861e7ee9f792a17194f96649736d4916f45605918acac78e5d40a5b8f6170" },
+    "withdraw": { "r1csSha256": "85cf1542ab2f2ece4bbd8757def48d526ba0951a832a2e0ebbf97ace2c611308", "zkeySha256": "fd303dd0dd53b9b752dac0de546dabdd03198a7a4defde5e8d6018bccd419c56", "verificationKeySha256": "445c1982bea5e465fb0f5665023bb279637d820a9425f16a4c2f2ee7460e7e4a", "proofSha256": "4746ee54c04389929aad48c0c5a0cf18985b9dd6bcd7a3b83aa717d8847973d3", "publicInputsSha256": "d18d5852ac3c636c7b081bc52d367c896c95bd5a89feacc91014afefe3dcff54" }
+  }
+}

package/dist/buyer-setup.js

@@ -48,10 +48,10 @@ function validateConfig(config) {
         fail("SETUP_INVALID", "configure a directoryUrl or sellerOrigins");
     if (config.directoryUrl)
         origins([config.directoryUrl]);
-    for (const key of ["deploymentConfig", "tatumKeyFile", "writeGrpc", "tatumGrpc", "walrusPublisher", "walrusAggregator", "memoryConfigFile"])
+    for (const key of ["deploymentConfig", "tatumKeyFile", "writeGrpc", "tatumGrpc", "walrusPublisher", "walrusAggregator"])
         if (typeof config[key] !== "string" || !config[key])
             fail("SETUP_INVALID", `${key} is required`);
-    for (const path of [config.tatumKeyFile, config.memoryConfigFile, ...(config.suiKeyFile ? [config.suiKeyFile] : [])])
+    for (const path of [config.tatumKeyFile, ...(config.memoryConfigFile ? [config.memoryConfigFile] : []), ...(config.suiKeyFile ? [config.suiKeyFile] : [])])
         ownerFile(resolve(path));
     const deployment = JSON.parse(readFileSync(resolve(config.deploymentConfig), "utf8"));
     if (deployment.network !== "testnet" || deployment.verifierVersion !== 2)
@@ -94,7 +94,7 @@ export async function promptBuyerSetup(home) {
             deploymentConfig: await ask("Pinned Testnet deployment config path"), tatumKeyFile: await ask("Tatum key file path"),
             writeGrpc: await ask("Sui write gRPC URL"), tatumGrpc: await ask("Tatum read gRPC URL"),
             walrusPublisher: await ask("Walrus publisher URL"), walrusAggregator: await ask("Walrus aggregator URL"),
-            memoryConfigFile: await ask("Owner-only Walrus Memory config path"),
+            memoryConfigFile: await ask("Owner-only Walrus Memory config path (blank to skip Memory)"),
             directoryUrl: await ask("Shared directory origin (blank for direct sellers)"),
             sellerOrigins: (await ask("Additional seller HTTPS origins, comma separated (or blank)")).split(",").map((item) => item.trim()).filter(Boolean),
             allowedCounterparties: (await ask("Initially approved seller Sui addresses, comma separated (or blank)")).split(",").map((item) => item.trim()).filter(Boolean),
@@ -118,7 +118,7 @@ function setupBuyerConfig(home, config) {
     if (!config.suiKeyFile)
         writeFileSync(keyPath, Ed25519Keypair.generate().getSecretKey(), { mode: 0o600, flag: "wx" });
     ownerFile(keyPath);
-    initialize(home, { role: "buyer", "deployment-config": resolve(config.deploymentConfig), "sui-key-file": keyPath, "tatum-key-file": resolve(config.tatumKeyFile), "write-grpc": config.writeGrpc, "tatum-grpc": config.tatumGrpc, "walrus-publisher": config.walrusPublisher, "walrus-aggregator": config.walrusAggregator, "memory-config-file": resolve(config.memoryConfigFile), "allow-counterparty": (config.allowedCounterparties ?? []).join(","), "max-amount": config.perDealCeiling, ...(config.rapidsnark ? { rapidsnark: resolve(config.rapidsnark) } : {}) });
+    initialize(home, { role: "buyer", "deployment-config": resolve(config.deploymentConfig), "sui-key-file": keyPath, "tatum-key-file": resolve(config.tatumKeyFile), "write-grpc": config.writeGrpc, "tatum-grpc": config.tatumGrpc, "walrus-publisher": config.walrusPublisher, "walrus-aggregator": config.walrusAggregator, ...(config.memoryConfigFile ? { "memory-config-file": resolve(config.memoryConfigFile) } : {}), "allow-counterparty": (config.allowedCounterparties ?? []).join(","), "max-amount": config.perDealCeiling, ...(config.rapidsnark ? { rapidsnark: resolve(config.rapidsnark) } : {}) });
     writePolicy(home, config);
     const session = createBuyerSession(home);
     const decoded = decodeSuiPrivateKey(readFileSync(keyPath, "utf8").trim());

package/dist/cli.js

@@ -4,19 +4,22 @@ import { addBuyerPrivacyRule, approveBuyerSeller, createBuyerSession, promptBuye
 import { onboardingDoctor } from "./onboarding-doctor.js";
 import { executeFunding, prepareFunding } from "./funding.js";
 import { packageHostedSeller } from "./seller-package.js";
+import { promptSellerSetup, setupSeller } from "./seller-setup.js";
+import { scaffoldSeller } from "./seller-scaffold.js";
+import { generateSellerResearch } from "./seller-research.js";
 const words = process.argv.slice(2);
 let command = words.shift() ?? "";
 if (["wallet", "offer", "pay", "resource", "memory", "audit", "capability", "settlement", "setup", "policy", "onboarding", "onboard", "funding", "seller"].includes(command))
     command += `.${words.shift() ?? ""}`;
 try {
     if (!command || command === "help" || command === "--help" || command === "setup.") {
-        process.stdout.write(`${JSON.stringify({ schemaVersion: "supercuts.help.v1", ok: true, commands: ["onboard buyer", "funding prepare", "funding execute", "seller package", "setup buyer", "setup renew", "setup session", "init", "doctor", "status", "wallet", "offer", "pay", "memory", "capability", "audit"], setup: "Run supercuts onboard buyer --home <private-directory> for guided live Testnet setup. Use seller package to validate and prepare an operator-assisted hosted seller bundle.", live: "Use funding prepare to calculate public gas/payment and shielded deposit requirements. Funding execute requires explicit confirmation and funds only the generated buyer address." })}\n`);
+        process.stdout.write(`${JSON.stringify({ schemaVersion: "supercuts.help.v1", ok: true, commands: ["onboard buyer", "onboard seller", "seller scaffold", "seller research", "seller package", "funding prepare", "funding execute", "setup buyer", "setup seller", "setup renew", "setup session", "init", "doctor", "status", "wallet", "offer", "pay", "memory", "capability", "audit"], setup: "Run supercuts onboard buyer or supercuts onboard seller with an isolated --home. Then use seller scaffold to generate a capability. Research sellers can use seller research to create a cited owner-review draft before packaging.", live: "Fund only the generated buyer address. A seller does not need faucet funds to publish or receive a capability payment." })}\n`);
         process.exit(0);
     }
     const args = parseArgs(words);
     const home = homePath(args);
     const fundingInput = { publicPayment: String(args["public-payment"] ?? "0"), shieldedPayment: String(args["shielded-payment"] ?? "0"), ...(typeof args["gas-reserve"] === "string" ? { gasReserve: args["gas-reserve"] } : {}), ...(typeof args["change-reserve"] === "string" ? { changeReserve: args["change-reserve"] } : {}) };
-    const result = command === "init" ? initialize(home, args) : command === "setup.buyer" || command === "onboard.buyer" ? { schemaVersion: "supercuts.setup.v1", ok: true, command, data: typeof args.config === "string" ? setupBuyer(home, args.config) : await promptBuyerSetup(home) } : command === "setup.renew" ? { schemaVersion: "supercuts.setup.v1", ok: true, command, data: renewBuyer(home, String(args.config ?? "")) } : command === "setup.session" ? { schemaVersion: "supercuts.setup.v1", ok: true, command, data: createBuyerSession(home) } : command === "funding.prepare" ? { schemaVersion: "supercuts.funding.v1", ok: true, command, data: await prepareFunding(home, fundingInput) } : command === "funding.execute" ? { schemaVersion: "supercuts.funding.v1", ok: true, command, data: await executeFunding(home, { ...fundingInput, operationId: String(args["operation-id"] ?? ""), requestFaucet: args["request-faucet"] === true, confirmed: args.confirm === true }) } : command === "seller.package" ? { schemaVersion: "supercuts.seller-package.v1", ok: true, command, data: await packageHostedSeller({ home, spec: String(args.spec ?? ""), artifact: String(args.artifact ?? ""), metadata: String(args.metadata ?? ""), registration: String(args.registration ?? ""), bundle: String(args.bundle ?? ""), ...(typeof args["content-type"] === "string" ? { contentType: args["content-type"] } : {}) }) } : command === "policy.add" ? { schemaVersion: "supercuts.setup.v1", ok: true, command, data: await addBuyerPrivacyRule(home, String(args["capability-id"] ?? "")) } : command === "policy.approve-seller" ? { schemaVersion: "supercuts.setup.v1", ok: true, command, data: await approveBuyerSeller(home, String(args["capability-id"] ?? "")) } : command === "onboarding.doctor" ? { schemaVersion: "supercuts.onboarding.v1", ok: true, command, data: await onboardingDoctor(home, typeof args.config === "string" ? args.config : undefined) } : await (async () => { const app = new Phase3App(home); try {
+    const result = command === "init" ? initialize(home, args) : command === "setup.buyer" || command === "onboard.buyer" ? { schemaVersion: "supercuts.setup.v1", ok: true, command, data: typeof args.config === "string" ? setupBuyer(home, args.config) : await promptBuyerSetup(home) } : command === "setup.seller" || command === "onboard.seller" ? { schemaVersion: "supercuts.setup.v1", ok: true, command, data: typeof args.config === "string" ? setupSeller(home, args.config) : await promptSellerSetup(home) } : command === "seller.scaffold" ? { schemaVersion: "supercuts.seller-scaffold.v1", ok: true, command, data: scaffoldSeller({ ...args, home }) } : command === "seller.research" ? { schemaVersion: "supercuts.seller-research.v1", ok: true, command, data: await generateSellerResearch({ kind: String(args.kind ?? ""), topic: String(args.topic ?? ""), output: String(args.output ?? ""), ...(typeof args["context-file"] === "string" ? { contextFile: args["context-file"] } : {}), ...(typeof args["allowed-domains"] === "string" ? { allowedDomains: args["allowed-domains"] } : {}), ...(typeof args.model === "string" ? { model: args.model } : {}) }) } : command === "setup.renew" ? { schemaVersion: "supercuts.setup.v1", ok: true, command, data: renewBuyer(home, String(args.config ?? "")) } : command === "setup.session" ? { schemaVersion: "supercuts.setup.v1", ok: true, command, data: createBuyerSession(home) } : command === "funding.prepare" ? { schemaVersion: "supercuts.funding.v1", ok: true, command, data: await prepareFunding(home, fundingInput) } : command === "funding.execute" ? { schemaVersion: "supercuts.funding.v1", ok: true, command, data: await executeFunding(home, { ...fundingInput, operationId: String(args["operation-id"] ?? ""), requestFaucet: args["request-faucet"] === true, confirmed: args.confirm === true }) } : command === "seller.package" ? { schemaVersion: "supercuts.seller-package.v1", ok: true, command, data: await packageHostedSeller({ home, spec: String(args.spec ?? ""), artifact: String(args.artifact ?? ""), metadata: String(args.metadata ?? ""), registration: String(args.registration ?? ""), bundle: String(args.bundle ?? ""), ...(typeof args["content-type"] === "string" ? { contentType: args["content-type"] } : {}) }) } : command === "policy.add" ? { schemaVersion: "supercuts.setup.v1", ok: true, command, data: await addBuyerPrivacyRule(home, String(args["capability-id"] ?? "")) } : command === "policy.approve-seller" ? { schemaVersion: "supercuts.setup.v1", ok: true, command, data: await approveBuyerSeller(home, String(args["capability-id"] ?? "")) } : command === "onboarding.doctor" ? { schemaVersion: "supercuts.onboarding.v1", ok: true, command, data: await onboardingDoctor(home, typeof args.config === "string" ? args.config : undefined) } : await (async () => { const app = new Phase3App(home); try {
         return await app.execute(command, args);
     }
     finally {

package/dist/deal-adapter.js

@@ -16,8 +16,6 @@ export async function createConfiguredDealEngine(app) {
         fail("MANDATE_COMMAND_FORBIDDEN", "owner mandate does not allow composite deal execution");
     const path = join(app.home, "deal-ports.mjs");
     if (!existsSync(path)) {
-        if (!app.store.getSecret("live:memory-config"))
-            fail("LIVE_MEMORY_CONFIG_MISSING", "live composite deals require an owner-only Walrus Memory configuration");
         return new DealEngine(new DealJournal(app.store), new LiveDealPorts(app, mandate), mandate);
     }
     if ((statSync(path).mode & 0o077) !== 0)

package/dist/deal-engine.js

@@ -179,10 +179,10 @@ export class DealEngine {
         if (existing?.blobId) {
             const indexed = await this.ports.inventory(existing.blobId);
             this.journal.recordOutcome(operationId, existing.payloadHash, existing.blobId, indexed);
-            return indexed ? this.journal.advance(operationId, "outcome_pending", "complete") : this.journal.get(operationId);
+            return this.journal.advance(operationId, "outcome_pending", "complete");
         }
         if (existing)
-            return view;
+            return this.journal.advance(operationId, "outcome_pending", "complete");
         const plan = this.journal.step(operationId, "planning") ?? fail("DEAL_PLAN_MISSING", "saved deal plan is missing");
         const payment = this.journal.step(operationId, "payment") ?? fail("DEAL_PAYMENT_UNVERIFIED", "saved deal payment is missing");
         const artifact = this.journal.step(operationId, "delivery") ?? fail("DEAL_DELIVERY_UNVERIFIED", "saved deal delivery is missing");
@@ -193,11 +193,11 @@ export class DealEngine {
             this.journal.recordTiming(operationId, "outcome_queue", Date.now() - started);
             if ("unresolved" in candidate) {
                 this.journal.setOutcomeUnresolved(operationId);
-                return this.journal.get(operationId);
+                return this.journal.advance(operationId, "outcome_pending", "complete");
             }
             if ("queued" in candidate) {
                 this.journal.queueOutcome(operationId, candidate.payloadHash);
-                return this.journal.get(operationId);
+                return this.journal.advance(operationId, "outcome_pending", "complete");
             }
             if (!candidate.blobId || !/^[0-9a-f]{64}$/.test(candidate.payloadHash))
                 fail("DEAL_MEMORY_INVALID", "outcome memory is incomplete");
@@ -206,6 +206,6 @@ export class DealEngine {
         }
         const indexed = await this.ports.inventory(outcome.blobId);
         this.journal.recordOutcome(operationId, outcome.payloadHash, outcome.blobId, indexed);
-        return indexed ? this.journal.advance(operationId, "outcome_pending", "complete") : this.journal.get(operationId);
+        return this.journal.advance(operationId, "outcome_pending", "complete");
     }
 }

package/dist/deal.js

@@ -213,8 +213,8 @@ export class DealJournal {
                 fail("DEAL_PAYMENT_UNVERIFIED", "confirmed payment evidence is required");
             if (next === "delivered" && !(this.store.db.prepare("SELECT 1 FROM deal_blobs WHERE operation_id=? AND kind='delivery' AND status='verified'").get(operationId)))
                 fail("DEAL_DELIVERY_UNVERIFIED", "verified delivery evidence is required");
-            if (next === "complete" && !(this.store.db.prepare("SELECT 1 FROM deal_memory_outbox WHERE operation_id=? AND event_kind='outcome' AND status='indexed'").get(operationId)))
-                fail("DEAL_MEMORY_UNVERIFIED", "indexed outcome memory is required");
+            if (next === "complete" && (this.get(operationId).evidence.payment !== "finalized" || this.get(operationId).evidence.delivery !== "verified"))
+                fail("DEAL_DELIVERY_UNVERIFIED", "finalized payment and verified delivery are required before deal completion");
             this.store.db.prepare("UPDATE deal_operations SET state=?,rail=COALESCE(?,rail),plan_hash=COALESCE(?,plan_hash),updated_at=? WHERE operation_id=?")
                 .run(next, result?.rail ?? null, result?.planHash ?? null, Date.now(), operationId);
             this.store.db.exec("COMMIT");

package/dist/index.d.ts

@@ -15,6 +15,7 @@ export * from "./indexer.js";
 export * from "./memory.js";
 export * from "./settlement.js";
 export * from "./seller-runtime.js";
+export * from "./seller-research.js";
 export * from "./seller-stdio.js";
 export * from "./live-index.js";
 export * from "./live-runtime.js";

package/dist/index.js

@@ -15,6 +15,7 @@ export * from "./indexer.js";
 export * from "./memory.js";
 export * from "./settlement.js";
 export * from "./seller-runtime.js";
+export * from "./seller-research.js";
 export * from "./seller-stdio.js";
 export * from "./live-index.js";
 export * from "./live-runtime.js";

package/dist/live-deal-ports.js

@@ -64,7 +64,14 @@ export class LiveDealPorts {
         return Ed25519Keypair.fromSecretKey(decoded.secretKey);
     }
     async request(origin, path, body) {
-        const response = await this.http(new URL(path, origin), { ...(body ? { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(body) } : {}), redirect: "error", signal: AbortSignal.timeout(90_000) });
+        const url = new URL(path, origin);
+        let response;
+        try {
+            response = await this.http(url, { ...(body ? { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(body) } : {}), redirect: "error", signal: AbortSignal.timeout(90_000) });
+        }
+        catch (error) {
+            return fail("DEAL_SELLER_UNAVAILABLE", `seller ${url.origin} is unreachable; check its health endpoint and network route`, error);
+        }
         let value;
         try {
             value = await response.json();

package/dist/live-runtime.d.ts

@@ -47,7 +47,7 @@ export declare class LiveRuntime {
     readonly prover: Groth16Prover;
     private constructor();
     static create(profile: LiveRuntimeProfile, store: RoleStore): Promise<LiveRuntime>;
-    doctor(): Promise<Record<string, unknown>>;
+    doctor(proofsRequired?: boolean): Promise<Record<string, unknown>>;
     balance(): Promise<Record<string, unknown>>;
     private signed;
     private operationContext;

package/dist/live-runtime.js

@@ -89,8 +89,8 @@ export class LiveRuntime {
         const engine = await ProtocolEngine.create({ deploymentDomain: profile.live.deploymentDomain, poolId: profile.poolId, coinTypeHash: profile.live.coinTypeHash, verifierVersion: profile.verifierVersion, initialRoot: profile.live.initialRoot });
         return new LiveRuntime(profile, store, new TatumLedger(profile.live.tatumGrpcEndpoint, tatumKey), Ed25519Keypair.fromSecretKey(decoded.secretKey), engine);
     }
-    async doctor() {
-        const artifacts = this.prover.doctor();
+    async doctor(proofsRequired = true) {
+        const artifacts = proofsRequired ? this.prover.doctor() : { rapidSnark: false, artifacts: {} };
         const [service, suiObject] = await Promise.all([this.tatum.getServiceInfo(), this.client.getObject({ objectId: this.profile.poolId, include: { json: true } })]);
         if (!suiObject.object)
             fail("POOL_OBJECT_MISSING", "pinned Testnet pool object is unavailable; check the Sui write RPC and deployment config");
@@ -99,7 +99,7 @@ export class LiveRuntime {
         const babySeed = this.store.getSecret("identity:babyjub-seed") ?? fail("IDENTITY_MISSING", "BabyJub identity is missing");
         const identity = this.engine.identity(babySeed);
         const fixes = [];
-        if (!artifacts.rapidSnark)
+        if (proofsRequired && !artifacts.rapidSnark)
             fixes.push("Set an executable RapidSnark path in the role profile for v2 proofs.");
         if (!this.profile.live.walrusPublisherUrl)
             fixes.push("Configure the Walrus publisher URL for capability and transcript writes.");
@@ -117,9 +117,7 @@ export class LiveRuntime {
                 fixes.push(`Walrus ${name} is unreachable; check the configured URL and network access.`);
             }
         }
-        if (this.profile.role === "buyer" && !this.store.getSecret("live:memory-config"))
-            fixes.push("Configure an owner-only Walrus Memory file using the local 1536-dimensional embedding adapter.");
-        return { role: this.profile.role, network: "testnet", packageId: this.profile.packageId, poolId: this.profile.poolId, asset: this.profile.coinType, verifierVersion: this.profile.verifierVersion, keyPermissions: "owner-only", rpc: this.profile.live.writeGrpcEndpoint, healthy: true, readyForDemo: fixes.length === 0, fixes, runtime: "testnet-live", signer: this.signer.toSuiAddress(), babyJubPublicKey: identity.publicKey.map(String), x25519PublicKey: this.store.getSecret("identity:x25519-public")?.toString("base64"), rapidSnark: artifacts.rapidSnark, artifacts: artifacts.artifacts, poolObjectVerified: true, tatumServiceVerified: true };
+        return { role: this.profile.role, network: "testnet", packageId: this.profile.packageId, poolId: this.profile.poolId, asset: this.profile.coinType, verifierVersion: this.profile.verifierVersion, keyPermissions: "owner-only", rpc: this.profile.live.writeGrpcEndpoint, healthy: true, readyForDemo: fixes.length === 0, fixes, runtime: "testnet-live", signer: this.signer.toSuiAddress(), babyJubPublicKey: identity.publicKey.map(String), x25519PublicKey: this.store.getSecret("identity:x25519-public")?.toString("base64"), memoryConfigured: Boolean(this.store.getSecret("live:memory-config")), proofsRequired, rapidSnark: artifacts.rapidSnark, artifacts: artifacts.artifacts, poolObjectVerified: true, tatumServiceVerified: true };
     }
     async balance() {
         const state = await this.index.sync();

package/dist/live-seller-transport.js

@@ -97,6 +97,8 @@ export class LiveSellerTransport {
     async handle(request, response) {
         try {
             const url = new URL(request.url ?? "/", this.config.origin);
+            if (request.method === "GET" && url.pathname === "/health")
+                return this.respond(response, 200, { ok: true, service: "supercuts-seller", capabilities: this.runtime.catalog().length });
             if (request.method === "GET" && url.pathname === "/v2/catalog")
                 return this.respond(response, 200, { capabilities: this.runtime.catalog() });
             if (request.method === "POST" && url.pathname === "/v2/prepare")
@@ -108,7 +110,9 @@ export class LiveSellerTransport {
                     if (url.pathname.startsWith(`${(resource.config.pathPrefix ?? "/capability").replace(/\/$/, "")}/`))
                         return resource.handle(request, response);
             }
-            return this.respond(response, 404, { error: "NOT_FOUND" });
+            if (request.method === "GET" && [...this.#registrations.values()].some((item) => url.pathname === new URL(item.manifest.endpoint).pathname))
+                return this.respond(response, 404, { error: "NEGOTIATION_REQUIRED", message: "Protected resource URLs are issued for a negotiated session." });
+            return this.respond(response, 404, { error: "NOT_FOUND", message: "Seller route was not found." });
         }
         catch (error) {
             const known = error instanceof SupercutsError ? error : new SupercutsError("SELLER_REQUEST_FAILED", "seller request failed");

package/dist/mandate.js

@@ -125,7 +125,7 @@ export async function executeMandated(app, mandate, command, raw) {
         fail("MANDATE_COMMAND_FORBIDDEN", `mandate does not allow ${command}`);
     const args = {};
     for (const [key, value] of Object.entries(raw))
-        args[key] = typeof value === "boolean" ? value : typeof value === "string" ? value : Buffer.from(JSON.stringify(value)).toString("base64url");
+        args[key] = typeof value === "boolean" ? value : typeof value === "string" ? value : Buffer.from(canonical(value)).toString("base64url");
     if (!spec.mutating)
         return (await app.execute(command, args)).data;
     const operationId = String(raw["operation-id"]), journalOperationId = command === "settlement.plan" ? `settlement.plan:${operationId}` : operationId;

package/dist/mcp-bootstrap.js

@@ -37,17 +37,17 @@ else {
             return;
         if (request.method === "tools/list")
             return send({ jsonrpc: "2.0", id: request.id, result: { tools: [
-                        { name: "setup.status", description: "Explain how the owner completes one-time buyer setup locally. Do not request secrets in chat.", inputSchema: { type: "object", properties: {}, additionalProperties: false } },
+                        { name: "setup.status", description: "Explain how the owner completes one-time buyer or seller setup locally. Do not request secrets in chat.", inputSchema: { type: "object", properties: {}, additionalProperties: false } },
                         { name: "setup.refresh", description: "Reload this MCP connection after the owner completes local setup.", inputSchema: { type: "object", properties: {}, additionalProperties: false } },
                     ] } });
         if (request.method === "tools/call" && request.params?.name === "setup.status") {
             const configured = existsSync(join(home, "profile.json"));
-            const result = { schemaVersion: "supercuts.setup.v1", ok: true, configured, home, nextStep: configured ? "Call setup.refresh to load the configured buyer tools without restarting the connector." : `Run supercuts onboard buyer --home ${JSON.stringify(home)} in a terminal, then call setup.refresh. The command asks for policy limits, seller origins and local credential file paths. Do not paste keys or tokens into Codex.` };
+            const result = { schemaVersion: "supercuts.setup.v1", ok: true, configured, home, nextStep: configured ? "Call setup.refresh to load the configured role tools without restarting the connector." : `Run supercuts onboard buyer --home ${JSON.stringify(home)} or supercuts onboard seller --home ${JSON.stringify(home)} in a terminal, then call setup.refresh. Use a separate owner-only home for every role and identity. Do not paste keys or tokens into Codex.` };
             return send({ jsonrpc: "2.0", id: request.id, result: { content: [{ type: "text", text: JSON.stringify(result) }], structuredContent: result } });
         }
         if (request.method === "tools/call" && request.params?.name === "setup.refresh") {
             if (!existsSync(join(home, "profile.json"))) {
-                const result = { schemaVersion: "supercuts.setup.v1", ok: false, error: { code: "SETUP_REQUIRED", message: "buyer setup is not complete", recovery: `Run supercuts onboard buyer --home ${JSON.stringify(home)} locally, then retry setup.refresh.` } };
+                const result = { schemaVersion: "supercuts.setup.v1", ok: false, error: { code: "SETUP_REQUIRED", message: "role setup is not complete", recovery: `Run supercuts onboard buyer --home ${JSON.stringify(home)} or supercuts onboard seller --home ${JSON.stringify(home)} locally, then retry setup.refresh.` } };
                 return send({ jsonrpc: "2.0", id: request.id, result: { isError: true, content: [{ type: "text", text: JSON.stringify(result) }], structuredContent: result } });
             }
             const result = { schemaVersion: "supercuts.setup.v1", ok: true, configured: true, reloading: true };

package/dist/onboarding-doctor.js

@@ -19,10 +19,10 @@ export async function onboardingDoctor(home, sellerConfig) {
     try {
         if (app.profile.mock)
             fail("LIVE_PROFILE_REQUIRED", "onboarding doctor requires a live Testnet role home");
-        const runtime = await app.execute("doctor", {});
-        if (runtime.data.readyForDemo === false)
-            fail("ONBOARDING_RUNTIME_NOT_READY", "live runtime doctor reports missing prerequisites");
         if (app.profile.role === "buyer") {
+            const runtime = await app.execute("doctor", {});
+            if (runtime.data.readyForDemo === false)
+                fail("ONBOARDING_RUNTIME_NOT_READY", "live runtime doctor reports missing prerequisites");
             const mandate = loadMandate(home);
             if (mandate.version !== "supercuts.mandate.v2")
                 fail("DEAL_MANDATE_VERSION", "buyer needs a v2 standing mandate");
@@ -68,15 +68,20 @@ export async function onboardingDoctor(home, sellerConfig) {
             const served = await json(new URL("/v2/catalog", config.origin));
             if (!Array.isArray(served.capabilities))
                 fail("SELLER_CATALOG_INVALID", "seller endpoint has no valid catalog");
+            let proofsRequired = false;
             for (const item of config.capabilities) {
                 const registrationPath = resolve(item.registrationFile);
                 if ((statSync(registrationPath).mode & 0o077) !== 0)
                     fail("SELLER_CONFIG_PERMISSIONS", "registration file must be owner-only");
                 const registration = JSON.parse(readFileSync(registrationPath, "utf8"));
+                proofsRequired ||= registration.manifest.supportedRails.includes("shielded");
                 await verifySignedCapability(registration);
                 if (!served.capabilities.some((entry) => JSON.stringify(entry) === JSON.stringify(registration)))
                     fail("SELLER_CATALOG_INVALID", "seller endpoint does not serve its configured registration");
             }
+            const runtime = await app.execute("doctor", { "proofs-required": proofsRequired });
+            if (runtime.data.readyForDemo === false)
+                fail("ONBOARDING_RUNTIME_NOT_READY", "live runtime doctor reports missing prerequisites");
             return { role: "seller", healthy: true, runtime: runtime.data, capabilities: config.capabilities.length, origin: config.origin };
         }
         return fail("ROLE_FORBIDDEN", "onboarding doctor supports buyer and seller homes");

package/dist/phase3.js

@@ -760,7 +760,7 @@ export class Phase3App {
             return output(command, await this.liveMemory(command, args));
         const runtime = await LiveRuntime.create(this.profile, this.store);
         if (command === "doctor")
-            return output(command, await runtime.doctor());
+            return output(command, await runtime.doctor(args["proofs-required"] !== false));
         if (command === "status")
             return output(command, { role: this.profile.role, network: this.profile.network, mock: false, runtime: "testnet-live" });
         if (command === "capability.publish")
@@ -1143,7 +1143,7 @@ export class Phase3App {
 export function output(command, data) { return { schemaVersion: "supercuts.v1", ok: true, command, data }; }
 export function errorOutput(error) {
     const known = error instanceof SupercutsError ? error : new SupercutsError("INTERNAL_ERROR", error instanceof Error ? error.message : "unknown error");
-    const retryable = ["BROADCAST_UNRESOLVED", "DELIVERY_IN_PROGRESS", "DELIVERY_PENDING", "ONBOARDING_SERVICE_UNAVAILABLE", "SELLER_DIRECTORY_UNAVAILABLE", "WALRUS_WRITE_FAILED", "WALRUS_READ_FAILED", "X402_FACILITATOR_UNAVAILABLE"].includes(known.code);
+    const retryable = ["BROADCAST_UNRESOLVED", "DELIVERY_IN_PROGRESS", "DELIVERY_PENDING", "DEAL_SELLER_UNAVAILABLE", "ONBOARDING_SERVICE_UNAVAILABLE", "SELLER_DIRECTORY_UNAVAILABLE", "WALRUS_WRITE_FAILED", "WALRUS_READ_FAILED", "X402_FACILITATOR_UNAVAILABLE"].includes(known.code);
     const sameOperation = retryable || ["OPERATION_ID_CONFLICT", "DEAL_OPERATION_CONFLICT"].includes(known.code);
     return { schemaVersion: "supercuts.v1", ok: false, error: { code: known.code, message: known.message, recovery: recovery(known.code), retryable, retryWithSameOperationId: sameOperation } };
 }
@@ -1164,6 +1164,8 @@ function recovery(code) {
         return "reconcile or resume with the same operation ID; never create a replacement payment";
     if (code === "DELIVERY_PENDING")
         return "resume the same root operation ID; completed selection, payment, and agreement stages will not run again";
+    if (code === "DEAL_SELLER_UNAVAILABLE")
+        return "check the seller /health endpoint, then resume the same root operation ID";
     if (code === "X402_FACILITATOR_UNAVAILABLE")
         return "the signed transaction remains journaled; resume the same operation ID after facilitator health recovers";
     if (code === "OPERATION_ID_CONFLICT" || code === "DEAL_OPERATION_CONFLICT")

package/dist/role-lock.d.ts

@@ -4,5 +4,5 @@ export interface RoleHomeLease {
     release(): void;
 }
 /** Best-effort process lease. SQLite still owns data integrity; this prevents
- * multiple MCP event/memory workers from operating one role home at once. */
+ * multiple long-running role workers from operating one role home at once. */
 export declare function acquireRoleHomeLease(home: string): RoleHomeLease;

package/dist/role-lock.js

@@ -13,7 +13,7 @@ function active(pid) {
     }
 }
 /** Best-effort process lease. SQLite still owns data integrity; this prevents
- * multiple MCP event/memory workers from operating one role home at once. */
+ * multiple long-running role workers from operating one role home at once. */
 export function acquireRoleHomeLease(home) {
     const path = join(home, ".mcp.lock"), token = randomUUID();
     for (let attempt = 0; attempt < 2; attempt++) {

package/dist/seller-catalog-generate.js

@@ -35,8 +35,8 @@ try {
         if (item.data.reviewStatus !== "approved")
             fail("ARTIFACT_REVIEW_REQUIRED", `${item.path} must be owner-reviewed before live provisioning`);
     for (const brief of [briefA, briefB]) {
-        if (typeof brief.data.title !== "string" || typeof brief.data.body !== "string" || !Array.isArray(brief.data.citations) || brief.data.citations.length < 2 || typeof brief.data.preview !== "object")
-            fail("BRIEF_INVALID", "brief reports need title, body, two citations, and preview metadata");
+        if (typeof brief.data.title !== "string" || typeof brief.data.body !== "string" || !Array.isArray(brief.data.citations) || brief.data.citations.length < 2 || brief.data.citations.some((value) => typeof value !== "string" || !/^https:\/\//.test(value)) || new Set(brief.data.citations).size !== brief.data.citations.length || typeof brief.data.preview !== "object")
+            fail("BRIEF_INVALID", "brief reports need title, body, unique HTTPS citations, and preview metadata");
         for (const key of ["relevance", "sourceQuality"])
             if (typeof brief.data.preview[key] !== "number" || brief.data.preview[key] < 0 || brief.data.preview[key] > 1)
                 fail("BRIEF_INVALID", `preview ${key} must be in [0,1]`);
@@ -44,8 +44,8 @@ try {
             fail("BRIEF_INVALID", "preview freshnessDays is invalid");
     }
     for (const analysis of [analysisA, analysisB])
-        if (typeof analysis.data.title !== "string" || typeof analysis.data.body !== "string")
-            fail("ANALYSIS_INVALID", "analysis reports need a title and body");
+        if (typeof analysis.data.title !== "string" || typeof analysis.data.body !== "string" || analysis.data.citations !== undefined && (!Array.isArray(analysis.data.citations) || analysis.data.citations.some((value) => typeof value !== "string" || !/^https:\/\//.test(value))))
+            fail("ANALYSIS_INVALID", "analysis reports need a title, body, and HTTPS citations when provided");
     const expiresAt = Date.now() + 7 * 24 * 60 * 60 * 1000;
     const capability = (id, sellerId, description, rails, amount) => createCapabilityManifest({ capabilityId: id, sellerId, capability: id === "competitor-analysis" ? "sui.competitor-analysis" : "sui.market-brief", description, inputSchema: { type: "object", properties: { topic: { type: "string" } } }, outputSchema: { type: "object", properties: { title: { type: "string" }, body: { type: "string" }, citations: { type: "array" } } }, supportedRails: rails, priceBand: { minimum: amount, maximum: amount }, asset: "0x2::sui::SUI", endpoint: new URL(`/resource/${id}`, origin).toString(), expiresAt });
     const publicA = run.addresses.publicSeller ?? fail("SELLER_CONFIG_INVALID", "first brief seller is missing"), publicB = run.addresses.secondPublicSeller ?? fail("SELLER_CONFIG_INVALID", "second brief seller is missing"), analysisSeller = run.addresses.confidentialSeller ?? fail("SELLER_CONFIG_INVALID", "analysis seller is missing");

package/dist/seller-directory-cli.js

@@ -3,6 +3,7 @@ import { readFileSync, statSync } from "node:fs";
 import { resolve } from "node:path";
 import { verifySignedCapability } from "./capability.js";
 import { fail } from "./errors.js";
+import { errorOutput } from "./phase3.js";
 async function main() {
     const [command, file, directory] = process.argv.slice(2);
     if (command !== "publish" || !file || !directory)
@@ -21,4 +22,4 @@ async function main() {
         fail("SELLER_DIRECTORY_UNAVAILABLE", String(result.message ?? `directory returned HTTP ${response.status}`));
     process.stdout.write(`${JSON.stringify(result)}\n`);
 }
-main().catch((error) => { process.stderr.write(`${error instanceof Error ? error.message : "directory publication failed"}\n`); process.exitCode = 1; });
+main().catch((error) => { process.stdout.write(`${JSON.stringify(errorOutput(error))}\n`); process.exitCode = 1; });

package/dist/seller-live-cli.js

@@ -5,6 +5,7 @@ import { pathToFileURL } from "node:url";
 import { fail } from "./errors.js";
 import { Phase3App, errorOutput } from "./phase3.js";
 import { LiveSellerTransport } from "./live-seller-transport.js";
+import { acquireRoleHomeLease } from "./role-lock.js";
 async function main() {
     const home = process.argv[2], configPath = process.argv[3];
     if (!home || !configPath)
@@ -12,8 +13,15 @@ async function main() {
     if ((statSync(configPath).mode & 0o077) !== 0)
         fail("SELLER_CONFIG_PERMISSIONS", "seller config must be owner-only");
     const config = JSON.parse(readFileSync(configPath, "utf8"));
+    if (config.facilitatorUrlEnv)
+        config.facilitatorUrl = process.env[config.facilitatorUrlEnv] ?? fail("SELLER_FACILITATOR_REQUIRED", `environment variable ${config.facilitatorUrlEnv} is required`);
+    if (config.facilitatorKeyEnv)
+        config.facilitatorKey = process.env[config.facilitatorKeyEnv] ?? fail("SELLER_FACILITATOR_REQUIRED", `environment variable ${config.facilitatorKeyEnv} is required`);
     if (!Array.isArray(config.capabilities) || !config.capabilities.length)
         fail("SELLER_CONFIG_INVALID", "seller config must name registered capabilities and handlers");
+    const lease = acquireRoleHomeLease(resolve(home));
+    if (!lease.acquired)
+        fail("ROLE_HOME_BUSY", `seller home is already in use${lease.ownerPid ? ` by process ${lease.ownerPid}` : ""}`);
     const app = new Phase3App(home), transport = new LiveSellerTransport(app, config);
     try {
         for (const item of config.capabilities) {
@@ -41,11 +49,12 @@ async function main() {
             fail("SELLER_CONFIG_INVALID", "seller listenPort must be a valid TCP port");
         await new Promise((done) => server.listen(port, host, done));
         process.stdout.write(`${JSON.stringify({ ok: true, service: "supercuts-seller-live", origin: config.origin, capabilities: transport.runtime.catalog().map((item) => item.manifest.capabilityId) })}\n`);
-        const stop = () => server.close(() => { app.close(); process.exit(0); });
+        const stop = () => server.close(() => { lease.release(); app.close(); process.exit(0); });
         process.on("SIGINT", stop);
         process.on("SIGTERM", stop);
     }
     catch (error) {
+        lease.release();
         app.close();
         throw error;
     }

package/dist/seller-provision.js

@@ -48,6 +48,8 @@ async function main() {
                         catch (error) {
                             return fail("BRIEF_INVALID", "market brief must be JSON", error);
                         }
+                        if (report.reviewStatus !== "approved")
+                            fail("ARTIFACT_REVIEW_REQUIRED", "market brief must be owner-reviewed before provisioning");
                         if (typeof report.title !== "string" || typeof report.body !== "string" || !Array.isArray(report.citations) || report.citations.length < 2 || report.citations.some((value) => typeof value !== "string" || !/^https:\/\//.test(value)))
                             fail("BRIEF_INVALID", "market brief needs a title, body, and at least two HTTPS citations");
                     }
@@ -56,7 +58,19 @@ async function main() {
                 for (const [briefHash, artifactPath] of Object.entries(capability.variants ?? {})) {
                     if (!/^[0-9a-f]{64}$/.test(briefHash))
                         fail("SELLER_CONFIG_INVALID", "variant brief hash is invalid");
-                    artifacts[`${manifest.capabilityId}:${briefHash}`] = readFileSync(resolve(artifactPath)).toString("base64url");
+                    const body = readFileSync(resolve(artifactPath));
+                    if (manifest.capability === "sui.competitor-analysis") {
+                        let report;
+                        try {
+                            report = JSON.parse(body.toString());
+                        }
+                        catch (error) {
+                            return fail("ANALYSIS_INVALID", "competitor analysis must be JSON", error);
+                        }
+                        if (report.reviewStatus !== "approved")
+                            fail("ARTIFACT_REVIEW_REQUIRED", "competitor analysis must be owner-reviewed before provisioning");
+                    }
+                    artifacts[`${manifest.capabilityId}:${briefHash}`] = body.toString("base64url");
                 }
                 if (!capability.artifact && !Object.keys(capability.variants ?? {}).length)
                     fail("SELLER_ARTIFACT_MISSING", "capability needs a prepared artifact or brief variants");

package/dist/seller-research.d.ts

@@ -0,0 +1,50 @@
+export type SellerResearchKind = "market-brief" | "competitor-analysis";
+export interface SellerResearchDraft {
+    title: string;
+    body: string;
+    citations: string[];
+    preview: {
+        summary: string;
+        relevance: number;
+        sourceQuality: number;
+        freshnessDays: number;
+    };
+    reviewStatus: "draft-needs-owner-review";
+    research: {
+        model: string;
+        generatedAt: string;
+        sourceCount: number;
+        topic: string;
+        kind: SellerResearchKind;
+    };
+}
+export interface SellerResearchOptions {
+    apiKey?: string;
+    model?: string;
+    fetch?: typeof globalThis.fetch;
+    maxSearches?: number;
+    maxTokens?: number;
+    allowedDomains?: string[];
+    now?: Date;
+}
+/** Generates an owner-review draft. It never publishes or mutates a live seller. */
+export declare class ClaudeSellerResearcher {
+    #private;
+    readonly model: string;
+    constructor(options?: SellerResearchOptions);
+    research(input: {
+        kind: SellerResearchKind;
+        topic: string;
+        context?: Record<string, unknown>;
+    }): Promise<SellerResearchDraft>;
+}
+export declare function generateSellerResearch(input: {
+    kind: string;
+    topic: string;
+    output: string;
+    contextFile?: string;
+    allowedDomains?: string;
+    apiKey?: string;
+    model?: string;
+    fetch?: typeof globalThis.fetch;
+}): Promise<Record<string, unknown>>;

package/dist/seller-research.js

@@ -0,0 +1,210 @@
+import { readFileSync, statSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { fail } from "./errors.js";
+const asObject = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : fail("SELLER_RESEARCH_INVALID", "Claude research output must be an object");
+const submittedTool = (blocks) => {
+    for (const block of blocks)
+        if (block?.type === "tool_use" && block.name === "submit_research") {
+            if (block.input && typeof block.input === "object" && !Array.isArray(block.input))
+                return block;
+            if (typeof block.input === "string")
+                try {
+                    const input = JSON.parse(block.input);
+                    if (input && typeof input === "object" && !Array.isArray(input))
+                        return { ...block, input };
+                }
+                catch { }
+        }
+    return undefined;
+};
+const normalizedUrl = (value) => { const url = new URL(value); url.hash = ""; if (url.pathname !== "/")
+    url.pathname = url.pathname.replace(/\/$/, ""); return url.toString(); };
+function sourceUrls(value, found = new Set()) {
+    if (Array.isArray(value))
+        for (const item of value)
+            sourceUrls(item, found);
+    else if (value && typeof value === "object")
+        for (const [key, item] of Object.entries(value)) {
+            if (key === "url" && typeof item === "string") {
+                try {
+                    if (new URL(item).protocol === "https:")
+                        found.add(normalizedUrl(item));
+                }
+                catch { }
+            }
+            sourceUrls(item, found);
+        }
+    return found;
+}
+function validateDraft(value, evidence, allowedDomains) {
+    const draft = asObject(value), preview = asObject(draft.preview);
+    if (typeof draft.title !== "string" || draft.title.trim().length < 8 || draft.title.length > 180)
+        fail("SELLER_RESEARCH_INVALID", "research title must contain 8 to 180 characters");
+    if (typeof draft.body !== "string" || draft.body.trim().length < 800 || draft.body.length > 16_000)
+        fail("SELLER_RESEARCH_INVALID", "research body must contain 800 to 16,000 characters");
+    if (!Array.isArray(draft.citations))
+        fail("SELLER_RESEARCH_INVALID", "research citations must be an array");
+    if (draft.citations.length < 3 || draft.citations.length > 32)
+        fail("SELLER_RESEARCH_INVALID", `research must contain 3 to 32 citations; received ${draft.citations.length}`);
+    let citations = draft.citations.map((item) => {
+        if (typeof item !== "string")
+            return fail("SELLER_RESEARCH_INVALID", "every citation must be an HTTPS URL");
+        let url;
+        try {
+            url = new URL(item);
+        }
+        catch (error) {
+            return fail("SELLER_RESEARCH_INVALID", "every citation must be a valid URL", error);
+        }
+        if (url.protocol !== "https:" || url.username || url.password)
+            fail("SELLER_RESEARCH_INVALID", "every citation must be a public HTTPS URL without credentials");
+        if (allowedDomains.length && !allowedDomains.some((domain) => url.hostname === domain || url.hostname.endsWith(`.${domain}`)))
+            fail("SELLER_RESEARCH_SOURCE_UNAPPROVED", `citation host ${url.hostname} is outside --allowed-domains`);
+        const normalized = normalizedUrl(item);
+        if (!evidence.has(normalized))
+            fail("SELLER_RESEARCH_SOURCE_UNVERIFIED", "Claude cited a URL that was not returned by web search");
+        return normalized;
+    });
+    if (new Set(citations).size !== citations.length)
+        fail("SELLER_RESEARCH_INVALID", "research citations must be unique");
+    let reportBody = draft.body.trim();
+    const markers = [...reportBody.matchAll(/\[([1-9][0-9]*)\]/g)].map((match) => Number(match[1]));
+    if (markers.some((index) => index > citations.length))
+        fail("SELLER_RESEARCH_INVALID", "research body contains an out-of-range citation marker");
+    const used = [...new Set(markers)].sort((a, b) => a - b);
+    if (used.length < 3)
+        fail("SELLER_RESEARCH_INVALID", "research body must reference at least three listed sources inline");
+    if (used.length !== citations.length) {
+        const remap = new Map(used.map((oldIndex, newIndex) => [oldIndex, newIndex + 1]));
+        reportBody = reportBody.replace(/\[([1-9][0-9]*)\]/g, (_marker, raw) => `[${remap.get(Number(raw))}]`);
+        citations = used.map((index) => citations[index - 1]);
+    }
+    if (typeof preview.summary !== "string" || preview.summary.trim().length < 30 || preview.summary.length > 400)
+        fail("SELLER_RESEARCH_INVALID", "preview summary must contain 30 to 400 characters");
+    for (const key of ["relevance", "sourceQuality"])
+        if (typeof preview[key] !== "number" || !Number.isFinite(preview[key]) || preview[key] < 0 || preview[key] > 1)
+            fail("SELLER_RESEARCH_INVALID", `preview ${key} must be in [0,1]`);
+    if (!Number.isInteger(preview.freshnessDays) || preview.freshnessDays < 0 || preview.freshnessDays > 365)
+        fail("SELLER_RESEARCH_INVALID", "preview freshnessDays must be an integer in [0,365]");
+    return { title: draft.title.trim(), body: reportBody, citations, preview: { summary: preview.summary.trim(), relevance: preview.relevance, sourceQuality: preview.sourceQuality, freshnessDays: preview.freshnessDays } };
+}
+/** Generates an owner-review draft. It never publishes or mutates a live seller. */
+export class ClaudeSellerResearcher {
+    model;
+    #apiKey;
+    #fetch;
+    #maxSearches;
+    #maxTokens;
+    #allowedDomains;
+    #now;
+    constructor(options = {}) {
+        this.#apiKey = options.apiKey ?? process.env.CLAUDE_API_KEY ?? "";
+        if (!this.#apiKey)
+            fail("CLAUDE_CREDENTIAL_MISSING", "CLAUDE_API_KEY is required to generate a seller research draft");
+        this.model = options.model ?? process.env.CLAUDE_RESEARCH_MODEL ?? process.env.CLAUDE_MODEL ?? "claude-haiku-5-5";
+        this.#fetch = options.fetch ?? fetch;
+        this.#maxSearches = options.maxSearches ?? 8;
+        this.#maxTokens = options.maxTokens ?? 5_000;
+        this.#allowedDomains = (options.allowedDomains ?? []).map((item) => item.trim().toLowerCase()).filter(Boolean);
+        this.#now = options.now ?? new Date();
+        if (!Number.isInteger(this.#maxSearches) || this.#maxSearches < 3 || this.#maxSearches > 12 || !Number.isInteger(this.#maxTokens) || this.#maxTokens < 1_500 || this.#maxTokens > 8_192)
+            fail("CLAUDE_LIMIT_INVALID", "seller research bounds are invalid");
+        if (this.#allowedDomains.some((item) => !/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)*[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(item)))
+            fail("SELLER_RESEARCH_INVALID", "allowed domains must be bare DNS names");
+    }
+    async research(input) {
+        if (!["market-brief", "competitor-analysis"].includes(input.kind) || !input.topic.trim() || input.topic.length > 500)
+            fail("SELLER_RESEARCH_INVALID", "research needs a valid kind and a topic of at most 500 characters");
+        const context = input.context ? JSON.stringify(input.context) : "none";
+        if (context.length > 40_000)
+            fail("SELLER_RESEARCH_INVALID", "matching brief context is too large");
+        const schema = {
+            type: "object", additionalProperties: false,
+            properties: {
+                title: { type: "string", maxLength: 180 }, body: { type: "string", maxLength: 16000 }, citations: { type: "array", minItems: 3, maxItems: 32, items: { type: "string" } },
+                preview: { type: "object", additionalProperties: false, properties: { summary: { type: "string", maxLength: 400 }, relevance: { type: "number", minimum: 0, maximum: 1 }, sourceQuality: { type: "number", minimum: 0, maximum: 1 }, freshnessDays: { type: "integer", minimum: 0, maximum: 365 } }, required: ["summary", "relevance", "sourceQuality", "freshnessDays"] },
+            }, required: ["title", "body", "citations", "preview"],
+        };
+        const webSearch = { type: "web_search_20250305", name: "web_search", max_uses: this.#maxSearches, allowed_callers: ["direct"] };
+        if (this.#allowedDomains.length)
+            webSearch.allowed_domains = this.#allowedDomains;
+        const system = `<role>You are the research desk for a paid Sui ecosystem intelligence seller.</role>
+<quality_bar>Use web search before writing. Prefer primary sources, official documentation, project announcements, repositories, and dated first-party metrics. Cross-check material claims across independent sources. Separate observed facts from analysis, name dates and measurement windows, surface uncertainty and counter-evidence, and never invent a fact, quotation, number, or URL. The report must be useful to a technically sophisticated buyer, not promotional copy.</quality_bar>
+<format>After research and a final self-check, call submit_research exactly once. Write a cohesive 800-16000 character report. Include inline source markers such as [1] that correspond in order to the citations array. Use only HTTPS URLs actually returned by web_search. Provide at least 3 unique sources and include additional material sources when useful. Preview scores are seller estimates, not independent guarantees.</format>`;
+        const prompt = `<today>${this.#now.toISOString().slice(0, 10)}</today><kind>${input.kind}</kind><topic>${input.topic.trim()}</topic><matching_brief_context>${context}</matching_brief_context><instructions>Research the topic broadly enough to identify market structure, concrete evidence, important competitors or alternatives, risks, and what would change the conclusion. For competitor analysis, directly compare the purchased brief's thesis with named competing projects or approaches. Before submission, verify every citation was observed in search results and every quantitative claim is qualified by date and source.</instructions>`;
+        const request = async (payload) => {
+            let response;
+            try {
+                response = await this.#fetch("https://api.anthropic.com/v1/messages", { method: "POST", headers: { "content-type": "application/json", "anthropic-version": "2023-06-01", "x-api-key": this.#apiKey }, body: JSON.stringify(payload), signal: AbortSignal.timeout(90_000) });
+            }
+            catch (error) {
+                return fail("CLAUDE_UNAVAILABLE", "Claude research request failed closed", error);
+            }
+            if (!response.ok) {
+                await response.arrayBuffer();
+                return fail("CLAUDE_UNAVAILABLE", `Claude research returned status ${response.status}`);
+            }
+            try {
+                return await response.json();
+            }
+            catch (error) {
+                return fail("CLAUDE_OUTPUT_INVALID", "Claude research returned invalid JSON", error);
+            }
+        };
+        const submitTool = { name: "submit_research", description: "Submit the source-checked seller research draft for owner review.", input_schema: schema };
+        let messages = [{ role: "user", content: prompt }], selected;
+        const blocks = [];
+        for (let turn = 0; turn < 3; turn++) {
+            const body = await request({ model: this.model, max_tokens: this.#maxTokens, system, messages, tools: [webSearch, submitTool] });
+            const current = Array.isArray(body.content) ? body.content : [];
+            blocks.push(...current);
+            selected = submittedTool(current);
+            if (selected || current.some((block) => block?.type === "text" && typeof block.text === "string" && block.text.trim()))
+                break;
+            if (!current.length || turn === 2)
+                break;
+            // Anthropic can pause a server-side search turn. Replay its opaque content
+            // unchanged so the model can synthesize the already-returned evidence.
+            messages = [...messages, { role: "assistant", content: current }, { role: "user", content: "Continue the paused research turn using the returned search evidence, then submit the structured draft." }];
+        }
+        const searchFailure = blocks.some((block) => block?.type === "web_search_tool_result" && (block.is_error === true || block.content?.type === "web_search_tool_result_error"));
+        if (searchFailure)
+            fail("SELLER_RESEARCH_SEARCH_FAILED", "Claude web search failed; no draft was written");
+        const evidence = sourceUrls(blocks);
+        if (evidence.size < 3)
+            fail("SELLER_RESEARCH_SOURCE_UNVERIFIED", "Claude returned fewer than three verifiable web-search sources");
+        if (selected)
+            try {
+                const draft = validateDraft(selected.input, evidence, this.#allowedDomains);
+                return { ...draft, reviewStatus: "draft-needs-owner-review", research: { model: this.model, generatedAt: this.#now.toISOString(), sourceCount: evidence.size, topic: input.topic.trim(), kind: input.kind } };
+            }
+            catch { }
+        const researchedText = blocks.filter((block) => block?.type === "text" && typeof block.text === "string").map((block) => block.text).join("\n").slice(0, 30_000) || (selected ? JSON.stringify(selected.input).slice(0, 30_000) : "");
+        if (!researchedText)
+            fail("CLAUDE_OUTPUT_INVALID", "Claude returned search evidence without a research answer");
+        const editorSystem = `<role>You are a strict research editor.</role><instructions>Convert or repair the supplied web-researched answer into the submit_research schema. Preserve material uncertainty, dates, comparisons, and counter-evidence. Use only URLs in verified_sources, include at least 3 unique citations and all additional material sources, and do not add facts or sources. The body must be 800-16000 characters and use [1], [2], and subsequent inline markers corresponding to citation order. Ensure preview is an object with summary, relevance, sourceQuality, and integer freshnessDays. Call submit_research exactly once.</instructions>`;
+        const edited = await request({ model: this.model, max_tokens: this.#maxTokens, system: editorSystem, messages: [{ role: "user", content: JSON.stringify({ kind: input.kind, topic: input.topic.trim(), researchedAnswer: researchedText, verifiedSources: [...evidence].slice(0, 32) }) }], tools: [submitTool], tool_choice: { type: "tool", name: "submit_research" } });
+        const editedBlocks = Array.isArray(edited.content) ? edited.content : [];
+        selected = submittedTool(editedBlocks);
+        if (!selected)
+            fail("CLAUDE_OUTPUT_INVALID", "Claude did not submit a structured research draft");
+        const draft = validateDraft(selected.input, evidence, this.#allowedDomains);
+        return { ...draft, reviewStatus: "draft-needs-owner-review", research: { model: this.model, generatedAt: this.#now.toISOString(), sourceCount: evidence.size, topic: input.topic.trim(), kind: input.kind } };
+    }
+}
+export async function generateSellerResearch(input) {
+    const kind = input.kind;
+    const output = resolve(input.output || fail("ARGUMENT_REQUIRED", "seller research requires --output"));
+    let context;
+    if (input.contextFile) {
+        const path = resolve(input.contextFile);
+        if ((statSync(path).mode & 0o077) !== 0)
+            fail("SELLER_CONFIG_PERMISSIONS", "research context file must be owner-only");
+        context = asObject(JSON.parse(readFileSync(path, "utf8")));
+    }
+    const allowedDomains = input.allowedDomains?.split(",").map((item) => item.trim()).filter(Boolean);
+    const researcher = new ClaudeSellerResearcher({ ...(input.apiKey ? { apiKey: input.apiKey } : {}), ...(input.model ? { model: input.model } : {}), ...(input.fetch ? { fetch: input.fetch } : {}), ...(allowedDomains?.length ? { allowedDomains } : {}) });
+    const draft = await researcher.research({ kind, topic: input.topic, ...(context ? { context } : {}) });
+    writeFileSync(output, `${JSON.stringify(draft, null, 2)}\n`, { mode: 0o600, flag: "wx" });
+    return { output, kind, topic: input.topic, model: researcher.model, citations: draft.citations.length, reviewStatus: draft.reviewStatus, nextStep: "Review every claim and citation, then set reviewStatus to approved before catalog generation or seller packaging." };
+}

package/dist/seller-scaffold.d.ts

@@ -0,0 +1 @@
+export declare function scaffoldSeller(input: Record<string, string | boolean>): Record<string, unknown>;

package/dist/seller-scaffold.js

@@ -0,0 +1,35 @@
+import { chmodSync, mkdirSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { fail } from "./errors.js";
+const idPattern = /^[a-z0-9][a-z0-9._-]{1,127}$/;
+export function scaffoldSeller(input) {
+    const home = typeof input.home === "string" ? resolve(input.home) : fail("ARGUMENT_REQUIRED", "seller scaffold requires --home");
+    const output = typeof input.output === "string" ? resolve(input.output) : fail("ARGUMENT_REQUIRED", "seller scaffold requires --output");
+    const capabilityId = String(input["capability-id"] ?? ""), capability = String(input.capability ?? ""), description = String(input.description ?? ""), origin = String(input.origin ?? ""), price = String(input.price ?? "");
+    if (!idPattern.test(capabilityId) || !idPattern.test(capability))
+        fail("SELLER_SCAFFOLD_INVALID", "capability identifiers must use 2..128 lowercase letters, digits, dot, underscore, or dash");
+    if (!description || description.length > 512 || !/^[1-9][0-9]*$/.test(price))
+        fail("SELLER_SCAFFOLD_INVALID", "description and positive MIST --price are required");
+    const url = new URL(origin);
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && ["localhost", "127.0.0.1", "::1"].includes(url.hostname)) || url.username || url.password || url.pathname !== "/" || url.search || url.hash)
+        fail("SELLER_SCAFFOLD_INVALID", "origin must be an HTTPS or loopback HTTP origin without path or credentials");
+    const rails = String(input.rails ?? "x402").split(",").map((rail) => rail.trim()).filter(Boolean);
+    if (!rails.length || rails.some((rail) => rail !== "x402" && rail !== "shielded") || new Set(rails).size !== rails.length)
+        fail("SELLER_SCAFFOLD_INVALID", "--rails must be x402, shielded, or x402,shielded");
+    const days = Number(input["expires-in-days"] ?? "30");
+    if (!Number.isSafeInteger(days) || days < 1 || days > 365)
+        fail("SELLER_SCAFFOLD_INVALID", "--expires-in-days must be 1..365");
+    const listenPort = Number(input["listen-port"] ?? (url.protocol === "http:" && url.port ? url.port : "8788"));
+    if (!Number.isSafeInteger(listenPort) || listenPort < 1 || listenPort > 65535)
+        fail("SELLER_SCAFFOLD_INVALID", "--listen-port must be 1..65535");
+    mkdirSync(output, { recursive: false, mode: 0o700 });
+    chmodSync(output, 0o700);
+    const specPath = resolve(output, "capability.json"), handlerPath = resolve(output, "handler.mjs"), registrationPath = resolve(output, "registration.json"), servicePath = resolve(output, "seller-service.json");
+    const spec = { capabilityId, capability, description, inputSchema: { type: "object", required: ["task"], properties: { task: { type: "string", minLength: 1, maxLength: 4096 } }, additionalProperties: false }, outputSchema: { type: "object", required: ["kind"], properties: { kind: { const: capability } }, additionalProperties: false }, supportedRails: rails, priceBand: { minimum: price, maximum: price }, asset: "0x2::sui::SUI", endpoint: `${url.origin}/v2/resource/${capabilityId}`, expiresAt: Date.now() + days * 86_400_000 };
+    const handler = `export async function handle(request) {\n  const result = { kind: ${JSON.stringify(capability)}, task: request.input.task, message: "Replace this template with your seller implementation." };\n  return { artifact: Buffer.from(JSON.stringify(result)), contentType: "application/json", metadata: { kind: ${JSON.stringify(capability)} } };\n}\n`;
+    const service = { origin: url.origin, listenHost: "127.0.0.1", listenPort, ...(rails.includes("x402") ? { facilitatorUrlEnv: "X402_FACILITATOR_URL", facilitatorKeyEnv: "FACILITATOR_SHARED_KEY" } : {}), capabilities: [{ registrationFile: registrationPath, handler: handlerPath }] };
+    writeFileSync(specPath, `${JSON.stringify(spec, null, 2)}\n`, { mode: 0o600, flag: "wx" });
+    writeFileSync(handlerPath, handler, { mode: 0o600, flag: "wx" });
+    writeFileSync(servicePath, `${JSON.stringify(service, null, 2)}\n`, { mode: 0o600, flag: "wx" });
+    return { home, output, specFile: specPath, handlerFile: handlerPath, registrationFile: registrationPath, serviceFile: servicePath, expiresAt: spec.expiresAt, nextCommands: [`supercuts-seller-register ${JSON.stringify(home)} ${JSON.stringify(specPath)} ${JSON.stringify(registrationPath)}`, `supercuts-seller-live ${JSON.stringify(home)} ${JSON.stringify(servicePath)}`], note: "Review and replace the generated handler before serving production work." };
+}

package/dist/seller-service.d.ts

@@ -18,7 +18,7 @@ export declare class SellerService {
         facilitatorUrl: string;
         facilitatorKey: string;
         allowedBuyers: ReadonlySet<string>;
-        claudeKey: string;
+        claudeKey?: string;
         directoryAggregator?: string;
     }): Promise<SellerService>;
     private artifact;

package/dist/seller-service.js

@@ -4,7 +4,6 @@ import { createServer } from "node:http";
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { BoundedClaude } from "./claude.js";
 import { decodeSuiPrivateKey } from "@mysten/sui/cryptography";
 import { Ed25519Keypair } from "@mysten/sui/keypairs/ed25519";
 import { isValidPersonalMessageSignature } from "@mysten/sui/verify";
@@ -35,10 +34,9 @@ export class SellerService {
     #v2 = new Map();
     #v2BySeller = new Map();
     #root = mkdtempSync(join(tmpdir(), "supercuts-sellers-"));
-    #claude;
     #queue = Promise.resolve();
     #healthy = true;
-    constructor(db, snapshotKey, origin, facilitatorUrl, facilitatorKey, allowedBuyers, claudeKey, directoryAggregator) {
+    constructor(db, snapshotKey, origin, facilitatorUrl, facilitatorKey, allowedBuyers, directoryAggregator) {
         this.db = db;
         this.snapshotKey = snapshotKey;
         this.origin = origin;
@@ -46,10 +44,9 @@ export class SellerService {
         this.facilitatorKey = facilitatorKey;
         this.allowedBuyers = allowedBuyers;
         this.directoryAggregator = directoryAggregator;
-        this.#claude = new BoundedClaude({ apiKey: claudeKey });
     }
     static async create(config) {
-        const service = new SellerService(config.db, config.snapshotKey, config.origin, config.facilitatorUrl, config.facilitatorKey, config.allowedBuyers, config.claudeKey, config.directoryAggregator);
+        const service = new SellerService(config.db, config.snapshotKey, config.origin, config.facilitatorUrl, config.facilitatorKey, config.allowedBuyers, config.directoryAggregator);
         const rows = (await config.db.listCatalog()).filter((row) => !(isV2(row) && row.manifest.expiresAt <= Date.now()));
         for (const row of rows) {
             validateCapabilityManifest(row.manifest);
@@ -271,10 +268,6 @@ export class SellerService {
                     const opening = BigInt(String(offer.opening ?? "0")), maximum = BigInt(String(offer.maximum ?? "0")), minimum = BigInt(row.manifest.priceBand.minimum), briefHash = typeof offer.briefHash === "string" ? offer.briefHash : undefined;
                     if (opening <= 0n || opening > maximum || maximum < minimum || maximum > BigInt(row.manifest.priceBand.maximum) || briefHash !== undefined && !/^[0-9a-f]{64}$/.test(briefHash))
                         fail("NEGOTIATION_BOUNDS_INVALID", "buyer offer exceeds approved price bounds");
-                    const task = String(offer.task ?? "").slice(0, 512);
-                    const decision = await this.#claude.decide({ system: "You are a bounded research seller. Present only the fixed price and service terms approved by Supercuts.", task, candidates: [{ action: "counteroffer", capabilityId, amount: minimum.toString() }], schema: { name: "respond_to_private_offer", description: "Present the approved exact price.", properties: { action: { type: "string", enum: ["counteroffer"] } }, required: ["action"] } });
-                    if (decision.action.action !== "counteroffer")
-                        fail("SELLER_DECISION_INVALID", "seller did not choose the approved response");
                     const reply = { capabilityId, amount: minimum.toString(), asset: row.manifest.asset, railOptions: row.manifest.supportedRails, accepted: true };
                     const replyCiphertext = encryptSessionMessage(key, sessionId, `${sessionId}:seller:2`, Buffer.from(JSON.stringify(reply)));
                     const requestBlobId = await this.publishCiphertext(slot, ciphertext), replyBlobId = await this.publishCiphertext(slot, replyCiphertext);
@@ -291,7 +284,7 @@ export class SellerService {
                         this.#healthy = false;
                         throw error;
                     }
-                    await this.db.addEvent({ run_id: runId, seller_id: slot.sellerId, stage: "negotiation", status: "complete", details: { capabilityId, sessionId, requestBlobId, replyBlobId, transcriptHash, model: decision.model } });
+                    await this.db.addEvent({ run_id: runId, seller_id: slot.sellerId, stage: "negotiation", status: "complete", details: { capabilityId, sessionId, requestBlobId, replyBlobId, transcriptHash, decision: "policy-validated-fixed-price" } });
                     return this.reply(response, 200, { sessionId, capabilityId, ciphertext: replyCiphertext, signature, requestBlobId, replyBlobId, transcriptHash });
                 });
             }
@@ -316,9 +309,6 @@ export class SellerService {
                     const prior = slot.app.store.db.prepare("SELECT operation_id AS operationId,capability_id AS capabilityId,amount,artifact_key AS artifactKey,run_id AS runId FROM remote_quotes WHERE request_id=?").get(requestId);
                     if (prior && JSON.stringify(prior) !== JSON.stringify({ operationId, capabilityId, amount: quote.amount, artifactKey: quote.artifactKey, runId }))
                         fail("SELLER_QUOTE_CONFLICT", "request ID identifies another quote");
-                    const decision = await this.#claude.decide({ system: "You are a bounded seller agent. You may present only the fixed approved quote.", task: String(input.task ?? "Sui market brief").slice(0, 512), candidates: [{ action: "present_quote", capabilityId, amount: quote.amount }], schema: { name: "respond_to_buyer", description: "Present the approved exact price.", properties: { action: { type: "string", enum: ["present_quote"] } }, required: ["action"] } });
-                    if (decision.action.action !== "present_quote")
-                        fail("SELLER_DECISION_INVALID", "seller did not choose the approved quote");
                     slot.app.store.db.prepare("INSERT OR IGNORE INTO remote_quotes(request_id,operation_id,capability_id,amount,artifact_key,run_id) VALUES(?,?,?,?,?,?)").run(requestId, operationId, capabilityId, quote.amount, quote.artifactKey, runId);
                     const artifact = this.artifact(slot, quote.artifactKey), registration = this.resource(slot, row).register(requestId, operationId, artifact);
                     try {
@@ -328,7 +318,7 @@ export class SellerService {
                         this.#healthy = false;
                         throw error;
                     }
-                    await this.db.addEvent({ run_id: runId, seller_id: slot.sellerId, stage: "quote", status: "complete", details: { capabilityId, amount: quote.amount, model: decision.model } });
+                    await this.db.addEvent({ run_id: runId, seller_id: slot.sellerId, stage: "quote", status: "complete", details: { capabilityId, amount: quote.amount, decision: "manifest-fixed-price" } });
                     return this.reply(response, 200, { capabilityId, sellerId: slot.sellerId, amount: quote.amount, asset: row.manifest.asset, requestId, operationId, resourceUrl: registration.url, artifactSha256: registration.artifactSha256 });
                 });
             }
@@ -356,9 +346,6 @@ export class SellerService {
                     const prior = slot.app.store.db.prepare("SELECT capability_id AS capabilityId,artifact_key AS artifactKey,delivery_public_key AS deliveryPublicKey,run_id AS runId FROM remote_deliveries WHERE session_id=?").get(sessionId);
                     if (prior && JSON.stringify(prior) !== JSON.stringify({ capabilityId, artifactKey, deliveryPublicKey, runId }))
                         fail("AGREEMENT_SESSION_CONFLICT", "session identifies another delivery");
-                    const decision = await this.#claude.decide({ system: "You are a bounded seller agent. Sign only the backend-verified agreement.", task: `Respond to accepted competitor analysis request for ${capabilityId}.`, candidates: [{ action: "sign_approved_agreement", capabilityId }], schema: { name: "respond_to_private_offer", description: "Approve the backend-verified agreement.", properties: { action: { type: "string", enum: ["sign_approved_agreement"] } }, required: ["action"] } });
-                    if (decision.action.action !== "sign_approved_agreement")
-                        fail("SELLER_DECISION_INVALID", "seller did not choose the approved agreement");
                     const signed = await executeMandated(slot.app, loadMandate(slot.home), "offer.counter", { "operation-id": `remote-counter-${sessionId}`, session: sessionId, agreement: encoded });
                     slot.app.store.db.prepare("INSERT OR IGNORE INTO remote_deliveries(session_id,capability_id,artifact_key,delivery_public_key,run_id) VALUES(?,?,?,?,?)").run(sessionId, capabilityId, artifactKey, deliveryPublicKey, runId);
                     try {
@@ -368,7 +355,7 @@ export class SellerService {
                         this.#healthy = false;
                         throw error;
                     }
-                    await this.db.addEvent({ run_id: runId, seller_id: slot.sellerId, stage: "agreement", status: "complete", details: { capabilityId, sessionId, model: decision.model, dealCommitment: signed.dealCommitment } });
+                    await this.db.addEvent({ run_id: runId, seller_id: slot.sellerId, stage: "agreement", status: "complete", details: { capabilityId, sessionId, decision: "backend-verified-agreement", dealCommitment: signed.dealCommitment } });
                     return this.reply(response, 200, { sessionId, capabilityId, agreement: signed.agreement, dealCommitment: signed.dealCommitment, artifactSha256 });
                 });
             }
@@ -416,7 +403,7 @@ if (process.argv[1] && import.meta.url.endsWith(process.argv[1])) {
     const required = (key) => process.env[key] ?? fail("SELLER_CONFIG_MISSING", `${key} is required`);
     const port = Number(process.env.PORT ?? "3000");
     const origin = required("SELLER_ORIGIN");
-    SellerService.create({ db: new SellerDatabase(required("SUPABASE_URL"), required("SUPABASE_SERVICE_ROLE_KEY")), snapshotKey: required("SELLER_STATE_KEY"), origin, facilitatorUrl: required("FACILITATOR_URL"), facilitatorKey: required("FACILITATOR_SHARED_KEY"), allowedBuyers: new Set((process.env.SELLER_ALLOWED_BUYERS ?? "").split(",").map((item) => item.trim().toLowerCase()).filter(Boolean)), claudeKey: required("CLAUDE_API_KEY"), ...(process.env.DIRECTORY_WALRUS_AGGREGATOR ? { directoryAggregator: process.env.DIRECTORY_WALRUS_AGGREGATOR } : {}) })
+    SellerService.create({ db: new SellerDatabase(required("SUPABASE_URL"), required("SUPABASE_SERVICE_ROLE_KEY")), snapshotKey: required("SELLER_STATE_KEY"), origin, facilitatorUrl: required("FACILITATOR_URL"), facilitatorKey: required("FACILITATOR_SHARED_KEY"), allowedBuyers: new Set((process.env.SELLER_ALLOWED_BUYERS ?? "").split(",").map((item) => item.trim().toLowerCase()).filter(Boolean)), ...(process.env.DIRECTORY_WALRUS_AGGREGATOR ? { directoryAggregator: process.env.DIRECTORY_WALRUS_AGGREGATOR } : {}) })
         .then((service) => { const server = service.createServer(); server.listen(port, "0.0.0.0"); const close = () => server.close(() => { service.close(); process.exit(0); }); process.on("SIGINT", close); process.on("SIGTERM", close); })
         .catch((error) => { process.stderr.write(`${error instanceof Error ? error.message : "seller service failed"}\n`); process.exitCode = 1; });
 }

package/dist/seller-setup.d.ts

@@ -0,0 +1,3 @@
+export declare function createSellerSession(home: string): Record<string, unknown>;
+export declare function setupSeller(home: string, configPath: string): Record<string, unknown>;
+export declare function promptSellerSetup(home: string): Promise<Record<string, unknown>>;

package/dist/seller-setup.js

@@ -0,0 +1,107 @@
+import { chmodSync, existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { createInterface } from "node:readline/promises";
+import { decodeSuiPrivateKey } from "@mysten/sui/cryptography";
+import { Ed25519Keypair } from "@mysten/sui/keypairs/ed25519";
+import { fail } from "./errors.js";
+import { initialize } from "./phase3.js";
+function ownerFile(path) {
+    if ((statSync(path).mode & 0o077) !== 0)
+        fail("SETUP_PERMISSIONS", `${path} must be owner-only`);
+}
+function validateConfig(config) {
+    config.deploymentConfig ||= join(dirname(fileURLToPath(import.meta.url)), "../config/phase1.testnet.json");
+    for (const key of ["deploymentConfig", "tatumKeyFile", "writeGrpc", "tatumGrpc", "walrusPublisher", "walrusAggregator"]) {
+        if (typeof config[key] !== "string" || !config[key])
+            fail("SETUP_INVALID", `${key} is required`);
+    }
+    ownerFile(resolve(config.tatumKeyFile));
+    if (config.suiKeyFile)
+        ownerFile(resolve(config.suiKeyFile));
+    const deployment = JSON.parse(readFileSync(resolve(config.deploymentConfig), "utf8"));
+    if (deployment.network !== "testnet" || deployment.testOnly !== true || deployment.verifierVersion !== 2)
+        fail("SETUP_INVALID", "seller setup requires the pinned experimental v2 Testnet deployment");
+    return config;
+}
+function readConfig(path) {
+    ownerFile(path);
+    return validateConfig(JSON.parse(readFileSync(path, "utf8")));
+}
+export function createSellerSession(home) {
+    if (!existsSync(join(home, "profile.json")))
+        fail("SETUP_REQUIRED", "initialize the seller before creating an agent session");
+    const mcpScript = join(dirname(fileURLToPath(import.meta.url)), "mcp-bootstrap.js");
+    const mcp = `[mcp_servers.supercuts-seller]\ncommand = ${JSON.stringify(process.execPath)}\nargs = ${JSON.stringify([mcpScript])}\n[mcp_servers.supercuts-seller.env]\nSUPERCUTS_HOME = ${JSON.stringify(home)}\n`;
+    const mcpConfig = join(home, "seller-codex.toml");
+    writeFileSync(mcpConfig, mcp, { mode: 0o600 });
+    chmodSync(mcpConfig, 0o600);
+    return { mcpConfig };
+}
+function setupSellerConfig(home, config) {
+    if (existsSync(join(home, "profile.json")))
+        fail("PROFILE_EXISTS", "seller home already exists; create a separate home for another seller identity");
+    mkdirSync(home, { recursive: true, mode: 0o700 });
+    chmodSync(home, 0o700);
+    const keyPath = config.suiKeyFile ? resolve(config.suiKeyFile) : join(home, "seller.sui.key");
+    if (!config.suiKeyFile)
+        writeFileSync(keyPath, Ed25519Keypair.generate().getSecretKey(), { mode: 0o600, flag: "wx" });
+    ownerFile(keyPath);
+    initialize(home, {
+        role: "seller",
+        "deployment-config": resolve(config.deploymentConfig),
+        "sui-key-file": keyPath,
+        "tatum-key-file": resolve(config.tatumKeyFile),
+        "write-grpc": config.writeGrpc,
+        "tatum-grpc": config.tatumGrpc,
+        "walrus-publisher": config.walrusPublisher,
+        "walrus-aggregator": config.walrusAggregator,
+        ...(config.snarkjs ? { snarkjs: resolve(config.snarkjs) } : {}),
+        ...(config.converter ? { converter: resolve(config.converter) } : {}),
+        ...(config.rapidsnark ? { rapidsnark: resolve(config.rapidsnark) } : {}),
+    });
+    const decoded = decodeSuiPrivateKey(readFileSync(keyPath, "utf8").trim());
+    if (decoded.scheme !== "ED25519")
+        fail("SETUP_INVALID", "seller key must use ED25519");
+    const address = Ed25519Keypair.fromSecretKey(decoded.secretKey).toSuiAddress();
+    return {
+        home,
+        address,
+        fundingRequired: false,
+        warning: "Do not faucet-fund the seller. Only a generated buyer address is funded for live purchases.",
+        ...createSellerSession(home),
+        nextStep: `Run supercuts seller scaffold --home ${JSON.stringify(home)} --output <offer-dir> with the capability, origin, price, rails, and expiry options. Review the handler, then run the printed registration and service commands.`,
+    };
+}
+export function setupSeller(home, configPath) {
+    return setupSellerConfig(home, readConfig(resolve(configPath)));
+}
+export async function promptSellerSetup(home) {
+    if (!process.stdin.isTTY)
+        fail("SETUP_INPUT_REQUIRED", "interactive seller setup requires a terminal; use --config with an owner-only JSON file");
+    const rl = createInterface({ input: process.stdin, output: process.stderr });
+    try {
+        const ask = async (label) => (await rl.question(`${label}: `)).trim();
+        const config = {
+            deploymentConfig: await ask("Pinned v2 Testnet deployment config path (blank for bundled config)"),
+            tatumKeyFile: await ask("Owner-only Tatum key file path"),
+            writeGrpc: await ask("Sui write gRPC URL"),
+            tatumGrpc: await ask("Tatum read gRPC URL"),
+            walrusPublisher: await ask("Walrus publisher URL"),
+            walrusAggregator: await ask("Walrus aggregator URL"),
+        };
+        const snarkjs = await ask("SnarkJS executable path (blank for deployment-relative default)");
+        const converter = await ask("Groth16 converter path (blank for deployment-relative default)");
+        const rapidsnark = await ask("RapidSnark executable path (blank to use SnarkJS)");
+        if (snarkjs)
+            config.snarkjs = snarkjs;
+        if (converter)
+            config.converter = converter;
+        if (rapidsnark)
+            config.rapidsnark = rapidsnark;
+        return setupSellerConfig(home, validateConfig(config));
+    }
+    finally {
+        rl.close();
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supercuts-walrus/backend",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "private": false,
   "type": "module",
   "exports": {
@@ -29,6 +29,7 @@
   },
   "files": [
     "dist",
+    "config",
     "README.md"
   ],
   "license": "Apache-2.0",