@tabai/sdk 0.2.0

package/dist/cli/connect.js

@@ -0,0 +1,158 @@
+/**
+ * `tab connect`: the one line of configuration.
+ *
+ * The whole adoption story is this command. It finds the MCP client's server
+ * list, reads the deployment keylessly so it can tell the caller what they are
+ * about to be connected to, merges one `mcpServers.tab` stanza, backs up what
+ * was there, and prints the diff.
+ *
+ * ## Read before write
+ *
+ * The keyless read happens first and its result is reported whether it succeeded
+ * or not. A `connect` that silently wrote a stanza pointing at a registry that
+ * does not answer would look like success and behave like a broken install, and
+ * the person running it would find out from a model instead of from the command.
+ * The read never blocks the write: a deployment that is temporarily down is not
+ * a reason to refuse to configure a client against it.
+ *
+ * ## Nothing here is a secret
+ *
+ * The stanza carries a command, its arguments, and at most two URLs. Every value
+ * in it is publishable. {@link assertNoSecret} runs over the merged document
+ * before anything is written, so the property is enforced rather than asserted
+ * in a comment.
+ *
+ * Requirements: 25.5, 25.6
+ */
+import { ok } from "../_shared/index.js";
+import { validationError } from "../errors.js";
+import { silentLogger } from "../logger.js";
+import { asArray, field } from "../mcp/json.js";
+import { createRegistryReadClient } from "../mcp/registry-client.js";
+import { buildTabStanza, chooseMcpClient, detectMcpClients, mergeTabStanza, readClientConfig, renderConfig, unifiedDiff, writeClientConfig, } from "./client-config.js";
+/** The environment values that belong in a stanza. Publishable, all of them. */
+function stanzaEnv(settings, env) {
+    const values = {};
+    const rpc = settings.rpcUrl ?? env["MONAD_RPC_URL"];
+    if (rpc !== undefined && rpc.trim() !== "")
+        values["MONAD_RPC_URL"] = rpc.trim();
+    values["MONAD_CHAIN_ID"] = String(settings.chainId);
+    const registry = settings.registryUrl ?? env["NEXT_PUBLIC_REGISTRY_API_URL"];
+    if (registry !== undefined && registry.trim() !== "")
+        values["NEXT_PUBLIC_REGISTRY_API_URL"] = registry.trim();
+    return values;
+}
+/** Reads the deployment, keylessly, so `connect` can say what it connected to. */
+async function preflight(settings, fetchImpl, logger) {
+    if (settings.registryUrl === undefined) {
+        return {
+            registryUrl: undefined,
+            services: null,
+            note: "no registry read API is configured, so discovery and status will not work until one is. Calling and settling do not need it",
+        };
+    }
+    const registry = createRegistryReadClient({
+        baseUrl: settings.registryUrl,
+        logger,
+        ...(fetchImpl === undefined ? {} : { fetchImpl }),
+    });
+    const services = await registry.services(50);
+    if (!services.ok) {
+        return {
+            registryUrl: registry.baseUrl,
+            services: null,
+            note: `the read API did not answer: ${services.error.message}`,
+        };
+    }
+    const count = asArray(field(services.value, "services")).length;
+    const lastBlock = field(field(services.value, "index"), "lastBlock");
+    return {
+        registryUrl: registry.baseUrl,
+        services: count,
+        note: typeof lastBlock === "number"
+            ? `${count} Service(s) indexed at Monad block ${lastBlock}`
+            : `${count} Service(s) indexed`,
+    };
+}
+/** Resolves which file to write, from `--config`, then `--client`, then detection. */
+function resolveTarget(options) {
+    if (options.configPath !== undefined) {
+        return ok({ id: options.client ?? "custom", configPath: options.configPath });
+    }
+    const detected = detectMcpClients({
+        ...(options.os === undefined ? {} : { os: options.os }),
+        ...(options.env === undefined ? {} : { env: options.env }),
+        ...(options.cwd === undefined ? {} : { cwd: options.cwd }),
+    });
+    if (options.client !== undefined) {
+        const named = detected.find((target) => target.id === options.client);
+        if (named === undefined || named.configPath === undefined) {
+            return validationError("CLIENT_UNKNOWN", `\`${options.client}\` is not an MCP client this command knows on this platform; the known ones are ${detected
+                .filter((target) => target.configPath !== undefined)
+                .map((target) => target.id)
+                .join(", ")}`, { details: { client: options.client } });
+        }
+        return ok({ id: named.id, configPath: named.configPath });
+    }
+    const chosen = chooseMcpClient(detected);
+    if (!chosen.ok)
+        return chosen;
+    if (chosen.value.configPath === undefined) {
+        return validationError("CLIENT_UNKNOWN", `\`${chosen.value.id}\` has no config path on this platform`);
+    }
+    return ok({ id: chosen.value.id, configPath: chosen.value.configPath });
+}
+/**
+ * Runs the command.
+ *
+ * Every failure is a `Result`, including a config file that will not parse. The
+ * one thing this never does is write over something it could not read.
+ */
+export async function runConnect(options) {
+    const env = options.env ?? process.env;
+    const logger = options.logger ?? silentLogger;
+    const at = (options.now ?? (() => new Date()))();
+    const dryRun = options.dryRun ?? false;
+    const target = resolveTarget(options);
+    if (!target.ok)
+        return target;
+    const read = readClientConfig(target.value.configPath);
+    if (!read.ok)
+        return read;
+    const stanza = buildTabStanza(stanzaEnv(options.settings, env));
+    const merged = mergeTabStanza(read.value.document, stanza);
+    if (!merged.ok)
+        return merged;
+    const checked = await preflight(options.settings, options.fetchImpl, logger);
+    const before = read.value.existed ? renderConfig(read.value.document) : "";
+    const after = renderConfig(merged.value.merged);
+    const diff = merged.value.changed ? unifiedDiff(before, after) : "";
+    if (dryRun) {
+        return ok({
+            client: target.value.id,
+            configPath: target.value.configPath,
+            changed: merged.value.changed,
+            hadStanza: merged.value.hadStanza,
+            backupPath: undefined,
+            stanza,
+            diff,
+            preflight: checked,
+            dryRun: true,
+        });
+    }
+    const written = writeClientConfig(target.value.configPath, merged.value, read.value.existed, at);
+    if (!written.ok)
+        return written;
+    return ok({
+        client: target.value.id,
+        configPath: target.value.configPath,
+        changed: written.value.wrote,
+        hadStanza: merged.value.hadStanza,
+        backupPath: written.value.backupPath,
+        stanza,
+        diff,
+        preflight: checked,
+        dryRun: false,
+    });
+}
+//# sourceMappingURL=connect.js.map

package/dist/cli/connect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect.js","sourceRoot":"","sources":["../../src/cli/connect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,EAAE,EAAE,EAAE,MAAM,eAAe,CAAC;AAEnC,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,wBAAwB,EAAsB,MAAM,2BAA2B,CAAC;AAEzF,OAAO,EACL,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,iBAAiB,GAIlB,MAAM,oBAAoB,CAAC;AA0C5B,gFAAgF;AAChF,SAAS,SAAS,CAAC,QAAwB,EAAE,GAAsB;IACjE,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IACpD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,MAAM,CAAC,eAAe,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACjF,MAAM,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,QAAQ,CAAC,WAAW,IAAI,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAC7E,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,MAAM,CAAC,8BAA8B,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/G,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,kFAAkF;AAClF,KAAK,UAAU,SAAS,CACtB,QAAwB,EACxB,SAAoC,EACpC,MAAc;IAEd,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACvC,OAAO;YACL,WAAW,EAAE,SAAS;YACtB,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,6HAA6H;SACpI,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,wBAAwB,CAAC;QACxC,OAAO,EAAE,QAAQ,CAAC,WAAW;QAC7B,MAAM;QACN,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;KAClD,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO;YACL,WAAW,EAAE,QAAQ,CAAC,OAAO;YAC7B,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,gCAAgC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE;SAC/D,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;IAChE,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,WAAW,CAAC,CAAC;IACrE,OAAO;QACL,WAAW,EAAE,QAAQ,CAAC,OAAO;QAC7B,QAAQ,EAAE,KAAK;QACf,IAAI,EACF,OAAO,SAAS,KAAK,QAAQ;YAC3B,CAAC,CAAC,GAAG,KAAK,sCAAsC,SAAS,EAAE;YAC3D,CAAC,CAAC,GAAG,KAAK,qBAAqB;KACpC,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,SAAS,aAAa,CAAC,OAAuB;IAC5C,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACrC,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,IAAI,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC;QAChC,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;QACvD,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1D,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;KAC3D,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,KAAK,GAAgC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;QACnG,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAC1D,OAAO,eAAe,CACpB,gBAAgB,EAChB,KAAK,OAAO,CAAC,MAAM,mFAAmF,QAAQ;iBAC3G,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC;iBACnD,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;iBAC1B,IAAI,CAAC,IAAI,CAAC,EAAE,EACf,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CACxC,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC;IAC9B,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,eAAe,CAAC,gBAAgB,EAAE,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,wCAAwC,CAAC,CAAC;IACzG,CAAC;IACD,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAuB;IACtD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,YAAY,CAAC;IAC9C,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;IACjD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC;IAEvC,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC;IAE9B,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACvD,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAE1B,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC3D,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC;IAE9B,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAE7E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEpE,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,EAAE,CAAC;YACR,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE;YACvB,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU;YACnC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;YAC7B,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS;YACjC,UAAU,EAAE,SAAS;YACrB,MAAM;YACN,IAAI;YACJ,SAAS,EAAE,OAAO;YAClB,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACjG,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC;IAEhC,OAAO,EAAE,CAAC;QACR,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE;QACvB,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU;QACnC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK;QAC5B,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS;QACjC,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,UAAU;QACpC,MAAM;QACN,IAAI;QACJ,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * `tab connect`: the one line of configuration.\n *\n * The whole adoption story is this command. It finds the MCP client's server\n * list, reads the deployment keylessly so it can tell the caller what they are\n * about to be connected to, merges one `mcpServers.tab` stanza, backs up what\n * was there, and prints the diff.\n *\n * ## Read before write\n *\n * The keyless read happens first and its result is reported whether it succeeded\n * or not. A `connect` that silently wrote a stanza pointing at a registry that\n * does not answer would look like success and behave like a broken install, and\n * the person running it would find out from a model instead of from the command.\n * The read never blocks the write: a deployment that is temporarily down is not\n * a reason to refuse to configure a client against it.\n *\n * ## Nothing here is a secret\n *\n * The stanza carries a command, its arguments, and at most two URLs. Every value\n * in it is publishable. {@link assertNoSecret} runs over the merged document\n * before anything is written, so the property is enforced rather than asserted\n * in a comment.\n *\n * Requirements: 25.5, 25.6\n */\n\nimport type { Result } from \"../_shared/index.js\";\nimport { ok } from \"../_shared/index.js\";\n\nimport { validationError } from \"../errors.js\";\nimport type { Logger } from \"../logger.js\";\nimport { silentLogger } from \"../logger.js\";\nimport { asArray, field } from \"../mcp/json.js\";\nimport { createRegistryReadClient, type RegistryFetch } from \"../mcp/registry-client.js\";\nimport type { TabMcpSettings } from \"../mcp/settings.js\";\nimport {\n  buildTabStanza,\n  chooseMcpClient,\n  detectMcpClients,\n  mergeTabStanza,\n  readClientConfig,\n  renderConfig,\n  unifiedDiff,\n  writeClientConfig,\n  type McpClientTarget,\n  type StanzaEnv,\n  type TabStanza,\n} from \"./client-config.js\";\n\nexport interface ConnectOptions {\n  readonly settings: TabMcpSettings;\n  /** `claude-code`, `claude-desktop`, `cursor`, `windsurf` or `vscode`. */\n  readonly client?: string;\n  /** An explicit config file, which beats `client` and skips detection. */\n  readonly configPath?: string;\n  readonly env?: NodeJS.ProcessEnv;\n  readonly os?: string;\n  readonly cwd?: string;\n  /** Injectable clock, so a backup name is testable. */\n  readonly now?: () => Date;\n  /** Work out and print everything, and write nothing. */\n  readonly dryRun?: boolean;\n  readonly fetchImpl?: RegistryFetch;\n  readonly logger?: Logger;\n}\n\n/** What the deployment said when it was asked, before anything was written. */\nexport interface ConnectPreflight {\n  readonly registryUrl: string | undefined;\n  /** Services indexed, or null when the read API did not answer. */\n  readonly services: number | null;\n  readonly note: string;\n}\n\nexport interface ConnectReport {\n  readonly client: string;\n  readonly configPath: string;\n  /** False when the file already said exactly this. */\n  readonly changed: boolean;\n  /** True when a `tab` stanza was already there, so a message can say updated. */\n  readonly hadStanza: boolean;\n  readonly backupPath: string | undefined;\n  readonly stanza: TabStanza;\n  /** Empty when nothing changed. */\n  readonly diff: string;\n  readonly preflight: ConnectPreflight;\n  readonly dryRun: boolean;\n}\n\n/** The environment values that belong in a stanza. Publishable, all of them. */\nfunction stanzaEnv(settings: TabMcpSettings, env: NodeJS.ProcessEnv): StanzaEnv {\n  const values: Record<string, string> = {};\n  const rpc = settings.rpcUrl ?? env[\"MONAD_RPC_URL\"];\n  if (rpc !== undefined && rpc.trim() !== \"\") values[\"MONAD_RPC_URL\"] = rpc.trim();\n  values[\"MONAD_CHAIN_ID\"] = String(settings.chainId);\n  const registry = settings.registryUrl ?? env[\"NEXT_PUBLIC_REGISTRY_API_URL\"];\n  if (registry !== undefined && registry.trim() !== \"\") values[\"NEXT_PUBLIC_REGISTRY_API_URL\"] = registry.trim();\n  return values;\n}\n\n/** Reads the deployment, keylessly, so `connect` can say what it connected to. */\nasync function preflight(\n  settings: TabMcpSettings,\n  fetchImpl: RegistryFetch | undefined,\n  logger: Logger,\n): Promise<ConnectPreflight> {\n  if (settings.registryUrl === undefined) {\n    return {\n      registryUrl: undefined,\n      services: null,\n      note: \"no registry read API is configured, so discovery and status will not work until one is. Calling and settling do not need it\",\n    };\n  }\n  const registry = createRegistryReadClient({\n    baseUrl: settings.registryUrl,\n    logger,\n    ...(fetchImpl === undefined ? {} : { fetchImpl }),\n  });\n  const services = await registry.services(50);\n  if (!services.ok) {\n    return {\n      registryUrl: registry.baseUrl,\n      services: null,\n      note: `the read API did not answer: ${services.error.message}`,\n    };\n  }\n  const count = asArray(field(services.value, \"services\")).length;\n  const lastBlock = field(field(services.value, \"index\"), \"lastBlock\");\n  return {\n    registryUrl: registry.baseUrl,\n    services: count,\n    note:\n      typeof lastBlock === \"number\"\n        ? `${count} Service(s) indexed at Monad block ${lastBlock}`\n        : `${count} Service(s) indexed`,\n  };\n}\n\n/** Resolves which file to write, from `--config`, then `--client`, then detection. */\nfunction resolveTarget(options: ConnectOptions): Result<{ id: string; configPath: string }> {\n  if (options.configPath !== undefined) {\n    return ok({ id: options.client ?? \"custom\", configPath: options.configPath });\n  }\n  const detected = detectMcpClients({\n    ...(options.os === undefined ? {} : { os: options.os }),\n    ...(options.env === undefined ? {} : { env: options.env }),\n    ...(options.cwd === undefined ? {} : { cwd: options.cwd }),\n  });\n  if (options.client !== undefined) {\n    const named: McpClientTarget | undefined = detected.find((target) => target.id === options.client);\n    if (named === undefined || named.configPath === undefined) {\n      return validationError(\n        \"CLIENT_UNKNOWN\",\n        `\\`${options.client}\\` is not an MCP client this command knows on this platform; the known ones are ${detected\n          .filter((target) => target.configPath !== undefined)\n          .map((target) => target.id)\n          .join(\", \")}`,\n        { details: { client: options.client } },\n      );\n    }\n    return ok({ id: named.id, configPath: named.configPath });\n  }\n  const chosen = chooseMcpClient(detected);\n  if (!chosen.ok) return chosen;\n  if (chosen.value.configPath === undefined) {\n    return validationError(\"CLIENT_UNKNOWN\", `\\`${chosen.value.id}\\` has no config path on this platform`);\n  }\n  return ok({ id: chosen.value.id, configPath: chosen.value.configPath });\n}\n\n/**\n * Runs the command.\n *\n * Every failure is a `Result`, including a config file that will not parse. The\n * one thing this never does is write over something it could not read.\n */\nexport async function runConnect(options: ConnectOptions): Promise<Result<ConnectReport>> {\n  const env = options.env ?? process.env;\n  const logger = options.logger ?? silentLogger;\n  const at = (options.now ?? (() => new Date()))();\n  const dryRun = options.dryRun ?? false;\n\n  const target = resolveTarget(options);\n  if (!target.ok) return target;\n\n  const read = readClientConfig(target.value.configPath);\n  if (!read.ok) return read;\n\n  const stanza = buildTabStanza(stanzaEnv(options.settings, env));\n  const merged = mergeTabStanza(read.value.document, stanza);\n  if (!merged.ok) return merged;\n\n  const checked = await preflight(options.settings, options.fetchImpl, logger);\n\n  const before = read.value.existed ? renderConfig(read.value.document) : \"\";\n  const after = renderConfig(merged.value.merged);\n  const diff = merged.value.changed ? unifiedDiff(before, after) : \"\";\n\n  if (dryRun) {\n    return ok({\n      client: target.value.id,\n      configPath: target.value.configPath,\n      changed: merged.value.changed,\n      hadStanza: merged.value.hadStanza,\n      backupPath: undefined,\n      stanza,\n      diff,\n      preflight: checked,\n      dryRun: true,\n    });\n  }\n\n  const written = writeClientConfig(target.value.configPath, merged.value, read.value.existed, at);\n  if (!written.ok) return written;\n\n  return ok({\n    client: target.value.id,\n    configPath: target.value.configPath,\n    changed: written.value.wrote,\n    hadStanza: merged.value.hadStanza,\n    backupPath: written.value.backupPath,\n    stanza,\n    diff,\n    preflight: checked,\n    dryRun: false,\n  });\n}\n"]}

package/dist/cli/doctor.d.ts

@@ -0,0 +1,57 @@
+/**
+ * `tab doctor`: every check that can be made without a key.
+ *
+ * The point of the command is that a person who has just run `tab connect` can
+ * find out whether it worked before they ask a model to spend anything. So every
+ * check here is a read -- an `eth_chainId`, an `eth_getCode`, a `GET /healthz`.
+ * Nothing here signs, nothing here writes, and nothing here loads a private key.
+ * The one thing it says about a signing key is whether the environment carries
+ * one at all, reported as present or absent and never read, because "you have no
+ * key configured" is the answer to why `tab_settle` will refuse, and printing the
+ * key would be the worst possible way to say it.
+ *
+ * ## Three outcomes, not two
+ *
+ * A check answers `pass`, `warn`, `fail` or `skip`, and the distinction carries
+ * weight. A missing registry read API is a `warn`: discovery and status will not
+ * work, but calling and settling will, so it is not a broken installation. An
+ * RPC endpoint that answers the wrong chain id is a `fail`: every address in the
+ * configuration names a contract on a different chain, and anything built on top
+ * of it would be wrong rather than absent. `skip` is for a check whose input was
+ * not configured, which is a statement about the configuration and not about the
+ * deployment.
+ *
+ * Requirements: 25.6, 28.6
+ */
+import type { Logger } from "../logger.js";
+import { type RegistryFetch } from "../mcp/registry-client.js";
+import type { TabMcpSettings } from "../mcp/settings.js";
+export type CheckStatus = "pass" | "warn" | "fail" | "skip";
+export interface DoctorCheck {
+    /** Short and stable, so a script can grep for one. */
+    readonly name: string;
+    readonly status: CheckStatus;
+    /** What was found, in one sentence. */
+    readonly detail: string;
+    /** What to do about it, when there is something to do. */
+    readonly hint?: string;
+}
+export interface DoctorReport {
+    readonly checks: readonly DoctorCheck[];
+    /** True when nothing failed. Warnings do not make a report unhealthy. */
+    readonly ok: boolean;
+    readonly counts: Readonly<Record<CheckStatus, number>>;
+}
+export interface DoctorOptions {
+    readonly settings: TabMcpSettings;
+    readonly env?: NodeJS.ProcessEnv;
+    /** The MCP client config to inspect, when the caller resolved one. */
+    readonly clientConfigPath?: string;
+    readonly fetchImpl?: RegistryFetch;
+    readonly logger?: Logger;
+    /** How long any one network read may take. Defaults to 10 seconds. */
+    readonly timeoutMs?: number;
+}
+/** Runs every check and answers the whole report. Never throws, never signs. */
+export declare function runDoctor(options: DoctorOptions): Promise<DoctorReport>;
+//# sourceMappingURL=doctor.d.ts.map

package/dist/cli/doctor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/cli/doctor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAG3C,OAAO,EAA4B,KAAK,aAAa,EAAE,MAAM,2BAA2B,CAAC;AACzF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAGzD,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAE5D,MAAM,WAAW,WAAW;IAC1B,sDAAsD;IACtD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,uCAAuC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,0DAA0D;IAC1D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,CAAC;IACxC,yEAAyE;IACzE,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;CACxD;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACjC,sEAAsE;IACtE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAkCD,gFAAgF;AAChF,wBAAsB,SAAS,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CA4I7E"}

package/dist/cli/doctor.js

@@ -0,0 +1,253 @@
+/**
+ * `tab doctor`: every check that can be made without a key.
+ *
+ * The point of the command is that a person who has just run `tab connect` can
+ * find out whether it worked before they ask a model to spend anything. So every
+ * check here is a read -- an `eth_chainId`, an `eth_getCode`, a `GET /healthz`.
+ * Nothing here signs, nothing here writes, and nothing here loads a private key.
+ * The one thing it says about a signing key is whether the environment carries
+ * one at all, reported as present or absent and never read, because "you have no
+ * key configured" is the answer to why `tab_settle` will refuse, and printing the
+ * key would be the worst possible way to say it.
+ *
+ * ## Three outcomes, not two
+ *
+ * A check answers `pass`, `warn`, `fail` or `skip`, and the distinction carries
+ * weight. A missing registry read API is a `warn`: discovery and status will not
+ * work, but calling and settling will, so it is not a broken installation. An
+ * RPC endpoint that answers the wrong chain id is a `fail`: every address in the
+ * configuration names a contract on a different chain, and anything built on top
+ * of it would be wrong rather than absent. `skip` is for a check whose input was
+ * not configured, which is a statement about the configuration and not about the
+ * deployment.
+ *
+ * Requirements: 25.6, 28.6
+ */
+import { JsonRpcProvider, Network } from "ethers";
+import { silentLogger } from "../logger.js";
+import { asArray, field, isRecord } from "../mcp/json.js";
+import { createRegistryReadClient } from "../mcp/registry-client.js";
+import { readClientConfig, TAB_SERVER_KEY, assertNoSecret } from "./client-config.js";
+/** The contracts a working deployment has code at, under their environment names. */
+const CONTRACTS = [
+    ["SERVICE_REGISTRY_ADDRESS", "ServiceRegistry"],
+    ["BOND_ADDRESS", "Bond"],
+    ["TAB_BOOK_ADDRESS", "TabBook"],
+    ["TAB_SETTLEMENT_ADDRESS", "TabSettlement"],
+];
+const ZERO_ADDRESS = "0x0000000000000000000000000000000000000000";
+const pass = (name, detail) => ({ name, status: "pass", detail });
+const warn = (name, detail, hint) => ({
+    name,
+    status: "warn",
+    detail,
+    ...(hint === undefined ? {} : { hint }),
+});
+const bad = (name, detail, hint) => ({
+    name,
+    status: "fail",
+    detail,
+    ...(hint === undefined ? {} : { hint }),
+});
+const skip = (name, detail, hint) => ({
+    name,
+    status: "skip",
+    detail,
+    ...(hint === undefined ? {} : { hint }),
+});
+const reason = (error) => (error instanceof Error ? error.message : String(error));
+/** Runs every check and answers the whole report. Never throws, never signs. */
+export async function runDoctor(options) {
+    const env = options.env ?? process.env;
+    const settings = options.settings;
+    const logger = options.logger ?? silentLogger;
+    const timeoutMs = options.timeoutMs ?? 10_000;
+    const checks = [];
+    // ---- the runtime
+    const major = Number.parseInt(process.versions.node.split(".")[0] ?? "0", 10);
+    checks.push(major >= 20
+        ? pass("node", `Node ${process.versions.node}`)
+        : bad("node", `Node ${process.versions.node}`, "the MCP server needs Node 20.10 or later for its global fetch"));
+    // ---- what is configured
+    checks.push(settings.agent === undefined
+        ? warn("agent", "no Agent address is configured", "set `agent` in tab.config; tab_call and tab_settle need to know whose Open Tab to meter")
+        : pass("agent", `${settings.agent} (${settings.sources["agent"] ?? "unknown source"})`));
+    checks.push(settings.services.length === 0
+        ? warn("service-directory", "no Service endpoints are configured", "the chain records no URL for a Service, so add each one to the `services` list in tab.config or tab_call has nowhere to send a request")
+        : pass("service-directory", `${settings.services.length} Service endpoint(s) configured`));
+    // ---- Monad, keyless
+    if (settings.rpcUrl === undefined) {
+        checks.push(skip("monad-rpc", "no Monad RPC endpoint is configured", "set MONAD_RPC_URL"), skip("monad-contracts", "skipped: there is no endpoint to read from"));
+    }
+    else {
+        const expected = settings.chainId;
+        // Pinned to the configured chain so ethers never probes the network on its
+        // own, and `eth_chainId` is then asked directly: a static network would
+        // otherwise answer the configured id without the endpoint being consulted,
+        // which is the one check this exists to make.
+        const provider = new JsonRpcProvider(settings.rpcUrl, Network.from(expected), { staticNetwork: true });
+        try {
+            const [answered, head] = await Promise.all([
+                withTimeout(provider.send("eth_chainId", []), timeoutMs, "eth_chainId"),
+                withTimeout(provider.getBlockNumber(), timeoutMs, "eth_blockNumber"),
+            ]);
+            const chainId = typeof answered === "string" ? Number.parseInt(answered, 16) : Number.NaN;
+            checks.push(chainId === expected
+                ? pass("monad-rpc", `chain id ${chainId} at block ${head}`)
+                : bad("monad-rpc", `the endpoint answers chain id ${chainId} and the configuration expects ${expected}`, "every contract address in the configuration names a contract on one chain; reading a different one would produce confident wrong answers"));
+            checks.push(...(await contractChecks(provider, env, timeoutMs)));
+        }
+        catch (error) {
+            checks.push(bad("monad-rpc", `${settings.rpcUrl} could not be read: ${reason(error)}`, "check MONAD_RPC_URL"), skip("monad-contracts", "skipped: the endpoint did not answer"));
+        }
+        finally {
+            provider.destroy();
+        }
+    }
+    // ---- the registry read API, keyless
+    if (settings.registryUrl === undefined) {
+        checks.push(warn("registry-api", "no registry read API is configured", "tab_discover and tab_status read from it; set NEXT_PUBLIC_REGISTRY_API_URL or `registryUrl` in tab.config. tab_call and tab_settle work without it"));
+    }
+    else {
+        const registry = createRegistryReadClient({
+            baseUrl: settings.registryUrl,
+            timeoutMs,
+            logger,
+            ...(options.fetchImpl === undefined ? {} : { fetchImpl: options.fetchImpl }),
+        });
+        const health = await registry.health();
+        if (!health.ok) {
+            checks.push(warn("registry-api", `${registry.baseUrl} did not answer: ${health.error.message}`, "start the registry read API, or point at a deployed one"));
+        }
+        else {
+            checks.push(pass("registry-api", `${registry.baseUrl} is healthy`));
+            const services = await registry.services(5);
+            if (!services.ok) {
+                checks.push(warn("registry-services", `the Service directory could not be read: ${services.error.message}`));
+            }
+            else {
+                const count = asArray(field(services.value, "services")).length;
+                const lastBlock = field(field(services.value, "index"), "lastBlock");
+                checks.push(count === 0
+                    ? warn("registry-services", "the read API is healthy and no Service is registered yet", "register a Service, or wait for the indexer to catch up")
+                    : pass("registry-services", `${count} Service(s) indexed${typeof lastBlock === "number" ? ` at Monad block ${lastBlock}` : ""}`));
+            }
+        }
+    }
+    // ---- each configured Service endpoint
+    checks.push(...(await endpointChecks(settings, options.fetchImpl, timeoutMs)));
+    // ---- the MCP client config
+    checks.push(clientConfigCheck(options.clientConfigPath));
+    // ---- the signing key, named and never read
+    const keyPresent = env["AGENT_PRIVATE_KEY"] !== undefined;
+    checks.push(keyPresent
+        ? pass("settlement-key", "AGENT_PRIVATE_KEY is set in this environment; its value is never read here or written anywhere")
+        : warn("settlement-key", "AGENT_PRIVATE_KEY is not set", "tab_settle signs the Settlement with the Agent's own key, read from the environment at signing time. Discovery, calling and status need no key"));
+    const counts = { pass: 0, warn: 0, fail: 0, skip: 0 };
+    for (const check of checks)
+        counts[check.status] += 1;
+    return { checks, ok: counts.fail === 0, counts };
+}
+/** `eth_getCode` at each configured contract address. */
+async function contractChecks(provider, env, timeoutMs) {
+    const configured = [];
+    for (const [variable, label] of CONTRACTS) {
+        const address = env[variable];
+        // The zero address is the placeholder `.env.example` ships before a
+        // deployment fills it in, so it means "not configured" and not "no code".
+        if (address === undefined)
+            continue;
+        if (!/^0x[a-fA-F0-9]{40}$/.test(address) || address.toLowerCase() === ZERO_ADDRESS)
+            continue;
+        configured.push({ variable, label, address });
+    }
+    if (configured.length === 0) {
+        return [
+            skip("monad-contracts", "no contract addresses are configured", "set SERVICE_REGISTRY_ADDRESS, BOND_ADDRESS, TAB_BOOK_ADDRESS and TAB_SETTLEMENT_ADDRESS"),
+        ];
+    }
+    const results = await Promise.all(configured.map(async (entry) => {
+        try {
+            // Pinned to `latest`, deliberately. Monad finalises within seconds, but a
+            // `finalized` read still lags the head, and a contract deployed within
+            // the lag would read as absent: a false failure at exactly the moment
+            // somebody is checking a fresh deployment.
+            const code = await withTimeout(provider.getCode(entry.address, "latest"), timeoutMs, "eth_getCode");
+            return { entry, hasCode: code !== undefined && code !== "0x" && code.length > 2, error: undefined };
+        }
+        catch (error) {
+            return { entry, hasCode: false, error: reason(error) };
+        }
+    }));
+    const missing = results.filter((result) => !result.hasCode);
+    if (missing.length === 0) {
+        return [pass("monad-contracts", `${results.length} contract(s) hold code: ${results.map((r) => r.entry.label).join(", ")}`)];
+    }
+    return [
+        bad("monad-contracts", `no code at ${missing.map((result) => `${result.entry.label} (${result.entry.address})`).join(", ")}`, "the addresses name nothing on this chain: check the environment against the deployment, and that the RPC endpoint is the right network"),
+    ];
+}
+/** A `GET /healthz` against each configured Service endpoint. */
+async function endpointChecks(settings, fetchImpl, timeoutMs) {
+    if (settings.services.length === 0)
+        return [];
+    const send = fetchImpl ?? globalThis.fetch;
+    if (send === undefined)
+        return [skip("service-endpoints", "this host has no global fetch")];
+    const signal = globalThis.AbortSignal?.timeout?.(timeoutMs);
+    const results = await Promise.all(settings.services.map(async (entry) => {
+        const url = `${entry.endpoint.replace(/\/+$/, "")}/healthz`;
+        try {
+            const response = await send(url, { method: "GET", ...(signal === undefined ? {} : { signal }) });
+            return { entry, reachable: response.status >= 200 && response.status < 500, status: response.status };
+        }
+        catch (error) {
+            return { entry, reachable: false, status: reason(error) };
+        }
+    }));
+    const unreachable = results.filter((result) => !result.reachable);
+    if (unreachable.length === 0) {
+        return [pass("service-endpoints", `${results.length} Service endpoint(s) answered`)];
+    }
+    return [
+        warn("service-endpoints", `${unreachable.length} of ${results.length} Service endpoint(s) did not answer: ${unreachable
+            .map((result) => `${result.entry.serviceId} at ${result.entry.endpoint} (${String(result.status)})`)
+            .join(", ")}`, "a Service that is down is not a broken installation, but tab_call against it will fail"),
+    ];
+}
+/** Is the `tab` stanza in the client config, and is it free of credentials? */
+function clientConfigCheck(path) {
+    if (path === undefined) {
+        return skip("mcp-client-config", "no MCP client config was named", "run `tab connect`, or pass --config");
+    }
+    const read = readClientConfig(path);
+    if (!read.ok)
+        return bad("mcp-client-config", read.error.message);
+    if (!read.value.existed) {
+        return warn("mcp-client-config", `\`${path}\` does not exist yet`, "run `tab connect` to write it");
+    }
+    const servers = field(read.value.document, "mcpServers");
+    const stanza = field(servers, TAB_SERVER_KEY);
+    if (stanza === undefined) {
+        return warn("mcp-client-config", `\`${path}\` has no \`${TAB_SERVER_KEY}\` server`, "run `tab connect`");
+    }
+    const secret = assertNoSecret(stanza, `the \`${TAB_SERVER_KEY}\` stanza in ${path}`);
+    if (!secret.ok)
+        return bad("mcp-client-config", secret.error.message);
+    const command = isRecord(stanza) ? stanza["command"] : undefined;
+    return pass("mcp-client-config", `\`${path}\` runs the tab server with \`${String(command)}\` and carries no credential`);
+}
+/** A promise with a deadline, so one slow endpoint does not hold the whole report. */
+function withTimeout(promise, ms, label) {
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => reject(new Error(`${label} did not answer within ${ms}ms`)), ms);
+        promise.then((value) => {
+            clearTimeout(timer);
+            resolve(value);
+        }, (error) => {
+            clearTimeout(timer);
+            reject(error instanceof Error ? error : new Error(String(error)));
+        });
+    });
+}
+//# sourceMappingURL=doctor.js.map

package/dist/cli/doctor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../src/cli/doctor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAGlD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAE,wBAAwB,EAAsB,MAAM,2BAA2B,CAAC;AAEzF,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAgCtF,qFAAqF;AACrF,MAAM,SAAS,GAAG;IAChB,CAAC,0BAA0B,EAAE,iBAAiB,CAAC;IAC/C,CAAC,cAAc,EAAE,MAAM,CAAC;IACxB,CAAC,kBAAkB,EAAE,SAAS,CAAC;IAC/B,CAAC,wBAAwB,EAAE,eAAe,CAAC;CACnC,CAAC;AAEX,MAAM,YAAY,GAAG,4CAA4C,CAAC;AAElE,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,MAAc,EAAe,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;AAC/F,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,MAAc,EAAE,IAAa,EAAe,EAAE,CAAC,CAAC;IAC1E,IAAI;IACJ,MAAM,EAAE,MAAM;IACd,MAAM;IACN,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;CACxC,CAAC,CAAC;AACH,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,MAAc,EAAE,IAAa,EAAe,EAAE,CAAC,CAAC;IACzE,IAAI;IACJ,MAAM,EAAE,MAAM;IACd,MAAM;IACN,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;CACxC,CAAC,CAAC;AACH,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,MAAc,EAAE,IAAa,EAAe,EAAE,CAAC,CAAC;IAC1E,IAAI;IACJ,MAAM,EAAE,MAAM;IACd,MAAM;IACN,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;CACxC,CAAC,CAAC;AAEH,MAAM,MAAM,GAAG,CAAC,KAAc,EAAU,EAAE,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AAEpG,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAsB;IACpD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,YAAY,CAAC;IAC9C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;IAC9C,MAAM,MAAM,GAAkB,EAAE,CAAC;IAEjC,mBAAmB;IACnB,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;IAC9E,MAAM,CAAC,IAAI,CACT,KAAK,IAAI,EAAE;QACT,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/C,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,+DAA+D,CAAC,CAClH,CAAC;IAEF,0BAA0B;IAC1B,MAAM,CAAC,IAAI,CACT,QAAQ,CAAC,KAAK,KAAK,SAAS;QAC1B,CAAC,CAAC,IAAI,CACF,OAAO,EACP,gCAAgC,EAChC,yFAAyF,CAC1F;QACH,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,gBAAgB,GAAG,CAAC,CAC1F,CAAC;IACF,MAAM,CAAC,IAAI,CACT,QAAQ,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAC5B,CAAC,CAAC,IAAI,CACF,mBAAmB,EACnB,qCAAqC,EACrC,wIAAwI,CACzI;QACH,CAAC,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,iCAAiC,CAAC,CAC5F,CAAC;IAEF,sBAAsB;IACtB,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,CAAC,IAAI,CACT,IAAI,CAAC,WAAW,EAAE,qCAAqC,EAAE,mBAAmB,CAAC,EAC7E,IAAI,CAAC,iBAAiB,EAAE,4CAA4C,CAAC,CACtE,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC;QAClC,2EAA2E;QAC3E,wEAAwE;QACxE,2EAA2E;QAC3E,8CAA8C;QAC9C,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACvG,IAAI,CAAC;YACH,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACzC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,CAAqB,EAAE,SAAS,EAAE,aAAa,CAAC;gBAC3F,WAAW,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,iBAAiB,CAAC;aACrE,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YAC1F,MAAM,CAAC,IAAI,CACT,OAAO,KAAK,QAAQ;gBAClB,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,OAAO,aAAa,IAAI,EAAE,CAAC;gBAC3D,CAAC,CAAC,GAAG,CACD,WAAW,EACX,iCAAiC,OAAO,kCAAkC,QAAQ,EAAE,EACpF,0IAA0I,CAC3I,CACN,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,cAAc,CAAC,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CACT,GAAG,CAAC,WAAW,EAAE,GAAG,QAAQ,CAAC,MAAM,uBAAuB,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,qBAAqB,CAAC,EACjG,IAAI,CAAC,iBAAiB,EAAE,sCAAsC,CAAC,CAChE,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,QAAQ,CAAC,OAAO,EAAE,CAAC;QACrB,CAAC;IACH,CAAC;IAED,sCAAsC;IACtC,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACvC,MAAM,CAAC,IAAI,CACT,IAAI,CACF,cAAc,EACd,oCAAoC,EACpC,oJAAoJ,CACrJ,CACF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAG,wBAAwB,CAAC;YACxC,OAAO,EAAE,QAAQ,CAAC,WAAW;YAC7B,SAAS;YACT,MAAM;YACN,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;SAC7E,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CACT,IAAI,CAAC,cAAc,EAAE,GAAG,QAAQ,CAAC,OAAO,oBAAoB,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,yDAAyD,CAAC,CAC/I,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,QAAQ,CAAC,OAAO,aAAa,CAAC,CAAC,CAAC;YACpE,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC5C,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,4CAA4C,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC/G,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;gBAChE,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,WAAW,CAAC,CAAC;gBACrE,MAAM,CAAC,IAAI,CACT,KAAK,KAAK,CAAC;oBACT,CAAC,CAAC,IAAI,CACF,mBAAmB,EACnB,0DAA0D,EAC1D,yDAAyD,CAC1D;oBACH,CAAC,CAAC,IAAI,CACF,mBAAmB,EACnB,GAAG,KAAK,sBAAsB,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,mBAAmB,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACpG,CACN,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,wCAAwC;IACxC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;IAE/E,6BAA6B;IAC7B,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAEzD,6CAA6C;IAC7C,MAAM,UAAU,GAAG,GAAG,CAAC,mBAAmB,CAAC,KAAK,SAAS,CAAC;IAC1D,MAAM,CAAC,IAAI,CACT,UAAU;QACR,CAAC,CAAC,IAAI,CAAC,gBAAgB,EAAE,gGAAgG,CAAC;QAC1H,CAAC,CAAC,IAAI,CACF,gBAAgB,EAChB,8BAA8B,EAC9B,gJAAgJ,CACjJ,CACN,CAAC;IAEF,MAAM,MAAM,GAAgC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IACnF,KAAK,MAAM,KAAK,IAAI,MAAM;QAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtD,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AACnD,CAAC;AAED,yDAAyD;AACzD,KAAK,UAAU,cAAc,CAC3B,QAAyB,EACzB,GAAsB,EACtB,SAAiB;IAEjB,MAAM,UAAU,GAAsF,EAAE,CAAC;IACzG,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9B,oEAAoE;QACpE,0EAA0E;QAC1E,IAAI,OAAO,KAAK,SAAS;YAAE,SAAS;QACpC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,YAAY;YAAE,SAAS;QAC7F,UAAU,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO;YACL,IAAI,CACF,iBAAiB,EACjB,sCAAsC,EACtC,yFAAyF,CAC1F;SACF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC7B,IAAI,CAAC;YACH,0EAA0E;YAC1E,uEAAuE;YACvE,sEAAsE;YACtE,2CAA2C;YAC3C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;YACpG,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QACtG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,CAAC;IACH,CAAC,CAAC,CACH,CAAC;IAEF,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,OAAO,CAAC,MAAM,2BAA2B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/H,CAAC;IACD,OAAO;QACL,GAAG,CACD,iBAAiB,EACjB,cAAc,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACrG,wIAAwI,CACzI;KACF,CAAC;AACJ,CAAC;AAED,iEAAiE;AACjE,KAAK,UAAU,cAAc,CAC3B,QAAwB,EACxB,SAAoC,EACpC,SAAiB;IAEjB,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9C,MAAM,IAAI,GAAG,SAAS,IAAK,UAAwC,CAAC,KAAK,CAAC;IAC1E,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,mBAAmB,EAAE,+BAA+B,CAAC,CAAC,CAAC;IAE5F,MAAM,MAAM,GAAI,UAAsE,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IACzH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACpC,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC;QAC5D,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;YACjG,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QACxG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,CAAC;IACH,CAAC,CAAC,CACH,CAAC;IAEF,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAClE,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,OAAO,CAAC,MAAM,+BAA+B,CAAC,CAAC,CAAC;IACvF,CAAC;IACD,OAAO;QACL,IAAI,CACF,mBAAmB,EACnB,GAAG,WAAW,CAAC,MAAM,OAAO,OAAO,CAAC,MAAM,wCAAwC,WAAW;aAC1F,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,OAAO,MAAM,CAAC,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;aACnG,IAAI,CAAC,IAAI,CAAC,EAAE,EACf,wFAAwF,CACzF;KACF,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,SAAS,iBAAiB,CAAC,IAAwB;IACjD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,mBAAmB,EAAE,gCAAgC,EAAE,qCAAqC,CAAC,CAAC;IAC5G,CAAC;IACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,mBAAmB,EAAE,KAAK,IAAI,uBAAuB,EAAE,+BAA+B,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAC9C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,mBAAmB,EAAE,KAAK,IAAI,eAAe,cAAc,WAAW,EAAE,mBAAmB,CAAC,CAAC;IAC3G,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,SAAS,cAAc,gBAAgB,IAAI,EAAE,CAAC,CAAC;IACrF,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjE,OAAO,IAAI,CAAC,mBAAmB,EAAE,KAAK,IAAI,iCAAiC,MAAM,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC;AAC5H,CAAC;AAED,sFAAsF;AACtF,SAAS,WAAW,CAAI,OAAmB,EAAE,EAAU,EAAE,KAAa;IACpE,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,0BAA0B,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAChG,OAAO,CAAC,IAAI,CACV,CAAC,KAAK,EAAE,EAAE;YACR,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;YACjB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACpE,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * `tab doctor`: every check that can be made without a key.\n *\n * The point of the command is that a person who has just run `tab connect` can\n * find out whether it worked before they ask a model to spend anything. So every\n * check here is a read -- an `eth_chainId`, an `eth_getCode`, a `GET /healthz`.\n * Nothing here signs, nothing here writes, and nothing here loads a private key.\n * The one thing it says about a signing key is whether the environment carries\n * one at all, reported as present or absent and never read, because \"you have no\n * key configured\" is the answer to why `tab_settle` will refuse, and printing the\n * key would be the worst possible way to say it.\n *\n * ## Three outcomes, not two\n *\n * A check answers `pass`, `warn`, `fail` or `skip`, and the distinction carries\n * weight. A missing registry read API is a `warn`: discovery and status will not\n * work, but calling and settling will, so it is not a broken installation. An\n * RPC endpoint that answers the wrong chain id is a `fail`: every address in the\n * configuration names a contract on a different chain, and anything built on top\n * of it would be wrong rather than absent. `skip` is for a check whose input was\n * not configured, which is a statement about the configuration and not about the\n * deployment.\n *\n * Requirements: 25.6, 28.6\n */\n\nimport { JsonRpcProvider, Network } from \"ethers\";\n\nimport type { Logger } from \"../logger.js\";\nimport { silentLogger } from \"../logger.js\";\nimport { asArray, field, isRecord } from \"../mcp/json.js\";\nimport { createRegistryReadClient, type RegistryFetch } from \"../mcp/registry-client.js\";\nimport type { TabMcpSettings } from \"../mcp/settings.js\";\nimport { readClientConfig, TAB_SERVER_KEY, assertNoSecret } from \"./client-config.js\";\n\nexport type CheckStatus = \"pass\" | \"warn\" | \"fail\" | \"skip\";\n\nexport interface DoctorCheck {\n  /** Short and stable, so a script can grep for one. */\n  readonly name: string;\n  readonly status: CheckStatus;\n  /** What was found, in one sentence. */\n  readonly detail: string;\n  /** What to do about it, when there is something to do. */\n  readonly hint?: string;\n}\n\nexport interface DoctorReport {\n  readonly checks: readonly DoctorCheck[];\n  /** True when nothing failed. Warnings do not make a report unhealthy. */\n  readonly ok: boolean;\n  readonly counts: Readonly<Record<CheckStatus, number>>;\n}\n\nexport interface DoctorOptions {\n  readonly settings: TabMcpSettings;\n  readonly env?: NodeJS.ProcessEnv;\n  /** The MCP client config to inspect, when the caller resolved one. */\n  readonly clientConfigPath?: string;\n  readonly fetchImpl?: RegistryFetch;\n  readonly logger?: Logger;\n  /** How long any one network read may take. Defaults to 10 seconds. */\n  readonly timeoutMs?: number;\n}\n\n/** The contracts a working deployment has code at, under their environment names. */\nconst CONTRACTS = [\n  [\"SERVICE_REGISTRY_ADDRESS\", \"ServiceRegistry\"],\n  [\"BOND_ADDRESS\", \"Bond\"],\n  [\"TAB_BOOK_ADDRESS\", \"TabBook\"],\n  [\"TAB_SETTLEMENT_ADDRESS\", \"TabSettlement\"],\n] as const;\n\nconst ZERO_ADDRESS = \"0x0000000000000000000000000000000000000000\";\n\nconst pass = (name: string, detail: string): DoctorCheck => ({ name, status: \"pass\", detail });\nconst warn = (name: string, detail: string, hint?: string): DoctorCheck => ({\n  name,\n  status: \"warn\",\n  detail,\n  ...(hint === undefined ? {} : { hint }),\n});\nconst bad = (name: string, detail: string, hint?: string): DoctorCheck => ({\n  name,\n  status: \"fail\",\n  detail,\n  ...(hint === undefined ? {} : { hint }),\n});\nconst skip = (name: string, detail: string, hint?: string): DoctorCheck => ({\n  name,\n  status: \"skip\",\n  detail,\n  ...(hint === undefined ? {} : { hint }),\n});\n\nconst reason = (error: unknown): string => (error instanceof Error ? error.message : String(error));\n\n/** Runs every check and answers the whole report. Never throws, never signs. */\nexport async function runDoctor(options: DoctorOptions): Promise<DoctorReport> {\n  const env = options.env ?? process.env;\n  const settings = options.settings;\n  const logger = options.logger ?? silentLogger;\n  const timeoutMs = options.timeoutMs ?? 10_000;\n  const checks: DoctorCheck[] = [];\n\n  // ---- the runtime\n  const major = Number.parseInt(process.versions.node.split(\".\")[0] ?? \"0\", 10);\n  checks.push(\n    major >= 20\n      ? pass(\"node\", `Node ${process.versions.node}`)\n      : bad(\"node\", `Node ${process.versions.node}`, \"the MCP server needs Node 20.10 or later for its global fetch\"),\n  );\n\n  // ---- what is configured\n  checks.push(\n    settings.agent === undefined\n      ? warn(\n          \"agent\",\n          \"no Agent address is configured\",\n          \"set `agent` in tab.config; tab_call and tab_settle need to know whose Open Tab to meter\",\n        )\n      : pass(\"agent\", `${settings.agent} (${settings.sources[\"agent\"] ?? \"unknown source\"})`),\n  );\n  checks.push(\n    settings.services.length === 0\n      ? warn(\n          \"service-directory\",\n          \"no Service endpoints are configured\",\n          \"the chain records no URL for a Service, so add each one to the `services` list in tab.config or tab_call has nowhere to send a request\",\n        )\n      : pass(\"service-directory\", `${settings.services.length} Service endpoint(s) configured`),\n  );\n\n  // ---- Monad, keyless\n  if (settings.rpcUrl === undefined) {\n    checks.push(\n      skip(\"monad-rpc\", \"no Monad RPC endpoint is configured\", \"set MONAD_RPC_URL\"),\n      skip(\"monad-contracts\", \"skipped: there is no endpoint to read from\"),\n    );\n  } else {\n    const expected = settings.chainId;\n    // Pinned to the configured chain so ethers never probes the network on its\n    // own, and `eth_chainId` is then asked directly: a static network would\n    // otherwise answer the configured id without the endpoint being consulted,\n    // which is the one check this exists to make.\n    const provider = new JsonRpcProvider(settings.rpcUrl, Network.from(expected), { staticNetwork: true });\n    try {\n      const [answered, head] = await Promise.all([\n        withTimeout(provider.send(\"eth_chainId\", []) as Promise<unknown>, timeoutMs, \"eth_chainId\"),\n        withTimeout(provider.getBlockNumber(), timeoutMs, \"eth_blockNumber\"),\n      ]);\n      const chainId = typeof answered === \"string\" ? Number.parseInt(answered, 16) : Number.NaN;\n      checks.push(\n        chainId === expected\n          ? pass(\"monad-rpc\", `chain id ${chainId} at block ${head}`)\n          : bad(\n              \"monad-rpc\",\n              `the endpoint answers chain id ${chainId} and the configuration expects ${expected}`,\n              \"every contract address in the configuration names a contract on one chain; reading a different one would produce confident wrong answers\",\n            ),\n      );\n      checks.push(...(await contractChecks(provider, env, timeoutMs)));\n    } catch (error) {\n      checks.push(\n        bad(\"monad-rpc\", `${settings.rpcUrl} could not be read: ${reason(error)}`, \"check MONAD_RPC_URL\"),\n        skip(\"monad-contracts\", \"skipped: the endpoint did not answer\"),\n      );\n    } finally {\n      provider.destroy();\n    }\n  }\n\n  // ---- the registry read API, keyless\n  if (settings.registryUrl === undefined) {\n    checks.push(\n      warn(\n        \"registry-api\",\n        \"no registry read API is configured\",\n        \"tab_discover and tab_status read from it; set NEXT_PUBLIC_REGISTRY_API_URL or `registryUrl` in tab.config. tab_call and tab_settle work without it\",\n      ),\n    );\n  } else {\n    const registry = createRegistryReadClient({\n      baseUrl: settings.registryUrl,\n      timeoutMs,\n      logger,\n      ...(options.fetchImpl === undefined ? {} : { fetchImpl: options.fetchImpl }),\n    });\n    const health = await registry.health();\n    if (!health.ok) {\n      checks.push(\n        warn(\"registry-api\", `${registry.baseUrl} did not answer: ${health.error.message}`, \"start the registry read API, or point at a deployed one\"),\n      );\n    } else {\n      checks.push(pass(\"registry-api\", `${registry.baseUrl} is healthy`));\n      const services = await registry.services(5);\n      if (!services.ok) {\n        checks.push(warn(\"registry-services\", `the Service directory could not be read: ${services.error.message}`));\n      } else {\n        const count = asArray(field(services.value, \"services\")).length;\n        const lastBlock = field(field(services.value, \"index\"), \"lastBlock\");\n        checks.push(\n          count === 0\n            ? warn(\n                \"registry-services\",\n                \"the read API is healthy and no Service is registered yet\",\n                \"register a Service, or wait for the indexer to catch up\",\n              )\n            : pass(\n                \"registry-services\",\n                `${count} Service(s) indexed${typeof lastBlock === \"number\" ? ` at Monad block ${lastBlock}` : \"\"}`,\n              ),\n        );\n      }\n    }\n  }\n\n  // ---- each configured Service endpoint\n  checks.push(...(await endpointChecks(settings, options.fetchImpl, timeoutMs)));\n\n  // ---- the MCP client config\n  checks.push(clientConfigCheck(options.clientConfigPath));\n\n  // ---- the signing key, named and never read\n  const keyPresent = env[\"AGENT_PRIVATE_KEY\"] !== undefined;\n  checks.push(\n    keyPresent\n      ? pass(\"settlement-key\", \"AGENT_PRIVATE_KEY is set in this environment; its value is never read here or written anywhere\")\n      : warn(\n          \"settlement-key\",\n          \"AGENT_PRIVATE_KEY is not set\",\n          \"tab_settle signs the Settlement with the Agent's own key, read from the environment at signing time. Discovery, calling and status need no key\",\n        ),\n  );\n\n  const counts: Record<CheckStatus, number> = { pass: 0, warn: 0, fail: 0, skip: 0 };\n  for (const check of checks) counts[check.status] += 1;\n  return { checks, ok: counts.fail === 0, counts };\n}\n\n/** `eth_getCode` at each configured contract address. */\nasync function contractChecks(\n  provider: JsonRpcProvider,\n  env: NodeJS.ProcessEnv,\n  timeoutMs: number,\n): Promise<readonly DoctorCheck[]> {\n  const configured: { readonly variable: string; readonly label: string; readonly address: string }[] = [];\n  for (const [variable, label] of CONTRACTS) {\n    const address = env[variable];\n    // The zero address is the placeholder `.env.example` ships before a\n    // deployment fills it in, so it means \"not configured\" and not \"no code\".\n    if (address === undefined) continue;\n    if (!/^0x[a-fA-F0-9]{40}$/.test(address) || address.toLowerCase() === ZERO_ADDRESS) continue;\n    configured.push({ variable, label, address });\n  }\n\n  if (configured.length === 0) {\n    return [\n      skip(\n        \"monad-contracts\",\n        \"no contract addresses are configured\",\n        \"set SERVICE_REGISTRY_ADDRESS, BOND_ADDRESS, TAB_BOOK_ADDRESS and TAB_SETTLEMENT_ADDRESS\",\n      ),\n    ];\n  }\n\n  const results = await Promise.all(\n    configured.map(async (entry) => {\n      try {\n        // Pinned to `latest`, deliberately. Monad finalises within seconds, but a\n        // `finalized` read still lags the head, and a contract deployed within\n        // the lag would read as absent: a false failure at exactly the moment\n        // somebody is checking a fresh deployment.\n        const code = await withTimeout(provider.getCode(entry.address, \"latest\"), timeoutMs, \"eth_getCode\");\n        return { entry, hasCode: code !== undefined && code !== \"0x\" && code.length > 2, error: undefined };\n      } catch (error) {\n        return { entry, hasCode: false, error: reason(error) };\n      }\n    }),\n  );\n\n  const missing = results.filter((result) => !result.hasCode);\n  if (missing.length === 0) {\n    return [pass(\"monad-contracts\", `${results.length} contract(s) hold code: ${results.map((r) => r.entry.label).join(\", \")}`)];\n  }\n  return [\n    bad(\n      \"monad-contracts\",\n      `no code at ${missing.map((result) => `${result.entry.label} (${result.entry.address})`).join(\", \")}`,\n      \"the addresses name nothing on this chain: check the environment against the deployment, and that the RPC endpoint is the right network\",\n    ),\n  ];\n}\n\n/** A `GET /healthz` against each configured Service endpoint. */\nasync function endpointChecks(\n  settings: TabMcpSettings,\n  fetchImpl: RegistryFetch | undefined,\n  timeoutMs: number,\n): Promise<readonly DoctorCheck[]> {\n  if (settings.services.length === 0) return [];\n  const send = fetchImpl ?? (globalThis as { fetch?: RegistryFetch }).fetch;\n  if (send === undefined) return [skip(\"service-endpoints\", \"this host has no global fetch\")];\n\n  const signal = (globalThis as { AbortSignal?: { timeout?: (ms: number) => unknown } }).AbortSignal?.timeout?.(timeoutMs);\n  const results = await Promise.all(\n    settings.services.map(async (entry) => {\n      const url = `${entry.endpoint.replace(/\\/+$/, \"\")}/healthz`;\n      try {\n        const response = await send(url, { method: \"GET\", ...(signal === undefined ? {} : { signal }) });\n        return { entry, reachable: response.status >= 200 && response.status < 500, status: response.status };\n      } catch (error) {\n        return { entry, reachable: false, status: reason(error) };\n      }\n    }),\n  );\n\n  const unreachable = results.filter((result) => !result.reachable);\n  if (unreachable.length === 0) {\n    return [pass(\"service-endpoints\", `${results.length} Service endpoint(s) answered`)];\n  }\n  return [\n    warn(\n      \"service-endpoints\",\n      `${unreachable.length} of ${results.length} Service endpoint(s) did not answer: ${unreachable\n        .map((result) => `${result.entry.serviceId} at ${result.entry.endpoint} (${String(result.status)})`)\n        .join(\", \")}`,\n      \"a Service that is down is not a broken installation, but tab_call against it will fail\",\n    ),\n  ];\n}\n\n/** Is the `tab` stanza in the client config, and is it free of credentials? */\nfunction clientConfigCheck(path: string | undefined): DoctorCheck {\n  if (path === undefined) {\n    return skip(\"mcp-client-config\", \"no MCP client config was named\", \"run `tab connect`, or pass --config\");\n  }\n  const read = readClientConfig(path);\n  if (!read.ok) return bad(\"mcp-client-config\", read.error.message);\n  if (!read.value.existed) {\n    return warn(\"mcp-client-config\", `\\`${path}\\` does not exist yet`, \"run `tab connect` to write it\");\n  }\n  const servers = field(read.value.document, \"mcpServers\");\n  const stanza = field(servers, TAB_SERVER_KEY);\n  if (stanza === undefined) {\n    return warn(\"mcp-client-config\", `\\`${path}\\` has no \\`${TAB_SERVER_KEY}\\` server`, \"run `tab connect`\");\n  }\n  const secret = assertNoSecret(stanza, `the \\`${TAB_SERVER_KEY}\\` stanza in ${path}`);\n  if (!secret.ok) return bad(\"mcp-client-config\", secret.error.message);\n  const command = isRecord(stanza) ? stanza[\"command\"] : undefined;\n  return pass(\"mcp-client-config\", `\\`${path}\\` runs the tab server with \\`${String(command)}\\` and carries no credential`);\n}\n\n/** A promise with a deadline, so one slow endpoint does not hold the whole report. */\nfunction withTimeout<T>(promise: Promise<T>, ms: number, label: string): Promise<T> {\n  return new Promise<T>((resolve, reject) => {\n    const timer = setTimeout(() => reject(new Error(`${label} did not answer within ${ms}ms`)), ms);\n    promise.then(\n      (value) => {\n        clearTimeout(timer);\n        resolve(value);\n      },\n      (error: unknown) => {\n        clearTimeout(timer);\n        reject(error instanceof Error ? error : new Error(String(error)));\n      },\n    );\n  });\n}\n"]}

package/dist/cli/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * The CLI: the executable entry point of this package. (R25.5, R25.6)
+ *
+ * `connect` writes one `mcpServers` stanza into an MCP client's config, never a
+ * key. `doctor` checks the installation with reads alone. `status` and `settle`
+ * are the two tools reachable without a model, and `settle` is a dry run unless
+ * it is told otherwise.
+ */
+export * from "./client-config.js";
+export * from "./connect.js";
+export * from "./doctor.js";
+export * from "./main.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/cli/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,cAAc,oBAAoB,CAAC;AACnC,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC"}

package/dist/cli/index.js

@@ -0,0 +1,13 @@
+/**
+ * The CLI: the executable entry point of this package. (R25.5, R25.6)
+ *
+ * `connect` writes one `mcpServers` stanza into an MCP client's config, never a
+ * key. `doctor` checks the installation with reads alone. `status` and `settle`
+ * are the two tools reachable without a model, and `settle` is a dry run unless
+ * it is told otherwise.
+ */
+export * from "./client-config.js";
+export * from "./connect.js";
+export * from "./doctor.js";
+export * from "./main.js";
+//# sourceMappingURL=index.js.map

package/dist/cli/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,cAAc,oBAAoB,CAAC;AACnC,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC","sourcesContent":["/**\n * The CLI: the executable entry point of this package. (R25.5, R25.6)\n *\n * `connect` writes one `mcpServers` stanza into an MCP client's config, never a\n * key. `doctor` checks the installation with reads alone. `status` and `settle`\n * are the two tools reachable without a model, and `settle` is a dry run unless\n * it is told otherwise.\n */\n\nexport * from \"./client-config.js\";\nexport * from \"./connect.js\";\nexport * from \"./doctor.js\";\nexport * from \"./main.js\";\n"]}