@usesotto/cli 0.1.0

package/dist/bin.js

@@ -0,0 +1,1619 @@
+#!/usr/bin/env node
+import { parseArgs } from 'util';
+import { readFileSync, rmSync, mkdirSync, writeFileSync, chmodSync } from 'fs';
+import { homedir } from 'os';
+import { dirname, join } from 'path';
+
+var SottoApiError = class extends Error {
+  status;
+  code;
+  detail;
+  body;
+  constructor(status, body, fallbackCode) {
+    const code = typeof body.error === "string" ? body.error : fallbackCode;
+    const detail = typeof body.detail === "string" ? body.detail : void 0;
+    super(detail === void 0 ? code : `${code}: ${detail}`);
+    this.name = "SottoApiError";
+    this.status = status;
+    this.code = code;
+    this.detail = detail;
+    this.body = body;
+  }
+};
+var SottoResponseShapeError = class extends Error {
+  constructor(context) {
+    super(`The API response did not carry the expected shape: ${context}`);
+    this.name = "SottoResponseShapeError";
+  }
+};
+var SottoTransportError = class extends Error {
+  cause;
+  constructor(context, cause) {
+    super(`The Sotto API was unreachable: ${context}`);
+    this.name = "SottoTransportError";
+    this.cause = cause;
+  }
+};
+var SottoResponseTooLargeError = class extends Error {
+  constructor(limitBytes) {
+    super(
+      `The API response exceeded the bounded read limit of ${limitBytes} bytes`
+    );
+    this.name = "SottoResponseTooLargeError";
+  }
+};
+var TERMINAL_ATTEMPT_STATES = Object.freeze([
+  "wallet-rejected",
+  "wallet-unsupported",
+  "settlement-reconciled",
+  "settlement-rejected"
+]);
+function isTerminalAttemptState(state) {
+  return TERMINAL_ATTEMPT_STATES.includes(state);
+}
+function pairedOutcome(attemptState, deliveryClaimState) {
+  const settled = attemptState === "settlement-reconciled";
+  const delivered = deliveryClaimState === "delivered";
+  const deliveryFailed = deliveryClaimState === "delivery-failed" || deliveryClaimState === "delivery-unknown";
+  return Object.freeze({
+    settled,
+    settlementRejected: attemptState === "settlement-rejected",
+    delivered,
+    deliveryFailed,
+    deliveryPending: settled && !delivered && !deliveryFailed
+  });
+}
+var DEFAULT_MAX_RESPONSE_BYTES = 2 * 1024 * 1024;
+function normalizedOrigin(origin) {
+  const url = new URL(origin);
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    throw new SottoTransportError(`unsupported origin ${origin}`, void 0);
+  }
+  return url.origin;
+}
+async function readBounded(response, limitBytes) {
+  const body = response.body;
+  if (body === null) return "";
+  const reader = body.getReader();
+  const chunks = [];
+  let total = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    total += value.byteLength;
+    if (total > limitBytes) {
+      await reader.cancel();
+      throw new SottoResponseTooLargeError(limitBytes);
+    }
+    chunks.push(value);
+  }
+  return new TextDecoder().decode(
+    chunks.length === 1 ? chunks[0] : concat(chunks, total)
+  );
+}
+function concat(chunks, total) {
+  const merged = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    merged.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return merged;
+}
+function createTransport(options) {
+  const origin = normalizedOrigin(options.origin);
+  const fetchImpl = options.fetch ?? ((url, init) => globalThis.fetch(url, init));
+  const limit = options.maxResponseBytes ?? DEFAULT_MAX_RESPONSE_BYTES;
+  const authorizationHeader = () => {
+    const token = options.token?.();
+    return token === void 0 ? {} : { authorization: `Bearer ${token}` };
+  };
+  return Object.freeze({
+    origin,
+    authorizationHeader,
+    request: async ({ method, path, body, signal, headers }) => {
+      let response;
+      try {
+        response = await fetchImpl(`${origin}${path}`, {
+          method,
+          redirect: "error",
+          headers: {
+            accept: "application/json",
+            ...body === void 0 ? {} : { "content-type": "application/json" },
+            ...authorizationHeader(),
+            ...headers
+          },
+          ...body === void 0 ? {} : { body: JSON.stringify(body) },
+          ...signal === void 0 ? {} : { signal }
+        });
+      } catch (error) {
+        throw new SottoTransportError(`${method} ${path}`, error);
+      }
+      if (response.status === 204) return Object.freeze({});
+      const text2 = await readBounded(response, limit);
+      let parsed;
+      try {
+        parsed = text2 === "" ? {} : JSON.parse(text2);
+      } catch {
+        throw new SottoResponseShapeError(
+          `${method} ${path} answered non-JSON with status ${response.status}`
+        );
+      }
+      if (typeof parsed !== "object" || parsed === null) {
+        throw new SottoResponseShapeError(
+          `${method} ${path} answered a non-object body`
+        );
+      }
+      const record = parsed;
+      if (!response.ok) {
+        throw new SottoApiError(
+          response.status,
+          record,
+          `http-${response.status}`
+        );
+      }
+      return record;
+    },
+    fetchRaw: async (path, headers, signal) => {
+      try {
+        return await fetchImpl(`${origin}${path}`, {
+          method: "GET",
+          redirect: "error",
+          headers: { ...authorizationHeader(), ...headers },
+          ...signal === void 0 ? {} : { signal }
+        });
+      } catch (error) {
+        throw new SottoTransportError(`GET ${path}`, error);
+      }
+    }
+  });
+}
+var MAX_EVENT_BYTES = 64 * 1024;
+function createSseParser() {
+  let buffer = "";
+  return {
+    feed(chunk) {
+      buffer += chunk.replaceAll("\r\n", "\n");
+      if (buffer.length > MAX_EVENT_BYTES) {
+        throw new SottoResponseShapeError("SSE frame exceeded 64KiB");
+      }
+      const events = [];
+      for (; ; ) {
+        const boundary = buffer.indexOf("\n\n");
+        if (boundary === -1) break;
+        const frame = buffer.slice(0, boundary);
+        buffer = buffer.slice(boundary + 2);
+        let id;
+        let event;
+        const data = [];
+        for (const line of frame.split("\n")) {
+          if (line.startsWith(":")) continue;
+          if (line.startsWith("id:")) id = line.slice(3).trim();
+          else if (line.startsWith("event:")) event = line.slice(6).trim();
+          else if (line.startsWith("data:")) data.push(line.slice(5).trim());
+        }
+        if (id !== void 0 || event !== void 0 || data.length > 0) {
+          events.push(Object.freeze({ id, event, data: data.join("\n") }));
+        }
+      }
+      return events;
+    }
+  };
+}
+function parseAttemptEvent(frame) {
+  let parsed;
+  try {
+    parsed = JSON.parse(frame.data);
+  } catch {
+    throw new SottoResponseShapeError("SSE data was not JSON");
+  }
+  const record = parsed;
+  if (typeof record.sequence !== "number" || typeof record.type !== "string" || typeof record.recordedAt !== "string") {
+    throw new SottoResponseShapeError("SSE event missed journal fields");
+  }
+  return Object.freeze({
+    sequence: record.sequence,
+    type: record.type,
+    recordedAt: record.recordedAt,
+    updateId: typeof record.updateId === "string" ? record.updateId : null
+  });
+}
+var delay = (ms, signal) => new Promise((resolve) => {
+  const timer = setTimeout(done, ms);
+  function done() {
+    signal?.removeEventListener("abort", done);
+    clearTimeout(timer);
+    resolve();
+  }
+  signal?.addEventListener("abort", done, { once: true });
+});
+async function* followPurchaseEvents(transport, attemptId, options = {}) {
+  let cursor = options.lastEventId ?? 0;
+  const signal = options.signal;
+  const aborted = () => signal?.aborted === true;
+  const reconnectDelayMs = options.reconnectDelayMs ?? 1e3;
+  let reconnectsLeft = options.maxReconnects ?? 30;
+  for (; ; ) {
+    if (aborted()) return;
+    const response = await transport.fetchRaw(
+      `/v1/purchases/${encodeURIComponent(attemptId)}/events`,
+      {
+        accept: "text/event-stream",
+        ...cursor > 0 ? { "last-event-id": String(cursor) } : {}
+      },
+      signal
+    );
+    if (!response.ok) {
+      const text2 = await readBounded(response, MAX_EVENT_BYTES);
+      let body = {};
+      try {
+        body = JSON.parse(text2);
+      } catch {
+      }
+      throw new SottoApiError(response.status, body, `http-${response.status}`);
+    }
+    if (response.body === null) {
+      throw new SottoResponseShapeError("event stream had no body");
+    }
+    const parser = createSseParser();
+    const reader = response.body.getReader();
+    const decoder = new TextDecoder();
+    const abort = () => void reader.cancel().catch(() => void 0);
+    signal?.addEventListener("abort", abort, { once: true });
+    try {
+      for (; ; ) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        for (const frame of parser.feed(
+          decoder.decode(value, { stream: true })
+        )) {
+          if (frame.data === "") continue;
+          const event = parseAttemptEvent(frame);
+          if (event.sequence <= cursor) continue;
+          cursor = event.sequence;
+          yield event;
+          if (isTerminalAttemptState(event.type)) return;
+        }
+      }
+    } finally {
+      signal?.removeEventListener("abort", abort);
+    }
+    if (aborted()) return;
+    if (reconnectsLeft <= 0) {
+      throw new SottoResponseShapeError(
+        "event stream ended before a terminal journal event and the reconnect budget is exhausted"
+      );
+    }
+    reconnectsLeft -= 1;
+    await delay(reconnectDelayMs, signal);
+  }
+}
+function requireArray(value, context) {
+  if (!Array.isArray(value)) throw new SottoResponseShapeError(context);
+  return value;
+}
+function requireRecord(value, context) {
+  if (typeof value !== "object" || value === null) {
+    throw new SottoResponseShapeError(context);
+  }
+  return value;
+}
+function createSottoClient(options) {
+  const transport = createTransport(options);
+  const get = (path, signal) => transport.request({
+    method: "GET",
+    path,
+    ...signal === void 0 ? {} : { signal }
+  });
+  const client = {
+    origin: transport.origin,
+    health: async (signal) => requireRecord(await get("/healthz", signal), "healthz"),
+    session: Object.freeze({
+      verify: async (signal) => {
+        try {
+          await get("/v1/purchases?limit=1", signal);
+          return true;
+        } catch (error) {
+          if (error instanceof Error && "code" in error && error.code === "session-required") {
+            return false;
+          }
+          throw error;
+        }
+      },
+      logout: async (signal) => {
+        await transport.request({
+          method: "DELETE",
+          path: "/v1/session",
+          ...signal === void 0 ? {} : { signal }
+        });
+      }
+    }),
+    catalog: Object.freeze({
+      listResources: async (signal) => requireArray(
+        (await get("/v1/resources", signal)).resources,
+        "resources"
+      ),
+      resourceByListing: async (listingId, signal) => requireRecord(
+        (await get(`/v1/resources/${encodeURIComponent(listingId)}`, signal)).resource,
+        "resource"
+      ),
+      resourceHealth: async (listingId, signal) => {
+        const body = await get(
+          `/v1/resources/${encodeURIComponent(listingId)}/health`,
+          signal
+        );
+        return body.health ?? null;
+      }
+    }),
+    purchases: Object.freeze({
+      initiate: async (listingId, signal) => requireRecord(
+        await transport.request({
+          method: "POST",
+          path: "/v1/purchases",
+          body: { listingId },
+          ...signal === void 0 ? {} : { signal }
+        }),
+        "purchase initiation"
+      ),
+      get: async (attemptId, signal) => requireRecord(
+        await get(`/v1/purchases/${encodeURIComponent(attemptId)}`, signal),
+        "purchase detail"
+      ),
+      list: async (limit = 50, signal) => requireArray(
+        (await get(`/v1/purchases?limit=${limit}`, signal)).attempts,
+        "attempts"
+      ),
+      follow: (attemptId, followOptions) => followPurchaseEvents(transport, attemptId, followOptions)
+    }),
+    attempts: Object.freeze({
+      listPublic: async (limit = 50, signal) => requireArray(
+        (await get(`/v1/attempts?limit=${limit}`, signal)).attempts,
+        "public attempts"
+      ),
+      evidence: async (attemptId, signal) => requireRecord(
+        (await get(`/v1/attempts/${encodeURIComponent(attemptId)}`, signal)).attempt,
+        "attempt evidence"
+      )
+    }),
+    stats: Object.freeze({
+      read: async (window = "7d", signal) => requireRecord(
+        await get(`/v1/stats?window=${encodeURIComponent(window)}`, signal),
+        "stats"
+      )
+    })
+  };
+  return Object.freeze(client);
+}
+var TOKEN = /^[0-9a-f]{64}$/u;
+function configPath(env) {
+  const base = env.SOTTO_CONFIG_DIR ?? join(env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "sotto");
+  return join(base, "config.json");
+}
+function readConfig(env) {
+  let raw;
+  try {
+    raw = readFileSync(configPath(env), "utf8");
+  } catch {
+    return Object.freeze({});
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return Object.freeze({});
+  }
+  if (typeof parsed !== "object" || parsed === null) return Object.freeze({});
+  const record = parsed;
+  return Object.freeze({
+    ...typeof record.apiOrigin === "string" ? { apiOrigin: record.apiOrigin } : {},
+    ...typeof record.token === "string" && TOKEN.test(record.token) ? { token: record.token } : {},
+    ...typeof record.walletUrl === "string" ? { walletUrl: record.walletUrl } : {}
+  });
+}
+function writeConfig(env, config) {
+  const path = configPath(env);
+  mkdirSync(dirname(path), { recursive: true, mode: 448 });
+  writeFileSync(path, `${JSON.stringify(config, null, 2)}
+`, {
+    encoding: "utf8",
+    mode: 384
+  });
+  chmodSync(path, 384);
+  return path;
+}
+function deleteConfig(env) {
+  rmSync(configPath(env), { force: true });
+}
+function resolveSettings(env, flags = {}) {
+  const config = readConfig(env);
+  const envToken = env.SOTTO_SESSION_TOKEN;
+  const token = envToken !== void 0 && TOKEN.test(envToken) ? envToken : config.token;
+  return Object.freeze({
+    apiOrigin: flags.apiOrigin ?? env.SOTTO_API_ORIGIN ?? config.apiOrigin,
+    token,
+    walletUrl: env.SOTTO_WALLET_URL ?? config.walletUrl,
+    tokenSource: envToken !== void 0 && TOKEN.test(envToken) ? "env" : config.token !== void 0 ? "config" : "absent"
+  });
+}
+function isValidToken(candidate) {
+  return TOKEN.test(candidate);
+}
+
+// src/core.ts
+var CliUsageError = class extends Error {
+};
+var CliAuthError = class extends Error {
+};
+function buildClient(env, flags = {}, fetchImpl) {
+  const settings = resolveSettings(env, flags);
+  if (settings.apiOrigin === void 0) {
+    throw new CliUsageError(
+      "No API origin is configured. Set SOTTO_API_ORIGIN, pass --api-origin, or run `sotto login --api-origin <url> --token <token>`."
+    );
+  }
+  const client = createSottoClient({
+    origin: settings.apiOrigin,
+    token: () => settings.token,
+    ...fetchImpl === void 0 ? {} : { fetch: fetchImpl }
+  });
+  return Object.freeze({ client, settings });
+}
+function requireToken(settings) {
+  if (settings.token === void 0) {
+    throw new CliAuthError(
+      "No owner session token is configured. Copy the session token from the Sotto app (or the /v1/session/verify response) and run `sotto login --token <token>`, or export SOTTO_SESSION_TOKEN."
+    );
+  }
+  return settings.token;
+}
+function filterResources(resources, filters) {
+  const query = filters.query?.toLowerCase();
+  return resources.filter((resource) => {
+    if (filters.method !== void 0 && resource.method.toUpperCase() !== filters.method.toUpperCase()) {
+      return false;
+    }
+    if (filters.maxPriceAtomic !== void 0 && BigInt(resource.amountAtomic) > filters.maxPriceAtomic) {
+      return false;
+    }
+    if (query === void 0 || query === "") return true;
+    return [
+      resource.name,
+      resource.description,
+      resource.providerDisplayName,
+      resource.normalizedOrigin,
+      resource.routeTemplate,
+      resource.method
+    ].join("\n").toLowerCase().includes(query);
+  });
+}
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/u;
+async function resolveResource(client, reference, signal) {
+  if (UUID.test(reference)) {
+    return client.catalog.resourceByListing(reference, signal);
+  }
+  let url;
+  try {
+    url = new URL(reference);
+  } catch {
+    throw new CliUsageError(
+      `"${reference}" is neither a listing ID nor a resource URL. Pass the listing ID from \`sotto search\` or the resource's canonical URL.`
+    );
+  }
+  const resources = await client.catalog.listResources(signal);
+  const match = resources.find(
+    (resource) => resource.normalizedOrigin === url.origin && resource.routeTemplate === url.pathname
+  );
+  if (match === void 0) {
+    throw new CliUsageError(
+      `No verified resource matches ${url.origin}${url.pathname}. Browse \`sotto search\` for the published catalog.`
+    );
+  }
+  return match;
+}
+function parseMaxPrice(raw) {
+  if (raw === void 0) return void 0;
+  if (!/^[0-9]{1,38}$/u.test(raw)) {
+    throw new CliUsageError(
+      "--max-price takes an atomic-unit integer (the catalog's amountAtomic)."
+    );
+  }
+  return BigInt(raw);
+}
+
+// src/exit-codes.ts
+var EXIT = Object.freeze({
+  /** Read succeeded, or the purchase settled AND delivered. */
+  ok: 0,
+  /** Transport failure, API failure, or an unexpected error. */
+  failure: 1,
+  /** The command line itself was invalid. */
+  usage: 2,
+  /** No usable owner session (token absent, expired, or revoked). */
+  auth: 3,
+  /** The human wallet rejected this exact prepared call. */
+  walletRejected: 4,
+  /** The wallet cannot sign this prepared transaction shape. */
+  walletUnsupported: 5,
+  /** Canton rejected the settlement; no value moved. */
+  settlementRejected: 6,
+  /** The execute-before deadline passed without a terminal journal event. */
+  expired: 7,
+  /** Settled but not delivered, or otherwise ambiguous — reconcile, never retry. */
+  ambiguous: 8
+});
+
+// src/help.ts
+var HELP_TEXT = `sotto \u2014 Canton x402 marketplace CLI (thin client over the Sotto API)
+
+USAGE
+  sotto <command> [arguments] [flags]
+
+SESSION (copy-token flow \u2014 no device authorization exists server-side yet)
+  login [--api-origin <url>] --token <token> [--wallet-url <url>]
+        Store the owner-session token you copied from the Sotto app's
+        session response. Stored 0600 in ~/.config/sotto/config.json and
+        sent only as "Authorization: Bearer" to that API origin.
+  whoami        Report API origin, token presence, and session validity.
+  logout        Revoke the server session and remove the local token.
+
+CATALOG
+  search [query] [--method <m>] [--max-price <atomic>]
+        List verified resources. --tag is not supported: the catalog
+        carries no tags yet and the CLI will say so instead of ignoring it.
+  inspect <listingId|resource-url>
+        Show one resource with its fresh server-observed price + timestamp.
+  try <resource-url>
+        Inspect the listing behind a canonical URL and print the exact
+        prepare command. Alias of inspect with purchase guidance.
+
+PURCHASING (a HUMAN approves every spend at the wallet; the CLI never signs)
+  buy <listingId> [--max-price <atomic>] [--no-wait]
+        Initiate one exact purchase, print the prepared call + request
+        commitment (+ prepared hash once verified), then follow the journal
+        as a text rail until a terminal state.
+  status <attemptId> [--follow]
+        Show or follow the full journal state.
+  evidence <attemptId>
+        Paired settlement/delivery outcome, update ID, explorer URL.
+  stats [--window 24h|7d|30d|all]
+        Real persisted aggregates; settlement and delivery rates separate.
+
+AGENTS
+  mcp serve     Buyer MCP server on stdio (JSON-RPC on stdout, logs on
+                stderr). Same token via config or SOTTO_SESSION_TOKEN.
+
+GLOBAL FLAGS
+  --json        Machine-readable output on every read command.
+  --api-origin  Override the API origin for this invocation.
+  --version     Print the CLI version.        --help  This text.
+
+ENVIRONMENT
+  SOTTO_API_ORIGIN, SOTTO_SESSION_TOKEN, SOTTO_WALLET_URL, NO_COLOR
+
+EXIT CODES
+  0 delivered/ok  1 failure  2 usage  3 no session  4 wallet-rejected
+  5 wallet-unsupported  6 settlement-rejected  7 expired
+  8 ambiguous or settled-undelivered (reconcile; NEVER auto-retried)`;
+
+// src/output.ts
+function colorEnabled(io2) {
+  return io2.isTTY && io2.env.NO_COLOR === void 0;
+}
+function bold(io2, text2) {
+  return colorEnabled(io2) ? `\x1B[1m${text2}\x1B[0m` : text2;
+}
+function truncateUpdateId(updateId) {
+  if (updateId.length <= 14) return updateId;
+  return `${updateId.slice(0, 8)}\u2026${updateId.slice(-4)}`;
+}
+function amountWithAsset(atomic, asset) {
+  return `${atomic} ${asset} (atomic units)`;
+}
+function resourceUrl(origin, route) {
+  return `${origin}${route}`;
+}
+function printJson(io2, value) {
+  io2.stdout(JSON.stringify(value, null, 2));
+}
+function railLine(mark, timestamp, label) {
+  const box = mark === "done" ? "[x]" : mark === "active" ? "[>]" : "[ ]";
+  const at = timestamp === null ? "                        " : timestamp;
+  return `${box} ${at}  ${label}`;
+}
+function table(rows, header) {
+  const all = [header, ...rows];
+  const widths = header.map(
+    (_, column) => Math.max(...all.map((row) => (row[column] ?? "").length))
+  );
+  return all.map(
+    (row) => row.map((cell, column) => cell.padEnd(widths[column] ?? 0)).join("  ").trimEnd()
+  );
+}
+
+// src/commands/rail.ts
+var STATION_LABELS = Object.freeze({
+  "intent-created": "Intent journaled",
+  "prepared-hash-verified": "Prepared transaction hash verified",
+  "approval-requested": "Human wallet approval requested",
+  "wallet-rejected": "Wallet rejected this exact call",
+  "wallet-unsupported": "Wallet cannot sign this transaction shape",
+  "signature-verified": "Wallet signature verified",
+  "execution-started": "Canton execution started",
+  "settlement-reconciled": "Settlement reconciled on Canton",
+  "settlement-rejected": "Settlement rejected by Canton"
+});
+function renderEvent(io2, event) {
+  io2.stdout(
+    railLine(
+      "done",
+      event.recordedAt,
+      `${STATION_LABELS[event.type] ?? event.type}${event.updateId === null ? "" : ` \u2014 update ${event.updateId}`}`
+    )
+  );
+}
+function renderApprovalBlock(io2, walletUrl) {
+  io2.stdout("");
+  io2.stdout(bold(io2, "\u2500\u2500 HUMAN APPROVAL REQUIRED \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  io2.stdout("A human must approve this exact prepared call in the Sotto");
+  io2.stdout("wallet before any value moves. This CLI cannot sign anything.");
+  if (walletUrl !== void 0) {
+    io2.stdout(bold(io2, `Wallet approval page: ${walletUrl}`));
+  } else {
+    io2.stdout(
+      "Open the wallet link from your Sotto onboarding to approve (store it once with `sotto login --wallet-url <url>`)."
+    );
+  }
+  io2.stdout(bold(io2, "\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  io2.stdout("");
+}
+function reconcileGuidance(io2, attemptId) {
+  io2.stderr(
+    "This outcome is not final proof of delivery. Do NOT retry the purchase \u2014 a second attempt can pay twice for one call."
+  );
+  io2.stderr(`Reconcile with: sotto status ${attemptId}`);
+  io2.stderr(`Evidence:       sotto evidence ${attemptId}`);
+}
+var DELIVERY_POLL_MS = 2e3;
+var DELIVERY_WAIT_MS = 12e4;
+async function settleDeliveryExit(io2, client, attemptId, waitMs = DELIVERY_WAIT_MS, pollMs = DELIVERY_POLL_MS) {
+  const deadline = Date.now() + waitMs;
+  for (; ; ) {
+    const detail = await client.purchases.get(attemptId);
+    const outcome = pairedOutcome(
+      detail.attempt.state,
+      detail.delivery?.claimState ?? null
+    );
+    if (outcome.delivered) {
+      io2.stdout(
+        railLine(
+          "done",
+          detail.delivery?.respondedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+          "Delivered \u2014 paid provider response recorded"
+        )
+      );
+      io2.stdout("Settled: yes. Delivered: yes.");
+      return EXIT.ok;
+    }
+    if (outcome.deliveryFailed) {
+      io2.stdout(
+        `Settled: yes. Delivered: NO \u2014 delivery ${detail.delivery?.claimState ?? "unknown"} (${detail.delivery?.failureCode ?? "no failure code"}).`
+      );
+      reconcileGuidance(io2, attemptId);
+      return EXIT.ambiguous;
+    }
+    if (Date.now() >= deadline) {
+      io2.stdout(
+        "Settled: yes. Delivered: not yet \u2014 the delivery worker has not reported a terminal state within the wait budget."
+      );
+      reconcileGuidance(io2, attemptId);
+      return EXIT.ambiguous;
+    }
+    await new Promise((resolve) => setTimeout(resolve, pollMs));
+  }
+}
+function terminalExit(eventType) {
+  if (!isTerminalAttemptState(eventType)) return void 0;
+  switch (eventType) {
+    case "wallet-rejected":
+      return EXIT.walletRejected;
+    case "wallet-unsupported":
+      return EXIT.walletUnsupported;
+    case "settlement-rejected":
+      return EXIT.settlementRejected;
+    default:
+      return EXIT.ok;
+  }
+}
+
+// src/commands/buy.ts
+function renderPreparedCall(io2, client, initiated, listingId) {
+  io2.stdout(bold(io2, "Prepared paid call (exact, one call):"));
+  io2.stdout(`  Listing:            ${listingId}`);
+  io2.stdout(`  Attempt:            ${initiated.attemptId}`);
+  io2.stdout(`  Command ID:         ${initiated.commandId}`);
+  io2.stdout(
+    `  Observed price:     ${initiated.price.observed.amountAtomic} (atomic) at ${initiated.price.observed.observedAt}`
+  );
+  io2.stdout(`  Recipient:          ${initiated.price.observed.recipient}`);
+  io2.stdout(`  Execute before:     ${initiated.executeBefore}`);
+  io2.stdout(`  API origin:         ${client.origin}`);
+}
+async function renderCommitments(io2, client, attemptId) {
+  const detail = await client.purchases.get(attemptId);
+  io2.stdout(`  Request commitment: ${detail.attempt.requestCommitment}`);
+  io2.stdout(`  Purchase commit.:   ${detail.attempt.purchaseCommitment}`);
+  io2.stdout(
+    `  Prepared tx hash:   ${detail.attempt.preparedTransactionHash ?? "not prepared yet \u2014 appears at prepared-hash-verified"}`
+  );
+}
+async function buyCommand(input) {
+  const { io: io2, flags } = input;
+  const listingId = input.positionals[0];
+  if (listingId === void 0) {
+    throw new CliUsageError(
+      "Pass the listing ID of the verified resource: sotto buy <listingId>"
+    );
+  }
+  if (flags.input !== void 0) {
+    throw new CliUsageError(
+      "The purchasing API binds no request input yet \u2014 only parameterless resources are purchasable, so --input has nothing to carry. Drop --input to purchase the exact listed call."
+    );
+  }
+  const context = buildClient(
+    input.env,
+    typeof flags["api-origin"] === "string" ? { apiOrigin: flags["api-origin"] } : {},
+    input.fetchImpl
+  );
+  requireToken(context.settings);
+  const { client } = context;
+  const maxPrice = parseMaxPrice(
+    typeof flags["max-price"] === "string" ? flags["max-price"] : void 0
+  );
+  if (maxPrice !== void 0) {
+    const resource = await client.catalog.resourceByListing(listingId);
+    if (BigInt(resource.amountAtomic) > maxPrice) {
+      io2.stderr(
+        `Local policy stop (not a ledger limit): the indexed price ${amountWithAsset(resource.amountAtomic, resource.asset)} exceeds --max-price ${maxPrice}. Nothing was initiated.`
+      );
+      return EXIT.usage;
+    }
+  }
+  const initiated = await client.purchases.initiate(
+    listingId
+  );
+  renderPreparedCall(io2, client, initiated, listingId);
+  await renderCommitments(io2, client, initiated.attemptId);
+  io2.stdout("");
+  if (flags["no-wait"] === true) {
+    if (flags.json === true) printJson(io2, initiated);
+    io2.stdout(`Follow it with: sotto status ${initiated.attemptId} --follow`);
+    return EXIT.ok;
+  }
+  return followToExit(io2, client, initiated.attemptId, {
+    executeBefore: initiated.executeBefore,
+    walletUrl: context.settings.walletUrl,
+    json: flags.json === true
+  });
+}
+async function followToExit(io2, client, attemptId, options) {
+  io2.stdout(railLine("active", null, "Following the purchase journal\u2026"));
+  let lastType;
+  const expiresAt = options.executeBefore === void 0 ? void 0 : Date.parse(options.executeBefore);
+  const controller = new AbortController();
+  const expiry = expiresAt === void 0 ? void 0 : setTimeout(
+    () => controller.abort(),
+    // Small grace after execute-before: a settlement event recorded
+    // right at the deadline still arrives before the stream stops.
+    Math.max(expiresAt - Date.now() + 5e3, 1e3)
+  );
+  try {
+    for await (const event of client.purchases.follow(attemptId, {
+      signal: controller.signal,
+      ...options.lastEventId === void 0 ? {} : { lastEventId: options.lastEventId }
+    })) {
+      renderEvent(io2, event);
+      lastType = event.type;
+      if (event.type === "approval-requested") {
+        renderApprovalBlock(io2, options.walletUrl);
+      }
+    }
+  } catch (error) {
+    if (!controller.signal.aborted) {
+      if (error instanceof SottoApiError) throw error;
+      io2.stderr(String(error instanceof Error ? error.message : error));
+      reconcileGuidance(io2, attemptId);
+      return EXIT.ambiguous;
+    }
+  } finally {
+    if (expiry !== void 0) clearTimeout(expiry);
+  }
+  if (controller.signal.aborted && terminalExit(lastType ?? "") === void 0) {
+    io2.stdout(
+      "The execute-before deadline passed without a terminal journal event. The attempt can no longer settle as prepared."
+    );
+    reconcileGuidance(io2, attemptId);
+    return EXIT.expired;
+  }
+  const exit = terminalExit(lastType ?? "");
+  if (exit === void 0) {
+    reconcileGuidance(io2, attemptId);
+    return EXIT.ambiguous;
+  }
+  if (exit !== EXIT.ok) {
+    if (options.json === true) {
+      const detail = await client.purchases.get(attemptId);
+      printJson(io2, detail);
+    }
+    return exit;
+  }
+  const deliveryExit = await settleDeliveryExit(io2, client, attemptId);
+  if (options.json === true) {
+    const detail = await client.purchases.get(attemptId);
+    printJson(io2, {
+      ...detail,
+      pairedOutcome: pairedOutcome(
+        detail.attempt.state,
+        detail.delivery?.claimState ?? null
+      )
+    });
+  }
+  return deliveryExit;
+}
+
+// src/commands/catalog.ts
+function apiOriginFlag(flags) {
+  return typeof flags["api-origin"] === "string" ? { apiOrigin: flags["api-origin"] } : {};
+}
+async function searchCommand(input) {
+  const { io: io2, flags } = input;
+  if (flags.tag !== void 0) {
+    throw new CliUsageError(
+      "The verified catalog carries no tags yet, so --tag cannot filter anything. Filter by --method, --max-price, or free text instead."
+    );
+  }
+  const { client } = buildClient(
+    input.env,
+    apiOriginFlag(flags),
+    input.fetchImpl
+  );
+  const maxPrice = parseMaxPrice(
+    typeof flags["max-price"] === "string" ? flags["max-price"] : void 0
+  );
+  const resources = filterResources(await client.catalog.listResources(), {
+    ...input.positionals[0] === void 0 ? {} : { query: input.positionals[0] },
+    ...typeof flags.method === "string" ? { method: flags.method } : {},
+    ...maxPrice === void 0 ? {} : { maxPriceAtomic: maxPrice }
+  });
+  if (flags.json === true) {
+    printJson(io2, { resources });
+    return EXIT.ok;
+  }
+  if (resources.length === 0) {
+    io2.stdout("No verified resources match. The catalog answer is honest \u2014");
+    io2.stdout("nothing is hidden and nothing is sampled.");
+    return EXIT.ok;
+  }
+  for (const line of table(
+    resources.map((resource) => [
+      resource.listingId,
+      resource.method,
+      resourceUrl(resource.normalizedOrigin, resource.routeTemplate),
+      amountWithAsset(resource.amountAtomic, resource.asset),
+      resource.lastVerifiedAt
+    ]),
+    ["LISTING", "METHOD", "RESOURCE", "PRICE", "LAST VERIFIED"]
+  )) {
+    io2.stdout(line);
+  }
+  return EXIT.ok;
+}
+function renderResource(io2, resource, health) {
+  io2.stdout(`${resource.name} \u2014 ${resource.providerDisplayName}`);
+  io2.stdout(resource.description);
+  io2.stdout("");
+  io2.stdout(
+    `Resource:       ${resource.method} ${resourceUrl(resource.normalizedOrigin, resource.routeTemplate)}`
+  );
+  io2.stdout(`Network:        ${resource.network}`);
+  io2.stdout(
+    `Observed price: ${amountWithAsset(resource.amountAtomic, resource.asset)}`
+  );
+  io2.stdout(`Recipient:      ${resource.recipient}`);
+  io2.stdout(`Last verified:  ${resource.lastVerifiedAt} (server-observed)`);
+  io2.stdout(
+    `Health:         ${health === null ? "no observation recorded yet" : JSON.stringify(health)}`
+  );
+}
+async function inspectCommand(input, withPrepareGuidance) {
+  const reference = input.positionals[0];
+  if (reference === void 0) {
+    throw new CliUsageError(
+      "Pass a listing ID or the resource's canonical URL: sotto inspect <resource> | sotto try <resource-url>"
+    );
+  }
+  const { client } = buildClient(
+    input.env,
+    apiOriginFlag(input.flags),
+    input.fetchImpl
+  );
+  const resource = await resolveResource(client, reference);
+  const health = await client.catalog.resourceHealth(resource.listingId);
+  if (input.flags.json === true) {
+    printJson(input.io, { resource, health });
+    return EXIT.ok;
+  }
+  renderResource(input.io, resource, health);
+  if (withPrepareGuidance) {
+    input.io.stdout("");
+    input.io.stdout("To prepare this exact paid call for human approval:");
+    input.io.stdout(`  sotto buy ${resource.listingId}`);
+    input.io.stdout(
+      "Purchase initiation re-observes the live 402; a changed price stops before anything is journaled."
+    );
+  }
+  return EXIT.ok;
+}
+
+// src/commands/session.ts
+async function loginCommand(input) {
+  const { io: io2, env, flags } = input;
+  const token = typeof flags.token === "string" ? flags.token : void 0;
+  const apiOrigin = typeof flags["api-origin"] === "string" ? flags["api-origin"] : void 0;
+  const walletUrl = typeof flags["wallet-url"] === "string" ? flags["wallet-url"] : void 0;
+  const existing = readConfig(env);
+  const origin = apiOrigin ?? env.SOTTO_API_ORIGIN ?? existing.apiOrigin;
+  if (token === void 0) {
+    io2.stdout("To connect this CLI to your Sotto owner session:");
+    io2.stdout("");
+    io2.stdout(
+      `  1. Open the Sotto app${origin === void 0 ? "" : ` for ${origin}`} and establish an owner session (hosted onboarding or party proof).`
+    );
+    io2.stdout(
+      "  2. Copy the one-time session token from the session response (the app shows it once; it is the same opaque token the browser cookie carries)."
+    );
+    io2.stdout("  3. Run: sotto login --api-origin <api-url> --token <token>");
+    io2.stdout("");
+    io2.stdout(
+      "The token is stored 0600 in ~/.config/sotto/config.json and sent only as an Authorization: Bearer header to that API origin."
+    );
+    return EXIT.ok;
+  }
+  if (!isValidToken(token)) {
+    throw new CliUsageError(
+      "The session token must be the 64-hex value from the session response. Do not paste a cookie header or a signing key."
+    );
+  }
+  if (origin === void 0) {
+    throw new CliUsageError(
+      "Pass --api-origin <url> (or set SOTTO_API_ORIGIN) so the token is bound to one API origin."
+    );
+  }
+  const { client } = buildClient(env, { apiOrigin: origin }, input.fetchImpl);
+  const path = writeConfig(env, {
+    apiOrigin: origin,
+    token,
+    ...walletUrl === void 0 ? existing.walletUrl === void 0 ? {} : { walletUrl: existing.walletUrl } : { walletUrl }
+  });
+  io2.stdout(`Owner session token stored (0600) at ${path}.`);
+  io2.stdout(`API origin: ${origin}`);
+  io2.stdout("Verify it with: sotto whoami");
+  return EXIT.ok;
+}
+async function whoamiCommand(input) {
+  const { io: io2, env, flags } = input;
+  const context = buildClient(
+    env,
+    typeof flags["api-origin"] === "string" ? { apiOrigin: flags["api-origin"] } : {},
+    input.fetchImpl
+  );
+  const hasToken = context.settings.token !== void 0;
+  const sessionValid = hasToken ? await context.client.session.verify() : false;
+  const report = {
+    apiOrigin: context.client.origin,
+    tokenConfigured: hasToken,
+    tokenSource: context.settings.tokenSource,
+    sessionValid
+  };
+  if (flags.json === true) {
+    printJson(io2, report);
+  } else {
+    io2.stdout(`API origin:   ${report.apiOrigin}`);
+    io2.stdout(
+      `Token:        ${hasToken ? `configured (${report.tokenSource})` : "absent"}`
+    );
+    io2.stdout(
+      `Session:      ${sessionValid ? "valid owner session" : hasToken ? "rejected \u2014 expired or revoked; run `sotto login` again" : "absent \u2014 run `sotto login`"}`
+    );
+  }
+  return sessionValid ? EXIT.ok : EXIT.auth;
+}
+async function logoutCommand(input) {
+  const { io: io2, env } = input;
+  const config = readConfig(env);
+  if (config.token !== void 0 && config.apiOrigin !== void 0) {
+    try {
+      const { client } = buildClient(env, {}, input.fetchImpl);
+      await client.session.logout();
+      io2.stdout("Server session revoked.");
+    } catch {
+      io2.stderr(
+        "The API did not confirm revocation; the local token is removed anyway. The session still expires server-side on its own TTL."
+      );
+    }
+  }
+  if (config.apiOrigin === void 0 && config.walletUrl === void 0) {
+    deleteConfig(env);
+  } else {
+    writeConfig(env, {
+      ...config.apiOrigin === void 0 ? {} : { apiOrigin: config.apiOrigin },
+      ...config.walletUrl === void 0 ? {} : { walletUrl: config.walletUrl }
+    });
+  }
+  io2.stdout("Local session token removed.");
+  return EXIT.ok;
+}
+
+// src/commands/status.ts
+function originFlag(flags) {
+  return typeof flags["api-origin"] === "string" ? { apiOrigin: flags["api-origin"] } : {};
+}
+async function statusCommand(input) {
+  const attemptId = input.positionals[0];
+  if (attemptId === void 0) {
+    throw new CliUsageError("Pass the attempt ID: sotto status <attemptId>");
+  }
+  const context = buildClient(
+    input.env,
+    originFlag(input.flags),
+    input.fetchImpl
+  );
+  requireToken(context.settings);
+  const detail = await context.client.purchases.get(attemptId);
+  const outcome = pairedOutcome(
+    detail.attempt.state,
+    detail.delivery?.claimState ?? null
+  );
+  if (input.flags.json === true) {
+    printJson(input.io, { ...detail, pairedOutcome: outcome });
+    return EXIT.ok;
+  }
+  const { io: io2 } = input;
+  io2.stdout(`Attempt ${detail.attempt.attemptId}`);
+  io2.stdout(`State:          ${detail.attempt.state}`);
+  io2.stdout(`Created:        ${detail.attempt.createdAt}`);
+  io2.stdout(`Execute before: ${detail.attempt.executeBefore}`);
+  for (const event of detail.events) {
+    io2.stdout(
+      railLine(
+        "done",
+        event.recordedAt,
+        STATION_LABELS[event.type] ?? event.type
+      )
+    );
+  }
+  io2.stdout(
+    `Settlement:     ${detail.settlement?.state ?? "not submitted"}` + (detail.settlement?.updateId == null ? "" : ` \u2014 update ${truncateUpdateId(detail.settlement.updateId)}`)
+  );
+  io2.stdout(
+    `Delivery:       ${detail.delivery?.claimState ?? "not started"}` + (detail.delivery?.failureCode == null ? "" : ` (${detail.delivery.failureCode})`)
+  );
+  if (outcome.deliveryPending || outcome.deliveryFailed) {
+    reconcileGuidance(io2, detail.attempt.attemptId);
+  }
+  if (input.flags.follow === true && detail.events.length > 0) {
+    const lastSequence = detail.events[detail.events.length - 1]?.sequence ?? 0;
+    return followToExit(io2, context.client, attemptId, {
+      executeBefore: detail.attempt.executeBefore,
+      walletUrl: context.settings.walletUrl,
+      lastEventId: lastSequence
+    });
+  }
+  return EXIT.ok;
+}
+async function evidenceCommand(input) {
+  const attemptId = input.positionals[0];
+  if (attemptId === void 0) {
+    throw new CliUsageError("Pass the attempt ID: sotto evidence <attemptId>");
+  }
+  const context = buildClient(
+    input.env,
+    originFlag(input.flags),
+    input.fetchImpl
+  );
+  const evidence = await context.client.attempts.evidence(attemptId);
+  if (input.flags.json === true) {
+    printJson(input.io, { attempt: evidence });
+    return EXIT.ok;
+  }
+  const { io: io2 } = input;
+  io2.stdout(`Attempt ${evidence.attemptId}`);
+  if (evidence.resource !== null) {
+    io2.stdout(
+      `Resource:   ${evidence.resource.method} ${evidence.resource.origin}${evidence.resource.route}`
+    );
+  }
+  if (evidence.amount !== null) {
+    io2.stdout(
+      `Amount:     ${evidence.amount.atomic} ${evidence.amount.asset} (atomic units)`
+    );
+  }
+  io2.stdout(
+    `Settlement: ${evidence.settlement.status}` + (evidence.settlement.updateId === null ? "" : ` \u2014 update ${evidence.settlement.updateId}`)
+  );
+  if (evidence.settlement.explorerUrl !== null) {
+    io2.stdout(`Explorer:   ${evidence.settlement.explorerUrl}`);
+  }
+  io2.stdout(
+    `Delivery:   ${evidence.delivery.status}` + (evidence.delivery.failureCode === null ? "" : ` (${evidence.delivery.failureCode})`)
+  );
+  for (const entry of evidence.timeline) {
+    io2.stdout(
+      railLine("done", entry.recordedAt, `${entry.type} [${entry.source}]`)
+    );
+  }
+  for (const redaction of evidence.redactions) {
+    io2.stdout(`Withheld:   ${redaction.field} \u2014 ${redaction.reason}`);
+  }
+  return EXIT.ok;
+}
+async function statsCommand(input) {
+  const context = buildClient(
+    input.env,
+    originFlag(input.flags),
+    input.fetchImpl
+  );
+  const window = typeof input.flags.window === "string" ? input.flags.window : "7d";
+  const stats = await context.client.stats.read(window);
+  if (input.flags.json === true) {
+    printJson(input.io, stats);
+    return EXIT.ok;
+  }
+  const { io: io2 } = input;
+  const rate = (value) => value === null ? "unavailable (no denominator)" : `${(value * 100).toFixed(1)}%`;
+  io2.stdout(`Window: ${stats.window}`);
+  io2.stdout(
+    `Attempts: ${stats.attempts.total} total, ${stats.attempts.executed} executed`
+  );
+  io2.stdout(`Settlement rate: ${rate(stats.attempts.settlementRate)}`);
+  io2.stdout(`Delivery rate:   ${rate(stats.attempts.deliveryRate)}`);
+  io2.stdout(
+    `Probes: ${stats.probes.observations} observations, healthy rate ${rate(stats.probes.healthyRate)}`
+  );
+  io2.stdout(`Source commit: ${stats.sourceCommit}`);
+  return EXIT.ok;
+}
+
+// src/version.ts
+var CLI_VERSION = "0.1.0";
+
+// src/mcp/protocol.ts
+var MCP_PROTOCOL_VERSION = "2025-06-18";
+var JsonRpcError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "JsonRpcError";
+  }
+};
+function parseMessage(line) {
+  const trimmed = line.trim();
+  if (trimmed === "") return void 0;
+  let parsed;
+  try {
+    parsed = JSON.parse(trimmed);
+  } catch {
+    throw new JsonRpcError(-32700, "parse error: the line was not JSON");
+  }
+  if (typeof parsed !== "object" || parsed === null || parsed.jsonrpc !== "2.0") {
+    throw new JsonRpcError(-32600, "invalid request: jsonrpc 2.0 required");
+  }
+  return parsed;
+}
+async function handleMessage(definition, message) {
+  const id = message.id;
+  const isRequest = id !== void 0;
+  if (typeof message.method !== "string") {
+    return isRequest ? respondError(id, -32600, "invalid request: method missing") : void 0;
+  }
+  if (message.method.startsWith("notifications/")) return void 0;
+  const handler = message.method === "initialize" ? initializeHandler(definition) : message.method === "ping" ? () => ({}) : definition.methods[message.method];
+  if (handler === void 0) {
+    return isRequest ? respondError(id, -32601, `method not found: ${message.method}`) : void 0;
+  }
+  try {
+    const result = await handler(message.params ?? {});
+    return isRequest ? JSON.stringify({ jsonrpc: "2.0", id, result }) : void 0;
+  } catch (error) {
+    if (!isRequest) return void 0;
+    if (error instanceof JsonRpcError) {
+      return respondError(id, error.code, error.message);
+    }
+    return respondError(
+      id,
+      -32603,
+      error instanceof Error ? error.message : "internal error"
+    );
+  }
+}
+function initializeHandler(definition) {
+  return (params) => {
+    const requested = params.protocolVersion;
+    return {
+      protocolVersion: typeof requested === "string" && requested !== "" ? requested : MCP_PROTOCOL_VERSION,
+      capabilities: { tools: { listChanged: false } },
+      serverInfo: definition.serverInfo
+    };
+  };
+}
+function respondError(id, code, message) {
+  return JSON.stringify({ jsonrpc: "2.0", id, error: { code, message } });
+}
+async function serveJsonRpc(definition, streams) {
+  let buffer = "";
+  const decoder = new TextDecoder();
+  for await (const chunk of streams.input) {
+    buffer += typeof chunk === "string" ? chunk : decoder.decode(chunk, { stream: true });
+    for (; ; ) {
+      const newline = buffer.indexOf("\n");
+      if (newline === -1) break;
+      const line = buffer.slice(0, newline);
+      buffer = buffer.slice(newline + 1);
+      let message;
+      try {
+        message = parseMessage(line);
+      } catch (error) {
+        if (error instanceof JsonRpcError) {
+          streams.write(
+            `${JSON.stringify({ jsonrpc: "2.0", id: null, error: { code: error.code, message: error.message } })}
+`
+          );
+        }
+        continue;
+      }
+      if (message === void 0) continue;
+      const response = await handleMessage(definition, message);
+      if (response !== void 0) streams.write(`${response}
+`);
+    }
+  }
+}
+
+// src/mcp/tools.ts
+var text = (value) => ({
+  content: [{ type: "text", text: JSON.stringify(value, null, 2) }]
+});
+var failure = (message) => ({
+  content: [{ type: "text", text: message }],
+  isError: true
+});
+var str = (value) => typeof value === "string" && value !== "" ? value : void 0;
+var TOOL_DEFINITIONS = Object.freeze([
+  {
+    name: "search_resources",
+    title: "Search verified Canton x402 resources",
+    description: "Search Sotto's verified catalog. Read-only; an empty catalog answers an honest empty list, never samples.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        query: { type: "string", description: "Free-text filter" },
+        method: { type: "string", description: "HTTP method filter" },
+        maxPriceAtomic: {
+          type: "string",
+          description: "Upper price bound in atomic units"
+        }
+      },
+      additionalProperties: false
+    },
+    annotations: { readOnlyHint: true, openWorldHint: true }
+  },
+  {
+    name: "inspect_resource",
+    title: "Inspect one verified resource",
+    description: "Fetch one resource by listing ID or canonical URL: method, route, fresh server-observed price with its timestamp, recipient, and the latest health observation. Read-only.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        resource: {
+          type: "string",
+          description: "Listing ID or canonical resource URL"
+        }
+      },
+      required: ["resource"],
+      additionalProperties: false
+    },
+    annotations: { readOnlyHint: true, openWorldHint: true }
+  },
+  {
+    name: "purchase",
+    title: "Purchase (moves real money after human wallet approval)",
+    description: "Initiate ONE exact purchase of a verified resource. This journals a real payment intent; a HUMAN must approve the prepared call at the Sotto wallet before any value moves. This tool cannot sign, has no key, and never retries. Ask the human before calling it.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        listingId: { type: "string", description: "Verified listing ID" },
+        maxPriceAtomic: {
+          type: "string",
+          description: "Local policy bound (atomic units) \u2014 refused client-side, not a ledger-enforced limit"
+        }
+      },
+      required: ["listingId"],
+      additionalProperties: false
+    },
+    annotations: {
+      readOnlyHint: false,
+      destructiveHint: false,
+      idempotentHint: false,
+      openWorldHint: true
+    }
+  },
+  {
+    name: "purchase_status",
+    title: "Read a purchase's full journal state",
+    description: "Full lifecycle for one attempt: journal events, settlement and delivery as separate facts, including the honest settled-undelivered case with reconcile guidance. Read-only.",
+    inputSchema: {
+      type: "object",
+      properties: { attemptId: { type: "string" } },
+      required: ["attemptId"],
+      additionalProperties: false
+    },
+    annotations: { readOnlyHint: true, openWorldHint: true }
+  },
+  {
+    name: "get_evidence",
+    title: "Read attempt evidence",
+    description: "Paired settlement/delivery outcome, source-labeled timeline, update ID, and public explorer URL when indexed. Read-only.",
+    inputSchema: {
+      type: "object",
+      properties: { attemptId: { type: "string" } },
+      required: ["attemptId"],
+      additionalProperties: false
+    },
+    annotations: { readOnlyHint: true, openWorldHint: true }
+  }
+]);
+async function callTool(client, name, args) {
+  try {
+    switch (name) {
+      case "search_resources": {
+        const maxPrice = parseMaxPrice(str(args.maxPriceAtomic));
+        const query = str(args.query);
+        const method = str(args.method);
+        const resources = filterResources(
+          await client.catalog.listResources(),
+          {
+            ...query === void 0 ? {} : { query },
+            ...method === void 0 ? {} : { method },
+            ...maxPrice === void 0 ? {} : { maxPriceAtomic: maxPrice }
+          }
+        );
+        return text({ resources });
+      }
+      case "inspect_resource": {
+        const reference = str(args.resource);
+        if (reference === void 0) return failure("resource is required");
+        const resource = await resolveResource(client, reference);
+        const health = await client.catalog.resourceHealth(resource.listingId);
+        return text({ resource, health });
+      }
+      case "purchase": {
+        const listingId = str(args.listingId);
+        if (listingId === void 0) return failure("listingId is required");
+        const maxPrice = parseMaxPrice(str(args.maxPriceAtomic));
+        if (maxPrice !== void 0) {
+          const resource = await client.catalog.resourceByListing(listingId);
+          if (BigInt(resource.amountAtomic) > maxPrice) {
+            return failure(
+              `local-policy-stop: the indexed price ${resource.amountAtomic} ${resource.asset} (atomic) exceeds maxPriceAtomic ${maxPrice}. Nothing was initiated. This is local policy, not a ledger-enforced limit. Report the block to the human instead of seeking another transfer path.`
+            );
+          }
+        }
+        const initiated = await client.purchases.initiate(listingId);
+        return text({
+          ...initiated,
+          humanApproval: "A HUMAN must approve this exact prepared call at the Sotto wallet before any value moves. This tool cannot sign and will not retry. Follow progress with purchase_status."
+        });
+      }
+      case "purchase_status": {
+        const attemptId = str(args.attemptId);
+        if (attemptId === void 0) return failure("attemptId is required");
+        const detail = await client.purchases.get(attemptId);
+        const outcome = pairedOutcome(
+          detail.attempt.state,
+          detail.delivery?.claimState ?? null
+        );
+        return text({
+          ...detail,
+          pairedOutcome: outcome,
+          ...outcome.deliveryPending || outcome.deliveryFailed ? {
+            reconcileGuidance: "Settled but not delivered. Do NOT purchase again \u2014 a second attempt can pay twice. Reconcile with get_evidence and report the state to the human."
+          } : {}
+        });
+      }
+      case "get_evidence": {
+        const attemptId = str(args.attemptId);
+        if (attemptId === void 0) return failure("attemptId is required");
+        return text({ attempt: await client.attempts.evidence(attemptId) });
+      }
+      default:
+        return failure(`unknown tool: ${name}`);
+    }
+  } catch (error) {
+    if (error instanceof SottoApiError) {
+      return failure(`${error.code}: ${error.detail ?? "no detail"}`);
+    }
+    return failure(error instanceof Error ? error.message : String(error));
+  }
+}
+
+// src/mcp/serve.ts
+function buildMcpDefinition(env, fetchImpl) {
+  const context = buildClient(env, {}, fetchImpl);
+  requireToken(context.settings);
+  return Object.freeze({
+    serverInfo: Object.freeze({ name: "sotto", version: CLI_VERSION }),
+    methods: Object.freeze({
+      "tools/list": () => ({
+        tools: TOOL_DEFINITIONS.map((tool) => ({
+          name: tool.name,
+          title: tool.title,
+          description: tool.description,
+          inputSchema: tool.inputSchema,
+          annotations: tool.annotations
+        }))
+      }),
+      "tools/call": async (params) => {
+        const name = typeof params.name === "string" ? params.name : "";
+        const args = typeof params.arguments === "object" && params.arguments !== null ? params.arguments : {};
+        return callTool(context.client, name, args);
+      }
+    })
+  });
+}
+async function serveMcp(env, streams) {
+  const definition = buildMcpDefinition(env);
+  streams.logError(
+    `sotto mcp serve: stdio JSON-RPC against ${env.SOTTO_API_ORIGIN ?? "configured origin"} \u2014 logs on stderr only`
+  );
+  await serveJsonRpc(definition, streams);
+}
+
+// src/run.ts
+var FLAG_OPTIONS = {
+  "api-origin": { type: "string" },
+  "max-price": { type: "string" },
+  "no-wait": { type: "boolean" },
+  "wallet-url": { type: "string" },
+  follow: { type: "boolean" },
+  help: { type: "boolean" },
+  input: { type: "string" },
+  json: { type: "boolean" },
+  method: { type: "string" },
+  tag: { type: "string" },
+  token: { type: "string" },
+  version: { type: "boolean" },
+  window: { type: "string" }
+};
+function mapError(io2, error) {
+  if (error instanceof CliUsageError) {
+    io2.stderr(error.message);
+    return EXIT.usage;
+  }
+  if (error instanceof CliAuthError) {
+    io2.stderr(error.message);
+    return EXIT.auth;
+  }
+  if (error instanceof SottoApiError) {
+    if (error.code === "session-required") {
+      io2.stderr(
+        "The owner session is absent, expired, or revoked. Run `sotto login` with a fresh token from the Sotto app."
+      );
+      return EXIT.auth;
+    }
+    io2.stderr(`${error.code}: ${error.detail ?? `HTTP ${error.status}`}`);
+    return EXIT.failure;
+  }
+  if (error instanceof SottoTransportError) {
+    io2.stderr(error.message);
+    return EXIT.failure;
+  }
+  io2.stderr(error instanceof Error ? error.message : String(error));
+  return EXIT.failure;
+}
+async function run(argv, options) {
+  const { io: io2, env } = options;
+  let parsed;
+  try {
+    parsed = parseArgs({
+      args: [...argv],
+      options: FLAG_OPTIONS,
+      allowPositionals: true,
+      strict: true
+    });
+  } catch (error) {
+    io2.stderr(error instanceof Error ? error.message : String(error));
+    io2.stderr("Run `sotto --help` for usage.");
+    return EXIT.usage;
+  }
+  const flags = parsed.values;
+  const [command, ...positionals] = parsed.positionals;
+  if (flags.version === true) {
+    io2.stdout(CLI_VERSION);
+    return EXIT.ok;
+  }
+  if (command === void 0 || flags.help === true) {
+    io2.stdout(HELP_TEXT);
+    return command === void 0 && flags.help !== true ? EXIT.usage : EXIT.ok;
+  }
+  const input = {
+    io: io2,
+    env,
+    positionals,
+    flags,
+    ...options.fetchImpl === void 0 ? {} : { fetchImpl: options.fetchImpl }
+  };
+  try {
+    switch (command) {
+      case "login":
+        return await loginCommand(input);
+      case "whoami":
+        return await whoamiCommand(input);
+      case "logout":
+        return await logoutCommand(input);
+      case "search":
+        return await searchCommand(input);
+      case "inspect":
+        return await inspectCommand(input, false);
+      case "try":
+        return await inspectCommand(input, true);
+      case "buy":
+        return await buyCommand(input);
+      case "status":
+        return await statusCommand(input);
+      case "evidence":
+        return await evidenceCommand(input);
+      case "stats":
+        return await statsCommand(input);
+      case "mcp": {
+        if (positionals[0] !== "serve") {
+          io2.stderr("Usage: sotto mcp serve");
+          return EXIT.usage;
+        }
+        if (options.mcpStreams === void 0) {
+          io2.stderr("MCP stdio streams are unavailable in this environment.");
+          return EXIT.failure;
+        }
+        await serveMcp(env, options.mcpStreams);
+        return EXIT.ok;
+      }
+      default:
+        io2.stderr(`Unknown command: ${command}. Run \`sotto --help\`.`);
+        return EXIT.usage;
+    }
+  } catch (error) {
+    return mapError(io2, error);
+  }
+}
+
+// src/bin.ts
+var io = {
+  stdout: (line) => process.stdout.write(`${line}
+`),
+  stderr: (line) => process.stderr.write(`${line}
+`),
+  env: process.env,
+  isTTY: process.stdout.isTTY === true
+};
+var exitCode = await run(process.argv.slice(2), {
+  io,
+  env: process.env,
+  mcpStreams: {
+    input: process.stdin,
+    write: (frame) => void process.stdout.write(frame),
+    logError: (line) => void process.stderr.write(`${line}
+`)
+  }
+});
+process.exitCode = exitCode;
+//# sourceMappingURL=bin.js.map
+//# sourceMappingURL=bin.js.map