@wafermapxyz/cli 0.0.0-stage → 0.4.1

package/dist/cli.js

@@ -0,0 +1,1771 @@
+#!/usr/bin/env node
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res, err) => function __init() {
+  if (err) throw err[0];
+  try {
+    return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+  } catch (e) {
+    throw err = [e], e;
+  }
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// shared/swap.ts
+import { decodeFunctionData, erc20Abi, formatUnits, getAddress, isAddress, parseAbi, parseUnits } from "viem";
+function checkRouter(net2, router) {
+  const r = typeof router === "string" && isAddress(router) ? getAddress(router) : null;
+  if (r !== KYBER_ROUTER[net2]) throw new SwapError("unexpected_router", `The swap API named router ${String(router)}, not KyberSwap's router ${KYBER_ROUTER[net2]} on ${net2}. Nothing was approved or sent.`);
+  return r;
+}
+async function resolveToken(net2, ref, client, lookup) {
+  const r = ref.trim();
+  let t = null;
+  if (isAddress(r)) t = TOKENS[net2].find((x) => x.address.toLowerCase() === r.toLowerCase()) ?? { symbol: "?", name: "", address: getAddress(r), decimals: null };
+  else t = TOKENS[net2].find((x) => x.symbol.toLowerCase() === r.toLowerCase()) ?? (lookup ? await lookup(net2, r) : null);
+  if (!t) throw new SwapError("unknown_token", `Unknown token "${r}" on ${net2}. Use a symbol (ETH, ${net2 === "base" ? "USDC" : "USDG, TSLA"}) or a 0x address.`);
+  if (t.decimals === null || t.symbol === "?") {
+    const [dec, sym] = await client.multicall({ contracts: [{ address: t.address, abi: erc20Abi, functionName: "decimals" }, { address: t.address, abi: erc20Abi, functionName: "symbol" }], allowFailure: true });
+    if (dec.status !== "success") throw new SwapError("not_a_token", `${t.address} is not an ERC-20 token on ${net2}.`);
+    t = { ...t, decimals: Number(dec.result), symbol: t.symbol === "?" && sym.status === "success" ? String(sym.result) : t.symbol };
+  }
+  return t;
+}
+async function quoteSwap(o) {
+  const f = o.fetch ?? fetch;
+  if (o.tokenIn.address.toLowerCase() === o.tokenOut.address.toLowerCase()) throw new SwapError("same_token", "Pick two different tokens.");
+  let units;
+  try {
+    units = parseUnits(o.amount, o.tokenIn.decimals ?? 18);
+  } catch {
+    throw new SwapError("invalid_amount", `"${o.amount}" is not an amount.`);
+  }
+  if (units <= 0n) throw new SwapError("invalid_amount", "Amount must be above zero.");
+  const q = new URLSearchParams({ tokenIn: o.tokenIn.address, tokenOut: o.tokenOut.address, amountIn: units.toString(), gasInclude: "true" });
+  const res = await f(`${KYBER(o.network)}/routes?${q}`, { headers: HEADERS }).catch(() => null);
+  const j = await res?.json().catch(() => null);
+  const s = j?.data?.routeSummary;
+  if (!res?.ok || !s) throw new SwapError("no_route", j?.message && j.message !== "successfully" ? `No route: ${j.message}` : "No swap route found for that pair and size.");
+  const inUsd = Number(s.amountInUsd);
+  const outUsd = Number(s.amountOutUsd);
+  return {
+    network: o.network,
+    tokenIn: o.tokenIn,
+    tokenOut: o.tokenOut,
+    amountIn: o.amount,
+    amountOut: formatUnits(BigInt(s.amountOut), o.tokenOut.decimals ?? 18),
+    amountInUsd: Number.isFinite(inUsd) && inUsd > 0 ? inUsd : null,
+    amountOutUsd: Number.isFinite(outUsd) && outUsd > 0 ? outUsd : null,
+    gasUsd: Number(s.gasUsd) || null,
+    impactPct: inUsd > 0 && outUsd > 0 ? Math.round((1 - outUsd / inUsd) * 1e4) / 100 : null,
+    routerAddress: checkRouter(o.network, j.data.routerAddress),
+    route: s,
+    at: Date.now()
+  };
+}
+function decodeSwap(data) {
+  let d;
+  try {
+    d = decodeFunctionData({ abi: ROUTER_ABI, data });
+  } catch {
+    throw new SwapError("unexpected_calldata", "The swap API returned a call this wallet does not recognise. Nothing was sent.");
+  }
+  const desc = d.functionName === "swap" ? d.args[0].desc : d.args[1];
+  return { fn: d.functionName, srcToken: getAddress(desc.srcToken), dstToken: getAddress(desc.dstToken), receiver: getAddress(desc.dstReceiver), amount: desc.amount, minReturn: desc.minReturnAmount, feeReceivers: desc.feeReceivers, feeAmounts: desc.feeAmounts };
+}
+async function executeSwap(o) {
+  const f = o.fetch ?? fetch;
+  const { quote } = o;
+  const account = o.wallet.account;
+  if (!account) throw new SwapError("no_account", "No wallet account to swap from.");
+  if (Date.now() - quote.at > 9e4) throw new SwapError("stale_quote", "The quote is older than 90 seconds. Get a fresh one.");
+  checkRouter(quote.network, quote.routerAddress);
+  const from = account.address;
+  const amountIn = parseUnits(quote.amountIn, quote.tokenIn.decimals ?? 18);
+  const slippageBps = o.slippageBps ?? 100;
+  if (!(slippageBps > 0 && slippageBps <= 500)) throw new SwapError("invalid_slippage", "Slippage must be above 0 and at most 5%.");
+  const native = quote.tokenIn.address.toLowerCase() === NATIVE.toLowerCase();
+  const eth = await o.client.getBalance({ address: from });
+  if (eth === 0n) throw new SwapError("no_gas", `The wallet has no ETH on ${quote.network} to pay gas. Send a little ETH first.`);
+  if (native ? eth < amountIn : await o.client.readContract({ address: quote.tokenIn.address, abi: erc20Abi, functionName: "balanceOf", args: [from] }) < amountIn)
+    throw new SwapError("insufficient_balance", `Not enough ${quote.tokenIn.symbol} in ${from.slice(0, 6)}\u2026${from.slice(-4)}.`);
+  o.step?.("building");
+  const res = await f(`${KYBER(quote.network)}/route/build`, {
+    method: "POST",
+    headers: { ...HEADERS, "content-type": "application/json" },
+    body: JSON.stringify({ routeSummary: quote.route, sender: from, recipient: from, slippageTolerance: slippageBps, deadline: Math.floor(Date.now() / 1e3) + 1200, source: "wafermap" })
+  }).catch(() => null);
+  const j = await res?.json().catch(() => null);
+  if (!res?.ok || !j?.data?.data) throw new SwapError("build_failed", j?.message ? `Route build failed: ${j.message}` : "Could not build the swap. Get a fresh quote.");
+  const b = j.data;
+  const to = checkRouter(quote.network, b.routerAddress);
+  const big = (v) => (typeof v === "string" || typeof v === "number") && /^\d+$/.test(String(v)) ? BigInt(v) : null;
+  const value = big(b.transactionValue ?? "0");
+  const builtOut = big(b.amountOut);
+  const quotedOut = parseUnits(quote.amountOut, quote.tokenOut.decimals ?? 18);
+  const call = decodeSwap(b.data);
+  const mismatch = (what) => {
+    throw new SwapError("build_mismatch", `The built swap ${what}. Nothing was approved or sent.`);
+  };
+  if (call.srcToken !== getAddress(quote.tokenIn.address) || call.dstToken !== getAddress(quote.tokenOut.address)) mismatch("trades other tokens than the quote");
+  if (call.amount !== amountIn) mismatch("spends a different amount than the quote");
+  if (call.receiver !== getAddress(from)) mismatch(`sends the output to ${call.receiver}, not to this wallet`);
+  if (call.feeAmounts.some((x) => x > 0n)) mismatch("takes a fee");
+  if (value === null || value !== (native ? amountIn : 0n)) mismatch("sends a different amount of ETH than the quote");
+  if (builtOut === null || builtOut * 10000n < quotedOut * BigInt(1e4 - slippageBps)) throw new SwapError("price_moved", "The price moved past your slippage since the quote. Nothing was sent; get a fresh quote.");
+  if (call.minReturn < builtOut * BigInt(1e4 - slippageBps) / 10000n) mismatch("accepts less output than your slippage allows");
+  let approveTx;
+  if (!native) {
+    const allowance = await o.client.readContract({ address: quote.tokenIn.address, abi: erc20Abi, functionName: "allowance", args: [from, to] });
+    if (allowance < amountIn) {
+      o.step?.("approving");
+      approveTx = await o.wallet.writeContract({ address: quote.tokenIn.address, abi: erc20Abi, functionName: "approve", args: [to, amountIn], account, chain: o.wallet.chain });
+      const r = await o.client.waitForTransactionReceipt({ hash: approveTx });
+      if (r.status !== "success") throw new SwapError("approve_failed", "The approval transaction failed.");
+    }
+  }
+  o.step?.("swapping");
+  const tx = await o.wallet.sendTransaction({ to, data: b.data, value, account, chain: o.wallet.chain });
+  const receipt = await o.client.waitForTransactionReceipt({ hash: tx });
+  if (receipt.status !== "success") throw new SwapError("swap_reverted", "The swap reverted on-chain (price moved past your slippage). Nothing was swapped; gas was spent.");
+  return { approveTx, tx, amountOutMin: formatUnits(call.minReturn, quote.tokenOut.decimals ?? 18) };
+}
+var NATIVE, TOKENS, KYBER_ROUTER, KYBER, HEADERS, SwapError, SWAP_DESC, ROUTER_ABI;
+var init_swap = __esm({
+  "shared/swap.ts"() {
+    "use strict";
+    NATIVE = "0xEeeeeEeeeEeEeeEeEeEeeEEEeeeeEeeeeeeeEEeE";
+    TOKENS = {
+      robinhood: [
+        { symbol: "ETH", name: "Ether", address: NATIVE, decimals: 18, kind: "native" },
+        { symbol: "WETH", name: "Wrapped Ether", address: "0x0Bd7D308f8E1639FAb988df18A8011f41EAcAD73", decimals: 18, kind: "wrapped" },
+        { symbol: "USDG", name: "Global Dollar", address: "0x5fc5360D0400a0Fd4f2af552ADD042D716F1d168", decimals: 6, kind: "stable" }
+      ],
+      base: [
+        { symbol: "ETH", name: "Ether", address: NATIVE, decimals: 18, kind: "native" },
+        { symbol: "WETH", name: "Wrapped Ether", address: "0x4200000000000000000000000000000000000006", decimals: 18, kind: "wrapped" },
+        { symbol: "USDC", name: "USD Coin", address: "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913", decimals: 6, kind: "stable" }
+      ]
+    };
+    KYBER_ROUTER = {
+      robinhood: "0x6131B5fae19EA4f9D964eAc0408E4408b66337b5",
+      base: "0x6131B5fae19EA4f9D964eAc0408E4408b66337b5"
+    };
+    KYBER = (net2) => `https://aggregator-api.kyberswap.com/${net2}/api/v1`;
+    HEADERS = { "x-client-id": "wafermap", accept: "application/json" };
+    SwapError = class extends Error {
+      constructor(code, message) {
+        super(message);
+        this.code = code;
+      }
+      code;
+    };
+    SWAP_DESC = "(address srcToken, address dstToken, address[] srcReceivers, uint256[] srcAmounts, address[] feeReceivers, uint256[] feeAmounts, address dstReceiver, uint256 amount, uint256 minReturnAmount, uint256 flags, bytes permit)";
+    ROUTER_ABI = parseAbi([
+      `function swap((address callTarget, address approveTarget, bytes targetData, ${SWAP_DESC} desc, bytes clientData) execution) payable returns (uint256, uint256)`,
+      `function swapSimpleMode(address caller, ${SWAP_DESC} desc, bytes executorData, bytes clientData) returns (uint256, uint256)`
+    ]);
+  }
+});
+
+// shared/solana.ts
+import { ed25519 } from "@noble/curves/ed25519";
+import { hmac } from "@noble/hashes/hmac";
+import { sha256 } from "@noble/hashes/sha2";
+import { base58, base64 } from "@scure/base";
+function isSolanaAddress(v) {
+  try {
+    return base58.decode(v).length === 32;
+  } catch {
+    return false;
+  }
+}
+function solanaKeyFromEvm(privateKey) {
+  const seed = hmac(sha256, hexBytes(privateKey), utf8("wafermap/solana/v1"));
+  const pub = ed25519.getPublicKey(seed);
+  return {
+    address: base58.encode(pub),
+    /** seed ‖ public key, base58: the format Phantom and Solflare import. */
+    secretKey: base58.encode(concat(seed, pub)),
+    sign: (message) => ed25519.sign(message, seed)
+  };
+}
+function ataOf(owner, mint = SOLANA_USDC) {
+  const seeds = concat(base58.decode(owner), base58.decode(TOKEN_PROGRAM), base58.decode(mint));
+  const tail = concat(base58.decode(ATA_PROGRAM), utf8("ProgramDerivedAddress"));
+  for (let bump = 255; bump >= 0; bump--) {
+    const h = sha256(concat(seeds, Uint8Array.of(bump), tail));
+    if (!onCurve(h)) return base58.encode(h);
+  }
+  throw new Error("No associated token account address.");
+}
+async function solanaPayment(payer, q) {
+  if (q.asset !== SOLANA_USDC) throw new Error("Only USDC is paid on Solana.");
+  if (!isSolanaAddress(q.feePayer) || !isSolanaAddress(q.payTo)) throw new Error("The quote has no valid Solana fee payer or recipient.");
+  if (q.feePayer === payer.address) throw new Error("The fee payer cannot be the paying wallet.");
+  const memo = utf8(q.memo ?? [...crypto.getRandomValues(new Uint8Array(16))].map((b) => b.toString(16).padStart(2, "0")).join(""));
+  if (memo.length > MAX_MEMO_BYTES) throw new Error("The seller's memo is too long.");
+  const source = ataOf(payer.address, q.asset);
+  const dest = ataOf(q.payTo, q.asset);
+  const keys = [q.feePayer, payer.address, source, dest, q.asset, TOKEN_PROGRAM, COMPUTE_BUDGET, MEMO_PROGRAM];
+  if (new Set(keys).size !== keys.length) throw new Error("The quote reuses an account it should not.");
+  const at = (k) => keys.indexOf(k);
+  const ixs = [
+    { program: COMPUTE_BUDGET, accounts: [], data: concat(Uint8Array.of(2), le(BigInt(CU_LIMIT), 4)) },
+    { program: COMPUTE_BUDGET, accounts: [], data: concat(Uint8Array.of(3), le(CU_PRICE_MICROLAMPORTS, 8)) },
+    { program: TOKEN_PROGRAM, accounts: [source, q.asset, dest, payer.address], data: concat(Uint8Array.of(12), le(BigInt(q.amount), 8), Uint8Array.of(USDC_DECIMALS)) },
+    { program: MEMO_PROGRAM, accounts: [], data: memo }
+  ];
+  const message = concat(
+    Uint8Array.of(128, 2, 1, 4),
+    // v0; 2 signatures, 1 of them readonly; 4 readonly non-signers
+    shortvec(keys.length),
+    ...keys.map((k) => base58.decode(k)),
+    base58.decode(await payer.blockhash()),
+    shortvec(ixs.length),
+    ...ixs.map((ix) => concat(Uint8Array.of(at(ix.program)), shortvec(ix.accounts.length), Uint8Array.from(ix.accounts.map(at)), shortvec(ix.data.length), ix.data)),
+    shortvec(0)
+    // no address lookup tables
+  );
+  const signature = await payer.sign(message);
+  return base64.encode(concat(shortvec(2), new Uint8Array(64), signature, message));
+}
+async function solanaRpc(url, method, params, f = fetch) {
+  const r = await f(url, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ jsonrpc: "2.0", id: 1, method, params }) });
+  const j = await r.json().catch(() => null);
+  if (!j) throw new Error(`Solana RPC answered ${r.status}.`);
+  if (j.error) throw new Error(j.error.message ?? "Solana RPC error.");
+  return j.result;
+}
+async function solanaBalances(url, owner, f) {
+  const [usdc, lamports] = await Promise.all([
+    solanaRpc(url, "getAccountInfo", [ataOf(owner), { commitment: "confirmed", encoding: "jsonParsed" }], f).then((r) => String(r.value?.data?.parsed?.info?.tokenAmount?.uiAmountString ?? "0")),
+    solanaRpc(url, "getBalance", [owner, { commitment: "confirmed" }], f).then((r) => Number(r.value ?? 0))
+  ]);
+  return { usdc, sol: String(lamports / 1e9) };
+}
+var SOLANA_CAIP, SOLANA_USDC, USDC_DECIMALS, TOKEN_PROGRAM, ATA_PROGRAM, COMPUTE_BUDGET, MEMO_PROGRAM, CU_LIMIT, CU_PRICE_MICROLAMPORTS, MAX_MEMO_BYTES, utf8, concat, hexBytes, le, shortvec, onCurve, latestBlockhash;
+var init_solana = __esm({
+  "shared/solana.ts"() {
+    "use strict";
+    SOLANA_CAIP = "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp";
+    SOLANA_USDC = "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v";
+    USDC_DECIMALS = 6;
+    TOKEN_PROGRAM = "TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA";
+    ATA_PROGRAM = "ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL";
+    COMPUTE_BUDGET = "ComputeBudget111111111111111111111111111111";
+    MEMO_PROGRAM = "MemoSq4gqABAXKb96qnH8TysNcWxMyWCqXgDLGmfcHr";
+    CU_LIMIT = 2e4;
+    CU_PRICE_MICROLAMPORTS = 1n;
+    MAX_MEMO_BYTES = 256;
+    utf8 = (s) => new TextEncoder().encode(s);
+    concat = (...parts) => {
+      const out = new Uint8Array(parts.reduce((n, p) => n + p.length, 0));
+      let o = 0;
+      for (const p of parts) out.set(p, o), o += p.length;
+      return out;
+    };
+    hexBytes = (h) => {
+      const s = h.replace(/^0x/, "");
+      if (!/^[0-9a-fA-F]{64}$/.test(s)) throw new Error("Expected a 32-byte hex private key.");
+      return Uint8Array.from(s.match(/../g), (b) => parseInt(b, 16));
+    };
+    le = (v, bytes) => Uint8Array.from({ length: bytes }, (_, i) => Number(v >> BigInt(8 * i) & 0xffn));
+    shortvec = (n) => {
+      const out = [];
+      for (let v = n; ; ) {
+        const b = v & 127;
+        v >>= 7;
+        if (!v) return Uint8Array.from([...out, b]);
+        out.push(b | 128);
+      }
+    };
+    onCurve = (b) => {
+      try {
+        ed25519.ExtendedPoint.fromHex(b);
+        return true;
+      } catch {
+        return false;
+      }
+    };
+    latestBlockhash = async (url, f) => (await solanaRpc(url, "getLatestBlockhash", [{ commitment: "confirmed" }], f)).value.blockhash;
+  }
+});
+
+// shared/x402client.ts
+function chainOf(network) {
+  const n = String(network ?? "").toLowerCase();
+  return PAY_CHAINS.find((c) => c.caip.toLowerCase() === n || c.v1 === n || c.id > 0 && String(c.id) === n);
+}
+async function readQuote(res) {
+  let body = null;
+  const header = res.headers.get("payment-required");
+  if (header) {
+    try {
+      body = JSON.parse(b64decode(header));
+    } catch {
+    }
+  }
+  if (!body) body = await res.json().catch(() => null);
+  if (!body || !Array.isArray(body.accepts)) throw new X402Error("not_x402", "The service answered 402 without x402 payment details.");
+  const version = Number(body.x402Version) === 1 ? 1 : 2;
+  const accepts = [];
+  const offered = [];
+  for (const r of body.accepts) {
+    offered.push(`${r.scheme ?? "?"}/${r.network ?? "?"}`);
+    const chain = chainOf(r.network);
+    if (!chain || r.scheme !== "exact") continue;
+    if (chain.vm === "evm" ? String(r.asset ?? "").toLowerCase() !== chain.stable.toLowerCase() : r.asset !== chain.stable) continue;
+    const amount = String(version === 1 ? r.maxAmountRequired : r.amount);
+    if (!/^\d+$/.test(amount)) continue;
+    let extra;
+    if (chain.vm === "svm") {
+      if (typeof r.extra?.feePayer !== "string") continue;
+      extra = { feePayer: r.extra.feePayer, ...typeof r.extra.memo === "string" ? { memo: r.extra.memo } : {} };
+    } else extra = r.extra?.name && r.extra?.version ? { name: String(r.extra.name), version: String(r.extra.version) } : chain.domain;
+    accepts.push({ version, chain, amount, usd: Number(amount) / 1e6, payTo: r.payTo, asset: r.asset, maxTimeoutSeconds: Number(r.maxTimeoutSeconds) || 120, extra, raw: r });
+  }
+  const inputError = body.inputError?.message ? { code: String(body.inputError.code ?? "invalid_input"), message: String(body.inputError.message) } : void 0;
+  return { version, resource: body.resource ?? null, accepts, offered, inputError };
+}
+function choose(q, prefer = CHAIN_KEYS) {
+  for (const k of prefer) {
+    const r = q.accepts.find((a) => a.chain.key === k);
+    if (r) return r;
+  }
+  throw new X402Error("no_supported_payment", q.offered.length ? `This service only accepts ${[...new Set(q.offered)].join(", ")}. Wafermap pays USDG on Robinhood Chain or USDC on Solana, Base, Arbitrum or Polygon.` : "The service offered no payment option.");
+}
+async function signPayment(signer, req, resource, solana) {
+  if (req.chain.vm === "svm") {
+    if (!solana) throw new X402Error("no_solana_wallet", "This payment is on Solana and no Solana wallet was given.");
+    let transaction;
+    try {
+      transaction = await solanaPayment(solana, { amount: req.amount, payTo: req.payTo, asset: req.asset, feePayer: req.extra.feePayer, memo: req.extra.memo });
+    } catch (e) {
+      if (e?.name === "TimeoutError" || e?.cause?.name === "TimeoutError") throw e;
+      throw new X402Error("sign_failed", e?.message ?? "Could not build the Solana payment.");
+    }
+    if (req.version === 1) return { name: "X-PAYMENT", value: b64encode(JSON.stringify({ x402Version: 1, scheme: "exact", network: req.raw.network, payload: { transaction } })) };
+    return { name: "PAYMENT-SIGNATURE", value: b64encode(JSON.stringify({ x402Version: 2, resource, accepted: req.raw, payload: { transaction } })) };
+  }
+  const nonce = randomNonce();
+  const validBefore = BigInt(Math.floor(Date.now() / 1e3) + Math.min(req.maxTimeoutSeconds, MAX_VALIDITY_SECONDS));
+  const message = { from: signer.address, to: req.payTo, value: BigInt(req.amount), validAfter: 0n, validBefore, nonce };
+  let signature;
+  try {
+    signature = await signer.signTypedData({ domain: { name: req.extra.name, version: req.extra.version, chainId: req.chain.id, verifyingContract: req.asset }, types: TYPES, primaryType: "TransferWithAuthorization", message });
+  } catch (e) {
+    throw new X402Error("sign_rejected", e?.shortMessage ?? e?.message ?? "Signature rejected.");
+  }
+  const authorization = { from: signer.address, to: req.payTo, value: req.amount, validAfter: "0", validBefore: validBefore.toString(), nonce };
+  const auth = { nonce, validBefore: Number(validBefore) };
+  if (req.version === 1) return { name: "X-PAYMENT", value: b64encode(JSON.stringify({ x402Version: 1, scheme: "exact", network: req.raw.network, payload: { signature, authorization } })), auth };
+  return { name: "PAYMENT-SIGNATURE", value: b64encode(JSON.stringify({ x402Version: 2, resource, accepted: req.raw, payload: { signature, authorization } })), auth };
+}
+function readSettlement(res) {
+  const h = res.headers.get("payment-response") ?? res.headers.get("x-payment-response");
+  if (!h) return null;
+  try {
+    const j = JSON.parse(b64decode(h));
+    return { tx: j.transaction ?? j.txHash ?? j.tx, network: j.network, success: j.success };
+  } catch {
+    return null;
+  }
+}
+async function x402fetch(url, init, opts) {
+  const f = opts.fetch ?? fetch;
+  const first = await f(url, init);
+  if (first.status !== 402) return { res: first, paid: null };
+  const quote = await readQuote(first);
+  if (quote.inputError) throw new X402Error(quote.inputError.code, quote.inputError.message);
+  const req = choose(quote, (opts.prefer ?? CHAIN_KEYS).filter((k) => k !== "solana" || opts.solana));
+  if (opts.approve) await opts.approve(req);
+  const svm = req.chain.vm === "svm";
+  const signer = svm ? null : typeof opts.signer === "function" ? await opts.signer() : opts.signer;
+  const header = await signPayment(signer, req, quote.resource, opts.solana);
+  const signed = { req, from: svm ? opts.solana.address : signer.address, ...header.auth ? { auth: header.auth } : {} };
+  opts.onSigned?.(signed);
+  const headers = new Headers(init.headers);
+  headers.set(header.name, header.value);
+  const res = await f(url, { ...init, headers });
+  return { res, paid: { ...signed, tx: readSettlement(res)?.tx ?? null } };
+}
+var USDC_DOMAIN, PAY_CHAINS, EVM_CHAINS, CHAIN_KEYS, X402Error, b64encode, b64decode, TYPES, MAX_VALIDITY_SECONDS, randomNonce;
+var init_x402client = __esm({
+  "shared/x402client.ts"() {
+    "use strict";
+    init_solana();
+    USDC_DOMAIN = { name: "USD Coin", version: "2" };
+    PAY_CHAINS = [
+      { key: "robinhood", vm: "evm", id: 4663, caip: "eip155:4663", v1: "robinhood", stable: "0x5fc5360D0400a0Fd4f2af552ADD042D716F1d168", symbol: "USDG", name: "Robinhood Chain", domain: { name: "Global Dollar", version: "1" } },
+      { key: "solana", vm: "svm", id: 0, caip: SOLANA_CAIP, v1: "solana", stable: SOLANA_USDC, symbol: "USDC", name: "Solana" },
+      { key: "base", vm: "evm", id: 8453, caip: "eip155:8453", v1: "base", stable: "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913", symbol: "USDC", name: "Base", domain: USDC_DOMAIN },
+      { key: "arbitrum", vm: "evm", id: 42161, caip: "eip155:42161", v1: "arbitrum", stable: "0xaf88d065e77c8cC2239327C5EDb3A432268e5831", symbol: "USDC", name: "Arbitrum", domain: USDC_DOMAIN },
+      { key: "polygon", vm: "evm", id: 137, caip: "eip155:137", v1: "polygon", stable: "0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359", symbol: "USDC", name: "Polygon", domain: USDC_DOMAIN }
+    ];
+    EVM_CHAINS = PAY_CHAINS.filter((c) => c.vm === "evm");
+    CHAIN_KEYS = PAY_CHAINS.map((c) => c.key);
+    X402Error = class extends Error {
+      constructor(code, message) {
+        super(message);
+        this.code = code;
+      }
+      code;
+    };
+    b64encode = (s) => {
+      const bytes = new TextEncoder().encode(s);
+      let bin = "";
+      for (let i = 0; i < bytes.length; i += 32768) bin += String.fromCharCode(...bytes.subarray(i, i + 32768));
+      return btoa(bin);
+    };
+    b64decode = (s) => new TextDecoder().decode(Uint8Array.from(atob(s), (c) => c.charCodeAt(0)));
+    TYPES = {
+      TransferWithAuthorization: [
+        { name: "from", type: "address" },
+        { name: "to", type: "address" },
+        { name: "value", type: "uint256" },
+        { name: "validAfter", type: "uint256" },
+        { name: "validBefore", type: "uint256" },
+        { name: "nonce", type: "bytes32" }
+      ]
+    };
+    MAX_VALIDITY_SECONDS = 90;
+    randomNonce = () => "0x" + [...crypto.getRandomValues(new Uint8Array(32))].map((b) => b.toString(16).padStart(2, "0")).join("");
+  }
+});
+
+// src/core.ts
+var core_exports = {};
+__export(core_exports, {
+  DEFAULT_LIMITS: () => DEFAULT_LIMITS,
+  DEFAULT_TIMEOUT_MS: () => DEFAULT_TIMEOUT_MS,
+  NETS: () => NETS,
+  Wafermap: () => Wafermap,
+  WafermapError: () => WafermapError,
+  checkPayment: () => checkPayment,
+  isNet: () => isNet,
+  mergeLog: () => mergeLog
+});
+import { createPublicClient, createWalletClient, erc20Abi as erc20Abi2, formatUnits as formatUnits2, http } from "viem";
+import { privateKeyToAccount } from "viem/accounts";
+import { arbitrum, base, polygon, robinhood } from "viem/chains";
+function mergeLog(entries) {
+  const outcomes = new Map(entries.filter((e) => e.of).map((e) => [e.of, e]));
+  return entries.filter((e) => !e.of).map((e) => {
+    const o = e.id ? outcomes.get(e.id) : void 0;
+    if (!o) return e;
+    return { ...e, status: o.status, tx: o.tx ?? e.tx, reported: o.reported ?? null, ...o.status === "aborted" ? { usd: 0 } : {} };
+  });
+}
+async function checkPayment(e, rpc) {
+  if (e.network === "solana" || !e.nonce || !(e.network in CHAINS)) return "unknown";
+  const chain = PAY_CHAINS.find((c) => c.key === e.network);
+  try {
+    const client = createPublicClient({ chain: CHAINS[e.network], transport: http(rpc) });
+    const used = await client.readContract({ address: chain.stable, abi: AUTH_STATE_ABI, functionName: "authorizationState", args: [e.payer, e.nonce] });
+    if (used) return "used";
+    return e.validBefore && Date.now() / 1e3 > e.validBefore ? "unused" : "pending";
+  } catch {
+    return "error";
+  }
+}
+var NETS, isNet, isSwapNet, WafermapError, CHAINS, AUTH_STATE_ABI, DEFAULT_LIMITS, DEFAULT_TIMEOUT_MS, timedOut, Wafermap;
+var init_core = __esm({
+  "src/core.ts"() {
+    "use strict";
+    init_swap();
+    init_solana();
+    init_x402client();
+    NETS = CHAIN_KEYS;
+    isNet = (v) => NETS.includes(v);
+    isSwapNet = (v) => v === "robinhood" || v === "base";
+    WafermapError = class extends Error {
+      constructor(code, message) {
+        super(message);
+        this.code = code;
+      }
+      code;
+    };
+    CHAINS = { robinhood, base, arbitrum, polygon };
+    AUTH_STATE_ABI = [{ type: "function", name: "authorizationState", stateMutability: "view", inputs: [{ name: "authorizer", type: "address" }, { name: "nonce", type: "bytes32" }], outputs: [{ type: "bool" }] }];
+    DEFAULT_LIMITS = { perPayment: 0.1, perDay: 1, perSwap: 25 };
+    DEFAULT_TIMEOUT_MS = 6e4;
+    timedOut = (e) => e?.name === "TimeoutError" || e?.cause?.name === "TimeoutError";
+    Wafermap = class {
+      account;
+      baseUrl;
+      network;
+      limits;
+      ledger;
+      approveFn;
+      rpc;
+      clients = {};
+      solana;
+      solanaAddress;
+      timeoutMs;
+      /** fetch with this wallet's time limit: a server that never answers cannot hold a call forever. */
+      fetch;
+      constructor(o) {
+        const account = o.account ?? (o.privateKey ? privateKeyToAccount(o.privateKey) : null);
+        if (!account) throw new WafermapError("no_account", "Pass privateKey or account.");
+        this.account = account;
+        this.baseUrl = (o.baseUrl ?? "https://wafermap.xyz").replace(/\/$/, "");
+        this.network = o.network ?? "robinhood";
+        this.limits = { ...DEFAULT_LIMITS, ...o.limits };
+        const mem = [];
+        this.ledger = o.ledger ?? { entries: () => mem, record: (e) => void mem.push(e) };
+        this.approveFn = o.approve;
+        this.rpc = o.rpc ?? {};
+        this.timeoutMs = o.timeoutMs && o.timeoutMs > 0 ? o.timeoutMs : DEFAULT_TIMEOUT_MS;
+        this.fetch = (input, init) => fetch(input, { ...init, signal: init?.signal ?? AbortSignal.timeout(this.timeoutMs) });
+        const sol = o.solana ?? (o.privateKey ? solanaKeyFromEvm(o.privateKey) : null);
+        const solRpc = this.rpc.solana ?? `${this.baseUrl}/api/solana`;
+        this.solana = sol ? { address: sol.address, sign: sol.sign, blockhash: () => latestBlockhash(solRpc, this.fetch) } : null;
+        this.solanaAddress = sol?.address ?? o.solanaAddress ?? null;
+      }
+      get address() {
+        return this.account.address;
+      }
+      client(n) {
+        return this.clients[n] ??= createPublicClient({ chain: CHAINS[n], transport: http(this.rpc[n]) });
+      }
+      /** USD signed today (local midnight) on payments, not counting swaps. Every signed payment
+       *  counts at its full amount, whatever the server answered, because a signed payment can be
+       *  executed until it expires. `checkPayment` shows on-chain which ones were never used. */
+      spentToday() {
+        const start = /* @__PURE__ */ new Date();
+        start.setHours(0, 0, 0, 0);
+        return this.ledger.entries().filter((e) => e.kind !== "swap" && e.at >= start.getTime() && (e.payer.toLowerCase() === this.address.toLowerCase() || e.payer === this.solanaAddress)).reduce((a, e) => a + e.usd, 0);
+      }
+      async gate(a) {
+        if (a.kind === "swap") {
+          if (a.usd > this.limits.perSwap) throw new WafermapError("over_swap_cap", `$${a.usd.toFixed(2)} is above the per-swap cap of $${this.limits.perSwap}.`);
+        } else {
+          if (a.usd > this.limits.perPayment) throw new WafermapError("over_payment_cap", `$${a.usd} is above the per-payment cap of $${this.limits.perPayment}.`);
+          if (this.spentToday() + a.usd > this.limits.perDay + 1e-9) throw new WafermapError("over_daily_cap", `This would pass the daily cap of $${this.limits.perDay} ($${this.spentToday().toFixed(4)} spent today).`);
+        }
+        if (this.approveFn && !await this.approveFn(a)) throw new WafermapError("declined", "Declined.");
+      }
+      prefer(n) {
+        const first = n ?? this.network;
+        return [first, ...NETS.filter((x) => x !== first)];
+      }
+      /** A second 402 means the payment itself was refused (usually: not enough balance). */
+      rejected(res, body, paid) {
+        if (!paid || res.status !== 402) return null;
+        const reason = typeof body?.error === "string" ? body.error : body?.error?.message ?? "rejected";
+        return new WafermapError("payment_rejected", `Payment refused (${reason}). Check that ${paid.req.chain.vm === "svm" ? this.solanaAddress : this.address} holds at least $${paid.req.usd} ${paid.req.chain.symbol} on ${paid.req.chain.name}.`);
+      }
+      /** Write the signed payment to the ledger before it leaves the machine. */
+      booked(kind, what, s) {
+        const id = crypto.randomUUID();
+        this.ledger.record({ at: Date.now(), kind, what, usd: s.req.usd, network: s.req.chain.key, tx: null, payer: s.from, id, status: "signed", ...s.auth ? { nonce: s.auth.nonce, validBefore: s.auth.validBefore } : {} });
+        return id;
+      }
+      /** The outcome line for a booked payment. It adds nothing to the daily total. */
+      outcome(id, kind, what, s, status, tx, reported = null) {
+        this.ledger.record({ at: Date.now(), kind, what, usd: 0, network: s.req.chain.key, tx, payer: s.from, of: id, status, reported });
+      }
+      /** The timeout error for `host`, saying whether a payment was signed and until when it can be executed. */
+      timeoutError(host, signed) {
+        const after = signed ? ` A payment had been signed and sent. It stays counted${signed.validBefore ? ` and can only be executed until ${new Date(signed.validBefore * 1e3).toLocaleTimeString()}` : ""}; check with \`wafermap history --verify\`.` : " Nothing was paid.";
+        return new WafermapError("timeout", `${host} did not answer within ${Math.round(this.timeoutMs / 1e3)} s.${after}`);
+      }
+      /** Read a JSON body; a time-out while reading is reported, anything else gives `fallback`. */
+      async body(res, read, fallback, host, signed) {
+        try {
+          return await read();
+        } catch (e) {
+          if (timedOut(e)) throw this.timeoutError(host, signed);
+          return fallback;
+        }
+      }
+      // Check-sign-book runs one payment at a time in this process, so two calls started together
+      // cannot both pass the daily cap on the same remaining budget. Across processes, see onSigned.
+      queue = Promise.resolve();
+      acquire() {
+        let release;
+        const held = new Promise((r) => release = r);
+        const prev = this.queue;
+        this.queue = prev.then(() => held);
+        return prev.then(() => release);
+      }
+      async paidFetch(kind, what, url, init, network) {
+        let id = null;
+        let release = null;
+        const unlock = () => {
+          release?.();
+          release = null;
+        };
+        try {
+          const r = await x402fetch(url, init, {
+            signer: this.account,
+            solana: this.solana ?? void 0,
+            prefer: this.prefer(network),
+            fetch: this.fetch,
+            approve: async (req) => {
+              release = await this.acquire();
+              await this.gate({ kind, what, usd: req.usd, network: req.chain.key, detail: `${req.chain.symbol} to ${req.payTo}` });
+            },
+            onSigned: (s) => {
+              id = this.booked(kind, what, s);
+              unlock();
+              if (this.spentToday() > this.limits.perDay + 1e-9) {
+                this.ledger.record({ at: Date.now(), kind, what, usd: -s.req.usd, network: s.req.chain.key, tx: null, payer: s.from, of: id, status: "aborted" });
+                id = null;
+                throw new WafermapError("over_daily_cap", `Another payment from this wallet used the daily cap of $${this.limits.perDay} at the same time. Nothing was sent.`);
+              }
+            }
+          });
+          return { ...r, id };
+        } catch (e) {
+          if (e instanceof WafermapError) throw e;
+          if (e instanceof X402Error) throw new WafermapError(e.code, e.message);
+          if (timedOut(e)) throw this.timeoutError(new URL(url).host, id ? this.ledger.entries().find((x) => x.id === id) ?? {} : null);
+          throw new WafermapError("network_error", `${new URL(url).host}: ${e?.cause?.message ?? e?.message ?? "request failed"}`);
+        } finally {
+          unlock();
+        }
+      }
+      // ---- Wafermap resources ----
+      async resources() {
+        const host = new URL(this.baseUrl).host;
+        const r = await this.fetch(`${this.baseUrl}/v1/resources`).catch((e) => {
+          throw timedOut(e) ? this.timeoutError(host) : new WafermapError("network_error", `${host}: ${e?.message ?? "request failed"}`);
+        });
+        const j = await this.body(r, () => r.json(), null, host);
+        return j?.data ?? [];
+      }
+      async call(id, input = {}, o = {}) {
+        const go = () => this.paidFetch("resource", id, `${this.baseUrl}/v1/${id}`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(input) }, o.network);
+        const settle = (r2, out2) => {
+          if (!r2.paid || !r2.id) return;
+          const status = r2.res.status === 402 ? "refused" : r2.res.ok ? "ok" : "failed";
+          this.outcome(r2.id, "resource", id, r2.paid, status, out2?.receipt?.tx ?? r2.paid.tx, typeof out2?.receipt?.amountUsd === "number" ? out2.receipt.amountUsd : null);
+        };
+        const host = new URL(this.baseUrl).host;
+        const read = (r2) => this.body(r2.res, () => r2.res.json(), {}, host, r2.paid?.auth ?? (r2.paid ? {} : null));
+        let r = await go();
+        let out = await read(r);
+        settle(r, out);
+        if (r.paid?.req.chain.vm === "svm" && r.res.status === 402 && /fee_payer/i.test(JSON.stringify(out))) {
+          r = await go().catch((e) => {
+            if (e?.code === "over_daily_cap") throw new WafermapError("over_daily_cap", `The facilitator refused the first Solana payment (its fee payer rotated). That signed payment still counts until it expires, and a second one would pass the daily cap of $${this.limits.perDay}. Try again in a few minutes or pay on another network.`);
+            throw e;
+          });
+          out = await read(r);
+          settle(r, out);
+        }
+        const { res, paid } = r;
+        const refused = this.rejected(res, out, paid);
+        if (refused) throw refused;
+        if (!res.ok) throw new WafermapError(out?.error?.code ?? "http_error", out?.error?.message ?? (typeof out?.error === "string" ? out.error : `HTTP ${res.status}`));
+        return out;
+      }
+      // ---- Third-party x402 services ----
+      async discover(query, limit = 10) {
+        const host = new URL(this.baseUrl).host;
+        const r = await this.fetch(`${this.baseUrl}/api/discover?q=${encodeURIComponent(query)}&limit=${limit}`).catch((e) => {
+          throw timedOut(e) ? this.timeoutError(host) : new WafermapError("network_error", `${host}: ${e?.message ?? "request failed"}`);
+        });
+        const j = await this.body(r, () => r.json(), null, host);
+        if (!r.ok || !Array.isArray(j?.services)) throw new WafermapError(j?.error?.code ?? "discovery_failed", j?.error?.message ?? "Discovery is unavailable.");
+        return j.services;
+      }
+      /** Call any x402 URL and pay it if it asks. GET sends `input` as the query string, POST as JSON. */
+      async pay(url, o = {}) {
+        const method = o.method ?? "GET";
+        const qs = method === "GET" && o.input && Object.keys(o.input).length ? new URLSearchParams(Object.entries(o.input).map(([k, v]) => [k, String(v)])).toString() : "";
+        const target = qs ? `${url}${url.includes("?") ? "&" : "?"}${qs}` : url;
+        const init = method === "GET" ? { method } : { method, headers: { "content-type": "application/json" }, body: JSON.stringify(o.input ?? {}) };
+        const u = new URL(url);
+        const what = `${u.host}${u.pathname}`;
+        const { res, paid, id } = await this.paidFetch("service", what, target, init, o.network);
+        if (paid && id) this.outcome(id, "service", what, paid, res.status === 402 ? "refused" : res.ok ? "ok" : "failed", paid.tx);
+        const type = res.headers.get("content-type") ?? "";
+        const signed = paid?.auth ?? (paid ? {} : null);
+        const result2 = /json/.test(type) ? await this.body(res, () => res.json(), null, u.host, signed) : /^(image|audio|video)\//.test(type) ? { bytes: (await this.body(res, () => res.arrayBuffer(), new ArrayBuffer(0), u.host, signed)).byteLength, contentType: type } : await this.body(res, () => res.text(), "", u.host, signed);
+        const refused = this.rejected(res, result2, paid);
+        if (refused) throw refused;
+        if (!res.ok) throw new WafermapError(paid ? "payment_failed" : "http_error", `${u.host} answered ${res.status}: ${JSON.stringify(result2).slice(0, 300)}`);
+        return { status: res.status, result: result2, paid: paid ? { usd: paid.req.usd, network: paid.req.chain.key, tx: paid.tx } : null };
+      }
+      // ---- Wallet ----
+      async balances() {
+        const out = Object.fromEntries(NETS.map((n) => [n, null]));
+        const sol = this.solanaAddress;
+        await Promise.all([
+          sol ? solanaBalances(this.rpc.solana ?? `${this.baseUrl}/api/solana`, sol, this.fetch).then(
+            (b) => void (out.solana = { eth: b.sol, gas: "SOL", stable: b.usdc, symbol: "USDC" }),
+            () => {
+            }
+          ) : null,
+          ...NETS.filter((n) => n !== "solana").map(async (n) => {
+            try {
+              const c = this.client(n);
+              const chain = PAY_CHAINS.find((x) => x.key === n);
+              const [eth, usd] = await Promise.all([c.getBalance({ address: this.address }), c.readContract({ address: chain.stable, abi: erc20Abi2, functionName: "balanceOf", args: [this.address] })]);
+              out[n] = { eth: formatUnits2(eth, 18), gas: CHAINS[n].nativeCurrency.symbol, stable: formatUnits2(usd, 6), symbol: chain.symbol };
+            } catch {
+              out[n] = null;
+            }
+          })
+        ]);
+        return out;
+      }
+      // ---- Swaps ----
+      tokenCache = {};
+      async lookup(n, symbol) {
+        if (!this.tokenCache[n]) {
+          const j = await this.fetch(`${this.baseUrl}/api/tokens?network=${n}`).then((r) => r.json()).catch(() => null);
+          this.tokenCache[n] = j?.tokens ?? TOKENS[n];
+        }
+        return this.tokenCache[n].find((t) => t.symbol.toLowerCase() === symbol.toLowerCase()) ?? null;
+      }
+      async swapQuote(from, to, amount, network) {
+        const n = network ?? (isSwapNet(this.network) ? this.network : "robinhood");
+        if (!isSwapNet(n)) throw new WafermapError("unsupported_network", "Swaps run on Robinhood Chain or Base. Use --network robinhood or base.");
+        const c = this.client(n);
+        try {
+          const [tokenIn, tokenOut] = await Promise.all([resolveToken(n, from, c, (net2, s) => this.lookup(net2, s)), resolveToken(n, to, c, (net2, s) => this.lookup(net2, s))]);
+          return await quoteSwap({ network: n, tokenIn, tokenOut, amount, fetch: this.fetch });
+        } catch (e) {
+          throw new WafermapError(e?.code ?? "quote_failed", e?.shortMessage ?? e?.message ?? "No quote.");
+        }
+      }
+      async swap(quote, o = {}) {
+        if (!quote.amountInUsd) throw new WafermapError("no_usd_value", "This swap has no USD value, so the per-swap cap cannot be checked. Not sent.");
+        await this.gate({ kind: "swap", what: `${quote.amountIn} ${quote.tokenIn.symbol} \u2192 ${quote.tokenOut.symbol}`, usd: quote.amountInUsd, network: quote.network, detail: `about ${quote.amountOut} ${quote.tokenOut.symbol}` });
+        const wallet = createWalletClient({ account: this.account, chain: CHAINS[quote.network], transport: http(this.rpc[quote.network]) });
+        try {
+          const r = await executeSwap({ quote, wallet, client: this.client(quote.network), slippageBps: o.slippageBps, step: o.step, fetch: this.fetch });
+          this.ledger.record({ at: Date.now(), kind: "swap", what: `${quote.amountIn} ${quote.tokenIn.symbol} \u2192 ${quote.tokenOut.symbol}`, usd: 0, network: quote.network, tx: r.tx, payer: this.address });
+          return r;
+        } catch (e) {
+          throw new WafermapError(e?.code ?? "swap_failed", e?.shortMessage ?? e?.message ?? "Swap failed.");
+        }
+      }
+    };
+  }
+});
+
+// src/store.ts
+import { createCipheriv, createDecipheriv, randomBytes, scryptSync } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync, appendFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+function ensureHome() {
+  if (!existsSync(HOME)) mkdirSync(HOME, { recursive: true, mode: 448 });
+}
+function secureWrite(path, data) {
+  ensureHome();
+  writeFileSync(path, data, { mode: 384 });
+  try {
+    chmodSync(path, 384);
+  } catch {
+  }
+}
+function saveKey(privateKey, address, password2, solana) {
+  if (password2.length < 8) throw new Error("Use a password of at least 8 characters.");
+  const salt = randomBytes(32);
+  const iv = randomBytes(12);
+  const key = scryptSync(password2, salt, 32, SCRYPT);
+  const c = createCipheriv("aes-256-gcm", key, iv);
+  const ct = Buffer.concat([c.update(privateKey.slice(2), "hex"), c.final()]);
+  secureWrite(
+    KEYSTORE,
+    JSON.stringify(
+      { version: 1, address, ...solana ? { solana } : {}, kdf: "scrypt", kdfparams: { n: SCRYPT.N, r: SCRYPT.r, p: SCRYPT.p, salt: salt.toString("hex") }, cipher: "aes-256-gcm", iv: iv.toString("hex"), tag: c.getAuthTag().toString("hex"), ciphertext: ct.toString("hex") },
+      null,
+      2
+    )
+  );
+}
+function keystoreAddress() {
+  if (!hasWallet()) return null;
+  return JSON.parse(readFileSync(KEYSTORE, "utf8")).address ?? null;
+}
+function keystoreSolana() {
+  if (!hasWallet()) return null;
+  return JSON.parse(readFileSync(KEYSTORE, "utf8")).solana ?? null;
+}
+function rememberSolana(address) {
+  const k = JSON.parse(readFileSync(KEYSTORE, "utf8"));
+  if (k.solana === address) return;
+  secureWrite(KEYSTORE, JSON.stringify({ ...k, solana: address }, null, 2));
+}
+function loadKey(password2) {
+  if (!hasWallet()) throw new Error("No wallet yet. Run `wafermap init`.");
+  const k = JSON.parse(readFileSync(KEYSTORE, "utf8"));
+  const key = scryptSync(password2, Buffer.from(k.kdfparams.salt, "hex"), 32, { N: k.kdfparams.n, r: k.kdfparams.r, p: k.kdfparams.p, maxmem: SCRYPT.maxmem });
+  const d = createDecipheriv("aes-256-gcm", key, Buffer.from(k.iv, "hex"));
+  d.setAuthTag(Buffer.from(k.tag, "hex"));
+  try {
+    return `0x${Buffer.concat([d.update(Buffer.from(k.ciphertext, "hex")), d.final()]).toString("hex")}`;
+  } catch {
+    throw new Error("Wrong password.");
+  }
+}
+function config() {
+  if (!existsSync(CONFIG)) return DEFAULTS;
+  const c = JSON.parse(readFileSync(CONFIG, "utf8"));
+  return { network: NETS.includes(c.network) ? c.network : "robinhood", limits: { ...DEFAULTS.limits, ...c.limits }, mcpSwaps: c.mcpSwaps === true, mcpConfirm: c.mcpConfirm === true };
+}
+function saveConfig(c) {
+  secureWrite(CONFIG, JSON.stringify(c, null, 2));
+}
+function spendLog() {
+  if (!existsSync(SPEND)) return [];
+  return readFileSync(SPEND, "utf8").split("\n").filter(Boolean).map((l) => JSON.parse(l));
+}
+function appendSpend(e) {
+  ensureHome();
+  appendFileSync(SPEND, JSON.stringify(e) + "\n", { mode: 384 });
+}
+var HOME, KEYSTORE, CONFIG, SPEND, SCRYPT, hasWallet, DEFAULTS;
+var init_store = __esm({
+  "src/store.ts"() {
+    "use strict";
+    init_core();
+    HOME = process.env.WAFERMAP_HOME || join(homedir(), ".wafermap");
+    KEYSTORE = join(HOME, "keystore.json");
+    CONFIG = join(HOME, "config.json");
+    SPEND = join(HOME, "spend.jsonl");
+    SCRYPT = { N: 1 << 17, r: 8, p: 1, maxmem: 256 * 1024 * 1024 };
+    hasWallet = () => existsSync(KEYSTORE);
+    DEFAULTS = { network: "robinhood", limits: { perPayment: 0.1, perDay: 1, perSwap: 25 }, mcpSwaps: false, mcpConfirm: false };
+  }
+});
+
+// src/keychain.ts
+import { spawnSync } from "node:child_process";
+import { existsSync as existsSync2, rmSync } from "node:fs";
+import { join as join2 } from "node:path";
+function backend() {
+  if (process.platform === "win32") return "windows-dpapi";
+  if (process.platform === "darwin") return "macos-keychain";
+  if (process.platform === "linux") return "secret-service";
+  return null;
+}
+function decode(v) {
+  const s = v.replace(/\r?\n$/, "");
+  return s.startsWith("wm1:") ? Buffer.from(s.slice(4), "base64").toString("utf8") : null;
+}
+function run(cmd, args, input, env) {
+  const merged = { ...process.env, ...env };
+  if (cmd === POWERSHELL) delete merged.PSModulePath;
+  const r = spawnSync(cmd, args, { input, encoding: "utf8", env: merged, windowsHide: true, timeout: 2e4 });
+  if (r.error) throw new Error(`${cmd} could not run: ${r.error.code === "ENOENT" ? "not installed" : r.error.message}`);
+  return { ok: r.status === 0, out: r.stdout ?? "", err: (r.stderr ?? "").trim() };
+}
+function keychainSet(password2) {
+  const b = backend();
+  const value = encode(password2);
+  if (b === "windows-dpapi") {
+    const r = run(POWERSHELL, [...PS, DPAPI_PROTECT], value);
+    if (!r.ok || !r.out.trim()) throw new Error(`DPAPI refused: ${r.err || "no output"}`);
+    secureWrite(DPAPI_FILE, r.out.trim());
+  } else if (b === "macos-keychain") {
+    const r = run("security", ["-i"], `add-generic-password -U -a ${ACCOUNT} -s ${SERVICE} -l "Wafermap MCP wallet password" -X ${Buffer.from(value, "utf8").toString("hex")}
+`);
+    if (!r.ok || r.err) throw new Error(`Keychain refused: ${r.err || "unknown error"}`);
+  } else if (b === "secret-service") {
+    const r = run("secret-tool", ["store", "--label=Wafermap MCP wallet password", "service", SERVICE, "account", ACCOUNT], value);
+    if (!r.ok) throw new Error(`secret-tool refused: ${r.err || "is a Secret Service (GNOME Keyring, KWallet) running?"}`);
+  } else throw new Error(`No OS keychain support on ${process.platform}.`);
+}
+function keychainGet() {
+  const b = backend();
+  try {
+    if (b === "windows-dpapi") {
+      if (!existsSync2(DPAPI_FILE)) return null;
+      const r = run(POWERSHELL, [...PS, DPAPI_UNPROTECT], void 0, { WM_DPAPI_FILE: DPAPI_FILE });
+      return r.ok ? decode(r.out) : null;
+    }
+    if (b === "macos-keychain") {
+      const r = run("security", ["find-generic-password", "-a", ACCOUNT, "-s", SERVICE, "-w"]);
+      return r.ok ? decode(r.out) : null;
+    }
+    if (b === "secret-service") {
+      const r = run("secret-tool", ["lookup", "service", SERVICE, "account", ACCOUNT]);
+      return r.ok ? decode(r.out) : null;
+    }
+  } catch {
+  }
+  return null;
+}
+function keychainClear() {
+  const b = backend();
+  if (b === "windows-dpapi") rmSync(DPAPI_FILE, { force: true });
+  else if (b === "macos-keychain") run("security", ["delete-generic-password", "-a", ACCOUNT, "-s", SERVICE]);
+  else if (b === "secret-service") run("secret-tool", ["clear", "service", SERVICE, "account", ACCOUNT]);
+}
+var SERVICE, ACCOUNT, DPAPI_FILE, BACKEND_NAME, encode, PS, POWERSHELL, DPAPI_PROTECT, DPAPI_UNPROTECT;
+var init_keychain = __esm({
+  "src/keychain.ts"() {
+    "use strict";
+    init_store();
+    SERVICE = "wafermap";
+    ACCOUNT = "mcp";
+    DPAPI_FILE = join2(HOME, "mcp-password.dpapi");
+    BACKEND_NAME = { "windows-dpapi": "Windows DPAPI", "macos-keychain": "macOS Keychain", "secret-service": "Secret Service (secret-tool)" };
+    encode = (pw) => `wm1:${Buffer.from(pw, "utf8").toString("base64")}`;
+    PS = ["-NoProfile", "-NonInteractive", "-Command"];
+    POWERSHELL = join2(process.env.SystemRoot ?? "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+    DPAPI_PROTECT = "[void][Reflection.Assembly]::LoadWithPartialName('System.Security'); $b = [Text.Encoding]::UTF8.GetBytes([Console]::In.ReadToEnd()); [Console]::Out.Write([Convert]::ToBase64String([Security.Cryptography.ProtectedData]::Protect($b, $null, 'CurrentUser')))";
+    DPAPI_UNPROTECT = "[void][Reflection.Assembly]::LoadWithPartialName('System.Security'); $b = [Convert]::FromBase64String([IO.File]::ReadAllText($env:WM_DPAPI_FILE).Trim()); [Console]::Out.Write([Text.Encoding]::UTF8.GetString([Security.Cryptography.ProtectedData]::Unprotect($b, $null, 'CurrentUser')))";
+  }
+});
+
+// src/local.ts
+function openWallet(password2, approve) {
+  if (!hasWallet()) throw new Error("No wallet yet. Run `wafermap init` first.");
+  const c = config();
+  const wm = new Wafermap({
+    privateKey: loadKey(password2),
+    baseUrl: process.env.WAFERMAP_URL,
+    network: c.network,
+    limits: c.limits,
+    ledger: { entries: spendLog, record: appendSpend },
+    approve,
+    rpc: { robinhood: process.env.WAFERMAP_RPC_ROBINHOOD, base: process.env.WAFERMAP_RPC_BASE, arbitrum: process.env.WAFERMAP_RPC_ARBITRUM, polygon: process.env.WAFERMAP_RPC_POLYGON, solana: process.env.WAFERMAP_RPC_SOLANA }
+  });
+  if (wm.solanaAddress) rememberSolana(wm.solanaAddress);
+  return wm;
+}
+var init_local = __esm({
+  "src/local.ts"() {
+    "use strict";
+    init_core();
+    init_store();
+  }
+});
+
+// src/version.ts
+var VERSION;
+var init_version = __esm({
+  "src/version.ts"() {
+    "use strict";
+    VERSION = "0.4.1";
+  }
+});
+
+// src/mcp.ts
+var mcp_exports = {};
+__export(mcp_exports, {
+  runMcp: () => runMcp
+});
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { z } from "zod";
+function text(v) {
+  return { content: [{ type: "text", text: typeof v === "string" ? v : JSON.stringify(v, null, 2) }] };
+}
+function result(v) {
+  const content = [];
+  const scrub = (x) => {
+    if (typeof x === "string" && /^data:(image|audio)\/[\w.+-]+;base64,/.test(x)) {
+      const [head, data] = x.split(",");
+      const mimeType = head.slice(5, head.indexOf(";"));
+      if (mimeType.startsWith("image/")) content.push({ type: "image", data, mimeType });
+      return `[${mimeType}, ${Math.round(data.length * 3 / 4 / 1024)} KB${mimeType.startsWith("image/") ? ", attached" : ""}]`;
+    }
+    if (Array.isArray(x)) return x.map(scrub);
+    if (x && typeof x === "object") return Object.fromEntries(Object.entries(x).map(([k, y]) => [k, scrub(y)]));
+    return x;
+  };
+  const clean = scrub(v);
+  return { content: [{ type: "text", text: JSON.stringify(clean, null, 2) }, ...content] };
+}
+function failure(e) {
+  const msg = e instanceof WafermapError ? `${e.code}: ${e.message}` : String(e?.message ?? e);
+  return { isError: true, content: [{ type: "text", text: msg }] };
+}
+async function confirmWithPerson(server, a) {
+  if (!server.server.getClientCapabilities()?.elicitation) {
+    throw new WafermapError(
+      "confirm_unavailable",
+      "Per-payment confirmation is on, but this MCP client cannot show an approval prompt, so nothing was paid. Use a client that supports MCP elicitation, or turn it off with `wafermap limits --mcp-confirm off`."
+    );
+  }
+  const message = a.kind === "swap" ? `Approve this swap?
+
+${a.what} (${a.detail}), worth about $${a.usd.toFixed(2)}, on ${a.network}.` : `Approve this payment?
+
+$${a.usd} ${a.detail ?? ""} on ${a.network}
+for ${a.what}`;
+  const r = await server.server.elicitInput({
+    mode: "form",
+    message,
+    requestedSchema: { type: "object", properties: { approve: { type: "boolean", title: "Approve", description: "Sign and pay this one call", default: false } }, required: ["approve"] }
+  });
+  return r.action === "accept" && r.content?.approve === true;
+}
+async function runMcp() {
+  const fromEnv = process.env.WAFERMAP_PASSWORD || void 0;
+  const password2 = fromEnv ?? keychainGet();
+  if (!password2) {
+    process.stderr.write("No wallet password: run `wafermap keychain on` once in a terminal (recommended), or set WAFERMAP_PASSWORD in your MCP client's env.\n");
+    process.exit(1);
+  }
+  const store = backend();
+  if (fromEnv && store) process.stderr.write(`WAFERMAP_PASSWORD is set in plain text. Run \`wafermap keychain on\` to keep it in the ${BACKEND_NAME[store]} instead, then remove it from your MCP config.
+`);
+  const server = new McpServer({ name: "wafermap", version: VERSION });
+  const wm = openWallet(password2, config().mcpConfirm ? (a) => confirmWithPerson(server, a) : void 0);
+  server.registerTool(
+    "wafermap_wallet",
+    { title: "Wallet status", description: "The agent wallet's address, USDG/USDC and ETH balances on Robinhood Chain and Base, spending caps and today's spend.", inputSchema: {} },
+    async () => {
+      try {
+        return text({ address: wm.address, balances: await wm.balances(), limits: wm.limits, spentTodayUsd: Number(wm.spentToday().toFixed(6)), network: wm.network, swapsEnabled: !!config().mcpSwaps, confirmEachPayment: !!config().mcpConfirm });
+      } catch (e) {
+        return failure(e);
+      }
+    }
+  );
+  server.registerTool(
+    "wafermap_resources",
+    {
+      title: "List Wafermap resources",
+      description: "Pay-per-call tools on Wafermap: LLMs, image and audio models, web reading, on-chain data, tokenized stocks, prediction markets. Each has an id, a USD price and input fields.",
+      inputSchema: { query: z.string().optional().describe("Filter by words in the name, summary or category.") }
+    },
+    async ({ query }) => {
+      try {
+        const q = query?.toLowerCase();
+        const list = (await wm.resources()).filter((r) => !q || `${r.id} ${r.name} ${r.summary} ${r.category}`.toLowerCase().includes(q));
+        return text(list.map((r) => ({ id: r.id, name: r.name, priceUsd: r.price, category: r.category, summary: r.summary, input: r.input ?? r.fields })));
+      } catch (e) {
+        return failure(e);
+      }
+    }
+  );
+  server.registerTool(
+    "wafermap_call",
+    {
+      title: "Call a Wafermap resource",
+      description: "Run one Wafermap resource and pay its exact price over x402 from the local wallet, within the per-payment and daily caps. Failed calls are not charged.",
+      inputSchema: { resource: z.string().describe("Resource id, e.g. market-brief, prediction-markets, stock-signal, flux-2-dev."), input: z.record(z.string(), z.any()).optional().describe("Input fields for the resource."), network: NET }
+    },
+    async ({ resource, input, network }) => {
+      try {
+        return result(await wm.call(resource, input ?? {}, { network }));
+      } catch (e) {
+        return failure(e);
+      }
+    }
+  );
+  server.registerTool(
+    "wafermap_discover",
+    {
+      title: "Discover x402 services",
+      description: "Search the open x402 index for third-party paid APIs (weather, search, enrichment, data\u2026). Services marked payable accept USDG on Robinhood Chain or USDC on Solana, Base, Arbitrum or Polygon and can be called with wafermap_pay.",
+      inputSchema: { query: z.string().min(2).describe("What you need, in a few words."), limit: z.number().int().min(1).max(20).optional() }
+    },
+    async ({ query, limit }) => {
+      try {
+        return text(await wm.discover(query, limit ?? 10));
+      } catch (e) {
+        return failure(e);
+      }
+    }
+  );
+  server.registerTool(
+    "wafermap_pay",
+    {
+      title: "Call and pay an x402 service",
+      description: "Call any x402 URL (e.g. one found with wafermap_discover) and pay it if it answers 402, within the caps. GET sends input as query parameters, POST as a JSON body.",
+      inputSchema: { url: z.string().url().startsWith("https://"), method: z.enum(["GET", "POST"]).optional(), input: z.record(z.string(), z.any()).optional(), network: NET }
+    },
+    async ({ url, method, input, network }) => {
+      try {
+        return result(await wm.pay(url, { method, input, network }));
+      } catch (e) {
+        return failure(e);
+      }
+    }
+  );
+  server.registerTool(
+    "wafermap_swap_quote",
+    {
+      title: "Quote a token swap",
+      description: "Best route through the KyberSwap aggregator on Robinhood Chain or Base. Tokens: ETH, WETH, USDG, USDC, Robinhood stock tickers (TSLA\u2026) or a 0x address. Amount is in units of the token you sell.",
+      inputSchema: { from: z.string(), to: z.string(), amount: z.string().describe('e.g. "0.01"'), network: SWAP_NET }
+    },
+    async ({ from, to, amount, network }) => {
+      try {
+        const q = await wm.swapQuote(from, to, amount, network);
+        return text({ network: q.network, pay: `${q.amountIn} ${q.tokenIn.symbol}`, receiveAbout: `${q.amountOut} ${q.tokenOut.symbol}`, amountInUsd: q.amountInUsd, amountOutUsd: q.amountOutUsd, costPct: q.impactPct, gasUsd: q.gasUsd, swapsEnabled: !!config().mcpSwaps });
+      } catch (e) {
+        return failure(e);
+      }
+    }
+  );
+  server.registerTool(
+    "wafermap_swap",
+    {
+      title: "Swap tokens",
+      description: "Execute a swap from the local wallet (needs ETH for gas). Disabled unless the owner ran `wafermap limits --mcp-swaps on`. Always within the per-swap cap. Only swap when the user explicitly asked for this trade.",
+      inputSchema: { from: z.string(), to: z.string(), amount: z.string(), network: SWAP_NET, slippagePct: z.number().min(0.05).max(5).optional().describe("Max slippage, default 1%.") }
+    },
+    async ({ from, to, amount, network, slippagePct }) => {
+      if (!config().mcpSwaps) return failure(new WafermapError("swaps_disabled", "Swaps from MCP are off. The wallet owner can enable them with `wafermap limits --mcp-swaps on`."));
+      try {
+        const q = await wm.swapQuote(from, to, amount, network);
+        const r = await wm.swap(q, { slippageBps: Math.round((slippagePct ?? 1) * 100) });
+        return text({ swapped: `${q.amountIn} ${q.tokenIn.symbol} \u2192 ~${q.amountOut} ${q.tokenOut.symbol}`, minimumOut: r.amountOutMin, tx: r.tx, approveTx: r.approveTx ?? null, network: q.network });
+      } catch (e) {
+        return failure(e);
+      }
+    }
+  );
+  server.registerTool(
+    "wafermap_history",
+    { title: "Spending history", description: "Recent payments and swaps made by this wallet.", inputSchema: { limit: z.number().int().min(1).max(200).optional() } },
+    async ({ limit }) => text(mergeLog(spendLog()).slice(-(limit ?? 30)).reverse())
+  );
+  await server.connect(new StdioServerTransport());
+  process.stderr.write(`Wafermap MCP ${VERSION} ready \xB7 wallet ${wm.address}
+`);
+}
+var NET, SWAP_NET;
+var init_mcp = __esm({
+  "src/mcp.ts"() {
+    "use strict";
+    init_core();
+    init_keychain();
+    init_local();
+    init_store();
+    init_version();
+    NET = z.enum(["robinhood", "solana", "base", "arbitrum", "polygon"]).optional().describe("Payment network: robinhood (USDG), or solana, base, arbitrum or polygon (USDC). Defaults to your configured network.");
+    SWAP_NET = z.enum(["robinhood", "base"]).optional().describe("Swap network: robinhood or base. Defaults to your configured network when it is one of these, else robinhood.");
+  }
+});
+
+// src/cli.ts
+import { createInterface } from "node:readline";
+import { generatePrivateKey, privateKeyToAccount as privateKeyToAccount2 } from "viem/accounts";
+
+// shared/catalog.ts
+var PROMPT = { name: "prompt", type: "string", required: true, description: "What you want, in plain words.", max: 24e3, example: "Explain x402 in two sentences." };
+var SYSTEM = { name: "system", type: "string", description: "Optional instructions that shape every answer.", max: 8e3 };
+var MAX_TOKENS = { name: "max_tokens", type: "number", description: "Output cap. 2048 at most, 1024 by default.", max: 2048, example: 1024 };
+var NETWORK = { name: "network", type: "network", description: "robinhood (default) or base.", options: ["robinhood", "base"], example: "robinhood" };
+var TOKEN = { name: "address", type: "address", required: true, description: "Token contract address (0x\u2026).", example: "0x5fc5360D0400a0Fd4f2af552ADD042D716F1d168" };
+var IMAGE_PROMPT = { name: "prompt", type: "string", required: true, description: "Describe the image.", max: 2e3, example: "A glossy black wafer on white, studio light" };
+var SIZE = { name: "size", type: "enum", description: "Square, wide or tall.", options: ["1024x1024", "1280x768", "768x1280"], example: "1024x1024" };
+var llm = (id, name, model, price, summary, tags = []) => ({
+  id,
+  name,
+  category: "llm",
+  price,
+  summary,
+  provider: "Workers AI",
+  returns: "{ text, model, usage }",
+  model,
+  fields: [PROMPT, SYSTEM, MAX_TOKENS],
+  tags: ["chat", "write", "answer", ...tags]
+});
+var image = (id, name, model, price, summary) => ({
+  id,
+  name,
+  category: "image",
+  price,
+  summary,
+  provider: "Workers AI",
+  returns: "{ image: data:image/png;base64,\u2026 }",
+  model,
+  fields: [IMAGE_PROMPT, SIZE],
+  tags: ["image", "picture", "logo", "art", "generate"]
+});
+var RESOURCES = [
+  // LLM
+  llm("kimi-k2-6", "Kimi K2.6", "@cf/moonshotai/kimi-k2.6", "0.02", "Moonshot's agentic flagship. Long reasoning, strong tool use, 262K context.", ["reasoning", "agent"]),
+  llm("deepseek-v4-pro", "DeepSeek V4 Pro", "@cf/deepseek-ai/deepseek-v4-pro-0813", "0.025", "DeepSeek's top model for hard reasoning, math and code.", ["reasoning", "code", "math"]),
+  llm("glm-5-3", "GLM 5.3", "@cf/zai-org/glm-5.3", "0.025", "Z.ai's frontier model. Careful writing and multi-step planning.", ["reasoning", "writing"]),
+  llm("qwen-3-8", "Qwen 3.8 27B", "@cf/qwen/qwen3.8-27b", "0.015", "Alibaba's dense 27B. Fast, multilingual, solid at code.", ["multilingual", "code"]),
+  llm("nemotron-3", "Nemotron 3 120B", "@cf/nvidia/nemotron-3-120b-a12b", "0.01", "NVIDIA's open MoE model tuned for agent workflows.", ["agent"]),
+  llm("gpt-oss-120b", "GPT-OSS 120B", "@cf/openai/gpt-oss-120b", "0.006", "OpenAI's open-weight 120B. Reasoning at a low price.", ["reasoning"]),
+  llm("deepseek-v4-1-flash", "DeepSeek V4.1 Flash", "@cf/deepseek-ai/deepseek-v4.1-flash-1017", "0.007", "Quick DeepSeek for everyday questions and drafts.", ["fast"]),
+  llm("llama-4-scout", "Llama 4 Scout", "@cf/meta/llama-4-scout-17b-16e-instruct", "0.006", "Meta's multimodal MoE. Good general assistant.", ["general"]),
+  llm("gemma-4", "Gemma 4 26B", "@cf/google/gemma-4-26b-a4b-it", "0.002", "Google's open model. The cheapest way to get a good answer.", ["cheap", "fast"]),
+  // Image
+  image("flux-2-dev", "FLUX.2 dev", "@cf/black-forest-labs/flux-2-dev", "0.04", "Black Forest Labs' FLUX.2. High fidelity, accurate text in images."),
+  image("flux-2-klein-4b", "FLUX.2 klein 4B", "@cf/black-forest-labs/flux-2-klein-4b", "0.01", "Smallest FLUX.2. Fast drafts and variations."),
+  image("lucid-origin", "Lucid Origin", "@cf/leonardo/lucid-origin", "0.04", "Leonardo's prompt-faithful model. Strong on design and typography."),
+  image("phoenix-1", "Phoenix 1.0", "@cf/leonardo/phoenix-1.0", "0.035", "Leonardo Phoenix. Polished, coherent compositions."),
+  image("flux-1-schnell", "FLUX.1 schnell", "@cf/black-forest-labs/flux-1-schnell", "0.005", "The quick classic. Four steps, half a cent."),
+  // Audio
+  {
+    id: "tts-aura-2",
+    name: "Aura 2 Voice",
+    category: "audio",
+    price: "0.04",
+    summary: "Deepgram Aura 2. Natural English speech from text, up to 1,000 characters.",
+    provider: "Workers AI",
+    returns: "{ audio: data:audio/mpeg;base64,\u2026 }",
+    model: "@cf/deepgram/aura-2-en",
+    fields: [{ name: "text", type: "string", required: true, description: "Text to speak.", max: 1e3, example: "Your agent just paid for this sentence." }],
+    tags: ["speech", "voice", "tts", "audio"]
+  },
+  {
+    id: "tts-melo",
+    name: "MeloTTS",
+    category: "audio",
+    price: "0.002",
+    summary: "Light multilingual text-to-speech. Cheap narration for drafts.",
+    provider: "Workers AI",
+    returns: "{ audio: data:audio/mpeg;base64,\u2026 }",
+    model: "@cf/myshell-ai/melotts",
+    fields: [
+      { name: "text", type: "string", required: true, description: "Text to speak.", max: 1e3, example: "Hello from Wafermap." },
+      { name: "lang", type: "enum", description: "Language.", options: ["en", "es", "fr", "zh", "ja", "ko"], example: "en" }
+    ],
+    tags: ["speech", "voice", "tts", "audio"]
+  },
+  {
+    id: "stt-whisper",
+    name: "Whisper v3 Turbo",
+    category: "audio",
+    price: "0.01",
+    summary: "Transcribe audio from an HTTPS link. Files up to 10 MB.",
+    provider: "Workers AI",
+    returns: "{ text, language }",
+    model: "@cf/openai/whisper-large-v3-turbo",
+    fields: [{ name: "url", type: "url", required: true, description: "HTTPS link to an audio file (mp3, wav, m4a, ogg).", example: "https://raw.githubusercontent.com/openai/whisper/main/tests/jfk.flac" }],
+    tags: ["transcribe", "speech to text", "audio"]
+  },
+  // Vision + language
+  {
+    id: "vision-describe",
+    name: "Image Describe",
+    category: "vision",
+    price: "0.006",
+    summary: "Ask a question about an image at an HTTPS link. Llama 4 Scout reads it.",
+    provider: "Workers AI",
+    returns: "{ text }",
+    model: "@cf/meta/llama-4-scout-17b-16e-instruct",
+    fields: [
+      { name: "url", type: "url", required: true, description: "HTTPS link to a PNG, JPEG or WebP image.", example: "https://wafermap.xyz/og.png" },
+      { name: "question", type: "string", description: "What to look for. Defaults to a plain description.", max: 1e3, example: "What does this image show?" }
+    ],
+    tags: ["image", "caption", "ocr", "see"]
+  },
+  {
+    id: "translate",
+    name: "Translate",
+    category: "web",
+    price: "0.002",
+    summary: "Translate text between 100 languages with M2M100.",
+    provider: "Workers AI",
+    returns: "{ text }",
+    model: "@cf/meta/m2m100-1.2b",
+    fields: [
+      { name: "text", type: "string", required: true, description: "Text to translate.", max: 4e3, example: "Agents pay per call." },
+      { name: "target", type: "string", required: true, description: "Target language code (e.g. id, es, zh).", example: "id" },
+      { name: "source", type: "string", description: "Source language code. Defaults to en.", example: "en" }
+    ],
+    tags: ["translate", "language"]
+  },
+  {
+    id: "web-read",
+    name: "Web Reader",
+    category: "web",
+    price: "0.003",
+    summary: "Fetch a public web page and return clean Markdown an agent can read.",
+    provider: "Wafermap",
+    returns: "{ title, markdown }",
+    fields: [{ name: "url", type: "url", required: true, description: "HTTPS link to read.", example: "https://www.x402.org" }],
+    tags: ["web", "read", "scrape", "page", "article"]
+  },
+  // On-chain
+  {
+    id: "token-snapshot",
+    name: "Token Snapshot",
+    category: "onchain",
+    price: "0.005",
+    summary: "Name, supply and decimals read from the chain, plus price, liquidity and volume from the top pool.",
+    provider: "Wafermap \xB7 GeckoTerminal",
+    returns: "{ token, market, pools }",
+    fields: [TOKEN, NETWORK],
+    tags: ["token", "price", "market cap", "liquidity", "contract"]
+  },
+  {
+    id: "token-signal",
+    name: "Token Signal",
+    category: "onchain",
+    price: "0.02",
+    summary: "Snapshot plus a short AI read: momentum, liquidity depth and the risks worth checking.",
+    provider: "Wafermap \xB7 Workers AI",
+    returns: "{ snapshot, signal: { stance, summary, risks[] } }",
+    fields: [TOKEN, NETWORK],
+    tags: ["token", "analysis", "sentiment", "risk", "signal"]
+  },
+  {
+    id: "contract-check",
+    name: "Contract Check",
+    category: "onchain",
+    price: "0.005",
+    summary: "Who owns it, is it a proxy, can supply still change. Read straight from bytecode and storage.",
+    provider: "Wafermap",
+    returns: "{ isContract, owner, proxy, implementation, notes[] }",
+    fields: [TOKEN, NETWORK],
+    tags: ["contract", "owner", "proxy", "safety"]
+  },
+  {
+    id: "trending-pools",
+    name: "Trending Pools",
+    category: "onchain",
+    price: "0.01",
+    summary: "The pools traders are hitting right now, with price change, volume and liquidity.",
+    provider: "Wafermap \xB7 GeckoTerminal",
+    returns: "{ network, pools[] }",
+    fields: [NETWORK],
+    tags: ["trending", "hot", "movers", "pools"]
+  },
+  {
+    id: "new-pools",
+    name: "New Pools",
+    category: "onchain",
+    price: "0.005",
+    summary: "Freshly created pools, newest first, with age, liquidity and early volume.",
+    provider: "Wafermap \xB7 GeckoTerminal",
+    returns: "{ network, pools[] }",
+    fields: [NETWORK],
+    tags: ["new", "launch", "fresh", "pools"]
+  },
+  {
+    id: "market-brief",
+    name: "Market Brief",
+    category: "onchain",
+    price: "0.03",
+    summary: "Trending and new pools in one call, written up as a short brief by an LLM.",
+    provider: "Wafermap \xB7 Workers AI",
+    returns: "{ network, brief, pools[] }",
+    fields: [NETWORK],
+    tags: ["market", "brief", "summary", "today"]
+  },
+  {
+    id: "wallet-balances",
+    name: "Wallet Balances",
+    category: "onchain",
+    price: "0.002",
+    summary: "ETH and stablecoin balances for any address, plus any tokens you list.",
+    provider: "Wafermap",
+    returns: "{ address, network, balances[] }",
+    fields: [
+      { name: "address", type: "address", required: true, description: "Wallet address (0x\u2026).", example: "0x0000000000000000000000000000000000000000" },
+      NETWORK,
+      { name: "tokens", type: "string", description: "Extra token addresses, comma-separated (up to 10)." }
+    ],
+    tags: ["wallet", "balance", "portfolio"]
+  },
+  {
+    id: "gas-now",
+    name: "Gas Now",
+    category: "onchain",
+    price: "0.001",
+    summary: "Current gas price and latest block on Robinhood Chain or Base.",
+    provider: "Wafermap",
+    returns: "{ network, block, gasPriceGwei }",
+    fields: [NETWORK],
+    tags: ["gas", "fee", "block"]
+  },
+  // Tokenized stocks (Robinhood Chain)
+  {
+    id: "stock-tokens",
+    name: "Stock Tokens",
+    category: "stocks",
+    price: "0.002",
+    summary: "Every active stock token on Robinhood Chain: ticker, name, contract and whether a Chainlink feed prices it.",
+    provider: "Wafermap \xB7 Robinhood registry",
+    returns: "{ total, stocks[] }",
+    fields: [{ name: "query", type: "string", description: "Filter by ticker or company name.", max: 60, example: "tesla" }],
+    tags: ["stocks", "equities", "xstocks", "tokenized", "list"]
+  },
+  {
+    id: "stock-signal",
+    name: "Stock Token Signal",
+    category: "stocks",
+    price: "0.02",
+    summary: "One stock token: Chainlink reference price, on-chain DEX price, the premium between them and a short AI read.",
+    provider: "Wafermap \xB7 Chainlink \xB7 Workers AI",
+    returns: "{ stock, reference, dex, premiumPct, signal: { stance, summary, risks[] } }",
+    fields: [{ name: "symbol", type: "string", required: true, description: "Ticker (TSLA) or token address.", max: 64, example: "TSLA" }],
+    tags: ["stocks", "signal", "tsla", "nvda", "premium", "tokenized", "trading"]
+  },
+  // Prediction markets (Polymarket)
+  {
+    id: "prediction-markets",
+    name: "Prediction Markets",
+    category: "prediction",
+    price: "0.003",
+    summary: "Live Polymarket markets with outcome odds, volume, liquidity and end date. Search by topic or browse the busiest.",
+    provider: "Wafermap \xB7 Polymarket",
+    returns: "{ markets[]: { question, outcomes[{ name, probability }], volume24hUsd, liquidityUsd, endDate, url } }",
+    fields: [
+      { name: "query", type: "string", description: "Topic to search, e.g. fed rates, bitcoin, election.", max: 120, example: "bitcoin" },
+      { name: "sort", type: "enum", description: "Without a query: busiest, ending soon or newest.", options: ["volume", "ending", "new"], example: "volume" },
+      { name: "limit", type: "number", description: "How many markets, 20 at most.", max: 20, example: 10 }
+    ],
+    tags: ["polymarket", "prediction", "odds", "bets", "forecast", "election"]
+  },
+  {
+    id: "prediction-read",
+    name: "Prediction Read",
+    category: "prediction",
+    price: "0.02",
+    summary: "One Polymarket market, read by an LLM: what the odds price in, the week's move, catalysts and risks.",
+    provider: "Wafermap \xB7 Polymarket \xB7 Workers AI",
+    returns: "{ market, history[], read: { summary, pricedIn, lean, confidence, catalysts[], risks[] } }",
+    fields: [{ name: "market", type: "string", required: true, description: "Polymarket link, slug, market id, or a few words to find the busiest matching market.", max: 300, example: "fed interest rates" }],
+    tags: ["polymarket", "prediction", "analysis", "odds", "forecast"]
+  },
+  // Content
+  {
+    id: "token-starter-kit",
+    name: "Token Starter Kit",
+    category: "content",
+    price: "0.08",
+    summary: "From one idea: three name and ticker options, a tagline, a short lore and a logo.",
+    provider: "Wafermap \xB7 Workers AI",
+    returns: "{ names[], tagline, lore, logo: data:image/png;base64,\u2026 }",
+    fields: [{ name: "idea", type: "string", required: true, description: "The idea, in a sentence.", max: 500, example: "A cat that only trades on weekends" }],
+    tags: ["token", "launch", "logo", "name", "meme"]
+  },
+  {
+    id: "x-post-writer",
+    name: "X Post Writer",
+    category: "content",
+    price: "0.01",
+    summary: "Three ready-to-post X drafts under 280 characters, in the tone you ask for.",
+    provider: "Wafermap \xB7 Workers AI",
+    returns: "{ posts[] }",
+    fields: [
+      { name: "topic", type: "string", required: true, description: "What the posts are about.", max: 1500, example: "Our agent now pays for its own tools" },
+      { name: "tone", type: "enum", description: "Voice.", options: ["confident", "playful", "technical", "minimal"], example: "confident" }
+    ],
+    tags: ["twitter", "x", "post", "tweet", "copy"]
+  },
+  {
+    id: "prompt-refine",
+    name: "Prompt Refiner",
+    category: "content",
+    price: "0.004",
+    summary: "Turn a rough idea into a precise prompt for an image or text model.",
+    provider: "Wafermap \xB7 Workers AI",
+    returns: "{ prompt, negative }",
+    fields: [
+      { name: "idea", type: "string", required: true, description: "Your rough idea.", max: 1500, example: "logo for a robot bank" },
+      { name: "target", type: "enum", description: "What the prompt is for.", options: ["image", "text"], example: "image" }
+    ],
+    tags: ["prompt", "creative", "director"]
+  }
+];
+var NETWORKS = {
+  robinhood: { id: 4663, caip: "eip155:4663", name: "Robinhood Chain", asset: "USDG", gecko: "robinhood", explorer: "https://robinhoodchain.blockscout.com" },
+  base: { id: 8453, caip: "eip155:8453", name: "Base", asset: "USDC", gecko: "base", explorer: "https://basescan.org" }
+};
+var PAY_NETWORKS = {
+  robinhood: { ...NETWORKS.robinhood, vm: "evm" },
+  solana: { id: 0, caip: "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp", name: "Solana", asset: "USDC", explorer: "https://solscan.io", vm: "svm" },
+  base: { ...NETWORKS.base, vm: "evm" },
+  arbitrum: { id: 42161, caip: "eip155:42161", name: "Arbitrum", asset: "USDC", explorer: "https://arbiscan.io", vm: "evm" },
+  polygon: { id: 137, caip: "eip155:137", name: "Polygon", asset: "USDC", explorer: "https://polygonscan.com", vm: "evm" }
+};
+function payNetworkOf(v) {
+  const s = String(v ?? "").toLowerCase();
+  for (const [k, n] of Object.entries(PAY_NETWORKS)) if (s === k || s === n.caip.toLowerCase() || n.id && s === String(n.id)) return k;
+  return null;
+}
+
+// src/cli.ts
+init_core();
+init_keychain();
+init_local();
+init_solana();
+init_store();
+init_version();
+var HELP = `wafermap ${VERSION}: an x402 wallet for agents (Robinhood Chain, Solana, Base, Arbitrum, Polygon)
+
+Wallet
+  wafermap init [--import]              create (or import) the agent wallet, encrypted with a password
+  wafermap address                      print the wallet addresses (EVM and Solana)
+  wafermap balance                      USDG / USDC and gas on every payment network
+  wafermap limits [--per-payment 0.1] [--per-day 1] [--per-swap 25] [--network <net>] [--mcp-swaps on|off] [--mcp-confirm on|off]
+  wafermap history [--days 7] [--verify]  payments and swaps from this machine; --verify checks on-chain
+  wafermap export-key [--solana]        print the private key, or the Solana key for Phantom/Solflare
+  wafermap keychain [on|off]            keep the password for \`wafermap mcp\` in the OS keychain, not in plain text
+
+Pay
+  wafermap resources [words]            Wafermap's pay-per-call catalog
+  wafermap call <id> [field=value ...]  run a resource and pay its price  (--json '{...}' for complex input)
+  wafermap discover <words>             search third-party x402 services
+  wafermap pay <url> [field=value ...]  call any x402 URL and pay it       (--post to send a JSON body)
+
+Trade
+  wafermap swap <amount> <from> <to>    swap through KyberSwap on robinhood or base, e.g. wafermap swap 0.01 ETH USDG
+
+Agents
+  wafermap mcp                          run as an MCP server (stdio); password from \`wafermap keychain on\` or WAFERMAP_PASSWORD
+
+Common flags: --network robinhood|solana|base|arbitrum|polygon   --yes (skip the confirmation)
+Files live in ${HOME}. Docs: https://wafermap.xyz/docs#cli`;
+function parse(argv) {
+  const out = { _: [], flags: {} };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a.startsWith("--")) {
+      const [k, v] = a.slice(2).split("=", 2);
+      if (v !== void 0) out.flags[k] = v;
+      else if (argv[i + 1] && !argv[i + 1].startsWith("--") && !["yes", "post", "import"].includes(k)) out.flags[k] = argv[++i];
+      else out.flags[k] = true;
+    } else out._.push(a);
+  }
+  return out;
+}
+function ask(question, hidden = false) {
+  return new Promise((resolve) => {
+    const rl = createInterface({ input: process.stdin, output: process.stdout, terminal: true });
+    if (hidden) {
+      const out = process.stdout;
+      rl._writeToOutput = (s) => out.write(s.includes(question) ? question : s === "\r\n" || s === "\n" ? s : "");
+    }
+    rl.question(question, (a) => {
+      rl.close();
+      if (hidden) process.stdout.write("\n");
+      resolve(a);
+    });
+  });
+}
+async function password() {
+  return process.env.WAFERMAP_PASSWORD || await ask("Wallet password: ", true);
+}
+var net = (v) => isNet(v) ? v : v === void 0 || v === true ? void 0 : die(`--network must be one of ${NETS.join(", ")}`);
+function die(msg) {
+  console.error(`\u2715 ${msg}`);
+  process.exit(1);
+}
+function inputOf(a, from = 0) {
+  const input = {};
+  if (typeof a.flags.json === "string") {
+    try {
+      Object.assign(input, JSON.parse(a.flags.json));
+    } catch {
+      die("--json is not valid JSON");
+    }
+  }
+  for (const kv of a._.slice(from)) {
+    const i = kv.indexOf("=");
+    if (i < 1) die(`"${kv}" should look like field=value`);
+    const v = kv.slice(i + 1);
+    input[kv.slice(0, i)] = /^-?\d+(\.\d+)?$/.test(v) && !/^0x/i.test(v) && v.length < 16 ? Number(v) : v;
+  }
+  return input;
+}
+function approver(yes) {
+  return async (a) => {
+    if (yes) return true;
+    const what = a.kind === "swap" ? `Swap ${a.what} (${a.detail}), worth $${a.usd.toFixed(2)}` : `Pay $${a.usd} on ${a.network} for ${a.what}`;
+    return /^y(es)?$/i.test((await ask(`${what}? [y/N] `)).trim());
+  };
+}
+var EXPLORER = (n) => PAY_NETWORKS[payNetworkOf(n) ?? "robinhood"].explorer;
+function printResult(r) {
+  const scrub = (x) => typeof x === "string" && x.startsWith("data:") ? `[${x.slice(5, x.indexOf(";"))}, ${Math.round(x.length / 1365)} KB, use --out to save]` : Array.isArray(x) ? x.map(scrub) : x && typeof x === "object" ? Object.fromEntries(Object.entries(x).map(([k, y]) => [k, scrub(y)])) : x;
+  console.log(typeof r === "string" ? r : JSON.stringify(scrub(r), null, 2));
+}
+async function saveMedia(r, out) {
+  const { writeFileSync: writeFileSync2 } = await import("node:fs");
+  const media = JSON.stringify(r).match(/data:[\w/.+-]+;base64,[A-Za-z0-9+/=]+/);
+  if (!media) return console.log("(no image or audio in the result to save)");
+  writeFileSync2(out, Buffer.from(media[0].split(",")[1], "base64"));
+  console.log(`Saved ${out}`);
+}
+async function main() {
+  const a = parse(process.argv.slice(2));
+  const cmd = a._.shift() ?? (a.flags.version ? "version" : "help");
+  const yes = a.flags.yes === true;
+  switch (cmd) {
+    case "help":
+    case "--help":
+    case "-h":
+      return console.log(HELP);
+    case "version":
+    case "--version":
+      return console.log(VERSION);
+    case "init": {
+      if (hasWallet()) die(`A wallet already exists (${keystoreAddress()}). Delete ${HOME}/keystore.json first if you really want a new one.`);
+      let key;
+      if (a.flags.import) {
+        const k = (await ask("Private key (0x\u2026): ", true)).trim();
+        key = k.startsWith("0x") ? k : `0x${k}`;
+        if (!/^0x[0-9a-fA-F]{64}$/.test(key)) die("That is not a 64-character hex private key.");
+      } else key = generatePrivateKey();
+      const p1 = process.env.WAFERMAP_PASSWORD ?? await ask("New password (8+ characters): ", true);
+      if (!process.env.WAFERMAP_PASSWORD && p1 !== await ask("Repeat password: ", true)) die("Passwords do not match.");
+      const acct = privateKeyToAccount2(key);
+      const sol = solanaKeyFromEvm(key).address;
+      saveKey(key, acct.address, p1, sol);
+      saveConfig(config());
+      console.log(`\u2713 Agent wallet ${acct.address}
+  Solana address ${sol} (derived from the same key)
+  Key encrypted in ${HOME}/keystore.json. Forget the password and the key is gone: run \`wafermap export-key\` to back it up.
+  Fund it with a few dollars of USDC on Solana (Solana address), or USDG on Robinhood Chain or USDC on Base, Arbitrum or Polygon (EVM address). Payments are gasless; swaps need a little ETH.
+  Caps: $0.10 per payment, $1 per day, $25 per swap. Change with \`wafermap limits\`.`);
+      return;
+    }
+    case "address": {
+      const evm = keystoreAddress() ?? die("No wallet yet. Run `wafermap init`.");
+      let sol = keystoreSolana();
+      if (!sol && process.env.WAFERMAP_PASSWORD) rememberSolana(sol = solanaKeyFromEvm(loadKey(process.env.WAFERMAP_PASSWORD)).address);
+      console.log(`evm     ${evm}`);
+      return console.log(`solana  ${sol ?? "(unlock once to see it: WAFERMAP_PASSWORD=\u2026 wafermap address)"}`);
+    }
+    case "export-key": {
+      const k = loadKey(await password());
+      console.error("Anyone with this key can spend the wallet. Do not paste it into chats or websites.");
+      if (a.flags.solana) {
+        const s = solanaKeyFromEvm(k);
+        rememberSolana(s.address);
+        console.error(`Solana ${s.address}. Import this secret key in Phantom or Solflare ("Import private key"):`);
+        return console.log(s.secretKey);
+      }
+      return console.log(k);
+    }
+    case "limits": {
+      const c = config();
+      const num = (k) => {
+        const v = a.flags[k];
+        if (v === void 0) return void 0;
+        const n = Number(v);
+        if (!(n > 0)) die(`--${k} must be a positive number`);
+        return n;
+      };
+      c.limits.perPayment = num("per-payment") ?? c.limits.perPayment;
+      c.limits.perDay = num("per-day") ?? c.limits.perDay;
+      c.limits.perSwap = num("per-swap") ?? c.limits.perSwap;
+      if (c.limits.perPayment > c.limits.perDay) die("The per-payment cap cannot be above the daily cap.");
+      c.network = net(a.flags.network) ?? c.network;
+      if (a.flags["mcp-swaps"] !== void 0) c.mcpSwaps = a.flags["mcp-swaps"] === "on";
+      if (a.flags["mcp-confirm"] !== void 0) c.mcpConfirm = a.flags["mcp-confirm"] === "on";
+      if (Object.keys(a.flags).length) saveConfig(c);
+      return console.log(`Per payment $${c.limits.perPayment} \xB7 per day $${c.limits.perDay} \xB7 per swap $${c.limits.perSwap} \xB7 network ${c.network} \xB7 swaps from MCP ${c.mcpSwaps ? "on" : "off"} \xB7 confirm each MCP payment ${c.mcpConfirm ? "on" : "off"}`);
+    }
+    case "history": {
+      const days = Number(a.flags.days ?? 7);
+      const since = Date.now() - days * 864e5;
+      const rows = mergeLog(spendLog()).filter((e) => e.at >= since).reverse();
+      if (!rows.length) return console.log(`Nothing in the last ${days} days.`);
+      const verify = a.flags.verify !== void 0;
+      const RPC = { robinhood: process.env.WAFERMAP_RPC_ROBINHOOD, base: process.env.WAFERMAP_RPC_BASE, arbitrum: process.env.WAFERMAP_RPC_ARBITRUM, polygon: process.env.WAFERMAP_RPC_POLYGON };
+      const chain = verify ? await Promise.all(rows.map((e) => e.kind === "swap" ? null : checkPayment(e, RPC[e.network]))) : [];
+      rows.forEach((e, i) => {
+        const state = [e.status, chain[i] ? `on-chain: ${chain[i]}` : null].filter(Boolean).join(", ");
+        console.log(`${new Date(e.at).toISOString().slice(0, 16).replace("T", " ")}  ${e.kind.padEnd(8)}  ${e.kind === "swap" ? "      " : `$${e.usd}`.padEnd(8)}  ${e.network.padEnd(9)}  ${e.what}${state ? `  [${state}]` : ""}${e.tx ? `  ${EXPLORER(e.network)}/tx/${e.tx}` : ""}`);
+      });
+      const pays = rows.filter((e) => e.kind !== "swap");
+      const total = pays.reduce((s, e) => s + e.usd, 0);
+      console.log(`
+Total $${total.toFixed(4)} in ${pays.length} payments. From 0.3.3 every payment counts at its full signed amount; older lines show what the server reported.`);
+      if (verify) {
+        const never = rows.filter((e, i) => e.kind !== "swap" && chain[i] === "unused").reduce((s, e) => s + e.usd, 0);
+        console.log(`On-chain: $${never.toFixed(4)} of that was signed but never executed and has expired. "unknown" = Solana or an older log line; "error" = the RPC did not answer, try again.`);
+      } else console.log("Add --verify to check on-chain which signed payments were executed.");
+      return;
+    }
+    case "resources": {
+      const q = a._.join(" ").toLowerCase();
+      const r = await fetch(`${process.env.WAFERMAP_URL ?? "https://wafermap.xyz"}/v1/resources`).then((x) => x.json());
+      for (const x of (r.data ?? []).filter((x2) => !q || `${x2.id} ${x2.name} ${x2.summary} ${x2.category}`.toLowerCase().includes(q))) console.log(`${x.id.padEnd(22)} $${String(x.price).padEnd(7)} ${x.summary}`);
+      return;
+    }
+    case "discover": {
+      const q = a._.join(" ");
+      if (q.length < 2) die("Say what you are looking for: wafermap discover weather");
+      const wm = openWallet(await password());
+      const list = await wm.discover(q, Number(a.flags.limit ?? 10));
+      for (const s of list) console.log(`${s.payable ? "\u25CF" : "\u25CB"} ${s.priceUsd !== null ? `$${s.priceUsd}`.padEnd(8) : "\u2014".padEnd(8)} ${s.method.padEnd(4)} ${s.url}
+    ${s.description.slice(0, 140)}${s.input ? `
+    input: ${JSON.stringify(s.input).slice(0, 140)}` : ""}`);
+      return console.log(`
+\u25CF payable with USDG (Robinhood Chain) or USDC (Solana, Base, Arbitrum, Polygon)   \u25CB other networks only`);
+    }
+    case "call": {
+      const id = a._[0] ?? die("Which resource? e.g. wafermap call gas-now network=base");
+      const wm = openWallet(await password(), approver(yes));
+      const out = await wm.call(id, inputOf(a, 1), { network: net(a.flags.network) });
+      if (out.receipt) console.error(`\u2713 Paid $${out.receipt.amountUsd} ${out.receipt.asset} \xB7 ${EXPLORER(out.receipt.network)}/tx/${out.receipt.tx}`);
+      if (typeof a.flags.out === "string") await saveMedia(out.result, a.flags.out);
+      return printResult(out.result);
+    }
+    case "pay": {
+      const url = a._[0] ?? die("Which URL? e.g. wafermap pay https://example.com/api city=Paris");
+      if (!/^https:\/\//.test(url)) die("Only https:// URLs.");
+      const wm = openWallet(await password(), approver(yes));
+      const out = await wm.pay(url, { method: a.flags.post ? "POST" : "GET", input: inputOf(a, 1), network: net(a.flags.network) });
+      if (out.paid) console.error(`\u2713 Paid $${out.paid.usd} on ${out.paid.network}${out.paid.tx ? ` \xB7 ${EXPLORER(out.paid.network)}/tx/${out.paid.tx}` : ""}`);
+      return printResult(out.result);
+    }
+    case "balance": {
+      const addr = keystoreAddress() ?? die("No wallet yet. Run `wafermap init`.");
+      const { Wafermap: Wafermap2 } = await Promise.resolve().then(() => (init_core(), core_exports));
+      const wm = new Wafermap2({ account: { ...privateKeyToAccount2(generatePrivateKey()), address: addr }, solanaAddress: keystoreSolana() ?? void 0, baseUrl: process.env.WAFERMAP_URL, rpc: { robinhood: process.env.WAFERMAP_RPC_ROBINHOOD, base: process.env.WAFERMAP_RPC_BASE, arbitrum: process.env.WAFERMAP_RPC_ARBITRUM, polygon: process.env.WAFERMAP_RPC_POLYGON, solana: process.env.WAFERMAP_RPC_SOLANA } });
+      const b = await wm.balances();
+      console.log(addr);
+      for (const n of NETS) console.log(`  ${n.padEnd(10)} ${b[n] ? `${Number(b[n].stable).toFixed(4)} ${b[n].symbol}   ${Number(b[n].eth).toPrecision(4)} ${b[n].gas}` : n === "solana" && !wm.solanaAddress ? "run `wafermap address` once with WAFERMAP_PASSWORD set" : "unreadable (RPC did not answer)"}`);
+      return;
+    }
+    case "swap": {
+      const [amount, from, to] = a._;
+      if (!amount || !from || !to) die("Usage: wafermap swap <amount> <from> <to>  e.g. wafermap swap 0.01 ETH USDG");
+      const wm = openWallet(await password(), approver(yes));
+      const q = await wm.swapQuote(from, to, amount, net(a.flags.network));
+      console.log(`${q.network}: pay ${q.amountIn} ${q.tokenIn.symbol}${q.amountInUsd ? ` ($${q.amountInUsd.toFixed(2)})` : ""} \u2192 about ${q.amountOut} ${q.tokenOut.symbol}${q.amountOutUsd ? ` ($${q.amountOutUsd.toFixed(2)})` : ""} \xB7 cost ${q.impactPct ?? "?"}% \xB7 gas ~$${q.gasUsd?.toFixed(3) ?? "?"}`);
+      const slip = a.flags.slippage !== void 0 ? Number(a.flags.slippage) : 1;
+      if (!(slip > 0 && slip <= 5)) die("--slippage must be between 0 and 5 (percent)");
+      const r = await wm.swap(q, { slippageBps: Math.round(slip * 100), step: (s) => console.error(`\u2026 ${s}`) });
+      return console.log(`\u2713 Swapped \xB7 ${EXPLORER(q.network)}/tx/${r.tx}`);
+    }
+    case "keychain": {
+      const b = backend() ?? die(`No OS keychain support on ${process.platform}. Use WAFERMAP_PASSWORD.`);
+      const where = BACKEND_NAME[b];
+      const what = a._[0];
+      if (what === "on") {
+        const pw2 = await password();
+        loadKey(pw2);
+        keychainSet(pw2);
+        if (keychainGet() !== pw2) die(`The ${where} did not give the password back. Nothing changed for \`wafermap mcp\`.`);
+        return console.log(`\u2713 The wallet password is in the ${where}. \`wafermap mcp\` reads it from there: remove WAFERMAP_PASSWORD from your MCP client's config and restart the client.`);
+      }
+      if (what === "off") {
+        keychainClear();
+        if (keychainGet() !== null) die(`The ${where} still holds the password. Remove the "wafermap" entry by hand.`);
+        return console.log(`\u2713 Removed from the ${where}. \`wafermap mcp\` needs WAFERMAP_PASSWORD again.`);
+      }
+      if (what !== void 0) die("Use: wafermap keychain [on|off]");
+      const pw = keychainGet();
+      if (!pw) return console.log(`Off. \`wafermap mcp\` reads WAFERMAP_PASSWORD. Run \`wafermap keychain on\` to keep it in the ${where}.`);
+      try {
+        loadKey(pw);
+      } catch {
+        die(`On (${where}), but it no longer unlocks the wallet. Run \`wafermap keychain on\` again.`);
+      }
+      return console.log(`On (${where}). It unlocks the wallet.`);
+    }
+    case "mcp": {
+      const { runMcp: runMcp2 } = await Promise.resolve().then(() => (init_mcp(), mcp_exports));
+      return runMcp2();
+    }
+    default:
+      die(`Unknown command "${cmd}". Run \`wafermap help\`.`);
+  }
+}
+main().catch((e) => {
+  if (e instanceof WafermapError && e.code === "declined") die("Cancelled. Nothing was paid.");
+  die(e instanceof WafermapError ? `${e.message} (${e.code})` : e?.shortMessage ?? e?.message ?? String(e));
+});