@zeroclickai/zam-cli 0.3.15

package/dist/index.js

@@ -0,0 +1,3456 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { log as log22 } from "@clack/prompts";
+import { Command as Command20 } from "commander";
+
+// package.json
+var package_default = {
+  name: "@zeroclickai/zam-cli",
+  version: "0.3.15",
+  type: "module",
+  bin: {
+    zam: "bin/zam.js",
+    "zam-cli": "bin/zam.js"
+  },
+  files: [
+    "bin",
+    "dist",
+    "skills",
+    "hooks"
+  ],
+  publishConfig: {
+    access: "public"
+  },
+  scripts: {
+    build: "tsup src/index.ts --format esm --out-dir dist --clean",
+    prepublishOnly: "pnpm run build",
+    dev: "tsx src/index.ts",
+    cli: "ZAM_API_URL=http://localhost:1111 tsx src/index.ts",
+    "test:integration": "vitest run --project integration",
+    "test:unit": "vitest run --project unit",
+    test: "pnpm run test:integration",
+    typecheck: "tsc"
+  },
+  dependencies: {
+    "@clack/prompts": "^0.11.0",
+    commander: "^13.0.0",
+    open: "^11.0.0",
+    "posthog-node": "^5.28.5",
+    ws: "^8.20.0",
+    zod: "^4.3.5"
+  },
+  devDependencies: {
+    "@types/node": "^25.0.7",
+    "@types/ws": "^8.18.1",
+    msw: "^2.12.14",
+    tsup: "^8.5.1",
+    tsx: "^4.21.0",
+    typescript: "^5.9.3",
+    vitest: "^4.0.17"
+  }
+};
+
+// src/api-client.ts
+var ApiError = class extends Error {
+  constructor(status, message, body) {
+    super(message);
+    this.status = status;
+    this.body = body;
+    this.name = "ApiError";
+  }
+  status;
+  body;
+};
+var handleResponse = async (response) => {
+  if (!response.ok) {
+    const body = await response.json().catch(() => ({ error: "Unknown error" }));
+    throw new ApiError(
+      response.status,
+      body.error ?? `HTTP ${response.status}`,
+      body
+    );
+  }
+  if (response.status === 204) {
+    return void 0;
+  }
+  return response.json();
+};
+var createApiClient = (config) => {
+  const headers = (hasBody) => {
+    const h = {};
+    if (hasBody) {
+      h["content-type"] = "application/json";
+    }
+    if (config.apiKey) {
+      h["x-zam-api-key"] = config.apiKey;
+    }
+    return h;
+  };
+  const request = async (method, path, body) => {
+    const url = `${config.baseUrl}${path}`;
+    const hasBody = body !== void 0;
+    const opts = {
+      method,
+      headers: headers(hasBody),
+      body: hasBody ? JSON.stringify(body) : void 0
+    };
+    return handleResponse(await fetch(url, opts));
+  };
+  const get = (path) => request("GET", path);
+  const post = (path, body) => request("POST", path, body);
+  const patch = (path, body) => request("PATCH", path, body);
+  const del = (path) => request("DELETE", path);
+  return {
+    searchZams: async (params) => {
+      const sp = new URLSearchParams();
+      if (params?.query) sp.set("query", params.query);
+      if (params?.category) sp.set("category", params.category);
+      const qs = sp.toString();
+      const response = await get(`/v1/marketplace/zams${qs ? `?${qs}` : ""}`);
+      return Array.isArray(response) ? response : response.results;
+    },
+    getMarketplaceZam: (id) => get(`/v1/marketplace/zams/${id}`),
+    resolveZid: (zid) => get(
+      `/v1/marketplace/resolve/${zid}`
+    ),
+    commitPreflight: (preflightToken) => post("/v1/orders/", { preflightToken }),
+    createPreflight: (listingId, requestBody, providerId) => post("/v1/orders/preflight", {
+      listingId,
+      requestBody,
+      providerId
+    }),
+    listOrders: () => get("/v1/orders/"),
+    getOrder: (id) => get(`/v1/orders/${id}`),
+    listApiKeys: () => get("/v1/api-keys/"),
+    createApiKey: (name, scopes) => post("/v1/api-keys/", {
+      name,
+      scopes
+    }),
+    updateApiKey: (id, data) => patch(`/v1/api-keys/${id}`, data),
+    deleteApiKey: (id) => del(`/v1/api-keys/${id}`),
+    getOpenApiSpec: () => get("/openapi.json"),
+    getSigningSecret: (id) => get(`/v1/zams/${id}/signing-secret`),
+    rotateSigningSecret: (id) => post(`/v1/zams/${id}/signing-secret/rotate`),
+    getWalletInfo: () => get("/v1/wallets/me"),
+    updateWalletProfile: (data) => patch("/v1/wallets/me", data),
+    approveDeviceCode: (code) => post(`/v1/device-codes/${code}/approve`),
+    createFundingSession: (amount) => post(
+      "/v1/wallets/fund",
+      amount ? { amount } : {}
+    ),
+    checkFundingStatus: (sessionId) => get(`/v1/wallets/fund/status/${sessionId}`),
+    listProviders: () => get("/v1/zams/"),
+    getProvider: (id) => get(`/v1/zams/${id}`),
+    createProvider: (data) => post("/v1/zams/", data),
+    updateProvider: (id, data) => patch(`/v1/zams/${id}`, data),
+    deleteProvider: (id) => del(`/v1/zams/${id}`),
+    activate: (zid, input, fromCapability) => {
+      const url = fromCapability ? `/v1/activate/${zid}?fromCapability=${fromCapability}` : `/v1/activate/${zid}`;
+      return post(url, { input });
+    },
+    searchCapabilities: async (query) => {
+      const sp = new URLSearchParams();
+      sp.set("query", query);
+      return get(
+        `/v1/marketplace/capabilities?${sp.toString()}`
+      );
+    },
+    getCapability: (zid) => get(`/v1/marketplace/capabilities/${zid}`),
+    unifiedSearch: async (params) => {
+      const sp = new URLSearchParams();
+      if (params.query) sp.set("query", params.query);
+      if (params.limit) sp.set("limit", String(params.limit));
+      const qs = sp.toString();
+      return get(
+        `/v1/marketplace/search${qs ? `?${qs}` : ""}`
+      );
+    },
+    getZamCapabilities: (id) => get(`/v1/zams/${id}/capabilities`)
+  };
+};
+
+// src/commands/activate.ts
+import { log as log3 } from "@clack/prompts";
+import { Command } from "commander";
+
+// src/auth.ts
+import { log } from "@clack/prompts";
+var requireAuth = (apiKey) => {
+  if (!apiKey) {
+    log.error(
+      "Authentication required.\n\nCreate a wallet with:\n  zam wallet create\n\nOr set your API key with:\n  zam config set-key <your-api-key>\n\nOr set the ZAM_API_KEY environment variable."
+    );
+    process.exitCode = 1;
+    throw new Error("Authentication required");
+  }
+};
+
+// src/commands/activate-flow.ts
+import { log as log2, spinner } from "@clack/prompts";
+
+// src/format.ts
+var formatMicrodollars = (microdollars) => {
+  const dollars = Number(microdollars) / 1e6;
+  return `$${dollars.toFixed(4)}`;
+};
+var formatPrice = (price) => {
+  if (!price) return "Free";
+  const raw = price.amountMicrodollars;
+  if (raw === void 0 || raw === null) return "Free";
+  const micros = Number(raw);
+  if (!Number.isFinite(micros) || micros <= 0) return "Free";
+  const unit = price.unit ?? "call";
+  return `$${(micros / 1e6).toFixed(2)}/${unit}`;
+};
+var formatDate = (iso) => new Date(iso).toLocaleDateString("en-US", {
+  year: "numeric",
+  month: "short",
+  day: "numeric"
+});
+var formatProviderSummary = (p) => `${p.title} [${p.providerState}]
+  ID: ${p.id}
+  ZID: ${p.zid}
+  Slug: ${p.slug}
+  Category: ${p.category ?? "\u2014"} | Price: ${formatPrice(p.price)}
+` + (p.tags?.length ? `  Tags: ${p.tags.join(", ")}
+` : "") + (p.description ? `  ${p.description}` : "");
+var formatProviderDetail = (p) => {
+  let s = `${p.title}
+  ID: ${p.id}
+  ZID: ${p.zid}
+  Slug: ${p.slug}
+  State: ${p.providerState}
+  Category: ${p.category ?? "\u2014"}
+  Category ID: ${p.categoryId ?? "\u2014"}
+  Price: ${formatPrice(p.price)}
+`;
+  if (p.tags?.length) s += `  Tags: ${p.tags.join(", ")}
+`;
+  if (p.description) s += `  Description: ${p.description}
+`;
+  s += `${formatRunContract(p.runContract ?? null)}
+`;
+  if (p.reviewRejectionReason) {
+    s += `  Review Rejection: ${p.reviewRejectionReason}
+`;
+  }
+  s += `  Created: ${formatDate(p.createdAt)} | Updated: ${formatDate(p.updatedAt)}`;
+  return s;
+};
+var formatOrderSummary = (o) => `Order ${o.id} [${o.orderState}]
+  ZAM: ${o.zamId ?? o.providerId ?? o.listingId ?? "\u2014"}
+` + (o.errorMessage ? `  Error: ${o.errorMessage}
+` : "") + `  Created: ${formatDate(o.createdAt)}`;
+var formatOrderDetail = (o) => {
+  let s = `Order ${o.id}
+  State: ${o.orderState}
+  ZAM: ${o.zamId ?? o.providerId ?? o.listingId ?? "\u2014"}
+`;
+  if (o.requestBody) s += `  Request: ${JSON.stringify(o.requestBody)}
+`;
+  if (o.result) s += `  Result: ${JSON.stringify(o.result)}
+`;
+  if (o.errorMessage) s += `  Error: ${o.errorMessage}
+`;
+  if (o.startedAt) s += `  Started: ${formatDate(o.startedAt)}
+`;
+  if (o.completedAt) s += `  Completed: ${formatDate(o.completedAt)}
+`;
+  s += `  Created: ${formatDate(o.createdAt)} | Updated: ${formatDate(o.updatedAt)}`;
+  return s;
+};
+var formatRunContract = (rc) => {
+  if (!rc) return "  Run Contract: none";
+  const endpoint = "endpointPath" in rc ? rc.endpointPath : void 0;
+  let s = endpoint ? `  Run Contract: ${rc.method} ${endpoint}
+` : `  Run Contract: ${rc.method}
+`;
+  if (rc.inputSchema)
+    s += `  Input Schema:
+${JSON.stringify(rc.inputSchema, null, 2).split("\n").map((line) => `    ${line}`).join("\n")}
+`;
+  if (rc.outputSchema)
+    s += `  Output Schema:
+${JSON.stringify(rc.outputSchema, null, 2).split("\n").map((line) => `    ${line}`).join("\n")}
+`;
+  if (rc.requestExampleJson)
+    s += `  Request Example: ${rc.requestExampleJson}
+`;
+  if (rc.responseExampleJson)
+    s += `  Response Example: ${rc.responseExampleJson}
+`;
+  return s.trimEnd();
+};
+var formatApiKeySummary = (k) => `${k.name} (${k.keyPrefix}...)
+  ID: ${k.id}
+  Scopes: ${k.scopes.join(", ")}
+` + (k.lastUsedAt ? `  Last used: ${formatDate(k.lastUsedAt)}
+` : "") + (k.expiresAt ? `  Expires: ${formatDate(k.expiresAt)}` : "  No expiry");
+
+// src/commands/activate-flow.ts
+var POLL_INTERVAL_MS = 1e3;
+var DEFAULT_TIMEOUT_S = 10;
+var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+var activateAndPoll = async (client2, identifier, requestBody, timeoutS = DEFAULT_TIMEOUT_S, opts) => {
+  const quiet = opts?.json === true;
+  const s = spinner();
+  let order;
+  let activateResponse;
+  if (opts?.preflight) {
+    if (!quiet) s.start("Running preflight check...");
+    try {
+      const result = await client2.createPreflight(identifier, requestBody);
+      if (!result.accepted) {
+        if (!quiet) s.stop("Preflight rejected");
+        if (!quiet) log2.error(`Seller rejected: ${result.reason}`);
+        return {
+          order: void 0,
+          activateResponse: void 0,
+          success: false,
+          errorMessage: `Seller rejected: ${result.reason}`
+        };
+      }
+      if (!quiet) {
+        s.stop("Preflight accepted");
+        log2.info(
+          [
+            `Order:   ${result.orderId}`,
+            `Price:   ${formatMicrodollars(result.price.amountMicrodollars)}`,
+            `Expires: ${result.expiresAt}`
+          ].join("\n")
+        );
+      }
+      if (!quiet) s.start("Committing order...");
+      order = await client2.commitPreflight(result.preflightToken);
+      if (!quiet) s.stop(`Order committed: ${order.id} [${order.orderState}]`);
+    } catch (err) {
+      if (!quiet) s.stop("Preflight failed");
+      const msg = err instanceof Error ? err.message : "Unknown error";
+      if (!quiet) log2.error(msg);
+      return {
+        order: void 0,
+        activateResponse: void 0,
+        success: false,
+        errorMessage: msg
+      };
+    }
+  } else {
+    if (!quiet) s.start("Activating...");
+    try {
+      activateResponse = await client2.activate(identifier, requestBody ?? {});
+      order = activateResponse.order;
+      if (!quiet) s.stop(`Order created: ${order.id} [${order.orderState}]`);
+    } catch (err) {
+      if (err instanceof ApiError && err.status === 422 && err.body) {
+        const body = err.body;
+        if (body.preflightRejected) {
+          if (!quiet) {
+            s.stop("Preflight rejected");
+            log2.error(err.message);
+            if (body.suggestions?.length) {
+              log2.warn(
+                `${body.suggestions.length} alternative ZAM(s) available:`
+              );
+              for (const suggestion of body.suggestions) {
+                const label = suggestion.zamTitle ?? suggestion.zamZid ?? suggestion.zamId;
+                const zid = suggestion.zamZid ?? suggestion.zamId;
+                log2.info(`  \u2192 ${label} (${zid})`);
+              }
+              const first = body.suggestions[0];
+              if (first) {
+                const firstZid = first.zamZid ?? first.zamId;
+                log2.info(
+                  `
+Try this next:
+  zam activate ${firstZid} --request-body '...'`
+                );
+              }
+            } else {
+              log2.warn("No other ZAMs available in this capability.");
+            }
+          }
+          return {
+            order: void 0,
+            activateResponse: {
+              suggestions: body.suggestions
+            },
+            success: false,
+            errorMessage: err.message
+          };
+        }
+      }
+      if (!quiet) s.stop("Failed to create order");
+      const msg = err instanceof Error ? err.message : "Unknown error";
+      if (!quiet) log2.error(msg);
+      return {
+        order: void 0,
+        activateResponse: void 0,
+        success: false,
+        errorMessage: msg
+      };
+    }
+  }
+  if (order.orderState === "pending" || order.orderState === "running") {
+    if (!quiet) s.start("Waiting for result...");
+    const deadline = Date.now() + timeoutS * 1e3;
+    while (Date.now() < deadline) {
+      await sleep(POLL_INTERVAL_MS);
+      try {
+        order = await client2.getOrder(order.id);
+      } catch (err) {
+        if (!quiet) s.stop("Failed to poll order");
+        if (!quiet)
+          log2.error(err instanceof Error ? err.message : "Unknown error");
+        return { order, activateResponse, success: false };
+      }
+      if (order.orderState === "completed" || order.orderState === "failed") {
+        break;
+      }
+    }
+    if (!quiet) {
+      if (order.orderState === "completed") {
+        s.stop("Order completed!");
+      } else if (order.orderState === "failed") {
+        s.stop("Order failed");
+      } else {
+        s.stop(
+          `Order still ${order.orderState} after ${timeoutS}s. Check later with: zam orders get ${order.id}`
+        );
+      }
+    }
+  }
+  if (!quiet) log2.info(formatOrderDetail(order));
+  return { order, activateResponse, success: order.orderState !== "failed" };
+};
+
+// src/commands/activate.ts
+var activateCommand = (client2, apiKey) => new Command("activate").description(
+  "Activate a ZAM or Capability (create an order and poll for result)"
+).argument(
+  "<identifier>",
+  "ZAM ZID (ZP-*), Capability ZID (ZG-*), UUID, or slug"
+).option("--request-body <json>", "Request body as JSON string").option(
+  "--timeout <seconds>",
+  "Polling timeout in seconds (default: 10)",
+  String(DEFAULT_TIMEOUT_S)
+).option(
+  "--preflight",
+  "Run a preflight check before executing (validates input, gets dynamic price)"
+).option("--json", "Output as JSON").action(
+  async (identifier, options) => {
+    requireAuth(apiKey);
+    let requestBody;
+    if (options.requestBody) {
+      try {
+        requestBody = JSON.parse(options.requestBody);
+      } catch {
+        log3.error("Invalid JSON for --request-body");
+        process.exitCode = 1;
+        return;
+      }
+    }
+    const timeoutS = Number.parseInt(
+      options.timeout ?? String(DEFAULT_TIMEOUT_S),
+      10
+    );
+    const { order, activateResponse, success, errorMessage } = await activateAndPoll(client2, identifier, requestBody, timeoutS, {
+      preflight: options.preflight,
+      json: options.json
+    });
+    if (options.json) {
+      const output = {};
+      if (order) output.order = order;
+      if (activateResponse?.fulfilledBy) {
+        output.fulfilledBy = activateResponse.fulfilledBy;
+      }
+      if (activateResponse?.suggestions) {
+        output.suggestions = activateResponse.suggestions;
+      }
+      if (!order && !success) {
+        output.error = errorMessage ?? "Activation failed";
+      }
+      process.stdout.write(`${JSON.stringify(output, null, 2)}
+`);
+    }
+    if (!success) {
+      process.exitCode = 1;
+    }
+  }
+);
+
+// src/commands/agents.ts
+import { createHash } from "crypto";
+import {
+  chmodSync,
+  cpSync,
+  existsSync,
+  mkdirSync,
+  readdirSync,
+  readFileSync,
+  writeFileSync
+} from "fs";
+import { homedir } from "os";
+import { dirname, join, relative } from "path";
+import { fileURLToPath } from "url";
+import { confirm, isCancel, log as log4, spinner as spinner2 } from "@clack/prompts";
+import { Command as Command2 } from "commander";
+var TOOLS = [
+  { name: "Claude Code", configDir: ".claude" },
+  { name: "Codex", configDir: ".codex" },
+  { name: "OpenCode", configDir: ".config/opencode" },
+  { name: "Cursor", configDir: ".cursor" }
+];
+var getPackageRoot = () => {
+  let dir = dirname(fileURLToPath(import.meta.url));
+  while (!existsSync(join(dir, "package.json"))) {
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return dir;
+};
+var getSkillsSourceDir = () => join(getPackageRoot(), "skills");
+var getSkillDirs = (skillsSourceDir) => readdirSync(skillsSourceDir, { withFileTypes: true }).filter((d) => d.isDirectory() && d.name.startsWith("zam-")).map((d) => d.name);
+var getHooksSourceDir = () => join(getPackageRoot(), "hooks");
+var sha256File = (filePath) => createHash("sha256").update(readFileSync(filePath)).digest("hex");
+var verifyFileCopy = (src, dest) => {
+  if (!existsSync(dest)) return false;
+  return sha256File(src) === sha256File(dest);
+};
+var collectAllFiles = (dir) => {
+  const files = [];
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    const fullPath = join(dir, entry.name);
+    if (entry.isDirectory()) {
+      files.push(...collectAllFiles(fullPath));
+    } else {
+      files.push(fullPath);
+    }
+  }
+  return files;
+};
+var installHooks = (homeDir) => {
+  const home = homeDir ?? homedir();
+  const claudeDir = join(home, ".claude");
+  if (!existsSync(claudeDir)) {
+    return false;
+  }
+  const zamHooksDir = join(home, ".zam", "hooks");
+  mkdirSync(zamHooksDir, { recursive: true });
+  const hookSource = join(getHooksSourceDir(), "auto-approve-zam.sh");
+  const hookDest = join(zamHooksDir, "auto-approve-zam.sh");
+  cpSync(hookSource, hookDest);
+  chmodSync(hookDest, 493);
+  if (!verifyFileCopy(hookSource, hookDest)) {
+    throw new Error(
+      `Integrity check failed: ${hookDest} does not match source`
+    );
+  }
+  const settingsPath = join(claudeDir, "settings.json");
+  let settings = {};
+  if (existsSync(settingsPath)) {
+    try {
+      settings = JSON.parse(readFileSync(settingsPath, "utf-8"));
+    } catch {
+    }
+  }
+  if (!settings.hooks || typeof settings.hooks !== "object") {
+    settings.hooks = {};
+  }
+  const hooks = settings.hooks;
+  if (!Array.isArray(hooks.PreToolUse)) {
+    hooks.PreToolUse = [];
+  }
+  const preToolUse = hooks.PreToolUse;
+  const zamHookEntry = {
+    matcher: "Bash",
+    hooks: [
+      {
+        type: "command",
+        command: hookDest
+      }
+    ]
+  };
+  const existingIdx = preToolUse.findIndex((entry) => {
+    const entryHooks = entry.hooks;
+    if (!Array.isArray(entryHooks)) return false;
+    return entryHooks.some(
+      (h) => typeof h.command === "string" && h.command.includes("auto-approve-zam")
+    );
+  });
+  if (existingIdx >= 0) {
+    preToolUse[existingIdx] = zamHookEntry;
+  } else {
+    preToolUse.push(zamHookEntry);
+  }
+  writeFileSync(settingsPath, `${JSON.stringify(settings, null, 2)}
+`);
+  return true;
+};
+var installSkills = (homeDir) => {
+  const home = homeDir ?? homedir();
+  const skillsSourceDir = getSkillsSourceDir();
+  const skillDirs = getSkillDirs(skillsSourceDir);
+  const toolsDetected = [];
+  const skillsCopied = [];
+  for (const tool of TOOLS) {
+    const toolConfigPath = join(home, tool.configDir);
+    if (!existsSync(toolConfigPath)) {
+      continue;
+    }
+    const toolSkillsPath = join(toolConfigPath, "skills");
+    mkdirSync(toolSkillsPath, { recursive: true });
+    toolsDetected.push({ name: tool.name, skillsPath: toolSkillsPath });
+    for (const skillDir of skillDirs) {
+      const src = join(skillsSourceDir, skillDir);
+      const dest = join(toolSkillsPath, skillDir);
+      cpSync(src, dest, { recursive: true });
+      for (const srcFile of collectAllFiles(src)) {
+        const relPath = relative(src, srcFile);
+        const destFile = join(dest, relPath);
+        if (!verifyFileCopy(srcFile, destFile)) {
+          throw new Error(
+            `Integrity check failed: ${destFile} does not match source`
+          );
+        }
+      }
+      skillsCopied.push(`${tool.name}: ${dest}`);
+    }
+  }
+  return { toolsDetected, skillsCopied, hooksInstalled: false };
+};
+var describeInstallPlan = (homeDir) => {
+  const home = homeDir ?? homedir();
+  const skillsSourceDir = getSkillsSourceDir();
+  const skillDirs = getSkillDirs(skillsSourceDir);
+  const lines = [];
+  for (const tool of TOOLS) {
+    const toolConfigPath = join(home, tool.configDir);
+    if (!existsSync(toolConfigPath)) continue;
+    const toolSkillsPath = join(toolConfigPath, "skills");
+    for (const skillDir of skillDirs) {
+      const dest = join(toolSkillsPath, skillDir);
+      const exists = existsSync(dest);
+      lines.push(
+        `  ${tool.name}: ${dest}${exists ? " (overwrite)" : " (new)"}`
+      );
+    }
+  }
+  const claudeDir = join(home, ".claude");
+  if (existsSync(claudeDir)) {
+    const hookDest = join(home, ".zam", "hooks", "auto-approve-zam.sh");
+    const exists = existsSync(hookDest);
+    lines.push(`  Hook: ${hookDest}${exists ? " (overwrite)" : " (new)"}`);
+  }
+  return lines;
+};
+var agentsCommand = (homeDir) => new Command2("agents").description("Manage agent skills").addCommand(
+  new Command2("install").description("Install ZAM skills for AI coding agents").option("-y, --yes", "Skip confirmation prompt").action(async (opts) => {
+    const s = spinner2();
+    s.start("Detecting AI coding tools...");
+    const home = homeDir ?? homedir();
+    const hasTools = TOOLS.some((t) => existsSync(join(home, t.configDir)));
+    if (!hasTools) {
+      s.stop("No supported AI coding tools detected");
+      log4.warn(
+        "No AI coding tools found. Supported tools:\n  - Claude Code (~/.claude/)\n  - Codex (~/.codex/)\n  - OpenCode (~/.config/opencode/)\n  - Cursor (~/.cursor/)"
+      );
+      return;
+    }
+    s.stop("Tools detected");
+    const planLines = describeInstallPlan(homeDir);
+    log4.info(`Files to install:
+${planLines.join("\n")}`);
+    if (!opts.yes) {
+      const confirmed = await confirm({
+        message: "Proceed with installation?"
+      });
+      if (isCancel(confirmed) || !confirmed) {
+        log4.info("Installation cancelled.");
+        return;
+      }
+    }
+    const s2 = spinner2();
+    s2.start("Installing skills...");
+    const result = installSkills(homeDir);
+    s2.stop(
+      `Found ${result.toolsDetected.length} tool(s): ${result.toolsDetected.map((t) => t.name).join(", ")}`
+    );
+    for (const entry of result.skillsCopied) {
+      log4.info(`  Installed: ${entry}`);
+    }
+    const hooksInstalled = installHooks(homeDir);
+    if (hooksInstalled) {
+      log4.info("  Installed auto-approval hook for Claude Code");
+      log4.info(
+        "  Auto-approved: zam search, zam orders list/get, zam openapi, zam config show"
+      );
+    }
+    log4.success(
+      `Installed ZAM skills for ${result.toolsDetected.length} tool(s)`
+    );
+  })
+);
+
+// src/commands/api-keys.ts
+import {
+  cancel,
+  confirm as confirm2,
+  isCancel as isCancel2,
+  log as log5,
+  multiselect,
+  spinner as spinner3,
+  text
+} from "@clack/prompts";
+import { Command as Command3 } from "commander";
+var ALL_SCOPES = [
+  "api_key:create",
+  "api_key:read",
+  "api_key:update",
+  "api_key:delete",
+  "zam:create",
+  "zam:read",
+  "zam:update",
+  "zam:delete",
+  "order:create",
+  "order:read"
+];
+var apiKeysCommand = (client2, apiKey) => new Command3("api-keys").description("Manage API keys").addCommand(
+  new Command3("list").description("List your API keys").option("--json", "Output as JSON").action(async (opts) => {
+    requireAuth(apiKey);
+    const s = spinner3();
+    if (!opts.json) s.start("Fetching API keys...");
+    try {
+      const keys = await client2.listApiKeys();
+      if (opts.json) {
+        process.stdout.write(`${JSON.stringify(keys, null, 2)}
+`);
+        return;
+      }
+      s.stop(`Found ${keys.length} API key(s)`);
+      if (keys.length === 0) {
+        log5.info("No API keys found.");
+        return;
+      }
+      for (const k of keys) {
+        log5.info(formatApiKeySummary(k));
+      }
+    } catch (err) {
+      if (!opts.json) s.stop("Failed to fetch API keys");
+      log5.error(err instanceof Error ? err.message : "Unknown error");
+      process.exitCode = 1;
+    }
+  })
+).addCommand(
+  new Command3("create").description("Create a new API key").option("--json", "Output as JSON").option("--name <name>", "Key name").option(
+    "--scopes <scopes>",
+    "Comma-separated scopes (e.g. zam:read,order:create)"
+  ).action(
+    async (opts) => {
+      requireAuth(apiKey);
+      const name = opts.name ?? await (async () => {
+        const v = await text({
+          message: "Key name:",
+          validate: (val) => val.length > 0 ? void 0 : "Name is required"
+        });
+        if (isCancel2(v)) {
+          cancel("Cancelled.");
+          process.exit(0);
+        }
+        return v;
+      })();
+      const scopes = opts.scopes ? opts.scopes.split(",").map((s2) => s2.trim()).filter(Boolean) : await (async () => {
+        const selected = await multiselect({
+          message: "Select scopes:",
+          options: ALL_SCOPES.map((s2) => ({
+            value: s2,
+            label: s2
+          })),
+          required: true
+        });
+        if (isCancel2(selected)) {
+          cancel("Cancelled.");
+          process.exit(0);
+        }
+        return selected;
+      })();
+      const s = spinner3();
+      if (!opts.json) s.start("Creating API key...");
+      try {
+        const result = await client2.createApiKey(name, scopes);
+        if (opts.json) {
+          process.stdout.write(
+            `${JSON.stringify(
+              {
+                apiKey: result.apiKey,
+                plaintextKey: result.plaintextKey
+              },
+              null,
+              2
+            )}
+`
+          );
+          return;
+        }
+        s.stop("API key created");
+        log5.warning(
+          `Save this key \u2014 it will not be shown again:
+
+  ${result.plaintextKey}
+`
+        );
+        log5.info(formatApiKeySummary(result.apiKey));
+      } catch (err) {
+        if (!opts.json) s.stop("Failed to create API key");
+        log5.error(err instanceof Error ? err.message : "Unknown error");
+        process.exitCode = 1;
+      }
+    }
+  )
+).addCommand(
+  new Command3("update").description("Update an API key").argument("<id>", "API key ID").option("--json", "Output as JSON").option("--name <name>", "New name").option(
+    "--scopes <scopes>",
+    "Comma-separated new scopes (e.g. zam:read,order:create)"
+  ).action(
+    async (id, opts) => {
+      requireAuth(apiKey);
+      const hasFlags = opts.name !== void 0 || opts.scopes !== void 0;
+      let nameVal;
+      let scopesVal;
+      if (hasFlags) {
+        nameVal = opts.name;
+        scopesVal = opts.scopes ? opts.scopes.split(",").map((s2) => s2.trim()).filter(Boolean) : void 0;
+      } else {
+        const nameInput = await text({
+          message: "New name (leave empty to skip):",
+          defaultValue: ""
+        });
+        if (isCancel2(nameInput)) {
+          cancel("Cancelled.");
+          process.exit(0);
+        }
+        nameVal = nameInput || void 0;
+        const changeScopes = await confirm2({
+          message: "Update scopes?"
+        });
+        if (isCancel2(changeScopes)) {
+          cancel("Cancelled.");
+          process.exit(0);
+        }
+        if (changeScopes) {
+          const selected = await multiselect({
+            message: "Select new scopes:",
+            options: ALL_SCOPES.map((s2) => ({
+              value: s2,
+              label: s2
+            })),
+            required: true
+          });
+          if (isCancel2(selected)) {
+            cancel("Cancelled.");
+            process.exit(0);
+          }
+          scopesVal = selected;
+        }
+      }
+      const s = spinner3();
+      if (!opts.json) s.start("Updating API key...");
+      try {
+        const updated = await client2.updateApiKey(id, {
+          name: nameVal,
+          scopes: scopesVal
+        });
+        if (opts.json) {
+          process.stdout.write(`${JSON.stringify(updated, null, 2)}
+`);
+          return;
+        }
+        s.stop("API key updated");
+        log5.success(formatApiKeySummary(updated));
+      } catch (err) {
+        if (!opts.json) s.stop("Failed to update API key");
+        log5.error(err instanceof Error ? err.message : "Unknown error");
+        process.exitCode = 1;
+      }
+    }
+  )
+).addCommand(
+  new Command3("delete").description("Delete an API key").argument("<id>", "API key ID").option("--json", "Output as JSON").option("-y, --yes", "Skip confirmation prompt").action(async (id, opts) => {
+    requireAuth(apiKey);
+    if (!opts.json && !opts.yes) {
+      const confirmed = await confirm2({
+        message: `Delete API key ${id}?`
+      });
+      if (isCancel2(confirmed) || !confirmed) {
+        cancel("Cancelled.");
+        return;
+      }
+    }
+    const s = spinner3();
+    if (!opts.json) s.start("Deleting API key...");
+    try {
+      await client2.deleteApiKey(id);
+      if (opts.json) {
+        process.stdout.write(
+          `${JSON.stringify({ deleted: true, id }, null, 2)}
+`
+        );
+        return;
+      }
+      s.stop("API key deleted");
+      log5.success(`API key ${id} deleted.`);
+    } catch (err) {
+      if (!opts.json) s.stop("Failed to delete API key");
+      log5.error(err instanceof Error ? err.message : "Unknown error");
+      process.exitCode = 1;
+    }
+  })
+);
+
+// src/commands/auth-approve.ts
+import { log as log6, spinner as spinner4 } from "@clack/prompts";
+import { Command as Command4 } from "commander";
+var authApproveCommand = (client2, apiKey) => new Command4("approve").description("Approve a device code to sign in on the dashboard").argument("<code>", "The device code shown on the dashboard").action(async (code) => {
+  if (!apiKey) {
+    log6.error(
+      "No API key configured. Run `zam wallet create` or `zam config set-key` first."
+    );
+    process.exitCode = 1;
+    return;
+  }
+  const s = spinner4();
+  s.start("Approving device code...");
+  try {
+    await client2.approveDeviceCode(code);
+    s.stop("Device code approved!");
+    log6.success(
+      "Dashboard sign-in approved. You can close your browser prompt."
+    );
+  } catch (err) {
+    s.stop("Failed to approve");
+    log6.error(
+      err instanceof Error ? err.message : "Failed to approve device code"
+    );
+    process.exitCode = 1;
+  }
+});
+
+// src/commands/capabilities.ts
+import { log as log7, spinner as spinner5 } from "@clack/prompts";
+import { Command as Command5 } from "commander";
+var formatCapabilitySummary = (c) => {
+  let s = `${c.name}  ${c.zid}
+`;
+  if (c.description) s += `  ${c.description}
+`;
+  return s.trimEnd();
+};
+var capabilitiesCommand = (client2) => new Command5("capabilities").description("Browse and inspect capabilities").addCommand(
+  new Command5("list").description("List published capabilities").option("--json", "Output as JSON").action(async (opts) => {
+    const s = spinner5();
+    if (!opts.json) s.start("Fetching capabilities...");
+    try {
+      const capabilities = await client2.searchCapabilities("");
+      if (opts.json) {
+        process.stdout.write(
+          `${JSON.stringify(capabilities, null, 2)}
+`
+        );
+        return;
+      }
+      s.stop(`Found ${capabilities.length} capability(ies)`);
+      if (capabilities.length === 0) {
+        log7.info("No capabilities found.");
+        return;
+      }
+      for (const c of capabilities) {
+        log7.info(formatCapabilitySummary(c));
+      }
+    } catch (err) {
+      if (!opts.json) s.stop("Failed to fetch capabilities");
+      log7.error(err instanceof Error ? err.message : "Unknown error");
+      process.exitCode = 1;
+    }
+  })
+).addCommand(
+  new Command5("inspect").description("Inspect a capability by ZID").argument("<zid>", "Capability ZID (e.g. ZG-sms-texting)").option("--json", "Output as JSON").action(async (zid, opts) => {
+    const s = spinner5();
+    if (!opts.json) s.start("Fetching capability...");
+    try {
+      const detail = await client2.getCapability(zid);
+      if (opts.json) {
+        process.stdout.write(`${JSON.stringify(detail, null, 2)}
+`);
+        return;
+      }
+      s.stop("Capability found");
+      let output = `${detail.name}
+`;
+      output += `  ZID: ${zid}
+`;
+      if (detail.description) {
+        output += `  Description: ${detail.description}
+`;
+      }
+      output += `  Sensitivity: ${detail.sensitivityLevel}
+`;
+      output += `  Schema Version: ${detail.schemaVersion}
+`;
+      if (detail.tags?.length) {
+        output += `  Tags: ${detail.tags.join(", ")}
+`;
+      }
+      if (detail.defaultInputSchema) {
+        output += `  Input Schema:
+${JSON.stringify(
+          detail.defaultInputSchema,
+          null,
+          2
+        ).split("\n").map((line) => `    ${line}`).join("\n")}
+`;
+      }
+      if (detail.defaultOutputSchema) {
+        output += `  Output Schema:
+${JSON.stringify(
+          detail.defaultOutputSchema,
+          null,
+          2
+        ).split("\n").map((line) => `    ${line}`).join("\n")}
+`;
+      }
+      log7.info(output);
+      if (detail.members.length > 0) {
+        log7.info(`Members (${detail.members.length}):`);
+        for (const m of detail.members) {
+          const price = formatPrice(m.price);
+          let memberLine = `  ${m.title}  ${m.zid}  ${price}`;
+          if (m.description) {
+            memberLine += `
+    ${m.description}`;
+          }
+          log7.info(memberLine);
+        }
+      } else {
+        log7.info("No members.");
+      }
+      log7.info(`
+Activate: zam activate ${zid} --request-body '{...}'`);
+    } catch (err) {
+      if (!opts.json) s.stop("Failed to fetch capability");
+      log7.error(err instanceof Error ? err.message : "Unknown error");
+      process.exitCode = 1;
+    }
+  })
+).addCommand(
+  new Command5("search").description("Search capabilities by query").argument("<query>", "Search query").option("--json", "Output as JSON").action(async (query, opts) => {
+    const s = spinner5();
+    if (!opts.json) s.start("Searching capabilities...");
+    try {
+      const capabilities = await client2.searchCapabilities(query);
+      if (opts.json) {
+        process.stdout.write(
+          `${JSON.stringify(capabilities, null, 2)}
+`
+        );
+        return;
+      }
+      s.stop(`Found ${capabilities.length} capability(ies)`);
+      if (capabilities.length === 0) {
+        log7.info("No capabilities matched your query.");
+        return;
+      }
+      for (const c of capabilities) {
+        log7.info(formatCapabilitySummary(c));
+      }
+    } catch (err) {
+      if (!opts.json) s.stop("Search failed");
+      log7.error(err instanceof Error ? err.message : "Unknown error");
+      process.exitCode = 1;
+    }
+  })
+);
+
+// src/commands/config.ts
+import { cancel as cancel2, isCancel as isCancel3, log as log8, text as text2 } from "@clack/prompts";
+import { Command as Command6 } from "commander";
+
+// src/config.ts
+import {
+  chmodSync as chmodSync2,
+  mkdirSync as mkdirSync2,
+  readFileSync as readFileSync2,
+  writeFileSync as writeFileSync2
+} from "fs";
+import { homedir as homedir2 } from "os";
+import { dirname as dirname2, join as join2 } from "path";
+import { z } from "zod";
+var CONFIG_DIR = join2(homedir2(), ".zam");
+var CONFIG_FILE = join2(CONFIG_DIR, "config.v2.json");
+var DEFAULT_API_URL = "https://api.zeroclick.am";
+var configSchema = z.object({
+  apiKey: z.string().optional(),
+  apiUrl: z.string().optional(),
+  telemetry: z.boolean().optional(),
+  telemetryNoticeShown: z.boolean().optional()
+});
+var loadConfig = (configPath = CONFIG_FILE) => {
+  try {
+    const raw = readFileSync2(configPath, "utf-8");
+    return configSchema.parse(JSON.parse(raw));
+  } catch {
+    return {};
+  }
+};
+var saveConfig = (updates, configPath = CONFIG_FILE) => {
+  const configDir = dirname2(configPath);
+  mkdirSync2(configDir, { recursive: true, mode: 448 });
+  chmodSync2(configDir, 448);
+  const existing = loadConfig(configPath);
+  const merged = { ...existing, ...updates };
+  writeFileSync2(configPath, `${JSON.stringify(merged, null, 2)}
+`, {
+    mode: 384
+  });
+  chmodSync2(configPath, 384);
+};
+var getEffectiveConfig = (configPath = CONFIG_FILE) => {
+  const file = loadConfig(configPath);
+  return {
+    apiUrl: process.env.ZAM_API_URL ?? file.apiUrl ?? DEFAULT_API_URL,
+    apiKey: process.env.ZAM_API_KEY ?? file.apiKey
+  };
+};
+
+// src/telemetry.ts
+import { randomUUID } from "crypto";
+import { existsSync as existsSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+import { join as join3 } from "path";
+import { PostHog } from "posthog-node";
+var POSTHOG_KEY = "phc_yzL0ANbc4pgoBNQRCtYIuXXctrzYUSMP4R9zpDDKE72";
+var POSTHOG_HOST = "https://us.i.posthog.com";
+var MAX_ERROR_LENGTH = 200;
+var SHUTDOWN_TIMEOUT_MS = 2e3;
+var SESSION_FILE = join3(
+  process.env.HOME ?? process.env.USERPROFILE ?? ".",
+  ".zam",
+  "telemetry-id"
+);
+var client = null;
+var isTelemetryEnabled = () => {
+  const envVal = process.env.ZAM_TELEMETRY?.toLowerCase();
+  if (envVal === "off" || envVal === "false" || envVal === "0") return false;
+  const config = loadConfig();
+  if (config.telemetry === false) return false;
+  return true;
+};
+var getAnonymousId = () => {
+  try {
+    if (existsSync3(SESSION_FILE)) {
+      return readFileSync3(SESSION_FILE, "utf-8").trim();
+    }
+  } catch {
+  }
+  const id = randomUUID().replace(/-/g, "").slice(0, 16);
+  try {
+    writeFileSync3(SESSION_FILE, id);
+  } catch {
+  }
+  return id;
+};
+var getClient = () => {
+  if (!isTelemetryEnabled()) return null;
+  if (!client) {
+    client = new PostHog(POSTHOG_KEY, {
+      host: POSTHOG_HOST,
+      flushAt: 1,
+      flushInterval: 0
+    });
+  }
+  return client;
+};
+var trackCommand = (command, properties) => {
+  const ph = getClient();
+  if (!ph) return;
+  ph.capture({
+    distinctId: getAnonymousId(),
+    event: "cli_command",
+    properties: {
+      command,
+      cliVersion: package_default.version,
+      os: process.platform,
+      nodeVersion: process.version,
+      ...properties
+    }
+  });
+};
+var trackError = (command, error) => {
+  const ph = getClient();
+  if (!ph) return;
+  ph.capture({
+    distinctId: getAnonymousId(),
+    event: "cli_error",
+    properties: {
+      command,
+      error: error.slice(0, MAX_ERROR_LENGTH),
+      cliVersion: package_default.version,
+      os: process.platform
+    }
+  });
+};
+var shutdownTelemetry = async () => {
+  if (client) {
+    const c = client;
+    client = null;
+    await c.shutdown(SHUTDOWN_TIMEOUT_MS);
+  }
+};
+var printTelemetryNotice = () => {
+  if (!isTelemetryEnabled()) return;
+  const config = loadConfig();
+  if (config.telemetryNoticeShown) return;
+  console.error(
+    "\n  ZAM collects anonymous usage data to improve the CLI.\n  Run 'zam config set-telemetry off' or set ZAM_TELEMETRY=off to disable.\n"
+  );
+  saveConfig({ telemetryNoticeShown: true });
+};
+
+// src/commands/config.ts
+var configCommand = (opts) => new Command6("config").description("Manage CLI configuration").addCommand(
+  new Command6("set-key").description("Set the API key").argument("[key]", "API key (zam_... format)").action(async (key) => {
+    const apiKey = key ?? await (async () => {
+      const v = await text2({
+        message: "Enter your ZAM API key:",
+        placeholder: "zam_...",
+        validate: (val) => val.startsWith("zam_") ? void 0 : "API key must start with zam_"
+      });
+      if (isCancel3(v)) {
+        cancel2("Cancelled.");
+        process.exit(0);
+      }
+      return v;
+    })();
+    saveConfig({ apiKey }, opts?.configPath);
+    log8.success("API key saved.");
+  })
+).addCommand(
+  new Command6("set-url").description("Set the API base URL").argument("[url]", "API base URL").action(async (url) => {
+    const apiUrl = url ?? await (async () => {
+      const v = await text2({
+        message: "Enter the API base URL:",
+        placeholder: "http://localhost:3000"
+      });
+      if (isCancel3(v)) {
+        cancel2("Cancelled.");
+        process.exit(0);
+      }
+      return v;
+    })();
+    saveConfig({ apiUrl }, opts?.configPath);
+    log8.success("API URL saved.");
+  })
+).addCommand(
+  new Command6("set-telemetry").description("Enable or disable anonymous telemetry (on/off)").argument("<value>", "'on' or 'off'").action((value) => {
+    const enabled = value.toLowerCase() === "on";
+    saveConfig({ telemetry: enabled }, opts?.configPath);
+    log8.success(`Telemetry ${enabled ? "enabled" : "disabled"}.`);
+  })
+).addCommand(
+  new Command6("show").description("Show current configuration").action(() => {
+    const config = getEffectiveConfig(opts?.configPath);
+    log8.info(`API URL: ${config.apiUrl}`);
+    log8.info(`API Key: ${config.apiKey ?? "(not set)"}`);
+    log8.info(`Telemetry: ${isTelemetryEnabled() ? "on" : "off"}`);
+  })
+);
+
+// src/commands/inspect.ts
+import { log as log9, spinner as spinner6 } from "@clack/prompts";
+import { Command as Command7 } from "commander";
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var fetchZam = async (client2, identifier) => {
+  if (UUID_RE.test(identifier)) {
+    return client2.getMarketplaceZam(identifier);
+  }
+  try {
+    const resolved = await client2.resolveZid(identifier);
+    if (resolved.type === "capability") {
+      return resolved.data;
+    }
+    return client2.getMarketplaceZam(
+      resolved.data.id
+    );
+  } catch {
+    const results = await client2.searchZams({ query: identifier });
+    const match = results.find(
+      (z3) => z3.slug === identifier || z3.title.toLowerCase() === identifier.toLowerCase()
+    );
+    if (match) {
+      return client2.getMarketplaceZam(match.id);
+    }
+    throw new Error(`ZAM "${identifier}" not found`);
+  }
+};
+var inspectCommand = (client2) => new Command7("inspect").description(
+  "Inspect a ZAM or Capability \u2014 view schema, pricing, and details before activating"
+).argument(
+  "<identifier>",
+  "ZAM or capability ZID, UUID, or slug (e.g. ZPXXXX, ZG-sms-texting, send-sms)"
+).option("--json", "Output as JSON (machine-readable)").action(async (identifier, options) => {
+  const s = spinner6();
+  if (!options.json) s.start("Fetching details...");
+  try {
+    const resolved = await fetchZam(client2, identifier);
+    const isCapability = !!(resolved.defaultInputSchema || resolved.name && !resolved.title);
+    const title = resolved.title ?? resolved.name;
+    if (!options.json) s.stop(title);
+    const inputSchema = isCapability ? resolved.defaultInputSchema ?? null : resolved.runContract?.inputSchema ?? null;
+    const outputSchema = isCapability ? resolved.defaultOutputSchema ?? null : resolved.runContract?.outputSchema ?? null;
+    if (options.json) {
+      const output = {
+        type: isCapability ? "capability" : "zam",
+        zid: resolved.zid ?? null,
+        title,
+        description: resolved.description ?? null,
+        inputSchema,
+        outputSchema
+      };
+      if (!isCapability) {
+        output.id = resolved.id;
+        output.category = resolved.category ?? null;
+        output.price = resolved.price ?? null;
+      }
+      process.stdout.write(`${JSON.stringify(output, null, 2)}
+`);
+      return;
+    }
+    const lines = [];
+    if (isCapability) {
+      lines.push(`  Type: Capability`);
+    }
+    if (resolved.zid) lines.push(`  ZID: ${resolved.zid}`);
+    if (resolved.id) lines.push(`  ID: ${resolved.id}`);
+    if (resolved.category) lines.push(`  Category: ${resolved.category}`);
+    if (!isCapability) {
+      lines.push(
+        `  Price: ${formatPrice(resolved.price)}`
+      );
+    }
+    if (resolved.providerState)
+      lines.push(`  State: ${resolved.providerState}`);
+    if (Array.isArray(resolved.tags) && resolved.tags.length)
+      lines.push(`  Tags: ${resolved.tags.join(", ")}`);
+    if (resolved.description)
+      lines.push(`  Description: ${resolved.description}`);
+    if (inputSchema) {
+      lines.push("  Input Schema:");
+      lines.push(
+        JSON.stringify(inputSchema, null, 2).split("\n").map((l) => `    ${l}`).join("\n")
+      );
+    }
+    if (outputSchema) {
+      lines.push("  Output Schema:");
+      lines.push(
+        JSON.stringify(outputSchema, null, 2).split("\n").map((l) => `    ${l}`).join("\n")
+      );
+    }
+    log9.info(lines.join("\n"));
+    const zid = resolved.zid ?? resolved.id;
+    if (inputSchema) {
+      const props = inputSchema.properties;
+      if (props) {
+        const fields = Object.keys(props).map((k) => `"${k}": ...`).join(", ");
+        log9.info(
+          `
+To activate:
+  zam activate ${zid} --request-body '{${fields}}'`
+        );
+      }
+    } else {
+      log9.info(`
+To activate:
+  zam activate ${zid}`);
+    }
+    if (isCapability) {
+      log9.info(
+        `
+This is a capability \u2014 the system will pick the best ZAM and map your input automatically.`
+      );
+    }
+  } catch (err) {
+    if (!options.json) s.stop("Failed");
+    log9.error(err instanceof Error ? err.message : "Unknown error");
+    process.exitCode = 1;
+  }
+});
+
+// src/commands/node.ts
+import { log as log10, spinner as spinner7 } from "@clack/prompts";
+import { Command as Command8 } from "commander";
+
+// src/node/bundle-manager.ts
+import { createHash as createHash2 } from "crypto";
+import { mkdir, readFile, stat, writeFile } from "fs/promises";
+import { homedir as homedir3 } from "os";
+import { dirname as dirname3, join as join4 } from "path";
+var BUNDLE_DIR = join4(homedir3(), ".zam-node", "bundles");
+var BundleManager = class {
+  constructor(bundleDir = BUNDLE_DIR) {
+    this.bundleDir = bundleDir;
+  }
+  bundleDir;
+  /** Check if a bundle version is already cached locally. */
+  async hasCached(zamId, version2) {
+    const path = this.bundlePath(zamId, version2);
+    const s = await stat(path).catch(() => null);
+    return s !== null;
+  }
+  /** Download a bundle from the platform, verify SHA-256, and cache it. */
+  async download(bundleUrl, expectedSha256, zamId, version2, apiKey, metadata) {
+    const response = await fetch(bundleUrl, {
+      headers: { "x-zam-api-key": apiKey }
+    });
+    if (!response.ok) {
+      throw new Error(
+        `Bundle download failed: ${response.status} ${response.statusText}`
+      );
+    }
+    const content = Buffer.from(await response.arrayBuffer());
+    const actualSha256 = createHash2("sha256").update(content).digest("hex");
+    if (actualSha256 !== expectedSha256) {
+      throw new Error(
+        `Bundle integrity check failed: expected ${expectedSha256}, got ${actualSha256}`
+      );
+    }
+    const path = this.bundlePath(zamId, version2);
+    await mkdir(dirname3(path), { recursive: true });
+    await writeFile(path, content);
+    await writeFile(
+      this.metaPath(zamId, version2),
+      JSON.stringify({
+        zamId,
+        version: version2,
+        sha256: actualSha256,
+        signature: metadata?.signature,
+        capabilityLevel: metadata?.capabilityLevel,
+        resourceLimits: metadata?.resourceLimits
+      })
+    );
+    return path;
+  }
+  /** Read a cached bundle from disk. */
+  async readBundle(zamId, version2) {
+    const path = this.bundlePath(zamId, version2);
+    const content = await readFile(path, "utf-8");
+    return content;
+  }
+  /** Get the filesystem path for a bundle. */
+  bundlePath(zamId, version2) {
+    return join4(this.bundleDir, zamId, `${version2}.js`);
+  }
+  metaPath(zamId, version2) {
+    return join4(this.bundleDir, zamId, `${version2}.meta.json`);
+  }
+};
+
+// src/node/tunnel-client.ts
+import WebSocket from "ws";
+var RECONNECT_DELAY_MS = 3e3;
+var MAX_RECONNECT_DELAY_MS = 3e4;
+var TunnelClient = class {
+  constructor(opts) {
+    this.opts = opts;
+  }
+  opts;
+  ws = null;
+  reconnectDelay = RECONNECT_DELAY_MS;
+  reconnectTimer = null;
+  stopped = false;
+  /** Connect to the tunnel gateway. Auto-reconnects on disconnect. */
+  connect() {
+    this.stopped = false;
+    this.doConnect();
+  }
+  /** Gracefully disconnect. */
+  disconnect() {
+    this.stopped = true;
+    if (this.reconnectTimer) {
+      clearTimeout(this.reconnectTimer);
+      this.reconnectTimer = null;
+    }
+    if (this.ws) {
+      this.ws.close(1e3, "Client shutdown");
+      this.ws = null;
+    }
+  }
+  /** Send a capabilities message to advertise loaded ZAMs. */
+  sendCapabilities(runtime, loadedZamIds, runtimeVersion) {
+    this.send({
+      type: "capabilities",
+      runtime,
+      runtimeVersion,
+      loadedZamIds
+    });
+  }
+  doConnect() {
+    const tunnelUrl = this.opts.apiUrl.replace("http://", "ws://").replace("https://", "wss://");
+    const url = `${tunnelUrl}/tunnel/${this.opts.nodeId}`;
+    this.opts.log(`Connecting to ${url}...`);
+    const ws = new WebSocket(url);
+    this.ws = ws;
+    ws.on("open", () => {
+      this.opts.log("WebSocket open, authenticating...");
+      this.send({
+        type: "auth",
+        apiKey: this.opts.apiKey,
+        nodeId: this.opts.nodeId,
+        version: this.opts.version ?? "1.0.0"
+      });
+    });
+    ws.on("message", (data) => {
+      try {
+        const msg = JSON.parse(data.toString());
+        this.handleMessage(msg);
+      } catch (err) {
+        this.opts.log(`Invalid message: ${err}`);
+      }
+    });
+    ws.on("close", (code, reason) => {
+      const reasonStr = reason?.toString() ?? "unknown";
+      this.opts.log(`Disconnected: ${code} ${reasonStr}`);
+      this.opts.onDisconnected(code, reasonStr);
+      this.ws = null;
+      this.scheduleReconnect();
+    });
+    ws.on("error", (err) => {
+      this.opts.log(`WebSocket error: ${err.message}`);
+    });
+  }
+  handleMessage(msg) {
+    switch (msg.type) {
+      case "auth_ok":
+        this.opts.log(`Authenticated. Heartbeat: ${msg.heartbeatIntervalMs}ms`);
+        this.reconnectDelay = RECONNECT_DELAY_MS;
+        this.opts.onConnected();
+        break;
+      case "auth_error":
+        this.opts.log(`Auth failed: ${msg.message}`);
+        this.stopped = true;
+        this.opts.onAuthError(msg.message);
+        break;
+      case "ping":
+        this.send({ type: "pong", ts: msg.ts });
+        break;
+      case "request":
+        this.handleRequest(msg);
+        break;
+      case "deploy":
+        this.handleDeploy(msg);
+        break;
+      case "undeploy":
+        this.opts.onUndeploy(msg.zamId).catch(
+          (err) => this.opts.log(`Undeploy error for ${msg.zamId}: ${err}`)
+        );
+        break;
+    }
+  }
+  handleRequest(msg) {
+    this.opts.onRequest(msg).then((response) => {
+      this.send({
+        type: "response",
+        id: msg.id,
+        ...response
+      });
+    }).catch((err) => {
+      this.send({
+        type: "response",
+        id: msg.id,
+        status: 500,
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+          error: err instanceof Error ? err.message : "Internal error"
+        })
+      });
+    });
+  }
+  handleDeploy(msg) {
+    this.opts.onDeploy(msg).then((result) => {
+      this.send({
+        type: "deploy_ack",
+        zamId: msg.zamId,
+        success: result.success,
+        error: result.error
+      });
+    }).catch((err) => {
+      this.send({
+        type: "deploy_ack",
+        zamId: msg.zamId,
+        success: false,
+        error: err instanceof Error ? err.message : "Deploy failed"
+      });
+    });
+  }
+  send(msg) {
+    if (this.ws?.readyState === WebSocket.OPEN) {
+      this.ws.send(JSON.stringify(msg));
+    }
+  }
+  scheduleReconnect() {
+    if (this.stopped) return;
+    this.opts.log(`Reconnecting in ${this.reconnectDelay}ms...`);
+    this.reconnectTimer = setTimeout(() => {
+      this.reconnectTimer = null;
+      this.doConnect();
+    }, this.reconnectDelay);
+    this.reconnectDelay = Math.min(
+      this.reconnectDelay * 2,
+      MAX_RECONNECT_DELAY_MS
+    );
+  }
+};
+
+// src/node/workerd-manager.ts
+import { spawn } from "child_process";
+import { copyFile, mkdir as mkdir2, writeFile as writeFile2 } from "fs/promises";
+import { homedir as homedir4 } from "os";
+import { basename, join as join5 } from "path";
+var WORKERD_DIR = join5(homedir4(), ".zam-node", "workerd");
+var DEFAULT_PORT = 8787;
+var WorkerdManager = class {
+  process = null;
+  workers = /* @__PURE__ */ new Map();
+  port;
+  workerdBinary;
+  configDir;
+  constructor(opts) {
+    this.port = opts?.port ?? DEFAULT_PORT;
+    this.workerdBinary = opts?.workerdBinary ?? "workerd";
+    this.configDir = opts?.configDir ?? WORKERD_DIR;
+  }
+  /** Start the workerd process with current config. */
+  async start() {
+    await this.generateConfig();
+    await this.spawnWorkerd();
+  }
+  /** Stop the workerd process. */
+  async stop() {
+    if (!this.process) return;
+    return new Promise((resolve) => {
+      const proc = this.process;
+      if (!proc) {
+        resolve();
+        return;
+      }
+      const killTimer = setTimeout(() => {
+        proc.kill("SIGKILL");
+      }, 5e3);
+      proc.once("exit", () => {
+        clearTimeout(killTimer);
+        this.process = null;
+        resolve();
+      });
+      proc.kill("SIGTERM");
+    });
+  }
+  /** Deploy a ZAM worker: add to config and restart workerd. */
+  async deployWorker(zamId, bundlePath, capabilityLevel) {
+    this.workers.set(zamId, { zamId, bundlePath, capabilityLevel });
+    await this.restart();
+  }
+  /** Remove a ZAM worker and restart workerd. */
+  async removeWorker(zamId) {
+    this.workers.delete(zamId);
+    await this.restart();
+  }
+  /** Get list of currently loaded ZAM IDs. */
+  getLoadedZamIds() {
+    return [...this.workers.keys()];
+  }
+  /** Check if workerd process is running. */
+  isRunning() {
+    return this.process !== null && this.process.exitCode === null;
+  }
+  /** Execute a request against a loaded worker via HTTP. */
+  async executeRequest(zamId, method, headers, body) {
+    if (!this.workers.has(zamId)) {
+      return {
+        status: 404,
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ error: `ZAM ${zamId} not loaded` })
+      };
+    }
+    try {
+      const response = await fetch(`http://127.0.0.1:${this.port}/`, {
+        method,
+        headers: {
+          ...headers,
+          "x-zam-worker": zamId
+        },
+        body: method !== "GET" ? body : void 0,
+        signal: AbortSignal.timeout(5e3)
+      });
+      const responseBody = await response.text();
+      const responseHeaders = {};
+      response.headers.forEach((v, k) => {
+        responseHeaders[k] = v;
+      });
+      return {
+        status: response.status,
+        headers: responseHeaders,
+        body: responseBody
+      };
+    } catch (err) {
+      return {
+        status: 502,
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+          error: err instanceof Error ? err.message : "workerd execution failed"
+        })
+      };
+    }
+  }
+  // --- Private helpers ---
+  async restart() {
+    await this.stop();
+    await this.generateConfig();
+    if (this.workers.size > 0) {
+      await this.spawnWorkerd();
+    }
+  }
+  async generateConfig() {
+    await mkdir2(this.configDir, { recursive: true });
+    await mkdir2(join5(this.configDir, "workers"), { recursive: true });
+    const workerEntries = [];
+    const serviceEntries = [];
+    const routerBindings = [];
+    for (const [zamId, worker] of this.workers) {
+      const safeName = `z${zamId.replace(/-/g, "")}`;
+      const localBundleName = `${zamId.replace(/-/g, "_")}.js`;
+      await copyFile(
+        worker.bundlePath,
+        join5(this.configDir, "workers", localBundleName)
+      );
+      serviceEntries.push(
+        `  (name = "${safeName}", worker = .${safeName}Worker),`
+      );
+      const networkConfig = worker.capabilityLevel === "L0" ? '  globalOutbound = "denied",' : "";
+      workerEntries.push(`
+const ${safeName}Worker :Workerd.Worker = (
+  compatibilityDate = "2024-01-01",
+  modules = [
+    (name = "index.js", esModule = embed "workers/${localBundleName}"),
+  ],
+${networkConfig}
+);`);
+      routerBindings.push(
+        `    (name = "${safeName}", service = "${safeName}"),`
+      );
+    }
+    const routerCode = `export default {
+  async fetch(request, env) {
+    const zamId = request.headers.get("x-zam-worker");
+    if (!zamId) {
+      return new Response(JSON.stringify({ error: "Missing x-zam-worker header" }), {
+        status: 400,
+        headers: { "content-type": "application/json" }
+      });
+    }
+    const safeName = "z" + zamId.replace(/-/g, "");
+    const service = env[safeName];
+    if (!service) {
+      return new Response(JSON.stringify({ error: "ZAM not loaded: " + zamId }), {
+        status: 404,
+        headers: { "content-type": "application/json" }
+      });
+    }
+    return service.fetch(request);
+  }
+};`;
+    await writeFile2(join5(this.configDir, "router.js"), routerCode);
+    const hasL0Workers = [...this.workers.values()].some(
+      (w) => w.capabilityLevel === "L0"
+    );
+    const denyServiceEntry = hasL0Workers ? '  (name = "denied", network = .denyAllNetwork),' : "";
+    const denyNetworkConst = hasL0Workers ? `
+const denyAllNetwork :Workerd.Network = (
+  allow = [],
+  deny = ["public", "private", "local", "network"],
+);` : "";
+    const config = `using Workerd = import "/workerd/workerd.capnp";
+
+const config :Workerd.Config = (
+  services = [
+    (name = "router", worker = .routerWorker),
+${denyServiceEntry}
+${serviceEntries.join("\n")}
+  ],
+  sockets = [
+    (name = "http", address = "127.0.0.1:${this.port}", http = (), service = "router"),
+  ],
+);
+
+const routerWorker :Workerd.Worker = (
+  compatibilityDate = "2024-01-01",
+  modules = [
+    (name = "router.js", esModule = embed "router.js"),
+  ],
+  bindings = [
+${routerBindings.join("\n")}
+  ],
+);
+${workerEntries.join("\n")}
+${denyNetworkConst}
+`;
+    await writeFile2(join5(this.configDir, "config.capnp"), config);
+  }
+  async spawnWorkerd() {
+    const configPath = join5(this.configDir, "config.capnp");
+    return new Promise((resolve, reject) => {
+      const proc = spawn(
+        this.workerdBinary,
+        ["serve", basename(configPath), "--verbose"],
+        {
+          cwd: this.configDir,
+          stdio: ["ignore", "pipe", "pipe"]
+        }
+      );
+      this.process = proc;
+      let started = false;
+      const startTimeout = setTimeout(() => {
+        if (!started) {
+          started = true;
+          if (proc.exitCode === null) {
+            resolve();
+          } else {
+            reject(
+              new Error(
+                `workerd did not start within 3s (exit: ${proc.exitCode})`
+              )
+            );
+          }
+        }
+      }, 3e3);
+      proc.stderr?.on("data", (data) => {
+        const line = data.toString();
+        if (!started && (line.includes("listening") || line.includes("ready"))) {
+          started = true;
+          clearTimeout(startTimeout);
+          resolve();
+        }
+      });
+      proc.on("error", (err) => {
+        clearTimeout(startTimeout);
+        this.process = null;
+        if (!started) {
+          started = true;
+          reject(new Error(`Failed to start workerd: ${err.message}`));
+        }
+      });
+      proc.on("exit", (code) => {
+        this.process = null;
+        if (!started) {
+          started = true;
+          clearTimeout(startTimeout);
+          reject(new Error(`workerd exited with code ${code}`));
+        }
+      });
+    });
+  }
+};
+
+// src/commands/node.ts
+var nodeCommand = (apiKey, apiUrl) => {
+  const cmd = new Command8("node").description(
+    "Run a ZAM node to serve activations from your machine"
+  );
+  cmd.command("start").description(
+    "Start a ZAM node: connects to the platform via WebSocket tunnel and serves activations"
+  ).option("-n, --name <name>", "Node name", "my-node").option("--node-id <id>", "Existing node ID (skip registration)").option("-p, --port <port>", "workerd listen port", "8787").option("--workerd <path>", "Path to workerd binary", "workerd").option(
+    "--runtime <runtime>",
+    "Runtime: workerd (sandboxed) or builtin (direct)",
+    "workerd"
+  ).action(async (opts) => {
+    if (!apiKey) {
+      log10.error(
+        "API key required. Run `zam config` or set ZAM_API_KEY env var."
+      );
+      process.exitCode = 1;
+      return;
+    }
+    const s = spinner7();
+    const runtime = opts.runtime ?? "workerd";
+    const port = opts.port ?? 8787;
+    let nodeId = opts.nodeId;
+    if (!nodeId) {
+      s.start("Registering node...");
+      try {
+        const res = await fetch(`${apiUrl}/v1/nodes`, {
+          method: "POST",
+          headers: {
+            "content-type": "application/json",
+            "x-zam-api-key": apiKey
+          },
+          body: JSON.stringify({ name: opts.name ?? "my-node" })
+        });
+        if (!res.ok) {
+          const body2 = await res.json().catch(() => ({}));
+          throw new Error(
+            body2.error ?? `HTTP ${res.status}`
+          );
+        }
+        const body = await res.json();
+        nodeId = body.id;
+        s.stop(`Node registered: ${nodeId}`);
+      } catch (err) {
+        s.stop("Failed to register node");
+        log10.error(err instanceof Error ? err.message : "Registration failed");
+        process.exitCode = 1;
+        return;
+      }
+    } else {
+      log10.info(`Using existing node: ${nodeId}`);
+    }
+    const bundleManager = new BundleManager();
+    const workerdManager = runtime === "workerd" ? new WorkerdManager({
+      port: Number(port),
+      workerdBinary: opts.workerd ?? "workerd"
+    }) : null;
+    const loadedZams = /* @__PURE__ */ new Set();
+    const tunnel = new TunnelClient({
+      apiUrl,
+      apiKey,
+      nodeId,
+      version: "1.0.0",
+      log: (msg) => log10.info(`[tunnel] ${msg}`),
+      onConnected: () => {
+        tunnel.sendCapabilities(
+          runtime === "workerd" ? "workerd" : "builtin",
+          [...loadedZams]
+        );
+      },
+      onDisconnected: (_code, _reason) => {
+      },
+      onAuthError: (message) => {
+        log10.error(`Authentication failed: ${message}`);
+        log10.error("Check your API key and node ID. Exiting.");
+        process.exit(1);
+      },
+      onRequest: async (req) => {
+        const zamId = req.headers["x-zam-worker-id"];
+        if (!zamId) {
+          return {
+            status: 400,
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({
+              error: "Missing x-zam-worker-id header"
+            })
+          };
+        }
+        if (workerdManager && runtime === "workerd") {
+          return workerdManager.executeRequest(
+            zamId,
+            req.method,
+            req.headers,
+            req.body
+          );
+        }
+        return {
+          status: 501,
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({
+            error: "No runtime available for this ZAM"
+          })
+        };
+      },
+      onDeploy: async (msg) => {
+        log10.info(
+          `[deploy] ZAM ${msg.zamId} v${msg.bundleVersion} (${msg.capabilityLevel})`
+        );
+        try {
+          const hasCached = await bundleManager.hasCached(
+            msg.zamId,
+            msg.bundleVersion
+          );
+          let bundlePath;
+          if (hasCached) {
+            bundlePath = bundleManager.bundlePath(
+              msg.zamId,
+              msg.bundleVersion
+            );
+            log10.info(`[deploy] Using cached bundle for ${msg.zamId}`);
+          } else {
+            log10.info(`[deploy] Downloading bundle for ${msg.zamId}...`);
+            bundlePath = await bundleManager.download(
+              msg.bundleUrl,
+              msg.bundleSha256,
+              msg.zamId,
+              msg.bundleVersion,
+              apiKey,
+              {
+                signature: msg.signature,
+                capabilityLevel: msg.capabilityLevel,
+                resourceLimits: msg.resourceLimits
+              }
+            );
+            log10.info(`[deploy] Bundle saved to ${bundlePath}`);
+          }
+          if (workerdManager) {
+            await workerdManager.deployWorker(
+              msg.zamId,
+              bundlePath,
+              msg.capabilityLevel
+            );
+            log10.info(`[deploy] workerd reloaded with ${msg.zamId}`);
+          }
+          loadedZams.add(msg.zamId);
+          tunnel.sendCapabilities(
+            runtime === "workerd" ? "workerd" : "builtin",
+            [...loadedZams]
+          );
+          return { success: true };
+        } catch (err) {
+          const error = err instanceof Error ? err.message : "Deploy failed";
+          log10.error(`[deploy] Failed: ${error}`);
+          return { success: false, error };
+        }
+      },
+      onUndeploy: async (zamId) => {
+        log10.info(`[undeploy] Removing ZAM ${zamId}`);
+        loadedZams.delete(zamId);
+        if (workerdManager) {
+          await workerdManager.removeWorker(zamId);
+        }
+        tunnel.sendCapabilities(
+          runtime === "workerd" ? "workerd" : "builtin",
+          [...loadedZams]
+        );
+      }
+    });
+    log10.info(`Starting ZAM node (runtime: ${runtime})...`);
+    tunnel.connect();
+    const shutdown = async () => {
+      log10.info("Shutting down...");
+      tunnel.disconnect();
+      if (workerdManager) {
+        await workerdManager.stop();
+      }
+      process.exit(0);
+    };
+    process.on("SIGINT", shutdown);
+    process.on("SIGTERM", shutdown);
+    await new Promise(() => {
+    });
+  });
+  return cmd;
+};
+
+// src/commands/openapi.ts
+import { log as log11, spinner as spinner8 } from "@clack/prompts";
+import { Command as Command9 } from "commander";
+var openapiCommand = (client2) => new Command9("openapi").description("Display the API's OpenAPI specification").option("--raw", "Output raw JSON").action(async (options) => {
+  const s = spinner8();
+  s.start("Fetching OpenAPI spec...");
+  try {
+    const spec = await client2.getOpenApiSpec();
+    s.stop("OpenAPI spec loaded");
+    if (options.raw) {
+      console.log(JSON.stringify(spec, null, 2));
+      return;
+    }
+    const info = spec.info;
+    if (info) {
+      log11.info(`${info.title ?? "API"} v${info.version ?? "?"}`);
+    }
+    const paths = spec.paths;
+    if (!paths) {
+      log11.info("No paths found in spec.");
+      return;
+    }
+    const methods = ["get", "post", "put", "patch", "delete"];
+    const rows = [];
+    for (const [path, pathItem] of Object.entries(paths)) {
+      for (const method of methods) {
+        const operation = pathItem[method];
+        if (!operation) continue;
+        const summary = operation.summary ?? operation.description ?? "";
+        rows.push(
+          `  ${method.toUpperCase().padEnd(7)} ${path.padEnd(35)} ${summary}`
+        );
+      }
+    }
+    log11.info(`Endpoints (${rows.length}):
+
+${rows.join("\n")}`);
+  } catch (err) {
+    s.stop("Failed to fetch OpenAPI spec");
+    log11.error(err instanceof Error ? err.message : "Unknown error");
+    process.exitCode = 1;
+  }
+});
+
+// src/commands/orders.ts
+import { log as log12, spinner as spinner9 } from "@clack/prompts";
+import { Command as Command10 } from "commander";
+var ordersCommand = (client2, apiKey) => new Command10("orders").description("View orders").addCommand(
+  new Command10("list").description("List your orders").option("--json", "Output as JSON").action(async (opts) => {
+    requireAuth(apiKey);
+    const s = spinner9();
+    if (!opts.json) s.start("Fetching orders...");
+    try {
+      const orders = await client2.listOrders();
+      if (opts.json) {
+        process.stdout.write(`${JSON.stringify(orders, null, 2)}
+`);
+        return;
+      }
+      s.stop(`Found ${orders.length} order(s)`);
+      if (orders.length === 0) {
+        log12.info("No orders found.");
+        return;
+      }
+      for (const o of orders) {
+        log12.info(formatOrderSummary(o));
+      }
+    } catch (err) {
+      if (!opts.json) s.stop("Failed to fetch orders");
+      log12.error(err instanceof Error ? err.message : "Unknown error");
+      process.exitCode = 1;
+    }
+  })
+).addCommand(
+  new Command10("get").description("Get order details").argument("<id>", "Order ID").option("--json", "Output as JSON").action(async (id, opts) => {
+    requireAuth(apiKey);
+    const s = spinner9();
+    if (!opts.json) s.start("Fetching order...");
+    try {
+      const order = await client2.getOrder(id);
+      if (opts.json) {
+        process.stdout.write(`${JSON.stringify(order, null, 2)}
+`);
+        return;
+      }
+      s.stop("Order found");
+      log12.info(formatOrderDetail(order));
+    } catch (err) {
+      if (!opts.json) s.stop("Failed to fetch order");
+      log12.error(err instanceof Error ? err.message : "Unknown error");
+      process.exitCode = 1;
+    }
+  })
+);
+
+// src/commands/preflight.ts
+import { log as log13, spinner as spinner10 } from "@clack/prompts";
+import { Command as Command11 } from "commander";
+var preflightCommand = (client2, apiKey) => new Command11("preflight").description(
+  "Run a preflight check against a ZAM (validate input, get dynamic price quote)"
+).argument("<identifier>", "ZAM ZID, UUID, or slug (e.g. ZPXXXX, send-sms)").option("--request-body <json>", "Request body as JSON string").option(
+  "--commit",
+  "Automatically commit the preflight and execute the order"
+).option(
+  "--timeout <seconds>",
+  "Polling timeout for commit (default: 10)",
+  String(DEFAULT_TIMEOUT_S)
+).action(
+  async (identifier, options) => {
+    requireAuth(apiKey);
+    let requestBody;
+    if (options.requestBody) {
+      try {
+        requestBody = JSON.parse(options.requestBody);
+      } catch {
+        log13.error("Invalid JSON for --request-body");
+        process.exitCode = 1;
+        return;
+      }
+    }
+    const s = spinner10();
+    s.start("Running preflight check...");
+    try {
+      const result = await client2.createPreflight(identifier, requestBody);
+      if (!result.accepted) {
+        s.stop("Preflight rejected");
+        log13.error(`Reason: ${result.reason}`);
+        process.exitCode = 1;
+        return;
+      }
+      s.stop("Preflight accepted");
+      log13.info(
+        [
+          `Order ID:        ${result.orderId}`,
+          `Quoted Price:    ${formatMicrodollars(result.price.amountMicrodollars)}`,
+          `Expires At:      ${result.expiresAt}`,
+          `Preflight Token: ${result.preflightToken}`
+        ].join("\n")
+      );
+      if (!options.commit) {
+        log13.info(
+          `
+To execute this order, run this command again with --commit, or use the API:
+  zam preflight ${identifier} --request-body '...' --commit
+  # Or via API: POST /v1/orders with {"preflightToken": "${result.preflightToken}"}`
+        );
+        return;
+      }
+      s.start("Committing order...");
+      const order = await client2.commitPreflight(result.preflightToken);
+      s.stop(`Order committed: ${order.id} [${order.orderState}]`);
+      if (order.orderState === "pending" || order.orderState === "running") {
+        const timeoutS = Number.parseInt(
+          options.timeout ?? String(DEFAULT_TIMEOUT_S),
+          10
+        );
+        s.start("Waiting for result...");
+        const deadline = Date.now() + timeoutS * 1e3;
+        let current = order;
+        while (Date.now() < deadline) {
+          await new Promise((r) => setTimeout(r, 1e3));
+          current = await client2.getOrder(order.id);
+          if (current.orderState === "completed" || current.orderState === "failed") {
+            break;
+          }
+        }
+        if (current.orderState === "completed") {
+          s.stop("Order completed!");
+        } else if (current.orderState === "failed") {
+          s.stop("Order failed");
+        } else {
+          s.stop(
+            `Order still ${current.orderState}. Check: zam orders get ${order.id}`
+          );
+        }
+        log13.info(formatOrderDetail(current));
+        if (current.orderState === "failed") {
+          process.exitCode = 1;
+        }
+      } else {
+        log13.info(formatOrderDetail(order));
+        if (order.orderState === "failed") {
+          process.exitCode = 1;
+        }
+      }
+    } catch (err) {
+      s.stop("Preflight failed");
+      log13.error(err instanceof Error ? err.message : "Unknown error");
+      process.exitCode = 1;
+    }
+  }
+);
+
+// src/commands/run.ts
+import { cancel as cancel3, isCancel as isCancel4, log as log14, select, spinner as spinner11 } from "@clack/prompts";
+import { Command as Command12 } from "commander";
+var zamToResult = (z3) => ({
+  id: z3.id,
+  zid: z3.zid,
+  title: z3.title,
+  description: z3.description,
+  source: "zam"
+});
+var capabilityToResult = (c) => ({
+  id: c.zid,
+  zid: c.zid,
+  title: c.name,
+  description: c.description,
+  source: "capability"
+});
+var unifiedToResult = (u) => ({
+  id: u.zid,
+  zid: u.zid,
+  title: u.type === "zam" ? u.title ?? u.name : u.name,
+  description: u.description,
+  source: u.type === "capability" ? "capability" : "zam"
+});
+var runCommand = (client2, apiKey) => new Command12("run").description("Search for a ZAM or Capability and activate it in one step").argument("<query>", "Natural language description of what you need").option("--request-body <json>", "Request body as JSON string").option(
+  "--timeout <seconds>",
+  "Polling timeout in seconds (default: 10)",
+  String(DEFAULT_TIMEOUT_S)
+).option(
+  "--preflight",
+  "Run a preflight check before executing (validates input, gets dynamic price)"
+).option("--json", "Output as JSON").action(
+  async (query, options) => {
+    requireAuth(apiKey);
+    let requestBody;
+    if (options.requestBody) {
+      try {
+        requestBody = JSON.parse(options.requestBody);
+      } catch {
+        log14.error("Invalid JSON for --request-body");
+        process.exitCode = 1;
+        return;
+      }
+    }
+    const timeoutS = Number.parseInt(
+      options.timeout ?? String(DEFAULT_TIMEOUT_S),
+      10
+    );
+    const s = spinner11();
+    if (!options.json) s.start(`Searching for "${query}"...`);
+    let results;
+    try {
+      let usedUnified = false;
+      results = [];
+      try {
+        const unified = await client2.unifiedSearch({ query });
+        results = unified.results.map(unifiedToResult);
+        usedUnified = true;
+      } catch (err) {
+        if (err instanceof ApiError && err.status === 404) {
+        } else {
+          throw err;
+        }
+      }
+      if (!usedUnified) {
+        const [zams, capabilities] = await Promise.all([
+          client2.searchZams({ query }),
+          client2.searchCapabilities(query).catch(() => [])
+        ]);
+        for (const cap of capabilities) {
+          results.push(capabilityToResult(cap));
+        }
+        for (const zam of zams) {
+          results.push(zamToResult(zam));
+        }
+      }
+    } catch (err) {
+      if (!options.json) s.stop("Search failed");
+      log14.error(err instanceof Error ? err.message : "Unknown error");
+      process.exitCode = 1;
+      return;
+    }
+    if (results.length === 0) {
+      if (!options.json) s.stop("No results found");
+      if (!options.json) {
+        log14.warning(
+          `No ZAMs matched "${query}". Try a broader search with: zam search`
+        );
+      }
+      if (options.json) {
+        process.stdout.write(
+          JSON.stringify({ error: "No results found", query }, null, 2) + "\n"
+        );
+      }
+      process.exitCode = 1;
+      return;
+    }
+    if (!options.json) s.stop(`Found ${results.length} result(s)`);
+    let chosen;
+    if (results.length === 1) {
+      chosen = results[0];
+      if (!options.json)
+        log14.info(
+          `Activating: ${chosen.title} (${chosen.zid ?? chosen.id})`
+        );
+    } else if (!options.json && process.stdout.isTTY) {
+      const selection = await select({
+        message: "Multiple results found. Which one?",
+        options: results.map((r) => ({
+          value: r,
+          label: r.source === "capability" ? `${r.title} (Capability)` : r.title,
+          hint: r.zid ?? r.id
+        }))
+      });
+      if (isCancel4(selection)) {
+        cancel3("Cancelled.");
+        process.exit(0);
+      }
+      chosen = selection;
+    } else {
+      chosen = results[0];
+      if (!options.json)
+        log14.info(
+          `Auto-selected: ${chosen.title} (${chosen.zid ?? chosen.id})`
+        );
+    }
+    const identifier = chosen.zid ?? chosen.id;
+    const { order, activateResponse, success, errorMessage } = await activateAndPoll(client2, identifier, requestBody, timeoutS, {
+      preflight: options.preflight,
+      json: options.json
+    });
+    if (options.json) {
+      const output = {};
+      if (order) output.order = order;
+      if (activateResponse?.fulfilledBy) {
+        output.fulfilledBy = activateResponse.fulfilledBy;
+      }
+      if (activateResponse?.suggestions) {
+        output.suggestions = activateResponse.suggestions;
+      }
+      if (!order && !success) {
+        output.error = errorMessage ?? "Activation failed";
+      }
+      process.stdout.write(`${JSON.stringify(output, null, 2)}
+`);
+    }
+    if (!success) {
+      process.exitCode = 1;
+    }
+  }
+);
+
+// src/commands/search.ts
+import { cancel as cancel4, isCancel as isCancel5, log as log15, spinner as spinner12, text as text3 } from "@clack/prompts";
+import { Command as Command13 } from "commander";
+var zamToResult2 = (z3) => ({
+  id: z3.id,
+  zid: z3.zid,
+  title: z3.title,
+  description: z3.description,
+  category: z3.category,
+  price: z3.price,
+  tags: z3.tags,
+  runContract: z3.runContract,
+  source: "zam"
+});
+var capabilityToZam = (c) => ({
+  id: c.zid,
+  zid: c.zid,
+  title: c.name,
+  description: c.description,
+  category: null,
+  price: null,
+  tags: null,
+  runContract: c.inputSchema ? {
+    method: "POST",
+    inputSchema: c.inputSchema,
+    outputSchema: c.outputSchema
+  } : null,
+  source: "capability"
+});
+var unifiedToZamResult = (u) => ({
+  id: u.zid,
+  zid: u.zid,
+  title: u.type === "zam" ? u.title ?? u.name : u.name,
+  description: u.description,
+  category: null,
+  price: u.price ?? null,
+  tags: null,
+  runContract: u.inputSchema ? { method: "POST", inputSchema: u.inputSchema } : null,
+  source: u.type === "capability" ? "capability" : "zam"
+});
+var getRequiredFields = (rc) => {
+  const schema = rc?.inputSchema;
+  if (!schema) return null;
+  const props = schema.properties;
+  if (!props) return null;
+  const required = schema.required ?? [];
+  if (required.length > 0) return required;
+  return Object.keys(props).length > 0 ? Object.keys(props) : null;
+};
+var formatZamResult = (z3, showSchema) => {
+  const sourceLabel = z3.source === "capability" ? z3.memberCount ? `${z3.memberCount} ZAM${z3.memberCount !== 1 ? "s" : ""} in Capability` : "Capability" : "ZAM";
+  const price = formatPrice(z3.price);
+  const tags = z3.tags?.join(", ") ?? "";
+  const catPart = z3.category ? `Category: ${z3.category} | ` : "";
+  const fields = getRequiredFields(z3.runContract);
+  const fieldHint = fields ? `  Fields: ${fields.join(", ")}
+` : "";
+  let output = `${z3.title} (${sourceLabel}) ${z3.zid ?? z3.id}
+  ${catPart}Price: ${price}
+` + fieldHint + (tags ? `  Tags: ${tags}
+` : "") + (z3.description ? `  ${z3.description}` : "");
+  if (showSchema && z3.runContract) {
+    output += `
+${formatRunContract(z3.runContract)}`;
+  }
+  return output;
+};
+var searchCommand = (client2) => new Command13("search").description("Search the ZeroClick Marketplace").argument("[query]", "Search query").option("--category <category>", "Filter by category").option("--show-schema", "Show input/output schemas for each result").option("--json", "Output results as JSON (machine-readable)").action(
+  async (queryArg, options) => {
+    const query = queryArg ?? await (async () => {
+      const v = await text3({
+        message: "Search query (leave empty to list all):",
+        defaultValue: ""
+      });
+      if (isCancel5(v)) {
+        cancel4("Cancelled.");
+        process.exit(0);
+      }
+      return v || void 0;
+    })();
+    const s = spinner12();
+    if (!options.json) s.start("Searching...");
+    try {
+      let results = [];
+      const useUnified = !options.category;
+      let usedUnified = false;
+      if (useUnified) {
+        try {
+          const unified = await client2.unifiedSearch({ query });
+          results = unified.results.map(unifiedToZamResult);
+          usedUnified = true;
+        } catch (err) {
+          if (err instanceof ApiError && err.status === 404) {
+          } else {
+            throw err;
+          }
+        }
+      }
+      if (!usedUnified) {
+        const [zams, capabilities] = await Promise.all([
+          client2.searchZams({
+            query,
+            category: options.category
+          }),
+          query ? client2.searchCapabilities(query).catch(() => []) : Promise.resolve([])
+        ]);
+        for (const cap of capabilities) {
+          results.push(capabilityToZam(cap));
+        }
+        for (const zam of zams) {
+          results.push(zamToResult2(zam));
+        }
+      }
+      if (!options.json) s.stop(`Found ${results.length} result(s)`);
+      if (results.length === 0) {
+        if (!options.json) log15.info("No results found.");
+        if (options.json)
+          process.stdout.write(`${JSON.stringify([], null, 2)}
+`);
+        return;
+      }
+      if (options.json) {
+        process.stdout.write(`${JSON.stringify(results, null, 2)}
+`);
+        return;
+      }
+      for (const r of results) {
+        log15.info(formatZamResult(r, options.showSchema));
+      }
+    } catch (err) {
+      if (!options.json) s.stop("Search failed");
+      log15.error(err instanceof Error ? err.message : "Unknown error");
+      process.exitCode = 1;
+    }
+  }
+);
+
+// src/commands/wallet-create.ts
+import { log as log16, spinner as spinner13 } from "@clack/prompts";
+import { Command as Command14 } from "commander";
+
+// src/pow-solver.ts
+import { createHash as createHash3 } from "crypto";
+var solvePow = (challenge, difficulty) => {
+  let nonce = 0;
+  while (true) {
+    const nonceStr = nonce.toString(16);
+    const hash = createHash3("sha256").update(challenge + nonceStr).digest();
+    if (countLeadingZeroBits(hash) >= difficulty) {
+      return nonceStr;
+    }
+    nonce++;
+  }
+};
+var countLeadingZeroBits = (buf) => {
+  let bits = 0;
+  for (const byte of buf) {
+    if (byte === 0) {
+      bits += 8;
+    } else {
+      bits += Math.clz32(byte) - 24;
+      break;
+    }
+  }
+  return bits;
+};
+
+// src/commands/wallet-create.ts
+var walletCreateCommand = (baseUrl, saveConfig2) => new Command14("create").description("Create a new ZAM wallet").option("--name <name>", "Set a display name for the wallet").action(async (opts) => {
+  const s = spinner13();
+  try {
+    s.start("Fetching challenge...");
+    const challengeRes = await fetch(`${baseUrl}/v1/wallets/challenge`);
+    if (!challengeRes.ok) {
+      s.stop("Failed to fetch challenge");
+      const body = await challengeRes.json().catch(() => ({}));
+      log16.error(
+        body.error ?? `HTTP ${challengeRes.status}`
+      );
+      process.exitCode = 1;
+      return;
+    }
+    const { challengeId, challenge, difficulty } = await challengeRes.json();
+    s.stop("Challenge received");
+    s.start("Solving proof of work...");
+    const nonce = solvePow(challenge, difficulty);
+    s.stop("Proof of work solved");
+    s.start("Creating wallet...");
+    const createRes = await fetch(`${baseUrl}/v1/wallets`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        challengeId,
+        nonce,
+        ...opts.name ? { displayName: opts.name } : {}
+      })
+    });
+    if (!createRes.ok) {
+      s.stop("Failed to create wallet");
+      const body = await createRes.json().catch(() => ({}));
+      log16.error(
+        body.error ?? `HTTP ${createRes.status}`
+      );
+      process.exitCode = 1;
+      return;
+    }
+    const { address, apiKey, recoveryPhrase } = await createRes.json();
+    saveConfig2({ apiKey });
+    s.stop("Wallet created!");
+    log16.success(`Address: ${address}`);
+    log16.warn(
+      `SAVE YOUR RECOVERY PHRASE \u2014 you will not see it again:
+
+  ${recoveryPhrase}
+`
+    );
+    log16.info("API key saved to ~/.zam/config.v2.json");
+  } catch (err) {
+    s.stop("Error");
+    log16.error(
+      err instanceof Error ? err.message : "Failed to create wallet"
+    );
+    process.exitCode = 1;
+  }
+});
+
+// src/commands/wallet-fund.ts
+import { log as log17, spinner as spinner14 } from "@clack/prompts";
+import { Command as Command15 } from "commander";
+var walletFundCommand = (client2) => new Command15("fund").description("Fund your wallet via Coinbase Onramp").option("-a, --amount <amount>", "Amount in USD to pre-fill").action(async (opts) => {
+  try {
+    const amount = opts.amount ? Number.parseFloat(opts.amount) : void 0;
+    if (amount !== void 0 && (Number.isNaN(amount) || amount <= 0)) {
+      log17.error("Amount must be a positive number");
+      process.exitCode = 1;
+      return;
+    }
+    log17.info("Creating funding session...");
+    const { sessionId, onrampUrl } = await client2.createFundingSession(amount);
+    log17.info("Opening Coinbase Onramp in your browser...");
+    log17.info(`URL: ${onrampUrl}`);
+    const { spawn: spawn2 } = await import("child_process");
+    const [cmd, args] = process.platform === "darwin" ? ["open", [onrampUrl]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", onrampUrl]] : ["xdg-open", [onrampUrl]];
+    spawn2(cmd, args, {
+      stdio: "ignore",
+      detached: true
+    }).unref();
+    const s = spinner14();
+    s.start("Waiting for funding to complete...");
+    let done = false;
+    while (!done) {
+      await new Promise((resolve) => setTimeout(resolve, 5e3));
+      try {
+        const status = await client2.checkFundingStatus(sessionId);
+        if (status.status === "completed") {
+          s.stop("Funding completed!");
+          const usd = status.amountMicrodollars ? `$${(Number(BigInt(status.amountMicrodollars)) / 1e6).toFixed(2)} USD` : "";
+          log17.success(`Wallet funded with ${usd}`);
+          const wallet = await client2.getWalletInfo();
+          log17.info(
+            `New balance: $${(Number(BigInt(wallet.balanceMicrodollars)) / 1e6).toFixed(2)} USD`
+          );
+          done = true;
+        } else if (status.status === "failed") {
+          s.stop("Funding failed");
+          log17.error(status.failureReason ?? "Unknown failure reason");
+          process.exitCode = 1;
+          done = true;
+        }
+      } catch {
+      }
+    }
+  } catch (err) {
+    log17.error(
+      err instanceof Error ? err.message : "Failed to create funding session"
+    );
+    process.exitCode = 1;
+  }
+});
+
+// src/commands/wallet-info.ts
+import { log as log18 } from "@clack/prompts";
+import { Command as Command16 } from "commander";
+var walletInfoCommand = (client2) => new Command16("info").description("Show wallet info").action(async () => {
+  try {
+    const wallet = await client2.getWalletInfo();
+    const { apiKey } = getEffectiveConfig();
+    if (wallet.displayName) {
+      log18.info(`Name:     ${wallet.displayName}`);
+    }
+    log18.info(`Address:  ${wallet.address}`);
+    log18.info(`Balance:  ${formatBalance(wallet.balanceMicrodollars)}`);
+    log18.info(`API Key:  ${apiKey ?? "(not set)"}`);
+    log18.info(`Created:  ${wallet.createdAt}`);
+  } catch (err) {
+    log18.error(
+      err instanceof Error ? err.message : "Failed to fetch wallet info"
+    );
+    process.exitCode = 1;
+  }
+});
+var formatBalance = (microdollars) => {
+  const usd = Number(BigInt(microdollars)) / 1e6;
+  return `$${usd.toFixed(2)} USD`;
+};
+
+// src/commands/wallet-recover.ts
+import { log as log19, spinner as spinner15, text as text4 } from "@clack/prompts";
+import { Command as Command17 } from "commander";
+var walletRecoverCommand = (baseUrl, saveConfig2) => new Command17("recover").description("Recover wallet access with recovery phrase").action(async () => {
+  const phrase = await text4({
+    message: "Enter your 12-word recovery phrase:"
+  });
+  if (typeof phrase !== "string") {
+    return;
+  }
+  const s = spinner15();
+  s.start("Recovering wallet...");
+  try {
+    const res = await fetch(`${baseUrl}/v1/wallets/recover`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ recoveryPhrase: phrase.trim() })
+    });
+    if (!res.ok) {
+      s.stop("Recovery failed");
+      const body = await res.json().catch(() => ({}));
+      log19.error(body.error ?? `HTTP ${res.status}`);
+      process.exitCode = 1;
+      return;
+    }
+    const { apiKey } = await res.json();
+    saveConfig2({ apiKey });
+    s.stop("Wallet recovered!");
+    log19.success("New API key saved to ~/.zam/config.v2.json");
+    log19.info("All previous API keys have been revoked.");
+  } catch (err) {
+    s.stop("Error");
+    log19.error(err instanceof Error ? err.message : "Recovery failed");
+    process.exitCode = 1;
+  }
+});
+
+// src/commands/wallet-update.ts
+import { log as log20 } from "@clack/prompts";
+import { Command as Command18 } from "commander";
+var walletUpdateCommand = (client2) => new Command18("update").description("Update wallet profile").option("--name <name>", "Set display name").option("--clear-name", "Clear display name").action(async (opts) => {
+  try {
+    if (!opts.name && !opts.clearName) {
+      log20.error("Provide --name <name> or --clear-name");
+      process.exitCode = 1;
+      return;
+    }
+    const displayName = opts.clearName ? null : opts.name ?? null;
+    const wallet = await client2.updateWalletProfile({ displayName });
+    if (wallet.displayName) {
+      log20.success(`Display name set to "${wallet.displayName}"`);
+    } else {
+      log20.success("Display name cleared");
+    }
+  } catch (err) {
+    log20.error(
+      err instanceof Error ? err.message : "Failed to update profile"
+    );
+    process.exitCode = 1;
+  }
+});
+
+// src/commands/zams.ts
+import {
+  cancel as cancel5,
+  confirm as confirm3,
+  isCancel as isCancel6,
+  log as log21,
+  select as select2,
+  spinner as spinner16,
+  text as text5
+} from "@clack/prompts";
+import { Command as Command19 } from "commander";
+
+// src/crawl-contract.ts
+import { z as z2 } from "zod";
+var serviceContractDataSchema = z2.object({
+  title: z2.string().min(1),
+  description: z2.string().optional(),
+  category: z2.string().optional(),
+  tags: z2.array(z2.string()).optional(),
+  listingState: z2.enum(["draft", "published"]).optional(),
+  price: z2.object({
+    currency: z2.literal("USD"),
+    amountMicrodollars: z2.number(),
+    unit: z2.string()
+  }).optional(),
+  runContract: z2.object({
+    method: z2.enum(["GET", "POST", "PUT", "PATCH", "DELETE"]),
+    endpointPath: z2.string(),
+    inputSchema: z2.record(z2.string(), z2.unknown()).optional(),
+    outputSchema: z2.record(z2.string(), z2.unknown()).optional(),
+    requestExampleJson: z2.string().optional(),
+    responseExampleJson: z2.string().optional(),
+    maxExecutionTimeMs: z2.number().optional(),
+    healthEndpoint: z2.string().url().optional()
+  })
+});
+var serviceContractSchema = z2.object({
+  provider: serviceContractDataSchema.optional(),
+  listing: serviceContractDataSchema.optional()
+}).refine((data) => data.provider || data.listing, {
+  message: 'Contract must include a "provider" or "listing" key with service details'
+}).transform((data) => {
+  const provider = data.provider ?? data.listing;
+  if (!provider) throw new Error("unreachable");
+  return { provider };
+});
+var CRAWL_TIMEOUT_MS = 3e4;
+var normalizeServiceUrl = (serviceUrl) => {
+  const base = serviceUrl.replace(/\/+$/, "").replace(/\/contract$/, "");
+  return `${base}/contract`;
+};
+var crawlServiceContract = async (serviceUrl) => {
+  const contractUrl = normalizeServiceUrl(serviceUrl);
+  let response;
+  try {
+    response = await fetch(contractUrl, {
+      method: "GET",
+      headers: { accept: "application/json" },
+      signal: AbortSignal.timeout(CRAWL_TIMEOUT_MS)
+    });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Unknown network error";
+    throw new Error(`Failed to reach service: ${message}`);
+  }
+  if (!response.ok) {
+    throw new Error(`Service returned HTTP ${response.status}`);
+  }
+  let body;
+  try {
+    body = await response.json();
+  } catch {
+    throw new Error("Service returned non-JSON response");
+  }
+  const parsed = serviceContractSchema.safeParse(body);
+  if (!parsed.success) {
+    const paths = parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ");
+    throw new Error(`Invalid contract response from ${contractUrl}: ${paths}`);
+  }
+  return parsed.data;
+};
+
+// src/commands/zams.ts
+var zamsCommand = (client2, apiKey) => new Command19("zams").description("Manage your ZAMs").addCommand(
+  new Command19("list").description("List your ZAMs").option("--json", "Output as JSON").action(async (opts) => {
+    requireAuth(apiKey);
+    const s = spinner16();
+    if (!opts.json) s.start("Fetching ZAMs...");
+    try {
+      const providers = await client2.listProviders();
+      if (opts.json) {
+        process.stdout.write(`${JSON.stringify(providers, null, 2)}
+`);
+        return;
+      }
+      s.stop(`Found ${providers.length} ZAM(s)`);
+      if (providers.length === 0) {
+        log21.info("No ZAMs found.");
+        return;
+      }
+      for (const p of providers) {
+        log21.info(formatProviderSummary(p));
+      }
+    } catch (err) {
+      if (!opts.json) s.stop("Failed to fetch ZAMs");
+      log21.error(err instanceof Error ? err.message : "Unknown error");
+      process.exitCode = 1;
+    }
+  })
+).addCommand(
+  new Command19("get").description("Get ZAM details").argument("<id>", "ZAM ID").option("--json", "Output as JSON").action(async (id, opts) => {
+    requireAuth(apiKey);
+    const s = spinner16();
+    if (!opts.json) s.start("Fetching ZAM...");
+    try {
+      const provider = await client2.getProvider(id);
+      const memberships = await client2.getZamCapabilities(id).catch(() => []);
+      if (opts.json) {
+        process.stdout.write(
+          `${JSON.stringify({ ...provider, capabilities: memberships }, null, 2)}
+`
+        );
+        return;
+      }
+      s.stop("ZAM found");
+      log21.info(formatProviderDetail(provider));
+      if (memberships.length > 0) {
+        log21.info(`
+Capabilities (${memberships.length}):`);
+        for (const m of memberships) {
+          log21.info(
+            `  ${m.capabilityName}  ${m.capabilityZid}  [${m.membershipStatus}]` + (m.joinedAt ? `  joined ${new Date(m.joinedAt).toLocaleDateString("en-US", { year: "numeric", month: "short", day: "numeric" })}` : "")
+          );
+        }
+      }
+    } catch (err) {
+      if (!opts.json) s.stop("Failed to fetch ZAM");
+      log21.error(err instanceof Error ? err.message : "Unknown error");
+      process.exitCode = 1;
+    }
+  })
+).addCommand(
+  new Command19("create").description("Create a new ZAM").option("--json", "Output as JSON").option("--title <title>", "ZAM title").option("--description <desc>", "ZAM description").option("--endpoint <url>", "Endpoint URL").option("--method <method>", "HTTP method (default: POST)").option("--tags <tags>", "Comma-separated tags").option("--category <category>", "Category").option("--capability-intent <zid>", "Capability intent ZID").option("--input-schema <json>", "Input schema as JSON string").option("--output-schema <json>", "Output schema as JSON string").action(
+    async (opts) => {
+      requireAuth(apiKey);
+      const title = opts.title ?? await (async () => {
+        const v = await text5({
+          message: "Title:",
+          validate: (val) => val.length > 0 ? void 0 : "Title is required"
+        });
+        if (isCancel6(v)) {
+          cancel5("Cancelled.");
+          process.exit(0);
+        }
+        return v;
+      })();
+      const description = opts.description ?? await (async () => {
+        const v = await text5({
+          message: "Description (optional):",
+          defaultValue: ""
+        });
+        if (isCancel6(v)) {
+          cancel5("Cancelled.");
+          process.exit(0);
+        }
+        return v;
+      })();
+      const category = opts.category ?? await (async () => {
+        const v = await text5({
+          message: "Category (optional):",
+          defaultValue: ""
+        });
+        if (isCancel6(v)) {
+          cancel5("Cancelled.");
+          process.exit(0);
+        }
+        return v;
+      })();
+      const tagsRaw = opts.tags ?? await (async () => {
+        const v = await text5({
+          message: "Tags (comma-separated, optional):",
+          defaultValue: ""
+        });
+        if (isCancel6(v)) {
+          cancel5("Cancelled.");
+          process.exit(0);
+        }
+        return v;
+      })();
+      const tags = tagsRaw ? tagsRaw.split(",").map((t) => t.trim()).filter(Boolean) : void 0;
+      const endpointUrl = opts.endpoint ?? await (async () => {
+        const v = await text5({
+          message: "Endpoint URL (optional):",
+          defaultValue: "",
+          placeholder: "https://your-api.com/run"
+        });
+        if (isCancel6(v)) {
+          cancel5("Cancelled.");
+          process.exit(0);
+        }
+        return v;
+      })();
+      let runContract;
+      if (endpointUrl) {
+        const methodValue = opts.method ? opts.method.toUpperCase() : await (async () => {
+          const v = await select2({
+            message: "HTTP method:",
+            initialValue: "POST",
+            options: [
+              { value: "GET", label: "GET" },
+              { value: "POST", label: "POST" },
+              { value: "PUT", label: "PUT" },
+              { value: "PATCH", label: "PATCH" },
+              { value: "DELETE", label: "DELETE" }
+            ]
+          });
+          if (isCancel6(v)) {
+            cancel5("Cancelled.");
+            process.exit(0);
+          }
+          return v;
+        })();
+        let inputSchema;
+        if (opts.inputSchema) {
+          try {
+            inputSchema = JSON.parse(opts.inputSchema);
+          } catch {
+            log21.error("Invalid JSON for --input-schema");
+            process.exitCode = 1;
+            return;
+          }
+        }
+        let outputSchema;
+        if (opts.outputSchema) {
+          try {
+            outputSchema = JSON.parse(opts.outputSchema);
+          } catch {
+            log21.error("Invalid JSON for --output-schema");
+            process.exitCode = 1;
+            return;
+          }
+        }
+        runContract = {
+          method: methodValue,
+          endpointPath: endpointUrl,
+          ...inputSchema && { inputSchema },
+          ...outputSchema && { outputSchema }
+        };
+      }
+      const s = spinner16();
+      if (!opts.json) s.start("Creating ZAM...");
+      try {
+        const provider = await client2.createProvider({
+          title,
+          description: description || void 0,
+          category: category || void 0,
+          tags,
+          runContract,
+          capabilityIntent: opts.capabilityIntent
+        });
+        if (opts.json) {
+          process.stdout.write(`${JSON.stringify(provider, null, 2)}
+`);
+          return;
+        }
+        s.stop("ZAM created");
+        log21.success(formatProviderDetail(provider));
+        if (provider.providerState === "pending_review") {
+          log21.info(
+            "ZAM submitted for review. It will be published after passing safety and classification checks."
+          );
+        }
+      } catch (err) {
+        if (!opts.json) s.stop("Failed to create ZAM");
+        log21.error(err instanceof Error ? err.message : "Unknown error");
+        process.exitCode = 1;
+      }
+    }
+  )
+).addCommand(
+  new Command19("create-from-service").description("Create a ZAM by crawling a service URL").argument(
+    "<url>",
+    "Service base URL (e.g. https://my-service.example.com)"
+  ).option("--json", "Output as JSON").option("-y, --yes", "Skip confirmation prompt").action(
+    async (url, opts) => {
+      requireAuth(apiKey);
+      const s = spinner16();
+      if (!opts.json) s.start("Crawling service contract...");
+      try {
+        const contract = await crawlServiceContract(url);
+        if (!opts.json) s.stop("Contract fetched");
+        const { provider: svc } = contract;
+        if (!opts.json) {
+          log21.info(
+            `Title: ${svc.title}
+` + (svc.description ? `  Description: ${svc.description.slice(0, 100)}${svc.description.length > 100 ? "..." : ""}
+` : "") + (svc.category ? `  Category: ${svc.category}
+` : "") + (svc.runContract?.endpointPath ? `  Endpoint: ${svc.runContract.method} ${svc.runContract.endpointPath}
+` : "")
+          );
+        }
+        if (!opts.json && !opts.yes) {
+          const confirmed = await confirm3({
+            message: "Create ZAM from this contract?"
+          });
+          if (isCancel6(confirmed) || !confirmed) {
+            cancel5("Cancelled.");
+            return;
+          }
+        }
+        if (!opts.json) s.start("Creating ZAM...");
+        const provider = await client2.createProvider({
+          title: svc.title,
+          description: svc.description,
+          category: svc.category,
+          tags: svc.tags,
+          price: svc.price,
+          runContract: svc.runContract
+        });
+        if (opts.json) {
+          process.stdout.write(`${JSON.stringify(provider, null, 2)}
+`);
+          return;
+        }
+        s.stop("ZAM created");
+        log21.success(formatProviderDetail(provider));
+        if (provider.providerState === "pending_review") {
+          log21.info(
+            "ZAM submitted for review. It will be published after passing safety and classification checks."
+          );
+        }
+      } catch (err) {
+        if (!opts.json) s.stop("Failed to create ZAM from service");
+        log21.error(err instanceof Error ? err.message : "Unknown error");
+        process.exitCode = 1;
+      }
+    }
+  )
+).addCommand(
+  // Update only exposes title/description/category/state — structural
+  // changes (runContract, tags) require creating a new ZAM.
+  new Command19("update").description("Update a ZAM").argument("<id>", "ZAM ID").option("--json", "Output as JSON").option("--title <title>", "New title").option("--description <desc>", "New description").option("--category <category>", "New category").option("--tags <tags>", "Comma-separated tags").option(
+    "--state <state>",
+    "New state (pending_review, published, paused, archived)"
+  ).action(
+    async (id, opts) => {
+      requireAuth(apiKey);
+      const hasFlags = opts.title !== void 0 || opts.description !== void 0 || opts.category !== void 0 || opts.tags !== void 0 || opts.state !== void 0;
+      let titleVal;
+      let descriptionVal;
+      let categoryVal;
+      let stateVal;
+      if (hasFlags) {
+        titleVal = opts.title;
+        descriptionVal = opts.description;
+        categoryVal = opts.category;
+        stateVal = opts.state;
+      } else {
+        const fetchSpinner = spinner16();
+        fetchSpinner.start("Fetching current ZAM...");
+        let current;
+        try {
+          current = await client2.getProvider(id);
+          fetchSpinner.stop("ZAM loaded");
+        } catch (err) {
+          fetchSpinner.stop("Failed to fetch ZAM");
+          log21.error(err instanceof Error ? err.message : "Unknown error");
+          process.exitCode = 1;
+          return;
+        }
+        const titleInput = await text5({
+          message: "Title:",
+          defaultValue: current.title
+        });
+        if (isCancel6(titleInput)) {
+          cancel5("Cancelled.");
+          process.exit(0);
+        }
+        titleVal = titleInput;
+        const descInput = await text5({
+          message: "Description:",
+          defaultValue: current.description ?? ""
+        });
+        if (isCancel6(descInput)) {
+          cancel5("Cancelled.");
+          process.exit(0);
+        }
+        descriptionVal = descInput || void 0;
+        const catInput = await text5({
+          message: "Category:",
+          defaultValue: current.category ?? ""
+        });
+        if (isCancel6(catInput)) {
+          cancel5("Cancelled.");
+          process.exit(0);
+        }
+        categoryVal = catInput || void 0;
+        const stateOptions = [
+          {
+            value: "pending_review",
+            label: "Pending Review"
+          },
+          { value: "published", label: "Published" },
+          { value: "paused", label: "Paused" },
+          { value: "archived", label: "Archived" }
+        ];
+        const stateInput = await select2({
+          message: "State:",
+          initialValue: stateOptions.find(
+            (o) => o.value === current.providerState
+          )?.value,
+          options: stateOptions
+        });
+        if (isCancel6(stateInput)) {
+          cancel5("Cancelled.");
+          process.exit(0);
+        }
+        stateVal = stateInput;
+      }
+      const updatePayload = {};
+      if (titleVal !== void 0) updatePayload.title = titleVal;
+      if (descriptionVal !== void 0)
+        updatePayload.description = descriptionVal;
+      if (categoryVal !== void 0) updatePayload.category = categoryVal;
+      if (opts.tags !== void 0) {
+        updatePayload.tags = opts.tags.split(",").map((t) => t.trim()).filter(Boolean);
+      }
+      if (stateVal !== void 0) updatePayload.providerState = stateVal;
+      const s = spinner16();
+      if (!opts.json) s.start("Updating ZAM...");
+      try {
+        const updated = await client2.updateProvider(
+          id,
+          updatePayload
+        );
+        if (opts.json) {
+          process.stdout.write(`${JSON.stringify(updated, null, 2)}
+`);
+          return;
+        }
+        s.stop("ZAM updated");
+        log21.success(formatProviderDetail(updated));
+      } catch (err) {
+        if (!opts.json) s.stop("Failed to update ZAM");
+        log21.error(err instanceof Error ? err.message : "Unknown error");
+        process.exitCode = 1;
+      }
+    }
+  )
+).addCommand(
+  new Command19("get-secret").description("Check whether a signing secret exists for a ZAM").argument("<id>", "ZAM ID").action(async (id) => {
+    requireAuth(apiKey);
+    const s = spinner16();
+    s.start("Checking signing secret...");
+    try {
+      const result = await client2.getSigningSecret(id);
+      s.stop("Signing secret checked");
+      log21.info(`Secret exists: ${result.hasSecret ? "yes" : "no"}`);
+    } catch (err) {
+      s.stop("Failed to check signing secret");
+      log21.error(err instanceof Error ? err.message : "Unknown error");
+      process.exitCode = 1;
+    }
+  })
+).addCommand(
+  new Command19("rotate-secret").description("Rotate the signing secret for a ZAM").argument("<id>", "ZAM ID").action(async (id) => {
+    requireAuth(apiKey);
+    const confirmed = await confirm3({
+      message: "This will invalidate the old signing secret. Continue?"
+    });
+    if (isCancel6(confirmed) || !confirmed) {
+      cancel5("Cancelled.");
+      return;
+    }
+    const s = spinner16();
+    s.start("Rotating signing secret...");
+    try {
+      const result = await client2.rotateSigningSecret(id);
+      s.stop("Signing secret rotated");
+      log21.success(`New Signing Secret: ${result.signingSecret}`);
+    } catch (err) {
+      s.stop("Failed to rotate signing secret");
+      log21.error(err instanceof Error ? err.message : "Unknown error");
+      process.exitCode = 1;
+    }
+  })
+).addCommand(
+  new Command19("delete").description("Delete a ZAM").argument("<id>", "ZAM ID").option("--json", "Output as JSON").option("-y, --yes", "Skip confirmation prompt").action(async (id, opts) => {
+    requireAuth(apiKey);
+    if (!opts.json && !opts.yes) {
+      const confirmed = await confirm3({
+        message: `Delete ZAM ${id}?`
+      });
+      if (isCancel6(confirmed) || !confirmed) {
+        cancel5("Cancelled.");
+        return;
+      }
+    }
+    const s = spinner16();
+    if (!opts.json) s.start("Deleting ZAM...");
+    try {
+      await client2.deleteProvider(id);
+      if (opts.json) {
+        process.stdout.write(
+          `${JSON.stringify({ deleted: true, id }, null, 2)}
+`
+        );
+        return;
+      }
+      s.stop("ZAM deleted");
+      log21.success(`ZAM ${id} deleted.`);
+    } catch (err) {
+      if (!opts.json) s.stop("Failed to delete ZAM");
+      log21.error(err instanceof Error ? err.message : "Unknown error");
+      process.exitCode = 1;
+    }
+  })
+).addCommand(
+  new Command19("capabilities").description("List capability memberships for a ZAM").argument("<id>", "ZAM ID").option("--json", "Output as JSON").action(async (id, opts) => {
+    requireAuth(apiKey);
+    const s = spinner16();
+    if (!opts.json) s.start("Fetching capability memberships...");
+    try {
+      const memberships = await client2.getZamCapabilities(id);
+      if (opts.json) {
+        process.stdout.write(`${JSON.stringify(memberships, null, 2)}
+`);
+        return;
+      }
+      s.stop(`Found ${memberships.length} capability membership(s)`);
+      if (memberships.length === 0) {
+        log21.info("This ZAM is not a member of any capabilities.");
+        return;
+      }
+      for (const m of memberships) {
+        log21.info(
+          `${m.capabilityName}  ${m.capabilityZid}  [${m.membershipStatus}]` + (m.joinedAt ? `  joined ${new Date(m.joinedAt).toLocaleDateString("en-US", { year: "numeric", month: "short", day: "numeric" })}` : "")
+        );
+      }
+    } catch (err) {
+      if (!opts.json) s.stop("Failed to fetch capability memberships");
+      log21.error(err instanceof Error ? err.message : "Unknown error");
+      process.exitCode = 1;
+    }
+  })
+);
+
+// src/version-check.ts
+import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "fs";
+import { dirname as dirname4, join as join6 } from "path";
+var CACHE_TTL_MS = 4 * 60 * 60 * 1e3;
+var REGISTRY_URL = "https://registry.npmjs.org/@zeroclickai%2fzam-cli/latest";
+var FETCH_TIMEOUT_MS = 3e3;
+var getCacheFile = () => join6(
+  process.env.HOME ?? process.env.USERPROFILE ?? ".",
+  ".zam",
+  "version-check.json"
+);
+var readCache = () => {
+  try {
+    const cacheFile = getCacheFile();
+    if (!existsSync4(cacheFile)) return null;
+    const raw = JSON.parse(readFileSync4(cacheFile, "utf-8"));
+    if (typeof raw.latestVersion === "string" && typeof raw.checkedAt === "number") {
+      return raw;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+};
+var writeCache = (latestVersion) => {
+  try {
+    const cacheFile = getCacheFile();
+    const cacheDir = dirname4(cacheFile);
+    if (!existsSync4(cacheDir)) {
+      mkdirSync3(cacheDir, { recursive: true });
+    }
+    const data = { latestVersion, checkedAt: Date.now() };
+    writeFileSync4(cacheFile, JSON.stringify(data));
+  } catch {
+  }
+};
+var isNewer = (current, latest) => {
+  const parse = (v) => v.replace(/-.*$/, "").split(".").map(Number);
+  const c = parse(current);
+  const l = parse(latest);
+  for (let i = 0; i < 3; i++) {
+    const cv = c[i] ?? 0;
+    const lv = l[i] ?? 0;
+    if (lv !== cv) return lv > cv;
+  }
+  return false;
+};
+var checkForUpdate = async (currentVersion) => {
+  try {
+    const envVal = process.env.ZAM_UPDATE_CHECK?.toLowerCase();
+    if (envVal === "off" || envVal === "false" || envVal === "0") return null;
+    const cached = readCache();
+    if (cached && Date.now() - cached.checkedAt < CACHE_TTL_MS) {
+      return isNewer(currentVersion, cached.latestVersion) ? cached.latestVersion : null;
+    }
+    const res = await fetch(REGISTRY_URL, {
+      signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
+    });
+    if (!res.ok) return null;
+    const data = await res.json();
+    const latest = data.version;
+    if (!latest) return null;
+    writeCache(latest);
+    return isNewer(currentVersion, latest) ? latest : null;
+  } catch {
+    return null;
+  }
+};
+var printUpdateNotice = (currentVersion, latestVersion) => {
+  const updateCmd = detectUpdateCommand();
+  console.error(
+    `
+  Update available: ${currentVersion} \u2192 ${latestVersion}
+  Run \`${updateCmd}\` to update
+`
+  );
+};
+var detectUpdateCommand = () => {
+  const execPath = process.argv[1] ?? "";
+  if (execPath.includes(".pnpm") || execPath.includes("pnpm"))
+    return "pnpm add -g @zeroclickai/zam-cli@latest";
+  if (execPath.includes("yarn"))
+    return "yarn global add @zeroclickai/zam-cli@latest";
+  return "npm i -g @zeroclickai/zam-cli@latest";
+};
+
+// src/index.ts
+var { version } = package_default;
+var main = async () => {
+  printTelemetryNotice();
+  const updateCheckPromise = checkForUpdate(version);
+  const program = new Command20().name("zam").description("ZeroClick Marketplace CLI").version(version).exitOverride();
+  const effectiveConfig = getEffectiveConfig();
+  const client2 = createApiClient({
+    baseUrl: effectiveConfig.apiUrl,
+    apiKey: effectiveConfig.apiKey
+  });
+  const walletCmd = new Command20("wallet").description("Wallet management");
+  walletCmd.addCommand(walletCreateCommand(effectiveConfig.apiUrl, saveConfig));
+  walletCmd.addCommand(
+    walletRecoverCommand(effectiveConfig.apiUrl, saveConfig)
+  );
+  walletCmd.addCommand(walletInfoCommand(client2));
+  walletCmd.addCommand(walletUpdateCommand(client2));
+  walletCmd.addCommand(walletFundCommand(client2));
+  program.addCommand(walletCmd);
+  const authCmd = new Command20("auth").description("Authentication");
+  authCmd.addCommand(authApproveCommand(client2, effectiveConfig.apiKey));
+  program.addCommand(authCmd);
+  program.addCommand(zamsCommand(client2, effectiveConfig.apiKey));
+  program.addCommand(capabilitiesCommand(client2));
+  program.addCommand(configCommand());
+  program.addCommand(searchCommand(client2));
+  program.addCommand(ordersCommand(client2, effectiveConfig.apiKey));
+  program.addCommand(activateCommand(client2, effectiveConfig.apiKey));
+  program.addCommand(inspectCommand(client2));
+  program.addCommand(preflightCommand(client2, effectiveConfig.apiKey));
+  program.addCommand(runCommand(client2, effectiveConfig.apiKey));
+  program.addCommand(apiKeysCommand(client2, effectiveConfig.apiKey));
+  program.addCommand(openapiCommand(client2));
+  program.addCommand(agentsCommand());
+  program.addCommand(
+    nodeCommand(effectiveConfig.apiKey, effectiveConfig.apiUrl)
+  );
+  const args = process.argv.slice(2);
+  const commandName = args.filter((a) => !a.startsWith("-")).join(" ") || "help";
+  trackCommand(commandName);
+  await program.parseAsync(process.argv);
+  await shutdownTelemetry();
+  const latestVersion = await updateCheckPromise;
+  if (latestVersion) {
+    printUpdateNotice(version, latestVersion);
+  }
+};
+main().catch(async (err) => {
+  if (err?.exitCode === 0) {
+    await shutdownTelemetry();
+    return;
+  }
+  const args = process.argv.slice(2);
+  const commandName = args.filter((a) => !a.startsWith("-")).join(" ") || "unknown";
+  trackError(
+    commandName,
+    err instanceof Error ? err.message : "Unexpected error"
+  );
+  await shutdownTelemetry();
+  if (!process.exitCode) {
+    log22.error(err instanceof Error ? err.message : "Unexpected error");
+    process.exitCode = 1;
+  }
+});