zk-agent-cli 0.1.0-beta.6 → 0.1.0-beta.7

package/dist/index.js

@@ -10409,7 +10409,10 @@ function buildNextHelpText() {
   return [
     "",
     "Use `next` as the product entrypoint:",
-    "  Fresh operator routing:",
+    "  Fresh local-first routing:",
+    "    zk-agent setup",
+    "    zk-agent next",
+    "    zk-agent wallet create --await-local",
     "    zk-agent next",
     "",
     "  Continue a stored workflow checkpoint:",
@@ -10418,6 +10421,9 @@ function buildNextHelpText() {
     "  Stay on the wallet layer only when you need wallet-specific remediation:",
     "    zk-agent wallet next --name main",
     "",
+    "  Switch to the hosted remote-approval path only when the browser is not colocated:",
+    "    zk-agent wallet --help",
+    "",
     "  Stay on the workflow layer only when you already have an explicit workflow or checkpoint:",
     "    zk-agent workflow next --request-id <id>"
   ].join("\n");
@@ -11829,21 +11835,155 @@ import { Command as Command8 } from "commander";
 // src/lib/relay.ts
 import { createServer } from "node:http";
 import fs7 from "node:fs";
-import path6 from "node:path";
+import path7 from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
+
+// src/lib/http.ts
+import { spawn } from "node:child_process";
+import { mkdtemp, readFile as readFile2, rm as rm2 } from "node:fs/promises";
+import os2 from "node:os";
+import path6 from "node:path";
+function isDnsResolutionFailure(error) {
+  if (!error || typeof error !== "object") {
+    return false;
+  }
+  const cause = "cause" in error ? error.cause : void 0;
+  if (!cause || typeof cause !== "object") {
+    return false;
+  }
+  const code = "code" in cause ? cause.code : void 0;
+  return code === "ENOTFOUND" || code === "EAI_AGAIN";
+}
+function isHttpUrl(value) {
+  return value.startsWith("http://") || value.startsWith("https://");
+}
+function parseCurlHeaders(rawHeaders) {
+  const blocks = rawHeaders.replace(/\r\n/g, "\n").split(/\n{2,}/).map((block) => block.trim()).filter((block) => block.startsWith("HTTP/"));
+  const lastBlock = blocks.at(-1);
+  if (!lastBlock) {
+    throw new Error("curl fallback did not emit an HTTP response header block.");
+  }
+  const [statusLine, ...headerLines] = lastBlock.split("\n");
+  const status = Number.parseInt(statusLine.split(/\s+/)[1] || "", 10);
+  if (!Number.isInteger(status)) {
+    throw new Error(`curl fallback emitted an invalid status line: ${statusLine}`);
+  }
+  const headers = new Headers();
+  for (const line of headerLines) {
+    const separator = line.indexOf(":");
+    if (separator <= 0) continue;
+    const key = line.slice(0, separator).trim();
+    const value = line.slice(separator + 1).trim();
+    if (key) {
+      headers.append(key, value);
+    }
+  }
+  return { status, headers };
+}
+async function runCurlRequest(url, options) {
+  const tempDir = await mkdtemp(path6.join(os2.tmpdir(), "zk-agent-http-"));
+  const headersPath = path6.join(tempDir, "headers.txt");
+  const bodyPath = path6.join(tempDir, "body.txt");
+  try {
+    const args = [
+      "--silent",
+      "--show-error",
+      "--output",
+      bodyPath,
+      "--dump-header",
+      headersPath,
+      "--request",
+      options.method || "GET"
+    ];
+    if (options.redirect === "follow") {
+      args.push("--location");
+    }
+    for (const [key, value] of Object.entries(options.headers || {})) {
+      args.push("--header", `${key}: ${value}`);
+    }
+    if (typeof options.body === "string") {
+      args.push("--data-raw", options.body);
+    }
+    args.push(url);
+    const child = spawn("curl", args, {
+      env: process.env,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.setEncoding("utf8");
+    child.stderr.setEncoding("utf8");
+    child.stdout.on("data", (chunk) => {
+      stdout += chunk;
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk;
+    });
+    const exitCode = await new Promise((resolve, reject) => {
+      child.once("error", reject);
+      child.once("close", resolve);
+    });
+    if (exitCode !== 0) {
+      throw new Error(stderr.trim() || stdout.trim() || `curl exited with code ${exitCode}`);
+    }
+    const [rawHeaders, body] = await Promise.all([
+      readFile2(headersPath, "utf8"),
+      readFile2(bodyPath, "utf8")
+    ]);
+    const { status, headers } = parseCurlHeaders(rawHeaders);
+    return {
+      ok: status >= 200 && status < 300,
+      status,
+      headers,
+      body
+    };
+  } finally {
+    await rm2(tempDir, { recursive: true, force: true });
+  }
+}
+async function fetchTextWithFallback(url, options = {}) {
+  try {
+    const response = await fetch(url, {
+      method: options.method,
+      headers: options.headers,
+      body: options.body,
+      redirect: options.redirect
+    });
+    return {
+      ok: response.ok,
+      status: response.status,
+      headers: response.headers,
+      body: await response.text()
+    };
+  } catch (error) {
+    if (!isHttpUrl(url) || !isDnsResolutionFailure(error)) {
+      throw error;
+    }
+    return await runCurlRequest(url, options);
+  }
+}
+async function fetchJsonWithFallback(url, options = {}) {
+  const response = await fetchTextWithFallback(url, options);
+  return {
+    ...response,
+    json: JSON.parse(response.body)
+  };
+}
+
+// src/lib/relay.ts
 var RELAY_BODY_LIMIT_BYTES = 1024 * 1024;
 var RELAY_SERVICE = "zk-agent-relay";
 var RELAY_PROTOCOL = "zk-agent-session-relay";
 var RELAY_SCHEMA_VERSION = 1;
 function relayDir() {
-  const directory = path6.join(storageDir(), "relay");
+  const directory = path7.join(storageDir(), "relay");
   if (!fs7.existsSync(directory)) {
     fs7.mkdirSync(directory, { recursive: true, mode: 448 });
   }
   return directory;
 }
 function relayRecordPath(requestId) {
-  return path6.join(relayDir(), `${requestId}.json`);
+  return path7.join(relayDir(), `${requestId}.json`);
 }
 function writeRelayRecord(record) {
   fs7.writeFileSync(relayRecordPath(record.request_id), JSON.stringify(record, null, 2), {
@@ -11925,14 +12065,14 @@ function writeBody(response, statusCode, contentType, value, extraHeaders = {})
 }
 function resolveConnectorUiDistRoot() {
   const currentFile = fileURLToPath3(import.meta.url);
-  const currentDir2 = path6.dirname(currentFile);
+  const currentDir2 = path7.dirname(currentFile);
   const candidates = [
-    path6.resolve(currentDir2, "./connector-ui"),
-    path6.resolve(currentDir2, "../../../zk-connector-ui/dist"),
-    path6.resolve(currentDir2, "../../zk-connector-ui/dist")
+    path7.resolve(currentDir2, "./connector-ui"),
+    path7.resolve(currentDir2, "../../../zk-connector-ui/dist"),
+    path7.resolve(currentDir2, "../../zk-connector-ui/dist")
   ];
   for (const candidate of candidates) {
-    if (fs7.existsSync(path6.join(candidate, "index.html"))) {
+    if (fs7.existsSync(path7.join(candidate, "index.html"))) {
       return candidate;
     }
   }
@@ -11961,7 +12101,7 @@ function relayCapabilities(connectorUiAvailable) {
     ...connectorUiAvailable ? ["connector-ui"] : []
   ];
 }
-function relayHealthResponse(bindBaseUrl, publicBaseUrl, connectorUiAvailable) {
+function relayHealthResponse(bindBaseUrl, publicBaseUrl, connectorUiAvailable, publicOriginSource) {
   return {
     ok: true,
     service: RELAY_SERVICE,
@@ -11970,6 +12110,7 @@ function relayHealthResponse(bindBaseUrl, publicBaseUrl, connectorUiAvailable) {
     relay_mode: "local-file",
     origin: normalizeRelayBaseUrl(bindBaseUrl),
     public_origin: normalizeRelayBaseUrl(publicBaseUrl),
+    public_origin_source: publicOriginSource,
     connector_ui_available: connectorUiAvailable,
     capabilities: relayCapabilities(connectorUiAvailable)
   };
@@ -11984,31 +12125,34 @@ function relayApprovalUrl(baseUrl, requestId) {
   return `${relayStatusUrl(baseUrl, requestId)}/approval`;
 }
 async function publishRelayRequest(baseUrl, body) {
-  const response = await fetch(`${normalizeRelayBaseUrl(baseUrl)}/api/requests`, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/json"
-    },
-    body: JSON.stringify(body)
-  });
+  const response = await fetchJsonWithFallback(
+    `${normalizeRelayBaseUrl(baseUrl)}/api/requests`,
+    {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify(body)
+    }
+  );
   if (!response.ok) {
     throw new Error(`Relay publish failed with status ${response.status}`);
   }
-  return await response.json();
+  return response.json;
 }
 async function fetchRelayStatus(baseUrl, requestId) {
-  const response = await fetch(relayStatusUrl(baseUrl, requestId));
+  const response = await fetchJsonWithFallback(relayStatusUrl(baseUrl, requestId));
   if (!response.ok) {
     throw new Error(`Relay status fetch failed with status ${response.status}`);
   }
-  return await response.json();
+  return response.json;
 }
 async function fetchRelayHealth(baseUrl) {
-  const response = await fetch(`${normalizeRelayBaseUrl(baseUrl)}/health`);
+  const response = await fetchJsonWithFallback(`${normalizeRelayBaseUrl(baseUrl)}/health`);
   if (!response.ok) {
     throw new Error(`Relay health fetch failed with status ${response.status}`);
   }
-  return await response.json();
+  return response.json;
 }
 function sleep(ms) {
   return new Promise((resolve) => {
@@ -12033,15 +12177,16 @@ async function waitForRelayApprovalReady(baseUrl, requestId, options) {
   );
 }
 async function fetchRelayApproval(baseUrl, requestId) {
-  const response = await fetch(relayApprovalUrl(baseUrl, requestId));
+  const response = await fetchJsonWithFallback(relayApprovalUrl(baseUrl, requestId));
   if (!response.ok) {
     throw new Error(`Relay approval fetch failed with status ${response.status}`);
   }
-  return await response.json();
+  return response.json;
 }
 async function startRelayServer(options) {
   const uiDistRoot = resolveConnectorUiDistRoot();
   let bindBaseUrl = "";
+  const publicOriginSource = options.publicOrigin?.trim() ? "configured" : "bind-origin-default";
   const server = createServer(async (request, response) => {
     try {
       const requestUrl = new URL(request.url || "/", "http://localhost");
@@ -12056,7 +12201,12 @@ async function startRelayServer(options) {
         writeJson2(
           response,
           200,
-          relayHealthResponse(bindBaseUrl, publicBaseUrl, Boolean(uiDistRoot))
+          relayHealthResponse(
+            bindBaseUrl,
+            publicBaseUrl,
+            Boolean(uiDistRoot),
+            publicOriginSource
+          )
         );
         return;
       }
@@ -12125,7 +12275,7 @@ async function startRelayServer(options) {
       }
       if (method === "GET" && uiDistRoot) {
         const relativePath = pathname === "/" ? "/index.html" : pathname;
-        const filePath = path6.resolve(uiDistRoot, `.${relativePath}`);
+        const filePath = path7.resolve(uiDistRoot, `.${relativePath}`);
         if (!filePath.startsWith(uiDistRoot)) {
           writeJson2(response, 403, { error: "Forbidden path" });
           return;
@@ -12134,7 +12284,7 @@ async function startRelayServer(options) {
           writeBody(response, 200, contentTypeFor(filePath), fs7.readFileSync(filePath));
           return;
         }
-        const indexPath = path6.join(uiDistRoot, "index.html");
+        const indexPath = path7.join(uiDistRoot, "index.html");
         if (fs7.existsSync(indexPath)) {
           writeBody(response, 200, "text/html; charset=utf-8", fs7.readFileSync(indexPath));
           return;
@@ -12181,8 +12331,14 @@ async function startRelayServer(options) {
 // src/commands/relay.ts
 function buildRelayServeRecommendedCommands(relayUrl) {
   return {
-    createWallet: `zk-agent wallet create --relay-url ${relayUrl}`,
-    reapproveWallet: `zk-agent wallet reapprove --name main --relay-url ${relayUrl}`
+    createWallet: `zk-agent wallet create --relay-url ${relayUrl} --wait-relay --prompt-code`,
+    reapproveWallet: `zk-agent wallet reapprove --name main --relay-url ${relayUrl} --wait-relay --prompt-code`
+  };
+}
+function buildAdvertisedRelayBases(publicOrigin) {
+  return {
+    shareLinkBaseUrl: `${publicOrigin}/r`,
+    statusApiBaseUrl: `${publicOrigin}/api/requests`
   };
 }
 function isRecord3(value) {
@@ -12198,6 +12354,9 @@ function isRelayCapability(value) {
     "connector-ui"
   ].includes(String(value));
 }
+function isRelayPublicOriginSource(value) {
+  return value === "configured" || value === "bind-origin-default";
+}
 function asRelayHealthResponse(value) {
   if (!isRecord3(value)) return null;
   if (value.ok !== true) return null;
@@ -12207,6 +12366,9 @@ function asRelayHealthResponse(value) {
   if (value.relay_mode !== "local-file") return null;
   if (typeof value.origin !== "string") return null;
   if (typeof value.public_origin !== "string") return null;
+  if (typeof value.public_origin_source !== "undefined" && !isRelayPublicOriginSource(value.public_origin_source)) {
+    return null;
+  }
   if (typeof value.connector_ui_available !== "boolean") return null;
   if (!Array.isArray(value.capabilities) || !value.capabilities.every(isRelayCapability)) {
     return null;
@@ -12225,6 +12387,29 @@ function relayPublicOriginLooksLocal(origin) {
     return false;
   }
 }
+function normalizeComparableRelayUrl(value) {
+  try {
+    return new URL(value).toString().replace(/\/+$/, "");
+  } catch {
+    return null;
+  }
+}
+function relayUrlMatches(left, right) {
+  const normalizedLeft = normalizeComparableRelayUrl(left);
+  const normalizedRight = right ? normalizeComparableRelayUrl(right) : null;
+  if (normalizedLeft === null || normalizedRight === null) {
+    return null;
+  }
+  return normalizedLeft === normalizedRight;
+}
+function inferRelayPublicOriginSource(options) {
+  const normalizedOrigin = options.origin ? normalizeComparableRelayUrl(options.origin) : null;
+  const normalizedPublicOrigin = normalizeComparableRelayUrl(options.publicOrigin);
+  if (!normalizedOrigin || !normalizedPublicOrigin) {
+    return null;
+  }
+  return normalizedOrigin === normalizedPublicOrigin ? "bind-origin-default" : "configured";
+}
 function relayHostedReadinessNotes(options) {
   const notes = [];
   if (!options.compatible) {
@@ -12235,7 +12420,7 @@ function relayHostedReadinessNotes(options) {
   }
   if (relayPublicOriginLooksLocal(options.publicOrigin)) {
     notes.push(
-      "Relay compatibility is present, but the advertised public origin still points at a local-only address. Set --public-origin to the externally reachable URL before using this as a hosted approval path."
+      options.publicOriginSource === "bind-origin-default" ? "Relay compatibility is present, but the relay is still advertising its bind origin as the public origin. Set --public-origin to the externally reachable URL before using this as a hosted approval path." : "Relay compatibility is present, but the advertised public origin still points at a local-only address. Set --public-origin to the externally reachable URL before using this as a hosted approval path."
     );
   }
   if (options.connectorUiAvailable === false) {
@@ -12245,19 +12430,50 @@ function relayHostedReadinessNotes(options) {
   }
   return notes;
 }
+function relayOriginRelationshipNotes(options) {
+  const notes = [];
+  const relayUrlMatchesOrigin = relayUrlMatches(options.relayUrl, options.origin);
+  const relayUrlMatchesPublicOrigin = relayUrlMatches(options.relayUrl, options.publicOrigin);
+  if (relayUrlMatchesOrigin === false) {
+    notes.push(
+      "The inspected relay URL differs from the bind origin reported by /health. That is expected when you inspect a relay through a reverse proxy or tunnel instead of the local bind address."
+    );
+  }
+  if (relayUrlMatchesPublicOrigin === false) {
+    notes.push(
+      "The inspected relay URL differs from the advertised public origin. Share links and wallet approval commands will use the public origin, not the inspected relay URL."
+    );
+  }
+  return notes;
+}
 function buildRelayInspectPayload(relayUrl, rawHealth) {
   const health = asRelayHealthResponse(rawHealth);
   const fallbackPublicOrigin = isRecord3(rawHealth) && typeof rawHealth.public_origin === "string" ? rawHealth.public_origin : relayUrl;
   const publicOrigin = health?.public_origin || fallbackPublicOrigin;
+  const publicOriginSource = health?.public_origin_source || inferRelayPublicOriginSource({
+    origin: health?.origin || null,
+    publicOrigin
+  });
   const compatible = Boolean(health && hasCoreRelayCapabilities(health.capabilities));
   const connectorUiAvailable = health?.connector_ui_available ?? null;
+  const relayUrlMatchesOrigin = relayUrlMatches(relayUrl, health?.origin || null);
+  const relayUrlMatchesPublicOrigin = relayUrlMatches(relayUrl, publicOrigin);
   const publicOriginLooksLocal = relayPublicOriginLooksLocal(publicOrigin);
   const hostedShareRedirectReady = compatible && connectorUiAvailable === true && !publicOriginLooksLocal;
-  const notes = relayHostedReadinessNotes({
-    compatible,
-    publicOrigin,
-    connectorUiAvailable
-  });
+  const { shareLinkBaseUrl, statusApiBaseUrl } = buildAdvertisedRelayBases(publicOrigin);
+  const notes = [
+    ...relayHostedReadinessNotes({
+      compatible,
+      publicOrigin,
+      publicOriginSource,
+      connectorUiAvailable
+    }),
+    ...relayOriginRelationshipNotes({
+      relayUrl,
+      origin: health?.origin || null,
+      publicOrigin
+    })
+  ];
   return {
     ok: true,
     status: "relay-inspected",
@@ -12269,6 +12485,11 @@ function buildRelayInspectPayload(relayUrl, rawHealth) {
     relayMode: health?.relay_mode || null,
     origin: health?.origin || null,
     publicOrigin,
+    publicOriginSource,
+    shareLinkBaseUrl,
+    statusApiBaseUrl,
+    relayUrlMatchesOrigin,
+    relayUrlMatchesPublicOrigin,
     publicOriginLooksLocal,
     connectorUiAvailable,
     hostedShareRedirectReady,
@@ -12294,13 +12515,16 @@ function createRelayCommand() {
       publicOrigin: options.publicOrigin?.trim()
     });
     const publicOrigin = options.publicOrigin?.trim() || server.origin;
+    const publicOriginSource = options.publicOrigin?.trim() ? "configured" : "bind-origin-default";
     const publicOriginLooksLocal = relayPublicOriginLooksLocal(publicOrigin);
     const connectorUiAvailable = server.connectorUiAvailable;
     const hostedShareRedirectReady = connectorUiAvailable && !publicOriginLooksLocal;
+    const { shareLinkBaseUrl, statusApiBaseUrl } = buildAdvertisedRelayBases(publicOrigin);
     const recommendedCommands = buildRelayServeRecommendedCommands(publicOrigin);
     const notes = relayHostedReadinessNotes({
       compatible: true,
       publicOrigin,
+      publicOriginSource,
       connectorUiAvailable
     });
     const payload = {
@@ -12308,6 +12532,9 @@ function createRelayCommand() {
       status: "relay-serving",
       origin: server.origin,
       publicOrigin,
+      publicOriginSource,
+      shareLinkBaseUrl,
+      statusApiBaseUrl,
       publicOriginLooksLocal,
       port: server.port,
       healthUrl: `${server.origin}/health`,
@@ -12334,6 +12561,9 @@ function createRelayCommand() {
       if (publicOrigin !== server.origin) {
         humanLine("public origin", publicOrigin);
       }
+      humanLine("public origin source", publicOriginSource);
+      humanLine("share-link base", shareLinkBaseUrl);
+      humanLine("status api base", statusApiBaseUrl);
       humanLine("health", `${server.origin}/health`);
       humanLine("hosted ready", hostedShareRedirectReady ? "yes" : "no");
       if (connectorUiAvailable !== null) {
@@ -12385,6 +12615,20 @@ function createRelayCommand() {
     if (payload.publicOrigin) {
       humanLine("public origin", payload.publicOrigin);
     }
+    if (payload.publicOriginSource) {
+      humanLine("public origin source", payload.publicOriginSource);
+    }
+    humanLine("share-link base", payload.shareLinkBaseUrl);
+    humanLine("status api base", payload.statusApiBaseUrl);
+    if (payload.relayUrlMatchesOrigin !== null) {
+      humanLine("relay url matches origin", payload.relayUrlMatchesOrigin ? "yes" : "no");
+    }
+    if (payload.relayUrlMatchesPublicOrigin !== null) {
+      humanLine(
+        "relay url matches public origin",
+        payload.relayUrlMatchesPublicOrigin ? "yes" : "no"
+      );
+    }
     humanLine("public origin local", payload.publicOriginLooksLocal ? "yes" : "no");
     if (payload.connectorUiAvailable !== null) {
       humanLine("connector ui", payload.connectorUiAvailable ? "available" : "missing");
@@ -12400,10 +12644,9 @@ function createRelayCommand() {
       if (payload.recommendedCommands.reapproveWallet) {
         humanLine("reapprove wallet", payload.recommendedCommands.reapproveWallet);
       }
-    } else {
-      for (const note of payload.notes) {
-        humanLine("note", note);
-      }
+    }
+    for (const note of payload.notes) {
+      humanLine("note", note);
     }
   });
   return relay;
@@ -12416,12 +12659,12 @@ import { Command as Command9 } from "commander";
 
 // ../account-profiles/src/profiles.ts
 import fs8 from "node:fs";
-import path7 from "node:path";
+import path8 from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 var PACKAGE_NAME = "@zk-agent/account-profiles";
 var PACKAGE_ROOT_FALLBACK = `<${PACKAGE_NAME} package root unavailable>`;
 function isExpectedPackageRoot(candidate) {
-  const manifestPath = path7.join(candidate, "package.json");
+  const manifestPath = path8.join(candidate, "package.json");
   if (!fs8.existsSync(manifestPath)) return false;
   try {
     const manifest = JSON.parse(fs8.readFileSync(manifestPath, "utf8"));
@@ -12431,19 +12674,19 @@ function isExpectedPackageRoot(candidate) {
   }
 }
 function resolvePackageRoot() {
-  const moduleRoot = path7.resolve(path7.dirname(fileURLToPath4(import.meta.url)), "..");
+  const moduleRoot = path8.resolve(path8.dirname(fileURLToPath4(import.meta.url)), "..");
   const cwd = process.cwd();
   const candidates = [
     process.env.ZK_AGENT_ACCOUNT_PROFILES_ROOT,
-    path7.join(moduleRoot, "dist", "builtin-account-profiles"),
+    path8.join(moduleRoot, "dist", "builtin-account-profiles"),
     moduleRoot,
-    path7.join(cwd, "packages", "account-profiles"),
-    path7.join(cwd, "account-profiles"),
+    path8.join(cwd, "packages", "account-profiles"),
+    path8.join(cwd, "account-profiles"),
     cwd
   ].filter((value) => typeof value === "string" && value.trim().length > 0);
   const seen = /* @__PURE__ */ new Set();
   for (const candidate of candidates) {
-    const normalized = path7.resolve(candidate);
+    const normalized = path8.resolve(candidate);
     if (seen.has(normalized)) continue;
     seen.add(normalized);
     if (isExpectedPackageRoot(normalized)) {
@@ -12515,11 +12758,11 @@ function missingArtifactError(profileId, artifactPath2) {
 }
 function contractPath(...segments) {
   const packageRoot = tryResolvePackageRoot();
-  return packageRoot ? path7.join(packageRoot, "contracts", ...segments) : path7.join(PACKAGE_ROOT_FALLBACK, "contracts", ...segments);
+  return packageRoot ? path8.join(packageRoot, "contracts", ...segments) : path8.join(PACKAGE_ROOT_FALLBACK, "contracts", ...segments);
 }
 function artifactPath(...segments) {
   const packageRoot = tryResolvePackageRoot();
-  return packageRoot ? path7.join(packageRoot, "artifacts", ...segments) : path7.join(PACKAGE_ROOT_FALLBACK, "artifacts", ...segments);
+  return packageRoot ? path8.join(packageRoot, "artifacts", ...segments) : path8.join(PACKAGE_ROOT_FALLBACK, "artifacts", ...segments);
 }
 function createDailySpendLimitProfile() {
   const resolvedArtifactPath = artifactPath("daily-spend-limit", "Account.json");
@@ -13005,11 +13248,16 @@ function sanitizeWalletRecord(wallet) {
 function relayOutputAliases(relay) {
   const shareUrl = relay && "share_url" in relay ? relay.share_url : void 0;
   const statusUrl = relay && "status_url" in relay ? relay.status_url : void 0;
+  const approvalUrl = relay?.approval_url;
+  const shareLinkBaseUrl = shareUrl ? shareUrl.replace(/\/[^/]+$/, "") : approvalUrl ? approvalUrl.replace(/\/[^/]+$/, "") : void 0;
+  const statusApiBaseUrl = statusUrl ? statusUrl.replace(/\/[^/]+$/, "") : approvalUrl && relay?.request_id ? `${approvalUrl.replace(/\/r\/[^/]+$/, "")}/api/requests` : void 0;
   return {
     relayRequestId: relay?.request_id,
     relayShareUrl: shareUrl,
     relayStatusUrl: statusUrl,
-    relayApprovalUrl: relay?.approval_url
+    relayApprovalUrl: approvalUrl,
+    relayShareLinkBaseUrl: shareLinkBaseUrl,
+    relayStatusApiBaseUrl: statusApiBaseUrl
   };
 }
 function sanitizeWalletRequestRecord(request) {
@@ -14836,13 +15084,14 @@ function createWalletCommand(deps) {
     "after",
     [
       "",
-      "Default wallet path:",
+      "Local-first wallet path:",
       "  First bootstrap:",
       "    zk-agent wallet create --await-local",
       "    zk-agent next",
       "",
       "  Restore approval metadata for an existing wallet:",
       "    zk-agent wallet reapprove --name main --await-local",
+      "    zk-agent next",
       "",
       "  Attach a local signer when approval is still present:",
       "    zk-agent wallet signer attach --name main --private-key <hex>",
@@ -14852,7 +15101,7 @@ function createWalletCommand(deps) {
       "    zk-agent wallet status --name main",
       "    zk-agent wallet next --name main",
       "",
-      "  Remote approval path:",
+      "  Hosted remote approval path:",
       "    zk-agent relay inspect --relay-url <url>",
       "    zk-agent wallet create --relay-url <url> --wait-relay --prompt-code",
       "    zk-agent wallet reapprove --name main --relay-url <url> --wait-relay --prompt-code"
@@ -15010,7 +15259,9 @@ function createWalletCommand(deps) {
           ["approval url", request2.approvalUrl],
           ...relay ? [
             ["share url", relay.share_url],
-            ["status url", relay.status_url]
+            ["status url", relay.status_url],
+            ["share-link base", relay.share_url.replace(/\/[^/]+$/, "")],
+            ["status api base", relay.status_url.replace(/\/[^/]+$/, "")]
           ] : [],
           ["expires", request2.expiresAt],
           ["next local", buildWalletRequestAwaitLocalRecommendedCommand(request2.requestId)],
@@ -15157,7 +15408,9 @@ function createWalletCommand(deps) {
           ["approval url", request2.approvalUrl],
           ...relay ? [
             ["share url", relay.share_url],
-            ["status url", relay.status_url]
+            ["status url", relay.status_url],
+            ["share-link base", relay.share_url.replace(/\/[^/]+$/, "")],
+            ["status api base", relay.status_url.replace(/\/[^/]+$/, "")]
           ] : [],
           ["expires", request2.expiresAt],
           ["next local", buildWalletRequestAwaitLocalRecommendedCommand(request2.requestId)],
@@ -15511,6 +15764,8 @@ function createWalletCommand(deps) {
         ["request", relay.request_id],
         ["share url", relay.share_url],
         ["status url", relay.status_url],
+        ["share-link base", relay.share_url.replace(/\/[^/]+$/, "")],
+        ["status api base", relay.status_url.replace(/\/[^/]+$/, "")],
         ["next status", buildWalletRequestRelayStatusRecommendedCommand(relay.request_id, options.relayUrl)],
         ["next approve", buildWalletRequestRelayApproveRecommendedCommand(relay.request_id, options.relayUrl)]
       ],
@@ -15539,6 +15794,8 @@ function createWalletCommand(deps) {
         ["request", relay.request_id],
         ["approval ready", relay.approval_ready ? "yes" : "no"],
         ["share url", relay.approval_url],
+        ["share-link base", relay.approval_url.replace(/\/[^/]+$/, "")],
+        ["status api base", `${relay.approval_url.replace(/\/r\/[^/]+$/, "")}/api/requests`],
         ["expires", relay.expires_at],
         ["next status", buildWalletRequestRelayStatusRecommendedCommand(relay.request_id, options.relayUrl)],
         ...relay.approval_ready ? [[
@@ -17818,6 +18075,7 @@ async function ensureWorkflowWalletSession(input, deps) {
 }
 function workflowWalletApprovalLines(walletApproval) {
   if (!walletApproval) return [];
+  const relayAliases = workflowWalletApprovalRelayAliases(walletApproval.relay);
   const lines = [
     ["wallet approval", walletApproval.stage],
     ["wallet request", walletApproval.request.requestId]
@@ -17837,6 +18095,12 @@ function workflowWalletApprovalLines(walletApproval) {
   if (walletApproval.relay?.status_url) {
     lines.push(["status url", walletApproval.relay.status_url]);
   }
+  if (relayAliases.walletApprovalRelayShareLinkBaseUrl) {
+    lines.push(["share-link base", relayAliases.walletApprovalRelayShareLinkBaseUrl]);
+  }
+  if (relayAliases.walletApprovalRelayStatusApiBaseUrl) {
+    lines.push(["status api base", relayAliases.walletApprovalRelayStatusApiBaseUrl]);
+  }
   if (walletApproval.stage === "request-created" && walletApproval.recommendedCommands) {
     lines.push(["next local", walletApproval.recommendedCommands.awaitLocal]);
     lines.push(["next remote", walletApproval.recommendedCommands.approve]);
@@ -17896,6 +18160,7 @@ async function printWorkflowRunCommandResult(execution) {
         result: execution.result,
         walletRequestId: execution.walletApproval?.request.requestId,
         walletApprovalRelay: execution.walletApproval?.relay,
+        ...workflowWalletApprovalRelayAliases(execution.walletApproval?.relay),
         walletApprovalRecommendedCommands: execution.walletApproval?.recommendedCommands,
         walletApproval: serializeWalletApproval(execution.walletApproval),
         recommendedCommands: recommendedCommands2
@@ -17937,6 +18202,7 @@ async function printWorkflowRunCommandResult(execution) {
       checkpoint: execution.checkpoint,
       walletRequestId: execution.walletApproval?.request.requestId,
       walletApprovalRelay: execution.walletApproval?.relay,
+      ...workflowWalletApprovalRelayAliases(execution.walletApproval?.relay),
       walletApprovalRecommendedCommands: execution.walletApproval?.recommendedCommands,
       walletApproval: serializeWalletApproval(execution.walletApproval),
       recommendedCommands
@@ -18237,6 +18503,7 @@ async function printWorkflowAutoCommandResult(execution) {
       checkpoint: execution.checkpoint,
       walletRequestId: execution.walletApproval?.request.requestId,
       walletApprovalRelay: execution.walletApproval?.relay,
+      ...workflowWalletApprovalRelayAliases(execution.walletApproval?.relay),
       walletApprovalRecommendedCommands: execution.walletApproval?.recommendedCommands,
       walletApproval: serializeWalletApproval(execution.walletApproval),
       recommendedCommands
@@ -18367,11 +18634,29 @@ function serializeWalletApproval(walletApproval) {
   if (!walletApproval) return void 0;
   return {
     ...walletApproval,
+    ...workflowWalletApprovalRelayAliases(walletApproval.relay, {
+      shareLinkBaseField: "relayShareLinkBaseUrl",
+      statusApiBaseField: "relayStatusApiBaseUrl"
+    }),
     walletRequestId: walletApproval.request.requestId,
     request: sanitizeWalletRequestRecord(walletApproval.request),
     wallet: walletApproval.wallet ? sanitizeWalletRecord(walletApproval.wallet) : void 0
   };
 }
+function workflowWalletApprovalRelayAliases(relay, fieldNames = {
+  shareLinkBaseField: "walletApprovalRelayShareLinkBaseUrl",
+  statusApiBaseField: "walletApprovalRelayStatusApiBaseUrl"
+}) {
+  const shareUrl = relay?.share_url;
+  const statusUrl = relay?.status_url;
+  const approvalUrl = relay?.approval_url;
+  const shareLinkBaseUrl = shareUrl ? shareUrl.replace(/\/[^/]+$/, "") : approvalUrl ? approvalUrl.replace(/\/[^/]+$/, "") : void 0;
+  const statusApiBaseUrl = statusUrl ? statusUrl.replace(/\/[^/]+$/, "") : approvalUrl && relay?.request_id ? `${approvalUrl.replace(/\/r\/[^/]+$/, "")}/api/requests` : void 0;
+  return {
+    [fieldNames.shareLinkBaseField]: shareLinkBaseUrl,
+    [fieldNames.statusApiBaseField]: statusApiBaseUrl
+  };
+}
 function addWorkflowGoalOptions(command, config = {}) {
   if (config.includeExecutionFlags) {
     command.option("--broadcast", "Broadcast the underlying transaction(s) instead of returning a preview", false).option(
@@ -18965,6 +19250,7 @@ function createWorkflowCommand(deps) {
         checkpoint: inspection.checkpoint,
         walletRequestId: inspection.walletApproval?.request.requestId,
         walletApprovalRelay: inspection.walletApproval?.relay,
+        ...workflowWalletApprovalRelayAliases(inspection.walletApproval?.relay),
         walletApprovalRecommendedCommands: inspection.walletApproval?.recommendedCommands,
         walletApproval: serializeWalletApproval(inspection.walletApproval),
         recommendedCommands
@@ -19028,6 +19314,7 @@ function createWorkflowCommand(deps) {
         checkpoint: inspection.checkpoint,
         walletRequestId: inspection.walletApproval?.request.requestId,
         walletApprovalRelay: inspection.walletApproval?.relay,
+        ...workflowWalletApprovalRelayAliases(inspection.walletApproval?.relay),
         walletApprovalRecommendedCommands: inspection.walletApproval?.recommendedCommands,
         walletApproval: serializeWalletApproval(inspection.walletApproval),
         recommendedCommands
@@ -19079,6 +19366,7 @@ function createWorkflowCommand(deps) {
           checkpoint: inspection.checkpoint,
           walletRequestId: inspection.walletApproval.request.requestId,
           walletApprovalRelay: inspection.walletApproval.relay,
+          ...workflowWalletApprovalRelayAliases(inspection.walletApproval.relay),
           walletApprovalRecommendedCommands: inspection.walletApproval.recommendedCommands,
           walletApproval: serializeWalletApproval(inspection.walletApproval),
           recommendedCommands: recommendedCommands2
@@ -19129,6 +19417,7 @@ function createWorkflowCommand(deps) {
           checkpoint: execution.checkpoint,
           walletRequestId: execution.walletApproval?.request.requestId,
           walletApprovalRelay: execution.walletApproval?.relay,
+          ...workflowWalletApprovalRelayAliases(execution.walletApproval?.relay),
           walletApprovalRecommendedCommands: execution.walletApproval?.recommendedCommands,
           walletApproval: serializeWalletApproval(execution.walletApproval),
           recommendedCommands: recommendedCommands2
@@ -19170,6 +19459,7 @@ function createWorkflowCommand(deps) {
         result: execution.result,
         walletRequestId: inspection.walletApproval?.request.requestId,
         walletApprovalRelay: inspection.walletApproval?.relay,
+        ...workflowWalletApprovalRelayAliases(inspection.walletApproval?.relay),
         walletApprovalRecommendedCommands: inspection.walletApproval?.recommendedCommands,
         walletApproval: serializeWalletApproval(inspection.walletApproval),
         recommendedCommands
@@ -19207,14 +19497,15 @@ function createWorkflowCommand(deps) {
 function buildDefaultOperatorPathHelpText() {
   return [
     "",
-    "Default operator path:",
+    "Default local-first operator path:",
     "  zk-agent setup",
     "  zk-agent next",
     "  zk-agent wallet create --await-local",
     "  zk-agent next",
-    `  ${buildWorkflowAutoRecommendedCommand("main")}`,
+    `  ${buildWorkflowPayRecommendedCommand("main")}`,
     "",
     "Use `zk-agent next --request-id <id>` to continue a stored workflow checkpoint.",
+    "Use `zk-agent relay inspect --relay-url <url>` and `zk-agent wallet --help` for the hosted remote-approval path.",
     "Use `zk-agent wallet --help` for bootstrap/reapproval details and `zk-agent workflow --help` once the intent is known."
   ].join("\n");
 }