zk-agent-cli 0.1.0-beta.9 → 0.1.0-rc.0

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { Command as Command11, CommanderError } from "commander";
+import { Command as Command12, CommanderError } from "commander";
 import { config as loadEnv } from "dotenv";
 
 // src/commands/operations.ts
@@ -7830,13 +7830,61 @@ function buildWalletCreateRecommendedCommand() {
 function buildRelayInspectRecommendedCommand(relayUrl = "<url>") {
   return `zk-agent relay inspect --relay-url ${relayUrl}`;
 }
-function buildWalletCreateRemoteRecommendedCommand(relayUrl = "<url>", paymasterMode, walletName = "main", accountKind = "smart-account") {
-  const command = [
+function inferSessionHours(sessionPolicies, requestCreatedAt) {
+  const expiresAt = sessionPolicies?.expiresAt;
+  if (!expiresAt || !requestCreatedAt) return null;
+  const createdAtMs = Date.parse(requestCreatedAt);
+  const expiresAtMs = Date.parse(expiresAt);
+  if (!Number.isFinite(createdAtMs) || !Number.isFinite(expiresAtMs) || expiresAtMs <= createdAtMs) {
+    return null;
+  }
+  const hours = (expiresAtMs - createdAtMs) / (60 * 60 * 1e3);
+  if (!Number.isFinite(hours) || hours <= 0) return null;
+  const rounded = Math.round(hours * 1e3) / 1e3;
+  if (Math.abs(rounded - 24) < 5e-4) {
+    return null;
+  }
+  return Number.isInteger(rounded) ? String(rounded) : String(rounded).replace(/(?:\.0+|(\.\d*?)0+)$/, "$1");
+}
+function appendSessionPolicyFlags(commandParts, options) {
+  const sessionHours = inferSessionHours(options?.sessionPolicies, options?.requestCreatedAt);
+  if (sessionHours) {
+    commandParts.push(`--session-hours ${sessionHours}`);
+  }
+  const transfers = options?.sessionPolicies?.transfers;
+  if (Array.isArray(transfers)) {
+    if (transfers.length === 0) {
+      commandParts.push("--disallow-transfers");
+    } else {
+      for (const policy of transfers) {
+        if (policy?.to) {
+          commandParts.push(`--allow-transfer-to ${policy.to}`);
+        }
+      }
+    }
+  }
+  const contractCalls = options?.sessionPolicies?.contractCalls;
+  if (Array.isArray(contractCalls)) {
+    if (contractCalls.length === 0) {
+      commandParts.push("--disallow-contract-calls");
+    } else {
+      for (const policy of contractCalls) {
+        if (policy?.address) {
+          commandParts.push(`--allow-contract ${policy.address}`);
+        }
+      }
+    }
+  }
+}
+function buildWalletCreateRemoteRecommendedCommand(relayUrl = "<url>", paymasterMode, walletName = "main", accountKind = "smart-account", options) {
+  const commandParts = [
     "zk-agent wallet create",
     walletName !== "main" ? `--name ${walletName}` : "",
-    accountKind !== "smart-account" ? `--account-kind ${accountKind}` : "",
-    `--relay-url ${relayUrl} --wait-relay --prompt-code`
-  ].filter(Boolean).join(" ");
+    accountKind !== "smart-account" ? `--account-kind ${accountKind}` : ""
+  ].filter(Boolean);
+  appendSessionPolicyFlags(commandParts, options);
+  commandParts.push(`--relay-url ${relayUrl} --wait-relay --prompt-code`);
+  const command = commandParts.join(" ");
   return appendPaymasterMode(command, paymasterMode);
 }
 function buildWalletListRecommendedCommand() {
@@ -7845,6 +7893,9 @@ function buildWalletListRecommendedCommand() {
 function buildWalletStatusRecommendedCommand(walletName) {
   return `zk-agent wallet status --name ${walletName}`;
 }
+function buildWalletSignerShowRecommendedCommand(walletName) {
+  return `zk-agent wallet signer show --name ${walletName}`;
+}
 function buildWalletSignerAttachRecommendedCommand(walletName, privateKeyRef = "<hex>") {
   return `zk-agent wallet signer attach --name ${walletName} --private-key ${privateKeyRef}`;
 }
@@ -7901,8 +7952,11 @@ function buildDiscoveryRecommendedCommands(input) {
 function buildWalletReapproveRecommendedCommand(walletName) {
   return `zk-agent wallet reapprove --name ${walletName} --await-local`;
 }
-function buildWalletReapproveRemoteRecommendedCommand(walletName, relayUrl = "<url>") {
-  return `zk-agent wallet reapprove --name ${walletName} --relay-url ${relayUrl} --wait-relay --prompt-code`;
+function buildWalletReapproveRemoteRecommendedCommand(walletName, relayUrl = "<url>", options) {
+  const commandParts = [`zk-agent wallet reapprove --name ${walletName}`];
+  appendSessionPolicyFlags(commandParts, options);
+  commandParts.push(`--relay-url ${relayUrl} --wait-relay --prompt-code`);
+  return commandParts.join(" ");
 }
 function buildWalletNextRecommendedCommand(walletName) {
   return `zk-agent wallet next --name ${walletName}`;
@@ -10066,12 +10120,43 @@ function createPlannedCommands() {
 
 // src/commands/setup.ts
 import { Command as Command2 } from "commander";
+
+// src/lib/onboarding-summary.ts
+function buildOnboardingSummary(input) {
+  return {
+    stage: input.stage,
+    baseline: "local-first",
+    localOnly: input.localOnly,
+    configExists: input.configExists,
+    walletExists: input.walletExists ?? null,
+    approvalReady: input.approvalReady ?? null,
+    localExecutionKeyStored: input.localExecutionKeyStored ?? null,
+    defaultChain: input.defaultChain ?? null,
+    connectorUrl: input.connectorUrl ?? null,
+    relayUrl: input.relayUrl ?? null,
+    nextAction: input.nextAction ?? null,
+    notes: [...input.notes ?? []]
+  };
+}
+function onboardingSummaryLines(summary) {
+  return [
+    ["baseline", summary.baseline],
+    ["local only", summary.localOnly ? "yes" : "no"]
+  ];
+}
+
+// src/commands/setup.ts
 function buildSetupHelpText() {
   return [
     "",
     "What setup does:",
     "  Writes the local default chain and connector URL used by the first-run path.",
     "",
+    "Validated first-run baseline:",
+    "  Default chain:   zksync-sepolia",
+    "  Connector URL:   http://localhost:4444",
+    "  Override --default-chain or --connector-url only when you intentionally deviate from that path.",
+    "",
     "After setup, stay on the canonical local-first path:",
     "  zk-agent next",
     "  zk-agent wallet create --await-local",
@@ -10088,7 +10173,7 @@ function buildSetupHelpText() {
   ].join("\n");
 }
 function createInitCommand() {
-  return new Command2("init").alias("setup").description("Initialize local zk-agent configuration for the default operator path").addHelpText("after", buildSetupHelpText()).option("--default-chain <chain>", "Default chain key", "zksync-era").option("--connector-url <url>", "Connector UI base URL", "http://localhost:4444").option("--force", "Overwrite an existing config", false).action(async (options) => {
+  return new Command2("init").alias("setup").description("Initialize local zk-agent configuration for the validated first-run operator path").addHelpText("after", buildSetupHelpText()).option("--default-chain <chain>", "Default chain key", "zksync-sepolia").option("--connector-url <url>", "Connector UI base URL", "http://localhost:4444").option("--force", "Overwrite an existing config", false).action(async (options) => {
     const recommendedCommands = {
       next: buildTopLevelNextRecommendedCommand(),
       inspectDefaults: buildDefaultsRecommendedCommand(),
@@ -10099,9 +10184,22 @@ function createInitCommand() {
     };
     const existing = await loadProjectConfig();
     if (existing && !options.force) {
+      const onboardingSummary2 = buildOnboardingSummary({
+        stage: "wallet-bootstrap",
+        localOnly: true,
+        configExists: true,
+        defaultChain: existing.defaultChain,
+        connectorUrl: existing.connectorUrl,
+        nextAction: recommendedCommands.next,
+        notes: [
+          "Setup did not overwrite the existing local defaults.",
+          "Run zk-agent next so the CLI can choose wallet bootstrap or workflow follow-up from the current local state."
+        ]
+      });
       printResult(
         [
           ["status", "Config already exists. Re-run with --force to overwrite."],
+          ...onboardingSummaryLines(onboardingSummary2),
           ["default chain", existing.defaultChain],
           ["connector", existing.connectorUrl],
           ["next", recommendedCommands.next],
@@ -10115,22 +10213,36 @@ function createInitCommand() {
           ok: true,
           message: "Config already exists. Re-run with --force to overwrite.",
           config: existing,
+          onboardingSummary: onboardingSummary2,
           recommendedCommands
         }
       );
       return;
     }
     const config = {
-      defaultChain: options.defaultChain || "zksync-era",
+      defaultChain: options.defaultChain || "zksync-sepolia",
       connectorUrl: options.connectorUrl || "http://localhost:4444",
       provider: "zksync-sso",
       createdAt: existing?.createdAt || (/* @__PURE__ */ new Date()).toISOString(),
       updatedAt: (/* @__PURE__ */ new Date()).toISOString()
     };
     await saveProjectConfig(config);
+    const onboardingSummary = buildOnboardingSummary({
+      stage: "wallet-bootstrap",
+      localOnly: true,
+      configExists: true,
+      defaultChain: config.defaultChain,
+      connectorUrl: config.connectorUrl,
+      nextAction: recommendedCommands.next,
+      notes: [
+        "Setup only writes local defaults and does not inspect wallet state.",
+        "Stay on zk-agent next so the product entrypoint can decide between wallet bootstrap and workflow guidance."
+      ]
+    });
     printResult(
       [
         ["status", "Config saved"],
+        ...onboardingSummaryLines(onboardingSummary),
         ["default chain", config.defaultChain],
         ["connector", config.connectorUrl],
         ["next", recommendedCommands.next],
@@ -10140,7 +10252,7 @@ function createInitCommand() {
         ["create wallet (remote)", recommendedCommands.createWalletRemote],
         ["after approval", recommendedCommands.afterWalletApproval]
       ],
-      { ok: true, config, recommendedCommands }
+      { ok: true, config, onboardingSummary, recommendedCommands }
     );
   });
 }
@@ -10504,10 +10616,14 @@ function agentProfileLines(summary) {
 }
 
 // src/lib/wallet-next.ts
-function buildWalletNextRecommendedCommands(walletName, summary) {
+function buildWalletNextRecommendedCommands(walletName, summary, paymasterMode) {
   return {
     discoverAssets: buildAssetsRecommendedCommand(walletName),
     discoverOwnedTokens: buildOwnedTokensRecommendedCommand(walletName),
+    ...paymasterMode === "approval-based" ? {
+      discoverPaymasterTokens: buildPaymasterFeeTokensRecommendedCommand(summary.chain),
+      inspectPaymasterToken: buildPaymasterFeeTokenResolveRecommendedCommand(summary.chain)
+    } : {},
     discoverTokens: buildTokensRecommendedCommand(summary.chain),
     inspectToken: buildResolveTokenRecommendedCommand(summary.chain),
     walletStatus: buildWalletStatusRecommendedCommand(walletName),
@@ -10620,17 +10736,38 @@ function buildSetupCommand() {
 function buildTopLevelNextRecommendedCommand2(requestId) {
   return requestId ? `zk-agent next --request-id ${requestId}` : "zk-agent next";
 }
+function buildTopLevelWorkflowSummary(result, nextCommand) {
+  return {
+    status: result.status,
+    readyForGoal: result.readyForGoal,
+    nextCommand,
+    blockingActionIds: result.blockingActionIds,
+    fundingProgress: result.fundingProgress ? {
+      kind: result.fundingProgress.kind,
+      txHash: result.fundingProgress.txHash,
+      status: result.fundingProgress.status,
+      terminal: result.fundingProgress.terminal,
+      finalized: result.fundingProgress.finalized
+    } : void 0
+  };
+}
 function appendPaymasterMode2(command, paymasterMode) {
   if (!paymasterMode) return command;
   return `${command} --paymaster-mode ${paymasterMode}`;
 }
-function topLevelNextLines(scope, lines) {
-  return [["scope", scope], ...lines];
+function topLevelNextLines(scope, lines, onboardingSummary) {
+  return [
+    ["scope", scope],
+    ...onboardingSummary ? onboardingSummaryLines(onboardingSummary) : [],
+    ...lines
+  ];
 }
 function buildNextHelpText() {
   return [
     "",
     "Use `next` as the product entrypoint:",
+    "  Stay on `next` until it points you at a wallet-specific or workflow-specific blocker.",
+    "",
     "  Fresh local-first routing:",
     "    zk-agent setup",
     "    zk-agent next",
@@ -10642,6 +10779,8 @@ function buildNextHelpText() {
     "    zk-agent wallet create --relay-url <url> --wait-relay --prompt-code",
     "    zk-agent next",
     "",
+    "  If setup has not run yet, `next` will send you back to `zk-agent setup` first.",
+    "",
     "  Continue a stored workflow checkpoint:",
     "    zk-agent next --request-id <id>",
     "",
@@ -10651,6 +10790,9 @@ function buildNextHelpText() {
     "  Switch to the hosted remote-approval path only when the browser is not colocated:",
     "    zk-agent wallet --help",
     "",
+    "  Use `wallet --help` when you already know the blocker is wallet-specific:",
+    "    zk-agent wallet next --name main",
+    "",
     "  Stay on the workflow layer only when you already have an explicit workflow or checkpoint:",
     "    zk-agent workflow next --request-id <id>"
   ].join("\n");
@@ -10740,6 +10882,7 @@ function createNextCommand(deps) {
           nextCommand: nextCommand2,
           agentProfile: workflowAgentProfile,
           agentFollowup: agentFollowup2,
+          summary: buildTopLevelWorkflowSummary(result, nextCommand2),
           result,
           checkpoint: updatedCheckpoint,
           tokenDiscoverySummary: tokenDiscoverySummary2,
@@ -10755,6 +10898,17 @@ function createNextCommand(deps) {
         afterSetup: buildTopLevelNextRecommendedCommand2(),
         inspectDefaults: buildDefaultsRecommendedCommand()
       };
+      const onboardingSummary2 = buildOnboardingSummary({
+        stage: "setup",
+        localOnly: true,
+        configExists: false,
+        walletExists: false,
+        nextAction: recommendedCommands2.setup,
+        notes: [
+          "No local config was found, so setup is still the first required onboarding step.",
+          "This scope is local-only and does not require live RPC reads."
+        ]
+      });
       printResult(
         topLevelNextLines("setup", [
           ["status", "No local config found"],
@@ -10763,12 +10917,13 @@ function createNextCommand(deps) {
           ["next", recommendedCommands2.setup],
           ["after setup", recommendedCommands2.afterSetup],
           ["inspect defaults", recommendedCommands2.inspectDefaults]
-        ]),
+        ], onboardingSummary2),
         {
           ok: true,
           scope: "setup",
           status: "action-required",
           nextCommand: recommendedCommands2.setup,
+          onboardingSummary: onboardingSummary2,
           agentProfile,
           agentFollowup: defaultAgentFollowup,
           recommendedCommands: recommendedCommands2
@@ -10791,6 +10946,19 @@ function createNextCommand(deps) {
         afterApproval: appendPaymasterMode2(buildTopLevelNextRecommendedCommand2(), paymasterMode),
         inspectDefaults: buildDefaultsRecommendedCommand()
       };
+      const onboardingSummary2 = buildOnboardingSummary({
+        stage: "wallet-bootstrap",
+        localOnly: true,
+        configExists: true,
+        walletExists: false,
+        defaultChain: config.defaultChain,
+        connectorUrl: config.connectorUrl,
+        nextAction: recommendedCommands2.createWallet,
+        notes: [
+          "Config exists, but no saved wallet record was found for this name yet.",
+          "Use the remote approval fallback only when the browser is not colocated with this terminal."
+        ]
+      });
       printResult(
         topLevelNextLines("wallet-bootstrap", [
           ["status", `Wallet not found: ${walletName}`],
@@ -10803,13 +10971,14 @@ function createNextCommand(deps) {
           ["remote fallback", recommendedCommands2.createWalletRemote],
           ["after approval", recommendedCommands2.afterApproval],
           ["inspect defaults", recommendedCommands2.inspectDefaults]
-        ]),
+        ], onboardingSummary2),
         {
           ok: true,
           scope: "wallet-bootstrap",
           walletName,
           config,
           nextCommand: recommendedCommands2.createWallet,
+          onboardingSummary: onboardingSummary2,
           agentProfile,
           agentFollowup: defaultAgentFollowup,
           recommendedCommands: recommendedCommands2
@@ -10845,6 +11014,27 @@ function createNextCommand(deps) {
       paymasterMode
     );
     const nextCommand = summary.recommendedCommand || workflowPay;
+    const onboardingSummary = buildOnboardingSummary({
+      stage: inspection.approvalReady && inspection.localExecutionKeyStored ? "wallet-ready" : "wallet-recovery",
+      localOnly: false,
+      configExists: true,
+      walletExists: true,
+      approvalReady: inspection.approvalReady,
+      localExecutionKeyStored: inspection.localExecutionKeyStored,
+      defaultChain: config.defaultChain,
+      connectorUrl: config.connectorUrl,
+      nextAction: nextCommand,
+      notes: !inspection.approvalReady ? [
+        "Wallet metadata exists, but approved session metadata is still missing.",
+        "Top-level next returns to live workflow guidance after wallet approval is restored."
+      ] : !inspection.localExecutionKeyStored ? [
+        "Approved session metadata exists, but no local execution signer is stored yet.",
+        "Top-level next returns to live workflow guidance after the signer is attached."
+      ] : [
+        "Wallet approval and local signer state are present.",
+        "Top-level next also inspects live deployment and balance state before recommending the workflow step."
+      ]
+    });
     const agentFollowup = buildAgentFollowup(agentProfile, {
       walletName: wallet.walletName,
       walletExists: true
@@ -10885,11 +11075,12 @@ function createNextCommand(deps) {
         ...recommendedCommands.inspectPaymasterToken ? [["inspect paymaster token", recommendedCommands.inspectPaymasterToken]] : [],
         ["inspect token", recommendedCommands.inspectToken],
         ["inspect defaults", recommendedCommands.inspectDefaults]
-      ]),
+      ], onboardingSummary),
       {
         ok: true,
         scope: "wallet",
         walletName: wallet.walletName,
+        onboardingSummary,
         agentProfile,
         agentFollowup,
         inspection,
@@ -10908,8 +11099,418 @@ function parsePaymasterMode(value) {
   throw new Error(`Unsupported paymaster mode: ${value}`);
 }
 
-// src/commands/agent.ts
+// src/commands/doctor.ts
 import { Command as Command4 } from "commander";
+function buildDoctorHelpText() {
+  return [
+    "",
+    "Use `doctor` when local state is unclear:",
+    "  zk-agent doctor",
+    "  zk-agent doctor --wallet main",
+    "  zk-agent doctor --wallet main --relay-url https://relay.example.com",
+    "",
+    "Default behavior:",
+    "  Inspects saved config, local wallet approval metadata, local signer state,",
+    "  and the shortest next command without requiring live RPC reads.",
+    "  Run this before guessing whether the blocker is setup, wallet approval, or local signer state.",
+    "",
+    "Remote-browser recovery path:",
+    "  Pass --relay-url when you want the remote approval fallback commands",
+    "  to use a concrete relay URL instead of a placeholder."
+  ].join("\n");
+}
+function summarizeLocalWalletState(wallet) {
+  const localExecutionPrivateKey = resolveLocalExecutionPrivateKey(wallet);
+  return {
+    exists: true,
+    walletName: wallet.walletName,
+    walletAddress: wallet.walletAddress,
+    chain: wallet.chain,
+    chainId: wallet.chainId,
+    accountKind: wallet.accountKind || wallet.sessionPayload?.account?.kind || "smart-account",
+    smartAccountProfileId: wallet.smartAccountProfileId || null,
+    syncedAt: wallet.syncedAt || null,
+    approvalReady: Boolean(wallet.sessionPayload),
+    localExecutionKeyStored: Boolean(localExecutionPrivateKey),
+    legacySessionKeyStored: Boolean(wallet.sessionPayload?.sessionPrivateKey),
+    signerType: wallet.localExecutionAuthority?.signerType || wallet.sessionPayload?.account?.signerType || null,
+    signerAddress: wallet.localExecutionAuthority?.signerAddress || deriveLocalExecutionSignerAddress(localExecutionPrivateKey) || null,
+    signerSource: wallet.localExecutionAuthority?.source || (wallet.sessionPayload?.sessionPrivateKey ? "legacy-session-payload" : null)
+  };
+}
+function buildSetupRecommendedCommands() {
+  return {
+    setup: "zk-agent setup",
+    next: buildTopLevelNextRecommendedCommand(),
+    inspectDefaults: buildDefaultsRecommendedCommand()
+  };
+}
+function buildWalletBootstrapRecommendedCommands(walletName, relayUrl) {
+  return {
+    next: buildTopLevelNextRecommendedCommand(),
+    inspectDefaults: buildDefaultsRecommendedCommand(),
+    createWallet: buildWalletCreateRecommendedCommand(),
+    relayInspect: buildRelayInspectRecommendedCommand(relayUrl),
+    createWalletRemote: buildWalletCreateRemoteRecommendedCommand(relayUrl, void 0, walletName)
+  };
+}
+function buildWalletRecoveryRecommendedCommands(wallet, relayUrl) {
+  const shared = {
+    next: buildTopLevelNextRecommendedCommand(),
+    walletStatus: buildWalletStatusRecommendedCommand(wallet.walletName),
+    walletNext: buildWalletNextRecommendedCommand(wallet.walletName),
+    signerShow: buildWalletSignerShowRecommendedCommand(wallet.walletName),
+    relayInspect: buildRelayInspectRecommendedCommand(relayUrl),
+    reapproveRemote: buildWalletReapproveRemoteRecommendedCommand(wallet.walletName, relayUrl)
+  };
+  if (!wallet.approvalReady) {
+    return {
+      ...shared,
+      reapprove: buildWalletReapproveRecommendedCommand(wallet.walletName)
+    };
+  }
+  return {
+    ...shared,
+    attachSigner: buildWalletSignerAttachRecommendedCommand(wallet.walletName),
+    reapprove: buildWalletReapproveRecommendedCommand(wallet.walletName)
+  };
+}
+function buildWalletReadyRecommendedCommands(wallet) {
+  return {
+    next: buildTopLevelNextRecommendedCommand(),
+    walletStatus: buildWalletStatusRecommendedCommand(wallet.walletName),
+    walletNext: buildWalletNextRecommendedCommand(wallet.walletName),
+    workflowPay: buildWorkflowPayRecommendedCommand(wallet.walletName),
+    inspectDefaults: buildDefaultsRecommendedCommand()
+  };
+}
+function buildDoctorResult(options) {
+  if (!options.config) {
+    const recommendedCommands2 = buildSetupRecommendedCommands();
+    const onboardingSummary2 = buildOnboardingSummary({
+      stage: "setup",
+      localOnly: true,
+      configExists: false,
+      walletExists: Boolean(options.wallet),
+      approvalReady: options.wallet?.approvalReady ?? null,
+      localExecutionKeyStored: options.wallet?.localExecutionKeyStored ?? null,
+      relayUrl: options.relayUrl || null,
+      nextAction: recommendedCommands2.setup,
+      notes: [
+        "Local config is missing, so the canonical operator path should start with setup.",
+        "Doctor is local-only by default and does not require live RPC reads."
+      ]
+    });
+    return {
+      scope: "setup",
+      nextAction: recommendedCommands2.setup,
+      onboardingSummary: onboardingSummary2,
+      summary: {
+        stage: "setup",
+        configExists: false,
+        walletExists: Boolean(options.wallet),
+        approvalReady: options.wallet?.approvalReady ?? null,
+        localExecutionKeyStored: options.wallet?.localExecutionKeyStored ?? null,
+        relayUrl: options.relayUrl || null,
+        nextAction: recommendedCommands2.setup,
+        localOnly: true,
+        notes: [
+          "Local config is missing, so the canonical operator path should start with setup.",
+          "Doctor is local-only by default and does not require live RPC reads."
+        ]
+      },
+      recommendedCommands: recommendedCommands2
+    };
+  }
+  if (!options.wallet) {
+    const recommendedCommands2 = buildWalletBootstrapRecommendedCommands(
+      options.walletName,
+      options.relayUrl
+    );
+    const onboardingSummary2 = buildOnboardingSummary({
+      stage: "wallet-bootstrap",
+      localOnly: true,
+      configExists: true,
+      walletExists: false,
+      defaultChain: options.config.defaultChain,
+      connectorUrl: options.config.connectorUrl,
+      relayUrl: options.relayUrl || null,
+      nextAction: recommendedCommands2.createWallet,
+      notes: [
+        "Local config exists, but no saved wallet record was found for this name yet.",
+        "Use the remote relay path only when the browser is not colocated with this terminal."
+      ]
+    });
+    return {
+      scope: "wallet-bootstrap",
+      nextAction: recommendedCommands2.createWallet,
+      onboardingSummary: onboardingSummary2,
+      summary: {
+        stage: "wallet-bootstrap",
+        configExists: true,
+        walletExists: false,
+        approvalReady: null,
+        localExecutionKeyStored: null,
+        relayUrl: options.relayUrl || null,
+        nextAction: recommendedCommands2.createWallet,
+        localOnly: true,
+        notes: [
+          "Local config exists, but no saved wallet record was found for this name yet.",
+          "Use the remote relay path only when the browser is not colocated with this terminal."
+        ]
+      },
+      recommendedCommands: recommendedCommands2
+    };
+  }
+  if (!options.wallet.approvalReady) {
+    const recommendedCommands2 = buildWalletRecoveryRecommendedCommands(
+      options.wallet,
+      options.relayUrl
+    );
+    const onboardingSummary2 = buildOnboardingSummary({
+      stage: "wallet-recovery",
+      localOnly: true,
+      configExists: true,
+      walletExists: true,
+      approvalReady: false,
+      localExecutionKeyStored: options.wallet.localExecutionKeyStored,
+      defaultChain: options.config.defaultChain,
+      connectorUrl: options.config.connectorUrl,
+      relayUrl: options.relayUrl || null,
+      nextAction: recommendedCommands2.reapprove,
+      notes: [
+        "A local wallet record exists, but approved session metadata is missing.",
+        "Use the remote reapproval path only when the browser cannot return directly to this terminal."
+      ]
+    });
+    return {
+      scope: "wallet-recovery",
+      nextAction: recommendedCommands2.reapprove,
+      onboardingSummary: onboardingSummary2,
+      summary: {
+        stage: "wallet-recovery",
+        configExists: true,
+        walletExists: true,
+        approvalReady: false,
+        localExecutionKeyStored: options.wallet.localExecutionKeyStored,
+        relayUrl: options.relayUrl || null,
+        nextAction: recommendedCommands2.reapprove,
+        localOnly: true,
+        notes: [
+          "A local wallet record exists, but approved session metadata is missing.",
+          "Use the remote reapproval path only when the browser cannot return directly to this terminal."
+        ]
+      },
+      recommendedCommands: recommendedCommands2
+    };
+  }
+  if (!options.wallet.localExecutionKeyStored) {
+    const attachSigner = buildWalletSignerAttachRecommendedCommand(options.wallet.walletName);
+    const recommendedCommands2 = {
+      ...buildWalletRecoveryRecommendedCommands(options.wallet, options.relayUrl),
+      attachSigner
+    };
+    const onboardingSummary2 = buildOnboardingSummary({
+      stage: "wallet-recovery",
+      localOnly: true,
+      configExists: true,
+      walletExists: true,
+      approvalReady: true,
+      localExecutionKeyStored: false,
+      defaultChain: options.config.defaultChain,
+      connectorUrl: options.config.connectorUrl,
+      relayUrl: options.relayUrl || null,
+      nextAction: attachSigner,
+      notes: [
+        "Approved session metadata exists, but no local execution signer is stored yet.",
+        "Doctor is local-only: it confirms stored signer state, not live chain deployment or gas balance."
+      ]
+    });
+    return {
+      scope: "wallet-recovery",
+      nextAction: attachSigner,
+      onboardingSummary: onboardingSummary2,
+      summary: {
+        stage: "wallet-recovery",
+        configExists: true,
+        walletExists: true,
+        approvalReady: true,
+        localExecutionKeyStored: false,
+        relayUrl: options.relayUrl || null,
+        nextAction: attachSigner,
+        localOnly: true,
+        notes: [
+          "Approved session metadata exists, but no local execution signer is stored yet.",
+          "Doctor is local-only: it confirms stored signer state, not live chain deployment or gas balance."
+        ]
+      },
+      recommendedCommands: recommendedCommands2
+    };
+  }
+  const recommendedCommands = buildWalletReadyRecommendedCommands(options.wallet);
+  const onboardingSummary = buildOnboardingSummary({
+    stage: "wallet-ready",
+    localOnly: true,
+    configExists: true,
+    walletExists: true,
+    approvalReady: true,
+    localExecutionKeyStored: true,
+    defaultChain: options.config.defaultChain,
+    connectorUrl: options.config.connectorUrl,
+    relayUrl: options.relayUrl || null,
+    nextAction: recommendedCommands.next,
+    notes: [
+      "Local config, approval metadata, and a local execution signer are all present.",
+      "Run zk-agent next for the current shortest live path; doctor does not confirm RPC reachability, deployment state, or funding."
+    ]
+  });
+  return {
+    scope: "wallet-ready",
+    nextAction: recommendedCommands.next,
+    onboardingSummary,
+    summary: {
+      stage: "wallet-ready",
+      configExists: true,
+      walletExists: true,
+      approvalReady: true,
+      localExecutionKeyStored: true,
+      relayUrl: options.relayUrl || null,
+      nextAction: recommendedCommands.next,
+      localOnly: true,
+      notes: [
+        "Local config, approval metadata, and a local execution signer are all present.",
+        "Run zk-agent next for the current shortest live path; doctor does not confirm RPC reachability, deployment state, or funding."
+      ]
+    },
+    recommendedCommands
+  };
+}
+function buildDoctorLines(input) {
+  const lines = [
+    ["scope", input.scope],
+    ...onboardingSummaryLines(input.onboardingSummary),
+    ["config", input.config ? "present" : "missing"]
+  ];
+  if (input.config) {
+    lines.push(["default chain", input.config.defaultChain]);
+    lines.push(["connector", input.config.connectorUrl]);
+  }
+  lines.push(["wallet", input.walletName]);
+  lines.push(["wallet record", input.wallet ? "present" : "missing"]);
+  if (input.wallet) {
+    lines.push(["address", input.wallet.walletAddress]);
+    lines.push(["account", input.wallet.accountKind]);
+    lines.push(["chain", `${input.wallet.chain} (${input.wallet.chainId})`]);
+    lines.push(["approval", input.wallet.approvalReady ? "present" : "missing"]);
+    lines.push(["local signer", input.wallet.localExecutionKeyStored ? "stored" : "missing"]);
+    lines.push([
+      "legacy payload mirror",
+      input.wallet.legacySessionKeyStored ? "present" : "missing"
+    ]);
+    if (input.wallet.signerType) {
+      lines.push(["signer type", input.wallet.signerType]);
+    }
+    if (input.wallet.signerAddress) {
+      lines.push(["signer address", input.wallet.signerAddress]);
+    }
+    if (input.wallet.signerSource) {
+      lines.push(["signer source", input.wallet.signerSource]);
+    }
+    if (input.wallet.smartAccountProfileId) {
+      lines.push(["smart-account profile", input.wallet.smartAccountProfileId]);
+    }
+    if (input.wallet.syncedAt) {
+      lines.push(["synced at", input.wallet.syncedAt]);
+    }
+  }
+  lines.push(["next", input.nextAction]);
+  if (input.recommendedCommands.createWallet) {
+    lines.push(["create wallet (local)", input.recommendedCommands.createWallet]);
+  }
+  if (input.recommendedCommands.reapprove) {
+    lines.push(["reapprove", input.recommendedCommands.reapprove]);
+  }
+  if (input.recommendedCommands.attachSigner) {
+    lines.push(["attach signer", input.recommendedCommands.attachSigner]);
+  }
+  if (input.recommendedCommands.workflowPay) {
+    lines.push(["workflow pay", input.recommendedCommands.workflowPay]);
+  }
+  if (input.recommendedCommands.relayInspect) {
+    lines.push(["relay inspect", input.recommendedCommands.relayInspect]);
+  }
+  if (input.recommendedCommands.createWalletRemote) {
+    lines.push(["create wallet (remote)", input.recommendedCommands.createWalletRemote]);
+  }
+  if (input.recommendedCommands.reapproveRemote) {
+    lines.push(["reapprove (remote)", input.recommendedCommands.reapproveRemote]);
+  }
+  for (const note of input.summary.notes) {
+    lines.push(["note", note]);
+  }
+  return lines;
+}
+function createDoctorCommand() {
+  return new Command4("doctor").description("Local-only onboarding and wallet-recovery diagnostic for the default operator path").addHelpText("after", buildDoctorHelpText()).option("--wallet <name>", "Wallet name", "main").option(
+    "--relay-url <url>",
+    "Optional relay URL used only to make remote approval fallback commands concrete"
+  ).action(async (options) => {
+    const walletName = options.wallet?.trim() || "main";
+    const config = await loadProjectConfig();
+    const walletRecord = await loadWalletSession(walletName);
+    const wallet = walletRecord ? summarizeLocalWalletState(walletRecord) : null;
+    const result = buildDoctorResult({
+      walletName,
+      relayUrl: options.relayUrl,
+      wallet,
+      config
+    });
+    const agentProfile = await loadAgentIdentitySummary(walletName);
+    const agentFollowup = buildAgentFollowup(agentProfile, {
+      walletName,
+      walletExists: Boolean(wallet)
+    });
+    printResult(
+      [
+        ...buildDoctorLines({
+          scope: result.scope,
+          walletName,
+          config,
+          wallet,
+          onboardingSummary: result.onboardingSummary,
+          summary: result.summary,
+          recommendedCommands: result.recommendedCommands,
+          nextAction: result.nextAction
+        }),
+        ...agentProfileLines(agentProfile),
+        ...agentFollowupLines(agentFollowup)
+      ],
+      {
+        ok: true,
+        scope: result.scope,
+        walletName,
+        config: config ? {
+          exists: true,
+          defaultChain: config.defaultChain,
+          connectorUrl: config.connectorUrl,
+          provider: config.provider
+        } : {
+          exists: false
+        },
+        wallet,
+        onboardingSummary: result.onboardingSummary,
+        summary: result.summary,
+        agentProfile,
+        agentFollowup,
+        nextAction: result.nextAction,
+        recommendedCommands: result.recommendedCommands
+      }
+    );
+  });
+}
+
+// src/commands/agent.ts
+import { Command as Command5 } from "commander";
 function collectRepeatedString(value, previous) {
   return [...previous, value];
 }
@@ -10994,7 +11595,7 @@ function buildAgentSummaryLines(options) {
   return lines;
 }
 function createAgentCommand() {
-  const agent = new Command4("agent").description(
+  const agent = new Command5("agent").description(
     "Manage local agent identity metadata without assuming a zkSync-native onchain reputation standard"
   );
   agent.addHelpText(
@@ -11187,7 +11788,7 @@ function createAgentCommand() {
 }
 
 // src/commands/defaults.ts
-import { Command as Command5 } from "commander";
+import { Command as Command6 } from "commander";
 function inferPrimaryDiscoveryChain(defaults) {
   return defaults.defaultSelections.paymaster.validatedDefault?.chain || defaults.defaultSelections.swap.validatedDefault?.chain || defaults.defaultSelections.bridge.validatedWithdraw?.fromChain || defaults.defaultSelections.bridge.validatedDeposit?.toChain || defaults.validated.feeTokenEraVm?.chain || defaults.builtinChains.find((chain) => chain.key === "zksync-sepolia")?.key || defaults.builtinChains[0]?.key || "zksync-sepolia";
 }
@@ -11735,7 +12336,7 @@ function buildDefaultsLines(input) {
   return lines;
 }
 function createDefaultsCommand() {
-  return new Command5("defaults").description("Show the machine-readable registry of supported, validated, experimental, and manually configured defaults").addHelpText(
+  return new Command6("defaults").description("Show the machine-readable registry of supported, validated, experimental, and manually configured defaults").addHelpText(
     "after",
     [
       "",
@@ -11794,7 +12395,7 @@ function createDefaultsCommand() {
 }
 
 // src/commands/resolve-token.ts
-import { Command as Command6 } from "commander";
+import { Command as Command7 } from "commander";
 function resolveResolveTokenCommandDeps(deps) {
   return {
     loadWallet: deps?.loadWallet ?? (async (walletName) => {
@@ -11852,7 +12453,7 @@ function buildResolveTokenDiscoverySummary(result) {
 }
 function createResolveTokenCommand(deps) {
   const resolvedDeps = resolveResolveTokenCommandDeps(deps);
-  return new Command6("resolve-token").description("Resolve a token symbol or address against the configured local-first token registry").addHelpText(
+  return new Command7("resolve-token").description("Resolve a token symbol or address against the configured local-first token registry").addHelpText(
     "after",
     [
       "",
@@ -11986,7 +12587,7 @@ function normalizeSource(value) {
 }
 
 // src/commands/tokens.ts
-import { Command as Command7 } from "commander";
+import { Command as Command8 } from "commander";
 var provider2 = new ZkSyncWalletProvider();
 function resolveTokensCommandDeps(deps) {
   return {
@@ -12116,7 +12717,7 @@ function buildTokenDiscoverySummary(result) {
 }
 function createTokensCommand(deps) {
   const resolvedDeps = resolveTokensCommandDeps(deps);
-  return new Command7("tokens").description("List discoverable tokens from the configured local-first token registry, or inspect the owned ERC-20 registry subset for one wallet").addHelpText(
+  return new Command8("tokens").description("List discoverable tokens from the configured local-first token registry, or inspect the owned ERC-20 registry subset for one wallet").addHelpText(
     "after",
     [
       "",
@@ -12321,7 +12922,7 @@ function normalizeRole2(value) {
 }
 
 // src/commands/relay.ts
-import { Command as Command8 } from "commander";
+import { Command as Command9 } from "commander";
 
 // src/lib/relay.ts
 import { createServer } from "node:http";
@@ -12829,10 +13430,52 @@ async function startRelayServer(options) {
 }
 
 // src/commands/relay.ts
-function buildRelayServeRecommendedCommands(relayUrl) {
+function buildRelayServeRecommendedCommands(options) {
+  const commands = {
+    inspectRelay: `zk-agent relay inspect --relay-url ${options.relayUrl}`,
+    createWallet: `zk-agent wallet create --relay-url ${options.relayUrl} --wait-relay --prompt-code`,
+    reapproveWallet: `zk-agent wallet reapprove --name main --relay-url ${options.relayUrl} --wait-relay --prompt-code`
+  };
+  if (options.publicOriginLooksLocal) {
+    return {
+      ...commands,
+      restartWithPublicOrigin: "zk-agent relay serve --public-origin https://relay.example.com"
+    };
+  }
+  return commands;
+}
+function buildRelayInspectRecommendedCommands(options) {
+  const commands = {};
+  if (options.compatible) {
+    commands.createWallet = `zk-agent wallet create --relay-url ${options.publicOrigin} --wait-relay --prompt-code`;
+    commands.reapproveWallet = `zk-agent wallet reapprove --name main --relay-url ${options.publicOrigin} --wait-relay --prompt-code`;
+  }
+  if (options.publicOriginLooksLocal) {
+    commands.restartWithPublicOrigin = "zk-agent relay serve --public-origin https://relay.example.com";
+  }
+  return commands;
+}
+function buildRelayHostedReadinessSummary(options) {
+  let status;
+  if (!options.compatible) {
+    status = "incompatible";
+  } else if (options.publicOriginLooksLocal && options.connectorUiAvailable !== true) {
+    status = "needs-public-origin-and-ui";
+  } else if (options.publicOriginLooksLocal) {
+    status = "needs-public-origin";
+  } else if (options.connectorUiAvailable !== true) {
+    status = "needs-connector-ui";
+  } else {
+    status = "ready";
+  }
   return {
-    createWallet: `zk-agent wallet create --relay-url ${relayUrl} --wait-relay --prompt-code`,
-    reapproveWallet: `zk-agent wallet reapprove --name main --relay-url ${relayUrl} --wait-relay --prompt-code`
+    status,
+    compatible: options.compatible,
+    hostedApprovalReady: options.hostedShareRedirectReady,
+    publicOriginConfigured: options.publicOriginSource === "configured",
+    publicOriginLooksLocal: options.publicOriginLooksLocal,
+    connectorUiAvailable: options.connectorUiAvailable,
+    singleHostFileState: options.deploymentSummary.singleHostFileState
   };
 }
 function buildAdvertisedRelayBases(publicOrigin) {
@@ -12841,6 +13484,24 @@ function buildAdvertisedRelayBases(publicOrigin) {
     statusApiBaseUrl: `${publicOrigin}/api/requests`
   };
 }
+function buildRelayApprovalEndpointSummary(options) {
+  let status;
+  if (options.publicOriginLooksLocal) {
+    status = "local-public-origin";
+  } else if (options.relayUrlMatchesPublicOrigin === false) {
+    status = "hosted-public-origin-via-proxy";
+  } else {
+    status = "hosted-public-origin";
+  }
+  return {
+    status,
+    publicOriginConfigured: options.publicOriginSource === "configured",
+    publicOriginLooksLocal: options.publicOriginLooksLocal,
+    relayUrlMatchesPublicOrigin: options.relayUrlMatchesPublicOrigin,
+    shareLinkBaseUrl: options.shareLinkBaseUrl,
+    statusApiBaseUrl: options.statusApiBaseUrl
+  };
+}
 function isRecord3(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
@@ -13026,6 +13687,21 @@ function buildRelayInspectPayload(relayUrl, rawHealth) {
     deploymentScope,
     sameHostRestartPersists
   });
+  const approvalEndpointSummary = buildRelayApprovalEndpointSummary({
+    publicOriginSource,
+    publicOriginLooksLocal,
+    relayUrlMatchesPublicOrigin,
+    shareLinkBaseUrl,
+    statusApiBaseUrl
+  });
+  const hostedReadinessSummary = buildRelayHostedReadinessSummary({
+    compatible,
+    publicOriginSource,
+    publicOriginLooksLocal,
+    connectorUiAvailable,
+    hostedShareRedirectReady,
+    deploymentSummary
+  });
   const notes = [
     ...relayHostedReadinessNotes({
       compatible,
@@ -13065,16 +13741,22 @@ function buildRelayInspectPayload(relayUrl, rawHealth) {
     relayUrlMatchesOrigin,
     relayUrlMatchesPublicOrigin,
     publicOriginLooksLocal,
+    approvalEndpointSummary,
     connectorUiAvailable,
     hostedShareRedirectReady,
+    hostedReadinessSummary,
     deploymentSummary,
     capabilities: health?.capabilities || [],
-    recommendedCommands: compatible ? buildRelayServeRecommendedCommands(publicOrigin) : {},
+    recommendedCommands: buildRelayInspectRecommendedCommands({
+      publicOrigin,
+      compatible,
+      publicOriginLooksLocal
+    }),
     notes
   };
 }
 function createRelayCommand() {
-  const relay = new Command8("relay").description("Run the local connector relay prototype server");
+  const relay = new Command9("relay").description("Run the local connector relay prototype server");
   relay.addHelpText(
     "after",
     [
@@ -13112,7 +13794,10 @@ function createRelayCommand() {
     const connectorUiAvailable = server.connectorUiAvailable;
     const hostedShareRedirectReady = connectorUiAvailable && !publicOriginLooksLocal;
     const { shareLinkBaseUrl, statusApiBaseUrl } = buildAdvertisedRelayBases(publicOrigin);
-    const recommendedCommands = buildRelayServeRecommendedCommands(publicOrigin);
+    const recommendedCommands = buildRelayServeRecommendedCommands({
+      relayUrl: publicOrigin,
+      publicOriginLooksLocal
+    });
     const deploymentSummary = buildRelayDeploymentSummary({
       origin: server.origin,
       publicOrigin,
@@ -13126,6 +13811,21 @@ function createRelayCommand() {
       deploymentScope: "single-host",
       sameHostRestartPersists: true
     });
+    const hostedReadinessSummary = buildRelayHostedReadinessSummary({
+      compatible: true,
+      publicOriginSource,
+      publicOriginLooksLocal,
+      connectorUiAvailable,
+      hostedShareRedirectReady,
+      deploymentSummary
+    });
+    const approvalEndpointSummary = buildRelayApprovalEndpointSummary({
+      publicOriginSource,
+      publicOriginLooksLocal,
+      relayUrlMatchesPublicOrigin: null,
+      shareLinkBaseUrl,
+      statusApiBaseUrl
+    });
     const notes = relayHostedReadinessNotes({
       compatible: true,
       publicOrigin,
@@ -13144,6 +13844,8 @@ function createRelayCommand() {
       shareLinkBaseUrl,
       statusApiBaseUrl,
       publicOriginLooksLocal,
+      approvalEndpointSummary,
+      hostedReadinessSummary,
       deploymentSummary,
       port: server.port,
       healthUrl: `${server.origin}/health`,
@@ -13179,13 +13881,19 @@ function createRelayCommand() {
       );
       humanLine("share-link base", shareLinkBaseUrl);
       humanLine("status api base", statusApiBaseUrl);
+      humanLine("approval endpoint", approvalEndpointSummary.status);
       humanLine("health", `${server.origin}/health`);
+      humanLine("hosted readiness", hostedReadinessSummary.status);
       humanLine("hosted ready", hostedShareRedirectReady ? "yes" : "no");
       if (connectorUiAvailable !== null) {
         humanLine("connector ui", connectorUiAvailable ? "available" : "missing");
       }
+      humanLine("inspect relay", recommendedCommands.inspectRelay);
       humanLine("create wallet", recommendedCommands.createWallet);
       humanLine("reapprove wallet", recommendedCommands.reapproveWallet);
+      if (recommendedCommands.restartWithPublicOrigin) {
+        humanLine("restart with public origin", recommendedCommands.restartWithPublicOrigin);
+      }
       for (const note of notes) {
         humanLine("note", note);
       }
@@ -13247,6 +13955,8 @@ function createRelayCommand() {
     }
     humanLine("share-link base", payload.shareLinkBaseUrl);
     humanLine("status api base", payload.statusApiBaseUrl);
+    humanLine("approval endpoint", payload.approvalEndpointSummary.status);
+    humanLine("hosted readiness", payload.hostedReadinessSummary.status);
     if (payload.relayUrlMatchesOrigin !== null) {
       humanLine("relay url matches origin", payload.relayUrlMatchesOrigin ? "yes" : "no");
     }
@@ -13272,6 +13982,12 @@ function createRelayCommand() {
         humanLine("reapprove wallet", payload.recommendedCommands.reapproveWallet);
       }
     }
+    if (payload.recommendedCommands.restartWithPublicOrigin) {
+      humanLine(
+        "restart with public origin",
+        payload.recommendedCommands.restartWithPublicOrigin
+      );
+    }
     for (const note of payload.notes) {
       humanLine("note", note);
     }
@@ -13282,7 +13998,7 @@ function createRelayCommand() {
 // src/commands/wallet.ts
 import { createServer as createServer2 } from "node:http";
 import { createInterface } from "node:readline/promises";
-import { Command as Command9 } from "commander";
+import { Command as Command10 } from "commander";
 
 // ../account-profiles/src/profiles.ts
 import fs8 from "node:fs";
@@ -15217,7 +15933,9 @@ async function buildRelayStatusFollowUp(options) {
       walletName: options.relay.request?.walletName,
       relayUrl: options.relayUrl,
       paymasterMode: options.relay.request?.requestedPaymasterMode,
-      accountKind: options.relay.request?.requestedAccountKind
+      accountKind: options.relay.request?.requestedAccountKind,
+      sessionPolicies: options.relay.request?.policies,
+      requestCreatedAt: options.relay.request?.createdAt
     });
   }
   if (options.relay.approval_ready) {
@@ -15262,11 +15980,18 @@ async function buildRelayExpiredRecoveryCommands(options) {
     };
   }
   const existingWallet = await loadWalletSession(walletName);
-  const reissueRemoteApproval = existingWallet ? buildWalletReapproveRemoteRecommendedCommand(walletName, options.relayUrl) : buildWalletCreateRemoteRecommendedCommand(
+  const reissueRemoteApproval = existingWallet ? buildWalletReapproveRemoteRecommendedCommand(walletName, options.relayUrl, {
+    sessionPolicies: options.sessionPolicies,
+    requestCreatedAt: options.requestCreatedAt
+  }) : buildWalletCreateRemoteRecommendedCommand(
     options.relayUrl,
     options.paymasterMode,
     walletName,
-    options.accountKind
+    options.accountKind,
+    {
+      sessionPolicies: options.sessionPolicies,
+      requestCreatedAt: options.requestCreatedAt
+    }
   );
   return {
     nextAction: reissueRemoteApproval,
@@ -15274,7 +15999,7 @@ async function buildRelayExpiredRecoveryCommands(options) {
       relayInspect,
       reissueRemoteApproval
     },
-    note: "Relay approval expired. Reissue the remote request. If the original request used scoped session flags, add those same policy flags again."
+    note: "Relay approval expired. Reissue the remote request. The recovery command preserves any CLI-expressible session-policy flags from the expired request."
   };
 }
 function buildRelayApprovalTimeoutError(options) {
@@ -15318,7 +16043,9 @@ async function buildRelayApprovalExpiredError(options) {
     walletName: options.walletName,
     relayUrl: options.relayUrl,
     paymasterMode: options.paymasterMode,
-    accountKind: options.accountKind
+    accountKind: options.accountKind,
+    sessionPolicies: options.sessionPolicies,
+    requestCreatedAt: options.requestCreatedAt
   });
   return new AgentError(
     "RELAY_APPROVAL_EXPIRED",
@@ -15565,7 +16292,9 @@ async function finalizePublishedRelayWalletRequest(options) {
         walletName: options.walletRequest.walletName,
         relayUrl: options.relayUrl,
         paymasterMode: options.walletRequest.requestedPaymasterMode,
-        accountKind: options.walletRequest.requestedAccountKind
+        accountKind: options.walletRequest.requestedAccountKind,
+        sessionPolicies: options.walletRequest.policies,
+        requestCreatedAt: options.walletRequest.createdAt
       });
     }
     throw error;
@@ -15936,32 +16665,32 @@ async function printBuiltinSmartAccountProfiles() {
 }
 function createWalletCommand(deps) {
   const resolvedDeps = resolveWalletCommandDeps(deps);
-  const wallet = new Command9("wallet").description(
+  const wallet = new Command10("wallet").description(
     "Create, inspect, and recover local-first wallet sessions"
   );
-  const request = new Command9("request").description("Inspect and finalize pending wallet requests");
-  const signer = new Command9("signer").description(
+  const request = new Command10("request").description("Inspect and finalize pending wallet requests");
+  const signer = new Command10("signer").description(
     "Inspect and manage the stored local execution signer for a wallet"
   );
-  const smartAccount = new Command9("smart-account").description(
+  const smartAccount = new Command10("smart-account").description(
     "Predict and deploy zkSync smart-account contracts from a supplied artifact or built-in profile"
   );
-  const sedLite = new Command9("sed-lite").description(
+  const sedLite = new Command10("sed-lite").description(
     "Inspect and manage the SED modular smart-account profile"
   );
-  const nativeCapHook = new Command9("native-cap-hook").description(
+  const nativeCapHook = new Command10("native-cap-hook").description(
     "Inspect and manage the first SED Lite validation-hook policy: native per-transaction spend caps"
   );
-  const targetAllowlistHook = new Command9("target-allowlist-hook").description(
+  const targetAllowlistHook = new Command10("target-allowlist-hook").description(
     "Inspect and manage the SED Lite validation-hook policy that restricts transactions to an allowlisted target set"
   );
-  const selectorAllowlistHook = new Command9("selector-allowlist-hook").description(
+  const selectorAllowlistHook = new Command10("selector-allowlist-hook").description(
     "Inspect and manage the SED Lite validation-hook policy that restricts contract calls to allowlisted target and selector pairs"
   );
-  const dailySpendLimit = new Command9("daily-spend-limit").description(
+  const dailySpendLimit = new Command10("daily-spend-limit").description(
     "Read and update the native-token daily spend limit used by the built-in daily-spend-limit smart-account profile"
   );
-  const paymaster = new Command9("paymaster").description(
+  const paymaster = new Command10("paymaster").description(
     "Manage saved paymaster defaults for stored wallets"
   );
   wallet.addHelpText(
@@ -15969,6 +16698,9 @@ function createWalletCommand(deps) {
     [
       "",
       "Local-first wallet path:",
+      "  Use this layer when the blocker is specifically about wallet approval or signer state.",
+      "  Otherwise start with `zk-agent next` or `zk-agent doctor`.",
+      "",
       "  First bootstrap:",
       "    zk-agent wallet create --await-local",
       "    zk-agent next",
@@ -15989,7 +16721,8 @@ function createWalletCommand(deps) {
       "    zk-agent relay inspect --relay-url <url>",
       "    zk-agent wallet create --relay-url <url> --wait-relay --prompt-code",
       "    zk-agent wallet reapprove --name main --relay-url <url> --wait-relay --prompt-code",
-      "    zk-agent next"
+      "    zk-agent next",
+      "    Use this only when the browser is not colocated with the terminal."
     ].join("\n")
   );
   request.addHelpText(
@@ -16060,7 +16793,28 @@ function createWalletCommand(deps) {
   ).option("--disallow-transfers", "Disable transfer capability for the approved session").option(
     "--disallow-contract-calls",
     "Disable contract-call capability for the approved session"
-  ).option("--connector-url <url>", "Connector UI base URL override").option("--relay-url <url>", "Relay server base URL for immediate remote approval publishing").option("--account-kind <kind>", "Requested account kind", "smart-account").option("--paymaster-mode <mode>", "Requested paymaster mode", "none").option("--await-local", "Immediately wait for a local connector approval callback").option("--wait-relay", "Wait for relay approval readiness and finalize from the same command (requires --relay-url and either --code or --prompt-code)").option("--code <code>", "6-digit relay approval code used together with --wait-relay").option("--prompt-code", "Read the 6-digit relay approval code from stdin after the relay approval is ready").option("--host <host>", "Loopback host to bind when using --await-local", "127.0.0.1").option("--port <port>", "Loopback port to bind when using --await-local (0 = choose a free port)", "0").option("--timeout-seconds <seconds>", "How long to wait when using --await-local or --wait-relay", "600").option("--interval-ms <milliseconds>", "How often to poll relay status while using --wait-relay", "2000").action(
+  ).option("--connector-url <url>", "Connector UI base URL override").option("--relay-url <url>", "Relay server base URL for immediate remote approval publishing").option("--account-kind <kind>", "Requested account kind", "smart-account").option("--paymaster-mode <mode>", "Requested paymaster mode", "none").option("--await-local", "Immediately wait for a local connector approval callback").option("--wait-relay", "Wait for relay approval readiness and finalize from the same command (requires --relay-url and either --code or --prompt-code)").option("--code <code>", "6-digit relay approval code used together with --wait-relay").option("--prompt-code", "Read the 6-digit relay approval code from stdin after the relay approval is ready").option("--host <host>", "Loopback host to bind when using --await-local", "127.0.0.1").option("--port <port>", "Loopback port to bind when using --await-local (0 = choose a free port)", "0").option("--timeout-seconds <seconds>", "How long to wait when using --await-local or --wait-relay", "600").option("--interval-ms <milliseconds>", "How often to poll relay status while using --wait-relay", "2000").addHelpText(
+    "after",
+    [
+      "",
+      "Default wallet-create path:",
+      "  Keep `--await-local` as the local-first baseline when the browser and terminal are colocated.",
+      "",
+      "  Fresh bootstrap:",
+      "    zk-agent next",
+      "    zk-agent wallet create --await-local",
+      "    zk-agent next",
+      "",
+      "  Remote-browser fallback:",
+      "    zk-agent relay inspect --relay-url <url>",
+      "    zk-agent wallet create --relay-url <url> --wait-relay --prompt-code",
+      "    zk-agent next",
+      "",
+      "Environment note:",
+      "  No custom .env is required to create the wallet request itself.",
+      "  Add RPC env vars later, before live reads or broadcasts."
+    ].join("\n")
+  ).action(
     async (options) => {
       const config = await loadProjectConfig();
       const chain = options.chain || config?.defaultChain || "zksync-era";
@@ -16243,7 +16997,27 @@ function createWalletCommand(deps) {
   ).option("--disallow-transfers", "Disable transfer capability for the approved session").option(
     "--disallow-contract-calls",
     "Disable contract-call capability for the approved session"
-  ).option("--connector-url <url>", "Connector UI base URL override").option("--relay-url <url>", "Relay server base URL for immediate remote approval publishing").option("--await-local", "Immediately wait for a local connector approval callback").option("--wait-relay", "Wait for relay approval readiness and finalize from the same command (requires --relay-url and either --code or --prompt-code)").option("--code <code>", "6-digit relay approval code used together with --wait-relay").option("--prompt-code", "Read the 6-digit relay approval code from stdin after the relay approval is ready").option("--host <host>", "Loopback host to bind when using --await-local", "127.0.0.1").option("--port <port>", "Loopback port to bind when using --await-local (0 = choose a free port)", "0").option("--timeout-seconds <seconds>", "How long to wait when using --await-local or --wait-relay", "600").option("--interval-ms <milliseconds>", "How often to poll relay status while using --wait-relay", "2000").action(
+  ).option("--connector-url <url>", "Connector UI base URL override").option("--relay-url <url>", "Relay server base URL for immediate remote approval publishing").option("--await-local", "Immediately wait for a local connector approval callback").option("--wait-relay", "Wait for relay approval readiness and finalize from the same command (requires --relay-url and either --code or --prompt-code)").option("--code <code>", "6-digit relay approval code used together with --wait-relay").option("--prompt-code", "Read the 6-digit relay approval code from stdin after the relay approval is ready").option("--host <host>", "Loopback host to bind when using --await-local", "127.0.0.1").option("--port <port>", "Loopback port to bind when using --await-local (0 = choose a free port)", "0").option("--timeout-seconds <seconds>", "How long to wait when using --await-local or --wait-relay", "600").option("--interval-ms <milliseconds>", "How often to poll relay status while using --wait-relay", "2000").addHelpText(
+    "after",
+    [
+      "",
+      "Default wallet-reapprove path:",
+      "  Use this when the wallet already exists locally but its approval/session must be refreshed.",
+      "",
+      "  Colocated browser + terminal:",
+      "    zk-agent wallet reapprove --name main --await-local",
+      "    zk-agent next",
+      "",
+      "  Remote-browser fallback:",
+      "    zk-agent relay inspect --relay-url <url>",
+      "    zk-agent wallet reapprove --name main --relay-url <url> --wait-relay --prompt-code",
+      "    zk-agent next",
+      "",
+      "Environment note:",
+      "  No custom .env is required to create the reapproval request itself.",
+      "  Add RPC env vars later, before live reads or broadcasts."
+    ].join("\n")
+  ).action(
     async (options) => {
       const walletRecord = await requireWalletRecord(options.name);
       const request2 = await createWalletReapprovalRequest({
@@ -16526,14 +17300,45 @@ function createWalletCommand(deps) {
     const walletRecord = await loadWalletSession(options.name);
     if (!walletRecord) throw new Error(`Wallet not found: ${options.name}`);
     const { inspection, summary } = await loadWalletStatusSummary(walletRecord, resolvedDeps);
-    printResult(walletStatusLines(inspection, summary), { ok: true, inspection, summary });
+    const recommendedCommands = buildWalletNextRecommendedCommands(
+      walletRecord.walletName,
+      summary,
+      resolveEffectivePaymasterSelection(walletRecord)?.mode
+    );
+    const tokenDiscoverySummary = buildWalletTokenDiscoverySummary({
+      walletName: walletRecord.walletName,
+      chain: summary.chain,
+      nextAction: summary.recommendedCommand,
+      paymasterMode: resolveEffectivePaymasterSelection(walletRecord)?.mode,
+      recommendedCommands
+    });
+    printResult(
+      [
+        ...walletStatusLines(inspection, summary),
+        ["discover assets", recommendedCommands.discoverAssets],
+        ["discover owned tokens", recommendedCommands.discoverOwnedTokens],
+        ...recommendedCommands.discoverPaymasterTokens ? [["discover paymaster tokens", recommendedCommands.discoverPaymasterTokens]] : [],
+        ["discover tokens", recommendedCommands.discoverTokens],
+        ...recommendedCommands.inspectPaymasterToken ? [["inspect paymaster token", recommendedCommands.inspectPaymasterToken]] : [],
+        ["inspect token", recommendedCommands.inspectToken],
+        ["wallet next", buildWalletNextRecommendedCommand(walletRecord.walletName)]
+      ],
+      {
+        ok: true,
+        inspection,
+        summary,
+        tokenDiscoverySummary,
+        recommendedCommands
+      }
+    );
   });
   wallet.command("next").description("Explain the shortest next CLI steps to make a stored wallet operational").option("--name <name>", "Wallet name", "main").action(async (options) => {
     const walletRecord = await requireWalletRecord(options.name);
     const { inspection, summary } = await loadWalletStatusSummary(walletRecord, resolvedDeps);
     const recommendedCommands = buildWalletNextRecommendedCommands(
       walletRecord.walletName,
-      summary
+      summary,
+      resolveEffectivePaymasterSelection(walletRecord)?.mode
     );
     const tokenDiscoverySummary = buildWalletTokenDiscoverySummary({
       walletName: walletRecord.walletName,
@@ -16547,7 +17352,9 @@ function createWalletCommand(deps) {
         ...walletNextLines(summary),
         ["discover assets", recommendedCommands.discoverAssets],
         ["discover owned tokens", recommendedCommands.discoverOwnedTokens],
+        ...recommendedCommands.discoverPaymasterTokens ? [["discover paymaster tokens", recommendedCommands.discoverPaymasterTokens]] : [],
         ["discover tokens", recommendedCommands.discoverTokens],
+        ...recommendedCommands.inspectPaymasterToken ? [["inspect paymaster token", recommendedCommands.inspectPaymasterToken]] : [],
         ["inspect token", recommendedCommands.inspectToken],
         ["status command", recommendedCommands.walletStatus]
       ],
@@ -18512,7 +19319,7 @@ function createWalletCommand(deps) {
 
 // src/commands/workflow.ts
 import { randomBytes as randomBytes4 } from "node:crypto";
-import { Command as Command10 } from "commander";
+import { Command as Command11 } from "commander";
 var defaultProvider2 = new ZkSyncWalletProvider();
 var defaultDefiProvider2 = new ZkSyncDefiProvider({
   walletWriter: defaultProvider2
@@ -19152,7 +19959,69 @@ function withAgentProfileLines(lines, agentProfile, agentFollowup) {
     ...agentFollowup ? agentFollowupLines(agentFollowup) : []
   ];
 }
-async function printWorkflowRunCommandResult(execution) {
+function serializeWorkflowFundingProgress(fundingProgress) {
+  return fundingProgress ? {
+    kind: fundingProgress.kind,
+    txHash: fundingProgress.txHash,
+    status: fundingProgress.status,
+    terminal: fundingProgress.terminal,
+    finalized: fundingProgress.finalized
+  } : void 0;
+}
+function buildWorkflowRuntimeSummary(options) {
+  if (!options.status && !options.result) {
+    throw new Error("Workflow runtime summary requires a workflow status or execution result.");
+  }
+  const nextCommand = options.nextCommand ?? options.result?.nextCommand ?? options.status?.fundingProgress?.nextCommand ?? options.status?.recommendedCommand;
+  return {
+    status: options.result?.stage ?? options.status?.status ?? "blocked",
+    readyForGoal: options.result ? options.result.stage === "goal-executed" : Boolean(options.status?.readyForGoal),
+    nextCommand,
+    blockingActionIds: options.status?.blockingActionIds ?? [],
+    fundingProgress: serializeWorkflowFundingProgress(options.status?.fundingProgress)
+  };
+}
+function buildWorkflowEntrySummary(input) {
+  if (input.plan) {
+    return {
+      entrypoint: "workflow",
+      command: input.command,
+      source: input.source || null,
+      workflowRequestId: input.requestId || null,
+      walletName: input.plan.walletName,
+      intent: input.plan.intent,
+      runtimeStatus: input.plan.status,
+      readyForGoal: input.plan.readyForGoal,
+      walletApprovalStatus: null,
+      checkpointPersisted: typeof input.checkpointPersisted === "boolean" ? input.checkpointPersisted : null,
+      nextAction: input.nextCommand || input.plan.recommendedCommand || null
+    };
+  }
+  const runtimeSummary = buildWorkflowRuntimeSummary({
+    status: input.status,
+    result: input.result,
+    nextCommand: input.nextCommand
+  });
+  const walletName = input.result?.walletName ?? input.status?.walletName;
+  const intent = input.result?.intent ?? input.status?.intent;
+  if (!walletName || !intent) {
+    throw new Error("Workflow entry summary requires workflow status or execution metadata.");
+  }
+  return {
+    entrypoint: "workflow",
+    command: input.command,
+    source: input.source || null,
+    workflowRequestId: input.requestId || null,
+    walletName,
+    intent,
+    runtimeStatus: runtimeSummary.status,
+    readyForGoal: runtimeSummary.readyForGoal,
+    walletApprovalStatus: buildWorkflowWalletApprovalSummary(input.walletApproval)?.status || null,
+    checkpointPersisted: typeof input.checkpointPersisted === "boolean" ? input.checkpointPersisted : null,
+    nextAction: runtimeSummary.nextCommand || null
+  };
+}
+async function printWorkflowRunCommandResult(execution, command) {
   if (execution.result) {
     const agentProfile2 = await loadWorkflowAgentProfile(execution.result.walletName);
     const agentFollowup2 = buildAgentFollowup(agentProfile2, {
@@ -19175,6 +20044,21 @@ async function printWorkflowRunCommandResult(execution) {
       paymasterMode: execution.walletApproval?.request.requestedPaymasterMode ?? extractWorkflowGoalPaymasterMode(execution.goal),
       recommendedCommands: recommendedCommands2
     });
+    const summary2 = buildWorkflowRuntimeSummary({
+      status: execution.status,
+      result: execution.result,
+      nextCommand: execution.result.nextCommand
+    });
+    const workflowEntrySummary2 = buildWorkflowEntrySummary({
+      command,
+      source: execution.requestId ? "checkpoint" : "input",
+      requestId: execution.requestId,
+      checkpointPersisted: Boolean(execution.checkpoint || execution.requestId),
+      status: execution.status,
+      result: execution.result,
+      walletApproval: execution.walletApproval,
+      nextCommand: execution.result.nextCommand
+    });
     printResult(
       prependWorkflowRequestId(
         execution.requestId,
@@ -19191,47 +20075,62 @@ async function printWorkflowRunCommandResult(execution) {
       {
         ok: true,
         ...serializeWorkflowRequestMeta(execution.requestId),
+        workflowEntrySummary: workflowEntrySummary2,
         agentProfile: agentProfile2,
         agentFollowup: agentFollowup2,
+        summary: summary2,
         result: execution.result,
-        walletRequestId: execution.walletApproval?.request.requestId,
-        walletApprovalRelay: execution.walletApproval?.relay,
-        ...workflowWalletApprovalRelayAliases(execution.walletApproval?.relay),
-        walletApprovalRecommendedCommands: execution.walletApproval?.recommendedCommands,
-        walletApproval: serializeWalletApproval(execution.walletApproval),
+        ...serializeWorkflowWalletApprovalOutput(execution.walletApproval),
         tokenDiscoverySummary: tokenDiscoverySummary2,
         recommendedCommands: recommendedCommands2
       }
     );
     return;
   }
-  const agentProfile = await loadWorkflowAgentProfile(execution.status.walletName);
+  const status = execution.status;
+  if (!status) {
+    throw new Error("Workflow run result is missing both execution result and status.");
+  }
+  const agentProfile = await loadWorkflowAgentProfile(status.walletName);
   const agentFollowup = buildAgentFollowup(agentProfile, {
-    walletName: execution.status.walletName,
+    walletName: status.walletName,
     walletExists: true
   });
   const recommendedCommands = buildWorkflowRuntimeRecommendedCommands({
     requestId: execution.requestId,
-    walletName: execution.status.walletName,
-    nextAction: execution.status.recommendedCommand,
-    chain: execution.status.plan.chain,
-    intent: execution.status.intent,
+    walletName: status.walletName,
+    nextAction: status.recommendedCommand,
+    chain: status.plan.chain,
+    intent: status.intent,
     paymasterMode: execution.walletApproval?.request.requestedPaymasterMode ?? extractWorkflowGoalPaymasterMode(execution.checkpoint?.goal)
   });
   const tokenDiscoverySummary = buildWorkflowTokenDiscoverySummary({
-    walletName: execution.status.walletName,
-    chain: execution.status.plan.chain,
-    intent: execution.status.intent,
-    nextAction: execution.status.recommendedCommand,
+    walletName: status.walletName,
+    chain: status.plan.chain,
+    intent: status.intent,
+    nextAction: status.recommendedCommand,
     paymasterMode: execution.walletApproval?.request.requestedPaymasterMode ?? extractWorkflowGoalPaymasterMode(execution.checkpoint?.goal),
     recommendedCommands
   });
+  const summary = buildWorkflowRuntimeSummary({
+    status,
+    nextCommand: status.recommendedCommand
+  });
+  const workflowEntrySummary = buildWorkflowEntrySummary({
+    command,
+    source: execution.requestId ? "checkpoint" : "input",
+    requestId: execution.requestId,
+    checkpointPersisted: Boolean(execution.checkpoint || execution.requestId),
+    status,
+    walletApproval: execution.walletApproval,
+    nextCommand: status.recommendedCommand
+  });
   printResult(
     prependWorkflowRequestId(
       execution.requestId,
       withAgentProfileLines(
         [
-          ...workflowStatusLines(execution.status),
+          ...workflowStatusLines(status),
           ...workflowWalletApprovalLines(execution.walletApproval),
           ...workflowFollowupLines(recommendedCommands)
         ],
@@ -19242,15 +20141,13 @@ async function printWorkflowRunCommandResult(execution) {
     {
       ok: true,
       ...serializeWorkflowRequestMeta(execution.requestId),
+      workflowEntrySummary,
       agentProfile,
       agentFollowup,
-      status: execution.status,
+      summary,
+      status,
       checkpoint: execution.checkpoint,
-      walletRequestId: execution.walletApproval?.request.requestId,
-      walletApprovalRelay: execution.walletApproval?.relay,
-      ...workflowWalletApprovalRelayAliases(execution.walletApproval?.relay),
-      walletApprovalRecommendedCommands: execution.walletApproval?.recommendedCommands,
-      walletApproval: serializeWalletApproval(execution.walletApproval),
+      ...serializeWorkflowWalletApprovalOutput(execution.walletApproval),
       tokenDiscoverySummary,
       recommendedCommands
     }
@@ -19504,7 +20401,7 @@ async function executeWorkflowAutoCommand(options, deps = resolveWorkflowCommand
     walletApproval
   };
 }
-async function printWorkflowAutoCommandResult(execution) {
+async function printWorkflowAutoCommandResult(execution, command) {
   const agentProfile = await loadWorkflowAgentProfile(execution.status.walletName);
   const agentFollowup = buildAgentFollowup(agentProfile, {
     walletName: execution.status.walletName,
@@ -19527,6 +20424,21 @@ async function printWorkflowAutoCommandResult(execution) {
     paymasterMode: execution.walletApproval?.request.requestedPaymasterMode ?? extractWorkflowGoalPaymasterMode(execution.goal) ?? extractWorkflowGoalPaymasterMode(execution.checkpoint?.goal),
     recommendedCommands
   });
+  const summary = buildWorkflowRuntimeSummary({
+    status: execution.status,
+    result: execution.result,
+    nextCommand: nextAction
+  });
+  const workflowEntrySummary = buildWorkflowEntrySummary({
+    command,
+    source: execution.source,
+    requestId: execution.requestId,
+    checkpointPersisted: execution.checkpointPersisted,
+    status: execution.status,
+    result: execution.result,
+    walletApproval: execution.walletApproval,
+    nextCommand: nextAction
+  });
   const summaryLines = [
     ["source", execution.source],
     ["action", execution.action],
@@ -19553,16 +20465,14 @@ async function printWorkflowAutoCommandResult(execution) {
       action: execution.action,
       checkpointPersisted: execution.checkpointPersisted,
       ...serializeWorkflowRequestMeta(execution.requestId),
+      workflowEntrySummary,
       agentProfile,
       agentFollowup,
+      summary,
       status: execution.status,
       result: execution.result,
       checkpoint: execution.checkpoint,
-      walletRequestId: execution.walletApproval?.request.requestId,
-      walletApprovalRelay: execution.walletApproval?.relay,
-      ...workflowWalletApprovalRelayAliases(execution.walletApproval?.relay),
-      walletApprovalRecommendedCommands: execution.walletApproval?.recommendedCommands,
-      walletApproval: serializeWalletApproval(execution.walletApproval),
+      ...serializeWorkflowWalletApprovalOutput(execution.walletApproval),
       tokenDiscoverySummary,
       recommendedCommands
     }
@@ -19760,6 +20670,7 @@ function serializeWalletApproval(walletApproval) {
   if (!walletApproval) return void 0;
   return {
     ...walletApproval,
+    summary: buildWorkflowWalletApprovalSummary(walletApproval),
     ...workflowWalletApprovalRelayAliases(walletApproval.relay, {
       shareLinkBaseField: "relayShareLinkBaseUrl",
       statusApiBaseField: "relayStatusApiBaseUrl"
@@ -19769,6 +20680,34 @@ function serializeWalletApproval(walletApproval) {
     wallet: walletApproval.wallet ? sanitizeWalletRecord(walletApproval.wallet) : void 0
   };
 }
+function buildWorkflowWalletApprovalSummary(walletApproval) {
+  if (!walletApproval) return void 0;
+  let status = "await-local";
+  if (walletApproval.stage === "approved") {
+    status = "approved";
+  } else if (walletApproval.recommendedCommands?.relayStatus && walletApproval.nextCommand === walletApproval.recommendedCommands.relayStatus) {
+    status = "relay-pending";
+  }
+  return {
+    status,
+    walletRequestId: walletApproval.request.requestId,
+    reusedRequest: walletApproval.reusedRequest,
+    relayPublished: Boolean(walletApproval.relay),
+    nextAction: walletApproval.nextCommand,
+    afterApproval: walletApproval.recommendedCommands?.afterApproval || null,
+    afterApprovalStatus: walletApproval.recommendedCommands?.afterApprovalStatus || null
+  };
+}
+function serializeWorkflowWalletApprovalOutput(walletApproval) {
+  return {
+    walletRequestId: walletApproval?.request.requestId,
+    walletApprovalRelay: walletApproval?.relay,
+    ...workflowWalletApprovalRelayAliases(walletApproval?.relay),
+    walletApprovalRecommendedCommands: walletApproval?.recommendedCommands,
+    walletApprovalSummary: buildWorkflowWalletApprovalSummary(walletApproval),
+    walletApproval: serializeWalletApproval(walletApproval)
+  };
+}
 function workflowWalletApprovalRelayAliases(relay, fieldNames = {
   shareLinkBaseField: "walletApprovalRelayShareLinkBaseUrl",
   statusApiBaseField: "walletApprovalRelayStatusApiBaseUrl"
@@ -20120,7 +21059,7 @@ function applyWorkflowHelpCommandOrder(workflow) {
 }
 function createWorkflowCommand(deps) {
   const resolvedDeps = resolveWorkflowCommandDeps(deps);
-  const workflow = new Command10("workflow").description(
+  const workflow = new Command11("workflow").description(
     "Plan, persist, and execute higher-level wallet workflows"
   );
   workflow.addHelpText("after", buildWorkflowHelpText());
@@ -20159,6 +21098,13 @@ function createWorkflowCommand(deps) {
         walletName: plan.walletName,
         walletExists: true
       });
+      const workflowEntrySummary = buildWorkflowEntrySummary({
+        command: "plan",
+        source: "input",
+        checkpointPersisted: false,
+        plan,
+        nextCommand: plan.recommendedCommand
+      });
       printResult(
         withAgentProfileLines(
           [...workflowPlanLines(plan), ...workflowFollowupLines(recommendedCommands)],
@@ -20167,6 +21113,7 @@ function createWorkflowCommand(deps) {
         ),
         {
           ok: true,
+          workflowEntrySummary,
           agentProfile,
           agentFollowup,
           inspection,
@@ -20308,6 +21255,14 @@ function createWorkflowCommand(deps) {
       {
         ok: true,
         ...serializeWorkflowRequestMeta(started.requestId),
+        workflowEntrySummary: buildWorkflowEntrySummary({
+          command: "start",
+          source: "input",
+          requestId: started.requestId,
+          checkpointPersisted: true,
+          status: started.status,
+          nextCommand: started.status.recommendedCommand
+        }),
         agentProfile,
         agentFollowup,
         checkpoint: started.checkpoint,
@@ -20327,7 +21282,7 @@ function createWorkflowCommand(deps) {
     includeLocalApproval: true
   }).action(withWorkflowInputErrorHandling(async (options) => {
     const execution = await executeWorkflowAutoCommand(options, resolvedDeps);
-    await printWorkflowAutoCommandResult(execution);
+    await printWorkflowAutoCommandResult(execution, "auto");
   }));
   const pay = workflow.command("pay").description(
     "Guided flagship AA native-send path with checkpoint persistence, intent-scoped session recovery, and paymaster-aware defaults"
@@ -20344,7 +21299,7 @@ function createWorkflowCommand(deps) {
       applyWorkflowPayDefaults(options),
       resolvedDeps
     );
-    await printWorkflowAutoCommandResult(execution);
+    await printWorkflowAutoCommandResult(execution, "pay");
   }));
   const run = workflow.command("run").description("Run the requested workflow, or stop on the next required prerequisite or funding step first").option(
     "--intent <intent>",
@@ -20356,7 +21311,7 @@ function createWorkflowCommand(deps) {
     includeLocalApproval: true
   }).action(withWorkflowInputErrorHandling(async (options) => {
     const execution = await executeWorkflowRunCommand(options, resolvedDeps);
-    await printWorkflowRunCommandResult(execution);
+    await printWorkflowRunCommandResult(execution, "run");
   }));
   const status = workflow.command("status").description("Inspect whether a workflow is blocked, still waiting on funding, or ready to resume").option(
     "--intent <intent>",
@@ -20388,6 +21343,19 @@ function createWorkflowCommand(deps) {
       walletName: inspection.result.walletName,
       walletExists: true
     });
+    const summary = buildWorkflowRuntimeSummary({
+      status: inspection.result,
+      nextCommand: inspection.result.recommendedCommand
+    });
+    const workflowEntrySummary = buildWorkflowEntrySummary({
+      command: "status",
+      source: options.requestId?.trim() ? "checkpoint" : "input",
+      requestId: inspection.requestId,
+      checkpointPersisted: Boolean(inspection.checkpoint),
+      status: inspection.result,
+      walletApproval: inspection.walletApproval,
+      nextCommand: inspection.result.recommendedCommand
+    });
     printResult(
       prependWorkflowRequestId(
         inspection.requestId,
@@ -20404,15 +21372,13 @@ function createWorkflowCommand(deps) {
       {
         ok: true,
         ...serializeWorkflowRequestMeta(inspection.requestId),
+        workflowEntrySummary,
         agentProfile,
         agentFollowup,
+        summary,
         result: inspection.result,
         checkpoint: inspection.checkpoint,
-        walletRequestId: inspection.walletApproval?.request.requestId,
-        walletApprovalRelay: inspection.walletApproval?.relay,
-        ...workflowWalletApprovalRelayAliases(inspection.walletApproval?.relay),
-        walletApprovalRecommendedCommands: inspection.walletApproval?.recommendedCommands,
-        walletApproval: serializeWalletApproval(inspection.walletApproval),
+        ...serializeWorkflowWalletApprovalOutput(inspection.walletApproval),
         tokenDiscoverySummary,
         recommendedCommands
       }
@@ -20449,6 +21415,19 @@ function createWorkflowCommand(deps) {
       walletName: inspection.result.walletName,
       walletExists: true
     });
+    const summary = buildWorkflowRuntimeSummary({
+      status: inspection.result,
+      nextCommand
+    });
+    const workflowEntrySummary = buildWorkflowEntrySummary({
+      command: "next",
+      source: options.requestId?.trim() ? "checkpoint" : "input",
+      requestId: inspection.requestId,
+      checkpointPersisted: Boolean(inspection.checkpoint),
+      status: inspection.result,
+      walletApproval: inspection.walletApproval,
+      nextCommand
+    });
     printResult(
       prependWorkflowRequestId(
         inspection.requestId,
@@ -20465,28 +21444,13 @@ function createWorkflowCommand(deps) {
       {
         ok: true,
         ...serializeWorkflowRequestMeta(inspection.requestId),
+        workflowEntrySummary,
         agentProfile,
         agentFollowup,
-        summary: {
-          status: inspection.result.status,
-          readyForGoal: inspection.result.readyForGoal,
-          nextCommand,
-          blockingActionIds: inspection.result.blockingActionIds,
-          fundingProgress: inspection.result.fundingProgress ? {
-            kind: inspection.result.fundingProgress.kind,
-            txHash: inspection.result.fundingProgress.txHash,
-            status: inspection.result.fundingProgress.status,
-            terminal: inspection.result.fundingProgress.terminal,
-            finalized: inspection.result.fundingProgress.finalized
-          } : void 0
-        },
+        summary,
         result: inspection.result,
         checkpoint: inspection.checkpoint,
-        walletRequestId: inspection.walletApproval?.request.requestId,
-        walletApprovalRelay: inspection.walletApproval?.relay,
-        ...workflowWalletApprovalRelayAliases(inspection.walletApproval?.relay),
-        walletApprovalRecommendedCommands: inspection.walletApproval?.recommendedCommands,
-        walletApproval: serializeWalletApproval(inspection.walletApproval),
+        ...serializeWorkflowWalletApprovalOutput(inspection.walletApproval),
         tokenDiscoverySummary,
         recommendedCommands
       }
@@ -20524,6 +21488,19 @@ function createWorkflowCommand(deps) {
         walletName: inspection.result.walletName,
         walletExists: true
       });
+      const summary2 = buildWorkflowRuntimeSummary({
+        status: inspection.result,
+        nextCommand: inspection.result.recommendedCommand
+      });
+      const workflowEntrySummary2 = buildWorkflowEntrySummary({
+        command: "resume",
+        source: options.requestId?.trim() ? "checkpoint" : "input",
+        requestId: inspection.requestId,
+        checkpointPersisted: Boolean(inspection.checkpoint),
+        status: inspection.result,
+        walletApproval: inspection.walletApproval,
+        nextCommand: inspection.result.recommendedCommand
+      });
       printResult(
         prependWorkflowRequestId(
           inspection.requestId,
@@ -20540,15 +21517,13 @@ function createWorkflowCommand(deps) {
         {
           ok: true,
           ...serializeWorkflowRequestMeta(inspection.requestId),
+          workflowEntrySummary: workflowEntrySummary2,
           agentProfile: agentProfile2,
           agentFollowup: agentFollowup2,
+          summary: summary2,
           status: inspection.result,
           checkpoint: inspection.checkpoint,
-          walletRequestId: inspection.walletApproval.request.requestId,
-          walletApprovalRelay: inspection.walletApproval.relay,
-          ...workflowWalletApprovalRelayAliases(inspection.walletApproval.relay),
-          walletApprovalRecommendedCommands: inspection.walletApproval.recommendedCommands,
-          walletApproval: serializeWalletApproval(inspection.walletApproval),
+          ...serializeWorkflowWalletApprovalOutput(inspection.walletApproval),
           tokenDiscoverySummary: tokenDiscoverySummary2,
           recommendedCommands: recommendedCommands2
         }
@@ -20564,33 +21539,50 @@ function createWorkflowCommand(deps) {
       resolvedDeps
     );
     if (!execution.result) {
+      const status2 = execution.status;
+      if (!status2) {
+        throw new Error("Workflow resume result is missing both execution result and status.");
+      }
       const recommendedCommands2 = buildWorkflowRuntimeRecommendedCommands({
         requestId: execution.requestId,
-        walletName: execution.status.walletName,
-        nextAction: execution.status.recommendedCommand,
-        chain: execution.status.plan.chain,
-        intent: execution.status.intent,
+        walletName: status2.walletName,
+        nextAction: status2.recommendedCommand,
+        chain: status2.plan.chain,
+        intent: status2.intent,
         paymasterMode: execution.walletApproval?.request.requestedPaymasterMode ?? extractWorkflowGoalPaymasterMode(execution.checkpoint?.goal)
       });
       const tokenDiscoverySummary2 = buildWorkflowTokenDiscoverySummary({
-        walletName: execution.status.walletName,
-        chain: execution.status.plan.chain,
-        intent: execution.status.intent,
-        nextAction: execution.status.recommendedCommand,
+        walletName: status2.walletName,
+        chain: status2.plan.chain,
+        intent: status2.intent,
+        nextAction: status2.recommendedCommand,
         paymasterMode: execution.walletApproval?.request.requestedPaymasterMode ?? extractWorkflowGoalPaymasterMode(execution.checkpoint?.goal),
         recommendedCommands: recommendedCommands2
       });
-      const agentProfile2 = await loadWorkflowAgentProfile(execution.status.walletName);
+      const agentProfile2 = await loadWorkflowAgentProfile(status2.walletName);
       const agentFollowup2 = buildAgentFollowup(agentProfile2, {
-        walletName: execution.status.walletName,
+        walletName: status2.walletName,
         walletExists: true
       });
+      const summary2 = buildWorkflowRuntimeSummary({
+        status: status2,
+        nextCommand: status2.recommendedCommand
+      });
+      const workflowEntrySummary2 = buildWorkflowEntrySummary({
+        command: "resume",
+        source: options.requestId?.trim() ? "checkpoint" : "input",
+        requestId: execution.requestId,
+        checkpointPersisted: Boolean(execution.checkpoint || execution.requestId),
+        status: status2,
+        walletApproval: execution.walletApproval,
+        nextCommand: status2.recommendedCommand
+      });
       printResult(
         prependWorkflowRequestId(
           execution.requestId,
           withAgentProfileLines(
             [
-              ...workflowStatusLines(execution.status),
+              ...workflowStatusLines(status2),
               ...workflowWalletApprovalLines(execution.walletApproval),
               ...workflowFollowupLines(recommendedCommands2)
             ],
@@ -20601,15 +21593,13 @@ function createWorkflowCommand(deps) {
         {
           ok: true,
           ...serializeWorkflowRequestMeta(execution.requestId),
+          workflowEntrySummary: workflowEntrySummary2,
           agentProfile: agentProfile2,
           agentFollowup: agentFollowup2,
-          status: execution.status,
+          summary: summary2,
+          status: status2,
           checkpoint: execution.checkpoint,
-          walletRequestId: execution.walletApproval?.request.requestId,
-          walletApprovalRelay: execution.walletApproval?.relay,
-          ...workflowWalletApprovalRelayAliases(execution.walletApproval?.relay),
-          walletApprovalRecommendedCommands: execution.walletApproval?.recommendedCommands,
-          walletApproval: serializeWalletApproval(execution.walletApproval),
+          ...serializeWorkflowWalletApprovalOutput(execution.walletApproval),
           tokenDiscoverySummary: tokenDiscoverySummary2,
           recommendedCommands: recommendedCommands2
         }
@@ -20637,6 +21627,21 @@ function createWorkflowCommand(deps) {
       walletName: execution.result.walletName,
       walletExists: true
     });
+    const summary = buildWorkflowRuntimeSummary({
+      status: inspection.result,
+      result: execution.result,
+      nextCommand: execution.result.nextCommand ?? inspection.result.recommendedCommand
+    });
+    const workflowEntrySummary = buildWorkflowEntrySummary({
+      command: "resume",
+      source: options.requestId?.trim() ? "checkpoint" : "input",
+      requestId: execution.requestId,
+      checkpointPersisted: Boolean(execution.checkpoint || execution.requestId),
+      status: inspection.result,
+      result: execution.result,
+      walletApproval: inspection.walletApproval,
+      nextCommand: execution.result.nextCommand ?? inspection.result.recommendedCommand
+    });
     printResult(
       prependWorkflowRequestId(
         execution.requestId,
@@ -20653,15 +21658,13 @@ function createWorkflowCommand(deps) {
       {
         ok: true,
         ...serializeWorkflowRequestMeta(execution.requestId),
+        workflowEntrySummary,
         agentProfile,
         agentFollowup,
+        summary,
         status: inspection.result,
         result: execution.result,
-        walletRequestId: inspection.walletApproval?.request.requestId,
-        walletApprovalRelay: inspection.walletApproval?.relay,
-        ...workflowWalletApprovalRelayAliases(inspection.walletApproval?.relay),
-        walletApprovalRecommendedCommands: inspection.walletApproval?.recommendedCommands,
-        walletApproval: serializeWalletApproval(inspection.walletApproval),
+        ...serializeWorkflowWalletApprovalOutput(inspection.walletApproval),
         tokenDiscoverySummary,
         recommendedCommands
       }
@@ -20681,7 +21684,7 @@ function createWorkflowCommand(deps) {
         },
         resolvedDeps
       );
-      await printWorkflowRunCommandResult(execution);
+      await printWorkflowRunCommandResult(execution, intent);
     }));
   }
   workflow.addCommand(
@@ -20710,6 +21713,13 @@ function buildDefaultOperatorPathHelpText() {
     "  zk-agent next",
     `  ${buildWorkflowPayRecommendedCommand("main")}`,
     "",
+    "Validated first-run baseline:",
+    "  setup defaults to zksync-sepolia and the local connector at http://localhost:4444",
+    "  Override those only when you intentionally target a different chain or connector deployment.",
+    "",
+    "If local setup or wallet state is unclear:",
+    "  zk-agent doctor",
+    "",
     "No custom .env is required for setup, next, or wallet create/reapprove request generation.",
     "Add RPC env vars later, before live reads or broadcasts.",
     "",
@@ -20720,6 +21730,7 @@ function buildDefaultOperatorPathHelpText() {
 }
 var ROOT_HELP_COMMAND_ORDER = [
   "next",
+  "doctor",
   "init",
   "wallet",
   "workflow",
@@ -20756,13 +21767,14 @@ function applyRootHelpCommandOrder(program) {
   program.commands = sortedCommands;
 }
 function createProgram() {
-  const program = new Command11().name("zk-agent").description(
+  const program = new Command12().name("zk-agent").description(
     "Local-first zkSync Era CLI for wallet approval, workflow execution, and hosted relay recovery"
   ).showHelpAfterError().option("--json", "Force JSON output for agent harnesses", false).hook("preAction", (thisCommand) => {
     if (thisCommand.optsWithGlobals().json) process.env.ZK_AGENT_OUTPUT = "json";
   });
   program.addCommand(createInitCommand());
   program.addCommand(createNextCommand());
+  program.addCommand(createDoctorCommand());
   program.addCommand(createAgentCommand());
   program.addCommand(createDefaultsCommand());
   program.addCommand(createTokensCommand());