zk-credits 0.1.0

package/dist/zk-credits.js

@@ -0,0 +1,1087 @@
+#!/usr/bin/env node
+import { createRequire as __createNodeRequire } from 'node:module'; const require = __createNodeRequire(import.meta.url);
+
+// dist/cli.js
+import { homedir } from "node:os";
+import { join as join4 } from "node:path";
+
+// dist/codex-launcher.js
+import { spawn } from "node:child_process";
+
+// dist/codex-profile.js
+import { randomBytes } from "node:crypto";
+import { chmod, mkdir, rename, stat, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+var CODEX_PROFILE_NAME = "zk-credits";
+var DEFAULT_CODEX_MODEL = "openai/gpt-4o-mini";
+function resolveCodexHome(environment, userHome) {
+  return environment.CODEX_HOME || join(userHome, ".codex");
+}
+function tomlString(value) {
+  return JSON.stringify(value);
+}
+function providerBaseUrl(loopbackBaseUrl2) {
+  const url = new URL(loopbackBaseUrl2);
+  if (url.protocol !== "http:" || url.hostname !== "127.0.0.1") {
+    throw new Error("Codex provider must use a 127.0.0.1 HTTP sidecar URL");
+  }
+  return `${url.origin}/v1`;
+}
+function codexProfilePath(codexHome) {
+  return join(codexHome, `${CODEX_PROFILE_NAME}.config.toml`);
+}
+function renderCodexProfile(options) {
+  const model = options.model?.trim() || DEFAULT_CODEX_MODEL;
+  return [
+    `model = ${tomlString(model)}`,
+    'model_provider = "zk_credits"',
+    "",
+    "[model_providers.zk_credits]",
+    'name = "ZK Credits"',
+    `base_url = ${tomlString(providerBaseUrl(options.loopbackBaseUrl))}`,
+    'wire_api = "responses"',
+    "",
+    "[model_providers.zk_credits.auth]",
+    'command = "zk-credits"',
+    'args = ["token"]',
+    "refresh_interval_ms = 0",
+    ""
+  ].join("\n");
+}
+function codexModelsResponse() {
+  return {
+    models: [{
+      slug: DEFAULT_CODEX_MODEL,
+      display_name: "GPT-4o Mini (ZK Credits)",
+      description: "OpenRouter coding model paid with private ZK Credits tickets.",
+      default_reasoning_level: null,
+      supported_reasoning_levels: [],
+      shell_type: "shell_command",
+      visibility: "list",
+      supported_in_api: true,
+      priority: 1,
+      additional_speed_tiers: [],
+      service_tiers: [],
+      default_service_tier: null,
+      availability_nux: null,
+      upgrade: null,
+      base_instructions: [
+        "You are Codex, a coding agent. Follow the user's instructions carefully.",
+        "Use the provided tools when needed, preserve existing work, and verify changes before claiming completion."
+      ].join(" "),
+      include_skills_usage_instructions: true,
+      include_plugin_usage_instructions: true,
+      include_apps_usage_instructions: true,
+      supports_reasoning_summary_parameter: false,
+      default_reasoning_summary: "none",
+      support_verbosity: false,
+      default_verbosity: null,
+      apply_patch_tool_type: "freeform",
+      web_search_tool_type: "text",
+      truncation_policy: { mode: "tokens", limit: 1e4 },
+      supports_parallel_tool_calls: true,
+      supports_image_detail_original: false,
+      context_window: 128e3,
+      max_context_window: 128e3,
+      experimental_supported_tools: [],
+      input_modalities: ["text", "image"],
+      supports_search_tool: false,
+      use_responses_lite: false,
+      tool_mode: "direct"
+    }]
+  };
+}
+async function writeCodexProfile(options) {
+  await mkdir(options.codexHome, { recursive: true, mode: 448 });
+  const profilePath = codexProfilePath(options.codexHome);
+  const temporaryPath = `${profilePath}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+  await writeFile(temporaryPath, renderCodexProfile(options), { encoding: "utf8", mode: 384 });
+  await chmod(temporaryPath, 384);
+  await rename(temporaryPath, profilePath);
+  await chmod(profilePath, 384);
+  return profilePath;
+}
+async function isCodexProfileInstalled(codexHome) {
+  try {
+    return (await stat(codexProfilePath(codexHome))).isFile();
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return false;
+    throw error;
+  }
+}
+
+// dist/codex-launcher.js
+var spawnCommand = (command, args, options) => spawn(command, args, options);
+async function launchCodexProcess(args, spawnImpl = spawnCommand) {
+  const child = spawnImpl("codex", ["--profile", CODEX_PROFILE_NAME, ...args], { stdio: "inherit" });
+  return new Promise((resolve2, reject) => {
+    child.once("error", (error) => {
+      if (error.code === "ENOENT") {
+        reject(new Error("Codex CLI was not found; install it before running zk-credits codex"));
+        return;
+      }
+      reject(error);
+    });
+    child.once("exit", (code) => resolve2(code ?? 1));
+  });
+}
+
+// dist/identity.js
+import * as keytar from "keytar";
+
+// ../zk-credits-shared/dist/crypto.js
+import { entropyToMnemonic, mnemonicToEntropy } from "@scure/bip39";
+import { wordlist } from "@scure/bip39/wordlists/english.js";
+var FR_ORDER = "0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001";
+var FIELD_ORDER = BigInt(FR_ORDER);
+var MIMC_ROUNDS = 220;
+var MEMBERSHIP_TREE_DEPTH = 3;
+var MEMBERSHIP_TREE_CAPACITY = 2 ** MEMBERSHIP_TREE_DEPTH;
+var mimcConstantsPromise = null;
+function toHexBytes(secretK) {
+  return Array.from(secretK).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+function recoverSecretK(mnemonic) {
+  return mnemonicToEntropy(mnemonic.trim(), wordlist);
+}
+function skToField(secretK) {
+  const val = BigInt("0x" + toHexBytes(secretK));
+  return (val % FIELD_ORDER).toString();
+}
+function mod(value) {
+  const reduced = value % FIELD_ORDER;
+  return reduced < 0n ? reduced + FIELD_ORDER : reduced;
+}
+async function mimcConstants() {
+  if (!mimcConstantsPromise) {
+    const { buildMimcSponge } = await import("circomlibjs");
+    mimcConstantsPromise = buildMimcSponge().then((mimc) => mimc.cts.map((constant) => BigInt(mimc.F.toObject(constant).toString())));
+  }
+  return mimcConstantsPromise;
+}
+function pow5(value) {
+  const square = mod(value * value);
+  return mod(mod(square * square) * value);
+}
+function mimcFeistel(leftInput, rightInput, constants) {
+  let left = mod(leftInput);
+  let right = mod(rightInput);
+  for (let round = 0; round < MIMC_ROUNDS; round += 1) {
+    const constant = round === 0 || round === MIMC_ROUNDS - 1 ? 0n : constants[round];
+    const previousRight = right;
+    const powered = pow5(left + constant);
+    if (round < MIMC_ROUNDS - 1) {
+      right = left;
+      left = mod(previousRight + powered);
+    } else {
+      right = mod(previousRight + powered);
+    }
+  }
+  return { left, right };
+}
+async function mimcHash(inputs) {
+  if (inputs.length === 0)
+    throw new Error("MiMCSponge requires an input");
+  const constants = await mimcConstants();
+  let rate = 0n;
+  let capacity = 0n;
+  for (const input of inputs) {
+    rate = mod(rate + input);
+    const state = mimcFeistel(rate, capacity, constants);
+    rate = state.left;
+    capacity = state.right;
+  }
+  return rate.toString();
+}
+function normalizeField(value, label) {
+  let field;
+  try {
+    field = BigInt(value);
+  } catch {
+    throw new Error(`Invalid ${label}`);
+  }
+  if (field < 0n || field >= FIELD_ORDER)
+    throw new Error(`Invalid ${label}`);
+  return field.toString();
+}
+async function setSnapshotLeaf(layers, leafIndex, leaf) {
+  layers[0][leafIndex] = leaf;
+  let index = leafIndex;
+  for (let level = 0; level < MEMBERSHIP_TREE_DEPTH; level++) {
+    const left = BigInt(layers[level][index & ~1]);
+    const right = BigInt(layers[level][index & ~1 | 1]);
+    const parentIndex = Math.floor(index / 2);
+    layers[level + 1][parentIndex] = await mimcHash([left, right]);
+    index = parentIndex;
+  }
+}
+async function normalizedSnapshotLayers(snapshot) {
+  if (snapshot.depth !== MEMBERSHIP_TREE_DEPTH) {
+    throw new Error(`Unsupported membership-tree depth: ${snapshot.depth}`);
+  }
+  if (!Array.isArray(snapshot.leaves) || snapshot.leaves.length !== MEMBERSHIP_TREE_CAPACITY) {
+    throw new Error(`Expected ${MEMBERSHIP_TREE_CAPACITY} membership leaves`);
+  }
+  const leaves = snapshot.leaves.map((leaf, index) => normalizeField(leaf, `membership leaf ${index}`));
+  if (!snapshot.layers) {
+    const layers2 = Array.from({ length: MEMBERSHIP_TREE_DEPTH + 1 }, (_, level) => Array(2 ** (MEMBERSHIP_TREE_DEPTH - level)).fill("0"));
+    for (let index = 0; index < leaves.length; index++) {
+      if (leaves[index] !== "0")
+        await setSnapshotLeaf(layers2, index, leaves[index]);
+    }
+    return layers2;
+  }
+  if (!Array.isArray(snapshot.layers) || snapshot.layers.length !== MEMBERSHIP_TREE_DEPTH + 1) {
+    throw new Error("Invalid membership-tree layers");
+  }
+  const layers = snapshot.layers.map((layer, level) => {
+    const expectedLength = 2 ** (MEMBERSHIP_TREE_DEPTH - level);
+    if (!Array.isArray(layer) || layer.length !== expectedLength) {
+      throw new Error(`Invalid membership-tree layer ${level}`);
+    }
+    return layer.map((node, index) => normalizeField(node, `membership node ${level}:${index}`));
+  });
+  if (layers[0].some((leaf, index) => leaf !== leaves[index])) {
+    throw new Error("Membership-tree leaves do not match its layers");
+  }
+  const zeroParent = await mimcHash([0n, 0n]);
+  for (let level = 0; level < MEMBERSHIP_TREE_DEPTH; level++) {
+    for (let index = 0; index < layers[level + 1].length; index++) {
+      const left = layers[level][index * 2];
+      const right = layers[level][index * 2 + 1];
+      const parent = layers[level + 1][index];
+      if (left === "0" && right === "0") {
+        if (parent !== "0" && parent !== zeroParent) {
+          throw new Error("Invalid empty membership-tree branch");
+        }
+      } else if (parent !== await mimcHash([BigInt(left), BigInt(right)])) {
+        throw new Error("Invalid membership-tree parent");
+      }
+    }
+  }
+  return layers;
+}
+async function deriveMembershipWitness(commitment, snapshot) {
+  const normalizedCommitment = normalizeField(commitment, "membership commitment");
+  if (normalizedCommitment === "0")
+    throw new Error("Membership commitment is not active");
+  const layers = await normalizedSnapshotLayers(snapshot);
+  const root = normalizeField(snapshot.root, "membership root");
+  if (layers[MEMBERSHIP_TREE_DEPTH][0] !== root) {
+    throw new Error("Membership-tree root does not match its layers");
+  }
+  const matchingIndices = layers[0].map((leaf, index2) => leaf === normalizedCommitment ? index2 : -1).filter((index2) => index2 >= 0);
+  if (matchingIndices.length !== 1) {
+    throw new Error("Membership commitment must appear exactly once in the public snapshot");
+  }
+  const merklePathElements = [];
+  const merklePathIndices = [];
+  let node = normalizedCommitment;
+  let index = matchingIndices[0];
+  for (let level = 0; level < MEMBERSHIP_TREE_DEPTH; level++) {
+    const sibling = layers[level][index ^ 1];
+    const isRight = index & 1;
+    merklePathElements.push(sibling);
+    merklePathIndices.push(isRight.toString());
+    node = isRight ? await mimcHash([BigInt(sibling), BigInt(node)]) : await mimcHash([BigInt(node), BigInt(sibling)]);
+    index = Math.floor(index / 2);
+  }
+  if (node !== root)
+    throw new Error("Membership witness does not reproduce the snapshot root");
+  return {
+    root,
+    leafIndex: matchingIndices[0],
+    merklePathElements,
+    merklePathIndices
+  };
+}
+function normalizeForCanonicalJson(value) {
+  if (value === null || typeof value === "string" || typeof value === "boolean")
+    return value;
+  if (typeof value === "number")
+    return Number.isFinite(value) ? value : null;
+  if (Array.isArray(value))
+    return value.map((item) => normalizeForCanonicalJson(item));
+  if (value !== null && typeof value === "object") {
+    const object = value;
+    return Object.fromEntries(Object.keys(object).sort().map((key) => [key, normalizeForCanonicalJson(object[key])]));
+  }
+  return null;
+}
+function canonicalizeRequest(request) {
+  return JSON.stringify(normalizeForCanonicalJson(request));
+}
+async function requestDigestToField(request) {
+  const canonical = canonicalizeRequest(request);
+  const digestBytes = new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(canonical)));
+  const digest = Array.from(digestBytes).map((byte) => byte.toString(16).padStart(2, "0")).join("");
+  return { canonical, digest, field: mod(BigInt(`0x${digest}`)).toString() };
+}
+
+// ../zk-credits-shared/dist/proof.js
+import { groth16 } from "snarkjs";
+var ProofSelfVerificationError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ProofSelfVerificationError";
+  }
+};
+async function proveGroth16(input, wasm, zkey) {
+  const { proof, publicSignals } = await groth16.fullProve(input, wasm, zkey);
+  return { proof, publicSignals };
+}
+async function verifyGroth16Proof(verificationKey, publicSignals, proof) {
+  return groth16.verify(verificationKey, publicSignals, proof);
+}
+async function generateRlnProofSelfVerified(input, resources) {
+  const result = await proveGroth16(input, resources.rlnWasm, resources.rlnZkey);
+  let valid;
+  try {
+    valid = await verifyGroth16Proof(resources.rlnVk, result.publicSignals, result.proof);
+  } catch (err) {
+    throw new ProofSelfVerificationError(`Local Groth16 verification failed: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  if (!valid) {
+    throw new ProofSelfVerificationError("Local Groth16 verification failed; proof not returned");
+  }
+  return { ...result, nullifier: result.publicSignals[1] };
+}
+
+// dist/identity.js
+var SERVICE = "zk-credits-sidecar";
+var ACCOUNT = "secret-k-v1";
+function secretToHex(secretK) {
+  if (secretK.length !== 32)
+    throw new Error("Expected a 32-byte ZK Credits secret");
+  return Array.from(secretK, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function hexToSecret(value) {
+  if (!/^[a-f0-9]{64}$/i.test(value)) {
+    throw new Error("Stored ZK Credits credential is malformed; re-import the mnemonic");
+  }
+  return new Uint8Array(value.match(/.{2}/g).map((pair) => Number.parseInt(pair, 16)));
+}
+var IdentityStore = class {
+  credentials;
+  constructor(credentials = keytar) {
+    this.credentials = credentials;
+  }
+  async hasIdentity() {
+    return await this.credentials.getPassword(SERVICE, ACCOUNT) !== null;
+  }
+  async importMnemonic(mnemonic) {
+    const secretK = recoverSecretK(mnemonic);
+    if (secretK.length !== 32)
+      throw new Error("Recovery phrase must encode a 32-byte secret");
+    await this.credentials.setPassword(SERVICE, ACCOUNT, secretToHex(secretK));
+    return secretK;
+  }
+  async loadSecretK(options = {}) {
+    const stored = await this.credentials.getPassword(SERVICE, ACCOUNT);
+    if (stored !== null)
+      return hexToSecret(stored);
+    if (options.headlessMnemonic) {
+      const secretK = recoverSecretK(options.headlessMnemonic);
+      if (secretK.length !== 32)
+        throw new Error("Recovery phrase must encode a 32-byte secret");
+      return secretK;
+    }
+    throw new Error("No ZK Credits identity found; run zk-credits import-mnemonic first");
+  }
+};
+
+// dist/local-prover.js
+import { readFile as readFile2 } from "node:fs/promises";
+import { resolve } from "node:path";
+
+// dist/artifact-manifest.js
+import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { join as join2 } from "node:path";
+var CIRCUIT_MANIFEST = [
+  {
+    file: "rln_nullifier.wasm",
+    sha256: "38370baebbafb76562d5c94e15354c04152c388bffe1bf85faeeb4dd221538c1"
+  },
+  {
+    file: "rln_nullifier_final.zkey",
+    sha256: "11cd9e881437283701dcebd75be469d57ec7428de3495d229268eb75f2413cc8"
+  },
+  {
+    file: "verification_key_rln.json",
+    sha256: "9a521e0e19dc272c281f1a41abf79571bb0094cda653c890bdd95aa5b4c5f1ee"
+  }
+];
+async function verifyArtifactManifest(artifactDirectory, manifest = CIRCUIT_MANIFEST) {
+  for (const artifact of manifest) {
+    const content = await readFile(join2(artifactDirectory, artifact.file));
+    const digest = createHash("sha256").update(content).digest("hex");
+    if (digest !== artifact.sha256) {
+      throw new Error(`Circuit artifact hash mismatch: ${artifact.file}`);
+    }
+  }
+  return manifest;
+}
+
+// dist/local-prover.js
+async function createLocalProofGenerator(options) {
+  const artifactDirectory = options.artifactDirectory ?? resolve(import.meta.dirname, "..", "circuits");
+  await verifyArtifactManifest(artifactDirectory);
+  const verificationKey = JSON.parse(await readFile2(resolve(artifactDirectory, "verification_key_rln.json"), "utf8"));
+  const prove = options.prove ?? generateRlnProofSelfVerified;
+  return async ({ ticketIndex, request }) => {
+    const [requestDigest, witness] = await Promise.all([
+      requestDigestToField(request),
+      options.membershipClient.witnessForSecret(options.secretK)
+    ]);
+    const result = await prove({
+      secret_k: skToField(options.secretK),
+      ticket_index: ticketIndex.toString(),
+      request_digest: requestDigest.field,
+      merkle_path_elements: witness.merklePathElements,
+      merkle_path_indices: witness.merklePathIndices
+    }, {
+      rlnWasm: resolve(artifactDirectory, "rln_nullifier.wasm"),
+      rlnZkey: resolve(artifactDirectory, "rln_nullifier_final.zkey"),
+      rlnVk: verificationKey
+    });
+    return { proof: result.proof, pubSignals: result.publicSignals };
+  };
+}
+
+// dist/membership-client.js
+var MAX_SNAPSHOT_AGE_MS = 6e4;
+function parseSnapshot(value) {
+  if (!value || typeof value !== "object")
+    throw new Error("Membership snapshot is malformed");
+  const snapshot = value;
+  if (typeof snapshot.root !== "string" || typeof snapshot.depth !== "number" || !Array.isArray(snapshot.leaves) || !snapshot.leaves.every((leaf) => typeof leaf === "string") || !Array.isArray(snapshot.layers) || !snapshot.layers.every((layer) => Array.isArray(layer) && layer.every((node) => typeof node === "string")) || typeof snapshot.generatedAt !== "string") {
+    throw new Error("Membership snapshot is malformed");
+  }
+  const generatedAt = Date.parse(snapshot.generatedAt);
+  if (!Number.isFinite(generatedAt) || Date.now() - generatedAt > MAX_SNAPSHOT_AGE_MS || generatedAt - Date.now() > 5e3) {
+    throw new Error("Membership snapshot is stale");
+  }
+  return {
+    root: snapshot.root,
+    depth: snapshot.depth,
+    leaves: snapshot.leaves,
+    layers: snapshot.layers,
+    generatedAt: snapshot.generatedAt
+  };
+}
+var MembershipClient = class {
+  fetcher;
+  baseUrl;
+  constructor(gatewayBaseUrl, fetcher = fetch) {
+    this.fetcher = fetcher;
+    this.baseUrl = gatewayBaseUrl.replace(/\/$/, "");
+  }
+  async witnessForSecret(secretK) {
+    const [chainRoot, snapshot] = await Promise.all([
+      this.getCurrentChainRoot(),
+      this.getSnapshot()
+    ]);
+    if (snapshot.root !== chainRoot) {
+      throw new Error("Membership snapshot does not match the current chain root");
+    }
+    const commitment = await mimcHash([BigInt(skToField(secretK))]);
+    return deriveMembershipWitness(commitment, snapshot);
+  }
+  async getCurrentChainRoot() {
+    const response = await this.fetcher(`${this.baseUrl}/v1/contract-status`, { cache: "no-store" });
+    if (!response.ok)
+      throw new Error("Current chain root could not be loaded");
+    const payload = await response.json();
+    if (!payload || typeof payload !== "object" || typeof payload.currentRoot !== "string") {
+      throw new Error("Current chain root is unavailable");
+    }
+    return payload.currentRoot;
+  }
+  async getSnapshot() {
+    const response = await this.fetcher(`${this.baseUrl}/v1/membership-tree`, { cache: "no-store" });
+    if (!response.ok)
+      throw new Error("Membership snapshot could not be loaded");
+    return parseSnapshot(await response.json());
+  }
+};
+
+// dist/sidecar-config.js
+import { randomBytes as randomBytes2 } from "node:crypto";
+import { join as join3 } from "node:path";
+function createLoopbackToken() {
+  return randomBytes2(32).toString("base64url");
+}
+function sidecarStatePaths(stateDirectory2) {
+  return {
+    ledgerPath: join3(stateDirectory2, "tickets.json"),
+    tokenPath: join3(stateDirectory2, "loopback-token"),
+    logPath: join3(stateDirectory2, "sidecar.log")
+  };
+}
+function formatOpenAiEnvironment(loopbackBaseUrl2, localToken) {
+  const url = new URL(loopbackBaseUrl2);
+  if (url.protocol !== "http:" || url.hostname !== "127.0.0.1" || !/^[A-Za-z0-9_-]+$/.test(localToken)) {
+    throw new Error("Sidecar environment must use a valid 127.0.0.1 URL and local token");
+  }
+  return [
+    `export OPENAI_BASE_URL=${url.origin}/v1`,
+    `export OPENAI_API_KEY=${localToken}`
+  ].join("\n");
+}
+
+// dist/cli-runtime.js
+function setupModel(args) {
+  if (args[1] !== "codex")
+    throw new Error("Usage: zk-credits setup codex [--model <model>]");
+  if (args.length === 2)
+    return void 0;
+  if (args.length === 4 && args[2] === "--model" && args[3]?.trim())
+    return args[3];
+  throw new Error("Usage: zk-credits setup codex [--model <model>]");
+}
+async function runCliCommand(args, dependencies) {
+  switch (args[0]) {
+    case "env": {
+      dependencies.write(formatOpenAiEnvironment(dependencies.loopbackBaseUrl, await dependencies.readToken()));
+      return 0;
+    }
+    case "import-mnemonic": {
+      await dependencies.importMnemonic(await dependencies.readMnemonic());
+      dependencies.write("ZK Credits identity imported into the system credential store.");
+      return 0;
+    }
+    case "setup": {
+      const model = setupModel(args);
+      if (!await dependencies.isIdentityConfigured()) {
+        await dependencies.importMnemonic(await dependencies.readMnemonic());
+        dependencies.write("ZK Credits identity imported into the system credential store.");
+      }
+      await dependencies.configureCodex(model);
+      await dependencies.ensureSidecar();
+      dependencies.write("ZK Credits is ready for Codex.");
+      dependencies.write("Run: zk-credits codex");
+      return 0;
+    }
+    case "token": {
+      dependencies.write(await dependencies.ensureSidecar());
+      return 0;
+    }
+    case "status": {
+      dependencies.write(`Identity: ${await dependencies.isIdentityConfigured() ? "configured" : "missing"}`);
+      dependencies.write(`Codex profile: ${await dependencies.isCodexProfileInstalled() ? "installed" : "missing"}`);
+      dependencies.write(`Sidecar: ${await dependencies.isSidecarHealthy() ? "running" : "stopped"}`);
+      return 0;
+    }
+    case "codex": {
+      if (!await dependencies.isCodexProfileInstalled()) {
+        throw new Error("Run zk-credits setup codex first");
+      }
+      await dependencies.ensureSidecar();
+      return dependencies.launchCodex(args.slice(1));
+    }
+    default:
+      throw new Error("Usage: zk-credits <setup codex|codex|status|token|import-mnemonic|serve|env>");
+  }
+}
+
+// dist/node-sidecar-lifecycle.js
+import { spawn as spawn2 } from "node:child_process";
+import { chmod as chmod3, mkdir as mkdir3, open } from "node:fs/promises";
+import { dirname as dirname2 } from "node:path";
+
+// dist/sidecar-state.js
+import { chmod as chmod2, mkdir as mkdir2, readFile as readFile3, rename as rename2, writeFile as writeFile2 } from "node:fs/promises";
+import { dirname } from "node:path";
+async function writeLoopbackToken(tokenPath, token) {
+  if (!token)
+    throw new Error("Loopback token is required");
+  await mkdir2(dirname(tokenPath), { recursive: true, mode: 448 });
+  const temporaryPath = `${tokenPath}.tmp`;
+  await writeFile2(temporaryPath, `${token}
+`, { encoding: "utf8", mode: 384 });
+  await chmod2(temporaryPath, 384);
+  await rename2(temporaryPath, tokenPath);
+  await chmod2(tokenPath, 384);
+}
+async function readLoopbackToken(tokenPath) {
+  const token = (await readFile3(tokenPath, "utf8")).trim();
+  if (!token)
+    throw new Error("No active ZK Credits sidecar token; start zk-credits serve first");
+  return token;
+}
+
+// dist/node-sidecar-lifecycle.js
+async function startDetachedProcess(specification) {
+  await mkdir3(dirname2(specification.logPath), { recursive: true, mode: 448 });
+  const log = await open(specification.logPath, "a", 384);
+  await chmod3(specification.logPath, 384);
+  try {
+    const child = spawn2(specification.executable, specification.args, {
+      detached: true,
+      env: specification.env,
+      stdio: ["ignore", log.fd, log.fd]
+    });
+    await new Promise((resolve2, reject) => {
+      child.once("spawn", resolve2);
+      child.once("error", reject);
+    });
+    child.unref();
+  } finally {
+    await log.close();
+  }
+}
+var defaultRuntime = {
+  fetchHealth: async (url) => fetch(url, { signal: AbortSignal.timeout(500) }),
+  startDetachedProcess,
+  wait: async (milliseconds) => new Promise((resolve2) => setTimeout(resolve2, milliseconds))
+};
+function createNodeSidecarLifecycle(options, runtime = defaultRuntime) {
+  const url = new URL(options.loopbackBaseUrl);
+  if (url.protocol !== "http:" || url.hostname !== "127.0.0.1" || !url.port) {
+    throw new Error("Sidecar lifecycle requires a 127.0.0.1 HTTP URL with an explicit port");
+  }
+  return {
+    logPath: options.logPath,
+    async isHealthy() {
+      try {
+        const response = await runtime.fetchHealth(`${url.origin}/health`);
+        if (!response.ok)
+          return false;
+        const body = await response.json();
+        return body.service === "zk-credits-sidecar" && body.status === "ok";
+      } catch {
+        return false;
+      }
+    },
+    async startDetached() {
+      await runtime.startDetachedProcess({
+        executable: process.execPath,
+        args: [options.cliEntryPath, "serve", "--port", url.port],
+        env: {
+          ...process.env,
+          ZK_CREDITS_HOME: options.stateDirectory,
+          ZK_CREDITS_SIDECAR_PORT: url.port
+        },
+        logPath: options.logPath
+      });
+    },
+    readToken: () => readLoopbackToken(options.tokenPath),
+    wait: runtime.wait
+  };
+}
+
+// dist/server-startup.js
+async function activateSidecarServer(activation) {
+  const address = await activation.listen();
+  await activation.publishToken();
+  return address;
+}
+
+// dist/sidecar-lifecycle.js
+async function ensureSidecarReady(dependencies, options = {}) {
+  if (await dependencies.isHealthy())
+    return dependencies.readToken();
+  await dependencies.startDetached();
+  const attempts = options.attempts ?? 50;
+  const intervalMs = options.intervalMs ?? 100;
+  for (let attempt = 0; attempt < attempts; attempt += 1) {
+    await dependencies.wait(intervalMs);
+    if (await dependencies.isHealthy())
+      return dependencies.readToken();
+  }
+  throw new Error(`ZK Credits sidecar did not become ready; inspect ${dependencies.logPath}`);
+}
+
+// dist/sidecar.js
+import { createServer } from "node:http";
+var MAX_REQUEST_BYTES = 2e6;
+function isLoopbackAddress(address) {
+  return address === "127.0.0.1" || address === "::1" || address === "::ffff:127.0.0.1";
+}
+function sendJson(res, status, body) {
+  res.writeHead(status, { "Content-Type": "application/json; charset=utf-8" });
+  res.end(JSON.stringify(body));
+}
+async function readJsonBody(req) {
+  const chunks = [];
+  let total = 0;
+  for await (const chunk of req) {
+    const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    total += bytes.length;
+    if (total > MAX_REQUEST_BYTES)
+      throw new Error("OpenAI request exceeds the loopback size limit");
+    chunks.push(bytes);
+  }
+  const raw = Buffer.concat(chunks).toString("utf8");
+  if (!raw)
+    throw new Error("OpenAI request body is required");
+  try {
+    return { raw, parsed: JSON.parse(raw) };
+  } catch {
+    throw new Error("OpenAI request body must be valid JSON");
+  }
+}
+async function relayGatewayResponse(res, upstream) {
+  const contentType = upstream.headers.get("content-type") || "application/json; charset=utf-8";
+  res.writeHead(upstream.status, { "Content-Type": contentType });
+  if (!upstream.body) {
+    res.end();
+    return;
+  }
+  const reader = upstream.body.getReader();
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done)
+        break;
+      res.write(Buffer.from(value));
+    }
+    res.end();
+  } finally {
+    reader.releaseLock();
+  }
+}
+function proofHeader(proof) {
+  return Buffer.from(JSON.stringify(proof)).toString("base64");
+}
+function createSidecarServer(options) {
+  const gatewayBaseUrl = options.gatewayBaseUrl.replace(/\/$/, "");
+  const gatewayFetch = options.gatewayFetch ?? fetch;
+  let server = null;
+  const inFlight = /* @__PURE__ */ new Set();
+  const handler = async (req, res) => {
+    const pathname = new URL(req.url || "/", "http://127.0.0.1").pathname;
+    if (!isLoopbackAddress(req.socket.remoteAddress)) {
+      sendJson(res, 403, { error: "loopback_only" });
+      return;
+    }
+    if (req.method === "GET" && pathname === "/health") {
+      sendJson(res, 200, { service: "zk-credits-sidecar", status: "ok" });
+      return;
+    }
+    if (req.method === "GET" && pathname === "/v1/models") {
+      if (req.headers.authorization !== `Bearer ${options.localToken}`) {
+        sendJson(res, 401, { error: "invalid_local_token" });
+        return;
+      }
+      sendJson(res, 200, codexModelsResponse());
+      return;
+    }
+    if (req.method !== "POST" || pathname !== "/v1/chat/completions" && pathname !== "/v1/responses") {
+      sendJson(res, 404, { error: "unsupported_openai_path" });
+      return;
+    }
+    if (req.headers.authorization !== `Bearer ${options.localToken}`) {
+      sendJson(res, 401, { error: "invalid_local_token" });
+      return;
+    }
+    try {
+      const body = await readJsonBody(req);
+      const reservation = await options.ledger.reserve(body.parsed);
+      const proof = await options.proofGenerator({
+        ticketIndex: reservation.index,
+        request: body.parsed
+      });
+      const upstream = await gatewayFetch(`${gatewayBaseUrl}${pathname}`, {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${options.compatibilityKey}`,
+          "Content-Type": "application/json",
+          "X-ZK-Proof": proofHeader(proof)
+        },
+        body: body.raw
+      });
+      await relayGatewayResponse(res, upstream);
+      if (upstream.status >= 200 && upstream.status < 300) {
+        await options.ledger.consume(reservation.requestDigest);
+      }
+    } catch (error) {
+      if (!res.headersSent) {
+        const message = error instanceof Error ? error.message : "Loopback request failed";
+        sendJson(res, 502, { error: "sidecar_request_failed", message });
+      } else if (!res.writableEnded) {
+        res.end();
+      }
+    }
+  };
+  return {
+    async listen(port = 0) {
+      if (server)
+        throw new Error("ZK Credits sidecar is already running");
+      server = createServer((req, res) => {
+        const request = handler(req, res).finally(() => inFlight.delete(request));
+        inFlight.add(request);
+      });
+      await new Promise((resolve2, reject) => {
+        server.once("error", reject);
+        server.listen(port, "127.0.0.1", () => {
+          server.off("error", reject);
+          resolve2();
+        });
+      });
+      const address = server.address();
+      return `http://127.0.0.1:${address.port}`;
+    },
+    async close() {
+      if (!server)
+        return;
+      const activeServer = server;
+      server = null;
+      await new Promise((resolve2, reject) => activeServer.close((error) => {
+        if (error)
+          reject(error);
+        else
+          resolve2();
+      }));
+      await Promise.all(inFlight);
+    }
+  };
+}
+
+// dist/ticket-ledger.js
+import { mkdir as mkdir4, readFile as readFile4, rename as rename3, writeFile as writeFile3 } from "node:fs/promises";
+import { dirname as dirname3 } from "node:path";
+function parseLedger(raw) {
+  const parsed = JSON.parse(raw);
+  if (!parsed || typeof parsed !== "object" || !Array.isArray(parsed.entries)) {
+    throw new Error("Sidecar ticket ledger is malformed");
+  }
+  const entries = parsed.entries.map((entry) => {
+    if (!entry || typeof entry !== "object" || !Number.isInteger(entry.index) || typeof entry.requestDigest !== "string" || !["reserved", "consumed"].includes(entry.state)) {
+      throw new Error("Sidecar ticket ledger is malformed");
+    }
+    return entry;
+  });
+  return { entries };
+}
+var TicketLedger = class {
+  filePath;
+  capacity;
+  queue = Promise.resolve();
+  constructor(filePath, capacity = 100) {
+    this.filePath = filePath;
+    this.capacity = capacity;
+  }
+  async reserve(request) {
+    const digest = (await requestDigestToField(request)).digest;
+    return this.serialized(async () => {
+      const ledger = await this.read();
+      const existing = ledger.entries.find((entry) => entry.requestDigest === digest);
+      if (existing)
+        return { ...existing };
+      const used = new Set(ledger.entries.map((entry) => entry.index));
+      const index = Array.from({ length: this.capacity }, (_, candidate) => candidate).find((candidate) => !used.has(candidate));
+      if (index === void 0)
+        throw new Error("All ZK Credit tickets have been reserved");
+      const reservation = { index, requestDigest: digest, state: "reserved" };
+      ledger.entries.push(reservation);
+      await this.write(ledger);
+      return reservation;
+    });
+  }
+  async consume(requestDigest) {
+    await this.serialized(async () => {
+      const ledger = await this.read();
+      const entry = ledger.entries.find((candidate) => candidate.requestDigest === requestDigest);
+      if (!entry)
+        throw new Error("Unknown sidecar ticket reservation");
+      entry.state = "consumed";
+      await this.write(ledger);
+    });
+  }
+  async serialized(operation) {
+    const previous = this.queue;
+    let release;
+    this.queue = new Promise((resolve2) => {
+      release = resolve2;
+    });
+    await previous;
+    try {
+      return await operation();
+    } finally {
+      release();
+    }
+  }
+  async read() {
+    try {
+      return parseLedger(await readFile4(this.filePath, "utf8"));
+    } catch (error) {
+      if (error.code === "ENOENT")
+        return { entries: [] };
+      throw error;
+    }
+  }
+  async write(ledger) {
+    await mkdir4(dirname3(this.filePath), { recursive: true, mode: 448 });
+    const temporaryPath = `${this.filePath}.tmp`;
+    await writeFile3(temporaryPath, JSON.stringify(ledger), { encoding: "utf8", mode: 384 });
+    await rename3(temporaryPath, this.filePath);
+  }
+};
+
+// dist/cli.js
+var DEFAULT_GATEWAY_URL = "https://zk-credits-gateway.onrender.com";
+var DEFAULT_PORT = 3210;
+function stateDirectory() {
+  return process.env.ZK_CREDITS_HOME || join4(homedir(), ".zk-credits");
+}
+function loopbackBaseUrl() {
+  const port = Number(process.env.ZK_CREDITS_SIDECAR_PORT || DEFAULT_PORT);
+  if (!Number.isInteger(port) || port < 1 || port > 65535) {
+    throw new Error("ZK_CREDITS_SIDECAR_PORT must be a port between 1 and 65535");
+  }
+  return `http://127.0.0.1:${port}`;
+}
+function readPort(args) {
+  const portIndex = args.indexOf("--port");
+  if (portIndex === -1)
+    return Number(new URL(loopbackBaseUrl()).port);
+  const parsed = Number(args[portIndex + 1]);
+  if (!Number.isInteger(parsed) || parsed < 1 || parsed > 65535) {
+    throw new Error("--port must be a port between 1 and 65535");
+  }
+  return parsed;
+}
+async function readHiddenMnemonic() {
+  if (!process.stdin.isTTY || !process.stdin.setRawMode) {
+    throw new Error("import-mnemonic requires an interactive terminal");
+  }
+  process.stdout.write("Enter your 24-word recovery phrase: ");
+  process.stdin.setRawMode(true);
+  process.stdin.resume();
+  return new Promise((resolve2, reject) => {
+    let value = "";
+    const done = (error) => {
+      process.stdin.off("data", onData);
+      process.stdin.setRawMode(false);
+      process.stdout.write("\n");
+      if (error)
+        reject(error);
+      else
+        resolve2(value.trim());
+    };
+    const onData = (chunk) => {
+      for (const byte of chunk) {
+        if (byte === 3) {
+          done(new Error("Mnemonic import cancelled"));
+          return;
+        }
+        if (byte === 13 || byte === 10) {
+          done();
+          return;
+        }
+        if (byte === 127 || byte === 8) {
+          value = value.slice(0, -1);
+          continue;
+        }
+        value += String.fromCharCode(byte);
+      }
+    };
+    process.stdin.on("data", onData);
+  });
+}
+function printHelp() {
+  console.log(`Usage:
+  zk-credits setup codex [--model <model>]
+  zk-credits codex [codex arguments...]
+  zk-credits status
+  zk-credits import-mnemonic
+  zk-credits serve [--port <port>]
+  eval "$(zk-credits env)"
+
+The Codex setup starts the loopback sidecar automatically; daily use is
+"zk-credits codex". serve/env remain available for other OpenAI-compatible
+clients. Set ZK_CREDITS_MNEMONIC only for a headless process; it is not
+persisted by that path.`);
+}
+async function serve(args) {
+  const port = readPort(args);
+  const statePaths = sidecarStatePaths(stateDirectory());
+  const localToken = createLoopbackToken();
+  const identities = new IdentityStore();
+  const secretK = await identities.loadSecretK({ headlessMnemonic: process.env.ZK_CREDITS_MNEMONIC });
+  const gatewayBaseUrl = process.env.ZK_CREDITS_GATEWAY_URL || DEFAULT_GATEWAY_URL;
+  const proofGenerator = await createLocalProofGenerator({
+    secretK,
+    membershipClient: new MembershipClient(gatewayBaseUrl)
+  });
+  const sidecar = createSidecarServer({
+    localToken,
+    gatewayBaseUrl,
+    compatibilityKey: process.env.ZK_CREDITS_COMPATIBILITY_KEY || "sk-zk-local-demo",
+    ledger: new TicketLedger(statePaths.ledgerPath),
+    proofGenerator
+  });
+  let address;
+  try {
+    address = await activateSidecarServer({
+      listen: () => sidecar.listen(port),
+      publishToken: () => writeLoopbackToken(statePaths.tokenPath, localToken)
+    });
+  } catch (error) {
+    await sidecar.close();
+    throw error;
+  }
+  console.log(`ZK Credits sidecar listening on ${address}/v1`);
+  console.log('Run eval "$(zk-credits env)" in the client shell.');
+  const shutdown = async () => {
+    await sidecar.close();
+    process.exit(0);
+  };
+  process.once("SIGINT", () => {
+    void shutdown();
+  });
+  process.once("SIGTERM", () => {
+    void shutdown();
+  });
+}
+async function main() {
+  const args = process.argv.slice(2);
+  if (args[0] === "--help" || args[0] === "-h" || !args[0]) {
+    printHelp();
+    return;
+  }
+  if (args[0] === "serve") {
+    await serve(args.slice(1));
+    return;
+  }
+  const identities = new IdentityStore();
+  const sidecarHome = stateDirectory();
+  const statePaths = sidecarStatePaths(sidecarHome);
+  const codexHome = resolveCodexHome(process.env, homedir());
+  const cliEntryPath = process.argv[1];
+  if (!cliEntryPath)
+    throw new Error("Unable to resolve the zk-credits executable path");
+  const lifecycle = createNodeSidecarLifecycle({
+    loopbackBaseUrl: loopbackBaseUrl(),
+    stateDirectory: sidecarHome,
+    tokenPath: statePaths.tokenPath,
+    logPath: statePaths.logPath,
+    cliEntryPath
+  });
+  const exitCode = await runCliCommand(args, {
+    loopbackBaseUrl: loopbackBaseUrl(),
+    readToken: () => readLoopbackToken(statePaths.tokenPath),
+    importMnemonic: async (mnemonic) => {
+      await identities.importMnemonic(mnemonic);
+    },
+    readMnemonic: readHiddenMnemonic,
+    write: (line) => console.log(line),
+    isIdentityConfigured: () => identities.hasIdentity(),
+    configureCodex: async (model) => {
+      await writeCodexProfile({ codexHome, loopbackBaseUrl: loopbackBaseUrl(), model });
+    },
+    ensureSidecar: () => ensureSidecarReady(lifecycle),
+    isCodexProfileInstalled: () => isCodexProfileInstalled(codexHome),
+    isSidecarHealthy: () => lifecycle.isHealthy(),
+    launchCodex: (codexArgs) => launchCodexProcess(codexArgs)
+  });
+  if (exitCode !== 0)
+    process.exitCode = exitCode;
+}
+void main().catch((error) => {
+  console.error(error instanceof Error ? error.message : "zk-credits failed");
+  process.exitCode = 1;
+});