zk-credits 0.2.2 → 0.2.4

package/dist/zk-credits.js

@@ -34651,7 +34651,7 @@ var require_lib = __commonJS({
       };
     }
     // @__NO_SIDE_EFFECTS__
-    function join7(separator = "") {
+    function join8(separator = "") {
       astr("join", separator);
       return {
         encode: (from) => {
@@ -34867,15 +34867,15 @@ var require_lib = __commonJS({
       convertRadix2,
       radix,
       radix2,
-      join: join7,
+      join: join8,
       padding
     };
-    exports.base16 = /* @__PURE__ */ chain(/* @__PURE__ */ radix2(4), /* @__PURE__ */ alphabet("0123456789ABCDEF"), /* @__PURE__ */ join7(""));
-    exports.base32 = /* @__PURE__ */ chain(/* @__PURE__ */ radix2(5), /* @__PURE__ */ alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZ234567"), /* @__PURE__ */ padding(5), /* @__PURE__ */ join7(""));
-    exports.base32nopad = /* @__PURE__ */ chain(/* @__PURE__ */ radix2(5), /* @__PURE__ */ alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZ234567"), /* @__PURE__ */ join7(""));
-    exports.base32hex = /* @__PURE__ */ chain(/* @__PURE__ */ radix2(5), /* @__PURE__ */ alphabet("0123456789ABCDEFGHIJKLMNOPQRSTUV"), /* @__PURE__ */ padding(5), /* @__PURE__ */ join7(""));
-    exports.base32hexnopad = /* @__PURE__ */ chain(/* @__PURE__ */ radix2(5), /* @__PURE__ */ alphabet("0123456789ABCDEFGHIJKLMNOPQRSTUV"), /* @__PURE__ */ join7(""));
-    exports.base32crockford = /* @__PURE__ */ chain(/* @__PURE__ */ radix2(5), /* @__PURE__ */ alphabet("0123456789ABCDEFGHJKMNPQRSTVWXYZ"), /* @__PURE__ */ join7(""), /* @__PURE__ */ normalize((s) => s.toUpperCase().replace(/O/g, "0").replace(/[IL]/g, "1")));
+    exports.base16 = /* @__PURE__ */ chain(/* @__PURE__ */ radix2(4), /* @__PURE__ */ alphabet("0123456789ABCDEF"), /* @__PURE__ */ join8(""));
+    exports.base32 = /* @__PURE__ */ chain(/* @__PURE__ */ radix2(5), /* @__PURE__ */ alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZ234567"), /* @__PURE__ */ padding(5), /* @__PURE__ */ join8(""));
+    exports.base32nopad = /* @__PURE__ */ chain(/* @__PURE__ */ radix2(5), /* @__PURE__ */ alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZ234567"), /* @__PURE__ */ join8(""));
+    exports.base32hex = /* @__PURE__ */ chain(/* @__PURE__ */ radix2(5), /* @__PURE__ */ alphabet("0123456789ABCDEFGHIJKLMNOPQRSTUV"), /* @__PURE__ */ padding(5), /* @__PURE__ */ join8(""));
+    exports.base32hexnopad = /* @__PURE__ */ chain(/* @__PURE__ */ radix2(5), /* @__PURE__ */ alphabet("0123456789ABCDEFGHIJKLMNOPQRSTUV"), /* @__PURE__ */ join8(""));
+    exports.base32crockford = /* @__PURE__ */ chain(/* @__PURE__ */ radix2(5), /* @__PURE__ */ alphabet("0123456789ABCDEFGHJKMNPQRSTVWXYZ"), /* @__PURE__ */ join8(""), /* @__PURE__ */ normalize((s) => s.toUpperCase().replace(/O/g, "0").replace(/[IL]/g, "1")));
     var hasBase64Builtin = /* @__PURE__ */ (() => typeof Uint8Array.from([]).toBase64 === "function" && typeof Uint8Array.fromBase64 === "function")();
     var decodeBase64Builtin = (s, isUrl) => {
       astr("base64", s);
@@ -34893,8 +34893,8 @@ var require_lib = __commonJS({
       decode(s) {
         return decodeBase64Builtin(s, false);
       }
-    } : /* @__PURE__ */ chain(/* @__PURE__ */ radix2(6), /* @__PURE__ */ alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"), /* @__PURE__ */ padding(6), /* @__PURE__ */ join7(""));
-    exports.base64nopad = /* @__PURE__ */ chain(/* @__PURE__ */ radix2(6), /* @__PURE__ */ alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"), /* @__PURE__ */ join7(""));
+    } : /* @__PURE__ */ chain(/* @__PURE__ */ radix2(6), /* @__PURE__ */ alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"), /* @__PURE__ */ padding(6), /* @__PURE__ */ join8(""));
+    exports.base64nopad = /* @__PURE__ */ chain(/* @__PURE__ */ radix2(6), /* @__PURE__ */ alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"), /* @__PURE__ */ join8(""));
     exports.base64url = hasBase64Builtin ? {
       encode(b) {
         abytes(b);
@@ -34903,9 +34903,9 @@ var require_lib = __commonJS({
       decode(s) {
         return decodeBase64Builtin(s, true);
       }
-    } : /* @__PURE__ */ chain(/* @__PURE__ */ radix2(6), /* @__PURE__ */ alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"), /* @__PURE__ */ padding(6), /* @__PURE__ */ join7(""));
-    exports.base64urlnopad = /* @__PURE__ */ chain(/* @__PURE__ */ radix2(6), /* @__PURE__ */ alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"), /* @__PURE__ */ join7(""));
-    var genBase58 = /* @__NO_SIDE_EFFECTS__ */ (abc) => /* @__PURE__ */ chain(/* @__PURE__ */ radix(58), /* @__PURE__ */ alphabet(abc), /* @__PURE__ */ join7(""));
+    } : /* @__PURE__ */ chain(/* @__PURE__ */ radix2(6), /* @__PURE__ */ alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"), /* @__PURE__ */ padding(6), /* @__PURE__ */ join8(""));
+    exports.base64urlnopad = /* @__PURE__ */ chain(/* @__PURE__ */ radix2(6), /* @__PURE__ */ alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"), /* @__PURE__ */ join8(""));
+    var genBase58 = /* @__NO_SIDE_EFFECTS__ */ (abc) => /* @__PURE__ */ chain(/* @__PURE__ */ radix(58), /* @__PURE__ */ alphabet(abc), /* @__PURE__ */ join8(""));
     exports.base58 = /* @__PURE__ */ genBase58("123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz");
     exports.base58flickr = /* @__PURE__ */ genBase58("123456789abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ");
     exports.base58xrp = /* @__PURE__ */ genBase58("rpshnaf39wBUDNEGHJKLM4PQRST7VWXYZ2bcdeCg65jkm8oFqi1tuvAxyz");
@@ -34937,7 +34937,7 @@ var require_lib = __commonJS({
     var createBase58check = (sha256) => /* @__PURE__ */ chain(checksum(4, (data) => sha256(sha256(data))), exports.base58);
     exports.createBase58check = createBase58check;
     exports.base58check = exports.createBase58check;
-    var BECH_ALPHABET = /* @__PURE__ */ chain(/* @__PURE__ */ alphabet("qpzry9x8gf2tvdw0s3jn54khce6mua7l"), /* @__PURE__ */ join7(""));
+    var BECH_ALPHABET = /* @__PURE__ */ chain(/* @__PURE__ */ alphabet("qpzry9x8gf2tvdw0s3jn54khce6mua7l"), /* @__PURE__ */ join8(""));
     var POLYMOD_GENERATORS = [996825010, 642813549, 513874426, 1027748829, 705979059];
     function bech32Polymod(pre) {
       const b = pre >> 25;
@@ -35046,7 +35046,7 @@ var require_lib = __commonJS({
         return Uint8Array.fromHex(s);
       }
     };
-    exports.hex = hasHexBuiltin ? hexBuiltin : /* @__PURE__ */ chain(/* @__PURE__ */ radix2(4), /* @__PURE__ */ alphabet("0123456789abcdef"), /* @__PURE__ */ join7(""), /* @__PURE__ */ normalize((s) => {
+    exports.hex = hasHexBuiltin ? hexBuiltin : /* @__PURE__ */ chain(/* @__PURE__ */ radix2(4), /* @__PURE__ */ alphabet("0123456789abcdef"), /* @__PURE__ */ join8(""), /* @__PURE__ */ normalize((s) => {
       if (typeof s !== "string" || s.length % 2 !== 0)
         throw new TypeError(`hex.decode: expected string, got ${typeof s} with length ${s.length}`);
       return s.toLowerCase();
@@ -38581,9 +38581,9 @@ var require_SignatureEnvelope = __commonJS({
     }
     function sortMultisigApprovals(value) {
       const { signatures } = value;
-      const digest = MultisigConfig.getSignPayload(value);
+      const digest2 = MultisigConfig.getSignPayload(value);
       return signatures.map((signature) => ({
-        key: Hex.toBigInt(extractAddress({ payload: digest, signature })),
+        key: Hex.toBigInt(extractAddress({ payload: digest2, signature })),
         signature
       })).sort((a, b) => a.key < b.key ? -1 : a.key > b.key ? 1 : 0).map((entry) => entry.signature);
     }
@@ -38760,20 +38760,20 @@ var require_TempoAddress = __commonJS({
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.InvalidPrefixError = void 0;
-    exports.resolve = resolve3;
+    exports.resolve = resolve4;
     exports.format = format;
     exports.parse = parse;
     exports.validate = validate;
     var core_Address = require_Address();
     var Errors = require_Errors();
     var Hex = require_Hex();
-    function resolve3(address2) {
+    function resolve4(address2) {
       if (address2.startsWith("tempo"))
         return parse(address2).address;
       return address2;
     }
     function format(address2) {
-      const resolved = resolve3(address2);
+      const resolved = resolve4(address2);
       return `tempox${resolved.toLowerCase()}`;
     }
     function parse(tempoAddress) {
@@ -41421,12 +41421,12 @@ var require_MultisigOperation = __commonJS({
           });
         retained.splice(index, 1);
       }
-      const digest = MultisigConfig.getSignPayload({
+      const digest2 = MultisigConfig.getSignPayload({
         account: operation.account,
         config: operation.config,
         payload: KeyAuthorization_.getSignPayload(authorization)
       });
-      const addresses = selected.map((signature) => SignatureEnvelope.extractAddress({ payload: digest, signature }));
+      const addresses = selected.map((signature) => SignatureEnvelope.extractAddress({ payload: digest2, signature }));
       for (let index = 1; index < addresses.length; index++) {
         const previous = Hex.toBigInt(addresses[index - 1]);
         const current = Hex.toBigInt(addresses[index]);
@@ -42868,13 +42868,13 @@ var require_virtualMasterPool = __commonJS({
   "node_modules/ox/_cjs/tempo/internal/virtualMasterPool.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.resolve = resolve3;
+    exports.resolve = resolve4;
     exports.resolveNode = resolveNode;
     exports.resolveBrowser = resolveBrowser;
     var Errors = require_Errors();
     var cachedPool;
     var isNode = typeof globalThis.process !== "undefined" && typeof globalThis.process.versions?.node === "string";
-    async function resolve3() {
+    async function resolve4() {
       if (cachedPool)
         return cachedPool;
       cachedPool = isNode ? await resolveNode() : await resolveBrowser();
@@ -43152,7 +43152,7 @@ var require_VirtualMaster = __commonJS({
     }
     function mineSaltWithWorkerPool(value) {
       const startedAt = Date.now();
-      return new Promise((resolve3, reject) => {
+      return new Promise((resolve4, reject) => {
         let settled = false;
         let attempts = 0;
         let completedWorkers = 0;
@@ -43182,7 +43182,7 @@ var require_VirtualMaster = __commonJS({
           settled = true;
           value.signal?.removeEventListener("abort", onAbort);
           terminateAll();
-          resolve3(result);
+          resolve4(result);
         };
         const fail = (error) => {
           if (settled)
@@ -46248,13 +46248,13 @@ var require_withResolvers = __commonJS({
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.withResolvers = withResolvers;
     function withResolvers() {
-      let resolve3 = () => void 0;
+      let resolve4 = () => void 0;
       let reject = () => void 0;
       const promise = new Promise((resolve_, reject_) => {
-        resolve3 = resolve_;
+        resolve4 = resolve_;
         reject = reject_;
       });
-      return { promise, resolve: resolve3, reject };
+      return { promise, resolve: resolve4, reject };
     }
   }
 });
@@ -46278,8 +46278,8 @@ var require_createBatchScheduler = __commonJS({
           if (sort && Array.isArray(data))
             data.sort(sort);
           for (let i = 0; i < scheduler.length; i++) {
-            const { resolve: resolve3 } = scheduler[i];
-            resolve3?.([data[i], data]);
+            const { resolve: resolve4 } = scheduler[i];
+            resolve4?.([data[i], data]);
           }
         }).catch((err) => {
           for (let i = 0; i < scheduler.length; i++) {
@@ -46295,16 +46295,16 @@ var require_createBatchScheduler = __commonJS({
       return {
         flush,
         async schedule(args) {
-          const { promise, resolve: resolve3, reject } = (0, withResolvers_js_1.withResolvers)();
+          const { promise, resolve: resolve4, reject } = (0, withResolvers_js_1.withResolvers)();
           const split = shouldSplitBatch?.([...getBatchedArgs(), args]);
           if (split)
             exec();
           const hasActiveScheduler = getScheduler().length > 0;
           if (hasActiveScheduler) {
-            setScheduler({ args, resolve: resolve3, reject });
+            setScheduler({ args, resolve: resolve4, reject });
             return promise;
           }
-          setScheduler({ args, resolve: resolve3, reject });
+          setScheduler({ args, resolve: resolve4, reject });
           setTimeout(exec, wait);
           return promise;
         }
@@ -47463,7 +47463,7 @@ var require_wait = __commonJS({
     exports.wait = wait;
     var utils_js_1 = require_utils5();
     async function wait(time, { signal } = {}) {
-      return new Promise((resolve3, reject) => {
+      return new Promise((resolve4, reject) => {
         if (signal?.aborted) {
           reject((0, utils_js_1.getAbortError)(signal));
           return;
@@ -47471,7 +47471,7 @@ var require_wait = __commonJS({
         const cleanup = () => signal?.removeEventListener("abort", onAbort);
         const timeout = setTimeout(() => {
           cleanup();
-          resolve3();
+          resolve4();
         }, time);
         const onAbort = () => {
           clearTimeout(timeout);
@@ -49127,7 +49127,7 @@ var require_withRetry = __commonJS({
     var utils_js_1 = require_utils5();
     var wait_js_1 = require_wait();
     function withRetry(fn, { delay: delay_ = 100, retryCount = 2, shouldRetry = () => true, signal } = {}) {
-      return new Promise((resolve3, reject) => {
+      return new Promise((resolve4, reject) => {
         const attemptRetry = async ({ count = 0 } = {}) => {
           if (signal?.aborted) {
             reject((0, utils_js_1.getAbortError)(signal));
@@ -49147,7 +49147,7 @@ var require_withRetry = __commonJS({
           };
           try {
             const data = await fn();
-            resolve3(data);
+            resolve4(data);
           } catch (err) {
             if (signal?.aborted) {
               reject((0, utils_js_1.getAbortError)(signal));
@@ -49327,13 +49327,13 @@ var require_waitForTransactionReceipt = __commonJS({
       let retrying = false;
       let _unobserve;
       let _unwatch;
-      const { promise, resolve: resolve3, reject } = (0, withResolvers_js_1.withResolvers)();
+      const { promise, resolve: resolve4, reject } = (0, withResolvers_js_1.withResolvers)();
       const timer = timeout ? setTimeout(() => {
         _unwatch?.();
         _unobserve?.();
         reject(new transaction_js_1.WaitForTransactionReceiptTimeoutError({ hash }));
       }, timeout) : void 0;
-      _unobserve = (0, observe_js_1.observe)(observerId, { onReplaced, resolve: resolve3, reject }, async (emit) => {
+      _unobserve = (0, observe_js_1.observe)(observerId, { onReplaced, resolve: resolve4, reject }, async (emit) => {
         receipt = await (0, getAction_js_1.getAction)(client, getTransactionReceipt_js_1.getTransactionReceipt, "getTransactionReceipt")({ hash }).catch(() => void 0);
         if (receipt && confirmations <= 1) {
           clearTimeout(timer);
@@ -59405,7 +59405,7 @@ var require_Account = __commonJS({
       const currentConfig = config ?? account.config;
       if (!currentConfig)
         throw new Error("A current multisig config is required for local signing.");
-      const digest = tempo_1.MultisigConfig.getSignPayload({
+      const digest2 = tempo_1.MultisigConfig.getSignPayload({
         account: account.address,
         config: currentConfig,
         payload
@@ -59415,7 +59415,7 @@ var require_Account = __commonJS({
       let weight = 0;
       for (const signature of providedSignatures) {
         const address2 = tempo_1.SignatureEnvelope.extractAddress({
-          payload: digest,
+          payload: digest2,
           signature
         }).toLowerCase();
         const owner = currentConfig.owners.find((owner2) => Address.isEqual(owner2.owner, address2));
@@ -59436,7 +59436,7 @@ var require_Account = __commonJS({
           continue;
         if (!ownerAccount.sign)
           throw new Error("Multisig owner account cannot sign.");
-        signatures.push((0, Signature_js_1.parseApproval)(await ownerAccount.sign({ hash: digest })));
+        signatures.push((0, Signature_js_1.parseApproval)(await ownerAccount.sign({ hash: digest2 })));
         signedOwners.add(address2);
         weight += Number(owner.weight);
         if (weight >= Number(currentConfig.threshold))
@@ -59623,12 +59623,12 @@ var require_Account = __commonJS({
             if (!from2)
               throw new Error("A multisig sender is required for signing.");
             const config = tempo_1.MultisigConfig.from(multisigSimulation.config);
-            const digest = tempo_1.MultisigConfig.getSignPayload({
+            const digest2 = tempo_1.MultisigConfig.getSignPayload({
               account: from2,
               config,
               payload
             });
-            return await sign({ hash: digest, raw: true });
+            return await sign({ hash: digest2, raw: true });
           }
           const signature = await sign({ hash: payload });
           const envelope = tempo_1.SignatureEnvelope.from(signature);
@@ -60344,7 +60344,7 @@ var require_withTimeout = __commonJS({
     exports.withTimeout = withTimeout;
     var utils_js_1 = require_utils5();
     function withTimeout(fn, { errorInstance = new Error("timed out"), timeout, signal }) {
-      return new Promise((resolve3, reject) => {
+      return new Promise((resolve4, reject) => {
         ;
         (async () => {
           let timeoutId;
@@ -60359,7 +60359,7 @@ var require_withTimeout = __commonJS({
                 }
               }, timeout);
             }
-            resolve3(await fn({ signal: controller?.signal || null }));
+            resolve4(await fn({ signal: controller?.signal || null }));
           } catch (err) {
             if (controller?.signal.aborted && (0, utils_js_1.isAbortError)(err)) {
               reject(errorInstance);
@@ -62994,7 +62994,7 @@ var require_websocket = __commonJS({
     var http2 = __require("http");
     var net = __require("net");
     var tls = __require("tls");
-    var { randomBytes: randomBytes4, createHash: createHash2 } = __require("crypto");
+    var { randomBytes: randomBytes4, createHash: createHash3 } = __require("crypto");
     var { Duplex, Readable } = __require("stream");
     var { URL: URL2 } = __require("url");
     var PerMessageDeflate = require_permessage_deflate();
@@ -63662,8 +63662,8 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash2("sha1").update(key + GUID).digest("base64");
-        if (res.headers["sec-websocket-accept"] !== digest) {
+        const digest2 = createHash3("sha1").update(key + GUID).digest("base64");
+        if (res.headers["sec-websocket-accept"] !== digest2) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
         }
@@ -63943,7 +63943,7 @@ var require_stream = __commonJS({
       };
       duplex._final = function(callback) {
         if (ws.readyState === ws.CONNECTING) {
-          ws.once("open", function open3() {
+          ws.once("open", function open4() {
             duplex._final(callback);
           });
           return;
@@ -63964,7 +63964,7 @@ var require_stream = __commonJS({
       };
       duplex._write = function(chunk, encoding, callback) {
         if (ws.readyState === ws.CONNECTING) {
-          ws.once("open", function open3() {
+          ws.once("open", function open4() {
             duplex._write(chunk, encoding, callback);
           });
           return;
@@ -64031,7 +64031,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter = __require("events");
     var http2 = __require("http");
     var { Duplex } = __require("stream");
-    var { createHash: createHash2 } = __require("crypto");
+    var { createHash: createHash3 } = __require("crypto");
     var extension = require_extension();
     var PerMessageDeflate = require_permessage_deflate();
     var subprotocol = require_subprotocol();
@@ -64338,12 +64338,12 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash2("sha1").update(key + GUID).digest("base64");
+        const digest2 = createHash3("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
           "Connection: Upgrade",
-          `Sec-WebSocket-Accept: ${digest}`
+          `Sec-WebSocket-Accept: ${digest2}`
         ];
         const ws = new this.options.WebSocket(null, void 0, this.options);
         if (protocols.size) {
@@ -64527,10 +64527,10 @@ var require_webSocket = __commonJS({
           socket.addEventListener("error", onError);
           socket.addEventListener("open", onOpen);
           if (socket.readyState === WebSocket2.CONNECTING) {
-            await new Promise((resolve3, reject) => {
+            await new Promise((resolve4, reject) => {
               if (!socket)
                 return;
-              socket.onopen = resolve3;
+              socket.onopen = resolve4;
               socket.onerror = reject;
             });
           }
@@ -73671,7 +73671,7 @@ var require_sendCalls = __commonJS({
               results.push({ reason, status: "rejected" });
             }
             if (experimental_fallbackDelay > 0)
-              await new Promise((resolve3) => setTimeout(resolve3, experimental_fallbackDelay));
+              await new Promise((resolve4) => setTimeout(resolve4, experimental_fallbackDelay));
           }
           if (results.every((r) => r.status === "rejected"))
             throw results[0].reason;
@@ -73793,9 +73793,9 @@ var require_waitForCallsStatus = __commonJS({
     async function waitForCallsStatus(client, parameters) {
       const { id, pollingInterval = client.pollingInterval, status = ({ statusCode }) => statusCode === 200 || statusCode >= 300, retryCount = 4, retryDelay = ({ count }) => ~~(1 << count) * 200, timeout = 6e4, throwOnFailure = false } = parameters;
       const observerId = (0, stringify_js_1.stringify)(["waitForCallsStatus", client.uid, id]);
-      const { promise, resolve: resolve3, reject } = (0, withResolvers_js_1.withResolvers)();
+      const { promise, resolve: resolve4, reject } = (0, withResolvers_js_1.withResolvers)();
       let timer;
-      const unobserve = (0, observe_js_1.observe)(observerId, { resolve: resolve3, reject }, (emit) => {
+      const unobserve = (0, observe_js_1.observe)(observerId, { resolve: resolve4, reject }, (emit) => {
         const unpoll = (0, poll_js_1.poll)(async () => {
           const done = (fn) => {
             clearTimeout(timer);
@@ -74281,13 +74281,13 @@ var require_utils11 = __commonJS({
         }
         if (!Object.hasOwn(globalThis, "Image"))
           return false;
-        return new Promise((resolve3) => {
+        return new Promise((resolve4) => {
           const img = new Image();
           img.onload = () => {
-            resolve3(true);
+            resolve4(true);
           };
           img.onerror = () => {
-            resolve3(false);
+            resolve4(false);
           };
           img.src = uri;
         });
@@ -78763,7 +78763,7 @@ var require_webSocket2 = __commonJS({
           },
           async subscribe({ params, onData, onError }) {
             const rpcClient = await (0, webSocket_js_1.getWebSocketRpcClient)(url_, wsRpcClientOpts);
-            const { result: subscriptionId } = await new Promise((resolve3, reject) => rpcClient.request({
+            const { result: subscriptionId } = await new Promise((resolve4, reject) => rpcClient.request({
               body: {
                 method: "eth_subscribe",
                 params
@@ -78780,7 +78780,7 @@ var require_webSocket2 = __commonJS({
                   return;
                 }
                 if (typeof response.id === "number") {
-                  resolve3(response);
+                  resolve4(response);
                   return;
                 }
                 if (response.method !== "eth_subscription")
@@ -78791,12 +78791,12 @@ var require_webSocket2 = __commonJS({
             return {
               subscriptionId,
               async unsubscribe() {
-                return new Promise((resolve3) => rpcClient.request({
+                return new Promise((resolve4) => rpcClient.request({
                   body: {
                     method: "eth_unsubscribe",
                     params: [subscriptionId]
                   },
-                  onResponse: resolve3
+                  onResponse: resolve4
                 }));
               }
             };
@@ -80654,8 +80654,8 @@ var require_cjs2 = __commonJS({
 
 // dist/cli.js
 import { homedir } from "node:os";
-import { readFile as readFile6 } from "node:fs/promises";
-import { join as join6 } from "node:path";
+import { readFile as readFile7 } from "node:fs/promises";
+import { join as join7 } from "node:path";
 import { createInterface } from "node:readline/promises";
 
 // dist/codex-launcher.js
@@ -80768,7 +80768,7 @@ async function isCodexProfileInstalled(codexHome) {
 var spawnCommand = (command, args, options) => spawn(command, args, options);
 async function launchCodexProcess(args, spawnImpl = spawnCommand) {
   const child = spawnImpl("codex", ["--profile", CODEX_PROFILE_NAME, ...args], { stdio: "inherit" });
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve4, reject) => {
     child.once("error", (error) => {
       if (error.code === "ENOENT") {
         reject(new Error("Codex CLI was not found; install it before running zk-credits codex"));
@@ -80776,7 +80776,7 @@ async function launchCodexProcess(args, spawnImpl = spawnCommand) {
       }
       reject(error);
     });
-    child.once("exit", (code) => resolve3(code ?? 1));
+    child.once("exit", (code) => resolve4(code ?? 1));
   });
 }
 
@@ -80818,7 +80818,7 @@ function assertManagedProviderArguments(args) {
   }
 }
 function waitForCline(child) {
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve4, reject) => {
     child.once("error", (error) => {
       if (error.code === "ENOENT") {
         reject(new Error("Cline CLI was not found; install it with npm install --global cline"));
@@ -80826,7 +80826,7 @@ function waitForCline(child) {
       }
       reject(error);
     });
-    child.once("exit", (code) => resolve3(code ?? 1));
+    child.once("exit", (code) => resolve4(code ?? 1));
   });
 }
 async function launchClineProcess(options, spawnImpl = spawnCommand2) {
@@ -81423,6 +81423,8 @@ var ArtifactBundleError = class extends Error {
 var SHA256_PATTERN = /^[0-9a-f]{64}$/u;
 var SAFE_FILE_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u;
 var REMOTE_PATTERN = /^[A-Za-z][A-Za-z0-9+.-]*:\/\//u;
+var ADDRESS_PATTERN = /^0x[0-9a-fA-F]{40}$/u;
+var RELEASE_REPOSITORY_PATTERN = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/u;
 function isRecord(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
@@ -81447,6 +81449,7 @@ function parseCircuitManifest(value) {
   if (!isRecord(value.circuit))
     throw new ArtifactBundleError("artifact_manifest_malformed", "Circuit manifest is missing the circuit block");
   const circuit = value.circuit;
+  const network = requiredString(value, "network");
   const depth = circuit.depth;
   if (!Number.isSafeInteger(depth) || depth <= 0) {
     throw new ArtifactBundleError("artifact_manifest_malformed", "Circuit depth must be a positive integer");
@@ -81469,7 +81472,7 @@ function parseCircuitManifest(value) {
   const resolved = {
     version: 1,
     scheme: requiredString(value, "scheme"),
-    network: requiredString(value, "network"),
+    network,
     circuit: {
       id: requiredString(circuit, "id"),
       depth,
@@ -81477,8 +81480,13 @@ function parseCircuitManifest(value) {
       zkey: pinnedFile(circuit.zkey, "zkey"),
       verificationKey: pinnedFile(circuit.verificationKey, "verificationKey")
     },
-    artifacts
+    artifacts,
+    ...value.release === void 0 ? {} : { release: parseRelease(value.release) },
+    ...value.deployment === void 0 ? {} : { deployment: parseDeployment(value.deployment, requiredString(circuit, "id")) }
   };
+  if (resolved.deployment && network !== "eip155:84532") {
+    throw new ArtifactBundleError("artifact_manifest_malformed", "Pinned V2 deployment must use Base Sepolia");
+  }
   const pinned = new Set(artifacts.map((artifact) => artifact.file));
   for (const role of ARTIFACT_HASHES) {
     const file = resolved.circuit[role];
@@ -81488,6 +81496,33 @@ function parseCircuitManifest(value) {
   }
   return resolved;
 }
+function parseRelease(value) {
+  if (!isRecord(value) || typeof value.repository !== "string" || !RELEASE_REPOSITORY_PATTERN.test(value.repository) || typeof value.tag !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u.test(value.tag) || !Number.isSafeInteger(value.releaseId) || value.releaseId <= 0 || typeof value.assetName !== "string" || !SAFE_FILE_PATTERN.test(value.assetName) || value.assetName.includes("..") || typeof value.sha256 !== "string" || !SHA256_PATTERN.test(value.sha256)) {
+    throw new ArtifactBundleError("artifact_manifest_malformed", "Circuit manifest release pin is malformed");
+  }
+  return {
+    repository: value.repository,
+    tag: value.tag,
+    releaseId: value.releaseId,
+    assetName: value.assetName,
+    sha256: value.sha256
+  };
+}
+function parseDeployment(value, circuitId) {
+  if (!isRecord(value) || value.chainId !== 84532 || typeof value.bondAddress !== "string" || !ADDRESS_PATTERN.test(value.bondAddress) || typeof value.deploymentBlock !== "string" || !/^\d+$/u.test(value.deploymentBlock) || typeof value.deploymentDomain !== "string" || value.deploymentDomain !== "84532" || value.circuitId !== circuitId || typeof value.verifyingKeyId !== "string" || value.verifyingKeyId.length === 0 || typeof value.spendVerifierAddress !== "string" || !ADDRESS_PATTERN.test(value.spendVerifierAddress) || typeof value.groth16VerifierAddress !== "string" || !ADDRESS_PATTERN.test(value.groth16VerifierAddress)) {
+    throw new ArtifactBundleError("artifact_manifest_malformed", "Circuit manifest V2 deployment pin is malformed");
+  }
+  return {
+    chainId: 84532,
+    bondAddress: value.bondAddress,
+    deploymentBlock: value.deploymentBlock,
+    deploymentDomain: value.deploymentDomain,
+    circuitId,
+    verifyingKeyId: value.verifyingKeyId,
+    spendVerifierAddress: value.spendVerifierAddress,
+    groth16VerifierAddress: value.groth16VerifierAddress
+  };
+}
 async function loadCircuitManifest(manifestPath) {
   const path = manifestPath ?? resolve(dirname2(fileURLToPath(import.meta.url)), "..", "circuits", "manifest.json");
   let raw;
@@ -81564,8 +81599,8 @@ async function resolvePinnedArtifactBundle(options) {
       throw new ArtifactBundleError("artifact_missing", `Artifact ${artifact.file} is missing from the pinned bundle`);
     }
     assertWithinDirectory(realDirectory, realFile, artifact.file);
-    const digest = await sha256File(realFile);
-    if (digest !== artifact.sha256) {
+    const digest2 = await sha256File(realFile);
+    if (digest2 !== artifact.sha256) {
       throw new ArtifactBundleError("artifact_hash_mismatch", `Artifact ${artifact.file} does not match the pinned SHA-256 digest`);
     }
   }
@@ -81683,8 +81718,8 @@ function proverProcessFactory(proverPath) {
       execArgv: [],
       stdio: ["ignore", "pipe", "pipe", "ipc"]
     });
-    const result = new Promise((resolve3, reject) => {
-      child.once("message", (message) => resolve3(message));
+    const result = new Promise((resolve4, reject) => {
+      child.once("message", (message) => resolve4(message));
       child.once("error", (error) => reject(error));
       child.once("exit", (code, signal) => {
         if (code !== 0 && signal === null)
@@ -81698,11 +81733,11 @@ function proverProcessFactory(proverPath) {
       terminate: async () => {
         if (child.exitCode === null && child.signalCode === null)
           child.kill("SIGKILL");
-        await new Promise((resolve3) => {
+        await new Promise((resolve4) => {
           if (child.exitCode !== null || child.signalCode !== null)
-            resolve3();
+            resolve4();
           else
-            child.once("exit", () => resolve3());
+            child.once("exit", () => resolve4());
         });
       }
     };
@@ -82116,8 +82151,8 @@ async function startDetachedProcess(specification) {
       env: specification.env,
       stdio: [specification.stdin === void 0 ? "ignore" : "pipe", log.fd, log.fd]
     });
-    await new Promise((resolve3, reject) => {
-      child.once("spawn", resolve3);
+    await new Promise((resolve4, reject) => {
+      child.once("spawn", resolve4);
       child.once("error", reject);
     });
     if (specification.stdin !== void 0 && child.stdin) {
@@ -82132,7 +82167,7 @@ async function startDetachedProcess(specification) {
 var defaultRuntime = {
   fetchHealth: async (url) => fetch(url, { signal: AbortSignal.timeout(500) }),
   startDetachedProcess,
-  wait: async (milliseconds) => new Promise((resolve3) => setTimeout(resolve3, milliseconds))
+  wait: async (milliseconds) => new Promise((resolve4) => setTimeout(resolve4, milliseconds))
 };
 function createNodeSidecarLifecycle(options, runtime = defaultRuntime) {
   const url = new URL(options.loopbackBaseUrl);
@@ -82177,9 +82212,241 @@ async function activateSidecarServer(activation) {
 }
 
 // dist/setup-config.js
-import { randomUUID } from "node:crypto";
-import { chmod as chmod5, lstat, mkdir as mkdir7, open as open2, readFile as readFile5, readdir, realpath as realpath2, rename as rename4, rm } from "node:fs/promises";
+import { randomUUID as randomUUID2 } from "node:crypto";
+import { chmod as chmod6, lstat as lstat2, mkdir as mkdir8, open as open3, readFile as readFile6, readdir, realpath as realpath2, rename as rename5, rm as rm2 } from "node:fs/promises";
+import { dirname as dirname7, join as join6, resolve as resolve3 } from "node:path";
+
+// dist/artifact-release.js
+import { createHash as createHash2, randomUUID } from "node:crypto";
+import { execFile as nodeExecFile } from "node:child_process";
+import { gunzipSync } from "node:zlib";
+import { promisify as promisify2 } from "node:util";
+import { chmod as chmod5, lstat, mkdir as mkdir7, open as open2, readFile as readFile5, rename as rename4, rm } from "node:fs/promises";
 import { dirname as dirname6, join as join5, resolve as resolve2 } from "node:path";
+var execFile = promisify2(nodeExecFile);
+var MAX_COMPRESSED_BYTES = 20 * 1024 * 1024;
+var MAX_EXPANDED_BYTES = 32 * 1024 * 1024;
+var BLOCK_BYTES = 512;
+var SAFE_TAR_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u;
+function digest(bytes) {
+  return createHash2("sha256").update(bytes).digest("hex");
+}
+function zeroBlock(block) {
+  return block.every((byte) => byte === 0);
+}
+function tarText(header, start, length, label) {
+  const bytes = header.subarray(start, start + length);
+  const terminator = bytes.indexOf(0);
+  const value = bytes.subarray(0, terminator < 0 ? bytes.length : terminator);
+  if (!value.every((byte) => byte >= 32 && byte <= 126)) {
+    throw new Error("Pinned proving bundle archive contains an invalid " + label);
+  }
+  return value.toString("ascii");
+}
+function tarOctal(header, start, length, label) {
+  const value = tarText(header, start, length, label).trim();
+  if (!value)
+    return 0;
+  if (!/^[0-7]+$/u.test(value))
+    throw new Error("Pinned proving bundle archive has an invalid " + label);
+  const parsed = Number.parseInt(value, 8);
+  if (!Number.isSafeInteger(parsed) || parsed < 0)
+    throw new Error("Pinned proving bundle archive has an invalid " + label);
+  return parsed;
+}
+function parseTar(archive, allowedNames) {
+  if (archive.length === 0 || archive.length > MAX_EXPANDED_BYTES || archive.length % BLOCK_BYTES !== 0) {
+    throw new Error("Pinned proving bundle archive has an invalid size");
+  }
+  const files = /* @__PURE__ */ new Map();
+  let offset = 0;
+  let endBlocks = 0;
+  while (offset + BLOCK_BYTES <= archive.length) {
+    const header = archive.subarray(offset, offset + BLOCK_BYTES);
+    if (zeroBlock(header)) {
+      endBlocks += 1;
+      offset += BLOCK_BYTES;
+      if (endBlocks === 2)
+        break;
+      continue;
+    }
+    if (endBlocks > 0)
+      throw new Error("Pinned proving bundle archive has a malformed end marker");
+    const recordedChecksum = tarOctal(header, 148, 8, "header checksum");
+    const checksumHeader = Buffer.from(header);
+    checksumHeader.fill(32, 148, 156);
+    const actualChecksum = checksumHeader.reduce((sum, byte) => sum + byte, 0);
+    if (recordedChecksum !== actualChecksum)
+      throw new Error("Pinned proving bundle archive failed its header checksum");
+    const magic = header.subarray(257, 263).toString("ascii");
+    if (magic !== "ustar\0" && magic !== "ustar ") {
+      throw new Error("Pinned proving bundle archive must use the USTAR format");
+    }
+    const name = tarText(header, 0, 100, "entry name");
+    const prefix = tarText(header, 345, 155, "entry prefix");
+    if (!name || prefix || !SAFE_TAR_NAME.test(name) || name.includes("..") || !allowedNames.has(name)) {
+      throw new Error("Pinned proving bundle archive contains an unexpected entry");
+    }
+    const type = header[156];
+    if (type !== 0 && type !== 48)
+      throw new Error("Pinned proving bundle archive contains a non-file entry");
+    if (tarText(header, 157, 100, "link target"))
+      throw new Error("Pinned proving bundle archive contains a link");
+    if (files.has(name))
+      throw new Error("Pinned proving bundle archive contains a duplicate entry");
+    const size = tarOctal(header, 124, 12, "entry size");
+    const dataStart = offset + BLOCK_BYTES;
+    const dataEnd = dataStart + size;
+    const paddedEnd = dataStart + Math.ceil(size / BLOCK_BYTES) * BLOCK_BYTES;
+    if (size <= 0 || dataEnd > archive.length || paddedEnd > archive.length) {
+      throw new Error("Pinned proving bundle archive entry exceeds its bounds");
+    }
+    if (!zeroBlock(archive.subarray(dataEnd, paddedEnd))) {
+      throw new Error("Pinned proving bundle archive has invalid entry padding");
+    }
+    files.set(name, Buffer.from(archive.subarray(dataStart, dataEnd)));
+    offset = paddedEnd;
+  }
+  if (endBlocks !== 2)
+    throw new Error("Pinned proving bundle archive is missing its end marker");
+  if (!zeroBlock(archive.subarray(offset)))
+    throw new Error("Pinned proving bundle archive has trailing data");
+  if (files.size !== allowedNames.size || [...allowedNames].some((name) => !files.has(name))) {
+    throw new Error("Pinned proving bundle archive is incomplete");
+  }
+  return files;
+}
+async function defaultGithubCommand(arguments_) {
+  try {
+    const { stdout } = await execFile("gh", [...arguments_], {
+      encoding: "utf8",
+      timeout: 6e4,
+      maxBuffer: 2 * 1024 * 1024,
+      windowsHide: true
+    });
+    return stdout;
+  } catch {
+    throw new Error("Pinned proving release could not be read; authenticate with gh and confirm repository access.");
+  }
+}
+function pinnedAsset(release, raw) {
+  let value;
+  try {
+    value = JSON.parse(raw);
+  } catch {
+    throw new Error("Pinned proving release metadata is invalid");
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("Pinned proving release metadata is invalid");
+  }
+  const record = value;
+  const assets = Array.isArray(record.assets) ? record.assets : [];
+  const asset = assets.find((entry) => entry && typeof entry === "object" && !Array.isArray(entry) && entry.name === release.assetName);
+  if (record.id !== release.releaseId || record.tag_name !== release.tag || record.draft !== false || record.immutable !== true || !asset || typeof asset.digest === "string" && asset.digest !== "sha256:" + release.sha256) {
+    throw new Error("Pinned proving release identity or immutability check failed");
+  }
+}
+async function writeBundleFile(directory, name, bytes) {
+  const file = await open2(join5(directory, name), "wx", 384);
+  try {
+    await file.writeFile(bytes);
+    await file.sync();
+  } finally {
+    await file.close();
+  }
+}
+async function replaceDirectoryAtomically(stage, target) {
+  const parent = dirname6(target);
+  await mkdir7(parent, { recursive: true, mode: 448 });
+  const backup = join5(parent, ".base-sepolia-old-" + randomUUID());
+  let movedOld = false;
+  try {
+    try {
+      const existing = await lstat(target);
+      if (existing.isSymbolicLink() || !existing.isDirectory()) {
+        throw new Error("Local proving bundle destination must be a regular directory");
+      }
+      await rename4(target, backup);
+      movedOld = true;
+    } catch (error) {
+      if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") {
+      } else {
+        throw error;
+      }
+    }
+    try {
+      await rename4(stage, target);
+      await chmod5(target, 448);
+    } catch (error) {
+      if (movedOld)
+        await rename4(backup, target);
+      throw error;
+    }
+    if (movedOld)
+      await rm(backup, { recursive: true, force: true }).catch(() => void 0);
+  } finally {
+    await rm(stage, { recursive: true, force: true });
+  }
+}
+async function acquirePinnedArtifactBundle(options) {
+  const release = options.manifest.release;
+  if (!release)
+    throw new Error("This sidecar manifest has no pinned artifact release");
+  const names = new Set(options.manifest.artifacts.map((artifact) => artifact.file));
+  const command = options.runGithubCommand ?? defaultGithubCommand;
+  const parent = dirname6(resolve2(options.targetDirectory));
+  const tempDirectory = join5(parent, ".base-sepolia-download-" + randomUUID());
+  const stage = join5(parent, ".base-sepolia-stage-" + randomUUID());
+  try {
+    await mkdir7(parent, { recursive: true, mode: 448 });
+    await mkdir7(tempDirectory, { recursive: false, mode: 448 });
+    await mkdir7(stage, { recursive: false, mode: 448 });
+    const releaseJson = await command(["api", `repos/${release.repository}/releases/${release.releaseId}`]);
+    pinnedAsset(release, releaseJson);
+    await command([
+      "release",
+      "download",
+      release.tag,
+      "--repo",
+      release.repository,
+      "--dir",
+      tempDirectory,
+      "--pattern",
+      release.assetName
+    ]);
+    const archivePath = join5(tempDirectory, release.assetName);
+    const archiveInfo = await lstat(archivePath);
+    if (archiveInfo.isSymbolicLink() || !archiveInfo.isFile() || archiveInfo.size > MAX_COMPRESSED_BYTES) {
+      throw new Error("Pinned proving bundle archive is missing or too large");
+    }
+    const compressed = await readFile5(archivePath);
+    if (digest(compressed) !== release.sha256)
+      throw new Error("Pinned proving bundle archive failed its SHA-256 check");
+    let expanded;
+    try {
+      expanded = gunzipSync(compressed, { maxOutputLength: MAX_EXPANDED_BYTES });
+    } catch {
+      throw new Error("Pinned proving bundle archive is not a bounded gzip tarball");
+    }
+    const files = parseTar(expanded, names);
+    for (const [name, bytes] of files)
+      await writeBundleFile(stage, name, bytes);
+    await chmod5(stage, 448);
+    await resolvePinnedArtifactBundle({ artifactDirectory: stage, manifest: options.manifest });
+    await replaceDirectoryAtomically(stage, resolve2(options.targetDirectory));
+    await resolvePinnedArtifactBundle({ artifactDirectory: resolve2(options.targetDirectory), manifest: options.manifest });
+    return resolve2(options.targetDirectory);
+  } catch (error) {
+    if (error instanceof Error && /^(Pinned proving|This sidecar manifest|Local proving bundle)/u.test(error.message))
+      throw error;
+    throw new Error("Pinned proving bundle acquisition failed; verify gh access and the published release pin.");
+  } finally {
+    await rm(tempDirectory, { recursive: true, force: true });
+    await rm(stage, { recursive: true, force: true });
+  }
+}
+
+// dist/setup-config.js
 var WITNESS_FILENAMES = /* @__PURE__ */ new Set([
   "base-tree.json",
   "base-sepolia-tree.json",
@@ -82197,7 +82464,7 @@ function absolutePath(value, label) {
   if (typeof value !== "string" || value.trim().length === 0) {
     throw new Error("Setup configuration " + label + " is required");
   }
-  return resolve2(value);
+  return resolve3(value);
 }
 function optionalUnsignedString(value, label) {
   if (value === void 0)
@@ -82247,9 +82514,9 @@ function optionalEnvironmentInteger(environment, name) {
 }
 async function candidateDirectories(homeDirectory, stateDirectory2) {
   const roots = [
-    join5(stateDirectory2, "artifacts", "base-sepolia"),
-    join5(homeDirectory, ".zk-credits", "artifacts", "base-sepolia"),
-    join5(homeDirectory, "Downloads")
+    join6(stateDirectory2, "artifacts", "base-sepolia"),
+    join6(homeDirectory, ".zk-credits", "artifacts", "base-sepolia"),
+    join6(homeDirectory, "Downloads")
   ];
   const candidates = [...roots];
   for (const root of roots) {
@@ -82261,10 +82528,10 @@ async function candidateDirectories(homeDirectory, stateDirectory2) {
     }
     for (const entry of entries) {
       if (entry.isDirectory())
-        candidates.push(join5(root, entry.name));
+        candidates.push(join6(root, entry.name));
     }
   }
-  return [...new Set(candidates.map((path) => resolve2(path)))];
+  return [...new Set(candidates.map((path) => resolve3(path)))];
 }
 async function chooseOne(kind, candidates, chooseCandidate) {
   if (candidates.length === 1)
@@ -82274,14 +82541,14 @@ async function chooseOne(kind, candidates, chooseCandidate) {
     throw new Error("Found more than one valid " + kind + "; set " + variable + " to choose one.");
   }
   const selected = await chooseCandidate(kind, candidates);
-  if (!candidates.includes(resolve2(selected))) {
+  if (!candidates.includes(resolve3(selected))) {
     throw new Error("The selected " + kind + " is not one of the validated local candidates");
   }
-  return resolve2(selected);
+  return resolve3(selected);
 }
 async function resolveArtifactDirectory(options, saved) {
   const explicit = options.environment.ZK_CREDITS_ARTIFACT_DIR?.trim();
-  const candidates = explicit ? [resolve2(options.workingDirectory ?? process.cwd(), explicit)] : [
+  const candidates = explicit ? [resolve3(options.workingDirectory ?? process.cwd(), explicit)] : [
     ...saved ? [saved.artifactDirectory] : [],
     ...await candidateDirectories(options.homeDirectory, options.stateDirectory)
   ];
@@ -82293,7 +82560,7 @@ async function resolveArtifactDirectory(options, saved) {
         artifactDirectory: candidate,
         manifest: options.manifest
       });
-      let identity = resolve2(bundle.directory);
+      let identity = resolve3(bundle.directory);
       try {
         identity = await realpath2(bundle.directory);
       } catch {
@@ -82309,42 +82576,72 @@ async function resolveArtifactDirectory(options, saved) {
     throw new Error("The configured proving bundle at " + explicit + " failed its pinned checks." + reason);
   }
   if (valid.size === 0) {
-    throw new Error("Could not find a valid pinned proving bundle. Extract the bundle from your pilot contact into ~/.zk-credits/artifacts/base-sepolia or ~/Downloads, or set ZK_CREDITS_ARTIFACT_DIR.");
+    if (options.manifest.release && !explicit) {
+      const targetDirectory = resolve3(options.stateDirectory, "artifacts", "base-sepolia");
+      const acquire = options.acquireArtifactBundle ?? (async (target, manifest) => {
+        await acquirePinnedArtifactBundle({ manifest, targetDirectory: target });
+      });
+      await acquire(targetDirectory, options.manifest);
+      const bundle = await resolvePinnedArtifactBundle({ artifactDirectory: targetDirectory, manifest: options.manifest });
+      return resolve3(bundle.directory);
+    }
+    throw new Error("Could not find a valid pinned proving bundle. Set ZK_CREDITS_ARTIFACT_DIR to a verified local bundle.");
   }
   const selected = await chooseOne("proving bundle", [...valid.values()], options.chooseCandidate);
-  return resolve2(selected);
+  return resolve3(selected);
 }
-function eventSourceFromEnvironment(environment) {
+function eventSourceFromEnvironment(environment, manifest) {
   const rpcUrl = environment.BASE_RPC_URL?.trim();
-  const contractAddress = environment.BASE_PRIVATE_CREDIT_BOND_ADDRESS?.trim();
+  const configuredContract = environment.BASE_PRIVATE_CREDIT_BOND_ADDRESS?.trim();
+  const configuredBlock = optionalEnvironmentInteger(environment, "BASE_DEPLOYMENT_BLOCK");
+  const deployment = manifest.deployment;
+  if (deployment) {
+    if (configuredContract && configuredContract.toLowerCase() !== deployment.bondAddress.toLowerCase()) {
+      throw new Error("BASE_PRIVATE_CREDIT_BOND_ADDRESS does not match the pinned Base Sepolia V2 bond");
+    }
+    if (configuredBlock && configuredBlock !== deployment.deploymentBlock) {
+      throw new Error("BASE_DEPLOYMENT_BLOCK does not match the pinned Base Sepolia V2 deployment block");
+    }
+  }
+  const contractAddress = deployment?.bondAddress ?? configuredContract;
   if (!rpcUrl || !contractAddress)
     return void 0;
-  const deploymentBlock = optionalEnvironmentInteger(environment, "BASE_DEPLOYMENT_BLOCK");
   const confirmations = optionalEnvironmentInteger(environment, "BASE_CONFIRMATIONS");
   return {
     kind: "base-events",
     rpcUrl,
     contractAddress,
-    ...deploymentBlock === void 0 ? {} : { deploymentBlock },
+    ...deployment ? { deploymentBlock: deployment.deploymentBlock } : configuredBlock === void 0 ? {} : { deploymentBlock: configuredBlock },
     ...confirmations === void 0 ? {} : { confirmations }
   };
 }
+function assertPinnedEventSource(source, manifest) {
+  const deployment = manifest.deployment;
+  if (!deployment)
+    return;
+  if (source.kind !== "base-events" || source.contractAddress.toLowerCase() !== deployment.bondAddress.toLowerCase() || source.deploymentBlock !== deployment.deploymentBlock) {
+    throw new Error("Saved Base event witness source does not match the pinned Base Sepolia V2 deployment");
+  }
+}
 function witnessCandidates(homeDirectory, stateDirectory2) {
   const roots = [
-    join5(stateDirectory2, "witnesses"),
-    join5(stateDirectory2, "witness"),
-    join5(homeDirectory, ".zk-credits", "witnesses"),
-    join5(homeDirectory, "Downloads")
+    join6(stateDirectory2, "witnesses"),
+    join6(stateDirectory2, "witness"),
+    join6(homeDirectory, ".zk-credits", "witnesses"),
+    join6(homeDirectory, "Downloads")
   ];
-  return [...new Set(roots.flatMap((root) => [...WITNESS_FILENAMES].map((name) => resolve2(root, name))))];
+  return [...new Set(roots.flatMap((root) => [...WITNESS_FILENAMES].map((name) => resolve3(root, name))))];
 }
 async function resolveWitnessSource(options, saved) {
   const environment = options.environment;
   const explicitPath = environment.ZK_CREDITS_WITNESS_PATH?.trim();
   if (explicitPath) {
+    if (options.manifest.deployment) {
+      throw new Error("Base Sepolia V2 setup requires a witness synchronized from the pinned public Base events");
+    }
     const source = {
       kind: "file",
-      path: resolve2(options.workingDirectory ?? process.cwd(), explicitPath)
+      path: resolve3(options.workingDirectory ?? process.cwd(), explicitPath)
     };
     try {
       await options.validateWitness(source);
@@ -82354,7 +82651,7 @@ async function resolveWitnessSource(options, saved) {
       throw new Error("The configured Base witness at " + explicitPath + " failed validation." + reason);
     }
   }
-  const environmentSource = eventSourceFromEnvironment(environment);
+  const environmentSource = eventSourceFromEnvironment(environment, options.manifest);
   if (environmentSource) {
     try {
       await options.validateWitness(environmentSource);
@@ -82366,6 +82663,7 @@ async function resolveWitnessSource(options, saved) {
   }
   if (saved?.witness.kind === "base-events") {
     try {
+      assertPinnedEventSource(saved.witness, options.manifest);
       await options.validateWitness(saved.witness);
       return saved.witness;
     } catch (error) {
@@ -82373,6 +82671,9 @@ async function resolveWitnessSource(options, saved) {
       throw new Error("Saved Base event witness source failed validation." + reason);
     }
   }
+  if (options.manifest.deployment) {
+    throw new Error("Base Sepolia V2 setup requires BASE_RPC_URL to sync the pinned V2 bond from its deployment block");
+  }
   if (saved?.witness.kind === "file") {
     try {
       await options.validateWitness(saved.witness);
@@ -82383,7 +82684,7 @@ async function resolveWitnessSource(options, saved) {
   const valid = [];
   for (const path of witnessCandidates(options.homeDirectory, options.stateDirectory)) {
     try {
-      const info = await lstat(path);
+      const info = await lstat2(path);
       if (!info.isFile())
         continue;
       const source = { kind: "file", path };
@@ -82406,10 +82707,10 @@ async function resolveSetupInputs(options) {
 async function readSetupConfig(path) {
   let raw;
   try {
-    const info = await lstat(path);
+    const info = await lstat2(path);
     if (!info.isFile())
       throw new Error("Local setup config must be a regular file");
-    raw = await readFile5(path, "utf8");
+    raw = await readFile6(path, "utf8");
   } catch (error) {
     if (error && typeof error === "object" && "code" in error && error.code === "ENOENT")
       return void 0;
@@ -82426,30 +82727,30 @@ async function readSetupConfig(path) {
 }
 async function writeSetupConfig(path, config) {
   const normalized = parseSetupConfig(config);
-  const directory = dirname6(resolve2(path));
-  await mkdir7(directory, { recursive: true, mode: 448 });
-  const destination = resolve2(path);
+  const directory = dirname7(resolve3(path));
+  await mkdir8(directory, { recursive: true, mode: 448 });
+  const destination = resolve3(path);
   try {
-    const existing = await lstat(destination);
+    const existing = await lstat2(destination);
     if (existing.isSymbolicLink())
       throw new Error("Local setup config cannot be a symbolic link");
   } catch (error) {
     if (!(error && typeof error === "object" && "code" in error && error.code === "ENOENT"))
       throw error;
   }
-  const temporary = join5(directory, ".config-" + randomUUID() + ".tmp");
+  const temporary = join6(directory, ".config-" + randomUUID2() + ".tmp");
   try {
-    const file = await open2(temporary, "wx", 384);
+    const file = await open3(temporary, "wx", 384);
     try {
       await file.writeFile(JSON.stringify(normalized, null, 2) + "\n", "utf8");
       await file.sync();
     } finally {
       await file.close();
     }
-    await rename4(temporary, destination);
-    await chmod5(destination, 384);
+    await rename5(temporary, destination);
+    await chmod6(destination, 384);
   } finally {
-    await rm(temporary, { force: true });
+    await rm2(temporary, { force: true });
   }
 }
 function applySetupConfig(environment, config) {
@@ -82494,7 +82795,7 @@ async function ensureSidecarReady(dependencies, options = {}) {
 import { createServer } from "node:http";
 
 // dist/responses-bridge.js
-import { randomUUID as randomUUID2 } from "node:crypto";
+import { randomUUID as randomUUID3 } from "node:crypto";
 function isRecord3(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
@@ -82636,7 +82937,7 @@ function translateResponsesRequest(body) {
   if (body.include !== void 0 && (!Array.isArray(body.include) || body.include.some((value) => value !== "reasoning.encrypted_content"))) {
     return { ok: false, error: "unsupported_include" };
   }
-  if (body.reasoning !== void 0 && (!isRecord3(body.reasoning) || !hasOnlyKeys(body.reasoning, ["summary"]) || body.reasoning.summary !== void 0 && !["auto", "concise", "detailed"].includes(String(body.reasoning.summary)))) {
+  if (body.reasoning !== void 0 && (!isRecord3(body.reasoning) || !hasOnlyKeys(body.reasoning, ["effort", "summary"]) || body.reasoning.effort !== void 0 && body.reasoning.effort !== "none" || body.reasoning.summary !== void 0 && !["none", "auto", "concise", "detailed"].includes(String(body.reasoning.summary)))) {
     return { ok: false, error: "unsupported_reasoning_controls" };
   }
   if (body.parallel_tool_calls !== void 0 && typeof body.parallel_tool_calls !== "boolean") {
@@ -82699,7 +83000,7 @@ function responsesEventStream(chatValue, model) {
   if (!isRecord3(choice.message))
     throw new Error("Gateway returned an invalid chat message");
   const message = choice.message;
-  const responseSuffix = randomUUID2().replaceAll("-", "");
+  const responseSuffix = randomUUID3().replaceAll("-", "");
   const responseId = `resp_${responseSuffix}`;
   const events = [];
   let sequence = 0;
@@ -82733,7 +83034,7 @@ function responsesEventStream(chatValue, model) {
   if (refusal !== void 0 && typeof refusal !== "string")
     throw new Error("Gateway returned an invalid refusal value");
   if (typeof text === "string" || typeof refusal === "string") {
-    const itemId = `msg_${randomUUID2().replaceAll("-", "")}`;
+    const itemId = `msg_${randomUUID3().replaceAll("-", "")}`;
     const isRefusal = typeof refusal === "string";
     const part = isRefusal ? { type: "refusal", refusal } : { type: "output_text", text: text ?? "", annotations: [] };
     const item = { id: itemId, type: "message", status: "completed", role: "assistant", content: [part] };
@@ -82766,8 +83067,8 @@ function responsesEventStream(chatValue, model) {
       if (!isRecord3(callValue) || callValue.type !== "function" || !isRecord3(callValue.function) || typeof callValue.function.name !== "string" || typeof callValue.function.arguments !== "string") {
         throw new Error("Gateway returned an invalid function call");
       }
-      const callId = typeof callValue.id === "string" ? callValue.id : `call_${randomUUID2().replaceAll("-", "")}`;
-      const itemId = `fc_${randomUUID2().replaceAll("-", "")}`;
+      const callId = typeof callValue.id === "string" ? callValue.id : `call_${randomUUID3().replaceAll("-", "")}`;
+      const itemId = `fc_${randomUUID3().replaceAll("-", "")}`;
       const item = {
         id: itemId,
         type: "function_call",
@@ -83008,11 +83309,11 @@ function createSidecarServer(options) {
         const request = handler(req, res).finally(() => inFlight.delete(request));
         inFlight.add(request);
       });
-      await new Promise((resolve3, reject) => {
+      await new Promise((resolve4, reject) => {
         server.once("error", reject);
         server.listen(port, "127.0.0.1", () => {
           server.off("error", reject);
-          resolve3();
+          resolve4();
         });
       });
       const address2 = server.address();
@@ -83023,11 +83324,11 @@ function createSidecarServer(options) {
         return;
       const activeServer = server;
       server = null;
-      await new Promise((resolve3, reject) => activeServer.close((error) => {
+      await new Promise((resolve4, reject) => activeServer.close((error) => {
         if (error)
           reject(error);
         else
-          resolve3();
+          resolve4();
       }));
       await Promise.all(inFlight);
     }
@@ -83176,13 +83477,42 @@ async function runBaseRegisteredTrialExchange(options) {
 
 // dist/cli.js
 import { BASE_SEPOLIA_NETWORK as BASE_SEPOLIA_NETWORK2 } from "@zk-credits/x402-zk-prepaid";
+
+// dist/gateway-root-check.js
+function isRecord5(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+async function requireGatewayKnownRoot(root, origin, fetcher = fetch) {
+  let response;
+  try {
+    response = await fetcher(new URL("/v1/root-known", origin), {
+      method: "POST",
+      headers: { accept: "application/json", "content-type": "application/json" },
+      body: JSON.stringify({ root }),
+      signal: AbortSignal.timeout(1e4)
+    });
+  } catch {
+    throw new Error("The gateway could not confirm that the activated credential root is known");
+  }
+  let body;
+  try {
+    body = await response.json();
+  } catch {
+    body = void 0;
+  }
+  if (response.status !== 200 || !isRecord5(body) || body.known !== true) {
+    throw new Error("The activated credential root is not in the gateway known-root set; stop setup and reconcile the V2 activation");
+  }
+}
+
+// dist/cli.js
 var DEFAULT_GATEWAY_URL = "https://zk-credits-gateway.onrender.com";
 var DEFAULT_PORT = 3210;
 function stateDirectory() {
-  return process.env.ZK_CREDITS_HOME || join6(homedir(), ".zk-credits");
+  return process.env.ZK_CREDITS_HOME || join7(homedir(), ".zk-credits");
 }
 function setupConfigPath(directory = stateDirectory()) {
-  return join6(directory, "config.json");
+  return join7(directory, "config.json");
 }
 async function applySavedSetupConfig(environment, directory = stateDirectory()) {
   const config = await readSetupConfig(setupConfigPath(directory));
@@ -83229,7 +83559,7 @@ async function witnessProviderForSource(source, cachePath) {
   if (source.kind === "file") {
     let value;
     try {
-      value = JSON.parse(await readFile6(source.path, "utf8"));
+      value = JSON.parse(await readFile7(source.path, "utf8"));
     } catch {
       throw new Error("The Base witness file could not be read as JSON");
     }
@@ -83262,7 +83592,7 @@ async function readHiddenValue(prompt) {
   process.stdout.write(prompt);
   process.stdin.setRawMode(true);
   process.stdin.resume();
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve4, reject) => {
     let value = "";
     const done = (error) => {
       process.stdin.off("data", onData);
@@ -83272,7 +83602,7 @@ async function readHiddenValue(prompt) {
       if (error)
         reject(error);
       else
-        resolve3(value.trim());
+        resolve4(value.trim());
     };
     const onData = (chunk) => {
       for (const byte of chunk) {
@@ -83295,7 +83625,7 @@ async function readHiddenValue(prompt) {
   });
 }
 async function readEncryptedCredential(path, password) {
-  const parsed = JSON.parse(await readFile6(path, "utf8"));
+  const parsed = JSON.parse(await readFile7(path, "utf8"));
   if (parsed.format !== "zk-credits-credential" || parsed.version !== 1 && parsed.version !== 2) {
     throw new Error("Credential file is not a supported zk-credits export");
   }
@@ -83317,10 +83647,11 @@ non-streaming POST /v1/chat/completions; Codex Responses requests pass through
 the sidecar's bounded local compatibility bridge.
 "zk-credits trial-registered-adapter" runs one confirmed, billable internal
 trial request through the directly registered official x402 client adapter.
-Set ZK_CREDITS_CREDENTIAL_PATH before setup. The wizard searches Downloads and
-~/.zk-credits for the pinned bundle and local Base witness, validates both,
-then saves their paths locally. Alternatively, set ZK_CREDITS_ARTIFACT_DIR and
-ZK_CREDITS_WITNESS_PATH explicitly. Setup prompts for the credential password
+Set ZK_CREDITS_CREDENTIAL_PATH and BASE_RPC_URL before setup. For Base Sepolia
+V2, setup can download the immutable bundle pinned by the package manifest by
+using this machine's authenticated GitHub CLI session, then synchronizes the
+witness from the pinned public Base events and checks the resulting root with
+the gateway. It saves local paths and prompts for the credential password
 without echo; the encrypted export is decrypted only in local memory.`);
 }
 async function loadBaseClientRuntime(passwordInput) {
@@ -83334,18 +83665,18 @@ async function loadBaseClientRuntime(passwordInput) {
   if (!artifactDirectory) {
     throw new Error("Set ZK_CREDITS_ARTIFACT_DIR to the directory holding the installed pinned proving bundle");
   }
-  const witnessProvider = witnessPath ? createFileWitnessProvider(JSON.parse(await readFile6(witnessPath, "utf8"))) : process.env.BASE_RPC_URL && process.env.BASE_PRIVATE_CREDIT_BOND_ADDRESS ? createBaseEventWitnessProvider({
+  const witnessProvider = witnessPath ? createFileWitnessProvider(JSON.parse(await readFile7(witnessPath, "utf8"))) : process.env.BASE_RPC_URL && process.env.BASE_PRIVATE_CREDIT_BOND_ADDRESS ? createBaseEventWitnessProvider({
     rpcUrl: process.env.BASE_RPC_URL,
     contractAddress: process.env.BASE_PRIVATE_CREDIT_BOND_ADDRESS,
     deploymentBlock: process.env.BASE_DEPLOYMENT_BLOCK && /^\d+$/u.test(process.env.BASE_DEPLOYMENT_BLOCK) ? BigInt(process.env.BASE_DEPLOYMENT_BLOCK) : void 0,
     confirmations: process.env.BASE_CONFIRMATIONS && /^\d+$/u.test(process.env.BASE_CONFIRMATIONS) ? BigInt(process.env.BASE_CONFIRMATIONS) : void 0,
-    cachePath: join6(stateDirectory(), "base-event-sync.json")
+    cachePath: join7(stateDirectory(), "base-event-sync.json")
   }) : (() => {
     throw new Error("Set ZK_CREDITS_WITNESS_PATH or configure BASE_RPC_URL and BASE_PRIVATE_CREDIT_BOND_ADDRESS");
   })();
   const proofMetrics = createBaseProofMetrics();
   const exchangeMetrics = createZkPrepaidLifecycleMetrics();
-  const slotLedger = await BaseSlotLedger.open({ path: join6(stateDirectory(), "base-slots.json") });
+  const slotLedger = await BaseSlotLedger.open({ path: join7(stateDirectory(), "base-slots.json") });
   const prove = await createPinnedBaseProofGenerator({ artifactDirectory, metrics: proofMetrics });
   validateBaseCreditWitness(await witnessProvider.witnessForCredential(credential));
   return { credential, witnessProvider, slotLedger, proofMetrics, exchangeMetrics, prove };
@@ -83370,7 +83701,7 @@ var GATEWAY_COUNTER_NAMES = [
 ];
 var GATEWAY_CLAIM_COUNT_NAMES = ["reserved", "ready", "committed", "cancelled"];
 var GATEWAY_READINESS_CHECK_NAMES = /* @__PURE__ */ new Set(["launchControl", "database", "baseRoot", "baseRpc", "verifierAssets", "provider"]);
-function isRecord5(value) {
+function isRecord6(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function safeCount(value) {
@@ -83397,12 +83728,15 @@ async function readGatewayJson(url, headers) {
     return { status: null };
   }
 }
+async function requireGatewayKnownRoot2(root) {
+  await requireGatewayKnownRoot(root, gatewayOrigin());
+}
 async function gatewayReadiness(origin) {
   const response = await readGatewayJson(new URL("/ready", origin), { accept: "application/json" });
-  const report = isRecord5(response.body) ? response.body : void 0;
+  const report = isRecord6(response.body) ? response.body : void 0;
   const checks = Array.isArray(report?.checks) ? report.checks : [];
-  const failedChecks = checks.flatMap((check) => isRecord5(check) && check.ok === true ? [] : [isRecord5(check) && typeof check.name === "string" && GATEWAY_READINESS_CHECK_NAMES.has(check.name) ? check.name : "unknown"]);
-  const hasLaunchCheck = checks.some((check) => isRecord5(check) && check.name === "launchControl" && check.ok === true);
+  const failedChecks = checks.flatMap((check) => isRecord6(check) && check.ok === true ? [] : [isRecord6(check) && typeof check.name === "string" && GATEWAY_READINESS_CHECK_NAMES.has(check.name) ? check.name : "unknown"]);
+  const hasLaunchCheck = checks.some((check) => isRecord6(check) && check.name === "launchControl" && check.ok === true);
   return {
     status: response.status,
     passed: response.status === 200 && report?.ready === true && failedChecks.length === 0 && hasLaunchCheck,
@@ -83414,12 +83748,12 @@ async function gatewayTrialSnapshot(origin, token) {
     accept: "application/json",
     authorization: `Bearer ${token}`
   });
-  const body = isRecord5(response.body) ? response.body : void 0;
-  const launch = isRecord5(body?.launchControl) ? body.launchControl : void 0;
-  const base = isRecord5(body?.base) ? body.base : void 0;
-  const spend = isRecord5(body?.spend) ? body.spend : void 0;
-  const rawMetrics = isRecord5(body?.metrics) ? body.metrics : void 0;
-  const rawClaims = isRecord5(body?.claims) ? body.claims : void 0;
+  const body = isRecord6(response.body) ? response.body : void 0;
+  const launch = isRecord6(body?.launchControl) ? body.launchControl : void 0;
+  const base = isRecord6(body?.base) ? body.base : void 0;
+  const spend = isRecord6(body?.spend) ? body.spend : void 0;
+  const rawMetrics = isRecord6(body?.metrics) ? body.metrics : void 0;
+  const rawClaims = isRecord6(body?.claims) ? body.claims : void 0;
   const metrics = {};
   const claims = {};
   let countersValid = Boolean(rawMetrics && rawClaims);
@@ -83684,7 +84018,7 @@ async function main() {
       if (!path)
         return false;
       try {
-        await readFile6(path);
+        await readFile7(path);
         return true;
       } catch {
         return false;
@@ -83704,8 +84038,10 @@ async function main() {
         configPath: setupConfigPath(sidecarHome),
         manifest,
         validateWitness: async (source) => {
-          const provider = await witnessProviderForSource(source, join6(stateDirectory(), "base-event-sync.json"));
-          validateBaseCreditWitness(await provider.witnessForCredential(credential));
+          const provider = await witnessProviderForSource(source, join7(stateDirectory(), "base-event-sync.json"));
+          const witness = validateBaseCreditWitness(await provider.witnessForCredential(credential));
+          if (manifest.deployment)
+            await requireGatewayKnownRoot2(witness.root);
         },
         chooseCandidate: chooseSetupCandidate
       });