zk-credits 0.2.4 → 0.2.7

package/dist/zk-credits.js

@@ -34651,7 +34651,7 @@ var require_lib = __commonJS({
       };
     }
     // @__NO_SIDE_EFFECTS__
-    function join8(separator = "") {
+    function join9(separator = "") {
       astr("join", separator);
       return {
         encode: (from) => {
@@ -34867,15 +34867,15 @@ var require_lib = __commonJS({
       convertRadix2,
       radix,
       radix2,
-      join: join8,
+      join: join9,
       padding
     };
-    exports.base16 = /* @__PURE__ */ chain(/* @__PURE__ */ radix2(4), /* @__PURE__ */ alphabet("0123456789ABCDEF"), /* @__PURE__ */ join8(""));
-    exports.base32 = /* @__PURE__ */ chain(/* @__PURE__ */ radix2(5), /* @__PURE__ */ alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZ234567"), /* @__PURE__ */ padding(5), /* @__PURE__ */ join8(""));
-    exports.base32nopad = /* @__PURE__ */ chain(/* @__PURE__ */ radix2(5), /* @__PURE__ */ alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZ234567"), /* @__PURE__ */ join8(""));
-    exports.base32hex = /* @__PURE__ */ chain(/* @__PURE__ */ radix2(5), /* @__PURE__ */ alphabet("0123456789ABCDEFGHIJKLMNOPQRSTUV"), /* @__PURE__ */ padding(5), /* @__PURE__ */ join8(""));
-    exports.base32hexnopad = /* @__PURE__ */ chain(/* @__PURE__ */ radix2(5), /* @__PURE__ */ alphabet("0123456789ABCDEFGHIJKLMNOPQRSTUV"), /* @__PURE__ */ join8(""));
-    exports.base32crockford = /* @__PURE__ */ chain(/* @__PURE__ */ radix2(5), /* @__PURE__ */ alphabet("0123456789ABCDEFGHJKMNPQRSTVWXYZ"), /* @__PURE__ */ join8(""), /* @__PURE__ */ normalize((s) => s.toUpperCase().replace(/O/g, "0").replace(/[IL]/g, "1")));
+    exports.base16 = /* @__PURE__ */ chain(/* @__PURE__ */ radix2(4), /* @__PURE__ */ alphabet("0123456789ABCDEF"), /* @__PURE__ */ join9(""));
+    exports.base32 = /* @__PURE__ */ chain(/* @__PURE__ */ radix2(5), /* @__PURE__ */ alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZ234567"), /* @__PURE__ */ padding(5), /* @__PURE__ */ join9(""));
+    exports.base32nopad = /* @__PURE__ */ chain(/* @__PURE__ */ radix2(5), /* @__PURE__ */ alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZ234567"), /* @__PURE__ */ join9(""));
+    exports.base32hex = /* @__PURE__ */ chain(/* @__PURE__ */ radix2(5), /* @__PURE__ */ alphabet("0123456789ABCDEFGHIJKLMNOPQRSTUV"), /* @__PURE__ */ padding(5), /* @__PURE__ */ join9(""));
+    exports.base32hexnopad = /* @__PURE__ */ chain(/* @__PURE__ */ radix2(5), /* @__PURE__ */ alphabet("0123456789ABCDEFGHIJKLMNOPQRSTUV"), /* @__PURE__ */ join9(""));
+    exports.base32crockford = /* @__PURE__ */ chain(/* @__PURE__ */ radix2(5), /* @__PURE__ */ alphabet("0123456789ABCDEFGHJKMNPQRSTVWXYZ"), /* @__PURE__ */ join9(""), /* @__PURE__ */ normalize((s) => s.toUpperCase().replace(/O/g, "0").replace(/[IL]/g, "1")));
     var hasBase64Builtin = /* @__PURE__ */ (() => typeof Uint8Array.from([]).toBase64 === "function" && typeof Uint8Array.fromBase64 === "function")();
     var decodeBase64Builtin = (s, isUrl) => {
       astr("base64", s);
@@ -34893,8 +34893,8 @@ var require_lib = __commonJS({
       decode(s) {
         return decodeBase64Builtin(s, false);
       }
-    } : /* @__PURE__ */ chain(/* @__PURE__ */ radix2(6), /* @__PURE__ */ alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"), /* @__PURE__ */ padding(6), /* @__PURE__ */ join8(""));
-    exports.base64nopad = /* @__PURE__ */ chain(/* @__PURE__ */ radix2(6), /* @__PURE__ */ alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"), /* @__PURE__ */ join8(""));
+    } : /* @__PURE__ */ chain(/* @__PURE__ */ radix2(6), /* @__PURE__ */ alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"), /* @__PURE__ */ padding(6), /* @__PURE__ */ join9(""));
+    exports.base64nopad = /* @__PURE__ */ chain(/* @__PURE__ */ radix2(6), /* @__PURE__ */ alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"), /* @__PURE__ */ join9(""));
     exports.base64url = hasBase64Builtin ? {
       encode(b) {
         abytes(b);
@@ -34903,9 +34903,9 @@ var require_lib = __commonJS({
       decode(s) {
         return decodeBase64Builtin(s, true);
       }
-    } : /* @__PURE__ */ chain(/* @__PURE__ */ radix2(6), /* @__PURE__ */ alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"), /* @__PURE__ */ padding(6), /* @__PURE__ */ join8(""));
-    exports.base64urlnopad = /* @__PURE__ */ chain(/* @__PURE__ */ radix2(6), /* @__PURE__ */ alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"), /* @__PURE__ */ join8(""));
-    var genBase58 = /* @__NO_SIDE_EFFECTS__ */ (abc) => /* @__PURE__ */ chain(/* @__PURE__ */ radix(58), /* @__PURE__ */ alphabet(abc), /* @__PURE__ */ join8(""));
+    } : /* @__PURE__ */ chain(/* @__PURE__ */ radix2(6), /* @__PURE__ */ alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"), /* @__PURE__ */ padding(6), /* @__PURE__ */ join9(""));
+    exports.base64urlnopad = /* @__PURE__ */ chain(/* @__PURE__ */ radix2(6), /* @__PURE__ */ alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"), /* @__PURE__ */ join9(""));
+    var genBase58 = /* @__NO_SIDE_EFFECTS__ */ (abc) => /* @__PURE__ */ chain(/* @__PURE__ */ radix(58), /* @__PURE__ */ alphabet(abc), /* @__PURE__ */ join9(""));
     exports.base58 = /* @__PURE__ */ genBase58("123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz");
     exports.base58flickr = /* @__PURE__ */ genBase58("123456789abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ");
     exports.base58xrp = /* @__PURE__ */ genBase58("rpshnaf39wBUDNEGHJKLM4PQRST7VWXYZ2bcdeCg65jkm8oFqi1tuvAxyz");
@@ -34937,7 +34937,7 @@ var require_lib = __commonJS({
     var createBase58check = (sha256) => /* @__PURE__ */ chain(checksum(4, (data) => sha256(sha256(data))), exports.base58);
     exports.createBase58check = createBase58check;
     exports.base58check = exports.createBase58check;
-    var BECH_ALPHABET = /* @__PURE__ */ chain(/* @__PURE__ */ alphabet("qpzry9x8gf2tvdw0s3jn54khce6mua7l"), /* @__PURE__ */ join8(""));
+    var BECH_ALPHABET = /* @__PURE__ */ chain(/* @__PURE__ */ alphabet("qpzry9x8gf2tvdw0s3jn54khce6mua7l"), /* @__PURE__ */ join9(""));
     var POLYMOD_GENERATORS = [996825010, 642813549, 513874426, 1027748829, 705979059];
     function bech32Polymod(pre) {
       const b = pre >> 25;
@@ -35046,7 +35046,7 @@ var require_lib = __commonJS({
         return Uint8Array.fromHex(s);
       }
     };
-    exports.hex = hasHexBuiltin ? hexBuiltin : /* @__PURE__ */ chain(/* @__PURE__ */ radix2(4), /* @__PURE__ */ alphabet("0123456789abcdef"), /* @__PURE__ */ join8(""), /* @__PURE__ */ normalize((s) => {
+    exports.hex = hasHexBuiltin ? hexBuiltin : /* @__PURE__ */ chain(/* @__PURE__ */ radix2(4), /* @__PURE__ */ alphabet("0123456789abcdef"), /* @__PURE__ */ join9(""), /* @__PURE__ */ normalize((s) => {
       if (typeof s !== "string" || s.length % 2 !== 0)
         throw new TypeError(`hex.decode: expected string, got ${typeof s} with length ${s.length}`);
       return s.toLowerCase();
@@ -80653,9 +80653,9 @@ var require_cjs2 = __commonJS({
 });
 
 // dist/cli.js
-import { homedir } from "node:os";
-import { readFile as readFile7 } from "node:fs/promises";
-import { join as join7 } from "node:path";
+import { homedir as homedir2 } from "node:os";
+import { readFile as readFile8 } from "node:fs/promises";
+import { join as join8 } from "node:path";
 import { createInterface } from "node:readline/promises";
 
 // dist/codex-launcher.js
@@ -80687,6 +80687,7 @@ function renderCodexProfile(options) {
   const model = options.model?.trim() || DEFAULT_CODEX_MODEL;
   return [
     `model = ${tomlString(model)}`,
+    'model_reasoning_effort = "none"',
     'model_provider = "zk_credits"',
     "",
     "[model_providers.zk_credits]",
@@ -80732,7 +80733,7 @@ function codexModelsResponse() {
       apply_patch_tool_type: "freeform",
       web_search_tool_type: "text",
       truncation_policy: { mode: "tokens", limit: 1e4 },
-      supports_parallel_tool_calls: true,
+      supports_parallel_tool_calls: false,
       supports_image_detail_original: false,
       context_window: 128e3,
       max_context_window: 128e3,
@@ -80884,6 +80885,10 @@ var TREE_DEPTH = 20;
 var FIELD_ORDER = 21888242871839275222246405745257275088548364400416034343698204186575808495617n;
 var REPLAY_TTL_MS = 24 * 60 * 60 * 1e3;
 var MAX_PENDING_PAYMENTS = 64;
+var PAYMENT_PROOF_FIELDS = ["pi_a", "pi_b", "pi_c"];
+function proofForPayment(proof) {
+  return Object.fromEntries(PAYMENT_PROOF_FIELDS.filter((field3) => Object.prototype.hasOwnProperty.call(proof, field3)).map((field3) => [field3, proof[field3]]));
+}
 function field(value, label) {
   if (!/^\d+$/u.test(value))
     throw new Error(`Invalid ${label}`);
@@ -80926,6 +80931,7 @@ function requestBodyBytes(body) {
 }
 function createBasePaymentFactory(options) {
   const secret = secretFromBase64Url(options.credential.secret);
+  let internalTrialProofAttempted = false;
   return async ({ method, url, body, requirements }) => {
     if (requirements.extra.deploymentDomain !== options.credential.deploymentDomain) {
       throw new Error("Credential deployment domain does not match the gateway challenge");
@@ -80961,6 +80967,11 @@ function createBasePaymentFactory(options) {
         nullifier,
         share
       ];
+      if (options.internalTrialOneProof) {
+        if (internalTrialProofAttempted)
+          throw new Error("internal_trial_limit_reached");
+        internalTrialProofAttempted = true;
+      }
       const proof = await options.prove({
         secret: secretToField(secret),
         tier_id: String(options.credential.tierId),
@@ -80979,7 +80990,7 @@ function createBasePaymentFactory(options) {
       await slotLedger.commit(selectedSlot);
       const payment = buildPaymentPayload({
         requirements,
-        proof: proof.proof,
+        proof: proofForPayment(proof.proof),
         publicSignals: [...proof.publicSignals],
         nonce,
         responseKey: responseKeys.publicKey
@@ -81256,6 +81267,13 @@ function createFileWitnessProvider(value) {
   };
 }
 
+// dist/local-x402-agent.js
+import { readFile as readFile7 } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join as join7 } from "node:path";
+import { decryptAnyCredentialExport } from "@zk-credits/shared/base";
+import { BASE_SEPOLIA_NETWORK, createZkPrepaidLifecycleMetrics } from "@zk-credits/x402-zk-prepaid";
+
 // dist/base-event-sync.js
 var import_chains = __toESM(require_chains(), 1);
 var import_viem = __toESM(require_cjs2(), 1);
@@ -81873,9 +81891,6 @@ async function createPinnedBaseProofGenerator(options) {
   };
 }
 
-// dist/cli.js
-import { createZkPrepaidLifecycleMetrics } from "@zk-credits/x402-zk-prepaid";
-
 // dist/slot-ledger.js
 import { mkdir as mkdir4, readFile as readFile3, rename as rename2, writeFile as writeFile3 } from "node:fs/promises";
 import { dirname as dirname3 } from "node:path";
@@ -82000,229 +82015,18 @@ var BaseSlotLedger = class _BaseSlotLedger {
   }
 };
 
-// dist/cli.js
-import { decryptAnyCredentialExport } from "@zk-credits/shared/base";
-
-// dist/sidecar-config.js
-import { randomBytes as randomBytes3 } from "node:crypto";
-import { join as join4 } from "node:path";
-function createLoopbackToken() {
-  return randomBytes3(32).toString("base64url");
-}
-function sidecarStatePaths(stateDirectory2) {
-  return {
-    tokenPath: join4(stateDirectory2, "loopback-token"),
-    logPath: join4(stateDirectory2, "sidecar.log")
-  };
-}
-function formatOpenAiEnvironment(loopbackBaseUrl2, localToken) {
-  const url = new URL(loopbackBaseUrl2);
-  if (url.protocol !== "http:" || url.hostname !== "127.0.0.1" || !/^[A-Za-z0-9_-]+$/.test(localToken)) {
-    throw new Error("Sidecar environment must use a valid 127.0.0.1 URL and local token");
-  }
-  return [
-    `export OPENAI_BASE_URL=${url.origin}/v1`,
-    `export OPENAI_API_KEY=${localToken}`
-  ].join("\n");
-}
-
-// dist/cli-runtime.js
-function setupModel(args) {
-  if (args[1] !== "codex")
-    throw new Error("Usage: zk-credits setup codex [--model <model>]");
-  if (args.length === 2)
-    return void 0;
-  if (args.length === 4 && args[2] === "--model" && args[3]?.trim())
-    return args[3];
-  throw new Error("Usage: zk-credits setup codex [--model <model>]");
-}
-async function runCliCommand(args, dependencies) {
-  switch (args[0]) {
-    case "env": {
-      dependencies.write(formatOpenAiEnvironment(dependencies.loopbackBaseUrl, await dependencies.readToken()));
-      return 0;
-    }
-    case "setup": {
-      const model = setupModel(args);
-      if (!await dependencies.isCredentialConfigured())
-        throw new Error("Set ZK_CREDITS_CREDENTIAL_PATH before running zk-credits setup");
-      await dependencies.validateSetupPrerequisites();
-      await dependencies.ensureSidecar();
-      await dependencies.configureCodex(model);
-      dependencies.write("ZK Credits is ready for Codex.");
-      dependencies.write("Run: zk-credits codex");
-      return 0;
-    }
-    case "token": {
-      dependencies.write(await dependencies.ensureSidecar());
-      return 0;
-    }
-    case "status": {
-      dependencies.write(`Credential export: ${await dependencies.isCredentialConfigured() ? "configured" : "missing"}`);
-      dependencies.write(`Codex profile: ${await dependencies.isCodexProfileInstalled() ? "installed" : "missing"}`);
-      dependencies.write(`Sidecar: ${await dependencies.isSidecarHealthy() ? "running" : "stopped"}`);
-      return 0;
-    }
-    case "codex": {
-      if (!await dependencies.isCodexProfileInstalled()) {
-        throw new Error("Run zk-credits setup codex first");
-      }
-      await dependencies.ensureSidecar();
-      return dependencies.launchCodex(args.slice(1));
-    }
-    case "cline": {
-      if (!await dependencies.isCredentialConfigured())
-        throw new Error("Set ZK_CREDITS_CREDENTIAL_PATH before running zk-credits cline");
-      const localToken = await dependencies.ensureSidecar();
-      return dependencies.launchCline(args.slice(1), localToken);
-    }
-    default:
-      throw new Error("Usage: zk-credits <cline|setup codex|codex|status|token|serve|env>");
-  }
-}
-
-// dist/node-sidecar-lifecycle.js
-import { spawn as spawn3 } from "node:child_process";
-import { chmod as chmod4, mkdir as mkdir6, open } from "node:fs/promises";
-import { dirname as dirname5 } from "node:path";
-
-// dist/sidecar-state.js
-import { chmod as chmod3, mkdir as mkdir5, readFile as readFile4, rename as rename3, writeFile as writeFile4 } from "node:fs/promises";
-import { dirname as dirname4 } from "node:path";
-async function writeLoopbackToken(tokenPath, token) {
-  if (!token)
-    throw new Error("Loopback token is required");
-  await mkdir5(dirname4(tokenPath), { recursive: true, mode: 448 });
-  const temporaryPath = `${tokenPath}.tmp`;
-  await writeFile4(temporaryPath, `${token}
-`, { encoding: "utf8", mode: 384 });
-  await chmod3(temporaryPath, 384);
-  await rename3(temporaryPath, tokenPath);
-  await chmod3(tokenPath, 384);
-}
-async function readLoopbackToken(tokenPath) {
-  const token = (await readFile4(tokenPath, "utf8")).trim();
-  if (!token)
-    throw new Error("No active ZK Credits sidecar token; start zk-credits serve first");
-  return token;
-}
-
-// dist/node-sidecar-lifecycle.js
-var CHILD_ENVIRONMENT_KEYS = [
-  "HOME",
-  "PATH",
-  "TMP",
-  "TEMP",
-  "TMPDIR",
-  "LANG",
-  "LC_ALL",
-  "TZ",
-  "SystemRoot",
-  "WINDIR",
-  "COMSPEC",
-  "PATHEXT",
-  "ZK_CREDITS_CREDENTIAL_PATH",
-  "ZK_CREDITS_ARTIFACT_DIR",
-  "ZK_CREDITS_WITNESS_PATH",
-  "ZK_CREDITS_GATEWAY_URL",
-  "BASE_RPC_URL",
-  "BASE_PRIVATE_CREDIT_BOND_ADDRESS",
-  "BASE_DEPLOYMENT_BLOCK",
-  "BASE_CONFIRMATIONS"
-];
-function sidecarEnvironment(stateDirectory2, port) {
-  const environment = {};
-  for (const key of CHILD_ENVIRONMENT_KEYS) {
-    const value = process.env[key];
-    if (value !== void 0)
-      environment[key] = value;
-  }
-  environment.ZK_CREDITS_HOME = stateDirectory2;
-  environment.ZK_CREDITS_SIDECAR_PORT = port;
-  return environment;
-}
-async function startDetachedProcess(specification) {
-  await mkdir6(dirname5(specification.logPath), { recursive: true, mode: 448 });
-  const log = await open(specification.logPath, "a", 384);
-  await chmod4(specification.logPath, 384);
-  try {
-    const child = spawn3(specification.executable, specification.args, {
-      detached: true,
-      env: specification.env,
-      stdio: [specification.stdin === void 0 ? "ignore" : "pipe", log.fd, log.fd]
-    });
-    await new Promise((resolve4, reject) => {
-      child.once("spawn", resolve4);
-      child.once("error", reject);
-    });
-    if (specification.stdin !== void 0 && child.stdin) {
-      child.stdin.on("error", () => void 0);
-      child.stdin.end(specification.stdin);
-    }
-    child.unref();
-  } finally {
-    await log.close();
-  }
-}
-var defaultRuntime = {
-  fetchHealth: async (url) => fetch(url, { signal: AbortSignal.timeout(500) }),
-  startDetachedProcess,
-  wait: async (milliseconds) => new Promise((resolve4) => setTimeout(resolve4, milliseconds))
-};
-function createNodeSidecarLifecycle(options, runtime = defaultRuntime) {
-  const url = new URL(options.loopbackBaseUrl);
-  if (url.protocol !== "http:" || url.hostname !== "127.0.0.1" || !url.port) {
-    throw new Error("Sidecar lifecycle requires a 127.0.0.1 HTTP URL with an explicit port");
-  }
-  return {
-    logPath: options.logPath,
-    async isHealthy() {
-      try {
-        const response = await runtime.fetchHealth(`${url.origin}/health`);
-        if (!response.ok)
-          return false;
-        const body = await response.json();
-        return body.service === "zk-credits-sidecar" && body.status === "ok";
-      } catch {
-        return false;
-      }
-    },
-    async startDetached() {
-      if (!options.readCredentialPassword)
-        throw new Error("Credential password prompt is unavailable");
-      const password = await options.readCredentialPassword();
-      await runtime.startDetachedProcess({
-        executable: process.execPath,
-        args: [options.cliEntryPath, "serve", "--port", url.port, "--credential-password-stdin"],
-        env: sidecarEnvironment(options.stateDirectory, url.port),
-        logPath: options.logPath,
-        stdin: password
-      });
-    },
-    readToken: () => readLoopbackToken(options.tokenPath),
-    wait: runtime.wait
-  };
-}
-
-// dist/server-startup.js
-async function activateSidecarServer(activation) {
-  const address2 = await activation.listen();
-  await activation.publishToken();
-  return address2;
-}
-
 // dist/setup-config.js
 import { randomUUID as randomUUID2 } from "node:crypto";
-import { chmod as chmod6, lstat as lstat2, mkdir as mkdir8, open as open3, readFile as readFile6, readdir, realpath as realpath2, rename as rename5, rm as rm2 } from "node:fs/promises";
-import { dirname as dirname7, join as join6, resolve as resolve3 } from "node:path";
+import { chmod as chmod4, lstat as lstat2, mkdir as mkdir6, open as open2, readFile as readFile5, readdir, realpath as realpath2, rename as rename4, rm as rm2 } from "node:fs/promises";
+import { dirname as dirname5, join as join5, resolve as resolve3 } from "node:path";
 
 // dist/artifact-release.js
 import { createHash as createHash2, randomUUID } from "node:crypto";
 import { execFile as nodeExecFile } from "node:child_process";
 import { gunzipSync } from "node:zlib";
 import { promisify as promisify2 } from "node:util";
-import { chmod as chmod5, lstat, mkdir as mkdir7, open as open2, readFile as readFile5, rename as rename4, rm } from "node:fs/promises";
-import { dirname as dirname6, join as join5, resolve as resolve2 } from "node:path";
+import { chmod as chmod3, lstat, mkdir as mkdir5, open, readFile as readFile4, rename as rename3, rm } from "node:fs/promises";
+import { dirname as dirname4, join as join4, resolve as resolve2 } from "node:path";
 var execFile = promisify2(nodeExecFile);
 var MAX_COMPRESSED_BYTES = 20 * 1024 * 1024;
 var MAX_EXPANDED_BYTES = 32 * 1024 * 1024;
@@ -82347,7 +82151,7 @@ function pinnedAsset(release, raw) {
   }
 }
 async function writeBundleFile(directory, name, bytes) {
-  const file = await open2(join5(directory, name), "wx", 384);
+  const file = await open(join4(directory, name), "wx", 384);
   try {
     await file.writeFile(bytes);
     await file.sync();
@@ -82356,9 +82160,9 @@ async function writeBundleFile(directory, name, bytes) {
   }
 }
 async function replaceDirectoryAtomically(stage, target) {
-  const parent = dirname6(target);
-  await mkdir7(parent, { recursive: true, mode: 448 });
-  const backup = join5(parent, ".base-sepolia-old-" + randomUUID());
+  const parent = dirname4(target);
+  await mkdir5(parent, { recursive: true, mode: 448 });
+  const backup = join4(parent, ".base-sepolia-old-" + randomUUID());
   let movedOld = false;
   try {
     try {
@@ -82366,7 +82170,7 @@ async function replaceDirectoryAtomically(stage, target) {
       if (existing.isSymbolicLink() || !existing.isDirectory()) {
         throw new Error("Local proving bundle destination must be a regular directory");
       }
-      await rename4(target, backup);
+      await rename3(target, backup);
       movedOld = true;
     } catch (error) {
       if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") {
@@ -82375,11 +82179,11 @@ async function replaceDirectoryAtomically(stage, target) {
       }
     }
     try {
-      await rename4(stage, target);
-      await chmod5(target, 448);
+      await rename3(stage, target);
+      await chmod3(target, 448);
     } catch (error) {
       if (movedOld)
-        await rename4(backup, target);
+        await rename3(backup, target);
       throw error;
     }
     if (movedOld)
@@ -82394,13 +82198,13 @@ async function acquirePinnedArtifactBundle(options) {
     throw new Error("This sidecar manifest has no pinned artifact release");
   const names = new Set(options.manifest.artifacts.map((artifact) => artifact.file));
   const command = options.runGithubCommand ?? defaultGithubCommand;
-  const parent = dirname6(resolve2(options.targetDirectory));
-  const tempDirectory = join5(parent, ".base-sepolia-download-" + randomUUID());
-  const stage = join5(parent, ".base-sepolia-stage-" + randomUUID());
+  const parent = dirname4(resolve2(options.targetDirectory));
+  const tempDirectory = join4(parent, ".base-sepolia-download-" + randomUUID());
+  const stage = join4(parent, ".base-sepolia-stage-" + randomUUID());
   try {
-    await mkdir7(parent, { recursive: true, mode: 448 });
-    await mkdir7(tempDirectory, { recursive: false, mode: 448 });
-    await mkdir7(stage, { recursive: false, mode: 448 });
+    await mkdir5(parent, { recursive: true, mode: 448 });
+    await mkdir5(tempDirectory, { recursive: false, mode: 448 });
+    await mkdir5(stage, { recursive: false, mode: 448 });
     const releaseJson = await command(["api", `repos/${release.repository}/releases/${release.releaseId}`]);
     pinnedAsset(release, releaseJson);
     await command([
@@ -82414,12 +82218,12 @@ async function acquirePinnedArtifactBundle(options) {
       "--pattern",
       release.assetName
     ]);
-    const archivePath = join5(tempDirectory, release.assetName);
+    const archivePath = join4(tempDirectory, release.assetName);
     const archiveInfo = await lstat(archivePath);
     if (archiveInfo.isSymbolicLink() || !archiveInfo.isFile() || archiveInfo.size > MAX_COMPRESSED_BYTES) {
       throw new Error("Pinned proving bundle archive is missing or too large");
     }
-    const compressed = await readFile5(archivePath);
+    const compressed = await readFile4(archivePath);
     if (digest(compressed) !== release.sha256)
       throw new Error("Pinned proving bundle archive failed its SHA-256 check");
     let expanded;
@@ -82431,7 +82235,7 @@ async function acquirePinnedArtifactBundle(options) {
     const files = parseTar(expanded, names);
     for (const [name, bytes] of files)
       await writeBundleFile(stage, name, bytes);
-    await chmod5(stage, 448);
+    await chmod3(stage, 448);
     await resolvePinnedArtifactBundle({ artifactDirectory: stage, manifest: options.manifest });
     await replaceDirectoryAtomically(stage, resolve2(options.targetDirectory));
     await resolvePinnedArtifactBundle({ artifactDirectory: resolve2(options.targetDirectory), manifest: options.manifest });
@@ -82514,9 +82318,9 @@ function optionalEnvironmentInteger(environment, name) {
 }
 async function candidateDirectories(homeDirectory, stateDirectory2) {
   const roots = [
-    join6(stateDirectory2, "artifacts", "base-sepolia"),
-    join6(homeDirectory, ".zk-credits", "artifacts", "base-sepolia"),
-    join6(homeDirectory, "Downloads")
+    join5(stateDirectory2, "artifacts", "base-sepolia"),
+    join5(homeDirectory, ".zk-credits", "artifacts", "base-sepolia"),
+    join5(homeDirectory, "Downloads")
   ];
   const candidates = [...roots];
   for (const root of roots) {
@@ -82528,7 +82332,7 @@ async function candidateDirectories(homeDirectory, stateDirectory2) {
     }
     for (const entry of entries) {
       if (entry.isDirectory())
-        candidates.push(join6(root, entry.name));
+        candidates.push(join5(root, entry.name));
     }
   }
   return [...new Set(candidates.map((path) => resolve3(path)))];
@@ -82625,10 +82429,10 @@ function assertPinnedEventSource(source, manifest) {
 }
 function witnessCandidates(homeDirectory, stateDirectory2) {
   const roots = [
-    join6(stateDirectory2, "witnesses"),
-    join6(stateDirectory2, "witness"),
-    join6(homeDirectory, ".zk-credits", "witnesses"),
-    join6(homeDirectory, "Downloads")
+    join5(stateDirectory2, "witnesses"),
+    join5(stateDirectory2, "witness"),
+    join5(homeDirectory, ".zk-credits", "witnesses"),
+    join5(homeDirectory, "Downloads")
   ];
   return [...new Set(roots.flatMap((root) => [...WITNESS_FILENAMES].map((name) => resolve3(root, name))))];
 }
@@ -82710,7 +82514,7 @@ async function readSetupConfig(path) {
     const info = await lstat2(path);
     if (!info.isFile())
       throw new Error("Local setup config must be a regular file");
-    raw = await readFile6(path, "utf8");
+    raw = await readFile5(path, "utf8");
   } catch (error) {
     if (error && typeof error === "object" && "code" in error && error.code === "ENOENT")
       return void 0;
@@ -82727,8 +82531,8 @@ async function readSetupConfig(path) {
 }
 async function writeSetupConfig(path, config) {
   const normalized = parseSetupConfig(config);
-  const directory = dirname7(resolve3(path));
-  await mkdir8(directory, { recursive: true, mode: 448 });
+  const directory = dirname5(resolve3(path));
+  await mkdir6(directory, { recursive: true, mode: 448 });
   const destination = resolve3(path);
   try {
     const existing = await lstat2(destination);
@@ -82738,17 +82542,17 @@ async function writeSetupConfig(path, config) {
     if (!(error && typeof error === "object" && "code" in error && error.code === "ENOENT"))
       throw error;
   }
-  const temporary = join6(directory, ".config-" + randomUUID2() + ".tmp");
+  const temporary = join5(directory, ".config-" + randomUUID2() + ".tmp");
   try {
-    const file = await open3(temporary, "wx", 384);
+    const file = await open2(temporary, "wx", 384);
     try {
       await file.writeFile(JSON.stringify(normalized, null, 2) + "\n", "utf8");
       await file.sync();
     } finally {
       await file.close();
     }
-    await rename5(temporary, destination);
-    await chmod6(destination, 384);
+    await rename4(temporary, destination);
+    await chmod4(destination, 384);
   } finally {
     await rm2(temporary, { force: true });
   }
@@ -82776,21 +82580,6 @@ function applySetupConfig(environment, config) {
   }
 }
 
-// dist/sidecar-lifecycle.js
-async function ensureSidecarReady(dependencies, options = {}) {
-  if (await dependencies.isHealthy())
-    return dependencies.readToken();
-  await dependencies.startDetached();
-  const attempts = options.attempts ?? 50;
-  const intervalMs = options.intervalMs ?? 100;
-  for (let attempt = 0; attempt < attempts; attempt += 1) {
-    await dependencies.wait(intervalMs);
-    if (await dependencies.isHealthy())
-      return dependencies.readToken();
-  }
-  throw new Error(`ZK Credits sidecar did not become ready; inspect ${dependencies.logPath}`);
-}
-
 // dist/sidecar.js
 import { createServer } from "node:http";
 
@@ -82873,6 +82662,11 @@ function responseTools(value) {
       tools.push({ type: "function", function: definition });
       continue;
     }
+    if (tool.type === "custom") {
+      if (!hasOnlyKeys(tool, ["type", "name", "description", "format"]) || tool.name !== "apply_patch" || tool.description !== void 0 && typeof tool.description !== "string" || !isRecord3(tool.format) || !hasOnlyKeys(tool.format, ["type", "syntax", "definition"]) || tool.format.type !== "grammar" || tool.format.syntax !== "lark" || typeof tool.format.definition !== "string")
+        return void 0;
+      continue;
+    }
     if (tool.type === "web_search") {
       if (!hasOnlyKeys(tool, ["type", "external_web_access"]) || tool.external_web_access !== void 0 && typeof tool.external_web_access !== "boolean")
         return void 0;
@@ -82970,8 +82764,6 @@ function translateResponsesRequest(body) {
     }
     chatRequest.max_completion_tokens = body.max_output_tokens;
   }
-  if (body.parallel_tool_calls !== void 0)
-    chatRequest.parallel_tool_calls = body.parallel_tool_calls;
   for (const key of ["temperature", "top_p", "stop", "seed", "presence_penalty", "frequency_penalty", "logit_bias"]) {
     if (body[key] !== void 0)
       chatRequest[key] = body[key];
@@ -83031,8 +82823,9 @@ function responsesEventStream(chatValue, model) {
   if (text !== null && text !== void 0 && typeof text !== "string") {
     throw new Error("Gateway returned an unsupported chat content value");
   }
-  if (refusal !== void 0 && typeof refusal !== "string")
+  if (refusal !== void 0 && refusal !== null && typeof refusal !== "string") {
     throw new Error("Gateway returned an invalid refusal value");
+  }
   if (typeof text === "string" || typeof refusal === "string") {
     const itemId = `msg_${randomUUID3().replaceAll("-", "")}`;
     const isRefusal = typeof refusal === "string";
@@ -83221,6 +83014,7 @@ async function relayResponsesGatewayResponse(res, upstream, responseModel) {
 function createSidecarServer(options) {
   const gatewayBaseUrl = options.gatewayBaseUrl.replace(/\/$/u, "");
   let server = null;
+  let internalTrialRequestClaimed = false;
   const inFlight = /* @__PURE__ */ new Set();
   const handler = async (req, res) => {
     const pathname = new URL(req.url || "/", "http://127.0.0.1").pathname;
@@ -83281,6 +83075,13 @@ function createSidecarServer(options) {
           return;
         }
       }
+      if (options.internalTrialOneProof) {
+        if (internalTrialRequestClaimed) {
+          sendJson(res, 409, { error: "internal_trial_limit_reached" });
+          return;
+        }
+        internalTrialRequestClaimed = true;
+      }
       const upstream = await options.prepaidClient.fetch(`${gatewayBaseUrl}/v1/chat/completions`, {
         method: "POST",
         headers: { "Content-Type": "application/json" },
@@ -83335,9 +83136,337 @@ function createSidecarServer(options) {
   };
 }
 
+// dist/sidecar-config.js
+import { randomBytes as randomBytes3 } from "node:crypto";
+import { join as join6 } from "node:path";
+function createLoopbackToken() {
+  return randomBytes3(32).toString("base64url");
+}
+function sidecarStatePaths(stateDirectory2) {
+  return {
+    tokenPath: join6(stateDirectory2, "loopback-token"),
+    logPath: join6(stateDirectory2, "sidecar.log")
+  };
+}
+function formatOpenAiEnvironment(loopbackBaseUrl2, localToken) {
+  const url = new URL(loopbackBaseUrl2);
+  if (url.protocol !== "http:" || url.hostname !== "127.0.0.1" || !/^[A-Za-z0-9_-]+$/.test(localToken)) {
+    throw new Error("Sidecar environment must use a valid 127.0.0.1 URL and local token");
+  }
+  return [
+    `export OPENAI_BASE_URL=${url.origin}/v1`,
+    `export OPENAI_API_KEY=${localToken}`
+  ].join("\n");
+}
+
+// dist/sidecar-state.js
+import { chmod as chmod5, mkdir as mkdir7, readFile as readFile6, rename as rename5, writeFile as writeFile4 } from "node:fs/promises";
+import { dirname as dirname6 } from "node:path";
+async function writeLoopbackToken(tokenPath, token) {
+  if (!token)
+    throw new Error("Loopback token is required");
+  await mkdir7(dirname6(tokenPath), { recursive: true, mode: 448 });
+  const temporaryPath = `${tokenPath}.tmp`;
+  await writeFile4(temporaryPath, `${token}
+`, { encoding: "utf8", mode: 384 });
+  await chmod5(temporaryPath, 384);
+  await rename5(temporaryPath, tokenPath);
+  await chmod5(tokenPath, 384);
+}
+async function readLoopbackToken(tokenPath) {
+  const token = (await readFile6(tokenPath, "utf8")).trim();
+  if (!token)
+    throw new Error("No active ZK Credits sidecar token; start zk-credits serve first");
+  return token;
+}
+
+// dist/local-x402-agent.js
+var DEFAULT_GATEWAY_URL = "https://zk-credits-gateway.onrender.com";
+var DEFAULT_PORT = 3210;
+async function witnessProviderForSource(source, cachePath) {
+  if (source.kind === "file") {
+    const value = JSON.parse(await readFile7(source.path, "utf8"));
+    return createFileWitnessProvider(value);
+  }
+  return createBaseEventWitnessProvider({
+    rpcUrl: source.rpcUrl,
+    contractAddress: source.contractAddress,
+    deploymentBlock: source.deploymentBlock === void 0 ? void 0 : BigInt(source.deploymentBlock),
+    confirmations: source.confirmations === void 0 ? void 0 : BigInt(source.confirmations),
+    cachePath
+  });
+}
+async function readCredential(path, password) {
+  const parsed = JSON.parse(await readFile7(path, "utf8"));
+  if (parsed.format !== "zk-credits-credential" || parsed.version !== 1 && parsed.version !== 2) {
+    throw new Error("Credential file is not a supported zk-credits export");
+  }
+  return decryptAnyCredentialExport(parsed, password);
+}
+async function createLocalX402Agent(options) {
+  const environment = options.environment ?? process.env;
+  const homeDirectory = options.homeDirectory ?? homedir();
+  const stateDirectory2 = options.stateDirectory ?? environment.ZK_CREDITS_HOME ?? join7(homeDirectory, ".zk-credits");
+  const credentialPath = environment.ZK_CREDITS_CREDENTIAL_PATH;
+  if (!credentialPath)
+    throw new Error("Set ZK_CREDITS_CREDENTIAL_PATH to the encrypted browser export");
+  const savedConfig = await readSetupConfig(join7(stateDirectory2, "config.json"));
+  if (savedConfig)
+    applySetupConfig(environment, savedConfig);
+  const credential = await readCredential(credentialPath, options.credentialPassword);
+  const artifactDirectory = environment.ZK_CREDITS_ARTIFACT_DIR;
+  if (!artifactDirectory)
+    throw new Error("Run `zk-credits setup codex` first to install and verify the pinned proving bundle");
+  const witnessPath = environment.ZK_CREDITS_WITNESS_PATH;
+  const rpcUrl = environment.BASE_RPC_URL;
+  const contractAddress = environment.BASE_PRIVATE_CREDIT_BOND_ADDRESS;
+  const witnessProvider = witnessPath ? await witnessProviderForSource({ kind: "file", path: witnessPath }, join7(stateDirectory2, "base-event-sync.json")) : rpcUrl && contractAddress ? await witnessProviderForSource({
+    kind: "base-events",
+    rpcUrl,
+    contractAddress,
+    ...environment.BASE_DEPLOYMENT_BLOCK && /^\d+$/u.test(environment.BASE_DEPLOYMENT_BLOCK) ? { deploymentBlock: environment.BASE_DEPLOYMENT_BLOCK } : {},
+    ...environment.BASE_CONFIRMATIONS && /^\d+$/u.test(environment.BASE_CONFIRMATIONS) ? { confirmations: environment.BASE_CONFIRMATIONS } : {}
+  }, join7(stateDirectory2, "base-event-sync.json")) : (() => {
+    throw new Error("Local setup is missing its Base witness source; rerun `zk-credits setup codex`");
+  })();
+  const proofMetrics = createBaseProofMetrics();
+  const exchangeMetrics = createZkPrepaidLifecycleMetrics();
+  const slotLedger = await BaseSlotLedger.open({ path: join7(stateDirectory2, "base-slots.json") });
+  const prove = await createPinnedBaseProofGenerator({ artifactDirectory, metrics: proofMetrics });
+  validateBaseCreditWitness(await witnessProvider.witnessForCredential(credential));
+  if (credential.deploymentDomain !== "84532" || credential.expiry <= Math.floor(Date.now() / 1e3)) {
+    throw new Error(`Credential is not active for ${BASE_SEPOLIA_NETWORK}`);
+  }
+  const prepaid = createBasePrepaidClient({
+    credential,
+    witnessProvider,
+    prove,
+    slotLedger,
+    lifecycle: exchangeMetrics.observe
+  });
+  const localToken = createLoopbackToken();
+  const paths = sidecarStatePaths(stateDirectory2);
+  const metrics = () => ({
+    ...proofMetrics.snapshot(),
+    exchange: exchangeMetrics.snapshot()
+  });
+  const server = createSidecarServer({
+    localToken,
+    gatewayBaseUrl: environment.ZK_CREDITS_GATEWAY_URL || DEFAULT_GATEWAY_URL,
+    prepaidClient: prepaid.client,
+    metrics
+  });
+  let baseUrl;
+  try {
+    const port = options.port ?? Number(environment.ZK_CREDITS_SIDECAR_PORT || DEFAULT_PORT);
+    if (!Number.isInteger(port) || port < 0 || port > 65535)
+      throw new Error("Local metrics port is invalid");
+    baseUrl = await server.listen(port);
+    await writeLoopbackToken(paths.tokenPath, localToken);
+  } catch (error) {
+    await server.close();
+    throw error;
+  }
+  return {
+    client: prepaid.client,
+    metricsUrl: `${baseUrl}/metrics`,
+    close: async () => server.close()
+  };
+}
+
+// dist/cli.js
+import { createZkPrepaidLifecycleMetrics as createZkPrepaidLifecycleMetrics2 } from "@zk-credits/x402-zk-prepaid";
+import { decryptAnyCredentialExport as decryptAnyCredentialExport2 } from "@zk-credits/shared/base";
+
+// dist/cli-runtime.js
+function setupModel(args) {
+  if (args[1] !== "codex")
+    throw new Error("Usage: zk-credits setup codex [--model <model>]");
+  if (args.length === 2)
+    return void 0;
+  if (args.length === 4 && args[2] === "--model" && args[3]?.trim())
+    return args[3];
+  throw new Error("Usage: zk-credits setup codex [--model <model>]");
+}
+async function runCliCommand(args, dependencies) {
+  switch (args[0]) {
+    case "env": {
+      dependencies.write(formatOpenAiEnvironment(dependencies.loopbackBaseUrl, await dependencies.readToken()));
+      return 0;
+    }
+    case "setup": {
+      const model = setupModel(args);
+      if (!await dependencies.isCredentialConfigured())
+        throw new Error("Set ZK_CREDITS_CREDENTIAL_PATH before running zk-credits setup");
+      await dependencies.validateSetupPrerequisites();
+      await dependencies.ensureSidecar();
+      await dependencies.configureCodex(model);
+      dependencies.write("ZK Credits is ready for Codex.");
+      dependencies.write("Run: zk-credits codex");
+      return 0;
+    }
+    case "token": {
+      dependencies.write(await dependencies.ensureSidecar());
+      return 0;
+    }
+    case "status": {
+      dependencies.write(`Credential export: ${await dependencies.isCredentialConfigured() ? "configured" : "missing"}`);
+      dependencies.write(`Codex profile: ${await dependencies.isCodexProfileInstalled() ? "installed" : "missing"}`);
+      dependencies.write(`Sidecar: ${await dependencies.isSidecarHealthy() ? "running" : "stopped"}`);
+      return 0;
+    }
+    case "codex": {
+      if (!await dependencies.isCodexProfileInstalled()) {
+        throw new Error("Run zk-credits setup codex first");
+      }
+      await dependencies.ensureSidecar();
+      return dependencies.launchCodex(args.slice(1));
+    }
+    case "cline": {
+      if (!await dependencies.isCredentialConfigured())
+        throw new Error("Set ZK_CREDITS_CREDENTIAL_PATH before running zk-credits cline");
+      const localToken = await dependencies.ensureSidecar();
+      return dependencies.launchCline(args.slice(1), localToken);
+    }
+    default:
+      throw new Error("Usage: zk-credits <cline|setup codex|codex|status|token|serve|env>");
+  }
+}
+
+// dist/node-sidecar-lifecycle.js
+import { spawn as spawn3 } from "node:child_process";
+import { chmod as chmod6, mkdir as mkdir8, open as open3 } from "node:fs/promises";
+import { dirname as dirname7 } from "node:path";
+var CHILD_ENVIRONMENT_KEYS = [
+  "HOME",
+  "PATH",
+  "TMP",
+  "TEMP",
+  "TMPDIR",
+  "LANG",
+  "LC_ALL",
+  "TZ",
+  "SystemRoot",
+  "WINDIR",
+  "COMSPEC",
+  "PATHEXT",
+  "ZK_CREDITS_CREDENTIAL_PATH",
+  "ZK_CREDITS_ARTIFACT_DIR",
+  "ZK_CREDITS_WITNESS_PATH",
+  "ZK_CREDITS_GATEWAY_URL",
+  "BASE_RPC_URL",
+  "BASE_PRIVATE_CREDIT_BOND_ADDRESS",
+  "BASE_DEPLOYMENT_BLOCK",
+  "BASE_CONFIRMATIONS"
+];
+function sidecarEnvironment(stateDirectory2, port) {
+  const environment = {};
+  for (const key of CHILD_ENVIRONMENT_KEYS) {
+    const value = process.env[key];
+    if (value !== void 0)
+      environment[key] = value;
+  }
+  environment.ZK_CREDITS_HOME = stateDirectory2;
+  environment.ZK_CREDITS_SIDECAR_PORT = port;
+  return environment;
+}
+async function startDetachedProcess(specification) {
+  await mkdir8(dirname7(specification.logPath), { recursive: true, mode: 448 });
+  const log = await open3(specification.logPath, "a", 384);
+  await chmod6(specification.logPath, 384);
+  try {
+    const child = spawn3(specification.executable, specification.args, {
+      detached: true,
+      env: specification.env,
+      stdio: [specification.stdin === void 0 ? "ignore" : "pipe", log.fd, log.fd]
+    });
+    await new Promise((resolve4, reject) => {
+      child.once("spawn", resolve4);
+      child.once("error", reject);
+    });
+    if (specification.stdin !== void 0 && child.stdin) {
+      child.stdin.on("error", () => void 0);
+      child.stdin.end(specification.stdin);
+    }
+    child.unref();
+  } finally {
+    await log.close();
+  }
+}
+var defaultRuntime = {
+  fetchHealth: async (url) => fetch(url, { signal: AbortSignal.timeout(500) }),
+  startDetachedProcess,
+  wait: async (milliseconds) => new Promise((resolve4) => setTimeout(resolve4, milliseconds))
+};
+function createNodeSidecarLifecycle(options, runtime = defaultRuntime) {
+  const url = new URL(options.loopbackBaseUrl);
+  if (url.protocol !== "http:" || url.hostname !== "127.0.0.1" || !url.port) {
+    throw new Error("Sidecar lifecycle requires a 127.0.0.1 HTTP URL with an explicit port");
+  }
+  return {
+    logPath: options.logPath,
+    async isHealthy() {
+      try {
+        const response = await runtime.fetchHealth(`${url.origin}/health`);
+        if (!response.ok)
+          return false;
+        const body = await response.json();
+        return body.service === "zk-credits-sidecar" && body.status === "ok";
+      } catch {
+        return false;
+      }
+    },
+    async startDetached() {
+      if (!options.readCredentialPassword)
+        throw new Error("Credential password prompt is unavailable");
+      const password = await options.readCredentialPassword();
+      await runtime.startDetachedProcess({
+        executable: process.execPath,
+        args: [options.cliEntryPath, "serve", "--port", url.port, "--credential-password-stdin"],
+        env: sidecarEnvironment(options.stateDirectory, url.port),
+        logPath: options.logPath,
+        stdin: password
+      });
+    },
+    readToken: () => readLoopbackToken(options.tokenPath),
+    wait: runtime.wait
+  };
+}
+
+// dist/server-startup.js
+async function activateSidecarServer(activation) {
+  const address2 = await activation.listen();
+  await activation.publishToken();
+  return address2;
+}
+
+// dist/sidecar-lifecycle.js
+async function ensureSidecarReady(dependencies, options = {}) {
+  if (await dependencies.isHealthy())
+    return dependencies.readToken();
+  await dependencies.startDetached();
+  const attempts = options.attempts ?? 50;
+  const intervalMs = options.intervalMs ?? 100;
+  for (let attempt = 0; attempt < attempts; attempt += 1) {
+    await dependencies.wait(intervalMs);
+    if (await dependencies.isHealthy())
+      return dependencies.readToken();
+  }
+  throw new Error(`ZK Credits sidecar did not become ready; inspect ${dependencies.logPath}`);
+}
+
 // dist/base-registered-trial.js
 import { x402Client } from "@x402/core/client";
-import { BASE_SEPOLIA_NETWORK, decodeHeader as decodeHeader2, encodeHeader, lifecycleFailure, lifecycleStage, PAYMENT_REQUIRED_HEADER as PAYMENT_REQUIRED_HEADER2, PAYMENT_RESPONSE_HEADER as PAYMENT_RESPONSE_HEADER3, PAYMENT_SIGNATURE_HEADER as PAYMENT_SIGNATURE_HEADER2, registerZkPrepaidClient, ZK_PREPAID_SCHEME } from "@zk-credits/x402-zk-prepaid";
+import { BASE_SEPOLIA_NETWORK as BASE_SEPOLIA_NETWORK2, decodeHeader as decodeHeader2, encodeHeader, lifecycleFailure, lifecycleStage, PAYMENT_REQUIRED_HEADER as PAYMENT_REQUIRED_HEADER2, PAYMENT_RESPONSE_HEADER as PAYMENT_RESPONSE_HEADER3, PAYMENT_SIGNATURE_HEADER as PAYMENT_SIGNATURE_HEADER2, registerZkPrepaidClient, ZK_PREPAID_SCHEME } from "@zk-credits/x402-zk-prepaid";
+function buildBaseRegisteredTrialRequestBody(task = "Reply with exactly: internal trial complete.") {
+  if (typeof task !== "string" || task.trim().length === 0 || task.length > 4e3) {
+    throw new Error("Task must contain between 1 and 4000 characters");
+  }
+  return JSON.stringify({
+    model: "deepseek/deepseek-v4-flash",
+    messages: [{ role: "user", content: task }]
+  });
+}
 function observe(options, event) {
   try {
     options.lifecycle?.(event);
@@ -83406,7 +83535,7 @@ async function runBaseRegisteredTrialExchange(options) {
   } catch {
     return withFailure(options, result, startingCommittedSlots, "challenge_invalid", "challenge_unreadable");
   }
-  if (required.x402Version !== 2 || !Array.isArray(required.accepts) || !required.accepts.some((accepted) => accepted.scheme === ZK_PREPAID_SCHEME && accepted.network === BASE_SEPOLIA_NETWORK)) {
+  if (required.x402Version !== 2 || !Array.isArray(required.accepts) || !required.accepts.some((accepted) => accepted.scheme === ZK_PREPAID_SCHEME && accepted.network === BASE_SEPOLIA_NETWORK2)) {
     return withFailure(options, result, startingCommittedSlots, "challenge_unsupported", "challenge_unsupported");
   }
   const challengeUrl = required.resource?.url;
@@ -83417,7 +83546,7 @@ async function runBaseRegisteredTrialExchange(options) {
   observe(options, lifecycleStage("challenge_received"));
   const createPayment = createBasePaymentFactory(options);
   const directAdapter = registerZkPrepaidClient(new x402Client((_version, accepts) => {
-    const selected = accepts.find((accepted) => accepted.scheme === ZK_PREPAID_SCHEME && accepted.network === BASE_SEPOLIA_NETWORK);
+    const selected = accepts.find((accepted) => accepted.scheme === ZK_PREPAID_SCHEME && accepted.network === BASE_SEPOLIA_NETWORK2);
     if (!selected)
       throw new Error("zk_prepaid_challenge_missing");
     return selected;
@@ -83458,7 +83587,7 @@ async function runBaseRegisteredTrialExchange(options) {
   }
   try {
     const settlement = decodeHeader2(encodedPaymentResponse);
-    if (settlement.success !== true || settlement.network !== BASE_SEPOLIA_NETWORK || settlement.transaction !== "") {
+    if (settlement.success !== true || settlement.network !== BASE_SEPOLIA_NETWORK2 || settlement.transaction !== "") {
       return withFailure(options, result, startingCommittedSlots, "payment_response_invalid", "settlement_failed");
     }
   } catch {
@@ -83471,12 +83600,16 @@ async function runBaseRegisteredTrialExchange(options) {
   }
   result.responseSucceeded = true;
   observe(options, lifecycleStage("exchange_succeeded"));
+  try {
+    await options.onResponse?.(paidResponse.clone());
+  } catch {
+  }
   result.committedSlotDelta = ledger.snapshot().committed - startingCommittedSlots;
   return result;
 }
 
 // dist/cli.js
-import { BASE_SEPOLIA_NETWORK as BASE_SEPOLIA_NETWORK2 } from "@zk-credits/x402-zk-prepaid";
+import { BASE_SEPOLIA_NETWORK as BASE_SEPOLIA_NETWORK3 } from "@zk-credits/x402-zk-prepaid";
 
 // dist/gateway-root-check.js
 function isRecord5(value) {
@@ -83505,14 +83638,74 @@ async function requireGatewayKnownRoot(root, origin, fetcher = fetch) {
   }
 }
 
+// dist/gateway-trial-status.js
+var GATEWAY_READINESS_CHECK_NAMES = [
+  "launchControl",
+  "database",
+  "baseRoot",
+  "baseRpc",
+  "verifierAssets",
+  "provider"
+];
+var MAX_STATUS_AGE_MS = 12e4;
+var MAX_FUTURE_SKEW_MS = 3e4;
+function isRecord6(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isGatewayStatusFresh(value, now = Date.now()) {
+  if (typeof value !== "string")
+    return false;
+  const timestamp = Date.parse(value);
+  if (!Number.isFinite(timestamp))
+    return false;
+  const age = now - timestamp;
+  return age <= MAX_STATUS_AGE_MS && age >= -MAX_FUTURE_SKEW_MS;
+}
+function evaluateGatewayReadiness(status, body, now = Date.now()) {
+  const report = isRecord6(body) ? body : void 0;
+  const checks = Array.isArray(report?.checks) ? report.checks : void 0;
+  const byName = /* @__PURE__ */ new Map();
+  const failedChecks = [];
+  let checksValid = Boolean(checks);
+  for (const check of checks ?? []) {
+    if (!isRecord6(check) || typeof check.name !== "string" || byName.has(check.name)) {
+      checksValid = false;
+      continue;
+    }
+    byName.set(check.name, check);
+    if (!GATEWAY_READINESS_CHECK_NAMES.includes(check.name))
+      checksValid = false;
+  }
+  checksValid = checksValid && byName.size === GATEWAY_READINESS_CHECK_NAMES.length && GATEWAY_READINESS_CHECK_NAMES.every((name) => byName.has(name) && byName.get(name)?.ok === true);
+  for (const name of GATEWAY_READINESS_CHECK_NAMES) {
+    if (byName.get(name)?.ok !== true)
+      failedChecks.push(name);
+  }
+  if (!checksValid && failedChecks.length === 0)
+    failedChecks.push("checks");
+  if (report?.ready !== true)
+    failedChecks.push("ready");
+  if (report?.launchControl !== "enabled" && !failedChecks.includes("launchControl")) {
+    failedChecks.push("launchControl");
+  }
+  const timestampFresh = isGatewayStatusFresh(report?.generatedAt, now);
+  if (!timestampFresh)
+    failedChecks.push("generatedAt");
+  return {
+    passed: status === 200 && report?.ready === true && report.launchControl === "enabled" && checksValid && timestampFresh,
+    failedChecks,
+    timestampFresh
+  };
+}
+
 // dist/cli.js
-var DEFAULT_GATEWAY_URL = "https://zk-credits-gateway.onrender.com";
-var DEFAULT_PORT = 3210;
+var DEFAULT_GATEWAY_URL2 = "https://zk-credits-gateway.onrender.com";
+var DEFAULT_PORT2 = 3210;
 function stateDirectory() {
-  return process.env.ZK_CREDITS_HOME || join7(homedir(), ".zk-credits");
+  return process.env.ZK_CREDITS_HOME || join8(homedir2(), ".zk-credits");
 }
 function setupConfigPath(directory = stateDirectory()) {
-  return join7(directory, "config.json");
+  return join8(directory, "config.json");
 }
 async function applySavedSetupConfig(environment, directory = stateDirectory()) {
   const config = await readSetupConfig(setupConfigPath(directory));
@@ -83520,7 +83713,7 @@ async function applySavedSetupConfig(environment, directory = stateDirectory())
     applySetupConfig(environment, config);
 }
 function loopbackBaseUrl() {
-  const port = Number(process.env.ZK_CREDITS_SIDECAR_PORT || DEFAULT_PORT);
+  const port = Number(process.env.ZK_CREDITS_SIDECAR_PORT || DEFAULT_PORT2);
   if (!Number.isInteger(port) || port < 1 || port > 65535) {
     throw new Error("ZK_CREDITS_SIDECAR_PORT must be a port between 1 and 65535");
   }
@@ -83555,11 +83748,11 @@ async function chooseSetupCandidate(kind, candidates) {
     input.close();
   }
 }
-async function witnessProviderForSource(source, cachePath) {
+async function witnessProviderForSource2(source, cachePath) {
   if (source.kind === "file") {
     let value;
     try {
-      value = JSON.parse(await readFile7(source.path, "utf8"));
+      value = JSON.parse(await readFile8(source.path, "utf8"));
     } catch {
       throw new Error("The Base witness file could not be read as JSON");
     }
@@ -83625,11 +83818,11 @@ async function readHiddenValue(prompt) {
   });
 }
 async function readEncryptedCredential(path, password) {
-  const parsed = JSON.parse(await readFile7(path, "utf8"));
+  const parsed = JSON.parse(await readFile8(path, "utf8"));
   if (parsed.format !== "zk-credits-credential" || parsed.version !== 1 && parsed.version !== 2) {
     throw new Error("Credential file is not a supported zk-credits export");
   }
-  return decryptAnyCredentialExport(parsed, password);
+  return decryptAnyCredentialExport2(parsed, password);
 }
 function printHelp() {
   console.log(`Usage:
@@ -83637,16 +83830,25 @@ function printHelp() {
   zk-credits setup codex [--model <model>]
   zk-credits codex [codex arguments...]
   zk-credits status
-  zk-credits serve [--port <port>]
-  zk-credits trial-registered-adapter
+  zk-credits serve [--port <port>] [--internal-trial-one-proof]
+  zk-credits x402-agent
+  zk-credits founder-demo-agent
   eval "$(zk-credits env)"
 
 "zk-credits cline" and the Codex companion configure and launch coding agents
 against the x402 zk-prepaid loopback sidecar. The gateway spend path is
 non-streaming POST /v1/chat/completions; Codex Responses requests pass through
 the sidecar's bounded local compatibility bridge.
-"zk-credits trial-registered-adapter" runs one confirmed, billable internal
-trial request through the directly registered official x402 client adapter.
+"zk-credits founder-demo-agent" asks for one local task and runs it through
+the request-aware x402 adapter and local proof engine. It requires explicit
+confirmation before one billable internal exchange; the task and response are
+displayed locally and never added to activation evidence.
+"zk-credits x402-agent" is a small task-running starter for the participant's
+own x402 agent loop. It asks for tasks locally and sends each through the same
+request-aware adapter and local proof engine; aggregate metrics stay on the
+loopback-only authenticated endpoint.
+"zk-credits serve --internal-trial-one-proof" limits this sidecar process to
+one authenticated, valid spend request and one local proof attempt.
 Set ZK_CREDITS_CREDENTIAL_PATH and BASE_RPC_URL before setup. For Base Sepolia
 V2, setup can download the immutable bundle pinned by the package manifest by
 using this machine's authenticated GitHub CLI session, then synchronizes the
@@ -83665,18 +83867,20 @@ async function loadBaseClientRuntime(passwordInput) {
   if (!artifactDirectory) {
     throw new Error("Set ZK_CREDITS_ARTIFACT_DIR to the directory holding the installed pinned proving bundle");
   }
-  const witnessProvider = witnessPath ? createFileWitnessProvider(JSON.parse(await readFile7(witnessPath, "utf8"))) : process.env.BASE_RPC_URL && process.env.BASE_PRIVATE_CREDIT_BOND_ADDRESS ? createBaseEventWitnessProvider({
-    rpcUrl: process.env.BASE_RPC_URL,
-    contractAddress: process.env.BASE_PRIVATE_CREDIT_BOND_ADDRESS,
-    deploymentBlock: process.env.BASE_DEPLOYMENT_BLOCK && /^\d+$/u.test(process.env.BASE_DEPLOYMENT_BLOCK) ? BigInt(process.env.BASE_DEPLOYMENT_BLOCK) : void 0,
-    confirmations: process.env.BASE_CONFIRMATIONS && /^\d+$/u.test(process.env.BASE_CONFIRMATIONS) ? BigInt(process.env.BASE_CONFIRMATIONS) : void 0,
-    cachePath: join7(stateDirectory(), "base-event-sync.json")
-  }) : (() => {
+  const baseRpcUrl = process.env.BASE_RPC_URL;
+  const baseContractAddress = process.env.BASE_PRIVATE_CREDIT_BOND_ADDRESS;
+  const witnessProvider = witnessPath ? createFileWitnessProvider(JSON.parse(await readFile8(witnessPath, "utf8"))) : baseRpcUrl && baseContractAddress ? await witnessProviderForSource2({
+    kind: "base-events",
+    rpcUrl: baseRpcUrl,
+    contractAddress: baseContractAddress,
+    ...process.env.BASE_DEPLOYMENT_BLOCK && /^\d+$/u.test(process.env.BASE_DEPLOYMENT_BLOCK) ? { deploymentBlock: process.env.BASE_DEPLOYMENT_BLOCK } : {},
+    ...process.env.BASE_CONFIRMATIONS && /^\d+$/u.test(process.env.BASE_CONFIRMATIONS) ? { confirmations: process.env.BASE_CONFIRMATIONS } : {}
+  }, join8(stateDirectory(), "base-event-sync.json")) : (() => {
     throw new Error("Set ZK_CREDITS_WITNESS_PATH or configure BASE_RPC_URL and BASE_PRIVATE_CREDIT_BOND_ADDRESS");
   })();
   const proofMetrics = createBaseProofMetrics();
-  const exchangeMetrics = createZkPrepaidLifecycleMetrics();
-  const slotLedger = await BaseSlotLedger.open({ path: join7(stateDirectory(), "base-slots.json") });
+  const exchangeMetrics = createZkPrepaidLifecycleMetrics2();
+  const slotLedger = await BaseSlotLedger.open({ path: join8(stateDirectory(), "base-slots.json") });
   const prove = await createPinnedBaseProofGenerator({ artifactDirectory, metrics: proofMetrics });
   validateBaseCreditWitness(await witnessProvider.witnessForCredential(credential));
   return { credential, witnessProvider, slotLedger, proofMetrics, exchangeMetrics, prove };
@@ -83700,15 +83904,14 @@ var GATEWAY_COUNTER_NAMES = [
   "request_rejected"
 ];
 var GATEWAY_CLAIM_COUNT_NAMES = ["reserved", "ready", "committed", "cancelled"];
-var GATEWAY_READINESS_CHECK_NAMES = /* @__PURE__ */ new Set(["launchControl", "database", "baseRoot", "baseRpc", "verifierAssets", "provider"]);
-function isRecord6(value) {
+function isRecord7(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function safeCount(value) {
   return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : void 0;
 }
 function gatewayOrigin() {
-  const origin = new URL(process.env.ZK_CREDITS_GATEWAY_URL || DEFAULT_GATEWAY_URL);
+  const origin = new URL(process.env.ZK_CREDITS_GATEWAY_URL || DEFAULT_GATEWAY_URL2);
   if (origin.protocol !== "https:" || origin.username || origin.password || origin.search || origin.hash || origin.pathname !== "/") {
     throw new Error("The internal trial requires a plain HTTPS gateway origin");
   }
@@ -83733,14 +83936,10 @@ async function requireGatewayKnownRoot2(root) {
 }
 async function gatewayReadiness(origin) {
   const response = await readGatewayJson(new URL("/ready", origin), { accept: "application/json" });
-  const report = isRecord6(response.body) ? response.body : void 0;
-  const checks = Array.isArray(report?.checks) ? report.checks : [];
-  const failedChecks = checks.flatMap((check) => isRecord6(check) && check.ok === true ? [] : [isRecord6(check) && typeof check.name === "string" && GATEWAY_READINESS_CHECK_NAMES.has(check.name) ? check.name : "unknown"]);
-  const hasLaunchCheck = checks.some((check) => isRecord6(check) && check.name === "launchControl" && check.ok === true);
+  const gate = evaluateGatewayReadiness(response.status, response.body);
   return {
     status: response.status,
-    passed: response.status === 200 && report?.ready === true && failedChecks.length === 0 && hasLaunchCheck,
-    failedChecks
+    ...gate
   };
 }
 async function gatewayTrialSnapshot(origin, token) {
@@ -83748,12 +83947,12 @@ async function gatewayTrialSnapshot(origin, token) {
     accept: "application/json",
     authorization: `Bearer ${token}`
   });
-  const body = isRecord6(response.body) ? response.body : void 0;
-  const launch = isRecord6(body?.launchControl) ? body.launchControl : void 0;
-  const base = isRecord6(body?.base) ? body.base : void 0;
-  const spend = isRecord6(body?.spend) ? body.spend : void 0;
-  const rawMetrics = isRecord6(body?.metrics) ? body.metrics : void 0;
-  const rawClaims = isRecord6(body?.claims) ? body.claims : void 0;
+  const body = isRecord7(response.body) ? response.body : void 0;
+  const launch = isRecord7(body?.launchControl) ? body.launchControl : void 0;
+  const base = isRecord7(body?.base) ? body.base : void 0;
+  const spend = isRecord7(body?.spend) ? body.spend : void 0;
+  const rawMetrics = isRecord7(body?.metrics) ? body.metrics : void 0;
+  const rawClaims = isRecord7(body?.claims) ? body.claims : void 0;
   const metrics = {};
   const claims = {};
   let countersValid = Boolean(rawMetrics && rawClaims);
@@ -83779,7 +83978,7 @@ async function gatewayTrialSnapshot(origin, token) {
   return {
     status: response.status,
     ...snapshot ? { snapshot } : {},
-    gatePassed: response.status === 200 && body?.network === BASE_SEPOLIA_NETWORK2 && launch?.state === "enabled" && knownRoot && safeCount(base?.knownRootCount) !== void 0 && (safeCount(base?.knownRootCount) ?? 0) > 0 && lag !== void 0 && lag <= 300n && headroom(spend?.dailyHeadroomMicroUsd) && headroom(spend?.rollingHeadroomMicroUsd) && countersValid
+    gatePassed: response.status === 200 && isGatewayStatusFresh(body?.generatedAt) && body?.network === BASE_SEPOLIA_NETWORK3 && launch?.state === "enabled" && knownRoot && safeCount(base?.knownRootCount) !== void 0 && (safeCount(base?.knownRootCount) ?? 0) > 0 && lag !== void 0 && lag <= 300n && headroom(spend?.dailyHeadroomMicroUsd) && headroom(spend?.rollingHeadroomMicroUsd) && countersValid
   };
 }
 async function confirmDirectTrial() {
@@ -83793,27 +83992,110 @@ async function confirmDirectTrial() {
     input.close();
   }
 }
+async function readFounderDemoTask() {
+  if (!process.stdin.isTTY || !process.stdout.isTTY) {
+    throw new Error("the founder demo requires a local interactive terminal");
+  }
+  const input = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    const task = (await input.question("Task for the founder x402 demo agent (up to 4000 characters): ")).trim();
+    if (task.length === 0 || task.length > 4e3) {
+      throw new Error("Task must contain between 1 and 4000 characters");
+    }
+    return task;
+  } finally {
+    input.close();
+  }
+}
+async function readX402AgentTask() {
+  if (!process.stdin.isTTY || !process.stdout.isTTY) {
+    throw new Error("the x402 starter agent requires a local interactive terminal");
+  }
+  const input = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    const task = (await input.question("Task for your x402 agent (or :quit): ")).trim();
+    if (task === ":quit")
+      return null;
+    if (task.length === 0 || task.length > 4e3) {
+      throw new Error("Task must contain between 1 and 4000 characters");
+    }
+    return task;
+  } finally {
+    input.close();
+  }
+}
+async function runX402Agent() {
+  const gateway = gatewayOrigin();
+  const runtime = await createLocalX402Agent({
+    credentialPassword: await readHiddenValue("Credential backup password: ")
+  });
+  const url = new URL("/v1/chat/completions", gateway).toString();
+  console.log(`Local aggregate metrics: ${runtime.metricsUrl}`);
+  console.log("Enter one task at a time. Each task can spend one founder-provisioned test credit.");
+  try {
+    while (true) {
+      const task = await readX402AgentTask();
+      if (task === null)
+        break;
+      const response = await runtime.client.fetch(url, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: buildBaseRegisteredTrialRequestBody(task)
+      });
+      await displayAgentResponse(response);
+      if (!response.ok)
+        console.log(`Request ended with HTTP ${response.status}.`);
+    }
+  } finally {
+    await runtime.close();
+  }
+}
+async function displayAgentResponse(response) {
+  let content;
+  try {
+    const body = await response.json();
+    if (isRecord7(body) && Array.isArray(body.choices) && isRecord7(body.choices[0])) {
+      const message = body.choices[0].message;
+      if (isRecord7(message))
+        content = message.content;
+    }
+  } catch {
+  }
+  console.log("\nAgent response (shown locally only):");
+  if (typeof content === "string") {
+    console.log(content);
+    return;
+  }
+  if (Array.isArray(content)) {
+    const textParts = content.filter((part) => isRecord7(part)).filter((part) => part.type === "text" && typeof part.text === "string").map((part) => part.text);
+    if (textParts.length > 0) {
+      console.log(textParts.join("\n"));
+      return;
+    }
+  }
+  console.log("[The response completed, but its text content was not available for local display.]");
+}
 function gatewayCounterDelta(before, after) {
   return {
     metrics: Object.fromEntries(GATEWAY_COUNTER_NAMES.map((name) => [name, after.metrics[name] - before.metrics[name]])),
     claims: Object.fromEntries(GATEWAY_CLAIM_COUNT_NAMES.map((name) => [name, after.claims[name] - before.claims[name]]))
   };
 }
-async function trialRegisteredAdapter() {
+async function trialRegisteredAdapter(task) {
   if (!await confirmDirectTrial()) {
-    console.log(JSON.stringify({ path: "registered-adapter", status: "not_run" }));
+    console.log(JSON.stringify({ path: "founder-demo-agent", status: "not_run" }));
     return;
   }
   try {
     const runtime = await loadBaseClientRuntime();
     if (runtime.credential.tierId !== 0 || runtime.credential.deploymentDomain !== "84532" || runtime.credential.expiry <= Math.floor(Date.now() / 1e3)) {
-      console.log(JSON.stringify({ path: "registered-adapter", status: "stopped", failurePhase: "credential_gate" }));
+      console.log(JSON.stringify({ path: "founder-demo-agent", status: "stopped", failurePhase: "credential_gate" }));
       return;
     }
     const startingSlots = runtime.slotLedger.snapshot();
     if (startingSlots.committed >= startingSlots.capacity) {
       console.log(JSON.stringify({
-        path: "registered-adapter",
+        path: "founder-demo-agent",
         status: "stopped",
         failurePhase: "local_credit_gate",
         localCredits: { capacity: startingSlots.capacity, committed: startingSlots.committed, available: 0 }
@@ -83823,7 +84105,7 @@ async function trialRegisteredAdapter() {
     const gateway = gatewayOrigin();
     const adminToken = process.env.BILLING_INTERNAL_TOKEN || await readHiddenValue("Gateway admin token: ");
     if (!adminToken.trim()) {
-      console.log(JSON.stringify({ path: "registered-adapter", status: "stopped", failurePhase: "admin_auth" }));
+      console.log(JSON.stringify({ path: "founder-demo-agent", status: "stopped", failurePhase: "admin_auth" }));
       return;
     }
     const lifecycle = createNodeSidecarLifecycle({
@@ -83833,40 +84115,36 @@ async function trialRegisteredAdapter() {
       logPath: sidecarStatePaths(stateDirectory()).logPath,
       cliEntryPath: process.argv[1] ?? ""
     });
-    const codexHome = resolveCodexHome(process.env, homedir());
+    const codexHome = resolveCodexHome(process.env, homedir2());
     const [sidecarRunning, codexProfileInstalled] = await Promise.all([
       lifecycle.isHealthy(),
       isCodexProfileInstalled(codexHome)
     ]);
     const launcherStatus = { codexProfileInstalled, sidecarRunning };
     if (sidecarRunning) {
-      console.log(JSON.stringify({ path: "registered-adapter", status: "stopped", failurePhase: "sidecar_running", launcherStatus }));
+      console.log(JSON.stringify({ path: "founder-demo-agent", status: "stopped", failurePhase: "sidecar_running", launcherStatus }));
       return;
     }
     const witness = await runtime.witnessProvider.witnessForCredential(runtime.credential);
     const readiness = await gatewayReadiness(gateway);
     if (!readiness.passed) {
-      console.log(JSON.stringify({ path: "registered-adapter", status: "stopped", failurePhase: "readiness", launcherStatus, readiness }));
+      console.log(JSON.stringify({ path: "founder-demo-agent", status: "stopped", failurePhase: "readiness", launcherStatus, readiness }));
       return;
     }
     const adminBefore = await gatewayTrialSnapshot(gateway, adminToken);
     if (!adminBefore.gatePassed || !adminBefore.snapshot) {
-      console.log(JSON.stringify({ path: "registered-adapter", status: "stopped", failurePhase: "admin_status", launcherStatus, readiness, adminStatus: adminBefore.status }));
+      console.log(JSON.stringify({ path: "founder-demo-agent", status: "stopped", failurePhase: "admin_status", launcherStatus, readiness, adminStatus: adminBefore.status }));
       return;
     }
     if (witness.root !== adminBefore.snapshot.currentRoot) {
-      console.log(JSON.stringify({ path: "registered-adapter", status: "stopped", failurePhase: "root_mismatch", launcherStatus, readiness, adminStatus: adminBefore.status }));
+      console.log(JSON.stringify({ path: "founder-demo-agent", status: "stopped", failurePhase: "root_mismatch", launcherStatus, readiness, adminStatus: adminBefore.status }));
       return;
     }
     const baselineSlots = runtime.slotLedger.snapshot();
     const baselineProof = runtime.proofMetrics.snapshot();
     const baselineLifecycle = runtime.exchangeMetrics.snapshot();
     const requestUrl = new URL("/v1/chat/completions", gateway).toString();
-    const requestBody = JSON.stringify({
-      model: "deepseek/deepseek-v4-flash",
-      messages: [{ role: "user", content: "Reply with exactly: internal trial complete." }],
-      stream: false
-    });
+    const requestBody = buildBaseRegisteredTrialRequestBody(task);
     const exchange = await runBaseRegisteredTrialExchange({
       url: requestUrl,
       body: requestBody,
@@ -83875,7 +84153,8 @@ async function trialRegisteredAdapter() {
       witnessProvider: runtime.witnessProvider,
       prove: runtime.prove,
       slotLedger: runtime.slotLedger,
-      lifecycle: runtime.exchangeMetrics.observe
+      lifecycle: runtime.exchangeMetrics.observe,
+      onResponse: displayAgentResponse
     });
     const adminAfter = await gatewayTrialSnapshot(gateway, adminToken);
     const proofAfter = runtime.proofMetrics.snapshot();
@@ -83897,7 +84176,7 @@ async function trialRegisteredAdapter() {
     const gatewayCountersMatch = Boolean(counterDelta) && expectedGatewayCounters.every((name) => counterDelta.metrics[name] === 1) && Object.entries(counterDelta?.metrics ?? {}).every(([name, value]) => expectedGatewayCounters.includes(name) || value === 0) && counterDelta?.claims.committed === 1 && Object.entries(counterDelta?.claims ?? {}).every(([name, value]) => name === "committed" || value === 0);
     const failurePhase = exchange.failurePhase ?? (!exchange.responseSucceeded ? "response_not_ok" : void 0) ?? (adminAfter.status !== 200 || !adminAfter.snapshot ? "postflight_admin_status" : void 0) ?? (!gatewayCountersMatch ? "gateway_counter_delta" : void 0);
     console.log(JSON.stringify({
-      path: "registered-adapter",
+      path: "founder-demo-agent",
       readiness: { status: readiness.status, passed: readiness.passed, failedChecks: readiness.failedChecks },
       launcherStatus,
       adminStatus: { before: adminBefore.status, after: adminAfter.status },
@@ -83924,11 +84203,12 @@ async function trialRegisteredAdapter() {
       failurePhase
     }));
   } catch {
-    console.log(JSON.stringify({ path: "registered-adapter", status: "stopped", failurePhase: "local_setup" }));
+    console.log(JSON.stringify({ path: "founder-demo-agent", status: "stopped", failurePhase: "local_setup" }));
   }
 }
 async function serve(args, passwordInput) {
   const port = readPort(args);
+  const internalTrialOneProof = args.includes("--internal-trial-one-proof");
   const statePaths = sidecarStatePaths(stateDirectory());
   const localToken = createLoopbackToken();
   const { credential, witnessProvider, proofMetrics, exchangeMetrics, slotLedger, prove } = await loadBaseClientRuntime(passwordInput);
@@ -83937,13 +84217,15 @@ async function serve(args, passwordInput) {
     witnessProvider,
     prove,
     slotLedger,
+    internalTrialOneProof,
     lifecycle: exchangeMetrics.observe
   });
-  const gatewayBaseUrl = process.env.ZK_CREDITS_GATEWAY_URL || DEFAULT_GATEWAY_URL;
+  const gatewayBaseUrl = process.env.ZK_CREDITS_GATEWAY_URL || DEFAULT_GATEWAY_URL2;
   const sidecar = createSidecarServer({
     localToken,
     gatewayBaseUrl,
     prepaidClient: prepaid.client,
+    internalTrialOneProof,
     metrics: () => ({ ...proofMetrics.snapshot(), exchange: exchangeMetrics.snapshot() })
   });
   let address2;
@@ -83984,12 +84266,21 @@ async function main() {
     await serve(args.slice(1).filter((argument) => argument !== "--credential-password-stdin"), passwordFromStdin);
     return;
   }
-  if (args[0] === "trial-registered-adapter") {
-    await trialRegisteredAdapter();
+  if (args[0] === "founder-demo-agent") {
+    if (args.length !== 1)
+      throw new Error("founder-demo-agent does not accept arguments; it reads the task locally");
+    const task = await readFounderDemoTask();
+    await trialRegisteredAdapter(task);
+    return;
+  }
+  if (args[0] === "x402-agent") {
+    if (args.length !== 1)
+      throw new Error("x402-agent does not accept arguments; it reads tasks locally");
+    await runX402Agent();
     return;
   }
   const statePaths = sidecarStatePaths(sidecarHome);
-  const codexHome = resolveCodexHome(process.env, homedir());
+  const codexHome = resolveCodexHome(process.env, homedir2());
   const cliEntryPath = process.argv[1];
   if (!cliEntryPath)
     throw new Error("Unable to resolve the zk-credits executable path");
@@ -84018,7 +84309,7 @@ async function main() {
       if (!path)
         return false;
       try {
-        await readFile7(path);
+        await readFile8(path);
         return true;
       } catch {
         return false;
@@ -84033,12 +84324,12 @@ async function main() {
       const manifest = await loadCircuitManifest();
       const config = await resolveSetupInputs({
         environment: process.env,
-        homeDirectory: homedir(),
+        homeDirectory: homedir2(),
         stateDirectory: sidecarHome,
         configPath: setupConfigPath(sidecarHome),
         manifest,
         validateWitness: async (source) => {
-          const provider = await witnessProviderForSource(source, join7(stateDirectory(), "base-event-sync.json"));
+          const provider = await witnessProviderForSource2(source, join8(stateDirectory(), "base-event-sync.json"));
           const witness = validateBaseCreditWitness(await provider.witnessForCredential(credential));
           if (manifest.deployment)
             await requireGatewayKnownRoot2(witness.root);