@agenzo/token-cli 0.1.2

package/dist/index.js

@@ -0,0 +1,1649 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { Command } from "commander";
+
+// ../../packages/cli-core/dist/index.js
+import { readFileSync } from "fs";
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
+import { readFile as readFile3, writeFile as writeFile3, mkdir as mkdir3, chmod as chmod3 } from "fs/promises";
+import { join as join4 } from "path";
+import { homedir as homedir3 } from "os";
+import { input, password, select } from "@inquirer/prompts";
+var CODE_NUM = {
+  AUTH_SESSION_EXPIRED: 1001,
+  AUTH_MAGIC_LINK_EXPIRED: 1002,
+  AUTH_INVITE_CODE_REQUIRED: 1003,
+  AUTH_INVITE_CODE_INVALID: 1004,
+  KEY_INVALID: 1101,
+  KEY_SCOPE_DENIED: 1102,
+  RESOURCE_NOT_FOUND: 2001,
+  RESOURCE_CONFLICT: 2002,
+  RESOURCE_STATE_INVALID: 2003,
+  PARAM_INVALID: 2101,
+  PARAM_IDEMPOTENCY_KEY_REQUIRED: 2102,
+  PARAM_IDEMPOTENCY_KEY_CONFLICT: 2103,
+  BILLING_MODE_MISMATCH: 3001,
+  ACCOUNT_NOT_FOUND: 3101,
+  ACCOUNT_SUSPENDED: 3102,
+  ACCOUNT_INSUFFICIENT_BALANCE: 3103,
+  PAYMENT_ORDER_NOT_FOUND: 3201,
+  PAYMENT_ORDER_NOT_PAID: 3202,
+  PAYMENT_ORDER_MISMATCH: 3203,
+  PAYMENT_ORDER_ALREADY_CONSUMED: 3204,
+  TOKEN_FEATURE_DISABLED: 4001,
+  SERVICE_NOT_FOUND: 4101,
+  VEHICLE_UNAVAILABLE: 4201,
+  QUOTE_EXPIRED: 4202,
+  BOOKING_FAILED: 4203,
+  CANCELLATION_NOT_ALLOWED: 4204,
+  RATE_LIMITED: 5001,
+  UPSTREAM_ERROR: 5101,
+  INTERNAL_ERROR: 5201,
+  NOT_IMPLEMENTED: 5300,
+  CLIENT_NOT_SIGNED_IN: 9001,
+  CLIENT_LOGIN_TIMEOUT: 9002,
+  CLIENT_ORG_NOT_LOCAL: 9003,
+  CLIENT_ORG_WRONG_ENV: 9004,
+  CLIENT_NO_PAYMENT_METHOD: 9005,
+  CLIENT_CARD_NOT_MATCHED: 9006,
+  CLIENT_ABORTED: 9007,
+  UPGRADE_REQUIRED: 9008
+};
+function codeNum(code) {
+  return CODE_NUM[code];
+}
+var CliError = class _CliError extends Error {
+  constructor(code, message, statusCode, requestId, upstream) {
+    super(message);
+    this.code = code;
+    this.statusCode = statusCode;
+    this.requestId = requestId;
+    this.upstream = upstream;
+    this.name = "CliError";
+  }
+  code;
+  statusCode;
+  requestId;
+  upstream;
+  /**
+   * Map a backend ApiError to a CLI-facing code (§8.5 transitional mapping).
+   * Backend numeric codes / HTTP status are translated to §8.4 string codes;
+   * the raw backend message is NOT passed through (§8.1 principle 4) — a
+   * stable, fixed message per code is used instead.
+   *
+   * The optional `opts.auth` selects the auth semantics for the 401 mapping:
+   * - `'bearer'` (default, admin-cli Bearer Token): 401 → `AUTH_SESSION_EXPIRED`.
+   * - `'api-key'` (token-cli `X-Api-Key`): 401 → `KEY_INVALID`.
+   * 403 maps to `KEY_SCOPE_DENIED` under both auth modes. Omitting `opts`
+   * preserves the original Bearer behavior exactly (§8.5 / requirement 6.4).
+   *
+   * Domain string-code routing (D3 / requirement 5.4): when the backend
+   * supplies a string `error.code` in the v3 envelope that is a known §8 code
+   * (present in {@link CODE_NUM}), it is used verbatim as the CLI-facing code
+   * so ride/merchant-specific codes (`QUOTE_EXPIRED`, `VEHICLE_UNAVAILABLE`,
+   * `BILLING_MODE_MISMATCH`, `PAYMENT_ORDER_*`, …) survive intact. Otherwise —
+   * including when no string code is provided, as is the case for admin/token
+   * today — mapping falls back to the HTTP-status table below, leaving the
+   * existing Bearer/api-key behavior unchanged.
+   */
+  static fromApi(error, opts) {
+    if (error.code && isKnownErrorCode(error.code)) {
+      return new _CliError(
+        error.code,
+        STABLE_MESSAGE[error.code] ?? "Request failed. Please check your input and retry.",
+        error.statusCode,
+        error.requestId,
+        error.upstream
+      );
+    }
+    const status = error.statusCode;
+    let code;
+    if (status === 401) code = opts?.auth === "api-key" ? "KEY_INVALID" : "AUTH_SESSION_EXPIRED";
+    else if (status === 403) code = "KEY_SCOPE_DENIED";
+    else if (status === 404) code = "RESOURCE_NOT_FOUND";
+    else if (status === 409) code = "RESOURCE_CONFLICT";
+    else if (status === 429) code = "RATE_LIMITED";
+    else if (status >= 500) code = "INTERNAL_ERROR";
+    else code = "PARAM_INVALID";
+    return new _CliError(
+      code,
+      STABLE_MESSAGE[code] ?? "Request failed. Please check your input and retry.",
+      status,
+      error.requestId,
+      error.upstream
+    );
+  }
+};
+var NetworkError = class extends CliError {
+  constructor(_url, timeout, _cause) {
+    super(
+      "UPSTREAM_ERROR",
+      timeout ? "The request timed out. The service may be temporarily unavailable \u2014 please retry." : "Connection failed. The service may be temporarily unavailable \u2014 please retry."
+    );
+  }
+};
+var ConfigError = class extends CliError {
+  constructor(message, filePath) {
+    super("INTERNAL_ERROR", message || "Unknown error");
+    this.filePath = filePath;
+  }
+  filePath;
+};
+var ValidationError = class extends CliError {
+  constructor(message) {
+    super("PARAM_INVALID", message || "Unknown error");
+  }
+};
+var IdempotencyKeyRequiredError = class extends CliError {
+  constructor(commandPath) {
+    super(
+      "PARAM_IDEMPOTENCY_KEY_REQUIRED",
+      `\`${commandPath}\` requires --idempotency-key <key>. Supply a unique key so the write can be safely retried.`
+    );
+  }
+};
+var UpgradeRequiredError = class extends CliError {
+  constructor(currentVersion, minVersion, upgradeCommand) {
+    super(
+      "UPGRADE_REQUIRED",
+      `agenzo-admin-cli ${currentVersion} is out of date \u2014 the server requires ${minVersion} or newer. To upgrade, run: ${upgradeCommand}`
+    );
+  }
+};
+var UserCancelError = class extends CliError {
+  constructor(message = "Operation cancelled by user") {
+    super("CLIENT_ABORTED", message || "Unknown error");
+  }
+};
+function isKnownErrorCode(value) {
+  return Object.prototype.hasOwnProperty.call(CODE_NUM, value);
+}
+var STABLE_MESSAGE = {
+  AUTH_SESSION_EXPIRED: "Your session has expired. Please run `agenzo-admin-cli auth login` again.",
+  AUTH_MAGIC_LINK_EXPIRED: "Verification link is invalid or has expired. Please request a new one.",
+  AUTH_INVITE_CODE_REQUIRED: "An invitation code is required to register.",
+  AUTH_INVITE_CODE_INVALID: "The invitation code is invalid.",
+  KEY_INVALID: "The API key is invalid or has been revoked. Please check your --api-key and retry.",
+  KEY_SCOPE_DENIED: "This API key does not have the required scope for this command.",
+  RESOURCE_NOT_FOUND: "The resource was not found or does not belong to the current organization.",
+  RESOURCE_CONFLICT: "A resource with the same unique value already exists.",
+  RESOURCE_STATE_INVALID: "The resource is in a state that does not permit this operation.",
+  RATE_LIMITED: "Too many requests. Please back off and retry.",
+  UPSTREAM_ERROR: "A third-party service is temporarily unavailable. Please try again later.",
+  INTERNAL_ERROR: "Something went wrong on the server. Please retry and note the request_id.",
+  PARAM_INVALID: "One or more parameters are invalid. Please check your input and retry.",
+  PARAM_IDEMPOTENCY_KEY_CONFLICT: "A request with this idempotency key was already processed with different parameters.",
+  TOKEN_FEATURE_DISABLED: "This token feature is currently unavailable.",
+  BILLING_MODE_MISMATCH: "The billing mode does not match this operation. Please verify your account billing configuration.",
+  ACCOUNT_NOT_FOUND: "The settlement account was not found.",
+  ACCOUNT_SUSPENDED: "The settlement account is suspended. Please contact support.",
+  ACCOUNT_INSUFFICIENT_BALANCE: "The settlement account has insufficient balance for this operation.",
+  PAYMENT_ORDER_NOT_FOUND: "The payment order was not found.",
+  PAYMENT_ORDER_NOT_PAID: "The payment order has not been paid. Please complete payment and retry.",
+  PAYMENT_ORDER_MISMATCH: "The payment order does not match this order. Please check the --payment-order-id.",
+  PAYMENT_ORDER_ALREADY_CONSUMED: "The payment order has already been consumed by another booking.",
+  SERVICE_NOT_FOUND: "The requested service was not found.",
+  VEHICLE_UNAVAILABLE: "No vehicle is available for the requested trip. Please try a different time or class.",
+  QUOTE_EXPIRED: "The quote has expired. Please request a new quote and retry.",
+  BOOKING_FAILED: "The booking could not be completed. Please retry.",
+  CANCELLATION_NOT_ALLOWED: "This order cannot be cancelled in its current state.",
+  NOT_IMPLEMENTED: "This operation is not implemented yet."
+};
+function toErrorEnvelope(error) {
+  if (error instanceof CliError) {
+    return {
+      error: {
+        code: error.code,
+        code_num: codeNum(error.code),
+        message: error.message || "Unknown error",
+        ...error.requestId ? { request_id: error.requestId } : {},
+        ...error.upstream ? { upstream: error.upstream } : {}
+      }
+    };
+  }
+  const message = error instanceof Error ? error.message : typeof error === "string" ? error : "Unexpected error";
+  return {
+    error: {
+      code: "INTERNAL_ERROR",
+      code_num: codeNum("INTERNAL_ERROR"),
+      message: message || "Unknown error"
+    }
+  };
+}
+var UPGRADE_COMMAND = "npm install -g agenzo-admin-cli@latest";
+var FALLBACK_VERSION = "0.1.1";
+var cachedVersion = null;
+function getCurrentVersion() {
+  if (cachedVersion !== null) return cachedVersion;
+  const here = dirname(fileURLToPath(import.meta.url));
+  const candidates = [
+    join(here, "..", "package.json"),
+    // dist/ → project root
+    join(here, "..", "..", "package.json")
+    // src/utils/ → project root
+  ];
+  for (const p of candidates) {
+    try {
+      const pkg = JSON.parse(readFileSync(p, "utf-8"));
+      if (typeof pkg.version === "string") {
+        cachedVersion = pkg.version;
+        return cachedVersion;
+      }
+    } catch {
+    }
+  }
+  cachedVersion = FALLBACK_VERSION;
+  console.warn(
+    `[agenzo-admin-cli] package.json not found; using fallback version ${FALLBACK_VERSION}`
+  );
+  return cachedVersion;
+}
+function compareVersions(a, b) {
+  const parse = (v) => {
+    const clean = v.trim().replace(/^v/, "").split(/[-+]/)[0];
+    const parts = clean.split(".");
+    return [
+      parseInt(parts[0] ?? "0", 10) || 0,
+      parseInt(parts[1] ?? "0", 10) || 0,
+      parseInt(parts[2] ?? "0", 10) || 0
+    ];
+  };
+  const [a1, a2, a3] = parse(a);
+  const [b1, b2, b3] = parse(b);
+  if (a1 !== b1) return a1 - b1;
+  if (a2 !== b2) return a2 - b2;
+  return a3 - b3;
+}
+function isBelow(current, minimum) {
+  return compareVersions(current, minimum) < 0;
+}
+var ApiClient = class {
+  baseUrl;
+  timeout;
+  constructor(config) {
+    this.baseUrl = config.baseUrl.replace(/\/+$/, "");
+    this.timeout = config.timeout ?? 6e4;
+  }
+  buildHeaders(auth) {
+    const headers = {
+      "User-Agent": `agenzo-admin-cli/${getCurrentVersion()}`
+    };
+    if (auth.type === "bearer") {
+      headers["Authorization"] = `Bearer ${auth.token}`;
+    } else if (auth.type === "api-key") {
+      headers["X-Api-Key"] = auth.key;
+    }
+    return headers;
+  }
+  async get(path, auth, params) {
+    let url = `${this.baseUrl}${path}`;
+    if (params && Object.keys(params).length > 0) {
+      const searchParams = new URLSearchParams(params);
+      url += `?${searchParams.toString()}`;
+    }
+    return this.request(url, {
+      method: "GET",
+      headers: this.buildHeaders(auth)
+    });
+  }
+  async post(path, auth, body, extraHeaders) {
+    const url = `${this.baseUrl}${path}`;
+    const headers = this.buildHeaders(auth);
+    headers["Content-Type"] = "application/json";
+    if (extraHeaders) {
+      Object.assign(headers, extraHeaders);
+    }
+    return this.request(url, {
+      method: "POST",
+      headers,
+      body: body ? JSON.stringify(body) : void 0
+    });
+  }
+  async request(url, init) {
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), this.timeout);
+    try {
+      const response = await fetch(url, {
+        ...init,
+        signal: controller.signal
+      });
+      this.enforceMinVersion(response.headers.get("x-cli-min-version"));
+      const contentType = response.headers.get("content-type") ?? "";
+      let responseBody;
+      if (contentType.includes("application/json")) {
+        responseBody = await response.json();
+      } else {
+        const text = await response.text();
+        if (!response.ok) {
+          const statusMsg = this.friendlyStatusMessage(response.status);
+          return {
+            success: false,
+            errorCode: 0,
+            errorMessage: statusMsg,
+            statusCode: response.status
+          };
+        }
+        try {
+          responseBody = JSON.parse(text);
+        } catch {
+          return {
+            success: false,
+            errorCode: 0,
+            errorMessage: `Unexpected response from server (${response.status})`,
+            statusCode: response.status
+          };
+        }
+      }
+      const code = responseBody.code;
+      const message = responseBody.message;
+      const data = responseBody.data;
+      if (response.ok && (!code || code === "0000")) {
+        const payload = data ?? responseBody;
+        return { success: true, data: payload, message };
+      }
+      const errorCode = code ? parseInt(code, 10) : 0;
+      let errorMsg = message ?? response.statusText;
+      if (!errorMsg || errorMsg === response.statusText) {
+        const detail = responseBody.detail;
+        if (Array.isArray(detail)) {
+          errorMsg = detail.map((d) => {
+            const loc = d.loc?.slice(1).join(".") ?? "";
+            return loc ? `${loc}: ${d.msg}` : String(d.msg);
+          }).join("; ");
+        } else if (typeof detail === "string") {
+          errorMsg = detail;
+        }
+      }
+      const errorCodeStr = responseBody.error_code;
+      const rawData = responseBody.data;
+      const upstream = rawData?.upstream && typeof rawData.upstream === "object" ? rawData.upstream : void 0;
+      return {
+        success: false,
+        errorCode: isNaN(errorCode) ? 0 : errorCode,
+        errorMessage: errorMsg,
+        statusCode: response.status,
+        ...errorCodeStr ? { code: errorCodeStr } : typeof code === "string" && code ? { code } : {},
+        requestId: responseBody.request_id ?? responseBody.requestId,
+        ...upstream ? { upstream } : {}
+      };
+    } catch (error) {
+      if (error instanceof UpgradeRequiredError) {
+        throw error;
+      }
+      if (error instanceof DOMException && error.name === "AbortError") {
+        throw new NetworkError(url, this.timeout);
+      }
+      throw new NetworkError(url, void 0, error instanceof Error ? error : void 0);
+    } finally {
+      clearTimeout(timeoutId);
+    }
+  }
+  /**
+   * Validate that the running CLI meets the server-advertised minimum.
+   * Missing or empty header → skip (backward compat with servers that don't
+   * advertise yet, and clients hitting legacy proxies).
+   */
+  enforceMinVersion(headerValue) {
+    const minVersion = headerValue?.trim();
+    if (!minVersion) return;
+    const current = getCurrentVersion();
+    if (isBelow(current, minVersion)) {
+      throw new UpgradeRequiredError(current, minVersion, UPGRADE_COMMAND);
+    }
+  }
+  friendlyStatusMessage(status) {
+    const messages = {
+      400: "Invalid request. Please check your input.",
+      401: "Authentication failed. Please check your API key or login again.",
+      403: "Access denied. You do not have permission for this operation.",
+      404: "Resource not found. Please check the ID.",
+      409: "Conflict. This resource may already exist.",
+      422: "Invalid input. Please check the request parameters.",
+      429: "Too many requests. Please wait and try again.",
+      500: "Something went wrong on the server. Please try again later.",
+      502: "Service is temporarily unavailable. Please try again in a moment.",
+      503: "Service is temporarily unavailable. Please try again in a moment.",
+      504: "The request took too long. Please try again."
+    };
+    return messages[status] ?? `Something went wrong (${status}). Please try again later.`;
+  }
+};
+var DEFAULT_CONFIG = {
+  active_org: null,
+  active_developer_id: null,
+  api_host: "https://agent.everonet.com",
+  api_path: "/api/v3/agent-pay"
+};
+var BUILTIN_PROFILES = {
+  production: "https://agent.everonet.com",
+  testing: "https://agent-test.everonet.com"
+};
+function resolveApiHost(host) {
+  if (BUILTIN_PROFILES[host]) {
+    return BUILTIN_PROFILES[host];
+  }
+  let url;
+  try {
+    url = new URL(host);
+  } catch {
+    throw new ValidationError(`Unknown profile or invalid URL: ${host}`);
+  }
+  if (url.protocol === "https:") {
+    return host;
+  }
+  if (url.protocol === "http:" && (url.hostname === "localhost" || url.hostname === "127.0.0.1")) {
+    return host;
+  }
+  throw new ValidationError(
+    `Insecure API host is not allowed: ${host}. Use HTTPS, except for localhost or 127.0.0.1.`
+  );
+}
+var ConfigManager = class {
+  basePath;
+  configPath;
+  constructor(basePath) {
+    this.basePath = basePath ?? join4(homedir3(), ".agenzo-admin-cli");
+    this.configPath = join4(this.basePath, "config.json");
+  }
+  async ensureDirectories() {
+    await mkdir3(this.basePath, { recursive: true, mode: 448 });
+    await chmod3(this.basePath, 448);
+    const credDir = join4(this.basePath, "credentials");
+    await mkdir3(credDir, { recursive: true, mode: 448 });
+    await chmod3(credDir, 448);
+  }
+  async load() {
+    try {
+      const content = await readFile3(this.configPath, "utf-8");
+      try {
+        const raw = JSON.parse(content);
+        if (raw.api_base_url && !raw.api_host) {
+          const url = String(raw.api_base_url);
+          const pathIndex = url.indexOf("/api/");
+          raw.api_host = pathIndex > 0 ? url.slice(0, pathIndex) : url;
+          raw.api_path = pathIndex > 0 ? url.slice(pathIndex) : DEFAULT_CONFIG.api_path;
+          delete raw.api_base_url;
+        }
+        return {
+          active_org: raw.active_org ?? null,
+          active_developer_id: raw.active_developer_id ?? null,
+          api_host: raw.api_host ?? DEFAULT_CONFIG.api_host,
+          api_path: raw.api_path ?? DEFAULT_CONFIG.api_path
+        };
+      } catch {
+        throw new ConfigError(
+          `Invalid config file: ${this.configPath}`,
+          this.configPath
+        );
+      }
+    } catch (error) {
+      if (error instanceof ConfigError) throw error;
+      if (error.code === "ENOENT") {
+        return { ...DEFAULT_CONFIG };
+      }
+      throw error;
+    }
+  }
+  async save(config) {
+    await this.ensureDirectories();
+    await writeFile3(this.configPath, JSON.stringify(config, null, 2), {
+      encoding: "utf-8",
+      mode: 384
+    });
+    await chmod3(this.configPath, 384);
+  }
+  async getActiveOrg() {
+    const config = await this.load();
+    return config.active_org;
+  }
+  async setActiveOrg(orgId) {
+    const config = await this.load();
+    config.active_org = orgId;
+    await this.save(config);
+  }
+  async getApiBaseUrl() {
+    const config = await this.load();
+    const host = resolveApiHost(config.api_host).replace(/\/+$/, "");
+    const path = config.api_path.startsWith("/") ? config.api_path : `/${config.api_path}`;
+    return `${host}${path}`;
+  }
+  async setApiHost(host) {
+    const config = await this.load();
+    config.api_host = resolveApiHost(host);
+    await this.save(config);
+  }
+  async getApiHost() {
+    const config = await this.load();
+    return resolveApiHost(config.api_host);
+  }
+};
+function exitCodeFor(error) {
+  if (!(error instanceof CliError)) {
+    return 1;
+  }
+  const code = error.code;
+  if (code === "UPGRADE_REQUIRED") {
+    return 2;
+  }
+  if (code === "CLIENT_ABORTED") {
+    return 5;
+  }
+  if (code.startsWith("AUTH_") || code.startsWith("KEY_")) {
+    return 3;
+  }
+  if (code === "UPSTREAM_ERROR" || code === "INTERNAL_ERROR" || code === "RATE_LIMITED") {
+    return 4;
+  }
+  return 1;
+}
+var STATUS_ICONS = {
+  success: "\u2713",
+  error: "\u2717",
+  info: "\u2139",
+  warning: "\u26A0",
+  loading: "\u280B"
+};
+var Formatter = class _Formatter {
+  /** Get display width of a string (CJK characters count as 2) */
+  static displayWidth(str) {
+    let width = 0;
+    for (const char of str) {
+      const code = char.codePointAt(0);
+      if (code >= 19968 && code <= 40959 || // CJK Unified
+      code >= 12288 && code <= 12351 || // CJK Punctuation
+      code >= 13312 && code <= 19903 || // CJK Extension A
+      code >= 65280 && code <= 65519 || // Fullwidth Forms
+      code >= 63744 && code <= 64255 || // CJK Compatibility
+      code >= 131072 && code <= 173791) {
+        width += 2;
+      } else {
+        width += 1;
+      }
+    }
+    return width;
+  }
+  /** Pad string to target display width (right-pad with spaces) */
+  static padEndDisplay(str, targetWidth) {
+    const currentWidth = _Formatter.displayWidth(str);
+    const padding = Math.max(0, targetWidth - currentWidth);
+    return str + " ".repeat(padding);
+  }
+  /** Pad string to target display width (left-pad with spaces) */
+  static padStartDisplay(str, targetWidth) {
+    const currentWidth = _Formatter.displayWidth(str);
+    const padding = Math.max(0, targetWidth - currentWidth);
+    return " ".repeat(padding) + str;
+  }
+  /** Table output for list commands — columns aligned by max width */
+  static table(headers, rows) {
+    const colWidths = headers.map((h, i) => {
+      const cellWidths = rows.map((r) => _Formatter.displayWidth(r[i] ?? ""));
+      return Math.max(_Formatter.displayWidth(h), ...cellWidths);
+    });
+    const sep = "  ";
+    const headerLine = headers.map((h, i) => _Formatter.padEndDisplay(h, colWidths[i])).join(sep);
+    const divider = colWidths.map((w) => "-".repeat(w)).join(sep);
+    const dataLines = rows.map(
+      (row) => row.map((cell, i) => _Formatter.padEndDisplay(cell ?? "", colWidths[i])).join(sep)
+    );
+    return [headerLine, divider, ...dataLines].join("\n");
+  }
+  /** Key-value output for detail commands — keys left-aligned */
+  static keyValue(entries) {
+    const maxKeyWidth = Math.max(...entries.map(([k]) => _Formatter.displayWidth(k)));
+    return entries.map(([key, value]) => `${_Formatter.padEndDisplay(key, maxKeyWidth)}  ${value}`).join("\n");
+  }
+  /** Status-prefixed message */
+  static status(type, message) {
+    return `${STATUS_ICONS[type]} ${message}`;
+  }
+  /** Mask sensitive info, keeping only the prefix */
+  static maskKey(key, prefixLength = 8) {
+    if (key.length <= prefixLength) {
+      return key;
+    }
+    return key.slice(0, prefixLength) + "*".repeat(key.length - prefixLength);
+  }
+  /**
+   * Format ISO 8601 timestamp to local timezone display.
+   * Automatically uses the user's system timezone.
+   * e.g. "2026-05-07T03:24:53+00:00" → "2026-05-07 11:24:53" (in CST)
+   *      "2026-05-07T03:24:53+00:00" → "2026-05-06 20:24:53" (in PDT)
+   * Returns the original string if parsing fails or input is empty.
+   */
+  static formatTime(iso) {
+    if (!iso) return "";
+    const date = new Date(iso);
+    if (isNaN(date.getTime())) return iso;
+    const pad = (n) => String(n).padStart(2, "0");
+    const y = date.getFullYear();
+    const m = pad(date.getMonth() + 1);
+    const d = pad(date.getDate());
+    const h = pad(date.getHours());
+    const min = pad(date.getMinutes());
+    const s = pad(date.getSeconds());
+    const offsetMin = -date.getTimezoneOffset();
+    const sign = offsetMin >= 0 ? "+" : "-";
+    const absOffset = Math.abs(offsetMin);
+    const tzH = pad(Math.floor(absOffset / 60));
+    const tzM = pad(absOffset % 60);
+    return `${y}-${m}-${d} ${h}:${min}:${s} (UTC${sign}${tzH}:${tzM})`;
+  }
+};
+var DEFAULT_FORMAT = "table";
+function isOutputFormat(value) {
+  return value === "json" || value === "table";
+}
+function resolveFormat(flag, env = process.env.AGENZO_FORMAT) {
+  if (flag !== void 0) {
+    return isOutputFormat(flag) ? flag : DEFAULT_FORMAT;
+  }
+  if (env !== void 0 && isOutputFormat(env)) {
+    return env;
+  }
+  return DEFAULT_FORMAT;
+}
+function render(result, opts) {
+  if (opts.format === "json") {
+    process.stdout.write(`${JSON.stringify(result.data, null, 2)}
+`);
+    return;
+  }
+  process.stdout.write(`${result.text()}
+`);
+}
+function notify(format, type, message) {
+  if (format === "json") {
+    return;
+  }
+  console.error(Formatter.status(type, message));
+}
+async function renderWithContext(result, opts, configManager) {
+  if (opts.format !== "json") {
+    render(result, opts);
+    return;
+  }
+  const config = await configManager.load();
+  const host = config.api_host.replace(/\/+$/, "");
+  const profile = Object.entries(BUILTIN_PROFILES).find(([, v]) => v === host)?.[0] ?? "custom";
+  const dataObj = result.data && typeof result.data === "object" ? result.data : { value: result.data };
+  const payload = {
+    profile,
+    endpoint: host,
+    ...dataObj
+  };
+  render({ ...result, data: payload }, opts);
+}
+var PromptEngine = class {
+  /** Return flagValue directly if provided, otherwise prompt interactively */
+  static async resolveInput(flagValue, config) {
+    if (flagValue !== void 0) {
+      return flagValue;
+    }
+    if (config.type === "password") {
+      return password({ message: config.message, mask: "*" });
+    }
+    if (config.type === "select" && config.choices) {
+      return select({
+        message: config.message,
+        choices: config.choices
+      });
+    }
+    return input({
+      message: config.message,
+      validate: config.validate
+    });
+  }
+};
+
+// src/payment-methods/prompts.ts
+import { password as password2 } from "@inquirer/prompts";
+async function collectCvv() {
+  return password2({
+    message: "CVV:",
+    mask: "*"
+  });
+}
+async function collectPaymentMethodParams(type, flags) {
+  const params = { type };
+  const email = await PromptEngine.resolveInput(flags.cardEmail ?? flags.email, {
+    message: "Email (for 3DS verification):"
+  });
+  params.email = email;
+  if (type === "card") {
+    params.card_number = await PromptEngine.resolveInput(flags.cardNumber, {
+      message: "Card number:"
+    });
+    params.expiry_date = await PromptEngine.resolveInput(flags.expiry, {
+      message: "Expiry (MMYY):"
+    });
+    if (flags.cvv) {
+      params.cvv = flags.cvv;
+    } else {
+      params.cvv = await collectCvv();
+    }
+  }
+  return params;
+}
+
+// src/payment-methods/add.ts
+var POLL_INTERVAL_MS = 3e3;
+var POLL_TIMEOUT_MS = 15 * 60 * 1e3;
+function registerAddCommand(parent, deps) {
+  const cmd = parent.command("add").description("Add a payment method (card binding + 3DS)").option("--api-key <key>", "API Key for authentication").option("--type <type>", "Payment method type (default: card)", "card").option("--email <email>", "Email for 3DS verification").option("--card-number <number>", "Card number").option("--expiry <mmyy>", "Expiry date (MMYY format)").option("--cvv <cvv>", "Card CVV").option(
+    "--idempotency-key <key>",
+    "Idempotency key forwarded verbatim as the Idempotency-Key header"
+  );
+  cmd.action(async () => {
+    const opts = cmd.optsWithGlobals();
+    const format = resolveFormat(opts.format);
+    const isYes = Boolean(opts.yes);
+    const apiKey = await PromptEngine.resolveInput(opts.apiKey, {
+      message: "API Key:",
+      type: "password"
+    });
+    const type = opts.type || "card";
+    const flags = {
+      email: opts.email,
+      cardNumber: opts.cardNumber,
+      expiry: opts.expiry,
+      cvv: opts.cvv
+    };
+    const params = await collectPaymentMethodParams(type, flags);
+    let idempotencyKey = opts.idempotencyKey;
+    if (!idempotencyKey) {
+      if (isYes) {
+        throw new IdempotencyKeyRequiredError("payment-methods add");
+      }
+      idempotencyKey = await PromptEngine.resolveInput(void 0, {
+        message: "Idempotency key (unique per write, for safe retry):",
+        validate: (v) => v.trim().length > 0 || "Idempotency key is required"
+      });
+    }
+    const extraHeaders = {
+      "Idempotency-Key": idempotencyKey
+    };
+    const result = await deps.apiClient.post(
+      "/payment-methods/create",
+      { type: "api-key", key: apiKey },
+      params,
+      extraHeaders
+    );
+    if (!result.success) {
+      throw CliError.fromApi(result, { auth: "api-key" });
+    }
+    const pm = result.data;
+    notify(format, "success", "Payment method created");
+    const createdResult = {
+      data: pm,
+      text: () => {
+        const lines = [
+          ["ID", pm.id],
+          ["Type", pm.type],
+          ["Status", pm.status]
+        ];
+        if (pm.brand) lines.push(["Brand", pm.brand]);
+        if (pm.first6) lines.push(["First 6", pm.first6]);
+        if (pm.last4) lines.push(["Last 4", pm.last4]);
+        return Formatter.keyValue(lines);
+      }
+    };
+    const configManager = new ConfigManager();
+    await renderWithContext(createdResult, { format }, configManager);
+    notify(format, "info", "Complete 3DS verification via email to activate");
+    if (type === "card" && pm.status === "PENDING") {
+      const finalStatus = await poll3dsVerification(
+        deps.apiClient,
+        apiKey,
+        pm.id,
+        format
+      );
+      if (finalStatus === "ACTIVE") {
+        const getResult = await deps.apiClient.get(
+          `/payment-methods/${pm.id}`,
+          { type: "api-key", key: apiKey }
+        );
+        if (getResult.success) {
+          const activatedPm = getResult.data;
+          notify(format, "success", "Payment method activated");
+          const activatedResult = {
+            data: activatedPm,
+            text: () => {
+              const lines = [
+                ["ID", activatedPm.id],
+                ["Type", activatedPm.type],
+                ["Status", activatedPm.status]
+              ];
+              if (activatedPm.brand) lines.push(["Brand", activatedPm.brand]);
+              if (activatedPm.first6) lines.push(["First 6", activatedPm.first6]);
+              if (activatedPm.last4) lines.push(["Last 4", activatedPm.last4]);
+              return Formatter.keyValue(lines);
+            }
+          };
+          await renderWithContext(activatedResult, { format }, configManager);
+        } else {
+          notify(format, "success", "Payment method activated");
+          const degraded = { ...pm, status: "ACTIVE" };
+          const degradedResult = {
+            data: degraded,
+            text: () => {
+              const lines = [
+                ["ID", degraded.id],
+                ["Type", degraded.type],
+                ["Status", degraded.status]
+              ];
+              if (degraded.brand) lines.push(["Brand", degraded.brand]);
+              if (degraded.first6) lines.push(["First 6", degraded.first6]);
+              if (degraded.last4) lines.push(["Last 4", degraded.last4]);
+              return Formatter.keyValue(lines);
+            }
+          };
+          await renderWithContext(degradedResult, { format }, configManager);
+        }
+      } else if (finalStatus === "FAILED") {
+        notify(format, "error", "3DS verification failed");
+      } else if (finalStatus === "TIMEOUT") {
+        notify(
+          format,
+          "info",
+          `Verification timed out (15 min). Check status with: agenzo-token-cli payment-methods get ${pm.id} --api-key <your_key>`
+        );
+      }
+    }
+  });
+}
+async function poll3dsVerification(apiClient, apiKey, paymentMethodId, format) {
+  const startTime = Date.now();
+  notify(format, "info", "Waiting for 3DS verification...");
+  while (Date.now() - startTime < POLL_TIMEOUT_MS) {
+    await sleep(POLL_INTERVAL_MS);
+    const result = await apiClient.get(
+      "/payment-methods/verification/status",
+      { type: "api-key", key: apiKey },
+      { payment_method_id: paymentMethodId }
+    );
+    if (result.success) {
+      const status = result.data.status;
+      if (status === "ACTIVE") {
+        return "ACTIVE";
+      }
+      if (status === "FAILED") {
+        return "FAILED";
+      }
+    }
+  }
+  return "TIMEOUT";
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+// src/payment-methods/list.ts
+function registerListCommand(parent, deps) {
+  const cmd = parent.command("list").description("List payment methods").option("--api-key <key>", "API Key for authentication").option("--member <member_id>", "Filter by member ID");
+  cmd.action(async () => {
+    const opts = cmd.optsWithGlobals();
+    const format = resolveFormat(opts.format);
+    const apiKey = await PromptEngine.resolveInput(opts.apiKey, {
+      message: "API Key:",
+      type: "password"
+    });
+    const params = {};
+    if (opts.member) {
+      params.member_id = opts.member;
+    }
+    const result = await deps.apiClient.get(
+      "/payment-methods",
+      { type: "api-key", key: apiKey },
+      Object.keys(params).length > 0 ? params : void 0
+    );
+    if (!result.success) {
+      throw CliError.fromApi(result, { auth: "api-key" });
+    }
+    const methods = result.data;
+    const configManager = new ConfigManager();
+    const commandResult = {
+      data: { payment_methods: methods },
+      text: () => {
+        if (methods.length === 0) {
+          return Formatter.status("info", "No payment methods found");
+        }
+        const headers = ["ID", "Type", "Brand", "First 6", "Last 4", "Status"];
+        const rows = methods.map((m) => [
+          m.id,
+          m.type,
+          m.brand || "-",
+          m.first6 || "-",
+          m.last4 || "-",
+          m.status
+        ]);
+        return Formatter.table(headers, rows);
+      }
+    };
+    await renderWithContext(commandResult, { format }, configManager);
+  });
+}
+
+// src/payment-methods/get.ts
+function registerGetCommand(parent, deps) {
+  const cmd = parent.command("get <pm_id>").description("Get a payment method by ID").option("--api-key <key>", "API key for authentication");
+  cmd.action(async (pmId) => {
+    const opts = cmd.optsWithGlobals();
+    const format = resolveFormat(opts.format);
+    const apiKey = await PromptEngine.resolveInput(opts.apiKey, {
+      message: "API Key:",
+      type: "password"
+    });
+    const result = await deps.apiClient.get(
+      `/payment-methods/${pmId}`,
+      { type: "api-key", key: apiKey }
+    );
+    if (!result.success) {
+      throw CliError.fromApi(result, { auth: "api-key" });
+    }
+    const pm = result.data;
+    const entries = [
+      ["ID", pm.id],
+      ["Type", pm.type]
+    ];
+    if (pm.brand) {
+      entries.push(["Brand", pm.brand]);
+    }
+    if (pm.first6) {
+      entries.push(["First 6", pm.first6]);
+    }
+    if (pm.last4) {
+      entries.push(["Last 4", pm.last4]);
+    }
+    entries.push(["Status", pm.status]);
+    entries.push(["Created", Formatter.formatTime(pm.created_at)]);
+    const configManager = new ConfigManager();
+    const cmdResult = {
+      data: pm,
+      text: () => Formatter.keyValue(entries)
+    };
+    await renderWithContext(cmdResult, { format }, configManager);
+  });
+}
+
+// src/payment-methods/disable.ts
+function registerDisableCommand(parent, deps) {
+  const cmd = parent.command("disable <pm_id>").description("Disable a payment method").option("--api-key <key>", "API key for authentication").option(
+    "--idempotency-key <key>",
+    "Idempotency key forwarded verbatim as the Idempotency-Key header"
+  );
+  cmd.action(async (pmId) => {
+    const opts = cmd.optsWithGlobals();
+    const format = resolveFormat(opts.format);
+    const apiKey = await PromptEngine.resolveInput(opts.apiKey, {
+      message: "API Key:",
+      type: "password"
+    });
+    let idempotencyKey = opts.idempotencyKey;
+    if (!idempotencyKey) {
+      if (opts.yes) {
+        throw new IdempotencyKeyRequiredError("payment-methods disable");
+      }
+      idempotencyKey = await PromptEngine.resolveInput(void 0, {
+        message: "Idempotency key (unique per write, for safe retry):",
+        validate: (v) => v.trim().length > 0 || "Idempotency key is required"
+      });
+    }
+    const extraHeaders = {
+      "Idempotency-Key": idempotencyKey
+    };
+    const result = await deps.apiClient.post(
+      `/payment-methods/${pmId}/disable`,
+      { type: "api-key", key: apiKey },
+      void 0,
+      extraHeaders
+    );
+    if (!result.success) {
+      throw CliError.fromApi(result, { auth: "api-key" });
+    }
+    const data = result.data;
+    notify(format, "success", `Payment method ${pmId} disabled`);
+    const cmdResult = {
+      data,
+      text: () => Formatter.keyValue([
+        ["Status", data.status],
+        ["Revoked tokens", String(data.revoked_tokens_count ?? 0)]
+      ])
+    };
+    const configManager = new ConfigManager();
+    await renderWithContext(cmdResult, { format }, configManager);
+  });
+}
+
+// src/payment-tokens/create.ts
+import { confirm, select as select2 } from "@inquirer/prompts";
+var DEFAULT_NT_FEE_CENTS = 500;
+var USDC_UNIT = 1e6;
+function mapTokenType(cliType) {
+  if (cliType === "network-token") return "network_token";
+  return cliType;
+}
+function usdToCents(amountStr) {
+  const trimmed = amountStr.trim();
+  if (!/^\d*\.?\d{0,2}$/.test(trimmed) || trimmed === "" || trimmed === ".") {
+    throw new CliError("PARAM_INVALID", `Invalid amount format: "${amountStr}". Expected a decimal like "12.50".`);
+  }
+  const parts = trimmed.split(".");
+  const integerPart = parts[0] || "0";
+  let fractionalPart = parts[1] || "0";
+  fractionalPart = fractionalPart.padEnd(2, "0");
+  const integerCents = parseInt(integerPart, 10) * 100;
+  const fractionalCents = parseInt(fractionalPart, 10);
+  return integerCents + fractionalCents;
+}
+async function resolvePaymentMethod(apiClient, apiKey, opts) {
+  if (opts.paymentMethodId) {
+    return opts.paymentMethodId;
+  }
+  const result = await apiClient.get(
+    "/payment-methods",
+    { type: "api-key", key: apiKey }
+  );
+  if (!result.success) {
+    throw CliError.fromApi(result, { auth: "api-key" });
+  }
+  const activeCards = result.data.filter((m) => m.status === "ACTIVE");
+  if (activeCards.length === 0) {
+    throw new CliError(
+      "CLIENT_NO_PAYMENT_METHOD",
+      "No active payment methods found. Add one with: agenzo-token-cli payment-methods add --api-key <your_key>"
+    );
+  }
+  if (opts.card) {
+    const matched = activeCards.find((m) => m.last4 === opts.card);
+    if (!matched) {
+      throw new CliError(
+        "CLIENT_CARD_NOT_MATCHED",
+        `No active card ending in ${opts.card}. Available: ${activeCards.map((m) => m.last4 || "????").join(", ")}`
+      );
+    }
+    return matched.id;
+  }
+  if (activeCards.length === 1) {
+    return activeCards[0].id;
+  }
+  if (opts.yes) {
+    throw new CliError(
+      "PARAM_INVALID",
+      "Multiple active payment methods found. Specify --payment-method-id or --card to disambiguate."
+    );
+  }
+  const selected = await select2({
+    message: "Select a payment method:",
+    choices: activeCards.map((m) => ({
+      name: `${m.id} (${m.brand || m.type} ****${m.last4 || "????"})`,
+      value: m.id
+    }))
+  });
+  return selected;
+}
+function formatPaymentToken(data) {
+  const type = data.type;
+  const lines = [];
+  if (type === "vcn") {
+    const vcn = data.vcn ?? data;
+    lines.push(["Payment Token ID", String(data.id || vcn.id || "")]);
+    lines.push(["Type", "VCN"]);
+    lines.push(["Card Number", String(vcn.card_number || "")]);
+    lines.push(["Expiry", String(vcn.expiry || "")]);
+    lines.push(["CVC", String(vcn.cvc || "")]);
+    lines.push(["Limit", `$${formatCentsToUsd(vcn.amount_limit)}`]);
+    lines.push(["Currency", String(vcn.currency || "USD")]);
+    lines.push(["Status", String(vcn.status || data.status || "")]);
+  } else if (type === "network_token") {
+    const nt = data.network_token ?? data;
+    lines.push(["Payment Token ID", String(data.id || nt.id || "")]);
+    lines.push(["Type", "Network Token"]);
+    lines.push(["Brand", String(nt.payment_brand || nt.brand || "")]);
+    lines.push(["ECI", String(nt.eci || "")]);
+    lines.push(["Cryptogram", String(nt.token_cryptogram || nt.cryptogram || "")]);
+    lines.push(["Expiry", String(nt.expiry_date || nt.expiry || "")]);
+    lines.push(["Value", String(nt.value || "")]);
+  } else if (type === "x402") {
+    const x402 = data.x402 ?? data;
+    lines.push(["Payment Token ID", String(data.id || x402.id || "")]);
+    lines.push(["Type", "X402"]);
+    lines.push(["Signature Value", String(x402.signature_value || "")]);
+    lines.push(["Status", String(x402.status || data.status || "")]);
+  } else {
+    lines.push(["Payment Token ID", String(data.id || "")]);
+    lines.push(["Type", String(type || "unknown")]);
+    lines.push(["Status", String(data.status || "")]);
+  }
+  return Formatter.keyValue(lines);
+}
+function formatCentsToUsd(cents) {
+  if (cents === void 0 || cents === null) return "0.00";
+  const dollars = Math.floor(cents / 100);
+  const remainder = cents % 100;
+  return `${dollars}.${String(remainder).padStart(2, "0")}`;
+}
+function registerCreateCommand(parent, deps) {
+  const cmd = parent.command("create").description("Create a payment token (VCN / Network Token / X402)").option("--api-key <key>", "API Key for authentication").option("--type <type>", "Token type: vcn | network-token | x402").option("--payment-method-id <id>", "Payment method ID to use").option("--card <last4>", "Match payment method by last 4 digits").option("--member <member_id>", "Member ID").option("--amount <amount>", "Amount in USD (VCN / X402)").option("--currency <currency>", "Currency (default: USD)").option("--pay-to <address>", "Pay-to address (X402)").option("--nonce <nonce>", "Nonce (X402)").option("--network <network>", "Network (X402)").option("--deadline <deadline>", "Deadline (X402)").option("--external-tx-id <id>", "External transaction ID").option(
+    "--idempotency-key <key>",
+    "Idempotency key forwarded verbatim as the Idempotency-Key header"
+  );
+  cmd.action(async () => {
+    const opts = cmd.optsWithGlobals();
+    const format = resolveFormat(opts.format);
+    const isYes = Boolean(opts.yes);
+    const apiKey = await PromptEngine.resolveInput(opts.apiKey, {
+      message: "API Key:",
+      type: "password"
+    });
+    const cliType = await PromptEngine.resolveInput(opts.type, {
+      message: "Token type:",
+      type: "select",
+      choices: [
+        { name: "VCN (Virtual Card Number)", value: "vcn" },
+        { name: "Network Token", value: "network-token" },
+        { name: "X402 (USDC on-chain)", value: "x402" }
+      ]
+    });
+    const serverType = mapTokenType(cliType);
+    const paymentMethodId = await resolvePaymentMethod(deps.apiClient, apiKey, {
+      paymentMethodId: opts.paymentMethodId,
+      card: opts.card,
+      yes: isYes
+    });
+    let member = opts.member;
+    if (!member && !isYes) {
+      const memberInput = await PromptEngine.resolveInput(void 0, {
+        message: "Member ID (optional, press Enter to skip):",
+        validate: () => true
+        // always valid (optional)
+      });
+      if (memberInput.trim()) {
+        member = memberInput.trim();
+      }
+    }
+    let freezeAmountCents;
+    let feeCents;
+    let feeDisplay;
+    let freezeDisplay;
+    const typeBody = {};
+    if (serverType === "vcn") {
+      await checkVcnFeatureEnabled(deps.apiClient, apiKey);
+      const amountStr = await PromptEngine.resolveInput(opts.amount, {
+        message: "Amount (USD, e.g. 25.00):",
+        validate: (v) => {
+          try {
+            const cents2 = usdToCents(v);
+            if (cents2 < 1 || cents2 > 5e4) {
+              return "Amount must be between $0.01 and $500.00";
+            }
+            return true;
+          } catch {
+            return 'Invalid amount format. Use a decimal like "25.00"';
+          }
+        }
+      });
+      const cents = usdToCents(amountStr);
+      if (cents < 1 || cents > 5e4) {
+        throw new CliError(
+          "PARAM_INVALID",
+          "Amount must be between $0.01 and $500.00"
+        );
+      }
+      feeCents = Math.max(1, Math.round(cents * 0.05));
+      freezeAmountCents = cents + feeCents;
+      feeDisplay = `$${formatCentsToUsd(feeCents)}`;
+      freezeDisplay = `$${formatCentsToUsd(freezeAmountCents)}`;
+      typeBody.amount = cents;
+      if (opts.currency) {
+        typeBody.currency = opts.currency;
+      }
+    } else if (serverType === "network_token") {
+      feeCents = await fetchNetworkTokenFee(deps.apiClient, apiKey);
+      freezeAmountCents = feeCents;
+      feeDisplay = `$${formatCentsToUsd(feeCents)}`;
+      freezeDisplay = feeDisplay;
+    } else if (serverType === "x402") {
+      const amountStr = await PromptEngine.resolveInput(opts.amount, {
+        message: "Amount (USDC):",
+        validate: (v) => {
+          const n = parseFloat(v);
+          if (isNaN(n) || n <= 0) return "Amount must be a positive number";
+          return true;
+        }
+      });
+      const amountUsdc = parseFloat(amountStr);
+      const amountUnits = Math.round(amountUsdc * USDC_UNIT);
+      const minFeeUnits = Math.round(0.01 * USDC_UNIT);
+      const percentFeeUnits = Math.round(amountUnits * 0.05);
+      const feeUnits = Math.max(minFeeUnits, percentFeeUnits);
+      const freezeUnits = amountUnits + feeUnits;
+      feeDisplay = `${(feeUnits / USDC_UNIT).toFixed(6)} USDC`;
+      freezeDisplay = `${(freezeUnits / USDC_UNIT).toFixed(6)} USDC`;
+      typeBody.amount = amountUnits;
+      typeBody.pay_to = await PromptEngine.resolveInput(opts.payTo, {
+        message: "Pay-to address:"
+      });
+      typeBody.nonce = await PromptEngine.resolveInput(opts.nonce, {
+        message: "Nonce:"
+      });
+      typeBody.network = await PromptEngine.resolveInput(opts.network, {
+        message: "Network:"
+      });
+      const deadlineStr = await PromptEngine.resolveInput(opts.deadline, {
+        message: "Deadline (Unix timestamp):",
+        validate: (v) => /^\d+$/.test(v.trim()) || "Deadline must be a Unix timestamp (integer seconds)"
+      });
+      const deadlineNum = Number(deadlineStr.trim());
+      if (!Number.isInteger(deadlineNum) || deadlineNum <= 0) {
+        throw new CliError(
+          "PARAM_INVALID",
+          `Invalid deadline: "${deadlineStr}". Expected a Unix timestamp (integer seconds).`
+        );
+      }
+      typeBody.deadline = deadlineNum;
+    }
+    if (!isYes) {
+      const warningLines = [`Freeze: ${freezeDisplay}`, `Fee: ${feeDisplay}`];
+      notify(format, "warning", warningLines.join(" | "));
+      const confirmed = await confirm({
+        message: "Proceed with token creation?",
+        default: true
+      });
+      if (!confirmed) {
+        throw new CliError("CLIENT_ABORTED", "Token creation cancelled by user");
+      }
+    }
+    let idempotencyKey = opts.idempotencyKey;
+    if (!idempotencyKey) {
+      if (isYes) {
+        throw new IdempotencyKeyRequiredError("payment-tokens create");
+      }
+      idempotencyKey = await PromptEngine.resolveInput(void 0, {
+        message: "Idempotency key (unique per write, for safe retry):",
+        validate: (v) => v.trim().length > 0 || "Idempotency key is required"
+      });
+    }
+    const body = {
+      type: serverType,
+      payment_method_id: paymentMethodId,
+      ...typeBody
+    };
+    if (member) {
+      body.member_id = member;
+    }
+    if (opts.externalTxId) {
+      body.external_tx_id = opts.externalTxId;
+    }
+    const extraHeaders = {
+      "Idempotency-Key": idempotencyKey
+    };
+    const result = await deps.apiClient.post(
+      "/payment-tokens/create",
+      { type: "api-key", key: apiKey },
+      body,
+      extraHeaders
+    );
+    if (!result.success) {
+      throw CliError.fromApi(result, { auth: "api-key" });
+    }
+    const tokenData = result.data;
+    if (!tokenData.type) {
+      tokenData.type = serverType;
+    }
+    notify(format, "success", "Payment token created");
+    const configManager = new ConfigManager();
+    const commandResult = {
+      data: tokenData,
+      text: () => {
+        let output = formatPaymentToken(tokenData);
+        if (serverType === "x402") {
+          output += "\n" + Formatter.status("info", "Use the Signature Value in the X-PAYMENT request header");
+        }
+        return output;
+      }
+    };
+    await renderWithContext(commandResult, { format }, configManager);
+  });
+}
+async function checkVcnFeatureEnabled(apiClient, apiKey) {
+  const result = await apiClient.get(
+    "/features/vcn",
+    { type: "api-key", key: apiKey }
+  );
+  if (!result.success) {
+    throw CliError.fromApi(result, { auth: "api-key" });
+  }
+  if (!result.data.enabled) {
+    throw new CliError(
+      "TOKEN_FEATURE_DISABLED",
+      "VCN feature is not enabled for your account. Contact support to activate."
+    );
+  }
+}
+async function fetchNetworkTokenFee(apiClient, apiKey) {
+  try {
+    const result = await apiClient.get(
+      "/config/network-token-fee",
+      { type: "api-key", key: apiKey }
+    );
+    if (result.success && typeof result.data.fee_cents === "number") {
+      return result.data.fee_cents;
+    }
+    return DEFAULT_NT_FEE_CENTS;
+  } catch {
+    return DEFAULT_NT_FEE_CENTS;
+  }
+}
+
+// src/payment-tokens/list.ts
+function getSummary(token) {
+  const type = token.type;
+  if (type === "vcn") {
+    const first6 = String(token.first6 || token.first_six || "");
+    const last4 = String(token.last4 || token.last_four || "");
+    const limit = token.amount_limit ?? token.limit;
+    const limitDisplay = limit !== void 0 && limit !== null ? `$${(limit / 100).toFixed(2)}` : "";
+    return `${first6}****${last4} ${limitDisplay}`.trim();
+  }
+  if (type === "network_token") {
+    const nt = token.network_token;
+    return String(nt?.payment_brand || token.brand || "");
+  }
+  if (type === "x402") {
+    const amount = String(token.amount ?? "");
+    const network = String(token.network || "");
+    return `${amount} ${network}`.trim();
+  }
+  return "";
+}
+function registerListCommand2(parent, deps) {
+  const cmd = parent.command("list").description("List payment tokens").option("--api-key <key>", "API Key for authentication").option("--type <type>", "Filter by token type").option("--member <member_id>", "Filter by member ID");
+  cmd.action(async () => {
+    const opts = cmd.optsWithGlobals();
+    const format = resolveFormat(opts.format);
+    const apiKey = await PromptEngine.resolveInput(opts.apiKey, {
+      message: "API Key:",
+      type: "password"
+    });
+    const params = {};
+    if (opts.type) {
+      params.type = opts.type;
+    }
+    if (opts.member) {
+      params.member_id = opts.member;
+    }
+    const result = await deps.apiClient.get(
+      "/payment-tokens",
+      { type: "api-key", key: apiKey },
+      Object.keys(params).length > 0 ? params : void 0
+    );
+    if (!result.success) {
+      throw CliError.fromApi(result, { auth: "api-key" });
+    }
+    const tokens = result.data;
+    const configManager = new ConfigManager();
+    const commandResult = {
+      data: { payment_tokens: tokens },
+      text: () => {
+        if (tokens.length === 0) {
+          return Formatter.status("info", "No payment tokens found");
+        }
+        const headers = ["Token ID", "Type", "Status", "Summary"];
+        const rows = tokens.map((t) => [
+          String(t.id || ""),
+          String(t.type || ""),
+          String(t.status || ""),
+          getSummary(t)
+        ]);
+        return Formatter.table(headers, rows);
+      }
+    };
+    await renderWithContext(commandResult, { format }, configManager);
+  });
+}
+
+// src/payment-tokens/get.ts
+function asString(value) {
+  return typeof value === "string" ? value : "";
+}
+function maskPan(value, lastFour) {
+  const suffix = lastFour || value.slice(-4);
+  if (!suffix) return "";
+  const maskedLength = Math.max(value.length - suffix.length, 4);
+  return `${"*".repeat(maskedLength)}${suffix}`;
+}
+function maskCvc(value) {
+  return value ? "***" : "";
+}
+function maskVcnFields(vcn) {
+  const masked = { ...vcn };
+  const lastFour = asString(masked.last_four ?? masked.last4);
+  if (typeof masked.card_number === "string") {
+    masked.card_number = maskPan(masked.card_number, lastFour);
+  }
+  if (typeof masked.pan === "string") {
+    masked.pan = maskPan(masked.pan, lastFour);
+  }
+  if (typeof masked.cvc === "string") {
+    masked.cvc = maskCvc(masked.cvc);
+  }
+  if (typeof masked.cvv === "string") {
+    masked.cvv = maskCvc(masked.cvv);
+  }
+  return masked;
+}
+function buildPaymentTokenGetPayload(data, opts = {}) {
+  if (opts.revealSensitive || data.type !== "vcn") {
+    return data;
+  }
+  const payload = { ...data };
+  if (payload.vcn && typeof payload.vcn === "object") {
+    payload.vcn = maskVcnFields(payload.vcn);
+    return payload;
+  }
+  return maskVcnFields(payload);
+}
+function formatPaymentTokenGet(data, opts = {}) {
+  const type = data.type;
+  const lines = [];
+  if (type === "vcn") {
+    const vcn = data.vcn ?? data;
+    const lastFour = asString(vcn.last_four ?? vcn.last4);
+    const cardNumber = asString(vcn.card_number ?? vcn.pan);
+    const cvc = asString(vcn.cvc ?? vcn.cvv);
+    lines.push(["Token ID", String(data.id || vcn.id || "")]);
+    lines.push(["Type", "VCN"]);
+    lines.push([
+      "Card Number",
+      opts.revealSensitive ? cardNumber : maskPan(cardNumber, lastFour)
+    ]);
+    lines.push(["Last 4", lastFour]);
+    lines.push(["Expiry", String(vcn.expiry || "")]);
+    lines.push(["CVC", opts.revealSensitive ? cvc : maskCvc(cvc)]);
+    lines.push(["Limit", formatCentsPlain(vcn.amount_limit)]);
+    lines.push(["Balance", formatCentsPlain(vcn.balance)]);
+    lines.push(["Currency", String(vcn.currency || "USD")]);
+    lines.push(["Status", String(vcn.status || data.status || "")]);
+  } else if (type === "network_token") {
+    const nt = data.network_token ?? data;
+    lines.push(["Token ID", String(data.id || nt.id || "")]);
+    lines.push(["Type", "Network Token"]);
+    lines.push(["Brand", String(nt.payment_brand || nt.brand || "")]);
+    lines.push(["ECI", String(nt.eci || "")]);
+    lines.push(["Cryptogram", String(nt.token_cryptogram || nt.cryptogram || "")]);
+    lines.push(["Expiry", String(nt.expiry_date || nt.expiry || "")]);
+    lines.push(["Value", String(nt.value || "")]);
+  } else if (type === "x402") {
+    const x402 = data.x402 ?? data;
+    lines.push(["Token ID", String(data.id || x402.id || "")]);
+    lines.push(["Type", "X402"]);
+    lines.push(["Signature Value", String(x402.signature_value || "")]);
+    lines.push(["Status", String(x402.status || data.status || "")]);
+  } else {
+    lines.push(["Token ID", String(data.id || "")]);
+    lines.push(["Type", String(type || "unknown")]);
+    lines.push(["Status", String(data.status || "")]);
+  }
+  return Formatter.keyValue(lines);
+}
+function formatCentsPlain(cents) {
+  if (cents === void 0 || cents === null) return "0.00";
+  const dollars = Math.floor(cents / 100);
+  const remainder = cents % 100;
+  return `${dollars}.${String(remainder).padStart(2, "0")}`;
+}
+function registerGetCommand2(parent, deps) {
+  const cmd = parent.command("get <payment_token_id>").description("Get a payment token by ID").option("--api-key <key>", "API key for authentication").option("--reveal", "Reveal full VCN card number and CVC in the output");
+  cmd.action(async (paymentTokenId) => {
+    const opts = cmd.optsWithGlobals();
+    const format = resolveFormat(opts.format);
+    const apiKey = await PromptEngine.resolveInput(opts.apiKey, {
+      message: "API Key:",
+      type: "password"
+    });
+    const result = await deps.apiClient.get(
+      `/payment-tokens/${paymentTokenId}`,
+      { type: "api-key", key: apiKey }
+    );
+    if (!result.success) {
+      throw CliError.fromApi(result, { auth: "api-key" });
+    }
+    const revealSensitive = Boolean(opts.reveal);
+    const tokenData = buildPaymentTokenGetPayload(result.data, { revealSensitive });
+    const configManager = new ConfigManager();
+    const commandResult = {
+      data: tokenData,
+      text: () => formatPaymentTokenGet(result.data, { revealSensitive })
+    };
+    await renderWithContext(commandResult, { format }, configManager);
+  });
+}
+
+// src/payment-tokens/revoke.ts
+function registerRevokeCommand(parent, deps) {
+  const cmd = parent.command("revoke <payment_token_id>").description("Revoke a payment token").option("--api-key <key>", "API key for authentication").option(
+    "--idempotency-key <key>",
+    "Idempotency key forwarded verbatim as the Idempotency-Key header"
+  );
+  cmd.action(async (paymentTokenId) => {
+    const opts = cmd.optsWithGlobals();
+    const format = resolveFormat(opts.format);
+    const apiKey = await PromptEngine.resolveInput(opts.apiKey, {
+      message: "API Key:",
+      type: "password"
+    });
+    let idempotencyKey = opts.idempotencyKey;
+    if (!idempotencyKey) {
+      if (opts.yes) {
+        throw new IdempotencyKeyRequiredError("payment-tokens revoke");
+      }
+      idempotencyKey = await PromptEngine.resolveInput(void 0, {
+        message: "Idempotency key (unique per write, for safe retry):",
+        validate: (v) => v.trim().length > 0 || "Idempotency key is required"
+      });
+    }
+    const extraHeaders = {
+      "Idempotency-Key": idempotencyKey
+    };
+    const result = await deps.apiClient.post(
+      `/payment-tokens/${paymentTokenId}/revoke`,
+      { type: "api-key", key: apiKey },
+      void 0,
+      extraHeaders
+    );
+    if (!result.success) {
+      throw CliError.fromApi(result, { auth: "api-key" });
+    }
+    const data = result.data;
+    const isDelayedRevoke = data.status === "ACTIVE" && data.expires_at != null;
+    if (isDelayedRevoke) {
+      notify(format, "success", "Revoke scheduled (cryptogram will auto-expire)");
+      const kvPairs = [
+        ["Token ID", data.id],
+        ["Status", data.status],
+        ["Expires At", Formatter.formatTime(data.expires_at)]
+      ];
+      if (data.message) {
+        kvPairs.push(["Message", data.message]);
+      }
+      const cmdResult = {
+        data,
+        text: () => Formatter.keyValue(kvPairs)
+      };
+      const configManager = new ConfigManager();
+      await renderWithContext(cmdResult, { format }, configManager);
+    } else {
+      notify(format, "success", "Payment token revoked");
+      const cmdResult = {
+        data,
+        text: () => Formatter.keyValue([
+          ["Token ID", data.id],
+          ["Status", data.status],
+          ["Revoked At", Formatter.formatTime(data.revoked_at)]
+        ])
+      };
+      const configManager = new ConfigManager();
+      await renderWithContext(cmdResult, { format }, configManager);
+    }
+  });
+}
+
+// src/index.ts
+var programRef;
+async function main() {
+  const configManager = new ConfigManager();
+  await configManager.ensureDirectories();
+  const apiBaseUrl = await configManager.getApiBaseUrl();
+  const apiClient = new ApiClient({ baseUrl: apiBaseUrl });
+  const deps = { apiClient };
+  const program = new Command();
+  programRef = program;
+  program.name("agenzo-token-cli").version(getCurrentVersion()).description(
+    "Agenzo token plane: payment methods (card binding + 3DS) and payment tokens (VCN / Network Token / X402)"
+  ).option("--verbose", "Show verbose logs").option("--yes", "Skip confirmation prompts (for automation/AI Agents)").option(
+    "--format <format>",
+    "Output format: json | table (default: table; or set AGENZO_FORMAT)"
+  );
+  program.hook("preAction", (thisCommand) => {
+    const flag = thisCommand.opts().format;
+    process.env.AGENZO_FORMAT = resolveFormat(flag);
+  });
+  const pmCmd = program.command("payment-methods").description("Payment method management");
+  registerAddCommand(pmCmd, deps);
+  registerListCommand(pmCmd, deps);
+  registerGetCommand(pmCmd, deps);
+  registerDisableCommand(pmCmd, deps);
+  const ptCmd = program.command("payment-tokens").description("Payment token management");
+  registerCreateCommand(ptCmd, deps);
+  registerListCommand2(ptCmd, deps);
+  registerGetCommand2(ptCmd, deps);
+  registerRevokeCommand(ptCmd, deps);
+  await program.parseAsync(process.argv);
+}
+function resolveActiveFormat() {
+  const flag = programRef?.opts().format;
+  return resolveFormat(flag);
+}
+function reportError(error) {
+  const envelope = toErrorEnvelope(error);
+  const format = resolveActiveFormat();
+  if (format === "json") {
+    console.error(JSON.stringify(envelope));
+  } else {
+    console.error(
+      Formatter.status("error", `[${envelope.error.code_num}] ${envelope.error.message}`)
+    );
+    if (!(error instanceof CliError) && process.argv.includes("--verbose")) {
+      console.error(error);
+    }
+  }
+  process.exit(exitCodeFor(error));
+}
+process.on("SIGINT", () => {
+  reportError(new UserCancelError());
+});
+main().catch(reportError);
+//# sourceMappingURL=index.js.map