@buildaureon/sdk 0.1.2 → 0.1.7

package/docs/architecture.md

@@ -127,7 +127,7 @@ sequenceDiagram
 
 - **Capital Book** — gateway portfolio used for weight math (`syncPortfolio`).
 - **Vault balances** — on-chain capital Automatic restores trade against.
-- Empty vault ⇒ Automatic restores cannot meaningfully settle on-chain even if policy exists.
+- Empty vault ⇒ Automatic restore returns 409. It does not stage a fake success or edit the capital book.
 
 ---
 

package/docs/client-api.md

@@ -365,6 +365,172 @@ async getOverview(): Promise<DashboardOverview>
 | HTTP | `GET /overview` |
 | Contains | Health counts, global score, 24h portfolio change (daily snapshots), evaluation schedule, recent executions + events |
 
+### `getAllocationVsTarget()`
+
+```ts
+async getAllocationVsTarget(): Promise<{
+  rows: AllocationComparisonRow[];
+  paradox: PlanParadoxResult;
+  overview: DashboardOverview;
+}>
+```
+
+| | |
+|--|--|
+| Auth | Required |
+| HTTP | Composite — parallel `GET /overview`, `GET /objectives`, `GET /health` |
+| Returns | Per-objective current vs target weights plus a green-book/off-plan paradox flag |
+| Use | demo — objective vs actual portfolio without stitching JSON yourself |
+
+Helpers `buildAllocationComparison()` and `detectPlanParadox()` are exported for custom integrators. See `pnpm example:green-vs-plan`.
+
+### `applyFinancialIntent(intent)`
+
+```ts
+async applyFinancialIntent(intent: FinancialIntent): Promise<ObjectivePortfolioFlow>
+```
+
+| | |
+|--|--|
+| Auth | Required |
+| HTTP | Composite — `POST /objectives` + watchdog refresh + `GET /health` + `GET /portfolio` |
+| Returns | Intent summary, created objective, health, portfolio snapshot, teaching message |
+| Use | AI → objective → portfolio in one call |
+
+### `getObjectivePortfolioFlow(objectiveId?)`
+
+```ts
+async getObjectivePortfolioFlow(objectiveId?: string): Promise<ObjectivePortfolioFlow[]>
+```
+
+| | |
+|--|--|
+| Auth | Required |
+| HTTP | Composite — objectives + health + portfolio |
+| Returns | Flow snapshots for active objectives (or one id) |
+
+Helpers `parseFinancialIntent()`, `resolveObjectiveFromIntent()`, and `buildObjectivePortfolioFlow()` are exported. See `pnpm example:ai-to-objective-to-portfolio`.
+
+### `runDriftRestoreDemo()`
+
+```ts
+async runDriftRestoreDemo(): Promise<DriftRestoreFlow>
+```
+
+| | |
+|--|--|
+| Auth | Required |
+| HTTP | Composite — portfolio seed, objective create, market event (`autoRestore: false`), restore plan, manual restore |
+| Returns | Three-beat `DriftRestoreFlow` — aligned → drift → restored |
+| Use | drift → detection → restore teaching demo |
+
+### `getDriftRestoreFlow(objectiveId?)`
+
+```ts
+async getDriftRestoreFlow(objectiveId?: string): Promise<DriftRestoreFlow[]>
+```
+
+| | |
+|--|--|
+| Auth | Required |
+| HTTP | Composite — objectives + health + allocation + executions (+ restore plan when off-plan) |
+| Returns | Inferred drift-restore flows for active objectives |
+
+Helpers `buildDriftRestoreFlow()`, `buildDriftRestoreFlowFromSnapshot()`, and `inferDriftPhase()` are exported. See `pnpm example:drift-detect-restore`.
+
+### `runReceiptVerificationDemo()`
+
+```ts
+async runReceiptVerificationDemo(): Promise<ReceiptVerificationFlow>
+```
+
+| | |
+|--|--|
+| Auth | Required |
+| HTTP | Composite — `runDriftRestoreDemo()` + local validation + settlement lookup + timeline |
+| Returns | Three-beat `ReceiptVerificationFlow` — claim → validate → verify |
+| Use | receipt → verification teaching demo |
+
+### `getReceiptVerificationFlow(executionId?)`
+
+```ts
+async getReceiptVerificationFlow(executionId?: string): Promise<ReceiptVerificationFlow[]>
+```
+
+| | |
+|--|--|
+| Auth | Required |
+| HTTP | Composite — executions + validation + settlement + timeline |
+| Returns | Verification flows for recent or specified execution(s) |
+
+Helpers `buildReceiptVerificationFlow()`, `inferProofTier()`, and `validateExecutionReceipt()` are exported. See `pnpm example:receipt-verification`.
+
+### `runPortfolioWatchDemo(input?)`
+
+```ts
+async runPortfolioWatchDemo(input?: {
+  brief?: string;
+  host?: "cursor" | "claude" | "mcp";
+}): Promise<PortfolioWatchFlow>
+```
+
+| | |
+|--|--|
+| Auth | Required |
+| HTTP | Composite — `applyFinancialIntent` + market event (`autoRestore: true`) + timeline |
+| Returns | Portfolio watch flow — register → while away → return briefing |
+| Use | agent-in-host demo |
+
+### `getPortfolioWatchFlow(input?)`
+
+```ts
+async getPortfolioWatchFlow(input?: {
+  objectiveId?: string;
+  brief?: string;
+  host?: "cursor" | "claude" | "mcp";
+}): Promise<PortfolioWatchFlow[]>
+```
+
+| | |
+|--|--|
+| Auth | Required |
+| HTTP | Composite — Automatic objectives + health + allocation + timeline |
+| Returns | Read-only briefing for active Automatic objectives |
+
+Helpers `buildPortfolioWatchFlow()`, `DEFAULT_PORTFOLIO_WATCH_BRIEF`, and `inferPortfolioWatchPhase()` are exported. See `pnpm example:portfolio-watch`.
+
+### `runFullAureonLoopDemo(input?)`
+
+```ts
+async runFullAureonLoopDemo(input?: {
+  brief?: string;
+}): Promise<FullAureonLoopFlow>
+```
+
+| | |
+|--|--|
+| Auth | Required |
+| HTTP | Composite — intent + allocation paradox + restore (`autoRestore: false`) + receipt verification |
+| Returns | Full loop — intent → plan check → restore → verify |
+| Use | Content Arc — full AUREON loop positioning demo |
+
+### `getFullAureonLoopFlow(input?)`
+
+```ts
+async getFullAureonLoopFlow(input?: {
+  objectiveId?: string;
+  brief?: string;
+}): Promise<FullAureonLoopFlow[]>
+```
+
+| | |
+|--|--|
+| Auth | Required |
+| HTTP | Composite — objectives + allocation + latest receipt + validation |
+| Returns | Read-only full-loop flows for active objectives with receipts |
+
+Helpers `buildFullAureonLoopFlow()`, `DEFAULT_FULL_LOOP_BRIEF`, and `inferFullAureonLoopPhase()` are exported. See `pnpm example:full-aureon-loop`.
+
 ---
 
 ## 6. Vault
@@ -478,7 +644,7 @@ async applyMarketEvent(input: ApplyMarketEventInput): Promise<{
 |--|--|
 | Auth | Required |
 | HTTP | `POST /market/events` |
-| Normalization | Uppercases symbol; `autoRestore` defaults **true** |
+| Normalization | Uppercases symbol; `autoRestore` defaults **false** (must opt in to restore) |
 | Validation | Symbol required; finite `priceChangeRatio`; rejects extreme ≤ -0.95 |
 
 ### `getRestorePlan(objectiveId)`
@@ -578,6 +744,17 @@ session.clear();
 | `syncPortfolio` | POST | `/portfolio/sync` | **yes** |
 | `refreshWatchdog` | POST | `/watchdog/refresh` | **yes** |
 | `getOverview` | GET | `/overview` | **yes** |
+| `getAllocationVsTarget` | composite | overview + objectives + health | **yes** |
+| `applyFinancialIntent` | composite | create objective + health + portfolio | **yes** |
+| `getObjectivePortfolioFlow` | composite | objectives + health + portfolio | **yes** |
+| `runDriftRestoreDemo` | composite | seed + drift + manual restore | **yes** |
+| `getDriftRestoreFlow` | composite | objectives + health + allocation + executions | **yes** |
+| `runReceiptVerificationDemo` | composite | drift-restore + validate + settlement | **yes** |
+| `getReceiptVerificationFlow` | composite | executions + validation + settlement | **yes** |
+| `runPortfolioWatchDemo` | composite | intent + auto-restore market event + briefing | **yes** |
+| `getPortfolioWatchFlow` | composite | Automatic objectives + health + timeline | **yes** |
+| `runFullAureonLoopDemo` | composite | intent + plan paradox + restore + verify | **yes** |
+| `getFullAureonLoopFlow` | composite | objectives + allocation + receipt validation | **yes** |
 | `listMarketPresets` | GET | `/market/presets` | **yes** |
 | `applyMarketEvent` | POST | `/market/events` | **yes** |
 | `getRestorePlan` | GET | `/objectives/:id/restore-plan` | **yes** |

package/docs/data-contracts.md

@@ -402,14 +402,84 @@ export interface ExecutionReceipt {
   result: string;
   createdAt: string;
   confirmedAt: string | null;
-  /** 
-   * vault represents keeper rebalances on the Robinhood Chain.
-   * staged represents simulated/book-only ledger updates.
-   */
-  settlement?: "staged" | "vault";
+  /** Required. vault = on-chain keeper path; staged = capital-book update only. */
+  settlement: "staged" | "vault";
+  /** Block explorer link when vault tx is confirmed (`0x…`); null for staged. */
+  explorerUrl?: string | null;
+  /** Present when the objective is registered on ObjectiveRegistry. */
+  registryRef?: RegistryRef;
+  /** True when a settlement record exists for this execution (vault only). */
+  verifiedOnChain?: boolean;
+  /** Populated when `verifiedOnChain` is true. */
+  settlementRecord?: SettlementRecord;
 }
 ```
 
+### SettlementRecord (Day 8)
+
+Independent on-chain proof from AureonVault `Rebalanced` events:
+
+```ts
+export interface SettlementRecord {
+  id: string;
+  executionId: string | null;
+  objectiveId: string | null;
+  walletAddress: string;
+  settlement: "vault";
+  transactionHash: string;
+  blockNumber: number;
+  logIndex: number;
+  vaultAddress: string;
+  tokenSell: string;
+  tokenBuy: string;
+  amountIn: string;
+  amountOut: string;
+  explorerUrl: string;
+  verifiedAt: string;
+  status: "confirmed" | "orphan";
+  registryRef?: RegistryRef;
+}
+```
+
+Client methods: `getExecutionSettlement`, `listSettlements`, `confirmExecutionSettlement`.
+
+---
+
+## 6.1 Receipt validation (Day 9)
+
+Validate receipts locally before trusting them in automation:
+
+```ts
+import {
+  validateExecutionReceipt,
+  assertValidExecutionReceipt,
+} from "@buildaureon/sdk";
+
+const result = validateExecutionReceipt(receipt);
+if (!result.valid) {
+  console.error(result.issues);
+}
+
+assertValidExecutionReceipt(receipt); // throws AureonValidationError
+```
+
+`ReceiptValidationResult`:
+
+```ts
+export type ReceiptValidationIssue = {
+  code: string;
+  message: string;
+  path?: string;
+};
+
+export type ReceiptValidationResult = {
+  valid: boolean;
+  issues: ReceiptValidationIssue[];
+};
+```
+
+Enforces required fields, `vault` vs `staged` honesty, explorer rules, and `verifiedOnChain` / `settlementRecord` consistency. See [receipt-validation.md](./receipt-validation.md).
+
 #### JSON Representation Example
 ```json
 {
@@ -422,7 +492,12 @@ export interface ExecutionReceipt {
   "result": "Exchanged stock tokens for 3750.0 USDG on Robinhood Chain",
   "createdAt": "2026-07-15T22:46:00.000Z",
   "confirmedAt": "2026-07-15T22:46:05.000Z",
-  "settlement": "vault"
+  "settlement": "vault",
+  "explorerUrl": "https://explorer.testnet.chain.robinhood.com/tx/0xe295c2763f0d4681a8b54dfd38a0f8bfd21051515fcd9185a494ff3c8a99478f",
+  "registryRef": {
+    "objectiveKey": "0xabc…",
+    "contractAddress": "0x76d8f088d2abba3c73ff93f92308f8b59b250ea5"
+  }
 }
 ```
 

package/docs/integration-guide.md

@@ -163,7 +163,147 @@ Start with one Automatic `balanced_portfolio` objective and a funded vault befor
 
 ---
 
-## 3. Daemon runners
+## 2b. Green vs plan paradox demo (Update 2)
+
+Most dashboards celebrate green PnL. AUREON separates book performance from plan adherence:
+
+```ts
+// Baseline
+const before = await aureon.getAllocationVsTarget();
+console.log(before.rows); // current vs target per objective
+
+// Controlled shock — keep violation visible
+await aureon.applyMarketEvent({
+  symbol: "NVDA",
+  priceChangeRatio: 0.45,
+  autoRestore: false,
+});
+
+const after = await aureon.getAllocationVsTarget();
+console.log(after.paradox.message);
+// "Book is up (5.0%), but 1 objective is off-plan."
+```
+
+Run the full script: `pnpm example:green-vs-plan` (requires `AUREON_API_KEY`).
+
+---
+
+## 2c. AI → objective → portfolio (Update 3)
+
+Most AI agents can transact but forget what the user wanted. AUREON registers intent as a persistent objective, then reads the portfolio through that policy:
+
+```ts
+const flow = await aureon.applyFinancialIntent({
+  brief: "Keep about 20% of the portfolio in stable assets",
+  kind: "stable_allocation",
+  targetWeight: 0.2,
+  tolerance: 0.02,
+});
+
+console.log(flow.intent.policySummary);
+console.log(flow.objective.id);
+console.log(flow.health?.state);
+console.log(flow.message);
+```
+
+For demos, `parseFinancialIntent(brief)` converts a user sentence into structured fields (rule-based, not production NLU).
+
+Run the full script: `pnpm example:ai-to-objective-to-portfolio`.
+
+Then use `getAllocationVsTarget()` (Update 2) to compare objective vs actual over time.
+
+---
+
+## 2d. Drift → detection → restore (Update 4)
+
+Update 2 stops at the paradox — book up, plan off-target, no restore. Update 4 closes the loop:
+
+```ts
+const flow = await aureon.runDriftRestoreDemo();
+
+console.log(flow.rule.summary);
+console.log(flow.phases.aligned.health.state);
+console.log(flow.phases.drift.health.state);
+console.log(flow.phases.restored?.receipt?.settlement);
+console.log(flow.message);
+```
+
+For read-only monitoring without mutating the book, use `getDriftRestoreFlow()` — it joins objectives, health, allocation rows, restore plans (when off-plan), and the latest execution receipt.
+
+Run the full script: `pnpm example:drift-detect-restore`.
+
+---
+
+## 2e. Receipt → verification (Update 5)
+
+Update 4 returns a receipt after restore. Update 5 teaches that **"transaction successful" is a claim**, not proof:
+
+```ts
+const flow = await aureon.runReceiptVerificationDemo();
+
+console.log(flow.phases.claimed.result);
+console.log(flow.phases.validation.valid);
+console.log(flow.proofTier);
+console.log(flow.phases.settlement?.verifiedOnChain);
+console.log(flow.message);
+```
+
+Proof tiers: **claim_only** (validation failed) → **schema_valid** (honest receipt shape) → **chain_verified** (independent settlement record for vault).
+
+For read-only checks on existing executions, use `getReceiptVerificationFlow(executionId?)`.
+
+Run the full script: `pnpm example:receipt-verification`.
+
+Forward link: Update 6 — Claude/Cursor + AUREON agent-in-host demo.
+
+---
+
+## 2f. Portfolio watch while away (Update 6)
+
+Consumer hook: *“Imagine telling your AI: watch my portfolio while I'm away.”*
+
+```ts
+const flow = await aureon.runPortfolioWatchDemo({ host: "cursor" });
+
+console.log(flow.userBrief);
+console.log(flow.phases.register.automationMode);
+console.log(flow.phases.whileAway?.autoRestored);
+for (const line of flow.phases.briefing.summaryLines) {
+  console.log(line);
+}
+```
+
+Update 4 uses `autoRestore: false` (manual restore demo). Update 6 uses **`autoRestore: true`** — Automatic mode acts while the operator is away.
+
+For read-only briefing on existing Automatic objectives: `getPortfolioWatchFlow()`.
+
+Run the full script: `pnpm example:portfolio-watch`.
+
+Forward link: Update 7 — full AUREON loop.
+
+---
+
+## 2g. Full AUREON loop (Update 7)
+
+Positioning hook: *"We're not building another portfolio tracker."*
+
+```ts
+const flow = await aureon.runFullAureonLoopDemo();
+
+console.log(flow.phases.intent.policySummary);
+console.log(flow.phases.planCheck.afterShock.paradox.detected);
+console.log(flow.phases.driftRestore.settlement);
+console.log(flow.phases.verification.proofTier);
+console.log(flow.message);
+```
+
+One composite closes the content arc: **intent → plan check → restore → receipt verification**. A tracker stops at marks; AUREON registers policy, exposes green-vs-plan failure (`autoRestore: false`), restores, then validates the receipt.
+
+For read-only joins on existing objectives with receipts: `getFullAureonLoopFlow()`.
+
+Run the full script: `pnpm example:full-aureon-loop`.
+
+---
 
 ### PM2
 

package/docs/receipt-validation.md

@@ -0,0 +1,63 @@
+# Receipt validation
+
+Phase 2 receipts must follow honest settlement rules. Use the SDK validator after every restore or when ingesting receipts from logs.
+
+---
+
+## Quick example
+
+```ts
+import {
+  createAureonClient,
+  validateExecutionReceipt,
+  assertValidExecutionReceipt,
+} from "@buildaureon/sdk";
+
+const client = createAureonClient({
+  baseUrl: process.env.AUREON_API_URL!,
+  apiKey: process.env.AUREON_API_KEY!,
+});
+
+const receipt = await client.restoreObjective("obj_abc123");
+
+const check = validateExecutionReceipt(receipt);
+if (!check.valid) {
+  for (const issue of check.issues) {
+    console.error(issue.code, issue.path, issue.message);
+  }
+  throw new Error("Receipt failed validation");
+}
+
+// Or throw in one step:
+assertValidExecutionReceipt(receipt);
+```
+
+List recent receipts and validate each:
+
+```ts
+for (const receipt of await client.listExecutions()) {
+  assertValidExecutionReceipt(receipt);
+}
+```
+
+---
+
+## What gets checked
+
+| Rule | Fail code (examples) |
+|------|----------------------|
+| Required fields present | `MISSING_FIELD` |
+| `settlement` is `vault` or `staged` | `INVALID_SETTLEMENT` |
+| Staged: no explorer, not verified | `STAGED_WITH_EXPLORER`, `STAGED_VERIFIED_ON_CHAIN` |
+| Vault with real `0x` tx: explorer required | `VAULT_MISSING_EXPLORER` |
+| `verifiedOnChain: true` needs matching record | `VERIFIED_WITHOUT_RECORD` |
+| Registry ref hex shape | `INVALID_REGISTRY_REF` |
+
+The validator does **not** re-query the chain — it checks shape and honesty only.
+
+---
+
+## Related
+
+- [Data contracts](./data-contracts.md) — receipt and settlement fields
+- [Integration guide](./integration-guide.md) — agent restore loop

package/examples/ai-to-objective-to-portfolio/main.ts

@@ -0,0 +1,127 @@
+/**
+ * @fileoverview Update 3 demo — AI → objective → portfolio.
+ *
+ * Env:
+ *   AUREON_API_KEY  issued developer key (required)
+ *   AUREON_API_URL  optional (default https://api.aureonlabs.network)
+ *
+ *   pnpm example:ai-to-objective-to-portfolio
+ */
+
+import {
+  createAureonClient,
+  DEFAULT_API_BASE_URL,
+  formatWeight,
+  isAureonError,
+  parseFinancialIntent,
+  type PortfolioPositionInput,
+} from "../../src/index.js";
+
+const DEMO_POSITIONS: PortfolioPositionInput[] = [
+  {
+    symbol: "USDG",
+    name: "Paxos USDG",
+    category: "stable",
+    quantity: 24_000,
+    markPriceUsd: 1,
+  },
+  {
+    symbol: "NVDA",
+    name: "NVIDIA Stock Token",
+    category: "stock_token",
+    quantity: 45,
+    markPriceUsd: 920,
+  },
+  {
+    symbol: "AAPL",
+    name: "Apple Stock Token",
+    category: "stock_token",
+    quantity: 80,
+    markPriceUsd: 210,
+  },
+  {
+    symbol: "ETH",
+    name: "Ether",
+    category: "gas",
+    quantity: 8.5,
+    markPriceUsd: 3400,
+  },
+];
+
+async function main(): Promise<void> {
+  const apiKey = process.env.AUREON_API_KEY?.trim();
+  if (!apiKey) {
+    throw new Error("Set AUREON_API_KEY to an issued developer key.");
+  }
+
+  const aureon = createAureonClient({
+    baseUrl: process.env.AUREON_API_URL?.trim() || DEFAULT_API_BASE_URL,
+    apiKey,
+  });
+
+  const userBrief =
+    "I want to keep about 20% of my portfolio in stable assets.";
+
+  console.log("\n=== AUREON Update 3 — AI → objective → portfolio ===\n");
+  console.log("USER (simulated agent input):");
+  console.log(`  "${userBrief}"\n`);
+
+  console.log("AI — structured intent:");
+  const intent = parseFinancialIntent(userBrief);
+  console.log(
+    JSON.stringify(
+      {
+        kind: intent.kind,
+        targetWeight: intent.targetWeight,
+        tolerance: intent.tolerance,
+      },
+      null,
+      2
+    )
+  );
+
+  console.log("\n1. Seed capital book…");
+  await aureon.setPortfolio(DEMO_POSITIONS);
+
+  console.log("2. Apply financial intent → create objective…");
+  const flow = await aureon.applyFinancialIntent(intent);
+
+  console.log("\n--- Intent ---");
+  console.log(`  Brief:   ${flow.intent.brief}`);
+  console.log(`  Policy:  ${flow.intent.policySummary}`);
+
+  console.log("\n--- Objective ---");
+  console.log(`  ID:      ${flow.objective.id}`);
+  console.log(`  Kind:    ${flow.objective.kind}`);
+  console.log(`  Mode:    ${flow.objective.automationMode}`);
+  console.log(
+    `  Target:  ${formatWeight(flow.objective.policy.targetWeight)}`
+  );
+
+  console.log("\n--- Portfolio ---");
+  console.log(
+    `  Book:    $${flow.portfolio.totalNotionalUsd.toLocaleString()}`
+  );
+  console.log(
+    `  Stables: ${formatWeight(flow.portfolio.stableWeight)}`
+  );
+  if (flow.health) {
+    console.log(
+      `  Health:  ${flow.health.state} — current ${formatWeight(flow.health.currentMetric)} vs target ${formatWeight(flow.health.targetMetric)}`
+    );
+  }
+
+  console.log(`\n${flow.message}`);
+  console.log(
+    "\nThe portfolio now has a reason — not just positions.\n"
+  );
+}
+
+main().catch((error) => {
+  if (isAureonError(error)) {
+    console.error(`${error.code}: ${error.message}`);
+  } else {
+    console.error(error);
+  }
+  process.exitCode = 1;
+});

package/examples/audit-trail/main.ts

@@ -0,0 +1,53 @@
+/**
+ * @fileoverview Phase 2 audit trail export — objective → proof.
+ *
+ * Env:
+ *   AUREON_API_KEY  issued developer key (required)
+ *   AUREON_API_URL  optional
+ *   AUREON_OBJECTIVE_ID  optional (defaults to first objective)
+ *
+ *   pnpm example:audit-trail
+ */
+
+import {
+  createAureonClient,
+  DEFAULT_API_BASE_URL,
+  formatAuditTrailLines,
+  isAureonError,
+} from "../../src/index.js";
+
+async function main(): Promise<void> {
+  const apiKey = process.env.AUREON_API_KEY?.trim();
+  if (!apiKey) {
+    throw new Error("Set AUREON_API_KEY to an issued developer key.");
+  }
+
+  const aureon = createAureonClient({
+    baseUrl: process.env.AUREON_API_URL?.trim() || DEFAULT_API_BASE_URL,
+    apiKey,
+  });
+
+  const requested = process.env.AUREON_OBJECTIVE_ID?.trim();
+  const objectiveId =
+    requested || (await aureon.listObjectives())[0]?.id;
+  if (!objectiveId) {
+    throw new Error("No objectives on this wallet. Create one first.");
+  }
+
+  const trail = await aureon.getAuditTrail(objectiveId);
+
+  console.log("\n=== AUREON Phase 2 — Financial audit trail ===\n");
+  for (const line of formatAuditTrailLines(trail)) {
+    console.log(line);
+  }
+  console.log("");
+}
+
+main().catch((error) => {
+  if (isAureonError(error)) {
+    console.error(`${error.code}: ${error.message}`);
+  } else {
+    console.error(error);
+  }
+  process.exitCode = 1;
+});