@coswic/aipay 0.2.0 → 0.4.0

package/CHANGELOG.md

@@ -0,0 +1,40 @@
+# @coswic/aipay
+
+## 0.4.0 — 2026-09-08
+
+- Simplify setup instructions around standard OAuth and HTTPS connectivity.
+- Report empty 404 responses without inferring their cause.
+- Remove the retired `AIPAY_GATE_TOKEN` setting and automatic `X-AIPay-Gate` header injection. OAuth tokens, PKCE, device authorization, refresh and revocation retain their existing behavior.
+- **Programmatic compatibility:** remove the `GATE_ENV`, `gatedFetch`, `gateHeaders` and `looksGated` exports; use `isEmpty404` to identify an empty 404 response. Remove the gate-only environment arguments from `createRemote`, `fetchCliConfig`, `openDeveloperApi` and the doctor dependency interface. `Remote.fetchDocs`/`probe` results and init JSON use `empty404` instead of `gated`; the corresponding error code is `empty_404`.
+
+## 0.3.0
+
+- `aipay init --framework next|express|fastify|hono|vite|node` overrides framework detection.
+- Vite (browser SPA) projects: `init` writes a browser helper (`aipay.ts`, PKCE in the page,
+  tokens in sessionStorage) plus `aipay-boot.ts`, and `VITE_AIPAY_*` aliases in `.env.local`
+  (Vite exposes only VITE_-prefixed values). Server frameworks still win when both are present.
+- `aipay test` reports failures to the Console too (`cli.test` with `ok:false` and an error
+  code), so the verify step can show what went wrong.
+
+## 0.2.1
+
+Same content as 0.2.0. Version 0.2.0 on npm was published by mistake without `dist` (the
+tarball only had README and package.json); it is deprecated and `latest` points past it.
+Install 0.2.1 or later.
+
+## 0.2.0
+
+- `aipay login --device`: RFC 8628 device authorization for machines without a browser (SSH
+  boxes, containers, CI). Prints a URL and a short code; approve on any device; the CLI polls.
+  Requires an AI-Pay whose `/v1/cli/config` reports `device_authorization: true`.
+- Windows: developer tokens are now protected with DPAPI (Windows PowerShell
+  `ConvertFrom-SecureString`) in `%APPDATA%\aipay\credentials.dpapi` instead of a plaintext
+  `credentials.json`. An existing plaintext file is read once and replaced on the next login.
+  `AIPAY_TOKEN_STORE=file` keeps the old behaviour.
+- `aipay login` (browser flow) mentions `--device` when the server supports it.
+
+## 0.1.0
+
+- First release: `init`, `test`, `doctor`, `status`, `unlink`, `login`/`logout`/`whoami`,
+  `apps list`/`apps create`; loopback PKCE on any free port; tokens in the OS keychain or a
+  0600 file; setup progress reported to the Console.

package/README.md

@@ -12,7 +12,7 @@ npx @coswic/aipay test
 
 | Command | What it does |
 |---|---|
-| `aipay init` | Links the project to your app: writes `.aipay/project.json` (commit it), `.env.local` (public values only, git-ignored), a start/callback route for your framework (Next.js, Express, Fastify, Hono, plain Node), `aipay-agent.md` (the developer docs, fetched once, for your agent to read offline) and installs the SDK. Never overwrites a file it did not write this run. `--dry-run` shows the plan. |
+| `aipay init` | Links the project to your app: writes `.aipay/project.json` (commit it), `.env.local` (public values only, git-ignored), a start/callback route for your framework (Next.js, Express, Fastify, Hono, plain Node) or a browser helper for a Vite SPA (`--framework` overrides detection), `aipay-agent.md` (the developer docs, fetched once, for your agent to read offline) and installs the SDK. Never overwrites a file it did not write this run. `--dry-run` shows the plan. |
 | `aipay test` | The proof: a real sign-in through the AI-Pay authorization server, received by the CLI on a loopback callback, then one chat completion on that user's behalf. Prints the receipt (`request_id`, amount charged). The Console's verify step turns green from the server side. The authorization server ignores the port for `127.0.0.1` redirect URIs (RFC 8252), so the CLI binds any free port and your dev server can keep running; `--port <n>` forces one. `--no-open` prints the URL instead of opening a browser; `--model <id>` picks the model. |
 | `aipay doctor` | Checks Node, the link, `.env.local`, the SDK install, and that the authorization server and API are reachable. `--offline` skips the network. |
 | `aipay status` | What this directory is linked to. |
@@ -37,16 +37,12 @@ own. Nothing is written to the project; tokens go to the keychain or the 0600 fi
 like the browser flow. With `--json`, the URL and code are echoed on stderr as
 `device_url …` / `user_code …` so an agent can show them to you.
 
-## Pilot gate
+## Connection troubleshooting
 
-During the closed pilot, non-public AI-Pay paths answer `404` with an empty body unless the
-request carries the gate token. Export it and the CLI sends it as `X-AIPay-Gate`:
-
-```bash
-export AIPAY_GATE_TOKEN=<token from the Console>
-```
-
-The CLI never writes the token to any file and never prints it.
+Check the configured API and authorization server URLs and network connectivity if a
+request fails. An empty `404` alone does not identify the cause; it does not establish
+whether a path is missing or why the server returned that response. Run `aipay doctor`
+to check the configured endpoints before retrying.
 
 ## What gets written
 

package/dist/agent-guide.d.ts

@@ -0,0 +1,18 @@
+/**
+ * `aipay-agent.md`: the file a coding agent reads first. Header = the facts of THIS
+ * project (app, endpoints, what was scaffolded, what "done" means); body = the AI-Pay
+ * developer docs fetched from the API (`/docs.md?lang=en`), so the agent does not need
+ * network access to read them later.
+ *
+ * Never contains tokens. If the docs cannot be fetched, the file still gets
+ * written with the header and a pointer, and the CLI warns.
+ */
+import type { ProjectConfig } from './project.js';
+export declare const AGENT_GUIDE_FILE = "aipay-agent.md";
+export interface GuideInput {
+    project: ProjectConfig;
+    scaffolded: string[];
+    docsMarkdown: string | null;
+    docsUrl: string;
+}
+export declare function agentGuide(input: GuideInput): string;

package/dist/agent-guide.js

@@ -0,0 +1,60 @@
+export const AGENT_GUIDE_FILE = 'aipay-agent.md';
+export function agentGuide(input) {
+    const p = input.project;
+    const files = input.scaffolded.length
+        ? input.scaffolded.map((f) => `- \`${f}\``).join('\n')
+        : '- (none — the project had them already)';
+    const head = `# AI-Pay integration guide for this project
+
+> Written by \`aipay init\` on ${p.linked_at}. Regenerate with \`aipay init --app ${p.app.client_id}\`. Safe to commit: it contains no secrets.
+
+## This project
+
+| | |
+|---|---|
+| App | ${p.app.name ?? '(unnamed)'} |
+| client_id | \`${p.app.client_id}\` (public client, PKCE S256, no secret) |
+| Authorization server | ${p.auth_origin} |
+| API base | ${p.api_base} |
+| Registered callback | \`${p.callback}\` (for 127.0.0.1 the port is not compared, so any local port works) |
+| Local config | \`.aipay/project.json\` (commit it), \`.env.local\` (do not commit) |
+
+Files scaffolded by the CLI (edit freely; the CLI never overwrites existing files):
+${files}
+
+## Definition of done
+
+1. \`aipay doctor\` reports no problems.
+2. The app's dev server serves the start route and the callback route above.
+3. \`aipay test\` completes: a real sign-in through the AI-Pay authorization server and
+   one chat completion whose response carries a receipt (\`aipay.request_id\`).
+4. Typecheck/build pass. Do not commit automatically and do not deploy.
+
+## Rules for agents
+
+- Read the docs below before changing the integration; they are the source of truth.
+- Use standard OAuth sign-in and app authorization.
+- Keep OAuth tokens out of code, config files, and version control.
+- Never request \`offline_access\` unless the product needs background renewal.
+- Key user accounts on \`sub\` from the userinfo endpoint, never on email.
+
+`;
+    const body = input.docsMarkdown
+        ? `---
+
+# AI-Pay developer documentation
+
+_Fetched from ${input.docsUrl} by \`aipay init\`._
+
+${input.docsMarkdown.trim()}
+`
+        : `---
+
+# AI-Pay developer documentation
+
+The docs could not be fetched when this file was written (see the \`aipay init\` output).
+Check the endpoint URL and network connectivity, then read
+${input.docsUrl} or run \`aipay init\` again. An empty 404 alone does not identify the cause.
+`;
+    return head + body;
+}

package/dist/args.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Tiny argv parser — zero deps on purpose (the CLI is installed by coding agents in
+ * arbitrary projects; every dependency is attack surface and install time).
+ *
+ * Supports `--flag`, `--flag value`, `--flag=value`, `--no-flag`, and positionals.
+ * Every flag is a string or boolean; commands coerce what they need.
+ */
+export interface ParsedArgs {
+    command: string | null;
+    positionals: string[];
+    flags: Record<string, string | boolean>;
+}
+export declare function parseArgs(argv: string[]): ParsedArgs;
+export declare function flagString(flags: ParsedArgs['flags'], name: string): string | null;
+export declare function flagBool(flags: ParsedArgs['flags'], name: string, dflt?: boolean): boolean;

package/dist/args.js

@@ -0,0 +1,47 @@
+export function parseArgs(argv) {
+    const out = { command: null, positionals: [], flags: {} };
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i] ?? '';
+        if (a === '--') {
+            out.positionals.push(...argv.slice(i + 1));
+            break;
+        }
+        if (a.startsWith('--')) {
+            const body = a.slice(2);
+            const eq = body.indexOf('=');
+            if (eq >= 0) {
+                out.flags[body.slice(0, eq)] = body.slice(eq + 1);
+                continue;
+            }
+            if (body.startsWith('no-')) {
+                out.flags[body.slice(3)] = false;
+                continue;
+            }
+            const next = argv[i + 1];
+            if (next !== undefined && !next.startsWith('--')) {
+                out.flags[body] = next;
+                i++;
+            }
+            else
+                out.flags[body] = true;
+            continue;
+        }
+        if (out.command === null)
+            out.command = a;
+        else
+            out.positionals.push(a);
+    }
+    return out;
+}
+export function flagString(flags, name) {
+    const v = flags[name];
+    return typeof v === 'string' && v !== '' ? v : null;
+}
+export function flagBool(flags, name, dflt = false) {
+    const v = flags[name];
+    if (typeof v === 'boolean')
+        return v;
+    if (typeof v === 'string')
+        return v !== 'false' && v !== '0';
+    return dflt;
+}

package/dist/auth-store.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Where the developer's management tokens live between commands.
+ *
+ * Order of preference (decision D5, 2026-09-04): the OS keychain when a CLI for it exists
+ * (macOS `security`, Linux `secret-tool`), on Windows a DPAPI-protected file (Windows
+ * PowerShell's ConvertFrom-SecureString — encrypted for this Windows user, no plaintext on
+ * disk), else a 0600 file under the user's config dir with a one-line warning at login.
+ * Tokens are never written into the project directory. `AIPAY_TOKEN_STORE=file` forces the
+ * plain file everywhere (escape hatch when a keychain misbehaves).
+ */
+import { type SpawnSyncOptions, type SpawnSyncReturns } from 'node:child_process';
+export interface StoredAuth {
+    api_base: string;
+    auth_origin: string;
+    client_id: string;
+    access_token: string;
+    refresh_token: string | null;
+    /** epoch ms */
+    expires_at: number;
+    scope: string;
+    email: string | null;
+    sub: string;
+}
+export interface AuthStore {
+    /** keychain = OS secret service; dpapi = Windows user-scoped encryption; file = plain 0600 file */
+    kind: 'keychain' | 'dpapi' | 'file';
+    load(): StoredAuth | null;
+    save(auth: StoredAuth): void;
+    clear(): void;
+    /** Human description of where tokens are kept (for `whoami`/`login` output). */
+    where: string;
+}
+export declare function configDir(env?: NodeJS.ProcessEnv): string;
+export declare function createAuthStore(env?: NodeJS.ProcessEnv): AuthStore;
+/** Minimal spawn shape the DPAPI store needs (injectable so the round-trip is unit-testable off Windows). */
+export type Exec = (cmd: string, args: string[], opts: SpawnSyncOptions & {
+    encoding: 'utf8';
+}) => Pick<SpawnSyncReturns<string>, 'status' | 'stdout'>;
+/**
+ * Windows: DPAPI (user scope) via PowerShell — the same primitive the OS uses for saved
+ * credentials. The file holds only the encrypted blob; another Windows account (or a copy
+ * of the file on another machine) cannot decrypt it. The token JSON is base64-encoded
+ * before protection so no PowerShell console encoding can mangle it. A plain
+ * `credentials.json` left by CLI 0.1.0 is still read, and replaced on the next save.
+ */
+export declare function dpapiStore(dir: string, exec?: Exec): AuthStore;
+export declare function fileStore(dir: string): AuthStore;

package/dist/auth-store.js

@@ -0,0 +1,176 @@
+/**
+ * Where the developer's management tokens live between commands.
+ *
+ * Order of preference (decision D5, 2026-09-04): the OS keychain when a CLI for it exists
+ * (macOS `security`, Linux `secret-tool`), on Windows a DPAPI-protected file (Windows
+ * PowerShell's ConvertFrom-SecureString — encrypted for this Windows user, no plaintext on
+ * disk), else a 0600 file under the user's config dir with a one-line warning at login.
+ * Tokens are never written into the project directory. `AIPAY_TOKEN_STORE=file` forces the
+ * plain file everywhere (escape hatch when a keychain misbehaves).
+ */
+import { spawnSync } from 'node:child_process';
+import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+const SERVICE = 'aipay-cli';
+export function configDir(env = process.env) {
+    if (env.AIPAY_CONFIG_DIR)
+        return env.AIPAY_CONFIG_DIR;
+    const base = process.platform === 'win32'
+        ? (env.APPDATA ?? join(homedir(), 'AppData', 'Roaming'))
+        : (env.XDG_CONFIG_HOME ?? join(homedir(), '.config'));
+    return join(base, 'aipay');
+}
+function has(bin) {
+    const r = spawnSync(process.platform === 'win32' ? 'where' : 'which', [bin], { stdio: 'ignore' });
+    return r.status === 0;
+}
+export function createAuthStore(env = process.env) {
+    if (env.AIPAY_TOKEN_STORE !== 'file') {
+        if (process.platform === 'darwin' && has('security'))
+            return macKeychain();
+        if (process.platform === 'linux' && has('secret-tool'))
+            return secretTool();
+        if (process.platform === 'win32' && has('powershell'))
+            return dpapiStore(configDir(env));
+    }
+    return fileStore(configDir(env));
+}
+/** Windows PowerShell 5.1 ships with every Windows; `-NoProfile -NonInteractive` keeps it quiet and fast. */
+const PS_ARGS = ['-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-Command'];
+/** stdin → DPAPI blob (hex). The secret travels over stdin only — never in argv (visible in Task Manager/ETW). */
+const PS_PROTECT = '$in=[Console]::In.ReadToEnd().Trim(); $s=ConvertTo-SecureString -String $in -AsPlainText -Force; ConvertFrom-SecureString -SecureString $s';
+/** DPAPI blob (hex) on stdin → plaintext on stdout. */
+const PS_UNPROTECT = '$in=[Console]::In.ReadToEnd().Trim(); $s=ConvertTo-SecureString -String $in; [System.Net.NetworkCredential]::new("", $s).Password';
+/**
+ * Windows: DPAPI (user scope) via PowerShell — the same primitive the OS uses for saved
+ * credentials. The file holds only the encrypted blob; another Windows account (or a copy
+ * of the file on another machine) cannot decrypt it. The token JSON is base64-encoded
+ * before protection so no PowerShell console encoding can mangle it. A plain
+ * `credentials.json` left by CLI 0.1.0 is still read, and replaced on the next save.
+ */
+export function dpapiStore(dir, exec = spawnSync) {
+    const file = join(dir, 'credentials.dpapi');
+    const legacy = fileStore(dir);
+    const run = (script, input) => {
+        const r = exec('powershell', [...PS_ARGS, script], {
+            input,
+            encoding: 'utf8',
+            stdio: ['pipe', 'pipe', 'ignore'],
+            windowsHide: true,
+        });
+        if (r.status !== 0 || typeof r.stdout !== 'string')
+            return null;
+        const out = r.stdout.trim();
+        return out ? out : null;
+    };
+    return {
+        kind: 'dpapi',
+        where: `${file} (encrypted for this Windows user with DPAPI)`,
+        load() {
+            if (!existsSync(file))
+                return legacy.load();
+            const plain = run(PS_UNPROTECT, readFileSync(file, 'utf8'));
+            if (!plain)
+                return null;
+            try {
+                return parse(Buffer.from(plain, 'base64').toString('utf8'));
+            }
+            catch {
+                return null;
+            }
+        },
+        save(auth) {
+            const blob = run(PS_PROTECT, Buffer.from(JSON.stringify(auth), 'utf8').toString('base64'));
+            if (!blob)
+                throw new Error('could not protect the tokens with Windows DPAPI (PowerShell failed)');
+            mkdirSync(dir, { recursive: true });
+            writeFileSync(file, `${blob}\n`);
+            legacy.clear(); // a 0.1.0 plaintext file must not outlive the encrypted one
+        },
+        clear() {
+            rmSync(file, { force: true });
+            legacy.clear();
+        },
+    };
+}
+function macKeychain() {
+    const account = 'developer';
+    return {
+        kind: 'keychain',
+        where: 'macOS Keychain (service aipay-cli)',
+        load() {
+            const r = spawnSync('security', ['find-generic-password', '-a', account, '-s', SERVICE, '-w'], { encoding: 'utf8' });
+            if (r.status !== 0)
+                return null;
+            return parse(r.stdout.trim());
+        },
+        save(auth) {
+            const r = spawnSync('security', ['add-generic-password', '-U', '-a', account, '-s', SERVICE, '-w', JSON.stringify(auth)], { stdio: 'ignore' });
+            if (r.status !== 0)
+                throw new Error('could not write to the macOS Keychain');
+        },
+        clear() {
+            spawnSync('security', ['delete-generic-password', '-a', account, '-s', SERVICE], {
+                stdio: 'ignore',
+            });
+        },
+    };
+}
+function secretTool() {
+    const attrs = ['service', SERVICE, 'account', 'developer'];
+    return {
+        kind: 'keychain',
+        where: 'the system keyring (secret-tool, service aipay-cli)',
+        load() {
+            const r = spawnSync('secret-tool', ['lookup', ...attrs], { encoding: 'utf8' });
+            if (r.status !== 0 || !r.stdout)
+                return null;
+            return parse(r.stdout.trim());
+        },
+        save(auth) {
+            const r = spawnSync('secret-tool', ['store', '--label', 'AI-Pay CLI', ...attrs], {
+                input: JSON.stringify(auth),
+                stdio: ['pipe', 'ignore', 'ignore'],
+            });
+            if (r.status !== 0)
+                throw new Error('could not write to the system keyring');
+        },
+        clear() {
+            spawnSync('secret-tool', ['clear', ...attrs], { stdio: 'ignore' });
+        },
+    };
+}
+export function fileStore(dir) {
+    const file = join(dir, 'credentials.json');
+    return {
+        kind: 'file',
+        where: `${file} (mode 0600)`,
+        load() {
+            if (!existsSync(file))
+                return null;
+            return parse(readFileSync(file, 'utf8'));
+        },
+        save(auth) {
+            mkdirSync(dir, { recursive: true, mode: 0o700 });
+            writeFileSync(file, `${JSON.stringify(auth, null, 2)}\n`, { mode: 0o600 });
+            chmodSync(file, 0o600);
+        },
+        clear() {
+            rmSync(file, { force: true });
+        },
+    };
+}
+function parse(raw) {
+    try {
+        const v = JSON.parse(raw);
+        if (typeof v.access_token !== 'string' ||
+            typeof v.api_base !== 'string' ||
+            typeof v.client_id !== 'string')
+            return null;
+        return v;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/bin.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/bin.js

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+import { main } from './main.js';
+main(process.argv.slice(2)).then((code) => {
+    process.exitCode = code;
+}, (err) => {
+    process.stderr.write(`${err instanceof Error ? (err.stack ?? err.message) : String(err)}\n`);
+    process.exitCode = 1;
+});

package/dist/browser.d.ts

@@ -0,0 +1 @@
+export declare function openBrowser(url: string, platform?: NodeJS.Platform): boolean;

package/dist/browser.js

@@ -0,0 +1,18 @@
+/** Open a URL in the user's default browser without depending on the `open` package. */
+import { spawn } from 'node:child_process';
+export function openBrowser(url, platform = process.platform) {
+    const [cmd, args] = platform === 'darwin'
+        ? ['open', [url]]
+        : platform === 'win32'
+            ? ['cmd', ['/c', 'start', '', url.replace(/&/g, '^&')]]
+            : ['xdg-open', [url]];
+    try {
+        const child = spawn(cmd, args, { stdio: 'ignore', detached: true });
+        child.on('error', () => { });
+        child.unref();
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/commands/apps.d.ts

@@ -0,0 +1,15 @@
+import { type ParsedArgs } from '../args.js';
+import { type DeveloperApi } from '../developer-api.js';
+import { type Reporter } from '../output.js';
+export interface CreatedApp {
+    app_id: string;
+    client_id: string;
+    redirect_uris: string[];
+    replayed?: boolean;
+}
+export declare function createApp(api: DeveloperApi, input: {
+    name: string;
+    callback: string;
+    key?: string | null;
+}): Promise<CreatedApp>;
+export declare function runApps(args: ParsedArgs, out: Reporter, env?: NodeJS.ProcessEnv): Promise<number>;

package/dist/commands/apps.js

@@ -0,0 +1,53 @@
+/**
+ * `aipay apps list [--json]`
+ * `aipay apps create --name <name> [--callback <uri>] [--key <idempotency key>] [--json]`
+ *
+ * Uses the developer's management token. Creation sends an Idempotency-Key so a retried
+ * command never makes a second app.
+ */
+import { randomUUID } from 'node:crypto';
+import { flagString } from '../args.js';
+import { createAuthStore } from '../auth-store.js';
+import { errorMessage, openDeveloperApi } from '../developer-api.js';
+import { CliError, EXIT } from '../output.js';
+import { DEFAULT_CALLBACK } from './init.js';
+export async function createApp(api, input) {
+    const key = input.key ?? `aipay-cli-${randomUUID()}`;
+    const res = await api.request('POST', '/v1/developer/apps', {
+        body: { name: input.name, redirect_uris: [input.callback] },
+        headers: { 'idempotency-key': key },
+    });
+    if (res.status !== 201 && res.status !== 200)
+        throw new CliError('create_failed', `could not create the app: ${errorMessage(res.body, res.status)}`, EXIT.remote);
+    return res.body;
+}
+export async function runApps(args, out, env = process.env) {
+    const sub = args.positionals[0] ?? 'list';
+    const store = createAuthStore(env);
+    const api = await openDeveloperApi(store);
+    if (sub === 'list') {
+        const res = await api.request('GET', '/v1/developer/apps');
+        if (res.status !== 200)
+            throw new CliError('remote', `GET /v1/developer/apps → ${errorMessage(res.body, res.status)}`, EXIT.remote);
+        const apps = Array.isArray(res.body) ? res.body : (res.body.data ?? res.body.apps ?? []);
+        if (!apps.length)
+            out.line('info', 'no apps yet — `aipay apps create --name "My app"`');
+        for (const a of apps)
+            out.line('info', `${String(a.name ?? '?')}  ${String(a.id ?? a.app_id ?? a.client_id ?? '')}  ${String(a.status ?? '')}`);
+        out.result({ ok: true, apps });
+        return EXIT.ok;
+    }
+    if (sub === 'create') {
+        const name = flagString(args.flags, 'name');
+        if (!name)
+            throw new CliError('usage', 'missing --name <app name>', EXIT.usage);
+        const callback = flagString(args.flags, 'callback') ?? DEFAULT_CALLBACK;
+        const created = await createApp(api, { name, callback, key: flagString(args.flags, 'key') });
+        out.line('ok', `${created.replayed ? 'already created' : 'created'} "${name}" — client_id ${created.client_id}`);
+        out.kv('callback', created.redirect_uris.join(', '));
+        out.line('info', `next: aipay init --app ${created.client_id}`);
+        out.result({ ok: true, ...created, name });
+        return EXIT.ok;
+    }
+    throw new CliError('usage', `unknown apps subcommand "${sub}" (list | create)`, EXIT.usage);
+}

package/dist/commands/doctor.d.ts

@@ -0,0 +1,16 @@
+import { type ParsedArgs } from '../args.js';
+import { type Level, type Reporter } from '../output.js';
+import { type Remote } from '../remote.js';
+export interface Check {
+    id: string;
+    level: Level;
+    text: string;
+}
+export interface DoctorDeps {
+    remote?: Remote;
+    nodeVersion?: string;
+}
+export declare function runDoctor(args: ParsedArgs, out: Reporter, deps?: DoctorDeps): Promise<number>;
+export declare function collectChecks(dir: string, opts: {
+    offline: boolean;
+}, deps: DoctorDeps): Promise<Check[]>;