@kivel.io/cli 0.6.1 → 0.8.0

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # @kivel.io/cli
 
+## 0.8.0
+
+### Minor Changes
+
+- 7290344: Add test wallets, x402 paywalls and mock checkouts with approval-aware payments, ledgers and test outcome controls.
+
+### Patch Changes
+
+- Updated dependencies [7290344]
+    - @kivel.io/sdk@0.8.0
+
+## 0.7.0
+
+### Minor Changes
+
+- 7cbd3fc: Add workspace credential storage, password generation and approved reveals.
+
+### Patch Changes
+
+- Updated dependencies [7cbd3fc]
+    - @kivel.io/sdk@0.7.0
+
 ## 0.6.1
 
 ### Patch Changes

package/README.md

@@ -82,3 +82,16 @@ kivel oauth delete <id>
 Use `oauth list` to list workspace providers. Configure your OAuth client with the
 returned discovery URL and S256 PKCE. See the [OAuth guide](https://kivel.io/docs/mock-oauth/)
 for headless approval, refresh tokens and failure scenarios. This service is for tests only.
+
+## Workspace vault
+
+Pipe `{ "name": "Example", "url": "example.com", "username": "agent@example.com" }`
+to `kivel credential save` to generate and save a password. Include `password`
+to store an existing value. List with `kivel credential list`, or inspect
+metadata with `kivel credential inspect <id>`.
+
+`kivel credential reveal <id>` returns an approval link by default. After the
+human approves, repeat with `--approval-id <id>`. An approval permits one reveal.
+Use `kivel password generate --length 24` to generate without storing.
+Write keys are required for saves and reveals. Agent access settings stay with
+the signed-in workspace owner or admin.

package/dist/agent-commands.js

@@ -1,9 +1,12 @@
 export function needsInput(args) {
     return (['run', 'upload'].includes(args[0] ?? '') ||
+        (['test-wallet', 'test-paywall', 'test-checkout'].includes(args[0] ?? '') &&
+            ['create', 'update', 'pay', 'top-up', 'complete', 'confirm'].includes(args[1] ?? '')) ||
         (args[0] === 'api' && !['GET', 'HEAD', 'OPTIONS', 'DELETE'].includes(args[1] ?? '')) ||
         (args[0] === 'agent' && args[1] === 'token') ||
         (args[0] === 'memory' && args[1] === 'set') ||
         (args[0] === 'authenticator' && args[1] === 'add') ||
+        (args[0] === 'credential' && ['save', 'update'].includes(args[1] ?? '')) ||
         (args[0] === 'approval' && args[1] === 'ask') ||
         (args[0] === 'monitor' && args[1] === 'create') ||
         (args[0] === 'email' && ['draft-create', 'draft-submit'].includes(args[1] ?? '')) ||
@@ -55,6 +58,10 @@ export async function agentCommand(client, args, input) {
         allowed.add('--cursor');
         allowed.add('--limit');
     }
+    if (group === 'credential' && action === 'reveal')
+        allowed.add('--approval-id');
+    if (group === 'password' && action === 'generate')
+        allowed.add('--length');
     if (group === 'agent' && ['login', 'trial'].includes(action ?? ''))
         allowed.add('--client');
     if (group === 'agent' && action === 'trial')
@@ -115,6 +122,8 @@ export async function agentCommand(client, args, input) {
     const idempotencyKey = take('--idempotency-key');
     const emailSettings = { activeDays: number('--active-days'), localPart: take('--local-part') };
     const threadPage = { cursor: take('--cursor'), limit: number('--limit') };
+    const approvalId = take('--approval-id');
+    const passwordLength = number('--length');
     if (flags.size)
         throw new Error(`Unknown option: ${flags.keys().next().value}`);
     const exact = (count) => {
@@ -170,6 +179,64 @@ export async function agentCommand(client, args, input) {
             return client.agents();
         }
     }
+    if (['test-wallet', 'test-paywall', 'test-checkout'].includes(group ?? '')) {
+        const kind = group === 'test-wallet'
+            ? 'wallets'
+            : group === 'test-paywall'
+                ? 'paywalls'
+                : 'checkouts';
+        if (action === 'create') {
+            exact(0);
+            const input = json();
+            return kind === 'wallets'
+                ? client.createTestWallet(input)
+                : kind === 'paywalls'
+                    ? client.createTestPaywall(input)
+                    : client.createTestCheckout(input);
+        }
+        if (action === 'list') {
+            exact(0);
+            return client.testPayments(kind);
+        }
+        if (action === 'inspect' || action === 'balance')
+            return client.testPayment(kind, id());
+        if (action === 'update')
+            return client.updateTestPayment(kind, id(), json());
+        if (action === 'delete')
+            return client.deleteTestPayment(kind, id());
+        if (group === 'test-wallet' && action === 'pay')
+            return client.walletPay(id(), json());
+        if (group === 'test-wallet' && action === 'top-up')
+            return client.topUpTestWallet(id(), json().amount);
+        if (group === 'test-wallet' && action === 'transactions')
+            return client.listWalletTransactions(id());
+        if (group === 'test-checkout' && action === 'complete')
+            return client.completeTestCheckout(id(), json());
+        if (group === 'test-checkout' && action === 'confirm')
+            return client.confirmTestCheckout(id(), json().confirmationToken);
+    }
+    if (group === 'credential') {
+        if (action === 'save') {
+            exact(0);
+            return client.saveCredential(json());
+        }
+        if (action === 'list') {
+            exact(0);
+            return client.credentials();
+        }
+        if (action === 'inspect')
+            return client.credential(id());
+        if (action === 'update')
+            return client.updateCredential(id(), json());
+        if (action === 'delete')
+            return client.deleteCredential(id());
+        if (action === 'reveal')
+            return client.revealCredential(id(), approvalId);
+    }
+    if (group === 'password' && action === 'generate') {
+        exact(0);
+        return client.generatePassword(passwordLength);
+    }
     if (group === 'authenticator') {
         if (action === 'add') {
             exact(0);

package/dist/commands.d.ts

@@ -1,4 +1,4 @@
 export { needsInput } from './agent-commands.js';
 import type { Kivel } from '@kivel.io/sdk';
-export declare const help = "kivel tools | usage | resources\nkivel --version\nkivel plans | activity\nkivel agent login <name> [--client <client>]\nkivel agent token < login.json\nkivel agent trial <name> [--human-email <email>] [--client <client>]\nkivel agent list\nkivel authenticator add < authenticator.json\nkivel authenticator list|code|delete [id]\nkivel authenticator rename <id> <name>\nkivel email attachment|download-attachment <inbox-id> <message-id> <attachment-id>\nkivel email create [--active-days <1-7>] [--local-part <paid-address>]\nkivel email list\nkivel email clear <id>\nkivel email forward <id> [--token <token>] < forwarding.json\nkivel email send <id> --idempotency-key <unique-key> < message.json\nkivel event wait [--timeout-seconds <1-30>] < sources.json\nkivel email threads [inbox-id] [--cursor <cursor>] [--limit <n>]\nkivel email thread <inbox-id> <thread-id>\nkivel email drafts|rules <inbox-id>\nkivel email draft-create <inbox-id> < content.json\nkivel email draft-inspect|draft-delete <draft-id>\nkivel email draft-submit <draft-id> [< settings.json]\nkivel email messages|wait <id> [--token <token>] [--after <id>] [--timeout-seconds <n>]\nkivel memory set <namespace> <key> [--ttl-seconds <n>] < value.json\nkivel memory get|delete <namespace> <key>\nkivel memory list <namespace> [--prefix <prefix>]\nkivel monitor create < monitor.json\nkivel monitor list|inspect|pause|resume|delete [id]\nkivel monitor ping|fail <ping-token>\nkivel monitor accept-dns <id>\nkivel job create [--ttl-seconds <n>] < job.json\nkivel job list|inspect|cancel [id]\nkivel status-page create|update [id] < page.json\nkivel smtp create [--ttl-seconds <n>]\nkivel smtp rotate <id>\nkivel phone available [US-area-code]\nkivel phone create <E.164-number> --idempotency-key <unique-key>\nkivel phone list|release|messages|wait [id] [--after <id>] [--timeout-seconds <n>]\nkivel approval ask < question.json\nkivel approval list|pending|inspect|wait [id] [--timeout-seconds <n>]\nkivel inbox requests|wait|deliveries <id> [--token <token>]\nkivel inbox response|forward <id> [--token <token>] < settings.json\nkivel oauth create [--ttl-seconds <n>] < provider.json\nkivel oauth update <id> < provider.json\nkivel oauth list|inspect|calls|renew|delete [id]\nkivel mock create|update [id] < config.json\nkivel mock calls|reset <id> [--token <token>]\nkivel mcp-server create < config.json\nkivel inbox|email|mock|mcp-server|file inspect|delete|renew <id> [--token <token>]\nkivel inbox|mock|mcp-server|file sharing <id> --visibility private|public [--token <token>]\nkivel describe <tool-id>\nkivel run <tool-id> [--file <filename>] [--options '{\"action\":\"minify\"}'] < input.txt\nkivel inbox create [--visibility private|public]\nkivel listen <inbox-id> [--token <inspection-token>] [--forward http://localhost:3000] [--all]\nkivel api <GET|HEAD|OPTIONS|POST|PUT|PATCH|DELETE> /api/path-or-/mock/path [--token <resource-token>] < body.json\nkivel upload <filename> [--visibility private|public] [--max-downloads 1] < file.bin\nkivel download <file-id> [--access-token token] > file.bin\n\nSet KIVEL_URL and KIVEL_API_KEY. Commands output JSON; downloads output binary; help is plain text. Mutations are never retried. Authenticators are only for accounts your human asked you to create or operate. Attachment downloads output untrusted binary files; attachment links expire in two minutes.\nCreation also accepts --ttl-seconds <n> and --persistent. Webhook receiving is public by default; inspection always needs workspace credentials or the inspection token. Use inbox create --visibility private only when senders can add X-Access-Token. Other resources default to private.";
+export declare const help = "kivel tools | usage | resources\nkivel --version\nkivel plans | activity\nkivel agent login <name> [--client <client>]\nkivel agent token < login.json\nkivel agent trial <name> [--human-email <email>] [--client <client>]\nkivel agent list\nkivel authenticator add < authenticator.json\nkivel authenticator list|code|delete [id]\nkivel authenticator rename <id> <name>\nkivel email attachment|download-attachment <inbox-id> <message-id> <attachment-id>\nkivel email create [--active-days <1-7>] [--local-part <paid-address>]\nkivel email list\nkivel email clear <id>\nkivel email forward <id> [--token <token>] < forwarding.json\nkivel email send <id> --idempotency-key <unique-key> < message.json\nkivel event wait [--timeout-seconds <1-30>] < sources.json\nkivel test-wallet create|list|inspect|update|delete [id]\nkivel test-wallet balance|transactions <id>\nkivel test-wallet pay|top-up <id> < test-payment.json\nkivel test-paywall create|list|inspect|update|delete [id]\nkivel test-checkout create|list|inspect|update|delete [id]\nkivel test-checkout complete|confirm <id> < test-checkout.json\nTest payments use fake units only. Create/update read JSON from stdin. Agent keys cannot set wallet limits; only a human owner/admin can. Resume approval with the same payment idempotencyKey.\nkivel credential save < credential.json\nkivel credential list\nkivel credential inspect|delete <id>\nkivel credential update <id> < changes.json\nkivel credential reveal <id> [--approval-id <id>]\nkivel password generate [--length <n>]\nkivel email threads [inbox-id] [--cursor <cursor>] [--limit <n>]\nkivel email thread <inbox-id> <thread-id>\nkivel email drafts|rules <inbox-id>\nkivel email draft-create <inbox-id> < content.json\nkivel email draft-inspect|draft-delete <draft-id>\nkivel email draft-submit <draft-id> [< settings.json]\nkivel email messages|wait <id> [--token <token>] [--after <id>] [--timeout-seconds <n>]\nkivel memory set <namespace> <key> [--ttl-seconds <n>] < value.json\nkivel memory get|delete <namespace> <key>\nkivel memory list <namespace> [--prefix <prefix>]\nkivel monitor create < monitor.json\nkivel monitor list|inspect|pause|resume|delete [id]\nkivel monitor ping|fail <ping-token>\nkivel monitor accept-dns <id>\nkivel job create [--ttl-seconds <n>] < job.json\nkivel job list|inspect|cancel [id]\nkivel status-page create|update [id] < page.json\nkivel smtp create [--ttl-seconds <n>]\nkivel smtp rotate <id>\nkivel phone available [US-area-code]\nkivel phone create <E.164-number> --idempotency-key <unique-key>\nkivel phone list|release|messages|wait [id] [--after <id>] [--timeout-seconds <n>]\nkivel approval ask < question.json\nkivel approval list|pending|inspect|wait [id] [--timeout-seconds <n>]\nkivel inbox requests|wait|deliveries <id> [--token <token>]\nkivel inbox response|forward <id> [--token <token>] < settings.json\nkivel oauth create [--ttl-seconds <n>] < provider.json\nkivel oauth update <id> < provider.json\nkivel oauth list|inspect|calls|renew|delete [id]\nkivel mock create|update [id] < config.json\nkivel mock calls|reset <id> [--token <token>]\nkivel mcp-server create < config.json\nkivel inbox|email|mock|mcp-server|file inspect|delete|renew <id> [--token <token>]\nkivel inbox|mock|mcp-server|file sharing <id> --visibility private|public [--token <token>]\nkivel describe <tool-id>\nkivel run <tool-id> [--file <filename>] [--options '{\"action\":\"minify\"}'] < input.txt\nkivel inbox create [--visibility private|public]\nkivel listen <inbox-id> [--token <inspection-token>] [--forward http://localhost:3000] [--all]\nkivel api <GET|HEAD|OPTIONS|POST|PUT|PATCH|DELETE> /api/path-or-/mock/path [--token <resource-token>] < body.json\nkivel upload <filename> [--visibility private|public] [--max-downloads 1] < file.bin\nkivel download <file-id> [--access-token token] > file.bin\n\nSet KIVEL_URL and KIVEL_API_KEY. Commands output JSON; downloads output binary; help is plain text. Mutations are never retried. Authenticators are only for accounts your human asked you to create or operate. Attachment downloads output untrusted binary files; attachment links expire in two minutes.\nCreation also accepts --ttl-seconds <n> and --persistent. Webhook receiving is public by default; inspection always needs workspace credentials or the inspection token. Use inbox create --visibility private only when senders can add X-Access-Token. Other resources default to private.";
 export declare function command(client: Kivel, args: string[], input?: Uint8Array): Promise<unknown>;

package/dist/commands.js

@@ -18,6 +18,19 @@ kivel email clear <id>
 kivel email forward <id> [--token <token>] < forwarding.json
 kivel email send <id> --idempotency-key <unique-key> < message.json
 kivel event wait [--timeout-seconds <1-30>] < sources.json
+kivel test-wallet create|list|inspect|update|delete [id]
+kivel test-wallet balance|transactions <id>
+kivel test-wallet pay|top-up <id> < test-payment.json
+kivel test-paywall create|list|inspect|update|delete [id]
+kivel test-checkout create|list|inspect|update|delete [id]
+kivel test-checkout complete|confirm <id> < test-checkout.json
+Test payments use fake units only. Create/update read JSON from stdin. Agent keys cannot set wallet limits; only a human owner/admin can. Resume approval with the same payment idempotencyKey.
+kivel credential save < credential.json
+kivel credential list
+kivel credential inspect|delete <id>
+kivel credential update <id> < changes.json
+kivel credential reveal <id> [--approval-id <id>]
+kivel password generate [--length <n>]
 kivel email threads [inbox-id] [--cursor <cursor>] [--limit <n>]
 kivel email thread <inbox-id> <thread-id>
 kivel email drafts|rules <inbox-id>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kivel.io/cli",
-  "version": "0.6.1",
+  "version": "0.8.0",
   "type": "module",
   "bin": {
     "kivel": "./bin/kivel.mjs"
@@ -18,7 +18,7 @@
     "CHANGELOG.md"
   ],
   "dependencies": {
-    "@kivel.io/sdk": "0.6.1"
+    "@kivel.io/sdk": "0.8.0"
   },
   "devDependencies": {
     "@types/node": "^26.6.5",