@kweaver-ai/kweaver-sdk 0.6.4 → 0.6.5

package/README.md

@@ -180,7 +180,9 @@ kweaver skill list/market/get/register/status/delete/content/read-file/download/
 kweaver vega health/stats/inspect/sql/catalog/resource/connector-type
 kweaver context-loader config set/use/list/show
 kweaver context-loader kn-search/query-object-instance/...
-kweaver call <path> [-X METHOD] [-d BODY] [-H header]
+kweaver toolbox create/list/publish/unpublish/delete
+kweaver tool upload/list/enable/disable
+kweaver call <path> [-X METHOD] [-d BODY] [-H header] [-F key=value]
 ```
 
 ### Dataflow CLI examples
@@ -211,6 +213,25 @@ kweaver vega sql -d '{"resource_type":"mysql","query":"SELECT * FROM {{res-1}} L
 
 If both `-d` and `--query` / `--resource-type` are present, **only `-d` is used**.
 
+### Register an Agent toolbox
+
+```bash
+# 1. Create a toolbox pointing at your service
+kweaver toolbox create \
+  --name my_actions \
+  --service-url http://my-svc:8080 \
+  --description "Demo action backend"
+# → {"box_id":"<BOX_ID>"}
+
+# 2. Upload an OpenAPI spec as a tool
+kweaver tool upload --toolbox <BOX_ID> ./openapi.json
+# → {"success_ids":["<TOOL_ID>"]}
+
+# 3. Publish the toolbox and enable the tool
+kweaver toolbox publish <BOX_ID>
+kweaver tool enable --toolbox <BOX_ID> <TOOL_ID>
+```
+
 **No-auth platforms:** If OAuth is not enabled, use `kweaver auth <url> --no-auth` (or run a normal `auth login`; a **404** on `POST /oauth2/clients` switches to no-auth automatically). Credentials are still saved under `~/.kweaver/` and work with `auth use` / `auth list`. Optional: `KWEAVER_NO_AUTH=1` with `KWEAVER_BASE_URL` when no token env is set. SDK: `new KWeaverClient({ baseUrl, auth: false })` or `kweaver.configure({ baseUrl, auth: false })`.
 
 ## Environment Variables

package/dist/api/dataflow.d.ts

@@ -14,7 +14,7 @@ export interface DataflowCreateBody {
 }
 export interface DataflowResult {
     status: "success" | "completed" | "failed" | "error";
-    reason?: string;
+    reason?: unknown;
 }
 export interface CreateDataflowOptions {
     baseUrl: string;

package/dist/api/toolboxes.d.ts

@@ -0,0 +1,47 @@
+interface BaseOpts {
+    baseUrl: string;
+    accessToken: string;
+    businessDomain?: string;
+}
+export interface CreateToolboxOptions extends BaseOpts {
+    name: string;
+    description: string;
+    serviceUrl: string;
+    metadataType?: "openapi";
+    source?: string;
+}
+export declare function createToolbox(opts: CreateToolboxOptions): Promise<string>;
+export interface DeleteToolboxOptions extends BaseOpts {
+    boxId: string;
+}
+export declare function deleteToolbox(opts: DeleteToolboxOptions): Promise<void>;
+export interface SetToolboxStatusOptions extends BaseOpts {
+    boxId: string;
+    status: "published" | "draft";
+}
+export declare function setToolboxStatus(opts: SetToolboxStatusOptions): Promise<void>;
+export interface UploadToolOptions extends BaseOpts {
+    boxId: string;
+    filePath: string;
+    metadataType?: "openapi";
+}
+export declare function uploadTool(opts: UploadToolOptions): Promise<string>;
+export interface SetToolStatusesOptions extends BaseOpts {
+    boxId: string;
+    updates: Array<{
+        toolId: string;
+        status: "enabled" | "disabled";
+    }>;
+}
+export declare function setToolStatuses(opts: SetToolStatusesOptions): Promise<void>;
+export interface ListToolboxesOptions extends BaseOpts {
+    keyword?: string;
+    limit?: number;
+    offset?: number;
+}
+export declare function listToolboxes(opts: ListToolboxesOptions): Promise<string>;
+export interface ListToolsOptions extends BaseOpts {
+    boxId: string;
+}
+export declare function listTools(opts: ListToolsOptions): Promise<string>;
+export {};

package/dist/api/toolboxes.js

@@ -0,0 +1,90 @@
+import { readFile } from "node:fs/promises";
+import { basename } from "node:path";
+import { fetchTextOrThrow } from "../utils/http.js";
+import { buildHeaders } from "./headers.js";
+// Backend endpoints under /api/agent-operator-integration/v1/tool-box.
+//
+// Verified against kweaver/examples/03-action-lifecycle/run.sh (lines 78–197):
+//   POST   /tool-box                   create
+//   DELETE /tool-box/{id}              delete
+//   POST   /tool-box/{id}/status       publish/draft
+//   POST   /tool-box/{id}/tool         upload tool (multipart)
+//   POST   /tool-box/{id}/tools/status enable/disable (batch)
+//
+// Verified during Task 8 e2e against the live backend (2026-04-18):
+//   GET    /tool-box?keyword=&limit=&offset=  list toolboxes
+//   GET    /tool-box/{id}/tool                list tools
+const PATH = "/api/agent-operator-integration/v1/tool-box";
+function url(base, suffix = "") {
+    return `${base.replace(/\/+$/, "")}${PATH}${suffix}`;
+}
+export async function createToolbox(opts) {
+    const body = JSON.stringify({
+        metadata_type: opts.metadataType ?? "openapi",
+        box_name: opts.name,
+        box_desc: opts.description,
+        box_svc_url: opts.serviceUrl,
+        source: opts.source ?? "custom",
+    });
+    const { body: text } = await fetchTextOrThrow(url(opts.baseUrl), {
+        method: "POST",
+        headers: { ...buildHeaders(opts.accessToken, opts.businessDomain ?? "bd_public"), "content-type": "application/json" },
+        body,
+    });
+    return text;
+}
+export async function deleteToolbox(opts) {
+    await fetchTextOrThrow(url(opts.baseUrl, `/${encodeURIComponent(opts.boxId)}`), {
+        method: "DELETE",
+        headers: buildHeaders(opts.accessToken, opts.businessDomain ?? "bd_public"),
+    });
+}
+export async function setToolboxStatus(opts) {
+    await fetchTextOrThrow(url(opts.baseUrl, `/${encodeURIComponent(opts.boxId)}/status`), {
+        method: "POST",
+        headers: { ...buildHeaders(opts.accessToken, opts.businessDomain ?? "bd_public"), "content-type": "application/json" },
+        body: JSON.stringify({ status: opts.status }),
+    });
+}
+export async function uploadTool(opts) {
+    const buf = await readFile(opts.filePath);
+    const form = new FormData();
+    form.append("metadata_type", opts.metadataType ?? "openapi");
+    form.append("data", new Blob([buf]), basename(opts.filePath));
+    const { body: text } = await fetchTextOrThrow(url(opts.baseUrl, `/${encodeURIComponent(opts.boxId)}/tool`), {
+        method: "POST",
+        headers: buildHeaders(opts.accessToken, opts.businessDomain ?? "bd_public"),
+        body: form,
+    });
+    return text;
+}
+export async function setToolStatuses(opts) {
+    const body = JSON.stringify(opts.updates.map((u) => ({ tool_id: u.toolId, status: u.status })));
+    await fetchTextOrThrow(url(opts.baseUrl, `/${encodeURIComponent(opts.boxId)}/tools/status`), {
+        method: "POST",
+        headers: { ...buildHeaders(opts.accessToken, opts.businessDomain ?? "bd_public"), "content-type": "application/json" },
+        body,
+    });
+}
+export async function listToolboxes(opts) {
+    const qp = new URLSearchParams();
+    if (opts.keyword !== undefined)
+        qp.set("keyword", opts.keyword);
+    if (opts.limit !== undefined)
+        qp.set("limit", String(opts.limit));
+    if (opts.offset !== undefined)
+        qp.set("offset", String(opts.offset));
+    const suffix = qp.toString() ? `?${qp}` : "";
+    const { body } = await fetchTextOrThrow(url(opts.baseUrl, suffix), {
+        method: "GET",
+        headers: buildHeaders(opts.accessToken, opts.businessDomain ?? "bd_public"),
+    });
+    return body;
+}
+export async function listTools(opts) {
+    const { body } = await fetchTextOrThrow(url(opts.baseUrl, `/${encodeURIComponent(opts.boxId)}/tool`), {
+        method: "GET",
+        headers: buildHeaders(opts.accessToken, opts.businessDomain ?? "bd_public"),
+    });
+    return body;
+}

package/dist/cli.js

@@ -12,6 +12,8 @@ import { runExploreCommand } from "./commands/explore.js";
 import { runDataviewCommand } from "./commands/dataview.js";
 import { runSkillCommand } from "./commands/skill.js";
 import { runTokenCommand } from "./commands/token.js";
+import { runToolboxCommand } from "./commands/toolbox.js";
+import { runToolCommand } from "./commands/tool.js";
 import { runVegaCommand } from "./commands/vega.js";
 function printHelp() {
     console.log(`kweaver
@@ -99,6 +101,15 @@ Usage:
   kweaver skill read-file <skill-id> <rel-path> [--raw] [--output file]
   kweaver skill download|install <skill-id> [path] [options]
 
+  kweaver toolbox create --name <n> --service-url <url> [--description <d>] [-bd value]
+  kweaver toolbox list [--keyword X] [--limit N] [--offset N] [-bd value]
+  kweaver toolbox publish|unpublish <box-id> [-bd value]
+  kweaver toolbox delete <box-id> [-y] [-bd value]
+
+  kweaver tool upload --toolbox <box-id> <openapi-spec-path> [--metadata-type openapi]
+  kweaver tool list --toolbox <box-id> [-bd value]
+  kweaver tool enable|disable --toolbox <box-id> <tool-id>... [-bd value]
+
   kweaver vega health|stats|inspect
   kweaver vega catalog list|get|health|test-connection|discover|resources [options]
   kweaver vega resource list|get|query [options]
@@ -129,6 +140,8 @@ Commands:
                  object-type, relation-type, subgraph, action-type, action-execution, action-log)
   config         Per-platform configuration (business domain)
   skill          Skill registry and market (register, search, progressive read, download/install)
+  toolbox        Agent toolbox lifecycle (create, list, publish, delete)
+  tool           Tools inside a toolbox (upload OpenAPI spec, list, enable/disable)
   vega           Vega observability (catalog, resource, query/sql, connector-type, health/stats/inspect)
   context-loader Context-loader MCP (config, tools, resources, prompts, kn-search, query-*, etc.)
   help           Show this message`);
@@ -195,6 +208,12 @@ export async function run(argv) {
     if (command === "skill") {
         return runSkillCommand(rest);
     }
+    if (command === "toolbox") {
+        return runToolboxCommand(rest);
+    }
+    if (command === "tool") {
+        return runToolCommand(rest);
+    }
     if (command === "context-loader" || command === "context") {
         return runContextLoaderCommand(rest);
     }

package/dist/commands/bkn-ops.d.ts

@@ -49,6 +49,7 @@ export declare function parseKnCreateFromCsvArgs(args: string[]): {
     batchSize: number;
     tables: string[];
     build: boolean;
+    recreate: boolean;
     timeout: number;
     businessDomain: string;
 };

package/dist/commands/bkn-ops.js

@@ -706,6 +706,7 @@ Options:
   --tables <a,b>       Tables to include in KN (default: all imported)
   --build (default)    Build after creation
   --no-build           Skip build
+  --recreate           Use "insert" mode on first batch (only effective for new tables)
   --timeout <n>        Build timeout in seconds (default: 300)
   -bd, --biz-domain    Business domain (default: bd_public)`;
 export function parseKnCreateFromCsvArgs(args) {
@@ -716,6 +717,7 @@ export function parseKnCreateFromCsvArgs(args) {
     let batchSize = 500;
     let tablesStr = "";
     let build = true;
+    let recreate = false;
     let timeout = 300;
     let businessDomain = "";
     for (let i = 0; i < args.length; i += 1) {
@@ -752,6 +754,10 @@ export function parseKnCreateFromCsvArgs(args) {
             build = false;
             continue;
         }
+        if (arg === "--recreate") {
+            recreate = true;
+            continue;
+        }
         if (arg === "--timeout" && args[i + 1]) {
             timeout = parseInt(args[++i], 10);
             if (Number.isNaN(timeout) || timeout < 1)
@@ -772,7 +778,7 @@ export function parseKnCreateFromCsvArgs(args) {
     }
     if (!businessDomain)
         businessDomain = resolveBusinessDomain();
-    return { dsId, files, name, tablePrefix, batchSize, tables, build, timeout, businessDomain };
+    return { dsId, files, name, tablePrefix, batchSize, tables, build, recreate, timeout, businessDomain };
 }
 export async function runKnCreateFromCsvCommand(args) {
     let options;
@@ -795,6 +801,7 @@ export async function runKnCreateFromCsvCommand(args) {
         "--table-prefix", options.tablePrefix,
         "--batch-size", String(options.batchSize),
         "-bd", options.businessDomain,
+        ...(options.recreate ? ["--recreate"] : []),
     ];
     const importResult = await runDsImportCsv(importArgs);
     if (importResult.code !== 0) {

package/dist/commands/call.d.ts

@@ -1,8 +1,18 @@
+export type FormField = {
+    name: string;
+    kind: "string";
+    value: string;
+} | {
+    name: string;
+    kind: "file";
+    path: string;
+};
 export interface CallInvocation {
     url: string;
     method: string;
     headers: Headers;
     body?: string;
+    formFields?: FormField[];
     pretty: boolean;
     verbose: boolean;
     businessDomain: string;

package/dist/commands/call.js

@@ -1,3 +1,5 @@
+import { readFile } from "node:fs/promises";
+import { basename } from "node:path";
 import { ensureValidToken, formatHttpError, with401RefreshRetry } from "../auth/oauth.js";
 import { isNoAuth } from "../config/no-auth.js";
 import { HttpError } from "../utils/http.js";
@@ -6,6 +8,7 @@ export function parseCallArgs(args) {
     const headers = new Headers();
     let method = "GET";
     let body;
+    const formFields = [];
     let url;
     let pretty = true;
     let verbose = false;
@@ -40,6 +43,26 @@ export function parseCallArgs(args) {
             index += 1;
             continue;
         }
+        if (arg === "-F" || arg === "--form") {
+            const raw = args[index + 1];
+            if (!raw)
+                throw new Error("Missing value for -F flag");
+            const eq = raw.indexOf("=");
+            if (eq === -1)
+                throw new Error(`Invalid -F format: ${raw} (expected key=value or key=@path)`);
+            const name = raw.slice(0, eq);
+            const rhs = raw.slice(eq + 1);
+            if (rhs.startsWith("@")) {
+                formFields.push({ name, kind: "file", path: rhs.slice(1) });
+            }
+            else {
+                formFields.push({ name, kind: "string", value: rhs });
+            }
+            if (method === "GET")
+                method = "POST";
+            index += 1;
+            continue;
+        }
         if (arg === "--pretty") {
             pretty = true;
             continue;
@@ -70,9 +93,21 @@ export function parseCallArgs(args) {
     if (!url) {
         throw new Error("Missing request URL");
     }
+    if (formFields.length > 0 && body !== undefined) {
+        throw new Error("-F and -d are mutually exclusive");
+    }
     if (!businessDomain)
         businessDomain = resolveBusinessDomain();
-    return { url, method, headers, body, pretty, verbose, businessDomain };
+    return {
+        url,
+        method,
+        headers,
+        body,
+        formFields: formFields.length > 0 ? formFields : undefined,
+        pretty,
+        verbose,
+        businessDomain,
+    };
 }
 function injectAuthHeaders(headers, accessToken, businessDomain) {
     if (!isNoAuth(accessToken)) {
@@ -115,12 +150,17 @@ export function formatVerboseRequest(invocation) {
     for (const [name, value] of entries) {
         lines.push(`  ${name}: ${value}`);
     }
-    lines.push(`Body: ${invocation.body ? "present" : "empty"}`);
+    const bodyDesc = invocation.formFields && invocation.formFields.length > 0
+        ? `multipart (${invocation.formFields.length} field${invocation.formFields.length > 1 ? "s" : ""})`
+        : invocation.body
+            ? "present"
+            : "empty";
+    lines.push(`Body: ${bodyDesc}`);
     return lines;
 }
 export async function runCallCommand(args) {
     if (args.length === 0 || args[0] === "--help" || args[0] === "-h") {
-        console.log(`kweaver call <url> [-X METHOD] [-H "Name: value"] [-d BODY] [--pretty] [--verbose] [-bd value]
+        console.log(`kweaver call <url> [-X METHOD] [-H "Name: value"] [-d BODY] [-F key=value] [--pretty] [--verbose] [-bd value]
 
 Call an API with curl-style flags and auto-injected token headers.
 
@@ -129,6 +169,7 @@ Options:
   -X, --request      HTTP method (default: GET)
   -H, --header       Extra header (repeatable)
   -d, --data, --data-raw   JSON request body (sets Content-Type: application/json if not set)
+  -F, --form         Multipart form field. -F key=value or -F key=@/path/to/file. Repeatable. Mutually exclusive with -d.
   -bd, --biz-domain  Override x-business-domain (default: bd_public)
   -v, --verbose      Print request info to stderr
   --pretty           Pretty-print JSON output (default)`);
@@ -150,7 +191,22 @@ Options:
             : invocation.url;
         const headers = new Headers(invocation.headers);
         injectAuthHeaders(headers, token.accessToken, invocation.businessDomain);
-        if (invocation.body !== undefined &&
+        let requestBody = invocation.body;
+        if (invocation.formFields && invocation.formFields.length > 0) {
+            const form = new FormData();
+            for (const field of invocation.formFields) {
+                if (field.kind === "string") {
+                    form.append(field.name, field.value);
+                }
+                else {
+                    const buf = await readFile(field.path);
+                    form.append(field.name, new Blob([buf]), basename(field.path));
+                }
+            }
+            requestBody = form;
+            // do not set content-type — fetch sets multipart boundary
+        }
+        else if (invocation.body !== undefined &&
             invocation.body.length > 0 &&
             !headers.has("content-type") &&
             !headers.has("Content-Type")) {
@@ -164,7 +220,7 @@ Options:
         const response = await fetch(url, {
             method: invocation.method,
             headers,
-            body: invocation.body,
+            body: requestBody,
         });
         const rawText = await response.text();
         const text = stripSseDoneMarker(rawText, response.headers.get("content-type"));

package/dist/commands/ds.js

@@ -466,7 +466,7 @@ export async function runDsImportCsv(args) {
                 process.stderr.write(`${elapsed}s\n`);
             }
             catch (err) {
-                const msg = err instanceof Error ? err.message : String(err);
+                const msg = formatHttpError(err);
                 process.stderr.write(`FAILED\n`);
                 console.error(`[${tableName}] batch ${batchLabel} error: ${msg}`);
                 batchFailed = true;

package/dist/commands/import-csv.d.ts

@@ -19,7 +19,7 @@ export interface DagBodyOptions {
     tableExist: boolean;
     data: Array<Record<string, string | null>>;
     fieldMappings: FieldMapping[];
-    /** When true on the first batch (`tableExist` false), use overwrite to drop/recreate table before import. */
+    /** When true on the first batch (`tableExist` false), use "insert" to force table recreation. */
     recreate?: boolean;
 }
 /**

package/dist/commands/import-csv.js

@@ -82,7 +82,9 @@ export function buildFieldMappings(headers) {
 export function buildDagBody(options) {
     const { datasourceId, datasourceType, tableName, tableExist, data, fieldMappings, recreate } = options;
     const ts = Date.now();
-    const operateType = tableExist ? "append" : recreate ? "overwrite" : "append";
+    // "insert" creates/replaces the table; "append" adds rows to an existing table.
+    // With --recreate, use "insert" on first batch to force table recreation when schema changed.
+    const operateType = tableExist ? "append" : recreate ? "insert" : "append";
     const triggerStep = {
         id: "step-trigger",
         title: "Trigger",

package/dist/commands/tool.d.ts

@@ -0,0 +1,16 @@
+export declare function runToolCommand(args: string[]): Promise<number>;
+export interface ToolUploadOptions {
+    boxId: string;
+    filePath: string;
+    metadataType: "openapi";
+    businessDomain: string;
+    pretty: boolean;
+}
+export declare function parseToolUploadArgs(args: string[]): ToolUploadOptions;
+export interface ToolStatusOptions {
+    boxId: string;
+    toolIds: string[];
+    status: "enabled" | "disabled";
+    businessDomain: string;
+}
+export declare function parseToolStatusArgs(args: string[], status: "enabled" | "disabled"): ToolStatusOptions;

package/dist/commands/tool.js

@@ -0,0 +1,208 @@
+import { access } from "node:fs/promises";
+import { ensureValidToken, formatHttpError, with401RefreshRetry } from "../auth/oauth.js";
+import { listTools, setToolStatuses, uploadTool } from "../api/toolboxes.js";
+import { formatCallOutput } from "./call.js";
+import { resolveBusinessDomain } from "../config/store.js";
+const HELP = `kweaver tool
+
+Subcommands:
+  upload --toolbox <box-id> <openapi-spec-path> [--metadata-type openapi]
+                                          Upload an OpenAPI spec file as a tool
+  list --toolbox <box-id>                  List tools in a toolbox
+  enable --toolbox <box-id> <tool-id>...   Enable one or more tools
+  disable --toolbox <box-id> <tool-id>...  Disable one or more tools
+
+Options:
+  -bd, --biz-domain <s>   Business domain (default: bd_public)
+  --pretty                Pretty-print JSON (default)
+  --compact               Single-line JSON (pipeline-friendly)`;
+export async function runToolCommand(args) {
+    const [subcommand, ...rest] = args;
+    if (!subcommand || subcommand === "--help" || subcommand === "-h") {
+        console.log(HELP);
+        return 0;
+    }
+    const dispatch = () => {
+        if (subcommand === "upload")
+            return runToolUpload(rest);
+        if (subcommand === "list")
+            return runToolList(rest);
+        if (subcommand === "enable")
+            return runToolStatus(rest, "enabled");
+        if (subcommand === "disable")
+            return runToolStatus(rest, "disabled");
+        return Promise.resolve(-1);
+    };
+    try {
+        return await with401RefreshRetry(async () => {
+            const code = await dispatch();
+            if (code === -1) {
+                console.error(`Unknown tool subcommand: ${subcommand}`);
+                return 1;
+            }
+            return code;
+        });
+    }
+    catch (error) {
+        console.error(formatHttpError(error));
+        return 1;
+    }
+}
+export function parseToolUploadArgs(args) {
+    let boxId = "";
+    let filePath = "";
+    let metadataType = "openapi";
+    let businessDomain = "";
+    let pretty = true;
+    for (let i = 0; i < args.length; i += 1) {
+        const a = args[i];
+        if (a === "--toolbox" && args[i + 1]) {
+            boxId = args[++i];
+            continue;
+        }
+        if (a === "--metadata-type" && args[i + 1]) {
+            const val = args[++i];
+            if (val !== "openapi") {
+                throw new Error(`Unsupported --metadata-type: ${val} (only "openapi" is supported)`);
+            }
+            metadataType = val;
+            continue;
+        }
+        if ((a === "-bd" || a === "--biz-domain") && args[i + 1]) {
+            businessDomain = args[++i];
+            continue;
+        }
+        if (a === "--pretty") {
+            pretty = true;
+            continue;
+        }
+        if (a === "--compact") {
+            pretty = false;
+            continue;
+        }
+        if (!a.startsWith("-") && !filePath) {
+            filePath = a;
+            continue;
+        }
+    }
+    if (!boxId)
+        throw new Error("Missing required flag: --toolbox");
+    if (!filePath)
+        throw new Error("Missing required positional argument: <file-path>");
+    if (!businessDomain)
+        businessDomain = resolveBusinessDomain();
+    return { boxId, filePath, metadataType, businessDomain, pretty };
+}
+async function runToolUpload(args) {
+    let opts;
+    try {
+        opts = parseToolUploadArgs(args);
+    }
+    catch (e) {
+        console.error(e instanceof Error ? e.message : String(e));
+        return 1;
+    }
+    try {
+        await access(opts.filePath);
+    }
+    catch {
+        console.error(`File not found: ${opts.filePath}`);
+        return 1;
+    }
+    const token = await ensureValidToken();
+    const body = await uploadTool({
+        baseUrl: token.baseUrl,
+        accessToken: token.accessToken,
+        businessDomain: opts.businessDomain,
+        boxId: opts.boxId,
+        filePath: opts.filePath,
+        metadataType: opts.metadataType,
+    });
+    console.log(formatCallOutput(body, opts.pretty));
+    return 0;
+}
+// ── list ──────────────────────────────────────────────────────────────────────
+async function runToolList(args) {
+    let boxId = "";
+    let businessDomain = "";
+    let pretty = true;
+    for (let i = 0; i < args.length; i += 1) {
+        const a = args[i];
+        if (a === "--toolbox" && args[i + 1]) {
+            boxId = args[++i];
+            continue;
+        }
+        if ((a === "-bd" || a === "--biz-domain") && args[i + 1]) {
+            businessDomain = args[++i];
+            continue;
+        }
+        if (a === "--pretty") {
+            pretty = true;
+            continue;
+        }
+        if (a === "--compact") {
+            pretty = false;
+            continue;
+        }
+    }
+    if (!boxId) {
+        console.error("Missing required flag: --toolbox");
+        return 1;
+    }
+    if (!businessDomain)
+        businessDomain = resolveBusinessDomain();
+    const token = await ensureValidToken();
+    const body = await listTools({
+        baseUrl: token.baseUrl,
+        accessToken: token.accessToken,
+        businessDomain,
+        boxId,
+    });
+    console.log(formatCallOutput(body, pretty));
+    return 0;
+}
+export function parseToolStatusArgs(args, status) {
+    let boxId = "";
+    let businessDomain = "";
+    const toolIds = [];
+    for (let i = 0; i < args.length; i += 1) {
+        const a = args[i];
+        if (a === "--toolbox" && args[i + 1]) {
+            boxId = args[++i];
+            continue;
+        }
+        if ((a === "-bd" || a === "--biz-domain") && args[i + 1]) {
+            businessDomain = args[++i];
+            continue;
+        }
+        if (!a.startsWith("-"))
+            toolIds.push(a);
+    }
+    if (!boxId)
+        throw new Error("Missing required flag: --toolbox");
+    if (toolIds.length === 0)
+        throw new Error("Missing tool id(s)");
+    if (!businessDomain)
+        businessDomain = resolveBusinessDomain();
+    return { boxId, toolIds, status, businessDomain };
+}
+async function runToolStatus(args, status) {
+    let opts;
+    try {
+        opts = parseToolStatusArgs(args, status);
+    }
+    catch (e) {
+        console.error(e instanceof Error ? e.message : String(e));
+        return 1;
+    }
+    const token = await ensureValidToken();
+    await setToolStatuses({
+        baseUrl: token.baseUrl,
+        accessToken: token.accessToken,
+        businessDomain: opts.businessDomain,
+        boxId: opts.boxId,
+        updates: opts.toolIds.map((toolId) => ({ toolId, status: opts.status })),
+    });
+    console.error(`${status === "enabled" ? "Enabled" : "Disabled"} ${opts.toolIds.length} tool(s) in toolbox ${opts.boxId}`);
+    return 0;
+}

package/dist/commands/toolbox.d.ts

@@ -0,0 +1,14 @@
+export declare function runToolboxCommand(args: string[]): Promise<number>;
+export interface ToolboxCreateOptions {
+    name: string;
+    serviceUrl: string;
+    description: string;
+    businessDomain: string;
+    pretty: boolean;
+}
+export declare function parseToolboxCreateArgs(args: string[]): ToolboxCreateOptions;
+export interface ToolboxSetStatusOptions {
+    boxId: string;
+    businessDomain: string;
+}
+export declare function parseToolboxSetStatusArgs(args: string[]): ToolboxSetStatusOptions;

package/dist/commands/toolbox.js

@@ -0,0 +1,256 @@
+import { createInterface } from "node:readline";
+import { ensureValidToken, formatHttpError, with401RefreshRetry } from "../auth/oauth.js";
+import { createToolbox, deleteToolbox, listToolboxes, setToolboxStatus } from "../api/toolboxes.js";
+import { formatCallOutput } from "./call.js";
+import { resolveBusinessDomain } from "../config/store.js";
+const HELP = `kweaver toolbox
+
+Subcommands:
+  create --name <n> --service-url <url> [--description <d>]   Create a new toolbox
+  list [--keyword <s>] [--limit <n>] [--offset <n>]           List toolboxes
+  publish <box-id>                                            Publish a toolbox (status=published)
+  unpublish <box-id>                                          Unpublish (status=draft)
+  delete <box-id> [-y|--yes]                                  Delete a toolbox
+
+Options:
+  -bd, --biz-domain <s>   Business domain (default: bd_public)
+  --pretty                Pretty-print JSON (default)
+  --compact               Single-line JSON (pipeline-friendly)`;
+export async function runToolboxCommand(args) {
+    const [subcommand, ...rest] = args;
+    if (!subcommand || subcommand === "--help" || subcommand === "-h") {
+        console.log(HELP);
+        return 0;
+    }
+    const dispatch = () => {
+        if (subcommand === "create")
+            return runToolboxCreate(rest);
+        if (subcommand === "list")
+            return runToolboxList(rest);
+        if (subcommand === "publish")
+            return runToolboxSetStatus(rest, "published");
+        if (subcommand === "unpublish")
+            return runToolboxSetStatus(rest, "draft");
+        if (subcommand === "delete")
+            return runToolboxDelete(rest);
+        return Promise.resolve(-1);
+    };
+    try {
+        return await with401RefreshRetry(async () => {
+            const code = await dispatch();
+            if (code === -1) {
+                console.error(`Unknown toolbox subcommand: ${subcommand}`);
+                return 1;
+            }
+            return code;
+        });
+    }
+    catch (error) {
+        console.error(formatHttpError(error));
+        return 1;
+    }
+}
+export function parseToolboxCreateArgs(args) {
+    let name = "";
+    let serviceUrl = "";
+    let description = "";
+    let businessDomain = "";
+    let pretty = true;
+    for (let i = 0; i < args.length; i += 1) {
+        const a = args[i];
+        if (a === "--name" && args[i + 1]) {
+            name = args[++i];
+            continue;
+        }
+        if (a === "--service-url" && args[i + 1]) {
+            serviceUrl = args[++i];
+            continue;
+        }
+        if (a === "--description" && args[i + 1]) {
+            description = args[++i];
+            continue;
+        }
+        if ((a === "-bd" || a === "--biz-domain") && args[i + 1]) {
+            businessDomain = args[++i];
+            continue;
+        }
+        if (a === "--pretty") {
+            pretty = true;
+            continue;
+        }
+        if (a === "--compact") {
+            pretty = false;
+            continue;
+        }
+    }
+    if (!name)
+        throw new Error("Missing required flag: --name");
+    if (!serviceUrl)
+        throw new Error("Missing required flag: --service-url");
+    if (!businessDomain)
+        businessDomain = resolveBusinessDomain();
+    return { name, serviceUrl, description, businessDomain, pretty };
+}
+async function runToolboxCreate(args) {
+    let opts;
+    try {
+        opts = parseToolboxCreateArgs(args);
+    }
+    catch (e) {
+        console.error(e instanceof Error ? e.message : String(e));
+        return 1;
+    }
+    const token = await ensureValidToken();
+    const body = await createToolbox({
+        baseUrl: token.baseUrl,
+        accessToken: token.accessToken,
+        name: opts.name,
+        description: opts.description,
+        serviceUrl: opts.serviceUrl,
+        businessDomain: opts.businessDomain,
+    });
+    console.log(formatCallOutput(body, opts.pretty));
+    return 0;
+}
+// ── list ──────────────────────────────────────────────────────────────────────
+async function runToolboxList(args) {
+    let keyword;
+    let limit;
+    let offset;
+    let businessDomain = "";
+    let pretty = true;
+    for (let i = 0; i < args.length; i += 1) {
+        const a = args[i];
+        if (a === "--keyword" && args[i + 1]) {
+            keyword = args[++i];
+            continue;
+        }
+        if (a === "--limit" && args[i + 1]) {
+            const n = parseInt(args[++i], 10);
+            if (Number.isNaN(n)) {
+                console.error("--limit must be a number");
+                return 1;
+            }
+            limit = n;
+            continue;
+        }
+        if (a === "--offset" && args[i + 1]) {
+            const n = parseInt(args[++i], 10);
+            if (Number.isNaN(n)) {
+                console.error("--offset must be a number");
+                return 1;
+            }
+            offset = n;
+            continue;
+        }
+        if ((a === "-bd" || a === "--biz-domain") && args[i + 1]) {
+            businessDomain = args[++i];
+            continue;
+        }
+        if (a === "--pretty") {
+            pretty = true;
+            continue;
+        }
+        if (a === "--compact") {
+            pretty = false;
+            continue;
+        }
+    }
+    if (!businessDomain)
+        businessDomain = resolveBusinessDomain();
+    const token = await ensureValidToken();
+    const body = await listToolboxes({
+        baseUrl: token.baseUrl,
+        accessToken: token.accessToken,
+        businessDomain,
+        keyword, limit, offset,
+    });
+    console.log(formatCallOutput(body, pretty));
+    return 0;
+}
+export function parseToolboxSetStatusArgs(args) {
+    let boxId = "";
+    let businessDomain = "";
+    for (let i = 0; i < args.length; i += 1) {
+        const a = args[i];
+        if ((a === "-bd" || a === "--biz-domain") && args[i + 1]) {
+            businessDomain = args[++i];
+            continue;
+        }
+        if (!a.startsWith("-"))
+            boxId = a;
+    }
+    if (!boxId)
+        throw new Error("Missing required argument: <box-id>");
+    if (!businessDomain)
+        businessDomain = resolveBusinessDomain();
+    return { boxId, businessDomain };
+}
+async function runToolboxSetStatus(args, status) {
+    let opts;
+    try {
+        opts = parseToolboxSetStatusArgs(args);
+    }
+    catch (e) {
+        console.error(`Usage: kweaver toolbox ${status === "published" ? "publish" : "unpublish"} <box-id>`);
+        return 1;
+    }
+    const token = await ensureValidToken();
+    await setToolboxStatus({
+        baseUrl: token.baseUrl,
+        accessToken: token.accessToken,
+        businessDomain: opts.businessDomain,
+        boxId: opts.boxId,
+        status,
+    });
+    console.error(`${status === "published" ? "Published" : "Unpublished"} toolbox ${opts.boxId}`);
+    return 0;
+}
+// ── delete ────────────────────────────────────────────────────────────────────
+function confirmYes(prompt) {
+    return new Promise((resolve) => {
+        const rl = createInterface({ input: process.stdin, output: process.stdout });
+        rl.question(`${prompt} [y/N] `, (answer) => {
+            rl.close();
+            const t = answer.trim().toLowerCase();
+            resolve(t === "y" || t === "yes");
+        });
+    });
+}
+async function runToolboxDelete(args) {
+    let boxId = "";
+    let yes = false;
+    let businessDomain = "";
+    for (let i = 0; i < args.length; i += 1) {
+        const a = args[i];
+        if (a === "--yes" || a === "-y")
+            yes = true;
+        else if ((a === "-bd" || a === "--biz-domain") && args[i + 1]) {
+            businessDomain = args[++i];
+        }
+        else if (!a.startsWith("-"))
+            boxId = a;
+    }
+    if (!boxId) {
+        console.error("Usage: kweaver toolbox delete <box-id> [-y|--yes]");
+        return 1;
+    }
+    if (!yes) {
+        const ok = await confirmYes(`Delete toolbox ${boxId}?`);
+        if (!ok) {
+            console.error("Aborted.");
+            return 1;
+        }
+    }
+    if (!businessDomain)
+        businessDomain = resolveBusinessDomain();
+    const token = await ensureValidToken();
+    await deleteToolbox({
+        baseUrl: token.baseUrl,
+        accessToken: token.accessToken,
+        businessDomain,
+        boxId,
+    });
+    console.error(`Deleted toolbox ${boxId}`);
+    return 0;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kweaver-ai/kweaver-sdk",
-  "version": "0.6.4",
+  "version": "0.6.5",
   "description": "KWeaver TypeScript SDK — CLI tool and programmatic API for knowledge networks and Decision Agents.",
   "type": "module",
   "main": "./dist/index.js",