@paybond/kit 0.9.8 → 0.10.0

package/dist/cli/commands/setup.js

@@ -0,0 +1,397 @@
+import { mkdir, readFile } from "node:fs/promises";
+import path from "node:path";
+import { readJsonBody } from "../automation.js";
+import { listConfigEntries, resolveConfigValue, setConfigValue, unsetConfigValue } from "../config.js";
+import { commandPath, withGateway } from "../context.js";
+import { assertApiKeyShape, resolveApiKey, resolvedDefaultsForDoctor } from "../credentials.js";
+import { packageVersion, runAgentMcpChecks } from "../doctor-agent.js";
+import { consumeBooleanFlag, consumeFlag } from "../globals.js";
+import { maskApiKey, redactConfigValue } from "../redact.js";
+import { mergeMcpToolPolicy, parseMcpToolAllowlist, parseMcpToolPolicy, } from "../mcp-policy.js";
+import { parseMcpInstallFormat, parseMcpInstallHost, parseMcpInstallScope, planMcpInstall, } from "../mcp-install.js";
+import { verifyMcpInstallPlan } from "../mcp-verify-config.js";
+import { buildSupportDiagnostics, formatSupportDiagnosticsTable } from "../support-diagnostics.js";
+import { CliError } from "../types.js";
+import { main as runInitMain } from "../../init.js";
+import { parseArgs as parseLoginArgs, runLogin } from "../../login.js";
+import { main as runMcpServerMain } from "../../mcp-server.js";
+import { PaybondMCPServer } from "../../mcp-server.js";
+async function readJsonFile(filePath) {
+    return readJsonBody(filePath, process.stdin);
+}
+function loginResultData(result) {
+    const data = {
+        env_file: result.envPath,
+        key_masked: result.keyMasked,
+        key_written: result.keyWritten,
+        environment: result.environment,
+        tenant_id: result.tenantId,
+        tenant_uuid: result.tenantUuid,
+        verification_uri: result.verificationUri,
+        user_code: result.userCode,
+    };
+    if (result.expiresAt) {
+        data.expires_at = result.expiresAt;
+    }
+    return data;
+}
+export async function handleLogin(ctx, argv) {
+    if (argv[0] === "--help" || argv[0] === "-h") {
+        throw new CliError("help", { category: "usage", code: "cli.help" });
+    }
+    let parsed;
+    try {
+        parsed = parseLoginArgs(["login", ...argv]);
+    }
+    catch (err) {
+        throw new CliError(err instanceof Error ? err.message : String(err), {
+            category: "validation",
+            code: "cli.login.rejected",
+        });
+    }
+    if (parsed === "help") {
+        throw new CliError("help", { category: "usage", code: "cli.help" });
+    }
+    const options = {
+        ...parsed,
+        gateway: ctx.globals.gateway,
+        envFile: ctx.globals.envFile,
+        noOpen: ctx.globals.noOpen,
+    };
+    let result;
+    try {
+        result = await runLogin(options, {
+            cwd: ctx.cwd,
+            fetch: ctx.fetch,
+            humanOutput: ctx.globals.format !== "json",
+            stdout: {
+                write(chunk) {
+                    ctx.stdout.write(chunk);
+                    return true;
+                },
+            },
+            stderr: {
+                write(chunk) {
+                    ctx.stderr.write(chunk);
+                    return true;
+                },
+            },
+            sleep: ctx.deps.sleep,
+            openBrowser: ctx.deps.openBrowser,
+            now: ctx.deps.now,
+        });
+    }
+    catch (err) {
+        throw new CliError(err instanceof Error ? err.message : String(err), {
+            category: "validation",
+            code: "cli.login.failed",
+        });
+    }
+    return { data: loginResultData(result) };
+}
+export async function handleInitGuardrail(ctx, argv) {
+    const code = await runInitMain(argv);
+    if (code !== 0) {
+        throw new CliError("init guardrail failed", { category: "validation", code: "cli.init.failed", exitCode: code });
+    }
+    const outFlag = consumeFlag(argv, "--out");
+    const frameworkFlag = consumeFlag(argv, "--framework");
+    const presetFlag = consumeFlag(argv, "--preset");
+    return {
+        data: {
+            out: outFlag.value ?? "paybond-paid-tool-guard.ts",
+            preset: presetFlag.value ?? "paid-tool-guard",
+            framework: frameworkFlag.value ?? "provider-agnostic",
+            bytes_written: true,
+        },
+    };
+}
+export async function handleMcpServe(ctx, argv) {
+    if (argv.length > 0 && argv[0] !== "--help" && argv[0] !== "-h") {
+        throw new CliError(`unexpected arguments: ${argv.join(" ")}`, { category: "usage", code: "cli.usage.unexpected_args" });
+    }
+    ctx.stderr.write("Starting Paybond MCP stdio server (stdout is reserved for MCP JSON-RPC).\n");
+    const code = runMcpServerMain([]);
+    if (code !== 0) {
+        throw new CliError("mcp serve failed", { category: "internal", code: "cli.mcp.serve_failed", exitCode: code });
+    }
+    return { data: { started: true } };
+}
+export async function handleMcpTools(ctx) {
+    const server = new PaybondMCPServer({ gatewayBaseUrl: ctx.globals.gateway, apiKey: "paybond_sk_sandbox_redacted_redacted_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" });
+    const tools = server.listTools().map((tool) => ({
+        name: tool.name,
+        title: tool.title ?? tool.name,
+        description: tool.description,
+    }));
+    return { data: { tools } };
+}
+export async function handleMcpInstall(ctx, argv) {
+    const hostFlag = consumeFlag(argv, "--host");
+    const formatFlag = consumeFlag(argv, "--format");
+    const scopeFlag = consumeFlag(argv, "--scope");
+    const outFlag = consumeFlag(argv, "--out");
+    const envFileFlag = consumeFlag(argv, "--env-file");
+    const toolPolicyFlag = consumeFlag(argv, "--tool-policy");
+    const toolAllowlistFlag = consumeFlag(argv, "--tool-allowlist");
+    let format;
+    let scope;
+    let installHost;
+    let toolPolicy;
+    try {
+        installHost = parseMcpInstallHost(hostFlag.value);
+        format = parseMcpInstallFormat(formatFlag.value, installHost);
+        scope = parseMcpInstallScope(scopeFlag.value);
+        toolPolicy = mergeMcpToolPolicy(parseMcpToolPolicy(toolPolicyFlag.value), parseMcpToolAllowlist(toolAllowlistFlag.value));
+    }
+    catch (err) {
+        throw new CliError(err instanceof Error ? err.message : String(err), {
+            category: "usage",
+            code: "cli.usage.invalid_mcp_install",
+        });
+    }
+    const plan = planMcpInstall({
+        host: installHost,
+        scope,
+        format,
+        envFile: envFileFlag.value ?? ctx.globals.envFile,
+        out: outFlag.value,
+        cwd: ctx.cwd,
+        home: process.env.HOME ?? process.env.USERPROFILE ?? ctx.cwd,
+        toolPolicy: toolPolicy.policy ? toolPolicy : null,
+    });
+    if (plan.printed) {
+        if (ctx.globals.format !== "json") {
+            ctx.stdout.write(plan.payload);
+        }
+    }
+    else {
+        const configPath = plan.configPath;
+        await mkdir(path.dirname(configPath), { recursive: true });
+        const { writeAtomicFileAsync } = await import("../automation.js");
+        await writeAtomicFileAsync(configPath, plan.payload, 0o600);
+    }
+    const data = {
+        host: plan.host,
+        scope: plan.scope,
+        format: plan.format,
+        config_path: plan.configPath,
+        server_command: plan.serverCommand.join(" "),
+        printed: plan.printed,
+    };
+    if (plan.toolPolicy?.policy) {
+        data.tool_policy = plan.toolPolicy.policy;
+        if (plan.toolPolicy.allowlist.length > 0) {
+            data.tool_allowlist = [...plan.toolPolicy.allowlist];
+        }
+    }
+    if (plan.printed && ctx.globals.format === "json") {
+        data.payload = plan.payload;
+    }
+    return { data };
+}
+export async function handleMcpVerifyConfig(ctx, argv) {
+    const hostFlag = consumeFlag(argv, "--host");
+    const formatFlag = consumeFlag(argv, "--format");
+    const envFileFlag = consumeFlag(argv, "--env-file");
+    const configFlag = consumeFlag(argv, "--config");
+    let installHost;
+    let format;
+    try {
+        installHost = parseMcpInstallHost(hostFlag.value);
+        format = parseMcpInstallFormat(formatFlag.value, installHost);
+    }
+    catch (err) {
+        throw new CliError(err instanceof Error ? err.message : String(err), {
+            category: "usage",
+            code: "cli.usage.invalid_mcp_verify_config",
+        });
+    }
+    const result = await verifyMcpInstallPlan({
+        host: installHost,
+        format,
+        envFile: envFileFlag.value ?? ctx.globals.envFile,
+        cwd: ctx.cwd,
+        home: process.env.HOME ?? process.env.USERPROFILE ?? ctx.cwd,
+        configPath: configFlag.value,
+    });
+    return {
+        data: {
+            ok: result.ok,
+            host: result.host,
+            source: result.source,
+            config_path: result.configPath,
+            message: result.message,
+            issues: result.issues,
+            tool_policy: result.toolPolicy?.policy ?? null,
+        },
+    };
+}
+export async function handleDoctor(ctx, argv) {
+    const agentFlag = consumeBooleanFlag(argv, "--agent");
+    const hostFlag = consumeFlag(agentFlag.rest, "--host");
+    const checks = [];
+    const defaults = resolvedDefaultsForDoctor(ctx.globals);
+    checks.push({
+        name: "runtime",
+        ok: true,
+        message: `node ${process.version}`,
+    });
+    checks.push({
+        name: "package",
+        ok: true,
+        message: "@paybond/kit",
+        details: { version: packageVersion() },
+    });
+    const envPath = path.isAbsolute(defaults.envFile)
+        ? path.resolve(defaults.envFile)
+        : path.resolve(ctx.cwd, defaults.envFile);
+    try {
+        await readFile(envPath, "utf8");
+        checks.push({ name: "env_file", ok: true, message: envPath });
+    }
+    catch {
+        checks.push({ name: "env_file", ok: false, message: `env file not found: ${envPath}` });
+    }
+    let apiKey = "";
+    try {
+        apiKey = await resolveApiKey(ctx.globals, ctx.cwd);
+        assertApiKeyShape(apiKey);
+        checks.push({ name: "key_shape", ok: true, message: maskApiKey(apiKey) });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        checks.push({ name: "key_shape", ok: false, message });
+    }
+    if (apiKey) {
+        try {
+            await withGateway(ctx, async (gateway) => {
+                await gateway.getJson("/v1/auth/principal");
+                return { data: {} };
+            });
+            checks.push({ name: "principal", ok: true, message: "principal lookup succeeded" });
+        }
+        catch (err) {
+            checks.push({
+                name: "principal",
+                ok: false,
+                message: err instanceof Error ? err.message : String(err),
+            });
+        }
+    }
+    if (agentFlag.present) {
+        if (!apiKey) {
+            for (const name of [
+                "mcp_host_config",
+                "mcp_env_resolution",
+                "mcp_launch",
+                "mcp_initialize",
+                "mcp_tools_list",
+                "mcp_tool_schemas",
+                "mcp_stdout_purity",
+            ]) {
+                checks.push({ name, ok: false, message: "skipped MCP probe (missing API key)" });
+            }
+        }
+        else {
+            const agentChecks = await runAgentMcpChecks({
+                envFile: defaults.envFile,
+                cwd: ctx.cwd,
+                host: hostFlag.value ?? "generic",
+            });
+            checks.push(...agentChecks);
+        }
+    }
+    const summary = checks.every((check) => check.ok) ? "pass" : "fail";
+    return { data: { checks, summary } };
+}
+export async function handleConfig(ctx, subcommand, argv) {
+    if (subcommand === "list") {
+        const entries = await listConfigEntries(ctx.globals.profile);
+        return { data: { entries } };
+    }
+    if (subcommand === "get") {
+        const key = argv[0];
+        if (!key) {
+            throw new CliError("config get requires <key>", { category: "usage", code: "cli.usage.missing_key" });
+        }
+        const value = await resolveConfigValue(key, ctx.globals.profile);
+        if (value === undefined) {
+            throw new CliError(`config key not found: ${key}`, { category: "not_found", code: "cli.config.not_found" });
+        }
+        return { data: { key, value: redactConfigValue(key, value) } };
+    }
+    if (subcommand === "set") {
+        const key = argv[0];
+        const value = argv[1];
+        if (!key || value === undefined) {
+            throw new CliError("config set requires <key> <value>", { category: "usage", code: "cli.usage.missing_args" });
+        }
+        await setConfigValue(key, value, ctx.globals.profile);
+        return { data: { key, set: true } };
+    }
+    if (subcommand === "unset") {
+        const key = argv[0];
+        if (!key) {
+            throw new CliError("config unset requires <key>", { category: "usage", code: "cli.usage.missing_key" });
+        }
+        const removed = await unsetConfigValue(key, ctx.globals.profile);
+        return { data: { key, removed } };
+    }
+    throw new CliError(`unknown config subcommand: ${subcommand}`, { category: "usage", code: "cli.usage.unknown_command" });
+}
+export async function handleWhoami(ctx) {
+    return withGateway(ctx, async (gateway) => {
+        const principal = await gateway.getJson("/v1/auth/principal");
+        const stripped = { ...principal };
+        delete stripped.access_token;
+        delete stripped.refresh_token;
+        return {
+            data: {
+                tenant_id: String(principal.tenant_id ?? ""),
+                tenant_uuid: String(principal.tenant_uuid ?? ""),
+                environment: String(principal.environment ?? ""),
+                service_account_role: String(principal.service_account_role ?? ""),
+                principal: stripped,
+            },
+        };
+    });
+}
+export async function handleVersion(ctx, argv) {
+    const verboseFlag = consumeBooleanFlag(argv, "--verbose");
+    if (verboseFlag.rest.length > 0) {
+        throw new CliError(`unexpected arguments: ${verboseFlag.rest.join(" ")}`, {
+            category: "usage",
+            code: "cli.usage.unexpected_args",
+        });
+    }
+    if (verboseFlag.present) {
+        const diagnostics = await buildSupportDiagnostics(ctx);
+        return { data: diagnostics };
+    }
+    return { data: { version: packageVersion() } };
+}
+export async function handleDiagnose(ctx, argv) {
+    const redactedFlag = consumeBooleanFlag(argv, "--redacted");
+    if (redactedFlag.rest.length > 0) {
+        throw new CliError(`unexpected arguments: ${redactedFlag.rest.join(" ")}`, {
+            category: "usage",
+            code: "cli.usage.unexpected_args",
+        });
+    }
+    if (!redactedFlag.present) {
+        throw new CliError("paybond diagnose requires --redacted for support bundles", {
+            category: "usage",
+            code: "cli.diagnose.redacted_required",
+        });
+    }
+    const diagnostics = await buildSupportDiagnostics(ctx);
+    return {
+        data: {
+            redacted: true,
+            diagnostics,
+            lines: formatSupportDiagnosticsTable(diagnostics),
+        },
+    };
+}
+export { readJsonFile, commandPath };

package/dist/cli/commands/workflows.d.ts

@@ -0,0 +1,7 @@
+import { commandPath, type CliContext } from "../context.js";
+import { type CommandResult } from "../types.js";
+export declare function handleKeys(ctx: CliContext, subcommand: string, argv: string[]): Promise<CommandResult>;
+export declare function handleIntents(ctx: CliContext, subcommand: string, argv: string[]): Promise<CommandResult>;
+export declare function handleGuardrails(ctx: CliContext, subcommand: string, argv: string[]): Promise<CommandResult>;
+export declare function handleSpendAuthorize(ctx: CliContext, argv: string[]): Promise<CommandResult>;
+export { commandPath };

package/dist/cli/commands/workflows.js

@@ -0,0 +1,209 @@
+import { resolveJsonBody } from "../body.js";
+import { buildListQueryParams, extractNextCursor, partialResultsWarning, } from "../automation.js";
+import { commandPath, requireConfirmation, withGateway } from "../context.js";
+import { consumeFlag, parseOptionalNonNegativeInt, parseRequiredNonNegativeInt } from "../globals.js";
+import { maskApiKey, redactSensitiveFields } from "../redact.js";
+import { CliError } from "../types.js";
+export async function handleKeys(ctx, subcommand, argv) {
+    return withGateway(ctx, async (gateway) => {
+        if (subcommand === "list") {
+            const limitFlag = consumeFlag(argv, "--limit");
+            const cursorFlag = consumeFlag(argv, "--cursor");
+            const params = buildListQueryParams(limitFlag.value, cursorFlag.value, { limit: "50" });
+            const body = await gateway.getJson(`/v1/admin/api-keys?${params.toString()}`);
+            const items = Array.isArray(body.items) ? body.items : [];
+            const keys = items.map((item) => {
+                const row = item;
+                return {
+                    key_id: String(row.key_id ?? row.id ?? ""),
+                    key_masked: maskApiKey(`paybond_sk_${String(row.environment ?? "sandbox")}_${String(row.key_id ?? "redacted")}_redacted`),
+                    role: String(row.service_account_role ?? ""),
+                    created_at: String(row.created_at ?? ""),
+                    expires_at: row.expires_at ? String(row.expires_at) : null,
+                    status: row.revoked_at ? "revoked" : "active",
+                };
+            });
+            const nextCursor = extractNextCursor(body);
+            const warnings = partialResultsWarning(nextCursor) ? [partialResultsWarning(nextCursor)] : undefined;
+            const data = { keys };
+            if (nextCursor) {
+                data.next_cursor = nextCursor;
+            }
+            return { data, warnings };
+        }
+        if (subcommand === "create") {
+            const nameFlag = consumeFlag(argv, "--name");
+            const roleFlag = consumeFlag(argv, "--role");
+            const labelFlag = consumeFlag(argv, "--label");
+            if (!nameFlag.value || !roleFlag.value) {
+                throw new CliError("keys create requires --name and --role", { category: "usage", code: "cli.usage.missing_args" });
+            }
+            const body = await gateway.postJson("/v1/admin/api-keys", {
+                service_account_name: nameFlag.value,
+                service_account_role: roleFlag.value,
+                label: labelFlag.value ?? "",
+            });
+            const item = (body.item ?? {});
+            const rawApiKey = typeof body.api_key === "string" ? body.api_key : "";
+            const data = {
+                key_id: String(item.key_id ?? item.id ?? ""),
+                key_masked: rawApiKey ? maskApiKey(rawApiKey) : maskApiKey(""),
+                role: String(item.service_account_role ?? roleFlag.value),
+                created_at: String(item.created_at ?? ""),
+                status: "active",
+            };
+            if (rawApiKey) {
+                data.api_key = rawApiKey;
+            }
+            return { data };
+        }
+        const keyId = argv[0];
+        if (!keyId) {
+            throw new CliError(`keys ${subcommand} requires <key_id>`, { category: "usage", code: "cli.usage.missing_key_id" });
+        }
+        if (subcommand === "rotate") {
+            requireConfirmation(ctx.globals, "rotate API key");
+            const body = await gateway.postJson(`/v1/admin/api-keys/${encodeURIComponent(keyId)}/rotate`);
+            const item = (body.item ?? {});
+            const rawApiKey = typeof body.api_key === "string" ? body.api_key : "";
+            const data = {
+                key_id: String(item.key_id ?? keyId),
+                key_masked: rawApiKey ? maskApiKey(rawApiKey) : maskApiKey(""),
+                rotated: true,
+            };
+            if (rawApiKey) {
+                data.api_key = rawApiKey;
+            }
+            return { data };
+        }
+        if (subcommand === "revoke") {
+            requireConfirmation(ctx.globals, "revoke API key");
+            await gateway.deleteJson(`/v1/admin/api-keys/${encodeURIComponent(keyId)}`);
+            return { data: { key_id: keyId, revoked: true } };
+        }
+        throw new CliError(`unknown keys subcommand: ${subcommand}`, { category: "usage", code: "cli.usage.unknown_command" });
+    });
+}
+export async function handleIntents(ctx, subcommand, argv) {
+    return withGateway(ctx, async (gateway) => {
+        if (subcommand === "list") {
+            const statusFlag = consumeFlag(argv, "--status");
+            const limitFlag = consumeFlag(argv, "--limit");
+            const cursorFlag = consumeFlag(argv, "--cursor");
+            const params = buildListQueryParams(limitFlag.value, cursorFlag.value);
+            if (statusFlag.value) {
+                params.set("status", statusFlag.value);
+            }
+            const body = await gateway.getJson(`/harbor/operator/v1/intents?${params.toString()}`);
+            const redacted = redactSensitiveFields(body);
+            const nextCursor = extractNextCursor(redacted);
+            const warnings = partialResultsWarning(nextCursor) ? [partialResultsWarning(nextCursor)] : undefined;
+            if (nextCursor && !redacted.next_cursor) {
+                redacted.next_cursor = nextCursor;
+            }
+            return { data: redacted, warnings };
+        }
+        const intentId = argv[0];
+        if (subcommand === "get") {
+            if (!intentId) {
+                throw new CliError("intents get requires <intent_id>", { category: "usage", code: "cli.usage.missing_intent_id" });
+            }
+            const body = await gateway.getJson(`/harbor/operator/v1/intents/${encodeURIComponent(intentId)}`);
+            return { data: redactSensitiveFields(body) };
+        }
+        if (subcommand === "create") {
+            const { payload } = await resolveJsonBody(argv, {
+                missingMessage: "intents create requires --body <json-file> or --stdin",
+            });
+            const body = await gateway.postJson("/harbor/intents", payload);
+            return { data: redactSensitiveFields(body) };
+        }
+        if (!intentId) {
+            throw new CliError(`intents ${subcommand} requires <intent_id>`, { category: "usage", code: "cli.usage.missing_intent_id" });
+        }
+        if (subcommand === "fund") {
+            const { payload } = await resolveJsonBody(argv, { required: false });
+            const body = await gateway.postJson(`/harbor/intents/${encodeURIComponent(intentId)}/fund`, payload);
+            return { data: redactSensitiveFields(body) };
+        }
+        if (subcommand === "evidence") {
+            const { payload } = await resolveJsonBody(argv, {
+                missingMessage: "intents evidence requires --body <json-file> or --stdin",
+            });
+            const body = await gateway.postJson(`/harbor/intents/${encodeURIComponent(intentId)}/evidence`, payload);
+            return { data: redactSensitiveFields(body) };
+        }
+        if (subcommand === "settlement-confirm") {
+            const { payload } = await resolveJsonBody(argv, { required: false });
+            const body = await gateway.postJson(`/harbor/intents/${encodeURIComponent(intentId)}/settlement/confirm`, payload);
+            return { data: redactSensitiveFields(body) };
+        }
+        throw new CliError(`unknown intents subcommand: ${subcommand}`, { category: "usage", code: "cli.usage.unknown_command" });
+    });
+}
+export async function handleGuardrails(ctx, subcommand, argv) {
+    return withGateway(ctx, async (gateway) => {
+        if (subcommand === "bootstrap") {
+            const operationFlag = consumeFlag(argv, "--operation");
+            const spendFlag = consumeFlag(argv, "--requested-spend-cents");
+            if (!operationFlag.value || !spendFlag.value) {
+                throw new CliError("guardrails bootstrap requires --operation and --requested-spend-cents", { category: "usage", code: "cli.usage.missing_args" });
+            }
+            const spendCents = parseRequiredNonNegativeInt(spendFlag.value, "--requested-spend-cents");
+            const body = await gateway.postJson("/v1/sandbox/guardrails/bootstrap", {
+                operation: operationFlag.value,
+                requested_spend_cents: spendCents,
+            });
+            return {
+                data: {
+                    tenant_id: String(body.tenant_id ?? ""),
+                    intent_id: String(body.intent_id ?? ""),
+                    capability_token: String(body.capability_token ?? ""),
+                    operation: String(body.operation ?? operationFlag.value),
+                    requested_spend_cents: Number(body.requested_spend_cents ?? spendCents),
+                    sandbox_lifecycle_status: String(body.sandbox_lifecycle_status ?? ""),
+                },
+            };
+        }
+        if (subcommand === "evidence") {
+            const intentFlag = consumeFlag(argv, "--intent-id");
+            if (!intentFlag.value) {
+                throw new CliError("guardrails evidence requires --intent-id and --body <json-file>", { category: "usage", code: "cli.usage.missing_args" });
+            }
+            const { payload } = await resolveJsonBody(argv, {
+                missingMessage: "guardrails evidence requires --intent-id and --body <json-file> or --stdin",
+            });
+            const body = await gateway.postJson(`/v1/sandbox/guardrails/${encodeURIComponent(intentFlag.value)}/evidence`, payload);
+            return { data: body };
+        }
+        throw new CliError(`unknown guardrails subcommand: ${subcommand}`, { category: "usage", code: "cli.usage.unknown_command" });
+    });
+}
+export async function handleSpendAuthorize(ctx, argv) {
+    return withGateway(ctx, async (gateway) => {
+        const intentFlag = consumeFlag(argv, "--intent-id");
+        const tokenFlag = consumeFlag(argv, "--token");
+        const operationFlag = consumeFlag(argv, "--operation");
+        const spendFlag = consumeFlag(argv, "--requested-spend-cents");
+        if (!intentFlag.value || !tokenFlag.value || !operationFlag.value) {
+            throw new CliError("spend authorize requires --intent-id, --token, and --operation", { category: "usage", code: "cli.usage.missing_args" });
+        }
+        const spendCents = parseOptionalNonNegativeInt(spendFlag.value, "--requested-spend-cents");
+        const body = await gateway.postJson("/verify", {
+            intent_id: intentFlag.value,
+            token: tokenFlag.value,
+            operation: operationFlag.value,
+            requested_spend_cents: spendCents,
+        });
+        return {
+            data: {
+                authorized: Boolean(body.allow),
+                intent_id: String(body.intent_id ?? intentFlag.value),
+                operation: operationFlag.value,
+                requested_spend_cents: spendCents,
+                deny_reason: body.allow ? undefined : String(body.message ?? body.code ?? "denied"),
+            },
+        };
+    });
+}
+export { commandPath };

package/dist/cli/config.d.ts

@@ -0,0 +1,14 @@
+export type CliConfigFile = {
+    profiles?: Record<string, {
+        env_file?: string;
+        gateway?: string;
+    }>;
+    values?: Record<string, string>;
+};
+export declare function configFilePath(): string;
+export declare function loadConfigFile(): Promise<CliConfigFile>;
+export declare function saveConfigFile(config: CliConfigFile): Promise<void>;
+export declare function resolveConfigValue(key: string, profile?: string): Promise<string | undefined>;
+export declare function setConfigValue(key: string, value: string, profile?: string): Promise<void>;
+export declare function unsetConfigValue(key: string, profile?: string): Promise<boolean>;
+export declare function listConfigEntries(profile?: string): Promise<Record<string, string>>;