@tarileo/avileo-catalog-cli 0.3.0 → 0.3.1

package/README.md

@@ -1,11 +1,11 @@
 # @tarileo/avileo-catalog-cli
 
-The Avileo tenant-agent command line interface for a registered `tienda` catalog.
+The Avileo tenant-agent command line interface for a registered business with effective catalog-agent access.
 
 For a first-time human connection, use the temporary device authorization link:
 
 ```sh
-npx --yes @tarileo/avileo-catalog-cli@0.3.0 auth login --json
+npx --yes @tarileo/avileo-catalog-cli@0.3.1 auth login --json
 ```
 
 The CLI prints only the verification URI, user code and status, opens the link
@@ -15,7 +15,15 @@ in the URL. Use `auth status --json` to inspect the source (`environment` or
 `local`) without revealing the key, and `auth logout --json` to remove only the
 local credential; remote revocation remains an Avileo action.
 
-For CI/CD and automated agents, continue injecting `AVILEO_AGENT_API_KEY`.
+If Avileo has already issued an Agent Key, configure it without putting the
+secret in shell history, process arguments or JSON:
+
+```sh
+avileo auth configure --json
+```
+
+The command reads the key without echoing it and stores it locally. For CI/CD
+and automated agents, continue injecting `AVILEO_AGENT_API_KEY`.
 Environment credentials always take priority over the local credential file.
 Never pass an Agent Key through flags, prompts or JSON input.
 
@@ -29,8 +37,16 @@ reference for headers, idempotency, resources and errors.
 
 For operators and AI agents, the recommended sequence is:
 
-1. Run `business show --json`.
-2. Read the exact resource before proposing a change.
-3. Run mutations without `--apply` to review local validation or a diff.
-4. Request explicit approval and repeat with `--apply`.
-5. Use the durable import preview/apply flow for structured supplier lists.
+1. Run `business show --json` to confirm the connected business and actions.
+2. Run `business profile show --json` when evaluating profile completeness.
+3. Read the exact catalog resource before proposing a change.
+4. Run direct mutations without `--apply` to review local validation or a diff.
+5. Add `--apply` to create a proposal; this does not mutate the business.
+6. Ask the human to approve the exact proposal in Avileo, then apply the
+   returned operation or approval ID.
+7. Use the durable import preview/apply flow for structured supplier lists.
+
+Profile updates use a direct JSON object with `business profile update --from
+profile-update.json`. Without `--apply` the command returns a local diff; with
+`--apply` it creates a `business.profile.update` proposal. After approval, run
+`operation apply <id> --json` and re-read the profile.

package/dist/index.js

@@ -14729,18 +14729,19 @@ var AGENT_CAPABILITY_ACTIONS = [
   "assets:read",
   "assets:write",
   "inventory:read",
-  "inventory:write"
+  "inventory:write",
+  "payments:read",
+  "payments:write"
 ];
 var AgentCapabilityActionSchema = external_exports.enum(AGENT_CAPABILITY_ACTIONS);
 var AGENT_KEY_MODES = ["read", "mutate"];
 var AgentKeyModeSchema = external_exports.enum(AGENT_KEY_MODES);
-var AGENT_CATALOG_KEY_PRESET_ACTIONS = [
+var AGENT_KEY_READ_ACTIONS = [
   "business:read",
   "catalog:read",
-  "catalog:write",
   "assets:read",
-  "assets:write",
-  "inventory:read"
+  "inventory:read",
+  "payments:read"
 ];
 var AgentGrantedActionsSchema = external_exports.array(AgentCapabilityActionSchema).min(1).max(AGENT_CAPABILITY_ACTIONS.length).refine((actions) => new Set(actions).size === actions.length, {
   message: "Las capacidades no pueden repetirse"
@@ -15221,9 +15222,91 @@ var AgentOperationApplyEnvelopeSchema = external_exports.object({
   success: external_exports.literal(true),
   data: external_exports.record(external_exports.string(), external_exports.unknown())
 }).strict();
+var AGENT_PAYMENT_LINK_STATUSES = [
+  "awaiting_payment",
+  "verifying",
+  "under_review",
+  "confirmed",
+  "rejected",
+  "expired",
+  "cancelled"
+];
+var AgentPaymentLinkStatusSchema = external_exports.enum(AGENT_PAYMENT_LINK_STATUSES);
+var AGENT_PAYMENT_LINK_EXPECTED_METHODS = [
+  "yape",
+  "plin",
+  "transferencia",
+  "any"
+];
+var AgentPaymentLinkExpectedMethodSchema = external_exports.enum(AGENT_PAYMENT_LINK_EXPECTED_METHODS);
+var AGENT_PAYMENT_LINK_CONFIRMED_BY = ["ai", "gateway", "manual", "platform"];
+var AgentPaymentLinkConfirmedBySchema = external_exports.enum(AGENT_PAYMENT_LINK_CONFIRMED_BY);
+var AgentPaymentLinkExtractionDtoSchema = external_exports.object({
+  provider: external_exports.enum(["yape", "plin", "bbva_transfer", "unknown"]),
+  /** Detected amount in soles (major units), or null when illegible. */
+  detectedAmount: external_exports.number().nonnegative().multipleOf(0.01).nullable(),
+  currency: external_exports.string().length(3).nullable(),
+  operationNumber: external_exports.string().nullable(),
+  paidAt: timestampSchema.nullable(),
+  payerName: external_exports.string().nullable(),
+  recipientName: external_exports.string().nullable(),
+  confidence: external_exports.enum(["high", "medium", "low"]),
+  signals: external_exports.array(external_exports.string())
+}).strict();
+var AgentCreatePaymentLinkInputSchema = external_exports.object({
+  /** Amount in soles (major units); the backend stores amountMinor. */
+  amount: external_exports.number().positive().multipleOf(0.01).max(1e6),
+  currency: external_exports.string().trim().length(3).optional(),
+  concept: nonEmptyTextSchema.max(200).optional(),
+  expectedMethod: AgentPaymentLinkExpectedMethodSchema.optional(),
+  expiresInHours: external_exports.number().int().min(1).max(720).optional(),
+  customerPhone: nonEmptyTextSchema.max(20).optional(),
+  idempotencyKey: nonEmptyTextSchema.max(80).optional()
+}).strict();
+var AgentPaymentLinkBaseDtoSchema = external_exports.object({
+  id: uuidSchema,
+  /** Requested amount in soles (major units). */
+  amount: external_exports.number().positive().multipleOf(0.01),
+  currency: external_exports.string().length(3),
+  concept: external_exports.string().nullable(),
+  expectedMethod: AgentPaymentLinkExpectedMethodSchema,
+  status: AgentPaymentLinkStatusSchema,
+  confirmedBy: AgentPaymentLinkConfirmedBySchema.nullable(),
+  extraction: AgentPaymentLinkExtractionDtoSchema.nullable(),
+  expiresAt: timestampSchema,
+  createdAt: timestampSchema,
+  confirmedAt: timestampSchema.nullable().optional()
+}).strict();
+var AgentPaymentLinkDtoSchema = AgentPaymentLinkBaseDtoSchema.extend({
+  /** Persisted links can never recover the plaintext token URL. */
+  url: external_exports.null()
+}).strict();
+var AgentCreatedPaymentLinkDtoSchema = external_exports.discriminatedUnion("replayed", [
+  AgentPaymentLinkBaseDtoSchema.extend({
+    url: external_exports.string().url(),
+    replayed: external_exports.literal(false)
+  }).strict(),
+  AgentPaymentLinkBaseDtoSchema.extend({
+    url: external_exports.null(),
+    replayed: external_exports.literal(true)
+  }).strict()
+]);
+var isoDateOrTimestampSchema = external_exports.union([
+  external_exports.string().date(),
+  external_exports.string().datetime({ offset: true })
+]);
+var AgentPaymentLinkFilterInputSchema = AgentPaginationInputSchema.extend({
+  status: AgentPaymentLinkStatusSchema.optional(),
+  from: isoDateOrTimestampSchema.optional(),
+  to: isoDateOrTimestampSchema.optional()
+}).strict();
+var AgentPaymentLinkPageSchema = external_exports.object({
+  items: external_exports.array(AgentPaymentLinkDtoSchema),
+  total: external_exports.number().int().nonnegative()
+}).strict();
 var AGENT_DEVICE_AUTH_STATUSES = ["pending", "approved", "denied", "expired"];
 var AGENT_DEVICE_AUTH_DEFAULT_PERMISSIONS = [
-  ...AGENT_CATALOG_KEY_PRESET_ACTIONS
+  ...AGENT_KEY_READ_ACTIONS
 ];
 function parsePollResponse(value) {
   if (!AGENT_DEVICE_AUTH_STATUSES.includes(value.status)) {
@@ -15540,6 +15623,32 @@ var AgentOperationsResource = class {
     });
   }
 };
+var AgentPaymentLinksResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  /**
+   * Creates a payment link. `amount` is in soles (major units); the backend
+   * converts it to minor units — never convert it here. The URL is only
+   * non-null for the initial create response.
+   */
+  create(input) {
+    return this.http.request("/api/v1/agent/payment-links", {
+      method: "POST",
+      body: input,
+      mutation: true
+    }).then((response) => AgentCreatedPaymentLinkDtoSchema.parse(response));
+  }
+  /** Fetches a persisted link; `url` is always `null`. */
+  get(paymentLinkId) {
+    return this.http.request(`/api/v1/agent/payment-links/${encodeURIComponent(paymentLinkId)}`).then((response) => AgentPaymentLinkDtoSchema.parse(response));
+  }
+  /** Lists persisted links; every item has `url: null`. */
+  list(filter = {}) {
+    return this.http.request(`/api/v1/agent/payment-links${queryString(filter)}`).then((response) => AgentPaymentLinkPageSchema.parse(response));
+  }
+};
 function createAvileoAgent(config2) {
   const http = new AgentHttpClient(config2);
   return {
@@ -15551,7 +15660,8 @@ function createAvileoAgent(config2) {
     tags: new AgentTagsResource(http),
     assets: new AgentAssetsResource(http),
     inventory: new AgentInventoryResource(http),
-    imports: new AgentImportsResource(http)
+    imports: new AgentImportsResource(http),
+    paymentLinks: new AgentPaymentLinksResource(http)
   };
 }
 
@@ -15720,34 +15830,8 @@ function redact(value) {
   return value;
 }
 
-// src/commands/business.ts
-function registerBusinessCommands(root, getClient) {
-  const business = root.command("business").description("Consulta el negocio vinculado a la clave agente");
-  business.command("show").description("Muestra las capacidades seguras del negocio").action(async () => {
-    emitSuccess(await getClient().business.get());
-  });
-}
-
-// src/commands/catalog.ts
-import { createHash } from "crypto";
-import { readFile, stat } from "fs/promises";
-import { basename, extname } from "path";
-function requireId(value, name) {
-  if (!value.trim()) throw new CliProtocolError("CLI_VALIDATION_ERROR", `${name} es obligatorio`);
-  return value;
-}
-async function readMutationInput(path) {
-  let parsed;
-  try {
-    parsed = JSON.parse(await readFile(path, "utf8"));
-  } catch {
-    throw new CliProtocolError("CLI_INPUT_ERROR", "No se pudo leer un objeto JSON desde --from");
-  }
-  if (!parsed || Array.isArray(parsed) || typeof parsed !== "object") {
-    throw new CliProtocolError("CLI_VALIDATION_ERROR", "--from debe contener un objeto JSON");
-  }
-  return normalizeInput(parsed);
-}
+// src/commands/mutation.ts
+import { readFile } from "fs/promises";
 function normalizeInput(value) {
   const forbidden = {
     businessId: true,
@@ -15770,12 +15854,17 @@ function normalizeInput(value) {
   };
   return visit(value);
 }
-function withMutationOptions(command, includeFrom = true) {
-  if (includeFrom) command.requiredOption("--from <json-file>", "Objeto JSON estructurado");
-  return command.option("--apply", "Solicita aprobaci\xF3n o ejecuta una mutaci\xF3n aprobada").option("--approval-id <uuid>", "Aprobaci\xF3n emitida por Avileo");
-}
-function wantsApply(command) {
-  return Boolean(command.optsWithGlobals().apply);
+async function readMutationInput(path) {
+  let parsed;
+  try {
+    parsed = JSON.parse(await readFile(path, "utf8"));
+  } catch {
+    throw new CliProtocolError("CLI_INPUT_ERROR", "No se pudo leer un objeto JSON desde --from");
+  }
+  if (!parsed || Array.isArray(parsed) || typeof parsed !== "object") {
+    throw new CliProtocolError("CLI_VALIDATION_ERROR", "--from debe contener un objeto JSON");
+  }
+  return normalizeInput(parsed);
 }
 function localResult(input, current) {
   if (current === void 0) return { validated: "local", input };
@@ -15785,6 +15874,53 @@ function localResult(input, current) {
   );
   return { validated: "local", current, changes };
 }
+
+// src/commands/business.ts
+function profileValues(profile) {
+  const values = profile.values;
+  if (!values || Array.isArray(values) || typeof values !== "object") return {};
+  return values;
+}
+function registerBusinessCommands(root, getClient) {
+  const business = root.command("business").description("Consulta el negocio vinculado a la clave agente");
+  business.command("show").description("Muestra las capacidades seguras del negocio").action(async () => {
+    emitSuccess(await getClient().business.get());
+  });
+  const profile = business.command("profile").description("Consulta o propone cambios al perfil del negocio");
+  profile.command("show").description("Muestra campos, valores y completitud del perfil").action(async () => {
+    emitSuccess(await getClient().business.profile());
+  });
+  profile.command("update").description("Previsualiza o propone cambios al perfil").requiredOption("--from <json-file>", "Valores de perfil en un objeto JSON").option("--apply", "Crea una propuesta para aprobaci\xF3n en Avileo").action(async (options, command) => {
+    const values = await readMutationInput(options.from);
+    if (!command.optsWithGlobals().apply) {
+      const current = await getClient().business.profile();
+      emitSuccess(localResult(values, profileValues(current)));
+      return;
+    }
+    emitSuccess(
+      await getClient().operations.propose({
+        operationName: "business.profile.update",
+        payload: { values }
+      })
+    );
+  });
+}
+
+// src/commands/catalog.ts
+import { createHash } from "crypto";
+import { readFile as readFile2, stat } from "fs/promises";
+import { basename, extname } from "path";
+function requireId(value, name) {
+  if (!value.trim()) throw new CliProtocolError("CLI_VALIDATION_ERROR", `${name} es obligatorio`);
+  return value;
+}
+function withMutationOptions(command, includeFrom = true) {
+  if (includeFrom) command.requiredOption("--from <json-file>", "Objeto JSON estructurado");
+  return command.option("--apply", "Solicita aprobaci\xF3n o ejecuta una mutaci\xF3n aprobada").option("--approval-id <uuid>", "Aprobaci\xF3n emitida por Avileo");
+}
+function wantsApply(command) {
+  return Boolean(command.optsWithGlobals().apply);
+}
 function addListOptions(command) {
   return command.option("--search <text>").option("--category-id <id>").option("--active <true|false>", "Filtra por estado activo", parseBoolean).option("--limit <number>", "M\xE1ximo de resultados", parseInteger).option("--offset <number>", "Desplazamiento", parseInteger);
 }
@@ -16071,7 +16207,7 @@ function registerAssetCommands(catalog, getClient) {
         "Solo se permiten im\xE1genes JPEG, PNG o WebP"
       );
     }
-    const contents = await readFile(filePath);
+    const contents = await readFile2(filePath);
     const file2 = new File([contents], basename(filePath), { type: mimeType });
     const rawApprovalId = command.optsWithGlobals().approvalId;
     if (typeof rawApprovalId === "string") {
@@ -16212,6 +16348,57 @@ function safeFinalResult(start, browserOpened, result) {
 function sleep(milliseconds) {
   return new Promise((resolve) => setTimeout(resolve, milliseconds));
 }
+function readAgentKeyFromTty(prompt = "Agent Key de Avileo: ") {
+  if (!process.stdin.isTTY || !process.stderr.isTTY) {
+    throw new CliProtocolError(
+      "CLI_CONFIGURATION_ERROR",
+      "auth configure requiere una terminal interactiva; usa AVILEO_AGENT_API_KEY en CI/CD"
+    );
+  }
+  return new Promise((resolve, reject) => {
+    let value = "";
+    const input = process.stdin;
+    const output = process.stderr;
+    const wasRaw = input.isRaw;
+    const cleanup = () => {
+      input.removeListener("data", onData);
+      input.pause();
+      if (wasRaw !== void 0) input.setRawMode(Boolean(wasRaw));
+    };
+    const finish = (result) => {
+      cleanup();
+      output.write("\n");
+      if (result instanceof Error) reject(result);
+      else resolve(result);
+    };
+    const onData = (chunk) => {
+      for (const character of String(chunk)) {
+        if (character === "") {
+          finish(
+            new CliProtocolError(
+              "CLI_CONFIGURATION_ERROR",
+              "Configuraci\xF3n cancelada por el usuario"
+            )
+          );
+          return;
+        }
+        if (character === "\r" || character === "\n") {
+          finish(value);
+          return;
+        }
+        if (character === "\x7F" || character === "\b") {
+          value = value.slice(0, -1);
+          continue;
+        }
+        value += character;
+      }
+    };
+    output.write(prompt);
+    input.setRawMode(true);
+    input.resume();
+    input.on("data", onData);
+  });
+}
 async function openWithExecutable(command, args) {
   return new Promise((resolve) => {
     const child = spawn(command, args, { stdio: "ignore", shell: false, detached: true });
@@ -16279,6 +16466,21 @@ async function login(options) {
   }
   throw new CliProtocolError("CLI_AUTH_TIMEOUT", "La autorizaci\xF3n expir\xF3 antes de ser aprobada");
 }
+async function configure(options) {
+  const apiKey = await options.readSecret("Agent Key de Avileo (no se mostrar\xE1): ");
+  saveLocalCredential(
+    {
+      apiKey,
+      ...options.env.AVILEO_AGENT_BASE_URL?.trim() ? { baseUrl: options.env.AVILEO_AGENT_BASE_URL.trim() } : {}
+    },
+    options.env
+  );
+  emitSuccess({
+    configured: true,
+    source: "local",
+    credentialPath: localCredentialPath(options.env)
+  });
+}
 async function status(options) {
   const credential = resolveCredential(options.env);
   if (!credential) {
@@ -16290,7 +16492,7 @@ async function status(options) {
   try {
     business = await options.getClient().business.get();
   } catch (error51) {
-    const code = error51.code;
+    const code = error51 && typeof error51 === "object" && "code" in error51 ? error51.code : void 0;
     businessLookupError = typeof code === "string" ? code : "LOOKUP_FAILED";
   }
   emitSuccess({
@@ -16312,6 +16514,7 @@ async function logout(options) {
 }
 function registerAuthCommands(root, options) {
   const auth = root.command("auth").description("Conecta la CLI con Avileo sin copiar claves en el chat");
+  auth.command("configure").description("Guarda una Agent Key existente sin mostrarla en pantalla").action(() => configure(options));
   auth.command("login").description("Autoriza esta CLI mediante un link temporal").action(() => login(options));
   auth.command("status").description("Muestra el estado de la credencial sin revelar secretos").action(() => status(options));
   auth.command("logout").description("Elimina solamente la credencial local").action(() => logout(options));
@@ -16338,6 +16541,7 @@ function createProgram(options = {}) {
     env: options.env ?? process.env,
     deviceAuthFactory: options.deviceAuthFactory ?? createAvileoAgentDeviceAuth,
     openBrowser: options.openBrowser ?? openVerificationUri,
+    readSecret: options.readSecret ?? readAgentKeyFromTty,
     getClient,
     json: () => Boolean(program.opts().json)
   });