@tarileo/avileo-catalog-cli 0.3.13 → 0.3.15

package/dist/index.js

@@ -1867,18 +1867,18 @@ var validateAsync = async (schema, value, _ctx) => {
   return result.issues.length === 0;
 };
 var _encode = (_Err) => {
-  const parse3 = _parse(_Err);
+  const parse4 = _parse(_Err);
   const fn = (schema, value, _ctx, _params) => {
     const ctx = _ctx ? { ..._ctx, direction: "backward" } : { direction: "backward" };
-    return parse3(schema, value, ctx, finalizeParams(fn, _params));
+    return parse4(schema, value, ctx, finalizeParams(fn, _params));
   };
   return fn;
 };
 var encode = /* @__PURE__ */ _encode($ZodRealError);
 var _decode = (_Err) => {
-  const parse3 = _parse(_Err);
+  const parse4 = _parse(_Err);
   const fn = (schema, value, _ctx, _params) => {
-    return parse3(schema, value, _ctx, finalizeParams(fn, _params));
+    return parse4(schema, value, _ctx, finalizeParams(fn, _params));
   };
   return fn;
 };
@@ -3373,7 +3373,7 @@ function capSize(inst, size) {
   if (!caps.length)
     return;
   const cap = Math.min(...caps.map((c) => c[0]));
-  const parse3 = inst._zod.parse;
+  const parse4 = inst._zod.parse;
   inst._zod.parse = (payload, ctx) => {
     const n = size(payload.value);
     if (n > cap && !ctx?.skipChecks && ctx?.direction !== "backward") {
@@ -3387,7 +3387,7 @@ function capSize(inst, size) {
         }
       }
     }
-    return parse3(payload, ctx);
+    return parse4(payload, ctx);
   };
 }
 var arraySize = (input2) => Array.isArray(input2) ? input2.length : -1;
@@ -5076,7 +5076,7 @@ var recursive = /* @__PURE__ */ new WeakMap();
 var NONE = 0;
 var ASSUMED = 1;
 var PROVEN = 2;
-function isRecursive(inst, stack, resolve2) {
+function isRecursive(inst, stack, resolve3) {
   const cached2 = recursive.get(inst);
   if (cached2 !== void 0)
     return cached2 ? PROVEN : NONE;
@@ -5086,7 +5086,7 @@ function isRecursive(inst, stack, resolve2) {
   let result = NONE;
   const check2 = (child) => {
     if (result !== PROVEN && child?._zod) {
-      const answer = isRecursive(child, stack, resolve2);
+      const answer = isRecursive(child, stack, resolve3);
       if (answer > result)
         result = answer;
     }
@@ -5097,7 +5097,7 @@ function isRecursive(inst, stack, resolve2) {
       const desc = Object.getOwnPropertyDescriptor(sh, key);
       if (spread && !desc.enumerable)
         continue;
-      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve2) : NONE;
+      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve3) : NONE;
       if (child > answer)
         answer = child;
     }
@@ -5161,7 +5161,7 @@ function isRecursive(inst, stack, resolve2) {
       break;
     // `$ZodLazy` caches its inner on the def, so a resolved edge is followed exactly
     case "lazy": {
-      const inner = def._cachedInner ?? (resolve2 ? inst._zod.innerType : void 0);
+      const inner = def._cachedInner ?? (resolve3 ? inst._zod.innerType : void 0);
       merge2(inner ? isRecursive(inner, stack, false) : ASSUMED);
       break;
     }
@@ -19915,7 +19915,7 @@ var AgentHttpClient = class {
       } catch {
         abort.cancel();
         if (retry && attempt < 2) {
-          await new Promise((resolve2) => setTimeout(resolve2, retryDelayMs(attempt)));
+          await new Promise((resolve3) => setTimeout(resolve3, retryDelayMs(attempt)));
           continue;
         }
         throw new AgentNetworkError("No se pudo conectar con la API de Avileo", {
@@ -19926,7 +19926,7 @@ var AgentHttpClient = class {
       }
       abort.cancel();
       if (retry && isRetryableStatus(response.status) && attempt < 2) {
-        await new Promise((resolve2) => setTimeout(resolve2, retryDelayMs(attempt, response)));
+        await new Promise((resolve3) => setTimeout(resolve3, retryDelayMs(attempt, response)));
         continue;
       }
       let payload;
@@ -19962,7 +19962,8 @@ var AGENT_CAPABILITY_ACTIONS = [
   "inventory:read",
   "inventory:write",
   "payments:read",
-  "payments:write"
+  "payments:write",
+  "sales:read"
 ];
 var AgentCapabilityActionSchema = external_exports.enum(AGENT_CAPABILITY_ACTIONS);
 var AGENT_KEY_MODES = ["read", "mutate"];
@@ -19972,7 +19973,8 @@ var AGENT_KEY_READ_ACTIONS = [
   "catalog:read",
   "assets:read",
   "inventory:read",
-  "payments:read"
+  "payments:read",
+  "sales:read"
 ];
 var AgentGrantedActionsSchema = external_exports.array(AgentCapabilityActionSchema).min(1).max(AGENT_CAPABILITY_ACTIONS.length).refine((actions) => new Set(actions).size === actions.length, {
   message: "Las capacidades no pueden repetirse"
@@ -20772,6 +20774,75 @@ var AgentPaymentMethodDtoSchema = external_exports.object({
   qrRenderUrl: external_exports.string().nullable(),
   habilitado: external_exports.boolean()
 }).strict();
+var uuidSchema2 = external_exports.string().uuid();
+var timestampSchema2 = external_exports.string().datetime({ offset: true });
+var nonEmptyTextSchema2 = external_exports.string().trim().min(1);
+var nonNegativeDecimalStringSchema2 = external_exports.string().regex(/^(?:0|[1-9]\d*)(?:\.\d+)?$/, "Debe ser un decimal no negativo");
+var AgentSalesChannelSchema = external_exports.enum(["web", "tienda"]);
+var agentSaleTypeSchema = external_exports.enum(["instant_sale", "pre_order"]);
+var AgentSalesListQuerySchema = external_exports.object({
+  // Acepta tanto el estado legado como el nombre canónico en v1.
+  status: nonEmptyTextSchema2.max(40).optional(),
+  channel: AgentSalesChannelSchema.optional(),
+  type: agentSaleTypeSchema.optional(),
+  // Rango inclusivo por `since` y exclusivo por `until`.
+  since: timestampSchema2.optional(),
+  until: timestampSchema2.optional(),
+  limit: external_exports.number().int().min(1).max(100).default(20),
+  // Cursor opaco emitido por el backend; no interpretable por el agente.
+  cursor: external_exports.string().min(1).max(512).optional()
+}).strict();
+var AgentCustomerMaskedSchema = external_exports.object({
+  name: external_exports.string().nullable(),
+  phone: external_exports.string().nullable(),
+  address: external_exports.string().nullable()
+}).strict();
+var AgentSaleItemSchema = external_exports.object({
+  productId: uuidSchema2.nullable(),
+  variantId: uuidSchema2.nullable(),
+  name: nonEmptyTextSchema2,
+  variantName: external_exports.string().nullable(),
+  quantity: nonNegativeDecimalStringSchema2,
+  unitPrice: nonNegativeDecimalStringSchema2,
+  lineTotal: nonNegativeDecimalStringSchema2
+}).strict();
+var AgentSaleSummarySchema = external_exports.object({
+  id: uuidSchema2,
+  code: external_exports.string().nullable(),
+  channel: AgentSalesChannelSchema.nullable(),
+  type: agentSaleTypeSchema,
+  // Estado legado de la venta; `commercialStatus` es el canónico actual.
+  legacyStatus: nonEmptyTextSchema2,
+  commercialStatus: external_exports.string().nullable(),
+  paymentStatus: external_exports.string().nullable(),
+  fulfillmentStatus: external_exports.string().nullable(),
+  createdAt: timestampSchema2,
+  currency: external_exports.string().length(3),
+  total: nonNegativeDecimalStringSchema2,
+  itemCount: external_exports.number().int().nonnegative()
+}).strict();
+var AgentSaleTimelineEntrySchema = external_exports.object({
+  at: timestampSchema2,
+  kind: nonEmptyTextSchema2,
+  actorKind: external_exports.string().nullable(),
+  // Nota ya enmascarada por el servidor; nunca PII libre.
+  note: external_exports.string().nullable()
+}).strict();
+var AgentSaleDetailSchema = AgentSaleSummarySchema.extend({
+  subtotal: nonNegativeDecimalStringSchema2,
+  confirmedAt: timestampSchema2.nullable(),
+  // Método de entrega, NO el `fulfillmentSnapshot` crudo.
+  fulfillmentMethod: external_exports.string().nullable(),
+  deliveryDistrict: external_exports.string().nullable(),
+  customer: AgentCustomerMaskedSchema,
+  items: external_exports.array(AgentSaleItemSchema).max(200),
+  timeline: external_exports.array(AgentSaleTimelineEntrySchema).max(200)
+}).strict();
+var AgentSalesPageSchema = external_exports.object({
+  items: external_exports.array(AgentSaleSummarySchema).max(100),
+  total: external_exports.number().int().nonnegative(),
+  nextCursor: external_exports.string().nullable()
+}).strict();
 var AGENT_DEVICE_AUTH_STATUSES = ["pending", "approved", "denied", "expired"];
 var AGENT_DEVICE_AUTH_DEFAULT_PERMISSIONS = [
   ...AGENT_KEY_READ_ACTIONS
@@ -20834,6 +20905,32 @@ var AgentBusinessResource = class {
   profile() {
     return this.http.request("/api/v1/agent/business/profile");
   }
+  /** Diagnostic state of this credential; never returns key material. */
+  credential() {
+    return this.http.request("/api/v1/agent/credential");
+  }
+};
+var AgentSalesResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  list(query = {}) {
+    return this.http.request(
+      `/api/v1/agent/sales${queryString({
+        status: query.status,
+        channel: query.channel,
+        type: query.type,
+        since: query.since,
+        until: query.until,
+        limit: query.limit,
+        cursor: query.cursor
+      })}`
+    );
+  }
+  get(id) {
+    return this.http.request(`/api/v1/agent/sales/${encodeURIComponent(id)}`);
+  }
 };
 async function uploadTemporaryImage(http, file2, options = {}) {
   const body = new FormData();
@@ -21221,6 +21318,7 @@ function createAvileoAgent(config2) {
   const http = new AgentHttpClient(config2);
   return {
     business: new AgentBusinessResource(http),
+    sales: new AgentSalesResource(http),
     operations: new AgentOperationsResource(http),
     products: new AgentProductsResource(http),
     variants: new AgentVariantsResource(http),
@@ -21235,10 +21333,21 @@ function createAvileoAgent(config2) {
 }
 
 // src/config.ts
-import { chmodSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "fs";
+import {
+  chmodSync,
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  readFileSync,
+  realpathSync,
+  renameSync,
+  statSync,
+  unlinkSync,
+  writeFileSync
+} from "fs";
 import { randomUUID } from "crypto";
-import { homedir } from "os";
-import { dirname, join } from "path";
+import { homedir, tmpdir } from "os";
+import { basename, dirname, join, parse as parse3, resolve } from "path";
 import { isIP } from "net";
 var LOCAL_IPV4_HOST_PATTERN = /^(?:127\.|10\.|192\.168\.|169\.254\.|172\.(?:1[6-9]|2\d|3[01])\.|100\.(?:6[4-9]|[7-9]\d|1[01]\d|12[0-7])\.)/;
 function isLocalHostname(hostname3) {
@@ -21301,13 +21410,12 @@ function localCredentialPath(env = process.env) {
     "credentials.json"
   );
 }
-function readLocalCredential(env = process.env) {
-  let parsed;
-  try {
-    parsed = JSON.parse(readFileSync(localCredentialPath(env), "utf8"));
-  } catch {
-    return null;
-  }
+function localCredentialPathSource(env) {
+  if (env.AVILEO_AGENT_CONFIG_PATH?.trim()) return "AVILEO_AGENT_CONFIG_PATH";
+  if (env.XDG_CONFIG_HOME?.trim()) return "XDG_CONFIG_HOME";
+  return "default";
+}
+function parseLocalCredential(parsed) {
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
     throw new CliConfigurationError("La credencial local no tiene un formato v\xE1lido");
   }
@@ -21323,6 +21431,60 @@ function readLocalCredential(env = process.env) {
   }
   return { apiKey, baseUrl: normalizeApiBaseUrl(record2.baseUrl) };
 }
+function readCredentialFile(env) {
+  const path = localCredentialPath(env);
+  const pathSource = localCredentialPathSource(env);
+  let raw;
+  try {
+    raw = readFileSync(path, "utf8");
+  } catch (error62) {
+    const errorCode2 = error62?.code;
+    if (errorCode2 === "ENOENT") return { status: "missing", path, pathSource };
+    return {
+      status: "unreadable",
+      path,
+      pathSource,
+      ...typeof errorCode2 === "string" ? { errorCode: errorCode2 } : {}
+    };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return { status: "invalid_json", path, pathSource };
+  }
+  try {
+    return { status: "ok", credential: parseLocalCredential(parsed), path, pathSource };
+  } catch (error62) {
+    const failure2 = error62 instanceof CliConfigurationError ? error62 : new CliConfigurationError("La credencial local no tiene un formato v\xE1lido");
+    return { status: "invalid_shape", path, pathSource, errorCode: failure2.code, error: failure2 };
+  }
+}
+function inspectLocalCredential(env = process.env) {
+  const result = readCredentialFile(env);
+  if (result.status === "ok") {
+    return {
+      status: "ok",
+      credential: result.credential,
+      path: result.path,
+      pathSource: result.pathSource,
+      ...observedCredentialModes(result.path)
+    };
+  }
+  return {
+    status: result.status,
+    path: result.path,
+    pathSource: result.pathSource,
+    ...result.errorCode === void 0 ? {} : { errorCode: result.errorCode },
+    ...result.status === "missing" ? {} : observedCredentialModes(result.path)
+  };
+}
+function readLocalCredential(env = process.env) {
+  const result = readCredentialFile(env);
+  if (result.status === "ok") return result.credential;
+  if (result.error) throw result.error;
+  return null;
+}
 function resolveCredential(env = process.env) {
   const override = overrideBaseUrl(env);
   if (env.AVILEO_AGENT_REQUIRE_EXPLICIT_ORIGIN === "1" && override === void 0) {
@@ -21350,6 +21512,152 @@ function resolveCredential(env = process.env) {
   }
   return { ...local, source: "local" };
 }
+var DEFAULT_CREDENTIAL_PATH_HINT = "~/.config/avileo/credentials.json";
+function formatMode(mode) {
+  const masked = mode & 4095;
+  return masked > 511 ? masked.toString(8) : `0${masked.toString(8).padStart(3, "0")}`;
+}
+function observedCredentialModes(path) {
+  const modes = {};
+  const file2 = statSync(path, { throwIfNoEntry: false });
+  if (file2) modes.fileMode = formatMode(file2.mode);
+  const directory = statSync(dirname(path), { throwIfNoEntry: false });
+  if (directory) modes.directoryMode = formatMode(directory.mode);
+  return modes;
+}
+function sharedTempRoots() {
+  const roots = [];
+  for (const candidate of ["/tmp", "/var/tmp", tmpdir()]) {
+    try {
+      roots.push(realpathSync(candidate));
+    } catch {
+    }
+  }
+  return roots;
+}
+function resolveThroughExistingAncestors(targetPath) {
+  const absolute = resolve(targetPath);
+  const missingSegments = [];
+  let existingAncestor = absolute;
+  while (!existsSync(existingAncestor)) {
+    const parent = dirname(existingAncestor);
+    if (parent === existingAncestor) break;
+    missingSegments.unshift(basename(existingAncestor));
+    existingAncestor = parent;
+  }
+  const realAncestor = realpathSync(existingAncestor);
+  return missingSegments.length === 0 ? realAncestor : resolve(realAncestor, ...missingSegments);
+}
+function findRepositoryAncestor(startPath) {
+  let current = startPath;
+  while (true) {
+    if (statSync(join(current, ".git"), { throwIfNoEntry: false })) return current;
+    const parent = dirname(current);
+    if (parent === current) return null;
+    current = parent;
+  }
+}
+function assertOutsideRepository(resolvedPath) {
+  const repositoryRoot = findRepositoryAncestor(resolvedPath);
+  if (repositoryRoot === null) return;
+  throw new CliConfigurationError(
+    `No se puede guardar la credencial dentro de un repositorio: ${repositoryRoot} contiene .git. Usa la ruta por defecto ${DEFAULT_CREDENTIAL_PATH_HINT} o define AVILEO_AGENT_CONFIG_PATH fuera del \xE1rbol del repositorio.`
+  );
+}
+var UNRESOLVABLE_PARENT_CODES = {
+  EEXIST: true,
+  ELOOP: true,
+  ENOENT: true,
+  ENOTDIR: true
+};
+function findBrokenSymlinkAncestor(targetPath) {
+  const absolute = resolve(targetPath);
+  const segments = [];
+  let current = absolute;
+  while (true) {
+    const parent = dirname(current);
+    if (parent === current) break;
+    segments.unshift(basename(current));
+    current = parent;
+  }
+  let walked = parse3(absolute).root;
+  for (const segment of segments) {
+    walked = join(walked, segment);
+    const stats = lstatSync(walked, { throwIfNoEntry: false });
+    if (!stats) return null;
+    if (!stats.isSymbolicLink()) continue;
+    try {
+      realpathSync(walked);
+    } catch {
+      return walked;
+    }
+  }
+  return null;
+}
+function describeUnresolvableParent(parentPath, error62) {
+  const code = error62?.code;
+  if (typeof code !== "string" || UNRESOLVABLE_PARENT_CODES[code] !== true) return null;
+  const brokenLink = findBrokenSymlinkAncestor(parentPath);
+  const subject = brokenLink === null ? `${parentPath} contiene un enlace simb\xF3lico` : `${brokenLink} es un enlace simb\xF3lico`;
+  return new CliConfigurationError(
+    `No se pudo preparar el directorio de la credencial ${parentPath}: ${subject} roto o circular. Corrige o elimina ese enlace, o usa la ruta por defecto ${DEFAULT_CREDENTIAL_PATH_HINT} o un directorio privado 0700 fuera del repositorio.`
+  );
+}
+function decideParentDirectoryAction(input2) {
+  const fullMode = input2.mode & 4095;
+  if ((fullMode & 63) === 0) return "ok";
+  if (input2.isSharedTempRoot || (fullMode & 512) !== 0) return "refuse-shared";
+  if (input2.ownerUid === input2.processUid) return "repair";
+  return "refuse-foreign";
+}
+function assertPrivateParentDirectory(parentPath) {
+  const stats = statSync(parentPath);
+  const fullMode = stats.mode & 4095;
+  const processUid = typeof process.getuid === "function" ? process.getuid() : -1;
+  const action = decideParentDirectoryAction({
+    mode: fullMode,
+    ownerUid: stats.uid,
+    processUid,
+    isSharedTempRoot: sharedTempRoots().includes(parentPath)
+  });
+  if (action === "ok") return;
+  if (action === "refuse-shared") {
+    throw new CliConfigurationError(
+      `El directorio padre de la credencial es un directorio temporal compartido (modo ${formatMode(fullMode)}) pensado para archivos temporales: no guardes credenciales ah\xED ni cambies sus permisos. Usa un subdirectorio privado 0700, por ejemplo mkdtempSync(join(tmpdir(), 'avileo-')), o la ruta por defecto ${DEFAULT_CREDENTIAL_PATH_HINT}.`
+    );
+  }
+  if (action === "refuse-foreign") {
+    throw new CliConfigurationError(
+      `El directorio de credenciales ${parentPath} tiene permisos ${formatMode(fullMode)} y pertenece a otro usuario (uid ${stats.uid}; este proceso usa uid ${processUid}), as\xED que permite acceso de grupo o de otros usuarios y no se puede reparar autom\xE1ticamente. Usa la ruta por defecto ${DEFAULT_CREDENTIAL_PATH_HINT} o un directorio privado propio 0700.`
+    );
+  }
+  chmodSync(parentPath, 448);
+  const repairedMode = statSync(parentPath).mode & 511;
+  if (repairedMode !== 448) {
+    throw new CliConfigurationError(
+      `El directorio de credenciales ${parentPath} qued\xF3 con permisos ${formatMode(repairedMode)} tras repararlo; se requiere 0700.`
+    );
+  }
+}
+function assertSafeCredentialPath(targetPath) {
+  const resolvedTarget = resolve(targetPath);
+  const parentPath = dirname(resolvedTarget);
+  try {
+    const resolvedParent = resolveThroughExistingAncestors(parentPath);
+    assertOutsideRepository(resolvedParent);
+    mkdirSync(resolvedParent, { recursive: true, mode: 448 });
+    const realParent = realpathSync(resolvedParent);
+    assertOutsideRepository(realParent);
+    assertPrivateParentDirectory(realParent);
+  } catch (error62) {
+    if (error62 instanceof CliConfigurationError) throw error62;
+    throw describeUnresolvableParent(parentPath, error62) ?? error62;
+  }
+}
+function errorCodeOf(error62) {
+  const code = error62?.code;
+  return typeof code === "string" && code.length > 0 ? code : "UNKNOWN";
+}
 function saveLocalCredential(credential, env = process.env) {
   const apiKey = normalizeAgentKey(
     credential.apiKey,
@@ -21357,13 +21665,46 @@ function saveLocalCredential(credential, env = process.env) {
   );
   const baseUrl = normalizeApiBaseUrl(credential.baseUrl);
   const path = localCredentialPath(env);
-  mkdirSync(dirname(path), { recursive: true, mode: 448 });
+  assertSafeCredentialPath(path);
   const temporaryPath = `${path}.${randomUUID()}.tmp`;
-  writeFileSync(temporaryPath, `${JSON.stringify({ apiKey, baseUrl })}
+  try {
+    writeFileSync(temporaryPath, `${JSON.stringify({ apiKey, baseUrl })}
 `, { mode: 384 });
-  chmodSync(temporaryPath, 384);
-  renameSync(temporaryPath, path);
-  chmodSync(path, 384);
+    chmodSync(temporaryPath, 384);
+    renameSync(temporaryPath, path);
+  } catch (error62) {
+    throw new CliConfigurationError(
+      `No se pudo guardar la credencial local en ${path} (${errorCodeOf(error62)}).`
+    );
+  } finally {
+    try {
+      unlinkSync(temporaryPath);
+    } catch {
+    }
+  }
+  try {
+    chmodSync(path, 384);
+  } catch (error62) {
+    throw new CliConfigurationError(
+      `La credencial local en ${path} se guard\xF3 pero no se pudo ajustar a 0600 (${errorCodeOf(error62)}). Ejecuta chmod 600 ${path}.`
+    );
+  }
+  const finalMode = statSync(path).mode & 511;
+  if (finalMode !== 384) {
+    throw new CliConfigurationError(
+      `La credencial local en ${path} qued\xF3 con permisos ${formatMode(finalMode)}; se requiere 0600. Ejecuta chmod 600 ${path}.`
+    );
+  }
+}
+function inspectLocalCredentialPermissions(env = process.env) {
+  const path = localCredentialPath(env);
+  const { fileMode, directoryMode } = observedCredentialModes(path);
+  if (!fileMode || !directoryMode) {
+    throw new CliConfigurationError(
+      `No se pudieron leer los permisos de la credencial local en ${path}`
+    );
+  }
+  return { path, fileMode, directoryMode };
 }
 function removeLocalCredential(env = process.env) {
   try {
@@ -21548,13 +21889,41 @@ function registerBusinessCommands(root, getClient) {
 // src/commands/catalog.ts
 import { createHash } from "crypto";
 import { readFile as readFile2, stat } from "fs/promises";
-import { basename as basename2, extname } from "path";
+import { basename as basename3, extname } from "path";
+
+// src/commands/import-example.ts
+var CATALOG_IMPORT_EXAMPLE = {
+  source: "supplier-file",
+  products: [
+    {
+      externalRef: { source: "supplier-file", externalId: "SKU-001" },
+      name: "Arroz extra 1 kg",
+      description: "Arroz extra de grano largo, bolsa de 1 kg.",
+      category: { name: "Abarrotes" },
+      unit: "unidad",
+      basePrice: "6.50",
+      costPrice: "5.20",
+      isActive: true,
+      images: [{ kind: "file", path: "./arroz-extra-1kg.jpg" }],
+      variants: [
+        {
+          name: "Bolsa 1 kg",
+          sku: "SKU-001-1KG",
+          unitQuantity: "1",
+          price: "6.50",
+          initialStock: "20",
+          isActive: true
+        }
+      ]
+    }
+  ]
+};
 
 // src/commands/import-images.ts
 import { randomUUID as randomUUID2 } from "crypto";
 import { constants } from "fs";
 import { open as open2 } from "fs/promises";
-import { basename, dirname as dirname2, resolve } from "path";
+import { basename as basename2, dirname as dirname2, resolve as resolve2 } from "path";
 var MAX_IMAGE_BYTES = 5 * 1024 * 1024;
 var MAX_TEMPORARY_IMAGES = 100;
 var MAX_TEMPORARY_BYTES = 100 * 1024 * 1024;
@@ -21603,7 +21972,7 @@ async function readImage(path, remainingBytes) {
     const bytes = buffer.subarray(0, length);
     const mimeType = imageMimeType(bytes);
     if (!mimeType) invalidInput("Solo se permiten im\xE1genes JPEG, PNG, WebP o GIF");
-    return new File([bytes], basename(path), { type: mimeType });
+    return new File([bytes], basename2(path), { type: mimeType });
   } catch (error62) {
     if (error62 instanceof CliProtocolError) throw error62;
     invalidInput("No se pudo leer una imagen local del cat\xE1logo");
@@ -21614,7 +21983,7 @@ async function readImage(path, remainingBytes) {
 function localImageSources(inputPath) {
   const paths = /* @__PURE__ */ new Map();
   const placeholders = /* @__PURE__ */ new Map();
-  const baseDirectory = dirname2(resolve(inputPath));
+  const baseDirectory = dirname2(resolve2(inputPath));
   const normalizeImages = (value) => {
     if (!Array.isArray(value)) return value;
     return value.map((source) => {
@@ -21622,7 +21991,7 @@ function localImageSources(inputPath) {
       if (Object.keys(source).some((key) => key !== "kind" && key !== "path") || typeof source.path !== "string" || source.path.trim().length === 0 || source.path.includes("\0")) {
         invalidInput("Cada imagen local requiere \xFAnicamente kind: file y un path v\xE1lido");
       }
-      const path = resolve(baseDirectory, source.path);
+      const path = resolve2(baseDirectory, source.path);
       let placeholder = paths.get(path);
       if (!placeholder) {
         placeholder = randomUUID2();
@@ -22081,7 +22450,7 @@ function registerAssetCommands(catalog, getClient) {
     if (!wantsApply(command)) {
       emitSuccess({
         validated: "local",
-        file: basename2(filePath),
+        file: basename3(filePath),
         sizeBytes: fileStat.size
       });
       return;
@@ -22095,7 +22464,7 @@ function registerAssetCommands(catalog, getClient) {
       );
     }
     const contents = await readFile2(filePath);
-    const file2 = new File([contents], basename2(filePath), { type: mimeType });
+    const file2 = new File([contents], basename3(filePath), { type: mimeType });
     const rawApprovalId = command.optsWithGlobals().approvalId;
     if (typeof rawApprovalId === "string") {
       emitSuccess(await getClient().assets.upload(file2, requireId(rawApprovalId, "approvalId")));
@@ -22187,6 +22556,7 @@ function registerImportCommands(catalog, getClient) {
       );
     }
   );
+  imports.command("example").description("Imprime el payload can\xF3nico de una importaci\xF3n").action(() => emitSuccess(CATALOG_IMPORT_EXAMPLE));
   imports.command("status <importId>").action(async (importId) => {
     emitSuccess(await getClient().imports.get(requireId(importId, "importId")));
   });
@@ -22222,8 +22592,59 @@ function registerOperationBatchCommands(operation, getClient) {
   });
 }
 
+// src/commands/sales.ts
+var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function parseLimit(value) {
+  const parsed = Number(value);
+  if (!Number.isInteger(parsed) || parsed < 1 || parsed > 100) {
+    throw new CliProtocolError("CLI_VALIDATION_ERROR", "--limit debe ser un entero entre 1 y 100", {
+      limit: value
+    });
+  }
+  return parsed;
+}
+function parseChannel(value) {
+  if (value === "web" || value === "tienda") return value;
+  throw new CliProtocolError("CLI_VALIDATION_ERROR", "--channel debe ser web o tienda", {
+    channel: value
+  });
+}
+function parseType(value) {
+  if (value === "instant_sale" || value === "pre_order") return value;
+  throw new CliProtocolError("CLI_VALIDATION_ERROR", "--type debe ser instant_sale o pre_order", {
+    type: value
+  });
+}
+function requireUuid(value, name) {
+  const trimmed = value.trim();
+  if (!UUID_PATTERN.test(trimmed)) {
+    throw new CliProtocolError("CLI_VALIDATION_ERROR", `${name} debe ser un UUID v\xE1lido`);
+  }
+  return trimmed;
+}
+function registerSalesCommands(root, getClient) {
+  const sales = root.command("sales").description("Consulta ventas del negocio (solo lectura, tel\xE9fono parcialmente enmascarado)");
+  sales.command("list").description("Lista ventas con filtros opcionales").option("--status <status>", "Estado de la venta").option("--channel <channel>", "Canal de la venta (web|tienda)", parseChannel).option("--type <type>", "Tipo de venta (instant_sale|pre_order)", parseType).option("--since <iso>", "Fecha m\xEDnima (ISO 8601)").option("--until <iso>", "Fecha m\xE1xima (ISO 8601)").option("--limit <number>", "M\xE1ximo de resultados (1-100)", parseLimit).option("--cursor <cursor>", "Cursor de paginaci\xF3n").action(async (options) => {
+    emitSuccess(
+      await getClient().sales.list({
+        ...options.status === void 0 ? {} : { status: options.status },
+        ...options.channel === void 0 ? {} : { channel: options.channel },
+        ...options.type === void 0 ? {} : { type: options.type },
+        ...options.since === void 0 ? {} : { since: options.since },
+        ...options.until === void 0 ? {} : { until: options.until },
+        ...options.limit === void 0 ? {} : { limit: options.limit },
+        ...options.cursor === void 0 ? {} : { cursor: options.cursor }
+      })
+    );
+  });
+  sales.command("get <id>").description("Consulta el detalle de una venta").action(async (id) => {
+    emitSuccess(await getClient().sales.get(requireUuid(id, "id")));
+  });
+}
+
 // src/commands/auth.ts
 import { spawn } from "child_process";
+import { dirname as dirname3 } from "path";
 function safeStartResult(start, browserOpened) {
   return {
     status: "pending",
@@ -22249,7 +22670,7 @@ function safeFinalResult(start, browserOpened, result) {
   };
 }
 function sleep(milliseconds) {
-  return new Promise((resolve2) => setTimeout(resolve2, milliseconds));
+  return new Promise((resolve3) => setTimeout(resolve3, milliseconds));
 }
 function readAgentKeyFromTty(prompt = "Agent Key de Avileo: ") {
   if (!process.stdin.isTTY || !process.stderr.isTTY) {
@@ -22258,7 +22679,7 @@ function readAgentKeyFromTty(prompt = "Agent Key de Avileo: ") {
       "auth configure requiere una terminal interactiva; usa AVILEO_AGENT_API_KEY en CI/CD"
     );
   }
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     let value = "";
     const input2 = process.stdin;
     const output2 = process.stderr;
@@ -22272,7 +22693,7 @@ function readAgentKeyFromTty(prompt = "Agent Key de Avileo: ") {
       cleanup();
       output2.write("\n");
       if (result instanceof Error) reject(result);
-      else resolve2(result);
+      else resolve3(result);
     };
     const onData = (chunk) => {
       for (const character of String(chunk)) {
@@ -22303,12 +22724,12 @@ function readAgentKeyFromTty(prompt = "Agent Key de Avileo: ") {
   });
 }
 async function openWithExecutable(command, args) {
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     const child = spawn(command, args, { stdio: "ignore", shell: false, detached: true });
-    child.once("error", () => resolve2(false));
+    child.once("error", () => resolve3(false));
     child.once("spawn", () => {
       child.unref();
-      resolve2(true);
+      resolve3(true);
     });
   });
 }
@@ -22400,7 +22821,15 @@ async function login(options) {
       );
     }
     saveLocalCredential({ apiKey: result.agentKey, baseUrl }, options.env);
-    emitSuccess({ ...safeFinalResult(start, browserOpened, result), baseUrl });
+    const permissions = inspectLocalCredentialPermissions(options.env);
+    emitSuccess({
+      ...safeFinalResult(start, browserOpened, result),
+      baseUrl,
+      credentialPath: permissions.path,
+      credentialMode: permissions.fileMode,
+      credentialDirMode: permissions.directoryMode,
+      durability: "La credencial qued\xF3 guardada solo en este equipo: si se pierde el archivo tendr\xE1s que emparejar de nuevo con \xABavileo auth login\xBB."
+    });
     return;
   }
   throw new CliProtocolError("CLI_AUTH_TIMEOUT", "La autorizaci\xF3n expir\xF3 antes de ser aprobada");
@@ -22410,33 +22839,206 @@ async function configure(options) {
   assertIsolatedDevelopmentPairing(options);
   const apiKey = await options.readSecret("Agent Key de Avileo (no se mostrar\xE1): ");
   saveLocalCredential({ apiKey, baseUrl }, options.env);
+  const permissions = inspectLocalCredentialPermissions(options.env);
   emitSuccess({
     configured: true,
     source: "local",
     baseUrl,
-    credentialPath: localCredentialPath(options.env)
+    credentialPath: localCredentialPath(options.env),
+    credentialMode: permissions.fileMode,
+    credentialDirMode: permissions.directoryMode
   });
 }
+var PORTAL_URL_PLACEHOLDER = "<URL_DEL_PORTAL>";
+function inspectedState(inspection) {
+  switch (inspection.status) {
+    case "ok":
+      return "absent";
+    case "missing":
+      return "absent";
+    default:
+      return inspection.status;
+  }
+}
+function defaultCredentialPath(env) {
+  return localCredentialPath({ XDG_CONFIG_HOME: env.XDG_CONFIG_HOME });
+}
+function permissionWarning(inspection) {
+  const directoryPath = dirname3(inspection.path);
+  const { fileMode, directoryMode } = inspection;
+  const warnings = [];
+  if (fileMode !== void 0 && (Number.parseInt(fileMode, 8) & 63) !== 0) {
+    warnings.push(
+      `El archivo ${inspection.path} tiene permisos ${fileMode}; ejecuta chmod 600 ${inspection.path}.`
+    );
+  }
+  if (directoryMode !== void 0 && (Number.parseInt(directoryMode, 8) & 63) !== 0) {
+    warnings.push(
+      `El directorio ${directoryPath} tiene permisos ${directoryMode}; ejecuta chmod 700 ${directoryPath}.`
+    );
+  }
+  return warnings.length > 0 ? ` ${warnings.join(" ")}` : "";
+}
+function defaultCredentialRecovery(env) {
+  const defaultInspection = inspectLocalCredential({ XDG_CONFIG_HOME: env.XDG_CONFIG_HOME });
+  if (defaultInspection.status !== "ok") return "";
+  return ` Hay una credencial legible en la ruta por defecto (${defaultInspection.path}); para usarla ejecuta \`env -u AVILEO_AGENT_CONFIG_PATH avileo auth status\`.`;
+}
+function nextStepForInspection(inspection, env) {
+  switch (inspection.status) {
+    case "missing":
+      if (inspection.pathSource === "AVILEO_AGENT_CONFIG_PATH") {
+        return `AVILEO_AGENT_CONFIG_PATH apunta a ${inspection.path}, pero ese archivo no existe. Ejecuta \`avileo auth login --base-url ${PORTAL_URL_PLACEHOLDER}\` para crearlo en esa ruta, o quita la variable AVILEO_AGENT_CONFIG_PATH para volver a la ruta por defecto (${defaultCredentialPath(env)}).` + defaultCredentialRecovery(env);
+      }
+      return `No hay una credencial guardada en ${inspection.path}. Ejecuta \`avileo auth login --base-url ${PORTAL_URL_PLACEHOLDER}\` para vincular esta m\xE1quina.`;
+    case "unreadable":
+      return `No se pudo leer ${inspection.path}${inspection.errorCode ? ` (${inspection.errorCode})` : ""}. Revisa los permisos del archivo y vuelve a ejecutar \`avileo auth login\`.`;
+    case "invalid_json":
+      return `El archivo ${inspection.path} no contiene JSON v\xE1lido. Vuelve a ejecutar \`avileo auth login\` para regenerarlo.`;
+    case "invalid_shape":
+      return `La credencial en ${inspection.path} no es una Agent Key v\xE1lida o le falta el origen vinculado. Vuelve a ejecutar \`avileo auth login --base-url ${PORTAL_URL_PLACEHOLDER}\`.`;
+    case "ok":
+      return "La credencial local est\xE1 disponible.";
+  }
+}
+function describeResolutionFailure(error62, inspection, env) {
+  const originIssue = error62 instanceof CliOriginConflictError || error62 instanceof CliOriginUnsupportedError;
+  if (originIssue || env.AVILEO_AGENT_API_KEY?.trim()) {
+    return { state: "invalid", nextStep: error62.message };
+  }
+  if (inspection.status !== "ok") {
+    return {
+      state: inspectedState(inspection),
+      nextStep: nextStepForInspection(inspection, env)
+    };
+  }
+  return { state: "invalid", nextStep: error62.message };
+}
+function lookupFailureState(error62) {
+  if (error62 instanceof AgentNetworkError) return "unreachable";
+  if (error62 instanceof AgentAuthenticationError || error62 instanceof AgentPermissionError) {
+    return "invalid";
+  }
+  const status2 = error62?.status;
+  if (status2 === 401 || status2 === 403) return "invalid";
+  return "unreachable";
+}
+function errorCode(error62) {
+  const code = error62 && typeof error62 === "object" && "code" in error62 ? error62.code : void 0;
+  return typeof code === "string" ? code : "LOOKUP_FAILED";
+}
+function credentialDiagnostic(value) {
+  if (!value || typeof value !== "object") return null;
+  const record2 = value;
+  const state = record2.state;
+  if (state !== "active" && state !== "expired" && state !== "revoked") return null;
+  return {
+    state,
+    expiresAt: typeof record2.expiresAt === "string" ? record2.expiresAt : null
+  };
+}
+function isRejectedCredential(error62) {
+  if (error62 instanceof AgentAuthenticationError || error62 instanceof AgentPermissionError) {
+    return true;
+  }
+  const status2 = error62?.status;
+  return status2 === 401 || status2 === 403;
+}
+function nextStepForStatus(state, baseUrl) {
+  if (state === "expired") {
+    return `La Agent Key expir\xF3. Renu\xE9vala volviendo a vincular esta m\xE1quina con \`avileo auth login --base-url ${PORTAL_URL_PLACEHOLDER}\`.`;
+  }
+  if (state === "revoked") {
+    return `La Agent Key fue revocada. Vuelve a vincular esta m\xE1quina con \`avileo auth login --base-url ${PORTAL_URL_PLACEHOLDER}\`.`;
+  }
+  if (state === "invalid") return lookupNextStep("invalid", baseUrl);
+  if (state === "unreachable") return lookupNextStep("unreachable", baseUrl);
+  return lookupNextStep("active", baseUrl);
+}
+function lookupNextStep(state, baseUrl) {
+  if (state === "active") {
+    return `La credencial responde contra ${baseUrl}; no hay nada que hacer.`;
+  }
+  if (state === "invalid") {
+    return `El origen ${baseUrl} rechaz\xF3 la credencial. Vuelve a vincular esta m\xE1quina con \`avileo auth login --base-url ${PORTAL_URL_PLACEHOLDER}\`; la clave puede haber sido revocada.`;
+  }
+  return `No se pudo contactar ${baseUrl}. Verifica la conectividad o AVILEO_AGENT_BASE_URL y reintenta con \`avileo auth status\`.`;
+}
 async function status(options) {
-  const credential = resolveCredential(options.env);
+  const inspection = inspectLocalCredential(options.env);
+  const permissionWarningSuffix = permissionWarning(inspection);
+  let credential = null;
+  let resolution;
+  try {
+    credential = resolveCredential(options.env);
+  } catch (error62) {
+    if (!(error62 instanceof CliConfigurationError)) throw error62;
+    resolution = describeResolutionFailure(error62, inspection, options.env);
+  }
   if (!credential) {
-    emitSuccess({ configured: false, source: null, business: null });
+    const nextStep = resolution?.nextStep ?? nextStepForInspection(inspection, options.env);
+    emitSuccess({
+      configured: false,
+      state: resolution?.state ?? inspectedState(inspection),
+      source: null,
+      credentialPath: inspection.path,
+      pathSource: inspection.pathSource,
+      credentialMode: inspection.fileMode,
+      credentialDirMode: inspection.directoryMode,
+      baseUrl: null,
+      business: null,
+      nextStep: `${nextStep}${permissionWarningSuffix}`
+    });
     return;
   }
+  const baseUrl = credential.baseUrl ?? AVILEO_AGENT_API_URL;
+  const client = options.getClient();
   let business = null;
   let businessLookupError;
+  let state = "active";
+  let diagnostic = null;
   try {
-    business = await options.getClient().business.get();
+    diagnostic = credentialDiagnostic(await client.business.credential());
   } catch (error62) {
-    const code = error62 && typeof error62 === "object" && "code" in error62 ? error62.code : void 0;
-    businessLookupError = typeof code === "string" ? code : "LOOKUP_FAILED";
+    if (isRejectedCredential(error62)) {
+      state = "invalid";
+      businessLookupError = errorCode(error62);
+    }
   }
+  if (state !== "invalid") {
+    if (diagnostic) {
+      state = diagnostic.state;
+    } else {
+      try {
+        business = await client.business.get();
+      } catch (error62) {
+        businessLookupError = errorCode(error62);
+        state = lookupFailureState(error62);
+      }
+    }
+  }
+  if (diagnostic?.state === "active") {
+    try {
+      business = await client.business.get();
+    } catch (error62) {
+      businessLookupError = errorCode(error62);
+      state = lookupFailureState(error62);
+    }
+  }
+  const resolvedNextStep = diagnostic?.state === "active" && state === "invalid" ? `El origen ${baseUrl} reconoce la credencial como activa, pero deneg\xF3 el acceso al negocio. Revisa en Mis agentes los permisos y la autorizaci\xF3n del emisor para el negocio vinculado en este mismo origen. Si persiste, solicita un diagn\xF3stico del backend.` : nextStepForStatus(state, baseUrl);
   emitSuccess({
     configured: true,
-    source: credential.source,
-    baseUrl: credential.baseUrl ?? AVILEO_AGENT_API_URL,
+    state,
+    source: credential.source === "environment" ? "env" : "local",
+    credentialPath: inspection.path,
+    pathSource: inspection.pathSource,
+    credentialMode: inspection.fileMode,
+    credentialDirMode: inspection.directoryMode,
+    baseUrl,
     business,
-    ...businessLookupError ? { businessLookupError } : {}
+    ...businessLookupError ? { businessLookupError } : {},
+    ...diagnostic ? { expiresAt: diagnostic.expiresAt } : {},
+    nextStep: `${resolvedNextStep}${permissionWarningSuffix}`
   });
 }
 async function logout(options) {
@@ -22500,6 +23102,7 @@ function createProgram(options = {}) {
     json: () => Boolean(program.opts().json)
   });
   registerBusinessCommands(program, getClient);
+  registerSalesCommands(program, getClient);
   registerCatalogCommands(program, getClient);
   const operation = program.command("operation").description("Consulta y aplica operaciones aprobadas en Avileo");
   registerOperationBatchCommands(operation, getClient);
@@ -22528,8 +23131,8 @@ function createProgram(options = {}) {
       return await parseAsync3(...args);
     } catch (error62) {
       if (error62 instanceof CliVersionRequested) return program;
-      const errorCode = typeof error62 === "object" && error62 !== null && "code" in error62 ? String(error62.code) : "";
-      if (errorCode === "commander.helpDisplayed" || errorCode === "commander.version")
+      const errorCode2 = typeof error62 === "object" && error62 !== null && "code" in error62 ? String(error62.code) : "";
+      if (errorCode2 === "commander.helpDisplayed" || errorCode2 === "commander.version")
         return program;
       emitFailure(toFailure(error62));
       process.exitCode = exitCodeFor(error62);