@usenaive-sdk/cli 0.12.0 → 0.12.5

package/dist/commands/clone.js

@@ -0,0 +1,199 @@
+import { Command, Option } from "commander";
+import { readFileSync, existsSync } from "node:fs";
+import { basename } from "node:path";
+import { apiRequest, handleApiError } from "../client.js";
+import { loadConfig, getApiKey } from "../config.js";
+import { agentOutput, formatApiError } from "../output.js";
+// naive clone generate — one-shot digital-twin video (reference image + a saved cloned
+// voice + a script + an optional scene -> a lip-synced talking video). Mirrors
+// `naive video generate`: submit (async, returns a job id), optional --wait poll.
+// If --image is a LOCAL path, it is uploaded via `media upload` first to get a public URL.
+export const cloneCmd = new Command("clone")
+    .description("Generate a lip-synced talking video of a real person from a reference image + a saved cloned voice + a script")
+    .addHelpText("after", `
+Subcommands:
+  naive clone generate   Generate a talking video (image + voice + script -> video)
+  naive clone status     Check a clone generation job
+
+Examples:
+  $ naive clone generate --voice <voice_id> --image ./frame.png --text "Hey, welcome." --i-affirm
+  $ naive clone generate --voice <voice_id> --image https://example.com/frame.jpg \\
+      --text "Walking the pool deck" --scene "cliffside mansion pool deck at golden hour" --i-affirm --wait
+
+Cost:
+  - Image edit (only with --scene) + animate, billed on completion. The voice synth is
+    billed on its own meter. Credits deducted only on successful completion.
+`);
+cloneCmd
+    .command("generate")
+    .description("Generate a talking video (async — returns a job ID)")
+    .requiredOption("--voice <id>", "An existing cloned voice profile id (the subject's voice + consent)")
+    .requiredOption("--image <path|url>", "Reference image — a local file path or a public https URL")
+    .requiredOption("--text <script>", "The script the cloned voice should speak")
+    .option("--scene <description>", "Optional scene/relight, e.g. 'cliffside pool deck at golden hour'")
+    .addOption(new Option("--quality <tier>", "Animate model: 'max' (OmniHuman, best lip-sync, default) or 'fast' (Kling, ~27% cheaper, stabler background)").choices(["max", "fast"]))
+    .option("--i-affirm", "Affirm the depicted person consented to this likeness animation (required)")
+    .option("--wait", "Wait for the job to complete (polls until done)")
+    .addHelpText("after", `
+What this does:
+  1. (If --image is a local file) uploads it to get a public URL
+  2. Submits a clone generation job (image + voice + script [+ scene])
+  3. Returns a job ID (async, typically 1-3 minutes)
+  4. Use --wait to block until done, or check with 'naive clone status'
+
+Consent:
+  --i-affirm is required: you attest the depicted person consented to this likeness
+  animation. The voice must be a saved cloned-voice profile with self or verified
+  third-party consent (you are animating that subject's likeness), AND that consent
+  must authorize the clone_generate use. Clone the voice with that use enabled:
+    naive voice clone <file> --consent-type self --i-affirm \\
+      --authorized-uses voice_synthesis,clone_generate ...
+  A voice cloned without clone_generate in --authorized-uses will be rejected.
+`)
+    .action(async (opts) => {
+    if (!opts.iAffirm) {
+        console.error(JSON.stringify({
+            success: false,
+            action: "clone.generate",
+            error: {
+                code: "missing_argument",
+                message: "--i-affirm is required: affirm the depicted person consented to this likeness animation",
+            },
+            recovery_steps: [
+                {
+                    command: 'naive clone generate --voice <id> --image <path|url> --text "..." --i-affirm',
+                    description: "Re-run with the consent affirmation",
+                },
+            ],
+        }, null, 2));
+        process.exit(1);
+    }
+    // Resolve --image to a public URL. A local path is uploaded first (the S3 bucket
+    // returns a presigned URL fal can GET); an http(s) URL is passed through unchanged.
+    let imageUrl = opts.image;
+    if (!/^https?:\/\//i.test(opts.image)) {
+        if (!existsSync(opts.image)) {
+            console.error(JSON.stringify({
+                success: false,
+                action: "clone.generate",
+                error: { code: "invalid_input", message: `Image file not found: ${opts.image}` },
+            }, null, 2));
+            process.exit(1);
+        }
+        imageUrl = await uploadLocalImage(opts.image);
+    }
+    const resp = await apiRequest("POST", "/v1/clone/generate", {
+        voice_id: opts.voice,
+        image_url: imageUrl,
+        text: opts.text,
+        ...(opts.scene ? { scene: opts.scene } : {}),
+        ...(opts.quality ? { quality: opts.quality } : {}),
+        i_affirm: true,
+    });
+    handleApiError("clone.generate", resp);
+    const data = resp.data;
+    if (opts.wait) {
+        agentOutput({
+            action: "clone.generate.submitted",
+            result: { job_id: data.job_id, status: "polling" },
+            next_steps: [],
+            hints: ["Waiting for clone generation to complete (typically 1-3 minutes)..."],
+        });
+        await pollJob(data.job_id);
+    }
+    else {
+        agentOutput({
+            action: "clone.generate.submitted",
+            result: { job_id: data.job_id, status: "queued" },
+            next_steps: [
+                { command: `naive clone status ${data.job_id}`, description: "Check clone generation progress" },
+                { command: `naive jobs get ${data.job_id}`, description: "Get full job details" },
+            ],
+            hints: [
+                "Clone generation submitted",
+                "Credits deducted only on successful completion",
+                "Typical time: 1-3 minutes",
+            ],
+            related_commands: ["naive clone status", "naive jobs"],
+        });
+    }
+});
+cloneCmd
+    .command("status <job_id>")
+    .description("Check the status of a clone generation job")
+    .addHelpText("after", `
+Examples:
+  $ naive clone status 550e8400-e29b-41d4-a716-446655440000
+
+When completed, the result includes the talking-video URL (result.url).
+`)
+    .action(async (jobId) => {
+    const resp = await apiRequest("GET", `/v1/clone/${jobId}`);
+    handleApiError("clone.status", resp);
+    const data = resp.data;
+    agentOutput({
+        action: "clone.status",
+        result: resp.data,
+        next_steps: [
+            ...(data.status === "completed" && data.result?.url
+                ? [{ command: `# Download: curl -o clone.mp4 "${data.result.url}"`, description: "Download the talking video" }]
+                : []),
+            ...(data.status === "queued" || data.status === "processing"
+                ? [{ command: `naive clone status ${jobId}`, description: "Check again in 10-30 seconds" }]
+                : []),
+        ],
+        hints: [`Job status: ${data.status}`],
+        related_commands: ["naive clone generate", "naive jobs"],
+    });
+});
+// Upload a local image and return its presigned public URL (so fal can GET it). Mirrors
+// the local-file branch of `media upload` (multipart to /v1/media/upload/file).
+async function uploadLocalImage(filePath) {
+    const fileBuffer = readFileSync(filePath);
+    const filename = basename(filePath);
+    const config = loadConfig();
+    const url = `${config.base_url}/v1/media/upload/file`;
+    const formData = new FormData();
+    formData.append("file", new Blob([fileBuffer]), filename);
+    const resp = await fetch(url, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${getApiKey()}` },
+        body: formData,
+    });
+    const data = (await resp.json());
+    if (resp.status >= 400 || !data.url) {
+        formatApiError("clone.generate", data);
+        process.exit(1);
+    }
+    return data.url;
+}
+// Polls a clone job to completion for `clone generate --wait`. Mirrors video.ts's pollJob.
+async function pollJob(jobId) {
+    while (true) {
+        await new Promise((r) => setTimeout(r, 3000));
+        const resp = await apiRequest("GET", `/v1/jobs/${jobId}`);
+        const data = resp.data;
+        if (data.status === "completed" || data.status === "failed") {
+            const videoUrl = data.result?.url;
+            agentOutput({
+                action: "clone.generate.completed",
+                result: resp.data,
+                // On success surface a download command; on failure point at the full job details.
+                next_steps: data.status === "completed" && videoUrl
+                    ? [{ command: `curl -L -o clone.mp4 "${videoUrl}"`, description: "Download the talking video" }]
+                    : [{ command: `naive jobs get ${jobId}`, description: "Get full job details" }],
+                hints: [
+                    data.status === "completed"
+                        ? videoUrl
+                            ? `Clone generation complete — video: ${videoUrl}`
+                            : "Clone generation complete"
+                        : `Generation failed: ${data.error ?? "see job details"} (no credits deducted)`,
+                ],
+                related_commands: ["naive clone generate", "naive clone status", "naive jobs"],
+            });
+            return;
+        }
+        process.stderr.write(`  Progress: ${data.progress ?? 0}% (${data.status})\n`);
+    }
+}
+//# sourceMappingURL=clone.js.map

package/dist/commands/clone.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clone.js","sourceRoot":"","sources":["../../src/commands/clone.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE3D,uFAAuF;AACvF,+EAA+E;AAC/E,kFAAkF;AAClF,2FAA2F;AAC3F,MAAM,CAAC,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC;KACzC,WAAW,CAAC,+GAA+G,CAAC;KAC5H,WAAW,CAAC,OAAO,EAAE;;;;;;;;;;;;;CAavB,CAAC,CAAC;AAEH,QAAQ;KACL,OAAO,CAAC,UAAU,CAAC;KACnB,WAAW,CAAC,qDAAqD,CAAC;KAClE,cAAc,CAAC,cAAc,EAAE,qEAAqE,CAAC;KACrG,cAAc,CAAC,oBAAoB,EAAE,2DAA2D,CAAC;KACjG,cAAc,CAAC,iBAAiB,EAAE,0CAA0C,CAAC;KAC7E,MAAM,CAAC,uBAAuB,EAAE,mEAAmE,CAAC;KACpG,SAAS,CAAC,IAAI,MAAM,CAAC,kBAAkB,EAAE,8GAA8G,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;KAClL,MAAM,CAAC,YAAY,EAAE,4EAA4E,CAAC;KAClG,MAAM,CAAC,QAAQ,EAAE,iDAAiD,CAAC;KACnE,WAAW,CAAC,OAAO,EAAE;;;;;;;;;;;;;;;CAevB,CAAC;KACC,MAAM,CAAC,KAAK,EAAE,IAQd,EAAE,EAAE;IACH,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;YAC3B,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,gBAAgB;YACxB,KAAK,EAAE;gBACL,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,yFAAyF;aACnG;YACD,cAAc,EAAE;gBACd;oBACE,OAAO,EAAE,8EAA8E;oBACvF,WAAW,EAAE,qCAAqC;iBACnD;aACF;SACF,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,iFAAiF;IACjF,oFAAoF;IACpF,IAAI,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC;IAC1B,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;gBAC3B,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,gBAAgB;gBACxB,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,yBAAyB,IAAI,CAAC,KAAK,EAAE,EAAE;aACjF,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,oBAAoB,EAAE;QAC1D,QAAQ,EAAE,IAAI,CAAC,KAAK;QACpB,SAAS,EAAE,QAAQ;QACnB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,QAAQ,EAAE,IAAI;KACf,CAAC,CAAC;IACH,cAAc,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;IAEvC,MAAM,IAAI,GAAG,IAAI,CAAC,IAA0B,CAAC;IAC7C,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,WAAW,CAAC;YACV,MAAM,EAAE,0BAA0B;YAClC,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE;YAClD,UAAU,EAAE,EAAE;YACd,KAAK,EAAE,CAAC,qEAAqE,CAAC;SAC/E,CAAC,CAAC;QACH,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;SAAM,CAAC;QACN,WAAW,CAAC;YACV,MAAM,EAAE,0BAA0B;YAClC,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE;YACjD,UAAU,EAAE;gBACV,EAAE,OAAO,EAAE,sBAAsB,IAAI,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,iCAAiC,EAAE;gBAChG,EAAE,OAAO,EAAE,kBAAkB,IAAI,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,sBAAsB,EAAE;aAClF;YACD,KAAK,EAAE;gBACL,4BAA4B;gBAC5B,gDAAgD;gBAChD,2BAA2B;aAC5B;YACD,gBAAgB,EAAE,CAAC,oBAAoB,EAAE,YAAY,CAAC;SACvD,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,QAAQ;KACL,OAAO,CAAC,iBAAiB,CAAC;KAC1B,WAAW,CAAC,4CAA4C,CAAC;KACzD,WAAW,CAAC,OAAO,EAAE;;;;;CAKvB,CAAC;KACC,MAAM,CAAC,KAAK,EAAE,KAAa,EAAE,EAAE;IAC9B,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,aAAa,KAAK,EAAE,CAAC,CAAC;IAC3D,cAAc,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IAErC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAqD,CAAC;IACxE,WAAW,CAAC;QACV,MAAM,EAAE,cAAc;QACtB,MAAM,EAAE,IAAI,CAAC,IAAI;QACjB,UAAU,EAAE;YACV,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,WAAW,IAAI,IAAI,CAAC,MAAM,EAAE,GAAG;gBACjD,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,kCAAkC,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE,CAAC;gBAChH,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,YAAY;gBAC1D,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,sBAAsB,KAAK,EAAE,EAAE,WAAW,EAAE,8BAA8B,EAAE,CAAC;gBAC3F,CAAC,CAAC,EAAE,CAAC;SACR;QACD,KAAK,EAAE,CAAC,eAAe,IAAI,CAAC,MAAM,EAAE,CAAC;QACrC,gBAAgB,EAAE,CAAC,sBAAsB,EAAE,YAAY,CAAC;KACzD,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,wFAAwF;AACxF,gFAAgF;AAChF,KAAK,UAAU,gBAAgB,CAAC,QAAgB;IAC9C,MAAM,UAAU,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAEpC,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,QAAQ,uBAAuB,CAAC;IAEtD,MAAM,QAAQ,GAAG,IAAI,QAAQ,EAAE,CAAC;IAChC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAE1D,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC5B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,SAAS,EAAE,EAAE,EAAE;QACnD,IAAI,EAAE,QAAQ;KACf,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAqB,CAAC;IACrD,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACpC,cAAc,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;QACvC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC;AAClB,CAAC;AAED,2FAA2F;AAC3F,KAAK,UAAU,OAAO,CAAC,KAAa;IAClC,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,YAAY,KAAK,EAAE,CAAC,CAAC;QAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAkH,CAAC;QACrI,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC;YAClC,WAAW,CAAC;gBACV,MAAM,EAAE,0BAA0B;gBAClC,MAAM,EAAE,IAAI,CAAC,IAAI;gBACjB,mFAAmF;gBACnF,UAAU,EACR,IAAI,CAAC,MAAM,KAAK,WAAW,IAAI,QAAQ;oBACrC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,yBAAyB,QAAQ,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE,CAAC;oBAChG,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,kBAAkB,KAAK,EAAE,EAAE,WAAW,EAAE,sBAAsB,EAAE,CAAC;gBACnF,KAAK,EAAE;oBACL,IAAI,CAAC,MAAM,KAAK,WAAW;wBACzB,CAAC,CAAC,QAAQ;4BACR,CAAC,CAAC,sCAAsC,QAAQ,EAAE;4BAClD,CAAC,CAAC,2BAA2B;wBAC/B,CAAC,CAAC,sBAAsB,IAAI,CAAC,KAAK,IAAI,iBAAiB,wBAAwB;iBAClF;gBACD,gBAAgB,EAAE,CAAC,sBAAsB,EAAE,oBAAoB,EAAE,YAAY,CAAC;aAC/E,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;IAChF,CAAC;AACH,CAAC"}

package/dist/commands/config.d.ts

@@ -0,0 +1,2 @@
+import { Command } from "commander";
+export declare const configCmd: Command;

package/dist/commands/config.js

@@ -0,0 +1,36 @@
+import { Command } from "commander";
+import { loadConfig, saveConfig } from "../config.js";
+import { agentOutput, agentError } from "../output.js";
+export const configCmd = new Command("config").description("View or set CLI preferences (e.g. output format)");
+configCmd
+    .command("output <mode>")
+    .description("Set output format: human (friendly, interactive) | json (machine, default)")
+    .action((mode) => {
+    if (mode !== "human" && mode !== "json") {
+        agentError({
+            action: "config.output",
+            error: { code: "invalid_input", message: "mode must be 'human' or 'json'" },
+            recovery_steps: [{ command: "naive config output human", description: "Enable friendly output" }],
+        });
+        return;
+    }
+    saveConfig({ output: mode, human_hint_shown: true });
+    agentOutput({
+        action: "config.output",
+        result: { output: mode },
+        next_steps: [{ command: "naive voice list", description: "Try it" }],
+        hints: [mode === "human" ? "Friendly output enabled. Agents/scripts can still force JSON with --json or NAIVE_JSON=1." : "Machine JSON output set."],
+    });
+});
+configCmd
+    .command("show")
+    .description("Show current CLI preferences")
+    .action(() => {
+    const c = loadConfig();
+    agentOutput({
+        action: "config.show",
+        result: { output: c.output ?? "json (default)", base_url: c.base_url },
+        next_steps: [{ command: "naive config output human", description: "Switch to friendly output" }],
+    });
+});
+//# sourceMappingURL=config.js.map

package/dist/commands/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/commands/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAEvD,MAAM,CAAC,MAAM,SAAS,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,kDAAkD,CAAC,CAAC;AAE/G,SAAS;KACN,OAAO,CAAC,eAAe,CAAC;KACxB,WAAW,CAAC,4EAA4E,CAAC;KACzF,MAAM,CAAC,CAAC,IAAY,EAAE,EAAE;IACvB,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACxC,UAAU,CAAC;YACT,MAAM,EAAE,eAAe;YACvB,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,gCAAgC,EAAE;YAC3E,cAAc,EAAE,CAAC,EAAE,OAAO,EAAE,2BAA2B,EAAE,WAAW,EAAE,wBAAwB,EAAE,CAAC;SAClG,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,UAAU,CAAC,EAAE,MAAM,EAAE,IAAwB,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;IACzE,WAAW,CAAC;QACV,MAAM,EAAE,eAAe;QACvB,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;QACxB,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;QACpE,KAAK,EAAE,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,2FAA2F,CAAC,CAAC,CAAC,0BAA0B,CAAC;KACrJ,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,SAAS;KACN,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,8BAA8B,CAAC;KAC3C,MAAM,CAAC,GAAG,EAAE;IACX,MAAM,CAAC,GAAG,UAAU,EAAE,CAAC;IACvB,WAAW,CAAC;QACV,MAAM,EAAE,aAAa;QACrB,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,gBAAgB,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE;QACtE,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,2BAA2B,EAAE,WAAW,EAAE,2BAA2B,EAAE,CAAC;KACjG,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/commands/env.d.ts

@@ -1,7 +1,7 @@
 import { Command } from "commander";
 /**
- * Environments — switch the CLI between API environments (e.g. production vs a
- * staging/sandbox API), and create per-tenant preview sandboxes for testing
- * agent profiles without real sends/charges.
+ * Environments — the sandbox/production primitive (per-operator mode with
+ * stamped resources; see docs: getting-started/environments), plus the legacy
+ * base-URL switch and preview-sandbox helpers.
  */
 export declare const envCmd: Command;

package/dist/commands/env.js

@@ -1,13 +1,77 @@
 import { Command } from "commander";
 import { saveConfig, loadConfig } from "../config.js";
 import { agentOutput } from "../output.js";
+import { apiRequest } from "../client.js";
 /**
- * Environments — switch the CLI between API environments (e.g. production vs a
- * staging/sandbox API), and create per-tenant preview sandboxes for testing
- * agent profiles without real sends/charges.
+ * Environments — the sandbox/production primitive (per-operator mode with
+ * stamped resources; see docs: getting-started/environments), plus the legacy
+ * base-URL switch and preview-sandbox helpers.
  */
 export const envCmd = new Command("env")
-    .description("Manage API environments and per-tenant preview sandboxes");
+    .description("Operator environments (sandbox/production): status, promote, reset");
+/** Resolve the target user segment: explicit --user, else the active user. */
+function userSegment(user) {
+    if (user)
+        return user;
+    const active = loadConfig().active_user_id;
+    if (active)
+        return active;
+    throw new Error("No target user: pass --user <id> or set one with `naive use <id>`.");
+}
+envCmd
+    .command("status")
+    .description("Show the operator's current environment (sandbox|production)")
+    .option("--user <id>", "Target a specific tenant user")
+    .action(async (opts) => {
+    const uid = userSegment(opts.user);
+    const { status, data } = await apiRequest("GET", `/v1/users/${uid}/environment`);
+    agentOutput({
+        action: "env.status",
+        result: status === 200 ? data : { error: data, status },
+        next_steps: [
+            { command: `naive env promote --user ${uid} --to production`, description: "Promote to production" },
+            { command: `naive env reset --user ${uid} --sandbox`, description: "Purge sandbox resources (keeps audit)" },
+        ],
+    });
+});
+envCmd
+    .command("promote")
+    .description("Promote (or demote) the operator's environment")
+    .option("--user <id>", "Target a specific tenant user")
+    .option("--to <environment>", "Target environment: production|sandbox", "production")
+    .action(async (opts) => {
+    const uid = userSegment(opts.user);
+    const { status, data } = await apiRequest("POST", `/v1/users/${uid}/environment`, {
+        environment: opts.to,
+    });
+    agentOutput({
+        action: "env.promote",
+        result: status === 200 ? data : { error: data, status },
+        next_steps: [
+            { command: "naive env status", description: "Confirm the operator's mode" },
+        ],
+        hints: [
+            "Promote flips only the mode. Sandbox residue keeps its stamp: excluded from default listings, never billed against production caps; frozen sandbox approvals must be re-requested.",
+        ],
+    });
+});
+envCmd
+    .command("reset")
+    .description("Purge the operator's sandbox resources (audit/trajectories are retained)")
+    .option("--user <id>", "Target a specific tenant user")
+    .option("--sandbox", "Confirm the sandbox purge (required)")
+    .action(async (opts) => {
+    if (!opts.sandbox) {
+        throw new Error("Pass --sandbox to confirm: this deletes sandbox-stamped resources (never audit).");
+    }
+    const uid = userSegment(opts.user);
+    const { status, data } = await apiRequest("POST", `/v1/users/${uid}/environment/reset`, {});
+    agentOutput({
+        action: "env.reset",
+        result: status === 200 ? data : { error: data, status },
+        next_steps: [{ command: "naive env status", description: "Confirm the operator's mode" }],
+    });
+});
 envCmd
     .command("use")
     .description("Point the CLI at an API base URL (e.g. staging)")

package/dist/commands/env.js.map

@@ -1 +1 @@
-{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/commands/env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C;;;;GAIG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC;KACrC,WAAW,CAAC,0DAA0D,CAAC,CAAC;AAE3E,MAAM;KACH,OAAO,CAAC,KAAK,CAAC;KACd,WAAW,CAAC,iDAAiD,CAAC;KAC9D,QAAQ,CAAC,YAAY,EAAE,oDAAoD,CAAC;KAC5E,MAAM,CAAC,CAAC,OAAe,EAAE,EAAE;IAC1B,UAAU,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IACtD,WAAW,CAAC;QACV,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,QAAQ,EAAE;QAC3C,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,iDAAiD,EAAE,CAAC;QACzG,KAAK,EAAE,CAAC,mBAAmB,OAAO,6CAA6C,CAAC;KACjF,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,MAAM;KACH,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,+EAA+E,CAAC;KAC5F,MAAM,CAAC,eAAe,EAAE,mCAAmC,CAAC;KAC5D,MAAM,CAAC,cAAc,EAAE,sDAAsD,EAAE,YAAY,CAAC;KAC5F,MAAM,CAAC,CAAC,IAAwC,EAAE,EAAE;IACnD,+EAA+E;IAC/E,gFAAgF;IAChF,WAAW,CAAC;QACV,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE;YACN,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;YAC3B,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,YAAY;YAC/B,MAAM,EAAE,WAAW;SACpB;QACD,UAAU,EAAE;YACV,EAAE,OAAO,EAAE,mDAAmD,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,UAAU,CAAC,EAAE,WAAW,EAAE,+CAA+C,EAAE;SAC7J;QACD,KAAK,EAAE;YACL,6EAA6E;YAC7E,qGAAqG;SACtG;KACF,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/commands/env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C;;;;GAIG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC;KACrC,WAAW,CAAC,oEAAoE,CAAC,CAAC;AAErF,8EAA8E;AAC9E,SAAS,WAAW,CAAC,IAAa;IAChC,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC,cAAoC,CAAC;IACjE,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;AACxF,CAAC;AAED,MAAM;KACH,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,8DAA8D,CAAC;KAC3E,MAAM,CAAC,aAAa,EAAE,+BAA+B,CAAC;KACtD,MAAM,CAAC,KAAK,EAAE,IAAuB,EAAE,EAAE;IACxC,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,aAAa,GAAG,cAAc,CAAC,CAAC;IACjF,WAAW,CAAC;QACV,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE;QACvD,UAAU,EAAE;YACV,EAAE,OAAO,EAAE,4BAA4B,GAAG,kBAAkB,EAAE,WAAW,EAAE,uBAAuB,EAAE;YACpG,EAAE,OAAO,EAAE,0BAA0B,GAAG,YAAY,EAAE,WAAW,EAAE,uCAAuC,EAAE;SAC7G;KACF,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,MAAM;KACH,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,gDAAgD,CAAC;KAC7D,MAAM,CAAC,aAAa,EAAE,+BAA+B,CAAC;KACtD,MAAM,CAAC,oBAAoB,EAAE,wCAAwC,EAAE,YAAY,CAAC;KACpF,MAAM,CAAC,KAAK,EAAE,IAAmC,EAAE,EAAE;IACpD,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,aAAa,GAAG,cAAc,EAAE;QAChF,WAAW,EAAE,IAAI,CAAC,EAAE;KACrB,CAAC,CAAC;IACH,WAAW,CAAC;QACV,MAAM,EAAE,aAAa;QACrB,MAAM,EAAE,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE;QACvD,UAAU,EAAE;YACV,EAAE,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,6BAA6B,EAAE;SAC5E;QACD,KAAK,EAAE;YACL,oLAAoL;SACrL;KACF,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,MAAM;KACH,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,0EAA0E,CAAC;KACvF,MAAM,CAAC,aAAa,EAAE,+BAA+B,CAAC;KACtD,MAAM,CAAC,WAAW,EAAE,sCAAsC,CAAC;KAC3D,MAAM,CAAC,KAAK,EAAE,IAA0C,EAAE,EAAE;IAC3D,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,aAAa,GAAG,oBAAoB,EAAE,EAAE,CAAC,CAAC;IAC5F,WAAW,CAAC;QACV,MAAM,EAAE,WAAW;QACnB,MAAM,EAAE,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE;QACvD,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,6BAA6B,EAAE,CAAC;KAC1F,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,MAAM;KACH,OAAO,CAAC,KAAK,CAAC;KACd,WAAW,CAAC,iDAAiD,CAAC;KAC9D,QAAQ,CAAC,YAAY,EAAE,oDAAoD,CAAC;KAC5E,MAAM,CAAC,CAAC,OAAe,EAAE,EAAE;IAC1B,UAAU,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IACtD,WAAW,CAAC;QACV,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,QAAQ,EAAE;QAC3C,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,iDAAiD,EAAE,CAAC;QACzG,KAAK,EAAE,CAAC,mBAAmB,OAAO,6CAA6C,CAAC;KACjF,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,MAAM;KACH,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,+EAA+E,CAAC;KAC5F,MAAM,CAAC,eAAe,EAAE,mCAAmC,CAAC;KAC5D,MAAM,CAAC,cAAc,EAAE,sDAAsD,EAAE,YAAY,CAAC;KAC5F,MAAM,CAAC,CAAC,IAAwC,EAAE,EAAE;IACnD,+EAA+E;IAC/E,gFAAgF;IAChF,WAAW,CAAC;QACV,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE;YACN,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;YAC3B,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,YAAY;YAC/B,MAAM,EAAE,WAAW;SACpB;QACD,UAAU,EAAE;YACV,EAAE,OAAO,EAAE,mDAAmD,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,UAAU,CAAC,EAAE,WAAW,EAAE,+CAA+C,EAAE;SAC7J;QACD,KAAK,EAAE;YACL,6EAA6E;YAC7E,qGAAqG;SACtG;KACF,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/commands/images.js

@@ -19,7 +19,7 @@ Examples:
 
 Cost:
   - Image generation: dynamic, model-dependent (use GET /v1/images/pricing to preview)
-  - Pricing based on model costs, converted to credits ($0.50/credit)
+  - Pricing based on model costs, converted to credits ($0.05/credit)
   - Stock photo search: 0 credits (free)
   - Credits deducted only on successful job completion
 `);
@@ -60,7 +60,7 @@ Parameters (via --input JSON):
   output_format           "jpeg" or "png" (default: jpeg)
   enable_safety_checker   Boolean (default: true)
 
-Cost: dynamic — based on model pricing ($0.50/credit)
+Cost: dynamic — based on model pricing ($0.05/credit)
       Use 'GET /v1/images/pricing?model=<id>&num_images=<n>' to preview cost.
       Credits deducted only on successful completion. Failed jobs are free.
 `)

package/dist/commands/init.js

@@ -2,35 +2,50 @@ import { Command } from "commander";
 import { existsSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { agentOutput } from "../output.js";
-const STARTER_CONFIG = `import { defineConfig, cloud, agentTemplate, policy } from "@usenaive-sdk/iac";
+const STARTER_CONFIG = `import { defineConfig, cloud, business, agent, identity, skills } from "@usenaive-sdk/iac";
 
-// Naïve gives every agent its own governed real-world agent profile. This file
-// declares your project's own infrastructure (Path A) and the agent profile
-// template(s) each tenant gets. Run \`naive up\` to register it, then
-// \`naive agent-profiles provision <name>\` (or forUser(id).provision in the
-// server SDK) to instantiate one per tenant.
+// Naïve gives every agent its own governed, real-world identity. Declare your
+// project's shared infrastructure ONCE, then a blueprint per agent role. Run
+// \`naive up\` to set it up, then \`naive.forUser(id).provision("support")\`
+// (server SDK) or \`naive agent-profiles provision support --user <id>\` to
+// stamp out a fresh, isolated, governed copy per user.
 export default defineConfig({
   project: "my-project",
 
-  // Path A — your app's own shared infrastructure, as code. Omit this to bring
-  // your own backend (Supabase, your VPC, etc.) and use Naïve only for the
-  // regulated agent profile bundle.
+  // ── infrastructure: set up ONCE for the whole project ────────────────────
   infrastructure: {
-    web: cloud.web({ framework: "nextjs", dir: "." }),
-    database: cloud.postgres({ name: "app-db", size: "serverless" }),
-    uploads: cloud.bucket({ name: "app-uploads" }),
+    // Cloud — one instance, shared by everyone. Naïve injects the secrets
+    // (database URL, storage credentials…) into your runtime automatically.
+    cloud: {
+      website:  cloud.web({ framework: "nextjs", dir: "." }),
+      database: cloud.postgres({ size: "serverless" }),
+      storage:  cloud.bucket(),
+    },
+
+    // Business — the real-world programs each agent draws from. Turning one ON
+    // registers the shared parent; each agent gets its OWN instance via \`has\`.
+    business: {
+      identity: business.entity({ form: "llc", verify: "kyb" }),
+      email:    business.email({ domain: "mail.example.com" }),
+      cards:    business.cards({ funding: "balance" }),
+    },
   },
 
-  // The governed agent profile each tenant gets. Each entry is an agentTemplate.
-  agentProfiles: {
-    support: agentTemplate({
-      identity: { kind: "business" },
-      wallet: { card: "virtual", limit: "$50/day" },
-      comms: { email: { domain: "per-tenant" } },
-      policy: policy({
-        allow: ["cards.refund", "email.send", "search"],
-        approvals: [{ when: "cards.refund.amount > $50", via: "slack" }],
-      }),
+  // ── agents: a blueprint per ROLE ─────────────────────────────────────────
+  // Naïve stamps out a fresh, isolated copy per user:
+  //   naive.forUser(userId).provision("support")
+  agents: {
+    support: agent({
+      is: identity.business(),            // a real, monetizable entity
+      has: {
+        email: true,                      // own address under the verified domain
+        cards: { limit: "$50/day" },      // own spend-capped card
+      },
+      can: [skills.email, skills.search, skills.llm],
+      limits: {
+        budget: "$200/mo",                // alerts at 80%, hard-denies at cap
+        approve: [skills.cards.charge],   // human OK before money moves
+      },
     }),
   },
 });
@@ -61,7 +76,7 @@ export const initCmd = new Command("init")
             { command: "naive up", description: "Register the templates declared in naive.config.ts" },
             { command: "naive agent-profiles provision support --user <tenant>", description: "Provision an agent profile from a template" },
         ],
-        hints: ["Edit naive.config.ts to define your agent profile template(s): identity, wallet, comms, policy."],
+        hints: ["Edit naive.config.ts: declare shared infrastructure (cloud + business) once, then an agent blueprint per role (is / has / can / limits)."],
     });
 });
 //# sourceMappingURL=init.js.map

package/dist/commands/init.js.map

@@ -1 +1 @@
-{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgCtB,CAAC;AAEF,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC;KACvC,WAAW,CAAC,2DAA2D,CAAC;KACxE,MAAM,CAAC,SAAS,EAAE,uCAAuC,CAAC;KAC1D,MAAM,CAAC,CAAC,IAAyB,EAAE,EAAE;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,iBAAiB,CAAC,CAAC;IACpD,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACpC,WAAW,CAAC;YACV,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE;YAChC,UAAU,EAAE;gBACV,EAAE,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,wCAAwC,EAAE;gBACxF,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,oDAAoD,EAAE;aAC3F;YACD,KAAK,EAAE,CAAC,8EAA8E,CAAC;SACxF,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,aAAa,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;IAC5C,WAAW,CAAC;QACV,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;QAC/B,UAAU,EAAE;YACV,EAAE,OAAO,EAAE,iDAAiD,EAAE,WAAW,EAAE,0BAA0B,EAAE;YACvG,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,oDAAoD,EAAE;YAC1F,EAAE,OAAO,EAAE,wDAAwD,EAAE,WAAW,EAAE,4CAA4C,EAAE;SACjI;QACD,KAAK,EAAE,CAAC,iGAAiG,CAAC;KAC3G,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+CtB,CAAC;AAEF,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC;KACvC,WAAW,CAAC,2DAA2D,CAAC;KACxE,MAAM,CAAC,SAAS,EAAE,uCAAuC,CAAC;KAC1D,MAAM,CAAC,CAAC,IAAyB,EAAE,EAAE;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,iBAAiB,CAAC,CAAC;IACpD,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACpC,WAAW,CAAC;YACV,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE;YAChC,UAAU,EAAE;gBACV,EAAE,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,wCAAwC,EAAE;gBACxF,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,oDAAoD,EAAE;aAC3F;YACD,KAAK,EAAE,CAAC,8EAA8E,CAAC;SACxF,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,aAAa,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;IAC5C,WAAW,CAAC;QACV,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;QAC/B,UAAU,EAAE;YACV,EAAE,OAAO,EAAE,iDAAiD,EAAE,WAAW,EAAE,0BAA0B,EAAE;YACvG,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,oDAAoD,EAAE;YAC1F,EAAE,OAAO,EAAE,wDAAwD,EAAE,WAAW,EAAE,4CAA4C,EAAE;SACjI;QACD,KAAK,EAAE,CAAC,0IAA0I,CAAC;KACpJ,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/commands/keys.js

@@ -1,5 +1,5 @@
 import { Command } from "commander";
-import { apiRequest, handleApiError } from "../client.js";
+import { apiRequest, sessionRequest, handleApiError } from "../client.js";
 import { agentOutput } from "../output.js";
 export const keysCmd = new Command("keys")
     .description("Manage API keys for the current agent and company")
@@ -60,22 +60,40 @@ keysCmd
     .command("create")
     .description("Create a new API key for the current agent/company")
     .option("--name <name>", "Human-readable label for the key (e.g. 'CI Key', 'Production')")
+    .option("--scope <scope...>", "Restrict the key to a scope. Repeatable. Requires a signed-in session ('naive auth login'). Available: wallet:admin")
     .addHelpText("after", `
 Examples:
   $ naive keys create --name "Production Server"
   $ naive keys create --name "GitHub Actions"
+  $ naive keys create --name "Wallet ops (CI)" --scope wallet:admin
 
 What this does:
   Issues a new API key (nv_sk_live_...) for the current agent and company.
   The key is shown ONCE — save it securely.
 
+Scopes:
+  An unscoped key has full access. --scope narrows a key to one route family.
+  Minting a scoped key requires a signed-in SESSION, not an api key — because
+  "wallet:admin" GRANTS the wallet operator surface (fund/transfer/policy/sweep)
+  rather than restricting it, so a key that could mint it would be a way for an
+  agent to grant itself the float it is supposed to be denied.
+
+    wallet:admin   Administer per-agent crypto wallets headlessly (CI). Reaches
+                   /v1/users/*/wallet ONLY — deliberately NOT /payments, so the
+                   key can move the float but cannot spend it.
+
 Use cases:
   - Provisioning keys for different environments
   - Giving a key to a specific service/integration
   - Rotating keys (create new, revoke old)
 `)
     .action(async (opts) => {
-    const resp = await apiRequest("POST", "/v1/auth/keys", { name: opts.name });
+    const scopes = opts.scope?.length ? opts.scope : undefined;
+    // Scoped keys are session-only (see above), so they go over sessionRequest —
+    // apiRequest would send the agent bearer and be refused by the server.
+    const resp = scopes
+        ? await sessionRequest("POST", "/v1/auth/keys", { body: { name: opts.name, scopes } })
+        : await apiRequest("POST", "/v1/auth/keys", { name: opts.name });
     handleApiError("keys.create", resp);
     const data = resp.data;
     agentOutput({
@@ -92,9 +110,14 @@ Use cases:
             "IMPORTANT: Save this key now. It will not be shown again.",
             "Use this key as a Bearer token: Authorization: Bearer <key>",
             "Set as NAIVE_API_KEY environment variable for headless use",
+            ...(scopes?.length
+                ? [`This key is restricted to: ${scopes.join(", ")}. It cannot reach any other route family.`]
+                : []),
         ],
         related_commands: ["naive keys list", "naive keys revoke"],
-        help_markdown: "### Key Created\n\n**Save this key immediately** — it cannot be retrieved later.\n\nTo use:\n```bash\nexport NAIVE_API_KEY=\"" + data.api_key + "\"\n# or in requests:\ncurl -H \"Authorization: Bearer " + data.api_key + "\" ...\n```",
+        // Security: the raw key is echoed ONCE in result.api_key above. Do NOT interpolate it into
+        // these example commands — that multiplied it 3× and made it a copy-into-shell-history footgun.
+        help_markdown: "### Key Created\n\n**Save the `api_key` above immediately** — it cannot be retrieved later.\n\nTo use:\n```bash\nexport NAIVE_API_KEY=\"<your-key>\"\n# or in requests:\ncurl -H \"Authorization: Bearer <your-key>\" ...\n```",
     });
 });
 keysCmd

package/dist/commands/keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../src/commands/keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC;KACvC,WAAW,CAAC,mDAAmD,CAAC;KAChE,WAAW,CAAC,OAAO,EAAE;;;;;;;;;;;;;;;CAevB,CAAC,CAAC;AAEH,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,iDAAiD,CAAC;KAC9D,WAAW,CAAC,OAAO,EAAE;;;;;;;;;;;CAWvB,CAAC;KACC,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IACtD,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAElC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAuE,CAAC;IAC1F,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAC9D,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAE9D,WAAW,CAAC;QACV,MAAM,EAAE,WAAW;QACnB,MAAM,EAAE,IAAI,CAAC,IAAI;QACjB,UAAU,EAAE;YACV,EAAE,OAAO,EAAE,kCAAkC,EAAE,WAAW,EAAE,sBAAsB,EAAE,IAAI,EAAE,mDAAmD,EAAE;YAC/I,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;gBACvB,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,4BAA4B,EAAE,WAAW,EAAE,sBAAsB,EAAE,IAAI,EAAE,iDAAiD,EAAE,CAAC;gBAC3I,CAAC,CAAC,EAAE,CAAC;SACR;QACD,KAAK,EAAE;YACL,GAAG,UAAU,CAAC,MAAM,iBAAiB,WAAW,CAAC,MAAM,UAAU;YACjE,mEAAmE;SACpE;QACD,gBAAgB,EAAE,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,cAAc,CAAC;KAC7E,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,oDAAoD,CAAC;KACjE,MAAM,CAAC,eAAe,EAAE,gEAAgE,CAAC;KACzF,WAAW,CAAC,OAAO,EAAE;;;;;;;;;;;;;CAavB,CAAC;KACC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,eAAe,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5E,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IAEpC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAyD,CAAC;IAE5E,WAAW,CAAC;QACV,MAAM,EAAE,aAAa;QACrB,MAAM,EAAE;YACN,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB;QACD,UAAU,EAAE;YACV,EAAE,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,6CAA6C,EAAE;SAC3F;QACD,KAAK,EAAE;YACL,2DAA2D;YAC3D,6DAA6D;YAC7D,4DAA4D;SAC7D;QACD,gBAAgB,EAAE,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;QAC1D,aAAa,EAAE,+HAA+H,GAAG,IAAI,CAAC,OAAO,GAAG,yDAAyD,GAAG,IAAI,CAAC,OAAO,GAAG,aAAa;KACzP,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,iBAAiB,CAAC;KAC1B,WAAW,CAAC,kDAAkD,CAAC;KAC/D,WAAW,CAAC,OAAO,EAAE;;;;;;;;;;;;CAYvB,CAAC;KACC,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,EAAE;IAC3B,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAC;IAC/D,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IAEpC,WAAW,CAAC;QACV,MAAM,EAAE,aAAa;QACrB,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;QACrC,UAAU,EAAE;YACV,EAAE,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,iCAAiC,EAAE;YAC9E,EAAE,OAAO,EAAE,kCAAkC,EAAE,WAAW,EAAE,oCAAoC,EAAE;SACnG;QACD,KAAK,EAAE;YACL,yCAAyC;YACzC,oDAAoD;SACrD;QACD,gBAAgB,EAAE,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;KAC3D,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../src/commands/keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC;KACvC,WAAW,CAAC,mDAAmD,CAAC;KAChE,WAAW,CAAC,OAAO,EAAE;;;;;;;;;;;;;;;CAevB,CAAC,CAAC;AAEH,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,iDAAiD,CAAC;KAC9D,WAAW,CAAC,OAAO,EAAE;;;;;;;;;;;CAWvB,CAAC;KACC,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IACtD,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAElC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAuE,CAAC;IAC1F,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAC9D,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAE9D,WAAW,CAAC;QACV,MAAM,EAAE,WAAW;QACnB,MAAM,EAAE,IAAI,CAAC,IAAI;QACjB,UAAU,EAAE;YACV,EAAE,OAAO,EAAE,kCAAkC,EAAE,WAAW,EAAE,sBAAsB,EAAE,IAAI,EAAE,mDAAmD,EAAE;YAC/I,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;gBACvB,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,4BAA4B,EAAE,WAAW,EAAE,sBAAsB,EAAE,IAAI,EAAE,iDAAiD,EAAE,CAAC;gBAC3I,CAAC,CAAC,EAAE,CAAC;SACR;QACD,KAAK,EAAE;YACL,GAAG,UAAU,CAAC,MAAM,iBAAiB,WAAW,CAAC,MAAM,UAAU;YACjE,mEAAmE;SACpE;QACD,gBAAgB,EAAE,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,cAAc,CAAC;KAC7E,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,oDAAoD,CAAC;KACjE,MAAM,CAAC,eAAe,EAAE,gEAAgE,CAAC;KACzF,MAAM,CACL,oBAAoB,EACpB,qHAAqH,CACtH;KACA,WAAW,CAAC,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;CAyBvB,CAAC;KACC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,MAAM,MAAM,GAAyB,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,6EAA6E;IAC7E,uEAAuE;IACvE,MAAM,IAAI,GAAG,MAAM;QACjB,CAAC,CAAC,MAAM,cAAc,CAAC,MAAM,EAAE,eAAe,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC;QACtF,CAAC,CAAC,MAAM,UAAU,CAAC,MAAM,EAAE,eAAe,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACnE,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IAEpC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAyD,CAAC;IAE5E,WAAW,CAAC;QACV,MAAM,EAAE,aAAa;QACrB,MAAM,EAAE;YACN,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB;QACD,UAAU,EAAE;YACV,EAAE,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,6CAA6C,EAAE;SAC3F;QACD,KAAK,EAAE;YACL,2DAA2D;YAC3D,6DAA6D;YAC7D,4DAA4D;YAC5D,GAAG,CAAC,MAAM,EAAE,MAAM;gBAChB,CAAC,CAAC,CAAC,8BAA8B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,2CAA2C,CAAC;gBAC9F,CAAC,CAAC,EAAE,CAAC;SACR;QACD,gBAAgB,EAAE,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;QAC1D,2FAA2F;QAC3F,gGAAgG;QAChG,aAAa,EAAE,gOAAgO;KAChP,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,iBAAiB,CAAC;KAC1B,WAAW,CAAC,kDAAkD,CAAC;KAC/D,WAAW,CAAC,OAAO,EAAE;;;;;;;;;;;;CAYvB,CAAC;KACC,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,EAAE;IAC3B,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAC;IAC/D,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IAEpC,WAAW,CAAC;QACV,MAAM,EAAE,aAAa;QACrB,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;QACrC,UAAU,EAAE;YACV,EAAE,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,iCAAiC,EAAE;YAC9E,EAAE,OAAO,EAAE,kCAAkC,EAAE,WAAW,EAAE,oCAAoC,EAAE;SACnG;QACD,KAAK,EAAE;YACL,yCAAyC;YACzC,oDAAoD;SACrD;QACD,gBAAgB,EAAE,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;KAC3D,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/commands/loops.d.ts

@@ -0,0 +1,2 @@
+import { Command } from "commander";
+export declare const loopsCmd: Command;