@vapi-network/cli 0.7.0 → 0.9.0

package/README.md

@@ -6,6 +6,9 @@ discovery, payment, receipts, the OS secret store and the MCP launcher. The
 wallet key stays encrypted on the local machine and every x402 payment is signed
 locally.
 
+The `vapi docs`, `vapi docs search` and `vapi docs read` commands access the
+public documentation without a wallet, account or payment.
+
 Two entry points: `@vapi-network/cli` exports `runCli` and the `HELP` text for
 embedding, and `@vapi-network/cli/cli` is the executable itself.
 

package/dist/agent.d.ts

@@ -1,5 +1,5 @@
-import { listAgentProfiles, readAgentProfile, readSpendLedgerRows, removeAgentProfile, writeAgentProfile } from "@vapi-network/core";
-import { createAgentRunDeps, getWallet, runAgent } from "@vapi-network/mcp";
+import { listAgentProfiles, readAgentProfile, readSpendLedgerRows, removeAgentProfile, writeAgentProfile, type AgentProfile, type RunBudget } from "@vapi-network/core";
+import { createAgentRunDeps, getWallet, runAgent, type AgentEvent, type RunAgentDeps } from "@vapi-network/mcp";
 import { type CliDependencies, type CliIo } from "./cli.js";
 export type AgentCommandDependencies = {
     readAgentProfile?: typeof readAgentProfile;
@@ -12,3 +12,24 @@ export type AgentCommandDependencies = {
     getWallet?: typeof getWallet;
 };
 export declare function agentCommand(argv: string[], json: boolean, io: CliIo, dependencies: CliDependencies): Promise<number>;
+export declare function buildAgentRunDeps(input: {
+    profile: AgentProfile;
+    runId: string;
+    budget?: RunBudget;
+    allowanceExpiresAt?: Date;
+    runMeta?: {
+        swarm?: string;
+        member?: string;
+        parentRunId?: string;
+    };
+    approvals: "tty" | "decline";
+    onEvent?: (event: AgentEvent) => void;
+    json: boolean;
+    io: CliIo;
+    dependencies: CliDependencies;
+}): Promise<RunAgentDeps>;
+export declare function positiveUsdOption(value: string, option: string): {
+    text: string;
+    number: number;
+    atomic: string;
+};

package/dist/cli.d.ts

@@ -1,8 +1,12 @@
-import { drainCeilingSweeps, sweepBack, WalletStore, type AuditEvent, type CeilingBalanceReader, type CeilingSiblingsFetcher, type CeilingTransfer, type DistributeArgs, type ListingVerification, type SecretStore, type VapiConfig, type VapiPaymentAccount, type WalletBalanceReader, type WalletEntry, type WalletName, type TransferArgs } from "@vapi-network/core";
+import { drainCeilingSweeps, sweepAboveCeiling, sweepBack, WalletStore, type AuditEvent, type CeilingBalanceReader, type CeilingSiblingsFetcher, type CeilingTransfer, type DistributeArgs, type ListingVerification, type SecretStore, type SwarmCapitalDeps, type VapiConfig, type VapiPaymentAccount, type WalletBalanceReader, type WalletEntry, type WalletName, type TransferArgs } from "@vapi-network/core";
 import { type pollDeviceLink, type startDeviceLink } from "@vapi-network/core/agent-link";
 import type { buyRouterBalance, listRouterModels, ownerStake, rotateRouterKey, routerChat, routerCredentials, routerUsage } from "@vapi-network/core/router-client";
+import { type Runtime, type RuntimeKind, type runSwarm } from "@vapi-network/mcp";
 import { type AgentCommandDependencies } from "./agent.js";
-export declare const HELP = "vAPI Network\n\nUsage:\n  vapi init [--networks <base,arc,solana>] [--json]\n  vapi setup [--no-cloud-backup] [--json]\n  vapi accounts [--all] [--json]\n  vapi accounts add <name> [--label <text>] [--no-link] [--json]\n  vapi accounts import <name> [--keystore <path> | --key-file <path>] [--label <text>] [--json]\n  vapi accounts rename <old> <new> [--json]\n  vapi accounts use <name> [--json]\n  vapi accounts remove <name> [--force] [--json]\n  vapi accounts restore <name> [--json]\n  vapi accounts caps <name> [--per-call <usd>] [--per-day <usd>] [--ceiling <usd|off>] [--json]\n  vapi accounts distribute <amount> --from <account> [--to <a,b,c>] [--network base|arc] [--json]\n  vapi accounts distribute --resume <id> [--json]\n  vapi send <amount> --from <account> --to <account|owner|0x\u2026> [--network base|arc] [--resume <nonce>] [--json]\n  vapi fund [--amount <usd>] [--account <name>] [--json]\n  vapi search [query] [--kind <kind>] [--network <caip2>] [--limit <n>] [--cursor <cursor>] [--include-unverified] [--json]\n  vapi inspect <id> [--endpoint <name>] [--json]\n  vapi pay <id-or-url> [--method <method>] [--endpoint <name>] [--body <json>] [--content-type <type>] [--network <caip2>] [--expected-pay-to <address>] [--max <amount>] [--account <name>] [--json]\n  vapi pay --resume <receipt-id> [--json]\n  vapi check <url> [--method <method>] [--json]\n  vapi balance [--account <name>] [--json]\n  vapi receipts [--limit <n>] [--account <name>] [--all-wallets] [--json]\n  vapi receipts export --format <json|csv> [--range <24h|7d|30d>] [--account <name>] [--all-wallets]\n  vapi stats [--range <24h|7d|30d>] [--account <name>] [--all-wallets] [--json]\n  vapi sweep [<address>] [--network <caip2>] [--account <name>] [--json]\n  vapi agent create <name> --model <id> --instructions <file> [--call-budget <usd>] [--max-per-call <usd>] [--router-budget <usd>] [--approve-above <usd>] [--include-unverified] [--max-steps <n>] [--json]\n  vapi agent run <name> \"<task>\" [--json]\n  vapi agent list [--json]\n  vapi agent pause <name> [--json]\n  vapi agent resume <name> [--json]\n  vapi agent revoke <name> [--json]\n  vapi login [--account <name>] [--label <name>] [--publish] [--no-browser] [--json]\n  vapi logout [--account <name>] [--json]\n  vapi whoami [--account <name>] [--json]\n  vapi router models [--account <name>] [--json]\n  vapi router usage [--account <name>] [--json]\n  vapi router chat --model <id> [--system <text>] [--max-tokens <n>] \"<prompt>\" [--account <name>] [--json]\n  vapi router buy <1|5|20|50> [--account <name>] [--json]\n  vapi router buy --auto <1|5|20|50> --below <usd> [--account <name>] [--json]\n  vapi router buy --auto off [--account <name>] [--json]\n  vapi router key [--rotate] [--account <name>] [--json]\n  vapi stake status [--account <name>] [--json]\n  vapi stake open [--account <name>] [--no-browser] [--json]\n  vapi export-key [--network <caip2>] [--account <name>] [--json]\n  vapi backup [--account <name>] [--cloud [off]] [--json]\n  vapi restore [--from-owner [--owner <0x\u2026>]] [--json]\n  vapi import (--phrase | --key) [--account <name>] [--networks <base,arc,solana>] [--replace] [--force] [--json]\n  vapi passphrase [--account <name>] [--json]\n  vapi vault protect [--json]\n  vapi vault unprotect [--json]\n  vapi vault lock [--json]\n  vapi vault unlock [--json]\n  vapi vault status [--json]\n  vapi unlock [--account <name>] [--json]\n  vapi lock [--account <name> | --all] [--json]\n  vapi report \"<what happened>\" [--include-addresses] [--send] [--json]\n  vapi auth set-key [--json]\n  vapi auth status [--json]\n  vapi auth clear [--json]\n  vapi publish <url> [--method <method>] [--mode <origin|endpoint|openapi>] [--name <text>] [--description <text>] [--category <ai|data|crypto|compute|search>] [--select <names>] [--account <name>] [--yes] [--resume] [--json]\n  vapi publish activate <slug> [--json]\n  vapi publish verify-request <slug> [--json]\n  vapi publish list [--json]\n  vapi claim <origin> [--account <name>] [--json]\n  vapi mcp [--account <name>] [--json]\n  vapi mcp install <claude|cursor|codex> [--home <dir>] [--registry <url>] [--json]\n  vapi serve [--json]\n  vapi version [--json]\n  vapi help [--json]\n\nEvery command that touches a wallet takes `--account <name>`, falls back to `VAPI_WALLET`, then to the default account set by `vapi accounts use`, and names the wallet it used on its first line.\n\n`vapi search` answers with vAPI-verified listings plus the mirrored external catalogs. `--include-unverified` also returns self-listed APIs that passed vAPI's automated x402 probe but were never reviewed; every result is tagged `[verified]`, `[requested]`, `[unverified]` or `[external]`.\n\n`vapi check <url>` grades an x402 API's 402 without paying: status, transport, declared version and its required fields, the exact scheme, canonical USDC, payTo, maxTimeoutSeconds, advertised extensions, and the origin's /.well-known/x402. It looks for OpenAPI beside the checked path, at /openapi.json, then through same-origin service-desc links in /.well-known/api-catalog. No wallet, no payment, no registry call. It exits 1 when a rule fails. A 402 that answers with Stripe/Tempo's MPP challenge (WWW-Authenticate: Payment) is recognised and reported as transport mpp; vapi pay cannot pay it.\n\n`vapi pay --resume <receipt-id>` answers the one question a lost response leaves: did that payment settle? It reads the signed authorization's state on-chain \u2014 settled, expired, or still pending \u2014 and never pays.\n\n`vapi fund` opens the funding page: card via Coinbase (needs a Coinbase account; US guest checkout), send from MetaMask/Coinbase Wallet/WalletConnect, or bridge from another chain.\n\n`vapi vault protect` adds a password to the device vault. `vapi vault unlock` opens it on this device for 8 hours; for unattended use, set `VAPI_VAULT_PASSWORD`. `vapi unlock` and `vapi lock` remain aliases for one release.\n\n`vapi backup` and `vapi export-key` print a secret, so they run only on a real terminal, never for an agent, and ask you to type the wallet name first. `vapi backup --cloud` keeps an encrypted vault copy that only the owner can approve for recovery. `vapi restore` rebuilds the vault from the phrase and re-derives accounts until an unused address. Set `VAPI_NO_SECRETS=1` to switch exports off entirely. Every export and every wallet change is logged to ~/.vapi/audit.log.\n\n`vapi publish <url>` lists an API you own. vAPI probes the URL \u2014 an origin, one endpoint, or an OpenAPI document \u2014 you choose which endpoints to list, and your wallet signs one line naming where the payouts go. Listing is permissionless: a listing that passed the probe goes live with `vapi publish activate <slug>`, and `vapi publish verify-request <slug>` asks for the review that puts it in the default search. Deploying the FeeSplitter that receives the payouts is a wallet transaction and stays in the console. A catalog of more than 20 endpoints is listed as several listings of up to 20, with one result line per endpoint; `--resume` skips every endpoint this key already lists.\n\n`vapi claim <origin>` takes ownership of the listings vAPI indexed from your API. The wallet their payments go to signs one line, `Claim the vAPI Call listings served from <origin>`; the listings stay paid directly to that wallet, and `vapi publish list` shows them.\n\n`vapi auth set-key` types the registry API key once, on a terminal, into the same OS secret store as the passphrase. A key is a secret: it is never an argument, `VAPI_API_KEY` is the route for CI, and no agent or MCP tool can reach it.\n\nWith no command, vapi shows the status screen; vapi help prints this text. The MCP server starts only with `vapi mcp`; `vapi mcp install <app>` writes that app's MCP config and prints the file it touched.";
+import { type TasksCommandDependencies } from "./task.js";
+import { type RuntimeRequest } from "./runtime-local.js";
+import { type RailwayExec } from "./runtime-railway.js";
+export declare const HELP = "vAPI Network\n\nUsage:\n  vapi init [--networks <base,arc,solana>] [--json]\n  vapi setup [--no-cloud-backup] [--json]\n  vapi accounts [--all] [--json]\n  vapi accounts add <name> [--label <text>] [--no-link] [--json]\n  vapi accounts import <name> [--keystore <path> | --key-file <path>] [--label <text>] [--json]\n  vapi accounts rename <old> <new> [--json]\n  vapi accounts use <name> [--json]\n  vapi accounts remove <name> [--force] [--json]\n  vapi accounts restore <name> [--json]\n  vapi accounts caps <name> [--per-call <usd>] [--per-day <usd>] [--ceiling <usd|off>] [--json]\n  vapi accounts distribute <amount> --from <account> [--to <a,b,c>] [--network base|arc] [--json]\n  vapi accounts distribute --resume <id> [--replace-expired-restored] [--bind-legacy-addresses] [--json]\n  vapi accounts distribute --cancel <id> [--replace-expired-restored] [--json]\n  vapi swarm create <name> [--agents <n>|--roles <a,b,c>] [--fund <usd> --from <account>] [--strategy <targets|even|weights>] [--targets <role=usd,...>] [--caps <perCall>/<perDay>] [--treasury-caps <perCall>/<perDay>] [--network <base|arc>] [--model <id>] [--no-wait] [--json]\n  vapi swarm add <name> <role> [--json]\n  vapi swarm remove <name> <member> [--json]\n  vapi swarm fund <name> <usd> [--from <account>] [--json]\n  vapi swarm rebalance <name> [--targets <role=usd,...>] [--json]\n  vapi swarm status <name> [--json]\n  vapi swarm dissolve <name> [--json]\n  vapi swarm run <name> \"<task>\" [--mode lead|each] [--lead <member>] [--budget <usd>] [--draw <usd>] [--detach] [--runtime local|railway] [--result-file <path>] [--json]\n  vapi swarm run <name> \"<task>\" --mode each --runtime railway --checkpoint <name> --allow-remote-key [--budget <usd>] [--keep-sandbox] [--json]\n  vapi swarm runs <name> [--json]\n  vapi swarm stop <name> [<runId>|--all] [--confirm-worker-stopped] [--json]\n  vapi send <amount> --from <account> --to <account|owner|0x\u2026> [--network base|arc] [--resume <nonce>] [--json]\n  vapi fund [--amount <usd>] [--account <name>] [--json]\n  vapi docs \"<question>\" [--json]\n  vapi docs search \"<query>\" [--json]\n  vapi docs read <url-or-path> [--json]\n  vapi search [query] [--kind <kind>] [--network <caip2>] [--limit <n>] [--cursor <cursor>] [--include-unverified] [--json]\n  vapi inspect <id> [--endpoint <name>] [--json]\n  vapi pay <id-or-url> [--method <method>] [--endpoint <name>] [--body <json>] [--content-type <type>] [--network <caip2>] [--expected-pay-to <address>] [--max <amount>] [--account <name>] [--json]\n  vapi pay --resume <receipt-id> [--json]\n  vapi check <url> [--method <method>] [--json]\n  vapi balance [--account <name>] [--json]\n  vapi receipts [--limit <n>] [--account <name>] [--all-wallets] [--json]\n  vapi receipts export --format <json|csv> [--range <24h|7d|30d>] [--account <name>] [--all-wallets]\n  vapi stats [--range <24h|7d|30d>] [--account <name>] [--all-wallets] [--json]\n  vapi sweep [<address>] [--network <caip2>] [--account <name>] [--json]\n  vapi agent create <name> --model <id> --instructions <file> [--call-budget <usd>] [--max-per-call <usd>] [--router-budget <usd>] [--approve-above <usd>] [--max-per-task <usd>] [--auto-release-below <usd>] [--include-unverified] [--max-steps <n>] [--yes] [--json]\n  vapi agent run <name> \"<task>\" [--budget <usd>] [--detach] [--runtime local] [--result-file <path>] [--json]\n  vapi agent run --bundle-env <VAR> (\"<task>\" | --task-base64url <text>) [--budget <usd>] [--result-file <path>] [--json]\n  vapi agent list [--json]\n  vapi agent show <name> [--json]\n  vapi agent pause <name> [--json]\n  vapi agent resume <name> [--json]\n  vapi agent revoke <name> [--json]\n  vapi login [--account <name>] [--label <name>] [--publish] [--no-browser] [--json]\n  vapi logout [--account <name>] [--json]\n  vapi whoami [--account <name>] [--json]\n  vapi router models [--account <name>] [--json]\n  vapi router usage [--account <name>] [--json]\n  vapi router chat --model <id> [--system <text>] [--max-tokens <n>] \"<prompt>\" [--account <name>] [--json]\n  vapi router buy <1|5|20|50> [--account <name>] [--json]\n  vapi router buy --auto <1|5|20|50> --below <usd> [--account <name>] [--json]\n  vapi router buy --auto off [--account <name>] [--json]\n  vapi router key [--rotate] [--account <name>] [--json]\n  vapi stake status [--account <name>] [--json]\n  vapi stake open [--account <name>] [--no-browser] [--json]\n  vapi task search [--open] [--min <usd>] [--tab trending|new|closing|paid] [--limit <n>] [--json]\n  vapi task show <id> [--account <name>] [--json]\n  vapi task post --title <text> --brief <file|-> --amount <usd> --deadline <duration|ISO> [--intake proposals|submissions] [--max-awards <k>] [--webhook <https-url>] [--account <name>] [--json]\n  vapi task propose <id> --price <usd> --duration <duration> --note <text> [--account <name>] [--json]\n  vapi task submit <id> --proof <https-url> [--proof <https-url>...] [--file <path>...] [--account <name>] [--json]\n  vapi task award <id> <proposalId> [--account <name>] [--json]\n  vapi task sign <id> [--account <name>] [--json]\n  vapi task fund <id> [--yes] [--account <name>] [--json]\n  vapi task deliver <id> --files <path...> --note <text> [--account <name>] [--json]\n  vapi task release <id> [--account <name>] [--json]\n  vapi task refund <id> [--account <name>] [--json]\n  vapi task dispute <id> --evidence-hash <0x + 64 hex> [--account <name>] [--json]\n  vapi task message <id> <text> [--account <name>] [--json]\n  vapi task thread <id> [--after <cursor>] [--account <name>] [--json]\n  vapi task watch <id> [--until <state>] [--auto-release] [--timeout 7d] [--interval 5s] [--account <name>] [--json]\n  vapi task status <id> [--account <name>] [--json]\n  vapi export-key [--network <caip2>] [--account <name>] [--json]\n  vapi backup [--account <name>] [--cloud [off]] [--json]\n  vapi restore [--from-owner [--owner <0x\u2026>]] [--json]\n  vapi import (--phrase | --key) [--account <name>] [--networks <base,arc,solana>] [--replace] [--force] [--json]\n  vapi passphrase [--account <name>] [--json]\n  vapi vault protect [--json]\n  vapi vault unprotect [--json]\n  vapi vault lock [--json]\n  vapi vault unlock [--json]\n  vapi vault status [--json]\n  vapi unlock [--account <name>] [--json]\n  vapi lock [--account <name> | --all] [--json]\n  vapi report \"<what happened>\" [--include-addresses] [--send] [--json]\n  vapi auth set-key [--json]\n  vapi auth status [--json]\n  vapi auth clear [--json]\n  vapi publish <url> [--method <method>] [--mode <origin|endpoint|openapi>] [--name <text>] [--description <text>] [--category <ai|data|crypto|compute|search>] [--select <names>] [--account <name>] [--yes] [--resume] [--json]\n  vapi publish activate <slug> [--json]\n  vapi publish verify-request <slug> [--json]\n  vapi publish list [--json]\n  vapi claim <origin> [--account <name>] [--json]\n  vapi mcp [--account <name>] [--json]\n  vapi mcp install <claude|cursor|codex> [--home <dir>] [--registry <url>] [--json]\n  vapi serve [--json]\n  vapi version [--json]\n  vapi help [--json]\n\nEvery command that touches a wallet takes `--account <name>`, falls back to `VAPI_WALLET`, then to the default account set by `vapi accounts use`, and names the wallet it used on its first line.\n\n`vapi search` answers with vAPI-verified listings plus the mirrored external catalogs. `--include-unverified` also returns self-listed APIs that passed vAPI's automated x402 probe but were never reviewed; every result is tagged `[verified]`, `[requested]`, `[unverified]` or `[external]`.\n\n`vapi docs` asks the public vAPI documentation assistant; `vapi docs search` searches documentation excerpts and `vapi docs read` reads one Markdown page. They need no account, wallet or payment.\n\n`vapi task --help` lists task options and availability. Task exit codes: 0 ok, 1 error, 2 policy refusal (JSON ok:false with a policy. reason) or invalid usage (JSON error), 3 approval needed in non-interactive mode. Posting moves no money; the current create-order contract does not store amount, deadline, intake, max awards or webhook yet.\n\n`vapi check <url>` grades an x402 API's 402 without paying: status, transport, declared version and its required fields, the exact scheme, canonical USDC, payTo, maxTimeoutSeconds, advertised extensions, and the origin's /.well-known/x402. It looks for OpenAPI beside the checked path, at /openapi.json, then through same-origin service-desc links in /.well-known/api-catalog. No wallet, no payment, no registry call. It exits 1 when a rule fails. A 402 that answers with Stripe/Tempo's MPP challenge (WWW-Authenticate: Payment) is recognised and reported as transport mpp; vapi pay cannot pay it.\n\n`vapi pay --resume <receipt-id>` answers the one question a lost response leaves: did that payment settle? It reads the signed authorization's state on-chain \u2014 settled, expired, or still pending \u2014 and never pays.\n\n`vapi fund` opens the funding page: card via Coinbase (needs a Coinbase account; US guest checkout), send from MetaMask/Coinbase Wallet/WalletConnect, or bridge from another chain.\n\n`vapi vault protect` adds a password to the device vault. `vapi vault unlock` opens it on this device for 8 hours; for unattended use, set `VAPI_VAULT_PASSWORD`. `vapi unlock` and `vapi lock` remain aliases for one release.\n\n`vapi backup` and `vapi export-key` print a secret, so they run only on a real terminal, never for an agent, and ask you to type the wallet name first. `vapi backup --cloud` keeps an encrypted vault copy that only the owner can approve for recovery. `vapi restore` rebuilds the vault from the phrase and re-derives accounts until an unused address. Set `VAPI_NO_SECRETS=1` to switch exports off entirely. Every export and every wallet change is logged to ~/.vapi/audit.log.\n\n`vapi publish <url>` lists an API you own. vAPI probes the URL \u2014 an origin, one endpoint, or an OpenAPI document \u2014 you choose which endpoints to list, and your wallet signs one line naming where the payouts go. Listing is permissionless: a listing that passed the probe goes live with `vapi publish activate <slug>`, and `vapi publish verify-request <slug>` asks for the review that puts it in the default search. Deploying the FeeSplitter that receives the payouts is a wallet transaction and stays in the console. A catalog of more than 20 endpoints is listed as several listings of up to 20, with one result line per endpoint; `--resume` skips every endpoint this key already lists.\n\n`vapi claim <origin>` takes ownership of the listings vAPI indexed from your API. The wallet their payments go to signs one line, `Claim the vAPI Call listings served from <origin>`; the listings stay paid directly to that wallet, and `vapi publish list` shows them.\n\n`vapi auth set-key` types the registry API key once, on a terminal, into the same OS secret store as the passphrase. A key is a secret: it is never an argument, `VAPI_API_KEY` is the route for CI, and no agent or MCP tool can reach it.\n\nWith no command, vapi shows the status screen; vapi help prints this text. The MCP server starts only with `vapi mcp`; `vapi mcp install <app>` writes that app's MCP config and prints the file it touched.";
 export type CliIo = {
     stdout(message: string): void;
     stderr(message: string): void;
@@ -26,6 +30,13 @@ export type CliDependencies = {
     stdinIsTTY?: boolean;
     /** The environment this run sees: wallet selection and agent detection. */
     env?: NodeJS.ProcessEnv;
+    /**
+     * Runtime adapter selection, injected so CLI tests never spawn real children.
+     * A `vapi swarm run --runtime railway` start passes its request as well.
+     */
+    runtime?: (kind: RuntimeKind, home: string, request?: RuntimeRequest) => Runtime;
+    /** The `railway` CLI executor, injected so tests never run the real binary. */
+    railwayExec?: RailwayExec;
     /** The OS secret store `vapi unlock` and `vapi lock` act on. */
     secretStore?: SecretStore;
     /** Injected clock, so a signed message is reproducible in a test. */
@@ -48,6 +59,8 @@ export type CliDependencies = {
         ownerStake?: typeof ownerStake;
         routerCredentials?: typeof routerCredentials;
     };
+    /** Task transport and chain seams for deterministic commands. */
+    tasks?: TasksCommandDependencies;
     /** Status-screen deadlines, injected so timeout behavior is deterministic in tests. */
     status?: {
         timeoutMs?: number;
@@ -84,8 +97,13 @@ export type CliDependencies = {
     };
     /** Distribution seams, injected so CLI tests never sign or relay live transfers. */
     distribute?: Pick<DistributeArgs, "balanceReader" | "siblingsReader" | "transfer" | "authorizationState" | "randomId" | "randomNonce" | "timeoutMs" | "lockTimeoutMs">;
+    /** Swarm capital seams, injected so CLI tests never sign or relay live transfers. */
+    swarm?: Pick<SwarmCapitalDeps, "balanceReader" | "transfer" | "authorizationState" | "addressReader" | "randomId" | "randomNonce" | "unlock" | "timeoutMs" | "lockTimeoutMs"> & {
+        runSwarm?: typeof runSwarm;
+    };
     /** Automatic ceiling sweep seams for status and short-lived paid calls. */
     ceiling?: {
+        sweepAboveCeiling?: typeof sweepAboveCeiling;
         sweepAllAboveCeiling?: typeof import("@vapi-network/core").sweepAllAboveCeiling;
         drainCeilingSweeps?: typeof drainCeilingSweeps;
         balanceReader?: CeilingBalanceReader;
@@ -150,6 +168,9 @@ export declare function requireSecretsAllowed(dependencies: CliDependencies, eve
 export declare function confirmWalletName(name: string, prompt: string, refusal: string, dependencies: CliDependencies): Promise<void>;
 /** Run one CLI invocation and return its process exit code. */
 export declare function runCli(argv?: string[], io?: CliIo, dependencies?: CliDependencies): Promise<number>;
+export declare function redactDetachedRunValue<T>(value: T, environment: NodeJS.ProcessEnv): T;
+export declare function shouldAutoUploadBackup(args: readonly string[]): boolean;
+export declare function shouldAutoUploadAfterFailure(args: readonly string[]): boolean;
 /**
  * Creates another wallet on this machine, with the same custody notice and
  * the same one-time phrase as `vapi init`.
@@ -170,6 +191,11 @@ export declare function baseUsdcBalanceReader(config: VapiConfig, dependencies:
  * prefix alike. A hand-edited discovery URL falls back to the shipped default.
  */
 export declare function registryBaseUrl(config: VapiConfig): string;
+/** The device vault key, read the one way every CLI key export reads it. */
+export declare function deviceVaultKey(store: Pick<WalletStore, "home">, dependencies: CliDependencies): Promise<{
+    path: string;
+    key: Uint8Array;
+}>;
 /** Loads the config and reports any retired registry URL it had to repair. */
 export declare function readConfig(path: string, io: CliIo): Promise<VapiConfig>;
 export declare function output(io: CliIo, json: boolean, value: unknown, human: string): void;