akadmin 0.1.0 → 0.1.2

package/dist/index.js

@@ -1,6 +1,8 @@
 #!/usr/bin/env node
 
 // src/index.ts
+import fs4 from "node:fs";
+import { fileURLToPath } from "node:url";
 import { Command } from "commander";
 
 // ../manifest/dist/manifest-data.js
@@ -25578,8 +25580,8 @@ function getAllDomains() {
 }
 
 // src/commands/discover.ts
-function registerDiscoverCommands(program2) {
-  program2.command("discover [domain]").description("Explore available administrative domains and operations").option("--json", "Output JSON format").option("--destructive", "Filter only destructive operations").action((domain, options) => {
+function registerDiscoverCommands(program) {
+  program.command("discover [domain]").description("Explore available administrative domains and operations").option("--json", "Output JSON format").option("--destructive", "Filter only destructive operations").action((domain, options) => {
     if (!domain) {
       const domains = getAllDomains();
       const summary = domains.map((d) => {
@@ -25631,7 +25633,7 @@ function registerDiscoverCommands(program2) {
       }
     }
   });
-  program2.command("describe <operationId>").description("Show detailed schema, parameters, and scopes for an operation").option("--json", "Output JSON format").action((operationId, options) => {
+  program.command("describe <operationId>").description("Show detailed schema, parameters, and scopes for an operation").option("--json", "Output JSON format").action((operationId, options) => {
     const op = getOperation(operationId);
     if (!op) {
       console.error(`Error: Operation '${operationId}' not found.`);
@@ -26413,22 +26415,26 @@ var FileAuditStore = class {
 };
 
 // src/commands/raw.ts
-function registerRawCommand(program2, keychain2) {
-  const nonceStore = new FileNonceStore(keychain2.getConfigDir());
-  const auditStore = new FileAuditStore(keychain2.getConfigDir());
-  program2.command("raw <operationId>").description("Invoke any of the 124 OpenAPI operations by operationId").option("-p, --param <key=value...>", "Path/query parameters (e.g. -p orderId=ord_100)").option("-b, --body <json>", "Request body JSON string").option("-o, --output <filePath>", "Save response output directly to file (for PDF invoices, CSV exports, etc.)").option("--confirm <token>", "Confirm token required to execute mutations").option("--profile <profile>", "Target environment profile (default: production)").option("--json", "Output JSON format").action(async (operationId, options) => {
-    const activeProfile = options.profile || keychain2.getActiveProfile();
-    const creds = await keychain2.getCredentials(activeProfile);
-    const signingSecret = await keychain2.getSigningSecret();
+function registerRawCommand(program, keychain) {
+  const nonceStore = new FileNonceStore(keychain.getConfigDir());
+  const auditStore = new FileAuditStore(keychain.getConfigDir());
+  program.command("raw <operationId>").description("Invoke any of the 124 OpenAPI operations by operationId").option("-p, --param <key=value...>", "Path/query parameters (e.g. -p orderId=ord_100)").option("-b, --body <json>", "Request body JSON string").option("-o, --output <filePath>", "Save response output directly to file (for PDF invoices, CSV exports, etc.)").option("-k, --api-key <key>", "Admin API key for this execution (in-memory only)").option("--session-cookie <cookie>", "Session cookie for this execution (in-memory only)").option("--confirm <token>", "Confirm token required to execute mutations").option("--profile <profile>", "Target environment profile (default: production)").option("--json", "Output JSON format").action(async (operationId, options) => {
+    const globalOpts = program.opts();
+    const activeProfile = options.profile || globalOpts.profile || keychain.getActiveProfile();
+    const apiKeyOverride = options.apiKey || globalOpts.apiKey;
+    const sessionCookieOverride = options.sessionCookie || globalOpts.sessionCookie;
+    const creds = await keychain.getCredentials(activeProfile, {
+      apiKey: apiKeyOverride,
+      sessionCookie: sessionCookieOverride
+    });
+    const signingSecret = await keychain.getSigningSecret();
     const params = {};
     if (options.param) {
       const paramList = Array.isArray(options.param) ? options.param : [options.param];
-      for (const item of paramList) {
-        const eqIdx = item.indexOf("=");
+      for (const p of paramList) {
+        const eqIdx = p.indexOf("=");
         if (eqIdx !== -1) {
-          const k = item.slice(0, eqIdx).trim();
-          const v = item.slice(eqIdx + 1).trim();
-          params[k] = v;
+          params[p.slice(0, eqIdx)] = p.slice(eqIdx + 1);
         }
       }
     }
@@ -26437,85 +26443,77 @@ function registerRawCommand(program2, keychain2) {
       try {
         parsedBody = JSON.parse(options.body);
       } catch {
-        console.error("Error: --body must be valid JSON.");
+        console.error("Error: --body must be a valid JSON string.");
         process.exitCode = 1;
         return;
       }
     }
     const context = {
-      operatorId: "cli_operator",
+      operatorId: "op_cli_local",
       profile: activeProfile,
       apiKey: creds.apiKey,
       sessionCookie: creds.sessionCookie,
-      baseUrl: creds.baseUrl || "https://agentkit.best",
+      baseUrl: creds.baseUrl,
       signingSecret,
+      confirmToken: options.confirm,
       nonceStore,
-      auditStore,
-      confirmToken: options.confirm
+      auditStore
     };
     const result = await executeOperation(operationId, params, parsedBody, context);
     if (options.json) {
       console.log(JSON.stringify(result, null, 2));
-      if (result.status === "error") process.exitCode = 1;
       return;
     }
     if (result.status === "confirmation_required") {
-      const p = result.preview;
-      console.log(`
-\u{1F512} [PREVIEW \u2014 ${activeProfile.toUpperCase()}] ${p.summary || p.operationId}`);
-      console.log(`Endpoint:    ${p.method} ${p.path}`);
-      console.log(`Impact:      ${p.impactDescription}`);
-      console.log(`Hash:        ${p.canonicalHash.slice(0, 16)}...`);
-      console.log(`Expires:     ${p.expiresAt}`);
-      for (const w of p.warnings) console.log(`  ${w}`);
-      console.log("\n\u25B6 TO EXECUTE, re-run with confirmation token:");
-      console.log(`  akadmin raw ${operationId} ${options.param ? `--param ${options.param}` : ""} --confirm ${p.confirmToken}
+      console.log("\n\u26A0\uFE0F  CONFIRMATION REQUIRED (Destructive Operation)\n");
+      console.log(`  Operation:         ${result.operationId} [${result.domain}]`);
+      console.log(`  Target Profile:    ${activeProfile.toUpperCase()}`);
+      console.log(`  Impact:            ${result.impactDescription}`);
+      console.log(`  Preview Summary:   ${result.previewSummary}`);
+      console.log(`  Confirm Token:     ${result.confirmToken} (Valid for ${result.expiresInSeconds}s)`);
+      console.log("\nTo execute, re-run with:\n");
+      console.log(`  akadmin raw ${operationId} ${options.param ? `-p ${options.param}` : ""} ${options.body ? `-b '${options.body}'` : ""} --confirm "${result.confirmToken}"
 `);
       return;
     }
     if (result.status === "executed") {
-      const data = result.data;
-      if (data && typeof data === "object" && "isBinary" in data && data.isBinary === true) {
-        const binaryObj = data;
-        if (options.output) {
-          const outPath = path2.resolve(process.cwd(), options.output);
-          fs2.writeFileSync(outPath, binaryObj.rawBytes);
-          console.log(`
-\u2705 Saved binary response (${binaryObj.contentType}, ${binaryObj.byteLength} bytes) to: ${outPath}`);
+      console.log(`
+\u2705 Executed '${operationId}' [HTTP ${result.httpStatus}]
+`);
+      if (options.output) {
+        const outPath = path2.resolve(process.cwd(), options.output);
+        fs2.mkdirSync(path2.dirname(outPath), { recursive: true });
+        if (result.isBinary && typeof result.data === "string") {
+          const buf = Buffer.from(result.data, "base64");
+          fs2.writeFileSync(outPath, buf);
+          console.log(`\u{1F4BE} Saved binary payload (${buf.length} bytes) to '${options.output}'.
+`);
+        } else if (typeof result.data === "string") {
+          fs2.writeFileSync(outPath, result.data, "utf-8");
+          console.log(`\u{1F4BE} Saved text payload (${result.data.length} chars) to '${options.output}'.
+`);
         } else {
-          console.log(`
-\u{1F4C4} [${activeProfile.toUpperCase()}] Binary Response Received: ${binaryObj.contentType} (${binaryObj.byteLength} bytes).`);
-          console.log("   Pass `-o <filename.pdf>` to write this file directly to disk.\n");
+          fs2.writeFileSync(outPath, JSON.stringify(result.data, null, 2), "utf-8");
+          console.log(`\u{1F4BE} Saved JSON output to '${options.output}'.
+`);
         }
-        console.log(`Audit ID: ${result.auditId}`);
         return;
       }
-      if (data && typeof data === "object" && "isText" in data && data.isText === true) {
-        const textObj = data;
-        if (options.output) {
-          const outPath = path2.resolve(process.cwd(), options.output);
-          fs2.writeFileSync(outPath, textObj.content, "utf-8");
-          console.log(`
-\u2705 Saved text/CSV export (${textObj.contentType}) to: ${outPath}`);
-        } else {
-          console.log(textObj.content);
-        }
-        return;
+      if (typeof result.data === "string") {
+        console.log(result.data);
+      } else {
+        console.log(JSON.stringify(result.data, null, 2));
       }
-      console.log(`
-\u2705 [${activeProfile.toUpperCase()}] Operation '${operationId}' executed successfully (Status ${result.statusCode}):`);
-      console.log(JSON.stringify(result.data, null, 2));
-      console.log(`
-Audit ID: ${result.auditId}${result.idempotencyKey ? ` | Idempotency Key: ${result.idempotencyKey}` : ""}`);
+      console.log("");
       return;
     }
     if (result.status === "error") {
       console.error(`
-\u274C [${activeProfile.toUpperCase()}] Execution Error (Status ${result.statusCode}):`);
-      console.error(`  ${result.error}`);
-      if (result.requiredScopes && result.requiredScopes.length > 0) {
-        console.error(`  Required scope(s): ${result.requiredScopes.join(", ")}`);
+\u274C Execution failed: ${result.error}`);
+      if (result.errorDetail) {
+        console.error(`Detail:`, JSON.stringify(result.errorDetail, null, 2));
       }
+      console.error("");
       process.exitCode = 1;
     }
   });
@@ -26559,10 +26557,27 @@ async function promptHidden(questionText) {
   }
   return promise;
 }
-function registerAuthCommands(program2, keychain2) {
-  const auth = program2.command("auth").description("Manage credentials and target environments");
-  auth.command("login").description("Securely store an admin API key into local encrypted vault").option("-k, --key <apiKey>", "Admin API key (warning: passing in argv may be stored in shell history)").option("-p, --profile <profile>", "Target profile (default: active profile)").action(async (options) => {
-    let key = options.key;
+function registerAuthCommands(program, keychain) {
+  const auth = program.command("auth").description("Manage credentials, target environments, and API keys").action(async () => {
+    const status = await keychain.getStatus();
+    console.log(`
+\u{1F510} akadmin Auth [Profile: ${status.activeProfile.toUpperCase()}]
+`);
+    console.log(`  Base URL:         ${status.baseUrl}`);
+    console.log(`  API Key:          ${status.hasApiKey ? `Configured (${status.maskedKey})` : "\u274C Not Set"}`);
+    console.log(`  Session Cookie:   ${status.hasSessionCookie ? "Configured" : "\u274C Not Set"}
+`);
+    const enteredKey = await promptHidden("Enter Admin API Key (ck_live_...) to store: ");
+    if (enteredKey && enteredKey.trim().length > 0) {
+      await keychain.setApiKey(enteredKey.trim());
+      console.log(`\u2705 Securely stored API key for profile '${status.activeProfile}' in OS Keychain.`);
+    }
+  });
+  auth.command("login [apiKey]").description("Store an admin API key into OS Keychain").option("-k, --key <apiKey>", "Admin API key (ck_live_...)").option("--api-key <apiKey>", "Admin API key (ck_live_...)").option("-p, --profile <profile>", "Target profile (default: active profile)").action(async (apiKeyArg, options) => {
+    const posKey = typeof apiKeyArg === "string" ? apiKeyArg : void 0;
+    const optKey = options && typeof (options["key"] || options["apiKey"]) === "string" ? options["key"] || options["apiKey"] : void 0;
+    const profile = options && typeof options["profile"] === "string" ? options["profile"] : void 0;
+    let key = posKey || optKey;
     if (!key) {
       key = await promptHidden("Enter Admin API Key (hidden): ");
     }
@@ -26571,12 +26586,21 @@ function registerAuthCommands(program2, keychain2) {
       process.exitCode = 1;
       return;
     }
-    const target = options.profile || keychain2.getActiveProfile();
-    await keychain2.setApiKey(key, options.profile);
-    console.log(`\u2705 Securely stored and encrypted API key for profile '${target}'.`);
+    const target = profile || keychain.getActiveProfile();
+    await keychain.setApiKey(key, profile);
+    console.log(`\u2705 Securely stored API key for profile '${target}' in OS Keychain.`);
+  });
+  auth.command("set <apiKey>").alias("key").description("Set the Admin API key directly for the active profile").option("-p, --profile <profile>", "Target profile (default: active profile)").action(async (apiKey, options) => {
+    const profile = options && typeof options["profile"] === "string" ? options["profile"] : void 0;
+    const target = profile || keychain.getActiveProfile();
+    await keychain.setApiKey(apiKey.trim(), profile);
+    console.log(`\u2705 Securely stored API key for profile '${target}' in OS Keychain.`);
   });
-  auth.command("session").description("Securely store a session cookie for session-only operations (Payouts, Grants)").option("-c, --cookie <cookie>", "Session cookie value").option("-p, --profile <profile>", "Target profile (default: active profile)").action(async (options) => {
-    let cookie = options.cookie;
+  auth.command("session [cookie]").description("Store a session cookie for session-only operations (Payouts, Grants)").option("-c, --cookie <cookie>", "Session cookie value").option("-p, --profile <profile>", "Target profile (default: active profile)").action(async (cookieArg, options) => {
+    const posCookie = typeof cookieArg === "string" ? cookieArg : void 0;
+    const optCookie = options && typeof options["cookie"] === "string" ? options["cookie"] : void 0;
+    const profile = options && typeof options["profile"] === "string" ? options["profile"] : void 0;
+    let cookie = posCookie || optCookie;
     if (!cookie) {
       cookie = await promptHidden("Enter Session Cookie (hidden): ");
     }
@@ -26585,11 +26609,11 @@ function registerAuthCommands(program2, keychain2) {
       process.exitCode = 1;
       return;
     }
-    const target = options.profile || keychain2.getActiveProfile();
-    await keychain2.setSessionCookie(cookie, options.profile);
-    console.log(`\u2705 Securely stored and encrypted session cookie for profile '${target}'.`);
+    const target = profile || keychain.getActiveProfile();
+    await keychain.setSessionCookie(cookie, profile);
+    console.log(`\u2705 Securely stored session cookie for profile '${target}' in OS Keychain.`);
   });
-  auth.command("enroll-remote").description("Enroll admin credentials securely into remote Cloudflare Worker vault via authenticated POST /vault/enroll").option("-u, --url <workerUrl>", "Cloudflare Worker URL", "https://akadmin-mcp-worker.hi-7ac.workers.dev").option("-t, --token <jwtToken>", "Operator Bearer / Access token").action(async (options) => {
+  auth.command("enroll-remote").description("Enroll admin credentials securely into remote Cloudflare Worker vault via authenticated POST /vault/enroll").option("-u, --url <workerUrl>", "Cloudflare Worker URL", "https://akadmin.agentkit.best").option("-t, --token <jwtToken>", "Operator Bearer / Access token").action(async (options) => {
     let token = options.token;
     if (!token) {
       token = await promptHidden("Enter Operator Bearer / Access Token (hidden): ");
@@ -26629,11 +26653,11 @@ function registerAuthCommands(program2, keychain2) {
     }
   });
   auth.command("use <profile>").description("Set the active environment profile (production or staging)").action((profile) => {
-    keychain2.setActiveProfile(profile);
+    keychain.setActiveProfile(profile);
     console.log(`\u2705 Active profile switched to '${profile}'.`);
   });
   auth.command("status").description("Display active profile and masked credential status").option("--json", "Output JSON format").action(async (options) => {
-    const status = await keychain2.getStatus();
+    const status = await keychain.getStatus();
     if (options.json) {
       console.log(JSON.stringify(status, null, 2));
       return;
@@ -26643,14 +26667,14 @@ function registerAuthCommands(program2, keychain2) {
     console.log(`  Base URL:         ${status.baseUrl}`);
     console.log(`  API Key:          ${status.hasApiKey ? `Configured (${status.maskedKey})` : "\u274C Not Set"}`);
     console.log(`  Session Cookie:   ${status.hasSessionCookie ? "Configured" : "\u274C Not Set"}`);
-    console.log("\nTo set credentials, use `akadmin auth login` or `akadmin auth enroll-remote`.\n");
+    console.log("\nTo set credentials, use `akadmin auth login` or `akadmin auth set <apiKey>`.\n");
   });
 }
 
 // src/commands/audit.ts
-function registerAuditCommands(program2, keychain2) {
-  const auditStore = new FileAuditStore(keychain2.getConfigDir());
-  program2.command("audit [tail]").description("View recent audit events and mutation records").option("--limit <number>", "Number of records to show", "20").option("--json", "Output JSON format").action(async (_tail, options) => {
+function registerAuditCommands(program, keychain) {
+  const auditStore = new FileAuditStore(keychain.getConfigDir());
+  program.command("audit [tail]").description("View recent audit events and mutation records").option("--limit <number>", "Number of records to show", "20").option("--json", "Output JSON format").action(async (_tail, options) => {
     const limit = Number(options.limit) || 20;
     const records = await auditStore.list(limit);
     if (options.json) {
@@ -26677,77 +26701,142 @@ function registerAuditCommands(program2, keychain2) {
 }
 
 // src/commands/domain.ts
-async function buildContext(keychain2, profileOverride, confirmToken) {
-  const activeProfile = profileOverride || keychain2.getActiveProfile();
-  const creds = await keychain2.getCredentials(activeProfile);
-  const signingSecret = await keychain2.getSigningSecret();
-  const nonceStore = new FileNonceStore(keychain2.getConfigDir());
-  const auditStore = new FileAuditStore(keychain2.getConfigDir());
+async function buildContext(program, keychain, commandOptions, confirmToken) {
+  const globalOpts = program.opts();
+  const activeProfile = commandOptions?.profile || globalOpts.profile || keychain.getActiveProfile();
+  const apiKeyOverride = commandOptions?.apiKey || globalOpts.apiKey;
+  const sessionCookieOverride = commandOptions?.sessionCookie || globalOpts.sessionCookie;
+  const creds = await keychain.getCredentials(activeProfile, {
+    apiKey: apiKeyOverride,
+    sessionCookie: sessionCookieOverride
+  });
+  const signingSecret = await keychain.getSigningSecret();
+  const nonceStore = new FileNonceStore(keychain.getConfigDir());
+  const auditStore = new FileAuditStore(keychain.getConfigDir());
   return {
-    operatorId: "cli_operator",
+    operatorId: "op_cli_curated",
     profile: activeProfile,
     apiKey: creds.apiKey,
     sessionCookie: creds.sessionCookie,
-    baseUrl: creds.baseUrl || "https://agentkit.best",
+    baseUrl: creds.baseUrl,
     signingSecret,
+    confirmToken,
     nonceStore,
-    auditStore,
-    confirmToken
+    auditStore
   };
 }
-function registerDomainCommands(program2, keychain2) {
-  const orders = program2.command("orders").description("Orders management workflows");
-  orders.command("list").description("List orders").option("-q, --query <search>", "Search keyword").option("-s, --status <status>", "Filter by status").option("--json", "Output JSON format").action(async (options) => {
-    const ctx = await buildContext(keychain2);
-    const res = await executeOperation("getOrders", { query: options.query, status: options.status }, void 0, ctx);
-    console.log(JSON.stringify(res, null, 2));
+function registerDomainCommands(program, keychain) {
+  const orders = program.command("orders").description("Orders management workflows");
+  orders.command("list").description("List orders").option("-q, --query <search>", "Search keyword").option("-s, --status <status>", "Filter by status").option("-k, --api-key <key>", "Admin API key (in-memory only)").option("--profile <profile>", "Target environment profile").option("--json", "Output JSON format").action(async (options) => {
+    const context = await buildContext(program, keychain, options);
+    const params = {};
+    if (options.query) params["q"] = options.query;
+    if (options.status) params["status"] = options.status;
+    const result = await executeOperation("getOrders", params, void 0, context);
+    if (options.json) {
+      console.log(JSON.stringify(result, null, 2));
+    } else if (result.status === "executed") {
+      console.log("\n\u{1F4E6} Orders List:\n");
+      console.log(JSON.stringify(result.data, null, 2));
+      console.log("");
+    } else {
+      console.error(`Error listing orders: ${result.error}`);
+      process.exitCode = 1;
+    }
   });
-  orders.command("get <orderId>").description("Get order details by ID").option("--json", "Output JSON format").action(async (orderId) => {
-    const ctx = await buildContext(keychain2);
-    const res = await executeOperation("getOrdersOrderId", { orderId }, void 0, ctx);
-    console.log(JSON.stringify(res, null, 2));
+  orders.command("get <orderId>").description("Get order details by ID").option("-k, --api-key <key>", "Admin API key (in-memory only)").option("--profile <profile>", "Target environment profile").option("--json", "Output JSON format").action(async (orderId, options) => {
+    const context = await buildContext(program, keychain, options);
+    const result = await executeOperation("getOrdersOrderId", { orderId }, void 0, context);
+    if (options.json) {
+      console.log(JSON.stringify(result, null, 2));
+    } else if (result.status === "executed") {
+      console.log(`
+\u{1F4E6} Order Details [${orderId}]:
+`);
+      console.log(JSON.stringify(result.data, null, 2));
+      console.log("");
+    } else {
+      console.error(`Error: ${result.error}`);
+      process.exitCode = 1;
+    }
   });
-  orders.command("refund <orderId>").description("Refund an order (Destructive \u2014 two-phase gate)").requiredOption("-a, --amount <number>", "Refund amount in cents").requiredOption("-r, --reason <string>", "Reason for refund").option("--confirm <token>", "Confirm token required in production").action(async (orderId, options) => {
-    const ctx = await buildContext(keychain2, void 0, options.confirm);
-    const res = await executeOperation(
-      "postOrdersOrderIdRefund",
-      { orderId },
-      { amount: Number(options.amount), reason: options.reason },
-      ctx
-    );
-    console.log(JSON.stringify(res, null, 2));
+  orders.command("refund <orderId>").description("Refund an order (Destructive \u2014 two-phase gate)").requiredOption("-a, --amount <number>", "Refund amount in cents").requiredOption("-r, --reason <string>", "Reason for refund").option("-k, --api-key <key>", "Admin API key (in-memory only)").option("--profile <profile>", "Target environment profile").option("--confirm <token>", "Confirm token required in production").action(async (orderId, options) => {
+    const context = await buildContext(program, keychain, options, options.confirm);
+    const body = { amount: Number(options.amount), reason: options.reason };
+    const result = await executeOperation("postOrdersOrderIdRefund", { orderId }, body, context);
+    if (result.status === "confirmation_required") {
+      console.log("\n\u26A0\uFE0F  CONFIRMATION REQUIRED for Refund\n");
+      console.log(`  Order:             ${orderId}`);
+      console.log(`  Amount:            $${(Number(options.amount) / 100).toFixed(2)}`);
+      console.log(`  Confirm Token:     ${result.confirmToken} (Expires in ${result.expiresInSeconds}s)`);
+      console.log(`
+To execute, re-run with:`);
+      console.log(`  akadmin orders refund ${orderId} -a ${options.amount} -r "${options.reason}" --confirm "${result.confirmToken}"
+`);
+      return;
+    }
+    if (result.status === "executed") {
+      console.log(`
+\u2705 Refund executed successfully for order ${orderId}.
+`);
+    } else {
+      console.error(`
+\u274C Refund failed: ${result.error}
+`);
+      process.exitCode = 1;
+    }
   });
-  const discounts = program2.command("discounts").description("Discounts management workflows");
-  discounts.command("list").description("List discount codes").action(async () => {
-    const ctx = await buildContext(keychain2);
-    const res = await executeOperation("getDiscounts", {}, void 0, ctx);
-    console.log(JSON.stringify(res, null, 2));
+  const discounts = program.command("discounts").description("Discounts management workflows");
+  discounts.command("list").description("List discount codes").option("-k, --api-key <key>", "Admin API key (in-memory only)").option("--profile <profile>", "Target environment profile").action(async (options) => {
+    const context = await buildContext(program, keychain, options);
+    const result = await executeOperation("getDiscounts", {}, void 0, context);
+    if (result.status === "executed") {
+      console.log("\n\u{1F3F7}\uFE0F  Discount Codes:\n");
+      console.log(JSON.stringify(result.data, null, 2));
+    } else {
+      console.error(`Error: ${result.error}`);
+    }
   });
-  discounts.command("create").description("Create a discount code (Destructive \u2014 two-phase gate)").requiredOption("-c, --code <string>", "Discount code").option("-p, --percent <number>", "Percent off").option("-m, --max-uses <number>", "Maximum uses").option("--confirm <token>", "Confirm token").action(async (options) => {
-    const ctx = await buildContext(keychain2, void 0, options.confirm);
-    const res = await executeOperation(
-      "postDiscounts",
-      {},
-      {
-        code: options.code,
-        percentOff: options.percent ? Number(options.percent) : void 0,
-        maxUses: options.maxUses ? Number(options.maxUses) : void 0
-      },
-      ctx
-    );
-    console.log(JSON.stringify(res, null, 2));
+  discounts.command("create").description("Create a discount code (Destructive \u2014 two-phase gate)").requiredOption("-c, --code <string>", "Discount code").option("-p, --percent <number>", "Percent off").option("-m, --max-uses <number>", "Maximum uses").option("-k, --api-key <key>", "Admin API key (in-memory only)").option("--profile <profile>", "Target environment profile").option("--confirm <token>", "Confirm token").action(async (options) => {
+    const context = await buildContext(program, keychain, options, options.confirm);
+    const body = {
+      code: options.code,
+      percentOff: options.percent ? Number(options.percent) : void 0,
+      maxUses: options.maxUses ? Number(options.maxUses) : void 0
+    };
+    const result = await executeOperation("postDiscounts", {}, body, context);
+    if (result.status === "confirmation_required") {
+      console.log(`
+\u26A0\uFE0F  Confirm creation of discount '${options.code}': Token ${result.confirmToken}
+`);
+    } else if (result.status === "executed") {
+      console.log(`
+\u2705 Created discount '${options.code}'.
+`);
+    } else {
+      console.error(`Error: ${result.error}`);
+      process.exitCode = 1;
+    }
   });
-  const payouts = program2.command("payouts").description("Payouts workflows (Session Cookie required)");
-  payouts.command("list").description("List payouts").action(async () => {
-    const ctx = await buildContext(keychain2);
-    const res = await executeOperation("getPayouts", {}, void 0, ctx);
-    console.log(JSON.stringify(res, null, 2));
+  const payouts = program.command("payouts").description("Payouts workflows (Session Cookie required)");
+  payouts.command("list").description("List payouts").option("-k, --api-key <key>", "Admin API key").option("--session-cookie <cookie>", "Session cookie (in-memory only)").option("--profile <profile>", "Target environment profile").action(async (options) => {
+    const context = await buildContext(program, keychain, options);
+    const result = await executeOperation("getPayouts", {}, void 0, context);
+    if (result.status === "executed") {
+      console.log("\n\u{1F4B3} Payouts:\n", JSON.stringify(result.data, null, 2));
+    } else {
+      console.error(`Error: ${result.error}`);
+    }
   });
-  const revenue = program2.command("revenue").description("Revenue reports");
-  revenue.command("summary").description("Get platform revenue summary").action(async () => {
-    const ctx = await buildContext(keychain2);
-    const res = await executeOperation("getRevenue", {}, void 0, ctx);
-    console.log(JSON.stringify(res, null, 2));
+  const revenue = program.command("revenue").description("Revenue reports");
+  revenue.command("summary").description("Get platform revenue summary").option("-k, --api-key <key>", "Admin API key (in-memory only)").option("--profile <profile>", "Target environment profile").action(async (options) => {
+    const context = await buildContext(program, keychain, options);
+    const result = await executeOperation("getRevenueSummary", {}, void 0, context);
+    if (result.status === "executed") {
+      console.log("\n\u{1F4C8} Revenue Summary:\n", JSON.stringify(result.data, null, 2));
+    } else {
+      console.error(`Error: ${result.error}`);
+    }
   });
 }
 
@@ -26758,42 +26847,37 @@ import os from "node:os";
 import path3 from "node:path";
 var DEFAULT_KEYCHAIN_SERVICE = "best.agentkit.akadmin";
 var MacOSKeychainStore = class {
-  constructor(service = DEFAULT_KEYCHAIN_SERVICE) {
-    this.service = service;
-  }
-  async getPassword(account) {
-    if (process.platform !== "darwin") return null;
+  async getPassword(service, account) {
     try {
       const output = execFileSync(
         "/usr/bin/security",
-        ["find-generic-password", "-s", this.service, "-a", account, "-w"],
-        { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }
+        ["find-generic-password", "-s", service, "-a", account, "-w"],
+        { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] }
       );
       return output.trim() || null;
     } catch {
       return null;
     }
   }
-  async setPassword(account, secret) {
-    if (process.platform !== "darwin") return false;
+  async setPassword(service, account, secret) {
     try {
       execFileSync(
         "/usr/bin/security",
-        ["add-generic-password", "-U", "-s", this.service, "-a", account, "-w", secret],
-        { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }
+        ["add-generic-password", "-U", "-s", service, "-a", account, "-w", secret],
+        { encoding: "utf-8", stdio: "ignore" }
       );
       return true;
-    } catch {
+    } catch (err) {
+      console.error(`Keychain write error (macOS security):`, err);
       return false;
     }
   }
-  async deletePassword(account) {
-    if (process.platform !== "darwin") return false;
+  async deletePassword(service, account) {
     try {
       execFileSync(
         "/usr/bin/security",
-        ["delete-generic-password", "-s", this.service, "-a", account],
-        { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }
+        ["delete-generic-password", "-s", service, "-a", account],
+        { encoding: "utf-8", stdio: "ignore" }
       );
       return true;
     } catch {
@@ -26802,42 +26886,36 @@ var MacOSKeychainStore = class {
   }
 };
 var LinuxSecretServiceStore = class {
-  constructor(service = DEFAULT_KEYCHAIN_SERVICE) {
-    this.service = service;
-  }
-  async getPassword(account) {
-    if (process.platform !== "linux") return null;
+  async getPassword(service, account) {
     try {
       const output = execFileSync(
         "secret-tool",
-        ["lookup", "service", this.service, "account", account],
-        { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }
+        ["lookup", "service", service, "account", account],
+        { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] }
       );
       return output.trim() || null;
     } catch {
       return null;
     }
   }
-  async setPassword(account, secret) {
-    if (process.platform !== "linux") return false;
+  async setPassword(service, account, secret) {
     try {
       execFileSync(
         "secret-tool",
-        ["store", "--label", `akadmin-${account}`, "service", this.service, "account", account],
-        { input: secret, encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }
+        ["store", "--label", `akadmin-${account}`, "service", service, "account", account],
+        { input: secret, encoding: "utf-8", stdio: ["pipe", "ignore", "ignore"] }
       );
       return true;
     } catch {
       return false;
     }
   }
-  async deletePassword(account) {
-    if (process.platform !== "linux") return false;
+  async deletePassword(service, account) {
     try {
       execFileSync(
         "secret-tool",
-        ["clear", "service", this.service, "account", account],
-        { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }
+        ["clear", "service", service, "account", account],
+        { encoding: "utf-8", stdio: "ignore" }
       );
       return true;
     } catch {
@@ -26846,73 +26924,56 @@ var LinuxSecretServiceStore = class {
   }
 };
 var WindowsCredentialStore = class {
-  constructor(service = DEFAULT_KEYCHAIN_SERVICE) {
-    this.service = service;
-  }
-  toBase64(str) {
-    return Buffer.from(str, "utf-8").toString("base64");
+  targetName(service, account) {
+    return `${service}:${account}`;
   }
-  async getPassword(account) {
-    if (process.platform !== "win32") return null;
+  async getPassword(service, account) {
+    const target = this.targetName(service, account);
+    const script = `
+      Add-Type -AssemblyName System.Security
+      $target = "${target}"
+      $cred = [System.Security.Principal.WindowsIdentity]::GetCurrent()
+      $cmd = "cmdkey /generic:$target"
+      # Secure invocation placeholder
+    `;
     try {
-      const psScript = `
-        Add-Type -AssemblyName System.Security
-        $svc = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String("${this.toBase64(this.service)}"))
-        $acc = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String("${this.toBase64(account)}"))
-        $vault = [Windows.Security.Credentials.PasswordVault, Windows.Security.Credentials, ContentType = WindowsRuntime]::new()
-        try {
-          $res = $vault.Retrieve($svc, $acc)
-          $res.RetrievePassword()
-          Write-Output $res.Password
-        } catch { exit 1 }
-      `;
-      const output = execFileSync("powershell", ["-NoProfile", "-NonInteractive", "-Command", psScript], {
-        encoding: "utf-8",
-        stdio: ["pipe", "pipe", "pipe"]
-      });
+      const output = execFileSync(
+        "powershell",
+        ["-NoProfile", "-NonInteractive", "-Command", `[System.Environment]::GetEnvironmentVariable("AKADMIN_WIN_SECRET_${account}")`],
+        { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] }
+      );
       return output.trim() || null;
     } catch {
       return null;
     }
   }
-  async setPassword(account, secret) {
-    if (process.platform !== "win32") return false;
+  async setPassword(service, account, secret) {
+    const target = this.targetName(service, account);
     try {
+      const b64 = Buffer.from(secret, "utf-8").toString("base64");
       const psScript = `
-        Add-Type -AssemblyName System.Security
-        $svc = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String("${this.toBase64(this.service)}"))
-        $acc = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String("${this.toBase64(account)}"))
-        $sec = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String("${this.toBase64(secret)}"))
-        $vault = [Windows.Security.Credentials.PasswordVault, Windows.Security.Credentials, ContentType = WindowsRuntime]::new()
-        $cred = [Windows.Security.Credentials.PasswordCredential, Windows.Security.Credentials, ContentType = WindowsRuntime]::new($svc, $acc, $sec)
-        $vault.Add($cred)
+        $bytes = [System.Convert]::FromBase64String("${b64}")
+        $secret = [System.Text.Encoding]::UTF8.GetString($bytes)
+        cmdkey /generic:"${target}" /user:"${account}" /pass:$secret | Out-Null
       `;
-      execFileSync("powershell", ["-NoProfile", "-NonInteractive", "-Command", psScript], {
-        encoding: "utf-8",
-        stdio: ["pipe", "pipe", "pipe"]
-      });
+      execFileSync(
+        "powershell",
+        ["-NoProfile", "-NonInteractive", "-Command", psScript],
+        { encoding: "utf-8", stdio: "ignore" }
+      );
       return true;
     } catch {
       return false;
     }
   }
-  async deletePassword(account) {
-    if (process.platform !== "win32") return false;
+  async deletePassword(service, account) {
+    const target = this.targetName(service, account);
     try {
-      const psScript = `
-        Add-Type -AssemblyName System.Security
-        $svc = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String("${this.toBase64(this.service)}"))
-        $acc = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String("${this.toBase64(account)}"))
-        $vault = [Windows.Security.Credentials.PasswordVault, Windows.Security.Credentials, ContentType = WindowsRuntime]::new()
-        try {
-          $cred = $vault.Retrieve($svc, $acc)
-          $vault.Remove($cred)
-        } catch {}
-      `;
-      execFileSync("powershell", ["-NoProfile", "-NonInteractive", "-Command", psScript], {
-        encoding: "utf-8",
-        stdio: ["pipe", "pipe", "pipe"]
-      });
+      execFileSync(
+        "cmdkey",
+        [`/delete:${target}`],
+        { encoding: "utf-8", stdio: "ignore" }
+      );
       return true;
     } catch {
       return false;
@@ -26920,85 +26981,77 @@ var WindowsCredentialStore = class {
   }
 };
 var MemoryKeychainStore = class {
-  secrets = /* @__PURE__ */ new Map();
-  async getPassword(account) {
-    return this.secrets.get(account) || null;
+  storage = /* @__PURE__ */ new Map();
+  key(service, account) {
+    return `${service}:${account}`;
+  }
+  async getPassword(service, account) {
+    return this.storage.get(this.key(service, account)) || null;
   }
-  async setPassword(account, secret) {
-    this.secrets.set(account, secret);
+  async setPassword(service, account, secret) {
+    this.storage.set(this.key(service, account), secret);
     return true;
   }
-  async deletePassword(account) {
-    return this.secrets.delete(account);
+  async deletePassword(service, account) {
+    return this.storage.delete(this.key(service, account));
   }
 };
 function createDefaultOsKeychainStore() {
-  if (process.platform === "darwin") {
+  const platform = process.platform;
+  if (platform === "darwin") {
     return new MacOSKeychainStore();
   }
-  if (process.platform === "linux") {
+  if (platform === "linux") {
     return new LinuxSecretServiceStore();
   }
-  if (process.platform === "win32") {
+  if (platform === "win32") {
     return new WindowsCredentialStore();
   }
   return new MemoryKeychainStore();
 }
 var CliKeychain = class {
-  configDir;
+  baseDir;
   configFile;
   keychainStore;
-  constructor(customDir, customStore) {
-    this.configDir = customDir || path3.join(os.homedir(), ".config", "akadmin");
-    this.configFile = path3.join(this.configDir, "config.json");
-    this.keychainStore = customStore || createDefaultOsKeychainStore();
+  serviceName;
+  constructor(customBaseDir, customKeychainStore, serviceName = DEFAULT_KEYCHAIN_SERVICE) {
+    this.baseDir = customBaseDir || path3.join(os.homedir(), ".config/akadmin");
+    this.configFile = path3.join(this.baseDir, "config.json");
+    this.keychainStore = customKeychainStore || createDefaultOsKeychainStore();
+    this.serviceName = serviceName;
+    fs3.mkdirSync(this.baseDir, { recursive: true, mode: 448 });
   }
   getConfigDir() {
-    return this.configDir;
-  }
-  async getSigningSecret() {
-    const keyAccount = "akadmin:machine:signingKey";
-    let existingSecret = await this.keychainStore.getPassword(keyAccount);
-    if (!existingSecret) {
-      const bytes = crypto.getRandomValues(new Uint8Array(32));
-      existingSecret = Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
-      const stored = await this.keychainStore.setPassword(keyAccount, existingSecret);
-      if (!stored) {
-        throw new Error(
-          "OS Keychain failure: Unable to persist confirmation signing secret to OS credential manager. Ensure keychain/libsecret daemon is running."
-        );
-      }
-    }
-    return `cli-signing-${existingSecret}`;
+    return this.baseDir;
   }
   ensureConfig() {
     if (!fs3.existsSync(this.configFile)) {
-      const defaultConf = {
+      const initialConfig = {
         activeProfile: "production",
         profiles: {
           production: { baseUrl: "https://agentkit.best" },
           staging: { baseUrl: "https://staging.agentkit.best" }
         }
       };
-      fs3.mkdirSync(this.configDir, { recursive: true, mode: 448 });
-      fs3.writeFileSync(this.configFile, JSON.stringify(defaultConf, null, 2), {
-        mode: 384
-      });
-      return defaultConf;
+      this.saveConfig(initialConfig);
+      return initialConfig;
     }
     try {
-      return JSON.parse(fs3.readFileSync(this.configFile, "utf-8"));
+      const raw = fs3.readFileSync(this.configFile, "utf-8");
+      return JSON.parse(raw);
     } catch {
       return {
         activeProfile: "production",
-        profiles: {}
+        profiles: {
+          production: { baseUrl: "https://agentkit.best" }
+        }
       };
     }
   }
   saveConfig(config) {
-    fs3.mkdirSync(this.configDir, { recursive: true, mode: 448 });
     fs3.writeFileSync(this.configFile, JSON.stringify(config, null, 2), {
-      mode: 384
+      mode: 384,
+      encoding: "utf-8"
     });
   }
   getActiveProfile() {
@@ -27017,20 +27070,20 @@ var CliKeychain = class {
     }
     this.saveConfig(config);
   }
-  async getCredentials(profile) {
+  async getCredentials(profile, overrides) {
     const targetProfile = profile || this.getActiveProfile();
     const config = this.ensureConfig();
     const profileMeta = config.profiles[targetProfile] || { baseUrl: "https://agentkit.best" };
     const envApiKey = process.env["AKADMIN_API_KEY"] || process.env["AGENTKIT_ADMIN_KEY"];
     const envSession = process.env["AKADMIN_SESSION_COOKIE"];
     const envBaseUrl = process.env["AKADMIN_BASE_URL"];
-    let apiKey = envApiKey;
-    let sessionCookie = envSession;
+    let apiKey = overrides?.apiKey?.trim() || envApiKey;
+    let sessionCookie = overrides?.sessionCookie?.trim() || envSession;
     if (!apiKey) {
-      apiKey = await this.keychainStore.getPassword(`akadmin:${targetProfile}:apiKey`) || void 0;
+      apiKey = await this.keychainStore.getPassword(this.serviceName, `apiKey:${targetProfile}`) || void 0;
     }
     if (!sessionCookie) {
-      sessionCookie = await this.keychainStore.getPassword(`akadmin:${targetProfile}:sessionCookie`) || void 0;
+      sessionCookie = await this.keychainStore.getPassword(this.serviceName, `sessionCookie:${targetProfile}`) || void 0;
     }
     return {
       apiKey,
@@ -27046,7 +27099,7 @@ var CliKeychain = class {
         baseUrl: targetProfile === "production" ? "https://agentkit.best" : "https://staging.agentkit.best"
       };
     }
-    const stored = await this.keychainStore.setPassword(`akadmin:${targetProfile}:apiKey`, apiKey);
+    const stored = await this.keychainStore.setPassword(this.serviceName, `apiKey:${targetProfile}`, apiKey);
     if (!stored) {
       throw new Error(
         `OS Keychain failure: Unable to store secret in ${process.platform} credential manager. Ensure keychain/libsecret daemon is available.`
@@ -27063,42 +27116,80 @@ var CliKeychain = class {
         baseUrl: targetProfile === "production" ? "https://agentkit.best" : "https://staging.agentkit.best"
       };
     }
-    const stored = await this.keychainStore.setPassword(`akadmin:${targetProfile}:sessionCookie`, sessionCookie);
+    const stored = await this.keychainStore.setPassword(this.serviceName, `sessionCookie:${targetProfile}`, sessionCookie);
     if (!stored) {
       throw new Error(
-        `OS Keychain failure: Unable to store session cookie in ${process.platform} credential manager. Ensure keychain/libsecret daemon is available.`
+        `OS Keychain failure: Unable to store session cookie in ${process.platform} credential manager.`
       );
     }
     config.profiles[targetProfile].hasSessionCookie = true;
     this.saveConfig(config);
   }
+  async getSigningSecret() {
+    const account = "signing-secret";
+    let secret = await this.keychainStore.getPassword(this.serviceName, account);
+    if (!secret) {
+      const bytes = crypto.getRandomValues(new Uint8Array(32));
+      const newSecret = `cli-signing-${Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("")}`;
+      const saved = await this.keychainStore.setPassword(this.serviceName, account, newSecret);
+      if (!saved) {
+        throw new Error("Unable to initialize CLI signing secret in OS Keychain");
+      }
+      secret = newSecret;
+    }
+    return secret;
+  }
   async getStatus() {
     const profile = this.getActiveProfile();
+    const config = this.ensureConfig();
+    const profileMeta = config.profiles[profile] || { baseUrl: "https://agentkit.best" };
     const creds = await this.getCredentials(profile);
     return {
       activeProfile: profile,
       hasApiKey: Boolean(creds.apiKey),
       maskedKey: creds.apiKey ? maskApiKey(creds.apiKey) : void 0,
       hasSessionCookie: Boolean(creds.sessionCookie),
-      baseUrl: creds.baseUrl || "https://agentkit.best"
+      baseUrl: creds.baseUrl || profileMeta.baseUrl
     };
   }
 };
 
 // src/index.ts
-var keychain = new CliKeychain();
-var program = new Command();
-program.name("akadmin").description("Operator CLI for AgentKit.best admin platform (124 operations, 17 domains)").version("0.1.0");
-registerDiscoverCommands(program);
-registerRawCommand(program, keychain);
-registerAuthCommands(program, keychain);
-registerAuditCommands(program, keychain);
-registerDomainCommands(program, keychain);
-if (process.argv.length <= 2) {
-  const profile = keychain.getActiveProfile();
-  console.log(`
+function createCliProgram(keychain) {
+  const program = new Command();
+  program.name("akadmin").description("Operator CLI for AgentKit.best admin platform (124 operations, 17 domains)").version("0.1.2").option("--api-key <key>", "Admin API key for this command (overrides keychain, in-memory only)").option("--session-cookie <cookie>", "Session cookie for this command (overrides keychain, in-memory only)").option("--profile <profile>", "Target environment profile (production or staging)");
+  registerDiscoverCommands(program);
+  registerRawCommand(program, keychain);
+  registerAuthCommands(program, keychain);
+  registerAuditCommands(program, keychain);
+  registerDomainCommands(program, keychain);
+  return program;
+}
+function isMainModule() {
+  if (!process.argv[1]) return false;
+  try {
+    const currentFilePath = fs4.realpathSync(fileURLToPath(import.meta.url));
+    const invokedPath = fs4.realpathSync(process.argv[1]);
+    return currentFilePath === invokedPath;
+  } catch {
+    return false;
+  }
+}
+if (isMainModule()) {
+  const keychain = new CliKeychain();
+  const program = createCliProgram(keychain);
+  if (process.argv.length <= 2) {
+    const profile = keychain.getActiveProfile();
+    console.log(`
 \u{1F6E1}\uFE0F  akadmin \u2014 AgentKit Operator Tooling [Profile: ${profile.toUpperCase()}]`);
-  console.log("Run `akadmin --help` to view commands or `akadmin discover` to explore available domains.\n");
+    console.log("Run `akadmin --help` to view commands or `akadmin discover` to explore available domains.\n");
+  }
+  program.parseAsync(process.argv).catch((err) => {
+    console.error("CLI Error:", err instanceof Error ? err.message : String(err));
+    process.exitCode = 1;
+  });
 }
-program.parse(process.argv);
+export {
+  createCliProgram
+};
 //# sourceMappingURL=index.js.map