arispay 0.1.0

package/dist/chunk-4ON4ZXR3.js

@@ -0,0 +1,953 @@
+#!/usr/bin/env node
+
+// ../shared/dist/constants.js
+var CRYPTO_CHAINS = {
+  ETHEREUM: "ethereum",
+  BASE: "base",
+  POLYGON: "polygon",
+  SOLANA: "solana"
+};
+var SUPPORTED_CHAINS = Object.values(CRYPTO_CHAINS);
+var ERROR_CODES = {
+  INSUFFICIENT_FUNDS: "INSUFFICIENT_FUNDS",
+  SPEND_LIMIT_EXCEEDED: "SPEND_LIMIT_EXCEEDED",
+  MERCHANT_REJECTED: "MERCHANT_REJECTED",
+  TAP_VERIFICATION_FAILED: "TAP_VERIFICATION_FAILED",
+  CARD_DECLINED: "CARD_DECLINED",
+  INVALID_API_KEY: "INVALID_API_KEY",
+  RATE_LIMITED: "RATE_LIMITED",
+  IDEMPOTENCY_CONFLICT: "IDEMPOTENCY_CONFLICT",
+  AGENT_NOT_FOUND: "AGENT_NOT_FOUND",
+  USER_NOT_FOUND: "USER_NOT_FOUND",
+  PAYMENT_NOT_FOUND: "PAYMENT_NOT_FOUND",
+  INVALID_REQUEST: "INVALID_REQUEST",
+  INTERNAL_ERROR: "INTERNAL_ERROR",
+  CIRCUIT_BREAKER_TRIPPED: "CIRCUIT_BREAKER_TRIPPED",
+  AGENT_SUSPENDED: "AGENT_SUSPENDED",
+  WALLET_NOT_FOUND: "WALLET_NOT_FOUND",
+  INSUFFICIENT_ALLOWANCE: "INSUFFICIENT_ALLOWANCE",
+  INSUFFICIENT_TOKEN_BALANCE: "INSUFFICIENT_TOKEN_BALANCE",
+  CRYPTO_TRANSFER_FAILED: "CRYPTO_TRANSFER_FAILED",
+  INVALID_WALLET_ADDRESS: "INVALID_WALLET_ADDRESS",
+  UNSUPPORTED_CHAIN: "UNSUPPORTED_CHAIN",
+  UNSUPPORTED_TOKEN: "UNSUPPORTED_TOKEN",
+  UNSUPPORTED_CARD_NETWORK: "UNSUPPORTED_CARD_NETWORK",
+  NETWORK_REGISTRY_ERROR: "NETWORK_REGISTRY_ERROR",
+  INSUFFICIENT_BALANCE: "INSUFFICIENT_BALANCE",
+  AGENT_MODE_MISMATCH: "AGENT_MODE_MISMATCH",
+  THREE_DS_FAILED: "THREE_DS_FAILED",
+  MERCHANT_NOT_FOUND: "MERCHANT_NOT_FOUND",
+  INVALID_MERCHANT_API_KEY: "INVALID_MERCHANT_API_KEY"
+};
+
+// ../shared/dist/errors.js
+var ArisPayError = class extends Error {
+  code;
+  statusCode;
+  constructor(code, message, statusCode = 400) {
+    super(message);
+    this.code = code;
+    this.statusCode = statusCode;
+    this.name = "ArisPayError";
+  }
+  toJSON() {
+    return {
+      error: {
+        code: this.code,
+        message: this.message
+      }
+    };
+  }
+};
+
+// src/client.ts
+var SDK_REQUEST_TIMEOUT_MS = 3e4;
+var VALID_ERROR_CODES = new Set(Object.values(ERROR_CODES));
+function toErrorCode(code) {
+  if (typeof code === "string" && VALID_ERROR_CODES.has(code)) {
+    return code;
+  }
+  return "INTERNAL_ERROR";
+}
+var HttpClient = class {
+  constructor(baseUrl, apiKey) {
+    this.baseUrl = baseUrl;
+    this.apiKey = apiKey;
+  }
+  async request(method, path, body) {
+    const url = `${this.baseUrl}${path}`;
+    const headers = {
+      Authorization: `Bearer ${this.apiKey}`,
+      "Content-Type": "application/json"
+    };
+    const res = await fetch(url, {
+      method,
+      headers,
+      body: body ? JSON.stringify(body) : void 0,
+      signal: AbortSignal.timeout(SDK_REQUEST_TIMEOUT_MS)
+    });
+    const data = await res.json();
+    if (!res.ok) {
+      const err = data;
+      throw new ArisPayError(
+        toErrorCode(err.error?.code),
+        err.error?.message ?? "Request failed",
+        res.status
+      );
+    }
+    return data;
+  }
+  get(path) {
+    return this.request("GET", path);
+  }
+  post(path, body) {
+    return this.request("POST", path, body);
+  }
+  put(path, body) {
+    return this.request("PUT", path, body);
+  }
+  delete(path) {
+    return this.request("DELETE", path);
+  }
+};
+
+// src/agents.ts
+var AgentService = class {
+  constructor(client) {
+    this.client = client;
+  }
+  async register(params) {
+    return this.client.post("/v1/agents", params);
+  }
+  async get(agentId) {
+    return this.client.get(`/v1/agents/${agentId}`);
+  }
+  async list(params) {
+    const query = new URLSearchParams();
+    if (params?.name) query.set("name", params.name);
+    if (params?.status) query.set("status", params.status);
+    if (params?.limit) query.set("limit", String(params.limit));
+    if (params?.offset) query.set("offset", String(params.offset));
+    const qs = query.toString();
+    return this.client.get(`/v1/agents${qs ? `?${qs}` : ""}`);
+  }
+  async listChildren(agentId) {
+    return this.client.get(`/v1/agents/${agentId}/children`);
+  }
+  async resume(agentId) {
+    return this.client.post(`/v1/agents/${agentId}/resume`);
+  }
+  async setCircuitBreaker(agentId, params) {
+    return this.client.put(`/v1/agents/${agentId}/circuit-breaker`, params);
+  }
+  async getCircuitBreaker(agentId) {
+    return this.client.get(`/v1/agents/${agentId}/circuit-breaker`);
+  }
+  async rotateKeys(agentId) {
+    return this.client.post(`/v1/agents/${agentId}/rotate-keys`);
+  }
+  // ── Autonomous Agent Methods ──────────────────────────
+  /**
+   * Get the current balance for an autonomous agent.
+   */
+  async getBalance(agentId) {
+    return this.client.get(`/v1/agents/${agentId}/balance`);
+  }
+  /**
+   * Fund an autonomous agent's balance (topup).
+   */
+  async topup(agentId, params) {
+    return this.client.post(`/v1/agents/${agentId}/topup`, params);
+  }
+  /**
+   * Withdraw from an autonomous agent's balance (sweep).
+   * Omit `amount` to sweep everything above the sweep threshold.
+   */
+  async sweep(agentId, params) {
+    return this.client.post(`/v1/agents/${agentId}/sweep`, params ?? {});
+  }
+  /**
+   * Get paginated ledger history for an autonomous agent.
+   */
+  async getLedger(agentId, params) {
+    const query = new URLSearchParams();
+    if (params?.limit) query.set("limit", String(params.limit));
+    if (params?.offset) query.set("offset", String(params.offset));
+    if (params?.type) query.set("type", params.type);
+    if (params?.from) query.set("from", params.from);
+    if (params?.to) query.set("to", params.to);
+    const qs = query.toString();
+    return this.client.get(`/v1/agents/${agentId}/ledger${qs ? `?${qs}` : ""}`);
+  }
+  /**
+   * Record an earning (inbound money) for an autonomous agent.
+   */
+  async recordEarning(agentId, params) {
+    return this.client.post(`/v1/agents/${agentId}/earn`, params);
+  }
+};
+
+// src/users.ts
+var UserService = class {
+  constructor(client) {
+    this.client = client;
+  }
+  async create(params) {
+    return this.client.post("/v1/users", params);
+  }
+  async get(userId) {
+    return this.client.get(`/v1/users/${userId}`);
+  }
+  async getByExternalId(externalId) {
+    return this.client.get(`/v1/users/by-external/${encodeURIComponent(externalId)}`);
+  }
+  async getWalletStatus(userId) {
+    return this.client.get(`/v1/users/${userId}/wallet-status`);
+  }
+  async addPaymentMethod(params) {
+    const { userId, ...body } = params;
+    return this.client.post(`/v1/users/${userId}/payment-methods`, body);
+  }
+  async completePaymentMethod(params) {
+    const { userId, ...body } = params;
+    return this.client.post(`/v1/users/${userId}/payment-methods/complete`, body);
+  }
+  async setLimits(params) {
+    const { userId, ...body } = params;
+    return this.client.put(`/v1/users/${userId}/limits`, body);
+  }
+};
+
+// src/payments.ts
+var PaymentService = class {
+  constructor(client) {
+    this.client = client;
+  }
+  async create(params) {
+    return this.client.post("/v1/payments", params);
+  }
+  async get(paymentId) {
+    return this.client.get(`/v1/payments/${paymentId}`);
+  }
+  /** Complete a 3D Secure authentication step (method or challenge) */
+  async complete3ds(paymentId, params) {
+    return this.client.post(
+      `/v1/payments/${paymentId}/3ds/complete`,
+      params
+    );
+  }
+};
+
+// src/transactions.ts
+var TransactionService = class {
+  constructor(client) {
+    this.client = client;
+  }
+  async list(params) {
+    const searchParams = new URLSearchParams();
+    if (params?.userId) searchParams.set("userId", params.userId);
+    if (params?.agentId) searchParams.set("agentId", params.agentId);
+    if (params?.from) searchParams.set("from", params.from);
+    if (params?.to) searchParams.set("to", params.to);
+    if (params?.limit) searchParams.set("limit", String(params.limit));
+    if (params?.offset) searchParams.set("offset", String(params.offset));
+    const qs = searchParams.toString();
+    return this.client.get(`/v1/transactions${qs ? `?${qs}` : ""}`);
+  }
+};
+
+// src/webhooks.ts
+import { createHmac, timingSafeEqual } from "crypto";
+var WEBHOOK_TOLERANCE_SECONDS = 300;
+var WebhookService = class {
+  constructor(client) {
+    this.client = client;
+  }
+  async register(params) {
+    return this.client.post("/v1/webhooks", params);
+  }
+  async list() {
+    return this.client.get("/v1/webhooks");
+  }
+  async delete(webhookId) {
+    await this.client.delete(`/v1/webhooks/${webhookId}`);
+  }
+  /**
+   * Verify a webhook signature from an incoming request.
+   *
+   * ArisPay signs every webhook delivery with HMAC-SHA256 using the secret
+   * returned when you registered the webhook. The signature is sent in the
+   * `X-ArisPay-Signature` header and the unix timestamp in `X-ArisPay-Timestamp`.
+   *
+   * @param body      - The raw request body string (do NOT parse it first)
+   * @param signature - Value of the `X-ArisPay-Signature` header
+   * @param timestamp - Value of the `X-ArisPay-Timestamp` header
+   * @param secret    - Your webhook secret (`whsec_...`)
+   * @param toleranceSec - Maximum allowed age in seconds (default: 300 = 5 min)
+   * @returns `true` if the signature is valid and the timestamp is within tolerance
+   *
+   * @example
+   * ```ts
+   * import { WebhookService } from 'arispay';
+   *
+   * app.post('/webhooks', (req, res) => {
+   *   const isValid = WebhookService.verifyWebhookSignature(
+   *     req.body,                              // raw body string
+   *     req.headers['x-arispay-signature'],
+   *     req.headers['x-arispay-timestamp'],
+   *     process.env.WEBHOOK_SECRET!,
+   *   );
+   *   if (!isValid) return res.status(401).send('Invalid signature');
+   *   // Process the webhook event...
+   * });
+   * ```
+   */
+  static verifyWebhookSignature(body, signature, timestamp, secret, toleranceSec = WEBHOOK_TOLERANCE_SECONDS) {
+    if (!body || !signature || !timestamp || !secret) return false;
+    const ts = parseInt(timestamp, 10);
+    if (isNaN(ts)) return false;
+    const age = Math.abs(Math.floor(Date.now() / 1e3) - ts);
+    if (age > toleranceSec) return false;
+    const signaturePayload = `${timestamp}.${body}`;
+    const expected = createHmac("sha256", secret).update(signaturePayload).digest("hex");
+    try {
+      return timingSafeEqual(Buffer.from(signature, "hex"), Buffer.from(expected, "hex"));
+    } catch {
+      return false;
+    }
+  }
+};
+
+// src/index.ts
+var ArisPay = class {
+  /**
+   * Initialize the ArisPay SDK.
+   *
+   * @example
+   * ```ts
+   * import ArisPay from 'arispay';
+   *
+   * const arispay = ArisPay.init({
+   *   apiKey: 'ap_test_abc123',
+   *   environment: 'sandbox',
+   * });
+   *
+   * const agent = await arispay.agents.register({
+   *   name: 'TableClaw',
+   *   description: 'AI restaurant booking agent',
+   *   permissions: ['browse', 'payment'],
+   * });
+   *
+   * const user = await arispay.users.create({
+   *   externalId: 'user_123',
+   *   email: 'jane@example.com',
+   * });
+   *
+   * const payment = await arispay.payments.create({
+   *   agentId: agent.id,
+   *   userId: user.id,
+   *   amount: 20000,
+   *   currency: 'USD',
+   *   merchantUrl: 'https://nobu.com',
+   *   memo: 'Table for 2',
+   *   idempotencyKey: 'booking_123',
+   * });
+   * ```
+   */
+  static init(config) {
+    const defaultUrl = config.environment === "production" ? "https://api.arispay.app" : "https://api-production-79ea.up.railway.app";
+    const baseUrl = config.baseUrl || defaultUrl;
+    const client = new HttpClient(baseUrl, config.apiKey);
+    return {
+      agents: new AgentService(client),
+      users: new UserService(client),
+      payments: new PaymentService(client),
+      transactions: new TransactionService(client),
+      webhooks: new WebhookService(client)
+    };
+  }
+};
+
+// src/cli-shared.ts
+import { readFileSync, writeFileSync, existsSync, mkdirSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+import { createInterface } from "readline";
+function createBrand(cmd, authHint) {
+  const configDir = join(homedir(), `.${cmd}`);
+  const envPrefix = cmd.toUpperCase();
+  return { cmd, configDir, envPrefix, authHint };
+}
+function configFile(brand) {
+  return join(brand.configDir, "config.json");
+}
+function loadConfig(brand) {
+  const file = configFile(brand);
+  const fileConfig = existsSync(file) ? JSON.parse(readFileSync(file, "utf-8")) : {};
+  return {
+    ...fileConfig,
+    apiKey: env(`${brand.envPrefix}_API_KEY`) || fileConfig.apiKey,
+    environment: env(`${brand.envPrefix}_ENV`) || fileConfig.environment || "sandbox",
+    baseUrl: env(`${brand.envPrefix}_BASE_URL`) || fileConfig.baseUrl
+  };
+}
+function saveConfig(brand, config) {
+  if (!existsSync(brand.configDir)) mkdirSync(brand.configDir, { recursive: true });
+  writeFileSync(configFile(brand), JSON.stringify(config, null, 2) + "\n");
+}
+function getClient(brand) {
+  const config = loadConfig(brand);
+  const key = config.apiKey || config.accessToken;
+  if (!key) {
+    error(`No credentials configured. Run: ${brand.authHint}`);
+  }
+  return ArisPay.init({
+    apiKey: key,
+    environment: config.environment,
+    baseUrl: config.baseUrl
+  });
+}
+function env(key) {
+  return process.env[key];
+}
+function error(msg) {
+  console.error(`\x1B[31m\u2717\x1B[0m ${msg}`);
+  process.exit(1);
+}
+function success(msg) {
+  console.log(`\x1B[32m\u2713\x1B[0m ${msg}`);
+}
+function dim(msg) {
+  return `\x1B[2m${msg}\x1B[0m`;
+}
+function bold(msg) {
+  return `\x1B[1m${msg}\x1B[0m`;
+}
+function cyan(msg) {
+  return `\x1B[36m${msg}\x1B[0m`;
+}
+function json(data) {
+  console.log(JSON.stringify(data, null, 2));
+}
+function table(rows) {
+  if (rows.length === 0) {
+    console.log(dim("  (none)"));
+    return;
+  }
+  const keys = Object.keys(rows[0]);
+  const widths = keys.map(
+    (k) => Math.max(k.length, ...rows.map((r) => String(r[k] ?? "").length))
+  );
+  console.log(keys.map((k, i) => bold(k.padEnd(widths[i]))).join("  "));
+  console.log(widths.map((w) => "\u2500".repeat(w)).join("\u2500\u2500"));
+  for (const row of rows) {
+    console.log(keys.map((k, i) => String(row[k] ?? "").padEnd(widths[i])).join("  "));
+  }
+}
+function prompt(question) {
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve) => {
+    rl.question(question, (answer) => {
+      rl.close();
+      resolve(answer.trim());
+    });
+  });
+}
+function promptSecret(question) {
+  return new Promise((resolve) => {
+    process.stdout.write(question);
+    const rl = createInterface({ input: process.stdin, terminal: false });
+    if (process.stdin.isTTY) {
+      process.stdin.setRawMode?.(true);
+    }
+    let input = "";
+    const onData = (ch) => {
+      const c = ch.toString();
+      if (c === "\n" || c === "\r") {
+        process.stdin.removeListener("data", onData);
+        if (process.stdin.isTTY) process.stdin.setRawMode?.(false);
+        rl.close();
+        process.stdout.write("\n");
+        resolve(input.trim());
+      } else if (c === "\x7F" || c === "\b") {
+        input = input.slice(0, -1);
+      } else if (c === "") {
+        process.exit(0);
+      } else {
+        input += c;
+      }
+    };
+    if (process.stdin.isTTY) {
+      process.stdin.resume();
+      process.stdin.on("data", onData);
+    } else {
+      rl.on("line", (line) => {
+        rl.close();
+        resolve(line.trim());
+      });
+    }
+  });
+}
+function parseFlags(args) {
+  const flags = {};
+  const positional = [];
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg.startsWith("--")) {
+      const eqIdx = arg.indexOf("=");
+      if (eqIdx !== -1) {
+        flags[arg.slice(2, eqIdx)] = arg.slice(eqIdx + 1);
+      } else {
+        flags[arg.slice(2)] = args[++i] ?? "true";
+      }
+    } else if (arg.startsWith("-") && arg.length === 2) {
+      flags[arg.slice(1)] = args[++i] ?? "true";
+    } else {
+      positional.push(arg);
+    }
+  }
+  return { flags, positional };
+}
+function requireFlag(flags, key, label) {
+  const val = flags[key];
+  if (!val) error(`Missing required flag: --${key}${label ? ` (${label})` : ""}`);
+  return val;
+}
+async function cmdAgents(args, brand) {
+  const [sub, ...rest] = args;
+  if (!sub || sub === "help" || sub === "--help") {
+    return cmdAgentsHelp(brand);
+  }
+  const { flags, positional } = parseFlags(rest);
+  const client = getClient(brand);
+  const $ = brand.cmd;
+  switch (sub) {
+    case "list":
+    case "ls": {
+      const agents = await client.agents.list({
+        limit: flags["limit"] ? Number(flags["limit"]) : 20,
+        offset: flags["offset"] ? Number(flags["offset"]) : void 0,
+        status: flags["status"],
+        name: flags["name"]
+      });
+      table(
+        agents.agents?.map((a) => ({
+          id: a.id.slice(0, 12) + "\u2026",
+          name: a.name,
+          mode: a.mode || "platform",
+          status: a.status,
+          created: a.createdAt?.slice(0, 10)
+        })) ?? []
+      );
+      break;
+    }
+    case "create": {
+      const name = flags["name"] || positional[0];
+      if (!name) error(`Usage: ${$} agents create --name <name> [--mode platform|autonomous]`);
+      const agent = await client.agents.register({
+        name,
+        description: flags["description"],
+        permissions: (flags["permissions"] || "browse,payment").split(","),
+        mode: flags["mode"] || void 0,
+        sweepThreshold: flags["sweep-threshold"] ? Number(flags["sweep-threshold"]) : void 0
+      });
+      success(`Agent created: ${agent.id}`);
+      json(agent);
+      break;
+    }
+    case "get": {
+      const id = flags["id"] || positional[0];
+      if (!id) error(`Usage: ${$} agents get <id>`);
+      const agent = await client.agents.get(id);
+      json(agent);
+      break;
+    }
+    case "rotate-keys": {
+      const id = flags["id"] || positional[0];
+      if (!id) error(`Usage: ${$} agents rotate-keys <id>`);
+      const result = await client.agents.rotateKeys(id);
+      success("Keys rotated");
+      json(result);
+      break;
+    }
+    case "balance": {
+      const id = flags["id"] || positional[0];
+      if (!id) error(`Usage: ${$} agents balance <id>`);
+      const balance = await client.agents.getBalance(id);
+      const cents = balance.balance ?? balance.balanceCents ?? 0;
+      console.log(`
+  ${bold("Balance:")} ${cyan("$" + (cents / 100).toFixed(2))} ${balance.currency || "USD"}
+`);
+      break;
+    }
+    case "ledger": {
+      const id = flags["id"] || positional[0];
+      if (!id) error(`Usage: ${$} agents ledger <id>`);
+      const ledger = await client.agents.getLedger(id, {
+        limit: flags["limit"] ? Number(flags["limit"]) : 20
+      });
+      table(
+        (ledger.entries ?? []).map((e) => ({
+          type: e.type,
+          direction: e.direction,
+          amount: "$" + (e.amount / 100).toFixed(2),
+          balance: "$" + (e.balanceAfter / 100).toFixed(2),
+          description: (e.description || "").slice(0, 30),
+          date: e.createdAt?.slice(0, 10)
+        }))
+      );
+      break;
+    }
+    case "topup": {
+      const id = flags["id"] || positional[0];
+      if (!id) error(`Usage: ${$} agents topup <id> --amount <cents> --user <userId>`);
+      const amount = Number(requireFlag(flags, "amount", "in cents"));
+      const userId = requireFlag(flags, "user", "end user ID");
+      const result = await client.agents.topup(id, { amount, userId });
+      success(`Topped up $${(amount / 100).toFixed(2)}`);
+      json(result);
+      break;
+    }
+    case "sweep": {
+      const id = flags["id"] || positional[0];
+      if (!id) error(`Usage: ${$} agents sweep <id> [--amount <cents>]`);
+      const result = await client.agents.sweep(id, {
+        amount: flags["amount"] ? Number(flags["amount"]) : void 0
+      });
+      success("Sweep complete");
+      json(result);
+      break;
+    }
+    case "resume": {
+      const id = flags["id"] || positional[0];
+      if (!id) error(`Usage: ${$} agents resume <id>`);
+      const result = await client.agents.resume(id);
+      success(`Agent resumed at ${result.resumedAt}`);
+      break;
+    }
+    default:
+      cmdAgentsHelp(brand);
+  }
+}
+function cmdAgentsHelp(brand) {
+  const $ = brand.cmd;
+  console.log(`
+${bold(`${$} agents`)} \u2014 Manage AI payment agents
+
+  ${cyan(`${$} agents list`)}          List agents
+  ${cyan(`${$} agents create`)}        Register a new agent
+  ${cyan(`${$} agents get <id>`)}      Get agent details
+  ${cyan(`${$} agents balance <id>`)}  Check agent balance
+  ${cyan(`${$} agents ledger <id>`)}   View agent ledger
+  ${cyan(`${$} agents topup <id>`)}    Fund agent from user's card
+  ${cyan(`${$} agents sweep <id>`)}    Withdraw agent balance
+  ${cyan(`${$} agents rotate-keys <id>`)}  Rotate TAP keypair
+  ${cyan(`${$} agents resume <id>`)}   Resume suspended agent
+`);
+}
+async function cmdUsers(args, brand) {
+  const [sub, ...rest] = args;
+  if (!sub || sub === "help" || sub === "--help") {
+    return cmdUsersHelp(brand);
+  }
+  const { flags, positional } = parseFlags(rest);
+  const client = getClient(brand);
+  const $ = brand.cmd;
+  switch (sub) {
+    case "create": {
+      const externalId = flags["external-id"] || positional[0];
+      if (!externalId) error(`Usage: ${$} users create --external-id <id> [--email <email>]`);
+      const user = await client.users.create({
+        externalId,
+        email: flags["email"]
+      });
+      success(`User created: ${user.id}`);
+      json(user);
+      break;
+    }
+    case "get": {
+      const id = flags["id"] || positional[0];
+      if (!id) error(`Usage: ${$} users get <id>`);
+      const user = await client.users.get(id);
+      json(user);
+      break;
+    }
+    case "find": {
+      const externalId = flags["external-id"] || positional[0];
+      if (!externalId) error(`Usage: ${$} users find <externalId>`);
+      const user = await client.users.getByExternalId(externalId);
+      json(user);
+      break;
+    }
+    case "add-card": {
+      const id = flags["id"] || positional[0];
+      if (!id) error(`Usage: ${$} users add-card <userId> --return-url <url>`);
+      const returnUrl = requireFlag(flags, "return-url");
+      const result = await client.users.addPaymentMethod({
+        userId: id,
+        type: "card",
+        returnUrl
+      });
+      success("Card setup initiated");
+      console.log(`
+  ${bold("Setup URL:")} ${result.setupUrl}`);
+      console.log(`  ${bold("Session ID:")} ${result.sessionId}
+`);
+      break;
+    }
+    case "add-wallet": {
+      const id = flags["id"] || positional[0];
+      if (!id) error(`Usage: ${$} users add-wallet <userId> --address <addr> --chain <chain>`);
+      const walletAddress = requireFlag(flags, "address", "wallet address");
+      const chain = requireFlag(flags, "chain", "ethereum|base|polygon|solana");
+      const result = await client.users.addPaymentMethod({
+        userId: id,
+        type: "wallet",
+        walletAddress,
+        chain
+      });
+      success("Wallet registered");
+      json(result);
+      break;
+    }
+    case "set-limits": {
+      const id = flags["id"] || positional[0];
+      if (!id) error(`Usage: ${$} users set-limits <userId> --agent <agentId> [--per-tx <cents>] [--daily <cents>] [--monthly <cents>]`);
+      const agentId = requireFlag(flags, "agent", "agent ID");
+      const result = await client.users.setLimits({
+        userId: id,
+        agentId,
+        maxPerTransaction: flags["per-tx"] ? Number(flags["per-tx"]) : void 0,
+        maxDaily: flags["daily"] ? Number(flags["daily"]) : void 0,
+        maxMonthly: flags["monthly"] ? Number(flags["monthly"]) : void 0
+      });
+      success("Spend limits updated");
+      json(result);
+      break;
+    }
+    case "wallet-status": {
+      const id = flags["id"] || positional[0];
+      if (!id) error(`Usage: ${$} users wallet-status <userId>`);
+      const status = await client.users.getWalletStatus(id);
+      json(status);
+      break;
+    }
+    default:
+      cmdUsersHelp(brand);
+  }
+}
+function cmdUsersHelp(brand) {
+  const $ = brand.cmd;
+  console.log(`
+${bold(`${$} users`)} \u2014 Manage end users & payment methods
+
+  ${cyan(`${$} users create`)}          Create end user
+  ${cyan(`${$} users get <id>`)}        Get user by ID
+  ${cyan(`${$} users find <extId>`)}    Find user by external ID
+  ${cyan(`${$} users add-card <id>`)}   Start card tokenization
+  ${cyan(`${$} users add-wallet <id>`)} Register crypto wallet
+  ${cyan(`${$} users set-limits <id>`)} Set spend limits
+  ${cyan(`${$} users wallet-status <id>`)} Check wallet USDC status
+`);
+}
+async function cmdPay(args, brand) {
+  const { flags } = parseFlags(args);
+  const client = getClient(brand);
+  const agentId = requireFlag(flags, "agent", "agent ID");
+  const amount = Number(requireFlag(flags, "amount", "amount in cents"));
+  const currency = flags["currency"] || "USD";
+  const memo = requireFlag(flags, "memo", "payment memo");
+  const idempotencyKey = flags["idempotency-key"] || `cli_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
+  const params = {
+    agentId,
+    amount,
+    currency,
+    memo,
+    idempotencyKey
+  };
+  if (flags["user"]) params.userId = flags["user"];
+  if (flags["merchant-url"]) params.merchantUrl = flags["merchant-url"];
+  if (flags["merchant-name"]) params.merchantName = flags["merchant-name"];
+  if (flags["rail"]) params.rail = flags["rail"];
+  if (flags["chain"]) params.chain = flags["chain"];
+  if (flags["recipient"]) params.recipientAddress = flags["recipient"];
+  if (flags["token"]) params.token = flags["token"];
+  if (flags["metadata"]) {
+    try {
+      params.metadata = JSON.parse(flags["metadata"]);
+    } catch {
+      error("--metadata must be valid JSON");
+    }
+  }
+  console.log(`
+  ${dim("Creating payment...")}
+`);
+  const payment = await client.payments.create(params);
+  const p = payment;
+  if (p.status === "succeeded") {
+    success(`Payment ${bold(p.id)} \u2014 $${(amount / 100).toFixed(2)} ${currency}`);
+  } else if (p.status === "requires_action") {
+    console.log(`  ${bold("Status:")} requires_action (3DS)`);
+    if (p.nextAction?.type === "redirect") {
+      console.log(`  ${bold("Redirect:")} ${p.nextAction.url}`);
+    }
+  } else {
+    console.log(`  ${bold("Status:")} ${p.status}`);
+  }
+  console.log();
+  json(payment);
+}
+async function cmdPaymentGet(args, brand) {
+  const { positional } = parseFlags(args);
+  const id = positional[0];
+  if (!id) error(`Usage: ${brand.cmd} payment <id>`);
+  const client = getClient(brand);
+  const payment = await client.payments.get(id);
+  json(payment);
+}
+async function cmdTransactions(args, brand) {
+  const { flags } = parseFlags(args);
+  const client = getClient(brand);
+  const result = await client.transactions.list({
+    agentId: flags["agent"],
+    userId: flags["user"],
+    from: flags["from"],
+    to: flags["to"],
+    limit: flags["limit"] ? Number(flags["limit"]) : 20,
+    offset: flags["offset"] ? Number(flags["offset"]) : void 0
+  });
+  const payments = result.payments ?? result.transactions ?? [];
+  table(
+    payments.map((p) => ({
+      id: p.id.slice(0, 12) + "\u2026",
+      amount: "$" + (p.amount / 100).toFixed(2),
+      status: p.status,
+      rail: p.rail || "card",
+      memo: (p.memo || "").slice(0, 25),
+      date: p.createdAt?.slice(0, 10)
+    }))
+  );
+}
+async function cmdWebhooks(args, brand) {
+  const [sub, ...rest] = args;
+  if (!sub || sub === "help" || sub === "--help") {
+    return cmdWebhooksHelp(brand);
+  }
+  const { flags, positional } = parseFlags(rest);
+  const client = getClient(brand);
+  const $ = brand.cmd;
+  switch (sub) {
+    case "list":
+    case "ls": {
+      const result = await client.webhooks.list();
+      const webhooks = Array.isArray(result) ? result : result.data ?? [];
+      table(
+        webhooks.map((w) => ({
+          id: w.id.slice(0, 12) + "\u2026",
+          url: w.url.slice(0, 40),
+          events: (w.events || []).join(", ").slice(0, 30),
+          status: w.status || "active"
+        }))
+      );
+      break;
+    }
+    case "create": {
+      const url = flags["url"] || positional[0];
+      if (!url) error(`Usage: ${$} webhooks create --url <url> --events <evt1,evt2>`);
+      const events = (flags["events"] || "payment.succeeded,payment.failed").split(",");
+      const result = await client.webhooks.register({ url, events });
+      success("Webhook created");
+      console.log(`
+  ${bold("Secret:")} ${result.secret}`);
+      console.log(dim("  Store this \u2014 it won't be shown again.\n"));
+      json(result);
+      break;
+    }
+    case "delete":
+    case "rm": {
+      const id = flags["id"] || positional[0];
+      if (!id) error(`Usage: ${$} webhooks delete <id>`);
+      await client.webhooks.delete(id);
+      success(`Webhook ${id} deleted`);
+      break;
+    }
+    default:
+      cmdWebhooksHelp(brand);
+  }
+}
+function cmdWebhooksHelp(brand) {
+  const $ = brand.cmd;
+  console.log(`
+${bold(`${$} webhooks`)} \u2014 Manage webhook endpoints
+
+  ${cyan(`${$} webhooks list`)}            List webhooks
+  ${cyan(`${$} webhooks create`)}          Register new webhook
+  ${cyan(`${$} webhooks delete <id>`)}     Delete webhook
+`);
+}
+async function cmdStatus(brand) {
+  const config = loadConfig(brand);
+  console.log(`
+${bold(`${brand.cmd} status`)}
+`);
+  const key = config.apiKey || config.accessToken;
+  if (config.email) {
+    console.log(`  ${bold("Logged in:")}  ${config.email}`);
+  }
+  if (key) {
+    const masked = key.slice(0, 12) + "\u2026" + key.slice(-4);
+    console.log(`  ${bold("Auth:")}       ${masked}`);
+  } else {
+    console.log(`  ${bold("Auth:")}       ${dim(`not configured \u2014 run: ${brand.authHint}`)}`);
+  }
+  console.log(`  ${bold("Environment:")} ${config.environment || "sandbox"}`);
+  if (config.baseUrl) console.log(`  ${bold("Base URL:")}    ${config.baseUrl}`);
+  console.log(`  ${bold("Config:")}      ${configFile(brand)}`);
+  if (key) {
+    try {
+      const client = getClient(brand);
+      await client.transactions.list({ limit: 1 });
+      console.log(`  ${bold("API:")}         \x1B[32mconnected\x1B[0m`);
+    } catch (e) {
+      if (e.statusCode === 401) {
+        console.log(`  ${bold("API:")}         \x1B[31minvalid / expired\x1B[0m`);
+      } else {
+        console.log(`  ${bold("API:")}         \x1B[33munreachable\x1B[0m ${dim(e.message || "")}`);
+      }
+    }
+  }
+  console.log();
+}
+function getVersion() {
+  try {
+    const pkg = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf-8"));
+    return pkg.version;
+  } catch {
+    return "0.1.0";
+  }
+}
+
+export {
+  ArisPay,
+  createBrand,
+  configFile,
+  loadConfig,
+  saveConfig,
+  error,
+  success,
+  dim,
+  bold,
+  cyan,
+  table,
+  prompt,
+  promptSecret,
+  parseFlags,
+  cmdAgents,
+  cmdUsers,
+  cmdPay,
+  cmdPaymentGet,
+  cmdTransactions,
+  cmdWebhooks,
+  cmdStatus,
+  getVersion
+};