hedge-broker 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,18 @@
+# Changelog
+
+All notable changes to `hedge-broker` are documented here. This project follows
+[Semantic Versioning](https://semver.org) and
+[Keep a Changelog](https://keepachangelog.com).
+
+## [0.1.0] - 2026-07-06
+
+### Added
+
+- Initial release.
+- OAuth 2.1 sign-in: device-code (default, works over SSH), browser loopback (`--browser`), with automatic token refresh and `0600` credential storage.
+- `login`, `logout`, `whoami`.
+- Submissions: `submit`, `upload`, `requirements`, `finalize`, `status`, `submissions`.
+- Instant carrier quotes: `quotes`, `answer`, `request-quote`.
+- `appetite`, `policies`, `payments`.
+- Global `--json` output and `--staging` environment switch.
+- Distributed three ways: npm (`hedge-broker`), Homebrew (`taventech/tap/hedge`), and a self-contained binary via the curl installer.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Taven Insurance Services LLC (dba Hedge Specialty)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,105 @@
+# hedge
+
+The Hedge broker portal from your terminal. Submit risks, check appetite, run instant carrier quotes, and track status, policies, and payments.
+
+## Install
+
+Three ways to install. Pick one.
+
+### npm (requires Node.js 18 or newer)
+
+```bash
+npm install -g hedge-broker   # provides `hedge`
+```
+
+Or run without installing:
+
+```bash
+npx hedge-broker appetite "roofing contractor" --state CA
+```
+
+### Homebrew (self-contained binary, no Node required)
+
+```bash
+brew install taventech/tap/hedge
+```
+
+### curl (self-contained binary, no Node required)
+
+```bash
+curl -fsSL https://github.com/taventech/hedge-cli/releases/latest/download/install.sh | sh
+```
+
+The installer downloads the binary for your OS and CPU into `$HOME/.local/bin`. Add that directory to your `PATH` if it is not already there.
+
+## Quickstart
+
+```bash
+hedge login                      # device-code sign in (prints a code + URL)
+hedge appetite "hvac contractor" --state TX
+hedge submit --insured "Acme HVAC" --narrative "Residential HVAC install and repair" --lob commercial_general_liability --state TX
+hedge upload <submission-id> ./acord-125.pdf
+hedge finalize <submission-id>   # start marketing to carriers
+hedge status <submission-id>
+```
+
+## Commands
+
+| Command | What it does |
+| --- | --- |
+| `hedge appetite <class> [--state ST] [--lob slug]` | Which markets have appetite for a class of business. |
+| `hedge submit --insured <name> --narrative <text> [--lob a,b] [--state ST] [--effective YYYY-MM-DD]` | Create a submission (does not market it yet). |
+| `hedge upload <submissionId> <file.pdf> [--name label]` | Attach an ACORD, loss runs, or supplement. |
+| `hedge requirements <submissionId>` | What the submission still needs (per market, forms, carrier questions). |
+| `hedge finalize <submissionId>` | Start marketing the submission to carriers. |
+| `hedge status <submissionId>` | Submission detail plus live marketing and quote status. |
+| `hedge submissions [--status state] [--search q]` | List your brokerage's submissions. |
+| `hedge quotes <submissionId>` | List instant-quote carrier sessions and their open questions. |
+| `hedge answer <submissionId> <sessionId> --set k=v [--set k=v ...]` | Answer a carrier session's questions. |
+| `hedge request-quote <submissionId> <sessionId>` | Close a carrier session, request an indication, then a quote. |
+| `hedge policies` | List bound policies. |
+| `hedge payments` | List payment and invoice status. |
+| `hedge whoami` | Show the signed-in broker and brokerage. |
+| `hedge login` / `hedge logout` | Sign in and out. |
+
+Add `--json` to any command for the raw API response, so the CLI composes in scripts:
+
+```bash
+hedge submissions --json | jq '.[] | select(.status_label=="Quoted") | .insured_name'
+```
+
+Add `--staging` to any command (or set `HEDGE_ENV=staging`) to target the staging environment.
+
+## Example: a submission end to end
+
+```bash
+hedge login
+hedge appetite "roofing contractor" --state CA
+hedge submit \
+  --insured "Peak Roofing LLC" \
+  --narrative "Residential re-roofing, no hot tar, no work over 3 stories" \
+  --lob commercial_general_liability \
+  --state CA \
+  --effective 2026-08-01
+hedge upload <submission-id> ./acord-125.pdf --name "ACORD 125"
+hedge requirements <submission-id>
+hedge finalize <submission-id>
+hedge status <submission-id>
+```
+
+## Signing in
+
+The CLI signs in with OAuth 2.1, so there are no API keys to copy around for the interactive flow, and it works over SSH.
+
+| Mode | How | When to use |
+| --- | --- | --- |
+| Device code (default) | `hedge login` | Anywhere, including headless servers and SSH. Prints a short code and a URL to approve in any browser. |
+| Browser (loopback) | `hedge login --browser` | A local machine with a browser. Opens it and captures the redirect on `127.0.0.1`. |
+
+Credentials are stored per profile at `~/.config/taven-cli/hedge.<profile>.json` with `0600` permissions. Access tokens are refreshed automatically. Sign out with `hedge logout`.
+
+The CLI requests the `broker_mcp` and `broker_submit` scopes. Submitting on a brokerage's behalf requires that the brokerage has connected apps and programmatic submission enabled by Hedge. Read commands (appetite, submissions, status, requirements, policies, payments) work with either scope. `submit`, `upload`, `finalize`, and the carrier-quote commands require `broker_submit`.
+
+## License
+
+MIT. See [LICENSE](LICENSE).

package/dist/index.js

@@ -0,0 +1,552 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { Command } from "commander";
+
+// src/core/pkce.ts
+import { createHash, randomBytes } from "crypto";
+function b64url(buf) {
+  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function createPkce() {
+  const verifier = b64url(randomBytes(32));
+  const challenge = b64url(createHash("sha256").update(verifier).digest());
+  return { verifier, challenge };
+}
+function randomState() {
+  return b64url(randomBytes(16));
+}
+
+// src/core/config.ts
+import { chmodSync, mkdirSync, readFileSync, writeFileSync, existsSync, rmSync } from "fs";
+import { homedir } from "os";
+import { dirname, join } from "path";
+function configDir() {
+  const base = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
+  return join(base, "taven-cli");
+}
+function tokenPath(cfg) {
+  return join(configDir(), `${cfg.appName}.${cfg.profile}.json`);
+}
+function saveToken(cfg, token) {
+  const p = tokenPath(cfg);
+  mkdirSync(dirname(p), { recursive: true });
+  writeFileSync(p, JSON.stringify(token, null, 2), { mode: 384 });
+  chmodSync(p, 384);
+}
+function loadToken(cfg) {
+  const p = tokenPath(cfg);
+  if (!existsSync(p)) return null;
+  try {
+    return JSON.parse(readFileSync(p, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function clearToken(cfg) {
+  const p = tokenPath(cfg);
+  if (existsSync(p)) rmSync(p);
+}
+
+// src/core/oauth.ts
+import { createServer } from "http";
+var FORM = { "Content-Type": "application/x-www-form-urlencoded" };
+async function discover(metadataUrl) {
+  const res = await fetch(metadataUrl);
+  if (!res.ok) throw new Error(`Could not load auth metadata (${res.status}) from ${metadataUrl}`);
+  return await res.json();
+}
+async function registerClient(registrationEndpoint, clientName, redirectUris) {
+  const res = await fetch(registrationEndpoint, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ client_name: clientName, redirect_uris: redirectUris })
+  });
+  if (!res.ok) throw new Error(`Client registration failed (${res.status})`);
+  const body = await res.json();
+  if (!body.client_id) throw new Error("Registration returned no client_id");
+  return body.client_id;
+}
+async function deviceLogin(opts) {
+  const { meta, clientId } = opts;
+  if (!meta.device_authorization_endpoint) throw new Error("This server doesn't support device login");
+  const body = new URLSearchParams({ client_id: clientId });
+  if (opts.scope) body.set("scope", opts.scope);
+  const start = await fetch(meta.device_authorization_endpoint, { method: "POST", headers: FORM, body });
+  if (!start.ok) throw new Error(`Device authorization failed (${start.status})`);
+  const d = await start.json();
+  opts.onPrompt({
+    verificationUri: d.verification_uri,
+    verificationUriComplete: d.verification_uri_complete,
+    userCode: d.user_code
+  });
+  if (opts.openBrowser) opts.openBrowser(d.verification_uri_complete || d.verification_uri);
+  let interval = (d.interval || 5) * 1e3;
+  const deadline = Date.now() + (d.expires_in || 900) * 1e3;
+  while (Date.now() < deadline) {
+    await sleep(interval);
+    const poll = await fetch(meta.token_endpoint, {
+      method: "POST",
+      headers: FORM,
+      body: new URLSearchParams({
+        grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+        device_code: d.device_code,
+        client_id: clientId
+      })
+    });
+    const pb = await poll.json();
+    if (poll.ok) return pb;
+    if (pb.error === "authorization_pending") continue;
+    if (pb.error === "slow_down") {
+      interval += 5e3;
+      continue;
+    }
+    throw new Error(pb.error === "access_denied" ? "Access was denied" : pb.error || `Login failed (${poll.status})`);
+  }
+  throw new Error("Login timed out \u2014 run the command again");
+}
+async function loopbackLogin(opts) {
+  const { meta, clientId } = opts;
+  const { verifier, challenge } = createPkce();
+  const state = randomState();
+  return new Promise((resolve, reject) => {
+    const server = createServer(async (req, res) => {
+      try {
+        const url = new URL(req.url || "/", `http://127.0.0.1`);
+        if (!url.pathname.startsWith("/callback")) {
+          res.writeHead(404).end();
+          return;
+        }
+        const code = url.searchParams.get("code");
+        const gotState = url.searchParams.get("state");
+        const err = url.searchParams.get("error");
+        res.writeHead(200, { "Content-Type": "text/html" }).end(
+          "<html><body style='font-family:sans-serif;text-align:center;padding:3rem'>" + (err ? "You can close this tab." : "Signed in. You can close this tab and return to your terminal.") + "</body></html>"
+        );
+        server.close();
+        if (err) return reject(new Error(err));
+        if (!code || gotState !== state) return reject(new Error("Invalid callback"));
+        const redirectUri = `http://127.0.0.1:${port}/callback`;
+        const tr = await fetch(meta.token_endpoint, {
+          method: "POST",
+          headers: FORM,
+          body: new URLSearchParams({
+            grant_type: "authorization_code",
+            code,
+            code_verifier: verifier,
+            client_id: clientId,
+            redirect_uri: redirectUri
+          })
+        });
+        const tb = await tr.json();
+        if (!tr.ok) return reject(new Error(tb.error || `Token exchange failed (${tr.status})`));
+        resolve(tb);
+      } catch (e) {
+        reject(e);
+      }
+    });
+    server.listen(0, "127.0.0.1", () => {
+      const addr = server.address();
+      if (!addr || typeof addr === "string") return reject(new Error("Could not bind loopback port"));
+      port = addr.port;
+      const redirectUri = `http://127.0.0.1:${port}/callback`;
+      const authUrl = new URL(meta.authorization_endpoint);
+      authUrl.searchParams.set("response_type", "code");
+      authUrl.searchParams.set("client_id", clientId);
+      authUrl.searchParams.set("redirect_uri", redirectUri);
+      authUrl.searchParams.set("code_challenge", challenge);
+      authUrl.searchParams.set("code_challenge_method", "S256");
+      authUrl.searchParams.set("state", state);
+      if (opts.scope) authUrl.searchParams.set("scope", opts.scope);
+      opts.openBrowser(authUrl.toString());
+    });
+    let port = 0;
+  });
+}
+async function refresh(tokenEndpoint, clientId, refreshToken) {
+  const res = await fetch(tokenEndpoint, {
+    method: "POST",
+    headers: FORM,
+    body: new URLSearchParams({ grant_type: "refresh_token", refresh_token: refreshToken, client_id: clientId })
+  });
+  const body = await res.json();
+  if (!res.ok) throw new Error(body.error || `Token refresh failed (${res.status})`);
+  return body;
+}
+function sleep(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+
+// src/core/http.ts
+var ApiError = class extends Error {
+  constructor(status, message) {
+    super(message);
+    this.status = status;
+  }
+  status;
+};
+async function bearer(cfg) {
+  const tok = loadToken(cfg);
+  if (!tok) throw new ApiError(401, "Not signed in \u2014 run `login` first");
+  if (tok.expires_at - 60 > Math.floor(Date.now() / 1e3)) return tok.access_token;
+  if (!tok.refresh_token) throw new ApiError(401, "Session expired \u2014 run `login` again");
+  try {
+    const r = await refresh(tok.token_endpoint, tok.client_id, tok.refresh_token);
+    const updated = {
+      ...tok,
+      access_token: r.access_token,
+      refresh_token: r.refresh_token ?? tok.refresh_token,
+      expires_at: Math.floor(Date.now() / 1e3) + (r.expires_in ?? 3600),
+      scope: r.scope ?? tok.scope
+    };
+    saveToken(cfg, updated);
+    return updated.access_token;
+  } catch {
+    clearToken(cfg);
+    throw new ApiError(401, "Session expired \u2014 run `login` again");
+  }
+}
+async function apiRequest(opts, method, path, init) {
+  const url = new URL(opts.apiBase.replace(/\/$/, "") + path);
+  for (const [k, v] of Object.entries(init?.query ?? {})) if (v != null) url.searchParams.set(k, v);
+  const headers = { Accept: "application/json", ...init?.headers ?? {} };
+  if (opts.apiKey) {
+    headers[opts.apiKeyHeader ?? "X-Api-Key"] = opts.apiKey;
+  } else {
+    headers.Authorization = `Bearer ${await bearer(opts.cfg)}`;
+  }
+  let body;
+  if (init?.body !== void 0) {
+    headers["Content-Type"] = "application/json";
+    body = JSON.stringify(init.body);
+  }
+  const res = await fetch(url, { method, headers, body });
+  const text = await res.text();
+  let parsed = void 0;
+  if (text) {
+    try {
+      parsed = JSON.parse(text);
+    } catch {
+      parsed = text;
+    }
+  }
+  if (!res.ok) {
+    const detail = parsed && typeof parsed === "object" && "detail" in parsed && parsed.detail || parsed && typeof parsed === "object" && "error" in parsed && parsed.error || (typeof parsed === "string" ? parsed : `Request failed (${res.status})`);
+    throw new ApiError(res.status, String(detail));
+  }
+  return parsed;
+}
+async function multipartRequest(opts, method, path, form) {
+  const url = opts.apiBase.replace(/\/$/, "") + path;
+  const headers = { Accept: "application/json" };
+  if (opts.apiKey) headers[opts.apiKeyHeader ?? "X-Api-Key"] = opts.apiKey;
+  else headers.Authorization = `Bearer ${await bearer(opts.cfg)}`;
+  const res = await fetch(url, { method, headers, body: form });
+  const text = await res.text();
+  let parsed = text ? JSON.parse(text) : void 0;
+  if (!res.ok) {
+    const detail = parsed && typeof parsed === "object" && "detail" in parsed && parsed.detail || `Upload failed (${res.status})`;
+    throw new ApiError(res.status, String(detail));
+  }
+  return parsed;
+}
+
+// src/core/output.ts
+function printJson(data) {
+  process.stdout.write(JSON.stringify(data, null, 2) + "\n");
+}
+function table(rows, columns) {
+  if (rows.length === 0) return "(none)";
+  const cols = columns ?? Object.keys(rows[0]);
+  const widths = cols.map(
+    (c) => Math.max(c.length, ...rows.map((r) => String(r[c] ?? "").length))
+  );
+  const line = (cells) => cells.map((cell, i) => cell.padEnd(widths[i])).join("  ").trimEnd();
+  const head = line(cols.map((c) => c.toUpperCase()));
+  const body = rows.map((r) => line(cols.map((c) => String(r[c] ?? ""))));
+  return [head, ...body].join("\n");
+}
+function kv(obj) {
+  const width = Math.max(...Object.keys(obj).map((k) => k.length));
+  return Object.entries(obj).map(([k, v]) => `${k.padEnd(width)}  ${v ?? ""}`).join("\n");
+}
+
+// src/core/browser.ts
+import { spawn } from "child_process";
+function openBrowser(url) {
+  const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
+  const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+  try {
+    const child = spawn(cmd, args, { stdio: "ignore", detached: true });
+    child.on("error", () => {
+    });
+    child.unref();
+  } catch {
+  }
+}
+
+// src/core/login.ts
+async function loginInteractive(opts) {
+  const meta = await discover(opts.metadataUrl);
+  const mode = opts.mode ?? "device";
+  const redirectUris = ["http://127.0.0.1/callback", "http://localhost/callback"];
+  const clientId = opts.staticClientId ?? (meta.registration_endpoint ? await registerClient(meta.registration_endpoint, opts.clientName, redirectUris) : (() => {
+    throw new Error("Server has no client registration; a client_id is required");
+  })());
+  const tr = mode === "browser" ? await loopbackLogin({ meta, clientId, scope: opts.scope, openBrowser }) : await deviceLogin({
+    meta,
+    clientId,
+    scope: opts.scope,
+    openBrowser,
+    onPrompt: (info) => {
+      opts.log("");
+      opts.log("  To connect, open:  " + info.verificationUri);
+      opts.log("  and enter code:    " + info.userCode);
+      if (info.verificationUriComplete)
+        opts.log("  (or just open:     " + info.verificationUriComplete + ")");
+      opts.log("");
+      opts.log("Waiting for approval\u2026");
+    }
+  });
+  saveToken(opts.cfg, {
+    access_token: tr.access_token,
+    refresh_token: tr.refresh_token,
+    expires_at: Math.floor(Date.now() / 1e3) + (tr.expires_in ?? 3600),
+    scope: tr.scope,
+    token_endpoint: meta.token_endpoint,
+    client_id: clientId
+  });
+}
+
+// src/context.ts
+function resolveEnv(staging) {
+  if (staging || process.env.HEDGE_ENV === "staging") {
+    return {
+      metadataUrl: "https://staging-api.hedgespecialty.com/.well-known/oauth-authorization-server",
+      apiBase: "https://staging-api.hedgespecialty.com/api/v1",
+      brokerPortalBase: "https://staging-brokers.hedgespecialty.com"
+    };
+  }
+  return {
+    metadataUrl: "https://api.hedgespecialty.com/.well-known/oauth-authorization-server",
+    apiBase: "https://api.hedgespecialty.com/api/v1",
+    brokerPortalBase: "https://brokers.hedgespecialty.com"
+  };
+}
+function makeCtx(opts) {
+  const env = resolveEnv(!!opts.staging);
+  const cfg = { appName: "hedge", profile: opts.staging ? "staging" : "prod" };
+  return { env, cfg, client: { cfg, apiBase: env.apiBase }, json: !!opts.json };
+}
+
+// src/commands/auth.ts
+var SCOPE = "broker_mcp broker_submit";
+function registerAuth(program2) {
+  program2.command("login").description("Sign in to your Hedge broker account").option("--browser", "use the browser (loopback) flow instead of a device code").action(async (opts) => {
+    const g = program2.opts();
+    const ctx = makeCtx(g);
+    await loginInteractive({
+      cfg: ctx.cfg,
+      metadataUrl: ctx.env.metadataUrl,
+      clientName: "Hedge CLI",
+      scope: SCOPE,
+      mode: opts.browser ? "browser" : "device",
+      log: (m) => process.stdout.write(m + "\n")
+    });
+    process.stdout.write("\nSigned in.\n");
+  });
+  program2.command("logout").description("Remove stored credentials").action(() => {
+    const ctx = makeCtx(program2.opts());
+    clearToken(ctx.cfg);
+    process.stdout.write("Signed out.\n");
+  });
+  program2.command("whoami").description("Show the signed-in broker + brokerage").action(async () => {
+    const ctx = makeCtx(program2.opts());
+    const me = await apiRequest(ctx.client, "GET", "/broker/me");
+    if (ctx.json) return printJson(me);
+    const b = me.brokerage ?? {};
+    process.stdout.write(
+      kv({
+        email: me.email,
+        name: me.full_name,
+        brokerage: b.name,
+        role: me.role
+      }) + "\n"
+    );
+  });
+}
+
+// src/commands/submissions.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { basename } from "path";
+function registerSubmissions(program2) {
+  program2.command("submit").description("Create a submission (does not market it \u2014 run `finalize` when ready)").requiredOption("--insured <name>", "insured business name").requiredOption("--narrative <text>", "operations description of the risk").option("--lob <slugs>", "comma-separated lines of business, e.g. commercial_general_liability,workers_compensation").option("--effective <date>", "effective date, YYYY-MM-DD").option("--state <ST>", "primary state (2-letter)").action(async (opts) => {
+    const ctx = makeCtx(program2.opts());
+    const body = {
+      applicant: { insured_name: opts.insured, ...opts.state ? { mailing_address: void 0 } : {} },
+      narrative: opts.narrative,
+      lines_of_business: opts.lob ? String(opts.lob).split(",").map((s) => s.trim()) : []
+    };
+    if (opts.effective) body.effective_date = opts.effective;
+    const res = await apiRequest(ctx.client, "POST", "/broker/submissions", { body });
+    if (ctx.json) return printJson(res);
+    process.stdout.write(kv({ submission_id: res.submission_id, state: res.state, status: res.status_label }) + "\n");
+    process.stdout.write("\nNext: hedge upload " + res.submission_id + " <file.pdf>, hedge requirements " + res.submission_id + ", hedge finalize " + res.submission_id + "\n");
+  });
+  program2.command("upload <submissionId> <pdf>").description("Attach a PDF (ACORD, loss runs, supplement) to a submission").option("--name <label>", "display name for the document").action(async (submissionId, pdf, opts) => {
+    const ctx = makeCtx(program2.opts());
+    const bytes = readFileSync2(pdf);
+    const form = new FormData();
+    form.append("file", new Blob([bytes], { type: "application/pdf" }), basename(pdf));
+    if (opts.name) form.append("display_name", opts.name);
+    const res = await multipartRequest(ctx.client, "POST", `/broker/submissions/${submissionId}/documents`, form);
+    if (ctx.json) return printJson(res);
+    process.stdout.write(kv({ document_id: res.id, name: res.display_name, kind: res.source_label ?? res.source }) + "\n");
+  });
+  program2.command("requirements <submissionId>").description("What this submission still needs (per-market, forms, carrier questions)").action(async (submissionId) => {
+    const ctx = makeCtx(program2.opts());
+    const r = await apiRequest(ctx.client, "GET", `/broker/submissions/${submissionId}/requirements`);
+    if (ctx.json) return printJson(r);
+    process.stdout.write(kv({ insured: r.insured_name, lines: (r.lines || []).join(", "), state: r.state, forms: (r.forms || []).join(", ") }) + "\n");
+    if (r.markets?.length) {
+      process.stdout.write("\nMarkets:\n" + table(r.markets.map((m) => ({
+        market: m.market_name,
+        ready: m.ready ? "yes" : "no",
+        needs_from_you: (m.needs_from_you || []).join("; ")
+      })), ["market", "ready", "needs_from_you"]) + "\n");
+    }
+    if (r.carrier_api_sessions?.length) {
+      process.stdout.write("\nInstant-quote carriers:\n" + table(r.carrier_api_sessions.map((s) => ({
+        carrier: s.carrier_slug,
+        program: s.program,
+        status: s.status,
+        missing: (s.missing_questions || []).length,
+        quote: s.has_quote ? "yes" : ""
+      })), ["carrier", "program", "status", "missing", "quote"]) + "\n");
+    }
+  });
+  program2.command("status <submissionId>").description("Submission detail + live marketing/quote status").action(async (submissionId) => {
+    const ctx = makeCtx(program2.opts());
+    const s = await apiRequest(ctx.client, "GET", `/broker/submissions/${submissionId}`);
+    if (ctx.json) return printJson(s);
+    process.stdout.write(kv({ insured: s.insured_name, lines: (s.lines || []).join(", "), state: s.state, status: s.status_label, premium: s.premium }) + "\n");
+  });
+  program2.command("submissions").description("List your brokerage's submissions").option("--status <state>", "filter by state").option("--search <q>", "filter by insured name").action(async (opts) => {
+    const ctx = makeCtx(program2.opts());
+    const rows = await apiRequest(ctx.client, "GET", "/broker/submissions", {
+      query: { status: opts.status, search: opts.search }
+    });
+    if (ctx.json) return printJson(rows);
+    process.stdout.write(table(rows.map((r) => ({
+      id: r.id,
+      insured: r.insured_name,
+      lines: (r.lines || []).join(","),
+      status: r.status_label,
+      premium: r.premium ?? ""
+    })), ["id", "insured", "lines", "status", "premium"]) + "\n");
+  });
+  program2.command("finalize <submissionId>").description("Start marketing the submission to carriers").action(async (submissionId) => {
+    const ctx = makeCtx(program2.opts());
+    const r = await apiRequest(ctx.client, "POST", `/broker/submissions/${submissionId}/finalize`);
+    if (ctx.json) return printJson(r);
+    process.stdout.write("Marketing started. Track with: hedge status " + submissionId + "\n");
+  });
+  program2.command("policies").description("List bound policies").action(async () => {
+    const ctx = makeCtx(program2.opts());
+    const rows = await apiRequest(ctx.client, "GET", "/broker/policies");
+    if (ctx.json) return printJson(rows);
+    process.stdout.write(table(rows.map((r) => ({ insured: r.insured_name, carrier: r.carrier_name, policy: r.policy_number, premium: r.premium ?? "", status: r.status_label ?? r.status })), ["insured", "carrier", "policy", "premium", "status"]) + "\n");
+  });
+  program2.command("payments").description("List payment / invoice status").action(async () => {
+    const ctx = makeCtx(program2.opts());
+    const rows = await apiRequest(ctx.client, "GET", "/broker/payments");
+    if (ctx.json) return printJson(rows);
+    process.stdout.write(table(rows.map((r) => ({ insured: r.insured_name, status: r.status_label ?? r.status, premium: r.premium ?? "" })), ["insured", "status", "premium"]) + "\n");
+  });
+}
+
+// src/commands/appetite.ts
+function registerAppetite(program2) {
+  program2.command("appetite <class>").description('Which markets have appetite for a class, e.g. hedge appetite "roofing contractor" --state CA').option("--state <ST>", "2-letter state").option("--lob <slug>", "line of business filter").action(async (klass, opts) => {
+    const ctx = makeCtx(program2.opts());
+    const res = await apiRequest(ctx.client, "GET", "/broker/appetite", {
+      query: { q: klass, state: opts.state, lob: opts.lob }
+    });
+    if (ctx.json) return printJson(res);
+    const rows = (res.results || []).map((m) => ({
+      market: m.name,
+      lines: (m.lines || []).map((l) => l.slug ?? l).join(","),
+      programs: (m.matched_program_names || []).join("; "),
+      turnaround: m.turnaround?.median_hours != null ? `${Math.round(m.turnaround.median_hours)}h median` : ""
+    }));
+    process.stdout.write(table(rows, ["market", "lines", "programs", "turnaround"]) + "\n");
+  });
+}
+
+// src/commands/quotes.ts
+function registerQuotes(program2) {
+  program2.command("quotes <submissionId>").description("List instant-quote carrier sessions and their open questions").action(async (submissionId) => {
+    const ctx = makeCtx(program2.opts());
+    const rows = await apiRequest(ctx.client, "GET", `/broker/submissions/${submissionId}/api-quotes/sessions`);
+    if (ctx.json) return printJson(rows);
+    process.stdout.write(table(rows.map((s) => ({
+      session: s.id,
+      carrier: s.carrier_slug,
+      program: s.program_display_name ?? s.program_identifier,
+      status: s.status,
+      outcome: s.outcome ?? "",
+      missing: (s.missing_required_questions_json || []).length
+    })), ["session", "carrier", "program", "status", "outcome", "missing"]) + "\n");
+  });
+  program2.command("answer <submissionId> <sessionId>").description("Answer a carrier session's questions, e.g. --set years_in_business=8 --set employees=12").option("--set <kv...>", "key=value pairs").action(async (submissionId, sessionId, opts) => {
+    const ctx = makeCtx(program2.opts());
+    const answers = {};
+    for (const pair of opts.set || []) {
+      const i = String(pair).indexOf("=");
+      if (i > 0) answers[String(pair).slice(0, i)] = String(pair).slice(i + 1);
+    }
+    const res = await apiRequest(ctx.client, "POST", `/broker/submissions/${submissionId}/api-quotes/sessions/${sessionId}/answers`, {
+      body: { answers, merge: true }
+    });
+    if (ctx.json) return printJson(res);
+    process.stdout.write(`status: ${res.status} | remaining questions: ${(res.missing_required_questions_json || []).length}
+`);
+  });
+  program2.command("request-quote <submissionId> <sessionId>").description("Close a carrier session \u2014 request an indication then a quote").action(async (submissionId, sessionId) => {
+    const ctx = makeCtx(program2.opts());
+    const res = await apiRequest(ctx.client, "POST", `/broker/submissions/${submissionId}/api-quotes/sessions/${sessionId}/close`);
+    if (ctx.json) return printJson(res);
+    process.stdout.write(`outcome: ${res.outcome} | status: ${res.status}${res.quote_pdf_url ? " | quote: " + res.quote_pdf_url : ""}
+`);
+    if ((res.missing_required_questions_json || []).length)
+      process.stdout.write(`still needs ${(res.missing_required_questions_json || []).length} answers \u2014 use \`hedge answer\`
+`);
+  });
+}
+
+// src/index.ts
+var program = new Command();
+program.name("hedge").description("Submit risks to Hedge and track them from your terminal.").version("0.1.0").option("--staging", "use the staging environment").option("--json", "output raw JSON (for scripting)");
+registerAuth(program);
+registerSubmissions(program);
+registerAppetite(program);
+registerQuotes(program);
+program.hook("preAction", () => {
+});
+async function main() {
+  try {
+    await program.parseAsync(process.argv);
+  } catch (err) {
+    if (err instanceof ApiError && err.status === 401) {
+      process.stderr.write(`
+${err.message}
+`);
+      process.exit(1);
+    }
+    process.stderr.write(`
+Error: ${err instanceof Error ? err.message : String(err)}
+`);
+    process.exit(1);
+  }
+}
+main();

package/package.json

@@ -0,0 +1,28 @@
+{
+  "name": "hedge-broker",
+  "version": "0.1.0",
+  "description": "Command-line tool for the Hedge broker portal. Submit risks, check appetite, track quotes and policies.",
+  "type": "module",
+  "bin": { "hedge": "dist/index.js" },
+  "files": ["dist", "README.md", "CHANGELOG.md"],
+  "scripts": {
+    "build": "tsup",
+    "prepublishOnly": "tsup"
+  },
+  "engines": { "node": ">=18" },
+  "license": "MIT",
+  "author": "Hedge Specialty Insurance",
+  "homepage": "https://github.com/taventech/hedge-cli#readme",
+  "repository": { "type": "git", "url": "git+https://github.com/taventech/hedge-cli.git" },
+  "bugs": { "url": "https://github.com/taventech/hedge-cli/issues" },
+  "keywords": ["hedge", "insurance", "broker", "cli", "submissions", "commercial-insurance", "appetite"],
+  "publishConfig": { "access": "public" },
+  "dependencies": {
+    "commander": "^12.1.0"
+  },
+  "devDependencies": {
+    "tsup": "^8",
+    "typescript": "^5",
+    "@types/node": "^22"
+  }
+}