lh-ops 0.1.0

package/dist/index.js

@@ -0,0 +1,795 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const commander_1 = require("commander");
+const client_1 = require("./lib/client");
+const errors_1 = require("./lib/errors");
+const resolve_client_1 = require("./lib/resolve-client");
+const output_1 = require("./lib/output");
+const login_1 = require("./commands/login");
+const plan_1 = require("./commands/plan");
+const pricebook_1 = require("./commands/pricebook");
+const org_1 = require("./commands/org");
+const org_list_1 = require("./commands/org-list");
+const statement_1 = require("./commands/statement");
+const org_usage_1 = require("./commands/org-usage");
+const cache_coverage_1 = require("./commands/cache-coverage");
+const scanners_1 = require("./commands/scanners");
+const export_1 = require("./commands/export");
+const phase2_status_1 = require("./commands/phase2-status");
+const subscription_1 = require("./commands/subscription");
+const models_1 = require("./commands/models");
+const topup_1 = require("./commands/topup");
+const member_1 = require("./commands/member");
+const audit_1 = require("./commands/audit");
+const token_1 = require("./commands/token");
+// LH backend mounts all routes under the /api global prefix, so the operator-
+// facing API base ends with /api. Override via LH_OPS_API_BASE.
+const DEFAULT_API_BASE = process.env.LH_OPS_API_BASE ?? 'http://localhost:3002/api';
+function commonAuthOptions(cmd) {
+    return cmd
+        // normalizeApiBase coerces a bare origin (e.g. https://launchhill.com) to
+        // include the /api global prefix so operators needn't remember the suffix.
+        // #597 — default is LH_OPS_API_BASE env ONLY (not localhost): when the env
+        // is unset + no --api-base, opts.apiBase is undefined so resolveClient falls
+        // to the apiBase saved in ~/.lh-ops/credentials.json. A localhost default
+        // here would shadow stored creds and silently hit local (the footgun).
+        .option('--api-base <url>', 'override API base URL', resolve_client_1.normalizeApiBase, process.env.LH_OPS_API_BASE)
+        .option('--token <jwt>', 'override saved access token (skip login)')
+        .option('--json', 'emit JSON output instead of human-readable');
+}
+async function run(action) {
+    try {
+        await action();
+    }
+    catch (err) {
+        if (err instanceof client_1.ApiError) {
+            const detail = (0, errors_1.extractApiMessage)(err.body);
+            process.stderr.write(`Error ${err.status}: ${detail ?? err.message}\n`);
+            const hint = (0, errors_1.hintForApiError)(err);
+            if (hint)
+                process.stderr.write(`Hint: ${hint}\n`);
+            // Only dump the raw body when we couldn't surface a clean message from it.
+            if (!detail)
+                process.stderr.write(JSON.stringify(err.body, null, 2) + '\n');
+        }
+        else {
+            const e = err;
+            process.stderr.write(`Error: ${e.message}\n`);
+        }
+        process.exitCode = 1;
+    }
+}
+// T5 of v0.1.7 #279 / #283 — `--since 90d` parser. Accepts `<digits>d`
+// for now; weeks/hours can be added later. Defaults to 90 if unparseable
+// rather than throwing — keeps the CLI forgiving for the common case.
+function parseSinceDays(since) {
+    const m = /^(\d+)d$/.exec(since);
+    if (!m) {
+        throw new Error(`--since must match <digits>d (e.g. 90d), got: ${since}`);
+    }
+    return parseInt(m[1], 10);
+}
+// T5 of v0.1.7 #279 / #283 — emit export body. `--output <path>` writes
+// to file (atomic semantics not required for one-shot export); otherwise
+// stdout. JSON gets a trailing newline so shells render it cleanly;
+// CSV's renderer already appends \n.
+async function emitExport(body, outputPath, isCsv) {
+    if (outputPath) {
+        const { promises: fsp } = await Promise.resolve().then(() => __importStar(require('fs')));
+        await fsp.writeFile(outputPath, body);
+        return;
+    }
+    process.stdout.write(body + (isCsv ? '' : '\n'));
+}
+const program = new commander_1.Command();
+program.name('lh-ops').version('0.1.0').description('LH Platform Operator CLI');
+// ===== login =====
+const loginCmd = program
+    .command('login')
+    .description('Authenticate as a Platform Operator and persist the access token')
+    .requiredOption('--email <email>')
+    .requiredOption('--password <password>')
+    .option('--api-base <url>', 'API base URL', resolve_client_1.normalizeApiBase, DEFAULT_API_BASE)
+    .option('--json', 'emit JSON output')
+    .action(async (opts) => {
+    await run(async () => {
+        const result = await (0, login_1.login)({
+            apiBase: opts.apiBase,
+            email: opts.email,
+            password: opts.password,
+            json: !!opts.json,
+        });
+        (0, login_1.renderLogin)(result, !!opts.json);
+    });
+});
+void loginCmd;
+// ===== plan =====
+const plan = program.command('plan').description('Manage plan SKUs');
+commonAuthOptions(plan.command('publish'))
+    .description('Create a plan from a JSON file')
+    .requiredOption('--file <path>', 'path to JSON dto')
+    .action(async (opts) => {
+    await run(async () => {
+        const result = await (0, plan_1.publishPlan)({
+            filePath: opts.file,
+            apiBase: opts.apiBase,
+            token: opts.token,
+        });
+        (0, output_1.printValue)(result, { json: !!opts.json });
+    });
+});
+commonAuthOptions(plan.command('list'))
+    .description('List plan SKUs (US-1)')
+    .option('--family <family>', 'filter by plan family (OFFICE | CODING | ...)')
+    .option('--status <status>', 'filter by status (ACTIVE | ARCHIVED)')
+    .action(async (opts) => {
+    await run(async () => {
+        const plans = await (0, plan_1.listPlans)({
+            family: opts.family,
+            status: opts.status,
+            apiBase: opts.apiBase,
+            token: opts.token,
+        });
+        process.stdout.write((0, plan_1.renderPlanList)(plans, { json: !!opts.json }));
+    });
+});
+commonAuthOptions(plan.command('show <planId>'))
+    .description('Show a plan incl. quotas + updatedAt (the --if-match lock token)')
+    .action(async (planId, opts) => {
+    await run(async () => {
+        const p = await (0, plan_1.showPlan)({
+            planId,
+            apiBase: opts.apiBase,
+            token: opts.token,
+        });
+        process.stdout.write((0, plan_1.renderPlan)(p, { json: !!opts.json }));
+    });
+});
+commonAuthOptions(plan.command('update <planId>'))
+    .description('Update a plan from a JSON file (optimistic lock via --if-match)')
+    .requiredOption('--file <path>', 'JSON dto: displayName / quotas / status / isBaseTier')
+    .requiredOption('--if-match <updatedAt>', "plan's current updatedAt (copy from `plan show`)")
+    .action(async (planId, opts) => {
+    await run(async () => {
+        const result = await (0, plan_1.updatePlan)({
+            planId,
+            filePath: opts.file,
+            ifMatch: opts.ifMatch,
+            apiBase: opts.apiBase,
+            token: opts.token,
+        });
+        (0, output_1.printValue)(result, { json: !!opts.json });
+    });
+});
+commonAuthOptions(plan.command('archive <planId>'))
+    .description('Archive a plan — ARCHIVED (optimistic lock via --if-match)')
+    .requiredOption('--if-match <updatedAt>', "plan's current updatedAt (copy from `plan show`)")
+    .action(async (planId, opts) => {
+    await run(async () => {
+        const result = await (0, plan_1.archivePlan)({
+            planId,
+            ifMatch: opts.ifMatch,
+            apiBase: opts.apiBase,
+            token: opts.token,
+        });
+        (0, output_1.printValue)(result, { json: !!opts.json });
+    });
+});
+// ===== pricebook =====
+const pb = program.command('pricebook').description('Manage versioned price books');
+commonAuthOptions(pb.command('publish'))
+    .description('Create a DRAFT price book version from a JSON file')
+    .requiredOption('--file <path>')
+    .action(async (opts) => {
+    await run(async () => {
+        const result = await (0, pricebook_1.publishPriceBook)({
+            filePath: opts.file,
+            apiBase: opts.apiBase,
+            token: opts.token,
+        });
+        (0, output_1.printValue)(result, { json: !!opts.json });
+    });
+});
+commonAuthOptions(pb.command('activate <version>'))
+    .description('Activate a price book version (forward-only; pass --allow-removals to drop models)')
+    .option('--allow-removals', 'permit dropping models present in current ACTIVE')
+    .action(async (version, opts) => {
+    await run(async () => {
+        const result = await (0, pricebook_1.activatePriceBook)({
+            version,
+            allowRemovals: !!opts.allowRemovals,
+            apiBase: opts.apiBase,
+            token: opts.token,
+        });
+        (0, output_1.printValue)(result, { json: !!opts.json });
+    });
+});
+commonAuthOptions(pb.command('list'))
+    .description('List price book versions (US-2)')
+    .action(async (opts) => {
+    await run(async () => {
+        const rows = await (0, pricebook_1.listPriceBooks)({
+            apiBase: opts.apiBase,
+            token: opts.token,
+        });
+        process.stdout.write((0, pricebook_1.renderPriceBookList)(rows, { json: !!opts.json }));
+    });
+});
+// ===== cache-coverage (#595) =====
+commonAuthOptions(program.command('cache-coverage'))
+    .description('Platform-wide cache-hit audit by model (#595) — which models return prompt-cache tokens + hit rate')
+    .option('--format <fmt>', 'md (default) | json', 'md')
+    .action(async (opts) => {
+    await run(async () => {
+        const coverage = await (0, cache_coverage_1.getCacheCoverage)({
+            apiBase: opts.apiBase,
+            token: opts.token,
+        });
+        const body = (0, cache_coverage_1.renderCacheCoverage)(coverage, { format: opts.format ?? 'md' });
+        process.stdout.write(body + '\n');
+    });
+});
+// ===== models (canary prep #445) =====
+const models = program
+    .command('models')
+    .description('Inspect the upstream model catalog');
+commonAuthOptions(models.command('list'))
+    .description('List models the upstream new-api offers — the canonical names for plan authoring')
+    .action(async (opts) => {
+    await run(async () => {
+        const rows = await (0, models_1.listModels)({
+            apiBase: opts.apiBase,
+            token: opts.token,
+        });
+        process.stdout.write((0, models_1.renderModels)(rows, { json: !!opts.json }));
+    });
+});
+// ===== token (#304 / #473) — service-account tokens for agents / MCP =====
+const token = program
+    .command('token')
+    .description('Manage service-account tokens (lh_pat_…) for agents / MCP');
+commonAuthOptions(token.command('issue'))
+    .description('Issue a scoped service-account token (plaintext shown ONCE)')
+    .requiredOption('--scopes <list>', 'comma-separated scopes, e.g. read:orgs,read:billing,read:keys,read:audit,write:keys')
+    .option('--label <label>', 'human label shown in `token list`')
+    .option('--expires-days <n>', 'token lifetime in days (omit = non-expiring)')
+    .action(async (opts) => {
+    await run(async () => {
+        const result = await (0, token_1.issueToken)({
+            scopes: opts.scopes
+                .split(',')
+                .map((s) => s.trim())
+                .filter((s) => s.length > 0),
+            label: opts.label,
+            expiresInDays: opts.expiresDays !== undefined
+                ? parseInt(opts.expiresDays, 10)
+                : undefined,
+            apiBase: opts.apiBase,
+            token: opts.token,
+        });
+        process.stdout.write((0, token_1.renderIssuedToken)(result, { json: !!opts.json }));
+    });
+});
+commonAuthOptions(token.command('list'))
+    .description('List issued service-account tokens (never shows the secret)')
+    .action(async (opts) => {
+    await run(async () => {
+        const tokens = await (0, token_1.listTokens)({
+            apiBase: opts.apiBase,
+            token: opts.token,
+        });
+        process.stdout.write((0, token_1.renderTokenList)(tokens, { json: !!opts.json }));
+    });
+});
+commonAuthOptions(token.command('revoke <tokenId>'))
+    .description('Revoke a service-account token by id')
+    .action(async (tokenId, opts) => {
+    await run(async () => {
+        const result = await (0, token_1.revokeToken)({
+            tokenId,
+            apiBase: opts.apiBase,
+            token: opts.token,
+        });
+        (0, output_1.printValue)(result, { json: !!opts.json });
+    });
+});
+// ===== org =====
+const org = program.command('org').description('Manage customer orgs');
+commonAuthOptions(org.command('create'))
+    .description('Create an org and assign its initial Enterprise Admin (US-12)')
+    .requiredOption('--name <orgName>')
+    .requiredOption('--admin-email <email>')
+    .requiredOption('--admin-name <name>')
+    .option('--plan <planId>')
+    .action(async (opts) => {
+    await run(async () => {
+        const result = await (0, org_1.createOrg)({
+            orgName: opts.name,
+            adminEmail: opts.adminEmail,
+            adminName: opts.adminName,
+            planId: opts.plan,
+            apiBase: opts.apiBase,
+            token: opts.token,
+        });
+        if (opts.json) {
+            (0, output_1.printValue)(result, { json: true });
+        }
+        else {
+            (0, output_1.printValue)({
+                orgId: result.organization.id,
+                orgName: result.organization.name,
+                adminEmail: result.adminUser.email,
+                subscriptionId: result.subscription?.id ?? null,
+            }, { json: false });
+            (0, output_1.printSecret)('TEMP PASSWORD for first login', result.tempPassword);
+        }
+    });
+});
+commonAuthOptions(org.command('show <orgId>'))
+    .description('Show org details + active subscription + month-to-date usage')
+    .action(async (orgId, opts) => {
+    await run(async () => {
+        const result = await (0, org_1.showOrg)({
+            orgId,
+            apiBase: opts.apiBase,
+            token: opts.token,
+        });
+        (0, output_1.printValue)(result, { json: !!opts.json });
+    });
+});
+commonAuthOptions(org.command('rename <orgId>'))
+    .description('Rename a customer org (intent 1)')
+    .requiredOption('--name <newName>', 'new org display name')
+    .action(async (orgId, opts) => {
+    await run(async () => {
+        const result = await (0, org_1.renameOrg)({
+            orgId,
+            name: opts.name,
+            apiBase: opts.apiBase,
+            token: opts.token,
+        });
+        (0, output_1.printValue)(result, { json: !!opts.json });
+    });
+});
+commonAuthOptions(org.command('tokens <orgId>'))
+    .description("Show the org's new-api token state for triage (US-7 read; reset/recreate deferred per ADR-020 §4)")
+    .action(async (orgId, opts) => {
+    await run(async () => {
+        const rows = await (0, org_1.listOrgTokens)({
+            orgId,
+            apiBase: opts.apiBase,
+            token: opts.token,
+        });
+        process.stdout.write((0, org_1.renderOrgTokens)(rows, { json: !!opts.json }));
+    });
+});
+commonAuthOptions(org.command('suspend <orgId>'))
+    .description('Suspend an org — relay rejects existing api-keys (#27)')
+    .option('--reason <text>', 'free-form note recorded in audit log')
+    .action(async (orgId, opts) => {
+    await run(async () => {
+        const result = await (0, org_1.suspendOrg)({
+            orgId,
+            reason: opts.reason,
+            apiBase: opts.apiBase,
+            token: opts.token,
+        });
+        (0, output_1.printValue)(result, { json: !!opts.json });
+    });
+});
+// US-OP-9 (T2 of v0.1.7 #279 / #280) — cross-org overview.
+// Filter cycles (C3-C6 on backend, mirrored here): --near-limit / --over-budget
+// / --quiet-since-days / --sort-by. All are pass-through to the service.
+commonAuthOptions(org.command('list'))
+    .description('List customer orgs (US-OP-9) — Day-1-to-7 ops monitoring')
+    .option('--status <status>', 'ACTIVE | SUSPENDED | CLOSED (default ACTIVE)')
+    .option('--near-limit', 'orgs with any sub ≥ 70% of maxKeys active')
+    .option('--over-budget', 'orgs with balance ≤ 0')
+    .option('--quiet-since-days <n>', 'orgs with no usage in the last N days (incl. never-used)')
+    .option('--expiring-within <Xd>', 'orgs with any ACTIVE non-base sub commitmentEnd within X days (e.g. 14d)')
+    .option('--sort-by <key>', 'balance-asc')
+    .action(async (opts) => {
+    await run(async () => {
+        const quietDays = opts.quietSinceDays !== undefined && /^\d+$/.test(opts.quietSinceDays)
+            ? parseInt(opts.quietSinceDays, 10)
+            : undefined;
+        const expiringDays = opts.expiringWithin !== undefined
+            ? parseSinceDays(opts.expiringWithin)
+            : undefined;
+        const rows = await (0, org_list_1.listOrgs)({
+            status: opts.status,
+            nearLimit: opts.nearLimit,
+            overBudget: opts.overBudget,
+            quietSinceDays: quietDays,
+            expiringWithinDays: expiringDays,
+            sortBy: opts.sortBy === 'balance-asc' ? 'balance-asc' : undefined,
+            apiBase: opts.apiBase,
+            token: opts.token,
+        });
+        process.stdout.write((0, org_list_1.renderOrgList)(rows, { json: !!opts.json }));
+    });
+});
+// US-OP-10 (T3 of v0.1.7 #279 / #281) — monthly checkpoint statement.
+// PR B (2026-05-18) added md + csv renderers; server stays JSON-only,
+// presentation is dispatched client-side via `renderStatement`.
+commonAuthOptions(org.command('statement'))
+    .description('Generate a monthly statement for an org (US-OP-10) — sales reconciliation')
+    .requiredOption('--org <orgId>')
+    .requiredOption('--month <YYYY-MM>')
+    .option('--format <fmt>', 'json | md | csv', 'json')
+    .option('--output <path>', 'write rendered output to file instead of stdout')
+    .action(async (opts) => {
+    await run(async () => {
+        const stmt = await (0, statement_1.getStatement)({
+            orgId: opts.org,
+            month: opts.month,
+            apiBase: opts.apiBase,
+            token: opts.token,
+        });
+        const body = (0, statement_1.renderStatement)(stmt, { format: opts.format ?? 'json' });
+        if (opts.output) {
+            const { promises: fsp } = await Promise.resolve().then(() => __importStar(require('fs')));
+            await fsp.writeFile(opts.output, body);
+        }
+        else {
+            process.stdout.write(body + '\n');
+        }
+    });
+});
+// #589 — all-time usage reconciliation (counterpart to `statement` monthly).
+// "How much have they used / what's left" view: balance + deposits/charges +
+// usage by billing-decision + by model.
+commonAuthOptions(org.command('usage'))
+    .description('All-time usage reconciliation for an org (#589) — balance, deposits/charges, by-model')
+    .requiredOption('--org <orgId>')
+    .option('--format <fmt>', 'md (default) | json', 'md')
+    .action(async (opts) => {
+    await run(async () => {
+        const summary = await (0, org_usage_1.getOrgUsage)({
+            orgId: opts.org,
+            apiBase: opts.apiBase,
+            token: opts.token,
+        });
+        const body = (0, org_usage_1.renderOrgUsage)(summary, { format: opts.format ?? 'md' });
+        process.stdout.write(body + '\n');
+    });
+});
+// T5 of v0.1.7 #279 / #283 — compliance export (US-OP-12).
+// Two siblings: audit + keys. Both emit chain-of-custody sha256.
+commonAuthOptions(org.command('export-audit'))
+    .description('Export every org-scoped audit entry over a window (US-OP-12 compliance)')
+    .requiredOption('--org <orgId>')
+    .option('--since <duration>', 'window length, e.g. 90d (default 90d)', '90d')
+    .option('--format <fmt>', 'csv (default) | json', 'csv')
+    .option('--output <path>', 'write to file instead of stdout')
+    .action(async (opts) => {
+    await run(async () => {
+        const days = parseSinceDays(opts.since ?? '90d');
+        const to = new Date();
+        const from = new Date(to.getTime() - days * 24 * 60 * 60 * 1000);
+        const rows = await (0, export_1.exportAudit)({
+            orgId: opts.org,
+            from: from.toISOString(),
+            to: to.toISOString(),
+            apiBase: opts.apiBase,
+            token: opts.token,
+        });
+        const body = opts.format === 'json'
+            ? (0, export_1.renderAuditExportJson)(rows)
+            : (0, export_1.renderAuditExportCsv)(rows);
+        await emitExport(body, opts.output, opts.format !== 'json');
+    });
+});
+commonAuthOptions(org.command('export-keys'))
+    .description('Export every api_key (incl. REVOKED) for an org (US-OP-12 compliance)')
+    .requiredOption('--org <orgId>')
+    .option('--format <fmt>', 'csv (default) | json', 'csv')
+    .option('--output <path>', 'write to file instead of stdout')
+    .action(async (opts) => {
+    await run(async () => {
+        const rows = await (0, export_1.exportKeys)({
+            orgId: opts.org,
+            apiBase: opts.apiBase,
+            token: opts.token,
+        });
+        const body = opts.format === 'json'
+            ? (0, export_1.renderKeysExportJson)(rows)
+            : (0, export_1.renderKeysExportCsv)(rows);
+        await emitExport(body, opts.output, opts.format !== 'json');
+    });
+});
+commonAuthOptions(org.command('activate <orgId>'))
+    .description('Reactivate a suspended org (#27)')
+    .option('--reason <text>', 'free-form note recorded in audit log')
+    .action(async (orgId, opts) => {
+    await run(async () => {
+        const result = await (0, org_1.activateOrg)({
+            orgId,
+            reason: opts.reason,
+            apiBase: opts.apiBase,
+            token: opts.token,
+        });
+        (0, output_1.printValue)(result, { json: !!opts.json });
+    });
+});
+// ===== subscription =====
+const subscription = program
+    .command('subscription')
+    .description('Manage org subscriptions (operator-only sales motion)');
+commonAuthOptions(subscription.command('add <orgId>'))
+    .description('Add an additional subscription to an existing org (issue #83 — change order)')
+    .requiredOption('--plan-id <planId>')
+    .requiredOption('--max-keys <n>', 'API key cap for this subscription')
+    .requiredOption('--contract-start <iso>', 'ISO8601 contract start')
+    .requiredOption('--commitment-end <iso>', 'ISO8601 commitment end (must be in the future)')
+    .option('--price-book-version <version>', 'pin to a specific PriceBook version (default: capture current ACTIVE)')
+    .action(async (orgId, opts) => {
+    await run(async () => {
+        const maxKeys = Number(opts.maxKeys);
+        if (!Number.isFinite(maxKeys) || !Number.isInteger(maxKeys)) {
+            throw new Error(`--max-keys must be an integer, got: ${opts.maxKeys}`);
+        }
+        const result = await (0, subscription_1.addSubscription)({
+            orgId,
+            planId: opts.planId,
+            maxKeys,
+            contractStart: opts.contractStart,
+            commitmentEnd: opts.commitmentEnd,
+            priceBookVersion: opts.priceBookVersion,
+            apiBase: opts.apiBase,
+            token: opts.token,
+        });
+        (0, output_1.printValue)(result, { json: !!opts.json });
+    });
+});
+commonAuthOptions(subscription.command('extend <orgId> <subId>'))
+    .description("Extend a subscription's contract commitmentEnd (US-8 renewal; tier changes go via add + cancel)")
+    .requiredOption('--new-end <iso>', 'new ISO8601 commitmentEnd (must be in the future + later than current)')
+    .option('--memo <text>', 'free-form note recorded in the audit log')
+    .action(async (orgId, subId, opts) => {
+    await run(async () => {
+        const result = await (0, subscription_1.extendContract)({
+            orgId,
+            subId,
+            commitmentEnd: opts.newEnd,
+            memo: opts.memo,
+            apiBase: opts.apiBase,
+            token: opts.token,
+        });
+        (0, output_1.printValue)(result, { json: !!opts.json });
+    });
+});
+// ===== topup =====
+const topup = program.command('topup').description('Manage org balance');
+commonAuthOptions(topup.command('execute'))
+    .description('Credit an org\'s LH balance immediately (smoke A subset of #28)')
+    .requiredOption('--org <orgId>')
+    .requiredOption('--usd <amount>', 'positive USD amount')
+    .option('--memo <text>', 'free-form note (recorded in BalanceLog + audit)')
+    .action(async (opts) => {
+    await run(async () => {
+        const amountUsd = Number(opts.usd);
+        if (!Number.isFinite(amountUsd)) {
+            throw new Error(`--usd must be a number, got: ${opts.usd}`);
+        }
+        const result = await (0, topup_1.executeTopup)({
+            orgId: opts.org,
+            amountUsd,
+            memo: opts.memo,
+            apiBase: opts.apiBase,
+            token: opts.token,
+        });
+        (0, output_1.printValue)(result, { json: !!opts.json });
+    });
+});
+commonAuthOptions(topup.command('list'))
+    .description('List executed top-ups (filterable by org / time window / actor)')
+    .option('--org-id <orgId>')
+    .option('--from <iso>', 'inclusive lower bound on createdAt (ISO8601)')
+    .option('--to <iso>', 'exclusive upper bound on createdAt (ISO8601)')
+    .option('--actor <operatorId>', 'filter to top-ups executed by this operator id')
+    .option('--limit <n>', 'page size (default 50, max 200)')
+    .option('--offset <n>', 'page offset (default 0)')
+    .action(async (opts) => {
+    await run(async () => {
+        const limit = opts.limit !== undefined ? Number(opts.limit) : undefined;
+        const offset = opts.offset !== undefined ? Number(opts.offset) : undefined;
+        if (limit !== undefined && !Number.isFinite(limit)) {
+            throw new Error(`--limit must be a number, got: ${opts.limit}`);
+        }
+        if (offset !== undefined && !Number.isFinite(offset)) {
+            throw new Error(`--offset must be a number, got: ${opts.offset}`);
+        }
+        const result = await (0, topup_1.listTopups)({
+            orgId: opts.orgId,
+            from: opts.from,
+            to: opts.to,
+            actor: opts.actor,
+            limit,
+            offset,
+            apiBase: opts.apiBase,
+            token: opts.token,
+        });
+        (0, output_1.printValue)(result, { json: !!opts.json });
+    });
+});
+// ===== member (ADR-028 budget guardian, #578 CLI parity of #574) =====
+const member = program
+    .command('member')
+    .description('Member budget-guardian ops (unfreeze / daily cap)');
+commonAuthOptions(member.command('unfreeze'))
+    .description('Lift a budget-guardian freeze (FROZEN → ACTIVE) so the member\'s keys work again')
+    .requiredOption('--org <orgId>')
+    .requiredOption('--member <memberId>')
+    .action(async (opts) => {
+    await run(async () => {
+        const result = await (0, member_1.unfreezeMember)({
+            orgId: opts.org,
+            memberId: opts.member,
+            apiBase: opts.apiBase,
+            token: opts.token,
+        });
+        (0, output_1.printValue)(result, { json: !!opts.json });
+    });
+});
+commonAuthOptions(member.command('set-cap'))
+    .description('Set / change / clear a member\'s daily budget cap (in the org settlement currency)')
+    .requiredOption('--org <orgId>')
+    .requiredOption('--member <memberId>')
+    .option('--cap <amount>', 'daily cap amount (≥ 0) in the org settlement currency')
+    .option('--clear', 'clear the cap (member unbounded)')
+    .action(async (opts) => {
+    await run(async () => {
+        if (opts.clear && opts.cap !== undefined) {
+            throw new Error('Pass either --cap <amount> or --clear, not both.');
+        }
+        if (!opts.clear && opts.cap === undefined) {
+            throw new Error('Pass --cap <amount> to set, or --clear to remove.');
+        }
+        let dailyBudgetCap;
+        if (opts.clear) {
+            dailyBudgetCap = null;
+        }
+        else {
+            dailyBudgetCap = Number(opts.cap);
+            if (!Number.isFinite(dailyBudgetCap) || dailyBudgetCap < 0) {
+                throw new Error(`--cap must be a number ≥ 0, got: ${opts.cap}`);
+            }
+        }
+        const result = await (0, member_1.setMemberBudgetCap)({
+            orgId: opts.org,
+            memberId: opts.member,
+            dailyBudgetCap,
+            apiBase: opts.apiBase,
+            token: opts.token,
+        });
+        (0, output_1.printValue)(result, { json: !!opts.json });
+    });
+});
+// ===== audit =====
+const audit = program
+    .command('audit')
+    .description('Query the platform audit log (incident triage without psql)');
+commonAuthOptions(audit.command('query'))
+    .description('Read /platform/audit with filters; default output: one line per row')
+    .option('--org <orgId>', 'filter to a single org')
+    .option('--action <prefix>', 'filter to action (e.g. api_key.created)')
+    .option('--actor <emailOrId>', 'filter to operator/admin who performed the action')
+    .option('--from <iso>', 'ISO8601 lower bound on occurredAt')
+    .option('--to <iso>', 'ISO8601 upper bound on occurredAt')
+    .option('--limit <n>', 'page size (default 50, max 200)', '50')
+    .action(async (opts) => {
+    await run(async () => {
+        const limit = opts.limit !== undefined ? Number(opts.limit) : undefined;
+        if (limit !== undefined && !Number.isFinite(limit)) {
+            throw new Error(`--limit must be a number, got: ${opts.limit}`);
+        }
+        const rows = await (0, audit_1.queryAudit)({
+            orgId: opts.org,
+            action: opts.action,
+            actor: opts.actor,
+            from: opts.from,
+            to: opts.to,
+            limit,
+            apiBase: opts.apiBase,
+            token: opts.token,
+        });
+        process.stdout.write((0, audit_1.renderAudit)(rows, { json: !!opts.json }));
+        if (opts.json)
+            process.stdout.write('\n');
+    });
+});
+// ===== scanners (T4 of v0.1.7 #279 / #282 — US-OP-11) =====
+const scanners = program
+    .command('scanners')
+    .description('Background-scanner liveness');
+commonAuthOptions(scanners.command('status'))
+    .description('Show last-tick / next-tick / counters per scanner')
+    .action(async (opts) => {
+    await run(async () => {
+        const rows = await (0, scanners_1.getScannersStatus)({
+            apiBase: opts.apiBase,
+            token: opts.token,
+        });
+        process.stdout.write((0, scanners_1.renderScannersStatus)(rows, { json: !!opts.json }));
+    });
+});
+// ===== phase2-status (T9 of v0.1.7 #279 / #284) =====
+// Forcing function for the ADR-012 §4 Phase 2 SPA trigger conditions.
+// Manual flags persist to ~/.lh-ops/phase2-state.json so day-2 runs
+// don't reset to all-false when the operator omits flags.
+commonAuthOptions(program.command('phase2-status'))
+    .description('Evaluate ADR-012 §4 Phase 2 SPA trigger state')
+    .option('--ops-team-size <n>', 'condition 1: ops team headcount')
+    .option('--has-nontech <bool>', 'condition 1: includes non-technical member')
+    .option('--compliance-ask <bool>', 'condition 2: at least one paid customer has asked for compliance')
+    .option('--sales-demo-requested <bool>', 'condition 3: sales has requested customer-facing audit-trail demo')
+    .action(async (opts) => {
+    await run(async () => {
+        const persisted = (await (0, phase2_status_1.loadPhase2State)()) ?? {
+            opsTeamSize: 0,
+            hasNontech: false,
+            complianceAsk: false,
+            salesDemoRequested: false,
+        };
+        const merged = {
+            opsTeamSize: opts.opsTeamSize !== undefined
+                ? parseInt(opts.opsTeamSize, 10) || 0
+                : persisted.opsTeamSize,
+            hasNontech: parseBool(opts.hasNontech, persisted.hasNontech),
+            complianceAsk: parseBool(opts.complianceAsk, persisted.complianceAsk),
+            salesDemoRequested: parseBool(opts.salesDemoRequested, persisted.salesDemoRequested),
+        };
+        await (0, phase2_status_1.savePhase2State)(merged);
+        const orgs = await (0, org_list_1.listOrgs)({
+            status: 'ACTIVE',
+            apiBase: opts.apiBase,
+            token: opts.token,
+        });
+        const state = (0, phase2_status_1.evaluatePhase2State)(merged, orgs.length);
+        process.stdout.write((0, phase2_status_1.renderPhase2Status)(state, { json: !!opts.json }));
+    });
+});
+function parseBool(raw, fallback) {
+    if (raw === undefined)
+        return fallback;
+    return raw === 'true' || raw === '1' || raw === 'yes';
+}
+program.parseAsync(process.argv).catch((err) => {
+    process.stderr.write(`Fatal: ${err.message}\n`);
+    process.exitCode = 1;
+});
+//# sourceMappingURL=index.js.map