@rentaltide/cli 0.2.0 → 0.3.0

package/README.md

@@ -39,7 +39,7 @@ installed points all of them at your laptop.
 ## Embedded insurance
 
 An underwriter builds no iframe and holds no OAuth token — RentalTide calls
-*them*. Different world, same CLI:
+_them_. Different world, same CLI:
 
 ```bash
 rentaltide init --underwriter acme-cover
@@ -47,13 +47,25 @@ cd acme-cover
 export SIGNING_SECRET=whsec_…          # shown once when you created the offering
 npm run dev                            # six endpoints on :8787
 
-rentaltide coverage link
-rentaltide coverage secret
+rentaltide coverage create             # register it, secret saved automatically
 rentaltide coverage test --url http://localhost:8787
 ```
 
+Or fire one call at a time while you are writing the thing — signed exactly the
+way we sign it:
+
+```bash
+rentaltide coverage quote --subtotal 1200 --currency CAD
+rentaltide coverage requote --quote-id q_… --answers '{"prior_claims_3y":true}'
+rentaltide coverage bind --quote-id q_…
+rentaltide coverage cancel --policy-id POL-…
+```
+
+Each prints the signed request, the status, the timing and the body, and exits
+non-zero on anything but a 200.
+
 `coverage test` signs its requests exactly as the platform does and checks the
-rules that fail *quietly*:
+rules that fail _quietly_:
 
 ```
 ✓ Refuses an unsigned request

package/dist/commands/coverage.js

@@ -8,7 +8,7 @@
  */
 import { request } from '../api.js';
 import { readSigningSecret, requireCoverageConfig, readCoverageConfig, saveSigningSecret, writeCoverageConfig, COVERAGE_CONFIG_FILENAME, } from '../config.js';
-import { probe } from '../coverageProbe.js';
+import { call, probe } from '../coverageProbe.js';
 import { ask, bold, confirm, cyan, dim, fail, green, ok, red, say, step, warn } from '../ui.js';
 const toConfig = (provider, existing) => ({
     providerId: provider.id,
@@ -34,6 +34,8 @@ async function getProvider(providerId) {
 export async function coverage(args) {
     const [sub, ...rest] = args;
     switch (sub) {
+        case 'create':
+            return create();
         case 'link':
             return link();
         case 'pull':
@@ -51,8 +53,11 @@ export async function coverage(args) {
         case 'submit':
             return submit();
         default:
+            if (sub && ENDPOINTS.includes(sub))
+                return callOne(sub, rest);
             say(`${bold('rentaltide coverage')} <command>`);
             say();
+            say('  create    register this offering with RentalTide');
             say('  link      attach this directory to one of your coverage offerings');
             say('  pull      write the offering into rentaltide.coverage.json');
             say('  push      apply rentaltide.coverage.json to the offering');
@@ -61,8 +66,76 @@ export async function coverage(args) {
             say('  secret    store the signing secret for this machine');
             say('  status    what still has to be true before review');
             say('  submit    submit the offering for review');
+            say();
+            say(`  ${bold('One call at a time')} — signed the way we sign it:`);
+            say('    quote | schema | requote | bind | reschedule | cancel');
+            say(dim('    e.g. rentaltide coverage quote --subtotal 1200 --currency CAD'));
+            say(dim('         rentaltide coverage requote --quote-id q_… --answers \'{"prior_claims_3y":true}\''));
+            say(dim('         rentaltide coverage bind --data \'{"quoteId":"q_…"}\''));
     }
 }
+/**
+ * Register the offering.
+ *
+ * The one call that used to need a hand-built curl and a bearer token dug out
+ * of the portal — for a partner whose first act is to read a contract, that is
+ * a strange first step. It also puts the signing secret straight where the rest
+ * of the CLI looks for it: RentalTide shows it exactly once and cannot return
+ * it again, so a partner who pastes it into a terminal and closes the window
+ * has lost it.
+ */
+async function create() {
+    const existing = readCoverageConfig();
+    const name = existing?.name || (await ask('Offering name:'));
+    const baseUrl = existing?.baseUrl && existing.baseUrl !== 'https://example.com'
+        ? existing.baseUrl
+        : await ask('Base URL (https):');
+    const supportEmail = existing?.supportEmail || (await ask('Support email:'));
+    const countries = existing?.countries?.length
+        ? existing.countries
+        : (await ask('Licensed countries (ISO, comma separated):')).split(',').map((c) => c.trim().toUpperCase()).filter(Boolean);
+    const currencies = existing?.currencies?.length
+        ? existing.currencies
+        : (await ask('Currencies (ISO, comma separated):')).split(',').map((c) => c.trim().toUpperCase()).filter(Boolean);
+    if (!name || !baseUrl)
+        fail('A name and a base URL are required.');
+    if (!baseUrl.startsWith('https://')) {
+        fail('The base URL must be https.', 'We sign every call to it and send renter identity at bind.');
+    }
+    const result = await request('/developer/coverage-providers', {
+        method: 'POST',
+        body: {
+            name,
+            baseUrl,
+            supportEmail: supportEmail || undefined,
+            supportedCountries: countries,
+            supportedCurrencies: currencies,
+            quoteTimeoutMs: existing?.quoteTimeoutMs ?? 800,
+        },
+    });
+    writeCoverageConfig({
+        providerId: result.provider.id,
+        name: result.provider.name,
+        baseUrl,
+        supportEmail: supportEmail || undefined,
+        countries,
+        currencies,
+        quoteTimeoutMs: existing?.quoteTimeoutMs ?? 800,
+        dev: existing?.dev ?? { baseUrl: 'http://localhost:8787' },
+    });
+    // Stored before it is printed: if the terminal scrolls away or the window
+    // closes, the secret is still on this machine.
+    saveSigningSecret(result.provider.id, result.signingSecret);
+    ok(`Created ${result.provider.name} (${result.provider.slug}).`);
+    say();
+    say(`  ${bold('Signing secret')}  ${result.signingSecret}`);
+    say(`  ${dim('Shown once. Saved to ~/.rentaltide/credentials.json for `coverage test`.')}`);
+    say(`  ${dim('Put it in your own environment as SIGNING_SECRET too — we cannot show it again.')}`);
+    say();
+    say(`It works on sandbox locations now, with no approval step.`);
+    say(`  ${cyan('rentaltide coverage test')}    ${dim('prove your endpoints')}`);
+    say(`  ${cyan('rentaltide coverage status')}  ${dim('what is still missing before review')}`);
+}
 async function link() {
     const providers = await listProviders();
     if (providers.length === 0) {
@@ -271,3 +344,116 @@ async function submit() {
     await request(`/developer/coverage-providers/${config.providerId}/submit`, { method: 'POST' });
     ok('Submitted for review. It keeps working in sandbox meanwhile.');
 }
+// ============================================================================
+// One call at a time
+//
+// `coverage test` runs the whole contract and judges it. Sometimes you just
+// want to fire one endpoint with a payload you control and read what comes
+// back — while you are writing the thing, that is most of the time.
+// ============================================================================
+/** A realistic default body per endpoint, so a bare command does something. */
+function defaultBody(endpoint, args) {
+    const flag = (name) => {
+        const index = args.indexOf(`--${name}`);
+        return index >= 0 ? args[index + 1] : undefined;
+    };
+    const quoteId = flag('quote-id') || 'q_local_test';
+    const policyId = flag('policy-id') || 'POL-LOCAL-TEST';
+    const startsAt = new Date(Date.now() + 86_400_000).toISOString();
+    const endsAt = new Date(Date.now() + 100_800_000).toISOString();
+    switch (endpoint) {
+        case 'quote':
+            return {
+                productCode: flag('product') || 'hull-basic',
+                assetCategory: 'pontoon',
+                assetValue: 48000,
+                units: 1,
+                startsAt,
+                endsAt,
+                days: Number(flag('days') || 1),
+                bookingSubtotal: Number(flag('subtotal') || 850),
+                securityDeposit: 2000,
+                currency: flag('currency') || 'USD',
+                region: flag('region') || null,
+            };
+        case 'schema':
+            return { version: flag('version') || '2026-09-01' };
+        case 'requote':
+            return {
+                quoteId,
+                basePremium: Number(flag('premium') || 55.25),
+                answers: JSON.parse(flag('answers') || '{"date_of_birth":"1988-03-14","prior_claims_3y":false}'),
+            };
+        case 'bind':
+            return {
+                quoteId,
+                bookingReference: flag('booking') || 'bkg_local_test',
+                premiumCharged: Number(flag('premium') || 55.25),
+                renter: {
+                    firstName: 'Sam',
+                    lastName: 'Okafor',
+                    email: 'sam@example.invalid',
+                    phone: '+14165550142',
+                    dateOfBirth: '1988-03-14',
+                },
+                answers: JSON.parse(flag('answers') || '{"date_of_birth":"1988-03-14"}'),
+            };
+        case 'reschedule':
+            return {
+                policyId,
+                bookingReference: flag('booking') || 'bkg_local_test',
+                previousStartsAt: startsAt,
+                previousEndsAt: endsAt,
+                startsAt: new Date(Date.now() + 8 * 86_400_000).toISOString(),
+                endsAt: new Date(Date.now() + 8 * 86_400_000 + 14_400_000).toISOString(),
+                days: 1,
+            };
+        case 'cancel':
+            return { policyId, reason: flag('reason') || 'booking_cancelled' };
+        default:
+            return {};
+    }
+}
+const ENDPOINTS = ['quote', 'schema', 'requote', 'bind', 'reschedule', 'cancel'];
+async function callOne(endpoint, args) {
+    const config = requireCoverageConfig();
+    if (!config.providerId)
+        fail('Not linked yet.', 'Run `rentaltide coverage link`.');
+    const urlFlag = args.indexOf('--url');
+    const baseUrl = (urlFlag >= 0 ? args[urlFlag + 1] : undefined) || config.dev?.baseUrl || config.baseUrl;
+    const signingSecret = readSigningSecret(config.providerId);
+    if (!signingSecret) {
+        fail('No signing secret for this offering.', 'Run `rentaltide coverage secret`.');
+    }
+    // `--data` REPLACES the default body rather than merging into it: a merge
+    // would quietly leave defaults in a payload somebody wrote deliberately.
+    const dataFlag = args.indexOf('--data');
+    let body;
+    if (dataFlag >= 0) {
+        try {
+            body = JSON.parse(args[dataFlag + 1] || '{}');
+        }
+        catch (err) {
+            return fail('--data is not valid JSON.', err instanceof Error ? err.message : undefined);
+        }
+    }
+    else {
+        try {
+            body = defaultBody(endpoint, args);
+        }
+        catch (err) {
+            return fail('An option was not valid JSON.', err instanceof Error ? err.message : undefined);
+        }
+    }
+    say(`${bold('POST')} ${baseUrl.replace(/\/$/, '')}/${endpoint}`);
+    say(dim(JSON.stringify(body, null, 2)));
+    say();
+    const result = await call({ baseUrl, secret: signingSecret }, `/${endpoint}`, body, endpoint === 'bind' ? 15000 : 10000, endpoint === 'bind' ? String(body.quoteId ?? '') : undefined);
+    if (result.error)
+        fail(result.error);
+    const tone = result.status === 200 ? green : red;
+    say(`${tone(String(result.status))} ${dim(`${result.ms}ms`)}`);
+    say(JSON.stringify(result.body, null, 2));
+    if (result.status !== 200)
+        process.exit(1);
+}

package/dist/commands/init.js

@@ -8,7 +8,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { writeAppConfig, writeCoverageConfig } from '../config.js';
+import { writeAppConfig, writeCoverageConfig, } from '../config.js';
 import { ask, bold, dim, fail, ok, say } from '../ui.js';
 const here = path.dirname(fileURLToPath(import.meta.url));
 function templateDir(name) {

package/dist/config.js

@@ -76,9 +76,7 @@ export function requireCoverageConfig(cwd = process.cwd()) {
     return config;
 }
 export function readSigningSecret(providerId) {
-    return (process.env.RENTALTIDE_SIGNING_SECRET ||
-        readCredentials()?.signingSecrets?.[providerId] ||
-        null);
+    return (process.env.RENTALTIDE_SIGNING_SECRET || readCredentials()?.signingSecrets?.[providerId] || null);
 }
 export function saveSigningSecret(providerId, secret) {
     const credentials = readCredentials();

package/dist/coverageProbe.js

@@ -13,10 +13,10 @@
  * bind that writes a second policy on retry.
  */
 import crypto from 'node:crypto';
-function sign(secret, timestamp, body) {
+export function sign(secret, timestamp, body) {
     return `v1=${crypto.createHmac('sha256', secret).update(`${timestamp}.${body}`).digest('hex')}`;
 }
-async function call(opts, path, payload, timeoutMs, idempotencyKey) {
+export async function call(opts, path, payload, timeoutMs, idempotencyKey) {
     const raw = JSON.stringify(payload);
     const timestamp = new Date().toISOString();
     const started = Date.now();

package/dist/index.js

@@ -16,7 +16,7 @@ import { webhook } from './commands/webhook.js';
 import { open } from './commands/open.js';
 import { coverage } from './commands/coverage.js';
 import { bold, dim, say } from './ui.js';
-const VERSION = '0.2.0';
+const VERSION = '0.3.0';
 function usage() {
     say(`${bold('rentaltide')} ${dim(VERSION)} — build apps for RentalTide`);
     say();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rentaltide/cli",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Build RentalTide apps and coverage offerings: scaffold, run against your sandbox, push config, and test an underwriter the way RentalTide calls it.",
   "license": "MIT",
   "author": "RentalTide Inc.",

package/templates/underwriter/README.md

@@ -1,4 +1,4 @@
-# __APP_NAME__
+# **APP_NAME**
 
 A RentalTide coverage underwriter. Six endpoints, no dependencies.