@tarileo/avileo-catalog-cli 0.3.11 → 0.3.12

package/README.md

@@ -81,3 +81,42 @@ Profile updates use a direct JSON object with `business profile update --from
 profile-update.json`. Without `--apply` the command returns a local diff; with
 `--apply` it creates a `business.profile.update` proposal. After approval, run
 `operation apply <id> --json` and re-read the profile.
+
+## Kuati on the existing retail cell (`tienda`)
+
+Kuati uses the existing Tiendas deployment, API, account and data boundaries.
+There is no separate Kuati cell or catalog. The `tienda` catalog retains the
+10-day Professional trial and existing PEN subscription/payment flow.
+An active owner, active membership/store, canonical company approval and a
+usable subscription are required. Branding does not grant marketplace access
+or approve sensitive operations.
+
+The operator supplies `AVILEO_AGENT_BASE_URL` and injects a temporary read-only
+`AVILEO_AGENT_API_KEY` only into the process. Never put a key in arguments, URLs,
+prompts, source, browser configuration or evidence. Before injecting a secret,
+probe `/api/v1/public/deployment` without authentication and confirm the
+`tienda` identity, Kuati brand and expected fingerprint at the selected origin.
+
+Enable `AVILEO_AGENT_REQUIRE_EXPLICIT_ORIGIN` with its strict value `1` for this
+development flow. Missing/blank origins fail rather than choosing production.
+For `auth login`/`auth configure` in strict mode, an explicitly private
+`AVILEO_AGENT_CONFIG_PATH` is also mandatory; the global credential file is not
+an acceptable development pairing destination. Environment-only reads do not
+write a credential file.
+
+After preparing the workspace SDK as described above, the existing read-only
+CLI command is:
+
+```sh
+: "${AVILEO_AGENT_BASE_URL:?operator-selected API origin required}"
+: "${AVILEO_AGENT_API_KEY:?private process-only Agent Key required}"
+: "${AVILEO_AGENT_REQUIRE_EXPLICIT_ORIGIN:?strict development mode required}"
+bun --no-env-file apps/avileo/agent-cli/src/index.ts --json business show
+```
+
+Check business identity, canonical approval, usable subscription and
+`grantedActions`. A Public Client Key or System Admin credential cannot replace
+an Agent Key. Mutating credentials still need existing exact-payload human
+authorization; use read mode for the initial smoke. Device approval links use
+the app origin selected on the backend, which may have a different port from
+the API. Never switch to a production origin to recover a failed dev connection.

package/dist/index.js

@@ -19852,6 +19852,29 @@ function createAbortSignal(timeoutMs) {
   const timer = setTimeout(() => controller.abort(), timeoutMs);
   return { signal: controller.signal, cancel: () => clearTimeout(timer) };
 }
+function agentBaseUrl(config2) {
+  if (config2.requireExplicitBaseUrl && config2.baseUrl === void 0) {
+    throw new AgentValidationError("Esta conexi\xF3n requiere un origen de API expl\xEDcito.", {
+      code: "INVALID_AGENT_CONFIG",
+      status: 0
+    });
+  }
+  const raw = config2.baseUrl ?? AVILEO_AGENT_API_URL;
+  try {
+    const parsed = new URL(raw.trim());
+    if (!raw.trim() || !["http:", "https:"].includes(parsed.protocol) || parsed.username || parsed.password || parsed.search || parsed.hash)
+      throw new Error();
+    return parsed.toString().replace(/\/+$/, "");
+  } catch {
+    throw new AgentValidationError(
+      "El origen de API debe ser absoluto, sin credenciales, query ni fragmento.",
+      {
+        code: "INVALID_AGENT_CONFIG",
+        status: 0
+      }
+    );
+  }
+}
 var AgentHttpClient = class {
   #apiKey;
   #baseUrl;
@@ -19859,7 +19882,7 @@ var AgentHttpClient = class {
   #timeoutMs;
   constructor(config2) {
     this.#apiKey = configuredApiKey(config2);
-    this.#baseUrl = (config2.baseUrl ?? AVILEO_AGENT_API_URL).replace(/\/$/, "");
+    this.#baseUrl = agentBaseUrl(config2);
     this.#fetchImpl = config2.fetch ?? ((...args) => fetch(...args));
     this.#timeoutMs = config2.timeoutMs;
   }
@@ -19878,6 +19901,8 @@ var AgentHttpClient = class {
       try {
         response = await this.#fetchImpl(url2, {
           method: options.method ?? "GET",
+          // Custom Agent Key headers must not follow redirects to another origin.
+          redirect: "error",
           headers: {
             ...formData || options.body === void 0 ? {} : { "content-type": "application/json" },
             ...options.approvalId ? { "x-avileo-approval-id": options.approvalId } : {},
@@ -21258,8 +21283,8 @@ function apiOrigin(baseUrl) {
   return `${parsed.protocol}//${parsed.host}`;
 }
 function overrideBaseUrl(env) {
-  const raw = env.AVILEO_AGENT_BASE_URL?.trim();
-  return raw ? normalizeApiBaseUrl(raw) : void 0;
+  const raw = env.AVILEO_AGENT_BASE_URL;
+  return raw === void 0 ? void 0 : normalizeApiBaseUrl(raw);
 }
 var AGENT_KEY_PATTERN = /^avileo_sk_[^\s]+$/;
 function normalizeAgentKey(value, message) {
@@ -21300,6 +21325,11 @@ function readLocalCredential(env = process.env) {
 }
 function resolveCredential(env = process.env) {
   const override = overrideBaseUrl(env);
+  if (env.AVILEO_AGENT_REQUIRE_EXPLICIT_ORIGIN === "1" && override === void 0) {
+    throw new CliOriginUnsupportedError(
+      "Esta conexi\xF3n requiere AVILEO_AGENT_BASE_URL expl\xEDcito; no se usar\xE1 el origen de producci\xF3n."
+    );
+  }
   const environmentValue = env.AVILEO_AGENT_API_KEY;
   if (environmentValue !== void 0) {
     return {
@@ -21354,7 +21384,8 @@ function createClientFromEnvironment({
   }
   return clientFactory({
     apiKey: credential.apiKey,
-    baseUrl: credential.baseUrl
+    baseUrl: credential.baseUrl,
+    ...env.AVILEO_AGENT_REQUIRE_EXPLICIT_ORIGIN === "1" ? { requireExplicitBaseUrl: true } : {}
   });
 }
 var CliConfigurationError = class extends Error {
@@ -22299,13 +22330,27 @@ async function openVerificationUri(uri) {
   return false;
 }
 function resolveSelectedBaseUrl(options) {
-  const explicit = options.baseUrl?.trim();
-  if (explicit) return normalizeApiBaseUrl(explicit);
-  const fromEnvironment = options.env.AVILEO_AGENT_BASE_URL?.trim();
-  return fromEnvironment ? normalizeApiBaseUrl(fromEnvironment) : AVILEO_AGENT_API_URL;
+  if (options.baseUrl !== void 0) return normalizeApiBaseUrl(options.baseUrl);
+  const fromEnvironment = options.env.AVILEO_AGENT_BASE_URL;
+  if (fromEnvironment !== void 0) return normalizeApiBaseUrl(fromEnvironment);
+  if (options.env.AVILEO_AGENT_REQUIRE_EXPLICIT_ORIGIN === "1") {
+    throw new CliOriginUnsupportedError(
+      "Esta conexi\xF3n requiere --base-url o AVILEO_AGENT_BASE_URL expl\xEDcito."
+    );
+  }
+  return AVILEO_AGENT_API_URL;
+}
+function assertIsolatedDevelopmentPairing(options) {
+  if (options.env.AVILEO_AGENT_REQUIRE_EXPLICIT_ORIGIN === "1" && !options.env.AVILEO_AGENT_CONFIG_PATH?.trim()) {
+    throw new CliProtocolError(
+      "CLI_CONFIGURATION_ERROR",
+      "La conexi\xF3n de desarrollo requiere AVILEO_AGENT_CONFIG_PATH privado; no se modificar\xE1 la credencial global."
+    );
+  }
 }
 async function login(options) {
   const baseUrl = resolveSelectedBaseUrl(options);
+  assertIsolatedDevelopmentPairing(options);
   const deviceAuth = options.deviceAuthFactory({ baseUrl });
   const start = await deviceAuth.start({ name: "Avileo CLI" });
   const browserOpened = await options.openBrowser(start.verificationUri);
@@ -22362,6 +22407,7 @@ async function login(options) {
 }
 async function configure(options) {
   const baseUrl = resolveSelectedBaseUrl(options);
+  assertIsolatedDevelopmentPairing(options);
   const apiKey = await options.readSecret("Agent Key de Avileo (no se mostrar\xE1): ");
   saveLocalCredential({ apiKey, baseUrl }, options.env);
   emitSuccess({