@tarileo/avileo-catalog-cli 0.3.11 → 0.3.13
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +39 -0
- package/dist/index.js +149 -103
- package/dist/index.js.map +1 -1
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -81,3 +81,42 @@ Profile updates use a direct JSON object with `business profile update --from
|
|
|
81
81
|
profile-update.json`. Without `--apply` the command returns a local diff; with
|
|
82
82
|
`--apply` it creates a `business.profile.update` proposal. After approval, run
|
|
83
83
|
`operation apply <id> --json` and re-read the profile.
|
|
84
|
+
|
|
85
|
+
## Kuati on the existing retail cell (`tienda`)
|
|
86
|
+
|
|
87
|
+
Kuati uses the existing Tiendas deployment, API, account and data boundaries.
|
|
88
|
+
There is no separate Kuati cell or catalog. The `tienda` catalog retains the
|
|
89
|
+
10-day Professional trial and existing PEN subscription/payment flow.
|
|
90
|
+
An active owner, active membership/store, canonical company approval and a
|
|
91
|
+
usable subscription are required. Branding does not grant marketplace access
|
|
92
|
+
or approve sensitive operations.
|
|
93
|
+
|
|
94
|
+
The operator supplies `AVILEO_AGENT_BASE_URL` and injects a temporary read-only
|
|
95
|
+
`AVILEO_AGENT_API_KEY` only into the process. Never put a key in arguments, URLs,
|
|
96
|
+
prompts, source, browser configuration or evidence. Before injecting a secret,
|
|
97
|
+
probe `/api/v1/public/deployment` without authentication and confirm the
|
|
98
|
+
`tienda` identity, Kuati brand and expected fingerprint at the selected origin.
|
|
99
|
+
|
|
100
|
+
Enable `AVILEO_AGENT_REQUIRE_EXPLICIT_ORIGIN` with its strict value `1` for this
|
|
101
|
+
development flow. Missing/blank origins fail rather than choosing production.
|
|
102
|
+
For `auth login`/`auth configure` in strict mode, an explicitly private
|
|
103
|
+
`AVILEO_AGENT_CONFIG_PATH` is also mandatory; the global credential file is not
|
|
104
|
+
an acceptable development pairing destination. Environment-only reads do not
|
|
105
|
+
write a credential file.
|
|
106
|
+
|
|
107
|
+
After preparing the workspace SDK as described above, the existing read-only
|
|
108
|
+
CLI command is:
|
|
109
|
+
|
|
110
|
+
```sh
|
|
111
|
+
: "${AVILEO_AGENT_BASE_URL:?operator-selected API origin required}"
|
|
112
|
+
: "${AVILEO_AGENT_API_KEY:?private process-only Agent Key required}"
|
|
113
|
+
: "${AVILEO_AGENT_REQUIRE_EXPLICIT_ORIGIN:?strict development mode required}"
|
|
114
|
+
bun --no-env-file apps/avileo/agent-cli/src/index.ts --json business show
|
|
115
|
+
```
|
|
116
|
+
|
|
117
|
+
Check business identity, canonical approval, usable subscription and
|
|
118
|
+
`grantedActions`. A Public Client Key or System Admin credential cannot replace
|
|
119
|
+
an Agent Key. Mutating credentials still need existing exact-payload human
|
|
120
|
+
authorization; use read mode for the initial smoke. Device approval links use
|
|
121
|
+
the app origin selected on the backend, which may have a different port from
|
|
122
|
+
the API. Never switch to a production origin to recover a failed dev connection.
|