@tenderprompt/accounts 0.8.2 → 0.8.4

package/dist/main.js

@@ -3,6 +3,7 @@ import { createRequire } from "node:module";
 import { copyFile, lstat, mkdir, mkdtemp, readFile, readdir, realpath, rm } from "node:fs/promises";
 import { basename, dirname, join, relative, resolve, sep } from "node:path";
 import { homedir, hostname, tmpdir } from "node:os";
+import { createHash } from "node:crypto";
 import { AgentApiClient } from "./api.js";
 import { CLI_AUTH_SCHEMA, DEFAULT_AUTH_PROFILE, createDefaultAuthStore, validateAuthProfile, validateNamedAuthProfile, } from "./auth-store.js";
 import { labelLocalArtifact, verifyArtifact } from "./artifact.js";
@@ -146,6 +147,14 @@ async function execute(topic, options, cwd, runtime) {
             return { value: await sourceOperationStatus(cwd, options, runtime) };
         case "source operation retry":
             return { value: await sourceOperationRetry(cwd, options, runtime) };
+        case "source change create":
+            return { value: await sourceChangeCreate(cwd, options, runtime) };
+        case "source change list":
+            return { value: await sourceChangeList(cwd, options, runtime) };
+        case "source change show":
+            return { value: await sourceChangeShow(cwd, options, runtime) };
+        case "source change close":
+            return { value: await sourceChangeClose(cwd, options, runtime) };
         case "source connect":
             return { value: await sourceConnect(cwd, options, runtime) };
         case "source pull":
@@ -506,7 +515,7 @@ async function sourcePull(cwd, options, runtime) {
     }
     let credential = null;
     try {
-        const token = await access.client.sourceToken(repository.id, 15 * 60);
+        const token = await access.client.sourceToken(repository.id, 15 * 60, "read");
         if (token.remoteUrl !== repository.remoteUrl) {
             throw new CliError("source_token_target_mismatch", "Tender refused a repository credential whose target did not match the connected source.");
         }
@@ -755,8 +764,8 @@ async function sourceToken(cwd, options, runtime) {
     return {
         status: "issued",
         repositoryId: source.repository.id,
-        ...(await client.sourceToken(source.repository.id, numberFlag(options, "ttl-seconds", 15 * 60, 7 * 24 * 60 * 60, 60 * 60))),
-        warning: "This repository-scoped credential is shown once. Keep it out of source and shell history.",
+        ...(await client.sourceToken(source.repository.id, numberFlag(options, "ttl-seconds", 15 * 60, 7 * 24 * 60 * 60, 60 * 60), "read")),
+        warning: "This read-only repository credential is shown once. Keep it out of source and shell history.",
     };
 }
 async function sourcePush(cwd, options, runtime) {
@@ -775,6 +784,18 @@ async function sourcePush(cwd, options, runtime) {
     const branch = options.flags.get("branch") ?? (currentBranch || source.repository.defaultBranch);
     assertGitBranchName(branch);
     const state = await sourceState(gitRoot, runtime);
+    if (source.repository.changeRequestProtection === "enabling") {
+        throw new CliError("source_review_activation_pending", "Reviewed changes are still activating. Retry after Tender confirms previous write access was revoked.");
+    }
+    if (source.repository.changeRequestProtection === "enabled") {
+        if (!currentBranch) {
+            throw new CliError("source_push_detached_head", "Tender will not submit a detached HEAD. Create or switch to a feature branch first.");
+        }
+        if (branch === source.repository.defaultBranch) {
+            throw new CliError("source_default_branch_protected", `${source.repository.defaultBranch} is protected. Push a feature branch, then create a reviewed change request.`, "tender-accounts source push --branch my-change --json");
+        }
+        return await submitProtectedSourcePush(gitRoot, projectId, source.repository, branch, state, options, client, runtime);
+    }
     let credential = null;
     try {
         const token = await client.sourceToken(source.repository.id, 15 * 60);
@@ -795,6 +816,152 @@ async function sourcePush(cwd, options, runtime) {
         next: "tender-accounts source status --json",
     };
 }
+async function submitProtectedSourcePush(gitRoot, projectId, repository, branch, state, options, client, runtime) {
+    let credential = null;
+    let expectedCurrentSha = null;
+    try {
+        const token = await client.sourceToken(repository.id, 15 * 60, "read");
+        credential = token.token;
+        const remote = await runtime.captureCommand("git", ["ls-remote", "--heads", repository.remoteUrl, `refs/heads/${branch}`], gitRoot, managedGitEnvironment(runtime.environment, credential, managedGitCredentialHeaderKey(repository.remoteUrl)));
+        const refs = parseManagedSourceRefs(remote.stdout);
+        expectedCurrentSha = refs[0]?.sha ?? null;
+    }
+    finally {
+        credential = null;
+    }
+    const temporary = await mkdtemp(join(tmpdir(), "tender-source-push-"));
+    const bundlePath = join(temporary, "source.bundle");
+    try {
+        await runtime.captureCommand("git", ["bundle", "create", bundlePath, "HEAD"], gitRoot, managedGitCheckoutEnvironment(runtime.environment));
+        const bytes = new Uint8Array(await readFile(bundlePath));
+        if (bytes.byteLength > 50 * 1024 * 1024) {
+            throw new CliError("source_bundle_too_large", "The committed source bundle exceeds Tender's 50 MiB limit.");
+        }
+        const bundleSha256 = createHash("sha256").update(bytes).digest("hex");
+        const retryWindow = Math.floor(Date.now() / (24 * 60 * 60 * 1000));
+        const pushIntentDigest = createHash("sha256")
+            .update(`${repository.id}\0${branch}\0${state.revision}\0${retryWindow}`)
+            .digest("hex");
+        const requested = await client.createSourcePush(repository.id, {
+            idempotencyKey: `source-push-${pushIntentDigest}`,
+            branch,
+            expectedCurrentSha,
+            sourceRevision: state.revision,
+            bundleSha256,
+            bundleBytes: bytes.byteLength,
+        });
+        let push = requested.push;
+        if (push.status === "uploading")
+            push = (await client.uploadSourceBundle(push.id, bytes)).push;
+        if (!options.booleans.has("no-wait")) {
+            const deadline = Date.now() + numberFlag(options, "timeout-seconds", 30, 900, 300) * 1000;
+            while (push.status === "requested" || push.status === "running" || push.status === "uploading") {
+                if (Date.now() >= deadline) {
+                    throw new CliError("source_push_timeout", `Source push ${push.id} is still ${push.status}.`, `tender-accounts source push --branch ${branch} --no-wait --json`);
+                }
+                await runtime.sleep(1500);
+                push = (await client.sourcePush(push.id)).push;
+            }
+        }
+        if (push.status === "failed") {
+            throw new CliError(push.error?.code ?? "source_push_failed", push.error?.message ?? "Tender could not push the exact feature branch.");
+        }
+        if (push.status === "expired") {
+            throw new CliError(push.error?.code ?? "source_push_expired", push.error?.message ?? "The exact source push expired before it completed.");
+        }
+        return {
+            status: push.status === "succeeded" ? "pushed" : push.status,
+            projectId,
+            repositoryId: repository.id,
+            pushId: push.id,
+            branch,
+            sourceRevision: state.revision,
+            dirtyWorkingTreeExcluded: state.dirty,
+            credentialPersisted: false,
+            defaultBranchProtected: true,
+            next: `tender-accounts source change create --head ${branch} --title \"Describe this change\" --json`,
+        };
+    }
+    finally {
+        await rm(temporary, { recursive: true, force: true });
+    }
+}
+async function sourceChangeCreate(cwd, options, runtime) {
+    const access = await sourceReadAccess(cwd, options, runtime);
+    if (access.repository.changeRequestProtection !== "enabled") {
+        throw new CliError("source_review_not_enabled", "A merchant administrator must enable reviewed changes for this managed repository first.");
+    }
+    const baseBranch = options.flags.get("base") ?? access.repository.defaultBranch;
+    const headBranch = requiredFlag(options, "head");
+    const title = requiredFlag(options, "title");
+    assertGitBranchName(baseBranch);
+    assertGitBranchName(headBranch);
+    if (baseBranch === headBranch)
+        throw new CliError("source_change_invalid", "The head branch must differ from the protected base branch.");
+    return withManagedSourceMirror(cwd, access.repository, access.client, runtime, async (mirror) => {
+        const refs = await managedSourceMirrorRefs(mirror, runtime);
+        const baseSha = refs.get(`refs/heads/${baseBranch}`);
+        const headSha = refs.get(`refs/heads/${headBranch}`);
+        if (!baseSha || !headSha)
+            throw new CliError("source_branch_missing", "Both the protected base and proposed head branches must exist.");
+        const created = await access.client.createSourceChangeRequest(access.repository.id, {
+            title,
+            description: options.flags.get("description") ?? "",
+            baseBranch,
+            headBranch,
+            baseSha,
+            headSha,
+        });
+        return {
+            status: created.changeRequest.status,
+            created: created.created,
+            projectId: access.projectId,
+            repositoryId: access.repository.id,
+            changeRequest: created.changeRequest,
+            next: created.changeRequest.status === "ready_for_review"
+                ? "A merchant administrator can open the exact preview and approve this change in Tender."
+                : "Wait for Tender to validate and seal the exact preview, then inspect this change again.",
+        };
+    });
+}
+async function sourceChangeList(cwd, options, runtime) {
+    const access = await sourceReadAccess(cwd, options, runtime);
+    const state = (options.flags.get("state") ?? "open");
+    if (!new Set(["open", "closed", "all"]).has(state))
+        throw new CliError("argument_invalid", "--state must be open, closed, or all.");
+    const result = await access.client.sourceChangeRequests(access.repository.id, state);
+    return { status: "ready", projectId: access.projectId, repositoryId: access.repository.id, changeRequests: result.changeRequests };
+}
+async function sourceChangeShow(cwd, options, runtime) {
+    const context = await loadProjectContext(cwd);
+    if (!context.link)
+        throw new CliError("project_not_linked", "This app is not linked to a Tender Accounts project.");
+    const { client } = await authenticatedClient(cwd, context.link, options, runtime);
+    const result = await client.sourceChangeRequest(requiredSourceChangeRequestId(requiredFlag(options, "change")));
+    requireLinkedSourceChange(context.link.projectId, result.changeRequest.projectId);
+    return result;
+}
+async function sourceChangeClose(cwd, options, runtime) {
+    const context = await loadProjectContext(cwd);
+    if (!context.link)
+        throw new CliError("project_not_linked", "This app is not linked to a Tender Accounts project.");
+    const { client } = await authenticatedClient(cwd, context.link, options, runtime);
+    const changeRequestId = requiredSourceChangeRequestId(requiredFlag(options, "change"));
+    const current = await client.sourceChangeRequest(changeRequestId);
+    requireLinkedSourceChange(context.link.projectId, current.changeRequest.projectId);
+    return client.closeSourceChangeRequest(changeRequestId);
+}
+function requireLinkedSourceChange(expectedProjectId, actualProjectId) {
+    if (actualProjectId !== expectedProjectId) {
+        throw new CliError("project_link_mismatch", "That source change belongs to another Tender project. Run the command from its linked checkout.");
+    }
+}
+function requiredSourceChangeRequestId(value) {
+    if (!/^scr_[A-Za-z0-9_-]{8,64}$/u.test(value)) {
+        throw new CliError("source_change_id_invalid", "--change must be the scr_ ID returned by source change create.");
+    }
+    return value;
+}
 async function requireGitRoot(root, runtime) {
     try {
         return resolve((await runtime.captureCommand("git", ["rev-parse", "--show-toplevel"], root)).stdout);
@@ -1659,7 +1826,7 @@ function commandTopic(argv) {
         const child = argv[1];
         if (!child || child.startsWith("--"))
             return { topic: "help", values: [parent] };
-        if (parent === "source" && (child === "default" || child === "history" || child === "operation")) {
+        if (parent === "source" && (child === "default" || child === "history" || child === "operation" || child === "change")) {
             const grandchild = argv[2];
             if (!grandchild || grandchild.startsWith("--"))
                 return { topic: "help", values: [`${parent} ${child}`] };
@@ -1764,6 +1931,10 @@ function assertAllowedOptions(topic, options) {
         ],
         "source operation status": [...common, ...authentication, "operation"],
         "source operation retry": [...common, ...authentication, "operation", "no-wait", "timeout-seconds"],
+        "source change create": [...common, ...authentication, "project", "title", "description", "base", "head"],
+        "source change list": [...common, ...authentication, "project", "state"],
+        "source change show": [...common, ...authentication, "change"],
+        "source change close": [...common, ...authentication, "change"],
         "source connect": [
             ...common,
             ...authentication,
@@ -1777,7 +1948,7 @@ function assertAllowedOptions(topic, options) {
         ],
         "source pull": [...common, ...authentication, "project", "remote", "dry-run"],
         "source token": [...common, ...authentication, "ttl-seconds"],
-        "source push": [...common, ...authentication, "branch", "remote"],
+        "source push": [...common, ...authentication, "branch", "remote", "no-wait", "timeout-seconds"],
         tail: [
             ...common,
             ...authentication,
@@ -1908,7 +2079,7 @@ function helpText(topic) {
         check: "Usage: tender-accounts check [--json]\n\nRun the app's declared validation command.",
         build: "Usage: tender-accounts build [--json]\n\nRun validation and packaging, then verify the complete portable artifact.",
         preview: "Usage: tender-accounts preview [--dry-run] [--no-wait] [--timeout-seconds N] [--return-path /account] [--json]\n\nBuild and submit an exact preview. --dry-run validates locally without authentication or upload.",
-        source: "Usage: tender-accounts source <status|branches|log|compare|connect|pull|push|default|promote|history|operation> [options]\n\nUse standard Git through Tender for a gateway or service project. Source changes never publish production directly.",
+        source: "Usage: tender-accounts source <status|branches|log|compare|connect|pull|push|change|default|promote|history|operation> [options]\n\nUse standard Git through Tender for a gateway or service project. Source changes never publish production directly.",
         "source status": "Usage: tender-accounts source status [--project PROJECT_ID] [--json]\n\nRead the managed repository, immutable build contract, and recent source builds. --project works before a checkout is linked.\n\nExamples:\n  tender-accounts source status --project prj_... --json\n  tender-accounts source status --json",
         "source branches": "Usage: tender-accounts source branches [--project PROJECT_ID] [--json]\n\nList exact branch refs and identify Tender's authoritative default separately from the provider's create-time default. Uses a short-lived read credential without persisting it.",
         "source log": "Usage: tender-accounts source log [--project PROJECT_ID] [--branch BRANCH] [--limit 20] [--json]\n\nRead bounded commit history from one exact managed branch without requiring a checkout.",
@@ -1921,10 +2092,15 @@ function helpText(topic) {
         "source operation": "Usage: tender-accounts source operation <status|retry> --operation sop_... [--json]",
         "source operation status": "Usage: tender-accounts source operation status --operation sop_... [--json]\n\nRead durable status and safe evidence for one exact source operation.",
         "source operation retry": "Usage: tender-accounts source operation retry --operation sop_... [--no-wait] [--timeout-seconds N] [--json]\n\nRetry or resume the same durable source operation without changing its reviewed intent. This never publishes production.",
+        "source change": "Usage: tender-accounts source change <create|list|show|close> [options]\n\nCreate and inspect exact preview-backed changes. Approval and landing stay merchant-admin actions in Tender.",
+        "source change create": "Usage: tender-accounts source change create --head BRANCH --title TITLE [--description TEXT] [--base BRANCH] [--json]\n\nOpen a review for the exact protected-base and feature-branch SHAs. Tender binds checks and approval to this immutable snapshot.",
+        "source change list": "Usage: tender-accounts source change list [--state open|closed|all] [--json]\n\nList reviewed source changes for this exact linked project.",
+        "source change show": "Usage: tender-accounts source change show --change scr_... [--json]\n\nRead exact snapshot, preview, decision, and landing state.",
+        "source change close": "Usage: tender-accounts source change close --change scr_... [--json]\n\nClose an unlanded change without changing source or production.",
         "source connect": "Usage: tender-accounts source connect [--repo-name NAME] [--default-branch NAME] [--publication preview-only|default-branch] [--remote NAME] [--install-command COMMAND] [--working-directory PATH] [--artifact-path PATH] [--json]\n\nCreate or reconnect this linked project to Tender-managed Git. Build and artifact commands come from tender-accounts.json. Protected gateways accept preview-only publication.",
         "source pull": "Usage: tender-accounts source pull [--project PROJECT_ID] [--remote NAME] [--dry-run] [--json]\n\nClone the exact connected Tender-managed repository into an empty workspace, or fast-forward an existing clean matching checkout. The app is linked automatically and the short-lived Git credential is never persisted.\n\nExamples:\n  tender-accounts source pull --project prj_... --dry-run --json\n  tender-accounts source pull --project prj_... --json\n  tender-accounts source pull --json",
-        "source token": "Usage: tender-accounts source token [--ttl-seconds N] [--json]\n\nIssue a short-lived, repository-scoped Git credential. It is shown once and is never stored by the CLI.",
-        "source push": "Usage: tender-accounts source push [--branch NAME] [--remote NAME] [--json]\n\nPush the exact committed revision with an ephemeral credential supplied only to the Git child process. Dirty working-tree changes are excluded.",
+        "source token": "Usage: tender-accounts source token [--ttl-seconds N] [--json]\n\nIssue a short-lived read-only repository credential. It is shown once and is never stored by the CLI.",
+        "source push": "Usage: tender-accounts source push [--branch NAME] [--remote NAME] [--no-wait] [--json]\n\nPush the exact committed revision. Reviewed repositories upload a bounded Git bundle and never expose a write credential; the default branch remains protected. Dirty working-tree changes are excluded.",
         tail: "Usage: tender-accounts tail (--delivery dly_... | --production) [--status ok,error,canceled] [--method GET,POST] [--search TEXT] [--sampling-rate 0.25] [--json]\n\nStream sanitized logs for this exact linked project. Preview tails require a succeeded dly_ delivery. Production tails require merchant-administrator authorization. Sessions expire after 15 minutes and do not persist events.",
         delivery: "Usage: tender-accounts delivery <status|preview|retry> --delivery dly_... [--json]\n\nThese commands accept the developer-delivery ID returned by preview. A dwf_ ID is a production workflow managed by merchant administrators in Activity.",
         "delivery status": "Usage: tender-accounts delivery status --delivery dly_... [--json]\n\nRead one developer preview delivery. Do not pass a dwf_ production workflow ID.",