@tenderprompt/cli 0.1.10 → 0.1.12

package/dist/index.js

@@ -39,6 +39,14 @@ class TenderCliUsageError extends Error {
         this.name = "TenderCliUsageError";
     }
 }
+class TenderCliAnalyticsApiError extends Error {
+    reasonCode;
+    constructor(message, reasonCode) {
+        super(message);
+        this.reasonCode = reasonCode;
+        this.name = "TenderCliAnalyticsApiError";
+    }
+}
 const DEFAULT_PROFILE_NAME = "default";
 const DEFAULT_BASE_URL = "https://app.tenderprompt.com";
 const ARTIFACT_SOURCE_EXPORT_MAX_FILES = 1000;
@@ -199,6 +207,16 @@ Commands:
                              List or create saved dashboards
   tender app analytics charts create <app-id>
                              Create a saved chart from a chart spec
+  tender app analytics charts list <app-id>
+                             List saved charts in one dashboard
+  tender app analytics charts update <app-id>
+                             Update a saved chart title or spec
+  tender app analytics charts delete <app-id>
+                             Delete a saved chart
+  tender app analytics properties list <app-id>
+                             List properties available to dashboard queries
+  tender app analytics properties activate <app-id>
+                             Make a custom event property queryable
   tender app context fetch <app-id>
                              Fetch AGENTS.md, skills, and Tender App scaffold files
   tender app context status <app-id>
@@ -234,6 +252,11 @@ Examples:
   tender app analytics dashboards artifact_123 --json
   tender app analytics dashboards artifact_123 --create "Agent dashboard" --json
   tender app analytics charts create artifact_123 --dashboard analytics_dashboard_123 --title "Signup funnel" --spec funnel.json --json
+  tender app analytics charts list artifact_123 --dashboard analytics_dashboard_123 --json
+  tender app analytics charts update artifact_123 --chart analytics_chart_123 --title "Signup funnel" --spec funnel.json --dry-run --json
+  tender app analytics charts delete artifact_123 --chart analytics_chart_123 --dry-run --json
+  tender app analytics properties list artifact_123 --json
+  tender app analytics properties activate artifact_123 --event signup_started --property plan --type dimension --dry-run --json
   tender app context fetch artifact_123 --dir ./widget --dry-run --json
   tender app context status artifact_123 --dir ./widget --json
   tender app context refresh artifact_123 --dir ./widget --dry-run --json
@@ -268,6 +291,11 @@ Commands:
   tender app analytics export <kind> <app-id> Export catalog metadata or query rows
   tender app analytics charts templates       Print reusable chart spec templates
   tender app analytics charts create <app-id> Create a saved chart
+  tender app analytics charts list <app-id>   List saved charts in one dashboard
+  tender app analytics charts update <app-id> Update a saved chart
+  tender app analytics charts delete <app-id> Delete a saved chart
+  tender app analytics properties list <app-id>      List queryable custom event properties
+  tender app analytics properties activate <app-id>  Make a property queryable
 
 Examples:
   tender app analytics summary artifact_123 --range 30d --json
@@ -279,7 +307,12 @@ Examples:
   tender app analytics suggestions artifact_123 --range 2026-04-01..2026-04-30 --json
   tender app analytics dashboards artifact_123 --create "Agent dashboard" --json
   tender app analytics charts templates --json
-  tender app analytics charts create artifact_123 --dashboard analytics_dashboard_123 --title "Signup funnel" --spec funnel.json --json`;
+  tender app analytics charts create artifact_123 --dashboard analytics_dashboard_123 --title "Signup funnel" --spec funnel.json --json
+  tender app analytics charts list artifact_123 --dashboard analytics_dashboard_123 --json
+  tender app analytics charts update artifact_123 --chart analytics_chart_123 --title "Signup funnel" --spec funnel.json --dry-run --json
+  tender app analytics charts delete artifact_123 --chart analytics_chart_123 --dry-run --json
+  tender app analytics properties list artifact_123 --json
+  tender app analytics properties activate artifact_123 --event signup_started --property plan --type dimension --dry-run --json`;
 }
 function analyticsSummaryHelp() {
     return `Usage: tender app analytics summary <app-id> [--range <7d|30d|90d|YYYY-MM-DD..YYYY-MM-DD>] [--base-url <url>] [--token <token>] [--profile <name>] [--json]
@@ -355,16 +388,59 @@ Examples:
 function analyticsChartsCreateHelp() {
     return `Usage: tender app analytics charts create <app-id> --dashboard <dashboard-id> --title <title> --spec <file|-> [--dry-run] [--base-url <url>] [--token <token>] [--profile <name>] [--json]
 
+Property charts automatically make required custom event properties queryable before
+saving when the spec has an event_name = filter.
+
 Examples:
   tender app analytics charts create artifact_123 --dashboard analytics_dashboard_123 --title "Signup funnel" --spec funnel.json --dry-run --json
   tender app analytics charts create artifact_123 --dashboard analytics_dashboard_123 --title "Signup funnel" --spec funnel.json --json`;
 }
+function analyticsChartsListHelp() {
+    return `Usage: tender app analytics charts list <app-id> --dashboard <dashboard-id> [--base-url <url>] [--token <token>] [--profile <name>] [--json]
+
+Examples:
+  tender app analytics charts list artifact_123 --dashboard analytics_dashboard_123 --json`;
+}
+function analyticsChartsUpdateHelp() {
+    return `Usage: tender app analytics charts update <app-id> --chart <chart-id> [--title <title>] [--spec <file|->] [--dry-run] [--base-url <url>] [--token <token>] [--profile <name>] [--json]
+
+At least one of --title or --spec is required. When one is omitted, the CLI reads
+the existing saved chart and keeps that value.
+Property charts automatically make required custom event properties queryable before
+saving when the spec has an event_name = filter.
+
+Examples:
+  tender app analytics charts update artifact_123 --chart analytics_chart_123 --title "Signup funnel" --dry-run --json
+  tender app analytics charts update artifact_123 --chart analytics_chart_123 --spec funnel.json --dry-run --json
+  tender app analytics charts update artifact_123 --chart analytics_chart_123 --title "Signup funnel" --spec - --json < funnel.json`;
+}
+function analyticsChartsDeleteHelp() {
+    return `Usage: tender app analytics charts delete <app-id> --chart <chart-id> [--dry-run] [--base-url <url>] [--token <token>] [--profile <name>] [--json]
+
+Examples:
+  tender app analytics charts delete artifact_123 --chart analytics_chart_123 --dry-run --json
+  tender app analytics charts delete artifact_123 --chart analytics_chart_123 --json`;
+}
+function analyticsPropertiesListHelp() {
+    return `Usage: tender app analytics properties list <app-id> [--event <event-name>] [--base-url <url>] [--token <token>] [--profile <name>] [--json]
+
+Examples:
+  tender app analytics properties list artifact_123 --json
+  tender app analytics properties list artifact_123 --event signup_started --json`;
+}
+function analyticsPropertiesActivateHelp() {
+    return `Usage: tender app analytics properties activate <app-id> --event <event-name> --property <property-key> --type <dimension|metric> [--label <label>] [--dry-run] [--base-url <url>] [--token <token>] [--profile <name>] [--json]
+
+Examples:
+  tender app analytics properties activate artifact_123 --event signup_started --property plan --type dimension --dry-run --json
+  tender app analytics properties activate artifact_123 --event score_saved --property score --type metric --json`;
+}
 function artifactsListHelp() {
     return `Usage: tender app list [--base-url <url>] [--token <token>] [--profile <name>] [--json]
 
 Options:
   --base-url <url>   Tender base URL. Defaults to TENDER_BASE_URL, saved profile base URL, or https://app.tenderprompt.com.
-  --token <token>    Tender API token. Defaults to TENDER_API_TOKEN or the saved profile token.
+  --token <token>    Tender API token. Precedence: --token, explicit --profile, TENDER_API_TOKEN, saved default profile.
   --profile <name>   Local config profile name. Defaults to the saved default profile.
   --json             Emit stable JSON for coding agents.
 
@@ -381,7 +457,7 @@ Options:
   --target-pack <id>             Target pack id. Defaults to the API default.
   --target-pack-version <value>  Target pack version. Defaults to the API default.
   --base-url <url>               Tender base URL. Defaults to TENDER_BASE_URL, saved profile base URL, or https://app.tenderprompt.com.
-  --token <token>                Tender API token. Defaults to TENDER_API_TOKEN or the saved profile token.
+  --token <token>                Tender API token. Precedence: --token, explicit --profile, TENDER_API_TOKEN, saved default profile.
   --profile <name>               Local config profile name. Defaults to the saved default profile.
   --json                         Emit stable JSON for coding agents.
 
@@ -395,7 +471,7 @@ function artifactsUpdateHelp() {
 Options:
   --name <name>     New app name.
   --base-url <url>  Tender base URL. Defaults to TENDER_BASE_URL, saved profile base URL, or https://app.tenderprompt.com.
-  --token <token>   Tender API token. Defaults to TENDER_API_TOKEN or the saved profile token.
+  --token <token>   Tender API token. Precedence: --token, explicit --profile, TENDER_API_TOKEN, saved default profile.
   --profile <name>  Local config profile name. Defaults to the saved default profile.
   --json            Emit stable JSON for coding agents.
 
@@ -409,7 +485,7 @@ Options:
   --dir <path>      Local checkout directory to create/update. Defaults to current directory.
   --remote <name>   Git remote name to add or update. Defaults to tender.
   --base-url <url>  Tender base URL. Defaults to TENDER_BASE_URL, saved profile base URL, or https://app.tenderprompt.com.
-  --token <token>   Tender API token. Defaults to TENDER_API_TOKEN or the saved profile token.
+  --token <token>   Tender API token. Precedence: --token, explicit --profile, TENDER_API_TOKEN, saved default profile.
   --profile <name>  Local config profile name. Defaults to the saved default profile.
   --ttl <value>     Deprecated for Tender-hosted Git remotes; accepted for compatibility.
   --dry-run         Show file and Git actions without writing.
@@ -427,7 +503,7 @@ function artifactsContextFetchHelp() {
 Options:
   --dir <path>      Local checkout to update. Defaults to current directory.
   --base-url <url>  Tender base URL. Defaults to TENDER_BASE_URL, saved profile base URL, or https://app.tenderprompt.com.
-  --token <token>   Tender API token. Defaults to TENDER_API_TOKEN or the saved profile token.
+  --token <token>   Tender API token. Precedence: --token, explicit --profile, TENDER_API_TOKEN, saved default profile.
   --profile <name>  Local config profile name. Defaults to the saved default profile.
   --dry-run         Show create/overwrite/conflict actions without writing files.
   --force           Overwrite conflicting managed context files.
@@ -444,7 +520,7 @@ function artifactsContextStatusHelp() {
 Options:
   --dir <path>      Local checkout to inspect. Defaults to current directory.
   --base-url <url>  Tender base URL. Defaults to TENDER_BASE_URL, saved profile base URL, or https://app.tenderprompt.com.
-  --token <token>   Tender API token. Defaults to TENDER_API_TOKEN or the saved profile token.
+  --token <token>   Tender API token. Precedence: --token, explicit --profile, TENDER_API_TOKEN, saved default profile.
   --profile <name>  Local config profile name. Defaults to the saved default profile.
   --json            Emit stable JSON for coding agents.
 
@@ -457,7 +533,7 @@ function artifactsContextRefreshHelp() {
 Options:
   --dir <path>      Local checkout to update. Defaults to current directory.
   --base-url <url>  Tender base URL. Defaults to TENDER_BASE_URL, saved profile base URL, or https://app.tenderprompt.com.
-  --token <token>   Tender API token. Defaults to TENDER_API_TOKEN or the saved profile token.
+  --token <token>   Tender API token. Precedence: --token, explicit --profile, TENDER_API_TOKEN, saved default profile.
   --profile <name>  Local config profile name. Defaults to the saved default profile.
   --dry-run         Show create/overwrite/conflict actions without writing files.
   --force           Overwrite conflicting managed context files.
@@ -514,7 +590,7 @@ function gitRemoteHelp() {
 
 Options:
   --base-url <url>   Tender base URL. Defaults to TENDER_BASE_URL, saved profile base URL, or https://app.tenderprompt.com.
-  --token <token>    Tender API token. Defaults to TENDER_API_TOKEN or the saved profile token.
+  --token <token>    Tender API token. Precedence: --token, explicit --profile, TENDER_API_TOKEN, saved default profile.
   --profile <name>   Local config profile name. Defaults to the saved default profile.
   --ttl <value>      Deprecated for Tender-hosted Git remotes; accepted for compatibility.
   --json             Emit stable JSON for coding agents.
@@ -531,7 +607,7 @@ Options:
   --dir <path>      Local Git checkout to configure. Defaults to current directory.
   --remote <name>   Git remote name to add or update. Defaults to tender.
   --base-url <url>  Tender base URL. Defaults to TENDER_BASE_URL, saved profile base URL, or https://app.tenderprompt.com.
-  --token <token>   Tender API token. Defaults to TENDER_API_TOKEN or the saved profile token.
+  --token <token>   Tender API token. Precedence: --token, explicit --profile, TENDER_API_TOKEN, saved default profile.
   --profile <name>  Local config profile name. Defaults to the saved default profile.
   --ttl <value>     Deprecated for Tender-hosted Git remotes; accepted for compatibility.
   --dry-run         Show Git commands without running them.
@@ -559,7 +635,7 @@ function previewRebuildHelp() {
 Options:
   --commit <sha>   Rebuild preview only if the app workspace is at this Git commit.
   --base-url <url>  Tender base URL. Defaults to TENDER_BASE_URL, saved profile base URL, or https://app.tenderprompt.com.
-  --token <token>   Tender API token. Defaults to TENDER_API_TOKEN or the saved profile token.
+  --token <token>   Tender API token. Precedence: --token, explicit --profile, TENDER_API_TOKEN, saved default profile.
   --profile <name>  Local config profile name. Defaults to the saved default profile.
   --stream          Request lifecycle events from the API.
   --json            Emit stable JSON for coding agents.
@@ -573,7 +649,7 @@ function validateHelp() {
 
 Options:
   --base-url <url>  Tender base URL. Defaults to TENDER_BASE_URL, saved profile base URL, or https://app.tenderprompt.com.
-  --token <token>   Tender API token. Defaults to TENDER_API_TOKEN or the saved profile token.
+  --token <token>   Tender API token. Precedence: --token, explicit --profile, TENDER_API_TOKEN, saved default profile.
   --profile <name>  Local config profile name. Defaults to the saved default profile.
   --stream          Request lifecycle events from the API.
   --json            Emit stable JSON for coding agents.
@@ -588,7 +664,7 @@ function buildHelp() {
 Options:
   --commit <sha>   Build only if the app workspace is at this Git commit.
   --base-url <url>  Tender base URL. Defaults to TENDER_BASE_URL, saved profile base URL, or https://app.tenderprompt.com.
-  --token <token>   Tender API token. Defaults to TENDER_API_TOKEN or the saved profile token.
+  --token <token>   Tender API token. Precedence: --token, explicit --profile, TENDER_API_TOKEN, saved default profile.
   --profile <name>  Local config profile name. Defaults to the saved default profile.
   --stream          Request lifecycle events from the API.
   --json            Emit stable JSON for coding agents.
@@ -604,7 +680,7 @@ Options:
   --commit <sha>    Show the latest preview job for one artifact Git commit.
   --job <job-id>    Show one lifecycle job directly.
   --base-url <url>  Tender base URL. Defaults to TENDER_BASE_URL, saved profile base URL, or https://app.tenderprompt.com.
-  --token <token>   Tender API token. Defaults to TENDER_API_TOKEN or the saved profile token.
+  --token <token>   Tender API token. Precedence: --token, explicit --profile, TENDER_API_TOKEN, saved default profile.
   --profile <name>  Local config profile name. Defaults to the saved default profile.
   --json            Emit stable JSON for coding agents.
 
@@ -619,7 +695,7 @@ Options:
   --commit <sha>    Watch the latest preview job for one artifact Git commit.
   --job <job-id>    Watch one lifecycle job directly.
   --base-url <url>  Tender base URL. Defaults to TENDER_BASE_URL, saved profile base URL, or https://app.tenderprompt.com.
-  --token <token>   Tender API token. Defaults to TENDER_API_TOKEN or the saved profile token.
+  --token <token>   Tender API token. Precedence: --token, explicit --profile, TENDER_API_TOKEN, saved default profile.
   --profile <name>  Local config profile name. Defaults to the saved default profile.
   --stream          Request Server-Sent Events from the API.
   --json            Emit lifecycle events as JSON lines.
@@ -637,7 +713,7 @@ Options:
   --commit <sha>     Publish only if the app workspace is at this Git commit.
   --message <text>   Human audit message returned in CLI output.
   --base-url <url>   Tender base URL. Defaults to TENDER_BASE_URL, saved profile base URL, or https://app.tenderprompt.com.
-  --token <token>    Tender API token. Defaults to TENDER_API_TOKEN or the saved profile token.
+  --token <token>    Tender API token. Precedence: --token, explicit --profile, TENDER_API_TOKEN, saved default profile.
   --profile <name>   Local config profile name. Defaults to the saved default profile.
   --stream           Request lifecycle events from the API.
   --json             Emit stable JSON for coding agents.
@@ -652,7 +728,7 @@ function publishStatusHelp() {
 Options:
   --job <job-id>    Show one publish lifecycle job directly.
   --base-url <url>  Tender base URL. Defaults to TENDER_BASE_URL, saved profile base URL, or https://app.tenderprompt.com.
-  --token <token>   Tender API token. Defaults to TENDER_API_TOKEN or the saved profile token.
+  --token <token>   Tender API token. Precedence: --token, explicit --profile, TENDER_API_TOKEN, saved default profile.
   --profile <name>  Local config profile name. Defaults to the saved default profile.
   --json            Emit stable JSON for coding agents.
 
@@ -665,7 +741,7 @@ function publishWatchHelp() {
 Options:
   --job <job-id>    Watch one publish lifecycle job directly.
   --base-url <url>  Tender base URL. Defaults to TENDER_BASE_URL, saved profile base URL, or https://app.tenderprompt.com.
-  --token <token>   Tender API token. Defaults to TENDER_API_TOKEN or the saved profile token.
+  --token <token>   Tender API token. Precedence: --token, explicit --profile, TENDER_API_TOKEN, saved default profile.
   --profile <name>  Local config profile name. Defaults to the saved default profile.
   --stream          Request Server-Sent Events from the API.
   --json            Emit lifecycle events as JSON lines.
@@ -740,12 +816,20 @@ function tenderCliCapabilities() {
                     "tender app analytics charts templates --json",
                     "tender app analytics query <artifact-id> --spec chart.json --json",
                     "tender app analytics export query <artifact-id> --spec chart.json --format csv",
+                    "tender app analytics properties list <artifact-id> --json",
+                    "tender app analytics properties activate <artifact-id> --event <event-name> --property <property-key> --type dimension --dry-run --json",
                     "tender app analytics dashboards <artifact-id> --create \"Agent dashboard\" --dry-run --json",
                     "tender app analytics charts create <artifact-id> --dashboard <dashboard-id> --title <title> --spec chart.json --dry-run --json",
+                    "tender app analytics charts list <artifact-id> --dashboard <dashboard-id> --json",
+                    "tender app analytics charts update <artifact-id> --chart <chart-id> --title <title> --spec chart.json --dry-run --json",
+                    "tender app analytics charts delete <artifact-id> --chart <chart-id> --dry-run --json",
                 ],
                 notes: [
                     "Combine CLI capabilities with local source inspection of analytics calls.",
-                    "Validate chart specs with query before saving charts.",
+                    "Validate chart specs with query before creating or updating saved charts.",
+                    "Property chart create/update commands automatically make missing custom event properties queryable when the spec has an event_name = filter.",
+                    "Ad hoc query is read-only; if it reports a missing dashboard-query property, activate the property first or save the chart through charts create/update.",
+                    "Use list before writes so agents can avoid duplicates and explain the exact chart they are changing.",
                 ],
             },
             {
@@ -801,6 +885,46 @@ function tenderCliCapabilities() {
                 requiresAuth: false,
                 writes: false,
             },
+            {
+                command: "tender app analytics properties list <artifact-id> --json",
+                purpose: "List custom event properties available to dashboard queries.",
+                requiresAuth: true,
+                writes: false,
+            },
+            {
+                command: "tender app analytics properties activate <artifact-id> --event <event-name> --property <property-key> --type <dimension|metric> --dry-run --json",
+                purpose: "Preview or activate the custom event property needed for a property group-by or property metric chart.",
+                requiresAuth: true,
+                writes: true,
+                dryRun: true,
+            },
+            {
+                command: "tender app analytics charts create <artifact-id> --dashboard <dashboard-id> --title <title> --spec chart.json --dry-run --json",
+                purpose: "Preview or create a saved chart from a validated chart spec.",
+                requiresAuth: true,
+                writes: true,
+                dryRun: true,
+            },
+            {
+                command: "tender app analytics charts list <artifact-id> --dashboard <dashboard-id> --json",
+                purpose: "List saved charts and full chart specs from one dashboard.",
+                requiresAuth: true,
+                writes: false,
+            },
+            {
+                command: "tender app analytics charts update <artifact-id> --chart <chart-id> --title <title> --spec chart.json --dry-run --json",
+                purpose: "Preview or update a saved chart title and chart spec.",
+                requiresAuth: true,
+                writes: true,
+                dryRun: true,
+            },
+            {
+                command: "tender app analytics charts delete <artifact-id> --chart <chart-id> --dry-run --json",
+                purpose: "Preview or delete a saved chart.",
+                requiresAuth: true,
+                writes: true,
+                dryRun: true,
+            },
         ],
         security: [
             "Prefer artifact-scoped device tokens.",
@@ -921,6 +1045,19 @@ async function resolveApiCredentials(input) {
             profileName: null,
         };
     }
+    if (input.profileName) {
+        const config = await readConfig(input.env);
+        const profile = config.profiles?.[input.profileName];
+        if (!profile) {
+            throw new TenderCliUsageError(`Tender profile "${input.profileName}" was not found. Run \`tender auth login --device --save-profile ${input.profileName}\` or choose another --profile.`);
+        }
+        return {
+            baseUrl: input.baseUrl ?? profile.baseUrl ?? readDefaultBaseUrl(input.env),
+            token: profile.token,
+            source: "config",
+            profileName: input.profileName,
+        };
+    }
     if (input.env.TENDER_API_TOKEN) {
         return {
             baseUrl: input.baseUrl ?? readDefaultBaseUrl(input.env),
@@ -930,7 +1067,7 @@ async function resolveApiCredentials(input) {
         };
     }
     const config = await readConfig(input.env);
-    const profileName = input.profileName ?? config.defaultProfile ?? DEFAULT_PROFILE_NAME;
+    const profileName = config.defaultProfile ?? DEFAULT_PROFILE_NAME;
     const profile = config.profiles?.[profileName];
     if (!profile) {
         throw new TenderCliUsageError("Tender API token is required. Run `tender auth login --device`, set TENDER_API_TOKEN, or pass --token <token>.");
@@ -2801,13 +2938,13 @@ function analyticsChartTemplates() {
             id: "property_breakdown",
             title: "Property breakdown",
             visualization: "bar",
-            purpose: "Compare a promoted dimension property observed in events.",
+            purpose: "Compare a queryable dimension property observed in events.",
             usableAsIs: false,
             placeholders: {
-                property: "<promoted_dimension_property>",
+                property: "<queryable_dimension_property>",
             },
             adaptWith: [
-                "Use a property key promoted by capabilities chartSpec.groupBy, such as property:plan.",
+                "Use a queryable property key from capabilities chartSpec.groupBy, such as property:plan.",
                 "Choose stable categorical properties with enough observations to compare.",
             ],
             spec: {
@@ -2815,7 +2952,7 @@ function analyticsChartTemplates() {
                 dataset: "events",
                 visualization: "bar",
                 metric: { name: "custom_event_count" },
-                groupBy: [{ field: "property:<promoted_dimension_property>" }],
+                groupBy: [{ field: "property:<queryable_dimension_property>" }],
                 filters: [],
                 range: { preset: "30d" },
                 sort: [{ field: "value", direction: "desc" }],
@@ -2829,17 +2966,17 @@ function analyticsChartTemplates() {
             purpose: "Track an observed numeric event property over time.",
             usableAsIs: false,
             placeholders: {
-                metric: "avg:<promoted_metric_property>",
+                metric: "avg:<queryable_metric_property>",
             },
             adaptWith: [
-                "Use a numeric property key promoted by capabilities chartSpec.metrics.",
+                "Use a queryable numeric property key from capabilities chartSpec.metrics.",
                 "Prefer averages for scores, durations, quantities, or ordinal values.",
             ],
             spec: {
                 version: 1,
                 dataset: "events",
                 visualization: "line",
-                metric: { name: "avg:<promoted_metric_property>" },
+                metric: { name: "avg:<queryable_metric_property>" },
                 groupBy: [{ field: "day" }],
                 filters: [],
                 range: { preset: "30d" },
@@ -2882,7 +3019,7 @@ function runAnalyticsChartsTemplates(command, io) {
         templates,
         next: [
             "Run tender app analytics capabilities <artifact-id> --include-catalog --range 30d --json.",
-            "Choose a template and replace placeholders with observed events, paths, or promoted property keys.",
+            "Choose a template and replace placeholders with observed events, paths, or queryable property keys.",
             "Validate with tender app analytics query <artifact-id> --spec chart.json --json.",
             "Preview saved writes with tender app analytics dashboards ... --dry-run and charts create ... --dry-run.",
         ],
@@ -2953,6 +3090,208 @@ function parseAnalyticsChartsCreateArgs(args) {
         ...parsed,
     };
 }
+function parseAnalyticsChartsListArgs(args) {
+    if (args.includes("--help") || args.includes("-h")) {
+        return { command: "help", topic: "app analytics charts list" };
+    }
+    const artifactId = args[0];
+    if (!artifactId || artifactId.startsWith("-")) {
+        throw new TenderCliUsageError("app id is required. Example: tender app analytics charts list <app-id> --dashboard <dashboard-id> --json");
+    }
+    const parsed = parseAnalyticsCommonArgs(args, 1);
+    let dashboardId = null;
+    for (let index = 0; index < parsed.remaining.length; index += 1) {
+        const arg = parsed.remaining[index];
+        if (arg === "--dashboard") {
+            dashboardId = parseRequiredFlagValue(parsed.remaining[index + 1], "--dashboard");
+            index += 1;
+            continue;
+        }
+        throw new TenderCliUsageError(`Unknown analytics charts list option: ${arg}`);
+    }
+    if (!dashboardId) {
+        throw new TenderCliUsageError("--dashboard is required. Example: tender app analytics charts list artifact_123 --dashboard analytics_dashboard_123 --json");
+    }
+    return {
+        command: "app analytics charts list",
+        artifactId,
+        dashboardId,
+        ...parsed,
+    };
+}
+function parseAnalyticsChartsUpdateArgs(args) {
+    if (args.includes("--help") || args.includes("-h")) {
+        return { command: "help", topic: "app analytics charts update" };
+    }
+    const artifactId = args[0];
+    if (!artifactId || artifactId.startsWith("-")) {
+        throw new TenderCliUsageError("app id is required. Example: tender app analytics charts update <app-id> --chart <chart-id> --title <title> --spec chart.json --json");
+    }
+    const parsed = parseAnalyticsCommonArgs(args, 1);
+    let chartId = null;
+    let title = null;
+    let specPath = null;
+    let dryRun = false;
+    for (let index = 0; index < parsed.remaining.length; index += 1) {
+        const arg = parsed.remaining[index];
+        if (arg === "--chart") {
+            chartId = parseRequiredFlagValue(parsed.remaining[index + 1], "--chart");
+            index += 1;
+            continue;
+        }
+        if (arg === "--title") {
+            title = parseRequiredFlagValue(parsed.remaining[index + 1], "--title");
+            index += 1;
+            continue;
+        }
+        if (arg === "--spec") {
+            specPath = parseSpecPath(parsed.remaining[index + 1]);
+            index += 1;
+            continue;
+        }
+        if (arg === "--dry-run") {
+            dryRun = true;
+            continue;
+        }
+        throw new TenderCliUsageError(`Unknown analytics charts update option: ${arg}`);
+    }
+    if (!chartId) {
+        throw new TenderCliUsageError("--chart is required. Example: tender app analytics charts update artifact_123 --chart analytics_chart_123 --title \"Signup funnel\" --json");
+    }
+    if (!title && !specPath) {
+        throw new TenderCliUsageError("At least one of --title or --spec is required. Example: tender app analytics charts update artifact_123 --chart analytics_chart_123 --title \"Signup funnel\" --dry-run --json");
+    }
+    return {
+        command: "app analytics charts update",
+        artifactId,
+        chartId,
+        title,
+        specPath,
+        dryRun,
+        ...parsed,
+    };
+}
+function parseAnalyticsChartsDeleteArgs(args) {
+    if (args.includes("--help") || args.includes("-h")) {
+        return { command: "help", topic: "app analytics charts delete" };
+    }
+    const artifactId = args[0];
+    if (!artifactId || artifactId.startsWith("-")) {
+        throw new TenderCliUsageError("app id is required. Example: tender app analytics charts delete <app-id> --chart <chart-id> --dry-run --json");
+    }
+    const parsed = parseAnalyticsCommonArgs(args, 1);
+    let chartId = null;
+    let dryRun = false;
+    for (let index = 0; index < parsed.remaining.length; index += 1) {
+        const arg = parsed.remaining[index];
+        if (arg === "--chart") {
+            chartId = parseRequiredFlagValue(parsed.remaining[index + 1], "--chart");
+            index += 1;
+            continue;
+        }
+        if (arg === "--dry-run") {
+            dryRun = true;
+            continue;
+        }
+        throw new TenderCliUsageError(`Unknown analytics charts delete option: ${arg}`);
+    }
+    if (!chartId) {
+        throw new TenderCliUsageError("--chart is required. Example: tender app analytics charts delete artifact_123 --chart analytics_chart_123 --dry-run --json");
+    }
+    return {
+        command: "app analytics charts delete",
+        artifactId,
+        chartId,
+        dryRun,
+        ...parsed,
+    };
+}
+function parseAnalyticsPropertiesListArgs(args) {
+    if (args.includes("--help") || args.includes("-h")) {
+        return { command: "help", topic: "app analytics properties list" };
+    }
+    const artifactId = args[0];
+    if (!artifactId || artifactId.startsWith("-")) {
+        throw new TenderCliUsageError("app id is required. Example: tender app analytics properties list <app-id> --json");
+    }
+    const parsed = parseAnalyticsCommonArgs(args, 1);
+    let eventName = null;
+    for (let index = 0; index < parsed.remaining.length; index += 1) {
+        const arg = parsed.remaining[index];
+        if (arg === "--event") {
+            eventName = parseRequiredFlagValue(parsed.remaining[index + 1], "--event");
+            index += 1;
+            continue;
+        }
+        throw new TenderCliUsageError(`Unknown analytics properties list option: ${arg}`);
+    }
+    return {
+        command: "app analytics properties list",
+        artifactId,
+        eventName,
+        ...parsed,
+    };
+}
+function parseAnalyticsPropertiesActivateArgs(args) {
+    if (args.includes("--help") || args.includes("-h")) {
+        return { command: "help", topic: "app analytics properties activate" };
+    }
+    const artifactId = args[0];
+    if (!artifactId || artifactId.startsWith("-")) {
+        throw new TenderCliUsageError("app id is required. Example: tender app analytics properties activate <app-id> --event <event-name> --property <property-key> --type dimension --json");
+    }
+    const parsed = parseAnalyticsCommonArgs(args, 1);
+    let eventName = null;
+    let propertyKey = null;
+    let propertyType = null;
+    let label = null;
+    let dryRun = false;
+    for (let index = 0; index < parsed.remaining.length; index += 1) {
+        const arg = parsed.remaining[index];
+        if (arg === "--event") {
+            eventName = parseRequiredFlagValue(parsed.remaining[index + 1], "--event");
+            index += 1;
+            continue;
+        }
+        if (arg === "--property") {
+            propertyKey = parseRequiredFlagValue(parsed.remaining[index + 1], "--property");
+            index += 1;
+            continue;
+        }
+        if (arg === "--type") {
+            const value = parseRequiredFlagValue(parsed.remaining[index + 1], "--type");
+            if (value !== "dimension" && value !== "metric") {
+                throw new TenderCliUsageError("--type must be dimension or metric.");
+            }
+            propertyType = value;
+            index += 1;
+            continue;
+        }
+        if (arg === "--label") {
+            label = parseRequiredFlagValue(parsed.remaining[index + 1], "--label");
+            index += 1;
+            continue;
+        }
+        if (arg === "--dry-run") {
+            dryRun = true;
+            continue;
+        }
+        throw new TenderCliUsageError(`Unknown analytics properties activate option: ${arg}`);
+    }
+    if (!eventName || !propertyKey || !propertyType) {
+        throw new TenderCliUsageError("--event, --property, and --type are required. Example: tender app analytics properties activate artifact_123 --event signup_started --property plan --type dimension --json");
+    }
+    return {
+        command: "app analytics properties activate",
+        artifactId,
+        eventName,
+        propertyKey,
+        propertyType,
+        label,
+        dryRun,
+        ...parsed,
+    };
+}
 function parseTenderArgs(args) {
     if (args.length === 0 || args[0] === "--help" || args[0] === "-h") {
         return { command: "help", topic: "root" };
@@ -3036,6 +3375,23 @@ function parseTenderArgs(args) {
         if (resourceArgs[1] === "analytics" && resourceArgs[2] === "dashboards") {
             return parseAnalyticsDashboardsArgs(resourceArgs.slice(3));
         }
+        if (resourceArgs[1] === "analytics" &&
+            resourceArgs[2] === "properties" &&
+            (resourceArgs[3] === undefined ||
+                resourceArgs[3] === "--help" ||
+                resourceArgs[3] === "-h")) {
+            return { command: "help", topic: "app analytics properties list" };
+        }
+        if (resourceArgs[1] === "analytics" &&
+            resourceArgs[2] === "properties" &&
+            resourceArgs[3] === "list") {
+            return parseAnalyticsPropertiesListArgs(resourceArgs.slice(4));
+        }
+        if (resourceArgs[1] === "analytics" &&
+            resourceArgs[2] === "properties" &&
+            resourceArgs[3] === "activate") {
+            return parseAnalyticsPropertiesActivateArgs(resourceArgs.slice(4));
+        }
         if (resourceArgs[1] === "analytics" &&
             resourceArgs[2] === "export" &&
             (resourceArgs[3] === undefined ||
@@ -3070,6 +3426,21 @@ function parseTenderArgs(args) {
             resourceArgs[3] === "create") {
             return parseAnalyticsChartsCreateArgs(resourceArgs.slice(4));
         }
+        if (resourceArgs[1] === "analytics" &&
+            resourceArgs[2] === "charts" &&
+            resourceArgs[3] === "list") {
+            return parseAnalyticsChartsListArgs(resourceArgs.slice(4));
+        }
+        if (resourceArgs[1] === "analytics" &&
+            resourceArgs[2] === "charts" &&
+            resourceArgs[3] === "update") {
+            return parseAnalyticsChartsUpdateArgs(resourceArgs.slice(4));
+        }
+        if (resourceArgs[1] === "analytics" &&
+            resourceArgs[2] === "charts" &&
+            resourceArgs[3] === "delete") {
+            return parseAnalyticsChartsDeleteArgs(resourceArgs.slice(4));
+        }
         if (resourceArgs[1] === "context" &&
             (resourceArgs[2] === undefined ||
                 resourceArgs[2] === "--help" ||
@@ -3442,7 +3813,9 @@ async function requestAnalyticsApi(input) {
     if (input.includeCatalog) {
         params.set("includeCatalog", "1");
     }
-    const suffix = input.analyticsPath ? `/${input.analyticsPath}` : "";
+    const suffix = input.analyticsPath
+        ? `/${input.analyticsPath}${input.resourceId ? `/${encodeURIComponent(input.resourceId)}` : ""}`
+        : "";
     const query = params.size > 0 ? `?${params.toString()}` : "";
     const response = await input.fetcher(`${input.baseUrl}/api/v1/artifacts/${encodeURIComponent(input.artifactId)}/analytics${suffix}${query}`, {
         method: input.method,
@@ -3460,12 +3833,12 @@ async function requestAnalyticsApi(input) {
         const message = (typeof payload?.message === "string" && payload.message) ||
             (typeof payload?.reasonCode === "string" && payload.reasonCode) ||
             `Analytics request failed with HTTP ${response.status}.`;
-        throw new Error([
+        throw new TenderCliAnalyticsApiError([
             message,
             `Scope: artifact ${input.artifactId}, analytics/${input.analyticsPath || "summary"}.`,
             `Reason: ${reasonCode}.`,
             `Example: ${analyticsCorrectedExample(input.artifactId, input.analyticsPath)}.`,
-        ].join("\n"));
+        ].join("\n"), reasonCode);
     }
     return payload;
 }
@@ -3479,6 +3852,9 @@ function analyticsCorrectedExample(artifactId, analyticsPath) {
     if (analyticsPath === "suggestions") {
         return `tender app analytics suggestions ${artifactId} --range 30d --json`;
     }
+    if (analyticsPath === "properties") {
+        return `tender app analytics properties list ${artifactId} --json`;
+    }
     if (analyticsPath === "dashboards") {
         return `tender app analytics dashboards ${artifactId} --json`;
     }
@@ -3487,6 +3863,250 @@ function analyticsCorrectedExample(artifactId, analyticsPath) {
     }
     return `tender app analytics summary ${artifactId} --range 30d --json`;
 }
+function isCliJsonRecord(value) {
+    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function readCliStringField(record, field) {
+    const value = record[field];
+    return typeof value === "string" ? value : null;
+}
+function readCliBooleanField(record, field) {
+    const value = record[field];
+    return typeof value === "boolean" ? value : false;
+}
+function readAnalyticsDashboardRecords(payload) {
+    return Array.isArray(payload.dashboards)
+        ? payload.dashboards.filter(isCliJsonRecord)
+        : [];
+}
+function readAnalyticsChartRecords(dashboard) {
+    return Array.isArray(dashboard.charts)
+        ? dashboard.charts.filter(isCliJsonRecord)
+        : [];
+}
+function findAnalyticsDashboard(payload, dashboardId) {
+    return (readAnalyticsDashboardRecords(payload).find((dashboard) => readCliStringField(dashboard, "id") === dashboardId) ?? null);
+}
+function findAnalyticsChart(payload, chartId) {
+    for (const dashboard of readAnalyticsDashboardRecords(payload)) {
+        const chart = readAnalyticsChartRecords(dashboard).find((candidate) => readCliStringField(candidate, "id") === chartId);
+        if (chart) {
+            return { dashboard, chart };
+        }
+    }
+    return null;
+}
+function readAnalyticsChartTitle(chart) {
+    return readCliStringField(chart, "title") ?? "Analytics chart";
+}
+function readAnalyticsChartSpec(chart) {
+    const spec = chart.spec;
+    if (spec === undefined) {
+        throw new Error("Saved chart does not include a chart spec.");
+    }
+    return spec;
+}
+function readAnalyticsChartLayout(chart) {
+    return isCliJsonRecord(chart.layout) ? chart.layout : {};
+}
+function readAnalyticsPropertyRecords(payload) {
+    return Array.isArray(payload.properties)
+        ? payload.properties.filter(isCliJsonRecord)
+        : [];
+}
+function readAnalyticsSpecEventNameFilter(spec) {
+    if (!isCliJsonRecord(spec) || !Array.isArray(spec.filters)) {
+        return null;
+    }
+    const filter = spec.filters.filter(isCliJsonRecord).find((candidate) => readCliStringField(candidate, "field") === "event_name" &&
+        readCliStringField(candidate, "op") === "=" &&
+        typeof candidate.value === "string" &&
+        candidate.value.trim().length > 0);
+    return typeof filter?.value === "string" ? filter.value.trim() : null;
+}
+function readAnalyticsSpecMetricName(spec) {
+    if (!isCliJsonRecord(spec) || !isCliJsonRecord(spec.metric)) {
+        return null;
+    }
+    return readCliStringField(spec.metric, "name");
+}
+function readAnalyticsSpecGroupField(spec) {
+    if (!isCliJsonRecord(spec) || !Array.isArray(spec.groupBy)) {
+        return null;
+    }
+    const [group] = spec.groupBy.filter(isCliJsonRecord);
+    return group ? readCliStringField(group, "field") : null;
+}
+function readRequiredAnalyticsPropertiesFromSpec(spec) {
+    const eventName = readAnalyticsSpecEventNameFilter(spec);
+    const requirements = [];
+    const groupField = readAnalyticsSpecGroupField(spec);
+    if (groupField?.startsWith("property:")) {
+        if (!eventName) {
+            throw new TenderCliUsageError("Property group-by chart specs require an event_name = filter so the CLI can make the property available to dashboard queries.");
+        }
+        requirements.push({
+            eventName,
+            propertyKey: groupField.slice("property:".length),
+            propertyType: "dimension",
+        });
+    }
+    const metricName = readAnalyticsSpecMetricName(spec);
+    if (metricName?.startsWith("sum:") || metricName?.startsWith("avg:")) {
+        if (!eventName) {
+            throw new TenderCliUsageError("Property metric chart specs require an event_name = filter so the CLI can make the property available to dashboard queries.");
+        }
+        requirements.push({
+            eventName,
+            propertyKey: metricName.slice(metricName.indexOf(":") + 1),
+            propertyType: "metric",
+        });
+    }
+    const seen = new Set();
+    return requirements.filter((requirement) => {
+        const key = `${requirement.propertyType}:${requirement.eventName}:${requirement.propertyKey}`;
+        if (seen.has(key)) {
+            return false;
+        }
+        seen.add(key);
+        return true;
+    });
+}
+async function ensureAnalyticsProperties(input) {
+    if (input.requirements.length === 0) {
+        return [];
+    }
+    const plan = [];
+    for (const requirement of input.requirements) {
+        const body = {
+            eventName: requirement.eventName,
+            propertyKey: requirement.propertyKey,
+            propertyType: requirement.propertyType,
+            label: requirement.propertyKey,
+            dryRun: input.dryRun,
+        };
+        const payload = await requestAnalyticsApi({
+            artifactId: input.command.artifactId,
+            analyticsPath: "properties",
+            method: "POST",
+            baseUrl: input.credentials.baseUrl,
+            token: input.credentials.token,
+            fetcher: input.runtime.fetcher ?? fetch,
+            body,
+        });
+        plan.push({
+            eventName: requirement.eventName,
+            propertyKey: requirement.propertyKey,
+            propertyType: requirement.propertyType,
+            label: requirement.propertyKey,
+            status: readCliBooleanField(payload, "alreadyActive")
+                ? "existing"
+                : input.dryRun
+                    ? "planned"
+                    : "activated",
+            property: payload.property,
+        });
+    }
+    return plan;
+}
+function analyticsCommandAuthFlags(command) {
+    const flags = [];
+    if (command.baseUrl) {
+        flags.push("--base-url", shellQuote(command.baseUrl));
+    }
+    if (command.profileName) {
+        flags.push("--profile", shellQuote(command.profileName));
+    }
+    return flags;
+}
+function analyticsPropertyActivationCommand(input) {
+    return [
+        "tender",
+        "app",
+        "analytics",
+        "properties",
+        "activate",
+        shellQuote(input.command.artifactId),
+        "--event",
+        shellQuote(input.requirement.eventName),
+        "--property",
+        shellQuote(input.requirement.propertyKey),
+        "--type",
+        input.requirement.propertyType,
+        ...(input.dryRun ? ["--dry-run"] : []),
+        ...analyticsCommandAuthFlags(input.command),
+        "--json",
+    ].join(" ");
+}
+function createAnalyticsPropertyGuidance(input) {
+    let requirements;
+    try {
+        requirements = readRequiredAnalyticsPropertiesFromSpec(input.spec);
+    }
+    catch {
+        return null;
+    }
+    if (requirements.length === 0) {
+        return null;
+    }
+    const lines = [
+        "To make this chart available for dashboard queries, activate the custom event property first:",
+    ];
+    for (const requirement of requirements) {
+        lines.push(analyticsPropertyActivationCommand({
+            command: input.command,
+            requirement,
+            dryRun: true,
+        }), analyticsPropertyActivationCommand({
+            command: input.command,
+            requirement,
+            dryRun: false,
+        }));
+    }
+    if (input.command.flagToken) {
+        lines.push("Pass the same --token again, or use a saved profile/TENDER_API_TOKEN; tokens are not echoed in suggestions.");
+    }
+    lines.push("Then rerun the original analytics query.");
+    return lines.join("\n");
+}
+async function requestAnalyticsQueryWithPropertyGuidance(input) {
+    try {
+        return await requestAnalyticsApi({
+            artifactId: input.command.artifactId,
+            analyticsPath: "query",
+            method: "POST",
+            baseUrl: input.credentials.baseUrl,
+            token: input.credentials.token,
+            fetcher: input.runtime.fetcher ?? fetch,
+            body: { spec: input.spec },
+        });
+    }
+    catch (error) {
+        if (error instanceof TenderCliAnalyticsApiError &&
+            error.reasonCode === "analytics_property_not_queryable") {
+            const guidance = createAnalyticsPropertyGuidance({
+                command: input.command,
+                spec: input.spec,
+            });
+            if (guidance) {
+                throw new TenderCliAnalyticsApiError(`${error.message}\n\n${guidance}`, error.reasonCode);
+            }
+        }
+        throw error;
+    }
+}
+async function requestAnalyticsDashboardsForCli(command, runtime) {
+    const credentials = await resolveAnalyticsCredentials(command, runtime);
+    const payload = await requestAnalyticsApi({
+        artifactId: command.artifactId,
+        analyticsPath: "dashboards",
+        method: "GET",
+        baseUrl: credentials.baseUrl,
+        token: credentials.token,
+        fetcher: runtime.fetcher ?? fetch,
+    });
+    return { credentials, payload };
+}
 function printAnalyticsPayload(command, io, payload, fallbackLines) {
     if (command.json) {
         io.stdout(JSON.stringify(payload, null, 2));
@@ -3775,6 +4395,47 @@ async function planSourceFiles(input) {
 }
 async function runAuthStatus(command, io, runtime) {
     const env = runtime.env ?? process.env;
+    if (command.profileName) {
+        const config = await readConfig(env);
+        const profile = config.profiles?.[command.profileName] ?? null;
+        const result = {
+            ok: Boolean(profile),
+            command: command.command,
+            source: profile ? "config" : null,
+            profile: command.profileName,
+            configPath: readConfigPath(env),
+            baseUrl: profile?.baseUrl ?? null,
+            tokenAvailable: Boolean(profile?.token),
+            tokenPrefix: profile?.tokenPrefix ?? null,
+            tenantId: profile?.tenantId ?? null,
+            artifactId: profile?.artifactId ?? null,
+            permissions: profile?.permissions ?? [],
+            expiresAt: formatExpiry(profile?.expiresAt),
+        };
+        if (command.json) {
+            io.stdout(JSON.stringify(result, null, 2));
+        }
+        else if (profile) {
+            io.stdout([
+                "authenticated: true",
+                `source: config:${command.profileName}`,
+                `base_url: ${profile.baseUrl}`,
+                `token_prefix: ${profile.tokenPrefix ?? "(unknown)"}`,
+                `tenant_id: ${profile.tenantId ?? "(unknown)"}`,
+                `app_id: ${profile.artifactId ?? "(account)"}`,
+                `permissions: ${(profile.permissions ?? []).join(" ") || "(unknown)"}`,
+                `expires_at: ${formatExpiry(profile.expiresAt) ?? "(unknown)"}`,
+            ].join("\n"));
+        }
+        else {
+            io.stdout([
+                "authenticated: false",
+                `profile: ${command.profileName}`,
+                "next: tender auth login --device --profile edit-preview --artifact <artifact-id>",
+            ].join("\n"));
+        }
+        return profile ? 0 : 1;
+    }
     if (env.TENDER_API_TOKEN) {
         const result = {
             ok: true,
@@ -5491,14 +6152,11 @@ async function runAnalyticsQuery(command, io, runtime) {
         specPath: command.specPath,
         stdin: runtime.stdin,
     });
-    const payload = await requestAnalyticsApi({
-        artifactId: command.artifactId,
-        analyticsPath: "query",
-        method: "POST",
-        baseUrl: credentials.baseUrl,
-        token: credentials.token,
-        fetcher: runtime.fetcher ?? fetch,
-        body: { spec },
+    const payload = await requestAnalyticsQueryWithPropertyGuidance({
+        command,
+        credentials,
+        runtime,
+        spec,
     });
     const rows = Array.isArray(payload.rows) ? payload.rows : [];
     printAnalyticsPayload(command, io, payload, [
@@ -5619,14 +6277,11 @@ async function runAnalyticsExportQuery(command, io, runtime) {
         specPath: command.specPath,
         stdin: runtime.stdin,
     });
-    const payload = await requestAnalyticsApi({
-        artifactId: command.artifactId,
-        analyticsPath: "query",
-        method: "POST",
-        baseUrl: credentials.baseUrl,
-        token: credentials.token,
-        fetcher: runtime.fetcher ?? fetch,
-        body: { spec },
+    const payload = await requestAnalyticsQueryWithPropertyGuidance({
+        command,
+        credentials,
+        runtime,
+        spec,
     });
     const rows = Array.isArray(payload.rows) ? payload.rows : [];
     if (command.format === "csv") {
@@ -5636,6 +6291,58 @@ async function runAnalyticsExportQuery(command, io, runtime) {
     io.stdout(JSON.stringify(payload, null, 2));
     return 0;
 }
+async function runAnalyticsPropertiesList(command, io, runtime) {
+    const credentials = await resolveAnalyticsCredentials(command, runtime);
+    const payload = await requestAnalyticsApi({
+        artifactId: command.artifactId,
+        analyticsPath: "properties",
+        method: "GET",
+        baseUrl: credentials.baseUrl,
+        token: credentials.token,
+        fetcher: runtime.fetcher ?? fetch,
+    });
+    const properties = readAnalyticsPropertyRecords(payload).filter((property) => !command.eventName ||
+        readCliStringField(property, "eventName") === command.eventName);
+    printAnalyticsPayload(command, io, {
+        ok: true,
+        command: command.command,
+        artifactId: command.artifactId,
+        eventName: command.eventName,
+        properties,
+    }, [
+        `app_id: ${command.artifactId}`,
+        command.eventName ? `event: ${command.eventName}` : "event: all",
+        `properties: ${properties.length}`,
+    ]);
+    return 0;
+}
+async function runAnalyticsPropertiesActivate(command, io, runtime) {
+    const credentials = await resolveAnalyticsCredentials(command, runtime);
+    const request = {
+        eventName: command.eventName,
+        propertyKey: command.propertyKey,
+        propertyType: command.propertyType,
+        label: command.label ?? command.propertyKey,
+        dryRun: command.dryRun,
+    };
+    const payload = await requestAnalyticsApi({
+        artifactId: command.artifactId,
+        analyticsPath: "properties",
+        method: "POST",
+        baseUrl: credentials.baseUrl,
+        token: credentials.token,
+        fetcher: runtime.fetcher ?? fetch,
+        body: request,
+    });
+    printAnalyticsPayload(command, io, payload, [
+        `app_id: ${command.artifactId}`,
+        `event: ${command.eventName}`,
+        `property: ${command.propertyKey}`,
+        `type: ${command.propertyType}`,
+        ...(command.dryRun ? ["dry_run: true"] : []),
+    ]);
+    return 0;
+}
 async function runAnalyticsChartsCreate(command, io, runtime) {
     const spec = await readAnalyticsSpec({
         specPath: command.specPath,
@@ -5647,11 +6354,25 @@ async function runAnalyticsChartsCreate(command, io, runtime) {
         spec,
         layout: {},
     };
+    const requiredProperties = readRequiredAnalyticsPropertiesFromSpec(spec);
+    const credentials = !command.dryRun || requiredProperties.length > 0
+        ? await resolveAnalyticsCredentials(command, runtime)
+        : null;
+    const properties = credentials
+        ? await ensureAnalyticsProperties({
+            command,
+            credentials,
+            runtime,
+            requirements: requiredProperties,
+            dryRun: command.dryRun,
+        })
+        : [];
     if (command.dryRun) {
         const payload = {
             ok: true,
             dryRun: true,
             artifactId: command.artifactId,
+            properties,
             request: body,
         };
         printAnalyticsPayload(command, io, payload, [
@@ -5662,7 +6383,9 @@ async function runAnalyticsChartsCreate(command, io, runtime) {
         ]);
         return 0;
     }
-    const credentials = await resolveAnalyticsCredentials(command, runtime);
+    if (!credentials) {
+        throw new Error("Analytics credentials are required to create saved charts.");
+    }
     const payload = await requestAnalyticsApi({
         artifactId: command.artifactId,
         analyticsPath: "charts",
@@ -5672,9 +6395,138 @@ async function runAnalyticsChartsCreate(command, io, runtime) {
         fetcher: runtime.fetcher ?? fetch,
         body,
     });
-    printAnalyticsPayload(command, io, payload, [
+    printAnalyticsPayload(command, io, { ...payload, properties }, [
         `app_id: ${command.artifactId}`,
         `chart_id: ${String(payload.chart?.id ?? "")}`,
+        `properties: ${properties.length}`,
+    ]);
+    return 0;
+}
+async function runAnalyticsChartsList(command, io, runtime) {
+    const { payload } = await requestAnalyticsDashboardsForCli(command, runtime);
+    const dashboard = findAnalyticsDashboard(payload, command.dashboardId);
+    if (!dashboard) {
+        throw new Error(`Analytics dashboard ${command.dashboardId} was not found for app ${command.artifactId}.`);
+    }
+    const charts = readAnalyticsChartRecords(dashboard);
+    const dashboardName = readCliStringField(dashboard, "name");
+    printAnalyticsPayload(command, io, {
+        ok: true,
+        command: command.command,
+        artifactId: command.artifactId,
+        dashboardId: command.dashboardId,
+        dashboard: {
+            id: command.dashboardId,
+            name: dashboardName,
+        },
+        charts,
+    }, [
+        `app_id: ${command.artifactId}`,
+        `dashboard_id: ${command.dashboardId}`,
+        `charts: ${charts.length}`,
+    ]);
+    return 0;
+}
+async function runAnalyticsChartsUpdate(command, io, runtime) {
+    const { credentials, payload: dashboardsPayload } = await requestAnalyticsDashboardsForCli(command, runtime);
+    const existing = findAnalyticsChart(dashboardsPayload, command.chartId);
+    if (!existing) {
+        throw new Error(`Analytics chart ${command.chartId} was not found for app ${command.artifactId}.`);
+    }
+    const spec = command.specPath
+        ? await readAnalyticsSpec({
+            specPath: command.specPath,
+            stdin: runtime.stdin,
+        })
+        : readAnalyticsChartSpec(existing.chart);
+    const title = command.title ?? readAnalyticsChartTitle(existing.chart);
+    const body = {
+        title,
+        spec,
+        layout: readAnalyticsChartLayout(existing.chart),
+    };
+    const properties = await ensureAnalyticsProperties({
+        command,
+        credentials,
+        runtime,
+        requirements: readRequiredAnalyticsPropertiesFromSpec(spec),
+        dryRun: command.dryRun,
+    });
+    const dashboardId = readCliStringField(existing.dashboard, "id");
+    if (command.dryRun) {
+        printAnalyticsPayload(command, io, {
+            ok: true,
+            dryRun: true,
+            artifactId: command.artifactId,
+            chartId: command.chartId,
+            dashboardId,
+            currentChart: existing.chart,
+            properties,
+            request: body,
+        }, [
+            `app_id: ${command.artifactId}`,
+            `chart_id: ${command.chartId}`,
+            `title: ${title}`,
+            "dry_run: true",
+        ]);
+        return 0;
+    }
+    const payload = await requestAnalyticsApi({
+        artifactId: command.artifactId,
+        analyticsPath: "charts",
+        resourceId: command.chartId,
+        method: "PATCH",
+        baseUrl: credentials.baseUrl,
+        token: credentials.token,
+        fetcher: runtime.fetcher ?? fetch,
+        body,
+    });
+    printAnalyticsPayload(command, io, { ...payload, properties }, [
+        `app_id: ${command.artifactId}`,
+        `chart_id: ${command.chartId}`,
+        `title: ${String(payload.chart?.title ?? title)}`,
+        `properties: ${properties.length}`,
+    ]);
+    return 0;
+}
+async function runAnalyticsChartsDelete(command, io, runtime) {
+    const { credentials, payload: dashboardsPayload } = await requestAnalyticsDashboardsForCli(command, runtime);
+    const existing = findAnalyticsChart(dashboardsPayload, command.chartId);
+    if (!existing) {
+        throw new Error(`Analytics chart ${command.chartId} was not found for app ${command.artifactId}.`);
+    }
+    const dashboardId = readCliStringField(existing.dashboard, "id");
+    if (command.dryRun) {
+        printAnalyticsPayload(command, io, {
+            ok: true,
+            dryRun: true,
+            artifactId: command.artifactId,
+            chartId: command.chartId,
+            dashboardId,
+            currentChart: existing.chart,
+            request: {
+                chartId: command.chartId,
+            },
+        }, [
+            `app_id: ${command.artifactId}`,
+            `chart_id: ${command.chartId}`,
+            "dry_run: true",
+        ]);
+        return 0;
+    }
+    const payload = await requestAnalyticsApi({
+        artifactId: command.artifactId,
+        analyticsPath: "charts",
+        resourceId: command.chartId,
+        method: "DELETE",
+        baseUrl: credentials.baseUrl,
+        token: credentials.token,
+        fetcher: runtime.fetcher ?? fetch,
+    });
+    printAnalyticsPayload(command, io, payload, [
+        `app_id: ${command.artifactId}`,
+        `chart_id: ${command.chartId}`,
+        `deleted: ${String(payload.deleted ?? "")}`,
     ]);
     return 0;
 }
@@ -5793,6 +6645,21 @@ export async function runTenderCli(args, io = {
             else if (command.topic === "app analytics charts create") {
                 io.stdout(analyticsChartsCreateHelp());
             }
+            else if (command.topic === "app analytics charts list") {
+                io.stdout(analyticsChartsListHelp());
+            }
+            else if (command.topic === "app analytics charts update") {
+                io.stdout(analyticsChartsUpdateHelp());
+            }
+            else if (command.topic === "app analytics charts delete") {
+                io.stdout(analyticsChartsDeleteHelp());
+            }
+            else if (command.topic === "app analytics properties list") {
+                io.stdout(analyticsPropertiesListHelp());
+            }
+            else if (command.topic === "app analytics properties activate") {
+                io.stdout(analyticsPropertiesActivateHelp());
+            }
             else if (command.topic === "app") {
                 io.stdout(appHelp());
             }
@@ -5894,6 +6761,21 @@ export async function runTenderCli(args, io = {
         if (command.command === "app analytics charts create") {
             return await runAnalyticsChartsCreate(command, io, runtime);
         }
+        if (command.command === "app analytics charts list") {
+            return await runAnalyticsChartsList(command, io, runtime);
+        }
+        if (command.command === "app analytics charts update") {
+            return await runAnalyticsChartsUpdate(command, io, runtime);
+        }
+        if (command.command === "app analytics charts delete") {
+            return await runAnalyticsChartsDelete(command, io, runtime);
+        }
+        if (command.command === "app analytics properties list") {
+            return await runAnalyticsPropertiesList(command, io, runtime);
+        }
+        if (command.command === "app analytics properties activate") {
+            return await runAnalyticsPropertiesActivate(command, io, runtime);
+        }
         if (command.command === "app git remote") {
             return await runGitRemote(command, io, runtime);
         }