@tenderprompt/cli 0.1.19 → 0.1.20

package/dist/index.js

@@ -110,6 +110,10 @@ Commands:
                              Show publish job status by job id
   tender app publish watch <app-id>
                              Stream or print lifecycle events for a publish job
+  tender app outbound-auth list <app-id>
+                             List pending and approved outbound auth grants
+  tender app outbound-auth approve <app-id>
+                             Approve manifest-declared outbound auth grants
   tender app analytics summary <app-id>
                              Read artifact analytics totals and trend points
   tender app analytics query <app-id> --spec <file|-> 
@@ -155,6 +159,8 @@ Examples:
   tender app preview status artifact_123 --commit $(git rev-parse HEAD) --json
   tender app preview watch artifact_123 --job job_123 --stream --json
   tender app publish artifact_123 --commit $(git rev-parse HEAD) --confirm publish --stream --json
+  tender app outbound-auth list artifact_123 --json
+  tender app outbound-auth approve artifact_123 --all --confirm approve --json
   tender app analytics summary artifact_123 --range 30d --json
   tender app analytics query artifact_123 --spec chart.json --json
   tender app analytics suggestions artifact_123 --range 30d --json
@@ -293,6 +299,10 @@ Commands:
                              Show publish job status by job id
   tender app publish watch <app-id>
                              Replay lifecycle events for a publish job id
+  tender app outbound-auth list <app-id>
+                             List pending and approved outbound auth grants
+  tender app outbound-auth approve <app-id>
+                             Approve manifest-declared outbound auth grants
   tender app analytics summary <app-id>
                              Read artifact analytics totals and trend points
   tender app analytics query <app-id> --spec <file|->
@@ -355,6 +365,8 @@ Examples:
   tender app publish artifact_123 --dry-run --json
   tender app publish status artifact_123 --job job_123 --json
   tender app publish watch artifact_123 --job job_123 --stream --json
+  tender app outbound-auth list artifact_123 --json
+  tender app outbound-auth approve artifact_123 --all --confirm approve --json
   tender app analytics summary artifact_123 --range 30d --json
   tender app analytics query artifact_123 --spec chart.json --json
   tender app analytics suggestions artifact_123 --range 30d --json
@@ -1024,6 +1036,32 @@ Options:
 Examples:
   tender app publish watch artifact_123 --job job_123 --stream --json`;
 }
+function outboundAuthHelp() {
+    return `Usage:
+  tender app outbound-auth list <app-id> [--base-url <url>] [--token <token>] [--profile <name>] [--json]
+  tender app outbound-auth approve <app-id> (--all | --binding <id> --secret <key> --host <host> --location <header|query> --name <name>) --confirm approve [--path-prefix <path>] [--scheme <scheme>] [--base-url <url>] [--token <token>] [--profile <name>] [--json]
+
+Commands:
+  list       List manifest-declared outbound auth grants and approval status.
+  approve    Approve one grant, or all currently pending grants with --all.
+
+Options:
+  --all                  Approve every pending outbound auth grant declared by the current manifest.
+  --binding <id>         Binding id from bindings/<id>/binding.json.
+  --secret <key>         Secret key backing the injected credential.
+  --host <host>          Exact outbound host.
+  --location <value>     header or query.
+  --name <name>          Header name or query parameter name.
+  --path-prefix <path>   Optional path prefix from outboundAuth.
+  --scheme <scheme>      Optional header auth scheme from outboundAuth.
+  --confirm approve      Required for approval.
+  --json                 Emit stable JSON for coding agents.
+
+Examples:
+  tender app outbound-auth list artifact_123 --json
+  tender app outbound-auth approve artifact_123 --all --confirm approve --json
+  tender app outbound-auth approve artifact_123 --binding google-chat --secret GOOGLE_CHAT_KEY --host chat.googleapis.com --location query --name key --path-prefix /v1/spaces/ --confirm approve --json`;
+}
 function tenderCliCapabilities() {
     return {
         ok: true,
@@ -1057,6 +1095,7 @@ function tenderCliCapabilities() {
                 'tender app analytics --help',
                 'tender app db --help',
                 'tender app bindings outbound --help',
+                'tender app outbound-auth --help',
             ],
         },
         workflows: [
@@ -1130,11 +1169,13 @@ function tenderCliCapabilities() {
                     'git push tender main',
                     'tender app agent heartbeat <artifact-id> --source codex --status working --phase building_preview --summary "Waiting for preview build" --commit $(git rev-parse HEAD) --json',
                     'tender app preview <artifact-id> --commit $(git rev-parse HEAD) --stream --json',
+                    'tender app outbound-auth list <artifact-id> --json',
                     'tender app publish <artifact-id> --dry-run --json',
                     'tender app publish <artifact-id> --commit $(git rev-parse HEAD) --confirm publish --stream --json',
                 ],
                 notes: [
                     'Send heartbeat updates only at meaningful milestones or when waiting for user input; do not send rapid polling updates.',
+                    'If preview or publish reports outbound auth grant approval required, run tender app outbound-auth approve <artifact-id> --all --confirm approve --json, then retry.',
                     'Publishing is production-facing and requires explicit user intent.',
                 ],
             },
@@ -2260,6 +2301,201 @@ function parsePublishWatchArgs(args) {
         json: options.json,
     };
 }
+function parseOutboundAuthLocation(value) {
+    if (value !== 'header' && value !== 'query') {
+        throw new TenderCliUsageError('--location must be one of header or query.');
+    }
+    return value;
+}
+function parseOutboundAuthListArgs(args) {
+    if (args.includes('--help') || args.includes('-h')) {
+        return { command: 'help', topic: 'app outbound-auth' };
+    }
+    const artifactId = args[0];
+    if (!artifactId || artifactId.startsWith('-')) {
+        throw new TenderCliUsageError('app id is required. Example: tender app outbound-auth list <app-id> --json');
+    }
+    let baseUrl = null;
+    let flagToken = null;
+    let profileName = null;
+    let json = false;
+    for (let index = 1; index < args.length; index += 1) {
+        const arg = args[index];
+        if (arg === '--json') {
+            json = true;
+            continue;
+        }
+        if (arg === '--base-url') {
+            baseUrl = parseBaseUrlFlag(args, index);
+            index += 1;
+            continue;
+        }
+        if (arg === '--token') {
+            flagToken = parseTokenFlag(args, index);
+            index += 1;
+            continue;
+        }
+        if (arg === '--profile') {
+            profileName = parseProfileName(args[index + 1], '--profile');
+            index += 1;
+            continue;
+        }
+        throw new TenderCliUsageError(`Unknown outbound-auth list option: ${arg}`);
+    }
+    return {
+        command: 'app outbound-auth list',
+        artifactId,
+        baseUrl,
+        flagToken,
+        profileName,
+        json,
+    };
+}
+function parseOutboundAuthApproveArgs(args) {
+    if (args.includes('--help') || args.includes('-h')) {
+        return { command: 'help', topic: 'app outbound-auth' };
+    }
+    const artifactId = args[0];
+    if (!artifactId || artifactId.startsWith('-')) {
+        throw new TenderCliUsageError('app id is required. Example: tender app outbound-auth approve <app-id> --all --confirm approve --json');
+    }
+    let baseUrl = null;
+    let flagToken = null;
+    let profileName = null;
+    let confirm = null;
+    let approveAll = false;
+    let bindingId = null;
+    let secret = null;
+    let host = null;
+    let location = null;
+    let name = null;
+    let scheme = null;
+    let pathPrefix = null;
+    let json = false;
+    for (let index = 1; index < args.length; index += 1) {
+        const arg = args[index];
+        if (arg === '--json') {
+            json = true;
+            continue;
+        }
+        if (arg === '--all') {
+            approveAll = true;
+            continue;
+        }
+        if (arg === '--confirm') {
+            const value = args[index + 1];
+            if (!value || value.startsWith('-')) {
+                throw new TenderCliUsageError('--confirm requires the value approve.');
+            }
+            confirm = value;
+            index += 1;
+            continue;
+        }
+        if (arg === '--binding') {
+            const value = args[index + 1];
+            if (!value || value.startsWith('-')) {
+                throw new TenderCliUsageError('--binding requires a binding id.');
+            }
+            bindingId = value;
+            index += 1;
+            continue;
+        }
+        if (arg === '--secret') {
+            const value = args[index + 1];
+            if (!value || value.startsWith('-')) {
+                throw new TenderCliUsageError('--secret requires a secret key.');
+            }
+            secret = value;
+            index += 1;
+            continue;
+        }
+        if (arg === '--host') {
+            const value = args[index + 1];
+            if (!value || value.startsWith('-')) {
+                throw new TenderCliUsageError('--host requires a host.');
+            }
+            host = value;
+            index += 1;
+            continue;
+        }
+        if (arg === '--location') {
+            location = parseOutboundAuthLocation(args[index + 1]);
+            index += 1;
+            continue;
+        }
+        if (arg === '--name') {
+            const value = args[index + 1];
+            if (!value || value.startsWith('-')) {
+                throw new TenderCliUsageError('--name requires a header or query parameter name.');
+            }
+            name = value;
+            index += 1;
+            continue;
+        }
+        if (arg === '--scheme') {
+            const value = args[index + 1];
+            if (!value || value.startsWith('-')) {
+                throw new TenderCliUsageError('--scheme requires an auth scheme.');
+            }
+            scheme = value;
+            index += 1;
+            continue;
+        }
+        if (arg === '--path-prefix') {
+            const value = args[index + 1];
+            if (!value || value.startsWith('-')) {
+                throw new TenderCliUsageError('--path-prefix requires a path prefix.');
+            }
+            pathPrefix = value;
+            index += 1;
+            continue;
+        }
+        if (arg === '--base-url') {
+            baseUrl = parseBaseUrlFlag(args, index);
+            index += 1;
+            continue;
+        }
+        if (arg === '--token') {
+            flagToken = parseTokenFlag(args, index);
+            index += 1;
+            continue;
+        }
+        if (arg === '--profile') {
+            profileName = parseProfileName(args[index + 1], '--profile');
+            index += 1;
+            continue;
+        }
+        throw new TenderCliUsageError(`Unknown outbound-auth approve option: ${arg}`);
+    }
+    if (confirm !== 'approve') {
+        throw new TenderCliUsageError('outbound-auth approve requires --confirm approve.');
+    }
+    if (approveAll && (bindingId || secret || host || location || name || scheme || pathPrefix)) {
+        throw new TenderCliUsageError('Use either --all or one explicit grant, not both.');
+    }
+    if (!approveAll && (!bindingId || !secret || !host || !location || !name)) {
+        throw new TenderCliUsageError('Explicit approval requires --binding, --secret, --host, --location, and --name. Example: tender app outbound-auth approve <app-id> --binding google-chat --secret GOOGLE_CHAT_KEY --host chat.googleapis.com --location query --name key --confirm approve --json');
+    }
+    return {
+        command: 'app outbound-auth approve',
+        artifactId,
+        approveAll,
+        confirm,
+        grant: {
+            bindingId,
+            secret,
+            host,
+            location,
+            name,
+            scheme,
+            pathPrefix,
+        },
+        baseUrl,
+        flagToken,
+        profileName,
+        json,
+    };
+}
 function parseArtifactsListArgs(args) {
     if (args.includes('--help') || args.includes('-h')) {
         return { command: 'help', topic: 'app list' };
@@ -4692,6 +4928,18 @@ function parseTenderArgs(args) {
         if (resourceArgs[1] === 'bindings' && (resourceArgs[2] === undefined || resourceArgs[2] === '--help' || resourceArgs[2] === '-h')) {
             return { command: 'help', topic: 'app bindings outbound' };
         }
+        if (resourceArgs[1] === 'outbound-auth' && (resourceArgs[2] === undefined || resourceArgs[2] === '--help' || resourceArgs[2] === '-h')) {
+            return { command: 'help', topic: 'app outbound-auth' };
+        }
+        if (resourceArgs[1] === 'outbound-auth' && resourceArgs[2] === 'list') {
+            return parseOutboundAuthListArgs(resourceArgs.slice(3));
+        }
+        if (resourceArgs[1] === 'outbound-auth' && resourceArgs[2] === 'approve') {
+            return parseOutboundAuthApproveArgs(resourceArgs.slice(3));
+        }
+        if (resourceArgs[1] === 'outbound-auth') {
+            throw new TenderCliUsageError(`Unknown app outbound-auth command: ${resourceArgs[2]}`);
+        }
         if (resourceArgs[1] === 'analytics' && (resourceArgs[2] === undefined || resourceArgs[2] === '--help' || resourceArgs[2] === '-h')) {
             return { command: 'help', topic: 'app analytics' };
         }
@@ -7451,7 +7699,7 @@ async function postLifecycle(input) {
     }
     const payload = await parseJsonResponse(response);
     if (!response.ok || !payload?.ok) {
-        throw new Error(payload?.message ?? payload?.reasonCode ?? `Artifact ${input.operation} request failed with HTTP ${response.status}.`);
+        throw new Error(formatApiFailureMessage(payload, `Artifact ${input.operation} request failed with HTTP ${response.status}.`));
     }
     const result = {
         ok: true,
@@ -7473,6 +7721,18 @@ async function postLifecycle(input) {
     }
     return 0;
 }
+function readNextCommand(next) {
+    if (!next || typeof next !== 'object' || Array.isArray(next)) {
+        return null;
+    }
+    const command = next.command;
+    return typeof command === 'string' && command.trim() ? command.trim() : null;
+}
+function formatApiFailureMessage(payload, fallback) {
+    const message = payload?.message ?? payload?.reasonCode ?? fallback;
+    const command = readNextCommand(payload?.next);
+    return command ? `${message}\nNext: ${command}` : message;
+}
 async function runValidate(command, io, runtime) {
     return await postLifecycle({
         command,
@@ -7671,6 +7931,127 @@ async function runPublish(command, io, runtime) {
         runtime,
     });
 }
+async function requestOutboundAuthList(input) {
+    const response = await input.fetcher(`${input.credentials.baseUrl}/api/v1/artifacts/${encodeURIComponent(input.command.artifactId)}/outbound-auth/grants`, {
+        headers: {
+            authorization: `Bearer ${input.credentials.token}`,
+        },
+    });
+    const payload = await parseJsonResponse(response);
+    if (!response.ok || !payload?.ok) {
+        throw new Error(formatApiFailureMessage(payload, `Outbound auth grant lookup failed with HTTP ${response.status}.`));
+    }
+    return payload;
+}
+function formatOutboundAuthGrant(grant) {
+    return `${grant.bindingId} -> ${grant.secret} -> ${grant.host} -> ${grant.location}:${grant.name}${grant.pathPrefix ? ` -> ${grant.pathPrefix}` : ''}${grant.scheme ? ` -> ${grant.scheme}` : ''}`;
+}
+function readExplicitOutboundAuthGrant(command) {
+    const { bindingId, secret, host, location, name, scheme, pathPrefix } = command.grant;
+    if (!bindingId || !secret || !host || !location || !name) {
+        throw new TenderCliUsageError('Explicit approval requires --binding, --secret, --host, --location, and --name.');
+    }
+    return {
+        bindingId,
+        secret,
+        host,
+        location,
+        name,
+        ...(scheme ? { scheme } : {}),
+        ...(pathPrefix ? { pathPrefix } : {}),
+    };
+}
+async function approveOutboundAuthGrant(input) {
+    const response = await input.fetcher(`${input.credentials.baseUrl}/api/v1/artifacts/${encodeURIComponent(input.command.artifactId)}/outbound-auth/grants/approve`, {
+        method: 'POST',
+        headers: {
+            authorization: `Bearer ${input.credentials.token}`,
+            'content-type': 'application/json',
+        },
+        body: JSON.stringify(input.grant),
+    });
+    const payload = await parseJsonResponse(response);
+    if (!response.ok || !payload?.ok || !payload.approved) {
+        throw new Error(formatApiFailureMessage(payload, `Outbound auth grant approval failed with HTTP ${response.status}.`));
+    }
+    return payload.approved;
+}
+async function runOutboundAuthList(command, io, runtime) {
+    const credentials = await resolveApiCredentials({
+        baseUrl: command.baseUrl,
+        flagToken: command.flagToken,
+        profileName: command.profileName,
+        env: runtime.env ?? process.env,
+    });
+    const payload = await requestOutboundAuthList({
+        command,
+        credentials,
+        fetcher: runtime.fetcher ?? fetch,
+    });
+    const result = {
+        ok: true,
+        command: command.command,
+        baseUrl: credentials.baseUrl,
+        authSource: credentials.source,
+        profile: credentials.profileName,
+        artifactId: command.artifactId,
+        grants: payload.grants ?? [],
+        pendingCount: payload.pendingCount ?? 0,
+        approvedCount: payload.approvedCount ?? 0,
+        next: payload.next ?? null,
+    };
+    if (command.json) {
+        io.stdout(JSON.stringify(result, null, 2));
+    }
+    else {
+        const grants = result.grants.map((grant) => `${grant.approved ? 'approved' : 'pending'}: ${formatOutboundAuthGrant(grant)}`);
+        io.stdout([
+            `app_id: ${command.artifactId}`,
+            `pending: ${result.pendingCount}`,
+            `approved: ${result.approvedCount}`,
+            ...grants,
+            ...(readNextCommand(result.next) ? [`next: ${readNextCommand(result.next)}`] : []),
+        ].join('\n'));
+    }
+    return 0;
+}
+async function runOutboundAuthApprove(command, io, runtime) {
+    const credentials = await resolveApiCredentials({
+        baseUrl: command.baseUrl,
+        flagToken: command.flagToken,
+        profileName: command.profileName,
+        env: runtime.env ?? process.env,
+    });
+    const fetcher = runtime.fetcher ?? fetch;
+    const grants = command.approveAll
+        ? (await requestOutboundAuthList({ command, credentials, fetcher })).grants?.filter((grant) => !grant.approved) ?? []
+        : [readExplicitOutboundAuthGrant(command)];
+    const approved = [];
+    for (const grant of grants) {
+        approved.push(await approveOutboundAuthGrant({ command, credentials, fetcher, grant }));
+    }
+    const result = {
+        ok: true,
+        command: command.command,
+        baseUrl: credentials.baseUrl,
+        authSource: credentials.source,
+        profile: credentials.profileName,
+        artifactId: command.artifactId,
+        approvedCount: approved.length,
+        approved,
+    };
+    if (command.json) {
+        io.stdout(JSON.stringify(result, null, 2));
+    }
+    else {
+        io.stdout([
+            `app_id: ${command.artifactId}`,
+            `approved: ${approved.length}`,
+            ...approved.map((grant) => formatOutboundAuthGrant(grant)),
+        ].join('\n'));
+    }
+    return 0;
+}
 async function requestPublishJob(input) {
     const response = await input.fetcher(`${input.credentials.baseUrl}/api/v1/artifacts/${encodeURIComponent(input.command.artifactId)}/jobs/${encodeURIComponent(input.command.jobId)}`, {
         headers: {
@@ -8702,6 +9083,9 @@ export async function runTenderCli(args, io = {
             else if (command.topic === 'app publish watch') {
                 io.stdout(publishWatchHelp());
             }
+            else if (command.topic === 'app outbound-auth') {
+                io.stdout(outboundAuthHelp());
+            }
             else if (command.topic === 'app analytics') {
                 io.stdout(analyticsHelp());
             }
@@ -8854,6 +9238,12 @@ export async function runTenderCli(args, io = {
         if (command.command === 'app publish watch') {
             return await runPublishWatch(command, io, runtime);
         }
+        if (command.command === 'app outbound-auth list') {
+            return await runOutboundAuthList(command, io, runtime);
+        }
+        if (command.command === 'app outbound-auth approve') {
+            return await runOutboundAuthApprove(command, io, runtime);
+        }
         if (command.command === 'app analytics summary') {
             return await runAnalyticsSummary(command, io, runtime);
         }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@tenderprompt/cli",
-	"version": "0.1.19",
+	"version": "0.1.20",
 	"type": "module",
 	"bin": {
 		"tender": "bin/tender.js"