@tenderprompt/cli 0.1.24 → 0.1.26

package/dist/index.js

@@ -34,6 +34,61 @@ const CLI_PACKAGE_VERSION = readCliPackageVersion();
 const ANALYTICS_AUTHORING_PLAYBOOK_ID = 'analytics-event-authoring';
 const ANALYTICS_AUTHORING_COMMAND = 'tender app analytics authoring --json';
 const ANALYTICS_AUTHORING_PLAYBOOK_COMMAND = `tender playbooks get ${ANALYTICS_AUTHORING_PLAYBOOK_ID} --json`;
+const ANALYTICS_AGENT_GUIDANCE = {
+    generatedAppDelivery: {
+        defaultAnalytics: 'Generated apps should emit useful Tender analytics events and provision saved starter dashboard charts by default unless the user opts out or a concrete blocker is recorded.',
+        skipOnlyWhen: ['The user explicitly opts out.', 'A concrete platform or data blocker is reported.'],
+    },
+    replacementBaseline: {
+        requiredBeforeSourceEdits: true,
+        guidance: 'Replacement work must inspect and interact with the existing customer-facing surface before source edits, or record the concrete blocker.',
+        browserToolPriority: [
+            'Codex in-app browser:browser skill',
+            'agent-browser',
+            'Chrome DevTools MCP',
+            'Playwright',
+            'another browser-capable tool',
+        ],
+    },
+    shopperOperatorBoundary: {
+        guidance: 'Tender analytics dashboards, A/B reports, sessions, and internal counters are operator-facing Tender surfaces, not shopper-facing app UI.',
+        shopperUiMustNotInclude: [
+            'analytics dashboards',
+            'A/B reports',
+            'sessions tables',
+            'internal counters',
+            'dashboard controls',
+            'shopper-callable analytics summary routes',
+        ],
+        adminSurfaceException: 'Only build an admin or operator surface when the user explicitly asks for one, and secure it so shopper traffic cannot read internal analytics.',
+    },
+    dashboardCompletion: {
+        completeWhen: [
+            'A Tender dashboard exists or is reused.',
+            'Required queryable properties are active, already queryable, or blocked with an actionable reason.',
+            'Saved starter charts exist for the app journey.',
+            'The saved chart list has been queried and returns the chart names or ids.',
+        ],
+        notCompleteWhen: ['Only an empty dashboard shell exists.'],
+        proofCommand: 'tender app analytics charts list <app-id> --dashboard <dashboard-id> --json',
+    },
+    starterDashboardCommands: [
+        'tender app analytics authoring --json',
+        'tender playbooks get analytics-event-authoring --json',
+        'tender app analytics charts templates --json',
+        'tender app analytics properties activate <app-id> --event <event-name> --property <property-key> --type dimension --dry-run --json',
+        'tender app analytics dashboards <app-id> --create "Agent dashboard" --dry-run --json',
+        'tender app analytics charts create <app-id> --dashboard <dashboard-id> --title <title> --spec chart.json --dry-run --json',
+        'tender app analytics charts list <app-id> --dashboard <dashboard-id> --json',
+    ],
+    finalAnswerEvidence: [
+        'baseline inspection scope or blocker',
+        'published URL or preview status',
+        'Tender dashboard id',
+        'saved chart names or ids from charts list',
+        'clear split between shopper-facing UI and operator-facing analytics',
+    ],
+};
 class TenderCliUsageError extends Error {
     constructor(message) {
         super(message);
@@ -134,6 +189,8 @@ Commands:
                              Describe app database query limits and policy
   tender app db query <app-id> --env <preview|published> --sql <sql>
                              Run one read-only app database query
+  tender app db dashboards <app-id>
+                             List or create private app admin dashboards
   tender app context fetch <app-id>
                              Fetch managed agent context into a checkout
   tender app context status <app-id>
@@ -350,12 +407,12 @@ Commands:
                              Rebuild the preview and optionally stream lifecycle events
   tender app preview status <app-id>
                              Show preview job status by latest, commit, or job id
-  tender app preview watch <app-id>
-                             Replay lifecycle events by latest, commit, or job id
-  tender app agent heartbeat <app-id>
-                             Send a concise agent status update to the workspace
-  tender app publish <app-id>
-                             Publish after dry-run or explicit confirmation
+	  tender app preview watch <app-id>
+	                             Replay lifecycle events by latest, commit, or job id
+	  tender app agent heartbeat <app-id>
+	                             Send a concise agent status update to the workspace
+	  tender app publish <app-id>
+	                             Publish after dry-run or explicit confirmation
   tender app publish status <app-id>
                              Show publish job status by job id
   tender app publish watch <app-id>
@@ -372,6 +429,8 @@ Commands:
                              Run a server-validated chart spec
   tender app analytics suggestions <app-id>
                              Generate useful starter chart suggestions
+  tender app analytics provision <app-id>
+                             Print a starter dashboard provisioning plan
   tender app analytics dashboards <app-id>
                              List or create saved dashboards
   tender app analytics charts create <app-id>
@@ -394,6 +453,12 @@ Commands:
                              Show table and index schema for one table
   tender app db query <app-id> --env <preview|published> --sql <sql>
                              Run one read-only app database query
+  tender app db dashboards <app-id>
+                             List or create private app admin dashboards
+  tender app db resources create <app-id>
+                             Add a table-backed dashboard resource
+  tender app db widgets create <app-id>
+                             Add a saved dashboard widget
   tender app context fetch <app-id>
                              Fetch AGENTS.md, skills, and Tender project context
   tender app context status <app-id>
@@ -537,6 +602,7 @@ Commands:
   tender app analytics capabilities <app-id>  Describe agent-safe analytics capabilities
   tender app analytics suggestions <app-id>   Generate starter chart suggestions
   tender app analytics exact-funnel <app-id>  Run exact unit funnel analysis
+  tender app analytics provision <app-id>     Print a starter dashboard provisioning plan
   tender app analytics dashboards <app-id>    List or create dashboards
   tender app analytics export <kind> <app-id> Export catalog metadata or query rows
   tender app analytics charts templates       Print reusable chart spec templates
@@ -557,6 +623,7 @@ Examples:
   tender app analytics export catalog artifact_123 --range 30d --json
   tender app analytics export query artifact_123 --spec chart.json --format csv
   tender app analytics suggestions artifact_123 --range 2026-04-01..2026-04-30 --json
+  tender app analytics provision artifact_123 --from-app --json
   tender app analytics dashboards artifact_123 --create "Agent dashboard" --json
   tender app analytics charts templates --json
   tender app analytics charts create artifact_123 --dashboard analytics_dashboard_123 --title "Signup funnel" --spec unit-funnel.json --json
@@ -572,6 +639,10 @@ function analyticsAuthoringHelp() {
 Prints the current generated-app analytics event authoring contract. This command
 does not require an app id, checkout, API token, or installed skill.
 
+Agent guidance includes default generated-app analytics, replacement baseline
+inspection, shopper/operator surface separation, and dashboard chart-list
+completion criteria.
+
 Examples:
   tender app analytics authoring --json`;
 }
@@ -638,6 +709,18 @@ dashboard page loads.
 Examples:
   tender app analytics exact-funnel artifact_123 --flow checkout_flow --steps started,completed --range 30d --json`;
 }
+function analyticsProvisionHelp() {
+    return `Usage: tender app analytics provision <app-id> --from-app [--dashboard-name <name>] [--base-url <url>] [--token <token>] [--profile <name>] [--json]
+
+Prints a machine-readable provisioning plan for the default generated-app
+analytics delivery contract. This command does not mutate dashboards yet; it
+returns the exact commands, starter chart specs, completion criteria, and
+blockers an external coding agent should follow.
+
+Examples:
+  tender app analytics provision artifact_123 --from-app --json
+  tender app analytics provision artifact_123 --from-app --dashboard-name "Recommendation dashboard" --json`;
+}
 function analyticsDashboardsHelp() {
     return `Usage: tender app analytics dashboards <app-id> [--create <name>] [--dry-run] [--base-url <url>] [--token <token>] [--profile <name>] [--json]
 
@@ -717,12 +800,27 @@ Commands:
                                       Show schema for one table
   tender app db query <app-id> --env <preview|published>
                                       Run one read-only SQL query
+  tender app db dashboards <app-id>
+                                      List or create private app admin dashboards
+  tender app db resources suggest <app-id>
+                                      Suggest private app admin resources from schema
+  tender app db dashboards render <app-id>
+                                      Render saved private app admin queries
+  tender app db resources create <app-id>
+                                      Add a table-backed dashboard resource from JSON
+  tender app db widgets create <app-id>
+                                      Add a saved dashboard widget from JSON
 
 Examples:
   tender app db capabilities artifact_123 --json
   tender app db tables artifact_123 --env published --json
   tender app db schema artifact_123 --env published --table votes --json
   tender app db query artifact_123 --env published --sql "select * from votes limit 20" --json
+  tender app db resources suggest artifact_123 --env published --json
+  tender app db dashboards artifact_123 --create "Coffee Matcher Admin" --json
+  tender app db dashboards render artifact_123 --dashboard app_db_dashboard_123 --env published --json
+  tender app db resources create artifact_123 --dashboard app_db_dashboard_123 --spec resource.json --json
+  tender app db widgets create artifact_123 --dashboard app_db_dashboard_123 --title "Total signups" --spec widget.json --json
   tender app db query artifact_123 --env published --file ./debug.sql --param active --limit 50 --json`;
 }
 function dbCapabilitiesHelp() {
@@ -762,6 +860,38 @@ Examples:
   tender app db query artifact_123 --env published --file ./debug.sql --limit 50 --offset 100 --json
   tender app db query artifact_123 --env published --file - --json < debug.sql`;
 }
+function dbDashboardsHelp() {
+    return `Usage: tender app db dashboards <app-id> [--create <name>] [--default-env <preview|published>] [--dry-run] [--base-url <url>] [--token <token>] [--profile <name>] [--json]
+
+Examples:
+  tender app db dashboards artifact_123 --json
+  tender app db dashboards artifact_123 --create "Coffee Matcher Admin" --default-env published --json`;
+}
+function dbDashboardsRenderHelp() {
+    return `Usage: tender app db dashboards render <app-id> --dashboard <dashboard-id> --env <preview|published> [--base-url <url>] [--token <token>] [--profile <name>] [--json]
+
+Examples:
+  tender app db dashboards render artifact_123 --dashboard app_db_dashboard_123 --env published --json`;
+}
+function dbResourcesSuggestHelp() {
+    return `Usage: tender app db resources suggest <app-id> --env <preview|published> [--base-url <url>] [--token <token>] [--profile <name>] [--json]
+
+Examples:
+  tender app db resources suggest artifact_123 --env published --json`;
+}
+function dbResourcesCreateHelp() {
+    return `Usage: tender app db resources create <app-id> --dashboard <dashboard-id> --spec <resource.json|-> [--view <view.json|->] [--dry-run] [--base-url <url>] [--token <token>] [--profile <name>] [--json]
+
+Examples:
+  tender app db resources create artifact_123 --dashboard app_db_dashboard_123 --spec resource.json --json
+  tender app db resources create artifact_123 --dashboard app_db_dashboard_123 --spec resource.json --view needs-review.json --json`;
+}
+function dbWidgetsCreateHelp() {
+    return `Usage: tender app db widgets create <app-id> --dashboard <dashboard-id> --title <title> --spec <widget.json|-> [--dry-run] [--base-url <url>] [--token <token>] [--profile <name>] [--json]
+
+Examples:
+  tender app db widgets create artifact_123 --dashboard app_db_dashboard_123 --title "Total signups" --spec widget.json --json`;
+}
 function artifactsListHelp() {
     return `Usage: tender app list [--base-url <url>] [--token <token>] [--profile <name>] [--json]
 
@@ -1097,6 +1227,15 @@ Examples:
   tender app agent heartbeat artifact_123 --source claude-code --status needs_attention --summary "Waiting for an API key decision" --requested-action answer_question --json
   tender app agent heartbeat artifact_123 --input - --json < heartbeat.json`;
 }
+function appAgentHelp() {
+    return `Usage: tender app agent <command>
+
+Commands:
+  heartbeat <app-id>    Send a concise agent status update to the workspace.
+
+Examples:
+  tender app agent heartbeat artifact_123 --source codex --status working --summary "Reading files" --json`;
+}
 function publishStatusHelp() {
     return `Usage: tender app publish status <app-id> --job <job-id> [--base-url <url>] [--token <token>] [--profile <name>] [--json]
 
@@ -1174,6 +1313,7 @@ function tenderCliCapabilities() {
             playbookCommand: ANALYTICS_AUTHORING_PLAYBOOK_COMMAND,
             doctorCommand: 'tender app doctor --dir <dir> --json',
             purpose: 'Keep generated app analytics events compatible with Tender dashboards and unit funnels.',
+            guidance: ANALYTICS_AGENT_GUIDANCE,
         },
         description: 'Agent-safe Tender App source, lifecycle, analytics, and local scaffold controls.',
         discovery: {
@@ -1185,6 +1325,7 @@ function tenderCliCapabilities() {
                 'tender memory --help',
                 'tender playbooks --help',
                 'tender app --help',
+                'tender app agent --help',
                 'tender app agent heartbeat --help',
                 'tender app share --help',
                 'tender app claim --help',
@@ -1286,6 +1427,7 @@ function tenderCliCapabilities() {
                 commands: [
                     ANALYTICS_AUTHORING_COMMAND,
                     ANALYTICS_AUTHORING_PLAYBOOK_COMMAND,
+                    'tender app analytics provision <artifact-id> --from-app --json',
                     'tender app analytics capabilities <artifact-id> --include-catalog --range 30d --json',
                     'tender app analytics charts templates --json',
                     'tender app analytics query <artifact-id> --spec chart.json --json',
@@ -1300,10 +1442,14 @@ function tenderCliCapabilities() {
                 ],
                 notes: [
                     'Run authoring before adding or repairing analytics instrumentation; use capabilities for artifact-scoped read/query details.',
+                    'Generated apps should get useful Tender analytics events and saved starter dashboard charts by default unless the user opts out or a concrete blocker is recorded.',
+                    'For replacement work, inspect the baseline customer-facing page or widget before source edits; Codex should prefer browser:browser when available.',
+                    'Tender analytics dashboards are operator-facing surfaces; do not render dashboards, A/B reports, sessions, or internal counters in shopper UI unless the user explicitly requests a secured admin surface.',
                     'Combine CLI capabilities with local source inspection of analytics calls.',
                     'Validate chart specs with query before creating or updating saved charts.',
                     'Property chart create/update commands automatically make missing custom event properties queryable when the spec has an event_name = filter.',
                     'Ad hoc query is read-only; if it reports a missing dashboard-query property, activate the property first or save the chart through charts create/update.',
+                    'Dashboard setup is not complete until saved charts exist and tender app analytics charts list returns chart names or ids.',
                     'Use list before writes so agents can avoid duplicates and explain the exact chart they are changing.',
                 ],
             },
@@ -1317,11 +1463,14 @@ function tenderCliCapabilities() {
                     'tender app db schema <artifact-id> --env published --table <table-name> --profile db --json',
                     'tender app db query <artifact-id> --env published --sql "select * from <table-name> limit 20" --profile db --json',
                     'tender app db query <artifact-id> --env published --file ./debug.sql --profile db --json',
+                    'tender app db resources suggest <artifact-id> --env published --profile db --json',
+                    'tender app db dashboards render <artifact-id> --dashboard <dashboard-id> --env published --profile db --json',
                 ],
                 notes: [
                     'The CLI only accepts artifact ids. It never accepts tenant ids, runner names, provider account ids, or runtime storage identifiers.',
                     'Read-only policy is enforced by the server before the runtime shim executes SQL.',
                     'Use --file - to pipe SQL from stdin without prompts.',
+                    'Use resources suggest and dashboards render for private operator/admin surfaces instead of building database tables into shopper UI.',
                 ],
             },
             {
@@ -1450,6 +1599,12 @@ function tenderCliCapabilities() {
                 requiresAuth: false,
                 writes: false,
             },
+            {
+                command: 'tender app analytics provision <artifact-id> --from-app --json',
+                purpose: 'Print a guided starter dashboard provisioning plan with chart-list completion proof.',
+                requiresAuth: false,
+                writes: false,
+            },
             {
                 command: 'tender app analytics properties list <artifact-id> --json',
                 purpose: 'List custom event properties available to dashboard queries.',
@@ -1514,6 +1669,39 @@ function tenderCliCapabilities() {
                 requiresAuth: true,
                 writes: false,
             },
+            {
+                command: 'tender app db resources suggest <artifact-id> --env published --json',
+                purpose: 'Suggest private app admin resources, saved views, and widgets from app database schema and samples.',
+                requiresAuth: true,
+                writes: false,
+            },
+            {
+                command: 'tender app db dashboards <artifact-id> --create "App admin" --dry-run --json',
+                purpose: 'Preview or create a private app database dashboard definition for one artifact.',
+                requiresAuth: true,
+                writes: true,
+                dryRun: true,
+            },
+            {
+                command: 'tender app db dashboards render <artifact-id> --dashboard <dashboard-id> --env published --json',
+                purpose: 'Render saved private app admin resource and widget queries for completion proof.',
+                requiresAuth: true,
+                writes: false,
+            },
+            {
+                command: 'tender app db resources create <artifact-id> --dashboard <dashboard-id> --spec resource.json --dry-run --json',
+                purpose: 'Preview or save a table-backed resource definition for a private app admin dashboard.',
+                requiresAuth: true,
+                writes: true,
+                dryRun: true,
+            },
+            {
+                command: 'tender app db widgets create <artifact-id> --dashboard <dashboard-id> --title <title> --spec widget.json --dry-run --json',
+                purpose: 'Preview or save a bounded widget definition for a private app admin dashboard.',
+                requiresAuth: true,
+                writes: true,
+                dryRun: true,
+            },
         ],
         security: [
             'Prefer artifact-scoped device tokens.',
@@ -4103,6 +4291,35 @@ function parseAnalyticsDashboardsArgs(args) {
     }
     return { command: 'app analytics dashboards', artifactId, name, dryRun, ...parsed };
 }
+function parseAnalyticsProvisionArgs(args) {
+    if (args.includes('--help') || args.includes('-h')) {
+        return { command: 'help', topic: 'app analytics provision' };
+    }
+    const artifactId = args[0];
+    if (!artifactId || artifactId.startsWith('-')) {
+        throw new TenderCliUsageError('app id is required. Example: tender app analytics provision <app-id> --from-app --json');
+    }
+    const parsed = parseAnalyticsCommonArgs(args, 1);
+    let fromApp = false;
+    let dashboardName = 'Agent dashboard';
+    for (let index = 0; index < parsed.remaining.length; index += 1) {
+        const arg = parsed.remaining[index];
+        if (arg === '--from-app') {
+            fromApp = true;
+            continue;
+        }
+        if (arg === '--dashboard-name') {
+            dashboardName = parseRequiredFlagValue(parsed.remaining[index + 1], '--dashboard-name');
+            index += 1;
+            continue;
+        }
+        throw new TenderCliUsageError(`Unknown analytics provision option: ${arg}`);
+    }
+    if (!fromApp) {
+        throw new TenderCliUsageError('--from-app is required. Example: tender app analytics provision artifact_123 --from-app --json');
+    }
+    return { command: 'app analytics provision', artifactId, fromApp, dashboardName, ...parsed };
+}
 function parseAnalyticsChartsTemplatesArgs(args) {
     if (args.includes('--help') || args.includes('-h')) {
         return { command: 'help', topic: 'app analytics charts templates' };
@@ -4222,6 +4439,7 @@ function analyticsAuthoringContract() {
                 'analytics_unstable_unit_id',
             ],
         },
+        agentGuidance: ANALYTICS_AGENT_GUIDANCE,
         analyticsAuthoring: {
             payloadShape: {
                 event: 'custom_event_name',
@@ -4293,6 +4511,8 @@ function analyticsAuthoringContract() {
             },
         ],
         charting: {
+            starterDashboardCommands: ANALYTICS_AGENT_GUIDANCE.starterDashboardCommands,
+            completionProof: ANALYTICS_AGENT_GUIDANCE.dashboardCompletion.proofCommand,
             unitFunnel: 'After traffic exists, use tender app analytics capabilities <app-id> --include-catalog --json and create version 2 unit_step_count funnel specs from observedFlows and observedUnitTypes.',
             exactAudit: 'Use tender app analytics exact-funnel <app-id> --flow <flow-id> --steps <step-a,step-b> --json for repair and low-volume audits.',
         },
@@ -4648,6 +4868,100 @@ function runAnalyticsChartsTemplates(command, io) {
     }
     return 0;
 }
+function quoteCliArgument(value) {
+    return JSON.stringify(value);
+}
+function buildAnalyticsProvisionPayload(command) {
+    const starterTemplateIds = new Set(['daily_custom_events', 'top_custom_events']);
+    const starterCharts = analyticsChartTemplates()
+        .filter((template) => starterTemplateIds.has(template.id))
+        .map((template) => ({
+        templateId: template.id,
+        title: template.title,
+        purpose: template.purpose,
+        spec: template.spec,
+    }));
+    const dashboardName = quoteCliArgument(command.dashboardName);
+    return {
+        ok: true,
+        command: command.command,
+        version: 1,
+        artifactId: command.artifactId,
+        mode: 'guided_provisioning_plan',
+        writes: false,
+        fromApp: command.fromApp,
+        dashboardName: command.dashboardName,
+        description: 'Machine-readable starter dashboard provisioning plan for external coding agents. This command does not mutate dashboards yet.',
+        agentGuidance: ANALYTICS_AGENT_GUIDANCE,
+        starterCharts,
+        steps: [
+            {
+                id: 'read_authoring_contract',
+                command: ANALYTICS_AUTHORING_COMMAND,
+                completion: 'Generated app analytics payload contract and surface boundary are loaded.',
+            },
+            {
+                id: 'inspect_app_analytics',
+                commands: [
+                    `tender app analytics capabilities ${command.artifactId} --include-catalog --range 30d --json`,
+                    'tender app doctor --dir . --json',
+                ],
+                completion: 'Observed events, unit/flow metadata, existing dashboards, and local analytics diagnostics are known.',
+            },
+            {
+                id: 'choose_starter_charts',
+                command: 'tender app analytics charts templates --json',
+                defaultTemplates: ['daily_custom_events', 'top_custom_events'],
+                completion: 'Starter chart specs are adapted to observed events or accepted as generic app-owned event charts.',
+            },
+            {
+                id: 'create_or_reuse_dashboard',
+                dryRunCommand: `tender app analytics dashboards ${command.artifactId} --create ${dashboardName} --dry-run --json`,
+                writeCommand: `tender app analytics dashboards ${command.artifactId} --create ${dashboardName} --json`,
+                completion: 'A dashboard id is available, either reused from capabilities or returned by the create command.',
+            },
+            {
+                id: 'validate_chart_specs',
+                command: `tender app analytics query ${command.artifactId} --spec chart.json --json`,
+                completion: 'Each chart spec is server-validated before it is saved.',
+            },
+            {
+                id: 'create_saved_charts',
+                dryRunCommand: `tender app analytics charts create ${command.artifactId} --dashboard <dashboard-id> --title <title> --spec chart.json --dry-run --json`,
+                writeCommand: `tender app analytics charts create ${command.artifactId} --dashboard <dashboard-id> --title <title> --spec chart.json --json`,
+                completion: 'Saved chart ids exist for starter charts, or a concrete blocker is reported.',
+            },
+            {
+                id: 'prove_completion',
+                command: `tender app analytics charts list ${command.artifactId} --dashboard <dashboard-id> --json`,
+                completion: 'The chart list returns saved chart names or ids; an empty dashboard shell is not complete.',
+            },
+        ],
+        completionCriteria: ANALYTICS_AGENT_GUIDANCE.dashboardCompletion.completeWhen,
+        blockers: [
+            'User explicitly opted out of analytics.',
+            'No meaningful generated-app journey exists to instrument yet.',
+            'App source cannot be inspected from the current checkout.',
+            'Dashboard/chart API returns an actionable auth, validation, or property activation error.',
+        ],
+        finalAnswerEvidence: ANALYTICS_AGENT_GUIDANCE.finalAnswerEvidence,
+    };
+}
+function runAnalyticsProvision(command, io) {
+    const payload = buildAnalyticsProvisionPayload(command);
+    if (command.json) {
+        io.stdout(JSON.stringify(payload, null, 2));
+    }
+    else {
+        io.stdout([
+            `app_id: ${command.artifactId}`,
+            'mode: guided_provisioning_plan',
+            `dashboard: ${command.dashboardName}`,
+            `proof: ${ANALYTICS_AGENT_GUIDANCE.dashboardCompletion.proofCommand}`,
+        ].join('\n'));
+    }
+    return 0;
+}
 function parseAnalyticsChartsCreateArgs(args) {
     if (args.includes('--help') || args.includes('-h')) {
         return { command: 'help', topic: 'app analytics charts create' };
@@ -5191,6 +5505,239 @@ function parseDbQueryArgs(args) {
         ...parsed,
     };
 }
+function parseDbDashboardsArgs(args) {
+    if (args.includes('--help') || args.includes('-h')) {
+        return { command: 'help', topic: 'app db dashboards' };
+    }
+    const artifactId = args[0];
+    if (!artifactId || artifactId.startsWith('-')) {
+        throw new TenderCliUsageError('app id is required. Example: tender app db dashboards <app-id> --json');
+    }
+    const parsed = parseDbCommonArgs(args, 1);
+    let name = null;
+    let defaultEnvironment = null;
+    let dryRun = false;
+    for (let index = 0; index < parsed.remaining.length; index += 1) {
+        const arg = parsed.remaining[index];
+        const defaultEnvAssignment = parseFlagAssignment(arg, '--default-env');
+        if (defaultEnvAssignment !== null) {
+            defaultEnvironment = parseDbEnvironment(defaultEnvAssignment);
+            continue;
+        }
+        if (arg === '--create') {
+            name = parseRequiredFlagValue(parsed.remaining[index + 1], '--create');
+            index += 1;
+            continue;
+        }
+        if (arg === '--default-env') {
+            defaultEnvironment = parseDbEnvironment(parsed.remaining[index + 1]);
+            index += 1;
+            continue;
+        }
+        if (arg === '--dry-run') {
+            dryRun = true;
+            continue;
+        }
+        throw new TenderCliUsageError(`Unknown app db dashboards option: ${arg}`);
+    }
+    if (dryRun && !name) {
+        throw new TenderCliUsageError('--dry-run is only valid with --create. Example: tender app db dashboards artifact_123 --create "App admin" --dry-run --json');
+    }
+    return { command: 'app db dashboards', artifactId, name, defaultEnvironment, dryRun, ...parsed };
+}
+function parseDbDashboardsRenderArgs(args) {
+    if (args.includes('--help') || args.includes('-h')) {
+        return { command: 'help', topic: 'app db dashboards render' };
+    }
+    const artifactId = args[0];
+    if (!artifactId || artifactId.startsWith('-')) {
+        throw new TenderCliUsageError('app id is required. Example: tender app db dashboards render <app-id> --dashboard app_db_dashboard_123 --env published --json');
+    }
+    const parsed = parseDbCommonArgs(args, 1);
+    let dashboardId = null;
+    let environment = null;
+    for (let index = 0; index < parsed.remaining.length; index += 1) {
+        const arg = parsed.remaining[index];
+        const dashboardAssignment = parseFlagAssignment(arg, '--dashboard');
+        if (dashboardAssignment !== null) {
+            dashboardId = parseRequiredFlagValue(dashboardAssignment, '--dashboard');
+            continue;
+        }
+        const envAssignment = parseFlagAssignment(arg, '--env');
+        if (envAssignment !== null) {
+            environment = parseDbEnvironment(envAssignment);
+            continue;
+        }
+        if (arg === '--dashboard') {
+            dashboardId = parseRequiredFlagValue(parsed.remaining[index + 1], '--dashboard');
+            index += 1;
+            continue;
+        }
+        if (arg === '--env') {
+            environment = parseDbEnvironment(parsed.remaining[index + 1]);
+            index += 1;
+            continue;
+        }
+        throw new TenderCliUsageError(`Unknown app db dashboards render option: ${arg}`);
+    }
+    if (!dashboardId) {
+        throw new TenderCliUsageError('--dashboard is required. Example: tender app db dashboards render artifact_123 --dashboard app_db_dashboard_123 --env published --json');
+    }
+    if (!environment) {
+        throw new TenderCliUsageError('--env is required. Example: tender app db dashboards render artifact_123 --dashboard app_db_dashboard_123 --env published --json');
+    }
+    return { command: 'app db dashboards render', artifactId, dashboardId, environment, ...parsed };
+}
+function parseDbResourcesSuggestArgs(args) {
+    if (args.includes('--help') || args.includes('-h')) {
+        return { command: 'help', topic: 'app db resources suggest' };
+    }
+    const artifactId = args[0];
+    if (!artifactId || artifactId.startsWith('-')) {
+        throw new TenderCliUsageError('app id is required. Example: tender app db resources suggest <app-id> --env published --json');
+    }
+    const parsed = parseDbCommonArgs(args, 1);
+    let environment = null;
+    for (let index = 0; index < parsed.remaining.length; index += 1) {
+        const arg = parsed.remaining[index];
+        const envAssignment = parseFlagAssignment(arg, '--env');
+        if (envAssignment !== null) {
+            environment = parseDbEnvironment(envAssignment);
+            continue;
+        }
+        if (arg === '--env') {
+            environment = parseDbEnvironment(parsed.remaining[index + 1]);
+            index += 1;
+            continue;
+        }
+        throw new TenderCliUsageError(`Unknown app db resources suggest option: ${arg}`);
+    }
+    if (!environment) {
+        throw new TenderCliUsageError('--env is required. Example: tender app db resources suggest artifact_123 --env published --json');
+    }
+    return { command: 'app db resources suggest', artifactId, environment, ...parsed };
+}
+function parseDbResourcesCreateArgs(args) {
+    if (args.includes('--help') || args.includes('-h')) {
+        return { command: 'help', topic: 'app db resources create' };
+    }
+    const artifactId = args[0];
+    if (!artifactId || artifactId.startsWith('-')) {
+        throw new TenderCliUsageError('app id is required. Example: tender app db resources create <app-id> --dashboard app_db_dashboard_123 --spec resource.json --json');
+    }
+    const parsed = parseDbCommonArgs(args, 1);
+    let dashboardId = null;
+    let specPath = null;
+    const viewPaths = [];
+    let dryRun = false;
+    for (let index = 0; index < parsed.remaining.length; index += 1) {
+        const arg = parsed.remaining[index];
+        const dashboardAssignment = parseFlagAssignment(arg, '--dashboard');
+        if (dashboardAssignment !== null) {
+            dashboardId = parseRequiredFlagValue(dashboardAssignment, '--dashboard');
+            continue;
+        }
+        const specAssignment = parseFlagAssignment(arg, '--spec');
+        if (specAssignment !== null) {
+            specPath = parseSpecPath(specAssignment);
+            continue;
+        }
+        const viewAssignment = parseFlagAssignment(arg, '--view');
+        if (viewAssignment !== null) {
+            viewPaths.push(parseSpecPath(viewAssignment));
+            continue;
+        }
+        if (arg === '--dashboard') {
+            dashboardId = parseRequiredFlagValue(parsed.remaining[index + 1], '--dashboard');
+            index += 1;
+            continue;
+        }
+        if (arg === '--spec') {
+            specPath = parseSpecPath(parsed.remaining[index + 1]);
+            index += 1;
+            continue;
+        }
+        if (arg === '--view') {
+            viewPaths.push(parseSpecPath(parsed.remaining[index + 1]));
+            index += 1;
+            continue;
+        }
+        if (arg === '--dry-run') {
+            dryRun = true;
+            continue;
+        }
+        throw new TenderCliUsageError(`Unknown app db resources create option: ${arg}`);
+    }
+    if (!dashboardId) {
+        throw new TenderCliUsageError('--dashboard is required. Example: tender app db resources create artifact_123 --dashboard app_db_dashboard_123 --spec resource.json --json');
+    }
+    if (!specPath) {
+        throw new TenderCliUsageError('--spec is required. Example: tender app db resources create artifact_123 --dashboard app_db_dashboard_123 --spec resource.json --json');
+    }
+    return { command: 'app db resources create', artifactId, dashboardId, specPath, viewPaths, dryRun, ...parsed };
+}
+function parseDbWidgetsCreateArgs(args) {
+    if (args.includes('--help') || args.includes('-h')) {
+        return { command: 'help', topic: 'app db widgets create' };
+    }
+    const artifactId = args[0];
+    if (!artifactId || artifactId.startsWith('-')) {
+        throw new TenderCliUsageError('app id is required. Example: tender app db widgets create <app-id> --dashboard app_db_dashboard_123 --title "Total signups" --spec widget.json --json');
+    }
+    const parsed = parseDbCommonArgs(args, 1);
+    let dashboardId = null;
+    let title = null;
+    let specPath = null;
+    let dryRun = false;
+    for (let index = 0; index < parsed.remaining.length; index += 1) {
+        const arg = parsed.remaining[index];
+        const dashboardAssignment = parseFlagAssignment(arg, '--dashboard');
+        if (dashboardAssignment !== null) {
+            dashboardId = parseRequiredFlagValue(dashboardAssignment, '--dashboard');
+            continue;
+        }
+        const titleAssignment = parseFlagAssignment(arg, '--title');
+        if (titleAssignment !== null) {
+            title = parseRequiredFlagValue(titleAssignment, '--title');
+            continue;
+        }
+        const specAssignment = parseFlagAssignment(arg, '--spec');
+        if (specAssignment !== null) {
+            specPath = parseSpecPath(specAssignment);
+            continue;
+        }
+        if (arg === '--dashboard') {
+            dashboardId = parseRequiredFlagValue(parsed.remaining[index + 1], '--dashboard');
+            index += 1;
+            continue;
+        }
+        if (arg === '--title') {
+            title = parseRequiredFlagValue(parsed.remaining[index + 1], '--title');
+            index += 1;
+            continue;
+        }
+        if (arg === '--spec') {
+            specPath = parseSpecPath(parsed.remaining[index + 1]);
+            index += 1;
+            continue;
+        }
+        if (arg === '--dry-run') {
+            dryRun = true;
+            continue;
+        }
+        throw new TenderCliUsageError(`Unknown app db widgets create option: ${arg}`);
+    }
+    if (!dashboardId) {
+        throw new TenderCliUsageError('--dashboard is required. Example: tender app db widgets create artifact_123 --dashboard app_db_dashboard_123 --title "Total signups" --spec widget.json --json');
+    }
+    if (!title) {
+        throw new TenderCliUsageError('--title is required. Example: tender app db widgets create artifact_123 --dashboard app_db_dashboard_123 --title "Total signups" --spec widget.json --json');
+    }
+    if (!specPath) {
+        throw new TenderCliUsageError('--spec is required. Example: tender app db widgets create artifact_123 --dashboard app_db_dashboard_123 --title "Total signups" --spec widget.json --json');
+    }
+    return { command: 'app db widgets create', artifactId, dashboardId, title, specPath, dryRun, ...parsed };
+}
 const AGENT_HEARTBEAT_SOURCE_VALUES = new Set(['codex', 'claude-code', 'tender-cli', 'git', 'other']);
 const AGENT_HEARTBEAT_STATUS_VALUES = new Set(['connected', 'working', 'waiting_for_user', 'needs_attention']);
 const AGENT_HEARTBEAT_PHASE_VALUES = new Set([
@@ -5526,7 +6073,7 @@ function parseTenderArgs(args) {
             return parseContextRefreshArgs(resourceArgs.slice(3));
         }
         if (resourceArgs[1] === 'agent' && (resourceArgs[2] === undefined || resourceArgs[2] === '--help' || resourceArgs[2] === '-h')) {
-            return { command: 'help', topic: 'app agent heartbeat' };
+            return { command: 'help', topic: 'app agent' };
         }
         if (resourceArgs[1] === 'agent' && resourceArgs[2] === 'heartbeat') {
             return parseAgentHeartbeatArgs(resourceArgs.slice(3));
@@ -5576,6 +6123,9 @@ function parseTenderArgs(args) {
         if (resourceArgs[1] === 'analytics' && resourceArgs[2] === 'dashboards') {
             return parseAnalyticsDashboardsArgs(resourceArgs.slice(3));
         }
+        if (resourceArgs[1] === 'analytics' && resourceArgs[2] === 'provision') {
+            return parseAnalyticsProvisionArgs(resourceArgs.slice(3));
+        }
         if (resourceArgs[1] === 'analytics' &&
             resourceArgs[2] === 'properties' &&
             (resourceArgs[3] === undefined || resourceArgs[3] === '--help' || resourceArgs[3] === '-h')) {
@@ -5633,6 +6183,31 @@ function parseTenderArgs(args) {
         if (resourceArgs[1] === 'db' && resourceArgs[2] === 'query') {
             return parseDbQueryArgs(resourceArgs.slice(3));
         }
+        if (resourceArgs[1] === 'db' && resourceArgs[2] === 'dashboards' && resourceArgs[3] === 'render') {
+            return parseDbDashboardsRenderArgs(resourceArgs.slice(4));
+        }
+        if (resourceArgs[1] === 'db' && resourceArgs[2] === 'dashboards') {
+            return parseDbDashboardsArgs(resourceArgs.slice(3));
+        }
+        if (resourceArgs[1] === 'db' &&
+            resourceArgs[2] === 'resources' &&
+            (resourceArgs[3] === undefined || resourceArgs[3] === '--help' || resourceArgs[3] === '-h')) {
+            return { command: 'help', topic: 'app db resources create' };
+        }
+        if (resourceArgs[1] === 'db' && resourceArgs[2] === 'resources' && resourceArgs[3] === 'suggest') {
+            return parseDbResourcesSuggestArgs(resourceArgs.slice(4));
+        }
+        if (resourceArgs[1] === 'db' && resourceArgs[2] === 'resources' && resourceArgs[3] === 'create') {
+            return parseDbResourcesCreateArgs(resourceArgs.slice(4));
+        }
+        if (resourceArgs[1] === 'db' &&
+            resourceArgs[2] === 'widgets' &&
+            (resourceArgs[3] === undefined || resourceArgs[3] === '--help' || resourceArgs[3] === '-h')) {
+            return { command: 'help', topic: 'app db widgets create' };
+        }
+        if (resourceArgs[1] === 'db' && resourceArgs[2] === 'widgets' && resourceArgs[3] === 'create') {
+            return parseDbWidgetsCreateArgs(resourceArgs.slice(4));
+        }
         if (resourceArgs[1] === 'db') {
             throw new TenderCliUsageError(`Unknown app db command: ${resourceArgs[2]}`);
         }
@@ -6074,6 +6649,66 @@ async function requestDbApi(input) {
     }
     return payload;
 }
+function appDbDashboardApiSuffix(input) {
+    if (input.path === 'dashboards') {
+        return '';
+    }
+    if (input.path === 'suggest') {
+        return '/suggest';
+    }
+    if (!input.dashboardId) {
+        throw new TenderCliUsageError('--dashboard is required.');
+    }
+    if (input.path === 'dashboard') {
+        return `/${encodeURIComponent(input.dashboardId)}`;
+    }
+    if (input.path === 'resources') {
+        return `/${encodeURIComponent(input.dashboardId)}/resources`;
+    }
+    if (input.path === 'resourceQuery') {
+        if (!input.resourceId) {
+            throw new TenderCliUsageError('--resource is required.');
+        }
+        return `/${encodeURIComponent(input.dashboardId)}/resources/${encodeURIComponent(input.resourceId)}/query`;
+    }
+    if (input.path === 'widgets') {
+        return `/${encodeURIComponent(input.dashboardId)}/widgets`;
+    }
+    if (!input.widgetId) {
+        throw new TenderCliUsageError('--widget is required.');
+    }
+    return `/${encodeURIComponent(input.dashboardId)}/widgets/${encodeURIComponent(input.widgetId)}/query`;
+}
+async function requestAppDbDashboardApi(input) {
+    const suffix = appDbDashboardApiSuffix(input);
+    const response = await input.fetcher(`${input.baseUrl}/api/v1/artifacts/${encodeURIComponent(input.artifactId)}/app-db-dashboards${suffix}`, {
+        method: input.method,
+        headers: {
+            authorization: `Bearer ${input.token}`,
+            accept: 'application/json',
+            ...(input.body === undefined ? {} : { 'content-type': 'application/json' }),
+        },
+        body: input.body === undefined ? undefined : JSON.stringify(input.body),
+    });
+    const payload = await parseJsonResponse(response);
+    if (!response.ok || !payload?.ok) {
+        const reasonCode = (typeof payload?.reasonCode === 'string' && payload.reasonCode) || `http_${response.status}`;
+        const message = (typeof payload?.message === 'string' && payload.message) ||
+            (typeof payload?.reasonCode === 'string' && payload.reasonCode) ||
+            `App database dashboard request failed with HTTP ${response.status}.`;
+        const example = appDbDashboardCorrectedExample(input.artifactId, input.path);
+        throw new TenderCliDbApiError([
+            message,
+            `Scope: artifact ${input.artifactId}, app-db-dashboards.`,
+            `Reason: ${reasonCode}.`,
+            `Example: ${example}.`,
+        ].join('\n'), reasonCode, {
+            artifactId: input.artifactId,
+            surface: 'db/dashboards',
+        }, example);
+    }
+    return payload;
+}
 function encodePathSegments(filePath) {
     return filePath.split('/').map(encodeURIComponent).join('/');
 }
@@ -6115,6 +6750,21 @@ function dbCorrectedExample(artifactId, dbPath) {
     }
     return `tender app db query ${artifactId} --env published --sql "select * from <table-name> limit 20" --json`;
 }
+function appDbDashboardCorrectedExample(artifactId, path) {
+    if (path === 'suggest') {
+        return `tender app db resources suggest ${artifactId} --env published --json`;
+    }
+    if (path === 'dashboard' || path === 'resourceQuery' || path === 'widgetQuery') {
+        return `tender app db dashboards render ${artifactId} --dashboard app_db_dashboard_123 --env published --json`;
+    }
+    if (path === 'resources') {
+        return `tender app db resources create ${artifactId} --dashboard app_db_dashboard_123 --spec resource.json --json`;
+    }
+    if (path === 'widgets') {
+        return `tender app db widgets create ${artifactId} --dashboard app_db_dashboard_123 --title "Total signups" --spec widget.json --json`;
+    }
+    return `tender app db dashboards ${artifactId} --json`;
+}
 function analyticsCorrectedExample(artifactId, analyticsPath) {
     if (analyticsPath === 'capabilities') {
         return `tender app analytics capabilities ${artifactId} --include-catalog --range 30d --json`;
@@ -9529,6 +10179,310 @@ async function runDbQuery(command, io, runtime) {
     ]);
     return 0;
 }
+async function runDbDashboards(command, io, runtime) {
+    if (command.name && command.dryRun) {
+        const payload = {
+            ok: true,
+            dryRun: true,
+            artifactId: command.artifactId,
+            request: {
+                name: command.name,
+                defaultEnvironment: command.defaultEnvironment ?? 'published',
+            },
+        };
+        printDbPayload(command, io, payload, [`app_id: ${command.artifactId}`, `name: ${command.name}`, 'dry_run: true']);
+        return 0;
+    }
+    const credentials = await resolveDbCredentials(command, runtime);
+    const payload = await requestAppDbDashboardApi({
+        artifactId: command.artifactId,
+        path: 'dashboards',
+        method: command.name ? 'POST' : 'GET',
+        baseUrl: credentials.baseUrl,
+        token: credentials.token,
+        fetcher: runtime.fetcher ?? fetch,
+        body: command.name
+            ? {
+                name: command.name,
+                defaultEnvironment: command.defaultEnvironment ?? 'published',
+            }
+            : undefined,
+    });
+    const dashboards = Array.isArray(payload.dashboards) ? payload.dashboards : [];
+    printDbPayload(command, io, payload, [
+        `app_id: ${command.artifactId}`,
+        command.name
+            ? `dashboard_id: ${String(payload.dashboard?.id ?? '')}`
+            : `dashboards: ${dashboards.length}`,
+    ]);
+    return 0;
+}
+function isAppDbRecord(value) {
+    return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+}
+function appDbRecordArray(value) {
+    return Array.isArray(value) ? value.filter(isAppDbRecord) : [];
+}
+function appDbStringField(record, field) {
+    const value = record[field];
+    return typeof value === 'string' && value.trim() ? value : null;
+}
+function appDbResourcePageSize(resource) {
+    const spec = isAppDbRecord(resource.spec) ? resource.spec : null;
+    const pageSize = spec && typeof spec.pageSize === 'number' && Number.isInteger(spec.pageSize) ? spec.pageSize : 50;
+    return Math.min(Math.max(pageSize, 1), 50);
+}
+function appDbDateRangeDays(value) {
+    if (value === 'last_7_days') {
+        return 7;
+    }
+    if (value === 'last_90_days') {
+        return 90;
+    }
+    return 30;
+}
+function appDbDashboardDateRangeRequest(dashboard, now) {
+    const spec = isAppDbRecord(dashboard.spec) ? dashboard.spec : {};
+    const controls = isAppDbRecord(spec.controls) ? spec.controls : {};
+    const dateRange = isAppDbRecord(controls.dateRange) ? controls.dateRange : {};
+    const enabled = dateRange.enabled === undefined ? true : dateRange.enabled === true;
+    const defaultRange = dateRange.defaultRange ?? 'last_30_days';
+    if (enabled &&
+        isAppDbRecord(defaultRange) &&
+        defaultRange.type === 'fixed' &&
+        (typeof defaultRange.start === 'string' || typeof defaultRange.start === 'number') &&
+        (typeof defaultRange.end === 'string' || typeof defaultRange.end === 'number')) {
+        return { start: defaultRange.start, end: defaultRange.end };
+    }
+    const preset = typeof defaultRange === 'string' ? defaultRange : 'last_30_days';
+    if (!enabled || preset === 'all_time') {
+        return null;
+    }
+    const end = new Date(now);
+    const start = new Date(end);
+    start.setDate(start.getDate() - (appDbDateRangeDays(preset) - 1));
+    return {
+        start: start.toISOString().slice(0, 10),
+        end: end.toISOString().slice(0, 10),
+    };
+}
+async function runDbResourcesSuggest(command, io, runtime) {
+    const credentials = await resolveDbCredentials(command, runtime);
+    const payload = await requestAppDbDashboardApi({
+        artifactId: command.artifactId,
+        path: 'suggest',
+        method: 'POST',
+        baseUrl: credentials.baseUrl,
+        token: credentials.token,
+        fetcher: runtime.fetcher ?? fetch,
+        body: { environment: command.environment },
+    });
+    const resources = Array.isArray(payload.resources) ? payload.resources : [];
+    printDbPayload(command, io, payload, [
+        `app_id: ${command.artifactId}`,
+        `environment: ${command.environment}`,
+        `suggested_resources: ${resources.length}`,
+    ]);
+    return 0;
+}
+async function runDbDashboardsRender(command, io, runtime) {
+    const credentials = await resolveDbCredentials(command, runtime);
+    const dashboardPayload = await requestAppDbDashboardApi({
+        artifactId: command.artifactId,
+        path: 'dashboard',
+        dashboardId: command.dashboardId,
+        method: 'GET',
+        baseUrl: credentials.baseUrl,
+        token: credentials.token,
+        fetcher: runtime.fetcher ?? fetch,
+    });
+    const dashboard = isAppDbRecord(dashboardPayload.dashboard) ? dashboardPayload.dashboard : {};
+    const dateRange = appDbDashboardDateRangeRequest(dashboard, runtime.now ? runtime.now() : Date.now());
+    const resources = appDbRecordArray(dashboard.resources).slice(0, 6);
+    const widgets = appDbRecordArray(dashboard.widgets).slice(0, 12);
+    const resourceResults = [];
+    for (const resource of resources) {
+        const resourceId = appDbStringField(resource, 'id');
+        if (!resourceId) {
+            continue;
+        }
+        const views = [
+            { viewId: null, name: 'Default' },
+            ...appDbRecordArray(resource.views)
+                .slice(0, 4)
+                .map((view) => ({
+                viewId: appDbStringField(view, 'id'),
+                name: appDbStringField(view, 'name') ?? 'Saved view',
+            }))
+                .filter((view) => view.viewId !== null),
+        ];
+        const viewResults = [];
+        for (const view of views) {
+            const result = await requestAppDbDashboardApi({
+                artifactId: command.artifactId,
+                path: 'resourceQuery',
+                dashboardId: command.dashboardId,
+                resourceId,
+                method: 'POST',
+                baseUrl: credentials.baseUrl,
+                token: credentials.token,
+                fetcher: runtime.fetcher ?? fetch,
+                body: {
+                    environment: command.environment,
+                    ...(view.viewId ? { viewId: view.viewId } : {}),
+                    ...(dateRange ? { dateRange } : {}),
+                    limit: appDbResourcePageSize(resource),
+                    offset: 0,
+                },
+            });
+            viewResults.push({
+                viewId: view.viewId,
+                name: view.name,
+                result,
+            });
+        }
+        resourceResults.push({
+            resourceId,
+            label: appDbStringField(resource, 'label') ?? resourceId,
+            views: viewResults,
+        });
+    }
+    const widgetResults = [];
+    for (const widget of widgets) {
+        const widgetId = appDbStringField(widget, 'id');
+        if (!widgetId) {
+            continue;
+        }
+        const spec = isAppDbRecord(widget.spec) ? widget.spec : null;
+        const specLimit = spec && typeof spec.limit === 'number' && Number.isInteger(spec.limit) ? spec.limit : 20;
+        const result = await requestAppDbDashboardApi({
+            artifactId: command.artifactId,
+            path: 'widgetQuery',
+            dashboardId: command.dashboardId,
+            widgetId,
+            method: 'POST',
+            baseUrl: credentials.baseUrl,
+            token: credentials.token,
+            fetcher: runtime.fetcher ?? fetch,
+            body: {
+                environment: command.environment,
+                ...(dateRange ? { dateRange } : {}),
+                limit: Math.min(Math.max(specLimit, 1), 50),
+                offset: 0,
+            },
+        });
+        widgetResults.push({
+            widgetId,
+            title: appDbStringField(widget, 'title') ?? widgetId,
+            result,
+        });
+    }
+    const payload = {
+        ok: true,
+        artifactId: command.artifactId,
+        environment: command.environment,
+        dashboard,
+        resources: resourceResults,
+        widgets: widgetResults,
+    };
+    printDbPayload(command, io, payload, [
+        `app_id: ${command.artifactId}`,
+        `dashboard_id: ${command.dashboardId}`,
+        `environment: ${command.environment}`,
+        `resources_rendered: ${resourceResults.length}`,
+        `widgets_rendered: ${widgetResults.length}`,
+    ]);
+    return 0;
+}
+async function readJsonSpecFile(input) {
+    return readAnalyticsSpec({
+        specPath: input.specPath,
+        stdin: input.stdin,
+    });
+}
+async function runDbResourcesCreate(command, io, runtime) {
+    const spec = await readJsonSpecFile({
+        specPath: command.specPath,
+        stdin: runtime.stdin,
+    });
+    const views = [];
+    for (const viewPath of command.viewPaths) {
+        views.push({
+            spec: await readJsonSpecFile({
+                specPath: viewPath,
+                stdin: runtime.stdin,
+            }),
+        });
+    }
+    const body = {
+        spec,
+        ...(views.length > 0 ? { views } : {}),
+    };
+    if (command.dryRun) {
+        printDbPayload(command, io, {
+            ok: true,
+            dryRun: true,
+            artifactId: command.artifactId,
+            dashboardId: command.dashboardId,
+            request: body,
+        }, [`app_id: ${command.artifactId}`, `dashboard_id: ${command.dashboardId}`, 'dry_run: true']);
+        return 0;
+    }
+    const credentials = await resolveDbCredentials(command, runtime);
+    const payload = await requestAppDbDashboardApi({
+        artifactId: command.artifactId,
+        path: 'resources',
+        dashboardId: command.dashboardId,
+        method: 'POST',
+        baseUrl: credentials.baseUrl,
+        token: credentials.token,
+        fetcher: runtime.fetcher ?? fetch,
+        body,
+    });
+    printDbPayload(command, io, payload, [
+        `app_id: ${command.artifactId}`,
+        `dashboard_id: ${command.dashboardId}`,
+        `resource_id: ${String(payload.resource?.id ?? '')}`,
+    ]);
+    return 0;
+}
+async function runDbWidgetsCreate(command, io, runtime) {
+    const spec = await readJsonSpecFile({
+        specPath: command.specPath,
+        stdin: runtime.stdin,
+    });
+    const body = {
+        title: command.title,
+        spec,
+    };
+    if (command.dryRun) {
+        printDbPayload(command, io, {
+            ok: true,
+            dryRun: true,
+            artifactId: command.artifactId,
+            dashboardId: command.dashboardId,
+            request: body,
+        }, [`app_id: ${command.artifactId}`, `dashboard_id: ${command.dashboardId}`, `title: ${command.title}`, 'dry_run: true']);
+        return 0;
+    }
+    const credentials = await resolveDbCredentials(command, runtime);
+    const payload = await requestAppDbDashboardApi({
+        artifactId: command.artifactId,
+        path: 'widgets',
+        dashboardId: command.dashboardId,
+        method: 'POST',
+        baseUrl: credentials.baseUrl,
+        token: credentials.token,
+        fetcher: runtime.fetcher ?? fetch,
+        body,
+    });
+    printDbPayload(command, io, payload, [
+        `app_id: ${command.artifactId}`,
+        `dashboard_id: ${command.dashboardId}`,
+        `widget_id: ${String(payload.widget?.id ?? '')}`,
+    ]);
+    return 0;
+}
 async function runAnalyticsSummary(command, io, runtime) {
     const credentials = await resolveAnalyticsCredentials(command, runtime);
     const payload = await requestAnalyticsApi({
@@ -10150,6 +11104,9 @@ export async function runTenderCli(args, io = {
             else if (command.topic === 'app preview watch') {
                 io.stdout(previewWatchHelp());
             }
+            else if (command.topic === 'app agent') {
+                io.stdout(appAgentHelp());
+            }
             else if (command.topic === 'app agent heartbeat') {
                 io.stdout(agentHeartbeatHelp());
             }
@@ -10189,6 +11146,9 @@ export async function runTenderCli(args, io = {
             else if (command.topic === 'app analytics dashboards') {
                 io.stdout(analyticsDashboardsHelp());
             }
+            else if (command.topic === 'app analytics provision') {
+                io.stdout(analyticsProvisionHelp());
+            }
             else if (command.topic === 'app analytics export') {
                 io.stdout(analyticsExportHelp());
             }
@@ -10234,6 +11194,21 @@ export async function runTenderCli(args, io = {
             else if (command.topic === 'app db query') {
                 io.stdout(dbQueryHelp());
             }
+            else if (command.topic === 'app db dashboards') {
+                io.stdout(dbDashboardsHelp());
+            }
+            else if (command.topic === 'app db dashboards render') {
+                io.stdout(dbDashboardsRenderHelp());
+            }
+            else if (command.topic === 'app db resources suggest') {
+                io.stdout(dbResourcesSuggestHelp());
+            }
+            else if (command.topic === 'app db resources create') {
+                io.stdout(dbResourcesCreateHelp());
+            }
+            else if (command.topic === 'app db widgets create') {
+                io.stdout(dbWidgetsCreateHelp());
+            }
             else if (command.topic === 'app') {
                 io.stdout(appHelp());
             }
@@ -10383,6 +11358,9 @@ export async function runTenderCli(args, io = {
         if (command.command === 'app analytics dashboards') {
             return await runAnalyticsDashboards(command, io, runtime);
         }
+        if (command.command === 'app analytics provision') {
+            return runAnalyticsProvision(command, io);
+        }
         if (command.command === 'app analytics export catalog') {
             return await runAnalyticsExportCatalog(command, io, runtime);
         }
@@ -10422,6 +11400,21 @@ export async function runTenderCli(args, io = {
         if (command.command === 'app db query') {
             return await runDbQuery(command, io, runtime);
         }
+        if (command.command === 'app db dashboards') {
+            return await runDbDashboards(command, io, runtime);
+        }
+        if (command.command === 'app db resources suggest') {
+            return await runDbResourcesSuggest(command, io, runtime);
+        }
+        if (command.command === 'app db dashboards render') {
+            return await runDbDashboardsRender(command, io, runtime);
+        }
+        if (command.command === 'app db resources create') {
+            return await runDbResourcesCreate(command, io, runtime);
+        }
+        if (command.command === 'app db widgets create') {
+            return await runDbWidgetsCreate(command, io, runtime);
+        }
         if (command.command === 'app git remote') {
             return await runGitRemote(command, io, runtime);
         }
@@ -10450,6 +11443,8 @@ export function shouldReadEntrypointStdin(args) {
         ((args[1] === 'git' && args[2] === 'credential') ||
             (args[1] === 'analytics' && hasFlagValue(args, '--spec', '-')) ||
             (args[1] === 'agent' && args[2] === 'heartbeat' && hasFlagValue(args, '--input', '-')) ||
+            (args[1] === 'db' && (args[2] === 'resources' || args[2] === 'widgets') && hasFlagValue(args, '--spec', '-')) ||
+            (args[1] === 'db' && args[2] === 'resources' && hasFlagValue(args, '--view', '-')) ||
             (args[1] === 'db' && args[2] === 'query' && hasFlagValue(args, '--file', '-'))));
 }
 async function readEntrypointStdin() {