@tenderprompt/cli 0.1.5 → 0.1.7

package/README.md

@@ -16,15 +16,41 @@ npm install -g @tenderprompt/cli
 Then run:
 
 ```bash
-tender --help
+tender capabilities --json
 ```
 
+## What You Can Do
+
+Use the CLI to work with Tender Apps from a local checkout or coding-agent
+session:
+
+- sign in with a bounded device token and optional artifact scope
+- list, create, and rename apps
+- bootstrap a local app checkout with Tender project context
+- configure the Tender artifact Git remote and credential helper
+- discover the current CLI command surface with `tender capabilities --json`
+- preview outbound HTTP binding files without writing them
+- validate app source locally before pushing
+- build and preview a commit through the Tender API
+- publish only after a dry run or explicit `--confirm publish`
+- inspect artifact-scoped analytics without SQL or platform credentials
+- run server-validated chart specs and export aggregate rows
+- generate starter analytics suggestions
+- create saved analytics dashboards and charts, with `--dry-run` available for
+  write previews
+
+The CLI is deterministic by design: every workflow has a non-interactive flag
+path, supports `--json` where automation needs structured output, and avoids
+interactive prompts unless the command is explicitly an auth flow.
+
 ## Typical Flow
 
 ```bash
+tender capabilities --json
+
 tender auth login --device --profile edit-preview --artifact artifact_123 --ttl 7d
 
-tender app git setup artifact_123 --dir ./widget
+tender app init artifact_123 --dir ./widget --json
 
 cd ./widget
 npm run check
@@ -35,6 +61,16 @@ tender app preview artifact_123 --commit "$(git rev-parse HEAD)" --stream --json
 tender app publish artifact_123 --commit "$(git rev-parse HEAD)" --confirm publish --stream --json
 ```
 
+For agents, keep the pattern simple:
+
+1. start with `tender capabilities --json`
+2. use `tender app init` to clone/bootstrap an existing app checkout
+3. inspect and edit files locally
+4. run `tender app doctor` and local project checks
+5. push source with Git
+6. call `preview`, `publish --dry-run`, then `publish --confirm publish` only
+   when the user asked to publish
+
 ## Auth
 
 Use the device login flow to mint a local token:
@@ -71,10 +107,12 @@ indexing the accepted commit after upstream Git accepts the push.
 ## Useful Commands
 
 ```bash
+tender capabilities --json
 tender app list --json
 tender app create --name "Exit Intent Widget" --json
 tender app update artifact_123 --name "Sale Widget" --json
 tender app init artifact_123 --dir ./widget --json
+tender app bindings outbound --id shopify --host admin.shopify.com --dry-run --json
 tender app context status artifact_123 --dir ./widget --json
 tender app doctor --dir ./widget --json
 tender app validate artifact_123 --json
@@ -83,6 +121,64 @@ tender app preview artifact_123 --commit "$(git rev-parse HEAD)" --stream --json
 tender app publish artifact_123 --dry-run --json
 ```
 
+## Analytics
+
+Analytics commands are artifact-scoped and go through Tender's server-side
+validation. The CLI never exposes raw query credentials, raw SQL, or cross-app
+data.
+
+Start with capabilities. This is the self-documenting entrypoint for coding
+agents:
+
+```bash
+tender app analytics capabilities artifact_123 --include-catalog --range 30d --json
+```
+
+That response tells the agent:
+
+- which analytics commands are supported
+- the safe chart-spec shape
+- retention, range, quota, and security limits
+- existing saved dashboards and charts
+- bounded observed event names, request paths, property keys, rough types, and
+  counts from artifact-scoped catalog samples
+
+Common read-only commands:
+
+```bash
+tender app analytics summary artifact_123 --range 30d --json
+
+tender app analytics query artifact_123 --spec chart.json --json
+
+tender app analytics query artifact_123 --spec - --json < chart.json
+
+tender app analytics export catalog artifact_123 --range 30d --json
+
+tender app analytics export query artifact_123 --spec chart.json --format csv
+
+tender app analytics suggestions artifact_123 --range 30d --json
+```
+
+Safe write previews:
+
+```bash
+tender app analytics dashboards artifact_123 --create "Agent dashboard" --dry-run --json
+
+tender app analytics charts create artifact_123 \
+  --dashboard analytics_dashboard_123 \
+  --title "Signup funnel" \
+  --spec funnel.json \
+  --dry-run \
+  --json
+```
+
+Real saved-dashboard writes use the same commands without `--dry-run`.
+
+Agents should combine `capabilities --include-catalog` with local source-code
+inspection. For example, inspect where the app calls
+`__TP_ANALYTICS.invoke(...)`, propose a chart spec, validate it with
+`analytics query`, and only then create a saved chart.
+
 ## Safety Model
 
 - Local agents run in the user's environment, not in Tender.
@@ -93,6 +189,10 @@ tender app publish artifact_123 --dry-run --json
 - `tender app publish` requires `--dry-run` or `--confirm publish`.
 - Tokens are stored outside the project checkout and are not written into Git
   remote URLs.
+- Analytics commands use tenant/artifact-scoped API routes. They do not expose
+  raw query credentials or raw SQL.
+- Raw analytics event export is intentionally not available; exports are bounded
+  catalog metadata or validated aggregate query rows.
 
 ## Related Package
 

package/dist/index.js

@@ -20,6 +20,8 @@ function rootHelp() {
     return `Usage: tender <command> [options]
 
 Commands:
+  tender capabilities --json
+                             Describe the CLI command surface for coding agents
   tender auth login --device
                              Authorize this machine with a browser-approved device flow
   tender auth status         Show whether a Tender API token is available
@@ -58,6 +60,8 @@ Commands:
                              Report whether managed context is stale
   tender app context refresh <app-id>
                              Refresh managed context files
+  tender app bindings outbound --id <id> --host <host> --dry-run
+                             Preview files for an outbound HTTP binding
   tender app git setup <app-id>
                              Configure a checkout to push to the app remote
   tender app doctor          Validate a local Tender App checkout
@@ -68,6 +72,7 @@ Compatibility:
   tender artifacts ...       Legacy alias for Tender App commands
 
 Examples:
+  tender capabilities --json
   tender auth login --device --profile edit-preview --artifact artifact_123 --ttl 7d
   tender auth status --json
   tender app list --json
@@ -86,6 +91,7 @@ Examples:
   tender app context fetch artifact_123 --dir ./widget --dry-run --json
   tender app context status artifact_123 --dir ./widget --json
   tender app context refresh artifact_123 --dir ./widget --dry-run --json
+  tender app bindings outbound --id shopify --host admin.shopify.com --dry-run --json
   tender app git setup artifact_123 --dir ./widget --json
   tender app doctor --dir ./widget
   tender app generate-env-types --dir ./widget --json
@@ -175,6 +181,8 @@ Commands:
                              Show managed context freshness for a checkout
   tender app context refresh <app-id>
                              Refresh managed context files in a checkout
+  tender app bindings outbound --id <id> --host <host> --dry-run
+                             Preview files for an outbound HTTP binding
   tender app git setup <app-id>
                              Configure the tender Git remote and credential helper
   tender app doctor          Validate local context, TypeScript scaffold, and Tender App rules
@@ -205,6 +213,7 @@ Examples:
   tender app context fetch artifact_123 --dir ./widget --dry-run --json
   tender app context status artifact_123 --dir ./widget --json
   tender app context refresh artifact_123 --dir ./widget --dry-run --json
+  tender app bindings outbound --id shopify --host admin.shopify.com --dry-run --json
   tender app git setup artifact_123 --dir ./widget --json
   tender app doctor --dir ./widget
   tender app generate-env-types --dir ./widget --json
@@ -217,6 +226,15 @@ function artifactsHelp() {
 Legacy alias:
   tender artifacts ... continues to work for existing automation. Prefer tender app ... for new workflows.`;
 }
+function capabilitiesHelp() {
+    return `Usage: tender capabilities [--json]
+
+Describes the Tender CLI surface for coding agents. Use this first instead of
+copying long command lists into skill prompts.
+
+Examples:
+  tender capabilities --json`;
+}
 function analyticsHelp() {
     return `Usage: tender app analytics <command> <app-id> [options]
 
@@ -441,6 +459,26 @@ Examples:
   tender app generate-env-types --dir ./widget
   tender app generate-env-types --dir ./widget --json`;
 }
+function bindingsOutboundHelp() {
+    return `Usage: tender app bindings outbound --id <id> --host <host> --dry-run [--name <ENV_NAME>] [--label <label>] [--interface <TypeName>] [--json]
+
+Preview the file shape for an outbound HTTP binding. App server code cannot call
+third-party internet URLs directly; external APIs, OAuth/token exchanges,
+webhooks, and secrets must go through bindings.
+
+Options:
+  --id <id>              Binding id and directory name, for example shopify-api.
+  --host <host>          Explicit lowercase host without protocol, wildcard, path, query, or port.
+  --name <ENV_NAME>      App env binding name. Defaults to the id converted to UPPER_SNAKE.
+  --label <label>        Human label for app.json. Defaults to a title-cased id.
+  --interface <TypeName> TypeScript interface and worker class name. Defaults to a PascalCase id plus Binding.
+  --dry-run              Required. Prints files and app.json binding entry without writing.
+  --json                 Emit stable JSON for coding agents.
+
+Examples:
+  tender app bindings outbound --id shopify --host admin.shopify.com --dry-run --json
+  tender app bindings outbound --id yotpo-api --host api.yotpo.com --name YOTPO --label "Yotpo API" --dry-run --json`;
+}
 function gitRemoteHelp() {
     return `Usage: tender app git remote <app-id> [--base-url <url>] [--token <token>] [--profile <name>] [--ttl <7d|14d|30d>] [--json]
 
@@ -605,6 +643,149 @@ Options:
 Examples:
   tender app publish watch artifact_123 --job job_123 --stream --json`;
 }
+function tenderCliCapabilities() {
+    return {
+        ok: true,
+        surface: "tender_cli",
+        description: "Agent-safe Tender App source, lifecycle, analytics, and local scaffold controls.",
+        discovery: {
+            primary: "tender capabilities --json",
+            layeredHelp: [
+                "tender --help",
+                "tender auth --help",
+                "tender app --help",
+                "tender app analytics --help",
+                "tender app bindings outbound --help",
+            ],
+        },
+        workflows: [
+            {
+                name: "authenticate",
+                when: "Before reading or changing remote Tender App records.",
+                commands: [
+                    "tender auth status --json",
+                    "tender auth login --device --profile edit-preview --artifact <artifact-id> --ttl 7d --json",
+                ],
+            },
+            {
+                name: "clone_or_bootstrap_existing_app",
+                when: "When the user wants to download or work on an existing app locally.",
+                commands: [
+                    "tender app init <artifact-id> --dir <dir> --dry-run --json",
+                    "tender app init <artifact-id> --dir <dir> --json",
+                ],
+                notes: [
+                    "init is the normal clone/bootstrap command.",
+                    "If the app already has artifact Git source, init fetches it and configures the tender remote.",
+                    "If no artifact Git source exists yet, init writes managed context/scaffold files and configures the tender remote.",
+                    "Use context fetch only when you already have a checkout and only need AGENTS.md, skills, or Tender context refreshed.",
+                ],
+            },
+            {
+                name: "local_edit_preview_publish",
+                when: "When editing app source from a local checkout.",
+                commands: [
+                    "tender app doctor --dir <dir> --json",
+                    "tender app git setup <artifact-id> --dir <dir> --dry-run --json",
+                    "git push tender main",
+                    "tender app preview <artifact-id> --commit $(git rev-parse HEAD) --stream --json",
+                    "tender app publish <artifact-id> --dry-run --json",
+                    "tender app publish <artifact-id> --commit $(git rev-parse HEAD) --confirm publish --stream --json",
+                ],
+                notes: [
+                    "Publishing is production-facing and requires explicit user intent.",
+                ],
+            },
+            {
+                name: "analytics_agent_loop",
+                when: "When understanding app analytics or creating saved charts.",
+                commands: [
+                    "tender app analytics capabilities <artifact-id> --include-catalog --range 30d --json",
+                    "tender app analytics query <artifact-id> --spec chart.json --json",
+                    "tender app analytics export query <artifact-id> --spec chart.json --format csv",
+                    "tender app analytics dashboards <artifact-id> --create \"Agent dashboard\" --dry-run --json",
+                    "tender app analytics charts create <artifact-id> --dashboard <dashboard-id> --title <title> --spec chart.json --dry-run --json",
+                ],
+                notes: [
+                    "Combine CLI capabilities with local source inspection of analytics calls.",
+                    "Validate chart specs with query before saving charts.",
+                ],
+            },
+            {
+                name: "outbound_http_binding",
+                when: "When app code needs external APIs, OAuth/token exchange, webhooks, provider SDKs, or secrets.",
+                commands: [
+                    "tender app bindings outbound --id <id> --host <host> --dry-run --json",
+                    "tender app generate-env-types --dir <dir> --json",
+                    "tender app doctor --dir <dir> --json",
+                ],
+                notes: [
+                    "src/server.ts cannot call third-party internet URLs directly.",
+                    "Outbound calls are blocked unless they go through a binding with outbound:http and explicit allowedHosts.",
+                ],
+            },
+        ],
+        commands: [
+            {
+                command: "tender capabilities --json",
+                purpose: "Discover this CLI surface in a machine-readable shape.",
+                requiresAuth: false,
+                writes: false,
+            },
+            {
+                command: "tender app init <artifact-id> --dir <dir> --json",
+                purpose: "Clone/bootstrap an existing Tender App checkout and configure context plus the tender Git remote.",
+                requiresAuth: true,
+                writes: true,
+                dryRun: true,
+            },
+            {
+                command: "tender app context fetch <artifact-id> --dir <dir> --json",
+                purpose: "Fetch managed AGENTS.md, skills, and Tender context into an existing checkout.",
+                requiresAuth: true,
+                writes: true,
+                dryRun: true,
+            },
+            {
+                command: "tender app bindings outbound --id <id> --host <host> --dry-run --json",
+                purpose: "Preview app.json and binding files for an outbound HTTP integration.",
+                requiresAuth: false,
+                writes: false,
+            },
+            {
+                command: "tender app analytics capabilities <artifact-id> --include-catalog --range 30d --json",
+                purpose: "Discover artifact-scoped analytics commands, chart specs, saved dashboards, and bounded observed catalog.",
+                requiresAuth: true,
+                writes: false,
+            },
+        ],
+        security: [
+            "Prefer artifact-scoped device tokens.",
+            "Do not write Tender tokens into the project checkout.",
+            "Do not call Tender HTTP APIs directly from agent workflows.",
+            "Do not put third-party fetch calls in src/server.ts; use outbound bindings.",
+            "Do not request direct query credentials or raw SQL for analytics.",
+        ],
+    };
+}
+function runCapabilities(command, io) {
+    const payload = tenderCliCapabilities();
+    if (command.json) {
+        io.stdout(JSON.stringify(payload, null, 2));
+    }
+    else {
+        io.stdout([
+            "Tender CLI capabilities",
+            "",
+            "Start with:",
+            "  tender capabilities --json",
+            "",
+            "Useful next help topics:",
+            ...payload.discovery.layeredHelp.map((topic) => `  ${topic}`),
+        ].join("\n"));
+    }
+    return 0;
+}
 function normalizeBaseUrl(value) {
     return (value ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
 }
@@ -2071,6 +2252,127 @@ function parseRequiredFlagValue(value, flag) {
     }
     return value;
 }
+function parseCapabilitiesArgs(args) {
+    if (args.includes("--help") || args.includes("-h")) {
+        return { command: "help", topic: "capabilities" };
+    }
+    let json = false;
+    for (const arg of args) {
+        if (arg === "--json") {
+            json = true;
+            continue;
+        }
+        throw new TenderCliUsageError(`Unknown capabilities option: ${arg}`);
+    }
+    return { command: "capabilities", json };
+}
+function parseBindingId(value) {
+    if (!value || value.startsWith("-")) {
+        throw new TenderCliUsageError("--id requires a binding id.");
+    }
+    if (!/^[a-z][a-z0-9-]*$/.test(value)) {
+        throw new TenderCliUsageError("--id must start with a lowercase letter and contain only lowercase letters, numbers, and dashes. Example: shopify-api");
+    }
+    return value;
+}
+function parseAllowedHost(value) {
+    if (!value || value.startsWith("-")) {
+        throw new TenderCliUsageError("--host requires a hostname.");
+    }
+    if (value.length === 0 ||
+        value.includes("/") ||
+        value.includes(":") ||
+        value.includes("?") ||
+        value.includes("#") ||
+        value.includes("*") ||
+        value !== value.toLowerCase()) {
+        throw new TenderCliUsageError("--host must be an explicit lowercase hostname without protocol, wildcard, path, query, or port. Example: api.example.com");
+    }
+    return value;
+}
+function parseEnvBindingName(value) {
+    if (!value || value.startsWith("-")) {
+        throw new TenderCliUsageError("--name requires an env binding name.");
+    }
+    if (!/^[A-Z][A-Z0-9_]*$/.test(value)) {
+        throw new TenderCliUsageError("--name must be UPPER_SNAKE_CASE. Example: SHOPIFY_API");
+    }
+    return value;
+}
+function parseTypeName(value, flag) {
+    if (!value || value.startsWith("-")) {
+        throw new TenderCliUsageError(`${flag} requires a TypeScript type name.`);
+    }
+    if (!/^[A-Z][A-Za-z0-9]*$/.test(value)) {
+        throw new TenderCliUsageError(`${flag} must be a PascalCase TypeScript type name. Example: ShopifyApiBinding`);
+    }
+    return value;
+}
+function parseBindingsOutboundArgs(args) {
+    if (args.includes("--help") || args.includes("-h")) {
+        return { command: "help", topic: "artifacts bindings outbound" };
+    }
+    let id = null;
+    let host = null;
+    let name = null;
+    let label = null;
+    let interfaceName = null;
+    let dryRun = false;
+    let json = false;
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        if (arg === "--json") {
+            json = true;
+            continue;
+        }
+        if (arg === "--dry-run") {
+            dryRun = true;
+            continue;
+        }
+        if (arg === "--id") {
+            id = parseBindingId(args[index + 1]);
+            index += 1;
+            continue;
+        }
+        if (arg === "--host") {
+            host = parseAllowedHost(args[index + 1]);
+            index += 1;
+            continue;
+        }
+        if (arg === "--name") {
+            name = parseEnvBindingName(args[index + 1]);
+            index += 1;
+            continue;
+        }
+        if (arg === "--label") {
+            label = parseRequiredFlagValue(args[index + 1], "--label");
+            index += 1;
+            continue;
+        }
+        if (arg === "--interface") {
+            interfaceName = parseTypeName(args[index + 1], "--interface");
+            index += 1;
+            continue;
+        }
+        throw new TenderCliUsageError(`Unknown bindings outbound option: ${arg}`);
+    }
+    if (!id || !host) {
+        throw new TenderCliUsageError("--id and --host are required. Example: tender app bindings outbound --id shopify --host admin.shopify.com --dry-run --json");
+    }
+    if (!dryRun) {
+        throw new TenderCliUsageError("bindings outbound currently requires --dry-run. Example: tender app bindings outbound --id shopify --host admin.shopify.com --dry-run --json");
+    }
+    return {
+        command: "artifacts bindings outbound",
+        id,
+        host,
+        name,
+        label,
+        interfaceName,
+        dryRun,
+        json,
+    };
+}
 function parseAnalyticsCommonArgs(args, startIndex) {
     let baseUrl = null;
     let flagToken = null;
@@ -2359,6 +2661,9 @@ function parseTenderArgs(args) {
     if (args.length === 0 || args[0] === "--help" || args[0] === "-h") {
         return { command: "help", topic: "root" };
     }
+    if (args[0] === "capabilities") {
+        return parseCapabilitiesArgs(args.slice(1));
+    }
     if (args[0] === "auth") {
         if (args[1] === undefined || args[1] === "--help" || args[1] === "-h") {
             return { command: "help", topic: "auth" };
@@ -2406,6 +2711,15 @@ function parseTenderArgs(args) {
         if (resourceArgs[1] === "context" && resourceArgs[2] === "refresh") {
             return parseContextRefreshArgs(resourceArgs.slice(3));
         }
+        if (resourceArgs[1] === "bindings" && resourceArgs[2] === "outbound") {
+            return parseBindingsOutboundArgs(resourceArgs.slice(3));
+        }
+        if (resourceArgs[1] === "bindings" &&
+            (resourceArgs[2] === undefined ||
+                resourceArgs[2] === "--help" ||
+                resourceArgs[2] === "-h")) {
+            return { command: "help", topic: "artifacts bindings outbound" };
+        }
         if (resourceArgs[1] === "analytics" &&
             (resourceArgs[2] === undefined ||
                 resourceArgs[2] === "--help" ||
@@ -2659,6 +2973,98 @@ async function runGenerateEnvTypes(command, io) {
     }
     return 0;
 }
+function titleCaseBindingId(id) {
+    return id
+        .split("-")
+        .filter(Boolean)
+        .map((part) => `${part.slice(0, 1).toUpperCase()}${part.slice(1)}`)
+        .join(" ");
+}
+function pascalCaseBindingId(id) {
+    return id
+        .split("-")
+        .filter(Boolean)
+        .map((part) => `${part.slice(0, 1).toUpperCase()}${part.slice(1)}`)
+        .join("");
+}
+function envNameFromBindingId(id) {
+    return id.toUpperCase().replaceAll("-", "_");
+}
+function createOutboundBindingShape(command) {
+    const interfaceName = command.interfaceName ?? `${pascalCaseBindingId(command.id)}Binding`;
+    const label = command.label ?? titleCaseBindingId(command.id);
+    const name = command.name ?? envNameFromBindingId(command.id);
+    const bindingDirectory = `bindings/${command.id}`;
+    const bindingJson = {
+        id: command.id,
+        entry: "src/worker.ts",
+        entrypoint: interfaceName,
+        interface: interfaceName,
+        permissions: ["outbound:http"],
+        allowedHosts: [command.host],
+    };
+    const appJsonBinding = {
+        id: command.id,
+        label,
+        name,
+        source: bindingDirectory,
+        interface: interfaceName,
+    };
+    const interfaceSource = `export interface ${interfaceName} {\n  request(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;\n}\n`;
+    const workerSource = `import { WorkerEntrypoint } from "cloudflare:workers";\n\nexport class ${interfaceName} extends WorkerEntrypoint {\n  async request(input: RequestInfo | URL, init?: RequestInit): Promise<Response> {\n    const url = typeof input === "string" || input instanceof URL ? new URL(input) : new URL(input.url);\n    if (url.hostname !== "${command.host}") {\n      throw new Error("Host is not allowed for this binding.");\n    }\n    return fetch(url, init);\n  }\n}\n`;
+    return {
+        ok: true,
+        command: command.command,
+        dryRun: command.dryRun,
+        binding: {
+            id: command.id,
+            name,
+            label,
+            interface: interfaceName,
+            allowedHosts: [command.host],
+            permissions: ["outbound:http"],
+        },
+        appJsonBinding,
+        files: [
+            {
+                path: `${bindingDirectory}/binding.json`,
+                content: `${JSON.stringify(bindingJson, null, 2)}\n`,
+            },
+            {
+                path: `${bindingDirectory}/interface.d.ts`,
+                content: interfaceSource,
+            },
+            {
+                path: `${bindingDirectory}/src/worker.ts`,
+                content: workerSource,
+            },
+        ],
+        next: [
+            "Add appJsonBinding to app.json bindings[].",
+            `Call this binding from src/server.ts through env.${name}; do not fetch third-party URLs directly from src/server.ts.`,
+            "Run tender app generate-env-types --dir . --json.",
+            "Run tender app doctor --dir . --json.",
+        ],
+    };
+}
+function runBindingsOutbound(command, io) {
+    const payload = createOutboundBindingShape(command);
+    if (command.json) {
+        io.stdout(JSON.stringify(payload, null, 2));
+    }
+    else {
+        io.stdout([
+            `Outbound binding dry run: ${payload.binding.id}`,
+            `app.json binding name: ${payload.binding.name}`,
+            `allowed host: ${payload.binding.allowedHosts.join(", ")}`,
+            "files:",
+            ...payload.files.map((file) => `  ${file.path}`),
+            "next:",
+            ...payload.next.map((step) => `  ${step}`),
+        ].join("\n"));
+    }
+    return 0;
+}
 async function parseJsonResponse(response) {
     return (await response.json().catch(() => null));
 }
@@ -4972,7 +5378,10 @@ export async function runTenderCli(args, io = {
     try {
         const command = parseTenderArgs(args);
         if (command.command === "help") {
-            if (command.topic === "auth login") {
+            if (command.topic === "capabilities") {
+                io.stdout(capabilitiesHelp());
+            }
+            else if (command.topic === "auth login") {
                 io.stdout(authLoginHelp());
             }
             else if (command.topic === "auth status") {
@@ -5008,6 +5417,9 @@ export async function runTenderCli(args, io = {
             else if (command.topic === "artifacts context refresh") {
                 io.stdout(artifactsContextRefreshHelp());
             }
+            else if (command.topic === "artifacts bindings outbound") {
+                io.stdout(bindingsOutboundHelp());
+            }
             else if (command.topic === "artifacts git setup") {
                 io.stdout(gitSetupHelp());
             }
@@ -5079,6 +5491,9 @@ export async function runTenderCli(args, io = {
             }
             return 0;
         }
+        if (command.command === "capabilities") {
+            return runCapabilities(command, io);
+        }
         if (command.command === "auth login") {
             return await runAuthLogin(command, io, runtime);
         }
@@ -5109,6 +5524,9 @@ export async function runTenderCli(args, io = {
         if (command.command === "artifacts context refresh") {
             return await runContextFetch(command, io, runtime);
         }
+        if (command.command === "artifacts bindings outbound") {
+            return runBindingsOutbound(command, io);
+        }
         if (command.command === "artifacts git setup") {
             return await runGitSetup(command, io, runtime);
         }

package/package.json

@@ -1,9 +1,9 @@
 {
 	"name": "@tenderprompt/cli",
-	"version": "0.1.5",
+	"version": "0.1.7",
 	"type": "module",
 	"bin": {
-		"tender": "./bin/tender.js"
+		"tender": "bin/tender.js"
 	},
 	"main": "./dist/index.js",
 	"types": "./dist/index.d.ts",