@tendrilapp/cli 0.1.43 → 0.1.44

package/dist/tendril-mcp.js

@@ -108,7 +108,7 @@ var TOOLS = [
   },
   {
     name: "tendril_publish",
-    description: "Publish a VERIFIED bundle to the user's portal \u2014 phase one of the browser-approved publish. Re-publishing an already-published component completes in one call. A component's FIRST publish is a human-only decision the portal enforces: this call requests the approval and returns the approve-page link \u2014 RELAY IT to the user verbatim (they click Approve in the browser where they are signed in; when the page shows a terms checkbox, ticking it is part of their decision \u2014 never advise them to just tick it). Then call tendril_publish_wait to finish. You cannot approve this yourself: the portal only accepts the decision from their signed-in browser, never from this machine's token. Requires a green verify (the CLI refuses a declined run) and a portal session (tendril_login).",
+    description: "Publish a VERIFIED bundle to the user's portal \u2014 phase one of the browser-approved publish. Re-publishing an already-published component completes in one call. A component's FIRST publish is a human-only decision the portal enforces: this call requests the approval and returns the approve-page link \u2014 RELAY IT to the user verbatim, along with which account the result says to be signed in as (they click Approve in the browser; approving includes accepting the design system's publishing terms, which is their decision to make, never yours to urge). Then call tendril_publish_wait to finish. You cannot approve this yourself: the portal only accepts the decision from their signed-in browser, never from this machine's token. Requires a green verify (the CLI refuses a declined run) and a portal session (tendril_login).",
     schema: z.object({
       bundleDir: str("bundle directory (verified \u2014 carries component.json and verify-evidence)"),
       portal: optStr("portal origin override for self-hosted portals (defaults to the stored session's portal)")

package/dist/tendril.js

@@ -8468,6 +8468,9 @@ var init_publish_client = __esm({
       pollApproval(input) {
         return this.json("GET", `/api/publish-approvals/${encodeURIComponent(input.approvalId)}`, null, true);
       }
+      whoami() {
+        return this.json("GET", "/api/whoami", null, true);
+      }
       begin(input) {
         return this.json("POST", "/api/publications", input, true);
       }
@@ -17247,7 +17250,7 @@ var init_server = __esm({
       },
       {
         name: "tendril_publish",
-        description: "Publish a VERIFIED bundle to the user's portal \u2014 phase one of the browser-approved publish. Re-publishing an already-published component completes in one call. A component's FIRST publish is a human-only decision the portal enforces: this call requests the approval and returns the approve-page link \u2014 RELAY IT to the user verbatim (they click Approve in the browser where they are signed in; when the page shows a terms checkbox, ticking it is part of their decision \u2014 never advise them to just tick it). Then call tendril_publish_wait to finish. You cannot approve this yourself: the portal only accepts the decision from their signed-in browser, never from this machine's token. Requires a green verify (the CLI refuses a declined run) and a portal session (tendril_login).",
+        description: "Publish a VERIFIED bundle to the user's portal \u2014 phase one of the browser-approved publish. Re-publishing an already-published component completes in one call. A component's FIRST publish is a human-only decision the portal enforces: this call requests the approval and returns the approve-page link \u2014 RELAY IT to the user verbatim, along with which account the result says to be signed in as (they click Approve in the browser; approving includes accepting the design system's publishing terms, which is their decision to make, never yours to urge). Then call tendril_publish_wait to finish. You cannot approve this yourself: the portal only accepts the decision from their signed-in browser, never from this machine's token. Requires a green verify (the CLI refuses a declined run) and a portal session (tendril_login).",
         schema: z14.object({
           bundleDir: str("bundle directory (verified \u2014 carries component.json and verify-evidence)"),
           portal: optStr("portal origin override for self-hosted portals (defaults to the stored session's portal)")
@@ -18295,6 +18298,7 @@ var init_share = __esm({
 // packages/cli/src/commands/publish.ts
 var publish_exports = {};
 __export(publish_exports, {
+  resolveOrigin: () => resolveOrigin,
   runPublish: () => runPublish
 });
 import { existsSync as existsSync44, readFileSync as readFileSync41, rmSync as rmSync8, writeFileSync as writeFileSync23 } from "node:fs";
@@ -18410,10 +18414,10 @@ async function runPublish(opts) {
     );
     return;
   }
-  const origin = (opts.to ?? process.env["TENDRIL_PORTAL_URL"] ?? "").replace(/\/+$/, "");
+  const origin = resolveOrigin(opts);
   const client = opts.client ?? httpClient(opts, origin);
   if (opts.approveWait === true) {
-    await approveWaitPhase(opts, client, bundleDir);
+    await approveWaitPhase(opts, client, bundleDir, { componentName, figmaFile });
   }
   void reportRunPresence(componentName, "publishing");
   let opened = await client.begin({
@@ -18435,7 +18439,7 @@ async function runPublish(opts) {
   if (!opened.ok) {
     if (opened.needsConfirmation !== void 0) {
       fail(opts, ExitCode.ConfirmationRequired, {
-        error: `publishing ${JSON.stringify(opened.needsConfirmation.componentName)} for the first time is a decision a person makes, not a build step`,
+        error: opened.refusal,
         code: "first-publish-unconfirmed",
         remediation: "Approve it in your browser \u2014 run the publish again and open the link it prints."
       });
@@ -18457,7 +18461,7 @@ async function runPublish(opts) {
       relPath: object.relPath,
       bytes: new Uint8Array(readFileSync41(file))
     });
-    if (!sent.ok) refuse2(opts, sent, "upload-refused");
+    if (!sent.ok) refuse2(opts, sent, "upload-refused", true);
     uploaded.push({ relPath: object.relPath, deduplicated: sent.value.deduplicated });
   }
   const committed = await client.commit({ publicationId: opened.value.publicationId });
@@ -18472,7 +18476,7 @@ async function runPublish(opts) {
         remediation: `Run \`${tendrilCommand(`publish ${opts.bundleDir}`)}\` again \u2014 it rejoins this same unfinished publication and re-sends only what is missing.`
       });
     }
-    refuse2(opts, committed, "commit-refused");
+    refuse2(opts, committed, "commit-refused", true);
   }
   emitData(
     opts,
@@ -18544,6 +18548,12 @@ function readBundle(opts, bundleDir) {
   }
   return { manifest, report, reportText, files: bundleFiles(bundleDir) };
 }
+function resolveOrigin(opts) {
+  const named = (opts.to ?? process.env["TENDRIL_PORTAL_URL"] ?? "").replace(/\/+$/, "");
+  if (named !== "") return named;
+  if ((process.env["TENDRIL_TOKEN"] ?? "") !== "") return "";
+  return (readStoredSession()?.origin ?? "").replace(/\/+$/, "");
+}
 function httpClient(opts, origin) {
   if (origin === "") {
     fail(opts, ExitCode.InputValidation, {
@@ -18576,12 +18586,13 @@ function httpClient(opts, origin) {
   }
   return new HttpPublishClient({ origin, token: found.token });
 }
-function refuse2(opts, sent, code) {
+function refuse2(opts, sent, code, rejoins = false) {
   const detail = sent.detail === void 0 || sent.detail.length === 0 ? "" : `: ${sent.detail.join(", ")}`;
+  const retry = rejoins ? `run \`${tendrilCommand(`publish ${opts.bundleDir}`)}\` again \u2014 it rejoins this same unfinished publication rather than starting a second one` : `run \`${tendrilCommand(`publish ${opts.bundleDir}`)}\` again`;
   fail(opts, sent.status === 401 ? ExitCode.Auth : ExitCode.General, {
     error: `${sent.refusal}${detail}`,
     code,
-    remediation: sent.status === 401 ? `That session is no longer valid. Run \`${tendrilCommand(`login --to ${(opts.to ?? process.env["TENDRIL_PORTAL_URL"] ?? "").replace(/\/+$/, "")}`)}\` and paste a fresh token.` : sent.status >= 500 ? `The portal failed on its side. Quote the error id above to whoever runs it, then run \`${tendrilCommand(`publish ${opts.bundleDir}`)}\` again \u2014 a retry rejoins this same unfinished publication.` : `Fix what is named above and run \`${tendrilCommand(`publish ${opts.bundleDir}`)}\` again \u2014 it rejoins this same unfinished publication rather than starting a second one.`
+    remediation: sent.status === 401 ? `That session is no longer valid. Run \`${tendrilCommand(`login --to ${resolveOrigin(opts)}`)}\` and paste a fresh token.` : sent.status >= 500 ? `The portal failed on its side. Quote the error id above to whoever runs it, then ${retry}.` : `Fix what is named above and ${retry}.`
   });
 }
 function pendingApprovalPath() {
@@ -18591,22 +18602,27 @@ async function runApprovalFlow(opts, client, bundleDir, input) {
   const requested = await client.requestApproval({ componentName: input.componentName, figmaFile: input.figmaFile });
   if (!requested.ok) refuse2(opts, requested, "approval-request-refused");
   const approval = requested.value;
+  const who = await client.whoami?.();
+  const asAccount = who?.ok === true && who.value.email !== "" ? ` signed in as ${who.value.email}` : "";
   if (opts.approveStart === true) {
-    writeFileSync23(pendingApprovalPath(), `${JSON.stringify({ ...approval, bundleDir }, null, 2)}
+    const pending = { ...approval, bundleDir, componentName: input.componentName, figmaFile: input.figmaFile };
+    writeFileSync23(pendingApprovalPath(), `${JSON.stringify(pending, null, 2)}
 `, { mode: 384 });
+    await endRunPresence(input.componentName);
     emitData(
       opts,
       {
         status: "approval-pending",
         approveUrl: approval.approveUrl,
         componentName: input.componentName,
+        ...asAccount === "" ? {} : { approveAsAccount: who?.ok === true ? who.value.email : "" },
         expiresAt: approval.expiresAt,
-        next: "open the approve page in the signed-in browser, click Approve (tick the terms box if shown), then finish with --approve-wait"
+        next: `open the approve page in the browser${asAccount}, click Approve, then finish with --approve-wait`
       },
       () => {
         process.stdout.write(`Approval requested for ${JSON.stringify(input.componentName)}.
 `);
-        process.stdout.write(`Approve it here: ${approval.approveUrl}
+        process.stdout.write(`Approve it here${asAccount}: ${approval.approveUrl}
 `);
         process.stdout.write(`Then finish with: ${tendrilCommand(`publish ${opts.bundleDir} --approve-wait`)}
 `);
@@ -18614,16 +18630,17 @@ async function runApprovalFlow(opts, client, bundleDir, input) {
     );
     return void 0;
   }
-  process.stderr.write(`This component's FIRST publish needs your approval in the browser:
+  process.stderr.write(`This component's FIRST publish needs your approval in the browser${asAccount}:
   ${approval.approveUrl}
 `);
   process.stderr.write(`Waiting for your decision (lapses at ${approval.expiresAt.slice(11, 16)} UTC)\u2026
 `);
   const decided = await waitForApproval(opts, client, approval);
   if (decided === "approved") return input.begin();
+  await endRunPresence(input.componentName);
   failDecision(opts, decided);
 }
-async function approveWaitPhase(opts, client, bundleDir) {
+async function approveWaitPhase(opts, client, bundleDir, subject) {
   const file = pendingApprovalPath();
   let pending;
   if (existsSync44(file)) {
@@ -18642,6 +18659,13 @@ async function approveWaitPhase(opts, client, bundleDir) {
       remediation: `Start one first: ${tendrilCommand(`publish ${opts.bundleDir} --approve-start`)} (the tendril_publish tool).`
     });
   }
+  if (pending.componentName !== void 0 && pending.componentName !== subject.componentName) {
+    fail(opts, ExitCode.InputValidation, {
+      error: `the waiting approval is for ${JSON.stringify(pending.componentName)}, and this publish is ${JSON.stringify(subject.componentName)}`,
+      code: "pending-approval-mismatch",
+      remediation: `Finish that one first (${tendrilCommand(`publish ${pending.bundleDir} --approve-wait`)}), or start this one fresh with --approve-start \u2014 starting one replaces the waiting slot.`
+    });
+  }
   const done = () => rmSync8(file, { force: true });
   const decided = await waitForApproval(opts, client, pending);
   done();
@@ -18670,7 +18694,7 @@ function failDecision(opts, decided) {
   fail(opts, ExitCode.ConfirmationRequired, {
     error: decided === "expired" ? "the approval request lapsed before anyone decided it" : "the approval request is gone \u2014 it lapsed and was cleaned up, or was already spent",
     code: "publish-approval-lapsed",
-    remediation: "Run the publish again for a fresh request, and decide it within its 30-minute window."
+    remediation: "Run the publish again for a fresh request, and decide it within its 30-minute window. If the approve page showed nothing waiting, the browser is signed in to a DIFFERENT account than this CLI \u2014 the page lists only its own account's requests."
   });
 }
 var APPROVAL_WAIT_CAP_MS;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tendrilapp/cli",
-  "version": "0.1.43",
+  "version": "0.1.44",
   "description": "Figma design systems → verified React components. CLI ruler + MCP server.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",