@withandeo/cli 0.19.16 → 0.19.18

package/dist/workflow-coordinator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workflow-coordinator.d.ts","sourceRoot":"","sources":["../src/workflow-coordinator.ts"],"names":[],"mappings":"AAAA;qEACqE;AACrE,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CA6CvF"}
+{"version":3,"file":"workflow-coordinator.d.ts","sourceRoot":"","sources":["../src/workflow-coordinator.ts"],"names":[],"mappings":"AAAA;qEACqE;AACrE,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CA8CvF"}

package/dist/workflow-coordinator.js

@@ -14,12 +14,13 @@ export class AndeoCoordinator extends WorkerEntrypoint {
           || (options?.retries && typeof options.retries.delay === "function")) throw new Error("app_workflow_step_options_unsupported");
         const execute = async nativeContext => context.run({ native: nativeContext, call: 0 }, async () => {
           await runtime.observeStep?.(nativeContext, "started").catch(() => undefined);
+          const startedAt = Date.now();
           try {
             const result = await callback(nativeContext);
-            await runtime.observeStep?.(nativeContext, "completed").catch(() => undefined);
+            await runtime.observeStep?.(nativeContext, "completed", Date.now() - startedAt).catch(() => undefined);
             return result;
           } catch (error) {
-            await runtime.observeStep?.(nativeContext, "errored").catch(() => undefined);
+            await runtime.observeStep?.(nativeContext, "errored", Date.now() - startedAt).catch(() => undefined);
             throw error;
           }
         });

package/dist/workflow-coordinator.js.map

@@ -1 +1 @@
-{"version":3,"file":"workflow-coordinator.js","sourceRoot":"","sources":["../src/workflow-coordinator.ts"],"names":[],"mappings":"AAAA;qEACqE;AACrE,MAAM,UAAU,yBAAyB,CAAC,SAAiB,EAAE,QAAkB;IAC7E,OAAO;;WAEE,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;yBA2BK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;;;;;;;;;;;;;;CAchD,CAAC;AACF,CAAC"}
+{"version":3,"file":"workflow-coordinator.js","sourceRoot":"","sources":["../src/workflow-coordinator.ts"],"names":[],"mappings":"AAAA;qEACqE;AACrE,MAAM,UAAU,yBAAyB,CAAC,SAAiB,EAAE,QAAkB;IAC7E,OAAO;;WAEE,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBA4BK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;;;;;;;;;;;;;;CAchD,CAAC;AACF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@withandeo/cli",
-  "version": "0.19.16",
+  "version": "0.19.18",
   "description": "Developer CLI for Andeo applications",
   "type": "module",
   "license": "UNLICENSED",
@@ -40,7 +40,7 @@
     "jsonc-parser": "3.3.1",
     "miniflare": "5.20260918.0-alpha",
     "semver": "^7.8.5",
-    "smol-toml": "1.8.0"
+    "smol-toml": "1.9.0"
   },
   "exports": {
     "./cli": "./dist/main.js",

package/skill/publication.json

@@ -1,3 +1,3 @@
 {
-  "minimumCliVersion": "0.19.16"
+  "minimumCliVersion": "0.19.17"
 }

package/skill/tender-accounts/SKILL.md

@@ -98,6 +98,17 @@ artifact or bypass the isolation gate. Reopen with the returned `sbl_` ID while
 the run and derived preview remain authorized. Expiry requires a fresh task and
 its own assigned branch/preview, not reuse of the old bearer.
 
+With explicitly enrolled `preview.share`, the same preview command automatically
+resolves the published gateway and returns a separately revocable handoff lasting
+up to seven days, capped by ancestor authority. It survives normal run completion
+and issuing-token expiry. The gateway uses normal customer authentication and
+production APIs; sharing does not log in a customer or authorize additional
+provider mutations. Inspect the returned entry, selection, exact source and
+expiry before handing it over. Use `preview entries` and optional `--through`
+only when entry selection is ambiguous. Existing grants do not gain sharing
+from a task scope override. The stateless preview Worker receives no provider
+credentials, customer cookies, resources or outbound network access.
+
 `source.merge` delegates approval for the run's validated source. Keep
 `review.prepare` when requesting an implicit source review through merge.
 Use the existing merge command for the assigned branch or exact permitted

package/skill/tender-accounts/references/delivery.md

@@ -133,6 +133,13 @@ npx @withandeo/cli preview open --from sbl_EXAMPLE --return-path /account --json
 
 Preview entry selection follows published app connections automatically. When the response requires a choice, select an eligible app using `--through prj_ENTRY`. Only the previewed app's developer grant is needed. Private apps cannot open directly; a connection administrator must enable an eligible entry. Preserve the exact `from` ID when recovering from a session error and use `preview open` instead of rebuilding. Opening replaces the browser's previous preview selection and preserves sign-in.
 
+Persistent Cloud agents need separately consented `preview.share` for this gateway
+handoff. With it, the same `preview` and `preview open` commands resolve the entry
+server-side and return a link lasting at most seven days independently of normal
+run completion/token expiry. Parent deadlines, revocation, cancellation, current
+connection policy and exact preview retirement remain enforced on public and
+bound requests. Without it, the direct stateless preview remains run-bound.
+
 `<delivery-id>` is the `dly_` value returned by `preview`. A `dwf_` value is a production workflow ID and must not be passed to developer-delivery commands. If a merchant administrator sees a `dwf_` publish waiting with zero attempts, the supported recovery is **Activity → Resume exact publish**; it resumes the stored exact composition without rebuilding. Use the error code, request ID, and suggested command from the CLI. Do not retry with altered IDs, another project, or raw HTTP requests.
 
 When runtime evidence is needed, stream only the linked project and exact target:

package/skill/tender-accounts/references/email.md

@@ -1,5 +1,7 @@
 # Email identities and prepared test accounts
 
+Persistent Cloud agents require an explicitly selected `email.read` grant. In Persistent agents, enable **Read all merchant inboxes, including QA sign-in emails**, confirm the replacement grant, and update the Cloud environment's bootstrap. If the environment still sets optional `ANDEO_AGENT_SCOPE`, remove it to inherit the renewed grant scope, or include `email.read` in the explicit narrower scope. This permits listing, cursors, messages, reading and waiting across all inboxes in that merchant, even when only one app is selected. It does not permit creating or retiring inboxes. Existing grants do not acquire this capability automatically.
+
 Use `andeo email capabilities --json` to inspect `enabled`, `tenantId`, and `permissions`. Email is receive-only and belongs to the merchant, shared across all its apps. Developer access to any app in that merchant grants access to all its inboxes, even for an agent scoped to only one app. Viewers cannot read mail. A tenant member and an authorized agent use the same inboxes through the merchant Email section or CLI. Select the merchant with its login `--profile`; optional `--tenant tn_...` checks that the profile belongs to the intended merchant.
 
 ## Reuse an identity prepared by a person

package/skill/tender-accounts/references/managed-source.md

@@ -273,8 +273,16 @@ stated remediation and a newly reviewed request instead.
 For reviewed repositories, a moved head invalidates the previous approval and
 the newest source build becomes the next exact snapshot. A moved base makes the
 change stale. Rebase or update the feature branch, push a new committed
-revision, wait for its exact preview, and have the administrator review that
-new snapshot. Source landing never calls the production publisher directly;
+revision, then rerun `source change create --head BRANCH --title TITLE --json`.
+The command refreshes the existing open change for that base/head branch pair:
+its ID, number, title, description and history remain, while the current base/head
+SHAs become a new snapshot and any previous approval is invalidated. Repeating
+the command with unchanged refs preserves the snapshot and approval. A change
+already landing cannot be refreshed. Do not close a stale change just to update
+its base. Wait for the exact head preview, then have the administrator review
+and approve the refreshed snapshot. Closed or landed changes remain terminal;
+creating another review for their branch opens a new change.
+Source landing never calls the production publisher directly;
 after landing, the repository's already configured default-branch policy may
 publish the same artifact after its exact preview and production validation succeed.
 

package/templates/shopify-customer-account/apps/gateway/.tender/artifacts/current/tender-accounts-build.json

@@ -0,0 +1,99 @@
+{
+  "schema": "tender.external-app-build/v1",
+  "sourceRevision": "ffffffffffffffffffffffffffffffffffffffff",
+  "bundleDigest": "e66389b6c7916261dd8989277e73cccc53c361d1796eb481f832b73ecca66eb9",
+  "manifest": {
+    "schema": "tender.account-artifact/v1",
+    "app": {
+      "slug": "__APP_SLUG__-gateway",
+      "version": "0.1.0",
+      "label": "__APP_NAME__ gateway",
+      "fixture": false
+    },
+    "runtime": {
+      "kind": "worker",
+      "compatibilityDate": "2026-08-25",
+      "mainModule": "worker.mjs",
+      "assetPrefix": "/_tenant-artifacts/e66389b6c7916261dd8989277e73cccc53c361d1796eb481f832b73ecca66eb9"
+    },
+    "module": {
+      "path": "worker.mjs",
+      "sha256": "a4e09ddcd26055ce1305ba6ce2d45e648208338615c2b1e72a0ed9d3ad37fa1e",
+      "bytes": 73369,
+      "contentType": "application/javascript+module"
+    },
+    "files": [],
+    "health": {
+      "path": "/api/health"
+    },
+    "resources": [
+      {
+        "type": "d1",
+        "name": "APP_DB"
+      }
+    ],
+    "services": [
+      {
+        "name": "PORTAL_UI",
+        "targetProject": "__APP_SLUG__-portal-ui"
+      }
+    ],
+    "vars": {
+      "ACCOUNT_PROJECT_ID": "prj_replace_me",
+      "ACCOUNT_RUNTIME_BASE_DOMAIN": "tenderprompt.dev",
+      "ACCOUNT_TENANT_ID": "ten_replace_me",
+      "SHOPIFY_CUSTOMER_ACCOUNT_CLIENT_ID": "replace_me",
+      "SHOPIFY_CUSTOMER_ACCOUNT_DOMAIN": "shopify.com",
+      "SHOPIFY_STOREFRONT_DOMAIN": "example.myshopify.com"
+    },
+    "databaseSchema": {
+      "schema": "tender.d1-schema/v1",
+      "statements": [
+        "CREATE TABLE IF NOT EXISTS public_customer_auth_flows (\n    project_id TEXT NOT NULL,\n    state_digest TEXT NOT NULL,\n    browser_binding_digest TEXT NOT NULL,\n    client_key_digest TEXT NOT NULL,\n    interaction_mode TEXT NOT NULL,\n    pkce_verifier TEXT NOT NULL,\n    return_hostname TEXT NOT NULL,\n    created_at INTEGER NOT NULL,\n    expires_at INTEGER NOT NULL,\n    consumed_at INTEGER,\n    PRIMARY KEY (project_id, state_digest),\n    CHECK (length(project_id) BETWEEN 2 AND 128),\n    CHECK (length(state_digest) = 64),\n    CHECK (state_digest NOT GLOB '*[^0-9a-f]*'),\n    CHECK (length(browser_binding_digest) = 64),\n    CHECK (browser_binding_digest NOT GLOB '*[^0-9a-f]*'),\n    CHECK (length(client_key_digest) = 64),\n    CHECK (client_key_digest NOT GLOB '*[^0-9a-f]*'),\n    CHECK (interaction_mode IN ('interactive', 'silent')),\n    CHECK (length(pkce_verifier) BETWEEN 43 AND 128),\n    CHECK (length(return_hostname) BETWEEN 1 AND 253),\n    CHECK (return_hostname = lower(return_hostname)),\n    CHECK (expires_at > created_at),\n    CHECK (consumed_at IS NULL OR consumed_at BETWEEN created_at AND expires_at)\n  )",
+        "CREATE INDEX IF NOT EXISTS public_customer_auth_flows_by_expiry\n    ON public_customer_auth_flows (expires_at)",
+        "CREATE TABLE IF NOT EXISTS public_customer_auth_sessions (\n    project_id TEXT NOT NULL,\n    session_digest TEXT NOT NULL,\n    audience_hostname TEXT NOT NULL,\n    session_data TEXT NOT NULL,\n    created_at INTEGER NOT NULL,\n    expires_at INTEGER NOT NULL,\n    PRIMARY KEY (project_id, session_digest),\n    CHECK (length(project_id) BETWEEN 2 AND 128),\n    CHECK (length(session_digest) = 64),\n    CHECK (session_digest NOT GLOB '*[^0-9a-f]*'),\n    CHECK (length(audience_hostname) BETWEEN 1 AND 253),\n    CHECK (audience_hostname = lower(audience_hostname)),\n    CHECK (length(session_data) BETWEEN 1 AND 65536),\n    CHECK (expires_at > created_at)\n  )",
+        "CREATE INDEX IF NOT EXISTS public_customer_auth_sessions_by_expiry\n    ON public_customer_auth_sessions (expires_at)",
+        "CREATE TABLE IF NOT EXISTS public_customer_auth_handoffs (\n    project_id TEXT NOT NULL,\n    handoff_digest TEXT NOT NULL,\n    return_hostname TEXT NOT NULL,\n    session_digest TEXT NOT NULL,\n    session_seal TEXT NOT NULL,\n    created_at INTEGER NOT NULL,\n    expires_at INTEGER NOT NULL,\n    claimed_at INTEGER,\n    PRIMARY KEY (project_id, handoff_digest),\n    CHECK (length(project_id) BETWEEN 2 AND 128),\n    CHECK (length(handoff_digest) = 64),\n    CHECK (handoff_digest NOT GLOB '*[^0-9a-f]*'),\n    CHECK (length(return_hostname) BETWEEN 1 AND 253),\n    CHECK (return_hostname = lower(return_hostname)),\n    CHECK (length(session_digest) = 64),\n    CHECK (session_digest NOT GLOB '*[^0-9a-f]*'),\n    CHECK (length(session_seal) BETWEEN 80 AND 100000),\n    CHECK (expires_at > created_at),\n    CHECK (claimed_at IS NULL OR claimed_at BETWEEN created_at AND expires_at)\n  )",
+        "CREATE INDEX IF NOT EXISTS public_customer_auth_handoffs_by_expiry\n    ON public_customer_auth_handoffs (expires_at)"
+      ],
+      "objects": [
+        {
+          "type": "table",
+          "name": "public_customer_auth_flows",
+          "tableName": "public_customer_auth_flows",
+          "statementIndex": 0
+        },
+        {
+          "type": "index",
+          "name": "public_customer_auth_flows_by_expiry",
+          "tableName": "public_customer_auth_flows",
+          "statementIndex": 1
+        },
+        {
+          "type": "table",
+          "name": "public_customer_auth_sessions",
+          "tableName": "public_customer_auth_sessions",
+          "statementIndex": 2
+        },
+        {
+          "type": "index",
+          "name": "public_customer_auth_sessions_by_expiry",
+          "tableName": "public_customer_auth_sessions",
+          "statementIndex": 3
+        },
+        {
+          "type": "table",
+          "name": "public_customer_auth_handoffs",
+          "tableName": "public_customer_auth_handoffs",
+          "statementIndex": 4
+        },
+        {
+          "type": "index",
+          "name": "public_customer_auth_handoffs_by_expiry",
+          "tableName": "public_customer_auth_handoffs",
+          "statementIndex": 5
+        }
+      ]
+    }
+  }
+}