feat(api): authorize purpose-bound exports via loopback CLI

CHANGELOG.d/export-authorize-cli.md

@@ -0,0 +1 @@
+- `tepp_api` loopback `tepp-exports authorize` posts a purpose-bound export request to `tepp-naruon-live` (`NaruonLiveService` `POST /v1/exports`, ADR 0026). Metric-free decision JSON only. `tepp.scientific_acceptance.v1` never appears. Not `tepp-loopback`, not analysis-run CLIs, not GAP-010 Figma/export, not persistence.

DOCUMENTATION.md

@@ -11,6 +11,7 @@ TEPP's approved PRD v0.4 and implementation plan are the primary product baselin
 | Architecture | [`ARCHITECTURE.md`](ARCHITECTURE.md) |
 | Modular/API integration contract | [`docs/API_CONTRACT.md`](docs/API_CONTRACT.md) |
 | naruon modular consumer contract | [`docs/connectors/naruon-artifact-consumer.md`](docs/connectors/naruon-artifact-consumer.md) |
+| Export-authorize CLI doctoring | [`docs/research/export-authorize-cli.md`](docs/research/export-authorize-cli.md) |
 | contextual-orchestrator interpretation port | [`docs/connectors/contextual-orchestrator-interpretation-port.md`](docs/connectors/contextual-orchestrator-interpretation-port.md) |
 | Orchestrator live HTTP doctoring | [`docs/research/orchestrator-live-http.md`](docs/research/orchestrator-live-http.md) |
 | UML/runtime/scientific flows | [`docs/UML.md`](docs/UML.md) |

crates/tepp_api/Cargo.toml

@@ -29,5 +29,17 @@ path = "src/bin/tepp_loopback.rs"
 test = false
 bench = false
 
+[[bin]]
+name = "tepp-naruon-live"
+path = "src/bin/tepp_naruon_live.rs"
+test = false
+bench = false
+
+[[bin]]
+name = "tepp-exports"
+path = "src/bin/tepp_exports.rs"
+test = false
+bench = false
+
 [lints]
 workspace = true

crates/tepp_api/src/bin/tepp_exports.rs

@@ -0,0 +1,37 @@
+//! Operator CLI for loopback purpose-bound export authorization POST.
+
+use std::io::{self, IsTerminal};
+use std::process::ExitCode;
+
+use tepp_api::{
+    ApiError, ExportAuthorizeCliInvocation, execute_export_authorize_cli,
+    read_export_authorize_cli_stdin, render_export_authorize_cli_stdout,
+};
+
+fn main() -> ExitCode {
+    match run() {
+        Ok(()) => ExitCode::SUCCESS,
+        Err(_) => ExitCode::FAILURE,
+    }
+}
+
+fn run() -> Result<(), ApiError> {
+    let args: Vec<String> = std::env::args().skip(1).collect();
+    match args.first().map(String::as_str) {
+        Some("authorize") => run_authorize(&args),
+        _ => Err(ApiError::InvalidWirePayload),
+    }
+}
+
+fn run_authorize(args: &[String]) -> Result<(), ApiError> {
+    let body = read_export_authorize_cli_stdin(io::stdin().is_terminal(), io::stdin())?;
+    let invocation = ExportAuthorizeCliInvocation::from_args(args, body)?;
+    let response = execute_export_authorize_cli(&invocation)?;
+    let stdout = render_export_authorize_cli_stdout(&invocation, &response)?;
+    println!("{stdout}");
+    if (200..300).contains(&response.status_code) {
+        Ok(())
+    } else {
+        Err(ApiError::InvalidWirePayload)
+    }
+}

crates/tepp_api/src/bin/tepp_naruon_live.rs

@@ -0,0 +1,24 @@
+//! Runnable loopback ingress for naruon analysis-run and export POSTs.
+
+use std::net::SocketAddr;
+
+use tepp_api::NaruonLiveService;
+
+const DEFAULT_BIND_ADDR: &str = "127.0.0.1:18082";
+
+fn main() -> Result<(), Box<dyn std::error::Error>> {
+    let mut arguments = std::env::args().skip(1);
+    let bind_addr = arguments
+        .next()
+        .unwrap_or(DEFAULT_BIND_ADDR.to_owned())
+        .parse::<SocketAddr>()?;
+    let request_limit = arguments
+        .next()
+        .map(|value| value.parse::<usize>())
+        .transpose()?
+        .unwrap_or(usize::MAX);
+    let mut service = NaruonLiveService::bind(bind_addr)?;
+    println!("{}", service.local_addr()?);
+    (0..request_limit).for_each(|_| drop(service.serve_one()));
+    Ok(())
+}