@aderis-erp/cli 1.1.2 → 1.1.4

package/dist/commands/{workflows.js → work-summary.js}

@@ -1,22 +1,22 @@
 import { Command, Args, Flags } from '@oclif/core';
 import { apiRequest, ApiError, isTextualMediaType, normalizeSortBy } from '../lib/api-client.js';
 import { getCurrentContext, getContext, getBaseUrls, hasCredentials, missingCredentialsMessage } from '../lib/config.js';
-// Add 'import' action if both create and update exist
-const HAS_IMPORT = false;
-const HAS_EXPORT = true;
+// 'upsert' loops create/update from the CLI, one request per record. It exists
+// only where the API has no import endpoint of its own; those keep the name
+// 'import' and are listed in SERVER_IMPORTS.
+const HAS_UPSERT = false;
+const HAS_EXPORT = false;
 const HAS_CAMT053 = false;
-const NESTED_IMPORTS = [];
-const SUBCOMMANDS = [...["list", "status", "find"], ...(HAS_IMPORT ? ['import'] : []), ...(HAS_EXPORT ? ['export'] : []), ...NESTED_IMPORTS.map(n => `import-${n}`)];
+const SERVER_IMPORTS = [];
+const NESTED_UPSERTS = [];
+const SUBCOMMANDS = [...["get"], ...(HAS_UPSERT ? ['upsert'] : []), ...(HAS_EXPORT ? ['export'] : []), ...NESTED_UPSERTS.map(n => `upsert-${n}`)];
 const ENDPOINTS = {
-    'list': { method: 'GET', path: '/v1/workflows', summary: 'Get all workflows with their summary', pathParams: [], hasBody: false, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: [] },
-    'status': { method: 'POST', path: '/v1/workflows/status', summary: 'Create a new workflow status update', pathParams: [], hasBody: true, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: [] },
-    'find': { method: 'GET', path: '/v1/workflows/{workflowId}', summary: 'Get workflow details including status updates and entity changes', pathParams: ['workflowId'], hasBody: false, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: [] },
+    'get': { method: 'GET', path: '/v1/work-summary', summary: 'Count what is open for the caller', pathParams: [], hasBody: false, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: [] },
 };
-export default class Workflows extends Command {
-    static description = 'Manage workflows';
+export default class WorkSummary extends Command {
+    static description = 'Manage work summary';
     static examples = [
-        '<%= config.bin %> workflows list',
-        '<%= config.bin %> workflows export --csv > workflows.csv',
+        '<%= config.bin %> work-summary get <id>',
     ];
     static args = {
         action: Args.string({ description: 'Action: ' + SUBCOMMANDS.join(', '), required: true }),
@@ -24,7 +24,7 @@ export default class Workflows extends Command {
     };
     static flags = {
         context: Flags.string({ char: 'c', aliases: ['config'], env: 'ADERIS_CONTEXT', description: 'Context to use for this command, overriding the current context (alias: --config)' }),
-        output: Flags.string({ char: 'o', description: 'Output format (default: table for import, json for other commands)', options: ['json', 'table', 'csv'] }),
+        output: Flags.string({ char: 'o', description: 'Output format (default: table for upsert, json for other commands)', options: ['json', 'table', 'csv'] }),
         table: Flags.boolean({ char: 't', description: 'Output as table (shortcut for --output table)' }),
         csv: Flags.boolean({ description: 'Output as CSV (shortcut for --output csv)' }),
         data: Flags.string({ char: 'd', description: 'JSON data for request body' }),
@@ -43,12 +43,27 @@ export default class Workflows extends Command {
         'show-http-request': Flags.boolean({ description: 'Show HTTP request details (method, URL, body)' }),
     };
     async run() {
-        const { args, flags } = await this.parse(Workflows);
-        // Handle import action specially
-        if (args.action === 'import') {
-            if (!HAS_IMPORT)
-                this.error('Import not available for this resource');
-            await this.runImport(flags);
+        const { args, flags } = await this.parse(WorkSummary);
+        // Bulk actions. 'import' is the API's own endpoint: one request, answered
+        // by a run that records what happened to every record. 'upsert' is the CLI
+        // looping create/update. A resource has one or the other, never both.
+        if (args.action === 'upsert') {
+            if (!HAS_UPSERT) {
+                this.error(SERVER_IMPORTS.includes('import')
+                    ? 'This resource is imported by the API. Use: aderis work-summary import --file data.json'
+                    : 'Upsert needs both a create and an update endpoint, which this resource does not have');
+            }
+            await this.runUpsert(flags);
+            return;
+        }
+        if (args.action.startsWith('upsert-')) {
+            const suffix = args.action.replace('upsert-', '');
+            if (!NESTED_UPSERTS.includes(suffix)) {
+                this.error(SERVER_IMPORTS.includes('import-' + suffix)
+                    ? `That resource is imported by the API. Use: aderis work-summary import-${suffix} <id> --file data.json`
+                    : `Unknown action: ${args.action}. Available: ${SUBCOMMANDS.join(', ')}`);
+            }
+            await this.runNestedUpsert(suffix, args.id, flags);
             return;
         }
         // Handle export action specially
@@ -65,12 +80,17 @@ export default class Workflows extends Command {
             await this.runCamt053Import(flags);
             return;
         }
-        // Handle nested resource imports (e.g., import-prices)
-        if (args.action.startsWith('import-')) {
-            const suffix = args.action.replace('import-', '');
-            if (NESTED_IMPORTS.includes(suffix)) {
-                await this.runNestedImport(suffix, args.id, flags);
-                return;
+        if (SERVER_IMPORTS.includes(args.action)) {
+            await this.runServerImport(args.action, args.id, flags);
+            return;
+        }
+        // 'import' used to name the CLI's create/update loop on every resource. It
+        // now names the API endpoint, which most resources do not have.
+        if (args.action === 'import' || args.action.startsWith('import-')) {
+            const suffix = args.action === 'import' ? '' : '-' + args.action.replace('import-', '');
+            const loops = args.action === 'import' ? HAS_UPSERT : NESTED_UPSERTS.includes(args.action.replace('import-', ''));
+            if (loops) {
+                this.error(`This resource has no import endpoint. Use: aderis work-summary upsert${suffix}${suffix ? ' <id>' : ''} --file data.json`);
             }
         }
         const endpoint = ENDPOINTS[args.action];
@@ -84,7 +104,7 @@ export default class Workflows extends Command {
                 // First path param always comes from positional argument
                 value = args.id;
                 if (!value)
-                    this.error('Missing required argument: id. Usage: aderis workflows <action> <id>');
+                    this.error('Missing required argument: id. Usage: aderis work-summary <action> <id>');
             }
             else {
                 const flagName = param.replace(/\./g, '-').replace(/([A-Z])/g, '-$1').toLowerCase().replace(/^-/, '');
@@ -385,7 +405,7 @@ export default class Workflows extends Command {
             throw error;
         }
     }
-    async runImport(flags) {
+    async runUpsert(flags) {
         const context = flags.context ? getContext(flags.context) : getCurrentContext();
         if (!context)
             this.error(flags.context ? `Context "${flags.context}" not found. List contexts with: aderis config list` : 'No context configured. Run: aderis auth login --new');
@@ -449,12 +469,12 @@ export default class Workflows extends Command {
             items = [item];
         }
         else {
-            this.error('Import requires --file, --data, or --set flags');
+            this.error('Upsert requires --file, --data, or --set flags');
         }
         const createEndpoint = ENDPOINTS['create'];
         const updateEndpoint = ENDPOINTS['update'];
         if (!createEndpoint || !updateEndpoint) {
-            this.error('Import requires both create and update endpoints');
+            this.error('Upsert requires both create and update endpoints');
         }
         // Helper to extract identifier from item (id, code, or xxxCode)
         const getItemIdentifier = (item) => {
@@ -597,6 +617,117 @@ export default class Workflows extends Command {
         this.log('');
         this.log(`Summary: ${created} created, ${updated} updated, ${errors.length} failed`);
     }
+    /**
+     * The API's own import: the whole array goes up in one request and comes
+     * back as an import run, which records what happened to every record. A bad
+     * record lands in errorLog and the rest are still applied, and the run stays
+     * readable afterwards with: aderis imports get <id>.
+     */
+    async runServerImport(action, parentId, flags) {
+        const endpoint = ENDPOINTS[action];
+        if (!endpoint)
+            this.error(`Unknown action: ${action}. Available: ${SUBCOMMANDS.join(', ')}`);
+        const context = flags.context ? getContext(flags.context) : getCurrentContext();
+        if (!context)
+            this.error(flags.context ? `Context "${flags.context}" not found. List contexts with: aderis config list` : 'No context configured. Run: aderis auth login --new');
+        if (!hasCredentials(context))
+            this.error(missingCredentialsMessage(context));
+        let apiPath = endpoint.path;
+        if (endpoint.pathParams.length > 0) {
+            if (!parentId)
+                this.error(`Missing required argument: id. Usage: aderis work-summary ${action} <parent-id> --file data.json`);
+            apiPath = apiPath.replace(`{${endpoint.pathParams[0]}}`, parentId);
+        }
+        // The endpoint takes an array. A single object is wrapped, so importing
+        // one record reads the same as importing many.
+        let records = [];
+        if (flags.file) {
+            const fsModule = await import('node:fs');
+            try {
+                const content = JSON.parse(fsModule.readFileSync(flags.file, 'utf-8'));
+                records = Array.isArray(content) ? content : [content];
+            }
+            catch {
+                this.error(`Failed to read file: ${flags.file}`);
+            }
+        }
+        else if (flags.data) {
+            try {
+                const content = JSON.parse(flags.data);
+                records = Array.isArray(content) ? content : [content];
+            }
+            catch {
+                this.error('Invalid JSON in --data');
+            }
+        }
+        else {
+            this.error('Import requires --file or --data holding a JSON array of records');
+        }
+        if (records.length === 0)
+            this.error('Nothing to import: the input is an empty array');
+        const params = { format: 'json' };
+        if (flags.mode)
+            params.mode = flags.mode;
+        if (flags.reference)
+            params.reference = flags.reference;
+        if (flags.async)
+            params.async = true;
+        const headers = {};
+        if (flags['idempotency-key'])
+            headers['Idempotency-Key'] = flags['idempotency-key'];
+        if (flags['show-http-request']) {
+            const baseUrls = getBaseUrls(context.environment);
+            const queryString = '?' + Object.entries(params).map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(String(v))}`).join('&');
+            process.stderr.write(`\n${endpoint.method.toUpperCase()} ${baseUrls.api}${apiPath}${queryString}\n`);
+            process.stderr.write(`Body: [${records.length} record${records.length === 1 ? '' : 's'}]\n\n`);
+        }
+        try {
+            const response = await apiRequest(endpoint.method, apiPath, {
+                contextName: flags.context,
+                data: records,
+                headers,
+                params,
+            });
+            this.printImportRun(response.data, flags);
+        }
+        catch (error) {
+            if (error instanceof ApiError) {
+                this.error(`API Error (${error.status}): ${error.message}`);
+            }
+            throw error;
+        }
+    }
+    /** Renders an import run: its counts, then whatever the server refused. */
+    printImportRun(run, flags) {
+        if (flags.output === 'json') {
+            this.log(JSON.stringify(run, null, 2));
+            return;
+        }
+        const record = (run ?? {});
+        const count = (key) => (typeof record[key] === 'number' ? record[key] : 0);
+        const id = record.id ? String(record.id) : '';
+        this.log(`Import ${id} - ${String(record.status ?? 'UNKNOWN')}${record.async ? ' (background)' : ''}`);
+        this.log(`  ${count('inputSize')} submitted, ${count('createdCount')} created, ${count('updatedCount')} updated, ${count('unchangedCount')} unchanged`);
+        if (count('errorCount') > 0)
+            this.log(`  ${count('errorCount')} not applied: ${count('refusedCount')} refused, ${count('failedCount')} failed`);
+        if (count('warningCount') > 0)
+            this.log(`  ${count('warningCount')} applied with a warning`);
+        // errorLog is keyed by the record's identifier, then by field name.
+        const errorLog = record.errorLog;
+        if (errorLog && Object.keys(errorLog).length > 0) {
+            this.log('');
+            for (const [key, fields] of Object.entries(errorLog)) {
+                for (const [field, messages] of Object.entries(fields ?? {})) {
+                    for (const message of messages ?? [])
+                        this.log(`  ${key}  ${field}: ${message}`);
+                }
+            }
+        }
+        if (record.async && id) {
+            this.log('');
+            this.log(`Follow it with: aderis imports get ${id}`);
+        }
+    }
     async runExport(flags) {
         const context = flags.context ? getContext(flags.context) : getCurrentContext();
         if (!context)
@@ -775,9 +906,9 @@ export default class Workflows extends Command {
             throw error;
         }
     }
-    async runNestedImport(suffix, parentId, flags) {
+    async runNestedUpsert(suffix, parentId, flags) {
         if (!parentId) {
-            this.error(`Missing required argument: id. Usage: aderis workflows import-${suffix} <parent-id> --file data.json`);
+            this.error(`Missing required argument: id. Usage: aderis work-summary upsert-${suffix} <parent-id> --file data.json`);
         }
         const context = flags.context ? getContext(flags.context) : getCurrentContext();
         if (!context)
@@ -842,12 +973,12 @@ export default class Workflows extends Command {
             items = [item];
         }
         else {
-            this.error(`Import requires --file, --data, or --set flags`);
+            this.error('Upsert requires --file, --data, or --set flags');
         }
         const createEndpoint = ENDPOINTS[`create-${suffix}`];
         const updateEndpoint = ENDPOINTS[`update-${suffix}`];
         if (!createEndpoint || !updateEndpoint) {
-            this.error(`Import requires both create-${suffix} and update-${suffix} endpoints`);
+            this.error(`Upsert requires both create-${suffix} and update-${suffix} endpoints`);
         }
         // Build the base path with parent ID (first path param)
         const firstParam = createEndpoint.pathParams[0];

package/dist/lib/api-client.d.ts

@@ -49,6 +49,7 @@ export declare function apiRequest<T = unknown>(method: string, path: string, op
     contentType?: string;
     contextName?: string;
     data?: unknown;
+    headers?: Record<string, string>;
     params?: Record<string, unknown>;
     responseType?: 'arraybuffer' | 'json' | 'stream' | 'text';
 }): Promise<ApiResponse<T>>;

package/dist/lib/api-client.js

@@ -132,6 +132,9 @@ export async function apiRequest(method, path, options = {}) {
     if (options.params) {
         config.params = options.params;
     }
+    if (options.headers) {
+        config.headers = { ...config.headers, ...options.headers };
+    }
     if (options.data) {
         config.data = options.data;
         // Auto-detect FormData and set appropriate headers

package/dist/lib/auth/index.js

@@ -4,6 +4,7 @@
  */
 import axios from 'axios';
 import { clearSupportSession, getAuthType, getBaseUrls, getContext, getSupportSession, missingCredentialsMessage, saveCachedTenants, saveSupportSession, saveTokens, SESSION_EXPIRED_MESSAGE, unauthorizedMessage, } from '../config.js';
+import { assertProductionAccess } from '../production-guard.js';
 import { AuthError, TenantMismatchError } from './errors.js';
 import { runBrowserFlow } from './flow.js';
 import { requireOAuthContext } from './guards.js';
@@ -49,6 +50,7 @@ function withTenantAssertion(rounds, tenantId) {
 }
 export async function login(context, options = {}) {
     requireOAuthContext(context, 'Browser login');
+    assertProductionAccess(context);
     return runBrowserFlow(context, keycloakProvider, [{ prompt: options.prompt }], {
         log: options.log,
         openBrowser: options.openBrowser,
@@ -99,6 +101,9 @@ export async function getValidToken(contextName) {
  */
 export async function getAuthHeaders(contextName) {
     const context = requireContext(contextName);
+    // Every API request fetches its headers here, so production is refused before
+    // a token is read or refreshed. `login` guards the minting of live tokens.
+    assertProductionAccess(context);
     if (getAuthType(context) === 'api_key') {
         if (!context.api_key) {
             throw new Error(missingCredentialsMessage(context));

package/dist/lib/production-guard.d.ts

@@ -0,0 +1,42 @@
+import { type Context } from './config.js';
+/**
+ * The Claude organisation of Aderis AG. From an aderis.com address, it is the
+ * only Claude account that may drive the `live` environment through this CLI.
+ */
+export declare const ADERIS_CLAUDE_ORGANIZATION_UUID = "f5d2d8c1-7256-4628-89d9-45c029577670";
+/** Staff addresses: the guard applies to these and to nobody else. */
+export declare const ADERIS_EMAIL_DOMAIN = "aderis.com";
+/** The Claude Code account that is running this process. */
+export interface ClaudeAccount {
+    email?: string;
+    organizationUuid?: string;
+}
+/** Thrown when a Claude account outside the Aderis organisation reaches for production. */
+export declare class ProductionAccessError extends Error {
+    constructor(message: string);
+}
+/**
+ * The Claude Code account driving this process, or `null` when no Claude Code
+ * session is (`CLAUDECODE` unset): a person at the terminal is not gated.
+ *
+ * Claude Code exports the account into the environment of every command it
+ * runs (`CLAUDE_CODE_USER_EMAIL`, `CLAUDE_CODE_ORGANIZATION_UUID`); whatever the
+ * environment lacks is filled in from the stored account file.
+ */
+export declare function detectClaudeAccount(env?: NodeJS.ProcessEnv, homedir?: string): ClaudeAccount | null;
+/** Whether an address belongs to Aderis staff (case-insensitive). */
+export declare function isAderisAddress(email?: string): boolean;
+/** The error shown when production is refused; names the account so the fix is obvious. */
+export declare function productionRefusedMessage(context: Context, account: ClaudeAccount): string;
+/**
+ * Refuses production for Aderis staff who drive the CLI from Claude Code with a
+ * Claude account outside the Aderis organisation, so no customer data passes
+ * through a personal Claude subscription. Fails exactly when all three hold:
+ * the context is `live`, the Claude account has an aderis.com address, and its
+ * organisation is not {@link ADERIS_CLAUDE_ORGANIZATION_UUID}.
+ *
+ * Runs before any token is read, refreshed or minted. It is a client-side
+ * tripwire against the accidental case, not a security boundary: the API
+ * cannot tell which Claude account made a call.
+ */
+export declare function assertProductionAccess(context: Context, account?: ClaudeAccount | null): void;

package/dist/lib/production-guard.js

@@ -0,0 +1,92 @@
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+/**
+ * The Claude organisation of Aderis AG. From an aderis.com address, it is the
+ * only Claude account that may drive the `live` environment through this CLI.
+ */
+export const ADERIS_CLAUDE_ORGANIZATION_UUID = 'f5d2d8c1-7256-4628-89d9-45c029577670';
+/** Staff addresses: the guard applies to these and to nobody else. */
+export const ADERIS_EMAIL_DOMAIN = 'aderis.com';
+/** Thrown when a Claude account outside the Aderis organisation reaches for production. */
+export class ProductionAccessError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'ProductionAccessError';
+    }
+}
+function nonEmpty(value) {
+    return typeof value === 'string' && value.trim() ? value.trim() : undefined;
+}
+/**
+ * Claude Code keeps the signed-in account in `.claude.json` under
+ * `oauthAccount`, in `$CLAUDE_CONFIG_DIR` or the home directory. Unreadable or
+ * malformed means "nothing known", never an error: the file is Claude's, not ours.
+ */
+function readStoredAccount(env, homedir) {
+    const dir = env.CLAUDE_CONFIG_DIR ? path.resolve(env.CLAUDE_CONFIG_DIR) : homedir;
+    try {
+        const parsed = JSON.parse(fs.readFileSync(path.join(dir, '.claude.json'), 'utf8'));
+        const account = parsed.oauthAccount;
+        if (!account || typeof account !== 'object')
+            return undefined;
+        return { email: nonEmpty(account.emailAddress), organizationUuid: nonEmpty(account.organizationUuid) };
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * The Claude Code account driving this process, or `null` when no Claude Code
+ * session is (`CLAUDECODE` unset): a person at the terminal is not gated.
+ *
+ * Claude Code exports the account into the environment of every command it
+ * runs (`CLAUDE_CODE_USER_EMAIL`, `CLAUDE_CODE_ORGANIZATION_UUID`); whatever the
+ * environment lacks is filled in from the stored account file.
+ */
+export function detectClaudeAccount(env = process.env, homedir = os.homedir()) {
+    if (!nonEmpty(env.CLAUDECODE))
+        return null;
+    const fromEnv = {
+        email: nonEmpty(env.CLAUDE_CODE_USER_EMAIL),
+        organizationUuid: nonEmpty(env.CLAUDE_CODE_ORGANIZATION_UUID),
+    };
+    if (fromEnv.email && fromEnv.organizationUuid)
+        return fromEnv;
+    const stored = readStoredAccount(env, homedir);
+    return {
+        email: fromEnv.email ?? stored?.email,
+        organizationUuid: fromEnv.organizationUuid ?? stored?.organizationUuid,
+    };
+}
+/** Whether an address belongs to Aderis staff (case-insensitive). */
+export function isAderisAddress(email) {
+    return email?.trim().toLowerCase().endsWith(`@${ADERIS_EMAIL_DOMAIN}`) ?? false;
+}
+/** The error shown when production is refused; names the account so the fix is obvious. */
+export function productionRefusedMessage(context, account) {
+    return (`Production access refused for context "${context.name}" (live): Claude Code is signed in as ` +
+        `${account.email} in Claude organisation ${account.organizationUuid ?? 'unknown'}, which is not the ` +
+        'Aderis organisation. Aderis staff may only reach production through a Claude account in the Aderis ' +
+        'organisation. Sign in to Claude Code with your Aderis Team account, or use a non-production context.');
+}
+/**
+ * Refuses production for Aderis staff who drive the CLI from Claude Code with a
+ * Claude account outside the Aderis organisation, so no customer data passes
+ * through a personal Claude subscription. Fails exactly when all three hold:
+ * the context is `live`, the Claude account has an aderis.com address, and its
+ * organisation is not {@link ADERIS_CLAUDE_ORGANIZATION_UUID}.
+ *
+ * Runs before any token is read, refreshed or minted. It is a client-side
+ * tripwire against the accidental case, not a security boundary: the API
+ * cannot tell which Claude account made a call.
+ */
+export function assertProductionAccess(context, account = detectClaudeAccount()) {
+    if (context.environment !== 'live')
+        return;
+    if (!account || !isAderisAddress(account.email))
+        return;
+    if (account.organizationUuid?.toLowerCase() === ADERIS_CLAUDE_ORGANIZATION_UUID)
+        return;
+    throw new ProductionAccessError(productionRefusedMessage(context, account));
+}