@aiaiai-pt/martha-cli 0.48.0 → 0.50.0

package/CHANGELOG.md

@@ -4,6 +4,16 @@ All notable changes to `@aiaiai-pt/martha-cli`. Format: [Keep a Changelog](https
 
 ## [Unreleased]
 
+## [0.49.0] — 2026-07-15
+
+### Added — UMS-gated second-party approval governance (#583 G1+G2)
+
+- `martha approvals` now surfaces the server-computed requester, required-group
+  snapshot, and whether the current viewer can resolve the case. Resolution
+  remains server-authoritative and reports typed group/self-approval failures.
+- `martha policy` and `martha approvals` consistently honor `--api-url`, including
+  machine-readable `--json` workflows against non-default Martha deployments.
+
 ## [0.48.0] — 2026-07-13
 
 ### Changed — BREAKING: `martha runner` means ONE thing (#714 runner-journey unification)

package/dist/index.js

@@ -11119,7 +11119,7 @@ init_config();
 init_errors();
 
 // src/version.ts
-var CLI_VERSION = "0.48.0";
+var CLI_VERSION = "0.50.0";
 
 // src/commands/sessions.ts
 function relativeTime(iso) {
@@ -16983,13 +16983,11 @@ init_errors();
 function registerApprovalCommands(program2) {
   const cmd = program2.command("approvals").description("Manage approval cases");
   function getCtx() {
-    const ctx = createContext({
+    return createContext({
       profileOverride: program2.opts().profile,
+      apiUrlOverride: program2.opts().apiUrl,
       verbose: program2.opts().verbose
     });
-    if (program2.opts().apiUrl)
-      ctx.profile.api_url = program2.opts().apiUrl;
-    return ctx;
   }
   function isJson() {
     return !!program2.opts().json;
@@ -20916,13 +20914,11 @@ function assertOneOf(value, allowed, flag) {
 function registerPolicyCommands(program2) {
   const cmd = program2.command("policy").description("Manage the tenant's invoke-time capability policy");
   function getCtx() {
-    const ctx = createContext({
+    return createContext({
       profileOverride: program2.opts().profile,
+      apiUrlOverride: program2.opts().apiUrl,
       verbose: program2.opts().verbose
     });
-    if (program2.opts().apiUrl)
-      ctx.profile.api_url = program2.opts().apiUrl;
-    return ctx;
   }
   const isJson = () => !!program2.opts().json;
   cmd.command("show").description("Show the current policy: settings + rules").action(async () => {
@@ -21208,6 +21204,8 @@ ${typed.hint}
 // src/commands/authz.ts
 var DEFAULT_ENTITY = "document_collection";
 var DEFAULT_ACTION = "read";
+var APPROVAL_ENTITY = "approval";
+var RESOLVE_ACTION = "resolve";
 function registerAuthzCommands(program2) {
   function getCtx() {
     const ctx = createContext({
@@ -21222,6 +21220,7 @@ function registerAuthzCommands(program2) {
   registerCollections(program2, getCtx, isJson);
   registerAccess(program2, getCtx, isJson);
   registerGroups(program2, getCtx, isJson);
+  registerApprovers(program2, getCtx, isJson);
 }
 function renderGrantsTable(resp) {
   if (resp.grants.length === 0) {
@@ -21479,6 +21478,71 @@ function registerGroups(program2, getCtx, isJson) {
     }
   });
 }
+function registerApprovers(program2, getCtx, isJson) {
+  const cmd = program2.command("approvers").description("Manage who may resolve approval cases in the tenant (UMS approval/resolve). " + "Noun-first sugar over `access` on the approval entity.");
+  cmd.command("add <group>").description("Make a group a tenant approver (its members can resolve approvals)").option("--tenant <tenant>", "Target tenant (super-admin only)").action(async (group, opts) => {
+    const ctx = getCtx();
+    const json = isJson();
+    try {
+      await grant(ctx, {
+        granteeType: "group",
+        granteeId: group,
+        entityType: APPROVAL_ENTITY,
+        action: RESOLVE_ACTION,
+        objectId: null,
+        tenant: opts.tenant
+      });
+      emitOk(json, {
+        status: "approver_added",
+        entity_type: APPROVAL_ENTITY,
+        action: RESOLVE_ACTION,
+        grantee: `group:${group}`,
+        text: `Group ${group} can now resolve approvals in this tenant.`
+      });
+    } catch (err) {
+      emitAuthzError(err, json);
+    }
+  });
+  cmd.command("remove <group>").description("Remove a group's tenant approver binding").option("--tenant <tenant>", "Target tenant (super-admin only)").action(async (group, opts) => {
+    const ctx = getCtx();
+    const json = isJson();
+    try {
+      await revoke(ctx, {
+        granteeType: "group",
+        granteeId: group,
+        entityType: APPROVAL_ENTITY,
+        action: RESOLVE_ACTION,
+        objectId: null,
+        tenant: opts.tenant
+      });
+      emitOk(json, {
+        status: "approver_removed",
+        grantee: `group:${group}`,
+        text: `Group ${group} can no longer resolve approvals in this tenant.`
+      });
+    } catch (err) {
+      emitAuthzError(err, json);
+    }
+  });
+  cmd.command("list").description("Show which groups may resolve approvals in the tenant").option("--tenant <tenant>", "Target tenant (super-admin only)").action(async (opts) => {
+    const ctx = getCtx();
+    const json = isJson();
+    try {
+      const resp = await listGrants(ctx, {
+        entityType: APPROVAL_ENTITY,
+        action: RESOLVE_ACTION,
+        tenant: opts.tenant
+      });
+      if (json) {
+        console.log(JSON.stringify(resp, null, 2));
+      } else {
+        console.log(renderGrantsTable(resp));
+      }
+    } catch (err) {
+      emitAuthzError(err, json);
+    }
+  });
+}
 function emitOk(json, payload) {
   if (json) {
     const rest = { ...payload };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiaiai-pt/martha-cli",
-  "version": "0.48.0",
+  "version": "0.50.0",
   "description": "Terminal-first client for the Martha AI platform",
   "homepage": "https://docs.martha.nomadriver.co",
   "repository": {