@apex-actions/cli 0.100.0 → 0.101.0

package/dist/cli/grant/main.js

@@ -5,7 +5,8 @@ import { createGrantBody, createdLine, grantLine, revokedLine, updateGrantBody }
 import { HttpControlPlane, NotConfiguredError } from '../../src/infrastructure/control-plane-http.js';
 /**
  * `apex grant`: complimentary access from the terminal (api ADR-0056 as amended by api ADR-0079,
- * TASK-0199). The admin API's own shapes, unchanged. Every write needs a person: the operator token
+ * TASK-0199). The admin API's own shapes, unchanged. A grant belongs to an Account and covers every Organization in it
+ * but the operator's (decisions-log O66, O73), so `create` names an Account, never an installation. Every write needs a person: the operator token
  * `apex login --console` saved, whose operator the grant row and the audit log name. The machine token
  * (`APEX_ADMIN_TOKEN`) can list and is refused every write, so a leaked one cannot make a free tenant.
  */
@@ -57,15 +58,15 @@ const listCommand = new Command('list')
         console.log(`  ${grantLine(g)}`);
 });
 const createCommand = new Command('create')
-    .description('Grant an installation complimentary access, replacing any open grant it holds — recorded against you')
-    .argument('<installationId>', 'the GitHub App installation (see: apex tenant installations --fresh)')
+    .description("Grant an Account complimentary access, replacing any open grant it holds — its Organizations share the minutes; recorded against you")
+    .requiredOption('--account <id>', 'the Account the grant belongs to (see: apex tenant installations — connect a fresh installation to an Account first)')
     .requiredOption('--minutes <n>', 'standard minutes per calendar month, 1 to 80,000')
     .requiredOption('--concurrency <n>', 'jobs at once, 1 to 50')
     .requiredOption('--reason <text>', 'who this is for and why they run free, up to 500 characters — stored on the grant')
     .option('--until <YYYY-MM-DD>', 'the grant ends at the end of that UTC day (default: open-ended)')
     .option('--json', 'machine-readable output')
-    .action(async (installation, opts) => {
-    const body = createGrantBody(installation, opts, new Date());
+    .action(async (opts) => {
+    const body = createGrantBody(opts.account, opts, new Date());
     if (!body.ok) {
         usage(body.problem);
         return;
@@ -108,13 +109,13 @@ const updateCommand = new Command('update')
         console.log(JSON.stringify(grant, null, 2));
         return;
     }
-    console.log(`${chalk.green('✔')} Changed the grant for ${grant.owner}.`);
+    console.log(`${chalk.green('✔')} Changed the grant for ${grant.accountName}.`);
     console.log(`  ${grantLine(grant)}`);
 });
 const revokeCommand = new Command('revoke')
     .description('End a grant now: new runs are refused, queued free work is cancelled with a reason, and running work finishes')
     .argument('<grantId>', 'the grant (see: apex grant list)')
-    .option('--yes', 'confirm — revoking cannot be undone; the organisation does not fall back to the pre-trial minutes')
+    .option('--yes', 'confirm — revoking cannot be undone; the Account’s Organizations do not fall back to the pre-trial minutes')
     .option('--json', 'machine-readable output')
     .action(async (id, opts) => {
     if (opts.yes !== true) {

package/dist/cli/tenant/main.js

@@ -223,7 +223,7 @@ const connectCommand = new Command('connect')
     console.log(`${chalk.green('✔')} ${connectLine(outcome.value)}`);
 });
 const installationsCommand = new Command('installations')
-    .description("Every installation of the App as GitHub lists it, with what Apex knows of each — --fresh for those the tenants list never shows, which a grant needs the id of")
+    .description("Every installation of the App as GitHub lists it, with what Apex knows of each and the Account it is in — --fresh for those the tenants list never shows")
     .option('--fresh', 'only installations that never ran, paid or were granted')
     .option('--json', 'machine-readable output')
     .action(async (opts) => {
@@ -253,7 +253,7 @@ const installationsCommand = new Command('installations')
     }
     for (const i of outcome.value)
         console.log(`  ${installationLine(i)}`);
-    console.log(chalk.dim('\nGrant one with: apex grant create <installationId> --minutes <n> --concurrency <n> --reason "<why>"'));
+    console.log(chalk.dim('\nA grant belongs to an Account: connect an installation with apex tenant connect, then grant with: apex grant create --account <accountId> --minutes <n> --concurrency <n> --reason "<why>"'));
 });
 export default new Command('tenant')
     .description('Tenants: every installation of the App, connecting new ones to Accounts, who left and deleting their data on request, and the one-time move into Accounts')

package/dist/src/application/manage-grants.js

@@ -10,7 +10,7 @@ const attempt = async (fn) => {
 /** Every grant ever made, newest first. The control plane decides who may read them. */
 export const listGrants = async (api) => await attempt(() => api.listGrants());
 /**
- * Grant an installation complimentary access, replacing any open grant it holds. Only a person may: the
+ * Grant an Account complimentary access, replacing any open grant it holds (O73). Only a person may: the
  * control plane records the operator the token belongs to, and refuses the machine token.
  */
 export const createGrant = async (api, body) => await attempt(() => api.createGrant(body));

package/dist/src/domain/accounts.js

@@ -25,7 +25,7 @@ export const backfillLines = (r) => {
     if (r.subscriptions.length > 0)
         lines.push('Subscriptions:', ...r.subscriptions.map((s) => `  ${s.owner} (${s.status}): ${SUB_VERB[s.action][t]}`));
     if (r.grants.length > 0) {
-        lines.push('Open grants — unchanged here; choose the one to keep when the claim pools per Account:', ...r.grants.map((g) => `  ${g.owner}: ${g.minutesPerMonth} minutes a month, ${g.concurrency} concurrent${g.expiresAt === undefined ? '' : `, until ${g.expiresAt.slice(0, 10)}`}`));
+        lines.push('The Account’s open grant — unchanged here; it covers every Organization in the Account:', ...r.grants.map((g) => `  ${g.id}: ${g.minutesPerMonth} minutes a month, ${g.concurrency} concurrent${g.expiresAt === undefined ? '' : `, until ${g.expiresAt.slice(0, 10)}`}`));
     }
     if (r.notes.length > 0)
         lines.push('Notes:', ...r.notes.map((n) => `  ${n}`));

package/dist/src/domain/grants.js

@@ -3,7 +3,8 @@
  * Complimentary access from the terminal (api ADR-0056 as amended by
  * api ADR-0079, TASK-0199): the grant and installation shapes the admin API
  * answers with, the checks `apex grant` makes before a round trip — the
- * control plane makes them again — and how each reads as a line.
+ * control plane makes them again — and how each reads as a line. A grant belongs to an Account and covers
+ * its Organizations, the operator's left out (decisions-log O66, O73).
  */
 /** The admin API's limits on a grant (control-plane `domain/grant.ts`): the largest plan's — Business's 80,000 since the re-pricing (O48). */
 export const MAX_GRANT_MINUTES = 80_000;
@@ -31,11 +32,13 @@ export const endOfDay = (day, now) => {
 };
 const minutesProblem = `--minutes must be a whole number from 1 to ${MAX_GRANT_MINUTES.toLocaleString('en-US')}`;
 const concurrencyProblem = `--concurrency must be a whole number from 1 to ${MAX_GRANT_CONCURRENCY}`;
-/** `apex grant create`'s arguments, checked. */
-export const createGrantBody = (installation, flags, now) => {
-    const installationId = whole(installation, 1, Number.MAX_SAFE_INTEGER);
-    if (installationId === undefined)
-        return { ok: false, problem: `expected a positive installation id, got ${JSON.stringify(installation)}` };
+/** An Account id is the control plane's own text; this only refuses one that cannot be. */
+const MAX_ACCOUNT_ID = 200;
+/** `apex grant create`'s arguments, checked: `account` is `--account`, the Account the grant belongs to (O73). */
+export const createGrantBody = (account, flags, now) => {
+    const accountId = account?.trim() ?? '';
+    if (accountId === '' || accountId.length > MAX_ACCOUNT_ID || /\s/.test(accountId))
+        return { ok: false, problem: `--account must be an Account id (see: apex tenant installations), got ${JSON.stringify(account ?? '')}` };
     const minutesPerMonth = whole(flags.minutes, 1, MAX_GRANT_MINUTES);
     if (minutesPerMonth === undefined)
         return { ok: false, problem: minutesProblem };
@@ -46,9 +49,9 @@ export const createGrantBody = (installation, flags, now) => {
     if (reason === '' || reason.length > MAX_GRANT_REASON)
         return { ok: false, problem: `--reason is required, up to ${MAX_GRANT_REASON} characters — who this is for, and why they run free` };
     if (flags.until === undefined)
-        return { ok: true, value: { installationId, minutesPerMonth, concurrency, reason } };
+        return { ok: true, value: { accountId, minutesPerMonth, concurrency, reason } };
     const until = endOfDay(flags.until, now);
-    return until.ok ? { ok: true, value: { installationId, minutesPerMonth, concurrency, reason, expiresAt: until.value } } : until;
+    return until.ok ? { ok: true, value: { accountId, minutesPerMonth, concurrency, reason, expiresAt: until.value } } : until;
 };
 /** `apex grant update`'s flags, checked: at least one change, each well-formed, and not both an end date and none. */
 export const updateGrantBody = (flags, now) => {
@@ -80,18 +83,22 @@ export const updateGrantBody = (flags, now) => {
     return { ok: true, value: body };
 };
 const day = (iso) => iso?.slice(0, 10);
+/** The Organizations a grant covers, by login — or that it covers none yet. */
+export const coveredLine = (g) => g.organizations.length === 0 ? 'no Organization yet' : g.organizations.map((o) => o.login).join(', ');
+/** Whose a grant is: the Account, and the Organizations that share it. */
+const whose = (g) => `${g.accountName} (Account ${g.accountId}; covers ${coveredLine(g)})`;
 /** One grant as a line: whose, how it stands, the month so far, and who granted it and why. */
 export const grantLine = (g) => {
     const used = g.usedMinutes === undefined ? '' : `${Math.floor(g.usedMinutes).toLocaleString('en-US')} of `;
     const state = g.state === 'ended' ? `ended ${day(g.endedAt ?? g.revokedAt) ?? ''}${g.revokedBy === undefined ? '' : ` by ${g.revokedBy}`}`.trim() : g.dormant ? `${g.state}, dormant — they pay for a plan` : g.state;
     const until = g.expiresAt === undefined ? '' : `, until ${day(g.expiresAt) ?? ''}`;
-    return `${g.id}  ${g.owner} (installation ${g.installationId}) — ${state}; ${used}${g.minutesPerMonth.toLocaleString('en-US')} minutes a month, ${g.concurrency} at once${until}; granted by ${g.grantedBy}: ${g.reason}`;
+    return `${g.id}  ${whose(g)}${g.madeOn === undefined ? '' : `, made on ${g.madeOn}`} — ${state}; ${used}${g.minutesPerMonth.toLocaleString('en-US')} minutes a month, ${g.concurrency} at once${until}; granted by ${g.grantedBy}: ${g.reason}`;
 };
 /** What a create means, in the Console's words: open, a replacement, or dormant behind a subscription. */
 export const createdLine = (c) => c.dormant
-    ? `Granted to ${c.grant.owner}. They pay for a plan, so the grant is dormant until they stop.`
-    : `Granted to ${c.grant.owner}.${c.superseded === undefined ? '' : ' It replaces the grant they held.'}`;
-export const revokedLine = (r) => `Revoked the grant for ${r.grant.owner}.${r.cancelledJobs > 0 ? ` ${r.cancelledJobs} queued job${r.cancelledJobs === 1 ? ' was' : 's were'} cancelled.` : ''}`;
+    ? `Granted to ${c.grant.accountName}. They pay for a plan, so the grant is dormant until they stop.`
+    : `Granted to ${c.grant.accountName}.${c.superseded === undefined ? '' : ' It replaces the grant the Account held.'}`;
+export const revokedLine = (r) => `Revoked the grant for ${r.grant.accountName}.${r.cancelledJobs > 0 ? ` ${r.cancelledJobs} queued job${r.cancelledJobs === 1 ? ' was' : 's were'} cancelled.` : ''}`;
 /** One installation as a line: whose, and what Apex knows of it — or that it is new. */
 export const installationLine = (i) => {
     const known = [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@apex-actions/cli",
-  "version": "0.100.0",
+  "version": "0.101.0",
   "license": "SEE LICENSE IN LICENSE",
   "//files": "Without this npm ships src, test and the CI config alongside the binary a user installs.",
   "files": [