@apex-actions/cli 0.73.1 → 0.74.0

package/dist/cli/environment/main.js

@@ -59,7 +59,7 @@ const setCommand = new Command('set')
     .argument('<repository>', 'owner/repo')
     .argument('<name>', 'environment name, as the workflow spells it')
     .option('--wait-timer <minutes>', 'delay before the job may start; 0 removes it', (v) => Number(v))
-    .option('--reviewer <who...>', 'user:<login>, team:<org/slug>, or a bare login (a user)')
+    .option('--reviewer <who...>', 'user:<login>, role:<owner|account_admin|billing|member|viewer>, or a bare login (a user)')
     .option('--branch-pattern <glob...>', 'refs permitted to deploy here (main, releases/*, v?.0)')
     .option('--prevent-self-review', 'refuse an approval from whoever triggered the run')
     .option('--allow-self-review', 'permit it (the default)')
@@ -78,7 +78,7 @@ const setCommand = new Command('set')
         for (const raw of opts.reviewer) {
             const parsed = parseReviewer(raw);
             if (!parsed) {
-                console.error(chalk.red(`expected user:<login>, team:<org/slug> or a bare login, got ${JSON.stringify(raw)}`));
+                console.error(chalk.red(`expected user:<login>, role:<owner|account_admin|billing|member|viewer> or a bare login, got ${JSON.stringify(raw)}`));
                 process.exitCode = 2;
                 return;
             }

package/dist/cli/tenant/main.js

@@ -1,8 +1,8 @@
 import { Command } from 'commander';
 import chalk from 'chalk';
 import { listDepartures, purgeDeparture } from '../../src/application/manage-departures.js';
-import { backfillAccounts } from '../../src/application/manage-accounts.js';
-import { backfillLines } from '../../src/domain/accounts.js';
+import { backfillAccounts, connectInstallation, listUnconnected } from '../../src/application/manage-accounts.js';
+import { backfillLines, connectLine, unconnectedLine } from '../../src/domain/accounts.js';
 import { HttpControlPlane, NotConfiguredError } from '../../src/infrastructure/control-plane-http.js';
 import { countsLine, departureLine } from '../../src/domain/departures.js';
 /** Build the API client, or explain what is missing and stop. */
@@ -103,8 +103,64 @@ const backfillCommand = new Command('backfill')
     if (!outcome.value.applied)
         console.log(chalk.yellow('\nNothing was changed. Review the above, then re-run with --apply.'));
 });
+const unconnectedCommand = new Command('unconnected')
+    .description('Installations no Apex Account owns, the longest-waiting first — their people are refused until connected (decisions-log O20)')
+    .option('--json', 'machine-readable output')
+    .action(async (opts) => {
+    const client = api();
+    if (!client)
+        return;
+    const outcome = await listUnconnected(client);
+    if (outcome.kind === 'refused') {
+        console.error(chalk.red(outcome.message));
+        process.exitCode = 1;
+        return;
+    }
+    if (opts.json === true) {
+        console.log(JSON.stringify(outcome.value, null, 2));
+        return;
+    }
+    if (outcome.value.length === 0) {
+        console.log(chalk.green('every installation is connected to an Account'));
+        return;
+    }
+    const now = new Date();
+    for (const i of outcome.value)
+        console.log(`  ${unconnectedLine(i, now)}`);
+    console.log(chalk.dim('\nConnect one with: apex tenant connect <installationId> --owner <github-login> [--name <Account name>]'));
+});
+const connectCommand = new Command('connect')
+    .description('Connect one installation to the Account --owner owns, creating it with them its Owner when they own none (decisions-log O20)')
+    .argument('<installationId>', 'the installation to connect (see: apex tenant unconnected)')
+    .requiredOption('--owner <login>', 'the GitHub login of the Account’s Owner; they must have signed in once')
+    .option('--name <name>', 'the Account’s name — required when the Owner owns no Account yet')
+    .option('--json', 'machine-readable output')
+    .action(async (raw, opts) => {
+    const installationId = Number(raw);
+    if (!Number.isSafeInteger(installationId) || installationId <= 0) {
+        console.error(chalk.red(`expected a positive installation id, got ${JSON.stringify(raw)}`));
+        process.exitCode = 2;
+        return;
+    }
+    const client = api();
+    if (!client)
+        return;
+    const outcome = await connectInstallation(client, { installationId, ownerLogin: opts.owner, name: opts.name });
+    if (outcome.kind === 'refused') {
+        console.error(chalk.red(outcome.message));
+        process.exitCode = 1;
+        return;
+    }
+    if (opts.json === true) {
+        console.log(JSON.stringify(outcome.value, null, 2));
+        return;
+    }
+    console.log(`${chalk.green('✔')} ${connectLine(outcome.value)}`);
+});
 export default new Command('tenant')
-    .description('Tenants: who left and deleting their data on request, and the one-time move into Accounts')
+    .description('Tenants: connecting new installations to Accounts, who left and deleting their data on request, and the one-time move into Accounts')
     .addCommand(departuresCommand)
     .addCommand(purgeCommand)
-    .addCommand(backfillCommand);
+    .addCommand(backfillCommand)
+    .addCommand(unconnectedCommand)
+    .addCommand(connectCommand);

package/dist/src/application/manage-accounts.js

@@ -10,3 +10,25 @@ export const backfillAccounts = async (api, input, apply) => {
         return { kind: 'refused', message: err instanceof Error ? err.message : String(err) };
     }
 };
+const refusal = (err) => ({ kind: 'refused', message: err instanceof Error ? err.message : String(err) });
+/** The installations waiting for an operator (decisions-log O20), the longest-waiting first. */
+export const listUnconnected = async (api) => {
+    try {
+        return { kind: 'ok', value: await api.accountsUnconnected() };
+    }
+    catch (err) {
+        return refusal(err);
+    }
+};
+/**
+ * Connect one installation to the Account `ownerLogin` owns — created, with them
+ * its Owner, when they own none. The operator's step until onboarding (TASK-0204).
+ */
+export const connectInstallation = async (api, input) => {
+    try {
+        return { kind: 'ok', value: await api.accountsConnect(input) };
+    }
+    catch (err) {
+        return refusal(err);
+    }
+};

package/dist/src/application/manage-environments.js

@@ -1,4 +1,6 @@
 // application layer — see ../../../../docs/conventions.md §1
+/** The Account roles a reviewer may name (ADR-0033), exactly as the control plane accepts them. */
+export const REVIEWER_ROLES = ['owner', 'account_admin', 'billing', 'member', 'viewer'];
 const refused = (err) => ({ kind: 'refused', detail: err instanceof Error ? err.message : String(err) });
 export const listEnvironments = async (api, owner, repo) => {
     try {
@@ -26,8 +28,9 @@ export const deleteEnvironment = async (api, owner, repo, name) => {
     }
 };
 /**
- * `user:ana`, `team:acme/platform`, or a bare name (a user, because that is
- * what people mean when they type one).
+ * `user:ana`, `role:account_admin`, or a bare name (a user, because that is
+ * what people mean when they type one). A GitHub team no longer approves
+ * (decisions-log O20), so `team:` is refused rather than sent.
  */
 export const parseReviewer = (raw) => {
     const [head, ...rest] = raw.split(':');
@@ -40,8 +43,8 @@ export const parseReviewer = (raw) => {
         return undefined;
     if (head === 'user')
         return { type: 'user', name };
-    if (head === 'team')
-        return name.includes('/') ? { type: 'team', name } : undefined;
+    if (head === 'role')
+        return REVIEWER_ROLES.includes(name) ? { type: 'role', name } : undefined;
     return undefined;
 };
 export const listDeployments = async (api, runId) => {

package/dist/src/domain/accounts.js

@@ -31,3 +31,14 @@ export const backfillLines = (r) => {
         lines.push('Notes:', ...r.notes.map((n) => `  ${n}`));
     return lines;
 };
+const waited = (seenAt, now) => {
+    const minutes = Math.max(0, Math.floor((now.getTime() - Date.parse(seenAt)) / 60_000));
+    if (minutes < 60)
+        return `${minutes} min`;
+    const hours = Math.floor(minutes / 60);
+    return hours < 48 ? `${hours} h` : `${Math.floor(hours / 24)} d`;
+};
+/** One waiting installation as a line: who, which installation, and for how long. */
+export const unconnectedLine = (i, now) => `${i.login} (${i.type === 'User' ? 'personal account' : 'organization'}) — installation ${i.installationId}, waiting ${waited(i.seenAt, now)}`;
+/** A connection as a line, saying whether the Account was made for it. */
+export const connectLine = (c) => `${c.organization.login} (installation ${c.organization.installationId}) connected to ${c.account.created ? 'the new Account' : 'the Account'} ${c.account.name} (${c.account.id})`;

package/dist/src/infrastructure/control-plane-http.js

@@ -223,6 +223,12 @@ export class HttpControlPlane {
     async accountsBackfill(input, apply) {
         return await this.#json('POST', `/api/v1/admin/accounts/backfill${apply ? '?apply=true' : ''}`, input);
     }
+    async accountsUnconnected() {
+        return (await this.#json('GET', '/api/v1/admin/accounts/unconnected')).installations;
+    }
+    async accountsConnect(input) {
+        return await this.#json('POST', '/api/v1/admin/accounts/connect', input);
+    }
     async actionPolicy(owner) {
         return await this.#json('GET', `/api/v1/orgs/${encodeURIComponent(owner)}/action-policy`);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@apex-actions/cli",
-  "version": "0.73.1",
+  "version": "0.74.0",
   "license": "SEE LICENSE IN LICENSE",
   "//files": "Without this npm ships src, test and the CI config alongside the binary a user installs.",
   "files": [