@bergetai/odoo-cli 0.9.2 → 0.12.0

package/README.md

@@ -16,10 +16,17 @@ Requires Node.js 20 or later.
 
 ```bash
 # Authenticate (API key via stdin — never as a flag)
-pass odoo/key | odoo auth login --url https://acme.odoo.com --db acme --username automation
+pass odoo/key | odoo auth login --profile production --url https://acme.odoo.com --db acme --username automation
+
+# Authenticate a second environment (kept side by side in one config)
+pass odoo/stage-key | odoo auth login --profile stage --url https://odoo.stage.berget.ai --db berget-stage --username automation
+
+# Always select the profile explicitly — commands never guess credentials
+odoo --profile production partners list --company --json
+ODOO_PROFILE=stage odoo partners list --company --json
 
 # Check credentials and their configuration sources
-odoo auth status --json
+odoo auth status --profile production --json
 
 # Unauthenticated connectivity check
 odoo version
@@ -65,6 +72,37 @@ odoo crm teams create --name "Partnerships" --team-leader alice@acme.com
 odoo crm teams update 5 --name "Direct Sales (renamed)" --dry-run
 odoo crm teams delete 5 --dry-run
 
+# Record attachments (ir.attachment) — explicit scope required
+odoo attachments list --res-model helpdesk.ticket --res-id 398 --json
+odoo attachments list --res-model mail.message --res-id 253924
+odoo attachments list --search "spec" --limit 100
+odoo attachments show 31337
+odoo attachments download 31337 --out ./spec.pdf
+odoo attachments delete 31337 --dry-run
+odoo attachments delete 31337
+
+# Marketing (mailing.*) — email is the key; trace deletion is always explicit
+odoo marketing lists list
+odoo marketing lists show 11
+odoo marketing contacts list --email person@example.com --json
+odoo marketing contacts list --list "Berget Code waitlist"
+odoo marketing contacts delete 441 --dry-run
+odoo marketing contacts delete 441
+odoo marketing traces list --email person@example.com --json
+odoo marketing traces delete 7001 --dry-run
+odoo marketing traces delete 7001
+
+# Sign-in identities (res.users) — show + guarded delete only
+odoo users show 9
+odoo users delete 9 --dry-run
+odoo users delete 9
+odoo users delete 9 3782 --json
+
+# Footprint (read-only) — everything tied to an email, with SOP dispositions
+odoo footprint person@example.com --json
+odoo footprint person@example.com                  # grouped human report
+odoo footprint person@example.com --active-only    # what the UI sees
+
 # Internal notes (NEVER sends email to customer)
 odoo helpdesk tickets add-note 398 --body "Internal note text"
 odoo helpdesk tickets add-note 398 --body-file note.md
@@ -77,12 +115,36 @@ odoo crm records message-delete 253924 258332 --dry-run
 odoo crm records message-delete 253924 258332
 ```
 
-Configuration precedence: flags > environment (`ODOO_URL`, `ODOO_DB`, `ODOO_USERNAME`, `ODOO_API_KEY`) > `$XDG_CONFIG_HOME/odoo/config.json`. The API key is never accepted as a flag value.
+Configuration precedence: flags > environment (`ODOO_URL`, `ODOO_DB`, `ODOO_USERNAME`, `ODOO_API_KEY`) > the selected profile in `$XDG_CONFIG_HOME/odoo/config.toml`. The API key is never accepted as a flag value.
+
+### Profiles
+
+Credentials are stored per **profile** — one TOML table per environment:
+
+```toml
+[profiles.production]
+url = "https://odoo.berget.ai"
+db = "berget"
+username = "automation"
+api_key = "…"
+server_version = "18.0+e"
+
+[profiles.stage]
+url = "https://odoo.stage.berget.ai"
+db = "berget-stage"
+username = "automation"
+api_key = "…"
+```
+
+Every command requires an explicit profile: pass `--profile <name>` or set `ODOO_PROFILE`. Without one the command exits 2 — credentials are never guessed, so a command can never hit the wrong environment by accident. `auth login` and the flags-only `odoo version` check tolerate a profile that does not exist yet (bootstrap), while any other command reports an unknown profile.
+
+Older configs (`config.json`, including top-level credential keys) keep working: they read as the `default` profile and migrate to `config.toml` on the next `auth login` — the legacy file is removed once the TOML config holds everything.
 
 Note: `odoo --version` prints the CLI's own version; `odoo version` queries the server.
 
 ## Features
 
+- Footprint overview (`footprint <email>`) — one read-only invocation that enumerates everything tied to an email across the erasure-relevant modules (`res.partner` incl. archived, `res.users`, `crm.lead`, `mailing.*`, `helpdesk.ticket`, `mail.message`, `ir.attachment`), correlates the found partners into the RESTRICT accounting surfaces (`account.move`/`sale.order` incl. invoice & shipping addresses, `account.payment`), and classifies every record by erasure disposition: `delete`, `anonymize` (referenced — shell, never unlink), `keep` (bokföringslagen 7-year retention), `review` (account roots, legal-claim branch, internal users, unverifiable attachment parents). `--json` emits a structured per-group payload (fixed 11-group key order, `totalRecords`, per-group `found`/`total` server count/`truncated`/`dispositions` tally, many2one tuples normalized to `{id, name}`) with a `commandHint` on each actionable record, a top-level `runOrder` (SOP execution order), and decision-grade fields on partner records (`child_ids`/`user_ids`/`vat`). Review records with out-of-footprint parents are resolved inline — the parent's name is embedded in the reason (bounded by a per-model fetch cap; beyond it records keep an `inspectHint`). Every record tells you what to run next — or already answers the question. Read-only by design: verification (art. 12.6) is a human step and the argument must already be the verified email; record-rule hidden rows (e.g. `user_notification` messages) mean the raw SQL pre-flight stays the authoritative evidence. Never mutates anything
 - Read-only CRM surface (`crm leads list/show`) — default columns, `--fields`/`--all-fields`, `--limit`/`--offset`/`--order`, `--domain`/`--filter` with `fields_get` type checking, reference resolution (`--stage`/`--team`/`--assignee`/`--tag`), table/JSON output with `search_count` envelope
 - Partners surface (`partners list/show/tags/create/update/delete`) — `res.partner` CRUD with `--company`/`--individual` filters, `--search` (case-insensitive name/email match), `--tag` (repeatable, resolves `res.partner.category` by exact name then ilike), `--archived` (include inactive), curated list columns (ID, Name, Company Type, City, Email, Is a Company, Tags, Salesperson), curated `show` view with tag names, salesperson, customer/supplier ranks plus every populated `x_studio*` custom field, `partners tags` (usage counts via `read_group`, sorted by usage), first-class mutation flags for `--name`, `--email`, `--phone`, `--website`, `--parent` (m2o), `--is-company`, `--street`, `--city`, `--zip`, `--country` (m2o), `--comment`, `--add-tag`/`--remove-tag` on update (unknown tags fail on add; removal silently skips tags the record lacks; protected fields `company_type` and `x_studio_invoice_approved` refuse writes), full `--dry-run` support, `--fields`/`--all-fields`, table/JSON output
 - Sales teams surface (`crm teams list/show/create/update/delete`) — `--archived` (include inactive teams), `--team-leader` (team leader, login/email/name), `--active`/`--use-leads`/`--use-opportunities`/`--invoiced-target`/`--color`/`--sequence`, full `--dry-run` support, `--fields`/`--all-fields`, table/JSON output
@@ -95,7 +157,7 @@ Note: `odoo --version` prints the CLI's own version; `odoo version` queries the
 - `--dry-run` for all mutations — full validation, resolution, and before/after diffs without mutating
 - Internal notes (`add-note`) — creates internal Log Notes only (subtype_id=2, message_type=comment), **NEVER sends email to customer**, by design prevents accidental customer communication. Optional `--author <email|name|id>` attributes the note to the partner who actually sent the logged message (resolved via `res.partner`; ambiguous matches list candidates and never guess)
 - Log note correction (`message-update`, `message-delete`) — repair formatting or remove duplicate log notes; strictly limited to comment-type messages (emails/notifications refused by design), full `--dry-run` support, unknown delete ids skipped
-- Config sources and precedence with atomic `0600` config writes, XML-RPC transport with timeouts and HTTPS enforcement, and an auth failure taxonomy (db missing / bad credentials / unreachable)
+- Config profiles (named environments in one `0600` config file, explicit `--profile`/`ODOO_PROFILE` selection), atomic config writes with legacy migration, XML-RPC transport with timeouts and HTTPS enforcement, and an auth failure taxonomy (db missing / bad credentials / unreachable)
 
 ## Compatibility
 

package/dist/cli.js

@@ -10,7 +10,12 @@ import { createTaskCommand, projectListCommand, projectShowCommand, tasksListCom
 import { documentsDocuments, documentsListCommand, foldersListCommand, documentsShowCommand, documentsCreateCommand, documentsUpdateCommand, documentsDeleteCommand, treeCommand, uploadCommand, downloadCommand, } from "./commands/documents.js";
 import { versionCommand } from "./commands/version.js";
 import { partnersCreateCommand, partnersDeleteCommand, partnersListCommand, partnersShowCommand, partnersTagsCommand, partnersUpdateCommand, resPartner, } from "./commands/partners.js";
+import { usersDeleteCommand, usersShowCommand, } from "./commands/users.js";
+import { attachmentsDeleteCommand, attachmentsDownloadCommand, attachmentsListCommand, attachmentsShowCommand, } from "./commands/attachments.js";
+import { messagesDeleteCommand, messagesListCommand, messagesScrubCommand, messagesShowCommand, } from "./commands/messages.js";
+import { contactsDeleteCommand, contactsListCommand, contactsShowCommand, listsListCommand, listsShowCommand, tracesDeleteCommand, tracesListCommand, tracesShowCommand, } from "./commands/marketing.js";
 import { modelsFieldsCommand, modelsReadCommand, } from "./commands/models.js";
+import { footprintCommand, } from "./commands/footprint.js";
 import { CliError } from "./errors.js";
 import { applyGlobalOptions, enforceTransportSecurity, DEFAULT_TIMEOUT, } from "./global-options.js";
 import { printError } from "./output.js";
@@ -55,9 +60,10 @@ CLI's own version, while \`odoo version\` queries the server's version.`)
         .configureHelp({ sortSubcommands: true });
     program.addHelpText("after", `
 Examples:
-  $ pass odoo/key | odoo auth login --url https://acme.odoo.com --db acme --username automation
-  $ odoo auth status --json
-  $ odoo version
+  $ pass odoo/key | odoo auth login --profile production --url https://acme.odoo.com --db acme --username automation
+  $ odoo auth login --profile stage --url https://stage.odoo.com --db stage --username automation
+  $ odoo auth status --profile production --json
+  $ odoo --profile production crm leads list
 
 Docs: https://www.odoo.com/documentation/18.0/developer/reference/external_api.html`);
     applyGlobalOptions(program);
@@ -73,8 +79,8 @@ Docs: https://www.odoo.com/documentation/18.0/developer/reference/external_api.h
         .description("verify credentials and write them to the config file (key via stdin/env/file)")
         .addHelpText("after", `
 Examples:
-  $ pass odoo/key | odoo auth login --url https://acme.odoo.com --db acme --username automation
-  $ ODOO_API_KEY=... odoo auth login --url https://acme.odoo.com --db acme --username automation`)
+  $ pass odoo/key | odoo auth login --profile production --url https://acme.odoo.com --db acme --username automation
+  $ ODOO_API_KEY=... odoo auth login --profile stage --url https://stage.odoo.com --db stage --username automation`)
         .action(async () => {
         await run(authLoginCommand, program);
     });
@@ -721,6 +727,320 @@ Examples:
         .action(async () => {
         await run((g) => partnersTagsCommand(g), program);
     });
+    const users = program
+        .command("users")
+        .description("sign-in identities (res.users)");
+    users
+        .command("show")
+        .description("read one user (portal login, email, linked partner; internal accounts included)")
+        .argument("<id>", "record id")
+        .option("--fields <a,b,c>", "fields to display")
+        .option("--all-fields", "display every readable field")
+        .addHelpText("after", `
+Examples:
+  $ odoo users show 3781
+  $ odoo users show 3781 --json`)
+        .action(async (id, opts) => {
+        await run((g) => usersShowCommand(id, opts, g), program);
+    });
+    users
+        .command("delete")
+        .description("delete portal users (preview with --dry-run; unknown ids are skipped)")
+        .argument("<id...>", "record ids")
+        .addHelpText("after", `
+Portal users only (share=true): any internal user (share=false) in the
+batch aborts the whole command — employees and service accounts are managed
+in the Odoo UI, never via the CLI.
+
+Order matters: delete the portal user BEFORE deleting their partner —
+res_users.partner_id is ondelete=restrict, so a surviving user makes the
+partner delete fail with an FK violation.
+
+Examples:
+  $ odoo users delete 3781 --dry-run
+  $ odoo users delete 3781
+  $ odoo users delete 3781 3782 --json`)
+        .action(async (ids) => {
+        await run((g) => usersDeleteCommand(ids, g), program);
+    });
+    const attachments = program
+        .command("attachments")
+        .description("record attachments (ir.attachment)");
+    attachments
+        .command("list")
+        .description("list attachments; REQUIRES a scope: --res-model, --res-id, and/or --search (AND-ed)")
+        .option("--res-model <model>", "filter by linked record model (soft reference)")
+        .option("--res-id <n>", "filter by linked record id")
+        .option("--search <text>", "ilike match on the attachment name")
+        .option("--domain <json>", "extra Odoo domain as a JSON array (AND-ed with the scope flags)")
+        .option("--limit <n>", "max records (default: 50)", "50")
+        .option("--offset <n>", "skip the first n records", "0")
+        .option("--order <order>", 'sort order, e.g. "create_date desc"', undefined)
+        .addHelpText("after", `
+The ir.attachment table also holds accounting report PDFs. Never browse
+or delete without a scope.
+
+Examples:
+  $ odoo attachments list --res-model helpdesk.ticket --res-id 398 --json
+  $ odoo attachments list --res-model mail.message --res-id 253924
+  $ odoo attachments list --search "spec" --limit 100
+  $ odoo attachments list --res-model crm.lead --domain '[["res_id","=",91]]'`)
+        .action(async (opts) => {
+        await run((g) => attachmentsListCommand(opts, g), program);
+    });
+    attachments
+        .command("show")
+        .description("read one attachment (metadata; the datas payload is excluded)")
+        .argument("<id>", "record id")
+        .option("--fields <a,b,c>", "fields to display")
+        .option("--all-fields", "display every readable field (includes datas)")
+        .action(async (id, opts) => {
+        await run((g) => attachmentsShowCommand(id, opts, g), program);
+    });
+    attachments
+        .command("download")
+        .description("decode the attachment payload to a local file (--out - for stdout)")
+        .argument("<id>", "record id")
+        .option("--out <path>", "output path ('-' for stdout; default: datas_fname/name)")
+        .option("--force", "overwrite an existing output file")
+        .action(async (id, opts) => {
+        await run((g) => attachmentsDownloadCommand(id, opts, g), program);
+    });
+    attachments
+        .command("delete")
+        .description("delete attachments explicitly (preview with --dry-run; unknown ids are skipped)")
+        .argument("<id...>", "record ids")
+        .addHelpText("after", `
+Attachments are NEVER removed automatically when their parent record is
+deleted (res_model/res_id is a soft link, no FK cascade) — deletion must be
+explicit. Scope the ids via 'attachments list' first.
+
+Examples:
+  $ odoo attachments delete 31337 --dry-run
+  $ odoo attachments delete 31337 31338`)
+        .action(async (ids) => {
+        await run((g) => attachmentsDeleteCommand(ids, g), program);
+    });
+    const messages = program
+        .command("messages")
+        .description("chatter messages (mail.message), erasure-scoped");
+    messages
+        .command("list")
+        .description("list chatter on a record; REQUIRES a scope: --res-model and/or --res-id (AND-ed); bodies excluded (length only)")
+        .option("--res-model <model>", "filter by parent record model (e.g. res.partner)")
+        .option("--res-id <n>", "filter by parent record id")
+        .option("--domain <json>", "extra Odoo domain as a JSON array (AND-ed with the scope flags)")
+        .option("--limit <n>", "max records (default: 50)", "50")
+        .option("--offset <n>", "skip the first n records", "0")
+        .option("--order <order>", 'sort order, e.g. "date desc"', undefined)
+        .addHelpText("after", `
+mail.message is a global chatter table across every model. Never browse
+or delete without a scope. Bodies are excluded from list output
+(body_length only); use 'messages show' for the full body.
+
+Examples:
+  $ odoo messages list --res-model res.partner --res-id 3201 --json
+  $ odoo messages show 295203`)
+        .action(async (opts) => {
+        await run((g) => messagesListCommand(opts, g), program);
+    });
+    messages
+        .command("show")
+        .description("read one message (full body and tracking value ids)")
+        .argument("<id>", "record id")
+        .option("--fields <a,b,c>", "fields to display")
+        .option("--all-fields", "display every readable field")
+        .action(async (id, opts) => {
+        await run((g) => messagesShowCommand(id, opts, g), program);
+    });
+    messages
+        .command("scrub")
+        .description("strip tracked-change residue (old values) and replace the body with an erasure marker (preview with --dry-run)")
+        .argument("<id...>", "message ids")
+        .requiredOption("--res-model <model>", "parent record model — every id is cross-checked against it")
+        .requiredOption("--res-id <n>", "parent record id — every id is cross-checked against it")
+        .option("--marker <text>", "replacement body text (plain text, escaped, wrapped in <p>); default is the fixed SOP marker")
+        .addHelpText("after", `
+Erasure SOP usage: removing personal data from a record leaves a chatter
+message whose tracking rows carry the PRE-change values (old email, old
+name). Scrub removes those rows and replaces the body with an erasure
+marker. Messages without tracking rows are skipped (never rewrite
+arbitrary chatter — use 'messages delete' for verified personal-data
+bodies). Dry-run shows the tracked FIELD NAMES, never the old values.
+The default marker is fixed SOP text; --marker exists because messages
+attach to many models — it may not contain an email-shaped token.
+
+Examples:
+  $ odoo messages scrub 295203 --res-model res.partner --res-id 3201 --dry-run
+  $ odoo messages scrub 295203 --res-model res.partner --res-id 3201
+  $ odoo messages scrub 5511 --res-model helpdesk.ticket --res-id 398 --marker "Ticket anonymized (erasure flow)"`)
+        .action(async (ids, opts) => {
+        await run((g) => messagesScrubCommand(ids, opts, g), program);
+    });
+    messages
+        .command("delete")
+        .description("delete chatter messages outright, for verified personal data in bodies (preview with --dry-run)")
+        .argument("<id...>", "message ids")
+        .requiredOption("--res-model <model>", "parent record model — every id is cross-checked against it")
+        .requiredOption("--res-id <n>", "parent record id — every id is cross-checked against it")
+        .addHelpText("after", `
+This is the escalation-scope weapon: verify (SQL/probe) that the message
+bodies actually contain personal data BEFORE deleting. For tracked-change
+residue use 'messages scrub' instead — it keeps the accountability trail.
+
+Examples:
+  $ odoo messages delete 44022 44028 --res-model res.partner --res-id 3201 --dry-run
+  $ odoo messages delete 44022 --res-model res.partner --res-id 3201`)
+        .action(async (ids, opts) => {
+        await run((g) => messagesDeleteCommand(ids, opts, g), program);
+    });
+    const marketing = program
+        .command("marketing")
+        .description("marketing lists, contacts, and send traces (mailing.*)");
+    const mlLists = marketing
+        .command("lists")
+        .description("mailing lists (mailing.list; read-only)");
+    mlLists
+        .command("list")
+        .description("list mailing lists")
+        .option("--search <text>", "ilike match on the list name")
+        .option("--domain <json>", "Odoo domain as a JSON array")
+        .option("--limit <n>", "max records (default: 50)", "50")
+        .option("--offset <n>", "skip the first n records", "0")
+        .option("--order <order>", 'sort order, e.g. "contact_count desc"', undefined)
+        .action(async (opts) => {
+        await run((g) => listsListCommand(opts, g), program);
+    });
+    mlLists
+        .command("show")
+        .description("read one mailing list (use --all-fields for subscriber ids)")
+        .argument("<id>", "record id")
+        .option("--fields <a,b,c>", "fields to display")
+        .option("--all-fields", "display every readable field")
+        .action(async (id, opts) => {
+        await run((g) => listsShowCommand(id, opts, g), program);
+    });
+    const mlContacts = marketing
+        .command("contacts")
+        .description("mailing contacts (mailing.contact)");
+    mlContacts
+        .command("list")
+        .description("list mailing contacts; --email is the identity-safe filter (email column only)")
+        .option("--search <text>", "ilike match on name OR email (interactive browsing)")
+        .option("--email <text>", "ilike match on email ONLY (identity-safe; exclusive with --search)")
+        .option("--list <name|id>", "filter by mailing list membership (resolved by name)")
+        .option("--domain <json>", "Odoo domain as a JSON array")
+        .option("--fields <a,b,c>", "columns to display")
+        .option("--limit <n>", "max records (default: 50)", "50")
+        .option("--offset <n>", "skip the first n records", "0")
+        .option("--order <order>", 'sort order, e.g. "email asc"', undefined)
+        .addHelpText("after", `
+Email is the only reliable key for a person (name matching showed casing
+variance in production): prefer --email over --search wherever the identity
+of the subject matters.
+
+Examples:
+  $ odoo marketing contacts list --email person@example.com --json
+  $ odoo marketing contacts list --list "Berget Code waitlist"
+  $ odoo marketing contacts delete 441 442 --dry-run`)
+        .action(async (opts) => {
+        await run((g) => contactsListCommand(opts, g), program);
+    });
+    mlContacts
+        .command("show")
+        .description("read one mailing contact (membership via --all-fields/list_ids)")
+        .argument("<id>", "record id")
+        .option("--fields <a,b,c>", "fields to display")
+        .option("--all-fields", "display every readable field")
+        .action(async (id, opts) => {
+        await run((g) => contactsShowCommand(id, opts, g), program);
+    });
+    mlContacts
+        .command("delete")
+        .description("delete mailing contacts (preview with --dry-run; unknown ids are skipped)")
+        .argument("<id...>", "record ids")
+        .addHelpText("after", `
+Deleting a contact does NOT delete the person's send traces: mailing.trace
+rows carry a denormalized email with no FK to the contact — erase both:
+  1. odoo marketing traces list --email <address>   → trace ids
+  2. odoo marketing traces delete <ids>
+
+Examples:
+  $ odoo marketing contacts delete 441 --dry-run
+  $ odoo marketing contacts delete 441 442`)
+        .action(async (ids) => {
+        await run((g) => contactsDeleteCommand(ids, g), program);
+    });
+    const mlTraces = marketing
+        .command("traces")
+        .description("per-recipient send traces (mailing.trace; denormalized email, no FK)");
+    mlTraces
+        .command("list")
+        .description("list send traces by denormalized email — independent of contact records")
+        .option("--email <text>", "ilike match on the trace email column")
+        .option("--mailing <name|id>", "filter by campaign (mailing.mailing, resolved by name)")
+        .option("--state <status>", 'filter by trace_status (e.g. "sent", "opened", "replied", "error")')
+        .option("--domain <json>", "Odoo domain as a JSON array")
+        .option("--fields <a,b,c>", "columns to display")
+        .option("--limit <n>", "max records (default: 50)", "50")
+        .option("--offset <n>", "skip the first n records", "0")
+        .option("--order <order>", 'sort order, e.g. "create_date desc"', undefined)
+        .action(async (opts) => {
+        await run((g) => tracesListCommand(opts, g), program);
+    });
+    mlTraces
+        .command("show")
+        .description("read one send trace")
+        .argument("<id>", "record id")
+        .option("--fields <a,b,c>", "fields to display")
+        .option("--all-fields", "display every readable field")
+        .action(async (id, opts) => {
+        await run((g) => tracesShowCommand(id, opts, g), program);
+    });
+    mlTraces
+        .command("delete")
+        .description("delete send traces explicitly (preview with --dry-run; unknown ids are skipped)")
+        .argument("<id...>", "record ids")
+        .addHelpText("after", `
+mailing.trace has NO FK to mailing.contact: deleting contacts never removes
+traces — deletion here is always explicit. Trace email is denormalized, so
+trace deletion never requires the contact record to exist.
+
+Examples:
+  $ odoo marketing traces list --email person@example.com --json
+  $ odoo marketing traces delete 7001 7002 --dry-run`)
+        .action(async (ids) => {
+        await run((g) => tracesDeleteCommand(ids, g), program);
+    });
+    program
+        .command("footprint")
+        .description("everything tied to an email across erasure-relevant modules, with SOP dispositions — read-only")
+        .argument("<email>", "the verified email of the data subject")
+        .option("--active-only", "search only active rows (default: active + archived — archived data is still personal data)")
+        .option("--limit <n>", "max records per group", "500")
+        .addHelpText("after", `
+Read-only overview for erasure handling (Flow A step 1 + the §6.2.4
+pre-flight): searches res.partner, res.users, crm.lead, mailing.*,
+helpdesk.ticket, mail.message and ir.attachment by email and correlates the
+found partners into the RESTRICT accounting surfaces (account.move /
+sale.order / account.payment) that decide unlink-vs-anonymize.
+
+Dispositions: delete | anonymize (referenced — shell, never unlink) | keep
+(bokföringslagen) | review (machine cannot decide: account roots,
+legal-claim branch, internal users, unverifiable attachment parents).
+
+Verification is a human step (art. 12.6): the argument must already be the
+VERIFIED email. Nothing is mutated — act through the per-module commands,
+--dry-run first. Archived rows are included by default; run the §6.2.4 SQL
+pre-flight as the authoritative evidence (record rules can hide rows).
+
+Examples:
+  $ odoo footprint person@example.com --json
+  $ odoo footprint person@example.com
+  $ odoo footprint person@example.com --active-only`)
+        .action(async (email, opts) => {
+        await run((g) => footprintCommand(email, opts, g), program);
+    });
     const models = program
         .command("models")
         .description("generic model introspection (any model with an XML-RPC API)");
@@ -769,6 +1089,7 @@ function collectGlobalOptions(program) {
     return {
         json: Boolean(o.json),
         dryRun: Boolean(o.dryRun),
+        profile: o.profile,
         url: o.url,
         db: o.db,
         username: o.username,

package/dist/commands/attachments.js

@@ -0,0 +1,158 @@
+import { stat, writeFile } from "node:fs/promises";
+import { resolve } from "node:path";
+import { Buffer } from "node:buffer";
+import { ModelFields } from "../model.js";
+import { authenticatedClient, parseId, showCommand, } from "../resource.js";
+import { deleteCommand } from "../mutation.js";
+import { notFoundError, usageError } from "../errors.js";
+import { colorEnabled, printJson } from "../output.js";
+import { parseDomain } from "../filter.js";
+import { humanCell } from "../table.js";
+/**
+ * ir.attachment surface (generic binary store behind soft res_model/res_id
+ * links). Read + download + delete only; no create/update. `list` REQUIRES an
+ * explicit scope (--res-model / --res-id / --search): the table also holds
+ * accounting report PDFs (bokföringsunderlag), and an unbounded dump would
+ * invite filter-less bulk deletion. Nothing in Odoo cascades attachment
+ * deletion when a parent record is removed, so erasure must call
+ * `attachments delete` explicitly (invariant 4).
+ */
+export const irAttachment = {
+    model: "ir.attachment",
+    showCommand: "odoo attachments show",
+    defaultListFields: [
+        "id",
+        "name",
+        "res_model",
+        "res_id",
+        "mimetype",
+        "file_size",
+        "create_date",
+    ],
+    showExtraFields: ["checksum", "create_uid", "write_date", "url", "write_uid"],
+    resolutionHints: {},
+    priorityLabels: {},
+    pinnedDomain: [],
+    references: {},
+};
+function parseCount(raw, flag) {
+    if (!/^\d+$/.test(raw)) {
+        throw usageError(`invalid ${flag} value ${JSON.stringify(raw)}`, "expected a non-negative integer");
+    }
+    return Number(raw);
+}
+export async function attachmentsListCommand(opts, globals) {
+    const client = await authenticatedClient(globals);
+    const resId = opts.resId !== undefined ? parseCount(opts.resId, "--res-id") : undefined;
+    // Scope guard: never browse the whole ir.attachment table. It holds
+    // accounting PDFs alongside erasure-relevant files, so an unbounded dump
+    // is a footgun both to read and to delete from.
+    if (opts.resModel === undefined && resId === undefined && !opts.search) {
+        throw usageError("attachments list requires an explicit scope", "pass --res-model (e.g. `--res-model helpdesk.ticket`), --res-id, and/or --search; combine freely, they are AND-ed");
+    }
+    const limit = parseCount(opts.limit, "--limit");
+    const offset = parseCount(opts.offset, "--offset");
+    const fieldsMeta = await ModelFields.load(client, "ir.attachment");
+    // No `active` field on ir.attachment (no archive machinery): plain
+    // search_read/search_count without an active_test context.
+    const domain = [];
+    if (opts.resModel !== undefined)
+        domain.push(["res_model", "=", opts.resModel]);
+    if (resId !== undefined)
+        domain.push(["res_id", "=", resId]);
+    if (opts.search)
+        domain.push(["name", "ilike", opts.search]);
+    if (opts.domain)
+        domain.push(...parseDomain(opts.domain));
+    const order = opts.order ?? "id asc";
+    const [records, count] = await Promise.all([
+        client.executeKw("ir.attachment", "search_read", [domain], {
+            fields: irAttachment.defaultListFields,
+            limit,
+            offset,
+            order,
+        }),
+        client.executeKw("ir.attachment", "search_count", [
+            domain,
+        ]),
+    ]);
+    if (globals.json) {
+        printJson({ model: "ir.attachment", records, count, limit, offset });
+        return;
+    }
+    const headers = irAttachment.defaultListFields.map((f) => fieldsMeta.get(f)?.string ?? f);
+    const rows = records.map((rec) => headers.map((_, i) => humanCell(rec[irAttachment.defaultListFields[i]])));
+    process.stdout.write(formatPlainTable(headers, rows, colorEnabled(globals.noColor)) + "\n");
+}
+/** Aligned key-value-free table; TTY coloring matches other list commands. */
+function formatPlainTable(headers, rows, _color) {
+    const widths = headers.map((h, i) => Math.max(h.length, ...rows.map((r) => r[i].length)));
+    const fmt = (cells) => cells
+        .map((c, i) => c.padEnd(widths[i]))
+        .join("  ")
+        .trimEnd();
+    const lines = [fmt(headers)];
+    for (const r of rows)
+        lines.push(fmt(r));
+    return lines.join("\n");
+}
+export function attachmentsShowCommand(idArg, opts, globals) {
+    return showCommand(irAttachment, idArg, opts, globals);
+}
+export function attachmentsDeleteCommand(idArgs, globals) {
+    return deleteCommand(irAttachment, idArgs, globals);
+}
+/**
+ * Read `datas` (base64 of the filestore payload) and write decoded bytes to
+ * --out (or "-" for stdout, or a default derived from datas_fname/name).
+ * Modeled on the `documents download` implementation.
+ */
+export async function attachmentsDownloadCommand(idArg, opts, globals) {
+    const id = parseId(idArg);
+    const client = await authenticatedClient(globals);
+    await ModelFields.load(client, "ir.attachment");
+    const rows = (await client.executeKw("ir.attachment", "read", [[id]], {
+        fields: ["name", "datas", "mimetype", "url"],
+    }));
+    if (rows.length === 0) {
+        throw notFoundError("record_not_found", `no ir.attachment record with id ${id}`);
+    }
+    const rec = rows[0];
+    if (rec.datas === false || rec.datas === "") {
+        throw usageError(`attachment ${id} "${rec.name}" has no file content`, "url-style attachments store a link instead of bytes" +
+            (rec.url ? ` (\u0022${rec.url}\u0022)` : " (check the url field)"));
+    }
+    const buffer = Buffer.from(rec.datas, "base64");
+    if (opts.out === "-") {
+        process.stdout.write(buffer);
+        return;
+    }
+    const defaultName = rec.name || `ir.attachment.${id}.bin`;
+    const outPath = resolve(opts.out ?? defaultName);
+    try {
+        await stat(outPath);
+        if (!opts.force) {
+            throw usageError(`file already exists: ${outPath}`, "pass --force to overwrite");
+        }
+    }
+    catch (err) {
+        if (err.code !== "ENOENT")
+            throw err;
+    }
+    await writeFile(outPath, buffer);
+    if (globals.json) {
+        printJson({
+            model: "ir.attachment",
+            action: "download",
+            id,
+            name: rec.name,
+            path: outPath,
+            file_size: buffer.length,
+            mimetype: rec.mimetype,
+        });
+        return;
+    }
+    const color = colorEnabled(false) && process.stdout.isTTY === true;
+    const line = `Downloaded ir.attachment ${id} → ${outPath} (${buffer.length} bytes)`;
+    process.stdout.write((color ? `\x1b[32m${line}\x1b[0m` : line) + "\n");
+}