@carthooks/arcubase-cli 0.1.18 → 0.1.20

package/src/runtime/execute.ts

@@ -10,6 +10,7 @@ import { getBodySchema, getCommandDocHints, getDocHints, getTypeHints, getUnsupp
 import { resolveArcubaseSDKPath } from './paths.js'
 import { compileCSVImportMapping, compileExcelImportMapping, type CompiledEntityImportConfig } from './entity_import_mapping.js'
 import { uploadLocalFileWithToken } from './local_upload.js'
+import { renderCommandHelpExamples } from './help_examples.js'
 
 export type CommandExecutionSummary = {
   scope: CommandScope
@@ -64,12 +65,39 @@ function buildUnknownCommandDetails(scope: CommandScope, moduleName: string, com
   return suggestions.length > 0 ? { suggestions } : undefined
 }
 
+function throwHelpExamplesRequiresCommand(scope: CommandScope, moduleName?: string): never {
+  const binary = binaryForScope(scope)
+  const suggestions = scope === 'admin'
+    ? [
+        `${binary} access-rule create --help-examples`,
+        `${binary} access-rule assign-users --help-examples`,
+      ]
+    : [
+        `${binary} row bulk-update --help-examples`,
+        `${binary} row selection-action --help-examples`,
+      ]
+  throw new CLIError(
+    'HELP_EXAMPLES_REQUIRES_COMMAND',
+    '--help-examples must follow a final command',
+    2,
+    {
+      operation: moduleName ? `${binary} ${moduleName} --help-examples` : `${binary} --help-examples`,
+      hint: `retry with a final command, for example: ${suggestions[0]}`,
+      suggestions,
+    },
+  )
+}
+
 type EnvInput = Record<string, string | undefined>
 
 function sdkPath(file: string, env: EnvInput = process.env): string {
   return resolveArcubaseSDKPath(file, env)
 }
 
+function binaryForScope(scope: CommandScope): string {
+  return scope === 'admin' ? 'arcubase-admin' : 'arcubase'
+}
+
 export function renderCommandHelp(scope: CommandScope, moduleName: string, commandName?: string, env: EnvInput = process.env): string {
   const command = findCommand(scope, moduleName, commandName)
   if (!command) {
@@ -92,6 +120,7 @@ export function renderCommandHelp(scope: CommandScope, moduleName: string, comma
     command.requestType ? `body: ${bodyTypeText} via --body-json <json-string> | --body-file <file>.json` : 'body: none',
     queryFlags.length ? `query flags: ${queryFlags.join(', ')}, --query-file` : 'query flags: --query-file',
     pathFlags.length ? `path flags: ${pathFlags.join(', ')}` : 'path flags: none',
+    `copyable examples: ${scope === 'admin' ? 'arcubase-admin' : 'arcubase'} ${command.commandPath.join(' ')} --help-examples`,
     ...(isTableCreate
       ? [
           'body-json example:',
@@ -130,19 +159,19 @@ export function renderCommandHelp(scope: CommandScope, moduleName: string, comma
           `  - hide field: ${JSON.stringify(buildHiddenFieldAccessRuleBody())}`,
           'success requires:',
           '  - result.enabled must be true',
-          '  - options.user_scope[].type is "user" for tenant users',
+          '  - options.user_scope[].type is "user", "department", or "actor"',
           '  - hidden fields use colon field keys such as ":1002"',
         ]
       : []),
     ...(scope === 'admin' && command.commandPath[0] === 'access-rule' && command.commandPath[1] === 'assign-users'
       ? [
           'body-json example:',
-          '  - {"update":["user_scope"],"options":{"user_scope":[{"type":"user","id":2188889901}]}}',
+          '  - {"update":["user_scope"],"options":{"user_scope":[{"type":"user","id":2188889901},{"type":"department","id":2188881201},{"type":"actor","id":2188883301}]}}',
           'success requires:',
           '  - result.enabled must be true',
-          '  - result.options.user_scope must contain the assigned numeric arcubaseUserId values',
-          '  - PermitUserScope.id must be the numeric arcubaseUserId',
-          '  - Do not copy a non-numeric arcubaseUserId into PermitUserScope.id',
+          '  - result.options.user_scope must contain every assigned user, department, or actor scope',
+          '  - PermitUserScope.id must be the numeric arcubaseUserId, department ID, or actor ID',
+          '  - Do not copy a non-numeric BotWorks userId into PermitUserScope.id',
           '  - If result.enabled is false, enable the rule first and retry assign-users',
         ]
       : []),
@@ -248,7 +277,7 @@ function buildScalarQuery(command: ReturnType<typeof findCommand>, flags: Record
 }
 
 function validateKnownFlags(command: NonNullable<ReturnType<typeof findCommand>>, flags: Record<string, string | boolean>, env: EnvInput = process.env) {
-  const allowed = new Set<string>(['help', 'body-file', 'body-json', 'query-file'])
+  const allowed = new Set<string>(['help', 'help-examples', 'body-file', 'body-json', 'query-file'])
   for (const mapping of command.pathParams) {
     if (!getFixedValue(mapping)) {
       allowed.add(mapping.flag)
@@ -697,14 +726,18 @@ function buildAssignUsersValidationDetails(
     shapeHint: {
       update: ['user_scope'],
       options: {
-        user_scope: [{ type: 'user', id: 2188889901 }],
+        user_scope: [
+          { type: 'user', id: 2188889901 },
+          { type: 'department', id: 2188881201 },
+          { type: 'actor', id: 2188883301 },
+        ],
       },
     },
     commonMistakes: [
       'do not use user_scope at top level',
       'do not use users or allowedUsers',
-      'do not use non-numeric arcubaseUserId as id',
-      'id must be the numeric arcubaseUserId',
+      'do not use non-numeric BotWorks userId as id',
+      'id must be the numeric arcubaseUserId, department ID, or actor ID',
     ],
   }
 }
@@ -1004,7 +1037,7 @@ function validateAccessRuleUserScope(
   if (userScope === undefined) return
   if (!Array.isArray(userScope)) {
     throwBodyValidationFailure(
-      'access-rule user_scope must be an array of {"type":"user","id":2188889901}',
+        'access-rule user_scope must be an array of {"type":"user","id":2188889901}, {"type":"department","id":2188881201}, or {"type":"actor","id":2188883301}',
       requestType,
       pathPrefix,
       scope,
@@ -1047,6 +1080,38 @@ function validateAccessRuleUserScope(
   }
 }
 
+function normalizeNumericAccessRuleUserScopeIDs(
+  scope: CommandScope,
+  command: NonNullable<ReturnType<typeof findCommand>>,
+  body: unknown,
+): unknown {
+  if (!isAccessRuleCommand(scope, command) || !isRecord(body) || !isRecord(body.options) || !Array.isArray(body.options.user_scope)) {
+    return body
+  }
+
+  let changed = false
+  const userScope = body.options.user_scope.map((item) => {
+    if (!isRecord(item) || typeof item.id !== 'string' || !/^\d+$/.test(item.id)) {
+      return item
+    }
+    const id = Number(item.id)
+    if (!Number.isFinite(id) || !Number.isInteger(id)) {
+      return item
+    }
+    changed = true
+    return { ...item, id }
+  })
+
+  if (!changed) return body
+  return {
+    ...body,
+    options: {
+      ...body.options,
+      user_scope: userScope,
+    },
+  }
+}
+
 function requireUpdateContains(
   scope: CommandScope,
   command: NonNullable<ReturnType<typeof findCommand>>,
@@ -1081,7 +1146,7 @@ function validateActionSpecificRawBody(
   if (isAssignUsersCommand(scope, command)) {
     if ('users' in body || 'allowedUsers' in body || 'user_scope' in body) {
       throwBodyValidationFailure(
-        'access-rule assign-users only accepts body.options.user_scope with {"update":["user_scope"],"options":{"user_scope":[{"type":"user","id":2188889901}]}}',
+        'access-rule assign-users only accepts body.options.user_scope with {"update":["user_scope"],"options":{"user_scope":[{"type":"user","id":2188889901},{"type":"department","id":2188881201},{"type":"actor","id":2188883301}]}}',
         command.requestType,
         'body.options.user_scope',
         scope,
@@ -1213,7 +1278,7 @@ function validateActionSpecificBody(
     const userScope = options && Array.isArray(options.user_scope) ? options.user_scope : undefined
     if ('users' in body || 'allowedUsers' in body) {
       throwBodyValidationFailure(
-        'access-rule assign-users only accepts body.options.user_scope with {"update":["user_scope"],"options":{"user_scope":[{"type":"user","id":2188889901}]}}',
+        'access-rule assign-users only accepts body.options.user_scope with {"update":["user_scope"],"options":{"user_scope":[{"type":"user","id":2188889901},{"type":"department","id":2188881201},{"type":"actor","id":2188883301}]}}',
         command.requestType,
         'body.options.user_scope',
         scope,
@@ -1254,19 +1319,9 @@ function validateActionSpecificBody(
           env,
         )
       }
-      if (item.type !== 'user') {
-        throwBodyValidationFailure(
-          'access-rule assign-users requires body.options.user_scope[].type to be "user"',
-          command.requestType,
-          `body.options.user_scope.${index}.type`,
-          scope,
-          command,
-          env,
-        )
-      }
       if (typeof item.id !== 'number' || !Number.isInteger(item.id) || item.id <= 0) {
         throwBodyValidationFailure(
-          'access-rule assign-users requires body.options.user_scope[].id to be numeric arcubaseUserId',
+          'access-rule assign-users requires body.options.user_scope[].id to be numeric arcubaseUserId, department ID, or actor ID',
           command.requestType,
           `body.options.user_scope.${index}.id`,
           scope,
@@ -2011,16 +2066,32 @@ export async function executeCLI(scope: CommandScope, argv: string[], env?: Runt
   const parsed = parseCLIArgs(argv)
   const envInput = env ?? process.env
   if (parsed.commandTokens.length === 0) {
+    if (hasFlag(parsed.flags, 'help-examples')) {
+      throwHelpExamplesRequiresCommand(scope)
+    }
     return { kind: 'help', text: renderRootHelp(scope) }
   }
   const [moduleName, commandName] = parsed.commandTokens
   if (!moduleName) {
+    if (hasFlag(parsed.flags, 'help-examples')) {
+      throwHelpExamplesRequiresCommand(scope)
+    }
     return { kind: 'help', text: renderRootHelp(scope) }
   }
   const singleTokenCommand = !commandName ? findCommand(scope, moduleName) : null
   if (!commandName && !singleTokenCommand) {
+    if (hasFlag(parsed.flags, 'help-examples')) {
+      throwHelpExamplesRequiresCommand(scope, moduleName)
+    }
     return { kind: 'help', text: renderModuleHelp(scope, moduleName, envInput) }
   }
+  if (hasFlag(parsed.flags, 'help-examples')) {
+    const command = commandName ? findCommand(scope, moduleName, commandName) : singleTokenCommand
+    if (!command) {
+      throw new CLIError('UNKNOWN_COMMAND', `unknown command: ${moduleName}${commandName ? ` ${commandName}` : ''}`, 2, buildUnknownCommandDetails(scope, moduleName, commandName ?? ''))
+    }
+    return { kind: 'help', text: renderCommandHelpExamples(scope, command) }
+  }
   if (hasFlag(parsed.flags, 'help')) {
     return { kind: 'help', text: renderCommandHelp(scope, moduleName, commandName, envInput) }
   }
@@ -2071,6 +2142,7 @@ export async function executeCLI(scope: CommandScope, argv: string[], env?: Runt
     if (body === undefined) {
       throw new CLIError('MISSING_BODY_FILE', `command requires --body-json or --body-file for ${command.requestType}; prefer --body-json to avoid file creation`, 2)
     }
+    body = normalizeNumericAccessRuleUserScopeIDs(scope, command, body)
     if (isTableCreateCommand(scope, command)) {
       requireTableCreateSchemaBody(scope, command, body, runtimeEnv)
       validateActionSpecificRawBody(scope, command, body, runtimeEnv)
@@ -2108,16 +2180,17 @@ export async function executeCLI(scope: CommandScope, argv: string[], env?: Runt
         const message = parsedBody.error.issues.map((issue) => `${issue.path.join('.')}: ${issue.message}`).join('; ')
         if (isAssignUsersCommand(scope, command)) {
           const hasUserScopeIDIssue = parsedBody.error.issues.some((issue) => issue.path.join('.') === 'options.user_scope.0.id' || issue.path.join('.').startsWith('options.user_scope.'))
+          const userScopeIDMessage = 'access-rule assign-users requires body.options.user_scope[].id to be numeric arcubaseUserId, department ID, or actor ID'
           throw new CLIError(
             'BODY_VALIDATION_FAILED',
-            hasUserScopeIDIssue ? 'access-rule assign-users requires body.options.user_scope[].id to be numeric arcubaseUserId' : message,
+            hasUserScopeIDIssue ? userScopeIDMessage : message,
             2,
             buildAssignUsersValidationDetails(
               scope,
               command,
               command.requestType,
               hasUserScopeIDIssue ? 'body.options.user_scope' : 'body',
-              hasUserScopeIDIssue ? 'access-rule assign-users requires body.options.user_scope[].id to be numeric arcubaseUserId' : message,
+              hasUserScopeIDIssue ? userScopeIDMessage : message,
               runtimeEnv,
             )
           )

package/src/runtime/help_examples.ts

@@ -0,0 +1,61 @@
+import { helpExamplesIndex } from '../generated/help_examples.generated.js'
+import type { CommandDef, CommandScope } from './command_registry.js'
+
+type HelpExample = {
+  title: string
+  body?: unknown
+  notes?: readonly string[]
+}
+
+function binaryForScope(scope: CommandScope): string {
+  return scope === 'admin' ? 'arcubase-admin' : 'arcubase'
+}
+
+function getFixedValue(value: object): string | undefined {
+  if (!('fixedValue' in value)) {
+    return undefined
+  }
+  const fixedValue = (value as { fixedValue?: unknown }).fixedValue
+  return typeof fixedValue === 'string' ? fixedValue : undefined
+}
+
+function pathFlagPlaceholders(command: CommandDef): string {
+  const parts = command.pathParams
+    .filter((item) => !getFixedValue(item))
+    .map((item) => `--${item.flag} <${item.flag.replace(/-/g, '_')}>`)
+  return parts.length > 0 ? `${parts.join(' ')} ` : ''
+}
+
+function helpExampleKey(scope: CommandScope, command: CommandDef): string {
+  return `${scope}.${command.commandPath.join('.')}`
+}
+
+export function getCommandHelpExamples(scope: CommandScope, command: CommandDef): readonly HelpExample[] {
+  return (helpExamplesIndex as Record<string, { examples?: readonly HelpExample[] } | undefined>)[helpExampleKey(scope, command)]?.examples ?? []
+}
+
+export function renderCommandHelpExamples(scope: CommandScope, command: CommandDef): string {
+  const binary = binaryForScope(scope)
+  const examples = getCommandHelpExamples(scope, command)
+  const header = `${binary} ${command.commandPath.join(' ')} --help-examples`
+  if (examples.length === 0) {
+    return [
+      header,
+      '',
+      'No dedicated examples for this final command yet.',
+      `Use ${binary} ${command.commandPath.join(' ')} --help for flags, docs, and type paths.`,
+    ].join('\n')
+  }
+  return [
+    header,
+    '',
+    ...examples.flatMap((example) => [
+      `${example.title}:`,
+      ...(example.body === undefined
+        ? []
+        : [`  ${binary} ${command.commandPath.join(' ')} ${pathFlagPlaceholders(command)}--body-json '${JSON.stringify(example.body)}'`.replace(/\s+/g, ' ').trim()]),
+      ...(example.notes ?? []).map((note) => `  - ${note}`),
+      '',
+    ]),
+  ].join('\n').trimEnd()
+}

package/src/tests/execute_validation.test.ts

@@ -55,14 +55,18 @@ function assertAssignUsersGuidance(error: unknown, messagePattern?: RegExp): boo
   assert.deepEqual(error.details?.shapeHint, {
     update: ['user_scope'],
     options: {
-      user_scope: [{ type: 'user', id: 2188889901 }],
+      user_scope: [
+        { type: 'user', id: 2188889901 },
+        { type: 'department', id: 2188881201 },
+        { type: 'actor', id: 2188883301 },
+      ],
     },
   })
   assert.deepEqual(error.details?.commonMistakes, [
     'do not use user_scope at top level',
     'do not use users or allowedUsers',
-    'do not use non-numeric arcubaseUserId as id',
-    'id must be the numeric arcubaseUserId',
+    'do not use non-numeric BotWorks userId as id',
+    'id must be the numeric arcubaseUserId, department ID, or actor ID',
   ])
   assert.ok(error.details?.tsHints?.some((item) => item.symbol === 'AppIngressUpdateReqVO' && item.file === '/runtime/arcubase-sdk/types/ingress.ts'))
   assert.ok(error.details?.tsHints?.some((item) => item.symbol === 'EntityIngressOptions' && item.file === '/runtime/arcubase-sdk/types/ingress.ts'))
@@ -1318,7 +1322,7 @@ test('access-rule assign-users rejects top-level user_scope', async () => {
   }, (error: unknown) => assertAssignUsersGuidance(error, /options.user_scope/))
 })
 
-test('access-rule assign-users rejects non-user member scope type', async () => {
+test('access-rule assign-users rejects FieldVO member scope type', async () => {
   await assert.rejects(async () => {
     await executeCLI(
       'admin',
@@ -1326,10 +1330,10 @@ test('access-rule assign-users rejects non-user member scope type', async () =>
       env as any,
       async () => new Response('{}', { status: 200 }),
     )
-  }, (error: unknown) => assertAssignUsersGuidance(error, /type.*user/))
+  }, (error: unknown) => assertAssignUsersGuidance(error, /user.*department.*actor|FieldVO type "member"/))
 })
 
-test('access-rule assign-users rejects non-numeric arcubaseUserId', async () => {
+test('access-rule assign-users rejects non-numeric user scope id', async () => {
   await assert.rejects(async () => {
     await executeCLI(
       'admin',
@@ -1337,17 +1341,91 @@ test('access-rule assign-users rejects non-numeric arcubaseUserId', async () =>
       env as any,
       async () => new Response('{}', { status: 200 }),
     )
-  }, (error: unknown) => assertAssignUsersGuidance(error, /numeric arcubaseUserId/))
+  }, (error: unknown) => assertAssignUsersGuidance(error, /numeric arcubaseUserId, department ID, or actor ID/))
 })
 
-test('access-rule assign-users accepts canonical user_scope body', async () => {
+test('access-rule create normalizes numeric string user_scope ids before validation and request', async () => {
   const out = await executeCLI(
     'admin',
-    ['access-rule', 'assign-users', '--app-id', 'app_1', '--table-id', 'table_1', '--rule-id', 'rule_1', '--body-json', '{"update":["user_scope"],"options":{"user_scope":[{"type":"user","id":2188889901}]}}'],
+    ['access-rule', 'create', '--app-id', 'app_1', '--table-id', 'table_1', '--body-json', '{"name":"Role read","enabled":true,"type":"form","options":{"user_scope":[{"type":"actor","id":"2188883301"}],"policy":{"key":"custom","actions":["view"],"all_fields_read":true,"all_fields_write":false},"list_options":{}}}'],
+    env as any,
+    async (_url, init) => new Response(String(init?.body ?? '{}'), { status: 200 }),
+  )
+  assert.equal(out.kind, 'result')
+  assert.deepEqual(out.data.options.user_scope, [{ type: 'actor', id: 2188883301 }])
+})
+
+test('access-rule assign-users normalizes numeric string user_scope ids before validation and request', async () => {
+  const out = await executeCLI(
+    'admin',
+    ['access-rule', 'assign-users', '--app-id', 'app_1', '--table-id', 'table_1', '--rule-id', 'rule_1', '--body-json', '{"update":["user_scope"],"options":{"user_scope":[{"type":"user","id":"2188889901"},{"type":"department","id":"2188881201"},{"type":"actor","id":"2188883301"}]}}'],
+    env as any,
+    async (_url, init) => new Response(String(init?.body ?? '{}'), { status: 200 }),
+  )
+  assert.equal(out.kind, 'result')
+  assert.deepEqual(out.data.update, ['user_scope'])
+  assert.deepEqual(out.data.options.user_scope, [
+    { type: 'user', id: 2188889901 },
+    { type: 'department', id: 2188881201 },
+    { type: 'actor', id: 2188883301 },
+  ])
+})
+
+test('access-rule assign-users accepts canonical mixed user_scope body', async () => {
+  const out = await executeCLI(
+    'admin',
+    ['access-rule', 'assign-users', '--app-id', 'app_1', '--table-id', 'table_1', '--rule-id', 'rule_1', '--body-json', '{"update":["user_scope"],"options":{"user_scope":[{"type":"user","id":2188889901},{"type":"department","id":2188881201},{"type":"actor","id":2188883301}]}}'],
     env as any,
     async (_url, init) => new Response(String(init?.body ?? '{}'), { status: 200 }),
   )
   assert.equal(out.kind, 'result')
   assert.deepEqual(out.data.update, ['user_scope'])
-  assert.deepEqual(out.data.options.user_scope, [{ type: 'user', id: 2188889901 }])
+  assert.deepEqual(out.data.options.user_scope, [
+    { type: 'user', id: 2188889901 },
+    { type: 'department', id: 2188881201 },
+    { type: 'actor', id: 2188883301 },
+  ])
+})
+
+test('access-rule create accepts nested custom policy condition with field columns', async () => {
+  const body = JSON.stringify({
+    name: 'Sales own or west region',
+    enabled: true,
+    type: 'form',
+    options: {
+      user_scope: [{ type: 'department', id: 2188881201 }],
+      policy: {
+        key: 'custom',
+        actions: ['view', 'add', 'edit'],
+        all_fields_read: true,
+        all_fields_write: true,
+        condition: {
+          mode: 'and',
+          conditions: [
+            {
+              subset: {
+                mode: 'or',
+                conditions: [
+                  { column: 'creator', operator: '$eq', value: '[[current_user]]' },
+                  { column: ':1002', operator: '$eq', value: '[[current_user]]' },
+                ],
+              },
+            },
+            { column: ':1003', operator: '$eq', value: '华东' },
+          ],
+        },
+      },
+      list_options: {},
+    },
+  })
+  const out = await executeCLI(
+    'admin',
+    ['access-rule', 'create', '--app-id', 'app_1', '--table-id', 'table_1', '--body-json', body],
+    env as any,
+    async (_url, init) => new Response(String(init?.body ?? '{}'), { status: 200 }),
+  )
+  assert.equal(out.kind, 'result')
+  assert.equal(out.data.options.policy.condition.mode, 'and')
+  assert.equal(out.data.options.policy.condition.conditions[0].subset.mode, 'or')
+  assert.equal(out.data.options.policy.condition.conditions[0].subset.conditions[1].column, ':1002')
 })

package/src/tests/help.test.ts

@@ -120,14 +120,48 @@ test('admin access-rule help gives update whitelist and assign-users body-json e
   const assign = await executeCLI('admin', ['access-rule', 'assign-users', '--help'], env as any, async () => new Response('{}'))
   assert.equal(assign.kind, 'help')
   assert.match(assign.text, /"update":\["user_scope"\]/)
-  assert.match(assign.text, /\{"update":\["user_scope"\],"options":\{"user_scope":\[\{"type":"user","id":2188889901\}\]\}\}/)
+  assert.match(assign.text, /\{"update":\["user_scope"\],"options":\{"user_scope":\[\{"type":"user","id":2188889901\},\{"type":"department","id":2188881201\},\{"type":"actor","id":2188883301\}\]\}\}/)
   assert.match(assign.text, /arcubaseUserId/)
+  assert.match(assign.text, /department ID/)
+  assert.match(assign.text, /actor ID/)
   assert.doesNotMatch(assign.text, forbiddenArcubaseUserTerms())
   assert.doesNotMatch(assign.text, /"type":"member"/)
   assert.doesNotMatch(assign.text, /"users"/)
   assert.doesNotMatch(assign.text, /"allowedUsers"/)
 })
 
+test('help-examples requires a final command', async () => {
+  await assert.rejects(
+    () => executeCLI('admin', ['--help-examples'], env as any, async () => new Response('{}')),
+    { code: 'HELP_EXAMPLES_REQUIRES_COMMAND' },
+  )
+  await assert.rejects(
+    () => executeCLI('admin', ['access-rule', '--help-examples'], env as any, async () => new Response('{}')),
+    { code: 'HELP_EXAMPLES_REQUIRES_COMMAND' },
+  )
+})
+
+test('admin access-rule create help-examples show canonical ingress scopes and conditions', async () => {
+  const out = await executeCLI('admin', ['access-rule', 'create', '--help-examples'], env as any, async () => new Response('{}'))
+  assert.equal(out.kind, 'help')
+  assert.match(out.text, /arcubase-admin access-rule create --help-examples/)
+  assert.match(out.text, /"type":"department"/)
+  assert.match(out.text, /"type":"actor"/)
+  assert.match(out.text, /"column":"creator","operator":"\$eq","value":"\[\[current_user\]\]"/)
+  assert.match(out.text, /"subset":\{"mode":"or"/)
+  assert.doesNotMatch(out.text, forbiddenArcubaseUserTerms())
+  assert.doesNotMatch(out.text, /"type":"member"/)
+})
+
+test('user row bulk-update help-examples show ids and condition selection bodies', async () => {
+  const out = await executeCLI('user', ['row', 'bulk-update', '--help-examples'], env as any, async () => new Response('{}'))
+  assert.equal(out.kind, 'help')
+  assert.match(out.text, /arcubase row bulk-update --help-examples/)
+  assert.match(out.text, /"selection":\{"type":"ids"/)
+  assert.match(out.text, /"selection":\{"type":"condition"/)
+  assert.match(out.text, /"action":\{"type":"set"/)
+})
+
 test('admin assign-users help uses arcubaseUserId terminology', async () => {
   const help = await executeCLI('admin', ['access-rule', 'assign-users', '--help'], env as any, async () => new Response('{}'))
   assert.equal(help.kind, 'help')

package/src/tests/zod_registry.test.ts

@@ -41,6 +41,44 @@ test('EntityQueryReqVO search only accepts route-query string keys', () => {
   }
 })
 
+test('AppIngressCreateReqVO accepts nested ConditionSet with field EntityProp columns', () => {
+  const schema = getBodySchema('AppIngressCreateReqVO')
+  assert.ok(schema)
+
+  const result = schema.safeParse({
+    name: 'Sales own or west region',
+    enabled: true,
+    type: 'form',
+    options: {
+      user_scope: [{ type: 'department', id: 2188881201 }],
+      policy: {
+        key: 'custom',
+        actions: ['view', 'add', 'edit'],
+        all_fields_read: true,
+        all_fields_write: true,
+        condition: {
+          mode: 'and',
+          conditions: [
+            {
+              subset: {
+                mode: 'or',
+                conditions: [
+                  { column: 'creator', operator: '$eq', value: '[[current_user]]' },
+                  { column: ':1002', operator: '$eq', value: '[[current_user]]' },
+                ],
+              },
+            },
+            { column: ':1003', operator: '$eq', value: '华东' },
+          ],
+        },
+      },
+      list_options: {},
+    },
+  })
+
+  assert.equal(result.success, true)
+})
+
 test('unknown request type has no schema and no unsupported reason', () => {
   assert.equal(getBodySchema('DefinitelyMissingReqVO'), null)
   assert.equal(getUnsupportedBodySchemaReason('DefinitelyMissingReqVO'), null)