@carthooks/arcubase-cli 0.1.20 → 0.1.22

package/src/runtime/zod_registry.ts

@@ -89,12 +89,32 @@ const conditionDocHint: RuntimeDocHint = {
   title: 'Condition',
   file: 'docs/runtime-reference/condition.md',
 }
+const dashboardDocHint: RuntimeDocHint = {
+  title: 'Dashboard',
+  file: 'docs/runtime-reference/dashboard.md',
+}
+const widgetsDocHint: RuntimeDocHint = {
+  title: 'Widgets',
+  file: 'docs/runtime-reference/widgets.md',
+}
 
 const docHintIndex: Record<string, RuntimeDocHint[]> = {
   AppCreateByTenantsReqVO: [
     { title: 'Table lifecycle', file: 'docs/runtime-reference/table-lifecycle.md' },
     examplesIndexDocHint,
   ],
+  AppNewWidgetsReqVO: [
+    widgetsDocHint,
+  ],
+  AppPreviewWidgetsDataReqVO: [
+    widgetsDocHint,
+  ],
+  AppUpdateWidgetsIngressOptionsReqVO: [
+    widgetsDocHint,
+  ],
+  AppUpdateWidgetsReqVO: [
+    widgetsDocHint,
+  ],
   AppCreateEntityReqVO: [
     { title: 'Table lifecycle', file: 'docs/runtime-reference/table-lifecycle.md' },
     { title: 'Table schema cheatsheet', file: 'docs/runtime-reference/entity-schema.md' },
@@ -109,6 +129,23 @@ const docHintIndex: Record<string, RuntimeDocHint[]> = {
     { title: 'Access rule', file: 'docs/runtime-reference/access-rule.md' },
     examplesIndexDocHint,
   ],
+  AppIngressBulkApplyReqVO: [
+    { title: 'Access rule', file: 'docs/runtime-reference/access-rule.md' },
+    examplesIndexDocHint,
+  ],
+  DashboardCreateReqVO: [
+    dashboardDocHint,
+  ],
+  DashboardUpdateLayoutReqVO: [
+    dashboardDocHint,
+    widgetsDocHint,
+  ],
+  DashboardUpdateOptionsReqVO: [
+    dashboardDocHint,
+  ],
+  DashboardUpdateTitleReqVO: [
+    dashboardDocHint,
+  ],
   EntitySaveReqVO: [
     { title: 'Table schema cheatsheet', file: 'docs/runtime-reference/entity-schema.md' },
     { title: 'Field type index', file: 'docs/runtime-reference/entity-schema/README.md' },
@@ -148,6 +185,9 @@ const docHintIndex: Record<string, RuntimeDocHint[]> = {
     { title: 'Search and bulk actions', file: 'docs/runtime-reference/search-and-bulk-actions.md' },
     examplesIndexDocHint,
   ],
+  FetchWidgetsDataReqVO: [
+    widgetsDocHint,
+  ],
   'EntityInvokeBatchOperatorReqVO & InvokeRequestVO': [
     selectionDocHint,
     conditionDocHint,
@@ -202,6 +242,21 @@ const commandDocHintIndex: Record<string, RuntimeDocHint[]> = {
     { title: 'Table lifecycle', file: 'docs/runtime-reference/table-lifecycle.md' },
     examplesIndexDocHint,
   ],
+  'admin.dashboard.getDashboardList': [
+    dashboardDocHint,
+  ],
+  'admin.dashboard.getDashboardOptions': [
+    dashboardDocHint,
+  ],
+  'admin.widget.widgetsList': [
+    widgetsDocHint,
+  ],
+  'admin.widget.getWidgets': [
+    widgetsDocHint,
+  ],
+  'admin.widget.deleteWidgets': [
+    widgetsDocHint,
+  ],
   'admin.app.createEntity': [
     { title: 'Table lifecycle', file: 'docs/runtime-reference/table-lifecycle.md' },
     examplesIndexDocHint,
@@ -225,6 +280,10 @@ const commandDocHintIndex: Record<string, RuntimeDocHint[]> = {
     { title: 'Access rule', file: 'docs/runtime-reference/access-rule.md' },
     examplesIndexDocHint,
   ],
+  'admin.access-rule.bulkApplyEntityIngress': [
+    { title: 'Access rule', file: 'docs/runtime-reference/access-rule.md' },
+    examplesIndexDocHint,
+  ],
   'user.row.insertEntity': [
     { title: 'Row CRUD', file: 'docs/runtime-reference/row-crud.md' },
     { title: 'Uploads', file: 'docs/runtime-reference/uploads.md' },
@@ -265,6 +324,13 @@ const commandDocHintIndex: Record<string, RuntimeDocHint[]> = {
     { title: 'Search and bulk actions', file: 'docs/runtime-reference/search-and-bulk-actions.md' },
     examplesIndexDocHint,
   ],
+  'user.dashboard.getDashboard': [
+    dashboardDocHint,
+  ],
+  'user.dashboard.getDashboardWidgets': [
+    dashboardDocHint,
+    widgetsDocHint,
+  ],
 }
 
 export function getCommandDocHints(operation: string, env: EnvInput = process.env): RuntimeDocHint[] {

package/src/tests/command_registry.test.ts

@@ -17,6 +17,12 @@ test('admin surface is restricted to reset white list', () => {
     'app list',
     'app update',
     'app watch-import-task',
+    'dashboard create',
+    'dashboard get-options',
+    'dashboard list',
+    'dashboard rename',
+    'dashboard update-layout',
+    'dashboard update-options',
     'table create',
     'table delete',
     'table get',
@@ -24,11 +30,19 @@ test('admin surface is restricted to reset white list', () => {
     'table rename',
     'table update-schema',
     'access-rule assign-users',
+    'access-rule bulk-apply',
     'access-rule create',
     'access-rule delete',
     'access-rule get',
     'access-rule list',
     'access-rule update',
+    'widget create',
+    'widget delete',
+    'widget get',
+    'widget list',
+    'widget preview-data',
+    'widget update',
+    'widget update-ingress-options',
     'workflow create-version',
     'workflow deploy',
     'workflow get',
@@ -40,6 +54,8 @@ test('admin surface is restricted to reset white list', () => {
 test('user surface is restricted to reset white list', () => {
   const actual = commandPaths(userCommands)
   const expected = [
+    'dashboard get',
+    'dashboard widgets',
     'entry',
     'profile get',
     'profile update',
@@ -59,6 +75,7 @@ test('user surface is restricted to reset white list', () => {
     'upload mobile',
     'upload preview',
     'upload token',
+    'widget data',
     'workflow approve',
     'workflow countersign',
     'workflow forward',
@@ -75,8 +92,8 @@ test('user surface is restricted to reset white list', () => {
 test('generated modules use CLI namespaces only', () => {
   const adminModules = [...new Set(adminCommands.map((item) => item.module))].sort()
   const userModules = [...new Set(userCommands.map((item) => item.module))].sort()
-  assert.deepEqual(adminModules, ['access-rule', 'app', 'table', 'workflow'])
-  assert.deepEqual(userModules, ['entry', 'profile', 'row', 'table', 'upload', 'workflow'])
+  assert.deepEqual(adminModules, ['access-rule', 'app', 'dashboard', 'table', 'widget', 'workflow'])
+  assert.deepEqual(userModules, ['dashboard', 'entry', 'profile', 'row', 'table', 'upload', 'widget', 'workflow'])
 })
 
 test('black list commands are removed from registry', () => {
@@ -98,6 +115,8 @@ test('black list commands are removed from registry', () => {
     'workflow query-entity-selection',
     'profile change-password',
     'profile auth-channels',
+    'dashboard delete',
+    'dashboard clone',
   ]
   for (const item of forbidden) {
     assert.equal(all.has(item), false, `${item} should not exist`)

package/src/tests/dev_sdk_gen.test.ts

@@ -0,0 +1,226 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import fs from 'fs'
+import os from 'os'
+import path from 'path'
+
+import { generateArcubaseProjectSDK } from '../runtime/dev_sdk_gen.js'
+import { executeCLI } from '../runtime/execute.js'
+import { CLIError } from '../runtime/errors.js'
+
+const env = {
+  ARCUBASE_BASE_URL: 'https://arcubase.example.com',
+  ARCUBASE_ACCESS_TOKEN: 'tok',
+  ARCUBASE_SDK_ROOT: '/runtime/arcubase-sdk',
+  ARCUBASE_TRACE_ID: '',
+  ARCUBASE_SUBJECT_TYPE: '',
+  ARCUBASE_SUBJECT_ID: '',
+  ARCUBASE_TOKEN_EXPIRES_AT: '',
+}
+
+function appDetail() {
+  return {
+    id: 3882856425,
+    name: '故事应用',
+    entities: {},
+  }
+}
+
+function entityList() {
+  return [
+    {
+      id: 3883547182,
+      name: '编故事',
+    },
+  ]
+}
+
+function appDetailWithEntityList() {
+  return {
+    id: 3882856425,
+    name: '故事应用',
+    entities: [
+      {
+        id: 3883547182,
+        name: '编故事',
+      },
+    ],
+  }
+}
+
+function entityDetail() {
+  return {
+    id: 3883547182,
+    app_id: 3882856425,
+    name: '编故事',
+    key: 'story',
+    fields: [
+      { id: 1006, label: '时代', key: 'era', type: 'select', required: false, options: { options: { items: [{ key: 1, value: '现代' }] } } },
+      { id: 1013, label: '你刚刚', key: 'recentEvent', type: 'text', required: false, options: {} },
+      { id: 1011, label: '故事', key: 'story', type: 'textarea', required: true, options: {} },
+    ],
+  }
+}
+
+function entityDetailWithoutFieldKeys() {
+  const detail = entityDetail()
+  detail.fields = detail.fields.map((field) => ({ ...field, key: '' }))
+  return detail
+}
+
+function sdkSchemaPayload() {
+  return {
+    ...appDetailWithEntityList(),
+    entities: [
+      {
+        ...entityDetail(),
+        key: 'story',
+      },
+    ],
+  }
+}
+
+test('generateArcubaseProjectSDK emits typed key based entity sdk', () => {
+  const result = generateArcubaseProjectSDK(sdkSchemaPayload())
+
+  assert.deepEqual(result.files.map((file) => file.path).sort(), [
+    'client.ts',
+    'entities/story.ts',
+    'index.ts',
+    'runtime.ts',
+    'schema.ts',
+  ])
+
+  const client = result.files.find((file) => file.path === 'client.ts')?.contents ?? ''
+  assert.match(client, /createArcubaseSdk/)
+  assert.match(client, /story: createStorySDK\(runtime\)/)
+
+  const runtime = result.files.find((file) => file.path === 'runtime.ts')?.contents ?? ''
+  assert.match(runtime, /accessToken/)
+  assert.match(runtime, /refreshToken/)
+
+  const story = result.files.find((file) => file.path === 'entities/story.ts')?.contents ?? ''
+  assert.match(story, /export type StoryFields =/)
+  assert.match(story, /era\?: number \| string/)
+  assert.match(story, /recentEvent\?: string/)
+  assert.match(story, /story: string/)
+  assert.match(story, /create\(fields: StoryCreateInput\)/)
+  assert.match(story, /update\(rowId: string \| number, fields: StoryUpdateInput\)/)
+  assert.match(story, /toArcubaseFields\(fields\)/)
+  assert.match(story, /changed_fields: Object.keys\(data\)\.map\(\(fieldId\) => Number\(fieldId\)\)/)
+  assert.match(story, /\/entity\/3882856425\/\$\{entityId\}\/insert/)
+
+  const schema = result.files.find((file) => file.path === 'schema.ts')?.contents ?? ''
+  assert.match(schema, /"story"/)
+  assert.match(schema, /"fieldId": 1011/)
+  assert.match(schema, /"entityId": 3883547182/)
+})
+
+test('generateArcubaseProjectSDK rejects missing field keys', () => {
+  const payload = sdkSchemaPayload()
+  payload.entities[0].fields[1].key = ''
+
+  assert.throws(() => generateArcubaseProjectSDK(payload), (error: unknown) => {
+    assert.ok(error instanceof CLIError)
+    assert.equal(error.code, 'SDK_GEN_FIELD_KEY_REQUIRED')
+    assert.match(error.message, /你刚刚/)
+    return true
+  })
+})
+
+test('generateArcubaseProjectSDK rejects duplicate field keys within an entity', () => {
+  const payload = sdkSchemaPayload()
+  payload.entities[0].fields[1].key = 'story'
+
+  assert.throws(() => generateArcubaseProjectSDK(payload), (error: unknown) => {
+    assert.ok(error instanceof CLIError)
+    assert.equal(error.code, 'SDK_GEN_DUPLICATE_FIELD_KEY')
+    assert.match(error.message, /story/)
+    return true
+  })
+})
+
+test('arcubase-admin dev sdk-gen fetches app schema and writes typed sdk files', async () => {
+  const outDir = fs.mkdtempSync(path.join(os.tmpdir(), 'arcubase-sdk-gen-'))
+  const calls: Array<{ url: string; method?: string }> = []
+
+  const result = await executeCLI(
+    'admin',
+    ['dev', 'sdk-gen', '--app-id', '3882856425', '--out', outDir],
+    env as any,
+    async (url, init) => {
+      calls.push({ url: String(url), method: init?.method })
+      if (String(url).endsWith('/api/apps/3882856425')) {
+        return new Response(JSON.stringify({ data: appDetail() }), { status: 200 })
+      }
+      if (String(url).endsWith('/api/apps/3882856425/entities')) {
+        return new Response(JSON.stringify({ data: entityList() }), { status: 200 })
+      }
+      if (String(url).endsWith('/api/apps/3882856425/entity/3883547182')) {
+        return new Response(JSON.stringify({ data: entityDetail() }), { status: 200 })
+      }
+      return new Response(JSON.stringify({ error: { message: `unexpected url ${url}` } }), { status: 404 })
+    },
+  )
+
+  assert.equal(result.kind, 'result')
+  assert.deepEqual(result.commandPath, ['dev', 'sdk-gen'])
+  assert.equal(calls[0].method, 'GET')
+  assert.match(calls[0].url, /\/api\/apps\/3882856425$/)
+  assert.equal(calls[1].method, 'GET')
+  assert.match(calls[1].url, /\/api\/apps\/3882856425\/entities$/)
+  assert.equal(calls[2].method, 'GET')
+  assert.match(calls[2].url, /\/api\/apps\/3882856425\/entity\/3883547182$/)
+  assert.ok(fs.existsSync(path.join(outDir, 'index.ts')))
+  assert.ok(fs.existsSync(path.join(outDir, 'client.ts')))
+  assert.ok(fs.existsSync(path.join(outDir, 'entities/story.ts')))
+  assert.match(fs.readFileSync(path.join(outDir, 'client.ts'), 'utf8'), /createArcubaseSdk/)
+})
+
+test('arcubase-admin dev sdk-gen initializes missing field keys through admin auth before generation', async () => {
+  const outDir = fs.mkdtempSync(path.join(os.tmpdir(), 'arcubase-sdk-gen-'))
+  const calls: Array<{ url: string; method?: string; authorization?: string; body?: any }> = []
+
+  const result = await executeCLI(
+    'admin',
+    ['dev', 'sdk-gen', '--app-id', '3882856425', '--out', outDir],
+    env as any,
+    async (url, init) => {
+      const bodyText = typeof init?.body === 'string' ? init.body : undefined
+      calls.push({
+        url: String(url),
+        method: init?.method,
+        authorization: init?.headers instanceof Headers
+          ? init.headers.get('Authorization') ?? undefined
+          : (init?.headers as Record<string, string> | undefined)?.Authorization,
+        body: bodyText ? JSON.parse(bodyText) : undefined,
+      })
+      if (String(url).endsWith('/api/apps/3882856425')) {
+        return new Response(JSON.stringify({ data: appDetail() }), { status: 200 })
+      }
+      if (String(url).endsWith('/api/apps/3882856425/entities')) {
+        return new Response(JSON.stringify({ data: entityList() }), { status: 200 })
+      }
+      if (String(url).endsWith('/api/apps/3882856425/entity/3883547182')) {
+        return new Response(JSON.stringify({ data: entityDetailWithoutFieldKeys() }), { status: 200 })
+      }
+      if (String(url).endsWith('/api/apps/3882856425/entity/3883547182/custom-keys')) {
+        return new Response(JSON.stringify({ data: entityDetail() }), { status: 200 })
+      }
+      return new Response(JSON.stringify({ error: { message: `unexpected url ${url}` } }), { status: 404 })
+    },
+  )
+
+  assert.equal(result.kind, 'result')
+  const customKeysCall = calls.find((call) => call.url.endsWith('/api/apps/3882856425/entity/3883547182/custom-keys'))
+  assert.ok(customKeysCall)
+  assert.equal(customKeysCall.method, 'PUT')
+  assert.equal(customKeysCall.authorization, 'Bearer tok')
+  assert.deepEqual(customKeysCall.body, [
+    { id: 1006, key: 'field1006' },
+    { id: 1013, key: 'field1013' },
+    { id: 1011, key: 'field1011' },
+  ])
+  assert.match(fs.readFileSync(path.join(outDir, 'entities/story.ts'), 'utf8'), /field1011: string/)
+  assert.deepEqual(result.data.initializedFieldKeys, [{ entityId: 3883547182, fields: ['field1006', 'field1013', 'field1011'] }])
+})

package/src/tests/docs_readability.test.ts

@@ -68,6 +68,21 @@ test('runtime docs do not use retired table create and row probe names', () => {
   }
 })
 
+test('runtime docs document dashboard and widget single success paths', () => {
+  const dashboard = fs.readFileSync(path.join(root, 'dashboard.md'), 'utf8')
+  const widgets = fs.readFileSync(path.join(root, 'widgets.md'), 'utf8')
+  assert.match(dashboard, /arcubase dashboard get/)
+  assert.match(dashboard, /arcubase-admin dashboard list/)
+  assert.match(dashboard, /not exposed/)
+  assert.match(widgets, /arcubase-admin widget list/)
+  assert.match(widgets, /--widget-id/)
+  for (const aggregate of ['sum', 'avg', 'max', 'min', 'count', 'distinct_count']) {
+    assert.match(widgets, new RegExp(`\\\`${aggregate}\\\``))
+  }
+  assert.match(widgets, /unsupported aggregate names are invalid request bodies/)
+  assert.doesNotMatch(widgets, /widgets_id/)
+})
+
 test('scenario examples exist and are readable', () => {
   for (const dir of ['oms-01', 'wms-01', 'crm-01']) {
     const readme = path.join(root, 'examples', dir, 'README.md')

package/src/tests/execute_validation.test.ts

@@ -1094,6 +1094,135 @@ test('entry fixed app tables query cannot be disabled by query file', async () =
   assert.equal(out.data.url, 'https://arcubase.example.com/api/entry?include_app_tables=true')
 })
 
+test('dashboard and widget commands map to approved endpoints', async () => {
+  const adminWidgetList = await executeCLI(
+    'admin',
+    ['widget', 'list', '--app-id', 'app_1', '--type', 'dashboard', '--dashboard-id', '100'],
+    env as any,
+    async (url, init) => new Response(JSON.stringify({ url, method: init?.method }), { status: 200 }),
+  )
+  assert.equal(adminWidgetList.kind, 'result')
+  assert.equal(adminWidgetList.data.url, 'https://arcubase.example.com/api/apps/app_1/widgets?type=dashboard&dashboard_id=100')
+  assert.equal(adminWidgetList.data.method, 'GET')
+
+  const userDashboardWidgets = await executeCLI(
+    'user',
+    ['dashboard', 'widgets', '--app-id', 'app_1', '--dashboard-id', 'dash_1'],
+    env as any,
+    async (url, init) => new Response(JSON.stringify({ url, method: init?.method }), { status: 200 }),
+  )
+  assert.equal(userDashboardWidgets.kind, 'result')
+  assert.equal(userDashboardWidgets.data.url, 'https://arcubase.example.com/api/dashboard/app_1/dash_1/widgets')
+  assert.equal(userDashboardWidgets.data.method, 'GET')
+
+  const userWidgetData = await executeCLI(
+    'user',
+    ['widget', 'data', '--app-id', 'app_1', '--body-json', '{"dashboard_id":100,"type":1}'],
+    env as any,
+    async (url, init) => new Response(JSON.stringify({
+      url,
+      method: init?.method,
+      body: init?.body ? JSON.parse(String(init.body)) : null,
+    }), { status: 200 }),
+  )
+  assert.equal(userWidgetData.kind, 'result')
+  assert.equal(userWidgetData.data.url, 'https://arcubase.example.com/api/apps/app_1/widgets-data')
+  assert.equal(userWidgetData.data.method, 'POST')
+  assert.deepEqual(userWidgetData.data.body, { dashboard_id: 100, type: 1 })
+})
+
+test('widget preview-data rejects unsupported aggregate before request', async () => {
+  let called = false
+  await assert.rejects(async () => {
+    await executeCLI(
+      'admin',
+      [
+        'widget',
+        'preview-data',
+        '--app-id',
+        'app_1',
+        '--body-json',
+        '{"dataSource":2188891001,"dataSourceType":"entity","measures":[{"Name":"median_amount","FieldID":1004,"Aggregate":"median"}]}',
+      ],
+      env as any,
+      async () => {
+        called = true
+        return new Response('{}', { status: 200 })
+      },
+    )
+  }, (error: unknown) => {
+    assert.ok(error instanceof CLIError)
+    assert.equal(error.code, 'BODY_VALIDATION_FAILED')
+    assert.equal(error.details?.requestType, 'AppPreviewWidgetsDataReqVO')
+    assert.ok((error.details?.issues ?? []).some((item) => item.path === 'body.measures.0.Aggregate'))
+    assert.ok((error.details?.docHints ?? []).some((item) => item.file === '/runtime/arcubase-sdk/docs/runtime-reference/widgets.md'))
+    return true
+  })
+  assert.equal(called, false)
+})
+
+test('widget preview-data rejects field dimensions without IsField true before request', async () => {
+  let called = false
+  await assert.rejects(async () => {
+    await executeCLI(
+      'admin',
+      [
+        'widget',
+        'preview-data',
+        '--app-id',
+        'app_1',
+        '--body-json',
+        '{"dataSource":2188891001,"dataSourceType":"entity","dimensions":[{"FieldID":1004,"Name":"Source"}],"measures":[{"Name":"Total Amount","FieldID":1005,"Aggregate":"sum"}]}',
+      ],
+      env as any,
+      async () => {
+        called = true
+        return new Response('{}', { status: 200 })
+      },
+    )
+  }, (error: unknown) => {
+    assert.ok(error instanceof CLIError)
+    assert.equal(error.code, 'BODY_VALIDATION_FAILED')
+    assert.equal(error.details?.requestType, 'AppPreviewWidgetsDataReqVO')
+    assert.ok((error.details?.issues ?? []).some((item) => item.path === 'body.dimensions.0.IsField'))
+    assert.ok((error.details?.commonMistakes ?? []).includes('field dimensions with FieldID must set IsField:true'))
+    return true
+  })
+  assert.equal(called, false)
+})
+
+test('widget update rejects chart field dimensions without IsField true before request', async () => {
+  let called = false
+  await assert.rejects(async () => {
+    await executeCLI(
+      'admin',
+      [
+        'widget',
+        'update',
+        '--app-id',
+        'app_1',
+        '--widget-id',
+        'widget_1',
+        '--body-json',
+        '{"entity_id":2188891001,"options":{"charts":{"entity_id":2188891001,"dimensions":[{"FieldID":1004,"IsField":false,"Name":"Source"}],"measures":[{"Name":"Total Amount","FieldID":1005,"Aggregate":"sum"}]}}}',
+      ],
+      env as any,
+      async () => {
+        called = true
+        return new Response('{}', { status: 200 })
+      },
+    )
+  }, (error: unknown) => {
+    assert.ok(error instanceof CLIError)
+    assert.equal(error.code, 'BODY_VALIDATION_FAILED')
+    assert.equal(error.details?.requestType, 'AppUpdateWidgetsReqVO')
+    assert.ok((error.details?.issues ?? []).some((item) => item.path === 'body.options.charts.dimensions.0.IsField'))
+    assert.ok((error.details?.commonMistakes ?? []).includes('field dimensions with FieldID must set IsField:true'))
+    return true
+  })
+  assert.equal(called, false)
+})
+
 test('upstream http failures include endpoint status and body details', async () => {
   await assert.rejects(async () => {
     await executeCLI('user', ['entry'], env as any, async () => new Response('', { status: 500 }))
@@ -1387,6 +1516,92 @@ test('access-rule assign-users accepts canonical mixed user_scope body', async (
   ])
 })
 
+test('access-rule bulk-apply normalizes numeric string ids before validation and request', async () => {
+  const body = JSON.stringify({
+    mode: 'update_existing',
+    items: [
+      {
+        table_id: '2188893443',
+        rule_id: '2188893557',
+        enabled: true,
+        options: {
+          user_scope: [{ type: 'department', id: '2188881201' }],
+          policy: { key: 'custom', actions: ['view'], all_fields_read: true, all_fields_write: false },
+          list_options: {},
+        },
+      },
+    ],
+  })
+  let requestedURL = ''
+  const out = await executeCLI(
+    'admin',
+    ['access-rule', 'bulk-apply', '--app-id', 'app_1', '--body-json', body],
+    env as any,
+    async (url, init) => {
+      requestedURL = String(url)
+      return new Response(String(init?.body ?? '{}'), { status: 200 })
+    },
+  )
+  assert.equal(out.kind, 'result')
+  assert.match(requestedURL, /\/api\/apps\/app_1\/access-rules\/bulk-apply$/)
+  assert.equal(out.data.items[0].table_id, 2188893443)
+  assert.equal(out.data.items[0].rule_id, 2188893557)
+  assert.deepEqual(out.data.items[0].options.user_scope, [{ type: 'department', id: 2188881201 }])
+})
+
+test('access-rule bulk-apply rejects empty items before request', async () => {
+  await assert.rejects(async () => {
+    await executeCLI(
+      'admin',
+      ['access-rule', 'bulk-apply', '--app-id', 'app_1', '--body-json', '{"mode":"upsert_by_name","items":[]}'],
+      env as any,
+      async () => new Response('{}', { status: 200 }),
+    )
+  }, (error: unknown) => {
+    assert.ok(error instanceof CLIError)
+    assert.equal(error.code, 'BODY_VALIDATION_FAILED')
+    assert.equal(error.details?.requestType, 'AppIngressBulkApplyReqVO')
+    assert.match(error.message, /non-empty body.items/)
+    return true
+  })
+})
+
+test('access-rule bulk-apply rejects non-canonical policy actions before request', async () => {
+  const body = JSON.stringify({
+    mode: 'upsert_by_name',
+    items: [
+      {
+        table_id: 2188893443,
+        name: 'Bad read alias',
+        enabled: true,
+        options: {
+          user_scope: [{ type: 'user', id: 2188889901 }],
+          policy: { key: 'custom', actions: ['read'], all_fields_read: true, all_fields_write: false },
+          list_options: {},
+        },
+      },
+    ],
+  })
+  await assert.rejects(async () => {
+    await executeCLI(
+      'admin',
+      ['access-rule', 'bulk-apply', '--app-id', 'app_1', '--body-json', body],
+      env as any,
+      async () => new Response('{}', { status: 200 }),
+    )
+  }, (error: unknown) => {
+    assert.ok(error instanceof CLIError)
+    assert.equal(error.code, 'BODY_VALIDATION_FAILED')
+    assert.equal(error.details?.requestType, 'AppIngressBulkApplyReqVO')
+    assert.match(error.message, /actions must use Arcubase action codes/)
+    assert.deepEqual(error.details?.issues?.[0], {
+      path: 'body.items.0.options.policy.actions',
+      message: 'access-rule policy.actions must use Arcubase action codes: use "view" for read and "add","edit" for write; do not use "read", "write", or "insert"',
+    })
+    return true
+  })
+})
+
 test('access-rule create accepts nested custom policy condition with field columns', async () => {
   const body = JSON.stringify({
     name: 'Sales own or west region',