@commercelayer/agent-cli 1.0.0-dev.15 → 1.0.0-dev.17

package/README.md

@@ -76,9 +76,10 @@ Destructive verbs (deletes, `orders cancel`, `payments void` and `refund`, `sand
 
 - Without a login, nothing is checked on this machine: the request goes without a token, and the API's answer (`login_required`, or `state_required` for an organization not claimed) comes through as it is. So do `live_unavailable` (a plan without live), `forbidden` (the login is not an active admin of it) and `not_supported` for a verb that comes with a later step of go-live.
 - A verb that never runs live (sandbox, plans, sales calls, `auth login`, `auth switch`, `shop`) stops on this machine with `state_required`.
+- `c11r events writes --live --org <slug>` (`--since 2026-11-12T00:00:00Z`, an ISO time, `--noun`, `--cursor`, `--limit`) is the audit of live writes, and runs only in live: without `--live` it is `missing_value` with the full command, before any call.
 - `c11r status --live --org <slug>` is the organization's live status, with `live_credential` and the warning `live_credential_held` while the API holds one.
 - `c11r auth logout --live --org <slug>` revokes that credential in Commerce Layer (`DELETE /v1/auth/live`): `{ org, revoked, credential }`. The login stays on this machine. `--dry-run` says what it would revoke.
-- A destructive verb's confirmation names the mode and the organization: `Delete markets eu, in LIVE mode on S`. When the API supplies its own sentence (money, in a later step), that one is shown.
+- A verb that needs a yes is confirmed by the API in live, with a sentence naming the action, the amount and the mode (`Refunds EUR 1.00 on order N, in LIVE mode, real money.`): the CLI sends it without `confirm=true` and shows that `confirmation_required` as it is, with the API's next command, or asks it with those words in a terminal. `--yes` sends `confirm=true` on every live write, `payments capture` included.
 - A verb that answers a secret (`credentials create`) writes it in live only to the file the human chose with `--out`: without it, `missing_value` with the command and `--out FILE`. Never to c11r's secrets folder, never printed. A live delete leaves the test mode's secret files of the same organization alone.
 - `store.yml`, `.c11r/export.json` and the drift notes are of an organization in a mode: a live write marks a live `store.yml` behind, never a test one, and the other way round.
 - `c11r organizations disconnect <slug>` (confirmed) has the API revoke its credentials and the organization tokens; this machine then forgets the token, its secret files and a `.c11r.json` naming it, as `sandbox destroy` does, and answers `forgotten`.

package/dist/builtins/extensions.js

@@ -32,9 +32,10 @@ export const organizations = {
         const req = resourceRequest('organizations', run.verb, run.parsed.id, run.parsed.values);
         // Ending every other token of the organization is confirmed: by the schema's confirm_if, or
         // here for a schema without it.
-        if (run.verb.name === 'connect' && run.parsed.values.revoke_others && !run.globals.dryRun) {
-            if (!run.verb.confirmIf.includes('revoke_others'))
-                await confirm(`Connect ${run.parsed.id} and end every other organization token of it`, run.line, { yes: run.globals.yes, prompter: run.prompter ?? terminal });
+        // With confirm_if the engine has it confirmed, by the human here or by the API's 428 with its
+        // sentence; only a schema without it is confirmed here, and then sends confirm=true itself.
+        if (run.verb.name === 'connect' && run.parsed.values.revoke_others && !run.globals.dryRun && !run.verb.confirmIf.includes('revoke_others')) {
+            await confirm(`Connect ${run.parsed.id} and end every other organization token of it`, run.line, { yes: run.globals.yes, prompter: run.prompter ?? terminal });
             req.confirm = true;
             req.body = { ...req.body, confirm: true };
         }

package/dist/engine.js

@@ -42,6 +42,8 @@ function refusedBeforeEffect(e) {
         return status >= 400 && status < 500;
     return e.code === 'unknown_field' || e.code === 'unknown_verb';
 }
+/** Verbs that only run in live mode. */
+const LIVE_ONLY = new Set(['events writes']);
 async function executeOnce(argv, opts) {
     const cmd = parseCommand(argv);
     const builtins = opts.builtins ?? {};
@@ -87,6 +89,12 @@ async function executeOnce(argv, opts) {
     if (live && !verb.live) {
         fail('state_required', `${named} does not run in live mode.`, { required_state: 'claimed', path: 'live', next_step: fixWith(line.replace(/\s--live\b/, '')) });
     }
+    // A verb that only reads live data (events writes, the audit of live writes): without --live the
+    // API answers the login a bare 401, so the command says what it needs first.
+    if (!live && LIVE_ONLY.has(`${schema.noun} ${verb.name}`)) {
+        const org = cmd.globals.org ? '' : ' --org ORG_SLUG';
+        fail('missing_value', `${named} reads live data only: it needs --live and the organization, named with --org.`, { path: 'live', next_step: fixWith(`${line}${org} --live`) });
+    }
     // Live mode acts on an organization named on the command, never the folder's link or the
     // default, which are a sandbox's: --org, or C11R_ORG.
     const liveOrg = live ? (cmd.globals.org ?? (process.env.C11R_ORG || null)) : null;
@@ -118,10 +126,19 @@ async function executeOnce(argv, opts) {
     const loginOrg = org.source && org.source !== 'only_stored' ? org.org : null;
     let confirmed = false;
     const confirmFlags = verb.confirmIf.filter((k) => parsed.values[k] !== undefined && parsed.values[k] !== false);
-    if ((verb.destructive || verb.confirm || confirmFlags.length) && !cmd.globals.dryRun) {
+    // In live mode the API asks for the verbs it confirms, with a sentence naming the action, the
+    // amount and the mode ("Refunds EUR 1.00 on order N, in LIVE mode, real money."): the CLI sends
+    // without confirm=true and shows that 428 as it is, or asks it in a terminal. --yes sends
+    // confirm=true on every live write, payments capture included.
+    // So does a login verb (organizations disconnect), whose sentence names what stops answering.
+    const apiAsks = (live || verb.credential === 'login') && (verb.confirm || confirmFlags.length > 0);
+    if (apiAsks && cmd.globals.yes && !cmd.globals.dryRun)
+        confirmed = true;
+    if (live && cmd.globals.yes && verb.method !== 'GET')
+        confirmed = true;
+    if ((verb.destructive || verb.confirm || confirmFlags.length) && !cmd.globals.dryRun && !apiAsks) {
         const what = `${verb.name} ${schema.noun}${parsed.id ? ` ${parsed.id}` : ''}${confirmFlags.length ? ` with ${confirmFlags.map(toFlag).join(' ')}` : ''}`;
-        // In live mode the sentence says so, and on which organization.
-        const sentence = `${what.charAt(0).toUpperCase() + what.slice(1)}${live ? `, in LIVE mode on ${liveOrg}` : ''}`;
+        const sentence = what.charAt(0).toUpperCase() + what.slice(1);
         await confirm(sentence, line, { yes: cmd.globals.yes, prompter: opts.prompter });
         confirmed = true;
     }
@@ -149,6 +166,15 @@ async function executeOnce(argv, opts) {
                 return await sendOnce(req);
             }
             catch (e) {
+                // The API's own confirmation, in live: as it is with no terminal; asked with its words in one.
+                if (apiAsks && !confirmed && e instanceof CliError && e.code === 'confirmation_required') {
+                    const p = opts.prompter ?? terminal;
+                    if (!p.interactive)
+                        throw e;
+                    await confirm(e.body.message, line, { yes: false, prompter: p, sentence: e.body.message });
+                    confirmed = true;
+                    return sendOnce(req);
+                }
                 // A login token Commerce Layer no longer takes: mint a new one, once.
                 if (!(e instanceof CliError && e.code === 'login_required') || !login)
                     throw e;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commercelayer/agent-cli",
-  "version": "1.0.0-dev.15",
+  "version": "1.0.0-dev.17",
   "description": "c11r: the Commerce Layer CLI for coding agents. One grammar, c11r <noun> <verb>, from a sandbox to a running organization.",
   "homepage": "https://commercelayer.ai",
   "keywords": [