@commercelayer/agent-cli 1.0.0-dev.3 → 1.0.0-dev.4

package/README.md

@@ -34,7 +34,7 @@ This is the 1.0.0 line, in development on the `clean-slate` branch. It replaces
 | `c11r auth login [--client-id] [--secret-file] [--keep-file]` | The human's own Commerce Layer login, from their Provisioning API application. See below. |
 | `c11r auth logout`, `auth switch <slug> [--global]` | Forgetting the login; the organization commands act on. |
 
-A loop policy allows verbs: a bare verb is the skill's own noun (`approve`), `<noun>.<verb>` another Manage noun's verb on the same item (`payments.capture`). Verbs that delete or return money are never open to a policy.
+A loop runs a skill a Manage noun's schema names in `loop.skill` (`manage-orders`, `manage-payments`, `playbook-mail-to-order` for carts); create and update refuse any other skill, and any verb that loop does not list, with the allowed values. A loop policy allows verbs: a bare verb is the skill's own noun (`approve`), `<noun>.<verb>` another Manage noun's verb on the same item (`payments.capture`). Verbs that delete or return money are never open to a policy.
 
 ## Login, organization tokens and secrets
 

package/dist/builtins/loops.js

@@ -4,8 +4,9 @@
 // schedules the agent repeats it every `every`.
 //
 // A policy allows verbs: a bare verb is the skill's own noun (approve), <noun>.<verb> another
-// Manage noun's verb on the same item (payments.capture). Each must be in the noun's schema
-// loop.verbs; the API checks again on every pass.
+// Manage noun's verb on the same item (payments.capture). The skill must be one a Manage noun's
+// schema names in loop.skill (a noun's own skill is not always its loop's: carts loops run
+// playbook-mail-to-order), and each verb in that loop.verbs; the API checks again on every pass.
 import fs from 'node:fs';
 import path from 'node:path';
 import YAML from 'yaml';
@@ -13,11 +14,11 @@ import { projectDir } from '../config.js';
 import { CliError, closest, fail, fixWith } from '../errors.js';
 import { envelope } from '../http.js';
 import { parseSchema } from '../schema.js';
-import { apiSchema } from '../schemas.js';
+import { apiNouns, apiSchema } from '../schemas.js';
 const NAME = /^[a-z0-9][a-z0-9-]{0,62}$/;
 const EVERY = /^[1-9]\d*(m|h|d)$/;
 const policyFlags = (required) => [
-    { name: 'skill', type: 'string', required, description: 'The Manage skill or playbook the loop runs, as in manage-orders.' },
+    { name: 'skill', type: 'string', required, description: 'The skill or playbook the loop runs, as in manage-orders or playbook-mail-to-order: one a noun\'s schema names in loop.skill.' },
     { name: 'every', type: 'string', required, description: 'How often a pass should run, as in 15m, 2h or 1d. The scheduler reads it; the CLI does not wait.' },
     { name: 'allow', type: 'array', required, description: 'A verb the policy allows, repeated: approve, payments.capture. Only verbs the noun\'s schema lists in loop.verbs.' },
     { name: 'max_total', type: 'array', description: 'The largest order total acted on, in major units: 500 for every currency, or EUR=500, repeated per currency. Above it, the item waits for the human.' },
@@ -166,24 +167,45 @@ function maxTotal(items) {
         return [ccy, amount(n)];
     }));
 }
-/** The policy's verbs against the skill noun's schema; a playbook is checked by the API at the first pass. */
+/**
+ * The skill and the policy's verbs against the same source loops run uses: each noun schema's loop,
+ * { skill, verbs }. A skill no schema's loop names is refused with the ones that are, and so is a
+ * verb its loop does not list.
+ */
 async function checkPolicy(def) {
     if (!def.policy.allow.length)
         fail('missing_argument', 'A loop needs at least one --allow.', { path: 'allow' });
-    if (!def.skill.startsWith('manage-'))
-        return [{ code: 'policy_unchecked', message: `${def.skill} is not a Manage skill: the API checks its policy at the first pass.` }];
-    const noun = def.skill.slice('manage-'.length);
-    const schema = await apiSchema(noun, []);
-    const allowed = schema.loop?.verbs ?? [];
-    if (!allowed.length)
-        fail('policy_forbidden', `No loop acts on ${noun}: its schema has no loop.`, { path: 'skill' });
+    const skills = await loopSkills();
+    const allowed = skills.get(def.skill);
+    if (!allowed) {
+        const names = [...skills.keys()].sort();
+        fail('invalid_value', `--skill ${def.skill} runs no loop. A loop runs ${names.length ? names.join(', ') : 'no skill yet'}.`, {
+            path: 'skill',
+            did_you_mean: closest(def.skill, names),
+            details: { values: names },
+            next_step: fixWith('c11r loops create --help'),
+        });
+    }
     for (const verb of def.policy.allow) {
-        if (!allowed.includes(verb)) {
-            fail('policy_forbidden', `A ${def.skill} loop may not allow ${verb}. It may allow ${allowed.join(', ')}.`, { path: 'allow', did_you_mean: closest(verb, allowed), details: { loopable: allowed }, next_step: fixWith(`c11r schema ${noun}`) });
+        if (!allowed.verbs.includes(verb)) {
+            fail('policy_forbidden', `A ${def.skill} loop may not allow ${verb}. It may allow ${allowed.verbs.join(', ')}.`, { path: 'allow', did_you_mean: closest(verb, allowed.verbs), details: { loopable: allowed.verbs }, next_step: fixWith(`c11r schema ${allowed.noun}`) });
         }
     }
     return [];
 }
+/** The skills a loop can run, from the schemas of the nouns that have a loop: skill to its noun and verbs. */
+async function loopSkills() {
+    const nouns = (await apiNouns()).filter((n) => n.group === 'manage' && n.served !== false);
+    const schemas = await Promise.all(nouns.map((n) => apiSchema(n.noun, []).catch(() => null)));
+    const out = new Map();
+    for (const s of schemas) {
+        if (!s?.loop?.skill)
+            continue;
+        const seen = out.get(s.loop.skill);
+        out.set(s.loop.skill, { noun: seen?.noun ?? s.noun, verbs: [...new Set([...(seen?.verbs ?? []), ...s.loop.verbs])] });
+    }
+    return out;
+}
 async function remove(run, name, file) {
     one(file, name);
     if (run.globals.dryRun)

package/dist/builtins/sandbox.js

@@ -28,7 +28,7 @@ export const sandbox = {
                 live: false,
                 body: [
                     { name: 'name', type: 'string', description: 'The organization name; without it, an invented one. A name starting zztest marks a test organization.' },
-                    { name: 'seed', type: 'boolean', description: 'Loads the demo dataset: two markets, six products, shipping and a test payment method, enough to place a test order at once.' },
+                    { name: 'seed', type: 'boolean', description: 'Loads the demo dataset: two markets, six products, shipping and a manual payment setting (Wire transfer), enough to place a test order at once.' },
                 ],
                 effect: 'Creates a sandbox, stores its token on this machine (never printed) and links this folder to it with .c11r.json. With --seed it answers once the seed is applied, in about 20 seconds.',
             },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commercelayer/agent-cli",
-  "version": "1.0.0-dev.3",
+  "version": "1.0.0-dev.4",
   "description": "c11r: the Commerce Layer CLI for coding agents. One grammar, c11r <noun> <verb>, from a sandbox to a running organization.",
   "homepage": "https://commercelayer.ai",
   "keywords": [