@erdoai/cli 0.133.0 → 0.134.0

package/dist/index.js

@@ -1819,6 +1819,16 @@ var ErdoClient = class {
       input
     );
   }
+  listApprovalPolicies(action_key) {
+    const qs = action_key ? `?action_key=${encodeURIComponent(action_key)}` : "";
+    return this.request("GET", `/v1/approval-policies${qs}`);
+  }
+  createApprovalPolicy(input) {
+    return this.request("POST", "/v1/approval-policies", input);
+  }
+  deleteApprovalPolicy(id) {
+    return this.request("DELETE", `/v1/approval-policies/${encodeURIComponent(id)}`);
+  }
   // --- decisions ---
   // The decision record: what the organization committed to, what executed, and
   // what the evidence said afterwards. Referenced by slug, never UUID.
@@ -2329,6 +2339,24 @@ function timedOutMessage(threadID) {
 function print(value) {
   console.log(JSON.stringify(value, null, 2));
 }
+function policyValue(value) {
+  if (Array.isArray(value)) return value.map(policyValue);
+  if (value && typeof value === "object") {
+    return Object.fromEntries(Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, item]) => [key, policyValue(item)]));
+  }
+  return value;
+}
+function effectivePolicyMismatch(requested, effective) {
+  const differences = [];
+  if (effective.action_key !== requested.action_key) differences.push("action_key");
+  if (effective.scope_type !== requested.scope_type || (effective.scope_id ?? null) !== (requested.scope_id ?? null)) differences.push("scope");
+  if (effective.decision !== requested.decision) differences.push("decision");
+  if (JSON.stringify(policyValue(effective.parameter_constraints ?? null)) !== JSON.stringify(policyValue(requested.parameter_constraints ?? null))) differences.push("parameter_constraints");
+  const requestedExpiry = requested.expires_at ? Date.parse(requested.expires_at) : null;
+  const effectiveExpiry = effective.expires_at ? Date.parse(effective.expires_at) : null;
+  if (requestedExpiry !== effectiveExpiry) differences.push("expires_at");
+  return differences.length ? differences.join(", ") : void 0;
+}
 function formatNumber(n) {
   if (!Number.isFinite(n)) return String(n);
   if (Number.isInteger(n)) return n.toLocaleString("en-US");
@@ -4777,6 +4805,61 @@ approvalsCmd.command("list").description("List approval requests, optionally fil
     }
   }
 );
+var policiesCmd = approvalsCmd.command("policies").description("List and manage standing approval policies");
+policiesCmd.command("list").description("List standing approval policies").option("--action-key <key>", "only policies for this action").option("--json", "output raw JSON").action(async (opts) => {
+  try {
+    const res = await new ErdoClient().listApprovalPolicies(opts.actionKey);
+    if (opts.json) return print(res);
+    for (const p of res.policies) {
+      console.log(`${p.id}	${p.decision}	${p.action_key}	${p.scope_type}${p.scope_id ? `/${p.scope_id}` : ""}${p.expires_at ? `	expires ${p.expires_at}` : ""}`);
+    }
+  } catch (e) {
+    fail(e);
+  }
+});
+policiesCmd.command("create").description("Create a standing approval policy; this does not execute the action").requiredOption("--action-key <key>", "exact action key").requiredOption("--scope-type <type>", "organization | job | workstream | user").option("--scope-id <id>", "job, workstream, or user UUID").requiredOption("--decision <decision>", "always_approve | always_require").option("--constraints <json>", "parameter constraints JSON object").option("--expires-at <timestamp>", "future RFC3339 expiry").option("--json", "output raw JSON").action(async (opts) => {
+  try {
+    if (!["organization", "job", "workstream", "user"].includes(opts.scopeType)) throw new Error("--scope-type must be organization, job, workstream, or user");
+    if (!["always_approve", "always_require"].includes(opts.decision)) throw new Error("--decision must be always_approve or always_require");
+    let constraints;
+    if (opts.constraints !== void 0) {
+      try {
+        constraints = JSON.parse(opts.constraints);
+      } catch {
+        throw new Error("--constraints must be a JSON object");
+      }
+      if (constraints === null || Array.isArray(constraints) || typeof constraints !== "object") throw new Error("--constraints must be a JSON object");
+    }
+    const requested = {
+      action_key: opts.actionKey,
+      scope_type: opts.scopeType,
+      ...opts.scopeId ? { scope_id: opts.scopeId } : {},
+      decision: opts.decision,
+      ...constraints !== void 0 ? { parameter_constraints: constraints } : {},
+      ...opts.expiresAt ? { expires_at: opts.expiresAt } : {}
+    };
+    const res = await new ErdoClient().createApprovalPolicy(requested);
+    const mismatch = effectivePolicyMismatch(requested, res.policy);
+    if (opts.json) print(res);
+    if (mismatch) {
+      console.error(`Effective approval policy ${res.policy.id} does not grant the requested authority (${mismatch}). The existing policy was kept; inspect it with: erdo approvals policies list --action-key ${opts.actionKey}`);
+      process.exitCode = 1;
+    } else if (!opts.json) {
+      console.log(`Effective ${res.policy.decision} policy ${res.policy.id}`);
+    }
+  } catch (e) {
+    fail(e);
+  }
+});
+policiesCmd.command("delete <id>").description("Delete a standing approval policy").action(async (id) => {
+  try {
+    const result = await new ErdoClient().deleteApprovalPolicy(id);
+    if (!result.success) throw new Error(`Policy ${id} was not deleted`);
+    console.log(`Deleted policy ${id}`);
+  } catch (e) {
+    fail(e);
+  }
+});
 function executionVerdict(execution) {
   switch (execution.state) {
     case "succeeded":

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@erdoai/cli",
-  "version": "0.133.0",
-  "description": "Erdo CLI — drive datasets, pages, and evals from the terminal or CI",
+  "version": "0.134.0",
+  "description": "Erdo CLI \u2014 drive datasets, pages, and evals from the terminal or CI",
   "type": "module",
   "bin": {
     "erdo": "dist/index.js"