@erdoai/cli 0.64.1 → 0.65.0

package/dist/index.js

@@ -297,6 +297,36 @@ var ErdoClient = class {
   createManagerKey() {
     return this.request("POST", "/v1/manager-key");
   }
+  // Brings an EXISTING org under your manager org by redeeming a one-time consent
+  // token — a manager credential on its own can never adopt an arbitrary org, it
+  // has to present a secret only the target org's owner (or, for an ownerless
+  // managed org, its current manager) could have minted. The path is a sibling of
+  // /v1/managed-organizations rather than a nested `adopt` because Encore rejects
+  // a static segment alongside the parameterized /:orgSlug routes.
+  adoptManagedOrganization(token) {
+    return this.request("POST", "/v1/managed-organization-adoptions", { token });
+  }
+  // Seats a person in a managed org. The role is capped at admin — ownership of a
+  // client org stays with the client — and an omitted role means the backend's
+  // default (member).
+  addManagedOrganizationMember(slug, input) {
+    return this.request(
+      "POST",
+      `/v1/managed-organizations/${encodeURIComponent(slug)}/members`,
+      input
+    );
+  }
+  // Offers an ownerless managed org to another manager. Such an org has no owner
+  // to consent, so without this it stays pinned to whoever created it; the mint is
+  // refused the moment the org has a real owner, since re-parenting is then the
+  // owner's call through an adoption token.
+  createManagedOrganizationHandoffToken(slug, successorManagerSlug) {
+    return this.request(
+      "POST",
+      `/v1/managed-organizations/${encodeURIComponent(slug)}/handoff-tokens`,
+      { successor_manager_slug: successorManagerSlug }
+    );
+  }
   // --- Custom page domains: the branded hostnames the org's pages serve from ---
   listCustomDomains() {
     return this.request("GET", "/v1/custom-domains");
@@ -1751,6 +1781,57 @@ id: ${o.id}`);
     fail(e);
   }
 });
+managed.command("adopt <token>").description("Take over an existing org by redeeming a one-time consent token").action(async (token) => {
+  try {
+    const o = await new ErdoClient().adoptManagedOrganization(token);
+    console.log(`Adopted managed org: ${o.name}`);
+    console.log(`slug: ${o.slug}
+id: ${o.id}`);
+    process.stderr.write(
+      `Operate it with the manager key by passing --org ${o.slug} on any command (e.g. erdo --org ${o.slug} datasets list).
+`
+    );
+  } catch (e) {
+    fail(e);
+  }
+});
+managed.command("add-member <orgSlug> <email>").description("Seat a person in a managed org (role member or admin)").option("--role <role>", "member (default) or admin").action(async (orgSlug, email, opts) => {
+  try {
+    if (opts.role && opts.role !== "member" && opts.role !== "admin") {
+      fail(new Error("--role must be member or admin (ownership of a managed org stays with the client)"));
+    }
+    const m = await new ErdoClient().addManagedOrganizationMember(orgSlug, {
+      email,
+      role: opts.role
+    });
+    if (m.invited) {
+      console.log(`Invited ${m.email} to ${m.org_slug} as ${m.role} \u2014 pending until they accept`);
+    } else {
+      console.log(`Added ${m.email} to ${m.org_slug} as ${m.role}`);
+    }
+  } catch (e) {
+    fail(e);
+  }
+});
+managed.command("handoff-token <orgSlug>").description("Mint a one-time token offering an ownerless managed org to another manager; shown ONCE").requiredOption("--successor <managerOrgSlug>", "the manager org allowed to redeem the token").action(async (orgSlug, opts) => {
+  try {
+    const res = await new ErdoClient().createManagedOrganizationHandoffToken(orgSlug, opts.successor);
+    process.stderr.write(
+      "Give this handoff token to the successor manager now \u2014 it is shown only once and cannot be retrieved again.\n"
+    );
+    console.log(res.token);
+    process.stderr.write(
+      `
+org: ${res.org_slug}
+successor: ${res.successor_manager_slug}
+expires: ${res.expires_at}
+Only ${res.successor_manager_slug} can redeem it, with: erdo org managed adopt <token>, and only until it expires at the time above.
+`
+    );
+  } catch (e) {
+    fail(e);
+  }
+});
 managed.command("revoke <slug>").description("Stop managing a client org (removes access; keeps an audit record)").action(async (slug) => {
   try {
     await new ErdoClient().revokeManagedOrganization(slug);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@erdoai/cli",
-  "version": "0.64.1",
+  "version": "0.65.0",
   "description": "Erdo CLI — drive datasets, pages, and evals from the terminal or CI",
   "type": "module",
   "bin": {