@formigio/fazemos-cli 0.10.45 → 0.10.46

package/dist/approvals.d.ts

@@ -0,0 +1,35 @@
+/**
+ * FC-B — Founder Console: Close the Loop
+ *
+ * Exports `registerApprovalsCommands(program)` which wires two sub-commands
+ * into the root Commander program (mirrors src/governance.ts:518
+ * registerGovernanceCommands pattern):
+ *
+ *   fazemos approvals list [--project <slug>] [--json]
+ *     → GET /api/control-plane/approvals
+ *       Returns pending approval gates for the active org.
+ *
+ *   fazemos approvals resolve <id> --decision approve|reject --reason <text> [--json]
+ *     → POST /api/control-plane/approvals/:id/resolve
+ *       Resolves an approval gate; sends surface='cli' for audit trail.
+ *       --reason is mandatory (min 4 chars) — this is the CLI typed-token
+ *       equivalent (OBD #1 / rul_cli_resolve_terminal_explicit_is_typed_token_equivalent).
+ *
+ * Auth:  requireAuth + org membership (X-Org-Id via api() helper).
+ *        Both commands are org-scoped (noProjectHeader: true on resolve;
+ *        list passes project_id as query param when --project provided).
+ *
+ * Rule:  Server enforces reject + missing reason → 422 REJECT_REQUIRES_REASON.
+ *        CLI also validates locally so the error is surfaced before any HTTP call.
+ *
+ * Spec:  FC-B-founder-console-close-the-loop-manifest.yaml §cli
+ * Tech:  FC-B-founder-console-close-the-loop-tech-spec.md §cli
+ */
+import type { Command } from 'commander';
+/**
+ * Register `approvals list` and `approvals resolve` into the root Commander program.
+ * Called from index.ts alongside registerGovernanceCommands.
+ *
+ * Pattern: mirrors registerGovernanceCommands at fazemos-cli/src/governance.ts:518.
+ */
+export declare function registerApprovalsCommands(program: Command): void;

package/dist/approvals.js

@@ -0,0 +1,279 @@
+/**
+ * FC-B — Founder Console: Close the Loop
+ *
+ * Exports `registerApprovalsCommands(program)` which wires two sub-commands
+ * into the root Commander program (mirrors src/governance.ts:518
+ * registerGovernanceCommands pattern):
+ *
+ *   fazemos approvals list [--project <slug>] [--json]
+ *     → GET /api/control-plane/approvals
+ *       Returns pending approval gates for the active org.
+ *
+ *   fazemos approvals resolve <id> --decision approve|reject --reason <text> [--json]
+ *     → POST /api/control-plane/approvals/:id/resolve
+ *       Resolves an approval gate; sends surface='cli' for audit trail.
+ *       --reason is mandatory (min 4 chars) — this is the CLI typed-token
+ *       equivalent (OBD #1 / rul_cli_resolve_terminal_explicit_is_typed_token_equivalent).
+ *
+ * Auth:  requireAuth + org membership (X-Org-Id via api() helper).
+ *        Both commands are org-scoped (noProjectHeader: true on resolve;
+ *        list passes project_id as query param when --project provided).
+ *
+ * Rule:  Server enforces reject + missing reason → 422 REJECT_REQUIRES_REASON.
+ *        CLI also validates locally so the error is surfaced before any HTTP call.
+ *
+ * Spec:  FC-B-founder-console-close-the-loop-manifest.yaml §cli
+ * Tech:  FC-B-founder-console-close-the-loop-tech-spec.md §cli
+ */
+import chalk from 'chalk';
+import { api, ApiError, resolveProjectIdBySlug } from './api.js';
+// ── Helpers ────────────────────────────────────────────────────────────────────
+/**
+ * Validate that the --decision flag is one of the allowed values.
+ * Throws a user-facing error otherwise.
+ */
+function validateDecision(value) {
+    if (value !== 'approve' && value !== 'reject') {
+        throw new Error(`--decision must be 'approve' or 'reject', got: ${value}`);
+    }
+    return value;
+}
+/**
+ * Validate that --reason meets the minimum length requirement (4 chars).
+ * Throws a user-facing error otherwise.
+ * This is the CLI side of rul_cli_resolve_terminal_explicit_is_typed_token_equivalent.
+ */
+function validateReason(value) {
+    const trimmed = value.trim();
+    if (trimmed.length < 4) {
+        throw new Error(`--reason must be at least 4 characters (got ${trimmed.length}). ` +
+            `Provide a meaningful reason — it lands in the audit trail.`);
+    }
+    return trimmed;
+}
+/**
+ * Extract the approval gates array from the API response envelope.
+ * The API may return the array under different keys depending on version.
+ */
+function extractGates(data) {
+    if (Array.isArray(data.approvalRequests))
+        return data.approvalRequests;
+    if (Array.isArray(data.approval_requests))
+        return data.approval_requests;
+    if (Array.isArray(data.gates))
+        return data.gates;
+    // Some responses may return the array directly at a named key — scan.
+    for (const val of Object.values(data)) {
+        if (Array.isArray(val) && val.length > 0 && typeof val[0] === 'object' && 'id' in val[0]) {
+            return val;
+        }
+    }
+    return [];
+}
+/**
+ * Render a human-readable table for approval gates.
+ * Format mirrors the governance waiting_on_me approval block (F34 pattern).
+ */
+function renderGatesList(gates) {
+    if (gates.length === 0) {
+        console.log(chalk.dim('  No pending approval requests.'));
+        return;
+    }
+    console.log(chalk.bold(`Pending Approvals (${gates.length}):`));
+    console.log();
+    for (const gate of gates) {
+        console.log(`  ${chalk.bold(gate.description || chalk.dim('(no description)'))}`);
+        console.log(`    id:      ${chalk.dim(gate.id)}`);
+        console.log(`    status:  ${chalk.yellow(gate.status)}`);
+        if (gate.pipeline_name) {
+            console.log(`    pipeline: ${chalk.cyan(gate.pipeline_name)}`);
+        }
+        if (gate.step_name) {
+            console.log(`    step:     ${chalk.cyan(gate.step_name)}`);
+        }
+        if (gate.deadline_at) {
+            console.log(`    deadline: ${new Date(gate.deadline_at).toLocaleString()}`);
+        }
+        console.log(`    created:  ${new Date(gate.created_at).toLocaleString()}`);
+        if (gate.project_id) {
+            console.log(`    project:  ${chalk.dim(gate.project_id)}`);
+        }
+        console.log();
+    }
+    console.log(chalk.dim(`To resolve: fazemos approvals resolve <id> --decision approve|reject --reason "<text>"`));
+}
+// ── Command registration ───────────────────────────────────────────────────────
+/**
+ * Register `approvals list` and `approvals resolve` into the root Commander program.
+ * Called from index.ts alongside registerGovernanceCommands.
+ *
+ * Pattern: mirrors registerGovernanceCommands at fazemos-cli/src/governance.ts:518.
+ */
+export function registerApprovalsCommands(program) {
+    // ── `fazemos approvals` ───────────────────────────────────────────────────
+    //
+    // Parent command hosting list + resolve sub-commands.
+    // Org-scoped (X-Org-Id sent by api() helper; no X-Fazemos-Project-Id).
+    // Auth: requireAuth + org membership (server-side, F37 shipped).
+    const approvalsCmd = program
+        .command('approvals')
+        .description('Approval gate management — list pending gates and resolve them from the CLI.\n\n' +
+        'Sub-commands:\n' +
+        '  list       List pending approval gates for your org\n' +
+        '  resolve    Approve or reject an approval gate\n\n' +
+        'Auth: your org is resolved via X-Org-Id (your active org); ' +
+        'only gate approvers (per F37) may resolve.\n\n' +
+        'Rule (OBD #1): --reason is mandatory for resolve — it is the CLI equivalent\n' +
+        'of the typed-token ceremony (fully auditable via via=\'cli\' in audit trail).');
+    // ── `fazemos approvals list` ──────────────────────────────────────────────
+    //
+    // GET /api/control-plane/approvals
+    //
+    // Returns pending approval gates. Optional --project <slug> restricts to
+    // gates belonging to a specific project. No X-Fazemos-Project-Id header
+    // (control-plane endpoint); project_id passed as query param when provided.
+    //
+    // Usage:
+    //   fazemos approvals list
+    //   fazemos approvals list --project my-project
+    //   fazemos approvals list --json
+    approvalsCmd
+        .command('list')
+        .description('List pending approval gates for your org.\n\n' +
+        'Calls GET /api/control-plane/approvals (listOpenApprovals — F37 shipped).\n\n' +
+        'Use --project to restrict results to a specific project.\n' +
+        'Use --json for machine-readable output (raw API response).\n\n' +
+        'To resolve a gate: fazemos approvals resolve <id> --decision approve|reject --reason "<text>"')
+        .option('--project <slug>', 'filter to a specific project (slug or id)')
+        .option('--json', 'output machine-readable JSON (raw API response)')
+        .action(async (opts) => {
+        try {
+            // Build the query string. project_id is passed as a query param
+            // (not via X-Fazemos-Project-Id header — this is a control-plane call).
+            let path = '/api/control-plane/approvals';
+            if (opts.project) {
+                // Resolve slug → id (handles UUID pass-through transparently).
+                // resolveProjectIdBySlug uses cached /auth/me; refreshes on miss.
+                const projectId = await resolveProjectIdBySlug(opts.project);
+                if (projectId) {
+                    path += `?project_id=${encodeURIComponent(projectId)}`;
+                }
+            }
+            const data = await api('GET', path, undefined, { noProjectHeader: true });
+            if (opts.json) {
+                console.log(JSON.stringify(data, null, 2));
+                return;
+            }
+            const gates = extractGates(data);
+            renderGatesList(gates);
+        }
+        catch (err) {
+            if (err instanceof ApiError) {
+                console.error(chalk.red(`Error (${err.status}): ${err.message}`));
+                if (err.code) {
+                    console.error(chalk.dim(`  code: ${err.code}`));
+                }
+            }
+            else {
+                const msg = err instanceof Error ? err.message : String(err);
+                console.error(chalk.red(`Error: ${msg}`));
+            }
+            process.exit(1);
+        }
+    });
+    // ── `fazemos approvals resolve <id>` ─────────────────────────────────────
+    //
+    // POST /api/control-plane/approvals/:id/resolve
+    //
+    // Resolves an approval gate (approve or reject). Sends surface='cli' so the
+    // audit trail records via='cli' (rul_via_cli_landed_in_audit_trail).
+    //
+    // --decision and --reason are both required. --reason must be ≥ 4 chars.
+    // This constitutes the CLI typed-token equivalent (OBD #1):
+    //   "Terminal-explicit command + mandatory --reason IS the CLI equivalent
+    //    of typed-token ceremony. No hidden state. Fully auditable via='cli'."
+    //
+    // Server additionally enforces: reject + missing/empty reason_note → 422
+    // REJECT_REQUIRES_REASON (rul_cli_terminal_explicit_mandatory_reason).
+    //
+    // Usage:
+    //   fazemos approvals resolve <id> --decision approve --reason "Looks good, ship it"
+    //   fazemos approvals resolve <id> --decision reject --reason "Missing QA sign-off"
+    //   fazemos approvals resolve <id> --decision approve --reason "ok" --json
+    approvalsCmd
+        .command('resolve')
+        .description('Approve or reject an approval gate.\n\n' +
+        'Calls POST /api/control-plane/approvals/:id/resolve with surface=\'cli\'.\n' +
+        'Sends via=\'cli\' to the audit trail (rul_via_cli_landed_in_audit_trail).\n\n' +
+        'Both --decision and --reason are required.\n' +
+        '--reason must be at least 4 characters and is recorded in the audit trail.\n' +
+        'This is the CLI equivalent of the typed-token ceremony (OBD #1).\n\n' +
+        'Exit codes:\n' +
+        '  0  — resolved successfully\n' +
+        '  1  — API error (see error message)\n' +
+        '  2  — validation error (missing/invalid flag)')
+        .argument('<id>', 'Approval gate ID (UUID)')
+        .requiredOption('--decision <approve|reject>', 'Decision: approve or reject')
+        .requiredOption('--reason <text>', 'Reason for the decision (min 4 chars; recorded in audit trail)')
+        .option('--json', 'output machine-readable JSON (raw API response)')
+        .action(async (id, opts) => {
+        try {
+            // ── Client-side validation ─────────────────────────────────────────
+            // Validate before making any HTTP call (fast fail, clear messages).
+            // Server-side re-validates as well (defense-in-depth).
+            const decision = validateDecision(opts.decision);
+            const reason = validateReason(opts.reason);
+            // ── POST /api/control-plane/approvals/:id/resolve ──────────────────
+            // Body matches the FC-B modified contract:
+            //   { decision, reason_note, surface: 'cli' }
+            // surface='cli' propagates to via='cli' in the audit trail.
+            const body = {
+                decision,
+                reason_note: reason,
+                surface: 'cli',
+            };
+            const data = await api('POST', `/api/control-plane/approvals/${encodeURIComponent(id)}/resolve`, body, { noProjectHeader: true });
+            if (opts.json) {
+                console.log(JSON.stringify(data, null, 2));
+                return;
+            }
+            // ── Human output ───────────────────────────────────────────────────
+            const decisionLabel = decision === 'approve'
+                ? chalk.green('approved')
+                : chalk.red('rejected');
+            console.log(chalk.bold(`Approval ${decisionLabel}`));
+            console.log();
+            console.log(`  id:          ${chalk.dim(data.id)}`);
+            console.log(`  decision:    ${decisionLabel}`);
+            console.log(`  via:         ${chalk.dim(data.via)}`);
+            console.log(`  resolved_at: ${new Date(data.resolved_at).toLocaleString()}`);
+            if (data.downstream_queued) {
+                console.log();
+                console.log(`  ${chalk.cyan('→ downstream step queued:')} ${chalk.dim(data.downstream_queued)}`);
+            }
+            console.log();
+        }
+        catch (err) {
+            if (err instanceof ApiError) {
+                // Surface server-enforced errors clearly (e.g., 422 REJECT_REQUIRES_REASON,
+                // 409 APPROVAL_ALREADY_RESOLVED, 404 APPROVAL_GATE_NOT_FOUND).
+                console.error(chalk.red(`Error (${err.status}): ${err.message}`));
+                if (err.code) {
+                    console.error(chalk.dim(`  code: ${err.code}`));
+                }
+                if (err.code === 'APPROVAL_ALREADY_RESOLVED') {
+                    console.error(chalk.dim('  This gate was already resolved — nothing changed.'));
+                }
+                else if (err.code === 'REJECT_REQUIRES_REASON') {
+                    console.error(chalk.dim('  Server requires a reason for rejection. Pass --reason "<text>" (min 4 chars).'));
+                }
+            }
+            else {
+                const msg = err instanceof Error ? err.message : String(err);
+                console.error(chalk.red(`Error: ${msg}`));
+            }
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=approvals.js.map

package/dist/approvals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approvals.js","sourceRoot":"","sources":["../src/approvals.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAuCjE,kFAAkF;AAElF;;;GAGG;AACH,SAAS,gBAAgB,CAAC,KAAa;IACrC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,kDAAkD,KAAK,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,KAAyB,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,+CAA+C,OAAO,CAAC,MAAM,KAAK;YAClE,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,IAA2B;IAC/C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC;QAAE,OAAO,IAAI,CAAC,gBAAgB,CAAC;IACvE,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC;QAAE,OAAO,IAAI,CAAC,iBAAiB,CAAC;IACzE,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC;IACjD,sEAAsE;IACtE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,IAAK,GAAG,CAAC,CAAC,CAAY,EAAE,CAAC;YACrG,OAAO,GAAqB,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,KAAqB;IAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC,CAAC;QAC1D,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,sBAAsB,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,EAAE,CAAC;IAEd,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC,CAAC;QAClF,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAClD,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACzD,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAC3E,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC;IAED,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CAAC,wFAAwF,CAAC,CACpG,CAAC;AACJ,CAAC;AAED,kFAAkF;AAElF;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAgB;IAExD,6EAA6E;IAC7E,EAAE;IACF,sDAAsD;IACtD,uEAAuE;IACvE,iEAAiE;IAEjE,MAAM,YAAY,GAAG,OAAO;SACzB,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CACV,kFAAkF;QAClF,iBAAiB;QACjB,yDAAyD;QACzD,qDAAqD;QACrD,6DAA6D;QAC7D,gDAAgD;QAChD,+EAA+E;QAC/E,+EAA+E,CAChF,CAAC;IAEJ,6EAA6E;IAC7E,EAAE;IACF,mCAAmC;IACnC,EAAE;IACF,yEAAyE;IACzE,wEAAwE;IACxE,4EAA4E;IAC5E,EAAE;IACF,SAAS;IACT,2BAA2B;IAC3B,gDAAgD;IAChD,kCAAkC;IAElC,YAAY;SACT,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CACV,+CAA+C;QAC/C,+EAA+E;QAC/E,4DAA4D;QAC5D,gEAAgE;QAChE,+FAA+F,CAChG;SACA,MAAM,CAAC,kBAAkB,EAAE,2CAA2C,CAAC;SACvE,MAAM,CAAC,QAAQ,EAAE,iDAAiD,CAAC;SACnE,MAAM,CAAC,KAAK,EAAE,IAA0C,EAAE,EAAE;QAC3D,IAAI,CAAC;YACH,gEAAgE;YAChE,wEAAwE;YACxE,IAAI,IAAI,GAAG,8BAA8B,CAAC;YAE1C,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACjB,+DAA+D;gBAC/D,kEAAkE;gBAClE,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC7D,IAAI,SAAS,EAAE,CAAC;oBACd,IAAI,IAAI,eAAe,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;gBACzD,CAAC;YACH,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAA0B,CAAC;YAEnG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC3C,OAAO;YACT,CAAC;YAED,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YACjC,eAAe,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;gBAC5B,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,MAAM,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;gBAClE,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;oBACb,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBAClD,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC,CAAC;YAC5C,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,4EAA4E;IAC5E,EAAE;IACF,gDAAgD;IAChD,EAAE;IACF,4EAA4E;IAC5E,qEAAqE;IACrE,EAAE;IACF,yEAAyE;IACzE,4DAA4D;IAC5D,0EAA0E;IAC1E,2EAA2E;IAC3E,EAAE;IACF,yEAAyE;IACzE,uEAAuE;IACvE,EAAE;IACF,SAAS;IACT,qFAAqF;IACrF,oFAAoF;IACpF,2EAA2E;IAE3E,YAAY;SACT,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CACV,yCAAyC;QACzC,6EAA6E;QAC7E,+EAA+E;QAC/E,8CAA8C;QAC9C,8EAA8E;QAC9E,sEAAsE;QACtE,eAAe;QACf,gCAAgC;QAChC,wCAAwC;QACxC,gDAAgD,CACjD;SACA,QAAQ,CAAC,MAAM,EAAE,yBAAyB,CAAC;SAC3C,cAAc,CAAC,6BAA6B,EAAE,6BAA6B,CAAC;SAC5E,cAAc,CAAC,iBAAiB,EAAE,gEAAgE,CAAC;SACnG,MAAM,CAAC,QAAQ,EAAE,iDAAiD,CAAC;SACnE,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,IAA0D,EAAE,EAAE;QACvF,IAAI,CAAC;YACH,sEAAsE;YACtE,oEAAoE;YACpE,uDAAuD;YAEvD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAE3C,sEAAsE;YACtE,2CAA2C;YAC3C,8CAA8C;YAC9C,4DAA4D;YAE5D,MAAM,IAAI,GAAG;gBACX,QAAQ;gBACR,WAAW,EAAE,MAAM;gBACnB,OAAO,EAAE,KAAc;aACxB,CAAC;YAEF,MAAM,IAAI,GAAG,MAAM,GAAG,CACpB,MAAM,EACN,gCAAgC,kBAAkB,CAAC,EAAE,CAAC,UAAU,EAChE,IAAI,EACJ,EAAE,eAAe,EAAE,IAAI,EAAE,CACC,CAAC;YAE7B,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC3C,OAAO;YACT,CAAC;YAED,sEAAsE;YACtE,MAAM,aAAa,GAAG,QAAQ,KAAK,SAAS;gBAC1C,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC;gBACzB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAE1B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,aAAa,EAAE,CAAC,CAAC,CAAC;YACrD,OAAO,CAAC,GAAG,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACpD,OAAO,CAAC,GAAG,CAAC,kBAAkB,aAAa,EAAE,CAAC,CAAC;YAC/C,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACrD,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;YAE7E,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBAC3B,OAAO,CAAC,GAAG,EAAE,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;YACnG,CAAC;YACD,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;gBAC5B,4EAA4E;gBAC5E,+DAA+D;gBAC/D,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,MAAM,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;gBAClE,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;oBACb,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBAClD,CAAC;gBACD,IAAI,GAAG,CAAC,IAAI,KAAK,2BAA2B,EAAE,CAAC;oBAC7C,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC,CAAC;gBAClF,CAAC;qBAAM,IAAI,GAAG,CAAC,IAAI,KAAK,wBAAwB,EAAE,CAAC;oBACjD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,iFAAiF,CAAC,CAAC,CAAC;gBAC9G,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC,CAAC;YAC5C,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/index.js

@@ -24,6 +24,7 @@ import { registerGovernanceCommands } from './governance.js';
 import { registerAutoStartCommands } from './autostart.js';
 import { registerFtrCommand } from './ftr.js';
 import { registerScheduleCommands } from './schedule.js';
+import { registerApprovalsCommands } from './approvals.js';
 import { parseExecutionsJson, resolveWaitOptions, waitForPipelines, buildAwsCommand, validateExecutionEntry, } from './wait-for-pipeline.js';
 import { readFileSync, readdirSync, writeFileSync, mkdirSync, existsSync, statSync } from 'fs';
 import { fileURLToPath } from 'url';
@@ -9620,6 +9621,13 @@ registerFtrCommand(program);
 // (does NOT pass noProjectHeader: true — greenfield fix per binding_decision.cli_header_scoping).
 // admin/owner required for set/unset/disable/enable/tz; any active member for list.
 registerScheduleCommands(program);
+// ── FC-B — Approval Gate CLI: approvals list / approvals resolve ──────────────
+// Registers `approvals` top-level command with `list` and `resolve` sub-commands.
+// Both calls are org-scoped (noProjectHeader: true); resolve sends surface='cli'
+// so the audit trail records via='cli' (rul_via_cli_landed_in_audit_trail).
+// --reason is mandatory for resolve — CLI typed-token equivalent (OBD #1).
+// Auth: requireAuth + org membership (server-side, F37 shipped).
+registerApprovalsCommands(program);
 // Skip auto-parse only when running under Vitest (which sets process.env.VITEST).
 // Tests import `program` and drive it via `program.parseAsync(...)` after mocking
 // `./api.js`. In every other context — direct invocation, npx tsx, OR the bin