@letterstory/cli 0.85.0 → 0.86.1

package/lib/cli.mjs

@@ -57,7 +57,7 @@ import {
 } from "./commands.mjs";
 
 // Keep in sync with cli/package.json.
-export const VERSION = "0.85.0";
+export const VERSION = "0.86.1";
 
 // Flags that never take a value. Listing them explicitly means `deploy get --json <id>`
 // can't accidentally swallow the id as --json's value. Every `type: "bool"` flag (and its
@@ -818,6 +818,7 @@ Seers (event-driven signals -> drafts):
   org join <dir> [--file <path>]                       Rebuild the bundle from a --split directory
   org diff <file|dir>                                  What applying a bundle would change (reads only)
   org apply <file|dir> [--dry-run] [--prune --yes]     Make the org match a bundle (adds/updates; --prune deletes)
+                [--allow spends,sends,destroys,access --yes]  Also apply gated changes (admins; without --yes it only previews)
 
 Content templates (compose structures seers bind via config.template_key):
   templates list                                       Custom + built-in catalog

package/lib/commands/org.mjs

@@ -22,6 +22,8 @@ export const ARGS = {
 		config: { value: (_flags, positionals) => readBundle(requirePositional(positionals, 0, "file|dir")) },
 		dry_run: { flag: "dry-run", type: "bool" },
 		prune: { flag: "prune", type: "bool" },
+		allow: { flag: "allow", type: "list" },
+		confirm: { flag: "confirm" },
 	},
 	get_org_config_source: {},
 	connect_org_config_source: {
@@ -218,6 +220,10 @@ export function formatApply(result) {
 	for (const a of result.skipped) lines.push(`  ${SYMBOL[a.op]} ${a.section}/${a.name} — ${a.reason}`);
 	if (result.failed.length) lines.push("Failed:");
 	for (const a of result.failed) lines.push(`  ${SYMBOL[a.op]} ${a.section}/${a.name} — ${a.error}`);
+	if (result.gated?.length) {
+		lines.push(`Gated (allow with --allow; confirm ${result.confirm}):`);
+		for (const a of result.gated) lines.push(`  ${SYMBOL[a.op]} ${a.section}/${a.name} — ${a.gate}`);
+	}
 	for (const w of result.plan.warnings) lines.push(`warning: ${w}`);
 	return lines.join("\n");
 }
@@ -227,10 +233,25 @@ async function orgApply(ctx) {
 	refuseUnknownFlags(ctx, ARGS.apply_org_config, ["yes"]);
 	if (flagBool(flags.prune) && !flagBool(flags["dry-run"]) && !flagBool(flags.yes))
 		throw new CliError("--prune deletes records missing from the bundle. Review with --dry-run, then add --yes.");
-	const { result } = await client.callTool(
-		"apply_org_config",
-		argsFromFlags(ARGS.apply_org_config, flags, ctx.positionals)
-	);
+	const args = argsFromFlags(ARGS.apply_org_config, flags, ctx.positionals);
+	if (args.allow)
+		args.allow = args.allow
+			.flatMap((g) => g.split(","))
+			.map((g) => g.trim())
+			.filter(Boolean);
+	if (args.allow?.length && !args.dry_run && !args.confirm) {
+		// Gated changes need the plan's hash: dry-run to get it, show what it unlocks, then apply with it.
+		const { result: plan } = await client.callTool("apply_org_config", { ...args, dry_run: true });
+		const unlocked = (plan.gated ?? []).filter((g) => args.allow.includes(g.gate));
+		if (unlocked.length && !flagBool(flags.yes)) {
+			printResult(io, flags, plan, formatApply);
+			throw new CliError(
+				`--allow ${args.allow.join(",")} unlocks ${unlocked.length} gated change(s) above. Re-run with --yes to apply them.`
+			);
+		}
+		args.confirm = plan.confirm ?? undefined;
+	}
+	const { result } = await client.callTool("apply_org_config", args);
 	printResult(io, flags, result, formatApply);
 	return result.failed.length ? 1 : 0;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@letterstory/cli",
-	"version": "0.85.0",
+	"version": "0.86.1",
 	"description": "Spin up and manage Letterstory phantom blogs from your terminal.",
 	"type": "module",
 	"license": "UNLICENSED",