@pipod/cli 0.1.10 → 0.1.11

package/dist/cli.js

@@ -1908,6 +1908,14 @@ var AccountClient = class {
   putOrgSettings(body) {
     return this.request(`/orgs/${encodeURIComponent(this.orgId)}/settings`, { method: "PUT", body });
   }
+  /** The organization's policy: its `config` holds the limits; the scripts and Pi files are always empty. */
+  getOrgPolicy() {
+    return this.request(`/orgs/${encodeURIComponent(this.orgId)}/policy`);
+  }
+  /** Replaces the whole policy, compare-and-swap on `version`. The server validates it. */
+  putOrgPolicy(body) {
+    return this.request(`/orgs/${encodeURIComponent(this.orgId)}/policy`, { method: "PUT", body });
+  }
   launch(body) {
     return this.request("/pods", { method: "POST", body });
   }
@@ -2209,10 +2217,12 @@ async function responseError(res, method, apiPath) {
       hint: "an owner of your organization can grant it (`pipod org-admin` opens the console)"
     });
   }
+  const issues = res.status === 400 && Array.isArray(body.detail) ? body.detail.filter((issue) => typeof issue === "string").slice(0, 10).map((issue) => issue.slice(0, 240)) : [];
   return new PiPodError(`the pi pod server refused ${method} ${apiPath}: ${message}`, {
     status: res.status,
     ...code ? { code } : {},
-    ...safeDetail !== void 0 ? { detail: safeDetail } : {}
+    ...safeDetail !== void 0 ? { detail: safeDetail } : {},
+    ...issues.length > 0 ? { hint: issues.join("\n") } : {}
   });
 }
 function isSafeCapacityDetail(value) {
@@ -3870,6 +3880,9 @@ function orgSourceDir(args) {
   if (!home) throw new PiPodError("cannot locate ~/.pi-pod/org: HOME is unset", { hint: "pass --dir <path>" });
   return path11.join(home, ORG_SOURCE_SUBDIR);
 }
+function policySourcePath(args) {
+  return path11.join(orgSourceDir(args), ORG_POLICY_FILE);
+}
 function safePiDir(root, subpath) {
   const directory = path11.join(root, subpath);
   let stat;
@@ -3970,6 +3983,28 @@ async function readEnvSnapshot(envPath, mode, resolver, home) {
 async function compileBundleSource(args) {
   const cwd = args.cwd ?? process.cwd();
   const envMode = args.includeEnv === false ? false : args.includeEnv === "names" ? "names" : true;
+  if (args.source === "policy-file") {
+    const configPath2 = policySourcePath({ dir: args.dir, home: args.home });
+    if (!fs12.existsSync(configPath2)) {
+      throw new PiPodError(`no org policy file at ${configPath2}`, {
+        hint: "run `pipod pull policy` to create it from the server's policy, or pass --dir <path>"
+      });
+    }
+    return {
+      kind: "policy-file",
+      config: parseConfig(configPath2),
+      initScript: "",
+      bakeScript: "",
+      piFiles: {},
+      env: {},
+      warnings: [],
+      name: "org policy",
+      templateRef: null,
+      projectRoot: null,
+      root: path11.dirname(configPath2),
+      configPath: configPath2
+    };
+  }
   if (args.source === "project") {
     const configPath2 = findConfigPath(cwd, { home: args.home });
     if (!configPath2) {
@@ -4069,6 +4104,7 @@ async function compileBundleSource(args) {
 }
 var ORG_SCRIPTS = { init: "init.sh", bake: "bake.sh" };
 var ORG_ENV_FILE = "env";
+var ORG_POLICY_FILE = "policy.json";
 function readPiFiles(root, config, kind) {
   const files = {};
   const warnings = [];
@@ -4323,6 +4359,15 @@ function writePulledAgents(writer, piDir, agents) {
 }
 function writeBundleSource(args) {
   const { kind, bundle } = args;
+  if (kind === "policy-file") {
+    const policyPath = policySourcePath({ dir: args.dir, home: args.home });
+    const writer2 = new LayerWriter(path11.dirname(policyPath));
+    if (!fs12.existsSync(policyPath) || stable(parseConfig(policyPath)) !== stable(bundle.config)) {
+      writer2.noteComments(policyPath);
+      writer2.json(policyPath, bundle.config);
+    }
+    return { written: writer2.written, removed: writer2.removed, warnings: writer2.warnings, root: writer2.root };
+  }
   let root;
   let configPath;
   if (kind === "project") {
@@ -18863,7 +18908,7 @@ async function rmCmd2(client, args, flags) {
 }
 
 // src/commands/layers.ts
-var LAYER_USAGE = "template [<name>], user, or org";
+var LAYER_USAGE = "template [<name>], user, org, or policy";
 function parseLayerArgs(verb, args, opts) {
   const positionals = [];
   let dir;
@@ -18890,18 +18935,29 @@ function parseLayerArgs(verb, args, opts) {
     layer = { kind: "template" };
   } else if (first === "template") {
     layer = second === void 0 ? { kind: "template" } : { kind: "template", name: second };
-  } else if (first === "user" || first === "org") {
+  } else if (first === "user" || first === "org" || first === "policy") {
     layer = { kind: first };
     if (second !== void 0) extra.unshift(second);
   } else {
     throw new PiPodError(`unknown layer "${first}"`, { hint: `layers: ${LAYER_USAGE}` });
   }
   if (extra.length > 0) throw new PiPodError(`unexpected \`pipod ${verb}\` argument(s): ${extra.join(" ")}`);
-  if (dir !== void 0 && layer.kind !== "org") throw new PiPodError("--dir only applies to the org layer");
+  if (dir !== void 0 && layer.kind !== "org" && layer.kind !== "policy") {
+    throw new PiPodError("--dir only applies to the org and policy layers");
+  }
   return { layer, ...dir !== void 0 ? { dir } : {}, yes, withSecrets };
 }
 function sourceKindOf(layer) {
-  return layer.kind === "template" ? "project" : layer.kind === "user" ? "user-dir" : "org-dir";
+  switch (layer.kind) {
+    case "template":
+      return "project";
+    case "user":
+      return "user-dir";
+    case "org":
+      return "org-dir";
+    case "policy":
+      return "policy-file";
+  }
 }
 async function fetchRemoteLayer(client, layer, source) {
   if (layer.kind === "template") {
@@ -18924,6 +18980,17 @@ async function fetchRemoteLayer(client, layer, source) {
       scopeId: template.id
     };
   }
+  if (layer.kind === "policy") {
+    const current2 = await client.getOrgPolicy();
+    return {
+      bundle: settingsBundle(current2),
+      version: current2.version,
+      secretNames: [],
+      label: `org policy v${current2.version}`,
+      scope: "policy",
+      scopeId: client.orgId
+    };
+  }
   const current = layer.kind === "user" ? await client.getUserSettings() : await client.getOrgSettings();
   const scopeId = layer.kind === "user" ? client.userId : client.orgId;
   const listed = await client.listSecrets(layer.kind, scopeId).catch(() => ({ secrets: [] }));
@@ -18939,6 +19006,7 @@ async function fetchRemoteLayer(client, layer, source) {
 function localLabel(layer, flags) {
   if (layer.kind === "template") return "project";
   if (layer.kind === "user") return "~/.pi-pod + ~/.pi/agent";
+  if (layer.kind === "policy") return displayPath(policySourcePath({ dir: flags.dir, home: flags.home }), flags.home);
   return displayPath(orgSourceDir({ dir: flags.dir, home: flags.home }), flags.home);
 }
 function printDiff(heading, lines) {
@@ -18972,22 +19040,10 @@ async function runPull(args, flags) {
   const kind = sourceKindOf(parsed.layer);
   let source;
   let firstPull = false;
-  if (kind === "org-dir" && !fs31.existsSync(orgSourceDir({ dir: parsed.dir, home: flags.home }))) {
+  const localPath = kind === "org-dir" ? orgSourceDir({ dir: parsed.dir, home: flags.home }) : kind === "policy-file" ? policySourcePath({ dir: parsed.dir, home: flags.home }) : null;
+  if (localPath !== null && !fs31.existsSync(localPath)) {
     firstPull = true;
-    source = {
-      kind,
-      config: {},
-      initScript: "",
-      bakeScript: "",
-      piFiles: {},
-      env: {},
-      warnings: [],
-      name: "org settings",
-      templateRef: null,
-      projectRoot: null,
-      root: orgSourceDir({ dir: parsed.dir, home: flags.home }),
-      configPath: ""
-    };
+    source = { config: {}, initScript: "", bakeScript: "", piFiles: {}, env: {}, warnings: [], templateRef: null };
   } else {
     source = await compileBundleSource({ source: kind, cwd, home: flags.home, includeEnv: false, dir: parsed.dir });
   }
@@ -19048,6 +19104,11 @@ async function runPush(args, flags) {
     return 0;
   }
   if (remote.version === void 0) throw new PiPodError(`${remote.label} has no version to compare-and-swap against`);
+  if (remote.scope === "policy") {
+    const written2 = await flags.client.putOrgPolicy({ config: source.config, version: remote.version });
+    info(`pushed ${local} to org policy v${written2.version}`);
+    return 0;
+  }
   const body = {
     config: source.config,
     version: remote.version,
@@ -19120,7 +19181,7 @@ async function runSettings(args, flags) {
   const [scope = "user", action = "show", ...rest] = args;
   if (scope !== "user" && scope !== "org") {
     throw new PiPodError(`unknown settings scope "${scope}"`, {
-      hint: `${USAGE}; templates are managed with \`pipod templates\``
+      hint: `${USAGE}; templates are managed with \`pipod templates\`, and org policy with \`pipod pull|diff|push policy\``
     });
   }
   if (action === "show") {