@velaro/cli 1.4.102 → 1.4.104

package/lib/shopify-write-policy.test.js

@@ -0,0 +1,34 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { buildWritePolicyBody, parseCap } from './commands/shopify.js';
+
+const root = path.join(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
+
+test('parseCap handles numbers, default and invalid', () => {
+  assert.equal(parseCap(undefined, 'x'), undefined);
+  assert.equal(parseCap('default', 'x'), null);
+  assert.equal(parseCap('12.5', 'x'), 12.5);
+  assert.throws(() => parseCap('abc', 'x'));
+  assert.throws(() => parseCap('-1', 'x'));
+});
+
+test('buildWritePolicyBody is partial and maps default to null', () => {
+  assert.deepEqual(buildWritePolicyBody({ enableShopifyWrite: false }), { enableShopifyWrite: false });
+  assert.deepEqual(buildWritePolicyBody({ maxRefundAmount: '100', maxDiscountPercent: 'default' }), { maxRefundAmount: 100, maxDiscountPercent: null });
+  assert.throws(() => buildWritePolicyBody({}));
+});
+
+test('CLI and MCP expose the write-policy surface and it is registered', () => {
+  const cli = fs.readFileSync(path.join(root, 'cli/bin/velaro.js'), 'utf8');
+  assert.match(cli, /\.command\(shopifyCommand\)/);
+  const mcp = fs.readFileSync(path.join(root, 'mcp/server.js'), 'utf8');
+  for (const t of ['shopify_get_write_policy', 'shopify_set_write_policy']) {
+    assert.match(mcp, new RegExp(`name: '${t}'`));
+    assert.match(mcp, new RegExp(`case '${t}'`));
+  }
+  assert.match(mcp, /messagingPut\('\/Shopify\/WritePolicy'/);
+  assert.match(mcp, /messagingGet\('\/Shopify\/WritePolicy'/);
+});

package/lib/signature-policy.js

@@ -0,0 +1,70 @@
+// Pure helpers for `velaro signature policy` (and mirrored in mcp/server.js signature_policy_set).
+// The messaging endpoint PUT Signatures/policy REPLACES the row for a team, and silently turns an unknown mode
+// into "follow the company-wide value", so we validate here and merge onto the current row before sending.
+
+const MODES = {
+  'locked': 'admin_locked',
+  'admin-locked': 'admin_locked',
+  'admin_locked': 'admin_locked',
+  'company-default': 'company_default',
+  'company_default': 'company_default',
+  'personal-only': 'personal_only',
+  'personal_only': 'personal_only',
+};
+
+// Returns undefined when not supplied, null for "follow the company-wide setting", else the API value.
+export function parseMode(value) {
+  if (value === undefined) return undefined;
+  const v = String(value).trim().toLowerCase();
+  if (v === 'default' || v === 'inherit' || v === '') return null;
+  const mode = MODES[v];
+  if (!mode) throw new Error('mode must be locked, company-default, personal-only or default');
+  return mode;
+}
+
+export function parseTeamId(value) {
+  if (value === undefined || value === null || value === '') return 0;
+  const n = Number(value);
+  if (!Number.isInteger(n) || n < 0) throw new Error('teamId must be 0 (company-wide) or a team id');
+  return n;
+}
+
+// current: the matching row from GET Signatures/policy (or undefined). opts: only the fields being changed.
+// A field left out keeps its current value; null clears it back to "follow the company-wide setting".
+export function buildPolicyBody(current, opts = {}) {
+  const cur = current ?? {};
+  const body = {
+    teamId: parseTeamId(opts.teamId ?? cur.teamId),
+    mode: cur.mode ?? null,
+    corporateSignature: cur.corporateSignature || null,
+    disclaimerEnabled: cur.disclaimerEnabled ?? null,
+    disclaimerText: cur.disclaimerText || null,
+  };
+  const mode = parseMode(opts.mode);
+  if (mode !== undefined) body.mode = mode;
+  if (opts.corporateSignature !== undefined) body.corporateSignature = opts.corporateSignature || null;
+  if (opts.disclaimerEnabled !== undefined) {
+    if (opts.disclaimerEnabled !== null && typeof opts.disclaimerEnabled !== 'boolean') {
+      throw new Error('disclaimerEnabled must be true, false or null');
+    }
+    body.disclaimerEnabled = opts.disclaimerEnabled;
+  }
+  if (opts.disclaimerText !== undefined) body.disclaimerText = opts.disclaimerText || null;
+  if (body.corporateSignature && body.corporateSignature.length > 4000) throw new Error('corporateSignature is limited to 4000 characters');
+  if (body.disclaimerText && body.disclaimerText.length > 2000) throw new Error('disclaimerText is limited to 2000 characters');
+  return body;
+}
+
+export function findPolicy(policies, teamId) {
+  const id = parseTeamId(teamId);
+  return (Array.isArray(policies) ? policies : []).find((p) => p.teamId === id);
+}
+
+export function describeMode(mode) {
+  switch (mode) {
+    case 'admin_locked': return 'locked (company signature only)';
+    case 'company_default': return 'company default (personal signatures allowed)';
+    case 'personal_only': return 'personal only';
+    default: return 'follows company-wide setting (personal only if none set)';
+  }
+}

package/lib/signature-policy.test.js

@@ -0,0 +1,48 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { parseMode, parseTeamId, buildPolicyBody, findPolicy, describeMode } from './signature-policy.js';
+
+test('parseMode maps friendly names to API values and rejects unknown ones', () => {
+  assert.equal(parseMode('locked'), 'admin_locked');
+  assert.equal(parseMode('Company-Default'), 'company_default');
+  assert.equal(parseMode('personal_only'), 'personal_only');
+  assert.equal(parseMode('default'), null);
+  assert.equal(parseMode(undefined), undefined);
+  assert.throws(() => parseMode('strict'), /mode must be/);
+});
+
+test('parseTeamId defaults to company-wide and rejects junk', () => {
+  assert.equal(parseTeamId(undefined), 0);
+  assert.equal(parseTeamId('7'), 7);
+  assert.throws(() => parseTeamId('abc'), /teamId/);
+  assert.throws(() => parseTeamId(-1), /teamId/);
+});
+
+test('buildPolicyBody keeps current values for fields that are not passed', () => {
+  const cur = { teamId: 0, mode: 'company_default', corporateSignature: '<b>Acme</b>', disclaimerEnabled: true, disclaimerText: 'Confidential' };
+  const body = buildPolicyBody(cur, { mode: 'locked' });
+  assert.deepEqual(body, { teamId: 0, mode: 'admin_locked', corporateSignature: '<b>Acme</b>', disclaimerEnabled: true, disclaimerText: 'Confidential' });
+});
+
+test('buildPolicyBody with no existing row starts from all-null (follow company-wide)', () => {
+  const body = buildPolicyBody(undefined, { teamId: 5, disclaimerEnabled: true });
+  assert.deepEqual(body, { teamId: 5, mode: null, corporateSignature: null, disclaimerEnabled: true, disclaimerText: null });
+});
+
+test('null clears a field and over-long text is rejected before sending', () => {
+  const cur = { teamId: 0, mode: 'admin_locked', disclaimerEnabled: true, disclaimerText: 'x' };
+  assert.equal(buildPolicyBody(cur, { disclaimerEnabled: null }).disclaimerEnabled, null);
+  assert.equal(buildPolicyBody(cur, { mode: 'default' }).mode, null);
+  assert.throws(() => buildPolicyBody(cur, { disclaimerText: 'a'.repeat(2001) }), /2000/);
+  assert.throws(() => buildPolicyBody(cur, { corporateSignature: 'a'.repeat(4001) }), /4000/);
+  assert.throws(() => buildPolicyBody(cur, { disclaimerEnabled: 'yes' }), /true, false or null/);
+});
+
+test('findPolicy picks the row for a team and describeMode is readable', () => {
+  const rows = [{ teamId: 0, mode: 'personal_only' }, { teamId: 3, mode: 'admin_locked' }];
+  assert.equal(findPolicy(rows, 3).mode, 'admin_locked');
+  assert.equal(findPolicy(rows, undefined).teamId, 0);
+  assert.equal(findPolicy(null, 1), undefined);
+  assert.match(describeMode('admin_locked'), /locked/);
+  assert.match(describeMode(null), /follows/);
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@velaro/cli",
-  "version": "1.4.102",
+  "version": "1.4.104",
   "description": "Velaro Workspace v20 — command-line interface for managing bots, knowledge base ingestion, MCP API keys, search indexes, and ops health.",
   "type": "module",
   "bin": {