@velaro/cli 1.4.91 → 1.4.93

package/lib/avatar-override.js

@@ -0,0 +1,56 @@
+// Pure helpers for `velaro avatar group-override | workflow-override | effective | reset`.
+// Per-group / per-workflow avatar + backdrop overrides live in velaro-messaging (VelaroAvatarController);
+// effective = perWorkflow ?? perGroup ?? perSite. Kept dependency-free so it is unit-testable.
+
+export const BACKDROP_MODES = ['none', 'color', 'gradient', 'image'];
+
+const HEX = /^#[0-9a-fA-F]{3,8}$/;
+const GRADIENT = /^#[0-9a-fA-F]{3,8},#[0-9a-fA-F]{3,8}$/;
+const HTTPS = /^https:\/\/[^\s"'()<>\\]+$/i;
+
+/** Returns an error string or null. Mirrors AvatarExperienceSettings.ValidateBackdrop on the server. */
+export function validateBackdrop(mode, value) {
+  if (mode === undefined || mode === '') return null;
+  if (!BACKDROP_MODES.includes(mode)) return `--backdrop must be one of ${BACKDROP_MODES.join(', ')}`;
+  const v = (value ?? '').trim();
+  if (mode === 'none') return null;
+  if (mode === 'color') return HEX.test(v) ? null : '--backdrop-value must be a hex color like #1e293b';
+  if (mode === 'gradient') return GRADIENT.test(v) ? null : '--backdrop-value must be two hex colors like #1e293b,#7c3aed';
+  return v.length <= 500 && HTTPS.test(v) ? null : '--backdrop-value must be an https image URL';
+}
+
+/**
+ * Builds the PUT body. Merge by default: only flags the caller passed are sent, so changing one field never wipes the
+ * others; an empty string clears that one field back to inherit. `replace` replaces the whole override.
+ */
+export function overrideBody(argv) {
+  const body = { merge: !argv.replace };
+  const map = {
+    provider: 'providerSlug',
+    avatar: 'avatarId',
+    personality: 'personalityPresetSlug',
+    voice: 'voiceId',
+    'display-name': 'displayName',
+    backdrop: 'backgroundMode',
+    'backdrop-value': 'backgroundValue',
+  };
+  for (const [flag, key] of Object.entries(map)) {
+    if (argv[flag] !== undefined) body[key] = String(argv[flag]);
+  }
+  const err = validateBackdrop(body.backgroundMode, body.backgroundValue);
+  if (err) throw new Error(err);
+  if (body.backgroundMode === undefined && body.backgroundValue !== undefined && body.backgroundValue !== '')
+    throw new Error('--backdrop-value needs --backdrop (none | color | gradient | image)');
+  if (Object.keys(body).length === 1) throw new Error('Pass at least one of --avatar --personality --voice --display-name --backdrop --backdrop-value --provider');
+  return body;
+}
+
+/** `group` or `workflow` target path segment from the flags; exactly one is required. */
+export function scopePath(argv) {
+  const hasGroup = argv.group !== undefined;
+  const hasWorkflow = argv.workflow !== undefined;
+  if (hasGroup === hasWorkflow) throw new Error('Pass exactly one of --group <teamId> or --workflow <workflowId>');
+  const id = Number(hasGroup ? argv.group : argv.workflow);
+  if (!Number.isInteger(id) || id <= 0) throw new Error('The id must be a positive whole number');
+  return hasGroup ? `/avatar/groups/${id}` : `/avatar/workflows/${id}`;
+}

package/lib/avatar-override.test.js

@@ -0,0 +1,43 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { overrideBody, scopePath, validateBackdrop } from './avatar-override.js';
+
+const TIMKEN = 'https://admin.velaro.com/avatar-backdrops/timken-hr-office.png';
+
+test('validateBackdrop accepts https images, hex colors and two-color gradients only', () => {
+  assert.equal(validateBackdrop('image', TIMKEN), null);
+  assert.match(validateBackdrop('image', 'http://admin.velaro.com/a.png'), /https/);
+  assert.match(validateBackdrop('image', 'javascript:alert(1)'), /https/);
+  assert.match(validateBackdrop('image', 'https://admin.velaro.com/a.png");background:url(//evil'), /https/);
+  assert.equal(validateBackdrop('color', '#1e293b'), null);
+  assert.match(validateBackdrop('color', 'red'), /hex/);
+  assert.equal(validateBackdrop('gradient', '#111,#222'), null);
+  assert.match(validateBackdrop('gradient', '#111'), /two hex/);
+  assert.equal(validateBackdrop('none', ''), null);
+  assert.match(validateBackdrop('sparkles', 'x'), /one of/);
+});
+
+test('overrideBody merges by default and only sends the flags that were passed', () => {
+  assert.deepEqual(overrideBody({ avatar: 'priya', backdrop: 'image', 'backdrop-value': TIMKEN }), {
+    merge: true,
+    avatarId: 'priya',
+    backgroundMode: 'image',
+    backgroundValue: TIMKEN,
+  });
+  assert.deepEqual(overrideBody({ 'display-name': '' }), { merge: true, displayName: '' }); // clears just that field
+  assert.equal(overrideBody({ avatar: 'maya', replace: true }).merge, false);
+});
+
+test('overrideBody refuses an unsafe backdrop, a value with no mode, and an empty change', () => {
+  assert.throws(() => overrideBody({ backdrop: 'image', 'backdrop-value': 'http://admin.velaro.com/a.png' }), /https/);
+  assert.throws(() => overrideBody({ 'backdrop-value': '#fff' }), /needs --backdrop/);
+  assert.throws(() => overrideBody({}), /at least one/);
+});
+
+test('scopePath needs exactly one of --group / --workflow and a positive id', () => {
+  assert.equal(scopePath({ workflow: 12 }), '/avatar/workflows/12');
+  assert.equal(scopePath({ group: 7 }), '/avatar/groups/7');
+  assert.throws(() => scopePath({}), /exactly one/);
+  assert.throws(() => scopePath({ group: 1, workflow: 2 }), /exactly one/);
+  assert.throws(() => scopePath({ group: 0 }), /positive/);
+});

package/lib/commands/agent.js

@@ -1,4 +1,4 @@
-import { get, post, messagingGet, messagingPost, getCredentials }  from '../api.js';
+import { get, post, messagingGet, messagingPost, messagingPut, getCredentials }  from '../api.js';
 import { runCommand }  from '../run.js';
 
 const VALID_STATUSES = ['Available', 'Away', 'Offline'];
@@ -97,6 +97,18 @@ export const agentCommand = {
         console.log(`  ${result.message ?? ''}`);
       }),
     })
+    .command({
+      command:  'set-roles',
+      describe: 'Set roles (Administrator/Manager/Agent) of an EXISTING user on a site (Velaro staff only) -- makes E2E/QA test logins admin-capable',
+      builder:  (y) => y
+        .option('site-id', { type: 'number', demandOption: true, describe: 'Target site ID' })
+        .option('email',   { type: 'string', demandOption: true, describe: 'Existing user email' })
+        .option('roles',   { type: 'array',  demandOption: true, describe: 'e.g. --roles Administrator' }),
+      handler: runCommand(async (argv) => {
+        const r = await messagingPut(`/SupportTools/sites/${argv['site-id']}/agents/roles`, { email: argv.email, roles: argv.roles.map(String) });
+        console.log(`OK: ${r.email} roles ${r.before || '(none)'} -> ${r.roles.join(', ')}`);
+      }),
+    })
     .command({
       command:  'set-status',
       describe: 'Set an agent\'s availability status (admin only)',

package/lib/commands/avatar.js

@@ -1,4 +1,5 @@
-import { request } from '../api.js';
+import { request, messagingGet, messagingPut, messagingDel } from '../api.js';
+import { overrideBody, scopePath } from '../avatar-override.js';
 import { runCommand } from '../run.js';
 
 // ── velaro avatar ─────────────────────────────────────────────────────────────
@@ -104,5 +105,53 @@ export const avatarCommand = {
         console.log(`  Max TTS chars/mo: ${data.maxAvatarTtsChars}\n`);
       }),
     })
-    .demandCommand(1, 'Specify a subcommand: get | enable | disable | set'),
+    .command({
+      command:  'override',
+      describe: 'Set the person / personality / voice / name / backdrop for ONE group or workflow of YOUR site (perWorkflow ?? perGroup ?? perSite)',
+      builder:  y => y
+        .option('group',          { type: 'number', describe: 'Group (team) id' })
+        .option('workflow',       { type: 'number', describe: 'Workflow id (wins over its group)' })
+        .option('avatar',         { type: 'string', describe: 'Library avatar slug (see the avatar library), e.g. priya. Empty string clears.' })
+        .option('personality',    { type: 'string', describe: 'Personality preset slug. Empty string clears.' })
+        .option('voice',          { type: 'string', describe: 'ElevenLabs voice id. Empty string clears.' })
+        .option('display-name',   { type: 'string', describe: 'Visitor-facing avatar name. Empty string clears.' })
+        .option('backdrop',       { type: 'string', choices: ['none', 'color', 'gradient', 'image', ''], describe: 'Backdrop type. none = explicitly no backdrop; empty string = inherit.' })
+        .option('backdrop-value', { type: 'string', describe: 'Hex color, "#a,#b" gradient, or https image URL' })
+        .option('provider',       { type: 'string', describe: 'Provider slug (a library avatar implies velaro)' })
+        .option('replace',        { type: 'boolean', describe: 'Replace the whole override instead of changing only the flags passed' }),
+      handler:  runCommand(async argv => {
+        const base = scopePath(argv);
+        const data = await messagingPut(`${base}/override`, overrideBody(argv));
+        if (!data?.success) throw new Error(data?.error || 'Override failed');
+        const eff = await messagingGet(`${base}/effective`);
+        console.log(`
+✓ Override saved. Effective now: avatar=${eff.avatarId ?? '(default)'} backdrop=${eff.backgroundMode}${eff.backgroundValue ? ' ' + eff.backgroundValue : ''} name=${eff.displayName ?? '(AI)'} layer=${eff.layer}
+`);
+      }),
+    })
+    .command({
+      command:  'effective',
+      describe: 'Show what a group or workflow of your site gets (override fields layered over the site default)',
+      builder:  y => y
+        .option('group',    { type: 'number', describe: 'Group (team) id' })
+        .option('workflow', { type: 'number', describe: 'Workflow id' }),
+      handler:  runCommand(async argv => {
+        const eff = await messagingGet(`${scopePath(argv)}/effective`);
+        console.log(JSON.stringify(eff, null, 2));
+      }),
+    })
+    .command({
+      command:  'reset',
+      describe: 'Remove a group or workflow override (back to the next layer / site default)',
+      builder:  y => y
+        .option('group',    { type: 'number', describe: 'Group (team) id' })
+        .option('workflow', { type: 'number', describe: 'Workflow id' }),
+      handler:  runCommand(async argv => {
+        const data = await messagingDel(`${scopePath(argv)}/override`);
+        console.log(`
+✓ Reset (${data?.removed ?? 0} override removed)
+`);
+      }),
+    })
+    .demandCommand(1, 'Specify a subcommand: get | enable | disable | set | override | effective | reset'),
 };

package/lib/commands/migrate.js

@@ -9,7 +9,8 @@ export const migrateCommand = {
       .command(migrateExportCommand)
       .command(migrateLivefluenceCommand)
       .command(migrateUrlRulesCommand)
-      .demandCommand(1, 'Specify a subcommand: export, livefluence, url-rules'),
+      .command(migrateTeamsCommand)
+      .demandCommand(1, 'Specify a subcommand: export, livefluence, url-rules, teams'),
   handler: () => {},
 };
 
@@ -21,9 +22,13 @@ const migrateExportCommand = {
   builder:  (y) =>
     y
       .positional('v10SiteId', { type: 'number', describe: 'V10 site ID to export from' })
-      .option('v20-site-id',   { type: 'number', alias: 's', describe: 'V20 site ID for auto-matching teams/AI configs' }),
+      .option('v20-site-id',   { type: 'number', alias: 's', describe: 'V20 site ID for auto-matching teams/AI configs' })
+      .option('include-non-routing', { type: 'boolean', default: false, describe: 'Also include v10 rules with IsRouting=false (group-assignment rules)' }),
   handler:  runCommand(async (argv) => {
-    const qs = argv['v20-site-id'] ? `?v20SiteId=${argv['v20-site-id']}` : '';
+    const params = [];
+    if (argv['v20-site-id']) params.push(`v20SiteId=${argv['v20-site-id']}`);
+    if (argv['include-non-routing']) params.push('includeNonRouting=true');
+    const qs = params.length ? `?${params.join('&')}` : '';
     const data = await get(`/DatabaseTool/V10Export/${argv.v10SiteId}${qs}`);
 
     console.log(`\n${'─'.repeat(60)}`);
@@ -78,7 +83,9 @@ const migrateLivefluenceCommand = {
       .option('v10-site-id',  { type: 'number',  alias: 'v', describe: 'V10 (Livefluence) site ID', demandOption: true })
       .option('v20-site-id',  { type: 'number',  alias: 's', describe: 'V20 destination site ID', demandOption: true })
       .option('dry-run',      { type: 'boolean', default: false, describe: 'Preview without creating' })
-      .option('enable',       { type: 'boolean', default: false, describe: 'Enable created workflows immediately (default: disabled)' })
+      .option('enable',       { type: 'boolean', default: false, describe: 'Enable created workflows immediately (default: disabled; workflows with unconverted v10 terms always stay disabled)' })
+      .option('include-non-routing', { type: 'boolean', default: false, describe: 'Also migrate v10 rules with IsRouting=false (group-assignment rules)' })
+      .option('route-bot-groups-to-team', { type: 'boolean', default: false, describe: 'Route to the v20 team named after the v10 group even if the group had a v10 bot' })
       .option('team-map',     { type: 'string',  describe: 'JSON: [{"v10GroupId":1,"v20TeamId":5},...]  override auto-resolution for teams' })
       .option('ai-config-map',{ type: 'string',  describe: 'JSON: [{"v10GroupId":2,"v20AiConfigId":3},...] override auto-resolution for AI configs' }),
   handler:  runCommand(async (argv) => {
@@ -90,6 +97,8 @@ const migrateLivefluenceCommand = {
       v20SiteId,
       dryRun: argv['dry-run'],
       enable: argv.enable,
+      includeNonRouting:    argv['include-non-routing'],
+      routeBotGroupsToTeam: argv['route-bot-groups-to-team'],
       teamMappings:     argv['team-map']      ? JSON.parse(argv['team-map'])       : [],
       aiConfigMappings: argv['ai-config-map'] ? JSON.parse(argv['ai-config-map'])  : [],
     };
@@ -111,6 +120,8 @@ const migrateLivefluenceCommand = {
         if (item.v2AiConfigId)  console.log(`       → AI Config id=${item.v2AiConfigId}`);
         if (item.v2TeamId)      console.log(`       → Team id=${item.v2TeamId}`);
         if (item.v10Expression) console.log(`       V10 expression: ${item.v10Expression}`);
+        if (item.conditionGroups !== undefined) console.log(`       v20 condition groups (OR): ${item.conditionGroups}`);
+        for (const u of item.unconverted ?? []) console.log(`       ⚠ not converted: ${u}`);
         console.log('');
       }
     }
@@ -127,8 +138,7 @@ const migrateLivefluenceCommand = {
     console.log(`  ${result.message}`);
     if (!argv['dry-run'] && result.created > 0) {
       console.log(`\n  ⚠ All workflows created DISABLED — review conditions in the canvas then enable.`);
-      console.log(`    Note: V10 routing expressions were NOT auto-converted.`);
-      console.log(`    Add conditions manually in the Workflows canvas (Phase 3 trigger node).`);
+      console.log(`    Country and URL terms are converted; terms marked 'not converted' need manual canvas conditions.`);
     }
     console.log(`${'─'.repeat(60)}\n`);
   }),
@@ -157,3 +167,31 @@ const migrateUrlRulesCommand = {
     console.log(`\n  ${result.dryRun ? 'DRY RUN: ' : ''}created ${result.created}, skipped ${result.skipped}`);
   }),
 };
+
+// -- copy v10 groups to v20 teams (v10 read-only) ------------------------------
+
+const migrateTeamsCommand = {
+  command:  'teams',
+  describe: 'Copy v10 (Livefluence) groups to v20 teams on a site (v10 is read-only; idempotent by name)',
+  builder:  (y) =>
+    y
+      .option('v10-site-id', { type: 'number',  alias: 'v', describe: 'V10 (Livefluence) site ID', demandOption: true })
+      .option('v20-site-id', { type: 'number',  alias: 's', describe: 'V20 destination site ID', demandOption: true })
+      .option('groups',      { type: 'string',  describe: 'Comma-separated group names to copy (default: every non-deleted v10 group). "Default Group" maps to the site default team.' })
+      .option('dry-run',     { type: 'boolean', default: false, describe: 'Preview without creating' }),
+  handler:  runCommand(async (argv) => {
+    const body = {
+      v10SiteId: argv['v10-site-id'],
+      v20SiteId: argv['v20-site-id'],
+      dryRun:    argv['dry-run'],
+      groupNames: argv.groups ? argv.groups.split(',').map(g => g.trim()).filter(Boolean) : [],
+    };
+    const result = await post('/DatabaseTool/V10CreateTeams', body);
+    console.log(`\n  ${result.dryRun ? 'DRY RUN - ' : ''}v10 site ${body.v10SiteId} -> v20 site ${body.v20SiteId}\n`);
+    for (const t of result.teams ?? []) {
+      const members = t.v10Members !== undefined ? `  (v10 members: ${t.v10Members})` : '';
+      console.log(`  ${t.status.padEnd(24)} ${t.name}${t.teamId ? `  [team id=${t.teamId}]` : ''}${members}`);
+    }
+    console.log('\n  Members are not copied; assign v20 agents to the new teams.\n');
+  }),
+};

package/lib/commands/recruiting.js

@@ -1,7 +1,7 @@
-import { writeFileSync } from 'fs';
+import { readFileSync, writeFileSync } from 'fs';
 import { messagingGet, messagingPost, messagingPut, messagingDel, getCredentials } from '../api.js';
 import { runCommand } from '../run.js';
-import { applicationIdPath, buildApplySettingsBody, buildBotSettingsBody, buildRenewBody, jobLifecyclePath } from '../recruiting-apply.js';
+import { buildAssignBody, buildNoteBody, buildPipelineBody, buildRetentionBody, buildStageBody, applicationIdPath, buildApplySettingsBody, buildBotSettingsBody, buildHostedBody, buildJobPayBody, buildRenewBody, jobLifecyclePath, jobPayPath } from '../recruiting-apply.js';
 
 // -- velaro recruiting --------------------------------------------------------
 // CLI surface for the Recruiting Bot: job-feed sync (JSON/XML/RSS/Indeed/
@@ -18,9 +18,13 @@ import { applicationIdPath, buildApplySettingsBody, buildBotSettingsBody, buildR
 //   DELETE Recruiting/Jobs/{id}                        -> { success }
 //   GET    Recruiting/Jobs?includeAll=true             -> every status (needs the Job Board lifecycle package)
 //   POST   Recruiting/Jobs/{id}/close | /renew { days? } ; GET Recruiting/Lifecycle -> { entitled, defaultListingDays } (403 without the package)
+//   GET/PUT Recruiting/Hosted { enabled?, regenerateSlug? } ; POST Recruiting/Hosted/FeedKey/Rotate ; PUT Recruiting/Jobs/{id}/Pay -> hosted job pages (package job-board-hosted, 403 without it)
 //   GET    Recruiting/Applications                     -> candidateApplication[]
 //   GET    Recruiting/Applications/AtsFailures; POST Recruiting/Applications/{id}/AtsRetry; PUT Recruiting/ApplySettings { publicApplyEnabled?, autoCreateCaseTypeId?, defaultListingDays? }; GET Recruiting/Applications/{id}/Resume (binary)
 //   GET    Recruiting/Applications/ExportEeoc           -> text/csv (Professional tier+, EnableRecruitingBotEeoc)
+//   GET/PUT Recruiting/Pipeline { stages:[{key,label,color?,applicantVisible?,applicantLabel?}] } ; PUT Recruiting/Applications/{id}/Stage { stage, note? }
+//   GET Recruiting/Applications/{id}/History ; POST .../Notes { note } ; PUT .../Assign { assignedTo }
+//   GET/PUT Recruiting/Retention ; POST Recruiting/Retention/Run?dryRun= -> recruiter pipeline and retention (package job-board-pipeline; 403 job_board_pipeline_not_entitled without it)
 
 const BOLD = '\x1b[1m';
 const DIM  = '\x1b[2m';
@@ -112,6 +116,42 @@ async function jobsLifecycleHandler() {
   console.log(`  Default listing days: ${r.defaultListingDays}\n`);
 }
 
+async function jobsPayHandler(argv) {
+  const r = await messagingPut(jobPayPath(argv.jobId), buildJobPayBody({ min: argv.min, max: argv.max, currency: argv.currency, period: argv.period, clear: argv.clear }));
+  console.log(`\n${GRN}OK${RST} Job listing ${r.id} pay: ${r.display || '(not stated)'} (source: ${r.salarySource || 'none'}).\n`);
+}
+
+function printHosted(r) {
+  console.log(`\n${BOLD}Job Board hosted pages${RST}`);
+  if (!r.entitled) {
+    console.log(`  Package:  not included (the hosted pages, sitemap and feeds are off; admin calls return 403)\n`);
+    return;
+  }
+  console.log(`  Package:      ${GRN}included${RST}`);
+  console.log(`  Published:    ${r.enabled ? `${GRN}yes${RST}` : 'no (every hosted link answers 404)'}`);
+  console.log(`  Open listings:${' '}${r.liveListings ?? 0}`);
+  if (r.boardUrl) {
+    console.log(`  Board link:   ${r.boardUrl}`);
+    console.log(`  Sitemap:      ${r.sitemapUrl}`);
+    console.log(`  Indeed feed:  ${r.indeedFeedUrl}`);
+    console.log(`  Google feed:  ${r.googleFeedUrl}`);
+    console.log(`  ${DIM}The feed URLs contain a secret key; treat them like a password.${RST}`);
+  }
+  console.log(`  Apply form:   ${r.publicApplyEnabled ? 'on' : 'off (candidates are sent to each listing\'s apply link)'}${r.publicApplyEnabled && r.eeocSelfIdAvailable ? ', with voluntary EEO self-ID' : ''}\n`);
+}
+
+async function hostedHandler(argv) {
+  const body = buildHostedBody({ enabled: argv.enabled, regenerateLink: argv.regenerateLink });
+  const r = Object.keys(body).length ? await messagingPut('/Recruiting/Hosted', body) : await messagingGet('/Recruiting/Hosted');
+  printHosted(r);
+}
+
+async function hostedRotateKeyHandler() {
+  const r = await messagingPost('/Recruiting/Hosted/FeedKey/Rotate', {});
+  console.log(`\n${GRN}OK${RST} Feed key rotated; the previous Indeed and Google feed URLs no longer work.`);
+  printHosted(r);
+}
+
 async function applicationsListHandler() {
   const apps = await messagingGet('/Recruiting/Applications');
   if (!Array.isArray(apps) || !apps.length) {
@@ -260,16 +300,42 @@ const jobsCommand = {
       describe: 'Show whether this site has the Job Board lifecycle package and its default listing days',
       handler:  runCommand(jobsLifecycleHandler),
     })
+    .command({
+      command:  'pay <jobId>',
+      describe: 'Set or clear the pay range shown on the hosted page and in its structured data. Needs the Job Board hosted pages package',
+      builder:  (y2) => y2
+        .positional('jobId', { describe: 'Job listing ID', type: 'number' })
+        .option('min',      { describe: 'Minimum (or only) amount', type: 'number' })
+        .option('max',      { describe: 'Maximum amount (optional)', type: 'number' })
+        .option('currency', { describe: '3-letter ISO currency (default USD)', type: 'string' })
+        .option('period',   { describe: 'Hour | Day | Week | Month | Year', type: 'string' })
+        .option('clear',    { describe: 'Remove the stated pay', type: 'boolean' }),
+      handler:  runCommand(jobsPayHandler),
+    })
     .command({
       command:  'delete <jobId>',
       describe: 'Delete a synced job listing',
       builder:  (y2) => y2.positional('jobId', { describe: 'Job listing ID', type: 'number' }),
       handler:  runCommand(jobsDeleteHandler),
     })
-    .demandCommand(1, 'Specify a jobs subcommand: list | close | renew | lifecycle | delete'),
+    .demandCommand(1, 'Specify a jobs subcommand: list | close | renew | lifecycle | pay | delete'),
   handler: () => {},
 };
 
+const hostedCommand = {
+  command:  'hosted',
+  describe: 'Hosted public job pages: show or change the board settings (needs the Job Board hosted pages package)',
+  builder:  (y) => y
+    .option('enabled',         { describe: 'Publish (true) or unpublish (false) the hosted pages, sitemap and feeds', type: 'boolean' })
+    .option('regenerate-link', { describe: 'Issue a NEW opaque board link; every old hosted URL answers 404 (administrators)', type: 'boolean' })
+    .command({
+      command:  'rotate-key',
+      describe: 'Rotate the outbound feed key; the old Indeed and Google feed URLs stop working (administrators)',
+      handler:  runCommand(hostedRotateKeyHandler),
+    }),
+  handler: runCommand(hostedHandler),
+};
+
 const applicationsCommand = {
   command:  'applications <subcommand>',
   describe: 'List candidate applications or export EEOC voluntary self-ID data',
@@ -407,10 +473,100 @@ async function sourcesAddListingHandler(argv) {
 }
 
 async function pipelineMoveHandler(argv) {
-  const app = await messagingPut(`/Recruiting/Applications/${argv.applicationId}/Stage`, { stage: argv.stage });
+  const app = await messagingPut(applicationIdPath(argv.applicationId, 'Stage'), buildStageBody(argv.stage, argv.note));
   console.log(`\n${GRN}OK${RST} Application ${app.id} moved to stage "${app.pipelineStage}".\n`);
 }
 
+function printPipeline(r) {
+  console.log(`\n${BOLD}Job Board pipeline${RST}`);
+  console.log(`  Package:  ${r.entitled ? `${GRN}included${RST}` : 'not included (default stages; history, notes, assignment, stage editing and retention are off)'}`);
+  console.log(`  Source:   ${r.source === 'caseType' ? `case type ${r.caseTypeId}` : 'default list'}`);
+  for (const s of r.stages ?? []) {
+    const seen = s.applicantVisible ? `applicants see "${s.applicantLabel || s.label}"` : 'applicants see "In review"';
+    console.log(`  ${s.key.padEnd(16)} ${String(s.label).padEnd(20)} ${DIM}${seen}${s.color ? `, ${s.color}` : ''}${RST}`);
+  }
+  console.log('');
+}
+
+async function pipelineGetHandler() {
+  printPipeline(await messagingGet('/Recruiting/Pipeline'));
+}
+
+async function pipelineSetHandler(argv) {
+  let raw = argv.stagesJson;
+  if (!raw && argv.file) raw = readFileSync(argv.file, 'utf8');
+  if (!raw) throw new Error('Pass --stages-json \'[{"key":"Applied","label":"Applied"}]\' or --file stages.json.');
+  const r = await messagingPut('/Recruiting/Pipeline', buildPipelineBody(raw));
+  console.log(`\n${GRN}OK${RST} Pipeline saved.`);
+  printPipeline(r);
+}
+
+// The API returns UTC without a zone designator; show Pacific Time like every other user-facing timestamp.
+function pacific(raw) {
+  if (!raw) return '';
+  const d = new Date(/(Z|[+-]\d{2}:?\d{2})$/i.test(raw) ? raw : `${raw}Z`);
+  return Number.isNaN(d.getTime()) ? String(raw) : `${d.toLocaleString('en-US', { timeZone: 'America/Los_Angeles', dateStyle: 'medium', timeStyle: 'short' })} PT`;
+}
+
+async function applicationHistoryHandler(argv) {
+  const r = await messagingGet(applicationIdPath(argv.applicationId, 'History'));
+  const events = r.events ?? [];
+  if (!events.length) {
+    console.log('\n  No history yet.\n');
+    return;
+  }
+  console.log(`\n${BOLD}Application ${argv.applicationId} history${RST} (newest first, Pacific Time)\n`);
+  for (const e of events) {
+    // An Assign event carries the new recruiter in note (empty = unassigned); toStage is just the stage at the time.
+    const what = e.kind === 'Note' ? 'note' : e.kind === 'Assign' ? (e.note ? `assigned to ${e.note}` : 'unassigned') : `${e.fromStage ?? '-'} -> ${e.toStage ?? '?'}`;
+    console.log(`  ${pacific(e.at)}  ${String(e.actorType).padEnd(8)} ${e.actorId ?? ''}  ${what}${e.note && e.kind !== 'Assign' ? `  "${e.note}"` : ''}`);
+  }
+  console.log('');
+}
+
+async function applicationNoteHandler(argv) {
+  await messagingPost(applicationIdPath(argv.applicationId, 'Notes'), buildNoteBody(argv.text));
+  console.log(`\n${GRN}OK${RST} Note added to application ${argv.applicationId}.\n`);
+}
+
+async function applicationAssignHandler(argv) {
+  const app = await messagingPut(applicationIdPath(argv.applicationId, 'Assign'), buildAssignBody(argv.who));
+  console.log(`\n${GRN}OK${RST} Application ${app.id} ${app.assignedTo ? `assigned to ${app.assignedTo}` : 'unassigned'}.\n`);
+}
+
+function printRetention(r) {
+  console.log(`\n${BOLD}Applicant record retention${RST}`);
+  console.log(`  Automatic retention: ${r.enabled ? `${GRN}on${RST}` : 'off'}${r.enabled && r.dryRun ? ' (count only, nothing is deleted)' : ''}`);
+  console.log(`  Legal hold:          ${r.legalHold ? `${RED}ON, all deletion stopped${RST}` : 'off'}`);
+  console.log(`  Federal contractor:  ${r.isFederalContractor ? 'yes' : 'no'}`);
+  console.log(`  Retention days:      ${r.retentionDays} (legal minimum ${r.floorDays}, applied ${r.effectiveDays})`);
+  if (r.lastRunAt) console.log(`  Last run:            ${pacific(r.lastRunAt)}, ${r.lastRunDeleted} deleted, ${r.lastRunWouldDelete} would have been deleted`);
+  console.log(`  ${DIM}Records are never deleted before 1 year (2 years for federal contractors). Counts only.${RST}\n`);
+}
+
+async function retentionHandler(argv) {
+  const action = argv.action ?? 'get';
+  if (action === 'get') return printRetention(await messagingGet('/Recruiting/Retention'));
+  if (action === 'set') {
+    // Arming real deletion, or lifting a legal hold, is destructive: refuse unless --yes.
+    if ((argv.dryRun === false || argv.legalHold === false) && !argv.yes) {
+      throw new Error('This can start real deletion of applicant records or lift a legal hold. Preview first with `velaro recruiting retention run`, then repeat with --yes.');
+    }
+    const r = await messagingPut('/Recruiting/Retention', buildRetentionBody({ enabled: argv.enabled, dryRun: argv.dryRun, days: argv.days, federalContractor: argv.federalContractor, legalHold: argv.legalHold }));
+    console.log(`\n${GRN}OK${RST} Retention settings saved.`);
+    return printRetention(r);
+  }
+  // run: previews by default (nothing deleted); --execute --yes performs a real run.
+  if (argv.execute && !argv.yes) throw new Error('--execute permanently deletes applicant records past retention. Preview first (omit --execute), then repeat with --execute --yes.');
+  const r = await messagingPost(`/Recruiting/Retention/Run?dryRun=${argv.execute ? 'false' : 'true'}`, {});
+  console.log(`\n${BOLD}Retention run${RST} ${r.dryRun ? '(preview, nothing deleted)' : ''}`);
+  console.log(`  Due:                ${r.due}`);
+  console.log(`  Deleted:            ${r.deleted}`);
+  console.log(`  Resumes deleted:    ${r.resumesDeleted}`);
+  console.log(`  Held by legal hold: ${r.skippedLegalHold}`);
+  console.log(`  Legal minimum:      ${r.floorDays} days\n`);
+}
+
 const sourcesCommand = {
   command:  'sources <subcommand>',
   describe: 'Manage named job posting sources for a multi-employer job board (EnableJobBoardMultiEmployer)',
@@ -478,16 +634,74 @@ const pipelineCommand = {
   builder:  (y) => y
     .command({
       command:  'move <applicationId> <stage>',
-      describe: 'Move a candidate application to a new pipeline stage (Applied|Screened|Interview|Offer|Hired|Rejected)',
+      describe: 'Move a candidate application to a new pipeline stage (default stages: Applied|Screened|Interview|Offer|Hired|Rejected)',
       builder:  (y2) => y2
         .positional('applicationId', { type: 'number' })
-        .positional('stage', { type: 'string' }),
+        .positional('stage', { type: 'string' })
+        .option('note', { describe: 'Note recorded in the stage history', type: 'string' }),
       handler: runCommand(pipelineMoveHandler),
     })
-    .demandCommand(1, 'Specify a pipeline subcommand: move'),
+    .command({ command: 'get', describe: 'Show the pipeline stages (the default list when the Job board pipeline package is not included)', handler: runCommand(pipelineGetHandler) })
+    .command({
+      command:  'set',
+      describe: 'Replace the pipeline stages (needs the Job board pipeline package)',
+      builder:  (y2) => y2
+        .option('stages-json', { describe: 'JSON array: [{"key","label","color"?,"applicantVisible"?,"applicantLabel"?}]', type: 'string' })
+        .option('file', { describe: 'Read the stages JSON from a file', type: 'string' }),
+      handler: runCommand(pipelineSetHandler),
+    })
+    .demandCommand(1, 'Specify a pipeline subcommand: get | set | move'),
   handler: () => {},
 };
 
+// `recruiting application ...` (singular): per-application stage, history, notes and assignment.
+const applicationCommand = {
+  command:  'application <subcommand>',
+  describe: 'One application: move stage, show history, add a note, assign a recruiter',
+  builder:  (y) => y
+    .command({
+      command:  'stage <applicationId> <stage>',
+      describe: 'Move an application to a stage, with an optional note',
+      builder:  (y2) => y2.positional('applicationId', { type: 'number' }).positional('stage', { type: 'string' }).option('note', { describe: 'Note recorded in the stage history', type: 'string' }),
+      handler:  runCommand(pipelineMoveHandler),
+    })
+    .command({
+      command:  'history <applicationId>',
+      describe: 'Show the stage, note and assignment history, newest first (needs the Job board pipeline package)',
+      builder:  (y2) => y2.positional('applicationId', { type: 'number' }),
+      handler:  runCommand(applicationHistoryHandler),
+    })
+    .command({
+      command:  'note <applicationId> <text>',
+      describe: 'Add an internal note (never shown to the applicant; needs the Job board pipeline package)',
+      builder:  (y2) => y2.positional('applicationId', { type: 'number' }).positional('text', { type: 'string' }),
+      handler:  runCommand(applicationNoteHandler),
+    })
+    .command({
+      command:  'assign <applicationId> <who>',
+      describe: 'Assign a recruiter (name or email; "none" clears; needs the Job board pipeline package)',
+      builder:  (y2) => y2.positional('applicationId', { type: 'number' }).positional('who', { type: 'string' }),
+      handler:  runCommand(applicationAssignHandler),
+    })
+    .demandCommand(1, 'Specify an application subcommand: stage | history | note | assign'),
+  handler: () => {},
+};
+
+const retentionCommand = {
+  command:  'retention [action]',
+  describe: 'Applicant record retention: show (default), set, or run a preview (needs the Job board pipeline package; set and run need an Administrator)',
+  builder:  (y) => y
+    .positional('action', { describe: 'get | set | run', type: 'string', choices: ['get', 'set', 'run'], default: 'get' })
+    .option('enabled', { describe: 'set: turn automatic retention on or off', type: 'boolean' })
+    .option('dry-run', { describe: 'set: count only, never delete', type: 'boolean' })
+    .option('days', { describe: 'set: days to keep records (below the legal minimum the minimum applies)', type: 'number' })
+    .option('federal-contractor', { describe: 'set: federal contractor (2 year minimum)', type: 'boolean' })
+    .option('legal-hold', { describe: 'set: stop all deletion', type: 'boolean' })
+    .option('execute', { describe: 'run: really delete due records (default is a preview that deletes nothing)', type: 'boolean' })
+    .option('yes', { describe: 'Confirm a deleting run, or set --dry-run=false / --legal-hold=false', type: 'boolean' }),
+  handler:  runCommand(retentionHandler),
+};
+
 export const recruitingCommand = {
   command:  'recruiting <subcommand>',
   describe: 'Recruiting Bot: sync job feeds, manage listings, applications, config, and multi-employer job board sources',
@@ -495,10 +709,13 @@ export const recruitingCommand = {
     .command(syncCommand)
     .command(configCommand)
     .command(jobsCommand)
+    .command(hostedCommand)
     .command(applicationsCommand)
     .command(sourcesCommand)
     .command(pipelineCommand)
-    .demandCommand(1, 'Specify a recruiting subcommand: sync | config | jobs | applications | sources | pipeline')
+    .command(applicationCommand)
+    .command(retentionCommand)
+    .demandCommand(1, 'Specify a recruiting subcommand: sync | config | jobs | hosted | applications | application | sources | pipeline | retention')
     .strict(),
   handler: () => {},
 };

package/lib/messaging-routes.test.js

@@ -9,7 +9,7 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const dir = path.join(path.dirname(fileURLToPath(import.meta.url)), 'commands');
-const MESSAGING_ONLY = ['/Teams/List', '/Deployment', '/Users/List', '/Workflows/List', '/Rules', '/Ticket/knowledge-overrides', '/UserStatus/admin', '/api/ivr/config', '/WooCommerce/billing', '/WooCommerce/auth', '/diagnostics/test-magento', '/voice/admin', '/api/enterprise-reports'];
+const MESSAGING_ONLY = ['/Teams/List', '/Deployment', '/Users/List', '/Workflows/List', '/Rules', '/Ticket/knowledge-overrides', '/UserStatus/admin', '/api/ivr/config', '/WooCommerce/billing', '/WooCommerce/auth', '/diagnostics/test-magento', '/voice/admin', '/api/enterprise-reports', '/avatar/groups', '/avatar/workflows', '/avatar/group-overrides'];
 
 test('messaging-only routes are never called through the admin api helpers', () => {
   const offenders = [];

package/lib/recruiting-apply.js

@@ -16,6 +16,44 @@ export function jobLifecyclePath(id, action) {
   return `/Recruiting/Jobs/${n}/${action}`;
 }
 
+// Job Board hosted pages (package job-board-hosted): PUT Recruiting/Jobs/{id}/Pay.
+export function jobPayPath(id) {
+  const n = Number(id);
+  if (!Number.isInteger(n) || n <= 0) throw new Error('jobId must be a positive integer.');
+  return `/Recruiting/Jobs/${n}/Pay`;
+}
+
+const PAY_PERIODS = ['Hour', 'Day', 'Week', 'Month', 'Year'];
+
+// Body for PUT Recruiting/Jobs/{id}/Pay. { clear: true } removes the stated pay; otherwise min + period are required
+// (max optional, currency defaults to USD). A manual value is never overwritten by a feed sync.
+export function buildJobPayBody({ min, max, currency, period, clear } = {}) {
+  if (clear) return { clear: true };
+  const lo = Number(min);
+  if (min === undefined || !Number.isFinite(lo) || lo <= 0) throw new Error('min must be a number greater than 0 (or pass clear).');
+  const body = { salaryMin: lo };
+  if (max !== undefined) {
+    const hi = Number(max);
+    if (!Number.isFinite(hi) || hi < lo) throw new Error('max must be a number greater than or equal to min.');
+    body.salaryMax = hi;
+  }
+  const cur = String(currency ?? 'USD').trim().toUpperCase();
+  if (!/^[A-Z]{3}$/.test(cur)) throw new Error('currency must be a 3-letter ISO code such as USD.');
+  body.salaryCurrency = cur;
+  const per = PAY_PERIODS.find((p) => p.toLowerCase() === String(period ?? '').trim().toLowerCase());
+  if (!per) throw new Error(`period must be one of: ${PAY_PERIODS.join(', ')}.`);
+  body.salaryPeriod = per;
+  return body;
+}
+
+// Apply-if-present body for PUT Recruiting/Hosted: { enabled?, regenerateSlug? }. Omit both to only read the settings.
+export function buildHostedBody({ enabled, regenerateLink } = {}) {
+  const body = {};
+  if (enabled !== undefined) body.enabled = Boolean(enabled);
+  if (regenerateLink) body.regenerateSlug = true;
+  return body;
+}
+
 // Body for POST Recruiting/Jobs/{id}/renew. Omit days to use the site default (RecruitingConfig.DefaultListingDays).
 export function buildRenewBody(days) {
   if (days === undefined) return {};
@@ -73,3 +111,69 @@ export function buildBotSettingsBody(o = {}) {
   if (!Object.keys(body).length) throw new Error('Specify at least one bot setting.');
   return body;
 }
+
+// ── Job Board Stage 4: recruiter pipeline, history, notes, assignment, retention (package job-board-pipeline) ──
+
+// Body for PUT Recruiting/Applications/{id}/Stage. note is optional (recorded in the stage history).
+export function buildStageBody(stage, note) {
+  const s = String(stage ?? '').trim();
+  if (!s) throw new Error('stage is required.');
+  const body = { stage: s };
+  if (note !== undefined && String(note).trim()) {
+    if (String(note).length > 2000) throw new Error('note must be 2000 characters or fewer.');
+    body.note = String(note).trim();
+  }
+  return body;
+}
+
+// Body for POST Recruiting/Applications/{id}/Notes.
+export function buildNoteBody(note) {
+  const t = String(note ?? '').trim();
+  if (!t) throw new Error('note is required.');
+  if (t.length > 2000) throw new Error('note must be 2000 characters or fewer.');
+  return { note: t };
+}
+
+// Body for PUT Recruiting/Applications/{id}/Assign. "none" or "" clears the assignment.
+export function buildAssignBody(who) {
+  const t = String(who ?? '').trim();
+  if (t.length > 200) throw new Error('assignedTo must be 200 characters or fewer.');
+  return { assignedTo: !t || t.toLowerCase() === 'none' ? null : t };
+}
+
+// Body for PUT Recruiting/Pipeline from a JSON array of stages: [{ key, label, color?, applicantVisible?, applicantLabel? }].
+// The server also validates (1-12 stages, unique keys; removing a stage that holds applications is refused with a 400).
+export function buildPipelineBody(stagesJson) {
+  let stages;
+  try {
+    stages = typeof stagesJson === 'string' ? JSON.parse(stagesJson) : stagesJson;
+  } catch (e) {
+    throw new Error(`stages must be valid JSON: ${e.message}`);
+  }
+  if (!Array.isArray(stages) || stages.length < 1 || stages.length > 12) throw new Error('stages must be a JSON array of 1 to 12 stages.');
+  const keys = new Set();
+  for (const s of stages) {
+    if (!s || typeof s !== 'object' || typeof s.key !== 'string' || !s.key.trim() || s.key.length > 64) throw new Error('every stage needs a key (up to 64 characters).');
+    if (typeof s.label !== 'string' || !s.label.trim()) throw new Error(`stage ${s.key} needs a label.`);
+    if (keys.has(s.key)) throw new Error(`duplicate stage key: ${s.key}.`);
+    keys.add(s.key);
+  }
+  return { stages };
+}
+
+// Partial body for PUT Recruiting/Retention (apply-if-present). A day count below the legal floor is accepted by the server,
+// which then applies the floor (365 days, or 730 for federal contractors; 29 CFR 1602.14).
+export function buildRetentionBody({ enabled, dryRun, days, federalContractor, legalHold } = {}) {
+  const body = {};
+  if (enabled !== undefined) body.enabled = Boolean(enabled);
+  if (dryRun !== undefined) body.dryRun = Boolean(dryRun);
+  if (federalContractor !== undefined) body.isFederalContractor = Boolean(federalContractor);
+  if (legalHold !== undefined) body.legalHold = Boolean(legalHold);
+  if (days !== undefined) {
+    const n = Number(days);
+    if (!Number.isInteger(n) || n < 1 || n > 36500) throw new Error('days must be a whole number from 1 to 36500.');
+    body.retentionDays = n;
+  }
+  if (!Object.keys(body).length) throw new Error('Specify at least one retention setting.');
+  return body;
+}

package/lib/recruiting-apply.test.js

@@ -1,6 +1,6 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
-import { applicationIdPath, buildApplySettingsBody, buildBotSettingsBody, buildRenewBody, jobLifecyclePath } from './recruiting-apply.js';
+import { buildAssignBody, buildNoteBody, buildPipelineBody, buildRetentionBody, buildStageBody, applicationIdPath, buildApplySettingsBody, buildBotSettingsBody, buildHostedBody, buildJobPayBody, buildRenewBody, jobLifecyclePath, jobPayPath } from './recruiting-apply.js';
 
 test('job lifecycle paths validate id and action', () => {
   assert.equal(jobLifecyclePath(7, 'close'), '/Recruiting/Jobs/7/close');
@@ -49,3 +49,67 @@ test('bot settings body is apply-if-present and validated', () => {
   assert.throws(() => buildBotSettingsBody({ maxResults: 11 }));
   assert.throws(() => buildBotSettingsBody({ greeting: 'g'.repeat(501) }));
 });
+
+// -- Job Board hosted pages (Stage 2) -----------------------------------------
+
+test('job pay path validates the id', () => {
+  assert.equal(jobPayPath(7), '/Recruiting/Jobs/7/Pay');
+  assert.throws(() => jobPayPath('x'));
+  assert.throws(() => jobPayPath(0));
+});
+
+test('job pay body: range, currency default and period are validated like the server', () => {
+  assert.deepEqual(buildJobPayBody({ min: 50000, max: 70000, period: 'year' }), { salaryMin: 50000, salaryMax: 70000, salaryCurrency: 'USD', salaryPeriod: 'Year' });
+  assert.deepEqual(buildJobPayBody({ min: '18.5', currency: 'cad', period: 'HOUR' }), { salaryMin: 18.5, salaryCurrency: 'CAD', salaryPeriod: 'Hour' });
+  assert.deepEqual(buildJobPayBody({ clear: true }), { clear: true });
+  assert.throws(() => buildJobPayBody({ period: 'Year' }));
+  assert.throws(() => buildJobPayBody({ min: 0, period: 'Year' }));
+  assert.throws(() => buildJobPayBody({ min: 10, max: 5, period: 'Year' }));
+  assert.throws(() => buildJobPayBody({ min: 10, currency: 'US', period: 'Year' }));
+  assert.throws(() => buildJobPayBody({ min: 10, period: 'Fortnight' }));
+  assert.throws(() => buildJobPayBody({ min: 10 }));
+});
+
+test('hosted body is apply-if-present; no flags means read-only', () => {
+  assert.deepEqual(buildHostedBody({}), {});
+  assert.deepEqual(buildHostedBody({ enabled: true }), { enabled: true });
+  assert.deepEqual(buildHostedBody({ enabled: false }), { enabled: false });
+  assert.deepEqual(buildHostedBody({ regenerateLink: true }), { regenerateSlug: true });
+});
+
+// -- Job Board pipeline (Stage 4) ---------------------------------------------
+
+test('stage body carries an optional trimmed note', () => {
+  assert.deepEqual(buildStageBody('Interview'), { stage: 'Interview' });
+  assert.deepEqual(buildStageBody(' Offer ', ' good fit '), { stage: 'Offer', note: 'good fit' });
+  assert.deepEqual(buildStageBody('Offer', '  '), { stage: 'Offer' });
+  assert.throws(() => buildStageBody(''));
+  assert.throws(() => buildStageBody('Offer', 'x'.repeat(2001)));
+});
+
+test('note and assign bodies validate', () => {
+  assert.deepEqual(buildNoteBody(' hello '), { note: 'hello' });
+  assert.throws(() => buildNoteBody(' '));
+  assert.deepEqual(buildAssignBody('pat@acme.com'), { assignedTo: 'pat@acme.com' });
+  assert.deepEqual(buildAssignBody('none'), { assignedTo: null });
+  assert.deepEqual(buildAssignBody(''), { assignedTo: null });
+  assert.throws(() => buildAssignBody('x'.repeat(201)));
+});
+
+test('pipeline body validates the stage list client side', () => {
+  const ok = [{ key: 'Applied', label: 'Applied' }, { key: 'Hired', label: 'Hired', applicantVisible: true }];
+  assert.deepEqual(buildPipelineBody(JSON.stringify(ok)), { stages: ok });
+  assert.throws(() => buildPipelineBody('{'), /valid JSON/);
+  assert.throws(() => buildPipelineBody('[]'));
+  assert.throws(() => buildPipelineBody(JSON.stringify([{ key: 'A', label: 'A' }, { key: 'A', label: 'B' }])), /duplicate/);
+  assert.throws(() => buildPipelineBody(JSON.stringify([{ key: 'A' }])), /label/);
+  assert.throws(() => buildPipelineBody(JSON.stringify(Array.from({ length: 13 }, (_, i) => ({ key: `K${i}`, label: 'x' })))));
+});
+
+test('retention body is apply-if-present and range-checked', () => {
+  assert.deepEqual(buildRetentionBody({ legalHold: true }), { legalHold: true });
+  assert.deepEqual(buildRetentionBody({ enabled: false, dryRun: true, days: '400', federalContractor: true }), { enabled: false, dryRun: true, retentionDays: 400, isFederalContractor: true });
+  assert.throws(() => buildRetentionBody({}));
+  assert.throws(() => buildRetentionBody({ days: 0 }));
+  assert.throws(() => buildRetentionBody({ days: 1.5 }));
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@velaro/cli",
-  "version": "1.4.91",
+  "version": "1.4.93",
   "description": "Velaro Workspace v20 — command-line interface for managing bots, knowledge base ingestion, MCP API keys, search indexes, and ops health.",
   "type": "module",
   "bin": {