atmn 2.0.167 → 2.0.169

package/dist/bin.js

@@ -4421,6 +4421,142 @@ var API_ROUTES = [
         description: "When false, `webhooks` is the environment's complete set: every webhook not listed is deleted, including ones made in the dashboard. Defaults true, which leaves unlisted webhooks alone."
       }
     ]
+  },
+  {
+    group: "approval_rules",
+    method: "list",
+    path: "/v1/approval_rules.list",
+    description: "Lists the organization's approval rules, oldest first. Every member and key can read rules. For each request, only the most specific level with a rule for that person decides (user, then role, then everyone), and every rule at that level must pass.",
+    body: "none",
+    fields: []
+  },
+  {
+    group: "approval_rules",
+    method: "get",
+    path: "/v1/approval_rules.get",
+    description: "Gets one approval rule by ID.",
+    body: "object",
+    fields: [
+      {
+        name: "id",
+        type: "string",
+        required: true
+      }
+    ]
+  },
+  {
+    group: "approval_rules",
+    method: "create",
+    path: "/v1/approval_rules.create",
+    description: "Creates an approval rule as version 1. `allow` is `true` (always allowed), `false` (never allowed) or an object of conditions that must all match. Problems with the rule come back as `invalid_approval_rule` with every issue under `details.issues`. Rules apply in live only. Only owners and admins (an OAuth token also needs `organisation:write` consent) and live secret keys with every scope can call it. Anyone else, whatever their scopes and including any sandbox key, gets 403 `approval_rule_editor_required`.",
+    body: "object",
+    fields: [
+      {
+        name: "name",
+        type: "string",
+        required: true
+      },
+      {
+        name: "subjects",
+        type: "json",
+        required: true
+      },
+      {
+        name: "actions",
+        type: "json",
+        required: true
+      },
+      {
+        name: "allow",
+        type: "json",
+        required: true,
+        description: "true always allows the actions and false never does. An object of conditions in the shape of the rule's area allows them only when every condition matches."
+      },
+      {
+        name: "note",
+        type: "string",
+        required: false
+      },
+      {
+        name: "enabled",
+        type: "boolean",
+        required: false
+      }
+    ]
+  },
+  {
+    group: "approval_rules",
+    method: "update",
+    path: "/v1/approval_rules.update",
+    description: "Updates the fields you pass and saves the rule as its next version. The whole rule is checked again, so changing `actions` re-checks the conditions in `allow`. Sending `allow` replaces it, so switching between `true`, `false` and conditions is one field. Only owners and admins (an OAuth token also needs `organisation:write` consent) and live secret keys with every scope can call it. Anyone else, whatever their scopes and including any sandbox key, gets 403 `approval_rule_editor_required`.",
+    body: "object",
+    fields: [
+      {
+        name: "id",
+        type: "string",
+        required: true
+      },
+      {
+        name: "name",
+        type: "string",
+        required: false
+      },
+      {
+        name: "subjects",
+        type: "json",
+        required: false
+      },
+      {
+        name: "actions",
+        type: "json",
+        required: false
+      },
+      {
+        name: "allow",
+        type: "json",
+        required: false,
+        description: "true always allows the actions and false never does. An object of conditions in the shape of the rule's area allows them only when every condition matches."
+      },
+      {
+        name: "note",
+        type: "string",
+        required: false
+      },
+      {
+        name: "enabled",
+        type: "boolean",
+        required: false
+      }
+    ]
+  },
+  {
+    group: "approval_rules",
+    method: "delete",
+    path: "/v1/approval_rules.delete",
+    description: "Deletes an approval rule. Its versions stay readable through `approval_rules.versions.list`. Only owners and admins (an OAuth token also needs `organisation:write` consent) and live secret keys with every scope can call it. Anyone else, whatever their scopes and including any sandbox key, gets 403 `approval_rule_editor_required`.",
+    body: "object",
+    fields: [
+      {
+        name: "id",
+        type: "string",
+        required: true
+      }
+    ]
+  },
+  {
+    group: "approvals",
+    method: "can",
+    path: "/v1/approvals.can",
+    description: "Says whether the caller could make some request for an action: `scope` when their scope allows it and no rule rules it out, `blocked` when an enforced rule never allows it, and `none` when they lack the action's scope. A conditional rule can still deny a given request; preview it to see. Alias actions such as `billing.multi_attach` are read as the action they're checked as.",
+    body: "object",
+    fields: [
+      {
+        name: "action",
+        type: "string",
+        required: true,
+        description: "The action to ask about, named after the route it gates. Routes checked as another action, like billing.multi_attach, are read as that action."
+      }
+    ]
   }
 ];
 
@@ -7735,7 +7871,7 @@ var createClient = (options) => ({
 });
 
 // src/version.ts
-var version = "2.0.167";
+var version = "2.0.169";
 
 // src/http/autumnFetch.ts
 var runtime = typeof Bun !== "undefined" ? `bun ${Bun.version}` : `node ${process.versions.node}`;
@@ -10006,16 +10142,16 @@ import { dirname as dirname4, join as join7 } from "node:path";
 import chalk3 from "chalk";
 
 // src/generated/skills.ts
-var SKILLS_VERSION = "2.0.166";
+var SKILLS_VERSION = "2.0.168";
 var SKILLS = [
   {
     name: "autumn-setup",
     description: "First-time Autumn setup — install the atmn CLI, connect to an org (sign in, or keyless with no account), turn the user's pricing into autumn.config.ts, and push it to a sandbox org. Use when the user is new to Autumn, pastes an Autumn setup prompt, or asks to set up Autumn, add billing, monetization, subscriptions, usage-based billing, pricing, or plans. If Autumn is already set up, use autumn-catalog instead.",
-    version: "2.0.166",
+    version: "2.0.168",
     markdown: `---
 name: autumn-setup
 description: First-time Autumn setup — install the atmn CLI, connect to an org (sign in, or keyless with no account), turn the user's pricing into autumn.config.ts, and push it to a sandbox org. Use when the user is new to Autumn, pastes an Autumn setup prompt, or asks to set up Autumn, add billing, monetization, subscriptions, usage-based billing, pricing, or plans. If Autumn is already set up, use autumn-catalog instead.
-version: 2.0.166
+version: 2.0.168
 ---
 
 # Setup
@@ -10173,11 +10309,11 @@ Then stop. Don't keep building, don't tour the dashboard, don't deploy anything.
   {
     name: "autumn-catalog",
     description: "Modeling a user's pricing into an Autumn catalog — deciding the structure (plans, variants, add-ons, licenses, credit systems, pooled balances) before writing config, then filling in the numbers. Use when the user describes their pricing or asks to model, change, or push a catalog.",
-    version: "2.0.166",
+    version: "2.0.168",
     markdown: `---
 name: autumn-catalog
 description: Modeling a user's pricing into an Autumn catalog — deciding the structure (plans, variants, add-ons, licenses, credit systems, pooled balances) before writing config, then filling in the numbers. Use when the user describes their pricing or asks to model, change, or push a catalog.
-version: 2.0.166
+version: 2.0.168
 ---
 
 # Catalog
@@ -14021,11 +14157,11 @@ Pitch: "Pro $20/mo or $200/yr — 1,000 messages per month either way."
   {
     name: "autumn-integrate",
     description: "Integrating Autumn into an app's backend — creating customers, billing flows (attach, checkout, upgrade, cancel), gating features with check, recording usage with track, and exposing billing data to the frontend. Use when the user asks to integrate Autumn, add billing/payments to their app, gate features, meter usage, or build checkout/upgrade flows. Requires a pushed catalog; use autumn-catalog first if plans don't exist yet.",
-    version: "2.0.166",
+    version: "2.0.168",
     markdown: `---
 name: autumn-integrate
 description: Integrating Autumn into an app's backend — creating customers, billing flows (attach, checkout, upgrade, cancel), gating features with check, recording usage with track, and exposing billing data to the frontend. Use when the user asks to integrate Autumn, add billing/payments to their app, gate features, meter usage, or build checkout/upgrade flows. Requires a pushed catalog; use autumn-catalog first if plans don't exist yet.
-version: 2.0.166
+version: 2.0.168
 ---
 
 # Integrate
@@ -18728,11 +18864,11 @@ Monitor your logs for this message. If you see it, check [status.useautumn.com](
   {
     name: "autumn-concepts",
     description: "Understanding Autumn's billing objects before acting on them — what a plan version is and what active means, when a trial starts or ends billing, how entity- and seat-scoped subscriptions differ from the customer's own, what a customize diff actually changes, and how caps, overage, and top-ups behave. Load before versioning, editing, or drafting a plan, or when a customer's state does not match the plain reading of their plan.",
-    version: "2.0.166",
+    version: "2.0.168",
     markdown: `---
 name: autumn-concepts
 description: Understanding Autumn's billing objects before acting on them — what a plan version is and what active means, when a trial starts or ends billing, how entity- and seat-scoped subscriptions differ from the customer's own, what a customize diff actually changes, and how caps, overage, and top-ups behave. Load before versioning, editing, or drafting a plan, or when a customer's state does not match the plain reading of their plan.
-version: 2.0.166
+version: 2.0.168
 ---
 
 # Concepts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "atmn",
-  "version": "2.0.167",
+  "version": "2.0.169",
   "license": "MIT",
   "description": "The CLI for Autumn — define your pricing in code, sync it to Autumn, and keep everything in version control.",
   "bin": {
@@ -49,5 +49,5 @@
     "open": "10.2.0",
     "yaml": "2.9.0"
   },
-  "gitHead": "2e6dd072a0ec96550d3be4e1d713ace0771ba85e"
+  "gitHead": "b6f4f03cd085eca2df1781dd51d892bac30f88ce"
 }

package/src/generated/apiRoutes.ts

@@ -4756,4 +4756,148 @@ export const API_ROUTES: readonly ApiRoute[] = [
 			},
 		],
 	},
+	{
+		group: "approval_rules",
+		method: "list",
+		path: "/v1/approval_rules.list",
+		description:
+			"Lists the organization's approval rules, oldest first. Every member and key can read rules. For each request, only the most specific level with a rule for that person decides (user, then role, then everyone), and every rule at that level must pass.",
+		body: "none",
+		fields: [],
+	},
+	{
+		group: "approval_rules",
+		method: "get",
+		path: "/v1/approval_rules.get",
+		description: "Gets one approval rule by ID.",
+		body: "object",
+		fields: [
+			{
+				name: "id",
+				type: "string",
+				required: true,
+			},
+		],
+	},
+	{
+		group: "approval_rules",
+		method: "create",
+		path: "/v1/approval_rules.create",
+		description:
+			"Creates an approval rule as version 1. `allow` is `true` (always allowed), `false` (never allowed) or an object of conditions that must all match. Problems with the rule come back as `invalid_approval_rule` with every issue under `details.issues`. Rules apply in live only. Only owners and admins (an OAuth token also needs `organisation:write` consent) and live secret keys with every scope can call it. Anyone else, whatever their scopes and including any sandbox key, gets 403 `approval_rule_editor_required`.",
+		body: "object",
+		fields: [
+			{
+				name: "name",
+				type: "string",
+				required: true,
+			},
+			{
+				name: "subjects",
+				type: "json",
+				required: true,
+			},
+			{
+				name: "actions",
+				type: "json",
+				required: true,
+			},
+			{
+				name: "allow",
+				type: "json",
+				required: true,
+				description:
+					"true always allows the actions and false never does. An object of conditions in the shape of the rule's area allows them only when every condition matches.",
+			},
+			{
+				name: "note",
+				type: "string",
+				required: false,
+			},
+			{
+				name: "enabled",
+				type: "boolean",
+				required: false,
+			},
+		],
+	},
+	{
+		group: "approval_rules",
+		method: "update",
+		path: "/v1/approval_rules.update",
+		description:
+			"Updates the fields you pass and saves the rule as its next version. The whole rule is checked again, so changing `actions` re-checks the conditions in `allow`. Sending `allow` replaces it, so switching between `true`, `false` and conditions is one field. Only owners and admins (an OAuth token also needs `organisation:write` consent) and live secret keys with every scope can call it. Anyone else, whatever their scopes and including any sandbox key, gets 403 `approval_rule_editor_required`.",
+		body: "object",
+		fields: [
+			{
+				name: "id",
+				type: "string",
+				required: true,
+			},
+			{
+				name: "name",
+				type: "string",
+				required: false,
+			},
+			{
+				name: "subjects",
+				type: "json",
+				required: false,
+			},
+			{
+				name: "actions",
+				type: "json",
+				required: false,
+			},
+			{
+				name: "allow",
+				type: "json",
+				required: false,
+				description:
+					"true always allows the actions and false never does. An object of conditions in the shape of the rule's area allows them only when every condition matches.",
+			},
+			{
+				name: "note",
+				type: "string",
+				required: false,
+			},
+			{
+				name: "enabled",
+				type: "boolean",
+				required: false,
+			},
+		],
+	},
+	{
+		group: "approval_rules",
+		method: "delete",
+		path: "/v1/approval_rules.delete",
+		description:
+			"Deletes an approval rule. Its versions stay readable through `approval_rules.versions.list`. Only owners and admins (an OAuth token also needs `organisation:write` consent) and live secret keys with every scope can call it. Anyone else, whatever their scopes and including any sandbox key, gets 403 `approval_rule_editor_required`.",
+		body: "object",
+		fields: [
+			{
+				name: "id",
+				type: "string",
+				required: true,
+			},
+		],
+	},
+	{
+		group: "approvals",
+		method: "can",
+		path: "/v1/approvals.can",
+		description:
+			"Says whether the caller could make some request for an action: `scope` when their scope allows it and no rule rules it out, `blocked` when an enforced rule never allows it, and `none` when they lack the action's scope. A conditional rule can still deny a given request; preview it to see. Alias actions such as `billing.multi_attach` are read as the action they're checked as.",
+		body: "object",
+		fields: [
+			{
+				name: "action",
+				type: "string",
+				required: true,
+				description:
+					"The action to ask about, named after the route it gates. Routes checked as another action, like billing.multi_attach, are read as that action.",
+			},
+		],
+	},
 ];