arch-insight-cli 0.2.0__tar.gz → 0.4.0__tar.gz

{arch_insight_cli-0.2.0 → arch_insight_cli-0.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: arch-insight-cli
-Version: 0.2.0
+Version: 0.4.0
 Summary: Command-line client for ARCH-Insight tasks, factsheets, secrets, and developer platform.
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
@@ -68,6 +68,46 @@ JSON imports create rows one at a time through the same API used by the web
 app. If an item fails, earlier successful items remain created. ZIP imports use
 the application's import endpoint and report imported and skipped entries.
 
+## Projects, tasks, tickets and notes
+
+```sh
+arch project list
+arch project create "Webshop" --priority high
+arch task create "Release Stripe production account" --project-id 12 --assignee st@example.com --due-date 2026-09-14
+arch task update 41 --status in_review
+arch ticket create "Alfen box offline" --message "Since 2026-09-14 after reset" --priority high
+arch ticket reply 7 --message "2026-09-15: back online after factory reset"
+arch document create "Meeting 2026-10-05" --file minutes.md --folder "Change Control Board"
+```
+
+Move a whole list in at once -- projects, their tasks, a dated status log
+kept as a ticket, and notes -- from one JSON file. Re-running it creates
+nothing twice:
+
+```sh
+arch project import plan.json --dry-run
+arch project import plan.json
+```
+
+See `arch_cli/work.py` for the file format.
+
+## Organisation
+
+```sh
+arch org show                 # name, members, whether Entra sign-in is on
+arch org entra show           # the Redirect URI to register in Entra
+ARCH_ENTRA_CLIENT_SECRET=... arch org entra set --tenant-id <Directory ID> --client-id <Application ID>
+```
+
+With Entra sign-in on, members choose "Sign in with your organization" on the
+login screen and type the organisation's name. `--domain` (a domain proven
+under Organization -> Access) also sends that domain's addresses to Entra by
+themselves. The secret is read from `ARCH_ENTRA_CLIENT_SECRET` or asked for,
+never taken as an argument.
+
+`arch login` prints the organisation it signed in to. A browser sign-in uses
+the account that browser is signed in to; check it before importing.
+
 ## Marketing e-mail
 
 Contact lists drop malformed addresses and reserved domains (`example.com`,

{arch_insight_cli-0.2.0 → arch_insight_cli-0.4.0}/README.md

@@ -60,6 +60,46 @@ JSON imports create rows one at a time through the same API used by the web
 app. If an item fails, earlier successful items remain created. ZIP imports use
 the application's import endpoint and report imported and skipped entries.
 
+## Projects, tasks, tickets and notes
+
+```sh
+arch project list
+arch project create "Webshop" --priority high
+arch task create "Release Stripe production account" --project-id 12 --assignee st@example.com --due-date 2026-09-14
+arch task update 41 --status in_review
+arch ticket create "Alfen box offline" --message "Since 2026-09-14 after reset" --priority high
+arch ticket reply 7 --message "2026-09-15: back online after factory reset"
+arch document create "Meeting 2026-10-05" --file minutes.md --folder "Change Control Board"
+```
+
+Move a whole list in at once -- projects, their tasks, a dated status log
+kept as a ticket, and notes -- from one JSON file. Re-running it creates
+nothing twice:
+
+```sh
+arch project import plan.json --dry-run
+arch project import plan.json
+```
+
+See `arch_cli/work.py` for the file format.
+
+## Organisation
+
+```sh
+arch org show                 # name, members, whether Entra sign-in is on
+arch org entra show           # the Redirect URI to register in Entra
+ARCH_ENTRA_CLIENT_SECRET=... arch org entra set --tenant-id <Directory ID> --client-id <Application ID>
+```
+
+With Entra sign-in on, members choose "Sign in with your organization" on the
+login screen and type the organisation's name. `--domain` (a domain proven
+under Organization -> Access) also sends that domain's addresses to Entra by
+themselves. The secret is read from `ARCH_ENTRA_CLIENT_SECRET` or asked for,
+never taken as an argument.
+
+`arch login` prints the organisation it signed in to. A browser sign-in uses
+the account that browser is signed in to; check it before importing.
+
 ## Marketing e-mail
 
 Contact lists drop malformed addresses and reserved domains (`example.com`,

{arch_insight_cli-0.2.0 → arch_insight_cli-0.4.0}/arch_cli/__init__.py

@@ -1,3 +1,3 @@
 """ARCH-Insight command-line client."""
 
-__version__ = "0.2.0"
+__version__ = "0.4.0"

{arch_insight_cli-0.2.0 → arch_insight_cli-0.4.0}/arch_cli/main.py

@@ -9,6 +9,7 @@ package.
 from __future__ import annotations
 
 import argparse
+import getpass
 import json
 import os
 import secrets
@@ -18,7 +19,7 @@ import urllib.parse
 import urllib.request
 from pathlib import Path
 
-from arch_cli import auth, comms
+from arch_cli import auth, comms, work
 
 DEFAULT_API = "https://arch-insight.com"
 TIMEOUT = 60
@@ -231,8 +232,13 @@ def login(args):
         raise CliError(str(exc)) from exc
     args.token = record["access_token"]
     me = request(args, "GET", "/api/auth/me")
-    emit({"signed_in_as": me.get("email"), "org_id": me.get("org_id"),
-          "roles": me.get("roles"), "stored_in": str(auth.credentials_path())})
+    # The organisation by name, not only its id: a browser sign-in reuses
+    # whatever account that browser is signed in to, and "org_id": 7 does not
+    # tell anyone they are about to import into the wrong organisation.
+    org = request(args, "GET", "/api/orgs/me") if me.get("org_id") else {}
+    emit({"signed_in_as": me.get("email"), "organization": org.get("name"),
+          "org_id": me.get("org_id"), "roles": me.get("roles"),
+          "stored_in": str(auth.credentials_path())})
 
 
 def logout(args):
@@ -390,8 +396,42 @@ def campaign_delete(args):
 
 
 # --- organisation (#1072) ---------------------------------------------------------
+ORG_FIELDS = ("id", "name", "website", "industry", "timezone", "subdomain", "member_count")
+
+
 def org_show(args):
-    emit(request(args, "GET", "/api/orgs/me"))
+    # What a person asks "which organisation am I in" for -- not the billing
+    # identifiers, purchase tokens and join codes the same row also carries.
+    org = request(args, "GET", "/api/orgs/me")
+    out = {k: org.get(k) for k in ORG_FIELDS}
+    out["entra_sign_in"] = bool(org.get("entra_sign_in"))
+    out["members"] = [{k: m.get(k) for k in ("name", "email", "roles")} for m in org.get("members") or []]
+    emit(out)
+
+
+def org_entra_show(args):
+    emit(request(args, "GET", "/api/orgs/me/entra"))
+
+
+def org_entra_set(args):
+    """Sign-in with the organisation's own Microsoft Entra ID tenant.
+
+    The client secret is read from ARCH_ENTRA_CLIENT_SECRET or asked for, never
+    taken as an argument (it would land in shell history). Leaving it empty on
+    a change keeps the secret already stored."""
+    secret = os.environ.get("ARCH_ENTRA_CLIENT_SECRET")
+    if secret is None and sys.stdin.isatty():
+        secret = getpass.getpass("Client secret (Value; empty keeps the stored one): ")
+    body = {"tenant_id": args.tenant_id, "client_id": args.client_id}
+    if secret:
+        body["client_secret"] = secret
+    if args.domain:
+        body["domain"] = args.domain
+    emit(request(args, "PUT", "/api/orgs/me/entra", body))
+
+
+def org_entra_disable(args):
+    emit(request(args, "DELETE", "/api/orgs/me/entra"))
 
 
 def org_logo(args):
@@ -402,6 +442,112 @@ def org_logo(args):
     emit(request(args, "POST", "/api/orgs/me/logo", body, content_type=content_type))
 
 
+# --- projects, tasks, tickets -------------------------------------------------
+def project_list(args):
+    emit([{k: r.get(k) for k in ("id", "name", "status", "priority")}
+          for r in request(args, "GET", "/api/projects")])
+
+
+def project_create(args):
+    emit(request(args, "POST", "/api/projects", {
+        "name": args.name, "status": args.status, "priority": args.priority,
+        "description": comms.read_text(args.description_file) if args.description_file else args.description}))
+
+
+def project_import(args):
+    report = work.import_plan(request, args, work.load_plan(args.file), args.dry_run)
+    report.update(work.import_documents(request, args, work.load_documents(args.file), args.dry_run))
+    emit(report)
+
+
+def document_list(args):
+    emit([{k: r.get(k) for k in ("id", "title", "folder", "template", "project_id")}
+          for r in request(args, "GET", "/api/docs/requirements")])
+
+
+def document_create(args):
+    body = {"title": args.title, "template": "note", "body": comms.read_text(args.file),
+            "body_format": "markdown"}
+    if args.folder:
+        body["folder"] = args.folder
+    if args.project_id:
+        body["project_id"] = args.project_id
+    emit(request(args, "POST", "/api/docs/requirements", body))
+
+
+def task_update(args):
+    body = {k: v for k, v in (("status", args.status), ("priority", args.priority),
+                              ("due_date", args.due_date), ("title", args.title)) if v is not None}
+    if args.assignee:
+        body["assignees"] = args.assignee
+    if not body:
+        raise CliError("Nothing to change: pass --status, --assignee, --due-date, --priority or --title.")
+    emit(request(args, "PUT", f"/api/agile/tasks/{args.task_id}", body))
+
+
+def ticket_list(args):
+    page = request(args, "GET", "/api/tickets")
+    emit([{k: r.get(k) for k in ("id", "title", "status", "priority", "due_date")}
+          for r in (page.get("items") or [])])
+
+
+def ticket_create(args):
+    body = {"title": args.title, "message": args.message, "priority": args.priority}
+    if args.due_date:
+        body["due_date"] = args.due_date
+    emit(request(args, "POST", "/api/tickets", body))
+
+
+def ticket_reply(args):
+    emit(request(args, "POST", f"/api/tickets/{args.ticket_id}/reply", {"message": args.message}))
+
+
+def ticket_status(args):
+    emit(request(args, "POST", f"/api/tickets/{args.ticket_id}/status", {"status": args.status}))
+
+
+def _work_parsers(areas) -> None:
+    pr = areas.add_parser("project", help="Projects").add_subparsers(dest="action", required=True)
+    pr.add_parser("list").set_defaults(func=project_list)
+    pc = pr.add_parser("create")
+    pc.add_argument("name")
+    pc.add_argument("--status", default="active")
+    pc.add_argument("--priority", choices=work.PRIORITIES, default="medium")
+    pc.add_argument("--description")
+    pc.add_argument("--description-file")
+    pc.set_defaults(func=project_create)
+    pi = pr.add_parser("import", help="Projects with their tasks and status logs from one JSON file")
+    pi.add_argument("file")
+    pi.add_argument("--dry-run", action="store_true")
+    pi.set_defaults(func=project_import)
+
+    dc = areas.add_parser("document", help="Notes and documents").add_subparsers(dest="action", required=True)
+    dc.add_parser("list").set_defaults(func=document_list)
+    dcc = dc.add_parser("create", help="A note from a Markdown file")
+    dcc.add_argument("title")
+    dcc.add_argument("--file", required=True, help="Markdown body")
+    dcc.add_argument("--folder")
+    dcc.add_argument("--project-id", type=int)
+    dcc.set_defaults(func=document_create)
+
+    tk = areas.add_parser("ticket", help="Helpdesk tickets").add_subparsers(dest="action", required=True)
+    tk.add_parser("list").set_defaults(func=ticket_list)
+    tc = tk.add_parser("create")
+    tc.add_argument("title")
+    tc.add_argument("--message", required=True)
+    tc.add_argument("--priority", choices=("low", "medium", "high", "urgent"), default="medium")
+    tc.add_argument("--due-date")
+    tc.set_defaults(func=ticket_create)
+    trp = tk.add_parser("reply")
+    trp.add_argument("ticket_id", type=int)
+    trp.add_argument("--message", required=True)
+    trp.set_defaults(func=ticket_reply)
+    ts = tk.add_parser("status")
+    ts.add_argument("ticket_id", type=int)
+    ts.add_argument("status", choices=("open", "pending_customer", "closed"))
+    ts.set_defaults(func=ticket_status)
+
+
 def _comms_parsers(areas) -> None:
     lg = areas.add_parser("login", help="Sign in (browser, or --email for unattended use)")
     lg.add_argument("--email", help="Sign in with a password instead of the browser; "
@@ -468,6 +614,14 @@ def _comms_parsers(areas) -> None:
     og.add_parser("show").set_defaults(func=org_show)
     lo = og.add_parser("logo", help="Set the logo shown in e-mail and the app")
     lo.add_argument("file"); lo.set_defaults(func=org_logo)
+    en = og.add_parser("entra", help="Sign-in with your Microsoft Entra ID (by organisation name)")         .add_subparsers(dest="entra_action", required=True)
+    en.add_parser("show", help="The setup, and the Redirect URI to register in Entra").set_defaults(func=org_entra_show)
+    es = en.add_parser("set", help="Turn it on or change it; secret from ARCH_ENTRA_CLIENT_SECRET or asked for")
+    es.add_argument("--tenant-id", required=True, help="Directory (tenant) ID")
+    es.add_argument("--client-id", required=True, help="Application (client) ID")
+    es.add_argument("--domain", help="Optional proven domain whose addresses go to Entra by themselves")
+    es.set_defaults(func=org_entra_set)
+    en.add_parser("disable").set_defaults(func=org_entra_disable)
 
 
 def build_parser():
@@ -527,6 +681,16 @@ def build_parser():
     dl = deploy.add_parser("list"); dl.add_argument("environment", nargs="?", default=""); dl.set_defaults(func=deploy_list)
 
     _comms_parsers(areas)
+    _work_parsers(areas)
+    tu = [a for a in areas.choices["task"]._subparsers._group_actions][0].add_parser(
+        "update", help="Change a task's status, assignees, due date, priority or title")
+    tu.add_argument("task_id", type=int)
+    tu.add_argument("--status", choices=work.TASK_STATUSES)
+    tu.add_argument("--priority", choices=work.PRIORITIES)
+    tu.add_argument("--due-date")
+    tu.add_argument("--title")
+    tu.add_argument("--assignee", action="append")
+    tu.set_defaults(func=task_update)
     return parser
 
 
@@ -536,7 +700,7 @@ def main(argv=None):
     try:
         result = args.func(args)
         return result if isinstance(result, int) else 0
-    except (CliError, comms.CommsError) as exc:
+    except (CliError, comms.CommsError, work.WorkError) as exc:
         print(f"arch: {exc}", file=sys.stderr)
         return 2
     except KeyboardInterrupt:

arch_insight_cli-0.4.0/arch_cli/work.py

@@ -0,0 +1,134 @@
+"""Projects, tasks and helpdesk tickets from the command line.
+
+`arch project import` takes a whole plan in one JSON file -- projects, their
+tasks, and a status log kept as a ticket -- so a list kept somewhere else
+(a OneNote page, a spreadsheet) comes over in one command instead of
+hundreds of clicks. It is re-runnable: a project that already exists by name
+is reported and left alone, so a second run creates nothing twice.
+
+    {"projects": [{
+        "name": "Webshop", "priority": "high", "status": "active",
+        "description": "...",
+        "tasks": [{"title": "Release Stripe production account",
+                   "assignees": ["someone@example.com"], "due_date": "2026-09-14",
+                   "status": "done", "priority": "medium", "description": "..."}],
+        "log": {"title": "Webshop - status log",
+                "entries": ["2026-09-05: URL redirected by nginx ...", "..."]}
+    }],
+     "documents": [{"title": "CCB 2026-10-05", "folder": "Change Control Board",
+                    "body": "# Markdown ...", "project": "Webshop"}]}
+
+Documents are notes (Markdown) -- meeting minutes, a dated snapshot -- in a
+folder, optionally attached to one of the projects by name.
+"""
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+PRIORITIES = ("low", "medium", "high")
+TASK_STATUSES = ("todo", "in_progress", "in_review", "done")
+
+
+class WorkError(RuntimeError):
+    pass
+
+
+def load_plan(path: str) -> list[dict]:
+    try:
+        data = json.loads(Path(path).read_text(encoding="utf-8"))
+    except (OSError, ValueError) as exc:
+        raise WorkError(f"Cannot read {path}: {exc}") from exc
+    projects = data.get("projects") if isinstance(data, dict) else None
+    if not isinstance(projects, list) or not all(isinstance(p, dict) and p.get("name") for p in projects):
+        raise WorkError('Expected {"projects": [{"name": ..., "tasks": [...]}, ...]}.')
+    for p in projects:
+        if p.get("priority") and p["priority"] not in PRIORITIES:
+            raise WorkError(f"{p['name']}: priority must be one of {', '.join(PRIORITIES)}.")
+        for t in p.get("tasks") or []:
+            if not t.get("title"):
+                raise WorkError(f"{p['name']}: every task needs a title.")
+            if t.get("status") and t["status"] not in TASK_STATUSES:
+                raise WorkError(f"{p['name']} / {t['title']}: status must be one of {', '.join(TASK_STATUSES)}.")
+    return projects
+
+
+def load_documents(path: str) -> list[dict]:
+    data = json.loads(Path(path).read_text(encoding="utf-8"))
+    docs = data.get("documents") or [] if isinstance(data, dict) else []
+    if not all(isinstance(d, dict) and d.get("title") for d in docs):
+        raise WorkError("Every document needs a title.")
+    return docs
+
+
+def import_documents(request, args, docs: list[dict], dry_run: bool) -> dict:
+    """Create the notes that do not exist yet (same title in the same folder)."""
+    have = {((d.get("folder") or ""), (d.get("title") or "").strip().casefold())
+            for d in request(args, "GET", "/api/docs/requirements")}
+    projects = {(p.get("name") or "").strip().casefold(): p["id"]
+                for p in request(args, "GET", "/api/projects")}
+    made, skipped = 0, 0
+    for d in docs:
+        key = ((d.get("folder") or ""), d["title"].strip().casefold())
+        if key in have:
+            skipped += 1
+            continue
+        if not dry_run:
+            body = {"title": d["title"], "template": "note", "body": d.get("body") or "",
+                    "body_format": "markdown"}
+            if d.get("folder"):
+                body["folder"] = d["folder"]
+            pid = projects.get((d.get("project") or "").strip().casefold())
+            if pid:
+                body["project_id"] = pid
+            request(args, "POST", "/api/docs/requirements", body)
+        made += 1
+    return {"documents_created": made, "documents_skipped": skipped}
+
+
+def import_plan(request, args, projects: list[dict], dry_run: bool) -> dict:
+    """Create what does not exist yet; return what was done."""
+    existing = {(p.get("name") or "").strip().casefold(): p
+                for p in request(args, "GET", "/api/projects")}
+    report = {"projects_created": 0, "projects_skipped": [], "tasks_created": 0,
+              "tickets_created": 0, "log_entries": 0}
+    for spec in projects:
+        name = spec["name"].strip()
+        if name.casefold() in existing:
+            report["projects_skipped"].append(name)
+            continue
+        if dry_run:
+            report["projects_created"] += 1
+            report["tasks_created"] += len(spec.get("tasks") or [])
+            continue
+        ticket_note = ""
+        log = spec.get("log") or {}
+        entries = [e for e in (log.get("entries") or []) if str(e).strip()]
+        if entries:
+            ticket = request(args, "POST", "/api/tickets", {
+                "title": log.get("title") or f"{name} - status log",
+                "message": entries[0],
+                "priority": spec.get("priority") or "medium",
+            })
+            for entry in entries[1:]:
+                request(args, "POST", f"/api/tickets/{ticket['id']}/reply", {"message": entry})
+            report["tickets_created"] += 1
+            report["log_entries"] += len(entries)
+            ticket_note = f"\n\nStatus log: helpdesk ticket #{ticket['id']}."
+        project = request(args, "POST", "/api/projects", {
+            "name": name,
+            "status": spec.get("status") or "active",
+            "priority": spec.get("priority") or "medium",
+            "description": (spec.get("description") or "") + ticket_note,
+        })
+        report["projects_created"] += 1
+        for t in spec.get("tasks") or []:
+            body = {"title": t["title"], "project_id": project["id"],
+                    "status": t.get("status") or "todo",
+                    "priority": t.get("priority") or spec.get("priority") or "medium"}
+            for key in ("description", "due_date", "assignees"):
+                if t.get(key):
+                    body[key] = t[key]
+            request(args, "POST", "/api/agile/tasks", body)
+            report["tasks_created"] += 1
+    return report

{arch_insight_cli-0.2.0 → arch_insight_cli-0.4.0}/arch_insight_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: arch-insight-cli
-Version: 0.2.0
+Version: 0.4.0
 Summary: Command-line client for ARCH-Insight tasks, factsheets, secrets, and developer platform.
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
@@ -68,6 +68,46 @@ JSON imports create rows one at a time through the same API used by the web
 app. If an item fails, earlier successful items remain created. ZIP imports use
 the application's import endpoint and report imported and skipped entries.
 
+## Projects, tasks, tickets and notes
+
+```sh
+arch project list
+arch project create "Webshop" --priority high
+arch task create "Release Stripe production account" --project-id 12 --assignee st@example.com --due-date 2026-09-14
+arch task update 41 --status in_review
+arch ticket create "Alfen box offline" --message "Since 2026-09-14 after reset" --priority high
+arch ticket reply 7 --message "2026-09-15: back online after factory reset"
+arch document create "Meeting 2026-10-05" --file minutes.md --folder "Change Control Board"
+```
+
+Move a whole list in at once -- projects, their tasks, a dated status log
+kept as a ticket, and notes -- from one JSON file. Re-running it creates
+nothing twice:
+
+```sh
+arch project import plan.json --dry-run
+arch project import plan.json
+```
+
+See `arch_cli/work.py` for the file format.
+
+## Organisation
+
+```sh
+arch org show                 # name, members, whether Entra sign-in is on
+arch org entra show           # the Redirect URI to register in Entra
+ARCH_ENTRA_CLIENT_SECRET=... arch org entra set --tenant-id <Directory ID> --client-id <Application ID>
+```
+
+With Entra sign-in on, members choose "Sign in with your organization" on the
+login screen and type the organisation's name. `--domain` (a domain proven
+under Organization -> Access) also sends that domain's addresses to Entra by
+themselves. The secret is read from `ARCH_ENTRA_CLIENT_SECRET` or asked for,
+never taken as an argument.
+
+`arch login` prints the organisation it signed in to. A browser sign-in uses
+the account that browser is signed in to; check it before importing.
+
 ## Marketing e-mail
 
 Contact lists drop malformed addresses and reserved domains (`example.com`,

{arch_insight_cli-0.2.0 → arch_insight_cli-0.4.0}/arch_insight_cli.egg-info/SOURCES.txt

@@ -4,10 +4,12 @@ arch_cli/__init__.py
 arch_cli/auth.py
 arch_cli/comms.py
 arch_cli/main.py
+arch_cli/work.py
 arch_insight_cli.egg-info/PKG-INFO
 arch_insight_cli.egg-info/SOURCES.txt
 arch_insight_cli.egg-info/dependency_links.txt
 arch_insight_cli.egg-info/entry_points.txt
 arch_insight_cli.egg-info/requires.txt
 arch_insight_cli.egg-info/top_level.txt
-tests/test_comms.py
+tests/test_comms.py
+tests/test_work.py

{arch_insight_cli-0.2.0 → arch_insight_cli-0.4.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "arch-insight-cli"
-version = "0.2.0"
+version = "0.4.0"
 description = "Command-line client for ARCH-Insight tasks, factsheets, secrets, and developer platform."
 readme = "README.md"
 requires-python = ">=3.10"

{arch_insight_cli-0.2.0 → arch_insight_cli-0.4.0}/tests/test_comms.py

@@ -14,7 +14,7 @@ def test_reserved_and_malformed_addresses_are_not_usable():
 
 def test_an_excluded_domain_takes_its_subdomains_with_it():
     assert comms.excluded_by("a@arch-insight.com", ["arch-insight.com"])
-    assert comms.excluded_by("a@ai-charge.arch-insight.com", ["arch-insight.com"])
+    assert comms.excluded_by("a@example.arch-insight.com", ["arch-insight.com"])
     assert not comms.excluded_by("a@notarch-insight.com", ["arch-insight.com"])
 
 

arch_insight_cli-0.4.0/tests/test_work.py

@@ -0,0 +1,103 @@
+"""`arch project import`: a whole plan in one command, re-runnable."""
+import json
+from types import SimpleNamespace
+
+import pytest
+
+from arch_cli import main, work
+
+PLAN = {"projects": [{"name": "Webshop", "priority": "high",
+                      "tasks": [{"title": "Release Stripe", "assignees": ["st@x.com"], "due_date": "2026-09-14"},
+                                {"title": "Go live", "status": "done"}],
+                      "log": {"entries": ["2026-09-05: redirected", "2026-09-14: terms updated"]}},
+                     {"name": "Existing"}],
+        "documents": [{"title": "CCB 2026-10-05", "folder": "CCB", "body": "# x", "project": "Webshop"},
+                      {"title": "Old", "folder": "CCB", "body": "y"}]}
+
+
+def fake_server():
+    calls = []
+    state = {"projects": [{"id": 1, "name": "Existing"}], "docs": [{"title": "Old", "folder": "CCB"}]}
+
+    def request(args, method, path, body=None, **kw):
+        calls.append((method, path, body))
+        if (method, path) == ("GET", "/api/projects"):
+            return state["projects"]
+        if (method, path) == ("GET", "/api/docs/requirements"):
+            return state["docs"]
+        if (method, path) == ("POST", "/api/projects"):
+            row = {"id": 10 + len(state["projects"]), **body}
+            state["projects"].append(row)
+            return row
+        if (method, path) == ("POST", "/api/tickets"):
+            return {"id": 77}
+        return {}
+    return request, calls
+
+
+def test_a_plan_creates_projects_tasks_and_the_status_log(tmp_path):
+    f = tmp_path / "plan.json"
+    f.write_text(json.dumps(PLAN), encoding="utf-8")
+    request, calls = fake_server()
+    report = work.import_plan(request, SimpleNamespace(), work.load_plan(str(f)), dry_run=False)
+    assert report == {"projects_created": 1, "projects_skipped": ["Existing"], "tasks_created": 2,
+                      "tickets_created": 1, "log_entries": 2}
+    tasks = [b for m, p, b in calls if (m, p) == ("POST", "/api/agile/tasks")]
+    assert tasks[0]["assignees"] == ["st@x.com"] and tasks[0]["due_date"] == "2026-09-14"
+    assert tasks[1]["status"] == "done"
+    project = next(b for m, p, b in calls if (m, p) == ("POST", "/api/projects"))
+    assert "ticket #77" in project["description"]
+    assert [b["message"] for m, p, b in calls if p == "/api/tickets/77/reply"] == ["2026-09-14: terms updated"]
+
+
+def test_documents_are_notes_and_not_created_twice(tmp_path):
+    f = tmp_path / "plan.json"
+    f.write_text(json.dumps(PLAN), encoding="utf-8")
+    request, calls = fake_server()
+    work.import_plan(request, SimpleNamespace(), work.load_plan(str(f)), dry_run=False)
+    report = work.import_documents(request, SimpleNamespace(), work.load_documents(str(f)), dry_run=False)
+    assert report == {"documents_created": 1, "documents_skipped": 1}
+    doc = next(b for m, p, b in calls if (m, p) == ("POST", "/api/docs/requirements"))
+    assert doc["template"] == "note" and doc["folder"] == "CCB" and doc["project_id"] == 11
+
+
+def test_a_bad_plan_is_refused_before_anything_is_sent(tmp_path):
+    f = tmp_path / "plan.json"
+    f.write_text(json.dumps({"projects": [{"name": "X", "tasks": [{"title": "t", "status": "nope"}]}]}),
+                 encoding="utf-8")
+    with pytest.raises(work.WorkError):
+        work.load_plan(str(f))
+
+
+def test_the_new_commands_parse():
+    parser = main.build_parser()
+    for argv in (["project", "list"], ["project", "create", "Webshop", "--priority", "high"],
+                 ["project", "import", "plan.json", "--dry-run"],
+                 ["task", "update", "5", "--status", "in_review", "--assignee", "a@b.c"],
+                 ["ticket", "create", "T", "--message", "m"], ["ticket", "reply", "3", "--message", "m"],
+                 ["ticket", "status", "3", "pending_customer"],
+                 ["document", "create", "Minutes", "--file", "m.md", "--folder", "CCB"]):
+        assert callable(parser.parse_args(argv).func), argv
+
+
+def test_org_entra_sends_the_secret_only_from_the_environment(monkeypatch):
+    sent = []
+    monkeypatch.setattr(main, "request", lambda args, method, path, body=None, **kw: sent.append((method, path, body)) or {})
+    monkeypatch.setattr(main, "emit", lambda value: None)
+    monkeypatch.setenv("ARCH_ENTRA_CLIENT_SECRET", "s3cret")
+    args = main.build_parser().parse_args(["org", "entra", "set", "--tenant-id", "t", "--client-id", "c"])
+    args.func(args)
+    assert sent == [("PUT", "/api/orgs/me/entra", {"tenant_id": "t", "client_id": "c", "client_secret": "s3cret"})]
+
+
+def test_org_show_leaves_out_billing_identifiers(monkeypatch):
+    shown = []
+    monkeypatch.setattr(main, "request", lambda *a, **kw: {"id": 7, "name": "X", "stripe_customer_id": "cus_1",
+                                                           "play_purchase_token": "tok", "join_code": "J",
+                                                           "members": [{"name": "a", "email": "a@x", "roles": ["Admin"], "bio": "b"}]})
+    monkeypatch.setattr(main, "emit", shown.append)
+    args = main.build_parser().parse_args(["org", "show"])
+    args.func(args)
+    text = str(shown[0])
+    assert "cus_1" not in text and "tok" not in text and "'J'" not in text
+    assert shown[0]["members"] == [{"name": "a", "email": "a@x", "roles": ["Admin"]}]