impreza-cli 0.5.1__tar.gz → 0.6.0__tar.gz

{impreza_cli-0.5.1 → impreza_cli-0.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: impreza-cli
-Version: 0.5.1
+Version: 0.6.0
 Summary: Official command-line interface for the Impreza Host public REST API
 Author-email: Impreza Host <support@imprezahost.com>
 License: MIT
@@ -23,7 +23,7 @@ Classifier: Topic :: Internet :: WWW/HTTP
 Classifier: Topic :: Utilities
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
-Requires-Dist: impreza-sdk<0.6,>=0.5.0
+Requires-Dist: impreza-sdk<0.7,>=0.6.0
 Requires-Dist: typer>=0.12
 Requires-Dist: rich>=13.7
 Requires-Dist: click>=8.0
@@ -259,6 +259,15 @@ Tracebacks never leak from expected failures (auth errors, missing
 contexts, 404s, 429s, etc.). Bugs in the CLI itself still raise so
 the traceback isn't swallowed — that's intentional.
 
+## Reviewed application configuration
+
+Version 0.6.0 adds configuration export, review and apply. Documents are limited
+to 64 KiB of UTF-8 and carry secret references instead of values. Applications
+retain their current configuration until a reviewed plan is explicitly applied.
+
+See [the configuration guide](https://docs.imprezahost.com/customer-workflows.html#config-cli)
+for SDK and CLI examples, permissions, review expiry and replay behavior.
+
 ## Development
 
 ```bash

{impreza_cli-0.5.1 → impreza_cli-0.6.0}/README.md

@@ -217,6 +217,15 @@ Tracebacks never leak from expected failures (auth errors, missing
 contexts, 404s, 429s, etc.). Bugs in the CLI itself still raise so
 the traceback isn't swallowed — that's intentional.
 
+## Reviewed application configuration
+
+Version 0.6.0 adds configuration export, review and apply. Documents are limited
+to 64 KiB of UTF-8 and carry secret references instead of values. Applications
+retain their current configuration until a reviewed plan is explicitly applied.
+
+See [the configuration guide](https://docs.imprezahost.com/customer-workflows.html#config-cli)
+for SDK and CLI examples, permissions, review expiry and replay behavior.
+
 ## Development
 
 ```bash

{impreza_cli-0.5.1 → impreza_cli-0.6.0}/impreza_cli/commands/_helpers.py

@@ -28,11 +28,10 @@ Conventions kept consistent across every CLI command:
 from __future__ import annotations
 
 import time
-from typing import Any
 from urllib.parse import quote
 
 import typer
-from impreza import Operation, Vps
+from impreza import Client, Operation, Vps
 from impreza.exceptions import ApiError, InvalidRequest, ResourceNotFound
 
 from ..output import error
@@ -85,7 +84,7 @@ def exit_on_api_error(exc: ApiError) -> None:
     raise typer.Exit(code=1)
 
 
-def resolve_vps_or_exit(client: Any, service_id: int) -> Vps:
+def resolve_vps_or_exit(client: Client, service_id: int) -> Vps:
     """Look up a VPS by id, mapping the standard SDK errors to the
     same friendly stderr lines the 3.2 power verbs introduced.
 

impreza_cli-0.6.0/impreza_cli/commands/config.py

@@ -0,0 +1,220 @@
+"""``impreza config`` — configuration as code for custom deployments (P4).
+
+Three commands over the reviewed config surface:
+
+* ``impreza config export <deployment> [--out FILE]`` — write the versioned
+  document (secrets as references) to stdout or a file;
+* ``impreza config apply <deployment> --file FILE [--yes]`` — prepare a
+  reviewed apply from the document, show the server-computed diff, and only
+  queue it after an explicit confirmation. The apply carries the exact
+  review digest, so what you confirmed is byte-for-byte what runs;
+* ``impreza config plan <plan-id>`` — read a saved review's status or
+  replay its receipt.
+
+The document is meant for version control: export it, commit it, edit it,
+apply it. Secret values never appear in the document — applying resolves
+the references server-side.
+"""
+
+from __future__ import annotations
+
+import os
+import re
+import stat
+from pathlib import Path
+
+import typer
+from impreza.exceptions import ApiError
+
+from ..output import error, success
+from ..sdk import make_client_or_exit
+from ..state import confirm_or_exit, from_typer_context
+from ._helpers import exit_on_api_error
+
+app = typer.Typer(
+    name="config",
+    help="Export, review and apply versioned application configuration.",
+    no_args_is_help=True,
+)
+
+
+def _terminal_text(value: str) -> str:
+    # Escape terminal control characters and bidi overrides in server text.
+    return "".join(
+        ch
+        if ch in "\n\t"
+        or (
+            ord(ch) >= 32
+            and not 127 <= ord(ch) <= 159
+            and not 0x202A <= ord(ch) <= 0x202E
+            and not 0x2066 <= ord(ch) <= 0x2069
+        )
+        else f"\\u{ord(ch):04x}"
+        for ch in value
+    )
+
+
+@app.command("export")
+def export(
+    typer_ctx: typer.Context,
+    deployment_id: str = typer.Argument(..., help="Custom deployment id (dpl_…)."),
+    out: Path | None = typer.Option(
+        None,
+        "--out",
+        "-o",
+        help="Write the document to this file instead of stdout.",
+    ),
+) -> None:
+    """Export the versioned config document (secrets as references)."""
+    client = make_client_or_exit(from_typer_context(typer_ctx))
+    try:
+        payload = client.config.export(deployment_id)
+    except ApiError as exc:
+        exit_on_api_error(exc)
+    except ValueError as exc:
+        error(str(exc))
+        raise typer.Exit(1) from exc
+    document_text = payload.get("document_text")
+    if not isinstance(document_text, str) or not document_text.strip():
+        error("The export carried no document text.")
+        raise typer.Exit(1)
+    if out is not None:
+        out.write_text(document_text, encoding="utf-8")
+        success(
+            f"Exported config for {payload.get('deployment_id', deployment_id)} "
+            f"(schema {payload.get('schema', '?')}) to {out}."
+        )
+        return
+    typer.echo(document_text, nl=False)
+
+
+@app.command("apply")
+def apply(
+    typer_ctx: typer.Context,
+    deployment_id: str = typer.Argument(..., help="Custom deployment id (dpl_…)."),
+    file: Path = typer.Option(
+        ...,
+        "--file",
+        "-f",
+        help="Config document to apply (as written by `impreza config export`).",
+        exists=True,
+        readable=True,
+        dir_okay=False,
+    ),
+    yes: bool = typer.Option(
+        False,
+        "--yes",
+        "-y",
+        help="Apply without the interactive confirmation prompt.",
+    ),
+) -> None:
+    """Prepare a reviewed apply from a document, show its diff, confirm, apply."""
+    try:
+        if not file.is_file():
+            raise ValueError("Config input must be a regular file.")
+        # Nonblocking open also prevents a raced replacement with a FIFO from
+        # hanging automation. Validate the opened descriptor, then bound reads.
+        fd = os.open(file, os.O_RDONLY | getattr(os, "O_NONBLOCK", 0) | getattr(os, "O_BINARY", 0))
+        with os.fdopen(fd, "rb") as stream:
+            if not stat.S_ISREG(os.fstat(stream.fileno()).st_mode):
+                raise ValueError("Config input must be a regular file.")
+            raw = stream.read(65537)
+        if not raw or len(raw) > 65536:
+            raise ValueError("Config document must contain 1 to 65536 UTF-8 bytes.")
+        document = raw.decode("utf-8")
+    except (OSError, ValueError) as exc:
+        error("Cannot read config document: " + str(exc))
+        raise typer.Exit(1) from exc
+    client = make_client_or_exit(from_typer_context(typer_ctx))
+    try:
+        review = client.config.prepare(deployment_id, document)
+    except ApiError as exc:
+        exit_on_api_error(exc)
+    except ValueError as exc:
+        error(str(exc))
+        raise typer.Exit(1) from exc
+    plan_id = review.get("plan_id")
+    review_digest = review.get("review_digest")
+    changes = review.get("changes")
+    diff_text = review.get("diff_text")
+    if (
+        not isinstance(plan_id, str)
+        or re.fullmatch(r"cplan_[a-f0-9]{24}", plan_id) is None
+        or not isinstance(review_digest, str)
+        or re.fullmatch(r"[a-f0-9]{64}", review_digest) is None
+        or review.get("deployment_id") != deployment_id
+        or review.get("operation") != "config_apply"
+        or not isinstance(changes, list)
+        or not all(isinstance(item, str) for item in changes)
+        or not isinstance(diff_text, str)
+        or review.get("no_changes") is not (changes == [])
+    ):
+        error(
+            "The review response is incomplete or does not match this deployment; "
+            "nothing was applied."
+        )
+        raise typer.Exit(1)
+
+    if isinstance(changes, (list, dict)) and changes:
+        typer.secho("Planned changes:", fg=typer.colors.YELLOW, bold=True)
+        if isinstance(changes, dict):
+            for key, value in changes.items():
+                typer.echo(f"  {key}: {value}")
+        else:
+            for line in changes:
+                typer.echo(_terminal_text(f"  {line}"))
+    else:
+        typer.echo("No changes detected — the apply is idempotent for this document.")
+    if isinstance(diff_text, str) and diff_text.strip():
+        typer.echo("")
+        typer.secho("Diff:", fg=typer.colors.YELLOW, bold=True)
+        typer.echo(_terminal_text(diff_text.rstrip()))
+
+    typer.echo("")
+    confirm_or_exit(f"Apply this configuration to {deployment_id}.", yes=yes)
+    try:
+        result = client.config.apply(plan_id, review_digest)
+    except ApiError as exc:
+        exit_on_api_error(exc)
+    except ValueError as exc:
+        error(str(exc))
+        raise typer.Exit(1) from exc
+    receipt = result.get("receipt")
+    if not isinstance(receipt, dict):
+        receipt = result
+    command_id = result.get("command_id") or receipt.get("command_id")
+    replayed = bool(result.get("replayed"))
+    if replayed:
+        success(f"Plan {plan_id} was already accepted — replayed its receipt.")
+    else:
+        success(f"Configuration applied (plan {plan_id}).")
+    if isinstance(command_id, str) and command_id:
+        typer.echo(_terminal_text(f"Deploy command: {command_id}"))
+    if receipt.get("no_changes") is True:
+        typer.echo("No deployment was queued because the configuration already matches.")
+    else:
+        typer.echo("The change is queued; watch the deployment's status or the command above.")
+
+
+@app.command("plan")
+def plan(
+    typer_ctx: typer.Context,
+    plan_id: str = typer.Argument(..., help="Config plan id (cplan_…)."),
+) -> None:
+    """Read one saved config review: status, digest and receipt."""
+    client = make_client_or_exit(from_typer_context(typer_ctx))
+    try:
+        payload = client.config.get_plan(plan_id)
+    except ApiError as exc:
+        exit_on_api_error(exc)
+    except ValueError as exc:
+        error(str(exc))
+        raise typer.Exit(1) from exc
+    status = payload.get("status", "unknown")
+    typer.echo(_terminal_text(f"Plan {plan_id}: {status}"))
+    digest = payload.get("review_digest")
+    if isinstance(digest, str) and digest:
+        typer.echo(_terminal_text(f"Review digest: {digest}"))
+    receipt = payload.get("receipt")
+    if isinstance(receipt, dict):
+        typer.echo(f"Receipt: {receipt}")

{impreza_cli-0.5.1 → impreza_cli-0.6.0}/impreza_cli/commands/dedicated.py

@@ -45,7 +45,7 @@ Reinstall (destructive — wipes ALL data):
 
 from __future__ import annotations
 
-from typing import Any
+from typing import Any, Literal, cast
 
 import typer
 from impreza.exceptions import ApiError
@@ -76,9 +76,11 @@ def _emit(value: Any, *, ctx: typer.Context, title: str) -> None:
     """
     fmt = resolve_output(from_typer_context(ctx), None)
     if isinstance(value, list):
-        rows = value if all(isinstance(row, dict) for row in value) else [
-            {"value": item} for item in value
-        ]
+        rows = (
+            value
+            if all(isinstance(row, dict) for row in value)
+            else [{"value": item} for item in value]
+        )
         print_table(title, rows, fmt=fmt)
     elif isinstance(value, dict):
         print_dict(title, value, fmt=fmt)
@@ -356,8 +358,15 @@ def cmd_set_firewall(
     """Update DDoS firewall state/sensitivity for an IP. Requires the ``firewall`` capability."""
     client = make_client_or_exit(from_typer_context(ctx))
     try:
+        if state not in (None, "always_on", "redirect_on_attack"):
+            raise typer.BadParameter("Use always_on or redirect_on_attack.", param_hint="--state")
+        if sensitivity not in (None, "low", "normal", "medium", "high"):
+            raise typer.BadParameter("Use low, normal, medium or high.", param_hint="--sensitivity")
         data = client.dedicated.set_firewall(
-            service_id, ip=ip, state=state, sensitivity=sensitivity
+            service_id,
+            ip=ip,
+            state=cast(Literal["always_on", "redirect_on_attack"] | None, state),
+            sensitivity=cast(Literal["low", "normal", "medium", "high"] | None, sensitivity),
         )
     except ApiError as exc:
         exit_on_api_error(exc)
@@ -382,7 +391,32 @@ def cmd_bandwidth(
     """Bandwidth graph (PNG base64). Requires the ``bandwidth`` capability."""
     client = make_client_or_exit(from_typer_context(ctx))
     try:
-        data = client.dedicated.bandwidth(service_id, type=type, scale=scale)
+        if type not in (
+            "port_bits",
+            "port_upkts",
+            "port_percent",
+            "port_errors",
+            "port_pktsize",
+            "port_discards",
+        ):
+            raise typer.BadParameter("Unsupported bandwidth type.", param_hint="--type")
+        if scale not in ("day", "week", "month"):
+            raise typer.BadParameter("Use day, week or month.", param_hint="--scale")
+        data = client.dedicated.bandwidth(
+            service_id,
+            type=cast(
+                Literal[
+                    "port_bits",
+                    "port_upkts",
+                    "port_percent",
+                    "port_errors",
+                    "port_pktsize",
+                    "port_discards",
+                ],
+                type,
+            ),
+            scale=cast(Literal["day", "week", "month"], scale),
+        )
     except ApiError as exc:
         exit_on_api_error(exc)
         return

{impreza_cli-0.5.1 → impreza_cli-0.6.0}/impreza_cli/commands/vps_cloud.py

@@ -178,6 +178,7 @@ def images_list(
     if not images:
         typer.echo("No images saved on this account.")
         return
+    rows: list[dict[str, Any]]
     if fmt is OutputFormat.TABLE:
         rows = [
             {

{impreza_cli-0.5.1 → impreza_cli-0.6.0}/impreza_cli/main.py

@@ -18,6 +18,7 @@ import typer
 from . import __version__
 from .commands import account as account_cmd
 from .commands import catalog as catalog_cmd
+from .commands import config as config_cmd
 from .commands import context as context_cmd
 from .commands import dedicated as dedicated_cmd
 from .commands import doctor as doctor_cmd
@@ -86,6 +87,7 @@ def _root(
 # ``impreza --help`` output reads predictably.
 app.add_typer(account_cmd.app, name="account")
 app.add_typer(catalog_cmd.app, name="catalog")
+app.add_typer(config_cmd.app, name="config")
 app.add_typer(context_cmd.app, name="context")
 app.add_typer(dedicated_cmd.app, name="dedicated")
 app.add_typer(doctor_cmd.app, name="doctor")

{impreza_cli-0.5.1 → impreza_cli-0.6.0}/impreza_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: impreza-cli
-Version: 0.5.1
+Version: 0.6.0
 Summary: Official command-line interface for the Impreza Host public REST API
 Author-email: Impreza Host <support@imprezahost.com>
 License: MIT
@@ -23,7 +23,7 @@ Classifier: Topic :: Internet :: WWW/HTTP
 Classifier: Topic :: Utilities
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
-Requires-Dist: impreza-sdk<0.6,>=0.5.0
+Requires-Dist: impreza-sdk<0.7,>=0.6.0
 Requires-Dist: typer>=0.12
 Requires-Dist: rich>=13.7
 Requires-Dist: click>=8.0
@@ -259,6 +259,15 @@ Tracebacks never leak from expected failures (auth errors, missing
 contexts, 404s, 429s, etc.). Bugs in the CLI itself still raise so
 the traceback isn't swallowed — that's intentional.
 
+## Reviewed application configuration
+
+Version 0.6.0 adds configuration export, review and apply. Documents are limited
+to 64 KiB of UTF-8 and carry secret references instead of values. Applications
+retain their current configuration until a reviewed plan is explicitly applied.
+
+See [the configuration guide](https://docs.imprezahost.com/customer-workflows.html#config-cli)
+for SDK and CLI examples, permissions, review expiry and replay behavior.
+
 ## Development
 
 ```bash

{impreza_cli-0.5.1 → impreza_cli-0.6.0}/impreza_cli.egg-info/SOURCES.txt

@@ -16,6 +16,7 @@ impreza_cli/commands/__init__.py
 impreza_cli/commands/_helpers.py
 impreza_cli/commands/account.py
 impreza_cli/commands/catalog.py
+impreza_cli/commands/config.py
 impreza_cli/commands/context.py
 impreza_cli/commands/dedicated.py
 impreza_cli/commands/doctor.py
@@ -35,6 +36,7 @@ tests/test_account_commands.py
 tests/test_account_topup_commands.py
 tests/test_catalog_commands.py
 tests/test_config.py
+tests/test_config_commands.py
 tests/test_context_commands.py
 tests/test_dedicated_commands.py
 tests/test_doctor_commands.py

{impreza_cli-0.5.1 → impreza_cli-0.6.0}/impreza_cli.egg-info/requires.txt

@@ -1,4 +1,4 @@
-impreza-sdk<0.6,>=0.5.0
+impreza-sdk<0.7,>=0.6.0
 typer>=0.12
 rich>=13.7
 click>=8.0

{impreza_cli-0.5.1 → impreza_cli-0.6.0}/pyproject.toml

@@ -41,7 +41,7 @@ dependencies = [
     # breaking (see CHANGELOG). Raise BOTH bounds in the same commit that
     # makes the CLI depend on a newer SDK feature, or this stops
     # protecting anything.
-    "impreza-sdk>=0.5.0,<0.6",
+    "impreza-sdk>=0.6.0,<0.7",
     "typer>=0.12",
     "rich>=13.7",
     # Declared explicitly because `config.py` imports click directly, for

impreza_cli-0.6.0/tests/test_config_commands.py

@@ -0,0 +1,297 @@
+"""Unit tests for ``impreza config`` commands (P4 config-as-code CLI).
+
+respx mocks the SDK's HTTP layer end-to-end: export writes the exact
+document text, apply runs the prepare → review → apply flow carrying the
+exact digest, and plan renders a saved review. The confirmation path,
+digest mismatch refusals and the no-changes rendering are all covered.
+"""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+import httpx
+import pytest
+import respx
+from typer.testing import CliRunner
+
+from impreza_cli.config import Config
+from impreza_cli.main import app
+
+runner = CliRunner()
+
+BASE = "https://api.imprezahost.com/v1"
+_FAKE_KEY = "imp_" + ("a" * 40)
+_FAKE_SECRET = "0" * 64
+
+_DEPLOYMENT = "dpl_" + "c" * 16
+_PLAN = "cplan_" + "6" * 24
+_DIGEST = "f" * 64
+_DOCUMENT = {
+    "schema": 1,
+    "deployment": {"name": "web", "build_strategy": "static_files"},
+    "resources": {},
+}
+
+
+@pytest.fixture
+def seeded_config(isolated_config: Path) -> Path:
+    cfg = Config.load(isolated_config)
+    cfg.add_context("personal", api_key=_FAKE_KEY, api_secret=_FAKE_SECRET)
+    cfg.save()
+    return isolated_config
+
+
+def _export_envelope() -> dict[str, object]:
+    return {
+        "success": True,
+        "data": {
+            "schema": 1,
+            "deployment_id": _DEPLOYMENT,
+            "name": "web",
+            "exported_at": "2026-09-21T00:00:00Z",
+            "document": _DOCUMENT,
+            "document_text": json.dumps(_DOCUMENT, indent=2) + "\n",
+            "secrets": "references_only",
+        },
+        "meta": {"request_id": "req_t"},
+    }
+
+
+def _prepare_envelope(changes: object, diff: str) -> dict[str, object]:
+    return {
+        "success": True,
+        "data": {
+            "plan_id": _PLAN,
+            "review_digest": _DIGEST,
+            "status": "ready_for_review",
+            "expires_at": "2026-09-21T00:15:00Z",
+            "changes": changes,
+            "no_changes": changes == [],
+            "diff_text": diff,
+            "operation": "config_apply",
+            "deployment_id": _DEPLOYMENT,
+        },
+        "meta": {"request_id": "req_t"},
+    }
+
+
+# ── export ────────────────────────────────────────────────────────────
+
+
+@respx.mock
+def test_export_writes_document_text(seeded_config: Path, tmp_path: Path) -> None:
+    respx.get(f"{BASE}/platform/deployments/custom/{_DEPLOYMENT}/config").mock(
+        return_value=httpx.Response(200, json=_export_envelope()),
+    )
+    out = tmp_path / "config.json"
+    result = runner.invoke(app, ["config", "export", _DEPLOYMENT, "--out", str(out)])
+    assert result.exit_code == 0, result.stderr
+    assert _DEPLOYMENT in result.stdout
+    assert "Exported" in result.stdout
+    written = out.read_text(encoding="utf-8")
+    assert json.loads(written) == _DOCUMENT
+
+
+@respx.mock
+def test_export_stdout_is_document_only(seeded_config: Path) -> None:
+    respx.get(f"{BASE}/platform/deployments/custom/{_DEPLOYMENT}/config").mock(
+        return_value=httpx.Response(200, json=_export_envelope()),
+    )
+    result = runner.invoke(app, ["config", "export", _DEPLOYMENT])
+    assert result.exit_code == 0, result.stderr
+    assert json.loads(result.stdout) == _DOCUMENT
+
+
+# ── apply ─────────────────────────────────────────────────────────────
+
+
+@respx.mock
+def test_apply_flow_carries_exact_digest(seeded_config: Path, tmp_path: Path) -> None:
+    doc = tmp_path / "config.json"
+    doc.write_text(json.dumps(_DOCUMENT), encoding="utf-8")
+    prepare = respx.post(
+        f"{BASE}/platform/deployments/custom/{_DEPLOYMENT}/prepare-config-apply"
+    ).mock(
+        return_value=httpx.Response(
+            201,
+            json=_prepare_envelope(
+                ["vars: two changes", "build: one change"],
+                "--- a\n+++ b\n@@\n- static_spa: false\n+ static_spa: true\n",
+            ),
+        )
+    )
+    apply = respx.post(f"{BASE}/platform/config-plans/{_PLAN}/apply").mock(
+        return_value=httpx.Response(
+            202,
+            json={
+                "success": True,
+                "data": {
+                    "command_id": "cmd_" + "a" * 16,
+                    "receipt": {"command_id": "cmd_" + "a" * 16},
+                },
+                "meta": {"request_id": "req_t"},
+            },
+        )
+    )
+    result = runner.invoke(app, ["config", "apply", _DEPLOYMENT, "--file", str(doc), "--yes"])
+    assert result.exit_code == 0, result.stderr
+    assert "static_spa: true" in result.stdout
+    assert "cmd_" + "a" * 16 in result.stdout
+    assert "Applied" in result.stdout or "applied" in result.stdout
+
+    prepare_body = json.loads(prepare.calls.last.request.content)
+    assert prepare_body == {"document": json.dumps(_DOCUMENT)}
+    apply_body = json.loads(apply.calls.last.request.content)
+    assert apply_body == {"confirm": True, "review_digest": _DIGEST}
+
+
+@respx.mock
+def test_apply_without_yes_prompts_and_declines(seeded_config: Path, tmp_path: Path) -> None:
+    doc = tmp_path / "config.json"
+    doc.write_text(json.dumps(_DOCUMENT), encoding="utf-8")
+    respx.post(f"{BASE}/platform/deployments/custom/{_DEPLOYMENT}/prepare-config-apply").mock(
+        return_value=httpx.Response(201, json=_prepare_envelope([], ""))
+    )
+    result = runner.invoke(app, ["config", "apply", _DEPLOYMENT, "--file", str(doc)], input="n\n")
+    assert result.exit_code == 0, result.stderr
+    assert "Cancelled" in result.stdout
+
+
+@respx.mock
+def test_apply_without_yes_prompts_and_confirms(seeded_config: Path, tmp_path: Path) -> None:
+    doc = tmp_path / "config.json"
+    doc.write_text(json.dumps(_DOCUMENT), encoding="utf-8")
+    respx.post(f"{BASE}/platform/deployments/custom/{_DEPLOYMENT}/prepare-config-apply").mock(
+        return_value=httpx.Response(201, json=_prepare_envelope([], ""))
+    )
+    respx.post(f"{BASE}/platform/config-plans/{_PLAN}/apply").mock(
+        return_value=httpx.Response(
+            202,
+            json={
+                "success": True,
+                "data": {"command_id": "cmd_b"},
+                "meta": {"request_id": "req_t"},
+            },
+        )
+    )
+    result = runner.invoke(app, ["config", "apply", _DEPLOYMENT, "--file", str(doc)], input="y\n")
+    assert result.exit_code == 0, result.stderr
+    assert "No changes detected" in result.stdout
+
+
+@respx.mock
+def test_apply_digest_mismatch_is_refused(seeded_config: Path, tmp_path: Path) -> None:
+    doc = tmp_path / "config.json"
+    doc.write_text(json.dumps(_DOCUMENT), encoding="utf-8")
+    respx.post(f"{BASE}/platform/deployments/custom/{_DEPLOYMENT}/prepare-config-apply").mock(
+        return_value=httpx.Response(201, json=_prepare_envelope([], ""))
+    )
+    respx.post(f"{BASE}/platform/config-plans/{_PLAN}/apply").mock(
+        return_value=httpx.Response(
+            409,
+            json={
+                "success": False,
+                "error": {"code": "CONFLICT", "message": "Config review digest does not match."},
+            },
+        )
+    )
+    result = runner.invoke(app, ["config", "apply", _DEPLOYMENT, "--file", str(doc), "--yes"])
+    assert result.exit_code != 0
+    assert "digest" in result.stdout.lower() or "digest" in result.stderr.lower()
+
+
+@respx.mock
+def test_apply_replayed_plan_renders_receipt(seeded_config: Path, tmp_path: Path) -> None:
+    doc = tmp_path / "config.json"
+    doc.write_text(json.dumps(_DOCUMENT), encoding="utf-8")
+    respx.post(f"{BASE}/platform/deployments/custom/{_DEPLOYMENT}/prepare-config-apply").mock(
+        return_value=httpx.Response(201, json=_prepare_envelope([], ""))
+    )
+    respx.post(f"{BASE}/platform/config-plans/{_PLAN}/apply").mock(
+        return_value=httpx.Response(
+            202,
+            json={
+                "success": True,
+                "data": {"replayed": True, "receipt": {"command_id": "cmd_first"}},
+                "meta": {"request_id": "req_t"},
+            },
+        )
+    )
+    result = runner.invoke(app, ["config", "apply", _DEPLOYMENT, "--file", str(doc), "--yes"])
+    assert result.exit_code == 0, result.stderr
+    assert "already accepted" in result.stdout
+
+
+# ── plan ──────────────────────────────────────────────────────────────
+
+
+@respx.mock
+def test_plan_renders_status_and_digest(seeded_config: Path) -> None:
+    respx.get(f"{BASE}/platform/config-plans/{_PLAN}").mock(
+        return_value=httpx.Response(
+            200,
+            json={
+                "success": True,
+                "data": {
+                    "plan_id": _PLAN,
+                    "review_digest": _DIGEST,
+                    "status": "accepted",
+                    "receipt": {"command_id": "cmd_first"},
+                },
+                "meta": {"request_id": "req_t"},
+            },
+        )
+    )
+    result = runner.invoke(app, ["config", "plan", _PLAN])
+    assert result.exit_code == 0, result.stderr
+    assert "accepted" in result.stdout
+    assert _DIGEST in result.stdout
+    assert "cmd_first" in result.stdout
+
+
+@pytest.mark.parametrize(
+    "field,value",
+    [
+        ("deployment_id", "dpl_" + "d" * 16),
+        ("operation", "delete"),
+        ("plan_id", "cplan_" + "6" * 24 + "/apply"),
+        ("review_digest", ""),
+        ("changes", None),
+        ("changes", {}),
+        ("changes", [123]),
+        ("diff_text", None),
+        ("no_changes", False),
+    ],
+)
+@respx.mock
+def test_incomplete_review_never_applies_even_with_yes(
+    seeded_config: Path, tmp_path: Path, field, value
+) -> None:
+    doc = tmp_path / "config.json"
+    doc.write_text(json.dumps(_DOCUMENT), encoding="utf-8")
+    payload = _prepare_envelope([], "No changes")
+    payload["data"][field] = value
+    respx.post(f"{BASE}/platform/deployments/custom/{_DEPLOYMENT}/prepare-config-apply").respond(
+        201, json=payload
+    )
+    result = runner.invoke(app, ["config", "apply", _DEPLOYMENT, "--file", str(doc), "--yes"])
+    assert result.exit_code == 1
+    assert "nothing was applied" in result.stderr
+    assert len(respx.calls) == 1
+
+
+@respx.mock
+def test_oversize_file_is_rejected_without_network(seeded_config: Path, tmp_path: Path) -> None:
+    doc = tmp_path / "large.json"
+    doc.write_bytes(b"x" * 65537)
+    result = runner.invoke(app, ["config", "apply", _DEPLOYMENT, "--file", str(doc), "--yes"])
+    assert result.exit_code == 1
+    assert len(respx.calls) == 0
+
+
+def test_review_terminal_control_is_visible() -> None:
+    from impreza_cli.commands.config import _terminal_text
+
+    assert _terminal_text("before\x1b[2J\r\u202eafter") == "before\\u001b[2J\\u000d\\u202eafter"

{impreza_cli-0.5.1 → impreza_cli-0.6.0}/tests/test_dedicated_commands.py

@@ -91,9 +91,7 @@ def test_list_renders_table(seeded_config: Path) -> None:
 def test_list_json_echoes_raw_payload(seeded_config: Path) -> None:
     """JSON output passes the server payload through untouched, so
     scripts see every field — not just the table projection."""
-    respx.get(f"{BASE}/dedicated").mock(
-        return_value=httpx.Response(200, json=_ok(_SERVERS))
-    )
+    respx.get(f"{BASE}/dedicated").mock(return_value=httpx.Response(200, json=_ok(_SERVERS)))
     result = runner.invoke(app, ["--output", "json", "dedicated", "list"])
     assert result.exit_code == 0, result.stdout
     assert json.loads(result.stdout) == _SERVERS
@@ -166,9 +164,7 @@ def test_dict_verbs_render(
     needle: str,
 ) -> None:
     """Every read verb that returns a dict renders a Field / Value table."""
-    route = respx.get(f"{BASE}{path}").mock(
-        return_value=httpx.Response(200, json=_ok(payload))
-    )
+    route = respx.get(f"{BASE}{path}").mock(return_value=httpx.Response(200, json=_ok(payload)))
     result = runner.invoke(app, argv)
     assert result.exit_code == 0, result.stdout
     assert route.called
@@ -215,9 +211,7 @@ def test_set_rdns_puts_ip_in_path_and_hostname_in_body(seeded_config: Path) -> N
     )
     assert result.exit_code == 0, result.stdout
     assert route.called
-    assert json.loads(route.calls.last.request.content) == {
-        "hostname": "srv1.example.com"
-    }
+    assert json.loads(route.calls.last.request.content) == {"hostname": "srv1.example.com"}
 
 
 @respx.mock
@@ -294,3 +288,21 @@ def test_reinstall_sends_wipe_header(seeded_config: Path) -> None:
     body = json.loads(route.calls.last.request.content)
     assert body["confirm"] is True
     assert body["os_id"] == "ubuntu-24.04"
+
+
+@pytest.mark.parametrize(
+    "args",
+    [
+        ["set-firewall", "101", "--ip", "203.0.113.10", "--state", "invalid"],
+        ["set-firewall", "101", "--ip", "203.0.113.10", "--sensitivity", "invalid"],
+        ["bandwidth", "101", "--type", "invalid"],
+        ["bandwidth", "101", "--scale", "invalid"],
+    ],
+)
+@respx.mock
+def test_invalid_dedicated_options_never_reach_transport(
+    seeded_config: Path, args: list[str]
+) -> None:
+    result = runner.invoke(app, ["dedicated"] + args)
+    assert result.exit_code == 2
+    assert len(respx.calls) == 0