makea-cli 0.2.2__tar.gz → 0.2.5__tar.gz

{makea_cli-0.2.2 → makea_cli-0.2.5}/CHANGELOG.md

@@ -1,5 +1,46 @@
 # Changelog
 
+## 0.2.5
+
+The production journey, for the Claude agent on the product channel.
+
+- `designer set production-cart <production_order_id> --qty 'SIZE,#RRGGBB=COUNT' …`
+  (`auto`): the run's size x colour quantities. Replaces the whole cart, and is
+  refused once the run is locked.
+- `designer set production-lock <production_order_id> [--unlock]` (`ask`):
+  place the order. Locking is what makes the deposit payable; it can be
+  reopened until the deposit is paid.
+- `designer get production-price <production_order_id> [--phase final]`: the
+  deposit (or balance) for the quantities on the run now, line by line.
+
+## 0.2.4
+
+For Beeboo acting for a brand through the CLI (the Claude agent on the product
+channel).
+
+- **Token broker mode.** With `MAKEA_TOKEN_BROKER=<unix socket>` the CLI sends
+  its own argv to the broker and uses the token it gets back
+  (`x-impersonation-token`) for that one invocation. There is no fallback to a
+  cached login in this mode: a command that did not come through the host's
+  gate gets no token.
+- `designer submit tech-pack <product_id>` (`ask`): confirm the tech pack.
+- `designer create quote-award <product_id> --quote <supplier link id>` (`ask`):
+  choose the quote to sample with. Creates or reuses a DRAFT sampling order and
+  prints its id.
+- `designer create checkout --key sampling:<id> [--key …] --accept-terms`
+  (`ask`): a Stripe checkout link for one or more charges (sampling,
+  production deposit/final, shipping, misc). It is the one command near a
+  payment endpoint: it creates the session and nothing is charged until the
+  brand pays on Stripe's page. Bank transfers and subscriptions stay out.
+
+## 0.2.3
+
+- `admin update quote --ip-schedule-hidden/--ip-schedule-visible`: hide a
+  supplier's IP Schedule from the customer, or show it again. Visible unless set.
+- `--ip-schedule-json` help describes the version 2 schedule: two buckets
+  (`production_files`, tech pack and BOM included, and `physical_tooling`),
+  "not created" by default, and optional.
+
 ## 0.2.2
 
 Order lifecycle, exposed in tiers rather than all at once.

{makea_cli-0.2.2 → makea_cli-0.2.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: makea-cli
-Version: 0.2.2
+Version: 0.2.5
 Summary: Makea admin CLI (browser login + Makea admin HTTP API)
 Requires-Python: >=3.10
 Requires-Dist: click<9,>=8.1
@@ -144,9 +144,11 @@ exit code：`0` 成功 · `2` 用法错 · `3` 未登录或身份与 persona 不
 
 | 命令 | 读/写 | 后端 | 说明 | 旧名 |
 |---|---|---|---|---|
+| `makea-cli designer create checkout` | write（ask） | `POST /designer/payments/basket/create-session` | a Stripe checkout link for one or more charges. --key repeats: sampling:<sampling_order_id>, production:<production_o… | — |
 | `makea-cli designer create collection` | write（auto） | `POST /designer/collections/create` | create or update a designer collection. | `designer-create-collection` |
 | `makea-cli designer create note` | write（ask） | `POST /designer/products/{product_id}/notes` | post a message into a product's conversation. | — |
 | `makea-cli designer create product` | write（ask） | `POST /designer/product/create_or_update_product` | payload must match manufacture/specifications (all frontend fields; categories/subcategories + collection_id in --hel… | `designer-upsert-product` |
+| `makea-cli designer create quote-award` | write（ask） | `POST /designer/quotes/group_pay_prepare` | choose the supplier quote to sample with. --quote is the supplier link id from `designer list supplier-link`; repeat … | — |
 | `makea-cli designer create rfq` | write（ask） | `POST /designer/product/send_rfq` | ask the chosen suppliers to quote on a product. --supplier repeats; --makea-sourcing also asks Makea to source. | — |
 | `makea-cli designer create sampling-order` | write（ask） | `POST /designer/sampling_orders` | order samples. --file is the full order payload (product_order_id, items, fees …); run --dry-run first and read the b… | — |
 | `makea-cli designer delete sampling-order` | write（never） | `DELETE /designer/sampling_orders/{sampling_order_id}` | delete a DRAFT sample order. The backend refuses any other status. Graded `never`. | — |
@@ -155,6 +157,7 @@ exit code：`0` 成功 · `2` 用法错 · `3` 未登录或身份与 persona 不
 | `makea-cli designer get collection` | read | `GET /designer/collections/{collection_id}/overview` | one collection with its products, orders and lifecycle in a single read. | — |
 | `makea-cli designer get lifecycle` | read | `GET /designer/product_orders/{product_order_id}/lifecycle` | which stage this product is in. | — |
 | `makea-cli designer get product` | read | `GET /designer/get_product` | one product: status, documents, prices, links. | — |
+| `makea-cli designer get production-price` | read | `GET /designer/production_orders/{production_order_id}/calculate_price` | what the deposit (or the balance, --phase final) comes to for the quantities on the run right now, line by line. | — |
 | `makea-cli designer get quote-advice` | read | `GET /designer/product/quote_advice` | which quote to award and why, from cache. Reading never spends a model call; the web app is what asks for a fresh one. | — |
 | `makea-cli designer get tech-pack` | read | `GET /designer/products/{product_id}/technical-specifications` | the product's tech pack. | — |
 | `makea-cli designer get tech-pack-history` | read | `GET /designer/products/{product_id}/specification-change-history` | who changed which spec field, when, and from what. | — |
@@ -171,8 +174,11 @@ exit code：`0` 成功 · `2` 用法错 · `3` 未登录或身份与 persona 不
 | `makea-cli designer list task` | read | `GET /designer/tasks` | what the platform is waiting on you for. | — |
 | `makea-cli designer search note` | read | `GET /designer/products/{product_id}/channel_search` | full-text search across a product's conversation; --channel narrows to one channel key. | — |
 | `makea-cli designer set product-collection` | write（auto） | `POST /designer/products/{id}/link-to-collection` | assign product to a collection. | `designer-link-product-to-collection` |
+| `makea-cli designer set production-cart` | write（auto） | `PUT /designer/production_orders/{production_order_id}/cart` | the quantity of every size and colour on the run. Replaces the whole cart: pass every cell you want kept. --qty repea… | — |
+| `makea-cli designer set production-lock` | write（ask） | `POST /designer/production_orders/{production_order_id}/configuration-lock` | place the order with the quantities on the run (--unlock to reopen them). Locking is what makes the deposit payable: … | — |
 | `makea-cli designer submit production-order` | write（ask） | `POST /designer/production_orders/{production_order_id}/submit` | submit a 大货 order. This is the commitment, so --dry-run and confirm with the user first. | — |
 | `makea-cli designer submit sampling-order` | write（ask） | `POST /designer/sampling_orders/{sampling_order_id}/confirm` | confirm a sample order so the supplier starts. Run --dry-run first and read it back to the user. | — |
+| `makea-cli designer submit tech-pack` | write（ask） | `POST /designer/products/{product_id}/technical-specifications/confirm` | confirm the tech pack, the step before anyone is asked to quote. | — |
 | `makea-cli designer update action` | write（auto） | `POST /designer/actions/{action_id}/{acknowledge\|snooze\|dismiss}` | respond to one of the pending actions from `designer list action`. An action is closed by the fact it asks for, not b… | — |
 | `makea-cli designer update note` | write（ask） | `POST /designer/products/{product_id}/notes/{note_id}/{accept\|reject}` | decide on a task the assistant proposed on a product. | — |
 | `makea-cli designer update product` | write（auto） | `POST /designer/product/update_basic_info` | patch fields on a product. --cover-image / --back-image take a document id and are what the assistant's set_product_i… | — |

{makea_cli-0.2.2 → makea_cli-0.2.5}/README.md

@@ -132,9 +132,11 @@ exit code：`0` 成功 · `2` 用法错 · `3` 未登录或身份与 persona 不
 
 | 命令 | 读/写 | 后端 | 说明 | 旧名 |
 |---|---|---|---|---|
+| `makea-cli designer create checkout` | write（ask） | `POST /designer/payments/basket/create-session` | a Stripe checkout link for one or more charges. --key repeats: sampling:<sampling_order_id>, production:<production_o… | — |
 | `makea-cli designer create collection` | write（auto） | `POST /designer/collections/create` | create or update a designer collection. | `designer-create-collection` |
 | `makea-cli designer create note` | write（ask） | `POST /designer/products/{product_id}/notes` | post a message into a product's conversation. | — |
 | `makea-cli designer create product` | write（ask） | `POST /designer/product/create_or_update_product` | payload must match manufacture/specifications (all frontend fields; categories/subcategories + collection_id in --hel… | `designer-upsert-product` |
+| `makea-cli designer create quote-award` | write（ask） | `POST /designer/quotes/group_pay_prepare` | choose the supplier quote to sample with. --quote is the supplier link id from `designer list supplier-link`; repeat … | — |
 | `makea-cli designer create rfq` | write（ask） | `POST /designer/product/send_rfq` | ask the chosen suppliers to quote on a product. --supplier repeats; --makea-sourcing also asks Makea to source. | — |
 | `makea-cli designer create sampling-order` | write（ask） | `POST /designer/sampling_orders` | order samples. --file is the full order payload (product_order_id, items, fees …); run --dry-run first and read the b… | — |
 | `makea-cli designer delete sampling-order` | write（never） | `DELETE /designer/sampling_orders/{sampling_order_id}` | delete a DRAFT sample order. The backend refuses any other status. Graded `never`. | — |
@@ -143,6 +145,7 @@ exit code：`0` 成功 · `2` 用法错 · `3` 未登录或身份与 persona 不
 | `makea-cli designer get collection` | read | `GET /designer/collections/{collection_id}/overview` | one collection with its products, orders and lifecycle in a single read. | — |
 | `makea-cli designer get lifecycle` | read | `GET /designer/product_orders/{product_order_id}/lifecycle` | which stage this product is in. | — |
 | `makea-cli designer get product` | read | `GET /designer/get_product` | one product: status, documents, prices, links. | — |
+| `makea-cli designer get production-price` | read | `GET /designer/production_orders/{production_order_id}/calculate_price` | what the deposit (or the balance, --phase final) comes to for the quantities on the run right now, line by line. | — |
 | `makea-cli designer get quote-advice` | read | `GET /designer/product/quote_advice` | which quote to award and why, from cache. Reading never spends a model call; the web app is what asks for a fresh one. | — |
 | `makea-cli designer get tech-pack` | read | `GET /designer/products/{product_id}/technical-specifications` | the product's tech pack. | — |
 | `makea-cli designer get tech-pack-history` | read | `GET /designer/products/{product_id}/specification-change-history` | who changed which spec field, when, and from what. | — |
@@ -159,8 +162,11 @@ exit code：`0` 成功 · `2` 用法错 · `3` 未登录或身份与 persona 不
 | `makea-cli designer list task` | read | `GET /designer/tasks` | what the platform is waiting on you for. | — |
 | `makea-cli designer search note` | read | `GET /designer/products/{product_id}/channel_search` | full-text search across a product's conversation; --channel narrows to one channel key. | — |
 | `makea-cli designer set product-collection` | write（auto） | `POST /designer/products/{id}/link-to-collection` | assign product to a collection. | `designer-link-product-to-collection` |
+| `makea-cli designer set production-cart` | write（auto） | `PUT /designer/production_orders/{production_order_id}/cart` | the quantity of every size and colour on the run. Replaces the whole cart: pass every cell you want kept. --qty repea… | — |
+| `makea-cli designer set production-lock` | write（ask） | `POST /designer/production_orders/{production_order_id}/configuration-lock` | place the order with the quantities on the run (--unlock to reopen them). Locking is what makes the deposit payable: … | — |
 | `makea-cli designer submit production-order` | write（ask） | `POST /designer/production_orders/{production_order_id}/submit` | submit a 大货 order. This is the commitment, so --dry-run and confirm with the user first. | — |
 | `makea-cli designer submit sampling-order` | write（ask） | `POST /designer/sampling_orders/{sampling_order_id}/confirm` | confirm a sample order so the supplier starts. Run --dry-run first and read it back to the user. | — |
+| `makea-cli designer submit tech-pack` | write（ask） | `POST /designer/products/{product_id}/technical-specifications/confirm` | confirm the tech pack, the step before anyone is asked to quote. | — |
 | `makea-cli designer update action` | write（auto） | `POST /designer/actions/{action_id}/{acknowledge\|snooze\|dismiss}` | respond to one of the pending actions from `designer list action`. An action is closed by the fact it asks for, not b… | — |
 | `makea-cli designer update note` | write（ask） | `POST /designer/products/{product_id}/notes/{note_id}/{accept\|reject}` | decide on a task the assistant proposed on a product. | — |
 | `makea-cli designer update product` | write（auto） | `POST /designer/product/update_basic_info` | patch fields on a product. --cover-image / --back-image take a document id and are what the assistant's set_product_i… | — |

makea_cli-0.2.5/makea_cli/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.2.5"

{makea_cli-0.2.2 → makea_cli-0.2.5}/makea_cli/api_client.py

@@ -12,6 +12,7 @@ import httpx
 from contextvars import ContextVar
 from dataclasses import dataclass
 
+from makea_cli import broker
 from makea_cli.auth_pkce import ensure_fresh_id_token
 from makea_cli.config import api_base_url
 from makea_cli.errors import ApiError, AuthError, UnknownOutcomeError
@@ -53,8 +54,20 @@ def _token() -> str:
         raise AuthError(str(e)) from e
 
 
+def _auth_headers() -> dict[str, str]:
+    """Who this request is from.
+
+    Under a token broker the token is a delegation the backend reads from the
+    impersonation header; there is no bearer at all, so a command that did not
+    come through the host's gate has nothing to send.
+    """
+    if broker.broker_path():
+        return {"x-impersonation-token": broker.brokered_token() or ""}
+    return {"Authorization": f"Bearer {_token()}"}
+
+
 def _headers() -> dict[str, str]:
-    headers = {"Authorization": f"Bearer {_token()}", "Accept": "application/json"}
+    headers = {**_auth_headers(), "Accept": "application/json"}
     if state.idempotency_key:
         headers["Idempotency-Key"] = state.idempotency_key
     return headers
@@ -254,7 +267,7 @@ def post_multipart_with_files(
 def _download(path: str, params: dict[str, Any], *, timeout: float) -> tuple[bytes, str | None]:
     """GET a file (or follow the redirect to its presigned URL); returns (bytes, filename)."""
     url = f"{api_base_url()}{path}"
-    headers = {"Authorization": f"Bearer {_token()}", "Accept": "*/*"}
+    headers = {**_auth_headers(), "Accept": "*/*"}
     try:
         with httpx.Client(timeout=timeout, follow_redirects=True) as client:
             r = client.get(url, headers=headers, params=params)
@@ -1185,6 +1198,42 @@ def designer_send_rfq(body: dict[str, Any]) -> Any:
     return post_json("/designer/product/send_rfq", body)
 
 
+def designer_confirm_tech_spec(product_id: str) -> Any:
+    """POST /designer/products/{id}/technical-specifications/confirm — confirm the tech pack."""
+    return post_json(f"/designer/products/{product_id}/technical-specifications/confirm", {})
+
+
+def designer_award_quotes(body: dict[str, Any]) -> Any:
+    """POST /designer/quotes/group_pay_prepare — DRAFT sampling orders for chosen quotes."""
+    return post_json("/designer/quotes/group_pay_prepare", body)
+
+
+def designer_create_checkout(body: dict[str, Any]) -> Any:
+    """POST /designer/payments/basket/create-session — a Stripe checkout for charges."""
+    return post_json("/designer/payments/basket/create-session", body)
+
+
+def designer_production_price(production_order_id: str, phase: str) -> Any:
+    """GET /designer/production_orders/{id}/calculate_price — deposit or balance, itemised."""
+    return get_json(
+        f"/designer/production_orders/{production_order_id}/calculate_price",
+        params={"payment_type": phase},
+    )
+
+
+def designer_set_production_cart(production_order_id: str, cart: dict[str, int]) -> Any:
+    """PUT /designer/production_orders/{id}/cart — replace the size x colour quantities."""
+    return put_json(f"/designer/production_orders/{production_order_id}/cart", {"cart_items": cart})
+
+
+def designer_set_production_lock(production_order_id: str, locked: bool) -> Any:
+    """POST /designer/production_orders/{id}/configuration-lock — place or reopen the run."""
+    return post_json(
+        f"/designer/production_orders/{production_order_id}/configuration-lock",
+        {"locked": locked},
+    )
+
+
 def designer_list_collections() -> Any:
     """GET /designer/collections — the brand's collections."""
     return get_json("/designer/collections")

makea_cli-0.2.5/makea_cli/broker.py

@@ -0,0 +1,83 @@
+"""Token broker client: how the CLI acts for someone without holding their token.
+
+A host that runs the CLI on a user's behalf (the Beeboo agent runner) does not
+put that user's token in the environment, where any process in the sandbox
+could read it. It runs a broker on a unix socket and names it in
+``MAKEA_TOKEN_BROKER``. Before a command runs, the host's gate has already
+looked at the exact command line and left a one-time ticket for it; the CLI
+sends its own argv and gets back a token that is good for this invocation.
+
+A process that did not come through the gate (``python -c``, ``curl``, a CLI
+call wrapped in a script) has no ticket and gets nothing. That is the whole
+point, so there is deliberately no fallback to a cached login in this mode.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import socket
+import sys
+
+from makea_cli.errors import AuthError
+
+BROKER_ENV = "MAKEA_TOKEN_BROKER"
+
+# A broker lives on the same box; anything slower than this is a broker that
+# is not there.
+_TIMEOUT_SECONDS = 10.0
+
+# One invocation spends one ticket. Every request the command makes reuses the
+# token the ticket bought.
+_cached: dict[str, str] | None = None
+
+
+def broker_path() -> str | None:
+    path = (os.environ.get(BROKER_ENV) or "").strip()
+    return path or None
+
+
+def invocation_argv() -> list[str]:
+    """This process's command line, as the gate saw it (without the program name)."""
+    return list(sys.argv[1:])
+
+
+def exchange(path: str, argv: list[str]) -> dict[str, str]:
+    """Trade this command line for ``{"token", "persona"}``, or raise AuthError."""
+    request = json.dumps({"argv": argv}).encode("utf-8") + b"\n"
+    try:
+        with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as sock:
+            sock.settimeout(_TIMEOUT_SECONDS)
+            sock.connect(path)
+            sock.sendall(request)
+            chunks = []
+            while True:
+                chunk = sock.recv(65536)
+                if not chunk:
+                    break
+                chunks.append(chunk)
+                if chunk.endswith(b"\n"):
+                    break
+    except OSError as e:
+        raise AuthError(f"token broker unavailable ({e.__class__.__name__})") from e
+    try:
+        reply = json.loads(b"".join(chunks).decode("utf-8") or "{}")
+    except (UnicodeDecodeError, json.JSONDecodeError) as e:
+        raise AuthError("token broker sent an unreadable reply") from e
+    if not reply.get("ok") or not reply.get("token"):
+        raise AuthError(
+            str(reply.get("error") or "the token broker refused this command"),
+            detail={"broker": True},
+        )
+    return {"token": str(reply["token"]), "persona": str(reply.get("persona") or "")}
+
+
+def brokered_token() -> str | None:
+    """The token for this invocation when a broker is configured, else None."""
+    global _cached
+    path = broker_path()
+    if not path:
+        return None
+    if _cached is None:
+        _cached = exchange(path, invocation_argv())
+    return _cached["token"]

{makea_cli-0.2.2 → makea_cli-0.2.5}/makea_cli/commands/brand/cmd.py

@@ -817,3 +817,196 @@ def register(app: typer.Typer) -> None:
         if makea_sourcing:
             body["makea_sourcing"] = True
         print_json_or_exit(console, lambda: api_client.designer_send_rfq(body))
+
+    # --- the sampling journey: confirm the pack, award a quote, pay -------------
+
+    @command(
+        app,
+        "designer",
+        "submit",
+        "tech-pack",
+        api="POST /designer/products/{product_id}/technical-specifications/confirm",
+        side_effects=[
+            "locks the tech pack as the version suppliers quote against",
+            "opens the product for sourcing",
+        ],
+        approval="ask",
+        help=(
+            "POST /designer/products/{id}/technical-specifications/confirm — confirm the "
+            "tech pack, the step before anyone is asked to quote."
+        ),
+    )
+    def submit_tech_pack(
+        product_id: str = typer.Argument(..., help="Product id."),
+    ) -> None:
+        """Confirm a product's tech pack."""
+        print_json_or_exit(console, lambda: api_client.designer_confirm_tech_spec(product_id))
+
+    @command(
+        app,
+        "designer",
+        "create",
+        "quote-award",
+        api="POST /designer/quotes/group_pay_prepare",
+        side_effects=[
+            "creates (or reuses) a DRAFT sampling order on each chosen quote",
+            "nothing is charged until that order is paid",
+        ],
+        approval="ask",
+        help=(
+            "POST /designer/quotes/group_pay_prepare — choose the supplier quote to sample "
+            "with. --quote is the supplier link id from `designer list supplier-link`; "
+            "repeat --option for the quote's optional extras. Prints the sampling_order_ids "
+            "to pay with `designer create checkout --key sampling:<id>`."
+        ),
+    )
+    def create_quote_award(
+        product_id: str = typer.Argument(..., help="Product id."),
+        quote: str = typer.Option(..., "--quote", help="Supplier link id of the chosen quote."),
+        option: list[str] = typer.Option(
+            [], "--option", help="Optional extra on the quote to include (repeat)."
+        ),
+        no_base_sampling: bool = typer.Option(
+            False, "--no-base-sampling", help="Leave the quote's base sample out."
+        ),
+        notes: str | None = typer.Option(None, "--notes", help="Note for the supplier."),
+    ) -> None:
+        """Award a quote: the sampling order that pays for it."""
+        selection: dict[str, Any] = {"product_id": product_id, "link_id": quote}
+        if option:
+            selection["selected_option_ids"] = list(option)
+        if no_base_sampling:
+            selection["include_base_sampling"] = False
+        if notes:
+            selection["notes"] = notes
+        print_json_or_exit(
+            console, lambda: api_client.designer_award_quotes({"selections": [selection]})
+        )
+
+    @command(
+        app,
+        "designer",
+        "create",
+        "checkout",
+        api="POST /designer/payments/basket/create-session",
+        side_effects=[
+            "records the brand's acceptance of the sampling/production terms",
+            "creates a Stripe checkout session; nothing is charged until it is paid there",
+        ],
+        approval="ask",
+        help=(
+            "POST /designer/payments/basket/create-session — a Stripe checkout link for one "
+            "or more charges. --key repeats: sampling:<sampling_order_id>, "
+            "production:<production_order_id>:deposit|final, shipping:<id>, misc:<id> "
+            "(the `key` of each payable in `designer list payment`). Prints checkout_url."
+        ),
+    )
+    def create_checkout(
+        key: list[str] = typer.Option(..., "--key", help="Charge key to pay (repeat)."),
+        accept_terms: bool = typer.Option(
+            False,
+            "--accept-terms",
+            help="The brand accepts the sampling/production terms for these charges.",
+        ),
+    ) -> None:
+        """Create a Stripe checkout link for charges."""
+        body: dict[str, Any] = {"keys": list(key)}
+        if accept_terms:
+            body["terms_accepted"] = True
+        print_json_or_exit(console, lambda: api_client.designer_create_checkout(body))
+
+    # --- the production journey: quantities, place the order, pay the deposit ---
+
+    @command(
+        app,
+        "designer",
+        "get",
+        "production-price",
+        api="GET /designer/production_orders/{production_order_id}/calculate_price",
+        help=(
+            "GET /designer/production_orders/{id}/calculate_price — what the deposit (or the "
+            "balance, --phase final) comes to for the quantities on the run right now, line "
+            "by line."
+        ),
+    )
+    def get_production_price(
+        production_order_id: str = typer.Argument(..., help="Production order id."),
+        phase: str = typer.Option("deposit", "--phase", help="deposit or final."),
+    ) -> None:
+        """Price a production order's deposit or balance."""
+        if phase not in ("deposit", "final"):
+            raise typer.BadParameter("--phase is deposit or final")
+        print_json_or_exit(
+            console,
+            lambda: api_client.designer_production_price(production_order_id, phase),
+        )
+
+    @command(
+        app,
+        "designer",
+        "set",
+        "production-cart",
+        api="PUT /designer/production_orders/{production_order_id}/cart",
+        side_effects=["replaces the run's quantities; nothing is ordered until it is locked"],
+        approval="auto",
+        help=(
+            "PUT /designer/production_orders/{id}/cart — the quantity of every size and "
+            "colour on the run. Replaces the whole cart: pass every cell you want kept. "
+            "--qty repeats as 'SIZE,#RRGGBB=COUNT' (quote it: # starts a shell comment), "
+            "with the sizes and colour hex codes from "
+            "the order's available_sizes / available_colors (`designer list "
+            "production-order --product <id>`). Refused once the run is locked."
+        ),
+    )
+    def set_production_cart(
+        production_order_id: str = typer.Argument(..., help="Production order id."),
+        qty: list[str] = typer.Option(
+            ..., "--qty", help="SIZE,#RRGGBB=COUNT for one cell (repeat)."
+        ),
+    ) -> None:
+        """Set a production order's size x colour quantities."""
+        cart: dict[str, int] = {}
+        for cell in qty:
+            key, sep, count = cell.rpartition("=")
+            if not sep or "," not in key:
+                raise typer.BadParameter(f"--qty {cell!r}: expected SIZE,#RRGGBB=COUNT")
+            try:
+                n = int(count)
+            except ValueError as e:
+                raise typer.BadParameter(f"--qty {cell!r}: COUNT must be a whole number") from e
+            if n < 0:
+                raise typer.BadParameter(f"--qty {cell!r}: COUNT cannot be negative")
+            size, _, colour = key.partition(",")
+            cart[f"{size.strip()},{colour.strip()}"] = n
+        print_json_or_exit(
+            console,
+            lambda: api_client.designer_set_production_cart(production_order_id, cart),
+        )
+
+    @command(
+        app,
+        "designer",
+        "set",
+        "production-lock",
+        api="POST /designer/production_orders/{production_order_id}/configuration-lock",
+        side_effects=[
+            "places the order: the quantities are final and the deposit becomes payable",
+            "can be unlocked again until the deposit is paid",
+        ],
+        approval="ask",
+        help=(
+            "POST /designer/production_orders/{id}/configuration-lock — place the order "
+            "with the quantities on the run (--unlock to reopen them). Locking is what makes "
+            "the deposit payable: `designer create checkout --key "
+            "production:<id>:deposit --accept-terms`."
+        ),
+    )
+    def set_production_lock(
+        production_order_id: str = typer.Argument(..., help="Production order id."),
+        unlock: bool = typer.Option(False, "--unlock", help="Reopen the quantities instead."),
+    ) -> None:
+        """Lock (place) or unlock a production order's configuration."""
+        print_json_or_exit(
+            console,
+            lambda: api_client.designer_set_production_lock(production_order_id, not unlock),
+        )

{makea_cli-0.2.2 → makea_cli-0.2.5}/makea_cli/commands/supplier/cmd.py

@@ -688,7 +688,8 @@ def register(app: typer.Typer) -> None:
         Read one quote request in full.
         """
         print_json_or_exit(
-            console, lambda: api_client.get_quote_request(quote_request_id=quote_request_id)
+            console,
+            lambda: api_client.get_quote_request(quote_request_id=quote_request_id),
         )
 
     @command(
@@ -988,9 +989,18 @@ def register(app: typer.Typer) -> None:
             help=(
                 "ip_schedule: who owns each asset the job creates (optional, JSON object). "
                 "Omit when the factory did not state it — makea must not invent an answer "
-                "on its behalf. If supplied it has to be COMPLETE (every one of the 12 "
-                "assets answered, plus production location and subcontractors on a "
-                "PRODUCTION link) or the API returns 400 listing what is missing."
+                "on its behalf. If supplied it has to be COMPLETE or the API returns 400 "
+                "listing what is missing. Schema v2: "
+                '{"schema_version":"2","background_ip_used":false,"assets":['
+                '{"asset_type":"production_files","applicable":true,'
+                '"transfer":"transfers_to_client","delivery":"on_full_payment"},'
+                '{"asset_type":"physical_tooling","applicable":false}]} '
+                "-- both asset types answered (applicable false, the default, is a valid "
+                "answer; production_files includes the tech pack and BOM), "
+                "background_ip_used true needs background_ip_declaration, and a "
+                "PRODUCTION link also needs production_location and subcontractors_declared. "
+                "To hide it from the customer afterwards, update the quote with "
+                "--ip-schedule-hidden."
             ),
         ),
         resample_request_id: str | None = typer.Option(
@@ -1250,6 +1260,14 @@ def register(app: typer.Typer) -> None:
                 "the factory could not have submitted itself."
             ),
         ),
+        ip_schedule_hidden: bool | None = typer.Option(
+            None,
+            "--ip-schedule-hidden/--ip-schedule-visible",
+            help=(
+                "ip_schedule_hidden_from_customer: hide this quote's IP Schedule from "
+                "the customer, or show it again. Visible unless set."
+            ),
+        ),
         available_sizes_json: str | None = typer.Option(
             None,
             "--available-sizes-json",
@@ -1350,6 +1368,8 @@ def register(app: typer.Typer) -> None:
             )
         if ip_schedule_json is not None:
             override["ip_schedule"] = _parse_json_option(ip_schedule_json, "--ip-schedule-json")
+        if ip_schedule_hidden is not None:
+            override["ip_schedule_hidden_from_customer"] = ip_schedule_hidden
         if refundable_terms_json is not None:
             override["refundable_terms"] = _parse_json_option(
                 refundable_terms_json, "--refundable-terms-json"

{makea_cli-0.2.2 → makea_cli-0.2.5}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "makea-cli"
-version = "0.2.2"
+version = "0.2.5"
 description = "Makea admin CLI (browser login + Makea admin HTTP API)"
 readme = "README.md"
 requires-python = ">=3.10"

{makea_cli-0.2.2 → makea_cli-0.2.5}/tests/golden_manifest.json

@@ -2890,7 +2890,7 @@
           "required": false,
           "multiple": false,
           "default": null,
-          "help": "ip_schedule: who owns each asset the job creates (optional, JSON object). Omit when the factory did not state it — makea must not invent an answer on its behalf. If supplied it has to be COMPLETE (every one of the 12 assets answered, plus production location and subcontractors on a PRODUCTION link) or the API returns 400 listing what is missing."
+          "help": "ip_schedule: who owns each asset the job creates (optional, JSON object). Omit when the factory did not state it — makea must not invent an answer on its behalf. If supplied it has to be COMPLETE or the API returns 400 listing what is missing. Schema v2: {\"schema_version\":\"2\",\"background_ip_used\":false,\"assets\":[{\"asset_type\":\"production_files\",\"applicable\":true,\"transfer\":\"transfers_to_client\",\"delivery\":\"on_full_payment\"},{\"asset_type\":\"physical_tooling\",\"applicable\":false}]} -- both asset types answered (applicable false, the default, is a valid answer; production_files includes the tech pack and BOM), background_ip_used true needs background_ip_declaration, and a PRODUCTION link also needs production_location and subcontractors_declared. To hide it from the customer afterwards, update the quote with --ip-schedule-hidden."
         },
         {
           "name": "resample_request_id",
@@ -3287,6 +3287,18 @@
           "default": null,
           "help": "ip_schedule: who owns each asset the job creates (JSON object; pass `null` to clear). A supplied schedule must be COMPLETE — the API refuses a half-answered one, so a quote can never carry a schedule the factory could not have submitted itself."
         },
+        {
+          "name": "ip_schedule_hidden",
+          "kind": "option",
+          "opts": [
+            "--ip-schedule-hidden"
+          ],
+          "type": "flag",
+          "required": false,
+          "multiple": false,
+          "default": null,
+          "help": "ip_schedule_hidden_from_customer: hide this quote's IP Schedule from the customer, or show it again. Visible unless set."
+        },
         {
           "name": "available_sizes_json",
           "kind": "option",
@@ -4471,6 +4483,52 @@
         }
       ]
     },
+    {
+      "name": "designer create checkout",
+      "persona": "designer",
+      "verb": "create",
+      "noun": "checkout",
+      "access": "write",
+      "api": "POST /designer/payments/basket/create-session",
+      "external": null,
+      "side_effects": [
+        "records the brand's acceptance of the sampling/production terms",
+        "creates a Stripe checkout session; nothing is charged until it is paid there"
+      ],
+      "approval": "ask",
+      "reversible": null,
+      "idempotent": null,
+      "limit": null,
+      "legacy": [],
+      "help": "POST /designer/payments/basket/create-session — a Stripe checkout link for one or more charges. --key repeats: sampling:<sampling_order_id>, production:<production_order_id>:deposit|final, shipping:<id>, misc:<id> (the `key` of each payable in `designer list payment`). Prints checkout_url.",
+      "function": "makea_cli.commands.brand.cmd.register.<locals>.create_checkout",
+      "flags": [
+        {
+          "name": "key",
+          "kind": "option",
+          "opts": [
+            "--key"
+          ],
+          "type": "text",
+          "required": true,
+          "multiple": true,
+          "default": null,
+          "help": "Charge key to pay (repeat)."
+        },
+        {
+          "name": "accept_terms",
+          "kind": "option",
+          "opts": [
+            "--accept-terms"
+          ],
+          "type": "flag",
+          "required": false,
+          "multiple": false,
+          "default": false,
+          "help": "The brand accepts the sampling/production terms for these charges."
+        }
+      ]
+    },
     {
       "name": "designer create collection",
       "persona": "designer",
@@ -4711,6 +4769,88 @@
         }
       ]
     },
+    {
+      "name": "designer create quote-award",
+      "persona": "designer",
+      "verb": "create",
+      "noun": "quote-award",
+      "access": "write",
+      "api": "POST /designer/quotes/group_pay_prepare",
+      "external": null,
+      "side_effects": [
+        "creates (or reuses) a DRAFT sampling order on each chosen quote",
+        "nothing is charged until that order is paid"
+      ],
+      "approval": "ask",
+      "reversible": null,
+      "idempotent": null,
+      "limit": null,
+      "legacy": [],
+      "help": "POST /designer/quotes/group_pay_prepare — choose the supplier quote to sample with. --quote is the supplier link id from `designer list supplier-link`; repeat --option for the quote's optional extras. Prints the sampling_order_ids to pay with `designer create checkout --key sampling:<id>`.",
+      "function": "makea_cli.commands.brand.cmd.register.<locals>.create_quote_award",
+      "flags": [
+        {
+          "name": "product_id",
+          "kind": "argument",
+          "opts": [
+            "product_id"
+          ],
+          "type": "text",
+          "required": true,
+          "multiple": false,
+          "default": null,
+          "help": "Product id."
+        },
+        {
+          "name": "quote",
+          "kind": "option",
+          "opts": [
+            "--quote"
+          ],
+          "type": "text",
+          "required": true,
+          "multiple": false,
+          "default": null,
+          "help": "Supplier link id of the chosen quote."
+        },
+        {
+          "name": "option",
+          "kind": "option",
+          "opts": [
+            "--option"
+          ],
+          "type": "text",
+          "required": false,
+          "multiple": true,
+          "default": [],
+          "help": "Optional extra on the quote to include (repeat)."
+        },
+        {
+          "name": "no_base_sampling",
+          "kind": "option",
+          "opts": [
+            "--no-base-sampling"
+          ],
+          "type": "flag",
+          "required": false,
+          "multiple": false,
+          "default": false,
+          "help": "Leave the quote's base sample out."
+        },
+        {
+          "name": "notes",
+          "kind": "option",
+          "opts": [
+            "--notes"
+          ],
+          "type": "text",
+          "required": false,
+          "multiple": false,
+          "default": null,
+          "help": "Note for the supplier."
+        }
+      ]
+    },
     {
       "name": "designer create rfq",
       "persona": "designer",
@@ -5061,6 +5201,49 @@
         }
       ]
     },
+    {
+      "name": "designer get production-price",
+      "persona": "designer",
+      "verb": "get",
+      "noun": "production-price",
+      "access": "read",
+      "api": "GET /designer/production_orders/{production_order_id}/calculate_price",
+      "external": null,
+      "side_effects": [],
+      "approval": "auto",
+      "reversible": null,
+      "idempotent": null,
+      "limit": null,
+      "legacy": [],
+      "help": "GET /designer/production_orders/{id}/calculate_price — what the deposit (or the balance, --phase final) comes to for the quantities on the run right now, line by line.",
+      "function": "makea_cli.commands.brand.cmd.register.<locals>.get_production_price",
+      "flags": [
+        {
+          "name": "production_order_id",
+          "kind": "argument",
+          "opts": [
+            "production_order_id"
+          ],
+          "type": "text",
+          "required": true,
+          "multiple": false,
+          "default": null,
+          "help": "Production order id."
+        },
+        {
+          "name": "phase",
+          "kind": "option",
+          "opts": [
+            "--phase"
+          ],
+          "type": "text",
+          "required": false,
+          "multiple": false,
+          "default": "deposit",
+          "help": "deposit or final."
+        }
+      ]
+    },
     {
       "name": "designer get quote-advice",
       "persona": "designer",
@@ -5599,6 +5782,97 @@
         }
       ]
     },
+    {
+      "name": "designer set production-cart",
+      "persona": "designer",
+      "verb": "set",
+      "noun": "production-cart",
+      "access": "write",
+      "api": "PUT /designer/production_orders/{production_order_id}/cart",
+      "external": null,
+      "side_effects": [
+        "replaces the run's quantities; nothing is ordered until it is locked"
+      ],
+      "approval": "auto",
+      "reversible": null,
+      "idempotent": null,
+      "limit": null,
+      "legacy": [],
+      "help": "PUT /designer/production_orders/{id}/cart — the quantity of every size and colour on the run. Replaces the whole cart: pass every cell you want kept. --qty repeats as 'SIZE,#RRGGBB=COUNT' (quote it: # starts a shell comment), with the sizes and colour hex codes from the order's available_sizes / available_colors (`designer list production-order --product <id>`). Refused once the run is locked.",
+      "function": "makea_cli.commands.brand.cmd.register.<locals>.set_production_cart",
+      "flags": [
+        {
+          "name": "production_order_id",
+          "kind": "argument",
+          "opts": [
+            "production_order_id"
+          ],
+          "type": "text",
+          "required": true,
+          "multiple": false,
+          "default": null,
+          "help": "Production order id."
+        },
+        {
+          "name": "qty",
+          "kind": "option",
+          "opts": [
+            "--qty"
+          ],
+          "type": "text",
+          "required": true,
+          "multiple": true,
+          "default": null,
+          "help": "SIZE,#RRGGBB=COUNT for one cell (repeat)."
+        }
+      ]
+    },
+    {
+      "name": "designer set production-lock",
+      "persona": "designer",
+      "verb": "set",
+      "noun": "production-lock",
+      "access": "write",
+      "api": "POST /designer/production_orders/{production_order_id}/configuration-lock",
+      "external": null,
+      "side_effects": [
+        "places the order: the quantities are final and the deposit becomes payable",
+        "can be unlocked again until the deposit is paid"
+      ],
+      "approval": "ask",
+      "reversible": null,
+      "idempotent": null,
+      "limit": null,
+      "legacy": [],
+      "help": "POST /designer/production_orders/{id}/configuration-lock — place the order with the quantities on the run (--unlock to reopen them). Locking is what makes the deposit payable: `designer create checkout --key production:<id>:deposit --accept-terms`.",
+      "function": "makea_cli.commands.brand.cmd.register.<locals>.set_production_lock",
+      "flags": [
+        {
+          "name": "production_order_id",
+          "kind": "argument",
+          "opts": [
+            "production_order_id"
+          ],
+          "type": "text",
+          "required": true,
+          "multiple": false,
+          "default": null,
+          "help": "Production order id."
+        },
+        {
+          "name": "unlock",
+          "kind": "option",
+          "opts": [
+            "--unlock"
+          ],
+          "type": "flag",
+          "required": false,
+          "multiple": false,
+          "default": false,
+          "help": "Reopen the quantities instead."
+        }
+      ]
+    },
     {
       "name": "designer submit production-order",
       "persona": "designer",
@@ -5667,6 +5941,40 @@
         }
       ]
     },
+    {
+      "name": "designer submit tech-pack",
+      "persona": "designer",
+      "verb": "submit",
+      "noun": "tech-pack",
+      "access": "write",
+      "api": "POST /designer/products/{product_id}/technical-specifications/confirm",
+      "external": null,
+      "side_effects": [
+        "locks the tech pack as the version suppliers quote against",
+        "opens the product for sourcing"
+      ],
+      "approval": "ask",
+      "reversible": null,
+      "idempotent": null,
+      "limit": null,
+      "legacy": [],
+      "help": "POST /designer/products/{id}/technical-specifications/confirm — confirm the tech pack, the step before anyone is asked to quote.",
+      "function": "makea_cli.commands.brand.cmd.register.<locals>.submit_tech_pack",
+      "flags": [
+        {
+          "name": "product_id",
+          "kind": "argument",
+          "opts": [
+            "product_id"
+          ],
+          "type": "text",
+          "required": true,
+          "multiple": false,
+          "default": null,
+          "help": "Product id."
+        }
+      ]
+    },
     {
       "name": "designer update action",
       "persona": "designer",

makea_cli-0.2.5/tests/test_broker.py

@@ -0,0 +1,106 @@
+"""Token broker mode: the CLI trades its own argv for a token, and has no fallback."""
+
+from __future__ import annotations
+
+import json
+import os
+import socket
+import tempfile
+import threading
+import unittest
+from unittest import mock
+
+from makea_cli import api_client, broker
+from makea_cli.errors import AuthError
+
+
+class _FakeBroker:
+    """A unix-socket broker that answers one canned reply per connection."""
+
+    def __init__(self, reply: dict):
+        self.reply = reply
+        self.seen: list[dict] = []
+        self._dir = tempfile.mkdtemp()
+        self.path = os.path.join(self._dir, "b.sock")
+        self._sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+        self._sock.bind(self.path)
+        self._sock.listen(4)
+        self._thread = threading.Thread(target=self._serve, daemon=True)
+        self._thread.start()
+
+    def _serve(self):
+        while True:
+            try:
+                conn, _ = self._sock.accept()
+            except OSError:
+                return
+            with conn:
+                data = b""
+                while not data.endswith(b"\n"):
+                    chunk = conn.recv(4096)
+                    if not chunk:
+                        break
+                    data += chunk
+                self.seen.append(json.loads(data.decode() or "{}"))
+                conn.sendall(json.dumps(self.reply).encode() + b"\n")
+
+    def close(self):
+        self._sock.close()
+
+
+class BrokerTests(unittest.TestCase):
+    def setUp(self):
+        broker._cached = None
+
+    def tearDown(self):
+        broker._cached = None
+
+    def test_argv_is_exchanged_for_a_token(self):
+        fake = _FakeBroker({"ok": True, "token": "delegation_abc", "persona": "designer"})
+        try:
+            with mock.patch.dict(os.environ, {broker.BROKER_ENV: fake.path}):
+                with mock.patch("sys.argv", ["makea-cli", "designer", "list", "product"]):
+                    headers = api_client._headers()
+        finally:
+            fake.close()
+        self.assertEqual(headers["x-impersonation-token"], "delegation_abc")
+        self.assertNotIn("Authorization", headers)
+        self.assertEqual(fake.seen, [{"argv": ["designer", "list", "product"]}])
+
+    def test_one_invocation_spends_one_ticket(self):
+        fake = _FakeBroker({"ok": True, "token": "delegation_abc"})
+        try:
+            with mock.patch.dict(os.environ, {broker.BROKER_ENV: fake.path}):
+                api_client._headers()
+                api_client._headers()
+        finally:
+            fake.close()
+        self.assertEqual(len(fake.seen), 1)
+
+    def test_a_refusal_is_an_auth_error_not_a_login_fallback(self):
+        fake = _FakeBroker({"ok": False, "error": "no ticket for this command"})
+        try:
+            with mock.patch.dict(os.environ, {broker.BROKER_ENV: fake.path}):
+                with mock.patch.object(api_client, "ensure_fresh_id_token") as login:
+                    with self.assertRaises(AuthError) as ctx:
+                        api_client._headers()
+                    login.assert_not_called()
+        finally:
+            fake.close()
+        self.assertIn("no ticket", ctx.exception.message)
+
+    def test_a_missing_broker_is_an_auth_error(self):
+        with mock.patch.dict(os.environ, {broker.BROKER_ENV: "/nonexistent/b.sock"}):
+            with self.assertRaises(AuthError):
+                api_client._headers()
+
+    def test_without_a_broker_the_login_is_used(self):
+        env = {k: v for k, v in os.environ.items() if k != broker.BROKER_ENV}
+        with mock.patch.dict(os.environ, env, clear=True):
+            with mock.patch.object(api_client, "ensure_fresh_id_token", return_value="jwt"):
+                headers = api_client._headers()
+        self.assertEqual(headers["Authorization"], "Bearer jwt")
+
+
+if __name__ == "__main__":
+    unittest.main()

{makea_cli-0.2.2 → makea_cli-0.2.5}/tests/test_persona_commands.py

@@ -395,7 +395,16 @@ class OrderLifecycleTests(_PersonaCase):
 
 
 class NoMoneyPathTests(unittest.TestCase):
-    """No CLI command may reach a payment or subscription endpoint."""
+    """No CLI command may move money; one may hand the brand a link to pay.
+
+    ``designer create checkout`` creates a Stripe checkout session and nothing
+    else: the charge happens on Stripe's page, entered by the brand. It is the
+    only write allowed near a payment endpoint, and it always asks first,
+    because it also records the brand's acceptance of the terms. Bank
+    transfers, subscriptions and every other payment write stay out.
+    """
+
+    CHECKOUT_LINK = "designer create checkout"
 
     def test_no_command_touches_money(self):
         from makea_cli import registry
@@ -406,6 +415,19 @@ class NoMoneyPathTests(unittest.TestCase):
         offenders = [
             (s.name, s.api)
             for s in registry.specs()
-            if not s.external and any(f in s.api for f in forbidden) and s.access == "write"
+            if not s.external
+            and any(f in s.api for f in forbidden)
+            and s.access == "write"
+            and s.name != self.CHECKOUT_LINK
         ]
         self.assertEqual(offenders, [], "a write command reaches money movement")
+
+    def test_the_checkout_link_asks_and_only_creates_a_session(self):
+        from makea_cli import registry
+        from makea_cli.main import build_cli
+
+        build_cli()
+        spec = registry.spec_for("designer", "create", "checkout")
+        self.assertIsNotNone(spec)
+        self.assertEqual(spec.approval, "ask")
+        self.assertEqual(spec.api, "POST /designer/payments/basket/create-session")

makea_cli-0.2.2/makea_cli/__init__.py

@@ -1 +0,0 @@
-__version__ = "0.2.2"