feat: organization policy rule methods (/v1/org/policy)#52
Merged
Conversation
Adds the /v1/org/policy surface to the org client (10 methods):
listPolicyRules, getPolicyRule, createPolicyRule, updatePolicyRule,
deletePolicyRule, reorderPolicyRules, getPolicyDefault, setPolicyDefault,
publishPolicy, and getPolicyLastPublish.
Writes publish automatically; pass { skipPublish: true } to stage and
review first (a publish snapshots the whole org draft, including changes
staged by other users). If the publish step fails after a successful
write, the write stays staged and the publish request's error is
rethrown unchanged.
Types are honest about both directions: PolicyRuleTarget models
responses (arrays always present, unset scalars explicit null) while
PolicyRuleTargetInput models writes (optionals only; the API rejects
nulls on write); org rule inputs exclude agent identities at the type
level (the org API rejects them); PolicyWriteResult discriminates on
`published`. The legacy createRule/updateRule/deleteRule methods are
marked @deprecated (cloud deployments reject them with 410 Gone).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds the organization policy-engine surface to
onecli.org— 10 methods over/v1/org/policy:listPolicyRules,getPolicyRule,createPolicyRule,updatePolicyRule,deletePolicyRule,reorderPolicyRules,getPolicyDefault,setPolicyDefault,publishPolicy,getPolicyLastPublish.{ skipPublish: true }stages for an explicit reviewedpublishPolicy()(a publish snapshots the whole org draft, including other users' staged changes). A publish failure after a successful write rethrows the publish error unchanged — the write stays staged.PolicyRuleTargetmodels responses (arrays always present, unset scalars explicitnull);PolicyRuleTargetInputmodels writes (optionals only — the API rejectsnulls on write);OrgPolicyRuleIdentityInputexcludesagent(the org API rejects agent identities);PolicyWriteResult<T>discriminates onpublished;conditionsis a typed union (behavioral conditions or resource scoping).createRule/updateRule/deleteRuleare@deprecated— cloud deployments reject them with410 Gone; self-hosted servers that have not cut over still accept them. A route-miss 404 on policy endpoints maps to a clear "requires OneCLI Cloud or Enterprise" hint.Why
OneCLI Cloud runs the policy engine; org-wide guardrails are authored through
/v1/org/policy. The SDK needs typed, publish-aware methods for it — and the request/response type split has to land before npm freezes the contract (responses carrynulls that write inputs reject; one shared type would make a read→write round-trip compile and then fail at runtime).Verification
tscclean, vitest 101/101, tsup build green.skipPublishsingle-call behavior, publish-failure rethrow after a successful write, the?status=query,orderedIdsbody,last-publishnull, and the route-miss hint.Review
Reviewed via the ship pipeline: hunk-by-hunk self-review, two independent adversarial reviewers, then a cross-repo fix-attacker pass verifying the fixes and the cross-repo contract against the server source. Skills applied:
typescript-advanced-types(the input/output type split, discriminated result: 4 fixes),typescript-pro(API honesty, JSDoc: 2 fixes). Findings fixed: 1 high (shared target type conflated read/write shapes), 3 medium, 4 low. Final gates green.Related PRs
Merge order: this PR and the CLI PR are independent and can merge anytime (the API is live on OneCLI Cloud and current Enterprise releases); the docs PR merges last.
🤖 Generated with Claude Code