fix(framework-editor-cli): scope task/policy/doc-type links to a framework

[jprcompai]

What

The API now requires a frameworkId for task, policy, and document-type link endpoints on a control template (control-template.service.ts: ensureFramework). Without it the request is rejected with 400 "frameworkId is required for policy, task, and document links". The framework-editor CLI predates this change, so its link-task / link-policy / add-document-type commands no longer work.

Changes

• Add a required --framework-id option to link-task/unlink-task and link-policy/unlink-policy, forwarded as the frameworkId query param.
• Rewrite add-document-type/remove-document-type to use the scoped POST/DELETE :id/document-types/:formType?frameworkId= endpoints, replacing the obsolete GET + PATCH documentTypes flow (update also now requires frameworkId when documentTypes is provided).
• Drop the now-unused ControlTemplate type and outputResult imports.

Why now

Surfaced while building the NIST SP 800-53 Rev 5.2 Moderate baseline (287 requirements) via the CLI: phase-5 task→control linking failed against staging until the CLI was updated to pass frameworkId. Note that because links are now framework-scoped, callers must also avoid deduping links against the cross-framework control list/task list snapshots (which return links across all frameworks).

Testing

• Rebuilt the CLI (bun run build).
• Verified end-to-end against https://api.staging.trycomp.ai: created 287 requirements, 508 control→requirement links, 256 framework-scoped task→control links, and 22 framework-scoped doc-type tags on the Moderate framework with no errors.

🤖 Generated with Claude Code

---

Summary by cubic

Scopes task, policy, and document-type links in framework-editor-cli to a specific framework to match API changes, fixing 400 errors. Adds a required --framework-id flag to link/unlink commands and moves document-type operations to scoped endpoints.

• Migration
  • Pass --framework-id <id> to: link-task/unlink-task, link-policy/unlink-policy, and add-document-type/remove-document-type.
  • If you dedupe links locally, do it per framework (not across all frameworks).

^{Written for commit b3f5c4a. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 1 file

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}

[vercel]

@jprcompai is attempting to deploy a commit to the Comp AI Team on Vercel.

A member of the Team first needs to authorize it.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}