@burdenoff/cli-sdk 2026.504.1

package/dist/modules/products/index.js

@@ -0,0 +1,102 @@
+import {a,c,g,o,m,f,h as h$1}from'../../chunk-KTKHJORN.js';import {o as o$1}from'../../chunk-RNWXATAC.js';var b=`
+  query ListProducts($filter: PlatformProductFilterInput, $limit: Int, $offset: Int) {
+    platformProducts(filter: $filter, limit: $limit, offset: $offset) {
+      items { id name slug status logoUrl appUrl }
+      total
+    }
+  }
+`,h=`
+  query GetProduct($id: ID!) {
+    platformProduct(id: $id) {
+      id name slug description status metadata logoUrl appUrl
+    }
+  }
+`,T=`
+  mutation CreatePlatformProduct($input: CreatePlatformProductInput!) {
+    createPlatformProduct(input: $input) {
+      id name slug status
+    }
+  }
+`,C=`
+  mutation UpdatePlatformProduct($id: ID!, $input: UpdatePlatformProductInput!) {
+    updatePlatformProduct(id: $id, input: $input) {
+      id name status
+    }
+  }
+`,F=`
+  mutation DeletePlatformProduct($id: ID!) {
+    deletePlatformProduct(id: $id)
+  }
+`,U=`
+  query ListShortcuts($filter: KeyboardShortcutFilterInput, $limit: Int) {
+    keyboardShortcuts(filter: $filter, limit: $limit) {
+      items { id label shortcutKey category eventName isEnabled productId }
+    }
+  }
+`,w=`
+  mutation CreateKeyboardShortcut($input: CreateKeyboardShortcutInput!) {
+    createKeyboardShortcut(input: $input) {
+      id label shortcutKey isEnabled
+    }
+  }
+`,R=`
+  mutation UpdateKeyboardShortcut($id: ID!, $input: UpdateKeyboardShortcutInput!) {
+    updateKeyboardShortcut(id: $id, input: $input) {
+      id label shortcutKey isEnabled
+    }
+  }
+`,I=`
+  mutation DeleteKeyboardShortcut($id: ID!) {
+    deleteKeyboardShortcut(id: $id)
+  }
+`,S=`
+  query ListContentPages($productId: ID!, $filter: ContentPageFilterInput, $limit: Int) {
+    contentPages(productId: $productId, filter: $filter, limit: $limit) {
+      items { id slug title visibility isPublished }
+    }
+  }
+`,O=`
+  mutation CreateContentPage($input: CreateContentPageInput!) {
+    createContentPage(input: $input) {
+      id slug title visibility
+    }
+  }
+`,A=`
+  mutation UpdateContentPage($id: ID!, $input: UpdateContentPageInput!) {
+    updateContentPage(id: $id, input: $input) {
+      id slug title isPublished
+    }
+  }
+`,k=`
+  mutation DeleteContentPage($id: ID!) {
+    deleteContentPage(id: $id)
+  }
+`,$=`
+  query ListFeatureFlags($filter: FeatureFlagFilterInput, $limit: Int) {
+    featureFlags(filter: $filter, limit: $limit) {
+      items { id key name flagType status defaultValue category productId }
+    }
+  }
+`,D=`
+  mutation CreateFeatureFlag($input: CreateFeatureFlagInput!) {
+    createFeatureFlag(input: $input) {
+      id key name flagType status
+    }
+  }
+`,v=`
+  mutation UpdateFeatureFlag($id: ID!, $input: UpdateFeatureFlagInput!) {
+    updateFeatureFlag(id: $id, input: $input) {
+      id key status defaultValue
+    }
+  }
+`,_=`
+  mutation DeleteFeatureFlag($id: ID!) {
+    deleteFeatureFlag(id: $id)
+  }
+`,L=`
+  query EvaluateFeatureFlags($input: EvaluateFeatureFlagsInput!) {
+    evaluateFeatureFlags(input: $input) {
+      evaluations { key flagType value variant reason }
+    }
+  }
+`;function N(m$1){let d=m$1.command("products").description("Platform products, shortcuts, content-pages, feature-flags");d.command("list").description("List platform products").option("--search <q>").option("--status <s>").option("--limit <n>","Page size",t=>parseInt(t,10),50).option("-f, --format <format>").action(async t=>{try{let e={};t.search&&(e.search=t.search),t.status&&(e.status=t.status.toUpperCase());let i=await c(b,{filter:Object.keys(e).length?e:void 0,limit:t.limit,offset:0});g(t,i.platformProducts.items,{headers:["ID","Name","Slug","Status"],rows:i.platformProducts.items.map(a=>[o(a.id,12),a.name,a.slug??"-",m(a.status)])});}catch(e){f(e);}}),d.command("get").description("Get a product").argument("<id>").option("-f, --format <format>").action(async(t,e)=>{try{let i=await c(h,{id:t});if(!i.platformProduct)throw new o$1(`Product ${t} not found`);g(e,i.platformProduct);}catch(i){f(i);}}),d.command("create").description("Create a platform product").requiredOption("--name <s>").requiredOption("--slug <s>").option("--description <s>").option("--status <s>","DRAFT|ACTIVE|ARCHIVED","DRAFT").option("--app-url <url>").option("--logo-url <url>").option("-f, --format <format>").action(async t=>{try{let e={name:t.name,slug:t.slug,description:t.description,status:(t.status??"DRAFT").toUpperCase(),appUrl:t.appUrl,logoUrl:t.logoUrl},i=await c(T,{input:e});h$1(`Product created: ${i.createPlatformProduct.name}`),g(t,i.createPlatformProduct);}catch(e){f(e);}}),d.command("update").description("Update a product").argument("<id>").option("--name <s>").option("--description <s>").option("--status <s>").option("-f, --format <format>").action(async(t,e)=>{try{let i={};if(e.name&&(i.name=e.name),e.description!==void 0&&(i.description=e.description),e.status&&(i.status=e.status.toUpperCase()),!Object.keys(i).length)throw new o$1("No updates specified");let a=await c(C,{id:t,input:i});h$1("Product updated"),g(e,a.updatePlatformProduct);}catch(i){f(i);}}),d.command("delete").description("Delete a product").argument("<id>").action(async t=>{try{await c(F,{id:t}),h$1("Product deleted");}catch(e){f(e);}});let l=d.command("shortcuts").description("Keyboard shortcuts");l.command("list").description("List shortcuts").option("--product <id>").option("--category <c>").option("--limit <n>","Page size",t=>parseInt(t,10),100).option("-f, --format <format>").action(async t=>{try{let e={};t.product&&(e.productId=t.product),t.category&&(e.category=t.category);let i=await c(U,{filter:Object.keys(e).length?e:void 0,limit:t.limit});g(t,i.keyboardShortcuts.items,{headers:["ID","Label","Key","Category","Event","Enabled"],rows:i.keyboardShortcuts.items.map(a=>[o(a.id,12),a.label,a.shortcutKey,a.category??"-",a.eventName??"-",String(!!a.isEnabled)])});}catch(e){f(e);}}),l.command("create").description("Create a shortcut").requiredOption("--label <s>").requiredOption("--key <s>",'Shortcut key sequence (e.g. "g h")').requiredOption("--event <name>","Event emitted when shortcut fires").requiredOption("--product <id>","Owning product id").option("--category <c>","Navigation|Editing|...").option("--enabled").option("-f, --format <format>").action(async t=>{try{let e={label:t.label,shortcutKey:t.key,eventName:t.event,productId:t.product,category:t.category,isEnabled:t.enabled!==!1},i=await c(w,{input:e});h$1("Shortcut created"),g(t,i.createKeyboardShortcut);}catch(e){f(e);}}),l.command("update").description("Update a shortcut").argument("<id>").option("--label <s>").option("--key <s>").option("--enabled <bool>").option("-f, --format <format>").action(async(t,e)=>{try{let i={};if(e.label&&(i.label=e.label),e.key&&(i.shortcutKey=e.key),e.enabled!==void 0&&(i.isEnabled=e.enabled==="true"),!Object.keys(i).length)throw new o$1("No updates specified");let a=await c(R,{id:t,input:i});h$1("Shortcut updated"),g(e,a.updateKeyboardShortcut);}catch(i){f(i);}}),l.command("delete").description("Delete a shortcut").argument("<id>").action(async t=>{try{await c(I,{id:t}),h$1("Shortcut deleted");}catch(e){f(e);}});let g$1=d.command("content-pages").description("Content pages (legal, marketing)");g$1.command("list").description("List content pages for a product").requiredOption("--product <id>").option("--published").option("--visibility <v>","PUBLIC|PRIVATE").option("--limit <n>","Page size",t=>parseInt(t,10),100).option("-f, --format <format>").action(async t=>{try{let e={};t.published!==void 0&&(e.isPublished=t.published),t.visibility&&(e.visibility=t.visibility.toUpperCase());let i=await c(S,{productId:t.product,filter:Object.keys(e).length?e:void 0,limit:t.limit});g(t,i.contentPages.items,{headers:["ID","Slug","Title","Visibility","Published"],rows:i.contentPages.items.map(a=>[o(a.id,12),a.slug,o(a.title,40),a.visibility??"-",String(!!a.isPublished)])});}catch(e){f(e);}}),g$1.command("create").description("Create a content page").requiredOption("--product <id>").requiredOption("--slug <s>").requiredOption("--title <s>").requiredOption("--content <s>").option("--visibility <v>","PUBLIC|PRIVATE","PUBLIC").option("--published").option("-f, --format <format>").action(async t=>{try{let e={productId:t.product,slug:t.slug,title:t.title,content:t.content,visibility:(t.visibility??"PUBLIC").toUpperCase(),isPublished:!!t.published},i=await c(O,{input:e});h$1("Content page created"),g(t,i.createContentPage);}catch(e){f(e);}}),g$1.command("update").description("Update a content page").argument("<id>").option("--title <s>").option("--content <s>").option("--visibility <v>").option("--published <bool>").option("-f, --format <format>").action(async(t,e)=>{try{let i={};if(e.title&&(i.title=e.title),e.content!==void 0&&(i.content=e.content),e.visibility&&(i.visibility=e.visibility.toUpperCase()),e.published!==void 0&&(i.isPublished=e.published==="true"),!Object.keys(i).length)throw new o$1("No updates specified");let a=await c(A,{id:t,input:i});h$1("Content page updated"),g(e,a.updateContentPage);}catch(i){f(i);}}),g$1.command("delete").description("Delete a content page").argument("<id>").action(async t=>{try{await c(k,{id:t}),h$1("Content page deleted");}catch(e){f(e);}});let p=d.command("feature-flags").description("Feature flag administration (highest SRE/ops value)");p.command("list").description("List feature flags").option("--product <id>").option("--status <s>").option("--category <c>").option("--limit <n>","Page size",t=>parseInt(t,10),100).option("-f, --format <format>").action(async t=>{try{let e={};t.product&&(e.productId=t.product),t.status&&(e.status=t.status.toUpperCase()),t.category&&(e.category=t.category);let i=await c($,{filter:Object.keys(e).length?e:void 0,limit:t.limit});g(t,i.featureFlags.items,{headers:["ID","Key","Type","Status","Default"],rows:i.featureFlags.items.map(a=>[o(a.id,12),a.key,a.flagType??"-",m(a.status),String(a.defaultValue)])});}catch(e){f(e);}}),p.command("create").description("Create a feature flag").requiredOption("--key <s>","Stable key (e.g. enable-beta-ui)").requiredOption("--name <s>","Human label").requiredOption("--product <id>","Owning product id").option("--type <t>","BOOLEAN|STRING|NUMBER|JSON","BOOLEAN").option("--default <s>","Default value (parsed as JSON)").option("--description <s>").option("--category <c>").option("--previewable").option("--tags <s>","Comma-separated tags").option("-f, --format <format>").action(async t=>{try{let e={key:t.key,name:t.name,productId:t.product,flagType:(t.type??"BOOLEAN").toUpperCase(),defaultValue:t.default?JSON.parse(t.default):!1,description:t.description,category:t.category,previewable:!!t.previewable,tags:t.tags?t.tags.split(","):void 0},i=await c(D,{input:e});h$1(`Feature flag created: ${i.createFeatureFlag.key}`),g(t,i.createFeatureFlag);}catch(e){f(e);}}),p.command("update").description("Update a feature flag").argument("<id>").option("--name <s>").option("--default <s>","Default value (parsed as JSON)").option("--status <s>","ACTIVE|ARCHIVED").option("-f, --format <format>").action(async(t,e)=>{try{let i={};if(e.name&&(i.name=e.name),e.default!==void 0&&(i.defaultValue=JSON.parse(e.default)),e.status&&(i.status=e.status.toUpperCase()),!Object.keys(i).length)throw new o$1("No updates specified");let a=await c(v,{id:t,input:i});h$1("Feature flag updated"),g(e,a.updateFeatureFlag);}catch(i){f(i);}}),p.command("delete").description("Delete a feature flag").argument("<id>").action(async t=>{try{await c(_,{id:t}),h$1("Feature flag deleted");}catch(e){f(e);}}),p.command("evaluate").description("Evaluate flags in a workspace context").requiredOption("--workspace <id>").requiredOption("--keys <s>","Comma-separated flag keys").option("-f, --format <format>").action(async t=>{try{let e={workspaceId:t.workspace,keys:t.keys.split(",")},i=await c(L,{input:e});g(t,i.evaluateFeatureFlags.evaluations);}catch(e){f(e);}});}var q={id:"products",version:"1.0.0",displayName:"Platform Products",dependsOn:["auth"],register(m,d){a(d),N(m);}},J=q;export{J as default};

package/dist/modules/rbac/index.cjs

@@ -0,0 +1,63 @@
+'use strict';require('graphql-request'),require('cross-fetch'),require('commander');var u=class extends Error{exitCode;hint;constructor(r,i){super(r),this.name="CliUserError",this.exitCode=i?.exitCode??1,this.hint=i?.hint;}},m=class extends u{constructor(r,i){super(r,{exitCode:2,hint:i?.hint??"Run `<product> auth login` to authenticate."}),this.name="CliAuthError";}},d=class extends Error{cause;constructor(r,i){super(r),this.name="CliInternalError",this.cause=i;}};var h=null;function I(e){h=e;}function p(){if(!h)throw new d("vibecontrols module helpers used before setHelpersContext was called");return h}function K(){let e=p();if(!e.auth.isAuthenticated())throw new m(`Authentication required. Run \`${e.productName} auth login\`.`)}async function E(e,r){return K(),p().gql.workspace.request(e,r)}async function v(e,r){return p().gql.global.request(e,r)}function g(e){let r=e instanceof Error?e.message:String(e);throw new u(r)}function y(e,r,i){p().output.formatAndOutput(e,r,i);}function k(e){p().output.printSuccess(e);}function R(e){return p().output.formatStatus(e)}function C(e,r){return p().output.truncate(e,r)}function A(){return p()}var S=`
+  query ListRoles($filter: RoleFilterInput, $pagination: PaginationInput, $scopeId: String!) {
+    roles(filter: $filter, pagination: $pagination, scopeId: $scopeId) {
+      id
+      name
+      description
+      isSystem
+      scopeId
+      priority
+      defaultPermissions {
+        level
+        resourceType
+      }
+    }
+  }
+`,O=`
+  query GetRole($id: ID!) {
+    role(id: $id) {
+      id
+      name
+      description
+      isSystem
+      scopeId
+      priority
+      defaultPermissions {
+        level
+        resourceType
+      }
+    }
+  }
+`,L=`
+  mutation CreateRole($input: CreateRoleInput!) {
+    createRole(input: $input) {
+      id
+      name
+      description
+      scopeId
+    }
+  }
+`,$=`
+  mutation UpdateRole($id: ID!, $input: UpdateRoleInput!) {
+    updateRole(id: $id, input: $input) {
+      id
+      name
+      description
+      priority
+    }
+  }
+`,P=`
+  mutation DeleteRole($id: ID!, $reassignToRoleId: ID) {
+    deleteRole(id: $id, reassignToRoleId: $reassignToRoleId)
+  }
+`,D=`
+  query CheckPermission($input: PermissionCheckInput!) {
+    checkPermission(input: $input) {
+      allowed
+      decisionPath
+      roleName
+      roleLevel
+      overrideType
+    }
+  }
+`;function w(e,r,i){return e==="workspace"?E(r,i):v(r,i)}function x(e){let r=A().auth.read();if(e==="workspace"){if(!r?.workspaceId)throw new u("No workspace set. Run `vibecontrols workspace set <id>` or pass --scope <workspaceId>.");return r.workspaceId}if(!r?.organizationId)throw new u("No organization context. Run `auth login` to bind a tenant or pass --scope <tenantId>.");return r.organizationId}function q(e){let r=e.command("rbac").description("Role-based access control"),i=r.command("roles").description("Manage roles");i.command("list").description("List roles").option("--layer <layer>","workspace or global","workspace").option("--scope <scopeId>","Override scope id (workspace or tenant)").option("--include-system","Include system roles",false).option("--limit <n>","Page size",t=>parseInt(t,10),100).option("-f, --format <format>","Output format").action(async t=>{try{let n=t.layer==="global"?"global":"workspace",s=t.scope??x(n),o={};t.includeSystem&&(o.includeSystem=!0);let c=await w(n,S,{filter:Object.keys(o).length?o:void 0,pagination:{limit:t.limit,offset:0},scopeId:s});y(t,c.roles,{headers:["ID","Name","Scope","Priority","System"],rows:c.roles.map(l=>[C(l.id,12),l.name,C(l.scopeId,12),String(l.priority),String(l.isSystem)])});}catch(n){g(n);}}),i.command("get").description("Get role by id").argument("<id>").option("--layer <layer>","workspace or global","workspace").option("-f, --format <format>").action(async(t,n)=>{try{let s=n.layer==="global"?"global":"workspace",o=await w(s,O,{id:t});if(!o.role)throw new u(`Role ${t} not found`);y(n,o.role);}catch(s){g(s);}}),i.command("create").description("Create a role").requiredOption("--name <name>","Role name").option("--description <text>").option("--parent <id>","Parent role id").option("--priority <n>","Priority",t=>parseInt(t,10)).option("--layer <layer>","workspace or global","workspace").option("--scope <scopeId>","Override scope id").option("--scope-type <type>","wspace|entity (global only)").option("-f, --format <format>").action(async t=>{try{let n=t.layer==="global"?"global":"workspace",s=t.scope??x(n),o={name:t.name,description:t.description,parentId:t.parent,priority:t.priority,scopeId:s};n==="global"&&t.scopeType&&(o.scopeType=t.scopeType);let c=await w(n,L,{input:o});k(`Role created: ${c.createRole.name}`),y(t,c.createRole);}catch(n){g(n);}}),i.command("update").description("Update a role").argument("<id>").option("--name <name>").option("--description <text>").option("--priority <n>","",t=>parseInt(t,10)).option("--parent <id>").option("--layer <layer>","workspace or global","workspace").option("-f, --format <format>").action(async(t,n)=>{try{let s=n.layer==="global"?"global":"workspace",o={};if(n.name&&(o.name=n.name),n.description!==void 0&&(o.description=n.description),n.priority!==void 0&&(o.priority=n.priority),n.parent&&(o.parentId=n.parent),!Object.keys(o).length)throw new u("No updates specified");let c=await w(s,$,{id:t,input:o});k("Role updated"),y(n,c.updateRole);}catch(s){g(s);}}),i.command("delete").description("Delete a role").argument("<id>").option("--reassign <roleId>","Reassign actors to this role").option("--layer <layer>","workspace or global","workspace").action(async(t,n)=>{try{let s=n.layer==="global"?"global":"workspace";await w(s,P,{id:t,reassignToRoleId:n.reassign}),k("Role deleted");}catch(s){g(s);}}),r.command("check").description("Check whether an actor has permission for an action on a resource").argument("<actorId>","Actor id (user/app/service/super_admin)").argument("<action>","Action like read/write/delete").argument("<resourceType>","Resource type like project/task").option("--actor-type <type>","USER|BOT|GROUP|INTEGRATION|DELEGATED_AGENT","USER").option("--resource-id <id>","Specific resource id (optional)").option("--scope <scopeId>","Scope id (workspaceId or tenantId)").option("--layer <layer>","workspace or global","workspace").option("-f, --format <format>").action(async(t,n,s,o)=>{try{let c=o.layer==="global"?"global":"workspace",l=o.scope??x(c),_={actorId:t,actorType:(o.actorType??"USER").toUpperCase(),action:n,resourceType:s,resourceId:o.resourceId,scopeId:l},f=await w(c,D,{input:_});y(o,f.checkPermission,{headers:["Allowed","Decision","Role","Level","Override"],rows:[[R(f.checkPermission.allowed?"ACTIVE":"ERROR"),f.checkPermission.decisionPath,f.checkPermission.roleName??"-",f.checkPermission.roleLevel??"-",f.checkPermission.overrideType??"-"]]});}catch(c){g(c);}});}var Y={id:"rbac",version:"1.0.0",displayName:"RBAC",dependsOn:["auth"],register(e,r){I(r),q(e);}},st=Y;module.exports=st;

package/dist/modules/rbac/index.d.cts

@@ -0,0 +1,7 @@
+import { C as CliModule } from '../../module-Bv5zhYt2.cjs';
+import 'commander';
+import 'graphql-request';
+
+declare const rbacModule: CliModule;
+
+export { rbacModule as default };

package/dist/modules/rbac/index.d.ts

@@ -0,0 +1,7 @@
+import { C as CliModule } from '../../module-Bv5zhYt2.js';
+import 'commander';
+import 'graphql-request';
+
+declare const rbacModule: CliModule;
+
+export { rbacModule as default };

package/dist/modules/rbac/index.js

@@ -0,0 +1,63 @@
+import {a,g,o,f,h,m as m$1,r,b,c}from'../../chunk-KTKHJORN.js';import {o as o$1}from'../../chunk-RNWXATAC.js';var T=`
+  query ListRoles($filter: RoleFilterInput, $pagination: PaginationInput, $scopeId: String!) {
+    roles(filter: $filter, pagination: $pagination, scopeId: $scopeId) {
+      id
+      name
+      description
+      isSystem
+      scopeId
+      priority
+      defaultPermissions {
+        level
+        resourceType
+      }
+    }
+  }
+`,L=`
+  query GetRole($id: ID!) {
+    role(id: $id) {
+      id
+      name
+      description
+      isSystem
+      scopeId
+      priority
+      defaultPermissions {
+        level
+        resourceType
+      }
+    }
+  }
+`,C=`
+  mutation CreateRole($input: CreateRoleInput!) {
+    createRole(input: $input) {
+      id
+      name
+      description
+      scopeId
+    }
+  }
+`,S=`
+  mutation UpdateRole($id: ID!, $input: UpdateRoleInput!) {
+    updateRole(id: $id, input: $input) {
+      id
+      name
+      description
+      priority
+    }
+  }
+`,P=`
+  mutation DeleteRole($id: ID!, $reassignToRoleId: ID) {
+    deleteRole(id: $id, reassignToRoleId: $reassignToRoleId)
+  }
+`,O=`
+  query CheckPermission($input: PermissionCheckInput!) {
+    checkPermission(input: $input) {
+      allowed
+      decisionPath
+      roleName
+      roleLevel
+      overrideType
+    }
+  }
+`;function m(s,i,a){return s==="workspace"?b(i,a):c(i,a)}function R(s){let i=r().auth.read();if(s==="workspace"){if(!i?.workspaceId)throw new o$1("No workspace set. Run `vibecontrols workspace set <id>` or pass --scope <workspaceId>.");return i.workspaceId}if(!i?.organizationId)throw new o$1("No organization context. Run `auth login` to bind a tenant or pass --scope <tenantId>.");return i.organizationId}function $(s){let i=s.command("rbac").description("Role-based access control"),a=i.command("roles").description("Manage roles");a.command("list").description("List roles").option("--layer <layer>","workspace or global","workspace").option("--scope <scopeId>","Override scope id (workspace or tenant)").option("--include-system","Include system roles",false).option("--limit <n>","Page size",e=>parseInt(e,10),100).option("-f, --format <format>","Output format").action(async e=>{try{let o$1=e.layer==="global"?"global":"workspace",t=e.scope??R(o$1),r={};e.includeSystem&&(r.includeSystem=!0);let n=await m(o$1,T,{filter:Object.keys(r).length?r:void 0,pagination:{limit:e.limit,offset:0},scopeId:t});g(e,n.roles,{headers:["ID","Name","Scope","Priority","System"],rows:n.roles.map(c=>[o(c.id,12),c.name,o(c.scopeId,12),String(c.priority),String(c.isSystem)])});}catch(o){f(o);}}),a.command("get").description("Get role by id").argument("<id>").option("--layer <layer>","workspace or global","workspace").option("-f, --format <format>").action(async(e,o)=>{try{let t=o.layer==="global"?"global":"workspace",r=await m(t,L,{id:e});if(!r.role)throw new o$1(`Role ${e} not found`);g(o,r.role);}catch(t){f(t);}}),a.command("create").description("Create a role").requiredOption("--name <name>","Role name").option("--description <text>").option("--parent <id>","Parent role id").option("--priority <n>","Priority",e=>parseInt(e,10)).option("--layer <layer>","workspace or global","workspace").option("--scope <scopeId>","Override scope id").option("--scope-type <type>","wspace|entity (global only)").option("-f, --format <format>").action(async e=>{try{let o=e.layer==="global"?"global":"workspace",t=e.scope??R(o),r={name:e.name,description:e.description,parentId:e.parent,priority:e.priority,scopeId:t};o==="global"&&e.scopeType&&(r.scopeType=e.scopeType);let n=await m(o,C,{input:r});h(`Role created: ${n.createRole.name}`),g(e,n.createRole);}catch(o){f(o);}}),a.command("update").description("Update a role").argument("<id>").option("--name <name>").option("--description <text>").option("--priority <n>","",e=>parseInt(e,10)).option("--parent <id>").option("--layer <layer>","workspace or global","workspace").option("-f, --format <format>").action(async(e,o)=>{try{let t=o.layer==="global"?"global":"workspace",r={};if(o.name&&(r.name=o.name),o.description!==void 0&&(r.description=o.description),o.priority!==void 0&&(r.priority=o.priority),o.parent&&(r.parentId=o.parent),!Object.keys(r).length)throw new o$1("No updates specified");let n=await m(t,S,{id:e,input:r});h("Role updated"),g(o,n.updateRole);}catch(t){f(t);}}),a.command("delete").description("Delete a role").argument("<id>").option("--reassign <roleId>","Reassign actors to this role").option("--layer <layer>","workspace or global","workspace").action(async(e,o)=>{try{let t=o.layer==="global"?"global":"workspace";await m(t,P,{id:e,reassignToRoleId:o.reassign}),h("Role deleted");}catch(t){f(t);}}),i.command("check").description("Check whether an actor has permission for an action on a resource").argument("<actorId>","Actor id (user/app/service/super_admin)").argument("<action>","Action like read/write/delete").argument("<resourceType>","Resource type like project/task").option("--actor-type <type>","USER|BOT|GROUP|INTEGRATION|DELEGATED_AGENT","USER").option("--resource-id <id>","Specific resource id (optional)").option("--scope <scopeId>","Scope id (workspaceId or tenantId)").option("--layer <layer>","workspace or global","workspace").option("-f, --format <format>").action(async(e,o,t,r)=>{try{let n=r.layer==="global"?"global":"workspace",c=r.scope??R(n),x={actorId:e,actorType:(r.actorType??"USER").toUpperCase(),action:o,resourceType:t,resourceId:r.resourceId,scopeId:c},l=await m(n,O,{input:x});g(r,l.checkPermission,{headers:["Allowed","Decision","Role","Level","Override"],rows:[[m$1(l.checkPermission.allowed?"ACTIVE":"ERROR"),l.checkPermission.decisionPath,l.checkPermission.roleName??"-",l.checkPermission.roleLevel??"-",l.checkPermission.overrideType??"-"]]});}catch(n){f(n);}});}var A={id:"rbac",version:"1.0.0",displayName:"RBAC",dependsOn:["auth"],register(s,i){a(i),$(s);}},j=A;export{j as default};

package/dist/modules/sandbox/index.cjs

@@ -0,0 +1,33 @@
+'use strict';require('graphql-request'),require('cross-fetch'),require('commander');var s=class extends Error{exitCode;hint;constructor(n,e){super(n),this.name="CliUserError",this.exitCode=e?.exitCode??1,this.hint=e?.hint;}},f=class extends s{constructor(n,e){super(n,{exitCode:2,hint:e?.hint??"Run `<product> auth login` to authenticate."}),this.name="CliAuthError";}},I=class extends Error{cause;constructor(n,e){super(n),this.name="CliInternalError",this.cause=e;}};var P=null;function q(t){P=t;}function p(){if(!P)throw new I("vibecontrols module helpers used before setHelpersContext was called");return P}function mt(){let t=p();if(!t.auth.isAuthenticated())throw new f(`Authentication required. Run \`${t.productName} auth login\`.`)}async function m(t,n){return mt(),p().gql.workspace.request(t,n)}function $(t){let n=t instanceof Error?t.message:String(t);throw new s(n)}function C(t,n,e){p().output.formatAndOutput(t,n,e);}function k(t){p().output.printSuccess(t);}function F(t){return p().output.formatStatus(t)}function M(t){return p().output.formatDate(t)}function H(t,n){return p().output.truncate(t,n)}function W(t,n){return p().output.confirm(t,n)}function K(){return p()}var h=`
+  id name template mode status ttlSeconds
+  expiresAt stoppedAt
+  workspaceId createdAt updatedAt
+`,z=`
+  query ListSandboxes($context: ContextInput!, $filter: SandboxFilterInput, $pagination: SandboxPaginationInput) {
+    listSandboxes(context: $context, filter: $filter, pagination: $pagination) {
+      items { ${h} } total hasMore
+    }
+  }
+`,Q=`
+  query GetSandbox($context: ContextInput!, $id: ID!) {
+    getSandbox(context: $context, id: $id) { ${h} }
+  }
+`,Z=`
+  mutation CreateSandbox($input: CreateSandboxInput!) {
+    createSandbox(input: $input) { ${h} }
+  }
+`,tt=`
+  mutation StopSandbox($context: ContextInput!, $id: ID!) {
+    stopSandbox(context: $context, id: $id) { ${h} }
+  }
+`,et=`
+  mutation DeleteSandbox($context: ContextInput!, $id: ID!) {
+    deleteSandbox(context: $context, id: $id)
+  }
+`,nt=`
+  mutation ExtendSandboxTTL($context: ContextInput!, $id: ID!, $additionalSeconds: Int!) {
+    extendSandboxTTL(context: $context, id: $id, additionalSeconds: $additionalSeconds) {
+      ${h}
+    }
+  }
+`;function b(){let t=K().auth.read();if(!t?.workspaceId)throw new s("No workspace set. Run: vibecontrols workspace set <id>");return {workspaceId:t.workspaceId}}function ot(t){let n=t.command("sandbox").description("Manage sandboxes");n.command("list").description("List sandboxes").option("--status <status>","Filter by status").option("--template <template>","Filter by template").option("--limit <n>","Page size",e=>parseInt(e,10),50).option("-f, --format <format>","Output format").action(async e=>{try{let o={};e.status&&(o.status=e.status.toUpperCase()),e.template&&(o.template=e.template.toUpperCase());let N=(await m(z,{context:b(),filter:Object.keys(o).length?o:void 0,pagination:{limit:e.limit,offset:0}})).listSandboxes.items;C(e,N,{headers:["ID","Name","Template","Mode","Status","TTL","Created"],rows:N.map(l=>[H(l.id,12),l.name,l.template,l.mode,F(l.status),l.ttlSeconds?`${l.ttlSeconds}s`:"-",M(l.createdAt)])});}catch(o){$(o);}}),n.command("get").description("Get sandbox details").argument("<id>").option("-f, --format <format>","Output format").action(async(e,o)=>{try{let i=await m(Q,{context:b(),id:e});if(!i.getSandbox)throw new s("Sandbox not found");C(o,i.getSandbox);}catch(i){$(i);}}),n.command("create").description("Create sandbox").requiredOption("--name <name>","Sandbox name").option("--template <template>","Template type","VIBECONTROLS").option("--mode <mode>","Mode (DEPLOYMENT or JOB)","DEPLOYMENT").option("--ttl <seconds>","TTL in seconds",parseInt).option("-f, --format <format>","Output format").action(async e=>{try{let o=await m(Z,{input:{name:e.name,template:e.template.toUpperCase(),mode:e.mode.toUpperCase(),ttlSeconds:e.ttl,context:b()}});k("Sandbox created"),C(e,o.createSandbox);}catch(o){$(o);}}),n.command("stop").description("Stop sandbox").argument("<id>").action(async e=>{try{await m(tt,{context:b(),id:e}),k("Sandbox stopped");}catch(o){$(o);}}),n.command("delete").description("Delete sandbox").argument("<id>").option("--force","Skip confirmation").action(async(e,o)=>{try{if(!await W("Delete this sandbox?",o.force))return;await m(et,{context:b(),id:e}),k("Sandbox deleted");}catch(i){$(i);}}),n.command("extend").description("Extend sandbox TTL").argument("<id>").option("--seconds <n>","Extend by seconds",parseInt).option("--minutes <n>","Extend by minutes",parseInt).option("-f, --format <format>","Output format").action(async(e,o)=>{try{let i;if(o.seconds?i=o.seconds:o.minutes&&(i=o.minutes*60),!i)throw new s("Either --seconds or --minutes is required");let N=await m(nt,{context:b(),id:e,additionalSeconds:i});k(`Sandbox extended by ${i}s`),C(o,N.extendSandboxTTL);}catch(i){$(i);}});}var Et={id:"sandbox",version:"1.0.0",displayName:"Sandbox",dependsOn:["auth","workspaces"],register(t,n){q(n),ot(t);}},ei=Et;module.exports=ei;

package/dist/modules/sandbox/index.d.cts

@@ -0,0 +1,7 @@
+import { C as CliModule } from '../../module-Bv5zhYt2.cjs';
+import 'commander';
+import 'graphql-request';
+
+declare const sandboxModule: CliModule;
+
+export { sandboxModule as default };

package/dist/modules/sandbox/index.d.ts

@@ -0,0 +1,7 @@
+import { C as CliModule } from '../../module-Bv5zhYt2.js';
+import 'commander';
+import 'graphql-request';
+
+declare const sandboxModule: CliModule;
+
+export { sandboxModule as default };

package/dist/modules/sandbox/index.js

@@ -0,0 +1 @@
+import {Dc,Ec,Fc,Gc,Hc,Ic}from'../../chunk-MRONTCXQ.js';import {a,b,g,o,m,n,f,h as h$1,p,r}from'../../chunk-KTKHJORN.js';import {o as o$1}from'../../chunk-RNWXATAC.js';function d(){let i=r().auth.read();if(!i?.workspaceId)throw new o$1("No workspace set. Run: vibecontrols workspace set <id>");return {workspaceId:i.workspaceId}}function h(i){let o$2=i.command("sandbox").description("Manage sandboxes");o$2.command("list").description("List sandboxes").option("--status <status>","Filter by status").option("--template <template>","Filter by template").option("--limit <n>","Page size",t=>parseInt(t,10),50).option("-f, --format <format>","Output format").action(async t=>{try{let e={};t.status&&(e.status=t.status.toUpperCase()),t.template&&(e.template=t.template.toUpperCase());let p=(await b(Dc,{context:d(),filter:Object.keys(e).length?e:void 0,pagination:{limit:t.limit,offset:0}})).listSandboxes.items;g(t,p,{headers:["ID","Name","Template","Mode","Status","TTL","Created"],rows:p.map(a=>[o(a.id,12),a.name,a.template,a.mode,m(a.status),a.ttlSeconds?`${a.ttlSeconds}s`:"-",n(a.createdAt)])});}catch(e){f(e);}}),o$2.command("get").description("Get sandbox details").argument("<id>").option("-f, --format <format>","Output format").action(async(t,e)=>{try{let n=await b(Ec,{context:d(),id:t});if(!n.getSandbox)throw new o$1("Sandbox not found");g(e,n.getSandbox);}catch(n){f(n);}}),o$2.command("create").description("Create sandbox").requiredOption("--name <name>","Sandbox name").option("--template <template>","Template type","VIBECONTROLS").option("--mode <mode>","Mode (DEPLOYMENT or JOB)","DEPLOYMENT").option("--ttl <seconds>","TTL in seconds",parseInt).option("-f, --format <format>","Output format").action(async t=>{try{let e=await b(Fc,{input:{name:t.name,template:t.template.toUpperCase(),mode:t.mode.toUpperCase(),ttlSeconds:t.ttl,context:d()}});h$1("Sandbox created"),g(t,e.createSandbox);}catch(e){f(e);}}),o$2.command("stop").description("Stop sandbox").argument("<id>").action(async t=>{try{await b(Gc,{context:d(),id:t}),h$1("Sandbox stopped");}catch(e){f(e);}}),o$2.command("delete").description("Delete sandbox").argument("<id>").option("--force","Skip confirmation").action(async(t,e)=>{try{if(!await p("Delete this sandbox?",e.force))return;await b(Hc,{context:d(),id:t}),h$1("Sandbox deleted");}catch(n){f(n);}}),o$2.command("extend").description("Extend sandbox TTL").argument("<id>").option("--seconds <n>","Extend by seconds",parseInt).option("--minutes <n>","Extend by minutes",parseInt).option("-f, --format <format>","Output format").action(async(t,e)=>{try{let n;if(e.seconds?n=e.seconds:e.minutes&&(n=e.minutes*60),!n)throw new o$1("Either --seconds or --minutes is required");let p=await b(Ic,{context:d(),id:t,additionalSeconds:n});h$1(`Sandbox extended by ${n}s`),g(e,p.extendSandboxTTL);}catch(n){f(n);}});}var I={id:"sandbox",version:"1.0.0",displayName:"Sandbox",dependsOn:["auth","workspaces"],register(i,o){a(o),h(i);}},_=I;export{_ as default};

package/dist/modules/scheduler/index.cjs

@@ -0,0 +1,32 @@
+'use strict';require('graphql-request'),require('cross-fetch'),require('commander');var c=class extends Error{exitCode;hint;constructor(n,a){super(n),this.name="CliUserError",this.exitCode=a?.exitCode??1,this.hint=a?.hint;}},l=class extends c{constructor(n,a){super(n,{exitCode:2,hint:a?.hint??"Run `<product> auth login` to authenticate."}),this.name="CliAuthError";}},p=class extends Error{cause;constructor(n,a){super(n),this.name="CliInternalError",this.cause=a;}};var h=null;function E(e){h=e;}function u(){if(!h)throw new p("vibecontrols module helpers used before setHelpersContext was called");return h}function M(){let e=u();if(!e.auth.isAuthenticated())throw new l(`Authentication required. Run \`${e.productName} auth login\`.`)}async function d(e,n){return M(),u().gql.workspace.request(e,n)}function g(e){let n=e instanceof Error?e.message:String(e);throw new c(n)}function f(e,n,a){u().output.formatAndOutput(e,n,a);}function x(e){u().output.printSuccess(e);}function w(e){return u().output.formatStatus(e)}function m(e){return u().output.formatDate(e)}function C(e,n){return u().output.truncate(e,n)}function T(){return u()}var I=`
+  query ListScheduledJobs($workspaceId: ID!, $filter: JobFilterInput, $pagination: SchedulerPaginationInput) {
+    scheduledJobs(workspaceId: $workspaceId, filter: $filter, pagination: $pagination) {
+      jobs { id name status scheduleType nextExecutionAt createdAt }
+      total nextCursor
+    }
+  }
+`,v=`
+  query GetScheduledJob($id: ID!) {
+    scheduledJob(id: $id) {
+      id name status scheduleType cronExpression executorType
+      nextExecutionAt lastExecutionAt
+    }
+  }
+`,A=`
+  mutation CreateScheduledJob($workspaceId: ID!, $input: CreateScheduledJobInput!) {
+    createScheduledJob(workspaceId: $workspaceId, input: $input) {
+      id name status scheduleType
+    }
+  }
+`,S=`
+  mutation DeleteScheduledJob($id: ID!) {
+    deleteScheduledJob(id: $id)
+  }
+`,O=`
+  query JobExecutions($jobId: ID!, $pagination: SchedulerPaginationInput) {
+    jobExecutions(jobId: $jobId, pagination: $pagination) {
+      executions { id status startedAt completedAt duration errorMessage success }
+      total nextCursor
+    }
+  }
+`;function D(){let e=T().auth.read();if(!e?.workspaceId)throw new c("No workspace set. Run: vibecontrols workspace set <id>");return e.workspaceId}function R(e){let n=e.command("scheduler").description("Scheduled jobs & executions"),a=n.command("jobs").description("Manage scheduled jobs");a.command("list").description("List scheduled jobs").option("--status <s>").option("--type <t>","CRON|INTERVAL|ONCE").option("--limit <n>","Page size",t=>parseInt(t,10),50).option("-f, --format <format>").action(async t=>{try{let r={};t.status&&(r.status=t.status.toUpperCase()),t.type&&(r.scheduleType=t.type.toUpperCase());let o=await d(I,{workspaceId:D(),filter:Object.keys(r).length?r:void 0,pagination:{first:t.limit}});f(t,o.scheduledJobs.jobs,{headers:["ID","Name","Status","Type","NextRun","Created"],rows:o.scheduledJobs.jobs.map(i=>[C(i.id,12),i.name,w(i.status),i.scheduleType??"-",m(i.nextExecutionAt),m(i.createdAt)])});}catch(r){g(r);}}),a.command("get").description("Get a scheduled job").argument("<id>").option("-f, --format <format>").action(async(t,r)=>{try{let o=await d(v,{id:t});if(!o.scheduledJob)throw new c(`Job ${t} not found`);f(r,o.scheduledJob);}catch(o){g(o);}}),a.command("create").description("Create a scheduled job").requiredOption("--name <name>").requiredOption("--type <t>","CRON|FIXED_INTERVAL|ONE_TIME|RRULE|WINDOWED").option("--cron <expr>","Cron expression (for CRON)").option("--interval-seconds <n>","",t=>parseInt(t,10)).option("--executor <e>","WEBHOOK|GRAPHQL|INTERNAL_API|NATS_TOPIC","WEBHOOK").option("--executor-config <json>","Executor config JSON","{}").option("-f, --format <format>").action(async t=>{try{let r={INTERVAL:"FIXED_INTERVAL",ONCE:"ONE_TIME"},o=t.type.toUpperCase(),i={name:t.name,scheduleType:r[o]??o,cronExpression:t.cron,intervalSeconds:t.intervalSeconds,executorType:(t.executor??"WEBHOOK").toUpperCase(),executorConfig:JSON.parse(t.executorConfig??"{}")},k=await d(A,{workspaceId:D(),input:i});x(`Job created: ${k.createScheduledJob.name}`),f(t,k.createScheduledJob);}catch(r){g(r);}}),a.command("delete").description("Delete a scheduled job").argument("<id>").action(async t=>{try{await d(S,{id:t}),x("Job deleted");}catch(r){g(r);}}),n.command("executions").description("Job execution history").command("list").description("List executions for a job").argument("<jobId>").option("--limit <n>","Page size",t=>parseInt(t,10),100).option("-f, --format <format>").action(async(t,r)=>{try{let o=await d(O,{jobId:t,pagination:{first:r.limit}});f(r,o.jobExecutions.executions,{headers:["ID","Status","Started","Duration","Success"],rows:o.jobExecutions.executions.map(i=>[C(i.id,12),w(i.status),m(i.startedAt),String(i.duration??"-"),String(!!i.success)])});}catch(o){g(o);}});}var H={id:"scheduler",version:"1.0.0",displayName:"Scheduler",dependsOn:["auth","workspaces"],register(e,n){E(n),R(e);}},nt=H;module.exports=nt;

package/dist/modules/scheduler/index.d.cts

@@ -0,0 +1,7 @@
+import { C as CliModule } from '../../module-Bv5zhYt2.cjs';
+import 'commander';
+import 'graphql-request';
+
+declare const schedulerModule: CliModule;
+
+export { schedulerModule as default };

package/dist/modules/scheduler/index.d.ts

@@ -0,0 +1,7 @@
+import { C as CliModule } from '../../module-Bv5zhYt2.js';
+import 'commander';
+import 'graphql-request';
+
+declare const schedulerModule: CliModule;
+
+export { schedulerModule as default };

package/dist/modules/scheduler/index.js

@@ -0,0 +1,32 @@
+import {a,b,g,o,m,n,f,h,r}from'../../chunk-KTKHJORN.js';import {o as o$1}from'../../chunk-RNWXATAC.js';var C=`
+  query ListScheduledJobs($workspaceId: ID!, $filter: JobFilterInput, $pagination: SchedulerPaginationInput) {
+    scheduledJobs(workspaceId: $workspaceId, filter: $filter, pagination: $pagination) {
+      jobs { id name status scheduleType nextExecutionAt createdAt }
+      total nextCursor
+    }
+  }
+`,I=`
+  query GetScheduledJob($id: ID!) {
+    scheduledJob(id: $id) {
+      id name status scheduleType cronExpression executorType
+      nextExecutionAt lastExecutionAt
+    }
+  }
+`,S=`
+  mutation CreateScheduledJob($workspaceId: ID!, $input: CreateScheduledJobInput!) {
+    createScheduledJob(workspaceId: $workspaceId, input: $input) {
+      id name status scheduleType
+    }
+  }
+`,J=`
+  mutation DeleteScheduledJob($id: ID!) {
+    deleteScheduledJob(id: $id)
+  }
+`,y=`
+  query JobExecutions($jobId: ID!, $pagination: SchedulerPaginationInput) {
+    jobExecutions(jobId: $jobId, pagination: $pagination) {
+      executions { id status startedAt completedAt duration errorMessage success }
+      total nextCursor
+    }
+  }
+`;function w(){let s=r().auth.read();if(!s?.workspaceId)throw new o$1("No workspace set. Run: vibecontrols workspace set <id>");return s.workspaceId}function O(s){let c=s.command("scheduler").description("Scheduled jobs & executions"),d=c.command("jobs").description("Manage scheduled jobs");d.command("list").description("List scheduled jobs").option("--status <s>").option("--type <t>","CRON|INTERVAL|ONCE").option("--limit <n>","Page size",e=>parseInt(e,10),50).option("-f, --format <format>").action(async e=>{try{let t={};e.status&&(t.status=e.status.toUpperCase()),e.type&&(t.scheduleType=e.type.toUpperCase());let o$1=await b(C,{workspaceId:w(),filter:Object.keys(t).length?t:void 0,pagination:{first:e.limit}});g(e,o$1.scheduledJobs.jobs,{headers:["ID","Name","Status","Type","NextRun","Created"],rows:o$1.scheduledJobs.jobs.map(n$1=>[o(n$1.id,12),n$1.name,m(n$1.status),n$1.scheduleType??"-",n(n$1.nextExecutionAt),n(n$1.createdAt)])});}catch(t){f(t);}}),d.command("get").description("Get a scheduled job").argument("<id>").option("-f, --format <format>").action(async(e,t)=>{try{let o=await b(I,{id:e});if(!o.scheduledJob)throw new o$1(`Job ${e} not found`);g(t,o.scheduledJob);}catch(o){f(o);}}),d.command("create").description("Create a scheduled job").requiredOption("--name <name>").requiredOption("--type <t>","CRON|FIXED_INTERVAL|ONE_TIME|RRULE|WINDOWED").option("--cron <expr>","Cron expression (for CRON)").option("--interval-seconds <n>","",e=>parseInt(e,10)).option("--executor <e>","WEBHOOK|GRAPHQL|INTERNAL_API|NATS_TOPIC","WEBHOOK").option("--executor-config <json>","Executor config JSON","{}").option("-f, --format <format>").action(async e=>{try{let t={INTERVAL:"FIXED_INTERVAL",ONCE:"ONE_TIME"},o=e.type.toUpperCase(),n={name:e.name,scheduleType:t[o]??o,cronExpression:e.cron,intervalSeconds:e.intervalSeconds,executorType:(e.executor??"WEBHOOK").toUpperCase(),executorConfig:JSON.parse(e.executorConfig??"{}")},g$1=await b(S,{workspaceId:w(),input:n});h(`Job created: ${g$1.createScheduledJob.name}`),g(e,g$1.createScheduledJob);}catch(t){f(t);}}),d.command("delete").description("Delete a scheduled job").argument("<id>").action(async e=>{try{await b(J,{id:e}),h("Job deleted");}catch(t){f(t);}}),c.command("executions").description("Job execution history").command("list").description("List executions for a job").argument("<jobId>").option("--limit <n>","Page size",e=>parseInt(e,10),100).option("-f, --format <format>").action(async(e,t)=>{try{let o$1=await b(y,{jobId:e,pagination:{first:t.limit}});g(t,o$1.jobExecutions.executions,{headers:["ID","Status","Started","Duration","Success"],rows:o$1.jobExecutions.executions.map(n$1=>[o(n$1.id,12),m(n$1.status),n(n$1.startedAt),String(n$1.duration??"-"),String(!!n$1.success)])});}catch(o){f(o);}});}var T={id:"scheduler",version:"1.0.0",displayName:"Scheduler",dependsOn:["auth","workspaces"],register(s,c){a(c),O(s);}},k=T;export{k as default};

package/dist/modules/security/index.cjs

@@ -0,0 +1,69 @@
+'use strict';require('graphql-request'),require('cross-fetch'),require('commander');var c=class extends Error{exitCode;hint;constructor(o,a){super(o),this.name="CliUserError",this.exitCode=a?.exitCode??1,this.hint=a?.hint;}},h=class extends c{constructor(o,a){super(o,{exitCode:2,hint:a?.hint??"Run `<product> auth login` to authenticate."}),this.name="CliAuthError";}},f=class extends Error{cause;constructor(o,a){super(o),this.name="CliInternalError",this.cause=a;}};var C=null;function S(n){C=n;}function d(){if(!C)throw new f("vibecontrols module helpers used before setHelpersContext was called");return C}function Z(){let n=d();if(!n.auth.isAuthenticated())throw new h(`Authentication required. Run \`${n.productName} auth login\`.`)}async function u(n,o){return Z(),d().gql.workspace.request(n,o)}function p(n){let o=n instanceof Error?n.message:String(n);throw new c(o)}function l(n,o,a){d().output.formatAndOutput(n,o,a);}function g(n){d().output.printSuccess(n);}function k(n){return d().output.formatStatus(n)}function y(n){return d().output.formatDate(n)}function x(n,o){return d().output.truncate(n,o)}function v(){return d()}var b=`
+  query GetVaults($filter: VaultFilterInput, $pagination: SecurityPaginationInput) {
+    getVaults(filter: $filter, pagination: $pagination) {
+      items { id name description scope status createdAt }
+      total hasMore
+    }
+  }
+`,I=`
+  query GetVault($id: ID!) {
+    getVault(id: $id) {
+      id name description scope scopeId status lockAfterMinutes createdAt updatedAt
+    }
+  }
+`,A=`
+  mutation CreateVault($input: CreateVaultInput!) {
+    createVault(input: $input) {
+      id name scope scopeId status
+    }
+  }
+`,R=`
+  mutation DeleteVault($id: ID!) {
+    deleteVault(id: $id)
+  }
+`,$=`
+  mutation ArchiveVault($id: ID!) {
+    archiveVault(id: $id) { id status }
+  }
+`,O=`
+  query GetSecrets($vaultId: ID!, $filter: SecretFilterInput, $pagination: SecurityPaginationInput) {
+    getSecrets(vaultId: $vaultId, filter: $filter, pagination: $pagination) {
+      items { id key name description type status isEphemeral createdAt }
+      total hasMore
+    }
+  }
+`,D=`
+  query GetSecret($id: ID!) {
+    getSecret(id: $id) {
+      id key name description type status isEphemeral expiresAt createdAt updatedAt
+    }
+  }
+`,q=`
+  query DecryptSecret($id: ID!) {
+    decryptSecret(id: $id) {
+      id key value
+    }
+  }
+`,L=`
+  mutation CreateSecret($input: CreateSecretInput!) {
+    createSecret(input: $input) {
+      id key name type status
+    }
+  }
+`,P=`
+  mutation UpdateSecret($id: ID!, $input: UpdateSecretInput!) {
+    updateSecret(id: $id, input: $input) {
+      id key name status updatedAt
+    }
+  }
+`,V=`
+  mutation DeleteSecret($id: ID!) {
+    deleteSecret(id: $id)
+  }
+`,_=`
+  mutation RotateSecret($id: ID!, $newValue: String!) {
+    rotateSecret(id: $id, newValue: $newValue) {
+      id key updatedAt
+    }
+  }
+`;function w(){let n=v().auth.read();if(!n?.workspaceId)throw new c("No workspace set. Run: vibecontrols workspace set <id>");return {workspaceId:n.workspaceId}}async function N(){if(process.stdin.isTTY)throw new c('Pipe the secret value via stdin (e.g. `echo -n "value" | vibecontrols security secrets set ...`).');let n=[];for await(let o of process.stdin)n.push(Buffer.isBuffer(o)?o:Buffer.from(o));return Buffer.concat(n).toString("utf8")}function G(n){let o=n.command("security").description("Security: vaults & secrets"),a=o.command("vaults").description("Vault management");a.command("list").description("List vaults").option("--scope <s>","WORKSPACE|GLOBAL|VIBE").option("--status <s>").option("--search <q>").option("--limit <n>","Page size",e=>parseInt(e,10),50).option("-f, --format <format>").action(async e=>{try{let t={context:w()};e.scope&&(t.scope=e.scope.toUpperCase()),e.status&&(t.status=e.status.toUpperCase()),e.search&&(t.search=e.search);let r=await u(b,{filter:t,pagination:{limit:e.limit,offset:0}});l(e,r.getVaults.items,{headers:["ID","Name","Scope","Status","Created"],rows:r.getVaults.items.map(i=>[x(i.id,12),i.name,i.scope??"-",k(i.status),y(i.createdAt)])});}catch(t){p(t);}}),a.command("get").description("Get a vault").argument("<id>").option("-f, --format <format>").action(async(e,t)=>{try{let r=await u(I,{id:e});if(!r.getVault)throw new c(`Vault ${e} not found`);l(t,r.getVault);}catch(r){p(r);}}),a.command("create").description("Create a vault").requiredOption("--name <name>").option("--description <s>").option("--scope <s>","WORKSPACE|GLOBAL|VIBE","WORKSPACE").option("--scope-id <id>","Scope id (defaults to current workspace)").option("--lock-after <minutes>","Auto-lock after N minutes",e=>parseInt(e,10)).option("-f, --format <format>").action(async e=>{try{let t=w(),r={context:t,name:e.name,description:e.description,scope:(e.scope??"WORKSPACE").toUpperCase(),scopeId:e.scopeId??t.workspaceId,lockAfterMinutes:e.lockAfter},i=await u(A,{input:r});g(`Vault created: ${i.createVault.name}`),l(e,i.createVault);}catch(t){p(t);}}),a.command("delete").description("Delete a vault").argument("<id>").option("--archive","Archive instead of hard delete",false).action(async(e,t)=>{try{t.archive?(await u($,{id:e}),g("Vault archived")):(await u(R,{id:e}),g("Vault deleted"));}catch(r){p(r);}});let m=o.command("secrets").description("Secret management");m.command("list").description("List secrets in a vault").requiredOption("--vault <id>").option("--type <t>","Filter by secret type").option("--search <q>").option("--limit <n>","Page size",e=>parseInt(e,10),100).option("-f, --format <format>").action(async e=>{try{let t={context:w()};e.type&&(t.type=e.type.toUpperCase()),e.search&&(t.search=e.search);let r=await u(O,{vaultId:e.vault,filter:t,pagination:{limit:e.limit,offset:0}});l(e,r.getSecrets.items,{headers:["ID","Key","Name","Type","Status","Created"],rows:r.getSecrets.items.map(i=>[x(i.id,12),i.key,i.name,i.type??"-",k(i.status),y(i.createdAt)])});}catch(t){p(t);}}),m.command("get").description("Get secret metadata (does NOT decrypt)").argument("<id>").option("-f, --format <format>").action(async(e,t)=>{try{let r=await u(D,{id:e});if(!r.getSecret)throw new c(`Secret ${e} not found`);l(t,r.getSecret);}catch(r){p(r);}}),m.command("show").description("Decrypt and print a secret value (audited)").argument("<id>").action(async e=>{try{let t=await u(q,{id:e});process.stdout.write(t.decryptSecret.value);}catch(t){p(t);}}),m.command("set").description("Create a secret. Reads the value from stdin.").requiredOption("--vault <id>").requiredOption("--key <key>","Secret key (unique within vault)").requiredOption("--name <name>").option("--description <s>").option("--type <t>","API_KEY|PASSWORD|CERTIFICATE|TOKEN|OTHER","OTHER").option("--ephemeral","Mark as ephemeral").option("--expires <iso>").option("-f, --format <format>").action(async e=>{try{let t=await N(),r={context:w(),vaultId:e.vault,key:e.key,name:e.name,description:e.description,type:(e.type??"OTHER").toUpperCase(),isEphemeral:!!e.ephemeral,expiresAt:e.expires,value:t},i=await u(L,{input:r});g(`Secret created: ${i.createSecret.key}`),l(e,i.createSecret);}catch(t){p(t);}}),m.command("update").description("Update a secret. Pass --value via stdin to rotate.").argument("<id>").option("--name <s>").option("--description <s>").option("--rotate","Rotate value (reads new value from stdin)").option("--status <s>").option("-f, --format <format>").action(async(e,t)=>{try{if(t.rotate){let F=await N(),U=await u(_,{id:e,newValue:F});g("Secret rotated"),l(t,U.rotateSecret);return}let r={context:w()};if(t.name&&(r.name=t.name),t.description!==void 0&&(r.description=t.description),t.status&&(r.status=t.status.toUpperCase()),Object.keys(r).length===1)throw new c("No updates specified (use --rotate to change value)");let i=await u(P,{id:e,input:r});g("Secret updated"),l(t,i.updateSecret);}catch(r){p(r);}}),m.command("delete").description("Delete a secret").argument("<id>").action(async e=>{try{await u(V,{id:e}),g("Secret deleted");}catch(t){p(t);}});}var te={id:"security",version:"1.0.0",displayName:"Security",dependsOn:["auth","workspaces"],register(n,o){S(o),G(n);}},lt=te;module.exports=lt;

package/dist/modules/security/index.d.cts

@@ -0,0 +1,7 @@
+import { C as CliModule } from '../../module-Bv5zhYt2.cjs';
+import 'commander';
+import 'graphql-request';
+
+declare const securityModule: CliModule;
+
+export { securityModule as default };

package/dist/modules/security/index.d.ts

@@ -0,0 +1,7 @@
+import { C as CliModule } from '../../module-Bv5zhYt2.js';
+import 'commander';
+import 'graphql-request';
+
+declare const securityModule: CliModule;
+
+export { securityModule as default };

package/dist/modules/security/index.js

@@ -0,0 +1,69 @@
+import {a,b as b$1,g,o,m as m$1,n,f,h,r}from'../../chunk-KTKHJORN.js';import {o as o$1}from'../../chunk-RNWXATAC.js';var C=`
+  query GetVaults($filter: VaultFilterInput, $pagination: SecurityPaginationInput) {
+    getVaults(filter: $filter, pagination: $pagination) {
+      items { id name description scope status createdAt }
+      total hasMore
+    }
+  }
+`,T=`
+  query GetVault($id: ID!) {
+    getVault(id: $id) {
+      id name description scope scopeId status lockAfterMinutes createdAt updatedAt
+    }
+  }
+`,R=`
+  mutation CreateVault($input: CreateVaultInput!) {
+    createVault(input: $input) {
+      id name scope scopeId status
+    }
+  }
+`,A=`
+  mutation DeleteVault($id: ID!) {
+    deleteVault(id: $id)
+  }
+`,V=`
+  mutation ArchiveVault($id: ID!) {
+    archiveVault(id: $id) { id status }
+  }
+`,I=`
+  query GetSecrets($vaultId: ID!, $filter: SecretFilterInput, $pagination: SecurityPaginationInput) {
+    getSecrets(vaultId: $vaultId, filter: $filter, pagination: $pagination) {
+      items { id key name description type status isEphemeral createdAt }
+      total hasMore
+    }
+  }
+`,v=`
+  query GetSecret($id: ID!) {
+    getSecret(id: $id) {
+      id key name description type status isEphemeral expiresAt createdAt updatedAt
+    }
+  }
+`,k=`
+  query DecryptSecret($id: ID!) {
+    decryptSecret(id: $id) {
+      id key value
+    }
+  }
+`,$=`
+  mutation CreateSecret($input: CreateSecretInput!) {
+    createSecret(input: $input) {
+      id key name type status
+    }
+  }
+`,x=`
+  mutation UpdateSecret($id: ID!, $input: UpdateSecretInput!) {
+    updateSecret(id: $id, input: $input) {
+      id key name status updatedAt
+    }
+  }
+`,D=`
+  mutation DeleteSecret($id: ID!) {
+    deleteSecret(id: $id)
+  }
+`,_=`
+  mutation RotateSecret($id: ID!, $newValue: String!) {
+    rotateSecret(id: $id, newValue: $newValue) {
+      id key updatedAt
+    }
+  }
+`;function m(){let s=r().auth.read();if(!s?.workspaceId)throw new o$1("No workspace set. Run: vibecontrols workspace set <id>");return {workspaceId:s.workspaceId}}async function L(){if(process.stdin.isTTY)throw new o$1('Pipe the secret value via stdin (e.g. `echo -n "value" | vibecontrols security secrets set ...`).');let s=[];for await(let c of process.stdin)s.push(Buffer.isBuffer(c)?c:Buffer.from(c));return Buffer.concat(s).toString("utf8")}function O(s){let c=s.command("security").description("Security: vaults & secrets"),l=c.command("vaults").description("Vault management");l.command("list").description("List vaults").option("--scope <s>","WORKSPACE|GLOBAL|VIBE").option("--status <s>").option("--search <q>").option("--limit <n>","Page size",t=>parseInt(t,10),50).option("-f, --format <format>").action(async t=>{try{let e={context:m()};t.scope&&(e.scope=t.scope.toUpperCase()),t.status&&(e.status=t.status.toUpperCase()),t.search&&(e.search=t.search);let r=await b$1(C,{filter:e,pagination:{limit:t.limit,offset:0}});g(t,r.getVaults.items,{headers:["ID","Name","Scope","Status","Created"],rows:r.getVaults.items.map(a=>[o(a.id,12),a.name,a.scope??"-",m$1(a.status),n(a.createdAt)])});}catch(e){f(e);}}),l.command("get").description("Get a vault").argument("<id>").option("-f, --format <format>").action(async(t,e)=>{try{let r=await b$1(T,{id:t});if(!r.getVault)throw new o$1(`Vault ${t} not found`);g(e,r.getVault);}catch(r){f(r);}}),l.command("create").description("Create a vault").requiredOption("--name <name>").option("--description <s>").option("--scope <s>","WORKSPACE|GLOBAL|VIBE","WORKSPACE").option("--scope-id <id>","Scope id (defaults to current workspace)").option("--lock-after <minutes>","Auto-lock after N minutes",t=>parseInt(t,10)).option("-f, --format <format>").action(async t=>{try{let e=m(),r={context:e,name:t.name,description:t.description,scope:(t.scope??"WORKSPACE").toUpperCase(),scopeId:t.scopeId??e.workspaceId,lockAfterMinutes:t.lockAfter},a=await b$1(R,{input:r});h(`Vault created: ${a.createVault.name}`),g(t,a.createVault);}catch(e){f(e);}}),l.command("delete").description("Delete a vault").argument("<id>").option("--archive","Archive instead of hard delete",false).action(async(t,e)=>{try{e.archive?(await b$1(V,{id:t}),h("Vault archived")):(await b$1(A,{id:t}),h("Vault deleted"));}catch(r){f(r);}});let d=c.command("secrets").description("Secret management");d.command("list").description("List secrets in a vault").requiredOption("--vault <id>").option("--type <t>","Filter by secret type").option("--search <q>").option("--limit <n>","Page size",t=>parseInt(t,10),100).option("-f, --format <format>").action(async t=>{try{let e={context:m()};t.type&&(e.type=t.type.toUpperCase()),t.search&&(e.search=t.search);let r=await b$1(I,{vaultId:t.vault,filter:e,pagination:{limit:t.limit,offset:0}});g(t,r.getSecrets.items,{headers:["ID","Key","Name","Type","Status","Created"],rows:r.getSecrets.items.map(a=>[o(a.id,12),a.key,a.name,a.type??"-",m$1(a.status),n(a.createdAt)])});}catch(e){f(e);}}),d.command("get").description("Get secret metadata (does NOT decrypt)").argument("<id>").option("-f, --format <format>").action(async(t,e)=>{try{let r=await b$1(v,{id:t});if(!r.getSecret)throw new o$1(`Secret ${t} not found`);g(e,r.getSecret);}catch(r){f(r);}}),d.command("show").description("Decrypt and print a secret value (audited)").argument("<id>").action(async t=>{try{let e=await b$1(k,{id:t});process.stdout.write(e.decryptSecret.value);}catch(e){f(e);}}),d.command("set").description("Create a secret. Reads the value from stdin.").requiredOption("--vault <id>").requiredOption("--key <key>","Secret key (unique within vault)").requiredOption("--name <name>").option("--description <s>").option("--type <t>","API_KEY|PASSWORD|CERTIFICATE|TOKEN|OTHER","OTHER").option("--ephemeral","Mark as ephemeral").option("--expires <iso>").option("-f, --format <format>").action(async t=>{try{let e=await L(),r={context:m(),vaultId:t.vault,key:t.key,name:t.name,description:t.description,type:(t.type??"OTHER").toUpperCase(),isEphemeral:!!t.ephemeral,expiresAt:t.expires,value:e},a=await b$1($,{input:r});h(`Secret created: ${a.createSecret.key}`),g(t,a.createSecret);}catch(e){f(e);}}),d.command("update").description("Update a secret. Pass --value via stdin to rotate.").argument("<id>").option("--name <s>").option("--description <s>").option("--rotate","Rotate value (reads new value from stdin)").option("--status <s>").option("-f, --format <format>").action(async(t,e)=>{try{if(e.rotate){let U=await L(),P=await b$1(_,{id:t,newValue:U});h("Secret rotated"),g(e,P.rotateSecret);return}let r={context:m()};if(e.name&&(r.name=e.name),e.description!==void 0&&(r.description=e.description),e.status&&(r.status=e.status.toUpperCase()),Object.keys(r).length===1)throw new o$1("No updates specified (use --rotate to change value)");let a=await b$1(x,{id:t,input:r});h("Secret updated"),g(e,a.updateSecret);}catch(r){f(r);}}),d.command("delete").description("Delete a secret").argument("<id>").action(async t=>{try{await b$1(D,{id:t}),h("Secret deleted");}catch(e){f(e);}});}var b={id:"security",version:"1.0.0",displayName:"Security",dependsOn:["auth","workspaces"],register(s,c){a(c),O(s);}},W=b;export{W as default};