@burdenoff/cli-sdk 2026.522.1 → 2026.525.2

package/dist/modules/integrations/index.cjs

@@ -1,44 +1,128 @@
-'use strict';require('graphql-request'),require('cross-fetch'),require('commander');var c=class extends Error{exitCode;hint;constructor(o,a){super(o),this.name="CliUserError",this.exitCode=a?.exitCode??1,this.hint=a?.hint;}},f=class extends c{constructor(o,a){super(o,{exitCode:2,hint:a?.hint??"Run `<product> auth login` to authenticate."}),this.name="CliAuthError";}},l=class extends Error{cause;constructor(o,a){super(o),this.name="CliInternalError",this.cause=a;}};var h=null;function y(n){h=n;}function d(){if(!h)throw new l("vibecontrols module helpers used before setHelpersContext was called");return h}function V(){let n=d();if(!n.auth.isAuthenticated())throw new f(`Authentication required. Run \`${n.productName} auth login\`.`)}async function u(n,o){return V(),d().gql.workspace.request(n,o)}function p(n){let o=n instanceof Error?n.message:String(n);throw new c(o)}function g(n,o,a){d().output.formatAndOutput(n,o,a);}function w(n){d().output.printSuccess(n);}function v(n){return d().output.formatStatus(n)}function I(n){return d().output.formatDate(n)}function C(n,o){return d().output.truncate(n,o)}var T=`
+'use strict';require('graphql-request'),require('cross-fetch'),require('commander');var g=class extends Error{exitCode;hint;constructor(a,u){super(a),this.name="CliUserError",this.exitCode=u?.exitCode??1,this.hint=u?.hint;}},C=class extends g{constructor(a,u){super(a,{exitCode:2,hint:u?.hint??"Run `<product> auth login` to authenticate."}),this.name="CliAuthError";}},f=class extends Error{cause;constructor(a,u){super(a),this.name="CliInternalError",this.cause=u;}};var w=null;function E(o){w=o;}function m(){if(!w)throw new f("vibecontrols module helpers used before setHelpersContext was called");return w}function dt(){let o=m();if(!o.auth.isAuthenticated())throw new C(`Authentication required. Run \`${o.productName} auth login\`.`)}async function r(o,a){return dt(),m().gql.workspace.request(o,a)}function i(o){let a=o instanceof Error?o.message:String(o);throw new g(a)}function s(o,a,u){m().output.formatAndOutput(o,a,u);}function d(o){m().output.printSuccess(o);}function x(o){return m().output.formatStatus(o)}function v(o){return m().output.formatDate(o)}function y(o,a){return m().output.truncate(o,a)}var A=`
   query GetProviders($filter: ProviderFilterInput, $pagination: IntegrationsPaginationInput) {
     getProviders(filter: $filter, pagination: $pagination) {
       items { id key name category authType isEnabled }
       total hasMore
     }
   }
-`,b=`
+`,O=`
   query GetProvider($id: ID!) {
     getProvider(id: $id) {
       id key name authType category connectionCount
     }
   }
-`,E=`
+`,b=`
   query GetConnections($filter: ConnectionFilterInput, $pagination: IntegrationsPaginationInput) {
     getConnections(filter: $filter, pagination: $pagination) {
       items { id name providerId status grantedScopes }
       total hasMore
     }
   }
-`,A=`
+`,N=`
   query GetConnection($id: ID!) {
     getConnection(id: $id) {
       id name providerId status externalAccountEmail credentialSource
     }
   }
-`,S=`
+`,R=`
   mutation CreateConnection($input: CreateConnectionInput!) {
     createConnection(input: $input) {
       id name status providerId
     }
   }
-`,O=`
+`,$=`
   mutation DeleteConnection($id: ID!, $deleteVaultSecret: Boolean) {
     deleteConnection(id: $id, deleteVaultSecret: $deleteVaultSecret)
   }
-`,R=`
+`,S=`
   query GetIntegrationLogs($filter: LogFilterInput, $pagination: IntegrationsPaginationInput) {
     getIntegrationLogs(filter: $filter, pagination: $pagination) {
       items { id action level message createdAt }
       total hasMore
     }
   }
-`;function $(n){let o=n.command("integrations").description("Integration providers, connections, and logs"),a=o.command("providers").description("Available providers");a.command("list").description("List integration providers").option("--category <c>").option("--enabled").option("--limit <n>","Page size",e=>parseInt(e,10),100).option("-f, --format <format>").action(async e=>{try{let t={};e.category&&(t.category=e.category.toUpperCase()),e.enabled!==void 0&&(t.isEnabled=e.enabled);let r=await u(T,{filter:Object.keys(t).length?t:void 0,pagination:{limit:e.limit,offset:0}});g(e,r.getProviders.items,{headers:["ID","Key","Name","Category","Auth","Enabled"],rows:r.getProviders.items.map(i=>[C(i.id,12),i.key,i.name,i.category??"-",i.authType??"-",String(!!i.isEnabled)])});}catch(t){p(t);}}),a.command("get").description("Get a provider").argument("<id>").option("-f, --format <format>").action(async(e,t)=>{try{let r=await u(b,{id:e});if(!r.getProvider)throw new c(`Provider ${e} not found`);g(t,r.getProvider);}catch(r){p(r);}});let m=o.command("connections").description("Provider connections (OAuth + credential)");m.command("list").description("List connections").option("--provider <id>").option("--status <s>").option("--limit <n>","Page size",e=>parseInt(e,10),100).option("-f, --format <format>").action(async e=>{try{let t={};e.provider&&(t.providerId=e.provider),e.status&&(t.status=e.status.toUpperCase());let r=await u(E,{filter:Object.keys(t).length?t:void 0,pagination:{limit:e.limit,offset:0}});g(e,r.getConnections.items,{headers:["ID","Name","Provider","Status"],rows:r.getConnections.items.map(i=>[C(i.id,12),i.name,C(i.providerId,12),v(i.status)])});}catch(t){p(t);}}),m.command("get").description("Get a connection").argument("<id>").option("-f, --format <format>").action(async(e,t)=>{try{let r=await u(A,{id:e});if(!r.getConnection)throw new c(`Connection ${e} not found`);g(t,r.getConnection);}catch(r){p(r);}}),m.command("add").description("Create a connection (provider id required; credentials stored in vault)").requiredOption("--name <name>").requiredOption("--provider <id>").option("--scopes <s>","Comma-separated scopes").option("-f, --format <format>").action(async e=>{try{let t={name:e.name,providerId:e.provider,grantedScopes:e.scopes?e.scopes.split(","):void 0},r=await u(S,{input:t});w("Connection created"),g(e,r.createConnection);}catch(t){p(t);}}),m.command("delete").description("Delete a connection").argument("<id>").option("--keep-secret","Keep vault secret",false).action(async(e,t)=>{try{await u(O,{id:e,deleteVaultSecret:!t.keepSecret}),w("Connection deleted");}catch(r){p(r);}}),o.command("logs").description("Integration audit logs").option("--connection <id>").option("--level <l>","INFO|WARN|ERROR").option("--limit <n>","Page size",e=>parseInt(e,10),100).option("-f, --format <format>").action(async e=>{try{let t={};e.connection&&(t.connectionId=e.connection),e.level&&(t.level=e.level.toUpperCase());let r=await u(R,{filter:Object.keys(t).length?t:void 0,pagination:{limit:e.limit,offset:0}});g(e,r.getIntegrationLogs.items,{headers:["When","Action","Level","Message"],rows:r.getIntegrationLogs.items.map(i=>[I(i.createdAt),i.action,i.level,i.message])});}catch(t){p(t);}});}var z={id:"integrations",version:"1.0.0",displayName:"Integrations",dependsOn:["auth","workspaces"],register(n,o){y(o),$(n);}},tt=z;module.exports=tt;
+`,P=`
+  mutation UpdateConnection($id: ID!, $input: UpdateConnectionInput!) {
+    updateConnection(id: $id, input: $input) { id name status }
+  }
+`,_=`
+  mutation RevokeConnection($connectionId: ID!) {
+    revokeConnection(connectionId: $connectionId) { id name status }
+  }
+`,D=`
+  mutation TestConnection($connectionId: ID!) {
+    testConnection(connectionId: $connectionId) { success message latencyMs }
+  }
+`,q=`
+  mutation LinkIntegrationToChannel($channelId: String!, $connectionId: ID!, $organizationId: String!) {
+    linkIntegrationToChannel(channelId: $channelId, connectionId: $connectionId, organizationId: $organizationId) {
+      id name status channelId organizationId
+    }
+  }
+`,L=`
+  mutation RefreshConnectionToken($connectionId: ID!) {
+    refreshConnectionToken(connectionId: $connectionId) { id status }
+  }
+`,G=`
+  mutation AuthenticateWithApiKey($input: ApiKeyAuthInput!) {
+    authenticateWithApiKey(input: $input) { id name status }
+  }
+`,U=`
+  mutation AuthenticateWithBasicAuth($input: BasicAuthInput!) {
+    authenticateWithBasicAuth(input: $input) { id name status }
+  }
+`,W=`
+  mutation AuthenticateWithBearerToken($input: BearerTokenAuthInput!) {
+    authenticateWithBearerToken(input: $input) { id name status }
+  }
+`,B=`
+  mutation InitiateOAuth($input: InitiateOAuthInput!) {
+    initiateOAuth(input: $input) { redirectUrl state }
+  }
+`,F=`
+  mutation CompleteOAuth($input: CompleteOAuthInput!) {
+    completeOAuth(input: $input) { id name status }
+  }
+`,j=`
+  query GetProviderByKey($key: String!) {
+    getProviderByKey(key: $key) { id key name authType category connectionCount isEnabled }
+  }
+`,M=`
+  query GetProviderCatalog($pagination: IntegrationsPaginationInput) {
+    getProviderCatalog(pagination: $pagination) {
+      items { id key name category authType isEnabled }
+      total hasMore
+    }
+  }
+`,V=`
+  query GetConnectionsByProvider($providerId: ID!, $pagination: IntegrationsPaginationInput) {
+    getConnectionsByProvider(providerId: $providerId, pagination: $pagination) {
+      items { id name providerId status grantedScopes }
+      total hasMore
+    }
+  }
+`,K=`
+  mutation EnableProvider($id: ID!) {
+    enableProvider(id: $id) { id key name isEnabled }
+  }
+`,z=`
+  mutation DisableProvider($id: ID!) {
+    disableProvider(id: $id) { id key name isEnabled }
+  }
+`,H=`
+  mutation TagConnection($input: TagConnectionInput!) {
+    tagConnection(input: $input) { id entityId tagId source }
+  }
+`,Y=`
+  mutation UntagConnection($input: UntagConnectionInput!) {
+    untagConnection(input: $input)
+  }
+`,J=`
+  mutation ReplaceConnectionTags($input: ReplaceConnectionTagsInput!) {
+    replaceConnectionTags(input: $input) { id entityId tagId source }
+  }
+`,Q=`
+  query GetConnectionTags($input: GetConnectionTagsInput!) {
+    getConnectionTags(input: $input) { id entityId tagId source assignedAt }
+  }
+`;function X(o){let a=o.command("integrations").description("Integration providers, connections, and logs"),u=a.command("providers").description("Available providers");u.command("list").description("List integration providers").option("--category <c>").option("--enabled").option("--limit <n>","Page size",t=>parseInt(t,10),100).option("-f, --format <format>").action(async t=>{try{let e={};t.category&&(e.category=t.category.toUpperCase()),t.enabled!==void 0&&(e.isEnabled=t.enabled);let n=await r(A,{filter:Object.keys(e).length?e:void 0,pagination:{limit:t.limit,offset:0}});s(t,n.getProviders.items,{headers:["ID","Key","Name","Category","Auth","Enabled"],rows:n.getProviders.items.map(c=>[y(c.id,12),c.key,c.name,c.category??"-",c.authType??"-",String(!!c.isEnabled)])});}catch(e){i(e);}}),u.command("get").description("Get a provider").argument("<id>").option("-f, --format <format>").action(async(t,e)=>{try{let n=await r(O,{id:t});if(!n.getProvider)throw new g(`Provider ${t} not found`);s(e,n.getProvider);}catch(n){i(n);}});let l=a.command("connections").description("Provider connections (OAuth + credential)");l.command("list").description("List connections").option("--provider <id>").option("--status <s>").option("--limit <n>","Page size",t=>parseInt(t,10),100).option("-f, --format <format>").action(async t=>{try{let e={};t.provider&&(e.providerId=t.provider),t.status&&(e.status=t.status.toUpperCase());let n=await r(b,{filter:Object.keys(e).length?e:void 0,pagination:{limit:t.limit,offset:0}});s(t,n.getConnections.items,{headers:["ID","Name","Provider","Status"],rows:n.getConnections.items.map(c=>[y(c.id,12),c.name,y(c.providerId,12),x(c.status)])});}catch(e){i(e);}}),l.command("get").description("Get a connection").argument("<id>").option("-f, --format <format>").action(async(t,e)=>{try{let n=await r(N,{id:t});if(!n.getConnection)throw new g(`Connection ${t} not found`);s(e,n.getConnection);}catch(n){i(n);}}),l.command("add").description("Create a connection (provider id required; credentials stored in vault)").requiredOption("--name <name>").requiredOption("--provider <id>").option("--scopes <s>","Comma-separated scopes").option("-f, --format <format>").action(async t=>{try{let e={name:t.name,providerId:t.provider,grantedScopes:t.scopes?t.scopes.split(","):void 0},n=await r(R,{input:e});d("Connection created"),s(t,n.createConnection);}catch(e){i(e);}}),l.command("delete").description("Delete a connection").argument("<id>").option("--keep-secret","Keep vault secret",false).action(async(t,e)=>{try{await r($,{id:t,deleteVaultSecret:!e.keepSecret}),d("Connection deleted");}catch(n){i(n);}}),l.command("update").description("Update a connection (name / description / config JSON)").argument("<id>").option("--name <name>").option("--description <desc>").option("--config <json>","Config JSON string").option("-f, --format <format>").action(async(t,e)=>{try{let n={};if(e.name!==void 0&&(n.name=e.name),e.description!==void 0&&(n.description=e.description),e.config!==void 0&&(n.config=JSON.parse(e.config)),Object.keys(n).length===0)throw new g("Provide at least one of --name, --description, --config");let c=await r(P,{id:t,input:n});d("Connection updated"),s(e,c.updateConnection);}catch(n){i(n);}}),l.command("revoke").description("Revoke a connection (soft delete; tokens invalidated)").argument("<connectionId>").option("-f, --format <format>").action(async(t,e)=>{try{let n=await r(_,{connectionId:t});d("Connection revoked"),s(e,n.revokeConnection);}catch(n){i(n);}}),l.command("test").description("Test a connection (health/auth probe)").argument("<connectionId>").option("-f, --format <format>").action(async(t,e)=>{try{let n=await r(D,{connectionId:t});s(e,n.testConnection);}catch(n){i(n);}}),l.command("link").description("Link a connection to a channel for DM/notification routing").requiredOption("--channel <channelId>").requiredOption("--connection <id>").requiredOption("--organization <id>").option("-f, --format <format>").action(async t=>{try{let e=await r(q,{channelId:t.channel,connectionId:t.connection,organizationId:t.organization});d("Linked"),s(t,e.linkIntegrationToChannel);}catch(e){i(e);}}),l.command("refresh-token").description("Force a connection token refresh (OAuth refresh_grant)").argument("<connectionId>").option("-f, --format <format>").action(async(t,e)=>{try{let n=await r(L,{connectionId:t});d("Token refreshed"),s(e,n.refreshConnectionToken);}catch(n){i(n);}});let h=a.command("auth").description("Per-connection auth flows");h.command("api-key").description("Authenticate a connection with an API key").requiredOption("--connection <id>").requiredOption("--api-key <key>").option("-f, --format <format>").action(async t=>{try{let e=await r(G,{input:{connectionId:t.connection,apiKey:t.apiKey}});d("Authenticated"),s(t,e.authenticateWithApiKey);}catch(e){i(e);}}),h.command("basic").description("Authenticate a connection with Basic Auth").requiredOption("--connection <id>").requiredOption("--username <u>").requiredOption("--password <p>").option("-f, --format <format>").action(async t=>{try{let e=await r(U,{input:{connectionId:t.connection,username:t.username,password:t.password}});d("Authenticated"),s(t,e.authenticateWithBasicAuth);}catch(e){i(e);}}),h.command("bearer").description("Authenticate a connection with a Bearer token").requiredOption("--connection <id>").requiredOption("--token <t>").option("-f, --format <format>").action(async t=>{try{let e=await r(W,{input:{connectionId:t.connection,token:t.token}});d("Authenticated"),s(t,e.authenticateWithBearerToken);}catch(e){i(e);}}),h.command("oauth-start").description("Initiate an OAuth flow; prints redirect URL + state").requiredOption("--connection <id>").requiredOption("--redirect-uri <uri>").option("--scopes <s>","Comma-separated scopes").option("-f, --format <format>").action(async t=>{try{let e={connectionId:t.connection,redirectUri:t.redirectUri};t.scopes&&(e.scopes=t.scopes.split(","));let n=await r(B,{input:e});s(t,n.initiateOAuth);}catch(e){i(e);}}),h.command("oauth-complete").description("Complete an OAuth flow with the authorization code + state").requiredOption("--connection <id>").requiredOption("--code <c>").requiredOption("--redirect-uri <uri>").requiredOption("--state <s>").option("-f, --format <format>").action(async t=>{try{let e=await r(F,{input:{connectionId:t.connection,code:t.code,redirectUri:t.redirectUri,state:t.state}});d("OAuth complete"),s(t,e.completeOAuth);}catch(e){i(e);}});let I=l.command("tags").description("Connection tag assignments");I.command("add").description("Tag a connection").requiredOption("--entity <id>").requiredOption("--tag <tagId>").option("--source <s>").option("-f, --format <format>").action(async t=>{try{let e={entityId:t.entity,tagId:t.tag};t.source&&(e.source=t.source);let n=await r(H,{input:e});d("Tagged"),s(t,n.tagConnection);}catch(e){i(e);}}),I.command("remove").description("Remove a tag from a connection").requiredOption("--entity <id>").requiredOption("--tag <tagId>").action(async t=>{try{await r(Y,{input:{entityId:t.entity,tagId:t.tag}}),d("Tag removed");}catch(e){i(e);}}),I.command("replace").description("Replace all tags on a connection").requiredOption("--entity <id>").requiredOption("--tags <ids>","Comma-separated tag IDs").option("-f, --format <format>").action(async t=>{try{let e=await r(J,{input:{entityId:t.entity,tagIds:t.tags.split(",")}});d("Tags replaced"),s(t,e.replaceConnectionTags);}catch(e){i(e);}}),I.command("list").description("List tags on a connection").requiredOption("--entity <id>").option("-f, --format <format>").action(async t=>{try{let e=await r(Q,{input:{entityId:t.entity}});s(t,e.getConnectionTags);}catch(e){i(e);}}),u.command("get-by-key").description("Get a provider by key (e.g. github, slack)").argument("<key>").option("-f, --format <format>").action(async(t,e)=>{try{let n=await r(j,{key:t});if(!n.getProviderByKey)throw new g(`Provider ${t} not found`);s(e,n.getProviderByKey);}catch(n){i(n);}}),u.command("catalog").description("Browseable provider catalog").option("--limit <n>","Page size",t=>parseInt(t,10),100).option("-f, --format <format>").action(async t=>{try{let e=await r(M,{pagination:{limit:t.limit,offset:0}});s(t,e.getProviderCatalog.items,{headers:["ID","Key","Name","Category","Auth","Enabled"],rows:e.getProviderCatalog.items.map(n=>[y(n.id,12),n.key,n.name,n.category??"-",n.authType??"-",String(!!n.isEnabled)])});}catch(e){i(e);}}),u.command("connections").description("Connections for a given provider").argument("<providerId>").option("--limit <n>","Page size",t=>parseInt(t,10),100).option("-f, --format <format>").action(async(t,e)=>{try{let n=await r(V,{providerId:t,pagination:{limit:e.limit,offset:0}});s(e,n.getConnectionsByProvider.items);}catch(n){i(n);}}),u.command("enable").description("Enable a provider").argument("<id>").action(async t=>{try{await r(K,{id:t}),d("Provider enabled");}catch(e){i(e);}}),u.command("disable").description("Disable a provider").argument("<id>").action(async t=>{try{await r(z,{id:t}),d("Provider disabled");}catch(e){i(e);}}),a.command("logs").description("Integration audit logs").option("--connection <id>").option("--level <l>","INFO|WARN|ERROR").option("--limit <n>","Page size",t=>parseInt(t,10),100).option("-f, --format <format>").action(async t=>{try{let e={};t.connection&&(e.connectionId=t.connection),t.level&&(e.level=t.level.toUpperCase());let n=await r(S,{filter:Object.keys(e).length?e:void 0,pagination:{limit:t.limit,offset:0}});s(t,n.getIntegrationLogs.items,{headers:["When","Action","Level","Message"],rows:n.getIntegrationLogs.items.map(c=>[v(c.createdAt),c.action,c.level,c.message])});}catch(e){i(e);}});}var gt={id:"integrations",version:"1.0.0",displayName:"Integrations",dependsOn:["auth","workspaces"],register(o,a){E(a),X(o);}},ke=gt;module.exports=ke;

package/dist/modules/integrations/index.js

@@ -1,44 +1,128 @@
-import {a,b,g,o,f,m,h as h$1,n}from'../../chunk-KTKHJORN.js';import {o as o$1}from'../../chunk-RNWXATAC.js';var y=`
+import {a,b as b$1,g,o,f,m,h,n}from'../../chunk-KTKHJORN.js';import {o as o$1}from'../../chunk-RNWXATAC.js';var E=`
   query GetProviders($filter: ProviderFilterInput, $pagination: IntegrationsPaginationInput) {
     getProviders(filter: $filter, pagination: $pagination) {
       items { id key name category authType isEnabled }
       total hasMore
     }
   }
-`,E=`
+`,O=`
   query GetProvider($id: ID!) {
     getProvider(id: $id) {
       id key name authType category connectionCount
     }
   }
-`,O=`
+`,N=`
   query GetConnections($filter: ConnectionFilterInput, $pagination: IntegrationsPaginationInput) {
     getConnections(filter: $filter, pagination: $pagination) {
       items { id name providerId status grantedScopes }
       total hasMore
     }
   }
-`,N=`
+`,A=`
   query GetConnection($id: ID!) {
     getConnection(id: $id) {
       id name providerId status externalAccountEmail credentialSource
     }
   }
-`,T=`
+`,v=`
   mutation CreateConnection($input: CreateConnectionInput!) {
     createConnection(input: $input) {
       id name status providerId
     }
   }
-`,h=`
+`,R=`
   mutation DeleteConnection($id: ID!, $deleteVaultSecret: Boolean) {
     deleteConnection(id: $id, deleteVaultSecret: $deleteVaultSecret)
   }
-`,P=`
+`,w=`
   query GetIntegrationLogs($filter: LogFilterInput, $pagination: IntegrationsPaginationInput) {
     getIntegrationLogs(filter: $filter, pagination: $pagination) {
       items { id action level message createdAt }
       total hasMore
     }
   }
-`;function R(m$1){let s=m$1.command("integrations").description("Integration providers, connections, and logs"),l=s.command("providers").description("Available providers");l.command("list").description("List integration providers").option("--category <c>").option("--enabled").option("--limit <n>","Page size",t=>parseInt(t,10),100).option("-f, --format <format>").action(async t=>{try{let e={};t.category&&(e.category=t.category.toUpperCase()),t.enabled!==void 0&&(e.isEnabled=t.enabled);let n=await b(y,{filter:Object.keys(e).length?e:void 0,pagination:{limit:t.limit,offset:0}});g(t,n.getProviders.items,{headers:["ID","Key","Name","Category","Auth","Enabled"],rows:n.getProviders.items.map(o$1=>[o(o$1.id,12),o$1.key,o$1.name,o$1.category??"-",o$1.authType??"-",String(!!o$1.isEnabled)])});}catch(e){f(e);}}),l.command("get").description("Get a provider").argument("<id>").option("-f, --format <format>").action(async(t,e)=>{try{let n=await b(E,{id:t});if(!n.getProvider)throw new o$1(`Provider ${t} not found`);g(e,n.getProvider);}catch(n){f(n);}});let c=s.command("connections").description("Provider connections (OAuth + credential)");c.command("list").description("List connections").option("--provider <id>").option("--status <s>").option("--limit <n>","Page size",t=>parseInt(t,10),100).option("-f, --format <format>").action(async t=>{try{let e={};t.provider&&(e.providerId=t.provider),t.status&&(e.status=t.status.toUpperCase());let n=await b(O,{filter:Object.keys(e).length?e:void 0,pagination:{limit:t.limit,offset:0}});g(t,n.getConnections.items,{headers:["ID","Name","Provider","Status"],rows:n.getConnections.items.map(o$1=>[o(o$1.id,12),o$1.name,o(o$1.providerId,12),m(o$1.status)])});}catch(e){f(e);}}),c.command("get").description("Get a connection").argument("<id>").option("-f, --format <format>").action(async(t,e)=>{try{let n=await b(N,{id:t});if(!n.getConnection)throw new o$1(`Connection ${t} not found`);g(e,n.getConnection);}catch(n){f(n);}}),c.command("add").description("Create a connection (provider id required; credentials stored in vault)").requiredOption("--name <name>").requiredOption("--provider <id>").option("--scopes <s>","Comma-separated scopes").option("-f, --format <format>").action(async t=>{try{let e={name:t.name,providerId:t.provider,grantedScopes:t.scopes?t.scopes.split(","):void 0},n=await b(T,{input:e});h$1("Connection created"),g(t,n.createConnection);}catch(e){f(e);}}),c.command("delete").description("Delete a connection").argument("<id>").option("--keep-secret","Keep vault secret",false).action(async(t,e)=>{try{await b(h,{id:t,deleteVaultSecret:!e.keepSecret}),h$1("Connection deleted");}catch(n){f(n);}}),s.command("logs").description("Integration audit logs").option("--connection <id>").option("--level <l>","INFO|WARN|ERROR").option("--limit <n>","Page size",t=>parseInt(t,10),100).option("-f, --format <format>").action(async t=>{try{let e={};t.connection&&(e.connectionId=t.connection),t.level&&(e.level=t.level.toUpperCase());let n$1=await b(P,{filter:Object.keys(e).length?e:void 0,pagination:{limit:t.limit,offset:0}});g(t,n$1.getIntegrationLogs.items,{headers:["When","Action","Level","Message"],rows:n$1.getIntegrationLogs.items.map(o=>[n(o.createdAt),o.action,o.level,o.message])});}catch(e){f(e);}});}var $={id:"integrations",version:"1.0.0",displayName:"Integrations",dependsOn:["auth","workspaces"],register(m,s){a(s),R(m);}},A=$;export{A as default};
+`,_=`
+  mutation UpdateConnection($id: ID!, $input: UpdateConnectionInput!) {
+    updateConnection(id: $id, input: $input) { id name status }
+  }
+`,P=`
+  mutation RevokeConnection($connectionId: ID!) {
+    revokeConnection(connectionId: $connectionId) { id name status }
+  }
+`,$=`
+  mutation TestConnection($connectionId: ID!) {
+    testConnection(connectionId: $connectionId) { success message latencyMs }
+  }
+`,k=`
+  mutation LinkIntegrationToChannel($channelId: String!, $connectionId: ID!, $organizationId: String!) {
+    linkIntegrationToChannel(channelId: $channelId, connectionId: $connectionId, organizationId: $organizationId) {
+      id name status channelId organizationId
+    }
+  }
+`,b=`
+  mutation RefreshConnectionToken($connectionId: ID!) {
+    refreshConnectionToken(connectionId: $connectionId) { id status }
+  }
+`,G=`
+  mutation AuthenticateWithApiKey($input: ApiKeyAuthInput!) {
+    authenticateWithApiKey(input: $input) { id name status }
+  }
+`,S=`
+  mutation AuthenticateWithBasicAuth($input: BasicAuthInput!) {
+    authenticateWithBasicAuth(input: $input) { id name status }
+  }
+`,D=`
+  mutation AuthenticateWithBearerToken($input: BearerTokenAuthInput!) {
+    authenticateWithBearerToken(input: $input) { id name status }
+  }
+`,B=`
+  mutation InitiateOAuth($input: InitiateOAuthInput!) {
+    initiateOAuth(input: $input) { redirectUrl state }
+  }
+`,q=`
+  mutation CompleteOAuth($input: CompleteOAuthInput!) {
+    completeOAuth(input: $input) { id name status }
+  }
+`,x=`
+  query GetProviderByKey($key: String!) {
+    getProviderByKey(key: $key) { id key name authType category connectionCount isEnabled }
+  }
+`,L=`
+  query GetProviderCatalog($pagination: IntegrationsPaginationInput) {
+    getProviderCatalog(pagination: $pagination) {
+      items { id key name category authType isEnabled }
+      total hasMore
+    }
+  }
+`,U=`
+  query GetConnectionsByProvider($providerId: ID!, $pagination: IntegrationsPaginationInput) {
+    getConnectionsByProvider(providerId: $providerId, pagination: $pagination) {
+      items { id name providerId status grantedScopes }
+      total hasMore
+    }
+  }
+`,K=`
+  mutation EnableProvider($id: ID!) {
+    enableProvider(id: $id) { id key name isEnabled }
+  }
+`,V=`
+  mutation DisableProvider($id: ID!) {
+    disableProvider(id: $id) { id key name isEnabled }
+  }
+`,H=`
+  mutation TagConnection($input: TagConnectionInput!) {
+    tagConnection(input: $input) { id entityId tagId source }
+  }
+`,W=`
+  mutation UntagConnection($input: UntagConnectionInput!) {
+    untagConnection(input: $input)
+  }
+`,z=`
+  mutation ReplaceConnectionTags($input: ReplaceConnectionTagsInput!) {
+    replaceConnectionTags(input: $input) { id entityId tagId source }
+  }
+`,M=`
+  query GetConnectionTags($input: GetConnectionTagsInput!) {
+    getConnectionTags(input: $input) { id entityId tagId source assignedAt }
+  }
+`;function Y(I){let p=I.command("integrations").description("Integration providers, connections, and logs"),d=p.command("providers").description("Available providers");d.command("list").description("List integration providers").option("--category <c>").option("--enabled").option("--limit <n>","Page size",t=>parseInt(t,10),100).option("-f, --format <format>").action(async t=>{try{let n={};t.category&&(n.category=t.category.toUpperCase()),t.enabled!==void 0&&(n.isEnabled=t.enabled);let e=await b$1(E,{filter:Object.keys(n).length?n:void 0,pagination:{limit:t.limit,offset:0}});g(t,e.getProviders.items,{headers:["ID","Key","Name","Category","Auth","Enabled"],rows:e.getProviders.items.map(r=>[o(r.id,12),r.key,r.name,r.category??"-",r.authType??"-",String(!!r.isEnabled)])});}catch(n){f(n);}}),d.command("get").description("Get a provider").argument("<id>").option("-f, --format <format>").action(async(t,n)=>{try{let e=await b$1(O,{id:t});if(!e.getProvider)throw new o$1(`Provider ${t} not found`);g(n,e.getProvider);}catch(e){f(e);}});let s=p.command("connections").description("Provider connections (OAuth + credential)");s.command("list").description("List connections").option("--provider <id>").option("--status <s>").option("--limit <n>","Page size",t=>parseInt(t,10),100).option("-f, --format <format>").action(async t=>{try{let n={};t.provider&&(n.providerId=t.provider),t.status&&(n.status=t.status.toUpperCase());let e=await b$1(N,{filter:Object.keys(n).length?n:void 0,pagination:{limit:t.limit,offset:0}});g(t,e.getConnections.items,{headers:["ID","Name","Provider","Status"],rows:e.getConnections.items.map(r=>[o(r.id,12),r.name,o(r.providerId,12),m(r.status)])});}catch(n){f(n);}}),s.command("get").description("Get a connection").argument("<id>").option("-f, --format <format>").action(async(t,n)=>{try{let e=await b$1(A,{id:t});if(!e.getConnection)throw new o$1(`Connection ${t} not found`);g(n,e.getConnection);}catch(e){f(e);}}),s.command("add").description("Create a connection (provider id required; credentials stored in vault)").requiredOption("--name <name>").requiredOption("--provider <id>").option("--scopes <s>","Comma-separated scopes").option("-f, --format <format>").action(async t=>{try{let n={name:t.name,providerId:t.provider,grantedScopes:t.scopes?t.scopes.split(","):void 0},e=await b$1(v,{input:n});h("Connection created"),g(t,e.createConnection);}catch(n){f(n);}}),s.command("delete").description("Delete a connection").argument("<id>").option("--keep-secret","Keep vault secret",false).action(async(t,n)=>{try{await b$1(R,{id:t,deleteVaultSecret:!n.keepSecret}),h("Connection deleted");}catch(e){f(e);}}),s.command("update").description("Update a connection (name / description / config JSON)").argument("<id>").option("--name <name>").option("--description <desc>").option("--config <json>","Config JSON string").option("-f, --format <format>").action(async(t,n)=>{try{let e={};if(n.name!==void 0&&(e.name=n.name),n.description!==void 0&&(e.description=n.description),n.config!==void 0&&(e.config=JSON.parse(n.config)),Object.keys(e).length===0)throw new o$1("Provide at least one of --name, --description, --config");let r=await b$1(_,{id:t,input:e});h("Connection updated"),g(n,r.updateConnection);}catch(e){f(e);}}),s.command("revoke").description("Revoke a connection (soft delete; tokens invalidated)").argument("<connectionId>").option("-f, --format <format>").action(async(t,n)=>{try{let e=await b$1(P,{connectionId:t});h("Connection revoked"),g(n,e.revokeConnection);}catch(e){f(e);}}),s.command("test").description("Test a connection (health/auth probe)").argument("<connectionId>").option("-f, --format <format>").action(async(t,n)=>{try{let e=await b$1($,{connectionId:t});g(n,e.testConnection);}catch(e){f(e);}}),s.command("link").description("Link a connection to a channel for DM/notification routing").requiredOption("--channel <channelId>").requiredOption("--connection <id>").requiredOption("--organization <id>").option("-f, --format <format>").action(async t=>{try{let n=await b$1(k,{channelId:t.channel,connectionId:t.connection,organizationId:t.organization});h("Linked"),g(t,n.linkIntegrationToChannel);}catch(n){f(n);}}),s.command("refresh-token").description("Force a connection token refresh (OAuth refresh_grant)").argument("<connectionId>").option("-f, --format <format>").action(async(t,n)=>{try{let e=await b$1(b,{connectionId:t});h("Token refreshed"),g(n,e.refreshConnectionToken);}catch(e){f(e);}});let g$1=p.command("auth").description("Per-connection auth flows");g$1.command("api-key").description("Authenticate a connection with an API key").requiredOption("--connection <id>").requiredOption("--api-key <key>").option("-f, --format <format>").action(async t=>{try{let n=await b$1(G,{input:{connectionId:t.connection,apiKey:t.apiKey}});h("Authenticated"),g(t,n.authenticateWithApiKey);}catch(n){f(n);}}),g$1.command("basic").description("Authenticate a connection with Basic Auth").requiredOption("--connection <id>").requiredOption("--username <u>").requiredOption("--password <p>").option("-f, --format <format>").action(async t=>{try{let n=await b$1(S,{input:{connectionId:t.connection,username:t.username,password:t.password}});h("Authenticated"),g(t,n.authenticateWithBasicAuth);}catch(n){f(n);}}),g$1.command("bearer").description("Authenticate a connection with a Bearer token").requiredOption("--connection <id>").requiredOption("--token <t>").option("-f, --format <format>").action(async t=>{try{let n=await b$1(D,{input:{connectionId:t.connection,token:t.token}});h("Authenticated"),g(t,n.authenticateWithBearerToken);}catch(n){f(n);}}),g$1.command("oauth-start").description("Initiate an OAuth flow; prints redirect URL + state").requiredOption("--connection <id>").requiredOption("--redirect-uri <uri>").option("--scopes <s>","Comma-separated scopes").option("-f, --format <format>").action(async t=>{try{let n={connectionId:t.connection,redirectUri:t.redirectUri};t.scopes&&(n.scopes=t.scopes.split(","));let e=await b$1(B,{input:n});g(t,e.initiateOAuth);}catch(n){f(n);}}),g$1.command("oauth-complete").description("Complete an OAuth flow with the authorization code + state").requiredOption("--connection <id>").requiredOption("--code <c>").requiredOption("--redirect-uri <uri>").requiredOption("--state <s>").option("-f, --format <format>").action(async t=>{try{let n=await b$1(q,{input:{connectionId:t.connection,code:t.code,redirectUri:t.redirectUri,state:t.state}});h("OAuth complete"),g(t,n.completeOAuth);}catch(n){f(n);}});let l=s.command("tags").description("Connection tag assignments");l.command("add").description("Tag a connection").requiredOption("--entity <id>").requiredOption("--tag <tagId>").option("--source <s>").option("-f, --format <format>").action(async t=>{try{let n={entityId:t.entity,tagId:t.tag};t.source&&(n.source=t.source);let e=await b$1(H,{input:n});h("Tagged"),g(t,e.tagConnection);}catch(n){f(n);}}),l.command("remove").description("Remove a tag from a connection").requiredOption("--entity <id>").requiredOption("--tag <tagId>").action(async t=>{try{await b$1(W,{input:{entityId:t.entity,tagId:t.tag}}),h("Tag removed");}catch(n){f(n);}}),l.command("replace").description("Replace all tags on a connection").requiredOption("--entity <id>").requiredOption("--tags <ids>","Comma-separated tag IDs").option("-f, --format <format>").action(async t=>{try{let n=await b$1(z,{input:{entityId:t.entity,tagIds:t.tags.split(",")}});h("Tags replaced"),g(t,n.replaceConnectionTags);}catch(n){f(n);}}),l.command("list").description("List tags on a connection").requiredOption("--entity <id>").option("-f, --format <format>").action(async t=>{try{let n=await b$1(M,{input:{entityId:t.entity}});g(t,n.getConnectionTags);}catch(n){f(n);}}),d.command("get-by-key").description("Get a provider by key (e.g. github, slack)").argument("<key>").option("-f, --format <format>").action(async(t,n)=>{try{let e=await b$1(x,{key:t});if(!e.getProviderByKey)throw new o$1(`Provider ${t} not found`);g(n,e.getProviderByKey);}catch(e){f(e);}}),d.command("catalog").description("Browseable provider catalog").option("--limit <n>","Page size",t=>parseInt(t,10),100).option("-f, --format <format>").action(async t=>{try{let n=await b$1(L,{pagination:{limit:t.limit,offset:0}});g(t,n.getProviderCatalog.items,{headers:["ID","Key","Name","Category","Auth","Enabled"],rows:n.getProviderCatalog.items.map(e=>[o(e.id,12),e.key,e.name,e.category??"-",e.authType??"-",String(!!e.isEnabled)])});}catch(n){f(n);}}),d.command("connections").description("Connections for a given provider").argument("<providerId>").option("--limit <n>","Page size",t=>parseInt(t,10),100).option("-f, --format <format>").action(async(t,n)=>{try{let e=await b$1(U,{providerId:t,pagination:{limit:n.limit,offset:0}});g(n,e.getConnectionsByProvider.items);}catch(e){f(e);}}),d.command("enable").description("Enable a provider").argument("<id>").action(async t=>{try{await b$1(K,{id:t}),h("Provider enabled");}catch(n){f(n);}}),d.command("disable").description("Disable a provider").argument("<id>").action(async t=>{try{await b$1(V,{id:t}),h("Provider disabled");}catch(n){f(n);}}),p.command("logs").description("Integration audit logs").option("--connection <id>").option("--level <l>","INFO|WARN|ERROR").option("--limit <n>","Page size",t=>parseInt(t,10),100).option("-f, --format <format>").action(async t=>{try{let n$1={};t.connection&&(n$1.connectionId=t.connection),t.level&&(n$1.level=t.level.toUpperCase());let e=await b$1(w,{filter:Object.keys(n$1).length?n$1:void 0,pagination:{limit:t.limit,offset:0}});g(t,e.getIntegrationLogs.items,{headers:["When","Action","Level","Message"],rows:e.getIntegrationLogs.items.map(r=>[n(r.createdAt),r.action,r.level,r.message])});}catch(n){f(n);}});}var F={id:"integrations",version:"1.0.0",displayName:"Integrations",dependsOn:["auth","workspaces"],register(I,p){a(p),Y(I);}},et=F;export{et as default};

package/dist/modules/rbac/index.cjs

@@ -1,4 +1,4 @@
-'use strict';require('graphql-request'),require('cross-fetch'),require('commander');var u=class extends Error{exitCode;hint;constructor(r,i){super(r),this.name="CliUserError",this.exitCode=i?.exitCode??1,this.hint=i?.hint;}},m=class extends u{constructor(r,i){super(r,{exitCode:2,hint:i?.hint??"Run `<product> auth login` to authenticate."}),this.name="CliAuthError";}},d=class extends Error{cause;constructor(r,i){super(r),this.name="CliInternalError",this.cause=i;}};var h=null;function I(e){h=e;}function p(){if(!h)throw new d("vibecontrols module helpers used before setHelpersContext was called");return h}function K(){let e=p();if(!e.auth.isAuthenticated())throw new m(`Authentication required. Run \`${e.productName} auth login\`.`)}async function E(e,r){return K(),p().gql.workspace.request(e,r)}async function v(e,r){return p().gql.global.request(e,r)}function g(e){let r=e instanceof Error?e.message:String(e);throw new u(r)}function y(e,r,i){p().output.formatAndOutput(e,r,i);}function k(e){p().output.printSuccess(e);}function R(e){return p().output.formatStatus(e)}function C(e,r){return p().output.truncate(e,r)}function A(){return p()}var S=`
+'use strict';require('graphql-request'),require('cross-fetch'),require('commander');var l=class extends Error{exitCode;hint;constructor(n,a){super(n),this.name="CliUserError",this.exitCode=a?.exitCode??1,this.hint=a?.hint;}},w=class extends l{constructor(n,a){super(n,{exitCode:2,hint:a?.hint??"Run `<product> auth login` to authenticate."}),this.name="CliAuthError";}},f=class extends Error{cause;constructor(n,a){super(n),this.name="CliInternalError",this.cause=a;}};var x=null;function E(r){x=r;}function d(){if(!x)throw new f("vibecontrols module helpers used before setHelpersContext was called");return x}function X(){let r=d();if(!r.auth.isAuthenticated())throw new w(`Authentication required. Run \`${r.productName} auth login\`.`)}async function v(r,n){return X(),d().gql.workspace.request(r,n)}async function R(r,n){return d().gql.global.request(r,n)}function p(r){let n=r instanceof Error?r.message:String(r);throw new l(n)}function m(r,n,a){d().output.formatAndOutput(r,n,a);}function k(r){d().output.printSuccess(r);}function A(r){return d().output.formatStatus(r)}function h(r,n){return d().output.truncate(r,n)}function S(){return d()}var O=`
   query ListRoles($filter: RoleFilterInput, $pagination: PaginationInput, $scopeId: String!) {
     roles(filter: $filter, pagination: $pagination, scopeId: $scopeId) {
       id
@@ -13,7 +13,7 @@
       }
     }
   }
-`,O=`
+`,L=`
   query GetRole($id: ID!) {
     role(id: $id) {
       id
@@ -28,7 +28,7 @@
       }
     }
   }
-`,L=`
+`,P=`
   mutation CreateRole($input: CreateRoleInput!) {
     createRole(input: $input) {
       id
@@ -46,11 +46,35 @@
       priority
     }
   }
-`,P=`
+`,D=`
   mutation DeleteRole($id: ID!, $reassignToRoleId: ID) {
     deleteRole(id: $id, reassignToRoleId: $reassignToRoleId)
   }
-`,D=`
+`,q=`
+  query PolicyReferences($filter: PolicyReferenceFilterInput, $pagination: PaginationInput) {
+    policyReferences(filter: $filter, pagination: $pagination) {
+      id
+      name
+      description
+      opaPackage
+      resourceType
+      action
+      isActive
+      priority
+    }
+  }
+`,_=`
+  mutation AttachPolicyToRole($roleId: ID!, $policyId: ID!) {
+    attachPolicyToRole(roleId: $roleId, policyId: $policyId) {
+      id
+      name
+    }
+  }
+`,N=`
+  mutation DetachPolicyFromRole($roleId: ID!, $policyId: ID!) {
+    detachPolicyFromRole(roleId: $roleId, policyId: $policyId)
+  }
+`,F=`
   query CheckPermission($input: PermissionCheckInput!) {
     checkPermission(input: $input) {
       allowed
@@ -60,4 +84,4 @@
       overrideType
     }
   }
-`;function w(e,r,i){return e==="workspace"?E(r,i):v(r,i)}function x(e){let r=A().auth.read();if(e==="workspace"){if(!r?.workspaceId)throw new u("No workspace set. Run `vibecontrols workspace set <id>` or pass --scope <workspaceId>.");return r.workspaceId}if(!r?.organizationId)throw new u("No organization context. Run `auth login` to bind a tenant or pass --scope <tenantId>.");return r.organizationId}function q(e){let r=e.command("rbac").description("Role-based access control"),i=r.command("roles").description("Manage roles");i.command("list").description("List roles").option("--layer <layer>","workspace or global","workspace").option("--scope <scopeId>","Override scope id (workspace or tenant)").option("--include-system","Include system roles",false).option("--limit <n>","Page size",t=>parseInt(t,10),100).option("-f, --format <format>","Output format").action(async t=>{try{let n=t.layer==="global"?"global":"workspace",s=t.scope??x(n),o={};t.includeSystem&&(o.includeSystem=!0);let c=await w(n,S,{filter:Object.keys(o).length?o:void 0,pagination:{limit:t.limit,offset:0},scopeId:s});y(t,c.roles,{headers:["ID","Name","Scope","Priority","System"],rows:c.roles.map(l=>[C(l.id,12),l.name,C(l.scopeId,12),String(l.priority),String(l.isSystem)])});}catch(n){g(n);}}),i.command("get").description("Get role by id").argument("<id>").option("--layer <layer>","workspace or global","workspace").option("-f, --format <format>").action(async(t,n)=>{try{let s=n.layer==="global"?"global":"workspace",o=await w(s,O,{id:t});if(!o.role)throw new u(`Role ${t} not found`);y(n,o.role);}catch(s){g(s);}}),i.command("create").description("Create a role").requiredOption("--name <name>","Role name").option("--description <text>").option("--parent <id>","Parent role id").option("--priority <n>","Priority",t=>parseInt(t,10)).option("--layer <layer>","workspace or global","workspace").option("--scope <scopeId>","Override scope id").option("--scope-type <type>","wspace|entity (global only)").option("-f, --format <format>").action(async t=>{try{let n=t.layer==="global"?"global":"workspace",s=t.scope??x(n),o={name:t.name,description:t.description,parentId:t.parent,priority:t.priority,scopeId:s};n==="global"&&t.scopeType&&(o.scopeType=t.scopeType);let c=await w(n,L,{input:o});k(`Role created: ${c.createRole.name}`),y(t,c.createRole);}catch(n){g(n);}}),i.command("update").description("Update a role").argument("<id>").option("--name <name>").option("--description <text>").option("--priority <n>","",t=>parseInt(t,10)).option("--parent <id>").option("--layer <layer>","workspace or global","workspace").option("-f, --format <format>").action(async(t,n)=>{try{let s=n.layer==="global"?"global":"workspace",o={};if(n.name&&(o.name=n.name),n.description!==void 0&&(o.description=n.description),n.priority!==void 0&&(o.priority=n.priority),n.parent&&(o.parentId=n.parent),!Object.keys(o).length)throw new u("No updates specified");let c=await w(s,$,{id:t,input:o});k("Role updated"),y(n,c.updateRole);}catch(s){g(s);}}),i.command("delete").description("Delete a role").argument("<id>").option("--reassign <roleId>","Reassign actors to this role").option("--layer <layer>","workspace or global","workspace").action(async(t,n)=>{try{let s=n.layer==="global"?"global":"workspace";await w(s,P,{id:t,reassignToRoleId:n.reassign}),k("Role deleted");}catch(s){g(s);}}),r.command("check").description("Check whether an actor has permission for an action on a resource").argument("<actorId>","Actor id (user/app/service/super_admin)").argument("<action>","Action like read/write/delete").argument("<resourceType>","Resource type like project/task").option("--actor-type <type>","USER|BOT|GROUP|INTEGRATION|DELEGATED_AGENT","USER").option("--resource-id <id>","Specific resource id (optional)").option("--scope <scopeId>","Scope id (workspaceId or tenantId)").option("--layer <layer>","workspace or global","workspace").option("-f, --format <format>").action(async(t,n,s,o)=>{try{let c=o.layer==="global"?"global":"workspace",l=o.scope??x(c),_={actorId:t,actorType:(o.actorType??"USER").toUpperCase(),action:n,resourceType:s,resourceId:o.resourceId,scopeId:l},f=await w(c,D,{input:_});y(o,f.checkPermission,{headers:["Allowed","Decision","Role","Level","Override"],rows:[[R(f.checkPermission.allowed?"ACTIVE":"ERROR"),f.checkPermission.decisionPath,f.checkPermission.roleName??"-",f.checkPermission.roleLevel??"-",f.checkPermission.overrideType??"-"]]});}catch(c){g(c);}});}var Y={id:"rbac",version:"1.0.0",displayName:"RBAC",dependsOn:["auth"],register(e,r){I(r),q(e);}},st=Y;module.exports=st;
+`;function u(r,n,a){return r==="workspace"?v(n,a):R(n,a)}function I(r){let n=S().auth.read();if(r==="workspace"){if(!n?.workspaceId)throw new l("No workspace set. Run `vibecontrols workspace set <id>` or pass --scope <workspaceId>.");return n.workspaceId}if(!n?.organizationId)throw new l("No organization context. Run `auth login` to bind a tenant or pass --scope <tenantId>.");return n.organizationId}function j(r){let n=r.command("rbac").description("Role-based access control"),a=n.command("roles").description("Manage roles");a.command("list").description("List roles").option("--layer <layer>","workspace or global","workspace").option("--scope <scopeId>","Override scope id (workspace or tenant)").option("--include-system","Include system roles",false).option("--limit <n>","Page size",e=>parseInt(e,10),100).option("-f, --format <format>","Output format").action(async e=>{try{let t=e.layer==="global"?"global":"workspace",i=e.scope??I(t),o={};e.includeSystem&&(o.includeSystem=!0);let s=await u(t,O,{filter:Object.keys(o).length?o:void 0,pagination:{limit:e.limit,offset:0},scopeId:i});m(e,s.roles,{headers:["ID","Name","Scope","Priority","System"],rows:s.roles.map(g=>[h(g.id,12),g.name,h(g.scopeId,12),String(g.priority),String(g.isSystem)])});}catch(t){p(t);}}),a.command("get").description("Get role by id").argument("<id>").option("--layer <layer>","workspace or global","workspace").option("-f, --format <format>").action(async(e,t)=>{try{let i=t.layer==="global"?"global":"workspace",o=await u(i,L,{id:e});if(!o.role)throw new l(`Role ${e} not found`);m(t,o.role);}catch(i){p(i);}}),a.command("create").description("Create a role").requiredOption("--name <name>","Role name").option("--description <text>").option("--parent <id>","Parent role id").option("--priority <n>","Priority",e=>parseInt(e,10)).option("--layer <layer>","workspace or global","workspace").option("--scope <scopeId>","Override scope id").option("--scope-type <type>","wspace|entity (global only)").option("-f, --format <format>").action(async e=>{try{let t=e.layer==="global"?"global":"workspace",i=e.scope??I(t),o={name:e.name,description:e.description,parentId:e.parent,priority:e.priority,scopeId:i};t==="global"&&e.scopeType&&(o.scopeType=e.scopeType);let s=await u(t,P,{input:o});k(`Role created: ${s.createRole.name}`),m(e,s.createRole);}catch(t){p(t);}}),a.command("update").description("Update a role").argument("<id>").option("--name <name>").option("--description <text>").option("--priority <n>","",e=>parseInt(e,10)).option("--parent <id>").option("--layer <layer>","workspace or global","workspace").option("-f, --format <format>").action(async(e,t)=>{try{let i=t.layer==="global"?"global":"workspace",o={};if(t.name&&(o.name=t.name),t.description!==void 0&&(o.description=t.description),t.priority!==void 0&&(o.priority=t.priority),t.parent&&(o.parentId=t.parent),!Object.keys(o).length)throw new l("No updates specified");let s=await u(i,$,{id:e,input:o});k("Role updated"),m(t,s.updateRole);}catch(i){p(i);}}),a.command("delete").description("Delete a role").argument("<id>").option("--reassign <roleId>","Reassign actors to this role").option("--layer <layer>","workspace or global","workspace").action(async(e,t)=>{try{let i=t.layer==="global"?"global":"workspace";await u(i,D,{id:e,reassignToRoleId:t.reassign}),k("Role deleted");}catch(i){p(i);}});let C=n.command("policies").description("Manage policy references");C.command("list").description("List policy references").option("--layer <layer>","workspace or global","workspace").option("--resource-type <s>","Filter by resource type").option("--action <s>","Filter by action").option("--limit <n>","Page size",e=>parseInt(e,10),100).option("-f, --format <format>").action(async e=>{try{let t=e.layer==="global"?"global":"workspace",i={};e.resourceType&&(i.resourceType=e.resourceType),e.action&&(i.action=e.action);let o=await u(t,q,{filter:Object.keys(i).length?i:void 0,pagination:{limit:e.limit,offset:0}});m(e,o.policyReferences,{headers:["ID","Name","Resource","Action","Active","Priority"],rows:o.policyReferences.map(s=>[h(s.id,12),s.name,s.resourceType??"-",s.action??"-",String(s.isActive),String(s.priority??"-")])});}catch(t){p(t);}}),C.command("attach").description("Attach a policy to a role").requiredOption("--role <roleId>").requiredOption("--policy <policyId>").option("--layer <layer>","workspace or global","workspace").action(async e=>{try{let t=e.layer==="global"?"global":"workspace";await u(t,_,{roleId:e.role,policyId:e.policy}),k("Policy attached");}catch(t){p(t);}}),C.command("detach").description("Detach a policy from a role").requiredOption("--role <roleId>").requiredOption("--policy <policyId>").option("--layer <layer>","workspace or global","workspace").action(async e=>{try{let t=e.layer==="global"?"global":"workspace";await u(t,N,{roleId:e.role,policyId:e.policy}),k("Policy detached");}catch(t){p(t);}}),n.command("check").description("Check whether an actor has permission for an action on a resource").argument("<actorId>","Actor id (user/app/service/super_admin)").argument("<action>","Action like read/write/delete").argument("<resourceType>","Resource type like project/task").option("--actor-type <type>","USER|BOT|GROUP|INTEGRATION|DELEGATED_AGENT","USER").option("--resource-id <id>","Specific resource id (optional)").option("--scope <scopeId>","Scope id (workspaceId or tenantId)").option("--layer <layer>","workspace or global","workspace").option("-f, --format <format>").action(async(e,t,i,o)=>{try{let s=o.layer==="global"?"global":"workspace",g=o.scope??I(s),G={actorId:e,actorType:(o.actorType??"USER").toUpperCase(),action:t,resourceType:i,resourceId:o.resourceId,scopeId:g},y=await u(s,F,{input:G});m(o,y.checkPermission,{headers:["Allowed","Decision","Role","Level","Override"],rows:[[A(y.checkPermission.allowed?"ACTIVE":"ERROR"),y.checkPermission.decisionPath,y.checkPermission.roleName??"-",y.checkPermission.roleLevel??"-",y.checkPermission.overrideType??"-"]]});}catch(s){p(s);}});}var ee={id:"rbac",version:"1.0.0",displayName:"RBAC",dependsOn:["auth"],register(r,n){E(n),j(r);}},pt=ee;module.exports=pt;

package/dist/modules/rbac/index.js

@@ -1,4 +1,4 @@
-import {a,g,o,f,h,m as m$1,r,b,c}from'../../chunk-KTKHJORN.js';import {o as o$1}from'../../chunk-RNWXATAC.js';var T=`
+import {a,g,o,f as f$1,h,m,r,b,c}from'../../chunk-KTKHJORN.js';import {o as o$1}from'../../chunk-RNWXATAC.js';var L=`
   query ListRoles($filter: RoleFilterInput, $pagination: PaginationInput, $scopeId: String!) {
     roles(filter: $filter, pagination: $pagination, scopeId: $scopeId) {
       id
@@ -13,7 +13,7 @@ import {a,g,o,f,h,m as m$1,r,b,c}from'../../chunk-KTKHJORN.js';import {o as o$1}
       }
     }
   }
-`,L=`
+`,P=`
   query GetRole($id: ID!) {
     role(id: $id) {
       id
@@ -37,7 +37,7 @@ import {a,g,o,f,h,m as m$1,r,b,c}from'../../chunk-KTKHJORN.js';import {o as o$1}
       scopeId
     }
   }
-`,S=`
+`,O=`
   mutation UpdateRole($id: ID!, $input: UpdateRoleInput!) {
     updateRole(id: $id, input: $input) {
       id
@@ -46,11 +46,35 @@ import {a,g,o,f,h,m as m$1,r,b,c}from'../../chunk-KTKHJORN.js';import {o as o$1}
       priority
     }
   }
-`,P=`
+`,S=`
   mutation DeleteRole($id: ID!, $reassignToRoleId: ID) {
     deleteRole(id: $id, reassignToRoleId: $reassignToRoleId)
   }
-`,O=`
+`,$=`
+  query PolicyReferences($filter: PolicyReferenceFilterInput, $pagination: PaginationInput) {
+    policyReferences(filter: $filter, pagination: $pagination) {
+      id
+      name
+      description
+      opaPackage
+      resourceType
+      action
+      isActive
+      priority
+    }
+  }
+`,A=`
+  mutation AttachPolicyToRole($roleId: ID!, $policyId: ID!) {
+    attachPolicyToRole(roleId: $roleId, policyId: $policyId) {
+      id
+      name
+    }
+  }
+`,x=`
+  mutation DetachPolicyFromRole($roleId: ID!, $policyId: ID!) {
+    detachPolicyFromRole(roleId: $roleId, policyId: $policyId)
+  }
+`,D=`
   query CheckPermission($input: PermissionCheckInput!) {
     checkPermission(input: $input) {
       allowed
@@ -60,4 +84,4 @@ import {a,g,o,f,h,m as m$1,r,b,c}from'../../chunk-KTKHJORN.js';import {o as o$1}
       overrideType
     }
   }
-`;function m(s,i,a){return s==="workspace"?b(i,a):c(i,a)}function R(s){let i=r().auth.read();if(s==="workspace"){if(!i?.workspaceId)throw new o$1("No workspace set. Run `vibecontrols workspace set <id>` or pass --scope <workspaceId>.");return i.workspaceId}if(!i?.organizationId)throw new o$1("No organization context. Run `auth login` to bind a tenant or pass --scope <tenantId>.");return i.organizationId}function $(s){let i=s.command("rbac").description("Role-based access control"),a=i.command("roles").description("Manage roles");a.command("list").description("List roles").option("--layer <layer>","workspace or global","workspace").option("--scope <scopeId>","Override scope id (workspace or tenant)").option("--include-system","Include system roles",false).option("--limit <n>","Page size",e=>parseInt(e,10),100).option("-f, --format <format>","Output format").action(async e=>{try{let o$1=e.layer==="global"?"global":"workspace",t=e.scope??R(o$1),r={};e.includeSystem&&(r.includeSystem=!0);let n=await m(o$1,T,{filter:Object.keys(r).length?r:void 0,pagination:{limit:e.limit,offset:0},scopeId:t});g(e,n.roles,{headers:["ID","Name","Scope","Priority","System"],rows:n.roles.map(c=>[o(c.id,12),c.name,o(c.scopeId,12),String(c.priority),String(c.isSystem)])});}catch(o){f(o);}}),a.command("get").description("Get role by id").argument("<id>").option("--layer <layer>","workspace or global","workspace").option("-f, --format <format>").action(async(e,o)=>{try{let t=o.layer==="global"?"global":"workspace",r=await m(t,L,{id:e});if(!r.role)throw new o$1(`Role ${e} not found`);g(o,r.role);}catch(t){f(t);}}),a.command("create").description("Create a role").requiredOption("--name <name>","Role name").option("--description <text>").option("--parent <id>","Parent role id").option("--priority <n>","Priority",e=>parseInt(e,10)).option("--layer <layer>","workspace or global","workspace").option("--scope <scopeId>","Override scope id").option("--scope-type <type>","wspace|entity (global only)").option("-f, --format <format>").action(async e=>{try{let o=e.layer==="global"?"global":"workspace",t=e.scope??R(o),r={name:e.name,description:e.description,parentId:e.parent,priority:e.priority,scopeId:t};o==="global"&&e.scopeType&&(r.scopeType=e.scopeType);let n=await m(o,C,{input:r});h(`Role created: ${n.createRole.name}`),g(e,n.createRole);}catch(o){f(o);}}),a.command("update").description("Update a role").argument("<id>").option("--name <name>").option("--description <text>").option("--priority <n>","",e=>parseInt(e,10)).option("--parent <id>").option("--layer <layer>","workspace or global","workspace").option("-f, --format <format>").action(async(e,o)=>{try{let t=o.layer==="global"?"global":"workspace",r={};if(o.name&&(r.name=o.name),o.description!==void 0&&(r.description=o.description),o.priority!==void 0&&(r.priority=o.priority),o.parent&&(r.parentId=o.parent),!Object.keys(r).length)throw new o$1("No updates specified");let n=await m(t,S,{id:e,input:r});h("Role updated"),g(o,n.updateRole);}catch(t){f(t);}}),a.command("delete").description("Delete a role").argument("<id>").option("--reassign <roleId>","Reassign actors to this role").option("--layer <layer>","workspace or global","workspace").action(async(e,o)=>{try{let t=o.layer==="global"?"global":"workspace";await m(t,P,{id:e,reassignToRoleId:o.reassign}),h("Role deleted");}catch(t){f(t);}}),i.command("check").description("Check whether an actor has permission for an action on a resource").argument("<actorId>","Actor id (user/app/service/super_admin)").argument("<action>","Action like read/write/delete").argument("<resourceType>","Resource type like project/task").option("--actor-type <type>","USER|BOT|GROUP|INTEGRATION|DELEGATED_AGENT","USER").option("--resource-id <id>","Specific resource id (optional)").option("--scope <scopeId>","Scope id (workspaceId or tenantId)").option("--layer <layer>","workspace or global","workspace").option("-f, --format <format>").action(async(e,o,t,r)=>{try{let n=r.layer==="global"?"global":"workspace",c=r.scope??R(n),x={actorId:e,actorType:(r.actorType??"USER").toUpperCase(),action:o,resourceType:t,resourceId:r.resourceId,scopeId:c},l=await m(n,O,{input:x});g(r,l.checkPermission,{headers:["Allowed","Decision","Role","Level","Override"],rows:[[m$1(l.checkPermission.allowed?"ACTIVE":"ERROR"),l.checkPermission.decisionPath,l.checkPermission.roleName??"-",l.checkPermission.roleLevel??"-",l.checkPermission.overrideType??"-"]]});}catch(n){f(n);}});}var A={id:"rbac",version:"1.0.0",displayName:"RBAC",dependsOn:["auth"],register(s,i){a(i),$(s);}},j=A;export{j as default};
+`;function s(p,n,c$1){return p==="workspace"?b(n,c$1):c(n,c$1)}function f(p){let n=r().auth.read();if(p==="workspace"){if(!n?.workspaceId)throw new o$1("No workspace set. Run `vibecontrols workspace set <id>` or pass --scope <workspaceId>.");return n.workspaceId}if(!n?.organizationId)throw new o$1("No organization context. Run `auth login` to bind a tenant or pass --scope <tenantId>.");return n.organizationId}function _(p){let n=p.command("rbac").description("Role-based access control"),c=n.command("roles").description("Manage roles");c.command("list").description("List roles").option("--layer <layer>","workspace or global","workspace").option("--scope <scopeId>","Override scope id (workspace or tenant)").option("--include-system","Include system roles",false).option("--limit <n>","Page size",e=>parseInt(e,10),100).option("-f, --format <format>","Output format").action(async e=>{try{let o$1=e.layer==="global"?"global":"workspace",t=e.scope??f(o$1),r={};e.includeSystem&&(r.includeSystem=!0);let i=await s(o$1,L,{filter:Object.keys(r).length?r:void 0,pagination:{limit:e.limit,offset:0},scopeId:t});g(e,i.roles,{headers:["ID","Name","Scope","Priority","System"],rows:i.roles.map(l=>[o(l.id,12),l.name,o(l.scopeId,12),String(l.priority),String(l.isSystem)])});}catch(o){f$1(o);}}),c.command("get").description("Get role by id").argument("<id>").option("--layer <layer>","workspace or global","workspace").option("-f, --format <format>").action(async(e,o)=>{try{let t=o.layer==="global"?"global":"workspace",r=await s(t,P,{id:e});if(!r.role)throw new o$1(`Role ${e} not found`);g(o,r.role);}catch(t){f$1(t);}}),c.command("create").description("Create a role").requiredOption("--name <name>","Role name").option("--description <text>").option("--parent <id>","Parent role id").option("--priority <n>","Priority",e=>parseInt(e,10)).option("--layer <layer>","workspace or global","workspace").option("--scope <scopeId>","Override scope id").option("--scope-type <type>","wspace|entity (global only)").option("-f, --format <format>").action(async e=>{try{let o=e.layer==="global"?"global":"workspace",t=e.scope??f(o),r={name:e.name,description:e.description,parentId:e.parent,priority:e.priority,scopeId:t};o==="global"&&e.scopeType&&(r.scopeType=e.scopeType);let i=await s(o,C,{input:r});h(`Role created: ${i.createRole.name}`),g(e,i.createRole);}catch(o){f$1(o);}}),c.command("update").description("Update a role").argument("<id>").option("--name <name>").option("--description <text>").option("--priority <n>","",e=>parseInt(e,10)).option("--parent <id>").option("--layer <layer>","workspace or global","workspace").option("-f, --format <format>").action(async(e,o)=>{try{let t=o.layer==="global"?"global":"workspace",r={};if(o.name&&(r.name=o.name),o.description!==void 0&&(r.description=o.description),o.priority!==void 0&&(r.priority=o.priority),o.parent&&(r.parentId=o.parent),!Object.keys(r).length)throw new o$1("No updates specified");let i=await s(t,O,{id:e,input:r});h("Role updated"),g(o,i.updateRole);}catch(t){f$1(t);}}),c.command("delete").description("Delete a role").argument("<id>").option("--reassign <roleId>","Reassign actors to this role").option("--layer <layer>","workspace or global","workspace").action(async(e,o)=>{try{let t=o.layer==="global"?"global":"workspace";await s(t,S,{id:e,reassignToRoleId:o.reassign}),h("Role deleted");}catch(t){f$1(t);}});let I=n.command("policies").description("Manage policy references");I.command("list").description("List policy references").option("--layer <layer>","workspace or global","workspace").option("--resource-type <s>","Filter by resource type").option("--action <s>","Filter by action").option("--limit <n>","Page size",e=>parseInt(e,10),100).option("-f, --format <format>").action(async e=>{try{let o$1=e.layer==="global"?"global":"workspace",t={};e.resourceType&&(t.resourceType=e.resourceType),e.action&&(t.action=e.action);let r=await s(o$1,$,{filter:Object.keys(t).length?t:void 0,pagination:{limit:e.limit,offset:0}});g(e,r.policyReferences,{headers:["ID","Name","Resource","Action","Active","Priority"],rows:r.policyReferences.map(i=>[o(i.id,12),i.name,i.resourceType??"-",i.action??"-",String(i.isActive),String(i.priority??"-")])});}catch(o){f$1(o);}}),I.command("attach").description("Attach a policy to a role").requiredOption("--role <roleId>").requiredOption("--policy <policyId>").option("--layer <layer>","workspace or global","workspace").action(async e=>{try{let o=e.layer==="global"?"global":"workspace";await s(o,A,{roleId:e.role,policyId:e.policy}),h("Policy attached");}catch(o){f$1(o);}}),I.command("detach").description("Detach a policy from a role").requiredOption("--role <roleId>").requiredOption("--policy <policyId>").option("--layer <layer>","workspace or global","workspace").action(async e=>{try{let o=e.layer==="global"?"global":"workspace";await s(o,x,{roleId:e.role,policyId:e.policy}),h("Policy detached");}catch(o){f$1(o);}}),n.command("check").description("Check whether an actor has permission for an action on a resource").argument("<actorId>","Actor id (user/app/service/super_admin)").argument("<action>","Action like read/write/delete").argument("<resourceType>","Resource type like project/task").option("--actor-type <type>","USER|BOT|GROUP|INTEGRATION|DELEGATED_AGENT","USER").option("--resource-id <id>","Specific resource id (optional)").option("--scope <scopeId>","Scope id (workspaceId or tenantId)").option("--layer <layer>","workspace or global","workspace").option("-f, --format <format>").action(async(e,o,t,r)=>{try{let i=r.layer==="global"?"global":"workspace",l=r.scope??f(i),v={actorId:e,actorType:(r.actorType??"USER").toUpperCase(),action:o,resourceType:t,resourceId:r.resourceId,scopeId:l},y=await s(i,D,{input:v});g(r,y.checkPermission,{headers:["Allowed","Decision","Role","Level","Override"],rows:[[m(y.checkPermission.allowed?"ACTIVE":"ERROR"),y.checkPermission.decisionPath,y.checkPermission.roleName??"-",y.checkPermission.roleLevel??"-",y.checkPermission.overrideType??"-"]]});}catch(i){f$1(i);}});}var U={id:"rbac",version:"1.0.0",displayName:"RBAC",dependsOn:["auth"],register(p,n){a(n),_(p);}},Y=U;export{Y as default};