@dereekb/dbx-cli 13.12.0 → 13.12.2

package/lint-cache/main.js

@@ -20,15 +20,21 @@ import { join as join2 } from "node:path";
 // packages/dbx-cli/lint-cache/src/project-lookup.ts
 import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { join, relative } from "node:path";
-var TOP_LEVEL_DIRS = ["apps", "packages", "tools"];
 var SKIP_DIR_NAMES = /* @__PURE__ */ new Set(["node_modules", "dist", "coverage", ".nx", ".angular", ".next"]);
+function discoverTopLevelDirs(workspaceRoot) {
+  let dirs;
+  try {
+    dirs = readdirSync(workspaceRoot, { withFileTypes: true }).filter((e) => e.isDirectory() && !SKIP_DIR_NAMES.has(e.name) && !e.name.startsWith(".")).map((e) => e.name).sort((a, b) => a.localeCompare(b));
+  } catch {
+    dirs = [];
+  }
+  return dirs;
+}
 function findProject(workspaceRoot, projectName) {
   let result = null;
-  for (const dir of TOP_LEVEL_DIRS) {
+  for (const dir of discoverTopLevelDirs(workspaceRoot)) {
     if (result) break;
-    const base = join(workspaceRoot, dir);
-    if (!existsSync(base)) continue;
-    result = walkForProject(workspaceRoot, base, projectName);
+    result = walkForProject(workspaceRoot, join(workspaceRoot, dir), projectName);
   }
   if (!result) {
     const rootProject = readProjectJson(join(workspaceRoot, "project.json"));
@@ -60,10 +66,8 @@ function walkForProject(workspaceRoot, dir, projectName) {
 }
 function listProjects(workspaceRoot) {
   const out = [];
-  for (const dir of TOP_LEVEL_DIRS) {
-    const base = join(workspaceRoot, dir);
-    if (!existsSync(base)) continue;
-    collectProjects(workspaceRoot, base, out);
+  for (const dir of discoverTopLevelDirs(workspaceRoot)) {
+    collectProjects(workspaceRoot, join(workspaceRoot, dir), out);
   }
   const rootProject = readProjectJson(join(workspaceRoot, "project.json"));
   if (rootProject) out.push(toProjectInfo(workspaceRoot, workspaceRoot, rootProject));

package/lint-cache/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@dereekb/dbx-cli-lint-cache",
-  "version": "13.12.0",
+  "version": "13.12.2",
   "private": true,
   "type": "module",
   "devDependencies": {
-    "@dereekb/util": "13.12.0",
+    "@dereekb/util": "13.12.2",
     "eslint": "10.4.0",
     "yargs": "^18.0.0",
     "@types/yargs": "^17.0.35"

package/manifest-extract/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dereekb/dbx-cli/manifest-extract",
-  "version": "13.12.0",
+  "version": "13.12.2",
   "sideEffects": false,
   "peerDependencies": {
     "ts-morph": "^21.0.0"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dereekb/dbx-cli",
-  "version": "13.12.0",
+  "version": "13.12.2",
   "type": "module",
   "sideEffects": false,
   "bin": {
@@ -41,10 +41,10 @@
     }
   },
   "peerDependencies": {
-    "@dereekb/date": "13.12.0",
-    "@dereekb/firebase": "13.12.0",
-    "@dereekb/nestjs": "13.12.0",
-    "@dereekb/util": "13.12.0",
+    "@dereekb/date": "13.12.2",
+    "@dereekb/firebase": "13.12.2",
+    "@dereekb/nestjs": "13.12.2",
+    "@dereekb/util": "13.12.2",
     "arktype": "^2.2.0",
     "ts-morph": "^21.0.0",
     "yargs": "^18.0.0"

package/src/lib/mcp-scan/scan/auth-extract.d.ts

@@ -15,8 +15,13 @@
  * The extractor is intentionally syntactic — no type checker calls — so it
  * runs cheaply on in-memory fixtures and the demo's `claims.ts`. Role
  * constants like `AUTH_ADMIN_ROLE` are resolved through the supplied
- * {@link AuthExtractKnownRoles} map; unresolved identifiers fall through as
- * the identifier text so callers can still see them in registry output.
+ * {@link AuthExtractKnownRoles} map. In addition, role constants declared in
+ * the scanned source itself (an `export const WORKER_ROLE = 'worker'`, or an
+ * `export const ALL_ADMIN_ROLES = [...]` aggregate) are resolved by reading
+ * their `StringLiteral` / `ArrayLiteralExpression` initializers — built-ins
+ * always win on conflict. Identifiers that still can't be resolved fall
+ * through as the identifier text so callers can still see them in registry
+ * output (and emit an `unresolved-role-const` warning).
  */
 import { type Project } from 'ts-morph';
 import type { AuthClaimRoleMappingInfo } from '../registry/auth-runtime.js';
@@ -86,9 +91,11 @@ export type AuthExtractWarning = {
 };
 /**
  * Map from role-constant name (e.g. `AUTH_ADMIN_ROLE`) to its resolved
- * role string (`'admin'`). The built-in roles populate this; downstream
- * apps that introduce their own role constants can extend the map at the
- * loader layer once that becomes a workflow.
+ * role string (`'admin'`). The built-in roles populate this. Role consts an
+ * app declares in its own scanned source are resolved automatically by
+ * {@link extractAuthEntries} (string-literal consts are merged into this map,
+ * array-aggregate consts are flattened on demand) — built-ins always win on
+ * conflict so a downstream file can never shadow a `@dereekb/util` role.
  */
 export type AuthExtractKnownRoles = ReadonlyMap<string, string>;
 /**

package/test/package.json

@@ -1,15 +1,15 @@
 {
   "name": "@dereekb/dbx-cli/test",
-  "version": "13.12.0",
+  "version": "13.12.2",
   "peerDependencies": {
-    "@dereekb/date": "13.12.0",
-    "@dereekb/dbx-cli": "13.12.0",
-    "@dereekb/firebase": "13.12.0",
-    "@dereekb/firebase-server/test": "13.12.0",
-    "@dereekb/model": "13.12.0",
-    "@dereekb/nestjs": "13.12.0",
-    "@dereekb/rxjs": "13.12.0",
-    "@dereekb/util": "13.12.0",
+    "@dereekb/date": "13.12.2",
+    "@dereekb/dbx-cli": "13.12.2",
+    "@dereekb/firebase": "13.12.2",
+    "@dereekb/firebase-server/test": "13.12.2",
+    "@dereekb/model": "13.12.2",
+    "@dereekb/nestjs": "13.12.2",
+    "@dereekb/rxjs": "13.12.2",
+    "@dereekb/util": "13.12.2",
     "@nestjs/common": "^11.1.19",
     "arktype": "^2.2.0",
     "yargs": "^18.0.0"

package/generate-mcp-manifest/src/generate-mcp-manifest/main.d.ts

@@ -1,26 +0,0 @@
-/**
- * Generates a pre-rendered MCP manifest JSON file from a generated CliApiManifest.
- *
- * Pipeline (build-time, run via `nx run <demo-api>:generate-mcp-manifest`):
- *
- *   1. Load the TS module passed via `--input`, expecting either an `<X>_API_MANIFEST`
- *      named export or a default export typed as `CliApiManifest`. The file is loaded
- *      via dynamic `import()` so it must compile under ESM — same as the demo-cli
- *      manifests written by `dbx-cli-generate-firebase-api-manifest`.
- *   2. Run the pure {@link renderMcpManifest} renderer to pre-merge descriptions,
- *      enrich the input JSON Schema with `paramsFields[]` descriptions, and
- *      synthesize an `outputSchema` from `resultFields[]`.
- *   3. Write the result to `<output>.tmp`, then `fs.renameSync` to `<output>` so
- *      partial files never land on disk.
- *
- * Flags:
- *   --input=<path>           (required) path to the *.api.manifest.generated.ts file.
- *                             Absolute or workspace-relative.
- *   --output=<path>          (required) destination JSON path (workspace-relative ok).
- *   --regenerate-input       Reserved for a future revision that will invoke
- *                             `dbx-cli-generate-firebase-api-manifest` first when the
- *                             input file is missing. Today this flag is accepted but
- *                             not honored; missing inputs still fail with a clear
- *                             pointer to the right manifest target.
- */
-export {};

package/generate-mcp-manifest/src/generate-mcp-manifest/render.d.ts

@@ -1,38 +0,0 @@
-import { type AuthRegistry, type CliApiManifest, type CliModelManifest, type McpManifest } from '@dereekb/dbx-cli';
-/**
- * Inputs to {@link renderMcpManifest}.
- */
-export interface RenderMcpManifestInput {
-    /**
-     * Generated API manifest used to render tool entries.
-     */
-    readonly apiManifest: CliApiManifest;
-    /**
-     * Optional generated model manifest. When present, projects each entry into
-     * the runtime {@link McpManifestModelEntry} shape and emits a `models` array
-     * on the output JSON for the runtime's built-in catalog tools.
-     */
-    readonly modelManifest?: CliModelManifest;
-    /**
-     * Optional auth registry + primary-app slug used to project the runtime
-     * `auth` section on the manifest. The renderer filters entries to the
-     * primary app's claim catalog (inherited claims like `fr` are included
-     * via the app's `claimKeys` list).
-     */
-    readonly auth?: {
-        readonly registry: AuthRegistry;
-        readonly app: string;
-    };
-}
-/**
- * Pure renderer: turns a {@link CliApiManifest} (and optional {@link CliModelManifest})
- * into the {@link McpManifest} JSON shape.
- *
- * No file I/O — the main entry handles writing. Skips `verb === 'standalone'` entries
- * (they aren't dispatched through callModel and have no MCP tool counterpart).
- *
- * @param input - The render config carrying the API manifest and optional model manifest.
- * @param now - Override for the `generatedAt` timestamp. Tests pass a fixed value.
- * @returns The rendered MCP manifest with tools keyed by {@link mcpManifestKey} and an optional models array.
- */
-export declare function renderMcpManifest(input: RenderMcpManifestInput, now?: Date): McpManifest;