@hotmeshio/long-tail 0.10.8 → 0.10.10

package/build/api/escalations/bulk.js

@@ -166,7 +166,7 @@ async function bulkAssign(input, auth) {
             }
             const result = await escalationService.bulkAssignEscalationsByQuery({ role: query.role, facets: query.facets }, targetUserId, durationMinutes ?? 30);
             if (result.assigned > 0)
-                (0, helpers_1.publishBulkClaimEvents)(result.ids, targetUserId);
+                (0, helpers_1.publishBulkClaimEvents)(result.ids, targetUserId, query.role);
             return { status: 200, data: { assigned: result.assigned, skipped: 0 } };
         }
         if (!(0, helpers_1.validateIds)(ids)) {
@@ -215,7 +215,13 @@ async function bulkEscalate(input, auth) {
         const perm = await (0, helpers_1.checkBulkPermission)(auth.userId, ids);
         if (!perm.allowed)
             return perm;
+        // Departing roles are read before the move so each reassignment can
+        // publish under BOTH queues — the one the row leaves and the one it
+        // joins (same contract as the single escalate path).
+        const beforeRows = await escalationService.getEscalationScopeRows(ids);
         const updated = await escalationService.bulkEscalateToRole(ids, targetRole);
+        if (updated > 0)
+            (0, helpers_1.publishBulkReassignEvents)(beforeRows, targetRole);
         return { status: 200, data: { updated } };
     }
     catch (err) {

package/build/api/escalations/helpers.d.ts

@@ -141,4 +141,13 @@ export declare function resolveAssignee(assignee: string | undefined, auth: {
  * Only adds the role if `provisionIfAbsent` declares it and caller has authority.
  */
 export declare function ensureRoleMembership(userId: string, requiredRole: string, callerUserId: string, provisionIfAbsent?: ProvisionIfAbsent): Promise<boolean>;
-export declare function publishBulkClaimEvents(ids: string[], assignedTo: string): void;
+/**
+ * Publish `reassigned` for a bulk role move: every row publishes under its
+ * departing role AND the target role, so subscribers scoped to either queue
+ * observe the move. Rows already in the target role publish once.
+ */
+export declare function publishBulkReassignEvents(beforeRows: Array<{
+    id: string;
+    role: string;
+}>, targetRole: string): void;
+export declare function publishBulkClaimEvents(ids: string[], assignedTo: string, knownRole?: string): void;

package/build/api/escalations/helpers.js

@@ -44,6 +44,7 @@ exports.assertQueueManageAccess = assertQueueManageAccess;
 exports.checkBulkPermission = checkBulkPermission;
 exports.resolveAssignee = resolveAssignee;
 exports.ensureRoleMembership = ensureRoleMembership;
+exports.publishBulkReassignEvents = publishBulkReassignEvents;
 exports.publishBulkClaimEvents = publishBulkClaimEvents;
 const escalationService = __importStar(require("../../services/escalation"));
 const userService = __importStar(require("../../services/user"));
@@ -254,17 +255,56 @@ async function ensureRoleMembership(userId, requiredRole, callerUserId, provisio
     catch { /* already has it */ }
     return true;
 }
-function publishBulkClaimEvents(ids, assignedTo) {
-    for (const id of ids) {
-        (0, publish_1.publishEscalationEvent)({
-            type: 'escalation.claimed',
-            source: 'api',
-            workflowId: '',
-            workflowName: '',
-            taskQueue: '',
-            escalationId: id,
-            status: 'claimed',
-            data: { assigned_to: assignedTo, bulk: true },
-        });
+/**
+ * Publish `reassigned` for a bulk role move: every row publishes under its
+ * departing role AND the target role, so subscribers scoped to either queue
+ * observe the move. Rows already in the target role publish once.
+ */
+function publishBulkReassignEvents(beforeRows, targetRole) {
+    for (const row of beforeRows) {
+        const roles = row.role && row.role !== targetRole ? [row.role, targetRole] : [targetRole];
+        for (const role of roles) {
+            (0, publish_1.publishEscalationEvent)({
+                type: 'escalation.reassigned',
+                source: 'api',
+                workflowId: '',
+                workflowName: '',
+                taskQueue: '',
+                escalationId: row.id,
+                role,
+                status: 'pending',
+                data: { from_role: row.role, to_role: targetRole, bulk: true },
+            });
+        }
     }
 }
+function publishBulkClaimEvents(ids, assignedTo, knownRole) {
+    // The claimed subject carries each row's role token. Query-form callers
+    // already know the single role; id-form callers resolve roles with one
+    // indexed read. Fire-and-forget, like every event publish.
+    void (async () => {
+        const roleById = new Map();
+        if (knownRole) {
+            for (const id of ids)
+                roleById.set(id, knownRole);
+        }
+        else {
+            const rows = await escalationService.getEscalationScopeRows(ids);
+            for (const row of rows)
+                roleById.set(row.id, row.role);
+        }
+        for (const id of ids) {
+            (0, publish_1.publishEscalationEvent)({
+                type: 'escalation.claimed',
+                source: 'api',
+                workflowId: '',
+                workflowName: '',
+                taskQueue: '',
+                escalationId: id,
+                role: roleById.get(id) ?? '',
+                status: 'claimed',
+                data: { assigned_to: assignedTo, bulk: true },
+            });
+        }
+    })().catch(() => { });
+}

package/build/api/index.d.ts

@@ -4,6 +4,7 @@ export * as workflows from './workflows';
 export * as yamlWorkflows from './yaml-workflows';
 export * as users from './users';
 export * as roles from './roles';
+export * as personas from './personas';
 export * as auth from './auth';
 export * as mcp from './mcp';
 export * as pipelines from './pipelines';

package/build/api/index.js

@@ -33,13 +33,14 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.maintenance = exports.namespaces = exports.dba = exports.workflowSets = exports.botAccounts = exports.controlplane = exports.exports = exports.settings = exports.insight = exports.mcpRuns = exports.pipelines = exports.mcp = exports.auth = exports.roles = exports.users = exports.yamlWorkflows = exports.workflows = exports.escalations = exports.tasks = void 0;
+exports.maintenance = exports.namespaces = exports.dba = exports.workflowSets = exports.botAccounts = exports.controlplane = exports.exports = exports.settings = exports.insight = exports.mcpRuns = exports.pipelines = exports.mcp = exports.auth = exports.personas = exports.roles = exports.users = exports.yamlWorkflows = exports.workflows = exports.escalations = exports.tasks = void 0;
 exports.tasks = __importStar(require("./tasks"));
 exports.escalations = __importStar(require("./escalations"));
 exports.workflows = __importStar(require("./workflows"));
 exports.yamlWorkflows = __importStar(require("./yaml-workflows"));
 exports.users = __importStar(require("./users"));
 exports.roles = __importStar(require("./roles"));
+exports.personas = __importStar(require("./personas"));
 exports.auth = __importStar(require("./auth"));
 exports.mcp = __importStar(require("./mcp"));
 exports.pipelines = __importStar(require("./pipelines"));

package/build/api/personas.d.ts

@@ -0,0 +1,121 @@
+import type { LTApiResult } from '../types/sdk';
+/**
+ * List all personas with their role links and holder counts.
+ *
+ * @returns `{ status: 200, data: { personas: LTPersonaRecord[] } }` on success
+ */
+export declare function listPersonas(): Promise<LTApiResult>;
+/**
+ * Retrieve a single persona by key, including its role links and assignees.
+ *
+ * @param input.key — the persona's stable key
+ * @returns `{ status: 200, data: LTPersonaRecord & { assignees } }` or 404
+ */
+export declare function getPersona(input: {
+    key: string;
+}): Promise<LTApiResult>;
+/**
+ * Create a persona. The key is trimmed, lowercased, and validated against
+ * `^[a-z][a-z0-9_-]*$` (the role-name alphabet).
+ *
+ * @returns `{ status: 201, data: LTPersonaRecord }` on success, 409 on duplicate key
+ */
+export declare function createPersona(input: {
+    key: string;
+    title?: string;
+    description?: string;
+}): Promise<LTApiResult>;
+/**
+ * Update a persona's title/description with PATCH semantics — omitted fields
+ * keep their values; null clears.
+ *
+ * @returns `{ status: 200, data: LTPersonaRecord }` or 404
+ */
+export declare function updatePersona(input: {
+    key: string;
+    title?: string | null;
+    description?: string | null;
+}): Promise<LTApiResult>;
+/**
+ * Delete a persona. Memberships it sustains are removed (or re-homed to a
+ * sibling persona the user still holds); direct grants are never touched.
+ *
+ * @returns `{ status: 200, data: { deleted: true, recompute } }` or 404
+ */
+export declare function deletePersona(input: {
+    key: string;
+}): Promise<LTApiResult>;
+/**
+ * Link a role to a persona (or change the link's relationship). Every current
+ * holder's memberships are reconciled in the same transaction.
+ *
+ * @param input.relationship — write-all | write-self | read-all (write-none = read-all)
+ * @returns `{ status: 201, data: { role, relationship, recompute } }` or 404
+ */
+export declare function linkPersonaRole(input: {
+    key: string;
+    role: string;
+    relationship: string;
+}): Promise<LTApiResult>;
+/**
+ * Unlink a role from a persona and reconcile every holder's memberships.
+ *
+ * @returns `{ status: 200, data: { unlinked: true, recompute } }` or 404
+ */
+export declare function unlinkPersonaRole(input: {
+    key: string;
+    role: string;
+}): Promise<LTApiResult>;
+/**
+ * Assign a persona to a user — shorthand for adding the user to each linked
+ * role at the linked scope. Idempotent: re-assigning overlays fresh from the
+ * persona's current links. Direct grants are only ever raised, never lowered.
+ *
+ * @param input.id — the user's unique identifier
+ * @param input.key — the persona key
+ * @returns `{ status: 200, data: { assigned: true, recompute } }` or 404
+ */
+export declare function assignPersona(input: {
+    id: string;
+    key: string;
+}): Promise<LTApiResult>;
+/**
+ * Unassign a persona from a user. Removes only the memberships the persona
+ * sustains; memberships another held persona still grants are re-homed to it,
+ * and direct grants are never touched.
+ *
+ * @returns `{ status: 200, data: { unassigned: true, recompute } }` or 404
+ */
+export declare function unassignPersona(input: {
+    id: string;
+    key: string;
+}): Promise<LTApiResult>;
+/**
+ * The personas a user holds plus the composed role/scope map their memberships
+ * form (each row names the sustaining persona, or null for a direct grant).
+ *
+ * @returns `{ status: 200, data: { personas, roles } }` on success
+ */
+export declare function getUserPersonas(input: {
+    id: string;
+}): Promise<LTApiResult>;
+/**
+ * Declarative, idempotent persona seeding — the static-config twin of the API
+ * surface. Each spec is authoritative for its persona: title/description
+ * overlaid, role links synced (absent links pruned), linked roles ensured, and
+ * every holder reconciled so re-running the seed re-applies edits.
+ *
+ * @param input.personas — array of { key, title?, description?, roles: [{ role, relationship }] }
+ * @returns `{ status: 200, data: { personas, links, recompute } }` on success
+ */
+export declare function seedPersonas(input: {
+    personas: {
+        key: string;
+        title?: string;
+        description?: string;
+        roles?: {
+            role: string;
+            relationship: string;
+        }[];
+    }[];
+}): Promise<LTApiResult>;

package/build/api/personas.js

@@ -0,0 +1,341 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.listPersonas = listPersonas;
+exports.getPersona = getPersona;
+exports.createPersona = createPersona;
+exports.updatePersona = updatePersona;
+exports.deletePersona = deletePersona;
+exports.linkPersonaRole = linkPersonaRole;
+exports.unlinkPersonaRole = unlinkPersonaRole;
+exports.assignPersona = assignPersona;
+exports.unassignPersona = unassignPersona;
+exports.getUserPersonas = getUserPersonas;
+exports.seedPersonas = seedPersonas;
+const personaService = __importStar(require("../services/persona"));
+/** Persona keys share the role-name alphabet: kebab/underscore, letter-first. */
+const PERSONA_KEY = /^[a-z][a-z0-9_-]*$/;
+function validateKey(key) {
+    if (typeof key !== 'string' || !key.trim())
+        return null;
+    const trimmed = key.trim().toLowerCase();
+    return PERSONA_KEY.test(trimmed) ? trimmed : null;
+}
+const RELATIONSHIP_ERROR = 'relationship must be write-all, write-self, or read-all (write-none is accepted as read-all)';
+/**
+ * List all personas with their role links and holder counts.
+ *
+ * @returns `{ status: 200, data: { personas: LTPersonaRecord[] } }` on success
+ */
+async function listPersonas() {
+    try {
+        const personas = await personaService.listPersonas();
+        return { status: 200, data: { personas } };
+    }
+    catch (err) {
+        return { status: 500, error: err.message };
+    }
+}
+/**
+ * Retrieve a single persona by key, including its role links and assignees.
+ *
+ * @param input.key — the persona's stable key
+ * @returns `{ status: 200, data: LTPersonaRecord & { assignees } }` or 404
+ */
+async function getPersona(input) {
+    try {
+        if (!input.key) {
+            return { status: 400, error: 'key is required' };
+        }
+        const persona = await personaService.getPersona(input.key);
+        if (!persona) {
+            return { status: 404, error: `Persona '${input.key}' not found` };
+        }
+        return { status: 200, data: persona };
+    }
+    catch (err) {
+        return { status: 500, error: err.message };
+    }
+}
+/**
+ * Create a persona. The key is trimmed, lowercased, and validated against
+ * `^[a-z][a-z0-9_-]*$` (the role-name alphabet).
+ *
+ * @returns `{ status: 201, data: LTPersonaRecord }` on success, 409 on duplicate key
+ */
+async function createPersona(input) {
+    try {
+        const key = validateKey(input.key);
+        if (!key) {
+            return {
+                status: 400,
+                error: 'key must start with a letter and contain only lowercase letters, numbers, hyphens, and underscores',
+            };
+        }
+        const persona = await personaService.createPersona({
+            key,
+            title: input.title,
+            description: input.description,
+        });
+        return { status: 201, data: persona };
+    }
+    catch (err) {
+        if (err.code === '23505') {
+            return { status: 409, error: 'Persona with this key already exists' };
+        }
+        return { status: 500, error: err.message };
+    }
+}
+/**
+ * Update a persona's title/description with PATCH semantics — omitted fields
+ * keep their values; null clears.
+ *
+ * @returns `{ status: 200, data: LTPersonaRecord }` or 404
+ */
+async function updatePersona(input) {
+    try {
+        if (!input.key) {
+            return { status: 400, error: 'key is required' };
+        }
+        const persona = await personaService.updatePersona(input.key, {
+            title: input.title,
+            description: input.description,
+        });
+        if (!persona) {
+            return { status: 404, error: `Persona '${input.key}' not found` };
+        }
+        return { status: 200, data: persona };
+    }
+    catch (err) {
+        return { status: 500, error: err.message };
+    }
+}
+/**
+ * Delete a persona. Memberships it sustains are removed (or re-homed to a
+ * sibling persona the user still holds); direct grants are never touched.
+ *
+ * @returns `{ status: 200, data: { deleted: true, recompute } }` or 404
+ */
+async function deletePersona(input) {
+    try {
+        if (!input.key) {
+            return { status: 400, error: 'key is required' };
+        }
+        const result = await personaService.deletePersona(input.key);
+        if (!result.deleted) {
+            return { status: 404, error: `Persona '${input.key}' not found` };
+        }
+        return { status: 200, data: { deleted: true, recompute: result.recompute } };
+    }
+    catch (err) {
+        return { status: 500, error: err.message };
+    }
+}
+/**
+ * Link a role to a persona (or change the link's relationship). Every current
+ * holder's memberships are reconciled in the same transaction.
+ *
+ * @param input.relationship — write-all | write-self | read-all (write-none = read-all)
+ * @returns `{ status: 201, data: { role, relationship, recompute } }` or 404
+ */
+async function linkPersonaRole(input) {
+    try {
+        if (!input.key || !input.role) {
+            return { status: 400, error: 'key and role are required' };
+        }
+        const role = input.role.trim().toLowerCase();
+        if (!PERSONA_KEY.test(role)) {
+            return {
+                status: 400,
+                error: 'Role must start with a letter and contain only lowercase letters, numbers, hyphens, and underscores',
+            };
+        }
+        const relationship = personaService.normalizeRelationship(input.relationship ?? '');
+        if (!relationship) {
+            return { status: 400, error: RELATIONSHIP_ERROR };
+        }
+        const result = await personaService.linkPersonaRole(input.key, role, relationship);
+        if (!result) {
+            return { status: 404, error: `Persona '${input.key}' not found` };
+        }
+        return { status: 201, data: result };
+    }
+    catch (err) {
+        return { status: 500, error: err.message };
+    }
+}
+/**
+ * Unlink a role from a persona and reconcile every holder's memberships.
+ *
+ * @returns `{ status: 200, data: { unlinked: true, recompute } }` or 404
+ */
+async function unlinkPersonaRole(input) {
+    try {
+        if (!input.key || !input.role) {
+            return { status: 400, error: 'key and role are required' };
+        }
+        const result = await personaService.unlinkPersonaRole(input.key, input.role);
+        if (!result.personaFound) {
+            return { status: 404, error: `Persona '${input.key}' not found` };
+        }
+        if (!result.unlinked) {
+            return { status: 404, error: `Persona '${input.key}' does not link role '${input.role}'` };
+        }
+        return { status: 200, data: { unlinked: true, recompute: result.recompute } };
+    }
+    catch (err) {
+        return { status: 500, error: err.message };
+    }
+}
+/**
+ * Assign a persona to a user — shorthand for adding the user to each linked
+ * role at the linked scope. Idempotent: re-assigning overlays fresh from the
+ * persona's current links. Direct grants are only ever raised, never lowered.
+ *
+ * @param input.id — the user's unique identifier
+ * @param input.key — the persona key
+ * @returns `{ status: 200, data: { assigned: true, recompute } }` or 404
+ */
+async function assignPersona(input) {
+    try {
+        if (!input.id || !input.key) {
+            return { status: 400, error: 'user id and persona key are required' };
+        }
+        const recompute = await personaService.assignPersona(input.id, input.key);
+        if (!recompute) {
+            return { status: 404, error: `Persona '${input.key}' not found` };
+        }
+        return { status: 200, data: { assigned: true, recompute } };
+    }
+    catch (err) {
+        if (err.code === '23503') {
+            return { status: 404, error: 'User not found' };
+        }
+        if (err.code === '22P02') {
+            return { status: 400, error: 'user id must be a UUID' };
+        }
+        return { status: 500, error: err.message };
+    }
+}
+/**
+ * Unassign a persona from a user. Removes only the memberships the persona
+ * sustains; memberships another held persona still grants are re-homed to it,
+ * and direct grants are never touched.
+ *
+ * @returns `{ status: 200, data: { unassigned: true, recompute } }` or 404
+ */
+async function unassignPersona(input) {
+    try {
+        if (!input.id || !input.key) {
+            return { status: 400, error: 'user id and persona key are required' };
+        }
+        const result = await personaService.unassignPersona(input.id, input.key);
+        if (!result.personaFound) {
+            return { status: 404, error: `Persona '${input.key}' not found` };
+        }
+        if (!result.unassigned) {
+            return { status: 404, error: `User does not hold persona '${input.key}'` };
+        }
+        return { status: 200, data: { unassigned: true, recompute: result.recompute } };
+    }
+    catch (err) {
+        if (err.code === '22P02') {
+            return { status: 400, error: 'user id must be a UUID' };
+        }
+        return { status: 500, error: err.message };
+    }
+}
+/**
+ * The personas a user holds plus the composed role/scope map their memberships
+ * form (each row names the sustaining persona, or null for a direct grant).
+ *
+ * @returns `{ status: 200, data: { personas, roles } }` on success
+ */
+async function getUserPersonas(input) {
+    try {
+        if (!input.id) {
+            return { status: 400, error: 'user id is required' };
+        }
+        const result = await personaService.getUserPersonas(input.id);
+        return { status: 200, data: result };
+    }
+    catch (err) {
+        if (err.code === '22P02') {
+            return { status: 400, error: 'user id must be a UUID' };
+        }
+        return { status: 500, error: err.message };
+    }
+}
+/**
+ * Declarative, idempotent persona seeding — the static-config twin of the API
+ * surface. Each spec is authoritative for its persona: title/description
+ * overlaid, role links synced (absent links pruned), linked roles ensured, and
+ * every holder reconciled so re-running the seed re-applies edits.
+ *
+ * @param input.personas — array of { key, title?, description?, roles: [{ role, relationship }] }
+ * @returns `{ status: 200, data: { personas, links, recompute } }` on success
+ */
+async function seedPersonas(input) {
+    try {
+        if (!Array.isArray(input.personas)) {
+            return { status: 400, error: 'personas must be an array of persona specs' };
+        }
+        const specs = [];
+        for (const spec of input.personas) {
+            const key = validateKey(spec?.key);
+            if (!key) {
+                return { status: 400, error: `Invalid persona key: '${spec?.key}'` };
+            }
+            const roles = [];
+            for (const link of spec.roles ?? []) {
+                const role = validateKey(link?.role);
+                if (!role) {
+                    return { status: 400, error: `Persona '${key}': invalid role '${link?.role}'` };
+                }
+                const relationship = personaService.normalizeRelationship(link?.relationship ?? '');
+                if (!relationship) {
+                    return { status: 400, error: `Persona '${key}', role '${role}': ${RELATIONSHIP_ERROR}` };
+                }
+                roles.push({ role, relationship });
+            }
+            specs.push({ key, title: spec.title, description: spec.description, roles });
+        }
+        const result = await personaService.seedPersonas(specs);
+        return { status: 200, data: result };
+    }
+    catch (err) {
+        return { status: 500, error: err.message };
+    }
+}

package/build/bin/ltc.js

@@ -55,6 +55,7 @@ const kb = __importStar(require("../lib/cli/commands/knowledge"));
 const mcp = __importStar(require("../lib/cli/commands/mcp"));
 const usr = __importStar(require("../lib/cli/commands/users"));
 const roles = __importStar(require("../lib/cli/commands/roles"));
+const personas = __importStar(require("../lib/cli/commands/personas"));
 const streams = __importStar(require("../lib/cli/commands/streams"));
 const pkg = require('../package.json');
 const envPath = path.resolve(process.cwd(), '.env');
@@ -309,6 +310,28 @@ rolesCmd.command('save-schema <role>')
     .option('--summary <text>', 'Change summary recorded on the new version')
     .option('--json', 'JSON output')
     .action(wrap(roles.saveRoleSchema));
+// ── Personas ─────────────────────────────────────────────────────────────
+const personasCmd = commander_1.program.command('personas').description('Personas — named role bundles with per-role relationship scope');
+personasCmd.command('list')
+    .option('--json', 'JSON output')
+    .option('-q, --quiet', 'Keys only')
+    .action(wrap(personas.listPersonas));
+personasCmd.command('get <key>')
+    .description('Show a persona with its role links and assignees')
+    .option('--json', 'JSON output')
+    .action(wrap(personas.getPersona));
+personasCmd.command('assign <key> <userId>')
+    .description('Assign a persona to a user (idempotent; re-assigning overlays fresh)')
+    .option('--json', 'JSON output')
+    .action(wrap(personas.assignPersona));
+personasCmd.command('unassign <key> <userId>')
+    .description('Unassign a persona — removes only the memberships it sustains')
+    .option('--json', 'JSON output')
+    .action(wrap(personas.unassignPersona));
+personasCmd.command('for-user <userId>')
+    .description('Show the personas a user holds and the composed role/scope map')
+    .option('--json', 'JSON output')
+    .action(wrap(personas.getUserPersonas));
 // ── Streams ─────────────────────────────────────────────────────────────
 const streamsCmd = commander_1.program.command('streams').description('Browse stream messages (admin)');
 streamsCmd.command('list')

package/build/lib/cli/commands/personas.d.ts

@@ -0,0 +1,16 @@
+export declare function listPersonas(opts: {
+    json?: boolean;
+    quiet?: boolean;
+}): Promise<void>;
+export declare function getPersona(key: string, opts: {
+    json?: boolean;
+}): Promise<void>;
+export declare function assignPersona(key: string, userId: string, opts: {
+    json?: boolean;
+}): Promise<void>;
+export declare function unassignPersona(key: string, userId: string, opts: {
+    json?: boolean;
+}): Promise<void>;
+export declare function getUserPersonas(userId: string, opts: {
+    json?: boolean;
+}): Promise<void>;