@nebulr-group/bridge-cli 0.4.0 → 0.4.2

package/dist/output.js

@@ -1,5 +1,6 @@
 import { HttpError } from '@nebulr-group/bridge-auth-core';
 import { ConfigError } from './config.js';
+import { ADMIN_SCOPE_PRIVILEGES } from './auth/scopes.js';
 export function outputSuccess(data) {
     const output = { success: true, data };
     process.stdout.write(JSON.stringify(output, null, 2) + '\n');
@@ -14,10 +15,26 @@ export function outputSuccess(data) {
 export function outputPrompt(content) {
     process.stdout.write(content.endsWith('\n') ? content : content + '\n');
 }
+/**
+ * Turn "Privilege 'TOKEN_WRITE' required" into something the reader can act
+ * on. Without this the message is a dead end: it names a privilege but not how
+ * to obtain one, and the answer ("log in again, differently") is not guessable.
+ */
+export function privilegeHint(message) {
+    const match = /Privilege '([A-Z_]+)' required/.exec(message);
+    const privilege = match?.[1];
+    if (!privilege || !ADMIN_SCOPE_PRIVILEGES.has(privilege))
+        return undefined;
+    return (`Your login token does not carry ${privilege}. ` +
+        'Re-authenticate with `bridge auth login --admin` to request delete authority ' +
+        'and the ability to create API tokens. The default login deliberately omits ' +
+        'them — the token is stored on disk and lives for 10 days.');
+}
 export function outputError(error) {
     let code = 'UNKNOWN_ERROR';
     let message = 'An unknown error occurred';
     let details = undefined;
+    let hint;
     let exitCode = 1;
     if (error instanceof ConfigError) {
         code = 'CONFIG_ERROR';
@@ -33,11 +50,34 @@ export function outputError(error) {
         if (typeof error.body === 'object' && error.body && 'nblocksCode' in error.body) {
             code = error.body.nblocksCode;
         }
+        if (error.status === 403) {
+            // The server's message is the authoritative one; check the body too,
+            // since the privilege name sometimes only appears there.
+            const bodyMessage = typeof error.body === 'object' && error.body && 'message' in error.body
+                ? String(error.body.message)
+                : '';
+            hint = privilegeHint(message) ?? privilegeHint(bodyMessage);
+        }
     }
     else if (error instanceof Error) {
         message = error.message;
+        // TBP-586: errors that carry their own machine-readable `code` (e.g.
+        // ResolveError's FLAG_NOT_FOUND / TENANT_AMBIGUOUS / INVALID_OPTIONS)
+        // report it instead of collapsing to UNKNOWN_ERROR.
+        const carried = error.code;
+        if (typeof carried === 'string' && carried.length > 0) {
+            code = carried;
+        }
     }
-    const output = { success: false, error: { code, message, ...(details !== undefined ? { details } : {}) } };
+    const output = {
+        success: false,
+        error: {
+            code,
+            message,
+            ...(hint !== undefined ? { hint } : {}),
+            ...(details !== undefined ? { details } : {}),
+        },
+    };
     process.stderr.write(JSON.stringify(output, null, 2) + '\n');
     process.exitCode = exitCode;
 }

package/dist/output.js.map

@@ -1 +1 @@
-{"version":3,"file":"output.js","sourceRoot":"","sources":["../src/output.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,UAAU,aAAa,CAAC,IAAa;IACzC,MAAM,MAAM,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACvC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,IAAI,IAAI,GAAG,eAAe,CAAC;IAC3B,IAAI,OAAO,GAAG,2BAA2B,CAAC;IAC1C,IAAI,OAAO,GAAY,SAAS,CAAC;IACjC,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;QACjC,IAAI,GAAG,cAAc,CAAC;QACtB,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QACxB,QAAQ,GAAG,CAAC,CAAC;IACf,CAAC;SAAM,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;QACtC,IAAI,GAAG,QAAQ,KAAK,CAAC,MAAM,EAAE,CAAC;QAC9B,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QACxB,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC;QACrB,QAAQ,GAAG,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAEvC,iCAAiC;QACjC,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,IAAI,aAAa,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YAChF,IAAI,GAAI,KAAK,CAAC,IAA+B,CAAC,WAAW,CAAC;QAC5D,CAAC;IACH,CAAC;SAAM,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAClC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC1B,CAAC;IAED,MAAM,MAAM,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;IAC3G,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC7D,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC;AAC9B,CAAC"}
+{"version":3,"file":"output.js","sourceRoot":"","sources":["../src/output.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,MAAM,UAAU,aAAa,CAAC,IAAa;IACzC,MAAM,MAAM,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACvC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;AAC1E,CAAC;AAGD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,KAAK,GAAG,gCAAgC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,CAAC,SAAS,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3E,OAAO,CACL,mCAAmC,SAAS,IAAI;QAChD,+EAA+E;QAC/E,6EAA6E;QAC7E,2DAA2D,CAC5D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,IAAI,IAAI,GAAG,eAAe,CAAC;IAC3B,IAAI,OAAO,GAAG,2BAA2B,CAAC;IAC1C,IAAI,OAAO,GAAY,SAAS,CAAC;IACjC,IAAI,IAAwB,CAAC;IAC7B,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;QACjC,IAAI,GAAG,cAAc,CAAC;QACtB,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QACxB,QAAQ,GAAG,CAAC,CAAC;IACf,CAAC;SAAM,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;QACtC,IAAI,GAAG,QAAQ,KAAK,CAAC,MAAM,EAAE,CAAC;QAC9B,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QACxB,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC;QACrB,QAAQ,GAAG,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAEvC,iCAAiC;QACjC,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,IAAI,aAAa,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YAChF,IAAI,GAAI,KAAK,CAAC,IAA+B,CAAC,WAAW,CAAC;QAC5D,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACzB,qEAAqE;YACrE,yDAAyD;YACzD,MAAM,WAAW,GACf,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,IAAI,SAAS,IAAI,KAAK,CAAC,IAAI;gBACrE,CAAC,CAAC,MAAM,CAAE,KAAK,CAAC,IAAgC,CAAC,OAAO,CAAC;gBACzD,CAAC,CAAC,EAAE,CAAC;YACT,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,aAAa,CAAC,WAAW,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;SAAM,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAClC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QACxB,qEAAqE;QACrE,sEAAsE;QACtE,oDAAoD;QACpD,MAAM,OAAO,GAAI,KAA4B,CAAC,IAAI,CAAC;QACnD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtD,IAAI,GAAG,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG;QACb,OAAO,EAAE,KAAK;QACd,KAAK,EAAE;YACL,IAAI;YACJ,OAAO;YACP,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9C;KACF,CAAC;IACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC7D,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC;AAC9B,CAAC"}

package/dist/prompt-urls.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Single source of truth for every raw.githubusercontent.com URL the CLI builds.
+ *
+ * TBP-585: `bridge integrate` and `bridge guide` each hardcoded their own copy
+ * of the base URL and drifted — integrate pointed at the wrong GitHub org
+ * (`nebulr-group`) *and* the wrong path (missing the nested package dir), so its
+ * remote fallback was a permanent 404. The fallback is invisible in normal use
+ * (an installed CLI reads the bundled prompt first), which is exactly why it
+ * must be derived rather than retyped.
+ *
+ * Nothing outside this module should contain a raw.githubusercontent literal;
+ * `src/__tests__/prompt-urls.test.ts` enforces that.
+ */
+/** GitHub org that owns every Bridge repo the CLI reads content from. */
+export declare const GITHUB_RAW_BASE_URL = "https://raw.githubusercontent.com/thebridgedev";
+/**
+ * The published npm package lives in a `bridge-cli/` subdirectory of the
+ * `bridge-cli` repo — hence the doubled segment. Dropping it yields a 404.
+ */
+export declare const CLI_PROMPTS_BASE_URL = "https://raw.githubusercontent.com/thebridgedev/bridge-cli/main/bridge-cli/prompts";
+/** URL of a prompt bundled in this repo, e.g. cliPromptUrl('flags', 'master.md'). */
+export declare function cliPromptUrl(...segments: string[]): string;
+/**
+ * URL of a per-framework prompt owned by a plugin repo. `repoPrefix` is the
+ * `<repo>/<ref>` pair from GUIDE_REPOS, e.g. `bridge-svelte/main`.
+ */
+export declare function pluginGuideUrl(repoPrefix: string, filename: string): string;
+/** Master auth integration prompt — shared by `bridge integrate` and `bridge guide`. */
+export declare const AUTH_MASTER_PROMPT_FILENAME = "auth-master-integration-prompt.md";
+export declare const AUTH_MASTER_PROMPT_URL: string;
+//# sourceMappingURL=prompt-urls.d.ts.map

package/dist/prompt-urls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt-urls.d.ts","sourceRoot":"","sources":["../src/prompt-urls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,yEAAyE;AACzE,eAAO,MAAM,mBAAmB,mDAAmD,CAAC;AAEpF;;;GAGG;AACH,eAAO,MAAM,oBAAoB,sFAA8D,CAAC;AAEhG,qFAAqF;AACrF,wBAAgB,YAAY,CAAC,GAAG,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAE1D;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE3E;AAED,wFAAwF;AACxF,eAAO,MAAM,2BAA2B,sCAAsC,CAAC;AAC/E,eAAO,MAAM,sBAAsB,QAA4C,CAAC"}

package/dist/prompt-urls.js

@@ -0,0 +1,35 @@
+/**
+ * Single source of truth for every raw.githubusercontent.com URL the CLI builds.
+ *
+ * TBP-585: `bridge integrate` and `bridge guide` each hardcoded their own copy
+ * of the base URL and drifted — integrate pointed at the wrong GitHub org
+ * (`nebulr-group`) *and* the wrong path (missing the nested package dir), so its
+ * remote fallback was a permanent 404. The fallback is invisible in normal use
+ * (an installed CLI reads the bundled prompt first), which is exactly why it
+ * must be derived rather than retyped.
+ *
+ * Nothing outside this module should contain a raw.githubusercontent literal;
+ * `src/__tests__/prompt-urls.test.ts` enforces that.
+ */
+/** GitHub org that owns every Bridge repo the CLI reads content from. */
+export const GITHUB_RAW_BASE_URL = 'https://raw.githubusercontent.com/thebridgedev';
+/**
+ * The published npm package lives in a `bridge-cli/` subdirectory of the
+ * `bridge-cli` repo — hence the doubled segment. Dropping it yields a 404.
+ */
+export const CLI_PROMPTS_BASE_URL = `${GITHUB_RAW_BASE_URL}/bridge-cli/main/bridge-cli/prompts`;
+/** URL of a prompt bundled in this repo, e.g. cliPromptUrl('flags', 'master.md'). */
+export function cliPromptUrl(...segments) {
+    return [CLI_PROMPTS_BASE_URL, ...segments].join('/');
+}
+/**
+ * URL of a per-framework prompt owned by a plugin repo. `repoPrefix` is the
+ * `<repo>/<ref>` pair from GUIDE_REPOS, e.g. `bridge-svelte/main`.
+ */
+export function pluginGuideUrl(repoPrefix, filename) {
+    return `${GITHUB_RAW_BASE_URL}/${repoPrefix}/mcp/${filename}`;
+}
+/** Master auth integration prompt — shared by `bridge integrate` and `bridge guide`. */
+export const AUTH_MASTER_PROMPT_FILENAME = 'auth-master-integration-prompt.md';
+export const AUTH_MASTER_PROMPT_URL = cliPromptUrl(AUTH_MASTER_PROMPT_FILENAME);
+//# sourceMappingURL=prompt-urls.js.map

package/dist/prompt-urls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt-urls.js","sourceRoot":"","sources":["../src/prompt-urls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,yEAAyE;AACzE,MAAM,CAAC,MAAM,mBAAmB,GAAG,gDAAgD,CAAC;AAEpF;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,mBAAmB,qCAAqC,CAAC;AAEhG,qFAAqF;AACrF,MAAM,UAAU,YAAY,CAAC,GAAG,QAAkB;IAChD,OAAO,CAAC,oBAAoB,EAAE,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,UAAkB,EAAE,QAAgB;IACjE,OAAO,GAAG,mBAAmB,IAAI,UAAU,QAAQ,QAAQ,EAAE,CAAC;AAChE,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,MAAM,2BAA2B,GAAG,mCAAmC,CAAC;AAC/E,MAAM,CAAC,MAAM,sBAAsB,GAAG,YAAY,CAAC,2BAA2B,CAAC,CAAC"}

package/dist/resolve.d.ts

@@ -0,0 +1,97 @@
+/**
+ * Error carrying a stable machine-readable `code`, so `outputError` can emit
+ * something better than UNKNOWN_ERROR for resolution failures.
+ */
+export declare class ResolveError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+export interface ResolveSpec<T> {
+    /** Capitalised singular noun used in messages, e.g. `'Flag'`. */
+    noun: string;
+    /** Flag the user types to address by id, e.g. `'--id'` or `'--user-id'`. */
+    idOption: string;
+    /** Flag the user types to address by key, e.g. `'--key'`, `'--email'`. */
+    keyOption: string;
+    /** What the key option holds, in prose: `'key'`, `'name'`, `'email'`. */
+    keyLabel: string;
+    /** Command that lists the candidates, e.g. `'bridge flag list'`. */
+    listCommand: string;
+    /** Fetches every candidate. Only called when resolving by key. */
+    list: () => Promise<T[]>;
+    idOf: (item: T) => string;
+    /** The item's key; `undefined` when the item has none (skipped in matching). */
+    keyOf: (item: T) => string | undefined;
+    /**
+     * Comparison normaliser. Defaults to identity (exact, case-sensitive).
+     * Emails pass `(s) => s.toLowerCase()`.
+     */
+    normalize?: (value: string) => string;
+    /** One-line rendering of a candidate, used in the ambiguity error. */
+    describe?: (item: T) => string;
+}
+export interface ResolveTarget {
+    id?: string;
+    key?: string;
+}
+/**
+ * Turn `{ id }` or `{ key }` into an id.
+ *
+ * - both supplied  → INVALID_OPTIONS
+ * - neither        → INVALID_OPTIONS, naming both options
+ * - id supplied    → returned as-is (no network call)
+ * - key supplied   → one `list()` call, then exact-match on the key
+ *   - 0 matches    → `<NOUN>_NOT_FOUND`, naming the list command
+ *   - >1 matches   → `<NOUN>_AMBIGUOUS`, listing every candidate. Nothing acts.
+ */
+export declare function resolveResourceId<T>(target: ResolveTarget, spec: ResolveSpec<T>): Promise<string>;
+/** `bridge flag …` — flag keys are unique. */
+export declare function resolveFlagId(target: ResolveTarget): Promise<string>;
+/** `bridge role …` — role keys are unique (e.g. ADMIN). */
+export declare function resolveRoleId(target: ResolveTarget): Promise<string>;
+/**
+ * `bridge tenant …` — tenants have NO key field. `name` is optional and the
+ * platform does not enforce uniqueness on it, so a duplicate name is a real
+ * possibility and always fails loudly rather than picking one.
+ */
+export declare function resolveTenantIdByName(target: ResolveTarget): Promise<string>;
+/**
+ * `bridge user …` — users have no key either; email is the natural
+ * human-readable identifier and is unique within a tenant. Matched
+ * case-insensitively, as email addresses are.
+ */
+export declare function resolveUserId(target: ResolveTarget, tenantId: string): Promise<string>;
+/**
+ * TBP-592 — turn privilege KEYS into the ids `POST/PUT /account/role` stores.
+ *
+ * `--privileges` is documented as taking keys, and keys are the only form a
+ * human or agent has: they are what `bridge role list` prints and what the app
+ * is designed around. But `role.model.ts` types `privileges` as
+ * `Types.ObjectId[]` and resolves them with `findByIdsAndApp`, so a key
+ * resolved to nothing, the array came back empty, and the model's pre-save
+ * hook threw "A role needs at least one privilege".
+ *
+ * That error is the real cost. It reads as "you passed none" when the truth is
+ * "the ones you passed were dropped", and nothing in it points at keys-vs-ids —
+ * the only way to find out was to read the model.
+ *
+ * So: resolve here, and make an unknown identifier a hard failure that NAMES
+ * the offenders. Silently dropping one privilege out of ten would create a role
+ * that looks right and under-permits, which is worse than any error.
+ *
+ * Ids are still accepted and passed through untouched. Mixed input works. That
+ * keeps `--privileges` honest for scripts that already pass ids, and means no
+ * caller has to know which form the API wants.
+ */
+export declare function resolvePrivilegeIds(identifiers: string[]): Promise<string[]>;
+/**
+ * `bridge privilege …` — privilege keys are unique within an app, so a key
+ * addresses exactly one. Same shape as `resolveRoleId`.
+ */
+export declare function resolvePrivilegeId(target: ResolveTarget): Promise<string>;
+/**
+ * `bridge token …` — API tokens have no key; `name` is free text and is NOT
+ * enforced unique, so two tokens can legitimately share one.
+ */
+export declare function resolveTokenIdByName(target: ResolveTarget): Promise<string>;
+//# sourceMappingURL=resolve.d.ts.map

package/dist/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../src/resolve.ts"],"names":[],"mappings":"AAkBA;;;GAGG;AACH,qBAAa,YAAa,SAAQ,KAAK;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBAEV,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAK1C;AAED,MAAM,WAAW,WAAW,CAAC,CAAC;IAC5B,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;IAClB,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAC;IACjB,oEAAoE;IACpE,WAAW,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IACzB,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,MAAM,CAAC;IAC1B,gFAAgF;IAChF,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,MAAM,GAAG,SAAS,CAAC;IACvC;;;OAGG;IACH,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;IACtC,sEAAsE;IACtE,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAQD;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,GACnB,OAAO,CAAC,MAAM,CAAC,CA+CjB;AAOD,8CAA8C;AAC9C,wBAAgB,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAYpE;AAED,2DAA2D;AAC3D,wBAAgB,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAYpE;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAe5E;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CActF;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAmClF;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAYzE;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAa3E"}

package/dist/resolve.js

@@ -0,0 +1,233 @@
+// TBP-586 — Address resources by their human-readable key, not just by id.
+//
+// Most write commands used to take an opaque `--id` only, which forced every
+// caller (agent or human) to run a `list` first and pair the right id with the
+// right name by hand. This module is the single place that turns a
+// human-readable identifier into an id, so every noun behaves the same way.
+//
+// Semantics mirror the MCP layer's `toggle_feature_flag`
+// (bridge-api/microservices/account/nebulr-api/mcp/tools/flags.ts): list, find
+// by key, act — with two additions the CLI needs:
+//
+//   * exactly one of the id option / key option must be supplied, and
+//   * a key that matches MORE THAN ONE resource is a hard failure that lists
+//     the candidates. Never guess. Silently deleting the wrong tenant because
+//     two of them share a name is the worst outcome this module can produce.
+import { getManagementClient } from './config.js';
+/**
+ * Error carrying a stable machine-readable `code`, so `outputError` can emit
+ * something better than UNKNOWN_ERROR for resolution failures.
+ */
+export class ResolveError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = 'ResolveError';
+        this.code = code;
+    }
+}
+const CODE_SAFE = /[^A-Z0-9]+/g;
+function codeFor(noun, suffix) {
+    return `${noun.toUpperCase().replace(CODE_SAFE, '_')}_${suffix}`;
+}
+/**
+ * Turn `{ id }` or `{ key }` into an id.
+ *
+ * - both supplied  → INVALID_OPTIONS
+ * - neither        → INVALID_OPTIONS, naming both options
+ * - id supplied    → returned as-is (no network call)
+ * - key supplied   → one `list()` call, then exact-match on the key
+ *   - 0 matches    → `<NOUN>_NOT_FOUND`, naming the list command
+ *   - >1 matches   → `<NOUN>_AMBIGUOUS`, listing every candidate. Nothing acts.
+ */
+export async function resolveResourceId(target, spec) {
+    const { id, key } = target;
+    const hasId = id !== undefined && id !== '';
+    const hasKey = key !== undefined && key !== '';
+    if (hasId && hasKey) {
+        throw new ResolveError('INVALID_OPTIONS', `Pass either ${spec.idOption} or ${spec.keyOption}, not both.`);
+    }
+    if (!hasId && !hasKey) {
+        throw new ResolveError('INVALID_OPTIONS', `Missing target: pass ${spec.idOption} <id> or ${spec.keyOption} <${spec.keyLabel}>. ` +
+            `Run \`${spec.listCommand}\` to see existing ${spec.keyLabel}s.`);
+    }
+    if (hasId)
+        return id;
+    const normalize = spec.normalize ?? ((v) => v);
+    const wanted = normalize(key);
+    const items = await spec.list();
+    const matches = items.filter((item) => {
+        const candidate = spec.keyOf(item);
+        return candidate !== undefined && candidate !== null && normalize(candidate) === wanted;
+    });
+    if (matches.length === 0) {
+        throw new ResolveError(codeFor(spec.noun, 'NOT_FOUND'), `${spec.noun} not found: ${key}. Run \`${spec.listCommand}\` to see existing ${spec.keyLabel}s.`);
+    }
+    if (matches.length > 1) {
+        const describe = spec.describe ?? ((item) => `${spec.idOf(item)}`);
+        const candidates = matches.map((m) => `  - ${describe(m)}`).join('\n');
+        throw new ResolveError(codeFor(spec.noun, 'AMBIGUOUS'), `Ambiguous ${spec.keyLabel} "${key}" — it matches ${matches.length} ` +
+            `${spec.noun.toLowerCase()}s:\n${candidates}\n` +
+            `Nothing was changed. Re-run with ${spec.idOption} <id> to pick one.`);
+    }
+    return spec.idOf(matches[0]);
+}
+// ── per-noun resolvers ──────────────────────────────────────────────────────
+//
+// One function per noun so no command hand-rolls a `list().find()`. Each is a
+// thin `resolveResourceId` call describing where that noun's key lives.
+/** `bridge flag …` — flag keys are unique. */
+export function resolveFlagId(target) {
+    return resolveResourceId(target, {
+        noun: 'Flag',
+        idOption: '--id',
+        keyOption: '--key',
+        keyLabel: 'key',
+        listCommand: 'bridge flag list',
+        list: () => getManagementClient().flags.list(),
+        idOf: (f) => f.id,
+        keyOf: (f) => f.key,
+        describe: (f) => `${f.key} (id ${f.id})`,
+    });
+}
+/** `bridge role …` — role keys are unique (e.g. ADMIN). */
+export function resolveRoleId(target) {
+    return resolveResourceId(target, {
+        noun: 'Role',
+        idOption: '--id',
+        keyOption: '--key',
+        keyLabel: 'key',
+        listCommand: 'bridge role list',
+        list: () => getManagementClient().roles.list(),
+        idOf: (r) => r.id,
+        keyOf: (r) => r.key,
+        describe: (r) => `${r.key} — ${r.name} (id ${r.id})`,
+    });
+}
+/**
+ * `bridge tenant …` — tenants have NO key field. `name` is optional and the
+ * platform does not enforce uniqueness on it, so a duplicate name is a real
+ * possibility and always fails loudly rather than picking one.
+ */
+export function resolveTenantIdByName(target) {
+    return resolveResourceId(target, {
+        noun: 'Tenant',
+        idOption: '--id',
+        keyOption: '--name',
+        keyLabel: 'name',
+        listCommand: 'bridge tenant list',
+        list: () => getManagementClient().tenants.list(),
+        idOf: (t) => t.id,
+        keyOf: (t) => t.name,
+        describe: (t) => `${t.name ?? '(unnamed)'} — id ${t.id}` +
+            (t.signupBy?.email ? `, owner ${t.signupBy.email}` : '') +
+            (t.createdAt ? `, created ${t.createdAt}` : ''),
+    });
+}
+/**
+ * `bridge user …` — users have no key either; email is the natural
+ * human-readable identifier and is unique within a tenant. Matched
+ * case-insensitively, as email addresses are.
+ */
+export function resolveUserId(target, tenantId) {
+    return resolveResourceId(target, {
+        noun: 'User',
+        idOption: '--user-id',
+        keyOption: '--email',
+        keyLabel: 'email',
+        listCommand: 'bridge user list',
+        list: () => getManagementClient().users.list(tenantId),
+        idOf: (u) => u.id,
+        keyOf: (u) => u.email ?? u.username,
+        normalize: (v) => v.toLowerCase(),
+        describe: (u) => `${u.email ?? u.username}${u.fullName ? ` — ${u.fullName}` : ''} (id ${u.id})`,
+    });
+}
+/**
+ * TBP-592 — turn privilege KEYS into the ids `POST/PUT /account/role` stores.
+ *
+ * `--privileges` is documented as taking keys, and keys are the only form a
+ * human or agent has: they are what `bridge role list` prints and what the app
+ * is designed around. But `role.model.ts` types `privileges` as
+ * `Types.ObjectId[]` and resolves them with `findByIdsAndApp`, so a key
+ * resolved to nothing, the array came back empty, and the model's pre-save
+ * hook threw "A role needs at least one privilege".
+ *
+ * That error is the real cost. It reads as "you passed none" when the truth is
+ * "the ones you passed were dropped", and nothing in it points at keys-vs-ids —
+ * the only way to find out was to read the model.
+ *
+ * So: resolve here, and make an unknown identifier a hard failure that NAMES
+ * the offenders. Silently dropping one privilege out of ten would create a role
+ * that looks right and under-permits, which is worse than any error.
+ *
+ * Ids are still accepted and passed through untouched. Mixed input works. That
+ * keeps `--privileges` honest for scripts that already pass ids, and means no
+ * caller has to know which form the API wants.
+ */
+export async function resolvePrivilegeIds(identifiers) {
+    const wanted = identifiers.map((v) => v.trim()).filter((v) => v !== '');
+    if (wanted.length === 0)
+        return [];
+    const privileges = await getManagementClient().roles.listPrivileges();
+    const byKey = new Map(privileges.map((p) => [p.key, p.id]));
+    const knownIds = new Set(privileges.map((p) => p.id));
+    const resolved = [];
+    const unknown = [];
+    for (const identifier of wanted) {
+        const id = byKey.get(identifier);
+        if (id !== undefined) {
+            resolved.push(id);
+        }
+        else if (knownIds.has(identifier)) {
+            resolved.push(identifier); // already an id
+        }
+        else {
+            unknown.push(identifier);
+        }
+    }
+    if (unknown.length > 0) {
+        const available = privileges.map((p) => p.key).sort();
+        throw new ResolveError('PRIVILEGE_NOT_FOUND', `Unknown privilege${unknown.length > 1 ? 's' : ''}: ${unknown.join(', ')}.\n` +
+            `Nothing was changed. Available privileges: ${available.join(', ') || '(none defined)'}.\n` +
+            `Run \`bridge role list\` to see which roles use them.`);
+    }
+    // De-duplicate: two spellings of the same privilege (its key and its id) must
+    // not produce a doubled entry in the stored array.
+    return [...new Set(resolved)];
+}
+/**
+ * `bridge privilege …` — privilege keys are unique within an app, so a key
+ * addresses exactly one. Same shape as `resolveRoleId`.
+ */
+export function resolvePrivilegeId(target) {
+    return resolveResourceId(target, {
+        noun: 'Privilege',
+        idOption: '--id',
+        keyOption: '--key',
+        keyLabel: 'key',
+        listCommand: 'bridge privilege list',
+        list: () => getManagementClient().roles.listPrivileges(),
+        idOf: (p) => p.id,
+        keyOf: (p) => p.key,
+        describe: (p) => `${p.key}${p.description ? ` — ${p.description}` : ''} (id ${p.id})`,
+    });
+}
+/**
+ * `bridge token …` — API tokens have no key; `name` is free text and is NOT
+ * enforced unique, so two tokens can legitimately share one.
+ */
+export function resolveTokenIdByName(target) {
+    return resolveResourceId(target, {
+        noun: 'Token',
+        idOption: '--id',
+        keyOption: '--name',
+        keyLabel: 'name',
+        listCommand: 'bridge token list',
+        list: () => getManagementClient().tokens.list(),
+        idOf: (t) => t.id,
+        keyOf: (t) => t.name,
+        describe: (t) => `${t.name} — id ${t.id}` + (t.createdAt ? `, created ${t.createdAt}` : ''),
+    });
+}
+//# sourceMappingURL=resolve.js.map

package/dist/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../src/resolve.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,EAAE;AACF,6EAA6E;AAC7E,+EAA+E;AAC/E,mEAAmE;AACnE,4EAA4E;AAC5E,EAAE;AACF,yDAAyD;AACzD,+EAA+E;AAC/E,kDAAkD;AAClD,EAAE;AACF,sEAAsE;AACtE,6EAA6E;AAC7E,8EAA8E;AAC9E,6EAA6E;AAE7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD;;;GAGG;AACH,MAAM,OAAO,YAAa,SAAQ,KAAK;IAC5B,IAAI,CAAS;IAEtB,YAAY,IAAY,EAAE,OAAe;QACvC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAgCD,MAAM,SAAS,GAAG,aAAa,CAAC;AAEhC,SAAS,OAAO,CAAC,IAAY,EAAE,MAAc;IAC3C,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;AACnE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAqB,EACrB,IAAoB;IAEpB,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IAC3B,MAAM,KAAK,GAAG,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC;IAC5C,MAAM,MAAM,GAAG,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE,CAAC;IAE/C,IAAI,KAAK,IAAI,MAAM,EAAE,CAAC;QACpB,MAAM,IAAI,YAAY,CACpB,iBAAiB,EACjB,eAAe,IAAI,CAAC,QAAQ,OAAO,IAAI,CAAC,SAAS,aAAa,CAC/D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QACtB,MAAM,IAAI,YAAY,CACpB,iBAAiB,EACjB,wBAAwB,IAAI,CAAC,QAAQ,YAAY,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,QAAQ,KAAK;YACpF,SAAS,IAAI,CAAC,WAAW,sBAAsB,IAAI,CAAC,QAAQ,IAAI,CACnE,CAAC;IACJ,CAAC;IACD,IAAI,KAAK;QAAE,OAAO,EAAY,CAAC;IAE/B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,SAAS,CAAC,GAAa,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IAChC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QACpC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,OAAO,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,YAAY,CACpB,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAC/B,GAAG,IAAI,CAAC,IAAI,eAAe,GAAG,WAAW,IAAI,CAAC,WAAW,sBAAsB,IAAI,CAAC,QAAQ,IAAI,CACjG,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAO,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtE,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvE,MAAM,IAAI,YAAY,CACpB,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAC/B,aAAa,IAAI,CAAC,QAAQ,KAAK,GAAG,kBAAkB,OAAO,CAAC,MAAM,GAAG;YACnE,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,UAAU,IAAI;YAC/C,oCAAoC,IAAI,CAAC,QAAQ,oBAAoB,CACxE,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,+EAA+E;AAC/E,EAAE;AACF,8EAA8E;AAC9E,wEAAwE;AAExE,8CAA8C;AAC9C,MAAM,UAAU,aAAa,CAAC,MAAqB;IACjD,OAAO,iBAAiB,CAAC,MAAM,EAAE;QAC/B,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,OAAO;QAClB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,kBAAkB;QAC/B,IAAI,EAAE,GAAG,EAAE,CAAC,mBAAmB,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE;QAC9C,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE;QACjB,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG;QACnB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,GAAG;KACzC,CAAC,CAAC;AACL,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,aAAa,CAAC,MAAqB;IACjD,OAAO,iBAAiB,CAAC,MAAM,EAAE;QAC/B,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,OAAO;QAClB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,kBAAkB;QAC/B,IAAI,EAAE,GAAG,EAAE,CAAC,mBAAmB,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE;QAC9C,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE;QACjB,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG;QACnB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,EAAE,GAAG;KACrD,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAqB;IACzD,OAAO,iBAAiB,CAAC,MAAM,EAAE;QAC/B,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,QAAQ;QACnB,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,oBAAoB;QACjC,IAAI,EAAE,GAAG,EAAE,CAAC,mBAAmB,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE;QAChD,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE;QACjB,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI;QACpB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CACd,GAAG,CAAC,CAAC,IAAI,IAAI,WAAW,SAAS,CAAC,CAAC,EAAE,EAAE;YACvC,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,MAAqB,EAAE,QAAgB;IACnE,OAAO,iBAAiB,CAAC,MAAM,EAAE;QAC/B,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE,SAAS;QACpB,QAAQ,EAAE,OAAO;QACjB,WAAW,EAAE,kBAAkB;QAC/B,IAAI,EAAE,GAAG,EAAE,CAAC,mBAAmB,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;QACtD,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE;QACjB,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,QAAQ;QACnC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE;QACjC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CACd,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,GAAG;KACjF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,WAAqB;IAC7D,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACxE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEnC,MAAM,UAAU,GAAG,MAAM,mBAAmB,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;IACtE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAEtD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,UAAU,IAAI,MAAM,EAAE,CAAC;QAChC,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACjC,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpB,CAAC;aAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACpC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,gBAAgB;QAC7C,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACtD,MAAM,IAAI,YAAY,CACpB,qBAAqB,EACrB,oBAAoB,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;YAC3E,8CAA8C,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,gBAAgB,KAAK;YAC3F,uDAAuD,CAC1D,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,mDAAmD;IACnD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAqB;IACtD,OAAO,iBAAiB,CAAC,MAAM,EAAE;QAC/B,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,OAAO;QAClB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,uBAAuB;QACpC,IAAI,EAAE,GAAG,EAAE,CAAC,mBAAmB,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE;QACxD,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE;QACjB,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG;QACnB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,GAAG;KACtF,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAqB;IACxD,OAAO,iBAAiB,CAAC,MAAM,EAAE;QAC/B,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,QAAQ;QACnB,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,mBAAmB;QAChC,IAAI,EAAE,GAAG,EAAE,CAAC,mBAAmB,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE;QAC/C,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE;QACjB,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI;QACpB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CACd,GAAG,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7E,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nebulr-group/bridge-cli",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "description": "Bridge platform CLI for AI coding agents and developers",
   "author": "Nebulr Group",
   "license": "MIT",
@@ -24,7 +24,7 @@
     "publish:local": "npm run build && node -e \"const fs=require('fs'),p=JSON.parse(fs.readFileSync('package.json','utf8')),v=p.version.match(/^(\\d+\\.\\d+\\.\\d+)-alpha\\.(\\d+)$/);if(v){p.version=v[1]+'-alpha.'+(+v[2]+1);}else{p.version=p.version+'-alpha.0';}fs.writeFileSync('package.json',JSON.stringify(p,null,'  ')+'\\n');console.log('Version bumped to '+p.version);\" && npm publish --registry http://host.docker.internal:4873 --no-git-checks --ignore-scripts && npm dist-tag add @nebulr-group/bridge-cli@$(node -p \"require('./package.json').version\") alpha --registry http://host.docker.internal:4873"
   },
   "dependencies": {
-    "@nebulr-group/bridge-auth-core": "0.4.0",
+    "@nebulr-group/bridge-auth-core": "0.4.4",
     "commander": "^12.0.0"
   },
   "devDependencies": {