@nebulr-group/bridge-cli 0.4.1 → 0.4.3

package/README.md

@@ -66,6 +66,37 @@ export BRIDGE_TENANT_ID=<tenant-id>                 # for user commands
 export BRIDGE_DEBUG=true                            # enable debug logging
 ```
 
+### 3. Targeting a local stack
+
+Two exports, then log in as usual — the browser flow works against a local
+stack the same way it does against production:
+
+```bash
+export BRIDGE_BASE_URL=http://localhost:3200        # bridge-api
+export BRIDGE_AUTH_BASE_URL=http://localhost:3091   # consent screen (cloud-views)
+
+bridge auth login
+```
+
+`BRIDGE_BASE_URL` is where commands send their API calls; `BRIDGE_AUTH_BASE_URL`
+is where `bridge auth login` opens the consent screen. Set the second one too,
+or you will authenticate against production and then issue commands against
+your local API with a token it does not accept.
+
+There is deliberately **no config file to source** (TBP-121). A sourceable file
+mixed CLI settings with two demo apps' settings, pinned an undocumented app id,
+and kept a long-lived API key on disk in plaintext; two exports cover the same
+ground without any of that. For CI, use `BRIDGE_API_KEY` as described above.
+
+One more, for working on the integration guides themselves:
+
+```bash
+export BRIDGE_GUIDE_LOCAL_DIR=/path/to/thebridge-platform/bridge-plugins
+```
+
+`bridge guide` and `bridge integrate` then read prompts from that directory
+instead of fetching them from GitHub, so edits show up without a release.
+
 ## Usage
 
 All output is JSON by default for management commands. AI agents parse it directly; humans can pipe through `jq`. The `bridge auth status` and `bridge auth login` commands print human-readable text, since their primary audience is a human in a terminal.

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAuBpC,eAAO,MAAM,OAAO,SAAgB,CAAC"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAwBpC,eAAO,MAAM,OAAO,SAAgB,CAAC"}

package/dist/cli.js

@@ -6,6 +6,7 @@ import { registerAppCommands } from './commands/app.command.js';
 import { registerTenantCommands } from './commands/tenant.command.js';
 import { registerUserCommands } from './commands/user.command.js';
 import { registerRoleCommands } from './commands/role.command.js';
+import { registerPrivilegeCommands } from './commands/privilege.command.js';
 import { registerFlagCommands } from './commands/flag.command.js';
 import { registerAuthCommands } from './commands/auth.command.js';
 import { registerBrandingCommands } from './commands/branding.command.js';
@@ -31,6 +32,7 @@ registerAppCommands(program);
 registerTenantCommands(program);
 registerUserCommands(program);
 registerRoleCommands(program);
+registerPrivilegeCommands(program);
 registerFlagCommands(program);
 registerAuthCommands(program);
 registerBrandingCommands(program);

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAEtE,6EAA6E;AAC7E,kFAAkF;AAClF,6EAA6E;AAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;AACpF,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAwB,CAAC;AAErF,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAErC,OAAO;KACJ,IAAI,CAAC,QAAQ,CAAC;KACd,WAAW,CAAC,sDAAsD,CAAC;KACnE,OAAO,CAAC,OAAO,CAAC,CAAC;AAEpB,mBAAmB,CAAC,OAAO,CAAC,CAAC;AAC7B,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,wBAAwB,CAAC,OAAO,CAAC,CAAC;AAClC,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,mBAAmB,CAAC,OAAO,CAAC,CAAC;AAC7B,sBAAsB,CAAC,OAAO,CAAC,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAEtE,6EAA6E;AAC7E,kFAAkF;AAClF,6EAA6E;AAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;AACpF,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAwB,CAAC;AAErF,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAErC,OAAO;KACJ,IAAI,CAAC,QAAQ,CAAC;KACd,WAAW,CAAC,sDAAsD,CAAC;KACnE,OAAO,CAAC,OAAO,CAAC,CAAC;AAEpB,mBAAmB,CAAC,OAAO,CAAC,CAAC;AAC7B,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,yBAAyB,CAAC,OAAO,CAAC,CAAC;AACnC,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,wBAAwB,CAAC,OAAO,CAAC,CAAC;AAClC,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,mBAAmB,CAAC,OAAO,CAAC,CAAC;AAC7B,sBAAsB,CAAC,OAAO,CAAC,CAAC"}

package/dist/commands/privilege.command.d.ts

@@ -0,0 +1,16 @@
+import { Command } from 'commander';
+/**
+ * TBP-589 / TBP-592 — `bridge privilege` did not exist.
+ *
+ * The account API has served full CRUD under `/account/role/privilege` all
+ * along; nothing in the CLI reached it. An app with custom privileges — which
+ * is most non-trivial apps — therefore could not be provisioned by the CLI at
+ * all. Porting one real app meant ten raw `POST /account/role/privilege` calls
+ * with the credential JWT passed as `x-api-key`, entirely outside the tool
+ * that exists to do this.
+ *
+ * `role create --privileges` also depends on `list` here: it resolves the keys
+ * a human types into the ids the API stores.
+ */
+export declare function registerPrivilegeCommands(program: Command): void;
+//# sourceMappingURL=privilege.command.d.ts.map

package/dist/commands/privilege.command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"privilege.command.d.ts","sourceRoot":"","sources":["../../src/commands/privilege.command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAyDhE"}

package/dist/commands/privilege.command.js

@@ -0,0 +1,86 @@
+import { getManagementClient } from '../config.js';
+import { outputSuccess, outputError } from '../output.js';
+import { resolvePrivilegeId } from '../resolve.js';
+/**
+ * TBP-589 / TBP-592 — `bridge privilege` did not exist.
+ *
+ * The account API has served full CRUD under `/account/role/privilege` all
+ * along; nothing in the CLI reached it. An app with custom privileges — which
+ * is most non-trivial apps — therefore could not be provisioned by the CLI at
+ * all. Porting one real app meant ten raw `POST /account/role/privilege` calls
+ * with the credential JWT passed as `x-api-key`, entirely outside the tool
+ * that exists to do this.
+ *
+ * `role create --privileges` also depends on `list` here: it resolves the keys
+ * a human types into the ids the API stores.
+ */
+export function registerPrivilegeCommands(program) {
+    const privilege = program
+        .command('privilege')
+        .description('Manage the privileges roles are built from');
+    privilege.command('list')
+        .description('List all privileges defined for this app')
+        .action(async () => {
+        try {
+            outputSuccess(await getManagementClient().roles.listPrivileges());
+        }
+        catch (err) {
+            outputError(err);
+        }
+    });
+    privilege.command('create')
+        .description('Create a new privilege')
+        .requiredOption('--key <key>', 'Privilege key, e.g. CASE_READ')
+        .option('--description <desc>', 'What this privilege grants')
+        .action(async (opts) => {
+        try {
+            outputSuccess(await getManagementClient().roles.createPrivilege({
+                key: opts.key,
+                description: opts.description,
+            }));
+        }
+        catch (err) {
+            outputError(err);
+        }
+    });
+    privilege.command('update')
+        .description('Update a privilege by --key or --id')
+        .option('--key <key>', 'Privilege key to address (alternative to --id)')
+        .option('--id <id>', 'Privilege ID to address (alternative to --key)')
+        .option('--new-key <key>', 'Rename the privilege to this key')
+        .option('--description <desc>', 'What this privilege grants')
+        .action(async (opts) => {
+        try {
+            const id = await resolvePrivilegeId({ id: opts.id, key: opts.key });
+            // `--key` addresses; `--new-key` renames. Keeping them separate means
+            // addressing by key can never be misread as a rename (TBP-586).
+            const data = {};
+            if (opts.newKey !== undefined)
+                data.key = opts.newKey;
+            if (opts.description !== undefined)
+                data.description = opts.description;
+            outputSuccess(await getManagementClient().roles.updatePrivilege(id, data));
+        }
+        catch (err) {
+            outputError(err);
+        }
+    });
+    privilege.command('delete')
+        .description('Delete a privilege by --key or --id')
+        .option('--key <key>', 'Privilege key to address (alternative to --id)')
+        .option('--id <id>', 'Privilege ID to address (alternative to --key)')
+        .action(async (opts) => {
+        try {
+            const id = await resolvePrivilegeId({ id: opts.id, key: opts.key });
+            // Needs ROLE_DELETE on the token. Destructive privileges are opt-in
+            // (TBP-552) — a plain `bridge auth login` token is refused with 403;
+            // `bridge auth login --admin` requests them (TBP-593).
+            await getManagementClient().roles.deletePrivilege(id);
+            outputSuccess({ deleted: true, id });
+        }
+        catch (err) {
+            outputError(err);
+        }
+    });
+}
+//# sourceMappingURL=privilege.command.js.map

package/dist/commands/privilege.command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"privilege.command.js","sourceRoot":"","sources":["../../src/commands/privilege.command.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAEnD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAgB;IACxD,MAAM,SAAS,GAAG,OAAO;SACtB,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,4CAA4C,CAAC,CAAC;IAE7D,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC;SACtB,WAAW,CAAC,0CAA0C,CAAC;SACvD,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,IAAI,CAAC;YAAC,aAAa,CAAC,MAAM,mBAAmB,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC;QAAC,CAAC;QAC1E,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEL,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC;SACxB,WAAW,CAAC,wBAAwB,CAAC;SACrC,cAAc,CAAC,aAAa,EAAE,+BAA+B,CAAC;SAC9D,MAAM,CAAC,sBAAsB,EAAE,4BAA4B,CAAC;SAC5D,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,IAAI,CAAC;YACH,aAAa,CAAC,MAAM,mBAAmB,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC;gBAC9D,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,WAAW,EAAE,IAAI,CAAC,WAAW;aAC9B,CAAC,CAAC,CAAC;QACN,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEL,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC;SACxB,WAAW,CAAC,qCAAqC,CAAC;SAClD,MAAM,CAAC,aAAa,EAAE,gDAAgD,CAAC;SACvE,MAAM,CAAC,WAAW,EAAE,gDAAgD,CAAC;SACrE,MAAM,CAAC,iBAAiB,EAAE,kCAAkC,CAAC;SAC7D,MAAM,CAAC,sBAAsB,EAAE,4BAA4B,CAAC;SAC5D,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,kBAAkB,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACpE,sEAAsE;YACtE,gEAAgE;YAChE,MAAM,IAAI,GAA2C,EAAE,CAAC;YACxD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;gBAAE,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;YACtD,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;gBAAE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;YACxE,aAAa,CAAC,MAAM,mBAAmB,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;QAC7E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEL,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC;SACxB,WAAW,CAAC,qCAAqC,CAAC;SAClD,MAAM,CAAC,aAAa,EAAE,gDAAgD,CAAC;SACvE,MAAM,CAAC,WAAW,EAAE,gDAAgD,CAAC;SACrE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,kBAAkB,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACpE,oEAAoE;YACpE,qEAAqE;YACrE,uDAAuD;YACvD,MAAM,mBAAmB,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;YACtD,aAAa,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/role.command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role.command.d.ts","sourceRoot":"","sources":["../../src/commands/role.command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA0D3D"}
+{"version":3,"file":"role.command.d.ts","sourceRoot":"","sources":["../../src/commands/role.command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAoE3D"}

package/dist/commands/role.command.js

@@ -1,6 +1,6 @@
 import { getManagementClient } from '../config.js';
 import { outputSuccess, outputError } from '../output.js';
-import { resolveRoleId } from '../resolve.js';
+import { resolvePrivilegeIds, resolveRoleId } from '../resolve.js';
 export function registerRoleCommands(program) {
     const role = program.command('role').description('Manage access roles');
     role.command('list')
@@ -18,15 +18,19 @@ export function registerRoleCommands(program) {
         .requiredOption('--name <name>', 'Role name')
         .requiredOption('--key <key>', 'Role key')
         .option('--description <desc>', 'Description')
-        .option('--privileges <list>', 'Comma-separated privilege keys', (v) => v.split(','))
+        .option('--privileges <list>', 'Comma-separated privilege keys (ids also accepted)', (v) => v.split(','))
         .option('--is-default', 'Set as default role', false)
         .action(async (opts) => {
         try {
+            // TBP-592: --privileges is documented as taking KEYS, but the API
+            // stores ObjectIds and silently drops anything that isn't one. Resolve
+            // here so the documented behaviour is the real behaviour.
+            const privileges = await resolvePrivilegeIds(opts.privileges ?? []);
             outputSuccess(await getManagementClient().roles.create({
                 name: opts.name,
                 key: opts.key,
                 description: opts.description,
-                privileges: opts.privileges ?? [],
+                privileges,
                 isDefault: opts.isDefault,
             }));
         }
@@ -40,7 +44,7 @@ export function registerRoleCommands(program) {
         .option('--id <id>', 'Role ID to address (alternative to --key)')
         .option('--name <name>', 'Role name')
         .option('--description <desc>', 'Description')
-        .option('--privileges <list>', 'Comma-separated privilege keys', (v) => v.split(','))
+        .option('--privileges <list>', 'Comma-separated privilege keys (ids also accepted)', (v) => v.split(','))
         .action(async (opts) => {
         try {
             // TBP-586: `--key`/`--id` are addressing only — strip both out of the
@@ -48,6 +52,12 @@ export function registerRoleCommands(program) {
             const { id: _id, key: _key, ...data } = opts;
             const roleId = await resolveRoleId({ id: opts.id, key: opts.key });
             const cleaned = Object.fromEntries(Object.entries(data).filter(([, v]) => v !== undefined));
+            // TBP-592: same key->id resolution as `create`. Only when the caller
+            // actually passed --privileges: an absent key must stay absent so an
+            // update that renames a role does not blank its privileges.
+            if (opts.privileges !== undefined) {
+                cleaned.privileges = await resolvePrivilegeIds(opts.privileges);
+            }
             outputSuccess(await getManagementClient().roles.update(roleId, cleaned));
         }
         catch (err) {

package/dist/commands/role.command.js.map

@@ -1 +1 @@
-{"version":3,"file":"role.command.js","sourceRoot":"","sources":["../../src/commands/role.command.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9C,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC;IAExE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;SACjB,WAAW,CAAC,uBAAuB,CAAC;SACpC,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,IAAI,CAAC;YAAC,aAAa,CAAC,MAAM,mBAAmB,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;QAChE,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEL,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;SACnB,WAAW,CAAC,0BAA0B,CAAC;SACvC,cAAc,CAAC,eAAe,EAAE,WAAW,CAAC;SAC5C,cAAc,CAAC,aAAa,EAAE,UAAU,CAAC;SACzC,MAAM,CAAC,sBAAsB,EAAE,aAAa,CAAC;SAC7C,MAAM,CAAC,qBAAqB,EAAE,gCAAgC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;SACpF,MAAM,CAAC,cAAc,EAAE,qBAAqB,EAAE,KAAK,CAAC;SACpD,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,IAAI,CAAC;YACH,aAAa,CAAC,MAAM,mBAAmB,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;gBACrD,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,EAAE;gBACjC,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CAAC,CAAC;QACN,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEL,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;SACnB,WAAW,CAAC,wCAAwC,CAAC;SACrD,MAAM,CAAC,aAAa,EAAE,uDAAuD,CAAC;SAC9E,MAAM,CAAC,WAAW,EAAE,2CAA2C,CAAC;SAChE,MAAM,CAAC,eAAe,EAAE,WAAW,CAAC;SACpC,MAAM,CAAC,sBAAsB,EAAE,aAAa,CAAC;SAC7C,MAAM,CAAC,qBAAqB,EAAE,gCAAgC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;SACpF,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,IAAI,CAAC;YACH,sEAAsE;YACtE,oEAAoE;YACpE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;YAC7C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACnE,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC;YAC5F,aAAa,CAAC,MAAM,mBAAmB,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEL,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;SACnB,WAAW,CAAC,wCAAwC,CAAC;SACrD,MAAM,CAAC,aAAa,EAAE,uDAAuD,CAAC;SAC9E,MAAM,CAAC,WAAW,EAAE,2CAA2C,CAAC;SAChE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAC/D,MAAM,mBAAmB,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC7C,aAAa,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"role.command.js","sourceRoot":"","sources":["../../src/commands/role.command.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnE,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC;IAExE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;SACjB,WAAW,CAAC,uBAAuB,CAAC;SACpC,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,IAAI,CAAC;YAAC,aAAa,CAAC,MAAM,mBAAmB,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;QAChE,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEL,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;SACnB,WAAW,CAAC,0BAA0B,CAAC;SACvC,cAAc,CAAC,eAAe,EAAE,WAAW,CAAC;SAC5C,cAAc,CAAC,aAAa,EAAE,UAAU,CAAC;SACzC,MAAM,CAAC,sBAAsB,EAAE,aAAa,CAAC;SAC7C,MAAM,CAAC,qBAAqB,EAAE,oDAAoD,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;SACxG,MAAM,CAAC,cAAc,EAAE,qBAAqB,EAAE,KAAK,CAAC;SACpD,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,IAAI,CAAC;YACH,kEAAkE;YAClE,uEAAuE;YACvE,0DAA0D;YAC1D,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;YACpE,aAAa,CAAC,MAAM,mBAAmB,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;gBACrD,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,UAAU;gBACV,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CAAC,CAAC;QACN,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEL,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;SACnB,WAAW,CAAC,wCAAwC,CAAC;SACrD,MAAM,CAAC,aAAa,EAAE,uDAAuD,CAAC;SAC9E,MAAM,CAAC,WAAW,EAAE,2CAA2C,CAAC;SAChE,MAAM,CAAC,eAAe,EAAE,WAAW,CAAC;SACpC,MAAM,CAAC,sBAAsB,EAAE,aAAa,CAAC;SAC7C,MAAM,CAAC,qBAAqB,EAAE,oDAAoD,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;SACxG,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,IAAI,CAAC;YACH,sEAAsE;YACtE,oEAAoE;YACpE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;YAC7C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACnE,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC;YAC5F,qEAAqE;YACrE,qEAAqE;YACrE,4DAA4D;YAC5D,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;gBAClC,OAAO,CAAC,UAAU,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAClE,CAAC;YACD,aAAa,CAAC,MAAM,mBAAmB,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEL,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;SACnB,WAAW,CAAC,wCAAwC,CAAC;SACrD,MAAM,CAAC,aAAa,EAAE,uDAAuD,CAAC;SAC9E,MAAM,CAAC,WAAW,EAAE,2CAA2C,CAAC;SAChE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAC/D,MAAM,mBAAmB,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC7C,aAAa,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/resolve.d.ts

@@ -61,6 +61,34 @@ export declare function resolveTenantIdByName(target: ResolveTarget): Promise<st
  * case-insensitively, as email addresses are.
  */
 export declare function resolveUserId(target: ResolveTarget, tenantId: string): Promise<string>;
+/**
+ * TBP-592 — turn privilege KEYS into the ids `POST/PUT /account/role` stores.
+ *
+ * `--privileges` is documented as taking keys, and keys are the only form a
+ * human or agent has: they are what `bridge role list` prints and what the app
+ * is designed around. But `role.model.ts` types `privileges` as
+ * `Types.ObjectId[]` and resolves them with `findByIdsAndApp`, so a key
+ * resolved to nothing, the array came back empty, and the model's pre-save
+ * hook threw "A role needs at least one privilege".
+ *
+ * That error is the real cost. It reads as "you passed none" when the truth is
+ * "the ones you passed were dropped", and nothing in it points at keys-vs-ids —
+ * the only way to find out was to read the model.
+ *
+ * So: resolve here, and make an unknown identifier a hard failure that NAMES
+ * the offenders. Silently dropping one privilege out of ten would create a role
+ * that looks right and under-permits, which is worse than any error.
+ *
+ * Ids are still accepted and passed through untouched. Mixed input works. That
+ * keeps `--privileges` honest for scripts that already pass ids, and means no
+ * caller has to know which form the API wants.
+ */
+export declare function resolvePrivilegeIds(identifiers: string[]): Promise<string[]>;
+/**
+ * `bridge privilege …` — privilege keys are unique within an app, so a key
+ * addresses exactly one. Same shape as `resolveRoleId`.
+ */
+export declare function resolvePrivilegeId(target: ResolveTarget): Promise<string>;
 /**
  * `bridge token …` — API tokens have no key; `name` is free text and is NOT
  * enforced unique, so two tokens can legitimately share one.

package/dist/resolve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../src/resolve.ts"],"names":[],"mappings":"AAkBA;;;GAGG;AACH,qBAAa,YAAa,SAAQ,KAAK;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBAEV,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAK1C;AAED,MAAM,WAAW,WAAW,CAAC,CAAC;IAC5B,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;IAClB,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAC;IACjB,oEAAoE;IACpE,WAAW,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IACzB,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,MAAM,CAAC;IAC1B,gFAAgF;IAChF,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,MAAM,GAAG,SAAS,CAAC;IACvC;;;OAGG;IACH,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;IACtC,sEAAsE;IACtE,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAQD;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,GACnB,OAAO,CAAC,MAAM,CAAC,CA+CjB;AAOD,8CAA8C;AAC9C,wBAAgB,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAYpE;AAED,2DAA2D;AAC3D,wBAAgB,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAYpE;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAe5E;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CActF;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAa3E"}
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../src/resolve.ts"],"names":[],"mappings":"AAkBA;;;GAGG;AACH,qBAAa,YAAa,SAAQ,KAAK;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBAEV,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAK1C;AAED,MAAM,WAAW,WAAW,CAAC,CAAC;IAC5B,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;IAClB,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAC;IACjB,oEAAoE;IACpE,WAAW,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IACzB,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,MAAM,CAAC;IAC1B,gFAAgF;IAChF,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,MAAM,GAAG,SAAS,CAAC;IACvC;;;OAGG;IACH,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;IACtC,sEAAsE;IACtE,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAQD;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,GACnB,OAAO,CAAC,MAAM,CAAC,CA+CjB;AAOD,8CAA8C;AAC9C,wBAAgB,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAYpE;AAED,2DAA2D;AAC3D,wBAAgB,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAYpE;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAe5E;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CActF;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAmClF;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAYzE;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAa3E"}

package/dist/resolve.js

@@ -143,6 +143,76 @@ export function resolveUserId(target, tenantId) {
         describe: (u) => `${u.email ?? u.username}${u.fullName ? ` — ${u.fullName}` : ''} (id ${u.id})`,
     });
 }
+/**
+ * TBP-592 — turn privilege KEYS into the ids `POST/PUT /account/role` stores.
+ *
+ * `--privileges` is documented as taking keys, and keys are the only form a
+ * human or agent has: they are what `bridge role list` prints and what the app
+ * is designed around. But `role.model.ts` types `privileges` as
+ * `Types.ObjectId[]` and resolves them with `findByIdsAndApp`, so a key
+ * resolved to nothing, the array came back empty, and the model's pre-save
+ * hook threw "A role needs at least one privilege".
+ *
+ * That error is the real cost. It reads as "you passed none" when the truth is
+ * "the ones you passed were dropped", and nothing in it points at keys-vs-ids —
+ * the only way to find out was to read the model.
+ *
+ * So: resolve here, and make an unknown identifier a hard failure that NAMES
+ * the offenders. Silently dropping one privilege out of ten would create a role
+ * that looks right and under-permits, which is worse than any error.
+ *
+ * Ids are still accepted and passed through untouched. Mixed input works. That
+ * keeps `--privileges` honest for scripts that already pass ids, and means no
+ * caller has to know which form the API wants.
+ */
+export async function resolvePrivilegeIds(identifiers) {
+    const wanted = identifiers.map((v) => v.trim()).filter((v) => v !== '');
+    if (wanted.length === 0)
+        return [];
+    const privileges = await getManagementClient().roles.listPrivileges();
+    const byKey = new Map(privileges.map((p) => [p.key, p.id]));
+    const knownIds = new Set(privileges.map((p) => p.id));
+    const resolved = [];
+    const unknown = [];
+    for (const identifier of wanted) {
+        const id = byKey.get(identifier);
+        if (id !== undefined) {
+            resolved.push(id);
+        }
+        else if (knownIds.has(identifier)) {
+            resolved.push(identifier); // already an id
+        }
+        else {
+            unknown.push(identifier);
+        }
+    }
+    if (unknown.length > 0) {
+        const available = privileges.map((p) => p.key).sort();
+        throw new ResolveError('PRIVILEGE_NOT_FOUND', `Unknown privilege${unknown.length > 1 ? 's' : ''}: ${unknown.join(', ')}.\n` +
+            `Nothing was changed. Available privileges: ${available.join(', ') || '(none defined)'}.\n` +
+            `Run \`bridge role list\` to see which roles use them.`);
+    }
+    // De-duplicate: two spellings of the same privilege (its key and its id) must
+    // not produce a doubled entry in the stored array.
+    return [...new Set(resolved)];
+}
+/**
+ * `bridge privilege …` — privilege keys are unique within an app, so a key
+ * addresses exactly one. Same shape as `resolveRoleId`.
+ */
+export function resolvePrivilegeId(target) {
+    return resolveResourceId(target, {
+        noun: 'Privilege',
+        idOption: '--id',
+        keyOption: '--key',
+        keyLabel: 'key',
+        listCommand: 'bridge privilege list',
+        list: () => getManagementClient().roles.listPrivileges(),
+        idOf: (p) => p.id,
+        keyOf: (p) => p.key,
+        describe: (p) => `${p.key}${p.description ? ` — ${p.description}` : ''} (id ${p.id})`,
+    });
+}
 /**
  * `bridge token …` — API tokens have no key; `name` is free text and is NOT
  * enforced unique, so two tokens can legitimately share one.

package/dist/resolve.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../src/resolve.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,EAAE;AACF,6EAA6E;AAC7E,+EAA+E;AAC/E,mEAAmE;AACnE,4EAA4E;AAC5E,EAAE;AACF,yDAAyD;AACzD,+EAA+E;AAC/E,kDAAkD;AAClD,EAAE;AACF,sEAAsE;AACtE,6EAA6E;AAC7E,8EAA8E;AAC9E,6EAA6E;AAE7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD;;;GAGG;AACH,MAAM,OAAO,YAAa,SAAQ,KAAK;IAC5B,IAAI,CAAS;IAEtB,YAAY,IAAY,EAAE,OAAe;QACvC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAgCD,MAAM,SAAS,GAAG,aAAa,CAAC;AAEhC,SAAS,OAAO,CAAC,IAAY,EAAE,MAAc;IAC3C,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;AACnE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAqB,EACrB,IAAoB;IAEpB,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IAC3B,MAAM,KAAK,GAAG,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC;IAC5C,MAAM,MAAM,GAAG,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE,CAAC;IAE/C,IAAI,KAAK,IAAI,MAAM,EAAE,CAAC;QACpB,MAAM,IAAI,YAAY,CACpB,iBAAiB,EACjB,eAAe,IAAI,CAAC,QAAQ,OAAO,IAAI,CAAC,SAAS,aAAa,CAC/D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QACtB,MAAM,IAAI,YAAY,CACpB,iBAAiB,EACjB,wBAAwB,IAAI,CAAC,QAAQ,YAAY,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,QAAQ,KAAK;YACpF,SAAS,IAAI,CAAC,WAAW,sBAAsB,IAAI,CAAC,QAAQ,IAAI,CACnE,CAAC;IACJ,CAAC;IACD,IAAI,KAAK;QAAE,OAAO,EAAY,CAAC;IAE/B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,SAAS,CAAC,GAAa,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IAChC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QACpC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,OAAO,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,YAAY,CACpB,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAC/B,GAAG,IAAI,CAAC,IAAI,eAAe,GAAG,WAAW,IAAI,CAAC,WAAW,sBAAsB,IAAI,CAAC,QAAQ,IAAI,CACjG,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAO,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtE,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvE,MAAM,IAAI,YAAY,CACpB,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAC/B,aAAa,IAAI,CAAC,QAAQ,KAAK,GAAG,kBAAkB,OAAO,CAAC,MAAM,GAAG;YACnE,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,UAAU,IAAI;YAC/C,oCAAoC,IAAI,CAAC,QAAQ,oBAAoB,CACxE,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,+EAA+E;AAC/E,EAAE;AACF,8EAA8E;AAC9E,wEAAwE;AAExE,8CAA8C;AAC9C,MAAM,UAAU,aAAa,CAAC,MAAqB;IACjD,OAAO,iBAAiB,CAAC,MAAM,EAAE;QAC/B,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,OAAO;QAClB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,kBAAkB;QAC/B,IAAI,EAAE,GAAG,EAAE,CAAC,mBAAmB,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE;QAC9C,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE;QACjB,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG;QACnB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,GAAG;KACzC,CAAC,CAAC;AACL,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,aAAa,CAAC,MAAqB;IACjD,OAAO,iBAAiB,CAAC,MAAM,EAAE;QAC/B,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,OAAO;QAClB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,kBAAkB;QAC/B,IAAI,EAAE,GAAG,EAAE,CAAC,mBAAmB,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE;QAC9C,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE;QACjB,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG;QACnB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,EAAE,GAAG;KACrD,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAqB;IACzD,OAAO,iBAAiB,CAAC,MAAM,EAAE;QAC/B,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,QAAQ;QACnB,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,oBAAoB;QACjC,IAAI,EAAE,GAAG,EAAE,CAAC,mBAAmB,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE;QAChD,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE;QACjB,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI;QACpB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CACd,GAAG,CAAC,CAAC,IAAI,IAAI,WAAW,SAAS,CAAC,CAAC,EAAE,EAAE;YACvC,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,MAAqB,EAAE,QAAgB;IACnE,OAAO,iBAAiB,CAAC,MAAM,EAAE;QAC/B,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE,SAAS;QACpB,QAAQ,EAAE,OAAO;QACjB,WAAW,EAAE,kBAAkB;QAC/B,IAAI,EAAE,GAAG,EAAE,CAAC,mBAAmB,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;QACtD,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE;QACjB,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,QAAQ;QACnC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE;QACjC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CACd,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,GAAG;KACjF,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAqB;IACxD,OAAO,iBAAiB,CAAC,MAAM,EAAE;QAC/B,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,QAAQ;QACnB,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,mBAAmB;QAChC,IAAI,EAAE,GAAG,EAAE,CAAC,mBAAmB,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE;QAC/C,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE;QACjB,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI;QACpB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CACd,GAAG,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7E,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../src/resolve.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,EAAE;AACF,6EAA6E;AAC7E,+EAA+E;AAC/E,mEAAmE;AACnE,4EAA4E;AAC5E,EAAE;AACF,yDAAyD;AACzD,+EAA+E;AAC/E,kDAAkD;AAClD,EAAE;AACF,sEAAsE;AACtE,6EAA6E;AAC7E,8EAA8E;AAC9E,6EAA6E;AAE7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD;;;GAGG;AACH,MAAM,OAAO,YAAa,SAAQ,KAAK;IAC5B,IAAI,CAAS;IAEtB,YAAY,IAAY,EAAE,OAAe;QACvC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAgCD,MAAM,SAAS,GAAG,aAAa,CAAC;AAEhC,SAAS,OAAO,CAAC,IAAY,EAAE,MAAc;IAC3C,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;AACnE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAqB,EACrB,IAAoB;IAEpB,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IAC3B,MAAM,KAAK,GAAG,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC;IAC5C,MAAM,MAAM,GAAG,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE,CAAC;IAE/C,IAAI,KAAK,IAAI,MAAM,EAAE,CAAC;QACpB,MAAM,IAAI,YAAY,CACpB,iBAAiB,EACjB,eAAe,IAAI,CAAC,QAAQ,OAAO,IAAI,CAAC,SAAS,aAAa,CAC/D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QACtB,MAAM,IAAI,YAAY,CACpB,iBAAiB,EACjB,wBAAwB,IAAI,CAAC,QAAQ,YAAY,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,QAAQ,KAAK;YACpF,SAAS,IAAI,CAAC,WAAW,sBAAsB,IAAI,CAAC,QAAQ,IAAI,CACnE,CAAC;IACJ,CAAC;IACD,IAAI,KAAK;QAAE,OAAO,EAAY,CAAC;IAE/B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,SAAS,CAAC,GAAa,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IAChC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QACpC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,OAAO,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,YAAY,CACpB,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAC/B,GAAG,IAAI,CAAC,IAAI,eAAe,GAAG,WAAW,IAAI,CAAC,WAAW,sBAAsB,IAAI,CAAC,QAAQ,IAAI,CACjG,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAO,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtE,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvE,MAAM,IAAI,YAAY,CACpB,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAC/B,aAAa,IAAI,CAAC,QAAQ,KAAK,GAAG,kBAAkB,OAAO,CAAC,MAAM,GAAG;YACnE,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,UAAU,IAAI;YAC/C,oCAAoC,IAAI,CAAC,QAAQ,oBAAoB,CACxE,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,+EAA+E;AAC/E,EAAE;AACF,8EAA8E;AAC9E,wEAAwE;AAExE,8CAA8C;AAC9C,MAAM,UAAU,aAAa,CAAC,MAAqB;IACjD,OAAO,iBAAiB,CAAC,MAAM,EAAE;QAC/B,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,OAAO;QAClB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,kBAAkB;QAC/B,IAAI,EAAE,GAAG,EAAE,CAAC,mBAAmB,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE;QAC9C,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE;QACjB,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG;QACnB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,GAAG;KACzC,CAAC,CAAC;AACL,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,aAAa,CAAC,MAAqB;IACjD,OAAO,iBAAiB,CAAC,MAAM,EAAE;QAC/B,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,OAAO;QAClB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,kBAAkB;QAC/B,IAAI,EAAE,GAAG,EAAE,CAAC,mBAAmB,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE;QAC9C,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE;QACjB,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG;QACnB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,EAAE,GAAG;KACrD,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAqB;IACzD,OAAO,iBAAiB,CAAC,MAAM,EAAE;QAC/B,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,QAAQ;QACnB,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,oBAAoB;QACjC,IAAI,EAAE,GAAG,EAAE,CAAC,mBAAmB,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE;QAChD,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE;QACjB,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI;QACpB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CACd,GAAG,CAAC,CAAC,IAAI,IAAI,WAAW,SAAS,CAAC,CAAC,EAAE,EAAE;YACvC,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,MAAqB,EAAE,QAAgB;IACnE,OAAO,iBAAiB,CAAC,MAAM,EAAE;QAC/B,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE,SAAS;QACpB,QAAQ,EAAE,OAAO;QACjB,WAAW,EAAE,kBAAkB;QAC/B,IAAI,EAAE,GAAG,EAAE,CAAC,mBAAmB,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;QACtD,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE;QACjB,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,QAAQ;QACnC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE;QACjC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CACd,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,GAAG;KACjF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,WAAqB;IAC7D,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACxE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEnC,MAAM,UAAU,GAAG,MAAM,mBAAmB,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;IACtE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAEtD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,UAAU,IAAI,MAAM,EAAE,CAAC;QAChC,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACjC,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpB,CAAC;aAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACpC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,gBAAgB;QAC7C,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACtD,MAAM,IAAI,YAAY,CACpB,qBAAqB,EACrB,oBAAoB,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;YAC3E,8CAA8C,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,gBAAgB,KAAK;YAC3F,uDAAuD,CAC1D,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,mDAAmD;IACnD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAqB;IACtD,OAAO,iBAAiB,CAAC,MAAM,EAAE;QAC/B,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,OAAO;QAClB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,uBAAuB;QACpC,IAAI,EAAE,GAAG,EAAE,CAAC,mBAAmB,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE;QACxD,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE;QACjB,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG;QACnB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,GAAG;KACtF,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAqB;IACxD,OAAO,iBAAiB,CAAC,MAAM,EAAE;QAC/B,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,QAAQ;QACnB,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,mBAAmB;QAChC,IAAI,EAAE,GAAG,EAAE,CAAC,mBAAmB,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE;QAC/C,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE;QACjB,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI;QACpB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CACd,GAAG,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7E,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nebulr-group/bridge-cli",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "description": "Bridge platform CLI for AI coding agents and developers",
   "author": "Nebulr Group",
   "license": "MIT",
@@ -24,7 +24,7 @@
     "publish:local": "npm run build && node -e \"const fs=require('fs'),p=JSON.parse(fs.readFileSync('package.json','utf8')),v=p.version.match(/^(\\d+\\.\\d+\\.\\d+)-alpha\\.(\\d+)$/);if(v){p.version=v[1]+'-alpha.'+(+v[2]+1);}else{p.version=p.version+'-alpha.0';}fs.writeFileSync('package.json',JSON.stringify(p,null,'  ')+'\\n');console.log('Version bumped to '+p.version);\" && npm publish --registry http://host.docker.internal:4873 --no-git-checks --ignore-scripts && npm dist-tag add @nebulr-group/bridge-cli@$(node -p \"require('./package.json').version\") alpha --registry http://host.docker.internal:4873"
   },
   "dependencies": {
-    "@nebulr-group/bridge-auth-core": "0.4.2",
+    "@nebulr-group/bridge-auth-core": "0.4.4",
     "commander": "^12.0.0"
   },
   "devDependencies": {