@nebulr-group/bridge-cli 0.6.5 → 1.0.0-alpha.0

package/dist/flag-coherence.d.ts

@@ -1,42 +0,0 @@
-import type { Rule } from '@nebulr-group/bridge-auth-core';
-/** The fields a coherence check reads. Values as stored; defaults applied here. */
-export interface FlagLike {
-    key: string;
-    state?: string;
-    valueType?: string;
-    onValue?: unknown;
-    offValue?: unknown;
-    rule?: Rule | null;
-}
-/** What the app actually has, for the dangling-reference check. */
-export interface CoherenceCatalog {
-    /** Rules compare the KEY; the name is kept to say which key was meant. */
-    plans: Array<{
-        key: string;
-        name?: string;
-    }>;
-    roles: Array<{
-        key: string;
-        name?: string;
-    }>;
-}
-/**
- * The warnings for one flag. Pure. `catalog` omitted skips the
- * dangling-reference check (the caller could not read plans/roles).
- */
-export declare function flagCoherenceWarnings(flag: FlagLike, catalog?: CoherenceCatalog): string[];
-/** True when any condition reads a plan or role attribute (worth fetching the catalog). */
-export declare function ruleReadsPlanOrRole(rule: Rule | null | undefined): boolean;
-/**
- * Plans and roles for the dangling-reference check. Never throws: a login
- * that cannot read plans or roles gets no dangling-reference warning rather
- * than a failed flag command — a warning never blocks.
- */
-export declare function loadCoherenceCatalog(): Promise<CoherenceCatalog | undefined>;
-/** Warnings for a list of flags, fetching the catalog once and only if a rule needs it. */
-export declare function warningsForFlags(flags: FlagLike[]): Promise<string[][]>;
-/** A flag with its warnings attached — only when there are any, so a coherent flag prints as before. */
-export declare function withFlagWarnings<T extends FlagLike>(flag: T): Promise<T | (T & {
-    warnings: string[];
-})>;
-//# sourceMappingURL=flag-coherence.d.ts.map

package/dist/flag-coherence.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"flag-coherence.d.ts","sourceRoot":"","sources":["../src/flag-coherence.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,gCAAgC,CAAC;AAgB3D,mFAAmF;AACnF,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,IAAI,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACpB;AAED,mEAAmE;AACnE,MAAM,WAAW,gBAAgB;IAC/B,0EAA0E;IAC1E,KAAK,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7C,KAAK,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC9C;AAiBD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,MAAM,EAAE,CAuD1F;AAED,2FAA2F;AAC3F,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAO1E;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAWlF;AAED,2FAA2F;AAC3F,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAG7E;AAED,wGAAwG;AACxG,wBAAsB,gBAAgB,CAAC,CAAC,SAAS,QAAQ,EAAE,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG;IAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC,CAI7G"}

package/dist/flag-coherence.js

@@ -1,103 +0,0 @@
-import { getManagementClient } from './config.js';
-/** Attributes whose value names a plan (the JWT `plan` claim, billing slug). */
-const PLAN_ATTRIBUTES = ['tenant.plan', 'bridge:billing.plan'];
-/** Attributes whose value names a role (the JWT `role` claim). */
-const ROLE_ATTRIBUTES = ['user.role'];
-/** Operators whose values are compared for equality with the attribute. */
-const EQUALITY_OPERATORS = ['eq', 'neq', 'in', 'not_in'];
-function sameValue(a, b) {
-    return JSON.stringify(a ?? null) === JSON.stringify(b ?? null);
-}
-function listed(entries) {
-    return entries.length ? entries.map((e) => e.key).join(', ') : '(none)';
-}
-/**
- * The warnings for one flag. Pure. `catalog` omitted skips the
- * dangling-reference check (the caller could not read plans/roles).
- */
-export function flagCoherenceWarnings(flag, catalog) {
-    const warnings = [];
-    const state = flag.state ?? 'off';
-    const valueType = flag.valueType ?? 'boolean';
-    const onValue = flag.onValue !== undefined ? flag.onValue : true;
-    const offValue = flag.offValue !== undefined ? flag.offValue : false;
-    if (state === 'on') {
-        if (valueType === 'boolean' && onValue === false) {
-            warnings.push(`Flag "${flag.key}" is switched on, but its onValue is false, so it returns false for ` +
-                'everyone: it looks on and behaves off. Set onValue to true, or switch the flag off.');
-        }
-        else if (sameValue(onValue, offValue)) {
-            warnings.push(`Flag "${flag.key}" is switched on, but its onValue equals its offValue ` +
-                `(${JSON.stringify(onValue)}), so switching it on or off changes nothing.`);
-        }
-    }
-    if (catalog && flag.rule) {
-        for (const branch of flag.rule.branches ?? []) {
-            for (const condition of branch.conditions ?? []) {
-                if (!EQUALITY_OPERATORS.includes(condition.operator))
-                    continue;
-                const isPlan = PLAN_ATTRIBUTES.includes(condition.attribute);
-                const isRole = ROLE_ATTRIBUTES.includes(condition.attribute);
-                if (!isPlan && !isRole)
-                    continue;
-                const known = isPlan ? catalog.plans : catalog.roles;
-                const keys = new Set(known.map((k) => k.key));
-                const what = isPlan ? 'plan' : 'role';
-                for (const value of condition.values ?? []) {
-                    if (typeof value !== 'string' || keys.has(value))
-                        continue;
-                    // The token carries the plan/role KEY, so a display name never matches.
-                    const byName = known.find((k) => k.name === value);
-                    if (byName) {
-                        warnings.push(`Flag "${flag.key}" has a rule on ${condition.attribute} ${condition.operator} ` +
-                            `"${value}", which matches the ${what} named "${value}" by name; rules compare the ` +
-                            `${what} key — use "${byName.key}".`);
-                        continue;
-                    }
-                    warnings.push(`Flag "${flag.key}" has a rule on ${condition.attribute} ${condition.operator} ` +
-                        `"${value}", but the app has no ${what} "${value}", so no real ` +
-                        `${isPlan ? 'workspace' : 'user'} can carry it. Existing ${what} keys: ` +
-                        `${listed(known)}.`);
-                }
-            }
-        }
-    }
-    return warnings;
-}
-/** True when any condition reads a plan or role attribute (worth fetching the catalog). */
-export function ruleReadsPlanOrRole(rule) {
-    if (!rule)
-        return false;
-    return (rule.branches ?? []).some((b) => (b.conditions ?? []).some((c) => PLAN_ATTRIBUTES.includes(c.attribute) || ROLE_ATTRIBUTES.includes(c.attribute)));
-}
-/**
- * Plans and roles for the dangling-reference check. Never throws: a login
- * that cannot read plans or roles gets no dangling-reference warning rather
- * than a failed flag command — a warning never blocks.
- */
-export async function loadCoherenceCatalog() {
-    try {
-        const client = getManagementClient();
-        const [plans, roles] = await Promise.all([client.plans.list(), client.roles.list()]);
-        return {
-            plans: (plans ?? []).map((p) => ({ key: String(p.key), name: p.name })),
-            roles: (roles ?? []).map((r) => ({ key: String(r.key), name: r.name })),
-        };
-    }
-    catch {
-        return undefined;
-    }
-}
-/** Warnings for a list of flags, fetching the catalog once and only if a rule needs it. */
-export async function warningsForFlags(flags) {
-    const catalog = flags.some((f) => ruleReadsPlanOrRole(f.rule)) ? await loadCoherenceCatalog() : undefined;
-    return flags.map((f) => flagCoherenceWarnings(f, catalog));
-}
-/** A flag with its warnings attached — only when there are any, so a coherent flag prints as before. */
-export async function withFlagWarnings(flag) {
-    if (!flag || typeof flag !== 'object')
-        return flag;
-    const [warnings] = await warningsForFlags([flag]);
-    return warnings.length ? { ...flag, warnings } : flag;
-}
-//# sourceMappingURL=flag-coherence.js.map

package/dist/flag-coherence.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"flag-coherence.js","sourceRoot":"","sources":["../src/flag-coherence.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAgClD,gFAAgF;AAChF,MAAM,eAAe,GAAG,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC;AAC/D,kEAAkE;AAClE,MAAM,eAAe,GAAG,CAAC,WAAW,CAAC,CAAC;AACtC,2EAA2E;AAC3E,MAAM,kBAAkB,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;AAEzD,SAAS,SAAS,CAAC,CAAU,EAAE,CAAU;IACvC,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,MAAM,CAAC,OAA8C;IAC5D,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC1E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAc,EAAE,OAA0B;IAC9E,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IAClC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC;IAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;IAErE,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,IAAI,SAAS,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;YACjD,QAAQ,CAAC,IAAI,CACX,SAAS,IAAI,CAAC,GAAG,sEAAsE;gBACrF,qFAAqF,CACxF,CAAC;QACJ,CAAC;aAAM,IAAI,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACxC,QAAQ,CAAC,IAAI,CACX,SAAS,IAAI,CAAC,GAAG,wDAAwD;gBACvE,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,+CAA+C,CAC7E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,OAAO,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;YAC9C,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;gBAChD,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC;oBAAE,SAAS;gBAC/D,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;gBAC7D,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;gBAC7D,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM;oBAAE,SAAS;gBACjC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;gBACrD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;gBACtC,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;oBAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;wBAAE,SAAS;oBAC3D,wEAAwE;oBACxE,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;oBACnD,IAAI,MAAM,EAAE,CAAC;wBACX,QAAQ,CAAC,IAAI,CACX,SAAS,IAAI,CAAC,GAAG,mBAAmB,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,QAAQ,GAAG;4BAC9E,IAAI,KAAK,wBAAwB,IAAI,WAAW,KAAK,+BAA+B;4BACpF,GAAG,IAAI,eAAe,MAAM,CAAC,GAAG,IAAI,CACvC,CAAC;wBACF,SAAS;oBACX,CAAC;oBACD,QAAQ,CAAC,IAAI,CACX,SAAS,IAAI,CAAC,GAAG,mBAAmB,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,QAAQ,GAAG;wBAC9E,IAAI,KAAK,yBAAyB,IAAI,KAAK,KAAK,gBAAgB;wBAChE,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,2BAA2B,IAAI,SAAS;wBACxE,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CACtB,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,mBAAmB,CAAC,IAA6B;IAC/D,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,OAAO,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CACtC,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,CACvB,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CACtF,CACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;QACrC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACrF,OAAO;YACL,KAAK,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACvE,KAAK,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;SACxE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAiB;IACtD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,oBAAoB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1G,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,wGAAwG;AACxG,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAqB,IAAO;IAChE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAClD,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC"}

package/dist/output.d.ts

@@ -1,17 +0,0 @@
-export declare function outputSuccess(data: unknown): void;
-/**
- * Emit a prompt body verbatim to stdout — used by `bridge guide …` commands
- * whose output is intended to be read by a human or pasted to an AI agent.
- * Wrapping the markdown in a JSON envelope makes it unreadable in a terminal
- * and forces scripts to parse JSON to recover the original text. Use the
- * `--json` flag on each guide command if the envelope is needed for tooling.
- */
-export declare function outputPrompt(content: string): void;
-/**
- * Turn "Privilege 'TOKEN_WRITE' required" into something the reader can act
- * on. Without this the message is a dead end: it names a privilege but not how
- * to obtain one, and the answer ("log in again, differently") is not guessable.
- */
-export declare function privilegeHint(message: string): string | undefined;
-export declare function outputError(error: unknown): void;
-//# sourceMappingURL=output.d.ts.map

package/dist/output.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../src/output.ts"],"names":[],"mappings":"AAIA,wBAAgB,aAAa,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAGjD;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAElD;AAGD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUjE;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAwEhD"}

package/dist/output.js

@@ -1,107 +0,0 @@
-import { HttpError } from '@nebulr-group/bridge-auth-core';
-import { ConfigError } from './config.js';
-import { ADMIN_SCOPE_PRIVILEGES } from './auth/scopes.js';
-export function outputSuccess(data) {
-    const output = { success: true, data };
-    process.stdout.write(JSON.stringify(output, null, 2) + '\n');
-}
-/**
- * Emit a prompt body verbatim to stdout — used by `bridge guide …` commands
- * whose output is intended to be read by a human or pasted to an AI agent.
- * Wrapping the markdown in a JSON envelope makes it unreadable in a terminal
- * and forces scripts to parse JSON to recover the original text. Use the
- * `--json` flag on each guide command if the envelope is needed for tooling.
- */
-export function outputPrompt(content) {
-    process.stdout.write(content.endsWith('\n') ? content : content + '\n');
-}
-/**
- * Turn "Privilege 'TOKEN_WRITE' required" into something the reader can act
- * on. Without this the message is a dead end: it names a privilege but not how
- * to obtain one, and the answer ("log in again, differently") is not guessable.
- */
-export function privilegeHint(message) {
-    const match = /Privilege '([A-Z_]+)' required/.exec(message);
-    const privilege = match?.[1];
-    if (!privilege || !ADMIN_SCOPE_PRIVILEGES.has(privilege))
-        return undefined;
-    return (`Your login token does not carry ${privilege}. ` +
-        'Re-authenticate with `bridge auth login --admin` to request delete authority ' +
-        'and the ability to create API tokens. The default login deliberately omits ' +
-        'them — the token is stored on disk and lives for 10 days.');
-}
-export function outputError(error) {
-    let code = 'UNKNOWN_ERROR';
-    let message = 'An unknown error occurred';
-    let details = undefined;
-    let hint;
-    let fields;
-    let exitCode = 1;
-    if (error instanceof ConfigError) {
-        code = 'CONFIG_ERROR';
-        message = error.message;
-        exitCode = 3;
-        // TBP-769 — a config error may name its own code and next step.
-        const carriedCode = error.code;
-        if (typeof carriedCode === 'string' && carriedCode.length > 0)
-            code = carriedCode;
-        const carriedHint = error.hint;
-        if (typeof carriedHint === 'string' && carriedHint.length > 0)
-            hint = carriedHint;
-    }
-    else if (error instanceof HttpError) {
-        code = `HTTP_${error.status}`;
-        message = error.message;
-        details = error.body;
-        exitCode = error.status >= 500 ? 2 : 1;
-        // Extract nblocksCode if present
-        if (typeof error.body === 'object' && error.body && 'nblocksCode' in error.body) {
-            code = error.body.nblocksCode;
-        }
-        // TBP-541 — the server named the fix itself; that beats any generic hint.
-        const serverFix = typeof error.body === 'object' && error.body && 'fix' in error.body
-            ? error.body.fix
-            : undefined;
-        if (typeof serverFix === 'string' && serverFix.length > 0) {
-            hint = serverFix;
-        }
-        else if (error.status === 403) {
-            // The server's message is the authoritative one; check the body too,
-            // since the privilege name sometimes only appears there.
-            const bodyMessage = typeof error.body === 'object' && error.body && 'message' in error.body
-                ? String(error.body.message)
-                : '';
-            hint = privilegeHint(message) ?? privilegeHint(bodyMessage);
-        }
-    }
-    else if (error instanceof Error) {
-        message = error.message;
-        // TBP-586: errors that carry their own machine-readable `code` (e.g.
-        // ResolveError's FLAG_NOT_FOUND / TENANT_AMBIGUOUS / INVALID_OPTIONS)
-        // report it instead of collapsing to UNKNOWN_ERROR.
-        const carried = error.code;
-        if (typeof carried === 'string' && carried.length > 0) {
-            code = carried;
-        }
-        // TBP-713: a DecisionNeededError carries the next step and the questions.
-        const carriedHint = error.hint;
-        if (typeof carriedHint === 'string' && carriedHint.length > 0)
-            hint = carriedHint;
-        const carriedFields = error.fields;
-        if (Array.isArray(carriedFields))
-            fields = carriedFields;
-    }
-    const output = {
-        success: false,
-        error: {
-            code,
-            message,
-            ...(hint !== undefined ? { hint } : {}),
-            ...(fields !== undefined ? { fields } : {}),
-            ...(details !== undefined ? { details } : {}),
-        },
-    };
-    process.stderr.write(JSON.stringify(output, null, 2) + '\n');
-    process.exitCode = exitCode;
-}
-//# sourceMappingURL=output.js.map

package/dist/output.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"output.js","sourceRoot":"","sources":["../src/output.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,MAAM,UAAU,aAAa,CAAC,IAAa;IACzC,MAAM,MAAM,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACvC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;AAC1E,CAAC;AAGD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,KAAK,GAAG,gCAAgC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,CAAC,SAAS,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3E,OAAO,CACL,mCAAmC,SAAS,IAAI;QAChD,+EAA+E;QAC/E,6EAA6E;QAC7E,2DAA2D,CAC5D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,IAAI,IAAI,GAAG,eAAe,CAAC;IAC3B,IAAI,OAAO,GAAG,2BAA2B,CAAC;IAC1C,IAAI,OAAO,GAAY,SAAS,CAAC;IACjC,IAAI,IAAwB,CAAC;IAC7B,IAAI,MAA6B,CAAC;IAClC,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;QACjC,IAAI,GAAG,cAAc,CAAC;QACtB,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QACxB,QAAQ,GAAG,CAAC,CAAC;QACb,gEAAgE;QAChE,MAAM,WAAW,GAAI,KAA4B,CAAC,IAAI,CAAC;QACvD,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;YAAE,IAAI,GAAG,WAAW,CAAC;QAClF,MAAM,WAAW,GAAI,KAA4B,CAAC,IAAI,CAAC;QACvD,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;YAAE,IAAI,GAAG,WAAW,CAAC;IACpF,CAAC;SAAM,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;QACtC,IAAI,GAAG,QAAQ,KAAK,CAAC,MAAM,EAAE,CAAC;QAC9B,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QACxB,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC;QACrB,QAAQ,GAAG,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAEvC,iCAAiC;QACjC,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,IAAI,aAAa,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YAChF,IAAI,GAAI,KAAK,CAAC,IAA+B,CAAC,WAAW,CAAC;QAC5D,CAAC;QAED,0EAA0E;QAC1E,MAAM,SAAS,GACb,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI;YACjE,CAAC,CAAE,KAAK,CAAC,IAAgC,CAAC,GAAG;YAC7C,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1D,IAAI,GAAG,SAAS,CAAC;QACnB,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAChC,qEAAqE;YACrE,yDAAyD;YACzD,MAAM,WAAW,GACf,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,IAAI,SAAS,IAAI,KAAK,CAAC,IAAI;gBACrE,CAAC,CAAC,MAAM,CAAE,KAAK,CAAC,IAAgC,CAAC,OAAO,CAAC;gBACzD,CAAC,CAAC,EAAE,CAAC;YACT,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,aAAa,CAAC,WAAW,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;SAAM,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAClC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QACxB,qEAAqE;QACrE,sEAAsE;QACtE,oDAAoD;QACpD,MAAM,OAAO,GAAI,KAA4B,CAAC,IAAI,CAAC;QACnD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtD,IAAI,GAAG,OAAO,CAAC;QACjB,CAAC;QACD,0EAA0E;QAC1E,MAAM,WAAW,GAAI,KAA4B,CAAC,IAAI,CAAC;QACvD,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;YAAE,IAAI,GAAG,WAAW,CAAC;QAClF,MAAM,aAAa,GAAI,KAA8B,CAAC,MAAM,CAAC;QAC7D,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;YAAE,MAAM,GAAG,aAAa,CAAC;IAC3D,CAAC;IAED,MAAM,MAAM,GAAG;QACb,OAAO,EAAE,KAAK;QACd,KAAK,EAAE;YACL,IAAI;YACJ,OAAO;YACP,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9C;KACF,CAAC;IACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC7D,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC;AAC9B,CAAC"}

package/dist/preview.d.ts

@@ -1,9 +0,0 @@
-export declare class PreviewNotSupportedError extends Error {
-    readonly path: string;
-    readonly serverBody?: unknown | undefined;
-    readonly code = "PREVIEW_NOT_SUPPORTED";
-    constructor(path: string, serverBody?: unknown | undefined);
-}
-export declare function previewPath(path: string): string;
-export declare function dryRunPreview(path: string, headers?: Record<string, string>): Promise<unknown>;
-//# sourceMappingURL=preview.d.ts.map

package/dist/preview.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"preview.d.ts","sourceRoot":"","sources":["../src/preview.ts"],"names":[],"mappings":"AAmBA,qBAAa,wBAAyB,SAAQ,KAAK;IAErC,QAAQ,CAAC,IAAI,EAAE,MAAM;IAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO;IADhE,QAAQ,CAAC,IAAI,2BAA2B;gBACnB,IAAI,EAAE,MAAM,EAAW,UAAU,CAAC,EAAE,OAAO,YAAA;CAOjE;AAcD,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAgBpG"}

package/dist/preview.js

@@ -1,63 +0,0 @@
-import { HttpError } from '@nebulr-group/bridge-auth-core';
-import { getManagementHttp } from './config.js';
-/*
- * TBP-709 (E) — `--dry-run` on the destructive commands.
- *
- * The preview is the server's: every delete route has a read-only sibling,
- * `GET <route>/deletion-preview`, that answers with what the delete would
- * remove and removes nothing. It passes the same guards as the delete, so a
- * login without the destructive privilege gets the same 403 — and it is the
- * same answer the MCP tools' `dryRun` shows.
- *
- * Why a GET on its own path, and never `?dryRun=true` on the DELETE: this CLI
- * is released separately from the server and is pointed at servers that
- * predate previews. Such a server ignores an unknown query parameter and
- * PERFORMS THE DELETE; it answers an unknown path with 404. So a 404 here
- * means "no previews on this server", and the command stops — it never falls
- * back to the delete.
- */
-export class PreviewNotSupportedError extends Error {
-    path;
-    serverBody;
-    code = 'PREVIEW_NOT_SUPPORTED';
-    constructor(path, serverBody) {
-        super(`This Bridge server does not support deletion previews yet (GET ${path} answered 404). ` +
-            'Nothing was deleted. Run without --dry-run only if you mean to delete.');
-        this.path = path;
-        this.serverBody = serverBody;
-        this.name = 'PreviewNotSupportedError';
-    }
-}
-/*
- * A server that HAS the route still 404s a record that does not exist, with
- * its own message ("tenant not found"). An unknown route gets the framework's
- * "Cannot GET …" (or a bare "Not Found" from a proxy in front). Only the
- * former is passed through as-is; either way the command fails and deletes
- * nothing — this only decides which message the user reads.
- */
-function isRecordNotFound(body) {
-    const message = body && typeof body === 'object' ? body.message : undefined;
-    return typeof message === 'string' && !/^Cannot GET\b/.test(message) && message !== 'Not Found';
-}
-export function previewPath(path) {
-    return `${path}/deletion-preview`;
-}
-export async function dryRunPreview(path, headers) {
-    const route = previewPath(path);
-    let preview;
-    try {
-        preview = await getManagementHttp().get(route, headers);
-    }
-    catch (err) {
-        if (err instanceof HttpError && err.status === 404 && !isRecordNotFound(err.body)) {
-            throw new PreviewNotSupportedError(route, err.body);
-        }
-        throw err;
-    }
-    return {
-        ...(preview && typeof preview === 'object' ? preview : {}),
-        dryRun: true,
-        next: 'Nothing was changed. Run the same command without --dry-run to go ahead.',
-    };
-}
-//# sourceMappingURL=preview.js.map

package/dist/preview.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"preview.js","sourceRoot":"","sources":["../src/preview.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IAE5B;IAAuB;IADnC,IAAI,GAAG,uBAAuB,CAAC;IACxC,YAAqB,IAAY,EAAW,UAAoB;QAC9D,KAAK,CACH,kEAAkE,IAAI,kBAAkB;YACtF,wEAAwE,CAC3E,CAAC;QAJiB,SAAI,GAAJ,IAAI,CAAQ;QAAW,eAAU,GAAV,UAAU,CAAU;QAK9D,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,IAAa;IACrC,MAAM,OAAO,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,IAA8B,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACvG,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,KAAK,WAAW,CAAC;AAClG,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,OAAO,GAAG,IAAI,mBAAmB,CAAC;AACpC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,OAAgC;IAChF,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,iBAAiB,EAAE,CAAC,GAAG,CAA0B,KAAK,EAAE,OAAO,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAClF,MAAM,IAAI,wBAAwB,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,OAAO;QACL,GAAG,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,0EAA0E;KACjF,CAAC;AACJ,CAAC"}

package/dist/product-decisions.d.ts

@@ -1,40 +0,0 @@
-/**
- * TBP-713 — the product decisions a command never makes for the developer.
- *
- * The list is bridge-api's PRODUCT_DECISIONS, shipped here as the generated
- * `prompts/product-decisions.json` (bridge-api's guide-currency.spec.ts fails
- * when the two differ). A command missing one of these stops before writing
- * anything, exits non-zero with `DECISION_NEEDED`, and lists the same fields
- * the MCP tool would, plus the flag that answers each.
- */
-export interface ProductDecision {
-    tool: string;
-    cli?: string;
-    field: string;
-    guide: string;
-    enforcement: 'ask' | 'only-when-given';
-    question: string;
-    type: 'string' | 'number' | 'boolean' | 'enum';
-    options?: string[];
-}
-export interface DecisionField {
-    name: string;
-    question: string;
-    type: ProductDecision['type'];
-    options?: string[];
-    /** The flag (or spec key) that answers it on this command. */
-    flag?: string;
-}
-/** `prompts/product-decisions.json`, from `dist/prompts` or the source tree. */
-export declare function loadProductDecisions(): ProductDecision[];
-/** One missing decision, by the MCP tool's field name; throws on a name not in the list. */
-export declare function decisionField(tool: string, field: string, flag?: string, name?: string): DecisionField;
-/** Thrown before any write; outputError prints code, message, hint and fields and exits 1. */
-export declare class DecisionNeededError extends Error {
-    readonly command: string;
-    readonly fields: DecisionField[];
-    readonly code = "DECISION_NEEDED";
-    readonly hint: string;
-    constructor(command: string, fields: DecisionField[], context?: string);
-}
-//# sourceMappingURL=product-decisions.d.ts.map

package/dist/product-decisions.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"product-decisions.d.ts","sourceRoot":"","sources":["../src/product-decisions.ts"],"names":[],"mappings":"AAIA;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,KAAK,GAAG,iBAAiB,CAAC;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAC;IAC/C,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC;IAC9B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,8DAA8D;IAC9D,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAID,gFAAgF;AAChF,wBAAgB,oBAAoB,IAAI,eAAe,EAAE,CAexD;AAED,4FAA4F;AAC5F,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,GAAE,MAAc,GAAG,aAAa,CAI7G;AAED,8FAA8F;AAC9F,qBAAa,mBAAoB,SAAQ,KAAK;IAIhC,QAAQ,CAAC,OAAO,EAAE,MAAM;IAAE,QAAQ,CAAC,MAAM,EAAE,aAAa,EAAE;IAHtE,QAAQ,CAAC,IAAI,qBAAqB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBAED,OAAO,EAAE,MAAM,EAAW,MAAM,EAAE,aAAa,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM;CAczF"}

package/dist/product-decisions.js

@@ -1,52 +0,0 @@
-import { readFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { commandsDir } from './commands/runtime-dir.js';
-let cached;
-/** `prompts/product-decisions.json`, from `dist/prompts` or the source tree. */
-export function loadProductDecisions() {
-    if (cached)
-        return cached;
-    const candidates = [
-        join(commandsDir, '..', 'prompts', 'product-decisions.json'),
-        join(commandsDir, '..', '..', 'prompts', 'product-decisions.json'),
-    ];
-    for (const path of candidates) {
-        try {
-            cached = JSON.parse(readFileSync(path, 'utf-8')).decisions;
-            return cached;
-        }
-        catch {
-            /* try next */
-        }
-    }
-    throw new Error(`product-decisions.json not found. Tried: ${candidates.join(', ')}`);
-}
-/** One missing decision, by the MCP tool's field name; throws on a name not in the list. */
-export function decisionField(tool, field, flag, name = field) {
-    const d = loadProductDecisions().find((x) => x.tool === tool && x.field === field);
-    if (!d)
-        throw new Error(`No product decision ${tool}.${field} in product-decisions.json`);
-    return { name, question: d.question, type: d.type, ...(d.options ? { options: [...d.options] } : {}), ...(flag ? { flag } : {}) };
-}
-/** Thrown before any write; outputError prints code, message, hint and fields and exits 1. */
-export class DecisionNeededError extends Error {
-    command;
-    fields;
-    code = 'DECISION_NEEDED';
-    hint;
-    constructor(command, fields, context) {
-        const names = fields.map((f) => f.name).join(', ');
-        super(`${command} needs ${fields.length === 1 ? 'a product decision' : `${fields.length} product decisions`} ` +
-            `the developer has not made: ${names}.${context ? ` ${context}` : ''} Nothing was changed.`);
-        this.command = command;
-        this.fields = fields;
-        this.name = 'DecisionNeededError';
-        const guide = loadProductDecisions().find((d) => d.cli === command)?.guide;
-        const flags = fields.map((f) => f.flag ?? f.name).join(' ');
-        this.hint =
-            `Ask the developer each question in fields and wait for the answers; do not choose values for them. ` +
-                `Then run ${command} again with ${flags}.` +
-                (guide ? ` \`bridge guide decision ${guide}\` says what each choice means.` : '');
-    }
-}
-//# sourceMappingURL=product-decisions.js.map

package/dist/product-decisions.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"product-decisions.js","sourceRoot":"","sources":["../src/product-decisions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AA+BxD,IAAI,MAAqC,CAAC;AAE1C,gFAAgF;AAChF,MAAM,UAAU,oBAAoB;IAClC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,UAAU,GAAG;QACjB,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,wBAAwB,CAAC;QAC5D,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,wBAAwB,CAAC;KACnE,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,GAAI,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAsC,CAAC,SAAS,CAAC;YACjG,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,cAAc;QAChB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,4CAA4C,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACvF,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,KAAa,EAAE,IAAa,EAAE,OAAe,KAAK;IAC5F,MAAM,CAAC,GAAG,oBAAoB,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;IACnF,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,IAAI,KAAK,4BAA4B,CAAC,CAAC;IAC1F,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACpI,CAAC;AAED,8FAA8F;AAC9F,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAIvB;IAA0B;IAHtC,IAAI,GAAG,iBAAiB,CAAC;IACzB,IAAI,CAAS;IAEtB,YAAqB,OAAe,EAAW,MAAuB,EAAE,OAAgB;QACtF,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,KAAK,CACH,GAAG,OAAO,UAAU,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,oBAAoB,GAAG;YACtG,+BAA+B,KAAK,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,uBAAuB,CAC9F,CAAC;QALiB,YAAO,GAAP,OAAO,CAAQ;QAAW,WAAM,GAAN,MAAM,CAAiB;QAMpE,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,MAAM,KAAK,GAAG,oBAAoB,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC,EAAE,KAAK,CAAC;QAC3E,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI;YACP,qGAAqG;gBACrG,YAAY,OAAO,eAAe,KAAK,GAAG;gBAC1C,CAAC,KAAK,CAAC,CAAC,CAAC,4BAA4B,KAAK,iCAAiC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACtF,CAAC;CACF"}

package/dist/prompt-urls.d.ts

@@ -1,31 +0,0 @@
-/**
- * Single source of truth for every raw.githubusercontent.com URL the CLI builds.
- *
- * TBP-585: `bridge integrate` and `bridge guide` each hardcoded their own copy
- * of the base URL and drifted — integrate pointed at the wrong GitHub org
- * (`nebulr-group`) *and* the wrong path (missing the nested package dir), so its
- * remote fallback was a permanent 404. The fallback is invisible in normal use
- * (an installed CLI reads the bundled prompt first), which is exactly why it
- * must be derived rather than retyped.
- *
- * Nothing outside this module should contain a raw.githubusercontent literal;
- * `src/__tests__/prompt-urls.test.ts` enforces that.
- */
-/** GitHub org that owns every Bridge repo the CLI reads content from. */
-export declare const GITHUB_RAW_BASE_URL = "https://raw.githubusercontent.com/thebridgedev";
-/**
- * The published npm package lives in a `bridge-cli/` subdirectory of the
- * `bridge-cli` repo — hence the doubled segment. Dropping it yields a 404.
- */
-export declare const CLI_PROMPTS_BASE_URL = "https://raw.githubusercontent.com/thebridgedev/bridge-cli/main/bridge-cli/prompts";
-/** URL of a prompt bundled in this repo, e.g. cliPromptUrl('flags', 'master.md'). */
-export declare function cliPromptUrl(...segments: string[]): string;
-/**
- * URL of a per-framework prompt owned by a plugin repo. `repoPrefix` is the
- * `<repo>/<ref>` pair from GUIDE_REPOS, e.g. `bridge-svelte/main`.
- */
-export declare function pluginGuideUrl(repoPrefix: string, filename: string): string;
-/** Master auth integration prompt — shared by `bridge integrate` and `bridge guide`. */
-export declare const AUTH_MASTER_PROMPT_FILENAME = "auth-master-integration-prompt.md";
-export declare const AUTH_MASTER_PROMPT_URL: string;
-//# sourceMappingURL=prompt-urls.d.ts.map

package/dist/prompt-urls.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"prompt-urls.d.ts","sourceRoot":"","sources":["../src/prompt-urls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,yEAAyE;AACzE,eAAO,MAAM,mBAAmB,mDAAmD,CAAC;AAEpF;;;GAGG;AACH,eAAO,MAAM,oBAAoB,sFAA8D,CAAC;AAEhG,qFAAqF;AACrF,wBAAgB,YAAY,CAAC,GAAG,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAE1D;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE3E;AAED,wFAAwF;AACxF,eAAO,MAAM,2BAA2B,sCAAsC,CAAC;AAC/E,eAAO,MAAM,sBAAsB,QAA4C,CAAC"}

package/dist/prompt-urls.js

@@ -1,35 +0,0 @@
-/**
- * Single source of truth for every raw.githubusercontent.com URL the CLI builds.
- *
- * TBP-585: `bridge integrate` and `bridge guide` each hardcoded their own copy
- * of the base URL and drifted — integrate pointed at the wrong GitHub org
- * (`nebulr-group`) *and* the wrong path (missing the nested package dir), so its
- * remote fallback was a permanent 404. The fallback is invisible in normal use
- * (an installed CLI reads the bundled prompt first), which is exactly why it
- * must be derived rather than retyped.
- *
- * Nothing outside this module should contain a raw.githubusercontent literal;
- * `src/__tests__/prompt-urls.test.ts` enforces that.
- */
-/** GitHub org that owns every Bridge repo the CLI reads content from. */
-export const GITHUB_RAW_BASE_URL = 'https://raw.githubusercontent.com/thebridgedev';
-/**
- * The published npm package lives in a `bridge-cli/` subdirectory of the
- * `bridge-cli` repo — hence the doubled segment. Dropping it yields a 404.
- */
-export const CLI_PROMPTS_BASE_URL = `${GITHUB_RAW_BASE_URL}/bridge-cli/main/bridge-cli/prompts`;
-/** URL of a prompt bundled in this repo, e.g. cliPromptUrl('flags', 'master.md'). */
-export function cliPromptUrl(...segments) {
-    return [CLI_PROMPTS_BASE_URL, ...segments].join('/');
-}
-/**
- * URL of a per-framework prompt owned by a plugin repo. `repoPrefix` is the
- * `<repo>/<ref>` pair from GUIDE_REPOS, e.g. `bridge-svelte/main`.
- */
-export function pluginGuideUrl(repoPrefix, filename) {
-    return `${GITHUB_RAW_BASE_URL}/${repoPrefix}/mcp/${filename}`;
-}
-/** Master auth integration prompt — shared by `bridge integrate` and `bridge guide`. */
-export const AUTH_MASTER_PROMPT_FILENAME = 'auth-master-integration-prompt.md';
-export const AUTH_MASTER_PROMPT_URL = cliPromptUrl(AUTH_MASTER_PROMPT_FILENAME);
-//# sourceMappingURL=prompt-urls.js.map

package/dist/prompt-urls.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"prompt-urls.js","sourceRoot":"","sources":["../src/prompt-urls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,yEAAyE;AACzE,MAAM,CAAC,MAAM,mBAAmB,GAAG,gDAAgD,CAAC;AAEpF;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,mBAAmB,qCAAqC,CAAC;AAEhG,qFAAqF;AACrF,MAAM,UAAU,YAAY,CAAC,GAAG,QAAkB;IAChD,OAAO,CAAC,oBAAoB,EAAE,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,UAAkB,EAAE,QAAgB;IACjE,OAAO,GAAG,mBAAmB,IAAI,UAAU,QAAQ,QAAQ,EAAE,CAAC;AAChE,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,MAAM,2BAA2B,GAAG,mCAAmC,CAAC;AAC/E,MAAM,CAAC,MAAM,sBAAsB,GAAG,YAAY,CAAC,2BAA2B,CAAC,CAAC"}