@nebulr-group/bridge-cli 0.6.5 → 1.0.0-alpha.0

package/dist/resolve.js

@@ -1,260 +0,0 @@
-// TBP-586 — Address resources by their human-readable key, not just by id.
-//
-// Most write commands used to take an opaque `--id` only, which forced every
-// caller (agent or human) to run a `list` first and pair the right id with the
-// right name by hand. This module is the single place that turns a
-// human-readable identifier into an id, so every noun behaves the same way.
-//
-// Semantics mirror the MCP layer's `toggle_feature_flag`
-// (bridge-api/microservices/account/nebulr-api/mcp/tools/flags.ts): list, find
-// by key, act — with two additions the CLI needs:
-//
-//   * exactly one of the id option / key option must be supplied, and
-//   * a key that matches MORE THAN ONE resource is a hard failure that lists
-//     the candidates. Never guess. Silently deleting the wrong tenant because
-//     two of them share a name is the worst outcome this module can produce.
-import { getManagementClient } from './config.js';
-/**
- * Error carrying a stable machine-readable `code`, so `outputError` can emit
- * something better than UNKNOWN_ERROR for resolution failures.
- */
-export class ResolveError extends Error {
-    code;
-    constructor(code, message) {
-        super(message);
-        this.name = 'ResolveError';
-        this.code = code;
-    }
-}
-const CODE_SAFE = /[^A-Z0-9]+/g;
-function codeFor(noun, suffix) {
-    return `${noun.toUpperCase().replace(CODE_SAFE, '_')}_${suffix}`;
-}
-/**
- * Turn `{ id }` or `{ key }` into an id.
- *
- * - both supplied  → INVALID_OPTIONS
- * - neither        → INVALID_OPTIONS, naming both options
- * - id supplied    → returned as-is (no network call)
- * - key supplied   → one `list()` call, then exact-match on the key
- *   - 0 matches    → `<NOUN>_NOT_FOUND`, naming the list command
- *   - >1 matches   → `<NOUN>_AMBIGUOUS`, listing every candidate. Nothing acts.
- */
-export async function resolveResourceId(target, spec) {
-    const { id, key } = target;
-    const hasId = id !== undefined && id !== '';
-    const hasKey = key !== undefined && key !== '';
-    if (hasId && hasKey) {
-        throw new ResolveError('INVALID_OPTIONS', `Pass either ${spec.idOption} or ${spec.keyOption}, not both.`);
-    }
-    if (!hasId && !hasKey) {
-        throw new ResolveError('INVALID_OPTIONS', `Missing target: pass ${spec.idOption} <id> or ${spec.keyOption} <${spec.keyLabel}>. ` +
-            `Run \`${spec.listCommand}\` to see existing ${spec.keyLabel}s.`);
-    }
-    if (hasId)
-        return id;
-    const normalize = spec.normalize ?? ((v) => v);
-    const wanted = normalize(key);
-    const items = await spec.list();
-    const matches = items.filter((item) => {
-        const candidate = spec.keyOf(item);
-        return candidate !== undefined && candidate !== null && normalize(candidate) === wanted;
-    });
-    if (matches.length === 0) {
-        throw new ResolveError(codeFor(spec.noun, 'NOT_FOUND'), `${spec.noun} not found: ${key}. Run \`${spec.listCommand}\` to see existing ${spec.keyLabel}s.`);
-    }
-    if (matches.length > 1) {
-        const describe = spec.describe ?? ((item) => `${spec.idOf(item)}`);
-        const candidates = matches.map((m) => `  - ${describe(m)}`).join('\n');
-        throw new ResolveError(codeFor(spec.noun, 'AMBIGUOUS'), `Ambiguous ${spec.keyLabel} "${key}" — it matches ${matches.length} ` +
-            `${spec.noun.toLowerCase()}s:\n${candidates}\n` +
-            `Nothing was changed. Re-run with ${spec.idOption} <id> to pick one.`);
-    }
-    return spec.idOf(matches[0]);
-}
-// ── per-noun resolvers ──────────────────────────────────────────────────────
-//
-// One function per noun so no command hand-rolls a `list().find()`. Each is a
-// thin `resolveResourceId` call describing where that noun's key lives.
-function flagSpec(list) {
-    return {
-        noun: 'Flag',
-        idOption: '--id',
-        keyOption: '--key',
-        keyLabel: 'key',
-        listCommand: 'bridge flag list',
-        list,
-        idOf: (f) => f.id,
-        keyOf: (f) => f.key,
-        describe: (f) => `${f.key} (id ${f.id})`,
-    };
-}
-/** `bridge flag …` — flag keys are unique. */
-export function resolveFlagId(target) {
-    return resolveResourceId(target, flagSpec(() => getManagementClient().flags.list()));
-}
-/**
- * Resolve to the whole flag record rather than just its id.
- *
- * TBP-548. `flag toggle` has to read the flag's current `state` before it
- * writes: turning a `state: "on-with-rule"` flag fully on would widen it from
- * the rule's audience to everyone, which is not what a switch labelled
- * "toggle" is understood to do. One `list()` serves both the resolution and
- * that check, and it costs the `--id` path its previous no-network property —
- * deliberately, since an `--id` that matches nothing now fails here by name
- * instead of as an opaque server 404.
- */
-export async function resolveFlag(target) {
-    // Memoised so a bad `--id`/`--key` combination still fails before any
-    // network call, and the key path lists exactly once.
-    let cached;
-    const list = async () => (cached ??= await getManagementClient().flags.list());
-    const id = await resolveResourceId(target, flagSpec(list));
-    const flags = await list();
-    const found = flags.find((f) => f.id === id);
-    if (!found) {
-        throw new ResolveError('FLAG_NOT_FOUND', `Flag not found: ${id}. Run \`bridge flag list\` to see existing flags.`);
-    }
-    return found;
-}
-/** `bridge role …` — role keys are unique (e.g. ADMIN). */
-export function resolveRoleId(target) {
-    return resolveResourceId(target, {
-        noun: 'Role',
-        idOption: '--id',
-        keyOption: '--key',
-        keyLabel: 'key',
-        listCommand: 'bridge role list',
-        list: () => getManagementClient().roles.list(),
-        idOf: (r) => r.id,
-        keyOf: (r) => r.key,
-        describe: (r) => `${r.key} — ${r.name} (id ${r.id})`,
-    });
-}
-/**
- * `bridge tenant …` — tenants have NO key field. `name` is optional and the
- * platform does not enforce uniqueness on it, so a duplicate name is a real
- * possibility and always fails loudly rather than picking one.
- */
-export function resolveTenantIdByName(target) {
-    return resolveResourceId(target, {
-        noun: 'Tenant',
-        idOption: '--id',
-        keyOption: '--name',
-        keyLabel: 'name',
-        listCommand: 'bridge tenant list',
-        list: () => getManagementClient().tenants.list(),
-        idOf: (t) => t.id,
-        keyOf: (t) => t.name,
-        describe: (t) => `${t.name ?? '(unnamed)'} — id ${t.id}` +
-            (t.signupBy?.email ? `, owner ${t.signupBy.email}` : '') +
-            (t.createdAt ? `, created ${t.createdAt}` : ''),
-    });
-}
-/**
- * `bridge user …` — users have no key either; email is the natural
- * human-readable identifier and is unique within a tenant. Matched
- * case-insensitively, as email addresses are.
- */
-export function resolveUserId(target, tenantId) {
-    return resolveResourceId(target, {
-        noun: 'User',
-        idOption: '--user-id',
-        keyOption: '--email',
-        keyLabel: 'email',
-        listCommand: 'bridge user list',
-        list: () => getManagementClient().users.list(tenantId),
-        idOf: (u) => u.id,
-        keyOf: (u) => u.email ?? u.username,
-        normalize: (v) => v.toLowerCase(),
-        describe: (u) => `${u.email ?? u.username}${u.fullName ? ` — ${u.fullName}` : ''} (id ${u.id})`,
-    });
-}
-/**
- * TBP-592 — turn privilege KEYS into the ids `POST/PUT /account/role` stores.
- *
- * `--privileges` is documented as taking keys, and keys are the only form a
- * human or agent has: they are what `bridge role list` prints and what the app
- * is designed around. But `role.model.ts` types `privileges` as
- * `Types.ObjectId[]` and resolves them with `findByIdsAndApp`, so a key
- * resolved to nothing, the array came back empty, and the model's pre-save
- * hook threw "A role needs at least one privilege".
- *
- * That error is the real cost. It reads as "you passed none" when the truth is
- * "the ones you passed were dropped", and nothing in it points at keys-vs-ids —
- * the only way to find out was to read the model.
- *
- * So: resolve here, and make an unknown identifier a hard failure that NAMES
- * the offenders. Silently dropping one privilege out of ten would create a role
- * that looks right and under-permits, which is worse than any error.
- *
- * Ids are still accepted and passed through untouched. Mixed input works. That
- * keeps `--privileges` honest for scripts that already pass ids, and means no
- * caller has to know which form the API wants.
- */
-export async function resolvePrivilegeIds(identifiers) {
-    const wanted = identifiers.map((v) => v.trim()).filter((v) => v !== '');
-    if (wanted.length === 0)
-        return [];
-    const privileges = await getManagementClient().roles.listPrivileges();
-    const byKey = new Map(privileges.map((p) => [p.key, p.id]));
-    const knownIds = new Set(privileges.map((p) => p.id));
-    const resolved = [];
-    const unknown = [];
-    for (const identifier of wanted) {
-        const id = byKey.get(identifier);
-        if (id !== undefined) {
-            resolved.push(id);
-        }
-        else if (knownIds.has(identifier)) {
-            resolved.push(identifier); // already an id
-        }
-        else {
-            unknown.push(identifier);
-        }
-    }
-    if (unknown.length > 0) {
-        const available = privileges.map((p) => p.key).sort();
-        throw new ResolveError('PRIVILEGE_NOT_FOUND', `Unknown privilege${unknown.length > 1 ? 's' : ''}: ${unknown.join(', ')}.\n` +
-            `Nothing was changed. Available privileges: ${available.join(', ') || '(none defined)'}.\n` +
-            `Run \`bridge role list\` to see which roles use them.`);
-    }
-    // De-duplicate: two spellings of the same privilege (its key and its id) must
-    // not produce a doubled entry in the stored array.
-    return [...new Set(resolved)];
-}
-/**
- * `bridge privilege …` — privilege keys are unique within an app, so a key
- * addresses exactly one. Same shape as `resolveRoleId`.
- */
-export function resolvePrivilegeId(target) {
-    return resolveResourceId(target, {
-        noun: 'Privilege',
-        idOption: '--id',
-        keyOption: '--key',
-        keyLabel: 'key',
-        listCommand: 'bridge privilege list',
-        list: () => getManagementClient().roles.listPrivileges(),
-        idOf: (p) => p.id,
-        keyOf: (p) => p.key,
-        describe: (p) => `${p.key}${p.description ? ` — ${p.description}` : ''} (id ${p.id})`,
-    });
-}
-/**
- * `bridge token …` — API tokens have no key; `name` is free text and is NOT
- * enforced unique, so two tokens can legitimately share one.
- */
-export function resolveTokenIdByName(target) {
-    return resolveResourceId(target, {
-        noun: 'Token',
-        idOption: '--id',
-        keyOption: '--name',
-        keyLabel: 'name',
-        listCommand: 'bridge token list',
-        list: () => getManagementClient().tokens.list(),
-        idOf: (t) => t.id,
-        keyOf: (t) => t.name,
-        describe: (t) => `${t.name} — id ${t.id}` + (t.createdAt ? `, created ${t.createdAt}` : ''),
-    });
-}
-//# sourceMappingURL=resolve.js.map

package/dist/resolve.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../src/resolve.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,EAAE;AACF,6EAA6E;AAC7E,+EAA+E;AAC/E,mEAAmE;AACnE,4EAA4E;AAC5E,EAAE;AACF,yDAAyD;AACzD,+EAA+E;AAC/E,kDAAkD;AAClD,EAAE;AACF,sEAAsE;AACtE,6EAA6E;AAC7E,8EAA8E;AAC9E,6EAA6E;AAG7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD;;;GAGG;AACH,MAAM,OAAO,YAAa,SAAQ,KAAK;IAC5B,IAAI,CAAS;IAEtB,YAAY,IAAY,EAAE,OAAe;QACvC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAgCD,MAAM,SAAS,GAAG,aAAa,CAAC;AAEhC,SAAS,OAAO,CAAC,IAAY,EAAE,MAAc;IAC3C,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;AACnE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAqB,EACrB,IAAoB;IAEpB,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IAC3B,MAAM,KAAK,GAAG,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC;IAC5C,MAAM,MAAM,GAAG,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE,CAAC;IAE/C,IAAI,KAAK,IAAI,MAAM,EAAE,CAAC;QACpB,MAAM,IAAI,YAAY,CACpB,iBAAiB,EACjB,eAAe,IAAI,CAAC,QAAQ,OAAO,IAAI,CAAC,SAAS,aAAa,CAC/D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QACtB,MAAM,IAAI,YAAY,CACpB,iBAAiB,EACjB,wBAAwB,IAAI,CAAC,QAAQ,YAAY,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,QAAQ,KAAK;YACpF,SAAS,IAAI,CAAC,WAAW,sBAAsB,IAAI,CAAC,QAAQ,IAAI,CACnE,CAAC;IACJ,CAAC;IACD,IAAI,KAAK;QAAE,OAAO,EAAY,CAAC;IAE/B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,SAAS,CAAC,GAAa,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IAChC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QACpC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,OAAO,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,YAAY,CACpB,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAC/B,GAAG,IAAI,CAAC,IAAI,eAAe,GAAG,WAAW,IAAI,CAAC,WAAW,sBAAsB,IAAI,CAAC,QAAQ,IAAI,CACjG,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAO,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtE,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvE,MAAM,IAAI,YAAY,CACpB,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAC/B,aAAa,IAAI,CAAC,QAAQ,KAAK,GAAG,kBAAkB,OAAO,CAAC,MAAM,GAAG;YACnE,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,UAAU,IAAI;YAC/C,oCAAoC,IAAI,CAAC,QAAQ,oBAAoB,CACxE,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,+EAA+E;AAC/E,EAAE;AACF,8EAA8E;AAC9E,wEAAwE;AAExE,SAAS,QAAQ,CAAC,IAAmC;IACnD,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,OAAO;QAClB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,kBAAkB;QAC/B,IAAI;QACJ,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE;QACjB,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG;QACnB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,GAAG;KACzC,CAAC;AACJ,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,aAAa,CAAC,MAAqB;IACjD,OAAO,iBAAiB,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,mBAAmB,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AACvF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAqB;IACrD,sEAAsE;IACtE,qDAAqD;IACrD,IAAI,MAAkC,CAAC;IACvC,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,MAAM,mBAAmB,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAE/E,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,MAAM,IAAI,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,YAAY,CACpB,gBAAgB,EAChB,mBAAmB,EAAE,mDAAmD,CACzE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,aAAa,CAAC,MAAqB;IACjD,OAAO,iBAAiB,CAAC,MAAM,EAAE;QAC/B,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,OAAO;QAClB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,kBAAkB;QAC/B,IAAI,EAAE,GAAG,EAAE,CAAC,mBAAmB,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE;QAC9C,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE;QACjB,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG;QACnB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,EAAE,GAAG;KACrD,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAqB;IACzD,OAAO,iBAAiB,CAAC,MAAM,EAAE;QAC/B,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,QAAQ;QACnB,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,oBAAoB;QACjC,IAAI,EAAE,GAAG,EAAE,CAAC,mBAAmB,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE;QAChD,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE;QACjB,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI;QACpB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CACd,GAAG,CAAC,CAAC,IAAI,IAAI,WAAW,SAAS,CAAC,CAAC,EAAE,EAAE;YACvC,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,MAAqB,EAAE,QAAgB;IACnE,OAAO,iBAAiB,CAAC,MAAM,EAAE;QAC/B,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE,SAAS;QACpB,QAAQ,EAAE,OAAO;QACjB,WAAW,EAAE,kBAAkB;QAC/B,IAAI,EAAE,GAAG,EAAE,CAAC,mBAAmB,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;QACtD,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE;QACjB,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,QAAQ;QACnC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE;QACjC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CACd,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,GAAG;KACjF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,WAAqB;IAC7D,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACxE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEnC,MAAM,UAAU,GAAG,MAAM,mBAAmB,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;IACtE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAEtD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,UAAU,IAAI,MAAM,EAAE,CAAC;QAChC,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACjC,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpB,CAAC;aAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACpC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,gBAAgB;QAC7C,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACtD,MAAM,IAAI,YAAY,CACpB,qBAAqB,EACrB,oBAAoB,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;YAC3E,8CAA8C,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,gBAAgB,KAAK;YAC3F,uDAAuD,CAC1D,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,mDAAmD;IACnD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAqB;IACtD,OAAO,iBAAiB,CAAC,MAAM,EAAE;QAC/B,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,OAAO;QAClB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,uBAAuB;QACpC,IAAI,EAAE,GAAG,EAAE,CAAC,mBAAmB,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE;QACxD,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE;QACjB,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG;QACnB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,GAAG;KACtF,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAqB;IACxD,OAAO,iBAAiB,CAAC,MAAM,EAAE;QAC/B,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,QAAQ;QACnB,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,mBAAmB;QAChC,IAAI,EAAE,GAAG,EAAE,CAAC,mBAAmB,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE;QAC/C,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE;QACjB,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI;QACpB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CACd,GAAG,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7E,CAAC,CAAC;AACL,CAAC"}

package/dist/shape.d.ts

@@ -1,25 +0,0 @@
-/**
- * Tenant metadata keys the platform writes for its own conversion-pixel
- * bookkeeping (tracking.service.ts, tenant.service.ts). Never app data.
- */
-export declare const INTERNAL_TENANT_METADATA_KEYS: string[];
-/** A tenant without the platform's pixel bookkeeping in `metadata`. */
-export declare function shapeTenant<T>(tenant: T): T;
-/**
- * A plan without the payment provider's ids: each quota's `providerRefs`
- * (Stripe price and meter ids) is dropped. Prices and quotas otherwise stay
- * whole — `create_plan` and friends still return the full plan.
- */
-export declare function shapePlan<T>(plan: T): T;
-/**
- * Roles with each privilege named once. Every role used to carry the full
- * privilege object (id, key, description) for every privilege it grants, so a
- * five-role app repeated the same descriptions five times. Now each role lists
- * privilege KEYS — what code and create_role/update_role take — and the
- * descriptions appear once, in `privileges`.
- */
-export declare function shapeRoleList(roles: unknown[]): {
-    roles: Array<Record<string, unknown>>;
-    privileges: Record<string, string>;
-};
-//# sourceMappingURL=shape.d.ts.map

package/dist/shape.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"shape.d.ts","sourceRoot":"","sources":["../src/shape.ts"],"names":[],"mappings":"AAUA;;;GAGG;AACH,eAAO,MAAM,6BAA6B,UAA+C,CAAC;AAE1F,uEAAuE;AACvE,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAU3C;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAYvC;AAOD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG;IAC/C,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACtC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpC,CAkBA"}

package/dist/shape.js

@@ -1,74 +0,0 @@
-/*
- * TBP-709 (D) — what `bridge … list` shows, minus the platform's internals.
- *
- * The REST DTOs these come from also serve the dashboards and the SDKs, so
- * they are left alone; the trimming happens at the presentation layer.
- * Port of bridge-api's MCP `shape.ts` (same functions, same tests) so the
- * CLI lists and the MCP lists cannot drift. Every function is pure and leaves
- * its input untouched.
- */
-/**
- * Tenant metadata keys the platform writes for its own conversion-pixel
- * bookkeeping (tracking.service.ts, tenant.service.ts). Never app data.
- */
-export const INTERNAL_TENANT_METADATA_KEYS = ['pendingPixelEvents', 'conversionTracking'];
-/** A tenant without the platform's pixel bookkeeping in `metadata`. */
-export function shapeTenant(tenant) {
-    if (!tenant || typeof tenant !== 'object')
-        return tenant;
-    const metadata = tenant.metadata;
-    if (!metadata || typeof metadata !== 'object')
-        return tenant;
-    const kept = Object.fromEntries(Object.entries(metadata).filter(([k]) => !INTERNAL_TENANT_METADATA_KEYS.includes(k)));
-    return { ...tenant, metadata: kept };
-}
-/**
- * A plan without the payment provider's ids: each quota's `providerRefs`
- * (Stripe price and meter ids) is dropped. Prices and quotas otherwise stay
- * whole — `create_plan` and friends still return the full plan.
- */
-export function shapePlan(plan) {
-    if (!plan || typeof plan !== 'object')
-        return plan;
-    const quotas = plan.quotas;
-    if (!Array.isArray(quotas))
-        return plan;
-    return {
-        ...plan,
-        quotas: quotas.map((q) => {
-            if (!q || typeof q !== 'object')
-                return q;
-            const { providerRefs: _drop, ...rest } = q;
-            return rest;
-        }),
-    };
-}
-/**
- * Roles with each privilege named once. Every role used to carry the full
- * privilege object (id, key, description) for every privilege it grants, so a
- * five-role app repeated the same descriptions five times. Now each role lists
- * privilege KEYS — what code and create_role/update_role take — and the
- * descriptions appear once, in `privileges`.
- */
-export function shapeRoleList(roles) {
-    const privileges = {};
-    const shaped = (roles ?? []).map((role) => {
-        const r = (role ?? {});
-        const granted = Array.isArray(r.privileges) ? r.privileges : [];
-        const keys = [];
-        for (const p of granted) {
-            if (typeof p === 'string') {
-                keys.push(p);
-                continue;
-            }
-            if (!p || typeof p.key !== 'string')
-                continue;
-            keys.push(p.key);
-            if (!(p.key in privileges))
-                privileges[p.key] = p.description ?? '';
-        }
-        return { ...r, privileges: keys };
-    });
-    return { roles: shaped, privileges };
-}
-//# sourceMappingURL=shape.js.map

package/dist/shape.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"shape.js","sourceRoot":"","sources":["../src/shape.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,oBAAoB,EAAE,oBAAoB,CAAC,CAAC;AAE1F,uEAAuE;AACvE,MAAM,UAAU,WAAW,CAAI,MAAS;IACtC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IACzD,MAAM,QAAQ,GAAI,MAAiC,CAAC,QAAQ,CAAC;IAC7D,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAC7B,MAAM,CAAC,OAAO,CAAC,QAAmC,CAAC,CAAC,MAAM,CACxD,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,6BAA6B,CAAC,QAAQ,CAAC,CAAC,CAAC,CACpD,CACF,CAAC;IACF,OAAO,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAO,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAI,IAAO;IAClC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,MAAM,GAAI,IAA6B,CAAC,MAAM,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO;QACL,GAAG,IAAI;QACP,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACvB,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,OAAO,CAAC,CAAC;YAC1C,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,CAA4B,CAAC;YACtE,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;KACE,CAAC;AACT,CAAC;AAOD;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,KAAgB;IAI5C,MAAM,UAAU,GAA2B,EAAE,CAAC;IAC9C,MAAM,MAAM,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACxC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;QAClD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,UAA4C,CAAC,CAAC,CAAC,EAAE,CAAC;QACnG,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAC1B,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACb,SAAS;YACX,CAAC;YACD,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;gBAAE,SAAS;YAC9C,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACjB,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,UAAU,CAAC;gBAAE,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC;QACtE,CAAC;QACD,OAAO,EAAE,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACpC,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AACvC,CAAC"}