@productbrain/cli 0.1.0-beta.1125 → 0.1.0-beta.11265

package/dist/commands/restore.d.ts

@@ -0,0 +1,2 @@
+export declare function runRestore(entryIdArg: string): Promise<void>;
+//# sourceMappingURL=restore.d.ts.map

package/dist/commands/restore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"restore.d.ts","sourceRoot":"","sources":["../../src/commands/restore.ts"],"names":[],"mappings":"AAoBA,wBAAsB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAsElE"}

package/dist/commands/restore.js

@@ -0,0 +1,83 @@
+/**
+ * pb restore <entry-id> — restore an archived Chain entry to draft.
+ *
+ * WP-514 review round 2 (P1): the ONLY production path to restoreArchivedEntry — a brand-new,
+ * always-authority-gated capability (VALID_ENTRY_STATUS_TRANSITIONS stays closed for archived,
+ * lib/guards.ts:146; there is no legacy fallback). Thin client mirroring `pb update`'s
+ * session/refusal handling — the server owns validation (BR-104).
+ */
+import { getConfigOrGuide } from '../lib/config.js';
+import { kernelCallWithSession } from '../lib/client.js';
+import { readSession } from '../lib/session.js';
+import { isJsonMode } from '../lib/runner.js';
+import { CLIError, ErrorCode } from '../lib/errors.js';
+import { emitEffectiveTenantNotice } from '../lib/workspaceNotice.js';
+export async function runRestore(entryIdArg) {
+    const config = await getConfigOrGuide(() => runRestore(entryIdArg));
+    if (!config)
+        return;
+    const json = isJsonMode();
+    const session = readSession();
+    if (!session) {
+        throw new CLIError('No active session.', {
+            code: ErrorCode.SESSION_REQUIRED,
+            category: 'session',
+            guidance: 'Run `pb session start` first. Write access requires a tracked session.',
+        });
+    }
+    const entryId = entryIdArg.trim();
+    if (!entryId) {
+        throw new CLIError('Entry ID is required.', {
+            code: ErrorCode.VALIDATION_FAILED,
+            category: 'validation',
+            guidance: 'Usage: pb restore <entry-id>',
+        });
+    }
+    await emitEffectiveTenantNotice();
+    if (!json)
+        process.stdout.write(`Restoring ${entryId} to draft...\n`);
+    let result;
+    try {
+        result = await kernelCallWithSession('chain.restoreArchivedEntry', {
+            entryId, changedBy: `agent:${session.sessionId}`,
+        });
+    }
+    catch (err) {
+        const mcpErr = err;
+        if (err instanceof Error && err.name === 'McpError') {
+            // Sweep finding #5: preserve an authority refusal as an authority refusal — mirrors
+            // runUpdate (update.ts). Flattening every gateway error to VALIDATION_FAILED told a
+            // machine caller to "fix input" even for a deny-by-default AUTH_DENIED (e.g. a
+            // delegated credential), instead of routing the work to an authorized principal.
+            const serverCode = String(mcpErr.code);
+            if (serverCode === 'AUTHZ_PERMISSION_DENIED' || serverCode === ErrorCode.AUTH_DENIED) {
+                throw new CLIError(mcpErr.message, {
+                    code: ErrorCode.AUTH_DENIED,
+                    category: 'auth',
+                    guidance: mcpErr.guidance,
+                });
+            }
+            throw new CLIError(mcpErr.message, { code: ErrorCode.VALIDATION_FAILED, category: 'validation' });
+        }
+        throw err;
+    }
+    if (result.outcome === 'refused') {
+        const { refusal } = result;
+        if (json) {
+            process.stdout.write(JSON.stringify({ outcome: 'refused', refusal }) + '\n');
+        }
+        const authorityRefusal = refusal.code !== 'not_archived' && refusal.code !== 'still_superseded';
+        throw new CLIError(refusal.reason ?? `Restoring ${entryId} was refused.`, {
+            code: authorityRefusal ? ErrorCode.AUTH_DENIED : ErrorCode.VALIDATION_FAILED,
+            category: authorityRefusal ? 'auth' : 'validation',
+            guidance: refusal.requiredAction ?? 'Route this change to the accountable role or Team Lead.',
+        });
+    }
+    if (json) {
+        process.stdout.write(JSON.stringify({ outcome: 'restored', entryId }) + '\n');
+    }
+    else {
+        process.stdout.write(`${entryId} restored to draft.\n`);
+    }
+}
+//# sourceMappingURL=restore.js.map

package/dist/commands/restore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"restore.js","sourceRoot":"","sources":["../../src/commands/restore.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAEzD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAMtE,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,UAAkB;IAClD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;IAE1B,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,MAAM,IAAI,QAAQ,CAAC,oBAAoB,EAAE;YACxC,IAAI,EAAE,SAAS,CAAC,gBAAgB;YAChC,QAAQ,EAAE,SAAS;YACnB,QAAQ,EAAE,wEAAwE;SAClF,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,MAAM,IAAI,QAAQ,CAAC,uBAAuB,EAAE;YAC3C,IAAI,EAAE,SAAS,CAAC,iBAAiB;YACjC,QAAQ,EAAE,YAAY;YACtB,QAAQ,EAAE,8BAA8B;SACxC,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,yBAAyB,EAAE,CAAC;IAClC,IAAI,CAAC,IAAI;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,OAAO,gBAAgB,CAAC,CAAC;IAEtE,IAAI,MAAqB,CAAC;IAC1B,IAAI,CAAC;QACJ,MAAM,GAAG,MAAM,qBAAqB,CAAgB,4BAA4B,EAAE;YACjF,OAAO,EAAE,SAAS,EAAE,SAAS,OAAO,CAAC,SAAS,EAAE;SAChD,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,GAAe,CAAC;QAC/B,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACrD,oFAAoF;YACpF,oFAAoF;YACpF,+EAA+E;YAC/E,iFAAiF;YACjF,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,UAAU,KAAK,yBAAyB,IAAI,UAAU,KAAK,SAAS,CAAC,WAAW,EAAE,CAAC;gBACtF,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE;oBAClC,IAAI,EAAE,SAAS,CAAC,WAAW;oBAC3B,QAAQ,EAAE,MAAM;oBAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ;iBACzB,CAAC,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,iBAAiB,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;QACnG,CAAC;QACD,MAAM,GAAG,CAAC;IACX,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;QAC3B,IAAI,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,gBAAgB,GAAG,OAAO,CAAC,IAAI,KAAK,cAAc,IAAI,OAAO,CAAC,IAAI,KAAK,kBAAkB,CAAC;QAChG,MAAM,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,IAAI,aAAa,OAAO,eAAe,EAAE;YACzE,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,iBAAiB;YAC5E,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY;YAClD,QAAQ,EAAE,OAAO,CAAC,cAAc,IAAI,yDAAyD;SAC7F,CAAC,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IAC/E,CAAC;SAAM,CAAC;QACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,uBAAuB,CAAC,CAAC;IACzD,CAAC;AACF,CAAC"}

package/dist/commands/rework.d.ts

@@ -0,0 +1,24 @@
+/**
+ * pb rework report — report an observed rework signal (WP-487 Slice 1 / FEAT-1373).
+ *
+ * Fills the M4 rework-meter slot reserved by `convex/scoreboard/aggregates.ts:1-15,597`. This is
+ * the SOLE ingestion path this quarter (founder-decided, WP-C spec §3/§4 Slice 1 Pass-2 review) —
+ * an agent-native checkpoint the CLI reports explicitly, not a CI/git-webhook adapter (excluded,
+ * spec §6). Requires an active session (mirrors `pb capture`, DEC-9/BR-8): the M4 join key needs
+ * a stable `conversationId`, which only resolves inside a tracked session.
+ */
+export interface ReworkReportOptions {
+    entryId: string;
+    classification: string;
+    reportedVia?: string;
+    attributable?: boolean;
+    task?: string;
+    /** Codex P2 fix (round 2, post-merge review): explicit conversation override, mirroring
+     *  `pb session start --conversation <id>`. Without this, `pb rework report` has no way to
+     *  find a session started with `--conversation <id>` when the shell never also set
+     *  PB_CONVERSATION_ID — readSession() with no override falls back to the legacy marker path,
+     *  not the conversation-scoped one `session start --conversation` wrote to. */
+    conversation?: string;
+}
+export declare function runReworkReport(options: ReworkReportOptions): Promise<void>;
+//# sourceMappingURL=rework.d.ts.map

package/dist/commands/rework.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rework.d.ts","sourceRoot":"","sources":["../../src/commands/rework.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAeH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;mFAI+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AASD,wBAAsB,eAAe,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsFjF"}

package/dist/commands/rework.js

@@ -0,0 +1,97 @@
+/**
+ * pb rework report — report an observed rework signal (WP-487 Slice 1 / FEAT-1373).
+ *
+ * Fills the M4 rework-meter slot reserved by `convex/scoreboard/aggregates.ts:1-15,597`. This is
+ * the SOLE ingestion path this quarter (founder-decided, WP-C spec §3/§4 Slice 1 Pass-2 review) —
+ * an agent-native checkpoint the CLI reports explicitly, not a CI/git-webhook adapter (excluded,
+ * spec §6). Requires an active session (mirrors `pb capture`, DEC-9/BR-8): the M4 join key needs
+ * a stable `conversationId`, which only resolves inside a tracked session.
+ */
+import { getConfigOrGuide } from '../lib/config.js';
+import { kernelCallWithSession } from '../lib/client.js';
+import { runCliCommand } from '../lib/runner.js';
+import { readSession } from '../lib/session.js';
+import { CLIError, ErrorCode } from '../lib/errors.js';
+const CLASSIFICATIONS = ['revision', 'ci_review_correction', 'user_override'];
+const REPORTED_VIA = ['followup_commit', 'ci_rerun', 'manual'];
+export async function runReworkReport(options) {
+    const config = await getConfigOrGuide(() => runReworkReport(options));
+    if (!config)
+        return;
+    const entryId = options.entryId?.trim();
+    if (!entryId) {
+        throw new CLIError('An entry ID is required.', {
+            code: ErrorCode.VALIDATION_FAILED,
+            category: 'validation',
+        });
+    }
+    if (!CLASSIFICATIONS.includes(options.classification)) {
+        throw new CLIError(`--classification must be one of: ${CLASSIFICATIONS.join(', ')}`, {
+            code: ErrorCode.VALIDATION_FAILED,
+            category: 'validation',
+        });
+    }
+    const classification = options.classification;
+    const reportedVia = (options.reportedVia ?? 'manual');
+    if (!REPORTED_VIA.includes(reportedVia)) {
+        throw new CLIError(`--via must be one of: ${REPORTED_VIA.join(', ')}`, {
+            code: ErrorCode.VALIDATION_FAILED,
+            category: 'validation',
+        });
+    }
+    // Require active session (DEC-9, BR-8, mirrors pb capture) — write access needs a tracked
+    // session, and the M4 join key needs the session's resolved conversationId.
+    //
+    // Codex P2 fix (round 2, post-merge review): pass `options.conversation` through to
+    // readSession() so a caller who started the session with `pb session start --conversation <id>`
+    // (writing the marker to .productbrain/sessions/<id>.json) can find it here even when the shell
+    // never ALSO exported PB_CONVERSATION_ID — a bare readSession() falls back to the legacy marker
+    // path and misses it. Without this override, an agent following `pb session start`'s own
+    // recovery guidance would still hit "No active session" on the very next command.
+    const session = readSession(options.conversation);
+    if (!session) {
+        throw new CLIError('No active session.', {
+            code: ErrorCode.SESSION_REQUIRED,
+            category: 'session',
+            guidance: 'Run `pb session start` first. Write access requires a tracked session. If you started a ' +
+                'session with `pb session start --conversation <id>`, re-run this command with ' +
+                '`--conversation <id>` (or export PB_CONVERSATION_ID=<id> in this shell) so it resolves the ' +
+                'same conversation-scoped marker.',
+        });
+    }
+    if (!session.conversationId) {
+        // Fail closed client-side too (TEN-2728): a rework signal with no conversationId cannot
+        // anchor the M4 join, and the server refuses it anyway — surface the real cause here rather
+        // than a generic server validation error.
+        throw new CLIError('No conversation identity resolved for this session.', {
+            code: ErrorCode.VALIDATION_FAILED,
+            category: 'validation',
+            guidance: 'A rework signal needs a stable conversationId to join against the governance-served log (M4). ' +
+                'Run this from a harness that sets PB_CONVERSATION_ID / CLAUDE_CODE_SESSION_ID / CURSOR_CONVERSATION_ID, ' +
+                'or start a fresh session with `pb session start --conversation <id>` and re-run this command ' +
+                'with the SAME `--conversation <id>` (otherwise only `session start` and `session close` read the flag).',
+        });
+    }
+    await runCliCommand({
+        fn: async () => {
+            return await kernelCallWithSession('rework.report', {
+                // Codex P1 fix (post-merge review): sessionId lets the server resolve conversationId
+                // AUTHORITATIVELY from the caller's own agentSessions row (mirrors served.ts's
+                // recordGovernanceServed stamping) rather than trusting the client-supplied string alone.
+                // conversationId still travels as a fallback for the server's bare-conversationId lookup
+                // path — both are verified server-side against the gateway-injected caller identity.
+                sessionId: session.sessionId,
+                conversationId: session.conversationId,
+                entryId,
+                classification,
+                reportedVia,
+                ...(options.attributable ? { attributableToGovernanceMiss: true } : {}),
+                ...(options.task ? { task: options.task } : {}),
+            });
+        },
+        formatPretty: (result) => result.deduped
+            ? `Rework signal already recorded (${classification}, via ${reportedVia}) — reused the existing row from a moment ago.`
+            : `Rework signal recorded (${classification}, via ${reportedVia}).`,
+    });
+}
+//# sourceMappingURL=rework.js.map

package/dist/commands/rework.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rework.js","sourceRoot":"","sources":["../../src/commands/rework.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAEvD,MAAM,eAAe,GAAG,CAAC,UAAU,EAAE,sBAAsB,EAAE,eAAe,CAAU,CAAC;AAGvF,MAAM,YAAY,GAAG,CAAC,iBAAiB,EAAE,UAAU,EAAE,QAAQ,CAAU,CAAC;AAwBxE,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAA4B;IAChE,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;IACtE,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,QAAQ,CAAC,0BAA0B,EAAE;YAC7C,IAAI,EAAE,SAAS,CAAC,iBAAiB;YACjC,QAAQ,EAAE,YAAY;SACvB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAsC,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,QAAQ,CAAC,oCAAoC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;YACnF,IAAI,EAAE,SAAS,CAAC,iBAAiB;YACjC,QAAQ,EAAE,YAAY;SACvB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,cAAc,GAAG,OAAO,CAAC,cAAsC,CAAC;IAEtE,MAAM,WAAW,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,QAAQ,CAAsB,CAAC;IAC3E,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,QAAQ,CAAC,yBAAyB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;YACrE,IAAI,EAAE,SAAS,CAAC,iBAAiB;YACjC,QAAQ,EAAE,YAAY;SACvB,CAAC,CAAC;IACL,CAAC;IAED,0FAA0F;IAC1F,4EAA4E;IAC5E,EAAE;IACF,oFAAoF;IACpF,gGAAgG;IAChG,gGAAgG;IAChG,gGAAgG;IAChG,yFAAyF;IACzF,kFAAkF;IAClF,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,QAAQ,CAAC,oBAAoB,EAAE;YACvC,IAAI,EAAE,SAAS,CAAC,gBAAgB;YAChC,QAAQ,EAAE,SAAS;YACnB,QAAQ,EACN,0FAA0F;gBAC1F,gFAAgF;gBAChF,6FAA6F;gBAC7F,kCAAkC;SACrC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAC5B,wFAAwF;QACxF,4FAA4F;QAC5F,0CAA0C;QAC1C,MAAM,IAAI,QAAQ,CAAC,qDAAqD,EAAE;YACxE,IAAI,EAAE,SAAS,CAAC,iBAAiB;YACjC,QAAQ,EAAE,YAAY;YACtB,QAAQ,EACN,gGAAgG;gBAChG,0GAA0G;gBAC1G,+FAA+F;gBAC/F,yGAAyG;SAC5G,CAAC,CAAC;IACL,CAAC;IAED,MAAM,aAAa,CAAqB;QACtC,EAAE,EAAE,KAAK,IAAI,EAAE;YACb,OAAO,MAAM,qBAAqB,CAA4C,eAAe,EAAE;gBAC7F,qFAAqF;gBACrF,+EAA+E;gBAC/E,0FAA0F;gBAC1F,yFAAyF;gBACzF,qFAAqF;gBACrF,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,OAAO;gBACP,cAAc;gBACd,WAAW;gBACX,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,4BAA4B,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChD,CAAC,CAAC;QACL,CAAC;QACD,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CACvB,MAAM,CAAC,OAAO;YACZ,CAAC,CAAC,mCAAmC,cAAc,SAAS,WAAW,gDAAgD;YACvH,CAAC,CAAC,2BAA2B,cAAc,SAAS,WAAW,IAAI;KACxE,CAAC,CAAC;AACL,CAAC"}

package/dist/commands/role.d.ts

@@ -0,0 +1,88 @@
+import { type EntryFromApi } from '../formatters/entry.js';
+export interface RoleAccountableOptions {
+    canonicalKey?: string;
+    limit?: string;
+    cursor?: string;
+    json?: boolean;
+}
+/** Mirrors `chain.listByRole`'s row shape (convex/agentKnowledge/entriesByRole.ts's
+ *  `RoleEntrySummary`) with a PLAIN `id: string` — the door returns a Convex document id over
+ *  the wire as a bare string, and this interface (not the raw gateway type's branded
+ *  `Id<'entries'>`) is what argv-facing code and its own tests actually handle, same pattern
+ *  `outcome.ts`'s own `ReadingRow`/`ListReadingsResult` use. The call site below still derives
+ *  from `GatewayRouteReturnByName<'chain.listByRole'>` (review PRRT_kwDORS4ils6gQAqu) so a
+ *  route-shape drift fails the `as` cast at compile time — the branded id only blocks the
+ *  OPPOSITE direction (a plain-string test fixture claiming to BE the branded type), which never
+ *  happens here: the widening cast below (branded -> plain) is always legal. */
+export interface RoleEntryRow {
+    id: string;
+    entryId?: string;
+    name: string;
+    canonicalKey?: string;
+    collectionSlug?: string;
+    status: string;
+    workflowStatus?: string;
+}
+export interface ListByRoleResult {
+    role: {
+        id: string;
+        entryId?: string;
+        name: string;
+    };
+    explicit: RoleEntryRow[];
+    explicitTruncated: boolean;
+    nextCursor: number | null;
+    reporting: RoleEntryRow[];
+    reportingTruncated: boolean;
+    inherited: RoleEntryRow[];
+    inheritedResolution: 'not-computed';
+    inheritedNotComputedReason: string;
+    truncated: boolean;
+    /** TASK-636 (DEC-1810): who holds the role; status is active, invited or placeholder. */
+    holders: {
+        personId: string;
+        displayName: string;
+        status: string;
+        teamName: string | null;
+    }[];
+    holdersTruncated: boolean;
+}
+/**
+ * Pretty rendering for `pb role accountable`. Exported so door-parity content-equality against
+ * the MCP tool's own rendering (`packages/mcp-server/src/tools/role.ts`) is assertable directly,
+ * not only through a live walk — both read the SAME `chain.listByRole` JSON shape and both print
+ * the SAME three sections in the SAME order.
+ */
+export declare function formatRoleAccountable(result: ListByRoleResult | null): string;
+export declare function runRoleAccountable(roleId: string, options: RoleAccountableOptions): Promise<void>;
+export interface RoleSeatOptions {
+    person?: string;
+    newPerson?: string;
+    team?: string;
+}
+export declare function runRoleSeat(roleId: string, options: RoleSeatOptions): Promise<void>;
+export declare function runRoleUnseat(roleId: string, options: {
+    person: string;
+    team?: string;
+}): Promise<void>;
+/** TEN-4847: `pb role list` reads at most this many roles; past it, it says the list is cut. Each role
+ *  costs two gateway reads (team, holders), so 40 roles stay near 82 requests, under the default
+ *  120-per-minute API-key quota (convex/rateLimiter.ts). A larger list needs one kernel read (DEC-2104). */
+export declare const ROLE_LIST_CAP = 40;
+/** `owner` is the kernel's where-it-lives line for the role (a `placed` team), as `pb get` reads it. */
+export interface RoleListRow {
+    entryId: string;
+    name: string;
+    owner: EntryFromApi['owner'] | null;
+    holders: number;
+    holdersTruncated: boolean;
+}
+export interface RoleListResult {
+    roles: RoleListRow[];
+    truncated: boolean;
+}
+/** Every role in the workspace over the paged collection read (slug `roles`), capped at ROLE_LIST_CAP. */
+export declare function readRoleList(): Promise<RoleListResult>;
+export declare function formatRoleList(result: RoleListResult): string;
+export declare function runRoleList(): Promise<void>;
+//# sourceMappingURL=role.d.ts.map

package/dist/commands/role.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role.d.ts","sourceRoot":"","sources":["../../src/commands/role.ts"],"names":[],"mappings":"AAiCA,OAAO,EAAmB,KAAK,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAE5E,MAAM,WAAW,sBAAsB;IACtC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;CACf;AAED;;;;;;;;gFAQgF;AAChF,MAAM,WAAW,YAAY;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IAItB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,gBAAgB;IAChC,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACrD,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,YAAY,EAAE,CAAC;IAC1B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,SAAS,EAAE,YAAY,EAAE,CAAC;IAC1B,mBAAmB,EAAE,cAAc,CAAC;IACpC,0BAA0B,EAAE,MAAM,CAAC;IACnC,SAAS,EAAE,OAAO,CAAC;IACnB,yFAAyF;IACzF,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,EAAE,CAAC;IAC9F,gBAAgB,EAAE,OAAO,CAAC;CAC1B;AAuGD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,gBAAgB,GAAG,IAAI,GAAG,MAAM,CAkB7E;AAED,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBvG;AAED,MAAM,WAAW,eAAe;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;CACd;AAMD,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAazF;AAED,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAM7G;AAED;;4GAE4G;AAC5G,eAAO,MAAM,aAAa,KAAK,CAAC;AAKhC,wGAAwG;AACxG,MAAM,WAAW,WAAW;IAAG,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,OAAO,CAAA;CAAE;AAC/I,MAAM,WAAW,cAAc;IAAG,KAAK,EAAE,WAAW,EAAE,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE;AAoB5E,0GAA0G;AAC1G,wBAAsB,YAAY,IAAI,OAAO,CAAC,cAAc,CAAC,CAqB5D;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAY7D;AAED,wBAAsB,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAKjD"}

package/dist/commands/role.js

@@ -0,0 +1,235 @@
+import { getConfigOrGuide } from '../lib/config.js';
+import { kernelCall, kernelCallWithSession } from '../lib/client.js';
+import { CLIError, ErrorCode } from '../lib/errors.js';
+import { runCliCommand } from '../lib/runner.js';
+import { formatSeatSentence, personStatusTag } from '../lib/seatSentence.js';
+import { sanitizeSingleLineField } from '../lib/strip.js';
+import { runOrganisationWrite } from './organisationWrite.js';
+import { formatOwnerLine } from '../formatters/entry.js';
+/** Holders first: who answers for the role, a non-active holder tagged with their state word (TASK-712, DEC-2007). */
+function formatHolders(result) {
+    if (result.holders.length === 0)
+        return [`  holders: none${result.holdersTruncated ? ' found, but the membership scan is incomplete' : ''}`];
+    return [
+        '  holders:',
+        ...result.holders.map((h) => {
+            const word = personStatusTag(h.status);
+            const tag = word ? ` (${word})` : '';
+            const team = h.teamName ? `  in ${sanitizeSingleLineField(h.teamName)}` : '';
+            return `    ${sanitizeSingleLineField(h.displayName)}${tag}${team}`;
+        }),
+        ...(result.holdersTruncated ? ['    (membership scan cut at 500 rows, more holders may exist)'] : []),
+    ];
+}
+const validation = (message, guidance) => new CLIError(message, { code: ErrorCode.VALIDATION_FAILED, category: 'validation', guidance });
+/** argv is a string; `--limit`/`--cursor` want whole numbers. Refused HERE, before any network
+ *  call, naming the flag — same shape `outcome.ts`'s own `requireNumber` and `shape.ts`'s enum
+ *  checks use (CLIError + code: VALIDATION_FAILED + category: 'validation'), so an invalid flag
+ *  reports category=validation in JSON mode rather than falling through to `runCliCommand`'s
+ *  generic unknown-error wrap (code: INTERNAL). Un-refused, `Number('abc')` is NaN, which
+ *  `JSON.stringify` silently turns into `null` on the wire — a validation bug disguised as a
+ *  present-but-empty value, not caught until the gateway's own (differently-worded) refusal.
+ */
+function requireInteger(raw, flag, range) {
+    const trimmed = raw.trim();
+    const parsed = Number(trimmed);
+    if (trimmed === '' || !Number.isInteger(parsed)) {
+        throw validation(`${flag} must be a whole number (got "${raw}").`, 'Usage: pb role accountable <role-id> [--limit <n>] [--cursor <n>]');
+    }
+    // PR #856 review round 3 (Codex P2, PRRT_kwDORS4ils6gQrZI): `requireInteger` checked only
+    // integrality, so `--limit 0`, a negative value, or anything above 200 reached the network
+    // call and was silently clamped server-side (convex/agentKnowledge/entriesByRole.ts:1-200
+    // range) to a page size the caller never asked for. Reject the advertised 1-200 range here,
+    // matching the MCP tool's own schema (packages/mcp-server/src/tools/role.ts), before the call.
+    if (range && (parsed < range.min || parsed > range.max)) {
+        throw validation(`${flag} must be between ${range.min} and ${range.max} (got ${parsed}).`, 'Usage: pb role accountable <role-id> [--limit <n>] [--cursor <n>]');
+    }
+    return parsed;
+}
+/** One row, terminal-safe. `name` is stored content any connector with write access can set —
+ *  sanitized for the same reason `outcome.ts`'s `formatReadingsList` sanitizes `note`/`valueText`:
+ *  this rendering is a plain-text sink, and an embedded newline would forge an extra row. */
+function formatRow(row) {
+    const id = row.entryId ?? row.id;
+    // PR #856 review round 3 (Codex P2, PRRT_kwDORS4ils6gQrZW): `chain.listByRole` deliberately
+    // includes each row's domain `workflowStatus` (convex/agentKnowledge/entriesByRole.ts:73-90)
+    // separately from `status` (the TRUST status, e.g. 'accepted') — a tension's `open` vs
+    // `closed` is exactly the distinction between a current obligation and a completed one.
+    // Dropping it here made both render identically as `[tension/accepted]`; render it, mirroring
+    // `packages/mcp-server/src/tools/entries.ts:697-700`'s existing formatter.
+    // PR #872 review round 3 (Codex P2): workflowStatus is stored content read from a workspace
+    // collection's `validWorkflowStatuses` declaration — vocabulary-checked by guardWorkflowStatus,
+    // never terminal-safety-checked, so a value containing a newline/control sequence could still
+    // forge an extra row. Sanitized the same way `row.name` already is.
+    const statusDisplay = row.workflowStatus ? `${row.status} / ${sanitizeSingleLineField(row.workflowStatus)}` : row.status;
+    // WP-771 S1b round 2 (Codex P2, PRRT_kwDORS4ils6lGWJ0): render the real collection slug,
+    // matching the MCP `role` tool's formatRow fixed this round — same sanitization, same '?'
+    // fallback for a row whose collection couldn't be resolved.
+    const collectionSlug = row.collectionSlug ? sanitizeSingleLineField(row.collectionSlug) : '?';
+    return `    ${id}  ${sanitizeSingleLineField(row.name)}  [${collectionSlug}/${statusDisplay}]`;
+}
+/** One labelled section — `explicit` or `reporting`. Empty prints the shared empty-state text
+ *  rather than an ambiguous blank, and a truncated page says so with an ACTIONABLE hint rather
+ *  than a vague "more exist" (review PRRT_kwDORS4ils6gQAqo, §13: cap every read AND surface
+ *  truncation to the caller — a claim of "continue with the printed cursor" that never printed
+ *  one is the failure this fixes). `cursorHint` is `undefined` for a section the gateway cannot
+ *  page (`reporting` — PR-1's own design: only `explicit` accepts a cursor) — that section
+ *  states the cap plainly instead of pointing at a flag that would silently be ignored. */
+function formatSection(label, rows, truncated, cursorHint) {
+    // PR #856 review round 3 (Codex P2, PRRT_kwDORS4ils6gQrY9): `canonicalKey` filtering can
+    // legitimately return `rows: []` with `truncated: true` and a usable cursor — the backend's
+    // raw scan window was exhausted without confirming no more matches exist beyond it
+    // (convex/agentKnowledge/entriesByRole.ts). Printing "not recorded yet" for that response
+    // falsely presents the role as having no matching entries at all and swallows the cursor that
+    // would let the caller keep looking. Check truncation BEFORE the empty-state early return.
+    if (rows.length === 0 && !truncated)
+        return [`  ${label}: not recorded yet`];
+    const lines = rows.length === 0 ? [`  ${label}: not recorded yet, but the scan is incomplete`] : [`  ${label}:`, ...rows.map(formatRow)];
+    // PR #872 review round 3 (Codex P2): `truncated` can be true purely because the raw scan
+    // budget (MAX_SCAN_BATCHES batches, entriesByRole.ts) was exhausted without confirming the
+    // true end of the index range — NOT because a filtered match beyond this page was actually
+    // found. "more exist" overclaimed a fact the backend never established; "scan incomplete"
+    // states only what is actually known (keep paging to find out), never asserts a match exists.
+    if (truncated)
+        lines.push(`    (scan incomplete, more may exist — ${cursorHint ?? 'raise --limit (capped at 200, no cursor for this list)'})`);
+    return lines;
+}
+/**
+ * Pretty rendering for `pb role accountable`. Exported so door-parity content-equality against
+ * the MCP tool's own rendering (`packages/mcp-server/src/tools/role.ts`) is assertable directly,
+ * not only through a live walk — both read the SAME `chain.listByRole` JSON shape and both print
+ * the SAME three sections in the SAME order.
+ */
+export function formatRoleAccountable(result) {
+    if (!result)
+        return 'Role not found.';
+    const roleLabel = `${sanitizeSingleLineField(result.role.name)} (${result.role.entryId ?? result.role.id})`;
+    // `explicit` is the only cursor-able list (PR-1's design) — print the REAL next cursor when
+    // truncated, never a bare claim that one exists.
+    const explicitCursorHint = result.nextCursor !== null
+        ? `raise --limit or continue with --cursor ${result.nextCursor}`
+        : 'raise --limit';
+    return [
+        `${roleLabel} — accountability:`,
+        ...formatHolders(result),
+        ...formatSection('explicit (owns)', result.explicit, result.explicitTruncated, explicitCursorHint),
+        ...formatSection('reporting (reports on)', result.reporting, result.reportingTruncated),
+        // DEC-1587 Team-Lead vacancy coverage — always not-computed today (see
+        // convex/agentKnowledge/entriesByRole.ts's own header for why); named, never faked as an
+        // empty computed list.
+        `  inherited: not-computed — ${result.inheritedNotComputedReason}`,
+    ].join('\n');
+}
+export async function runRoleAccountable(roleId, options) {
+    // Refuse everything refusable BEFORE the network call — same discipline outcome.ts's
+    // requireNumber and shape.ts's enum checks use.
+    const limit = options.limit !== undefined ? requireInteger(options.limit, '--limit', { min: 1, max: 200 }) : undefined;
+    const cursor = options.cursor !== undefined ? requireInteger(options.cursor, '--cursor') : undefined;
+    const config = await getConfigOrGuide(() => runRoleAccountable(roleId, options));
+    if (!config)
+        return;
+    await runCliCommand({
+        // A read: no session required, same posture as `pb outcome list`.
+        fn: async () => {
+            const raw = await kernelCall('chain.listByRole', {
+                roleId,
+                ...(options.canonicalKey ? { canonicalKey: options.canonicalKey } : {}),
+                ...(limit !== undefined ? { limit } : {}),
+                ...(cursor !== undefined ? { cursor } : {}),
+            });
+            return raw;
+        },
+        formatPretty: (value_) => formatRoleAccountable(value_),
+    });
+}
+const seatSentence = (action) => (result) => formatSeatSentence(action, result, sanitizeSingleLineField);
+export async function runRoleSeat(roleId, options) {
+    // Exactly one of an existing person or --new-person; refused before any network call.
+    if ((options.person === undefined) === (options.newPerson === undefined)) {
+        throw validation(options.person === undefined ? 'Say who to seat: --person <id-or-email>, or --new-person <name>.' : 'Give --person or --new-person, not both.', 'Usage: pb role seat <role-id> (--person <id-or-email> | --new-person <name>) [--team <team-id>]');
+    }
+    const config = await getConfigOrGuide(() => runRoleSeat(roleId, options));
+    if (!config)
+        return;
+    await runOrganisationWrite((context) => kernelCallWithSession('organisation.seatInRole', {
+        roleRef: roleId, targetPersonRef: options.person, newPersonName: options.newPerson, teamRef: options.team, sessionId: context.sessionId,
+    }), seatSentence('seat'));
+}
+export async function runRoleUnseat(roleId, options) {
+    const config = await getConfigOrGuide(() => runRoleUnseat(roleId, options));
+    if (!config)
+        return;
+    await runOrganisationWrite((context) => kernelCallWithSession('organisation.unseatFromRole', {
+        roleRef: roleId, targetPersonRef: options.person, teamRef: options.team, sessionId: context.sessionId,
+    }), seatSentence('unseat'));
+}
+/** TEN-4847: `pb role list` reads at most this many roles; past it, it says the list is cut. Each role
+ *  costs two gateway reads (team, holders), so 40 roles stay near 82 requests, under the default
+ *  120-per-minute API-key quota (convex/rateLimiter.ts). A larger list needs one kernel read (DEC-2104). */
+export const ROLE_LIST_CAP = 40;
+const ROLE_PAGE_SIZE = 50; // the paged read's own page cap (convex/agentKnowledge/listEntriesPaged.ts)
+const ROLE_READS_AT_ONCE = 8;
+const MAX_ROLE_PAGES = 10;
+/** One role's team (its owner line, as `pb get` reads it) and how many holder seats it has. */
+async function readRoleRow(role) {
+    const [entry, raw] = await Promise.all([
+        kernelCall('chain.getEntry', { entryId: role.entryId }),
+        kernelCall('chain.listByRole', { roleId: role.entryId, limit: 1 }),
+    ]);
+    const holders = raw;
+    return {
+        entryId: role.entryId,
+        name: role.name,
+        owner: entry?.owner ?? null,
+        holders: holders.holders.length,
+        holdersTruncated: holders.holdersTruncated,
+    };
+}
+/** Every role in the workspace over the paged collection read (slug `roles`), capped at ROLE_LIST_CAP. */
+export async function readRoleList() {
+    const roles = [];
+    let cursor;
+    let truncated = false;
+    let pages = 0;
+    do {
+        pages += 1;
+        const page = (await kernelCall('chain.listEntriesPaged', {
+            collectionSlug: 'roles', cursor, pageSize: Math.min(ROLE_PAGE_SIZE, ROLE_LIST_CAP - roles.length),
+        }));
+        for (const row of page.rows)
+            if (row.entryId)
+                roles.push({ entryId: row.entryId, name: row.name });
+        cursor = page.continueCursor ?? undefined;
+        // A page can come back short (drafts are filtered after the index), so pages are bounded too.
+        if (cursor && (roles.length >= ROLE_LIST_CAP || pages >= MAX_ROLE_PAGES))
+            truncated = true;
+    } while (cursor && !truncated);
+    const kept = roles.slice(0, ROLE_LIST_CAP);
+    const rows = [];
+    for (let i = 0; i < kept.length; i += ROLE_READS_AT_ONCE) {
+        rows.push(...await Promise.all(kept.slice(i, i + ROLE_READS_AT_ONCE).map(readRoleRow)));
+    }
+    return { roles: rows, truncated: truncated || roles.length > ROLE_LIST_CAP };
+}
+export function formatRoleList(result) {
+    const cut = result.truncated ? [`  (list cut after ${result.roles.length} roles; more may exist)`] : [];
+    if (result.roles.length === 0)
+        return cut.length > 0 ? ['No roles read yet.', ...cut].join('\n') : 'No roles in this workspace.';
+    const lines = result.roles.map((r) => {
+        const holders = `${r.holders}${r.holdersTruncated ? '+' : ''} ${r.holders === 1 && !r.holdersTruncated ? 'holder' : 'holders'}`;
+        return `  ${r.entryId}  ${sanitizeSingleLineField(r.name)}${r.owner ? `  ${formatOwnerLine(r.owner)}` : ''}  ${holders}`;
+    });
+    return [
+        `Roles (${result.roles.length}):`,
+        ...lines,
+        ...cut,
+    ].join('\n');
+}
+export async function runRoleList() {
+    const config = await getConfigOrGuide(runRoleList);
+    if (!config)
+        return;
+    // A read: no session required, same posture as `pb role accountable`.
+    await runCliCommand({ fn: readRoleList, formatPretty: formatRoleList });
+}
+//# sourceMappingURL=role.js.map

package/dist/commands/role.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role.js","sourceRoot":"","sources":["../../src/commands/role.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAkB,MAAM,wBAAwB,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAqB,MAAM,wBAAwB,CAAC;AA+C5E,sHAAsH;AACtH,SAAS,aAAa,CAAC,MAAwB;IAC9C,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,kBAAkB,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,+CAA+C,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7I,OAAO;QACN,YAAY;QACZ,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC3B,MAAM,IAAI,GAAG,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACvC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,uBAAuB,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,OAAO,OAAO,uBAAuB,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,GAAG,GAAG,IAAI,EAAE,CAAC;QACrE,CAAC,CAAC;QACF,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,+DAA+D,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACrG,CAAC;AACH,CAAC;AAMD,MAAM,UAAU,GAAG,CAAC,OAAe,EAAE,QAAgB,EAAY,EAAE,CAClE,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,iBAAiB,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,CAAC;AAEhG;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,GAAW,EAAE,IAAY,EAAE,KAAoC;IACtF,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,OAAO,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;QACjD,MAAM,UAAU,CACf,GAAG,IAAI,iCAAiC,GAAG,KAAK,EAChD,mEAAmE,CACnE,CAAC;IACH,CAAC;IACD,0FAA0F;IAC1F,2FAA2F;IAC3F,0FAA0F;IAC1F,4FAA4F;IAC5F,+FAA+F;IAC/F,IAAI,KAAK,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,GAAG,IAAI,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACzD,MAAM,UAAU,CACf,GAAG,IAAI,oBAAoB,KAAK,CAAC,GAAG,QAAQ,KAAK,CAAC,GAAG,SAAS,MAAM,IAAI,EACxE,mEAAmE,CACnE,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED;;6FAE6F;AAC7F,SAAS,SAAS,CAAC,GAAiB;IACnC,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,EAAE,CAAC;IACjC,4FAA4F;IAC5F,6FAA6F;IAC7F,uFAAuF;IACvF,wFAAwF;IACxF,8FAA8F;IAC9F,2EAA2E;IAC3E,4FAA4F;IAC5F,gGAAgG;IAChG,8FAA8F;IAC9F,oEAAoE;IACpE,MAAM,aAAa,GAAG,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,MAAM,uBAAuB,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;IACzH,yFAAyF;IACzF,0FAA0F;IAC1F,4DAA4D;IAC5D,MAAM,cAAc,GAAG,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,uBAAuB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC9F,OAAO,OAAO,EAAE,KAAK,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,cAAc,IAAI,aAAa,GAAG,CAAC;AAChG,CAAC;AAED;;;;;;2FAM2F;AAC3F,SAAS,aAAa,CAAC,KAAa,EAAE,IAA6B,EAAE,SAAkB,EAAE,UAAmB;IAC3G,yFAAyF;IACzF,4FAA4F;IAC5F,mFAAmF;IACnF,0FAA0F;IAC1F,8FAA8F;IAC9F,2FAA2F;IAC3F,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS;QAAE,OAAO,CAAC,KAAK,KAAK,oBAAoB,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,gDAAgD,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IACzI,yFAAyF;IACzF,2FAA2F;IAC3F,2FAA2F;IAC3F,0FAA0F;IAC1F,8FAA8F;IAC9F,IAAI,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,0CAA0C,UAAU,IAAI,wDAAwD,GAAG,CAAC,CAAC;IAC/I,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAA+B;IACpE,IAAI,CAAC,MAAM;QAAE,OAAO,iBAAiB,CAAC;IACtC,MAAM,SAAS,GAAG,GAAG,uBAAuB,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC;IAC5G,4FAA4F;IAC5F,iDAAiD;IACjD,MAAM,kBAAkB,GAAG,MAAM,CAAC,UAAU,KAAK,IAAI;QACpD,CAAC,CAAC,2CAA2C,MAAM,CAAC,UAAU,EAAE;QAChE,CAAC,CAAC,eAAe,CAAC;IACnB,OAAO;QACN,GAAG,SAAS,oBAAoB;QAChC,GAAG,aAAa,CAAC,MAAM,CAAC;QACxB,GAAG,aAAa,CAAC,iBAAiB,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;QAClG,GAAG,aAAa,CAAC,wBAAwB,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,kBAAkB,CAAC;QACvF,uEAAuE;QACvE,yFAAyF;QACzF,uBAAuB;QACvB,+BAA+B,MAAM,CAAC,0BAA0B,EAAE;KAClE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAAc,EAAE,OAA+B;IACvF,qFAAqF;IACrF,gDAAgD;IAChD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvH,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAErG,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACjF,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,MAAM,aAAa,CAAC;QACnB,kEAAkE;QAClE,EAAE,EAAE,KAAK,IAAI,EAAE;YACd,MAAM,GAAG,GAAG,MAAM,UAAU,CAA0B,kBAAkB,EAAE;gBACzE,MAAM;gBACN,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3C,CAAC,CAAC;YACH,OAAO,GAAuB,CAAC;QAChC,CAAC;QACD,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,qBAAqB,CAAC,MAAiC,CAAC;KAClF,CAAC,CAAC;AACJ,CAAC;AAUD,MAAM,YAAY,GAAG,CAAC,MAAyB,EAAE,EAAE,CAAC,CAAC,MAAkB,EAAE,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAmB,EAAE,uBAAuB,CAAC,CAAC;AAErJ,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAc,EAAE,OAAwB;IACzE,sFAAsF;IACtF,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,EAAE,CAAC;QAC1E,MAAM,UAAU,CACf,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,kEAAkE,CAAC,CAAC,CAAC,0CAA0C,EAC9I,iGAAiG,CACjG,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1E,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,MAAM,oBAAoB,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,qBAAqB,CAAa,yBAAyB,EAAE;QACpG,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;KACvI,CAAC,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAc,EAAE,OAA0C;IAC7F,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5E,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,MAAM,oBAAoB,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,qBAAqB,CAAa,6BAA6B,EAAE;QACxG,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;KACrG,CAAC,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED;;4GAE4G;AAC5G,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC;AAChC,MAAM,cAAc,GAAG,EAAE,CAAC,CAAC,4EAA4E;AACvG,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAC7B,MAAM,cAAc,GAAG,EAAE,CAAC;AAQ1B,+FAA+F;AAC/F,KAAK,UAAU,WAAW,CAAC,IAAuC;IACjE,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACtC,UAAU,CAAsB,gBAAgB,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5E,UAAU,CAA0B,kBAAkB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;KAC3F,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,GAAuB,CAAC;IACxC,OAAO;QACN,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,KAAK,EAAE,KAAK,EAAE,KAAK,IAAI,IAAI;QAC3B,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM;QAC/B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;KAC1C,CAAC;AACH,CAAC;AAED,0GAA0G;AAC1G,MAAM,CAAC,KAAK,UAAU,YAAY;IACjC,MAAM,KAAK,GAAwC,EAAE,CAAC;IACtD,IAAI,MAA0B,CAAC;IAC/B,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,GAAG,CAAC;QACH,KAAK,IAAI,CAAC,CAAC;QACX,MAAM,IAAI,GAAG,CAAC,MAAM,UAAU,CAAqD,wBAAwB,EAAE;YAC5G,cAAc,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,aAAa,GAAG,KAAK,CAAC,MAAM,CAAC;SACjG,CAAC,CAAwB,CAAC;QAC3B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI;YAAE,IAAI,GAAG,CAAC,OAAO;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACnG,MAAM,GAAG,IAAI,CAAC,cAAc,IAAI,SAAS,CAAC;QAC1C,8FAA8F;QAC9F,IAAI,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,aAAa,IAAI,KAAK,IAAI,cAAc,CAAC;YAAE,SAAS,GAAG,IAAI,CAAC;IAC5F,CAAC,QAAQ,MAAM,IAAI,CAAC,SAAS,EAAE;IAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAkB,EAAE,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,kBAAkB,EAAE,CAAC;QAC1D,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,kBAAkB,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAsB;IACpD,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,qBAAqB,MAAM,CAAC,KAAK,CAAC,MAAM,yBAAyB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxG,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,oBAAoB,EAAE,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,6BAA6B,CAAC;IACjI,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACpC,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QAChI,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;IAC1H,CAAC,CAAC,CAAC;IACH,OAAO;QACN,UAAU,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI;QACjC,GAAG,KAAK;QACR,GAAG,GAAG;KACN,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW;IAChC,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,sEAAsE;IACtE,MAAM,aAAa,CAAiB,EAAE,EAAE,EAAE,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC,CAAC;AACzF,CAAC"}

package/dist/commands/role.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=role.test.d.ts.map

package/dist/commands/role.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role.test.d.ts","sourceRoot":"","sources":["../../src/commands/role.test.ts"],"names":[],"mappings":""}