@productbrain/cli 0.1.0-beta.14 → 0.1.0-beta.14010

package/dist/commands/restore.js

@@ -0,0 +1,88 @@
+/**
+ * pb restore <entry-id> — restore an archived Chain entry to draft.
+ *
+ * WP-514 review round 2 (P1): the ONLY production path to restoreArchivedEntry — a brand-new,
+ * always-authority-gated capability (VALID_ENTRY_STATUS_TRANSITIONS stays closed for archived,
+ * lib/guards.ts:146; there is no legacy fallback). Thin client mirroring `pb update`'s
+ * session/refusal handling — the server owns validation (BR-104).
+ */
+import { getConfigOrGuide } from '../lib/config.js';
+import { kernelCallWithSession } from '../lib/client.js';
+import { withAskNext } from '../lib/kernelEnvelope.js';
+import { readSession } from '../lib/session.js';
+import { isJsonMode } from '../lib/runner.js';
+import { CLIError, ErrorCode } from '../lib/errors.js';
+import { emitEffectiveTenantNotice } from '../lib/workspaceNotice.js';
+import { copy } from '../lib/style.js';
+export async function runRestore(entryIdArg) {
+    await getConfigOrGuide();
+    const json = isJsonMode();
+    const session = readSession();
+    if (!session) {
+        throw new CLIError(copy.noSession, {
+            code: ErrorCode.SESSION_REQUIRED,
+            category: 'session',
+            guidance: copy.noSessionGuidance,
+        });
+    }
+    const entryId = entryIdArg.trim();
+    if (!entryId) {
+        throw new CLIError('Entry ID is required.', {
+            code: ErrorCode.VALIDATION_FAILED,
+            category: 'validation',
+            guidance: 'Usage: pb restore <entry-id>',
+        });
+    }
+    await emitEffectiveTenantNotice();
+    if (!json)
+        process.stdout.write(`Restoring ${entryId} to draft...\n`);
+    let result;
+    try {
+        result = await kernelCallWithSession('chain.restoreArchivedEntry', {
+            entryId, changedBy: `agent:${session.sessionId}`,
+        });
+    }
+    catch (err) {
+        const mcpErr = err;
+        if (err instanceof Error && err.name === 'McpError') {
+            // Sweep finding #5: preserve an authority refusal as an authority refusal — mirrors
+            // runUpdate (update.ts). Flattening every gateway error to VALIDATION_FAILED told a
+            // machine caller to "fix input" even for a deny-by-default AUTH_DENIED (e.g. a
+            // delegated credential), instead of routing the work to an authorized principal.
+            // A session refusal stays one too, as in runUpdate: its code, category and next step.
+            if (mcpErr.category === 'session')
+                throw err;
+            const serverCode = String(mcpErr.code);
+            if (serverCode === 'AUTHZ_PERMISSION_DENIED' || serverCode === ErrorCode.AUTH_DENIED) {
+                throw new CLIError(mcpErr.message, {
+                    code: ErrorCode.AUTH_DENIED,
+                    category: 'auth',
+                    guidance: mcpErr.guidance,
+                });
+            }
+            throw new CLIError(mcpErr.message, { code: ErrorCode.VALIDATION_FAILED, category: 'validation' });
+        }
+        throw err;
+    }
+    if (result.outcome === 'refused') {
+        const { refusal } = result;
+        if (json) {
+            process.stdout.write(JSON.stringify({ outcome: 'refused', refusal }) + '\n');
+        }
+        const authorityRefusal = refusal.code !== 'not_archived' && refusal.code !== 'still_superseded';
+        throw new CLIError(refusal.reason ?? `Restoring ${entryId} was refused.`, {
+            code: authorityRefusal ? ErrorCode.AUTH_DENIED : ErrorCode.VALIDATION_FAILED,
+            category: authorityRefusal ? 'auth' : 'validation',
+            guidance: authorityRefusal
+                ? withAskNext(refusal.requiredAction ?? 'Route this change to the accountable role or Team Lead.', refusal)
+                : refusal.requiredAction ?? 'Route this change to the accountable role or Team Lead.',
+        });
+    }
+    if (json) {
+        process.stdout.write(JSON.stringify({ outcome: 'restored', entryId }) + '\n');
+    }
+    else {
+        process.stdout.write(`${entryId} restored to draft.\n`);
+    }
+}
+//# sourceMappingURL=restore.js.map

package/dist/commands/restore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"restore.js","sourceRoot":"","sources":["../../src/commands/restore.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAEzD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAMvC,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,UAAkB;IAClD,MAAM,gBAAgB,EAAE,CAAC;IAEzB,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;IAE1B,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE;YAClC,IAAI,EAAE,SAAS,CAAC,gBAAgB;YAChC,QAAQ,EAAE,SAAS;YACnB,QAAQ,EAAE,IAAI,CAAC,iBAAiB;SAChC,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,MAAM,IAAI,QAAQ,CAAC,uBAAuB,EAAE;YAC3C,IAAI,EAAE,SAAS,CAAC,iBAAiB;YACjC,QAAQ,EAAE,YAAY;YACtB,QAAQ,EAAE,8BAA8B;SACxC,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,yBAAyB,EAAE,CAAC;IAClC,IAAI,CAAC,IAAI;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,OAAO,gBAAgB,CAAC,CAAC;IAEtE,IAAI,MAAqB,CAAC;IAC1B,IAAI,CAAC;QACJ,MAAM,GAAG,MAAM,qBAAqB,CAAgB,4BAA4B,EAAE;YACjF,OAAO,EAAE,SAAS,EAAE,SAAS,OAAO,CAAC,SAAS,EAAE;SAChD,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,GAAe,CAAC;QAC/B,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACrD,oFAAoF;YACpF,oFAAoF;YACpF,+EAA+E;YAC/E,iFAAiF;YACjF,sFAAsF;YACtF,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS;gBAAE,MAAM,GAAG,CAAC;YAC7C,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,UAAU,KAAK,yBAAyB,IAAI,UAAU,KAAK,SAAS,CAAC,WAAW,EAAE,CAAC;gBACtF,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE;oBAClC,IAAI,EAAE,SAAS,CAAC,WAAW;oBAC3B,QAAQ,EAAE,MAAM;oBAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ;iBACzB,CAAC,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,iBAAiB,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;QACnG,CAAC;QACD,MAAM,GAAG,CAAC;IACX,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;QAC3B,IAAI,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,gBAAgB,GAAG,OAAO,CAAC,IAAI,KAAK,cAAc,IAAI,OAAO,CAAC,IAAI,KAAK,kBAAkB,CAAC;QAChG,MAAM,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,IAAI,aAAa,OAAO,eAAe,EAAE;YACzE,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,iBAAiB;YAC5E,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY;YAClD,QAAQ,EAAE,gBAAgB;gBACzB,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,cAAc,IAAI,yDAAyD,EAAE,OAAO,CAAC;gBAC3G,CAAC,CAAC,OAAO,CAAC,cAAc,IAAI,yDAAyD;SACtF,CAAC,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IAC/E,CAAC;SAAM,CAAC;QACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,uBAAuB,CAAC,CAAC;IACzD,CAAC;AACF,CAAC"}

package/dist/commands/rework.d.ts

@@ -0,0 +1,24 @@
+/**
+ * pb rework report — report an observed rework signal (WP-487 Slice 1 / FEAT-1373).
+ *
+ * Fills the M4 rework-meter slot reserved by `convex/scoreboard/aggregates.ts:1-15,597`. This is
+ * the SOLE ingestion path this quarter (founder-decided, WP-C spec §3/§4 Slice 1 Pass-2 review) —
+ * an agent-native checkpoint the CLI reports explicitly, not a CI/git-webhook adapter (excluded,
+ * spec §6). Requires an active session (mirrors `pb capture`, DEC-9/BR-8): the M4 join key needs
+ * a stable `conversationId`, which only resolves inside a tracked session.
+ */
+export interface ReworkReportOptions {
+    entryId: string;
+    classification: string;
+    reportedVia?: string;
+    attributable?: boolean;
+    task?: string;
+    /** Codex P2 fix (round 2, post-merge review): explicit conversation override, mirroring
+     *  `pb session start --conversation <id>`. Without this, `pb rework report` has no way to
+     *  find a session started with `--conversation <id>` when the shell never also set
+     *  PB_CONVERSATION_ID — readSession() with no override falls back to the legacy marker path,
+     *  not the conversation-scoped one `session start --conversation` wrote to. */
+    conversation?: string;
+}
+export declare function runReworkReport(options: ReworkReportOptions): Promise<void>;
+//# sourceMappingURL=rework.d.ts.map

package/dist/commands/rework.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rework.d.ts","sourceRoot":"","sources":["../../src/commands/rework.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAgBH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;mFAI+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AASD,wBAAsB,eAAe,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqFjF"}

package/dist/commands/rework.js

@@ -0,0 +1,96 @@
+/**
+ * pb rework report — report an observed rework signal (WP-487 Slice 1 / FEAT-1373).
+ *
+ * Fills the M4 rework-meter slot reserved by `convex/scoreboard/aggregates.ts:1-15,597`. This is
+ * the SOLE ingestion path this quarter (founder-decided, WP-C spec §3/§4 Slice 1 Pass-2 review) —
+ * an agent-native checkpoint the CLI reports explicitly, not a CI/git-webhook adapter (excluded,
+ * spec §6). Requires an active session (mirrors `pb capture`, DEC-9/BR-8): the M4 join key needs
+ * a stable `conversationId`, which only resolves inside a tracked session.
+ */
+import { getConfigOrGuide } from '../lib/config.js';
+import { kernelCallWithSession } from '../lib/client.js';
+import { runCliCommand } from '../lib/runner.js';
+import { readSession } from '../lib/session.js';
+import { CLIError, ErrorCode } from '../lib/errors.js';
+import { copy } from '../lib/style.js';
+const CLASSIFICATIONS = ['revision', 'ci_review_correction', 'user_override'];
+const REPORTED_VIA = ['followup_commit', 'ci_rerun', 'manual'];
+export async function runReworkReport(options) {
+    await getConfigOrGuide();
+    const entryId = options.entryId?.trim();
+    if (!entryId) {
+        throw new CLIError('An entry ID is required.', {
+            code: ErrorCode.VALIDATION_FAILED,
+            category: 'validation',
+        });
+    }
+    if (!CLASSIFICATIONS.includes(options.classification)) {
+        throw new CLIError(`--classification must be one of: ${CLASSIFICATIONS.join(', ')}`, {
+            code: ErrorCode.VALIDATION_FAILED,
+            category: 'validation',
+        });
+    }
+    const classification = options.classification;
+    const reportedVia = (options.reportedVia ?? 'manual');
+    if (!REPORTED_VIA.includes(reportedVia)) {
+        throw new CLIError(`--via must be one of: ${REPORTED_VIA.join(', ')}`, {
+            code: ErrorCode.VALIDATION_FAILED,
+            category: 'validation',
+        });
+    }
+    // Require active session (DEC-9, BR-8, mirrors pb capture) — write access needs a tracked
+    // session, and the M4 join key needs the session's resolved conversationId.
+    //
+    // Codex P2 fix (round 2, post-merge review): pass `options.conversation` through to
+    // readSession() so a caller who started the session with `pb session start --conversation <id>`
+    // (writing the marker to .productbrain/sessions/<id>.json) can find it here even when the shell
+    // never ALSO exported PB_CONVERSATION_ID — a bare readSession() falls back to the legacy marker
+    // path and misses it. Without this override, an agent following `pb session start`'s own
+    // recovery guidance would still hit "No active session" on the very next command.
+    const session = readSession(options.conversation);
+    if (!session) {
+        throw new CLIError(copy.noSession, {
+            code: ErrorCode.SESSION_REQUIRED,
+            category: 'session',
+            guidance: `${copy.noSessionGuidance} If you started a ` +
+                'session with `pb session start --conversation <id>`, re-run this command with ' +
+                '`--conversation <id>` (or export PB_CONVERSATION_ID=<id> in this shell) so it resolves the ' +
+                'same conversation-scoped marker.',
+        });
+    }
+    if (!session.conversationId) {
+        // Fail closed client-side too (TEN-2728): a rework signal with no conversationId cannot
+        // anchor the M4 join, and the server refuses it anyway — surface the real cause here rather
+        // than a generic server validation error.
+        throw new CLIError('No conversation identity resolved for this session.', {
+            code: ErrorCode.VALIDATION_FAILED,
+            category: 'validation',
+            guidance: 'A rework signal needs a stable conversationId to join against the governance-served log (M4). ' +
+                'Run this from a harness that sets PB_CONVERSATION_ID / CLAUDE_CODE_SESSION_ID / CURSOR_CONVERSATION_ID, ' +
+                'or start a fresh session with `pb session start --conversation <id>` and re-run this command ' +
+                'with the SAME `--conversation <id>` (otherwise only `session start` and `session close` read the flag).',
+        });
+    }
+    await runCliCommand({
+        fn: async () => {
+            return await kernelCallWithSession('rework.report', {
+                // Codex P1 fix (post-merge review): sessionId lets the server resolve conversationId
+                // AUTHORITATIVELY from the caller's own agentSessions row (mirrors served.ts's
+                // recordGovernanceServed stamping) rather than trusting the client-supplied string alone.
+                // conversationId still travels as a fallback for the server's bare-conversationId lookup
+                // path — both are verified server-side against the gateway-injected caller identity.
+                sessionId: session.sessionId,
+                conversationId: session.conversationId,
+                entryId,
+                classification,
+                reportedVia,
+                ...(options.attributable ? { attributableToGovernanceMiss: true } : {}),
+                ...(options.task ? { task: options.task } : {}),
+            });
+        },
+        formatPretty: (result) => result.deduped
+            ? `Rework signal already recorded (${classification}, via ${reportedVia}) — reused the existing row from a moment ago.`
+            : `Rework signal recorded (${classification}, via ${reportedVia}).`,
+    });
+}
+//# sourceMappingURL=rework.js.map

package/dist/commands/rework.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rework.js","sourceRoot":"","sources":["../../src/commands/rework.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAEvC,MAAM,eAAe,GAAG,CAAC,UAAU,EAAE,sBAAsB,EAAE,eAAe,CAAU,CAAC;AAGvF,MAAM,YAAY,GAAG,CAAC,iBAAiB,EAAE,UAAU,EAAE,QAAQ,CAAU,CAAC;AAwBxE,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAA4B;IAChE,MAAM,gBAAgB,EAAE,CAAC;IAEzB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,QAAQ,CAAC,0BAA0B,EAAE;YAC7C,IAAI,EAAE,SAAS,CAAC,iBAAiB;YACjC,QAAQ,EAAE,YAAY;SACvB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAsC,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,QAAQ,CAAC,oCAAoC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;YACnF,IAAI,EAAE,SAAS,CAAC,iBAAiB;YACjC,QAAQ,EAAE,YAAY;SACvB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,cAAc,GAAG,OAAO,CAAC,cAAsC,CAAC;IAEtE,MAAM,WAAW,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,QAAQ,CAAsB,CAAC;IAC3E,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,QAAQ,CAAC,yBAAyB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;YACrE,IAAI,EAAE,SAAS,CAAC,iBAAiB;YACjC,QAAQ,EAAE,YAAY;SACvB,CAAC,CAAC;IACL,CAAC;IAED,0FAA0F;IAC1F,4EAA4E;IAC5E,EAAE;IACF,oFAAoF;IACpF,gGAAgG;IAChG,gGAAgG;IAChG,gGAAgG;IAChG,yFAAyF;IACzF,kFAAkF;IAClF,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE;YACjC,IAAI,EAAE,SAAS,CAAC,gBAAgB;YAChC,QAAQ,EAAE,SAAS;YACnB,QAAQ,EACN,GAAG,IAAI,CAAC,iBAAiB,oBAAoB;gBAC7C,gFAAgF;gBAChF,6FAA6F;gBAC7F,kCAAkC;SACrC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAC5B,wFAAwF;QACxF,4FAA4F;QAC5F,0CAA0C;QAC1C,MAAM,IAAI,QAAQ,CAAC,qDAAqD,EAAE;YACxE,IAAI,EAAE,SAAS,CAAC,iBAAiB;YACjC,QAAQ,EAAE,YAAY;YACtB,QAAQ,EACN,gGAAgG;gBAChG,0GAA0G;gBAC1G,+FAA+F;gBAC/F,yGAAyG;SAC5G,CAAC,CAAC;IACL,CAAC;IAED,MAAM,aAAa,CAAqB;QACtC,EAAE,EAAE,KAAK,IAAI,EAAE;YACb,OAAO,MAAM,qBAAqB,CAA4C,eAAe,EAAE;gBAC7F,qFAAqF;gBACrF,+EAA+E;gBAC/E,0FAA0F;gBAC1F,yFAAyF;gBACzF,qFAAqF;gBACrF,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,OAAO;gBACP,cAAc;gBACd,WAAW;gBACX,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,4BAA4B,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChD,CAAC,CAAC;QACL,CAAC;QACD,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CACvB,MAAM,CAAC,OAAO;YACZ,CAAC,CAAC,mCAAmC,cAAc,SAAS,WAAW,gDAAgD;YACvH,CAAC,CAAC,2BAA2B,cAAc,SAAS,WAAW,IAAI;KACxE,CAAC,CAAC;AACL,CAAC"}

package/dist/commands/role.d.ts

@@ -0,0 +1,90 @@
+import type { RoleCoverer } from '../formatters/entry.js';
+import { type SeatCounts, type SeatRow } from '../lib/seatRoster.js';
+export interface RoleAccountableOptions {
+    canonicalKey?: string;
+    limit?: string;
+    cursor?: string;
+    json?: boolean;
+}
+/** Mirrors `chain.listByRole`'s row shape (convex/agentKnowledge/entriesByRole.ts's
+ *  `RoleEntrySummary`) with a PLAIN `id: string` — the door returns a Convex document id over
+ *  the wire as a bare string, and this interface (not the raw gateway type's branded
+ *  `Id<'entries'>`) is what argv-facing code and its own tests actually handle, same pattern
+ *  `outcome.ts`'s own `ReadingRow`/`ListReadingsResult` use. The call site below still derives
+ *  from `GatewayRouteReturnByName<'chain.listByRole'>` (review PRRT_kwDORS4ils6gQAqu) so a
+ *  route-shape drift fails the `as` cast at compile time — the branded id only blocks the
+ *  OPPOSITE direction (a plain-string test fixture claiming to BE the branded type), which never
+ *  happens here: the widening cast below (branded -> plain) is always legal. */
+export interface RoleEntryRow {
+    id: string;
+    entryId?: string;
+    name: string;
+    canonicalKey?: string;
+    collectionSlug?: string;
+    status: string;
+    workflowStatus?: string;
+}
+export interface ListByRoleResult {
+    role: {
+        id: string;
+        entryId?: string;
+        name: string;
+    };
+    explicit: RoleEntryRow[];
+    explicitTruncated: boolean;
+    nextCursor: number | null;
+    reporting: RoleEntryRow[];
+    reportingTruncated: boolean;
+    truncated: boolean;
+    /** TASK-636 (DEC-1810): the role's roster; status is active, invited or placeholder. */
+    holders: {
+        personId: string;
+        displayName: string;
+        status: string;
+        teamName: string | null;
+    }[];
+    holdersTruncated: boolean;
+    /** DEC-2257: who holds the role, as the kernel's one sentence, and the covering Team Lead (null when seated). */
+    heldLine?: string;
+    coveredBy?: RoleCoverer | null;
+}
+/**
+ * Pretty rendering for `pb role accountable`. Exported so door-parity content-equality against
+ * the MCP tool's own rendering (`packages/mcp-server/src/tools/role.ts`) is assertable directly,
+ * not only through a live walk — both read the SAME `chain.listByRole` JSON shape and both print
+ * the SAME three sections in the SAME order.
+ */
+export declare function formatRoleAccountable(result: ListByRoleResult | null): string;
+export declare function runRoleAccountable(roleId: string, options: RoleAccountableOptions): Promise<void>;
+export interface RoleSeatOptions {
+    person?: string;
+    newPerson?: string;
+    team?: string;
+    /** DEC-2188: Team Lead only, by the team's accountable Team Lead. */
+    onMyAuthority?: boolean;
+}
+export declare function runRoleSeat(roleId: string, options: RoleSeatOptions): Promise<void>;
+export declare function runRoleUnseat(roleId: string, options: {
+    person: string;
+    team?: string;
+}): Promise<void>;
+/** DEC-2514 (TASK-1447): `pb role list` is one gateway read, `organisation.seats`: a row per seat (a role in a team) and the counts over them. */
+type RoleView = {
+    entryId: string | null;
+    name: string;
+    team: string | null;
+    heldLine: string;
+    coveredBy: SeatRow['coveredBy'];
+};
+export interface SeatListResult {
+    roles: RoleView[];
+    seats: SeatRow[];
+    counts: SeatCounts | null;
+    truncated: boolean;
+    total: number | null;
+}
+/** The seats roster in one call; a cut roster carries no counts (a count over a part would read as the whole, RULE-17). */
+export declare function readSeatList(): Promise<SeatListResult>;
+export declare function runRoleList(): Promise<void>;
+export {};
+//# sourceMappingURL=role.d.ts.map

package/dist/commands/role.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role.d.ts","sourceRoot":"","sources":["../../src/commands/role.ts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAgC,KAAK,UAAU,EAAE,KAAK,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAEnG,MAAM,WAAW,sBAAsB;IACtC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;CACf;AAED;;;;;;;;gFAQgF;AAChF,MAAM,WAAW,YAAY;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IAItB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,gBAAgB;IAChC,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACrD,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,YAAY,EAAE,CAAC;IAC1B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,SAAS,EAAE,OAAO,CAAC;IACnB,wFAAwF;IACxF,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,EAAE,CAAC;IAC9F,gBAAgB,EAAE,OAAO,CAAC;IAC1B,iHAAiH;IACjH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;CAC/B;AAgGD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,gBAAgB,GAAG,IAAI,GAAG,MAAM,CAc7E;AAED,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBvG;AAED,MAAM,WAAW,eAAe;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qEAAqE;IACrE,aAAa,CAAC,EAAE,OAAO,CAAC;CACxB;AAMD,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAazF;AAED,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAK7G;AAED,kJAAkJ;AAClJ,KAAK,QAAQ,GAAG;IAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC,WAAW,CAAC,CAAA;CAAE,CAAC;AACjI,MAAM,WAAW,cAAc;IAAG,KAAK,EAAE,QAAQ,EAAE,CAAC;IAAC,KAAK,EAAE,OAAO,EAAE,CAAC;IAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE;AAe5I,2HAA2H;AAC3H,wBAAsB,YAAY,IAAI,OAAO,CAAC,cAAc,CAAC,CAG5D;AAED,wBAAsB,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAIjD"}

package/dist/commands/role.js

@@ -0,0 +1,172 @@
+import { getConfigOrGuide } from '../lib/config.js';
+import { kernelCall, kernelCallWithSession } from '../lib/client.js';
+import { CLIError, ErrorCode } from '../lib/errors.js';
+import { runCliCommand } from '../lib/runner.js';
+import { formatSeatSentence } from '../lib/seatSentence.js';
+import { sanitizeSingleLineField } from '../lib/strip.js';
+import { runOrganisationWrite } from './organisationWrite.js';
+import { formatSeatRoster, seatCounts } from '../lib/seatRoster.js';
+/** Who holds the role first, the kernel's sentence verbatim (RULE-128). */
+function formatHeld(result) {
+    return [
+        ...(result.heldLine ? [`  ${sanitizeSingleLineField(result.heldLine)}`] : []),
+        ...(result.holdersTruncated ? ['    (membership scan cut at 500 rows, more holders may exist)'] : []),
+    ];
+}
+const validation = (message, guidance) => new CLIError(message, { code: ErrorCode.VALIDATION_FAILED, category: 'validation', guidance });
+/** argv is a string; `--limit`/`--cursor` want whole numbers. Refused HERE, before any network
+ *  call, naming the flag — same shape `outcome.ts`'s own `requireNumber` and `shape.ts`'s enum
+ *  checks use (CLIError + code: VALIDATION_FAILED + category: 'validation'), so an invalid flag
+ *  reports category=validation in JSON mode rather than falling through to `runCliCommand`'s
+ *  generic unknown-error wrap (code: INTERNAL). Un-refused, `Number('abc')` is NaN, which
+ *  `JSON.stringify` silently turns into `null` on the wire — a validation bug disguised as a
+ *  present-but-empty value, not caught until the gateway's own (differently-worded) refusal.
+ */
+function requireInteger(raw, flag, range) {
+    const trimmed = raw.trim();
+    const parsed = Number(trimmed);
+    if (trimmed === '' || !Number.isInteger(parsed)) {
+        throw validation(`${flag} must be a whole number (got "${raw}").`, 'Usage: pb role accountable <role-id> [--limit <n>] [--cursor <n>]');
+    }
+    // PR #856 review round 3 (Codex P2, PRRT_kwDORS4ils6gQrZI): `requireInteger` checked only
+    // integrality, so `--limit 0`, a negative value, or anything above 200 reached the network
+    // call and was silently clamped server-side (convex/agentKnowledge/entriesByRole.ts:1-200
+    // range) to a page size the caller never asked for. Reject the advertised 1-200 range here,
+    // matching the MCP tool's own schema (packages/mcp-server/src/tools/role.ts), before the call.
+    if (range && (parsed < range.min || parsed > range.max)) {
+        throw validation(`${flag} must be between ${range.min} and ${range.max} (got ${parsed}).`, 'Usage: pb role accountable <role-id> [--limit <n>] [--cursor <n>]');
+    }
+    return parsed;
+}
+/** One row, terminal-safe. `name` is stored content any connector with write access can set —
+ *  sanitized for the same reason `outcome.ts`'s `formatReadingsList` sanitizes `note`/`valueText`:
+ *  this rendering is a plain-text sink, and an embedded newline would forge an extra row. */
+function formatRow(row) {
+    const id = row.entryId ?? row.id;
+    // PR #856 review round 3 (Codex P2, PRRT_kwDORS4ils6gQrZW): `chain.listByRole` deliberately
+    // includes each row's domain `workflowStatus` (convex/agentKnowledge/entriesByRole.ts:73-90)
+    // separately from `status` (the TRUST status, e.g. 'accepted') — a tension's `open` vs
+    // `closed` is exactly the distinction between a current obligation and a completed one.
+    // Dropping it here made both render identically as `[tension/accepted]`; render it, mirroring
+    // `packages/mcp-server/src/tools/entries.ts:697-700`'s existing formatter.
+    // PR #872 review round 3 (Codex P2): workflowStatus is stored content read from a workspace
+    // collection's `validWorkflowStatuses` declaration — vocabulary-checked by guardWorkflowStatus,
+    // never terminal-safety-checked, so a value containing a newline/control sequence could still
+    // forge an extra row. Sanitized the same way `row.name` already is.
+    const statusDisplay = row.workflowStatus ? `${row.status} / ${sanitizeSingleLineField(row.workflowStatus)}` : row.status;
+    // WP-771 S1b round 2 (Codex P2, PRRT_kwDORS4ils6lGWJ0): render the real collection slug,
+    // matching the MCP `role` tool's formatRow fixed this round — same sanitization, same '?'
+    // fallback for a row whose collection couldn't be resolved.
+    const collectionSlug = row.collectionSlug ? sanitizeSingleLineField(row.collectionSlug) : '?';
+    return `    ${id}  ${sanitizeSingleLineField(row.name)}  [${collectionSlug}/${statusDisplay}]`;
+}
+/** One labelled section — `explicit` or `reporting`. Empty prints the shared empty-state text
+ *  rather than an ambiguous blank, and a truncated page says so with an ACTIONABLE hint rather
+ *  than a vague "more exist" (review PRRT_kwDORS4ils6gQAqo, §13: cap every read AND surface
+ *  truncation to the caller — a claim of "continue with the printed cursor" that never printed
+ *  one is the failure this fixes). `cursorHint` is `undefined` for a section the gateway cannot
+ *  page (`reporting` — PR-1's own design: only `explicit` accepts a cursor) — that section
+ *  states the cap plainly instead of pointing at a flag that would silently be ignored. */
+function formatSection(label, rows, truncated, cursorHint) {
+    // PR #856 review round 3 (Codex P2, PRRT_kwDORS4ils6gQrY9): `canonicalKey` filtering can
+    // legitimately return `rows: []` with `truncated: true` and a usable cursor — the backend's
+    // raw scan window was exhausted without confirming no more matches exist beyond it
+    // (convex/agentKnowledge/entriesByRole.ts). Printing "not recorded yet" for that response
+    // falsely presents the role as having no matching entries at all and swallows the cursor that
+    // would let the caller keep looking. Check truncation BEFORE the empty-state early return.
+    if (rows.length === 0 && !truncated)
+        return [`  ${label}: not recorded yet`];
+    const lines = rows.length === 0 ? [`  ${label}: not recorded yet, but the scan is incomplete`] : [`  ${label}:`, ...rows.map(formatRow)];
+    // PR #872 review round 3 (Codex P2): `truncated` can be true purely because the raw scan
+    // budget (MAX_SCAN_BATCHES batches, entriesByRole.ts) was exhausted without confirming the
+    // true end of the index range — NOT because a filtered match beyond this page was actually
+    // found. "more exist" overclaimed a fact the backend never established; "scan incomplete"
+    // states only what is actually known (keep paging to find out), never asserts a match exists.
+    if (truncated)
+        lines.push(`    (scan incomplete, more may exist — ${cursorHint ?? 'raise --limit (capped at 200, no cursor for this list)'})`);
+    return lines;
+}
+/**
+ * Pretty rendering for `pb role accountable`. Exported so door-parity content-equality against
+ * the MCP tool's own rendering (`packages/mcp-server/src/tools/role.ts`) is assertable directly,
+ * not only through a live walk — both read the SAME `chain.listByRole` JSON shape and both print
+ * the SAME three sections in the SAME order.
+ */
+export function formatRoleAccountable(result) {
+    if (!result)
+        return 'Role not found.';
+    const roleLabel = `${sanitizeSingleLineField(result.role.name)} (${result.role.entryId ?? result.role.id})`;
+    // `explicit` is the only cursor-able list (PR-1's design) — print the REAL next cursor when
+    // truncated, never a bare claim that one exists.
+    const explicitCursorHint = result.nextCursor !== null
+        ? `raise --limit or continue with --cursor ${result.nextCursor}`
+        : 'raise --limit';
+    return [
+        `${roleLabel} — accountability:`,
+        ...formatHeld(result),
+        ...formatSection('explicit (owns)', result.explicit, result.explicitTruncated, explicitCursorHint),
+        ...formatSection('reporting (reports on)', result.reporting, result.reportingTruncated),
+    ].join('\n');
+}
+export async function runRoleAccountable(roleId, options) {
+    // Refuse everything refusable BEFORE the network call — same discipline outcome.ts's
+    // requireNumber and shape.ts's enum checks use.
+    const limit = options.limit !== undefined ? requireInteger(options.limit, '--limit', { min: 1, max: 200 }) : undefined;
+    const cursor = options.cursor !== undefined ? requireInteger(options.cursor, '--cursor') : undefined;
+    await getConfigOrGuide();
+    await runCliCommand({
+        // A read: no session required, same posture as `pb outcome list`.
+        fn: async () => {
+            const raw = await kernelCall('chain.listByRole', {
+                roleId,
+                ...(options.canonicalKey ? { canonicalKey: options.canonicalKey } : {}),
+                ...(limit !== undefined ? { limit } : {}),
+                ...(cursor !== undefined ? { cursor } : {}),
+            });
+            return raw;
+        },
+        formatPretty: (value_) => formatRoleAccountable(value_),
+    });
+}
+const seatSentence = (action) => (result) => formatSeatSentence(action, result, sanitizeSingleLineField);
+export async function runRoleSeat(roleId, options) {
+    // Exactly one of an existing person or --new-person; refused before any network call.
+    if ((options.person === undefined) === (options.newPerson === undefined)) {
+        throw validation(options.person === undefined ? 'Say who to seat: --person <id-or-email>, or --new-person <name>.' : 'Give --person or --new-person, not both.', 'Usage: pb role seat <role-id> (--person <id-or-email> | --new-person <name>) [--team <team-id>] [--on-my-authority]');
+    }
+    await getConfigOrGuide();
+    await runOrganisationWrite((context) => kernelCallWithSession('organisation.seatInRole', {
+        roleRef: roleId, targetPersonRef: options.person, newPersonName: options.newPerson, teamRef: options.team, sessionId: context.sessionId,
+        ...(options.onMyAuthority ? { onMyAuthority: true } : {}),
+    }), seatSentence('seat'));
+}
+export async function runRoleUnseat(roleId, options) {
+    await getConfigOrGuide();
+    await runOrganisationWrite((context) => kernelCallWithSession('organisation.unseatFromRole', {
+        roleRef: roleId, targetPersonRef: options.person, teamRef: options.team, sessionId: context.sessionId,
+    }), seatSentence('unseat'));
+}
+/** `--json`'s `roles`, kept for a script written against it: one row per role. `owner` and the covering person's ids are gone (the seats
+ *  carry the team and the cover); a role held in several teams (Team Lead) reads each team's sentence after its name. */
+function rolesOf(seats) {
+    const byRole = new Map();
+    for (const seat of seats)
+        byRole.set(seat.roleEntryId ?? seat.roleName, [...(byRole.get(seat.roleEntryId ?? seat.roleName) ?? []), seat]);
+    return [...byRole.values()].map(([first, ...rest]) => ({
+        entryId: first.roleEntryId, name: first.roleName,
+        team: rest.length === 0 ? first.teamName : null,
+        heldLine: rest.length === 0 ? first.sentence : [first, ...rest].map((s) => `${s.teamName ?? first.roleName}: ${s.sentence}`).join(' '),
+        coveredBy: rest.length === 0 ? first.coveredBy : null,
+    }));
+}
+/** The seats roster in one call; a cut roster carries no counts (a count over a part would read as the whole, RULE-17). */
+export async function readSeatList() {
+    const roster = await kernelCall('organisation.seats', {});
+    return { roles: rolesOf(roster.seats), seats: roster.seats, counts: roster.truncated ? null : seatCounts(roster.seats), truncated: roster.truncated, total: roster.total };
+}
+export async function runRoleList() {
+    await getConfigOrGuide();
+    // A read: no session required, same posture as `pb role accountable`.
+    await runCliCommand({ fn: readSeatList, formatPretty: (result) => formatSeatRoster(result, sanitizeSingleLineField, 'pb get ROL-n') });
+}
+//# sourceMappingURL=role.js.map

package/dist/commands/role.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role.js","sourceRoot":"","sources":["../../src/commands/role.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAkB,MAAM,wBAAwB,CAAC;AAC5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAiC,MAAM,sBAAsB,CAAC;AA+CnG,2EAA2E;AAC3E,SAAS,UAAU,CAAC,MAAwB;IAC3C,OAAO;QACN,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,uBAAuB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,+DAA+D,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACrG,CAAC;AACH,CAAC;AAMD,MAAM,UAAU,GAAG,CAAC,OAAe,EAAE,QAAgB,EAAY,EAAE,CAClE,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,iBAAiB,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,CAAC;AAEhG;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,GAAW,EAAE,IAAY,EAAE,KAAoC;IACtF,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,OAAO,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;QACjD,MAAM,UAAU,CACf,GAAG,IAAI,iCAAiC,GAAG,KAAK,EAChD,mEAAmE,CACnE,CAAC;IACH,CAAC;IACD,0FAA0F;IAC1F,2FAA2F;IAC3F,0FAA0F;IAC1F,4FAA4F;IAC5F,+FAA+F;IAC/F,IAAI,KAAK,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,GAAG,IAAI,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACzD,MAAM,UAAU,CACf,GAAG,IAAI,oBAAoB,KAAK,CAAC,GAAG,QAAQ,KAAK,CAAC,GAAG,SAAS,MAAM,IAAI,EACxE,mEAAmE,CACnE,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED;;6FAE6F;AAC7F,SAAS,SAAS,CAAC,GAAiB;IACnC,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,EAAE,CAAC;IACjC,4FAA4F;IAC5F,6FAA6F;IAC7F,uFAAuF;IACvF,wFAAwF;IACxF,8FAA8F;IAC9F,2EAA2E;IAC3E,4FAA4F;IAC5F,gGAAgG;IAChG,8FAA8F;IAC9F,oEAAoE;IACpE,MAAM,aAAa,GAAG,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,MAAM,uBAAuB,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;IACzH,yFAAyF;IACzF,0FAA0F;IAC1F,4DAA4D;IAC5D,MAAM,cAAc,GAAG,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,uBAAuB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC9F,OAAO,OAAO,EAAE,KAAK,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,cAAc,IAAI,aAAa,GAAG,CAAC;AAChG,CAAC;AAED;;;;;;2FAM2F;AAC3F,SAAS,aAAa,CAAC,KAAa,EAAE,IAA6B,EAAE,SAAkB,EAAE,UAAmB;IAC3G,yFAAyF;IACzF,4FAA4F;IAC5F,mFAAmF;IACnF,0FAA0F;IAC1F,8FAA8F;IAC9F,2FAA2F;IAC3F,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS;QAAE,OAAO,CAAC,KAAK,KAAK,oBAAoB,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,gDAAgD,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IACzI,yFAAyF;IACzF,2FAA2F;IAC3F,2FAA2F;IAC3F,0FAA0F;IAC1F,8FAA8F;IAC9F,IAAI,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,0CAA0C,UAAU,IAAI,wDAAwD,GAAG,CAAC,CAAC;IAC/I,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAA+B;IACpE,IAAI,CAAC,MAAM;QAAE,OAAO,iBAAiB,CAAC;IACtC,MAAM,SAAS,GAAG,GAAG,uBAAuB,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC;IAC5G,4FAA4F;IAC5F,iDAAiD;IACjD,MAAM,kBAAkB,GAAG,MAAM,CAAC,UAAU,KAAK,IAAI;QACpD,CAAC,CAAC,2CAA2C,MAAM,CAAC,UAAU,EAAE;QAChE,CAAC,CAAC,eAAe,CAAC;IACnB,OAAO;QACN,GAAG,SAAS,oBAAoB;QAChC,GAAG,UAAU,CAAC,MAAM,CAAC;QACrB,GAAG,aAAa,CAAC,iBAAiB,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;QAClG,GAAG,aAAa,CAAC,wBAAwB,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,kBAAkB,CAAC;KACvF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAAc,EAAE,OAA+B;IACvF,qFAAqF;IACrF,gDAAgD;IAChD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvH,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAErG,MAAM,gBAAgB,EAAE,CAAC;IAEzB,MAAM,aAAa,CAAC;QACnB,kEAAkE;QAClE,EAAE,EAAE,KAAK,IAAI,EAAE;YACd,MAAM,GAAG,GAAG,MAAM,UAAU,CAA0B,kBAAkB,EAAE;gBACzE,MAAM;gBACN,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3C,CAAC,CAAC;YACH,OAAO,GAAuB,CAAC;QAChC,CAAC;QACD,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,qBAAqB,CAAC,MAAiC,CAAC;KAClF,CAAC,CAAC;AACJ,CAAC;AAYD,MAAM,YAAY,GAAG,CAAC,MAAyB,EAAE,EAAE,CAAC,CAAC,MAAkB,EAAE,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAmB,EAAE,uBAAuB,CAAC,CAAC;AAErJ,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAc,EAAE,OAAwB;IACzE,sFAAsF;IACtF,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,EAAE,CAAC;QAC1E,MAAM,UAAU,CACf,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,kEAAkE,CAAC,CAAC,CAAC,0CAA0C,EAC9I,qHAAqH,CACrH,CAAC;IACH,CAAC;IACD,MAAM,gBAAgB,EAAE,CAAC;IACzB,MAAM,oBAAoB,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,qBAAqB,CAAa,yBAAyB,EAAE;QACpG,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;QACvI,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzD,CAAC,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAc,EAAE,OAA0C;IAC7F,MAAM,gBAAgB,EAAE,CAAC;IACzB,MAAM,oBAAoB,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,qBAAqB,CAAa,6BAA6B,EAAE;QACxG,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;KACrG,CAAC,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC7B,CAAC;AAMD;yHACyH;AACzH,SAAS,OAAO,CAAC,KAAgB;IAChC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC5C,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAC1I,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACtD,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ;QAChD,IAAI,EAAE,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;QAC/C,QAAQ,EAAE,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QACtI,SAAS,EAAE,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;KACrD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,2HAA2H;AAC3H,MAAM,CAAC,KAAK,UAAU,YAAY;IACjC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAiD,oBAAoB,EAAE,EAAE,CAAC,CAAC;IAC1G,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AAC5K,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW;IAChC,MAAM,gBAAgB,EAAE,CAAC;IACzB,sEAAsE;IACtE,MAAM,aAAa,CAAiB,EAAE,EAAE,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,uBAAuB,EAAE,cAAc,CAAC,EAAE,CAAC,CAAC;AACxJ,CAAC"}

package/dist/commands/role.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=role.test.d.ts.map

package/dist/commands/role.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role.test.d.ts","sourceRoot":"","sources":["../../src/commands/role.test.ts"],"names":[],"mappings":""}