@productbrain/cli 0.1.0-beta.1428 → 0.1.0-beta.14280

package/dist/commands/admin/manage.js

@@ -1,85 +1,40 @@
 import { adminCall } from '../../lib/client.js';
-import { resolveAdminConfig } from '../../lib/config.js';
 import { resolveWorkspaceArg, resolveUserArg } from './inspect.js';
 import { isJsonMode } from '../../lib/runner.js';
-import { requiresAdminDestructiveConfirmation } from '../../lib/deployment.js';
-import { bold, red, green, dim, yellow } from '../../lib/style.js';
-/** Ordered count/flag fields rendered for a single migration result. */
-const TEAM_VOCAB_FIELDS = [
-    'entriesRenamed',
-    'rolesPatched',
-    'displayNamesPatched',
-    'membershipsPatched',
-    'teamCollectionFieldsPatched',
-    'teamEntriesPatched',
-    'glossaryNamesPatched',
-    'glossaryDefsPatched',
-    'rolesNamePatched',
-    'teamCollectionNamePatched',
-    'governanceTagsPatched',
-];
-/** Numeric fields that accumulate into fleet totals on the --all path. */
-const TEAM_VOCAB_NUMERIC_FIELDS = [
-    'entriesRenamed',
-    'rolesPatched',
-    'membershipsPatched',
-    'teamEntriesPatched',
-    'glossaryNamesPatched',
-    'glossaryDefsPatched',
-    'rolesNamePatched',
-    'governanceTagsPatched',
-    'glossaryNameCollisionsSkipped',
-    'roleNameCollisionsSkipped',
-];
-// The migration's manifest command name (vocab-clean — the retired literal lives
-// only inside the migration file, per the vocab guard).
-const MIGRATE_TEAM_VOCAB_COMMAND = 'manage:migrate-team-vocab';
+import { bold, red } from '../../lib/style.js';
 export function attachManageCommands(admin) {
     const manage = admin
         .command('manage')
-        .description('Dangerous operations: delete-workspace, delete-user, migrate-team-vocab (WP-324)');
+        .description('Dangerous operations: delete-workspace, delete-user');
     // ── delete-workspace ────────────────────────────────────────────────────
+    // TASK-1172: a dry run only; the gateway refuses a real run for every key.
     manage
         .command('delete-workspace <slug>')
-        .description('Permanently delete a workspace and all its data (TEST-ONLY, BR-210)')
-        .option('--confirm', 'Execute live delete (omit for dry-run preview)')
-        .action(async (slug, options) => {
+        .description('Preview what deleting this workspace would remove. A person deletes it from Cortex.')
+        .action(async (slug) => {
         const workspaceId = await resolveWorkspaceArg(slug);
         if (!workspaceId) {
             process.stderr.write(red(`Workspace not found: "${slug}"\n`));
             process.exit(1);
         }
-        const dryRun = !options.confirm;
-        const result = await adminCall('manage:delete-workspace', { workspaceId, dryRun });
+        const result = await adminCall('manage:delete-workspace', { workspaceId, dryRun: true });
         if (isJsonMode()) {
             process.stdout.write(JSON.stringify(result, null, 2) + '\n');
             return;
         }
-        if (dryRun) {
-            process.stdout.write(bold('Dry-run — ' + slug) + '\n');
-            process.stdout.write(dim('⚠  TEST-ONLY — for onboarding reset testing only (BR-210)') + '\n');
-            for (const entry of result.deletionLog ?? []) {
-                if (entry.count > 0)
-                    process.stdout.write(`  ${entry.table}: ${entry.count}\n`);
-            }
-            process.stdout.write(dim('Rerun with --confirm to execute') + '\n');
-        }
-        else {
-            process.stdout.write(dim('⚠  TEST-ONLY — for onboarding reset testing only (BR-210)') + '\n');
-            process.stdout.write(green(`✓ Deleted workspace ${slug}`) + '\n');
-            const total = (result.deletionLog ?? []).reduce((s, e) => s + e.count, 0);
-            process.stdout.write(dim(`  ${total} rows removed`) + '\n');
+        process.stdout.write(bold('Dry-run — ' + slug) + '\n');
+        for (const entry of result.deletionLog ?? []) {
+            if (entry.count > 0)
+                process.stdout.write(`  ${entry.table}: ${entry.count}\n`);
         }
     });
     // ── delete-user ─────────────────────────────────────────────────────────
     manage
         .command('delete-user <email>')
-        .description('Permanently delete a user across all workspaces (TEST-ONLY, BR-210)')
-        .option('--confirm', 'Execute live delete (omit for dry-run preview)')
-        .action(async (email, options) => {
+        .description('Preview what deleting this person would remove. A person deletes them from Cortex.')
+        .action(async (email) => {
         const clerkUserId = await resolveUserArg(email);
-        const dryRun = !options.confirm;
-        const result = await adminCall('manage:delete-user', { clerkUserId, dryRun });
+        const result = await adminCall('manage:delete-user', { clerkUserId, dryRun: true });
         if (!result.success && result.reason === 'user_owns_workspace') {
             process.stderr.write(red(`Cannot delete: user is the sole member of workspace ${result.workspaceId ?? ''}. Delete the workspace first. (BR-209)\n`));
             process.exit(1);
@@ -88,173 +43,11 @@ export function attachManageCommands(admin) {
             process.stdout.write(JSON.stringify(result, null, 2) + '\n');
             return;
         }
-        if (dryRun) {
-            process.stdout.write(bold('Dry-run — ' + email) + '\n');
-            process.stdout.write(dim('⚠  TEST-ONLY — for onboarding reset testing only (BR-210)') + '\n');
-            for (const entry of result.deletionLog ?? []) {
-                if (entry.count > 0)
-                    process.stdout.write(`  ${entry.table}: ${entry.count}\n`);
-            }
-            process.stdout.write(dim('Rerun with --confirm to execute') + '\n');
-        }
-        else {
-            process.stdout.write(dim('⚠  TEST-ONLY — for onboarding reset testing only (BR-210)') + '\n');
-            process.stdout.write(green(`✓ Deleted user ${email}`) + '\n');
-            const total = (result.deletionLog ?? []).reduce((s, e) => s + e.count, 0);
-            process.stdout.write(dim(`  ${total} rows removed`) + '\n');
+        process.stdout.write(bold('Dry-run — ' + email) + '\n');
+        for (const entry of result.deletionLog ?? []) {
+            if (entry.count > 0)
+                process.stdout.write(`  ${entry.table}: ${entry.count}\n`);
         }
     });
-    // ── migrate-team-vocab ────────────────────────────────────────────────────
-    // One-time persisted-data migration that finalizes the Phase 0 Team rename.
-    // Single-workspace by default; --all (requires --confirm) fans out across the
-    // whole fleet with a per-workspace try/catch so one throwing/partially-migrated
-    // workspace never aborts the run. Idempotent — safe to re-run.
-    manage
-        .command('migrate-team-vocab [slug]')
-        .description('Finalize the persisted-data team-vocab migration (one workspace, or --all). Idempotent.')
-        .option('--all', 'Run across ALL workspaces in the deployment (requires --confirm)', false)
-        .option('--confirm', 'Acknowledge the destructive cross-workspace run (required with --all)', false)
-        .action(async (slug, options) => {
-        if (options.confirm && !options.all) {
-            process.stderr.write(red('--confirm requires --all (the single-workspace path is always live)') + '\n');
-            process.exitCode = 1;
-            return;
-        }
-        if (options.all && slug) {
-            // --all fans out to EVERY workspace and ignores the slug. Reject the
-            // ambiguous mix so `migrate-team-vocab acme --all` can't silently
-            // migrate the whole deployment instead of the named workspace.
-            process.stderr.write(red('Cannot combine a slug with --all — --all migrates every workspace. Drop one.') + '\n');
-            process.exitCode = 1;
-            return;
-        }
-        if (options.all) {
-            await runMigrateTeamVocabAll(options.confirm);
-            return;
-        }
-        await runMigrateTeamVocabOne(slug);
-    });
-}
-/** Render a single migration result's 11 count/flag fields + the 2 collision warnings. */
-function printTeamVocabResult(label, result) {
-    process.stdout.write(bold(label) + '\n');
-    for (const field of TEAM_VOCAB_FIELDS) {
-        process.stdout.write(`  ${field}: ${String(result[field])}\n`);
-    }
-    printTeamVocabCollisions('  ', result);
-}
-/** Surface the two collision counters distinctly — non-zero is an operator warning, not a patch. */
-function printTeamVocabCollisions(indent, result) {
-    const { glossaryNameCollisionsSkipped, roleNameCollisionsSkipped } = result;
-    if (glossaryNameCollisionsSkipped > 0 || roleNameCollisionsSkipped > 0) {
-        process.stdout.write(yellow(`${indent}⚠  collisions skipped (NOT migrated) — review manually:`) + '\n');
-        process.stdout.write(yellow(`${indent}  glossaryNameCollisionsSkipped: ${glossaryNameCollisionsSkipped}`) + '\n');
-        process.stdout.write(yellow(`${indent}  roleNameCollisionsSkipped: ${roleNameCollisionsSkipped}`) + '\n');
-    }
-    else {
-        process.stdout.write(dim(`${indent}glossaryNameCollisionsSkipped: 0   roleNameCollisionsSkipped: 0`) + '\n');
-    }
-}
-/** Single-workspace path: resolve the slug, run the migration, print all 13 fields. */
-async function runMigrateTeamVocabOne(slug) {
-    const workspaceId = await resolveWorkspaceArg(slug);
-    if (!workspaceId) {
-        process.stderr.write(red('Workspace required — pass a slug/id or run `pb session start` in this project.\n'));
-        process.exit(1);
-    }
-    const result = (await adminCall(MIGRATE_TEAM_VOCAB_COMMAND, {
-        workspaceId,
-    }));
-    if (isJsonMode()) {
-        process.stdout.write(JSON.stringify(result, null, 2) + '\n');
-        return;
-    }
-    printTeamVocabResult(`Team-vocab migration — ${slug ?? workspaceId}`, result);
-    process.stdout.write(green('✓ Migration complete') + '\n');
-}
-/**
- * Fleet path: --all requires --confirm and the prod-destructive gate. Without --confirm
- * we list what WILL run and exit. With it, enumerate via inspect:list-workspaces and run
- * the migration per workspace under an isolated try/catch so failures don't abort the run.
- */
-async function runMigrateTeamVocabAll(confirm) {
-    const { siteUrl } = resolveAdminConfig();
-    // Enumerate the fleet (also used for the pre-confirm "what will run" listing).
-    const workspaces = (await adminCall('inspect:list-workspaces', {}));
-    if (!confirm) {
-        if (isJsonMode()) {
-            process.stdout.write(JSON.stringify({ wouldRun: workspaces.map((w) => ({ _id: w._id, slug: w.slug })) }, null, 2) +
-                '\n');
-            return;
-        }
-        process.stdout.write(bold(`Will run team-vocab migration on ${workspaces.length} workspace(s):`) + '\n');
-        for (const ws of workspaces) {
-            process.stdout.write(`  ${ws.slug} ${dim(`(${ws._id})`)}\n`);
-        }
-        process.stdout.write(dim('Rerun with --all --confirm to execute') + '\n');
-        return;
-    }
-    // Prod / remote deployments: surface the target loudly before fanning out.
-    // The gate is the mandatory --confirm flag + the no-confirm listing above
-    // (uniform across every deployment) — deliberately NOT an interactive prompt:
-    // a passed --confirm would bypass it anyway, and it would hang a non-interactive
-    // (CI / scripted) fleet run, which is exactly when --confirm is used.
-    if (requiresAdminDestructiveConfirmation(siteUrl)) {
-        // stderr, not stdout: in --json mode stdout carries the result payload, and
-        // a warning written there would corrupt it for jq/CI parsers.
-        process.stderr.write(yellow(`⚠  Running team-vocab migration across ALL ${workspaces.length} workspace(s) on ${siteUrl}`) +
-            '\n');
-    }
-    const succeeded = [];
-    const failed = [];
-    for (const ws of workspaces) {
-        try {
-            const result = (await adminCall(MIGRATE_TEAM_VOCAB_COMMAND, {
-                workspaceId: ws._id,
-            }));
-            succeeded.push({ slug: ws.slug, result });
-        }
-        catch (e) {
-            // One throwing / partially-migrated workspace must not abort the fleet.
-            failed.push({ slug: ws.slug, error: e instanceof Error ? e.message : String(e) });
-        }
-    }
-    // A throwing/partially-migrated workspace fails the run — set this BEFORE the
-    // JSON early-return so --json/CI callers get a non-zero exit too (not just the
-    // human path below). Skipped collisions are deliberately NOT a failure here:
-    // they are surfaced as warnings and their counts ride the result payload, so
-    // automation can gate on them explicitly.
-    if (failed.length > 0)
-        process.exitCode = 1;
-    if (isJsonMode()) {
-        process.stdout.write(JSON.stringify({ succeeded, failed }, null, 2) + '\n');
-        return;
-    }
-    // Per-workspace counts.
-    for (const s of succeeded) {
-        printTeamVocabResult(`✓ ${s.slug}`, s.result);
-        process.stdout.write('\n');
-    }
-    // Fleet totals across the numeric fields (collisions included).
-    const totals = {};
-    for (const field of TEAM_VOCAB_NUMERIC_FIELDS) {
-        totals[field] = succeeded.reduce((sum, s) => sum + s.result[field], 0);
-    }
-    process.stdout.write(bold(`Fleet totals (${succeeded.length} succeeded, ${failed.length} failed)`) + '\n');
-    for (const field of TEAM_VOCAB_NUMERIC_FIELDS) {
-        const line = `  ${field}: ${totals[field]}`;
-        const isCollision = field === 'glossaryNameCollisionsSkipped' || field === 'roleNameCollisionsSkipped';
-        process.stdout.write((isCollision && totals[field] > 0 ? yellow(line) : line) + '\n');
-    }
-    // Explicit failure list — a throwing/partially-migrated workspace surfaces here.
-    if (failed.length > 0) {
-        process.stdout.write(red(`\n✗ ${failed.length} workspace(s) failed:`) + '\n');
-        for (const f of failed) {
-            process.stdout.write(red(`  ${f.slug}: ${f.error}`) + '\n');
-        }
-    }
-    else {
-        process.stdout.write(green('\n✓ All workspaces migrated') + '\n');
-    }
 }
 //# sourceMappingURL=manage.js.map

package/dist/commands/admin/manage.js.map

@@ -1 +1 @@
-{"version":3,"file":"manage.js","sourceRoot":"","sources":["../../../src/commands/admin/manage.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,oCAAoC,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAwBnE,wEAAwE;AACxE,MAAM,iBAAiB,GAA0C;IAC/D,gBAAgB;IAChB,cAAc;IACd,qBAAqB;IACrB,oBAAoB;IACpB,6BAA6B;IAC7B,oBAAoB;IACpB,sBAAsB;IACtB,qBAAqB;IACrB,kBAAkB;IAClB,2BAA2B;IAC3B,uBAAuB;CACxB,CAAC;AAEF,0EAA0E;AAC1E,MAAM,yBAAyB,GAA0C;IACvE,gBAAgB;IAChB,cAAc;IACd,oBAAoB;IACpB,oBAAoB;IACpB,sBAAsB;IACtB,qBAAqB;IACrB,kBAAkB;IAClB,uBAAuB;IACvB,+BAA+B;IAC/B,2BAA2B;CAC5B,CAAC;AAEF,iFAAiF;AACjF,wDAAwD;AACxD,MAAM,0BAA0B,GAAG,2BAA2B,CAAC;AAE/D,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,MAAM,MAAM,GAAG,KAAK;SACjB,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,kFAAkF,CAAC,CAAC;IAEnG,2EAA2E;IAC3E,MAAM;SACH,OAAO,CAAC,yBAAyB,CAAC;SAClC,WAAW,CAAC,qEAAqE,CAAC;SAClF,MAAM,CAAC,WAAW,EAAE,gDAAgD,CAAC;SACrE,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,OAA8B,EAAE,EAAE;QAC7D,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,yBAAyB,IAAI,KAAK,CAAC,CAAC,CAAC;YAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,yBAAyB,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,CAKhF,CAAC;QAEF,IAAI,UAAU,EAAE,EAAE,CAAC;YACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QAED,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;YACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,2DAA2D,CAAC,GAAG,IAAI,CAAC,CAAC;YAC9F,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;gBAC7C,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC;oBAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;YAClF,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,iCAAiC,CAAC,GAAG,IAAI,CAAC,CAAC;QACtE,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,2DAA2D,CAAC,GAAG,IAAI,CAAC,CAAC;YAC9F,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,uBAAuB,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;YAClE,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAC1E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,KAAK,eAAe,CAAC,GAAG,IAAI,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,2EAA2E;IAC3E,MAAM;SACH,OAAO,CAAC,qBAAqB,CAAC;SAC9B,WAAW,CAAC,qEAAqE,CAAC;SAClF,MAAM,CAAC,WAAW,EAAE,gDAAgD,CAAC;SACrE,MAAM,CAAC,KAAK,EAAE,KAAa,EAAE,OAA8B,EAAE,EAAE;QAC9D,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,oBAAoB,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,CAO3E,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,KAAK,qBAAqB,EAAE,CAAC;YAC/D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,uDAAuD,MAAM,CAAC,WAAW,IAAI,EAAE,0CAA0C,CAAC,CAAC,CAAC;YACrJ,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,UAAU,EAAE,EAAE,CAAC;YACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QAED,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;YACxD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,2DAA2D,CAAC,GAAG,IAAI,CAAC,CAAC;YAC9F,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;gBAC7C,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC;oBAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;YAClF,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,iCAAiC,CAAC,GAAG,IAAI,CAAC,CAAC;QACtE,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,2DAA2D,CAAC,GAAG,IAAI,CAAC,CAAC;YAC9F,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAkB,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;YAC9D,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAC1E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,KAAK,eAAe,CAAC,GAAG,IAAI,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,6EAA6E;IAC7E,4EAA4E;IAC5E,8EAA8E;IAC9E,gFAAgF;IAChF,+DAA+D;IAC/D,MAAM;SACH,OAAO,CAAC,2BAA2B,CAAC;SACpC,WAAW,CAAC,yFAAyF,CAAC;SACtG,MAAM,CAAC,OAAO,EAAE,kEAAkE,EAAE,KAAK,CAAC;SAC1F,MAAM,CAAC,WAAW,EAAE,uEAAuE,EAAE,KAAK,CAAC;SACnG,MAAM,CAAC,KAAK,EAAE,IAAwB,EAAE,OAA2C,EAAE,EAAE;QACtF,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YACpC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,qEAAqE,CAAC,GAAG,IAAI,CAAC,CAAC;YACxG,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;YACxB,qEAAqE;YACrE,kEAAkE;YAClE,+DAA+D;YAC/D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,8EAA8E,CAAC,GAAG,IAAI,CAAC,CAAC;YACjH,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAChB,MAAM,sBAAsB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QACD,MAAM,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACP,CAAC;AAED,0FAA0F;AAC1F,SAAS,oBAAoB,CAAC,KAAa,EAAE,MAAgC;IAC3E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,iBAAiB,EAAE,CAAC;QACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC;IACjE,CAAC;IACD,wBAAwB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACzC,CAAC;AAED,oGAAoG;AACpG,SAAS,wBAAwB,CAAC,MAAc,EAAE,MAAgC;IAChF,MAAM,EAAE,6BAA6B,EAAE,yBAAyB,EAAE,GAAG,MAAM,CAAC;IAC5E,IAAI,6BAA6B,GAAG,CAAC,IAAI,yBAAyB,GAAG,CAAC,EAAE,CAAC;QACvE,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,MAAM,CAAC,GAAG,MAAM,yDAAyD,CAAC,GAAG,IAAI,CAClF,CAAC;QACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,MAAM,CAAC,GAAG,MAAM,oCAAoC,6BAA6B,EAAE,CAAC,GAAG,IAAI,CAC5F,CAAC;QACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,MAAM,CAAC,GAAG,MAAM,gCAAgC,yBAAyB,EAAE,CAAC,GAAG,IAAI,CACpF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,CAAC,GAAG,MAAM,iEAAiE,CAAC,GAAG,IAAI,CACvF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,KAAK,UAAU,sBAAsB,CAAC,IAAwB;IAC5D,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,CAAC,kFAAkF,CAAC,CACxF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,MAAM,SAAS,CAAC,0BAA0B,EAAE;QAC1D,WAAW;KACZ,CAAC,CAA6B,CAAC;IAEhC,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAC7D,OAAO;IACT,CAAC;IAED,oBAAoB,CAAC,0BAA0B,IAAI,IAAI,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC;IAC9E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,sBAAsB,CAAC,GAAG,IAAI,CAAC,CAAC;AAC7D,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,sBAAsB,CAAC,OAAgB;IACpD,MAAM,EAAE,OAAO,EAAE,GAAG,kBAAkB,EAAE,CAAC;IAEzC,+EAA+E;IAC/E,MAAM,UAAU,GAAG,CAAC,MAAM,SAAS,CAAC,yBAAyB,EAAE,EAAE,CAAC,CAIhE,CAAC;IAEH,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,UAAU,EAAE,EAAE,CAAC;YACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC1F,IAAI,CACP,CAAC;YACF,OAAO;QACT,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,oCAAoC,UAAU,CAAC,MAAM,gBAAgB,CAAC,GAAG,IAAI,CAAC,CAAC;QACzG,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;YAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,uCAAuC,CAAC,GAAG,IAAI,CAAC,CAAC;QAC1E,OAAO;IACT,CAAC;IAED,2EAA2E;IAC3E,0EAA0E;IAC1E,8EAA8E;IAC9E,iFAAiF;IACjF,sEAAsE;IACtE,IAAI,oCAAoC,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,4EAA4E;QAC5E,8DAA8D;QAC9D,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,MAAM,CAAC,8CAA8C,UAAU,CAAC,MAAM,oBAAoB,OAAO,EAAE,CAAC;YAClG,IAAI,CACP,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAA8D,EAAE,CAAC;IAChF,MAAM,MAAM,GAA2C,EAAE,CAAC;IAE1D,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,CAAC,MAAM,SAAS,CAAC,0BAA0B,EAAE;gBAC1D,WAAW,EAAE,EAAE,CAAC,GAAG;aACpB,CAAC,CAA6B,CAAC;YAChC,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,wEAAwE;YACxE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,+EAA+E;IAC/E,6EAA6E;IAC7E,6EAA6E;IAC7E,0CAA0C;IAC1C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IAE5C,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAC5E,OAAO;IACT,CAAC;IAED,wBAAwB;IACxB,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,oBAAoB,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;QAC9C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,gEAAgE;IAChE,MAAM,MAAM,GAAG,EAAoD,CAAC;IACpE,KAAK,MAAM,KAAK,IAAI,yBAAyB,EAAE,CAAC;QAC9C,MAAM,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAY,EAAE,CAAC,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,SAAS,CAAC,MAAM,eAAe,MAAM,CAAC,MAAM,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3G,KAAK,MAAM,KAAK,IAAI,yBAAyB,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,KAAK,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5C,MAAM,WAAW,GACf,KAAK,KAAK,+BAA+B,IAAI,KAAK,KAAK,2BAA2B,CAAC;QACrF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;IACxF,CAAC;IAED,iFAAiF;IACjF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,MAAM,CAAC,MAAM,uBAAuB,CAAC,GAAG,IAAI,CAAC,CAAC;QAC9E,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,6BAA6B,CAAC,GAAG,IAAI,CAAC,CAAC;IACpE,CAAC;AACH,CAAC"}
+{"version":3,"file":"manage.js","sourceRoot":"","sources":["../../../src/commands/admin/manage.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AAE/C,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,MAAM,MAAM,GAAG,KAAK;SACjB,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,qDAAqD,CAAC,CAAC;IAEtE,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM;SACH,OAAO,CAAC,yBAAyB,CAAC;SAClC,WAAW,CAAC,qFAAqF,CAAC;SAClG,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE;QAC7B,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,yBAAyB,IAAI,KAAK,CAAC,CAAC,CAAC;YAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,yBAAyB,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,CAKtF,CAAC;QAEF,IAAI,UAAU,EAAE,EAAE,CAAC;YACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QACvD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;YAC7C,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC;gBAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;QAClF,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,2EAA2E;IAC3E,MAAM;SACH,OAAO,CAAC,qBAAqB,CAAC;SAC9B,WAAW,CAAC,oFAAoF,CAAC;SACjG,MAAM,CAAC,KAAK,EAAE,KAAa,EAAE,EAAE;QAC9B,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,oBAAoB,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,CAOjF,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,KAAK,qBAAqB,EAAE,CAAC;YAC/D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,uDAAuD,MAAM,CAAC,WAAW,IAAI,EAAE,0CAA0C,CAAC,CAAC,CAAC;YACrJ,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,UAAU,EAAE,EAAE,CAAC;YACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;QACxD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;YAC7C,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC;gBAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;QAClF,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/admin/manage.test.d.ts

@@ -1,16 +1,2 @@
-/**
- * Tests for `pb admin manage migrate-team-vocab` subcommand wiring.
- *
- * Covers the dispatch surface for the (already-shipped) persisted-data team-vocab
- * migration:
- *   - [slug] path resolves the workspace and calls manage:migrate-team-vocab with it
- *   - --all WITHOUT --confirm enumerates but never dispatches the migration
- *   - --all --confirm enumerates then dispatches the migration per workspace
- *   - a throwing workspace is caught so the fleet loop continues
- *
- * The migration name literal is referenced via the vocab-clean manifest command
- * string ('manage:migrate-team-vocab') — the retired token lives only in the
- * migration file (see the vocab guard).
- */
 export {};
 //# sourceMappingURL=manage.test.d.ts.map

package/dist/commands/admin/manage.test.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manage.test.d.ts","sourceRoot":"","sources":["../../../src/commands/admin/manage.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG"}
+{"version":3,"file":"manage.test.d.ts","sourceRoot":"","sources":["../../../src/commands/admin/manage.test.ts"],"names":[],"mappings":""}

package/dist/commands/admin/manage.test.js

@@ -1,159 +1,103 @@
 /**
- * Tests for `pb admin manage migrate-team-vocab` subcommand wiring.
- *
- * Covers the dispatch surface for the (already-shipped) persisted-data team-vocab
- * migration:
- *   - [slug] path resolves the workspace and calls manage:migrate-team-vocab with it
- *   - --all WITHOUT --confirm enumerates but never dispatches the migration
- *   - --all --confirm enumerates then dispatches the migration per workspace
- *   - a throwing workspace is caught so the fleet loop continues
- *
- * The migration name literal is referenced via the vocab-clean manifest command
- * string ('manage:migrate-team-vocab') — the retired token lives only in the
- * migration file (see the vocab guard).
+ * TASK-1172: `pb admin manage delete-workspace|delete-user` are dry runs only, and a real run sent through `pb admin run`
+ * prints the gateway's refusal as served. The real adminCall and the real global error handler run; only the config,
+ * the session and fetch are stubbed.
  */
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { Command } from 'commander';
-// Mock adminCall — the single server dispatch surface.
-vi.mock('../../lib/client.js', () => ({
-    adminCall: vi.fn(async () => ({})),
+vi.mock('../../lib/adminConfig.js', () => ({
+    resolveAdminConfig: () => ({ apiKey: 'pb_sk_test', siteUrl: 'http://127.0.0.1:3210', source: 'env', profileName: null }),
 }));
-// Mock workspace resolution so the [slug] path is deterministic.
+vi.mock('../../lib/session.js', () => ({ readSession: () => null, readSessionBySessionId: () => null }));
 vi.mock('./inspect.js', () => ({
-    resolveWorkspaceArg: vi.fn(async (slug) => (slug ? `ws-${slug}` : undefined)),
-    resolveUserArg: vi.fn(async () => 'user_x'),
-}));
-// Non-JSON so the render paths execute (and never short-circuit).
-vi.mock('../../lib/runner.js', () => ({
-    isJsonMode: vi.fn(() => false),
-}));
-// Local deployment → no prod-destructive confirmation ceremony in the gate.
-vi.mock('../../lib/config.js', () => ({
-    resolveAdminConfig: vi.fn(() => ({ siteUrl: 'http://127.0.0.1:3210' })),
-}));
-vi.mock('../../lib/deployment.js', () => ({
-    requiresAdminDestructiveConfirmation: vi.fn(() => false),
+    resolveWorkspaceArg: async () => 'ws_invented',
+    resolveUserArg: async () => 'user_invented',
 }));
 import { attachManageCommands } from './manage.js';
-import { adminCall } from '../../lib/client.js';
-import { isJsonMode } from '../../lib/runner.js';
-const MIGRATE = 'manage:migrate-team-vocab';
-/** Build a Commander tree with the manage subcommands attached and parse argv. */
-async function runManage(argv) {
+import { attachRunCommand } from './run.js';
+import { handleCliError } from '../../handleCliError.js';
+import { setOutputMode } from '../../lib/runner.js';
+const ROWS = [
+    {
+        argv: ['delete-workspace', 'acme'], command: 'manage:delete-workspace', sentence: 'Only a person deletes a workspace.\nAcme stays as it is.',
+        next: 'Randy Hereman: open https://work.example.com/admin/workspaces?workspace=acme and click Delete workspace.',
+    },
+    {
+        argv: ['delete-user', 'someone@example.com'], command: 'manage:delete-user', sentence: 'Only a person deletes a person.\nSome One keeps their access.',
+        next: 'Randy Hereman: open https://work.example.com/admin/users?email=someone%40example.com and click Delete person.',
+    },
+];
+/** Runs `pb admin <argv>` and returns what reached stderr, the global handler's line included. */
+async function runAdmin(argv) {
     const admin = new Command();
-    attachManageCommands(admin);
-    // exitOverride so a parse error throws instead of calling process.exit.
     admin.exitOverride();
-    await admin.parseAsync(['node', 'pb', 'manage', ...argv]);
-}
-/** Full 13-field migration result with overridable fields. */
-function migrationResult(overrides = {}) {
-    return {
-        entriesRenamed: 0,
-        rolesPatched: 0,
-        displayNamesPatched: false,
-        membershipsPatched: 0,
-        teamCollectionFieldsPatched: false,
-        teamEntriesPatched: 0,
-        glossaryNamesPatched: 0,
-        glossaryDefsPatched: 0,
-        rolesNamePatched: 0,
-        teamCollectionNamePatched: false,
-        governanceTagsPatched: 0,
-        glossaryNameCollisionsSkipped: 0,
-        roleNameCollisionsSkipped: 0,
-        ...overrides,
-    };
+    admin.configureOutput({ outputError: () => { } });
+    attachManageCommands(admin);
+    attachRunCommand(admin);
+    for (const child of admin.commands)
+        child.exitOverride().configureOutput({ outputError: () => { } });
+    for (const child of admin.commands.flatMap((c) => c.commands))
+        child.exitOverride().configureOutput({ outputError: () => { } });
+    const stderr = [];
+    const stderrSpy = vi.spyOn(process.stderr, 'write').mockImplementation((c) => { stderr.push(String(c)); return true; });
+    const stdoutSpy = vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+    const exitSpy = vi.spyOn(process, 'exit').mockImplementation(((code) => { throw new Error(`exit ${code}`); }));
+    try {
+        await admin.parseAsync(['node', 'pb', ...argv]).catch((err) => handleCliError(err));
+    }
+    catch (err) {
+        expect(String(err)).toContain('exit 1');
+    }
+    finally {
+        stderrSpy.mockRestore();
+        stdoutSpy.mockRestore();
+        exitSpy.mockRestore();
+    }
+    return stderr.join('');
 }
+const refusal = (row) => ({
+    ok: false, status: 403, statusText: 'Forbidden', json: async () => ({ ok: false, error: row.sentence, code: 'person_only', details: [{ requiredAction: row.next }] }),
+});
+let fetchSpy;
 beforeEach(() => {
-    vi.clearAllMocks();
-    vi.mocked(adminCall).mockResolvedValue(migrationResult());
+    fetchSpy = vi.fn();
+    vi.stubGlobal('fetch', fetchSpy);
 });
-// Reset exit state after every test — a failed assertion before an inline reset
-// would otherwise leak process.exitCode into the next test (the file runs
-// sequentially) and into the runner's own exit code on the last test.
 afterEach(() => {
-    process.exitCode = 0;
+    setOutputMode('auto');
+    vi.unstubAllGlobals();
 });
-describe('manage migrate-team-vocab [slug]', () => {
-    it('resolves the slug and dispatches manage:migrate-team-vocab with the workspaceId', async () => {
-        vi.mocked(adminCall).mockResolvedValueOnce(migrationResult({ entriesRenamed: 3 }));
-        await runManage(['migrate-team-vocab', 'acme']);
-        expect(adminCall).toHaveBeenCalledTimes(1);
-        expect(adminCall).toHaveBeenCalledWith(MIGRATE, { workspaceId: 'ws-acme' });
-    });
-    it('rejects --confirm without --all and never dispatches (single path is always live)', async () => {
-        await runManage(['migrate-team-vocab', 'acme', '--confirm']);
-        expect(adminCall).not.toHaveBeenCalled();
-        expect(process.exitCode).toBe(1);
-    });
+describe('pb admin manage delete-* are dry runs only (TASK-1172)', () => {
+    for (const row of ROWS) {
+        it(`${row.argv[0]} sends dryRun true`, async () => {
+            setOutputMode('pretty');
+            fetchSpy.mockResolvedValue({ ok: true, status: 200, json: async () => ({ ok: true, data: { success: true, isDryRun: true, deletionLog: [] } }) });
+            await runAdmin(['manage', ...row.argv]);
+            expect(JSON.parse(fetchSpy.mock.calls[0][1].body)).toMatchObject({ command: row.command, args: { dryRun: true } });
+        });
+        it(`${row.argv[0]} has no --confirm`, async () => {
+            setOutputMode('pretty');
+            const stderr = await runAdmin(['manage', ...row.argv, '--confirm']);
+            expect(fetchSpy).not.toHaveBeenCalled();
+            expect(stderr).toContain('--confirm');
+        });
+    }
 });
-describe('manage migrate-team-vocab --all', () => {
-    it('rejects a slug combined with --all and never dispatches', async () => {
-        await runManage(['migrate-team-vocab', 'acme', '--all', '--confirm']);
-        // --all + slug is ambiguous (would migrate the whole fleet, ignoring the
-        // slug) — reject before any dispatch.
-        expect(adminCall).not.toHaveBeenCalled();
-        expect(process.exitCode).toBe(1);
-    });
-    it('without --confirm enumerates but does NOT dispatch the migration', async () => {
-        vi.mocked(adminCall).mockResolvedValueOnce([
-            { _id: 'ws-1', slug: 'one', name: 'One' },
-            { _id: 'ws-2', slug: 'two', name: 'Two' },
-        ]);
-        await runManage(['migrate-team-vocab', '--all']);
-        // Exactly one call — the enumerator — and never the migration.
-        expect(adminCall).toHaveBeenCalledTimes(1);
-        expect(adminCall).toHaveBeenCalledWith('inspect:list-workspaces', {});
-        expect(adminCall).not.toHaveBeenCalledWith(MIGRATE, expect.anything());
-    });
-    it('with --confirm enumerates then dispatches the migration per workspace', async () => {
-        vi.mocked(adminCall)
-            .mockResolvedValueOnce([
-            { _id: 'ws-1', slug: 'one', name: 'One' },
-            { _id: 'ws-2', slug: 'two', name: 'Two' },
-        ])
-            .mockResolvedValueOnce(migrationResult({ entriesRenamed: 1 }))
-            .mockResolvedValueOnce(migrationResult({ entriesRenamed: 2 }));
-        await runManage(['migrate-team-vocab', '--all', '--confirm']);
-        expect(adminCall).toHaveBeenNthCalledWith(1, 'inspect:list-workspaces', {});
-        expect(adminCall).toHaveBeenNthCalledWith(2, MIGRATE, { workspaceId: 'ws-1' });
-        expect(adminCall).toHaveBeenNthCalledWith(3, MIGRATE, { workspaceId: 'ws-2' });
-        expect(adminCall).toHaveBeenCalledTimes(3);
-    });
-    it('catches a throwing workspace and continues the fleet loop', async () => {
-        vi.mocked(adminCall)
-            .mockResolvedValueOnce([
-            { _id: 'ws-1', slug: 'one', name: 'One' },
-            { _id: 'ws-2', slug: 'two', name: 'Two' },
-            { _id: 'ws-3', slug: 'three', name: 'Three' },
-        ])
-            .mockResolvedValueOnce(migrationResult({ entriesRenamed: 1 }))
-            .mockRejectedValueOnce(new Error('legacy + renamed systemKey coexist'))
-            .mockResolvedValueOnce(migrationResult({ entriesRenamed: 3 }));
-        await runManage(['migrate-team-vocab', '--all', '--confirm']);
-        // All three workspaces were attempted despite ws-2 throwing.
-        expect(adminCall).toHaveBeenNthCalledWith(2, MIGRATE, { workspaceId: 'ws-1' });
-        expect(adminCall).toHaveBeenNthCalledWith(3, MIGRATE, { workspaceId: 'ws-2' });
-        expect(adminCall).toHaveBeenNthCalledWith(4, MIGRATE, { workspaceId: 'ws-3' });
-        expect(adminCall).toHaveBeenCalledTimes(4);
-        // Failing workspace marks a non-zero exit code.
-        expect(process.exitCode).toBe(1);
-    });
-    it('--json fleet run with a failing workspace still exits non-zero', async () => {
-        // The JSON payload is written and the function returns before the human
-        // failure block — the exit code must be set on the JSON path too, or CI
-        // parsing the payload treats a partial migration as success.
-        vi.mocked(isJsonMode).mockReturnValueOnce(true);
-        vi.mocked(adminCall)
-            .mockResolvedValueOnce([
-            { _id: 'ws-1', slug: 'one', name: 'One' },
-            { _id: 'ws-2', slug: 'two', name: 'Two' },
-        ])
-            .mockResolvedValueOnce(migrationResult({ entriesRenamed: 1 }))
-            .mockRejectedValueOnce(new Error('legacy + renamed systemKey coexist'));
-        await runManage(['migrate-team-vocab', '--all', '--confirm']);
-        expect(process.exitCode).toBe(1);
-    });
+describe('pb admin run prints the person-only refusal as served (TASK-1172, TASK-1173)', () => {
+    for (const row of ROWS) {
+        it(`${row.command} with dryRun false prints the reason, then who opens which page`, async () => {
+            setOutputMode('pretty');
+            fetchSpy.mockResolvedValue(refusal(row));
+            const stderr = await runAdmin(['run', row.command, '{"dryRun":false}']);
+            expect(stderr).toContain(`${row.sentence}\n${row.next}\n`);
+        });
+        it(`${row.command} with dryRun false and --json prints the sentence and the code`, async () => {
+            setOutputMode('json');
+            fetchSpy.mockResolvedValue(refusal(row));
+            const stderr = await runAdmin(['run', row.command, '{"dryRun":false}']);
+            const line = stderr.split('\n').find((l) => l.startsWith('{"error"'));
+            expect(JSON.parse(line ?? '{}')).toMatchObject({ error: row.sentence, code: 'person_only', category: 'auth', guidance: row.next });
+        });
+    }
 });
 //# sourceMappingURL=manage.test.js.map