conduyt 1.2.1 → 1.3.0

package/dist/index.js

@@ -99,6 +99,13 @@ contacts
         Object.assign(body, jsonArg(opts.json, "--json"));
     return client.post("/api/v1/contacts", body);
 }));
+contacts
+    .command("delete <id>")
+    .description("Delete a contact by id (soft-delete; retained for audit, the contact's deals are unaffected)")
+    .action(run(async (client, id) => {
+    assertUuid(id, "contact id");
+    return client.del(`/api/v1/contacts/${encodeURIComponent(id)}`);
+}));
 // ---- deals ----
 const deals = program.command("deals").description("Manage deals");
 deals
@@ -265,6 +272,13 @@ deals
     assertFiniteValue(body.value);
     return client.post("/api/v1/deals", body);
 }));
+deals
+    .command("delete <id>")
+    .description("Delete a deal by id (soft-delete; drops out of lists/boards and pipeline totals, retained for audit)")
+    .action(run(async (client, id) => {
+    assertUuid(id, "deal id");
+    return client.del(`/api/v1/deals/${encodeURIComponent(id)}`);
+}));
 // ---- pipelines ----
 // Default action preserves the original published `conduyt pipelines` (list)
 // invocation now that pipelines is a group — without it, commander prints help
@@ -485,6 +499,17 @@ function assertFiniteValue(v) {
         throw new Error("value must be a finite number.");
     }
 }
+// Validate an id is a UUID before it is interpolated into a DELETE path, so a
+// malformed value with slashes can't form a different (destructive) subroute.
+// The path is also URL-encoded at the call site as defence in depth. The regex
+// is inlined (not a module-level const) so it isn't in the temporal dead zone
+// when an action callback runs during program.parse().
+function assertUuid(id, label = "id") {
+    const uuidRe = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+    if (!uuidRe.test(id.trim())) {
+        throw new Error(`${label} must be a UUID.`);
+    }
+}
 // Reject prototype-polluting keys in untrusted JSON. JSON.parse creates an OWN
 // "__proto__" property, but Object.assign'ing it onto a {} body invokes the
 // setter and changes the body's PROTOTYPE — so a validator could read an

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "conduyt",
-  "version": "1.2.1",
-  "description": "Command-line interface for Conduyt CRM \u2014 manage contacts, deals, pipelines, and run insight queries from your terminal.",
+  "version": "1.3.0",
+  "description": "Command-line interface for Conduyt CRM — manage contacts, deals, pipelines, and run insight queries from your terminal.",
   "type": "module",
   "main": "dist/index.js",
   "bin": {