@blotout/qinto-cli 0.1.21 → 0.1.22

package/dist/worker-artifact/app-runtime/index.js

@@ -4,6 +4,10 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// ../../../libs/app-manifest/src/app-roles.ts
+var DECLARABLE_APP_ROLES = ["owner", "admin", "manager", "editor", "member", "viewer"];
+var APP_ROLES = ["full", ...DECLARABLE_APP_ROLES];
+
 // ../../../libs/app-manifest/src/cron.ts
 var MAX_CRON_LENGTH = 128;
 var MINUTE_LITERAL = /^([0-9]|[1-5][0-9])$/;
@@ -18947,6 +18951,10 @@ var VARIABLE_NAME = /^[A-Z][A-Z0-9_]*$/;
 var APP_SLUG_PATTERN = /^[a-z][a-z0-9-]{2,29}$/;
 var FUNCTION_NAME = /^[a-zA-Z_$][a-zA-Z0-9_$]*$/;
 var identifierField = external_exports.string().min(1).max(64).regex(IDENTIFIER);
+var RENDERABLE_TEXT = /^[^\u0000-\u0009\u000B-\u001F\u007F\u200B-\u200F\u202A-\u202E\u2066-\u2069\uFEFF]*$/;
+var renderableText = (min, max) => {
+  return external_exports.string().min(min).max(max).regex(RENDERABLE_TEXT, "must not carry control or bidirectional-override characters");
+};
 var httpsUrl = (field2) => {
   return external_exports.url().max(2048).refine((value) => value.startsWith("https://"), `${field2} must be an HTTPS URL`);
 };
@@ -19082,6 +19090,35 @@ var validateOauth = (input2, ctx) => {
   }
 };
 
+// ../../../libs/app-manifest/src/roles.ts
+var MAX_APP_ROLE_DESCRIPTION = 200;
+var roleSchema = external_exports.object({
+  key: external_exports.enum(DECLARABLE_APP_ROLES, {
+    error: (issue2) => {
+      return issue2.input === "full" ? "full access is always available and is not declared" : void 0;
+    }
+  }),
+  description: renderableText(1, MAX_APP_ROLE_DESCRIPTION).optional()
+}).strict();
+var rolesSchema = external_exports.array(roleSchema).max(DECLARABLE_APP_ROLES.length).superRefine((roles, ctx) => {
+  uniqueOrIssue(
+    ctx,
+    roles.map((role) => role.key),
+    [],
+    "role"
+  );
+}).transform((roles) => {
+  return [...roles].sort((a, b) => APP_ROLES.indexOf(a.key) - APP_ROLES.indexOf(b.key));
+});
+var validateRoles = (manifest, ctx) => {
+  const declared = /* @__PURE__ */ new Set(["full", ...(manifest.roles ?? []).map((role) => role.key)]);
+  for (const [index, tool] of manifest.tools.entries()) {
+    if (tool.role !== void 0 && !declared.has(tool.role)) {
+      ctx.addIssue({ code: "custom", path: ["tools", index, "role"], message: `Tool role ${tool.role} is not declared in roles` });
+    }
+  }
+};
+
 // ../../../libs/app-manifest/src/route.ts
 var ENDPOINT_PATH_PATTERN = /^\/(?:(?::[a-zA-Z][a-zA-Z0-9_]*|[a-zA-Z0-9_-]+)(?:\/(?::[a-zA-Z][a-zA-Z0-9_]*|[a-zA-Z0-9_-]+))*)?$/;
 var isParam = (segment) => {
@@ -19115,10 +19152,6 @@ var MAX_MANIFEST_TOOLS_BYTES = 150 * 1024;
 var TOOL_PROPERTY_NAME = /^[a-zA-Z][a-zA-Z0-9_]*$/;
 var RESERVED_TOOL_ARGUMENTS = ["teamId", "siteId", "installId"];
 var TOOL_STRING_FORMATS = ["uuid", "date", "date-time", "email", "uri"];
-var RENDERABLE_TEXT = /^[^\u0000-\u0009\u000B-\u001F\u007F\u200B-\u200F\u202A-\u202E\u2066-\u2069\uFEFF]*$/;
-var renderableText = (min, max) => {
-  return external_exports.string().min(min).max(max).regex(RENDERABLE_TEXT, "must not carry control or bidirectional-override characters");
-};
 var propertyName = external_exports.string().min(1).max(48).regex(TOOL_PROPERTY_NAME);
 var FORMAT_SCHEMAS = {
   uuid: external_exports.uuid(),
@@ -19214,7 +19247,8 @@ var toolSchema = external_exports.object({
   title: renderableText(1, MAX_APP_TOOL_TITLE_LENGTH),
   description: renderableText(MIN_APP_TOOL_DESCRIPTION, MAX_APP_TOOL_DESCRIPTION),
   inputSchema: toolInputSchema,
-  annotations: toolAnnotationsSchema
+  annotations: toolAnnotationsSchema,
+  role: external_exports.enum(APP_ROLES).optional()
 }).strict();
 var nodeChildren = (value) => {
   const properties = value["properties"];
@@ -19618,6 +19652,9 @@ var baseSchema = external_exports.object({
     description: "The push topics this app broadcasts to every app on the site. Requires the `sharedContext` data capability; a topic left out reaches only this app\u2019s own browser code."
   }),
   endpoints: external_exports.array(endpointSchema).max(16).default([]).meta({ description: "The HTTP routes served at https://<site>/app/<slug><path>." }),
+  roles: rolesSchema.optional().meta({
+    description: "The app roles this app uses, from the fixed list owner, admin, manager, editor, member, viewer. Full access is always available and is not declared. A team member is given one app role per app."
+  }),
   tools: toolsSchema.meta({
     description: "The MCP tools this app serves to AI assistants, published as `<slug>_<name>`. Each one a site manager accepts becomes callable on their behalf by an assistant."
   }),
@@ -19974,6 +20011,7 @@ var appManifestSchema = baseSchema.superRefine((manifest, ctx) => {
   validateOauth(manifest, ctx);
   validateServer(manifest, ctx);
   validateTools(manifest.tools, ctx);
+  validateRoles(manifest, ctx);
 });
 
 // ../../../libs/app-manifest/src/oauth-flow.ts
@@ -20188,7 +20226,12 @@ var toolSchema2 = external_exports.object({
   name: external_exports.string().min(1).max(MAX_APP_TOOL_NAME_LENGTH).regex(APP_TOOL_NAME_PATTERN),
   // Who asked, and what they may do on this site. Derived from the bearer by the portal, never
   // from the model's arguments.
-  viewer: external_exports.object({ userId: external_exports.string().min(1).max(64), access: external_exports.enum(["read", "write"]) }).strict(),
+  viewer: external_exports.object({
+    userId: external_exports.string().min(1).max(64),
+    access: external_exports.enum(["read", "write"]),
+    // Optional only while a site worker or app runtime that predates it can still receive this envelope; absent means `full`.
+    appRole: external_exports.enum(APP_ROLES).optional()
+  }).strict(),
   // Already validated against the tool's declared inputSchema, with the reserved routing names
   // stripped. Every declared input schema has an object root, so this is an object too — and a
   // call that names no arguments normalizes to `{}` rather than reaching the handler as undefined.
@@ -20416,7 +20459,12 @@ var appUiAnalyticsQueryPath = (domainId, appSlug2, resourceIdentifier) => {
 var uiInstallSchema = external_exports.object({ id: external_exports.string().min(1).max(64), ord: external_exports.number().int().min(1), label: external_exports.string().max(100), enabled: external_exports.boolean() }).strict();
 var uiContextSchema = external_exports.object({
   version: external_exports.string().min(1).max(32),
-  viewer: external_exports.object({ userId: external_exports.string().min(1).max(64), access: external_exports.enum(["read", "write"]) }).strict(),
+  viewer: external_exports.object({
+    userId: external_exports.string().min(1).max(64),
+    access: external_exports.enum(["read", "write"]),
+    // Optional only while a site worker that predates it can still send this header; absent means `full`.
+    appRole: external_exports.enum(APP_ROLES).optional()
+  }).strict(),
   install: uiInstallSchema,
   installs: external_exports.array(uiInstallSchema).min(1).max(MAX_INSTALLS_PER_APP),
   writeTicket: external_exports.string().min(1).max(2048).optional()
@@ -21941,7 +21989,8 @@ var buildContext2 = (envelope, env) => {
     env,
     site,
     install: { id: install.id, label: install.label },
-    viewer: envelope.tool.viewer,
+    // An envelope from a portal that predates the role, or one carrying `full`, has no `appRole`.
+    viewer: { ...envelope.tool.viewer, appRole: envelope.tool.viewer.appRole ?? "full" },
     callId: envelope.tool.callId,
     startWorkflow: buildStartWorkflow({ ord: install.ord, installId: install.id, installLabel: install.label, anonId: null }),
     oauth: buildOauth(env, install.ord),
@@ -22624,7 +22673,8 @@ var dispatchUi = async ({ request, env, versions }) => {
     secrets,
     appVariables,
     appSecrets,
-    viewer: context.viewer,
+    // A site worker that predates app roles sends none, and every member had full access then.
+    viewer: { ...context.viewer, appRole: context.viewer.appRole ?? "full" },
     observability: buildObservability(context.install.ord),
     identity: buildIdentity(env),
     apps: buildAppsClient(env, { depth: 0 })

package/dist/worker-artifact/main/index.js

@@ -790,6 +790,10 @@ var deriveVisitorSignature = /* @__PURE__ */ __name(async (masterBase64, domainI
   return hmacHex(masterBase64, `${domainId}#visitor#${anonId}`);
 }, "deriveVisitorSignature");
 
+// ../../libs/app-manifest/src/app-roles.ts
+var DECLARABLE_APP_ROLES = ["owner", "admin", "manager", "editor", "member", "viewer"];
+var APP_ROLES = ["full", ...DECLARABLE_APP_ROLES];
+
 // ../../libs/app-manifest/src/cron.ts
 var MAX_CRON_LENGTH = 128;
 var MINUTE_LITERAL = /^([0-9]|[1-5][0-9])$/;
@@ -20348,6 +20352,10 @@ var VARIABLE_NAME = /^[A-Z][A-Z0-9_]*$/;
 var APP_SLUG_PATTERN = /^[a-z][a-z0-9-]{2,29}$/;
 var FUNCTION_NAME = /^[a-zA-Z_$][a-zA-Z0-9_$]*$/;
 var identifierField = external_exports.string().min(1).max(64).regex(IDENTIFIER);
+var RENDERABLE_TEXT = /^[^\u0000-\u0009\u000B-\u001F\u007F\u200B-\u200F\u202A-\u202E\u2066-\u2069\uFEFF]*$/;
+var renderableText = /* @__PURE__ */ __name((min, max) => {
+  return external_exports.string().min(min).max(max).regex(RENDERABLE_TEXT, "must not carry control or bidirectional-override characters");
+}, "renderableText");
 var httpsUrl = /* @__PURE__ */ __name((field) => {
   return external_exports.url().max(2048).refine((value) => value.startsWith("https://"), `${field} must be an HTTPS URL`);
 }, "httpsUrl");
@@ -20483,6 +20491,35 @@ var validateOauth = /* @__PURE__ */ __name((input2, ctx) => {
   }
 }, "validateOauth");
 
+// ../../libs/app-manifest/src/roles.ts
+var MAX_APP_ROLE_DESCRIPTION = 200;
+var roleSchema = external_exports.object({
+  key: external_exports.enum(DECLARABLE_APP_ROLES, {
+    error: /* @__PURE__ */ __name((issue2) => {
+      return issue2.input === "full" ? "full access is always available and is not declared" : void 0;
+    }, "error")
+  }),
+  description: renderableText(1, MAX_APP_ROLE_DESCRIPTION).optional()
+}).strict();
+var rolesSchema = external_exports.array(roleSchema).max(DECLARABLE_APP_ROLES.length).superRefine((roles, ctx) => {
+  uniqueOrIssue(
+    ctx,
+    roles.map((role) => role.key),
+    [],
+    "role"
+  );
+}).transform((roles) => {
+  return [...roles].sort((a, b) => APP_ROLES.indexOf(a.key) - APP_ROLES.indexOf(b.key));
+});
+var validateRoles = /* @__PURE__ */ __name((manifest, ctx) => {
+  const declared = /* @__PURE__ */ new Set(["full", ...(manifest.roles ?? []).map((role) => role.key)]);
+  for (const [index, tool] of manifest.tools.entries()) {
+    if (tool.role !== void 0 && !declared.has(tool.role)) {
+      ctx.addIssue({ code: "custom", path: ["tools", index, "role"], message: `Tool role ${tool.role} is not declared in roles` });
+    }
+  }
+}, "validateRoles");
+
 // ../../libs/app-manifest/src/route.ts
 var ENDPOINT_PATH_PATTERN = /^\/(?:(?::[a-zA-Z][a-zA-Z0-9_]*|[a-zA-Z0-9_-]+)(?:\/(?::[a-zA-Z][a-zA-Z0-9_]*|[a-zA-Z0-9_-]+))*)?$/;
 var isParam = /* @__PURE__ */ __name((segment) => {
@@ -20579,10 +20616,6 @@ var MAX_MANIFEST_TOOLS_BYTES = 150 * 1024;
 var TOOL_PROPERTY_NAME = /^[a-zA-Z][a-zA-Z0-9_]*$/;
 var RESERVED_TOOL_ARGUMENTS = ["teamId", "siteId", "installId"];
 var TOOL_STRING_FORMATS = ["uuid", "date", "date-time", "email", "uri"];
-var RENDERABLE_TEXT = /^[^\u0000-\u0009\u000B-\u001F\u007F\u200B-\u200F\u202A-\u202E\u2066-\u2069\uFEFF]*$/;
-var renderableText = /* @__PURE__ */ __name((min, max) => {
-  return external_exports.string().min(min).max(max).regex(RENDERABLE_TEXT, "must not carry control or bidirectional-override characters");
-}, "renderableText");
 var propertyName = external_exports.string().min(1).max(48).regex(TOOL_PROPERTY_NAME);
 var FORMAT_SCHEMAS = {
   uuid: external_exports.uuid(),
@@ -20678,7 +20711,8 @@ var toolSchema = external_exports.object({
   title: renderableText(1, MAX_APP_TOOL_TITLE_LENGTH),
   description: renderableText(MIN_APP_TOOL_DESCRIPTION, MAX_APP_TOOL_DESCRIPTION),
   inputSchema: toolInputSchema,
-  annotations: toolAnnotationsSchema
+  annotations: toolAnnotationsSchema,
+  role: external_exports.enum(APP_ROLES).optional()
 }).strict();
 var nodeChildren = /* @__PURE__ */ __name((value) => {
   const properties2 = value["properties"];
@@ -21082,6 +21116,9 @@ var baseSchema = external_exports.object({
     description: "The push topics this app broadcasts to every app on the site. Requires the `sharedContext` data capability; a topic left out reaches only this app\u2019s own browser code."
   }),
   endpoints: external_exports.array(endpointSchema).max(16).default([]).meta({ description: "The HTTP routes served at https://<site>/app/<slug><path>." }),
+  roles: rolesSchema.optional().meta({
+    description: "The app roles this app uses, from the fixed list owner, admin, manager, editor, member, viewer. Full access is always available and is not declared. A team member is given one app role per app."
+  }),
   tools: toolsSchema.meta({
     description: "The MCP tools this app serves to AI assistants, published as `<slug>_<name>`. Each one a site manager accepts becomes callable on their behalf by an assistant."
   }),
@@ -21438,6 +21475,7 @@ var appManifestSchema = baseSchema.superRefine((manifest, ctx) => {
   validateOauth(manifest, ctx);
   validateServer(manifest, ctx);
   validateTools(manifest.tools, ctx);
+  validateRoles(manifest, ctx);
 });
 
 // ../../libs/app-manifest/src/oauth-flow.ts
@@ -21708,7 +21746,12 @@ var toolSchema2 = external_exports.object({
   name: external_exports.string().min(1).max(MAX_APP_TOOL_NAME_LENGTH).regex(APP_TOOL_NAME_PATTERN),
   // Who asked, and what they may do on this site. Derived from the bearer by the portal, never
   // from the model's arguments.
-  viewer: external_exports.object({ userId: external_exports.string().min(1).max(64), access: external_exports.enum(["read", "write"]) }).strict(),
+  viewer: external_exports.object({
+    userId: external_exports.string().min(1).max(64),
+    access: external_exports.enum(["read", "write"]),
+    // Optional only while a site worker or app runtime that predates it can still receive this envelope; absent means `full`.
+    appRole: external_exports.enum(APP_ROLES).optional()
+  }).strict(),
   // Already validated against the tool's declared inputSchema, with the reserved routing names
   // stripped. Every declared input schema has an object root, so this is an object too — and a
   // call that names no arguments normalizes to `{}` rather than reaching the handler as undefined.
@@ -21914,7 +21957,12 @@ var MAX_UI_BODY_BYTES = 1024 * 1024;
 var uiInstallSchema = external_exports.object({ id: external_exports.string().min(1).max(64), ord: external_exports.number().int().min(1), label: external_exports.string().max(100), enabled: external_exports.boolean() }).strict();
 var uiContextSchema = external_exports.object({
   version: external_exports.string().min(1).max(32),
-  viewer: external_exports.object({ userId: external_exports.string().min(1).max(64), access: external_exports.enum(["read", "write"]) }).strict(),
+  viewer: external_exports.object({
+    userId: external_exports.string().min(1).max(64),
+    access: external_exports.enum(["read", "write"]),
+    // Optional only while a site worker that predates it can still send this header; absent means `full`.
+    appRole: external_exports.enum(APP_ROLES).optional()
+  }).strict(),
   install: uiInstallSchema,
   installs: external_exports.array(uiInstallSchema).min(1).max(MAX_INSTALLS_PER_APP),
   writeTicket: external_exports.string().min(1).max(2048).optional()
@@ -29738,7 +29786,9 @@ var claimsSchema = external_exports.object({
   appId: external_exports.string().min(1),
   appInstallId: external_exports.string().min(1),
   appVersionId: external_exports.string().min(1),
-  access: external_exports.enum(["read", "write"])
+  access: external_exports.enum(["read", "write"]),
+  // Absent means `full`; see the mint below.
+  appRole: external_exports.enum(APP_ROLES).optional()
 }).strict();
 var appUiAudience = /* @__PURE__ */ __name((slug) => {
   return `app-ui:${slug}`;
@@ -29907,7 +29957,8 @@ var forwardToApp2 = /* @__PURE__ */ __name(async (c, input2) => {
         "app.install_ord": install.ord,
         "app.install_label": install.label,
         "app.viewer_id": viewer.userId,
-        "app.viewer_access": viewer.access
+        "app.viewer_access": viewer.access,
+        "app.viewer_app_role": viewer.appRole
       }
     },
     () => {
@@ -29953,7 +30004,13 @@ var authorizeUi = /* @__PURE__ */ __name(async (c, slug, origin) => {
     appId: verdict.claims.appId,
     appVersionId: verdict.claims.appVersionId
   }) : void 0;
-  return { app: app2, install, viewer: { userId: verdict.claims.userId, access: verdict.claims.access }, writeTicket };
+  return {
+    app: app2,
+    install,
+    // The portal mints `full` as no claim, so a site worker that predates the claim still accepts the token.
+    viewer: { userId: verdict.claims.userId, access: verdict.claims.access, appRole: verdict.claims.appRole ?? "full" },
+    writeTicket
+  };
 }, "authorizeUi");
 var handleAppUi = /* @__PURE__ */ __name(async (c, slug) => {
   const host = c.env.APP_UI_HOST;

package/dist/worker-artifact/version.json

@@ -1,8 +1,8 @@
 {
   "main": {
-    "version": "0.1.5",
-    "gitSha": "7c31ca4765a91cfd5098f098208c2409638b6e24",
-    "builtAt": "2026-09-25T12:23:20.370Z",
+    "version": "0.1.6",
+    "gitSha": "802179565243bb2e4dd99f79f00a3815d4f0568c",
+    "builtAt": "2026-09-28T04:28:30.340Z",
     "compatibilityDate": "2026-06-23",
     "compatibilityFlags": [
       "nodejs_compat"
@@ -39,9 +39,9 @@
     ]
   },
   "app-runtime": {
-    "version": "0.1.3",
-    "gitSha": "5991b0352059c2c9701ccc4e3414dc93fbba3371",
-    "builtAt": "2026-09-25T12:23:22.651Z",
+    "version": "0.1.4",
+    "gitSha": "b53a595d63827d8fda4f898391c6c0986f0fd1fa",
+    "builtAt": "2026-09-28T04:28:33.821Z",
     "compatibilityDate": "2026-06-23",
     "compatibilityFlags": [
       "nodejs_compat"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blotout/qinto-cli",
-  "version": "0.1.21",
+  "version": "0.1.22",
   "type": "module",
   "description": "Qinto CLI: authenticate against the Qinto platform and operate it from the terminal or from an agent.",
   "repository": {