@construct-space/cli 1.1.8 → 1.1.9

package/dist/index.js

@@ -7362,8 +7362,8 @@ function validate2(m) {
     errors2.push("author: must be an object with a name");
   if (!m.icon)
     errors2.push("icon: must be a string");
-  if (!["company", "project", "both"].includes(m.scope))
-    errors2.push('scope: must be "company", "project", or "both"');
+  if (!["app", "project", "org", "any"].includes(m.scope))
+    errors2.push('scope: must be "app", "project", "org", or "any"');
   if (!m.pages?.length)
     errors2.push("pages: must be a non-empty array");
   if (!m.navigation?.label)
@@ -9568,6 +9568,16 @@ async function uploadSource(portalURL, token, tarballPath, m) {
   if (resp.status === 401) {
     throw new Error("authentication failed \u2014 run 'construct login' to re-authenticate");
   }
+  if (resp.status === 403) {
+    let msg = result.error || "You are not the owner of this space";
+    if (result.owner_user_id) {
+      msg += `
+  Current owner: ${result.owner_user_id}`;
+    }
+    msg += `
+  Fork to a new space_id to publish your own version.`;
+    throw new Error(msg);
+  }
   if (resp.status >= 400) {
     const msg = result.error || result.errors?.join("; ") || `server returned ${resp.status}`;
     throw new Error(msg);
@@ -10260,12 +10270,14 @@ async function graphPush() {
   const graphURL = process.env.GRAPH_URL || "https://graph.construct.space";
   const spinner = ora("Registering models...").start();
   try {
+    const userID = creds.user?.id || "";
     const resp = await fetch(`${graphURL}/api/schemas/register`, {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
         Authorization: `Bearer ${creds.token}`,
-        "X-Space-ID": m.id
+        "X-Space-ID": m.id,
+        "X-Auth-User-ID": userID
       },
       body: JSON.stringify({
         space_id: m.id,
@@ -10275,6 +10287,20 @@ async function graphPush() {
         manifest: { version: 1, models }
       })
     });
+    if (resp.status === 403) {
+      spinner.fail("Ownership check failed");
+      try {
+        const errBody = await resp.json();
+        console.error(source_default.red(`  ${errBody.error || "You are not the owner of this space"}`));
+        if (errBody.owner_user_id) {
+          console.error(source_default.dim(`  Current owner: ${errBody.owner_user_id}`));
+        }
+        console.error(source_default.dim("  Fork to a new space_id to publish your own version."));
+      } catch {
+        console.error(source_default.red(`  403: Forbidden \u2014 ownership check failed`));
+      }
+      process.exit(1);
+    }
     if (!resp.ok) {
       const body = await resp.text();
       spinner.fail("Registration failed");
@@ -10501,7 +10527,7 @@ function parseModelFields(content, fileName) {
 }
 
 // src/index.ts
-var VERSION = "1.1.8";
+var VERSION = "1.1.9";
 var program2 = new Command;
 program2.name("construct").description("Construct CLI \u2014 scaffold, build, develop, and publish spaces").version(VERSION);
 program2.command("scaffold [name]").alias("new").alias("create").description("Create a new Construct space project").option("--with-tests", "Include E2E testing boilerplate").option("--full", "Full preset: multiple pages, extra skills, widget templates").action(async (name, opts) => scaffold(name, opts));

package/dist/templates/space/full/space.manifest.json.tmpl

@@ -7,7 +7,7 @@
     "name": "Your Name"
   },
   "icon": "i-lucide-box",
-  "scope": "both",
+  "scope": "app",
   "minConstructVersion": "0.7.0",
   "navigation": {
     "label": "{{.DisplayName}}",

package/dist/templates/space/space.manifest.json.tmpl

@@ -7,7 +7,7 @@
     "name": "Your Name"
   },
   "icon": "i-lucide-box",
-  "scope": "both",
+  "scope": "app",
   "minConstructVersion": "0.7.0",
   "navigation": {
     "label": "{{.DisplayName}}",

package/dist/templates/space/widgets/2x1.vue.tmpl

@@ -1,7 +1,14 @@
 <script setup lang="ts">
 /**
  * {{.DisplayName}} Summary Widget — 2×1 compact view
+ *
+ * Widgets run inside a closed Shadow DOM sandbox.
+ * Use the injected widgetApi for theme and actions — do not access
+ * window, document, or global stores directly.
  */
+import { inject } from 'vue'
+
+const api = inject<{ theme: { mode: string; vars: Record<string, string> }; space: { id: string; name: string } }>('widgetApi')
 </script>
 
 <template>

package/dist/templates/space/widgets/4x1.vue.tmpl

@@ -1,7 +1,14 @@
 <script setup lang="ts">
 /**
  * {{.DisplayName}} Summary Widget — 4×1 wide view
+ *
+ * Widgets run inside a closed Shadow DOM sandbox.
+ * Use the injected widgetApi for theme and actions — do not access
+ * window, document, or global stores directly.
  */
+import { inject } from 'vue'
+
+const api = inject<{ theme: { mode: string; vars: Record<string, string> }; space: { id: string; name: string } }>('widgetApi')
 </script>
 
 <template>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@construct-space/cli",
-  "version": "1.1.8",
+  "version": "1.1.9",
   "description": "Construct CLI — scaffold, build, develop, and publish spaces",
   "type": "module",
   "bin": {

package/templates/space/full/space.manifest.json.tmpl

@@ -7,7 +7,7 @@
     "name": "Your Name"
   },
   "icon": "i-lucide-box",
-  "scope": "both",
+  "scope": "app",
   "minConstructVersion": "0.7.0",
   "navigation": {
     "label": "{{.DisplayName}}",

package/templates/space/space.manifest.json.tmpl

@@ -7,7 +7,7 @@
     "name": "Your Name"
   },
   "icon": "i-lucide-box",
-  "scope": "both",
+  "scope": "app",
   "minConstructVersion": "0.7.0",
   "navigation": {
     "label": "{{.DisplayName}}",

package/templates/space/widgets/2x1.vue.tmpl

@@ -1,7 +1,14 @@
 <script setup lang="ts">
 /**
  * {{.DisplayName}} Summary Widget — 2×1 compact view
+ *
+ * Widgets run inside a closed Shadow DOM sandbox.
+ * Use the injected widgetApi for theme and actions — do not access
+ * window, document, or global stores directly.
  */
+import { inject } from 'vue'
+
+const api = inject<{ theme: { mode: string; vars: Record<string, string> }; space: { id: string; name: string } }>('widgetApi')
 </script>
 
 <template>

package/templates/space/widgets/4x1.vue.tmpl

@@ -1,7 +1,14 @@
 <script setup lang="ts">
 /**
  * {{.DisplayName}} Summary Widget — 4×1 wide view
+ *
+ * Widgets run inside a closed Shadow DOM sandbox.
+ * Use the injected widgetApi for theme and actions — do not access
+ * window, document, or global stores directly.
  */
+import { inject } from 'vue'
+
+const api = inject<{ theme: { mode: string; vars: Record<string, string> }; space: { id: string; name: string } }>('widgetApi')
 </script>
 
 <template>