@dropthis/cli 0.31.0 → 0.33.1

package/dist/cli.cjs

@@ -305,6 +305,16 @@ function exitCodeFor(code) {
   if (code === "verify_timeout") return 7;
   return 1;
 }
+var EXIT_CODES = {
+  "0": "success",
+  "1": "api_error \u2014 the server returned an error (see the error envelope)",
+  "2": "invalid_usage \u2014 bad arguments, bad options, or an unknown command",
+  "3": "auth_error \u2014 missing or invalid credential; re-authenticate (dropthis login)",
+  "4": "local_input_error \u2014 a local file or path could not be read",
+  "5": "network_error \u2014 could not reach the API; safe to retry",
+  "6": "verify_pending \u2014 a domain is not verified yet; retry later (domains verify)",
+  "7": "verify_timeout \u2014 domain verification timed out while waiting (--wait)"
+};
 
 // src/program.ts
 var import_commander = require("commander");
@@ -324,7 +334,8 @@ async function resolveCredential(input) {
     ...stored.keyId ? { keyId: stored.keyId } : {},
     ...stored.keyLast4 ? { keyLast4: stored.keyLast4 } : {},
     ...stored.accountId ? { accountId: stored.accountId } : {},
-    ...stored.email ? { email: stored.email } : {}
+    ...stored.email ? { email: stored.email } : {},
+    ...stored.scopes?.length ? { scopes: stored.scopes } : {}
   };
 }
 async function requireCredential(input) {
@@ -673,14 +684,55 @@ async function runApiKeysCreate(input, deps) {
   } catch {
     return writeAuthError(deps);
   }
-  const result = await deps.client.apiKeys.create({ label: input.label });
+  const keyType = input.type ?? "delegated";
+  if (input.workspace && keyType !== "service") {
+    return writeError(
+      deps,
+      "invalid_usage",
+      "--workspace is only valid with --service (it pins a CI service key to one workspace). A delegated login key is account-scoped and switchable \u2014 use `dropthis workspace use <slug>` to change its active workspace."
+    );
+  }
+  if (input.allowedWorkspaces?.length && keyType === "service") {
+    return writeError(
+      deps,
+      "invalid_usage",
+      "--allowed-workspace is only valid for delegated keys; do not combine it with --service."
+    );
+  }
+  if (keyType === "service" && !input.workspace) {
+    return writeError(
+      deps,
+      "invalid_usage",
+      "Service keys must be pinned to a workspace.",
+      "Run: dropthis workspace list to see slugs, then: dropthis api-keys create --service --workspace <slug>"
+    );
+  }
+  const label = input.label ?? (keyType === "service" ? `Service key${input.workspace ? ` (${input.workspace})` : ""}` : "CLI key");
+  const createInput = {
+    label,
+    type: keyType
+  };
+  if (keyType === "service" && input.workspace) {
+    createInput.workspace = input.workspace;
+  }
+  if (input.allowedWorkspaces?.length) {
+    createInput.allowedWorkspaces = input.allowedWorkspaces;
+  }
+  const result = await deps.client.apiKeys.create(createInput);
   if (result.error) return writeApiError(deps, result.error);
   const data = result.data;
   const pairs = [];
   if (data.id) pairs.push(["ID", String(data.id)]);
   if (data.key) pairs.push(["Key", String(data.key)]);
   if (data.keyLast4) pairs.push(["Last 4", String(data.keyLast4)]);
+  if (data.label) pairs.push(["Label", String(data.label)]);
   writeKv(deps, pairs, { ok: true, api_key: result.data });
+  if (deps.outputMode === "human") {
+    deps.stderr(
+      `${hint("Store this key now \u2014 it will not be shown again.")}
+`
+    );
+  }
   return { exitCode: 0 };
 }
 async function runApiKeysList(_input, deps) {
@@ -845,7 +897,10 @@ var COMMAND_ANNOTATIONS = {
   },
   "api-keys create": {
     auth: "required",
-    examples: ["dropthis api-keys create --label CI --json"]
+    examples: [
+      "dropthis api-keys create --label CI --json",
+      "dropthis api-keys create --service --workspace acme --json"
+    ]
   },
   "api-keys list": {
     auth: "required",
@@ -870,17 +925,56 @@ var COMMAND_ANNOTATIONS = {
       "dropthis workspace use ws_team123"
     ]
   },
-  keys: {
+  "workspace create": {
+    auth: "required",
+    examples: ['dropthis workspace create "Acme" --slug acme --json']
+  },
+  "workspace rename": {
+    auth: "required",
+    examples: ['dropthis workspace rename ws_team123 --name "Acme Inc" --json']
+  },
+  "workspace delete": {
     auth: "required",
-    examples: ["dropthis keys create --service --workspace acme --json"]
+    examples: ["dropthis workspace delete ws_team123 --yes --json"]
   },
-  "keys create": {
+  members: {
+    auth: "required",
+    examples: ["dropthis members list ws_team123 --json"]
+  },
+  "members list": {
+    auth: "required",
+    examples: ["dropthis members list ws_team123 --json"]
+  },
+  "members invite": {
     auth: "required",
     examples: [
-      "dropthis keys create --json",
-      "dropthis keys create --service --workspace acme --json"
+      "dropthis members invite ws_team123 --email teammate@acme.com --role member --json"
     ]
   },
+  "members role": {
+    auth: "required",
+    examples: ["dropthis members role ws_team123 acc_123 --role admin --json"]
+  },
+  "members remove": {
+    auth: "required",
+    examples: ["dropthis members remove ws_team123 acc_123 --yes --json"]
+  },
+  invitations: {
+    auth: "required",
+    examples: ["dropthis invitations --json"]
+  },
+  "invitations list": {
+    auth: "required",
+    examples: ["dropthis invitations list --json"]
+  },
+  "invitations accept": {
+    auth: "required",
+    examples: ["dropthis invitations accept --token inv_tok_abc --json"]
+  },
+  "invitations accept-by-id": {
+    auth: "required",
+    examples: ["dropthis invitations accept-by-id inv_123 --json"]
+  },
   login: {
     examples: [
       "dropthis login",
@@ -908,7 +1002,9 @@ var COMMAND_ANNOTATIONS = {
     auth: "required",
     examples: ["dropthis account delete --yes --json"]
   },
-  doctor: { examples: ["dropthis doctor --json"] },
+  doctor: {
+    examples: ["dropthis doctor --json", "dropthis doctor --online --json"]
+  },
   upgrade: { examples: ["dropthis upgrade", "dropthis upgrade --json"] },
   commands: { examples: ["dropthis commands --json"] }
 };
@@ -935,6 +1031,12 @@ function toEntry(cmd, path) {
 function buildCatalog(program) {
   return program.commands.map((cmd) => toEntry(cmd, []));
 }
+function buildGlobalOptions(program) {
+  return program.options.map((o) => ({
+    flags: o.flags,
+    description: o.description
+  }));
+}
 
 // src/commands/commands.ts
 async function runCommands(_input, deps) {
@@ -942,7 +1044,9 @@ async function runCommands(_input, deps) {
     `${JSON.stringify({
       ok: true,
       output: "JSON by default in CI, pipes, non-TTY, --json, or --quiet.",
-      commands: buildCatalog(deps.program)
+      commands: buildCatalog(deps.program),
+      global_options: buildGlobalOptions(deps.program),
+      exit_codes: EXIT_CODES
     })}
 `
   );
@@ -1032,10 +1136,76 @@ function spreadData(data) {
 }
 
 // src/version.ts
-var CLI_VERSION = true ? "0.31.0" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.33.1" : "0.0.0-dev";
 
 // src/commands/doctor.ts
-async function runDoctor(_input, deps) {
+async function onlineChecks(deps, hasCredential) {
+  if (!hasCredential) {
+    return {
+      checks: [
+        {
+          name: "auth",
+          status: "fail",
+          detail: "No credential found \u2014 run `dropthis login` or set DROPTHIS_API_KEY."
+        }
+      ],
+      exitCode: exitCodeFor("auth_error")
+    };
+  }
+  const account = await deps.client.account.get();
+  if (account.error) {
+    const code = cliErrorCodeFor(account.error);
+    const isAuth = code === "auth_error";
+    return {
+      checks: [
+        {
+          name: "api_reachable",
+          status: isAuth ? "ok" : "fail",
+          detail: isAuth ? "reached the API" : `could not reach the API: ${account.error.message}`
+        },
+        {
+          name: "auth",
+          status: isAuth ? "fail" : "warn",
+          detail: isAuth ? "credential rejected \u2014 re-authenticate with `dropthis login`" : account.error.message
+        }
+      ],
+      exitCode: exitCodeFor(code)
+    };
+  }
+  const data = account.data;
+  const checks = [
+    { name: "api_reachable", status: "ok", detail: "reached the API" },
+    { name: "auth", status: "ok", detail: "credential accepted" }
+  ];
+  const ws = data?.workspace;
+  checks.push(
+    ws?.name ? {
+      name: "workspace",
+      status: "ok",
+      detail: `active: ${String(ws.name)} (${String(ws.kind)})`
+    } : {
+      name: "workspace",
+      status: "warn",
+      detail: "no active workspace resolved \u2014 pass --workspace or run `dropthis workspace use`"
+    }
+  );
+  if (data?.plan) {
+    checks.push({ name: "plan", status: "ok", detail: String(data.plan) });
+  }
+  const domains = await deps.client.domains.list();
+  if (!domains.error) {
+    const list = domains.data?.domains ?? [];
+    const live = list.filter((d) => d.status === "live").length;
+    const pending = list.length - live;
+    checks.push({
+      name: "domains",
+      status: pending > 0 ? "warn" : "ok",
+      detail: `${list.length} connected, ${live} live${pending > 0 ? `, ${pending} pending verification` : ""}`
+    });
+  }
+  return { checks, exitCode: 0 };
+}
+async function runDoctor(input, deps) {
   const stored = await deps.store.read();
   const credential = await resolveCredential({
     env: deps.env,
@@ -1048,13 +1218,30 @@ async function runDoctor(_input, deps) {
     ["Auth", authSource],
     ["Storage", storageBackend]
   ];
+  if (!input.online) {
+    writeKv(deps, pairs, {
+      ok: true,
+      version: CLI_VERSION,
+      auth: { source: authSource },
+      storage: { backend: storageBackend }
+    });
+    return { exitCode: 0 };
+  }
+  const { checks, exitCode } = await onlineChecks(
+    deps,
+    credential !== void 0
+  );
+  for (const c of checks) {
+    pairs.push([c.name, `${c.status} \u2014 ${c.detail}`]);
+  }
   writeKv(deps, pairs, {
-    ok: true,
+    ok: exitCode === 0,
     version: CLI_VERSION,
     auth: { source: authSource },
-    storage: { backend: storageBackend }
+    storage: { backend: storageBackend },
+    checks
   });
-  return { exitCode: 0 };
+  return { exitCode };
 }
 
 // src/commands/domains.ts
@@ -1635,8 +1822,8 @@ async function runDropsDelete(target, input, deps) {
   return { exitCode: 0 };
 }
 
-// src/commands/keys.ts
-async function runKeysCreate(input, deps) {
+// src/commands/invitations.ts
+async function runInvitationsList(_input, deps) {
   try {
     await requireCredential({
       ...deps.apiKey ? { apiKey: deps.apiKey } : {},
@@ -1646,45 +1833,67 @@ async function runKeysCreate(input, deps) {
   } catch {
     return writeAuthError(deps);
   }
-  const keyType = input.type ?? "delegated";
-  if (input.workspace && keyType !== "service") {
-    return writeError(
-      deps,
-      "invalid_usage",
-      "--workspace is only valid with --service (it pins a CI service key to one workspace). A delegated login key is account-scoped and switchable \u2014 use `dropthis workspace use <slug>` to change its active workspace."
-    );
-  }
-  if (keyType === "service" && !input.workspace) {
-    return writeError(
-      deps,
-      "invalid_usage",
-      "Service keys must be pinned to a workspace.",
-      "Run: dropthis workspace list to see slugs, then: dropthis keys create --service --workspace <slug>"
-    );
+  const result = await deps.client.invitations.list();
+  if (result.error) return writeApiError(deps, result.error);
+  const raw = unwrapListData(result.data, "invitations");
+  const items = Array.isArray(raw) ? raw : [];
+  if (deps.outputMode === "human") {
+    if (items.length === 0) {
+      writeEmpty(deps, "No pending invitations.", {
+        ok: true,
+        invitations: []
+      });
+    } else {
+      for (const inv of items) {
+        deps.stdout(`${inv.email}  ${inv.role}  ${inv.status}  ${inv.id}
+`);
+      }
+    }
+  } else {
+    writeJson(deps, { ok: true, invitations: items });
   }
-  const label = input.label ?? (keyType === "service" ? `Service key${input.workspace ? ` (${input.workspace})` : ""}` : "CLI key");
-  const createInput = {
-    label,
-    type: keyType
-  };
-  if (keyType === "service" && input.workspace) {
-    createInput.workspace = input.workspace;
+  return { exitCode: 0 };
+}
+async function runInvitationsAccept(input, deps) {
+  try {
+    await requireCredential({
+      ...deps.apiKey ? { apiKey: deps.apiKey } : {},
+      env: deps.env,
+      store: deps.store
+    });
+  } catch {
+    return writeAuthError(deps);
   }
-  const result = await deps.client.apiKeys.create(createInput);
+  const result = await deps.client.invitations.accept({ token: input.token });
   if (result.error) return writeApiError(deps, result.error);
-  const data = result.data;
-  const pairs = [];
-  if (data.id) pairs.push(["ID", String(data.id)]);
-  if (data.key) pairs.push(["Key", String(data.key)]);
-  if (data.keyLast4) pairs.push(["Last 4", String(data.keyLast4)]);
-  if (data.label) pairs.push(["Label", String(data.label)]);
-  writeKv(deps, pairs, { ok: true, api_key: result.data });
-  if (deps.outputMode === "human") {
-    deps.stderr(
-      `${hint("Store this key now \u2014 it will not be shown again.")}
-`
-    );
+  const ws = result.data;
+  writeHumanOrJson(
+    deps,
+    success(`Joined ${ws.name} (${ws.slug}) \u2014 now your active workspace.`),
+    { ok: true, workspace: ws }
+  );
+  return { exitCode: 0 };
+}
+async function runInvitationsAcceptById(input, deps) {
+  try {
+    await requireCredential({
+      ...deps.apiKey ? { apiKey: deps.apiKey } : {},
+      env: deps.env,
+      store: deps.store
+    });
+  } catch {
+    return writeAuthError(deps);
   }
+  const result = await deps.client.invitations.acceptById({
+    invitationId: input.invitationId
+  });
+  if (result.error) return writeApiError(deps, result.error);
+  const ws = result.data;
+  writeHumanOrJson(
+    deps,
+    success(`Joined ${ws.name} (${ws.slug}) \u2014 now your active workspace.`),
+    { ok: true, workspace: ws }
+  );
   return { exitCode: 0 };
 }
 
@@ -1747,7 +1956,8 @@ async function runLoginInteractive(deps) {
   const authedClient = deps.createClient(session.data.token);
   const apiKey = await authedClient.apiKeys.create({
     label: "CLI",
-    type: "delegated"
+    type: "delegated",
+    ...deps.scope ? { scopes: [deps.scope] } : {}
   });
   if (apiKey.error) {
     prompts4.cancel(apiKey.error.message);
@@ -1759,6 +1969,7 @@ async function runLoginInteractive(deps) {
     keyLast4: apiKey.data.keyLast4,
     accountId: apiKey.data.accountId ?? session.data.accountId,
     email,
+    ...apiKey.data.scopes ? { scopes: apiKey.data.scopes } : {},
     storage: "secure"
   });
   prompts4.outro("Logged in successfully.");
@@ -1793,7 +2004,10 @@ async function runLoginVerify(input, deps) {
   const authedClient = deps.createClient(session.data.token);
   const apiKey = await authedClient.apiKeys.create({
     label: "CLI",
-    type: "delegated"
+    type: "delegated",
+    // A single bundle name (e.g. "team") requests a capability-scoped key; the
+    // server returns the resolved scope list on the mint response.
+    ...input.scope ? { scopes: [input.scope] } : {}
   });
   if (apiKey.error) {
     return writeApiError(deps, apiKey.error);
@@ -1804,6 +2018,7 @@ async function runLoginVerify(input, deps) {
     keyLast4: apiKey.data.keyLast4,
     accountId: apiKey.data.accountId ?? session.data.accountId,
     email: input.email,
+    ...apiKey.data.scopes ? { scopes: apiKey.data.scopes } : {},
     storage: "secure"
   });
   writeHumanOrJson(deps, success(`Logged in as ${input.email}.`), {
@@ -1832,6 +2047,115 @@ async function runLogout(input, deps) {
   return { exitCode: 0 };
 }
 
+// src/commands/members.ts
+var prompts5 = __toESM(require("@clack/prompts"), 1);
+async function runMembersList(workspaceId, _input, deps) {
+  try {
+    await requireCredential({
+      ...deps.apiKey ? { apiKey: deps.apiKey } : {},
+      env: deps.env,
+      store: deps.store
+    });
+  } catch {
+    return writeAuthError(deps);
+  }
+  const result = await deps.client.members.list(workspaceId);
+  if (result.error) return writeApiError(deps, result.error);
+  const raw = unwrapListData(result.data, "members");
+  const items = Array.isArray(raw) ? raw : [];
+  if (deps.outputMode === "human") {
+    if (items.length === 0) {
+      writeEmpty(deps, "No members.", { ok: true, members: [] });
+    } else {
+      for (const m of items) {
+        const who = m.email || m.accountId;
+        const you = m.isYou ? "(you)" : "";
+        deps.stdout(`${who}  ${m.role}  ${you}
+`);
+      }
+    }
+  } else {
+    writeJson(deps, { ok: true, members: items });
+  }
+  return { exitCode: 0 };
+}
+async function runMembersInvite(workspaceId, input, deps) {
+  try {
+    await requireCredential({
+      ...deps.apiKey ? { apiKey: deps.apiKey } : {},
+      env: deps.env,
+      store: deps.store
+    });
+  } catch {
+    return writeAuthError(deps);
+  }
+  const role = input.role ?? "member";
+  const result = await deps.client.members.invite(workspaceId, {
+    email: input.email,
+    role
+  });
+  if (result.error) return writeApiError(deps, result.error);
+  writeHumanOrJson(deps, success(`Invited ${input.email} as ${role}`), {
+    ok: true,
+    invitation: result.data
+  });
+  return { exitCode: 0 };
+}
+async function runMembersRole(workspaceId, accountId, input, deps) {
+  try {
+    await requireCredential({
+      ...deps.apiKey ? { apiKey: deps.apiKey } : {},
+      env: deps.env,
+      store: deps.store
+    });
+  } catch {
+    return writeAuthError(deps);
+  }
+  const result = await deps.client.members.updateRole(workspaceId, accountId, {
+    role: input.role
+  });
+  if (result.error) return writeApiError(deps, result.error);
+  writeHumanOrJson(deps, success(`Set ${accountId} to ${input.role}`), {
+    ok: true,
+    member: result.data
+  });
+  return { exitCode: 0 };
+}
+async function runMembersRemove(workspaceId, accountId, input, deps) {
+  if (!input.yes && input.interactive === false) {
+    return writeError(
+      deps,
+      "invalid_usage",
+      "Pass --yes to remove in non-interactive mode."
+    );
+  }
+  if (!input.yes && input.interactive !== false) {
+    const confirmed = await prompts5.confirm({
+      message: `Remove ${accountId} from workspace ${workspaceId}?`
+    });
+    if (prompts5.isCancel(confirmed) || !confirmed) {
+      return { exitCode: 0 };
+    }
+  }
+  try {
+    await requireCredential({
+      ...deps.apiKey ? { apiKey: deps.apiKey } : {},
+      env: deps.env,
+      store: deps.store
+    });
+  } catch {
+    return writeAuthError(deps);
+  }
+  const result = await deps.client.members.remove(workspaceId, accountId);
+  if (result?.error) return writeApiError(deps, result.error);
+  writeHumanOrJson(deps, success(`Removed ${accountId}`), {
+    ok: true,
+    removed: true,
+    account_id: accountId
+  });
+  return { exitCode: 0 };
+}
+
 // src/drop-operations.ts
 var import_node_crypto = require("crypto");
 var import_promises = require("fs/promises");
@@ -1968,6 +2292,9 @@ async function parseDropOptions(raw) {
   if (raw.noindex && raw.index) {
     throw new Error("Use either --noindex or --index, not both.");
   }
+  if (raw.expiresAt && raw.noExpires) {
+    throw new Error("Use either --expires-at or --no-expires, not both.");
+  }
   if (raw.shared && raw.domain) {
     throw new Error("Use either --shared or --domain <hostname>, not both.");
   }
@@ -1996,6 +2323,7 @@ async function parseDropOptions(raw) {
     ...raw.noindex ? { noindex: true } : {},
     ...raw.index ? { noindex: false } : {},
     ...raw.expiresAt ? { expiresAt: raw.expiresAt } : {},
+    ...raw.noExpires ? { expiresAt: null } : {},
     ...metadata ? { metadata } : {},
     ...raw.entry ? { entry: raw.entry } : {},
     ...raw.contentType ? { contentType: raw.contentType } : {},
@@ -2197,7 +2525,9 @@ async function runPull(target, input, deps) {
   const dropId = resolved.dropId;
   const defaultDirName = resolved.slug || resolved.dropId;
   const spin = shouldSpin(deps.outputMode) ? createSpinner("Pulling content\u2026", deps.stderr) : void 0;
-  const manifestResult = await deps.client.drops.getContent(dropId);
+  const deploymentId = input.deployment;
+  const manifestOptions = deploymentId ? { deploymentId } : void 0;
+  const manifestResult = manifestOptions ? await deps.client.drops.getContent(dropId, manifestOptions) : await deps.client.drops.getContent(dropId);
   if (manifestResult.error) {
     spin?.fail();
     return writeApiError(deps, manifestResult.error);
@@ -2221,7 +2551,10 @@ async function runPull(target, input, deps) {
   try {
     await (0, import_promises3.mkdir)(outDir, { recursive: true });
     for (const { path, dest } of destinations) {
-      const fileResult = await deps.client.drops.getContent(dropId, { path });
+      const fileResult = await deps.client.drops.getContent(dropId, {
+        path,
+        ...deploymentId ? { deploymentId } : {}
+      });
       if (fileResult.error) {
         spin?.fail();
         return writeApiError(deps, {
@@ -2408,9 +2741,9 @@ async function handleDryRun(dropId, input, raw, deps) {
 }
 
 // src/commands/update-settings.ts
-var prompts5 = __toESM(require("@clack/prompts"), 1);
+var prompts6 = __toESM(require("@clack/prompts"), 1);
 var NO_SETTINGS_MESSAGE = "Nothing to update. Provide at least one settings option.";
-var NO_SETTINGS_NEXT_ACTION = "Run dropthis update-settings --help, or retry with one of: --title, --visibility, --password, --no-password, --noindex, --index, --expires-at, --metadata, or --metadata-file. To replace the content at the URL instead, use dropthis update-content <dropId> ./dist.";
+var NO_SETTINGS_NEXT_ACTION = "Run dropthis update-settings --help, or retry with one of: --title, --visibility, --password, --no-password, --noindex, --index, --expires-at, --no-expires, --domain, --shared, --slug, --metadata, or --metadata-file. To replace the content at the URL instead, use dropthis update-content <dropId> ./dist.";
 async function runUpdateSettings(target, raw, deps) {
   const apiKey = raw.apiKey ?? deps.apiKey;
   try {
@@ -2440,7 +2773,7 @@ async function runUpdateSettings(target, raw, deps) {
       if (shouldPrompt(deps)) {
         const prompted = await promptForSettings(
           dropId,
-          deps.prompts ?? prompts5
+          deps.prompts ?? prompts6
         );
         if (!prompted) return { exitCode: 0 };
         parsed = { ...parsed, ...prompted };
@@ -2629,8 +2962,10 @@ async function handleDryRun2(dropId, raw, deps) {
     if (options.visibility) fields.visibility = options.visibility;
     if (options.password !== void 0) fields.password = options.password;
     if (options.noindex !== void 0) fields.noindex = options.noindex;
-    if (options.expiresAt) fields.expires_at = options.expiresAt;
+    if (options.expiresAt !== void 0) fields.expires_at = options.expiresAt;
     if (options.metadata) fields.metadata = options.metadata;
+    if (options.domain) fields.domain = options.domain;
+    if (options.slug) fields.slug = options.slug;
     deps.stdout(
       `${JSON.stringify({ ok: true, dryRun: true, kind: "settings_update", target: dropId, fields }, null, 2)}
 `
@@ -2778,6 +3113,8 @@ async function runWhoami(_input, deps) {
   pairs.push(["Source", credential.source]);
   if (credential.accountId ?? account.id)
     pairs.push(["Account", String(credential.accountId ?? account.id)]);
+  if (credential.scopes?.length)
+    pairs.push(["Scopes", credential.scopes.join(", ")]);
   const jsonEnvelope = {
     ok: true,
     authenticated: true,
@@ -2786,13 +3123,15 @@ async function runWhoami(_input, deps) {
     ...credential.keyId ? { key_id: credential.keyId } : {},
     ...last4 ? { key_last4: last4 } : {},
     ...credential.accountId ?? account.id ? { account_id: String(credential.accountId ?? account.id) } : {},
-    ...credential.email ?? account.email ? { email: String(credential.email ?? account.email) } : {}
+    ...credential.email ?? account.email ? { email: String(credential.email ?? account.email) } : {},
+    ...credential.scopes?.length ? { scopes: credential.scopes } : {}
   };
   writeKv(deps, pairs, jsonEnvelope);
   return { exitCode: 0 };
 }
 
 // src/commands/workspace.ts
+var prompts7 = __toESM(require("@clack/prompts"), 1);
 async function runWorkspaceList(_input, deps) {
   try {
     await requireCredential({
@@ -2845,6 +3184,104 @@ async function runWorkspaceUse(slugOrId, _input, deps) {
   );
   return { exitCode: 0 };
 }
+async function runWorkspaceCreate(input, deps) {
+  try {
+    await requireCredential({
+      ...deps.apiKey ? { apiKey: deps.apiKey } : {},
+      env: deps.env,
+      store: deps.store
+    });
+  } catch {
+    return writeAuthError(deps);
+  }
+  const createInput = { name: input.name };
+  if (input.slug !== void 0) createInput.slug = input.slug;
+  const result = await deps.client.workspaces.create(createInput);
+  if (result.error) return writeApiError(deps, result.error);
+  const ws = result.data;
+  writeHumanOrJson(
+    deps,
+    success(`Created workspace: ${ws.name} (${ws.slug})`),
+    {
+      ok: true,
+      workspace: ws
+    }
+  );
+  if (ws.creatorCanReach === false && deps.outputMode === "human") {
+    deps.stderr(
+      `${hint("This key can't reach the new workspace \u2014 re-authenticate (dropthis login) to pick it up.")}
+`
+    );
+  }
+  return { exitCode: 0 };
+}
+async function runWorkspaceRename(workspaceId, input, deps) {
+  if (input.name === void 0 && input.slug === void 0) {
+    return writeError(
+      deps,
+      "invalid_usage",
+      "Provide --name and/or --slug to rename."
+    );
+  }
+  try {
+    await requireCredential({
+      ...deps.apiKey ? { apiKey: deps.apiKey } : {},
+      env: deps.env,
+      store: deps.store
+    });
+  } catch {
+    return writeAuthError(deps);
+  }
+  const renameInput = {};
+  if (input.name !== void 0) renameInput.name = input.name;
+  if (input.slug !== void 0) renameInput.slug = input.slug;
+  const result = await deps.client.workspaces.rename(workspaceId, renameInput);
+  if (result.error) return writeApiError(deps, result.error);
+  const ws = result.data;
+  writeHumanOrJson(
+    deps,
+    success(`Renamed workspace: ${ws.name} (${ws.slug})`),
+    {
+      ok: true,
+      workspace: ws
+    }
+  );
+  return { exitCode: 0 };
+}
+async function runWorkspaceDelete(workspaceId, input, deps) {
+  if (!input.yes && input.interactive === false) {
+    return writeError(
+      deps,
+      "invalid_usage",
+      "Pass --yes to delete in non-interactive mode."
+    );
+  }
+  if (!input.yes && input.interactive !== false) {
+    const confirmed = await prompts7.confirm({
+      message: `Delete workspace ${workspaceId}?`
+    });
+    if (prompts7.isCancel(confirmed) || !confirmed) {
+      return { exitCode: 0 };
+    }
+  }
+  try {
+    await requireCredential({
+      ...deps.apiKey ? { apiKey: deps.apiKey } : {},
+      env: deps.env,
+      store: deps.store
+    });
+  } catch {
+    return writeAuthError(deps);
+  }
+  const result = await deps.client.workspaces.delete(workspaceId);
+  if (result?.error) return writeApiError(deps, result.error);
+  writeHumanOrJson(deps, success(`Deleted workspace ${workspaceId}`), {
+    ok: true,
+    deleted: true,
+    id: workspaceId
+  });
+  return { exitCode: 0 };
+}
 
 // src/context.ts
 var import_node2 = require("@dropthis/node");
@@ -3170,7 +3607,8 @@ ${import_picocolors6.default.bold("Canonical vs raw URLs:")}`,
         return;
       }
     }
-    if (deps.outputMode === "human" && deps.interactive && inputs.length === 1 && typeof publishInput === "string" && isBareWordToken(publishInput) && !await pathExists(publishInput)) {
+    const publishWasExplicit = (program.rawArgs ?? []).includes("publish");
+    if (!publishWasExplicit && inputs.length === 1 && typeof publishInput === "string" && isBareWordToken(publishInput) && !await pathExists(publishInput)) {
       const suggestion = suggestCommand(
         publishInput,
         program.commands.map((c) => c.name())
@@ -3184,13 +3622,15 @@ ${import_picocolors6.default.bold("Canonical vs raw URLs:")}`,
         ).exitCode;
         return;
       }
-      const prompts6 = await import("@clack/prompts");
-      const confirmed = await prompts6.confirm({
-        message: `Publish '${publishInput}' as inline text?`,
-        initialValue: false
-      });
-      if (prompts6.isCancel(confirmed) || !confirmed) {
-        return;
+      if (deps.outputMode === "human" && deps.interactive) {
+        const prompts8 = await import("@clack/prompts");
+        const confirmed = await prompts8.confirm({
+          message: `Publish '${publishInput}' as inline text?`,
+          initialValue: false
+        });
+        if (prompts8.isCancel(confirmed) || !confirmed) {
+          return;
+        }
       }
     }
     let dropOpts;
@@ -3281,10 +3721,19 @@ ${import_picocolors6.default.bold("Canonical vs raw URLs:")}`,
   );
   program.command("update-settings <dropId>").description(
     "Change a drop's title, visibility, password, expiry, or metadata (pass the full drop_\u2026 id, not the slug).\nContent stays unchanged \u2014 use update-content to replace the files at the URL."
-  ).option("--title <title>", "Change title").option("--visibility <v>", "Set to public or unlisted").option("--password <password>", "Require password to view").option("--no-password", "Remove password protection").option("--noindex", "Prevent search-engine indexing").option("--index", "Allow search-engine indexing").option("--expires-at <datetime>", "Auto-delete after this ISO 8601 date").option(
+  ).option("--title <title>", "Change title").option("--visibility <v>", "Set to public or unlisted").option("--password <password>", "Require password to view").option("--no-password", "Remove password protection").option("--noindex", "Prevent search-engine indexing").option("--index", "Allow search-engine indexing").option("--expires-at <datetime>", "Auto-delete after this ISO 8601 date").option("--no-expires", "Clear the auto-delete expiry").option(
     "--metadata <json>",
     `Attach JSON key-value pairs, e.g. '{"source":"ci"}'`
   ).option("--metadata-file <path>", "Read metadata JSON from a file").option(
+    "--domain <hostname>",
+    "Move this drop to a connected custom domain (must be live \u2014 see: dropthis domains list)."
+  ).option(
+    "--shared",
+    "Unmount this drop back to the shared dropthis pool. Cannot combine with --domain."
+  ).option(
+    "--slug <vanity-slug>",
+    "Rename the vanity slug on a path-mode custom domain (1\u201363 lowercase letters/digits/hyphens). 409 on conflict \u2014 does not auto-suffix."
+  ).option(
     "--if-revision <n>",
     "Fail if current revision doesn't match (optimistic lock)",
     parseInteger
@@ -3316,7 +3765,7 @@ ${import_picocolors6.default.bold("Canonical vs raw URLs:")}`,
   );
   program.command("pull <target>").description(
     "Download a drop's files into a local directory (accepts the drop_\u2026 id, the drop URL, or its slug).\nFetches the current deployment's file manifest and writes every file. Pull, edit, then update-content to ship the changes back to the same URL \u2014 also the rollback path."
-  ).option("-o, --output <dir>", "Output directory (default: ./<slug-or-id>)").option("--json", "Force JSON output").addHelpText(
+  ).option("-o, --output <dir>", "Output directory (default: ./<slug-or-id>)").option("--deployment <deploymentId>", "Download a specific deployment").option("--json", "Force JSON output").addHelpText(
     "after",
     examplesBlock([
       "dropthis pull drop_abc123 -o ./site        # download the drop's files",
@@ -3452,7 +3901,7 @@ ${import_picocolors6.default.bold("Canonical vs raw URLs:")}`,
     process.exitCode = result.exitCode;
   });
   domains.command("verify <hostname>").description(
-    "Trigger a DNS verification check. With --wait, polls until live or failed.\nUse after adding the DNS records from: dropthis domains connect\n\nExit codes: 0=live, 1=failed, 6=still pending (retry). Use --wait to poll automatically."
+    "Trigger a DNS verification check. With --wait, polls until live or failed.\nUse after adding the DNS records from: dropthis domains connect\n\nExit codes (one-shot): 0=live, 1=failed, 6=still pending (retry). With --wait: 0=live, 1=failed, 7=timed out."
   ).option("--wait", "Poll until live (or failed/timeout)").option(
     "--timeout <secs>",
     "Max seconds to wait (default: 300)",
@@ -3508,11 +3957,35 @@ ${import_picocolors6.default.bold("Canonical vs raw URLs:")}`,
     }
   );
   const apiKeys = program.command("api-keys").description("Manage API keys");
-  apiKeys.command("create").description("Create an API key").option("--label <label>", "API key label", "CLI").option("--json", "Force JSON output").action(async (commandOptions) => {
-    const deps = await commandDeps(program, options, store, commandOptions);
-    const result = await runApiKeysCreate(commandOptions, deps);
-    process.exitCode = result.exitCode;
-  });
+  apiKeys.command("create").description(
+    "Create an API key. Without --service, mints a delegated account-scoped key (default for login). With --service --workspace <ws>, mints a CI key pinned to that workspace."
+  ).option("--label <label>", "API key label").option(
+    "--service",
+    "Mint a pinned service key for CI/automation (requires --workspace to pin it)"
+  ).option(
+    "--workspace <slugOrId>",
+    "Pin this service key to the given workspace slug or id (only valid with --service)"
+  ).option(
+    "--allowed-workspace <slugOrId>",
+    "Allow a delegated key to access the given workspace slug or id",
+    collect,
+    []
+  ).option("--json", "Force JSON output").action(
+    async (commandOptions) => {
+      const deps = await commandDeps(program, options, store, commandOptions);
+      const result = await runApiKeysCreate(
+        {
+          ...commandOptions.label !== void 0 ? { label: commandOptions.label } : {},
+          type: commandOptions.service ? "service" : "delegated",
+          ...commandOptions.workspace !== void 0 ? { workspace: commandOptions.workspace } : {},
+          ...commandOptions.allowedWorkspace?.length ? { allowedWorkspaces: commandOptions.allowedWorkspace } : {},
+          ...commandOptions.json !== void 0 ? { json: commandOptions.json } : {}
+        },
+        deps
+      );
+      process.exitCode = result.exitCode;
+    }
+  );
   apiKeys.command("list").description("List API keys").option("--json", "Force JSON output").action(async (commandOptions) => {
     const deps = await commandDeps(program, options, store, commandOptions);
     const result = await runApiKeysList(commandOptions, deps);
@@ -3549,25 +4022,121 @@ ${import_picocolors6.default.bold("Canonical vs raw URLs:")}`,
     const result = await runWorkspaceUse(slugOrId, commandOptions, deps);
     process.exitCode = result.exitCode;
   });
-  const keys = program.command("keys").description(
-    "Mint API keys (delegated login keys or pinned CI service keys)"
+  workspace.command("create <name>").description("Create a new team workspace").option("--slug <slug>", "Vanity slug for the workspace").option("--json", "Force JSON output").action(
+    async (name, commandOptions) => {
+      const deps = await commandDeps(program, options, store, commandOptions);
+      const result = await runWorkspaceCreate(
+        {
+          name,
+          ...commandOptions.slug !== void 0 ? { slug: commandOptions.slug } : {},
+          ...commandOptions.json !== void 0 ? { json: commandOptions.json } : {}
+        },
+        deps
+      );
+      process.exitCode = result.exitCode;
+    }
   );
-  keys.command("create").description(
-    "Create an API key. Without --service, mints a delegated account-scoped key (default for login). With --service --workspace <ws>, mints a CI key pinned to that workspace."
-  ).option("--label <label>", "Key label").option(
-    "--service",
-    "Mint a pinned service key for CI/automation (requires --workspace to pin it)"
-  ).option(
-    "--workspace <slugOrId>",
-    "Pin this service key to the given workspace slug or id (only valid with --service)"
-  ).option("--json", "Force JSON output").action(
-    async (commandOptions) => {
+  workspace.command("rename <workspaceId>").description("Rename a workspace or change its vanity slug").option("--name <name>", "New workspace name").option("--slug <slug>", "New vanity slug").option("--json", "Force JSON output").action(
+    async (workspaceId, commandOptions) => {
       const deps = await commandDeps(program, options, store, commandOptions);
-      const result = await runKeysCreate(
+      const result = await runWorkspaceRename(
+        workspaceId,
         {
-          ...commandOptions.label !== void 0 ? { label: commandOptions.label } : {},
-          type: commandOptions.service ? "service" : "delegated",
-          ...commandOptions.workspace !== void 0 ? { workspace: commandOptions.workspace } : {},
+          ...commandOptions.name !== void 0 ? { name: commandOptions.name } : {},
+          ...commandOptions.slug !== void 0 ? { slug: commandOptions.slug } : {},
+          ...commandOptions.json !== void 0 ? { json: commandOptions.json } : {}
+        },
+        deps
+      );
+      process.exitCode = result.exitCode;
+    }
+  );
+  workspace.command("delete <workspaceId>").description("Delete a workspace").option("--yes", "Confirm deletion").option("--json", "Force JSON output").action(
+    async (workspaceId, commandOptions) => {
+      const stdinIsTTY = options.stdinIsTTY ?? process.stdin.isTTY ?? false;
+      const global = globalOptions(program, commandOptions);
+      const deps = await commandDeps(program, options, store, commandOptions);
+      const result = await runWorkspaceDelete(
+        workspaceId,
+        {
+          ...commandOptions,
+          interactive: isInteractive(stdinIsTTY, deps.env, global)
+        },
+        deps
+      );
+      process.exitCode = result.exitCode;
+    }
+  );
+  const members = program.command("members").description("Manage team members");
+  members.command("list <workspaceId>").description("List members of a workspace").option("--json", "Force JSON output").action(async (workspaceId, commandOptions) => {
+    const deps = await commandDeps(program, options, store, commandOptions);
+    const result = await runMembersList(workspaceId, commandOptions, deps);
+    process.exitCode = result.exitCode;
+  });
+  members.command("invite <workspaceId>").description("Invite someone to a workspace by email").requiredOption("--email <email>", "Email address to invite").option("--role <role>", "Role to grant (admin or member)", "member").option("--json", "Force JSON output").action(
+    async (workspaceId, commandOptions) => {
+      const deps = await commandDeps(program, options, store, commandOptions);
+      const result = await runMembersInvite(
+        workspaceId,
+        {
+          email: commandOptions.email,
+          ...commandOptions.role !== void 0 ? { role: commandOptions.role } : {},
+          ...commandOptions.json !== void 0 ? { json: commandOptions.json } : {}
+        },
+        deps
+      );
+      process.exitCode = result.exitCode;
+    }
+  );
+  members.command("role <workspaceId> <accountId>").description("Change a member's role").requiredOption("--role <role>", "New role (owner, admin, or member)").option("--json", "Force JSON output").action(
+    async (workspaceId, accountId, commandOptions) => {
+      const deps = await commandDeps(program, options, store, commandOptions);
+      const result = await runMembersRole(
+        workspaceId,
+        accountId,
+        {
+          role: commandOptions.role,
+          ...commandOptions.json !== void 0 ? { json: commandOptions.json } : {}
+        },
+        deps
+      );
+      process.exitCode = result.exitCode;
+    }
+  );
+  members.command("remove <workspaceId> <accountId>").description("Remove a member from a workspace").option("--yes", "Confirm removal").option("--json", "Force JSON output").action(
+    async (workspaceId, accountId, commandOptions) => {
+      const stdinIsTTY = options.stdinIsTTY ?? process.stdin.isTTY ?? false;
+      const global = globalOptions(program, commandOptions);
+      const deps = await commandDeps(program, options, store, commandOptions);
+      const result = await runMembersRemove(
+        workspaceId,
+        accountId,
+        {
+          ...commandOptions,
+          interactive: isInteractive(stdinIsTTY, deps.env, global)
+        },
+        deps
+      );
+      process.exitCode = result.exitCode;
+    }
+  );
+  const invitations = program.command("invitations").description("Manage your workspace invitations");
+  invitations.command("list", { isDefault: true }).description("List your pending workspace invitations").option("--json", "Force JSON output").action(async (commandOptions) => {
+    const deps = await commandDeps(program, options, store, commandOptions);
+    const result = await runInvitationsList(commandOptions, deps);
+    process.exitCode = result.exitCode;
+  });
+  invitations.command("accept").description("Accept a workspace invitation by token").requiredOption("--token <token>", "Invitation token").option("--json", "Force JSON output").action(async (commandOptions) => {
+    const deps = await commandDeps(program, options, store, commandOptions);
+    const result = await runInvitationsAccept(commandOptions, deps);
+    process.exitCode = result.exitCode;
+  });
+  invitations.command("accept-by-id <invitationId>").description("Accept a workspace invitation by its id").option("--json", "Force JSON output").action(
+    async (invitationId, commandOptions) => {
+      const deps = await commandDeps(program, options, store, commandOptions);
+      const result = await runInvitationsAcceptById(
+        {
+          invitationId,
           ...commandOptions.json !== void 0 ? { json: commandOptions.json } : {}
         },
         deps
@@ -3575,7 +4144,10 @@ ${import_picocolors6.default.bold("Canonical vs raw URLs:")}`,
       process.exitCode = result.exitCode;
     }
   );
-  program.command("login").description("Authenticate with email OTP").option("--email <email>", "Email address").option("--otp <otp>", "One-time passcode").option("--json", "Force JSON output").action(
+  program.command("login").description("Authenticate with email OTP").option("--email <email>", "Email address").option("--otp <otp>", "One-time passcode").option(
+    "--scope <scope>",
+    "Capability scope to request for the minted key (e.g. team)"
+  ).option("--json", "Force JSON output").action(
     async (commandOptions) => {
       if (!commandOptions.email || !commandOptions.otp) {
         const deps2 = await commandDeps(program, options, store, commandOptions);
@@ -3593,7 +4165,8 @@ ${import_picocolors6.default.bold("Canonical vs raw URLs:")}`,
         const context = createContext({ global: global2 });
         const result2 = await runLoginInteractive({
           ...deps2,
-          createClient: (apiKey) => context.createClient(apiKey)
+          createClient: (apiKey) => context.createClient(apiKey),
+          ...commandOptions.scope ? { scope: commandOptions.scope } : {}
         });
         process.exitCode = result2.exitCode;
         return;
@@ -3605,6 +4178,7 @@ ${import_picocolors6.default.bold("Canonical vs raw URLs:")}`,
         {
           email: commandOptions.email,
           otp: commandOptions.otp,
+          ...commandOptions.scope ? { scope: commandOptions.scope } : {},
           ...commandOptions.json !== void 0 ? { json: commandOptions.json } : {}
         },
         {
@@ -3621,7 +4195,10 @@ ${import_picocolors6.default.bold("Canonical vs raw URLs:")}`,
     const result = await runLoginRequest(commandOptions, deps);
     process.exitCode = result.exitCode;
   });
-  login?.command("verify").description("Verify email OTP and store an API key").requiredOption("--email <email>", "Email address").requiredOption("--otp <otp>", "One-time passcode").option("--json", "Force JSON output").action(
+  login?.command("verify").description("Verify email OTP and store an API key").requiredOption("--email <email>", "Email address").requiredOption("--otp <otp>", "One-time passcode").option(
+    "--scope <scope>",
+    "Capability scope to request for the minted key (e.g. team)"
+  ).option("--json", "Force JSON output").action(
     async (commandOptions) => {
       const deps = await commandDeps(program, options, store, commandOptions);
       const global = globalOptions(program, commandOptions);
@@ -3659,17 +4236,30 @@ ${import_picocolors6.default.bold("Canonical vs raw URLs:")}`,
     const result = await runAccountGet(commandOptions, deps);
     process.exitCode = result.exitCode;
   });
-  account.command("update").description("Update account display name").requiredOption("--display-name <name>", "Set the display name").option("--json", "Force JSON output").action(async (commandOptions) => {
-    const deps = await commandDeps(program, options, store, commandOptions);
-    const result = await runAccountUpdate(
-      {
-        displayName: commandOptions.displayName,
-        ...commandOptions.json !== void 0 ? { json: commandOptions.json } : {}
-      },
-      deps
-    );
-    process.exitCode = result.exitCode;
-  });
+  account.command("update").description("Update account display name").option("--display-name <name>", "Set the display name").option("--clear-display-name", "Clear the display name").option("--json", "Force JSON output").action(
+    async (commandOptions) => {
+      if (commandOptions.displayName === void 0 && !commandOptions.clearDisplayName || commandOptions.displayName !== void 0 && commandOptions.clearDisplayName) {
+        const writer = outputWriter(program, options, commandOptions);
+        process.exitCode = writeError(
+          writer,
+          "invalid_usage",
+          "Use either --display-name <name> or --clear-display-name."
+        ).exitCode;
+        return;
+      }
+      const displayName = commandOptions.clearDisplayName ? null : commandOptions.displayName;
+      if (displayName === void 0) return;
+      const deps = await commandDeps(program, options, store, commandOptions);
+      const result = await runAccountUpdate(
+        {
+          displayName,
+          ...commandOptions.json !== void 0 ? { json: commandOptions.json } : {}
+        },
+        deps
+      );
+      process.exitCode = result.exitCode;
+    }
+  );
   account.command("delete").description("Delete your account").option("--yes", "Confirm deletion").option("--json", "Force JSON output").action(async (commandOptions) => {
     const stdinIsTTY = options.stdinIsTTY ?? process.stdin.isTTY ?? false;
     const global = globalOptions(program, commandOptions);
@@ -3683,7 +4273,10 @@ ${import_picocolors6.default.bold("Canonical vs raw URLs:")}`,
     );
     process.exitCode = result.exitCode;
   });
-  program.command("doctor").description("Report CLI diagnostics").option("--json", "Force JSON output").action(async (commandOptions) => {
+  program.command("doctor").description("Report CLI diagnostics").option("--json", "Force JSON output").option(
+    "--online",
+    "Run a network preflight (auth + active workspace + custom-domain status) \u2014 exits 3 on auth failure, 5 on a network failure"
+  ).action(async (commandOptions) => {
     const deps = await commandDeps(
       program,
       options,
@@ -3818,6 +4411,7 @@ function toDropOptions(options) {
     ...options.noindex ? { noindex: true } : {},
     ...options.index ? { index: true } : {},
     ...options.expiresAt ? { expiresAt: options.expiresAt } : {},
+    ...options.expires === false || options.noExpires ? { noExpires: true } : {},
     ...options.metadata ? { metadata: options.metadata } : {},
     ...options.metadataFile ? { metadataFile: options.metadataFile } : {},
     ...options.entry ? { entry: options.entry } : {},