@dropthis/cli 0.33.1 → 0.34.0

package/README.md

@@ -39,12 +39,30 @@ dropthis login verify --email you@example.com --otp 123456
 
 > A failed verify prints `Your code has expired` (`otp_expired`) or `That code is incorrect` (`otp_invalid`) and exits non-zero.
 
-Or pass both flags directly:
+### Scopes
+
+Keys are minted with a **capability bundle**. The default for `dropthis login` is **publish** — enough to publish drops and read your own context, nothing else. To manage a team you need a wider bundle, requested with `--scope` on `login verify`:
+
+| Bundle | Grants | Use it for |
+|--------|--------|------------|
+| `publish` *(default)* | publish + read your own account/workspaces + mint downscoped keys | publishing, CI |
+| `team` | publish + create/rename workspaces, invite/manage members | running a team |
+| `team-admin` | team + delete workspaces, remove members, change roles | irreversible team admin |
+| `service` | publish without key-minting (workspace-pinned) | automation / CI that can't mint keys |
+
+```bash
+# Mint a team-scoped key
+dropthis login verify --email you@example.com --otp 123456 --scope team
+```
+
+Minting is **downscope-only** — a minted key can never have more scopes than the key that minted it. Check what your current key carries:
 
 ```bash
-dropthis login --email you@example.com --otp 123456
+dropthis whoami --json   # echoes the key's scopes
 ```
 
+If a command returns `insufficient_scope` (exit 1, HTTP 403), your key lacks a scope that route needs. Fix it by re-logging in with the right bundle (`dropthis login verify … --scope team`) or, via the SDK, `apiKeys.create({ scopes: ["team"] })`.
+
 Credentials resolve in this order:
 
 1. `--api-key sk_...` flag
@@ -232,6 +250,42 @@ dropthis pull drop_abc123 -o ./site
 
 Pull fetches the current deployment's file manifest and writes every file into the output directory. It is owner-side read-back via the API — it works regardless of any viewer password. Custom-domain URLs are not resolvable yet; use the `drop_…` id instead.
 
+## Teams & workspaces
+
+Publishes land in a **workspace**. Everyone has a personal workspace; teams add shared ones. List the workspaces you belong to and switch the active one (delegated keys):
+
+```bash
+dropthis workspace list
+dropthis workspace use acme            # by slug or ws_… id
+```
+
+Creating and managing team workspaces needs a `team`-scoped key (see [Scopes](#scopes)):
+
+```bash
+dropthis workspace create "Acme" --slug acme        # create a team workspace
+dropthis workspace rename ws_team123 --name "Acme Inc"
+dropthis workspace delete ws_team123 --yes          # team-admin scope
+```
+
+Manage who's in a workspace:
+
+```bash
+dropthis members list ws_team123
+dropthis members invite ws_team123 --email teammate@acme.com --role member   # --role admin|member
+dropthis members role ws_team123 acc_123 --role admin                         # --role owner|admin|member
+dropthis members remove ws_team123 acc_123 --yes
+```
+
+Accept an invitation you received:
+
+```bash
+dropthis invitations list                          # pending invitations for your email
+dropthis invitations accept --token inv_tok_abc    # accept by invite token
+dropthis invitations accept-by-id inv_123          # or by invitation id
+```
+
+To publish into a specific workspace for one call, pass `--workspace <slugOrId>` on `publish` (delegated keys only).
+
 ## Commands
 
 ```bash
@@ -259,6 +313,18 @@ dropthis domains remove <host> --yes         # Disconnect a domain
 
 dropthis workspace list                      # List workspaces you belong to
 dropthis workspace use <slug|id>             # Switch active workspace (delegated keys)
+dropthis workspace create <name> --slug <s>  # Create a team workspace (team scope)
+dropthis workspace rename <ws> --name <name> # Rename a team workspace (team scope)
+dropthis workspace delete <ws> --yes         # Delete a team workspace (team-admin scope)
+
+dropthis members list <ws>                   # List a workspace's members
+dropthis members invite <ws> --email <e> --role <admin|member>   # Invite someone (team scope)
+dropthis members role <ws> <account-id> --role <owner|admin|member>  # Change a member's role
+dropthis members remove <ws> <account-id> --yes  # Remove a member (team-admin scope)
+
+dropthis invitations list                    # List pending invitations for your email
+dropthis invitations accept --token <token>  # Accept an invitation by token
+dropthis invitations accept-by-id <inv-id>   # Accept an invitation by id
 
 dropthis login                               # Authenticate with email OTP
 dropthis login request --email <email>       # Request OTP (non-interactive)
@@ -290,6 +356,7 @@ export DROPTHIS_API_KEY=sk_live_...    # API key (same as --api-key)
 export DROPTHIS_API_URL=https://...    # Override API base URL (same as --api-url)
 export DROPTHIS_NON_INTERACTIVE=1      # Disable interactive prompts (same as --no-interactive)
 export DROPTHIS_NO_UPDATE_NOTIFIER=1   # Disable the startup update notice (also auto-disabled in CI, non-TTY, --json/--quiet)
+export NO_COLOR=1                      # Disable ANSI color in human output (also auto-disabled when not a TTY)
 ```
 
 ```bash
@@ -319,6 +386,13 @@ dropthis publish ./dist --url
 
 This table — plus the global flags (`--api-key`, `--api-url`, `--json`, `--quiet`, `--no-interactive`) — is machine-readable from `dropthis commands --json` (the `exit_codes` and `global_options` fields), so an agent can discover the whole surface without scraping docs.
 
+Some failures share exit 1 but carry a distinct error `code` in the JSON envelope:
+
+| Error code | HTTP | Meaning & fix |
+|------------|------|----------------|
+| `insufficient_scope` | 403 | The key lacks a scope this route needs. Re-login with the bundle (`dropthis login verify … --scope team`), or mint a key with it via the SDK. See [Scopes](#scopes). |
+| `quota_exceeded` | 403/413 | A plan limit was hit. Check `dropthis account --json` (`entitlements.limits` vs `usage`) or upgrade. |
+
 **JSON output shape:**
 
 ```json
@@ -353,6 +427,8 @@ dropthis doctor --online --json
 
 It hits `GET /v1/account` (token valid? which workspace resolves? which plan?) and lists custom-domain verification status as a `checks` array. It exits **3** on an auth failure and **5** on a network failure, so a script can branch on the exit code.
 
+For a pre-publish **quota** check, `dropthis account --json` returns `entitlements.limits` (e.g. `maxStorageBytes`, `maxCustomHostnames`, `seatLimit`) alongside your current `usage` — read it before a large publish to avoid a `quota_exceeded` failure.
+
 ## Pricing tiers
 
 dropthis has four tiers — **Free**, **Keep**, **Pro**, and **Business**. Free drops carry the dropthis badge and expire after 30 days; paid tiers add permanence, larger limits, custom domains, passwords, and analytics. Run `dropthis account` to see your active tier and its exact caps, or visit https://dropthis.app/pricing for the current plans.

package/dist/cli.cjs

@@ -1032,7 +1032,7 @@ function buildCatalog(program) {
   return program.commands.map((cmd) => toEntry(cmd, []));
 }
 function buildGlobalOptions(program) {
-  return program.options.map((o) => ({
+  return program.options.filter((o) => o.long !== "--version" && o.long !== "--help").map((o) => ({
     flags: o.flags,
     description: o.description
   }));
@@ -1136,7 +1136,7 @@ function spreadData(data) {
 }
 
 // src/version.ts
-var CLI_VERSION = true ? "0.33.1" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.34.0" : "0.0.0-dev";
 
 // src/commands/doctor.ts
 async function onlineChecks(deps, hasCredential) {
@@ -1956,8 +1956,7 @@ async function runLoginInteractive(deps) {
   const authedClient = deps.createClient(session.data.token);
   const apiKey = await authedClient.apiKeys.create({
     label: "CLI",
-    type: "delegated",
-    ...deps.scope ? { scopes: [deps.scope] } : {}
+    type: "delegated"
   });
   if (apiKey.error) {
     prompts4.cancel(apiKey.error.message);
@@ -4073,7 +4072,12 @@ ${import_picocolors6.default.bold("Canonical vs raw URLs:")}`,
     const result = await runMembersList(workspaceId, commandOptions, deps);
     process.exitCode = result.exitCode;
   });
-  members.command("invite <workspaceId>").description("Invite someone to a workspace by email").requiredOption("--email <email>", "Email address to invite").option("--role <role>", "Role to grant (admin or member)", "member").option("--json", "Force JSON output").action(
+  members.command("invite <workspaceId>").description("Invite someone to a workspace by email").requiredOption("--email <email>", "Email address to invite").option(
+    "--role <role>",
+    "Role to grant (admin or member)",
+    parseInvitableRole,
+    "member"
+  ).option("--json", "Force JSON output").action(
     async (workspaceId, commandOptions) => {
       const deps = await commandDeps(program, options, store, commandOptions);
       const result = await runMembersInvite(
@@ -4088,7 +4092,11 @@ ${import_picocolors6.default.bold("Canonical vs raw URLs:")}`,
       process.exitCode = result.exitCode;
     }
   );
-  members.command("role <workspaceId> <accountId>").description("Change a member's role").requiredOption("--role <role>", "New role (owner, admin, or member)").option("--json", "Force JSON output").action(
+  members.command("role <workspaceId> <accountId>").description("Change a member's role").requiredOption(
+    "--role <role>",
+    "New role (owner, admin, or member)",
+    parseWorkspaceRole
+  ).option("--json", "Force JSON output").action(
     async (workspaceId, accountId, commandOptions) => {
       const deps = await commandDeps(program, options, store, commandOptions);
       const result = await runMembersRole(
@@ -4144,51 +4152,26 @@ ${import_picocolors6.default.bold("Canonical vs raw URLs:")}`,
       process.exitCode = result.exitCode;
     }
   );
-  program.command("login").description("Authenticate with email OTP").option("--email <email>", "Email address").option("--otp <otp>", "One-time passcode").option(
-    "--scope <scope>",
-    "Capability scope to request for the minted key (e.g. team)"
-  ).option("--json", "Force JSON output").action(
-    async (commandOptions) => {
-      if (!commandOptions.email || !commandOptions.otp) {
-        const deps2 = await commandDeps(program, options, store, commandOptions);
-        const global2 = globalOptions(program, commandOptions);
-        const stdinIsTTY = options.stdinIsTTY ?? process.stdin.isTTY ?? false;
-        if (!isInteractive(stdinIsTTY, deps2.env, global2)) {
-          process.exitCode = writeError(
-            deps2,
-            "invalid_usage",
-            "dropthis login is interactive and needs a terminal.",
-            "Set DROPTHIS_API_KEY, or run: dropthis login request --email <email>, then dropthis login verify --email <email> --otp <code>."
-          ).exitCode;
-          return;
-        }
-        const context = createContext({ global: global2 });
-        const result2 = await runLoginInteractive({
-          ...deps2,
-          createClient: (apiKey) => context.createClient(apiKey),
-          ...commandOptions.scope ? { scope: commandOptions.scope } : {}
-        });
-        process.exitCode = result2.exitCode;
-        return;
-      }
-      const deps = await commandDeps(program, options, store, commandOptions);
-      const global = globalOptions(program, commandOptions);
-      const verifyContext = createContext({ global });
-      const result = await runLoginVerify(
-        {
-          email: commandOptions.email,
-          otp: commandOptions.otp,
-          ...commandOptions.scope ? { scope: commandOptions.scope } : {},
-          ...commandOptions.json !== void 0 ? { json: commandOptions.json } : {}
-        },
-        {
-          ...deps,
-          createClient: (apiKey) => verifyContext.createClient(apiKey)
-        }
-      );
-      process.exitCode = result.exitCode;
+  program.command("login").description("Authenticate with email OTP (interactive)").option("--json", "Force JSON output").action(async (commandOptions) => {
+    const deps = await commandDeps(program, options, store, commandOptions);
+    const global = globalOptions(program, commandOptions);
+    const stdinIsTTY = options.stdinIsTTY ?? process.stdin.isTTY ?? false;
+    if (!isInteractive(stdinIsTTY, deps.env, global)) {
+      process.exitCode = writeError(
+        deps,
+        "invalid_usage",
+        "dropthis login is interactive and needs a terminal.",
+        "Set DROPTHIS_API_KEY, or run: dropthis login request --email <email>, then dropthis login verify --email <email> --otp <code>."
+      ).exitCode;
+      return;
     }
-  );
+    const context = createContext({ global });
+    const result = await runLoginInteractive({
+      ...deps,
+      createClient: (apiKey) => context.createClient(apiKey)
+    });
+    process.exitCode = result.exitCode;
+  });
   const login = program.commands.find((command) => command.name() === "login");
   login?.command("request").description("Request an email OTP").requiredOption("--email <email>", "Email address").option("--json", "Force JSON output").action(async (commandOptions) => {
     const deps = await commandDeps(program, options, store, commandOptions);
@@ -4441,6 +4424,18 @@ function parseMode(value) {
   }
   return value;
 }
+function parseInvitableRole(value) {
+  if (value !== "admin" && value !== "member") {
+    throw new import_commander.InvalidArgumentError('Use "admin" or "member".');
+  }
+  return value;
+}
+function parseWorkspaceRole(value) {
+  if (value !== "owner" && value !== "admin" && value !== "member") {
+    throw new import_commander.InvalidArgumentError('Use "owner", "admin", or "member".');
+  }
+  return value;
+}
 function collect(value, previous) {
   return [...previous, value];
 }