@dropthis/cli 0.34.0 → 0.36.0

package/node_modules/@dropthis/node/README.md

@@ -286,6 +286,28 @@ whatever `retryable` the API returns (the SDK never overrides it). `publish()` a
 `updateContent()` are always safe to retry — each derives a stable idempotency key, so a
 retried publish never creates a duplicate drop.
 
+### Plan gates & quotas
+
+A feature your plan doesn't include (`feature_not_in_plan`) or a limit you've hit (`quota_exceeded`)
+comes back as a typed, **non-retryable** error — don't retry it, surface the upgrade path instead.
+`isPlanGate(error)` covers both; the narrower `isFeatureNotInPlan` / `isQuotaExceeded` are exported too.
+
+```typescript
+import { isPlanGate } from "@dropthis/node";
+
+const { error } = await dropthis.drops.publish("./dist", { password: "hunter2" });
+if (isPlanGate(error)) {
+  // error.feature ("passwordProtect"), error.requiredPlan ("pro"), error.upgradeUrl
+  // — on quota_exceeded also: error.limit, error.usage, error.requested
+  console.log(`Needs ${error.requiredPlan}: ${error.upgradeUrl}`);
+}
+```
+
+Pre-flight instead of failing: `account.get().data.entitlements` carries the capability matrix +
+numeric limits, so you can check a gate or size a publish before attempting it. A `403`
+`insufficient_scope` is different — that's a [scope](#capability-scopes) gap on the credential, not a
+plan gate; fix it by minting/re-logging with the needed scope, not by upgrading.
+
 ## Configuration
 
 ```typescript
@@ -304,6 +326,11 @@ You can also pass just the API key as a string:
 const dropthis = new Dropthis("sk_...");
 ```
 
+**Getting a key.** Grab an `sk_…` key from the [console](https://app.dropthis.app) Credentials page,
+or mint one programmatically after an OTP login (`auth.verifyEmailOtp()` → `apiKeys.create()`). The
+credential is sent as `Authorization: Bearer <key>`; an `at_…` session token works in the same slot.
+With no explicit `apiKey`, the client reads `DROPTHIS_API_KEY` from the environment.
+
 ## Resources
 
 ### drops
@@ -392,12 +419,39 @@ await dropthis.apiKeys.create({
   workspace: "prod-team",
 });
 
+// Key that can create + manage teams (not just publish) — pass a scope bundle
+await dropthis.apiKeys.create({ label: "Team bot", scopes: ["team"] });
+
 await dropthis.apiKeys.list();
 await dropthis.apiKeys.delete("key_abc123"); // 204 No Content — data is null
 ```
 
 `KeyType` is `"delegated" | "service"`. A `delegated` key acts on behalf of the owning account and can switch workspaces server-side via `workspaces.use()`; a `service` key is pinned to one workspace and is intended for CI/automation where a stable target is needed.
 
+#### Capability scopes
+
+Every credential carries a set of **capability scopes** that decide what it may do (ADR 0068). You
+request them as **bundles**; `apiKeys.create({ scopes })` mints the requested set **intersected with
+your own** (downscope-only — you can never grant a key more than you hold).
+
+| Bundle | Grants | Use it for |
+| --- | --- | --- |
+| `publish` *(default)* | publish drops, read your own context, mint downscope-only keys | a normal API key / `dropthis login` |
+| `team` | `publish` + create/rename workspaces + invite/manage members | building or running a team |
+| `team-admin` | `team` + delete workspaces, remove members, change roles | the irreversible team-admin tier |
+| `service` | `publish` minus key-minting, workspace-pinned | CI/automation |
+
+Omit `scopes` for the default `publish` bundle. A plain key **cannot** do team management — call a
+team op (`workspaces.create()`, members, invitations) with a publish-only key and the API returns
+`403 insufficient_scope`; mint or re-login with the `team` bundle to fix it. Fine-grained scopes
+(e.g. `members:admin`) may be passed individually; the created key's `data.scopes` echoes the
+granted set.
+
+```typescript
+const { data } = await dropthis.apiKeys.create({ label: "Team bot", scopes: ["team"] });
+console.log(data.scopes); // the granted set (requested ∩ yours)
+```
+
 ### account
 
 ```typescript
@@ -512,6 +566,37 @@ const { data } = await dropthis.drops.publish("./dist");
 
 `DropthisEdge` honours the same `workspace` constructor option and publish option.
 
+#### Team management (workspaces, members, invitations)
+
+A **team** workspace is shared by multiple accounts. Creating and managing one needs a `team`-scoped
+credential (see [Capability scopes](#capability-scopes)) — a default publish key gets
+`403 insufficient_scope`. Drops published while a team workspace is active land there and route on its
+shared custom domain automatically.
+
+```typescript
+// Create a team (caller becomes its owner) and switch to it
+const { data: team } = await dropthis.workspaces.create({ name: "Acme" });
+await dropthis.workspaces.use(team.slug);
+
+// Invite + manage members
+await dropthis.members.invite(team.id, { email: "teammate@acme.com", role: "member" });
+const { data: roster } = await dropthis.members.list(team.id);
+await dropthis.members.updateRole(team.id, "acc_123", { role: "admin" }); // needs members:admin
+await dropthis.members.remove(team.id, "acc_123"); // remove a member, or your own id to leave
+
+// Rename / delete the workspace
+await dropthis.workspaces.rename(team.id, { name: "Acme Inc" });
+await dropthis.workspaces.delete(team.id); // owner only, needs workspaces:admin
+
+// Invitee side — accept an invite (joins + switches active workspace)
+const { data: pending } = await dropthis.invitations.list();
+await dropthis.invitations.accept({ token: "inv_raw_token_from_email" });
+await dropthis.invitations.acceptById({ invitationId: "inv_abc123" }); // agent path: no token, just be the invited email
+```
+
+`role` is `"admin" | "member"` for invites; `updateRole` also accepts `"owner"` to transfer ownership
+(owner-only, enforced server-side).
+
 ## Pricing tiers
 
 - **Free** — drops expire after 30 days, 5 MB per drop, 500 MB active storage, dropthis badge.

package/node_modules/@dropthis/node/dist/edge.cjs

@@ -246,7 +246,8 @@ function buildStagedRequest(files, options, entry) {
         sourceUrl: file.sourceUrl,
         ...file.contentType ? { contentType: file.contentType } : {},
         ...file.sizeBytes !== void 0 ? { sizeBytes: file.sizeBytes } : {},
-        ...file.checksumSha256 ? { checksumSha256: file.checksumSha256 } : {}
+        ...file.checksumSha256 ? { checksumSha256: file.checksumSha256 } : {},
+        ...file.transform ? { transform: file.transform } : {}
       }
     ) : {
       path: normalizeManifestPath(file.path),
@@ -333,7 +334,8 @@ function prepareBundleFile(file) {
       sourceUrl: file.sourceUrl,
       ...file.contentType ? { contentType: file.contentType } : {},
       ...file.sizeBytes !== void 0 ? { sizeBytes: file.sizeBytes } : {},
-      ...file.checksumSha256 ? { checksumSha256: file.checksumSha256 } : {}
+      ...file.checksumSha256 ? { checksumSha256: file.checksumSha256 } : {},
+      ...file.transform ? { transform: file.transform } : {}
     };
   }
   const bytes = fileBytes(file);
@@ -877,6 +879,69 @@ function updateBody(options) {
   };
 }
 
+// src/resources/invitations.ts
+var InvitationsResource = class {
+  constructor(transport) {
+    this.transport = transport;
+  }
+  transport;
+  /** List the calling account's own pending invitations. */
+  list() {
+    return this.transport.request("GET", "/invitations");
+  }
+  /** Accept by the raw single-use token from the invite email. Joins + switches active workspace. */
+  accept(input) {
+    return this.transport.request("POST", "/invitations/accept", {
+      body: input
+    });
+  }
+  /** Accept by invitation id, once authenticated as the invited email — the agent path, no token. */
+  acceptById(input) {
+    return this.transport.request("POST", "/invitations/accept-by-id", {
+      body: input
+    });
+  }
+};
+
+// src/resources/members.ts
+var MembersResource = class {
+  constructor(transport) {
+    this.transport = transport;
+  }
+  transport;
+  /** List a workspace's members (any member, `members:read`). */
+  list(workspaceId) {
+    return this.transport.request(
+      "GET",
+      `/workspaces/${encodeURIComponent(workspaceId)}/members`
+    );
+  }
+  /** Invite an email to the workspace (owner/admin, `members:write`). */
+  invite(workspaceId, input) {
+    return this.transport.request(
+      "POST",
+      `/workspaces/${encodeURIComponent(workspaceId)}/invitations`,
+      { body: input }
+    );
+  }
+  /** Change a member's role (`members:admin`, owner-only-touches-owner enforced server-side). */
+  updateRole(workspaceId, accountId, input) {
+    return this.transport.request(
+      "PATCH",
+      `/workspaces/${encodeURIComponent(workspaceId)}/members/${encodeURIComponent(accountId)}`,
+      { body: input }
+    );
+  }
+  /** Remove a member, or leave the workspace (your own id). Removing others needs `members:admin`;
+   * leaving needs `members:write`. 204 — data is null. */
+  remove(workspaceId, accountId) {
+    return this.transport.request(
+      "DELETE",
+      `/workspaces/${encodeURIComponent(workspaceId)}/members/${encodeURIComponent(accountId)}`
+    );
+  }
+};
+
 // src/resources/workspaces.ts
 var WorkspacesResource = class {
   constructor(transport) {
@@ -958,7 +1023,7 @@ function toSnakeCase(value) {
 
 // src/transport.ts
 var DEFAULT_BASE_URL = "https://api.dropthis.app";
-var SDK_VERSION = "0.29.0";
+var SDK_VERSION = true ? "0.32.0" : "0.0.0-dev";
 var Transport = class {
   apiKey;
   baseUrl;
@@ -1215,6 +1280,8 @@ var DropthisEdge = class {
   deploymentsResource;
   domainsResource;
   workspacesResource;
+  membersResource;
+  invitationsResource;
   constructor(options = {}) {
     this.transport = new Transport(options);
     this.defaultWorkspace = typeof options === "string" ? void 0 : options.workspace;
@@ -1258,6 +1325,18 @@ var DropthisEdge = class {
       this.workspacesResource = new WorkspacesResource(this.transport);
     return this.workspacesResource;
   }
+  /** Team membership management (ADR 0068; needs a team / team-admin scoped credential). */
+  get members() {
+    if (!this.membersResource)
+      this.membersResource = new MembersResource(this.transport);
+    return this.membersResource;
+  }
+  /** Invitee-side invitations: list the caller's pending invites, accept by token or id. */
+  get invitations() {
+    if (!this.invitationsResource)
+      this.invitationsResource = new InvitationsResource(this.transport);
+    return this.invitationsResource;
+  }
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {