@envpilot/cli 1.16.0 → 1.18.0

package/dist/{app-HQ5P6QE6.js → app-JYN7XJXA.js}

@@ -4,7 +4,7 @@ import {
   getTopLevelCommandCatalog,
   getUser,
   isAuthenticated
-} from "./chunk-YBF26DSR.js";
+} from "./chunk-DYZH5VNC.js";
 
 // src/ui/app.tsx
 import {

package/dist/{chunk-YBF26DSR.js → chunk-DYZH5VNC.js}

@@ -7,7 +7,7 @@ function initSentry() {
   Sentry.init({
     dsn,
     environment: "cli",
-    release: true ? "1.16.0" : "0.0.0",
+    release: true ? "1.18.0" : "0.0.0",
     // All EnvPilot surfaces report to one Sentry project; the surface tag
     // is how dashboards tell web / cli / extension events apart.
     initialScope: { tags: { surface: "cli" } },
@@ -54,16 +54,12 @@ import Conf from "conf";
 
 // src/lib/roles.ts
 var ROLE_LEVEL = {
-  owner: 4,
-  project_manager: 3,
-  team_lead: 2,
-  developer: 1
-};
-var ORG_ROLE_LABELS = {
-  owner: "Owner",
-  project_manager: "Project Manager",
-  team_lead: "Team Lead",
-  developer: "Developer"
+  owner: 100,
+  project_manager: 80,
+  team_lead: 60,
+  editor: 50,
+  developer: 40,
+  viewer: 20
 };
 function normalizeOrgRole(role) {
   switch (role) {
@@ -71,20 +67,20 @@ function normalizeOrgRole(role) {
       return "owner";
     case "member":
       return "developer";
-    case "owner":
-    case "project_manager":
-    case "team_lead":
-    case "developer":
-      return role;
-    default:
+    case void 0:
+    case null:
+    case "":
       return "developer";
+    default:
+      return role;
   }
 }
 function roleLevel(role) {
-  return ROLE_LEVEL[normalizeOrgRole(role)];
+  return ROLE_LEVEL[normalizeOrgRole(role)] ?? 0;
 }
-function formatRoleLabel(role) {
-  return ORG_ROLE_LABELS[normalizeOrgRole(role)];
+function formatRoleLabel(role, meta) {
+  if (meta?.displayName) return meta.displayName;
+  return normalizeOrgRole(role).split("_").map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join(" ");
 }
 function isFileWritable(access) {
   if (access.role === "owner") return true;
@@ -93,7 +89,7 @@ function isFileWritable(access) {
     case "project_manager":
     case "team_lead":
       return true;
-    case "developer":
+    default:
       return access.hasWriteAccess;
   }
 }
@@ -196,6 +192,14 @@ function extendCacheFreshness(projectId, environment, organizationId) {
   } catch {
   }
 }
+function deleteCache(projectId, environment, organizationId) {
+  try {
+    const key = getCacheKey(projectId, environment, organizationId);
+    const path = getCachePath(key);
+    if (existsSync(path)) unlinkSync(path);
+  } catch {
+  }
+}
 function clearAllCache() {
   let count = 0;
   try {
@@ -466,7 +470,7 @@ function isInteractiveTerminal() {
 async function openTUI() {
   const [{ render }, { CLIApp }, { PressAnyKey }] = await Promise.all([
     import("ink"),
-    import("./app-HQ5P6QE6.js"),
+    import("./app-JYN7XJXA.js"),
     import("./press-any-key-64XFP4O2.js")
   ]);
   while (true) {
@@ -614,6 +618,8 @@ function formatRole(role) {
       return chalk.blue(label);
     case "developer":
       return chalk.yellow(label);
+    default:
+      return label;
   }
 }
 function roleNotice(role) {
@@ -665,7 +671,17 @@ var ErrorCodes = {
   INVALID_INPUT: "INVALID_INPUT",
   UNKNOWN_ERROR: "UNKNOWN_ERROR"
 };
+var ACCESS_SUSPENDED_TOKEN = "ACCESS_SUSPENDED";
+var ACCESS_REVOKED_MESSAGE = "Your access to this organization has been revoked. Please contact your organization administrator.";
 function formatError(error2) {
+  const data = error2?.data;
+  const raw = [
+    error2 instanceof Error ? error2.message : error2 ? String(error2) : "",
+    typeof data === "string" ? data : ""
+  ].join(" ");
+  if (raw.includes(ACCESS_SUSPENDED_TOKEN)) {
+    return chalk2.red(`Error: ${ACCESS_REVOKED_MESSAGE}`);
+  }
   if (error2 instanceof CLIError) {
     let message = chalk2.red(`Error: ${error2.message}`);
     if (error2.suggestion) {
@@ -731,6 +747,26 @@ function fileNotFound(path) {
 function invalidInput(message) {
   return new CLIError(message, ErrorCodes.INVALID_INPUT);
 }
+function isConnectivityError(error2) {
+  const code = error2?.code ?? "";
+  if ([
+    "ECONNREFUSED",
+    "ECONNRESET",
+    "ENOTFOUND",
+    "ETIMEDOUT",
+    "EAI_AGAIN",
+    "ENETUNREACH",
+    "EHOSTUNREACH",
+    "UND_ERR_CONNECT_TIMEOUT"
+  ].includes(code)) {
+    return true;
+  }
+  if (error2?.status !== void 0) return false;
+  const message = error2 instanceof Error ? error2.message : String(error2);
+  return /fetch failed|network|socket hang up|getaddrinfo|connect timeout/i.test(
+    message
+  );
+}
 
 // src/lib/auth-flow.ts
 import open from "open";
@@ -1292,7 +1328,8 @@ var APIClient = class {
       environmentScope: result.meta.environmentScope,
       hasWriteAccess: result.meta.hasWriteAccess,
       scopeRestricted: result.meta.scopeRestricted,
-      decryptionFailures: result.meta.decryptionFailures
+      decryptionFailures: result.meta.decryptionFailures,
+      capabilities: result.meta.capabilities
     };
     return {
       variables,
@@ -1528,7 +1565,9 @@ var projectSchema = z2.object({
   // Unified-role fields (optional so legacy server responses still parse)
   unifiedRole: z2.string().nullable().optional(),
   assigned: z2.boolean().optional(),
-  environmentScope: z2.array(z2.string()).nullable().optional()
+  environmentScope: z2.array(z2.string()).nullable().optional(),
+  // Resolved capability map (additive; absent on older deployments).
+  capabilities: z2.record(z2.string(), z2.boolean()).nullable().optional()
 });
 var variableTagSchema = z2.object({
   _id: z2.string(),
@@ -1561,7 +1600,9 @@ var variablesMetaSchema = z2.object({
   grantOnly: z2.boolean().optional(),
   environmentScope: z2.array(z2.string()).nullable().optional(),
   hasWriteAccess: z2.boolean().optional(),
-  scopeRestricted: z2.boolean().optional()
+  scopeRestricted: z2.boolean().optional(),
+  // Resolved capability map (additive; absent on older deployments).
+  capabilities: z2.record(z2.string(), z2.boolean()).optional()
 }).passthrough();
 var environmentSchema = z2.enum([
   "development",
@@ -4781,14 +4822,19 @@ var runCommand = new Command14("run").description(
               serverFingerprint
             );
           }
-        } catch {
-          variables = probe.entry.variables;
-          cacheHit = true;
-          cacheAge = formatAge(probe.entry.fetchedAt);
-          if (!options.quiet) {
-            warning(
-              `Using offline cache (age ${cacheAge}) \u2014 could not reach the server to verify freshness.`
-            );
+        } catch (err) {
+          if (isConnectivityError(err)) {
+            variables = probe.entry.variables;
+            cacheHit = true;
+            cacheAge = formatAge(probe.entry.fetchedAt);
+            if (!options.quiet) {
+              warning(
+                `Using offline cache (age ${cacheAge}) \u2014 could not reach the server to verify freshness.`
+              );
+            }
+          } else {
+            deleteCache(project.projectId, environment, organizationId);
+            throw err;
           }
         }
       } else {
@@ -5113,9 +5159,17 @@ function buildCreateVariableRequestBody(input) {
     isSensitive: input.isSensitive ?? false
   };
 }
+function canSubmitRequests(input) {
+  if (input.capabilities) {
+    return input.capabilities["project.requests.submit"] === true;
+  }
+  return normalizeOrgRole(input.role) === "developer";
+}
 function isRequestEligibleProject(project) {
-  const role = normalizeOrgRole(project.unifiedRole ?? project.role);
-  return role === "developer" && project.assigned === true;
+  return canSubmitRequests({
+    capabilities: project.capabilities,
+    role: project.unifiedRole ?? project.role
+  }) && project.assigned === true;
 }
 function buildEligibleRequestTargets(projects, orgNameById) {
   return projects.filter(isRequestEligibleProject).map((p) => ({
@@ -5214,8 +5268,11 @@ var requestCommand = new Command17("request").description(
       }
       if (useDefault) {
         const meta = await fetchProjectMeta(api, defaultEntry);
-        const role = normalizeOrgRole(meta?.unifiedRole ?? meta?.role);
-        if (role !== "developer") {
+        const eligible = canSubmitRequests({
+          capabilities: meta?.capabilities,
+          role: meta?.unifiedRole ?? meta?.role
+        });
+        if (!eligible) {
           warning(
             "You have direct write access to this project. Use `envpilot push` or create the variable directly instead of submitting a request."
           );
@@ -5329,10 +5386,6 @@ var requestCommand = new Command17("request").description(
     );
     info(`Status: ${created.status} \xB7 Id: ${created._id}`);
   } catch (err) {
-    if (err instanceof APIError && err.statusCode === 403) {
-      error(err.message);
-      return;
-    }
     await handleError(err);
   }
 });

package/dist/index.js

@@ -7,13 +7,13 @@ import {
   initSentry,
   isInteractiveTerminal,
   openTUI
-} from "./chunk-YBF26DSR.js";
+} from "./chunk-DYZH5VNC.js";
 
 // src/lib/program.ts
 import { Command } from "commander";
 
 // src/lib/cli-version.ts
-var CLI_VERSION = true ? "1.16.0" : "0.0.0";
+var CLI_VERSION = true ? "1.18.0" : "0.0.0";
 
 // src/lib/version-check.ts
 import chalk from "chalk";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@envpilot/cli",
-  "version": "1.16.0",
+  "version": "1.18.0",
   "description": "Envpilot CLI — sync and manage environment variables from the terminal",
   "type": "module",
   "bin": {