@envpilot/cli 1.17.0 → 1.18.0

package/dist/{app-7IL7GWIN.js → app-JYN7XJXA.js}

@@ -4,7 +4,7 @@ import {
   getTopLevelCommandCatalog,
   getUser,
   isAuthenticated
-} from "./chunk-VEZRLJGM.js";
+} from "./chunk-DYZH5VNC.js";
 
 // src/ui/app.tsx
 import {

package/dist/{chunk-VEZRLJGM.js → chunk-DYZH5VNC.js}

@@ -7,7 +7,7 @@ function initSentry() {
   Sentry.init({
     dsn,
     environment: "cli",
-    release: true ? "1.17.0" : "0.0.0",
+    release: true ? "1.18.0" : "0.0.0",
     // All EnvPilot surfaces report to one Sentry project; the surface tag
     // is how dashboards tell web / cli / extension events apart.
     initialScope: { tags: { surface: "cli" } },
@@ -54,16 +54,12 @@ import Conf from "conf";
 
 // src/lib/roles.ts
 var ROLE_LEVEL = {
-  owner: 4,
-  project_manager: 3,
-  team_lead: 2,
-  developer: 1
-};
-var ORG_ROLE_LABELS = {
-  owner: "Owner",
-  project_manager: "Project Manager",
-  team_lead: "Team Lead",
-  developer: "Developer"
+  owner: 100,
+  project_manager: 80,
+  team_lead: 60,
+  editor: 50,
+  developer: 40,
+  viewer: 20
 };
 function normalizeOrgRole(role) {
   switch (role) {
@@ -71,20 +67,20 @@ function normalizeOrgRole(role) {
       return "owner";
     case "member":
       return "developer";
-    case "owner":
-    case "project_manager":
-    case "team_lead":
-    case "developer":
-      return role;
-    default:
+    case void 0:
+    case null:
+    case "":
       return "developer";
+    default:
+      return role;
   }
 }
 function roleLevel(role) {
-  return ROLE_LEVEL[normalizeOrgRole(role)];
+  return ROLE_LEVEL[normalizeOrgRole(role)] ?? 0;
 }
-function formatRoleLabel(role) {
-  return ORG_ROLE_LABELS[normalizeOrgRole(role)];
+function formatRoleLabel(role, meta) {
+  if (meta?.displayName) return meta.displayName;
+  return normalizeOrgRole(role).split("_").map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join(" ");
 }
 function isFileWritable(access) {
   if (access.role === "owner") return true;
@@ -93,7 +89,7 @@ function isFileWritable(access) {
     case "project_manager":
     case "team_lead":
       return true;
-    case "developer":
+    default:
       return access.hasWriteAccess;
   }
 }
@@ -474,7 +470,7 @@ function isInteractiveTerminal() {
 async function openTUI() {
   const [{ render }, { CLIApp }, { PressAnyKey }] = await Promise.all([
     import("ink"),
-    import("./app-7IL7GWIN.js"),
+    import("./app-JYN7XJXA.js"),
     import("./press-any-key-64XFP4O2.js")
   ]);
   while (true) {
@@ -622,6 +618,8 @@ function formatRole(role) {
       return chalk.blue(label);
     case "developer":
       return chalk.yellow(label);
+    default:
+      return label;
   }
 }
 function roleNotice(role) {
@@ -1330,7 +1328,8 @@ var APIClient = class {
       environmentScope: result.meta.environmentScope,
       hasWriteAccess: result.meta.hasWriteAccess,
       scopeRestricted: result.meta.scopeRestricted,
-      decryptionFailures: result.meta.decryptionFailures
+      decryptionFailures: result.meta.decryptionFailures,
+      capabilities: result.meta.capabilities
     };
     return {
       variables,
@@ -1566,7 +1565,9 @@ var projectSchema = z2.object({
   // Unified-role fields (optional so legacy server responses still parse)
   unifiedRole: z2.string().nullable().optional(),
   assigned: z2.boolean().optional(),
-  environmentScope: z2.array(z2.string()).nullable().optional()
+  environmentScope: z2.array(z2.string()).nullable().optional(),
+  // Resolved capability map (additive; absent on older deployments).
+  capabilities: z2.record(z2.string(), z2.boolean()).nullable().optional()
 });
 var variableTagSchema = z2.object({
   _id: z2.string(),
@@ -1599,7 +1600,9 @@ var variablesMetaSchema = z2.object({
   grantOnly: z2.boolean().optional(),
   environmentScope: z2.array(z2.string()).nullable().optional(),
   hasWriteAccess: z2.boolean().optional(),
-  scopeRestricted: z2.boolean().optional()
+  scopeRestricted: z2.boolean().optional(),
+  // Resolved capability map (additive; absent on older deployments).
+  capabilities: z2.record(z2.string(), z2.boolean()).optional()
 }).passthrough();
 var environmentSchema = z2.enum([
   "development",
@@ -5156,9 +5159,17 @@ function buildCreateVariableRequestBody(input) {
     isSensitive: input.isSensitive ?? false
   };
 }
+function canSubmitRequests(input) {
+  if (input.capabilities) {
+    return input.capabilities["project.requests.submit"] === true;
+  }
+  return normalizeOrgRole(input.role) === "developer";
+}
 function isRequestEligibleProject(project) {
-  const role = normalizeOrgRole(project.unifiedRole ?? project.role);
-  return role === "developer" && project.assigned === true;
+  return canSubmitRequests({
+    capabilities: project.capabilities,
+    role: project.unifiedRole ?? project.role
+  }) && project.assigned === true;
 }
 function buildEligibleRequestTargets(projects, orgNameById) {
   return projects.filter(isRequestEligibleProject).map((p) => ({
@@ -5257,8 +5268,11 @@ var requestCommand = new Command17("request").description(
       }
       if (useDefault) {
         const meta = await fetchProjectMeta(api, defaultEntry);
-        const role = normalizeOrgRole(meta?.unifiedRole ?? meta?.role);
-        if (role !== "developer") {
+        const eligible = canSubmitRequests({
+          capabilities: meta?.capabilities,
+          role: meta?.unifiedRole ?? meta?.role
+        });
+        if (!eligible) {
           warning(
             "You have direct write access to this project. Use `envpilot push` or create the variable directly instead of submitting a request."
           );
@@ -5372,10 +5386,6 @@ var requestCommand = new Command17("request").description(
     );
     info(`Status: ${created.status} \xB7 Id: ${created._id}`);
   } catch (err) {
-    if (err instanceof APIError && err.statusCode === 403) {
-      error(err.message);
-      return;
-    }
     await handleError(err);
   }
 });

package/dist/index.js

@@ -7,13 +7,13 @@ import {
   initSentry,
   isInteractiveTerminal,
   openTUI
-} from "./chunk-VEZRLJGM.js";
+} from "./chunk-DYZH5VNC.js";
 
 // src/lib/program.ts
 import { Command } from "commander";
 
 // src/lib/cli-version.ts
-var CLI_VERSION = true ? "1.17.0" : "0.0.0";
+var CLI_VERSION = true ? "1.18.0" : "0.0.0";
 
 // src/lib/version-check.ts
 import chalk from "chalk";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@envpilot/cli",
-  "version": "1.17.0",
+  "version": "1.18.0",
   "description": "Envpilot CLI — sync and manage environment variables from the terminal",
   "type": "module",
   "bin": {