@lahat-group/cli 1.1.6 → 1.1.8

package/dist/index.js

@@ -9447,7 +9447,8 @@ var AGENT_SCOPES = {
   "orders:write": { he: "\u05DC\u05D4\u05DB\u05D9\u05DF \u05D8\u05D9\u05D5\u05D8\u05EA \u05D4\u05D6\u05DE\u05E0\u05D4 \u05DC\u05D0\u05D9\u05E9\u05D5\u05E8\u05DA", en: "Draft an order for you to confirm" },
   "orders:commit": { he: "\u05DC\u05D0\u05E9\u05E8 \u05D4\u05D6\u05DE\u05E0\u05D4 \u05D1\u05E9\u05DE\u05DA", en: "Confirm an order on your behalf" },
   "invitations:write": { he: "\u05DC\u05D4\u05D6\u05DE\u05D9\u05DF \u05D0\u05E0\u05E9\u05D9\u05DD \u05DC\u05E4\u05E8\u05D5\u05D9\u05E7\u05D8\u05D9\u05DD \u05E9\u05DC\u05DA", en: "Invite people to your projects" },
-  "staff:read": { he: "\u05DC\u05E7\u05E8\u05D5\u05D0 \u05D0\u05EA \u05D4\u05E0\u05EA\u05D5\u05E0\u05D9\u05DD \u05E9\u05DC \u05DB\u05DC \u05D4\u05DE\u05E9\u05EA\u05DE\u05E9\u05D9\u05DD \u05D1\u05DE\u05E2\u05E8\u05DB\u05EA", en: "Read every user's data in the system" }
+  "staff:read": { he: "\u05DC\u05E7\u05E8\u05D5\u05D0 \u05D0\u05EA \u05D4\u05E0\u05EA\u05D5\u05E0\u05D9\u05DD \u05E9\u05DC \u05DB\u05DC \u05D4\u05DE\u05E9\u05EA\u05DE\u05E9\u05D9\u05DD \u05D1\u05DE\u05E2\u05E8\u05DB\u05EA", en: "Read every user's data in the system" },
+  "staff:write": { he: "\u05DC\u05E2\u05E8\u05D5\u05DA \u05D0\u05EA \u05D4\u05E0\u05EA\u05D5\u05E0\u05D9\u05DD \u05E9\u05DC \u05DB\u05DC \u05D4\u05DE\u05E9\u05EA\u05DE\u05E9\u05D9\u05DD \u05D1\u05DE\u05E2\u05E8\u05DB\u05EA", en: "Edit every user's data in the system" }
 };
 var ALL_AGENT_SCOPES = Object.keys(AGENT_SCOPES);
 
@@ -11831,8 +11832,8 @@ To authorize this CLI, visit:
 // src/commands/account.ts
 init_esm_shims();
 async function whoami(opts = {}) {
-  const client3 = createClient(readConfig()?.accessToken ?? null);
-  const me = await client3.get("auth/me").json();
+  const client4 = createClient(readConfig()?.accessToken ?? null);
+  const me = await client4.get("auth/me").json();
   emit(me, !!opts.json, () => {
     process.stdout.write(`${me.displayName} <${me.email}> \u2014 account role: ${me.role}
 `);
@@ -11847,39 +11848,159 @@ function logout(opts = {}) {
 
 // src/commands/network.ts
 init_esm_shims();
+
+// src/commands/read.ts
+init_esm_shims();
+import { writeFileSync as writeFileSync2 } from "fs";
 function client() {
   return createClient(readConfig()?.accessToken ?? null);
 }
+function phoneKey(value) {
+  const digits = (value ?? "").replace(/\D/g, "");
+  return digits.startsWith("972") ? `0${digits.slice(3)}` : digits;
+}
+async function getProject(id, opts = {}) {
+  const p = await client().get(`projects/${id}`).json();
+  emit(p, !!opts.json, () => {
+    process.stdout.write(`${p.id}	${p.name}
+`);
+    if (p.customer) {
+      process.stdout.write(`customer: ${p.customer.customerName ?? "\u2014"} ${p.customer.phoneNumber ?? ""}
+`);
+    }
+    if (p.createdBy) process.stdout.write(`designer: ${p.createdBy.displayName ?? "\u2014"} (${p.createdBy.id ?? ""})
+`);
+  });
+}
+async function projectMembers(id, opts = {}) {
+  const res = await client().get(`projects/${id}/members`).json();
+  emit(res.members, !!opts.json, () => {
+    for (const m of res.members) {
+      process.stdout.write(`${m.userId}	${m.role}	${m.displayName ?? m.email ?? ""}
+`);
+    }
+  });
+}
+async function listCustomers(opts = {}) {
+  const res = await client().get("customers").json();
+  emit(res.customers, !!opts.json, () => {
+    for (const c of res.customers) {
+      process.stdout.write(`${c.id}	${c.customerName ?? ""}	${c.phoneNumber ?? ""}
+`);
+    }
+  });
+}
+async function getCustomer(id, opts = {}) {
+  const c = await client().get(`customers/${id}`).json();
+  emit(
+    c,
+    !!opts.json,
+    () => process.stdout.write(`${c.id}	${c.customerName ?? ""}	${c.phoneNumber ?? ""}	${c.email ?? ""}
+`)
+  );
+}
+async function customerProjects(id, opts = {}) {
+  const res = await client().get(`customers/${id}/projects`).json();
+  const projects2 = res.projects ?? [];
+  emit(projects2, !!opts.json, () => {
+    for (const p of projects2) process.stdout.write(`${p.id}	${p.name}
+`);
+  });
+}
+async function listOrders(opts = {}) {
+  if (!opts.project) throw new Error("--project <id> is required.");
+  const path2 = opts.open ? "orders/open" : "orders";
+  const res = await client().get(path2, { searchParams: { projectId: opts.project } }).json();
+  const orders2 = Array.isArray(res?.orders) ? res.orders : res ? [res] : [];
+  emit(opts.open ? res : orders2, !!opts.json, () => {
+    if (orders2.length === 0) {
+      process.stdout.write("no orders\n");
+      return;
+    }
+    for (const o of orders2) {
+      const total = o.totalPrice !== void 0 ? `${o.totalPrice} ${o.currency ?? "NIS"}` : "";
+      process.stdout.write(`${o.id ?? ""}	#${o.orderNumber ?? "\u2014"}	rev${o.revisionNumber ?? 1}	${o.status ?? ""}	${total}
+`);
+    }
+  });
+}
+async function orderPdf(id, opts = {}) {
+  const out = opts.out ?? `order-${id}.pdf`;
+  const buf = Buffer.from(await client().get(`orders/${id}/pdf`).arrayBuffer());
+  writeFileSync2(out, buf);
+  emit(
+    { path: out, bytes: buf.length },
+    !!opts.json,
+    () => process.stdout.write(`${out}	${buf.length} bytes
+`)
+  );
+}
+async function designThumbnail(id, opts = {}) {
+  const out = opts.out ?? `design-${id}.jpg`;
+  const buf = Buffer.from(await client().get(`designs/${id}/thumbnail`).arrayBuffer());
+  writeFileSync2(out, buf);
+  emit(
+    { path: out, bytes: buf.length },
+    !!opts.json,
+    () => process.stdout.write(`${out}	${buf.length} bytes
+`)
+  );
+}
+async function helpTexts(opts = {}) {
+  const res = await client().get("help-texts").json();
+  emit(res, !!opts.json, () => process.stdout.write(`${Object.keys(res).length} help text(s)
+`));
+}
+
+// src/commands/network.ts
+function client2() {
+  return createClient(readConfig()?.accessToken ?? null);
+}
 async function price(file, opts = {}) {
   const config = await readJsonInput(file);
-  const res = await client().post("price", { json: { config } }).json();
+  const res = await client2().post("price", { json: { config } }).json();
   emit(res, !!opts.json, () => process.stdout.write(`${res.total} ${res.currency}
 `));
 }
 async function listDesigns(opts = {}) {
   if (!opts.project) throw new Error("--project <id> is required.");
-  const res = await client().get("designs", { searchParams: { projectId: opts.project } }).json();
+  const res = await client2().get("designs", { searchParams: { projectId: opts.project } }).json();
   emit(res.designs, !!opts.json, () => {
     for (const d of res.designs) process.stdout.write(`${d.id}	${d.name}
 `);
   });
 }
 async function listProjects(opts = {}) {
-  const res = await client().get("projects").json();
-  emit(res.projects, !!opts.json, () => {
-    for (const p of res.projects) process.stdout.write(`${p.id}	${p.name}
+  const res = await client2().get("projects").json();
+  let projects2 = res.projects;
+  if (opts.phone) {
+    const want = phoneKey(opts.phone);
+    projects2 = projects2.filter((p) => phoneKey(p.customer?.phoneNumber) === want);
+  }
+  if (opts.designer) {
+    const needle = opts.designer.toLowerCase();
+    projects2 = projects2.filter(
+      (p) => p.createdBy?.id === opts.designer || (p.createdBy?.displayName ?? "").toLowerCase().includes(needle)
+    );
+  }
+  emit(projects2, !!opts.json, () => {
+    for (const p of projects2) {
+      const who = p.createdBy?.displayName ? `	${p.createdBy.displayName}` : "";
+      const cust = p.customer?.customerName ? `	${p.customer.customerName}` : "";
+      process.stdout.write(`${p.id}	${p.name}${cust}${who}
 `);
+    }
   });
 }
 
 // src/commands/mutate.ts
 init_esm_shims();
-function client2() {
+function client3() {
   return createClient(readConfig()?.accessToken ?? null);
 }
 async function plan(file, opts = {}) {
   const config = await readJsonInput(file);
-  const res = await client2().post("price", { json: { config }, searchParams: { preview: "bom" } }).json();
+  const res = await client3().post("price", { json: { config }, searchParams: { preview: "bom" } }).json();
   emit(res, !!opts.json, () => {
     process.stdout.write(`${res.total} ${res.currency}
 `);
@@ -11892,12 +12013,30 @@ async function plan(file, opts = {}) {
 async function apply(file, opts = {}) {
   if (!opts.project) throw new Error("--project <id> is required.");
   const config = await readJsonInput(file);
-  const res = await client2().post("designs", {
+  const res = await client3().post("designs", {
     json: { projectId: opts.project, name: opts.name ?? "CLI design", config }
   }).json();
   emit(res, !!opts.json, () => process.stdout.write(`${res.id}
 `));
 }
+async function updateDesign(id, opts = {}) {
+  if (!opts.file && !opts.name) {
+    throw new Error("Nothing to update \u2014 pass --file <config> and/or --name <name>.");
+  }
+  const api = client3();
+  const current = await api.get(`designs/${id}`).json();
+  const body = {};
+  if (opts.file) body.config = await readJsonInput(opts.file);
+  if (opts.name) body.name = opts.name;
+  if (current.version !== void 0) body.version = current.version;
+  const res = await api.put(`designs/${id}`, { json: body }).json();
+  emit(
+    res,
+    !!opts.json,
+    () => process.stdout.write(`${res.id}	v${res.version ?? "?"}
+`)
+  );
+}
 
 // src/commands/skill.ts
 init_esm_shims();
@@ -11966,7 +12105,7 @@ async function formatCliError(err, json) {
 
 // src/version.ts
 init_esm_shims();
-var CLI_VERSION = "1.1.6";
+var CLI_VERSION = "1.1.8";
 
 // src/index.ts
 program.name("wardrobe").description("Wardrobe configurator CLI").version(CLI_VERSION);
@@ -11991,8 +12130,8 @@ program.command("describe <idOrFile>").description("Describe a config (local fil
   if (idOrFile === "-" || existsSync3(idOrFile)) {
     config = await readJsonInput(idOrFile);
   } else {
-    const client3 = createClient(readConfig()?.accessToken ?? null);
-    const design = await client3.get(`designs/${idOrFile}`).json();
+    const client4 = createClient(readConfig()?.accessToken ?? null);
+    const design = await client4.get(`designs/${idOrFile}`).json();
     config = design.config;
   }
   const lines = describeInput(config, o.locale ?? "en");
@@ -12003,8 +12142,21 @@ program.command("plan <file>").description("Dry-run: price a config + BOM previe
 program.command("apply <file>").description("Save a config as a design (file or - for stdin)").requiredOption("--project <id>", "project id").option("--name <name>", "design name").option("--json", "machine-readable output").action((file, o) => apply(file, o));
 var designs = program.command("designs").description("Manage saved designs");
 designs.command("list").description("List designs in a project").requiredOption("--project <id>", "project id").option("--json", "machine-readable output").action((o) => listDesigns(o));
+designs.command("create <file>").description("Save a config as a new design in a project (same as `apply`)").requiredOption("--project <id>", "project id").option("--name <name>", "design name").option("--json", "machine-readable output").action((file, o) => apply(file, o));
+designs.command("update <id>").description("Revise a saved design (config and/or name)").option("--file <file>", "new config JSON (file or - for stdin)").option("--name <name>", "new design name").option("--json", "machine-readable output").action((id, o) => updateDesign(id, o));
+designs.command("thumbnail <id>").description("Download a design's thumbnail image").option("--out <file>", "destination path").option("--json", "machine-readable output").action((id, o) => designThumbnail(id, o));
 var projects = program.command("projects").description("Manage projects");
-projects.command("list").description("List accessible projects").option("--json", "machine-readable output").action((o) => listProjects(o));
+projects.command("list").description("List accessible projects").option("--phone <number>", "filter by the customer's phone number").option("--designer <idOrName>", "filter by the designer who owns the project").option("--json", "machine-readable output").action((o) => listProjects(o));
+projects.command("get <id>").description("Show one project").option("--json", "machine-readable output").action((id, o) => getProject(id, o));
+projects.command("members <id>").description("List a project's owner and members").option("--json", "machine-readable output").action((id, o) => projectMembers(id, o));
+var customers = program.command("customers").description("Read customers");
+customers.command("list").description("List your customers").option("--json", "machine-readable output").action((o) => listCustomers(o));
+customers.command("get <id>").description("Show one customer").option("--json", "machine-readable output").action((id, o) => getCustomer(id, o));
+customers.command("projects <id>").description("List a customer's projects").option("--json", "machine-readable output").action((id, o) => customerProjects(id, o));
+var orders = program.command("orders").description("Read orders");
+orders.command("list").description("List a project's orders").requiredOption("--project <id>", "project id").option("--open", "only the project's active (non-cancelled) order").option("--json", "machine-readable output").action((o) => listOrders(o));
+orders.command("pdf <id>").description("Download an order PDF").option("--out <file>", "destination path").option("--json", "machine-readable output").action((id, o) => orderPdf(id, o));
+program.command("help-texts").description("Read the help-text table").option("--json", "machine-readable output").action((o) => helpTexts(o));
 var skill = program.command("skill").description("Manage the bundled Claude Skill");
 skill.command("install").description("Install the wardrobe-configurator Skill for Claude Code").option("--project", "install into ./.claude/skills instead of ~/.claude/skills").option("--json", "machine-readable output").action((o) => skillInstall(o));
 program.parseAsync().catch(async (err) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lahat-group/cli",
-  "version": "1.1.6",
+  "version": "1.1.8",
   "description": "CLI + Claude Skill to build, validate, price, and save wardrobe designs.",
   "license": "UNLICENSED",
   "type": "module",

package/skill/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: wardrobe-configurator
-description: Use when the user wants to build, configure, validate, price, or order a wardrobe/closet design from the terminal — phrases like "configure a wardrobe", "price a design", "build a closet layout", "validate my wardrobe config". Drives the `wardrobe` CLI (HTTP client over the configurator API); a WardrobeConfig JSON file on disk is the unit of work.
+description: Use when the user wants to build, configure, validate, price, or order a wardrobe/closet design from the terminal — phrases like "configure a wardrobe", "price a design", "build a closet layout", "validate my wardrobe config" — OR wants to look up existing wardrobe data: projects, customers, designers, orders and their PDFs, e.g. "which projects does this designer have", "find the customer with phone 05x", "who is on this project", "what is the status of this order", "download the order PDF". Drives the `wardrobe` CLI (HTTP client over the configurator API); a WardrobeConfig JSON file on disk is the unit of work for design verbs, and every lookup verb is read-only.
 ---
 
 # Wardrobe Configurator CLI
@@ -33,15 +33,89 @@ agent loop is: **init → edit → validate → price → plan → apply**.
 5. **plan** — `wardrobe plan wardrobe.json` → dry-run price **plus a BOM preview**.
    Mutates nothing. Use this to preview before applying.
 6. **apply** — `wardrobe apply wardrobe.json --project <id> [--name <name>]` → saves
-   the config as a design and prints its `{id}`. **`--project` is required.**
+   the config as a design in that project and prints its `{id}`. **`--project` is
+   required.** `wardrobe designs create <file> --project <id>` is the same verb under
+   the `designs` group, if that reads more clearly in context.
+
+## Revising a saved design
+
+`wardrobe designs update <id> [--file <config>] [--name <name>]` revises a design in
+place — pass either or both. Prefer this over creating a second design when the user
+is iterating; a project accumulating `CLI design`, `CLI design 2`, `CLI design 3` is
+almost always a bug in how the agent worked, not what the user wanted.
+
+Validate and price the new config **before** updating, same as for a create.
+
+Two refusals to expect, neither of which is retryable:
+
+- **`409 stale_version`** — someone edited that design (usually the human, in the web
+  app) after you read it. The CLI sends the version it last saw precisely so this
+  fails loudly instead of overwriting their edit. Re-read the design, re-apply the
+  user's intent on top, and tell them it changed underneath you. **Never** loop.
+- **`423 projectLocked`** — the project has a live (non-cancelled) order, which froze
+  its designs. No design in it can be created, updated or deleted until a human
+  cancels or completes that order. Say so; don't try another design or another verb.
+
+Note that updating a config **clears the design's thumbnail** (the stored image was of
+the old config); the web app re-captures it on next view. That is expected, not an error.
 
 `wardrobe describe <idOrFile>` gives a human-readable summary of a local file/`-`
 or a saved design id.
 
-## Listing context
-
-- `wardrobe projects list` — projects you can access (needed for `--project`).
-- `wardrobe designs list --project <id>` — designs saved in a project.
+## Reading what exists
+
+Every read the key can reach has a verb. **All of them are GETs** — the CLI can read
+customers and orders but never create or change them (`customers:write`,
+`orders:write` and `quotations:write` are not on the CLI's key, so those routes
+answer `403 insufficient_scope` whoever signed in).
+
+| Verb | Shows |
+|---|---|
+| `wardrobe projects list` | Projects you can access (needed for `--project`) |
+| `wardrobe projects list --phone <number>` | Only projects whose **customer** has that number |
+| `wardrobe projects list --designer <idOrName>` | Only projects owned by that designer |
+| `wardrobe projects get <id>` | One project: customer + owning designer |
+| `wardrobe projects members <id>` | Owner plus every invited member, with roles |
+| `wardrobe customers list` | Your customers |
+| `wardrobe customers get <id>` | One customer |
+| `wardrobe customers projects <id>` | That customer's projects |
+| `wardrobe designs list --project <id>` | Designs saved in a project |
+| `wardrobe designs thumbnail <id> --out f.jpg` | The design's rendered thumbnail |
+| `wardrobe orders list --project <id>` | Every order the project has had |
+| `wardrobe orders list --project <id> --open` | Only its active (non-cancelled) order |
+| `wardrobe orders pdf <id> --out f.pdf` | The order PDF |
+| `wardrobe help-texts` | The help-text table |
+
+`projects list` already returns each project's **customer and owning designer inline** —
+so "who is the customer on each of this designer's projects" is one call plus a filter,
+never one call per project. Prefer `--phone` / `--designer` over fetching and grepping.
+
+### What you can see is not what exists
+
+The list is bounded by the key, so an empty result is as often a **visibility** answer as
+a data one. `wardrobe whoami --json` reports the truth under `agent.scopes` and `role`:
+
+- An ordinary designer or client sees **their own** projects plus ones they were invited
+  to. A project belonging to someone else answers `403 Forbidden`, not `404`.
+- A key approved by an **admin or support** user *and* carrying **`staff:read`** sees
+  **every** project, customer and order in the system. That scope is granted only to
+  staff, only for GETs, and is listed by name on the consent screen. The same approver
+  also receives **`staff:write`**, which lets `designs create` / `designs update` land in
+  a project the admin does not own. A key logged in before 2026-09-05 lacks it — a `403
+  Forbidden` on a write to someone else's project means `wardrobe login` again.
+
+Never tell a user something does not exist when you only know your key cannot see it.
+Say which it is: `403 Forbidden` means the row is someone else's, `404` means it is gone.
+
+### Not available here
+
+Don't reach for these; they are not CLI verbs and not agent-reachable:
+
+- **Anything under `/admin`**, plus commissions and invitations — barred to every agent
+  key at the mount (`403 agent_not_permitted`). No scope unlocks them.
+- **Quotation history.** `POST /quotations/pdf` is open to other clients, but reading a
+  project's past quotes is JWT-only — a human in the web app.
+- **Manufacturing-files export.** Staff-only, through the web app.
 
 ## WardrobeConfig shape (top-level)
 
@@ -65,10 +139,12 @@ Prefer generating the skeleton with `wardrobe init` rather than hand-writing it
 
 ## Guardrails — committing to an order requires a human
 
-- **The CLI cannot place orders.** The `wardrobe-cli` client is registered with
-  `profile:read`, `projects:read`, `designs:read`, `designs:write`, `price:read` —
-  **no order or admin scope** — so every order route answers `403 insufficient_scope`.
-  Don't attempt to order, or to run admin/catalog operations.
+- **The CLI can read orders but never place one.** Its key carries `profile:read`,
+  `projects:read`, `customers:read`, `designs:read`, `designs:write`, `orders:read`,
+  `price:read` (+ `staff:read` and `staff:write` for staff) — **every write beyond designs is absent**,
+  and so is every admin scope. `wardrobe orders list` and `orders pdf` work; creating
+  or changing an order, a customer or a quotation answers `403 insufficient_scope`.
+  Don't attempt it, and don't attempt admin/catalog operations.
 - To turn a saved design into an order, direct the **human** to the web app: they
   open the project, review the design, and complete the **verify-details** flow —
   which computes the final price, freezes the PDF, and advances the order. Only a