@mediamonks/canopy-cli 0.7.42 → 0.7.44

package/dist/{open-D71Ms1nG.mjs → open-Bpz4C2Sr.mjs}

@@ -1,5 +1,5 @@
 import { c as projectUrl, d as stagingUrl, l as resolveProject, o as projectDirArgs } from "./site-0i7wAJqg.mjs";
-import { n as openBrowser, r as reportErrors } from "./ui-CDUJq-X-.mjs";
+import { n as openBrowser, r as reportErrors } from "./ui-CLnICOne.mjs";
 import { defineCommand } from "citty";
 //#region src/open.ts
 /**

package/dist/{package-CVDpzGgA.mjs → package-Bvly8-rB.mjs}

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.7.42";
+var version = "0.7.44";
 //#endregion
 export { version as t };

package/dist/project-template-715H_lnu.mjs

@@ -0,0 +1,2 @@
+import { a as templateCommand } from "./project-template-Cdr1uwwE.mjs";
+export { templateCommand };

package/dist/{project-template-BXfHpsI8.mjs → project-template-Cdr1uwwE.mjs}

@@ -1,6 +1,6 @@
 import { l as resolveProject, o as projectDirArgs } from "./site-0i7wAJqg.mjs";
-import { a as apiRequest, f as withContext } from "./api-Do9c8tZ_.mjs";
-import { a as unwrap, i as requireTty, r as reportErrors } from "./ui-CDUJq-X-.mjs";
+import { a as apiRequest, f as withContext } from "./api-Bl6SG8Oq.mjs";
+import { a as unwrap, i as requireTty, r as reportErrors } from "./ui-CLnICOne.mjs";
 import { defineCommand } from "citty";
 import * as p from "@clack/prompts";
 /** Plain words for the API's template errors. */

package/dist/{projects-BWTIk80a.mjs → projects-BRG2HnBs.mjs}

@@ -1,8 +1,8 @@
 import { c as projectUrl, f as tryReadCanopyJson, r as siteConfig } from "./site-0i7wAJqg.mjs";
-import { a as apiRequest, f as withContext } from "./api-Do9c8tZ_.mjs";
-import { a as unwrap, i as requireTty, r as reportErrors } from "./ui-CDUJq-X-.mjs";
-import { i as nextSteps, n as describeCopy, r as fetchTemplate, t as TEMPLATE_FIXES } from "./project-template-BXfHpsI8.mjs";
-import { i as offerRepoOnCreate, n as cloneProjectRepo } from "./repo-LSOxnmUk.mjs";
+import { a as apiRequest, f as withContext } from "./api-Bl6SG8Oq.mjs";
+import { a as unwrap, i as requireTty, r as reportErrors } from "./ui-CLnICOne.mjs";
+import { i as nextSteps, n as describeCopy, r as fetchTemplate, t as TEMPLATE_FIXES } from "./project-template-Cdr1uwwE.mjs";
+import { i as offerRepoOnCreate, n as cloneProjectRepo } from "./repo-CwT2RDoW.mjs";
 import { defineCommand } from "citty";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import { join, relative, resolve, sep } from "node:path";

package/dist/{rename-BdIFrqvG.mjs → rename-BGKa25Rq.mjs}

@@ -1,6 +1,6 @@
 import { c as projectUrl, l as resolveProject, o as projectDirArgs, u as rewriteCanopyJsonSlug } from "./site-0i7wAJqg.mjs";
-import { a as apiRequest, f as withContext } from "./api-Do9c8tZ_.mjs";
-import { a as unwrap, i as requireTty, r as reportErrors } from "./ui-CDUJq-X-.mjs";
+import { a as apiRequest, f as withContext } from "./api-Bl6SG8Oq.mjs";
+import { a as unwrap, i as requireTty, r as reportErrors } from "./ui-CLnICOne.mjs";
 import { defineCommand } from "citty";
 import * as p from "@clack/prompts";
 //#region src/rename.ts

package/dist/{repo-LSOxnmUk.mjs → repo-CwT2RDoW.mjs}

@@ -1,6 +1,6 @@
 import { f as tryReadCanopyJson, l as resolveProject, o as projectDirArgs, r as siteConfig } from "./site-0i7wAJqg.mjs";
-import { a as apiRequest, d as noticeRenamesOnly, f as withContext, n as agentHeaders, u as followRename } from "./api-Do9c8tZ_.mjs";
-import { a as unwrap, i as requireTty, r as reportErrors, t as formatDateTime } from "./ui-CDUJq-X-.mjs";
+import { a as apiRequest, d as noticeRenamesOnly, f as withContext, n as agentHeaders, u as followRename } from "./api-Bl6SG8Oq.mjs";
+import { a as unwrap, i as requireTty, r as reportErrors, t as formatDateTime } from "./ui-CLnICOne.mjs";
 import { a as parseCredentialInput, i as helperCommand, o as runCredentialHelper, r as fileTokenCache, t as RepoCredentialError } from "./repo-credential-CNDRM-tG.mjs";
 import { defineCommand } from "citty";
 import { existsSync, realpathSync } from "node:fs";

package/dist/repo-DmFs6H9m.mjs

@@ -0,0 +1,2 @@
+import { a as repoCommand } from "./repo-CwT2RDoW.mjs";
+export { repoCommand };

package/dist/roles-BDZaN3vi.mjs

@@ -0,0 +1,2 @@
+import { i as membersCommand, o as rolesCommand } from "./roles-UM0Iiws6.mjs";
+export { membersCommand, rolesCommand };

package/dist/roles-UM0Iiws6.mjs

@@ -0,0 +1,379 @@
+import { l as resolveProject, o as projectDirArgs } from "./site-0i7wAJqg.mjs";
+import { a as apiRequest, f as withContext } from "./api-Bl6SG8Oq.mjs";
+import { r as reportErrors } from "./ui-CLnICOne.mjs";
+import { defineCommand } from "citty";
+//#region src/roles.ts
+/**
+* canopy roles / canopy members — a project's app roles and its roster from
+* the terminal (OpenSpec project-roles), so an agent can look up the real
+* role slugs before it writes `roles.includes(...)`, and set people up
+* without the dashboard.
+*
+* Canopy roles (owner / editor / viewer) decide who may manage the project
+* and, when it is members-only, who may open it. App roles are the project's
+* own labels, delivered to the app as `roles` and never enforced by Canopy.
+*/
+const ROLE_FIXES = {
+	not_found: "The project or role doesn't exist, or you can't manage this project — only its owner and editors can.",
+	invalid_role_slug: "Slugs are 1–32 lowercase letters, digits and dashes, starting with a letter. Pass one with --slug.",
+	role_exists: "That slug is taken on this project — `canopy roles list` shows them.",
+	too_many_roles: "A project has at most 20 app roles — remove one first.",
+	default_role: "Make another role the default first (`canopy roles default <slug>`), then remove this one.",
+	unknown_role: "Use a slug from `canopy roles list`, or create it with `canopy roles add`."
+};
+/** One line per role, default marked — what `canopy roles list` prints. */
+function formatRoles(roles) {
+	if (roles.length === 0) return [];
+	const width = Math.max(...roles.map((r) => r.slug.length));
+	return roles.map((r) => `${r.slug.padEnd(width)}  ${r.name}${r.default ? "  (default)" : ""}`);
+}
+/** One line per person on the roster — what `canopy members list` prints. */
+function formatRoster(members, invites) {
+	const rows = [...members.map((m) => ({
+		who: m.email,
+		role: m.role,
+		apps: m.app_roles,
+		note: ""
+	})), ...invites.map((i) => ({
+		who: i.email,
+		role: i.role,
+		apps: i.app_roles,
+		note: "  (invited, not signed in yet)"
+	}))];
+	if (rows.length === 0) return [];
+	const whoWidth = Math.max(...rows.map((r) => r.who.length));
+	const roleWidth = Math.max(...rows.map((r) => r.role.length));
+	return rows.map((r) => `${r.who.padEnd(whoWidth)}  ${r.role.padEnd(roleWidth)}  ${r.apps.length > 0 ? r.apps.join(", ") : "-"}${r.note}`);
+}
+/** `--app-role a --app-role b,c` → ["a", "b", "c"]; undefined when the flag is absent. */
+function parseAppRoleFlag(value) {
+	if (value === void 0) return void 0;
+	const list = (Array.isArray(value) ? value : [value]).flatMap((v) => v.split(",")).map((v) => v.trim()).filter(Boolean);
+	return [...new Set(list)];
+}
+/** The Canopy role named by `--editor` / `--viewer`, refusing both at once. */
+function canopyRoleFlag(args) {
+	if (args.editor && args.viewer) throw new Error("Pass --editor or --viewer, not both.");
+	if (args.viewer) return "viewer";
+	if (args.editor) return "editor";
+}
+const appRoleArg = { "app-role": {
+	type: "string",
+	description: "An app role slug to give them (repeatable, or comma-separated)"
+} };
+/** citty hands a repeated string flag over as an array at runtime. */
+const appRolesOf = (args) => parseAppRoleFlag(args["app-role"]);
+const rolesCommand = defineCommand({
+	meta: {
+		name: "roles",
+		description: "Manage the project's app roles (list / add / rename / default / remove)"
+	},
+	subCommands: {
+		list: defineCommand({
+			meta: {
+				name: "list",
+				description: "List the project's app roles (the default is marked)"
+			},
+			args: {
+				...projectDirArgs,
+				json: {
+					type: "boolean",
+					default: false,
+					description: "Print the roles as JSON"
+				}
+			},
+			run: reportErrors("roles list", async ({ args }) => {
+				const { slug } = resolveProject(args);
+				const { roles } = await withContext(apiRequest("GET", `/projects/${slug}/roles`), {
+					action: `list app roles of ${slug}`,
+					fixes: ROLE_FIXES
+				});
+				if (args.json) {
+					console.log(JSON.stringify({ roles }, null, 2));
+					return;
+				}
+				if (roles.length === 0) {
+					console.log(`${slug} has no app roles — add one with \`canopy roles add "Approver"\`.`);
+					return;
+				}
+				for (const line of formatRoles(roles)) console.log(line);
+			})
+		}),
+		add: defineCommand({
+			meta: {
+				name: "add",
+				description: "Create an app role (the first one becomes the default)"
+			},
+			args: {
+				name: {
+					type: "positional",
+					description: "Display name, e.g. \"Approver\"",
+					required: true
+				},
+				slug: {
+					type: "string",
+					description: "The slug your code checks (default: derived from the name; never changes)"
+				},
+				...projectDirArgs
+			},
+			run: reportErrors("roles add", async ({ args }) => {
+				const { slug } = resolveProject(args);
+				const { role } = await withContext(apiRequest("POST", `/projects/${slug}/roles`, {
+					name: args.name,
+					...args.slug && { slug: args.slug }
+				}), {
+					action: `add app role "${args.name}" to ${slug}`,
+					fixes: ROLE_FIXES
+				});
+				console.log(`Added ${role.slug} ("${role.name}")${role.default ? " — the default role, so every visitor has it" : ""}.`);
+			})
+		}),
+		rename: defineCommand({
+			meta: {
+				name: "rename",
+				description: "Change an app role's display name (the slug stays)"
+			},
+			args: {
+				role: {
+					type: "positional",
+					description: "Role slug",
+					required: true
+				},
+				name: {
+					type: "positional",
+					description: "New display name",
+					required: true
+				},
+				...projectDirArgs
+			},
+			run: reportErrors("roles rename", async ({ args }) => {
+				const { slug } = resolveProject(args);
+				await withContext(apiRequest("PATCH", `/projects/${slug}/roles/${args.role}`, { name: args.name }), {
+					action: `rename app role ${args.role} on ${slug}`,
+					fixes: ROLE_FIXES
+				});
+				console.log(`Renamed ${args.role} to "${args.name}".`);
+			})
+		}),
+		default: defineCommand({
+			meta: {
+				name: "default",
+				description: "Make an app role the default — every visitor gets it on top of their own"
+			},
+			args: {
+				role: {
+					type: "positional",
+					description: "Role slug",
+					required: true
+				},
+				...projectDirArgs
+			},
+			run: reportErrors("roles default", async ({ args }) => {
+				const { slug } = resolveProject(args);
+				await withContext(apiRequest("PATCH", `/projects/${slug}/roles/${args.role}`, { default: true }), {
+					action: `make ${args.role} the default on ${slug}`,
+					fixes: ROLE_FIXES
+				});
+				console.log(`${args.role} is now the default role on ${slug}.`);
+			})
+		}),
+		remove: defineCommand({
+			meta: {
+				name: "remove",
+				description: "Delete an app role and take it away from everyone"
+			},
+			args: {
+				role: {
+					type: "positional",
+					description: "Role slug",
+					required: true
+				},
+				...projectDirArgs
+			},
+			run: reportErrors("roles remove", async ({ args }) => {
+				const { slug } = resolveProject(args);
+				await withContext(apiRequest("DELETE", `/projects/${slug}/roles/${args.role}`), {
+					action: `remove app role ${args.role} from ${slug}`,
+					fixes: ROLE_FIXES
+				});
+				console.log(`Removed ${args.role} from ${slug}.`);
+			})
+		})
+	}
+});
+const MEMBER_FIXES = {
+	...ROLE_FIXES,
+	not_found: "No such person on the project, or you can't manage it — only the owner adds and removes people.",
+	forbidden: "Only the project's owner changes who is an editor or a viewer.",
+	already_member: "They're already on the project — change them with `canopy members set`.",
+	already_invited: "They already have a pending invite — change it with `canopy members set`.",
+	email_domain_not_allowed: "Only colleagues who can sign in to Canopy can be added.",
+	cannot_change_owner: "The owner's role is fixed.",
+	cannot_remove_owner: "The owner can't be removed — delete the project instead."
+};
+const roster = (slug) => withContext(apiRequest("GET", `/projects/${slug}/members`), {
+	action: `read the members of ${slug}`,
+	fixes: MEMBER_FIXES
+});
+const membersCommand = defineCommand({
+	meta: {
+		name: "members",
+		description: "Manage who is on the project and their roles (list / add / set / remove)"
+	},
+	subCommands: {
+		list: defineCommand({
+			meta: {
+				name: "list",
+				description: "List members and pending invites with their roles"
+			},
+			args: {
+				...projectDirArgs,
+				json: {
+					type: "boolean",
+					default: false,
+					description: "Print the roster as JSON"
+				}
+			},
+			run: reportErrors("members list", async ({ args }) => {
+				const { slug } = resolveProject(args);
+				const { members, invites } = await roster(slug);
+				if (args.json) {
+					console.log(JSON.stringify({
+						members,
+						invites
+					}, null, 2));
+					return;
+				}
+				for (const line of formatRoster(members, invites)) console.log(line);
+			})
+		}),
+		add: defineCommand({
+			meta: {
+				name: "add",
+				description: "Add someone as an editor (default) or viewer; invites them if they haven't signed in yet"
+			},
+			args: {
+				email: {
+					type: "positional",
+					description: "Their company email",
+					required: true
+				},
+				viewer: {
+					type: "boolean",
+					description: "May open the app, not manage the project"
+				},
+				editor: {
+					type: "boolean",
+					description: "May manage the project (the default)"
+				},
+				...appRoleArg,
+				...projectDirArgs
+			},
+			run: reportErrors("members add", async ({ args }) => {
+				const { slug } = resolveProject(args);
+				const role = canopyRoleFlag(args) ?? "editor";
+				const appRoles = appRolesOf(args);
+				const res = await withContext(apiRequest("POST", `/projects/${slug}/members`, {
+					email: args.email,
+					role,
+					...appRoles && { app_roles: appRoles }
+				}), {
+					action: `add ${args.email} to ${slug}`,
+					fixes: MEMBER_FIXES
+				});
+				const roles = appRoles?.length ? ` with ${appRoles.join(", ")}` : "";
+				console.log(res.invite ? `Invited ${args.email} as ${role}${roles} — it takes effect when they first sign in. Canopy sends no email, so let them know.` : `Added ${args.email} as ${role}${roles}.`);
+			})
+		}),
+		set: defineCommand({
+			meta: {
+				name: "set",
+				description: "Change someone's Canopy role (owner only) and/or app roles (editors too)"
+			},
+			args: {
+				email: {
+					type: "positional",
+					description: "Their email, as `members list` shows it",
+					required: true
+				},
+				viewer: {
+					type: "boolean",
+					description: "Make them a viewer"
+				},
+				editor: {
+					type: "boolean",
+					description: "Make them an editor"
+				},
+				...appRoleArg,
+				"clear-app-roles": {
+					type: "boolean",
+					description: "Take all their app roles away"
+				},
+				...projectDirArgs
+			},
+			run: reportErrors("members set", async ({ args }) => {
+				const { slug } = resolveProject(args);
+				const role = canopyRoleFlag(args);
+				const appRoles = args["clear-app-roles"] ? [] : appRolesOf(args);
+				if (role === void 0 && appRoles === void 0) throw new Error("Nothing to change — pass --editor, --viewer, --app-role or --clear-app-roles.");
+				const body = {
+					...role && { role },
+					...appRoles && { app_roles: appRoles }
+				};
+				const email = args.email.trim().toLowerCase();
+				const { members, invites } = await roster(slug);
+				const member = members.find((m) => m.email.toLowerCase() === email);
+				const invite = invites.find((i) => i.email === email);
+				if (!member && !invite) throw new Error(`${args.email} is not on ${slug} — add them with \`canopy members add\`.`);
+				await withContext(apiRequest("PATCH", member ? `/projects/${slug}/members/${encodeURIComponent(member.user_id)}` : `/projects/${slug}/invites/${encodeURIComponent(email)}`, body), {
+					action: `update ${args.email} on ${slug}`,
+					fixes: MEMBER_FIXES
+				});
+				console.log([
+					`Updated ${args.email}`,
+					role && `now ${role}`,
+					appRoles && (appRoles.length ? `app roles ${appRoles.join(", ")}` : "no app roles")
+				].filter(Boolean).join(" — ") + ".");
+			})
+		}),
+		remove: defineCommand({
+			meta: {
+				name: "remove",
+				description: "Remove someone from the project, or withdraw their invite"
+			},
+			args: {
+				email: {
+					type: "positional",
+					description: "Their email, as `members list` shows it",
+					required: true
+				},
+				...projectDirArgs
+			},
+			run: reportErrors("members remove", async ({ args }) => {
+				const { slug } = resolveProject(args);
+				const email = args.email.trim().toLowerCase();
+				const { members, invites } = await roster(slug);
+				const member = members.find((m) => m.email.toLowerCase() === email);
+				if (member) {
+					await withContext(apiRequest("DELETE", `/projects/${slug}/members/${encodeURIComponent(member.user_id)}`), {
+						action: `remove ${args.email} from ${slug}`,
+						fixes: MEMBER_FIXES
+					});
+					console.log(`Removed ${args.email} from ${slug}.`);
+					return;
+				}
+				if (invites.some((i) => i.email === email)) {
+					await withContext(apiRequest("DELETE", `/projects/${slug}/invites/${encodeURIComponent(email)}`), {
+						action: `withdraw the invite for ${args.email}`,
+						fixes: MEMBER_FIXES
+					});
+					console.log(`Withdrew the invite for ${args.email}.`);
+					return;
+				}
+				throw new Error(`${args.email} is not on ${slug}.`);
+			})
+		})
+	}
+});
+//#endregion
+export { parseAppRoleFlag as a, membersCommand as i, formatRoles as n, rolesCommand as o, formatRoster as r, canopyRoleFlag as t };

package/dist/{schedule-DpMIpCGC.mjs → schedule-BcqBspn3.mjs}

@@ -1,6 +1,6 @@
 import { l as resolveProject, s as projectFlagArgs } from "./site-0i7wAJqg.mjs";
-import { a as apiRequest, f as withContext } from "./api-Do9c8tZ_.mjs";
-import { r as reportErrors, t as formatDateTime } from "./ui-CDUJq-X-.mjs";
+import { a as apiRequest, f as withContext } from "./api-Bl6SG8Oq.mjs";
+import { r as reportErrors, t as formatDateTime } from "./ui-CLnICOne.mjs";
 import { defineCommand } from "citty";
 //#region src/schedule.ts
 /**

package/dist/{secrets-BVx8L0Gj.mjs → secrets-BjbIi7Gp.mjs}

@@ -1,6 +1,6 @@
 import { l as resolveProject, o as projectDirArgs } from "./site-0i7wAJqg.mjs";
-import { a as apiRequest, f as withContext } from "./api-Do9c8tZ_.mjs";
-import { a as unwrap, r as reportErrors, t as formatDateTime } from "./ui-CDUJq-X-.mjs";
+import { a as apiRequest, f as withContext } from "./api-Bl6SG8Oq.mjs";
+import { a as unwrap, r as reportErrors, t as formatDateTime } from "./ui-CLnICOne.mjs";
 import { defineCommand } from "citty";
 import * as p from "@clack/prompts";
 //#region src/secrets.ts

package/dist/skill/canopy/SKILL.md

@@ -109,6 +109,15 @@ and never go stale.
   hard-coded ids — model ids outside that list are refused.
 - Work bug reports & feedback: `canopy feedback list | show | comment | note | status | report | watch`
   — see [Working feedback reports](#working-feedback-reports-issues) below
+- **People and permissions in the app** (`canopy docs roles`): app roles are
+  the project's own labels, read as `roles` on `auth.user()` / `env.CALLER`.
+  Run `canopy roles list --json` before writing a role check and use only those
+  slugs; create missing ones with `canopy roles add "<Name>"` and assign them
+  with `canopy members set <email> --app-role <slug>`. **Enforce roles in the
+  backend worker** (`env.CALLER.roles`), never only in the page; keep data
+  only some roles may see in `private_` tables. Try other roles locally with
+  `canopy dev --as-role <slug>`. Adding or removing people is the owner's call
+  (`canopy members add|remove`) — confirm with the user first.
 - CI credentials: `canopy token create | list | revoke`
 - Git: `canopy repo show --json` (is there a repository, and its remote) ·
   `canopy repo create` · `canopy repo clone <slug>` · `canopy repo connect`

package/dist/{skill-D58yV6K8.mjs → skill-DRLniv-I.mjs}

@@ -1,5 +1,5 @@
-import { t as version } from "./package-CVDpzGgA.mjs";
-import { r as reportErrors } from "./ui-CDUJq-X-.mjs";
+import { t as version } from "./package-Bvly8-rB.mjs";
+import { r as reportErrors } from "./ui-CLnICOne.mjs";
 import { defineCommand } from "citty";
 import { cpSync, existsSync, mkdirSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";