@mediamonks/canopy-cli 0.7.43 → 0.7.44

package/dist/roles-UM0Iiws6.mjs

@@ -0,0 +1,379 @@
+import { l as resolveProject, o as projectDirArgs } from "./site-0i7wAJqg.mjs";
+import { a as apiRequest, f as withContext } from "./api-Bl6SG8Oq.mjs";
+import { r as reportErrors } from "./ui-CLnICOne.mjs";
+import { defineCommand } from "citty";
+//#region src/roles.ts
+/**
+* canopy roles / canopy members — a project's app roles and its roster from
+* the terminal (OpenSpec project-roles), so an agent can look up the real
+* role slugs before it writes `roles.includes(...)`, and set people up
+* without the dashboard.
+*
+* Canopy roles (owner / editor / viewer) decide who may manage the project
+* and, when it is members-only, who may open it. App roles are the project's
+* own labels, delivered to the app as `roles` and never enforced by Canopy.
+*/
+const ROLE_FIXES = {
+	not_found: "The project or role doesn't exist, or you can't manage this project — only its owner and editors can.",
+	invalid_role_slug: "Slugs are 1–32 lowercase letters, digits and dashes, starting with a letter. Pass one with --slug.",
+	role_exists: "That slug is taken on this project — `canopy roles list` shows them.",
+	too_many_roles: "A project has at most 20 app roles — remove one first.",
+	default_role: "Make another role the default first (`canopy roles default <slug>`), then remove this one.",
+	unknown_role: "Use a slug from `canopy roles list`, or create it with `canopy roles add`."
+};
+/** One line per role, default marked — what `canopy roles list` prints. */
+function formatRoles(roles) {
+	if (roles.length === 0) return [];
+	const width = Math.max(...roles.map((r) => r.slug.length));
+	return roles.map((r) => `${r.slug.padEnd(width)}  ${r.name}${r.default ? "  (default)" : ""}`);
+}
+/** One line per person on the roster — what `canopy members list` prints. */
+function formatRoster(members, invites) {
+	const rows = [...members.map((m) => ({
+		who: m.email,
+		role: m.role,
+		apps: m.app_roles,
+		note: ""
+	})), ...invites.map((i) => ({
+		who: i.email,
+		role: i.role,
+		apps: i.app_roles,
+		note: "  (invited, not signed in yet)"
+	}))];
+	if (rows.length === 0) return [];
+	const whoWidth = Math.max(...rows.map((r) => r.who.length));
+	const roleWidth = Math.max(...rows.map((r) => r.role.length));
+	return rows.map((r) => `${r.who.padEnd(whoWidth)}  ${r.role.padEnd(roleWidth)}  ${r.apps.length > 0 ? r.apps.join(", ") : "-"}${r.note}`);
+}
+/** `--app-role a --app-role b,c` → ["a", "b", "c"]; undefined when the flag is absent. */
+function parseAppRoleFlag(value) {
+	if (value === void 0) return void 0;
+	const list = (Array.isArray(value) ? value : [value]).flatMap((v) => v.split(",")).map((v) => v.trim()).filter(Boolean);
+	return [...new Set(list)];
+}
+/** The Canopy role named by `--editor` / `--viewer`, refusing both at once. */
+function canopyRoleFlag(args) {
+	if (args.editor && args.viewer) throw new Error("Pass --editor or --viewer, not both.");
+	if (args.viewer) return "viewer";
+	if (args.editor) return "editor";
+}
+const appRoleArg = { "app-role": {
+	type: "string",
+	description: "An app role slug to give them (repeatable, or comma-separated)"
+} };
+/** citty hands a repeated string flag over as an array at runtime. */
+const appRolesOf = (args) => parseAppRoleFlag(args["app-role"]);
+const rolesCommand = defineCommand({
+	meta: {
+		name: "roles",
+		description: "Manage the project's app roles (list / add / rename / default / remove)"
+	},
+	subCommands: {
+		list: defineCommand({
+			meta: {
+				name: "list",
+				description: "List the project's app roles (the default is marked)"
+			},
+			args: {
+				...projectDirArgs,
+				json: {
+					type: "boolean",
+					default: false,
+					description: "Print the roles as JSON"
+				}
+			},
+			run: reportErrors("roles list", async ({ args }) => {
+				const { slug } = resolveProject(args);
+				const { roles } = await withContext(apiRequest("GET", `/projects/${slug}/roles`), {
+					action: `list app roles of ${slug}`,
+					fixes: ROLE_FIXES
+				});
+				if (args.json) {
+					console.log(JSON.stringify({ roles }, null, 2));
+					return;
+				}
+				if (roles.length === 0) {
+					console.log(`${slug} has no app roles — add one with \`canopy roles add "Approver"\`.`);
+					return;
+				}
+				for (const line of formatRoles(roles)) console.log(line);
+			})
+		}),
+		add: defineCommand({
+			meta: {
+				name: "add",
+				description: "Create an app role (the first one becomes the default)"
+			},
+			args: {
+				name: {
+					type: "positional",
+					description: "Display name, e.g. \"Approver\"",
+					required: true
+				},
+				slug: {
+					type: "string",
+					description: "The slug your code checks (default: derived from the name; never changes)"
+				},
+				...projectDirArgs
+			},
+			run: reportErrors("roles add", async ({ args }) => {
+				const { slug } = resolveProject(args);
+				const { role } = await withContext(apiRequest("POST", `/projects/${slug}/roles`, {
+					name: args.name,
+					...args.slug && { slug: args.slug }
+				}), {
+					action: `add app role "${args.name}" to ${slug}`,
+					fixes: ROLE_FIXES
+				});
+				console.log(`Added ${role.slug} ("${role.name}")${role.default ? " — the default role, so every visitor has it" : ""}.`);
+			})
+		}),
+		rename: defineCommand({
+			meta: {
+				name: "rename",
+				description: "Change an app role's display name (the slug stays)"
+			},
+			args: {
+				role: {
+					type: "positional",
+					description: "Role slug",
+					required: true
+				},
+				name: {
+					type: "positional",
+					description: "New display name",
+					required: true
+				},
+				...projectDirArgs
+			},
+			run: reportErrors("roles rename", async ({ args }) => {
+				const { slug } = resolveProject(args);
+				await withContext(apiRequest("PATCH", `/projects/${slug}/roles/${args.role}`, { name: args.name }), {
+					action: `rename app role ${args.role} on ${slug}`,
+					fixes: ROLE_FIXES
+				});
+				console.log(`Renamed ${args.role} to "${args.name}".`);
+			})
+		}),
+		default: defineCommand({
+			meta: {
+				name: "default",
+				description: "Make an app role the default — every visitor gets it on top of their own"
+			},
+			args: {
+				role: {
+					type: "positional",
+					description: "Role slug",
+					required: true
+				},
+				...projectDirArgs
+			},
+			run: reportErrors("roles default", async ({ args }) => {
+				const { slug } = resolveProject(args);
+				await withContext(apiRequest("PATCH", `/projects/${slug}/roles/${args.role}`, { default: true }), {
+					action: `make ${args.role} the default on ${slug}`,
+					fixes: ROLE_FIXES
+				});
+				console.log(`${args.role} is now the default role on ${slug}.`);
+			})
+		}),
+		remove: defineCommand({
+			meta: {
+				name: "remove",
+				description: "Delete an app role and take it away from everyone"
+			},
+			args: {
+				role: {
+					type: "positional",
+					description: "Role slug",
+					required: true
+				},
+				...projectDirArgs
+			},
+			run: reportErrors("roles remove", async ({ args }) => {
+				const { slug } = resolveProject(args);
+				await withContext(apiRequest("DELETE", `/projects/${slug}/roles/${args.role}`), {
+					action: `remove app role ${args.role} from ${slug}`,
+					fixes: ROLE_FIXES
+				});
+				console.log(`Removed ${args.role} from ${slug}.`);
+			})
+		})
+	}
+});
+const MEMBER_FIXES = {
+	...ROLE_FIXES,
+	not_found: "No such person on the project, or you can't manage it — only the owner adds and removes people.",
+	forbidden: "Only the project's owner changes who is an editor or a viewer.",
+	already_member: "They're already on the project — change them with `canopy members set`.",
+	already_invited: "They already have a pending invite — change it with `canopy members set`.",
+	email_domain_not_allowed: "Only colleagues who can sign in to Canopy can be added.",
+	cannot_change_owner: "The owner's role is fixed.",
+	cannot_remove_owner: "The owner can't be removed — delete the project instead."
+};
+const roster = (slug) => withContext(apiRequest("GET", `/projects/${slug}/members`), {
+	action: `read the members of ${slug}`,
+	fixes: MEMBER_FIXES
+});
+const membersCommand = defineCommand({
+	meta: {
+		name: "members",
+		description: "Manage who is on the project and their roles (list / add / set / remove)"
+	},
+	subCommands: {
+		list: defineCommand({
+			meta: {
+				name: "list",
+				description: "List members and pending invites with their roles"
+			},
+			args: {
+				...projectDirArgs,
+				json: {
+					type: "boolean",
+					default: false,
+					description: "Print the roster as JSON"
+				}
+			},
+			run: reportErrors("members list", async ({ args }) => {
+				const { slug } = resolveProject(args);
+				const { members, invites } = await roster(slug);
+				if (args.json) {
+					console.log(JSON.stringify({
+						members,
+						invites
+					}, null, 2));
+					return;
+				}
+				for (const line of formatRoster(members, invites)) console.log(line);
+			})
+		}),
+		add: defineCommand({
+			meta: {
+				name: "add",
+				description: "Add someone as an editor (default) or viewer; invites them if they haven't signed in yet"
+			},
+			args: {
+				email: {
+					type: "positional",
+					description: "Their company email",
+					required: true
+				},
+				viewer: {
+					type: "boolean",
+					description: "May open the app, not manage the project"
+				},
+				editor: {
+					type: "boolean",
+					description: "May manage the project (the default)"
+				},
+				...appRoleArg,
+				...projectDirArgs
+			},
+			run: reportErrors("members add", async ({ args }) => {
+				const { slug } = resolveProject(args);
+				const role = canopyRoleFlag(args) ?? "editor";
+				const appRoles = appRolesOf(args);
+				const res = await withContext(apiRequest("POST", `/projects/${slug}/members`, {
+					email: args.email,
+					role,
+					...appRoles && { app_roles: appRoles }
+				}), {
+					action: `add ${args.email} to ${slug}`,
+					fixes: MEMBER_FIXES
+				});
+				const roles = appRoles?.length ? ` with ${appRoles.join(", ")}` : "";
+				console.log(res.invite ? `Invited ${args.email} as ${role}${roles} — it takes effect when they first sign in. Canopy sends no email, so let them know.` : `Added ${args.email} as ${role}${roles}.`);
+			})
+		}),
+		set: defineCommand({
+			meta: {
+				name: "set",
+				description: "Change someone's Canopy role (owner only) and/or app roles (editors too)"
+			},
+			args: {
+				email: {
+					type: "positional",
+					description: "Their email, as `members list` shows it",
+					required: true
+				},
+				viewer: {
+					type: "boolean",
+					description: "Make them a viewer"
+				},
+				editor: {
+					type: "boolean",
+					description: "Make them an editor"
+				},
+				...appRoleArg,
+				"clear-app-roles": {
+					type: "boolean",
+					description: "Take all their app roles away"
+				},
+				...projectDirArgs
+			},
+			run: reportErrors("members set", async ({ args }) => {
+				const { slug } = resolveProject(args);
+				const role = canopyRoleFlag(args);
+				const appRoles = args["clear-app-roles"] ? [] : appRolesOf(args);
+				if (role === void 0 && appRoles === void 0) throw new Error("Nothing to change — pass --editor, --viewer, --app-role or --clear-app-roles.");
+				const body = {
+					...role && { role },
+					...appRoles && { app_roles: appRoles }
+				};
+				const email = args.email.trim().toLowerCase();
+				const { members, invites } = await roster(slug);
+				const member = members.find((m) => m.email.toLowerCase() === email);
+				const invite = invites.find((i) => i.email === email);
+				if (!member && !invite) throw new Error(`${args.email} is not on ${slug} — add them with \`canopy members add\`.`);
+				await withContext(apiRequest("PATCH", member ? `/projects/${slug}/members/${encodeURIComponent(member.user_id)}` : `/projects/${slug}/invites/${encodeURIComponent(email)}`, body), {
+					action: `update ${args.email} on ${slug}`,
+					fixes: MEMBER_FIXES
+				});
+				console.log([
+					`Updated ${args.email}`,
+					role && `now ${role}`,
+					appRoles && (appRoles.length ? `app roles ${appRoles.join(", ")}` : "no app roles")
+				].filter(Boolean).join(" — ") + ".");
+			})
+		}),
+		remove: defineCommand({
+			meta: {
+				name: "remove",
+				description: "Remove someone from the project, or withdraw their invite"
+			},
+			args: {
+				email: {
+					type: "positional",
+					description: "Their email, as `members list` shows it",
+					required: true
+				},
+				...projectDirArgs
+			},
+			run: reportErrors("members remove", async ({ args }) => {
+				const { slug } = resolveProject(args);
+				const email = args.email.trim().toLowerCase();
+				const { members, invites } = await roster(slug);
+				const member = members.find((m) => m.email.toLowerCase() === email);
+				if (member) {
+					await withContext(apiRequest("DELETE", `/projects/${slug}/members/${encodeURIComponent(member.user_id)}`), {
+						action: `remove ${args.email} from ${slug}`,
+						fixes: MEMBER_FIXES
+					});
+					console.log(`Removed ${args.email} from ${slug}.`);
+					return;
+				}
+				if (invites.some((i) => i.email === email)) {
+					await withContext(apiRequest("DELETE", `/projects/${slug}/invites/${encodeURIComponent(email)}`), {
+						action: `withdraw the invite for ${args.email}`,
+						fixes: MEMBER_FIXES
+					});
+					console.log(`Withdrew the invite for ${args.email}.`);
+					return;
+				}
+				throw new Error(`${args.email} is not on ${slug}.`);
+			})
+		})
+	}
+});
+//#endregion
+export { parseAppRoleFlag as a, membersCommand as i, formatRoles as n, rolesCommand as o, formatRoster as r, canopyRoleFlag as t };

package/dist/skill/canopy/SKILL.md

@@ -109,6 +109,15 @@ and never go stale.
   hard-coded ids — model ids outside that list are refused.
 - Work bug reports & feedback: `canopy feedback list | show | comment | note | status | report | watch`
   — see [Working feedback reports](#working-feedback-reports-issues) below
+- **People and permissions in the app** (`canopy docs roles`): app roles are
+  the project's own labels, read as `roles` on `auth.user()` / `env.CALLER`.
+  Run `canopy roles list --json` before writing a role check and use only those
+  slugs; create missing ones with `canopy roles add "<Name>"` and assign them
+  with `canopy members set <email> --app-role <slug>`. **Enforce roles in the
+  backend worker** (`env.CALLER.roles`), never only in the page; keep data
+  only some roles may see in `private_` tables. Try other roles locally with
+  `canopy dev --as-role <slug>`. Adding or removing people is the owner's call
+  (`canopy members add|remove`) — confirm with the user first.
 - CI credentials: `canopy token create | list | revoke`
 - Git: `canopy repo show --json` (is there a repository, and its remote) ·
   `canopy repo create` · `canopy repo clone <slug>` · `canopy repo connect`

package/dist/{skill-Ct-aCOzg.mjs → skill-DRLniv-I.mjs}

@@ -1,4 +1,4 @@
-import { t as version } from "./package-XOtqboS1.mjs";
+import { t as version } from "./package-Bvly8-rB.mjs";
 import { r as reportErrors } from "./ui-CLnICOne.mjs";
 import { defineCommand } from "citty";
 import { cpSync, existsSync, mkdirSync, rmSync, symlinkSync, writeFileSync } from "node:fs";

package/dist/{src-CScXotBB.mjs → src-8vxOBOxW.mjs}

@@ -860,7 +860,8 @@ const IDENTITY_STAMP_HEADERS = [
 	"x-canopy-identity-kind",
 	"x-canopy-identity-id",
 	"x-canopy-identity-email",
-	"x-canopy-identity-name"
+	"x-canopy-identity-name",
+	"x-canopy-identity-roles"
 ];
 /**
 * Header carrying the project's worker token as runtime-origin proof (docs/35).
@@ -960,15 +961,30 @@ const IDENTITY_STAMP_HEADERS = [
   "x-canopy-identity-id",
   "x-canopy-identity-email",
   "x-canopy-identity-name",
+  "x-canopy-identity-roles",
 ];
 
+// App roles (project-roles) — transcribed from rolesFromHeaders in
+// project-runtime/src/user.ts: undefined without the header (an older
+// gateway), so the property stays absent rather than [].
+function rolesFromHeaders(headers) {
+  const raw = headers.get("x-canopy-identity-roles");
+  if (raw === null) return undefined;
+  return raw
+    .split(",")
+    .map((r) => r.trim())
+    .filter(Boolean);
+}
+
 function userFromHeaders(headers) {
   const sub = (headers.get("x-canopy-user-sub") || "").trim();
   if (!sub) return null;
+  const roles = rolesFromHeaders(headers);
   return {
     sub,
     email: (headers.get("x-canopy-user-email") || "").trim(),
     name: (headers.get("x-canopy-user-name") || "").trim(),
+    ...(roles && { roles }),
   };
 }
 
@@ -979,17 +995,28 @@ function callerFromHeaders(headers) {
   const kind = (headers.get("x-canopy-identity-kind") || "").trim();
   const id = (headers.get("x-canopy-identity-id") || "").trim();
   if ((kind !== "monk" && kind !== "external") || !id) return null;
+  const roles = rolesFromHeaders(headers);
   return {
     kind,
     id,
     email: (headers.get("x-canopy-identity-email") || "").trim(),
     name: (headers.get("x-canopy-identity-name") || "").trim(),
     agent: headers.get("x-canopy-caller") === "agent",
+    ...(roles && { roles }),
   };
 }
 
 function callerFromUser(user) {
-  return user ? { kind: "monk", id: user.sub, email: user.email, name: user.name, agent: false } : null;
+  return user
+    ? {
+        kind: "monk",
+        id: user.sub,
+        email: user.email,
+        name: user.name,
+        agent: false,
+        ...(user.roles && { roles: user.roles }),
+      }
+    : null;
 }
 
 function rewriteCanopyUrl(raw, apiUrl) {
@@ -1576,7 +1603,15 @@ export default {
       // workspace, or an unknown caller, is nobody.
       workerEnv.USER =
         typeof body.user === "object" && body.user !== null && typeof body.user.sub === "string"
-          ? { sub: body.user.sub, email: body.user.email || "", name: body.user.name || "" }
+          ? {
+              sub: body.user.sub,
+              email: body.user.email || "",
+              name: body.user.name || "",
+              // App roles (project-roles), resolved by canopy-api.
+              ...(Array.isArray(body.user.roles) && {
+                roles: body.user.roles.filter((r) => typeof r === "string"),
+              }),
+            }
           : null;
       workerEnv.CALLER = callerFromUser(workerEnv.USER);
       try {

package/dist/{upgrade-DJogeXAF.mjs → upgrade-D_yrD7zp.mjs}

@@ -112,7 +112,7 @@ const upgradeCommand = defineCommand({
 		const spec = `${PACKAGE_NAME}@${args.version ?? "latest"}`;
 		const command = pmCommand(pm);
 		const cmd = installArgs(pm, spec);
-		const { skillInstalled } = await import("./skill-Ct-aCOzg.mjs");
+		const { skillInstalled } = await import("./skill-DRLniv-I.mjs");
 		const { homedir } = await import("node:os");
 		const refreshGlobal = skillInstalled(homedir());
 		const refreshRepo = process.cwd() !== homedir() && skillInstalled(process.cwd());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mediamonks/canopy-cli",
-  "version": "0.7.43",
+  "version": "0.7.44",
   "description": "Canopy CLI — create, develop and deploy Canopy projects.",
   "bin": {
     "canopy": "./dist/index.mjs"
@@ -22,7 +22,7 @@
     "esbuild": "^0.28.1",
     "hono": "^4.8.0",
     "vite-server": "npm:vite@^7",
-    "@mediamonks/canopy": "0.0.12",
+    "@mediamonks/canopy": "0.0.13",
     "@mediamonks/canopy-data-plane": "0.0.4"
   },
   "devDependencies": {

package/dist/dev-BmI5kwoG.mjs

@@ -1,2 +0,0 @@
-import { n as devCommand } from "./dev-adLLSY1F.mjs";
-export { devCommand };