@milesroxas/design-hub 0.1.2 → 0.1.3

package/dist/scripts/bootstrap.d.ts

@@ -29,6 +29,10 @@ export declare const spec: {
             readonly type: 'string';
             readonly description: 'Link this Vercel project and set the password gate env on it.';
         };
+        readonly team: {
+            readonly type: 'string';
+            readonly description: 'The Vercel team (its slug) the project lives in or is created in. Absent, the CLI’s current team.';
+        };
         readonly 'gate-password': {
             readonly type: 'string';
             readonly description: 'The share password (8+ characters). Given again, it rotates.';

package/dist/scripts/bootstrap.js

@@ -12,7 +12,7 @@ import { readEnv, writeEnv } from '../server/env.js';
 import { ROOT, TEMPLATES } from '../server/paths.js';
 import { CliError } from './lib/cli.js';
 import { holderOf, pickPort, readClaims, writeClaim } from './lib/ports.js';
-import { ENVIRONMENTS, envNames, linkedProject, STORE_ENV, setEnv, vercel, } from './lib/vercel.js';
+import { ENVIRONMENTS, envNames, linkedOrg, linkedProject, STORE_ENV, setEnv, vercel, } from './lib/vercel.js';
 export const spec = {
     name: 'bootstrap',
     summary: 'Set the project up on this machine, and optionally on Vercel. Safe to run again.',
@@ -26,6 +26,10 @@ export const spec = {
         conductor: { type: 'boolean', description: 'Write .conductor/settings.toml for Conductor workspaces.' },
         branch: { type: 'string', default: 'main', description: 'The branch Conductor workspaces land on.' },
         vercel: { type: 'string', description: 'Link this Vercel project and set the password gate env on it.' },
+        team: {
+            type: 'string',
+            description: 'The Vercel team (its slug) the project lives in or is created in. Absent, the CLI’s current team.',
+        },
         'gate-password': {
             type: 'string',
             description: 'The share password (8+ characters). Given again, it rotates.',
@@ -120,13 +124,15 @@ function cli(args, input) {
         });
     return out.stdout;
 }
-function link(project, warnings) {
+function link(project, team, warnings) {
     const current = linkedProject(ROOT);
     if (current === project)
         return 'kept';
     if (current)
         warnings.push(`.vercel/project.json pointed at ${current}; relinked to ${project}.`);
-    cli(['link', '--yes', '--project', project]);
+    // A new project is created in the scope given; without one the CLI's current team wins, which
+    // is whichever team the user last switched to, not necessarily where this project belongs.
+    cli(['link', '--yes', '--project', project, ...(team ? ['--scope', team] : [])]);
     return 'ran';
 }
 /** Sets each value where it is missing; `rotate` names the ones given again, which replace what is there. */
@@ -169,7 +175,21 @@ function pullValues(target, names) {
         rmSync(dir, { recursive: true, force: true });
     }
 }
-function provisionReview(project, warnings) {
+/** `--scope` for the commands that name the project instead of reading the link. */
+const scopeArgs = (team) => {
+    const scope = team ?? linkedOrg(ROOT);
+    return scope ? ['--scope', scope] : [];
+};
+/**
+ * Vercel Authentication is on for every new project on a team, and it sends each
+ * visitor to a Vercel login before the gate. The gate is the protection, so it goes
+ * off. Idempotent: disabling twice is fine.
+ */
+function protection(project, team) {
+    cli(['project', 'protection', 'disable', project, '--sso', ...scopeArgs(team)]);
+    return 'off';
+}
+function provisionReview(project, team, warnings) {
     const names = envNames(ROOT, 'production');
     let store = 'kept';
     if (!names || !STORE_ENV.every((n) => names.has(n))) {
@@ -186,6 +206,8 @@ function provisionReview(project, warnings) {
             '-e',
             'development',
             '--no-env-pull',
+            // Unlike env and deploy, this command ignores the project link and takes the CLI's current team.
+            ...scopeArgs(team),
         ]);
         if (out?.status !== 0)
             throw new CliError('Could not add the Upstash for Redis store.', {
@@ -226,7 +248,7 @@ export function gateValues(given, env) {
     return { password, secret, rotated: given !== undefined && given !== env.GATE_PASSWORD };
 }
 function setUpVercel(project, flags, env, typesafeKey, warnings) {
-    const linked = link(project, warnings);
+    const linked = link(project, flags.team, warnings);
     const { password, secret, rotated } = gateValues(flags['gate-password'], env);
     writeEnv(ROOT, { GATE_PASSWORD: password, GATE_SECRET: secret });
     const values = { GATE_PASSWORD: password, GATE_SECRET: secret };
@@ -236,13 +258,18 @@ function setUpVercel(project, flags, env, typesafeKey, warnings) {
     if (rotated)
         warnings.push('The password changed: every visitor signs in again.');
     const result = {
-        vercel: { project, linked, env: ensureEnv(values, new Set(rotated ? ['GATE_PASSWORD'] : [])) },
+        vercel: {
+            project,
+            linked,
+            protection: protection(project, flags.team),
+            env: ensureEnv(values, new Set(rotated ? ['GATE_PASSWORD'] : [])),
+        },
         share: { password },
     };
     if (!flags.review)
         return result;
     warnings.push('Redeploy so the new env reaches the site; then design-hub people invite --name "<you>" --role editor.');
-    return { ...result, review: provisionReview(project, warnings) };
+    return { ...result, review: provisionReview(project, flags.team, warnings) };
 }
 function envIgnored(warnings) {
     try {

package/dist/scripts/lib/vercel.d.ts

@@ -8,7 +8,9 @@ export type Run = {
     stderr: string;
 };
 export declare function vercel(cwd: string, args: string[], input?: string): Run | null;
-export declare function linkedProject(cwd: string): string | null;
+export declare const linkedProject: (cwd: string) => string | null;
+/** The team the linked project belongs to. The commands that take a project name instead of the link need it as `--scope`. */
+export declare const linkedOrg: (cwd: string) => string | null;
 /** The variable names set for a target, read from `vercel env ls`'s table. */
 export declare function envNames(cwd: string, target: Target): Set<string> | null;
 /** Sets one variable for one target; `force` replaces a value that is already there. */

package/dist/scripts/lib/vercel.js

@@ -15,17 +15,20 @@ export function vercel(cwd, args, input) {
         return null;
     return { status: out.status ?? 1, stdout: out.stdout ?? '', stderr: out.stderr ?? '' };
 }
-export function linkedProject(cwd) {
+function readLink(cwd) {
     const file = join(cwd, '.vercel', 'project.json');
     if (!existsSync(file))
         return null;
     try {
-        return JSON.parse(readFileSync(file, 'utf8')).projectName ?? null;
+        return JSON.parse(readFileSync(file, 'utf8'));
     }
     catch {
         return null;
     }
 }
+export const linkedProject = (cwd) => readLink(cwd)?.projectName ?? null;
+/** The team the linked project belongs to. The commands that take a project name instead of the link need it as `--scope`. */
+export const linkedOrg = (cwd) => readLink(cwd)?.orgId ?? null;
 /** The variable names set for a target, read from `vercel env ls`'s table. */
 export function envNames(cwd, target) {
     const out = vercel(cwd, ['env', 'ls', target]);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@milesroxas/design-hub",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "The Design Hub product: the hub that lists and serves prototypes, the review panel and its API, the password gate, the kit, and the design-hub CLI. A project installs it and keeps only its prototypes, kit materials and docs.",
   "license": "MIT",
   "repository": {

package/skills/miles-deploy/SKILL.md

@@ -34,11 +34,12 @@ Never send the link with a failed step, and never skip one with `--skip` without
 1. The user signs in once, in their own terminal: `vercel login`. It is interactive; never run it for them.
 2. From the project root:
    ```bash
-   pnpm bootstrap --vercel <project-name>
+   pnpm bootstrap --vercel <project-name> --team <team-slug>
    ```
-   It links the project, writes `GATE_PASSWORD` (12 readable characters, or `--gate-password <word>`) and a fresh `GATE_SECRET` to `.env` and to Production and Preview, and prints the password in `share.password`. A second run keeps what is set.
+   `--team` is the Vercel team the project is created in (`vercel teams ls` lists them); without it the CLI's current team wins, which is often not the one the user means. It links the project, writes `GATE_PASSWORD` (12 readable characters, or `--gate-password <word>`) and a fresh `GATE_SECRET` to `.env` and to Production and Preview, and prints the password in `share.password`. A second run keeps what is set.
 3. `pnpm preflight`, then push `main` (or `vercel --prod` from the project root).
-4. The handover message, in one message: the URL, the password, which prototype to open (the sprint's slug), the walkthrough at `/guide/<feature>/`, and that Controls is the round button at the top of the page. A reviewer who is not told about Controls reviews one state. Never send `GATE_SECRET`.
+4. On a Pro team Vercel turns Vercel Authentication on for every new project, which sends each visitor to a Vercel login before the gate. Turn it off for Production once: Project Settings, Deployment Protection, Vercel Authentication, set to Only Preview Deployments or Disabled. The hub's gate is the protection. Test by opening the production URL in a private window: the password page must appear, not vercel.com.
+5. The handover message, in one message: the URL, the password, which prototype to open (the sprint's slug), the walkthrough at `/guide/<feature>/`, and that Controls is the round button at the top of the page. A reviewer who is not told about Controls reviews one state. Never send `GATE_SECRET`.
 
 ## Comments