@pplethai/cli 0.5.1 → 0.7.0

package/templates/golden-path/test/legal-identity.test.ts

@@ -0,0 +1,256 @@
+// KYC Status on the actor, and getLegalIdentity (issue #216). Every refusal
+// the helper can return is named here. The offline path never yields a
+// citizen ID that would pass the Thai checksum.
+
+import { describe, expect, it, vi } from "vitest";
+import { DEV_PERSONAS } from "../src/dev-personas";
+import {
+  getLegalIdentity,
+  kycStartUrl,
+  OFFLINE_INVALID_ID,
+  OFFLINE_LEGAL_NAME,
+  thaiIdChecksumValid,
+  type LegalIdentityReason,
+} from "../src/legal-identity";
+import { makeHarness } from "./harness";
+
+describe("actor.kyc", () => {
+  it("gives every Persona a KYC Status, and members are verified via membership", () => {
+    for (const persona of Object.values(DEV_PERSONAS)) {
+      expect(persona.actor.kyc).toEqual(
+        expect.objectContaining({
+          status: expect.any(String),
+          verified: expect.any(Boolean),
+        }),
+      );
+      expect("kyc" in persona.effective).toBe(false);
+    }
+    expect(DEV_PERSONAS["hq-staff"]!.actor.kyc).toMatchObject({
+      status: "verified",
+      verified: true,
+      source: "membership",
+    });
+    expect(DEV_PERSONAS.unverified!.actor.kyc.status).toBe("none");
+    expect(DEV_PERSONAS["kyc-pending"]!.actor.kyc.status).toBe("pending_review");
+    expect(DEV_PERSONAS["kyc-verified-nonmember"]!.actor.kyc).toMatchObject({
+      status: "verified",
+      source: "kyc",
+    });
+  });
+
+  it("keeps the delegate's KYC Status, not the supervisor's", async () => {
+    const delegate = makeHarness({}, { DEV_PERSONA: "delegate" });
+    const supervisor = makeHarness({}, { DEV_PERSONA: "province-coordinator" });
+    const delegateMe = await (await delegate.request("/api/me")).json<{
+      actor: { kyc: { verifiedAt: string; source: string } };
+      effective: Record<string, unknown>;
+    }>();
+    const supervisorMe = await (await supervisor.request("/api/me")).json<{
+      actor: { kyc: { verifiedAt: string } };
+    }>();
+    expect(delegateMe.actor.kyc.verifiedAt).toBe("2024-04-01T00:00:00.000Z");
+    expect(delegateMe.actor.kyc.verifiedAt).not.toBe(supervisorMe.actor.kyc.verifiedAt);
+    expect(delegateMe.actor.kyc.source).toBe("membership");
+    expect(delegateMe.effective.kyc).toBeUndefined();
+  });
+
+  it("parses userinfo kyc onto the actor only, including a delegated session", async () => {
+    const h = makeHarness(
+      {
+        sso: () =>
+          Response.json({
+            sub: "u-delegate",
+            name: "Nok",
+            kyc: {
+              status: "verified",
+              verified: true,
+              verifiedAt: "2024-06-01T00:00:00.000Z",
+              source: "kyc",
+            },
+            ad: {
+              user: { id: 9, role: "province", mobile: "0810000009" },
+              actualPpleUser: { id: 14, role: "delegate", mobile: "0810000014" },
+              activeRole: "province",
+              eligibleRoles: ["province"],
+              eligibleProvinces: ["เชียงใหม่"],
+            },
+          }),
+      },
+      { DEV_PERSONA: "none" },
+    );
+    const me = await (await h.request("/api/me", {}, "valid-token")).json<{
+      actor: { kyc: { source: string; verifiedAt: string } };
+      effective: Record<string, unknown>;
+    }>();
+    expect(me.actor.kyc).toEqual({
+      status: "verified",
+      verified: true,
+      verifiedAt: "2024-06-01T00:00:00.000Z",
+      source: "kyc",
+    });
+    expect(me.effective.kyc).toBeUndefined();
+  });
+
+  it("defaults a userinfo payload with no kyc to none", async () => {
+    const h = makeHarness(
+      {
+        sso: () =>
+          Response.json({
+            sub: "u-42",
+            name: "Somchai",
+            ad: {
+              user: { id: 7, role: "hq", mobile: "0810000007" },
+              actualPpleUser: { id: 7, role: "hq", mobile: "0810000007" },
+              activeRole: "hq",
+              eligibleRoles: ["hq"],
+              eligibleProvinces: ["all"],
+            },
+          }),
+      },
+      { DEV_PERSONA: "none" },
+    );
+    const me = await (await h.request("/api/me", {}, "valid-token")).json<{
+      actor: { kyc: { status: string; verified: boolean; source: null } };
+    }>();
+    expect(me.actor.kyc).toEqual({
+      status: "none",
+      verified: false,
+      verifiedAt: null,
+      source: null,
+    });
+  });
+});
+
+describe("getLegalIdentity offline", () => {
+  it("never returns a checksum-valid citizen ID", async () => {
+    expect(thaiIdChecksumValid(OFFLINE_INVALID_ID)).toBe(false);
+    // A known-valid check digit for the same first 12 digits is 8.
+    expect(thaiIdChecksumValid("1100000000008")).toBe(true);
+
+    for (const name of Object.keys(DEV_PERSONAS)) {
+      const result = await getLegalIdentity({ DEV_PERSONA: name }, "ignored");
+      if (!result.ok) {
+        expect(result.reason).toBe("not_verified");
+        continue;
+      }
+      expect(result.legalIdentity.name).toBe(OFFLINE_LEGAL_NAME);
+      if (result.legalIdentity.idCardNumber !== null) {
+        expect(thaiIdChecksumValid(result.legalIdentity.idCardNumber)).toBe(false);
+      }
+    }
+
+    const member = await getLegalIdentity({ DEV_PERSONA: "hq-staff" }, "t");
+    expect(member).toEqual({
+      ok: true,
+      legalIdentity: { source: "membership", name: OFFLINE_LEGAL_NAME, idCardNumber: null },
+    });
+    const card = await getLegalIdentity({ DEV_PERSONA: "kyc-verified-nonmember" }, "t");
+    expect(card).toEqual({
+      ok: true,
+      legalIdentity: { source: "kyc", name: OFFLINE_LEGAL_NAME, idCardNumber: OFFLINE_INVALID_ID },
+    });
+    expect(await getLegalIdentity({ DEV_PERSONA: "unverified" }, "t")).toEqual({
+      ok: false,
+      reason: "not_verified",
+    });
+    expect(await getLegalIdentity({ DEV_PERSONA: "kyc-pending" }, "t")).toEqual({
+      ok: false,
+      reason: "not_verified",
+    });
+  });
+});
+
+describe("getLegalIdentity against Platform Services", () => {
+  const env = {
+    DEV_PERSONA: "none",
+    PPLE_SERVICES_URL: "https://services.test",
+    PPLE_APP_KEY: "app-key",
+  };
+
+  it("is not_configured until both bindings exist, and does not call out", async () => {
+    const fetchImpl = vi.fn<typeof fetch>();
+    expect(await getLegalIdentity({ DEV_PERSONA: "none" }, "tok", fetchImpl)).toEqual({
+      ok: false,
+      reason: "not_configured",
+    });
+    expect(
+      await getLegalIdentity({ DEV_PERSONA: "none", PPLE_SERVICES_URL: "https://services.test" }, "tok", fetchImpl),
+    ).toEqual({ ok: false, reason: "not_configured" });
+    expect(fetchImpl).not.toHaveBeenCalled();
+  });
+
+  it("names every error the service can return", async () => {
+    const reasons: LegalIdentityReason[] = [
+      "invalid_app_key",
+      "not_granted",
+      "not_verified",
+      "user_token_invalid",
+      "identity_not_enabled",
+      "upstream_unavailable",
+    ];
+    for (const reason of reasons) {
+      const status = reason === "invalid_app_key" || reason === "user_token_invalid" ? 401 : 403;
+      const fetchImpl = vi.fn<typeof fetch>(async () => Response.json({ error: reason }, { status }));
+      expect(await getLegalIdentity(env, "user-token", fetchImpl)).toEqual({ ok: false, reason });
+      const [url, init] = fetchImpl.mock.calls[0]!;
+      expect(url).toBe("https://services.test/legal-identity");
+      expect(new Headers(init?.headers).get("authorization")).toBe("Bearer app-key");
+      expect(JSON.parse(String(init?.body))).toEqual({ token: "user-token" });
+    }
+  });
+
+  it("returns the Legal Identity the service answered with", async () => {
+    const fetchImpl = vi.fn<typeof fetch>(async () =>
+      Response.json({ source: "kyc", name: "นาย ก", idCardNumber: "1100000000008" }),
+    );
+    expect(await getLegalIdentity(env, "user-token", fetchImpl)).toEqual({
+      ok: true,
+      legalIdentity: { source: "kyc", name: "นาย ก", idCardNumber: "1100000000008" },
+    });
+  });
+
+  it("treats a transport failure and a body-less error as upstream_unavailable", async () => {
+    const down = vi.fn<typeof fetch>(async () => {
+      throw new Error("network");
+    });
+    expect(await getLegalIdentity(env, "user-token", down)).toEqual({
+      ok: false,
+      reason: "upstream_unavailable",
+    });
+
+    const odd = vi.fn<typeof fetch>(async () => new Response("nope", { status: 502 }));
+    expect(await getLegalIdentity(env, "user-token", odd)).toEqual({
+      ok: false,
+      reason: "upstream_unavailable",
+    });
+  });
+});
+
+describe("local KYC redirect", () => {
+  it("sends a local click straight back with ?kyc=cancelled", () => {
+    const back = kycStartUrl({
+      ssoBaseUrl: "https://id.example",
+      clientId: "zitadel-app",
+      returnTo: "https://app.example/checkout?step=1#pay",
+      dev: true,
+    });
+    const url = new URL(back);
+    expect(url.origin + url.pathname).toBe("https://app.example/checkout");
+    expect(url.searchParams.get("step")).toBe("1");
+    expect(url.searchParams.get("kyc")).toBe("cancelled");
+    expect(url.hash).toBe("#pay");
+  });
+
+  it("points production at PPLE ID /kyc", () => {
+    expect(
+      kycStartUrl({
+        ssoBaseUrl: "https://id.example",
+        clientId: "zitadel-app",
+        returnTo: "https://app.example/checkout",
+        dev: false,
+      }),
+    ).toBe(
+      "https://id.example/kyc?client_id=zitadel-app&return_to=https%3A%2F%2Fapp.example%2Fcheckout",
+    );
+  });
+});

package/templates/golden-path/wrangler.jsonc

@@ -20,7 +20,8 @@
 
   // The React SPA (built to dist/client by Vite) is served for any request
   // that isn't worker-first. "/api/*" is the app's API; "/.pple/*" is reserved
-  // for the platform deploy probe. "single-page-application" makes every
+  // for the platform (the deploy probe and scheduled jobs) — don't add routes
+  // under it. "single-page-application" makes every
   // other path return index.html so client-side routing works.
   "assets": {
     "not_found_handling": "single-page-application",
@@ -46,6 +47,18 @@
     }
   ],
 
+  // Scheduled jobs (Cron Schedules, "งานตั้งเวลา"). Declare when the app runs
+  // its own code, in UTC (Bangkok is UTC+7: 08:00 in Bangkok is "0 1 * * *"),
+  // and export `scheduled()` beside `fetch` in src/index.ts. The platform fires
+  // them, not Cloudflare, so only standard five-field cron works (lists,
+  // ranges, steps, JAN-DEC months, and weekdays as NAMES only — MON-FRI, never
+  // digits, which count differently from Cloudflare's docs), at most 3 schedules per app and
+  // no closer than 5 minutes. Delivery is at-most-once: no catch-up and no
+  // retry, so write jobs that are safe to repeat. Deploying is the only way to
+  // change this list; `pple cron` shows, pauses and runs them. Uncomment to use:
+  //
+  // "triggers": { "crons": ["0 1 * * *"] },
+
   "vars": {
     // PPLE ID (identity). The Worker validates bearer tokens against this.
     "SSO_BASE_URL": "https://id.peoplesparty.or.th",

package/skills/pple-platform/SKILL.md

@@ -1,114 +0,0 @@
----
-name: pple-platform
-description: >
-  Build Builder Apps on the PPLE Platform — the People's Party (พรรคประชาชน)
-  digital infrastructure: PPLE ID single sign-on, PPLE Today mini-apps and
-  audience-bound push notifications, the @pplethai/components design system,
-  and managed Cloudflare Workers + D1 + R2 hosting via the pple CLI. Use this
-  skill whenever a task mentions PPLE, PPLE ID, PPLE Today, mini-app,
-  พรรคประชาชน, People's Party, @pplethai packages, Builder App, party
-  internal tools, or when scaffolding, authenticating, styling, notifying, or
-  deploying any app in the PPLE ecosystem — even if the user doesn't name the
-  platform explicitly.
----
-
-# Building on the PPLE Platform
-
-The PPLE Platform lets party workforce members (Builders) ship mini-apps
-without holding cloud or GitHub credentials. Every new **Builder App** plugs
-into three pillars on party-managed infrastructure:
-
-1. **PPLE ID** — OIDC single sign-on. End users authenticate via the mini-app
-   SDK (launch token inside **PPLE Today**, or the SDK's PPLE ID browser
-   login); the Worker validates the bearer token against the OIDC `userinfo`
-   endpoint. Builders also use PPLE ID for the Console (browser login) and
-   `pple auth login` (device flow).
-2. **Mini-app integration** — apps run inside PPLE Today's WebView using
-   `@pplethai/pple-today-miniapp-sdk` (and the same SDK in a plain browser),
-   and send audience-bound notifications — a **Broadcast** to everyone this
-   app can reach, or a **Direct** send to people it names — through the
-   platform-provisioned notify helper.
-3. **PPLE Design System** — `@pplethai/components`, a shadcn/ui-based React
-   library with party branding. Docs: https://components.pplethai.org/
-
-## Standard tech stack (Builder Apps)
-
-Use this stack for every new Builder App unless the user is working on a
-central-team core service — uniformity is deliberate (ADR-0002):
-
-| Layer        | Choice |
-| ------------ | ------ |
-| Runtime      | One Cloudflare Worker serves `/api/*` and the React SPA |
-| Frontend     | Vite + React 19 + TypeScript + `@pplethai/components` |
-| Backend      | Hono + TypeScript on the Workers runtime |
-| Database     | D1 (SQLite) via bound queries + SQL migrations |
-| Files        | R2 |
-| Validation   | Zod schemas in `shared/` |
-| Auth         | PPLE ID (OIDC `userinfo`); local `DEV_AUTH` bypass only |
-| Notifications| `src/notify.ts` — every send states its audience (`all` or `direct`) |
-| Deploy       | `pple deploy` (platform build → tenant Worker); never personal cloud |
-
-**Not the Builder App path** (do not resurrect these for new apps): Express +
-Prisma + PostgreSQL, Docker / Cloud Build / Artifact Registry, or a separate
-Cloudflare Pages project for the SPA. Those belong to older reference apps
-and central-team services, not the Workers golden path.
-
-Source of truth for new apps:
-
-- **`pple-platform/template`** — the golden-path seed `pple init` copies.
-  Prefer this over obsolete examples (`pple-erp`, `mini-app-example`).
-
-## Which reference to read
-
-Read only the file(s) relevant to the task at hand:
-
-| Task | Read |
-| ---- | ---- |
-| Start a new app / local layout & commands | [references/project-scaffold.md](references/project-scaffold.md) |
-| Login, tokens, browser PPLE ID flow, DEV_AUTH | [references/pple-id-auth.md](references/pple-id-auth.md) |
-| Mini-app SDK behavior, push notifications | [references/mini-app.md](references/mini-app.md) |
-| UI, styling, components | [references/design-system.md](references/design-system.md) |
-| Create → init → deploy; status / usage (`pple info`) | [references/deployment.md](references/deployment.md) |
-
-## Golden path for a new app
-
-1. **Sign in on the machine**: `pple auth login` (PPLE ID device flow; no
-   personal cloud credentials — ADR-0005).
-2. **Create + scaffold** — pick one path (both use the same Provisioner
-   create; the App Slug is always platform-generated):
-   - **CLI create**: `pple init` (prompts for App Name) or
-     `pple init --name "<App Name>"` (non-interactive) — creates the app,
-     waits until it is ready, then scaffolds and writes the App Link.
-   - **Console create**: create in the Console (`console.ppleth.ai`), then
-     `pple init <slug>` to scaffold and link the folder.
-3. **Build** against the template helpers (`auth`, `db`, `files`, `notify`)
-   and `@pplethai/components` (see the reference files).
-4. **Ship**: `pple deploy` — the platform builds and puts the app live.
-5. **Status / usage**: `pple info` (from a linked folder, or
-   `pple info <slug>`) — read-only overview, usage vs Resource Limits,
-   recent deploys, env key list. Invites, Requests, and collaborators stay
-   Console-only (see [deployment.md](references/deployment.md)).
-
-## Invariants — things that are true no matter what you build
-
-- **Mini-apps authenticate through the mini-app SDK.** Inside PPLE Today the
-  SDK reads the launch-URL token; in a plain browser it runs the PPLE ID
-  OIDC login. Do not add a NotInApp guard or a custom browser sign-in page.
-  Local development uses `DEV_AUTH` in `.dev.vars` only — never provisioned
-  in production. (Builders separately hold tokens from Console login and
-  `pple auth login`.)
-- **Never mention git, branches, remotes, GitHub, Cloudflare accounts, or
-  personal deploy credentials** in the happy path. Talk about the app's
-  code and `pple init` / `pple deploy` only.
-- **Notifications are audience-bound.** Every send states its audience:
-  Broadcast `{ kind: "all" }` or Direct `{ kind: "direct", recipients }`
-  (by `sub` or `phone`). Naming narrows the reachable set and never widens
-  it; `not_reachable` is one collapsed status — do not decompose it.
-  Self-links only (`linkPath` into this app). Shape in `shared/api.ts`;
-  details in [mini-app.md](references/mini-app.md).
-- **Stack is Workers + D1 + R2.** Bind D1 parameters; never concatenate SQL.
-  One Worker, same origin — no CORS between SPA and API.
-- **`DEV_AUTH` must be unset in production.** Its absence is what forces real
-  PPLE ID validation.
-- **Design tokens are CSS variables** from `@pplethai/components/styles.css`.
-  Prefer design-system components over hardcoding brand colors.

package/skills/pple-platform/evals/evals.json

@@ -1,29 +0,0 @@
-{
-  "skill_name": "pple-platform",
-  "evals": [
-    {
-      "id": 1,
-      "prompt": "I created an app called brave-otter in the Console. Help me get it running locally and understand the project layout so I can add features with my AI agent.",
-      "expected_output": "pple auth login → pple init brave-otter; single-package Workers template (src/ Hono Worker, web/ React, shared/ Zod, migrations/ D1); npm install, .dev.vars from example, db:migrate:local, npm run dev; DEV_AUTH local bypass; no Express/Prisma/Pages scaffold",
-      "files": []
-    },
-    {
-      "id": 2,
-      "prompt": "When a reimbursement is approved, send a push notification to that one person. We already have their PPLE ID sub. Use the PPLE notification service the platform wired up.",
-      "expected_output": "Use src/notify.ts sendNotification with required audience { kind: \"direct\", recipients: [{ sub }] } (or { phone }); title+body; optional path-only linkPath self-link into this app; naming narrows the reachable set and never widens it; not_reachable is one collapsed status — do not decompose it; never omit audience; never reimplement the wire POST; never free-form / cross-app destinations; never legacy /external/notifications/send with PHONE_NUMBER; Broadcast to everyone this app can reach is { kind: \"all\" }",
-      "files": []
-    },
-    {
-      "id": 3,
-      "prompt": "How do I put my changes live? Set up deployment for this Builder App.",
-      "expected_output": "pple deploy (after pple auth login); managed Workers+D1+R2; no Dockerfile, Cloud Build, Artifact Registry, or separate Cloudflare Pages project; no git/GitHub credential instructions in the happy path",
-      "files": []
-    },
-    {
-      "id": 4,
-      "prompt": "The app should work when I open it in Chrome on my laptop. Add a normal browser login with PPLE ID.",
-      "expected_output": "Use the mini-app SDK's existing browser PPLE ID flow (web/pple.ts bootstrap → sdk.init); do not add a custom OAuth login page or a NotInApp / open-in-Today-only guard; local DEV_AUTH only for vite dev — do not claim tokens only exist inside PPLE Today as a platform-wide absolute (Console/CLI hold Builder tokens; end users can also sign in via the SDK browser flow)",
-      "files": []
-    }
-  ]
-}

package/skills/pple-platform/references/deployment.md

@@ -1,129 +0,0 @@
-# Deployment (managed Workers hosting)
-
-Builder Apps run only on party-managed Cloudflare infrastructure
-(ADR-0001, ADR-0002). Builders never hold cloud or GitHub credentials
-(ADR-0005). The happy path uses the Console and the `pple` CLI — not git
-vocabulary, Docker, Cloud Build, or personal Cloudflare/Pages projects.
-
-Ops detail for create, status, and what stays Console-only lives here
-(ADR-0006: the Skill owns deeper platform guidance; `CLAUDE.md` stays
-short).
-
-## Happy path
-
-```bash
-pple auth login              # PPLE ID device flow on this machine
-
-# Create + scaffold — either path works:
-pple init                    # prompt for App Name → create → wait → scaffold
-# or: pple init --name "My App"   # non-interactive create (agents/scripts)
-# or: create in Console (console.ppleth.ai), then:
-#     pple init <slug>            # scaffold an app that already exists
-
-# …edit locally with npm run dev…
-pple deploy -m "short note"  # send changes; platform builds and goes live
-pple info                    # read-only status, usage vs limits, deploys
-```
-
-What the Builder hears: the app's name and live URL (e.g.
-`https://brave-otter.ppleth.ai`). Not branches, remotes, registries, or
-source-control jargon.
-
-| Command | Meaning for the Builder |
-| ------- | ----------------------- |
-| `pple auth login` | Sign in with PPLE ID |
-| `pple init` / `pple init --name "…"` | Create a new app, wait until ready, scaffold + App Link |
-| `pple init <slug>` | Set up an existing app's code on this computer |
-| `pple deploy` | Send changes and put them live |
-| `pple info` / `pple info <slug>` | Read-only status, usage vs Resource Limits, deploys |
-| `pple env list` / `set` / `delete` | Manage env vars and secrets (effect on next deploy) |
-| `pple whoami` / `pple auth logout` | Check / forget this machine's sign-in |
-
-## Creating an app (`pple init`)
-
-Same Provisioner create as the Console (`POST /apps`). The **App Slug** is
-always platform-generated — Builders choose only the **App Name**.
-
-| Invocation | Behavior |
-| ---------- | -------- |
-| `pple init` (TTY, no App Link in cwd) | Prompt for App Name → create → poll until ready → scaffold |
-| `pple init --name "<App Name>"` | Non-interactive create → poll → scaffold (agents/scripts) |
-| `pple init` non-TTY without `--name` or slug | Error clearly — do not hang waiting on stdin |
-| `pple init <slug>` | Scaffold an app that already exists (e.g. Console-created) |
-| `pple init` inside a folder with an App Link | **Refuse** — already linked; use `pple info` / `pple deploy`, or `cd` elsewhere to create another app |
-
-After create, the CLI **blocks/polls** until the app is ready to scaffold
-(repo present, not stuck in `provisioning`). On timeout it fails loudly and
-prints the App Slug so the Builder can retry with `pple init <slug>`. If
-scaffold fails after a successful create, the app still exists on the
-platform (same as Console-then-init).
-
-## Status and usage (`pple info`)
-
-Read-only terminal mirror of the Console app dashboard for one Builder App.
-**No mutations.**
-
-- Resolve the app from the **App Link** (`.pple/app.json`) when run inside
-  an app folder, **or** from `pple info <slug>`.
-- No App Link and no slug → clear error: `cd` into the app, pass a slug, or
-  use the Console.
-- Prints safe dashboard surfaces:
-  - Overview (App Name, App Slug, URL, status, Publication Tier, role, …)
-  - Usage vs Resource Limits — treat `null` usage fields as unavailable,
-    not zero (same semantics as Console)
-  - Recent deploys
-  - Env key list — secrets: key present only, never values
-  - Owner-only surfaces (publication / collaborators / request history as
-    the Console shows): include when the caller is Owner; **omit** for
-    Collaborators (same gates as Console — do not fail the whole command)
-
-## Console vs CLI
-
-| Need | Where |
-| ---- | ----- |
-| Create app | Console **or** `pple init` / `pple init --name` |
-| Scaffold / link locally | `pple init <slug>` (or create path above) |
-| Deploy | `pple deploy` |
-| Read status / usage / deploys / env keys | `pple info` (or Console) |
-| Env vars & secrets | Console **or** `pple env` |
-| Beta invites, Publication Tier / PublishRequest | **Console only** |
-| File ScopeRequest / LimitRequest / ChangeRequest / RetireRequest | **Console only** |
-| Manage Collaborators | **Console only** |
-| Dataset catalog / App Scope browsing | **Console only** |
-| Platform Admin approval queue | **Console only** |
-
-Point Builders at the Console (`console.ppleth.ai`) for anything in the
-Console-only rows — do not invent CLI flags for those.
-
-## What the platform owns
-
-- **Hosting**: Workers for Platforms dispatch namespace; one tenant Worker per
-  app serving API + static assets; D1 database; R2 bucket.
-- **Identity bindings**: `SSO_BASE_URL`, OAuth client env for the SPA,
-  audience-bound `NOTIFY_API_BASE` / `NOTIFY_API_KEY`.
-- **The app's code**: stored and shipped by the platform. `pple init` /
-  `pple deploy` authenticate under the hood — the Builder never configures
-  a source-control account or pastes a deploy token.
-- **Config / secrets**: set in the Console or via `pple env`; applied as
-  Worker bindings on the **next** deploy. Secrets are write-only (set/unset,
-  never read back).
-
-## Local vs production auth
-
-- Local: `DEV_AUTH` in `.dev.vars` (see [pple-id-auth.md](pple-id-auth.md)).
-- Production: `DEV_AUTH` must be absent. The platform never provisions it.
-
-## Archived / do-not-use for Builder Apps
-
-These were the previous golden path. Do not set them up for new Builder Apps:
-
-- Separate **Cloudflare Pages** project for a Vite SPA + Dockerized Express API
-- **Google Cloud Build** / Kaniko / Artifact Registry Docker deploys
-- Asking the Builder to sign into GitHub, create a Cloudflare account, or
-  paste long-lived deploy tokens
-- `api/Dockerfile` + `api/cloudbuild.yaml` monorepo layouts copied from
-  older Express-era apps
-
-If the user is maintaining a central-team service that still uses those
-tools, say so explicitly — that is outside the Builder App path this skill
-steers.

package/skills/pple-platform/references/design-system.md

@@ -1,55 +0,0 @@
-# PPLE Design System (@pplethai/components)
-
-`@pplethai/components` is the party's React component library, built on
-shadcn/ui. Live docs: **https://components.pplethai.org/**
-
-Builder Apps start with the golden-path template (`pple-platform/template`),
-which already imports the library. Prefer editing that wiring over
-reinventing a design-system setup from `pple-erp` or other older apps.
-
-## Consumer setup (already in the template)
-
-```tsx
-// web/main.tsx — design-system CSS first, then local layout
-import "@pplethai/components/styles.css";
-import "./app.css";
-
-import { Button, Card, CardContent, Navbar } from "@pplethai/components";
-```
-
-Package entry points:
-
-| Import | Contents |
-| ------ | -------- |
-| `@pplethai/components` | UI primitives, layout, brand (`Navbar`, `Logo`, …), `cn()`, toasts |
-| `@pplethai/components/form` | react-hook-form helpers when you need forms |
-| `@pplethai/components/styles.css` | Brand tokens — import once |
-
-Vite note (template already pins this): the package's `"development"` export
-can point at unpublished source. Keep the template's resolve alias that pins
-the bare `@pplethai/components` import to `dist/index.js`.
-
-## Layout conventions in Builder Apps
-
-- Put **page layout** in `web/app.css` (mobile-first, safe-area padding for
-  the WebView). Do not fight the design-system stylesheet with a second
-  full Tailwind stack unless you need it.
-- Top-level chrome uses Shared `<Navbar>` (see `web/App.tsx`). Do not hand-roll
-  a header/app bar with `Logo`. With a client router, pass `renderHomeLink` /
-  `renderLink` (as in pple-erp); otherwise default `<a href>` links are fine.
-  Navbar is `position: fixed` below the `md` breakpoint — pad the page content
-  accordingly (the template's `.screen` already does).
-- Compose screens from design-system components (`Card`, `Button`, `Input`,
-  `Textarea`, `Badge`, `Alert`, …) like the demo cards in `web/App.tsx`.
-- **Colors and type** come from CSS variables in `styles.css`
-  (`--primary`, fonts, gradients). Prefer components and those tokens over
-  hardcoded hex brand colors.
-- Typography: headings **Anakotmai**, body **IBM Plex Sans Thai Looped** —
-  both arrive with `styles.css`.
-
-## Filling gaps
-
-When the library lacks a component, generate a local shadcn/ui piece into
-your app and keep tokens aligned — or stick to plain markup + `app.css`.
-Prefer `@pplethai/components` whenever an equivalent exists so apps stay
-visually consistent.