@zanfia/cli 0.10.0 → 0.13.1

package/README.md

@@ -36,6 +36,22 @@ zanfia emails test purchase-confirmation --lang en   # queued to YOUR own addres
 Raw HTTP: `GET|PATCH /email-templates`, `POST /email-templates/{key}/test-sends`. Full reference for every
 command group: `.claude/skills/zanfia-cli/SKILL.md`.
 
+## Community member keys (read-only option)
+
+A member key acts as a creator's customer in their communities (Community API + the member MCP
+tools), never in a workspace. Three ways to get one:
+
+```bash
+zanfia login --address https://<creator-platform-url> [--read-only]   # browser consent on that platform
+zanfia join <handle> [--read-only]                                      # public community, emailed code
+zanfia auth set-key --api-url <api-community-url> <key>                 # key from the platform's settings
+```
+
+`--read-only` (or „Tylko odczyt” when generating a key under **Settings → AI agents** on the
+platform) grants `communities:read` only: the key reads and summarizes, and
+every write (post, comment, chat, ticket) gets a 403 / a refused MCP tool. `zanfia auth status` and
+`zanfia whoami` show the scope, e.g. `scope : communities:read (read-only)`.
+
 ## Auth resolution order
 
 1. `--api-key` flag

package/dist/index.js

@@ -33,9 +33,9 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
-// node_modules/commander/lib/error.js
+// ../../../Zanfia2/apps/cli/node_modules/commander/lib/error.js
 var require_error = __commonJS({
-  "node_modules/commander/lib/error.js"(exports) {
+  "../../../Zanfia2/apps/cli/node_modules/commander/lib/error.js"(exports) {
     "use strict";
     var CommanderError2 = class extends Error {
       /**
@@ -69,9 +69,9 @@ var require_error = __commonJS({
   }
 });
 
-// node_modules/commander/lib/argument.js
+// ../../../Zanfia2/apps/cli/node_modules/commander/lib/argument.js
 var require_argument = __commonJS({
-  "node_modules/commander/lib/argument.js"(exports) {
+  "../../../Zanfia2/apps/cli/node_modules/commander/lib/argument.js"(exports) {
     "use strict";
     var { InvalidArgumentError: InvalidArgumentError2 } = require_error();
     var Argument2 = class {
@@ -197,9 +197,9 @@ var require_argument = __commonJS({
   }
 });
 
-// node_modules/commander/lib/help.js
+// ../../../Zanfia2/apps/cli/node_modules/commander/lib/help.js
 var require_help = __commonJS({
-  "node_modules/commander/lib/help.js"(exports) {
+  "../../../Zanfia2/apps/cli/node_modules/commander/lib/help.js"(exports) {
     "use strict";
     var { humanReadableArgName } = require_argument();
     var Help2 = class {
@@ -612,9 +612,9 @@ var require_help = __commonJS({
   }
 });
 
-// node_modules/commander/lib/option.js
+// ../../../Zanfia2/apps/cli/node_modules/commander/lib/option.js
 var require_option = __commonJS({
-  "node_modules/commander/lib/option.js"(exports) {
+  "../../../Zanfia2/apps/cli/node_modules/commander/lib/option.js"(exports) {
     "use strict";
     var { InvalidArgumentError: InvalidArgumentError2 } = require_error();
     var Option2 = class {
@@ -885,9 +885,9 @@ var require_option = __commonJS({
   }
 });
 
-// node_modules/commander/lib/suggestSimilar.js
+// ../../../Zanfia2/apps/cli/node_modules/commander/lib/suggestSimilar.js
 var require_suggestSimilar = __commonJS({
-  "node_modules/commander/lib/suggestSimilar.js"(exports) {
+  "../../../Zanfia2/apps/cli/node_modules/commander/lib/suggestSimilar.js"(exports) {
     "use strict";
     var maxDistance = 3;
     function editDistance(a, b) {
@@ -966,9 +966,9 @@ var require_suggestSimilar = __commonJS({
   }
 });
 
-// node_modules/commander/lib/command.js
+// ../../../Zanfia2/apps/cli/node_modules/commander/lib/command.js
 var require_command = __commonJS({
-  "node_modules/commander/lib/command.js"(exports) {
+  "../../../Zanfia2/apps/cli/node_modules/commander/lib/command.js"(exports) {
     "use strict";
     var EventEmitter = __require("events").EventEmitter;
     var childProcess = __require("child_process");
@@ -3010,9 +3010,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
   }
 });
 
-// node_modules/commander/index.js
+// ../../../Zanfia2/apps/cli/node_modules/commander/index.js
 var require_commander = __commonJS({
-  "node_modules/commander/index.js"(exports) {
+  "../../../Zanfia2/apps/cli/node_modules/commander/index.js"(exports) {
     "use strict";
     var { Argument: Argument2 } = require_argument();
     var { Command: Command4 } = require_command();
@@ -3033,9 +3033,9 @@ var require_commander = __commonJS({
   }
 });
 
-// ../../node_modules/requires-port/index.js
+// ../../../Zanfia2/node_modules/requires-port/index.js
 var require_requires_port = __commonJS({
-  "../../node_modules/requires-port/index.js"(exports, module) {
+  "../../../Zanfia2/node_modules/requires-port/index.js"(exports, module) {
     "use strict";
     module.exports = function required(port, protocol) {
       protocol = protocol.split(":")[0];
@@ -3060,9 +3060,9 @@ var require_requires_port = __commonJS({
   }
 });
 
-// ../../node_modules/querystringify/index.js
+// ../../../Zanfia2/node_modules/querystringify/index.js
 var require_querystringify = __commonJS({
-  "../../node_modules/querystringify/index.js"(exports) {
+  "../../../Zanfia2/node_modules/querystringify/index.js"(exports) {
     "use strict";
     var has = Object.prototype.hasOwnProperty;
     var undef;
@@ -3112,9 +3112,9 @@ var require_querystringify = __commonJS({
   }
 });
 
-// ../../node_modules/url-parse/index.js
+// ../../../Zanfia2/node_modules/url-parse/index.js
 var require_url_parse = __commonJS({
-  "../../node_modules/url-parse/index.js"(exports, module) {
+  "../../../Zanfia2/node_modules/url-parse/index.js"(exports, module) {
     "use strict";
     var required = require_requires_port();
     var qs = require_querystringify();
@@ -3420,9 +3420,9 @@ var require_url_parse = __commonJS({
   }
 });
 
-// ../../node_modules/is-stream/index.js
+// ../../../Zanfia2/node_modules/is-stream/index.js
 var require_is_stream = __commonJS({
-  "../../node_modules/is-stream/index.js"(exports, module) {
+  "../../../Zanfia2/node_modules/is-stream/index.js"(exports, module) {
     "use strict";
     var isStream2 = (stream) => stream !== null && typeof stream === "object" && typeof stream.pipe === "function";
     isStream2.writable = (stream) => isStream2(stream) && stream.writable !== false && typeof stream._write === "function" && typeof stream._writableState === "object";
@@ -3433,9 +3433,9 @@ var require_is_stream = __commonJS({
   }
 });
 
-// ../../node_modules/lodash.throttle/index.js
+// ../../../Zanfia2/node_modules/lodash.throttle/index.js
 var require_lodash = __commonJS({
-  "../../node_modules/lodash.throttle/index.js"(exports, module) {
+  "../../../Zanfia2/node_modules/lodash.throttle/index.js"(exports, module) {
     "use strict";
     var FUNC_ERROR_TEXT = "Expected a function";
     var NAN = 0 / 0;
@@ -3582,9 +3582,9 @@ var require_lodash = __commonJS({
   }
 });
 
-// ../../node_modules/custom-error-instance/bin/factories.js
+// ../../../Zanfia2/node_modules/custom-error-instance/bin/factories.js
 var require_factories = __commonJS({
-  "../../node_modules/custom-error-instance/bin/factories.js"(exports) {
+  "../../../Zanfia2/node_modules/custom-error-instance/bin/factories.js"(exports) {
     "use strict";
     exports.expectReceive = function(properties, configuration, factory) {
       var message;
@@ -3655,9 +3655,9 @@ var require_factories = __commonJS({
   }
 });
 
-// ../../node_modules/custom-error-instance/bin/error.js
+// ../../../Zanfia2/node_modules/custom-error-instance/bin/error.js
 var require_error2 = __commonJS({
-  "../../node_modules/custom-error-instance/bin/error.js"(exports, module) {
+  "../../../Zanfia2/node_modules/custom-error-instance/bin/error.js"(exports, module) {
     "use strict";
     module.exports = CustomError;
     CustomError.factory = require_factories();
@@ -3766,17 +3766,17 @@ var require_error2 = __commonJS({
   }
 });
 
-// ../../node_modules/custom-error-instance/index.js
+// ../../../Zanfia2/node_modules/custom-error-instance/index.js
 var require_custom_error_instance = __commonJS({
-  "../../node_modules/custom-error-instance/index.js"(exports, module) {
+  "../../../Zanfia2/node_modules/custom-error-instance/index.js"(exports, module) {
     "use strict";
     module.exports = require_error2();
   }
 });
 
-// ../../node_modules/lodash._basetostring/index.js
+// ../../../Zanfia2/node_modules/lodash._basetostring/index.js
 var require_lodash2 = __commonJS({
-  "../../node_modules/lodash._basetostring/index.js"(exports, module) {
+  "../../../Zanfia2/node_modules/lodash._basetostring/index.js"(exports, module) {
     "use strict";
     var INFINITY = 1 / 0;
     var symbolTag = "[object Symbol]";
@@ -3819,9 +3819,9 @@ var require_lodash2 = __commonJS({
   }
 });
 
-// ../../node_modules/lodash._stringtopath/index.js
+// ../../../Zanfia2/node_modules/lodash._stringtopath/index.js
 var require_lodash3 = __commonJS({
-  "../../node_modules/lodash._stringtopath/index.js"(exports, module) {
+  "../../../Zanfia2/node_modules/lodash._stringtopath/index.js"(exports, module) {
     "use strict";
     var baseToString = require_lodash2();
     var FUNC_ERROR_TEXT = "Expected a function";
@@ -4064,9 +4064,9 @@ var require_lodash3 = __commonJS({
   }
 });
 
-// ../../node_modules/lodash._baseiteratee/index.js
+// ../../../Zanfia2/node_modules/lodash._baseiteratee/index.js
 var require_lodash4 = __commonJS({
-  "../../node_modules/lodash._baseiteratee/index.js"(exports, module) {
+  "../../../Zanfia2/node_modules/lodash._baseiteratee/index.js"(exports, module) {
     "use strict";
     var stringToPath = require_lodash3();
     var LARGE_ARRAY_SIZE = 200;
@@ -4835,9 +4835,9 @@ var require_lodash4 = __commonJS({
   }
 });
 
-// ../../node_modules/lodash._createset/index.js
+// ../../../Zanfia2/node_modules/lodash._createset/index.js
 var require_lodash5 = __commonJS({
-  "../../node_modules/lodash._createset/index.js"(exports, module) {
+  "../../../Zanfia2/node_modules/lodash._createset/index.js"(exports, module) {
     "use strict";
     var INFINITY = 1 / 0;
     var funcTag = "[object Function]";
@@ -4924,9 +4924,9 @@ var require_lodash5 = __commonJS({
   }
 });
 
-// ../../node_modules/lodash._root/index.js
+// ../../../Zanfia2/node_modules/lodash._root/index.js
 var require_lodash6 = __commonJS({
-  "../../node_modules/lodash._root/index.js"(exports, module) {
+  "../../../Zanfia2/node_modules/lodash._root/index.js"(exports, module) {
     "use strict";
     var objectTypes = {
       "function": true,
@@ -4946,9 +4946,9 @@ var require_lodash6 = __commonJS({
   }
 });
 
-// ../../node_modules/lodash._baseuniq/index.js
+// ../../../Zanfia2/node_modules/lodash._baseuniq/index.js
 var require_lodash7 = __commonJS({
-  "../../node_modules/lodash._baseuniq/index.js"(exports, module) {
+  "../../../Zanfia2/node_modules/lodash._baseuniq/index.js"(exports, module) {
     "use strict";
     var createSet = require_lodash5();
     var root = require_lodash6();
@@ -5249,9 +5249,9 @@ var require_lodash7 = __commonJS({
   }
 });
 
-// ../../node_modules/lodash.uniqby/index.js
+// ../../../Zanfia2/node_modules/combine-errors/node_modules/lodash.uniqby/index.js
 var require_lodash8 = __commonJS({
-  "../../node_modules/lodash.uniqby/index.js"(exports, module) {
+  "../../../Zanfia2/node_modules/combine-errors/node_modules/lodash.uniqby/index.js"(exports, module) {
     "use strict";
     var baseIteratee = require_lodash4();
     var baseUniq = require_lodash7();
@@ -5262,9 +5262,9 @@ var require_lodash8 = __commonJS({
   }
 });
 
-// ../../node_modules/combine-errors/index.js
+// ../../../Zanfia2/node_modules/combine-errors/index.js
 var require_combine_errors = __commonJS({
-  "../../node_modules/combine-errors/index.js"(exports, module) {
+  "../../../Zanfia2/node_modules/combine-errors/index.js"(exports, module) {
     "use strict";
     var Custom = require_custom_error_instance();
     var uniq = require_lodash8();
@@ -5298,9 +5298,9 @@ var require_combine_errors = __commonJS({
   }
 });
 
-// ../../node_modules/graceful-fs/polyfills.js
+// ../../../Zanfia2/node_modules/graceful-fs/polyfills.js
 var require_polyfills = __commonJS({
-  "../../node_modules/graceful-fs/polyfills.js"(exports, module) {
+  "../../../Zanfia2/node_modules/graceful-fs/polyfills.js"(exports, module) {
     "use strict";
     var constants = __require("constants");
     var origCwd = process.cwd;
@@ -5587,9 +5587,9 @@ var require_polyfills = __commonJS({
   }
 });
 
-// ../../node_modules/graceful-fs/legacy-streams.js
+// ../../../Zanfia2/node_modules/graceful-fs/legacy-streams.js
 var require_legacy_streams = __commonJS({
-  "../../node_modules/graceful-fs/legacy-streams.js"(exports, module) {
+  "../../../Zanfia2/node_modules/graceful-fs/legacy-streams.js"(exports, module) {
     "use strict";
     var Stream = __require("stream").Stream;
     module.exports = legacy;
@@ -5684,9 +5684,9 @@ var require_legacy_streams = __commonJS({
   }
 });
 
-// ../../node_modules/graceful-fs/clone.js
+// ../../../Zanfia2/node_modules/graceful-fs/clone.js
 var require_clone = __commonJS({
-  "../../node_modules/graceful-fs/clone.js"(exports, module) {
+  "../../../Zanfia2/node_modules/graceful-fs/clone.js"(exports, module) {
     "use strict";
     module.exports = clone;
     var getPrototypeOf = Object.getPrototypeOf || function(obj) {
@@ -5707,9 +5707,9 @@ var require_clone = __commonJS({
   }
 });
 
-// ../../node_modules/graceful-fs/graceful-fs.js
+// ../../../Zanfia2/node_modules/graceful-fs/graceful-fs.js
 var require_graceful_fs = __commonJS({
-  "../../node_modules/graceful-fs/graceful-fs.js"(exports, module) {
+  "../../../Zanfia2/node_modules/graceful-fs/graceful-fs.js"(exports, module) {
     "use strict";
     var fs2 = __require("fs");
     var polyfills = require_polyfills();
@@ -6078,9 +6078,9 @@ var require_graceful_fs = __commonJS({
   }
 });
 
-// ../../node_modules/proper-lockfile/node_modules/retry/lib/retry_operation.js
+// ../../../Zanfia2/node_modules/proper-lockfile/node_modules/retry/lib/retry_operation.js
 var require_retry_operation = __commonJS({
-  "../../node_modules/proper-lockfile/node_modules/retry/lib/retry_operation.js"(exports, module) {
+  "../../../Zanfia2/node_modules/proper-lockfile/node_modules/retry/lib/retry_operation.js"(exports, module) {
     "use strict";
     function RetryOperation(timeouts, options) {
       if (typeof options === "boolean") {
@@ -6210,9 +6210,9 @@ var require_retry_operation = __commonJS({
   }
 });
 
-// ../../node_modules/proper-lockfile/node_modules/retry/lib/retry.js
+// ../../../Zanfia2/node_modules/proper-lockfile/node_modules/retry/lib/retry.js
 var require_retry = __commonJS({
-  "../../node_modules/proper-lockfile/node_modules/retry/lib/retry.js"(exports) {
+  "../../../Zanfia2/node_modules/proper-lockfile/node_modules/retry/lib/retry.js"(exports) {
     "use strict";
     var RetryOperation = require_retry_operation();
     exports.operation = function(options) {
@@ -6297,17 +6297,17 @@ var require_retry = __commonJS({
   }
 });
 
-// ../../node_modules/proper-lockfile/node_modules/retry/index.js
+// ../../../Zanfia2/node_modules/proper-lockfile/node_modules/retry/index.js
 var require_retry2 = __commonJS({
-  "../../node_modules/proper-lockfile/node_modules/retry/index.js"(exports, module) {
+  "../../../Zanfia2/node_modules/proper-lockfile/node_modules/retry/index.js"(exports, module) {
     "use strict";
     module.exports = require_retry();
   }
 });
 
-// ../../node_modules/proper-lockfile/node_modules/signal-exit/signals.js
+// ../../../Zanfia2/node_modules/proper-lockfile/node_modules/signal-exit/signals.js
 var require_signals = __commonJS({
-  "../../node_modules/proper-lockfile/node_modules/signal-exit/signals.js"(exports, module) {
+  "../../../Zanfia2/node_modules/proper-lockfile/node_modules/signal-exit/signals.js"(exports, module) {
     "use strict";
     module.exports = [
       "SIGABRT",
@@ -6343,9 +6343,9 @@ var require_signals = __commonJS({
   }
 });
 
-// ../../node_modules/proper-lockfile/node_modules/signal-exit/index.js
+// ../../../Zanfia2/node_modules/proper-lockfile/node_modules/signal-exit/index.js
 var require_signal_exit = __commonJS({
-  "../../node_modules/proper-lockfile/node_modules/signal-exit/index.js"(exports, module) {
+  "../../../Zanfia2/node_modules/proper-lockfile/node_modules/signal-exit/index.js"(exports, module) {
     "use strict";
     var process2 = global.process;
     var processOk = function(process3) {
@@ -6503,9 +6503,9 @@ var require_signal_exit = __commonJS({
   }
 });
 
-// ../../node_modules/proper-lockfile/lib/mtime-precision.js
+// ../../../Zanfia2/node_modules/proper-lockfile/lib/mtime-precision.js
 var require_mtime_precision = __commonJS({
-  "../../node_modules/proper-lockfile/lib/mtime-precision.js"(exports, module) {
+  "../../../Zanfia2/node_modules/proper-lockfile/lib/mtime-precision.js"(exports, module) {
     "use strict";
     var cacheSymbol = /* @__PURE__ */ Symbol();
     function probe(file, fs2, callback) {
@@ -6545,9 +6545,9 @@ var require_mtime_precision = __commonJS({
   }
 });
 
-// ../../node_modules/proper-lockfile/lib/lockfile.js
+// ../../../Zanfia2/node_modules/proper-lockfile/lib/lockfile.js
 var require_lockfile = __commonJS({
-  "../../node_modules/proper-lockfile/lib/lockfile.js"(exports, module) {
+  "../../../Zanfia2/node_modules/proper-lockfile/lib/lockfile.js"(exports, module) {
     "use strict";
     var path2 = __require("path");
     var fs2 = require_graceful_fs();
@@ -6782,9 +6782,9 @@ var require_lockfile = __commonJS({
   }
 });
 
-// ../../node_modules/proper-lockfile/lib/adapter.js
+// ../../../Zanfia2/node_modules/proper-lockfile/lib/adapter.js
 var require_adapter = __commonJS({
-  "../../node_modules/proper-lockfile/lib/adapter.js"(exports, module) {
+  "../../../Zanfia2/node_modules/proper-lockfile/lib/adapter.js"(exports, module) {
     "use strict";
     var fs2 = require_graceful_fs();
     function createSyncFs(fs3) {
@@ -6847,9 +6847,9 @@ var require_adapter = __commonJS({
   }
 });
 
-// ../../node_modules/proper-lockfile/index.js
+// ../../../Zanfia2/node_modules/proper-lockfile/index.js
 var require_proper_lockfile = __commonJS({
-  "../../node_modules/proper-lockfile/index.js"(exports, module) {
+  "../../../Zanfia2/node_modules/proper-lockfile/index.js"(exports, module) {
     "use strict";
     var lockfile2 = require_lockfile();
     var { toPromise, toSync, toSyncOptions } = require_adapter();
@@ -6883,7 +6883,7 @@ var require_proper_lockfile = __commonJS({
   }
 });
 
-// node_modules/commander/esm.mjs
+// ../../../Zanfia2/apps/cli/node_modules/commander/esm.mjs
 var import_index = __toESM(require_commander(), 1);
 var {
   program,
@@ -7047,6 +7047,18 @@ function resolveApiKey(explicit) {
   const stored = readCredentials();
   return stored?.apiKey ?? null;
 }
+var MEMBER_WRITE_SCOPE = "communities:write";
+var FULL_MEMBER_SCOPES = ["communities:read", "communities:write"];
+function memberKeyScopes(claims) {
+  return claims.scopes ?? [...FULL_MEMBER_SCOPES];
+}
+function isReadOnlyMemberKey(claims) {
+  return !memberKeyScopes(claims).includes(MEMBER_WRITE_SCOPE);
+}
+function memberScopeLabel(claims) {
+  const scopes = memberKeyScopes(claims).join(", ");
+  return isReadOnlyMemberKey(claims) ? `${scopes} (read-only)` : scopes;
+}
 function decodeTokenClaims(token) {
   if (!token) return { kind: "workspace" };
   const parts = token.split(".");
@@ -7057,7 +7069,8 @@ function decodeTokenClaims(token) {
       kind: p.kind === "member" ? "member" : "workspace",
       workspaceId: typeof p.wsp === "string" ? p.wsp : void 0,
       subject: typeof p.sub === "string" ? p.sub : void 0,
-      expiresAt: typeof p.exp === "number" ? new Date(p.exp * 1e3).toISOString() : void 0
+      expiresAt: typeof p.exp === "number" ? new Date(p.exp * 1e3).toISOString() : void 0,
+      scopes: typeof p.scope === "string" ? p.scope.split(" ").filter(Boolean) : void 0
     };
   } catch {
     return { kind: "workspace" };
@@ -10595,6 +10608,84 @@ function registerCertificatesCommands(program2) {
     );
     emit(flags, result ?? {}, () => printJson(result ?? {}));
   });
+  const certificatesSettings = certificates.command("settings");
+  certificatesSettings.description(
+    "A course's or event's certificate settings (auto-issue, layout, numbering, date, claim)"
+  );
+  certificatesSettings.command("get").summary("A product's certificate settings").description(
+    'Certificate settings of one course or event product \u2014 the same fields as the dashboard\'s product Settings \u2192 Certificate section: `certificateEnabled` (automatic certificate on course completion; courses only, always false for an event), `certificateTemplateId` (null = the workspace default template), `certificateCustomText` (the extra line printed by templates with the "custom text" element), `certificateValidityMonths` (null = never expires), numbering (`certificateCode`), the printed date (`certificateDateMode` + `certificateTrainingDate`) and claim mode (`certificateClaimEnabled` + `certificateClaimAvailableFrom`). 404 for an unknown product, 400 for a product type without certificates.'
+  ).argument("<productId>", "Course or event product id (other product types answer 400).").action(async (productId, _options, command) => {
+    const flags = getGlobalFlags(command);
+    const client = createApiClient({ apiKey: flags.apiKey, verbose: flags.verbose });
+    const params = {
+      productId
+    };
+    const result = await client.call(
+      "GET",
+      "/products/:productId/certificate-settings",
+      params,
+      void 0,
+      void 0
+    );
+    emit(flags, result ?? {}, () => printJson(result ?? {}));
+  });
+  certificatesSettings.command("update").summary("Update a product's certificate settings").description(
+    "Partial update of one course or event product's certificate settings \u2014 what the dashboard's product Settings \u2192 Certificate section saves: automatic certificate on course completion (`certificateEnabled`, courses only), layout (`certificateTemplateId`), the extra line (`certificateCustomText`, max 300 characters / 3 lines), validity, numbering (`certificateCode`), the printed date (`certificateDateMode` + `certificateTrainingDate`) and claim mode (`certificateClaimEnabled` + `certificateClaimAvailableFrom`). Absent fields stay unchanged, null clears; an empty body is a 400. The whole patch is checked before anything is saved (409 taken code, 404 unknown product or template, 400 invalid value). Only certificates issued from now on use the new settings. Answers the settings as saved."
+  ).argument("<productId>", "Course or event product id (other product types answer 400).").option(
+    "--auto-issue",
+    "Automatic certificate on course completion. Course products only (400 on an event)."
+  ).option("--no-auto-issue", "Send `certificateEnabled: false` explicitly.").option(
+    "--template <value>",
+    "Certificate template id from list-certificate-templates (404 when not in this workspace); null or blank = back to the workspace default."
+  ).option(
+    "--custom-text <value>",
+    'Extra line printed by templates with the "custom text" element, e.g. training hours. Max 300 characters and 3 lines (line breaks kept); null or blank clears it.'
+  ).option(
+    "--validity-months <n>",
+    "Validity in months from issuance; null = never expires.",
+    parseNumberOption("--validity-months", NumberFormat.Integer)
+  ).option(
+    "--code <value>",
+    "Exactly 3 digits (`017`), unique in the workspace (409 when another product has it); numbers certificates `{seq}/{code}/{schoolYear}`. null or blank = unnumbered."
+  ).addOption(
+    new Option(
+      "--date-mode <completion|training_date|issue_date>",
+      "Printed date: `completion` (course progress, else the issue date), `training_date` (needs certificateTrainingDate) or `issue_date`. null = completion."
+    ).choices(["completion", "training_date", "issue_date"])
+  ).option(
+    "--training-date <value>",
+    "`YYYY-MM-DD`, printed in the `training_date` mode; null or blank clears."
+  ).option("--claim", "Participants claim the certificate themselves in the portal (claim mode).").option("--no-claim", "Send `certificateClaimEnabled: false` explicitly.").option(
+    "--claim-from <value>",
+    "First claim day `YYYY-MM-DD`; null or blank = the day after the training date (else at once)."
+  ).action(
+    async (productId, options, command) => {
+      const flags = getGlobalFlags(command);
+      const client = createApiClient({ apiKey: flags.apiKey, verbose: flags.verbose });
+      const params = {
+        productId
+      };
+      const payload = {
+        certificateEnabled: options.autoIssue,
+        certificateTemplateId: options.template,
+        certificateCustomText: options.customText,
+        certificateValidityMonths: options.validityMonths,
+        certificateCode: options.code,
+        certificateDateMode: options.dateMode,
+        certificateTrainingDate: options.trainingDate,
+        certificateClaimEnabled: options.claim,
+        certificateClaimAvailableFrom: options.claimFrom
+      };
+      const result = await client.call(
+        "PATCH",
+        "/products/:productId/certificate-settings",
+        params,
+        void 0,
+        payload
+      );
+      emit(flags, result ?? {}, () => printJson(result ?? {}));
+    }
+  );
 }
 
 // src/commands/_generated/blog.ts
@@ -11615,7 +11706,8 @@ async function runWhoami(command) {
       workspaceName: stored?.workspaceName ?? null,
       userEmail: stored?.userEmail ?? null,
       uid: claims.subject ?? null,
-      scopes: ["communities:read", "communities:write"],
+      scopes: memberKeyScopes(claims),
+      readOnly: isReadOnlyMemberKey(claims),
       communityApiUrl: resolveCommunityApiUrl()
     };
     emit(flags, info2, () => {
@@ -11629,7 +11721,7 @@ async function runWhoami(command) {
 `);
       else if (info2.uid) process.stdout.write(`User id: ${info2.uid}
 `);
-      process.stdout.write(`Scopes: ${info2.scopes.join(", ")}
+      process.stdout.write(`Scopes: ${memberScopeLabel(claims)}
 `);
       process.stdout.write(`Community API: ${info2.communityApiUrl ?? "<unresolved>"}
 `);
@@ -11685,10 +11777,15 @@ function registerAuthCommands(program2) {
       process.stdout.write(`  status: no credentials file found
 `);
     } else {
+      const storedClaims = decodeTokenClaims(stored.apiKey);
       process.stdout.write(`  source: ${stored.source ?? "manual"}
 `);
-      process.stdout.write(`  kind  : ${stored.kind ?? decodeTokenKind(stored.apiKey)}
+      process.stdout.write(`  kind  : ${stored.kind ?? storedClaims.kind}
 `);
+      if (storedClaims.kind === "member") {
+        process.stdout.write(`  scope : ${memberScopeLabel(storedClaims)}
+`);
+      }
       process.stdout.write(`  saved : ${stored.savedAt}
 `);
       if (stored.userEmail) {
@@ -11726,6 +11823,8 @@ Resolved by next call:
     process.stdout.write(`  kind  : ${kind}
 `);
     if (kind === "member") {
+      process.stdout.write(`  scope : ${memberScopeLabel(decodeTokenClaims(apiKey))}
+`);
       process.stdout.write(
         `  community API: ${resolveCommunityApiUrl() ?? "<unresolved \u2014 set --api-url>"}
 `
@@ -11741,7 +11840,8 @@ Resolved by next call:
     "--api-url <url>",
     "API URL to associate with this key (for member keys, the api-community URL)"
   ).action((key, options) => {
-    const kind = decodeTokenKind(key);
+    const claims = decodeTokenClaims(key);
+    const { kind } = claims;
     const path2 = writeCredentials({
       apiKey: key,
       apiUrl: options.apiUrl,
@@ -11749,7 +11849,8 @@ Resolved by next call:
       source: "manual",
       kind
     });
-    process.stdout.write(`Saved ${kind === "member" ? "member " : ""}API key to ${path2}
+    const label = kind === "member" ? isReadOnlyMemberKey(claims) ? "read-only member " : "member " : "";
+    process.stdout.write(`Saved ${label}API key to ${path2}
 `);
     if (kind === "member" && !options.apiUrl) {
       process.stdout.write(
@@ -12054,6 +12155,17 @@ async function runBrowserAuth(options, entryUrl) {
     server.close();
   }
 }
+function buildMemberConsentParams(input) {
+  return {
+    redirect_uri: input.redirectUri,
+    state: input.state,
+    code_challenge: input.challenge,
+    code_challenge_method: "S256",
+    hostname: input.hostname,
+    client: "zanfia-cli",
+    ...input.readOnly ? { read_only: "1" } : null
+  };
+}
 function resolveMemberExchangeUrl() {
   const explicit = process.env.ZANFIA_MEMBER_EXCHANGE_URL ?? backendDefaults.memberExchangeUrl;
   if (explicit) return explicit;
@@ -12098,14 +12210,16 @@ async function runMemberLogin(options) {
   const host = safeHostname();
   const server = await startLoopbackServer();
   const redirectUri = `http://127.0.0.1:${server.port}${CALLBACK_PATH}`;
-  const url = buildConsentUrl(consentUrl, {
-    redirect_uri: redirectUri,
-    state,
-    code_challenge: challenge,
-    code_challenge_method: "S256",
-    hostname: host,
-    client: "zanfia-cli"
-  });
+  const url = buildConsentUrl(
+    consentUrl,
+    buildMemberConsentParams({
+      redirectUri,
+      state,
+      challenge,
+      hostname: host,
+      readOnly: options.readOnly
+    })
+  );
   process.stdout.write(`Opening ${url}
 `);
   process.stdout.write("Waiting for browser callback...\n\n");
@@ -12131,6 +12245,8 @@ async function runMemberLogin(options) {
       workspaceName: exchanged.workspaceName
     });
     process.stdout.write(`Logged in as ${exchanged.userEmail} (community member).
+`);
+    process.stdout.write(`Access: ${memberScopeLabel(decodeTokenClaims(exchanged.token))}
 `);
     process.stdout.write(`Workspace: ${exchanged.workspaceName} (${exchanged.workspaceId})
 `);
@@ -12162,6 +12278,9 @@ function registerLoginCommand(auth) {
   ).option(
     "--address <url>",
     "sign in as a community member (Community API) against this creator platform URL"
+  ).option(
+    "--read-only",
+    "member login only: the key can read the communities but never post, comment or chat"
   ).option("-v, --verbose", "show HTTP request details").addHelpText(
     "after",
     `
@@ -12177,24 +12296,33 @@ The two flows use different consent pages:
     command uses another stored login just for that command.
 
   Community member login \u2014 Community API only:
-      login --address https://<creator-platform-url>
+      login --address https://<creator-platform-url> [--read-only]
     Opens the consent page on that creator's platform (where you log in as
     their customer). The CLI gets a member token scoped to that workspace's
     communities; the community URL is passed as the platform address, and
-    which community to act in is chosen per command.
+    which community to act in is chosen per command. --read-only gets a key
+    that can read and summarize but never post, comment or chat (the right
+    choice for an agent that only reads); \`auth status\` shows the scope.
 
     No browser? Generate a key on the creator's platform under
-    Settings -> Developer and paste the shown "auth set-key" command instead.
+    Settings -> AI agents and paste the shown "auth set-key"
+    command instead.
 `
   ).action(async (options) => {
     if (options.address) {
       await runMemberLogin({
         address: options.address,
         apiUrl: options.apiUrl,
-        verbose: options.verbose
+        verbose: options.verbose,
+        readOnly: options.readOnly
       });
       return;
     }
+    if (options.readOnly) {
+      throw new Error(
+        "--read-only applies to community member logins: add --address <creator-platform-url> (or use `zanfia join <handle> --read-only`)."
+      );
+    }
     await runLogin(options);
   });
 }
@@ -13105,10 +13233,10 @@ function registerCampaignsCommands(program2) {
     });
   });
   campaigns.command("test").description(
-    "Send a TEST of the saved campaign to up to 3 addresses (default: your own) \u2014 subject prefixed [Test], sample personalization values; never the audience"
+    "Send a TEST of the saved campaign to your team's addresses only (default: your own) \u2014 subject prefixed [Test], sample personalization values; never the audience"
   ).argument("<id>", "campaign id").option(
     "--to <email>",
-    "test recipient \u2014 repeatable or comma-separated, max 3 (default: your own address)",
+    "test recipient: a team member account e-mail (or a mail-tester.com inbox), repeatable or comma-separated, max 3 (default: your own address)",
     collectRepeatable,
     []
   ).action(async (id, options, command) => {
@@ -19900,7 +20028,13 @@ async function runJoin(handleInput, options) {
       completed = await postJson2(
         "Join",
         joinUrl(communityApiUrl, handle, "complete"),
-        { email, code, firstName, hostname: hostname3 },
+        {
+          email,
+          code,
+          firstName,
+          hostname: hostname3,
+          ...options.readOnly ? { readOnly: true } : {}
+        },
         { verbose }
       );
     } catch (err) {
@@ -19923,11 +20057,14 @@ async function runJoin(handleInput, options) {
     workspaceName: completed.workspaceName,
     kind: "member"
   });
+  const claims = decodeTokenClaims(completed.token);
+  const readOnly = isReadOnlyMemberKey(claims);
   if (options.json) {
     process.stdout.write(
       `${JSON.stringify(
         {
           joined: true,
+          readOnly,
           alreadyMember: completed.alreadyMember,
           communityId: completed.communityId,
           communityName: completed.communityName,
@@ -19945,12 +20082,13 @@ async function runJoin(handleInput, options) {
     );
     return;
   }
-  const intro = completed.introChannelId ? `  zanfia communities post create ${completed.communityId} ${completed.introChannelId} --content "Hi, I'm <your agent>. I ..."
+  const intro = completed.introChannelId && !readOnly ? `  zanfia communities post create ${completed.communityId} ${completed.introChannelId} --content "Hi, I'm <your agent>. I ..."
 ` : "";
   process.stdout.write(
     `
 ${completed.alreadyMember ? "Welcome back to" : "You are in:"} ${completed.communityName}.
 Member key saved to ${path2} (expires ${completed.expiresAt.slice(0, 10)}).
+Access: ${memberScopeLabel(claims)}
 
 Next:
   zanfia communities list
@@ -19963,17 +20101,20 @@ Plug in your agent: ${AGENT_DOCS_URL}
   );
 }
 function registerJoinCommand(program2) {
-  program2.command("join <handle>").description("Join a public community from the terminal (emailed code) and get a member key").option("--email <email>", "email to join with (prompted when omitted)").option("--name <name>", "your display name (prompted when omitted)").option("--code <code>", "the 6-digit code from the email (prompted when omitted)").addHelpText(
+  program2.command("join <handle>").description("Join a public community from the terminal (emailed code) and get a member key").option("--email <email>", "email to join with (prompted when omitted)").option("--name <name>", "your display name (prompted when omitted)").option("--code <code>", "the 6-digit code from the email (prompted when omitted)").option("--read-only", "get a key that can read and summarize but never post, comment or chat").addHelpText(
     "after",
     `
 Examples:
   zanfia join crew-of-one
   zanfia join crew-of-one --email me@example.com --name "Sam" --code 123456
+  zanfia join crew-of-one --read-only
 
 The key is a MEMBER key: it reaches the Community API for that creator's
-communities only (read/post/comment/chat), never your own workspace. It is
-saved to ~/.config/zanfia/credentials.json and expires in 90 days \u2014 run
-join again to refresh it.
+communities only (read/post/comment/chat), never your own workspace. With
+--read-only it can only read (the right choice for an agent that reads and
+summarizes); \`zanfia auth status\` shows the scope. It is saved to
+~/.config/zanfia/credentials.json and expires in 90 days \u2014 run join again
+to refresh it.
 `
   ).action(async (handle, options, command) => {
     const globals = getGlobalFlags(command);
@@ -20100,7 +20241,7 @@ import { basename } from "path";
 import { createReadStream as createReadStream2 } from "fs";
 import { stat as stat2 } from "fs/promises";
 
-// ../../node_modules/tus-js-client/lib.esm/error.js
+// ../../../Zanfia2/node_modules/tus-js-client/lib.esm/error.js
 function _typeof(o) {
   "@babel/helpers - typeof";
   return _typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function(o2) {
@@ -20254,14 +20395,14 @@ var DetailedError = /* @__PURE__ */ (function(_Error) {
 })(/* @__PURE__ */ _wrapNativeSuper(Error));
 var error_default = DetailedError;
 
-// ../../node_modules/tus-js-client/lib.esm/logger.js
+// ../../../Zanfia2/node_modules/tus-js-client/lib.esm/logger.js
 var isEnabled = false;
 function log(msg) {
   if (!isEnabled) return;
   console.log(msg);
 }
 
-// ../../node_modules/tus-js-client/lib.esm/noopUrlStorage.js
+// ../../../Zanfia2/node_modules/tus-js-client/lib.esm/noopUrlStorage.js
 function _typeof2(o) {
   "@babel/helpers - typeof";
   return _typeof2 = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function(o2) {
@@ -20331,7 +20472,7 @@ var NoopUrlStorage = /* @__PURE__ */ (function() {
   }]);
 })();
 
-// ../../node_modules/js-base64/base64.mjs
+// ../../../Zanfia2/node_modules/tus-js-client/node_modules/js-base64/base64.mjs
 var version = "3.7.8";
 var VERSION = version;
 var _hasBuffer = typeof Buffer === "function";
@@ -20493,10 +20634,10 @@ var gBase64 = {
   extendBuiltins
 };
 
-// ../../node_modules/tus-js-client/lib.esm/upload.js
+// ../../../Zanfia2/node_modules/tus-js-client/lib.esm/upload.js
 var import_url_parse = __toESM(require_url_parse());
 
-// ../../node_modules/tus-js-client/lib.esm/uuid.js
+// ../../../Zanfia2/node_modules/tus-js-client/lib.esm/uuid.js
 function uuid() {
   return "xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx".replace(/[xy]/g, function(c) {
     var r = Math.random() * 16 | 0;
@@ -20505,7 +20646,7 @@ function uuid() {
   });
 }
 
-// ../../node_modules/tus-js-client/lib.esm/upload.js
+// ../../../Zanfia2/node_modules/tus-js-client/lib.esm/upload.js
 function _regeneratorRuntime() {
   "use strict";
   _regeneratorRuntime = function _regeneratorRuntime4() {
@@ -21740,11 +21881,11 @@ function splitSizeIntoParts(totalSize, partCount) {
 BaseUpload.defaultOptions = defaultOptions;
 var upload_default = BaseUpload;
 
-// ../../node_modules/tus-js-client/lib.esm/node/fileReader.js
+// ../../../Zanfia2/node_modules/tus-js-client/lib.esm/node/fileReader.js
 var import_is_stream = __toESM(require_is_stream());
 import { ReadStream } from "fs";
 
-// ../../node_modules/tus-js-client/lib.esm/node/sources/BufferSource.js
+// ../../../Zanfia2/node_modules/tus-js-client/lib.esm/node/sources/BufferSource.js
 function _typeof4(o) {
   "@babel/helpers - typeof";
   return _typeof4 = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function(o2) {
@@ -21811,7 +21952,7 @@ var BufferSource = /* @__PURE__ */ (function() {
   }]);
 })();
 
-// ../../node_modules/tus-js-client/lib.esm/node/sources/FileSource.js
+// ../../../Zanfia2/node_modules/tus-js-client/lib.esm/node/sources/FileSource.js
 import { createReadStream, promises as fsPromises } from "fs";
 function _typeof5(o) {
   "@babel/helpers - typeof";
@@ -22187,7 +22328,7 @@ var FileSource = /* @__PURE__ */ (function() {
   }]);
 })();
 
-// ../../node_modules/tus-js-client/lib.esm/node/sources/StreamSource.js
+// ../../../Zanfia2/node_modules/tus-js-client/lib.esm/node/sources/StreamSource.js
 function _typeof6(o) {
   "@babel/helpers - typeof";
   return _typeof6 = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function(o2) {
@@ -22627,7 +22768,7 @@ var StreamSource = /* @__PURE__ */ (function() {
   }]);
 })();
 
-// ../../node_modules/tus-js-client/lib.esm/node/fileReader.js
+// ../../../Zanfia2/node_modules/tus-js-client/lib.esm/node/fileReader.js
 function _typeof7(o) {
   "@babel/helpers - typeof";
   return _typeof7 = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function(o2) {
@@ -22695,7 +22836,7 @@ var FileReader = /* @__PURE__ */ (function() {
   }]);
 })();
 
-// ../../node_modules/tus-js-client/lib.esm/node/fileSignature.js
+// ../../../Zanfia2/node_modules/tus-js-client/lib.esm/node/fileSignature.js
 import { createHash as createHash3 } from "crypto";
 import * as fs from "fs";
 import * as path from "path";
@@ -22723,7 +22864,7 @@ function fingerprint(file, options) {
   return Promise.resolve(null);
 }
 
-// ../../node_modules/tus-js-client/lib.esm/node/httpStack.js
+// ../../../Zanfia2/node_modules/tus-js-client/lib.esm/node/httpStack.js
 var import_lodash = __toESM(require_lodash());
 import * as http from "http";
 import * as https from "https";
@@ -23027,11 +23168,11 @@ var writeBufferToStreamWithProgress = function writeBufferToStreamWithProgress2(
   writeNextChunk();
 };
 
-// ../../node_modules/tus-js-client/lib.esm/node/urlStorage.js
+// ../../../Zanfia2/node_modules/tus-js-client/lib.esm/node/urlStorage.js
 var import_combine_errors = __toESM(require_combine_errors());
 var lockfile = __toESM(require_proper_lockfile());
 
-// ../../node_modules/tus-js-client/lib.esm/node/index.js
+// ../../../Zanfia2/node_modules/tus-js-client/lib.esm/node/index.js
 function _typeof9(o) {
   "@babel/helpers - typeof";
   return _typeof9 = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function(o2) {
@@ -25698,7 +25839,10 @@ function registerPagesCommands(program2) {
   });
   pages.command("generate").description(
     "AI-generate a hosted DRAFT page from a brief. Consumes AI credits and runs in the background (202 + run id, ~1-5 minutes) \u2014 the page appears in `pages list` when the run finishes. Signup intents (lead-magnet / webinar / waitlist) also provision a signup form, a companion thank-you page and a DRAFT delivery automation. Facts in the brief (price, date, links) are used verbatim. Requires --confirm."
-  ).requiredOption("--intent <intent>", `what the page is for (${PAGE_INTENTS.join(" | ")})`).requiredOption("--title <title>", "page title (the slug derives from it unless --slug)").requiredOption("--brief <textOrFile>", "the brief \u2014 inline text or a path to a text file").option("--template <templateId>", "design-template seed from `pages templates`").option("--product <productId>", "grounding product (real name/prices + checkout link)").option("--checkout <checkoutId>", "override the product's default checkout as the offer").option("--form <formId>", "standalone signup form whose embed becomes the signup CTA").option("--source-url <url>", "website to start from (fetched server-side; beats --template)").option(
+  ).requiredOption("--intent <intent>", `what the page is for (${PAGE_INTENTS.join(" | ")})`).requiredOption("--title <title>", "page title (the slug derives from it unless --slug)").requiredOption("--brief <textOrFile>", "the brief \u2014 inline text or a path to a text file").option("--template <templateId>", "design-template seed from `pages templates`").option("--product <productId>", "grounding product (real name/prices + checkout link)").option("--checkout <checkoutId>", "override the product's default checkout as the offer").option(
+    "--form <formId>",
+    "standalone signup form the page renders natively as its signup section (never an iframe)"
+  ).option("--source-url <url>", "website to start from (fetched server-side; beats --template)").option(
     "--source-mode <mode>",
     `how the source site is used, required with --source-url (${SOURCE_SITE_MODES.join(" | ")})`
   ).option("--slug <slug>", "public URL slug; derived from the title when omitted").option(
@@ -30763,8 +30907,8 @@ function applyShortHelp(program2) {
 
 // src/program.ts
 function resolveCliVersion() {
-  if ("0.10.0".length > 0) {
-    return "0.10.0";
+  if ("0.13.1".length > 0) {
+    return "0.13.1";
   }
   try {
     const raw = readFileSync28(new URL("../package.json", import.meta.url), "utf8");
@@ -30791,13 +30935,14 @@ Signing in \u2014 two roles, two consent pages:
   ${programName} login
       Creator (workspace) login. Opens the consent page in the Zanfia dashboard.
       Grants the full Workspace API: products, clients, orders, stats, \u2026
-  ${programName} login --address https://<creator-platform-url>
+  ${programName} login --address https://<creator-platform-url> [--read-only]
       Community member login. Opens the consent page on that creator's platform.
-      Grants the Community API only: communities, posts, comments.
+      Grants the Community API only: communities, posts, comments. --read-only
+      gets a key that reads and summarizes but never posts.
   ${programName} auth set-key --api-url <api-community-url> <key>
       Member alternative without a browser: paste the key generated on the
-      creator's platform under Settings \u2192 Developer.
-  ${programName} join <handle>
+      creator's platform under Settings \u2192 AI agents.
+  ${programName} join <handle> [--read-only]
       Join a public community from the terminal: emailed 6-digit code, then a
       member key is saved \u2014 no account or browser needed. Try: join crew-of-one
 `

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zanfia/cli",
-  "version": "0.10.0",
+  "version": "0.13.1",
   "private": false,
   "description": "Zanfia CLI — thin HTTP client over the Zanfia Public API",
   "type": "module",