impel-cli 0.17.11 → 0.17.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.17.11",
+  "version": "0.17.12",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/src/commands/tasks.js

@@ -6,6 +6,7 @@ import {
   ensureTenantSelection,
   PAT_SCOPE_TASKS,
   PRODUCT_ACCESS_GATEWAY,
+  PRODUCT_ACCESS_IDENTITY,
   PRODUCT_ACCESS_WORKSPACE,
 } from "../tenants.js";
 
@@ -85,6 +86,9 @@ async function requestJson({ flags, path, query, method = "GET", body }) {
   if (selected.productAccess === PRODUCT_ACCESS_GATEWAY) {
     fail("impel tasks: Gateway members do not have workspace task access.");
   }
+  if (selected.productAccess === PRODUCT_ACCESS_IDENTITY) {
+    fail("impel tasks: Identity members do not have workspace task access.");
+  }
   if (selected.productAccess !== PRODUCT_ACCESS_WORKSPACE) {
     fail("impel tasks: the control plane did not return a live Workspace entitlement; retry after it is upgraded.");
   }

package/src/tenants.js

@@ -7,11 +7,19 @@ import {
 
 export const TENANT_CREDENTIAL_PREFIX = "impel_tenant_";
 export const PRODUCT_ACCESS_WORKSPACE = "workspace";
+export const PRODUCT_ACCESS_IDENTITY = "identity";
 export const PRODUCT_ACCESS_GATEWAY = "gateway";
 export const PAT_SCOPE_CLAUDE = "claude-code-gateway";
 export const PAT_SCOPE_CODEX = "codex-gateway";
 export const PAT_SCOPE_TASKS = "tasks";
-const PRODUCT_ACCESS_VALUES = new Set([PRODUCT_ACCESS_WORKSPACE, PRODUCT_ACCESS_GATEWAY]);
+// Additive entitlement hierarchy: Gateway < Identity + Gateway < Workspace.
+// Identity and Gateway members share the same gateway scopes and neither can
+// authorize workspace tasks; only Workspace members do.
+const PRODUCT_ACCESS_VALUES = new Set([
+  PRODUCT_ACCESS_WORKSPACE,
+  PRODUCT_ACCESS_IDENTITY,
+  PRODUCT_ACCESS_GATEWAY,
+]);
 const PROVIDER_SCOPE = Object.freeze({ claude: PAT_SCOPE_CLAUDE, codex: PAT_SCOPE_CODEX });
 const TENANT_ID_RE = /^[A-Za-z0-9_.-]{1,128}$/u;
 const PAT_SCOPE_RE = /^[a-z0-9][a-z0-9:._-]{0,63}$/u;
@@ -27,6 +35,7 @@ export function normalizeProductAccess(value, { allowMissing = false } = {}) {
 
 export function productAccessLabel(value) {
   if (value === PRODUCT_ACCESS_WORKSPACE) return "Workspace member";
+  if (value === PRODUCT_ACCESS_IDENTITY) return "Identity + Gateway member";
   if (value === PRODUCT_ACCESS_GATEWAY) return "Gateway member";
   return "Unknown";
 }