@ambasada/cli 0.7.1 → 0.7.2

package/dist/ambasada.mjs

@@ -1700,7 +1700,7 @@ var AmbasadaAuth = class {
   async verifyShellToken(token, options = {}) {
     const c2 = this.config();
     if (!c2.issuer) throw new VillageError("CONFIG", "silent sign-in needs AMBASADA_AUTH_ISSUER (injected on ambasada.dev and by `ambasada dev`)");
-    const issuer = c2.issuer.replace(/\/+$/, "");
+    const trusted = [c2.issuer, c2.hubUrl].filter((v) => !!v).map((v) => v.replace(/\/+$/, ""));
     const audiences = [options.audience ?? c2.audiences ?? []].flat().filter(Boolean).map((a) => a.replace(/\/+$/, ""));
     if (!audiences.length) throw new VillageError("CONFIG", "silent sign-in needs to know this app: set AMBASADA_APP_ORIGIN or PUBLIC_URL, or pass { audience }");
     const doFetch = c2.fetch ?? ((input, init2) => fetch(input, init2));
@@ -1715,6 +1715,9 @@ var AmbasadaAuth = class {
       throw shellRefused("not a JWT");
     }
     if (header3.alg !== "RS256") throw shellRefused(`alg ${String(header3.alg)} (only RS256)`);
+    const iss = typeof claims.iss === "string" ? claims.iss.replace(/\/+$/, "") : null;
+    if (iss && !trusted.includes(iss)) throw shellRefused(`issuer ${claims.iss}`);
+    const issuer = iss ?? trusted[0];
     let keys3 = await jwks(issuer, doFetch);
     let jwk = keys3.find((k) => k.kid === header3.kid) ?? (!header3.kid && keys3.length === 1 ? keys3[0] : void 0);
     if (!jwk) {
@@ -1729,7 +1732,6 @@ var AmbasadaAuth = class {
     if (typeof claims.exp !== "number" || claims.exp + LEEWAY_S < now) throw shellRefused("expired");
     if (typeof claims.nbf === "number" && claims.nbf - LEEWAY_S > now) throw shellRefused("not valid yet");
     if (typeof claims.iat === "number" && claims.iat - LEEWAY_S > now) throw shellRefused("issued in the future");
-    if (typeof claims.iss === "string" && claims.iss.replace(/\/+$/, "") !== issuer) throw shellRefused(`issuer ${claims.iss}`);
     const aud = [claims.aud].flat().filter((a) => typeof a === "string").map((a) => a.replace(/\/+$/, ""));
     if (!aud.some((a) => audiences.includes(a))) throw shellRefused(`it is for ${aud.join(", ") || "no app"}, not this one`);
     if (typeof claims.sub !== "string" || !claims.sub) throw shellRefused("no subject");
@@ -3128,6 +3130,7 @@ ${key}` : null;
     const token = /^Bearer\s+(.+)$/i.exec(req.headers.get("authorization") ?? "")?.[1]?.trim();
     if (!token) throw fail("UNAUTHORIZED", `a company API key is required (Authorization: Bearer ${DEV_KEY})`);
     const me = token === AGENT_KEY ? FAKE_AGENT : company;
+    if (path === "/v1/key" && method === "GET") return json2({ id: me, name: me, kind: "company" });
     if (path === "/v1/wallet" && method === "GET") return json2(wallet2(me));
     if (path === "/v1/ledger" && method === "GET") {
       const since = Number(url.searchParams.get("since") ?? 0);
@@ -3745,6 +3748,7 @@ async function deploy2(args, flags) {
     out(`  ${deployment.tier === "listed" || deployment.tier === "verified" ? c.green("\u2713") : c.yellow("!")} in the Ambasada app: ${line}`);
     for (const issue of deployment.check?.issues.filter((i) => i.level === "problem") ?? []) out(c.dim(`    ${issue.message}`));
   }
+  if (deployment.kind === "project") return;
   if (!await setProductUrl(project.root, deployment.url)) {
     out(c.yellow(`! add \`product: { url: "${deployment.url}" }\` to ambasada.config.ts so relative offering endpoints resolve`));
   }
@@ -4228,7 +4232,7 @@ async function tunnel(_args, flags) {
 }
 
 // src/commands.ts
-var SDK_VERSION = /^\d+\.\d+\.\d+$/.test("0.7.1") ? `^${"0.7.1"}` : "latest";
+var SDK_VERSION = /^\d+\.\d+\.\d+$/.test("0.7.2") ? `^${"0.7.2"}` : "latest";
 var DEV_PORT = 8788;
 var out3 = (s = "") => process.stdout.write(`${s}
 `);
@@ -4294,19 +4298,33 @@ async function login(_args, flags) {
     if (device) ({ token: key, company } = device);
   }
   if (!key) {
-    out3(`Paste your company's server key from ${c.bold(`${apiUrl.replace(/\/$/, "")}`)} \u2192 your team \u2192 Developers \u2192 Server keys.`);
+    out3(`Paste your app's key: ${c.bold("https://developer.ambasada.dev")} \u2192 New app (or Settings \u2192 New key).`);
     key = await prompt("API key: ");
   }
   if (!key) throw new CliError("no key given");
-  const village2 = createAmbasada({ apiKey: key, apiUrl, env: {} });
+  company = (await whoseKey(apiUrl, key)).id;
+  await writeConfig({ ...await readConfig(), apiUrl, apiKey: key, company });
+  out3(`${c.green("\u2713")} logged in as ${c.bold(company)} on ${apiUrl} ${c.dim(`(saved to ${configPath()})`)}`);
+}
+async function whoseKey(apiUrl, key) {
+  let res;
+  try {
+    res = await fetch(`${apiUrl.replace(/\/$/, "")}/v1/key`, { headers: { authorization: `Bearer ${key}`, accept: "application/json" } });
+  } catch (error) {
+    throw new CliError(`can't reach ${apiUrl}: ${error.message}`);
+  }
+  if (res.status === 401) throw new CliError("that key was refused (UNAUTHORIZED)");
+  if (res.ok) {
+    const body = await res.json();
+    return { id: body.id, name: body.name ?? null, kind: body.kind === "project" ? "project" : "company" };
+  }
+  await res.body?.cancel();
   try {
-    company = (await village2.wallet()).account;
+    return { id: (await createAmbasada({ apiKey: key, apiUrl, env: {} }).wallet()).account, name: null, kind: "company" };
   } catch (error) {
-    if (isVillageError(error, "UNAUTHORIZED")) throw new CliError("that key was refused by the village (UNAUTHORIZED)");
+    if (isVillageError(error, "UNAUTHORIZED")) throw new CliError("that key was refused (UNAUTHORIZED)");
     throw error;
   }
-  await writeConfig({ ...await readConfig(), apiUrl, apiKey: key, company });
-  out3(`${c.green("\u2713")} logged in as ${c.bold(company)} on ${apiUrl} ${c.dim(`(saved to ${configPath()})`)}`);
 }
 async function logout() {
   const { apiKey: _k, company: _c, ...rest } = await readConfig();
@@ -4315,10 +4333,10 @@ async function logout() {
 }
 async function whoami(_args, flags) {
   const r = await resolve(flags);
-  const v = await client(flags);
-  const w = await v.wallet();
-  if (json(flags, { apiUrl: r.apiUrl, company: w.account })) return;
-  out3(`${c.bold(w.account)} on ${r.apiUrl}`);
+  if (!r.apiKey) throw new CliError("not logged in: run `ambasada login` (or set AMBASADA_API_KEY)");
+  const who = await whoseKey(r.apiUrl, r.apiKey);
+  if (json(flags, { apiUrl: r.apiUrl, company: who.id, kind: who.kind })) return;
+  out3(`${c.bold(who.id)} on ${r.apiUrl}`);
 }
 async function init(args, flags) {
   const target = resolvePath4(args[0] ?? ".");
@@ -4385,7 +4403,7 @@ async function init(args, flags) {
   out3(`  npm run dev             ${c.dim("# ambasada dev: mock village API on :8788 + your product on http://localhost:3000")}`);
   out3(`  npx ambasada dev buy translate '{"text":"Bun\u0103!","to":"en"}'   ${c.dim("# in a second terminal: a fake agent pays you 1 TON")}`);
   out3("");
-  out3(`Then ${c.bold("ambasada login")}, ${c.bold("ambasada link https://your.product")} and ${c.bold("ambasada deploy")}. See README.md.`);
+  out3(`Then ${c.bold("ambasada login")} (a key from https://developer.ambasada.dev \u2192 New app) and ${c.bold("ambasada deploy")}. See README.md.`);
 }
 async function check(args, flags) {
   const target = args[0];
@@ -4696,14 +4714,15 @@ async function links(args, flags) {
 }
 
 // src/main.ts
-var VERSION = true ? "0.7.1" : "0.1.0-dev";
-var HELP = `${c.bold("ambasada")} ${VERSION}: build a company for the Hack A Ton village
+var VERSION = true ? "0.7.2" : "0.1.0-dev";
+var HELP = `${c.bold("ambasada")} ${VERSION}: build and host apps on ambasada.dev
 
   ambasada init [dir] [--template next|spa|worker] [--name "Name"] [--id slug]
-                                                   scaffold a company (product + agent). A product is one Cloudflare
+                                                   scaffold an app (village teams also get the agent). An app is one Cloudflare
                                                    Worker: next (default, Next.js via OpenNext), spa (Vite + React,
                                                    for Lovable/Bolt exports) or worker (bare fetch handlers + web/)
-  ambasada login [--key sk_\u2026]                       device-code login with Ambasada ID, or paste a server key
+  ambasada login [--key vk_\u2026]                       device-code login with Ambasada ID, or paste an app key
+                                                   (developer.ambasada.dev \u2192 New app, or a team's server key)
   ambasada dev [--port 8788] [--product URL]        mock Payments API (fake bank, fake visitor, canned LLM/tools) on :8788
                                                    + your product's dev server (next dev | vite | wrangler dev) on
                                                    product.url (:3000), with AMBASADA_* pointed at the mock

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ambasada/cli",
-  "version": "0.7.1",
+  "version": "0.7.2",
   "description": "`ambasada`: the Ambasada CLI (Hack A Ton village commands) (login, init, dev, deploy, offerings, wallet, logs, market, steer).",
   "type": "module",
   "license": "MIT",
@@ -22,7 +22,7 @@
     "vitest": "^4.1.12",
     "wrangler": "^4.156.0",
     "@ambasada/protocol": "0.1.0",
-    "@ambasada/sdk": "0.7.1"
+    "@ambasada/sdk": "0.7.2"
   },
   "author": "CENTYSO (https://centyso.com)",
   "homepage": "https://ambasada.id",