@ascendkit/cli 0.3.11 → 0.3.13

package/dist/cli.js

@@ -40,7 +40,7 @@ Services:
   survey           Surveys, questions, distribution, analytics
   journey          Lifecycle journeys, nodes, transitions
   email-identity   Email domains, sender identities, and DNS
-  keystore         Environment runtime key-value settings
+  env              Environment variable settings
   webhook          Webhook endpoints and testing
   campaign         Email campaigns, scheduling, analytics
   import           Import users from external auth providers
@@ -61,7 +61,7 @@ Commands:
   auth provider list
   auth provider set <p1,p2,...>
   auth oauth open <provider>
-  auth oauth set <provider> --client-id <id> [--client-secret <secret> | --client-secret-stdin] [--callback-url <url>]
+  auth oauth set <provider> --client-id <id> [--client-secret <secret> | --client-secret-stdin]
   auth oauth remove <provider>
   auth user list
   auth user remove <user-id>
@@ -167,12 +167,12 @@ Commands:
   environment show
   environment update [<env-id>] [--name <name>] [--description <desc>]
   environment promote [<env-id>] --target <tier>`,
-    keystore: `Usage: ascendkit keystore <command>
+    env: `Usage: ascendkit env <command>
 
 Commands:
-  keystore list
-  keystore set <key> <value>
-  keystore remove <key>`,
+  env list
+  env set <key> <value>
+  env remove <key>`,
     import: `Usage: ascendkit import <source> <action> [options]
 
 Sources:
@@ -214,7 +214,7 @@ function printSectionHelp(section) {
         key = "email-identity";
     if (key === "projects")
         key = "project";
-    if (key === "env" || key === "environments")
+    if (key === "environments")
         key = "environment";
     const text = HELP_SECTION[key];
     if (!text)
@@ -294,6 +294,11 @@ function printAuthSettingsSummary(data) {
     if (data.sessionDuration) {
         console.log(`Session: ${data.sessionDuration}`);
     }
+    const allowedDomains = Array.isArray(data.allowedDomains) ? data.allowedDomains : [];
+    if (allowedDomains.length > 0)
+        console.log(`Allowed domains: ${allowedDomains.join(", ")}`);
+    if (data.blockPersonalDomains)
+        console.log("Block personal domains: on");
 }
 function printTemplateSummary(data, opts) {
     console.log(`Template: ${data.name} (${data.id})`);
@@ -309,7 +314,7 @@ function printTemplateSummary(data, opts) {
     }
     if (Array.isArray(data.unconfiguredVariables) && data.unconfiguredVariables.length > 0) {
         console.log(`\n⚠ Unconfigured variables: ${data.unconfiguredVariables.join(", ")}`);
-        console.log(`  Set values with: ascendkit keystore set <key> <value>`);
+        console.log(`  Set values with: ascendkit env set <key> <value>`);
     }
     if (Array.isArray(data.relatedJourneys) && data.relatedJourneys.length > 0) {
         const refs = data.relatedJourneys.map((j) => `${j.name} (${j.id})`).join(", ");
@@ -697,7 +702,7 @@ async function run() {
         case "environment":
             await runEnvironment(action, args.slice(2));
             return;
-        case "keystore":
+        case "env":
             await runKeystore(action, args.slice(2));
             return;
     }
@@ -1013,7 +1018,7 @@ async function runKeystore(action, rest) {
             const key = rest[0];
             const value = rest[1];
             if (!key || value === undefined) {
-                console.error("Usage: ascendkit keystore set <key> <value>");
+                console.error("Usage: ascendkit env set <key> <value>");
                 return await exitCli(1);
             }
             vars[key] = value;
@@ -1024,7 +1029,7 @@ async function runKeystore(action, rest) {
         case "remove": {
             const key = rest[0];
             if (!key) {
-                console.error("Usage: ascendkit keystore remove <key>");
+                console.error("Usage: ascendkit env remove <key>");
                 return await exitCli(1);
             }
             if (!(key in vars)) {
@@ -1063,8 +1068,8 @@ async function runKeystore(action, rest) {
             return;
         }
         default:
-            console.error(`Unknown keystore command: ${action}`);
-            console.error("Usage: ascendkit keystore list|set|remove");
+            console.error(`Unknown env command: ${action}`);
+            console.error("Usage: ascendkit env list|set|remove");
             return await exitCli(1);
     }
 }
@@ -1094,6 +1099,12 @@ async function runAuth(client, action, rest) {
             }
             if (flags["session-duration"])
                 params.sessionDuration = flags["session-duration"];
+            if (flags["allowed-domains"] !== undefined) {
+                const raw = flags["allowed-domains"].trim();
+                params.allowedDomains = raw === "" ? [] : raw.split(",").map((d) => d.trim()).filter(Boolean);
+            }
+            if (flags["block-personal-domains"] !== undefined)
+                params.blockPersonalDomains = flags["block-personal-domains"] === "true";
             printAuthSettingsSummary(await auth.updateSettings(client, params));
             break;
         }
@@ -1121,7 +1132,7 @@ async function runAuth(client, action, rest) {
             const provider = oauthAction === "open" && rest[0] !== "open" ? rest[0] : rest[1];
             if (oauthAction === "set") {
                 if (!provider || !flags["client-id"]) {
-                    console.error("Usage: ascendkit auth oauth set <provider> --client-id <id> [--client-secret <secret> | --client-secret-stdin] [--callback-url <url>]");
+                    console.error("Usage: ascendkit auth oauth set <provider> --client-id <id> [--client-secret <secret> | --client-secret-stdin]");
                     return await exitCli(1);
                 }
                 const secretFromArg = flags["client-secret"];
@@ -1139,7 +1150,20 @@ async function runAuth(client, action, rest) {
                     console.error("Client secret cannot be empty.");
                     return await exitCli(1);
                 }
-                await auth.updateOAuthCredentials(client, provider, flags["client-id"], clientSecret, flags["callback-url"]);
+                const ctx = loadEnvContext();
+                if (!ctx) {
+                    console.error("No environment set. Run: ascendkit set-env <public-key>");
+                    return await exitCli(1);
+                }
+                const env = await platform.getEnvironment(ctx.projectId, ctx.environmentId);
+                const variables = (env.variables ?? {});
+                const appUrl = (variables.APP_URL ?? "").trim();
+                if (!appUrl) {
+                    console.error("Set APP_URL for this environment first. AscendKit uses APP_URL to generate the redirect URI for custom OAuth credentials.");
+                    console.error("Use: ascendkit env set APP_URL https://your-app.com");
+                    return await exitCli(1);
+                }
+                await auth.updateOAuthCredentials(client, provider, flags["client-id"], clientSecret);
                 console.log(`Saved OAuth credentials for ${provider}.`);
             }
             else if (oauthAction === "remove") {

package/dist/commands/auth.d.ts

@@ -8,11 +8,13 @@ export interface UpdateSettingsParams {
         requireUsername?: boolean;
     };
     sessionDuration?: string;
+    allowedDomains?: string[];
+    blockPersonalDomains?: boolean;
 }
 export declare function getSettings(client: AscendKitClient): Promise<unknown>;
 export declare function updateSettings(client: AscendKitClient, params: UpdateSettingsParams): Promise<unknown>;
 export declare function updateProviders(client: AscendKitClient, providers: string[]): Promise<unknown>;
-export declare function updateOAuthCredentials(client: AscendKitClient, provider: string, clientId: string, clientSecret: string, callbackUrl?: string): Promise<unknown>;
+export declare function updateOAuthCredentials(client: AscendKitClient, provider: string, clientId: string, clientSecret: string): Promise<unknown>;
 export declare function deleteOAuthCredentials(client: AscendKitClient, provider: string): Promise<unknown>;
 export declare function getOAuthSetupUrl(portalUrl: string, provider: string, publicKey?: string): string;
 export declare function listUsers(client: AscendKitClient): Promise<unknown>;

package/dist/commands/auth.js

@@ -9,16 +9,17 @@ export async function updateSettings(client, params) {
         body.features = params.features;
     if (params.sessionDuration !== undefined)
         body.sessionDuration = params.sessionDuration;
+    if (params.allowedDomains !== undefined)
+        body.allowedDomains = params.allowedDomains;
+    if (params.blockPersonalDomains !== undefined)
+        body.blockPersonalDomains = params.blockPersonalDomains;
     return client.managedPut("/api/auth/settings", body);
 }
 export async function updateProviders(client, providers) {
     return client.managedPut("/api/auth/settings/providers", { providers });
 }
-export async function updateOAuthCredentials(client, provider, clientId, clientSecret, callbackUrl) {
-    const body = { clientId, clientSecret };
-    if (callbackUrl)
-        body.callbackUrl = callbackUrl;
-    return client.managedPut(`/api/auth/settings/oauth/${provider}`, body);
+export async function updateOAuthCredentials(client, provider, clientId, clientSecret) {
+    return client.managedPut(`/api/auth/settings/oauth/${provider}`, { clientId, clientSecret });
 }
 export async function deleteOAuthCredentials(client, provider) {
     return client.managedDelete(`/api/auth/settings/oauth/${provider}`);

package/dist/commands/platform.js

@@ -13,6 +13,7 @@ const ASCENDKIT_ENV_KEYS = [
     "ASCENDKIT_API_URL",
     "NEXT_PUBLIC_ASCENDKIT_ENV_KEY",
     "ASCENDKIT_ENV_KEY",
+    "APP_URL",
     "ASCENDKIT_APP_URL",
     "ASCENDKIT_SECRET_KEY",
     "ASCENDKIT_WEBHOOK_SECRET",
@@ -139,7 +140,7 @@ function buildAscendKitEnvBlock(values) {
         "# Public URL where your app is hosted (used for auth callbacks and redirects)",
         "# Example: https://app.yourdomain.com",
         "# Leave blank in local dev if the SDK should infer from the incoming request.",
-        `ASCENDKIT_APP_URL=${values.ASCENDKIT_APP_URL}`,
+        `APP_URL=${values.APP_URL}`,
         "",
         "# AscendKit secret key (server-only; never expose to client/browser)",
         `ASCENDKIT_SECRET_KEY=${values.ASCENDKIT_SECRET_KEY}`,
@@ -189,6 +190,7 @@ async function updateEnvExampleFile(filePath) {
         ASCENDKIT_API_URL: "",
         NEXT_PUBLIC_ASCENDKIT_ENV_KEY: "",
         ASCENDKIT_ENV_KEY: "",
+        APP_URL: "",
         ASCENDKIT_APP_URL: "",
         ASCENDKIT_SECRET_KEY: "",
         ASCENDKIT_WEBHOOK_SECRET: "",
@@ -215,7 +217,8 @@ async function updateRuntimeEnvFile(filePath, apiUrl, publicKey, secretKey, opti
         ASCENDKIT_API_URL: resolvedApiUrl,
         NEXT_PUBLIC_ASCENDKIT_ENV_KEY: resolvedPublicKey,
         ASCENDKIT_ENV_KEY: resolvedPublicKey,
-        ASCENDKIT_APP_URL: readEnvValue(original, "ASCENDKIT_APP_URL") ?? "",
+        APP_URL: readEnvValue(original, "APP_URL") ?? readEnvValue(original, "ASCENDKIT_APP_URL") ?? "",
+        ASCENDKIT_APP_URL: "",
         ASCENDKIT_SECRET_KEY: resolvedSecretKey,
         ASCENDKIT_WEBHOOK_SECRET: resolvedWebhookSecret,
     });

package/dist/tools/auth.js

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import * as auth from "../commands/auth.js";
+import * as platform from "../commands/platform.js";
 function formatAuthSettings(data) {
     const providers = Array.isArray(data.providers) ? data.providers : [];
     const features = data.features ?? {};
@@ -12,6 +13,11 @@ function formatAuthSettings(data) {
     ];
     if (data.sessionDuration)
         lines.push(`Session: ${data.sessionDuration}`);
+    const allowedDomains = Array.isArray(data.allowedDomains) ? data.allowedDomains : [];
+    if (allowedDomains.length > 0)
+        lines.push(`Allowed domains: ${allowedDomains.join(", ")}`);
+    if (data.blockPersonalDomains)
+        lines.push("Block personal domains: on");
     return lines.join("\n");
 }
 export function registerAuthTools(server, client) {
@@ -41,6 +47,24 @@ export function registerAuthTools(server, client) {
         const data = await auth.updateSettings(client, params);
         return { content: [{ type: "text", text: formatAuthSettings(data) }] };
     });
+    server.tool("auth_domain_restrictions", "Configure email domain restrictions for signups. Set an allowlist of specific domains, or block personal email providers (gmail, yahoo, etc.), or both. Allowlist takes precedence when both are set.", {
+        allowedDomains: z
+            .array(z.string())
+            .optional()
+            .describe('Allowed email domains for signup, e.g. ["company.com", "partner.org"]. Pass empty array to clear.'),
+        blockPersonalDomains: z
+            .boolean()
+            .optional()
+            .describe("Block signups from common personal email providers (gmail, yahoo, hotmail, etc.)"),
+    }, async (params) => {
+        const body = {};
+        if (params.allowedDomains !== undefined)
+            body.allowedDomains = params.allowedDomains;
+        if (params.blockPersonalDomains !== undefined)
+            body.blockPersonalDomains = params.blockPersonalDomains;
+        const data = await client.managedPut("/api/auth/settings", body);
+        return { content: [{ type: "text", text: formatAuthSettings(data) }] };
+    });
     server.tool("auth_provider_set", "Set which auth providers are enabled for the project. Credentials and magic-link are mutually exclusive. Social-only login (e.g. [\"google\"]) is valid. At least one provider required.", {
         providers: z
             .array(z.string())
@@ -60,7 +84,6 @@ export function registerAuthTools(server, client) {
         provider: z.string().describe('OAuth provider name, e.g. "google", "github"'),
         clientId: z.string().optional().describe("OAuth client ID (to set credentials directly)"),
         clientSecret: z.string().optional().describe("OAuth client secret (to set credentials directly)"),
-        callbackUrl: z.string().optional().describe("Auth callback URL for this provider"),
         useProxy: z.boolean().optional().describe("Clear custom credentials and use AscendKit managed proxy credentials"),
     }, async (params) => {
         if (params.useProxy && (params.clientId || params.clientSecret)) {
@@ -91,7 +114,19 @@ export function registerAuthTools(server, client) {
             };
         }
         if (params.clientId && params.clientSecret) {
-            const data = await auth.updateOAuthCredentials(client, params.provider, params.clientId, params.clientSecret, params.callbackUrl);
+            const env = await platform.mcpGetEnvironment(client, {});
+            const variables = env.variables ?? {};
+            const appUrl = (variables.APP_URL ?? "").trim();
+            if (!appUrl) {
+                return {
+                    content: [{
+                            type: "text",
+                            text: "Set APP_URL for the active environment first. AscendKit uses APP_URL to generate the redirect URI for custom OAuth credentials.",
+                        }],
+                    isError: true,
+                };
+            }
+            const data = await auth.updateOAuthCredentials(client, params.provider, params.clientId, params.clientSecret);
             return {
                 content: [{
                         type: "text",

package/dist/tools/platform.js

@@ -206,7 +206,7 @@ export function registerPlatformTools(server, client) {
             };
         }
     });
-    server.tool("keystore_list", "List keystore values for the active environment. Uses the shared .ascendkit environment context by default.", {
+    server.tool("env_list", "List environment variable values for the active environment. Uses the shared .ascendkit environment context by default.", {
         projectId: z.string().optional().describe("Optional project ID override (defaults to active environment project)"),
         envId: z.string().optional().describe("Optional environment ID override (defaults to active environment)"),
     }, async (params) => {
@@ -235,10 +235,10 @@ export function registerPlatformTools(server, client) {
             return { content: [{ type: "text", text: message }], isError: true };
         }
     });
-    server.tool("keystore_replace", "Replace the full keystore for the active environment. Pass the full key-value map.", {
+    server.tool("env_replace", "Replace the full environment variable map for the active environment. Pass the full key-value map.", {
         projectId: z.string().optional().describe("Optional project ID override (defaults to active environment project)"),
         envId: z.string().optional().describe("Optional environment ID override (defaults to active environment)"),
-        variables: z.record(z.string()).describe("Key-value map of keystore values"),
+        variables: z.record(z.string()).describe("Key-value map of environment variables"),
     }, async (params) => {
         try {
             const data = await platform.mcpUpdateEnvironmentVariables(client, params);
@@ -265,11 +265,11 @@ export function registerPlatformTools(server, client) {
             };
         }
     });
-    server.tool("keystore_set", "Set a single keystore key for the active environment.", {
+    server.tool("env_set", "Set a single environment variable for the active environment.", {
         projectId: z.string().optional().describe("Optional project ID override (defaults to active environment project)"),
         envId: z.string().optional().describe("Optional environment ID override (defaults to active environment)"),
-        key: z.string().describe("Keystore key"),
-        value: z.string().describe("Keystore value"),
+        key: z.string().describe("Environment variable key"),
+        value: z.string().describe("Environment variable value"),
     }, async (params) => {
         try {
             const env = await platform.mcpGetEnvironment(client, {
@@ -291,10 +291,10 @@ export function registerPlatformTools(server, client) {
             return { content: [{ type: "text", text: message }], isError: true };
         }
     });
-    server.tool("keystore_remove", "Remove a single keystore key from the active environment.", {
+    server.tool("env_remove", "Remove a single environment variable from the active environment.", {
         projectId: z.string().optional().describe("Optional project ID override (defaults to active environment project)"),
         envId: z.string().optional().describe("Optional environment ID override (defaults to active environment)"),
-        key: z.string().describe("Keystore key to remove"),
+        key: z.string().describe("Environment variable key to remove"),
     }, async (params) => {
         try {
             const env = await platform.mcpGetEnvironment(client, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ascendkit/cli",
-  "version": "0.3.11",
+  "version": "0.3.13",
   "description": "AscendKit CLI and MCP server",
   "author": "ascendkit.dev",
   "license": "MIT",