@asiyst/cli 1.0.9 → 1.1.1

package/README.md

@@ -12,17 +12,30 @@ npm install -g @asiyst/cli
 
 ## Commands
 
-`asiyst` detects the current project and opens an interactive command prompt. Use `asiyst connect` (or `asiyst init`) to start the browser-only authentication and project connection flow. Other commands are `login`, `logout`, `status`, `verify`, `doctor`/`diagnostics`, `dashboard`, `avatar`, `update`, `trust`, and `revoke-trust`.
+`asiyst` detects the current project and opens an interactive command prompt. Use `asiyst connect --project-id <PROJECT_ID>` or `asiyst connect` to start the authentication and project connection flow. The CLI requires an explicit public Project ID when connecting a project; it will not silently infer or substitute the developer account user ID.
+
+Other commands are `login`, `logout`, `status`, `verify`, `doctor`/`diagnostics`, `dashboard`, `avatar`, `update`, `trust`, and `revoke-trust`.
+
+```sh
+asiyst connect --project-id K8mP2xQ7_vL4N9cR5T1zB6Y3
+asiyst status
+asiyst avatar import --avatar-id A7K9M2QX4P
+asiyst disconnect
+```
+
+The connection flow asks for the 24-character Asiyst User ID and masks the API key while you enter it. The API verifies that the account, key, and selected project belong together. Avatar import uses the stored account, project, and key and requires a separate 10-character Avatar ID.
+
+Avatar import calls the authenticated CLI project import operation and sends `userId`, `projectId`, and `avatarId` as identifiers; the API key is sent only through authentication headers. The server remains responsible for ownership, project access, avatar existence, active-project checks, and duplicate detection.
 
 Interactive startup performs a lightweight npm version check. If a newer release exists, the CLI only displays a notification. It never installs or restarts automatically; run `update` and confirm to install it. Global installations are updated in place. For npx invocations, the latest package is downloaded and verified for that invocation without changing the website project.
 
-The CLI checks `GET /api/v1/health`, then creates a short-lived, single-use session through `POST /api/v1/cli/sessions`, opens its returned URL, and polls `GET /api/v1/cli/sessions/:sessionId/status`. Passwords, AI provider keys, Supabase keys, and private API credentials are never requested, placed in URLs, or logged.
+The CLI checks `GET /health`, verifies API keys via `POST /auth/api-key/verify` on `https://nqhxpgsjofzqudyqkqib.supabase.co/functions/v1/api`, and securely stores credentials. Passwords, AI provider keys, Supabase keys, and private API credentials are never requested, placed in URLs, or logged.
 
-Set `ASIIYST_API_URL` only for a controlled non-production deployment (production defaults to `https://asiyst.com/api/v1`). The current SDK accepts `projectId` and `publicKey` through its public `Asiyst.init({ ... })` API. For verification, configure `ASIIYST_PROJECT_ID` and `ASIIYST_PUBLIC_KEY` in the project environment.
+Production API defaults to `https://nqhxpgsjofzqudyqkqib.supabase.co/functions/v1/api`.
 
 ## Required web API
 
-The web application must implement the session endpoints above, `GET /api/v1/cli/projects/:projectId`, and `POST /api/v1/cli/verification`. Verification must return authoritative checks for project validity, key validity, API reachability, domain authorization, SDK heartbeat, published configuration, and avatar availability. The CLI does not fabricate these results or connect directly to Supabase.
+The web application must implement the session endpoints above, `GET /api/v1/cli/projects/:projectId`, `POST /api/v1/cli/verification`, and the authenticated `POST /cli/projects/:projectId/avatars/import` operation used by avatar import. The import operation must verify the authenticated API key, account/project access, avatar existence, active project state, and duplicate imports; it must return an explicit imported result or an error. Verification must return authoritative checks for project validity, key validity, API reachability, domain authorization, SDK heartbeat, published configuration, and avatar availability. The CLI does not fabricate these results or connect directly to Supabase.
 
 ## Development