@bnbagent/deploy-provider-bnb 0.3.0 → 0.4.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bnbagent/deploy-provider-bnb",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "type": "module",
   "description": "BNB Chain trial-platform provider for @bnbagent/deploy — deploys agents to the managed free-trial runtime (bnbagent-api) over plain HTTPS: GitHub device-flow login, zip artifact upload, deploy + poll. No cloud credentials of your own.",
   "license": "Apache-2.0",
@@ -17,10 +17,10 @@
     "typecheck": "tsc --noEmit"
   },
   "peerDependencies": {
-    "@bnbagent/deploy-core": "*"
+    "@bnbagent/deploy-core": "^0.4.0"
   },
   "devDependencies": {
-    "@bnbagent/deploy-core": "^0.3.0",
+    "@bnbagent/deploy-core": "^0.4.0",
     "@types/bun": "^1.3.0",
     "typescript": "^5.7.0"
   }

package/src/client.ts

@@ -16,7 +16,21 @@ import { loadSession, saveSession, withSessionLock, type Session } from "./sessi
  */
 export function apiUrl(ctx: Context): string {
   const fromSpec = ctx.overrides?.bnb?.apiUrl;
-  const url = (typeof fromSpec === "string" && fromSpec) || process.env.BNBAGENT_API_URL;
+  const fromEnv = process.env.BNBAGENT_API_URL?.trim();
+  const hasApiToken = Boolean(process.env.BNBAGENT_API_TOKEN?.trim());
+  // An API token is normally injected by CI while the TOML comes from the
+  // checked-out repository. Bind that credential to the trusted environment
+  // endpoint so repository config cannot redirect it to another HTTPS origin.
+  if (hasApiToken && !fromEnv) {
+    throw new BnbApiError(
+      0,
+      "config.token_api_url_missing",
+      "BNBAGENT_API_TOKEN requires BNBAGENT_API_URL so the CI credential is bound to a trusted origin.",
+    );
+  }
+  const url = hasApiToken
+    ? fromEnv
+    : (typeof fromSpec === "string" && fromSpec.trim()) || fromEnv;
   if (!url) {
     throw new BnbApiError(
       0,
@@ -40,7 +54,7 @@ export function apiUrl(ctx: Context): string {
 
 /**
  * Automation/CI bearer: a platform API token (`bnbk_…`, minted with
- * `bnbagent-deploy token --new`) via BNBAGENT_API_TOKEN. When set it REPLACES
+ * `bnbagent-deploy token --provider bnb --new`) via BNBAGENT_API_TOKEN. When set it REPLACES
  * the session entirely — no device flow, no refresh, no session file.
  */
 export function envApiToken(): string | undefined {
@@ -116,7 +130,7 @@ export async function authedRequest(
         throw new BnbApiError(
           401,
           "auth.token_invalid",
-          "BNBAGENT_API_TOKEN was rejected (revoked/expired?) — mint a new one: `bnbagent-deploy token --new` (while signed in).",
+          "BNBAGENT_API_TOKEN was rejected (revoked/expired?) — mint a new one: `bnbagent-deploy token --provider bnb --new` (while signed in).",
         );
       }
       throw e;
@@ -127,7 +141,7 @@ export async function authedRequest(
     throw new BnbApiError(
       401,
       "auth.signed_out",
-      "Not signed in — run `bnbagent-deploy login` first (CI: set BNBAGENT_API_TOKEN).",
+      "Not signed in — run `bnbagent-deploy login --provider bnb` first (CI: set BNBAGENT_API_TOKEN).",
     );
   }
   // Host-bind the token: never send a session minted against platform A to a
@@ -138,7 +152,7 @@ export async function authedRequest(
       401,
       "auth.host_mismatch",
       `Your session was minted against ${session.apiUrl}, but this command targets ${base}. ` +
-        `Refusing to send credentials cross-host — run \`bnbagent-deploy login\` against ${base}.`,
+        `Refusing to send credentials cross-host — run \`bnbagent-deploy login --provider bnb\` against ${base}.`,
     );
   }
   try {
@@ -155,7 +169,7 @@ async function refreshSession(base: string, session: Session): Promise<Session>
   return withSessionLock(async () => {
     const fresh = await loadSession();
     if (!fresh || !sameOrigin(fresh.apiUrl, base)) {
-      throw new BnbApiError(401, "auth.expired", "Session expired — run `bnbagent-deploy login` again.");
+      throw new BnbApiError(401, "auth.expired", "Session expired — run `bnbagent-deploy login --provider bnb` again.");
     }
     if (fresh.refresh_token !== session.refresh_token) {
       return fresh;
@@ -170,7 +184,7 @@ async function refreshSession(base: string, session: Session): Promise<Session>
       throw new BnbApiError(
         401,
         "auth.expired",
-        `Session expired${detail} — run \`bnbagent-deploy login\` again.`,
+        `Session expired${detail} — run \`bnbagent-deploy login --provider bnb\` again.`,
       );
     }
     const next: Session = { apiUrl: base, access_token: res.access_token, refresh_token: res.refresh_token };

package/src/extras.ts

@@ -27,7 +27,7 @@ const emit = (data: unknown): void => {
 };
 
 /**
- * `bnbagent-deploy trial [--json]` — the structured trial-clock read
+ * `bnbagent-deploy trial --provider bnb [--json]` — the structured trial-clock read
  * (GET /v1/account/trial: case/started_at/expires_at/remaining_seconds).
  * Account-level: works in any directory. Orchestrators gate deploy offers on it.
  */
@@ -104,7 +104,7 @@ export async function clientsCmd(spec: DeploymentSpec | undefined, ctx: Context)
 }
 
 /**
- * `bnbagent-deploy token [--new | --revoke <id>] [--json]` (default: list).
+ * `bnbagent-deploy token --provider bnb [--new | --revoke <id>] [--json]` (default: list).
  * Account-level — usable in ANY directory (`--provider bnb` + BNBAGENT_API_URL
  * outside a project); the spec, when present, only supplies [bnb] apiUrl.
  */
@@ -138,7 +138,7 @@ export async function tokenCmd(_spec: DeploymentSpec | undefined, ctx: Context):
     return;
   }
   if (!list.tokens.length) {
-    ctx.logger.info("No API tokens yet — mint one: bnbagent-deploy token --new");
+    ctx.logger.info("No API tokens yet — mint one: bnbagent-deploy token --provider bnb --new");
     return;
   }
   for (const t of list.tokens) {
@@ -146,5 +146,5 @@ export async function tokenCmd(_spec: DeploymentSpec | undefined, ctx: Context):
       `${t.prefix ?? "bnbk_…"}  ${t.scope ?? "tenant"}  expires ${t.expires_at ?? "never"}  (id ${t.id})`,
     );
   }
-  ctx.logger.info("Revoke one: bnbagent-deploy token --revoke <id>");
+  ctx.logger.info("Revoke one: bnbagent-deploy token --provider bnb --revoke <id>");
 }

package/src/index.ts

@@ -93,6 +93,10 @@ function slugPath(id: string): string {
   return encodeURIComponent(id);
 }
 
+export function isFreshSlugError(error: unknown): boolean {
+  return error instanceof BnbApiError && error.status === 404;
+}
+
 /**
  * The HARD spec contract for bnb/trial. validate() reports these early;
  * deploy() re-asserts UNCONDITIONALLY — --force / skipValidation only skip the
@@ -153,7 +157,8 @@ async function slugRetiredIssue(name: string, ctx: Context): Promise<string | un
     if (agent.state === "deleted" || agent.state === "reclaiming") return retired;
   } catch (e) {
     if (e instanceof BnbApiError && (e.status === 410 || e.code === "agent.deleted")) return retired;
-    // 404 = fresh slug; anything else (auth/network) is another gate's job.
+    if (isFreshSlugError(e)) return undefined;
+    throw e;
   }
   return undefined;
 }
@@ -221,7 +226,13 @@ const bnbProvider: CloudProvider = {
     if (envApiToken()) return [{ level: "info", code: "auth.ok", message: "BNBAGENT_API_TOKEN is set (CI bearer)." }];
     const session = await loadSession();
     if (!session) {
-      return [{ level: "error", code: "auth.signed_out", message: "No session and no BNBAGENT_API_TOKEN — run `bnbagent-deploy login`." }];
+      return [
+        {
+          level: "error",
+          code: "auth.signed_out",
+          message: "No session and no BNBAGENT_API_TOKEN — run `bnbagent-deploy login --provider bnb`.",
+        },
+      ];
     }
     return [{ level: "info", code: "auth.ok", message: `Session present (minted against ${session.apiUrl}).` }];
   },
@@ -254,7 +265,7 @@ const bnbProvider: CloudProvider = {
       if ("status" in res && res.status === "slow_down") interval += 5;
       // authorization_pending → keep polling
     }
-    throw new Error("Device-flow sign-in timed out — run `bnbagent-deploy login` again.");
+    throw new Error("Device-flow sign-in timed out — run `bnbagent-deploy login --provider bnb` again.");
   },
 
   /** Show the signed-in identity (GitHub login) + trial clock. */
@@ -262,7 +273,7 @@ const bnbProvider: CloudProvider = {
     const session = await loadSession();
     const viaToken = envApiToken();
     if (!session && !viaToken) {
-      ctx.logger.info("Not signed in to the trial platform (run `bnbagent-deploy login`).");
+      ctx.logger.info("Not signed in to the trial platform (run `bnbagent-deploy login --provider bnb`).");
       return;
     }
     try {
@@ -280,7 +291,7 @@ const bnbProvider: CloudProvider = {
       }
     } catch (e) {
       if (e instanceof BnbApiError && e.status === 401) {
-        ctx.logger.info("Session expired — run `bnbagent-deploy login` again.");
+        ctx.logger.info("Session expired — run `bnbagent-deploy login --provider bnb` again.");
         return;
       }
       throw e;
@@ -326,7 +337,7 @@ const bnbProvider: CloudProvider = {
         level: "error",
         code: "auth.signed_out",
         message: "Not signed in to the trial platform.",
-        hint: "Run: bnbagent-deploy login (CI: set BNBAGENT_API_TOKEN)",
+        hint: "Run: bnbagent-deploy login --provider bnb (CI: set BNBAGENT_API_TOKEN)",
       });
     } else if (!apiToken && session && base && session.apiUrl && !sameOrigin(session.apiUrl, base)) {
       // Parity with authedRequest's host binding: a token minted against
@@ -336,9 +347,27 @@ const bnbProvider: CloudProvider = {
         level: "error",
         code: "auth.host_mismatch",
         message: `Signed in against ${session.apiUrl}, but this spec targets ${base} — authenticated calls would be refused.`,
-        hint: "Run: bnbagent-deploy login (against the current apiUrl), or fix [bnb] apiUrl / BNBAGENT_API_URL.",
+        hint:
+          "Run: bnbagent-deploy login --provider bnb (against the current apiUrl), or fix [bnb] apiUrl / BNBAGENT_API_URL.",
       });
     }
+    let authReady = false;
+    if ((apiToken || session) && base && !issues.some((i) => i.code === "auth.host_mismatch")) {
+      try {
+        await authedRequest(ctx, "GET", "/v1/account");
+        authReady = true;
+      } catch (e) {
+        const err = e instanceof BnbApiError ? e : undefined;
+        issues.push({
+          level: "error",
+          code: err?.code ?? "auth.unavailable",
+          message: `Trial-platform authentication failed: ${(e as Error).message}`,
+          ...(err?.status === 401
+            ? { hint: "Re-run login, or replace the revoked/expired BNBAGENT_API_TOKEN." }
+            : {}),
+        });
+      }
+    }
     try {
       if (!base) throw new Error("no endpoint");
       const campaign: CampaignStatus = await publicRequest(base, "GET", "/v1/campaign");
@@ -358,14 +387,22 @@ const bnbProvider: CloudProvider = {
     }
     // Doomed-deploy precheck (needs working auth): a deleted slug is
     // retired forever — deploy would fail AFTER uploading the artifact.
-    if ((apiToken || session) && base && !issues.some((i) => i.code === "auth.host_mismatch")) {
-      const retired = await slugRetiredIssue(spec.name, ctx);
-      if (retired) {
+    if (authReady && base) {
+      try {
+        const retired = await slugRetiredIssue(spec.name, ctx);
+        if (retired) {
+          issues.push({
+            level: "error",
+            code: "agent.retired",
+            message: retired,
+            hint: "Pick a new agent name (slug) in agent-deploy.toml.",
+          });
+        }
+      } catch (e) {
         issues.push({
           level: "error",
-          code: "agent.retired",
-          message: retired,
-          hint: "Pick a new agent name (slug) in agent-deploy.toml.",
+          code: e instanceof BnbApiError ? e.code : "agent.precheck_failed",
+          message: `Could not verify the agent slug: ${(e as Error).message}`,
         });
       }
     }
@@ -412,7 +449,7 @@ const bnbProvider: CloudProvider = {
         );
       }
       if (!(e instanceof BnbApiError)) throw e; // the retired-slug Error above
-      // 404 = fresh slug; other API/network errors are the next call's problem.
+      if (!isFreshSlugError(e)) throw e;
     }
 
     const shipped = spec.type === "zip" ? await shipZipArtifact(spec, ctx) : await shipImageArtifact(spec, ctx);

package/src/init.ts

@@ -26,6 +26,9 @@ export async function initCmd(ctx: Context): Promise<void> {
   const defaultName = slugify(basename(ctx.baseDir));
   const name = process.stdin.isTTY ? slugify(ask(`Agent name (slug) [${defaultName}]: `) || defaultName) : defaultName;
   const apiUrl = process.stdin.isTTY ? ask("Trial platform URL (https://…): ") : "";
+  const apiUrlLine = apiUrl
+    ? `apiUrl = ${JSON.stringify(apiUrl)}`
+    : '# apiUrl = "https://<the-trial-platform-host>" # Or set BNBAGENT_API_URL';
 
   const toml = `name = "${name}"
 
@@ -37,7 +40,7 @@ entrypoint = "main.py"           # .py → Python · .js/.mjs/.cjs → Node (zip
 # protocol = "A2A"               # or "MCP" — buyers then authenticate via the platform token plane
 
 [bnb]
-apiUrl = "${apiUrl || "https://<the-trial-platform-host>"}"
+${apiUrlLine}
 
 # [env]                          # non-sensitive runtime config (plaintext)
 # MY_FLAG = "1"
@@ -49,7 +52,7 @@ apiUrl = "${apiUrl || "https://<the-trial-platform-host>"}"
   ctx.logger.success(`Wrote ${file}`);
   if (!apiUrl) ctx.logger.warn("Set [bnb] apiUrl (or BNBAGENT_API_URL) before deploying — there is no default.");
   ctx.logger.info("Next steps:");
-  ctx.logger.info("  1. bnbagent-deploy login          (GitHub device flow)");
+  ctx.logger.info("  1. bnbagent-deploy login --provider bnb   (GitHub device flow)");
   ctx.logger.info("  2. bnbagent-deploy pack           (Python zip projects — vendors arm64 deps)");
   ctx.logger.info("  3. bnbagent-deploy deploy");
 }