@faable/faable 4.5.1 → 4.5.3

package/dist/api/FaableApi.js

@@ -88,9 +88,14 @@ class FaableApi {
                     // Uniform handling for an expired/invalid session across every
                     // command, regardless of which endpoint returned the 401.
                     if (res.status === 401) {
-                        const expired = new Error('Your Faable session has expired or is invalid. Run `faable login` to sign in again.', { cause: error });
+                        // With an API key there is no session to renew: the key itself
+                        // is wrong or was revoked (the hosted MCP server runs on keys).
+                        const by_key = !!process.env.FAABLE_API_KEY && !process.env.FAABLE_TOKEN;
+                        const expired = new Error(by_key
+                            ? 'This Faable API key is invalid or was revoked. Create a new one in the dashboard (project settings → API Keys).'
+                            : 'Your Faable session has expired or is invalid. Run `faable login` to sign in again.', { cause: error });
                         expired.status = 401;
-                        expired.code = 'session_expired';
+                        expired.code = by_key ? 'apikey_invalid' : 'session_expired';
                         throw expired;
                     }
                     const serverMessage = res.data?.message || res.statusText || 'Unknown Error';
@@ -288,9 +293,10 @@ class FaableApi {
     async listDomains(app_id, team) {
         return firstPage(this.listDomainsPage(app_id, team));
     }
+    // Without `app_id`, every domain of the project.
     async listDomainsPage(app_id, team, params = {}) {
         return data(this.client.get(`/domain`, {
-            params: { app_id, ...page_params(params) },
+            params: { ...(app_id ? { app_id } : {}), ...page_params(params) },
             headers: projectHeader(team)
         }));
     }

package/dist/commands/deploy/domains/list.js

@@ -1,23 +1,26 @@
 import { requireApi } from '../../../api/context.js';
 import { fetch_page, print_json, print, more_hint, list_options } from '../../../lib/listing.js';
 import { log } from '../../../log.js';
-import { resolve_app_id } from '../resolve_app_id.js';
+import { requireProject } from '../../../api/project.js';
+import { find_app_id } from '../resolve_app_id.js';
 import { dns_badge, cname_target } from './format.js';
 
 const domains_list = {
     command: 'list',
-    describe: 'List custom domains of the app',
+    describe: 'List custom domains of the app (or of the project, outside a linked repo)',
     builder: yargs => list_options(yargs)
         .option('app', {
         alias: 'a',
         type: 'string',
         description: 'App id, name or slug (defaults to the linked app)'
     })
-        .example('$0 deploy domains list', 'Domains of the linked app')
+        .example('$0 deploy domains list', 'Domains of the linked app, or of the active project when there is none')
         .showHelpOnFail(false),
     handler: async (args) => {
         const ctx = await requireApi();
-        const app_id = await resolve_app_id(args.app, ctx.appId, ctx.api);
+        const app_id = await find_app_id(args.app, ctx.appId, ctx.api);
+        if (!app_id)
+            return list_project_domains(ctx.api, args);
         const app = await ctx.api.getApp(app_id);
         const page = await fetch_page(p => ctx.api.listDomainsPage(app_id, app.team, p), args);
         if (args.json)
@@ -48,5 +51,35 @@ const domains_list = {
         }
     }
 };
+// No app here (an unlinked directory): the domains of the active project,
+// each with the app it routes to.
+const list_project_domains = async (api, args) => {
+    const { id: project } = await requireProject(api);
+    const page = await fetch_page(p => api.listDomainsPage(undefined, project, p), args);
+    if (args.json)
+        return print_json(page);
+    const domains = page.data;
+    if (domains.length === 0) {
+        log.info(`🌐 No custom domains in ${project}.`);
+        log.info(`Add one with: faable deploy domains add <yourdomain.com> --app <app>.`);
+        return;
+    }
+    const apps = await fetch_page(p => api.listApps(p, project), {
+        limit: 200,
+        all: true
+    });
+    const app_name = new Map(apps.data.map(a => [a.id, a.name]));
+    const label = (d) => d.app_id ? app_name.get(d.app_id) ?? d.app_id : '(no app)';
+    log.info(`🌐 ${domains.length} domain(s) in ${project}:`);
+    const width = Math.max(...domains.map(d => d.fqdn.length));
+    const app_width = Math.max(...domains.map(d => label(d).length));
+    for (const domain of domains) {
+        const tls = domain.tls ? 'tls' : 'no-tls';
+        print(`  ${domain.fqdn.padEnd(width)}  ${label(domain).padEnd(app_width)}  ${dns_badge(domain)}  (${tls})`);
+    }
+    const hint = more_hint(page);
+    if (hint)
+        log.info(hint);
+};
 
 export { domains_list };

package/dist/lib/CredentialsStore.js

@@ -23,7 +23,6 @@ class CredentialsStore {
         await fs.ensureDir(this.faable_home);
         await fs.writeJSON(this.credentials_path, config, { spaces: 2 });
         await fs.chmod(this.credentials_path, 0o600);
-        this.log.info(`Stored credentials`);
     }
     async loadCredentials() {
         const old_path = path__default.join(this.faable_home, 'credentials');

package/dist/mcp/http.js

@@ -15,14 +15,14 @@ import { TOOLS } from './tools.js';
 // Streamable HTTP, stateless: every POST /mcp builds a server and a transport
 // for that one request, so any instance can answer anything. The caller
 // authenticates with a Faable API key (dashboard → project settings → API
-// keys). ⚠️ A key acts with its OWNER's access, not only on the project it was
-// created in (arch/deploy/mcp-cli-gaps.md) — /mcp/<project> is how a caller
-// narrows it. Each tool call runs the CLI as a child
+// keys). A key belongs to the project it was created in, and the api holds it
+// there (api 2.199.2, backlog §302): it never acts as its owner nor reaches
+// another project. Each tool call runs the CLI as a child
 // with THAT key in its environment and an empty HOME of its own — two
 // callers' credentials never meet in one process, and the key is never
 // logged.
 //
-//   POST /mcp              everything the key's owner can see
+//   POST /mcp              the key's project
 //   POST /mcp/<project>    pinned to one project (id, name or slug)
 //   ?mode=write            also the reversible writes
 //   ?readonly=1            reads only — not even deploy_app
@@ -151,7 +151,7 @@ const llms_txt = (base = PUBLIC_URL) => [
     '',
     '> Connects Claude, Cursor and any MCP client to Faable Deploy: read apps, deployments, build and runtime logs, traffic and domains, and deploy — without leaving the editor.',
     '',
-    `Endpoint: ${base}/mcp (Streamable HTTP). Authenticate with a Faable API key: \`Authorization: Bearer <key>\` (create one in the dashboard, project settings → API keys). The key acts with its owner's access; connect to \`${base}/mcp/<project>\` to keep every call in one project.`,
+    `Endpoint: ${base}/mcp (Streamable HTTP). Authenticate with a Faable API key: \`Authorization: Bearer <key>\` (create one in the dashboard, project settings → API keys). The key belongs to one project and only acts there.`,
     '',
     `- \`${base}/mcp/<project>\` pins every call to one project.`,
     '- `?mode=write` adds the reversible writes (create apps, set secrets, add domains, retry or cancel builds, change deploy settings). Nothing destructive is exposed.',

package/dist/mcp/server.js

@@ -32,6 +32,7 @@ const NEXT_STEP = {
     session_expired: 'The Faable session expired. Ask the user to run `faable login` in a terminal, then retry.',
     account_suspended: 'This Faable account is suspended; the user should contact support@faable.com.',
     apikey_session: 'The user is logged in with an API key; this needs `faable login` without --apikey.',
+    apikey_invalid: 'The API key this server was given is invalid or was revoked. The user needs a new one from the dashboard (project settings → API Keys).',
     not_found: 'Check the id or name — list_apps / list_deployments show what exists.',
     forbidden: 'This session has no access there — check the project (list_projects).',
     app_required: 'Pass `app` (id, name or slug).',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/faable",
-  "version": "4.5.1",
+  "version": "4.5.3",
   "main": "dist/index.js",
   "license": "MIT",
   "author": "Marc Pomar <marc@faable.com>",