@mondaydotcomorg/z2h-cli 0.17.0 → 0.18.0

package/dist/commands/deploy.js

@@ -66,14 +66,14 @@ async function deployPreview({ paths, consumerName, appName, token, opts }) {
     const previewId = opts.previewId ?? crypto.randomUUID().slice(0, 8);
     const previewSlug = util_appName.buildPreviewSlug(consumerName, previewId);
     const previewAppName = util_appName.mfAppName(previewSlug);
-    const keyPrefix = `${constants.S3_PREVIEWS_FOLDER}/${appName}/${previewId}/MF`;
+    const keyPrefix = `${constants.S3_PREVIEWS_FOLDER}/${previewAppName}/MF`;
     // Full CDN URL, not a relative path — trident-skeleton uses a manifest
     // entry's `url` verbatim as the asset base, never joined with its own mfUrl.
     const url = `${constants.BUCKET_READ_DNS_URL}/${keyPrefix}`;
     const nextVersion = (await util_auth_brokerCredentialProvider.fetchDeployVersion(previewAppName)) + 1;
     util_logger.info('building');
     const entry = await buildAndStamp({ paths, publicUrl: url, nextVersion, gitRemote: '' });
-    const creds = await util_auth_brokerCredentialProvider.brokerCredentialProvider({ appName, previewId })();
+    const creds = await util_auth_brokerCredentialProvider.brokerCredentialProvider({ appName: previewAppName, previewId })();
     util_s3_client.setupS3Client(creds);
     util_logger.info(`uploading preview build → s3://${constants.BUCKET_WRITE_NAME}/${keyPrefix}/`);
     await util_s3_upload.uploadDir(paths.shadowBuild, keyPrefix);

package/dist/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,eAAO,MAAM,eAAe,SAAS,CAAC;AAGtC,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAEjD,CAAC;AAKF,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAElD,CAAC;AAMF,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAC9B,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAG9B,eAAO,MAAM,iBAAiB,UAAY,CAAC;AAQ3C,eAAO,MAAM,iBAAiB,qCAAqC,CAAC;AACpE,eAAO,MAAM,MAAM,cAAc,CAAC;AAClC,eAAO,MAAM,gBAAgB,wEAA4D,CAAC;AAE1F,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAC7D,eAAO,MAAM,mBAAmB,+CAAgD,CAAC;AAIjF,eAAO,MAAM,kBAAkB,aAAa,CAAC;AAK7C,eAAO,MAAM,YAAY,cAAc,CAAC;AACxC,eAAO,MAAM,iBAAiB,yDAA2C,CAAC;AAM1E,eAAO,MAAM,gBAAgB,QAA2B,CAAC;AAEzD,eAAO,MAAM,uBAAuB,iBAAiB,CAAC;AAKtD,eAAO,MAAM,uBAAuB,qCAAqC,CAAC;AAE1E;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAID,wBAAgB,cAAc,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGvD;AAKD,eAAO,MAAM,eAAe,iBAAiB,CAAC;AAG9C,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAGnD,eAAO,MAAM,uBAAuB,gCAAgC,CAAC;AAMrE,eAAO,MAAM,iBAAiB,EAAG,eAAwB,CAAC;AAE1D;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,eAAO,MAAM,eAAe,SAAS,CAAC;AAGtC,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAEjD,CAAC;AAKF,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAElD,CAAC;AAMF,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAC9B,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAG9B,eAAO,MAAM,iBAAiB,UAAY,CAAC;AAQ3C,eAAO,MAAM,iBAAiB,qCAAqC,CAAC;AACpE,eAAO,MAAM,MAAM,cAAc,CAAC;AAClC,eAAO,MAAM,gBAAgB,wEAA4D,CAAC;AAE1F,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAC7D,eAAO,MAAM,mBAAmB,+CAAgD,CAAC;AAKjF,eAAO,MAAM,kBAAkB,aAAa,CAAC;AAK7C,eAAO,MAAM,YAAY,cAAc,CAAC;AACxC,eAAO,MAAM,iBAAiB,yDAA2C,CAAC;AAM1E,eAAO,MAAM,gBAAgB,QAA2B,CAAC;AAEzD,eAAO,MAAM,uBAAuB,iBAAiB,CAAC;AAKtD,eAAO,MAAM,uBAAuB,qCAAqC,CAAC;AAE1E;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAID,wBAAgB,cAAc,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGvD;AAKD,eAAO,MAAM,eAAe,iBAAiB,CAAC;AAG9C,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAGnD,eAAO,MAAM,uBAAuB,gCAAgC,CAAC;AAMrE,eAAO,MAAM,iBAAiB,EAAG,eAAwB,CAAC;AAE1D;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C"}

package/dist/constants.js

@@ -34,7 +34,8 @@ const REGION = 'us-east-1';
 const BUCKET_WRITE_URL = `https://${BUCKET_WRITE_NAME}.s3.${REGION}.amazonaws.com`;
 const BUCKET_READ_DNS_NAME = 'bigbrain-zth-mf-assets';
 const BUCKET_READ_DNS_URL = `https://${BUCKET_READ_DNS_NAME}.bigbrain.me`;
-// Root prefix for ephemeral preview uploads: `previews/<appName>/<previewId>/MF/...`.
+// Root prefix for ephemeral preview uploads: `previews/<previewAppName>/MF/...`,
+// where previewAppName is the preview's own `mf-zth-preview-<id>-<app>` name.
 // Shared by the CLI (upload path) and bigbrain-zth (STS policy + manifest overlay).
 const S3_PREVIEWS_FOLDER = 'previews';
 // No `.json` extension — TridentSkeleton's `mfUrl` API appends `/mf-assets`

package/dist/esm/commands/deploy.mjs

@@ -60,14 +60,14 @@ async function deployPreview({ paths, consumerName, appName, token, opts }) {
     const previewId = opts.previewId ?? randomUUID().slice(0, 8);
     const previewSlug = buildPreviewSlug(consumerName, previewId);
     const previewAppName = mfAppName(previewSlug);
-    const keyPrefix = `${S3_PREVIEWS_FOLDER}/${appName}/${previewId}/MF`;
+    const keyPrefix = `${S3_PREVIEWS_FOLDER}/${previewAppName}/MF`;
     // Full CDN URL, not a relative path — trident-skeleton uses a manifest
     // entry's `url` verbatim as the asset base, never joined with its own mfUrl.
     const url = `${BUCKET_READ_DNS_URL}/${keyPrefix}`;
     const nextVersion = (await fetchDeployVersion(previewAppName)) + 1;
     info('building');
     const entry = await buildAndStamp({ paths, publicUrl: url, nextVersion, gitRemote: '' });
-    const creds = await brokerCredentialProvider({ appName, previewId })();
+    const creds = await brokerCredentialProvider({ appName: previewAppName, previewId })();
     setupS3Client(creds);
     info(`uploading preview build → s3://${BUCKET_WRITE_NAME}/${keyPrefix}/`);
     await uploadDir(paths.shadowBuild, keyPrefix);

package/dist/esm/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/constants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,eAAO,MAAM,eAAe,SAAS,CAAC;AAGtC,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAEjD,CAAC;AAKF,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAElD,CAAC;AAMF,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAC9B,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAG9B,eAAO,MAAM,iBAAiB,UAAY,CAAC;AAQ3C,eAAO,MAAM,iBAAiB,qCAAqC,CAAC;AACpE,eAAO,MAAM,MAAM,cAAc,CAAC;AAClC,eAAO,MAAM,gBAAgB,wEAA4D,CAAC;AAE1F,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAC7D,eAAO,MAAM,mBAAmB,+CAAgD,CAAC;AAIjF,eAAO,MAAM,kBAAkB,aAAa,CAAC;AAK7C,eAAO,MAAM,YAAY,cAAc,CAAC;AACxC,eAAO,MAAM,iBAAiB,yDAA2C,CAAC;AAM1E,eAAO,MAAM,gBAAgB,QAA2B,CAAC;AAEzD,eAAO,MAAM,uBAAuB,iBAAiB,CAAC;AAKtD,eAAO,MAAM,uBAAuB,qCAAqC,CAAC;AAE1E;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAID,wBAAgB,cAAc,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGvD;AAKD,eAAO,MAAM,eAAe,iBAAiB,CAAC;AAG9C,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAGnD,eAAO,MAAM,uBAAuB,gCAAgC,CAAC;AAMrE,eAAO,MAAM,iBAAiB,EAAG,eAAwB,CAAC;AAE1D;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/constants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,eAAO,MAAM,eAAe,SAAS,CAAC;AAGtC,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAEjD,CAAC;AAKF,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAElD,CAAC;AAMF,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAC9B,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAG9B,eAAO,MAAM,iBAAiB,UAAY,CAAC;AAQ3C,eAAO,MAAM,iBAAiB,qCAAqC,CAAC;AACpE,eAAO,MAAM,MAAM,cAAc,CAAC;AAClC,eAAO,MAAM,gBAAgB,wEAA4D,CAAC;AAE1F,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAC7D,eAAO,MAAM,mBAAmB,+CAAgD,CAAC;AAKjF,eAAO,MAAM,kBAAkB,aAAa,CAAC;AAK7C,eAAO,MAAM,YAAY,cAAc,CAAC;AACxC,eAAO,MAAM,iBAAiB,yDAA2C,CAAC;AAM1E,eAAO,MAAM,gBAAgB,QAA2B,CAAC;AAEzD,eAAO,MAAM,uBAAuB,iBAAiB,CAAC;AAKtD,eAAO,MAAM,uBAAuB,qCAAqC,CAAC;AAE1E;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAID,wBAAgB,cAAc,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGvD;AAKD,eAAO,MAAM,eAAe,iBAAiB,CAAC;AAG9C,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAGnD,eAAO,MAAM,uBAAuB,gCAAgC,CAAC;AAMrE,eAAO,MAAM,iBAAiB,EAAG,eAAwB,CAAC;AAE1D;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C"}

package/dist/esm/constants.mjs

@@ -32,7 +32,8 @@ const REGION = 'us-east-1';
 const BUCKET_WRITE_URL = `https://${BUCKET_WRITE_NAME}.s3.${REGION}.amazonaws.com`;
 const BUCKET_READ_DNS_NAME = 'bigbrain-zth-mf-assets';
 const BUCKET_READ_DNS_URL = `https://${BUCKET_READ_DNS_NAME}.bigbrain.me`;
-// Root prefix for ephemeral preview uploads: `previews/<appName>/<previewId>/MF/...`.
+// Root prefix for ephemeral preview uploads: `previews/<previewAppName>/MF/...`,
+// where previewAppName is the preview's own `mf-zth-preview-<id>-<app>` name.
 // Shared by the CLI (upload path) and bigbrain-zth (STS policy + manifest overlay).
 const S3_PREVIEWS_FOLDER = 'previews';
 // No `.json` extension — TridentSkeleton's `mfUrl` API appends `/mf-assets`

package/dist/esm/util/auth/broker-credential-provider.d.ts

@@ -10,9 +10,10 @@ export declare function fetchDeployVersion(appName: string): Promise<number>;
 /**
  * AWS SDK credential provider that fetches short-lived credentials from the
  * bigbrain-zth STS broker, scoped to `appName` — or, when `previewId` is
- * given, to a single `previews/<appName>/<previewId>/*` slot instead of the
- * full deploy path. Credentials are cached in memory until 5 minutes before
- * expiry; concurrent calls share a single in-flight fetch.
+ * given, to a single `previews/<appName>/*` slot instead of the full deploy
+ * path (`appName` being the preview's own app name, which already embeds the
+ * id). Credentials are cached in memory until 5 minutes before expiry;
+ * concurrent calls share a single in-flight fetch.
  */
 export declare function brokerCredentialProvider({ appName, previewId, }: {
     appName: string;

package/dist/esm/util/auth/broker-credential-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"broker-credential-provider.d.ts","sourceRoot":"","sources":["../../../../src/util/auth/broker-credential-provider.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAyB,6BAA6B,EAAE,MAAM,gBAAgB,CAAC;AAE3F,eAAO,MAAM,eAAe,6BAA6B,CAAC;AAC1D,eAAO,MAAM,mBAAmB,0BAA0B,CAAC;AA4C3D;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAUzE;AA4DD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,EACvC,OAAO,EACP,SAAS,GACV,EAAE;IACD,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,6BAA6B,CAIhC"}
+{"version":3,"file":"broker-credential-provider.d.ts","sourceRoot":"","sources":["../../../../src/util/auth/broker-credential-provider.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAyB,6BAA6B,EAAE,MAAM,gBAAgB,CAAC;AAE3F,eAAO,MAAM,eAAe,6BAA6B,CAAC;AAC1D,eAAO,MAAM,mBAAmB,0BAA0B,CAAC;AA4C3D;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAUzE;AA4DD;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,EACvC,OAAO,EACP,SAAS,GACV,EAAE;IACD,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,6BAA6B,CAIhC"}

package/dist/esm/util/auth/broker-credential-provider.mjs

@@ -96,9 +96,10 @@ function createCachedCredentialProvider(fetchOnce) {
 /**
  * AWS SDK credential provider that fetches short-lived credentials from the
  * bigbrain-zth STS broker, scoped to `appName` — or, when `previewId` is
- * given, to a single `previews/<appName>/<previewId>/*` slot instead of the
- * full deploy path. Credentials are cached in memory until 5 minutes before
- * expiry; concurrent calls share a single in-flight fetch.
+ * given, to a single `previews/<appName>/*` slot instead of the full deploy
+ * path (`appName` being the preview's own app name, which already embeds the
+ * id). Credentials are cached in memory until 5 minutes before expiry;
+ * concurrent calls share a single in-flight fetch.
  */
 function brokerCredentialProvider({ appName, previewId, }) {
     return createCachedCredentialProvider(() => requestSts(STS_BROKER_PATH, { appName, previewId }, previewId ? 'preview' : 'deploy'));

package/dist/util/auth/broker-credential-provider.d.ts

@@ -10,9 +10,10 @@ export declare function fetchDeployVersion(appName: string): Promise<number>;
 /**
  * AWS SDK credential provider that fetches short-lived credentials from the
  * bigbrain-zth STS broker, scoped to `appName` — or, when `previewId` is
- * given, to a single `previews/<appName>/<previewId>/*` slot instead of the
- * full deploy path. Credentials are cached in memory until 5 minutes before
- * expiry; concurrent calls share a single in-flight fetch.
+ * given, to a single `previews/<appName>/*` slot instead of the full deploy
+ * path (`appName` being the preview's own app name, which already embeds the
+ * id). Credentials are cached in memory until 5 minutes before expiry;
+ * concurrent calls share a single in-flight fetch.
  */
 export declare function brokerCredentialProvider({ appName, previewId, }: {
     appName: string;

package/dist/util/auth/broker-credential-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"broker-credential-provider.d.ts","sourceRoot":"","sources":["../../../src/util/auth/broker-credential-provider.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAyB,6BAA6B,EAAE,MAAM,gBAAgB,CAAC;AAE3F,eAAO,MAAM,eAAe,6BAA6B,CAAC;AAC1D,eAAO,MAAM,mBAAmB,0BAA0B,CAAC;AA4C3D;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAUzE;AA4DD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,EACvC,OAAO,EACP,SAAS,GACV,EAAE;IACD,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,6BAA6B,CAIhC"}
+{"version":3,"file":"broker-credential-provider.d.ts","sourceRoot":"","sources":["../../../src/util/auth/broker-credential-provider.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAyB,6BAA6B,EAAE,MAAM,gBAAgB,CAAC;AAE3F,eAAO,MAAM,eAAe,6BAA6B,CAAC;AAC1D,eAAO,MAAM,mBAAmB,0BAA0B,CAAC;AA4C3D;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAUzE;AA4DD;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,EACvC,OAAO,EACP,SAAS,GACV,EAAE;IACD,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,6BAA6B,CAIhC"}

package/dist/util/auth/broker-credential-provider.js

@@ -98,9 +98,10 @@ function createCachedCredentialProvider(fetchOnce) {
 /**
  * AWS SDK credential provider that fetches short-lived credentials from the
  * bigbrain-zth STS broker, scoped to `appName` — or, when `previewId` is
- * given, to a single `previews/<appName>/<previewId>/*` slot instead of the
- * full deploy path. Credentials are cached in memory until 5 minutes before
- * expiry; concurrent calls share a single in-flight fetch.
+ * given, to a single `previews/<appName>/*` slot instead of the full deploy
+ * path (`appName` being the preview's own app name, which already embeds the
+ * id). Credentials are cached in memory until 5 minutes before expiry;
+ * concurrent calls share a single in-flight fetch.
  */
 function brokerCredentialProvider({ appName, previewId, }) {
     return createCachedCredentialProvider(() => requestSts(STS_BROKER_PATH, { appName, previewId }, previewId ? 'preview' : 'deploy'));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mondaydotcomorg/z2h-cli",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "bin": "./bin/z2h-cli.js",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

package/src/commands/__tests__/deploy.test.ts

@@ -104,15 +104,18 @@ describe('deploy --preview', () => {
     await expect(deployCommand({ preview: true })).rejects.toThrow(/must have a "name" field/);
   });
 
-  it('mints a fresh previewId and uploads to previews/<mfApp>/<id>/MF', async () => {
+  it('mints a fresh previewId and uploads to previews/<previewApp>/MF', async () => {
     await deployCommand({ preview: true });
 
     expect(brokerProvider.brokerCredentialProvider).toHaveBeenCalledTimes(1);
     const call = vi.mocked(brokerProvider.brokerCredentialProvider).mock.calls[0][0];
-    expect(call.appName).toBe('mf-my-app');
     expect(call.previewId).toMatch(/^[0-9a-f]{8}$/);
 
-    expect(uploadDir).toHaveBeenCalledWith(path.join(tmp, '.zth', 'build'), `previews/mf-my-app/${call.previewId}/MF`);
+    const previewAppName = `mf-${buildPreviewSlug('my-app', call.previewId as string)}`;
+    // Credentials are scoped to the folder the upload actually writes, so the
+    // broker is asked for the preview's own name rather than the real app's.
+    expect(call.appName).toBe(previewAppName);
+    expect(uploadDir).toHaveBeenCalledWith(path.join(tmp, '.zth', 'build'), `previews/${previewAppName}/MF`);
   });
 
   it('calls registerOrUpdateApp for a brand-new preview at version 1 with an empty gitRemote', async () => {
@@ -140,13 +143,11 @@ describe('deploy --preview', () => {
     const call = vi.mocked(brokerProvider.brokerCredentialProvider).mock.calls[0][0];
     expect(call.previewId).toBe('existing-preview-id');
 
-    expect(uploadDir).toHaveBeenCalledWith(
-      path.join(tmp, '.zth', 'build'),
-      'previews/mf-my-app/existing-preview-id/MF'
-    );
-
     const previewSlug = buildPreviewSlug('my-app', 'existing-preview-id');
     const previewAppName = `mf-${previewSlug}`;
+
+    expect(uploadDir).toHaveBeenCalledWith(path.join(tmp, '.zth', 'build'), `previews/${previewAppName}/MF`);
+
     expect(brokerApp.registerOrUpdateApp).toHaveBeenCalledWith({
       appName: previewAppName,
       token: 'jwt-stub',
@@ -159,9 +160,10 @@ describe('deploy --preview', () => {
   it('passes a full CDN URL (not a relative path) as publicUrl to the build', async () => {
     await deployCommand({ preview: true, previewId: 'existing-preview-id' });
 
+    const previewAppName = `mf-${buildPreviewSlug('my-app', 'existing-preview-id')}`;
     expect(buildCommand).toHaveBeenCalledWith(
       expect.objectContaining({
-        publicUrl: 'https://bigbrain-zth-mf-assets.bigbrain.me/previews/mf-my-app/existing-preview-id/MF',
+        publicUrl: `https://bigbrain-zth-mf-assets.bigbrain.me/previews/${previewAppName}/MF`,
       })
     );
   });

package/src/commands/deploy.ts

@@ -98,7 +98,7 @@ async function deployPreview({ paths, consumerName, appName, token, opts }: Depl
   const previewId = opts.previewId ?? randomUUID().slice(0, 8);
   const previewSlug = buildPreviewSlug(consumerName, previewId);
   const previewAppName = mfAppName(previewSlug);
-  const keyPrefix = `${S3_PREVIEWS_FOLDER}/${appName}/${previewId}/MF`;
+  const keyPrefix = `${S3_PREVIEWS_FOLDER}/${previewAppName}/MF`;
   // Full CDN URL, not a relative path — trident-skeleton uses a manifest
   // entry's `url` verbatim as the asset base, never joined with its own mfUrl.
   const url = `${BUCKET_READ_DNS_URL}/${keyPrefix}`;
@@ -108,7 +108,7 @@ async function deployPreview({ paths, consumerName, appName, token, opts }: Depl
   info('building');
   const entry = await buildAndStamp({ paths, publicUrl: url, nextVersion, gitRemote: '' });
 
-  const creds = await brokerCredentialProvider({ appName, previewId })();
+  const creds = await brokerCredentialProvider({ appName: previewAppName, previewId })();
   setupS3Client(creds);
 
   info(`uploading preview build → s3://${BUCKET_WRITE_NAME}/${keyPrefix}/`);

package/src/constants.ts

@@ -41,7 +41,8 @@ export const BUCKET_WRITE_URL = `https://${BUCKET_WRITE_NAME}.s3.${REGION}.amazo
 export const BUCKET_READ_DNS_NAME = 'bigbrain-zth-mf-assets';
 export const BUCKET_READ_DNS_URL = `https://${BUCKET_READ_DNS_NAME}.bigbrain.me`;
 
-// Root prefix for ephemeral preview uploads: `previews/<appName>/<previewId>/MF/...`.
+// Root prefix for ephemeral preview uploads: `previews/<previewAppName>/MF/...`,
+// where previewAppName is the preview's own `mf-zth-preview-<id>-<app>` name.
 // Shared by the CLI (upload path) and bigbrain-zth (STS policy + manifest overlay).
 export const S3_PREVIEWS_FOLDER = 'previews';
 

package/src/util/auth/broker-credential-provider.ts

@@ -125,9 +125,10 @@ function createCachedCredentialProvider(
 /**
  * AWS SDK credential provider that fetches short-lived credentials from the
  * bigbrain-zth STS broker, scoped to `appName` — or, when `previewId` is
- * given, to a single `previews/<appName>/<previewId>/*` slot instead of the
- * full deploy path. Credentials are cached in memory until 5 minutes before
- * expiry; concurrent calls share a single in-flight fetch.
+ * given, to a single `previews/<appName>/*` slot instead of the full deploy
+ * path (`appName` being the preview's own app name, which already embeds the
+ * id). Credentials are cached in memory until 5 minutes before expiry;
+ * concurrent calls share a single in-flight fetch.
  */
 export function brokerCredentialProvider({
   appName,