@mondaydotcomorg/z2h-cli 0.17.0 → 0.18.1

package/dist/commands/deploy.js

@@ -66,14 +66,14 @@ async function deployPreview({ paths, consumerName, appName, token, opts }) {
     const previewId = opts.previewId ?? crypto.randomUUID().slice(0, 8);
     const previewSlug = util_appName.buildPreviewSlug(consumerName, previewId);
     const previewAppName = util_appName.mfAppName(previewSlug);
-    const keyPrefix = `${constants.S3_PREVIEWS_FOLDER}/${appName}/${previewId}/MF`;
+    const keyPrefix = `${constants.S3_PREVIEWS_FOLDER}/${previewAppName}/MF`;
     // Full CDN URL, not a relative path — trident-skeleton uses a manifest
     // entry's `url` verbatim as the asset base, never joined with its own mfUrl.
     const url = `${constants.BUCKET_READ_DNS_URL}/${keyPrefix}`;
     const nextVersion = (await util_auth_brokerCredentialProvider.fetchDeployVersion(previewAppName)) + 1;
     util_logger.info('building');
     const entry = await buildAndStamp({ paths, publicUrl: url, nextVersion, gitRemote: '' });
-    const creds = await util_auth_brokerCredentialProvider.brokerCredentialProvider({ appName, previewId })();
+    const creds = await util_auth_brokerCredentialProvider.brokerCredentialProvider({ appName: previewAppName, previewId })();
     util_s3_client.setupS3Client(creds);
     util_logger.info(`uploading preview build → s3://${constants.BUCKET_WRITE_NAME}/${keyPrefix}/`);
     await util_s3_upload.uploadDir(paths.shadowBuild, keyPrefix);

package/dist/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,eAAO,MAAM,eAAe,SAAS,CAAC;AAGtC,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAEjD,CAAC;AAKF,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAElD,CAAC;AAMF,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAC9B,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAG9B,eAAO,MAAM,iBAAiB,UAAY,CAAC;AAQ3C,eAAO,MAAM,iBAAiB,qCAAqC,CAAC;AACpE,eAAO,MAAM,MAAM,cAAc,CAAC;AAClC,eAAO,MAAM,gBAAgB,wEAA4D,CAAC;AAE1F,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAC7D,eAAO,MAAM,mBAAmB,+CAAgD,CAAC;AAIjF,eAAO,MAAM,kBAAkB,aAAa,CAAC;AAK7C,eAAO,MAAM,YAAY,cAAc,CAAC;AACxC,eAAO,MAAM,iBAAiB,yDAA2C,CAAC;AAM1E,eAAO,MAAM,gBAAgB,QAA2B,CAAC;AAEzD,eAAO,MAAM,uBAAuB,iBAAiB,CAAC;AAKtD,eAAO,MAAM,uBAAuB,qCAAqC,CAAC;AAE1E;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAID,wBAAgB,cAAc,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGvD;AAKD,eAAO,MAAM,eAAe,iBAAiB,CAAC;AAG9C,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAGnD,eAAO,MAAM,uBAAuB,gCAAgC,CAAC;AAMrE,eAAO,MAAM,iBAAiB,EAAG,eAAwB,CAAC;AAE1D;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,eAAO,MAAM,eAAe,SAAS,CAAC;AAGtC,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAEjD,CAAC;AAKF,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAElD,CAAC;AAMF,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAC9B,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAG9B,eAAO,MAAM,iBAAiB,UAAY,CAAC;AAQ3C,eAAO,MAAM,iBAAiB,qCAAqC,CAAC;AACpE,eAAO,MAAM,MAAM,cAAc,CAAC;AAClC,eAAO,MAAM,gBAAgB,wEAA4D,CAAC;AAE1F,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAC7D,eAAO,MAAM,mBAAmB,+CAAgD,CAAC;AAKjF,eAAO,MAAM,kBAAkB,aAAa,CAAC;AAK7C,eAAO,MAAM,YAAY,cAAc,CAAC;AACxC,eAAO,MAAM,iBAAiB,yDAA2C,CAAC;AAM1E,eAAO,MAAM,gBAAgB,QAA2B,CAAC;AAEzD,eAAO,MAAM,uBAAuB,iBAAiB,CAAC;AAKtD,eAAO,MAAM,uBAAuB,qCAAqC,CAAC;AAE1E;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAID,wBAAgB,cAAc,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGvD;AAKD,eAAO,MAAM,eAAe,iBAAiB,CAAC;AAG9C,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAGnD,eAAO,MAAM,uBAAuB,gCAAgC,CAAC;AAMrE,eAAO,MAAM,iBAAiB,EAAG,eAAwB,CAAC;AAE1D;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C"}

package/dist/constants.js

@@ -34,7 +34,8 @@ const REGION = 'us-east-1';
 const BUCKET_WRITE_URL = `https://${BUCKET_WRITE_NAME}.s3.${REGION}.amazonaws.com`;
 const BUCKET_READ_DNS_NAME = 'bigbrain-zth-mf-assets';
 const BUCKET_READ_DNS_URL = `https://${BUCKET_READ_DNS_NAME}.bigbrain.me`;
-// Root prefix for ephemeral preview uploads: `previews/<appName>/<previewId>/MF/...`.
+// Root prefix for ephemeral preview uploads: `previews/<previewAppName>/MF/...`,
+// where previewAppName is the preview's own `mf-zth-preview-<id>-<app>` name.
 // Shared by the CLI (upload path) and bigbrain-zth (STS policy + manifest overlay).
 const S3_PREVIEWS_FOLDER = 'previews';
 // No `.json` extension — TridentSkeleton's `mfUrl` API appends `/mf-assets`

package/dist/esm/commands/deploy.mjs

@@ -60,14 +60,14 @@ async function deployPreview({ paths, consumerName, appName, token, opts }) {
     const previewId = opts.previewId ?? randomUUID().slice(0, 8);
     const previewSlug = buildPreviewSlug(consumerName, previewId);
     const previewAppName = mfAppName(previewSlug);
-    const keyPrefix = `${S3_PREVIEWS_FOLDER}/${appName}/${previewId}/MF`;
+    const keyPrefix = `${S3_PREVIEWS_FOLDER}/${previewAppName}/MF`;
     // Full CDN URL, not a relative path — trident-skeleton uses a manifest
     // entry's `url` verbatim as the asset base, never joined with its own mfUrl.
     const url = `${BUCKET_READ_DNS_URL}/${keyPrefix}`;
     const nextVersion = (await fetchDeployVersion(previewAppName)) + 1;
     info('building');
     const entry = await buildAndStamp({ paths, publicUrl: url, nextVersion, gitRemote: '' });
-    const creds = await brokerCredentialProvider({ appName, previewId })();
+    const creds = await brokerCredentialProvider({ appName: previewAppName, previewId })();
     setupS3Client(creds);
     info(`uploading preview build → s3://${BUCKET_WRITE_NAME}/${keyPrefix}/`);
     await uploadDir(paths.shadowBuild, keyPrefix);

package/dist/esm/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/constants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,eAAO,MAAM,eAAe,SAAS,CAAC;AAGtC,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAEjD,CAAC;AAKF,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAElD,CAAC;AAMF,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAC9B,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAG9B,eAAO,MAAM,iBAAiB,UAAY,CAAC;AAQ3C,eAAO,MAAM,iBAAiB,qCAAqC,CAAC;AACpE,eAAO,MAAM,MAAM,cAAc,CAAC;AAClC,eAAO,MAAM,gBAAgB,wEAA4D,CAAC;AAE1F,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAC7D,eAAO,MAAM,mBAAmB,+CAAgD,CAAC;AAIjF,eAAO,MAAM,kBAAkB,aAAa,CAAC;AAK7C,eAAO,MAAM,YAAY,cAAc,CAAC;AACxC,eAAO,MAAM,iBAAiB,yDAA2C,CAAC;AAM1E,eAAO,MAAM,gBAAgB,QAA2B,CAAC;AAEzD,eAAO,MAAM,uBAAuB,iBAAiB,CAAC;AAKtD,eAAO,MAAM,uBAAuB,qCAAqC,CAAC;AAE1E;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAID,wBAAgB,cAAc,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGvD;AAKD,eAAO,MAAM,eAAe,iBAAiB,CAAC;AAG9C,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAGnD,eAAO,MAAM,uBAAuB,gCAAgC,CAAC;AAMrE,eAAO,MAAM,iBAAiB,EAAG,eAAwB,CAAC;AAE1D;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/constants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,eAAO,MAAM,eAAe,SAAS,CAAC;AAGtC,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAEjD,CAAC;AAKF,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAElD,CAAC;AAMF,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAC9B,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAG9B,eAAO,MAAM,iBAAiB,UAAY,CAAC;AAQ3C,eAAO,MAAM,iBAAiB,qCAAqC,CAAC;AACpE,eAAO,MAAM,MAAM,cAAc,CAAC;AAClC,eAAO,MAAM,gBAAgB,wEAA4D,CAAC;AAE1F,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAC7D,eAAO,MAAM,mBAAmB,+CAAgD,CAAC;AAKjF,eAAO,MAAM,kBAAkB,aAAa,CAAC;AAK7C,eAAO,MAAM,YAAY,cAAc,CAAC;AACxC,eAAO,MAAM,iBAAiB,yDAA2C,CAAC;AAM1E,eAAO,MAAM,gBAAgB,QAA2B,CAAC;AAEzD,eAAO,MAAM,uBAAuB,iBAAiB,CAAC;AAKtD,eAAO,MAAM,uBAAuB,qCAAqC,CAAC;AAE1E;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAID,wBAAgB,cAAc,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGvD;AAKD,eAAO,MAAM,eAAe,iBAAiB,CAAC;AAG9C,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAGnD,eAAO,MAAM,uBAAuB,gCAAgC,CAAC;AAMrE,eAAO,MAAM,iBAAiB,EAAG,eAAwB,CAAC;AAE1D;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C"}

package/dist/esm/constants.mjs

@@ -32,7 +32,8 @@ const REGION = 'us-east-1';
 const BUCKET_WRITE_URL = `https://${BUCKET_WRITE_NAME}.s3.${REGION}.amazonaws.com`;
 const BUCKET_READ_DNS_NAME = 'bigbrain-zth-mf-assets';
 const BUCKET_READ_DNS_URL = `https://${BUCKET_READ_DNS_NAME}.bigbrain.me`;
-// Root prefix for ephemeral preview uploads: `previews/<appName>/<previewId>/MF/...`.
+// Root prefix for ephemeral preview uploads: `previews/<previewAppName>/MF/...`,
+// where previewAppName is the preview's own `mf-zth-preview-<id>-<app>` name.
 // Shared by the CLI (upload path) and bigbrain-zth (STS policy + manifest overlay).
 const S3_PREVIEWS_FOLDER = 'previews';
 // No `.json` extension — TridentSkeleton's `mfUrl` API appends `/mf-assets`

package/dist/esm/util/auth/broker-credential-provider.d.ts

@@ -10,9 +10,10 @@ export declare function fetchDeployVersion(appName: string): Promise<number>;
 /**
  * AWS SDK credential provider that fetches short-lived credentials from the
  * bigbrain-zth STS broker, scoped to `appName` — or, when `previewId` is
- * given, to a single `previews/<appName>/<previewId>/*` slot instead of the
- * full deploy path. Credentials are cached in memory until 5 minutes before
- * expiry; concurrent calls share a single in-flight fetch.
+ * given, to a single `previews/<appName>/*` slot instead of the full deploy
+ * path (`appName` being the preview's own app name, which already embeds the
+ * id). Credentials are cached in memory until 5 minutes before expiry;
+ * concurrent calls share a single in-flight fetch.
  */
 export declare function brokerCredentialProvider({ appName, previewId, }: {
     appName: string;

package/dist/esm/util/auth/broker-credential-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"broker-credential-provider.d.ts","sourceRoot":"","sources":["../../../../src/util/auth/broker-credential-provider.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAyB,6BAA6B,EAAE,MAAM,gBAAgB,CAAC;AAE3F,eAAO,MAAM,eAAe,6BAA6B,CAAC;AAC1D,eAAO,MAAM,mBAAmB,0BAA0B,CAAC;AA4C3D;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAUzE;AA4DD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,EACvC,OAAO,EACP,SAAS,GACV,EAAE;IACD,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,6BAA6B,CAIhC"}
+{"version":3,"file":"broker-credential-provider.d.ts","sourceRoot":"","sources":["../../../../src/util/auth/broker-credential-provider.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAyB,6BAA6B,EAAE,MAAM,gBAAgB,CAAC;AAE3F,eAAO,MAAM,eAAe,6BAA6B,CAAC;AAC1D,eAAO,MAAM,mBAAmB,0BAA0B,CAAC;AAiD3D;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAUzE;AA4DD;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,EACvC,OAAO,EACP,SAAS,GACV,EAAE;IACD,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,6BAA6B,CAIhC"}

package/dist/esm/util/auth/broker-credential-provider.mjs

@@ -26,8 +26,11 @@ async function postToBroker(path, body) {
     }
 }
 function assertBrokerOk(res) {
-    if (res.status === 401 || res.status === 403) {
-        throw new Error(`Z2H deploy token rejected by the broker (${res.status}). Refresh user token by running 'z2h-cli generate-z2h-token'.`);
+    if (res.status === 401) {
+        throw new Error(`Z2H deploy token rejected by the broker (401). Refresh user token by running 'z2h-cli generate-z2h-token'.`);
+    }
+    if (res.status === 403) {
+        throw new Error(`Access denied (403). You do not have editor access to this app. Ask the app owner to grant you access via 'z2h-cli grant'.`);
     }
 }
 /**
@@ -96,9 +99,10 @@ function createCachedCredentialProvider(fetchOnce) {
 /**
  * AWS SDK credential provider that fetches short-lived credentials from the
  * bigbrain-zth STS broker, scoped to `appName` — or, when `previewId` is
- * given, to a single `previews/<appName>/<previewId>/*` slot instead of the
- * full deploy path. Credentials are cached in memory until 5 minutes before
- * expiry; concurrent calls share a single in-flight fetch.
+ * given, to a single `previews/<appName>/*` slot instead of the full deploy
+ * path (`appName` being the preview's own app name, which already embeds the
+ * id). Credentials are cached in memory until 5 minutes before expiry;
+ * concurrent calls share a single in-flight fetch.
  */
 function brokerCredentialProvider({ appName, previewId, }) {
     return createCachedCredentialProvider(() => requestSts(STS_BROKER_PATH, { appName, previewId }, previewId ? 'preview' : 'deploy'));

package/dist/esm/util/broker/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../../../src/util/broker/app.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAiBvE;AAwCD,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,aAAa,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAWtF"}
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../../../src/util/broker/app.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAsBvE;AAwCD,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,aAAa,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAWtF"}

package/dist/esm/util/broker/app.mjs

@@ -19,6 +19,9 @@ async function fetchApp(appName) {
     if (res.status === 404) {
         return null;
     }
+    if (res.status === 403) {
+        throw new Error(`Access denied (403). You do not have access to this app. Ask the app owner to grant you access via 'z2h-cli grant'.`);
+    }
     if (!res.ok) {
         const text = await res.text();
         throw new Error(`Z2H app lookup failed (${res.status}): ${text.slice(0, 512)}`);

package/dist/util/auth/broker-credential-provider.d.ts

@@ -10,9 +10,10 @@ export declare function fetchDeployVersion(appName: string): Promise<number>;
 /**
  * AWS SDK credential provider that fetches short-lived credentials from the
  * bigbrain-zth STS broker, scoped to `appName` — or, when `previewId` is
- * given, to a single `previews/<appName>/<previewId>/*` slot instead of the
- * full deploy path. Credentials are cached in memory until 5 minutes before
- * expiry; concurrent calls share a single in-flight fetch.
+ * given, to a single `previews/<appName>/*` slot instead of the full deploy
+ * path (`appName` being the preview's own app name, which already embeds the
+ * id). Credentials are cached in memory until 5 minutes before expiry;
+ * concurrent calls share a single in-flight fetch.
  */
 export declare function brokerCredentialProvider({ appName, previewId, }: {
     appName: string;

package/dist/util/auth/broker-credential-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"broker-credential-provider.d.ts","sourceRoot":"","sources":["../../../src/util/auth/broker-credential-provider.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAyB,6BAA6B,EAAE,MAAM,gBAAgB,CAAC;AAE3F,eAAO,MAAM,eAAe,6BAA6B,CAAC;AAC1D,eAAO,MAAM,mBAAmB,0BAA0B,CAAC;AA4C3D;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAUzE;AA4DD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,EACvC,OAAO,EACP,SAAS,GACV,EAAE;IACD,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,6BAA6B,CAIhC"}
+{"version":3,"file":"broker-credential-provider.d.ts","sourceRoot":"","sources":["../../../src/util/auth/broker-credential-provider.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAyB,6BAA6B,EAAE,MAAM,gBAAgB,CAAC;AAE3F,eAAO,MAAM,eAAe,6BAA6B,CAAC;AAC1D,eAAO,MAAM,mBAAmB,0BAA0B,CAAC;AAiD3D;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAUzE;AA4DD;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,EACvC,OAAO,EACP,SAAS,GACV,EAAE;IACD,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,6BAA6B,CAIhC"}

package/dist/util/auth/broker-credential-provider.js

@@ -28,8 +28,11 @@ async function postToBroker(path, body) {
     }
 }
 function assertBrokerOk(res) {
-    if (res.status === 401 || res.status === 403) {
-        throw new Error(`Z2H deploy token rejected by the broker (${res.status}). Refresh user token by running 'z2h-cli generate-z2h-token'.`);
+    if (res.status === 401) {
+        throw new Error(`Z2H deploy token rejected by the broker (401). Refresh user token by running 'z2h-cli generate-z2h-token'.`);
+    }
+    if (res.status === 403) {
+        throw new Error(`Access denied (403). You do not have editor access to this app. Ask the app owner to grant you access via 'z2h-cli grant'.`);
     }
 }
 /**
@@ -98,9 +101,10 @@ function createCachedCredentialProvider(fetchOnce) {
 /**
  * AWS SDK credential provider that fetches short-lived credentials from the
  * bigbrain-zth STS broker, scoped to `appName` — or, when `previewId` is
- * given, to a single `previews/<appName>/<previewId>/*` slot instead of the
- * full deploy path. Credentials are cached in memory until 5 minutes before
- * expiry; concurrent calls share a single in-flight fetch.
+ * given, to a single `previews/<appName>/*` slot instead of the full deploy
+ * path (`appName` being the preview's own app name, which already embeds the
+ * id). Credentials are cached in memory until 5 minutes before expiry;
+ * concurrent calls share a single in-flight fetch.
  */
 function brokerCredentialProvider({ appName, previewId, }) {
     return createCachedCredentialProvider(() => requestSts(STS_BROKER_PATH, { appName, previewId }, previewId ? 'preview' : 'deploy'));

package/dist/util/broker/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../../src/util/broker/app.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAiBvE;AAwCD,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,aAAa,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAWtF"}
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../../src/util/broker/app.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAsBvE;AAwCD,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,aAAa,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAWtF"}

package/dist/util/broker/app.js

@@ -21,6 +21,9 @@ async function fetchApp(appName) {
     if (res.status === 404) {
         return null;
     }
+    if (res.status === 403) {
+        throw new Error(`Access denied (403). You do not have access to this app. Ask the app owner to grant you access via 'z2h-cli grant'.`);
+    }
     if (!res.ok) {
         const text = await res.text();
         throw new Error(`Z2H app lookup failed (${res.status}): ${text.slice(0, 512)}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mondaydotcomorg/z2h-cli",
-  "version": "0.17.0",
+  "version": "0.18.1",
   "bin": "./bin/z2h-cli.js",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

package/src/commands/__tests__/deploy.test.ts

@@ -104,15 +104,18 @@ describe('deploy --preview', () => {
     await expect(deployCommand({ preview: true })).rejects.toThrow(/must have a "name" field/);
   });
 
-  it('mints a fresh previewId and uploads to previews/<mfApp>/<id>/MF', async () => {
+  it('mints a fresh previewId and uploads to previews/<previewApp>/MF', async () => {
     await deployCommand({ preview: true });
 
     expect(brokerProvider.brokerCredentialProvider).toHaveBeenCalledTimes(1);
     const call = vi.mocked(brokerProvider.brokerCredentialProvider).mock.calls[0][0];
-    expect(call.appName).toBe('mf-my-app');
     expect(call.previewId).toMatch(/^[0-9a-f]{8}$/);
 
-    expect(uploadDir).toHaveBeenCalledWith(path.join(tmp, '.zth', 'build'), `previews/mf-my-app/${call.previewId}/MF`);
+    const previewAppName = `mf-${buildPreviewSlug('my-app', call.previewId as string)}`;
+    // Credentials are scoped to the folder the upload actually writes, so the
+    // broker is asked for the preview's own name rather than the real app's.
+    expect(call.appName).toBe(previewAppName);
+    expect(uploadDir).toHaveBeenCalledWith(path.join(tmp, '.zth', 'build'), `previews/${previewAppName}/MF`);
   });
 
   it('calls registerOrUpdateApp for a brand-new preview at version 1 with an empty gitRemote', async () => {
@@ -140,13 +143,11 @@ describe('deploy --preview', () => {
     const call = vi.mocked(brokerProvider.brokerCredentialProvider).mock.calls[0][0];
     expect(call.previewId).toBe('existing-preview-id');
 
-    expect(uploadDir).toHaveBeenCalledWith(
-      path.join(tmp, '.zth', 'build'),
-      'previews/mf-my-app/existing-preview-id/MF'
-    );
-
     const previewSlug = buildPreviewSlug('my-app', 'existing-preview-id');
     const previewAppName = `mf-${previewSlug}`;
+
+    expect(uploadDir).toHaveBeenCalledWith(path.join(tmp, '.zth', 'build'), `previews/${previewAppName}/MF`);
+
     expect(brokerApp.registerOrUpdateApp).toHaveBeenCalledWith({
       appName: previewAppName,
       token: 'jwt-stub',
@@ -159,9 +160,10 @@ describe('deploy --preview', () => {
   it('passes a full CDN URL (not a relative path) as publicUrl to the build', async () => {
     await deployCommand({ preview: true, previewId: 'existing-preview-id' });
 
+    const previewAppName = `mf-${buildPreviewSlug('my-app', 'existing-preview-id')}`;
     expect(buildCommand).toHaveBeenCalledWith(
       expect.objectContaining({
-        publicUrl: 'https://bigbrain-zth-mf-assets.bigbrain.me/previews/mf-my-app/existing-preview-id/MF',
+        publicUrl: `https://bigbrain-zth-mf-assets.bigbrain.me/previews/${previewAppName}/MF`,
       })
     );
   });

package/src/commands/deploy.ts

@@ -98,7 +98,7 @@ async function deployPreview({ paths, consumerName, appName, token, opts }: Depl
   const previewId = opts.previewId ?? randomUUID().slice(0, 8);
   const previewSlug = buildPreviewSlug(consumerName, previewId);
   const previewAppName = mfAppName(previewSlug);
-  const keyPrefix = `${S3_PREVIEWS_FOLDER}/${appName}/${previewId}/MF`;
+  const keyPrefix = `${S3_PREVIEWS_FOLDER}/${previewAppName}/MF`;
   // Full CDN URL, not a relative path — trident-skeleton uses a manifest
   // entry's `url` verbatim as the asset base, never joined with its own mfUrl.
   const url = `${BUCKET_READ_DNS_URL}/${keyPrefix}`;
@@ -108,7 +108,7 @@ async function deployPreview({ paths, consumerName, appName, token, opts }: Depl
   info('building');
   const entry = await buildAndStamp({ paths, publicUrl: url, nextVersion, gitRemote: '' });
 
-  const creds = await brokerCredentialProvider({ appName, previewId })();
+  const creds = await brokerCredentialProvider({ appName: previewAppName, previewId })();
   setupS3Client(creds);
 
   info(`uploading preview build → s3://${BUCKET_WRITE_NAME}/${keyPrefix}/`);

package/src/constants.ts

@@ -41,7 +41,8 @@ export const BUCKET_WRITE_URL = `https://${BUCKET_WRITE_NAME}.s3.${REGION}.amazo
 export const BUCKET_READ_DNS_NAME = 'bigbrain-zth-mf-assets';
 export const BUCKET_READ_DNS_URL = `https://${BUCKET_READ_DNS_NAME}.bigbrain.me`;
 
-// Root prefix for ephemeral preview uploads: `previews/<appName>/<previewId>/MF/...`.
+// Root prefix for ephemeral preview uploads: `previews/<previewAppName>/MF/...`,
+// where previewAppName is the preview's own `mf-zth-preview-<id>-<app>` name.
 // Shared by the CLI (upload path) and bigbrain-zth (STS policy + manifest overlay).
 export const S3_PREVIEWS_FOLDER = 'previews';
 

package/src/util/auth/__tests__/broker-credential-provider.test.ts

@@ -62,6 +62,12 @@ describe('fetchDeployVersion', () => {
     mockFetchOnce({}, { status: 401, text: 'Unauthorized' });
     await expect(fetchDeployVersion('my-app')).rejects.toThrow(/token rejected by the broker/);
   });
+
+  it('surfaces an access-denied hint on 403', async () => {
+    mockFetchOnce({}, { status: 403, text: 'Forbidden' });
+    await expect(fetchDeployVersion('my-app')).rejects.toThrow(/Access denied/);
+    await expect(fetchDeployVersion('my-app')).rejects.toThrow(/z2h-cli grant/);
+  });
 });
 
 describe('brokerCredentialProvider', () => {
@@ -132,6 +138,13 @@ describe('brokerCredentialProvider', () => {
     await expect(provider()).rejects.toThrow(/generate-z2h-token/);
   });
 
+  it('surfaces an access-denied hint on 403', async () => {
+    mockFetchOnce({}, { status: 403, text: 'Forbidden' });
+    const provider = brokerCredentialProvider({ appName: 'my-app' });
+    await expect(provider()).rejects.toThrow(/Access denied/);
+    await expect(provider()).rejects.toThrow(/z2h-cli grant/);
+  });
+
   it('honors Z2H_BROKER_BASE_URL override', async () => {
     vi.stubEnv('Z2H_BROKER_BASE_URL', 'https://staging.example.com');
     const fetchMock = mockFetchOnce({ ...STUB_CREDS, expiration: FAR_FUTURE_EXPIRY });
@@ -191,6 +204,13 @@ describe('brokerCredentialProvider', () => {
       await expect(provider()).rejects.toThrow(/generate-z2h-token/);
     });
 
+    it('surfaces an access-denied hint on 403', async () => {
+      mockFetchOnce({}, { status: 403, text: 'Forbidden' });
+      const provider = brokerCredentialProvider({ appName: 'mf-my-app', previewId: 'preview-1' });
+      await expect(provider()).rejects.toThrow(/Access denied/);
+      await expect(provider()).rejects.toThrow(/z2h-cli grant/);
+    });
+
     it('rejects responses missing required credential fields', async () => {
       mockFetchOnce({ accessKeyId: 'AKIA-stub' });
       const provider = brokerCredentialProvider({ appName: 'mf-my-app', previewId: 'preview-1' });

package/src/util/auth/broker-credential-provider.ts

@@ -40,9 +40,14 @@ async function postToBroker(path: string, body: unknown): Promise<Response> {
 }
 
 function assertBrokerOk(res: Response): void {
-  if (res.status === 401 || res.status === 403) {
+  if (res.status === 401) {
     throw new Error(
-      `Z2H deploy token rejected by the broker (${res.status}). Refresh user token by running 'z2h-cli generate-z2h-token'.`
+      `Z2H deploy token rejected by the broker (401). Refresh user token by running 'z2h-cli generate-z2h-token'.`
+    );
+  }
+  if (res.status === 403) {
+    throw new Error(
+      `Access denied (403). You do not have editor access to this app. Ask the app owner to grant you access via 'z2h-cli grant'.`
     );
   }
 }
@@ -125,9 +130,10 @@ function createCachedCredentialProvider(
 /**
  * AWS SDK credential provider that fetches short-lived credentials from the
  * bigbrain-zth STS broker, scoped to `appName` — or, when `previewId` is
- * given, to a single `previews/<appName>/<previewId>/*` slot instead of the
- * full deploy path. Credentials are cached in memory until 5 minutes before
- * expiry; concurrent calls share a single in-flight fetch.
+ * given, to a single `previews/<appName>/*` slot instead of the full deploy
+ * path (`appName` being the preview's own app name, which already embeds the
+ * id). Credentials are cached in memory until 5 minutes before expiry;
+ * concurrent calls share a single in-flight fetch.
  */
 export function brokerCredentialProvider({
   appName,

package/src/util/broker/app.ts

@@ -29,6 +29,11 @@ export async function fetchApp(appName: string): Promise<AppInfo | null> {
   if (res.status === 404) {
     return null;
   }
+  if (res.status === 403) {
+    throw new Error(
+      `Access denied (403). You do not have access to this app. Ask the app owner to grant you access via 'z2h-cli grant'.`
+    );
+  }
   if (!res.ok) {
     const text = await res.text();
     throw new Error(`Z2H app lookup failed (${res.status}): ${text.slice(0, 512)}`);