nimblybase 0.1.5 → 0.1.7

package/README.md

@@ -30,7 +30,14 @@ keychain on macOS, and otherwise in
 `~/.config/nimblybase/credentials.json` with permissions `0600`. `nimbly
 login` always says which one it used.
 
-For a machine without a browser, create an access token in the dashboard
+For a machine without a local browser, run `nimbly login --device`. Open the
+displayed verification page on another device and enter the short code. The
+dashboard shows the requesting client and approved workspace/scopes. The CLI
+waits at the server's polling interval, backs off on slow-down, and stops on
+denial or expiry. A failed attempt keeps your previous login. Device sign-in
+still requires a person; it is not unattended CI authentication.
+
+For an explicit pasted-token fallback, create an access token in the dashboard
 under **Access tokens** and run `nimbly login --token <token>`. Omitting the
 value prompts without echoing it.
 
@@ -245,3 +252,9 @@ nimbly sql "select * from notes where id = ?" --param 7
 go into the statement string: a CLI whose only option is to paste them in
 teaches everybody — and every agent reading a shell history — to write
 injectable SQL.
+
+Public frontend keys can be issued after browser/device login with
+`nimbly keys create "web frontend" --type anon` (requires `projects:write`).
+They obey row and storage policies. `--type service`, key listing and revocation
+require separate session/PAT key-management authority and remain unavailable
+through OAuth. Never put the agent’s OAuth credential in application code.

package/dist/index.js

@@ -68,6 +68,7 @@ function parse(argv) {
         spa: { type: "boolean" },
         build: { type: "boolean" },
         "token-only": { type: "boolean" },
+        device: { type: "boolean" },
         off: { type: "boolean" },
         using: { type: "string" },
         check: { type: "string" },
@@ -140,6 +141,7 @@ function parse(argv) {
       spa: v.spa === true ? true : void 0,
       build: v.build === true ? true : void 0,
       tokenOnly: v["token-only"] === true ? true : void 0,
+      device: v.device === true ? true : void 0,
       off: v.off === true ? true : void 0,
       using: v.using,
       check: v.check,
@@ -182,7 +184,8 @@ USAGE
   nimbly <command> [options]
 
 GETTING STARTED
-  login                    Sign in with an access token from the dashboard
+  login                    Sign in through your browser; --device for another machine
+                           --token-only is the explicit pasted-PAT fallback
   init [name]              Create or explicitly choose a project for this repo
   describe                 Show what the linked project's backend can do
   architect [requirements] Inspect this repo and propose a reviewable architecture
@@ -370,7 +373,7 @@ function when(iso) {
 
 // src/api.ts
 var DEFAULT_API_URL = "https://api-uat.nimblybase.com";
-var VERSION = "0.1.5";
+var VERSION = "0.1.7";
 function dashboardUrl(api) {
   const match = /^https:\/\/api(-[a-z0-9]+)?\.(.+)$/.exec(api);
   return match ? `https://app${match[1] ?? ""}.${match[2]}` : null;
@@ -470,8 +473,8 @@ function createClient(base, token) {
     resumeProject: (id) => req(`/v1/projects/${id}/resume`, { method: "POST", body: "{}" }),
     keys: (projectId) => req(`/v1/projects/${projectId}/keys`),
     createKey: (projectId, input) => req(
-      `/v1/projects/${projectId}/keys`,
-      { method: "POST", body: JSON.stringify(input) }
+      `/v1/projects/${projectId}/${input.type === "anon" ? "application-keys" : "keys"}`,
+      { method: "POST", body: JSON.stringify(input.type === "anon" ? { name: input.name } : input) }
     ),
     revokeKey: (keyId) => req(`/v1/keys/${keyId}`, { method: "DELETE" }),
     // --- project data ---------------------------------------------------
@@ -660,7 +663,7 @@ async function discover(issuer, fetchImpl = fetch) {
   if (!doc.authorization_endpoint || !doc.token_endpoint) {
     throw new Error("the authorization server metadata is missing an endpoint this flow needs");
   }
-  for (const endpoint of [doc.token_endpoint, doc.registration_endpoint].filter(Boolean)) {
+  for (const endpoint of [doc.token_endpoint, doc.registration_endpoint, doc.device_authorization_endpoint].filter(Boolean)) {
     const target = new URL(endpoint);
     if (target.origin !== origin || target.username || target.password || target.hash) {
       throw new Error("the authorization server advertises a credential endpoint outside its API origin");
@@ -782,6 +785,57 @@ function grantResponse(body, clientId) {
     scopes: String(body.scope ?? "").split(" ").filter(Boolean)
   };
 }
+async function deviceLogin(input, fetchImpl = fetch) {
+  const doc = await discover(input.issuer, fetchImpl);
+  if (!doc.device_authorization_endpoint || !doc.registration_endpoint) {
+    throw new Error("this server does not offer device sign-in and client registration");
+  }
+  const clientId = await registerClient(doc.registration_endpoint, fetchImpl);
+  const start = await fetchImpl(doc.device_authorization_endpoint, {
+    method: "POST",
+    redirect: "error",
+    signal: AbortSignal.timeout(3e4),
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({ client_id: clientId }).toString()
+  });
+  if (!start.ok) throw new Error("device sign-in could not be started");
+  const device = await start.json();
+  if (typeof device.device_code !== "string" || !/^nb_oat_[A-Za-z0-9_-]+$/.test(device.device_code) || typeof device.user_code !== "string" || !/^[A-Z0-9]{4}-[A-Z0-9]{4}$/.test(device.user_code) || typeof device.verification_uri !== "string" || typeof device.expires_in !== "number" || !Number.isInteger(device.expires_in) || device.expires_in < 1 || device.expires_in > 900 || device.interval !== void 0 && (!Number.isInteger(device.interval) || device.interval < 1 || device.interval > 60)) {
+    throw new Error("the server returned an invalid device authorization response");
+  }
+  const verification = new URL(device.verification_uri);
+  if (verification.origin !== new URL(doc.authorization_endpoint).origin || verification.username || verification.password || verification.search || verification.hash) {
+    throw new Error("the device verification page is outside the authorization origin");
+  }
+  const now = input.now ?? (() => performance.now());
+  const sleep = input.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
+  const deadline = now() + device.expires_in * 1e3;
+  let interval = Math.max(5, device.interval ?? 5) * 1e3;
+  input.announce({ verificationUri: verification.toString(), userCode: device.user_code, expiresInSeconds: device.expires_in });
+  while (now() < deadline) {
+    await sleep(Math.min(interval, Math.max(0, deadline - now())));
+    const remaining = deadline - now();
+    if (remaining <= 0) break;
+    const poll = await fetchImpl(doc.token_endpoint, {
+      method: "POST",
+      redirect: "error",
+      signal: AbortSignal.timeout(Math.min(3e4, remaining)),
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({ grant_type: "urn:ietf:params:oauth:grant-type:device_code", client_id: clientId, device_code: device.device_code }).toString()
+    });
+    const body = await poll.json();
+    if (poll.ok) return grantResponse(body, clientId);
+    if (body.error === "authorization_pending") continue;
+    if (body.error === "slow_down") {
+      interval += 5e3;
+      continue;
+    }
+    if (body.error === "access_denied") throw new Error("you declined device sign-in; your previous login was kept");
+    if (body.error === "expired_token") break;
+    throw new Error("device sign-in failed; your previous login was kept");
+  }
+  throw new Error("device sign-in expired; your previous login was kept");
+}
 async function refreshGrant(input, fetchImpl = fetch) {
   const res = await fetchImpl(input.tokenEndpoint, {
     method: "POST",
@@ -1269,8 +1323,17 @@ var WHERE_SAID = {
 async function login(flags) {
   const base = apiUrl(flags.api);
   const given = flags.token ?? await readPipedInput();
+  if (flags.device && (given || flags.tokenOnly)) throw new CliError("Choose device sign-in or a pasted token, not both.", EXIT.usage);
   if (!given && !flags.tokenOnly) {
-    const grant = await browserLogin({
+    const grant = flags.device ? await deviceLogin({
+      issuer: base,
+      announce: ({ verificationUri, userCode, expiresInSeconds }) => {
+        note(`On another device, open:
+  ${verificationUri}
+Enter code: ${userCode}
+It expires in ${expiresInSeconds} seconds. Approve only the CLI request you started.`);
+      }
+    }) : await browserLogin({
       issuer: base,
       announce: (url) => {
         out("Opening your browser to sign in.");
@@ -5522,6 +5585,7 @@ var PendingInvitation = external_exports.object({
   expiresAt: IsoDateTime
 });
 var Me = external_exports.object({
+  authorization: external_exports.object({ via: external_exports.enum(["session", "token", "oauth"]), projectId: external_exports.string().uuid().nullable() }).optional(),
   user: external_exports.object({ id: Uuid, clerkUserId: external_exports.string() }),
   organization: external_exports.object({ id: Uuid, name: external_exports.string(), slug: external_exports.string(), role: Role }).nullable(),
   permissions: external_exports.array(external_exports.string())
@@ -5602,6 +5666,9 @@ var BootstrapBody = external_exports.object({
 }).refine((body) => !(body.planId || body.factsFingerprint) || Boolean(body.name), {
   message: "planId and factsFingerprint are only valid when creating a named project"
 });
+var CreateApplicationKeyBody = external_exports.object({
+  name: external_exports.string().min(1).max(100)
+}).strict();
 var CreateApiKeyBody = external_exports.object({
   name: external_exports.string().min(1).max(100),
   type: ApiKeyType
@@ -5803,6 +5870,20 @@ var PendingInvitationListResponse = external_exports.object({ invitations: exter
 var RedeemedInvitationResponse = external_exports.object({
   organization: external_exports.object({ id: Uuid, role: Role })
 });
+var OAuthConnection = external_exports.object({
+  id: external_exports.string().uuid(),
+  clientId: external_exports.string().uuid(),
+  clientName: external_exports.string(),
+  orgId: external_exports.string().uuid(),
+  projectId: external_exports.string().uuid().nullable(),
+  projectName: external_exports.string().nullable(),
+  scopes: external_exports.array(external_exports.string()),
+  status: external_exports.enum(["ready", "awaiting_exchange"]),
+  connectedAt: external_exports.string().datetime(),
+  expiresAt: external_exports.string().datetime(),
+  lastUsedAt: external_exports.string().datetime().nullable()
+});
+var OAuthConnectionListResponse = external_exports.object({ enabled: external_exports.boolean(), connections: external_exports.array(OAuthConnection) });
 
 // ../../node_modules/.pnpm/zod-to-json-schema@3.25.2_zod@3.25.76/node_modules/zod-to-json-schema/dist/esm/Options.js
 var ignoreOverride = Symbol("Let zodToJsonSchema decide on which parser to use");
@@ -5990,6 +6071,34 @@ var routes = {
   // All three are sessionOnly: a token must not be able to mint another
   // token. Otherwise a leaked one manufactures replacements faster than
   // anyone can revoke them, and revoking the one you found achieves nothing.
+  listOAuthConnections: {
+    method: "GET",
+    path: "/v1/me/connections",
+    summary: "Your authorized app connections in this workspace. No credentials.",
+    permission: "org:read",
+    sessionOnly: true,
+    status: 200,
+    response: OAuthConnectionListResponse
+  },
+  narrowOAuthConnection: {
+    method: "POST",
+    path: "/v1/me/connections/{id}/project",
+    summary: "Permanently restrict one authorization to an existing project. Cannot widen or retarget.",
+    permission: "org:read",
+    sessionOnly: true,
+    params: Id,
+    body: external_exports.object({ projectId: external_exports.string().uuid() }).strict(),
+    status: 204
+  },
+  revokeOAuthConnection: {
+    method: "DELETE",
+    path: "/v1/me/connections/{id}",
+    summary: "Disconnect one consent family, including access, refresh and pending exchange.",
+    permission: "org:read",
+    sessionOnly: true,
+    params: Id,
+    status: 204
+  },
   listAccessTokens: {
     method: "GET",
     path: "/v1/me/tokens",
@@ -6153,6 +6262,16 @@ var routes = {
     status: 200,
     response: ApiKeyListResponse
   },
+  createApplicationKey: {
+    method: "POST",
+    path: "/v1/projects/{id}/application-keys",
+    summary: "Issue a public anon application key. It obeys row and storage policies; never issues a service key.",
+    permission: "project:update",
+    params: Id,
+    body: CreateApplicationKeyBody,
+    status: 201,
+    response: IssuedApiKeyResponse
+  },
   createProjectKey: {
     method: "POST",
     path: "/v1/projects/{id}/keys",
@@ -6173,8 +6292,9 @@ var routes = {
   // The platform token never leaves the control plane and expires after 60
   // seconds. Callers are therefore authorized for the operation they asked
   // for (`data:read`, `data:write`, `deploy`, or `logs:read`) rather than for
-  // the internal credential used to carry it out. Actual API-key management
-  // remains under apikey:* and is deliberately closed to OAuth.
+  // the internal credential used to carry it out. Service-key issuance, key
+  // listing and revocation remain under apikey:* and closed to OAuth. The
+  // separate anon-only application-key route above uses project:update.
   getProjectSchema: {
     method: "GET",
     path: "/v1/projects/{id}/schema",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nimblybase",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "description": "The NimblyBase command line - projects, keys and backends from a terminal.",
   "license": "UNLICENSED",
   "repository": {