nimblybase 0.1.6 → 0.1.7

package/README.md

@@ -252,3 +252,9 @@ nimbly sql "select * from notes where id = ?" --param 7
 go into the statement string: a CLI whose only option is to paste them in
 teaches everybody — and every agent reading a shell history — to write
 injectable SQL.
+
+Public frontend keys can be issued after browser/device login with
+`nimbly keys create "web frontend" --type anon` (requires `projects:write`).
+They obey row and storage policies. `--type service`, key listing and revocation
+require separate session/PAT key-management authority and remain unavailable
+through OAuth. Never put the agent’s OAuth credential in application code.

package/dist/index.js

@@ -373,7 +373,7 @@ function when(iso) {
 
 // src/api.ts
 var DEFAULT_API_URL = "https://api-uat.nimblybase.com";
-var VERSION = "0.1.6";
+var VERSION = "0.1.7";
 function dashboardUrl(api) {
   const match = /^https:\/\/api(-[a-z0-9]+)?\.(.+)$/.exec(api);
   return match ? `https://app${match[1] ?? ""}.${match[2]}` : null;
@@ -473,8 +473,8 @@ function createClient(base, token) {
     resumeProject: (id) => req(`/v1/projects/${id}/resume`, { method: "POST", body: "{}" }),
     keys: (projectId) => req(`/v1/projects/${projectId}/keys`),
     createKey: (projectId, input) => req(
-      `/v1/projects/${projectId}/keys`,
-      { method: "POST", body: JSON.stringify(input) }
+      `/v1/projects/${projectId}/${input.type === "anon" ? "application-keys" : "keys"}`,
+      { method: "POST", body: JSON.stringify(input.type === "anon" ? { name: input.name } : input) }
     ),
     revokeKey: (keyId) => req(`/v1/keys/${keyId}`, { method: "DELETE" }),
     // --- project data ---------------------------------------------------
@@ -5585,6 +5585,7 @@ var PendingInvitation = external_exports.object({
   expiresAt: IsoDateTime
 });
 var Me = external_exports.object({
+  authorization: external_exports.object({ via: external_exports.enum(["session", "token", "oauth"]), projectId: external_exports.string().uuid().nullable() }).optional(),
   user: external_exports.object({ id: Uuid, clerkUserId: external_exports.string() }),
   organization: external_exports.object({ id: Uuid, name: external_exports.string(), slug: external_exports.string(), role: Role }).nullable(),
   permissions: external_exports.array(external_exports.string())
@@ -5665,6 +5666,9 @@ var BootstrapBody = external_exports.object({
 }).refine((body) => !(body.planId || body.factsFingerprint) || Boolean(body.name), {
   message: "planId and factsFingerprint are only valid when creating a named project"
 });
+var CreateApplicationKeyBody = external_exports.object({
+  name: external_exports.string().min(1).max(100)
+}).strict();
 var CreateApiKeyBody = external_exports.object({
   name: external_exports.string().min(1).max(100),
   type: ApiKeyType
@@ -5866,6 +5870,20 @@ var PendingInvitationListResponse = external_exports.object({ invitations: exter
 var RedeemedInvitationResponse = external_exports.object({
   organization: external_exports.object({ id: Uuid, role: Role })
 });
+var OAuthConnection = external_exports.object({
+  id: external_exports.string().uuid(),
+  clientId: external_exports.string().uuid(),
+  clientName: external_exports.string(),
+  orgId: external_exports.string().uuid(),
+  projectId: external_exports.string().uuid().nullable(),
+  projectName: external_exports.string().nullable(),
+  scopes: external_exports.array(external_exports.string()),
+  status: external_exports.enum(["ready", "awaiting_exchange"]),
+  connectedAt: external_exports.string().datetime(),
+  expiresAt: external_exports.string().datetime(),
+  lastUsedAt: external_exports.string().datetime().nullable()
+});
+var OAuthConnectionListResponse = external_exports.object({ enabled: external_exports.boolean(), connections: external_exports.array(OAuthConnection) });
 
 // ../../node_modules/.pnpm/zod-to-json-schema@3.25.2_zod@3.25.76/node_modules/zod-to-json-schema/dist/esm/Options.js
 var ignoreOverride = Symbol("Let zodToJsonSchema decide on which parser to use");
@@ -6053,6 +6071,34 @@ var routes = {
   // All three are sessionOnly: a token must not be able to mint another
   // token. Otherwise a leaked one manufactures replacements faster than
   // anyone can revoke them, and revoking the one you found achieves nothing.
+  listOAuthConnections: {
+    method: "GET",
+    path: "/v1/me/connections",
+    summary: "Your authorized app connections in this workspace. No credentials.",
+    permission: "org:read",
+    sessionOnly: true,
+    status: 200,
+    response: OAuthConnectionListResponse
+  },
+  narrowOAuthConnection: {
+    method: "POST",
+    path: "/v1/me/connections/{id}/project",
+    summary: "Permanently restrict one authorization to an existing project. Cannot widen or retarget.",
+    permission: "org:read",
+    sessionOnly: true,
+    params: Id,
+    body: external_exports.object({ projectId: external_exports.string().uuid() }).strict(),
+    status: 204
+  },
+  revokeOAuthConnection: {
+    method: "DELETE",
+    path: "/v1/me/connections/{id}",
+    summary: "Disconnect one consent family, including access, refresh and pending exchange.",
+    permission: "org:read",
+    sessionOnly: true,
+    params: Id,
+    status: 204
+  },
   listAccessTokens: {
     method: "GET",
     path: "/v1/me/tokens",
@@ -6216,6 +6262,16 @@ var routes = {
     status: 200,
     response: ApiKeyListResponse
   },
+  createApplicationKey: {
+    method: "POST",
+    path: "/v1/projects/{id}/application-keys",
+    summary: "Issue a public anon application key. It obeys row and storage policies; never issues a service key.",
+    permission: "project:update",
+    params: Id,
+    body: CreateApplicationKeyBody,
+    status: 201,
+    response: IssuedApiKeyResponse
+  },
   createProjectKey: {
     method: "POST",
     path: "/v1/projects/{id}/keys",
@@ -6236,8 +6292,9 @@ var routes = {
   // The platform token never leaves the control plane and expires after 60
   // seconds. Callers are therefore authorized for the operation they asked
   // for (`data:read`, `data:write`, `deploy`, or `logs:read`) rather than for
-  // the internal credential used to carry it out. Actual API-key management
-  // remains under apikey:* and is deliberately closed to OAuth.
+  // the internal credential used to carry it out. Service-key issuance, key
+  // listing and revocation remain under apikey:* and closed to OAuth. The
+  // separate anon-only application-key route above uses project:update.
   getProjectSchema: {
     method: "GET",
     path: "/v1/projects/{id}/schema",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nimblybase",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "description": "The NimblyBase command line - projects, keys and backends from a terminal.",
   "license": "UNLICENSED",
   "repository": {