nimblybase 0.1.6 → 0.1.8

package/README.md

@@ -30,6 +30,27 @@ keychain on macOS, and otherwise in
 `~/.config/nimblybase/credentials.json` with permissions `0600`. `nimbly
 login` always says which one it used.
 
+Inside an existing linked repository, `nimbly login --api <linked-api>` requests
+access only to that project. The browser shows its authoritative name and asks
+for explicit approval. The CLI verifies the server's restriction before saving
+anything. Project creation, billing and other projects are excluded; your current
+workspace role still limits the approved operations.
+
+Each repository stores its grant separately in a keychain entry or under
+`~/.config/nimblybase/repositories/<directory-hash>/credentials.json`. Credentials
+stay outside your source tree; `nimblybase.json` only records the project and a
+credential-free `authorization: "project"` marker. Nested directories use the
+same login. `nimbly logout` here clears only this repository login and requires
+another approval before project commands can run; your workspace login is kept.
+
+For an unlinked existing repository, use `nimbly login --project <uuid> --api
+<api>`. It links the approved project after verification. Legacy linked repos
+keep their existing workspace login until they explicitly sign in this way.
+Automatic restriction after creating a new project is a separate pending step.
+Project login currently requires the browser flow; device sign-in and pasted
+PAT login remain available outside linked repositories. An explicitly supplied
+`NIMBLYBASE_TOKEN` still takes precedence for automation.
+
 For a machine without a local browser, run `nimbly login --device`. Open the
 displayed verification page on another device and enter the short code. The
 dashboard shows the requesting client and approved workspace/scopes. The CLI
@@ -252,3 +273,9 @@ nimbly sql "select * from notes where id = ?" --param 7
 go into the statement string: a CLI whose only option is to paste them in
 teaches everybody — and every agent reading a shell history — to write
 injectable SQL.
+
+Public frontend keys can be issued after browser/device login with
+`nimbly keys create "web frontend" --type anon` (requires `projects:write`).
+They obey row and storage policies. `--type service`, key listing and revocation
+require separate session/PAT key-management authority and remain unavailable
+through OAuth. Never put the agent’s OAuth credential in application code.

package/dist/index.js

@@ -185,6 +185,7 @@ USAGE
 
 GETTING STARTED
   login                    Sign in through your browser; --device for another machine
+                           Inside a linked repo, approve only that project
                            --token-only is the explicit pasted-PAT fallback
   init [name]              Create or explicitly choose a project for this repo
   describe                 Show what the linked project's backend can do
@@ -373,7 +374,7 @@ function when(iso) {
 
 // src/api.ts
 var DEFAULT_API_URL = "https://api-uat.nimblybase.com";
-var VERSION = "0.1.6";
+var VERSION = "0.1.8";
 function dashboardUrl(api) {
   const match = /^https:\/\/api(-[a-z0-9]+)?\.(.+)$/.exec(api);
   return match ? `https://app${match[1] ?? ""}.${match[2]}` : null;
@@ -473,8 +474,8 @@ function createClient(base, token) {
     resumeProject: (id) => req(`/v1/projects/${id}/resume`, { method: "POST", body: "{}" }),
     keys: (projectId) => req(`/v1/projects/${projectId}/keys`),
     createKey: (projectId, input) => req(
-      `/v1/projects/${projectId}/keys`,
-      { method: "POST", body: JSON.stringify(input) }
+      `/v1/projects/${projectId}/${input.type === "anon" ? "application-keys" : "keys"}`,
+      { method: "POST", body: JSON.stringify(input.type === "anon" ? { name: input.name } : input) }
     ),
     revokeKey: (keyId) => req(`/v1/keys/${keyId}`, { method: "DELETE" }),
     // --- project data ---------------------------------------------------
@@ -808,7 +809,7 @@ async function deviceLogin(input, fetchImpl = fetch) {
     throw new Error("the device verification page is outside the authorization origin");
   }
   const now = input.now ?? (() => performance.now());
-  const sleep = input.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
+  const sleep = input.sleep ?? ((ms) => new Promise((resolve9) => setTimeout(resolve9, ms)));
   const deadline = now() + device.expires_in * 1e3;
   let interval = Math.max(5, device.interval ?? 5) * 1e3;
   input.announce({ verificationUri: verification.toString(), userCode: device.user_code, expiresInSeconds: device.expires_in });
@@ -864,6 +865,7 @@ async function browserLogin(input) {
   const port = await listener.port;
   const redirectUri = `http://127.0.0.1:${port}${CALLBACK_PATH}`;
   const authorize = new URL(doc.authorization_endpoint);
+  if (input.projectId) authorize.searchParams.set("project_id", input.projectId);
   for (const [k, v] of Object.entries({
     response_type: "code",
     client_id: clientId,
@@ -905,7 +907,7 @@ import { promisify } from "node:util";
 import { homedir } from "node:os";
 import { join, dirname } from "node:path";
 import { mkdir, readFile, writeFile, chmod, rm, stat, rename } from "node:fs/promises";
-import { randomUUID } from "node:crypto";
+import { createHash as createHash2, randomUUID } from "node:crypto";
 var run = promisify(execFile);
 var SERVICE = "nimblybase-cli";
 var ACCOUNT = "access-token";
@@ -914,17 +916,21 @@ function configDir() {
   return xdg ? join(xdg, "nimblybase") : join(homedir(), ".config", "nimblybase");
 }
 var credentialsPath = () => join(configDir(), "credentials.json");
+function repositoryCredentials(root) {
+  const id = createHash2("sha256").update(root).digest("hex");
+  return createStore("repository-" + id, () => join(configDir(), "repositories", id, "credentials.json"), true);
+}
 function keychainAvailable() {
   return process.platform === "darwin" && process.env.NIMBLYBASE_NO_KEYCHAIN !== "1";
 }
-async function keychainSet(secret) {
+async function keychainSet(secret, account = ACCOUNT) {
   if (!keychainAvailable()) return false;
   try {
     await run("security", [
       "add-generic-password",
       "-U",
       "-a",
-      ACCOUNT,
+      account,
       "-s",
       SERVICE,
       "-D",
@@ -937,20 +943,20 @@ async function keychainSet(secret) {
     return false;
   }
 }
-async function keychainGet() {
+async function keychainGet(account = ACCOUNT) {
   if (!keychainAvailable()) return null;
   try {
-    const { stdout } = await run("security", ["find-generic-password", "-a", ACCOUNT, "-s", SERVICE, "-w"]);
+    const { stdout } = await run("security", ["find-generic-password", "-a", account, "-s", SERVICE, "-w"]);
     const value = stdout.trim();
     return value.length > 0 ? value : null;
   } catch {
     return null;
   }
 }
-async function keychainDelete() {
+async function keychainDelete(account = ACCOUNT) {
   if (!keychainAvailable()) return false;
   try {
-    await run("security", ["delete-generic-password", "-a", ACCOUNT, "-s", SERVICE]);
+    await run("security", ["delete-generic-password", "-a", account, "-s", SERVICE]);
     return true;
   } catch {
     return false;
@@ -970,15 +976,17 @@ function decodeSecret(raw) {
     return {};
   }
 }
-async function fileRead() {
+async function fileRead(path = credentialsPath(), strict = false) {
   try {
-    return JSON.parse(await readFile(credentialsPath(), "utf8"));
-  } catch {
+    const value = JSON.parse(await readFile(path, "utf8"));
+    if (strict && (!value || typeof value !== "object")) throw new Error("Invalid repository credential");
+    return value;
+  } catch (err) {
+    if (strict && err.code !== "ENOENT") throw new Error("Repository authorization is unreadable. Run nimbly login here again; your workspace login was kept.", { cause: err });
     return null;
   }
 }
-async function fileWrite(value, apiUrl2) {
-  const path = credentialsPath();
+async function fileWrite(value, apiUrl2, path = credentialsPath()) {
   await mkdir(dirname(path), { recursive: true, mode: 448 });
   await chmod(dirname(path), 448);
   const body = typeof value === "string" ? { token: value, ...apiUrl2 ? { apiUrl: apiUrl2 } : {} } : { grant: value };
@@ -992,110 +1000,67 @@ async function fileWrite(value, apiUrl2) {
     await rm(temporary, { force: true });
   }
 }
-var credentials = {
-  async save(token, apiUrl2) {
-    if (await keychainSet(encodeSecret(token, apiUrl2))) return "keychain";
-    await fileWrite(token, apiUrl2);
-    return "file";
-  },
-  async saveGrant(grant) {
-    if (await keychainSet(encodeSecret(grant))) return "keychain";
-    await fileWrite(grant);
-    return "file";
-  },
-  async load() {
-    const fromEnv = process.env.NIMBLYBASE_TOKEN?.trim();
-    if (fromEnv) return { token: fromEnv, where: "environment" };
-    const fromKeychain = await keychainGet();
-    if (fromKeychain) {
-      const { token, grant, apiUrl: apiUrl3 } = decodeSecret(fromKeychain);
-      const value2 = token ?? grant?.accessToken;
-      if (value2) return { token: value2, where: "keychain", ...apiUrl3 || grant?.issuer ? { apiUrl: apiUrl3 ?? grant.issuer } : {} };
-    }
-    const fromFile = await fileRead();
-    const value = fromFile?.token ?? fromFile?.grant?.accessToken;
-    const apiUrl2 = fromFile?.apiUrl ?? fromFile?.grant?.issuer;
-    return value ? { token: value, where: "file", ...apiUrl2 ? { apiUrl: apiUrl2 } : {} } : null;
-  },
-  async loadGrant() {
-    if (process.env.NIMBLYBASE_TOKEN?.trim()) return null;
-    const fromKeychain = await keychainGet();
-    if (fromKeychain) {
-      const { grant } = decodeSecret(fromKeychain);
-      return grant ? { grant, where: "keychain" } : null;
-    }
-    const fromFile = await fileRead();
-    return fromFile?.grant ? { grant: fromFile.grant, where: "file" } : null;
-  },
-  async clear() {
-    const cleared = [];
-    if (await keychainDelete()) cleared.push("keychain");
-    try {
-      await stat(credentialsPath());
-      await rm(credentialsPath());
-      cleared.push("file");
-    } catch {
+function createStore(account = ACCOUNT, path = credentialsPath, projectOnly = false) {
+  function checkProject(grant) {
+    if (projectOnly && (!grant?.projectId || !grant.issuer || !grant.refreshToken || !grant.accessToken)) {
+      throw new Error("Repository authorization is invalid. Run nimbly login here again; your workspace login was kept.");
     }
-    return cleared;
   }
-};
-
-// src/prompt.ts
-import { createInterface } from "node:readline";
-async function readPipedInput() {
-  if (process.stdin.isTTY) return null;
-  const chunks = [];
-  for await (const chunk of process.stdin) chunks.push(Buffer.from(chunk));
-  const value = Buffer.concat(chunks).toString("utf8").trim();
-  return value.length > 0 ? value : null;
-}
-function promptSecret(question) {
-  return new Promise((resolve8, reject) => {
-    const rl = createInterface({ input: process.stdin, output: process.stderr, terminal: true });
-    let promptShown = false;
-    const output = rl;
-    const write = output.output.write.bind(output.output);
-    output.output.write = (chunk) => {
-      if (!promptShown) {
-        promptShown = true;
-        return write(chunk);
+  return {
+    async save(token, apiUrl2) {
+      if (projectOnly) throw new Error("Repository authorization requires a project-restricted OAuth grant");
+      if (await keychainSet(encodeSecret(token, apiUrl2), account)) return "keychain";
+      await fileWrite(token, apiUrl2, path());
+      return "file";
+    },
+    async saveGrant(grant) {
+      checkProject(grant);
+      if (await keychainSet(encodeSecret(grant), account)) return "keychain";
+      await fileWrite(grant, void 0, path());
+      return "file";
+    },
+    async load() {
+      const fromEnv = process.env.NIMBLYBASE_TOKEN?.trim();
+      if (fromEnv) return { token: fromEnv, where: "environment" };
+      const fromKeychain = await keychainGet(account);
+      if (fromKeychain) {
+        const { token, grant, apiUrl: apiUrl3 } = decodeSecret(fromKeychain);
+        checkProject(grant);
+        const value2 = token ?? grant?.accessToken;
+        if (value2) return { token: value2, where: "keychain", ...apiUrl3 || grant?.issuer ? { apiUrl: apiUrl3 ?? grant.issuer } : {} };
       }
-      return true;
-    };
-    rl.question(question, (answer) => {
-      ;
-      output.output.write = write;
-      process.stderr.write("\n");
-      rl.close();
-      resolve8(answer.trim());
-    });
-    rl.on("SIGINT", () => {
-      rl.close();
-      reject(new Error("cancelled"));
-    });
-  });
-}
-async function confirmExact(question, expected) {
-  if (!process.stdin.isTTY) return false;
-  const rl = createInterface({ input: process.stdin, output: process.stderr });
-  try {
-    const answer = await new Promise((r) => rl.question(`${question}
-Type "${expected}" to confirm: `, r));
-    return answer.trim() === expected;
-  } finally {
-    rl.close();
-  }
-}
-async function confirm(question) {
-  if (!process.stdin.isTTY) return false;
-  const rl = createInterface({ input: process.stdin, output: process.stderr });
-  try {
-    const answer = await new Promise((r) => rl.question(`${question} [y/N] `, r));
-    return /^y(es)?$/i.test(answer.trim());
-  } finally {
-    rl.close();
-  }
+      const fromFile = await fileRead(path(), projectOnly);
+      if (fromFile) checkProject(fromFile.grant);
+      const value = fromFile?.token ?? fromFile?.grant?.accessToken;
+      const apiUrl2 = fromFile?.apiUrl ?? fromFile?.grant?.issuer;
+      return value ? { token: value, where: "file", ...apiUrl2 ? { apiUrl: apiUrl2 } : {} } : null;
+    },
+    async loadGrant() {
+      if (process.env.NIMBLYBASE_TOKEN?.trim()) return null;
+      const fromKeychain = await keychainGet(account);
+      if (fromKeychain) {
+        const { grant } = decodeSecret(fromKeychain);
+        checkProject(grant);
+        return grant ? { grant, where: "keychain" } : null;
+      }
+      const fromFile = await fileRead(path(), projectOnly);
+      if (fromFile) checkProject(fromFile.grant);
+      return fromFile?.grant ? { grant: fromFile.grant, where: "file" } : null;
+    },
+    async clear() {
+      const cleared = [];
+      if (await keychainDelete(account)) cleared.push("keychain");
+      try {
+        await stat(path());
+        await rm(path());
+        cleared.push("file");
+      } catch {
+      }
+      return cleared;
+    }
+  };
 }
+var credentials = createStore();
 
 // src/link.ts
 import { readFile as readFile2, rename as rename2, rm as rm2, writeFile as writeFile2, link as hardLink } from "node:fs/promises";
@@ -1146,6 +1111,7 @@ async function findLink(from = process.cwd()) {
         projectId: parsed.projectId,
         slug: typeof parsed.slug === "string" ? parsed.slug : "",
         apiUrl: typeof parsed.apiUrl === "string" ? parsed.apiUrl : void 0,
+        ...parsed.authorization === "project" ? { authorization: "project" } : {},
         path
       };
     }
@@ -1181,6 +1147,7 @@ async function writeLink(dir, link2, options = {}) {
     slug: link2.slug
   };
   if (link2.apiUrl !== void 0) next.apiUrl = link2.apiUrl;
+  if (link2.authorization !== void 0) next.authorization = link2.authorization;
   const temporary = join2(dirname2(path), `.${LINK_FILE}.${process.pid}.${randomUUID2()}.tmp`);
   try {
     await writeFile2(temporary, `${JSON.stringify(next, null, 2)}
@@ -1236,12 +1203,86 @@ async function clearPendingBootstrap(dir) {
   await rm2(join2(dir, BOOTSTRAP_FILE), { force: true });
 }
 
+// src/commands/auth.ts
+import { realpath as realpath2 } from "node:fs/promises";
+import { dirname as dirname4, resolve as resolve2 } from "node:path";
+
+// src/prompt.ts
+import { createInterface } from "node:readline";
+async function readPipedInput() {
+  if (process.stdin.isTTY) return null;
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(Buffer.from(chunk));
+  const value = Buffer.concat(chunks).toString("utf8").trim();
+  return value.length > 0 ? value : null;
+}
+function promptSecret(question) {
+  return new Promise((resolve9, reject) => {
+    const rl = createInterface({ input: process.stdin, output: process.stderr, terminal: true });
+    let promptShown = false;
+    const output = rl;
+    const write = output.output.write.bind(output.output);
+    output.output.write = (chunk) => {
+      if (!promptShown) {
+        promptShown = true;
+        return write(chunk);
+      }
+      return true;
+    };
+    rl.question(question, (answer) => {
+      ;
+      output.output.write = write;
+      process.stderr.write("\n");
+      rl.close();
+      resolve9(answer.trim());
+    });
+    rl.on("SIGINT", () => {
+      rl.close();
+      reject(new Error("cancelled"));
+    });
+  });
+}
+async function confirmExact(question, expected) {
+  if (!process.stdin.isTTY) return false;
+  const rl = createInterface({ input: process.stdin, output: process.stderr });
+  try {
+    const answer = await new Promise((r) => rl.question(`${question}
+Type "${expected}" to confirm: `, r));
+    return answer.trim() === expected;
+  } finally {
+    rl.close();
+  }
+}
+async function confirm(question) {
+  if (!process.stdin.isTTY) return false;
+  const rl = createInterface({ input: process.stdin, output: process.stderr });
+  try {
+    const answer = await new Promise((r) => rl.question(`${question} [y/N] `, r));
+    return /^y(es)?$/i.test(answer.trim());
+  } finally {
+    rl.close();
+  }
+}
+
 // src/context.ts
+import { realpath } from "node:fs/promises";
+import { dirname as dirname3 } from "node:path";
 async function context(apiOverride) {
   const link2 = await findLink();
-  const storedBeforeRefresh = await credentials.load();
+  const repositoryStore = link2 ? repositoryCredentials(await realpath(dirname3(link2.path))) : void 0;
+  const repositoryToken = await repositoryStore?.load();
+  const useRepository = repositoryToken?.where !== "environment" && (Boolean(repositoryToken) || link2?.authorization === "project");
+  const store = useRepository ? repositoryStore : credentials;
+  const storedBeforeRefresh = useRepository ? repositoryToken : await credentials.load();
   const base = apiUrl(apiOverride ?? process.env.NIMBLYBASE_API_URL ?? link2?.apiUrl ?? (storedBeforeRefresh?.where !== "environment" ? storedBeforeRefresh?.apiUrl : void 0));
-  const held = await credentials.loadGrant();
+  const held = await store.loadGrant();
+  if (useRepository && held && held.grant.projectId !== link2?.projectId) {
+    throw new CliError(
+      "This repository login belongs to a different project.",
+      EXIT.unauthenticated,
+      "Run `nimbly login` here to approve the new project. Your other logins were kept."
+    );
+  }
   if (storedBeforeRefresh && storedBeforeRefresh.where !== "environment") {
     const bound = apiUrl(storedBeforeRefresh.apiUrl ?? "https://api-uat.nimblybase.com");
     if (base !== bound) throw new CliError(
@@ -1264,11 +1305,11 @@ async function context(apiOverride) {
         clientId: held.grant.clientId,
         refreshToken: held.grant.refreshToken
       });
-      await credentials.saveGrant({ ...fresh, issuer: held.grant.issuer });
+      await store.saveGrant({ ...fresh, issuer: held.grant.issuer, ...held.grant.projectId ? { projectId: held.grant.projectId } : {} });
     } catch {
     }
   }
-  const stored = await credentials.load();
+  const stored = await store.load();
   if (!stored) {
     throw new CliError(
       "Not signed in.",
@@ -1281,7 +1322,8 @@ async function context(apiOverride) {
     base,
     tokenFrom: stored.where,
     isCurrentToken: (prefix) => prefix.length > 0 && stored.token.startsWith(prefix),
-    link: link2
+    link: link2,
+    credentialScope: useRepository ? "repository" : "workspace"
   };
 }
 var UUID2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
@@ -1322,7 +1364,34 @@ var WHERE_SAID = {
 };
 async function login(flags) {
   const base = apiUrl(flags.api);
+  const link2 = await findLink(flags.dir);
+  const projectId = flags.project ?? link2?.projectId;
+  if (projectId && !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(projectId)) {
+    throw new CliError("Project authorization requires a project UUID.", EXIT.usage, "Link this repository first, or pass --project <uuid>.");
+  }
+  if (projectId && flags.device) throw new CliError(
+    "Project sign-in currently requires browser approval.",
+    EXIT.usage,
+    "Run `nimbly login` here without --device. Device sign-in outside linked repositories remains workspace-scoped."
+  );
+  if (projectId && link2?.apiUrl && apiUrl(link2.apiUrl) !== base) throw new CliError(
+    "Choose the linked project API explicitly.",
+    EXIT.usage,
+    "Pass --api with the linked API; a repository file cannot choose your login destination."
+  );
+  if (link2 && projectId !== link2.projectId && !flags.relink) throw new CliError(
+    "This repository is linked to another project.",
+    EXIT.usage,
+    "Use --relink to explicitly authorize and link a different project."
+  );
+  const root = projectId ? await realpath2(link2 ? dirname4(link2.path) : resolve2(flags.dir ?? ".")) : void 0;
+  const store = root ? repositoryCredentials(root) : credentials;
   const given = flags.token ?? await readPipedInput();
+  if (projectId && (given || flags.tokenOnly)) throw new CliError(
+    "A pasted token does not authorize a repository project.",
+    EXIT.usage,
+    "Use browser sign-in here; use NIMBLYBASE_TOKEN for an explicitly configured automation identity."
+  );
   if (flags.device && (given || flags.tokenOnly)) throw new CliError("Choose device sign-in or a pasted token, not both.", EXIT.usage);
   if (!given && !flags.tokenOnly) {
     const grant = flags.device ? await deviceLogin({
@@ -1340,17 +1409,40 @@ It expires in ${expiresInSeconds} seconds. Approve only the CLI request you star
         note(`If it did not open, go to:
   ${url}`);
       },
-      open: openBrowser
+      open: openBrowser,
+      ...projectId ? { projectId } : {}
     });
-    const me2 = await createClient(base, grant.accessToken).me();
-    const where2 = await credentials.saveGrant({ ...grant, issuer: base });
+    const client = createClient(base, grant.accessToken);
+    const me2 = await client.me();
+    if (projectId && (me2.authorization?.via !== "oauth" || me2.authorization.projectId !== projectId)) {
+      throw new CliError(
+        "The server did not confirm this project restriction.",
+        EXIT.unauthenticated,
+        "Nothing was saved. Update the server/client and approve project access again."
+      );
+    }
+    if (projectId && root) {
+      const { project } = await client.project(projectId);
+      if (project.id !== projectId) throw new CliError("The authorized project response is invalid.", EXIT.unauthenticated);
+      await writeLink(root, { projectId, slug: project.slug, apiUrl: base, authorization: "project" }, { relink: flags.relink });
+    }
+    const where2 = await store.saveGrant({ ...grant, issuer: base, ...projectId ? { projectId } : {} });
     if (isJsonMode()) {
-      json({ ok: true, storedIn: where2, organization: me2.organization, api: base, scopes: grant.scopes });
+      json({
+        ok: true,
+        storedIn: where2,
+        organization: me2.organization,
+        api: base,
+        scopes: grant.scopes,
+        authorizationScope: projectId ? "repository" : "workspace",
+        ...projectId ? { projectId } : {}
+      });
       return;
     }
     out(`${paint("green", "\u2713")} Signed in as ${paint("bold", me2.organization?.name ?? "your account")}${me2.organization ? ` (${me2.organization.role})` : ""}`);
     note(`Granted: ${grant.scopes.join(", ") || "no scopes"}.`);
-    note(`Stored in ${WHERE_SAID[where2]}. It refreshes itself; run \`nimbly logout\` to end it.`);
+    note(projectId ? `Access is restricted to ${projectId}. Stored separately for this repository ${where2 === "keychain" ? "in your login keychain" : "outside the repository (permissions 0600)"}.` : `Stored in ${WHERE_SAID[where2]}.`);
+    note("It refreshes itself; run `nimbly logout` here to clear this login.");
     return;
   }
   const token = given ?? await promptSecret(source(base));
@@ -1374,14 +1466,18 @@ It expires in ${expiresInSeconds} seconds. Approve only the CLI request you star
     note("The keychain was not available, so a file was used instead.");
   }
 }
-async function logout() {
-  const cleared = await credentials.clear();
+async function logout(flags) {
+  const link2 = await findLink(flags?.dir);
+  const repo = link2 ? repositoryCredentials(await realpath2(dirname4(link2.path))) : void 0;
+  const repository = link2?.authorization === "project" || repo && await repo.loadGrant() !== null;
+  const cleared = await (repository ? repo : credentials).clear();
   if (isJsonMode()) {
     json({ ok: true, cleared });
     return;
   }
   if (cleared.length === 0) out("Nothing stored - already signed out.");
   else out(`${paint("green", "\u2713")} Signed out (cleared: ${cleared.join(", ")}).`);
+  if (repository) note("Cleared this repository login. Your separate workspace login was kept; run logout outside this repository to clear it.");
   if (process.env.NIMBLYBASE_TOKEN) {
     note("NIMBLYBASE_TOKEN is still set in this shell and takes precedence - unset it too.");
   }
@@ -1390,7 +1486,7 @@ async function whoami(flags) {
   const ctx = await context(flags.api);
   const me = await ctx.client.me();
   if (isJsonMode()) {
-    json({ ...me, api: ctx.base, tokenFrom: ctx.tokenFrom, link: ctx.link });
+    json({ ...me, api: ctx.base, tokenFrom: ctx.tokenFrom, link: ctx.link, credentialScope: ctx.credentialScope });
     return;
   }
   table(["", ""], [
@@ -1399,6 +1495,7 @@ async function whoami(flags) {
     ["role", me.organization?.role ?? "-"],
     ["api", ctx.base],
     ["token from", ctx.tokenFrom],
+    ["credential scope", ctx.credentialScope],
     ["linked project", ctx.link ? `${ctx.link.slug || ctx.link.projectId} \xB7 ${ctx.link.path}` : "none"]
   ]);
   out();
@@ -1412,8 +1509,8 @@ var AFTER_CREATE = [
 ];
 
 // src/creation-plan.ts
-import { createHash as createHash2 } from "node:crypto";
-import { resolve as resolve3 } from "node:path";
+import { createHash as createHash3 } from "node:crypto";
+import { resolve as resolve4 } from "node:path";
 
 // ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/external.js
 var external_exports = {};
@@ -5585,6 +5682,7 @@ var PendingInvitation = external_exports.object({
   expiresAt: IsoDateTime
 });
 var Me = external_exports.object({
+  authorization: external_exports.object({ via: external_exports.enum(["session", "token", "oauth"]), projectId: external_exports.string().uuid().nullable() }).optional(),
   user: external_exports.object({ id: Uuid, clerkUserId: external_exports.string() }),
   organization: external_exports.object({ id: Uuid, name: external_exports.string(), slug: external_exports.string(), role: Role }).nullable(),
   permissions: external_exports.array(external_exports.string())
@@ -5665,6 +5763,9 @@ var BootstrapBody = external_exports.object({
 }).refine((body) => !(body.planId || body.factsFingerprint) || Boolean(body.name), {
   message: "planId and factsFingerprint are only valid when creating a named project"
 });
+var CreateApplicationKeyBody = external_exports.object({
+  name: external_exports.string().min(1).max(100)
+}).strict();
 var CreateApiKeyBody = external_exports.object({
   name: external_exports.string().min(1).max(100),
   type: ApiKeyType
@@ -5866,6 +5967,20 @@ var PendingInvitationListResponse = external_exports.object({ invitations: exter
 var RedeemedInvitationResponse = external_exports.object({
   organization: external_exports.object({ id: Uuid, role: Role })
 });
+var OAuthConnection = external_exports.object({
+  id: external_exports.string().uuid(),
+  clientId: external_exports.string().uuid(),
+  clientName: external_exports.string(),
+  orgId: external_exports.string().uuid(),
+  projectId: external_exports.string().uuid().nullable(),
+  projectName: external_exports.string().nullable(),
+  scopes: external_exports.array(external_exports.string()),
+  status: external_exports.enum(["ready", "awaiting_exchange"]),
+  connectedAt: external_exports.string().datetime(),
+  expiresAt: external_exports.string().datetime(),
+  lastUsedAt: external_exports.string().datetime().nullable()
+});
+var OAuthConnectionListResponse = external_exports.object({ enabled: external_exports.boolean(), connections: external_exports.array(OAuthConnection) });
 
 // ../../node_modules/.pnpm/zod-to-json-schema@3.25.2_zod@3.25.76/node_modules/zod-to-json-schema/dist/esm/Options.js
 var ignoreOverride = Symbol("Let zodToJsonSchema decide on which parser to use");
@@ -6053,6 +6168,34 @@ var routes = {
   // All three are sessionOnly: a token must not be able to mint another
   // token. Otherwise a leaked one manufactures replacements faster than
   // anyone can revoke them, and revoking the one you found achieves nothing.
+  listOAuthConnections: {
+    method: "GET",
+    path: "/v1/me/connections",
+    summary: "Your authorized app connections in this workspace. No credentials.",
+    permission: "org:read",
+    sessionOnly: true,
+    status: 200,
+    response: OAuthConnectionListResponse
+  },
+  narrowOAuthConnection: {
+    method: "POST",
+    path: "/v1/me/connections/{id}/project",
+    summary: "Permanently restrict one authorization to an existing project. Cannot widen or retarget.",
+    permission: "org:read",
+    sessionOnly: true,
+    params: Id,
+    body: external_exports.object({ projectId: external_exports.string().uuid() }).strict(),
+    status: 204
+  },
+  revokeOAuthConnection: {
+    method: "DELETE",
+    path: "/v1/me/connections/{id}",
+    summary: "Disconnect one consent family, including access, refresh and pending exchange.",
+    permission: "org:read",
+    sessionOnly: true,
+    params: Id,
+    status: 204
+  },
   listAccessTokens: {
     method: "GET",
     path: "/v1/me/tokens",
@@ -6216,6 +6359,16 @@ var routes = {
     status: 200,
     response: ApiKeyListResponse
   },
+  createApplicationKey: {
+    method: "POST",
+    path: "/v1/projects/{id}/application-keys",
+    summary: "Issue a public anon application key. It obeys row and storage policies; never issues a service key.",
+    permission: "project:update",
+    params: Id,
+    body: CreateApplicationKeyBody,
+    status: 201,
+    response: IssuedApiKeyResponse
+  },
   createProjectKey: {
     method: "POST",
     path: "/v1/projects/{id}/keys",
@@ -6236,8 +6389,9 @@ var routes = {
   // The platform token never leaves the control plane and expires after 60
   // seconds. Callers are therefore authorized for the operation they asked
   // for (`data:read`, `data:write`, `deploy`, or `logs:read`) rather than for
-  // the internal credential used to carry it out. Actual API-key management
-  // remains under apikey:* and is deliberately closed to OAuth.
+  // the internal credential used to carry it out. Service-key issuance, key
+  // listing and revocation remain under apikey:* and closed to OAuth. The
+  // separate anon-only application-key route above uses project:update.
   getProjectSchema: {
     method: "GET",
     path: "/v1/projects/{id}/schema",
@@ -7258,7 +7412,7 @@ function staticSite(entries) {
 
 // src/commands/assess.ts
 import { stat as stat3 } from "node:fs/promises";
-import { basename, resolve as resolve2 } from "node:path";
+import { basename, resolve as resolve3 } from "node:path";
 
 // src/repository-scan.ts
 import { open, readdir, stat as stat2 } from "node:fs/promises";
@@ -7497,7 +7651,7 @@ async function assessWithContext(ctx, flags, requirements = "") {
     return;
   }
   if (flags.savePlan && !flags.name) throw new CliError("--save-plan requires --name with an explicit project name.", EXIT.usage);
-  const facts = await inspectAssessmentFacts(resolve2(flags.dir ?? "."), flags, requirements);
+  const facts = await inspectAssessmentFacts(resolve3(flags.dir ?? "."), flags, requirements);
   if (flags.savePlan) {
     const result2 = ProjectPlanResponse.safeParse(await ctx.client.createProjectPlan({ name: flags.name, ...flags.slug ? { slug: flags.slug } : {}, facts }));
     if (!result2.success) throw new CliError("The API returned an invalid project plan.", EXIT.failed);
@@ -7528,7 +7682,7 @@ async function assess(flags, ...words) {
 
 // src/creation-plan.ts
 async function prepareCreation(ctx, flags, name, operation) {
-  const root = resolve3(flags.dir ?? ".");
+  const root = resolve4(flags.dir ?? ".");
   const me = await ctx.client.me();
   if (!me.organization) throw new CliError("Select a workspace before creating a project.", EXIT.forbidden);
   const previous = await readPendingBootstrap(root);
@@ -7552,7 +7706,7 @@ async function prepareCreation(ctx, flags, name, operation) {
     EXIT.usage,
     "Run nimbly assess to clarify the requirements. An empty new application needs the explicit --recipe static-d1 choice."
   );
-  const fingerprint = createHash2("sha256").update(JSON.stringify(SuitabilityFacts.parse(facts))).digest("hex");
+  const fingerprint = createHash3("sha256").update(JSON.stringify(SuitabilityFacts.parse(facts))).digest("hex");
   if (previous) {
     if (flags.plan && flags.plan !== previous.planId) throw new CliError("Retry with the original pending plan.", EXIT.usage);
     if (fingerprint !== previous.factsFingerprint) throw new CliError(
@@ -7584,7 +7738,7 @@ async function prepareCreation(ctx, flags, name, operation) {
 }
 
 // src/commands/projects.ts
-import { resolve as resolve4 } from "node:path";
+import { resolve as resolve5 } from "node:path";
 var WAIT_TIMEOUT_MS = 18e4;
 var FIRST_POLL_MS = 500;
 var POLL_GROWTH = 1.5;
@@ -7642,7 +7796,7 @@ async function create(flags, name) {
     );
   }
   const ctx = await context(flags.api);
-  const root = resolve4(flags.dir ?? ".");
+  const root = resolve5(flags.dir ?? ".");
   if (flags.link !== false) {
     await assertMayCreateLink(root, { relink: flags.relink });
   }
@@ -7694,7 +7848,7 @@ async function init(flags, name) {
     );
   }
   const ctx = await context(flags.api);
-  const root = resolve4(flags.dir ?? ".");
+  const root = resolve5(flags.dir ?? ".");
   const explicitProject = flags.project;
   const linkedProject = !name && !explicitProject ? (await findLink(root))?.projectId : void 0;
   if (name && flags.link !== false) {
@@ -7968,11 +8122,11 @@ async function mcp(flags, which) {
 // src/commands/db.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
 import { readFile as readFile3, writeFile as writeFile3 } from "node:fs/promises";
-import { dirname as dirname3, isAbsolute, join as join4, resolve as resolve5 } from "node:path";
+import { dirname as dirname5, isAbsolute, join as join4, resolve as resolve6 } from "node:path";
 var DEFAULT_SCHEMA_FILE = "schema.json";
 function schemaPath(ctx, flag) {
-  if (flag) return isAbsolute(flag) ? flag : resolve5(process.cwd(), flag);
-  const base = ctx.link ? dirname3(ctx.link.path) : process.cwd();
+  if (flag) return isAbsolute(flag) ? flag : resolve6(process.cwd(), flag);
+  const base = ctx.link ? dirname5(ctx.link.path) : process.cwd();
   return join4(base, DEFAULT_SCHEMA_FILE);
 }
 async function readSchema(path) {
@@ -8482,7 +8636,7 @@ function render4(f) {
 
 // src/commands/functions.ts
 import { readFile as readFile5 } from "node:fs/promises";
-import { basename as basename2, dirname as dirname4, extname as extname2, resolve as resolve6 } from "node:path";
+import { basename as basename2, dirname as dirname6, extname as extname2, resolve as resolve7 } from "node:path";
 import { build as bundle } from "esbuild";
 var NAME = /^[a-z][a-z0-9-]{0,30}$/;
 var MAX_FUNCTION_BYTES = 1e6;
@@ -8563,10 +8717,10 @@ async function deploy(flags, file) {
   note(paint("dim", "  env.DB, env.FILES, env.KV are this project\u2019s own. Nothing else is reachable."));
 }
 async function bundleFunction(file) {
-  const absolute = resolve6(file);
+  const absolute = resolve7(file);
   try {
     const result = await bundle({
-      absWorkingDir: dirname4(absolute),
+      absWorkingDir: dirname6(absolute),
       entryPoints: [absolute],
       bundle: true,
       write: false,
@@ -9010,7 +9164,7 @@ function propertyName(name) {
 
 // src/commands/deploy.ts
 import { readdir as readdir2, readFile as readFile6, stat as stat4 } from "node:fs/promises";
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 import { spawn as spawn2 } from "node:child_process";
 import { join as join5, relative as relative2, sep } from "node:path";
 var SKIP = /* @__PURE__ */ new Set([".git", "node_modules", ".DS_Store", ".env", ".env.local", "Thumbs.db"]);
@@ -9181,7 +9335,7 @@ async function buildSite(root, script, display) {
   const entries = await readdir2(root);
   const runner = packageRunner(entries);
   if (!isJsonMode()) note(`Running ${runner.label} run ${script}\u2026`);
-  const code = await new Promise((resolve8, reject) => {
+  const code = await new Promise((resolve9, reject) => {
     const child = spawn2(runner.command, [...runner.args, "run", script], {
       cwd: root,
       stdio: "inherit",
@@ -9191,7 +9345,7 @@ async function buildSite(root, script, display) {
       shell: process.platform === "win32"
     });
     child.once("error", reject);
-    child.once("close", (status4) => resolve8(status4 ?? 1));
+    child.once("close", (status4) => resolve9(status4 ?? 1));
   }).catch((err) => {
     throw new CliError(
       `Could not start ${display ?? `${runner.label} run ${script}`}.`,
@@ -9251,7 +9405,7 @@ async function collect(dir) {
       found.push({
         path: toUrlPath(relative2(dir, absolute)),
         absolute,
-        hash: createHash3("sha256").update(await readFile6(absolute)).digest("hex"),
+        hash: createHash4("sha256").update(await readFile6(absolute)).digest("hex"),
         size: info.size
       });
     }
@@ -9721,7 +9875,7 @@ async function remove4(flags, name) {
 
 // src/commands/architect.ts
 import { readdir as readdir3, readFile as readFile8, stat as stat5 } from "node:fs/promises";
-import { join as join6, resolve as resolve7 } from "node:path";
+import { join as join6, resolve as resolve8 } from "node:path";
 var FEATURE_PATTERNS = {
   auth: /\b(auth(?:entication|enticated|orization|orized)?|log-?ins?|sign-?ins?|sign-?ups?|sessions?|user accounts?|passport|clerk|auth0)\b/i,
   storage: /\b(uploads?|attachments?|buckets?|object storage|file (?:uploads?|attachments?|storage)|s3|r2|multer|media)\b/i,
@@ -9735,7 +9889,7 @@ var FEATURE_PATTERNS = {
   crawler: /\b(crawls?|crawlers?|scrapes?|playwright|puppeteer|browser automation)\b/i
 };
 async function architect(flags, ...words) {
-  const root = resolve7(flags.dir ?? ".");
+  const root = resolve8(flags.dir ?? ".");
   const requirements = words.filter((word) => Boolean(word)).join(" ").trim();
   const ctx = await context(flags.api);
   if (!flags.project && !ctx.link) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nimblybase",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "description": "The NimblyBase command line - projects, keys and backends from a terminal.",
   "license": "UNLICENSED",
   "repository": {