nimblybase 0.1.7 → 0.1.9

package/README.md

@@ -30,6 +30,27 @@ keychain on macOS, and otherwise in
 `~/.config/nimblybase/credentials.json` with permissions `0600`. `nimbly
 login` always says which one it used.
 
+Inside an existing linked repository, `nimbly login --api <linked-api>` requests
+access only to that project. The browser shows its authoritative name and asks
+for explicit approval. The CLI verifies the server's restriction before saving
+anything. Project creation, billing and other projects are excluded; your current
+workspace role still limits the approved operations.
+
+Each repository stores its grant separately in a keychain entry or under
+`~/.config/nimblybase/repositories/<directory-hash>/credentials.json`. Credentials
+stay outside your source tree; `nimblybase.json` only records the project and a
+credential-free `authorization: "project"` marker. Nested directories use the
+same login. `nimbly logout` here clears only this repository login and requires
+another approval before project commands can run; your workspace login is kept.
+
+For an unlinked existing repository, use `nimbly login --project <uuid> --api
+<api>`. It links the approved project after verification. Legacy linked repos
+keep their existing workspace login until they explicitly sign in this way.
+Automatic restriction after creating a new project is a separate pending step.
+Project login currently requires the browser flow; device sign-in and pasted
+PAT login remain available outside linked repositories. An explicitly supplied
+`NIMBLYBASE_TOKEN` still takes precedence for automation.
+
 For a machine without a local browser, run `nimbly login --device`. Open the
 displayed verification page on another device and enter the short code. The
 dashboard shows the requesting client and approved workspace/scopes. The CLI
@@ -79,6 +100,30 @@ credentials**. Commit it: a teammate cloning the repo gets the same target
 without being told a UUID. Commands run anywhere beneath it use that project
 unless you name another with `-p`.
 
+## Project consent after setup
+
+`nimbly init` and `nimbly create` link an active project, then open browser
+consent automatically in an interactive terminal. The verified project grant
+is stored separately for this repository; your workspace login stays available
+for creating another project in another directory. Approval remains your choice.
+
+For an AI terminal, use `--authorize` to wait for browser consent explicitly.
+For scripts, `--json`, `--no-authorize`, CI, and a terminal without interactive
+input leave consent pending instead of opening a browser. The JSON response has
+an `authorization` object with `state`, `projectId` and, when pending, a retry
+`command`. Run that command **inside the linked repository**. A pending link
+will not fall back to the wider workspace login.
+
+`--no-wait` leaves consent pending while provisioning. `--no-link` creates no
+repository login. An explicit `NIMBLYBASE_TOKEN` is reported as `environment`;
+its permissions are those of that token, with no browser grant created. It
+cannot be combined with `--authorize`.
+
+If approval is denied or fails, the project and link are retained. Retry
+`nimbly login` with the API printed by the CLI; do not recreate the project.
+A returning repository grant uses read endpoints for `nimbly init`, so it does
+not need workspace creation permission or another browser approval.
+
 ## Scripting
 
 Every command takes `--json`. In JSON mode stdout carries the document and

package/dist/index.js

@@ -98,6 +98,7 @@ function parse(argv) {
         // SQL.
         param: { type: "string", multiple: true },
         "allow-destructive": { type: "boolean", default: false },
+        authorize: { type: "boolean" },
         wait: { type: "boolean", default: true },
         link: { type: "boolean", default: true },
         relink: { type: "boolean", default: false },
@@ -168,6 +169,7 @@ function parse(argv) {
       maxTokens: v["max-tokens"] === void 0 ? void 0 : Number(v["max-tokens"]),
       params: v.param,
       allowDestructive: v["allow-destructive"] === true,
+      authorize: v.authorize,
       wait: v.wait,
       link: v.link,
       relink: v.relink === true,
@@ -185,6 +187,7 @@ USAGE
 
 GETTING STARTED
   login                    Sign in through your browser; --device for another machine
+                           Inside a linked repo, approve only that project
                            --token-only is the explicit pasted-PAT fallback
   init [name]              Create or explicitly choose a project for this repo
   describe                 Show what the linked project's backend can do
@@ -313,6 +316,8 @@ OPTIONS
   --level <info|warn|error>  Only logs at this level or worse
   --route </v1/sql>        Only logs for one route
   --no-wait                Do not wait for a new project to finish provisioning
+  --authorize              Open project consent after linking, including from an agent terminal
+  --no-authorize           Leave project consent pending; never use workspace login as fallback
   --no-link                Do not link the directory after creating a project
   --relink                 Explicitly replace this repository's project target
   --with-token             Include the live token in \`mcp\` output
@@ -373,7 +378,7 @@ function when(iso) {
 
 // src/api.ts
 var DEFAULT_API_URL = "https://api-uat.nimblybase.com";
-var VERSION = "0.1.7";
+var VERSION = "0.1.9";
 function dashboardUrl(api) {
   const match = /^https:\/\/api(-[a-z0-9]+)?\.(.+)$/.exec(api);
   return match ? `https://app${match[1] ?? ""}.${match[2]}` : null;
@@ -808,7 +813,7 @@ async function deviceLogin(input, fetchImpl = fetch) {
     throw new Error("the device verification page is outside the authorization origin");
   }
   const now = input.now ?? (() => performance.now());
-  const sleep = input.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
+  const sleep = input.sleep ?? ((ms) => new Promise((resolve9) => setTimeout(resolve9, ms)));
   const deadline = now() + device.expires_in * 1e3;
   let interval = Math.max(5, device.interval ?? 5) * 1e3;
   input.announce({ verificationUri: verification.toString(), userCode: device.user_code, expiresInSeconds: device.expires_in });
@@ -864,6 +869,7 @@ async function browserLogin(input) {
   const port = await listener.port;
   const redirectUri = `http://127.0.0.1:${port}${CALLBACK_PATH}`;
   const authorize = new URL(doc.authorization_endpoint);
+  if (input.projectId) authorize.searchParams.set("project_id", input.projectId);
   for (const [k, v] of Object.entries({
     response_type: "code",
     client_id: clientId,
@@ -905,7 +911,7 @@ import { promisify } from "node:util";
 import { homedir } from "node:os";
 import { join, dirname } from "node:path";
 import { mkdir, readFile, writeFile, chmod, rm, stat, rename } from "node:fs/promises";
-import { randomUUID } from "node:crypto";
+import { createHash as createHash2, randomUUID } from "node:crypto";
 var run = promisify(execFile);
 var SERVICE = "nimblybase-cli";
 var ACCOUNT = "access-token";
@@ -914,17 +920,21 @@ function configDir() {
   return xdg ? join(xdg, "nimblybase") : join(homedir(), ".config", "nimblybase");
 }
 var credentialsPath = () => join(configDir(), "credentials.json");
+function repositoryCredentials(root) {
+  const id = createHash2("sha256").update(root).digest("hex");
+  return createStore("repository-" + id, () => join(configDir(), "repositories", id, "credentials.json"), true);
+}
 function keychainAvailable() {
   return process.platform === "darwin" && process.env.NIMBLYBASE_NO_KEYCHAIN !== "1";
 }
-async function keychainSet(secret) {
+async function keychainSet(secret, account = ACCOUNT) {
   if (!keychainAvailable()) return false;
   try {
     await run("security", [
       "add-generic-password",
       "-U",
       "-a",
-      ACCOUNT,
+      account,
       "-s",
       SERVICE,
       "-D",
@@ -937,20 +947,20 @@ async function keychainSet(secret) {
     return false;
   }
 }
-async function keychainGet() {
+async function keychainGet(account = ACCOUNT) {
   if (!keychainAvailable()) return null;
   try {
-    const { stdout } = await run("security", ["find-generic-password", "-a", ACCOUNT, "-s", SERVICE, "-w"]);
+    const { stdout } = await run("security", ["find-generic-password", "-a", account, "-s", SERVICE, "-w"]);
     const value = stdout.trim();
     return value.length > 0 ? value : null;
   } catch {
     return null;
   }
 }
-async function keychainDelete() {
+async function keychainDelete(account = ACCOUNT) {
   if (!keychainAvailable()) return false;
   try {
-    await run("security", ["delete-generic-password", "-a", ACCOUNT, "-s", SERVICE]);
+    await run("security", ["delete-generic-password", "-a", account, "-s", SERVICE]);
     return true;
   } catch {
     return false;
@@ -970,15 +980,17 @@ function decodeSecret(raw) {
     return {};
   }
 }
-async function fileRead() {
+async function fileRead(path = credentialsPath(), strict = false) {
   try {
-    return JSON.parse(await readFile(credentialsPath(), "utf8"));
-  } catch {
+    const value = JSON.parse(await readFile(path, "utf8"));
+    if (strict && (!value || typeof value !== "object")) throw new Error("Invalid repository credential");
+    return value;
+  } catch (err) {
+    if (strict && err.code !== "ENOENT") throw new Error("Repository authorization is unreadable. Run nimbly login here again; your workspace login was kept.", { cause: err });
     return null;
   }
 }
-async function fileWrite(value, apiUrl2) {
-  const path = credentialsPath();
+async function fileWrite(value, apiUrl2, path = credentialsPath()) {
   await mkdir(dirname(path), { recursive: true, mode: 448 });
   await chmod(dirname(path), 448);
   const body = typeof value === "string" ? { token: value, ...apiUrl2 ? { apiUrl: apiUrl2 } : {} } : { grant: value };
@@ -992,110 +1004,67 @@ async function fileWrite(value, apiUrl2) {
     await rm(temporary, { force: true });
   }
 }
-var credentials = {
-  async save(token, apiUrl2) {
-    if (await keychainSet(encodeSecret(token, apiUrl2))) return "keychain";
-    await fileWrite(token, apiUrl2);
-    return "file";
-  },
-  async saveGrant(grant) {
-    if (await keychainSet(encodeSecret(grant))) return "keychain";
-    await fileWrite(grant);
-    return "file";
-  },
-  async load() {
-    const fromEnv = process.env.NIMBLYBASE_TOKEN?.trim();
-    if (fromEnv) return { token: fromEnv, where: "environment" };
-    const fromKeychain = await keychainGet();
-    if (fromKeychain) {
-      const { token, grant, apiUrl: apiUrl3 } = decodeSecret(fromKeychain);
-      const value2 = token ?? grant?.accessToken;
-      if (value2) return { token: value2, where: "keychain", ...apiUrl3 || grant?.issuer ? { apiUrl: apiUrl3 ?? grant.issuer } : {} };
-    }
-    const fromFile = await fileRead();
-    const value = fromFile?.token ?? fromFile?.grant?.accessToken;
-    const apiUrl2 = fromFile?.apiUrl ?? fromFile?.grant?.issuer;
-    return value ? { token: value, where: "file", ...apiUrl2 ? { apiUrl: apiUrl2 } : {} } : null;
-  },
-  async loadGrant() {
-    if (process.env.NIMBLYBASE_TOKEN?.trim()) return null;
-    const fromKeychain = await keychainGet();
-    if (fromKeychain) {
-      const { grant } = decodeSecret(fromKeychain);
-      return grant ? { grant, where: "keychain" } : null;
-    }
-    const fromFile = await fileRead();
-    return fromFile?.grant ? { grant: fromFile.grant, where: "file" } : null;
-  },
-  async clear() {
-    const cleared = [];
-    if (await keychainDelete()) cleared.push("keychain");
-    try {
-      await stat(credentialsPath());
-      await rm(credentialsPath());
-      cleared.push("file");
-    } catch {
+function createStore(account = ACCOUNT, path = credentialsPath, projectOnly = false) {
+  function checkProject(grant) {
+    if (projectOnly && (!grant?.projectId || !grant.issuer || !grant.refreshToken || !grant.accessToken)) {
+      throw new Error("Repository authorization is invalid. Run nimbly login here again; your workspace login was kept.");
     }
-    return cleared;
   }
-};
-
-// src/prompt.ts
-import { createInterface } from "node:readline";
-async function readPipedInput() {
-  if (process.stdin.isTTY) return null;
-  const chunks = [];
-  for await (const chunk of process.stdin) chunks.push(Buffer.from(chunk));
-  const value = Buffer.concat(chunks).toString("utf8").trim();
-  return value.length > 0 ? value : null;
-}
-function promptSecret(question) {
-  return new Promise((resolve8, reject) => {
-    const rl = createInterface({ input: process.stdin, output: process.stderr, terminal: true });
-    let promptShown = false;
-    const output = rl;
-    const write = output.output.write.bind(output.output);
-    output.output.write = (chunk) => {
-      if (!promptShown) {
-        promptShown = true;
-        return write(chunk);
+  return {
+    async save(token, apiUrl2) {
+      if (projectOnly) throw new Error("Repository authorization requires a project-restricted OAuth grant");
+      if (await keychainSet(encodeSecret(token, apiUrl2), account)) return "keychain";
+      await fileWrite(token, apiUrl2, path());
+      return "file";
+    },
+    async saveGrant(grant) {
+      checkProject(grant);
+      if (await keychainSet(encodeSecret(grant), account)) return "keychain";
+      await fileWrite(grant, void 0, path());
+      return "file";
+    },
+    async load() {
+      const fromEnv = process.env.NIMBLYBASE_TOKEN?.trim();
+      if (fromEnv) return { token: fromEnv, where: "environment" };
+      const fromKeychain = await keychainGet(account);
+      if (fromKeychain) {
+        const { token, grant, apiUrl: apiUrl3 } = decodeSecret(fromKeychain);
+        checkProject(grant);
+        const value2 = token ?? grant?.accessToken;
+        if (value2) return { token: value2, where: "keychain", ...apiUrl3 || grant?.issuer ? { apiUrl: apiUrl3 ?? grant.issuer } : {} };
       }
-      return true;
-    };
-    rl.question(question, (answer) => {
-      ;
-      output.output.write = write;
-      process.stderr.write("\n");
-      rl.close();
-      resolve8(answer.trim());
-    });
-    rl.on("SIGINT", () => {
-      rl.close();
-      reject(new Error("cancelled"));
-    });
-  });
-}
-async function confirmExact(question, expected) {
-  if (!process.stdin.isTTY) return false;
-  const rl = createInterface({ input: process.stdin, output: process.stderr });
-  try {
-    const answer = await new Promise((r) => rl.question(`${question}
-Type "${expected}" to confirm: `, r));
-    return answer.trim() === expected;
-  } finally {
-    rl.close();
-  }
-}
-async function confirm(question) {
-  if (!process.stdin.isTTY) return false;
-  const rl = createInterface({ input: process.stdin, output: process.stderr });
-  try {
-    const answer = await new Promise((r) => rl.question(`${question} [y/N] `, r));
-    return /^y(es)?$/i.test(answer.trim());
-  } finally {
-    rl.close();
-  }
+      const fromFile = await fileRead(path(), projectOnly);
+      if (fromFile) checkProject(fromFile.grant);
+      const value = fromFile?.token ?? fromFile?.grant?.accessToken;
+      const apiUrl2 = fromFile?.apiUrl ?? fromFile?.grant?.issuer;
+      return value ? { token: value, where: "file", ...apiUrl2 ? { apiUrl: apiUrl2 } : {} } : null;
+    },
+    async loadGrant() {
+      if (process.env.NIMBLYBASE_TOKEN?.trim()) return null;
+      const fromKeychain = await keychainGet(account);
+      if (fromKeychain) {
+        const { grant } = decodeSecret(fromKeychain);
+        checkProject(grant);
+        return grant ? { grant, where: "keychain" } : null;
+      }
+      const fromFile = await fileRead(path(), projectOnly);
+      if (fromFile) checkProject(fromFile.grant);
+      return fromFile?.grant ? { grant: fromFile.grant, where: "file" } : null;
+    },
+    async clear() {
+      const cleared = [];
+      if (await keychainDelete(account)) cleared.push("keychain");
+      try {
+        await stat(path());
+        await rm(path());
+        cleared.push("file");
+      } catch {
+      }
+      return cleared;
+    }
+  };
 }
+var credentials = createStore();
 
 // src/link.ts
 import { readFile as readFile2, rename as rename2, rm as rm2, writeFile as writeFile2, link as hardLink } from "node:fs/promises";
@@ -1146,6 +1115,7 @@ async function findLink(from = process.cwd()) {
         projectId: parsed.projectId,
         slug: typeof parsed.slug === "string" ? parsed.slug : "",
         apiUrl: typeof parsed.apiUrl === "string" ? parsed.apiUrl : void 0,
+        ...parsed.authorization === "project" ? { authorization: "project" } : {},
         path
       };
     }
@@ -1181,6 +1151,7 @@ async function writeLink(dir, link2, options = {}) {
     slug: link2.slug
   };
   if (link2.apiUrl !== void 0) next.apiUrl = link2.apiUrl;
+  if (link2.authorization !== void 0) next.authorization = link2.authorization;
   const temporary = join2(dirname2(path), `.${LINK_FILE}.${process.pid}.${randomUUID2()}.tmp`);
   try {
     await writeFile2(temporary, `${JSON.stringify(next, null, 2)}
@@ -1236,12 +1207,86 @@ async function clearPendingBootstrap(dir) {
   await rm2(join2(dir, BOOTSTRAP_FILE), { force: true });
 }
 
+// src/commands/auth.ts
+import { realpath as realpath2 } from "node:fs/promises";
+import { dirname as dirname4, resolve as resolve2 } from "node:path";
+
+// src/prompt.ts
+import { createInterface } from "node:readline";
+async function readPipedInput() {
+  if (process.stdin.isTTY) return null;
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(Buffer.from(chunk));
+  const value = Buffer.concat(chunks).toString("utf8").trim();
+  return value.length > 0 ? value : null;
+}
+function promptSecret(question) {
+  return new Promise((resolve9, reject) => {
+    const rl = createInterface({ input: process.stdin, output: process.stderr, terminal: true });
+    let promptShown = false;
+    const output = rl;
+    const write = output.output.write.bind(output.output);
+    output.output.write = (chunk) => {
+      if (!promptShown) {
+        promptShown = true;
+        return write(chunk);
+      }
+      return true;
+    };
+    rl.question(question, (answer) => {
+      ;
+      output.output.write = write;
+      process.stderr.write("\n");
+      rl.close();
+      resolve9(answer.trim());
+    });
+    rl.on("SIGINT", () => {
+      rl.close();
+      reject(new Error("cancelled"));
+    });
+  });
+}
+async function confirmExact(question, expected) {
+  if (!process.stdin.isTTY) return false;
+  const rl = createInterface({ input: process.stdin, output: process.stderr });
+  try {
+    const answer = await new Promise((r) => rl.question(`${question}
+Type "${expected}" to confirm: `, r));
+    return answer.trim() === expected;
+  } finally {
+    rl.close();
+  }
+}
+async function confirm(question) {
+  if (!process.stdin.isTTY) return false;
+  const rl = createInterface({ input: process.stdin, output: process.stderr });
+  try {
+    const answer = await new Promise((r) => rl.question(`${question} [y/N] `, r));
+    return /^y(es)?$/i.test(answer.trim());
+  } finally {
+    rl.close();
+  }
+}
+
 // src/context.ts
-async function context(apiOverride) {
-  const link2 = await findLink();
-  const storedBeforeRefresh = await credentials.load();
+import { realpath } from "node:fs/promises";
+import { dirname as dirname3 } from "node:path";
+async function context(apiOverride, directory) {
+  const link2 = await findLink(directory);
+  const repositoryStore = link2 ? repositoryCredentials(await realpath(dirname3(link2.path))) : void 0;
+  const repositoryToken = await repositoryStore?.load();
+  const useRepository = repositoryToken?.where !== "environment" && (Boolean(repositoryToken) || link2?.authorization === "project");
+  const store = useRepository ? repositoryStore : credentials;
+  const storedBeforeRefresh = useRepository ? repositoryToken : await credentials.load();
   const base = apiUrl(apiOverride ?? process.env.NIMBLYBASE_API_URL ?? link2?.apiUrl ?? (storedBeforeRefresh?.where !== "environment" ? storedBeforeRefresh?.apiUrl : void 0));
-  const held = await credentials.loadGrant();
+  const held = await store.loadGrant();
+  if (useRepository && held && held.grant.projectId !== link2?.projectId) {
+    throw new CliError(
+      "This repository login belongs to a different project.",
+      EXIT.unauthenticated,
+      "Run `nimbly login` here to approve the new project. Your other logins were kept."
+    );
+  }
   if (storedBeforeRefresh && storedBeforeRefresh.where !== "environment") {
     const bound = apiUrl(storedBeforeRefresh.apiUrl ?? "https://api-uat.nimblybase.com");
     if (base !== bound) throw new CliError(
@@ -1264,11 +1309,11 @@ async function context(apiOverride) {
         clientId: held.grant.clientId,
         refreshToken: held.grant.refreshToken
       });
-      await credentials.saveGrant({ ...fresh, issuer: held.grant.issuer });
+      await store.saveGrant({ ...fresh, issuer: held.grant.issuer, ...held.grant.projectId ? { projectId: held.grant.projectId } : {} });
     } catch {
     }
   }
-  const stored = await credentials.load();
+  const stored = await store.load();
   if (!stored) {
     throw new CliError(
       "Not signed in.",
@@ -1281,7 +1326,8 @@ async function context(apiOverride) {
     base,
     tokenFrom: stored.where,
     isCurrentToken: (prefix) => prefix.length > 0 && stored.token.startsWith(prefix),
-    link: link2
+    link: link2,
+    credentialScope: useRepository ? "repository" : "workspace"
   };
 }
 var UUID2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
@@ -1320,9 +1366,65 @@ var WHERE_SAID = {
   file: `${credentialsPath()} (permissions 0600)`,
   environment: "the NIMBLYBASE_TOKEN environment variable"
 };
+async function saveBrowserLogin(grant, base, projectId, root, relink) {
+  const client = createClient(base, grant.accessToken);
+  const me = await client.me();
+  if (projectId && (me.authorization?.via !== "oauth" || me.authorization.projectId !== projectId)) {
+    throw new CliError(
+      "The server did not confirm this project restriction.",
+      EXIT.unauthenticated,
+      "Nothing was saved. Update the server/client and approve project access again."
+    );
+  }
+  if (projectId && root) {
+    const { project } = await client.project(projectId);
+    if (project.id !== projectId) throw new CliError("The authorized project response is invalid.", EXIT.unauthenticated);
+    await writeLink(root, { projectId, slug: project.slug, apiUrl: base, authorization: "project" }, { relink });
+  }
+  const store = root ? repositoryCredentials(root) : credentials;
+  const where = await store.saveGrant({ ...grant, issuer: base, ...projectId ? { projectId } : {} });
+  return { me, where };
+}
+async function authorizeRepository(root, projectId, base, relink) {
+  const canonical = await realpath2(root);
+  const grant = await browserLogin({
+    issuer: base,
+    projectId,
+    open: openBrowser,
+    announce: (url) => note(`Approve access to this project in your browser. If it did not open, go to:
+  ${url}`)
+  });
+  await saveBrowserLogin(grant, base, projectId, canonical, relink);
+}
 async function login(flags) {
   const base = apiUrl(flags.api);
+  const link2 = await findLink(flags.dir);
+  const projectId = flags.project ?? link2?.projectId;
+  if (projectId && !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(projectId)) {
+    throw new CliError("Project authorization requires a project UUID.", EXIT.usage, "Link this repository first, or pass --project <uuid>.");
+  }
+  if (projectId && flags.device) throw new CliError(
+    "Project sign-in currently requires browser approval.",
+    EXIT.usage,
+    "Run `nimbly login` here without --device. Device sign-in outside linked repositories remains workspace-scoped."
+  );
+  if (projectId && link2?.apiUrl && apiUrl(link2.apiUrl) !== base) throw new CliError(
+    "Choose the linked project API explicitly.",
+    EXIT.usage,
+    "Pass --api with the linked API; a repository file cannot choose your login destination."
+  );
+  if (link2 && projectId !== link2.projectId && !flags.relink) throw new CliError(
+    "This repository is linked to another project.",
+    EXIT.usage,
+    "Use --relink to explicitly authorize and link a different project."
+  );
+  const root = projectId ? await realpath2(link2 ? dirname4(link2.path) : resolve2(flags.dir ?? ".")) : void 0;
   const given = flags.token ?? await readPipedInput();
+  if (projectId && (given || flags.tokenOnly)) throw new CliError(
+    "A pasted token does not authorize a repository project.",
+    EXIT.usage,
+    "Use browser sign-in here; use NIMBLYBASE_TOKEN for an explicitly configured automation identity."
+  );
   if (flags.device && (given || flags.tokenOnly)) throw new CliError("Choose device sign-in or a pasted token, not both.", EXIT.usage);
   if (!given && !flags.tokenOnly) {
     const grant = flags.device ? await deviceLogin({
@@ -1340,17 +1442,26 @@ It expires in ${expiresInSeconds} seconds. Approve only the CLI request you star
         note(`If it did not open, go to:
   ${url}`);
       },
-      open: openBrowser
+      open: openBrowser,
+      ...projectId ? { projectId } : {}
     });
-    const me2 = await createClient(base, grant.accessToken).me();
-    const where2 = await credentials.saveGrant({ ...grant, issuer: base });
+    const { me: me2, where: where2 } = await saveBrowserLogin(grant, base, projectId, root, flags.relink);
     if (isJsonMode()) {
-      json({ ok: true, storedIn: where2, organization: me2.organization, api: base, scopes: grant.scopes });
+      json({
+        ok: true,
+        storedIn: where2,
+        organization: me2.organization,
+        api: base,
+        scopes: grant.scopes,
+        authorizationScope: projectId ? "repository" : "workspace",
+        ...projectId ? { projectId } : {}
+      });
       return;
     }
     out(`${paint("green", "\u2713")} Signed in as ${paint("bold", me2.organization?.name ?? "your account")}${me2.organization ? ` (${me2.organization.role})` : ""}`);
     note(`Granted: ${grant.scopes.join(", ") || "no scopes"}.`);
-    note(`Stored in ${WHERE_SAID[where2]}. It refreshes itself; run \`nimbly logout\` to end it.`);
+    note(projectId ? `Access is restricted to ${projectId}. Stored separately for this repository ${where2 === "keychain" ? "in your login keychain" : "outside the repository (permissions 0600)"}.` : `Stored in ${WHERE_SAID[where2]}.`);
+    note("It refreshes itself; run `nimbly logout` here to clear this login.");
     return;
   }
   const token = given ?? await promptSecret(source(base));
@@ -1374,14 +1485,18 @@ It expires in ${expiresInSeconds} seconds. Approve only the CLI request you star
     note("The keychain was not available, so a file was used instead.");
   }
 }
-async function logout() {
-  const cleared = await credentials.clear();
+async function logout(flags) {
+  const link2 = await findLink(flags?.dir);
+  const repo = link2 ? repositoryCredentials(await realpath2(dirname4(link2.path))) : void 0;
+  const repository = link2?.authorization === "project" || repo && await repo.loadGrant() !== null;
+  const cleared = await (repository ? repo : credentials).clear();
   if (isJsonMode()) {
     json({ ok: true, cleared });
     return;
   }
   if (cleared.length === 0) out("Nothing stored - already signed out.");
   else out(`${paint("green", "\u2713")} Signed out (cleared: ${cleared.join(", ")}).`);
+  if (repository) note("Cleared this repository login. Your separate workspace login was kept; run logout outside this repository to clear it.");
   if (process.env.NIMBLYBASE_TOKEN) {
     note("NIMBLYBASE_TOKEN is still set in this shell and takes precedence - unset it too.");
   }
@@ -1390,7 +1505,7 @@ async function whoami(flags) {
   const ctx = await context(flags.api);
   const me = await ctx.client.me();
   if (isJsonMode()) {
-    json({ ...me, api: ctx.base, tokenFrom: ctx.tokenFrom, link: ctx.link });
+    json({ ...me, api: ctx.base, tokenFrom: ctx.tokenFrom, link: ctx.link, credentialScope: ctx.credentialScope });
     return;
   }
   table(["", ""], [
@@ -1399,6 +1514,7 @@ async function whoami(flags) {
     ["role", me.organization?.role ?? "-"],
     ["api", ctx.base],
     ["token from", ctx.tokenFrom],
+    ["credential scope", ctx.credentialScope],
     ["linked project", ctx.link ? `${ctx.link.slug || ctx.link.projectId} \xB7 ${ctx.link.path}` : "none"]
   ]);
   out();
@@ -1412,8 +1528,8 @@ var AFTER_CREATE = [
 ];
 
 // src/creation-plan.ts
-import { createHash as createHash2 } from "node:crypto";
-import { resolve as resolve3 } from "node:path";
+import { createHash as createHash3 } from "node:crypto";
+import { resolve as resolve4 } from "node:path";
 
 // ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/external.js
 var external_exports = {};
@@ -7315,7 +7431,7 @@ function staticSite(entries) {
 
 // src/commands/assess.ts
 import { stat as stat3 } from "node:fs/promises";
-import { basename, resolve as resolve2 } from "node:path";
+import { basename, resolve as resolve3 } from "node:path";
 
 // src/repository-scan.ts
 import { open, readdir, stat as stat2 } from "node:fs/promises";
@@ -7554,7 +7670,7 @@ async function assessWithContext(ctx, flags, requirements = "") {
     return;
   }
   if (flags.savePlan && !flags.name) throw new CliError("--save-plan requires --name with an explicit project name.", EXIT.usage);
-  const facts = await inspectAssessmentFacts(resolve2(flags.dir ?? "."), flags, requirements);
+  const facts = await inspectAssessmentFacts(resolve3(flags.dir ?? "."), flags, requirements);
   if (flags.savePlan) {
     const result2 = ProjectPlanResponse.safeParse(await ctx.client.createProjectPlan({ name: flags.name, ...flags.slug ? { slug: flags.slug } : {}, facts }));
     if (!result2.success) throw new CliError("The API returned an invalid project plan.", EXIT.failed);
@@ -7585,7 +7701,7 @@ async function assess(flags, ...words) {
 
 // src/creation-plan.ts
 async function prepareCreation(ctx, flags, name, operation) {
-  const root = resolve3(flags.dir ?? ".");
+  const root = resolve4(flags.dir ?? ".");
   const me = await ctx.client.me();
   if (!me.organization) throw new CliError("Select a workspace before creating a project.", EXIT.forbidden);
   const previous = await readPendingBootstrap(root);
@@ -7609,7 +7725,7 @@ async function prepareCreation(ctx, flags, name, operation) {
     EXIT.usage,
     "Run nimbly assess to clarify the requirements. An empty new application needs the explicit --recipe static-d1 choice."
   );
-  const fingerprint = createHash2("sha256").update(JSON.stringify(SuitabilityFacts.parse(facts))).digest("hex");
+  const fingerprint = createHash3("sha256").update(JSON.stringify(SuitabilityFacts.parse(facts))).digest("hex");
   if (previous) {
     if (flags.plan && flags.plan !== previous.planId) throw new CliError("Retry with the original pending plan.", EXIT.usage);
     if (fingerprint !== previous.factsFingerprint) throw new CliError(
@@ -7640,8 +7756,47 @@ async function prepareCreation(ctx, flags, name, operation) {
   });
 }
 
+// src/repository-setup.ts
+import { realpath as realpath3 } from "node:fs/promises";
+import { dirname as dirname5 } from "node:path";
+function validateRepositorySetup(flags) {
+  if (flags.authorize && flags.link === false) {
+    throw new CliError("--authorize requires a linked repository.", EXIT.usage);
+  }
+  if (flags.authorize && process.env.NIMBLYBASE_TOKEN) {
+    throw new CliError(
+      "Choose browser consent or the supplied automation token.",
+      EXIT.usage,
+      "Unset NIMBLYBASE_TOKEN before requesting browser consent, or omit --authorize."
+    );
+  }
+}
+async function finishRepositorySetup(flags, project, linkedTo, base) {
+  const projectId = project.id;
+  if (!linkedTo) return { state: "not_linked", projectId };
+  if (process.env.NIMBLYBASE_TOKEN) return { state: "environment", projectId };
+  const command = `nimbly login --api ${base}`;
+  const interactive = process.stdin.isTTY === true && process.stderr.isTTY === true && !flags.json && !process.env.CI;
+  if (project.status !== "active" || !(flags.authorize ?? interactive)) {
+    note(`Project authorization is pending. After the project is active, run ${command} in this repository. Your workspace login was kept.`);
+    return { state: "pending", projectId, command };
+  }
+  note(`${project.slug} (${project.id}) is active and linked. Completing repository consent\u2026`);
+  try {
+    await authorizeRepository(await realpath3(dirname5(linkedTo)), projectId, base, flags.relink);
+  } catch {
+    throw new CliError(
+      `${project.slug} (${project.id}) exists and is linked, but project authorization was not completed.`,
+      EXIT.unauthenticated,
+      `Run ${command} here to retry consent. Do not create the project again. Your workspace login was kept.`
+    );
+  }
+  note("Project authorization saved separately for this repository. Your workspace login was kept.");
+  return { state: "authorized", projectId };
+}
+
 // src/commands/projects.ts
-import { resolve as resolve4 } from "node:path";
+import { resolve as resolve5 } from "node:path";
 var WAIT_TIMEOUT_MS = 18e4;
 var FIRST_POLL_MS = 500;
 var POLL_GROWTH = 1.5;
@@ -7689,6 +7844,7 @@ async function show(flags, ref) {
   ]);
 }
 async function create(flags, name) {
+  validateRepositorySetup(flags);
   if (!name) throw new CliError("A name is required.", EXIT.usage, 'nimbly create "My App"');
   const tier = flags.tier ?? "d1";
   if (tier !== "d1") {
@@ -7698,8 +7854,8 @@ async function create(flags, name) {
       "Use --tier d1."
     );
   }
-  const ctx = await context(flags.api);
-  const root = resolve4(flags.dir ?? ".");
+  const ctx = await context(flags.api, flags.dir);
+  const root = resolve5(flags.dir ?? ".");
   if (flags.link !== false) {
     await assertMayCreateLink(root, { relink: flags.relink });
   }
@@ -7712,23 +7868,27 @@ async function create(flags, name) {
     linkedTo = await writeLink(root, {
       projectId: final.id,
       slug: final.slug,
-      ...flags.api ? { apiUrl: flags.api } : {}
+      apiUrl: ctx.base,
+      authorization: "project"
     }, { relink: flags.relink });
   }
   await clearPendingBootstrap(root);
+  const authorization = await finishRepositorySetup(flags, final, linkedTo, ctx.base);
   if (isJsonMode()) {
-    json({ project: final, linkedTo });
+    json({ project: final, linkedTo, authorization });
     return;
   }
   out(`${paint("green", "\u2713")} ${final.slug} is ${statusPaint(final.status)}`);
   if (final.dataPlaneUrl) out(`  ${final.dataPlaneUrl}`);
   if (linkedTo) note(`Linked this directory (${linkedTo}).`);
+  if (authorization.state === "pending") return;
   if (final.status === "active") {
     note('Next: `nimbly keys create "local dev"` for a key your app can use.');
   }
   for (const line of AFTER_CREATE) note(paint("dim", `  ${line}`));
 }
 async function init(flags, name) {
+  validateRepositorySetup(flags);
   if (name && flags.project) {
     throw new CliError(
       "Choose an existing project or name a new one, not both.",
@@ -7750,13 +7910,30 @@ async function init(flags, name) {
       "Use --tier d1."
     );
   }
-  const ctx = await context(flags.api);
-  const root = resolve4(flags.dir ?? ".");
+  const ctx = await context(flags.api, flags.dir);
+  const root = resolve5(flags.dir ?? ".");
   const explicitProject = flags.project;
   const linkedProject = !name && !explicitProject ? (await findLink(root))?.projectId : void 0;
   if (name && flags.link !== false) {
     await assertMayCreateLink(root, { relink: flags.relink });
   }
+  if (ctx.credentialScope === "repository" && !name) {
+    const project = await resolveProject(ctx, explicitProject ?? linkedProject);
+    const backend = await ctx.client.describeProject(project.id);
+    if (isJsonMode()) {
+      json({
+        status: project.status === "active" ? "ready" : project.status,
+        project,
+        backend,
+        linkedTo: ctx.link?.path ?? null,
+        authorization: { state: "authorized", projectId: project.id }
+      });
+    } else {
+      out(`${paint("green", "\u2713")} ${project.slug} is ${statusPaint(project.status)}`);
+      note("This repository is already authorized. Next: nimbly describe.");
+    }
+    return;
+  }
   const pending = name ? await prepareCreation(ctx, flags, name, "init") : void 0;
   const request2 = {
     ...explicitProject || linkedProject ? { project: explicitProject ?? linkedProject } : {},
@@ -7821,16 +7998,19 @@ async function init(flags, name) {
   const linkedTo = flags.link === false ? null : await writeLink(root, {
     projectId: result.project.id,
     slug: result.project.slug,
-    ...flags.api ? { apiUrl: flags.api } : {}
+    apiUrl: ctx.base,
+    authorization: "project"
   }, { relink: flags.relink });
   if (pending) await clearPendingBootstrap(root);
+  const authorization = await finishRepositorySetup(flags, result.project, linkedTo, ctx.base);
   if (isJsonMode()) {
-    json({ ...result, linkedTo });
+    json({ ...result, linkedTo, authorization });
     return;
   }
   out(`${paint("green", "\u2713")} ${result.project.slug} is ${statusPaint(result.project.status)}`);
   if (result.project.dataPlaneUrl) out(`  ${result.project.dataPlaneUrl}`);
   if (linkedTo) note(`Linked this directory (${linkedTo}).`);
+  if (authorization.state === "pending") return;
   for (const action of result.nextActions) note(`Next: ${action.command} \u2014 ${action.description}`);
 }
 async function waitForActive(ctx, project) {
@@ -8025,11 +8205,11 @@ async function mcp(flags, which) {
 // src/commands/db.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
 import { readFile as readFile3, writeFile as writeFile3 } from "node:fs/promises";
-import { dirname as dirname3, isAbsolute, join as join4, resolve as resolve5 } from "node:path";
+import { dirname as dirname6, isAbsolute, join as join4, resolve as resolve6 } from "node:path";
 var DEFAULT_SCHEMA_FILE = "schema.json";
 function schemaPath(ctx, flag) {
-  if (flag) return isAbsolute(flag) ? flag : resolve5(process.cwd(), flag);
-  const base = ctx.link ? dirname3(ctx.link.path) : process.cwd();
+  if (flag) return isAbsolute(flag) ? flag : resolve6(process.cwd(), flag);
+  const base = ctx.link ? dirname6(ctx.link.path) : process.cwd();
   return join4(base, DEFAULT_SCHEMA_FILE);
 }
 async function readSchema(path) {
@@ -8539,7 +8719,7 @@ function render4(f) {
 
 // src/commands/functions.ts
 import { readFile as readFile5 } from "node:fs/promises";
-import { basename as basename2, dirname as dirname4, extname as extname2, resolve as resolve6 } from "node:path";
+import { basename as basename2, dirname as dirname7, extname as extname2, resolve as resolve7 } from "node:path";
 import { build as bundle } from "esbuild";
 var NAME = /^[a-z][a-z0-9-]{0,30}$/;
 var MAX_FUNCTION_BYTES = 1e6;
@@ -8620,10 +8800,10 @@ async function deploy(flags, file) {
   note(paint("dim", "  env.DB, env.FILES, env.KV are this project\u2019s own. Nothing else is reachable."));
 }
 async function bundleFunction(file) {
-  const absolute = resolve6(file);
+  const absolute = resolve7(file);
   try {
     const result = await bundle({
-      absWorkingDir: dirname4(absolute),
+      absWorkingDir: dirname7(absolute),
       entryPoints: [absolute],
       bundle: true,
       write: false,
@@ -9067,7 +9247,7 @@ function propertyName(name) {
 
 // src/commands/deploy.ts
 import { readdir as readdir2, readFile as readFile6, stat as stat4 } from "node:fs/promises";
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 import { spawn as spawn2 } from "node:child_process";
 import { join as join5, relative as relative2, sep } from "node:path";
 var SKIP = /* @__PURE__ */ new Set([".git", "node_modules", ".DS_Store", ".env", ".env.local", "Thumbs.db"]);
@@ -9238,7 +9418,7 @@ async function buildSite(root, script, display) {
   const entries = await readdir2(root);
   const runner = packageRunner(entries);
   if (!isJsonMode()) note(`Running ${runner.label} run ${script}\u2026`);
-  const code = await new Promise((resolve8, reject) => {
+  const code = await new Promise((resolve9, reject) => {
     const child = spawn2(runner.command, [...runner.args, "run", script], {
       cwd: root,
       stdio: "inherit",
@@ -9248,7 +9428,7 @@ async function buildSite(root, script, display) {
       shell: process.platform === "win32"
     });
     child.once("error", reject);
-    child.once("close", (status4) => resolve8(status4 ?? 1));
+    child.once("close", (status4) => resolve9(status4 ?? 1));
   }).catch((err) => {
     throw new CliError(
       `Could not start ${display ?? `${runner.label} run ${script}`}.`,
@@ -9308,7 +9488,7 @@ async function collect(dir) {
       found.push({
         path: toUrlPath(relative2(dir, absolute)),
         absolute,
-        hash: createHash3("sha256").update(await readFile6(absolute)).digest("hex"),
+        hash: createHash4("sha256").update(await readFile6(absolute)).digest("hex"),
         size: info.size
       });
     }
@@ -9778,7 +9958,7 @@ async function remove4(flags, name) {
 
 // src/commands/architect.ts
 import { readdir as readdir3, readFile as readFile8, stat as stat5 } from "node:fs/promises";
-import { join as join6, resolve as resolve7 } from "node:path";
+import { join as join6, resolve as resolve8 } from "node:path";
 var FEATURE_PATTERNS = {
   auth: /\b(auth(?:entication|enticated|orization|orized)?|log-?ins?|sign-?ins?|sign-?ups?|sessions?|user accounts?|passport|clerk|auth0)\b/i,
   storage: /\b(uploads?|attachments?|buckets?|object storage|file (?:uploads?|attachments?|storage)|s3|r2|multer|media)\b/i,
@@ -9792,7 +9972,7 @@ var FEATURE_PATTERNS = {
   crawler: /\b(crawls?|crawlers?|scrapes?|playwright|puppeteer|browser automation)\b/i
 };
 async function architect(flags, ...words) {
-  const root = resolve7(flags.dir ?? ".");
+  const root = resolve8(flags.dir ?? ".");
   const requirements = words.filter((word) => Boolean(word)).join(" ").trim();
   const ctx = await context(flags.api);
   if (!flags.project && !ctx.link) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nimblybase",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "description": "The NimblyBase command line - projects, keys and backends from a terminal.",
   "license": "UNLICENSED",
   "repository": {