nimblybase 0.1.8 → 0.1.10

package/README.md

@@ -100,6 +100,33 @@ credentials**. Commit it: a teammate cloning the repo gets the same target
 without being told a UUID. Commands run anywhere beneath it use that project
 unless you name another with `-p`.
 
+## Project consent after setup
+
+`nimbly init` and `nimbly create` link an active project, then open browser
+consent automatically in an interactive terminal. The verified project grant
+is stored separately for this repository; your workspace login stays available
+for creating another project in another directory. Approval remains your choice.
+
+For an AI terminal, use `--authorize` to wait for browser consent explicitly.
+For scripts, `--json`, `--no-authorize`, CI, and a terminal without interactive
+input leave consent pending instead of opening a browser. The JSON response has
+an `authorization` object with `state`, `projectId` and, when pending, a retry
+`command`. Run that command **inside the linked repository**. A pending link
+will not fall back to the wider workspace login.
+
+`--no-wait` leaves consent pending while provisioning. `--no-link` creates no
+repository login. An explicit `NIMBLYBASE_TOKEN` is reported as `environment`;
+its permissions are those of that token, with no browser grant created. It
+cannot be combined with `--authorize`.
+
+If approval is denied or fails, the project and link are retained. Retry
+`nimbly login` with the API printed by the CLI; do not recreate the project.
+A returning repository grant uses read endpoints for `nimbly init`, so it does
+not need workspace creation permission or another browser approval. Its JSON
+keeps the shared ready/provisioning/attention-required status and next actions;
+paused projects direct the agent to diagnosis, and default provisioning waits
+remain in effect.
+
 ## Scripting
 
 Every command takes `--json`. In JSON mode stdout carries the document and

package/dist/index.js

@@ -98,6 +98,7 @@ function parse(argv) {
         // SQL.
         param: { type: "string", multiple: true },
         "allow-destructive": { type: "boolean", default: false },
+        authorize: { type: "boolean" },
         wait: { type: "boolean", default: true },
         link: { type: "boolean", default: true },
         relink: { type: "boolean", default: false },
@@ -168,6 +169,7 @@ function parse(argv) {
       maxTokens: v["max-tokens"] === void 0 ? void 0 : Number(v["max-tokens"]),
       params: v.param,
       allowDestructive: v["allow-destructive"] === true,
+      authorize: v.authorize,
       wait: v.wait,
       link: v.link,
       relink: v.relink === true,
@@ -314,6 +316,8 @@ OPTIONS
   --level <info|warn|error>  Only logs at this level or worse
   --route </v1/sql>        Only logs for one route
   --no-wait                Do not wait for a new project to finish provisioning
+  --authorize              Open project consent after linking, including from an agent terminal
+  --no-authorize           Leave project consent pending; never use workspace login as fallback
   --no-link                Do not link the directory after creating a project
   --relink                 Explicitly replace this repository's project target
   --with-token             Include the live token in \`mcp\` output
@@ -374,7 +378,7 @@ function when(iso) {
 
 // src/api.ts
 var DEFAULT_API_URL = "https://api-uat.nimblybase.com";
-var VERSION = "0.1.8";
+var VERSION = "0.1.10";
 function dashboardUrl(api) {
   const match = /^https:\/\/api(-[a-z0-9]+)?\.(.+)$/.exec(api);
   return match ? `https://app${match[1] ?? ""}.${match[2]}` : null;
@@ -1267,8 +1271,8 @@ async function confirm(question) {
 // src/context.ts
 import { realpath } from "node:fs/promises";
 import { dirname as dirname3 } from "node:path";
-async function context(apiOverride) {
-  const link2 = await findLink();
+async function context(apiOverride, directory) {
+  const link2 = await findLink(directory);
   const repositoryStore = link2 ? repositoryCredentials(await realpath(dirname3(link2.path))) : void 0;
   const repositoryToken = await repositoryStore?.load();
   const useRepository = repositoryToken?.where !== "environment" && (Boolean(repositoryToken) || link2?.authorization === "project");
@@ -1362,6 +1366,36 @@ var WHERE_SAID = {
   file: `${credentialsPath()} (permissions 0600)`,
   environment: "the NIMBLYBASE_TOKEN environment variable"
 };
+async function saveBrowserLogin(grant, base, projectId, root, relink) {
+  const client = createClient(base, grant.accessToken);
+  const me = await client.me();
+  if (projectId && (me.authorization?.via !== "oauth" || me.authorization.projectId !== projectId)) {
+    throw new CliError(
+      "The server did not confirm this project restriction.",
+      EXIT.unauthenticated,
+      "Nothing was saved. Update the server/client and approve project access again."
+    );
+  }
+  if (projectId && root) {
+    const { project } = await client.project(projectId);
+    if (project.id !== projectId) throw new CliError("The authorized project response is invalid.", EXIT.unauthenticated);
+    await writeLink(root, { projectId, slug: project.slug, apiUrl: base, authorization: "project" }, { relink });
+  }
+  const store = root ? repositoryCredentials(root) : credentials;
+  const where = await store.saveGrant({ ...grant, issuer: base, ...projectId ? { projectId } : {} });
+  return { me, where };
+}
+async function authorizeRepository(root, projectId, base, relink) {
+  const canonical = await realpath2(root);
+  const grant = await browserLogin({
+    issuer: base,
+    projectId,
+    open: openBrowser,
+    announce: (url) => note(`Approve access to this project in your browser. If it did not open, go to:
+  ${url}`)
+  });
+  await saveBrowserLogin(grant, base, projectId, canonical, relink);
+}
 async function login(flags) {
   const base = apiUrl(flags.api);
   const link2 = await findLink(flags.dir);
@@ -1385,7 +1419,6 @@ async function login(flags) {
     "Use --relink to explicitly authorize and link a different project."
   );
   const root = projectId ? await realpath2(link2 ? dirname4(link2.path) : resolve2(flags.dir ?? ".")) : void 0;
-  const store = root ? repositoryCredentials(root) : credentials;
   const given = flags.token ?? await readPipedInput();
   if (projectId && (given || flags.tokenOnly)) throw new CliError(
     "A pasted token does not authorize a repository project.",
@@ -1412,21 +1445,7 @@ It expires in ${expiresInSeconds} seconds. Approve only the CLI request you star
       open: openBrowser,
       ...projectId ? { projectId } : {}
     });
-    const client = createClient(base, grant.accessToken);
-    const me2 = await client.me();
-    if (projectId && (me2.authorization?.via !== "oauth" || me2.authorization.projectId !== projectId)) {
-      throw new CliError(
-        "The server did not confirm this project restriction.",
-        EXIT.unauthenticated,
-        "Nothing was saved. Update the server/client and approve project access again."
-      );
-    }
-    if (projectId && root) {
-      const { project } = await client.project(projectId);
-      if (project.id !== projectId) throw new CliError("The authorized project response is invalid.", EXIT.unauthenticated);
-      await writeLink(root, { projectId, slug: project.slug, apiUrl: base, authorization: "project" }, { relink: flags.relink });
-    }
-    const where2 = await store.saveGrant({ ...grant, issuer: base, ...projectId ? { projectId } : {} });
+    const { me: me2, where: where2 } = await saveBrowserLogin(grant, base, projectId, root, flags.relink);
     if (isJsonMode()) {
       json({
         ok: true,
@@ -7737,6 +7756,45 @@ async function prepareCreation(ctx, flags, name, operation) {
   });
 }
 
+// src/repository-setup.ts
+import { realpath as realpath3 } from "node:fs/promises";
+import { dirname as dirname5 } from "node:path";
+function validateRepositorySetup(flags) {
+  if (flags.authorize && flags.link === false) {
+    throw new CliError("--authorize requires a linked repository.", EXIT.usage);
+  }
+  if (flags.authorize && process.env.NIMBLYBASE_TOKEN) {
+    throw new CliError(
+      "Choose browser consent or the supplied automation token.",
+      EXIT.usage,
+      "Unset NIMBLYBASE_TOKEN before requesting browser consent, or omit --authorize."
+    );
+  }
+}
+async function finishRepositorySetup(flags, project, linkedTo, base) {
+  const projectId = project.id;
+  if (!linkedTo) return { state: "not_linked", projectId };
+  if (process.env.NIMBLYBASE_TOKEN) return { state: "environment", projectId };
+  const command = `nimbly login --api ${base}`;
+  const interactive = process.stdin.isTTY === true && process.stderr.isTTY === true && !flags.json && !process.env.CI;
+  if (project.status !== "active" || !(flags.authorize ?? interactive)) {
+    note(`Project authorization is pending. After the project is active, run ${command} in this repository. Your workspace login was kept.`);
+    return { state: "pending", projectId, command };
+  }
+  note(`${project.slug} (${project.id}) is active and linked. Completing repository consent\u2026`);
+  try {
+    await authorizeRepository(await realpath3(dirname5(linkedTo)), projectId, base, flags.relink);
+  } catch {
+    throw new CliError(
+      `${project.slug} (${project.id}) exists and is linked, but project authorization was not completed.`,
+      EXIT.unauthenticated,
+      `Run ${command} here to retry consent. Do not create the project again. Your workspace login was kept.`
+    );
+  }
+  note("Project authorization saved separately for this repository. Your workspace login was kept.");
+  return { state: "authorized", projectId };
+}
+
 // src/commands/projects.ts
 import { resolve as resolve5 } from "node:path";
 var WAIT_TIMEOUT_MS = 18e4;
@@ -7786,6 +7844,7 @@ async function show(flags, ref) {
   ]);
 }
 async function create(flags, name) {
+  validateRepositorySetup(flags);
   if (!name) throw new CliError("A name is required.", EXIT.usage, 'nimbly create "My App"');
   const tier = flags.tier ?? "d1";
   if (tier !== "d1") {
@@ -7795,7 +7854,7 @@ async function create(flags, name) {
       "Use --tier d1."
     );
   }
-  const ctx = await context(flags.api);
+  const ctx = await context(flags.api, flags.dir);
   const root = resolve5(flags.dir ?? ".");
   if (flags.link !== false) {
     await assertMayCreateLink(root, { relink: flags.relink });
@@ -7809,23 +7868,27 @@ async function create(flags, name) {
     linkedTo = await writeLink(root, {
       projectId: final.id,
       slug: final.slug,
-      ...flags.api ? { apiUrl: flags.api } : {}
+      apiUrl: ctx.base,
+      authorization: "project"
     }, { relink: flags.relink });
   }
   await clearPendingBootstrap(root);
+  const authorization = await finishRepositorySetup(flags, final, linkedTo, ctx.base);
   if (isJsonMode()) {
-    json({ project: final, linkedTo });
+    json({ project: final, linkedTo, authorization });
     return;
   }
   out(`${paint("green", "\u2713")} ${final.slug} is ${statusPaint(final.status)}`);
   if (final.dataPlaneUrl) out(`  ${final.dataPlaneUrl}`);
   if (linkedTo) note(`Linked this directory (${linkedTo}).`);
+  if (authorization.state === "pending") return;
   if (final.status === "active") {
     note('Next: `nimbly keys create "local dev"` for a key your app can use.');
   }
   for (const line of AFTER_CREATE) note(paint("dim", `  ${line}`));
 }
 async function init(flags, name) {
+  validateRepositorySetup(flags);
   if (name && flags.project) {
     throw new CliError(
       "Choose an existing project or name a new one, not both.",
@@ -7847,13 +7910,35 @@ async function init(flags, name) {
       "Use --tier d1."
     );
   }
-  const ctx = await context(flags.api);
+  const ctx = await context(flags.api, flags.dir);
   const root = resolve5(flags.dir ?? ".");
   const explicitProject = flags.project;
   const linkedProject = !name && !explicitProject ? (await findLink(root))?.projectId : void 0;
   if (name && flags.link !== false) {
     await assertMayCreateLink(root, { relink: flags.relink });
   }
+  if (ctx.credentialScope === "repository" && !name) {
+    const initial = await resolveProject(ctx, explicitProject ?? linkedProject);
+    const project = flags.wait === false ? initial : await waitForActive(ctx, initial);
+    const backend = await ctx.client.describeProject(project.id);
+    const status4 = project.status === "active" ? "ready" : project.status === "provisioning" ? "provisioning" : "attention_required";
+    const result2 = { status: status4, project, backend, nextActions: status4 === "ready" ? [
+      { code: "inspect_backend", command: "nimbly describe", description: "Inspect available services before designing the backend." },
+      { code: "plan_schema", command: "nimbly db status", description: "Inspect the schema before applying changes." }
+    ] : status4 === "provisioning" ? [
+      { code: "wait_for_project", command: `nimbly project ${project.slug}`, description: "Wait for the project to become active." }
+    ] : [
+      { code: "diagnose_project", command: `nimbly diagnose ${project.slug}`, description: `The project is ${project.status}; inspect before using it.` }
+    ] };
+    if (isJsonMode()) {
+      json({ ...result2, linkedTo: ctx.link?.path ?? null, authorization: { state: "authorized", projectId: project.id } });
+    } else {
+      out(`${paint("green", "\u2713")} ${project.slug} is ${statusPaint(project.status)}`);
+      note("This repository is already authorized.");
+      for (const action of result2.nextActions) note(`Next: ${action.command} \u2014 ${action.description}`);
+    }
+    return;
+  }
   const pending = name ? await prepareCreation(ctx, flags, name, "init") : void 0;
   const request2 = {
     ...explicitProject || linkedProject ? { project: explicitProject ?? linkedProject } : {},
@@ -7918,16 +8003,19 @@ async function init(flags, name) {
   const linkedTo = flags.link === false ? null : await writeLink(root, {
     projectId: result.project.id,
     slug: result.project.slug,
-    ...flags.api ? { apiUrl: flags.api } : {}
+    apiUrl: ctx.base,
+    authorization: "project"
   }, { relink: flags.relink });
   if (pending) await clearPendingBootstrap(root);
+  const authorization = await finishRepositorySetup(flags, result.project, linkedTo, ctx.base);
   if (isJsonMode()) {
-    json({ ...result, linkedTo });
+    json({ ...result, linkedTo, authorization });
     return;
   }
   out(`${paint("green", "\u2713")} ${result.project.slug} is ${statusPaint(result.project.status)}`);
   if (result.project.dataPlaneUrl) out(`  ${result.project.dataPlaneUrl}`);
   if (linkedTo) note(`Linked this directory (${linkedTo}).`);
+  if (authorization.state === "pending") return;
   for (const action of result.nextActions) note(`Next: ${action.command} \u2014 ${action.description}`);
 }
 async function waitForActive(ctx, project) {
@@ -8122,11 +8210,11 @@ async function mcp(flags, which) {
 // src/commands/db.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
 import { readFile as readFile3, writeFile as writeFile3 } from "node:fs/promises";
-import { dirname as dirname5, isAbsolute, join as join4, resolve as resolve6 } from "node:path";
+import { dirname as dirname6, isAbsolute, join as join4, resolve as resolve6 } from "node:path";
 var DEFAULT_SCHEMA_FILE = "schema.json";
 function schemaPath(ctx, flag) {
   if (flag) return isAbsolute(flag) ? flag : resolve6(process.cwd(), flag);
-  const base = ctx.link ? dirname5(ctx.link.path) : process.cwd();
+  const base = ctx.link ? dirname6(ctx.link.path) : process.cwd();
   return join4(base, DEFAULT_SCHEMA_FILE);
 }
 async function readSchema(path) {
@@ -8636,7 +8724,7 @@ function render4(f) {
 
 // src/commands/functions.ts
 import { readFile as readFile5 } from "node:fs/promises";
-import { basename as basename2, dirname as dirname6, extname as extname2, resolve as resolve7 } from "node:path";
+import { basename as basename2, dirname as dirname7, extname as extname2, resolve as resolve7 } from "node:path";
 import { build as bundle } from "esbuild";
 var NAME = /^[a-z][a-z0-9-]{0,30}$/;
 var MAX_FUNCTION_BYTES = 1e6;
@@ -8720,7 +8808,7 @@ async function bundleFunction(file) {
   const absolute = resolve7(file);
   try {
     const result = await bundle({
-      absWorkingDir: dirname6(absolute),
+      absWorkingDir: dirname7(absolute),
       entryPoints: [absolute],
       bundle: true,
       write: false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nimblybase",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "description": "The NimblyBase command line - projects, keys and backends from a terminal.",
   "license": "UNLICENSED",
   "repository": {