tileflow 0.1.0-alpha.4 → 0.1.0-alpha.5

package/README.md

@@ -592,7 +592,7 @@ An explicit key or `TILEFLOW_API_KEY` never uses the saved account session. The
 `--map-id` that does not match the key. Read-only hosted icon comparison validates the same binding
 before loading its baseline.
 
-The CI key grants only `styles:write` and `status:read`. It cannot upload
+A deploy-only key grants `styles:write` and `status:read`. Without additional permissions it cannot upload
 datasets or render images. Give it an expiration, rotate the repository secret
 before it expires, and avoid non-expiring CI keys.
 
@@ -795,3 +795,12 @@ GitHub Action, an atomic multi-map deploy set, or a Tileflow-hosted remote
 builder.
 
 Docs: https://tileflow.dev/docs/deploy
+
+### Team credentials and explicit Map targets
+
+A unified Team credential can combine data and Map operations. Use `TILEFLOW_API_KEY` and an
+explicit `--map-id` for deployment, status and hosted icon comparisons. The CLI sends that target
+with style, icon and font requests and verifies the credential covers it. The Hosted API must
+support unified credentials. All Maps includes future Maps; selected Maps is an explicit list.
+A legacy Map key keeps its original binding. Personal CLI login remains separate from machine
+credentials. Credential administration and Team management use the Hosted API or dashboard.

package/dist/index.js

@@ -2301,6 +2301,10 @@ async function readBoundedResponseText(response, label) {
 // src/hosted-client.ts
 var defaultHostedRequestTimeoutMs = 3e4;
 var maximumHostedRequestTimeoutMs = 6e4;
+function apiProfileCanTargetMap(profile, mapId) {
+  if (!/^map_[A-Za-z0-9_-]{16}$/u.test(mapId)) return false;
+  return profile.credentialType === "project_api_key" ? profile.mapId === mapId : profile.mapAccess?.mode === "all" || profile.mapAccess?.mode === "selected" && profile.mapAccess.ids.includes(mapId);
+}
 async function requestHostedJson(apiUrl, path, init = {}, options = {}) {
   return withHostedResponse(apiUrl, path, init, options, async (response) => {
     const source = await readBoundedResponseText(response, "Hosted API");
@@ -2397,6 +2401,28 @@ async function validateApiKey(apiUrl, apiKey, options = {}) {
     return { error: `API key validation failed (${response.status}).`, ok: false };
   }
   const body = asRecord(response.body);
+  if (response.json && body.credentialType === "team_api_key") {
+    const mapAccess = asRecord(body.mapAccess);
+    const validMaps = body.mapAccess === null || mapAccess.mode === "all" && Object.keys(mapAccess).length === 1 || mapAccess.mode === "selected" && Object.keys(mapAccess).length === 2 && Array.isArray(mapAccess.ids) && mapAccess.ids.length > 0 && mapAccess.ids.length <= 1e3 && mapAccess.ids.every(
+      (id) => typeof id === "string" && /^map_[A-Za-z0-9_-]{16}$/u.test(id)
+    ) && new Set(mapAccess.ids).size === mapAccess.ids.length;
+    if (typeof body.apiKeyId !== "string" || !isProjectIdentity(body.organization) || body.project !== null || body.projectId !== null || body.mapId !== null || !validMaps || !Array.isArray(body.scopes) || !body.scopes.every((scope) => typeof scope === "string")) {
+      return { error: "API key validation returned an invalid response.", ok: false };
+    }
+    return {
+      ok: true,
+      value: {
+        apiKeyId: body.apiKeyId,
+        credentialType: "team_api_key",
+        organization: body.organization,
+        mapId: null,
+        project: null,
+        projectId: null,
+        scopes: body.scopes,
+        mapAccess: body.mapAccess === null ? null : mapAccess.mode === "all" ? { mode: "all" } : { mode: "selected", ids: mapAccess.ids }
+      }
+    };
+  }
   if (!response.json || typeof body.apiKeyId !== "string" || body.credentialType !== "project_api_key" || typeof body.mapId !== "string" || !/^map_[A-Za-z0-9_-]{16}$/u.test(body.mapId) || !isProjectIdentity(body.organization) || !isProjectIdentity(body.project) || typeof body.projectId !== "string" || body.projectId !== body.project.id || !Array.isArray(body.scopes)) {
     return { error: "API key validation returned an invalid response.", ok: false };
   }
@@ -2526,7 +2552,7 @@ async function publishHostedStyle(api, body, responseLabel, options = {}) {
     "/v1/styles",
     {
       ...jsonRequest("POST", body),
-      headers: { ...authorizationHeaders(api.apiKey), "Content-Type": "application/json" }
+      headers: { ...authorizationHeaders(api.apiKey, api.mapId), "Content-Type": "application/json" }
     },
     options
   );
@@ -2554,7 +2580,7 @@ async function uploadHostedIconPackage(api, iconPackage, options = {}) {
   const response = await requestHostedJson(
     api.apiUrl,
     `/v1/icon-packages/${encodeURIComponent(iconPackage.contentHash)}`,
-    { body: formData, headers: authorizationHeaders(api.apiKey), method: "PUT" },
+    { body: formData, headers: authorizationHeaders(api.apiKey, api.mapId), method: "PUT" },
     options
   );
   if (!response.ok) return { ok: false, status: response.status };
@@ -2591,7 +2617,7 @@ async function uploadHostedFontBundle(api, bundle, options = {}) {
   const response = await requestHostedJson(
     api.apiUrl,
     `/v1/font-bundles/${encodeURIComponent(bundle.contentHash)}`,
-    { body: formData, headers: authorizationHeaders(api.apiKey), method: "PUT" },
+    { body: formData, headers: authorizationHeaders(api.apiKey, api.mapId), method: "PUT" },
     options
   );
   if (!response.ok) return { ok: false, status: response.status };
@@ -2610,7 +2636,7 @@ async function fetchHostedMapStatus(api, options = {}) {
   const response = await requestHostedJson(
     api.apiUrl,
     "/v1/status",
-    { headers: authorizationHeaders(api.apiKey) },
+    { headers: authorizationHeaders(api.apiKey, api.mapId) },
     options
   );
   if (!response.ok) throw new Error(`Status failed: ${response.status}.`);
@@ -2707,11 +2733,16 @@ function jsonRequest(method, body) {
     method
   };
 }
-function authorizationHeaders(token) {
+function authorizationHeaders(token, mapId) {
   if (!token || token.length > 8192 || /[\p{Cc}]/u.test(token)) {
     throw new TypeError("Hosted authorization credential is invalid.");
   }
-  return { Authorization: `Bearer ${token}` };
+  if (mapId !== void 0 && !/^map_[A-Za-z0-9_-]{16}$/u.test(mapId))
+    throw new TypeError("Hosted Map ID is invalid.");
+  return {
+    Authorization: `Bearer ${token}`,
+    ...mapId === void 0 ? {} : { "X-Tileflow-Map-Id": mapId }
+  };
 }
 function parseResponse(response, schema, label) {
   if (!response.json) throw new Error(`${label} returned invalid JSON.`);
@@ -3453,7 +3484,7 @@ async function runIconDiff(options, dependencies) {
   });
   const binding = compiled.bindings.find((candidate) => candidate.mapName === environment);
   const proposedPackage = binding ? compiled.packages.find((candidate) => candidate.contentHash === binding.packageHash) ?? null : null;
-  const baseline = await readBaseline(api, environment);
+  const baseline = await readBaseline({ ...api, mapId: options.mapId }, environment);
   const beforeManifest = baseline.baseline?.package?.manifest ?? null;
   const iconDiff = diffTileflowIconPackageManifests(
     beforeManifest,
@@ -3511,7 +3542,7 @@ async function readBaseline(api, environment) {
   const response = await requestHostedJson(
     api.apiUrl,
     `/v1/icon-packages/baseline/${encodeURIComponent(environment)}`,
-    { headers: { Authorization: `Bearer ${api.apiKey}` } }
+    { headers: { Authorization: `Bearer ${api.apiKey}`, "X-Tileflow-Map-Id": api.mapId } }
   );
   if (!response.ok) {
     throw new Error(`Icon diff baseline failed: ${response.status}.`);
@@ -8120,7 +8151,7 @@ async function requireApiOptions(options, behavior = {}) {
         process.exitCode = 1;
         return null;
       }
-      if (profile.value.mapId !== requestedMapId) {
+      if (!apiProfileCanTargetMap(profile.value, requestedMapId)) {
         if (!behavior.silent) logError("This API key belongs to another Map.");
         process.exitCode = 1;
         return null;
@@ -8133,6 +8164,11 @@ async function requireApiOptions(options, behavior = {}) {
         process.exitCode = 1;
         return null;
       }
+      if (profile.value.credentialType === "team_api_key") {
+        if (!behavior.silent) logError("Team credentials require an explicit --map-id.");
+        process.exitCode = 1;
+        return null;
+      }
       if (requested && projectReference(profile.value) !== options.project) {
         if (!behavior.silent) {
           logError(
@@ -8152,7 +8188,7 @@ async function requireApiOptions(options, behavior = {}) {
   const allowStoredCredential = behavior.allowStoredCredential !== false && allowsStoredDeployCredential(resolveDeploySource(process.env));
   if (!allowStoredCredential) {
     if (!behavior.silent) {
-      logError("CI requires an explicit Map-scoped Tileflow API key.");
+      logError("CI requires an explicit Tileflow credential with access to the target Map.");
       printNextSteps([
         `Set ${pc3.cyan("TILEFLOW_API_KEY")} from the CI secret store.`,
         "The saved personal account session is never used in CI."

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tileflow",
-  "version": "0.1.0-alpha.4",
+  "version": "0.1.0-alpha.5",
   "license": "Apache-2.0",
   "description": "CLI-only tools for Tileflow config, capture, visual testing, and deploy.",
   "type": "module",
@@ -37,7 +37,7 @@
     "@hono/node-server": "2.0.10",
     "@tileflow/capture": ">=0.1.0-alpha.22 <0.1.0-beta.0",
     "@tileflow/coordinates": ">=0.1.0-alpha.0 <0.1.0-beta.0",
-    "@tileflow/coordinates-runtime": ">=0.1.0-alpha.1 <0.1.0-beta.0",
+    "@tileflow/coordinates-runtime": ">=0.1.0-alpha.2 <0.1.0-beta.0",
     "@tileflow/core": ">=0.1.0-alpha.24 <0.1.0-beta.0",
     "@tileflow/dev": ">=0.1.0-alpha.23 <0.1.0-beta.0",
     "@tileflow/maps": ">=0.1.0-alpha.3 <0.1.0-beta.0",