ugly-app 0.1.987 → 0.1.988

package/dist/cli/probeAuth.d.ts

@@ -40,5 +40,18 @@ export interface ProbeAuthResult {
  *                 since some service tokens are intentionally non-expiring
  */
 export declare function inspectJwt(token: string): 'valid' | 'expired' | 'unknown';
+/**
+ * The account a token acts as, read from its `sub` claim without verifying the
+ * signature (it's our own token — we only need to know whose it is).
+ *
+ * This is the check that would have caught the worst auth failure this tool has
+ * had: a project token minted while a FAKE login was in place carries a phantom
+ * subject (`e2e-auth-user`, `e2e-user`, …) that is not a ugly.bot account at
+ * all. The token verifies, `dev` works, tests appear to sign in — and then every
+ * billable call for that project 402s, or worse, test accounts get created
+ * pointing at an account that cannot pay. Nothing in the failure names the
+ * token, so it has cost hours more than once.
+ */
+export declare function jwtSubject(token: string): string | null;
 export declare function probeAuth(input: ProbeAuthInput): ProbeAuthResult;
 //# sourceMappingURL=probeAuth.d.ts.map

package/dist/cli/probeAuth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"probeAuth.d.ts","sourceRoot":"","sources":["../../src/cli/probeAuth.ts"],"names":[],"mappings":"AAoBA,MAAM,MAAM,UAAU,GAAG,IAAI,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;AAE1D,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,uEAAuE;IACvE,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,iEAAiE;IACjE,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,yCAAyC;IACzC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB;;;;;;OAMG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB,mDAAmD;IACnD,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC;AAyBD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,CAazE;AAyCD,wBAAgB,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,eAAe,CAqLhE"}
+{"version":3,"file":"probeAuth.d.ts","sourceRoot":"","sources":["../../src/cli/probeAuth.ts"],"names":[],"mappings":"AAoBA,MAAM,MAAM,UAAU,GAAG,IAAI,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;AAE1D,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,uEAAuE;IACvE,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,iEAAiE;IACjE,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,yCAAyC;IACzC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB;;;;;;OAMG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB,mDAAmD;IACnD,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC;AAyBD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,CAazE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAWvD;AAyCD,wBAAgB,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,eAAe,CA+MhE"}

package/dist/cli/probeAuth.js

@@ -57,6 +57,30 @@ export function inspectJwt(token) {
         return 'unknown';
     }
 }
+/**
+ * The account a token acts as, read from its `sub` claim without verifying the
+ * signature (it's our own token — we only need to know whose it is).
+ *
+ * This is the check that would have caught the worst auth failure this tool has
+ * had: a project token minted while a FAKE login was in place carries a phantom
+ * subject (`e2e-auth-user`, `e2e-user`, …) that is not a ugly.bot account at
+ * all. The token verifies, `dev` works, tests appear to sign in — and then every
+ * billable call for that project 402s, or worse, test accounts get created
+ * pointing at an account that cannot pay. Nothing in the failure names the
+ * token, so it has cost hours more than once.
+ */
+export function jwtSubject(token) {
+    const parts = token.split('.');
+    if (parts.length !== 3)
+        return null;
+    try {
+        const payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf-8'));
+        return typeof payload.sub === 'string' && payload.sub ? payload.sub : null;
+    }
+    catch {
+        return null;
+    }
+}
 function readGlobalAuth(homeDir) {
     const file = path.join(homeDir, '.ugly-bot', 'auth.json');
     const { data, malformed } = readJson(file);
@@ -219,6 +243,31 @@ export function probeAuth(input) {
             });
         }
     }
+    // 2b. Does each project token actually act as YOU?
+    //
+    // A project token whose `sub` isn't your account is not a smaller problem
+    // than a missing one — it is a token that works everywhere except where it
+    // matters. `auth:create-bot` bills test accounts to that subject, so a
+    // phantom one produces exactly the symptom that started all this: accounts
+    // that look fine and can't spend.
+    if (projectId && globalAuth) {
+        for (const [label, token, file] of [
+            ['auth (cloud)', cloudToken, `${projectId}.json`],
+            ['auth (local)', localToken, `${projectId}.local.json`],
+        ]) {
+            if (!token)
+                continue;
+            const sub = jwtSubject(token);
+            if (!sub || sub === globalAuth.userId)
+                continue;
+            lines.push({
+                status: 'error',
+                label,
+                detail: `token acts as "${sub}", not you (${globalAuth.userId}) — test accounts made with it bill an account you don't own`,
+            });
+            nextSteps.push(`Delete ~/.ugly-bot/${file} and re-run \`npx ugly-app dev\` (or \`login\`) to re-mint it as ${globalAuth.userId}`);
+        }
+    }
     // 3. Agent-ready summary.
     // For headless tooling, the global user token is what unblocks
     // everything: project tokens are derived. If we're in local mode we

package/dist/cli/probeAuth.js.map

@@ -1 +1 @@
-{"version":3,"file":"probeAuth.js","sourceRoot":"","sources":["../../src/cli/probeAuth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AA8C7B,SAAS,QAAQ,CAAC,QAAgB;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;YAC1D,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACzC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YAC5C,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACzC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC1C,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,CAAC;QACH,mEAAmE;QACnE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAClC,CAAC;QACtB,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACtD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,OAAO,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAQD,SAAS,cAAc,CAAC,OAAe;IAIrC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;IAC1D,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC5C,IACE,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;QAC9B,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;QAC/B,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,EAClC,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACzC,CAAC;IACD,OAAO;QACL,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;QAC3E,SAAS,EAAE,KAAK;KACjB,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,OAAe,EACf,SAAiB,EACjB,IAAuB;IAEvB,MAAM,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC;IAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,SAAS,GAAG,MAAM,EAAE,CAAC,CAAC;IACtE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7C,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC5E,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAqB;IAC7C,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC9C,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAa,EAAE,CAAC;IAE/B,mDAAmD;IACnD,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,eAAe,EAAE,GACpD,cAAc,CAAC,OAAO,CAAC,CAAC;IAC1B,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,KAAK,CAAC,IAAI,CAAC;gBACT,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,aAAa;gBACpB,MAAM,EAAE,yBAAyB,UAAU,CAAC,MAAM,GAAG;aACtD,CAAC,CAAC;YACH,SAAS,CAAC,IAAI,CACZ,4DAA4D,CAC7D,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,WAAW,GAAG,IAAI,CAAC;YACnB,KAAK,CAAC,IAAI,CAAC;gBACT,MAAM,EAAE,IAAI;gBACZ,KAAK,EAAE,aAAa;gBACpB,MAAM,EAAE,gBAAgB,UAAU,CAAC,MAAM,KAAK,UAAU,CAAC,SAAS,GAAG;aACtE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;SAAM,IAAI,eAAe,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC;YACT,MAAM,EAAE,OAAO;YACf,KAAK,EAAE,aAAa;YACpB,MAAM,EAAE,+DAA+D;SACxE,CAAC,CAAC;QACH,SAAS,CAAC,IAAI,CACZ,8DAA8D,CAC/D,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC;YACT,MAAM,EAAE,OAAO;YACf,KAAK,EAAE,aAAa;YACpB,MAAM,EAAE,0CAA0C;SACnD,CAAC,CAAC;QACH,SAAS,CAAC,IAAI,CACZ,8GAA8G,CAC/G,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,IAAI,UAAU,GAAkB,IAAI,CAAC;IACrC,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,UAAU,GAAkB,IAAI,CAAC;IACrC,IAAI,YAAY,GAAG,KAAK,CAAC;IAEzB,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAE5D,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,YAAY,GAAG,IAAI,CAAC;gBACpB,KAAK,CAAC,IAAI,CAAC;oBACT,MAAM,EAAE,MAAM;oBACd,KAAK,EAAE,cAAc;oBACrB,MAAM,EAAE,iCAAiC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI;iBACrE,CAAC,CAAC;gBACH,IAAI,CAAC,OAAO,IAAI,WAAW,EAAE,CAAC;oBAC5B,SAAS,CAAC,IAAI,CACZ,iFAAiF,CAClF,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC;gBACzB,KAAK,CAAC,IAAI,CAAC;oBACT,MAAM,EAAE,IAAI;oBACZ,KAAK,EAAE,cAAc;oBACrB,MAAM,EAAE,0BAA0B,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI;iBAC9D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YAC3B,KAAK,CAAC,IAAI,CAAC;gBACT,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,cAAc;gBACrB,MAAM,EAAE,eAAe,SAAS,oBAAoB;aACrD,CAAC,CAAC;YACH,SAAS,CAAC,IAAI,CACZ,sBAAsB,SAAS,kDAAkD,CAClF,CAAC;QACJ,CAAC;aAAM,IAAI,WAAW,IAAI,CAAC,OAAO,EAAE,CAAC;YACnC,2EAA2E;YAC3E,KAAK,CAAC,IAAI,CAAC;gBACT,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,cAAc;gBACrB,MAAM,EACJ,uEAAuE;aAC1E,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC;gBACT,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;gBACjC,KAAK,EAAE,cAAc;gBACrB,MAAM,EAAE,qCAAqC;aAC9C,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC7B,4EAA4E;YAC9E,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,YAAY,GAAG,IAAI,CAAC;gBACpB,KAAK,CAAC,IAAI,CAAC;oBACT,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;oBACjC,KAAK,EAAE,cAAc;oBACrB,MAAM,EAAE,+BAA+B,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI;iBACnE,CAAC,CAAC;gBACH,IAAI,OAAO,EAAE,CAAC;oBACZ,SAAS,CAAC,IAAI,CACZ,iFAAiF,CAClF,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC;gBACzB,KAAK,CAAC,IAAI,CAAC;oBACT,MAAM,EAAE,IAAI;oBACZ,KAAK,EAAE,cAAc;oBACrB,MAAM,EAAE,gCAAgC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI;iBACpE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YAC3B,KAAK,CAAC,IAAI,CAAC;gBACT,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,cAAc;gBACrB,MAAM,EAAE,eAAe,SAAS,0BAA0B;aAC3D,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC;gBACT,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM;gBAC1D,KAAK,EAAE,cAAc;gBACrB,MAAM,EACJ,OAAO,IAAI,WAAW;oBACpB,CAAC,CAAC,mEAAmE;oBACrE,CAAC,CAAC,yBAAyB;aAChC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,0BAA0B;IAC1B,+DAA+D;IAC/D,oEAAoE;IACpE,iEAAiE;IACjE,kBAAkB;IAClB,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,kBAAsC,CAAC;IAC3C,IAAI,UAA8B,CAAC;IAEnC,MAAM,SAAS,GAAG,UAAU,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,MAAM,SAAS,GAAG,UAAU,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;IAElE,IAAI,WAAW,EAAE,CAAC;QAChB,UAAU,GAAG,IAAI,CAAC;QAClB,UAAU,GAAG,OAAO;YAClB,CAAC,CAAC,CAAC,SAAS,IAAI,UAAU,EAAE,KAAK,CAAC;YAClC,CAAC,CAAC,CAAC,SAAS,IAAI,UAAU,EAAE,KAAK,CAAC,CAAC;IACvC,CAAC;SAAM,IAAI,SAAS,IAAI,SAAS,EAAE,CAAC;QAClC,iEAAiE;QACjE,iEAAiE;QACjE,sBAAsB;QACtB,UAAU,GAAG,IAAI,CAAC;QAClB,UAAU,GAAG,OAAO;YAClB,CAAC,CAAC,CAAC,SAAS,IAAI,SAAS,IAAI,SAAS,CAAC;YACvC,CAAC,CAAC,CAAC,SAAS,IAAI,SAAS,IAAI,SAAS,CAAC,CAAC;IAC5C,CAAC;SAAM,CAAC;QACN,UAAU,GAAG,KAAK,CAAC;QACnB,kBAAkB,GAAG,UAAU;YAC7B,CAAC,CAAC,sDAAsD;YACxD,CAAC,CAAC,sDAAsD,CAAC;IAC7D,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,kBAAkB,EAAE,UAAU,EAAE,CAAC;AAC1E,CAAC"}
+{"version":3,"file":"probeAuth.js","sourceRoot":"","sources":["../../src/cli/probeAuth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AA8C7B,SAAS,QAAQ,CAAC,QAAgB;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;YAC1D,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACzC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YAC5C,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACzC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC1C,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,CAAC;QACH,mEAAmE;QACnE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAClC,CAAC;QACtB,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACtD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,OAAO,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CACjC,CAAC;QACvB,OAAO,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAQD,SAAS,cAAc,CAAC,OAAe;IAIrC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;IAC1D,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC5C,IACE,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;QAC9B,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;QAC/B,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,EAClC,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACzC,CAAC;IACD,OAAO;QACL,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;QAC3E,SAAS,EAAE,KAAK;KACjB,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,OAAe,EACf,SAAiB,EACjB,IAAuB;IAEvB,MAAM,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC;IAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,SAAS,GAAG,MAAM,EAAE,CAAC,CAAC;IACtE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7C,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC5E,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAqB;IAC7C,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC9C,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAa,EAAE,CAAC;IAE/B,mDAAmD;IACnD,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,eAAe,EAAE,GACpD,cAAc,CAAC,OAAO,CAAC,CAAC;IAC1B,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,KAAK,CAAC,IAAI,CAAC;gBACT,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,aAAa;gBACpB,MAAM,EAAE,yBAAyB,UAAU,CAAC,MAAM,GAAG;aACtD,CAAC,CAAC;YACH,SAAS,CAAC,IAAI,CACZ,4DAA4D,CAC7D,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,WAAW,GAAG,IAAI,CAAC;YACnB,KAAK,CAAC,IAAI,CAAC;gBACT,MAAM,EAAE,IAAI;gBACZ,KAAK,EAAE,aAAa;gBACpB,MAAM,EAAE,gBAAgB,UAAU,CAAC,MAAM,KAAK,UAAU,CAAC,SAAS,GAAG;aACtE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;SAAM,IAAI,eAAe,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC;YACT,MAAM,EAAE,OAAO;YACf,KAAK,EAAE,aAAa;YACpB,MAAM,EAAE,+DAA+D;SACxE,CAAC,CAAC;QACH,SAAS,CAAC,IAAI,CACZ,8DAA8D,CAC/D,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC;YACT,MAAM,EAAE,OAAO;YACf,KAAK,EAAE,aAAa;YACpB,MAAM,EAAE,0CAA0C;SACnD,CAAC,CAAC;QACH,SAAS,CAAC,IAAI,CACZ,8GAA8G,CAC/G,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,IAAI,UAAU,GAAkB,IAAI,CAAC;IACrC,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,UAAU,GAAkB,IAAI,CAAC;IACrC,IAAI,YAAY,GAAG,KAAK,CAAC;IAEzB,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAE5D,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,YAAY,GAAG,IAAI,CAAC;gBACpB,KAAK,CAAC,IAAI,CAAC;oBACT,MAAM,EAAE,MAAM;oBACd,KAAK,EAAE,cAAc;oBACrB,MAAM,EAAE,iCAAiC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI;iBACrE,CAAC,CAAC;gBACH,IAAI,CAAC,OAAO,IAAI,WAAW,EAAE,CAAC;oBAC5B,SAAS,CAAC,IAAI,CACZ,iFAAiF,CAClF,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC;gBACzB,KAAK,CAAC,IAAI,CAAC;oBACT,MAAM,EAAE,IAAI;oBACZ,KAAK,EAAE,cAAc;oBACrB,MAAM,EAAE,0BAA0B,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI;iBAC9D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YAC3B,KAAK,CAAC,IAAI,CAAC;gBACT,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,cAAc;gBACrB,MAAM,EAAE,eAAe,SAAS,oBAAoB;aACrD,CAAC,CAAC;YACH,SAAS,CAAC,IAAI,CACZ,sBAAsB,SAAS,kDAAkD,CAClF,CAAC;QACJ,CAAC;aAAM,IAAI,WAAW,IAAI,CAAC,OAAO,EAAE,CAAC;YACnC,2EAA2E;YAC3E,KAAK,CAAC,IAAI,CAAC;gBACT,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,cAAc;gBACrB,MAAM,EACJ,uEAAuE;aAC1E,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC;gBACT,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;gBACjC,KAAK,EAAE,cAAc;gBACrB,MAAM,EAAE,qCAAqC;aAC9C,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC7B,4EAA4E;YAC9E,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,YAAY,GAAG,IAAI,CAAC;gBACpB,KAAK,CAAC,IAAI,CAAC;oBACT,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;oBACjC,KAAK,EAAE,cAAc;oBACrB,MAAM,EAAE,+BAA+B,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI;iBACnE,CAAC,CAAC;gBACH,IAAI,OAAO,EAAE,CAAC;oBACZ,SAAS,CAAC,IAAI,CACZ,iFAAiF,CAClF,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC;gBACzB,KAAK,CAAC,IAAI,CAAC;oBACT,MAAM,EAAE,IAAI;oBACZ,KAAK,EAAE,cAAc;oBACrB,MAAM,EAAE,gCAAgC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI;iBACpE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YAC3B,KAAK,CAAC,IAAI,CAAC;gBACT,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,cAAc;gBACrB,MAAM,EAAE,eAAe,SAAS,0BAA0B;aAC3D,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC;gBACT,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM;gBAC1D,KAAK,EAAE,cAAc;gBACrB,MAAM,EACJ,OAAO,IAAI,WAAW;oBACpB,CAAC,CAAC,mEAAmE;oBACrE,CAAC,CAAC,yBAAyB;aAChC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,mDAAmD;IACnD,EAAE;IACF,0EAA0E;IAC1E,2EAA2E;IAC3E,uEAAuE;IACvE,2EAA2E;IAC3E,kCAAkC;IAClC,IAAI,SAAS,IAAI,UAAU,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI;YACjC,CAAC,cAAc,EAAE,UAAU,EAAE,GAAG,SAAS,OAAO,CAAC;YACjD,CAAC,cAAc,EAAE,UAAU,EAAE,GAAG,SAAS,aAAa,CAAC;SAC/C,EAAE,CAAC;YACX,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;YAC9B,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,UAAU,CAAC,MAAM;gBAAE,SAAS;YAChD,KAAK,CAAC,IAAI,CAAC;gBACT,MAAM,EAAE,OAAO;gBACf,KAAK;gBACL,MAAM,EAAE,kBAAkB,GAAG,eAAe,UAAU,CAAC,MAAM,8DAA8D;aAC5H,CAAC,CAAC;YACH,SAAS,CAAC,IAAI,CACZ,sBAAsB,IAAI,oEAAoE,UAAU,CAAC,MAAM,EAAE,CAClH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,0BAA0B;IAC1B,+DAA+D;IAC/D,oEAAoE;IACpE,iEAAiE;IACjE,kBAAkB;IAClB,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,kBAAsC,CAAC;IAC3C,IAAI,UAA8B,CAAC;IAEnC,MAAM,SAAS,GAAG,UAAU,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,MAAM,SAAS,GAAG,UAAU,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;IAElE,IAAI,WAAW,EAAE,CAAC;QAChB,UAAU,GAAG,IAAI,CAAC;QAClB,UAAU,GAAG,OAAO;YAClB,CAAC,CAAC,CAAC,SAAS,IAAI,UAAU,EAAE,KAAK,CAAC;YAClC,CAAC,CAAC,CAAC,SAAS,IAAI,UAAU,EAAE,KAAK,CAAC,CAAC;IACvC,CAAC;SAAM,IAAI,SAAS,IAAI,SAAS,EAAE,CAAC;QAClC,iEAAiE;QACjE,iEAAiE;QACjE,sBAAsB;QACtB,UAAU,GAAG,IAAI,CAAC;QAClB,UAAU,GAAG,OAAO;YAClB,CAAC,CAAC,CAAC,SAAS,IAAI,SAAS,IAAI,SAAS,CAAC;YACvC,CAAC,CAAC,CAAC,SAAS,IAAI,SAAS,IAAI,SAAS,CAAC,CAAC;IAC5C,CAAC;SAAM,CAAC;QACN,UAAU,GAAG,KAAK,CAAC;QACnB,kBAAkB,GAAG,UAAU;YAC7B,CAAC,CAAC,sDAAsD;YACxD,CAAC,CAAC,sDAAsD,CAAC;IAC7D,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,kBAAkB,EAAE,UAAU,EAAE,CAAC;AAC1E,CAAC"}

package/dist/cli/version.d.ts

@@ -1,2 +1,2 @@
-export declare const CLI_VERSION = "0.1.987";
+export declare const CLI_VERSION = "0.1.988";
 //# sourceMappingURL=version.d.ts.map

package/dist/cli/version.js

@@ -1,3 +1,3 @@
 // Auto-generated by prebuild — do not edit manually
-export const CLI_VERSION = "0.1.987";
+export const CLI_VERSION = "0.1.988";
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "ugly-app",
   "packageManager": "pnpm@10.34.5",
-  "version": "0.1.987",
+  "version": "0.1.988",
   "type": "module",
   "comment:files": "Allowlist what ships to npm. dist = runtime; src = sourcemap targets (dist/*.js.map reference ../../src/); templates = CLI scaffold. Everything else at repo root (.pgdata local Postgres, coverage, assets/icons sources, test/, test-results/) is excluded by omission. The !negations strip the scaffold's installed deps + cruft (templates/node_modules is 200MB+ and must never ship). package.json/README/LICENSE ship automatically.",
   "files": [

package/src/cli/probeAuth.ts

@@ -101,6 +101,31 @@ export function inspectJwt(token: string): 'valid' | 'expired' | 'unknown' {
   }
 }
 
+/**
+ * The account a token acts as, read from its `sub` claim without verifying the
+ * signature (it's our own token — we only need to know whose it is).
+ *
+ * This is the check that would have caught the worst auth failure this tool has
+ * had: a project token minted while a FAKE login was in place carries a phantom
+ * subject (`e2e-auth-user`, `e2e-user`, …) that is not a ugly.bot account at
+ * all. The token verifies, `dev` works, tests appear to sign in — and then every
+ * billable call for that project 402s, or worse, test accounts get created
+ * pointing at an account that cannot pay. Nothing in the failure names the
+ * token, so it has cost hours more than once.
+ */
+export function jwtSubject(token: string): string | null {
+  const parts = token.split('.');
+  if (parts.length !== 3) return null;
+  try {
+    const payload = JSON.parse(
+      Buffer.from(parts[1]!, 'base64url').toString('utf-8'),
+    ) as { sub?: unknown };
+    return typeof payload.sub === 'string' && payload.sub ? payload.sub : null;
+  } catch {
+    return null;
+  }
+}
+
 interface GlobalAuth {
   token: string;
   userId: string;
@@ -288,6 +313,32 @@ export function probeAuth(input: ProbeAuthInput): ProbeAuthResult {
     }
   }
 
+  // 2b. Does each project token actually act as YOU?
+  //
+  // A project token whose `sub` isn't your account is not a smaller problem
+  // than a missing one — it is a token that works everywhere except where it
+  // matters. `auth:create-bot` bills test accounts to that subject, so a
+  // phantom one produces exactly the symptom that started all this: accounts
+  // that look fine and can't spend.
+  if (projectId && globalAuth) {
+    for (const [label, token, file] of [
+      ['auth (cloud)', cloudToken, `${projectId}.json`],
+      ['auth (local)', localToken, `${projectId}.local.json`],
+    ] as const) {
+      if (!token) continue;
+      const sub = jwtSubject(token);
+      if (!sub || sub === globalAuth.userId) continue;
+      lines.push({
+        status: 'error',
+        label,
+        detail: `token acts as "${sub}", not you (${globalAuth.userId}) — test accounts made with it bill an account you don't own`,
+      });
+      nextSteps.push(
+        `Delete ~/.ugly-bot/${file} and re-run \`npx ugly-app dev\` (or \`login\`) to re-mint it as ${globalAuth.userId}`,
+      );
+    }
+  }
+
   // 3. Agent-ready summary.
   // For headless tooling, the global user token is what unblocks
   // everything: project tokens are derived. If we're in local mode we

package/src/cli/version.ts

@@ -1,2 +1,2 @@
 // Auto-generated by prebuild — do not edit manually
-export const CLI_VERSION = "0.1.987";
+export const CLI_VERSION = "0.1.988";

package/templates/.claude/skills/create-test-users/SKILL.md

@@ -4,37 +4,72 @@ description: Create test users and seed data
 user-invocable: true
 ---
 
-# Creating Test Users
+# Creating test users
 
-## Register a test user
-```bash
-curl -X POST http://localhost:3000/auth/register \
-  -H "Content-Type: application/json" \
-  -d '{"email":"test1@test.com","password":"testpass123"}'
-# Returns: {"token":"..."}
-```
+**There is exactly one supported way, and it is the same one everywhere.** Everything
+else that has ever been used here — `POST /auth/register` with a password, hand-signed
+JWTs, reusing the project token from `~/.ugly-bot/<projectId>.json`, `mongosh` cleanup —
+either no longer exists or produces an account that looks signed in and cannot spend.
 
-## Save token for use in tests
-```bash
-TOKEN=$(curl -s -X POST http://localhost:3000/auth/login \
-  -H "Content-Type: application/json" \
-  -d '{"email":"test1@test.com","password":"testpass123"}' | jq -r .token)
-echo $TOKEN
+## In a Playwright test
+
+```ts
+import { testAccount, authenticateAs } from 'ugly-app/playwright';
+
+const acct = await testAccount('checkout-flow');        // idempotent per project+slug
+await authenticateAs(page, acct);                        // or a domain: 'myapp.ugly.bot'
+await page.goto('/');
 ```
 
-## Seed multiple users
+- `acct` is `{ userId, token, email, payerUserId?, canSpend? }`.
+- Add `{ requireSpend: true }` when the spec's point is a real AI response — it fails up
+  front with a readable message instead of a 402 three layers deep.
+- `testAccountPage(browser, slug, domain?)` does both steps in one call.
+
+## From the CLI (bots, swarms, manual poking)
+
 ```bash
-for i in 1 2 3 4 5; do
-  curl -s -X POST http://localhost:3000/auth/register \
-    -H "Content-Type: application/json" \
-    -d "{\"email\":\"bot${i}@test.com\",\"password\":\"botpass123\"}"
-done
+npx ugly-app auth:create-bot --slug <slug> --name "<Name>"
+# → { userId, token, email, billing: { payerUserId, canSpend, subscribed } }
 ```
 
-## Delete all test users
-```bash
-mongosh "$MONGODB_URI" --eval "db.user.deleteMany({email:/test\.com$/})"
+Use `token` as the `auth_token` cookie. Any deployed app accepts it, including default
+Mode-A apps.
+
+## What this guarantees
+
+- **A real ugly.bot account**, so `/verify` accepts it everywhere.
+- **Billed to you.** The account holds no credit of its own; a `billToUserId` pointer
+  routes its AI spend to the app owner. It never shows an "out of credit" banner just for
+  being a test account.
+- **Not creatable broken.** ugly.bot refuses to mint one when the calling identity isn't a
+  real account — the stale/fake-login case — with a message naming the fix
+  (`npx ugly-app login`). That failure used to surface hours later as an unexplained 402.
+- **Idempotent.** Same project + slug ⇒ same account, run after run. No litter.
+
+## Cleanup
+
+Don't. Accounts are reused across runs, an idle one bills nothing, and a ugly.bot cron
+reaps synthetic ones after ~7 days. Never delete users with raw SQL — that orphans rows
+in every collection keyed on the userId.
+
+## Seeding data for a test user
+
+Call the app's own API as that account, so the data goes through the same validation real
+users do:
+
+```ts
+await request.post('/api/<endpoint>', {
+  headers: { 'Cookie': `auth_token=${acct.token}`, 'Content-Type': 'application/json' },
+  data: { input: { /* ... */ } },
+});
 ```
 
+## Local, hermetic alternative (no ugly.bot, no money)
+
+For tests that don't need real AI or prod data, use test mode instead — it's free and
+offline. See `TESTING.md` §1: `UGLY_APP_TEST_MODE=1` plus the `impersonate(userId)`
+fixture from `ugly-app/testing`.
+
 # Notes
 <!-- Claude: append observations here — record which test users exist -->