@backifydev/cli 0.3.6 → 0.3.8

package/README.md

@@ -276,3 +276,5 @@ Copy the application AI prompt in Backify to receive the application ID, organiz
 `ship` runs configured checks, verifies the repository/branch, and pushes already-committed source using a short-lived repository-scoped GitHub App credential. It never stages, commits, force-pushes, or fabricates preview testing. It waits for the exact healthy preview, then publishes when policy and permissions allow. Required testing/approval returns a pending state and preview URL, not a false successful production deployment. Use `--preview-only` to stop at preview, or `--timeout <seconds>` to change the default 1200-second wait. Applications must currently be at the repository root; Backify Cloud needs static index.html output, and customer Azure needs a Dockerfile serving port 8080.
 
 `disconnect` revokes that user's application CLI sessions. `logout` removes local credentials only. Prompt histories and local reports remain subject to application permissions. Deploy the matching API and publish CLI 0.3.0 before enabling this flow in production.
+
+Connections now report the device hostname, operating system, architecture, and installed CLI version. Browser-based `connect` exchanges a general sign-in token for an application-scoped device session. Application **People & access → CLI access** shows these sessions and lets access managers revoke individual devices; source managers can revoke their own. Existing connections may need reconnecting to record device details. See [CLI access and country lookup configuration](../../docs/cli-access.md) for privacy, permissions and deployment requirements.

package/dist/index.js

@@ -17593,6 +17593,28 @@ function unzipSync(data, opts) {
 import { createRequire as createRequire2 } from "node:module";
 import { dirname, resolve } from "node:path";
 import { existsSync, mkdirSync, writeFileSync } from "node:fs";
+async function deployFunctions(call2, appId, environmentId, packageBytes, options = {}) {
+  const result = await call2("/apps/" + appId + "/functions/environments/" + environmentId + "/deploy?confirm=true", { method: "POST", headers: { "content-type": "application/zip" }, body: packageBytes });
+  if (result.status === "succeeded") return;
+  if (!result.operationId) throw new Error("Function deployment did not return a tracking operation. Success has not been verified.");
+  const now = options.now ?? Date.now;
+  const deadline = now() + (options.timeoutMs ?? 20 * 6e4);
+  const sleep = options.sleep ?? ((milliseconds) => new Promise((resolve24) => setTimeout(resolve24, milliseconds)));
+  options.progress?.("Function deployment queued. Waiting for operation " + result.operationId + ".");
+  while (now() < deadline) {
+    let operation;
+    try {
+      operation = await call2("/operations/" + result.operationId);
+    } catch (cause) {
+      throw new Error("Could not read function deployment operation " + result.operationId + ". Check its status before uploading again: " + String(cause));
+    }
+    if (operation.status === "succeeded") return;
+    if (operation.status === "failed" || operation.status === "cancelled") throw new Error("Function deployment " + operation.status + ": " + (operation.errorMessage ?? result.operationId));
+    if (operation.status !== "pending" && operation.status !== "running") throw new Error("Unknown function deployment status: " + operation.status);
+    await sleep(Math.min(options.intervalMs ?? 2e3, Math.max(0, deadline - now())));
+  }
+  throw new Error("Stopped waiting for function deployment. Operation " + result.operationId + " continues on Backify; check its status before uploading again.");
+}
 async function packageFunctions(entry, output) {
   const entryPath = resolve(entry);
   if (!existsSync(entryPath)) throw new Error("Function entrypoint does not exist: " + entryPath);
@@ -17638,6 +17660,71 @@ async function packageFunctions(entry, output) {
   return outputPath;
 }
 
+// src/cli-session.ts
+import { hostname, platform, release, arch } from "node:os";
+
+// package.json
+var package_default = {
+  name: "@backifydev/cli",
+  version: "0.3.8",
+  description: "Command-line setup and diagnostics for Backify applications",
+  type: "module",
+  bin: {
+    backify: "dist/index.js"
+  },
+  files: [
+    "dist/index.js",
+    "README.md"
+  ],
+  scripts: {
+    prebuild: "npm run build -w @backify/platform && npm run build -w @backifydev/sdk && npm run build -w @backify/analyzer",
+    build: `esbuild src/index.ts --bundle --platform=node --format=esm --external:esbuild --external:typescript --outfile=dist/index.js --banner:js="import { createRequire as __backifyCreateRequire } from 'node:module'; var require = __backifyCreateRequire(import.meta.url);"`,
+    prepack: "npm run build",
+    pretypecheck: "npm run build -w @backify/platform && npm run build -w @backifydev/sdk && npm run build -w @backify/analyzer",
+    typecheck: "tsc --noEmit",
+    pretest: "npm run build -w @backify/platform && npm run build -w @backifydev/sdk && npm run build -w @backify/analyzer",
+    test: "vitest run"
+  },
+  publishConfig: {
+    access: "public"
+  },
+  repository: {
+    type: "git",
+    url: "git+https://github.com/frejnorling/backify.git",
+    directory: "packages/cli"
+  },
+  homepage: "https://agent.backify.dev/",
+  license: "MIT",
+  engines: {
+    node: ">=20"
+  },
+  dependencies: {
+    "@azure/functions": "^4.7.2",
+    "@backifydev/sdk": "^0.1.1",
+    esbuild: "^0.25.10",
+    fflate: "^0.8.2",
+    typescript: "^5.9.2"
+  },
+  devDependencies: {
+    "@backify/analyzer": "*",
+    "@backify/platform": "*",
+    "@hono/node-server": "2.1.3",
+    "@types/node": "^24.3.1",
+    hono: "4.13.12",
+    vitest: "^4.1.11"
+  }
+};
+
+// src/cli-session.ts
+function cliDevice() {
+  return { deviceName: hostname(), operatingSystem: platform() + " " + release(), architecture: arch(), cliVersion: package_default.version };
+}
+var cliUserAgent = "BackifyCLI/" + package_default.version;
+async function registerCliSession(client, applicationId, apiUrl) {
+  const session = await client("/apps/" + applicationId + "/developer/session", { method: "POST", body: JSON.stringify(cliDevice()) });
+  return { ...session, apiUrl };
+}
+
 // src/local-runtime.ts
 import { createHash, randomUUID } from "node:crypto";
 import { chmodSync, existsSync as existsSync2, lstatSync, mkdirSync as mkdirSync2, readFileSync, readdirSync, writeFileSync as writeFileSync2 } from "node:fs";
@@ -17647,13 +17734,13 @@ import { spawnSync } from "node:child_process";
 
 // src/local-state.ts
 import { renameSync } from "node:fs";
-function replaceLocalFile(source, destination, rename, platform, wait) {
+function replaceLocalFile(source, destination, rename, platform2, wait) {
   for (let attempt = 0; ; attempt++) {
     try {
       rename(source, destination);
       return;
     } catch (error) {
-      if (platform !== "win32" || attempt >= 4 || !(error instanceof Error) || !("code" in error) || !["EPERM", "EACCES", "EBUSY"].includes(String(error.code))) throw error;
+      if (platform2 !== "win32" || attempt >= 4 || !(error instanceof Error) || !("code" in error) || !["EPERM", "EACCES", "EBUSY"].includes(String(error.code))) throw error;
       wait(10 * 2 ** attempt);
     }
   }
@@ -17666,8 +17753,8 @@ function renameLocalFile(source, destination) {
 var maxArchiveBytes = 256 * 1024 * 1024;
 var maxExpandedBytes = 512 * 1024 * 1024;
 var hash = (bytes) => createHash("sha256").update(bytes).digest("hex");
-function runtimeIdentifier(platform = process.platform, architecture = process.arch) {
-  const system = { win32: "win", darwin: "osx", linux: "linux" }[platform];
+function runtimeIdentifier(platform2 = process.platform, architecture = process.arch) {
+  const system = { win32: "win", darwin: "osx", linux: "linux" }[platform2];
   if (!system || !["x64", "arm64"].includes(architecture)) throw new Error("Local runtime supports Windows, macOS and Linux on x64/arm64");
   return system + "-" + architecture;
 }
@@ -17825,7 +17912,7 @@ function parseApplicationManifest(source) {
     if (name2 === "database" && settings.migrations !== void 0 && !portablePath(settings.migrations))
       throw new Error("Migrations must be repository-relative");
     if (name2 === "storage" && settings.buckets !== void 0) {
-      if (!Array.isArray(settings.buckets) || settings.buckets.length > 50 || settings.buckets.some((bucket) => !object(bucket) || typeof bucket.name !== "string" || !/^[A-Za-z0-9_-]{1,100}$/.test(bucket.name) || bucket.access !== void 0 && bucket.access !== "private" || Object.keys(bucket).some((key) => !["name", "access"].includes(key))) || new Set(settings.buckets.map((bucket) => bucket.name)).size !== settings.buckets.length)
+      if (!Array.isArray(settings.buckets) || settings.buckets.length > 50 || settings.buckets.some((bucket) => !object(bucket) || typeof bucket.name !== "string" || !/^[A-Za-z0-9_-]{1,100}$/.test(bucket.name) || bucket.access !== void 0 && bucket.access !== "private" || bucket.isolation !== void 0 && !["private", "user", "tenant", "authenticated", "public", "selected"].includes(String(bucket.isolation)) || bucket.allowSignedUrls !== void 0 && typeof bucket.allowSignedUrls !== "boolean" || Object.keys(bucket).some((key) => !["name", "access", "isolation", "allowSignedUrls"].includes(key))) || new Set(settings.buckets.map((bucket) => bucket.name)).size !== settings.buckets.length)
         throw new Error("Storage requires at most 50 distinct private logical buckets");
     }
     capabilities[name2] = structuredClone(settings);
@@ -17854,8 +17941,8 @@ function manifestDiagnostics(manifest, used) {
 // ../platform/dist/delivery.js
 var deliveryInstructions = `# Backify application delivery and prompt history
 
-Instruction version: 4
-Versioned guide: https://agent.backify.dev/v4/delivery.md
+Instruction version: 5
+Versioned guide: https://agent.backify.dev/v5/delivery.md
 
 These instructions are for AI coding tools building applications on Backify, not the Backify platform implementation. Complete the application and deliver a verified deployment, not just SDK setup. Respect the coding tool's own permissions and confirmation settings; preserve unrelated work and applicable repository instructions.
 
@@ -17873,7 +17960,7 @@ Initialize using App Id from the copied prompt and the current tool selection:
 
     npx @backifydev/cli@latest init --app <app-id> --agent <current-tool>
 
-For a tool without a built-in preset, replace --agent <current-tool> with --instruction-file <relative-path>. Read BACKIFY.md and the instruction file used by the current AI coding tool before changing application code. Create or update only instruction files used by that tool; never create files for other coding tools. Use --agent for a built-in tool preset or --instruction-file <relative-path> for the current tool's native instruction file, as described in the setup guide. Initialization installs this workflow alongside the persistent SDK instructions. Follow https://agent.backify.dev/v4 for instruction version 4; use the guide matching backify.json in an existing application. Do not silently upgrade its managed instruction version or overwrite instructions outside the managed block.
+For a tool without a built-in preset, replace --agent <current-tool> with --instruction-file <relative-path>. Read BACKIFY.md and the instruction file used by the current AI coding tool before changing application code. Create or update only instruction files used by that tool; never create files for other coding tools. Use --agent for a built-in tool preset or --instruction-file <relative-path> for the current tool's native instruction file, as described in the setup guide. Initialization installs this workflow alongside the persistent SDK instructions. Follow https://agent.backify.dev/v5 for instruction version 5; use the guide matching backify.json in an existing application. Do not silently upgrade its managed instruction version or overwrite instructions outside the managed block.
 
 Run the following to discover the connected hosting target, repository, branch, reports, releases, and deployment failures:
 
@@ -17907,6 +17994,12 @@ For Backify Cloud, build a static application with a build script and index.html
 
 Do not claim unsupported hosted server functions or SDK execution paths work. Report unsupported runtime requirements instead of substituting another platform. Keep secrets server-side and out of browser code, project files, and Git.
 
+## Local development before delivery
+
+From the first setup, make every new application runnable and testable locally without a cloud deployment. Follow the matching setup guide's local development steps: preserve the framework, provide a package-manager dev script and README, use @backifydev/sdk/local for platform capabilities and tests, and keep local state and credentials out of Git. Use a native framework dev server for frontend-only apps; for Backify server capabilities, configure backify.yaml and npx @backifydev/cli@latest dev --mode lightweight --json with the supported frontend adapter when needed. Disclose emulator limits and any full-runtime prerequisites.
+
+Start the application, wait for readiness, request the actual local application URL, and verify a representative user flow before shipping. Document safe seed data and local test identities where needed. Cloud connection, preview approval, or deployment failure must not prevent safe local testing; report those blockers separately without bypassing authorization. If requirements are missing, verify a minimal runnable shell before asking the required final question. Never claim local readiness from a build or management-dashboard response alone.
+
 ## Verify, push, and publish
 
 Run:
@@ -17925,6 +18018,8 @@ If testing or approval is required, return the preview URL and explain the remai
 
 After setup or a delivery attempt, give the user concise instructions: explain what is ready, how to open and use the application, and any sign-in, testing, approval, or other next steps. Summarize actual checks and blockers without exposing credentials or asking the user to perform routine deployment work the coding tool can complete.
 
+Include the verified Local URL, exact start command, and local testing/sign-in steps even when cloud delivery is blocked. If local startup was not verified, say unavailable and explain the blocker.
+
 Include separate Preview URL and Production URL lines, using the actual URLs returned by CLI status or deployment results. Include both URLs when available. If either is unavailable, say not deployed or unavailable and explain why; never invent a URL or claim an unverified deployment is live. When production still serves an earlier release, label it as the existing production version and explain that the new changes are preview-only or awaiting approval.
 
 If application requirements are missing after setup, finish the response with this exact question as its final line, without any text after it:
@@ -17935,7 +18030,7 @@ These instructions are an explicit agent workflow, not a universal chat intercep
 `;
 
 // ../platform/dist/index.js
-var INSTRUCTION_VERSION = 4;
+var INSTRUCTION_VERSION = 5;
 var SDK_PACKAGE = "@backifydev/sdk";
 var DOCS_URL = "https://docs.backify.dev";
 var MAIL_LIMITS = Object.freeze({
@@ -18005,6 +18100,7 @@ Require explicit confirmation before destructive data operations or removing sta
 ## Implementation workflow
 
 Inspect the framework, lockfile, scripts, configuration, and applicable repository instructions before editing. Preserve the existing framework and unrelated work. Implement the requested application rather than stopping at SDK setup; ask what to build if requirements are missing.
+From the first setup, make every new application runnable and testable locally without a cloud deployment. Provide a package-manager start script, document prerequisites and local test identities, start the application, and verify its local URL and a representative user flow. Use \`@backifydev/sdk/local\` for local platform capabilities, keep local state and credentials out of Git, and clearly disclose emulation limits. Include the actual Local URL, start command, checks, and any blockers in the user handoff; never claim an unstarted application is ready. Follow the matching setup guide for framework-specific local commands.
 Run relevant tests, typechecking, lint, and builds using the repository's scripts when available. Report changes, checks, and remaining blockers accurately; do not claim unverified success.
 
 ## Connected application delivery
@@ -19794,7 +19890,7 @@ async function startLocalServices(root, manifest, options = {}) {
   if (databasePort === hcrPort) throw new Error("HCR and PostgreSQL require separate ports");
   const cluster = join4(directory2, "postgres");
   assertLocalStatePath(root, cluster);
-  const release = acquireLocalLease(root, ".backify/dev/services/lifecycle.lock");
+  const release2 = acquireLocalLease(root, ".backify/dev/services/lifecycle.lock");
   let postgresStarted = false;
   let hcr;
   let timer;
@@ -19831,7 +19927,7 @@ async function startLocalServices(root, manifest, options = {}) {
       if (postgresStarted) notify("postgres", "stopped");
       if (existsSync5(tokenPath)) unlinkSync3(tokenPath);
     } finally {
-      release();
+      release2();
     }
   })();
   const applied = [];
@@ -21211,7 +21307,7 @@ function initializeLocalSecrets(root, application, keyFile) {
     if (dirname8(current) === current) break;
   }
   ensureIgnored(root);
-  const release = acquireLocalLease(root, ".backify/dev/secrets.lock");
+  const release2 = acquireLocalLease(root, ".backify/dev/secrets.lock");
   const key = randomBytes4(32);
   try {
     if (existsSync7(filename2)) throw failure();
@@ -21220,7 +21316,7 @@ function initializeLocalSecrets(root, application, keyFile) {
     writePrivate2(filename2, encrypt(root, application, key, {}));
   } finally {
     key.fill(0);
-    release();
+    release2();
   }
   return { schemaVersion: 1, status: "initialized", keyFile: external, names: [] };
 }
@@ -21228,7 +21324,7 @@ function setLocalSecret(root, application, keyFile, name2, value) {
   if (!secretName.test(name2) || Buffer.byteLength(value) < 1 || Buffer.byteLength(value) > 65536) throw new Error("Local secrets require an uppercase logical name and 1-65536 UTF-8 bytes from stdin");
   const filename2 = vaultPath(root);
   assertLocalStatePath(root, filename2);
-  const release = acquireLocalLease(root, ".backify/dev/secrets.lock");
+  const release2 = acquireLocalLease(root, ".backify/dev/secrets.lock");
   let key;
   try {
     const secrets = readLocalSecrets(root, application, keyFile);
@@ -21240,7 +21336,7 @@ function setLocalSecret(root, application, keyFile, name2, value) {
     renameLocalFile(temporary, filename2);
   } finally {
     key?.fill(0);
-    release();
+    release2();
   }
   return { schemaVersion: 1, status: "stored", name: name2 };
 }
@@ -22635,7 +22731,7 @@ function apiClient(session, transport = fetch) {
   return async (path, init) => {
     if (!path.startsWith("/") || path.startsWith("//")) throw new Error("Invalid API path.");
     if (session.expiresAt && Date.parse(session.expiresAt) <= Date.now()) throw new Error("CLI session expired. Copy a new setup prompt or run backify login.");
-    const response = await transport(base + path, { ...init, redirect: "error", signal: AbortSignal.timeout(3e4), headers: { "content-type": "application/json", "X-Organization-ID": session.organizationId, ...session.token ? { authorization: "Bearer " + session.token } : {}, ...init?.headers } });
+    const response = await transport(base + path, { ...init, redirect: "error", signal: AbortSignal.timeout(3e4), headers: { "content-type": "application/json", "user-agent": cliUserAgent, "X-Organization-ID": session.organizationId, ...session.token ? { authorization: "Bearer " + session.token } : {}, ...init?.headers } });
     if (!response.ok) {
       let message = "Backify request failed (" + response.status + ").";
       try {
@@ -22773,8 +22869,8 @@ function localReport(runChecks, root = process.cwd()) {
   const outputDirectory = ["dist", "build", "out", "."].find((directory2) => existsSync14(join16(root, directory2, "index.html"))) ?? null;
   return { framework, sdkVersion: dependencies["@backifydev/sdk"] ?? null, branch, commitSha, dirty, buildCommand: pkg.scripts?.build ? manager + " run build" : null, outputDirectory, hasDockerfile: existsSync14(join16(root, "Dockerfile")), checks };
 }
-function matchesSource(release, commit) {
-  return release?.commitSha === commit || release?.sourceCommitSha === commit;
+function matchesSource(release2, commit) {
+  return release2?.commitSha === commit || release2?.sourceCommitSha === commit;
 }
 function pushSource(appId, commit, branch, destination, root, environment) {
   const remoteHead = git2(["ls-remote", "--", destination, "refs/heads/" + branch], root, environment).split(/\s+/)[0];
@@ -22796,7 +22892,7 @@ async function waitForPreview(call2, prefix, commit, options = {}) {
   const sleep = options.sleep ?? ((delay) => new Promise((resolve24) => setTimeout(resolve24, delay)));
   do {
     const deployments = await call2(prefix + "/deployments");
-    const matching = deployments.find((release) => release.kind === "preview" && matchesSource(release, commit) && !options.previousDeploymentIds?.includes(release.id));
+    const matching = deployments.find((release2) => release2.kind === "preview" && matchesSource(release2, commit) && !options.previousDeploymentIds?.includes(release2.id));
     if (matching?.status === "failed") throw new Error("Deployment of this source failed. Run backify status and inspect its deployment steps.");
     const overview = await call2(prefix + "/releases");
     if (matchesSource(overview.preview, commit) && overview.preview?.status === "succeeded" && overview.preview.healthResult === "healthy") return overview;
@@ -22833,7 +22929,7 @@ async function ship(call2, appId, options = {}) {
   const environment = gitEnvironment(status.repository, credential.token);
   const destination = "https://github.com/" + status.repository + ".git";
   const alreadyPushed = pushSource(appId, commit, status.branch, destination, root, environment);
-  const currentPreview = previousDeployments.find((release) => release.kind === "preview" && matchesSource(release, commit));
+  const currentPreview = previousDeployments.find((release2) => release2.kind === "preview" && matchesSource(release2, commit));
   if (alreadyPushed && (!currentPreview || currentPreview.status === "failed") && !(matchesSource(status.releases.preview, commit) && status.releases.preview?.status === "succeeded")) await call2(prefix + "/deployments/preview", { method: "POST", body: JSON.stringify({ sourceRevision: "latest" }) });
   const overview = await waitForPreview(call2, prefix, commit, { timeoutMs: options.timeoutMs, previousDeploymentIds: previousDeployments.filter((deployment) => deployment.status === "failed").map((deployment) => deployment.id), previousBuildRunId: previousBuild.runId ?? null });
   if (overview.preview.commitSha !== commit) {
@@ -23070,7 +23166,7 @@ async function main() {
         const environmentId = option("--environment");
         const packagePath = option("--package");
         if (!environmentId || !packagePath || !args.includes("--confirm")) throw new Error("Use backify functions deploy --environment <environment-id> --package <functions.zip> --confirm. This replaces the complete function project.");
-        await call("/apps/" + appId + "/functions/environments/" + applicationGuid(environmentId) + "/deploy?confirm=true", { method: "POST", headers: { "content-type": "application/zip" }, body: new Uint8Array(readFileSync24(packagePath)) });
+        await deployFunctions(call, appId, applicationGuid(environmentId), new Uint8Array(readFileSync24(packagePath)), { progress: (message) => console.log(message) });
         console.log("Functions deployed.");
       } else throw new Error("Use backify functions package or backify functions deploy");
       break;
@@ -23113,14 +23209,20 @@ async function main() {
       if (code) {
         if (!organizationId) throw new Error("The setup prompt must supply the organization.");
         const redeem = apiClient({ token: "", organizationId, apiUrl: address });
-        const paired = await redeem("/apps/" + applicationGuid(appId) + "/developer/pair", { method: "POST", body: JSON.stringify({ code }) });
+        const paired = await redeem("/apps/" + applicationGuid(appId) + "/developer/pair", { method: "POST", body: JSON.stringify({ code, device: cliDevice() }) });
         userConfig.sessions ??= {};
         userConfig.sessions[key] = { ...paired, apiUrl: address };
         saveUserConfig(configPath, userConfig);
       } else if (!userConfig.sessions?.[key] && !userConfig.token) {
         await browserLogin();
       }
-      const session = userConfig.sessions?.[key] ?? { token: userConfig.token ?? "", organizationId: organizationId ?? userConfig.organizationId ?? "", apiUrl: address };
+      let session = userConfig.sessions?.[key] ?? { token: userConfig.token ?? "", organizationId: organizationId ?? userConfig.organizationId ?? "", apiUrl: address };
+      if (!session.token.startsWith("bfcli_")) {
+        session = await registerCliSession(apiClient(session), applicationGuid(appId), session.apiUrl);
+        userConfig.sessions ??= {};
+        userConfig.sessions[key] = session;
+        saveUserConfig(configPath, userConfig);
+      }
       const client = apiClient(session);
       await client("/apps/" + applicationGuid(appId) + "/developer");
       userConfig.sessions ??= {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@backifydev/cli",
-  "version": "0.3.6",
+  "version": "0.3.8",
   "description": "Command-line setup and diagnostics for Backify applications",
   "type": "module",
   "bin": {