@backifydev/cli 0.3.7 → 0.3.8

package/README.md

@@ -276,3 +276,5 @@ Copy the application AI prompt in Backify to receive the application ID, organiz
 `ship` runs configured checks, verifies the repository/branch, and pushes already-committed source using a short-lived repository-scoped GitHub App credential. It never stages, commits, force-pushes, or fabricates preview testing. It waits for the exact healthy preview, then publishes when policy and permissions allow. Required testing/approval returns a pending state and preview URL, not a false successful production deployment. Use `--preview-only` to stop at preview, or `--timeout <seconds>` to change the default 1200-second wait. Applications must currently be at the repository root; Backify Cloud needs static index.html output, and customer Azure needs a Dockerfile serving port 8080.
 
 `disconnect` revokes that user's application CLI sessions. `logout` removes local credentials only. Prompt histories and local reports remain subject to application permissions. Deploy the matching API and publish CLI 0.3.0 before enabling this flow in production.
+
+Connections now report the device hostname, operating system, architecture, and installed CLI version. Browser-based `connect` exchanges a general sign-in token for an application-scoped device session. Application **People & access → CLI access** shows these sessions and lets access managers revoke individual devices; source managers can revoke their own. Existing connections may need reconnecting to record device details. See [CLI access and country lookup configuration](../../docs/cli-access.md) for privacy, permissions and deployment requirements.

package/dist/index.js

@@ -17660,6 +17660,71 @@ async function packageFunctions(entry, output) {
   return outputPath;
 }
 
+// src/cli-session.ts
+import { hostname, platform, release, arch } from "node:os";
+
+// package.json
+var package_default = {
+  name: "@backifydev/cli",
+  version: "0.3.8",
+  description: "Command-line setup and diagnostics for Backify applications",
+  type: "module",
+  bin: {
+    backify: "dist/index.js"
+  },
+  files: [
+    "dist/index.js",
+    "README.md"
+  ],
+  scripts: {
+    prebuild: "npm run build -w @backify/platform && npm run build -w @backifydev/sdk && npm run build -w @backify/analyzer",
+    build: `esbuild src/index.ts --bundle --platform=node --format=esm --external:esbuild --external:typescript --outfile=dist/index.js --banner:js="import { createRequire as __backifyCreateRequire } from 'node:module'; var require = __backifyCreateRequire(import.meta.url);"`,
+    prepack: "npm run build",
+    pretypecheck: "npm run build -w @backify/platform && npm run build -w @backifydev/sdk && npm run build -w @backify/analyzer",
+    typecheck: "tsc --noEmit",
+    pretest: "npm run build -w @backify/platform && npm run build -w @backifydev/sdk && npm run build -w @backify/analyzer",
+    test: "vitest run"
+  },
+  publishConfig: {
+    access: "public"
+  },
+  repository: {
+    type: "git",
+    url: "git+https://github.com/frejnorling/backify.git",
+    directory: "packages/cli"
+  },
+  homepage: "https://agent.backify.dev/",
+  license: "MIT",
+  engines: {
+    node: ">=20"
+  },
+  dependencies: {
+    "@azure/functions": "^4.7.2",
+    "@backifydev/sdk": "^0.1.1",
+    esbuild: "^0.25.10",
+    fflate: "^0.8.2",
+    typescript: "^5.9.2"
+  },
+  devDependencies: {
+    "@backify/analyzer": "*",
+    "@backify/platform": "*",
+    "@hono/node-server": "2.1.3",
+    "@types/node": "^24.3.1",
+    hono: "4.13.12",
+    vitest: "^4.1.11"
+  }
+};
+
+// src/cli-session.ts
+function cliDevice() {
+  return { deviceName: hostname(), operatingSystem: platform() + " " + release(), architecture: arch(), cliVersion: package_default.version };
+}
+var cliUserAgent = "BackifyCLI/" + package_default.version;
+async function registerCliSession(client, applicationId, apiUrl) {
+  const session = await client("/apps/" + applicationId + "/developer/session", { method: "POST", body: JSON.stringify(cliDevice()) });
+  return { ...session, apiUrl };
+}
+
 // src/local-runtime.ts
 import { createHash, randomUUID } from "node:crypto";
 import { chmodSync, existsSync as existsSync2, lstatSync, mkdirSync as mkdirSync2, readFileSync, readdirSync, writeFileSync as writeFileSync2 } from "node:fs";
@@ -17669,13 +17734,13 @@ import { spawnSync } from "node:child_process";
 
 // src/local-state.ts
 import { renameSync } from "node:fs";
-function replaceLocalFile(source, destination, rename, platform, wait) {
+function replaceLocalFile(source, destination, rename, platform2, wait) {
   for (let attempt = 0; ; attempt++) {
     try {
       rename(source, destination);
       return;
     } catch (error) {
-      if (platform !== "win32" || attempt >= 4 || !(error instanceof Error) || !("code" in error) || !["EPERM", "EACCES", "EBUSY"].includes(String(error.code))) throw error;
+      if (platform2 !== "win32" || attempt >= 4 || !(error instanceof Error) || !("code" in error) || !["EPERM", "EACCES", "EBUSY"].includes(String(error.code))) throw error;
       wait(10 * 2 ** attempt);
     }
   }
@@ -17688,8 +17753,8 @@ function renameLocalFile(source, destination) {
 var maxArchiveBytes = 256 * 1024 * 1024;
 var maxExpandedBytes = 512 * 1024 * 1024;
 var hash = (bytes) => createHash("sha256").update(bytes).digest("hex");
-function runtimeIdentifier(platform = process.platform, architecture = process.arch) {
-  const system = { win32: "win", darwin: "osx", linux: "linux" }[platform];
+function runtimeIdentifier(platform2 = process.platform, architecture = process.arch) {
+  const system = { win32: "win", darwin: "osx", linux: "linux" }[platform2];
   if (!system || !["x64", "arm64"].includes(architecture)) throw new Error("Local runtime supports Windows, macOS and Linux on x64/arm64");
   return system + "-" + architecture;
 }
@@ -17847,7 +17912,7 @@ function parseApplicationManifest(source) {
     if (name2 === "database" && settings.migrations !== void 0 && !portablePath(settings.migrations))
       throw new Error("Migrations must be repository-relative");
     if (name2 === "storage" && settings.buckets !== void 0) {
-      if (!Array.isArray(settings.buckets) || settings.buckets.length > 50 || settings.buckets.some((bucket) => !object(bucket) || typeof bucket.name !== "string" || !/^[A-Za-z0-9_-]{1,100}$/.test(bucket.name) || bucket.access !== void 0 && bucket.access !== "private" || Object.keys(bucket).some((key) => !["name", "access"].includes(key))) || new Set(settings.buckets.map((bucket) => bucket.name)).size !== settings.buckets.length)
+      if (!Array.isArray(settings.buckets) || settings.buckets.length > 50 || settings.buckets.some((bucket) => !object(bucket) || typeof bucket.name !== "string" || !/^[A-Za-z0-9_-]{1,100}$/.test(bucket.name) || bucket.access !== void 0 && bucket.access !== "private" || bucket.isolation !== void 0 && !["private", "user", "tenant", "authenticated", "public", "selected"].includes(String(bucket.isolation)) || bucket.allowSignedUrls !== void 0 && typeof bucket.allowSignedUrls !== "boolean" || Object.keys(bucket).some((key) => !["name", "access", "isolation", "allowSignedUrls"].includes(key))) || new Set(settings.buckets.map((bucket) => bucket.name)).size !== settings.buckets.length)
         throw new Error("Storage requires at most 50 distinct private logical buckets");
     }
     capabilities[name2] = structuredClone(settings);
@@ -19825,7 +19890,7 @@ async function startLocalServices(root, manifest, options = {}) {
   if (databasePort === hcrPort) throw new Error("HCR and PostgreSQL require separate ports");
   const cluster = join4(directory2, "postgres");
   assertLocalStatePath(root, cluster);
-  const release = acquireLocalLease(root, ".backify/dev/services/lifecycle.lock");
+  const release2 = acquireLocalLease(root, ".backify/dev/services/lifecycle.lock");
   let postgresStarted = false;
   let hcr;
   let timer;
@@ -19862,7 +19927,7 @@ async function startLocalServices(root, manifest, options = {}) {
       if (postgresStarted) notify("postgres", "stopped");
       if (existsSync5(tokenPath)) unlinkSync3(tokenPath);
     } finally {
-      release();
+      release2();
     }
   })();
   const applied = [];
@@ -21242,7 +21307,7 @@ function initializeLocalSecrets(root, application, keyFile) {
     if (dirname8(current) === current) break;
   }
   ensureIgnored(root);
-  const release = acquireLocalLease(root, ".backify/dev/secrets.lock");
+  const release2 = acquireLocalLease(root, ".backify/dev/secrets.lock");
   const key = randomBytes4(32);
   try {
     if (existsSync7(filename2)) throw failure();
@@ -21251,7 +21316,7 @@ function initializeLocalSecrets(root, application, keyFile) {
     writePrivate2(filename2, encrypt(root, application, key, {}));
   } finally {
     key.fill(0);
-    release();
+    release2();
   }
   return { schemaVersion: 1, status: "initialized", keyFile: external, names: [] };
 }
@@ -21259,7 +21324,7 @@ function setLocalSecret(root, application, keyFile, name2, value) {
   if (!secretName.test(name2) || Buffer.byteLength(value) < 1 || Buffer.byteLength(value) > 65536) throw new Error("Local secrets require an uppercase logical name and 1-65536 UTF-8 bytes from stdin");
   const filename2 = vaultPath(root);
   assertLocalStatePath(root, filename2);
-  const release = acquireLocalLease(root, ".backify/dev/secrets.lock");
+  const release2 = acquireLocalLease(root, ".backify/dev/secrets.lock");
   let key;
   try {
     const secrets = readLocalSecrets(root, application, keyFile);
@@ -21271,7 +21336,7 @@ function setLocalSecret(root, application, keyFile, name2, value) {
     renameLocalFile(temporary, filename2);
   } finally {
     key?.fill(0);
-    release();
+    release2();
   }
   return { schemaVersion: 1, status: "stored", name: name2 };
 }
@@ -22666,7 +22731,7 @@ function apiClient(session, transport = fetch) {
   return async (path, init) => {
     if (!path.startsWith("/") || path.startsWith("//")) throw new Error("Invalid API path.");
     if (session.expiresAt && Date.parse(session.expiresAt) <= Date.now()) throw new Error("CLI session expired. Copy a new setup prompt or run backify login.");
-    const response = await transport(base + path, { ...init, redirect: "error", signal: AbortSignal.timeout(3e4), headers: { "content-type": "application/json", "X-Organization-ID": session.organizationId, ...session.token ? { authorization: "Bearer " + session.token } : {}, ...init?.headers } });
+    const response = await transport(base + path, { ...init, redirect: "error", signal: AbortSignal.timeout(3e4), headers: { "content-type": "application/json", "user-agent": cliUserAgent, "X-Organization-ID": session.organizationId, ...session.token ? { authorization: "Bearer " + session.token } : {}, ...init?.headers } });
     if (!response.ok) {
       let message = "Backify request failed (" + response.status + ").";
       try {
@@ -22804,8 +22869,8 @@ function localReport(runChecks, root = process.cwd()) {
   const outputDirectory = ["dist", "build", "out", "."].find((directory2) => existsSync14(join16(root, directory2, "index.html"))) ?? null;
   return { framework, sdkVersion: dependencies["@backifydev/sdk"] ?? null, branch, commitSha, dirty, buildCommand: pkg.scripts?.build ? manager + " run build" : null, outputDirectory, hasDockerfile: existsSync14(join16(root, "Dockerfile")), checks };
 }
-function matchesSource(release, commit) {
-  return release?.commitSha === commit || release?.sourceCommitSha === commit;
+function matchesSource(release2, commit) {
+  return release2?.commitSha === commit || release2?.sourceCommitSha === commit;
 }
 function pushSource(appId, commit, branch, destination, root, environment) {
   const remoteHead = git2(["ls-remote", "--", destination, "refs/heads/" + branch], root, environment).split(/\s+/)[0];
@@ -22827,7 +22892,7 @@ async function waitForPreview(call2, prefix, commit, options = {}) {
   const sleep = options.sleep ?? ((delay) => new Promise((resolve24) => setTimeout(resolve24, delay)));
   do {
     const deployments = await call2(prefix + "/deployments");
-    const matching = deployments.find((release) => release.kind === "preview" && matchesSource(release, commit) && !options.previousDeploymentIds?.includes(release.id));
+    const matching = deployments.find((release2) => release2.kind === "preview" && matchesSource(release2, commit) && !options.previousDeploymentIds?.includes(release2.id));
     if (matching?.status === "failed") throw new Error("Deployment of this source failed. Run backify status and inspect its deployment steps.");
     const overview = await call2(prefix + "/releases");
     if (matchesSource(overview.preview, commit) && overview.preview?.status === "succeeded" && overview.preview.healthResult === "healthy") return overview;
@@ -22864,7 +22929,7 @@ async function ship(call2, appId, options = {}) {
   const environment = gitEnvironment(status.repository, credential.token);
   const destination = "https://github.com/" + status.repository + ".git";
   const alreadyPushed = pushSource(appId, commit, status.branch, destination, root, environment);
-  const currentPreview = previousDeployments.find((release) => release.kind === "preview" && matchesSource(release, commit));
+  const currentPreview = previousDeployments.find((release2) => release2.kind === "preview" && matchesSource(release2, commit));
   if (alreadyPushed && (!currentPreview || currentPreview.status === "failed") && !(matchesSource(status.releases.preview, commit) && status.releases.preview?.status === "succeeded")) await call2(prefix + "/deployments/preview", { method: "POST", body: JSON.stringify({ sourceRevision: "latest" }) });
   const overview = await waitForPreview(call2, prefix, commit, { timeoutMs: options.timeoutMs, previousDeploymentIds: previousDeployments.filter((deployment) => deployment.status === "failed").map((deployment) => deployment.id), previousBuildRunId: previousBuild.runId ?? null });
   if (overview.preview.commitSha !== commit) {
@@ -23144,14 +23209,20 @@ async function main() {
       if (code) {
         if (!organizationId) throw new Error("The setup prompt must supply the organization.");
         const redeem = apiClient({ token: "", organizationId, apiUrl: address });
-        const paired = await redeem("/apps/" + applicationGuid(appId) + "/developer/pair", { method: "POST", body: JSON.stringify({ code }) });
+        const paired = await redeem("/apps/" + applicationGuid(appId) + "/developer/pair", { method: "POST", body: JSON.stringify({ code, device: cliDevice() }) });
         userConfig.sessions ??= {};
         userConfig.sessions[key] = { ...paired, apiUrl: address };
         saveUserConfig(configPath, userConfig);
       } else if (!userConfig.sessions?.[key] && !userConfig.token) {
         await browserLogin();
       }
-      const session = userConfig.sessions?.[key] ?? { token: userConfig.token ?? "", organizationId: organizationId ?? userConfig.organizationId ?? "", apiUrl: address };
+      let session = userConfig.sessions?.[key] ?? { token: userConfig.token ?? "", organizationId: organizationId ?? userConfig.organizationId ?? "", apiUrl: address };
+      if (!session.token.startsWith("bfcli_")) {
+        session = await registerCliSession(apiClient(session), applicationGuid(appId), session.apiUrl);
+        userConfig.sessions ??= {};
+        userConfig.sessions[key] = session;
+        saveUserConfig(configPath, userConfig);
+      }
       const client = apiClient(session);
       await client("/apps/" + applicationGuid(appId) + "/developer");
       userConfig.sessions ??= {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@backifydev/cli",
-  "version": "0.3.7",
+  "version": "0.3.8",
   "description": "Command-line setup and diagnostics for Backify applications",
   "type": "module",
   "bin": {