@condorinst/mobile-bridge 0.20.0 → 0.22.0

package/dist/cli.js

@@ -2,7 +2,15 @@
 
 // src/cli.ts
 import { mkdirSync, writeFileSync } from "fs";
-import { dirname as dirname2, resolve as resolve2 } from "path";
+import { dirname as dirname3, resolve as resolve4 } from "path";
+
+// package.json
+var version = "0.22.0";
+
+// src/canvas-admin/command.ts
+import { createHash as createHash2 } from "crypto";
+import { existsSync, readFileSync as readFileSync2, statSync } from "fs";
+import { extname as extname2, join, resolve as resolve2 } from "path";
 
 // src/cli-core.ts
 import { createHash } from "crypto";
@@ -167,8 +175,16 @@ var BLOCKED_API_RULES = [
     message: "connect-src 'self' on a null origin blocks every network call. Request data through the bridge instead (e.g. BridgeClient.fetchSensorLog)."
   }
 ];
+var DEV_HARNESS_MARKER = "__condorDevHarness__";
 function lintClientHtml(html) {
   const findings = [];
+  if (html.includes(DEV_HARNESS_MARKER)) {
+    findings.push({
+      severity: "error",
+      rule: "dev-harness-bundled",
+      message: "The bundle contains the development harness (@condorinst/mobile-bridge/dev). It belongs in the page that hosts the bundle during development, never in the bundle: remove the import."
+    });
+  }
   for (const { rule, pattern, message } of BLOCKED_API_RULES) {
     if (pattern.test(html)) findings.push({ severity: "warning", rule, message });
   }
@@ -276,6 +292,7 @@ function validateBundle(inputPath, maxBytes = DEFAULT_MAX_BYTES) {
   };
 }
 var DEFAULT_OUT = "dist/whitelabel-bundle.zip";
+var DEFAULT_DEV_PORT = 5173;
 function parseArgs(argv) {
   const args = {
     command: "build",
@@ -283,6 +300,9 @@ function parseArgs(argv) {
     outPath: DEFAULT_OUT,
     maxBytes: DEFAULT_MAX_BYTES,
     strict: false,
+    scenario: "default",
+    port: DEFAULT_DEV_PORT,
+    nativeVersion: void 0,
     help: false
   };
   for (let i = 0; i < argv.length; i++) {
@@ -313,6 +333,18 @@ function parseArgs(argv) {
       case "validate":
         args.command = "validate";
         break;
+      case "dev":
+        args.command = "dev";
+        break;
+      case "--scenario":
+        args.scenario = argv[++i] ?? "default";
+        break;
+      case "--native-version":
+        args.nativeVersion = argv[++i] ?? "null";
+        break;
+      case "--port":
+        args.port = Number.parseInt(argv[++i] ?? "", 10) || DEFAULT_DEV_PORT;
+        break;
       default:
         if (token && !token.startsWith("-") && !args.htmlPath) args.htmlPath = token;
     }
@@ -324,24 +356,891 @@ var USAGE = `condor-mobile-bridge \u2014 tooling for Condor Canvas client bundle
 Usage:
   npx condor-mobile-bridge build    -i <html> [-o <zip>]
   npx condor-mobile-bridge validate -i <zip|html> [--strict]
+  npx condor-mobile-bridge canvas   publish|list|revoke ...   (see: canvas --help)
+  npx condor-mobile-bridge dev      -i <html|zip|dir> [--scenario <name>] [--native-version <v|null>] [--port <n>]
 
 Commands:
   build      Inline a dist/index.html into a self-contained .zip.
   validate   Check a bundle against every rule the Canvas app enforces, plus
              the APIs the sandbox and the CSP block at runtime.
+  canvas     Publish, list and revoke the bundle of your company in the
+             Condor Canvas app (interactive login). See: canvas --help.
+  dev        Serve the bundle in a browser harness that behaves like the app:
+             same sandbox, shell and policy, and a simulated native side.
+             Re-reads the input on every reload. Scenarios: default,
+             cold-start, no-devices, shared-serial, offline.
 
 Options:
   -i, --html <path>    Input. build: dist/index.html. validate: .zip or .html. Required.
   -o, --out <path>     build only: output .zip (default: ${DEFAULT_OUT}).
       --max-bytes <n>  Size limit in bytes (default: ${DEFAULT_MAX_BYTES} = 2 MB).
       --strict         validate only: exit 1 on warnings too, not just errors.
+      --scenario <n>   dev only: device behaviour to simulate (default: default).
+      --port <n>       dev only: HTTP port (default: ${DEFAULT_DEV_PORT}).
+      --native-version <v|null>
+                       dev only: nativeVersion the harness reports (default
+                       0.17.0). 'null' reproduces a shell that could not
+                       reach the native side.
   -h, --help           Show this help.`;
 
+// src/canvas-admin/client.ts
+var CANVAS_ADMIN_API = {
+  prod: "https://api.sleepdiary.condorapps.net",
+  dev: "https://dev.sleepdiary.condorapps.net"
+};
+var CanvasAdminError = class extends Error {
+  constructor(message, status, reason) {
+    super(message);
+    this.status = status;
+    this.reason = reason;
+    this.name = "CanvasAdminError";
+  }
+};
+function tokenFrom(headers) {
+  const values = typeof headers.getSetCookie === "function" ? headers.getSetCookie() : [headers.get("set-cookie") ?? ""];
+  for (const value of values) {
+    const match = /(?:^|[,;\s])token=([^;,\s]*)/.exec(value);
+    if (match?.[1]) return match[1];
+  }
+  return null;
+}
+async function reasonFrom(response) {
+  try {
+    const body = await response.json();
+    for (const key of ["error", "message", "description", "code"]) {
+      const value = body[key];
+      if (typeof value === "string" && value) return value;
+    }
+  } catch {
+  }
+  return null;
+}
+var CanvasAdminClient = class {
+  constructor(opts) {
+    this.token = null;
+    this.baseUrl = opts.baseUrl.replace(/\/+$/, "");
+    this.userAgent = opts.userAgent;
+    this.fetchImpl = opts.fetchImpl ?? fetch;
+    this.timeoutMs = opts.timeoutMs ?? 6e4;
+  }
+  async request(path, init = {}) {
+    const headers = new Headers(init.headers);
+    headers.set("user-agent", this.userAgent);
+    headers.set("accept", "application/json");
+    if (this.token) headers.set("cookie", `token=${this.token}`);
+    try {
+      return await this.fetchImpl(`${this.baseUrl}${path}`, {
+        ...init,
+        headers,
+        redirect: "manual",
+        signal: AbortSignal.timeout(this.timeoutMs)
+      });
+    } catch (err) {
+      throw new CanvasAdminError(
+        `Could not reach ${this.baseUrl}: ${err instanceof Error ? err.message : String(err)}`,
+        0,
+        null
+      );
+    }
+  }
+  async fail(response, what) {
+    const reason = await reasonFrom(response);
+    throw new CanvasAdminError(
+      `${what} failed (HTTP ${response.status})${reason ? `: ${reason}` : ""}`,
+      response.status,
+      reason
+    );
+  }
+  /**
+   * Logs in. Resolves `{ needsCode: true }` when the company requires a
+   * two-factor code (sent by e-mail): call {@link verifyCode} next.
+   */
+  async login(creds) {
+    const response = await this.request("/auth/login", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        company_id: creds.companyId,
+        user_id: creds.userId,
+        password: creds.password
+      })
+    });
+    if (!response.ok) await this.fail(response, "Login");
+    const token = tokenFrom(response.headers);
+    if (!token) throw new CanvasAdminError("Login answered without a session cookie", 200, null);
+    this.token = token;
+    const body = await response.json().catch(() => ({}));
+    return { needsCode: body.completed_auth_flow === false };
+  }
+  /** Sends the two-factor (or recovery) code; the server swaps the session cookie. */
+  async verifyCode(code) {
+    const response = await this.request("/auth/verify_2fa", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ otp_code: code })
+    });
+    if (!response.ok) await this.fail(response, "Two-factor verification");
+    const token = tokenFrom(response.headers);
+    if (token) this.token = token;
+  }
+  /**
+   * Publishes a bundle. **It goes live at once** for every user of the
+   * company: there is no draft. A version can be published only once per
+   * company (HTTP 409).
+   */
+  async publish(input) {
+    const form = new FormData();
+    form.set(
+      "bundle",
+      new Blob([input.zipBytes], { type: "application/zip" }),
+      "bundle.zip"
+    );
+    form.set("version", input.version);
+    if (input.companyId !== void 0) form.set("company_id", String(input.companyId));
+    if (input.minAppVersion) form.set("min_app_version", input.minAppVersion);
+    const response = await this.request("/v2/condor_canvas/bundles", {
+      method: "POST",
+      body: form
+    });
+    if (!response.ok) await this.fail(response, "Publish");
+    const body = await response.json();
+    return body.data;
+  }
+  /** Lists the bundles of a company (a manager always sees their own). */
+  async list(companyId) {
+    const query = companyId === void 0 ? "" : `?company_id=${companyId}`;
+    const response = await this.request(`/v2/condor_canvas/bundles${query}`);
+    if (!response.ok) await this.fail(response, "List");
+    const body = await response.json();
+    return body.data;
+  }
+  /**
+   * Revokes a bundle. Without `fallbackVersion`, revoking the current bundle
+   * leaves the company with none: the app shows its default screen.
+   */
+  async revoke(bundleId, fallbackVersion) {
+    const response = await this.request(`/v2/condor_canvas/bundles/${bundleId}/revoke`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify(fallbackVersion ? { fallbackVersion } : {})
+    });
+    if (!response.ok) await this.fail(response, "Revoke");
+    const body = await response.json();
+    return body.data;
+  }
+};
+
+// src/canvas-admin/command.ts
+var CANVAS_USAGE = `condor-mobile-bridge canvas \u2014 publish a bundle to the Condor Canvas app.
+
+Usage:
+  npx condor-mobile-bridge canvas publish <dist/index.html|dir|bundle.zip> --version <v> [options]
+  npx condor-mobile-bridge canvas list    [options]
+  npx condor-mobile-bridge canvas revoke  <bundleId> [--fallback-version <v>] [options]
+
+Publishing goes LIVE AT ONCE for every user of the company \u2014 there is no draft.
+Use a test company, and see docs/device-testing.md.
+
+Options:
+  --company <id>          Company id, as in the Condor web login (or CONDOR_CANVAS_COMPANY).
+  --user <id>             Your user id, as in the Condor web login (or CONDOR_CANVAS_USER).
+                          Both are asked when not given.
+  --version <v>           publish: bundle version, unique per company.
+  --min-app-version <v>   publish: minimum app build that may load it.
+  --fallback-version <v>  revoke: VERSION to serve instead (the version column of
+                          canvas list, e.g. 0.0.8 \u2014 not the id).
+  --env prod|dev          API environment (default: prod). dev is for Condor staff.
+  --base-url <url>        Override the API URL.
+  --yes                   Do not ask for confirmation.
+  --json                  Print results as JSON.
+
+Your password (and the two-factor code, when your company uses one) is asked
+interactively, without echo, and never stored. There is no non-interactive login.`;
+var intOrUndefined = (value) => {
+  if (value === void 0) return void 0;
+  const n = Number(value);
+  return Number.isInteger(n) && n > 0 ? n : Number.NaN;
+};
+function parseCanvasArgs(argv, env = {}) {
+  const [action, ...rest] = argv;
+  if (action !== "publish" && action !== "list" && action !== "revoke") {
+    return { error: `Unknown canvas command "${action ?? ""}". Use publish, list or revoke.` };
+  }
+  const args = {
+    action,
+    env: "prod",
+    yes: false,
+    json: false,
+    companyId: intOrUndefined(env.CONDOR_CANVAS_COMPANY),
+    userId: intOrUndefined(env.CONDOR_CANVAS_USER)
+  };
+  const positional = [];
+  for (let i = 0; i < rest.length; i++) {
+    const token = rest[i] ?? "";
+    const next = () => rest[++i];
+    switch (token) {
+      case "--env": {
+        const env2 = next();
+        if (env2 !== "prod" && env2 !== "dev") return { error: "--env must be prod or dev." };
+        args.env = env2;
+        break;
+      }
+      case "--base-url":
+        args.baseUrl = next();
+        break;
+      case "--company":
+        args.companyId = intOrUndefined(next());
+        break;
+      case "--user":
+        args.userId = intOrUndefined(next());
+        break;
+      case "--version":
+        args.version = next();
+        break;
+      case "--min-app-version":
+        args.minAppVersion = next();
+        break;
+      case "--fallback-version":
+        args.fallbackVersion = next();
+        break;
+      case "--yes":
+        args.yes = true;
+        break;
+      case "--json":
+        args.json = true;
+        break;
+      case "--password":
+        return {
+          error: "There is no --password flag: the password is only read from the prompt."
+        };
+      default:
+        if (token.startsWith("-")) return { error: `Unknown option ${token}.` };
+        positional.push(token);
+    }
+  }
+  if (Number.isNaN(args.companyId) || Number.isNaN(args.userId)) {
+    return {
+      error: "--company and --user (or CONDOR_CANVAS_COMPANY / CONDOR_CANVAS_USER) take a positive integer id."
+    };
+  }
+  if (action === "publish") {
+    args.input = positional[0];
+    if (!args.input)
+      return { error: "canvas publish needs the bundle: dist/index.html, a dir or a .zip." };
+    if (!args.version) return { error: "canvas publish needs --version." };
+  }
+  if (action === "revoke") {
+    args.bundleId = intOrUndefined(positional[0]);
+    if (!args.bundleId || Number.isNaN(args.bundleId)) {
+      return { error: "canvas revoke needs the bundle id (see canvas list)." };
+    }
+  }
+  return args;
+}
+function loadZip(input) {
+  const path = resolve2(input);
+  if (!existsSync(path)) throw new Error(`${input}: not found.`);
+  let zipBytes;
+  if (extname2(path).toLowerCase() === ".zip") {
+    zipBytes = new Uint8Array(readFileSync2(path));
+  } else {
+    const html = statSync(path).isDirectory() ? join(path, "index.html") : path;
+    zipBytes = buildBundle(html).zipBytes;
+  }
+  return { zipBytes, findings: validateZipBytes(zipBytes).findings };
+}
+async function askId(io, label, value) {
+  if (value !== void 0) return value;
+  const answer = (await io.ask(`${label}: `)).trim();
+  const n = Number(answer);
+  if (!Number.isInteger(n) || n <= 0) throw new Error(`${label} must be a positive integer.`);
+  return n;
+}
+async function confirm(io, args, question2) {
+  if (args.yes) return true;
+  const answer = (await io.ask(`${question2} [y/N] `)).trim().toLowerCase();
+  return answer === "y" || answer === "yes";
+}
+async function logIn(io, client, companyId, userId) {
+  io.print("");
+  io.print("Log in with your Condor web account (typing is hidden; press Enter when done).");
+  let password = "";
+  for (let attempt = 0; attempt < 3 && !password.trim(); attempt++) {
+    if (attempt > 0) io.printError("The password cannot be empty.");
+    password = await io.askSecret("Password: ");
+  }
+  if (!password.trim()) throw new Error("No password given. Nothing was sent.");
+  const { needsCode } = await client.login({ companyId, userId, password });
+  if (!needsCode) return;
+  io.print(
+    "Your company uses two-factor login: a code was sent to your e-mail. Type it below (hidden)."
+  );
+  for (let attempt = 1; attempt <= 2; attempt++) {
+    const code = (await io.askSecret("Code (or a recovery code): ")).trim();
+    try {
+      await client.verifyCode(code);
+      return;
+    } catch (err) {
+      if (attempt === 2 || !(err instanceof CanvasAdminError) || err.status !== 400) throw err;
+      io.printError("That code was not accepted. Try once more.");
+    }
+  }
+}
+function describeError(err) {
+  if (!(err instanceof CanvasAdminError)) return err instanceof Error ? err.message : String(err);
+  if (err.status === 400 && /fallback/i.test(err.reason ?? "")) {
+    return `${err.message}
+--fallback-version takes the VERSION column of \`canvas list\` (e.g. 0.0.8), not the id.`;
+  }
+  switch (err.status) {
+    case 401:
+      return `${err.message}
+Check the company id, user id and password.`;
+    case 403:
+      return `${err.message}
+Your user cannot do this for that company: publishing needs a manager of the company.`;
+    case 409:
+      return `${err.message}
+This version was already published for the company. Use a new --version.`;
+    case 413:
+      return `${err.message}
+The .zip is over 2 MB.`;
+    default:
+      return err.message;
+  }
+}
+function table(rows) {
+  if (rows.length === 0) return ["No bundle published for this company."];
+  return [
+    "id      version        current  revoked  published_at                min_app",
+    ...rows.map(
+      (r) => `${String(r.id).padEnd(8)}${r.version.padEnd(15)}${(r.is_current ? "yes" : "").padEnd(9)}${(r.revoked ? "yes" : "").padEnd(9)}${(r.published_at ?? "").padEnd(28)}${r.min_app_version ?? ""}`
+    )
+  ];
+}
+async function runCanvas(args, io, deps) {
+  const baseUrl = args.baseUrl ?? CANVAS_ADMIN_API[args.env];
+  const envLabel = args.baseUrl ? `custom (${baseUrl})` : `${args.env.toUpperCase()} (${baseUrl})`;
+  try {
+    let zip;
+    if (args.action === "publish") {
+      zip = loadZip(args.input ?? "");
+      const errors = zip.findings.filter((f) => f.severity === "error");
+      for (const f of zip.findings) {
+        (f.severity === "error" ? io.printError : io.print)(
+          `${f.severity.toUpperCase()} [${f.rule}] ${f.message}`
+        );
+      }
+      if (errors.length > 0) {
+        io.printError("The app would reject this bundle. Nothing was sent.");
+        return 1;
+      }
+    }
+    if (!io.interactive) {
+      io.printError(
+        "canvas needs an interactive terminal: the password is only read from a prompt."
+      );
+      return 1;
+    }
+    const companyId = await askId(io, "Company id", args.companyId);
+    const userId = await askId(io, "User id", args.userId);
+    if (args.action === "publish" && zip) {
+      const hash = `sha256-${createHash2("sha256").update(zip.zipBytes).digest("hex")}`;
+      io.print("");
+      io.print(`Environment:  ${envLabel}`);
+      io.print(`Company:      ${companyId}`);
+      io.print(
+        `Version:      ${args.version}${args.minAppVersion ? ` (min app ${args.minAppVersion})` : ""}`
+      );
+      io.print(`Bundle:       ${zip.zipBytes.length} bytes, ${hash}`);
+      io.print("It goes LIVE AT ONCE for every user of this company.");
+      if (!await confirm(io, args, "Publish?")) {
+        io.print("Cancelled. Nothing was sent.");
+        return 1;
+      }
+    }
+    if (args.action === "revoke") {
+      io.print("");
+      io.print(`Environment:  ${envLabel}`);
+      io.print(`Revoke bundle ${args.bundleId} of company ${companyId}.`);
+      io.print(
+        args.fallbackVersion ? `The app switches to version ${args.fallbackVersion} (a version, not an id).` : "Without --fallback-version, revoking the current bundle leaves the company with none: the app shows its default screen."
+      );
+      if (!await confirm(io, args, "Revoke?")) {
+        io.print("Cancelled. Nothing was sent.");
+        return 1;
+      }
+    }
+    const client = new CanvasAdminClient({
+      baseUrl,
+      userAgent: deps.userAgent,
+      fetchImpl: deps.fetchImpl
+    });
+    await logIn(io, client, companyId, userId);
+    if (args.action === "publish" && zip) {
+      const record = await client.publish({
+        zipBytes: zip.zipBytes,
+        version: args.version ?? "",
+        companyId,
+        minAppVersion: args.minAppVersion
+      });
+      if (args.json) io.print(JSON.stringify(record));
+      else {
+        io.print(
+          `Published version ${record.version} (id ${record.id}) \u2014 current: ${record.is_current}.`
+        );
+        io.print(`bundleHash: ${record.bundle_hash}`);
+        io.print("Apps of this company load it the next time they come to the foreground.");
+      }
+      return 0;
+    }
+    if (args.action === "list") {
+      const rows = await client.list(companyId);
+      if (args.json) io.print(JSON.stringify(rows));
+      else for (const line of table(rows)) io.print(line);
+      return 0;
+    }
+    const result = await client.revoke(args.bundleId ?? 0, args.fallbackVersion);
+    io.print(args.json ? JSON.stringify(result) : `Revoked. ${JSON.stringify(result)}`);
+    return 0;
+  } catch (err) {
+    io.printError(describeError(err));
+    return 1;
+  }
+}
+
+// src/canvas-admin/tty.ts
+import { createInterface } from "readline";
+var rl = null;
+var mutedPrompt = null;
+function reader() {
+  if (rl) return rl;
+  rl = createInterface({ input: process.stdin, output: process.stderr, terminal: true });
+  const out = rl;
+  const write = out._writeToOutput.bind(rl);
+  out._writeToOutput = (s) => {
+    if (mutedPrompt === null || s.includes(mutedPrompt)) write(s);
+  };
+  return rl;
+}
+function question(prompt, secret) {
+  const r = reader();
+  return new Promise((resolve5) => {
+    mutedPrompt = secret ? prompt : null;
+    r.question(prompt, (answer) => {
+      if (secret) {
+        mutedPrompt = null;
+        process.stderr.write("\n");
+      }
+      resolve5(answer);
+    });
+  });
+}
+function terminalIo() {
+  return {
+    interactive: Boolean(process.stdin.isTTY),
+    ask: (q) => question(q, false),
+    askSecret: (q) => question(q, true),
+    print: (line) => console.log(line),
+    printError: (line) => console.error(line)
+  };
+}
+function closeTerminalIo() {
+  rl?.close();
+  rl = null;
+}
+
+// src/cli-dev.ts
+import { existsSync as existsSync2, readFileSync as readFileSync3, statSync as statSync2 } from "fs";
+import { createServer } from "http";
+import { dirname as dirname2, extname as extname3, join as join2, resolve as resolve3 } from "path";
+import { fileURLToPath } from "url";
+import { strFromU8, unzipSync as unzipSync2 } from "fflate";
+
+// src/keys.ts
+var BRIDGE_KEYS = {
+  pingPong: "pingPong",
+  userDevice: "userDevice",
+  deviceLightSensors: "deviceLightSensors",
+  syncTime: "syncTime",
+  realTime: "realTime",
+  deleteMemory: "deleteMemory",
+  deviceNotification: "deviceNotification",
+  deviceConnection: "deviceConnection",
+  sensorLog: "sensorLog",
+  dfu: "dfu",
+  systemStatus: "systemStatus",
+  /**
+   * Native → client: the OS back button was pressed and the client had
+   * reported internal history via `reportNavigation(true)`. Go back exactly
+   * ONE internal page. Emitted only when the native side decided to delegate
+   * the back gesture. See `BridgeClient.onBack`.
+   */
+  navigationBack: "navigationBack",
+  /**
+   * Native → client: the app's language state. Carries the raw device locale
+   * AND the language explicitly chosen in the app Settings, so the client can
+   * apply its own precedence rule — including rendering a language the native
+   * chrome does not support. Emitted on attach, after `handshake-ack`, and on
+   * every change in Settings. See `LanguagePayload`.
+   */
+  language: "language"
+};
+
+// src/dev/policy.ts
+var CANVAS_POLICY = {
+  readOnlyKeys: [
+    BRIDGE_KEYS.userDevice,
+    BRIDGE_KEYS.deviceConnection,
+    BRIDGE_KEYS.deviceLightSensors,
+    BRIDGE_KEYS.deviceNotification,
+    BRIDGE_KEYS.pingPong,
+    BRIDGE_KEYS.realTime,
+    BRIDGE_KEYS.syncTime,
+    BRIDGE_KEYS.deleteMemory,
+    BRIDGE_KEYS.sensorLog,
+    BRIDGE_KEYS.systemStatus,
+    BRIDGE_KEYS.navigationBack,
+    BRIDGE_KEYS.language
+  ],
+  allowedCommands: [
+    "userDevice",
+    "realTime",
+    "openSettings",
+    "deviceConnection",
+    "ping",
+    "jsError",
+    "sensorLog",
+    "setStatusBarColor",
+    "requestPermission",
+    "navigationState",
+    "language"
+  ],
+  requiresConfirmation: ["syncTime", "deleteMemory", "logout"],
+  deniedCommands: ["dfu"]
+};
+var CANVAS_CSP = "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src 'self'; frame-src 'self'; object-src 'none'; base-uri 'none'; form-action 'none';";
+
+// src/dev/fixtures.ts
+function config(spec) {
+  const item = {
+    deviceId: spec.deviceId,
+    serialNo: spec.serialNo,
+    deviceBodyPart: spec.bodyPart,
+    bleConnectionPeriod: 5,
+    autosync: true,
+    eraseDeviceMemory: false,
+    autoEraseDeviceMemory: false,
+    autoEraseDeviceMemoryThreshold: 80,
+    readSensorsMemory: false,
+    startDevice: false,
+    readFullMemory: false,
+    allowFirmwareUpdate: true
+  };
+  if (spec.modelId) item.modelId = spec.modelId;
+  return item;
+}
+function telemetry(spec, now) {
+  return {
+    serialNo: spec.serialNo,
+    deviceId: spec.deviceId,
+    updataDateTime: now - spec.syncedMinutesAgo * 6e4,
+    deviceName: spec.name,
+    deviceVersion: spec.modelId === "actlumus_plus" ? "3.0.2" : "2.1.0",
+    hardwareVersion: spec.modelId === "actlumus_plus" ? "B" : "A",
+    deviceDateTime: now - spec.syncedMinutesAgo * 6e4,
+    memoryDataUsage: 37.5,
+    memorySystemUsage: 4.2,
+    batteryLevel: spec.battery,
+    batteryVoltage: 3.7 + spec.battery / 1e3,
+    isCharging: spec.charging,
+    isOnDock: spec.charging,
+    syncErrors: spec.syncError ? [
+      {
+        serialNo: spec.serialNo,
+        attemptDate: now - 10 * 6e4,
+        message: spec.syncError,
+        messageCode: "SYNC_FAILED"
+      }
+    ] : []
+  };
+}
+function userConfig(spec) {
+  return {
+    serialNo: spec.serialNo,
+    deviceId: spec.deviceId,
+    syncTime: false,
+    realTime: false,
+    deleteMemory: false,
+    readAllMemory: false,
+    readAllSystemLog: false
+  };
+}
+function payloadOf(specs, now = Date.now()) {
+  return {
+    lastUpdate: now,
+    devicesConfig: specs.map(config),
+    devicesTelemetry: specs.map((s) => telemetry(s, now)),
+    devicesUserConfig: specs.map(userConfig)
+  };
+}
+function twoDevices(now = Date.now()) {
+  return payloadOf(
+    [
+      {
+        deviceId: 9001,
+        serialNo: 4534,
+        modelId: "actlumus",
+        bodyPart: "wrist",
+        name: "ActLumus 4534",
+        battery: 82,
+        charging: false,
+        syncedMinutesAgo: 12
+      },
+      {
+        deviceId: 9002,
+        serialNo: 5120,
+        modelId: "actlumus_plus",
+        bodyPart: "necklace",
+        name: "ActLumus Plus 5120",
+        battery: 41,
+        charging: true,
+        syncedMinutesAgo: 190,
+        syncError: "Could not read the device memory."
+      }
+    ],
+    now
+  );
+}
+function sharedSerial(now = Date.now()) {
+  return payloadOf(
+    [
+      {
+        deviceId: 9101,
+        serialNo: 7047,
+        bodyPart: "wrist",
+        name: "ActLumus 7047",
+        battery: 67,
+        charging: false,
+        syncedMinutesAgo: 30
+      },
+      {
+        deviceId: 9102,
+        serialNo: 7047,
+        modelId: "actlumus_plus",
+        bodyPart: "necklace",
+        name: "ActLumus Plus 7047",
+        battery: 93,
+        charging: false,
+        syncedMinutesAgo: 8
+      }
+    ],
+    now
+  );
+}
+function systemStatus(overrides = {}) {
+  return {
+    bluetooth: true,
+    internet: true,
+    permission: true,
+    hasDevices: true,
+    missingOptionalPermissions: [],
+    missingEssentialPermissions: [],
+    deviceSyncError: {},
+    deviceSyncErrorById: {},
+    ...overrides
+  };
+}
+
+// src/dev/scenarios.ts
+var HARNESS_NATIVE_VERSION = "0.17.0";
+var base = {
+  description: "Two devices, background service already running, realistic latency.",
+  nativeVersion: HARNESS_NATIVE_VERSION,
+  latencyMs: [80, 250],
+  serviceStartMs: 0,
+  userDeviceSilent: false,
+  logPeriodS: 60,
+  systemStatus: systemStatus(),
+  devices: () => twoDevices()
+};
+var SCENARIOS = {
+  default: base,
+  "cold-start": {
+    ...base,
+    description: "App launched from cold: the background service takes 4 s to start, and every ping/userDevice sent before that is lost. A bundle that asks once stays on its loading screen forever.",
+    serviceStartMs: 4e3
+  },
+  "no-devices": {
+    ...base,
+    description: "Account with no linked device: userDevice never answers and systemStatus.hasDevices is false. Your bundle must show an empty state.",
+    userDeviceSilent: true,
+    systemStatus: systemStatus({ hasDevices: false })
+  },
+  "shared-serial": {
+    ...base,
+    description: "An ActLumus and an ActLumus Plus share serial number 7047. Only deviceId tells them apart; sensorLog cannot address one of them.",
+    devices: () => sharedSerial()
+  },
+  offline: {
+    ...base,
+    description: "No internet. systemStatus.internet is false and sensorLog fails; userDevice answers from the cache.",
+    sensorLogError: "Connection failed",
+    systemStatus: systemStatus({ internet: false })
+  }
+};
+
+// src/cli-dev.ts
+function readClientHtml(input) {
+  const path = resolve3(input);
+  if (existsSync2(path) && statSync2(path).isDirectory()) {
+    return inlineHtml(join2(path, "index.html"));
+  }
+  if (extname3(path).toLowerCase() === ".zip") {
+    const files = unzipSync2(new Uint8Array(readFileSync3(path)));
+    const entry = files["index.html"];
+    if (!entry) throw new Error(`${input}: no index.html at the root of the zip.`);
+    return strFromU8(entry);
+  }
+  return inlineHtml(path);
+}
+var escapeHtml = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+function harnessPage(scenario, nativeVersion) {
+  const options = Object.entries(SCENARIOS).map(
+    ([name, s]) => `<option value="${name}" title="${escapeHtml(s.description)}"${name === scenario ? " selected" : ""}>${name}</option>`
+  ).join("");
+  const description = escapeHtml(SCENARIOS[scenario]?.description ?? "");
+  const scenarioJson = JSON.stringify(scenario).replace(/</g, "\\u003c");
+  const nativeJson = JSON.stringify(
+    nativeVersion === void 0 ? void 0 : nativeVersion === "null" ? null : nativeVersion
+  )?.replace(/</g, "\\u003c") ?? "undefined";
+  const nativeLabel = escapeHtml(
+    nativeVersion === void 0 ? "" : `nativeVersion ${nativeVersion}`
+  );
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta http-equiv="Content-Security-Policy" content="${CANVAS_CSP}">
+<title>Condor Canvas \u2014 dev harness</title>
+<style>
+  body { margin: 0; font: 13px system-ui, sans-serif; background: #e9ebef; color: #1b1f24; }
+  header { display: flex; gap: 12px; align-items: center; padding: 8px 16px; background: #1b1f24; color: #fff; flex-wrap: wrap; }
+  header p { margin: 0; opacity: .8; flex: 1 1 320px; }
+  main { display: flex; justify-content: center; padding: 16px; }
+  #device { width: 390px; height: 780px; max-width: 100%; border-radius: 28px; overflow: hidden; box-shadow: 0 10px 40px rgba(0,0,0,.25); background: #fff; }
+</style>
+</head>
+<body>
+<header>
+  <strong>Condor Canvas \xB7 dev harness</strong>
+  <label>Scenario <select id="scenario">${options}</select></label>
+  <button id="back" type="button" title="The OS back button: reaches the bundle only after it reported canGoBack true">\u25C0 OS back</button>
+  <span>${nativeLabel}</span>
+  <p>${description}</p>
+</header>
+<main><div id="device"></div></main>
+<script src="/__condor/harness.js"></script>
+<script>
+  var scenario = ${scenarioJson};
+  var nativeVersion = ${nativeJson};
+  var harness = null;
+  document.getElementById('scenario').addEventListener('change', function (e) {
+    var params = new URLSearchParams(location.search);
+    params.set('scenario', e.target.value);
+    location.search = params.toString();
+  });
+  document.getElementById('back').addEventListener('click', function () {
+    if (harness) harness.pressBack();
+  });
+  var chosen = CondorDevHarness.SCENARIOS[scenario];
+  if (nativeVersion !== undefined) chosen = Object.assign({}, chosen, { nativeVersion: nativeVersion });
+  fetch('/__condor/client.html')
+    .then(function (r) { if (!r.ok) throw new Error('could not read the bundle: HTTP ' + r.status); return r.text(); })
+    .then(function (html) {
+      return CondorDevHarness.createDevHarness({ html: html, scenario: chosen, mount: document.getElementById('device') });
+    })
+    .then(function (h) { harness = h; })
+    .catch(function (err) { document.getElementById('device').textContent = String(err); console.error(err); });
+</script>
+</body>
+</html>`;
+}
+function harnessScriptPath() {
+  const here = typeof __dirname !== "undefined" ? __dirname : dirname2(fileURLToPath(import.meta.url));
+  return join2(here, "dev-harness.global.js");
+}
+function startDevServer(opts) {
+  if (!(opts.scenario in SCENARIOS)) {
+    throw new Error(
+      `Unknown scenario "${opts.scenario}". Known: ${Object.keys(SCENARIOS).join(", ")}.`
+    );
+  }
+  readClientHtml(opts.input);
+  const server = createServer((req, res) => {
+    const url = new URL(req.url ?? "/", "http://localhost");
+    try {
+      if (url.pathname === "/__condor/client.html") {
+        res.writeHead(200, {
+          "content-type": "text/html; charset=utf-8",
+          "cache-control": "no-store"
+        });
+        res.end(readClientHtml(opts.input));
+        return;
+      }
+      if (url.pathname === "/__condor/harness.js") {
+        res.writeHead(200, {
+          "content-type": "text/javascript; charset=utf-8",
+          "cache-control": "no-store"
+        });
+        res.end(readFileSync3(harnessScriptPath()));
+        return;
+      }
+      if (url.pathname === "/") {
+        const scenario = url.searchParams.get("scenario") ?? opts.scenario;
+        res.writeHead(200, {
+          "content-type": "text/html; charset=utf-8",
+          "content-security-policy": CANVAS_CSP,
+          "cache-control": "no-store"
+        });
+        const nativeVersion = url.searchParams.get("nativeVersion") ?? opts.nativeVersion;
+        res.end(harnessPage(scenario in SCENARIOS ? scenario : opts.scenario, nativeVersion));
+        return;
+      }
+      res.writeHead(404).end();
+    } catch (err) {
+      res.writeHead(500, { "content-type": "text/plain; charset=utf-8" });
+      res.end(String(err instanceof Error ? err.message : err));
+    }
+  });
+  server.listen(opts.port, "127.0.0.1");
+  return server;
+}
+
 // src/cli.ts
+function runDev(input, scenario, port, nativeVersion) {
+  const server = startDevServer({ input, scenario, port, nativeVersion });
+  server.on("listening", () => {
+    const native = nativeVersion === void 0 ? "" : `&nativeVersion=${nativeVersion}`;
+    console.log(
+      `Condor Canvas dev harness: http://localhost:${port}/?scenario=${scenario}${native}`
+    );
+    console.log(`  bundle:   ${input} (re-read on every reload)`);
+    console.log("  sandbox, shell policy and CSP: same as the app");
+    console.log("  scenarios: default, cold-start, no-devices, shared-serial, offline");
+    console.log('  OS back button: the "\u25C0 OS back" button at the top');
+    console.log("\nA bundle is ready for a device only when it handles every scenario.");
+  });
+  server.on("error", (err) => {
+    console.error(`dev: ${err.message}`);
+    process.exit(1);
+  });
+}
 function runBuild(htmlPath, outPath, maxBytes) {
   const result = buildBundle(htmlPath, maxBytes);
-  const resolvedOut = resolve2(outPath);
-  mkdirSync(dirname2(resolvedOut), { recursive: true });
+  const resolvedOut = resolve4(outPath);
+  mkdirSync(dirname3(resolvedOut), { recursive: true });
   writeFileSync(resolvedOut, result.zipBytes);
   const kb = (Buffer.byteLength(result.html) / 1024).toFixed(1);
   console.log(`Built ${outPath}`);
@@ -390,12 +1289,42 @@ ${errors.length} error(s), ${warnings.length} warning(s).` + (result.size === nu
   );
   return 0;
 }
+async function runCanvasCommand(argv) {
+  if (argv.length === 0 || argv.includes("--help") || argv.includes("-h")) {
+    console.log(CANVAS_USAGE);
+    process.exit(argv.length === 0 ? 1 : 0);
+  }
+  const parsed = parseCanvasArgs(argv, process.env);
+  if ("error" in parsed) {
+    console.error(parsed.error);
+    console.error("Run `condor-mobile-bridge canvas --help`.");
+    process.exit(1);
+  }
+  const code = await runCanvas(parsed, terminalIo(), {
+    userAgent: `condor-mobile-bridge-cli/${version}`
+  });
+  closeTerminalIo();
+  process.exit(code);
+}
 function main() {
+  if (process.argv[2] === "canvas") {
+    void runCanvasCommand(process.argv.slice(3));
+    return;
+  }
   const args = parseArgs(process.argv.slice(2));
   if (args.help || !args.htmlPath) {
     console.log(USAGE);
     process.exit(args.help ? 0 : 1);
   }
+  if (args.command === "dev") {
+    try {
+      runDev(args.htmlPath, args.scenario, args.port, args.nativeVersion);
+    } catch (err) {
+      console.error(`dev: ${err instanceof Error ? err.message : String(err)}`);
+      process.exit(1);
+    }
+    return;
+  }
   if (args.command === "validate") {
     const result = validateBundle(args.htmlPath, args.maxBytes);
     process.exit(reportValidation(args.htmlPath, result, args.strict));