@dereekb/dbx-cli 13.22.0 → 13.24.0

package/lint-cache/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dereekb/dbx-cli-lint-cache",
-  "version": "13.22.0",
+  "version": "13.24.0",
   "private": true,
   "type": "module",
   "devDependencies": {
@@ -8,7 +8,7 @@
     "eslint": "10.4.0"
   },
   "peerDependencies": {
-    "@dereekb/util": "13.22.0",
+    "@dereekb/util": "13.24.0",
     "yargs": "^18.0.0"
   }
 }

package/manifest-extract/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@dereekb/dbx-cli/manifest-extract",
-  "version": "13.22.0",
+  "version": "13.24.0",
   "sideEffects": false,
   "peerDependencies": {
     "@dereekb/date": "13.15.0",
-    "@dereekb/dbx-cli": "13.22.0",
+    "@dereekb/dbx-cli": "13.24.0",
     "@dereekb/firebase": "13.15.0",
     "@dereekb/model": "13.15.0",
     "@dereekb/nestjs": "13.15.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dereekb/dbx-cli",
-  "version": "13.22.0",
+  "version": "13.24.0",
   "type": "module",
   "sideEffects": false,
   "bin": {
@@ -66,11 +66,11 @@
     }
   },
   "peerDependencies": {
-    "@dereekb/date": "13.22.0",
-    "@dereekb/firebase": "13.22.0",
-    "@dereekb/model": "13.22.0",
-    "@dereekb/nestjs": "13.22.0",
-    "@dereekb/util": "13.22.0",
+    "@dereekb/date": "13.24.0",
+    "@dereekb/firebase": "13.24.0",
+    "@dereekb/model": "13.24.0",
+    "@dereekb/nestjs": "13.24.0",
+    "@dereekb/util": "13.24.0",
     "@nestjs/common": "^11.1.19",
     "arktype": "^2.2.0",
     "jiti": "2.6.1",

package/route/package.json

@@ -1,14 +1,14 @@
 {
   "name": "@dereekb/dbx-cli/route",
-  "version": "13.22.0",
+  "version": "13.24.0",
   "sideEffects": false,
   "peerDependencies": {
-    "@dereekb/date": "13.22.0",
-    "@dereekb/dbx-cli": "13.22.0",
-    "@dereekb/firebase": "13.22.0",
-    "@dereekb/model": "13.22.0",
-    "@dereekb/nestjs": "13.22.0",
-    "@dereekb/util": "13.22.0"
+    "@dereekb/date": "13.24.0",
+    "@dereekb/dbx-cli": "13.24.0",
+    "@dereekb/firebase": "13.24.0",
+    "@dereekb/model": "13.24.0",
+    "@dereekb/nestjs": "13.24.0",
+    "@dereekb/util": "13.24.0"
   },
   "exports": {
     "./package.json": "./package.json",

package/src/lib/auth/oidc.client.d.ts

@@ -1,174 +1,51 @@
-import { type Maybe } from '@dereekb/util';
+import { type DiscoverOidcMetadataInput, type ExchangeAuthorizationCodeInput, type FetchSessionInfoInput, type FetchUserInfoInput, type OidcDiscoveryMetadata, type OidcSessionInfo, type OidcTokenResponse, type RefreshAccessTokenInput, type RevokeTokenInput } from '@dereekb/util';
 /**
- * The subset of fields we read from an OIDC discovery document.
+ * Converts an {@link OidcRelyingPartyError} thrown by the shared core into the CLI's {@link CliError}
+ * (preserving message + mapped code + suggestion). Any other value is returned unchanged.
  *
- * The CLI only uses the authorization, token, userinfo, and revocation endpoints to drive
- * the authorization-code-with-PKCE flow.
+ * @param error - The thrown value.
+ * @returns A {@link CliError} for relying-party errors, otherwise the original value.
  */
-export interface OidcDiscoveryMetadata {
-    readonly issuer: string;
-    readonly authorization_endpoint: string;
-    readonly token_endpoint: string;
-    readonly userinfo_endpoint?: string;
-    readonly revocation_endpoint?: string;
-    readonly end_session_endpoint?: string;
-    readonly jwks_uri?: string;
-    readonly scopes_supported?: string[];
-}
+export declare function oidcRelyingPartyErrorToCliError(error: unknown): unknown;
 /**
- * Token response from a successful `authorization_code` or `refresh_token` exchange.
- */
-export interface OidcTokenResponse {
-    readonly access_token: string;
-    readonly token_type?: string;
-    readonly expires_in?: number;
-    readonly refresh_token?: string;
-    readonly id_token?: string;
-    readonly scope?: string;
-}
-export interface DiscoverOidcMetadataInput {
-    readonly issuer: string;
-    /**
-     * Optional sibling base URL to try after the issuer-prefixed and origin-rooted paths.
-     *
-     * Useful when the discovery doc is served at `<api-base-url>/.well-known/openid-configuration`
-     * — e.g. when the issuer is reached via a different host than the API and the origin-rooted
-     * candidate would target the wrong host.
-     */
-    readonly fallbackBaseUrl?: string;
-}
-/**
- * Builds the ordered list of `.well-known/openid-configuration` URLs the CLI probes when
- * discovering OIDC metadata.
- *
- *   1. `<issuer>/.well-known/openid-configuration` (OpenID Connect Discovery 1.0).
- *   2. `<issuer-origin>/.well-known/openid-configuration` (host-rooted; matches projects that
- *      mount the discovery controller at the API/dev-server root rather than under the issuer
- *      sub-path — e.g. demo's `OidcWellKnownController`).
- *   3. `<fallbackBaseUrl>/.well-known/openid-configuration` when supplied and not already covered.
- *
- * Exported so diagnostic surfaces (e.g. `doctor`) can show the exact URLs the discovery step
- * tried — without re-implementing the candidate ordering.
- *
- * @param input - The discovery request.
- * @param input.issuer - The OIDC issuer URL whose `.well-known/openid-configuration` is fetched first.
- * @param input.fallbackBaseUrl - Optional sibling base URL appended after the issuer-prefixed and origin-rooted candidates.
- * @returns The candidate URL list in probe order, de-duplicated.
- */
-export declare function buildOidcDiscoveryCandidates(input: DiscoverOidcMetadataInput): string[];
-/**
- * Fetches the OIDC discovery document for the given issuer, trying the candidates returned by
- * {@link buildOidcDiscoveryCandidates} in order.
+ * Fetches the OIDC discovery document for the given issuer.
  *
  * @param input - The discovery request.
- * @param input.issuer - The OIDC issuer URL whose `.well-known/openid-configuration` is fetched first.
- * @param input.fallbackBaseUrl - Optional sibling base URL tried after the issuer-prefixed and origin-rooted candidates.
  * @returns The parsed {@link OidcDiscoveryMetadata}. Throws a {@link CliError} (`OIDC_DISCOVERY_FAILED`) when every candidate fails.
  */
 export declare function discoverOidcMetadata(input: DiscoverOidcMetadataInput): Promise<OidcDiscoveryMetadata>;
-export interface ExchangeAuthorizationCodeInput {
-    readonly tokenEndpoint: string;
-    readonly clientId: string;
-    readonly clientSecret: string;
-    readonly redirectUri: string;
-    readonly code: string;
-    readonly codeVerifier: string;
-}
 /**
  * Exchanges an authorization code (from the redirect) for an access token + refresh token.
  *
- * Uses `client_secret_post` auth — the demo's oidc-provider config registers clients with that method.
- *
  * @param input - The token exchange parameters.
- * @param input.tokenEndpoint - The OIDC token endpoint URL discovered from the issuer.
- * @param input.clientId - The OAuth client ID.
- * @param input.clientSecret - The OAuth client secret used for `client_secret_post` auth.
- * @param input.redirectUri - The redirect URI registered with the OAuth client (must match the value used when requesting the code).
- * @param input.code - The authorization code returned to the redirect URI.
- * @param input.codeVerifier - The PKCE code verifier originally paired with the code challenge in the authorization request.
  * @returns The parsed {@link OidcTokenResponse} with access/refresh tokens.
  */
 export declare function exchangeAuthorizationCode(input: ExchangeAuthorizationCodeInput): Promise<OidcTokenResponse>;
-export interface RefreshAccessTokenInput {
-    readonly tokenEndpoint: string;
-    readonly clientId: string;
-    readonly clientSecret: string;
-    readonly refreshToken: string;
-}
 /**
  * Exchanges a refresh token for a new access token (and possibly a rotated refresh token).
  *
  * @param input - The refresh request.
- * @param input.tokenEndpoint - The OIDC token endpoint URL discovered from the issuer.
- * @param input.clientId - The OAuth client ID.
- * @param input.clientSecret - The OAuth client secret used for `client_secret_post` auth.
- * @param input.refreshToken - The cached refresh token to redeem.
  * @returns The parsed {@link OidcTokenResponse} with the refreshed access token.
  */
 export declare function refreshAccessToken(input: RefreshAccessTokenInput): Promise<OidcTokenResponse>;
-export interface RevokeTokenInput {
-    readonly revocationEndpoint: string;
-    readonly clientId: string;
-    readonly clientSecret: string;
-    readonly token: string;
-    readonly tokenTypeHint?: 'access_token' | 'refresh_token';
-}
 /**
  * Revokes an access or refresh token at the OIDC revocation endpoint.
  *
  * @param input - The revocation request.
- * @param input.revocationEndpoint - The OIDC revocation endpoint URL.
- * @param input.clientId - The OAuth client ID used for `client_secret_post` auth.
- * @param input.clientSecret - The OAuth client secret used for `client_secret_post` auth.
- * @param input.token - The access or refresh token to revoke.
- * @param input.tokenTypeHint - Optional hint passed as `token_type_hint` (`access_token` or `refresh_token`).
  * @returns Resolves when the server returns a non-error status. Throws a {@link CliError} (`TOKEN_REVOCATION_FAILED`) on error.
  */
 export declare function revokeToken(input: RevokeTokenInput): Promise<void>;
-export interface FetchUserInfoInput {
-    readonly userinfoEndpoint: string;
-    readonly accessToken: string;
-}
 /**
  * Fetches the OIDC `userinfo` endpoint and returns the parsed claims object.
  *
  * @param input - The userinfo request.
- * @param input.userinfoEndpoint - The OIDC userinfo endpoint URL discovered from the issuer.
- * @param input.accessToken - The Bearer access token sent in the `Authorization` header.
  * @returns The parsed userinfo claims. Throws a {@link CliError} (`USERINFO_FAILED`) on a non-OK response.
  */
 export declare function fetchUserInfo(input: FetchUserInfoInput): Promise<Record<string, unknown>>;
-/**
- * Session lifetime metadata returned by the `GET /oidc/session` route.
- */
-export interface OidcSessionInfo {
-    readonly sub?: string;
-    readonly scope?: Maybe<string>;
-    /**
-     * Grant (session) expiry as unix epoch SECONDS, or `null` when the provider could not resolve it.
-     */
-    readonly expiresAt?: Maybe<number>;
-    /**
-     * Whether refresh-token rotation is disabled for this grant (a long-lived service token).
-     */
-    readonly rotationDisabled?: boolean;
-}
-export interface FetchSessionInfoInput {
-    /**
-     * The `GET /oidc/session` endpoint URL (typically `<oidcIssuer>/session`).
-     */
-    readonly sessionEndpoint: string;
-    readonly accessToken: string;
-}
 /**
  * Fetches the dbx-components `GET /oidc/session` route and returns the parsed session lifetime metadata.
  *
- * Mirrors {@link fetchUserInfo}, but reads the access token's baked-in session-lifetime claims
- * (`dbx_session_expires_at` / `dbx_rotation_disabled`) which userinfo does not echo.
- *
  * @param input - The session request.
- * @param input.sessionEndpoint - The `GET /oidc/session` endpoint URL.
- * @param input.accessToken - The Bearer access token sent in the `Authorization` header.
  * @returns The parsed {@link OidcSessionInfo}. Throws a {@link CliError} (`SESSION_INFO_FAILED`) on a non-OK response.
  */
 export declare function fetchSessionInfo(input: FetchSessionInfoInput): Promise<OidcSessionInfo>;

package/src/lib/auth/oidc.flow.d.ts

@@ -1,94 +1,18 @@
-import { type Maybe } from '@dereekb/util';
-export interface BuildAuthorizationUrlInput {
-    readonly authorizationEndpoint: string;
-    /**
-     * Optional OIDC issuer URL (e.g. `https://api.example.com/oidc`). Used as a fallback rebase
-     * origin when `appClientUrl` is not provided — the origin of `oidcIssuer` is applied to the
-     * discovered `authorizationEndpoint`. In typical OIDC deployments the issuer and authorization
-     * endpoint share an origin, so this fallback is a no-op rebase that ends up at the discovered
-     * `/oidc/auth` URL. Use `appClientUrl` to send the user to a different origin (e.g. a frontend
-     * dev server that proxies `/oidc/**` back to the API).
-     */
-    readonly oidcIssuer?: Maybe<string>;
-    /**
-     * Optional API base URL. Used as a fallback rebase origin when neither `appClientUrl` nor
-     * `oidcIssuer` is provided — only the origin is read, so prefix paths like `/api` are ignored.
-     * Prefer `oidcIssuer` for new deployments; `apiBaseUrl` is kept for backwards compatibility
-     * with envs that only declare an API base URL.
-     */
-    readonly apiBaseUrl?: Maybe<string>;
-    /**
-     * Optional client origin to rebase the authorization endpoint onto.
-     *
-     * When set, the path + search of `authorizationEndpoint` are kept and the origin is replaced
-     * with this URL. Takes precedence over both `oidcIssuer` and `apiBaseUrl`. Recommended for any
-     * env where the user-facing URL should differ from the discovered authorization endpoint —
-     * e.g. a frontend dev server that proxies `/oidc/**` to the API on another port. When omitted,
-     * the URL is derived from `oidcIssuer`/`apiBaseUrl` origin (or used verbatim if neither is set),
-     * so the CLI always opens the actual authorization endpoint (typically `/oidc/auth`).
-     */
-    readonly appClientUrl?: Maybe<string>;
-    readonly clientId: string;
-    readonly redirectUri: string;
-    readonly scopes?: string;
-    readonly state: string;
-    readonly codeChallenge: string;
-    /**
-     * Optional requested login duration in seconds. When set, the URL includes the
-     * `dbx_session_ttl=<seconds>` query param so the OIDC server applies the requested
-     * lifetime to the issued Session, Grant, and RefreshToken (subject to per-client and
-     * server caps).
-     */
-    readonly requestedSessionTtlSeconds?: Maybe<number>;
-}
+import { type BuildAuthorizationUrlInput } from '@dereekb/util';
 /**
  * Builds the authorization URL the user opens in a browser to start the PKCE flow.
  *
- * The user-facing endpoint is the discovered `authorizationEndpoint` (typically `/oidc/auth`)
- * with its origin optionally rebased. The rebase origin is the first non-empty value among
- * `appClientUrl` → `oidcIssuer` origin → `apiBaseUrl` origin. In a typical single-host
- * deployment all three resolve to the same origin and the rebase is a no-op; in a split-host
- * setup (frontend dev server proxying `/oidc/**` to the API) `appClientUrl` redirects the user
- * through the frontend. When none of the three is provided, the discovered endpoint is used
- * unchanged.
- *
- * Always lands at the actual authorization endpoint so oidc-provider can create an interaction
- * and redirect to the app login page with a `uid`. (Earlier versions targeted a convenience
- * `/oidc/login/client` redirect that forwarded query params to the app without creating an
- * interaction — that branch is gone.)
+ * Thin CLI wrapper over the shared {@link buildAuthorizationUrlHelper}: defaults the scope to
+ * {@link DEFAULT_CLI_OIDC_SCOPES} when none is supplied, and re-wraps the shared
+ * {@link OidcRelyingPartyError} into the CLI's {@link CliError} (`AUTH_LOGIN_FOR_INVALID`).
  *
- * @param input - The authorization URL inputs.
- * @param input.authorizationEndpoint - The authorization endpoint discovered from OIDC metadata.
- * @param input.appClientUrl - Optional client origin to rebase the authorization endpoint onto. Takes precedence over `oidcIssuer` and `apiBaseUrl`.
- * @param input.oidcIssuer - Optional OIDC issuer URL; falls back to its origin as the rebase target when `appClientUrl` is missing.
- * @param input.apiBaseUrl - Optional API base URL; falls back to its origin as the rebase target when neither `appClientUrl` nor `oidcIssuer` is set.
- * @param input.clientId - The OAuth client ID.
- * @param input.redirectUri - The redirect URI registered with the OAuth client.
- * @param input.scopes - Space-separated scope list. Defaults to {@link DEFAULT_CLI_OIDC_SCOPES}.
- * @param input.state - The opaque OAuth state token used for CSRF protection.
- * @param input.codeChallenge - The PKCE code challenge derived from the verifier.
+ * @param input - The authorization URL inputs. When `scopes` is omitted, the CLI default is used.
  * @returns The full authorization URL with all OAuth params merged in.
  * @throws {CliError} When `requestedSessionTtlSeconds` is provided but is not a positive integer.
  *
  * @__NO_SIDE_EFFECTS__
  */
 export declare function buildAuthorizationUrl(input: BuildAuthorizationUrlInput): string;
-export interface PkceMaterial {
-    readonly codeVerifier: string;
-    readonly codeChallenge: string;
-}
-/**
- * Generates a fresh PKCE code verifier and the matching SHA-256 code challenge.
- *
- * @returns A {@link PkceMaterial} pair consisting of the random `codeVerifier` and its derived `codeChallenge`.
- */
-export declare function generatePkceMaterial(): Promise<PkceMaterial>;
-/**
- * Generates a random URL-safe state value for the OAuth state parameter.
- *
- * @returns A 32-character hex string derived from 16 random bytes.
- */
-export declare function generateOAuthState(): string;
 export interface ParsePastedRedirectInput {
     readonly pasted: string;
     readonly expectedState?: string;
@@ -100,12 +24,14 @@ export interface ParsedRedirect {
 /**
  * Parses an authorization code out of a pasted redirect URL or a bare code string.
  *
- * Validates the `state` parameter when an expected value is provided.
+ * Thin CLI wrapper over the shared {@link parseAuthorizationRedirect}: keeps the CLI's pasted-string
+ * input shape and re-wraps the shared {@link OidcRelyingPartyError} into the CLI's {@link CliError}
+ * (`AUTH_NO_CODE` / `AUTH_PROVIDER_ERROR` / `AUTH_REDIRECT_PARSE_FAILED` / `AUTH_STATE_MISMATCH`).
  *
  * @param input - The parse inputs.
  * @param input.pasted - The redirect URL or bare authorization code pasted by the user.
  * @param input.expectedState - Optional state value to assert against `state` when present in the URL.
  * @returns The {@link ParsedRedirect} containing `code` and (when present) `state`.
- * @throws {CliError} When `pasted` is empty, when the URL contains no `code` parameter, or when `expectedState` does not match the URL's `state`.
+ * @throws {CliError} When `pasted` is empty, contains no `code`, or the `state` does not match.
  */
 export declare function parsePastedRedirect(input: ParsePastedRedirectInput): ParsedRedirect;

package/src/lib/mcp-scan/manifest/css-utilities-schema.d.ts

@@ -106,7 +106,7 @@ export declare const CssUtilityEntry: import("arktype/internal/variants/object.t
         property: string;
         value: string;
     }[];
-    role?: "state" | "text" | "size" | "layout" | "misc" | "flex" | "spacing" | "interaction" | "color" | "text-color" | "surface" | "radius" | undefined;
+    role?: "text" | "state" | "size" | "layout" | "misc" | "flex" | "spacing" | "interaction" | "color" | "text-color" | "surface" | "radius" | undefined;
     intent?: string | undefined;
     seeAlso?: string[] | undefined;
     antiUse?: string | undefined;
@@ -149,7 +149,7 @@ export declare const CssUtilityManifest: import("arktype/internal/variants/objec
             property: string;
             value: string;
         }[];
-        role?: "state" | "text" | "size" | "layout" | "misc" | "flex" | "spacing" | "interaction" | "color" | "text-color" | "surface" | "radius" | undefined;
+        role?: "text" | "state" | "size" | "layout" | "misc" | "flex" | "spacing" | "interaction" | "color" | "text-color" | "surface" | "radius" | undefined;
         intent?: string | undefined;
         seeAlso?: string[] | undefined;
         antiUse?: string | undefined;

package/src/lib/mcp-scan/manifest/pipes-schema.d.ts

@@ -57,7 +57,7 @@ export type PipeArgEntry = typeof PipeArgEntry.infer;
  */
 export declare const PipeEntry: import("arktype/internal/variants/object.ts").ObjectType<{
     slug: string;
-    category: "value" | "date" | "misc" | "async";
+    category: "date" | "value" | "misc" | "async";
     pipeName: string;
     className: string;
     module: string;
@@ -98,7 +98,7 @@ export declare const PipeManifest: import("arktype/internal/variants/object.ts")
     generator: string;
     entries: {
         slug: string;
-        category: "value" | "date" | "misc" | "async";
+        category: "date" | "value" | "misc" | "async";
         pipeName: string;
         className: string;
         module: string;

package/test/package.json

@@ -1,15 +1,15 @@
 {
   "name": "@dereekb/dbx-cli/test",
-  "version": "13.22.0",
+  "version": "13.24.0",
   "peerDependencies": {
-    "@dereekb/date": "13.22.0",
-    "@dereekb/dbx-cli": "13.22.0",
-    "@dereekb/firebase": "13.22.0",
-    "@dereekb/firebase-server/test": "13.22.0",
-    "@dereekb/model": "13.22.0",
-    "@dereekb/nestjs": "13.22.0",
-    "@dereekb/rxjs": "13.22.0",
-    "@dereekb/util": "13.22.0",
+    "@dereekb/date": "13.24.0",
+    "@dereekb/dbx-cli": "13.24.0",
+    "@dereekb/firebase": "13.24.0",
+    "@dereekb/firebase-server/test": "13.24.0",
+    "@dereekb/model": "13.24.0",
+    "@dereekb/nestjs": "13.24.0",
+    "@dereekb/rxjs": "13.24.0",
+    "@dereekb/util": "13.24.0",
     "@nestjs/common": "^11.1.19",
     "arktype": "^2.2.0",
     "vitest": "4.1.5",