@dereekb/dbx-cli 14.4.0 → 14.5.1

package/lint-cache/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dereekb/dbx-cli-lint-cache",
-  "version": "14.4.0",
+  "version": "14.5.1",
   "sideEffects": false,
   "private": true,
   "type": "module",
@@ -9,7 +9,7 @@
     "eslint": "10.9.1"
   },
   "peerDependencies": {
-    "@dereekb/util": "14.4.0",
+    "@dereekb/util": "14.5.1",
     "yargs": "^18.0.0"
   }
 }

package/manifest-extract/package.json

@@ -1,21 +1,21 @@
 {
   "name": "@dereekb/dbx-cli/manifest-extract",
-  "version": "14.4.0",
+  "version": "14.5.1",
   "type": "module",
   "sideEffects": false,
   "peerDependencies": {
-    "@dereekb/date": "14.4.0",
-    "@dereekb/dbx-cli": "14.4.0",
-    "@dereekb/firebase": "14.4.0",
-    "@dereekb/model": "14.4.0",
-    "@dereekb/nestjs": "14.4.0",
-    "@dereekb/oauth-resource": "14.4.0",
-    "@dereekb/rxjs": "14.4.0",
-    "@dereekb/util": "14.4.0",
+    "@dereekb/date": "14.5.1",
+    "@dereekb/dbx-cli": "14.5.1",
+    "@dereekb/firebase": "14.5.1",
+    "@dereekb/model": "14.5.1",
+    "@dereekb/nestjs": "14.5.1",
+    "@dereekb/oauth-resource": "14.5.1",
+    "@dereekb/rxjs": "14.5.1",
+    "@dereekb/util": "14.5.1",
     "ts-morph": "^28.0.0"
   },
   "devDependencies": {
-    "@dereekb/firebase": "14.4.0"
+    "@dereekb/firebase": "14.5.1"
   },
   "exports": {
     "./package.json": "./package.json",

package/model-test/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@dereekb/dbx-cli/model-test",
-  "version": "14.4.0",
+  "version": "14.5.1",
   "type": "module",
   "sideEffects": false,
   "peerDependencies": {
-    "@dereekb/util": "14.4.0",
+    "@dereekb/util": "14.5.1",
     "ts-morph": "^28.0.0"
   },
   "exports": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dereekb/dbx-cli",
-  "version": "14.4.0",
+  "version": "14.5.1",
   "type": "module",
   "sideEffects": false,
   "bin": {
@@ -66,12 +66,12 @@
     }
   },
   "peerDependencies": {
-    "@dereekb/date": "14.4.0",
-    "@dereekb/firebase": "14.4.0",
-    "@dereekb/model": "14.4.0",
-    "@dereekb/nestjs": "14.4.0",
-    "@dereekb/oauth-resource": "14.4.0",
-    "@dereekb/util": "14.4.0",
+    "@dereekb/date": "14.5.1",
+    "@dereekb/firebase": "14.5.1",
+    "@dereekb/model": "14.5.1",
+    "@dereekb/nestjs": "14.5.1",
+    "@dereekb/oauth-resource": "14.5.1",
+    "@dereekb/util": "14.5.1",
     "@nestjs/common": "^12.0.1",
     "arktype": "^2.2.0",
     "firebase": "^12.18.0",

package/route/package.json

@@ -1,16 +1,16 @@
 {
   "name": "@dereekb/dbx-cli/route",
-  "version": "14.4.0",
+  "version": "14.5.1",
   "type": "module",
   "sideEffects": false,
   "peerDependencies": {
-    "@dereekb/date": "14.4.0",
-    "@dereekb/dbx-cli": "14.4.0",
-    "@dereekb/firebase": "14.4.0",
-    "@dereekb/model": "14.4.0",
-    "@dereekb/nestjs": "14.4.0",
-    "@dereekb/oauth-resource": "14.4.0",
-    "@dereekb/util": "14.4.0"
+    "@dereekb/date": "14.5.1",
+    "@dereekb/dbx-cli": "14.5.1",
+    "@dereekb/firebase": "14.5.1",
+    "@dereekb/model": "14.5.1",
+    "@dereekb/nestjs": "14.5.1",
+    "@dereekb/oauth-resource": "14.5.1",
+    "@dereekb/util": "14.5.1"
   },
   "exports": {
     "./package.json": "./package.json",

package/src/lib/auth/auth.command.factory.d.ts

@@ -13,13 +13,39 @@ export interface CreateAuthCommandInput {
      */
     readonly defaultEnvs?: readonly CliEnvDefault[];
 }
+/**
+ * Env name a handoff falls back to when nothing else names one — no `--env`, no `envName` from the
+ * minting deployment, no active env, and no single built-in default to borrow a name from.
+ *
+ * Only reachable on an unconfigured machine redeeming against a server that declares no
+ * `CliTokenApiModuleConfig.envName`. A neutral name is better than refusing: the credential is
+ * already spent by this point, so failing here would burn a one-time code.
+ */
+export declare const DEFAULT_HANDOFF_ENV_NAME = "default";
+/**
+ * Whether two OIDC issuer URLs name the same provider, ignoring the differences that carry no
+ * meaning — a trailing slash, case in the scheme/host, and a default port for the scheme.
+ *
+ * Used to decide whether redeeming a claim would REPOINT an existing env at a different deployment.
+ * Anything unparseable falls back to a trimmed string compare rather than reporting a match, so a
+ * malformed value fails closed into the guard.
+ *
+ * @param a - The env's currently configured issuer.
+ * @param b - The issuer the claimed bundle came from.
+ * @returns True when both resolve to the same origin and path.
+ */
+export declare function cliIssuersMatch(a: string, b: string): boolean;
 /**
  * Factory for the built-in `auth` command tree.
  *
- * Wires `setup`, `login`, `logout`, `status`, `show`, and `check` subcommands that drive the OIDC
- * PKCE flow against the active env, persist tokens via the per-CLI token cache, and print a
+ * Wires `setup`, `login`, `handoff`, `logout`, `status`, `show`, and `check` subcommands that drive
+ * the OIDC PKCE flow against the active env, persist tokens via the per-CLI token cache, and print a
  * structured envelope.
  *
+ * `handoff` is the non-interactive counterpart to `login`: it redeems a one-time claim code minted by
+ * an already-authenticated MCP session, so an agent can bring a CLI up on a bare machine with no
+ * browser and no prior `auth setup`.
+ *
  * @param input - Factory configuration.
  * @param input.cliName - The CLI's binary name. Used for the per-user config dir, env-var prefix, and error messages.
  * @param input.envVarName - Override for the env-name env var. Defaults to `<CLINAME>_ENV` (e.g. `DEMO_CLI_ENV`).

package/src/lib/auth/cli-handoff.client.d.ts

@@ -0,0 +1,62 @@
+import { type ISO8601DateString } from '@dereekb/util';
+/**
+ * Path, relative to the OIDC issuer, of the one-time claim redemption endpoint.
+ *
+ * Mirrors `FIREBASE_SERVER_CLI_TOKEN_CLAIM_PATH` on the server. Duplicated rather than imported so
+ * `@dereekb/dbx-cli` keeps taking no dependency on `@dereekb/firebase-server`.
+ */
+export declare const CLI_TOKEN_CLAIM_ENDPOINT_PATH_PART = "/cli-token/claim";
+/**
+ * The credential bundle `POST <issuer>/cli-token/claim` returns — everything a bare machine needs to
+ * create an env and be logged in.
+ *
+ * The server-side shape is `CliTokenHandoffBundle` in `@dereekb/firebase-server/oidc`.
+ */
+export interface CliHandoffBundle {
+    readonly uid: string;
+    readonly issuer: string;
+    readonly apiBaseUrl?: string;
+    /**
+     * The env name the minting deployment says it is. Advisory — an explicit `--env` still wins — but
+     * it is what lets the rendered one-line handoff command work on a machine with no config at all.
+     */
+    readonly envName?: string;
+    readonly clientId: string;
+    readonly refreshToken: string;
+    readonly scope: string;
+    readonly expiresAt: ISO8601DateString;
+}
+/**
+ * Inputs to {@link claimCliHandoff}.
+ */
+export interface ClaimCliHandoffInput {
+    /**
+     * The env's OIDC issuer URL, e.g. `https://example.com/oidc`.
+     */
+    readonly oidcIssuer: string;
+    /**
+     * The one-time claim code an MCP session's `cli-token` tool produced.
+     */
+    readonly code: string;
+}
+/**
+ * Builds the claim endpoint URL from an OIDC issuer.
+ *
+ * @param oidcIssuer - The env's OIDC issuer URL.
+ * @returns The claim endpoint URL.
+ * @__NO_SIDE_EFFECTS__
+ */
+export declare function buildCliHandoffClaimEndpoint(oidcIssuer: string): string;
+/**
+ * Redeems a one-time claim code for the credential bundle it wraps.
+ *
+ * The request carries no credential of its own — the code IS the credential, which is the entire
+ * point: the machine running this has nothing yet. The server answers every failure (unknown code,
+ * expired code, already-redeemed code) with the same generic error, so this reports one message too
+ * rather than inventing a distinction the server deliberately withholds.
+ *
+ * @param input - The issuer and the claim code.
+ * @returns The parsed {@link CliHandoffBundle}.
+ * @throws {CliError} `AUTH_HANDOFF_FAILED` when the code is rejected or the response is unusable.
+ */
+export declare function claimCliHandoff(input: ClaimCliHandoffInput): Promise<CliHandoffBundle>;

package/src/lib/auth/index.d.ts

@@ -1,4 +1,5 @@
 export * from './auth.command.factory';
+export * from './cli-handoff.client';
 export * from './oidc.client';
 export * from './oidc.flow';
 export * from './oidc.loopback';

package/src/lib/config/cli.config.d.ts

@@ -51,6 +51,14 @@ export interface SaveCliConfigInput extends LoadCliConfigInput {
     readonly configDir: string;
     readonly config: CliConfig;
 }
+/**
+ * File mode `config.json` is written with.
+ *
+ * Owner-only, matching `.tokens.json`: the config holds `clientSecret` for a confidential client,
+ * which is every bit as sensitive as a cached token. It previously inherited the umask (0644 in the
+ * usual case), leaving a real credential world-readable on a shared machine.
+ */
+export declare const CLI_CONFIG_FILE_MODE = 384;
 /**
  * Writes the full {@link CliConfig} to disk, creating the parent directory if needed.
  *

package/src/lib/mcp-scan/scan/index.d.ts

@@ -9,6 +9,7 @@
 export * from './scan-config-schema.js';
 export * from './extract.js';
 export * from './build-manifest.js';
+export * from './sanitize-type-text.js';
 export * from './cli.js';
 export * from './filters-cli.js';
 export * from './filters-extract.js';

package/src/lib/mcp-scan/scan/model-snapshot-fields-build-manifest.d.ts

@@ -26,6 +26,12 @@ export type BuildModelSnapshotFieldsGlobber = ScanGlobber;
 export interface BuildModelSnapshotFieldsManifestInput {
     readonly projectRoot: string;
     readonly generator: string;
+    /**
+     * Absolute workspace root that absolute paths baked into type text are made
+     * relative to. Defaults to `process.cwd()`, which is the workspace root because
+     * the generate-* targets all run with `cwd: {workspaceRoot}`.
+     */
+    readonly workspaceRoot?: string;
     readonly now?: () => Date;
     readonly readFile?: BuildModelSnapshotFieldsReadFile;
     readonly globber?: BuildModelSnapshotFieldsGlobber;

package/src/lib/mcp-scan/scan/sanitize-type-text.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Makes ts-morph type text reproducible across checkouts.
+ *
+ * TypeScript emits `import("<absolute path>").Type` for any type it cannot name
+ * from the enclosing scope, and ts-morph surfaces that text verbatim. The path is
+ * machine-specific: it is the host checkout on a developer's machine and `/code`
+ * inside the build container's bind mount.
+ *
+ * That difference is not cosmetic. The generated manifests are tracked files under
+ * `packages/dbx-cli/generated`, which is inside `dbx-cli`'s project root, and the
+ * workspace's `default` named input is `{projectRoot}/**\/*`. So an absolute path
+ * baked into a manifest invalidates the Nx cache for `dbx-cli` — and everything
+ * downstream of it — on every alternation between a host build and a container
+ * build, and leaves the git tree permanently dirty.
+ *
+ * Rewriting the path to be workspace-relative makes the emitted bytes identical
+ * everywhere the workspace is checked out.
+ */
+/**
+ * Input to {@link sanitizeTypeText}.
+ */
+export interface SanitizeTypeTextInput {
+    /**
+     * Type text as reported by the type checker, possibly containing one or more
+     * `import("<absolute path>")` segments.
+     */
+    readonly typeText: string;
+    /**
+     * Absolute path to the workspace root that emitted paths are made relative to.
+     */
+    readonly workspaceRoot: string;
+}
+/**
+ * Rewrites every absolute `import("…")` path in `typeText` to a workspace-relative,
+ * forward-slashed path.
+ *
+ * Paths that are already relative, or that resolve outside `workspaceRoot`, are left
+ * untouched — there is no stable shorter form for them, and rewriting to a `../`
+ * chain would reintroduce the machine dependence this exists to remove.
+ *
+ * @param input - The type text and the workspace root to relativize against.
+ * @returns The type text with workspace-internal absolute paths relativized.
+ */
+export declare function sanitizeTypeText(input: SanitizeTypeTextInput): string;

package/src/lib/mcp-scan/scan/utils-build-manifest.d.ts

@@ -25,6 +25,12 @@ export type BuildUtilsGlobber = ScanGlobber;
 export interface BuildUtilsManifestInput {
     readonly projectRoot: string;
     readonly generator: string;
+    /**
+     * Absolute workspace root that absolute paths baked into type text are made
+     * relative to. Defaults to `process.cwd()`, which is the workspace root because
+     * the generate-* targets all run with `cwd: {workspaceRoot}`.
+     */
+    readonly workspaceRoot?: string;
     readonly now?: () => Date;
     readonly readFile?: BuildUtilsReadFile;
     readonly globber?: BuildUtilsGlobber;

package/test/package.json

@@ -1,18 +1,18 @@
 {
   "name": "@dereekb/dbx-cli/test",
-  "version": "14.4.0",
+  "version": "14.5.1",
   "sideEffects": false,
   "type": "module",
   "peerDependencies": {
-    "@dereekb/date": "14.4.0",
-    "@dereekb/dbx-cli": "14.4.0",
-    "@dereekb/firebase": "14.4.0",
-    "@dereekb/firebase-server/test": "14.4.0",
-    "@dereekb/model": "14.4.0",
-    "@dereekb/nestjs": "14.4.0",
-    "@dereekb/oauth-resource": "14.4.0",
-    "@dereekb/rxjs": "14.4.0",
-    "@dereekb/util": "14.4.0",
+    "@dereekb/date": "14.5.1",
+    "@dereekb/dbx-cli": "14.5.1",
+    "@dereekb/firebase": "14.5.1",
+    "@dereekb/firebase-server/test": "14.5.0",
+    "@dereekb/model": "14.5.1",
+    "@dereekb/nestjs": "14.5.1",
+    "@dereekb/oauth-resource": "14.5.1",
+    "@dereekb/rxjs": "14.5.1",
+    "@dereekb/util": "14.5.1",
     "@nestjs/common": "^12.0.1",
     "arktype": "^2.2.0",
     "vitest": "4.1.11",

package/validate/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@dereekb/dbx-cli/validate",
-  "version": "14.4.0",
+  "version": "14.5.1",
   "type": "module",
   "sideEffects": false,
   "peerDependencies": {
-    "@dereekb/dbx-cli": "14.4.0",
-    "@dereekb/util": "14.4.0",
+    "@dereekb/dbx-cli": "14.5.1",
+    "@dereekb/util": "14.5.1",
     "ts-morph": "^28.0.0"
   }
 }