@devicecloud.dev/dcd 5.9.0-beta.1 → 5.9.0

package/dist/commands/login.js

@@ -35,7 +35,8 @@ import * as p from '@clack/prompts';
 import { defineCommand } from 'citty';
 import { spawn } from 'node:child_process';
 import { createHash, randomBytes } from 'node:crypto';
-import { ENVIRONMENTS, inferEnvFromApiUrl, resolveFrontendUrl } from '../config/environments.js';
+import { ENVIRONMENTS, inferEnvFromApiUrl, resolveFrontendUrl, } from '../config/environments.js';
+import { getSupabaseKey } from '../config/supabase-key.js';
 import { jsonFlag } from '../config/flags/output.flags.js';
 import { canPrompt } from '../utils/ci.js';
 import { CliError, logger } from '../utils/cli.js';
@@ -179,7 +180,7 @@ export const loginCommand = defineCommand({
                 // rejects it, the token itself is bad; if Supabase accepts, the
                 // api's JwtService is misconfigured.
                 const iss = decodeJwtIssuer(payload.access_token);
-                const supabaseUser = await probeSupabaseUser(iss, ENVIRONMENTS[env].supabase.anonKey, payload.access_token);
+                const supabaseUser = await probeSupabaseUser(iss, env, payload.access_token);
                 const parts = [
                     iss ? `token iss: ${iss}` : null,
                     `supabase /auth/v1/user: ${supabaseUser}`,
@@ -287,14 +288,14 @@ async function pollForClaim(apiUrl, state, codeVerifier) {
 function base64url(buf) {
     return buf.toString('base64').replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/, '');
 }
-async function probeSupabaseUser(iss, anonKey, token) {
+async function probeSupabaseUser(iss, env, token) {
     if (!iss)
         return 'skipped (no iss)';
     try {
         const res = await fetch(`${iss}/user`, {
             headers: {
                 authorization: `Bearer ${token}`,
-                apikey: anonKey,
+                apikey: await getSupabaseKey(env),
             },
         });
         const bodyText = await res.text().catch(() => '');

package/dist/commands/logout.js

@@ -3,7 +3,6 @@
  * it on Supabase. Leaves DEVICE_CLOUD_API_KEY (env/flag) untouched.
  */
 import { defineCommand } from 'citty';
-import { ENVIRONMENTS } from '../config/environments.js';
 import { jsonFlag } from '../config/flags/output.flags.js';
 import { CliAuthGateway } from '../gateways/cli-auth-gateway.js';
 import { logger } from '../utils/cli.js';
@@ -31,8 +30,7 @@ export const logoutCommand = defineCommand({
             }
             return;
         }
-        const { anonKey } = ENVIRONMENTS[config.env].supabase;
-        await CliAuthGateway.signOut(config.supabase_url, anonKey, config.session);
+        await CliAuthGateway.signOut(config.supabase_url, config.env, config.session);
         clearConfig();
         if (json) {
             logger.json({ status: 'SUCCESS', loggedOut: true, user: config.session.user_email });

package/dist/config/environments.d.ts

@@ -1,12 +1,10 @@
 /**
  * Per-env devicecloud.dev coordinates — single source of truth for the URLs
- * and Supabase credentials the CLI uses.
+ * the CLI uses.
  *
- * **These `anonKey` values are public.** Supabase anon keys are JWTs designed
- * to be embedded in client code (web apps, mobile apps, CLIs). They only
- * grant whatever the project's RLS policies expose. Don't worry about seeing
- * them here — every Supabase-based product ships its anon key the same way.
- * https://supabase.com/docs/guides/api/api-keys
+ * There is deliberately no Supabase key here. A compiled-in key can never be
+ * rotated without breaking every pinned CLI version, so it is fetched from the
+ * API at runtime instead: see `getSupabaseKey` in ./supabase-key.ts (dcd#1112).
  */
 export type DcdEnvName = 'dev' | 'prod';
 export interface DcdEnvironment {
@@ -15,13 +13,12 @@ export interface DcdEnvironment {
     supabase: {
         url: string;
         projectRef: string;
-        anonKey: string;
     };
     /**
      * Pinned KEK public key for client-side binary envelope encryption (dcd#1138).
      * `key` is base64 of the raw 32-byte X25519 public key; `version` selects which
-     * KEK the platform API unwraps with. **Public — safe to embed** (like the anon
-     * key above): it can only *encrypt*; the private half lives solely on the API.
+     * KEK the platform API unwraps with. **Public — safe to embed**: it can only
+     * *encrypt*; the private half lives solely on the API.
      *
      * Left `null` until the KEK is generated and provisioned. Generate a keypair
      * with, e.g.:

package/dist/config/environments.js

@@ -1,12 +1,10 @@
 /**
  * Per-env devicecloud.dev coordinates — single source of truth for the URLs
- * and Supabase credentials the CLI uses.
+ * the CLI uses.
  *
- * **These `anonKey` values are public.** Supabase anon keys are JWTs designed
- * to be embedded in client code (web apps, mobile apps, CLIs). They only
- * grant whatever the project's RLS policies expose. Don't worry about seeing
- * them here — every Supabase-based product ships its anon key the same way.
- * https://supabase.com/docs/guides/api/api-keys
+ * There is deliberately no Supabase key here. A compiled-in key can never be
+ * rotated without breaking every pinned CLI version, so it is fetched from the
+ * API at runtime instead: see `getSupabaseKey` in ./supabase-key.ts (dcd#1112).
  */
 export const ENVIRONMENTS = {
     prod: {
@@ -15,7 +13,6 @@ export const ENVIRONMENTS = {
         supabase: {
             url: 'https://cloud.devicecloud.dev',
             projectRef: 'pgydnphbimetinsgfkbo',
-            anonKey: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InBneWRucGhiaW1ldGluc2dma2JvIiwicm9sZSI6ImFub24iLCJpYXQiOjE3MDc1OTQzNDYsImV4cCI6MjAyMzE3MDM0Nn0.hAYOMFxxwX1exkQkY9xyQJGC_GhGnyogkj2N-kBkMI8',
         },
         kekPublicKey: { version: 1, key: 'wtfyWEwK7nJzwI4PD+9RAW8jxIR1u8kMQq2IhsrVnH4=' },
     },
@@ -25,7 +22,6 @@ export const ENVIRONMENTS = {
         supabase: {
             url: 'https://lbmsowehtjwnqlurpemb.supabase.co',
             projectRef: 'lbmsowehtjwnqlurpemb',
-            anonKey: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImxibXNvd2VodGp3bnFsdXJwZW1iIiwicm9sZSI6ImFub24iLCJpYXQiOjE3MDkyMTg0ODcsImV4cCI6MjAyNDc5NDQ4N30.zeLTMAuZ_WwYvGdeP0kdvL_Zrs-RQee5APPyxmWq7qQ',
         },
         kekPublicKey: { version: 1, key: 'RgcToF/OJpcQI9koYvSvtj/WLaebfcN4v5GJoqtr/00=' },
     },

package/dist/config/supabase-key.d.ts

@@ -0,0 +1,27 @@
+/**
+ * The Supabase publishable key, fetched from the dcd API at runtime (dcd#1112).
+ *
+ * Releases up to this one compiled the anon key in, so the key could never be
+ * rotated without breaking every CLI version pinned in customer CI. The API now
+ * serves it from the public `GET /cli-config`, and rotating it is an env change
+ * on the API.
+ *
+ * Fetched once per process and kept in memory only. It is deliberately not
+ * cached on disk: a stale key makes GoTrue answer a refresh with a 4xx, which
+ * `resolveAuth` treats as a dead session and deletes the user's login.
+ *
+ * Only the key comes from the API. The Supabase URLs stay pinned in
+ * `ENVIRONMENTS`: prod goes through the `cloud.devicecloud.dev` custom domain,
+ * which customer firewalls may allow-list, not the API's raw `supabase.co` URL.
+ */
+import { type DcdEnvName } from './environments.js';
+/** The publishable key for `env`. A failed fetch is not cached, so the next call retries. */
+export declare function getSupabaseKey(env: DcdEnvName): Promise<string>;
+/**
+ * Headers that authenticate a raw Storage/Auth request with `key` alone. A
+ * legacy anon key is a JWT and also goes in `Authorization`; an
+ * `sb_publishable_` key is not a JWT and must only be sent as `apikey`.
+ */
+export declare function supabaseKeyHeaders(key: string): Record<string, string>;
+/** Test seam: forget fetched keys. */
+export declare function resetSupabaseKeyCache(): void;

package/dist/config/supabase-key.js

@@ -0,0 +1,54 @@
+/**
+ * The Supabase publishable key, fetched from the dcd API at runtime (dcd#1112).
+ *
+ * Releases up to this one compiled the anon key in, so the key could never be
+ * rotated without breaking every CLI version pinned in customer CI. The API now
+ * serves it from the public `GET /cli-config`, and rotating it is an env change
+ * on the API.
+ *
+ * Fetched once per process and kept in memory only. It is deliberately not
+ * cached on disk: a stale key makes GoTrue answer a refresh with a 4xx, which
+ * `resolveAuth` treats as a dead session and deletes the user's login.
+ *
+ * Only the key comes from the API. The Supabase URLs stay pinned in
+ * `ENVIRONMENTS`: prod goes through the `cloud.devicecloud.dev` custom domain,
+ * which customer firewalls may allow-list, not the API's raw `supabase.co` URL.
+ */
+import { ENVIRONMENTS } from './environments.js';
+const FETCH_TIMEOUT_MS = 10_000;
+const cache = new Map();
+async function fetchSupabaseKey(env) {
+    const url = `${ENVIRONMENTS[env].apiUrl}/cli-config`;
+    const res = await fetch(url, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
+    if (!res.ok) {
+        throw new Error(`Failed to fetch CLI config from ${url}: HTTP ${res.status}`);
+    }
+    const body = (await res.json());
+    const key = body.supabase_publishable_key;
+    if (typeof key !== 'string' || key.length === 0) {
+        throw new Error(`CLI config from ${url} has no supabase_publishable_key`);
+    }
+    return key;
+}
+/** The publishable key for `env`. A failed fetch is not cached, so the next call retries. */
+export function getSupabaseKey(env) {
+    let pending = cache.get(env);
+    if (!pending) {
+        pending = fetchSupabaseKey(env);
+        cache.set(env, pending);
+        pending.catch(() => cache.delete(env));
+    }
+    return pending;
+}
+/**
+ * Headers that authenticate a raw Storage/Auth request with `key` alone. A
+ * legacy anon key is a JWT and also goes in `Authorization`; an
+ * `sb_publishable_` key is not a JWT and must only be sent as `apikey`.
+ */
+export function supabaseKeyHeaders(key) {
+    return key.startsWith('sb_') ? { apikey: key } : { apikey: key, authorization: `Bearer ${key}` };
+}
+/** Test seam: forget fetched keys. */
+export function resetSupabaseKeyCache() {
+    cache.clear();
+}

package/dist/gateways/cli-auth-gateway.d.ts

@@ -1,3 +1,4 @@
+import type { DcdEnvName } from '../config/environments.js';
 import type { StoredSession } from '../utils/config-store.js';
 /**
  * Thrown when a session refresh fails. `definitive` distinguishes "Supabase
@@ -18,6 +19,6 @@ export interface RefreshedSession {
     user_id: string;
 }
 export declare const CliAuthGateway: {
-    refresh(supabaseUrl: string, supabaseAnonKey: string, session: StoredSession): Promise<RefreshedSession>;
-    signOut(supabaseUrl: string, supabaseAnonKey: string, session: StoredSession): Promise<void>;
+    refresh(supabaseUrl: string, env: DcdEnvName, session: StoredSession): Promise<RefreshedSession>;
+    signOut(supabaseUrl: string, env: DcdEnvName, session: StoredSession): Promise<void>;
 };

package/dist/gateways/cli-auth-gateway.js

@@ -6,6 +6,7 @@
  * login command's PKCE rendezvous flow (see src/commands/login.ts).
  */
 import { createClient, isAuthApiError } from '@supabase/supabase-js';
+import { getSupabaseKey } from '../config/supabase-key.js';
 /**
  * Thrown when a session refresh fails. `definitive` distinguishes "Supabase
  * rejected this refresh token" (revoked, already used, malformed — re-login
@@ -20,14 +21,23 @@ export class SessionRefreshError extends Error {
         this.name = 'SessionRefreshError';
     }
 }
-function client(supabaseUrl, supabaseAnonKey) {
-    return createClient(supabaseUrl, supabaseAnonKey, {
+function client(supabaseUrl, supabaseKey) {
+    return createClient(supabaseUrl, supabaseKey, {
         auth: { persistSession: false, autoRefreshToken: false, detectSessionInUrl: false },
     });
 }
 export const CliAuthGateway = {
-    async refresh(supabaseUrl, supabaseAnonKey, session) {
-        const sb = client(supabaseUrl, supabaseAnonKey);
+    async refresh(supabaseUrl, env, session) {
+        let supabaseKey;
+        try {
+            supabaseKey = await getSupabaseKey(env);
+        }
+        catch (error) {
+            // Never definitive: the refresh token was not even tried, so the stored
+            // session must survive for the next attempt.
+            throw new SessionRefreshError(`Failed to refresh session: ${error.message}`, false);
+        }
+        const sb = client(supabaseUrl, supabaseKey);
         const { data, error } = await sb.auth.refreshSession({
             refresh_token: session.refresh_token,
         });
@@ -53,14 +63,14 @@ export const CliAuthGateway = {
             user_id: u.id,
         };
     },
-    async signOut(supabaseUrl, supabaseAnonKey, session) {
+    async signOut(supabaseUrl, env, session) {
         // `scope: 'local'` clears this client's SDK state only — no server call,
         // no revocation. supabase-js defaults to `scope: 'global'`, which revokes
         // EVERY session for the user (browser, mobile, other CLIs), so
         // `dcd logout` would kick the user out of the web app. We don't want
         // that — logging out locally should be local.
-        const sb = client(supabaseUrl, supabaseAnonKey);
         try {
+            const sb = client(supabaseUrl, await getSupabaseKey(env));
             await sb.auth.setSession({
                 access_token: session.access_token,
                 refresh_token: session.refresh_token,

package/dist/gateways/realtime-gateway.js

@@ -15,6 +15,7 @@
  */
 import { createClient, REALTIME_SUBSCRIBE_STATES, } from '@supabase/supabase-js';
 import { ENVIRONMENTS } from '../config/environments.js';
+import { getSupabaseKey } from '../config/supabase-key.js';
 export class RealtimeResultsGateway {
     /**
      * Open a realtime subscription to `results` changes for the given upload.
@@ -34,17 +35,28 @@ export class RealtimeResultsGateway {
             onConnectionChange?.(next);
         };
         let client;
-        try {
-            const { url, anonKey } = ENVIRONMENTS[env].supabase;
-            client = createClient(url, anonKey, {
+        let channel;
+        let closed = false;
+        // The latest JWT, so a refresh that lands while the key is still being
+        // fetched is the one the socket joins with.
+        let token = accessToken;
+        // The publishable key comes from the API (dcd#1112), so the socket opens
+        // asynchronously. `subscribe` stays synchronous for the caller: until it
+        // connects, `isConnected` is false and the backstop poll covers the gap.
+        const ready = getSupabaseKey(env)
+            .then((supabaseKey) => {
+            if (closed)
+                return;
+            const sb = createClient(ENVIRONMENTS[env].supabase.url, supabaseKey, {
                 // Match SupabaseClientGateway / the frontend; no session persistence —
                 // we set the token explicitly below.
                 auth: { autoRefreshToken: false, persistSession: false },
                 realtime: { params: { eventsPerSecond: 10 } },
             });
+            client = sb;
             // Attach the user's JWT to the socket so RLS is enforced on the channel.
-            client.realtime.setAuth(accessToken);
-            const channel = client
+            sb.realtime.setAuth(token);
+            channel = sb
                 .channel(`results-cli-${uploadId}`)
                 .on(
             // The typings don't cover the postgres_changes overload cleanly.
@@ -73,29 +85,8 @@ export class RealtimeResultsGateway {
                     setConnected(false);
                 }
             });
-            const activeClient = client;
-            return {
-                isConnected: () => connected,
-                async unsubscribe() {
-                    setConnected(false);
-                    try {
-                        await activeClient.removeChannel(channel);
-                        await activeClient.realtime.disconnect();
-                    }
-                    catch {
-                        /* best effort — process is exiting anyway */
-                    }
-                },
-                updateAccessToken(nextToken) {
-                    // setAuth updates the join payload and pushes the token to joined
-                    // channels. A failure only costs realtime; the backstop poll stays.
-                    activeClient.realtime.setAuth(nextToken).catch((error) => {
-                        dbg(`failed to update the socket's token: ${error instanceof Error ? error.message : String(error)}`);
-                    });
-                },
-            };
-        }
-        catch (error) {
+        })
+            .catch((error) => {
             dbg(`failed to subscribe: ${error instanceof Error ? error.message : String(error)}`);
             // Best-effort cleanup of a half-built client, then degrade to polling.
             try {
@@ -104,11 +95,34 @@ export class RealtimeResultsGateway {
             catch {
                 /* ignore */
             }
-            return {
-                isConnected: () => false,
-                async unsubscribe() { },
-                updateAccessToken() { },
-            };
-        }
+            client = undefined;
+            channel = undefined;
+        });
+        return {
+            isConnected: () => connected,
+            async unsubscribe() {
+                closed = true;
+                setConnected(false);
+                await ready;
+                if (!client)
+                    return;
+                try {
+                    if (channel)
+                        await client.removeChannel(channel);
+                    await client.realtime.disconnect();
+                }
+                catch {
+                    /* best effort — process is exiting anyway */
+                }
+            },
+            updateAccessToken(nextToken) {
+                token = nextToken;
+                // setAuth updates the join payload and pushes the token to joined
+                // channels. A failure only costs realtime; the backstop poll stays.
+                client?.realtime.setAuth(nextToken).catch((error) => {
+                    dbg(`failed to update the socket's token: ${error instanceof Error ? error.message : String(error)}`);
+                });
+            },
+        };
     }
 }

package/dist/gateways/supabase-gateway.d.ts

@@ -9,7 +9,7 @@ export interface ResumableUploadSource {
 export declare class SupabaseGateway {
     /**
      * Upload to Supabase using resumable uploads (TUS protocol)
-     * Uploads to staging location (uploads/{id}/) using anon key
+     * Uploads to staging location (uploads/{id}/) using the publishable key
      * File is later moved to final location by API after finalization
      * @param env - Environment (dev or prod)
      * @param path - Staging storage path (uploads/{id}/file.ext)

package/dist/gateways/supabase-gateway.js

@@ -2,10 +2,11 @@ import { createReadStream } from 'node:fs';
 import { createClient } from '@supabase/supabase-js';
 import * as tus from 'tus-js-client';
 import { ENVIRONMENTS } from '../config/environments.js';
+import { getSupabaseKey, supabaseKeyHeaders } from '../config/supabase-key.js';
 export class SupabaseGateway {
     /**
      * Upload to Supabase using resumable uploads (TUS protocol)
-     * Uploads to staging location (uploads/{id}/) using anon key
+     * Uploads to staging location (uploads/{id}/) using the publishable key
      * File is later moved to final location by API after finalization
      * @param env - Environment (dev or prod)
      * @param path - Staging storage path (uploads/{id}/file.ext)
@@ -15,7 +16,8 @@ export class SupabaseGateway {
      * @returns Promise that resolves when upload completes
      */
     static async uploadResumable(env, path, source, debug = false, onProgress) {
-        const { anonKey: SUPABASE_PUBLIC_KEY, projectRef } = ENVIRONMENTS[env].supabase;
+        const { projectRef } = ENVIRONMENTS[env].supabase;
+        const supabaseKey = await getSupabaseKey(env);
         const storageUrl = `https://${projectRef}.storage.supabase.co`;
         if (debug) {
             console.log(`[DEBUG] Resumable upload starting...`);
@@ -35,9 +37,9 @@ export class SupabaseGateway {
                 // Retry configuration - will retry 5 times with increasing delays
                 retryDelays: [0, 3000, 5000, 10_000, 20_000],
                 // Authentication and headers
-                // Use anon key for staging uploads to uploads/* folder
+                // Publishable key for staging uploads to uploads/* folder
                 headers: {
-                    authorization: `Bearer ${SUPABASE_PUBLIC_KEY}`,
+                    ...supabaseKeyHeaders(supabaseKey),
                     'x-upsert': 'true', // Allow overwriting existing files
                 },
                 // Upload metadata
@@ -93,7 +95,7 @@ export class SupabaseGateway {
         });
     }
     static async uploadToSignedUrl(env, path, token, file, debug = false) {
-        const { url: SUPABASE_URL, anonKey: SUPABASE_PUBLIC_KEY } = ENVIRONMENTS[env].supabase;
+        const { url: SUPABASE_URL } = ENVIRONMENTS[env].supabase;
         if (debug) {
             console.log(`[DEBUG] Supabase upload starting...`);
             console.log(`[DEBUG] Supabase URL: ${SUPABASE_URL}`);
@@ -102,7 +104,7 @@ export class SupabaseGateway {
             console.log(`[DEBUG] File type: ${file.type}`);
         }
         try {
-            const supabase = createClient(SUPABASE_URL, SUPABASE_PUBLIC_KEY);
+            const supabase = createClient(SUPABASE_URL, await getSupabaseKey(env));
             const uploadToUrl = await supabase.storage
                 .from('organizations')
                 .uploadToSignedUrl(path, token, file);

package/dist/utils/auth.js

@@ -9,7 +9,6 @@
  * poll), which re-checks with isAuthExpiring / refreshAuth below.
  */
 import { closeSync, openSync, rmSync, statSync } from 'node:fs';
-import { ENVIRONMENTS } from '../config/environments.js';
 import { CliAuthGateway, SessionRefreshError, } from '../gateways/cli-auth-gateway.js';
 import { telemetry } from '../services/telemetry.service.js';
 import { CliError } from './cli.js';
@@ -144,10 +143,9 @@ async function refreshSessionWithLock(initial) {
         if (session.expires_at > now + REFRESH_SKEW_SECONDS) {
             return { config: current, session };
         }
-        const { anonKey } = ENVIRONMENTS[current.env].supabase;
         let refreshed;
         try {
-            refreshed = await CliAuthGateway.refresh(current.supabase_url, anonKey, session);
+            refreshed = await CliAuthGateway.refresh(current.supabase_url, current.env, session);
         }
         catch (error) {
             if (error instanceof SessionRefreshError && error.definitive) {

package/package.json

@@ -68,7 +68,7 @@
     "test:unit": "node scripts/test-runner.mjs --unit",
     "typecheck": "tsc --noEmit -p tsconfig.test.json"
   },
-  "version": "5.9.0-beta.1",
+  "version": "5.9.0",
   "bugs": {
     "url": "https://discord.gg/gm3mJwcNw8"
   },