@dxos/cli-util 0.9.0 → 0.9.1-main.c7dcc2e112

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dxos/cli-util",
-  "version": "0.9.0",
+  "version": "0.9.1-main.c7dcc2e112",
   "description": "Shared CLI utilities for DXOS CLI commands and plugins",
   "homepage": "https://dxos.org",
   "bugs": "https://github.com/dxos/dxos/issues",
@@ -31,25 +31,29 @@
   ],
   "dependencies": {
     "@effect/cli": "0.75.2",
+    "@effect/platform": "0.96.1",
+    "@effect/platform-bun": "0.90.0",
     "@effect/printer": "0.49.0",
     "@effect/printer-ansi": "0.49.0",
-    "@dxos/app-toolkit": "0.9.0",
-    "@dxos/client": "0.9.0",
-    "@dxos/compute": "0.9.0",
-    "@dxos/debug": "0.9.0",
-    "@dxos/echo": "0.9.0",
-    "@dxos/echo-client": "0.9.0",
-    "@dxos/effect": "0.9.0",
-    "@dxos/functions": "0.9.0",
-    "@dxos/log": "0.9.0",
-    "@dxos/protocols": "0.9.0",
-    "@dxos/util": "0.9.0",
-    "@dxos/errors": "0.9.0"
+    "get-port-please": "^3.1.1",
+    "@dxos/app-toolkit": "0.9.1-main.c7dcc2e112",
+    "@dxos/client": "0.9.1-main.c7dcc2e112",
+    "@dxos/echo": "0.9.1-main.c7dcc2e112",
+    "@dxos/echo-client": "0.9.1-main.c7dcc2e112",
+    "@dxos/compute": "0.9.1-main.c7dcc2e112",
+    "@dxos/effect": "0.9.1-main.c7dcc2e112",
+    "@dxos/functions": "0.9.1-main.c7dcc2e112",
+    "@dxos/keys": "0.9.1-main.c7dcc2e112",
+    "@dxos/errors": "0.9.1-main.c7dcc2e112",
+    "@dxos/log": "0.9.1-main.c7dcc2e112",
+    "@dxos/protocols": "0.9.1-main.c7dcc2e112",
+    "@dxos/util": "0.9.1-main.c7dcc2e112",
+    "@dxos/debug": "0.9.1-main.c7dcc2e112"
   },
   "devDependencies": {
     "effect": "3.21.3",
     "typescript": "^6.0.3",
-    "vitest": "4.1.7"
+    "vitest": "4.1.8"
   },
   "peerDependencies": {
     "effect": "3.21.3"

package/src/index.ts

@@ -2,5 +2,6 @@
 // Copyright 2025 DXOS.org
 //
 
+export * from './oauth';
 export * from './services';
 export * from './util';

package/src/oauth/index.ts

@@ -0,0 +1,6 @@
+//
+// Copyright 2026 DXOS.org
+//
+
+export * from './server';
+export * from './recovery';

package/src/oauth/recovery.ts

@@ -0,0 +1,76 @@
+//
+// Copyright 2026 DXOS.org
+//
+
+import * as Effect from 'effect/Effect';
+
+import { EntityId, SpaceId } from '@dxos/keys';
+
+import { OAUTH_TIMEOUT_MS, startOAuthCallbackServer } from './server';
+
+/** Path Edge redirects the browser to after a recovery/register OAuth round-trip. */
+const RECOVERY_CALLBACK_PATH = '/redirect/oauth-recovery';
+
+export type RecoveryOAuthParams = {
+  /** Edge services base URL (from client config `runtime.services.edge.url`). */
+  readonly edgeBaseUrl: string;
+  /** OAuth provider id (e.g. `'atproto'`). */
+  readonly provider: string;
+  /** Requested scopes. */
+  readonly scopes: readonly string[];
+  /** atproto handle or DID — required so Edge can resolve the user's PDS / auth server. */
+  readonly loginHint: string;
+};
+
+type InitiateEnvelope = { success: boolean; data?: { authUrl?: string }; error?: { message?: string } };
+
+/**
+ * Drives the gate's OAuth identity-recovery flow from a CLI: starts a local callback server, asks
+ * Edge to begin a `recovery`-purpose OAuth flow (advertising the local server as the redirect
+ * origin via the `Origin` header), opens the browser, and resolves with the one-time
+ * `recoveryProof` Edge carries back in its redirect. The caller redeems the proof via
+ * `client.halo.recoverIdentity({ recoveryProof })`.
+ *
+ * Recovery runs before any identity exists, so no auth header is sent — Edge resolves the user's
+ * space / token server-side from the recovery binding, and the `spaceId` / `accessTokenId` in the
+ * request are unused (random values satisfy request validation).
+ */
+export const performRecoveryOAuthFlow = Effect.fn(function* (params: RecoveryOAuthParams) {
+  const server = yield* startOAuthCallbackServer(RECOVERY_CALLBACK_PATH);
+  return yield* Effect.gen(function* () {
+    const initiateUrl = new URL('/oauth/initiate', params.edgeBaseUrl).toString();
+    const response = yield* Effect.tryPromise({
+      try: () =>
+        fetch(initiateUrl, {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json', Origin: server.origin },
+          body: JSON.stringify({
+            provider: params.provider,
+            scopes: params.scopes,
+            spaceId: SpaceId.random(),
+            accessTokenId: EntityId.random(),
+            purpose: 'recovery',
+            loginHint: params.loginHint,
+          }),
+        }),
+      catch: (error) =>
+        new Error(`OAuth initiate request failed: ${error instanceof Error ? error.message : String(error)}`),
+    });
+
+    const envelope = yield* Effect.tryPromise({
+      try: () => response.json() as Promise<InitiateEnvelope>,
+      catch: (error) => new Error(`OAuth initiate response parse failed: ${String(error)}`),
+    });
+    if (!envelope.success || !envelope.data?.authUrl) {
+      return yield* Effect.fail(new Error(`OAuth initiation failed: ${envelope.error?.message ?? 'unknown error'}`));
+    }
+
+    yield* server.open(envelope.data.authUrl);
+    const callbackParams = yield* server.waitForResult(OAUTH_TIMEOUT_MS);
+    const recoveryProof = callbackParams.recoveryProof;
+    if (!recoveryProof) {
+      return yield* Effect.fail(new Error('OAuth recovery completed but no recoveryProof was returned.'));
+    }
+    return { recoveryProof };
+  }).pipe(Effect.ensuring(server.stop()));
+});

package/src/oauth/server.ts

@@ -0,0 +1,157 @@
+//
+// Copyright 2026 DXOS.org
+//
+
+import * as BunHttpServer from '@effect/platform-bun/BunHttpServer';
+import * as HttpRouter from '@effect/platform/HttpRouter';
+import * as HttpServer from '@effect/platform/HttpServer';
+import * as HttpServerRequest from '@effect/platform/HttpServerRequest';
+import * as HttpServerResponse from '@effect/platform/HttpServerResponse';
+import * as Effect from 'effect/Effect';
+import * as Exit from 'effect/Exit';
+import * as Layer from 'effect/Layer';
+import * as Option from 'effect/Option';
+import * as Ref from 'effect/Ref';
+import * as Scope from 'effect/Scope';
+import { getPort } from 'get-port-please';
+
+import { openBrowser } from '../util/platform';
+
+/** Default timeout for a full OAuth browser round-trip. */
+export const OAUTH_TIMEOUT_MS = 5 * 60 * 1000;
+
+/**
+ * Relay page that performs a top-level redirect to Edge's `authUrl`. Edge finalizes the flow
+ * by redirecting the browser back to this server's callback path (bsky.social nullifies
+ * `window.opener`, so a popup + postMessage relay can't be used).
+ */
+const getRelayPageHtml = (authUrl: string) => `
+<!DOCTYPE html>
+<html>
+<head>
+  <meta charset="UTF-8">
+  <script>
+    window.location.href = '${authUrl.replace(/'/g, "\\'")}';
+  </script>
+</head>
+<body></body>
+</html>
+`;
+
+type CallbackOutcome = { success: true; params: Record<string, string> } | { success: false; reason: string };
+
+/**
+ * A running local OAuth callback server.
+ */
+export type OAuthCallbackServer = {
+  /** Port the server is listening on. */
+  readonly port: number;
+  /** Origin (e.g. `http://localhost:1234`) to advertise to Edge as the redirect target. */
+  readonly origin: string;
+  /** Opens `authUrl` in the browser via the local relay page. */
+  readonly open: (authUrl: string) => Effect.Effect<void, Error>;
+  /** Resolves with the captured callback query params, or fails on an `error` param / timeout. */
+  readonly waitForResult: (timeoutMs?: number) => Effect.Effect<Record<string, string>, Error>;
+  /** Stops the server. */
+  readonly stop: () => Effect.Effect<void>;
+};
+
+/**
+ * Starts a local Bun HTTP server that relays the browser to Edge's auth URL and captures Edge's
+ * eventual top-level redirect back to `callbackPath`. Generic over the callback shape: all query
+ * params are captured and returned; an `error` query param fails the wait.
+ *
+ * Used by both the integration-connect flow (`/redirect/oauth`) and the identity-recovery login
+ * flow (`/redirect/oauth-recovery`).
+ */
+export const startOAuthCallbackServer = (callbackPath: `/${string}`): Effect.Effect<OAuthCallbackServer, Error> =>
+  Effect.gen(function* () {
+    const port = yield* Effect.promise(() => getPort({ random: true }));
+    const origin = `http://localhost:${port}`;
+    const received = yield* Ref.make(false);
+    const outcome = yield* Ref.make<Option.Option<CallbackOutcome>>(Option.none());
+
+    // req.url is only the path + query, so reconstruct a full URL to parse the query string.
+    const parseUrl = (rawUrl: string) => new URL(rawUrl.startsWith('http') ? rawUrl : `http://localhost${rawUrl}`);
+
+    const router = HttpRouter.empty.pipe(
+      HttpRouter.get(
+        '/oauth-relay',
+        Effect.gen(function* () {
+          const request = yield* HttpServerRequest.HttpServerRequest;
+          const authUrl = parseUrl(request.url).searchParams.get('authUrl');
+          if (!authUrl) {
+            return yield* HttpServerResponse.text('Missing authUrl parameter', { status: 400 });
+          }
+          return yield* HttpServerResponse.text(getRelayPageHtml(authUrl), {
+            headers: { 'Content-Type': 'text/html' },
+          });
+        }),
+      ),
+      HttpRouter.get(
+        callbackPath,
+        Effect.gen(function* () {
+          if (Option.isSome(yield* Ref.get(outcome))) {
+            return yield* HttpServerResponse.text('Already received.', { status: 400 });
+          }
+
+          const request = yield* HttpServerRequest.HttpServerRequest;
+          const params = parseUrl(request.url).searchParams;
+          const error = params.get('error');
+          if (error) {
+            yield* Ref.set(outcome, Option.some({ success: false, reason: error }));
+            yield* Ref.set(received, true);
+            return yield* HttpServerResponse.text(
+              `<html><body><h1>Authentication failed</h1><p>${error}</p></body></html>`,
+              { status: 400, headers: { 'Content-Type': 'text/html' } },
+            );
+          }
+
+          const captured: Record<string, string> = {};
+          for (const [key, value] of params.entries()) {
+            captured[key] = value;
+          }
+          yield* Ref.set(outcome, Option.some({ success: true, params: captured }));
+          yield* Ref.set(received, true);
+          return yield* HttpServerResponse.text(
+            '<html><body><h1>Authentication successful! You can close this window.</h1></body></html>',
+            { headers: { 'Content-Type': 'text/html' } },
+          );
+        }),
+      ),
+    );
+
+    const app = router.pipe(HttpServer.serve());
+    const serverLayer = app.pipe(Layer.provide(BunHttpServer.layer({ port })));
+    const scope = yield* Scope.make();
+    yield* Layer.build(serverLayer).pipe(Scope.extend(scope));
+
+    const waitForResult = (timeoutMs: number = OAUTH_TIMEOUT_MS) =>
+      Effect.race(
+        Effect.gen(function* () {
+          while (true) {
+            if (yield* Ref.get(received)) {
+              break;
+            }
+            yield* Effect.sleep('500 millis');
+          }
+          const result = yield* Ref.get(outcome);
+          return yield* Option.match(result, {
+            onNone: () => Effect.fail(new Error('OAuth callback received but no result')),
+            onSome: (value) =>
+              value.success
+                ? Effect.succeed(value.params)
+                : Effect.fail(new Error(`OAuth flow failed: ${value.reason}`)),
+          });
+        }),
+        Effect.sleep(`${timeoutMs} millis`).pipe(Effect.flatMap(() => Effect.fail(new Error('OAuth flow timed out')))),
+      );
+
+    return {
+      port,
+      origin,
+      open: (authUrl: string) => openBrowser(`${origin}/oauth-relay?authUrl=${encodeURIComponent(authUrl)}`),
+      waitForResult,
+      stop: () => Scope.close(scope, Exit.void).pipe(Effect.catchAll(() => Effect.void)),
+    } satisfies OAuthCallbackServer;
+  });

package/src/util/space.ts

@@ -7,7 +7,7 @@ import * as Effect from 'effect/Effect';
 import * as Layer from 'effect/Layer';
 import * as Option from 'effect/Option';
 
-import { getPersonalSpace } from '@dxos/app-toolkit';
+import { AppSpace } from '@dxos/app-toolkit';
 import { ClientService } from '@dxos/client';
 import { type Space } from '@dxos/client/echo';
 import { Database, Feed, type Key } from '@dxos/echo';
@@ -27,7 +27,7 @@ export const spaceIdWithDefault = (spaceId: Option.Option<Key.SpaceId>) =>
   Effect.gen(function* () {
     const client = yield* ClientService;
     return Option.getOrElse(spaceId, () => {
-      const personal = getPersonalSpace(client);
+      const personal = AppSpace.getPersonalSpace(client);
       if (!personal) {
         throw new Error('No space ID provided and no personal space found.');
       }
@@ -56,7 +56,7 @@ export const spaceLayer = (
       }
       return spaceId$.pipe(
         Option.flatMap((id) => Option.fromNullable(client.spaces.get(id))),
-        Option.orElse(() => Option.fromNullable(getPersonalSpace(client))),
+        Option.orElse(() => Option.fromNullable(AppSpace.getPersonalSpace(client))),
         Option.orElse(() => Option.fromNullable(client.spaces.get()[0])),
       );
     };
@@ -99,7 +99,7 @@ export const spaceLayer = (
       if (!space) {
         return Feed.notAvailable;
       }
-      return createFeedServiceLayer(space.queues);
+      return createFeedServiceLayer(space.internal.db);
     }),
   );