@irtio/cli 0.1.0 → 0.2.0

package/dist/index.js

@@ -15,20 +15,41 @@ commands:
           [--room <code>] [--url <ws://\u2026>]        check the built-in invariants
           [--cheat] [--key <projectKey>]          --cheat sends illegal writes and expects
           [--trace <path>]                        corrections; --trace dumps every frame
+          [--misprediction-max <units>]           fail the run if one correction snaps a
+          [--snaps-max <n>]                       prediction further than this, if more than
+          [--corrections-max <perSec>]            <n> corrections fall outside the resim
+                                                  window, or above this correction rate/bot
 
   login [--url <control>]                         sign in to a control plane via the browser
   whoami [--url <control>]                         print the identity the stored credential
                                                   resolves to, and the control URL asked
   deploy [--allow-breaking] [--project <id>]      bundle, classify the schema change against the
          [--url <control>] [--room <file>]        last deployment, and upload \u2014 refuses breaking
-                                                  changes unless a migration covers them
+         [--strategy drain|migrate]               changes unless a migration covers them;
+                                                  migrate moves LIVE rooms onto the new version
+                                                  now (drain, the default, lets them finish)
+  deploy --static <dir> [--project <id>]          upload a BUILT client directory to the project's
+         [--label <label>] [--url <control>]      static site and print the playable link
+                                                  (<label>.irt-serve.com; no build step)
   migrate create <name>                           scaffold irtio/migrations/<n>_<name>.ts with the
                                                   live breaking changes quoted in its header
-  logs [--follow] [--since <cursor>]              tail a project's logs
-       [--project <id>] [--url <control>]
+  rollback <version> [--project <id>]             re-promote deployment <version> and bring rooms
+           [--url <control>]                      that migrated past it back to their
+                                                  pre-migration state \u2014 DISCARDS what they wrote
+                                                  since their migration
+  logs [--follow] [--since <cursor>]              tail a project's logs, oldest line first;
+       [--room <id>] [--project <id>]             --room narrows to a single room's stream
+       [--url <control>]
   rooms [--project <id>] [--url <control>]        list a project's rooms (rows not reported for
                                                   longer than the control plane's retention
                                                   window, 30 days by default, are pruned)
+  keys jwt-secret [--project <id>]                mint a JWT signing secret (printed ONCE);
+       [retire] [--url <control>]                 retire finishes a rotation
+  keys jwt-mint --secret <s> --sub <player>       sign a test token locally with the documented
+       [--room <id>] [--role <r>] [--ttl <sec>]   recipe \u2014 the secret never leaves this machine
+  rooms saves <room>                              list a room's save generations, newest first
+  rooms restore <room> --save <id>                bring a room back from a save \u2014 DISCARDS its
+                                                  current state; stops the tenant if it is live
 `;
 switch (command) {
   case "init": {
@@ -37,7 +58,7 @@ switch (command) {
     break;
   }
   case "dev": {
-    const { dev } = await import("./dev-BFWFWJ4J.js");
+    const { dev } = await import("./dev-LOSTB4CD.js");
     await dev(args);
     break;
   }
@@ -47,32 +68,47 @@ switch (command) {
     break;
   }
   case "login": {
-    const { login } = await import("./login-US2YT5ZB.js");
+    const { login } = await import("./login-OV2EFNTJ.js");
     await login(args);
     break;
   }
   case "whoami": {
-    const { whoami } = await import("./whoami-5Q32SXFX.js");
+    const { whoami } = await import("./whoami-S73O6KJF.js");
     await whoami(args);
     break;
   }
   case "deploy": {
-    const { deploy } = await import("./deploy-4W6AYYEW.js");
+    if (args.includes("--static")) {
+      const { staticDeploy } = await import("./static-deploy-2LB6H54Y.js");
+      await staticDeploy(args);
+      break;
+    }
+    const { deploy } = await import("./deploy-6OM3UYNL.js");
     await deploy(args);
     break;
   }
   case "migrate": {
-    const { migrate } = await import("./migrate-FQIDF747.js");
+    const { migrate } = await import("./migrate-3R6VRW4J.js");
     await migrate(args);
     break;
   }
+  case "rollback": {
+    const { rollback } = await import("./rollback-CLQVYFHW.js");
+    await rollback(args);
+    break;
+  }
+  case "keys": {
+    const { keys } = await import("./keys-KEKO3EJ6.js");
+    await keys(args);
+    break;
+  }
   case "logs": {
-    const { logs } = await import("./logs-6GLBO3TP.js");
+    const { logs } = await import("./logs-5OUDPAIX.js");
     await logs(args);
     break;
   }
   case "rooms": {
-    const { rooms } = await import("./rooms-JXT3PRHN.js");
+    const { rooms } = await import("./rooms-OJ3JLYHD.js");
     await rooms(args);
     break;
   }

package/dist/init.d.ts

@@ -19,12 +19,15 @@ interface InitArgs {
     readonly dir?: string;
     /** Set by `--tick` / `--event`; absent means "ask". */
     readonly mode?: RoomMode;
+    /** `--physics`: a Rapier room with a shared world-builder and client prediction (D22). */
+    readonly physics?: boolean;
 }
 interface RunInitOptions {
     /** Where the project lives. Defaults to `process.cwd()`. */
     readonly cwd?: string;
     readonly dir?: string;
     readonly mode?: RoomMode;
+    readonly physics?: boolean;
     /**
      * Asks the one question. Injected so tests never touch a TTY; the default reads stdin when it
      * is a TTY and otherwise takes the default answer rather than hanging in a pipeline.

package/dist/init.js

@@ -17,6 +17,9 @@ function parseInitArgs(args) {
   const parsed = {};
   for (const arg of args) {
     switch (arg) {
+      case "--physics":
+        parsed.physics = true;
+        break;
       case "--tick":
       case "--event": {
         const mode = arg === "--tick" ? "tick" : "event";
@@ -36,6 +39,9 @@ function parseInitArgs(args) {
       }
     }
   }
+  if (parsed.physics && parsed.mode === "event") {
+    throw new Error("irtio init: --physics needs tick mode \u2014 the world steps on the fixed tick");
+  }
   return parsed;
 }
 function generateProjectId() {
@@ -138,6 +144,205 @@ ${config}
 ${tick}});
 `;
 }
+function physicsSchemaTemplate(project) {
+  return `/**
+ * Shared facts about the data. Both sides import this file \u2014 the room to run on, your game
+ * to draw from \u2014 so it also carries the project id, which is the public key: domain-locked, never
+ * secret, safe in client code.
+ */
+
+import { defineSchema, entity, f32, str } from '@irtio/schema';
+
+import { rpc } from './rpc.js';
+
+export const schema = defineSchema(
+  {
+    // One ball per connected client. The \`physics\` option is the whole idea: the simulation
+    // owns the body fields (position and velocity \u2014 read-only everywhere else, synced from the
+    // world every tick), and the owner writes only the intents (\`ax\`/\`az\`, a steering axis).
+    // Map the velocity channels too: corrections can only rebase what the schema carries, and a
+    // predicted body drifts without them.
+    players: entity(
+      { x: f32, y: f32, z: f32, vx: f32, vy: f32, vz: f32, ax: f32, az: f32, name: str(24) },
+      {
+        physics: {
+          body: { x: 'x', y: 'y', z: 'z', vx: 'vx', vy: 'vy', vz: 'vz' },
+          intents: ['ax', 'az'],
+        },
+      },
+    ),
+  },
+  {
+    project: '${project}',
+    rpc,
+  },
+);
+`;
+}
+var WORLD_TEMPLATE = `/**
+ * The shared world-builder (D22): one module, imported by BOTH sides. The room's physics config
+ * uses these exports to build the authoritative world; the client passes the same exports to
+ * \`joinRoom({ physics })\` and predicts against an identical local world. "Same code both
+ * sides" is the geometry contract \u2014 this file's name is only the convention \`irtio init\`
+ * follows, not a requirement.
+ *
+ * Two rules keep it honest:
+ * - **Pure over synced inputs.** No \`Math.random()\`, no clock, no module state \u2014 put seeds
+ *   and level parameters in synced state, so both sides build bit-identical worlds
+ *   (\`irtio simulate\` builds it twice and compares).
+ * - **Never import room.ts from here or from client code.** Room code is server-only; shared
+ *   code lives in modules like this one. (\`irtio deploy\` warns if the client's import graph
+ *   reaches the room file.)
+ */
+
+import type RAPIER from '@dimforge/rapier3d-compat';
+
+type Rapier = typeof RAPIER;
+type World = RAPIER.World;
+type Body = RAPIER.RigidBody;
+
+export const gravity = { x: 0, y: -9.81, z: 0 } as const;
+
+export const ARENA_HALF = 20;
+export const BALL_RADIUS = 0.5;
+/** Horizontal impulse per tick at full stick. */
+export const NUDGE = 0.4;
+
+/** Static geometry: a floor and four walls. */
+export function setup(world: World, rapier: Rapier): void {
+  const floor = world.createRigidBody(rapier.RigidBodyDesc.fixed().setTranslation(0, -0.5, 0));
+  world.createCollider(rapier.ColliderDesc.cuboid(ARENA_HALF + 2, 0.5, ARENA_HALF + 2), floor);
+  for (const [x, z] of [
+    [ARENA_HALF + 1, 0],
+    [-(ARENA_HALF + 1), 0],
+    [0, ARENA_HALF + 1],
+    [0, -(ARENA_HALF + 1)],
+  ] as const) {
+    const wall = world.createRigidBody(rapier.RigidBodyDesc.fixed().setTranslation(x, 5, z));
+    world.createCollider(
+      rapier.ColliderDesc.cuboid(x === 0 ? ARENA_HALF + 2 : 1, 6, z === 0 ? ARENA_HALF + 2 : 1),
+      wall,
+    );
+  }
+}
+
+/** How one instance becomes a rigid body \u2014 shape and material only; \`add()\` places it. */
+export const bodies = {
+  players: (rapier: Rapier) => ({
+    body: rapier.RigidBodyDesc.dynamic().lockRotations(),
+    colliders: [rapier.ColliderDesc.ball(BALL_RADIUS).setRestitution(0.3)],
+  }),
+};
+
+/** Intent \u2192 force, once per step. The room's tick() and the client's predictor both call this. */
+export const intents = {
+  players: (body: Body, player: { ax: number; az: number }): void => {
+    if (player.ax === 0 && player.az === 0) return;
+    body.applyImpulse({ x: player.ax * NUDGE, y: 0, z: player.az * NUDGE }, true);
+  },
+};
+`;
+function physicsRoomTemplate() {
+  return `/**
+ * Behavior. Server-only: \`irtio dev\` and \`irtio deploy\` bundle this file, and it never
+ * reaches the browser. The world's geometry, shapes and intent handling come from the shared
+ * world module, so the client predicts with exactly the code the server runs.
+ */
+
+import { defineRoom } from '@irtio/server';
+
+import { schema } from './schema.js';
+import { bodies, gravity, intents, setup } from './world.js';
+
+export default defineRoom(schema, {
+  mode: 'tick',
+  tickRate: ${DEFAULT_TICK_RATE},
+
+  physics: {
+    engine: 'rapier3d',
+    gravity: { ...gravity },
+    setup(world, rapier) {
+      setup(world, rapier);
+    },
+    bodies,
+  },
+
+  onJoin(state, ctx) {
+    if (ctx.reconnecting || state.players.has(ctx.clientId)) return;
+    // Body fields are the spawn pose: add() places the body. Deterministic spawn spots, spread
+    // apart \u2014 overlapping spawns resolve against each other, and another player's body is not
+    // in your local prediction world.
+    state.players.add(
+      ctx.clientId,
+      {
+        x: (state.players.size % 5) * 6 - 12,
+        y: 4,
+        z: Math.floor(state.players.size / 5) * 6 - 6,
+        vx: 0,
+        vy: 0,
+        vz: 0,
+        ax: 0,
+        az: 0,
+        name: ctx.name || 'anon',
+      },
+      { owner: ctx.clientId },
+    );
+  },
+
+  onLeave(state, ctx) {
+    state.players.remove(ctx.clientId);
+  },
+
+  // Intents are the only thing a client can write on a physics entity; clamp them here.
+  validate: {
+    players: (_prev, next) => ({
+      ...next,
+      ax: Math.max(-1, Math.min(1, next.ax)),
+      az: Math.max(-1, Math.min(1, next.az)),
+    }),
+  },
+
+  tick(state, _dt, room) {
+    for (const [id, player] of state.players) {
+      const body = room.physics.body('players', id);
+      if (body) intents.players(body, player);
+    }
+  },
+});
+`;
+}
+var PHYSICS_ROOM_TEST_TEMPLATE = `/**
+ * The smoke test \`irtio init --physics\` scaffolds. The engine's WASM needs one await before
+ * any room exists \u2014 the worker host does it in production, the test does it here.
+ */
+
+import { beforeAll, expect, test } from 'vitest';
+
+import { initPhysics, testRoom } from '@irtio/testing';
+import '@irtio/testing/matchers';
+
+import room from './room.js';
+
+beforeAll(async () => {
+  await initPhysics();
+});
+
+test('a player joins, falls to the floor, and steers with an intent', async () => {
+  const t = await testRoom(room);
+  const [a] = await t.join(1);
+  await t.tick(60);
+
+  const ball = t.state.players.get(a!.me);
+  expect(ball).toBeDefined();
+  expect(ball!.y).toBeLessThan(1); // it fell and came to rest on the floor
+
+  const before = ball!.x;
+  a!.state.players.get(a!.me)!.ax = 1;
+  a!.flush();
+  await t.tick(20);
+  expect(t.state.players.get(a!.me)!.x).toBeGreaterThan(before); // the intent moved it
+});
+`;
 var ROOM_TEST_TEMPLATE = `/**
  * The smoke test \`irtio init\` scaffolds: two clients join, one writes a field it owns, and every
  * view agrees with the server. \`testRoom\` runs the real room and real client semantics in
@@ -211,7 +416,7 @@ async function defaultAsk(question) {
     rl.close();
   }
 }
-async function updatePackageJson(file) {
+async function updatePackageJson(file, wanted) {
   const source = await readFile(file, "utf8");
   let parsed;
   try {
@@ -221,7 +426,7 @@ async function updatePackageJson(file) {
   }
   const deps = { ...parsed.dependencies ?? {} };
   let changed = false;
-  for (const name of INIT_DEPENDENCIES) {
+  for (const name of wanted) {
     if (deps[name] === void 0) {
       deps[name] = "^0.0.0";
       changed = true;
@@ -240,8 +445,11 @@ async function runInit(options = {}) {
   const dir = path.resolve(cwd, options.dir ?? ".");
   const log = options.log ?? ((line) => console.log(line));
   const ask = options.ask ?? defaultAsk;
+  const physics = options.physics === true;
   let mode = options.mode;
-  if (mode === void 0) {
+  if (physics) {
+    mode = "tick";
+  } else if (mode === void 0) {
     const answer = (await ask("does anything move without a player doing something? (y/n) ")).trim().toLowerCase();
     mode = answer.startsWith("n") ? "event" : "tick";
   }
@@ -255,7 +463,15 @@ async function runInit(options = {}) {
     } catch {
     }
   }
-  const files = [
+  const files = physics ? [
+    ["irtio/schema.ts", physicsSchemaTemplate(project)],
+    ["irtio/rpc.ts", RPC_TEMPLATE],
+    ["irtio/world.ts", WORLD_TEMPLATE],
+    ["irtio/room.ts", physicsRoomTemplate()],
+    ["irtio/room.test.ts", PHYSICS_ROOM_TEST_TEMPLATE],
+    ["irtio.json", `${JSON.stringify({ project }, null, 2)}
+`]
+  ] : [
     ["irtio/schema.ts", schemaTemplate(project)],
     ["irtio/rpc.ts", RPC_TEMPLATE],
     ["irtio/room.ts", roomTemplate(mode)],
@@ -275,15 +491,26 @@ async function runInit(options = {}) {
     await writeFile(file, contents, "utf8");
     created.push(relative);
   }
+  const wantedDeps = physics ? [...INIT_DEPENDENCIES, "@dimforge/rapier3d-compat"] : [...INIT_DEPENDENCIES];
   const packageFile = path.join(dir, "package.json");
-  const packageJson = existsSync(packageFile) ? await updatePackageJson(packageFile) : "absent";
+  const packageJson = existsSync(packageFile) ? await updatePackageJson(packageFile, wantedDeps) : "absent";
   if (created.length > 0) log(pc.green(`created ${created.join(", ")}`));
   if (skipped.length > 0) {
     log(pc.yellow(`kept ${skipped.join(", ")} (already there \u2014 nothing was overwritten)`));
   }
-  log(pc.dim(`project ${project} \xB7 ${mode} mode`));
-  const installCommand = packageJson === "absent" ? `npm i ${INIT_DEPENDENCIES.join(" ")}` : "npm install   # the four irtio packages were added to your package.json";
+  log(pc.dim(`project ${project} \xB7 ${mode} mode${physics ? " \xB7 physics" : ""}`));
+  const installCommand = packageJson === "absent" ? `npm i ${wantedDeps.join(" ")}` : "npm install   # the irtio packages were added to your package.json";
   for (const line of nextSteps(installCommand)) log(line);
+  if (physics) {
+    log("  physics: the world lives in irtio/world.ts, imported by BOTH sides. The client");
+    log("  predicts its own body with the same code \u2014 pass it to joinRoom:");
+    log("");
+    log(pc.cyan("       import * as world from './irtio/world.js';"));
+    log(pc.cyan("       const room = await joinRoom(schema, { physics: world });"));
+    log("");
+    log("  draw from room.render (predicted + interpolated), write intents via room.state.");
+    log("");
+  }
   return { dir, project, mode, created, skipped, packageJson };
 }
 async function init(args) {
@@ -291,7 +518,8 @@ async function init(args) {
     const parsed = parseInitArgs(args);
     await runInit({
       ...parsed.dir !== void 0 ? { dir: parsed.dir } : {},
-      ...parsed.mode !== void 0 ? { mode: parsed.mode } : {}
+      ...parsed.mode !== void 0 ? { mode: parsed.mode } : {},
+      ...parsed.physics !== void 0 ? { physics: parsed.physics } : {}
     });
   } catch (err) {
     console.error(pc.red(err instanceof Error ? err.message : String(err)));

package/dist/keys-KEKO3EJ6.js

@@ -0,0 +1,174 @@
+import {
+  createApiClient,
+  isLoginRequired
+} from "./chunk-I37DLT7K.js";
+import {
+  resolveControlUrlForUser
+} from "./chunk-NVUKSP5U.js";
+
+// src/keys.ts
+import { existsSync } from "fs";
+import { readFile } from "fs/promises";
+import * as path from "path";
+import pc from "picocolors";
+
+// src/jwt.ts
+import { createHmac } from "crypto";
+function signJwt(secret, claims) {
+  const header = Buffer.from(JSON.stringify({ alg: "HS256", typ: "JWT" })).toString("base64url");
+  const payload = Buffer.from(JSON.stringify(claims)).toString("base64url");
+  const signature = createHmac("sha256", secret).update(`${header}.${payload}`).digest("base64url");
+  return `${header}.${payload}.${signature}`;
+}
+
+// src/keys.ts
+async function readIrtioJsonProject(cwd) {
+  const file = path.join(cwd, "irtio.json");
+  if (!existsSync(file)) return void 0;
+  let parsed;
+  try {
+    parsed = JSON.parse(await readFile(file, "utf8"));
+  } catch {
+    throw new Error(`irtio keys: ${file} is not valid JSON`);
+  }
+  return typeof parsed.project === "string" && parsed.project.length > 0 ? parsed.project : void 0;
+}
+function flagValue(args, flag) {
+  const i = args.indexOf(flag);
+  if (i === -1) return void 0;
+  const value = args[i + 1];
+  if (value === void 0) throw new Error(`irtio keys: ${flag} needs a value`);
+  return value;
+}
+async function resolveProject(args) {
+  const project = flagValue(args, "--project") ?? await readIrtioJsonProject(process.cwd());
+  if (project === void 0) {
+    throw new Error(
+      "irtio keys: no project id \u2014 pass --project or run this from a project with irtio.json"
+    );
+  }
+  return project;
+}
+var DEFAULT_ISSUER = "main";
+async function runJwtSecret(options) {
+  const log = options.log ?? ((line) => console.log(line));
+  const controlUrl = await resolveControlUrlForUser(options.controlUrl);
+  const client = options.client ?? await createApiClient(controlUrl);
+  const issuer = options.issuer ?? DEFAULT_ISSUER;
+  const result = await client.post(`/v1/projects/${options.project}/jwt-secret`, {
+    issuer
+  });
+  log(pc.green(`minted a JWT signing secret for ${options.project} (issuer ${result.issuer})`));
+  log("");
+  log(`  ${pc.bold(result.secret)}`);
+  log("");
+  log(pc.yellow("this is the only time you will see it \u2014 store it on your server now"));
+  if (result.active > 1) {
+    log(
+      pc.dim(
+        "two secrets are now active: tokens signed with either verify. Move your server to this one, then run `irtio keys jwt-secret retire` to finish the rotation."
+      )
+    );
+  }
+  log(
+    pc.dim(
+      "the tenant picks the secret up at its next placement (a stop and start), not mid-flight"
+    )
+  );
+  return result;
+}
+async function runJwtSecretRetire(options) {
+  const log = options.log ?? ((line) => console.log(line));
+  const controlUrl = await resolveControlUrlForUser(options.controlUrl);
+  const client = options.client ?? await createApiClient(controlUrl);
+  const result = await client.post(
+    `/v1/projects/${options.project}/jwt-secret/retire`,
+    { issuer: options.issuer ?? DEFAULT_ISSUER }
+  );
+  log(pc.green(`retired the oldest active secret; ${result.active} remain(s) active`));
+  log(pc.dim("tokens signed with the retired secret stop verifying at the next placement"));
+}
+async function keys(args, deps = {}) {
+  const log = deps.log ?? ((line) => console.log(line));
+  const errorLog = deps.errorLog ?? ((line) => console.error(line));
+  try {
+    const sub = args[0];
+    const rest = args.slice(1);
+    if (sub === "jwt-secret" && rest[0] === "retire") {
+      const project = await resolveProject(rest);
+      const url = flagValue(rest, "--url");
+      const issuer = flagValue(rest, "--issuer");
+      await runJwtSecretRetire({
+        project,
+        log,
+        ...issuer !== void 0 ? { issuer } : {},
+        ...url !== void 0 ? { controlUrl: url } : {},
+        ...deps.client !== void 0 ? { client: deps.client } : {}
+      });
+      return;
+    }
+    if (sub === "jwt-secret") {
+      const project = await resolveProject(rest);
+      const url = flagValue(rest, "--url");
+      const issuer = flagValue(rest, "--issuer");
+      await runJwtSecret({
+        project,
+        log,
+        ...issuer !== void 0 ? { issuer } : {},
+        ...url !== void 0 ? { controlUrl: url } : {},
+        ...deps.client !== void 0 ? { client: deps.client } : {}
+      });
+      return;
+    }
+    if (sub === "jwt-mint") {
+      const secret = flagValue(rest, "--secret");
+      const subject = flagValue(rest, "--sub");
+      if (secret === void 0 || subject === void 0) {
+        throw new Error("irtio keys jwt-mint: --secret <secret> and --sub <playerId> are required");
+      }
+      const ttl = Number(flagValue(rest, "--ttl") ?? 3600);
+      if (!Number.isFinite(ttl) || ttl <= 0) {
+        throw new Error("irtio keys jwt-mint: --ttl must be a positive number of seconds");
+      }
+      const room = flagValue(rest, "--room");
+      const role = flagValue(rest, "--role");
+      const iss = flagValue(rest, "--iss") ?? DEFAULT_ISSUER;
+      const project = flagValue(rest, "--project") ?? await readIrtioJsonProject(process.cwd());
+      if (project === void 0) {
+        throw new Error(
+          "irtio keys jwt-mint: --project is required (aud must name the project the token is for)"
+        );
+      }
+      const now = Math.floor(Date.now() / 1e3);
+      const token = signJwt(secret, {
+        iss,
+        aud: project,
+        sub: subject,
+        iat: now,
+        exp: now + Math.floor(ttl),
+        ...room !== void 0 ? { roomId: room } : {},
+        ...role !== void 0 ? { role } : {}
+      });
+      log(token);
+      return;
+    }
+    throw new Error(
+      "irtio keys: unknown subcommand \u2014 try `keys jwt-secret`, `keys jwt-secret retire`, or `keys jwt-mint`"
+    );
+  } catch (err) {
+    if (isLoginRequired(err)) {
+      errorLog(pc.red("not logged in"));
+      errorLog("run: irtio login");
+      process.exitCode = 1;
+      return;
+    }
+    errorLog(pc.red(err instanceof Error ? err.message : String(err)));
+    process.exitCode = 1;
+  }
+}
+export {
+  DEFAULT_ISSUER,
+  keys,
+  runJwtSecret,
+  runJwtSecretRetire
+};

package/dist/{login-US2YT5ZB.js → login-OV2EFNTJ.js}

@@ -2,7 +2,7 @@ import {
   credentialsPath,
   resolveControlUrl,
   writeCredential
-} from "./chunk-UYN5PWLT.js";
+} from "./chunk-NVUKSP5U.js";
 
 // src/login.ts
 import { spawn } from "child_process";
@@ -49,6 +49,11 @@ async function runLogin(options = {}) {
   const openBrowser = options.openBrowser ?? defaultOpenBrowser;
   const timeoutMs = options.timeoutMs ?? LOGIN_TIMEOUT_MS;
   const state = randomBytes(8).toString("hex");
+  const allowedOrigin = new URL(controlUrl).origin;
+  const corsHeaders = {
+    "access-control-allow-origin": allowedOrigin,
+    vary: "origin"
+  };
   return new Promise((resolve, reject) => {
     let settled = false;
     const finish = (fn) => {
@@ -64,7 +69,23 @@ async function runLogin(options = {}) {
           res.writeHead(403).end();
           return;
         }
-        if (req.method !== "POST" || req.url?.split("?")[0] !== "/token") {
+        if (req.url?.split("?")[0] !== "/token") {
+          res.writeHead(404).end();
+          return;
+        }
+        if (req.method === "OPTIONS") {
+          const headers = {
+            ...corsHeaders,
+            "access-control-allow-methods": "POST",
+            "access-control-allow-headers": "content-type"
+          };
+          if (req.headers["access-control-request-private-network"] === "true") {
+            headers["access-control-allow-private-network"] = "true";
+          }
+          res.writeHead(204, headers).end();
+          return;
+        }
+        if (req.method !== "POST") {
           res.writeHead(404).end();
           return;
         }
@@ -72,7 +93,7 @@ async function runLogin(options = {}) {
           const body = await readBody(req);
           const parsed = JSON.parse(body);
           if (typeof parsed.token !== "string" || typeof parsed.expiresAt !== "string") {
-            res.writeHead(400, { "content-type": "application/json" }).end(JSON.stringify({ error: "expected { token, expiresAt }" }));
+            res.writeHead(400, { "content-type": "application/json", ...corsHeaders }).end(JSON.stringify({ error: "expected { token, expiresAt }" }));
             return;
           }
           const credential = {
@@ -81,10 +102,10 @@ async function runLogin(options = {}) {
             ...typeof parsed.email === "string" && parsed.email !== "" ? { email: parsed.email } : {}
           };
           const file = await writeCredential(controlUrl, credential);
-          res.writeHead(200, { "content-type": "application/json" }).end(JSON.stringify({ ok: true }));
+          res.writeHead(200, { "content-type": "application/json", ...corsHeaders }).end(JSON.stringify({ ok: true }));
           finish(() => resolve({ controlUrl, email: credential.email, file }));
         } catch (err) {
-          res.writeHead(500).end();
+          res.writeHead(500, corsHeaders).end();
           finish(() => reject(err instanceof Error ? err : new Error(String(err))));
         }
       })();