@maxceem/agw 0.1.2 → 0.1.4

package/dist/release/{0.1.2 → 0.1.4}/worker/index.js

@@ -73475,7 +73475,6 @@ var mgmtHandoff = sqliteTable(
     initiatingCredentialId: text("initiating_credential_id").notNull(),
     submissionProofHash: text("submission_proof_hash").notNull(),
     pollProofHash: text("poll_proof_hash").notNull(),
-    humanCodeHash: text("human_code_hash"),
     consumedAt: integer2("consumed_at"),
     outcome: text("outcome"),
     expiresAt: integer2("expires_at").notNull(),
@@ -75661,6 +75660,9 @@ var AppWriteSchema = external_exports.object({
   config: AppConfigSchema,
   status: external_exports.enum(["active", "disabled"]).optional()
 }).strict().meta({ id: "AppWrite" });
+var AppUpdateSchema = AppWriteSchema.extend({
+  revision: external_exports.number().int().positive()
+}).meta({ id: "AppUpdate" });
 var APP_ID_IS_SERVER_ASSIGNED = "id is assigned by the server: omit it and read app.id from the response";
 var AppAttestKeyIdSchema = external_exports.string().min(1).max(200);
 var ChallengeSchema = external_exports.string().min(1).max(200);
@@ -76314,7 +76316,6 @@ var CliOperationRequestSchema = external_exports.object({
 }).strict();
 var CliSubmissionRequestSchema = external_exports.object({
   submissionToken: CliProofSchema,
-  humanCode: external_exports.string().max(40).optional(),
   approve: external_exports.literal(true).optional(),
   allowServiceAccess: external_exports.boolean().optional(),
   email: external_exports.email().optional(),
@@ -76335,6 +76336,26 @@ var CliAccountSchema = external_exports.object({
   claimed: external_exports.boolean(),
   expiresAt: external_exports.string().nullable()
 });
+var CliBrowserDetailsResponseSchema = external_exports.object({
+  kind: CliOperationRequestSchema.shape.kind,
+  payload: external_exports.record(external_exports.string(), external_exports.unknown()),
+  account: CliAccountSchema,
+  signedIn: external_exports.boolean(),
+  googleEnabled: external_exports.boolean(),
+  expiresAt: external_exports.string()
+});
+var CliBrowserSubmitResponseSchema = external_exports.object({
+  state: external_exports.literal("completed"),
+  message: external_exports.string()
+});
+var CliBrowserRegisterResponseSchema = external_exports.object({
+  token: external_exports.string().nullable().optional(),
+  redirect: external_exports.boolean().optional()
+});
+var CliBrowserGoogleResponseSchema = external_exports.object({
+  url: external_exports.string(),
+  redirect: external_exports.boolean().optional()
+});
 var CliCredentialSchema = external_exports.object({
   token: external_exports.string()
 });
@@ -76349,7 +76370,6 @@ var CliOperationResponseSchema = external_exports.object({
   url: external_exports.url(),
   expiresAt: external_exports.string(),
   state: external_exports.enum(["pending", "completed", "failed", "expired"]),
-  humanCode: external_exports.string().optional(),
   deployment: CliDeploymentSchema
 });
 var CliOperationResultSchema = external_exports.object({
@@ -76665,6 +76685,208 @@ async function bootstrap(c) {
 }
 __name(bootstrap, "bootstrap");
 
+// src/routes/cli/operations.ts
+init_errors();
+function browserPath(id) {
+  return `/cli/approve/${encodeURIComponent(id)}`;
+}
+__name(browserPath, "browserPath");
+async function authState(c, interactive = false) {
+  const auth = createIdentityAuth(c.env, c.req.url, {
+    suppressDefaultOrganization: true
+  });
+  await auth.middleware({
+    apiKeys: !interactive,
+    syncCurrentOrganizationCookie: false
+  })(c, async () => {
+  });
+  return c.get("authState");
+}
+__name(authState, "authState");
+async function challenge(c) {
+  const row = await c.env.DB.prepare(
+    "SELECT * FROM mgmt_handoff WHERE id=?"
+  ).bind(c.req.param("id")).first();
+  if (!row) throw new GatewayError(404, "not_found", "Operation was not found");
+  return row;
+}
+__name(challenge, "challenge");
+function nonSecretPayload(value) {
+  if (Array.isArray(value)) {
+    for (const item of value) nonSecretPayload(item);
+    return;
+  }
+  if (value && typeof value === "object")
+    for (const [key2, item] of Object.entries(value)) {
+      if (/secret|password|token|api.?key/i.test(key2))
+        throw new GatewayError(
+          400,
+          "invalid_request",
+          "Secrets must be submitted in the browser form"
+        );
+      nonSecretPayload(item);
+    }
+}
+__name(nonSecretPayload, "nonSecretPayload");
+async function createOperation(c) {
+  const input = providerSchemaBody(
+    CliOperationRequestSchema,
+    await cliJson(c.req.raw)
+  );
+  nonSecretPayload(input.payload);
+  const meta3 = deployment(c);
+  const state = await authState(c);
+  const resolved = requireOrganization(state);
+  if (state.credentialType === "session" && c.req.header("origin") !== meta3.consoleOrigin)
+    throw new GatewayError(
+      403,
+      "forbidden",
+      "Use the first-party console for browser operations"
+    );
+  if (!state.actor || resolved.role !== "owner" && resolved.role !== "admin")
+    throw new GatewayError(
+      403,
+      "forbidden",
+      "Account administration is required"
+    );
+  const organizationId = resolved.organization.id;
+  const userId = state.actor.id;
+  const credentialId = state.actor.credentialId;
+  const account = await assertAccountAccess(
+    c.env,
+    organizationId,
+    input.kind === "claim" ? "claim" : "setup"
+  );
+  if (input.kind === "claim" && account.claimed)
+    throw new GatewayError(409, "conflict", "Account is already claimed");
+  const pollHash = await digest2(input.pollToken), id = `cli-operation:${pollHash}`;
+  const requestHash = await digest2(JSON.stringify(input.payload));
+  let value = JSON.stringify({ ...input.payload, __requestHash: requestHash });
+  let row = await c.env.DB.prepare(
+    "SELECT * FROM mgmt_handoff WHERE id=?"
+  ).bind(id).first();
+  if (row && (row.kind !== input.kind || row.organization_id !== organizationId || row.initiating_user_id !== userId || JSON.parse(row.request_json).__requestHash !== requestHash))
+    throw new GatewayError(
+      409,
+      "conflict",
+      "Operation proof is already bound to a different request"
+    );
+  const submissionToken = await derive(input.pollToken, `browser:${meta3.id}`);
+  if (!row) {
+    if (input.kind !== "claim" && !input.kind.endsWith(".add")) {
+      if (typeof input.payload.id !== "string")
+        throw new GatewayError(
+          400,
+          "invalid_request",
+          "Resource ID is required"
+        );
+      const gateway = input.kind.startsWith("provider-gateway.");
+      const snapshot = await c.env.DB.prepare(
+        gateway ? "SELECT id,type,name,config_json AS config,status,updated_at AS expectedUpdatedAt FROM provider_gateway WHERE id=? AND organization_id=?" : "SELECT id,type,name,slug,base_url AS baseUrl,provider_gateway_id AS providerGatewayId,gateway_route_json AS gatewayRoute,status,updated_at AS expectedUpdatedAt FROM provider WHERE id=? AND organization_id=?"
+      ).bind(input.payload.id, organizationId).first();
+      if (!snapshot)
+        throw new GatewayError(
+          404,
+          "not_found",
+          "Resource was not found in this account"
+        );
+      value = JSON.stringify({
+        ...input.payload,
+        expectedUpdatedAt: snapshot.expectedUpdatedAt,
+        snapshot,
+        __requestHash: requestHash
+      });
+    }
+    if (input.kind.startsWith("provider.")) {
+      const captured = JSON.parse(value);
+      const snapshot = captured.snapshot;
+      const gatewayId = Object.hasOwn(input.payload, "providerGatewayId") ? input.payload.providerGatewayId : snapshot?.providerGatewayId;
+      if (typeof gatewayId === "string") {
+        const gatewaySnapshot = await c.env.DB.prepare(
+          "SELECT id,type,name,config_json AS config,status,updated_at AS expectedUpdatedAt FROM provider_gateway WHERE id=? AND organization_id=?"
+        ).bind(gatewayId, organizationId).first();
+        if (!gatewaySnapshot)
+          throw new GatewayError(
+            404,
+            "not_found",
+            "Provider gateway was not found in this account"
+          );
+        value = JSON.stringify({
+          ...captured,
+          gatewaySnapshot,
+          expectedGatewayUpdatedAt: gatewaySnapshot.expectedUpdatedAt
+        });
+      }
+    }
+    await enforceEndpointRateLimit(
+      c.env,
+      `operation:${organizationId ?? c.req.header("cf-connecting-ip") ?? "local"}`,
+      10,
+      6e4
+    );
+    const now2 = Date.now();
+    await c.env.DB.prepare(
+      `INSERT OR IGNORE INTO mgmt_handoff(id,kind,request_json,organization_id,initiating_user_id,initiating_credential_id,submission_proof_hash,poll_proof_hash,expires_at,created_at,updated_at)
+      SELECT ?,?,?,?,?,?,?,?,?,?,? WHERE (SELECT COUNT(*) FROM mgmt_handoff WHERE organization_id = ? AND consumed_at IS NULL AND expires_at>?) < 10`
+    ).bind(
+      id,
+      input.kind,
+      value,
+      organizationId,
+      userId,
+      credentialId,
+      await digest2(submissionToken),
+      pollHash,
+      now2 + TTL,
+      now2,
+      now2,
+      organizationId,
+      now2
+    ).run();
+    row = await c.env.DB.prepare(
+      "SELECT * FROM mgmt_handoff WHERE id=?"
+    ).bind(id).first();
+    if (!row)
+      throw new GatewayError(
+        429,
+        "rate_limited",
+        "Too many pending operations"
+      );
+  }
+  return c.json({
+    id,
+    url: `${meta3.consoleOrigin}${browserPath(id)}#${submissionToken}`,
+    expiresAt: new Date(row.expires_at).toISOString(),
+    state: row.consumed_at ? "completed" : row.expires_at <= Date.now() ? "expired" : "pending",
+    deployment: meta3
+  });
+}
+__name(createOperation, "createOperation");
+async function pollOperation(c) {
+  const row = await challenge(c);
+  const token = c.req.header("authorization")?.replace(/^Bearer /, "");
+  if (!await proofMatches(token, row.poll_proof_hash))
+    throw new GatewayError(403, "forbidden", "Invalid polling proof");
+  const base = {
+    id: row.id,
+    deployment: deployment(c),
+    expiresAt: new Date(row.expires_at).toISOString()
+  };
+  if (row.expires_at <= Date.now())
+    return c.json({ ...base, state: "expired" });
+  if (!row.consumed_at) return c.json({ ...base, state: "pending" });
+  const result = row.outcome ? JSON.parse(row.outcome) : {};
+  const accountId = result.accountId ?? row.organization_id;
+  const account = accountId ? await accountLifecycle(c.env, accountId) : null;
+  return c.json({
+    ...base,
+    state: "completed",
+    result,
+    account
+  });
+}
+__name(pollOperation, "pollOperation");
+
 // src/routes/cli/provider-handoff.ts
 init_errors();
 
@@ -80281,207 +80503,6 @@ __name(completeProviderSubmission, "completeProviderSubmission");
 // src/routes/cli/browser.ts
 init_errors();
 
-// src/routes/cli/operations.ts
-init_errors();
-async function authState(c, interactive = false) {
-  const auth = createIdentityAuth(c.env, c.req.url, {
-    suppressDefaultOrganization: true
-  });
-  await auth.middleware({
-    apiKeys: !interactive,
-    syncCurrentOrganizationCookie: false
-  })(c, async () => {
-  });
-  return c.get("authState");
-}
-__name(authState, "authState");
-async function challenge(c) {
-  const row = await c.env.DB.prepare(
-    "SELECT * FROM mgmt_handoff WHERE id=?"
-  ).bind(c.req.param("id")).first();
-  if (!row) throw new GatewayError(404, "not_found", "Operation was not found");
-  return row;
-}
-__name(challenge, "challenge");
-function nonSecretPayload(value) {
-  if (Array.isArray(value)) {
-    for (const item of value) nonSecretPayload(item);
-    return;
-  }
-  if (value && typeof value === "object")
-    for (const [key2, item] of Object.entries(value)) {
-      if (/secret|password|token|api.?key/i.test(key2))
-        throw new GatewayError(
-          400,
-          "invalid_request",
-          "Secrets must be submitted in the browser form"
-        );
-      nonSecretPayload(item);
-    }
-}
-__name(nonSecretPayload, "nonSecretPayload");
-async function createOperation(c) {
-  const input = providerSchemaBody(
-    CliOperationRequestSchema,
-    await cliJson(c.req.raw)
-  );
-  nonSecretPayload(input.payload);
-  const meta3 = deployment(c);
-  const state = await authState(c);
-  const resolved = requireOrganization(state);
-  if (state.credentialType === "session" && c.req.header("origin") !== meta3.consoleOrigin)
-    throw new GatewayError(
-      403,
-      "forbidden",
-      "Use the first-party console for browser operations"
-    );
-  if (!state.actor || resolved.role !== "owner" && resolved.role !== "admin")
-    throw new GatewayError(
-      403,
-      "forbidden",
-      "Account administration is required"
-    );
-  const organizationId = resolved.organization.id;
-  const userId = state.actor.id;
-  const credentialId = state.actor.credentialId;
-  const account = await assertAccountAccess(
-    c.env,
-    organizationId,
-    input.kind === "claim" ? "claim" : "setup"
-  );
-  if (input.kind === "claim" && account.claimed)
-    throw new GatewayError(409, "conflict", "Account is already claimed");
-  const pollHash = await digest2(input.pollToken), id = `cli-operation:${pollHash}`;
-  const requestHash = await digest2(JSON.stringify(input.payload));
-  let value = JSON.stringify({ ...input.payload, __requestHash: requestHash });
-  let row = await c.env.DB.prepare(
-    "SELECT * FROM mgmt_handoff WHERE id=?"
-  ).bind(id).first();
-  if (row && (row.kind !== input.kind || row.organization_id !== organizationId || row.initiating_user_id !== userId || JSON.parse(row.request_json).__requestHash !== requestHash))
-    throw new GatewayError(
-      409,
-      "conflict",
-      "Operation proof is already bound to a different request"
-    );
-  const submissionToken = await derive(input.pollToken, `browser:${meta3.id}`);
-  const humanCode = (await derive(input.pollToken, `human:${meta3.id}`)).slice(0, 12).toUpperCase();
-  if (!row) {
-    if (input.kind !== "claim" && !input.kind.endsWith(".add")) {
-      if (typeof input.payload.id !== "string")
-        throw new GatewayError(
-          400,
-          "invalid_request",
-          "Resource ID is required"
-        );
-      const gateway = input.kind.startsWith("provider-gateway.");
-      const snapshot = await c.env.DB.prepare(
-        gateway ? "SELECT id,type,name,config_json AS config,status,updated_at AS expectedUpdatedAt FROM provider_gateway WHERE id=? AND organization_id=?" : "SELECT id,type,name,slug,base_url AS baseUrl,provider_gateway_id AS providerGatewayId,gateway_route_json AS gatewayRoute,status,updated_at AS expectedUpdatedAt FROM provider WHERE id=? AND organization_id=?"
-      ).bind(input.payload.id, organizationId).first();
-      if (!snapshot)
-        throw new GatewayError(
-          404,
-          "not_found",
-          "Resource was not found in this account"
-        );
-      value = JSON.stringify({
-        ...input.payload,
-        expectedUpdatedAt: snapshot.expectedUpdatedAt,
-        snapshot,
-        __requestHash: requestHash
-      });
-    }
-    if (input.kind.startsWith("provider.")) {
-      const captured = JSON.parse(value);
-      const snapshot = captured.snapshot;
-      const gatewayId = Object.hasOwn(input.payload, "providerGatewayId") ? input.payload.providerGatewayId : snapshot?.providerGatewayId;
-      if (typeof gatewayId === "string") {
-        const gatewaySnapshot = await c.env.DB.prepare(
-          "SELECT id,type,name,config_json AS config,status,updated_at AS expectedUpdatedAt FROM provider_gateway WHERE id=? AND organization_id=?"
-        ).bind(gatewayId, organizationId).first();
-        if (!gatewaySnapshot)
-          throw new GatewayError(
-            404,
-            "not_found",
-            "Provider gateway was not found in this account"
-          );
-        value = JSON.stringify({
-          ...captured,
-          gatewaySnapshot,
-          expectedGatewayUpdatedAt: gatewaySnapshot.expectedUpdatedAt
-        });
-      }
-    }
-    await enforceEndpointRateLimit(
-      c.env,
-      `operation:${organizationId ?? c.req.header("cf-connecting-ip") ?? "local"}`,
-      10,
-      6e4
-    );
-    const now2 = Date.now();
-    await c.env.DB.prepare(
-      `INSERT OR IGNORE INTO mgmt_handoff(id,kind,request_json,organization_id,initiating_user_id,initiating_credential_id,submission_proof_hash,poll_proof_hash,human_code_hash,expires_at,created_at,updated_at)
-      SELECT ?,?,?,?,?,?,?,?,?,?,?,? WHERE (SELECT COUNT(*) FROM mgmt_handoff WHERE organization_id = ? AND consumed_at IS NULL AND expires_at>?) < 10`
-    ).bind(
-      id,
-      input.kind,
-      value,
-      organizationId,
-      userId,
-      credentialId,
-      await digest2(submissionToken),
-      pollHash,
-      await digest2(humanCode),
-      now2 + TTL,
-      now2,
-      now2,
-      organizationId,
-      now2
-    ).run();
-    row = await c.env.DB.prepare(
-      "SELECT * FROM mgmt_handoff WHERE id=?"
-    ).bind(id).first();
-    if (!row)
-      throw new GatewayError(
-        429,
-        "rate_limited",
-        "Too many pending operations"
-      );
-  }
-  return c.json({
-    id,
-    url: `${meta3.consoleOrigin}/v1/cli/browser/${encodeURIComponent(id)}#${submissionToken}`,
-    expiresAt: new Date(row.expires_at).toISOString(),
-    state: row.consumed_at ? "completed" : row.expires_at <= Date.now() ? "expired" : "pending",
-    ...input.kind === "claim" ? { humanCode } : {},
-    deployment: meta3
-  });
-}
-__name(createOperation, "createOperation");
-async function pollOperation(c) {
-  const row = await challenge(c);
-  const token = c.req.header("authorization")?.replace(/^Bearer /, "");
-  if (!await proofMatches(token, row.poll_proof_hash))
-    throw new GatewayError(403, "forbidden", "Invalid polling proof");
-  const base = {
-    id: row.id,
-    deployment: deployment(c),
-    expiresAt: new Date(row.expires_at).toISOString()
-  };
-  if (row.expires_at <= Date.now())
-    return c.json({ ...base, state: "expired" });
-  if (!row.consumed_at) return c.json({ ...base, state: "pending" });
-  const result = row.outcome ? JSON.parse(row.outcome) : {};
-  const accountId = result.accountId ?? row.organization_id;
-  const account = accountId ? await accountLifecycle(c.env, accountId) : null;
-  return c.json({
-    ...base,
-    state: "completed",
-    result,
-    account
-  });
-}
-__name(pollOperation, "pollOperation");
-
 // src/routes/cli/identity-handoff.ts
 init_errors();
 async function completeIdentity(c, row, allowServiceAccess) {
@@ -80548,7 +80569,7 @@ async function completeIdentity(c, row, allowServiceAccess) {
 __name(completeIdentity, "completeIdentity");
 
 // src/routes/cli/browser.ts
-async function verifiedSubmission(c, codeRequired = false) {
+async function verifiedSubmission(c) {
   const meta3 = deployment(c);
   if (new URL(c.req.url).origin !== meta3.consoleOrigin)
     throw new GatewayError(404, "not_found", "Page was not found");
@@ -80568,15 +80589,6 @@ async function verifiedSubmission(c, codeRequired = false) {
     throw new GatewayError(410, "invalid_request", "Operation has expired");
   if (!await proofMatches(input.submissionToken, row.submission_proof_hash))
     throw new GatewayError(403, "forbidden", "Invalid submission proof");
-  if (codeRequired && !await proofMatches(
-    input.humanCode?.trim().toUpperCase(),
-    row.human_code_hash
-  ))
-    throw new GatewayError(
-      403,
-      "forbidden",
-      "Enter the separate code shown in your CLI"
-    );
   await assertAccountAccess(c.env, row.organization_id, row.kind === "claim" ? "claim" : "read");
   return { input, row };
 }
@@ -80602,7 +80614,7 @@ async function browserDetails(c) {
 }
 __name(browserDetails, "browserDetails");
 async function browserRegister(c) {
-  const { row, input } = await verifiedSubmission(c, true);
+  const { row, input } = await verifiedSubmission(c);
   if (row.kind !== "claim" || row.consumed_at)
     throw new GatewayError(
       403,
@@ -80628,15 +80640,6 @@ async function browserRegister(c) {
 __name(browserRegister, "browserRegister");
 async function browserSubmit(c) {
   const { row, input } = await verifiedSubmission(c);
-  if (row.kind === "claim" && !await proofMatches(
-    input.humanCode?.trim().toUpperCase(),
-    row.human_code_hash
-  ))
-    throw new GatewayError(
-      403,
-      "forbidden",
-      "Enter the separate code shown in your CLI"
-    );
   if (input.approve !== true)
     throw new GatewayError(
       400,
@@ -80660,30 +80663,6 @@ async function browserSubmit(c) {
   });
 }
 __name(browserSubmit, "browserSubmit");
-function browserPage(c) {
-  const meta3 = deployment(c);
-  if (new URL(c.req.url).origin !== meta3.consoleOrigin)
-    throw new GatewayError(404, "not_found", "Page was not found");
-  const nonce = crypto.randomUUID().replaceAll("-", "");
-  c.header(
-    "Content-Security-Policy",
-    `default-src 'none'; script-src 'nonce-${nonce}'; style-src 'nonce-${nonce}'; connect-src 'self'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'`
-  );
-  c.header("Referrer-Policy", "no-referrer");
-  c.header("Cache-Control", "no-store");
-  c.header("X-Content-Type-Options", "nosniff");
-  return c.html(`<!doctype html><html lang="en"><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Approve CLI request \xB7 App AI Gateway</title>
-<style nonce="${nonce}">:root{color-scheme:light;font-family:Georgia,serif;color:#17251e;background:#f3f3eb}body{max-width:640px;margin:7vh auto;padding:24px}header{font:13px ui-monospace,monospace;letter-spacing:.12em;color:#48634c}h1{font-weight:400;font-size:40px;line-height:1.1;margin:20px 0}section{background:#fff;padding:28px;border:1px solid #d4dacf;border-radius:8px;margin:20px 0}label{display:block;margin:18px 0 6px}input,select,button{font:16px ui-sans-serif,sans-serif;border:1px solid #9aa89c;border-radius:5px;padding:12px;box-sizing:border-box;width:100%}button{background:#244e38;color:white;margin-top:22px;cursor:pointer}button:disabled{opacity:.5;cursor:wait}input[type=checkbox]{width:auto}pre{white-space:pre-wrap;overflow-wrap:anywhere;font-size:13px}#status{font-family:ui-sans-serif,sans-serif;line-height:1.5}small{font-family:ui-sans-serif,sans-serif;line-height:1.5}</style>
-<header>APP AI GATEWAY / CLI APPROVAL</header><h1>Review the request.</h1><p>Compare the account and action below with your CLI before approving.</p><section><pre id="details">Loading protected request\u2026</pre><form id="signin" hidden><h2>Sign in</h2><label for="email">Email</label><input id="email" type="email" autocomplete="username"><label for="password">Password</label><input id="password" type="password" autocomplete="current-password"><button>Sign in</button><div id="registration" hidden><label for="name">Name for your account</label><input id="name" autocomplete="name"><label for="registrationCode">Separate claim code shown in your CLI</label><input id="registrationCode" autocomplete="off"><button type="button" id="register">Create your login</button></div><button type="button" id="google" hidden>Continue with Google</button></form><form id="approve" hidden><label for="secret" id="secretLabel" hidden>Provider credential</label><input id="secret" type="password" autocomplete="off" hidden><label for="code" id="codeLabel">Separate code shown in your CLI</label><input id="code" autocomplete="off" spellcheck="false" required><label><input id="confirm" type="checkbox" required> I approve this action for the account shown above.</label><label id="ongoingLabel"><input id="ongoing" type="checkbox" checked> Keep this service identity and its role-based management access.</label><button>Approve request</button></form></section><p id="status" role="status"></p><small>This page never displays management credentials. Provider credentials are submitted directly to your gateway.</small>
-<script nonce="${nonce}">let saved=null;try{saved=JSON.parse(sessionStorage.getItem(location.pathname)||'null')}catch{}if(saved&&saved.expiresAt<=Date.now()){sessionStorage.removeItem(location.pathname);saved=null}const token=location.hash.slice(1)||saved?.token||'';history.replaceState(null,'',location.pathname);const base=location.pathname;const details=document.getElementById('details'),status=document.getElementById('status');let current;
-async function call(path,body){const r=await fetch(path,{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify(body)});const data=await r.json();if(!r.ok)throw Error(data.error?.message||data.message||'Request failed');return data}
-async function load(){current=await call(base+'/details',{submissionToken:token});sessionStorage.setItem(base,JSON.stringify({token,expiresAt:Date.parse(current.expiresAt)}));details.textContent=JSON.stringify({action:current.kind,account:current.account,configuration:current.payload,expiresAt:current.expiresAt},null,2);const identity=current.kind==='claim';document.getElementById('signin').hidden=!identity||current.signedIn;document.getElementById('registration').hidden=!identity;document.getElementById('google').hidden=!current.googleEnabled;document.getElementById('approve').hidden=identity&&!current.signedIn;const needsSecret=!identity&&!(current.kind==='provider.add'&&current.payload.providerGatewayId);document.getElementById('secret').hidden=!needsSecret;document.getElementById('secret').required=needsSecret;document.getElementById('secretLabel').hidden=!needsSecret;document.getElementById('ongoingLabel').hidden=!identity;document.getElementById('code').required=identity;document.getElementById('code').hidden=!identity;document.getElementById('codeLabel').hidden=!identity;}
-document.getElementById('signin').onsubmit=async e=>{e.preventDefault();try{await call('/v1/auth/sign-in/email',{email:document.getElementById('email').value,password:document.getElementById('password').value});document.getElementById('password').value='';await load()}catch(e){status.textContent=e.message}};
-document.getElementById('register').onclick=async()=>{try{await call(base+'/register',{submissionToken:token,humanCode:document.getElementById('registrationCode').value,email:document.getElementById('email').value,password:document.getElementById('password').value,name:document.getElementById('name').value});document.getElementById('password').value='';await load()}catch(e){status.textContent=e.message}};
-document.getElementById('google').onclick=async()=>{try{const result=await call(current.kind==='claim'?base+'/google':'/v1/auth/sign-in/social',current.kind==='claim'?{submissionToken:token,humanCode:document.getElementById('registrationCode').value}:{provider:'google',callbackURL:location.href});location.href=result.url}catch(e){status.textContent=e.message}};
-document.getElementById('approve').onsubmit=async e=>{e.preventDefault();const b=e.target.querySelector('button');b.disabled=true;try{const value={submissionToken:token,humanCode:document.getElementById('code').value,approve:true,allowServiceAccess:document.getElementById('ongoing').checked};if(!document.getElementById('secret').hidden)value.secret=document.getElementById('secret').value;await call(base+'/submit',value);document.getElementById('secret').value='';status.textContent='Approved. Return to your CLI.';sessionStorage.removeItem(base);e.target.hidden=true}catch(e){status.textContent=e.message;b.disabled=false}};load().catch(e=>status.textContent=e.message);<\/script></html>`);
-}
-__name(browserPage, "browserPage");
 
 // src/routes/cli/oauth.ts
 var CLAIM_OAUTH_COOKIE = "cli_claim_oauth";
@@ -80707,7 +80686,7 @@ async function claimOAuthAuthorized(env2, request) {
 }
 __name(claimOAuthAuthorized, "claimOAuthAuthorized");
 async function browserGoogle(c) {
-  const { row } = await verifiedSubmission(c, true);
+  const { row } = await verifiedSubmission(c);
   if (row.kind !== "claim" || row.consumed_at)
     throw new GatewayError(403, "forbidden", "Google registration requires a pending claim");
   const meta3 = deployment(c);
@@ -80716,7 +80695,7 @@ async function browserGoogle(c) {
   const rawResult = await createClaimRegistrationAuth(c.env, c.req.url).auth.api.signInSocial({
     body: {
       provider: "google",
-      callbackURL: `${meta3.consoleOrigin}/v1/cli/browser/${encodeURIComponent(row.id)}`
+      callbackURL: `${meta3.consoleOrigin}${browserPath(row.id)}`
     },
     headers: c.req.raw.headers,
     asResponse: true
@@ -80938,7 +80917,7 @@ GROUP BY app_id`).bind(organizationId, month).all();
 __name(organizationMonthUsage, "organizationMonthUsage");
 
 // package.json
-var version4 = "0.1.2";
+var version4 = "0.1.4";
 
 // src/core/version.ts
 var SERVER_VERSION = version4;
@@ -80981,7 +80960,6 @@ cliRoutes.get("/capabilities", (c) => {
 cliRoutes.post("/bootstrap", bootstrap);
 cliRoutes.post("/operations", createOperation);
 cliRoutes.get("/operations/:id", pollOperation);
-cliRoutes.get("/browser/:id", browserPage);
 cliRoutes.post("/browser/:id/details", browserDetails);
 cliRoutes.post("/browser/:id/submit", browserSubmit);
 cliRoutes.post("/browser/:id/register", browserRegister);
@@ -83660,6 +83638,15 @@ var APP_ID = /^[a-z0-9][a-z0-9-]{0,62}$/u;
 var APP_ID_MAX_LENGTH = 63;
 var APP_ID_SUFFIX_ALPHABET = "0123456789abcdefghjkmnpqrstvwxyz";
 var APP_ID_SUFFIX_LENGTH = 12;
+function appUpdateBody(value) {
+  const { revision, ...write } = value ?? {};
+  if (revision !== void 0 && AppUpdateSchema.shape.revision.safeParse(revision).error) {
+    throw new GatewayError(400, "app_revision_required", APP_REVISION_REQUIRED);
+  }
+  return { ...appBody(write), revision };
+}
+__name(appUpdateBody, "appUpdateBody");
+var APP_REVISION_REQUIRED = "Send the revision the application was read at as revision";
 function appBody(value) {
   const parsed = AppWriteSchema.safeParse(value);
   if (!parsed.success) {
@@ -83942,7 +83929,6 @@ appRoutes.get("/apps/:app", async (c) => {
   } catch (error52) {
     configError = error52 instanceof Error ? error52.message : String(error52);
   }
-  c.header("ETag", `"app-${row.revision}"`);
   return c.json({ app: serializeRow(row), resolved, config_error: configError });
 });
 appRoutes.post("/apps/:app/validate", async (c) => {
@@ -83979,7 +83965,7 @@ __name(backfillAppLedger, "backfillAppLedger");
 appRoutes.put("/apps/:app", async (c) => {
   await requireEntitlement(c);
   const appId = assertAppId(c.req.param("app"));
-  const body = appBody(await c.req.json());
+  const body = appUpdateBody(await c.req.json());
   const db = database(c.env.DB);
   const organizationId = c.get("admin").organizationId;
   const existing = await db.query.app.findFirst({
@@ -83987,10 +83973,11 @@ appRoutes.put("/apps/:app", async (c) => {
     where: and(eq(app.id, appId), eq(app.organizationId, organizationId))
   });
   if (!existing) throw new GatewayError(404, "app_not_found", "App is not registered");
-  const condition = c.req.header("If-Match");
-  if (condition === void 0) throw new GatewayError(428, "app_revision_required", "Supply the ETag from the application read in If-Match");
-  if (condition !== `"app-${existing.revision}"`) {
-    throw new GatewayError(412, "app_revision_conflict", "The application changed; reload it before saving your changes");
+  if (body.revision === void 0) {
+    throw new GatewayError(400, "app_revision_required", APP_REVISION_REQUIRED);
+  }
+  if (body.revision !== existing.revision) {
+    throw new GatewayError(409, "app_revision_conflict", "The application changed; reload it before saving your changes");
   }
   const config3 = validatedConfig(
     body.config,
@@ -84007,11 +83994,10 @@ appRoutes.put("/apps/:app", async (c) => {
     expectedRevision: existing.revision
   };
   const written = await updateApp(c.env.DB, values);
-  if (!written) throw new GatewayError(412, "app_revision_conflict", "The application changed or was removed; reload it before saving your changes");
+  if (!written) throw new GatewayError(409, "app_revision_conflict", "The application changed or was removed; reload it before saving your changes");
   invalidateAppConfig(appId);
   const resolved = await loadAppConfig(c.env, appId);
   await backfillAppLedger(c.env, appId, existing.config, resolved);
-  c.header("ETag", `"app-${written.revision}"`);
   return c.json(
     { app: serializeRow(written), resolved: asJsonObject(resolved), config_error: null },
     200

package/dist/release-integrity.json

@@ -1 +1 @@
-{"version":"0.1.2","sha256":"722b6a0754cf1c287320c511e9cccb276cf10f7664372f61b0b86fa252517a32"}
+{"version":"0.1.4","sha256":"6822a2a6c387356888ffdbb91cd5359e1fe181bb8d7cbd237bca65c99c91fa79"}

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@maxceem/agw",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "type": "module",
   "description": "App AI Gateway CLI",
-  "upgradeFrom": ["0.1.1", "0.1.0"],
+  "upgradeFrom": ["0.1.3", "0.1.2", "0.1.1", "0.1.0"],
   "license": "Apache-2.0",
   "bin": {
     "agw": "dist/agw.mjs"