@maxceem/agw 0.1.3 → 0.1.5

package/dist/release/{0.1.3 → 0.1.5}/worker/index.js

@@ -73475,7 +73475,6 @@ var mgmtHandoff = sqliteTable(
     initiatingCredentialId: text("initiating_credential_id").notNull(),
     submissionProofHash: text("submission_proof_hash").notNull(),
     pollProofHash: text("poll_proof_hash").notNull(),
-    humanCodeHash: text("human_code_hash"),
     consumedAt: integer2("consumed_at"),
     outcome: text("outcome"),
     expiresAt: integer2("expires_at").notNull(),
@@ -76317,9 +76316,7 @@ var CliOperationRequestSchema = external_exports.object({
 }).strict();
 var CliSubmissionRequestSchema = external_exports.object({
   submissionToken: CliProofSchema,
-  humanCode: external_exports.string().max(40).optional(),
   approve: external_exports.literal(true).optional(),
-  allowServiceAccess: external_exports.boolean().optional(),
   email: external_exports.email().optional(),
   password: external_exports.string().min(8).max(256).optional(),
   name: external_exports.string().min(1).max(100).optional(),
@@ -76338,6 +76335,37 @@ var CliAccountSchema = external_exports.object({
   claimed: external_exports.boolean(),
   expiresAt: external_exports.string().nullable()
 });
+var CliApprovalRefusalSchema = external_exports.enum(["session_required", "account_exists"]);
+var CliViewerSchema = external_exports.object({
+  name: external_exports.string().nullable(),
+  email: external_exports.string().nullable()
+});
+var CliBrowserDetailsResponseSchema = external_exports.object({
+  kind: CliOperationRequestSchema.shape.kind,
+  payload: external_exports.record(external_exports.string(), external_exports.unknown()),
+  account: CliAccountSchema,
+  viewer: CliViewerSchema.nullable(),
+  /**
+   * What stands between this browser and the Approve button, or null when
+   * nothing does — which is every non-claim kind, since only a claim asks who
+   * is holding the browser.
+   */
+  blockedBy: CliApprovalRefusalSchema.nullable(),
+  googleEnabled: external_exports.boolean(),
+  expiresAt: external_exports.string()
+});
+var CliBrowserSubmitResponseSchema = external_exports.object({
+  state: external_exports.literal("completed"),
+  message: external_exports.string()
+});
+var CliBrowserRegisterResponseSchema = external_exports.object({
+  token: external_exports.string().nullable().optional(),
+  redirect: external_exports.boolean().optional()
+});
+var CliBrowserGoogleResponseSchema = external_exports.object({
+  url: external_exports.string(),
+  redirect: external_exports.boolean().optional()
+});
 var CliCredentialSchema = external_exports.object({
   token: external_exports.string()
 });
@@ -76352,14 +76380,11 @@ var CliOperationResponseSchema = external_exports.object({
   url: external_exports.url(),
   expiresAt: external_exports.string(),
   state: external_exports.enum(["pending", "completed", "failed", "expired"]),
-  humanCode: external_exports.string().optional(),
   deployment: CliDeploymentSchema
 });
 var CliOperationResultSchema = external_exports.object({
   /** The account a claim acted on. */
   accountId: external_exports.string().optional(),
-  /** Whether the claiming human left the CLI's service access in place. */
-  accessGranted: external_exports.boolean().optional(),
   /** The stored row a provider submission created or rotated. */
   provider: ProviderSummarySchema.optional(),
   gateway: ProviderGatewaySummarySchema.optional()
@@ -76668,6 +76693,208 @@ async function bootstrap(c) {
 }
 __name(bootstrap, "bootstrap");
 
+// src/routes/cli/operations.ts
+init_errors();
+function browserPath(id) {
+  return `/cli/approve/${encodeURIComponent(id)}`;
+}
+__name(browserPath, "browserPath");
+async function authState(c, interactive = false) {
+  const auth = createIdentityAuth(c.env, c.req.url, {
+    suppressDefaultOrganization: true
+  });
+  await auth.middleware({
+    apiKeys: !interactive,
+    syncCurrentOrganizationCookie: false
+  })(c, async () => {
+  });
+  return c.get("authState");
+}
+__name(authState, "authState");
+async function challenge(c) {
+  const row = await c.env.DB.prepare(
+    "SELECT * FROM mgmt_handoff WHERE id=?"
+  ).bind(c.req.param("id")).first();
+  if (!row) throw new GatewayError(404, "not_found", "Operation was not found");
+  return row;
+}
+__name(challenge, "challenge");
+function nonSecretPayload(value) {
+  if (Array.isArray(value)) {
+    for (const item of value) nonSecretPayload(item);
+    return;
+  }
+  if (value && typeof value === "object")
+    for (const [key2, item] of Object.entries(value)) {
+      if (/secret|password|token|api.?key/i.test(key2))
+        throw new GatewayError(
+          400,
+          "invalid_request",
+          "Secrets must be submitted in the browser form"
+        );
+      nonSecretPayload(item);
+    }
+}
+__name(nonSecretPayload, "nonSecretPayload");
+async function createOperation(c) {
+  const input = providerSchemaBody(
+    CliOperationRequestSchema,
+    await cliJson(c.req.raw)
+  );
+  nonSecretPayload(input.payload);
+  const meta3 = deployment(c);
+  const state = await authState(c);
+  const resolved = requireOrganization(state);
+  if (state.credentialType === "session" && c.req.header("origin") !== meta3.consoleOrigin)
+    throw new GatewayError(
+      403,
+      "forbidden",
+      "Use the first-party console for browser operations"
+    );
+  if (!state.actor || resolved.role !== "owner" && resolved.role !== "admin")
+    throw new GatewayError(
+      403,
+      "forbidden",
+      "Account administration is required"
+    );
+  const organizationId = resolved.organization.id;
+  const userId = state.actor.id;
+  const credentialId = state.actor.credentialId;
+  const account = await assertAccountAccess(
+    c.env,
+    organizationId,
+    input.kind === "claim" ? "claim" : "setup"
+  );
+  if (input.kind === "claim" && account.claimed)
+    throw new GatewayError(409, "conflict", "Account is already claimed");
+  const pollHash = await digest2(input.pollToken), id = `cli-operation:${pollHash}`;
+  const requestHash = await digest2(JSON.stringify(input.payload));
+  let value = JSON.stringify({ ...input.payload, __requestHash: requestHash });
+  let row = await c.env.DB.prepare(
+    "SELECT * FROM mgmt_handoff WHERE id=?"
+  ).bind(id).first();
+  if (row && (row.kind !== input.kind || row.organization_id !== organizationId || row.initiating_user_id !== userId || JSON.parse(row.request_json).__requestHash !== requestHash))
+    throw new GatewayError(
+      409,
+      "conflict",
+      "Operation proof is already bound to a different request"
+    );
+  const submissionToken = await derive(input.pollToken, `browser:${meta3.id}`);
+  if (!row) {
+    if (input.kind !== "claim" && !input.kind.endsWith(".add")) {
+      if (typeof input.payload.id !== "string")
+        throw new GatewayError(
+          400,
+          "invalid_request",
+          "Resource ID is required"
+        );
+      const gateway = input.kind.startsWith("provider-gateway.");
+      const snapshot = await c.env.DB.prepare(
+        gateway ? "SELECT id,type,name,config_json AS config,status,updated_at AS expectedUpdatedAt FROM provider_gateway WHERE id=? AND organization_id=?" : "SELECT id,type,name,slug,base_url AS baseUrl,provider_gateway_id AS providerGatewayId,gateway_route_json AS gatewayRoute,status,updated_at AS expectedUpdatedAt FROM provider WHERE id=? AND organization_id=?"
+      ).bind(input.payload.id, organizationId).first();
+      if (!snapshot)
+        throw new GatewayError(
+          404,
+          "not_found",
+          "Resource was not found in this account"
+        );
+      value = JSON.stringify({
+        ...input.payload,
+        expectedUpdatedAt: snapshot.expectedUpdatedAt,
+        snapshot,
+        __requestHash: requestHash
+      });
+    }
+    if (input.kind.startsWith("provider.")) {
+      const captured = JSON.parse(value);
+      const snapshot = captured.snapshot;
+      const gatewayId = Object.hasOwn(input.payload, "providerGatewayId") ? input.payload.providerGatewayId : snapshot?.providerGatewayId;
+      if (typeof gatewayId === "string") {
+        const gatewaySnapshot = await c.env.DB.prepare(
+          "SELECT id,type,name,config_json AS config,status,updated_at AS expectedUpdatedAt FROM provider_gateway WHERE id=? AND organization_id=?"
+        ).bind(gatewayId, organizationId).first();
+        if (!gatewaySnapshot)
+          throw new GatewayError(
+            404,
+            "not_found",
+            "Provider gateway was not found in this account"
+          );
+        value = JSON.stringify({
+          ...captured,
+          gatewaySnapshot,
+          expectedGatewayUpdatedAt: gatewaySnapshot.expectedUpdatedAt
+        });
+      }
+    }
+    await enforceEndpointRateLimit(
+      c.env,
+      `operation:${organizationId ?? c.req.header("cf-connecting-ip") ?? "local"}`,
+      10,
+      6e4
+    );
+    const now2 = Date.now();
+    await c.env.DB.prepare(
+      `INSERT OR IGNORE INTO mgmt_handoff(id,kind,request_json,organization_id,initiating_user_id,initiating_credential_id,submission_proof_hash,poll_proof_hash,expires_at,created_at,updated_at)
+      SELECT ?,?,?,?,?,?,?,?,?,?,? WHERE (SELECT COUNT(*) FROM mgmt_handoff WHERE organization_id = ? AND consumed_at IS NULL AND expires_at>?) < 10`
+    ).bind(
+      id,
+      input.kind,
+      value,
+      organizationId,
+      userId,
+      credentialId,
+      await digest2(submissionToken),
+      pollHash,
+      now2 + TTL,
+      now2,
+      now2,
+      organizationId,
+      now2
+    ).run();
+    row = await c.env.DB.prepare(
+      "SELECT * FROM mgmt_handoff WHERE id=?"
+    ).bind(id).first();
+    if (!row)
+      throw new GatewayError(
+        429,
+        "rate_limited",
+        "Too many pending operations"
+      );
+  }
+  return c.json({
+    id,
+    url: `${meta3.consoleOrigin}${browserPath(id)}#${submissionToken}`,
+    expiresAt: new Date(row.expires_at).toISOString(),
+    state: row.consumed_at ? "completed" : row.expires_at <= Date.now() ? "expired" : "pending",
+    deployment: meta3
+  });
+}
+__name(createOperation, "createOperation");
+async function pollOperation(c) {
+  const row = await challenge(c);
+  const token = c.req.header("authorization")?.replace(/^Bearer /, "");
+  if (!await proofMatches(token, row.poll_proof_hash))
+    throw new GatewayError(403, "forbidden", "Invalid polling proof");
+  const base = {
+    id: row.id,
+    deployment: deployment(c),
+    expiresAt: new Date(row.expires_at).toISOString()
+  };
+  if (row.expires_at <= Date.now())
+    return c.json({ ...base, state: "expired" });
+  if (!row.consumed_at) return c.json({ ...base, state: "pending" });
+  const result = row.outcome ? JSON.parse(row.outcome) : {};
+  const accountId = result.accountId ?? row.organization_id;
+  const account = accountId ? await accountLifecycle(c.env, accountId) : null;
+  return c.json({
+    ...base,
+    state: "completed",
+    result,
+    account
+  });
+}
+__name(pollOperation, "pollOperation");
+
 // src/routes/cli/provider-handoff.ts
 init_errors();
 
@@ -80284,219 +80511,34 @@ __name(completeProviderSubmission, "completeProviderSubmission");
 // src/routes/cli/browser.ts
 init_errors();
 
-// src/routes/cli/operations.ts
-init_errors();
-async function authState(c, interactive = false) {
-  const auth = createIdentityAuth(c.env, c.req.url, {
-    suppressDefaultOrganization: true
-  });
-  await auth.middleware({
-    apiKeys: !interactive,
-    syncCurrentOrganizationCookie: false
-  })(c, async () => {
-  });
-  return c.get("authState");
-}
-__name(authState, "authState");
-async function challenge(c) {
-  const row = await c.env.DB.prepare(
-    "SELECT * FROM mgmt_handoff WHERE id=?"
-  ).bind(c.req.param("id")).first();
-  if (!row) throw new GatewayError(404, "not_found", "Operation was not found");
-  return row;
-}
-__name(challenge, "challenge");
-function nonSecretPayload(value) {
-  if (Array.isArray(value)) {
-    for (const item of value) nonSecretPayload(item);
-    return;
-  }
-  if (value && typeof value === "object")
-    for (const [key2, item] of Object.entries(value)) {
-      if (/secret|password|token|api.?key/i.test(key2))
-        throw new GatewayError(
-          400,
-          "invalid_request",
-          "Secrets must be submitted in the browser form"
-        );
-      nonSecretPayload(item);
-    }
-}
-__name(nonSecretPayload, "nonSecretPayload");
-async function createOperation(c) {
-  const input = providerSchemaBody(
-    CliOperationRequestSchema,
-    await cliJson(c.req.raw)
-  );
-  nonSecretPayload(input.payload);
-  const meta3 = deployment(c);
-  const state = await authState(c);
-  const resolved = requireOrganization(state);
-  if (state.credentialType === "session" && c.req.header("origin") !== meta3.consoleOrigin)
-    throw new GatewayError(
-      403,
-      "forbidden",
-      "Use the first-party console for browser operations"
-    );
-  if (!state.actor || resolved.role !== "owner" && resolved.role !== "admin")
-    throw new GatewayError(
-      403,
-      "forbidden",
-      "Account administration is required"
-    );
-  const organizationId = resolved.organization.id;
-  const userId = state.actor.id;
-  const credentialId = state.actor.credentialId;
-  const account = await assertAccountAccess(
-    c.env,
-    organizationId,
-    input.kind === "claim" ? "claim" : "setup"
-  );
-  if (input.kind === "claim" && account.claimed)
-    throw new GatewayError(409, "conflict", "Account is already claimed");
-  const pollHash = await digest2(input.pollToken), id = `cli-operation:${pollHash}`;
-  const requestHash = await digest2(JSON.stringify(input.payload));
-  let value = JSON.stringify({ ...input.payload, __requestHash: requestHash });
-  let row = await c.env.DB.prepare(
-    "SELECT * FROM mgmt_handoff WHERE id=?"
-  ).bind(id).first();
-  if (row && (row.kind !== input.kind || row.organization_id !== organizationId || row.initiating_user_id !== userId || JSON.parse(row.request_json).__requestHash !== requestHash))
-    throw new GatewayError(
-      409,
-      "conflict",
-      "Operation proof is already bound to a different request"
-    );
-  const submissionToken = await derive(input.pollToken, `browser:${meta3.id}`);
-  const humanCode = (await derive(input.pollToken, `human:${meta3.id}`)).slice(0, 12).toUpperCase();
-  if (!row) {
-    if (input.kind !== "claim" && !input.kind.endsWith(".add")) {
-      if (typeof input.payload.id !== "string")
-        throw new GatewayError(
-          400,
-          "invalid_request",
-          "Resource ID is required"
-        );
-      const gateway = input.kind.startsWith("provider-gateway.");
-      const snapshot = await c.env.DB.prepare(
-        gateway ? "SELECT id,type,name,config_json AS config,status,updated_at AS expectedUpdatedAt FROM provider_gateway WHERE id=? AND organization_id=?" : "SELECT id,type,name,slug,base_url AS baseUrl,provider_gateway_id AS providerGatewayId,gateway_route_json AS gatewayRoute,status,updated_at AS expectedUpdatedAt FROM provider WHERE id=? AND organization_id=?"
-      ).bind(input.payload.id, organizationId).first();
-      if (!snapshot)
-        throw new GatewayError(
-          404,
-          "not_found",
-          "Resource was not found in this account"
-        );
-      value = JSON.stringify({
-        ...input.payload,
-        expectedUpdatedAt: snapshot.expectedUpdatedAt,
-        snapshot,
-        __requestHash: requestHash
-      });
-    }
-    if (input.kind.startsWith("provider.")) {
-      const captured = JSON.parse(value);
-      const snapshot = captured.snapshot;
-      const gatewayId = Object.hasOwn(input.payload, "providerGatewayId") ? input.payload.providerGatewayId : snapshot?.providerGatewayId;
-      if (typeof gatewayId === "string") {
-        const gatewaySnapshot = await c.env.DB.prepare(
-          "SELECT id,type,name,config_json AS config,status,updated_at AS expectedUpdatedAt FROM provider_gateway WHERE id=? AND organization_id=?"
-        ).bind(gatewayId, organizationId).first();
-        if (!gatewaySnapshot)
-          throw new GatewayError(
-            404,
-            "not_found",
-            "Provider gateway was not found in this account"
-          );
-        value = JSON.stringify({
-          ...captured,
-          gatewaySnapshot,
-          expectedGatewayUpdatedAt: gatewaySnapshot.expectedUpdatedAt
-        });
-      }
-    }
-    await enforceEndpointRateLimit(
-      c.env,
-      `operation:${organizationId ?? c.req.header("cf-connecting-ip") ?? "local"}`,
-      10,
-      6e4
-    );
-    const now2 = Date.now();
-    await c.env.DB.prepare(
-      `INSERT OR IGNORE INTO mgmt_handoff(id,kind,request_json,organization_id,initiating_user_id,initiating_credential_id,submission_proof_hash,poll_proof_hash,human_code_hash,expires_at,created_at,updated_at)
-      SELECT ?,?,?,?,?,?,?,?,?,?,?,? WHERE (SELECT COUNT(*) FROM mgmt_handoff WHERE organization_id = ? AND consumed_at IS NULL AND expires_at>?) < 10`
-    ).bind(
-      id,
-      input.kind,
-      value,
-      organizationId,
-      userId,
-      credentialId,
-      await digest2(submissionToken),
-      pollHash,
-      await digest2(humanCode),
-      now2 + TTL,
-      now2,
-      now2,
-      organizationId,
-      now2
-    ).run();
-    row = await c.env.DB.prepare(
-      "SELECT * FROM mgmt_handoff WHERE id=?"
-    ).bind(id).first();
-    if (!row)
-      throw new GatewayError(
-        429,
-        "rate_limited",
-        "Too many pending operations"
-      );
-  }
-  return c.json({
-    id,
-    url: `${meta3.consoleOrigin}/v1/cli/browser/${encodeURIComponent(id)}#${submissionToken}`,
-    expiresAt: new Date(row.expires_at).toISOString(),
-    state: row.consumed_at ? "completed" : row.expires_at <= Date.now() ? "expired" : "pending",
-    ...input.kind === "claim" ? { humanCode } : {},
-    deployment: meta3
-  });
-}
-__name(createOperation, "createOperation");
-async function pollOperation(c) {
-  const row = await challenge(c);
-  const token = c.req.header("authorization")?.replace(/^Bearer /, "");
-  if (!await proofMatches(token, row.poll_proof_hash))
-    throw new GatewayError(403, "forbidden", "Invalid polling proof");
-  const base = {
-    id: row.id,
-    deployment: deployment(c),
-    expiresAt: new Date(row.expires_at).toISOString()
-  };
-  if (row.expires_at <= Date.now())
-    return c.json({ ...base, state: "expired" });
-  if (!row.consumed_at) return c.json({ ...base, state: "pending" });
-  const result = row.outcome ? JSON.parse(row.outcome) : {};
-  const accountId = result.accountId ?? row.organization_id;
-  const account = accountId ? await accountLifecycle(c.env, accountId) : null;
-  return c.json({
-    ...base,
-    state: "completed",
-    result,
-    account
-  });
-}
-__name(pollOperation, "pollOperation");
-
 // src/routes/cli/identity-handoff.ts
 init_errors();
-async function completeIdentity(c, row, allowServiceAccess) {
+function claimRefusal(state, organizationId) {
+  if (state.assurance !== "interactive" || state.user?.kind !== "human" || !state.actor?.credentialId)
+    return "session_required";
+  if (state.memberships.some((member) => member.organization.id !== organizationId))
+    return "account_exists";
+  return null;
+}
+__name(claimRefusal, "claimRefusal");
+async function completeIdentity(c, row) {
   if (row.kind !== "claim")
     throw new GatewayError(400, "invalid_request", "Unsupported identity handoff");
   const state = await authState(c, true);
-  if (state.assurance !== "interactive" || state.user?.kind !== "human" || !state.actor?.credentialId)
+  const refusal = claimRefusal(state, row.organization_id);
+  const approver = state.user;
+  if (refusal === "session_required" || !approver)
     throw new GatewayError(
       401,
       "session_required",
       "Sign in as a person before approving this request"
     );
+  if (refusal === "account_exists")
+    throw new GatewayError(
+      403,
+      "account_exists",
+      "This sign-in already has an account; sign out and create a new sign-in to claim this one"
+    );
   const target2 = row.organization_id;
   await assertAccountAccess(c.env, target2, "claim");
   try {
@@ -80508,7 +80550,11 @@ async function completeIdentity(c, row, allowServiceAccess) {
       provisioning: {
         userId: row.initiating_user_id,
         credentialId: row.initiating_credential_id,
-        revokeAccess: !allowServiceAccess
+        // A claim never retires the CLI that asked for it: the person approving
+        // is at their terminal mid-command, and an approval that logged them
+        // out of it would be a worse answer than anything it could protect
+        // against. Retiring that access is the console's job, afterwards.
+        revokeAccess: false
       }
     });
   } catch (error52) {
@@ -80521,11 +80567,7 @@ async function completeIdentity(c, row, allowServiceAccess) {
        WHERE id=? AND kind='claim' AND consumed_at IS NULL AND expires_at>?`
     ).bind(
       now2,
-      JSON.stringify({
-        accountId: target2,
-        accessGranted: allowServiceAccess,
-        approvedBy: state.user.id
-      }),
+      JSON.stringify({ accountId: target2, approvedBy: approver.id }),
       now2,
       row.id,
       now2
@@ -80551,7 +80593,11 @@ async function completeIdentity(c, row, allowServiceAccess) {
 __name(completeIdentity, "completeIdentity");
 
 // src/routes/cli/browser.ts
-async function verifiedSubmission(c, codeRequired = false) {
+function refusalFor(row, state) {
+  return row.kind === "claim" ? claimRefusal(state, row.organization_id) : null;
+}
+__name(refusalFor, "refusalFor");
+async function verifiedSubmission(c) {
   const meta3 = deployment(c);
   if (new URL(c.req.url).origin !== meta3.consoleOrigin)
     throw new GatewayError(404, "not_found", "Page was not found");
@@ -80571,15 +80617,6 @@ async function verifiedSubmission(c, codeRequired = false) {
     throw new GatewayError(410, "invalid_request", "Operation has expired");
   if (!await proofMatches(input.submissionToken, row.submission_proof_hash))
     throw new GatewayError(403, "forbidden", "Invalid submission proof");
-  if (codeRequired && !await proofMatches(
-    input.humanCode?.trim().toUpperCase(),
-    row.human_code_hash
-  ))
-    throw new GatewayError(
-      403,
-      "forbidden",
-      "Enter the separate code shown in your CLI"
-    );
   await assertAccountAccess(c.env, row.organization_id, row.kind === "claim" ? "claim" : "read");
   return { input, row };
 }
@@ -80598,14 +80635,17 @@ async function browserDetails(c) {
     kind: row.kind,
     payload: visiblePayload,
     account: await accountLifecycle(c.env, row.organization_id),
-    signedIn: state.assurance === "interactive",
+    // Named rather than reduced to a flag: the page shows who is about to
+    // approve, so a person who is signed in as the wrong human can see it.
+    viewer: state.assurance === "interactive" && state.user?.kind === "human" ? { name: state.user.name, email: state.user.email } : null,
+    blockedBy: refusalFor(row, state),
     googleEnabled: googleAuthEnabled(c.env),
     expiresAt: new Date(row.expires_at).toISOString()
   });
 }
 __name(browserDetails, "browserDetails");
 async function browserRegister(c) {
-  const { row, input } = await verifiedSubmission(c, true);
+  const { row, input } = await verifiedSubmission(c);
   if (row.kind !== "claim" || row.consumed_at)
     throw new GatewayError(
       403,
@@ -80631,15 +80671,6 @@ async function browserRegister(c) {
 __name(browserRegister, "browserRegister");
 async function browserSubmit(c) {
   const { row, input } = await verifiedSubmission(c);
-  if (row.kind === "claim" && !await proofMatches(
-    input.humanCode?.trim().toUpperCase(),
-    row.human_code_hash
-  ))
-    throw new GatewayError(
-      403,
-      "forbidden",
-      "Enter the separate code shown in your CLI"
-    );
   if (input.approve !== true)
     throw new GatewayError(
       400,
@@ -80647,13 +80678,7 @@ async function browserSubmit(c) {
       "Explicit approval is required"
     );
   if (row.kind === "claim") {
-    if (typeof input.allowServiceAccess !== "boolean")
-      throw new GatewayError(
-        400,
-        "invalid_request",
-        "Choose whether to allow ongoing CLI access"
-      );
-    await completeIdentity(c, row, input.allowServiceAccess);
+    await completeIdentity(c, row);
   } else {
     await completeProviderSubmission(c, row, input.secret);
   }
@@ -80663,30 +80688,6 @@ async function browserSubmit(c) {
   });
 }
 __name(browserSubmit, "browserSubmit");
-function browserPage(c) {
-  const meta3 = deployment(c);
-  if (new URL(c.req.url).origin !== meta3.consoleOrigin)
-    throw new GatewayError(404, "not_found", "Page was not found");
-  const nonce = crypto.randomUUID().replaceAll("-", "");
-  c.header(
-    "Content-Security-Policy",
-    `default-src 'none'; script-src 'nonce-${nonce}'; style-src 'nonce-${nonce}'; connect-src 'self'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'`
-  );
-  c.header("Referrer-Policy", "no-referrer");
-  c.header("Cache-Control", "no-store");
-  c.header("X-Content-Type-Options", "nosniff");
-  return c.html(`<!doctype html><html lang="en"><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Approve CLI request \xB7 App AI Gateway</title>
-<style nonce="${nonce}">:root{color-scheme:light;font-family:Georgia,serif;color:#17251e;background:#f3f3eb}body{max-width:640px;margin:7vh auto;padding:24px}header{font:13px ui-monospace,monospace;letter-spacing:.12em;color:#48634c}h1{font-weight:400;font-size:40px;line-height:1.1;margin:20px 0}section{background:#fff;padding:28px;border:1px solid #d4dacf;border-radius:8px;margin:20px 0}label{display:block;margin:18px 0 6px}input,select,button{font:16px ui-sans-serif,sans-serif;border:1px solid #9aa89c;border-radius:5px;padding:12px;box-sizing:border-box;width:100%}button{background:#244e38;color:white;margin-top:22px;cursor:pointer}button:disabled{opacity:.5;cursor:wait}input[type=checkbox]{width:auto}pre{white-space:pre-wrap;overflow-wrap:anywhere;font-size:13px}#status{font-family:ui-sans-serif,sans-serif;line-height:1.5}small{font-family:ui-sans-serif,sans-serif;line-height:1.5}</style>
-<header>APP AI GATEWAY / CLI APPROVAL</header><h1>Review the request.</h1><p>Compare the account and action below with your CLI before approving.</p><section><pre id="details">Loading protected request\u2026</pre><form id="signin" hidden><h2>Sign in</h2><label for="email">Email</label><input id="email" type="email" autocomplete="username"><label for="password">Password</label><input id="password" type="password" autocomplete="current-password"><button>Sign in</button><div id="registration" hidden><label for="name">Name for your account</label><input id="name" autocomplete="name"><label for="registrationCode">Separate claim code shown in your CLI</label><input id="registrationCode" autocomplete="off"><button type="button" id="register">Create your login</button></div><button type="button" id="google" hidden>Continue with Google</button></form><form id="approve" hidden><label for="secret" id="secretLabel" hidden>Provider credential</label><input id="secret" type="password" autocomplete="off" hidden><label for="code" id="codeLabel">Separate code shown in your CLI</label><input id="code" autocomplete="off" spellcheck="false" required><label><input id="confirm" type="checkbox" required> I approve this action for the account shown above.</label><label id="ongoingLabel"><input id="ongoing" type="checkbox" checked> Keep this service identity and its role-based management access.</label><button>Approve request</button></form></section><p id="status" role="status"></p><small>This page never displays management credentials. Provider credentials are submitted directly to your gateway.</small>
-<script nonce="${nonce}">let saved=null;try{saved=JSON.parse(sessionStorage.getItem(location.pathname)||'null')}catch{}if(saved&&saved.expiresAt<=Date.now()){sessionStorage.removeItem(location.pathname);saved=null}const token=location.hash.slice(1)||saved?.token||'';history.replaceState(null,'',location.pathname);const base=location.pathname;const details=document.getElementById('details'),status=document.getElementById('status');let current;
-async function call(path,body){const r=await fetch(path,{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify(body)});const data=await r.json();if(!r.ok)throw Error(data.error?.message||data.message||'Request failed');return data}
-async function load(){current=await call(base+'/details',{submissionToken:token});sessionStorage.setItem(base,JSON.stringify({token,expiresAt:Date.parse(current.expiresAt)}));details.textContent=JSON.stringify({action:current.kind,account:current.account,configuration:current.payload,expiresAt:current.expiresAt},null,2);const identity=current.kind==='claim';document.getElementById('signin').hidden=!identity||current.signedIn;document.getElementById('registration').hidden=!identity;document.getElementById('google').hidden=!current.googleEnabled;document.getElementById('approve').hidden=identity&&!current.signedIn;const needsSecret=!identity&&!(current.kind==='provider.add'&&current.payload.providerGatewayId);document.getElementById('secret').hidden=!needsSecret;document.getElementById('secret').required=needsSecret;document.getElementById('secretLabel').hidden=!needsSecret;document.getElementById('ongoingLabel').hidden=!identity;document.getElementById('code').required=identity;document.getElementById('code').hidden=!identity;document.getElementById('codeLabel').hidden=!identity;}
-document.getElementById('signin').onsubmit=async e=>{e.preventDefault();try{await call('/v1/auth/sign-in/email',{email:document.getElementById('email').value,password:document.getElementById('password').value});document.getElementById('password').value='';await load()}catch(e){status.textContent=e.message}};
-document.getElementById('register').onclick=async()=>{try{await call(base+'/register',{submissionToken:token,humanCode:document.getElementById('registrationCode').value,email:document.getElementById('email').value,password:document.getElementById('password').value,name:document.getElementById('name').value});document.getElementById('password').value='';await load()}catch(e){status.textContent=e.message}};
-document.getElementById('google').onclick=async()=>{try{const result=await call(current.kind==='claim'?base+'/google':'/v1/auth/sign-in/social',current.kind==='claim'?{submissionToken:token,humanCode:document.getElementById('registrationCode').value}:{provider:'google',callbackURL:location.href});location.href=result.url}catch(e){status.textContent=e.message}};
-document.getElementById('approve').onsubmit=async e=>{e.preventDefault();const b=e.target.querySelector('button');b.disabled=true;try{const value={submissionToken:token,humanCode:document.getElementById('code').value,approve:true,allowServiceAccess:document.getElementById('ongoing').checked};if(!document.getElementById('secret').hidden)value.secret=document.getElementById('secret').value;await call(base+'/submit',value);document.getElementById('secret').value='';status.textContent='Approved. Return to your CLI.';sessionStorage.removeItem(base);e.target.hidden=true}catch(e){status.textContent=e.message;b.disabled=false}};load().catch(e=>status.textContent=e.message);<\/script></html>`);
-}
-__name(browserPage, "browserPage");
 
 // src/routes/cli/oauth.ts
 var CLAIM_OAUTH_COOKIE = "cli_claim_oauth";
@@ -80710,7 +80711,7 @@ async function claimOAuthAuthorized(env2, request) {
 }
 __name(claimOAuthAuthorized, "claimOAuthAuthorized");
 async function browserGoogle(c) {
-  const { row } = await verifiedSubmission(c, true);
+  const { row } = await verifiedSubmission(c);
   if (row.kind !== "claim" || row.consumed_at)
     throw new GatewayError(403, "forbidden", "Google registration requires a pending claim");
   const meta3 = deployment(c);
@@ -80719,7 +80720,7 @@ async function browserGoogle(c) {
   const rawResult = await createClaimRegistrationAuth(c.env, c.req.url).auth.api.signInSocial({
     body: {
       provider: "google",
-      callbackURL: `${meta3.consoleOrigin}/v1/cli/browser/${encodeURIComponent(row.id)}`
+      callbackURL: `${meta3.consoleOrigin}${browserPath(row.id)}`
     },
     headers: c.req.raw.headers,
     asResponse: true
@@ -80941,7 +80942,7 @@ GROUP BY app_id`).bind(organizationId, month).all();
 __name(organizationMonthUsage, "organizationMonthUsage");
 
 // package.json
-var version4 = "0.1.3";
+var version4 = "0.1.5";
 
 // src/core/version.ts
 var SERVER_VERSION = version4;
@@ -80984,7 +80985,6 @@ cliRoutes.get("/capabilities", (c) => {
 cliRoutes.post("/bootstrap", bootstrap);
 cliRoutes.post("/operations", createOperation);
 cliRoutes.get("/operations/:id", pollOperation);
-cliRoutes.get("/browser/:id", browserPage);
 cliRoutes.post("/browser/:id/details", browserDetails);
 cliRoutes.post("/browser/:id/submit", browserSubmit);
 cliRoutes.post("/browser/:id/register", browserRegister);