@nebulr-group/bridge-cli 0.6.6 → 1.0.0-alpha.1

package/dist/api/flags.js

@@ -0,0 +1,108 @@
+import { CliError } from '../core/errors.js';
+export const FLAG_STATES = ['off', 'on', 'on-with-rule'];
+export const VALUE_TYPES = ['boolean', 'string', 'number', 'json'];
+export const OPERATORS = ['eq', 'neq', 'contains', 'not_contains', 'in', 'not_in', 'gt', 'lt', 'between', 'regex', 'exists', 'not_exists'];
+const body = (answer) => answer.body;
+/** `If-Match` for a change made on the flag as it was read: version 2 refuses a change that names no revision. */
+const revisionOf = (flag) => ({ 'if-match': `"${String(flag.revision)}"` });
+export const flags = {
+    list: (c, appId) => c.person('flagsList', { params: { appId } }).then(body),
+    get: (c, appId, key) => c.person('flagsGet', { params: { appId, key } }).then(body),
+    create: (c, appId, fields) => c.person('flagsCreate', { params: { appId }, body: fields }).then(body),
+    /** Changes the flag as it is now: read, changed, written with its revision, so a change made meanwhile is never overwritten. */
+    async update(c, appId, key, change) {
+        const current = await flags.get(c, appId, key);
+        const fields = typeof change === 'function' ? change(current) : change;
+        return c.person('flagsUpdate', { params: { appId, key }, body: fields, headers: revisionOf(current) }).then(body);
+    },
+    async remove(c, appId, key) {
+        const current = await flags.get(c, appId, key);
+        return c.person('flagsDelete', { params: { appId, key }, headers: revisionOf(current) }).then(body);
+    },
+    /** Switches the flag off and keeps its rule, so `restore` brings back what it was. */
+    kill: (c, appId, key) => c.person('flagsKill', { params: { appId, key } }).then(body),
+    restore: (c, appId, key) => c.person('flagsRestore', { params: { appId, key } }).then(body),
+    segments: (c, appId) => c.person('segmentsList', { params: { appId } }).then(body),
+};
+/** A value written in a condition: true, false, null and numbers as themselves, anything else as text. */
+function conditionValue(raw) {
+    if (raw === 'true')
+        return true;
+    if (raw === 'false')
+        return false;
+    if (raw === 'null')
+        return null;
+    if (/^-?\d+(\.\d+)?$/.test(raw))
+        return Number(raw);
+    return raw.replace(/^"(.*)"$/, '$1');
+}
+/**
+ * One condition written in words: `<attribute> <operator> [value[,value…]]`.
+ * `in`, `not_in` and `between` take a comma-separated list; `exists` and
+ * `not_exists` take none.
+ *
+ *   privileges contains USER_WRITE
+ *   bridge:billing.entitlement.analytics eq true
+ *   user.email in a@example.com,b@example.com
+ */
+export function parseCondition(text) {
+    const match = /^\s*(\S+)\s+(\S+)(?:\s+(.*?))?\s*$/.exec(text);
+    if (!match)
+        throw new CliError('invalid', `A condition is "<attribute> <operator> <value>": ${text}`);
+    const [, attribute, operator, rest] = match;
+    if (!OPERATORS.includes(operator)) {
+        throw new CliError('invalid', `${operator} is not an operator. The operators are: ${OPERATORS.join(', ')}.`);
+    }
+    const op = operator;
+    if (op === 'exists' || op === 'not_exists') {
+        if (rest)
+            throw new CliError('invalid', `${op} takes no value: ${text}`);
+        return { attribute, operator: op, values: [] };
+    }
+    if (rest === undefined || rest === '')
+        throw new CliError('invalid', `${op} needs a value: ${text}`);
+    const values = op === 'in' || op === 'not_in' || op === 'between' ? rest.split(',').map((each) => conditionValue(each.trim())) : [conditionValue(rest)];
+    if (op === 'between' && values.length !== 2)
+        throw new CliError('invalid', `between takes two values, "low,high": ${text}`);
+    return { attribute, operator: op, values };
+}
+/** A flag value written on the command line, read as the flag's type. */
+export function parseValue(raw, type) {
+    switch (type) {
+        case 'boolean':
+            if (raw !== 'true' && raw !== 'false')
+                throw new CliError('invalid', `A boolean flag's value is true or false, not ${raw}.`);
+            return raw === 'true';
+        case 'number': {
+            const n = Number(raw);
+            if (raw.trim() === '' || !Number.isFinite(n))
+                throw new CliError('invalid', `A number flag's value is a number, not ${raw}.`);
+            return n;
+        }
+        case 'json':
+            try {
+                return JSON.parse(raw);
+            }
+            catch {
+                throw new CliError('invalid', `A json flag's value is JSON: ${raw}`);
+            }
+        default:
+            return raw;
+    }
+}
+/** A rule given as JSON, checked for its shape before it is sent. */
+export function parseRule(json) {
+    let parsed;
+    try {
+        parsed = JSON.parse(json);
+    }
+    catch {
+        throw new CliError('invalid', 'The rule is not valid JSON.');
+    }
+    const rule = parsed;
+    if (typeof rule !== 'object' || rule === null || !Array.isArray(rule.branches) || !('otherwiseValue' in rule)) {
+        throw new CliError('invalid', 'A rule is { "branches": [{ "conditions": [...], "returnValue": … }], "otherwiseValue": … }.');
+    }
+    return rule;
+}
+//# sourceMappingURL=flags.js.map

package/dist/api/flags.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flags.js","sourceRoot":"","sources":["../../src/api/flags.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,cAAc,CAAU,CAAC;AAElE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAU,CAAC;AAE5E,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAU,CAAC;AA8CpJ,MAAM,IAAI,GAAG,CAAI,MAAmB,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC;AAErD,kHAAkH;AAClH,MAAM,UAAU,GAAG,CAAC,IAAU,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;AAElF,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,IAAI,EAAE,CAAC,CAAe,EAAE,KAAa,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAS,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IACzG,GAAG,EAAE,CAAC,CAAe,EAAE,KAAa,EAAE,GAAW,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAO,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IACvH,MAAM,EAAE,CAAC,CAAe,EAAE,KAAa,EAAE,MAAoC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAO,aAAa,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAE/J,gIAAgI;IAChI,KAAK,CAAC,MAAM,CAAC,CAAe,EAAE,KAAa,EAAE,GAAW,EAAE,MAAiD;QACzG,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,OAAO,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACvE,OAAO,CAAC,CAAC,MAAM,CAAO,aAAa,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1H,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,CAAe,EAAE,KAAa,EAAE,GAAW;QACtD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;QAC/C,OAAO,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtG,CAAC;IACD,sFAAsF;IACtF,IAAI,EAAE,CAAC,CAAe,EAAE,KAAa,EAAE,GAAW,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAO,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IACzH,OAAO,EAAE,CAAC,CAAe,EAAE,KAAa,EAAE,GAAW,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAO,cAAc,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAC/H,QAAQ,EAAE,CAAC,CAAe,EAAE,KAAa,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;CACzG,CAAC;AAEF,0GAA0G;AAC1G,SAAS,cAAc,CAAC,GAAW;IACjC,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAClC,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACpD,OAAO,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,KAAK,GAAG,oCAAoC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9D,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,QAAQ,CAAC,SAAS,EAAE,oDAAoD,IAAI,EAAE,CAAC,CAAC;IACtG,MAAM,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,KAAgE,CAAC;IACvG,IAAI,CAAE,SAA+B,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,QAAQ,CAAC,SAAS,EAAE,GAAG,QAAQ,2CAA2C,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/G,CAAC;IACD,MAAM,EAAE,GAAG,QAAoB,CAAC;IAChC,IAAI,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,YAAY,EAAE,CAAC;QAC3C,IAAI,IAAI;YAAE,MAAM,IAAI,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAC;QACzE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACjD,CAAC;IACD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE;QAAE,MAAM,IAAI,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE,mBAAmB,IAAI,EAAE,CAAC,CAAC;IACrG,MAAM,MAAM,GAAG,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;IACxJ,IAAI,EAAE,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,SAAS,EAAE,yCAAyC,IAAI,EAAE,CAAC,CAAC;IAC5H,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;AAC7C,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,IAAe;IACrD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,SAAS;YACZ,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,OAAO;gBAAE,MAAM,IAAI,QAAQ,CAAC,SAAS,EAAE,gDAAgD,GAAG,GAAG,CAAC,CAAC;YAC7H,OAAO,GAAG,KAAK,MAAM,CAAC;QACxB,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YACtB,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAAE,MAAM,IAAI,QAAQ,CAAC,SAAS,EAAE,0CAA0C,GAAG,GAAG,CAAC,CAAC;YAC9H,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,MAAM;YACT,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,QAAQ,CAAC,SAAS,EAAE,gCAAgC,GAAG,EAAE,CAAC,CAAC;YACvE,CAAC;QACH;YACE,OAAO,GAAG,CAAC;IACf,CAAC;AACH,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAAC,SAAS,EAAE,6BAA6B,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,IAAI,GAAG,MAAuB,CAAC;IACrC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,gBAAgB,IAAI,IAAI,CAAC,EAAE,CAAC;QAC9G,MAAM,IAAI,QAAQ,CAAC,SAAS,EAAE,6FAA6F,CAAC,CAAC;IAC/H,CAAC;IACD,OAAO,IAAY,CAAC;AACtB,CAAC"}

package/dist/api/keys.d.ts

@@ -0,0 +1,48 @@
+import type { BridgeClient } from '../client.js';
+export interface Key {
+    readonly id: string;
+    readonly name: string;
+    readonly kind?: string;
+    readonly privileges: string[];
+    readonly expiresAt: string;
+    readonly revoked?: boolean;
+    readonly [field: string]: unknown;
+}
+/** A key just made: the secret is in `key`, shown this once. */
+export interface MadeKey extends Key {
+    readonly key: string;
+}
+export interface KeyFields {
+    readonly name: string;
+    readonly privileges?: string[];
+    readonly expiresInDays?: number;
+}
+export declare const keys: {
+    list(c: BridgeClient, appId: string): Promise<Key[]>;
+    create(c: BridgeClient, appId: string, fields: KeyFields): Promise<MadeKey>;
+    revoke(c: BridgeClient, appId: string, keyId: string): Promise<void>;
+};
+/** The app an app key belongs to: keys read `bk.<app>.<id>.<secret>`. */
+export declare function appOfKey(key: string): string | null;
+/** What `withAppKey` reports with and listens to. Real ones by default; tests pass their own. */
+export interface AppKeyOptions {
+    readonly warn?: (message: string) => void;
+    /** Where SIGINT and SIGTERM arrive. */
+    readonly signals?: Pick<NodeJS.EventEmitter, 'on' | 'off'>;
+    readonly exit?: (code: number) => void;
+    /** How long a revoke may take when the command is stopped, in ms. */
+    readonly revokeTimeoutMs?: number;
+}
+/**
+ * Runs `fn` with an app key of the app, for the routes version 2 offers
+ * only to the app's own server.
+ *
+ * The key is `BRIDGE_APP_KEY` when it is set (it must be this app's).
+ * Otherwise the CLI makes a key that lasts one day and holds only the
+ * privileges this command needs, and revokes it once `fn` is done, when it
+ * fails, and when the command is stopped (Ctrl-C, SIGTERM). If it cannot be
+ * revoked, the CLI says which key to revoke (its id, never its secret).
+ * Making a key needs a recent sign-in.
+ */
+export declare function withAppKey<T>(c: BridgeClient, appId: string, privileges: string[], env: NodeJS.ProcessEnv, fn: (key: string) => Promise<T>, options?: AppKeyOptions): Promise<T>;
+//# sourceMappingURL=keys.d.ts.map

package/dist/api/keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../src/api/keys.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAGjD,MAAM,WAAW,GAAG;IAClB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CACnC;AAED,gEAAgE;AAChE,MAAM,WAAW,OAAQ,SAAQ,GAAG;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,eAAO,MAAM,IAAI;YACD,YAAY,SAAS,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;cAG1C,YAAY,SAAS,MAAM,UAAU,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC;cAGjE,YAAY,SAAS,MAAM,SAAS,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAG3E,CAAC;AAEF,yEAAyE;AACzE,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGnD;AAED,iGAAiG;AACjG,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAC1C,uCAAuC;IACvC,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,GAAG,KAAK,CAAC,CAAC;IAC3D,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC,qEAAqE;IACrE,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAID;;;;;;;;;;GAUG;AACH,wBAAsB,UAAU,CAAC,CAAC,EAChC,CAAC,EAAE,YAAY,EACf,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAAE,EACpB,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,EAC/B,OAAO,GAAE,aAAkB,GAC1B,OAAO,CAAC,CAAC,CAAC,CAuDZ"}

package/dist/api/keys.js

@@ -0,0 +1,87 @@
+import { CliError } from '../core/errors.js';
+export const keys = {
+    async list(c, appId) {
+        return (await c.person('keysList', { params: { appId } })).body;
+    },
+    async create(c, appId, fields) {
+        return (await c.person('keysCreate', { params: { appId }, body: fields })).body;
+    },
+    async revoke(c, appId, keyId) {
+        await c.person('keysRevoke', { params: { appId, keyId } });
+    },
+};
+/** The app an app key belongs to: keys read `bk.<app>.<id>.<secret>`. */
+export function appOfKey(key) {
+    const parts = key.split('.');
+    return parts.length === 4 && parts[0] === 'bk' && parts[1] !== '' ? parts[1] : null;
+}
+const SIGNALS = { SIGINT: 130, SIGTERM: 143 };
+/**
+ * Runs `fn` with an app key of the app, for the routes version 2 offers
+ * only to the app's own server.
+ *
+ * The key is `BRIDGE_APP_KEY` when it is set (it must be this app's).
+ * Otherwise the CLI makes a key that lasts one day and holds only the
+ * privileges this command needs, and revokes it once `fn` is done, when it
+ * fails, and when the command is stopped (Ctrl-C, SIGTERM). If it cannot be
+ * revoked, the CLI says which key to revoke (its id, never its secret).
+ * Making a key needs a recent sign-in.
+ */
+export async function withAppKey(c, appId, privileges, env, fn, options = {}) {
+    const warn = options.warn ?? ((message) => process.stderr.write(`${message}\n`));
+    const signals = options.signals ?? process;
+    const exit = options.exit ?? ((code) => process.exit(code));
+    const given = env['BRIDGE_APP_KEY']?.trim();
+    if (given) {
+        const owner = appOfKey(given);
+        if (owner !== null && owner !== appId) {
+            throw new CliError('misconfigured', `BRIDGE_APP_KEY belongs to app ${owner}, not to ${appId}.`);
+        }
+        return fn(given);
+    }
+    let made;
+    try {
+        made = await keys.create(c, appId, { name: 'bridge-cli (temporary)', privileges, expiresInDays: 1 });
+    }
+    catch (error) {
+        if (error instanceof CliError && error.kind === 'reauthenticate') {
+            throw new CliError('reauthenticate', 'This command makes a short-lived app key, which needs a recent sign-in.', {
+                status: error.status,
+                hint: 'Sign in again with `bridge auth login` and run it within 5 minutes, or set BRIDGE_APP_KEY to one of the app\'s keys.',
+            });
+        }
+        throw error;
+    }
+    let revoking;
+    const revoke = (timeoutMs) => {
+        revoking ??= (async () => {
+            const attempt = keys.revoke(c, appId, made.id);
+            const limited = timeoutMs === undefined
+                ? attempt
+                : Promise.race([attempt, new Promise((_, reject) => setTimeout(() => reject(new Error(`no answer within ${String(timeoutMs / 1000)} s`)), timeoutMs).unref?.())]);
+            try {
+                await limited;
+            }
+            catch (error) {
+                const reason = error instanceof Error ? error.message : String(error);
+                warn(`The temporary key ${made.id} could not be revoked (${reason}); it expires within a day. Revoke it with \`bridge key revoke ${made.id}\`.`);
+            }
+        })();
+        return revoking;
+    };
+    const handlers = Object.entries(SIGNALS).map(([signal, code]) => {
+        const handler = () => {
+            void revoke(options.revokeTimeoutMs ?? 5000).then(() => exit(code));
+        };
+        signals.on(signal, handler);
+        return () => signals.off(signal, handler);
+    });
+    try {
+        return await fn(made.key);
+    }
+    finally {
+        await revoke();
+        handlers.forEach((stop) => stop());
+    }
+}
+//# sourceMappingURL=keys.js.map

package/dist/api/keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../src/api/keys.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAuB7C,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,KAAK,CAAC,IAAI,CAAC,CAAe,EAAE,KAAa;QACvC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAQ,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACzE,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,CAAe,EAAE,KAAa,EAAE,MAAiB;QAC5D,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAU,YAAY,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3F,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,CAAe,EAAE,KAAa,EAAE,KAAa;QACxD,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IAC7D,CAAC;CACF,CAAC;AAEF,yEAAyE;AACzE,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAE,KAAK,CAAC,CAAC,CAAY,CAAC,CAAC,CAAC,IAAI,CAAC;AAClG,CAAC;AAYD,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAW,CAAC;AAEvD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,CAAe,EACf,KAAa,EACb,UAAoB,EACpB,GAAsB,EACtB,EAA+B,EAC/B,UAAyB,EAAE;IAE3B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,OAAe,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC,CAAC;IACzF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC;IAC3C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,GAAG,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC;IAC5C,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;YACtC,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,iCAAiC,KAAK,YAAY,KAAK,GAAG,CAAC,CAAC;QAClG,CAAC;QACD,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IACD,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC;IACvG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACjE,MAAM,IAAI,QAAQ,CAAC,gBAAgB,EAAE,yEAAyE,EAAE;gBAC9G,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,IAAI,EAAE,sHAAsH;aAC7H,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IAED,IAAI,QAAmC,CAAC;IACxC,MAAM,MAAM,GAAG,CAAC,SAAkB,EAAiB,EAAE;QACnD,QAAQ,KAAK,CAAC,KAAK,IAAI,EAAE;YACvB,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YAC/C,MAAM,OAAO,GACX,SAAS,KAAK,SAAS;gBACrB,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,oBAAoB,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;YAC7K,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC;YAChB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACtE,IAAI,CAAC,qBAAqB,IAAI,CAAC,EAAE,0BAA0B,MAAM,kEAAkE,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;YACnJ,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE;QAC9D,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,KAAK,MAAM,CAAC,OAAO,CAAC,eAAe,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACtE,CAAC,CAAC;QACF,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC5B,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,EAAE,CAAC;QACf,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IACrC,CAAC;AACH,CAAC"}

package/dist/auth/browser-open.d.ts

@@ -3,10 +3,27 @@ export interface OpenBrowserResult {
     /** Short reason the launch failed (only set when `ok === false`). */
     reason?: string;
 }
+/** The program and the argument array that open `url` on `platform`. Exposed for tests. */
+export declare function browserCommand(url: string, platform: NodeJS.Platform): {
+    command: string;
+    args: string[];
+};
+type ExecFile = (file: string, args: readonly string[], options: {
+    windowsHide: boolean;
+    shell: false;
+}, callback: (error: Error | null) => void) => {
+    unref?: () => void;
+    on?: (event: 'error', listener: (error: Error) => void) => unknown;
+} | undefined;
+export interface OpenBrowserDeps {
+    readonly platform?: NodeJS.Platform;
+    readonly execFile?: ExecFile;
+}
 /**
- * Attempts to open `url` in the user's default browser. Resolves to
- * `{ ok: true }` on success, `{ ok: false, reason }` on failure (caller
- * should print the URL and ask the user to open it manually).
+ * Attempts to open `url` in the person's default browser. Resolves to
+ * `{ ok: true }` on success, `{ ok: false, reason }` on failure (the caller
+ * then prints the address to open by hand).
  */
-export declare function openBrowser(url: string): Promise<OpenBrowserResult>;
+export declare function openBrowser(url: string, deps?: OpenBrowserDeps): Promise<OpenBrowserResult>;
+export {};
 //# sourceMappingURL=browser-open.d.ts.map

package/dist/auth/browser-open.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"browser-open.d.ts","sourceRoot":"","sources":["../../src/auth/browser-open.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA6DzE"}
+{"version":3,"file":"browser-open.d.ts","sourceRoot":"","sources":["../../src/auth/browser-open.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,2FAA2F;AAC3F,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAI1G;AAED,KAAK,QAAQ,GAAG,CACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,EAAE;IAAE,WAAW,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,KAAK,CAAA;CAAE,EAC/C,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,KAAK,IAAI,KACpC;IAAE,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;IAAC,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,KAAK,OAAO,CAAA;CAAE,GAAG,SAAS,CAAC;AAE5G,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IACpC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;CAC9B;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA6BrG"}

package/dist/auth/browser-open.js

@@ -1,81 +1,61 @@
 /**
- * Cross-platform default-browser opener.
+ * Opens an address in the default browser, with no shell anywhere.
  *
- * Uses `child_process.spawn` to invoke the platform's "open this URL" command:
+ * Each platform's opener gets the address as one argument of an argument
+ * array, through `execFile`, which never starts a shell:
  *   - macOS:   `open <url>`
- *   - Windows: `cmd /c start "" <url>`   (the empty `""` is the window title;
- *              omitting it makes `start` interpret the URL as the title)
- *   - Linux:   `xdg-open <url>`          (most desktops; requires xdg-utils)
+ *   - Windows: `rundll32 url.dll,FileProtocolHandler <url>`. Never `cmd /c start`:
+ *     cmd cuts the address at `&` and runs what follows as commands.
+ *   - Linux and the rest: `xdg-open <url>`
  *
- * Returns `false` if the spawn fails or the command exits non-zero, so callers
- * can fall back to printing the URL.
- *
- * Implemented directly on `child_process` to avoid a heavyweight dependency
- * for what is ~30 lines of platform detection.
+ * Only addresses the CLI would call itself are opened: https, or http on
+ * this machine. Anything else (`file:`, `javascript:`, a plain-http host) is
+ * refused before any program runs.
  */
-import { spawn } from 'node:child_process';
+import { execFile } from 'node:child_process';
+import { secureUrl } from '../core/urls.js';
+/** The program and the argument array that open `url` on `platform`. Exposed for tests. */
+export function browserCommand(url, platform) {
+    if (platform === 'darwin')
+        return { command: 'open', args: [url] };
+    if (platform === 'win32')
+        return { command: 'rundll32', args: ['url.dll,FileProtocolHandler', url] };
+    return { command: 'xdg-open', args: [url] };
+}
 /**
- * Attempts to open `url` in the user's default browser. Resolves to
- * `{ ok: true }` on success, `{ ok: false, reason }` on failure (caller
- * should print the URL and ask the user to open it manually).
+ * Attempts to open `url` in the person's default browser. Resolves to
+ * `{ ok: true }` on success, `{ ok: false, reason }` on failure (the caller
+ * then prints the address to open by hand).
  */
-export async function openBrowser(url) {
-    const platform = process.platform;
-    let command;
-    let args;
-    if (platform === 'darwin') {
-        command = 'open';
-        args = [url];
-    }
-    else if (platform === 'win32') {
-        // `cmd /c start "" <url>` — empty quoted string is the (ignored) window title.
-        command = 'cmd';
-        args = ['/c', 'start', '""', url];
-    }
-    else {
-        // Treat anything else (linux, freebsd, etc.) as xdg-open.
-        command = 'xdg-open';
-        args = [url];
-    }
+export async function openBrowser(url, deps = {}) {
+    const parsed = secureUrl(url);
+    if (parsed === null)
+        return { ok: false, reason: 'only https addresses (http on this machine) are opened' };
+    const { command, args } = browserCommand(parsed.toString(), deps.platform ?? process.platform);
+    const run = deps.execFile ?? execFile;
     return new Promise((resolve) => {
-        let child;
-        try {
-            child = spawn(command, args, {
-                stdio: 'ignore',
-                // detached so the browser process lives independently of the CLI.
-                // unref() so the CLI can exit without waiting for the browser to close.
-                detached: true,
-            });
-        }
-        catch (err) {
-            resolve({ ok: false, reason: err instanceof Error ? err.message : String(err) });
-            return;
-        }
         let settled = false;
-        const settle = (r) => {
+        const settle = (result) => {
             if (settled)
                 return;
             settled = true;
-            resolve(r);
+            resolve(result);
         };
-        child.on('error', (err) => {
-            settle({ ok: false, reason: err.message });
-        });
-        child.on('exit', (code) => {
-            if (code === 0 || code === null) {
-                settle({ ok: true });
-            }
-            else {
-                settle({ ok: false, reason: `${command} exited with code ${code}` });
-            }
-        });
-        // Don't block CLI shutdown waiting on the browser process.
-        child.unref?.();
-        // Most platforms exit (or detach) within a fraction of a second. If we
-        // don't hear back in 2s we optimistically declare success — at worst the
-        // browser opened but the parent process hung. The user only sees a
-        // problem if no callback ever arrives, and the loopback timeout handles
-        // that case.
+        try {
+            const child = run(command, args, { windowsHide: true, shell: false }, (error) => {
+                settle(error ? { ok: false, reason: error.message } : { ok: true });
+            });
+            child?.on?.('error', (error) => settle({ ok: false, reason: error.message }));
+            // Don't keep the CLI alive for the opener.
+            child?.unref?.();
+        }
+        catch (error) {
+            settle({ ok: false, reason: error instanceof Error ? error.message : String(error) });
+            return;
+        }
+        // Most openers return within a fraction of a second. If this one has not
+        // answered in 2 s, assume the browser opened; the loopback's timeout
+        // covers the case where no callback ever arrives.
         setTimeout(() => settle({ ok: true }), 2000).unref?.();
     });
 }

package/dist/auth/browser-open.js.map

@@ -1 +1 @@
-{"version":3,"file":"browser-open.js","sourceRoot":"","sources":["../../src/auth/browser-open.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAQ3C;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAW;IAC3C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,IAAI,OAAe,CAAC;IACpB,IAAI,IAAc,CAAC;IAEnB,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,GAAG,MAAM,CAAC;QACjB,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;SAAM,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChC,+EAA+E;QAC/E,OAAO,GAAG,KAAK,CAAC;QAChB,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACpC,CAAC;SAAM,CAAC;QACN,0DAA0D;QAC1D,OAAO,GAAG,UAAU,CAAC;QACrB,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;IAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YACH,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE;gBAC3B,KAAK,EAAE,QAAQ;gBACf,kEAAkE;gBAClE,wEAAwE;gBACxE,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACjF,OAAO;QACT,CAAC;QAED,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,CAAoB,EAAE,EAAE;YACtC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,CAAC,CAAC,CAAC,CAAC;QACb,CAAC,CAAC;QAEF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YACxB,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAChC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,qBAAqB,IAAI,EAAE,EAAE,CAAC,CAAC;YACvE,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,2DAA2D;QAC3D,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAEhB,uEAAuE;QACvE,yEAAyE;QACzE,mEAAmE;QACnE,wEAAwE;QACxE,aAAa;QACb,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"browser-open.js","sourceRoot":"","sources":["../../src/auth/browser-open.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAQ5C,2FAA2F;AAC3F,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,QAAyB;IACnE,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IACnE,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,6BAA6B,EAAE,GAAG,CAAC,EAAE,CAAC;IACrG,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;AAC9C,CAAC;AAcD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,OAAwB,EAAE;IACvE,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wDAAwD,EAAE,CAAC;IAC5G,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,cAAc,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/F,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAK,QAAgC,CAAC;IAE/D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,MAAyB,EAAE,EAAE;YAC3C,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC;QACF,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC9E,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACtE,CAAC,CAAC,CAAC;YACH,KAAK,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC9E,2CAA2C;YAC3C,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACtF,OAAO;QACT,CAAC;QACD,yEAAyE;QACzE,qEAAqE;QACrE,kDAAkD;QAClD,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/auth/lock.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Runs `fn` while holding a lock file, so two commands running at once never
+ * renew with the same refresh token. Bridge rotates refresh tokens and ends
+ * the session when one is used twice; this keeps that from happening by
+ * accident. A lock left by a command that crashed is taken over after 30 s.
+ */
+export declare function withLock<T>(dir: string, name: string, fn: () => Promise<T>): Promise<T>;
+//# sourceMappingURL=lock.d.ts.map

package/dist/auth/lock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock.d.ts","sourceRoot":"","sources":["../../src/auth/lock.ts"],"names":[],"mappings":"AASA;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAyB7F"}

package/dist/auth/lock.js

@@ -0,0 +1,43 @@
+import { lstat, open, unlink } from 'node:fs/promises';
+import { join } from 'node:path';
+import { ensurePrivateDir } from '../core/private-files.js';
+const STALE_MS = 30_000;
+const WAIT_MS = 15_000;
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/**
+ * Runs `fn` while holding a lock file, so two commands running at once never
+ * renew with the same refresh token. Bridge rotates refresh tokens and ends
+ * the session when one is used twice; this keeps that from happening by
+ * accident. A lock left by a command that crashed is taken over after 30 s.
+ */
+export async function withLock(dir, name, fn) {
+    await ensurePrivateDir(dir);
+    const path = join(dir, `${name}.lock`);
+    const deadline = Date.now() + WAIT_MS;
+    for (;;) {
+        try {
+            const handle = await open(path, 'wx', 0o600);
+            await handle.close();
+            break;
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST')
+                throw error;
+            const age = await lstat(path).then((info) => Date.now() - info.mtimeMs, () => 0);
+            if (age > STALE_MS) {
+                await unlink(path).catch(() => undefined);
+                continue;
+            }
+            if (Date.now() > deadline)
+                throw new Error(`Another bridge command holds ${path}. If none is running, delete that file.`);
+            await sleep(100);
+        }
+    }
+    try {
+        return await fn();
+    }
+    finally {
+        await unlink(path).catch(() => undefined);
+    }
+}
+//# sourceMappingURL=lock.js.map

package/dist/auth/lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock.js","sourceRoot":"","sources":["../../src/auth/lock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAE5D,MAAM,QAAQ,GAAG,MAAM,CAAC;AACxB,MAAM,OAAO,GAAG,MAAM,CAAC;AAEvB,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAEhF;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAI,GAAW,EAAE,IAAY,EAAE,EAAoB;IAC/E,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;IACtC,SAAS,CAAC;QACR,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAC7C,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACrB,MAAM;QACR,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;YACpE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;YACjF,IAAI,GAAG,GAAG,QAAQ,EAAE,CAAC;gBACnB,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAC1C,SAAS;YACX,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,yCAAyC,CAAC,CAAC;YAC1H,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,EAAE,CAAC;IACpB,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC"}

package/dist/auth/loopback.d.ts

@@ -3,22 +3,17 @@ export interface LoopbackResult {
     state: string;
 }
 export interface RunLoopbackOptions {
-    /** The CSRF state the caller generated; must match what the IdP echoes. */
+    /** The CSRF state the caller generated; must match what the page echoes. */
     expectedState: string;
-    /**
-     * If set, the loopback responds 302 → this URL on success instead of
-     * rendering the inline HTML. Used to bounce the browser to a hosted,
-     * branded "you can close this tab" page on cloud-views.
-     * Falls back to inline HTML if not provided.
-     */
-    successRedirectUrl?: string;
-    /** Body of the success page rendered to the browser when no redirect URL is set. */
+    /** The issuer: the callback must name it (`iss`, RFC 9207). */
+    expectedIssuer?: string;
+    /** Body of the success page rendered to the browser. */
     successHtml?: string;
     /** Total time (ms) we'll wait for the redirect before giving up. */
     timeoutMs?: number;
 }
 export interface StartedLoopback {
-    /** The redirect URI to pass to the IdP, e.g. `http://127.0.0.1:54321/callback`. */
+    /** The redirect URI to pass to the sign-in page, e.g. `http://127.0.0.1:54321/callback`. */
     redirectUri: string;
     /** Resolves with the verified `{ code, state }` once the redirect arrives. */
     result: Promise<LoopbackResult>;
@@ -36,18 +31,19 @@ export declare function parseCallbackUrl(rawUrl: string): {
     state?: string;
     error?: string;
     errorDescription?: string;
+    iss?: string;
     pathname: string;
 };
 /**
  * Validates a parsed callback against the expected CSRF state. Returns the
  * verified `{code, state}` or throws a friendly error.
  */
-export declare function verifyCallback(parsed: ReturnType<typeof parseCallbackUrl>, expectedState: string): LoopbackResult;
+export declare function verifyCallback(parsed: ReturnType<typeof parseCallbackUrl>, expectedState: string, expectedIssuer?: string): LoopbackResult;
 /**
  * Boots the single-shot loopback listener on a random ephemeral port.
  *
  * Returns immediately with `{ redirectUri, result }`. The caller passes
- * `redirectUri` to the IdP, then awaits `result` for the verified `{code, state}`.
+ * `redirectUri` to the sign-in page, then awaits `result` for the verified `{code, state}`.
  *
  * The server:
  *  - Closes itself after the first GET to `/callback` completes its response.

package/dist/auth/loopback.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loopback.d.ts","sourceRoot":"","sources":["../../src/auth/loopback.ts"],"names":[],"mappings":"AAkBA,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,oFAAoF;IACpF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,mFAAmF;IACnF,WAAW,EAAE,MAAM,CAAC;IACpB,8EAA8E;IAC9E,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IAChC,2EAA2E;IAC3E,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB;AAyHD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG;IAChD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;CAClB,CAUA;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,UAAU,CAAC,OAAO,gBAAgB,CAAC,EAC3C,aAAa,EAAE,MAAM,GACpB,cAAc,CAkBhB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,eAAe,CAAC,CAyGtF;AAED,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBACV,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;CAK1C"}
+{"version":3,"file":"loopback.d.ts","sourceRoot":"","sources":["../../src/auth/loopback.ts"],"names":[],"mappings":"AAmBA,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,kBAAkB;IACjC,4EAA4E;IAC5E,aAAa,EAAE,MAAM,CAAC;IACtB,+DAA+D;IAC/D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wDAAwD;IACxD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,4FAA4F;IAC5F,WAAW,EAAE,MAAM,CAAC;IACpB,8EAA8E;IAC9E,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IAChC,2EAA2E;IAC3E,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB;AAmHD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG;IAChD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB,CAWA;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,UAAU,CAAC,OAAO,gBAAgB,CAAC,EAC3C,aAAa,EAAE,MAAM,EACrB,cAAc,CAAC,EAAE,MAAM,GACtB,cAAc,CA2BhB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,eAAe,CAAC,CA6FtF;AAED,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBACV,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;CAK1C"}