@revyl/verify 0.1.0 → 0.3.0

package/dist/cli/login.js

@@ -0,0 +1,200 @@
+import { spawn } from 'node:child_process';
+import { randomBytes } from 'node:crypto';
+import { chmod, lstat, mkdir, open, readFile, rename, rm } from 'node:fs/promises';
+import { homedir, hostname } from 'node:os';
+import { join } from 'node:path';
+import { setTimeout as delay } from 'node:timers/promises';
+import { appUrl, RevylClient } from '../api/client.js';
+import { missingCredentialsMessage, resolveCredentials } from '../auth.js';
+import { isVerifyError, VerifyError } from '../errors.js';
+const AUTH_PATH = '/api/v1/entity/users/cli-device-authorizations';
+export async function signIn(options = {}) {
+    const existing = options.force ? undefined : await resolveCredentials();
+    if (existing)
+        return existing;
+    if (!process.stdin.isTTY || !process.stderr.isTTY || process.env.CI)
+        throw new VerifyError('AUTH_MISSING', `${missingCredentialsMessage()} Set the REVYL_API_KEY secret for non-interactive runs.`);
+    const backendUrl = new RevylClient({ token: '', backendUrl: options.backendUrl }).backendUrl;
+    const viewerOrigin = new URL(appUrl(options.appUrl)).origin;
+    const controller = new AbortController();
+    const cancel = () => controller.abort();
+    process.once('SIGINT', cancel);
+    process.once('SIGTERM', cancel);
+    const signal = AbortSignal.any([controller.signal, AbortSignal.timeout(600_000)]);
+    try {
+        const authorization = await post(backendUrl, AUTH_PATH, { client_instance_id: await clientInstanceId(), device_label: hostname().trim().replace(/\s+/g, ' ').slice(0, 80) || 'Revyl CLI' }, signal);
+        const deviceCode = requiredString(authorization, 'device_code');
+        const userCode = requiredString(authorization, 'user_code');
+        const rawUrl = requiredString(authorization, 'verification_uri_complete');
+        let url;
+        try {
+            url = new URL(rawUrl);
+        }
+        catch {
+            throw invalidResponse();
+        }
+        if (url.origin !== viewerOrigin || url.pathname !== '/cli/device' || url.username || url.password)
+            throw invalidResponse();
+        const expiresIn = authorization.expires_in;
+        const firstInterval = authorization.interval;
+        if (!Number.isInteger(expiresIn) || typeof expiresIn !== 'number' || expiresIn <= 0 || !Number.isInteger(firstInterval) || typeof firstInterval !== 'number' || firstInterval < 0)
+            throw invalidResponse();
+        const deadline = Date.now() + Math.min(expiresIn * 1000, 600_000);
+        let intervalMs = firstInterval > 0 ? firstInterval * 1000 : 5000;
+        process.stderr.write(`Open this URL to approve, then confirm the code below:\n${url.href}\nCode: ${userCode}\nWaiting for approval (Ctrl+C to cancel)...\n`);
+        openBrowser(url.href);
+        while (Date.now() < deadline) {
+            await delay(Math.min(intervalMs, deadline - Date.now()), undefined, { signal });
+            if (Date.now() >= deadline)
+                break;
+            const credential = await post(backendUrl, `${AUTH_PATH}/credentials`, { device_code: deviceCode }, signal);
+            if (credential.state === 'pending') {
+                intervalMs = Math.min(intervalMs * 1.5, 15_000);
+                continue;
+            }
+            if (credential.state === 'denied')
+                throw new VerifyError('AUTH_REJECTED', 'The Revyl login request was denied. Run your script again to sign in, or use revyl auth login.');
+            if (credential.state !== 'approved')
+                throw invalidResponse();
+            const token = requiredString(credential, 'api_key_token');
+            const who = await new RevylClient({ token, backendUrl }).whoAmI();
+            const concurrent = await resolveCredentials();
+            if (concurrent) {
+                try {
+                    await new RevylClient({ token: concurrent.token, backendUrl }).whoAmI();
+                    return concurrent;
+                }
+                catch (error) {
+                    if (!isVerifyError(error) || error.code !== 'AUTH_REJECTED')
+                        throw error;
+                }
+            }
+            const keyId = optionalString(credential, 'api_key_id');
+            const stored = {
+                ...(keyId ? { api_key: token, api_key_id: keyId, auth_method: 'browser_api_key' } : { access_token: token, expires_at: tokenExpiry(token), auth_method: 'browser' }),
+                ...(who.email || optionalString(credential, 'email') ? { email: who.email || optionalString(credential, 'email') } : {}),
+                ...(who.org_id || optionalString(credential, 'org_id') ? { org_id: who.org_id || optionalString(credential, 'org_id') } : {}),
+                ...(who.user_id || optionalString(credential, 'user_id') ? { user_id: who.user_id || optionalString(credential, 'user_id') } : {}),
+                ...(process.env.REVYL_API_KEY?.trim() ? { local_auth_override: true } : {}),
+            };
+            await writePrivateState('credentials.json', stored);
+            return { token, source: 'revyl-cli-login' };
+        }
+        throw new VerifyError('AUTH_MISSING', 'The Revyl login request expired. Run your script again to sign in, or use revyl auth login.');
+    }
+    catch (error) {
+        if (signal.aborted)
+            throw new VerifyError('AUTH_MISSING', 'Revyl sign-in was cancelled or timed out. Run your script again to sign in, or use revyl auth login.');
+        throw error;
+    }
+    finally {
+        process.removeListener('SIGINT', cancel);
+        process.removeListener('SIGTERM', cancel);
+    }
+}
+async function post(backendUrl, path, body, signal) {
+    let response;
+    try {
+        response = await fetch(new URL(path, backendUrl), { method: 'POST', headers: { 'Content-Type': 'application/json', Accept: 'application/json' }, body: JSON.stringify(body), redirect: 'error', signal: AbortSignal.any([signal, AbortSignal.timeout(15_000)]) });
+    }
+    catch {
+        throw new VerifyError('AUTH_MISSING', 'Could not reach Revyl to sign in. Run your script again, use revyl auth login, or set REVYL_API_KEY.');
+    }
+    if (response.status === 404)
+        throw new VerifyError('AUTH_MISSING', 'The Revyl login request is unavailable or expired. Run your script again, or use revyl auth login.');
+    if (!response.ok)
+        throw new VerifyError('AUTH_REJECTED', `Revyl sign-in failed (HTTP ${response.status}). Run your script again, use revyl auth login, or set REVYL_API_KEY.`);
+    let value;
+    try {
+        value = await response.json();
+    }
+    catch {
+        throw invalidResponse();
+    }
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw invalidResponse();
+    return value;
+}
+function requiredString(value, key) {
+    const text = optionalString(value, key);
+    if (!text)
+        throw invalidResponse();
+    return text;
+}
+function optionalString(value, key) {
+    const text = value[key];
+    if (text === null || text === undefined)
+        return undefined;
+    if (typeof text !== 'string' || text.length > 8192 || /[\x00-\x1f\x7f]/.test(text))
+        throw invalidResponse();
+    return text || undefined;
+}
+function invalidResponse() {
+    return new VerifyError('AUTH_REJECTED', 'Revyl returned an invalid sign-in response. Run your script again, use revyl auth login, or set REVYL_API_KEY.');
+}
+function tokenExpiry(token) {
+    try {
+        const payload = JSON.parse(Buffer.from(token.split('.')[1] ?? '', 'base64url').toString('utf8'));
+        if (typeof payload.exp === 'number' && Number.isFinite(payload.exp) && payload.exp > 0)
+            return new Date(Math.trunc(payload.exp) * 1000).toISOString();
+    }
+    catch { }
+    return new Date(Date.now() + 30 * 60_000).toISOString();
+}
+async function clientInstanceId() {
+    const path = join(homedir(), '.revyl', 'client-identity.json');
+    try {
+        const identity = JSON.parse(await readFile(path, 'utf8'));
+        if (identity && typeof identity === 'object' && 'client_instance_id' in identity && typeof identity.client_instance_id === 'string' && /^[A-Za-z0-9_-]{1,128}$/.test(identity.client_instance_id))
+            return identity.client_instance_id;
+    }
+    catch (error) {
+        if (!(error instanceof SyntaxError) && error.code !== 'ENOENT')
+            throw new VerifyError('AUTH_MISSING', 'Could not read the Revyl client identity. Check ~/.revyl permissions.');
+    }
+    const id = randomBytes(16).toString('hex');
+    await writePrivateState('client-identity.json', { client_instance_id: id });
+    return id;
+}
+async function writePrivateState(name, value) {
+    const directory = join(homedir(), '.revyl');
+    const destination = join(directory, name);
+    const temporary = join(directory, `.${name}.${randomBytes(16).toString('hex')}`);
+    try {
+        await mkdir(directory, { recursive: true, mode: 0o700 });
+        if (!(await lstat(directory)).isDirectory() || (await lstat(directory)).isSymbolicLink())
+            throw new Error();
+        if (process.platform !== 'win32')
+            await chmod(directory, 0o700);
+        try {
+            if (!(await lstat(destination)).isFile())
+                throw new Error();
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+        const file = await open(temporary, 'wx', 0o600);
+        try {
+            await file.writeFile(`${JSON.stringify(value, null, 2)}\n`);
+            await file.sync();
+        }
+        finally {
+            await file.close();
+        }
+        await rename(temporary, destination);
+    }
+    catch {
+        throw new VerifyError('AUTH_MISSING', 'Could not save Revyl sign-in state. Use a writable, owner-only ~/.revyl directory.');
+    }
+    finally {
+        await rm(temporary, { force: true });
+    }
+}
+function openBrowser(url) {
+    const command = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'rundll32' : 'xdg-open';
+    const args = process.platform === 'win32' ? ['url.dll,FileProtocolHandler', url] : [url];
+    const child = spawn(command, args, { stdio: 'ignore', timeout: 10_000 });
+    child.once('error', () => process.stderr.write('Open the URL above in your browser to finish signing in.\n'));
+    child.unref();
+}

package/dist/cli/main.js

@@ -6,18 +6,20 @@ import { missingCredentialsMessage, resolveCredentials } from '../auth.js';
 import { VerifyError, errorMessage, isVerifyError } from '../errors.js';
 import { PACKAGE_NAME, VERSION } from '../version.js';
 import { initProject, validateInitAnswers } from './init.js';
-const HELP = `verify ${VERSION}: open Revyl cloud browsers, devices, and Mac computers from your code
+import { installVerify, packageHasVerify } from './install.js';
+import { signIn } from './login.js';
+const HELP = `verify ${VERSION}: open Revyl cloud browsers, devices, and computers from your code
 
 Usage
-  verify init [--platform web|ios|android|mac] [--app-id <id>] [--url <https-url>] [--force]
-      Write verify.config.ts and an example script, verify/example.ts
-  verify whoami
+  npx ${PACKAGE_NAME} init [--platform web|ios|android|mac] [--app-id <id>] [--url <https-url>] [--force] [--yes] [--no-install]
+      Install Verify, write verify.config.ts and an example script, then check authentication
+  npx ${PACKAGE_NAME} whoami
       Check which Revyl account your credentials belong to
 
 Authentication
   REVYL_API_KEY, or a login from the Revyl CLI ('revyl auth login').
 
-Docs: https://github.com/RevylAI/verify/tree/main/packages/verify/docs
+Docs: https://github.com/RevylAI/verify/tree/v${VERSION}/packages/verify/docs
 `;
 const USAGE_CODES = new Set(['INVALID_ARGUMENT', 'AUTH_MISSING', 'AUTH_REJECTED']);
 export async function main(argv) {
@@ -50,8 +52,11 @@ async function initCommand(args) {
             'app-id': { type: 'string' },
             url: { type: 'string' },
             force: { type: 'boolean' },
+            yes: { type: 'boolean' },
+            'no-install': { type: 'boolean' },
         },
     });
+    const interactive = Boolean(process.stdin.isTTY) && !process.env.CI;
     let answers;
     if (values.platform) {
         answers = validateInitAnswers({
@@ -60,23 +65,52 @@ async function initCommand(args) {
             ...(values.url ? { url: values.url } : {}),
         });
     }
-    else if (process.stdin.isTTY) {
-        answers = await askInitQuestions(values['app-id'], values.url);
-    }
-    else {
+    else if (!interactive) {
         throw new VerifyError('INVALID_ARGUMENT', 'Pass --platform web, ios, android, or mac when not running in a terminal.');
     }
+    if (!values['no-install'] && !(await packageHasVerify(process.cwd()))) {
+        let installApproved = !interactive || Boolean(values.yes);
+        if (interactive && !values.yes) {
+            const readline = createInterface({ input: process.stdin, output: process.stdout });
+            try {
+                const answer = (await readline.question(`Install ${PACKAGE_NAME} as a dev dependency? (Y/n) `)).trim().toLowerCase();
+                installApproved = answer === '' || answer === 'y' || answer === 'yes';
+            }
+            finally {
+                readline.close();
+            }
+        }
+        if (installApproved)
+            await installVerify(process.cwd());
+    }
+    answers ??= await askInitQuestions(values['app-id'], values.url);
     const result = await initProject(process.cwd(), answers, { force: values.force ?? false });
+    process.stdout.write(`Created ${result.created.join(' and ')}${result.gitignoreUpdated ? ', and added .verify/ to .gitignore' : ''}.\n`);
+    const credentials = await resolveCredentials();
+    if (!credentials) {
+        if (interactive) {
+            await signIn();
+        }
+        else {
+            throw new VerifyError('AUTH_MISSING', `${missingCredentialsMessage()} In non-interactive environments, set the REVYL_API_KEY secret.`);
+        }
+    }
+    try {
+        await whoamiCommand();
+    }
+    catch (error) {
+        if (!interactive || !isVerifyError(error) || error.code !== 'AUTH_REJECTED')
+            throw error;
+        await signIn({ force: true });
+        await whoamiCommand();
+    }
     const steps = [
-        `npm install --save-dev ${PACKAGE_NAME}`,
-        "Authenticate: export REVYL_API_KEY=<key from Revyl settings>, or run 'revyl auth login'",
-        ...(answers.platform === 'mac' ? ['Mac computers are not yet available in Revyl production. Early access works only on Revyl staging for enabled organizations; use the optional REVYL_BACKEND_URL override with staging credentials. Ask support@revyl.ai for access. See https://github.com/RevylAI/verify/blob/main/packages/verify/docs/computers.md#availability-and-errors'] : []),
+        'Configure the generated verify.config.ts if needed',
+        ...(answers.platform === 'mac' ? ['Mac computers are early access. Ask support@revyl.ai about access.'] : []),
         ...(answers.platform === 'mac' || answers.appId ? [] : ['Put your Revyl app id in verify.config.ts (or set REVYL_APP_ID)']),
         'node verify/example.ts',
     ];
     process.stdout.write([
-        `Created ${result.created.join(' and ')}${result.gitignoreUpdated ? ', and added .verify/ to .gitignore' : ''}.`,
-        '',
         'Next:',
         ...steps.map((step, index) => `  ${index + 1}. ${step}`),
         '',

package/dist/computer-session.d.ts

@@ -1,19 +1,34 @@
 import { RevylClient } from './api/client.js';
-import type { ResolvedComputerTarget } from './config.js';
-import { type ComputerProcess, type ExecOptions, type ExecResult, type FileStat, type OperationOptions, type Session, type SessionOptions, type StepResult } from './session.js';
+import type { ComputerPlatform } from './api/types.js';
+import { type HostedTargetConfig, type ResolvedComputerTarget } from './config.js';
+import { type ComputerProcess, type ComputerRecording, type ExecOptions, type ExecResult, type FileStat, type OpenedSession, type OperationOptions, type Session, type SessionOptions, type StepResult } from './session.js';
 export declare class ComputerSession implements Session {
     private readonly client;
     private readonly options;
-    readonly platform: "mac";
+    private readonly stopOnClose;
+    readonly platform: ComputerPlatform;
     readonly target: string;
-    readonly id: `${string}-${string}-${string}-${string}-${string}`;
+    readonly id: string;
     readonly viewerUrl: string;
     readonly steps: StepResult[];
     private readonly lifetime;
     private closePromise;
+    private expiresAtMs;
+    private screenReadyUntilMs;
+    private readonly children;
+    private readonly childStarts;
+    private closing;
     private constructor();
     static start(client: RevylClient, target: ResolvedComputerTarget, options: SessionOptions): Promise<ComputerSession>;
     get closed(): boolean;
+    static attach(client: RevylClient, computerId: string, options: SessionOptions & {
+        stopOnClose?: boolean;
+    }): Promise<ComputerSession>;
+    open(target: HostedTargetConfig): Promise<OpenedSession>;
+    report(): Promise<Record<string, unknown>>;
+    navigate(): Promise<never>;
+    get expiresAt(): Date | undefined;
+    recording(): Promise<ComputerRecording | null>;
     instruction(): Promise<never>;
     validation(): Promise<never>;
     screenshot(options?: {
@@ -29,8 +44,9 @@ export declare class ComputerSession implements Session {
     [Symbol.asyncDispose](): Promise<void>;
     private operation;
     private request;
-    private report;
+    private parseReport;
     private assertOpen;
+    private observationSignal;
     private unavailable;
     private log;
 }