@verentis/cli 0.2.1 → 0.2.3

package/README.md

@@ -24,6 +24,12 @@ verentis login --api-url … --token <identity token>
 # VERENTIS_API_URL / VERENTIS_API_KEY / VERENTIS_TOKEN env vars also work
 ```
 
+A device sign-in also stores a **refresh token**, so you stay signed in: when the 1-hour identity token
+expires the CLI silently renews it on the next command (refresh tokens rotate on every use with reuse
+detection). You only re-run `verentis login` after the refresh token lapses (~30 days idle) or `verentis
+logout`. Tokens live in `~/.verentis/config.json` (mode `600`). Env-provided `VERENTIS_TOKEN` and API keys
+are used as-is and never auto-refreshed.
+
 Set defaults once so you can stop repeating flags:
 
 ```bash

package/dist/index.js

@@ -50,6 +50,87 @@ function isExpired(token, skewSeconds = 60) {
   return payload.exp * 1e3 <= Date.now() + skewSeconds * 1e3;
 }
 
+// src/auth/deviceFlow.ts
+var CLI_CLIENT_ID = "Verentis.Cli";
+async function startDeviceAuthorization(apiUrl) {
+  const res = await fetch(`${apiUrl}/connect/device/authorize`, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({ client_id: CLI_CLIENT_ID })
+  });
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new Error(`Could not start device sign-in (${res.status}).${text ? ` ${text.slice(0, 300)}` : ""}`);
+  }
+  return await res.json();
+}
+async function pollForIdentityToken(apiUrl, authorization, onPoll) {
+  let intervalMs = Math.max(authorization.interval, 1) * 1e3;
+  const deadline = Date.now() + authorization.expires_in * 1e3;
+  while (Date.now() < deadline) {
+    await sleep(intervalMs);
+    onPoll?.();
+    const res = await fetch(`${apiUrl}/connect/token`, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        grant_type: "device_code",
+        device_code: authorization.device_code,
+        client_id: CLI_CLIENT_ID
+      })
+    });
+    let payload;
+    try {
+      payload = await res.json();
+    } catch {
+      payload = void 0;
+    }
+    if (res.ok && payload?.id_token) {
+      return { idToken: payload.id_token, refreshToken: payload.refresh_token };
+    }
+    switch (payload?.error) {
+      case "authorization_pending":
+        continue;
+      case "slow_down":
+        intervalMs += 5e3;
+        continue;
+      case "access_denied":
+        throw new Error("Sign-in was denied in the browser.");
+      case "expired_token":
+        throw new Error("The device code expired before it was approved. Run `verentis login` again.");
+      default:
+        throw new Error(`Device sign-in failed (${res.status}).${payload?.error ? ` ${payload.error}` : ""}`);
+    }
+  }
+  throw new Error("The device code expired before it was approved. Run `verentis login` again.");
+}
+var RefreshTokenError = class extends Error {
+};
+async function refreshIdentityToken(apiUrl, refreshToken) {
+  const res = await fetch(`${apiUrl}/connect/token`, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "refresh_token",
+      refresh_token: refreshToken,
+      client_id: CLI_CLIENT_ID
+    })
+  });
+  let payload;
+  try {
+    payload = await res.json();
+  } catch {
+    payload = void 0;
+  }
+  if (res.ok && payload?.id_token) {
+    return { idToken: payload.id_token, refreshToken: payload.refresh_token ?? refreshToken };
+  }
+  throw new RefreshTokenError(
+    `Session could not be renewed${payload?.error ? ` (${payload.error})` : ` (${res.status})`}. Run \`verentis login\` again.`
+  );
+}
+var sleep = (ms) => new Promise((resolve8) => setTimeout(resolve8, ms));
+
 // src/http.ts
 var ApiError = class extends Error {
   constructor(status, message, body) {
@@ -65,6 +146,50 @@ async function createApiClient(overrides) {
   const config = { ...await loadConfig(), ...overrides };
   const apiUrl = requireApiUrl(config);
   const tokenCache = /* @__PURE__ */ new Map();
+  const envIdentity = process.env.VERENTIS_TOKEN;
+  let currentIdentity = envIdentity ?? config.identityToken;
+  let currentRefresh = config.refreshToken;
+  let refreshInflight = null;
+  async function persistTokens(idToken, refreshToken) {
+    const disk = await loadConfig();
+    disk.identityToken = idToken;
+    if (refreshToken) disk.refreshToken = refreshToken;
+    await saveConfig(disk);
+  }
+  async function clearTokens() {
+    const disk = await loadConfig();
+    delete disk.identityToken;
+    delete disk.refreshToken;
+    await saveConfig(disk);
+  }
+  async function resolveIdentityToken() {
+    if (!currentIdentity) throw new ApiError(401, "Not logged in. Run `verentis login`.");
+    if (!isExpired(currentIdentity, 120)) return currentIdentity;
+    if (envIdentity || !currentRefresh) {
+      throw new ApiError(401, "Your session has expired \u2014 run `verentis login` again.");
+    }
+    if (!refreshInflight) {
+      refreshInflight = (async () => {
+        try {
+          const refreshed = await refreshIdentityToken(apiUrl, currentRefresh);
+          currentIdentity = refreshed.idToken;
+          currentRefresh = refreshed.refreshToken ?? currentRefresh;
+          await persistTokens(refreshed.idToken, refreshed.refreshToken);
+          return refreshed.idToken;
+        } catch (err) {
+          if (err instanceof RefreshTokenError) {
+            await clearTokens().catch(() => {
+            });
+            throw new ApiError(401, err.message);
+          }
+          throw err;
+        } finally {
+          refreshInflight = null;
+        }
+      })();
+    }
+    return refreshInflight;
+  }
   async function credentialFor(scopes, workspaceId) {
     const cacheKey = `${workspaceId ?? ""}:${[...scopes].sort().join(" ")}`;
     const cached = tokenCache.get(cacheKey);
@@ -75,14 +200,10 @@ async function createApiClient(overrides) {
   }
   async function mintAccessToken(options) {
     const apiKey = process.env.VERENTIS_API_KEY ?? config.apiKey;
-    const identityToken = process.env.VERENTIS_TOKEN ?? config.identityToken;
-    const credential = apiKey ?? identityToken;
-    if (!credential) {
+    if (!apiKey && !currentIdentity) {
       throw new Error("Not logged in. Run `verentis login` (or pass --api-key / --token).");
     }
-    if (!apiKey && identityToken && isExpired(identityToken)) {
-      throw new ApiError(401, "Your identity token has expired \u2014 run `verentis login` again.");
-    }
+    const credential = apiKey ?? await resolveIdentityToken();
     const res = await fetch(`${apiUrl}/v1/tokens/access`, {
       method: "POST",
       headers: {
@@ -772,14 +893,49 @@ function validateManifest(manifest) {
     if (!manifestPermissions(manifest).length) warning("spec.permissions is empty \u2014 the run token will carry no VFS scopes");
   }
   if (kind === "Application") {
-    if (!spec.entry && !spec["entry-points"]?.length) {
-      error("applications need spec.entry or spec.entry-points[]");
+    const hasIframe = !!spec.entry || !!spec["entry-points"]?.length;
+    const hasInstall = Array.isArray(spec.install) && spec.install.length > 0;
+    const hasScopes = Array.isArray(spec.scopes) && spec.scopes.length > 0;
+    if (!hasIframe && !hasInstall && !hasScopes) {
+      error(
+        "an Application must declare at least one contribution: spec.entry / spec.entry-points[] (iframe UI), spec.install[] (installed files), or spec.scopes[] (identity)"
+      );
     }
   }
+  validateInstallDirectives(spec.install, issues);
   const packaging = manifest.packaging ?? {};
   if (!packaging.publisher) warning("packaging.publisher is not set \u2014 `verentis pack`/`publish` will refuse the package");
   return issues;
 }
+function validateInstallDirectives(install, issues) {
+  if (install === void 0) return;
+  const error = (message) => issues.push({ level: "error", message });
+  if (!Array.isArray(install)) {
+    error("spec.install must be a list of install directives");
+    return;
+  }
+  install.forEach((directive, index) => {
+    const at = `spec.install[${index}]`;
+    if (!directive || typeof directive !== "object") {
+      error(`${at} must be an object with 'from' and 'to'`);
+      return;
+    }
+    if (!directive.from || typeof directive.from !== "string") {
+      error(`${at}.from is required (a path/glob relative to the package payload)`);
+    } else if (directive.from.startsWith("/") || directive.from.split("/").includes("..")) {
+      error(`${at}.from must be a relative path inside the package payload (no leading '/' or '..')`);
+    }
+    if (!directive.to || typeof directive.to !== "string") {
+      error(`${at}.to is required (a workspace-absolute destination path)`);
+    } else {
+      if (!directive.to.startsWith("/")) error(`${at}.to must be a workspace-absolute path (start with '/')`);
+      if (directive.to.split("/").includes("..")) error(`${at}.to must not contain '..'`);
+    }
+    if (directive.mode !== void 0 && directive.mode !== "seed" && directive.mode !== "managed") {
+      error(`${at}.mode must be 'seed' or 'managed' (got '${directive.mode}')`);
+    }
+  });
+}
 var KIND_MAP = {
   application: "Application",
   executionengine: "ExecutionEngine",
@@ -1576,60 +1732,6 @@ function registerKeygen(program2) {
   });
 }
 
-// src/auth/deviceFlow.ts
-var CLI_CLIENT_ID = "Verentis.Cli";
-async function startDeviceAuthorization(apiUrl) {
-  const res = await fetch(`${apiUrl}/connect/device/authorize`, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({ client_id: CLI_CLIENT_ID })
-  });
-  if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`Could not start device sign-in (${res.status}).${text ? ` ${text.slice(0, 300)}` : ""}`);
-  }
-  return await res.json();
-}
-async function pollForIdentityToken(apiUrl, authorization, onPoll) {
-  let intervalMs = Math.max(authorization.interval, 1) * 1e3;
-  const deadline = Date.now() + authorization.expires_in * 1e3;
-  while (Date.now() < deadline) {
-    await sleep(intervalMs);
-    onPoll?.();
-    const res = await fetch(`${apiUrl}/connect/token`, {
-      method: "POST",
-      headers: { "Content-Type": "application/x-www-form-urlencoded" },
-      body: new URLSearchParams({
-        grant_type: "device_code",
-        device_code: authorization.device_code,
-        client_id: CLI_CLIENT_ID
-      })
-    });
-    let payload;
-    try {
-      payload = await res.json();
-    } catch {
-      payload = void 0;
-    }
-    if (res.ok && payload?.id_token) return payload.id_token;
-    switch (payload?.error) {
-      case "authorization_pending":
-        continue;
-      case "slow_down":
-        intervalMs += 5e3;
-        continue;
-      case "access_denied":
-        throw new Error("Sign-in was denied in the browser.");
-      case "expired_token":
-        throw new Error("The device code expired before it was approved. Run `verentis login` again.");
-      default:
-        throw new Error(`Device sign-in failed (${res.status}).${payload?.error ? ` ${payload.error}` : ""}`);
-    }
-  }
-  throw new Error("The device code expired before it was approved. Run `verentis login` again.");
-}
-var sleep = (ms) => new Promise((resolve8) => setTimeout(resolve8, ms));
-
 // src/commands/login.ts
 function registerLogin(program2) {
   program2.command("login").description("Sign in to Verentis (browser device flow by default; --api-key/--token for non-interactive use)").option("--api-url <url>", "Verentis API gateway URL").option("--api-key <key>", "Verentis API key (vrt_...)").option("--token <token>", "Verentis identity token (exchanged per request for scoped access tokens)").option("--sealing-key <key>", "the platform's base64 X25519 sealing PUBLIC key (used by `pack --encrypt`)").action(async (options) => {
@@ -1641,6 +1743,7 @@ function registerLogin(program2) {
       if (!options.apiKey.startsWith("vrt_")) throw new Error('API keys start with "vrt_".');
       config.apiKey = options.apiKey;
       delete config.identityToken;
+      delete config.refreshToken;
       await saveConfig(config);
       console.log(`Configuration saved (API key @ ${config.apiUrl}).`);
       return;
@@ -1648,6 +1751,7 @@ function registerLogin(program2) {
     if (options.token) {
       config.identityToken = options.token;
       delete config.apiKey;
+      delete config.refreshToken;
       await saveConfig(config);
       console.log(`Configuration saved (identity token @ ${config.apiUrl}).`);
       return;
@@ -1660,12 +1764,14 @@ function registerLogin(program2) {
 `);
     console.log(`and confirm the code: ${authorization.user_code}`);
     console.log("\nWaiting for approval\u2026");
-    const identityToken = await pollForIdentityToken(apiUrl, authorization, () => process.stderr.write("."));
+    const identity = await pollForIdentityToken(apiUrl, authorization, () => process.stderr.write("."));
     process.stderr.write("\n");
-    config.identityToken = identityToken;
+    config.identityToken = identity.idToken;
+    if (identity.refreshToken) config.refreshToken = identity.refreshToken;
+    else delete config.refreshToken;
     delete config.apiKey;
     await saveConfig(config);
-    const claims = decodeJwtPayload(identityToken);
+    const claims = decodeJwtPayload(identity.idToken);
     console.log(`Signed in as ${claims?.name ?? claims?.email ?? claims?.sub ?? "unknown"} @ ${config.apiUrl}.`);
     if (!claims?.account_id) {
       console.log("Note: no unambiguous account context \u2014 admin commands may need --account <id>.");
@@ -1675,6 +1781,7 @@ function registerLogin(program2) {
     const config = await loadConfig();
     delete config.apiKey;
     delete config.identityToken;
+    delete config.refreshToken;
     await saveConfig(config);
     console.log("Credentials removed.");
   });
@@ -1686,9 +1793,14 @@ function registerLogin(program2) {
       if (claims) {
         const expiry = claims.exp ? new Date(claims.exp * 1e3) : void 0;
         const expired = expiry && expiry.getTime() <= Date.now();
+        const renewable = Boolean(config.refreshToken) && !process.env.VERENTIS_TOKEN;
         console.log(`User: ${claims.name ?? claims.email ?? claims.sub ?? "(unknown)"}${claims.sub ? ` (${claims.sub})` : ""}`);
         if (claims.account_id) console.log(`Account: ${claims.account_id}`);
-        if (expiry) console.log(`Token ${expired ? "EXPIRED" : "expires"}: ${expiry.toISOString()}`);
+        if (expiry) {
+          const state = expired ? renewable ? "expired (auto-renews)" : "EXPIRED" : "expires";
+          console.log(`Token ${state}: ${expiry.toISOString()}`);
+        }
+        if (renewable) console.log("Session: refresh token stored (stays signed in across expiries)");
       }
     } else if (process.env.VERENTIS_API_KEY ?? config.apiKey) {
       console.log("Credential: API key (identity claims not available)");
@@ -1897,9 +2009,21 @@ async function resolvePayloadFiles(projectDir, manifestPath, manifest) {
 function defaultIncludes(manifest) {
   const sources = /* @__PURE__ */ new Set();
   collectSchemaSources(manifest, sources);
+  collectInstallSources(manifest, sources);
   if (sources.size === 0) return [];
   return [...sources];
 }
+function collectInstallSources(manifest, sources) {
+  const spec = manifest.spec;
+  const install = spec?.install;
+  if (!Array.isArray(install)) return;
+  for (const directive of install) {
+    const from = directive?.from;
+    if (typeof from === "string" && from.length > 0 && !from.startsWith("/")) {
+      sources.add(from);
+    }
+  }
+}
 function collectSchemaSources(node, sources) {
   if (Array.isArray(node)) {
     for (const item of node) collectSchemaSources(item, sources);