@ze-norm/cli 0.3.0 → 0.4.0

package/dist/api/client.d.ts

@@ -13,6 +13,8 @@ export declare class ZenormClient {
     constructor(opts?: ApiClientOptions);
     private getHeaders;
     private isLocalBaseUrl;
+    /** True when this client targets a localhost API (dev-bypass eligible). */
+    isLocalDevTarget(): boolean;
     private request;
     get<T>(path: string): Promise<T>;
     post<T>(path: string, body?: unknown): Promise<T>;

package/dist/api/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AA0BD,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,KAAK,CAAgB;gBAEjB,IAAI,CAAC,EAAE,gBAAgB;IAKnC,OAAO,CAAC,UAAU;IAqBlB,OAAO,CAAC,cAAc;YASR,OAAO;IAwCf,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAIhC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAIjD,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAIhD,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAIlD,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAIzC;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC,WAAW,CAAC;CAG7C"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AA0BD,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,KAAK,CAAgB;gBAEjB,IAAI,CAAC,EAAE,gBAAgB;IAKnC,OAAO,CAAC,UAAU;IAqBlB,OAAO,CAAC,cAAc;IAStB,2EAA2E;IAC3E,gBAAgB,IAAI,OAAO;YAIb,OAAO;IAwCf,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAIhC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAIjD,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAIhD,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAIlD,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAIzC;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC,WAAW,CAAC;CAG7C"}

package/dist/api/client.js

@@ -57,6 +57,10 @@ export class ZenormClient {
             return false;
         }
     }
+    /** True when this client targets a localhost API (dev-bypass eligible). */
+    isLocalDevTarget() {
+        return this.isLocalBaseUrl();
+    }
     async request(method, path, body) {
         const url = `${this.baseUrl}${path}`;
         const init = {

package/dist/auth/device-flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"device-flow.d.ts","sourceRoot":"","sources":["../../src/auth/device-flow.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAgJpD;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,iBAAiB,CAAC,CA4DpE"}
+{"version":3,"file":"device-flow.d.ts","sourceRoot":"","sources":["../../src/auth/device-flow.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAuKpD;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAkDpE"}

package/dist/auth/device-flow.js

@@ -4,7 +4,27 @@ import { exec } from "node:child_process";
 import { platform } from "node:os";
 import { URL, URLSearchParams } from "node:url";
 import { log } from "../util/logger.js";
-import { PRODUCTION_CLERK_CLIENT_ID, PRODUCTION_CLERK_ISSUER, } from "../config/defaults.js";
+import { CLI_CALLBACK_PORTS, PRODUCTION_CLERK_CLIENT_ID, PRODUCTION_CLERK_ISSUER, } from "../config/defaults.js";
+/**
+ * Find the first pre-registered callback port that is free to bind. Clerk
+ * matches redirect_uris exactly, so the local listener must use one of the
+ * ports registered on the OAuth app — not a random OS-assigned port.
+ */
+async function pickFreeCallbackPort() {
+    for (const candidate of CLI_CALLBACK_PORTS) {
+        const free = await new Promise((resolve) => {
+            const srv = createServer();
+            srv.once("error", () => resolve(false));
+            srv.listen(candidate, "127.0.0.1", () => {
+                srv.close(() => resolve(true));
+            });
+        });
+        if (free)
+            return candidate;
+    }
+    throw new Error(`All CLI callback ports are in use (${CLI_CALLBACK_PORTS.join(", ")}). ` +
+        `Free one of them and run \`zenorm login\` again.`);
+}
 function getClerkIssuer() {
     return process.env["ZENORM_CLERK_ISSUER"] ?? PRODUCTION_CLERK_ISSUER;
 }
@@ -126,20 +146,10 @@ export async function runDeviceAuthFlow() {
     const codeVerifier = generateCodeVerifier();
     const codeChallenge = generateCodeChallenge(codeVerifier);
     const state = generateState();
-    // Bind to port 0 to let the OS assign a free port
-    const port = await new Promise((resolve, reject) => {
-        const srv = createServer();
-        srv.listen(0, () => {
-            const addr = srv.address();
-            if (!addr || typeof addr === "string") {
-                srv.close();
-                reject(new Error("Failed to get server address"));
-                return;
-            }
-            const p = addr.port;
-            srv.close(() => resolve(p));
-        });
-    });
+    // Clerk enforces exact redirect_uri matching, so the callback must land on one
+    // of the OAuth app's pre-registered fixed ports — a random OS-assigned port
+    // would never match. Pick the first registered port that is currently free.
+    const port = await pickFreeCallbackPort();
     const redirectUri = `http://localhost:${port}/callback`;
     const authUrl = new URL(`${getClerkIssuer()}/oauth/authorize`);
     authUrl.searchParams.set("response_type", "code");

package/dist/commands/login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAOA,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuChE"}
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAMA,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuChE"}

package/dist/commands/login.js

@@ -2,7 +2,6 @@ import { parseArgs } from "node:util";
 import { runDeviceAuthFlow } from "../auth/device-flow.js";
 import { saveCredentials } from "../auth/store.js";
 import { ZenormClient } from "../api/client.js";
-import { AuthError } from "../util/errors.js";
 import { log } from "../util/logger.js";
 export async function loginCommand(argv) {
     const { values } = parseArgs({
@@ -39,15 +38,20 @@ export async function loginCommand(argv) {
     }
 }
 async function tryLocalDevelopmentLogin() {
+    const client = new ZenormClient();
+    // Only localhost targets use the dev-bypass header path. For hosted/prod APIs
+    // we must always run the real OAuth flow — never silently report a successful
+    // "local development mode" login against production.
+    if (!client.isLocalDevTarget()) {
+        return null;
+    }
     try {
-        const client = new ZenormClient();
         const ctx = await client.getAuthContext();
         return { userId: ctx.userId, orgId: ctx.orgId };
     }
-    catch (err) {
-        if (err instanceof AuthError) {
-            return null;
-        }
+    catch {
+        // Local API unreachable or rejected the dev headers — fall through to the
+        // browser OAuth flow rather than masking the failure.
         return null;
     }
 }

package/dist/config/defaults.d.ts

@@ -1,4 +1,5 @@
 export declare const PRODUCTION_API_URL = "https://api.zenorm.com";
 export declare const PRODUCTION_CLERK_ISSUER = "https://clerk.zenorm.com";
-export declare const PRODUCTION_CLERK_CLIENT_ID = "pk_live_Y2xlcmsuemVub3JtLmNvbSQ";
+export declare const PRODUCTION_CLERK_CLIENT_ID = "nUFCpxIFWJ4YSB3A";
+export declare const CLI_CALLBACK_PORTS: readonly [4571, 4572, 4573];
 //# sourceMappingURL=defaults.d.ts.map

package/dist/config/defaults.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../../src/config/defaults.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,kBAAkB,2BAA2B,CAAC;AAC3D,eAAO,MAAM,uBAAuB,6BAA6B,CAAC;AAClE,eAAO,MAAM,0BAA0B,oCAAoC,CAAC"}
+{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../../src/config/defaults.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,kBAAkB,2BAA2B,CAAC;AAC3D,eAAO,MAAM,uBAAuB,6BAA6B,CAAC;AAKlE,eAAO,MAAM,0BAA0B,qBAAqB,CAAC;AAK7D,eAAO,MAAM,kBAAkB,6BAA8B,CAAC"}

package/dist/config/defaults.js

@@ -1,3 +1,11 @@
 export const PRODUCTION_API_URL = "https://api.zenorm.com";
 export const PRODUCTION_CLERK_ISSUER = "https://clerk.zenorm.com";
-export const PRODUCTION_CLERK_CLIENT_ID = "pk_live_Y2xlcmsuemVub3JtLmNvbSQ";
+// Clerk OAuth Application client id for the public CLI (prod instance
+// clerk.zenorm.com). NOT the publishable key — this is the OAuth 2.0 client id
+// from the "ZeNorm CLI" OAuth app. Its registered redirect_uris are the fixed
+// localhost callback ports in CLI_CALLBACK_PORTS below.
+export const PRODUCTION_CLERK_CLIENT_ID = "nUFCpxIFWJ4YSB3A";
+// Fixed localhost callback ports the device-auth flow binds, in order. Clerk
+// enforces exact redirect_uri matching, so these MUST stay in sync with the
+// OAuth app's pre-registered redirect_uris (http://localhost:<port>/callback).
+export const CLI_CALLBACK_PORTS = [4571, 4572, 4573];

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ze-norm/cli",
   "private": false,
-  "version": "0.3.0",
+  "version": "0.4.0",
   "license": "SEE LICENSE IN README.md",
   "type": "module",
   "repository": {