bkper 5.7.3 → 5.8.0

package/lib/commands/context/register.js

@@ -0,0 +1,79 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { withAction } from '../action.js';
+import { getBookContextDir, pullBookContext } from './book-context.js';
+import { getDomainContextDir, pullDomainContext } from './domain-context.js';
+import { runContextCredentialHelper } from './git-credential.js';
+import { BOOK_ID, ContextError } from './platform-context.js';
+import { getUserContextDir, pullUserContext } from './user-context.js';
+const PULL_MESSAGES = {
+    synced: 'Up to date with what you published.',
+    unpublished: 'Nothing published yet. Commit and push from here to publish to all your agents.',
+    unpushed: 'Not updated: this clone has changes not pushed. Push or discard them, then pull again.',
+    failed: 'Could not update your agent context. Check your login (bkper auth login) and connection.',
+};
+/** Without a domain there is no line: most people have none. */
+const DOMAIN_PULL_MESSAGES = {
+    synced: "Up to date with what your company's domain admin published.",
+    unpublished: "Nothing published for your company yet. Your domain's admin publishes with a commit and push from here, to everyone in the domain.",
+    unpushed: 'Not updated: this clone has changes not pushed. Push or discard them, then pull again.',
+    failed: "Could not update your company's agent context. Check your login (bkper auth login) and connection.",
+};
+const BOOK_PULL_MESSAGES = {
+    synced: "Up to date with what the Book's editors published.",
+    unpublished: "Nothing published for this Book yet. Its editors publish with a commit and push from here, to everyone who can view it.",
+    unpushed: 'Not updated: this clone has changes not pushed. Push or discard them, then pull again.',
+    failed: "Could not update this Book's agent context. Check your login (bkper auth login) and connection.",
+    forbidden: "You cannot view this Book, so its agent context was not pulled. Ask the Book's owner to share it with you.",
+};
+/** `bkper context`: the agent context clones (yours, your company's, and a Book's), shared with all your agents. */
+export function registerContextCommands(program) {
+    const context = program
+        .command('context')
+        .description('Your agent context: AGENTS.md and skills shared with all your agents');
+    context
+        .command('pull')
+        .description("Clone or update ~/.bkper/user, and your company's in ~/.bkper/domain when you have one (fast-forward only); with --book, also the Book's in ~/.bkper/books/<bookId>")
+        .option('-b, --book <bookId>', "Also pull this Book's agent context")
+        .action((options) => withAction('pulling agent context', () => __awaiter(this, void 0, void 0, function* () {
+        const bookId = options.book;
+        if (bookId !== undefined && !BOOK_ID.test(bookId)) {
+            throw new ContextError(`'${bookId}' is not a Book ID.`);
+        }
+        const [outcome, domainOutcome, bookOutcome] = yield Promise.all([
+            pullUserContext(),
+            pullDomainContext(),
+            bookId === undefined ? undefined : pullBookContext(bookId),
+        ]);
+        console.log(`${getUserContextDir()}: ${PULL_MESSAGES[outcome]}`);
+        if (domainOutcome !== 'none') {
+            console.log(`${getDomainContextDir()}: ${DOMAIN_PULL_MESSAGES[domainOutcome]}`);
+        }
+        if (bookId !== undefined && bookOutcome) {
+            console.log(`${getBookContextDir(bookId)}: ${BOOK_PULL_MESSAGES[bookOutcome]}`);
+        }
+        if (outcome === 'failed' ||
+            domainOutcome === 'failed' ||
+            bookOutcome === 'failed' ||
+            bookOutcome === 'forbidden') {
+            process.exit(1);
+        }
+    }), { skipSetup: true })());
+    context
+        .command('git-credential <scope> [operation]')
+        .description('Internal noninteractive credential helper for agent context clones')
+        .action((scope, operation) => withAction('running git credential helper', () => __awaiter(this, void 0, void 0, function* () {
+        // Git appends get|store|erase to the configured helper command.
+        const exitCode = yield runContextCredentialHelper({ scope, operation: operation !== null && operation !== void 0 ? operation : 'get' });
+        if (exitCode !== 0)
+            process.exit(exitCode);
+    }), { skipSetup: true })());
+}
+//# sourceMappingURL=register.js.map

package/lib/commands/context/register.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.js","sourceRoot":"","sources":["../../../src/commands/context/register.ts"],"names":[],"mappings":";;;;;;;;;AACA,OAAO,EAAC,UAAU,EAAC,MAAM,cAAc,CAAC;AACxC,OAAO,EAAC,iBAAiB,EAAE,eAAe,EAAuB,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EAAC,mBAAmB,EAAE,iBAAiB,EAAyB,MAAM,qBAAqB,CAAC;AACnG,OAAO,EAAC,0BAA0B,EAAC,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAC,OAAO,EAAE,YAAY,EAAC,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAC,iBAAiB,EAAE,eAAe,EAAmB,MAAM,mBAAmB,CAAC;AAEvF,MAAM,aAAa,GAAgC;IAC/C,MAAM,EAAE,qCAAqC;IAC7C,WAAW,EAAE,iFAAiF;IAC9F,QAAQ,EAAE,wFAAwF;IAClG,MAAM,EAAE,0FAA0F;CACrG,CAAC;AAEF,gEAAgE;AAChE,MAAM,oBAAoB,GAAuD;IAC7E,MAAM,EAAE,6DAA6D;IACrE,WAAW,EACP,oIAAoI;IACxI,QAAQ,EAAE,wFAAwF;IAClG,MAAM,EAAE,oGAAoG;CAC/G,CAAC;AAEF,MAAM,kBAAkB,GAAoC;IACxD,MAAM,EAAE,oDAAoD;IAC5D,WAAW,EACP,yHAAyH;IAC7H,QAAQ,EAAE,wFAAwF;IAClG,MAAM,EAAE,iGAAiG;IACzG,SAAS,EAAE,4GAA4G;CAC1H,CAAC;AAEF,oHAAoH;AACpH,MAAM,UAAU,uBAAuB,CAAC,OAAgB;IACpD,MAAM,OAAO,GAAG,OAAO;SAClB,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,sEAAsE,CAAC,CAAC;IAEzF,OAAO;SACF,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CACR,qKAAqK,CACxK;SACA,MAAM,CAAC,qBAAqB,EAAE,qCAAqC,CAAC;SACpE,MAAM,CAAC,CAAC,OAAwB,EAAE,EAAE,CACjC,UAAU,CACN,uBAAuB,EACvB,GAAS,EAAE;QACP,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;QAC5B,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,YAAY,CAAC,IAAI,MAAM,qBAAqB,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,CAAC,OAAO,EAAE,aAAa,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC5D,eAAe,EAAE;YACjB,iBAAiB,EAAE;YACnB,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC;SAC7D,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,GAAG,iBAAiB,EAAE,KAAK,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACjE,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC;YAC3B,OAAO,CAAC,GAAG,CAAC,GAAG,mBAAmB,EAAE,KAAK,oBAAoB,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,MAAM,KAAK,SAAS,IAAI,WAAW,EAAE,CAAC;YACtC,OAAO,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,MAAM,CAAC,KAAK,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,IACI,OAAO,KAAK,QAAQ;YACpB,aAAa,KAAK,QAAQ;YAC1B,WAAW,KAAK,QAAQ;YACxB,WAAW,KAAK,WAAW,EAC7B,CAAC;YACC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;IACL,CAAC,CAAA,EACD,EAAC,SAAS,EAAE,IAAI,EAAC,CACpB,EAAE,CACN,CAAC;IAEN,OAAO;SACF,OAAO,CAAC,oCAAoC,CAAC;SAC7C,WAAW,CAAC,oEAAoE,CAAC;SACjF,MAAM,CAAC,CAAC,KAAa,EAAE,SAA6B,EAAE,EAAE,CACrD,UAAU,CACN,+BAA+B,EAC/B,GAAS,EAAE;QACP,gEAAgE;QAChE,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAAC,EAAC,KAAK,EAAE,SAAS,EAAE,SAAS,aAAT,SAAS,cAAT,SAAS,GAAI,KAAK,EAAC,CAAC,CAAC;QAC1F,IAAI,QAAQ,KAAK,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC,CAAA,EACD,EAAC,SAAS,EAAE,IAAI,EAAC,CACpB,EAAE,CACN,CAAC;AACV,CAAC"}

package/lib/commands/context/user-context.d.ts

@@ -0,0 +1,36 @@
+import { type GitRunner } from '../apps/git/run-git.js';
+import { type ContextScope, type PlatformContextApi } from './platform-context.js';
+/**
+ * The user's agent context clone (docs/plans/agent-context.md in bkper-clients): AGENTS.md and `.agents/skills`, shared
+ * with all of the user's agents. A push publishes; a pull brings what others published.
+ */
+export declare const USER_CONTEXT_SCOPE: ContextScope;
+/**
+ * Where agent context clones live on every machine, one folder per scope, as in the sandbox (whose home is `/workspace`):
+ * `~/.bkper/domain`, `~/.bkper/user`, `~/.bkper/books/<bookId>`.
+ */
+export declare function getContextRoot(home?: string): string;
+export declare function getUserContextDir(home?: string): string;
+/** synced; unpublished (nothing pushed yet: the clone is ready to push); unpushed (left as it is); failed. */
+export type PullOutcome = 'synced' | 'unpublished' | 'unpushed' | 'failed';
+/** The Git credential helper for a context scope; Git appends get, store or erase. */
+export declare function buildContextCredentialHelperCommand(scope: string): string;
+export interface PullOptions {
+    dir?: string;
+    api?: PlatformContextApi;
+    runner?: GitRunner;
+}
+/**
+ * Bring a scope's clone in `dir` up to date with what is published, fast-forward only: creates it if needed (ready to push
+ * even before anything was published), and leaves a clone with unpushed changes as it is. `configure` runs once the clone
+ * exists, before fetching. Platform's refusal (no access, no login) throws before anything is created.
+ */
+export declare function syncContextClone(scope: ContextScope, dir: string, options?: Omit<PullOptions, 'dir'> & {
+    configure?: (runner: GitRunner, dir: string) => Promise<void>;
+}): Promise<PullOutcome>;
+/**
+ * Bring the user's context clone up to date with what is published, fast-forward only: creates it if needed (ready to
+ * push even before anything was published), and leaves a clone with unpushed changes as it is. Never throws.
+ */
+export declare function pullUserContext(options?: PullOptions): Promise<PullOutcome>;
+//# sourceMappingURL=user-context.d.ts.map

package/lib/commands/context/user-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-context.d.ts","sourceRoot":"","sources":["../../../src/commands/context/user-context.ts"],"names":[],"mappings":"AAGA,OAAO,EAAS,KAAK,SAAS,EAAC,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAA2B,KAAK,YAAY,EAAE,KAAK,kBAAkB,EAAC,MAAM,uBAAuB,CAAC;AAE3G;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,YAAqB,CAAC;AACvD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,GAAE,MAAqB,GAAG,MAAM,CAElE;AACD,wBAAgB,iBAAiB,CAAC,IAAI,GAAE,MAAqB,GAAG,MAAM,CAErE;AAED,8GAA8G;AAC9G,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,aAAa,GAAG,UAAU,GAAG,QAAQ,CAAC;AAE3E,sFAAsF;AACtF,wBAAgB,mCAAmC,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEzE;AAED,MAAM,WAAW,WAAW;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,kBAAkB,CAAC;IACzB,MAAM,CAAC,EAAE,SAAS,CAAC;CACtB;AAoCD;;;;GAIG;AACH,wBAAsB,gBAAgB,CAClC,KAAK,EAAE,YAAY,EACnB,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG;IAAC,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAAM,GACzG,OAAO,CAAC,WAAW,CAAC,CAwBtB;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,WAAW,CAAC,CAMrF"}

package/lib/commands/context/user-context.js

@@ -0,0 +1,125 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { runGit } from '../apps/git/run-git.js';
+import { createPlatformContextApi } from './platform-context.js';
+/**
+ * The user's agent context clone (docs/plans/agent-context.md in bkper-clients): AGENTS.md and `.agents/skills`, shared
+ * with all of the user's agents. A push publishes; a pull brings what others published.
+ */
+export const USER_CONTEXT_SCOPE = 'user';
+/**
+ * Where agent context clones live on every machine, one folder per scope, as in the sandbox (whose home is `/workspace`):
+ * `~/.bkper/domain`, `~/.bkper/user`, `~/.bkper/books/<bookId>`.
+ */
+export function getContextRoot(home = os.homedir()) {
+    return path.join(home, '.bkper');
+}
+export function getUserContextDir(home = os.homedir()) {
+    return path.join(getContextRoot(home), USER_CONTEXT_SCOPE);
+}
+/** The Git credential helper for a context scope; Git appends get, store or erase. */
+export function buildContextCredentialHelperCommand(scope) {
+    return `!bkper context git-credential '${scope.replace(/'/g, `'\\''`)}'`;
+}
+/** Abort a stalled transfer instead of keeping a background pull alive. */
+const STALL_ENV = { GIT_HTTP_LOW_SPEED_LIMIT: '1000', GIT_HTTP_LOW_SPEED_TIME: '30' };
+function succeeds(runner, args, cwd) {
+    return __awaiter(this, void 0, void 0, function* () {
+        return (yield runner(args, { cwd, allowFailure: true })).exitCode === 0;
+    });
+}
+/** Whether the clone has changes not pushed: files not committed, or commits not on origin/main. */
+function unpushed(runner, cwd) {
+    return __awaiter(this, void 0, void 0, function* () {
+        if ((yield runner(['status', '--porcelain'], { cwd })).stdout)
+            return true;
+        if (!(yield succeeds(runner, ['rev-parse', '-q', '--verify', 'HEAD'], cwd)))
+            return false;
+        if (!(yield succeeds(runner, ['rev-parse', '-q', '--verify', 'refs/remotes/origin/main'], cwd)))
+            return true;
+        return Boolean((yield runner(['rev-list', '-n', '1', 'refs/remotes/origin/main..HEAD'], { cwd })).stdout);
+    });
+}
+/** A clone of the scope's `remote` in `dir`, tracking main, whose credentials come only from the helper (never stored). */
+function prepare(runner, dir, remote, scope) {
+    return __awaiter(this, void 0, void 0, function* () {
+        fs.mkdirSync(dir, { recursive: true });
+        if (!fs.existsSync(path.join(dir, '.git'))) {
+            yield runner(['init', '-q', '-b', 'main'], { cwd: dir });
+            yield runner(['remote', 'add', 'origin', remote], { cwd: dir });
+            yield runner(['config', 'branch.main.remote', 'origin'], { cwd: dir });
+            yield runner(['config', 'branch.main.merge', 'refs/heads/main'], { cwd: dir });
+        }
+        yield runner(['remote', 'set-url', 'origin', remote], { cwd: dir });
+        const key = `credential.${remote.replace(/\/+$/, '')}`;
+        yield runner(['config', `${key}.useHttpPath`, 'true'], { cwd: dir });
+        // Clears inherited helpers for this remote, then pins the context helper.
+        yield runner(['config', '--replace-all', `${key}.helper`, ''], { cwd: dir });
+        yield runner(['config', '--add', `${key}.helper`, buildContextCredentialHelperCommand(scope)], {
+            cwd: dir,
+        });
+    });
+}
+/**
+ * Bring a scope's clone in `dir` up to date with what is published, fast-forward only: creates it if needed (ready to push
+ * even before anything was published), and leaves a clone with unpushed changes as it is. `configure` runs once the clone
+ * exists, before fetching. Platform's refusal (no access, no login) throws before anything is created.
+ */
+export function syncContextClone(scope_1, dir_1) {
+    return __awaiter(this, arguments, void 0, function* (scope, dir, options = {}) {
+        var _a, _b, _c;
+        const runner = (_a = options.runner) !== null && _a !== void 0 ? _a : runGit;
+        const credential = yield ((_b = options.api) !== null && _b !== void 0 ? _b : createPlatformContextApi()).issueCredential('read', scope);
+        yield prepare(runner, dir, credential.remote, scope);
+        yield ((_c = options.configure) === null || _c === void 0 ? void 0 : _c.call(options, runner, dir));
+        if (!('token' in credential))
+            return 'unpublished';
+        try {
+            // The helper answers this fetch with the read token issued above, from the environment only.
+            const fetched = yield runner(['fetch', '-q', 'origin'], {
+                cwd: dir,
+                allowFailure: true,
+                env: Object.assign(Object.assign({}, STALL_ENV), { BKPER_CONTEXT_TOKEN: credential.token, BKPER_CONTEXT_REMOTE: credential.remote }),
+            });
+            if (fetched.exitCode !== 0)
+                return 'failed';
+            if (!(yield succeeds(runner, ['rev-parse', '-q', '--verify', 'refs/remotes/origin/main'], dir))) {
+                return 'unpublished';
+            }
+            if (yield unpushed(runner, dir))
+                return 'unpushed';
+            return (yield succeeds(runner, ['merge', '-q', '--ff-only', 'refs/remotes/origin/main'], dir))
+                ? 'synced'
+                : 'failed';
+        }
+        catch (_d) {
+            return 'failed';
+        }
+    });
+}
+/**
+ * Bring the user's context clone up to date with what is published, fast-forward only: creates it if needed (ready to
+ * push even before anything was published), and leaves a clone with unpushed changes as it is. Never throws.
+ */
+export function pullUserContext() {
+    return __awaiter(this, arguments, void 0, function* (options = {}) {
+        var _a;
+        try {
+            return yield syncContextClone(USER_CONTEXT_SCOPE, (_a = options.dir) !== null && _a !== void 0 ? _a : getUserContextDir(), options);
+        }
+        catch (_b) {
+            return 'failed';
+        }
+    });
+}
+//# sourceMappingURL=user-context.js.map

package/lib/commands/context/user-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-context.js","sourceRoot":"","sources":["../../../src/commands/context/user-context.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAC,MAAM,EAAiB,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAC,wBAAwB,EAA6C,MAAM,uBAAuB,CAAC;AAE3G;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAiB,MAAM,CAAC;AACvD;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,CAAC,OAAO,EAAE;IACtD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AACrC,CAAC;AACD,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,CAAC,OAAO,EAAE;IACzD,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC,CAAC;AAC/D,CAAC;AAKD,sFAAsF;AACtF,MAAM,UAAU,mCAAmC,CAAC,KAAa;IAC7D,OAAO,kCAAkC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC7E,CAAC;AAQD,2EAA2E;AAC3E,MAAM,SAAS,GAAG,EAAC,wBAAwB,EAAE,MAAM,EAAE,uBAAuB,EAAE,IAAI,EAAC,CAAC;AAEpF,SAAe,QAAQ,CAAC,MAAiB,EAAE,IAAc,EAAE,GAAW;;QAClE,OAAO,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,EAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC;IAC1E,CAAC;CAAA;AAED,oGAAoG;AACpG,SAAe,QAAQ,CAAC,MAAiB,EAAE,GAAW;;QAClD,IAAI,CAAC,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,EAAC,GAAG,EAAC,CAAC,CAAC,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzE,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1F,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,0BAA0B,CAAC,EAAE,GAAG,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7G,OAAO,OAAO,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,EAAE,gCAAgC,CAAC,EAAE,EAAC,GAAG,EAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC5G,CAAC;CAAA;AAED,2HAA2H;AAC3H,SAAe,OAAO,CAAC,MAAiB,EAAE,GAAW,EAAE,MAAc,EAAE,KAAmB;;QACtF,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAC,SAAS,EAAE,IAAI,EAAC,CAAC,CAAC;QACrC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;YACzC,MAAM,MAAM,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,EAAC,GAAG,EAAE,GAAG,EAAC,CAAC,CAAC;YACvD,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAC,GAAG,EAAE,GAAG,EAAC,CAAC,CAAC;YAC9D,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,oBAAoB,EAAE,QAAQ,CAAC,EAAE,EAAC,GAAG,EAAE,GAAG,EAAC,CAAC,CAAC;YACrE,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,mBAAmB,EAAE,iBAAiB,CAAC,EAAE,EAAC,GAAG,EAAE,GAAG,EAAC,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAC,GAAG,EAAE,GAAG,EAAC,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,cAAc,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;QACvD,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,GAAG,GAAG,cAAc,EAAE,MAAM,CAAC,EAAE,EAAC,GAAG,EAAE,GAAG,EAAC,CAAC,CAAC;QACnE,0EAA0E;QAC1E,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,eAAe,EAAE,GAAG,GAAG,SAAS,EAAE,EAAE,CAAC,EAAE,EAAC,GAAG,EAAE,GAAG,EAAC,CAAC,CAAC;QAC3E,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,GAAG,SAAS,EAAE,mCAAmC,CAAC,KAAK,CAAC,CAAC,EAAE;YAC3F,GAAG,EAAE,GAAG;SACX,CAAC,CAAC;IACP,CAAC;CAAA;AAED;;;;GAIG;AACH,MAAM,UAAgB,gBAAgB;yDAClC,KAAmB,EACnB,GAAW,EACX,UAAsG,EAAE;;QAExG,MAAM,MAAM,GAAG,MAAA,OAAO,CAAC,MAAM,mCAAI,MAAM,CAAC;QACxC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAA,OAAO,CAAC,GAAG,mCAAI,wBAAwB,EAAE,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACpG,MAAM,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACrD,MAAM,CAAA,MAAA,OAAO,CAAC,SAAS,wDAAG,MAAM,EAAE,GAAG,CAAC,CAAA,CAAC;QACvC,IAAI,CAAC,CAAC,OAAO,IAAI,UAAU,CAAC;YAAE,OAAO,aAAa,CAAC;QACnD,IAAI,CAAC;YACD,6FAA6F;YAC7F,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE;gBACpD,GAAG,EAAE,GAAG;gBACR,YAAY,EAAE,IAAI;gBAClB,GAAG,kCAAM,SAAS,KAAE,mBAAmB,EAAE,UAAU,CAAC,KAAK,EAAE,oBAAoB,EAAE,UAAU,CAAC,MAAM,GAAC;aACtG,CAAC,CAAC;YACH,IAAI,OAAO,CAAC,QAAQ,KAAK,CAAC;gBAAE,OAAO,QAAQ,CAAC;YAC5C,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,0BAA0B,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;gBAC9F,OAAO,aAAa,CAAC;YACzB,CAAC;YACD,IAAI,MAAM,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC;gBAAE,OAAO,UAAU,CAAC;YACnD,OAAO,CAAC,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,0BAA0B,CAAC,EAAE,GAAG,CAAC,CAAC;gBAC1F,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,QAAQ,CAAC;QACnB,CAAC;QAAC,WAAM,CAAC;YACL,OAAO,QAAQ,CAAC;QACpB,CAAC;IACL,CAAC;CAAA;AAED;;;GAGG;AACH,MAAM,UAAgB,eAAe;yDAAC,UAAuB,EAAE;;QAC3D,IAAI,CAAC;YACD,OAAO,MAAM,gBAAgB,CAAC,kBAAkB,EAAE,MAAA,OAAO,CAAC,GAAG,mCAAI,iBAAiB,EAAE,EAAE,OAAO,CAAC,CAAC;QACnG,CAAC;QAAC,WAAM,CAAC;YACL,OAAO,QAAQ,CAAC;QACpB,CAAC;IACL,CAAC;CAAA"}

package/lib/dev/auth-middleware.d.ts

@@ -1,4 +1,11 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
+/**
+ * Options for the dev auth middleware.
+ */
+export interface BkperAuthMiddlewareOptions {
+    /** Defaults to `BKPER_MANAGED_SANDBOX=1`. */
+    managedSandbox?: boolean;
+}
 /**
  * Creates a Connect-compatible middleware that handles /auth/refresh requests.
  *
@@ -7,6 +14,9 @@ import type { IncomingMessage, ServerResponse } from 'node:http';
  * clients to authenticate during local development without needing
  * to set up session cookies or connect to production auth servers.
  *
+ * In the managed sandbox it never reads stored credentials: it answers a fixed placeholder token
+ * and user, and the sandbox's Bkper API egress replaces every Authorization header with the owner's.
+ *
  * Response format matches production:
  * - 200: { userId: string, accessToken: string }
  * - 401: { error: string } - when not logged in
@@ -14,6 +24,6 @@ import type { IncomingMessage, ServerResponse } from 'node:http';
  *
  * @returns Connect-compatible middleware function (req, res, next)
  */
-export declare function createBkperAuthMiddleware(): (req: IncomingMessage, res: ServerResponse, next: () => void) => void;
+export declare function createBkperAuthMiddleware(options?: BkperAuthMiddlewareOptions): (req: IncomingMessage, res: ServerResponse, next: () => void) => void;
 export declare const createAuthMiddleware: typeof createBkperAuthMiddleware;
 //# sourceMappingURL=auth-middleware.d.ts.map

package/lib/dev/auth-middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-middleware.d.ts","sourceRoot":"","sources":["../../src/dev/auth-middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AA8DjE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,yBAAyB,IAAI,CACzC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,MAAM,IAAI,KACf,IAAI,CAgDR;AAGD,eAAO,MAAM,oBAAoB,kCAA4B,CAAC"}
+{"version":3,"file":"auth-middleware.d.ts","sourceRoot":"","sources":["../../src/dev/auth-middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAajE;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACvC,6CAA6C;IAC7C,cAAc,CAAC,EAAE,OAAO,CAAC;CAC5B;AAwDD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACrC,OAAO,GAAE,0BAA+B,GACzC,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,IAAI,KAAK,IAAI,CA2DvE;AAGD,eAAO,MAAM,oBAAoB,kCAA4B,CAAC"}

package/lib/dev/auth-middleware.js

@@ -9,6 +9,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 import { AUTHENTICATION_REQUIRED_MESSAGE } from '../auth/auth-errors.js';
 import { getStoredCredentials, getStoredOAuthToken, isLoggedIn, } from '../auth/local-auth-service.js';
+import { isManagedSandbox, MANAGED_SANDBOX_ACCESS_TOKEN, MANAGED_SANDBOX_USER_ID, } from './managed-sandbox.js';
 /**
  * Decodes a JWT token and extracts the payload.
  * Does NOT verify the signature - only extracts the payload.
@@ -56,6 +57,9 @@ function extractUserId() {
  * clients to authenticate during local development without needing
  * to set up session cookies or connect to production auth servers.
  *
+ * In the managed sandbox it never reads stored credentials: it answers a fixed placeholder token
+ * and user, and the sandbox's Bkper API egress replaces every Authorization header with the owner's.
+ *
  * Response format matches production:
  * - 200: { userId: string, accessToken: string }
  * - 401: { error: string } - when not logged in
@@ -63,7 +67,9 @@ function extractUserId() {
  *
  * @returns Connect-compatible middleware function (req, res, next)
  */
-export function createBkperAuthMiddleware() {
+export function createBkperAuthMiddleware(options = {}) {
+    var _a;
+    const managedSandbox = (_a = options.managedSandbox) !== null && _a !== void 0 ? _a : isManagedSandbox();
     return (req, res, next) => __awaiter(this, void 0, void 0, function* () {
         // Only handle POST /auth/refresh
         if (req.url !== '/auth/refresh' || req.method !== 'POST') {
@@ -71,6 +77,15 @@ export function createBkperAuthMiddleware() {
             return;
         }
         res.setHeader('Content-Type', 'application/json');
+        if (managedSandbox) {
+            const response = {
+                userId: MANAGED_SANDBOX_USER_ID,
+                accessToken: MANAGED_SANDBOX_ACCESS_TOKEN,
+            };
+            res.statusCode = 200;
+            res.end(JSON.stringify(response));
+            return;
+        }
         // Check if user is logged in to CLI
         if (!isLoggedIn()) {
             res.statusCode = 401;

package/lib/dev/auth-middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-middleware.js","sourceRoot":"","sources":["../../src/dev/auth-middleware.ts"],"names":[],"mappings":";;;;;;;;;AACA,OAAO,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AACzE,OAAO,EACH,oBAAoB,EACpB,mBAAmB,EACnB,UAAU,GACb,MAAM,+BAA+B,CAAC;AAiBvC;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,KAAa;IACnC,IAAI,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAEpC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACzB,8BAA8B;QAC9B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnE,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,WAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAe,aAAa;;QACxB,MAAM,WAAW,GAAG,oBAAoB,EAAE,CAAC;QAC3C,IAAI,WAAW,aAAX,WAAW,uBAAX,WAAW,CAAE,QAAQ,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,gBAAgB,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;YACvD,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC/C,OAAO,OAAO,CAAC,KAAK,CAAC;YACzB,CAAC;QACL,CAAC;QAED,OAAO,SAAS,CAAC;IACrB,CAAC;CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,yBAAyB;IAKrC,OAAO,CAAO,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC5B,iCAAiC;QACjC,IAAI,GAAG,CAAC,GAAG,KAAK,eAAe,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACvD,IAAI,EAAE,CAAC;YACP,OAAO;QACX,CAAC;QAED,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAElD,oCAAoC;QACpC,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;YAChB,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,MAAM,aAAa,GAAsB;gBACrC,KAAK,EAAE,+BAA+B;aACzC,CAAC;YACF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC;YACvC,OAAO;QACX,CAAC;QAED,IAAI,CAAC;YACD,sEAAsE;YACtE,6BAA6B;YAC7B,MAAM,WAAW,GAAG,MAAM,mBAAmB,EAAE,CAAC;YAChD,IAAI,CAAC,WAAW,EAAE,CAAC;gBACf,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,MAAM,aAAa,GAAsB;oBACrC,KAAK,EAAE,+BAA+B;iBACzC,CAAC;gBACF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC;gBACvC,OAAO;YACX,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,aAAa,EAAE,CAAC;YACrC,MAAM,QAAQ,GAAwB;gBAClC,MAAM;gBACN,WAAW;aACd,CAAC;YACF,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,MAAM,aAAa,GAAsB;gBACrC,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,4BAA4B;aAC3E,CAAC;YACF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC;QAC3C,CAAC;IACL,CAAC,CAAA,CAAC;AACN,CAAC;AAED,iCAAiC;AACjC,MAAM,CAAC,MAAM,oBAAoB,GAAG,yBAAyB,CAAC"}
+{"version":3,"file":"auth-middleware.js","sourceRoot":"","sources":["../../src/dev/auth-middleware.ts"],"names":[],"mappings":";;;;;;;;;AACA,OAAO,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AACzE,OAAO,EACH,oBAAoB,EACpB,mBAAmB,EACnB,UAAU,GACb,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACH,gBAAgB,EAChB,4BAA4B,EAC5B,uBAAuB,GAC1B,MAAM,sBAAsB,CAAC;AAyB9B;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,KAAa;IACnC,IAAI,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAEpC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACzB,8BAA8B;QAC9B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnE,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,WAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAe,aAAa;;QACxB,MAAM,WAAW,GAAG,oBAAoB,EAAE,CAAC;QAC3C,IAAI,WAAW,aAAX,WAAW,uBAAX,WAAW,CAAE,QAAQ,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,gBAAgB,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;YACvD,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC/C,OAAO,OAAO,CAAC,KAAK,CAAC;YACzB,CAAC;QACL,CAAC;QAED,OAAO,SAAS,CAAC;IACrB,CAAC;CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,yBAAyB,CACrC,UAAsC,EAAE;;IAExC,MAAM,cAAc,GAAG,MAAA,OAAO,CAAC,cAAc,mCAAI,gBAAgB,EAAE,CAAC;IACpE,OAAO,CAAO,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC5B,iCAAiC;QACjC,IAAI,GAAG,CAAC,GAAG,KAAK,eAAe,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACvD,IAAI,EAAE,CAAC;YACP,OAAO;QACX,CAAC;QAED,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAElD,IAAI,cAAc,EAAE,CAAC;YACjB,MAAM,QAAQ,GAAwB;gBAClC,MAAM,EAAE,uBAAuB;gBAC/B,WAAW,EAAE,4BAA4B;aAC5C,CAAC;YACF,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;YAClC,OAAO;QACX,CAAC;QAED,oCAAoC;QACpC,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;YAChB,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,MAAM,aAAa,GAAsB;gBACrC,KAAK,EAAE,+BAA+B;aACzC,CAAC;YACF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC;YACvC,OAAO;QACX,CAAC;QAED,IAAI,CAAC;YACD,sEAAsE;YACtE,6BAA6B;YAC7B,MAAM,WAAW,GAAG,MAAM,mBAAmB,EAAE,CAAC;YAChD,IAAI,CAAC,WAAW,EAAE,CAAC;gBACf,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,MAAM,aAAa,GAAsB;oBACrC,KAAK,EAAE,+BAA+B;iBACzC,CAAC;gBACF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC;gBACvC,OAAO;YACX,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,aAAa,EAAE,CAAC;YACrC,MAAM,QAAQ,GAAwB;gBAClC,MAAM;gBACN,WAAW;aACd,CAAC;YACF,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,MAAM,aAAa,GAAsB;gBACrC,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,4BAA4B;aAC3E,CAAC;YACF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC;QAC3C,CAAC;IACL,CAAC,CAAA,CAAC;AACN,CAAC;AAED,iCAAiC;AACjC,MAAM,CAAC,MAAM,oBAAoB,GAAG,yBAAyB,CAAC"}

package/lib/dev/local-outbound.d.ts

@@ -3,6 +3,13 @@ export interface LocalOutboundOptions {
     appId: string;
     getAccessToken?: () => Promise<string | undefined>;
     forwardFetch?: (request: Request) => Promise<Response>;
+    /**
+     * In the managed sandbox, Bkper API and AI requests go out without credentials (its egress adds
+     * the owner's), and Bkper API requests go to the host of `bkperApiUrl` when set.
+     */
+    managedSandbox?: boolean;
+    /** The sandbox's Bkper API (`BKPER_API_URL`); its egress refuses the other environment's. */
+    bkperApiUrl?: string;
 }
 export declare function createLocalOutboundService(options: LocalOutboundOptions): LocalOutboundService;
 //# sourceMappingURL=local-outbound.d.ts.map

package/lib/dev/local-outbound.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"local-outbound.d.ts","sourceRoot":"","sources":["../../src/dev/local-outbound.ts"],"names":[],"mappings":"AAWA,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAE3E,MAAM,WAAW,oBAAoB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACnD,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC1D;AAMD,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,oBAAoB,GAAG,oBAAoB,CA8B9F"}
+{"version":3,"file":"local-outbound.d.ts","sourceRoot":"","sources":["../../src/dev/local-outbound.ts"],"names":[],"mappings":"AAYA,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAE3E,MAAM,WAAW,oBAAoB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACnD,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvD;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,6FAA6F;IAC7F,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB;AAMD,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,oBAAoB,GAAG,oBAAoB,CA0C9F"}

package/lib/dev/local-outbound.js

@@ -9,6 +9,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 import { AUTHENTICATION_REQUIRED_MESSAGE } from '../auth/auth-errors.js';
 import { getStoredOAuthToken } from '../auth/local-auth-service.js';
+import { isManagedSandbox } from './managed-sandbox.js';
 const PUBLIC_BKPER_API_HOST = 'api.bkper.app';
 const BKPER_AI_HOSTS = new Set(['ai.bkper.app', 'ai-dev.bkper.app']);
 const PLATFORM_SESSION_COOKIE_NAMES = new Set([
@@ -17,32 +18,45 @@ const PLATFORM_SESSION_COOKIE_NAMES = new Set([
     'bkper_session_local',
 ]);
 export function createLocalOutboundService(options) {
-    var _a, _b;
+    var _a, _b, _c, _d;
     const getAccessToken = (_a = options.getAccessToken) !== null && _a !== void 0 ? _a : getStoredOAuthToken;
     const forwardFetch = (_b = options.forwardFetch) !== null && _b !== void 0 ? _b : ((request) => fetch(request));
+    const managedSandbox = (_c = options.managedSandbox) !== null && _c !== void 0 ? _c : isManagedSandbox();
+    const bkperApiUrl = (_d = options.bkperApiUrl) !== null && _d !== void 0 ? _d : process.env.BKPER_API_URL;
+    const managedApiOrigin = managedSandbox && bkperApiUrl ? new URL(bkperApiUrl).origin : undefined;
     return (request) => __awaiter(this, void 0, void 0, function* () {
         const service = getAuthorizedBkperService(request);
         if (!service) {
             return forwardFetch(createForwardRequest(request, new Headers(request.headers), request.redirect));
         }
-        const accessToken = normalizeBearerToken(yield getAccessToken());
-        if (!accessToken) {
-            return new Response(JSON.stringify({ error: AUTHENTICATION_REQUIRED_MESSAGE }), {
-                status: 401,
-                headers: { 'content-type': 'application/json' },
-            });
-        }
         const headers = new Headers(request.headers);
-        headers.set('Authorization', `Bearer ${accessToken}`);
+        let url = request.url;
+        if (managedSandbox) {
+            headers.delete('Authorization');
+            if (service === 'api' && managedApiOrigin) {
+                const target = new URL(request.url);
+                url = `${managedApiOrigin}${target.pathname}${target.search}`;
+            }
+        }
+        else {
+            const accessToken = normalizeBearerToken(yield getAccessToken());
+            if (!accessToken) {
+                return new Response(JSON.stringify({ error: AUTHENTICATION_REQUIRED_MESSAGE }), {
+                    status: 401,
+                    headers: { 'content-type': 'application/json' },
+                });
+            }
+            headers.set('Authorization', `Bearer ${accessToken}`);
+        }
         headers.set('bkper-agent-id', options.appId);
         if (service === 'ai') {
             headers.set('bkper-ai-source', options.appId);
         }
         stripPlatformCookieHeaders(headers);
-        return forwardFetch(createForwardRequest(request, headers, 'manual'));
+        return forwardFetch(createForwardRequest(request, headers, 'manual', url));
     });
 }
-function createForwardRequest(request, headers, redirect) {
+function createForwardRequest(request, headers, redirect, url = request.url) {
     const init = {
         method: request.method,
         headers,
@@ -54,7 +68,7 @@ function createForwardRequest(request, headers, redirect) {
             init.duplex = 'half';
         }
     }
-    return new Request(request.url, init);
+    return new Request(url, init);
 }
 function getAuthorizedBkperService(request) {
     const url = new URL(request.url);

package/lib/dev/local-outbound.js.map

@@ -1 +1 @@
-{"version":3,"file":"local-outbound.js","sourceRoot":"","sources":["../../src/dev/local-outbound.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAEpE,MAAM,qBAAqB,GAAG,eAAe,CAAC;AAC9C,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC,CAAC;AACrE,MAAM,6BAA6B,GAAG,IAAI,GAAG,CAAC;IAC1C,eAAe;IACf,mBAAmB;IACnB,qBAAqB;CACxB,CAAC,CAAC;AAcH,MAAM,UAAU,0BAA0B,CAAC,OAA6B;;IACpE,MAAM,cAAc,GAAG,MAAA,OAAO,CAAC,cAAc,mCAAI,mBAAmB,CAAC;IACrE,MAAM,YAAY,GAAG,MAAA,OAAO,CAAC,YAAY,mCAAI,CAAC,CAAC,OAAgB,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAEpF,OAAO,CAAO,OAAgB,EAAqB,EAAE;QACjD,MAAM,OAAO,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,OAAO,YAAY,CACf,oBAAoB,CAAC,OAAO,EAAE,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,CAChF,CAAC;QACN,CAAC;QAED,MAAM,WAAW,GAAG,oBAAoB,CAAC,MAAM,cAAc,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,WAAW,EAAE,CAAC;YACf,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,EAAE;gBAC5E,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAClD,CAAC,CAAC;QACP,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,WAAW,EAAE,CAAC,CAAC;QACtD,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACnB,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAClD,CAAC;QACD,0BAA0B,CAAC,OAAO,CAAC,CAAC;QAEpC,OAAO,YAAY,CAAC,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC1E,CAAC,CAAA,CAAC;AACN,CAAC;AAED,SAAS,oBAAoB,CACzB,OAAgB,EAChB,OAAgB,EAChB,QAA6B;IAE7B,MAAM,IAAI,GAA0B;QAChC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO;QACP,QAAQ;KACX,CAAC;IAEF,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACxD,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACzB,CAAC;IACL,CAAC;IAED,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,yBAAyB,CAAC,OAAgB;IAC/C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAyB;IACnD,MAAM,OAAO,GAAG,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,OAAO,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,0BAA0B,CAAC,OAAgB;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,EAAE,CAAC;QACV,OAAO;IACX,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM;SAClB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SACxB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;SAC/B,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;SAC3C,IAAI,CAAC,IAAI,CAAC,CAAC;IAEhB,IAAI,QAAQ,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACpC,CAAC;SAAM,CAAC;QACJ,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC;AACL,CAAC;AAED,SAAS,oBAAoB,CAAC,UAAkB;;IAC5C,MAAM,UAAU,GAAG,MAAA,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,0CAAE,IAAI,GAAG,WAAW,EAAE,CAAC;IACrE,OAAO,6BAA6B,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;AACzD,CAAC"}
+{"version":3,"file":"local-outbound.js","sourceRoot":"","sources":["../../src/dev/local-outbound.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD,MAAM,qBAAqB,GAAG,eAAe,CAAC;AAC9C,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC,CAAC;AACrE,MAAM,6BAA6B,GAAG,IAAI,GAAG,CAAC;IAC1C,eAAe;IACf,mBAAmB;IACnB,qBAAqB;CACxB,CAAC,CAAC;AAqBH,MAAM,UAAU,0BAA0B,CAAC,OAA6B;;IACpE,MAAM,cAAc,GAAG,MAAA,OAAO,CAAC,cAAc,mCAAI,mBAAmB,CAAC;IACrE,MAAM,YAAY,GAAG,MAAA,OAAO,CAAC,YAAY,mCAAI,CAAC,CAAC,OAAgB,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IACpF,MAAM,cAAc,GAAG,MAAA,OAAO,CAAC,cAAc,mCAAI,gBAAgB,EAAE,CAAC;IACpE,MAAM,WAAW,GAAG,MAAA,OAAO,CAAC,WAAW,mCAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IACrE,MAAM,gBAAgB,GAClB,cAAc,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAE5E,OAAO,CAAO,OAAgB,EAAqB,EAAE;QACjD,MAAM,OAAO,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,OAAO,YAAY,CACf,oBAAoB,CAAC,OAAO,EAAE,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,CAChF,CAAC;QACN,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;QACtB,IAAI,cAAc,EAAE,CAAC;YACjB,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YAChC,IAAI,OAAO,KAAK,KAAK,IAAI,gBAAgB,EAAE,CAAC;gBACxC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACpC,GAAG,GAAG,GAAG,gBAAgB,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;YAClE,CAAC;QACL,CAAC;aAAM,CAAC;YACJ,MAAM,WAAW,GAAG,oBAAoB,CAAC,MAAM,cAAc,EAAE,CAAC,CAAC;YACjE,IAAI,CAAC,WAAW,EAAE,CAAC;gBACf,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,EAAE;oBAC5E,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;iBAClD,CAAC,CAAC;YACP,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,WAAW,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACnB,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAClD,CAAC;QACD,0BAA0B,CAAC,OAAO,CAAC,CAAC;QAEpC,OAAO,YAAY,CAAC,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/E,CAAC,CAAA,CAAC;AACN,CAAC;AAED,SAAS,oBAAoB,CACzB,OAAgB,EAChB,OAAgB,EAChB,QAA6B,EAC7B,GAAG,GAAG,OAAO,CAAC,GAAG;IAEjB,MAAM,IAAI,GAA0B;QAChC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO;QACP,QAAQ;KACX,CAAC;IAEF,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACxD,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACzB,CAAC;IACL,CAAC;IAED,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,yBAAyB,CAAC,OAAgB;IAC/C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAyB;IACnD,MAAM,OAAO,GAAG,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,OAAO,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,0BAA0B,CAAC,OAAgB;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,EAAE,CAAC;QACV,OAAO;IACX,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM;SAClB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SACxB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;SAC/B,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;SAC3C,IAAI,CAAC,IAAI,CAAC,CAAC;IAEhB,IAAI,QAAQ,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACpC,CAAC;SAAM,CAAC;QACJ,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC;AACL,CAAC;AAED,SAAS,oBAAoB,CAAC,UAAkB;;IAC5C,MAAM,UAAU,GAAG,MAAA,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,0CAAE,IAAI,GAAG,WAAW,EAAE,CAAC;IACrE,OAAO,6BAA6B,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;AACzD,CAAC"}

package/lib/dev/managed-sandbox.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Bkper's managed agent sandbox sets `BKPER_MANAGED_SANDBOX=1`. There the CLI has no login of its own:
+ * the sandbox's egress adds the owner's credentials to Bkper API and AI requests, replacing any
+ * Authorization header. Never inferred from a missing login.
+ */
+export declare function isManagedSandbox(env?: NodeJS.ProcessEnv): boolean;
+/** The access token `bkper app dev` hands out in the managed sandbox; the sandbox's egress replaces it. */
+export declare const MANAGED_SANDBOX_ACCESS_TOKEN = "placeholder-replaced-outside-the-sandbox";
+/** The user id `bkper app dev` hands out in the managed sandbox, where the CLI does not know the owner. */
+export declare const MANAGED_SANDBOX_USER_ID = "managed-sandbox";
+//# sourceMappingURL=managed-sandbox.d.ts.map

package/lib/dev/managed-sandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-sandbox.d.ts","sourceRoot":"","sources":["../../src/dev/managed-sandbox.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAE9E;AAED,2GAA2G;AAC3G,eAAO,MAAM,4BAA4B,6CAA6C,CAAC;AAEvF,2GAA2G;AAC3G,eAAO,MAAM,uBAAuB,oBAAoB,CAAC"}

package/lib/dev/managed-sandbox.js

@@ -0,0 +1,13 @@
+/**
+ * Bkper's managed agent sandbox sets `BKPER_MANAGED_SANDBOX=1`. There the CLI has no login of its own:
+ * the sandbox's egress adds the owner's credentials to Bkper API and AI requests, replacing any
+ * Authorization header. Never inferred from a missing login.
+ */
+export function isManagedSandbox(env = process.env) {
+    return env.BKPER_MANAGED_SANDBOX === '1';
+}
+/** The access token `bkper app dev` hands out in the managed sandbox; the sandbox's egress replaces it. */
+export const MANAGED_SANDBOX_ACCESS_TOKEN = 'placeholder-replaced-outside-the-sandbox';
+/** The user id `bkper app dev` hands out in the managed sandbox, where the CLI does not know the owner. */
+export const MANAGED_SANDBOX_USER_ID = 'managed-sandbox';
+//# sourceMappingURL=managed-sandbox.js.map

package/lib/dev/managed-sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-sandbox.js","sourceRoot":"","sources":["../../src/dev/managed-sandbox.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACjE,OAAO,GAAG,CAAC,qBAAqB,KAAK,GAAG,CAAC;AAC7C,CAAC;AAED,2GAA2G;AAC3G,MAAM,CAAC,MAAM,4BAA4B,GAAG,0CAA0C,CAAC;AAEvF,2GAA2G;AAC3G,MAAM,CAAC,MAAM,uBAAuB,GAAG,iBAAiB,CAAC"}

package/lib/dev/tunnel.d.ts

@@ -17,6 +17,11 @@ export interface CloudflaredTunnelOptions {
     /** Optional logger for status messages. */
     logger?: Logger;
 }
+/**
+ * Whether `bkper app dev` starts the events tunnel: only for an App with events, and never in the
+ * managed sandbox, where it cannot connect; there it says why, once.
+ */
+export declare function startsEventsTunnel(hasEvents: boolean, logger: Logger, managedSandbox?: boolean): boolean;
 /**
  * Starts a cloudflared Quick Tunnel to expose a local port to the internet.
  *

package/lib/dev/tunnel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tunnel.d.ts","sourceRoot":"","sources":["../../src/dev/tunnel.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C;;GAEG;AACH,MAAM,WAAW,YAAY;IACzB,6CAA6C;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,gCAAgC;IAChC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACrC,gCAAgC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,2CAA2C;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB;AAQD;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CACxC,OAAO,EAAE,wBAAwB,GAClC,OAAO,CAAC,YAAY,CAAC,CA4FvB"}
+{"version":3,"file":"tunnel.d.ts","sourceRoot":"","sources":["../../src/dev/tunnel.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAG1C;;GAEG;AACH,MAAM,WAAW,YAAY;IACzB,6CAA6C;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,gCAAgC;IAChC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACrC,gCAAgC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,2CAA2C;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB;AAQD;;;GAGG;AACH,wBAAgB,kBAAkB,CAC9B,SAAS,EAAE,OAAO,EAClB,MAAM,EAAE,MAAM,EACd,cAAc,UAAqB,GACpC,OAAO,CAWT;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CACxC,OAAO,EAAE,wBAAwB,GAClC,OAAO,CAAC,YAAY,CAAC,CA4FvB"}

package/lib/dev/tunnel.js

@@ -9,11 +9,26 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 import fs from 'fs';
 import { Tunnel, bin, install } from './cloudflared/index.js';
+import { isManagedSandbox } from './managed-sandbox.js';
 /**
  * Maximum number of output lines to show on tunnel failure.
  * Balances debugging context with avoiding log bloat.
  */
 const MAX_ERROR_OUTPUT_LINES = 20;
+/**
+ * Whether `bkper app dev` starts the events tunnel: only for an App with events, and never in the
+ * managed sandbox, where it cannot connect; there it says why, once.
+ */
+export function startsEventsTunnel(hasEvents, logger, managedSandbox = isManagedSandbox()) {
+    if (!hasEvents) {
+        return false;
+    }
+    if (managedSandbox) {
+        logger.info('Events tunnel skipped: it cannot connect from the managed sandbox. Test events on a deployed preview (bkper app deploy --preview).');
+        return false;
+    }
+    return true;
+}
 /**
  * Starts a cloudflared Quick Tunnel to expose a local port to the internet.
  *

package/lib/dev/tunnel.js.map

@@ -1 +1 @@
-{"version":3,"file":"tunnel.js","sourceRoot":"","sources":["../../src/dev/tunnel.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAuB9D;;;GAGG;AACH,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAElC;;;;;;;;;GASG;AACH,MAAM,UAAgB,sBAAsB,CACxC,OAAiC;;QAEjC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAEjC,+DAA+D;QAC/D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,IAAI,CAAC,8CAA8C,CAAC,CAAC;YAC7D,IAAI,CAAC;gBACD,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;gBACnB,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,OAAO,CAAC,4BAA4B,GAAG,EAAE,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACjE,MAAM,IAAI,KAAK,CACX,kCAAkC,OAAO,IAAI;oBACzC,oFAAoF,CAC3F,CAAC;YACN,CAAC;QACL,CAAC;QAED,8BAA8B;QAC9B,IAAI,CAAC;YACD,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC1C,CAAC;QAAC,WAAM,CAAC;YACL,MAAM,IAAI,KAAK,CACX,yCAAyC,GAAG,IAAI,GAAG,0BAA0B,GAAG,GAAG,CACtF,CAAC;QACN,CAAC;QAED,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAEnC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC;QAExD,+EAA+E;QAC/E,MAAM,WAAW,GAAa,EAAE,CAAC;QACjC,MAAM,aAAa,GAAG,CAAC,IAAY,EAAQ,EAAE;YACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAC3D,WAAW,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;QAC/B,CAAC,CAAC;QACF,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QACnC,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QAEnC,uCAAuC;QACvC,MAAM,GAAG,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACtD,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,MAAM,CAAC,IAAI,EAAE,CAAC;gBACd,MAAM,CAAC,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC,CAAC;YAChE,CAAC,EAAE,KAAK,CAAC,CAAC;YAEV,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,WAAmB,EAAE,EAAE;gBACvC,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,OAAO,CAAC,WAAW,CAAC,CAAC;YACzB,CAAC,CAAC,CAAC;YAEH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;gBAChC,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,MAAM,CAAC,GAAG,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;YAEH,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAmB,EAAE,EAAE;gBACxC,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBAC9B,oCAAoC;oBACpC,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACzB,MAAM,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,sBAAsB,CAAC,CAAC;wBAC/D,IAAI,WAAW,CAAC,MAAM,GAAG,sBAAsB,EAAE,CAAC;4BAC9C,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,IAAI,CACR,QAAQ,WAAW,CAAC,MAAM,GAAG,sBAAsB,iBAAiB,CACvE,CAAC;wBACN,CAAC;wBACD,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,IAAI,CAAC,qBAAqB,CAAC,CAAC;wBACpC,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;4BAC7B,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;wBAC9B,CAAC;oBACL,CAAC;oBACD,MAAM,CAAC,IAAI,KAAK,CAAC,gCAAgC,IAAI,EAAE,CAAC,CAAC,CAAC;gBAC9D,CAAC;YACL,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;QAEH,OAAO;YACH,GAAG;YACG,IAAI;;oBACN,MAAM,CAAC,IAAI,EAAE,CAAC;oBACd,+CAA+C;oBAC/C,MAAM,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE;wBAC9B,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;wBAC9C,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;4BACrB,YAAY,CAAC,WAAW,CAAC,CAAC;4BAC1B,OAAO,EAAE,CAAC;wBACd,CAAC,CAAC,CAAC;oBACP,CAAC,CAAC,CAAC;gBACP,CAAC;aAAA;SACJ,CAAC;IACN,CAAC;CAAA"}
+{"version":3,"file":"tunnel.js","sourceRoot":"","sources":["../../src/dev/tunnel.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAsBxD;;;GAGG;AACH,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAElC;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAC9B,SAAkB,EAClB,MAAc,EACd,cAAc,GAAG,gBAAgB,EAAE;IAEnC,IAAI,CAAC,SAAS,EAAE,CAAC;QACb,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,IAAI,cAAc,EAAE,CAAC;QACjB,MAAM,CAAC,IAAI,CACP,oIAAoI,CACvI,CAAC;QACF,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAgB,sBAAsB,CACxC,OAAiC;;QAEjC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAEjC,+DAA+D;QAC/D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,IAAI,CAAC,8CAA8C,CAAC,CAAC;YAC7D,IAAI,CAAC;gBACD,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;gBACnB,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,OAAO,CAAC,4BAA4B,GAAG,EAAE,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACjE,MAAM,IAAI,KAAK,CACX,kCAAkC,OAAO,IAAI;oBACzC,oFAAoF,CAC3F,CAAC;YACN,CAAC;QACL,CAAC;QAED,8BAA8B;QAC9B,IAAI,CAAC;YACD,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC1C,CAAC;QAAC,WAAM,CAAC;YACL,MAAM,IAAI,KAAK,CACX,yCAAyC,GAAG,IAAI,GAAG,0BAA0B,GAAG,GAAG,CACtF,CAAC;QACN,CAAC;QAED,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAEnC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC;QAExD,+EAA+E;QAC/E,MAAM,WAAW,GAAa,EAAE,CAAC;QACjC,MAAM,aAAa,GAAG,CAAC,IAAY,EAAQ,EAAE;YACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAC3D,WAAW,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;QAC/B,CAAC,CAAC;QACF,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QACnC,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QAEnC,uCAAuC;QACvC,MAAM,GAAG,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACtD,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,MAAM,CAAC,IAAI,EAAE,CAAC;gBACd,MAAM,CAAC,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC,CAAC;YAChE,CAAC,EAAE,KAAK,CAAC,CAAC;YAEV,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,WAAmB,EAAE,EAAE;gBACvC,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,OAAO,CAAC,WAAW,CAAC,CAAC;YACzB,CAAC,CAAC,CAAC;YAEH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;gBAChC,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,MAAM,CAAC,GAAG,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;YAEH,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAmB,EAAE,EAAE;gBACxC,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBAC9B,oCAAoC;oBACpC,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACzB,MAAM,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,sBAAsB,CAAC,CAAC;wBAC/D,IAAI,WAAW,CAAC,MAAM,GAAG,sBAAsB,EAAE,CAAC;4BAC9C,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,IAAI,CACR,QAAQ,WAAW,CAAC,MAAM,GAAG,sBAAsB,iBAAiB,CACvE,CAAC;wBACN,CAAC;wBACD,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,IAAI,CAAC,qBAAqB,CAAC,CAAC;wBACpC,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;4BAC7B,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;wBAC9B,CAAC;oBACL,CAAC;oBACD,MAAM,CAAC,IAAI,KAAK,CAAC,gCAAgC,IAAI,EAAE,CAAC,CAAC,CAAC;gBAC9D,CAAC;YACL,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;QAEH,OAAO;YACH,GAAG;YACG,IAAI;;oBACN,MAAM,CAAC,IAAI,EAAE,CAAC;oBACd,+CAA+C;oBAC/C,MAAM,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE;wBAC9B,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;wBAC9C,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;4BACrB,YAAY,CAAC,WAAW,CAAC,CAAC;4BAC1B,OAAO,EAAE,CAAC;wBACd,CAAC,CAAC,CAAC;oBACP,CAAC,CAAC,CAAC;gBACP,CAAC;aAAA;SACJ,CAAC;IACN,CAAC;CAAA"}