sleev 0.0.11 → 0.0.13

package/dist/auth/loopback.js

@@ -1,8 +1,19 @@
-// Temporary loopback server that receives the browser login handoff.
-import { createServer } from 'node:http';
-import { parseHandoff } from './schema.js';
+import { createServer, } from "node:http";
+import { parseFirebaseHandoff, parseHandoff, parseTokenHandoff, } from "./schema.js";
 const MAX_BODY_BYTES = 16 * 1024;
 export async function startLoopback(options) {
+    return start(options, {
+        parse: parseHandoff,
+        verify: (payload) => accountMismatch(options.expectedAccount, payload),
+    });
+}
+export async function startTokenLoopback(options) {
+    return start(options, { parse: parseTokenHandoff });
+}
+export async function startFirebaseLoopback(options) {
+    return start(options, { parse: parseFirebaseHandoff });
+}
+async function start(options, runtime) {
     let settled = false;
     let finish = () => undefined;
     let fail = () => undefined;
@@ -10,69 +21,125 @@ export async function startLoopback(options) {
         finish = resolve;
         fail = reject;
     });
-    const server = createServer(async (req, res) => {
-        try {
-            await handleRequest(req, res, options, (payload) => {
-                if (settled)
-                    return;
-                settled = true;
-                finish(payload);
-            }, (err) => {
-                if (settled)
-                    return;
-                settled = true;
-                fail(err);
-            });
-        }
-        catch (err) {
-            sendJson(res, 400, { error: err instanceof Error ? err.message : 'Invalid request.' }, options.webOrigin);
-        }
+    const server = createServer((req, res) => {
+        void (async () => {
+            try {
+                await handleRequest(req, res, options, runtime, (payload) => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    finish(payload);
+                }, (err) => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    fail(err);
+                });
+            }
+            catch (err) {
+                sendJson(res, 400, {
+                    error: err instanceof Error
+                        ? err.message
+                        : "Invalid request.",
+                }, options.webOrigin);
+            }
+        })();
     });
     await listen(server);
     const address = server.address();
-    if (!address || typeof address === 'string') {
+    if (!address || typeof address === "string") {
         await closeServer(server);
-        throw new Error('Could not bind local login callback server.');
+        throw new Error("Could not bind local login callback server.");
     }
     const timeout = setTimeout(() => {
         if (settled)
             return;
         settled = true;
-        fail(new Error('Timed out waiting for browser login.'));
+        fail(new Error("Timed out waiting for browser login."));
         void closeServer(server);
     }, options.timeoutMs);
-    wait.finally(() => clearTimeout(timeout)).catch(() => undefined);
+    const abort = () => {
+        if (settled)
+            return;
+        settled = true;
+        fail(new Error("Sign in cancelled."));
+        void closeServer(server);
+    };
+    if (options.signal?.aborted) {
+        abort();
+    }
+    else {
+        options.signal?.addEventListener("abort", abort, { once: true });
+    }
+    wait.finally(() => {
+        clearTimeout(timeout);
+        options.signal?.removeEventListener("abort", abort);
+    }).catch(() => undefined);
     return {
         callback: `http://127.0.0.1:${address.port}/callback`,
         wait,
         close: () => closeServer(server),
     };
 }
-async function handleRequest(req, res, options, accept, reject) {
-    if (req.method === 'OPTIONS') {
+async function handleRequest(req, res, options, runtime, accept, reject) {
+    if (req.method === "OPTIONS") {
         handleOptions(req, res, options.webOrigin);
         return;
     }
-    if (req.method !== 'POST' || req.url !== '/callback') {
-        sendJson(res, 404, { error: 'Not found.' }, options.webOrigin);
+    if (req.method !== "POST" || req.url !== "/callback") {
+        sendJson(res, 404, { error: "Not found." }, options.webOrigin);
         return;
     }
     if (!hasAllowedOrigin(req, options.webOrigin)) {
-        sendJson(res, 403, { error: 'Origin is not allowed.' }, options.webOrigin);
+        sendJson(res, 403, { error: "Origin is not allowed." }, options.webOrigin);
         return;
     }
     const body = await readBody(req);
-    const payload = parseHandoff(JSON.parse(body));
-    if (payload.state !== options.state) {
-        sendJson(res, 403, { error: 'Login state did not match.' }, options.webOrigin);
+    const payload = runtime.parse(JSON.parse(body));
+    if (stateOf(payload) !== options.state) {
+        sendJson(res, 403, { error: "Login state did not match." }, options.webOrigin);
+        return;
+    }
+    const mismatch = runtime.verify?.(payload) ?? null;
+    if (mismatch) {
+        reject(new Error(mismatch));
+        sendJson(res, 403, { error: mismatch }, options.webOrigin);
         return;
     }
     accept(payload);
     sendJson(res, 200, { ok: true }, options.webOrigin);
 }
+function stateOf(payload) {
+    if (typeof payload !== "object" || payload === null)
+        return undefined;
+    const state = payload.state;
+    if (typeof state !== "string")
+        return undefined;
+    return state;
+}
+function accountMismatch(expected, payload) {
+    if (!expected)
+        return null;
+    if (expected.accountId) {
+        if (!payload.accountId)
+            return "Could not verify browser account. Run `sleeved auth login` again.";
+        if (expected.accountId !== payload.accountId) {
+            return "Browser is signed into a different Sleev account. Run `sleeved auth login` to switch accounts.";
+        }
+        return null;
+    }
+    if (expected.email) {
+        if (!payload.email)
+            return "Could not verify browser email. Run `sleeved auth login` again.";
+        if (expected.email !== payload.email) {
+            return "Browser is signed into a different Sleev email. Run `sleeved auth login` to switch accounts.";
+        }
+    }
+    return null;
+}
 function handleOptions(req, res, origin) {
     if (!hasAllowedOrigin(req, origin)) {
-        sendJson(res, 403, { error: 'Origin is not allowed.' }, origin);
+        sendJson(res, 403, { error: "Origin is not allowed." }, origin);
         return;
     }
     writeCors(res, origin);
@@ -87,36 +154,38 @@ function readBody(req) {
     return new Promise((resolve, reject) => {
         const chunks = [];
         let size = 0;
-        req.on('data', (chunk) => {
+        req.on("data", (chunk) => {
             size += chunk.length;
             if (size > MAX_BODY_BYTES) {
-                reject(new Error('Login callback body is too large.'));
+                reject(new Error("Login callback body is too large."));
                 req.destroy();
                 return;
             }
             chunks.push(chunk);
         });
-        req.once('end', () => resolve(Buffer.concat(chunks).toString('utf8')));
-        req.once('error', () => reject(new Error('Could not read login callback.')));
+        req.once("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
+        req.once("error", () => reject(new Error("Could not read login callback.")));
     });
 }
 function sendJson(res, status, body, origin) {
     if (res.writableEnded)
         return;
     writeCors(res, origin);
-    res.writeHead(status, { 'content-type': 'application/json; charset=utf-8' });
+    res.writeHead(status, {
+        "content-type": "application/json; charset=utf-8",
+    });
     res.end(JSON.stringify(body));
 }
 function writeCors(res, origin) {
-    res.setHeader('access-control-allow-origin', origin);
-    res.setHeader('access-control-allow-methods', 'POST, OPTIONS');
-    res.setHeader('access-control-allow-headers', 'content-type');
+    res.setHeader("access-control-allow-origin", origin);
+    res.setHeader("access-control-allow-methods", "POST, OPTIONS");
+    res.setHeader("access-control-allow-headers", "content-type");
 }
 function listen(server) {
     return new Promise((resolve, reject) => {
-        server.once('error', reject);
-        server.listen(0, '127.0.0.1', () => {
-            server.removeListener('error', reject);
+        server.once("error", reject);
+        server.listen(0, "127.0.0.1", () => {
+            server.removeListener("error", reject);
             resolve();
         });
     });
@@ -132,3 +201,4 @@ function closeServer(server) {
         });
     });
 }
+//# sourceMappingURL=loopback.js.map

package/dist/auth/loopback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loopback.js","sourceRoot":"","sources":["../../src/auth/loopback.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,YAAY,GAIf,MAAM,WAAW,CAAC;AACnB,OAAO,EACH,oBAAoB,EACpB,YAAY,EACZ,iBAAiB,GAKpB,MAAM,aAAa,CAAC;AAErB,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,CAAC;AAwBjC,MAAM,CAAC,KAAK,UAAU,aAAa,CAC/B,OAAwB;IAExB,OAAO,KAAK,CAAC,OAAO,EAAE;QAClB,KAAK,EAAE,YAAY;QACnB,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC;KACzE,CAAC,CAAC;AACP,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACpC,OAA4B;IAE5B,OAAO,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACvC,OAA4B;IAE5B,OAAO,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED,KAAK,UAAU,KAAK,CAChB,OAA4B,EAC5B,OAAmB;IAEnB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,MAAM,GAAyB,GAAG,EAAE,CAAC,SAAS,CAAC;IACnD,IAAI,IAAI,GAAyB,GAAG,EAAE,CAAC,SAAS,CAAC;IAEjD,MAAM,IAAI,GAAG,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,GAAG,OAAO,CAAC;QACjB,IAAI,GAAG,MAAM,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACrC,KAAK,CAAC,KAAK,IAAI,EAAE;YACb,IAAI,CAAC;gBACD,MAAM,aAAa,CACf,GAAG,EACH,GAAG,EACH,OAAO,EACP,OAAO,EACP,CAAC,OAAO,EAAE,EAAE;oBACR,IAAI,OAAO;wBAAE,OAAO;oBACpB,OAAO,GAAG,IAAI,CAAC;oBACf,MAAM,CAAC,OAAO,CAAC,CAAC;gBACpB,CAAC,EACD,CAAC,GAAG,EAAE,EAAE;oBACJ,IAAI,OAAO;wBAAE,OAAO;oBACpB,OAAO,GAAG,IAAI,CAAC;oBACf,IAAI,CAAC,GAAG,CAAC,CAAC;gBACd,CAAC,CACJ,CAAC;YACN,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,QAAQ,CACJ,GAAG,EACH,GAAG,EACH;oBACI,KAAK,EACD,GAAG,YAAY,KAAK;wBAChB,CAAC,CAAC,GAAG,CAAC,OAAO;wBACb,CAAC,CAAC,kBAAkB;iBAC/B,EACD,OAAO,CAAC,SAAS,CACpB,CAAC;YACN,CAAC;QACL,CAAC,CAAC,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;IACrB,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;QAC5B,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,IAAI,CAAC,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC,CAAC;QACxD,KAAK,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAEtB,MAAM,KAAK,GAAG,GAAG,EAAE;QACf,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,IAAI,CAAC,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;QACtC,KAAK,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC,CAAC;IAEF,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QAC1B,KAAK,EAAE,CAAC;IACZ,CAAC;SAAM,CAAC;QACJ,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;QACd,YAAY,CAAC,OAAO,CAAC,CAAC;QACtB,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAE1B,OAAO;QACH,QAAQ,EAAE,oBAAoB,OAAO,CAAC,IAAI,WAAW;QACrD,IAAI;QACJ,KAAK,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC;KACnC,CAAC;AACN,CAAC;AAED,KAAK,UAAU,aAAa,CACxB,GAAoB,EACpB,GAAmB,EACnB,OAA4B,EAC5B,OAAmB,EACnB,MAA4B,EAC5B,MAA4B;IAE5B,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC3B,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC3C,OAAO;IACX,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;QACnD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC/D,OAAO;IACX,CAAC;IAED,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5C,QAAQ,CACJ,GAAG,EACH,GAAG,EACH,EAAE,KAAK,EAAE,wBAAwB,EAAE,EACnC,OAAO,CAAC,SAAS,CACpB,CAAC;QACF,OAAO;IACX,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC,CAAC;IAC3D,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;QACrC,QAAQ,CACJ,GAAG,EACH,GAAG,EACH,EAAE,KAAK,EAAE,4BAA4B,EAAE,EACvC,OAAO,CAAC,SAAS,CACpB,CAAC;QACF,OAAO;IACX,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;IACnD,IAAI,QAAQ,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC5B,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC3D,OAAO;IACX,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,CAAC;IAChB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,OAAO,CAAC,OAAgB;IAC7B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACtE,MAAM,KAAK,GAAI,OAAmC,CAAC,KAAK,CAAC;IACzD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,SAAS,eAAe,CACpB,QAAqC,EACrC,OAAqB;IAErB,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QACrB,IAAI,CAAC,OAAO,CAAC,SAAS;YAClB,OAAO,mEAAmE,CAAC;QAC/E,IAAI,QAAQ,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC;YAC3C,OAAO,gGAAgG,CAAC;QAC5G,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACjB,IAAI,CAAC,OAAO,CAAC,KAAK;YACd,OAAO,iEAAiE,CAAC;QAC7E,IAAI,QAAQ,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;YACnC,OAAO,8FAA8F,CAAC;QAC1G,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAClB,GAAoB,EACpB,GAAmB,EACnB,MAAc;IAEd,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;QACjC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,MAAM,CAAC,CAAC;QAChE,OAAO;IACX,CAAC;IACD,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACvB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACnB,GAAG,CAAC,GAAG,EAAE,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAoB,EAAE,MAAc;IAC1D,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;IAClC,OAAO,CAAC,MAAM,IAAI,MAAM,KAAK,MAAM,CAAC;AACxC,CAAC;AAED,SAAS,QAAQ,CAAC,GAAoB;IAClC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QAEb,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC7B,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,IAAI,GAAG,cAAc,EAAE,CAAC;gBACxB,MAAM,CAAC,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC,CAAC;gBACvD,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO;YACX,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvE,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CACnB,MAAM,CAAC,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,CACtD,CAAC;IACN,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,QAAQ,CACb,GAAmB,EACnB,MAAc,EACd,IAA6B,EAC7B,MAAc;IAEd,IAAI,GAAG,CAAC,aAAa;QAAE,OAAO;IAC9B,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACvB,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE;QAClB,cAAc,EAAE,iCAAiC;KACpD,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,SAAS,CAAC,GAAmB,EAAE,MAAc;IAClD,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC;IACrD,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,eAAe,CAAC,CAAC;IAC/D,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,cAAc,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,MAAM,CAAC,MAAc;IAC1B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YAC/B,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACvC,OAAO,EAAE,CAAC;QACd,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IAC/B,IAAI,CAAC,MAAM,CAAC,SAAS;QAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAChD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACjB,IAAI,GAAG;gBAAE,MAAM,CAAC,GAAG,CAAC,CAAC;YACrB,OAAO,EAAE,CAAC;QACd,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/auth/schema.d.ts

@@ -0,0 +1,26 @@
+export type LoginHandoff = {
+    state: string;
+    label: string | null;
+    accountId: string;
+    email: string | null;
+};
+export type TokenHandoff = {
+    state: string;
+    token: string;
+    label: string | null;
+    proxyUrl: string;
+};
+export type FirebaseHandoff = {
+    state: string;
+    refreshToken: string;
+    accountId: string;
+    email: string | null;
+    label: string | null;
+};
+export type AccountIdentity = {
+    accountId: string | null;
+    email: string | null;
+};
+export declare function parseHandoff(input: unknown): LoginHandoff;
+export declare function parseTokenHandoff(input: unknown): TokenHandoff;
+export declare function parseFirebaseHandoff(input: unknown): FirebaseHandoff;

package/dist/auth/schema.js

@@ -1,35 +1,76 @@
-// Validation for the browser-to-CLI auth handoff payload.
 export function parseHandoff(input) {
-    if (!isRecord(input))
-        throw new Error('Login callback payload must be an object.');
-    const state = stringField(input, 'state');
-    const token = stringField(input, 'token');
-    const label = nullableStringField(input, 'label');
-    const proxyUrl = stringField(input, 'proxyUrl');
+    if (!isRecord(input)) {
+        throw new Error("Login callback payload must be an object.");
+    }
+    const state = stringField(input, "state");
+    const label = nullableStringField(input, "label");
+    const accountId = stringField(input, "accountId");
+    const email = nullableStringField(input, "email");
+    if (!state)
+        throw new Error("Login callback state is missing.");
+    if (!accountId)
+        throw new Error("Login callback account ID is missing.");
+    return {
+        state,
+        label,
+        accountId,
+        email,
+    };
+}
+export function parseTokenHandoff(input) {
+    if (!isRecord(input)) {
+        throw new Error("Token callback payload must be an object.");
+    }
+    const state = stringField(input, "state");
+    const token = stringField(input, "token");
+    const label = nullableStringField(input, "label");
+    const proxyUrl = stringField(input, "proxyUrl");
+    if (!state)
+        throw new Error("Token callback state is missing.");
+    if (!token.startsWith("slv_live_"))
+        throw new Error("Token callback token is invalid.");
+    validateUrl(proxyUrl, "Token callback proxy URL");
+    return {
+        state,
+        token,
+        label,
+        proxyUrl,
+    };
+}
+export function parseFirebaseHandoff(input) {
+    if (!isRecord(input)) {
+        throw new Error("Firebase callback payload must be an object.");
+    }
+    const state = stringField(input, "state");
+    const refreshToken = stringField(input, "refreshToken");
+    const accountId = stringField(input, "accountId");
+    const email = nullableStringField(input, "email");
+    const label = nullableStringField(input, "label");
     if (!state)
-        throw new Error('Login callback state is missing.');
-    if (!token.startsWith('slv_live_'))
-        throw new Error('Login callback token is invalid.');
-    validateUrl(proxyUrl, 'Login callback proxy URL');
-    return { state, token, label, proxyUrl };
+        throw new Error("Firebase callback state is missing.");
+    if (!refreshToken)
+        throw new Error("Firebase callback refresh token is missing.");
+    if (!accountId)
+        throw new Error("Firebase callback account ID is missing.");
+    return { state, refreshToken, accountId, email, label };
 }
 function stringField(input, key) {
     const value = input[key];
-    if (typeof value !== 'string')
+    if (typeof value !== "string")
         throw new Error(`${key} must be a string.`);
     return value;
 }
 function nullableStringField(input, key) {
     const value = input[key];
-    if (value === null || typeof value === 'undefined')
+    if (value === null || typeof value === "undefined")
         return null;
-    if (typeof value !== 'string')
+    if (typeof value !== "string")
         throw new Error(`${key} must be a string or null.`);
     return value;
 }
 function validateUrl(raw, name) {
     const url = parseUrl(raw, name);
-    if (url.protocol !== 'https:' && url.protocol !== 'http:') {
+    if (url.protocol !== "https:" && url.protocol !== "http:") {
         throw new Error(`${name} must use http or https.`);
     }
 }
@@ -42,5 +83,6 @@ function parseUrl(raw, name) {
     }
 }
 function isRecord(input) {
-    return typeof input === 'object' && input !== null && !Array.isArray(input);
+    return typeof input === "object" && input !== null && !Array.isArray(input);
 }
+//# sourceMappingURL=schema.js.map

package/dist/auth/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/auth/schema.ts"],"names":[],"mappings":"AA2BA,MAAM,UAAU,YAAY,CAAC,KAAc;IACvC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAElD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAChE,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAEzE,OAAO;QACH,KAAK;QACL,KAAK;QACL,SAAS;QACT,KAAK;KACR,CAAC;AACN,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC5C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAEhD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAChE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACxD,WAAW,CAAC,QAAQ,EAAE,0BAA0B,CAAC,CAAC;IAElD,OAAO;QACH,KAAK;QACL,KAAK;QACL,KAAK;QACL,QAAQ;KACX,CAAC;AACN,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAc;IAC/C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAElD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACnE,IAAI,CAAC,YAAY;QACb,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACnE,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAE5E,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC5D,CAAC;AAED,SAAS,WAAW,CAAC,KAA8B,EAAE,GAAW;IAC5D,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,oBAAoB,CAAC,CAAC;IAC3E,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,SAAS,mBAAmB,CACxB,KAA8B,EAC9B,GAAW;IAEX,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IAChE,IAAI,OAAO,KAAK,KAAK,QAAQ;QACzB,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,4BAA4B,CAAC,CAAC;IACxD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,SAAS,WAAW,CAAC,GAAW,EAAE,IAAY;IAC1C,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAChC,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,0BAA0B,CAAC,CAAC;IACvD,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW,EAAE,IAAY;IACvC,IAAI,CAAC;QACD,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACL,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,uBAAuB,CAAC,CAAC;IACpD,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAChF,CAAC"}

package/dist/auth/token.d.ts

@@ -0,0 +1,19 @@
+import type { Writable } from "node:stream";
+export type TokenResult = {
+    id: string;
+    token: string;
+    label: string | null;
+    proxyUrl: string;
+    createdAt: string;
+};
+export type TokenOptions = {
+    webOrigin?: string;
+    label?: string;
+    output?: Writable;
+    opener?: (url: string) => Promise<boolean>;
+    onUrl?: (url: string) => void;
+    timeoutMs?: number;
+    signal?: AbortSignal;
+    now?: () => Date;
+};
+export declare function createToken(options?: TokenOptions): Promise<TokenResult>;

package/dist/auth/token.js

@@ -0,0 +1,53 @@
+// Creates live Sleev tokens through the browser callback used by the legacy CLI.
+import { randomBytes, randomUUID } from "node:crypto";
+import { hostname } from "node:os";
+import { webOrigin as defaultWebOrigin } from "../product.js";
+import { openBrowser } from "./browser.js";
+import { startTokenLoopback } from "./loopback.js";
+const TOKEN_TIMEOUT_MS = 10 * 60 * 1000;
+export async function createToken(options = {}) {
+    const output = options.output ?? process.stdout;
+    const origin = options.webOrigin ?? defaultWebOrigin();
+    const opener = options.opener ?? openBrowser;
+    const state = randomBytes(32).toString("base64url");
+    const loopback = await startTokenLoopback({
+        state,
+        webOrigin: origin,
+        timeoutMs: options.timeoutMs ?? TOKEN_TIMEOUT_MS,
+        ...(options.signal ? { signal: options.signal } : {}),
+    });
+    const url = tokenUrl(origin, state, loopback.callback, options.label);
+    options.onUrl?.(url);
+    output.write(`Opening ${origin} to create a Sleev token.\n`);
+    try {
+        const opened = await opener(url);
+        if (!opened) {
+            output.write("Could not open a browser automatically. Open this URL instead:\n");
+            output.write(`${url}\n`);
+        }
+        output.write("Waiting for browser token confirmation...\n");
+        const payload = await loopback.wait;
+        output.write("Browser token confirmed.\n");
+        return {
+            id: randomUUID(),
+            token: payload.token,
+            label: payload.label,
+            proxyUrl: payload.proxyUrl,
+            createdAt: (options.now ?? (() => new Date()))().toISOString(),
+        };
+    }
+    finally {
+        await loopback.close();
+    }
+}
+function tokenUrl(origin, state, callback, label) {
+    const url = new URL("/cli/login", origin);
+    url.searchParams.set("mode", "signup");
+    url.searchParams.set("state", state);
+    url.searchParams.set("callback", callback);
+    url.searchParams.set("device", hostname().slice(0, 80));
+    if (label)
+        url.searchParams.set("label", label);
+    return url.toString();
+}
+//# sourceMappingURL=token.js.map

package/dist/auth/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../src/auth/token.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,EAAE,SAAS,IAAI,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAEnD,MAAM,gBAAgB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAqBxC,MAAM,CAAC,KAAK,UAAU,WAAW,CAC7B,UAAwB,EAAE;IAE1B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,IAAI,gBAAgB,EAAE,CAAC;IACvD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,WAAW,CAAC;IAC7C,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC;QACtC,KAAK;QACL,SAAS,EAAE,MAAM;QACjB,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,gBAAgB;QAChD,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACtE,OAAO,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC;IACrB,MAAM,CAAC,KAAK,CAAC,WAAW,MAAM,6BAA6B,CAAC,CAAC;IAE7D,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,MAAM,CAAC,KAAK,CACR,kEAAkE,CACrE,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;QAC7B,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC;QACpC,MAAM,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAC3C,OAAO;YACH,EAAE,EAAE,UAAU,EAAE;YAChB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,SAAS,EAAE,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE;SACjE,CAAC;IACN,CAAC;YAAS,CAAC;QACP,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CACb,MAAc,EACd,KAAa,EACb,QAAgB,EAChB,KAAc;IAEd,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAC1C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACvC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC3C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACxD,IAAI,KAAK;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAChD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AAC1B,CAAC"}

package/dist/auth/verify.d.ts

@@ -0,0 +1,6 @@
+import { FirebaseTokenManager } from "./firebase-tokens.js";
+export type VerifyResult = {
+    accountId: string;
+    email: string | null;
+};
+export declare function verifyFirebaseAuth(manager?: FirebaseTokenManager, fetchImpl?: typeof fetch): Promise<VerifyResult>;

package/dist/auth/verify.js

@@ -0,0 +1,22 @@
+// Proves the Firebase chain end to end: stored refresh token -> minted ID
+// token -> authenticated control-server call.
+import { apiOrigin } from "../product.js";
+import { FirebaseTokenManager } from "./firebase-tokens.js";
+export async function verifyFirebaseAuth(manager = new FirebaseTokenManager(), fetchImpl = fetch) {
+    const idToken = await manager.getIdToken();
+    const response = await fetchImpl(`${apiOrigin()}/api/users/me`, {
+        headers: { authorization: `Bearer ${idToken}` },
+    });
+    if (!response.ok) {
+        throw new Error(`Control rejected the Firebase token (HTTP ${response.status}).`);
+    }
+    const body = (await response.json().catch(() => null));
+    if (!body || typeof body.id !== "string") {
+        throw new Error("Control returned an unexpected /api/users/me body.");
+    }
+    return {
+        accountId: body.id,
+        email: typeof body.email === "string" ? body.email : null,
+    };
+}
+//# sourceMappingURL=verify.js.map

package/dist/auth/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/auth/verify.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,8CAA8C;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAO5D,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACpC,OAAO,GAAG,IAAI,oBAAoB,EAAE,EACpC,YAA0B,KAAK;IAE/B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,SAAS,EAAE,eAAe,EAAE;QAC5D,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,EAAE,EAAE;KAClD,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACX,6CAA6C,QAAQ,CAAC,MAAM,IAAI,CACnE,CAAC;IACN,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAG7C,CAAC;IAET,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO;QACH,SAAS,EAAE,IAAI,CAAC,EAAE;QAClB,KAAK,EAAE,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;KAC5D,CAAC;AACN,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+type CommandResult = {
+    exitCode: number;
+    output?: string;
+    error?: string;
+};
+export declare function runCli(argv: string[]): Promise<CommandResult>;
+export {};