Version Packages (#37)

github-actions[bot] · web-flow · commit 33fb071382b3 · 2026-03-10T14:57:54.000-04:00
Co-authored-by: github-actions[bot] &lt;41898282+github-actions[bot]@users.noreply.github.com&gt;
diff --git a/.changeset/auth-http-redesign.md b/.changeset/auth-http-redesign.md
diff --git a/.changeset/auth-security-hardening.md b/.changeset/auth-security-hardening.md
diff --git a/.changeset/cli-refactor-commands.md b/.changeset/cli-refactor-commands.md
diff --git a/.changeset/oauth-pkce-device-code.md b/.changeset/oauth-pkce-device-code.md
diff --git a/.changeset/utils-fs-export.md b/.changeset/utils-fs-export.md
diff --git a/packages/bundler/CHANGELOG.md b/packages/bundler/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @kidd-cli/bundler
 
+## 0.1.2
+
+### Patch Changes
+
+- Updated dependencies [f48ad38]
+  - @kidd-cli/utils@0.1.2
+  - @kidd-cli/config@0.1.2
+
 ## 0.1.1
 
 ### Patch Changes
diff --git a/packages/bundler/package.json b/packages/bundler/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@kidd-cli/bundler",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Programmatic bundler for kidd CLI tools powered by tsdown",
   "license": "MIT",
   "repository": {
diff --git a/packages/cli/CHANGELOG.md b/packages/cli/CHANGELOG.md
@@ -1,5 +1,19 @@
 # kidd-cli
 
+## 0.1.3
+
+### Patch Changes
+
+- f48ad38: Refactor CLI commands to use shared config helpers and validation utilities
+- Updated dependencies [f48ad38]
+- Updated dependencies [fd5bfcd]
+- Updated dependencies [f48ad38]
+- Updated dependencies [f48ad38]
+  - @kidd-cli/core@0.2.0
+  - @kidd-cli/utils@0.1.2
+  - @kidd-cli/bundler@0.1.2
+  - @kidd-cli/config@0.1.2
+
 ## 0.1.2
 
 ### Patch Changes
diff --git a/packages/cli/package.json b/packages/cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@kidd-cli/cli",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "DX companion CLI for the kidd framework",
   "keywords": [
     "cli",
diff --git a/packages/config/CHANGELOG.md b/packages/config/CHANGELOG.md
@@ -1,5 +1,12 @@
 # @kidd-cli/config
 
+## 0.1.2
+
+### Patch Changes
+
+- Updated dependencies [f48ad38]
+  - @kidd-cli/utils@0.1.2
+
 ## 0.1.1
 
 ### Patch Changes
diff --git a/packages/config/package.json b/packages/config/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@kidd-cli/config",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Build-time configuration for kidd CLIs",
   "license": "MIT",
   "repository": {
diff --git a/packages/core/CHANGELOG.md b/packages/core/CHANGELOG.md
@@ -1,5 +1,88 @@
 # kidd
 
+## 0.2.0
+
+### Minor Changes
+
+- f48ad38: Add resolver builder functions, HTTP integration to auth middleware, and decouple standalone http() from auth
+
+  **Resolver builders:** `auth.env()`, `auth.dotenv()`, `auth.file()`, `auth.oauth()`, `auth.deviceCode()`, `auth.token()`, `auth.custom()` provide construction sugar over raw config objects. Raw configs still work.
+
+  **Auth HTTP integration:** `auth({ http: { baseUrl, namespace } })` creates authenticated HTTP clients with automatic credential header injection. Supports single or multiple clients via an array.
+
+  **Breaking changes:**
+
+  - `http()` no longer auto-reads `ctx.auth.credential()`. Use `auth({ http })` for authenticated clients or pass `headers` explicitly.
+  - `HttpOptions.defaultHeaders` renamed to `headers` and now accepts a function `(ctx) => Record<string, string>` in addition to a static record.
+
+  Before:
+
+  ```ts
+  middleware: [
+    auth({ resolvers: [{ source: "env" }] }),
+    http({ baseUrl: "https://api.example.com", namespace: "api" }),
+  ];
+  ```
+
+  After:
+
+  ```ts
+  middleware: [
+    auth({
+      resolvers: [auth.env()],
+      http: { baseUrl: "https://api.example.com", namespace: "api" },
+    }),
+  ];
+  ```
+
+- f48ad38: Replace non-standard OAuth flow with spec-compliant PKCE (RFC 7636) and add Device Authorization Grant (RFC 8628)
+
+  The `oauth` resolver now implements the standard OAuth 2.0 Authorization Code flow with PKCE. The previous non-standard direct-token-POST flow has been removed entirely.
+
+  **Breaking change:** `OAuthSourceConfig` now requires `clientId` and `tokenUrl` in addition to `authUrl`.
+
+  Before:
+
+  ```ts
+  { source: 'oauth', authUrl: 'https://example.com/auth' }
+  ```
+
+  After:
+
+  ```ts
+  { source: 'oauth', clientId: 'my-client-id', authUrl: 'https://example.com/authorize', tokenUrl: 'https://example.com/token' }
+  ```
+
+  New `device-code` resolver added for headless/browserless environments (RFC 8628).
+
+  **Breaking change:** Remove `lib/output` and `lib/prompts` sub-exports. The `Spinner` interface is now inlined in `context/types.ts` and prompts use `@clack/prompts` directly. Consumers importing from `@kidd-cli/core/lib/output` or `@kidd-cli/core/lib/prompts` must update to use `@clack/prompts` directly.
+
+  **Breaking change:** Export `MiddlewareEnv` type from main entry point.
+
+  **Breaking change:** `DeviceCodeSourceConfig` adds `openBrowser` option (defaults to `true`). Set to `false` for headless/CI/SSH environments.
+
+  Include dotenv resolver in passive credential resolution (`ctx.auth.credential()`) alongside file and env resolvers.
+
+  OAuth callback server now detects provider error redirects (e.g. `?error=access_denied`) and resolves immediately instead of waiting for timeout.
+
+  Device-code and OAuth HTTP requests are now protected by `AbortSignal.timeout` to prevent hanging when endpoints are unresponsive.
+
+  Add `signal` parameter to `postFormEncoded()` for timeout/cancellation support.
+
+### Patch Changes
+
+- fd5bfcd: Harden auth middleware against insecure transport and injection
+
+  Enforce HTTPS on OAuth endpoint URLs (authUrl, tokenUrl, deviceAuthUrl) per RFC 8252 §8.3, allowing HTTP only for loopback addresses used during local redirect flows. Resolvers now return null for non-secure URLs.
+
+  Escape `cmd.exe` metacharacters (`&`, `|`, `<`, `>`, `^`) in URLs passed to `cmd /c start` on Windows to prevent command injection via query strings.
+
+  Remove redundant `existsSync` check in `loadFromPath` to eliminate a TOCTOU race condition, matching the pattern already used in the dotenv resolver.
+
+- Updated dependencies [f48ad38]
+  - @kidd-cli/utils@0.1.2
+  - @kidd-cli/config@0.1.2
+
 ## 0.1.2
 
 ### Patch Changes
diff --git a/packages/core/package.json b/packages/core/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@kidd-cli/core",
-  "version": "0.1.2",
+  "version": "0.2.0",
   "description": "An opinionated CLI framework for Node.js",
   "keywords": [
     "cli",
diff --git a/packages/utils/CHANGELOG.md b/packages/utils/CHANGELOG.md
@@ -1,5 +1,11 @@
 # @kidd-cli/utils
 
+## 0.1.2
+
+### Patch Changes
+
+- f48ad38: Add `fileExists` utility for checking file existence without throwing
+
 ## 0.1.1
 
 ### Patch Changes
diff --git a/packages/utils/package.json b/packages/utils/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@kidd-cli/utils",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Shared utilities for the kidd ecosystem",
   "license": "MIT",
   "repository": {

Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "@kidd-cli/bundler",`
`3`		`- "version": "0.1.1",`
	`3`	`+ "version": "0.1.2",`
`4`	`4`	`"description": "Programmatic bundler for kidd CLI tools powered by tsdown",`
`5`	`5`	`"license": "MIT",`
`6`	`6`	`"repository": {`
Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "@kidd-cli/cli",`
`3`		`- "version": "0.1.2",`
	`3`	`+ "version": "0.1.3",`
`4`	`4`	`"description": "DX companion CLI for the kidd framework",`
`5`	`5`	`"keywords": [`
`6`	`6`	`"cli",`