@datarails-ai/dr-cli 1.6.100 → 1.6.101

package/README.md

@@ -162,19 +162,23 @@ JWT refresh is automatic. Re-run `login` only when the refresh token itself
 dies (days of idle, password change, admin revoke). Never paste the
 session/JWT — treat them like a password.
 
-**Trying the v2 device flow (`DR_OAUTH_FLOW=v2`).** Set `DR_OAUTH_FLOW=v2` for
-`dr login` to use the monolith's `/oauth/v2/` device flow. The consent page lets
-you pick the credential's scope (below) before "Allow", and the login stores a
-cookie-less JWT pair, with no session, refreshed at the external refresh
-endpoint. The page offers the choice only where the org enforces it; elsewhere
-the token is unrestricted, as today. Unset, or `legacy`, keeps the current flow;
-any other value is refused. The server must be running the v2 endpoints
-(DR-53508). Log in again to switch an identity between flows. Not yet
-supported with a credential file (`DR_CREDENTIALS_FILE`): log in through the
-keychain.
-
-```
-DR_OAUTH_FLOW=v2 dr login --server US       # PowerShell: $env:DR_OAUTH_FLOW="v2"; dr login --server US
+**Device flow and credential scope.** `dr login` uses the monolith's
+`/oauth/v2/` device flow. The consent page lets you pick the credential's scope
+(below) before "Allow", and the login stores a cookie-less JWT pair, with no
+session, refreshed at the external refresh endpoint. The page offers the choice
+only where the org enforces it; elsewhere the token is unrestricted. This works
+with a credential file too (`DR_CREDENTIALS_FILE`), which records the login as
+`"interactiveLogin": true` so that `dr login` and `dr logout` still accept it.
+
+`DR_OAUTH_FLOW=legacy` runs the old `/oauth/device/code/` flow instead, for a
+server that does not serve `/oauth/v2/` yet (a 404 from the v2 code endpoint
+says so). A legacy token carries **no** credential scope, whatever the person
+would have picked, and the login prints a line saying so. `v2` or unset selects
+the default; any other value is refused. Log in again to switch an identity
+between flows.
+
+```
+DR_OAUTH_FLOW=legacy dr login --server US   # PowerShell: $env:DR_OAUTH_FLOW="legacy"; dr login --server US
 ```
 
 ### Credential scope

package/dist/cli.js

@@ -8,7 +8,7 @@ import { fileURLToPath as fileURLToPath3 } from "url";
 // package.json
 var package_default = {
   name: "@datarails-ai/dr-cli",
-  version: "1.6.100",
+  version: "1.6.101",
   description: "Datarails CLI",
   type: "module",
   engines: {
@@ -69,7 +69,7 @@ var package_default = {
 };
 
 // src/buildInfo.ts
-var BUILD_TIME = "2026-10-05T12:55:55.787Z";
+var BUILD_TIME = "2026-10-05T14:18:41.284Z";
 function formatBuildTime(iso) {
   if (iso === "") return "";
   const d = new Date(iso);
@@ -336,6 +336,13 @@ var credentialsFileSchema = z.object({
   // would rewrite live token material after every successful command.
   sessionId: z.string().min(1).optional(),
   csrfToken: z.string().min(1).optional(),
+  // DR-53844: set by a v2 `dr login`, whose pair comes with no cookie, so the
+  // file still reads as a person's login — `dr login` may replace it and
+  // `dr logout` may remove it — rather than as one provisioned externally.
+  // Written by the CLI only. `z.boolean()`, not `z.literal(true)`: a
+  // top-level rejection fails the whole file (see `apiKeyExpiresAt`), and a
+  // hand-edited `false` must read as absent, not lock the operator out.
+  interactiveLogin: z.boolean().optional(),
   // Validated, not just typed: `KeyringStore` turns this straight into a Date
   // and later calls `toISOString()` on it, which throws on an Invalid Date.
   // `datetime()` rejects a bad calendar date (2026-02-30, 2026-13-40) on its
@@ -2657,7 +2664,8 @@ var FileKeyringBackend = class _FileKeyringBackend {
         jwtApiKeyFingerprint: creds.accessApiKeyFingerprint
       },
       // The env var's NAME only — the resolved key never enters any store.
-      ...creds.apiKeyEnvVar !== void 0 && { apiKeyEnvVar: creds.apiKeyEnvVar }
+      ...creds.apiKeyEnvVar !== void 0 && { apiKeyEnvVar: creds.apiKeyEnvVar },
+      ...creds.interactiveLogin === true && { interactiveLogin: true }
     });
   }
   static slotOf(creds, account) {
@@ -2694,7 +2702,8 @@ var FileKeyringBackend = class _FileKeyringBackend {
       // Set-if-present, never deleted on a blob that lost it (the
       // `apiKeyExpiresAt` rule): it is the identity's only credential pointer,
       // and a meta rewrite must not be able to brick the file.
-      ...apiKeyEnvVar !== "" && { apiKeyEnvVar }
+      ...apiKeyEnvVar !== "" && { apiKeyEnvVar },
+      ...parsed2.interactiveLogin === true && { interactiveLogin: true }
     };
   }
   async get(_service, account) {
@@ -2788,6 +2797,8 @@ var FileKeyringBackend = class _FileKeyringBackend {
             if (meta.accessApiKeyFingerprint === void 0) delete next.accessApiKeyFingerprint;
             else next.accessApiKeyFingerprint = meta.accessApiKeyFingerprint;
             if (meta.apiKeyEnvVar !== void 0) next.apiKeyEnvVar = meta.apiKeyEnvVar;
+            if (meta.interactiveLogin === true) next.interactiveLogin = true;
+            else delete next.interactiveLogin;
             break;
           }
         }
@@ -4290,9 +4301,17 @@ async function refuseIfProvisionedExternally(action, opts) {
       `cannot ${action}: the credentials in ${path11} are an API key. Run \`dr login --api-key\` to replace the key (and update its \`apiKeyExpiresAt\` in that file, if set \u2014 nothing derives that date, and a stale one warns "expired" on every command), or \`dr logout\` to remove it and log in with a browser instead \u2014 it cannot be read back afterwards, so keep a copy if it is still needed.`
     );
   }
-  if (creds.sessionId !== void 0 && creds.sessionId !== "") return;
+  if (creds.apiKeyEnvVar !== void 0 && opts?.allowApiKey !== true) {
+    throw new Error(
+      `cannot ${action}: the credentials in ${path11} name the environment variable ${creds.apiKeyEnvVar} as their API key, which is what later commands would authenticate as. Remove that file (\`dr logout\`) to log in with a browser instead.`
+    );
+  }
+  if (isInteractiveFileLogin(creds)) return;
   throw provisionedExternallyError(path11, action);
 }
+function isInteractiveFileLogin(creds) {
+  return creds.sessionId !== void 0 && creds.sessionId !== "" || creds.interactiveLogin === true;
+}
 async function refuseLoginOverStoredApiKey(store, serverKey, email) {
   let existing;
   try {
@@ -4323,7 +4342,7 @@ async function refuseImpersonationWithCredentialFile() {
       `cannot ${action}: the credentials in ${path11} are an API key, and an API-key token cannot mint further credentials. Impersonating needs a browser login, so remove that file (\`dr logout\`) and run \`dr login --server <key>\` \u2014 the key cannot be read back afterwards, so keep a copy if it is still needed.`
     );
   }
-  if (creds.sessionId === void 0 || creds.sessionId === "") {
+  if (!isInteractiveFileLogin(creds)) {
     throw provisionedExternallyError(path11, action);
   }
   throw new Error(
@@ -5141,8 +5160,8 @@ var OAUTH_FLOW_ENV = "DR_OAUTH_FLOW";
 function oauthFlowFromEnv(env = process.env) {
   const raw = (env[OAUTH_FLOW_ENV] ?? "").trim();
   const value = raw.toLowerCase();
-  if (value === "" || value === "legacy") return "legacy";
-  if (value === "v2") return "v2";
+  if (value === "" || value === "v2") return "v2";
+  if (value === "legacy") return "legacy";
   throw new Error(`${OAUTH_FLOW_ENV} must be "legacy" or "v2", got "${raw}"`);
 }
 var PATHS = {
@@ -5152,7 +5171,7 @@ var PATHS = {
 var GRANT_TYPE = "urn:ietf:params:oauth:grant-type:";
 async function requestDeviceCode(host, options) {
   const base = host.replace(/\/+$/, "");
-  const flow = options?.flow ?? "legacy";
+  const flow = options?.flow ?? "v2";
   const paths = PATHS[flow];
   const body = new URLSearchParams({ client_id: CLIENT_ID, scope: paths.scope });
   const res = await fetch(`${base}${paths.code}`, {
@@ -5163,7 +5182,12 @@ async function requestDeviceCode(host, options) {
   });
   const text2 = await res.text();
   if (!res.ok) {
-    const hint = flow === "v2" && res.status === 429 ? " (too many logins from this address: wait a minute and run `dr login` again)" : "";
+    let hint = "";
+    if (flow === "v2" && res.status === 429) {
+      hint = " (too many logins from this address: wait a minute and run `dr login` again)";
+    } else if (flow === "v2" && res.status === 404) {
+      hint = ` (this server does not serve the v2 device flow yet: set ${OAUTH_FLOW_ENV}=legacy to log in through the old one, whose token carries no credential scope)`;
+    }
     throw new Error(`device/code failed: ${res.status} ${text2.trim()}${hint}`);
   }
   let raw;
@@ -5530,11 +5554,6 @@ function registerLoginCommand(root) {
     await refuseIfProvisionedExternally("log in");
     const flow = oauthFlowFromEnv();
     const fileStore = await resolveFileStore(opts.server);
-    if (flow === "v2" && fileStore !== void 0) {
-      throw new Error(
-        `DR_OAUTH_FLOW=v2 cannot log into the credential file ${fileStore.path} yet; unset DR_CREDENTIALS_FILE to log in through the keychain, or unset DR_OAUTH_FLOW.`
-      );
-    }
     let serverKey = fileStore?.key ?? (opts.server ?? "").trim();
     if (fileStore === void 0) {
       if (serverKey === "") {
@@ -5643,13 +5662,14 @@ async function runLogin(cfg) {
   await refuseIfProvisionedExternally("log in");
   const host = cfg.host ?? resolve(cfg.serverKey).host;
   const timeoutMs = cfg.timeoutMs !== void 0 && cfg.timeoutMs > 0 ? cfg.timeoutMs : DEFAULT_LOGIN_TIMEOUT_MS;
-  const flow = cfg.flow ?? "legacy";
+  const flow = cfg.flow;
   const controller = new AbortController();
   const overallTimer = setTimeout(() => controller.abort(), timeoutMs + ABORT_SLACK_MS);
   try {
-    if (flow === "v2") {
-      cfg.out.write(`Using the v2 device flow (DR_OAUTH_FLOW=v2).
-`);
+    if (flow === "legacy") {
+      cfg.out.write(
+        "Using the legacy device flow (DR_OAUTH_FLOW=legacy): its token carries no credential scope.\n"
+      );
     }
     const dc = await requestDeviceCode(host, { signal: controller.signal, flow });
     cfg.out.write(`Opening browser to authenticate with Datarails (${cfg.serverKey})...

package/dist/scopes-map.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "cliVersion": "1.6.100",
+  "cliVersion": "1.6.101",
   "_contract": "Resolve a command path through `aliases` (canonical prefix + alias segment -> canonical path) before any lookup. A path listed in `pendingCommands`, or whose first segment is a key of `pending`, is UNDECIDED, not unrestricted: fail closed or skip it, and never read a path's absence from `commands` as 'no requirement'. An entry carrying `denied` is UNAVAILABLE to any AGENT-SCOPED credential — one whose `scopes` claim carries at least one `resource:action` entry; a claim that is absent, empty, capability-only or wholly unparseable is UNRESTRICTED, and this mark does not apply to it — whatever else that entry says: it is not a ceiling and it is not always-available, its `denied.reason` says why and `denied.until` names the ticket that lifts it, and the absence of `requires` on it must NEVER be read as 'no requirement'. Only an entry in `commands` with an empty `requires` means always-available.",
   "commands": {
     "login": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@datarails-ai/dr-cli",
-  "version": "1.6.100",
+  "version": "1.6.101",
   "description": "Datarails CLI",
   "type": "module",
   "engines": {