@datarails-ai/dr-cli 1.6.104 → 1.6.105

package/dist/cli.js

@@ -8,7 +8,7 @@ import { fileURLToPath as fileURLToPath3 } from "url";
 // package.json
 var package_default = {
   name: "@datarails-ai/dr-cli",
-  version: "1.6.104",
+  version: "1.6.105",
   description: "Datarails CLI",
   type: "module",
   engines: {
@@ -40,7 +40,7 @@ var package_default = {
     postinstall: "node scripts/postinstall.mjs"
   },
   dependencies: {
-    "@datarails-ai/dr-appspace-cli": "0.11.1",
+    "@datarails-ai/dr-appspace-cli": "0.11.2",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@napi-rs/keyring": "^1.3.0",
     commander: "^12.1.0",
@@ -69,7 +69,7 @@ var package_default = {
 };
 
 // src/buildInfo.ts
-var BUILD_TIME = "2026-10-07T12:03:26.799Z";
+var BUILD_TIME = "2026-10-07T13:28:02.898Z";
 function formatBuildTime(iso) {
   if (iso === "") return "";
   const d = new Date(iso);
@@ -1165,13 +1165,8 @@ function exchangeForSession(store, serverKey, email, session, host, opts) {
   inFlightExchanges.set(key, entry);
   return joinExchange(entry, opts.signal);
 }
-async function ensureJwt(store, serverKey, email, opts) {
-  const stored = await store.getSession(serverKey, email);
-  if (stored === void 0) {
-    throw new NotLoggedInError(`not logged in: ${serverKey}:${email}`);
-  }
-  const keyed = usesApiKey(stored);
-  const unsaved = keyed ? unsavedExchanges.get(`${serverKey}:${email}`) : void 0;
+async function exchangeKeyedSession(store, serverKey, email, stored, opts) {
+  const unsaved = unsavedExchanges.get(`${serverKey}:${email}`);
   const session = unsaved !== void 0 && unsaved.apiKey === stored.apiKey ? {
     ...stored,
     jwtAccess: unsaved.jwtAccess,
@@ -1184,16 +1179,40 @@ async function ensureJwt(store, serverKey, email, opts) {
     // The store still holds whatever the failed save meant to remove.
     jwtRefresh: void 0
   } : stored;
-  if (!opts.force && (!keyed || mintedByStoredApiKey(session)) && session.jwtAccess !== void 0 && session.jwtAccess !== "" && !jwtExpiringSoon(
-    session,
-    keyed ? apiKeyStaleBuffer(session, `${serverKey}:${email}`, opts.buffer) : opts.buffer
-  )) {
+  if (!opts.force && mintedByStoredApiKey(session) && session.jwtAccess !== void 0 && session.jwtAccess !== "" && !jwtExpiringSoon(session, apiKeyStaleBuffer(session, `${serverKey}:${email}`, opts.buffer))) {
     return session;
   }
   const host = opts.host ?? resolve(serverKey).host;
-  if (keyed) {
-    return exchangeForSession(store, serverKey, email, session, host, opts);
+  return exchangeForSession(store, serverKey, email, session, host, opts);
+}
+async function ensureApiKeyJwt(store, serverKey, email, options) {
+  const stored = options?.session ?? await store.getSession(serverKey, email);
+  if (stored === void 0) {
+    throw new NotLoggedInError(`not logged in: ${serverKey}:${email}`);
+  }
+  if (!usesApiKey(stored)) {
+    throw new Error(`${serverKey}:${email} is not an api-key identity`);
   }
+  return exchangeKeyedSession(store, serverKey, email, stored, {
+    buffer: options?.buffer ?? 0,
+    force: false,
+    signal: options?.signal,
+    host: options?.host
+  });
+}
+async function ensureJwt(store, serverKey, email, opts) {
+  const stored = await store.getSession(serverKey, email);
+  if (stored === void 0) {
+    throw new NotLoggedInError(`not logged in: ${serverKey}:${email}`);
+  }
+  if (usesApiKey(stored)) {
+    return exchangeKeyedSession(store, serverKey, email, stored, opts);
+  }
+  const session = stored;
+  if (!opts.force && session.jwtAccess !== void 0 && session.jwtAccess !== "" && !jwtExpiringSoon(session, opts.buffer)) {
+    return session;
+  }
+  const host = opts.host ?? resolve(serverKey).host;
   if (session.impersonatorEmail !== void 0 && session.impersonatorEmail !== "") {
     return recoverImpersonatedJwt(store, serverKey, email, session, host, opts);
   }
@@ -2101,7 +2120,8 @@ var AuthorizedClient = class _AuthorizedClient {
    * How this identity gets a usable JWT again. `dr login` is refused over an
    * api-key credential, and it re-authenticates the operator rather than the
    * impersonated user, so naming it for either sends the reader at a command
-   * that cannot help — the same loop `runWhoami`'s three-way split breaks.
+   * that cannot help — the same loop `runWhoami` avoids by never naming
+   * `dr login` for either.
    *
    * `cause` splits the keyed answer, which is the only one that differs: a
    * token that never arrived is not a token whose `organization_id` is wrong,
@@ -4807,7 +4827,7 @@ function declaredWithValueBelow(flag, cmd) {
 // src/commands/whoami.ts
 function registerWhoamiCommand(root) {
   const cmd = root.command("whoami").description(
-    "whoami decodes the locally-stored JWT for a server and prints the identity claims (user_id, username, email, expiration). Purely offline \u2014 no network."
+    "whoami decodes the locally-stored JWT for a server and prints the identity claims (user_id, username, email, expiration). Offline, except that an api-key identity holding no token its current key minted is exchanged once to obtain one."
   ).summary("Show the identity encoded in the stored JWT for a server").option("--json", "Output the full claims map as JSON", false).option("--verbose", "Print every claim in a table, sorted alphabetically", false).action(
     async (opts) => {
       const fileStore = await resolveFileStore(opts.server);
@@ -4845,19 +4865,34 @@ async function runWhoami(cfg) {
   }
   emitApiKeyExpiryWarning(session, `${cfg.serverKey}:${email}`);
   const foreignJwt = usesApiKey(session) && session.jwtAccess !== void 0 && session.jwtAccess !== "" && !mintedByStoredApiKey(session);
+  let active = session;
   if (session.jwtAccess === void 0 || session.jwtAccess === "" || foreignJwt) {
-    const missing = foreignJwt ? `the JWT stored for ${cfg.serverKey}:${email} was not minted by its API key` : `no JWT stored for ${cfg.serverKey}:${email}`;
-    throw new Error(
-      usesApiKey(session) ? `${missing}; run any authenticated command to exchange the API key` : isImpersonatedSession(session) ? `${missing}; re-run dr login-as` : `${missing}; run dr login --server ${cfg.serverKey} to refresh`
-    );
+    if (usesApiKey(session)) {
+      try {
+        active = await ensureApiKeyJwt(cfg.store, cfg.serverKey, email, { session });
+      } catch (err) {
+        const reason = err instanceof Error ? err.message : String(err);
+        throw new Error(`cannot show identity for ${cfg.serverKey}:${email}: ${reason}`, {
+          cause: err
+        });
+      }
+    } else {
+      const missing = `no JWT stored for ${cfg.serverKey}:${email}`;
+      throw new Error(
+        isImpersonatedSession(session) ? `${missing}; re-run dr login-as` : `${missing}; run dr login --server ${cfg.serverKey} to refresh`
+      );
+    }
+  }
+  if (active.jwtAccess === void 0 || active.jwtAccess === "") {
+    throw new Error(`no JWT stored for ${cfg.serverKey}:${email}`);
   }
   try {
-    setTelemetryTarget(cfg.serverKey, deriveIdentity(session));
+    setTelemetryTarget(cfg.serverKey, deriveIdentity(active));
   } catch {
   }
   let claims;
   try {
-    claims = decodeJwtClaims(session.jwtAccess);
+    claims = decodeJwtClaims(active.jwtAccess);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     throw new Error(`decode JWT for ${cfg.serverKey}: ${msg}`);
@@ -4867,7 +4902,7 @@ async function runWhoami(cfg) {
     host = resolve(cfg.serverKey).host;
   } catch {
   }
-  const impersonatorEmail = session.impersonatorEmail !== void 0 && session.impersonatorEmail !== "" ? session.impersonatorEmail : void 0;
+  const impersonatorEmail = active.impersonatorEmail !== void 0 && active.impersonatorEmail !== "" ? active.impersonatorEmail : void 0;
   if (cfg.asJson) {
     writeWhoamiJSON(cfg.out, cfg.serverKey, host, claims, impersonatorEmail);
     return;
@@ -5657,6 +5692,10 @@ async function runApiKeyLogin(cfg) {
     apiKey: cfg.apiKey,
     jwtAccess: tok.access,
     jwtExpiresAt: tok.expiresAt,
+    // Records which key minted this token, as every exchange does. Without it
+    // `mintedByStoredApiKey` reads the token as unknown provenance, so `whoami`
+    // and the next command would exchange again instead of using it.
+    jwtApiKeyFingerprint: apiKeyFingerprint(cfg.apiKey),
     savedAt: /* @__PURE__ */ new Date(),
     cookieless: true
   };

package/dist/scopes-map.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "cliVersion": "1.6.104",
+  "cliVersion": "1.6.105",
   "_contract": "Resolve a command path through `aliases` (canonical prefix + alias segment -> canonical path) before any lookup. A path listed in `pendingCommands`, or whose first segment is a key of `pending`, is UNDECIDED, not unrestricted: fail closed or skip it, and never read a path's absence from `commands` as 'no requirement'. An entry carrying `denied` is UNAVAILABLE to any AGENT-SCOPED credential — one whose `scopes` claim carries at least one `resource:action` entry; a claim that is absent, empty, capability-only or wholly unparseable is UNRESTRICTED, and this mark does not apply to it — whatever else that entry says: it is not a ceiling and it is not always-available, its `denied.reason` says why and `denied.until` names the ticket that lifts it, and the absence of `requires` on it must NEVER be read as 'no requirement'. Only an entry in `commands` with an empty `requires` means always-available.",
   "commands": {
     "login": {

package/dist/skills/dr-cli/SKILL.md

@@ -66,16 +66,21 @@ per server can be logged in at once.
   required unless a credential file already names the server; don't run the
   piped form under shell tracing or command logging). Never pass the key as an
   argument or paste it into chat. `dr` exchanges it for a JWT itself, so no
-  re-login is ever needed while the key is live. Keys come from an operator
-  today (no self-service command yet). `login-as` cannot run from an API-key
-  identity.
+  re-login is ever needed while the key is live — and `login --api-key` does that
+  exchange **at login** and stores the JWT, so `whoami` and the next command work
+  right away. Keys come from an operator today (no self-service command yet).
+  `login-as` cannot run from an API-key identity.
 - `dr login-as <email> --server US` — impersonate a user, **JWT only, no
   browser**. Needs an operator `login` first; stores a switchable identity you
   then target with `--account <email>`. `--as <operator-email>` picks the
   operator if several are stored; `--user-id <n>` skips the email lookup.
   Refreshes/auto-remints silently — no re-prompt until the operator expires.
 - `dr whoami --server US` — confirm who/where you are. Offline (decodes the local
-  JWT, no network). **Always sanity-check after login or a server switch.**
+  JWT, no network) — **except** an API-key credential holding no token its current
+  key minted (a key written straight into a session file — e.g. a managed-agent
+  session — or a key rotated since its token was stored), which `whoami` exchanges
+  once to obtain one and saves, so it works even as the very first command.
+  **Always sanity-check after login or a server switch.**
   Shows `Impersonated by:` for a `login-as` identity, and a `Scope:` row for
   every identity (see below).
 - `dr logout --server US` / `dr logout --all`.

package/dist/skills/dr-switch-user/SKILL.md

@@ -92,7 +92,8 @@ Run a single Bash call:
 dr whoami --server <X> --account <email> 2>&1 || true
 ```
 
-`whoami` is purely offline (decodes the locally-stored JWT, no network).
+`whoami` is offline (decodes the locally-stored JWT, no network), except that an
+API-key identity holding no token its current key minted is exchanged once.
 Classify the output:
 
 | Result                                                 | Meaning                                  |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@datarails-ai/dr-cli",
-  "version": "1.6.104",
+  "version": "1.6.105",
   "description": "Datarails CLI",
   "type": "module",
   "engines": {
@@ -17,7 +17,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@datarails-ai/dr-appspace-cli": "0.11.1",
+    "@datarails-ai/dr-appspace-cli": "0.11.2",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@napi-rs/keyring": "^1.3.0",
     "commander": "^12.1.0",