@datarails-ai/dr-cli 1.6.99 → 1.6.100

package/dist/cli.js

@@ -8,7 +8,7 @@ import { fileURLToPath as fileURLToPath3 } from "url";
 // package.json
 var package_default = {
   name: "@datarails-ai/dr-cli",
-  version: "1.6.99",
+  version: "1.6.100",
   description: "Datarails CLI",
   type: "module",
   engines: {
@@ -69,7 +69,7 @@ var package_default = {
 };
 
 // src/buildInfo.ts
-var BUILD_TIME = "2026-10-05T12:03:05.855Z";
+var BUILD_TIME = "2026-10-05T12:55:55.787Z";
 function formatBuildTime(iso) {
   if (iso === "") return "";
   const d = new Date(iso);
@@ -5007,7 +5007,7 @@ async function runLogout(cfg) {
         const session2 = await cfg.store.getSession(key, meta.email);
         if (session2 === void 0) continue;
         try {
-          await revoker(host2, session2);
+          writeNotes(cfg.out, await revoker(host2, session2));
         } catch {
         }
         await cfg.store.removeSession(key, meta.email);
@@ -5040,32 +5040,95 @@ async function runLogout(cfg) {
   }
   const host = resolve(cfg.serverKey).host;
   try {
-    await revoker(host, session);
+    writeNotes(cfg.out, await revoker(host, session));
   } catch {
   }
   await cfg.store.removeSession(cfg.serverKey, email);
   cfg.out.write(`Logged out of ${cfg.serverKey} as ${email}.
 `);
 }
+function writeNotes(out, notes) {
+  for (const line of notes ?? []) out.write(`${line}
+`);
+}
+var REVOKE_TIMEOUT_MS = 5e3;
 async function bestEffortLogout(host, session) {
-  if (host === "" || isCookielessSession(session)) return;
+  if (host === "") return [];
   const base = host.replace(/\/+$/, "");
-  const controller = new AbortController();
-  const timeout = setTimeout(() => controller.abort(), 5e3);
-  try {
-    await fetch(`${base}/oauth/revoke/`, {
+  if (usesApiKey(session)) {
+    return [
+      "Note: the API key is still valid server-side until it is revoked where it was issued; only the local copy was removed."
+    ];
+  }
+  const refresh = session.jwtRefresh ?? "";
+  const hasCookieSession = !isCookielessSession(session) && session.sessionId !== "" && session.csrfToken !== "";
+  if (refresh === "" && !hasCookieSession) {
+    return [
+      `Warning: no refresh token is stored for this identity, so nothing was revoked on ${base}; only the local copy was removed.`
+    ];
+  }
+  const [refreshFailure, sessionFailure] = await Promise.all([
+    refresh === "" ? void 0 : revokeRefreshToken(base, refresh),
+    hasCookieSession ? endCookieSession(base, session) : void 0
+  ]);
+  const notes = [];
+  if (refreshFailure !== void 0) {
+    notes.push(
+      `Warning: could not revoke the refresh token on ${base} (${refreshFailure}); it stays valid server-side until it expires.`
+    );
+  }
+  if (sessionFailure !== void 0) {
+    notes.push(
+      `Warning: could not end the browser session on ${base} (${sessionFailure}); it stays valid server-side until it expires.`
+    );
+  }
+  return notes;
+}
+async function revokeRefreshToken(base, refresh) {
+  return withTimeout(async (signal) => {
+    const res = await fetch(`${base}/jwt/api/token/revoke/`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ refresh }),
+      signal
+    });
+    await discardBody(res);
+    return res.status === 204 ? void 0 : `HTTP ${res.status}`;
+  });
+}
+async function endCookieSession(base, session) {
+  return withTimeout(async (signal) => {
+    const res = await fetch(`${base}/api/accounts/logout/`, {
       method: "POST",
       headers: {
         Cookie: `sessionid=${session.sessionId}; csrftoken=${session.csrfToken}`,
-        "X-CSRFToken": session.csrfToken
+        "X-CSRFToken": session.csrfToken,
+        Referer: `${base}/`
       },
-      signal: controller.signal
+      redirect: "manual",
+      signal
     });
+    await discardBody(res);
+    return res.status >= 200 && res.status < 400 ? void 0 : `HTTP ${res.status}`;
+  });
+}
+async function withTimeout(run) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), REVOKE_TIMEOUT_MS);
+  try {
+    return await run(controller.signal);
   } catch {
+    return controller.signal.aborted ? "timed out" : "network error";
   } finally {
     clearTimeout(timeout);
   }
 }
+async function discardBody(res) {
+  try {
+    await res.text();
+  } catch {
+  }
+}
 
 // src/commands/login.ts
 import { Option } from "commander";
@@ -5172,7 +5235,7 @@ function tryParseErrorCode(text2) {
   return typeof errVal === "string" ? errVal : "";
 }
 async function pollForToken(host, deviceCode, options = {}) {
-  return poll(host, PATHS.legacy.token, deviceCode, options, (text2) => {
+  return poll(host, PATHS.legacy.token, deviceCode, options, {}, (text2) => {
     const tok = parseTokenResponse(text2);
     if (!tok.sessionId || !tok.csrfToken) {
       throw new Error("token response missing session_id or csrf_token");
@@ -5181,7 +5244,7 @@ async function pollForToken(host, deviceCode, options = {}) {
   });
 }
 async function pollForV2Token(host, deviceCode, options = {}) {
-  return poll(host, PATHS.v2.token, deviceCode, options, (text2) => {
+  return poll(host, PATHS.v2.token, deviceCode, options, V2_TERMINAL_HINTS, (text2) => {
     const obj = parseObject(text2);
     const access = typeof obj.access === "string" ? obj.access : "";
     const refresh = typeof obj.refresh === "string" ? obj.refresh : "";
@@ -5191,7 +5254,11 @@ async function pollForV2Token(host, deviceCode, options = {}) {
     return { access, refresh };
   });
 }
-async function poll(host, path11, deviceCode, options, onSuccess) {
+var V2_TERMINAL_HINTS = {
+  access_denied: " (the login was refused, expired, or already used: run `dr login` again)",
+  token_issuance_failed: " (the server could not issue the token: run `dr login` again to start a new login)"
+};
+async function poll(host, path11, deviceCode, options, terminalHints, onSuccess) {
   const interval = options.interval ?? 2e3;
   const maxWait = options.maxWait ?? 6e5;
   const now = options.now ?? Date.now;
@@ -5227,7 +5294,8 @@ async function poll(host, path11, deviceCode, options, onSuccess) {
       continue;
     }
     if (errCode) {
-      throw new Error(`token error: ${errCode}`);
+      const hint = Object.hasOwn(terminalHints, errCode) ? terminalHints[errCode] : "";
+      throw new Error(`token error: ${errCode}${hint}`);
     }
     throw new Error(`token HTTP ${res.status}: ${text2.trim()}`);
   }

package/dist/scopes-map.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "cliVersion": "1.6.99",
+  "cliVersion": "1.6.100",
   "_contract": "Resolve a command path through `aliases` (canonical prefix + alias segment -> canonical path) before any lookup. A path listed in `pendingCommands`, or whose first segment is a key of `pending`, is UNDECIDED, not unrestricted: fail closed or skip it, and never read a path's absence from `commands` as 'no requirement'. An entry carrying `denied` is UNAVAILABLE to any AGENT-SCOPED credential — one whose `scopes` claim carries at least one `resource:action` entry; a claim that is absent, empty, capability-only or wholly unparseable is UNRESTRICTED, and this mark does not apply to it — whatever else that entry says: it is not a ceiling and it is not always-available, its `denied.reason` says why and `denied.until` names the ticket that lifts it, and the absence of `requires` on it must NEVER be read as 'no requirement'. Only an entry in `commands` with an empty `requires` means always-available.",
   "commands": {
     "login": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@datarails-ai/dr-cli",
-  "version": "1.6.99",
+  "version": "1.6.100",
   "description": "Datarails CLI",
   "type": "module",
   "engines": {