@datarails-ai/dr-cli 1.6.99 → 1.6.101

package/README.md

@@ -162,19 +162,23 @@ JWT refresh is automatic. Re-run `login` only when the refresh token itself
 dies (days of idle, password change, admin revoke). Never paste the
 session/JWT — treat them like a password.
 
-**Trying the v2 device flow (`DR_OAUTH_FLOW=v2`).** Set `DR_OAUTH_FLOW=v2` for
-`dr login` to use the monolith's `/oauth/v2/` device flow. The consent page lets
-you pick the credential's scope (below) before "Allow", and the login stores a
-cookie-less JWT pair, with no session, refreshed at the external refresh
-endpoint. The page offers the choice only where the org enforces it; elsewhere
-the token is unrestricted, as today. Unset, or `legacy`, keeps the current flow;
-any other value is refused. The server must be running the v2 endpoints
-(DR-53508). Log in again to switch an identity between flows. Not yet
-supported with a credential file (`DR_CREDENTIALS_FILE`): log in through the
-keychain.
-
-```
-DR_OAUTH_FLOW=v2 dr login --server US       # PowerShell: $env:DR_OAUTH_FLOW="v2"; dr login --server US
+**Device flow and credential scope.** `dr login` uses the monolith's
+`/oauth/v2/` device flow. The consent page lets you pick the credential's scope
+(below) before "Allow", and the login stores a cookie-less JWT pair, with no
+session, refreshed at the external refresh endpoint. The page offers the choice
+only where the org enforces it; elsewhere the token is unrestricted. This works
+with a credential file too (`DR_CREDENTIALS_FILE`), which records the login as
+`"interactiveLogin": true` so that `dr login` and `dr logout` still accept it.
+
+`DR_OAUTH_FLOW=legacy` runs the old `/oauth/device/code/` flow instead, for a
+server that does not serve `/oauth/v2/` yet (a 404 from the v2 code endpoint
+says so). A legacy token carries **no** credential scope, whatever the person
+would have picked, and the login prints a line saying so. `v2` or unset selects
+the default; any other value is refused. Log in again to switch an identity
+between flows.
+
+```
+DR_OAUTH_FLOW=legacy dr login --server US   # PowerShell: $env:DR_OAUTH_FLOW="legacy"; dr login --server US
 ```
 
 ### Credential scope

package/dist/cli.js

@@ -8,7 +8,7 @@ import { fileURLToPath as fileURLToPath3 } from "url";
 // package.json
 var package_default = {
   name: "@datarails-ai/dr-cli",
-  version: "1.6.99",
+  version: "1.6.101",
   description: "Datarails CLI",
   type: "module",
   engines: {
@@ -69,7 +69,7 @@ var package_default = {
 };
 
 // src/buildInfo.ts
-var BUILD_TIME = "2026-10-05T12:03:05.855Z";
+var BUILD_TIME = "2026-10-05T14:18:41.284Z";
 function formatBuildTime(iso) {
   if (iso === "") return "";
   const d = new Date(iso);
@@ -336,6 +336,13 @@ var credentialsFileSchema = z.object({
   // would rewrite live token material after every successful command.
   sessionId: z.string().min(1).optional(),
   csrfToken: z.string().min(1).optional(),
+  // DR-53844: set by a v2 `dr login`, whose pair comes with no cookie, so the
+  // file still reads as a person's login — `dr login` may replace it and
+  // `dr logout` may remove it — rather than as one provisioned externally.
+  // Written by the CLI only. `z.boolean()`, not `z.literal(true)`: a
+  // top-level rejection fails the whole file (see `apiKeyExpiresAt`), and a
+  // hand-edited `false` must read as absent, not lock the operator out.
+  interactiveLogin: z.boolean().optional(),
   // Validated, not just typed: `KeyringStore` turns this straight into a Date
   // and later calls `toISOString()` on it, which throws on an Invalid Date.
   // `datetime()` rejects a bad calendar date (2026-02-30, 2026-13-40) on its
@@ -2657,7 +2664,8 @@ var FileKeyringBackend = class _FileKeyringBackend {
         jwtApiKeyFingerprint: creds.accessApiKeyFingerprint
       },
       // The env var's NAME only — the resolved key never enters any store.
-      ...creds.apiKeyEnvVar !== void 0 && { apiKeyEnvVar: creds.apiKeyEnvVar }
+      ...creds.apiKeyEnvVar !== void 0 && { apiKeyEnvVar: creds.apiKeyEnvVar },
+      ...creds.interactiveLogin === true && { interactiveLogin: true }
     });
   }
   static slotOf(creds, account) {
@@ -2694,7 +2702,8 @@ var FileKeyringBackend = class _FileKeyringBackend {
       // Set-if-present, never deleted on a blob that lost it (the
       // `apiKeyExpiresAt` rule): it is the identity's only credential pointer,
       // and a meta rewrite must not be able to brick the file.
-      ...apiKeyEnvVar !== "" && { apiKeyEnvVar }
+      ...apiKeyEnvVar !== "" && { apiKeyEnvVar },
+      ...parsed2.interactiveLogin === true && { interactiveLogin: true }
     };
   }
   async get(_service, account) {
@@ -2788,6 +2797,8 @@ var FileKeyringBackend = class _FileKeyringBackend {
             if (meta.accessApiKeyFingerprint === void 0) delete next.accessApiKeyFingerprint;
             else next.accessApiKeyFingerprint = meta.accessApiKeyFingerprint;
             if (meta.apiKeyEnvVar !== void 0) next.apiKeyEnvVar = meta.apiKeyEnvVar;
+            if (meta.interactiveLogin === true) next.interactiveLogin = true;
+            else delete next.interactiveLogin;
             break;
           }
         }
@@ -4290,9 +4301,17 @@ async function refuseIfProvisionedExternally(action, opts) {
       `cannot ${action}: the credentials in ${path11} are an API key. Run \`dr login --api-key\` to replace the key (and update its \`apiKeyExpiresAt\` in that file, if set \u2014 nothing derives that date, and a stale one warns "expired" on every command), or \`dr logout\` to remove it and log in with a browser instead \u2014 it cannot be read back afterwards, so keep a copy if it is still needed.`
     );
   }
-  if (creds.sessionId !== void 0 && creds.sessionId !== "") return;
+  if (creds.apiKeyEnvVar !== void 0 && opts?.allowApiKey !== true) {
+    throw new Error(
+      `cannot ${action}: the credentials in ${path11} name the environment variable ${creds.apiKeyEnvVar} as their API key, which is what later commands would authenticate as. Remove that file (\`dr logout\`) to log in with a browser instead.`
+    );
+  }
+  if (isInteractiveFileLogin(creds)) return;
   throw provisionedExternallyError(path11, action);
 }
+function isInteractiveFileLogin(creds) {
+  return creds.sessionId !== void 0 && creds.sessionId !== "" || creds.interactiveLogin === true;
+}
 async function refuseLoginOverStoredApiKey(store, serverKey, email) {
   let existing;
   try {
@@ -4323,7 +4342,7 @@ async function refuseImpersonationWithCredentialFile() {
       `cannot ${action}: the credentials in ${path11} are an API key, and an API-key token cannot mint further credentials. Impersonating needs a browser login, so remove that file (\`dr logout\`) and run \`dr login --server <key>\` \u2014 the key cannot be read back afterwards, so keep a copy if it is still needed.`
     );
   }
-  if (creds.sessionId === void 0 || creds.sessionId === "") {
+  if (!isInteractiveFileLogin(creds)) {
     throw provisionedExternallyError(path11, action);
   }
   throw new Error(
@@ -5007,7 +5026,7 @@ async function runLogout(cfg) {
         const session2 = await cfg.store.getSession(key, meta.email);
         if (session2 === void 0) continue;
         try {
-          await revoker(host2, session2);
+          writeNotes(cfg.out, await revoker(host2, session2));
         } catch {
         }
         await cfg.store.removeSession(key, meta.email);
@@ -5040,32 +5059,95 @@ async function runLogout(cfg) {
   }
   const host = resolve(cfg.serverKey).host;
   try {
-    await revoker(host, session);
+    writeNotes(cfg.out, await revoker(host, session));
   } catch {
   }
   await cfg.store.removeSession(cfg.serverKey, email);
   cfg.out.write(`Logged out of ${cfg.serverKey} as ${email}.
 `);
 }
+function writeNotes(out, notes) {
+  for (const line of notes ?? []) out.write(`${line}
+`);
+}
+var REVOKE_TIMEOUT_MS = 5e3;
 async function bestEffortLogout(host, session) {
-  if (host === "" || isCookielessSession(session)) return;
+  if (host === "") return [];
   const base = host.replace(/\/+$/, "");
-  const controller = new AbortController();
-  const timeout = setTimeout(() => controller.abort(), 5e3);
-  try {
-    await fetch(`${base}/oauth/revoke/`, {
+  if (usesApiKey(session)) {
+    return [
+      "Note: the API key is still valid server-side until it is revoked where it was issued; only the local copy was removed."
+    ];
+  }
+  const refresh = session.jwtRefresh ?? "";
+  const hasCookieSession = !isCookielessSession(session) && session.sessionId !== "" && session.csrfToken !== "";
+  if (refresh === "" && !hasCookieSession) {
+    return [
+      `Warning: no refresh token is stored for this identity, so nothing was revoked on ${base}; only the local copy was removed.`
+    ];
+  }
+  const [refreshFailure, sessionFailure] = await Promise.all([
+    refresh === "" ? void 0 : revokeRefreshToken(base, refresh),
+    hasCookieSession ? endCookieSession(base, session) : void 0
+  ]);
+  const notes = [];
+  if (refreshFailure !== void 0) {
+    notes.push(
+      `Warning: could not revoke the refresh token on ${base} (${refreshFailure}); it stays valid server-side until it expires.`
+    );
+  }
+  if (sessionFailure !== void 0) {
+    notes.push(
+      `Warning: could not end the browser session on ${base} (${sessionFailure}); it stays valid server-side until it expires.`
+    );
+  }
+  return notes;
+}
+async function revokeRefreshToken(base, refresh) {
+  return withTimeout(async (signal) => {
+    const res = await fetch(`${base}/jwt/api/token/revoke/`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ refresh }),
+      signal
+    });
+    await discardBody(res);
+    return res.status === 204 ? void 0 : `HTTP ${res.status}`;
+  });
+}
+async function endCookieSession(base, session) {
+  return withTimeout(async (signal) => {
+    const res = await fetch(`${base}/api/accounts/logout/`, {
       method: "POST",
       headers: {
         Cookie: `sessionid=${session.sessionId}; csrftoken=${session.csrfToken}`,
-        "X-CSRFToken": session.csrfToken
+        "X-CSRFToken": session.csrfToken,
+        Referer: `${base}/`
       },
-      signal: controller.signal
+      redirect: "manual",
+      signal
     });
+    await discardBody(res);
+    return res.status >= 200 && res.status < 400 ? void 0 : `HTTP ${res.status}`;
+  });
+}
+async function withTimeout(run) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), REVOKE_TIMEOUT_MS);
+  try {
+    return await run(controller.signal);
   } catch {
+    return controller.signal.aborted ? "timed out" : "network error";
   } finally {
     clearTimeout(timeout);
   }
 }
+async function discardBody(res) {
+  try {
+    await res.text();
+  } catch {
+  }
+}
 
 // src/commands/login.ts
 import { Option } from "commander";
@@ -5078,8 +5160,8 @@ var OAUTH_FLOW_ENV = "DR_OAUTH_FLOW";
 function oauthFlowFromEnv(env = process.env) {
   const raw = (env[OAUTH_FLOW_ENV] ?? "").trim();
   const value = raw.toLowerCase();
-  if (value === "" || value === "legacy") return "legacy";
-  if (value === "v2") return "v2";
+  if (value === "" || value === "v2") return "v2";
+  if (value === "legacy") return "legacy";
   throw new Error(`${OAUTH_FLOW_ENV} must be "legacy" or "v2", got "${raw}"`);
 }
 var PATHS = {
@@ -5089,7 +5171,7 @@ var PATHS = {
 var GRANT_TYPE = "urn:ietf:params:oauth:grant-type:";
 async function requestDeviceCode(host, options) {
   const base = host.replace(/\/+$/, "");
-  const flow = options?.flow ?? "legacy";
+  const flow = options?.flow ?? "v2";
   const paths = PATHS[flow];
   const body = new URLSearchParams({ client_id: CLIENT_ID, scope: paths.scope });
   const res = await fetch(`${base}${paths.code}`, {
@@ -5100,7 +5182,12 @@ async function requestDeviceCode(host, options) {
   });
   const text2 = await res.text();
   if (!res.ok) {
-    const hint = flow === "v2" && res.status === 429 ? " (too many logins from this address: wait a minute and run `dr login` again)" : "";
+    let hint = "";
+    if (flow === "v2" && res.status === 429) {
+      hint = " (too many logins from this address: wait a minute and run `dr login` again)";
+    } else if (flow === "v2" && res.status === 404) {
+      hint = ` (this server does not serve the v2 device flow yet: set ${OAUTH_FLOW_ENV}=legacy to log in through the old one, whose token carries no credential scope)`;
+    }
     throw new Error(`device/code failed: ${res.status} ${text2.trim()}${hint}`);
   }
   let raw;
@@ -5172,7 +5259,7 @@ function tryParseErrorCode(text2) {
   return typeof errVal === "string" ? errVal : "";
 }
 async function pollForToken(host, deviceCode, options = {}) {
-  return poll(host, PATHS.legacy.token, deviceCode, options, (text2) => {
+  return poll(host, PATHS.legacy.token, deviceCode, options, {}, (text2) => {
     const tok = parseTokenResponse(text2);
     if (!tok.sessionId || !tok.csrfToken) {
       throw new Error("token response missing session_id or csrf_token");
@@ -5181,7 +5268,7 @@ async function pollForToken(host, deviceCode, options = {}) {
   });
 }
 async function pollForV2Token(host, deviceCode, options = {}) {
-  return poll(host, PATHS.v2.token, deviceCode, options, (text2) => {
+  return poll(host, PATHS.v2.token, deviceCode, options, V2_TERMINAL_HINTS, (text2) => {
     const obj = parseObject(text2);
     const access = typeof obj.access === "string" ? obj.access : "";
     const refresh = typeof obj.refresh === "string" ? obj.refresh : "";
@@ -5191,7 +5278,11 @@ async function pollForV2Token(host, deviceCode, options = {}) {
     return { access, refresh };
   });
 }
-async function poll(host, path11, deviceCode, options, onSuccess) {
+var V2_TERMINAL_HINTS = {
+  access_denied: " (the login was refused, expired, or already used: run `dr login` again)",
+  token_issuance_failed: " (the server could not issue the token: run `dr login` again to start a new login)"
+};
+async function poll(host, path11, deviceCode, options, terminalHints, onSuccess) {
   const interval = options.interval ?? 2e3;
   const maxWait = options.maxWait ?? 6e5;
   const now = options.now ?? Date.now;
@@ -5227,7 +5318,8 @@ async function poll(host, path11, deviceCode, options, onSuccess) {
       continue;
     }
     if (errCode) {
-      throw new Error(`token error: ${errCode}`);
+      const hint = Object.hasOwn(terminalHints, errCode) ? terminalHints[errCode] : "";
+      throw new Error(`token error: ${errCode}${hint}`);
     }
     throw new Error(`token HTTP ${res.status}: ${text2.trim()}`);
   }
@@ -5462,11 +5554,6 @@ function registerLoginCommand(root) {
     await refuseIfProvisionedExternally("log in");
     const flow = oauthFlowFromEnv();
     const fileStore = await resolveFileStore(opts.server);
-    if (flow === "v2" && fileStore !== void 0) {
-      throw new Error(
-        `DR_OAUTH_FLOW=v2 cannot log into the credential file ${fileStore.path} yet; unset DR_CREDENTIALS_FILE to log in through the keychain, or unset DR_OAUTH_FLOW.`
-      );
-    }
     let serverKey = fileStore?.key ?? (opts.server ?? "").trim();
     if (fileStore === void 0) {
       if (serverKey === "") {
@@ -5575,13 +5662,14 @@ async function runLogin(cfg) {
   await refuseIfProvisionedExternally("log in");
   const host = cfg.host ?? resolve(cfg.serverKey).host;
   const timeoutMs = cfg.timeoutMs !== void 0 && cfg.timeoutMs > 0 ? cfg.timeoutMs : DEFAULT_LOGIN_TIMEOUT_MS;
-  const flow = cfg.flow ?? "legacy";
+  const flow = cfg.flow;
   const controller = new AbortController();
   const overallTimer = setTimeout(() => controller.abort(), timeoutMs + ABORT_SLACK_MS);
   try {
-    if (flow === "v2") {
-      cfg.out.write(`Using the v2 device flow (DR_OAUTH_FLOW=v2).
-`);
+    if (flow === "legacy") {
+      cfg.out.write(
+        "Using the legacy device flow (DR_OAUTH_FLOW=legacy): its token carries no credential scope.\n"
+      );
     }
     const dc = await requestDeviceCode(host, { signal: controller.signal, flow });
     cfg.out.write(`Opening browser to authenticate with Datarails (${cfg.serverKey})...

package/dist/scopes-map.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "cliVersion": "1.6.99",
+  "cliVersion": "1.6.101",
   "_contract": "Resolve a command path through `aliases` (canonical prefix + alias segment -> canonical path) before any lookup. A path listed in `pendingCommands`, or whose first segment is a key of `pending`, is UNDECIDED, not unrestricted: fail closed or skip it, and never read a path's absence from `commands` as 'no requirement'. An entry carrying `denied` is UNAVAILABLE to any AGENT-SCOPED credential — one whose `scopes` claim carries at least one `resource:action` entry; a claim that is absent, empty, capability-only or wholly unparseable is UNRESTRICTED, and this mark does not apply to it — whatever else that entry says: it is not a ceiling and it is not always-available, its `denied.reason` says why and `denied.until` names the ticket that lifts it, and the absence of `requires` on it must NEVER be read as 'no requirement'. Only an entry in `commands` with an empty `requires` means always-available.",
   "commands": {
     "login": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@datarails-ai/dr-cli",
-  "version": "1.6.99",
+  "version": "1.6.101",
   "description": "Datarails CLI",
   "type": "module",
   "engines": {