@factorialco/fcode-cli 2.2.0 → 2.3.0

package/README.md

@@ -20,7 +20,7 @@ $ npm install -g @factorialco/fcode-cli
 $ fcode COMMAND
 running command...
 $ fcode (--version)
-@factorialco/fcode-cli/2.2.0 linux-x64 node-v22.22.3
+@factorialco/fcode-cli/2.3.0 linux-x64 node-v22.22.3
 $ fcode --help [COMMAND]
 USAGE
   $ fcode COMMAND

package/dist/commands/clone.js

@@ -7,6 +7,7 @@ const path = require("node:path");
 const global_1 = require("../config/global");
 const workspace_1 = require("../config/workspace");
 const pull_1 = require("./pull");
+const team_access_1 = require("../services/team-access");
 const types_1 = require("../core/types");
 const cli_1 = require("../utils/cli");
 const settings_1 = require("../config/settings");
@@ -120,6 +121,7 @@ class Clone extends core_1.Command {
         });
     }
     async catch(error) {
+        process.exitCode = 1;
         const suggestions = error?.suggestions ?? [];
         const hint = suggestions.length > 0 ? ` Try this: ${suggestions.map((suggestion) => `'${suggestion}'`).join('\n')} \n` : '';
         cli_1.default.error(error.message + hint);
@@ -180,8 +182,19 @@ class Clone extends core_1.Command {
         if (skipSkillsSetup === undefined) {
             skipSkillsSetup = (await new global_1.default().getSetting(settings_1.SettingKeys.SKIP_SKILLS_SETUP)) === 'true';
         }
+        // Pre-flight access check so a session without access to the team fails here,
+        // before any workspace directory, config, or skills are created.
+        await team_access_1.default.ensureTeamAccess(url, slug);
         await this.cloneTeam({ url, slug }, skipSkillsSetup);
-        cli_1.default.log(`\n🎉  ${args.team} team workspace cloned successfully!\n`);
+        // Failed pulls don't abort the clone: each sub-pull reports through
+        // BaseCommand.catch, which prints and sets a non-zero exit code.
+        if (process.exitCode) {
+            cli_1.default.log(`\n⚠️  '${args.team}' team workspace cloned with errors — some resources failed to pull.`);
+            cli_1.default.log(`   Fix the errors above, then run 'fcode pull' inside the workspace.\n`);
+        }
+        else {
+            cli_1.default.log(`\n🎉  ${args.team} team workspace cloned successfully!\n`);
+        }
         cli_1.default.log(`$ cd ${slug}\n`);
     }
 }

package/dist/core/commands/api-client-command.d.ts

@@ -3,4 +3,5 @@ import FcodeGraphQLClient from '../../services/fcode-graphql-client';
 export default abstract class ApiClientCommand extends BaseCommand {
     _fcodeGraphQLClient: FcodeGraphQLClient;
     init(): Promise<void>;
+    protected onSessionRefreshed(): Promise<void>;
 }

package/dist/core/commands/api-client-command.js

@@ -26,5 +26,10 @@ class ApiClientCommand extends base_command_1.default {
             throw error;
         }
     }
+    async onSessionRefreshed() {
+        const { url } = await this.workspaceConfig.getTeamOrigin();
+        const { token: { access_token: accessToken }, } = await this.globalConfig.getAuthInfo(url);
+        this._fcodeGraphQLClient.setAccessToken(accessToken);
+    }
 }
 exports.default = ApiClientCommand;

package/dist/core/commands/base-command.d.ts

@@ -5,7 +5,9 @@ export default abstract class BaseCommand extends Command {
     url?: string;
     globalConfig: GlobalConfig;
     workspaceConfig: WorkspaceConfig;
+    private sessionRefreshRetried;
     catch(error: any): Promise<any>;
     init(url?: string): Promise<void>;
+    protected onSessionRefreshed(): Promise<void>;
     protected logActiveTeam(): Promise<void>;
 }

package/dist/core/commands/base-command.js

@@ -4,16 +4,42 @@ const core_1 = require("@oclif/core");
 const global_1 = require("../../config/global");
 const workspace_1 = require("../../config/workspace");
 const color_1 = require("@oclif/color");
+const auth_service_1 = require("../../services/auth-service");
 const errors_1 = require("../errors");
 const cli_1 = require("../../utils/cli");
 const url_utils_1 = require("../../utils/url-utils");
 class BaseCommand extends core_1.Command {
+    constructor() {
+        super(...arguments);
+        this.sessionRefreshRetried = false;
+    }
     async catch(error) {
         // do any extra work with error
         if (error && error.response && error.response.status === 401) {
+            process.exitCode = 1;
             cli_1.default.error(`User authentication is invalid for current team.`);
             return;
         }
+        if (error && error.response && error.response.status === 403) {
+            let origin;
+            try {
+                origin = await this.workspaceConfig.getTeamOrigin();
+            }
+            catch {
+                // No workspace context; report without the slug.
+            }
+            // A 403 with a valid session usually means the token's team groups went
+            // stale — they are snapshotted at issuance (FCT-61231). Re-mint the token
+            // and retry the command once; a second denial falls through to the error.
+            if (!this.sessionRefreshRetried && origin && (await auth_service_1.default.refreshSession(origin.url))) {
+                this.sessionRefreshRetried = true;
+                await this.onSessionRefreshed();
+                return this.run().catch((retryError) => this.catch(retryError));
+            }
+            process.exitCode = 1;
+            cli_1.default.error((0, errors_1.teamAccessDeniedMessage)(origin?.slug));
+            return;
+        }
         if (error instanceof errors_1.NotAuthenticated) {
             let errorMessage = 'No session active. Logging you in';
             const loginArgs = [];
@@ -40,9 +66,11 @@ class BaseCommand extends core_1.Command {
             return this.run();
         }
         if (error instanceof errors_1.CLIError) {
+            process.exitCode = 1;
             cli_1.default.error(error);
             return;
         }
+        process.exitCode = 1;
         cli_1.default.error(error.message);
     }
     async init(url) {
@@ -53,6 +81,9 @@ class BaseCommand extends core_1.Command {
         const { authUrl } = await this.globalConfig.getAuthInfo(workspaceUrl);
         await this.config.runHook('auth', { argv: [workspaceUrl, authUrl], id: 'init' });
     }
+    // Called after a 403-triggered session refresh, before the retry: rewire
+    // anything that captured the old access token. API commands override this.
+    async onSessionRefreshed() { }
     async logActiveTeam() {
         const { slug, url } = await this.workspaceConfig.getTeamOrigin();
         cli_1.default.log(color_1.default.magenta(`💻 Working on Factorial Code team '${slug}${url !== global_1.FCODE_CLOUD_URL ? ` (${url})` : ''}'.`));

package/dist/core/errors.d.ts

@@ -47,6 +47,10 @@ export declare class NotAuthenticated extends CLIError {
     constructor(url: string);
     getUrl(): string;
 }
+export declare function teamAccessDeniedMessage(slug?: string): string;
+export declare class TeamAccessDenied extends CLIError {
+    constructor(slug?: string);
+}
 export declare class NotFcodeWorkspace extends CLIError {
     constructor();
 }

package/dist/core/errors.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ErrorExecutingProcess = exports.ProcessDependenciesNotInstalled = exports.DependenciesNotInstalled = exports.NotFcodeWorkspace = exports.NotAuthenticated = exports.CloudProgrammingLanguageManifestNotFound = exports.LocalProgrammingLanguageManifestNotFound = exports.CloudLocaleNotFound = exports.LocalLocaleNotFound = exports.CloudVariableNotFound = exports.LocalVariableNotFound = exports.CloudScriptLibraryNotFound = exports.LocalScriptLibraryNotFound = exports.CloudProcessNotFound = exports.LocalProcessNotFound = exports.ResourceNotFound = exports.CLIError = void 0;
+exports.ErrorExecutingProcess = exports.ProcessDependenciesNotInstalled = exports.DependenciesNotInstalled = exports.NotFcodeWorkspace = exports.TeamAccessDenied = exports.NotAuthenticated = exports.CloudProgrammingLanguageManifestNotFound = exports.LocalProgrammingLanguageManifestNotFound = exports.CloudLocaleNotFound = exports.LocalLocaleNotFound = exports.CloudVariableNotFound = exports.LocalVariableNotFound = exports.CloudScriptLibraryNotFound = exports.LocalScriptLibraryNotFound = exports.CloudProcessNotFound = exports.LocalProcessNotFound = exports.ResourceNotFound = exports.CLIError = void 0;
+exports.teamAccessDeniedMessage = teamAccessDeniedMessage;
 const global_1 = require("../config/global");
 class CLIError extends Error {
     constructor(message, options) {
@@ -120,6 +121,20 @@ class NotAuthenticated extends CLIError {
     }
 }
 exports.NotAuthenticated = NotAuthenticated;
+function teamAccessDeniedMessage(slug) {
+    const team = slug ? ` '${slug}'` : '';
+    return (`You don't have access to team${team} with your current session.` +
+        ` If you were granted access recently, run 'fcode logout' and 'fcode login' and retry.`);
+}
+class TeamAccessDenied extends CLIError {
+    constructor(slug) {
+        super(teamAccessDeniedMessage(slug), {
+            code: 'ERR_TEAM_ACCESS_DENIED',
+            exit: 1,
+        });
+    }
+}
+exports.TeamAccessDenied = TeamAccessDenied;
 class NotFcodeWorkspace extends CLIError {
     constructor() {
         super('⚠️  Current directory is not a Factorial Code workspace.', {

package/dist/core/types.js

@@ -214,7 +214,9 @@ class Team extends Resource {
         const payload = {
             zoneId: this.zoneId || null,
             errorHandlerConfig: this.errorHandlerConfig || null,
-            parentTeamSlugs: [...(this.parentTeamSlugs || [])].sort(),
+            // Kept in the given order, not sorted: the order is the inheritance precedence, so a pure
+            // reorder is a real change that must be detected and pushed.
+            parentTeamSlugs: [...(this.parentTeamSlugs || [])],
         };
         // Inserted only when set, so every team.json that predates webhook auth keeps the
         // hash already stored in .fcode and does not report a phantom conflict. A key present

package/dist/services/auth-service.d.ts

@@ -8,6 +8,7 @@ declare const AuthService: {
     isAuthenticated(url: string): Promise<boolean>;
     isTokenExpiring(token: Token): boolean;
     refreshToken(authUrl: string, refreshToken: string): Promise<Token>;
+    refreshSession(url: string): Promise<boolean>;
     tryRefresh(url: string, { authUrl, token, userInfo }: AuthInfo): Promise<boolean>;
     login({ url, authUrl, email, password, clientId, clientSecret, accessToken }: Credentials): Promise<AuthInfo>;
     logout(url: string): Promise<void>;

package/dist/services/auth-service.js

@@ -117,6 +117,18 @@ const AuthService = {
         }
         throw token.error_description;
     },
+    // Force a re-mint of the access token regardless of expiry. Team groups are
+    // snapshotted into the token at issuance, so a token created before a team
+    // existed (or before the user joined it) 403s on it until re-minted (FCT-61231).
+    async refreshSession(url) {
+        try {
+            const authInfo = await this.globalConfig.getAuthInfo(url);
+            return await this.tryRefresh(url, authInfo);
+        }
+        catch {
+            return false;
+        }
+    },
     async tryRefresh(url, { authUrl, token, userInfo }) {
         if (!token.refresh_token) {
             return false;

package/dist/services/fcode-graphql-client.d.ts

@@ -10,6 +10,7 @@ declare class FcodeGraphQLClient {
     private teamSlug;
     private url;
     constructor(options: FcodeGraphQLClientOptions);
+    setAccessToken(accessToken: string): void;
     isDuplicatedError(error: any): boolean;
     isEmptyValueError(error: any): boolean;
     cleanError(error: any): any;
@@ -63,6 +64,7 @@ declare class FcodeGraphQLClient {
     /** The API upserts: an existing alias with the same name is re-pointed to the tag. */
     createTeamVersionAlias(name: string, tag: string): Promise<TeamVersionAlias>;
     deleteTeamVersionAlias(id: string): Promise<TeamVersionAlias>;
+    verifyTeamAccess(): Promise<void>;
     team(): Promise<RawTeamSettings>;
     pushTeam(update: TeamUpdateInput): Promise<RawTeamSettings>;
     mapProgrammingLanguageManifest(programmingLanguageManifest: any): ProgrammingLanguageManifest;

package/dist/services/fcode-graphql-client.js

@@ -90,6 +90,11 @@ class FcodeGraphQLClient {
             },
         });
     }
+    // Swap the bearer token on the live client (after a session refresh) so every
+    // holder of this instance — repositories, pushers, queries — uses the new one.
+    setAccessToken(accessToken) {
+        this.client.setHeader('authorization', `Bearer ${accessToken}`);
+    }
     isDuplicatedError(error) {
         return (error &&
             error.response &&
@@ -345,7 +350,10 @@ class FcodeGraphQLClient {
         catch (error) {
             return Promise.reject(this.cleanError(error));
         }
-        const merged = (0, locale_merger_1.mergeInheritedLocales)(locales);
+        // The cloud team's parent order is the inheritance precedence the merge must replicate; the
+        // local team.json may lag behind it, so the cloud is asked, not the file.
+        const { parentTeamSlugs } = await this.team();
+        const merged = (0, locale_merger_1.mergeInheritedLocales)(locales, parentTeamSlugs ?? []);
         (0, locale_merger_1.assertLocaleFilesCanCoexist)(merged);
         return merged;
     }
@@ -860,6 +868,23 @@ class FcodeGraphQLClient {
             return Promise.reject(this.cleanError(error));
         });
     }
+    // Cheapest team-scoped query, used as a pre-flight access check so commands can
+    // fail once with a clear error before touching local state, instead of erroring
+    // on every resource pull.
+    verifyTeamAccess() {
+        return this.client
+            .request((0, graphql_request_1.gql) `
+          query team($slug: ID!) {
+            team(slug: $slug) {
+              slug
+            }
+          }
+        `, { slug: this.teamSlug })
+            .then(() => undefined)
+            .catch((error) => {
+            return Promise.reject(this.cleanError(error));
+        });
+    }
     team() {
         return this.client
             .request((0, graphql_request_1.gql) `

package/dist/services/locale-merger.d.ts

@@ -11,7 +11,7 @@ import { Locale } from '../core/types';
  * several parents define is rewritten, as a flat mapping of dotted keys, which is the shape the
  * lookup uses anyway and the one shape where a nested and a dotted key cannot disagree.
  */
-export declare function mergeInheritedLocales(locales: Array<Locale>): Array<Locale>;
+export declare function mergeInheritedLocales(locales: Array<Locale>, parentTeamSlugs: Array<string>): Array<Locale>;
 /**
  * Locale identifiers are case-sensitive on the platform (pt-BR and pt-br are different locales),
  * but the filesystems macOS and Windows usually run on are not — both identifiers would collapse

package/dist/services/locale-merger.js

@@ -22,34 +22,37 @@ const locale_resolver_1 = require("./locale-resolver");
  * several parents define is rewritten, as a flat mapping of dotted keys, which is the shape the
  * lookup uses anyway and the one shape where a nested and a dotted key cannot disagree.
  */
-function mergeInheritedLocales(locales) {
+function mergeInheritedLocales(locales, parentTeamSlugs) {
     const inheritedByIdentifier = new Map();
     for (const locale of locales.filter((locale) => locale.resolvingTeamSlug)) {
         inheritedByIdentifier.set(locale.locale, [...(inheritedByIdentifier.get(locale.locale) ?? []), locale]);
     }
     return [
         ...locales.filter((locale) => !locale.resolvingTeamSlug),
-        ...[...inheritedByIdentifier.values()].map((files) => (files.length === 1 ? files[0] : mergeLocaleFiles(files))),
+        ...[...inheritedByIdentifier.values()].map((files) => files.length === 1 ? files[0] : mergeLocaleFiles(files, parentTeamSlugs)),
     ];
 }
 /**
- * The platform walks parents sorted by their slug — `Team.parentTeamIdsInResolutionOrder` — and
- * the first defining a key wins. Deriving that order here, rather than trusting the order the API
- * happened to list the rows in (which follows the listing's `orderBy`, `updatedAt` by default),
- * is what keeps a local run and the cloud resolving the same text.
+ * The platform walks parents in the team's configured order — `Team.parentTeamIdsInResolutionOrder`
+ * — and the first defining a key wins. Deriving that order here from the cloud team's
+ * `parentTeamSlugs`, rather than trusting the order the API happened to list the rows in (which
+ * follows the listing's `orderBy`, `updatedAt` by default), is what keeps a local run and the
+ * cloud resolving the same text.
  */
-function inResolutionOrder(files) {
-    return [...files].sort((a, b) => {
-        const [aSlug, bSlug] = [a.resolvingTeamSlug ?? '', b.resolvingTeamSlug ?? ''];
-        return aSlug < bSlug ? -1 : (aSlug > bSlug ? 1 : 0);
-    });
+function inResolutionOrder(files, parentTeamSlugs) {
+    const precedence = (file) => {
+        const index = parentTeamSlugs.indexOf(file.resolvingTeamSlug ?? '');
+        return index === -1 ? parentTeamSlugs.length : index;
+    };
+    return [...files].sort((a, b) => precedence(a) - precedence(b));
 }
 /**
  * @param files the same locale as every parent workspace defines it, in any order
+ * @param parentTeamSlugs the workspace's parents in inheritance-precedence order
  * @returns one locale carrying their merged translations, attributed to the winning parent
  */
-function mergeLocaleFiles(files) {
-    const ordered = inResolutionOrder(files);
+function mergeLocaleFiles(files, parentTeamSlugs) {
+    const ordered = inResolutionOrder(files, parentTeamSlugs);
     const [winner] = ordered;
     const translations = {};
     // Lowest precedence first, so the first parent in resolution order is the text that survives —

package/dist/services/team-access.d.ts

@@ -0,0 +1,13 @@
+import FcodeGraphQLClient from './fcode-graphql-client';
+import GlobalConfig from '../config/global';
+declare const TeamAccessService: {
+    globalConfig: GlobalConfig;
+    clientFactory: (options: {
+        url: string;
+        accessToken: string;
+        teamSlug: string;
+    }) => FcodeGraphQLClient;
+    ensureTeamAccess(url: string, slug: string): Promise<void>;
+    checkAccess(url: string, slug: string): Promise<void>;
+};
+export default TeamAccessService;

package/dist/services/team-access.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const auth_service_1 = require("./auth-service");
+const fcode_graphql_client_1 = require("./fcode-graphql-client");
+const global_1 = require("../config/global");
+const errors_1 = require("../core/errors");
+function is403(error) {
+    return error?.response?.status === 403;
+}
+const TeamAccessService = {
+    globalConfig: new global_1.default(),
+    clientFactory: (options) => new fcode_graphql_client_1.default(options),
+    // Pre-flight check that the current session can access the team, run before any
+    // local state is touched so a denied session fails once with a clear error
+    // instead of erroring on every resource pull. A 403 may just mean the token
+    // predates the team: groups are snapshotted into the token at issuance
+    // (FCT-61231), so re-mint it through the refresh grant and retry once.
+    async ensureTeamAccess(url, slug) {
+        try {
+            await this.checkAccess(url, slug);
+        }
+        catch (error) {
+            if (!is403(error)) {
+                throw error;
+            }
+            if (!(await auth_service_1.default.refreshSession(url))) {
+                throw new errors_1.TeamAccessDenied(slug);
+            }
+            try {
+                await this.checkAccess(url, slug);
+            }
+            catch (retryError) {
+                if (is403(retryError)) {
+                    throw new errors_1.TeamAccessDenied(slug);
+                }
+                throw retryError;
+            }
+        }
+    },
+    async checkAccess(url, slug) {
+        const { token } = await this.globalConfig.getAuthInfo(url);
+        await this.clientFactory({ url, accessToken: token.access_token, teamSlug: slug }).verifyTeamAccess();
+    },
+};
+exports.default = TeamAccessService;

package/oclif.manifest.json

@@ -2163,5 +2163,5 @@
       ]
     }
   },
-  "version": "2.2.0"
+  "version": "2.3.0"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@factorialco/fcode-cli",
-  "version": "2.2.0",
+  "version": "2.3.0",
   "packageManager": "pnpm@11.7.0",
   "description": "Factorial Code Command Line Interface",
   "homepage": "https://code.factorialhr.com/docs/cli/",