@floless/app 0.9.0 → 0.9.2

package/dist/floless-server.cjs

@@ -52055,10 +52055,10 @@ function jwtExpiry(jwt) {
 var NetworkError = class extends Error {
   network = true;
 };
-async function ensureFreshToken() {
+async function resolveToken() {
   const t = readTokens();
-  if (!t) return null;
-  if (Date.now() < t.expiresAt - REFRESH_SKEW_MS) return t.accessToken;
+  if (!t) return { token: null, reason: "signed-out" };
+  if (Date.now() < t.expiresAt - REFRESH_SKEW_MS) return { token: t.accessToken };
   let res;
   try {
     res = await fetch(`${env().apiBase}/auth/refresh`, {
@@ -52070,13 +52070,16 @@ async function ensureFreshToken() {
     throw new NetworkError("refresh failed (network)");
   }
   if (res.status >= 500) throw new NetworkError(`refresh failed (${res.status})`);
-  if (!res.ok) return null;
+  if (!res.ok) return { token: null, reason: "session-expired" };
   const body = await res.json();
   const access = body.data?.tokens?.access;
   const refresh = body.data?.tokens?.refresh ?? t.refreshToken;
-  if (!access) return null;
+  if (!access) return { token: null, reason: "session-expired" };
   storeTokens({ accessToken: access, refreshToken: refresh, expiresAt: jwtExpiry(access), issuedAt: Date.now() });
-  return access;
+  return { token: access };
+}
+async function ensureFreshToken() {
+  return (await resolveToken()).token;
 }
 function mapUserStatus(u) {
   switch (u.accountType) {
@@ -52087,7 +52090,7 @@ function mapUserStatus(u) {
     case "expired_trial":
       return { state: "expired", plan: u.subscription?.tier, expiresAt: u.trial?.trialExpiresAt };
     default:
-      return { state: "unlicensed" };
+      return { state: "unlicensed", reason: "no-subscription" };
   }
 }
 function signInUrl() {
@@ -52111,27 +52114,28 @@ async function getLicenseStatus(opts = {}) {
   const url = signInUrl();
   if (seatLost) {
     mem = null;
-    return { state: "unlicensed", signInUrl: url };
+    return { state: "unlicensed", reason: "seat-taken", signInUrl: url };
   }
   if (!opts.force && mem && Date.now() - mem.at < MEM_CACHE_MS) return mem.status;
   const finish = (s) => {
     mem = { at: Date.now(), status: s };
     return s;
   };
-  let token;
+  let resolved;
   try {
-    token = await ensureFreshToken();
+    resolved = await resolveToken();
   } catch {
     return finish(offlineFallback(url));
   }
-  if (!token) return finish({ state: "unlicensed", signInUrl: url });
+  if (resolved.token === null) return finish({ state: "unlicensed", reason: resolved.reason, signInUrl: url });
+  const token = resolved.token;
   let res;
   try {
     res = await fetch(`${env().apiBase}/user/status`, { headers: { Authorization: `Bearer ${token}` } });
   } catch {
     return finish(offlineFallback(url));
   }
-  if (res.status === 401) return finish({ state: "unlicensed", signInUrl: url });
+  if (res.status === 401) return finish({ state: "unlicensed", reason: "session-expired", signInUrl: url });
   if (res.status >= 500) return finish(offlineFallback(url));
   if (!res.ok) return finish({ state: "unlicensed", signInUrl: url });
   let mapped;
@@ -52357,7 +52361,7 @@ function appVersion() {
   return resolveVersion({
     isSea: isSea2(),
     sqVersionXml: readSqVersionXml(),
-    define: true ? "0.9.0" : void 0,
+    define: true ? "0.9.2" : void 0,
     pkgVersion: readPkgVersion()
   });
 }
@@ -52367,7 +52371,7 @@ function resolveChannel(s) {
   return "dev";
 }
 function appChannel() {
-  return resolveChannel({ isSea: isSea2(), define: true ? "0.9.0" : void 0 });
+  return resolveChannel({ isSea: isSea2(), define: true ? "0.9.2" : void 0 });
 }
 
 // oauth-presets.ts
@@ -52406,13 +52410,23 @@ function managedProfileYaml(preset) {
 function oauthDir() {
   return process.env.AWARE_HOME ? (0, import_node_path6.join)(process.env.AWARE_HOME, "oauth") : (0, import_node_path6.join)((0, import_node_os6.homedir)(), ".aware", "oauth");
 }
+function isUpgradableLegacyProfile(existing, preset) {
+  if (existing.startsWith(MANAGED_HEADER)) return false;
+  const content = existing.split("\n").map((l) => l.trim()).filter((l) => l.length > 0 && !l.startsWith("#"));
+  const only = content.length === 1 ? content[0] : void 0;
+  if (only === void 0) return false;
+  const m = /^client_id\s*:\s*(.+?)\s*$/.exec(only);
+  return m !== null && m[1] === preset.clientId;
+}
 function ensureManagedProfile(id) {
   const preset = OAUTH_PRESETS[id];
   if (!preset) return "not-managed";
   const dir = oauthDir();
   const file = (0, import_node_path6.join)(dir, `${id}.yaml`);
   const existing = (0, import_node_fs7.existsSync)(file) ? (0, import_node_fs7.readFileSync)(file, "utf8") : null;
-  if (existing !== null && !existing.startsWith(MANAGED_HEADER)) return "skipped";
+  if (existing !== null && !existing.startsWith(MANAGED_HEADER) && !isUpgradableLegacyProfile(existing, preset)) {
+    return "skipped";
+  }
   const desired = managedProfileYaml(preset);
   if (existing === desired) return "unchanged";
   (0, import_node_fs7.mkdirSync)(dir, { recursive: true });
@@ -56519,9 +56533,9 @@ async function startServer() {
     req.url.startsWith("/api/report-issue") || req.url.startsWith("/api/update") || req.url.startsWith("/api/aware/update") || // Release notes are a read-only display surface for the update pills — a local control,
     // no workspace data, never spawns `aware`. Exempt like the other update routes.
     req.url.startsWith("/api/release-notes")) return;
-    const { state: state2, signInUrl: signInUrl2 } = await getLicenseStatus();
+    const { state: state2, reason, signInUrl: signInUrl2 } = await getLicenseStatus();
     if (state2 !== "valid" && state2 !== "offline-grace") {
-      return reply.status(402).send({ ok: false, error: "subscription required", state: state2, signInUrl: signInUrl2 });
+      return reply.status(402).send({ ok: false, error: "subscription required", state: state2, reason, signInUrl: signInUrl2 });
     }
   });
   app.addHook("onRequest", async (req, reply) => {

package/dist/web/aware.js

@@ -2654,7 +2654,7 @@
         reloadTimer = setTimeout(() => loadApp(currentId).catch(reportErr), 250);
       } else if (m.type === 'seat-taken') {
         // This session's seat was claimed by another device (newest-login-wins).
-        showToast('Your session was taken over on another device — sign in to continue.', 'err');
+        showToast('Signed in on another device — sign in here to continue.', 'err');
         recheckLicenseAndGate();
       }
     };
@@ -3832,10 +3832,33 @@
   // We fetch NO workspace data while ungated. The license endpoints stay open.
   function renderGate(status) {
     if (document.getElementById('license-gate')) return;
-    const expired = status.state === 'expired';
     // signInUrl is server-generated, but escape it anyway before it lands in an
     // innerHTML href — a crafted FLOLESS_WEB_BASE shouldn't be able to break out.
     const subUrl = escapeHtml(status.signInUrl || 'https://floless.io');
+    // Gate copy is driven by WHY the user is locked out. `state==='expired'` is a
+    // distinct (trial-expiry) state; every other gated case carries a `reason`.
+    // `secondary:null` omits the cross-sell link (session-expired / seat-taken).
+    // Keys must mirror the server's LicenseReason values (+ the 'expired' state);
+    // an unmapped/new reason falls back to 'signed-out' copy below.
+    const reason = status.state === 'expired' ? 'expired' : status.reason;
+    const COPY = {
+      expired: { headline: 'Your subscription has expired',
+        body: 'Renew your FloLess subscription to keep using floless.app.',
+        secondary: { label: 'Manage subscription →', href: subUrl } },
+      'no-subscription': { headline: 'Subscription required',
+        body: 'A FloLess subscription is required to use floless.app. Sign in to continue.',
+        secondary: { label: 'No subscription yet? Subscribe →', href: subUrl } },
+      'session-expired': { headline: 'Please sign in again',
+        body: 'Your sign-in has expired. Signing in takes a few seconds.',
+        secondary: null },
+      'seat-taken': { headline: 'Signed in on another device',
+        body: 'floless.app can run on one device at a time. Sign in here to use it on this device.',
+        secondary: null },
+      'signed-out': { headline: 'Sign in to continue',
+        body: 'Sign in with your FloLess account to use floless.app.',
+        secondary: { label: 'No subscription yet? Subscribe →', href: subUrl } },
+    };
+    const copy = COPY[reason] || COPY['signed-out']; // neutral fallback for an unknown/absent reason
     const style = document.createElement('style');
     style.textContent = `
       #license-gate{position:fixed;inset:0;z-index:99999;display:flex;align-items:center;justify-content:center;
@@ -3868,13 +3891,11 @@
           <path class="mark-node" d="M138.092 174.908C148.53 174.908 156.992 166.446 156.992 156.008C156.992 145.57 148.53 137.108 138.092 137.108C127.654 137.108 119.192 145.57 119.192 156.008C119.192 166.446 127.654 174.908 138.092 174.908Z" fill="white" stroke="currentColor" stroke-width="8.72093" stroke-linecap="round" stroke-linejoin="round"/>
           <path class="mark-node" d="M149.714 43.6142C160.152 43.6142 168.614 35.1523 168.614 24.7141C168.614 14.2758 160.152 5.81396 149.714 5.81396C139.276 5.81396 130.814 14.2758 130.814 24.7141C130.814 35.1523 139.276 43.6142 149.714 43.6142Z" fill="white" stroke="currentColor" stroke-width="8.72093" stroke-linecap="round" stroke-linejoin="round"/>
         </svg></div>
-        <h1>${expired ? 'Your subscription has expired' : 'Subscription required'}</h1>
-        <p>${expired
-          ? 'Renew your FloLess subscription to keep using floless.app.'
-          : 'floless.app runs on your FloLess subscription. Sign in to continue.'}</p>
+        <h1>${escapeHtml(copy.headline)}</h1>
+        <p>${escapeHtml(copy.body)}</p>
         <button id="lg-signin" class="primary">Sign in at floless.io</button>
         <p class="lg-status" id="lg-status"></p>
-        <a class="lg-sub" href="${subUrl}" target="_blank" rel="noopener">${expired ? 'Manage subscription →' : 'No subscription yet? Subscribe →'}</a>
+        ${copy.secondary ? `<a class="lg-sub" href="${copy.secondary.href}" target="_blank" rel="noopener">${escapeHtml(copy.secondary.label)}</a>` : ''}
         <p class="lg-version" id="lg-version"></p>
       </div>`;
     document.body.appendChild(wrap);
@@ -3946,7 +3967,7 @@
         } catch { /* still failing — fall through to gate */ }
       }
       if (effectivelyLicensed) bootWorkspace();
-      else renderGate(effectiveStatus || { state: 'none' });
+      else renderGate(effectiveStatus || { state: 'unlicensed' });
     };
 
     // Setup-first: if AWARE isn't ready, show the overlay and DEFER routing until it

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floless/app",
-  "version": "0.9.0",
+  "version": "0.9.2",
   "type": "module",
   "description": "Thin localhost host for floless.app — serves web/ and shells the aware CLI. No engine, no LLM.",
   "bin": {