@fourier-labs/harbour 0.1.13-rc.1 → 0.1.13

package/dist/packages/harbour-cli/src/auth.js

@@ -78,18 +78,33 @@ export async function login(mcpUrl, tenant, output) {
         callback.close();
     }
 }
-export async function refreshStoredToken(mcpUrl, tenant, path = tokenStorePath()) {
+/** Refresh only when the access token is within this margin of expiry. */
+const REFRESH_MARGIN_MS = 5 * 60_000;
+/**
+ * Returns a usable access token, refreshing only when the stored one is about
+ * to expire. Refresh tokens are single-use, so every CLI process refreshing on
+ * start meant two processes at once (a `productionise` still polling and a
+ * `status` beside it) spent the same refresh token and one was told to sign in
+ * again. A refresh that fails now re-reads the store once: if a sibling
+ * process rotated the pair in the meantime, its newer token is used instead.
+ */
+export async function refreshStoredToken(mcpUrl, tenant, path = tokenStorePath(), now = Date.now) {
     const stored = await loadStoredToken(mcpUrl, tenant, path);
     if (!stored)
         return undefined;
     if (!stored.refreshToken)
         return stored.accessToken;
+    if (stored.accessTokenExpiresAt !== undefined && stored.accessTokenExpiresAt - REFRESH_MARGIN_MS > now())
+        return stored.accessToken;
     try {
         const refreshed = await token(stored.tokenEndpoint, { grant_type: "refresh_token", client_id: stored.clientId, refresh_token: stored.refreshToken });
         await saveStoredToken(mcpUrl, tenant, { ...stored, ...refreshed, refreshToken: refreshed.refreshToken ?? stored.refreshToken }, path);
         return refreshed.accessToken;
     }
     catch {
+        const rotated = await loadStoredToken(mcpUrl, tenant, path);
+        if (rotated && rotated.refreshToken !== stored.refreshToken && (rotated.accessTokenExpiresAt === undefined || rotated.accessTokenExpiresAt - REFRESH_MARGIN_MS > now()))
+            return rotated.accessToken;
         throw new Error("Harbour sign-in expired or was revoked. Run `harbour login` again.");
     }
 }
@@ -119,7 +134,7 @@ async function token(endpoint, values) {
     const response = await json(endpoint, { method: "POST", headers: { "content-type": "application/x-www-form-urlencoded" }, body: new URLSearchParams(values), redirect: "error" });
     if (!response.access_token)
         throw new Error("Harbour sign-in did not return an access token.");
-    return { accessToken: response.access_token, ...(response.refresh_token ? { refreshToken: response.refresh_token } : {}) };
+    return { accessToken: response.access_token, ...(response.refresh_token ? { refreshToken: response.refresh_token } : {}), ...(typeof response.expires_in === "number" && response.expires_in > 0 ? { accessTokenExpiresAt: Date.now() + response.expires_in * 1_000 } : {}) };
 }
 async function json(url, init) { const response = await fetch(url, { ...init, redirect: "error" }); if (!response.ok)
     throw new Error(`Harbour sign-in request failed (${response.status}).`); return response.json(); }

package/dist/packages/harbour-cli/src/operations.js

@@ -62,9 +62,26 @@ export async function waitForSettled(client, operationRef, output, options = {})
     const graceMs = options.noDeploymentGraceMs ?? 90_000;
     const startedAt = now();
     let lastLine = "";
+    let consecutiveFailures = 0;
     while (true) {
         const callStarted = now();
-        const status = await fetchStatus(client, operationRef, 15);
+        let status;
+        try {
+            status = await fetchStatus(client, operationRef, 15);
+            consecutiveFailures = 0;
+        }
+        catch (error) {
+            // A deployment takes minutes and one status call out of dozens can fail
+            // transiently (gateway timeout, dropped connection). The operation is
+            // unaffected by our polling, so keep watching; give up only after a run
+            // of failures, and say what the last one was instead of a generic error.
+            consecutiveFailures += 1;
+            if (consecutiveFailures >= 5)
+                throw new CliError("DEPLOYMENT_STATUS_UNAVAILABLE", `Harbour stopped answering status checks (${safeMessage(error)}). The deployment may still be running; check again with \`harbour status\`.`, operationRef);
+            output("Harbour did not answer that status check; trying again.");
+            await sleep(Math.min(15_000, 3_000 * consecutiveFailures));
+            continue;
+        }
         if (isSettled(status))
             return status;
         if (!status.deployment && !status.production) {
@@ -84,6 +101,10 @@ export async function waitForSettled(client, operationRef, output, options = {})
             await sleep(3_000 - elapsed);
     }
 }
+function safeMessage(error) {
+    const raw = error instanceof Error ? error.message : String(error);
+    return raw.replace(/https?:\/\/\S+|Bearer\s+\S+/gi, "").replace(/\s+/g, " ").trim().slice(0, 160) || "no details";
+}
 function progressLine(status) {
     if (status.production)
         return `Harbour is promoting the app to production${status.production.message ? ` (${status.production.message})` : ""}.`;

package/dist/packages/harbour-cli/src/output.js

@@ -29,8 +29,8 @@ export function renderSummary(envelope) {
         lines.push(`Next: ${result.nextStep}`);
     const setup = envelope.result?.setup;
     const secrets = setup?.secrets ?? envelope.result?.secrets;
-    if (setup) {
-        lines.push(`App name: ${setup.profile?.displayName ?? "(none)"}${setup.profile?.confirmed ? " (confirmed)" : setup.profile?.suggested?.displayName ? ` — suggested: ${setup.profile.suggested.displayName}` : " (not confirmed)"}`);
+    if (setup?.profile) {
+        lines.push(`App name: ${setup.profile.displayName ?? "(none)"}${setup.profile?.confirmed ? " (confirmed)" : setup.profile?.suggested?.displayName ? ` — suggested: ${setup.profile.suggested.displayName}` : " (not confirmed)"}`);
         if (setup.profile?.description || setup.profile?.suggested?.description)
             lines.push(`Description: ${setup.profile?.confirmed ? setup.profile.description : setup.profile?.suggested?.description ?? setup.profile?.description}`);
         if (setup.audience?.available === false)
@@ -47,9 +47,11 @@ export function renderSummary(envelope) {
             for (const ask of secrets.asks)
                 lines.push(`Secret ${ask.name}: ${ask.status === "UNSET" ? "needs a value" : ask.status === "SET" ? "set" : "not needed"}${ask.scope === "personal" ? " (personal)" : ""}${ask.prefilledFromPath ? ` (from ${ask.prefilledFromPath})` : ""}`);
     }
-    if (setup?.pending?.length)
-        lines.push(`Next: ${setup.nextAction?.plainEnglish ?? setup.pending.join(", ")}`);
-    else if (setup)
+    // productionise carries only the open steps; the setup commands carry the full view.
+    const openSteps = setup?.pending?.length ? setup.pending.map(step => step === "confirm_app_profile" ? "confirm the app's name and description" : step === "confirm_app_audience" ? "confirm who may open it" : step === "provide_secrets" ? "provide the secrets it asked for" : step) : [];
+    if (openSteps.length)
+        lines.push(`Still needed: ${openSteps.join("; ")}${envelope.result.setup?.plainEnglish && !setup?.profile ? ` — run \`harbour setup --operation ${envelope.operationRef ?? "<reference>"}\`` : ""}`);
+    else if (setup?.profile)
         lines.push("Setup complete.");
     return `${lines.join("\n")}\n`;
 }

package/dist/packages/harbour-cli/src/productionise.js

@@ -79,7 +79,18 @@ export async function productionise(rootArg, client, output, tenantId, includePa
         // The saved app is not the finished product. The same source save that the
         // console follows to "live" starts a preview deployment; follow it here so
         // the maker gets the app's real protected link, not the example one.
-        const outcome = outcomeFor(await waitForSettled(client, operationRef, output, options.waitOptions), operationRef);
+        // Past this point the app is saved and verified; a failure here is about
+        // following the deployment, not about the save, and must say so.
+        let settled;
+        try {
+            settled = await waitForSettled(client, operationRef, output, options.waitOptions);
+        }
+        catch (error) {
+            if (error instanceof CliError)
+                throw error;
+            throw new CliError("DEPLOYMENT_STATUS_UNAVAILABLE", `Harbour saved and verified the app but could not follow its deployment (${error instanceof Error ? error.message.replace(/https?:\/\/\S+|Bearer\s+\S+/gi, "").slice(0, 160) : "unknown error"}). Check again with \`harbour status\`.`, operationRef);
+        }
+        const outcome = outcomeFor(settled, operationRef);
         output(outcomeLine(outcome));
         // The console asks for the app's name, audience and secrets before it
         // offers promotion; say what is still open so a CLI-only builder knows.

package/dist/packages/harbour-cli/src/version.js

@@ -1 +1 @@
-export const CLI_VERSION = "0.1.13-rc.1";
+export const CLI_VERSION = "0.1.13";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fourier-labs/harbour",
-  "version": "0.1.13-rc.1",
+  "version": "0.1.13",
   "description": "Harbour productionisation helper",
   "type": "module",
   "bin": { "harbour": "./dist/packages/harbour-cli/src/cli.js" },