@great-arrow/cli 0.1.68 → 0.6.5

package/dist/index.js

@@ -9373,6 +9373,52 @@ function classifyRequestFailure(error62) {
   }
   return { kind, message, hint: FAILURE_HINTS[kind] };
 }
+var DEFAULT_ORIGIN = "https://www.greatarrow.ai";
+var LEVEL_WORDS = {
+  passkey: "a passkey",
+  verified: "a verified identity"
+};
+function actionLink(url2, apiUrl) {
+  try {
+    return new URL(url2, apiUrl || DEFAULT_ORIGIN).toString();
+  } catch {
+    return url2;
+  }
+}
+function policyRefusal(body, apiUrl) {
+  let record2 = body;
+  if (typeof body === "string") {
+    try {
+      record2 = JSON.parse(body);
+    } catch {
+      return null;
+    }
+  }
+  if (typeof record2 !== "object" || record2 === null) return null;
+  let r = record2;
+  if (typeof r.error === "object" && r.error !== null) {
+    const data = r.error.data;
+    if (typeof data !== "object" || data === null) return null;
+    r = data;
+  }
+  const url2 = typeof r.actionUrl === "string" && r.actionUrl ? actionLink(r.actionUrl, apiUrl) : null;
+  if (r.error === "identity_assurance_required") {
+    const need = LEVEL_WORDS[typeof r.required === "string" ? r.required : ""] ?? "a stronger sign-in";
+    return {
+      code: r.error,
+      message: `This workspace requires ${need} on your account.`,
+      hint: url2 ? `Open ${url2} to add it, then try again.` : "Add it under Account \u2192 Security, then try again."
+    };
+  }
+  if (r.error === "owner_approval_required") {
+    return {
+      code: r.error,
+      message: typeof r.message === "string" && r.message ? r.message : "Only the workspace owner can do this.",
+      hint: url2 ? `Open ${url2} to continue.` : "Ask the workspace owner to do it, or to change it on the Access page."
+    };
+  }
+  return null;
+}
 var SERVER_CODE = /^[a-z][a-z0-9_]{0,63}$/;
 function withServerCode(error62, body) {
   try {
@@ -9437,7 +9483,7 @@ function isNodeError(value) {
 
 // src/lib/version.ts
 var CLI_PACKAGE_NAME = "@great-arrow/cli";
-var CLI_VERSION = "0.1.68";
+var CLI_VERSION = "0.6.5";
 var GAD_INSTALL_VERSION = "2026.08.08";
 var GAD_INSTALL_MIN_VERSION = "2026.06.22";
 var GAD_INSTALL_HEADER = "X-GAD-Install-Version";
@@ -11056,6 +11102,8 @@ var ERROR_ENVELOPE_KEYS = /* @__PURE__ */ new Set([
   "details",
   "error_description",
   "reauth_url",
+  "actionUrl",
+  "achieved",
   "required",
   "ok",
   "success",
@@ -11073,6 +11121,8 @@ function cleanErrorText(text3) {
 }
 function hintFrom(record2) {
   if (nonEmpty(record2.hint)) return record2.hint;
+  if (nonEmpty(record2.actionUrl))
+    return `Open ${actionLink(record2.actionUrl, process.env.GAD_API_URL)} to continue.`;
   if (nonEmpty(record2.reauth_url))
     return `Re-authorize this connection: ${record2.reauth_url}`;
   return void 0;
@@ -11700,6 +11750,13 @@ var GadClient = class {
     const status = response.status;
     const body = await response.text().catch(() => "");
     if (status === 403) {
+      const refusal2 = policyRefusal(body, this.apiUrl);
+      if (refusal2) {
+        throw withServerCode(
+          new CliError(refusal2.message, 1 /* AUTH_ERROR */, refusal2.hint),
+          JSON.stringify({ error: refusal2.code })
+        );
+      }
       throw withServerCode(
         new CliError(
           "Permission denied (HTTP 403).",
@@ -11792,6 +11849,10 @@ var GadClient = class {
           message: data.error.message
         }
       });
+      const refusal2 = policyRefusal(data, this.apiUrl);
+      if (refusal2) {
+        throw new CliError(refusal2.message, 1 /* AUTH_ERROR */, refusal2.hint);
+      }
       const code = data.error.code === -32001 ? 1 /* AUTH_ERROR */ : 2 /* NETWORK_ERROR */;
       throw new CliError(
         data.error.message,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@great-arrow/cli",
-  "version": "0.1.68",
+  "version": "0.6.5",
   "description": "GreatArrow.ai CLI tool",
   "type": "module",
   "bin": {