@levr-one/cli 0.1.1 → 0.2.0

package/README.md

@@ -12,7 +12,19 @@ npm install -g @levr-one/cli    # global install for daily use
 npx @levr-one/cli --help
 ```
 
-The package is self-contained — no peer setup required.
+The package is self-contained — no peer setup required. A global install
+replaces the `levr` bin from the deprecated `@levr-one/setup` package.
+
+## Get started
+
+```bash
+npx @levr-one/cli init    # authenticate and list your workspaces
+```
+
+`levr init` is the first-run onboarding command: it logs you in (browser
+PKCE by default, `--device-code` for SSH/headless) and lists the workspaces
+you can push to. Re-running it reuses your stored session — it never
+re-opens the browser unnecessarily.
 
 ### Shell completion (optional)
 
@@ -149,13 +161,13 @@ withEnv(["LEVR_TOKEN=${LEVR_TOKEN}"]) {
 
 All configuration is via environment variables. Flags take precedence.
 
-| Variable        | Description                                                                             | Default                 |
-| --------------- | --------------------------------------------------------------------------------------- | ----------------------- |
-| `LEVR_TOKEN`    | Personal Access Token (for CI / headless)                                               |                         |
-| `LEVR_URL`      | API base URL                                                                            | `https://api.levr.one`  |
-| `LEVR_AUTH_URL` | Auth server URL                                                                         | `https://auth.levr.one` |
-| `LEVR_TEAM_ID`  | Default team ID (optional; server resolves from automation source or workspace default) |                         |
-| `LEVR_SOURCE`   | Automation source name override (groups imports, remembers team)                        |                         |
+| Variable        | Description                                                                             | Default                |
+| --------------- | --------------------------------------------------------------------------------------- | ---------------------- |
+| `LEVR_TOKEN`    | Personal Access Token (for CI / headless)                                               |                        |
+| `LEVR_URL`      | API base URL (`--url` flag > `LEVR_URL` > URL stored at login > default)                | `https://api.levr.one` |
+| `LEVR_AUTH_URL` | Auth server URL for the browser login page (derived from the API URL when unset)        | derived                |
+| `LEVR_TEAM_ID`  | Default team ID (optional; server resolves from automation source or workspace default) |                        |
+| `LEVR_SOURCE`   | Automation source name override (groups imports, remembers team)                        |                        |
 
 ## Troubleshooting
 

package/dist/cli.js

@@ -52,6 +52,45 @@ function buildContext(process$1) {
 	};
 }
 
+//#endregion
+//#region src/commands/init.ts
+const initCommand = buildCommand({
+	docs: {
+		brief: "First-run setup: authenticate and list your workspaces",
+		fullDescription: `Set up the Levr CLI: authenticate (if needed) and list your workspaces.
+
+Reuses an existing session when one is stored — running init again never
+re-opens the browser unnecessarily. For headless environments (SSH,
+containers), use --device-code.
+
+Examples:
+  npx @levr-one/cli init          # First-run onboarding
+  levr init --device-code         # Headless/SSH onboarding
+  levr init --url <api-url>       # Target a non-default API server`
+	},
+	parameters: {
+		flags: {
+			"device-code": {
+				kind: "boolean",
+				default: false,
+				brief: "Use device code flow (for SSH/headless environments)"
+			},
+			url: {
+				kind: "parsed",
+				parse: String,
+				brief: "API base URL (default: https://api.levr.one)",
+				placeholder: "url",
+				optional: true
+			}
+		},
+		aliases: { d: "device-code" }
+	},
+	loader: async () => {
+		const { initHandler } = await import("./initHandler-JN92u8td.js");
+		return initHandler;
+	}
+});
+
 //#endregion
 //#region src/commands/auth/login.ts
 const loginCommand = buildCommand({
@@ -68,15 +107,24 @@ Examples:
   levr auth login --device-code   # Device flow for SSH/headless`
 	},
 	parameters: {
-		flags: { "device-code": {
-			kind: "boolean",
-			default: false,
-			brief: "Use device code flow (for SSH/headless environments)"
-		} },
+		flags: {
+			"device-code": {
+				kind: "boolean",
+				default: false,
+				brief: "Use device code flow (for SSH/headless environments)"
+			},
+			url: {
+				kind: "parsed",
+				parse: String,
+				brief: "API base URL (default: https://api.levr.one)",
+				placeholder: "url",
+				optional: true
+			}
+		},
 		aliases: { d: "device-code" }
 	},
 	loader: async () => {
-		const { loginHandler } = await import("./loginHandler-BnokItPo.js");
+		const { loginHandler } = await import("./loginHandler-uZCrwdcR.js");
 		return loginHandler;
 	}
 });
@@ -95,7 +143,7 @@ Examples:
 	},
 	parameters: {},
 	loader: async () => {
-		const { logoutHandler } = await import("./logoutHandler-C3X9rqLP.js");
+		const { logoutHandler } = await import("./logoutHandler-jWPGhzls.js");
 		return logoutHandler;
 	}
 });
@@ -115,7 +163,7 @@ Examples:
 	},
 	parameters: {},
 	loader: async () => {
-		const { statusHandler } = await import("./statusHandler-LfrSN4uh.js");
+		const { statusHandler } = await import("./statusHandler-D6YAxhoN.js");
 		return statusHandler;
 	}
 });
@@ -226,7 +274,7 @@ Examples:
 		}
 	},
 	loader: async () => {
-		const { pushHandler } = await import("./pushHandler-C3DteESD.js");
+		const { pushHandler } = await import("./pushHandler-DG96IOVd.js");
 		return pushHandler;
 	}
 });
@@ -247,7 +295,7 @@ Examples:
 	},
 	parameters: {},
 	loader: async () => {
-		const { listHandler } = await import("./listHandler-gfnJbj60.js");
+		const { listHandler } = await import("./listHandler-5L3YE52T.js");
 		return listHandler;
 	}
 });
@@ -280,7 +328,7 @@ Examples:
 		flags: {}
 	},
 	loader: async () => {
-		const { selectHandler } = await import("./selectHandler-BjM4LKYW.js");
+		const { selectHandler } = await import("./selectHandler-CkIbO2qH.js");
 		return selectHandler;
 	}
 });
@@ -297,19 +345,20 @@ Examples:
 	},
 	parameters: {},
 	loader: async () => {
-		const { currentHandler } = await import("./currentHandler-DpWIqCBm.js");
+		const { currentHandler } = await import("./currentHandler-Dzg819Np.js");
 		return currentHandler;
 	}
 });
 
 //#endregion
 //#region package.json
-var version = "0.1.1";
+var version = "0.2.0";
 
 //#endregion
 //#region src/app.ts
 const routes = buildRouteMap({
 	routes: {
+		init: initCommand,
 		auth: buildRouteMap({
 			routes: {
 				login: loginCommand,

package/dist/{currentHandler-DpWIqCBm.js → currentHandler-Dzg819Np.js}

@@ -1,4 +1,4 @@
-import { loadWorkspace } from "./workspace-store-4hfvsEHS.js";
+import { loadWorkspace } from "./workspace-store-BcyMJAht.js";
 
 //#region src/commands/workspace/currentHandler.ts
 function currentHandler() {

package/dist/env-hpzB56ay.js

@@ -0,0 +1,102 @@
+import { mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+
+//#region src/auth/credentials.ts
+const CREDENTIALS_PATH = join(join(homedir(), ".config", "levr"), "credentials.json");
+function readCredentials() {
+	try {
+		const raw = readFileSync(CREDENTIALS_PATH, "utf8");
+		return JSON.parse(raw);
+	} catch {
+		return null;
+	}
+}
+function writeCredentials(creds) {
+	mkdirSync(dirname(CREDENTIALS_PATH), { recursive: true });
+	writeFileSync(CREDENTIALS_PATH, JSON.stringify(creds, null, 2), { mode: 384 });
+}
+function deleteCredentials() {
+	try {
+		unlinkSync(CREDENTIALS_PATH);
+		return true;
+	} catch {
+		return false;
+	}
+}
+
+//#endregion
+//#region src/utils/env.ts
+const DEFAULT_API_URL = "https://api.levr.one";
+const KNOWN_AUTH_HOSTS = {
+	"api.levr.one": "auth.levr.one",
+	"api.levr.one": "auth.levr.one"
+};
+/** OAuth client ID for the CLI (seeded in oauth_clients table) */
+const CLI_CLIENT_ID = "3";
+let sessionApiUrl;
+function setSessionApiUrl(url) {
+	sessionApiUrl = normalizeUrl(url);
+}
+function normalizeUrl(url) {
+	return url.replace(/\/+$/, "");
+}
+/**
+* Resolve the API base URL: `--url` flag > `LEVR_URL` env var > the
+* `api_url` stored in credentials at login > production default.
+*
+* The stored-credentials fallback keeps every later command (push, refresh,
+* workspace list) pointed at the environment the user actually logged into,
+* instead of silently falling back to production when the env var is no
+* longer exported in the current shell.
+*/
+function getApiUrl() {
+	if (sessionApiUrl) return sessionApiUrl;
+	const env = process.env["LEVR_URL"];
+	if (env) return normalizeUrl(env);
+	if (!getPatToken()) {
+		const stored = readCredentials()?.api_url;
+		if (stored) return normalizeUrl(stored);
+	}
+	return DEFAULT_API_URL;
+}
+/**
+* Resolve the auth-server base URL (browser PKCE consent page only):
+* `LEVR_AUTH_URL` env var > derived from the resolved API URL for known
+* Levr hosts. Unrecognized hosts (e.g. localhost dev stacks) require the
+* explicit env var — throwing beats silently opening the production login
+* page for a token exchange that can never succeed.
+*/
+function getAuthUrl() {
+	const env = process.env["LEVR_AUTH_URL"];
+	if (env) return normalizeUrl(env);
+	const apiUrl = getApiUrl();
+	const derived = deriveAuthUrl(apiUrl);
+	if (derived) return derived;
+	throw new Error(`Cannot derive the auth server URL from API URL "${apiUrl}". Set LEVR_AUTH_URL to the auth server base URL (e.g. https://auth.levr.one).`);
+}
+function deriveAuthUrl(apiUrl) {
+	let parsed;
+	try {
+		parsed = new URL(apiUrl);
+	} catch {
+		return;
+	}
+	const authHost = KNOWN_AUTH_HOSTS[parsed.host];
+	return authHost ? `${parsed.protocol}//${authHost}` : void 0;
+}
+function getTeamId(flagValue) {
+	return flagValue || process.env["LEVR_TEAM_ID"] || void 0;
+}
+function getPatToken() {
+	return process.env["LEVR_TOKEN"];
+}
+function getSourceOverride() {
+	return process.env["LEVR_SOURCE"];
+}
+function getAutomationSourceIdOverride() {
+	return process.env["LEVR_AUTOMATION_SOURCE_ID"];
+}
+
+//#endregion
+export { CLI_CLIENT_ID, deleteCredentials, getApiUrl, getAuthUrl, getAutomationSourceIdOverride, getPatToken, getSourceOverride, getTeamId, readCredentials, setSessionApiUrl, writeCredentials };

package/dist/initHandler-JN92u8td.js

@@ -0,0 +1,51 @@
+import { performLogin } from "./loginHandler-BSrs0mHq.js";
+import { setSessionApiUrl } from "./env-hpzB56ay.js";
+import { authGetSitesV1, configureClient } from "./sdk-client-BCOB2qNU.js";
+import "./workspace-store-BcyMJAht.js";
+import "./resolve-workspace-EpjKI71z.js";
+import "./token-refresh-BYu4XO3G.js";
+import { CredentialsMismatchError, resolveToken } from "./resolve-token-DizP2xRY.js";
+import { printSites } from "./listHandler-DDd6scZ8.js";
+import chalk from "chalk";
+
+//#region src/commands/initHandler.ts
+/**
+* First-run onboarding: authenticate if needed, then list workspaces.
+* Composes the existing login flow (loginHandler's performLogin) with the
+* workspace listing (listHandler's printSites) — absorbs the retired
+* @levr-one/setup flow (ENG-2361).
+*/
+async function initHandler(flags) {
+	if (flags.url) setSessionApiUrl(flags.url);
+	let auth;
+	try {
+		auth = await resolveToken();
+		this.logger.success("Already authenticated.");
+	} catch (resolveError) {
+		if (resolveError instanceof CredentialsMismatchError) this.logger.warning(resolveError.message);
+		if (!await performLogin(this, { deviceCode: flags["device-code"] })) return;
+		try {
+			auth = await resolveToken();
+		} catch (error) {
+			this.logger.error(error instanceof Error ? error.message : "Authentication failed.");
+			this.process.exitCode = 1;
+			return;
+		}
+	}
+	if (auth.type === "pat") {
+		this.logger.info("Authenticated via LEVR_TOKEN (PAT). Workspace listing requires JWT auth — run 'levr auth login' to browse workspaces.");
+		return;
+	}
+	configureClient(auth);
+	const result = await authGetSitesV1();
+	if (result.error) {
+		this.logger.error("Failed to list workspaces.");
+		this.process.exitCode = 1;
+		return;
+	}
+	printSites(this, result.data.sites);
+	this.process.stdout.write(`Next: ${chalk.cyan("'levr workspace select <id>'")} to pick a workspace, then ${chalk.cyan("'levr push <file>'")} to upload results.\n`);
+}
+
+//#endregion
+export { initHandler };

package/dist/listHandler-5L3YE52T.js

@@ -0,0 +1,8 @@
+import "./env-hpzB56ay.js";
+import "./sdk-client-BCOB2qNU.js";
+import "./workspace-store-BcyMJAht.js";
+import "./token-refresh-BYu4XO3G.js";
+import "./resolve-token-DizP2xRY.js";
+import { listHandler, printSites } from "./listHandler-DDd6scZ8.js";
+
+export { listHandler };

package/dist/listHandler-DDd6scZ8.js

@@ -0,0 +1,49 @@
+import { authGetSitesV1, configureClient } from "./sdk-client-BCOB2qNU.js";
+import { loadWorkspace } from "./workspace-store-BcyMJAht.js";
+import { resolveToken } from "./resolve-token-DizP2xRY.js";
+
+//#region src/commands/workspace/listHandler.ts
+async function listHandler() {
+	let auth;
+	try {
+		auth = await resolveToken();
+	} catch (err) {
+		this.logger.error(err instanceof Error ? err.message : "Not authenticated. Run 'levr auth login' first.");
+		this.process.exitCode = 1;
+		return;
+	}
+	if (auth.type === "pat") {
+		this.logger.error("Workspace listing requires JWT auth. Run 'levr auth login'.");
+		this.process.exitCode = 1;
+		return;
+	}
+	configureClient(auth);
+	const result = await authGetSitesV1();
+	if (result.error) {
+		this.logger.error("Failed to list workspaces.");
+		this.process.exitCode = 1;
+		return;
+	}
+	const data = result.data;
+	printSites(this, data.sites);
+}
+/**
+* Print the workspace list with the current-workspace indicator. Shared
+* with `levr init` (ENG-2361).
+*/
+function printSites(ctx, sites) {
+	if (sites.length === 0) {
+		ctx.logger.info("No workspaces available.");
+		return;
+	}
+	const currentWs = loadWorkspace();
+	ctx.process.stdout.write("\nWorkspaces:\n\n");
+	for (const site of sites) {
+		const indicator = site.workspace_id === currentWs ? " *" : "";
+		ctx.process.stdout.write(`  ${site.workspace_name} (${site.workspace_id}) [${site.role}]${indicator}\n`);
+	}
+	ctx.process.stdout.write("\n");
+}
+
+//#endregion
+export { listHandler, printSites };

package/dist/{loginHandler-BnokItPo.js → loginHandler-BSrs0mHq.js}

@@ -1,7 +1,6 @@
-import { CLI_CLIENT_ID, getApiUrl, getAuthUrl, writeCredentials } from "./credentials-Ciq9mA7N.js";
-import { configureClient } from "./sdk-client-rpUEykDw.js";
-import "./workspace-store-4hfvsEHS.js";
-import { autoSelectWorkspace } from "./resolve-workspace-BPMkU_SK.js";
+import { CLI_CLIENT_ID, getApiUrl, getAuthUrl, setSessionApiUrl, writeCredentials } from "./env-hpzB56ay.js";
+import { configureClient } from "./sdk-client-BCOB2qNU.js";
+import { autoSelectWorkspace } from "./resolve-workspace-EpjKI71z.js";
 import chalk from "chalk";
 import { createHash, randomBytes } from "node:crypto";
 import { createServer } from "node:http";
@@ -166,14 +165,19 @@ function sleep(ms) {
 */
 async function requestDeviceCode() {
 	const apiUrl = getApiUrl();
-	const res = await fetch(`${apiUrl}/v1/oauth/device/authorize`, {
-		method: "POST",
-		headers: { "Content-Type": "application/x-www-form-urlencoded" },
-		body: new URLSearchParams({
-			client_id: CLI_CLIENT_ID,
-			scope: "read:own write:own"
-		})
-	});
+	let res;
+	try {
+		res = await fetch(`${apiUrl}/v1/oauth/device/authorize`, {
+			method: "POST",
+			headers: { "Content-Type": "application/x-www-form-urlencoded" },
+			body: new URLSearchParams({
+				client_id: CLI_CLIENT_ID,
+				scope: "read:own write:own"
+			})
+		});
+	} catch {
+		throw new Error(`Could not reach ${apiUrl} — check the URL and your network connection.`);
+	}
 	if (!res.ok) {
 		const body = await res.text();
 		throw new Error(`Failed to request device code (${res.status}): ${body}`);
@@ -223,15 +227,31 @@ function formatCountdown(ms) {
 	return `${Math.floor(totalSec / 60)}:${(totalSec % 60).toString().padStart(2, "0")}`;
 }
 async function loginHandler(flags) {
-	if (flags["device-code"]) {
-		await deviceCodeLogin(this);
-		return;
-	}
-	await pkceLogin(this);
+	await performLogin(this, {
+		deviceCode: flags["device-code"],
+		url: flags.url
+	});
+}
+/**
+* Run the login flow (PKCE or device code). Reusable outside the Stricli
+* handler (levr init composes it). Returns true on success; on failure the
+* error has been printed and `exitCode` set.
+*/
+async function performLogin(ctx, options) {
+	if (options.url) setSessionApiUrl(options.url);
+	if (options.deviceCode) return deviceCodeLogin(ctx);
+	return pkceLogin(ctx);
 }
 async function pkceLogin(ctx) {
 	const apiUrl = getApiUrl();
-	const authUrl = getAuthUrl();
+	let authUrl;
+	try {
+		authUrl = getAuthUrl();
+	} catch (err) {
+		ctx.logger.error(err instanceof Error ? err.message : "Invalid auth server configuration.");
+		ctx.process.exitCode = 1;
+		return false;
+	}
 	const codeVerifier = generateCodeVerifier();
 	const codeChallenge = generateCodeChallenge(codeVerifier);
 	const state = randomBytes(16).toString("hex");
@@ -240,7 +260,7 @@ async function pkceLogin(ctx) {
 		expectedState: state
 	});
 	const redirectUri = `http://127.0.0.1:${await portPromise}/callback`;
-	const authorizeUrl = `${authUrl}/auth/oauth/authorize?${new URLSearchParams({
+	const params = new URLSearchParams({
 		response_type: "code",
 		client_id: CLI_CLIENT_ID,
 		redirect_uri: redirectUri,
@@ -248,7 +268,8 @@ async function pkceLogin(ctx) {
 		code_challenge_method: "S256",
 		scope: "read:own write:own",
 		state
-	}).toString()}`;
+	});
+	const authorizeUrl = `${authUrl}/auth/oauth/authorize?${params.toString()}`;
 	ctx.process.stdout.write("Opening browser to authenticate...\n\n");
 	ctx.process.stdout.write(`  If the browser doesn't open, visit:\n  ${chalk.cyan(authorizeUrl)}\n\n`);
 	try {
@@ -270,7 +291,7 @@ async function pkceLogin(ctx) {
 		ctx.process.stdout.write("\n");
 		ctx.logger.error(err instanceof Error ? err.message : "Authentication failed.");
 		ctx.process.exitCode = 1;
-		return;
+		return false;
 	}
 	clearInterval(countdownTimer);
 	try {
@@ -289,11 +310,12 @@ async function pkceLogin(ctx) {
 			const errBody = await tokenRes.text();
 			throw new Error(`Token exchange failed (${tokenRes.status}): ${errBody}`);
 		}
-		await saveTokensAndFinish(ctx, await tokenRes.json());
+		return await saveTokensAndFinish(ctx, await tokenRes.json());
 	} catch (err) {
 		ctx.process.stdout.write("\n");
 		ctx.logger.error(err instanceof Error ? err.message : "Token exchange failed.");
 		ctx.process.exitCode = 1;
+		return false;
 	}
 }
 async function deviceCodeLogin(ctx) {
@@ -319,11 +341,12 @@ async function deviceCodeLogin(ctx) {
 			throw err;
 		}
 		clearInterval(deviceTimer);
-		await saveTokensAndFinish(ctx, tokenData);
+		return await saveTokensAndFinish(ctx, tokenData);
 	} catch (err) {
 		ctx.process.stdout.write("\n");
 		ctx.logger.error(err instanceof Error ? err.message : "Device flow failed.");
 		ctx.process.exitCode = 1;
+		return false;
 	}
 }
 async function saveTokensAndFinish(ctx, tokenData) {
@@ -337,7 +360,7 @@ async function saveTokensAndFinish(ctx, tokenData) {
 		ctx.process.stdout.write("\n");
 		ctx.logger.error("Token response missing user data.");
 		ctx.process.exitCode = 1;
-		return;
+		return false;
 	}
 	writeCredentials({
 		version: 1,
@@ -357,7 +380,8 @@ async function saveTokensAndFinish(ctx, tokenData) {
 	const wsResult = await autoSelectWorkspace();
 	if (wsResult.kind === "single") ctx.process.stdout.write(`Workspace: ${chalk.bold(wsResult.workspaceName)}\n`);
 	else if (wsResult.kind === "multiple") ctx.process.stdout.write(`\n${wsResult.count} workspaces available. Run ${chalk.cyan("'levr workspace list'")} to see them.\n`);
+	return true;
 }
 
 //#endregion
-export { loginHandler };
+export { loginHandler, performLogin };

package/dist/loginHandler-uZCrwdcR.js

@@ -0,0 +1,7 @@
+import { loginHandler, performLogin } from "./loginHandler-BSrs0mHq.js";
+import "./env-hpzB56ay.js";
+import "./sdk-client-BCOB2qNU.js";
+import "./workspace-store-BcyMJAht.js";
+import "./resolve-workspace-EpjKI71z.js";
+
+export { loginHandler };

package/dist/{logoutHandler-C3X9rqLP.js → logoutHandler-jWPGhzls.js}

@@ -1,5 +1,5 @@
-import { deleteCredentials, getPatToken } from "./credentials-Ciq9mA7N.js";
-import { clearWorkspace } from "./workspace-store-4hfvsEHS.js";
+import { deleteCredentials, getPatToken } from "./env-hpzB56ay.js";
+import { clearWorkspace } from "./workspace-store-BcyMJAht.js";
 
 //#region src/commands/auth/logoutHandler.ts
 function logoutHandler() {

package/dist/{pushHandler-C3DteESD.js → pushHandler-DG96IOVd.js}

@@ -1,9 +1,9 @@
-import { getApiUrl, getAutomationSourceIdOverride, getSourceOverride, getTeamId } from "./credentials-Ciq9mA7N.js";
-import { client, configureClient, uploadAutomationIngest, uploadImport } from "./sdk-client-rpUEykDw.js";
-import "./workspace-store-4hfvsEHS.js";
-import { resolveWorkspace } from "./resolve-workspace-BPMkU_SK.js";
-import "./token-refresh-Pl6Adngb.js";
-import { resolveToken } from "./resolve-token-CQU55U6J.js";
+import { getApiUrl, getAutomationSourceIdOverride, getSourceOverride, getTeamId } from "./env-hpzB56ay.js";
+import { client, configureClient, uploadAutomationIngest, uploadImport } from "./sdk-client-BCOB2qNU.js";
+import "./workspace-store-BcyMJAht.js";
+import { resolveWorkspace } from "./resolve-workspace-EpjKI71z.js";
+import "./token-refresh-BYu4XO3G.js";
+import { resolveToken } from "./resolve-token-DizP2xRY.js";
 import { readFileSync, statSync } from "node:fs";
 import { basename } from "node:path";
 import ora from "ora";

package/dist/resolve-token-DizP2xRY.js

@@ -0,0 +1,48 @@
+import { getApiUrl, getPatToken, readCredentials } from "./env-hpzB56ay.js";
+import { isTokenExpired, refreshToken } from "./token-refresh-BYu4XO3G.js";
+
+//#region src/auth/resolve-token.ts
+/**
+* Stored credentials exist but were issued by a different server than the
+* one this command targets (`--url`/`LEVR_URL`). Callers that can recover
+* (e.g. `levr init` re-logging-in against the new target) match on this
+* class instead of string-sniffing the message.
+*/
+var CredentialsMismatchError = class extends Error {
+	constructor(storedUrl, activeUrl) {
+		super(`Stored credentials are for ${storedUrl}, but this command targets ${activeUrl}. Run 'levr auth login' to authenticate against this server.`);
+		this.name = "CredentialsMismatchError";
+	}
+};
+/**
+* Resolve auth token in priority order:
+* 1. LEVR_TOKEN env var (PAT) — long-lived, no refresh
+* 2. Stored credentials (JWT) — auto-refresh if expired
+* 3. Error — not authenticated
+*/
+async function resolveToken() {
+	const pat = getPatToken();
+	if (pat) return {
+		token: pat,
+		type: "pat"
+	};
+	let creds = readCredentials();
+	if (creds) {
+		const activeUrl = getApiUrl();
+		const storedUrl = creds.api_url.replace(/\/+$/, "");
+		if (storedUrl !== activeUrl) throw new CredentialsMismatchError(storedUrl, activeUrl);
+		if (isTokenExpired(creds)) {
+			const refreshed = await refreshToken(creds);
+			if (!refreshed) throw new Error("Token expired and refresh failed. Run 'levr auth login' to re-authenticate.");
+			creds = refreshed;
+		}
+		return {
+			token: creds.access_token,
+			type: "jwt"
+		};
+	}
+	throw new Error("Not authenticated. Run 'levr auth login' or set LEVR_TOKEN environment variable.");
+}
+
+//#endregion
+export { CredentialsMismatchError, resolveToken };

package/dist/{resolve-workspace-BPMkU_SK.js → resolve-workspace-EpjKI71z.js}

@@ -1,5 +1,5 @@
-import { authGetSitesV1 } from "./sdk-client-rpUEykDw.js";
-import { clearWorkspace, loadWorkspace, saveWorkspace } from "./workspace-store-4hfvsEHS.js";
+import { authGetSitesV1 } from "./sdk-client-BCOB2qNU.js";
+import { clearWorkspace, loadWorkspace, saveWorkspace } from "./workspace-store-BcyMJAht.js";
 
 //#region src/workspace/resolve-workspace.ts
 async function fetchSites() {

package/dist/{sdk-client-rpUEykDw.js → sdk-client-BCOB2qNU.js}

@@ -1,4 +1,4 @@
-import { getApiUrl } from "./credentials-Ciq9mA7N.js";
+import { getApiUrl } from "./env-hpzB56ay.js";
 import { z } from "zod/v3";
 
 //#region ../sdk/dist/gen/_common/zod.js

package/dist/{selectHandler-BjM4LKYW.js → selectHandler-CkIbO2qH.js}

@@ -1,8 +1,8 @@
-import "./credentials-Ciq9mA7N.js";
-import { authGetSitesV1, configureClient } from "./sdk-client-rpUEykDw.js";
-import { saveWorkspace } from "./workspace-store-4hfvsEHS.js";
-import "./token-refresh-Pl6Adngb.js";
-import { resolveToken } from "./resolve-token-CQU55U6J.js";
+import "./env-hpzB56ay.js";
+import { authGetSitesV1, configureClient } from "./sdk-client-BCOB2qNU.js";
+import { saveWorkspace } from "./workspace-store-BcyMJAht.js";
+import "./token-refresh-BYu4XO3G.js";
+import { resolveToken } from "./resolve-token-DizP2xRY.js";
 
 //#region src/commands/workspace/selectHandler.ts
 async function selectHandler(_flags, workspaceId) {

package/dist/{statusHandler-LfrSN4uh.js → statusHandler-D6YAxhoN.js}

@@ -1,6 +1,6 @@
-import { getApiUrl, getPatToken, readCredentials } from "./credentials-Ciq9mA7N.js";
-import { authGetProfileV1, configureClient } from "./sdk-client-rpUEykDw.js";
-import { isTokenExpired } from "./token-refresh-Pl6Adngb.js";
+import { getApiUrl, getPatToken, readCredentials } from "./env-hpzB56ay.js";
+import { authGetProfileV1, configureClient } from "./sdk-client-BCOB2qNU.js";
+import { isTokenExpired } from "./token-refresh-BYu4XO3G.js";
 import chalk from "chalk";
 
 //#region src/commands/auth/statusHandler.ts
@@ -23,6 +23,12 @@ async function statusHandler() {
 		this.process.exitCode = 1;
 		return;
 	}
+	const storedUrl = creds.api_url.replace(/\/+$/, "");
+	if (storedUrl !== apiUrl) {
+		this.process.stdout.write(`${chalk.red("error")} Stored credentials are for ${storedUrl}, but the current target is ${apiUrl}. Run 'levr auth login' to authenticate against this server.\n`);
+		this.process.exitCode = 1;
+		return;
+	}
 	if (isTokenExpired(creds)) {
 		this.process.stdout.write(`${chalk.red("error")} Token expired. Run 'levr auth login' to re-authenticate.\n`);
 		this.process.exitCode = 1;

package/dist/{token-refresh-Pl6Adngb.js → token-refresh-BYu4XO3G.js}

@@ -1,4 +1,4 @@
-import { CLI_CLIENT_ID, deleteCredentials, getApiUrl, writeCredentials } from "./credentials-Ciq9mA7N.js";
+import { CLI_CLIENT_ID, deleteCredentials, getApiUrl, writeCredentials } from "./env-hpzB56ay.js";
 
 //#region src/auth/token-refresh.ts
 const REFRESH_BUFFER_MS = 300 * 1e3;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@levr-one/cli",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "The command-line interface for Levr",
   "type": "module",
   "license": "MIT",

package/dist/credentials-Ciq9mA7N.js

@@ -1,54 +0,0 @@
-import { mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { dirname, join } from "node:path";
-
-//#region src/utils/env.ts
-const DEFAULT_API_URL = "https://api.levr.one";
-const DEFAULT_AUTH_URL = "https://auth.levr.one";
-/** OAuth client ID for the CLI (seeded in oauth_clients table) */
-const CLI_CLIENT_ID = "3";
-function getApiUrl() {
-	return process.env["LEVR_URL"] || DEFAULT_API_URL;
-}
-function getAuthUrl() {
-	return process.env["LEVR_AUTH_URL"] || DEFAULT_AUTH_URL;
-}
-function getTeamId(flagValue) {
-	return flagValue || process.env["LEVR_TEAM_ID"] || void 0;
-}
-function getPatToken() {
-	return process.env["LEVR_TOKEN"];
-}
-function getSourceOverride() {
-	return process.env["LEVR_SOURCE"];
-}
-function getAutomationSourceIdOverride() {
-	return process.env["LEVR_AUTOMATION_SOURCE_ID"];
-}
-
-//#endregion
-//#region src/auth/credentials.ts
-const CREDENTIALS_PATH = join(join(homedir(), ".config", "levr"), "credentials.json");
-function readCredentials() {
-	try {
-		const raw = readFileSync(CREDENTIALS_PATH, "utf8");
-		return JSON.parse(raw);
-	} catch {
-		return null;
-	}
-}
-function writeCredentials(creds) {
-	mkdirSync(dirname(CREDENTIALS_PATH), { recursive: true });
-	writeFileSync(CREDENTIALS_PATH, JSON.stringify(creds, null, 2), { mode: 384 });
-}
-function deleteCredentials() {
-	try {
-		unlinkSync(CREDENTIALS_PATH);
-		return true;
-	} catch {
-		return false;
-	}
-}
-
-//#endregion
-export { CLI_CLIENT_ID, deleteCredentials, getApiUrl, getAuthUrl, getAutomationSourceIdOverride, getPatToken, getSourceOverride, getTeamId, readCredentials, writeCredentials };

package/dist/listHandler-gfnJbj60.js

@@ -1,44 +0,0 @@
-import "./credentials-Ciq9mA7N.js";
-import { authGetSitesV1, configureClient } from "./sdk-client-rpUEykDw.js";
-import { loadWorkspace } from "./workspace-store-4hfvsEHS.js";
-import "./token-refresh-Pl6Adngb.js";
-import { resolveToken } from "./resolve-token-CQU55U6J.js";
-
-//#region src/commands/workspace/listHandler.ts
-async function listHandler() {
-	let auth;
-	try {
-		auth = await resolveToken();
-	} catch {
-		this.logger.error("Not authenticated. Run 'levr auth login' first.");
-		this.process.exitCode = 1;
-		return;
-	}
-	if (auth.type === "pat") {
-		this.logger.error("Workspace listing requires JWT auth. Run 'levr auth login'.");
-		this.process.exitCode = 1;
-		return;
-	}
-	configureClient(auth);
-	const result = await authGetSitesV1();
-	if (result.error) {
-		this.logger.error("Failed to list workspaces.");
-		this.process.exitCode = 1;
-		return;
-	}
-	const sites = result.data.sites;
-	if (sites.length === 0) {
-		this.logger.info("No workspaces available.");
-		return;
-	}
-	const currentWs = loadWorkspace();
-	this.process.stdout.write("\nWorkspaces:\n\n");
-	for (const site of sites) {
-		const indicator = site.workspace_id === currentWs ? " *" : "";
-		this.process.stdout.write(`  ${site.workspace_name} (${site.workspace_id}) [${site.role}]${indicator}\n`);
-	}
-	this.process.stdout.write("\n");
-}
-
-//#endregion
-export { listHandler };

package/dist/resolve-token-CQU55U6J.js

@@ -1,33 +0,0 @@
-import { getPatToken, readCredentials } from "./credentials-Ciq9mA7N.js";
-import { isTokenExpired, refreshToken } from "./token-refresh-Pl6Adngb.js";
-
-//#region src/auth/resolve-token.ts
-/**
-* Resolve auth token in priority order:
-* 1. LEVR_TOKEN env var (PAT) — long-lived, no refresh
-* 2. Stored credentials (JWT) — auto-refresh if expired
-* 3. Error — not authenticated
-*/
-async function resolveToken() {
-	const pat = getPatToken();
-	if (pat) return {
-		token: pat,
-		type: "pat"
-	};
-	let creds = readCredentials();
-	if (creds) {
-		if (isTokenExpired(creds)) {
-			const refreshed = await refreshToken(creds);
-			if (!refreshed) throw new Error("Token expired and refresh failed. Run 'levr auth login' to re-authenticate.");
-			creds = refreshed;
-		}
-		return {
-			token: creds.access_token,
-			type: "jwt"
-		};
-	}
-	throw new Error("Not authenticated. Run 'levr auth login' or set LEVR_TOKEN environment variable.");
-}
-
-//#endregion
-export { resolveToken };