@levr-one/cli 0.12.10 → 0.12.11

package/dist/{addHandler-CD1pda0z.js → addHandler-CJOweVZf.js}

@@ -1,7 +1,7 @@
 import { configureClient } from "./sdk-client-CSy2LOEh.js";
-import "./token-refresh-DEmYbJ8V.js";
+import "./token-refresh-cvAydkok.js";
 import { getApiUrl } from "./env-Cv-anxJA.js";
-import { resolveToken } from "./resolve-token-D1zteEfm.js";
+import { resolveToken } from "./resolve-token-BeX-Xegl.js";
 import "./workspace-store-BJyB_WEG.js";
 import { fetchSites } from "./resolve-workspace-CJN1plpd.js";
 import { describeWorkspaces, findWorkspaceByKeyOrName, isScopedMcpUrl, resolveMcpUrl, scopedMcpUrl, servedBySessionApi } from "./find-workspace-IWolSyrf.js";

package/dist/{appendHandler-BYOoCNXJ.js → appendHandler-mYa2KKNC.js}

@@ -1,10 +1,10 @@
 import { appendActualResult } from "./sdk-client-CSy2LOEh.js";
-import "./token-refresh-DEmYbJ8V.js";
+import "./token-refresh-cvAydkok.js";
 import "./env-Cv-anxJA.js";
-import "./resolve-token-D1zteEfm.js";
+import "./resolve-token-BeX-Xegl.js";
 import "./workspace-store-BJyB_WEG.js";
 import "./resolve-workspace-CJN1plpd.js";
-import { connect } from "./connect-A5VSJUv5.js";
+import { connect } from "./connect-B_Bva8BM.js";
 import "./sleep-DNLj0FMk.js";
 import { embedMarkdown, parseTarget, uploadArtifactFile } from "./artifact-upload-t6kL20b5.js";
 import { readFileSync } from "node:fs";

package/dist/{attachHandler-Ojk7mc2E.js → attachHandler-DFlDUObZ.js}

@@ -1,10 +1,10 @@
 import { appendActualResult, createComment } from "./sdk-client-CSy2LOEh.js";
-import "./token-refresh-DEmYbJ8V.js";
+import "./token-refresh-cvAydkok.js";
 import "./env-Cv-anxJA.js";
-import "./resolve-token-D1zteEfm.js";
+import "./resolve-token-BeX-Xegl.js";
 import "./workspace-store-BJyB_WEG.js";
 import "./resolve-workspace-CJN1plpd.js";
-import { connect } from "./connect-A5VSJUv5.js";
+import { connect } from "./connect-B_Bva8BM.js";
 import "./sleep-DNLj0FMk.js";
 import { TargetParseError, embedMarkdown, parseTarget, uploadArtifactFile } from "./artifact-upload-t6kL20b5.js";
 import { readFileSync } from "node:fs";

package/dist/{bindingsHandler-Dxx2LIci.js → bindingsHandler-BR_vk1eC.js}

@@ -1,8 +1,8 @@
 import "./gate-op-BINrIT2l.js";
 import { client, configureClient } from "./sdk-client-CSy2LOEh.js";
-import "./token-refresh-DEmYbJ8V.js";
+import "./token-refresh-cvAydkok.js";
 import "./env-Cv-anxJA.js";
-import { resolveToken } from "./resolve-token-D1zteEfm.js";
+import { resolveToken } from "./resolve-token-BeX-Xegl.js";
 import "./workspace-store-BJyB_WEG.js";
 import { resolveWorkspaceFor } from "./resolve-workspace-CJN1plpd.js";
 import { z } from "zod";

package/dist/cli.js

@@ -226,7 +226,7 @@ Examples:
 		aliases: { y: "yes" }
 	},
 	loader: async () => {
-		const { mcpAddHandler } = await import("./addHandler-CD1pda0z.js");
+		const { mcpAddHandler } = await import("./addHandler-CJOweVZf.js");
 		return mcpAddHandler;
 	}
 });
@@ -314,7 +314,7 @@ Examples:
 	},
 	parameters: {},
 	loader: async () => {
-		const { statusHandler } = await import("./statusHandler-ByTUMdKK.js");
+		const { statusHandler } = await import("./statusHandler-BgQTktJm.js");
 		return statusHandler;
 	}
 });
@@ -443,7 +443,7 @@ levr attach --manifest or later uploads.`
 		}
 	},
 	loader: async () => {
-		const { pushHandler } = await import("./pushHandler-BkCmzQz7.js");
+		const { pushHandler } = await import("./pushHandler-D02XXrQZ.js");
 		return pushHandler;
 	}
 });
@@ -563,7 +563,7 @@ Examples:
 		}
 	},
 	loader: async () => {
-		const { importHandler } = await import("./importHandler-86cjc2Zs.js");
+		const { importHandler } = await import("./importHandler-t4UNZ-tS.js");
 		return importHandler;
 	}
 });
@@ -584,7 +584,7 @@ Examples:
 	},
 	parameters: {},
 	loader: async () => {
-		const { listHandler } = await import("./listHandler-BoCzGUDK.js");
+		const { listHandler } = await import("./listHandler-D-W39_YC.js");
 		return listHandler;
 	}
 });
@@ -622,7 +622,7 @@ Examples:
 		flags: {}
 	},
 	loader: async () => {
-		const { selectHandler } = await import("./selectHandler-Dp74pefc.js");
+		const { selectHandler } = await import("./selectHandler-9pNaEvpf.js");
 		return selectHandler;
 	}
 });
@@ -688,7 +688,7 @@ Examples:
 		}
 	},
 	loader: async () => {
-		const { gatesBindingsExportHandler } = await import("./bindingsHandler-Dxx2LIci.js");
+		const { gatesBindingsExportHandler } = await import("./bindingsHandler-BR_vk1eC.js");
 		return gatesBindingsExportHandler;
 	}
 });
@@ -761,7 +761,7 @@ Examples:
 		aliases: { w: "workspace-id" }
 	},
 	loader: async () => {
-		const { gatesBindingsImportHandler } = await import("./bindingsHandler-Dxx2LIci.js");
+		const { gatesBindingsImportHandler } = await import("./bindingsHandler-BR_vk1eC.js");
 		return gatesBindingsImportHandler;
 	}
 });
@@ -1052,7 +1052,7 @@ Examples:
 		}
 	},
 	loader: async () => {
-		const { gatesRunHandler } = await import("./runHandler-BLkPzImG.js");
+		const { gatesRunHandler } = await import("./runHandler-DMJO--tc.js");
 		return gatesRunHandler;
 	}
 });
@@ -1165,7 +1165,7 @@ Examples:
 		}
 	},
 	loader: async () => {
-		const { attachHandler } = await import("./attachHandler-Ojk7mc2E.js");
+		const { attachHandler } = await import("./attachHandler-DFlDUObZ.js");
 		return attachHandler;
 	}
 });
@@ -1241,14 +1241,14 @@ Examples:
 		}
 	},
 	loader: async () => {
-		const { resultAppendHandler } = await import("./appendHandler-BYOoCNXJ.js");
+		const { resultAppendHandler } = await import("./appendHandler-mYa2KKNC.js");
 		return resultAppendHandler;
 	}
 });
 
 //#endregion
 //#region package.json
-var version = "0.12.10";
+var version = "0.12.11";
 
 //#endregion
 //#region src/app.ts

package/dist/{connect-A5VSJUv5.js → connect-B_Bva8BM.js}

@@ -1,5 +1,5 @@
 import { client, configureClient } from "./sdk-client-CSy2LOEh.js";
-import { resolveToken } from "./resolve-token-D1zteEfm.js";
+import { resolveToken } from "./resolve-token-BeX-Xegl.js";
 import { resolveWorkspaceFor } from "./resolve-workspace-CJN1plpd.js";
 
 //#region src/utils/connect.ts

package/dist/{importHandler-86cjc2Zs.js → importHandler-t4UNZ-tS.js}

@@ -1,7 +1,7 @@
 import { authGetProfileV1, client, configureClient } from "./sdk-client-CSy2LOEh.js";
-import "./token-refresh-DEmYbJ8V.js";
+import "./token-refresh-cvAydkok.js";
 import { getApiUrl, getTeamId } from "./env-Cv-anxJA.js";
-import { resolveToken } from "./resolve-token-D1zteEfm.js";
+import { resolveToken } from "./resolve-token-BeX-Xegl.js";
 import "./workspace-store-BJyB_WEG.js";
 import { resolveWorkspaceFor } from "./resolve-workspace-CJN1plpd.js";
 import chalk from "chalk";

package/dist/{listHandler-BoCzGUDK.js → listHandler-D-W39_YC.js}

@@ -1,7 +1,7 @@
 import { authGetSitesV1, configureClient } from "./sdk-client-CSy2LOEh.js";
-import "./token-refresh-DEmYbJ8V.js";
+import "./token-refresh-cvAydkok.js";
 import "./env-Cv-anxJA.js";
-import { resolveToken } from "./resolve-token-D1zteEfm.js";
+import { resolveToken } from "./resolve-token-BeX-Xegl.js";
 import { loadWorkspace } from "./workspace-store-BJyB_WEG.js";
 
 //#region src/commands/workspace/listHandler.ts

package/dist/{pushHandler-BkCmzQz7.js → pushHandler-D02XXrQZ.js}

@@ -1,7 +1,7 @@
 import { client, configureClient, uploadImport } from "./sdk-client-CSy2LOEh.js";
-import "./token-refresh-DEmYbJ8V.js";
+import "./token-refresh-cvAydkok.js";
 import { getApiUrl, getAutomationSourceIdOverride, getSourceOverride, getTeamId } from "./env-Cv-anxJA.js";
-import { resolveToken } from "./resolve-token-D1zteEfm.js";
+import { resolveToken } from "./resolve-token-BeX-Xegl.js";
 import "./workspace-store-BJyB_WEG.js";
 import { resolveWorkspaceFor } from "./resolve-workspace-CJN1plpd.js";
 import "./sleep-DNLj0FMk.js";

package/dist/{resolve-token-D1zteEfm.js → resolve-token-BeX-Xegl.js}

@@ -1,4 +1,4 @@
-import { classifyToken, isTokenExpired, refreshToken } from "./token-refresh-DEmYbJ8V.js";
+import { classifyToken, isTokenExpired, refreshToken } from "./token-refresh-cvAydkok.js";
 import { getApiUrl, getPatToken, readCredentials } from "./env-Cv-anxJA.js";
 
 //#region src/auth/resolve-token.ts

package/dist/{runHandler-BLkPzImG.js → runHandler-DMJO--tc.js}

@@ -1,9 +1,9 @@
 import "./gate-op-BINrIT2l.js";
 import { executeInspect } from "./inspect-CinRBSv6.js";
 import { client, configureClient } from "./sdk-client-CSy2LOEh.js";
-import "./token-refresh-DEmYbJ8V.js";
+import "./token-refresh-cvAydkok.js";
 import "./env-Cv-anxJA.js";
-import { resolveToken } from "./resolve-token-D1zteEfm.js";
+import { resolveToken } from "./resolve-token-BeX-Xegl.js";
 import "./workspace-store-BJyB_WEG.js";
 import { resolveWorkspaceFor } from "./resolve-workspace-CJN1plpd.js";
 import { existsSync } from "node:fs";

package/dist/{selectHandler-Dp74pefc.js → selectHandler-9pNaEvpf.js}

@@ -1,7 +1,7 @@
 import { authGetSitesV1, configureClient } from "./sdk-client-CSy2LOEh.js";
-import "./token-refresh-DEmYbJ8V.js";
+import "./token-refresh-cvAydkok.js";
 import "./env-Cv-anxJA.js";
-import { resolveToken } from "./resolve-token-D1zteEfm.js";
+import { resolveToken } from "./resolve-token-BeX-Xegl.js";
 import { saveWorkspace } from "./workspace-store-BJyB_WEG.js";
 
 //#region src/commands/workspace/selectHandler.ts
@@ -9,8 +9,8 @@ async function selectHandler(_flags, workspaceId) {
 	let auth;
 	try {
 		auth = await resolveToken();
-	} catch {
-		this.logger.error("Not authenticated. Run 'levr auth login' first.");
+	} catch (err) {
+		this.logger.error(err instanceof Error ? err.message : "Not authenticated. Run 'levr auth login' first.");
 		this.process.exitCode = 1;
 		return;
 	}

package/dist/{statusHandler-ByTUMdKK.js → statusHandler-BgQTktJm.js}

@@ -1,5 +1,5 @@
 import { authGetProfileV1, configureClient } from "./sdk-client-CSy2LOEh.js";
-import { classifyToken, isTokenExpired } from "./token-refresh-DEmYbJ8V.js";
+import { classifyToken, isTokenExpired } from "./token-refresh-cvAydkok.js";
 import { getApiUrl, getPatToken, readCredentials } from "./env-Cv-anxJA.js";
 import chalk from "chalk";
 

package/dist/token-refresh-cvAydkok.js

@@ -0,0 +1,116 @@
+import { CLI_CLIENT_ID, deleteCredentials, getApiUrl, readCredentials, writeCredentials } from "./env-Cv-anxJA.js";
+
+//#region src/auth/token-shape.ts
+/**
+* Classify a bearer token by its SHAPE — [issue:ENG-6068].
+*
+* The server decides how to verify a token by looking at the token, not at
+* where it came from (`isPersonalAccessToken` in the backend's auth
+* middleware): a Levr personal access token starts with `tq_`, and anything
+* else is handed to the JWT verifier. `LEVR_TOKEN` carries either kind — a
+* PAT minted in Settings, or an OAuth access token a device-code login
+* printed for CI — so the CLI must apply the same rule. Until ENG-6068 every
+* `LEVR_TOKEN` was called a PAT, and the JWT-only steps (resolving
+* `--workspace-id` / `LEVR_WORKSPACE_ID`, `levr workspace list|select`) were
+* silently skipped for an OAuth token, which has no workspace of its own.
+*
+* Leaf module on purpose: no imports, so `resolve-token`, the handlers and
+* their tests can all read it without pulling in credentials or the SDK.
+*/
+const PAT_PREFIX = "tq_";
+/** `tq_…` is a personal access token; everything else is treated as a JWT. */
+function classifyToken(token) {
+	return token.startsWith(PAT_PREFIX) ? "pat" : "jwt";
+}
+
+//#endregion
+//#region src/auth/token-refresh.ts
+const REFRESH_BUFFER_MS = 300 * 1e3;
+/**
+* Check if stored JWT credentials are expired (or within 5 min of expiry).
+*/
+function isTokenExpired(creds) {
+	const expiresAt = new Date(creds.expires_at).getTime();
+	return Date.now() >= expiresAt - REFRESH_BUFFER_MS;
+}
+/**
+* Refresh JWT credentials using the stored refresh token.
+*
+* Returns the updated credentials, or `null` only when the server REFUSED
+* the refresh token itself (400/401 `invalid_grant`): those credentials are
+* dead and are deleted, and the caller asks for `levr auth login`. Every
+* other failure (a 5xx, a 429, another error code, a proxy's HTML page, an
+* older backend's 400, a network error, an unusable success body) THROWS and
+* keeps the stored credentials, so the next command retries: deleting them
+* signed the user out on any backend hiccup (ENG-7829). Same rule as the web
+* client (`apps/client/app/services/tokenRefresh.ts`), including its
+* compare-before-clear: a refusal of a token another process already
+* rotated returns the newer stored pair.
+*/
+async function refreshToken(creds) {
+	const apiUrl = getApiUrl();
+	let res;
+	try {
+		res = await fetch(`${apiUrl}/v1/oauth/token`, {
+			method: "POST",
+			headers: { "Content-Type": "application/x-www-form-urlencoded" },
+			body: new URLSearchParams({
+				grant_type: "refresh_token",
+				refresh_token: creds.refresh_token,
+				client_id: CLI_CLIENT_ID
+			})
+		});
+	} catch (error) {
+		throw transientFailure(`network error: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	if (!res.ok) {
+		if (await isRefusal(res)) {
+			const stored = readCredentials();
+			if (stored && stored.refresh_token !== creds.refresh_token) return sameServer(stored, creds.api_url) ? stored : null;
+			deleteCredentials();
+			return null;
+		}
+		throw transientFailure(`HTTP ${res.status}`);
+	}
+	const data = await readTokenResponse(res);
+	if (!data) throw transientFailure("unusable response");
+	const updated = {
+		...creds,
+		access_token: data.access_token,
+		refresh_token: data.refresh_token,
+		expires_at: new Date(Date.now() + data.expires_in * 1e3).toISOString()
+	};
+	writeCredentials(updated);
+	return updated;
+}
+function sameServer(stored, apiUrl) {
+	return stored.api_url.replace(/\/+$/, "") === apiUrl.replace(/\/+$/, "");
+}
+function transientFailure(reason) {
+	return /* @__PURE__ */ new Error(`Token refresh failed (${reason}). Your login is kept; try again, or run 'levr auth login' if it keeps failing.`);
+}
+/** The server refused the refresh token itself: a 400/401 `invalid_grant`. */
+async function isRefusal(res) {
+	if (res.status !== 400 && res.status !== 401) return false;
+	try {
+		return (await res.json())?.error === "invalid_grant";
+	} catch {
+		return false;
+	}
+}
+/**
+* The token response, or `null` when it is not one (a captive portal's 200,
+* a body missing a token): writing it would store a login that cannot be
+* refreshed.
+*/
+async function readTokenResponse(res) {
+	try {
+		const data = await res.json();
+		return typeof data?.access_token === "string" && data.access_token !== "" && typeof data.refresh_token === "string" && data.refresh_token !== "" && typeof data.expires_in === "number" && Number.isFinite(data.expires_in) ? data : null;
+	} catch {
+		return null;
+	}
+}
+
+//#endregion
+export { classifyToken, isTokenExpired, refreshToken };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@levr-one/cli",
-  "version": "0.12.10",
+  "version": "0.12.11",
   "description": "The command-line interface for Levr",
   "type": "module",
   "license": "MIT",

package/dist/token-refresh-DEmYbJ8V.js

@@ -1,72 +0,0 @@
-import { CLI_CLIENT_ID, deleteCredentials, getApiUrl, writeCredentials } from "./env-Cv-anxJA.js";
-
-//#region src/auth/token-shape.ts
-/**
-* Classify a bearer token by its SHAPE — [issue:ENG-6068].
-*
-* The server decides how to verify a token by looking at the token, not at
-* where it came from (`isPersonalAccessToken` in the backend's auth
-* middleware): a Levr personal access token starts with `tq_`, and anything
-* else is handed to the JWT verifier. `LEVR_TOKEN` carries either kind — a
-* PAT minted in Settings, or an OAuth access token a device-code login
-* printed for CI — so the CLI must apply the same rule. Until ENG-6068 every
-* `LEVR_TOKEN` was called a PAT, and the JWT-only steps (resolving
-* `--workspace-id` / `LEVR_WORKSPACE_ID`, `levr workspace list|select`) were
-* silently skipped for an OAuth token, which has no workspace of its own.
-*
-* Leaf module on purpose: no imports, so `resolve-token`, the handlers and
-* their tests can all read it without pulling in credentials or the SDK.
-*/
-const PAT_PREFIX = "tq_";
-/** `tq_…` is a personal access token; everything else is treated as a JWT. */
-function classifyToken(token) {
-	return token.startsWith(PAT_PREFIX) ? "pat" : "jwt";
-}
-
-//#endregion
-//#region src/auth/token-refresh.ts
-const REFRESH_BUFFER_MS = 300 * 1e3;
-/**
-* Check if stored JWT credentials are expired (or within 5 min of expiry).
-*/
-function isTokenExpired(creds) {
-	const expiresAt = new Date(creds.expires_at).getTime();
-	return Date.now() >= expiresAt - REFRESH_BUFFER_MS;
-}
-/**
-* Refresh JWT credentials using the stored refresh token.
-* Returns updated credentials or null if refresh failed.
-*/
-async function refreshToken(creds) {
-	const apiUrl = getApiUrl();
-	try {
-		const res = await fetch(`${apiUrl}/v1/oauth/token`, {
-			method: "POST",
-			headers: { "Content-Type": "application/x-www-form-urlencoded" },
-			body: new URLSearchParams({
-				grant_type: "refresh_token",
-				refresh_token: creds.refresh_token,
-				client_id: CLI_CLIENT_ID
-			})
-		});
-		if (!res.ok) {
-			deleteCredentials();
-			return null;
-		}
-		const data = await res.json();
-		const updated = {
-			...creds,
-			access_token: data.access_token,
-			refresh_token: data.refresh_token,
-			expires_at: new Date(Date.now() + data.expires_in * 1e3).toISOString()
-		};
-		writeCredentials(updated);
-		return updated;
-	} catch {
-		deleteCredentials();
-		return null;
-	}
-}
-
-//#endregion
-export { classifyToken, isTokenExpired, refreshToken };