@loxtep/sdk 0.9.7 → 0.9.8

package/CHANGELOG.md

@@ -8,6 +8,15 @@ and this project adheres to
 
 ## [Unreleased]
 
+## [0.9.8] - 2026-08-11
+
+### Changed
+
+- **CLI browser login** opens `/auth/cli` instead of `/auth/mcp`. The app mints a
+  dedicated CLI session (`CLISESS#`) via `/app/auth/delegate-session`, so web SPA
+  token refresh no longer revokes CLI credentials. Re-run `loxtep login` once
+  after the platform deploy that ships this change.
+
 ## [0.9.7] - 2026-08-10
 
 ### Added

package/dist/auth/browser-login.d.ts

@@ -7,9 +7,9 @@
  *
  * Flow:
  * 1. Start a local HTTP server on a random port
- * 2. Open browser to https://app.loxtep.io/auth/mcp?callback_url=http://localhost:{port}/callback
+ * 2. Open browser to https://app.loxtep.io/auth/cli?callback_url=http://localhost:{port}/callback
  * 3. User logs in (Cognito SRP + MFA if needed) in the browser
- * 4. App redirects to our localhost callback with access_token + refresh_token
+ * 4. App mints a CLI-scoped session and redirects to our localhost callback with tokens
  * 5. Return tokens to caller, shut down server
  */
 import { type Server } from 'node:http';

package/dist/auth/browser-login.js

@@ -7,9 +7,9 @@
  *
  * Flow:
  * 1. Start a local HTTP server on a random port
- * 2. Open browser to https://app.loxtep.io/auth/mcp?callback_url=http://localhost:{port}/callback
+ * 2. Open browser to https://app.loxtep.io/auth/cli?callback_url=http://localhost:{port}/callback
  * 3. User logs in (Cognito SRP + MFA if needed) in the browser
- * 4. App redirects to our localhost callback with access_token + refresh_token
+ * 4. App mints a CLI-scoped session and redirects to our localhost callback with tokens
  * 5. Return tokens to caller, shut down server
  */
 import { createServer } from 'node:http';
@@ -113,7 +113,7 @@ export function browserLogin(options) {
             const port = addr.port;
             on_listening?.(port);
             const callbackUrl = `http://localhost:${port}/callback`;
-            const loginUrl = `${app_url.replace(/\/$/, '')}/auth/mcp?callback_url=${encodeURIComponent(callbackUrl)}`;
+            const loginUrl = `${app_url.replace(/\/$/, '')}/auth/cli?callback_url=${encodeURIComponent(callbackUrl)}`;
             if (no_open) {
                 console.log(`\nOpen this URL in your browser to log in:\n\n  ${loginUrl}\n`);
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@loxtep/sdk",
-  "version": "0.9.7",
+  "version": "0.9.8",
   "description": "Loxtep SDK for Node.js — the Enterprise Context Layer: data products, workflows, projects, queues, and machine-usable context for AI",
   "author": "Loxtep <engineering@loxtep.io>",
   "homepage": "https://loxtep.io",