@loxtep/sdk 0.9.9 → 0.9.11

package/CHANGELOG.md

@@ -8,6 +8,28 @@ and this project adheres to
 
 ## [Unreleased]
 
+## [0.9.11] - 2026-08-12
+
+### Fixed
+
+- **`createRStreamsSdk` / stream I/O** — restore top-level
+  `createRequire(import.meta.url)` in `leo-runtime.ts`. The 0.9.7
+  `new Function('return import.meta.url')` workaround always throws
+  `SyntaxError: Cannot use 'import.meta' outside a module` (Function bodies
+  are Scripts, never Modules), breaking `get_writer()` / `get_reader()` for
+  every consumer from 0.9.7–0.9.10. Jest maps the module to a CJS-safe stub
+  (and excludes it from coverage) instead of breaking the real runtime.
+
+## [0.9.10] - 2026-08-12
+
+### Fixed
+
+- **CLI API host from credentials** — `resolveCliApiUrl` prefers credentials
+  `api_base_url` over a stale `~/.loxtep/config.json` `api_url`. Stops sending
+  a host-bound login token (e.g. apidev `CLISESS#`) to production and getting
+  `users:read` RBAC denials on `loxtep whoami`. `LOXTEP_API_URL` still wins.
+  `whoami` prints a hint when the error looks like that mismatch.
+
 ## [0.9.9] - 2026-08-11
 
 ### Changed

package/README.md

@@ -62,6 +62,33 @@ Run these in an **empty directory** you want to turn into a Loxtep workspace.
    > **CI/headless:** `pnpm exec loxtep login --email you@co.com --password …`
    > or set `LOXTEP_AUTH_TOKEN`.
 
+### Login from code (library)
+
+Use these when your app mints tokens itself (not the CLI). Library login uses
+the **`sdk_node`** session channel — separate from CLI, web, Python SDK, and MCP.
+
+```ts
+import { login, browserLogin, LoxtepClient } from '@loxtep/sdk';
+
+const apiUrl = 'https://api.loxtep.io'; // or apidev.loxtep.io
+
+// Email / password (optional mfa_code). Defaults to client_channel: 'sdk_node'.
+const tokens = await login(apiUrl, 'you@co.com', 'secret', {
+  // mfa_code: '123456',
+});
+
+// Or browser handoff → /auth/sdk?runtime=node (also sdk_node).
+// const tokens = await browserLogin({ app_url: 'https://app.loxtep.io' });
+
+const client = new LoxtepClient({
+  api_url: apiUrl,
+  auth: { type: 'jwt', token: tokens.access_token },
+});
+```
+
+Refresh with `refresh(apiUrl, tokens.refresh_token)`. Prefer `loxtep login` +
+`LoxtepClient.fromWorkspace()` when you want credentials on disk for the CLI.
+
 3. **Scaffold the workspace**
 
    ```bash

package/dist/cli/commands/whoami.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"whoami.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/whoami.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,uCAAuC,CAAC;AAM/C,+DAA+D;AAC/D,MAAM,MAAM,cAAc,GAAG,iBAAiB,CAAC;AAE/C,MAAM,WAAW,aAAa;IAC5B,6EAA6E;IAC7E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,0FAA0F;IAC1F,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB,mFAAmF;IACnF,QAAQ,CAAC,EAAE,OAAO,KAAK,CAAC;IACxB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC,cAAc,CAAC,CAAC;IAC1C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AA0CD;;GAEG;AACH,wBAAsB,SAAS,CAAC,OAAO,GAAE,aAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CA8D1E"}
+{"version":3,"file":"whoami.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/whoami.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,uCAAuC,CAAC;AAM/C,+DAA+D;AAC/D,MAAM,MAAM,cAAc,GAAG,iBAAiB,CAAC;AAE/C,MAAM,WAAW,aAAa;IAC5B,6EAA6E;IAC7E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,0FAA0F;IAC1F,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB,mFAAmF;IACnF,QAAQ,CAAC,EAAE,OAAO,KAAK,CAAC;IACxB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC,cAAc,CAAC,CAAC;IAC1C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AA0CD;;GAEG;AACH,wBAAsB,SAAS,CAAC,OAAO,GAAE,aAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAmE1E"}

package/dist/cli/commands/whoami.js

@@ -92,6 +92,9 @@ export async function runWhoami(options = {}) {
     catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
         console.error('Failed to fetch user:', msg);
+        if (/insufficient permissions|Access denied/i.test(msg)) {
+            console.error('Hint: confirm whoami hits the same host as login (`api_base_url` in credentials). Stale ~/.loxtep/config.json api_url pointing at prod with a dev token is a common cause. Use LOXTEP_DEBUG=1 loxtep whoami.');
+        }
         process.exitCode = 1;
     }
 }

package/dist/cli/commands/whoami.js.map

@@ -1 +1 @@
-{"version":3,"file":"whoami.js","sourceRoot":"","sources":["../../../src/cli/commands/whoami.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EACxB,iBAAiB,GAElB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AAE/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAsB9D,SAAS,cAAc,CAAC,OAAsB;IAC5C,OAAO,OAAO,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,GAAG,CAAC;AACpE,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAuB;IACpD,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,iBAAiB,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC;AAChH,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAY;IACtC,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAa,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9F,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAI,GAA6B,CAAC,OAAO,CAAC;IACnD,OAAO,GAAG,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,GAAa,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,IAAuB,EACvB,IAAsB;IAEtB,IAAI,IAAI,CAAC,iBAAiB,IAAI,CAAC,IAAI,CAAC,eAAe;QAAE,OAAO,IAAI,CAAC;IACjE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAC3B,gCAAgC,kBAAkB,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAC3E,CAAC;QACF,MAAM,GAAG,GAAG,iBAAiB,CAAC,MAAM,CAAmC,CAAC;QACxE,MAAM,IAAI,GACR,OAAO,GAAG,EAAE,IAAI,KAAK,QAAQ;YAC3B,CAAC,CAAC,GAAG,CAAC,IAAI;YACV,CAAC,CAAC,OAAO,GAAG,EAAE,iBAAiB,KAAK,QAAQ;gBAC1C,CAAC,CAAC,GAAG,CAAC,iBAAiB;gBACvB,CAAC,CAAC,SAAS,CAAC;QAClB,IAAI,IAAI;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,mCAAmC;IACrC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,UAAyB,EAAE;IACzD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS;YAC5B,CAAC,CAAC,MAAM,OAAO,CAAC,SAAS,EAAE;YAC3B,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;gBAChB,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC;oBACpC,cAAc,EAAE,OAAO,CAAC,cAAc;oBACtC,eAAe,EAAE,OAAO,CAAC,eAAe;oBACxC,eAAe,EAAE,OAAO,CAAC,eAAe;oBACxC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,OAAO;iBAC9C,CAAC,CAAC;gBACH,IAAI,CAAC,GAAG,EAAE,CAAC;oBACT,OAAO,CAAC,KAAK,CACX,iIAAiI,CAClI,CAAC;oBACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;oBACrB,OAAO,IAAI,CAAC;gBACd,CAAC;gBAED,MAAM,IAAI,GAAG,yBAAyB,CAAC;gBACvC,IAAI,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC5B,MAAM,GAAG,GAAG,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;oBAC5D,OAAO,CAAC,KAAK,CAAC,6BAA6B,GAAG,EAAE,CAAC,CAAC;gBACpD,CAAC;gBAED,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAU,IAAI,CAAC,CAAC;gBAC9C,IAAI,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC5B,OAAO,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAC;oBAC7E,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;wBAC5B,OAAO,CAAC,KAAK,CACX,kGAAkG,CACnG,CAAC;oBACJ,CAAC;oBACD,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC9C,CAAC;gBAED,IAAI,MAAM,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;gBAC3C,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACzC,IAAI,KAAK,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;oBACxE,MAAM,GAAG,wBAAwB,CAAC,MAAM,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;gBACpE,CAAC;gBACD,MAAM,GAAG,MAAM,sBAAsB,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;gBACxD,OAAO,MAAM,CAAC;YAChB,CAAC,CAAC,EAAE,CAAC;QACT,IAAI,IAAI,IAAI,IAAI;YAAE,OAAO;QACzB,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,GAAG,CAAC;QACjC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC;QAClF,MAAM,GAAG,GAAG,IAAI,EAAE,iBAAiB,IAAI,IAAI,EAAE,eAAe,IAAI,GAAG,CAAC;QACpE,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;QAClC,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,KAAK,CACX,oIAAoI,CACrI,CAAC;YACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;QAC5C,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC"}
+{"version":3,"file":"whoami.js","sourceRoot":"","sources":["../../../src/cli/commands/whoami.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EACxB,iBAAiB,GAElB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AAE/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAsB9D,SAAS,cAAc,CAAC,OAAsB;IAC5C,OAAO,OAAO,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,GAAG,CAAC;AACpE,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAuB;IACpD,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,iBAAiB,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC;AAChH,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAY;IACtC,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAa,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9F,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAI,GAA6B,CAAC,OAAO,CAAC;IACnD,OAAO,GAAG,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,GAAa,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,IAAuB,EACvB,IAAsB;IAEtB,IAAI,IAAI,CAAC,iBAAiB,IAAI,CAAC,IAAI,CAAC,eAAe;QAAE,OAAO,IAAI,CAAC;IACjE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAC3B,gCAAgC,kBAAkB,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAC3E,CAAC;QACF,MAAM,GAAG,GAAG,iBAAiB,CAAC,MAAM,CAAmC,CAAC;QACxE,MAAM,IAAI,GACR,OAAO,GAAG,EAAE,IAAI,KAAK,QAAQ;YAC3B,CAAC,CAAC,GAAG,CAAC,IAAI;YACV,CAAC,CAAC,OAAO,GAAG,EAAE,iBAAiB,KAAK,QAAQ;gBAC1C,CAAC,CAAC,GAAG,CAAC,iBAAiB;gBACvB,CAAC,CAAC,SAAS,CAAC;QAClB,IAAI,IAAI;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,mCAAmC;IACrC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,UAAyB,EAAE;IACzD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS;YAC5B,CAAC,CAAC,MAAM,OAAO,CAAC,SAAS,EAAE;YAC3B,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;gBAChB,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC;oBACpC,cAAc,EAAE,OAAO,CAAC,cAAc;oBACtC,eAAe,EAAE,OAAO,CAAC,eAAe;oBACxC,eAAe,EAAE,OAAO,CAAC,eAAe;oBACxC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,OAAO;iBAC9C,CAAC,CAAC;gBACH,IAAI,CAAC,GAAG,EAAE,CAAC;oBACT,OAAO,CAAC,KAAK,CACX,iIAAiI,CAClI,CAAC;oBACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;oBACrB,OAAO,IAAI,CAAC;gBACd,CAAC;gBAED,MAAM,IAAI,GAAG,yBAAyB,CAAC;gBACvC,IAAI,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC5B,MAAM,GAAG,GAAG,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;oBAC5D,OAAO,CAAC,KAAK,CAAC,6BAA6B,GAAG,EAAE,CAAC,CAAC;gBACpD,CAAC;gBAED,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAU,IAAI,CAAC,CAAC;gBAC9C,IAAI,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC5B,OAAO,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAC;oBAC7E,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;wBAC5B,OAAO,CAAC,KAAK,CACX,kGAAkG,CACnG,CAAC;oBACJ,CAAC;oBACD,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC9C,CAAC;gBAED,IAAI,MAAM,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;gBAC3C,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACzC,IAAI,KAAK,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;oBACxE,MAAM,GAAG,wBAAwB,CAAC,MAAM,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;gBACpE,CAAC;gBACD,MAAM,GAAG,MAAM,sBAAsB,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;gBACxD,OAAO,MAAM,CAAC;YAChB,CAAC,CAAC,EAAE,CAAC;QACT,IAAI,IAAI,IAAI,IAAI;YAAE,OAAO;QACzB,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,GAAG,CAAC;QACjC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC;QAClF,MAAM,GAAG,GAAG,IAAI,EAAE,iBAAiB,IAAI,IAAI,EAAE,eAAe,IAAI,GAAG,CAAC;QACpE,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;QAClC,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,KAAK,CACX,oIAAoI,CACrI,CAAC;YACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;QAC5C,IAAI,yCAAyC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACxD,OAAO,CAAC,KAAK,CACX,8MAA8M,CAC/M,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/cli/resolve-api-url.d.ts

@@ -1,14 +1,18 @@
 /**
  * Resolve the API host for CLI calls.
- * Browser login stores `api_base_url` in credentials — that must win over the
- * baked-in production default when the user has not set api_url in config/env.
+ * Browser login stores `api_base_url` in credentials — that must win over a
+ * stale ~/.loxtep/config.json api_url (commonly left on production) because the
+ * access token is minted for a specific host.
  */
 import type { LoxtepConfig } from '../config/types.js';
 import type { ResolvedCliAuth } from './auth-resolve.js';
 /** True when ~/.loxtep/config.json (or override path) explicitly sets api_url. */
 export declare function configFileHasExplicitApiUrl(configFilePath?: string): boolean;
 /**
- * Precedence: LOXTEP_API_URL → explicit config file api_url → credentials api_base_url → config default.
+ * Precedence: LOXTEP_API_URL → credentials api_base_url → explicit config file api_url → config default.
+ *
+ * Credentials win over config because tokens are host-bound (e.g. apidev CLISESS JWT
+ * must not be sent to api.loxtep.io just because config still points at prod).
  */
 export declare function resolveCliApiUrl(config: LoxtepConfig, resolved: ResolvedCliAuth | null, options?: {
     configFilePath?: string;

package/dist/cli/resolve-api-url.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-api-url.d.ts","sourceRoot":"","sources":["../../src/cli/resolve-api-url.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEzD,kFAAkF;AAClF,wBAAgB,2BAA2B,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAS5E;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,YAAY,EACpB,QAAQ,EAAE,eAAe,GAAG,IAAI,EAChC,OAAO,CAAC,EAAE;IAAE,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,GACpC,MAAM,CAaR"}
+{"version":3,"file":"resolve-api-url.d.ts","sourceRoot":"","sources":["../../src/cli/resolve-api-url.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEzD,kFAAkF;AAClF,wBAAgB,2BAA2B,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAS5E;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,YAAY,EACpB,QAAQ,EAAE,eAAe,GAAG,IAAI,EAChC,OAAO,CAAC,EAAE;IAAE,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,GACpC,MAAM,CAaR"}

package/dist/cli/resolve-api-url.js

@@ -1,7 +1,8 @@
 /**
  * Resolve the API host for CLI calls.
- * Browser login stores `api_base_url` in credentials — that must win over the
- * baked-in production default when the user has not set api_url in config/env.
+ * Browser login stores `api_base_url` in credentials — that must win over a
+ * stale ~/.loxtep/config.json api_url (commonly left on production) because the
+ * access token is minted for a specific host.
  */
 import { existsSync, readFileSync } from 'node:fs';
 import { getDefaultConfigPath } from '../config/paths.js';
@@ -19,18 +20,21 @@ export function configFileHasExplicitApiUrl(configFilePath) {
     }
 }
 /**
- * Precedence: LOXTEP_API_URL → explicit config file api_url → credentials api_base_url → config default.
+ * Precedence: LOXTEP_API_URL → credentials api_base_url → explicit config file api_url → config default.
+ *
+ * Credentials win over config because tokens are host-bound (e.g. apidev CLISESS JWT
+ * must not be sent to api.loxtep.io just because config still points at prod).
  */
 export function resolveCliApiUrl(config, resolved, options) {
     const env = process.env.LOXTEP_API_URL?.trim();
     if (env)
         return env.replace(/\/$/, '');
-    if (configFileHasExplicitApiUrl(options?.configFilePath) && config.api_url) {
-        return config.api_url.replace(/\/$/, '');
-    }
     if (resolved?.api_url_from_mcp) {
         return resolved.api_url_from_mcp.replace(/\/$/, '');
     }
+    if (configFileHasExplicitApiUrl(options?.configFilePath) && config.api_url) {
+        return config.api_url.replace(/\/$/, '');
+    }
     return (config.api_url || '').replace(/\/$/, '');
 }
 //# sourceMappingURL=resolve-api-url.js.map

package/dist/cli/resolve-api-url.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-api-url.js","sourceRoot":"","sources":["../../src/cli/resolve-api-url.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAG1D,kFAAkF;AAClF,MAAM,UAAU,2BAA2B,CAAC,cAAuB;IACjE,MAAM,IAAI,GAAG,cAAc,IAAI,oBAAoB,EAAE,CAAC;IACtD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAA4B,CAAC;QAClF,OAAO,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAoB,EACpB,QAAgC,EAChC,OAAqC;IAErC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;IAC/C,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAEvC,IAAI,2BAA2B,CAAC,OAAO,EAAE,cAAc,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAC3E,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,IAAI,QAAQ,EAAE,gBAAgB,EAAE,CAAC;QAC/B,OAAO,QAAQ,CAAC,gBAAgB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACnD,CAAC"}
+{"version":3,"file":"resolve-api-url.js","sourceRoot":"","sources":["../../src/cli/resolve-api-url.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAG1D,kFAAkF;AAClF,MAAM,UAAU,2BAA2B,CAAC,cAAuB;IACjE,MAAM,IAAI,GAAG,cAAc,IAAI,oBAAoB,EAAE,CAAC;IACtD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAA4B,CAAC;QAClF,OAAO,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAoB,EACpB,QAAgC,EAChC,OAAqC;IAErC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;IAC/C,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAEvC,IAAI,QAAQ,EAAE,gBAAgB,EAAE,CAAC;QAC/B,OAAO,QAAQ,CAAC,gBAAgB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,2BAA2B,CAAC,OAAO,EAAE,cAAc,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAC3E,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACnD,CAAC"}

package/dist/rstreams/leo-runtime.d.ts

@@ -4,9 +4,6 @@
  * IMPORTANT: do not statically `import 'leo-sdk'`. leo-sdk's `leoConfigure.js` runs
  * `build(process.cwd())` at module load and calls `fs.existsSync({})` when there is no
  * Leo system directory (DEP0187). REST-only CLI commands must not pay that cost or warning.
- *
- * Lazy load must not use a bare `import.meta` in this file — Jest's CJS transform
- * rejects it. Resolve the module URL via Function so ESM runtime still works.
  */
 import type { ConfigurationResources, RStreamsSdk } from 'leo-sdk';
 export declare function createRStreamsSdk(config: ConfigurationResources): RStreamsSdk;

package/dist/rstreams/leo-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"leo-runtime.d.ts","sourceRoot":"","sources":["../../src/rstreams/leo-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAcnE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,sBAAsB,GAAG,WAAW,CAW7E;AAED,YAAY,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACnE,2EAA2E;AAC3E,YAAY,EAAE,WAAW,IAAI,mBAAmB,EAAE,MAAM,SAAS,CAAC"}
+{"version":3,"file":"leo-runtime.d.ts","sourceRoot":"","sources":["../../src/rstreams/leo-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAInE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,sBAAsB,GAAG,WAAW,CAc7E;AAED,YAAY,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACnE,2EAA2E;AAC3E,YAAY,EAAE,WAAW,IAAI,mBAAmB,EAAE,MAAM,SAAS,CAAC"}

package/dist/rstreams/leo-runtime.js

@@ -4,20 +4,12 @@
  * IMPORTANT: do not statically `import 'leo-sdk'`. leo-sdk's `leoConfigure.js` runs
  * `build(process.cwd())` at module load and calls `fs.existsSync({})` when there is no
  * Leo system directory (DEP0187). REST-only CLI commands must not pay that cost or warning.
- *
- * Lazy load must not use a bare `import.meta` in this file — Jest's CJS transform
- * rejects it. Resolve the module URL via Function so ESM runtime still works.
  */
 import { createRequire } from 'node:module';
-function loadLeoSdk() {
-    // Hide import.meta from static transforms (Jest); evaluate only in real ESM.
-    const moduleUrl = new Function('return import.meta.url')();
-    const requireCjs = createRequire(moduleUrl);
-    return requireCjs('leo-sdk');
-}
+const require = createRequire(import.meta.url);
 export function createRStreamsSdk(config) {
     // Lazy CJS require — only when a stream reader/writer is actually constructed.
-    const StreamRuntime = loadLeoSdk();
+    const StreamRuntime = require('leo-sdk');
     const defaultExport = StreamRuntime.default;
     const SDK = (StreamRuntime.RStreamsSdk || defaultExport?.RStreamsSdk);
     if (!SDK || typeof SDK !== 'function') {

package/dist/rstreams/leo-runtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"leo-runtime.js","sourceRoot":"","sources":["../../src/rstreams/leo-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAQ5C,SAAS,UAAU;IACjB,6EAA6E;IAC7E,MAAM,SAAS,GAAG,IAAI,QAAQ,CAAC,wBAAwB,CAAC,EAAY,CAAC;IACrE,MAAM,UAAU,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IAC5C,OAAO,UAAU,CAAC,SAAS,CAAiB,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAA8B;IAC9D,+EAA+E;IAC/E,MAAM,aAAa,GAAG,UAAU,EAAE,CAAC;IACnC,MAAM,aAAa,GAAG,aAAa,CAAC,OAAO,CAAC;IAC5C,MAAM,GAAG,GAAG,CAAC,aAAa,CAAC,WAAW,IAAI,aAAa,EAAE,WAAW,CAEvD,CAAC;IACd,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,UAAU,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;AACzB,CAAC"}
+{"version":3,"file":"leo-runtime.js","sourceRoot":"","sources":["../../src/rstreams/leo-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAG5C,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE/C,MAAM,UAAU,iBAAiB,CAAC,MAA8B;IAC9D,+EAA+E;IAC/E,MAAM,aAAa,GAAG,OAAO,CAAC,SAAS,CAGtC,CAAC;IACF,MAAM,aAAa,GAAG,aAAa,CAAC,OAAO,CAAC;IAC5C,MAAM,GAAG,GAAG,CAAC,aAAa,CAAC,WAAW,IAAI,aAAa,EAAE,WAAW,CAEvD,CAAC;IACd,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,UAAU,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;AACzB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@loxtep/sdk",
-  "version": "0.9.9",
+  "version": "0.9.11",
   "description": "Loxtep SDK for Node.js — the Enterprise Context Layer: data products, workflows, projects, queues, and machine-usable context for AI",
   "author": "Loxtep <engineering@loxtep.io>",
   "homepage": "https://loxtep.io",