@lpm-registry/cli 0.7.0 → 0.9.2

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.8.0] - 2026-04-01
+
+### Changed
+
+- **Rust binary v0.8.0** — Install hash fast-exit (82ms → 26ms up-to-date), NDJSON streaming batch metadata, resolver carries tarball URLs (eliminates double metadata fetch), up-to-date benchmark added.
+- **Scoped registry default** — `lpm setup` and `lpm npmrc` now write scoped config (`@lpm.dev:registry=`) by default. npm packages go direct to npmjs.org (faster, $0 proxy cost). Use `--proxy` to opt into full proxy mode (Pro/Org feature).
+- **Global config defaults** — `lpm config set allowNew true`, `lpm config set autoBuild true`, etc. CLI flags merge with `~/.lpm/config.toml` defaults.
+- **Migrate fix** — Corrected stale registry URL in `lpm migrate` (.npmrc now writes `/api/registry/` instead of `/api/packages/`).
+- Version bump to stay in sync with Rust binary releases.
+
 ## [0.7.0] - 2026-04-01
 
 ### Changed

package/lib/api.js

@@ -9,7 +9,15 @@
  * @module cli/lib/api
  */
 
-import { getRegistryUrl, getRetries, getTimeout, getToken } from "./config.js"
+import {
+	getRefreshToken,
+	getRegistryUrl,
+	getRetries,
+	getTimeout,
+	getToken,
+	setRefreshToken,
+	setToken,
+} from "./config.js"
 import {
 	ERROR_MESSAGES,
 	RATE_LIMIT_STATUS_CODES,
@@ -63,6 +71,44 @@ function parseRetryAfter(retryAfter) {
 	return RETRY_BASE_DELAY_MS
 }
 
+/**
+ * Attempt silent token refresh using the stored refresh token (Feature 44 Part B).
+ * @returns {Promise<string|null>} New access token if successful, null otherwise
+ */
+async function tryRefresh() {
+	try {
+		const refreshToken = await getRefreshToken()
+		if (!refreshToken) return null
+
+		const registryUrl = getRegistryUrl()
+		const { createHash } = await import("node:crypto")
+		const { hostname, userInfo } = await import("node:os")
+		const fp = createHash("sha256")
+			.update(`${hostname()}:${userInfo().username}:lpm-cli`)
+			.digest("hex")
+
+		const resp = await fetch(`${registryUrl}/api/cli/refresh`, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({ refreshToken, deviceFingerprint: fp }),
+		})
+
+		if (!resp.ok) return null
+
+		const data = await resp.json()
+		if (data.token) {
+			await setToken(data.token)
+			if (data.refreshToken) {
+				await setRefreshToken(data.refreshToken)
+			}
+			return data.token
+		}
+	} catch {
+		// Refresh failed — fall through to auth error
+	}
+	return null
+}
+
 /**
  * @typedef {Object} RequestOptions
  * @property {Record<string, string>} [headers] - Request headers
@@ -113,9 +159,8 @@ export async function request(path, options = {}) {
 
 			clearTimeout(timeoutId)
 
-			// Handle authentication errors immediately (no retry)
-			// Exception: 2FA OTP responses (401 with OTP_REQUIRED/OTP_INVALID code)
-			// must be returned to the caller so the publish handler can prompt for OTP
+			// Handle authentication errors — try silent refresh before failing
+			// Exception: 2FA OTP responses must be returned to the caller
 			if (response.status === 401) {
 				const cloned = response.clone()
 				let data = {}
@@ -127,6 +172,16 @@ export async function request(path, options = {}) {
 				if (data.code === "OTP_REQUIRED" || data.code === "OTP_INVALID") {
 					return response
 				}
+
+				// Attempt silent refresh (Feature 44 Part B) — one retry on 401
+				if (attempt === 0) {
+					const refreshed = await tryRefresh()
+					if (refreshed) {
+						// Update the auth header and retry this request
+						headers.Authorization = `Bearer ${refreshed}`
+						continue
+					}
+				}
 				throw new Error(ERROR_MESSAGES.notAuthenticated)
 			}
 

package/lib/commands/login.js

@@ -1,7 +1,9 @@
+import { createHash } from "node:crypto"
 import http from "node:http"
+import { hostname, userInfo } from "node:os"
 import open from "open"
 import { request } from "../api.js"
-import { getRegistryUrl, setToken } from "../config.js"
+import { getRegistryUrl, setRefreshToken, setToken } from "../config.js"
 import { WARNING_MESSAGES } from "../constants.js"
 import { createSpinner, log, printHeader } from "../ui.js"
 
@@ -188,11 +190,52 @@ export async function login() {
 		res.setHeader("Access-Control-Allow-Origin", "*")
 
 		if (url.pathname === "/callback") {
-			const token = url.searchParams.get("token")
+			// Exchange code flow (Feature 42) — code is exchanged for token server-side
+			const exchangeCode = url.searchParams.get("code")
+			// Legacy fallback: direct token in URL (for older server versions)
+			const directToken = url.searchParams.get("token")
+
+			let token = directToken
+			let refreshToken = null
+			if (exchangeCode && !directToken) {
+				try {
+					const exchangeRes = await fetch(`${registryUrl}/api/cli/exchange`, {
+						method: "POST",
+						headers: { "Content-Type": "application/json" },
+						body: JSON.stringify({ code: exchangeCode }),
+					})
+					if (exchangeRes.ok) {
+						const data = await exchangeRes.json()
+						token = data.token
+						// Feature 44: store refresh token if server provides one
+						if (data.refreshToken) {
+							refreshToken = data.refreshToken
+						}
+					} else {
+						const err = await exchangeRes.json().catch(() => ({}))
+						throw new Error(err.error || "Exchange failed")
+					}
+				} catch (err) {
+					spinner.fail(`Token exchange failed: ${err.message}`)
+					res.writeHead(200, { "Content-Type": "text/html" })
+					res.end(
+						getErrorHtml(
+							"Exchange Failed",
+							"Failed to exchange the authorization code. Please try again.",
+						),
+					)
+					closeAndExit(res)
+					return
+				}
+			}
 
 			if (token) {
-				// Use async setToken
+				// Store access token
 				await setToken(token)
+				// Store refresh token for session auth (Feature 44 Part B)
+				if (refreshToken) {
+					await setRefreshToken(refreshToken)
+				}
 
 				try {
 					const response = await request("/-/whoami")
@@ -535,10 +578,15 @@ export async function login() {
 		}
 	})
 
+	// Compute device fingerprint for session auth (Feature 44 Part B)
+	const fp = createHash("sha256")
+		.update(`${hostname()}:${userInfo().username}:lpm-cli`)
+		.digest("hex")
+	const dn = encodeURIComponent(hostname())
+
 	server.listen(0, async () => {
 		const port = server.address().port
-		// Assuming registryUrl is the base URL of the Next.js app
-		const loginUrl = `${registryUrl}/cli/login?port=${port}`
+		const loginUrl = `${registryUrl}/cli/login?port=${port}&fp=${fp}&dn=${dn}`
 
 		console.log(`Opening browser to: ${loginUrl}`)
 		await open(loginUrl)

package/lib/commands/npmrc.js

@@ -82,8 +82,9 @@ export async function npmrc(options) {
 		: `${registryUrl}/api/registry`
 	const registryHost = fullRegistryUrl.replace(/^https?:/, "")
 
-	// Determine proxy vs scoped mode
-	let useScoped = !!options?.scoped
+	// Default: scoped (only @lpm.dev packages through lpm.dev).
+	// --proxy: route all npm traffic through lpm.dev (Pro/Org feature).
+	let useScoped = !options?.proxy
 
 	// Read existing .npmrc and check for custom default registry
 	let npmrcContent = ""

package/lib/commands/setup.js

@@ -75,8 +75,9 @@ export async function setup(options) {
 		: `${registryUrl}/api/registry`
 	const registryHost = fullRegistryUrl.replace(/^https?:/, "")
 
-	// Determine proxy vs scoped mode
-	let useScoped = !!options?.scoped
+	// Default: scoped (only @lpm.dev packages through lpm.dev).
+	// --proxy: route all npm traffic through lpm.dev (Pro/Org feature).
+	let useScoped = !options?.proxy
 
 	// ── OIDC mode: exchange CI token for a real short-lived install token ──
 	if (options?.oidc) {

package/lib/config.js

@@ -118,6 +118,26 @@ export async function clearToken() {
 	config.delete("token")
 }
 
+/**
+ * Store a refresh token in secure storage (Feature 44 Part B).
+ * Uses the same secure-store as auth tokens with a "refresh:" prefix.
+ * @param {string} refreshToken
+ * @returns {Promise<void>}
+ */
+export async function setRefreshToken(refreshToken) {
+	const registryUrl = getRegistryUrl()
+	await secureSetToken(refreshToken, `refresh:${registryUrl}`)
+}
+
+/**
+ * Get the stored refresh token from secure storage.
+ * @returns {Promise<string|null>}
+ */
+export async function getRefreshToken() {
+	const registryUrl = getRegistryUrl()
+	return secureGetToken(`refresh:${registryUrl}`)
+}
+
 // ============================================================================
 // Registry URL Configuration
 // ============================================================================

package/package.json

@@ -1,11 +1,11 @@
 {
 	"name": "@lpm-registry/cli",
-	"version": "0.7.0",
+	"version": "0.9.2",
 	"description": "CLI for Licensed Package Manager",
 	"author": "LPM <hello@lpm.dev> (https://lpm.dev)",
 	"repository": {
 		"type": "git",
-		"url": "https://github.com/lpm-dev/cli"
+		"url": "https://github.com/lpm-dev/rust-client"
 	},
 	"homepage": "https://lpm.dev",
 	"license": "ISC",
@@ -61,11 +61,11 @@
 		"xcode": "^3.0.1"
 	},
 	"optionalDependencies": {
-		"@lpm-registry/cli-darwin-arm64": "0.7.0",
-		"@lpm-registry/cli-darwin-x64": "0.7.0",
-		"@lpm-registry/cli-linux-x64": "0.7.0",
-		"@lpm-registry/cli-linux-arm64": "0.7.0",
-		"@lpm-registry/cli-win32-x64": "0.7.0",
+		"@lpm-registry/cli-darwin-arm64": "0.9.2",
+		"@lpm-registry/cli-darwin-x64": "0.9.2",
+		"@lpm-registry/cli-linux-x64": "0.9.2",
+		"@lpm-registry/cli-linux-arm64": "0.9.2",
+		"@lpm-registry/cli-win32-x64": "0.9.2",
 		"keytar": "^7.9.0"
 	},
 	"type": "module",