@micropage-sh/cli 2.6.1 → 2.6.2

package/README.md

@@ -32,6 +32,8 @@ micropage whoami       # show the currently logged-in user and subscription
 micropage logout       # clear the stored session
 ```
 
+The CLI requires a paid plan (Pro or Pro+). Some features need a specific tier, such as deploy tokens (Pro+). The server enforces these limits. When a command needs a higher plan, the CLI prints the server's reason and an upgrade link.
+
 ## Project workflow
 
 ```bash

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@micropage-sh/cli",
-  "version": "2.6.1",
+  "version": "2.6.2",
   "description": "CLI for micropage.sh - create, sync, and publish microsites",
   "main": "src/index.js",
   "bin": {

package/src/commands/projects.js

@@ -607,6 +607,7 @@ async function deploy(projectUuid, deployToken, options = {}) {
       }
     }
   } catch (err) {
+    handleAuthError(err);
     console.error('Deploy failed:', err.message);
     process.exit(1);
   }

package/src/plan.js

@@ -2,13 +2,37 @@
 
 const { SUPABASE_URL, SUPABASE_ANON_KEY } = require('./config');
 
+const PRICING_URL = 'https://micropage.sh/pricing';
+
 const UPGRADE_MESSAGE = [
   'The micropage CLI is available on paid plans only.',
   'Your account is currently on the free plan.',
   '',
-  'Upgrade at: https://micropage.sh/pricing',
+  `Upgrade at: ${PRICING_URL}`,
 ].join('\n');
 
+const TIER_LABELS = { pro: 'Pro', pro_plus: 'Pro+' };
+
+// Message for a server refusal tagged PLAN_REQUIRED (see attachPlanRequired in
+// supabase.js). Leads with the server's own explanation, then the upgrade hint.
+function formatPlanRequiredMessage(err) {
+  const label = TIER_LABELS[err?.requiredTier];
+  const lines = [];
+  // Server messages written for the editor may end in a relative "Upgrade at /pricing.";
+  // drop it so the absolute link below is the only one.
+  const reason = (err?.message || '').replace(/\s*Upgrade at \S+$/i, '').trim();
+  if (reason) lines.push(reason, '');
+  lines.push(`This requires ${label ? `the ${label} plan` : 'a paid plan'}.`);
+  lines.push('');
+  lines.push(`Upgrade at: ${err?.upgradeUrl || PRICING_URL}`);
+  return lines.join('\n');
+}
+
+// The login gate below (and in whoami) is a product gate, not a security
+// boundary: anyone can call the Supabase API directly with an editor session.
+// The server enforces the per-feature gates (project limits via RLS, storage
+// quota, custom domains, archives, posts, deploy-token creation and exchange)
+// and answers with `code: "plan_required"` when a tier is missing.
 function isPaidTier(tier) {
   return tier === 'pro' || tier === 'pro_plus';
 }
@@ -37,4 +61,4 @@ async function getPlanTierWithToken(userId, accessToken) {
   }
 }
 
-module.exports = { UPGRADE_MESSAGE, isPaidTier, getPlanTierWithToken };
+module.exports = { UPGRADE_MESSAGE, isPaidTier, getPlanTierWithToken, formatPlanRequiredMessage };

package/src/supabase.js

@@ -13,6 +13,7 @@
 
 const { getSession, setSession, clearSession } = require('./auth');
 const { SUPABASE_URL, SUPABASE_ANON_KEY } = require('./config');
+const { formatPlanRequiredMessage } = require('./plan');
 
 // ---------------------------------------------------------------------------
 // JWT helpers
@@ -97,6 +98,18 @@ async function getValidAccessToken() {
 // Base request
 // ---------------------------------------------------------------------------
 
+// Server tier refusals carry `code: "plan_required"` in the JSON body, reusing
+// 402/403. Tag the error so callers can tell "upgrade needed" apart from
+// "not yours" / "invalid token", which share those statuses.
+function attachPlanRequired(err, data) {
+  if (data && typeof data === 'object' && data.code === 'plan_required') {
+    err.code = 'PLAN_REQUIRED';
+    err.requiredTier = data.required_tier || null;
+    err.upgradeUrl = data.upgrade_url || null;
+  }
+  return err;
+}
+
 async function requestWithToken(method, url, body, accessToken, extraHeaders = {}) {
   const headers = {
     'apikey': SUPABASE_ANON_KEY,
@@ -123,6 +136,7 @@ async function requestWithToken(method, url, body, accessToken, extraHeaders = {
     const err = new Error(msg);
     err.status = res.status;
     err.data = data;
+    attachPlanRequired(err, data);
     throw err;
   }
 
@@ -172,6 +186,7 @@ async function request(method, url, body, extraHeaders = {}) {
     err.status = res.status;
     err.data = data;
     if (res.status === 401) err.code = 'SESSION_EXPIRED';
+    attachPlanRequired(err, data);
     throw err;
   }
 
@@ -288,6 +303,10 @@ function handleAuthError(err) {
     console.error(err.message);
     process.exit(1);
   }
+  if (err.code === 'PLAN_REQUIRED') {
+    console.error(formatPlanRequiredMessage(err));
+    process.exit(1);
+  }
 }
 
 // ---------------------------------------------------------------------------
@@ -670,6 +689,7 @@ async function exchangeDeployTokenForAccessToken(deployTokenPlaintext, projectUu
     );
     err.status = res.status;
     err.data = data;
+    attachPlanRequired(err, data);
     throw err;
   }
   if (!data?.access_token) {
@@ -709,6 +729,7 @@ async function invokePublishBuild(accessToken, projectId, buildId) {
     );
     err.status = res.status;
     err.data = data;
+    attachPlanRequired(err, data);
     throw err;
   }
   return data;
@@ -719,6 +740,7 @@ module.exports = {
   fn,
   getUserInfo,
   handleAuthError,
+  attachPlanRequired,
   getValidAccessToken,
   getMaxDeployEventIdForBuild,
   getMaxDeployEventIdForProject,