@revturbine/cli 0.18.0 → 0.18.1

package/README.md

@@ -66,7 +66,7 @@ Commands that read a config name the version explicitly — there is no default:
 | `init` (alias `create`) | Set up RevTurbine while preserving existing integrations: install missing packages, pin the CLI exactly, create a starter for a fresh integration, and install skills for one agent. Use `--scaffold` to create a missing root starter explicitly; existing files are never overwritten. `--agent claude-code\|cursor\|codex` overrides environment detection; an unknown agent skips skills and prints the selection command. Also supports `--dir`, `--dry-run`, `--no-skills`, `--json`. With no `package.json`, offers a new project (`--yes` for noninteractive creation). Runs the invoked CLI even inside a repo that pins a different one. |
 | `signup` | Create an account headlessly: email + password, then an emailed one-time code to verify, then a token is stored. |
 | `login` / `logout` | Device-flow auth; tokens stored at `~/.revturbine/credentials.json` (mode 0600). |
-| `whoami` | The resolved instance, tenant, credentials source, and whether the stored token works. |
+| `whoami` | Authentication state first: not logged in, credentials accepted, credentials rejected for the selected instance/tenant, or verification unavailable. Then shows instance, tenant, and credentials source; configured tenant information alone does not prove login. Verification and subsequent telemetry each time out after 3 seconds. Status reports exit 0. `--json` retains its seven fields: `instance`, `tenant`, `tenant_source`, `credentials_dir`, `credentials_source`, `token_present` (boolean), and `token_valid` (`true` for 2xx, `false` for 401/403, `null` when absent or unverified, including redirects, other HTTP errors, timeouts and network failures). |
 | `schema` | Emit the bundled `RevTurbineConfig` JSON schema (for agents to author against). |
 | `docs` | Print the canonical documentation URL. |
 | `download` | Fetch a config version (`--live` / `--draft` / `--release <id>`); `--save`. |

package/dist/cli.js

@@ -10705,7 +10705,7 @@ var CLI_UNTRACKED_COMMANDS = /* @__PURE__ */ new Set(["login", "signup", "logout
 function shouldTrackCommandExecution(name, hasUrl) {
   return hasUrl && !CLI_UNTRACKED_COMMANDS.has(name);
 }
-async function trackEvent(rawUrl, explicitTenantId, eventType, payload) {
+async function trackEvent(rawUrl, explicitTenantId, eventType, payload, signal) {
   try {
     const url = normalizeBaseUrl(rawUrl);
     const cred = getCredential(url);
@@ -10717,7 +10717,8 @@ async function trackEvent(rawUrl, explicitTenantId, eventType, payload) {
         "x-tenant-id": explicitTenantId ?? cred.tenant_id ?? "dev-tenant-001",
         Authorization: `Bearer ${cred.token}`
       },
-      body: JSON.stringify({ event_type: eventType, payload })
+      body: JSON.stringify({ event_type: eventType, payload }),
+      ...signal ? { signal } : {}
     });
   } catch {
   }
@@ -10886,6 +10887,20 @@ async function resolveActiveDraft(baseUrl, headers, fetchImpl = fetch) {
   return { ok: res.ok, status: res.status, draft: res.ok ? json.active ?? null : null };
 }
 
+// src/lib/whoami.ts
+function classifyToken(hasToken, status) {
+  if (!hasToken || status === null) return null;
+  if (status >= 200 && status < 300) return true;
+  if (status === 401 || status === 403) return false;
+  return null;
+}
+function formatAuthentication(hasToken, tokenValid) {
+  if (!hasToken) return "authentication: not logged in \u2014 run `revturbine login`";
+  if (tokenValid === true) return "authentication: credentials accepted for this instance and tenant";
+  if (tokenValid === false) return "authentication: credentials rejected for this instance or tenant \u2014 check access or run `revturbine login`";
+  return "authentication: verification unavailable \u2014 credentials present; retry when the instance is reachable";
+}
+
 // src/lib/evaluate-local.ts
 import { initRevTurbine } from "@revturbine/sdk/headless";
 function resolvePlacementComponentType(input) {
@@ -11781,6 +11796,7 @@ function queryAnalyticsView(baseUrl, headers, body, fetchImpl) {
 // src/cli.ts
 var DOCS_URL = "https://github.com/revt-eng/revturbine-cli#readme";
 var DEFAULT_URL = "https://revturbine.com/app";
+var WHOAMI_REQUEST_TIMEOUT_MS = 3e3;
 function loadConfig(file) {
   const resolved = path2.resolve(file);
   if (!existsSync2(resolved)) fail(EXIT.USAGE, `Config not found: ${resolved}`);
@@ -11816,15 +11832,15 @@ function verifyConfig(file) {
   if (check.advisories.length > 0) diagRaw(formatFindings(check.advisories));
   return check.body;
 }
-function connect(rawUrl, explicitTenantId) {
+function connect(rawUrl, explicitTenantId, diagnostic = diag) {
   const url = normalizeBaseUrl(rawUrl);
   const { dir, source } = resolveConfigDir();
   const cred = getCredential(url);
   const tenantId = explicitTenantId ?? cred?.tenant_id ?? "dev-tenant-001";
   const tenantSource = explicitTenantId ? "--tenant-id" : cred?.tenant_id ? "stored token" : "default";
-  diag(`Tenant ${tenantId} (${tenantSource}); credentials: ${dir} [${source}].`);
+  diagnostic(`Tenant ${tenantId} (${tenantSource}); credentials: ${dir} [${source}].`);
   if (source === "global") {
-    diag(
+    diagnostic(
       `WARNING: using the global ${dir} - NOT worktree-scoped. If this session is for a specific customer, run from that customer's worktree (with its own .revturbine/) so a stale login can't target the wrong tenant.`
     );
   }
@@ -12092,6 +12108,10 @@ Auth:
   ~/.revturbine/credentials.json (0600); the token's tenant is used by default,
   override with -t/--tenant-id. Mutating commands (discard, restore) prompt
   for confirmation unless --yes.
+  \`whoami\` leads with absent, accepted, rejected, or unverifiable credentials;
+  a configured tenant alone does not prove login. Verification and subsequent
+  telemetry each time out after 3 seconds. Status reports exit 0; --json keeps
+  token_present boolean and token_valid true/false/null (null = unverified).
 
 Full reference: ${DOCS_URL}
 `;
@@ -12102,7 +12122,7 @@ program.hook("postAction", async (_thisCommand, actionCommand) => {
   if (!shouldTrackCommandExecution(actionCommand.name(), Boolean(opts.url))) return;
   await trackEvent(opts.url, opts.tenantId, "cli_command_executed", {
     command: actionCommand.name()
-  });
+  }, actionCommand.name() === "whoami" ? globalThis.AbortSignal.timeout(WHOAMI_REQUEST_TIMEOUT_MS) : void 0);
 });
 program.name("revturbine").description("Validate RevTurbine Playbooks and ship them through the playbook-version lifecycle (draft \u2192 Release).").version(`${pkgVersion} (schema ${SCHEMA_VERSION})`, "-V, --version", "Print the revturbine and bundled schema versions").option(NO_LOCAL_FLAG, "Ignore the repo-pinned CLI and run this installation").showHelpAfterError().addHelpText("after", HELP_AFTER);
 function runInstall(manager, args, cwd) {
@@ -12350,13 +12370,22 @@ program.command("logout").description("Remove the stored token for <url>.").argu
   const removed = removeCredential(normalized);
   diag(removed ? `Logged out of ${normalized}.` : `No stored credential for ${normalized}.`);
 });
-program.command("whoami").description("Show the resolved instance, tenant, credentials source, and whether the stored token works.").option("-u, --url <url>", "RevTurbine instance URL", DEFAULT_URL).option("-t, --tenant-id <id>", "x-tenant-id (defaults to the stored token tenant)").option("--json", "Machine-readable output").action(async (opts) => {
-  const conn = connect(opts.url, opts.tenantId);
-  let tokenValid = null;
+program.command("whoami").description("Show authentication state first (absent, accepted, rejected, or unverifiable), then instance, tenant, and credentials source.").option("-u, --url <url>", "RevTurbine instance URL", DEFAULT_URL).option("-t, --tenant-id <id>", "x-tenant-id (defaults to the stored token tenant)").option("--json", "Machine-readable output").action(async (opts) => {
+  const diagnostics = [];
+  const conn = connect(opts.url, opts.tenantId, (message) => diagnostics.push(message));
+  let probeStatus = null;
   if (conn.hasToken) {
-    const probe = await resolveActiveDraft(conn.url, conn.headers).catch(() => ({ ok: false, status: 0, draft: null }));
-    tokenValid = probe.ok || probe.status !== 401 && probe.status !== 403 && probe.status !== 0;
-  }
+    probeStatus = await fetch(`${conn.url}/api/optimization/drafts`, {
+      headers: conn.headers,
+      signal: globalThis.AbortSignal.timeout(WHOAMI_REQUEST_TIMEOUT_MS),
+      // A redirected login page returning 200 is not proof of authentication.
+      redirect: "manual"
+    }).then(async (response) => {
+      await response.body?.cancel();
+      return response.status;
+    }).catch(() => null);
+  }
+  const tokenValid = classifyToken(conn.hasToken, probeStatus);
   const data = {
     instance: conn.url,
     tenant: conn.tenantId,
@@ -12370,12 +12399,13 @@ program.command("whoami").description("Show the resolved instance, tenant, crede
     data,
     Boolean(opts.json),
     [
+      formatAuthentication(conn.hasToken, tokenValid),
       `instance:    ${data.instance}`,
       `tenant:      ${data.tenant} (${data.tenant_source})`,
-      `credentials: ${data.credentials_dir} [${data.credentials_source}]`,
-      `token:       ${data.token_present ? tokenValid ? "present, valid" : "present, NOT accepted" : "absent \u2014 run `revturbine login`"}`
+      `credentials: ${data.credentials_dir} [${data.credentials_source}]`
     ].join("\n")
   );
+  for (const message of diagnostics) diag(message);
 });
 program.command("schema").description("Emit the bundled RevTurbineConfig JSON schema for an agent to author against.").option("--json", "Accepted for symmetry; output is always JSON").action(() => {
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@revturbine/cli",
-  "version": "0.18.0",
+  "version": "0.18.1",
   "description": "revturbine — validate RevTurbine Playbooks and ship them to a RevTurbine instance through the playbook-version lifecycle (draft → Release).",
   "license": "MIT",
   "repository": {