@shoplifter/cli 0.1.1 → 0.1.2

package/README.md

@@ -1,6 +1,6 @@
 # Shoplifter CLI
 
-Requires Node 24. Install with `npm install --global @shoplifter/cli@0.1.1`.
+Requires Node 24. Install with `npm install --global @shoplifter/cli@0.1.2`.
 It continues using SDK and contract `0.1.0`; CLI patches do not upgrade runtime inputs.
 
 ## Authoring
@@ -44,6 +44,9 @@ Only channels accessible to your dashboard account can be selected; publishing m
 be enabled for the channel. Switching channels clears the reviewed request.
 One-hour credentials
 are stored with private permissions outside the project. Use `shoplifter logout` to revoke.
+CLI `0.1.2` tolerates up to five minutes of server clock lead when validating a
+new one-hour credential; server-side token expiry remains one hour. This fixes
+approved logins rejected by `0.1.1` when server and developer clocks differ slightly.
 `shoplifter publication upload <channel-code>` uploads source; `stage`, `preview`,
 `build`, `activate`, `publish`, `status`, `logs`, `retry`, `retry-deployment` and
 `rollback` operate on channel-scoped revisions. `preview-link` requests protected

package/dist/auth.js

@@ -14,6 +14,8 @@ export function apiOrigin() {
 }
 const directory = () => resolve(process.env.SHOPLIFTER_CONFIG_DIRECTORY ?? resolve(homedir(), '.config/shoplifter'));
 const filename = () => resolve(directory(), createHash('sha256').update(apiOrigin().origin).digest('hex') + '.json');
+// The server enforces token lifetime. Allow bounded clock skew when checking its expiry locally.
+const credentialClockSkewMs = 5 * 60 * 1000;
 export async function credentials(required = true) {
     try {
         if (process.platform !== 'win32' && (await stat(filename())).mode & 0o077)
@@ -63,10 +65,13 @@ export async function login(channelCode) {
             continue;
         if (result.status !== 'approved')
             throw new Error('CLI authorization denied or expired');
-        if (!/^slw_[A-Za-z0-9_-]{43}$/.test(result.token) || !/^\d+$/.test(result.channelId)
-            || !Number.isFinite(Date.parse(result.expiresAt)) || Date.parse(result.expiresAt) <= Date.now()
-            || Date.parse(result.expiresAt) > Date.now() + 3600000)
-            throw new Error('Invalid CLI credential response');
+        if (!/^slw_[A-Za-z0-9_-]{43}$/.test(result.token) || !/^\d+$/.test(result.channelId))
+            throw new Error('Invalid CLI credential response (session format)');
+        const expiresAt = Date.parse(result.expiresAt), now = Date.now();
+        if (!Number.isFinite(expiresAt) || expiresAt <= now)
+            throw new Error('Invalid CLI credential response (invalid or expired session)');
+        if (expiresAt > now + 3600000 + credentialClockSkewMs)
+            throw new Error('Invalid CLI credential response (expiry exceeds one hour plus clock tolerance; check your system clock)');
         const approvedCode = await sessionChannel(result.token);
         if (channelCode && approvedCode !== channelCode) {
             await response(await fetch(new URL('/shoplifter-cli/logout', origin), { method: 'POST', headers: { authorization: 'Bearer ' + result.token }, signal: AbortSignal.timeout(15000) }));

package/dist/index.js

@@ -13,6 +13,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 };
 import { program, command, requiredArg, optionalArg, description, version } from 'commander-ts';
 import { spawn } from 'node:child_process';
+import { readFileSync } from 'node:fs';
 import { initialize, editProject, scaffold } from './author.js';
 import { generate, validateImages } from './files.js';
 import { publication, previewUpload } from './publication.js';
@@ -207,7 +208,7 @@ __decorate([
 ], Shoplifter.prototype, "publication", null);
 Shoplifter = __decorate([
     program(),
-    version('0.1.1'),
+    version(JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version),
     description('Author and publish independent Shoplifter presentations')
 ], Shoplifter);
 if (Number(process.versions.node.split('.')[0]) !== 24)

package/dist/release-manifest.json

@@ -11,7 +11,7 @@
     },
     {
       "path": "auth.js",
-      "sha256": "282c5df5cc768f33e2f96052fb21758f74ca3875bc5c9c582c439a490ceed15e"
+      "sha256": "848d11a0471e0e82cfd759b82b5a927517bcb6ff89b47e12f4b588995bd32077"
     },
     {
       "path": "author.d.ts",
@@ -35,7 +35,7 @@
     },
     {
       "path": "index.js",
-      "sha256": "4b85f13c321650f3a35e9cdee6df2eb8608d815750886b99a5850b224441e3c4"
+      "sha256": "d8a1ef1be4575a581f63ca1c51f71327b91728dfda1ddf77ece556b8f7847899"
     },
     {
       "path": "publication.d.ts",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shoplifter/cli",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "shoplifterRuntimeVersion": "0.1.0",
   "private": false,
   "license": "Apache-2.0",