@superblocksteam/sdk 2.0.140 → 2.0.141-next.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@superblocksteam/sdk",
-  "version": "2.0.140",
+  "version": "2.0.141-next.1",
   "description": "Superblocks JS SDK",
   "homepage": "https://www.superblocks.com",
   "license": "Superblocks Community Software License",
@@ -25,15 +25,15 @@
     "@babel/plugin-proposal-decorators": "^7.28.0",
     "@babel/plugin-transform-typescript": "7.28.0",
     "@opentelemetry/api": "^1.9.1",
-    "@opentelemetry/api-logs": "^0.217.0",
-    "@opentelemetry/context-async-hooks": "^2.6.1",
-    "@opentelemetry/exporter-logs-otlp-http": "^0.217.0",
-    "@opentelemetry/exporter-trace-otlp-http": "^0.217.0",
-    "@opentelemetry/instrumentation-express": "^0.62.0",
-    "@opentelemetry/instrumentation-http": "^0.217.0",
-    "@opentelemetry/resources": "^2.6.1",
-    "@opentelemetry/sdk-node": "^0.217.0",
-    "@opentelemetry/semantic-conventions": "^1.36.0",
+    "@opentelemetry/api-logs": "^0.220.0",
+    "@opentelemetry/context-async-hooks": "^2.9.0",
+    "@opentelemetry/exporter-logs-otlp-http": "^0.220.0",
+    "@opentelemetry/exporter-trace-otlp-http": "^0.220.0",
+    "@opentelemetry/instrumentation-express": "^0.68.0",
+    "@opentelemetry/instrumentation-http": "^0.220.0",
+    "@opentelemetry/resources": "^2.9.0",
+    "@opentelemetry/sdk-node": "^0.220.0",
+    "@opentelemetry/semantic-conventions": "^1.41.1",
     "@superblocksteam/bucketeer-sdk": "1.1.0",
     "@vitejs/plugin-react": "4.3.4",
     "axios": "^1.15.2",
@@ -57,11 +57,11 @@
     "vite-tsconfig-paths": "^6.0.4",
     "winston": "^3.17.0",
     "yaml": "^2.7.1",
-    "@superblocksteam/library-shared": "2.0.140",
-    "@superblocksteam/shared": "0.9597.1",
-    "@superblocksteam/telemetry": "2.0.140",
-    "@superblocksteam/util": "2.0.140",
-    "@superblocksteam/vite-plugin-file-sync": "2.0.140"
+    "@superblocksteam/library-shared": "2.0.141-next.1",
+    "@superblocksteam/shared": "0.9598.1",
+    "@superblocksteam/telemetry": "2.0.141-next.1",
+    "@superblocksteam/util": "2.0.141-next.1",
+    "@superblocksteam/vite-plugin-file-sync": "2.0.141-next.1"
   },
   "devDependencies": {
     "@eslint/js": "^9.39.2",

package/src/cli-replacement/dependency-install-classifier.mts

@@ -39,7 +39,7 @@ export class UpgradeFailed extends Error {
   }
 }
 
-export interface ExecFailure {
+interface ExecFailure {
   stdout?: string;
   stderr?: string;
   message?: string;
@@ -58,7 +58,7 @@ const REASON_TO_CATEGORY: Record<
 const DEP_CONFLICT_CODES = /\b(ERESOLVE|ETARGET|EPEERINVALID)\b/;
 
 /** Best-effort: pull package specs out of an ERESOLVE/ETARGET `--json` detail. */
-export function parseDependencyConflict(
+function parseDependencyConflict(
   text: string,
 ): { name: string; version?: string }[] {
   const out: { name: string; version?: string }[] = [];

package/src/cli-replacement/dev-s3-restore.test.mts

@@ -115,6 +115,7 @@ vi.mock("@superblocksteam/util", () => ({
 vi.mock("@superblocksteam/vite-plugin-file-sync/ai-service", () => ({
   AiService: class {
     initialize = vi.fn(async () => undefined);
+    notifyMigrationAppArtifactsReady = vi.fn();
     removeIntegrationCache = vi.fn(async () => undefined);
     chatSessionStore = { invalidateCache: vi.fn() };
     // `dev.mts` reads this at startup for two paths: `syncHomeNpmrc`

package/src/cli-replacement/dev-startup-git-before-dbfs-order.test.mts

@@ -115,6 +115,7 @@ vi.mock("@superblocksteam/util", () => ({
 vi.mock("@superblocksteam/vite-plugin-file-sync/ai-service", () => ({
   AiService: class {
     initialize = vi.fn(async () => undefined);
+    notifyMigrationAppArtifactsReady = vi.fn();
     removeIntegrationCache = vi.fn(async () => undefined);
     chatSessionStore = { invalidateCache: vi.fn() };
     getNpmRegistryClient = vi.fn(() => undefined);

package/src/cli-replacement/dev.mts

@@ -17,6 +17,7 @@ import {
   buildGithubSuperblocksSyncWorkflowFromBaseUrl,
   ConflictError,
   DEFAULT_NON_GIT_BRANCH,
+  isGitAuthErrorMessage,
   isGitHubRemoteUrl,
   SUPERBLOCKS_LIVE_GIT_BRANCH,
 } from "@superblocksteam/shared";
@@ -1007,6 +1008,7 @@ export async function dev(options: {
 
       const fsOperationQueue = new OperationQueue();
       let activeDbfsBranchName = applicationConfig?.branchName ?? "main";
+      let devStartupGitBootstrapAuthFailed = false;
       let devStartupGitOutcome:
         | "skipped_no_remote"
         | "bootstrap_failed"
@@ -1186,6 +1188,7 @@ export async function dev(options: {
               logger,
               tokenManager,
               features: AiServiceFeatureFlags.create(flagBootstrap),
+              flagBootstrap,
               pluginExecutionVersions:
                 currentUser.organizations[0].pluginExecutionVersions,
             });
@@ -1201,6 +1204,10 @@ export async function dev(options: {
               },
             );
 
+            if (uploadFirst) {
+              aiService?.notifyMigrationAppArtifactsReady();
+            }
+
             logger.info(
               `[dev-startup] Starting git sync (${downloadFirst ? "download" : "upload"}-first) on branch '${activeDbfsBranchName}'`,
             );
@@ -1281,6 +1288,8 @@ export async function dev(options: {
               } catch (gitError) {
                 // Init/configure/ensureGitRepo failed — repo is not usable
                 devStartupGitOutcome = "bootstrap_failed";
+                devStartupGitBootstrapAuthFailed =
+                  isGitAuthErrorMessage(gitError);
                 gitService = undefined;
                 logger.warn(
                   "[git] startup git setup failed, continuing without git",
@@ -1392,6 +1401,10 @@ export async function dev(options: {
               logger.info("[dev-startup] Skipping download, already in sync");
             }
 
+            if (downloadFirst) {
+              aiService?.notifyMigrationAppArtifactsReady();
+            }
+
             const npmRegistryClient = aiService?.getNpmRegistryClient();
             const registryValidationResult =
               await privateRegistryValidationResult(npmRegistryClient, logger);
@@ -1938,6 +1951,33 @@ export async function dev(options: {
         }
       };
 
+      const refreshRuntimeGitCredentials = async (): Promise<
+        GitService | undefined
+      > => {
+        const gitConfigSdk = sdk as unknown as GitConfigSdk;
+        const gitConfig = await gitConfigSdk.getApplicationGitConfig(
+          applicationConfig.id,
+        );
+        if (!gitConfig?.gitRemoteUrl) {
+          return undefined;
+        }
+
+        if (gitService) {
+          const refreshed = await refreshGitServiceCredentials({
+            applicationId: applicationConfig.id,
+            gitRemoteUrl: gitConfig.gitRemoteUrl,
+            logger,
+            sdk,
+            service: gitService,
+            userEmail: gitUserEmail,
+            userName: gitUserName,
+          });
+          return refreshed ? gitService : undefined;
+        }
+
+        return activateRuntimeGitService();
+      };
+
       const httpServer = await tracer.startActiveSpan(
         "createDevServer",
         async (span) => {
@@ -1949,10 +1989,13 @@ export async function dev(options: {
               fsOperationQueue,
               syncService: syncService,
               lockService: lockService,
+              tokenManager,
               aiService: aiService,
               gitService: gitService,
+              gitBootstrapAuthFailed: devStartupGitBootstrapAuthFailed,
               gitBootstrapFailed: devStartupGitOutcome === "bootstrap_failed",
               activateGitService: activateRuntimeGitService,
+              refreshGitCredentials: refreshRuntimeGitCredentials,
               snapshotManager: snapshotManager,
               logger: options.logger,
               sdk,
@@ -2021,6 +2064,84 @@ export async function dev(options: {
 // Git sync helpers
 // ---------------------------------------------------------------------------
 
+interface GitConfigSdk {
+  getApplicationGitConfig(applicationId: string): Promise<{
+    gitRemoteUrl?: string;
+    hasCredential?: boolean;
+  } | null>;
+  getGitFreshToken(
+    host: string,
+    applicationId: string,
+  ): Promise<{ username: string; token: string }>;
+}
+
+async function fetchGitCredentials({
+  applicationId,
+  gitRemoteUrl,
+  logger,
+  sdk,
+}: {
+  applicationId: string;
+  gitRemoteUrl: string;
+  logger: Logger;
+  sdk: SuperblocksSdk;
+}): Promise<{ username: string; token: string } | undefined> {
+  const gitConfigSdk = sdk as unknown as GitConfigSdk;
+
+  try {
+    const host = new URL(gitRemoteUrl).hostname;
+    const freshToken = await gitConfigSdk.getGitFreshToken(host, applicationId);
+    return freshToken ?? undefined;
+  } catch (error) {
+    let gitRemoteHost: string | undefined;
+    try {
+      gitRemoteHost = new URL(gitRemoteUrl).hostname;
+    } catch {
+      // ignore invalid URL for logging only
+    }
+    logger.warn("[git] credential fetch failed, continuing without auth", {
+      gitCategory: "setup",
+      gitOperation: "fetch-credentials",
+      gitOutcome: "failed",
+      applicationId,
+      gitRemoteHost,
+      ...getGitErrorFields(error),
+    });
+    return undefined;
+  }
+}
+
+async function refreshGitServiceCredentials({
+  applicationId,
+  gitRemoteUrl,
+  logger,
+  sdk,
+  service,
+  userEmail,
+  userName,
+}: {
+  applicationId: string;
+  gitRemoteUrl: string;
+  logger: Logger;
+  sdk: SuperblocksSdk;
+  service: GitService;
+  userEmail?: string;
+  userName?: string;
+}): Promise<boolean> {
+  const credentials = await fetchGitCredentials({
+    applicationId,
+    gitRemoteUrl,
+    logger,
+    sdk,
+  });
+  if (!credentials) {
+    return false;
+  }
+
+  await service.configure({ credentials, userEmail, userName });
+  return true;
+}
+
 async function bootstrapGitService({
   sdk,
   applicationId,
@@ -2038,16 +2159,6 @@ async function bootstrapGitService({
   userEmail?: string;
   superblocksBaseUrl?: string;
 }): Promise<GitService | undefined> {
-  interface GitConfigSdk {
-    getApplicationGitConfig(applicationId: string): Promise<{
-      gitRemoteUrl?: string;
-      hasCredential?: boolean;
-    } | null>;
-    getGitFreshToken(
-      host: string,
-      applicationId: string,
-    ): Promise<{ username: string; token: string }>;
-  }
   const gitConfigSdk = sdk as unknown as GitConfigSdk;
   const gitConfig = await gitConfigSdk.getApplicationGitConfig(applicationId);
   if (!gitConfig?.gitRemoteUrl) {
@@ -2055,32 +2166,14 @@ async function bootstrapGitService({
   }
 
   const service = createGitService(cwd);
-  let credentials: { username: string; token: string } | undefined;
-  let gitRemoteHost: string | undefined;
-
-  if (gitConfig.hasCredential) {
-    try {
-      const host = new URL(gitConfig.gitRemoteUrl).hostname;
-      gitRemoteHost = host;
-      const freshToken = await gitConfigSdk.getGitFreshToken(
-        host,
+  const credentials = gitConfig.hasCredential
+    ? await fetchGitCredentials({
         applicationId,
-      );
-      if (freshToken) {
-        credentials = freshToken;
-      }
-    } catch (error) {
-      logger.warn("[git] credential fetch failed, continuing without auth", {
-        gitCategory: "setup",
-        gitOperation: "fetch-credentials",
-        gitOutcome: "failed",
-        applicationId,
-        gitRemoteHost,
         gitRemoteUrl: gitConfig.gitRemoteUrl,
-        ...getGitErrorFields(error),
-      });
-    }
-  }
+        logger,
+        sdk,
+      })
+    : undefined;
 
   await service.configure({ credentials, userName, userEmail });
   logger.info("[git] configure complete, proceeding to ensureGitRepo", {

package/src/cli-replacement/disk-space.mts

@@ -3,12 +3,12 @@ import path from "node:path";
 
 /** Minimal logger surface so this helper stays decoupled from the winston
  *  instance threaded through `dev.mts` (and trivially fakeable in tests). */
-export interface ReclaimLogger {
+interface ReclaimLogger {
   info: (message: string, meta?: unknown) => void;
   warn: (message: string, meta?: unknown) => void;
 }
 
-export interface DiskSpace {
+interface DiskSpace {
   totalBytes: number;
   freeBytes: number;
   usedBytes: number;
@@ -21,12 +21,11 @@ export interface DiskSpace {
  *  `errno -28`, or the kernel string — match all three. Centralised here (the
  *  disk domain) so both the install classifier and the recovery escalation
  *  gate agree on what "still out of space" means. */
-export const DISK_FULL_PATTERN =
-  /\bENOSPC\b|no space left on device|\berrno -28\b/i;
+const DISK_FULL_PATTERN = /\bENOSPC\b|no space left on device|\berrno -28\b/i;
 
 /** The error shape `util.promisify(exec)` rejects with (stdout/stderr/message
  *  preserved separately). */
-export interface ExecLikeFailure {
+interface ExecLikeFailure {
   stdout?: string;
   stderr?: string;
   message?: string;
@@ -66,7 +65,7 @@ export async function getDiskSpace(
  *  reclaim is composition-agnostic (delete whatever exists) precisely because
  *  it only ever touches throwaway build output. `node_modules` is deliberately
  *  excluded here and gated behind `includeNodeModules` (tier 2). */
-export const RECLAIMABLE_ARTIFACTS: readonly string[] = [
+const RECLAIMABLE_ARTIFACTS: readonly string[] = [
   ".turbo",
   ".vite",
   "build",
@@ -75,7 +74,7 @@ export const RECLAIMABLE_ARTIFACTS: readonly string[] = [
   "node_modules/.vite",
 ];
 
-export interface ReclaimResult {
+interface ReclaimResult {
   /** Bytes reclaimed, measured as the increase in filesystem free space across
    *  the deletions (a `statfs` delta). O(1) — deliberately NOT a directory walk:
    *  sizing a real `node_modules` (50k–200k files) on an already-ENOSPC volume
@@ -85,7 +84,7 @@ export interface ReclaimResult {
   removed: string[];
 }
 
-export interface ReclaimOptions {
+interface ReclaimOptions {
   /** Also remove `node_modules` — the tier-2 lever. After an ENOSPC mid-
    *  install the tree is half-written anyway, so a clean reinstall is the
    *  correct recovery AND it collapses the "old tree + new tree" 2× peak that
@@ -142,7 +141,7 @@ export async function reclaimDiskSpace(
   return { bytesFreed, removed };
 }
 
-export interface DiskRecoveryResult {
+interface DiskRecoveryResult {
   recovered: boolean;
   /** The error from the final failed install attempt, when recovery failed —
    *  so the caller can reclassify it for the most accurate surfaced error. */

package/src/cli-replacement/home-npmrc.mts

@@ -108,7 +108,7 @@ export function superblocksNpmrcBackupPath(homeDir?: string): string {
  * success from the dev-startup point of view (the writer is best-effort
  * and never throws).
  */
-export type SyncHomeNpmrcOutcome =
+type SyncHomeNpmrcOutcome =
   /** Config is set and `~/.superblocks/npmrc` was created or rewritten. */
   | "written"
   /**
@@ -160,7 +160,7 @@ export type SyncHomeNpmrcOutcome =
   /** The sync failed; the file is unchanged. Details in the warn log. */
   | "error";
 
-export interface SyncHomeNpmrcResult {
+interface SyncHomeNpmrcResult {
   outcome: SyncHomeNpmrcOutcome;
   /** Absolute path that was inspected / mutated. */
   path: string;
@@ -168,7 +168,7 @@ export interface SyncHomeNpmrcResult {
   source?: NpmRegistryFetchResult["source"];
 }
 
-export interface SyncHomeNpmrcDeps {
+interface SyncHomeNpmrcDeps {
   /**
    * Pre-constructed client with the LD-flag check, JWT provider, and
    * `refreshJwt` hook bound. We deliberately do not instantiate one

package/src/cli-replacement/normalize-workspace-protocol.ts

@@ -23,7 +23,7 @@ const DEPENDENCY_BUCKETS = [
 
 const WORKSPACE_PROTOCOL = "workspace:";
 
-export interface NormalizeResult {
+interface NormalizeResult {
   changed: boolean;
   warnings: string[];
   packageJson: PackageJson;

package/src/cli-replacement/package-json-snapshot.mts

@@ -10,7 +10,7 @@ export const MANAGED_PACKAGE_DEPENDENCIES = [
   SUPERBLOCKS_SDK_API_PACKAGE,
 ] as const;
 
-export const MANAGED_OVERRIDE_PACKAGES = ["zod"] as const;
+const MANAGED_OVERRIDE_PACKAGES = ["zod"] as const;
 
 export const PACKAGE_DEPENDENCY_FIELDS = [
   "dependencies",

package/src/cli-replacement/post-upgrade-lockfile-strip.mts

@@ -66,7 +66,7 @@ const CLI_PACKAGE_NAMES = new Set<string>([
  * Injectable subset of `child_process.exec` so tests can stub the
  * `which`/`where` lookup without spawning a real subprocess.
  */
-export type WhichRunner = (binary: string) => Promise<string>;
+type WhichRunner = (binary: string) => Promise<string>;
 
 const defaultWhichRunner: WhichRunner = async (binary) => {
   const cmd = process.platform === "win32" ? "where" : "which";
@@ -186,7 +186,7 @@ export async function findGlobalCliInstallDir(
   return undefined;
 }
 
-export interface StripUpgradedCliLockfilesOptions {
+interface StripUpgradedCliLockfilesOptions {
   /**
    * Pre-resolved install root. If omitted, `findGlobalCliInstallDir` is used.
    * Tests pass this directly to avoid stubbing `which`.

package/src/cli-replacement/version-detection.ts

@@ -23,7 +23,7 @@ const logger = getLogger();
 /**
  * Package version information returned by version detection.
  */
-export interface PackageVersionInfo {
+interface PackageVersionInfo {
   /** Semantic version string (e.g., "2.0.0-next.1") */
   version: string;
   /** Optional package alias for ephemeral builds (e.g., "@superblocksteam/cli-ephemeral") */

package/src/client.ts

@@ -998,7 +998,7 @@ export async function fetchOrganizationSummary(
   }
 }
 
-export interface CreateApplicationParams {
+interface CreateApplicationParams {
   cliVersion: string;
   token: string;
   superblocksBaseUrl: string;
@@ -2046,7 +2046,7 @@ export async function fetchAuditLogs({
   }
 }
 
-export interface AuditEventFilters {
+interface AuditEventFilters {
   timeStart: string;
   timeEnd: string;
   activityId?: number;
@@ -2062,12 +2062,12 @@ export interface AuditEventFilters {
   status?: number;
 }
 
-export interface AuditEventsResponse {
+interface AuditEventsResponse {
   events: OCSFAuditEvent[];
   next_cursor: string | null;
 }
 
-export interface ChatHistoryMessage {
+interface ChatHistoryMessage {
   id: string;
   created: string;
   chatPayload: AiChatMessagePayload;
@@ -2798,13 +2798,13 @@ export interface UsageRecordRow {
   source: string;
 }
 
-export interface AgentUsageRow {
+interface AgentUsageRow {
   agentId: string;
   name: string;
   creditsUsed: number;
 }
 
-export interface ApplicationUsageRow {
+interface ApplicationUsageRow {
   applicationId: string;
   applicationName: string;
   creditsUsed: number;

package/src/collect-sdk-apis.mts

@@ -6,15 +6,15 @@ import {
 } from "./extract-api-integrations.mjs";
 import { parseSdkRegistryWithExportNames } from "./parse-sdk-registry.mjs";
 
-export type SdkApiEntry = {
+type SdkApiEntry = {
   entryPoint: string;
   exportName?: string;
   integrations?: IntegrationInfo[];
 };
 
-export type SdkApisResult = Record<string, SdkApiEntry>;
+type SdkApisResult = Record<string, SdkApiEntry>;
 
-export type CollectSdkApisFs = {
+type CollectSdkApisFs = {
   pathExists: (p: string) => Promise<boolean>;
   readFile: (p: string, encoding: "utf-8") => Promise<string>;
 };

package/src/dev-utils/dedupe-async.ts

@@ -14,7 +14,7 @@
 // as `double free or corruption (fasttop)` from glibc and SIGABRT killing the
 // process before it can exit cleanly.
 
-export interface DedupeAsyncOptions<TArgs extends unknown[]> {
+interface DedupeAsyncOptions<TArgs extends unknown[]> {
   /**
    * Optional callback invoked when a duplicate call is detected. The first
    * caller's invocation runs normally; this fires for the 2nd, 3rd, …

package/src/dev-utils/dev-server-metrics.mts

@@ -3,8 +3,9 @@
  *
  * Records counters and histograms for the dev-server endpoints that the editor
  * and SABS hit during a live-edit connection: `/_sb_health`, `/_sb_connect`,
- * `/_sb_activate`, `/_sb_disconnect`, `/_sb_status`, `/_sb_activity`, plus
- * WebSocket upgrades, Vite eager-init, and warm-standby activation.
+ * `/_sb_activate`, `/_sb_disconnect`, `/_sb_status`, `/_sb_activity`,
+ * `/_sb_update_token`, plus WebSocket upgrades, Vite eager-init, and
+ * warm-standby activation.
  *
  * Metrics are scoped to the dev-server's existing OTel pipeline. When telemetry
  * has not yet initialized (warm-standby pre-activation), record calls are
@@ -138,6 +139,7 @@ export type DevServerEndpoint =
   | "_sb_disconnect"
   | "_sb_status"
   | "_sb_activity"
+  | "_sb_update_token"
   | "_sb_persist"
   | "_sb_ready";