@superblocksteam/sdk 2.0.141-next.0 → 2.0.141-next.2

package/src/cli-replacement/dev.mts

@@ -17,6 +17,7 @@ import {
   buildGithubSuperblocksSyncWorkflowFromBaseUrl,
   ConflictError,
   DEFAULT_NON_GIT_BRANCH,
+  isGitAuthErrorMessage,
   isGitHubRemoteUrl,
   SUPERBLOCKS_LIVE_GIT_BRANCH,
 } from "@superblocksteam/shared";
@@ -1007,6 +1008,7 @@ export async function dev(options: {
 
       const fsOperationQueue = new OperationQueue();
       let activeDbfsBranchName = applicationConfig?.branchName ?? "main";
+      let devStartupGitBootstrapAuthFailed = false;
       let devStartupGitOutcome:
         | "skipped_no_remote"
         | "bootstrap_failed"
@@ -1286,6 +1288,8 @@ export async function dev(options: {
               } catch (gitError) {
                 // Init/configure/ensureGitRepo failed — repo is not usable
                 devStartupGitOutcome = "bootstrap_failed";
+                devStartupGitBootstrapAuthFailed =
+                  isGitAuthErrorMessage(gitError);
                 gitService = undefined;
                 logger.warn(
                   "[git] startup git setup failed, continuing without git",
@@ -1947,6 +1951,33 @@ export async function dev(options: {
         }
       };
 
+      const refreshRuntimeGitCredentials = async (): Promise<
+        GitService | undefined
+      > => {
+        const gitConfigSdk = sdk as unknown as GitConfigSdk;
+        const gitConfig = await gitConfigSdk.getApplicationGitConfig(
+          applicationConfig.id,
+        );
+        if (!gitConfig?.gitRemoteUrl) {
+          return undefined;
+        }
+
+        if (gitService) {
+          const refreshed = await refreshGitServiceCredentials({
+            applicationId: applicationConfig.id,
+            gitRemoteUrl: gitConfig.gitRemoteUrl,
+            logger,
+            sdk,
+            service: gitService,
+            userEmail: gitUserEmail,
+            userName: gitUserName,
+          });
+          return refreshed ? gitService : undefined;
+        }
+
+        return activateRuntimeGitService();
+      };
+
       const httpServer = await tracer.startActiveSpan(
         "createDevServer",
         async (span) => {
@@ -1958,10 +1989,13 @@ export async function dev(options: {
               fsOperationQueue,
               syncService: syncService,
               lockService: lockService,
+              tokenManager,
               aiService: aiService,
               gitService: gitService,
+              gitBootstrapAuthFailed: devStartupGitBootstrapAuthFailed,
               gitBootstrapFailed: devStartupGitOutcome === "bootstrap_failed",
               activateGitService: activateRuntimeGitService,
+              refreshGitCredentials: refreshRuntimeGitCredentials,
               snapshotManager: snapshotManager,
               logger: options.logger,
               sdk,
@@ -2030,6 +2064,84 @@ export async function dev(options: {
 // Git sync helpers
 // ---------------------------------------------------------------------------
 
+interface GitConfigSdk {
+  getApplicationGitConfig(applicationId: string): Promise<{
+    gitRemoteUrl?: string;
+    hasCredential?: boolean;
+  } | null>;
+  getGitFreshToken(
+    host: string,
+    applicationId: string,
+  ): Promise<{ username: string; token: string }>;
+}
+
+async function fetchGitCredentials({
+  applicationId,
+  gitRemoteUrl,
+  logger,
+  sdk,
+}: {
+  applicationId: string;
+  gitRemoteUrl: string;
+  logger: Logger;
+  sdk: SuperblocksSdk;
+}): Promise<{ username: string; token: string } | undefined> {
+  const gitConfigSdk = sdk as unknown as GitConfigSdk;
+
+  try {
+    const host = new URL(gitRemoteUrl).hostname;
+    const freshToken = await gitConfigSdk.getGitFreshToken(host, applicationId);
+    return freshToken ?? undefined;
+  } catch (error) {
+    let gitRemoteHost: string | undefined;
+    try {
+      gitRemoteHost = new URL(gitRemoteUrl).hostname;
+    } catch {
+      // ignore invalid URL for logging only
+    }
+    logger.warn("[git] credential fetch failed, continuing without auth", {
+      gitCategory: "setup",
+      gitOperation: "fetch-credentials",
+      gitOutcome: "failed",
+      applicationId,
+      gitRemoteHost,
+      ...getGitErrorFields(error),
+    });
+    return undefined;
+  }
+}
+
+async function refreshGitServiceCredentials({
+  applicationId,
+  gitRemoteUrl,
+  logger,
+  sdk,
+  service,
+  userEmail,
+  userName,
+}: {
+  applicationId: string;
+  gitRemoteUrl: string;
+  logger: Logger;
+  sdk: SuperblocksSdk;
+  service: GitService;
+  userEmail?: string;
+  userName?: string;
+}): Promise<boolean> {
+  const credentials = await fetchGitCredentials({
+    applicationId,
+    gitRemoteUrl,
+    logger,
+    sdk,
+  });
+  if (!credentials) {
+    return false;
+  }
+
+  await service.configure({ credentials, userEmail, userName });
+  return true;
+}
+
 async function bootstrapGitService({
   sdk,
   applicationId,
@@ -2047,16 +2159,6 @@ async function bootstrapGitService({
   userEmail?: string;
   superblocksBaseUrl?: string;
 }): Promise<GitService | undefined> {
-  interface GitConfigSdk {
-    getApplicationGitConfig(applicationId: string): Promise<{
-      gitRemoteUrl?: string;
-      hasCredential?: boolean;
-    } | null>;
-    getGitFreshToken(
-      host: string,
-      applicationId: string,
-    ): Promise<{ username: string; token: string }>;
-  }
   const gitConfigSdk = sdk as unknown as GitConfigSdk;
   const gitConfig = await gitConfigSdk.getApplicationGitConfig(applicationId);
   if (!gitConfig?.gitRemoteUrl) {
@@ -2064,32 +2166,14 @@ async function bootstrapGitService({
   }
 
   const service = createGitService(cwd);
-  let credentials: { username: string; token: string } | undefined;
-  let gitRemoteHost: string | undefined;
-
-  if (gitConfig.hasCredential) {
-    try {
-      const host = new URL(gitConfig.gitRemoteUrl).hostname;
-      gitRemoteHost = host;
-      const freshToken = await gitConfigSdk.getGitFreshToken(
-        host,
+  const credentials = gitConfig.hasCredential
+    ? await fetchGitCredentials({
         applicationId,
-      );
-      if (freshToken) {
-        credentials = freshToken;
-      }
-    } catch (error) {
-      logger.warn("[git] credential fetch failed, continuing without auth", {
-        gitCategory: "setup",
-        gitOperation: "fetch-credentials",
-        gitOutcome: "failed",
-        applicationId,
-        gitRemoteHost,
         gitRemoteUrl: gitConfig.gitRemoteUrl,
-        ...getGitErrorFields(error),
-      });
-    }
-  }
+        logger,
+        sdk,
+      })
+    : undefined;
 
   await service.configure({ credentials, userName, userEmail });
   logger.info("[git] configure complete, proceeding to ensureGitRepo", {

package/src/cli-replacement/disk-space.mts

@@ -3,12 +3,12 @@ import path from "node:path";
 
 /** Minimal logger surface so this helper stays decoupled from the winston
  *  instance threaded through `dev.mts` (and trivially fakeable in tests). */
-export interface ReclaimLogger {
+interface ReclaimLogger {
   info: (message: string, meta?: unknown) => void;
   warn: (message: string, meta?: unknown) => void;
 }
 
-export interface DiskSpace {
+interface DiskSpace {
   totalBytes: number;
   freeBytes: number;
   usedBytes: number;
@@ -21,12 +21,11 @@ export interface DiskSpace {
  *  `errno -28`, or the kernel string — match all three. Centralised here (the
  *  disk domain) so both the install classifier and the recovery escalation
  *  gate agree on what "still out of space" means. */
-export const DISK_FULL_PATTERN =
-  /\bENOSPC\b|no space left on device|\berrno -28\b/i;
+const DISK_FULL_PATTERN = /\bENOSPC\b|no space left on device|\berrno -28\b/i;
 
 /** The error shape `util.promisify(exec)` rejects with (stdout/stderr/message
  *  preserved separately). */
-export interface ExecLikeFailure {
+interface ExecLikeFailure {
   stdout?: string;
   stderr?: string;
   message?: string;
@@ -66,7 +65,7 @@ export async function getDiskSpace(
  *  reclaim is composition-agnostic (delete whatever exists) precisely because
  *  it only ever touches throwaway build output. `node_modules` is deliberately
  *  excluded here and gated behind `includeNodeModules` (tier 2). */
-export const RECLAIMABLE_ARTIFACTS: readonly string[] = [
+const RECLAIMABLE_ARTIFACTS: readonly string[] = [
   ".turbo",
   ".vite",
   "build",
@@ -75,7 +74,7 @@ export const RECLAIMABLE_ARTIFACTS: readonly string[] = [
   "node_modules/.vite",
 ];
 
-export interface ReclaimResult {
+interface ReclaimResult {
   /** Bytes reclaimed, measured as the increase in filesystem free space across
    *  the deletions (a `statfs` delta). O(1) — deliberately NOT a directory walk:
    *  sizing a real `node_modules` (50k–200k files) on an already-ENOSPC volume
@@ -85,7 +84,7 @@ export interface ReclaimResult {
   removed: string[];
 }
 
-export interface ReclaimOptions {
+interface ReclaimOptions {
   /** Also remove `node_modules` — the tier-2 lever. After an ENOSPC mid-
    *  install the tree is half-written anyway, so a clean reinstall is the
    *  correct recovery AND it collapses the "old tree + new tree" 2× peak that
@@ -142,7 +141,7 @@ export async function reclaimDiskSpace(
   return { bytesFreed, removed };
 }
 
-export interface DiskRecoveryResult {
+interface DiskRecoveryResult {
   recovered: boolean;
   /** The error from the final failed install attempt, when recovery failed —
    *  so the caller can reclassify it for the most accurate surfaced error. */

package/src/cli-replacement/home-npmrc.mts

@@ -108,7 +108,7 @@ export function superblocksNpmrcBackupPath(homeDir?: string): string {
  * success from the dev-startup point of view (the writer is best-effort
  * and never throws).
  */
-export type SyncHomeNpmrcOutcome =
+type SyncHomeNpmrcOutcome =
   /** Config is set and `~/.superblocks/npmrc` was created or rewritten. */
   | "written"
   /**
@@ -160,7 +160,7 @@ export type SyncHomeNpmrcOutcome =
   /** The sync failed; the file is unchanged. Details in the warn log. */
   | "error";
 
-export interface SyncHomeNpmrcResult {
+interface SyncHomeNpmrcResult {
   outcome: SyncHomeNpmrcOutcome;
   /** Absolute path that was inspected / mutated. */
   path: string;
@@ -168,7 +168,7 @@ export interface SyncHomeNpmrcResult {
   source?: NpmRegistryFetchResult["source"];
 }
 
-export interface SyncHomeNpmrcDeps {
+interface SyncHomeNpmrcDeps {
   /**
    * Pre-constructed client with the LD-flag check, JWT provider, and
    * `refreshJwt` hook bound. We deliberately do not instantiate one

package/src/cli-replacement/normalize-workspace-protocol.ts

@@ -23,7 +23,7 @@ const DEPENDENCY_BUCKETS = [
 
 const WORKSPACE_PROTOCOL = "workspace:";
 
-export interface NormalizeResult {
+interface NormalizeResult {
   changed: boolean;
   warnings: string[];
   packageJson: PackageJson;

package/src/cli-replacement/package-json-snapshot.mts

@@ -10,7 +10,7 @@ export const MANAGED_PACKAGE_DEPENDENCIES = [
   SUPERBLOCKS_SDK_API_PACKAGE,
 ] as const;
 
-export const MANAGED_OVERRIDE_PACKAGES = ["zod"] as const;
+const MANAGED_OVERRIDE_PACKAGES = ["zod"] as const;
 
 export const PACKAGE_DEPENDENCY_FIELDS = [
   "dependencies",

package/src/cli-replacement/post-upgrade-lockfile-strip.mts

@@ -66,7 +66,7 @@ const CLI_PACKAGE_NAMES = new Set<string>([
  * Injectable subset of `child_process.exec` so tests can stub the
  * `which`/`where` lookup without spawning a real subprocess.
  */
-export type WhichRunner = (binary: string) => Promise<string>;
+type WhichRunner = (binary: string) => Promise<string>;
 
 const defaultWhichRunner: WhichRunner = async (binary) => {
   const cmd = process.platform === "win32" ? "where" : "which";
@@ -186,7 +186,7 @@ export async function findGlobalCliInstallDir(
   return undefined;
 }
 
-export interface StripUpgradedCliLockfilesOptions {
+interface StripUpgradedCliLockfilesOptions {
   /**
    * Pre-resolved install root. If omitted, `findGlobalCliInstallDir` is used.
    * Tests pass this directly to avoid stubbing `which`.

package/src/cli-replacement/version-detection.ts

@@ -23,7 +23,7 @@ const logger = getLogger();
 /**
  * Package version information returned by version detection.
  */
-export interface PackageVersionInfo {
+interface PackageVersionInfo {
   /** Semantic version string (e.g., "2.0.0-next.1") */
   version: string;
   /** Optional package alias for ephemeral builds (e.g., "@superblocksteam/cli-ephemeral") */

package/src/client.ts

@@ -998,7 +998,7 @@ export async function fetchOrganizationSummary(
   }
 }
 
-export interface CreateApplicationParams {
+interface CreateApplicationParams {
   cliVersion: string;
   token: string;
   superblocksBaseUrl: string;
@@ -2046,7 +2046,7 @@ export async function fetchAuditLogs({
   }
 }
 
-export interface AuditEventFilters {
+interface AuditEventFilters {
   timeStart: string;
   timeEnd: string;
   activityId?: number;
@@ -2062,12 +2062,12 @@ export interface AuditEventFilters {
   status?: number;
 }
 
-export interface AuditEventsResponse {
+interface AuditEventsResponse {
   events: OCSFAuditEvent[];
   next_cursor: string | null;
 }
 
-export interface ChatHistoryMessage {
+interface ChatHistoryMessage {
   id: string;
   created: string;
   chatPayload: AiChatMessagePayload;
@@ -2798,13 +2798,13 @@ export interface UsageRecordRow {
   source: string;
 }
 
-export interface AgentUsageRow {
+interface AgentUsageRow {
   agentId: string;
   name: string;
   creditsUsed: number;
 }
 
-export interface ApplicationUsageRow {
+interface ApplicationUsageRow {
   applicationId: string;
   applicationName: string;
   creditsUsed: number;

package/src/collect-sdk-apis.mts

@@ -6,15 +6,15 @@ import {
 } from "./extract-api-integrations.mjs";
 import { parseSdkRegistryWithExportNames } from "./parse-sdk-registry.mjs";
 
-export type SdkApiEntry = {
+type SdkApiEntry = {
   entryPoint: string;
   exportName?: string;
   integrations?: IntegrationInfo[];
 };
 
-export type SdkApisResult = Record<string, SdkApiEntry>;
+type SdkApisResult = Record<string, SdkApiEntry>;
 
-export type CollectSdkApisFs = {
+type CollectSdkApisFs = {
   pathExists: (p: string) => Promise<boolean>;
   readFile: (p: string, encoding: "utf-8") => Promise<string>;
 };

package/src/dev-utils/dedupe-async.ts

@@ -14,7 +14,7 @@
 // as `double free or corruption (fasttop)` from glibc and SIGABRT killing the
 // process before it can exit cleanly.
 
-export interface DedupeAsyncOptions<TArgs extends unknown[]> {
+interface DedupeAsyncOptions<TArgs extends unknown[]> {
   /**
    * Optional callback invoked when a duplicate call is detected. The first
    * caller's invocation runs normally; this fires for the 2nd, 3rd, …

package/src/dev-utils/dev-server-metrics.mts

@@ -3,8 +3,9 @@
  *
  * Records counters and histograms for the dev-server endpoints that the editor
  * and SABS hit during a live-edit connection: `/_sb_health`, `/_sb_connect`,
- * `/_sb_activate`, `/_sb_disconnect`, `/_sb_status`, `/_sb_activity`, plus
- * WebSocket upgrades, Vite eager-init, and warm-standby activation.
+ * `/_sb_activate`, `/_sb_disconnect`, `/_sb_status`, `/_sb_activity`,
+ * `/_sb_update_token`, plus WebSocket upgrades, Vite eager-init, and
+ * warm-standby activation.
  *
  * Metrics are scoped to the dev-server's existing OTel pipeline. When telemetry
  * has not yet initialized (warm-standby pre-activation), record calls are
@@ -138,6 +139,7 @@ export type DevServerEndpoint =
   | "_sb_disconnect"
   | "_sb_status"
   | "_sb_activity"
+  | "_sb_update_token"
   | "_sb_persist"
   | "_sb_ready";
 

package/src/dev-utils/dev-server.mts

@@ -24,8 +24,11 @@ import {
   JwtVerifier,
   SUPERBLOCKS_LIVE_GIT_BRANCH,
 } from "@superblocksteam/shared";
-import { getSuperblocksResourceConfigIfExists } from "@superblocksteam/util";
-import { getLocalTokenWithUrlIfExists } from "@superblocksteam/util";
+import {
+  getLocalTokenWithUrlIfExists,
+  getSuperblocksResourceConfigIfExists,
+  type ITokenManager,
+} from "@superblocksteam/util";
 import {
   type FileSyncPluginParams,
   fileSyncVitePlugin,
@@ -71,6 +74,7 @@ import {
   isRecoverableShutdownError,
   parseIsWarm,
 } from "./fatal-exit.mjs";
+import { OPTIMIZE_DEPS_CONFIG } from "./optimize-deps-config.mjs";
 import { prepareInPlaceRestart } from "./prepare-in-place-restart.mjs";
 import {
   formatViteDevServerStartedLog,
@@ -107,6 +111,8 @@ function endpointForUrl(
       return "_sb_status";
     case "/_sb_activity":
       return "_sb_activity";
+    case "/_sb_update_token":
+      return "_sb_update_token";
     case "/_sb_persist":
       return "_sb_persist";
     case "/_sb_ready":
@@ -151,21 +157,6 @@ function reactPlugin() {
   });
 }
 
-/**
- * Shared `optimizeDeps` config for both pre-warm and activation Vite servers.
- *
- * Vite includes the stringified `optimizeDeps` config in its dep cache hash,
- * so both servers must use identical config or activation will discard the
- * pre-warmed cache and re-run full dependency optimization.
- */
-const OPTIMIZE_DEPS_CONFIG: UserConfig["optimizeDeps"] = {
-  esbuildOptions: {
-    supported: {
-      destructuring: true,
-    },
-  },
-};
-
 /**
  * Vite `resolve` config shared by both the activation and pre-warm servers.
  *
@@ -438,10 +429,13 @@ interface CreateDevServerOptions {
   fsOperationQueue: OperationQueue;
   syncService?: SyncService;
   lockService?: LockService;
+  tokenManager?: ITokenManager;
   aiService?: AiService;
   gitService?: GitService;
+  gitBootstrapAuthFailed?: boolean;
   gitBootstrapFailed?: boolean;
   activateGitService?: () => Promise<GitService | undefined>;
+  refreshGitCredentials?: () => Promise<GitService | undefined>;
   snapshotManager?: SnapshotManager;
   /* For redirecting output, like when running outside of the CLI */
   logger?: (...messages: unknown[]) => void;
@@ -571,10 +565,13 @@ export async function createDevServer({
   fsOperationQueue,
   syncService,
   lockService,
+  tokenManager,
   aiService,
   gitService,
+  gitBootstrapAuthFailed,
   gitBootstrapFailed,
   activateGitService,
+  refreshGitCredentials,
   snapshotManager,
   logger: loggerOverride,
   port,
@@ -1369,10 +1366,13 @@ export async function createDevServer({
       fsOperationQueue,
       syncService,
       lockService,
+      tokenManager,
       aiService,
       gitService,
+      gitBootstrapAuthFailed,
       gitBootstrapFailed,
       activateGitService,
+      refreshGitCredentials,
       snapshotManager,
       checkAuthorization,
       logger: loggerOverride,
@@ -1443,10 +1443,13 @@ async function startVite({
   fsOperationQueue,
   syncService,
   lockService,
+  tokenManager,
   aiService,
   gitService,
+  gitBootstrapAuthFailed,
   gitBootstrapFailed,
   activateGitService,
+  refreshGitCredentials,
   snapshotManager,
   checkAuthorization,
   logger: loggerOverride,
@@ -1532,10 +1535,13 @@ async function startVite({
           fsOperationQueue,
           syncService,
           lockService,
+          tokenManager,
           aiService,
           gitService,
+          gitBootstrapAuthFailed,
           gitBootstrapFailed,
           activateGitService,
+          refreshGitCredentials,
           snapshotManager,
           httpServer,
           checkAuthorization,