@togglhq/cli 1.6.10 → 1.6.11

package/build/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { n as CommanderError, t as createProgram } from "./program-Cl1_dH7S.js";
+import { n as CommanderError, t as createProgram } from "./program-D4ljmpVV.js";
 //#region src/cli.ts
 try {
 	await createProgram({ enableUpdateNotification: true }).parseAsync(process.argv);

package/build/index.js

@@ -1,2 +1,2 @@
-import { t as createProgram } from "./program-Cl1_dH7S.js";
+import { t as createProgram } from "./program-D4ljmpVV.js";
 export { createProgram };

package/build/{program-Cl1_dH7S.js → program-D4ljmpVV.js}

@@ -11730,6 +11730,10 @@ function openAuthBrowser(url) {
 	});
 }
 const TOGGL_OAUTH_CLIENT_ID = "000000";
+/** Production accounts-be client for hosted `/focus/cli/auth-code` redirects. */
+const TOGGL_OAUTH_MANUAL_CLIENT_ID = "2ca88f39-18c5-4686-9101-3d3b7bd24470";
+/** Staging accounts-be client for hosted `/focus/cli/auth-code` redirects. */
+const TOGGL_OAUTH_MANUAL_STAGING_CLIENT_ID = "88972024-c0b3-46d1-8191-e48fb876434c";
 const TOGGL_OAUTH_CALLBACK_PORT = 8716;
 const TOGGL_OAUTH_LOGIN_TIMEOUT_MS = 12e4;
 const TOGGL_OAUTH_MANUAL_CALLBACK_PATH = "/focus/cli/auth-code";
@@ -11743,6 +11747,16 @@ function togglOAuthRedirectUri(port = TOGGL_OAUTH_CALLBACK_PORT) {
 function togglOAuthManualRedirectUri(accountsApiUrl) {
 	return `${accountsApiUrl.replace(/\/$/, "")}${TOGGL_OAUTH_MANUAL_CALLBACK_PATH}`;
 }
+/**
+* Localhost CLI login keeps the test client (`000000`, domain `http://localhost`).
+* Manual/headless login uses dedicated first-party clients whose domain prefixes
+* match the hosted auth-code page. Do not send `000000` with a hosted redirect.
+*/
+function resolveTogglOAuthClientId(flowMode, accountsApiUrl) {
+	if (flowMode !== "manual") return TOGGL_OAUTH_CLIENT_ID;
+	if (accountsApiUrl.replace(/\/$/, "") === "https://accounts.toggl.space") return TOGGL_OAUTH_MANUAL_STAGING_CLIENT_ID;
+	return TOGGL_OAUTH_MANUAL_CLIENT_ID;
+}
 const BACKGROUND_DARK_SVG = `<svg width="1440" height="900" viewBox="0 0 1440 900" fill="none" xmlns="http://www.w3.org/2000/svg">
 <g clip-path="url(#clip0_11555_363)">
 <g clip-path="url(#clip1_11555_363)">
@@ -12091,12 +12105,12 @@ function waitForOAuthCallback(port = TOGGL_OAUTH_CALLBACK_PORT, timeoutMs = TOGG
 		});
 	});
 }
-async function exchangeAuthorizationCode(accountsApiUrl, code, verifier, redirectUri = togglOAuthRedirectUri()) {
+async function exchangeAuthorizationCode(accountsApiUrl, code, verifier, redirectUri = togglOAuthRedirectUri(), clientId = TOGGL_OAUTH_CLIENT_ID) {
 	const params = new URLSearchParams({
 		grant_type: "authorization_code",
 		code,
 		code_verifier: verifier,
-		client_id: TOGGL_OAUTH_CLIENT_ID,
+		client_id: clientId,
 		redirect_uri: redirectUri
 	});
 	const response = await fetch(`${accountsApiUrl}/api/oauth/token?${params}`, { method: "POST" });
@@ -12133,7 +12147,7 @@ function resolveTogglOAuthFlowMode(options) {
 }
 function buildTogglOAuthAuthorizationUrl(options) {
 	return `${options.accountsApiUrl.replace(/\/$/, "")}/focus/login/?${new URLSearchParams({
-		client_id: TOGGL_OAUTH_CLIENT_ID,
+		client_id: resolveTogglOAuthClientId(options.flowMode, options.accountsApiUrl),
 		code_challenge: options.codeChallenge,
 		code_challenge_method: "S256",
 		redirect_uri: options.redirectUri,
@@ -12149,6 +12163,7 @@ async function obtainTogglOAuthAuthorizationCode(options) {
 		authorizationCode: options.authorizationCode
 	});
 	const redirectUri = resolveTogglOAuthRedirectUri(options.accountsApiUrl, flowMode);
+	const clientId = resolveTogglOAuthClientId(flowMode, options.accountsApiUrl);
 	const { verifier, challenge } = generateOAuthPKCE();
 	const authUrl = buildTogglOAuthAuthorizationUrl({
 		accountsApiUrl: options.accountsApiUrl,
@@ -12186,6 +12201,7 @@ async function obtainTogglOAuthAuthorizationCode(options) {
 		code,
 		verifier,
 		redirectUri,
+		clientId,
 		flowMode
 	};
 }
@@ -12251,7 +12267,7 @@ async function runCliAuthFlow(options = {}) {
 	const focusApiUrl = options.focusApiUrl ?? "https://focus.toggl.com";
 	const explicitProfileName = options.profileName;
 	log("Toggl CLI — Authentication\n");
-	const { code, verifier, redirectUri } = await obtainTogglOAuthAuthorizationCode({
+	const { code, verifier, redirectUri, clientId } = await obtainTogglOAuthAuthorizationCode({
 		accountsApiUrl,
 		flowMode: options.oauthFlowMode ?? (options.manualPrompt ? "manual" : "local"),
 		authorizationCode: options.authorizationCode,
@@ -12259,7 +12275,7 @@ async function runCliAuthFlow(options = {}) {
 		log
 	});
 	log("Exchanging authorization code...");
-	const tokens = await exchangeAuthorizationCode(accountsApiUrl, code, verifier, redirectUri);
+	const tokens = await exchangeAuthorizationCode(accountsApiUrl, code, verifier, redirectUri, clientId);
 	log("Fetching account info...");
 	const user = await fetchAccountsApiMe(accountsApiUrl, tokens.access_token);
 	if (!user.user_account_id) throw new Error("Could not determine user ID from API response.");
@@ -12281,6 +12297,7 @@ async function runCliAuthFlow(options = {}) {
 		focus_api_url: focusApiUrl,
 		accounts_api_url: accountsApiUrl,
 		authenticated_at: (/* @__PURE__ */ new Date()).toISOString(),
+		oauth_client_id: clientId,
 		workspaces
 	};
 	const profileName = explicitProfileName ?? (options.deriveProfileName ?? deriveCliProfileName)({
@@ -12308,11 +12325,11 @@ const PUBLIC_CLI_PACKAGE_SPEC = `${PUBLIC_CLI_PACKAGE_NAME}@latest`;
 function npxMcpAuthCommand() {
 	return `npx ${PUBLIC_MCP_PACKAGE_NAME} auth`;
 }
-async function refreshTokens(accountsApiUrl, refreshToken) {
+async function refreshTokens(accountsApiUrl, refreshToken, clientId = TOGGL_OAUTH_CLIENT_ID) {
 	const params = new URLSearchParams({
 		grant_type: "refresh_token",
 		refresh_token: refreshToken,
-		client_id: TOGGL_OAUTH_CLIENT_ID
+		client_id: clientId
 	});
 	const response = await fetch(`${accountsApiUrl}/api/oauth/token?${params}`, { method: "POST" });
 	if (!response.ok) {
@@ -12326,7 +12343,7 @@ async function getValidToken(scope = "cli", profile) {
 	if (!authConfig) throw new Error(scope === "cli" ? "Not authenticated. Run `toggl auth` to sign in." : `Not authenticated. Run \`${npxMcpAuthCommand()}\` to sign in.`);
 	const now = Date.now() / 1e3;
 	if (authConfig.expires_at > now + 60) return authConfig.access_token;
-	const tokens = await refreshTokens(authConfig.accounts_api_url, authConfig.refresh_token);
+	const tokens = await refreshTokens(authConfig.accounts_api_url, authConfig.refresh_token, authConfig.oauth_client_id ?? "000000");
 	authConfig.access_token = tokens.access_token;
 	authConfig.refresh_token = tokens.refresh_token;
 	authConfig.expires_at = now + tokens.expires_in;
@@ -25080,4 +25097,4 @@ Common commands:
 //#endregion
 export { CommanderError as n, createProgram as t };
 
-//# sourceMappingURL=program-Cl1_dH7S.js.map
+//# sourceMappingURL=program-D4ljmpVV.js.map

package/build/program.js

@@ -1,2 +1,2 @@
-import { t as createProgram } from "./program-Cl1_dH7S.js";
+import { t as createProgram } from "./program-D4ljmpVV.js";
 export { createProgram };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@togglhq/cli",
-  "version": "1.6.10",
+  "version": "1.6.11",
   "description": "Toggl CLI for Toggl 2.0 API operations.",
   "license": "UNLICENSED",
   "type": "module",