@tokenoftrust/cli 2.0.16 → 2.0.17

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "2.0.16",
+  "version": "2.0.17",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/commands/clone.mjs

@@ -287,7 +287,22 @@ export async function run(argv, ctx) {
  *   cloned: boolean, dir: string|null, head: string|null }>}
  */
 export async function checkoutTenant(client, { tenant, tag = "main", cloneDir = null, redact = (s) => s }) {
-  await client.callTool("client_switch", { tenant });
+  // The switch is LOAD-BEARING, so its refusal is the error the developer must see. When
+  // the tenant is not one of this session's clients the server refuses here with the real
+  // cause (no grant / a grant issued to a client this identity is not bound to / a grant
+  // issued after sign-in that needs a re-auth) — far more specific than the tenant_checkout
+  // refusal that follows it. Surfacing the switch's own words, with the server's nextAction,
+  // stops a genuinely-unentitled tenant from being reported as a scope-selection slip.
+  try {
+    await client.callTool("client_switch", { tenant });
+  } catch (e) {
+    throw new CliError(redact(String(e?.message || e)), {
+      next:
+        "confirm you're entitled to this store — `tot grants` lists what your session can " +
+        "act on, and `tot login` refreshes a grant issued after you signed in",
+      cause: e,
+    });
+  }
   // vc-app-binding safety-net (08-18, §5): ensure THIS developer is bound to the
   // storefront version-control app BEFORE checkout, so tenant_checkout can resolve
   // `appForCaller` for them instead of 403-ing "No version-control app is bound." The
@@ -541,6 +556,21 @@ export function checkoutError(checkout) {
     (c && (c.message || (typeof c.error === "string" ? c.error : c.error?.message))) ||
     (c && typeof c.raw === "string" && c.raw.trim() ? c.raw.trim() : null) ||
     null;
+  // Not entitled: the session resolved NO grant or client context for the asserted tenant.
+  // Distinct from both not-provisioned (the store is fine) and over-scope (you hold it but
+  // haven't switched) — and the one case where the remedy is upstream of this checkout.
+  if (
+    typeof msg === "string" &&
+    /not among the tenants your session holds|^Not entitled/i.test(msg)
+  ) {
+    return {
+      message: msg,
+      next:
+        "`tot grants` lists what your session can actually act on — a grant whose grantee " +
+        "your identity doesn't resolve to never becomes visible here; if it was issued after " +
+        "you signed in, run `tot login` to refresh, then retry",
+    };
+  }
   // The store's repo isn't provisioned yet — it isn't set up for this developer.
   if (typeof msg === "string" && /not provisioned/i.test(msg)) {
     return {