@tokenoftrust/cli 2.0.16 → 2.0.18

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "2.0.16",
+  "version": "2.0.18",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/commands/clone.mjs

@@ -287,7 +287,22 @@ export async function run(argv, ctx) {
  *   cloned: boolean, dir: string|null, head: string|null }>}
  */
 export async function checkoutTenant(client, { tenant, tag = "main", cloneDir = null, redact = (s) => s }) {
-  await client.callTool("client_switch", { tenant });
+  // The switch is LOAD-BEARING, so its refusal is the error the developer must see. When
+  // the tenant is not one of this session's clients the server refuses here with the real
+  // cause (no grant / a grant issued to a client this identity is not bound to / a grant
+  // issued after sign-in that needs a re-auth) — far more specific than the tenant_checkout
+  // refusal that follows it. Surfacing the switch's own words, with the server's nextAction,
+  // stops a genuinely-unentitled tenant from being reported as a scope-selection slip.
+  try {
+    await client.callTool("client_switch", { tenant });
+  } catch (e) {
+    throw new CliError(redact(String(e?.message || e)), {
+      next:
+        "confirm you're entitled to this store — `tot grants` lists what your session can " +
+        "act on, and `tot login` refreshes a grant issued after you signed in",
+      cause: e,
+    });
+  }
   // vc-app-binding safety-net (08-18, §5): ensure THIS developer is bound to the
   // storefront version-control app BEFORE checkout, so tenant_checkout can resolve
   // `appForCaller` for them instead of 403-ing "No version-control app is bound." The
@@ -541,6 +556,21 @@ export function checkoutError(checkout) {
     (c && (c.message || (typeof c.error === "string" ? c.error : c.error?.message))) ||
     (c && typeof c.raw === "string" && c.raw.trim() ? c.raw.trim() : null) ||
     null;
+  // Not entitled: the session resolved NO grant or client context for the asserted tenant.
+  // Distinct from both not-provisioned (the store is fine) and over-scope (you hold it but
+  // haven't switched) — and the one case where the remedy is upstream of this checkout.
+  if (
+    typeof msg === "string" &&
+    /not among the tenants your session holds|^Not entitled/i.test(msg)
+  ) {
+    return {
+      message: msg,
+      next:
+        "`tot grants` lists what your session can actually act on — a grant whose grantee " +
+        "your identity doesn't resolve to never becomes visible here; if it was issued after " +
+        "you signed in, run `tot login` to refresh, then retry",
+    };
+  }
   // The store's repo isn't provisioned yet — it isn't set up for this developer.
   if (typeof msg === "string" && /not provisioned/i.test(msg)) {
     return {

package/src/commands/dev.mjs

@@ -1039,6 +1039,36 @@ function sourceVersionKey(source) {
  * @param {{ log?: (m: string) => void, cacheRoot?: string }} [opts]
  * @returns {Promise<string>} the cached, installed runner tree's root directory.
  */
+/**
+ * Rename the runner's shipped lockfile back to the name pnpm reads, so a pinned runner
+ * version pins the graph it RUNS rather than just its own source.
+ *
+ * npm strips `pnpm-lock.yaml` from published tarballs unconditionally (the same
+ * always-excluded list as package-lock.json / yarn.lock), so build-runner.mjs emits a
+ * second copy as `pnpm-lock.runner.yaml`, which survives the publish. Verified both
+ * directions: the published 2.0.33 tarball carries pnpm-workspace.yaml and no lock,
+ * and a packed 2.0.34 tree delivers only the alias.
+ *
+ * Why it matters: without the restore, every developer resolves their own graph. Runner
+ * 2.0.33 was built against vite 8.1.0 / rolldown 1.1.3 and installed as 8.2.2 / 1.2.8,
+ * where an .astro parse regression failed the dependency scan — and Vite answers a
+ * failed scan by skipping pre-bundling for the whole app rather than erroring, silently
+ * disabling the SSR prebundle the renderer's own config depends on. Pages still
+ * rendered, so nothing caught it.
+ *
+ * Never clobbers an existing `pnpm-lock.yaml`: the entitled .tar.gz path is a plain
+ * tarball rather than an npm publish, so it already carries the real name.
+ * @param {string} dir the extracted runner tree
+ * @returns {boolean} whether a lock was restored
+ */
+export function restoreShippedLock(dir) {
+  const alias = join(dir, "pnpm-lock.runner.yaml");
+  const real = join(dir, "pnpm-lock.yaml");
+  if (!existsSync(alias) || existsSync(real)) return false;
+  renameSync(alias, real);
+  return true;
+}
+
 export async function installRunnerTarball(
   { source, version, isUrl = true, strip = 0, integrity = null },
   { log = (m) => console.error(m), cacheRoot = RENDERER_CACHE_ROOT } = {},
@@ -1137,6 +1167,8 @@ export async function installRunnerTarball(
         /** @type {any} */ (err).permanent = true;
         throw err;
       }
+      // Must run BEFORE the install, or it has no effect at all.
+      restoreShippedLock(stagingDir);
       // Pin the runner install to PUBLIC npm. The moat-free runner has only public
       // deps, but the HOST's global ~/.npmrc may point `registry` at a private
       // mirror (an internal proxy that 502s, or one an invited developer can't