@tokenoftrust/cli 2.2.7 → 2.2.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "2.2.7",
+  "version": "2.2.8",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/commands/git-credential.mjs

@@ -165,9 +165,22 @@ export async function mintOrCacheCredential({
     /* fall through — tagFromRepoName degrades to "main" on a null repo name */
   }
   if (expectedHost && !hostMatches(originUrl, expectedHost)) return null;
-  const tag = tagFromRepoName(repoName, ctx.tenant);
 
-  const cachePath = credentialCachePath(ctx.tenant, tag, env);
+  // Prefer the tenant encoded in the git remote itself over `.tot/config.json`'s
+  // "tenant" field. The remote URL is the forge's OWN record of this checkout's repo
+  // (set once by `tenant_checkout`'s returned cloneUrl at clone time); the config file
+  // is tenant-owned, committed content a developer's own commit can set wrong at seed
+  // time or drift later — exactly what broke every client_switch/tenant_checkout call
+  // in fb-1790958790645-7j8gul / fb-1790969588649-zl3xa7. Every real tenant is
+  // provisioned with repo === owner (storefront's provisioning enforces this at every
+  // call site — buildStaffStoreIdentity, scripts/tenant/provision-gitea-repo.mjs), so
+  // the repo name IS the tenant id. Fall back to the config file only when the remote
+  // can't be read or parsed (no origin yet) — this never makes the mint MORE likely to
+  // fail than before, only less dependent on content the forge itself didn't set.
+  const tenant = repoName || ctx.tenant;
+  const tag = tagFromRepoName(repoName, tenant);
+
+  const cachePath = credentialCachePath(tenant, tag, env);
   const cached = readCachedCredential(cachePath);
   if (cached) return { username: cached.username, password: cached.password };
 
@@ -179,7 +192,7 @@ export async function mintOrCacheCredential({
     return null; // not signed in (or session unrefreshable) — nothing this helper can do
   }
   try {
-    const res = await checkout(client, { tenant: ctx.tenant, tag, cloneDir: null });
+    const res = await checkout(client, { tenant, tag, cloneDir: null });
     const cred = splitAuthedRemote(res.gitRemote || "");
     if (!cred) return null;
     const fresh = { username: cred.username, password: cred.token };
@@ -236,8 +249,12 @@ export function forgetCredential({ env = process.env, cwd = process.cwd(), expec
       }).toString().trim();
     } catch { /* no origin */ }
     if (expectedHost && !hostMatches(originUrl, expectedHost)) return;
-    const tag = tagFromRepoName(originUrl ? repoNameFromRemote(originUrl) : null, ctx.tenant);
-    dropCachedCredential(credentialCachePath(ctx.tenant, tag, env));
+    // Mirror `get`'s tenant resolution (remote-derived, falling back to the config
+    // file) so `erase` drops the SAME cache key `get` wrote, not a stale sibling.
+    const repoName = originUrl ? repoNameFromRemote(originUrl) : null;
+    const tenant = repoName || ctx.tenant;
+    const tag = tagFromRepoName(repoName, tenant);
+    dropCachedCredential(credentialCachePath(tenant, tag, env));
   } catch {
     /* erase is advisory — never fail git over it */
   }