@tokenoftrust/cli 4.1.0 → 4.2.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "4.1.0",
+  "version": "4.2.1",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/auth.mjs

@@ -173,18 +173,24 @@ export async function resolveDeveloperSession(client, env, deps = {}) {
         { reason: "expired", hint: developerCredentialRecoveryHint(creds) },
       );
     }
+    const refreshGrant = { refreshToken: creds.refreshToken, clientId: creds.clientId };
     let refreshed;
-    try {
-      refreshed = await refreshAccessToken(
-        creds.tokenEndpoint,
-        { refreshToken: creds.refreshToken, clientId: creds.clientId },
-        fetchImpl,
-      );
-    } catch (e) {
-      throw new AuthUnavailableError(
-        "couldn't refresh your Token of Trust session.",
-        { reason: "refreshFailed", hint: developerCredentialRecoveryHint(creds) },
-      );
+    // One retry: a single token-endpoint failure is not "you are not signed in".
+    for (let attempt = 0; attempt < 2; attempt++) {
+      try {
+        refreshed = await refreshAccessToken(creds.tokenEndpoint, refreshGrant, fetchImpl);
+        break;
+      } catch {
+        if (attempt === 1) {
+          throw new AuthUnavailableError(
+            "couldn't refresh your Token of Trust session.",
+            {
+              reason: "refreshFailed",
+              hint: `the refresh failed. ${developerCredentialRecoveryHint(creds)}`,
+            },
+          );
+        }
+      }
     }
     const prior = creds;
     creds = credentialsFromToken({

package/src/commands/submit.mjs

@@ -1583,11 +1583,17 @@ export async function run(argv, ctx, {
     const diagnostic = recordDiagnostic(e, {
       command: verb, operation: "session_establish", required: true, degraded: false,
     }, env);
-    const note = e instanceof AuthUnavailableError
-      ? `Candidate not created: ${e.hint || "developer sign-in is required"}.`
+    const authFailure = e instanceof AuthUnavailableError;
+    const note = authFailure
+      ? `Candidate not created: ${e.reason}: ${e.message}${e.hint ? ` ${e.hint}` : ""}`
       : `Candidate not created: couldn't reach Token of Trust (${describeReadbackError(e)}).`;
     if (!args.json) {
-      console.error(fail(note, "run `tot login`, then re-run; no candidate ref was pushed"));
+      // The hint already states the next step. A second line that always says
+      // `tot login` flattens refreshFailed into "you are not signed in".
+      console.error(fail(
+        note,
+        authFailure ? null : "run `tot login`, then re-run; no candidate ref was pushed",
+      ));
       console.error(`  → ${diagnosticReference(diagnostic, env)}`);
     }
     emitJson(args, buildJsonResult({