@tokenoftrust/cli 4.7.4 → 4.7.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "4.7.4",
+  "version": "4.7.5",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/commands/preview-token.mjs

@@ -13,7 +13,7 @@
  * `--json` prints `{ token, exp, ttlSeconds, tenantId, previewVersion }` instead.
  * Treat the token like a password: anyone holding it sees the unpublished site.
  */
-import { resolveViewerTransport } from "../viewer-session.mjs";
+import { resolveViewerTransport, describeIdentity } from "../viewer-session.mjs";
 import { missingGrantsOf, refusalHint } from "../admission-hint.mjs";
 
 const MAX_TTL_SECONDS = 24 * 3600;
@@ -115,8 +115,10 @@ export async function run(argv, ctx, deps = {}) {
     /* non-JSON error body — this endpoint answers 401/403 as plain text */
   }
   if (res.status === 401 || res.status === 403) {
+    const checked = describeIdentity(transport.identity);
     err(
-      `✗ your account can't view ${tenant}'s preview.\n\n` +
+      `✗ your account can't view ${tenant}'s preview.\n` +
+        `  checked: ${checked ?? "your `tot login` session"} at ${transport.base}\n\n` +
         `  → next: ${refusalHint(res.status, missingGrantsOf(data))}.`,
     );
     return 1;

package/src/viewer-session.mjs

@@ -133,7 +133,8 @@ export function describeCliSessionRefusal(status, body, signedInMcpUrl) {
 
 /**
  * Resolve a viewer-session transport for `tenant`. Returns
- *   { ok:true, base, authHeaders }               — base = tenant host; cookie transport
+ *   { ok:true, base, identity, authHeaders }     — base = tenant host; cookie transport;
+ *                                                  identity = { account (masked), mcp origin }
  *   { ok:false, message, hint }                  — a clean, actionable refusal
  * Never throws.
  *
@@ -144,7 +145,8 @@ export function describeCliSessionRefusal(status, body, signedInMcpUrl) {
  *   storefrontUrl?:string|null, resolveDev?:typeof resolveDeveloperSession,
  *   verbose?:boolean, log?:(s:string)=>void }} params
  * @returns {Promise<
- *   { ok:true, base:string, authHeaders:Record<string,string> } |
+ *   { ok:true, base:string, identity:{ account:string|null, mcp:string|null },
+ *     authHeaders:Record<string,string> } |
  *   { ok:false, message:string, hint:string }
  * >}
  */
@@ -231,6 +233,7 @@ export async function resolveViewerTransport({
     };
   }
 
+  const minted = await readJson(res);
   const cookie = parseSessionCookie(res.headers.get("set-cookie"));
   if (!cookie) {
     return {
@@ -243,6 +246,10 @@ export async function resolveViewerTransport({
   return {
     ok: true,
     base,
+    identity: {
+      account: maskAccount(typeof minted?.email === "string" ? minted.email : null),
+      mcp: originOf(dev.mcpUrl),
+    },
     authHeaders: {
       cookie: `${SESSION_COOKIE}=${cookie}`,
       // Matches the admin browser client; the server IGNORES this hint and re-reads
@@ -252,6 +259,28 @@ export async function resolveViewerTransport({
   };
 }
 
+/** A recognizable stand-in for the signed-in account: first character and domain
+ *  (`d…@example.com`), never the full address.
+ *  @param {string|null} email @returns {string|null} */
+export function maskAccount(email) {
+  const at = email ? email.lastIndexOf("@") : -1;
+  if (!email || at < 1) return null;
+  return `${email[0]}…${email.slice(at)}`;
+}
+
+/**
+ * Which identity and tier the store checked, for a refusal line:
+ * `d…@example.com via https://mcp.tokenoftrust.com`.
+ * @param {{ account?: string|null, mcp?: string|null }|null|undefined} identity
+ * @returns {string|null}
+ */
+export function describeIdentity(identity) {
+  const account = identity?.account || null;
+  const mcp = identity?.mcp || null;
+  if (account && mcp) return `${account} via ${mcp}`;
+  return account || (mcp ? `your ${mcp} sign-in` : null);
+}
+
 /** The refusal body, or null when the body is not JSON (describeCliSessionRefusal
  *  falls back cleanly). Any other failure — a body already consumed, a stream
  *  error — is a bug or a fault, not "no body", and propagates.