@topolo/cli 0.4.3 → 0.4.5

package/dist/index.js

@@ -9,7 +9,7 @@ import { platform as platform2 } from "os";
 import { createInterface } from "readline/promises";
 import { stdin as input } from "process";
 
-// ../../../topolo-platform/packages/topolo-sdk/dist/index.js
+// ../topolo-sdk/dist/index.js
 function applyAuthHeaders(headers, credential) {
   if (credential.kind === "api_key") {
     headers.set("X-Api-Key", credential.apiKey);
@@ -3312,7 +3312,6 @@ var CrmModule = class {
   constructor(client) {
     this.client = client;
   }
-  client;
   async listContacts(options = {}) {
     const res = await this.client.request({
       service: "crm",
@@ -3358,7 +3357,6 @@ var IdentityModule = class {
   constructor(client) {
     this.client = client;
   }
-  client;
   /** Returns the resolved user, organization, and permission set for the
    *  current credential. Equivalent to `TopoloClient.introspect()` — exposed
    *  on this module for symmetry with the other domain modules. */
@@ -3453,7 +3451,7 @@ function createTopolo(options) {
   };
 }
 
-// ../../../topolo-platform/packages/topolo-sdk/dist/node/credential-store.js
+// ../topolo-sdk/dist/node/credential-store.js
 import { mkdir, readFile, writeFile, chmod } from "fs/promises";
 import { existsSync } from "fs";
 import { homedir, platform } from "os";
@@ -3783,9 +3781,9 @@ async function refreshCredentialIfNeeded(environment = selectedEnvironment(), op
   const profile = profileForEnvironment(config, environment);
   const cred = profile.credential;
   if (!cred || cred.kind !== "access_token") return cred ?? null;
-  if (!cred.refreshToken || !cred.expiresAt || !profile.oauthClientId) return cred;
+  if (!cred.refreshToken || !profile.oauthClientId) return cred;
   const now = Math.floor(Date.now() / 1e3);
-  if (!options.force && cred.expiresAt - REFRESH_SKEW_SECONDS > now) return cred;
+  if (!options.force && cred.expiresAt && cred.expiresAt - REFRESH_SKEW_SECONDS > now) return cred;
   try {
     const oauth = new TopoloOAuth2({
       serviceUrls: resolveServiceUrls(profile.serviceUrls, environment)
@@ -3819,6 +3817,46 @@ async function refreshCredentialIfNeeded(environment = selectedEnvironment(), op
     return cred;
   }
 }
+async function refreshContextCredentialIfNeeded(environment, key, options = {}) {
+  const config = await readConfig();
+  const profile = profileForEnvironment(config, environment);
+  const context = profile.contexts?.[key];
+  const credential = context?.credential;
+  if (!credential || credential.kind !== "access_token") return credential ?? null;
+  const oauthClientId = context.oauthClientId ?? profile.oauthClientId;
+  if (!credential.refreshToken || !oauthClientId) return credential;
+  const now = Math.floor(Date.now() / 1e3);
+  if (!options.force && credential.expiresAt && credential.expiresAt - REFRESH_SKEW_SECONDS > now) return credential;
+  try {
+    const oauth = new TopoloOAuth2({
+      serviceUrls: resolveServiceUrls(profile.serviceUrls, environment)
+    });
+    const tokens = await oauth.refreshToken({
+      clientId: oauthClientId,
+      refreshToken: credential.refreshToken
+    });
+    const refreshed = {
+      kind: "access_token",
+      accessToken: tokens.access_token,
+      ...tokens.refresh_token ? { refreshToken: tokens.refresh_token } : { refreshToken: credential.refreshToken },
+      expiresAt: Math.floor(Date.now() / 1e3) + tokens.expires_in
+    };
+    await writeConfig(writeProfileConfig(config, environment, {
+      ...profile.activeContext === key ? { credential: refreshed } : {},
+      contexts: {
+        ...profile.contexts ?? {},
+        [key]: {
+          ...context,
+          credential: refreshed,
+          oauthClientId
+        }
+      }
+    }));
+    return refreshed;
+  } catch {
+    return credential;
+  }
+}
 function resolveAgentName(configAgentName) {
   return process.env.TOPOLO_AGENT_NAME ?? configAgentName;
 }
@@ -11175,6 +11213,18 @@ function labelFor(ctx) {
   if (ctx.contextType === "personal") return "Personal";
   return ctx.organizationName || ctx.organizationSlug || ctx.organizationId || "organization";
 }
+function isAuthenticationFailure(error) {
+  return error instanceof Error && error.code === "auth_error";
+}
+function hasSameAccessToken(left, right) {
+  const leftCredential = left;
+  const rightCredential = right;
+  return leftCredential?.kind === "access_token" && rightCredential?.kind === "access_token" && leftCredential.accessToken === rightCredential.accessToken;
+}
+function identityMatchesContext(me, context) {
+  if (context.contextType === "personal") return me.activeType === "personal";
+  return me.activeType === "organization" && me.activeOrgId === context.organizationId;
+}
 function registerContextCommand(program2) {
   const context = program2.command("context").description("Show and switch the active context (personal or an organization)");
   context.command("ls", { isDefault: true }).alias("list").description("List the contexts you can act in and which is active").option("--json", "Output JSON", true).option("--no-json", "Output human-readable text").action(async (opts) => {
@@ -11228,16 +11278,10 @@ function registerContextCommand(program2) {
       const config = await readConfig();
       const profile = profileForEnvironment(config, environment);
       const serviceUrls = resolvedProfileConfig(config, environment).serviceUrls;
-      const priorCredential = profile.credential ?? (profile.activeContext ? profile.contexts?.[profile.activeContext]?.credential : void 0);
-      const cred = await refreshCredentialIfNeeded(environment, { force: true });
+      let cred = await refreshCredentialIfNeeded(environment);
       if (!cred) {
         throw new Error("Not signed in. Run `topolo auth login` first.");
       }
-      if (priorCredential?.kind === "access_token" && priorCredential.refreshToken && cred.kind === "access_token" && cred.accessToken === priorCredential.accessToken) {
-        throw new Error(
-          `The active credential could not be refreshed. Run \`topolo --env ${environment} auth login\` to sign in again.`
-        );
-      }
       const wantPersonal = /^(personal|me)$/i.test(target.trim());
       let resolved;
       const needle = target.trim().toLowerCase();
@@ -11275,10 +11319,40 @@ function registerContextCommand(program2) {
       }
       const key = contextKey(resolved.contextType, resolved.organizationId);
       const existing = profile.contexts?.[key];
-      const newCredential = await exchangeForContext(cred, serviceUrls, {
-        type: resolved.contextType,
-        id: resolved.organizationId
-      });
+      let newCredential;
+      if (existing?.credential && profile.activeContext !== key) {
+        const storedCredential = await refreshContextCredentialIfNeeded(environment, key);
+        if (storedCredential) {
+          try {
+            const storedIdentity = await fetchMe(storedCredential, serviceUrls);
+            if (identityMatchesContext(storedIdentity, resolved)) {
+              newCredential = storedCredential;
+            }
+          } catch {
+          }
+        }
+      }
+      if (!newCredential) {
+        try {
+          newCredential = await exchangeForContext(cred, serviceUrls, {
+            type: resolved.contextType,
+            id: resolved.organizationId
+          });
+        } catch (error) {
+          if (!isAuthenticationFailure(error)) throw error;
+          const refreshed = await refreshCredentialIfNeeded(environment, { force: true });
+          if (!refreshed || hasSameAccessToken(cred, refreshed)) {
+            throw new Error(
+              `The active credential could not be refreshed. Run \`topolo --env ${environment} auth login\` to sign in again.`
+            );
+          }
+          cred = refreshed;
+          newCredential = await exchangeForContext(cred, serviceUrls, {
+            type: resolved.contextType,
+            id: resolved.organizationId
+          });
+        }
+      }
       resolved.credential = newCredential;
       resolved.oauthClientId = existing?.oauthClientId ?? profile.oauthClientId;
       const updated = writeContextCredential(await readConfig(), environment, resolved, true);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@topolo/cli",
-  "version": "0.4.3",
+  "version": "0.4.5",
   "description": "Command-line interface for Topolo developers, operators, and agents, with internal first-party scaffolding available under the topolo platform namespace.",
   "type": "module",
   "bin": {