@verentis/cli 0.2.0 → 0.2.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Verentis
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -24,6 +24,12 @@ verentis login --api-url … --token <identity token>
 # VERENTIS_API_URL / VERENTIS_API_KEY / VERENTIS_TOKEN env vars also work
 ```
 
+A device sign-in also stores a **refresh token**, so you stay signed in: when the 1-hour identity token
+expires the CLI silently renews it on the next command (refresh tokens rotate on every use with reuse
+detection). You only re-run `verentis login` after the refresh token lapses (~30 days idle) or `verentis
+logout`. Tokens live in `~/.verentis/config.json` (mode `600`). Env-provided `VERENTIS_TOKEN` and API keys
+are used as-is and never auto-refreshed.
+
 Set defaults once so you can stop repeating flags:
 
 ```bash

package/dist/index.js

@@ -50,6 +50,87 @@ function isExpired(token, skewSeconds = 60) {
   return payload.exp * 1e3 <= Date.now() + skewSeconds * 1e3;
 }
 
+// src/auth/deviceFlow.ts
+var CLI_CLIENT_ID = "Verentis.Cli";
+async function startDeviceAuthorization(apiUrl) {
+  const res = await fetch(`${apiUrl}/connect/device/authorize`, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({ client_id: CLI_CLIENT_ID })
+  });
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new Error(`Could not start device sign-in (${res.status}).${text ? ` ${text.slice(0, 300)}` : ""}`);
+  }
+  return await res.json();
+}
+async function pollForIdentityToken(apiUrl, authorization, onPoll) {
+  let intervalMs = Math.max(authorization.interval, 1) * 1e3;
+  const deadline = Date.now() + authorization.expires_in * 1e3;
+  while (Date.now() < deadline) {
+    await sleep(intervalMs);
+    onPoll?.();
+    const res = await fetch(`${apiUrl}/connect/token`, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        grant_type: "device_code",
+        device_code: authorization.device_code,
+        client_id: CLI_CLIENT_ID
+      })
+    });
+    let payload;
+    try {
+      payload = await res.json();
+    } catch {
+      payload = void 0;
+    }
+    if (res.ok && payload?.id_token) {
+      return { idToken: payload.id_token, refreshToken: payload.refresh_token };
+    }
+    switch (payload?.error) {
+      case "authorization_pending":
+        continue;
+      case "slow_down":
+        intervalMs += 5e3;
+        continue;
+      case "access_denied":
+        throw new Error("Sign-in was denied in the browser.");
+      case "expired_token":
+        throw new Error("The device code expired before it was approved. Run `verentis login` again.");
+      default:
+        throw new Error(`Device sign-in failed (${res.status}).${payload?.error ? ` ${payload.error}` : ""}`);
+    }
+  }
+  throw new Error("The device code expired before it was approved. Run `verentis login` again.");
+}
+var RefreshTokenError = class extends Error {
+};
+async function refreshIdentityToken(apiUrl, refreshToken) {
+  const res = await fetch(`${apiUrl}/connect/token`, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "refresh_token",
+      refresh_token: refreshToken,
+      client_id: CLI_CLIENT_ID
+    })
+  });
+  let payload;
+  try {
+    payload = await res.json();
+  } catch {
+    payload = void 0;
+  }
+  if (res.ok && payload?.id_token) {
+    return { idToken: payload.id_token, refreshToken: payload.refresh_token ?? refreshToken };
+  }
+  throw new RefreshTokenError(
+    `Session could not be renewed${payload?.error ? ` (${payload.error})` : ` (${res.status})`}. Run \`verentis login\` again.`
+  );
+}
+var sleep = (ms) => new Promise((resolve8) => setTimeout(resolve8, ms));
+
 // src/http.ts
 var ApiError = class extends Error {
   constructor(status, message, body) {
@@ -65,6 +146,50 @@ async function createApiClient(overrides) {
   const config = { ...await loadConfig(), ...overrides };
   const apiUrl = requireApiUrl(config);
   const tokenCache = /* @__PURE__ */ new Map();
+  const envIdentity = process.env.VERENTIS_TOKEN;
+  let currentIdentity = envIdentity ?? config.identityToken;
+  let currentRefresh = config.refreshToken;
+  let refreshInflight = null;
+  async function persistTokens(idToken, refreshToken) {
+    const disk = await loadConfig();
+    disk.identityToken = idToken;
+    if (refreshToken) disk.refreshToken = refreshToken;
+    await saveConfig(disk);
+  }
+  async function clearTokens() {
+    const disk = await loadConfig();
+    delete disk.identityToken;
+    delete disk.refreshToken;
+    await saveConfig(disk);
+  }
+  async function resolveIdentityToken() {
+    if (!currentIdentity) throw new ApiError(401, "Not logged in. Run `verentis login`.");
+    if (!isExpired(currentIdentity, 120)) return currentIdentity;
+    if (envIdentity || !currentRefresh) {
+      throw new ApiError(401, "Your session has expired \u2014 run `verentis login` again.");
+    }
+    if (!refreshInflight) {
+      refreshInflight = (async () => {
+        try {
+          const refreshed = await refreshIdentityToken(apiUrl, currentRefresh);
+          currentIdentity = refreshed.idToken;
+          currentRefresh = refreshed.refreshToken ?? currentRefresh;
+          await persistTokens(refreshed.idToken, refreshed.refreshToken);
+          return refreshed.idToken;
+        } catch (err) {
+          if (err instanceof RefreshTokenError) {
+            await clearTokens().catch(() => {
+            });
+            throw new ApiError(401, err.message);
+          }
+          throw err;
+        } finally {
+          refreshInflight = null;
+        }
+      })();
+    }
+    return refreshInflight;
+  }
   async function credentialFor(scopes, workspaceId) {
     const cacheKey = `${workspaceId ?? ""}:${[...scopes].sort().join(" ")}`;
     const cached = tokenCache.get(cacheKey);
@@ -75,14 +200,10 @@ async function createApiClient(overrides) {
   }
   async function mintAccessToken(options) {
     const apiKey = process.env.VERENTIS_API_KEY ?? config.apiKey;
-    const identityToken = process.env.VERENTIS_TOKEN ?? config.identityToken;
-    const credential = apiKey ?? identityToken;
-    if (!credential) {
+    if (!apiKey && !currentIdentity) {
       throw new Error("Not logged in. Run `verentis login` (or pass --api-key / --token).");
     }
-    if (!apiKey && identityToken && isExpired(identityToken)) {
-      throw new ApiError(401, "Your identity token has expired \u2014 run `verentis login` again.");
-    }
+    const credential = apiKey ?? await resolveIdentityToken();
     const res = await fetch(`${apiUrl}/v1/tokens/access`, {
       method: "POST",
       headers: {
@@ -1576,60 +1697,6 @@ function registerKeygen(program2) {
   });
 }
 
-// src/auth/deviceFlow.ts
-var CLI_CLIENT_ID = "Verentis.Cli";
-async function startDeviceAuthorization(apiUrl) {
-  const res = await fetch(`${apiUrl}/connect/device/authorize`, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({ client_id: CLI_CLIENT_ID })
-  });
-  if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`Could not start device sign-in (${res.status}).${text ? ` ${text.slice(0, 300)}` : ""}`);
-  }
-  return await res.json();
-}
-async function pollForIdentityToken(apiUrl, authorization, onPoll) {
-  let intervalMs = Math.max(authorization.interval, 1) * 1e3;
-  const deadline = Date.now() + authorization.expires_in * 1e3;
-  while (Date.now() < deadline) {
-    await sleep(intervalMs);
-    onPoll?.();
-    const res = await fetch(`${apiUrl}/connect/token`, {
-      method: "POST",
-      headers: { "Content-Type": "application/x-www-form-urlencoded" },
-      body: new URLSearchParams({
-        grant_type: "device_code",
-        device_code: authorization.device_code,
-        client_id: CLI_CLIENT_ID
-      })
-    });
-    let payload;
-    try {
-      payload = await res.json();
-    } catch {
-      payload = void 0;
-    }
-    if (res.ok && payload?.id_token) return payload.id_token;
-    switch (payload?.error) {
-      case "authorization_pending":
-        continue;
-      case "slow_down":
-        intervalMs += 5e3;
-        continue;
-      case "access_denied":
-        throw new Error("Sign-in was denied in the browser.");
-      case "expired_token":
-        throw new Error("The device code expired before it was approved. Run `verentis login` again.");
-      default:
-        throw new Error(`Device sign-in failed (${res.status}).${payload?.error ? ` ${payload.error}` : ""}`);
-    }
-  }
-  throw new Error("The device code expired before it was approved. Run `verentis login` again.");
-}
-var sleep = (ms) => new Promise((resolve8) => setTimeout(resolve8, ms));
-
 // src/commands/login.ts
 function registerLogin(program2) {
   program2.command("login").description("Sign in to Verentis (browser device flow by default; --api-key/--token for non-interactive use)").option("--api-url <url>", "Verentis API gateway URL").option("--api-key <key>", "Verentis API key (vrt_...)").option("--token <token>", "Verentis identity token (exchanged per request for scoped access tokens)").option("--sealing-key <key>", "the platform's base64 X25519 sealing PUBLIC key (used by `pack --encrypt`)").action(async (options) => {
@@ -1641,6 +1708,7 @@ function registerLogin(program2) {
       if (!options.apiKey.startsWith("vrt_")) throw new Error('API keys start with "vrt_".');
       config.apiKey = options.apiKey;
       delete config.identityToken;
+      delete config.refreshToken;
       await saveConfig(config);
       console.log(`Configuration saved (API key @ ${config.apiUrl}).`);
       return;
@@ -1648,6 +1716,7 @@ function registerLogin(program2) {
     if (options.token) {
       config.identityToken = options.token;
       delete config.apiKey;
+      delete config.refreshToken;
       await saveConfig(config);
       console.log(`Configuration saved (identity token @ ${config.apiUrl}).`);
       return;
@@ -1660,12 +1729,14 @@ function registerLogin(program2) {
 `);
     console.log(`and confirm the code: ${authorization.user_code}`);
     console.log("\nWaiting for approval\u2026");
-    const identityToken = await pollForIdentityToken(apiUrl, authorization, () => process.stderr.write("."));
+    const identity = await pollForIdentityToken(apiUrl, authorization, () => process.stderr.write("."));
     process.stderr.write("\n");
-    config.identityToken = identityToken;
+    config.identityToken = identity.idToken;
+    if (identity.refreshToken) config.refreshToken = identity.refreshToken;
+    else delete config.refreshToken;
     delete config.apiKey;
     await saveConfig(config);
-    const claims = decodeJwtPayload(identityToken);
+    const claims = decodeJwtPayload(identity.idToken);
     console.log(`Signed in as ${claims?.name ?? claims?.email ?? claims?.sub ?? "unknown"} @ ${config.apiUrl}.`);
     if (!claims?.account_id) {
       console.log("Note: no unambiguous account context \u2014 admin commands may need --account <id>.");
@@ -1675,6 +1746,7 @@ function registerLogin(program2) {
     const config = await loadConfig();
     delete config.apiKey;
     delete config.identityToken;
+    delete config.refreshToken;
     await saveConfig(config);
     console.log("Credentials removed.");
   });
@@ -1686,9 +1758,14 @@ function registerLogin(program2) {
       if (claims) {
         const expiry = claims.exp ? new Date(claims.exp * 1e3) : void 0;
         const expired = expiry && expiry.getTime() <= Date.now();
+        const renewable = Boolean(config.refreshToken) && !process.env.VERENTIS_TOKEN;
         console.log(`User: ${claims.name ?? claims.email ?? claims.sub ?? "(unknown)"}${claims.sub ? ` (${claims.sub})` : ""}`);
         if (claims.account_id) console.log(`Account: ${claims.account_id}`);
-        if (expiry) console.log(`Token ${expired ? "EXPIRED" : "expires"}: ${expiry.toISOString()}`);
+        if (expiry) {
+          const state = expired ? renewable ? "expired (auto-renews)" : "EXPIRED" : "expires";
+          console.log(`Token ${state}: ${expiry.toISOString()}`);
+        }
+        if (renewable) console.log("Session: refresh token stored (stays signed in across expiries)");
       }
     } else if (process.env.VERENTIS_API_KEY ?? config.apiKey) {
       console.log("Credential: API key (identity claims not available)");