@vincentt-xr/cli 0.12.0 → 0.12.1

package/dist/lib/backend.js

@@ -6,6 +6,7 @@ import { promises as fs } from "node:fs";
 import path from "node:path";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
+import { clientHeaders } from "../shared/clientHeader.js";
 import { authFailureMessage } from "../shared/authError.js";
 const execFileAsync = promisify(execFile);
 export class BackendError extends Error {
@@ -19,7 +20,11 @@ export class BackendError extends Error {
 async function authFetch(cfg, pathname, init = {}) {
     return fetch(`${cfg.apiUrl}${pathname}`, {
         ...init,
-        headers: { ...(init.headers ?? {}), authorization: `Bearer ${cfg.pat}` },
+        headers: {
+            ...(init.headers ?? {}),
+            ...clientHeaders(),
+            authorization: `Bearer ${cfg.pat}`,
+        },
     });
 }
 async function safeText(res) {

package/dist/library/client.js

@@ -12,6 +12,7 @@
 // CLI-supplied URL reaches a fetch. That is a security control, not a style choice
 // (D-add-prints-urls degraded the no-invented-URLs rule from prevention to
 // detection, and this is the one arm that stayed prevention).
+import { clientHeaders } from "../shared/clientHeader.js";
 import { parseBatchResponse, parseFetchResponse, parseSearchResponse, } from "./wire.js";
 /** The API said no, with a code we can act on. */
 export class LibraryError extends Error {
@@ -61,7 +62,7 @@ async function readJson(res) {
  */
 export function httpLibraryClient(cfg) {
     const base = cfg.apiUrl.replace(/\/$/, "");
-    const auth = { authorization: `Bearer ${cfg.pat}` };
+    const auth = { ...clientHeaders(), authorization: `Bearer ${cfg.pat}` };
     const call = async (pathname, init) => {
         try {
             return await fetch(`${base}${pathname}`, {

package/dist/login/authBackend.js

@@ -7,6 +7,7 @@
 //   POST /access-tokens/exchange {code, code_verifier} → {token}   (raw PAT, once, in body)
 //   GET  /me            Bearer <PAT>                    → identity + orgs (confirm)
 import { authFailureMessage } from "../shared/authError.js";
+import { clientHeaders } from "../shared/clientHeader.js";
 class AuthError extends Error {
     status;
     constructor(message, status) {
@@ -30,7 +31,7 @@ export function httpAuthBackend(apiBase) {
         async exchange(code, codeVerifier) {
             const res = await fetch(`${base}/access-tokens/exchange`, {
                 method: "POST",
-                headers: { "content-type": "application/json" },
+                headers: { ...clientHeaders(), "content-type": "application/json" },
                 body: JSON.stringify({ code, code_verifier: codeVerifier }),
             });
             if (!res.ok) {
@@ -43,7 +44,7 @@ export function httpAuthBackend(apiBase) {
         },
         async me(pat) {
             const res = await fetch(`${base}/me`, {
-                headers: { authorization: `Bearer ${pat}` },
+                headers: { ...clientHeaders(), authorization: `Bearer ${pat}` },
             });
             if (!res.ok) {
                 throw new AuthError(authFailureMessage("Identity check failed", res.status, await safeText(res)), res.status);

package/dist/publish/api.js

@@ -5,6 +5,7 @@
 //
 // The bytes do NOT transit the API. Open returns one presigned PUT per file,
 // each signed for one exact key; the CLI PUTs direct to S3 and then commits.
+import { clientHeaders } from "../shared/clientHeader.js";
 export class PublishApiError extends Error {
     status;
     code;
@@ -31,7 +32,7 @@ async function readError(res) {
     return new PublishApiError(res.status, body.code ?? `http_${res.status}`, body.message ?? `request failed (${res.status})`, body.detail ?? {}, retryAfter ? Number(retryAfter) : undefined);
 }
 function authHeaders(cfg) {
-    return { authorization: `Bearer ${cfg.pat}` };
+    return { ...clientHeaders(), authorization: `Bearer ${cfg.pat}` };
 }
 /** The ONE call before the checklist. liveVersion + livePublishedAt ride it, by design. */
 export async function readProject(cfg, projectId, fetchImpl = fetch) {

package/dist/shared/clientHeader.d.ts

@@ -0,0 +1,19 @@
+/** The header name. Canonical casing; HTTP header matching is case-insensitive. */
+export declare const CLIENT_HEADER = "X-Vincentt-Client";
+export declare function clientVersion(): string;
+/**
+ * The header value: `cli/<version>`.
+ *
+ * The `cli/` prefix is what keeps the field readable when a second first-party
+ * client (the harness, a future console agent) starts reporting on the same
+ * header — a bare version would be ambiguous the moment it is not alone.
+ */
+export declare function clientHeaderValue(): string;
+/**
+ * The header, as a spreadable object. Callers merge this into their existing
+ * headers rather than assembling the name themselves, so the format stays in one
+ * place.
+ */
+export declare function clientHeaders(): Record<string, string>;
+/** Reset the memo. Test seam only. */
+export declare function resetClientVersionCache(): void;

package/dist/shared/clientHeader.js

@@ -0,0 +1,72 @@
+/**
+ * The client-identity header every API request carries.
+ *
+ * The platform could not previously tell which CLI was calling it. That makes
+ * two ordinary questions unanswerable: how far behind the installed base
+ * actually is, and whether a wire change is safe to make yet. Both are questions
+ * about a population, and no amount of reading one creator's terminal answers
+ * them.
+ *
+ * It is also the seam a minimum-version refusal would need. That is deliberately
+ * NOT built here — a floor that strands someone mid-publish is worth having only
+ * once a contract has actually broken, and it needs this measurement first to
+ * know where to sit.
+ *
+ * `X-Vincentt-Client` is the platform's namespace, which the EDGE strips from
+ * viewer traffic (see isViewerRoutingHeader in the api repo): a device must not
+ * be able to forge what a creator's tooling reports about itself. This is the
+ * other side of that rule — the CLI is a first-party client talking to the API
+ * directly, not a viewer, so it is the legitimate origin of the value rather
+ * than something to be filtered out.
+ */
+import { createRequire } from "node:module";
+/** The header name. Canonical casing; HTTP header matching is case-insensitive. */
+export const CLIENT_HEADER = "X-Vincentt-Client";
+/**
+ * The running package's version, read from the manifest rather than baked in by
+ * the build — a hardcoded string is one forgotten edit away from a CLI that
+ * misreports itself, which is worse than reporting nothing. `src/shared/` and
+ * the emitted `dist/shared/` sit at the same depth, so one relative path serves
+ * both.
+ */
+function readVersion() {
+    try {
+        const manifest = createRequire(import.meta.url)("../../package.json");
+        return manifest.version ?? "unknown";
+    }
+    catch {
+        return "unknown";
+    }
+}
+/**
+ * Cached: the manifest cannot change within a process, and this is read on every
+ * outbound request.
+ */
+let cached;
+export function clientVersion() {
+    if (cached === undefined)
+        cached = readVersion();
+    return cached;
+}
+/**
+ * The header value: `cli/<version>`.
+ *
+ * The `cli/` prefix is what keeps the field readable when a second first-party
+ * client (the harness, a future console agent) starts reporting on the same
+ * header — a bare version would be ambiguous the moment it is not alone.
+ */
+export function clientHeaderValue() {
+    return `cli/${clientVersion()}`;
+}
+/**
+ * The header, as a spreadable object. Callers merge this into their existing
+ * headers rather than assembling the name themselves, so the format stays in one
+ * place.
+ */
+export function clientHeaders() {
+    return { [CLIENT_HEADER]: clientHeaderValue() };
+}
+/** Reset the memo. Test seam only. */
+export function resetClientVersionCache() {
+    cached = undefined;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vincentt-xr/cli",
-  "version": "0.12.0",
+  "version": "0.12.1",
   "description": "Vincentt CLI — the vincentt command-line dev loop (login, create, publish, preview, diagnostics, feedback, relay)",
   "license": "UNLICENSED",
   "type": "module",