@ze-norm/cli 0.11.1 → 0.11.3

package/dist/api/client.d.ts

@@ -11,12 +11,15 @@ export interface AuthContext {
 }
 export declare class ZenormClient {
     private baseUrl;
-    private token;
+    private explicitToken;
     constructor(opts?: ApiClientOptions);
-    private getHeaders;
+    /** Resolve the bearer token for a request, refreshing it if expired. */
+    private resolveRequestToken;
+    private buildHeaders;
     private isLocalBaseUrl;
     /** True when this client targets a localhost API (dev-bypass eligible). */
     isLocalDevTarget(): boolean;
+    private sendOnce;
     private request;
     get<T>(path: string): Promise<T>;
     post<T>(path: string, body?: unknown): Promise<T>;

package/dist/api/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAqBA,kFAAkF;AAClF,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AA0BD,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,KAAK,CAAgB;gBAEjB,IAAI,CAAC,EAAE,gBAAgB;IAKnC,OAAO,CAAC,UAAU;IA0BlB,OAAO,CAAC,cAAc;IAStB,2EAA2E;IAC3E,gBAAgB,IAAI,OAAO;YAIb,OAAO;IAsEf,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAIhC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAIjD,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAIhD,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAIlD,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAIzC;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC,WAAW,CAAC;CAG7C"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAyBA,kFAAkF;AAClF,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AA0BD,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,OAAO,CAAS;IAIxB,OAAO,CAAC,aAAa,CAAgB;gBAEzB,IAAI,CAAC,EAAE,gBAAgB;IAKnC,wEAAwE;YAC1D,mBAAmB;IAKjC,OAAO,CAAC,YAAY;IA0BpB,OAAO,CAAC,cAAc;IAStB,2EAA2E;IAC3E,gBAAgB,IAAI,OAAO;YAIb,QAAQ;YAqBR,OAAO;IAqEf,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAIhC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAIjD,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAIhD,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAIlD,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAIzC;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC,WAAW,CAAC;CAG7C"}

package/dist/api/client.js

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { ApiError, AuthError, UpgradeRequiredError } from "../util/errors.js";
-import { resolveToken } from "../auth/store.js";
+import { forceRefreshToken, hasRefreshableCredentials, resolveValidToken, } from "../auth/store.js";
 import { PRODUCTION_API_URL } from "../config/defaults.js";
 import { getCliVersion } from "../util/package.js";
 import { log } from "../util/logger.js";
@@ -40,12 +40,21 @@ function resolveBaseUrl(explicit) {
 }
 export class ZenormClient {
     baseUrl;
-    token;
+    // An explicit token override (e.g. from `login` before creds are persisted).
+    // When set it is used verbatim and never refreshed. When null, the token is
+    // resolved per-request from stored credentials so expiry/refresh is handled.
+    explicitToken;
     constructor(opts) {
         this.baseUrl = resolveBaseUrl(opts?.baseUrl).replace(/\/+$/, "");
-        this.token = opts?.token ?? resolveToken();
+        this.explicitToken = opts?.token ?? null;
     }
-    getHeaders() {
+    /** Resolve the bearer token for a request, refreshing it if expired. */
+    async resolveRequestToken() {
+        if (this.explicitToken)
+            return this.explicitToken;
+        return resolveValidToken();
+    }
+    buildHeaders(token) {
         const headers = {
             "Content-Type": "application/json",
             // Always advertise the CLI version so the API can gate stale clients
@@ -54,8 +63,8 @@ export class ZenormClient {
             // authenticated or dev-bypassed.
             "x-zenorm-cli-version": getCliVersion(),
         };
-        if (this.token) {
-            headers["Authorization"] = `Bearer ${this.token}`;
+        if (token) {
+            headers["Authorization"] = `Bearer ${token}`;
             return headers;
         }
         if (this.isLocalBaseUrl()) {
@@ -82,23 +91,38 @@ export class ZenormClient {
     isLocalDevTarget() {
         return this.isLocalBaseUrl();
     }
-    async request(method, path, body) {
-        const url = `${this.baseUrl}${path}`;
+    async sendOnce(method, url, token, body) {
         const init = {
             method,
-            headers: this.getHeaders(),
+            headers: this.buildHeaders(token),
         };
         if (body !== undefined) {
             init.body = JSON.stringify(body);
         }
-        let res;
         try {
-            res = await fetch(url, init);
+            return await fetch(url, init);
         }
         catch (err) {
             const msg = err instanceof Error ? err.message : String(err);
             throw new ApiError(`Request failed: ${msg}`, 0, null);
         }
+    }
+    async request(method, path, body) {
+        const url = `${this.baseUrl}${path}`;
+        let token = await this.resolveRequestToken();
+        let res = await this.sendOnce(method, url, token, body);
+        // A 401 on a token we resolved from stored credentials may mean the server
+        // revoked it before its stated expiry. Try one forced refresh + retry
+        // before giving up — but never for an explicit/env token we can't refresh.
+        if (res.status === 401 && !this.explicitToken && hasRefreshableCredentials()) {
+            try {
+                token = await forceRefreshToken();
+            }
+            catch {
+                throw new AuthError("Authentication required. Run `zenorm login` first.");
+            }
+            res = await this.sendOnce(method, url, token, body);
+        }
         if (res.status === 401) {
             throw new AuthError("Authentication required. Run `zenorm login` first.");
         }

package/dist/auth/device-flow.d.ts

@@ -1,4 +1,18 @@
 import type { StoredCredentials } from "./store.js";
+/**
+ * Exchange a stored refresh token for a fresh access token at the Clerk token
+ * endpoint (`grant_type=refresh_token`). Clerk may rotate the refresh token, so
+ * the caller must persist whichever refresh token comes back; if the response
+ * omits one, the existing refresh token is still valid and is returned as-is.
+ *
+ * Throws on any non-2xx response — an expired/revoked refresh token means the
+ * caller must fall back to a full `zenorm login`.
+ */
+export declare function refreshAccessToken(refreshToken: string): Promise<{
+    accessToken: string;
+    refreshToken: string;
+    expiresIn: number;
+}>;
 /**
  * Run the full OAuth 2.0 Authorization Code + PKCE flow.
  *

package/dist/auth/device-flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"device-flow.d.ts","sourceRoot":"","sources":["../../src/auth/device-flow.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAkUpD;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAkDpE"}
+{"version":3,"file":"device-flow.d.ts","sourceRoot":"","sources":["../../src/auth/device-flow.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAkUpD;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;IACtE,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC,CAuBD;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAkDpE"}

package/dist/auth/device-flow.js

@@ -280,6 +280,37 @@ async function exchangeCodeForTokens(code, codeVerifier, redirectUri) {
         expiresIn: data.expires_in ?? 3600,
     };
 }
+/**
+ * Exchange a stored refresh token for a fresh access token at the Clerk token
+ * endpoint (`grant_type=refresh_token`). Clerk may rotate the refresh token, so
+ * the caller must persist whichever refresh token comes back; if the response
+ * omits one, the existing refresh token is still valid and is returned as-is.
+ *
+ * Throws on any non-2xx response — an expired/revoked refresh token means the
+ * caller must fall back to a full `zenorm login`.
+ */
+export async function refreshAccessToken(refreshToken) {
+    const res = await fetch(`${getClerkIssuer()}/oauth/token`, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+            grant_type: "refresh_token",
+            refresh_token: refreshToken,
+            client_id: getClerkClientId(),
+        }),
+    });
+    if (!res.ok) {
+        const text = await res.text().catch(() => "");
+        throw new Error(`Token refresh failed (${res.status}): ${text}`);
+    }
+    const data = (await res.json());
+    return {
+        accessToken: data.access_token,
+        // Clerk rotates refresh tokens; reuse the old one only if none is returned.
+        refreshToken: data.refresh_token ?? refreshToken,
+        expiresIn: data.expires_in ?? 3600,
+    };
+}
 /**
  * Run the full OAuth 2.0 Authorization Code + PKCE flow.
  *

package/dist/auth/store.d.ts

@@ -9,8 +9,38 @@ export declare function loadCredentials(): StoredCredentials | null;
 export declare function saveCredentials(creds: StoredCredentials): void;
 export declare function deleteCredentials(): boolean;
 /**
- * Resolve the current access token.
+ * Resolve the current access token without any network/refresh side effects.
  * Priority: ZENORM_API_TOKEN env var > stored credentials.
+ *
+ * Prefer `resolveValidToken()` for actual API calls — this raw accessor does
+ * NOT check expiry and is kept for callers that only need the literal token
+ * (e.g. displaying it).
  */
 export declare function resolveToken(): string | null;
+/**
+ * Resolve a usable access token, refreshing it first when the stored one is
+ * expired (or about to be). Rotated credentials are persisted.
+ *
+ * Priority: ZENORM_API_TOKEN env var (used as-is, never refreshed) > stored
+ * credentials (refreshed on demand). Returns null when there is nothing to
+ * resolve, leaving the caller to fall back to dev-bypass headers or error.
+ *
+ * A failed refresh (revoked/expired refresh token) throws; the caller surfaces
+ * it as "run `zenorm login`".
+ */
+export declare function resolveValidToken(): Promise<string | null>;
+/**
+ * True when a refresh-token grant is possible: stored credentials with a
+ * refresh token exist and no explicit ZENORM_API_TOKEN override is in play
+ * (an env token is opaque to us and cannot be refreshed).
+ */
+export declare function hasRefreshableCredentials(): boolean;
+/**
+ * Force a refresh regardless of expiry — used after a 401, where the server
+ * rejected a token that may have been revoked before its stated expiry.
+ * Persists rotated credentials and returns the new access token.
+ *
+ * Throws if there is nothing to refresh or the refresh grant fails.
+ */
+export declare function forceRefreshToken(): Promise<string>;
 //# sourceMappingURL=store.d.ts.map

package/dist/auth/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/auth/store.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAaD,wBAAgB,eAAe,IAAI,iBAAiB,GAAG,IAAI,CAO1D;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAM9D;AAED,wBAAgB,iBAAiB,IAAI,OAAO,CAO3C;AAED;;;GAGG;AACH,wBAAgB,YAAY,IAAI,MAAM,GAAG,IAAI,CAU5C"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/auth/store.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAaD,wBAAgB,eAAe,IAAI,iBAAiB,GAAG,IAAI,CAO1D;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAM9D;AAED,wBAAgB,iBAAiB,IAAI,OAAO,CAO3C;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,IAAI,MAAM,GAAG,IAAI,CAU5C;AAWD;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAwBhE;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,IAAI,OAAO,CAInD;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC,CAezD"}

package/dist/auth/store.js

@@ -1,6 +1,11 @@
 import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
+import { refreshAccessToken } from "./device-flow.js";
+import { log } from "../util/logger.js";
+// Refresh the access token this many ms before it actually expires, so an
+// in-flight request never races the expiry boundary.
+const EXPIRY_SKEW_MS = 60_000;
 function getCredentialsPath() {
     return join(homedir(), ".zenorm", "credentials.json");
 }
@@ -34,8 +39,12 @@ export function deleteCredentials() {
     return true;
 }
 /**
- * Resolve the current access token.
+ * Resolve the current access token without any network/refresh side effects.
  * Priority: ZENORM_API_TOKEN env var > stored credentials.
+ *
+ * Prefer `resolveValidToken()` for actual API calls — this raw accessor does
+ * NOT check expiry and is kept for callers that only need the literal token
+ * (e.g. displaying it).
  */
 export function resolveToken() {
     const envToken = process.env["ZENORM_API_TOKEN"];
@@ -48,3 +57,81 @@ export function resolveToken() {
     }
     return null;
 }
+/** True when the stored access token is expired (within the skew window). */
+function isExpired(creds) {
+    const expiresAtMs = Date.parse(creds.expiresAt);
+    // An unparseable expiry is treated as expired so we refresh rather than send
+    // a token we can't reason about.
+    if (Number.isNaN(expiresAtMs))
+        return true;
+    return expiresAtMs - EXPIRY_SKEW_MS <= Date.now();
+}
+/**
+ * Resolve a usable access token, refreshing it first when the stored one is
+ * expired (or about to be). Rotated credentials are persisted.
+ *
+ * Priority: ZENORM_API_TOKEN env var (used as-is, never refreshed) > stored
+ * credentials (refreshed on demand). Returns null when there is nothing to
+ * resolve, leaving the caller to fall back to dev-bypass headers or error.
+ *
+ * A failed refresh (revoked/expired refresh token) throws; the caller surfaces
+ * it as "run `zenorm login`".
+ */
+export async function resolveValidToken() {
+    const envToken = process.env["ZENORM_API_TOKEN"];
+    if (envToken) {
+        return envToken;
+    }
+    const creds = loadCredentials();
+    if (!creds) {
+        return null;
+    }
+    if (!creds.refreshToken || !isExpired(creds)) {
+        return creds.accessToken;
+    }
+    log.debug("Access token expired; refreshing via refresh_token grant");
+    const refreshed = await refreshAccessToken(creds.refreshToken);
+    const updated = {
+        ...creds,
+        accessToken: refreshed.accessToken,
+        refreshToken: refreshed.refreshToken,
+        expiresAt: new Date(Date.now() + refreshed.expiresIn * 1000).toISOString(),
+    };
+    saveCredentials(updated);
+    log.debug("Access token refreshed", { expiresAt: updated.expiresAt });
+    return refreshed.accessToken;
+}
+/**
+ * True when a refresh-token grant is possible: stored credentials with a
+ * refresh token exist and no explicit ZENORM_API_TOKEN override is in play
+ * (an env token is opaque to us and cannot be refreshed).
+ */
+export function hasRefreshableCredentials() {
+    if (process.env["ZENORM_API_TOKEN"])
+        return false;
+    const creds = loadCredentials();
+    return Boolean(creds?.refreshToken);
+}
+/**
+ * Force a refresh regardless of expiry — used after a 401, where the server
+ * rejected a token that may have been revoked before its stated expiry.
+ * Persists rotated credentials and returns the new access token.
+ *
+ * Throws if there is nothing to refresh or the refresh grant fails.
+ */
+export async function forceRefreshToken() {
+    const creds = loadCredentials();
+    if (!creds?.refreshToken) {
+        throw new Error("No refresh token available");
+    }
+    log.debug("Forcing token refresh after 401");
+    const refreshed = await refreshAccessToken(creds.refreshToken);
+    const updated = {
+        ...creds,
+        accessToken: refreshed.accessToken,
+        refreshToken: refreshed.refreshToken,
+        expiresAt: new Date(Date.now() + refreshed.expiresIn * 1000).toISOString(),
+    };
+    saveCredentials(updated);
+    return refreshed.accessToken;
+}

package/dist/commands/whoami.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"whoami.d.ts","sourceRoot":"","sources":["../../src/commands/whoami.ts"],"names":[],"mappings":"AAIA,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBlE"}
+{"version":3,"file":"whoami.d.ts","sourceRoot":"","sources":["../../src/commands/whoami.ts"],"names":[],"mappings":"AAIA,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBlE"}

package/dist/commands/whoami.js

@@ -2,9 +2,11 @@ import { loadCredentials, resolveToken } from "../auth/store.js";
 import { ZenormClient } from "../api/client.js";
 import { log } from "../util/logger.js";
 export async function whoamiCommand(_argv) {
-    const token = resolveToken();
-    const client = new ZenormClient({ token: token ?? undefined });
+    // Let the client resolve (and refresh if needed) the stored token itself —
+    // passing an explicit token here would bypass expiry handling.
+    const client = new ZenormClient();
     const ctx = await client.getAuthContext();
+    const token = resolveToken();
     log.info(`User:    ${ctx.userId}`);
     log.info(`Org:     ${ctx.orgId}`);
     log.info(`Admin:   ${ctx.isAdmin ? "yes" : "no"}`);

package/dist/util/self-update.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"self-update.d.ts","sourceRoot":"","sources":["../../src/util/self-update.ts"],"names":[],"mappings":"AAgBA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CA+DlE"}
+{"version":3,"file":"self-update.d.ts","sourceRoot":"","sources":["../../src/util/self-update.ts"],"names":[],"mappings":"AAgBA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CA4ElE"}

package/dist/util/self-update.js

@@ -98,7 +98,16 @@ export async function armSelfUpdate(notify) {
         }
         // Detached, non-blocking. Outlives this process; the upgrade lands for the
         // next invocation. stdio ignored so it can't corrupt this command's output.
-        const child = spawn("npm", ["install", "-g", `${PACKAGE_NAME}@${update.latest}`], {
+        //
+        // `--prefer-online`: revalidate cached registry metadata instead of
+        // trusting it. An auto-updater's whole job is fetching the newest version,
+        // so stale local packument metadata is exactly the wrong thing to trust —
+        // without this, an install attempted shortly after a publish can serve a
+        // cached packument that predates the new version and fail with ETARGET
+        // (silently, since stdio is ignored), then the single-flight marker blocks
+        // retries until it ages out. Forcing a metadata revalidation closes that
+        // post-publish race.
+        const child = spawn("npm", ["install", "-g", "--prefer-online", `${PACKAGE_NAME}@${update.latest}`], {
             detached: true,
             stdio: "ignore",
         });

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ze-norm/cli",
   "private": false,
-  "version": "0.11.1",
+  "version": "0.11.3",
   "license": "SEE LICENSE IN README.md",
   "type": "module",
   "repository": {