dazzer-connect 0.4.0 → 0.4.1

package/dist/index.js

@@ -23,6 +23,7 @@ function writeErr(message) {
 }
 var CANNOT_REACH_DAZZER = "I can't reach Dazzer right now \u2014 nothing was sent. Try again shortly.";
 var SIGN_IN_NO_LONGER_VALID = "Your Dazzer sign-in is no longer valid. Reconnect your client (or run `dazzer auth login`).";
+var RENEWED_SIGN_IN_NOT_SAVED = "Your sign-in was renewed, but this machine's credential store would not save it. Run: dazzer auth login";
 var UPDATE_THE_TOOL = "npm install -g dazzer-connect@latest";
 var newerToolIsOut = (version2) => `Version ${version2} of dazzer is out. Update it with: ${UPDATE_THE_TOOL}`;
 function printDeviceInstructions(deviceAuth) {
@@ -95,6 +96,9 @@ function printAuthStatus(params) {
       writeOut("  Common on servers and containers, which often have none.");
       writeOut("  Run: dazzer auth login \u2014 it prints a pass you can paste in.");
       return;
+    case "save-refused":
+      writeOut(RENEWED_SIGN_IN_NOT_SAVED);
+      return;
     case "expired":
       writeOut("Your sign-in has expired or been revoked. Run: dazzer auth login");
       return;
@@ -199,6 +203,12 @@ var RefreshRejectedError = class extends Error {
   }
   oauthError;
 };
+var RenewedSignInNotSavedError = class extends Error {
+  constructor() {
+    super("The credential store would not save the renewed sign-in.");
+    this.name = "RenewedSignInNotSavedError";
+  }
+};
 async function refreshAccessToken(options) {
   const fetchFn = options.fetchFn ?? fetch;
   const params = new URLSearchParams({
@@ -226,7 +236,11 @@ async function refreshAccessToken(options) {
   }
   const newRefresh = typeof refreshToken === "string" ? refreshToken : options.refreshToken;
   const expiresIn = typeof body.expires_in === "number" ? body.expires_in : null;
-  await options.tokenStore.save({ accessToken, refreshToken: newRefresh });
+  try {
+    await options.tokenStore.save({ accessToken, refreshToken: newRefresh });
+  } catch {
+    throw new RenewedSignInNotSavedError();
+  }
   return { accessToken, refreshToken: newRefresh, expiresIn };
 }
 async function getValidAccessToken(options) {
@@ -241,6 +255,9 @@ async function getValidAccessToken(options) {
     if (err instanceof RefreshRejectedError) {
       return { status: "rejected" };
     }
+    if (err instanceof RenewedSignInNotSavedError) {
+      return { status: "save-refused" };
+    }
     return { status: "unreachable" };
   }
 }
@@ -365,6 +382,8 @@ async function resolveCredential(auth2) {
       return { status: "signed-out" };
     case "rejected":
       return { status: "sign-in-invalid" };
+    case "save-refused":
+      return { status: "save-refused" };
     case "unreachable":
       return { held: held.accessToken };
     case "refreshed": {
@@ -384,6 +403,9 @@ async function callDazzer(request) {
     if (credential.status === "sign-in-invalid") {
       return { status: "sign-in-invalid", message: SIGN_IN_NO_LONGER_VALID };
     }
+    if (credential.status === "save-refused") {
+      return { status: "sign-in-invalid", message: RENEWED_SIGN_IN_NOT_SAVED };
+    }
     return { status: credential.status };
   }
   const fetchFn = request.fetchFn ?? fetch;
@@ -720,9 +742,17 @@ var KeychainTokenStore = class {
     this.openEntry = openEntry;
   }
   openEntry;
+  /**
+   * THE REFRESH TOKEN IS WRITTEN FIRST, AND IF IT WILL NOT BE, NOTHING ELSE IS TOUCHED. After a renewal
+   * the saved refresh token is already spent at the sign-in server. Writing the access token first and
+   * then failing on the refresh token left a new access token beside that spent one, which read as a
+   * fresh sign-in until it failed to renew. In this order a refused first write changes nothing, and
+   * a refused second write leaves the new refresh token, which can still renew. Either way the
+   * refusal reaches the caller, which says so rather than calling it anything else.
+   */
   async save(tokens) {
-    this.openEntry(ACCESS_ACCOUNT).setPassword(tokens.accessToken);
     this.openEntry(REFRESH_ACCOUNT).setPassword(tokens.refreshToken);
+    this.openEntry(ACCESS_ACCOUNT).setPassword(tokens.accessToken);
   }
   async load() {
     const accessToken = this.openEntry(ACCESS_ACCOUNT).getPassword();
@@ -2559,6 +2589,9 @@ async function runStatus(options) {
     case "rejected":
       printAuthStatus({ state: "expired" });
       return;
+    case "save-refused":
+      printAuthStatus({ state: "save-refused" });
+      return;
     case "unreachable":
       printAuthStatus({
         state: "unverified",

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dazzer-connect",
   "private": false,
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "Sign in to Dazzer \u2014 the memory your AI tools share \u2014 from a terminal, for clients that cannot sign in themselves",
   "license": "MIT",
   "type": "module",
@@ -41,7 +41,7 @@
   },
   "devDependencies": {
     "@dazzer/auth-ui": "workspace:*",
-    "@types/node": "^26.6.2",
+    "@types/node": "^26.6.3",
     "esbuild": "^0.28.2",
     "tsx": "^4.23.15",
     "typescript": "^5.7.2",