ninepm 0.58.0 → 0.59.0

package/dist/index.d.ts

@@ -116,7 +116,7 @@ export interface CreatedServiceToken {
     clientSecret: string;
 }
 export type FetchLike = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
-export declare const CLI_VERSION = "0.58.0";
+export declare const CLI_VERSION = "0.59.0";
 type CredentialBackend = "macos-keychain" | "windows-dpapi" | "linux-secret-service" | "file-plaintext" | "none";
 export interface StoredCredentialEntry {
     token: string;

package/dist/index.js

@@ -15,7 +15,7 @@ import { managedHostnamesIn, siblingCallWarning, siblingsOf } from "./sibling-ho
 import { MAX_STATIC_ASSET_FILE_BYTES, MAX_WORKER_ENTRY_COMPRESSED_BYTES, MAX_WORKER_SCRIPT_COMPRESSED_BYTES, WORKER_ENTRY_COMPRESSED_WARN_BYTES, assetFileTooLargeMessage, formatMebibytes, formatMegabytes, oversizedAssets, workerBundleNearLimitMessage, workerBundleTooLargeMessage, workerEntryNearLimitMessage, workerEntryTooLargeMessage, } from "./deploy-limits.js";
 import { buildFileManifest, readManifestFile } from "./manifest.js";
 import { API_KEY_HELP, API_URL_HELP, CLI_CLIENT_ID, DEFAULT_API_URL, reportCliError } from "./cli-config.js";
-export const CLI_VERSION = "0.58.0";
+export const CLI_VERSION = "0.59.0";
 const PUBLIC_DASHBOARD_URL = "https://9pm.ai/dashboard";
 const TOKEN_SERVICE = "9pm";
 const TOKEN_ACCOUNT = "default";
@@ -903,15 +903,21 @@ function revocationFailureReason(error) {
     }
     return error instanceof Error ? error.message : String(error);
 }
-// The ONLY refusal that proves anything about the stored credential:
-// requireAuth emits invalid_api_key after looking the presented token up
-// (src/server/routes/guards.ts). Its siblings do not — missing_api_key means no
-// credential arrived at all and malformed_api_key means the header was not a
-// bearer token, both of which a proxy that strips or rewrites Authorization
-// produces for a perfectly live key. Anything else answering 401/403 is an
-// intermediary rather than the control plane judging this credential.
+// The refusals that prove something about the stored credential: requireAuth emits
+// both AFTER looking the presented token up (src/server/routes/guards.ts), so each
+// is the control plane judging this credential. Their siblings do not — missing_api_key
+// means no credential arrived at all and malformed_api_key means the header was not a
+// bearer token, both of which a proxy that strips or rewrites Authorization produces
+// for a perfectly live key. Anything else answering 401/403 is an intermediary rather
+// than the control plane judging this credential.
+//
+// A set rather than a comparison because the list is now open: a key refused for
+// inactivity (#854) is as dead to its holder as a revoked one, and a refusal this
+// function does not recognise turns a clean `9pm logout` into a reported failure
+// blaming an intermediary that was never involved.
+const CREDENTIAL_REFUSAL_CODES = new Set(["invalid_api_key", "expired_api_key"]);
 async function isAuthRefusal(response) {
-    return (await responseErrorCode(response)) === "invalid_api_key";
+    return CREDENTIAL_REFUSAL_CODES.has(await responseErrorCode(response));
 }
 // The `code` from the control plane's {error:{code}} envelope, or "" when the
 // body is not that shape (proxy error page, empty body).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ninepm",
-  "version": "0.58.0",
+  "version": "0.59.0",
   "description": "CLI for deploying built apps to 9pm.ai.",
   "homepage": "https://9pm.ai",
   "keywords": [