orizu 0.1.6 → 0.2.1

package/README.md

@@ -50,6 +50,7 @@ orizu login
 ```
 
 This will open a browser tab for you to login with. You must either have an account on the [Orizu platform](https://orizu.ai) or it will help you create one.
+Approving the login creates a personal access token for the CLI and stores it in your local Orizu credentials file. You can revoke CLI tokens from the Personal Tokens page in Orizu.
 
 **Check the signed-in user**
 
@@ -120,6 +121,10 @@ orizu logout
     <td>Append dataset rows</td>
     <td><code>orizu datasets append --dataset &lt;datasetId&gt; --file ./datasets/support-extra.jsonl</code></td>
   </tr>
+  <tr>
+    <td>Delete a dataset</td>
+    <td><code>orizu datasets delete --dataset &lt;datasetId&gt;</code> (interactive confirmation required)</td>
+  </tr>
   <tr>
     <td>Lock a dataset</td>
     <td><code>orizu datasets lock --dataset &lt;datasetId&gt; --reason "Finalize for labeling"</code></td>

package/dist/credentials.js

@@ -18,6 +18,13 @@ function isStoredCredentialsV2(value) {
     const typed = value;
     return typed.version === 2 && !!typed.servers && typeof typed.servers === 'object';
 }
+function isStoredCredentialsV3(value) {
+    if (!value || typeof value !== 'object') {
+        return false;
+    }
+    const typed = value;
+    return typed.version === 3 && !!typed.servers && typeof typed.servers === 'object';
+}
 function isStoredCredentialsV1(value) {
     if (!value || typeof value !== 'object') {
         return false;
@@ -74,7 +81,7 @@ function writeCredentials(config) {
 }
 function createEmptyCredentialsConfig() {
     return {
-        version: 2,
+        version: 3,
         activeBaseUrl: null,
         servers: {},
     };
@@ -101,6 +108,9 @@ export function loadCredentialsConfig() {
         console.warn('Warning: credentials file contains invalid JSON — please re-login with `orizu login`');
         return null;
     }
+    if (isStoredCredentialsV3(parsed)) {
+        return parsed;
+    }
     if (isStoredCredentialsV2(parsed)) {
         return parsed;
     }
@@ -121,13 +131,27 @@ export function getServerCredentials(baseUrl) {
     return config.servers[baseUrl] || null;
 }
 export function saveServerCredentials(baseUrl, credentials) {
-    const config = loadCredentialsConfigForWrite();
+    const loaded = loadCredentialsConfigForWrite();
+    const config = loaded.version === 3
+        ? loaded
+        : {
+            version: 3,
+            activeBaseUrl: loaded.activeBaseUrl,
+            servers: loaded.servers,
+        };
     config.servers[baseUrl] = credentials;
     config.activeBaseUrl = baseUrl;
     writeCredentials(config);
 }
 export function updateServerCredentials(baseUrl, credentials) {
-    const config = loadCredentialsConfigForWrite();
+    const loaded = loadCredentialsConfigForWrite();
+    const config = loaded.version === 3
+        ? loaded
+        : {
+            version: 3,
+            activeBaseUrl: loaded.activeBaseUrl,
+            servers: loaded.servers,
+        };
     config.servers[baseUrl] = credentials;
     writeCredentials(config);
 }

package/dist/http.js

@@ -55,11 +55,20 @@ export function assertSecureTokenTransport(baseUrl) {
     }
     throw new Error(`Refusing to send CLI tokens to ${baseUrl}. Use HTTPS, or --local for loopback development.`);
 }
+function isSessionCredentials(credentials) {
+    return 'accessToken' in credentials;
+}
+function getAuthorizationToken(credentials) {
+    return isSessionCredentials(credentials) ? credentials.accessToken : credentials.apiKey;
+}
 function isExpired(expiresAt) {
     const nowUnix = Math.floor(Date.now() / 1000);
     return expiresAt <= nowUnix + 30;
 }
 async function refreshCredentials(baseUrl, credentials) {
+    if (!isSessionCredentials(credentials)) {
+        throw new Error('API key credentials do not refresh. Run `orizu login` again if access fails.');
+    }
     assertSecureTokenTransport(baseUrl);
     const response = await fetch(`${baseUrl}/api/cli/auth/refresh`, {
         method: 'POST',
@@ -70,7 +79,11 @@ async function refreshCredentials(baseUrl, credentials) {
         throw new Error('Session expired. Run `orizu login` again.');
     }
     const data = await response.json();
+    if (!data.accessToken || !data.refreshToken || !data.expiresAt) {
+        throw new Error('Server returned invalid refresh credentials. Run `orizu login` again.');
+    }
     const refreshed = {
+        credentialType: 'session',
         accessToken: data.accessToken,
         refreshToken: data.refreshToken,
         expiresAt: data.expiresAt,
@@ -86,23 +99,23 @@ export async function authedFetch(path, init = {}) {
         throw new Error(`Not logged in for ${baseUrl}. Run \`orizu login --server ${baseUrl}\` (or \`--local\`) first.`);
     }
     let activeCredentials = credentials;
-    if (isExpired(activeCredentials.expiresAt)) {
+    if (isSessionCredentials(activeCredentials) && isExpired(activeCredentials.expiresAt)) {
         activeCredentials = await refreshCredentials(baseUrl, activeCredentials);
     }
     let response = await fetch(`${baseUrl}${path}`, {
         ...init,
         headers: {
             ...(init.headers || {}),
-            Authorization: `Bearer ${activeCredentials.accessToken}`,
+            Authorization: `Bearer ${getAuthorizationToken(activeCredentials)}`,
         },
     });
-    if (response.status === 401) {
+    if (response.status === 401 && isSessionCredentials(activeCredentials)) {
         activeCredentials = await refreshCredentials(baseUrl, activeCredentials);
         response = await fetch(`${baseUrl}${path}`, {
             ...init,
             headers: {
                 ...(init.headers || {}),
-                Authorization: `Bearer ${activeCredentials.accessToken}`,
+                Authorization: `Bearer ${getAuthorizationToken(activeCredentials)}`,
             },
         });
     }