synthesisui 0.16.57 → 0.16.59

package/dist/commands/import.js

@@ -1,6 +1,6 @@
 import { mkdir, readdir, readFile, writeFile } from "node:fs/promises";
-import { basename, join, relative } from "node:path";
-import { readToken, resolveRegistry } from "../config.js";
+import { basename, dirname, join, relative } from "node:path";
+import { readCredentials, readToken, resolveRegistry, sameRegistry, } from "../config.js";
 import { isNearDuplicate, isNeutral, lightness, } from "../doctor/color-distance.js";
 import { emptyTally, internalSpecifiers, scanComponentsInto, tallyToInventory, } from "../doctor/components-scan.js";
 import { crosswalk, observedRules } from "../doctor/crosswalk.js";
@@ -894,8 +894,12 @@ export async function runImport(opts) {
     summarize(census);
     if (!opts.census)
         await sayIfWorkspace(root);
-    const out = join(root, "_synthesisui", "census.json");
-    await mkdir(join(root, "_synthesisui"), { recursive: true });
+    // A census handed to us is written BACK TO ITSELF. Deriving the path from the
+    // root instead planted a second census at the repo root when the real one
+    // lived in `packages/ui/_synthesisui/` - two files, silently disagreeing
+    // about which import happened (dono, 31/07).
+    const out = opts.census ?? join(root, "_synthesisui", "census.json");
+    await mkdir(dirname(out), { recursive: true });
     await writeFile(out, `${JSON.stringify(census, null, 2)}\n`, "utf8");
     console.log("");
     console.log(body(`Written to ${paint.strong(relative(root, out))}`));
@@ -944,6 +948,20 @@ export async function runImport(opts) {
         return;
     }
     const base = resolveRegistry(opts.registry);
+    // A token belongs to the host that issued it. Sending it anywhere else earns
+    // a 401 that describes the wrong problem entirely.
+    const creds = await readCredentials();
+    if (creds && !sameRegistry(creds.registry, base)) {
+        console.log("");
+        console.log(body(`You are logged in to ${paint.strong(creds.registry ?? "another registry")}, and this would go to ${paint.strong(base)}.`));
+        console.log(body("The census is on disk. Either name the one you meant:"));
+        console.log("");
+        console.log(body(`    synthesisui import --census ${out} --registry ${creds.registry}`));
+        console.log(body("or log in to this one:"));
+        console.log(body(`    synthesisui login --registry ${base}`));
+        console.log("");
+        return;
+    }
     const res = await fetch(`${base}/api/onboarding/import`, {
         method: "POST",
         headers: {
@@ -960,6 +978,18 @@ export async function runImport(opts) {
                 .catch(() => null)
             : null;
         console.log("");
+        // A 401 is not a refusal of the census, it is an expired session - and
+        // saying "HTTP 401" at the end of a long read leaves the person guessing at
+        // which of the two it was (dono, 31/07). A stale token gets past the
+        // `readToken` guard above and only fails here.
+        if (res?.status === 401) {
+            console.log(body("Your session has expired. The census is on disk."));
+            console.log("");
+            console.log(body(`    ${paint.strong("synthesisui login")}`));
+            console.log(body(`    synthesisui import --census ${out}${chosen ? ` --name "${chosen}"` : ""}`));
+            console.log("");
+            return;
+        }
         console.log(body(res
             ? `The registry refused it (HTTP ${res.status})${detail ? `: ${detail}` : "."}`
             : "Could not reach the registry. The census is on disk - try again later."));

package/dist/config.js

@@ -17,6 +17,33 @@ export const credentialsPath = join(homedir(), ".synthesisui", "credentials.json
  * Reads the saved token, if any. Optional for now (open gate); the device-flow
  * is what writes it. Sent as a Bearer header when present.
  */
+/**
+ * The token AND the registry it was issued for.
+ *
+ * They were always written together and never read together, so a token minted
+ * by `login --registry http://localhost:3000` was sent to production, which
+ * refused it with a 401 that read as "your session expired" (dono, 31/07). A
+ * session cannot expire on a host that never issued it.
+ */
+export async function readCredentials() {
+    try {
+        const raw = await readFile(credentialsPath, "utf8");
+        const parsed = JSON.parse(raw);
+        if (!parsed.token)
+            return null;
+        return { token: parsed.token, registry: parsed.registry ?? null };
+    }
+    catch {
+        return null;
+    }
+}
+/** Two registry URLs, compared the way a person means them. */
+export function sameRegistry(a, b) {
+    if (!a || !b)
+        return true;
+    const norm = (u) => u.trim().replace(/\/+$/, "").toLowerCase();
+    return norm(a) === norm(b);
+}
 export async function readToken() {
     try {
         const raw = await readFile(credentialsPath, "utf8");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "synthesisui",
-  "version": "0.16.57",
+  "version": "0.16.59",
   "description": "Bring SynthesisUI design systems into any project - tokens, typed components, whole pages and an agent-ready CLAUDE.md manifest.",
   "type": "module",
   "bin": {