ticketlens 0.21.0 → 0.21.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ticketlens",
-  "version": "0.21.0",
+  "version": "0.21.1",
   "description": "Jira CLI for developers — fetch ticket context, triage your queue, and stop tab-switching. Zero dependencies, all local.",
   "type": "module",
   "bin": {

package/skills/jtb/scripts/lib/cli-auth.mjs

@@ -25,13 +25,37 @@ export function readCliToken(configDir = DEFAULT_CONFIG_DIR) {
   }
 }
 
-export function saveCliToken(token, configDir = DEFAULT_CONFIG_DIR) {
+// Server-asserted tier (personal or team-seat) synced alongside the token on
+// every login/sync — separate from the signed, offline license.json file.
+// Lets team-invited members get Pro-equivalent CLI access without a personal
+// TL- key, mirroring what the manager already pays for.
+export function readCliTokenTier(configDir = DEFAULT_CONFIG_DIR) {
+  const p = cliTokenPath(configDir);
+  if (!existsSync(p)) return null;
+  try {
+    const data = JSON.parse(readFileSync(p, 'utf8'));
+    return typeof data.tier === 'string' ? data.tier : null;
+  } catch {
+    return null;
+  }
+}
+
+export function saveCliToken(token, configDir = DEFAULT_CONFIG_DIR, tier = undefined) {
   mkdirSync(configDir, { recursive: true });
   const p = cliTokenPath(configDir);
-  writeFileSync(p, JSON.stringify({ token }, null, 2) + '\n', { encoding: 'utf8', mode: 0o600 });
+  const payload = tier === undefined ? { token } : { token, tier };
+  writeFileSync(p, JSON.stringify(payload, null, 2) + '\n', { encoding: 'utf8', mode: 0o600 });
   chmodSync(p, 0o600);
 }
 
+// Updates just the cached tier without touching the token — used by `tl sync`
+// to keep entitlement fresh between logins.
+export function saveCliTokenTier(tier, configDir = DEFAULT_CONFIG_DIR) {
+  const token = readCliToken(configDir);
+  if (!token) return;
+  saveCliToken(token, configDir, tier);
+}
+
 export function deleteCliToken(configDir = DEFAULT_CONFIG_DIR) {
   const p = cliTokenPath(configDir);
   if (existsSync(p)) {

package/skills/jtb/scripts/lib/license.mjs

@@ -5,6 +5,7 @@ import crypto from 'node:crypto';
 import { DEFAULT_CONFIG_DIR } from './config.mjs';
 import { createStyler } from './ansi.mjs';
 import { siteBase } from './api-utils.mjs';
+import { readCliTokenTier } from './cli-auth.mjs';
 
 // Mixed into the HMAC key so that knowing the license key alone is not sufficient
 // to forge a valid signature — an attacker also needs this constant from the source.
@@ -100,6 +101,15 @@ export function isLicensed(tier, configDir = DEFAULT_CONFIG_DIR) {
   if (required === 0) return true;
   if (process.env.TICKETLENS_SKIP_LICENSE === 'true') return true;
 
+  if (checkOwnLicense(required, configDir)) return true;
+
+  // Team-seat entitlement, server-asserted and synced via login/`tl sync` —
+  // covers invited team members who never activated a personal TL- key.
+  const syncedTier = LICENSE_TIERS[readCliTokenTier(configDir)] ?? 0;
+  return syncedTier >= required;
+}
+
+function checkOwnLicense(required, configDir) {
   const license = readLicense(configDir);
   if (!license) return false;
 

package/skills/jtb/scripts/lib/login-flow.mjs

@@ -83,7 +83,12 @@ export async function runLogin({
     return;
   }
 
-  saveCliTokenFn(token);
+  let tier;
+  try {
+    tier = (await res.json())?.tier;
+  } catch { /* tier is best-effort — token is still valid */ }
+
+  saveCliTokenFn(token, undefined, tier);
   stream.write(`\x1b[A\r\x1b[2K  ${s.green('✔')} Logged in.\n`);
 
   // Flow 1: pull team Jira config for Pro/Team members (silently skipped for Free)

package/skills/jtb/scripts/lib/sync.mjs

@@ -5,7 +5,7 @@
  * Server wins on all non-credential fields (shape, prefixes, URLs, etc.).
  */
 
-import { readCliToken } from './cli-auth.mjs';
+import { readCliToken, saveCliTokenTier } from './cli-auth.mjs';
 import {
   loadProfiles,
   loadCredentials,
@@ -88,6 +88,8 @@ export async function syncProfiles({
   let json;
   try { json = await res.json(); } catch { return { error: 'invalid-json' }; }
 
+  if (typeof json?.tier === 'string') saveCliTokenTier(json.tier, configDir);
+
   const remoteProfiles = Array.isArray(json?.profiles) ? json.profiles : [];
   const localConfig  = loadProfiles(configDir) || { profiles: {} };
   const localCreds   = loadCredentials(configDir);