tileflow 0.1.0-alpha.20 → 0.1.0-alpha.21

package/README.md

@@ -269,10 +269,10 @@ npx tileflow tileset publish ./data/stores.pmtiles --id stores --team @acme --at
 npx tileflow tileset status stores --team @acme --json
 ```
 
-Use your own file, Team selector, and attribution. Inspection is account-free. Publication validates
-and uploads a managed dataset using Team data authority, not a map-only deploy key. Interrupted
-uploads are resumable; a completed version becomes current at stable delivery URLs. Purge is
-explicit, requires confirmation, and can be blocked by retained deployment dependencies.
+Use your own file, Team and attribution. Inspection needs no account. Publication requires Team data
+authority and renews account-backed authorization during long transfers and validation. Interrupted
+uploads resume; published versions become current at stable delivery URLs. Purge requires confirmation
+and can be blocked by retained deployment dependencies.
 
 Administratively disabled uploads return `TF_TILESET_UPLOAD_DISABLED` without retrying.
 Temporary service failures retain bounded retries.

package/dist/index.js

@@ -4501,7 +4501,7 @@ async function requestTeamCapability(session, team, scopes, options = {}) {
   if (!response.json || body.schemaVersion !== 1 || typeof body.capability !== "string" || !body.capability.startsWith("tf_cap_") || body.capability.length > 8192 || body.reference !== team || !isProjectIdentity(body.team) || `@${body.team.slug}` !== team || !validIsoDate(body.expiresAt) || !Array.isArray(body.scopes) || body.scopes.join("\0") !== [...scopes].sort().join("\0")) {
     return { error: "Team capability response was invalid.", ok: false };
   }
-  return { capability: body.capability, ok: true, team: body.team };
+  return { capability: body.capability, expiresAt: body.expiresAt, ok: true, team: body.team };
 }
 async function listAccountTeams(session, options = {}) {
   const response = await requestHostedJson(
@@ -6308,20 +6308,41 @@ async function resolveTeamAuthority(options, scopes, dependencies) {
     return null;
   }
   const capability = await requestTeamCapability(selected.session, `@${team.slug}`, scopes);
-  if (!capability.ok) {
-    emitFailure(options.json, "team_capability_failed", capability.error);
+  if (!capability.ok || capability.team.id !== team.id) {
+    emitFailure(
+      options.json,
+      "team_capability_failed",
+      capability.ok ? "Team capability response was invalid." : capability.error
+    );
     return null;
   }
+  let current = capability;
+  let renewal;
+  const getCredential = async () => {
+    if (Date.parse(current.expiresAt) > Date.now() + 3e4) return current.capability;
+    renewal ??= requestTeamCapability(selected.session, `@${team.slug}`, scopes).then((next) => {
+      if (!next.ok || next.team.id !== team.id || Date.parse(next.expiresAt) <= Date.now() + 3e4) {
+        throw new Error("Team authorization could not be renewed. Run tileflow login.");
+      }
+      current = next;
+    }).finally(() => {
+      renewal = void 0;
+    });
+    await renewal;
+    return current.capability;
+  };
   return {
     apiOrigin: selected.session.apiOrigin,
     credential: capability.capability,
+    getCredential,
     team
   };
 }
-function authorizedTeamRequest(authority, path, method, init = {}) {
+async function authorizedTeamRequest(authority, path, method, init = {}) {
+  const credential = await authority.getCredential?.() ?? authority.credential;
   return requestHostedJson(authority.apiOrigin, path, {
     ...init.body === void 0 ? {} : { body: init.body },
-    headers: { Authorization: `Bearer ${authority.credential}`, ...init.headers },
+    headers: { Authorization: `Bearer ${credential}`, ...init.headers },
     method
   });
 }
@@ -8536,6 +8557,15 @@ function createHostedTeamTilesetUploadTransport(input) {
   const basePath = `/v1/tilesets/${encodeURIComponent(input.tilesetId)}/uploads`;
   const control = async (path, init) => {
     for (let attempt = 1; attempt <= maximumControlAttempts; attempt += 1) {
+      let credential;
+      try {
+        credential = await input.getCredential?.() ?? input.credential;
+      } catch {
+        throw new TeamTilesetUploadError(
+          "TF_TILESET_UPLOAD_UNAVAILABLE",
+          "Team authorization could not be renewed. Run tileflow login and retry the upload."
+        );
+      }
       let response;
       try {
         response = await requestHostedJson(
@@ -8544,7 +8574,7 @@ function createHostedTeamTilesetUploadTransport(input) {
           {
             ...init,
             headers: {
-              Authorization: `Bearer ${input.credential}`,
+              Authorization: `Bearer ${credential}`,
               ...init.body ? { "Content-Type": "application/json" } : {},
               ...init.headers
             }
@@ -9000,7 +9030,7 @@ function registerTilesetCommands(program2, dependencies) {
         const prepared = await prepareTeamTilesetUpload(uploadFile);
         const authority = await resolveTeamAuthority(options, ["tilesets:write"], dependencies);
         if (!authority) return;
-        const registration = await requestHostedJson(authority.apiOrigin, "/v1/tilesets", {
+        const registration = await authorizedTeamRequest(authority, "/v1/tilesets", "POST", {
           body: JSON.stringify({
             ...options.attribution ? { attribution: options.attribution } : {},
             format: "pmtiles",
@@ -9008,10 +9038,8 @@ function registerTilesetCommands(program2, dependencies) {
             slug: options.id
           }),
           headers: {
-            Authorization: `Bearer ${authority.credential}`,
             "Content-Type": "application/json"
-          },
-          method: "POST"
+          }
         });
         const registered = asRecord4(registration.body);
         const resourceId = String(registered.tilesetId ?? "");
@@ -9044,6 +9072,7 @@ function registerTilesetCommands(program2, dependencies) {
           transport: createHostedTeamTilesetUploadTransport({
             apiOrigin: authority.apiOrigin,
             credential: authority.credential,
+            getCredential: authority.getCredential,
             tilesetId: resourceId
           }),
           upload: prepared
@@ -9133,15 +9162,14 @@ function registerTilesetCommands(program2, dependencies) {
       }
       const authority = await resolveTeamAuthority(options, ["tilesets:write"], dependencies);
       if (!authority) return;
-      const response = await requestHostedJson(
-        authority.apiOrigin,
+      const response = await authorizedTeamRequest(
+        authority,
         `/v1/tilesets/${encodeURIComponent(id)}`,
+        "DELETE",
         {
           headers: {
-            Authorization: `Bearer ${authority.credential}`,
             "X-Tileflow-Confirm-Tileset-Purge": id
-          },
-          method: "DELETE"
+          }
         }
       );
       if (!response.ok) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tileflow",
-  "version": "0.1.0-alpha.20",
+  "version": "0.1.0-alpha.21",
   "license": "Apache-2.0",
   "description": "CLI-only tools for Tileflow config, capture, visual testing, and deploy.",
   "type": "module",
@@ -38,8 +38,8 @@
     "@tileflow/capture": ">=0.1.0-alpha.37 <0.1.0-beta.0",
     "@tileflow/coordinates": ">=0.1.0-alpha.3 <0.1.0-beta.0",
     "@tileflow/coordinates-runtime": ">=0.1.0-alpha.6 <0.1.0-beta.0",
-    "@tileflow/core": ">=0.1.0-alpha.45 <0.1.0-beta.0",
-    "@tileflow/dev": ">=0.1.0-alpha.41 <0.1.0-beta.0",
+    "@tileflow/core": ">=0.1.0-alpha.46 <0.1.0-beta.0",
+    "@tileflow/dev": ">=0.1.0-alpha.42 <0.1.0-beta.0",
     "@tileflow/maps": ">=0.1.0-alpha.18 <0.1.0-beta.0",
     "commander": "^15.0.0",
     "hono": "4.13.14",