@aiam/ciba 0.9.4 → 0.9.6

package/ciba.mjs

@@ -689,6 +689,35 @@ const refreshCmd = defineCommand({
   },
 });
 
+const inspectCmd = defineCommand({
+  meta: { description: 'Open live device doc inspector in browser' },
+  args: {
+    url: { ...serverArg },
+  },
+  async run({ args }) {
+    const serverUrl = args.url || process.env.CIBA_URL || loadConfig().url || DEFAULT_SERVER_URL;
+    const keys = loadOrGenerateEcdhKeys();
+    const { jwt: deviceJwt } = signDeviceJwt(keys.privateKey, keys.publicKey);
+
+    // POST /inspect with device JWT to get a one-time inspect code.
+    const res = await fetch(`${serverUrl}/inspect`, {
+      method: 'POST',
+      headers: { Authorization: `Bearer ${deviceJwt}` },
+    });
+    if (!res.ok) {
+      const err = await res.json().catch(() => ({}));
+      process.stderr.write(`Error: ${err.error || res.status}\n`);
+      process.exit(1);
+    }
+    const { code, url } = await res.json();
+    process.stderr.write(`→ inspect code: ${code}\n`);
+    process.stderr.write(`→ opening:      ${url}\n`);
+    const cmd = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'start ""' : 'xdg-open';
+    exec(`${cmd} "${url}"`);
+    process.exit(0);
+  },
+});
+
 const logoutCmd = defineCommand({
   meta: { description: 'Clear device keys, session and config (next login generates a new device identity)' },
   args: {},
@@ -764,6 +793,7 @@ const main = defineCommand({
     login:   loginCmd,
     token:   tokenCmd,
     refresh: refreshCmd,
+    inspect: inspectCmd,
     stop:    stopCmd,
     status:  statusCmd,
     logout:  logoutCmd,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiam/ciba",
-  "version": "0.9.4",
+  "version": "0.9.6",
   "description": "OAuth 2.0 Device Authorization Grant CLI with cross-device push approval (Yjs sync, ECDH-encrypted token delivery, persistent device id)",
   "type": "module",
   "bin": {

package/token.mjs

@@ -30,11 +30,22 @@ const args = process.argv.slice(2);
 const get = (flag) => { const i = args.indexOf(flag); return i !== -1 ? args[i + 1] : undefined; };
 const has = (flag) => args.includes(flag);
 
-const resource = get('--resource') ?? `urn:sap:destination:${process.env.CIBA_DEFAULT_DESTINATION || 'WEBAGENTS_BACKEND'}`;
-const jsonOut  = has('--json');
-const envOut   = has('--env');
+const resource  = get('--resource') ?? `urn:sap:destination:${process.env.CIBA_DEFAULT_DESTINATION || 'WEBAGENTS_BACKEND'}`;
+const jsonOut   = has('--json');
+const envOut    = has('--env');
 const isRefresh = has('--refresh');
 
+// Collect all unrecognised --key value pairs as extra request attrs.
+// Server uses them for login-hint, tenant, scope, app_tid, etc.
+const KNOWN = new Set(['--resource', '--url', '--json', '--env', '--refresh']);
+const extraAttrs = {};
+for (let i = 0; i < args.length; i++) {
+  if (args[i].startsWith('--') && !KNOWN.has(args[i]) && i + 1 < args.length && !args[i + 1].startsWith('--')) {
+    extraAttrs[args[i].slice(2).replace(/-/g, '_')] = args[i + 1];
+    i++;
+  }
+}
+
 // ─── Config ───────────────────────────────────────────────────────────────────
 
 function loadConfig() {
@@ -119,7 +130,17 @@ function tryGet(resourcesMap, deviceDoc, res) {
 
 // ─── Output ───────────────────────────────────────────────────────────────────
 
-function log(msg) { process.stderr.write(msg + '\n'); }
+// Log entries go to Yjs `log` map on device doc (visible in ciba inspect).
+// Before doc is synced, fall back to stderr.
+let _logMap = null;
+let _logIdx = 0;
+function log(msg) {
+  if (_logMap) {
+    _logMap.set(`${Date.now()}-${_logIdx++}`, { ts: new Date().toISOString(), msg });
+  } else {
+    process.stderr.write(msg + '\n');
+  }
+}
 
 function output(token) {
   if (jsonOut) {
@@ -159,6 +180,8 @@ await new Promise((resolve, reject) => {
   provider.on('authenticationFailed', ({ reason }) => { clearTimeout(t); reject(new Error(reason)); });
 });
 
+// Switch logging to Yjs after sync — ciba inspect can now see entries.
+_logMap = deviceDoc.getMap('log');
 log('→ synced');
 
 // Write public key
@@ -198,7 +221,7 @@ if (isRefresh) {
   const requests = deviceDoc.getMap('requests');
   const newRid = randomBytes(8).toString('base64url');
   log(`→ refresh — writing request ${newRid}`);
-  requests.set(newRid, { resource, status: 'pending', created_at: new Date().toISOString() });
+  requests.set(newRid, { ...extraAttrs, resource, status: 'pending', created_at: new Date().toISOString() });
   provider.destroy();
   process.exit(0);
 }
@@ -217,7 +240,7 @@ if (found) {
 const requests = deviceDoc.getMap('requests');
 const newRid = randomBytes(8).toString('base64url');
 log(`→ cache miss — writing request ${newRid} resource=${resolvedResource}`);
-requests.set(newRid, { resource: resolvedResource, status: 'pending', created_at: new Date().toISOString() });
+requests.set(newRid, { ...extraAttrs, resource: resolvedResource, status: 'pending', created_at: new Date().toISOString() });
 
 // Wait for resources to update
 log('→ waiting for token...');