@aiam/ciba 0.9.5 → 0.9.6

package/ciba.mjs

@@ -689,6 +689,35 @@ const refreshCmd = defineCommand({
   },
 });
 
+const inspectCmd = defineCommand({
+  meta: { description: 'Open live device doc inspector in browser' },
+  args: {
+    url: { ...serverArg },
+  },
+  async run({ args }) {
+    const serverUrl = args.url || process.env.CIBA_URL || loadConfig().url || DEFAULT_SERVER_URL;
+    const keys = loadOrGenerateEcdhKeys();
+    const { jwt: deviceJwt } = signDeviceJwt(keys.privateKey, keys.publicKey);
+
+    // POST /inspect with device JWT to get a one-time inspect code.
+    const res = await fetch(`${serverUrl}/inspect`, {
+      method: 'POST',
+      headers: { Authorization: `Bearer ${deviceJwt}` },
+    });
+    if (!res.ok) {
+      const err = await res.json().catch(() => ({}));
+      process.stderr.write(`Error: ${err.error || res.status}\n`);
+      process.exit(1);
+    }
+    const { code, url } = await res.json();
+    process.stderr.write(`→ inspect code: ${code}\n`);
+    process.stderr.write(`→ opening:      ${url}\n`);
+    const cmd = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'start ""' : 'xdg-open';
+    exec(`${cmd} "${url}"`);
+    process.exit(0);
+  },
+});
+
 const logoutCmd = defineCommand({
   meta: { description: 'Clear device keys, session and config (next login generates a new device identity)' },
   args: {},
@@ -764,6 +793,7 @@ const main = defineCommand({
     login:   loginCmd,
     token:   tokenCmd,
     refresh: refreshCmd,
+    inspect: inspectCmd,
     stop:    stopCmd,
     status:  statusCmd,
     logout:  logoutCmd,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiam/ciba",
-  "version": "0.9.5",
+  "version": "0.9.6",
   "description": "OAuth 2.0 Device Authorization Grant CLI with cross-device push approval (Yjs sync, ECDH-encrypted token delivery, persistent device id)",
   "type": "module",
   "bin": {

package/token.mjs

@@ -130,7 +130,17 @@ function tryGet(resourcesMap, deviceDoc, res) {
 
 // ─── Output ───────────────────────────────────────────────────────────────────
 
-function log(msg) { process.stderr.write(msg + '\n'); }
+// Log entries go to Yjs `log` map on device doc (visible in ciba inspect).
+// Before doc is synced, fall back to stderr.
+let _logMap = null;
+let _logIdx = 0;
+function log(msg) {
+  if (_logMap) {
+    _logMap.set(`${Date.now()}-${_logIdx++}`, { ts: new Date().toISOString(), msg });
+  } else {
+    process.stderr.write(msg + '\n');
+  }
+}
 
 function output(token) {
   if (jsonOut) {
@@ -170,6 +180,8 @@ await new Promise((resolve, reject) => {
   provider.on('authenticationFailed', ({ reason }) => { clearTimeout(t); reject(new Error(reason)); });
 });
 
+// Switch logging to Yjs after sync — ciba inspect can now see entries.
+_logMap = deviceDoc.getMap('log');
 log('→ synced');
 
 // Write public key