@alter-ai/cli 0.1.0 → 0.3.0

package/README.md

@@ -16,7 +16,7 @@ The fastest interactive sign-in is the browser-dance flow — `alter auth login`
 
 ```bash
 alter auth login
-# alter: opening browser at https://dashboard.alterauth.com/cli-auth
+# alter: opening browser at https://portal.alterauth.com/cli-auth
 #        (waiting up to 2 minutes for you to approve)…
 # alter: signed in via browser-dance flow.
 

package/dist/cli.js

@@ -176,7 +176,7 @@ async function maybePrintUpdateBanner(currentVersion, argv2 = process.argv.slice
 // package.json
 var package_default = {
   name: "@alter-ai/cli",
-  version: "0.1.0",
+  version: "0.3.0",
   description: "Command-line interface for the Alter Vault dev portal \u2014 scripted dashboard automation.",
   type: "module",
   bin: {
@@ -440,10 +440,23 @@ var GrantRevokedError = class extends ReAuthRequiredError {
 };
 var CredentialRevokedError = class extends ReAuthRequiredError {
   grantId;
-  constructor(message, grantId, details) {
+  // Recovery-context fields. Populated by the backend at the raise
+  // site in token_service so callers can mint a Connect session for
+  // the same (user, provider) without re-fetching the grant. See
+  // docs/planning/CONNECT_RECOVERY_CONTEXT.md.
+  providerId;
+  appUserId;
+  // Recovery context is appended AFTER `details` so the existing
+  // positional contract `new CredentialRevokedError("msg", "g-1",
+  // detailsObj)` keeps compiling AND keeps assigning detailsObj to
+  // the `details` slot — only the wire-parsing site uses the new
+  // positional slots.
+  constructor(message, grantId, details, providerId, appUserId) {
     super(message, details);
     this.name = "CredentialRevokedError";
     this.grantId = grantId;
+    this.providerId = providerId;
+    this.appUserId = appUserId;
   }
 };
 var GrantDeletedError = class extends ReAuthRequiredError {
@@ -453,9 +466,19 @@ var GrantDeletedError = class extends ReAuthRequiredError {
   }
 };
 var GrantNotFoundError = class extends BackendError {
-  constructor(message, details) {
+  providerId;
+  agentId;
+  appUserId;
+  // Recovery context is appended AFTER `details` so the existing
+  // positional contract `new GrantNotFoundError("msg", detailsObj)`
+  // keeps compiling AND keeps assigning detailsObj to the `details`
+  // slot — only the wire-parsing site uses the new positional slots.
+  constructor(message, details, providerId, agentId, appUserId) {
     super(message, details);
     this.name = "GrantNotFoundError";
+    this.providerId = providerId;
+    this.agentId = agentId;
+    this.appUserId = appUserId;
   }
 };
 var AmbiguousGrantError = class extends BackendError {
@@ -468,23 +491,43 @@ var AmbiguousGrantError = class extends BackendError {
   // UUIDs only (no emails / names) — same backend hygiene rule that
   // applies to the rest of the cross-tenant probe surface.
   appUserIds;
-  constructor(message, providerId, accountIdentifiers, accountWasProvided, appUserIds, details) {
+  // Populated for the managed-secret grant-level flavor: one user
+  // delegated multiple managed-secret grants sharing the same
+  // template to the same agent. The SDK caller picks one via
+  // `grantId=` on the next request. UUIDs only.
+  grantIds;
+  constructor(message, providerId, accountIdentifiers, accountWasProvided, appUserIds, details, grantIds) {
     super(message, details);
     this.name = "AmbiguousGrantError";
     this.providerId = providerId;
     this.accountIdentifiers = accountIdentifiers ?? [];
     this.accountWasProvided = accountWasProvided ?? false;
     this.appUserIds = appUserIds ?? [];
+    this.grantIds = grantIds ?? [];
   }
 };
 var NoDelegatedGrantError = class extends BackendError {
+  // `providerId` + `agentId` shipped in the pre-recovery PR, so they
+  // KEEP their positional slots. `appUserId` is new in this PR and
+  // appended AFTER `details` so the existing 4-arg call shape
+  // `new NoDelegatedGrantError(msg, providerId, agentId, details)`
+  // continues to work — only the wire-parsing site uses the new
+  // appUserId slot.
   providerId;
   agentId;
-  constructor(message, providerId, agentId, details) {
+  // Populated when the resolution applied a user filter. Diagnostic /
+  // correlation field only — the recovery helper does NOT auto-bind
+  // the session to the user. Pass `userToken=` to
+  // `createConnectSessionForError` (or configure `userTokenGetter` on
+  // the client) when user binding is required. See
+  // docs/planning/CONNECT_RECOVERY_CONTEXT.md.
+  appUserId;
+  constructor(message, providerId, agentId, details, appUserId) {
     super(message, details);
     this.name = "NoDelegatedGrantError";
     this.providerId = providerId;
     this.agentId = agentId;
+    this.appUserId = appUserId;
   }
 };
 var PolicyViolationError = class extends BackendError {
@@ -2895,7 +2938,7 @@ function _extractAdditionalCredentials(token) {
   return _additionalCredsStore.get(token);
 }
 var _fetch;
-var SDK_VERSION = "0.14.0";
+var SDK_VERSION = "0.15.0";
 var SDK_USER_AGENT = `alter-sdk-node/${SDK_VERSION}`;
 var HTTP_FORBIDDEN = 403;
 var HTTP_NO_CONTENT2 = 204;
@@ -3506,7 +3549,10 @@ ${effectiveConstraints}`;
       if (errorCode === "credential_revoked") {
         throw new CredentialRevokedError(
           errorData.message ?? "Credential has been revoked. User must re-authorize.",
-          errorData.grant_id
+          errorData.grant_id,
+          errorData,
+          typeof errorData.provider_id === "string" ? errorData.provider_id : void 0,
+          typeof errorData.app_user_id === "string" ? errorData.app_user_id : void 0
         );
       }
       if (errorData.error === "scope_mismatch") {
@@ -3546,13 +3592,17 @@ ${effectiveConstraints}`;
         const appUserIds = Array.isArray(errorData.app_user_ids) ? errorData.app_user_ids.filter(
           (v) => typeof v === "string"
         ) : [];
+        const grantIds = Array.isArray(errorData.grant_ids) ? errorData.grant_ids.filter(
+          (v) => typeof v === "string"
+        ) : [];
         throw new AmbiguousGrantError(
           errorData.message ?? "JWT identity resolved to multiple grants. Pass the 'account' parameter to disambiguate.",
           typeof errorData.provider_id === "string" ? errorData.provider_id : void 0,
           accountIdentifiers,
           errorData.account_was_provided === true,
           appUserIds,
-          errorData
+          errorData,
+          grantIds
         );
       }
       if (errorData.error === "no_delegated_grant") {
@@ -3560,7 +3610,8 @@ ${effectiveConstraints}`;
           errorData.message ?? "Agent has no active delegation or managed-secret grant for this provider.",
           typeof errorData.provider_id === "string" ? errorData.provider_id : void 0,
           typeof errorData.agent_id === "string" ? errorData.agent_id : void 0,
-          errorData
+          errorData,
+          typeof errorData.app_user_id === "string" ? errorData.app_user_id : void 0
         );
       }
       throw new BackendError(
@@ -3577,9 +3628,21 @@ ${effectiveConstraints}`;
     }
     if (response.status === HTTP_NOT_FOUND) {
       const errorData = await __VaultClient.#safeParseJson(response);
+      if (errorData.error === "no_delegated_grant") {
+        throw new NoDelegatedGrantError(
+          errorData.message ?? "Agent has no active delegation or managed-secret grant for this provider.",
+          typeof errorData.provider_id === "string" ? errorData.provider_id : void 0,
+          typeof errorData.agent_id === "string" ? errorData.agent_id : void 0,
+          errorData,
+          typeof errorData.app_user_id === "string" ? errorData.app_user_id : void 0
+        );
+      }
       throw new GrantNotFoundError(
         errorData.message ?? "OAuth grant not found for the given grant_id",
-        errorData
+        errorData,
+        typeof errorData.provider_id === "string" ? errorData.provider_id : void 0,
+        typeof errorData.agent_id === "string" ? errorData.agent_id : void 0,
+        typeof errorData.app_user_id === "string" ? errorData.app_user_id : void 0
       );
     }
     if (response.status === HTTP_BAD_REQUEST || response.status === HTTP_BAD_GATEWAY) {
@@ -3595,7 +3658,9 @@ ${effectiveConstraints}`;
         throw new CredentialRevokedError(
           errorData.message ?? "Underlying credential has been revoked. User must re-authorize.",
           errorData.grant_id,
-          errorData
+          errorData,
+          typeof errorData.provider_id === "string" ? errorData.provider_id : void 0,
+          typeof errorData.app_user_id === "string" ? errorData.app_user_id : void 0
         );
       }
       throw new BackendError(
@@ -4787,7 +4852,14 @@ ${effectiveConstraints}`;
       }
       sessionBody.agent = options.agent;
     }
-    if (this.#userTokenGetter) {
+    if (options.userToken !== void 0) {
+      if (typeof options.userToken !== "string" || options.userToken.length === 0) {
+        throw new AlterValueError(
+          "userToken must be a non-empty string when provided"
+        );
+      }
+      sessionBody.user_token = options.userToken;
+    } else if (this.#userTokenGetter) {
       sessionBody.user_token = await this.#getUserToken();
     }
     const sessionPath = "/sdk/oauth/connect/session";
@@ -4951,10 +5023,43 @@ ${effectiveConstraints}`;
     } else {
       console.log(`Open this URL to authorize: ${session.connectUrl}`);
     }
+    return await this.pollConnectSession(session.sessionToken, {
+      timeoutMs,
+      pollIntervalMs
+    });
+  }
+  /**
+   * Poll a Connect session to completion.
+   *
+   * Use this when your code minted the Connect session itself (e.g.,
+   * via {@link createConnectSession} for a custom UI flow, or via
+   * {@link createConnectSessionForError} for a recovery flow) and
+   * you need to block until the user finishes the consent screen.
+   * {@link connect} is the all-in-one convenience that mints + opens
+   * the browser + polls; this method is the polling half on its own.
+   *
+   * @param sessionToken - A session token from
+   *     {@link createConnectSession} or
+   *     {@link createConnectSessionForError}.
+   * @param options - `timeoutMs` (default 300000 = 5 min) and
+   *     `pollIntervalMs` (default 2000). Milliseconds per ecosystem
+   *     convention; the Python SDK's equivalent uses seconds.
+   * @returns One `ConnectResult` per provider the user completed
+   *     within the session (multi-provider Connect sessions yield
+   *     multiple results).
+   * @throws ConnectTimeoutError if the session didn't complete within
+   *     `timeoutMs`.
+   * @throws ConnectFlowError / ConnectDeniedError / ConnectConfigError
+   *     for user denial, session expiry, or unrecognized status.
+   * @throws AlterSDKError if the SDK instance has been closed.
+   */
+  async pollConnectSession(sessionToken, options) {
+    this.#assertNotClosed();
+    const timeoutMs = options?.timeoutMs ?? 3e5;
+    const pollIntervalMs = options?.pollIntervalMs ?? 2e3;
     const deadline = Date.now() + timeoutMs;
-    while (Date.now() < deadline) {
-      await new Promise((resolve2) => setTimeout(resolve2, pollIntervalMs));
-      const pollResult = await this.#pollSession(session.sessionToken);
+    while (true) {
+      const pollResult = await this.#pollSession(sessionToken);
       const pollStatus = pollResult.status;
       if (pollStatus === "completed") {
         const grantsData = pollResult.grants ?? [];
@@ -4997,12 +5102,95 @@ ${effectiveConstraints}`;
           { status: pollStatus }
         );
       }
+      const remaining = deadline - Date.now();
+      if (remaining <= 0) break;
+      const sleepMs = Math.min(pollIntervalMs, remaining);
+      await new Promise((resolve2) => setTimeout(resolve2, sleepMs));
     }
     throw new ConnectTimeoutError(
       `OAuth flow did not complete within ${Math.round(timeoutMs / 1e3)} seconds. The user may not have finished authorizing in the browser.`,
       { timeoutMs }
     );
   }
+  /**
+   * Mint a recovery Connect session from a typed error.
+   *
+   * Use this in the catch block of an identity-mode or agent-mode
+   * request that failed because the user hasn't authorized the
+   * provider yet ({@link NoDelegatedGrantError}), or because the
+   * underlying credential is permanently broken
+   * ({@link CredentialRevokedError}), or because the resolved grant
+   * doesn't exist ({@link GrantNotFoundError} with identity-mode
+   * context).
+   *
+   * What the method reuses from the error:
+   * - `providerId` → threaded into `allowedProviders=[...]`. Required;
+   *   missing context throws `AlterValueError`.
+   * - `agentId` → threaded into `agent=` so the recovery session
+   *   re-binds the same delegation target. Required for
+   *   `NoDelegatedGrantError` recovery; absent on
+   *   `GrantNotFoundError` / `CredentialRevokedError` for user-direct
+   *   grants, in which case the call falls through to non-delegated
+   *   recovery.
+   *
+   * What the method does NOT reuse from the error:
+   * - `appUserId` is exposed on the typed error for caller use
+   *   (logging, audit correlation, deciding which user to re-prompt)
+   *   but is NOT threaded into the recovery session.
+   *   `createConnectSession` binds the session via `userToken` (JWT),
+   *   not `appUserId`. To bind the session, pass `userToken=`
+   *   explicitly or configure `userTokenGetter` on the SDK client.
+   *
+   * @example
+   * ```ts
+   * try {
+   *   await vault.request(HttpMethod.GET, "https://...", { provider: "<provider-id>" });
+   * } catch (e) {
+   *   if (e instanceof NoDelegatedGrantError) {
+   *     const session = await vault.createConnectSessionForError(e, {
+   *       allowedOrigin: "https://app.example.com",
+   *     });
+   *     redirectUser(session.connectUrl);
+   *     const results = await vault.pollConnectSession(session.sessionToken);
+   *     // Retry with results[0].grantId
+   *   }
+   * }
+   * ```
+   *
+   * @param error - The typed exception. Must carry `providerId`; if
+   *     `undefined` (direct-mode 404 from a stale grant_id), recovery
+   *     isn't derivable and this method throws `AlterValueError`
+   *     rather than guessing.
+   * @param options - Standard `createConnectSession` options. Supplied
+   *     per call so the recovery session matches the deployment
+   *     shape (popup, mobile redirect, headless). The convenience
+   *     method doesn't infer these from the error.
+   * @throws AlterValueError if `error.providerId` is `undefined`.
+   */
+  async createConnectSessionForError(error, options) {
+    const providerId = error.providerId;
+    if (providerId === void 0) {
+      throw new AlterValueError(
+        "Cannot mint a recovery Connect session: the typed error has no providerId context. This usually means the original call used direct grantId mode and the grantId was stale \u2014 there's no (user, provider) tuple to recover. Catch GrantNotFoundError separately and call createConnectSession() directly with the providers the user should re-authorize."
+      );
+    }
+    const agentId = error.agentId;
+    if (error instanceof NoDelegatedGrantError && agentId === void 0) {
+      throw new AlterValueError(
+        "Cannot mint a delegated recovery Connect session: the typed NoDelegatedGrantError has no agentId context. The backend may be on a version predating the recovery-context fields, or the wire payload was malformed. Upgrade the backend, or catch this and call createConnectSession() explicitly with the right agent=."
+      );
+    }
+    return await this.createConnectSession({
+      allowedProviders: [providerId],
+      allowedOrigin: options?.allowedOrigin,
+      returnUrl: options?.returnUrl,
+      metadata: options?.metadata,
+      grantPolicy: options?.grantPolicy,
+      requiredScopes: options?.requiredScopes,
+      agent: agentId,
+      userToken: options?.userToken
+    });
+  }
   /**
    * Trigger IDP login for end user via browser.
    *
@@ -6539,8 +6727,13 @@ var _keytarCache;
 async function loadKeytar() {
   if (_keytarCache !== void 0) return _keytarCache;
   try {
-    const mod = await import("keytar");
-    _keytarCache = mod;
+    const raw = await import("keytar");
+    const candidate = raw.default ?? raw;
+    if (typeof candidate.getPassword === "function" && typeof candidate.setPassword === "function" && typeof candidate.deletePassword === "function") {
+      _keytarCache = candidate;
+    } else {
+      _keytarCache = null;
+    }
   } catch {
     _keytarCache = null;
   }
@@ -6548,7 +6741,7 @@ async function loadKeytar() {
 }
 function printPlaintextFallbackWarning() {
   process.stderr.write(
-    "alter: WARNING \u2014 saving the PAT to a plaintext file (~/.config/alter/auth.toml).\n       The OS keychain (keytar) is not available on this host. Install the\n       native build tools and re-run `npm install -g @alter-ai/cli` to enable\n       secure storage:\n         macOS:   xcode-select --install\n         Linux:   sudo apt install libsecret-1-dev gnome-keyring  (or distro equivalent)\n         Windows: install windows-build-tools or VS Build Tools\n"
+    "alter: WARNING \u2014 saving the PAT to a plaintext file (~/.config/alter/auth.toml, mode 0600).\n       The OS keychain (keytar) is not usable on this host. Common causes:\n         - keytar's native module failed to install (Linux: install libsecret-1-dev +\n           gnome-keyring; Windows: install VS Build Tools; macOS: usually pre-installed).\n         - The native module is present but its API surface doesn't match what the CLI\n           expects (file a bug against @alter-ai/cli with your node + npm versions).\n       If the cleartext fallback is unacceptable on this host, revoke the PAT from the\n       dashboard's `Personal Access Tokens` page after use.\n"
   );
 }
 async function loadStoredAuth2() {
@@ -6642,11 +6835,11 @@ async function clearStoredAuth2() {
 
 // src/portal-client.ts
 import { platform, release } from "os";
-var DEFAULT_BASE_URL = "https://api.alterauth.com";
+var DEFAULT_BASE_URL = "https://backend.alterauth.com";
 var PAT_API_PREFIX = "/api/v1/dev-portal";
 var HTTP_ERROR_THRESHOLD = 400;
 var DEFAULT_TIMEOUT_MS = 3e4;
-var CLI_VERSION = "0.1.0";
+var CLI_VERSION = "0.3.0";
 var USER_AGENT = buildUserAgent();
 function buildUserAgent() {
   let osTag = "";
@@ -9383,7 +9576,7 @@ var DEFAULT_SCOPES = [
   "dashboard_secrets:write"
 ];
 function deriveDashboardUrl(baseUrl) {
-  return baseUrl.replace(/^https:\/\/api\./, "https://dashboard.");
+  return baseUrl.replace(/^https:\/\/backend\./, "https://portal.");
 }
 function defaultOpenBrowser(url) {
   let command;
@@ -9500,7 +9693,7 @@ async function runBrowserDance(options) {
         server.close();
         reject(
           new Error(
-            "browser-dance callback came from an unexpected origin \u2014 refusing to accept. Re-run ``alter auth login`` and verify the dashboard URL."
+            `browser-dance callback came from an unexpected origin \u2014 refusing to accept. Expected origin ${JSON.stringify(dashboardOrigin)}; received Origin: ${JSON.stringify(origin || "(none)")}, Referer: ${JSON.stringify(referer || "(none)")}. If your dashboard isn't at the regex-derived host, re-run with --dashboard-url <https-url> pointing at the actual dashboard origin.`
           )
         );
         return;
@@ -9634,8 +9827,21 @@ async function runBrowserDance(options) {
     pat,
     ...options.baseUrl ? { baseUrl: options.baseUrl } : {}
   });
+  const smokeTest = options.smokeTest ?? defaultSmokeTest;
+  await smokeTest(pat, options.baseUrl);
   process.stdout.write("alter: signed in via browser-dance flow.\n");
 }
+async function defaultSmokeTest(pat, baseUrl) {
+  const client = new DashboardClient({
+    pat,
+    ...baseUrl ? { baseUrl } : {}
+  });
+  try {
+    await client.pats.whoami();
+  } finally {
+    await client.close();
+  }
+}
 
 // src/scope-catalog.ts
 var DASHBOARD_RESOURCE_VERBS = {
@@ -9849,7 +10055,7 @@ async function loginCommand(options) {
     let resolvedBaseUrl2;
     try {
       const envBaseUrl = process.env.ALTER_BASE_URL?.trim() || null;
-      resolvedBaseUrl2 = options.baseUrl ? validateBaseUrl(options.baseUrl) : envBaseUrl ? validateBaseUrl(envBaseUrl) : "https://api.alterauth.com";
+      resolvedBaseUrl2 = options.baseUrl ? validateBaseUrl(options.baseUrl) : envBaseUrl ? validateBaseUrl(envBaseUrl) : "https://backend.alterauth.com";
     } catch (e) {
       err(e instanceof Error ? e.message : String(e));
       process.exit(EXIT_USAGE);
@@ -9875,10 +10081,8 @@ async function loginCommand(options) {
         process.exit(EXIT_USAGE);
       }
     }
-    let bindOverride = null;
-    if (options.bindIp === false) {
-      bindOverride = { bind: "none" };
-    } else if (typeof options.bindIp === "string") {
+    let bindOverride = { bind: "none" };
+    if (typeof options.bindIp === "string") {
       let normalisedCidr;
       try {
         normalisedCidr = validateBindIpFlag(options.bindIp);
@@ -9897,6 +10101,19 @@ async function loginCommand(options) {
       });
       return;
     } catch (e) {
+      if (e instanceof PortalBackendError) {
+        const isAuthTier = e.statusCode === 401 || e.statusCode === 403;
+        if (isAuthTier) {
+          err(`PAT was minted but cannot authenticate: ${e.message}`);
+        } else {
+          err(`PAT was minted but the backend rejected the smoke test: ${e.message}`);
+        }
+        process.exit(exitCodeForHttpStatus(e.statusCode));
+      }
+      if (e instanceof NetworkError) {
+        err(`PAT was minted but the backend is unreachable: ${e.message}. Check connectivity and retry.`);
+        process.exit(EXIT_ERROR);
+      }
       err(e instanceof Error ? e.message : String(e));
       process.exit(EXIT_ERROR);
     }
@@ -10061,16 +10278,16 @@ function buildAuthCommand() {
     "Override the backend URL (must be https://). Defaults to ALTER_BASE_URL or production."
   ).option(
     "--dashboard-url <url>",
-    "Override the dashboard URL used by the browser-dance flow. Defaults to the backend URL with the leftmost `api.` subdomain swapped for `dashboard.`. Use this when the dashboard isn't at the regex-derivable host (e.g. staging / self-hosted setups). Must use https://."
+    "Override the dashboard URL used by the browser-dance flow. Defaults to the backend URL with the leftmost `backend.` subdomain swapped for `portal.`. Use this when the dashboard isn't at the regex-derivable host (e.g. staging / self-hosted setups). Must use https://."
   ).option(
     "--scopes <list>",
     "Comma-separated scope list to request on the browser-dance consent page (e.g. 'dashboard_apps:read,dashboard_keys:write'). Defaults to the full read+write set across the CLI surface \u2014 enough for every non-destructive day-to-day command. Opt in to admin / delete tiers explicitly: 'dashboard_keys:admin' for runtime-key admin ops, 'dashboard_apps:delete' for cascade-delete an app (note: dashboard_apps does NOT support :admin \u2014 the Destructive-Action Policy separates :delete as its own verb). Each entry is validated client-side against the dashboard scope catalog \u2014 typos fail fast. Mutually exclusive with --token / --token-file / --token-stdin \u2014 pre-minted PATs have their scope set baked at mint time on the dashboard's Settings page; combining the flags is a usage error."
   ).option(
     "--no-bind-ip",
-    "Mint the PAT WITHOUT an IP allowlist. The resulting token works from any source IP \u2014 useful when the dashboard sits behind a CDN whose edge IPs aren't yet trusted by the backend (in that case the default 'bind to caller IP' resolves to the CDN edge instead of the operator's real IP, leaving the PAT unusable from the CLI). Browser-dance flow only."
+    "Explicit opt-out of IP binding. This is now the DEFAULT for the browser-dance flow, so the flag is a no-op alias retained for scripts that pass it explicitly. The resulting PAT works from any source IP. Browser-dance flow only."
   ).option(
     "--bind-ip <cidr>",
-    "Mint the PAT bound to the operator-supplied IP / CIDR (e.g. '203.0.113.5' for a single host, '203.0.113.0/24' for a range, or an IPv6 equivalent). The backend's automatic caller-IP bind is bypassed; the supplied range becomes the entire allowlist. Use this when the operator's egress IP is known but the dashboard sits behind a CDN whose trusted-proxy list isn't yet populated on the backend. If both --bind-ip and --no-bind-ip appear, the one that appears LAST on the command line takes effect (Commander last-wins). Browser-dance flow only."
+    "Mint the PAT bound to the operator-supplied IP / CIDR (e.g. '203.0.113.5' for a single host, '203.0.113.0/24' for a range, or an IPv6 equivalent). The supplied range becomes the entire allowlist on the minted PAT. Use this when the egress IP is known and stable \u2014 e.g. minting a token for a CI runner whose outbound CIDR you control. Interactive developer-laptop logins should leave this unset (default is now unbound; see --no-bind-ip). If both --bind-ip and --no-bind-ip appear, the one that appears LAST on the command line takes effect (Commander last-wins). Browser-dance flow only."
   ).action(async (options) => {
     await loginCommand(options);
   });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alter-ai/cli",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "Command-line interface for the Alter Vault dev portal — scripted dashboard automation.",
   "type": "module",
   "bin": {