@settlemint/dalp-cli 3.1.33-main.43020455143 → 3.1.33-main.43028474710

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@settlemint/dalp-cli",
-  "version": "3.1.33-main.43020455143",
+  "version": "3.1.33-main.43028474710",
   "private": false,
   "description": "CLI for the Digital Asset Lifecycle Platform — manage tokens, identities, compliance, and more from the command line.",
   "homepage": "https://settlemint.com",
@@ -50,14 +50,14 @@
   },
   "dependencies": {
     "@modelcontextprotocol/server": "2.4.0",
-    "@settlemint/dalp-sdk": "3.1.33-main.43020455143",
+    "@settlemint/dalp-sdk": "3.1.33-main.43028474710",
     "incur": "0.7.1",
     "zod": "4.6.7"
   },
   "devDependencies": {
     "@arethetypeswrong/cli": "0.18.5",
-    "@testkit/effect-bun-test": "3.1.33-main.43020455143",
-    "@tools/typescript-config": "3.1.33-main.43020455143",
+    "@testkit/effect-bun-test": "3.1.33-main.43028474710",
+    "@tools/typescript-config": "3.1.33-main.43028474710",
     "@types/bun": "1.4.4",
     "publint": "0.3.25"
   },

package/src/commands/login.ts

@@ -139,6 +139,7 @@ async function readBoundedJson<T>(response: Response, schema: z.ZodType<T>): Pro
 }
 
 async function postJson(url: string, body: unknown, headers: Record<string, string> = {}): Promise<Response> {
+  // fallow-ignore-next-line security-sink -- Client-side CLI. The login base is the user's own --url, DALP_URL or saved apiUrl (login.ts:308), parsed by validateLoginBaseUrl (login.ts:97-126), which rejects query and fragment. No server-side fetch, so no SSRF path for an outside party.
   return fetch(url, {
     method: "POST",
     headers: {
@@ -339,6 +340,7 @@ export const loginCommand = Cli.create("login", {
         );
 
         const sessionBearer = `Bearer ${sessionToken.access_token}`;
+        // fallow-ignore-next-line security-sink -- Same client-side CLI base as login.ts:142. baseUrl comes from validateLoginBaseUrl (login.ts:319) before use. The server's verification_uri only feeds the browser-open path, not this fetch. Not a server-side SSRF.
         const sessionResponse = await fetch(`${baseUrl}/api/auth/get-session`, {
           headers: { Authorization: sessionBearer, "User-Agent": CLI_USER_AGENT },
         });

package/src/lib/auth-request.ts

@@ -26,6 +26,7 @@ export async function authRequest(
   let response: Response;
   let text: string;
   try {
+    // fallow-ignore-next-line security-sink -- apiUrl is the saved credentials.apiUrl (credential-store.ts:21, z.url()), written at login from the validated base (login.ts:406, 458). Client-side CLI; the stored host is the user's own instance, not attacker-set.
     response = await fetch(`${apiUrl.replace(TRAILING_SLASHES_PATTERN, "")}/api/auth${route}`, {
       method: request.method,
       headers,