@settlemint/dalp-cli 3.1.33-release.42636987002 → 3.1.33-release.43440124932

package/dist/dalp.js

@@ -131382,7 +131382,7 @@ function normalizeDalpBaseUrl(url2) {
   }
   return `${parsed.origin}${parsed.pathname.replace(/\/+$/, "")}`;
 }
-var SDK_PACKAGE_VERSION = "3.1.33-release.42636987002";
+var SDK_PACKAGE_VERSION = "3.1.33-release.43440124932";
 var SDK_VERSION = SDK_PACKAGE_VERSION;
 var SDK_USER_AGENT = `DALP SDK v${SDK_VERSION}`;
 var DEFAULT_MUTATION_PREFER = "wait=99";
@@ -132534,7 +132534,7 @@ var failedStateSet = new Set(FAILED_TRANSACTION_STATES);
 // package.json
 var package_default = {
   name: "@settlemint/dalp-cli",
-  version: "3.1.33-release.42636987002",
+  version: "3.1.33-release.43440124932",
   private: false,
   description: "CLI for the Digital Asset Lifecycle Platform — manage tokens, identities, compliance, and more from the command line.",
   homepage: "https://settlemint.com",
@@ -195841,6 +195841,20 @@ kycCommand.command("action-request-fulfill", {
 // src/commands/login.ts
 import { execFile as execFile2 } from "node:child_process";
 import { hostname as hostname3 } from "node:os";
+
+// src/lib/api-key-name.ts
+var SERVER_API_KEY_NAME_MAX_LENGTH = 32;
+var CLI_KEY_PREFIX = "dalp-cli";
+function cliApiKeyName(machine) {
+  const name = `${CLI_KEY_PREFIX} (${machine})`;
+  if (name.length <= SERVER_API_KEY_NAME_MAX_LENGTH) {
+    return name;
+  }
+  const room = SERVER_API_KEY_NAME_MAX_LENGTH - `${CLI_KEY_PREFIX} (…)`.length;
+  return `${CLI_KEY_PREFIX} (${machine.slice(0, room)}…)`;
+}
+
+// src/commands/login.ts
 var deviceCodeSchema = object({
   device_code: string2(),
   user_code: string2(),
@@ -195986,27 +196000,28 @@ Open this URL in your browser:
       } catch {}
     }
     const sessionToken = await pollForToken(apiUrl, deviceCode.device_code, deviceCode.interval, deviceCode.expires_in);
-    const sessionCookie = `better-auth.session_token=${sessionToken.access_token}`;
+    const bearerAuthorization = `Bearer ${sessionToken.access_token}`;
     const sessionResponse = await fetch(`${apiUrl}/api/auth/get-session`, {
-      headers: { Cookie: sessionCookie, "User-Agent": CLI_USER_AGENT }
+      headers: { Authorization: bearerAuthorization, "User-Agent": CLI_USER_AGENT }
     });
-    if (!sessionResponse.ok) {
+    const parsedSession = sessionResponse.ok ? sessionResponseSchema.safeParse(await sessionResponse.json()) : undefined;
+    if (!parsedSession?.success) {
       return c.error({
         code: "SESSION_FAILED",
         message: "Authorized but failed to fetch session. Try 'dalp login' again.",
         retryable: true
       });
     }
-    const session = sessionResponseSchema.parse(await sessionResponse.json());
+    const session = parsedSession.data;
     const apiKeyResponse = await fetch(`${apiUrl}/api/auth/api-key/create`, {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
         "User-Agent": CLI_USER_AGENT,
-        Cookie: sessionCookie
+        Authorization: bearerAuthorization
       },
       body: JSON.stringify({
-        name: `dalp-cli (${hostname3()})`,
+        name: cliApiKeyName(hostname3()),
         metadata: {
           ...session.session.activeOrganizationId ? { organizationId: session.session.activeOrganizationId } : {},
           scope: "read-write"
@@ -201991,6 +202006,18 @@ var whoamiCommand = create("whoami", {
   }
 });
 
+// src/lib/confirm-prompt.ts
+import { createInterface } from "node:readline/promises";
+async function confirmYesNo(question) {
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    const answer = await rl.question(`${question} `);
+    return ["y", "yes"].includes(answer.trim().toLowerCase());
+  } finally {
+    rl.close();
+  }
+}
+
 // src/lib/errors.ts
 function renderSdkErrorForCli(error, context) {
   if (error instanceof DalpSdkError) {
@@ -202444,18 +202471,88 @@ authCommand.command("wallet-secret-codes-confirm", {
     return result.data;
   }
 });
+var deviceClaimSchema = object({ user_code: string2(), status: string2() });
+var deviceDetailsSchema = object({
+  userCode: string2(),
+  clientId: string2(),
+  clientName: string2(),
+  permissions: string2(),
+  expiresAt: union([string2(), date3().transform((date) => date.toISOString())])
+});
+var authFetchResultSchema = object({ data: unknown().nullable(), error: unknown().nullable() }).partial();
+var DEVICE_APPROVE_WARNING = "Only approve if this code is shown on a device you have in front of you right now.";
+function formatUserCode(userCode) {
+  const compact = userCode.replaceAll("-", "").toUpperCase();
+  return compact.length === 8 ? `${compact.slice(0, 4)}-${compact.slice(4)}` : userCode;
+}
+function describeDeviceRequest(details) {
+  return [
+    `Client: ${details.clientName} (${details.clientId})`,
+    `Permissions: ${details.permissions}`,
+    `Code: ${formatUserCode(details.userCode)}`,
+    `Expires: ${details.expiresAt}`
+  ].join(`
+`);
+}
+async function getAuthEndpoint(auth, path, userCode) {
+  const raw = authFetchResultSchema.parse(await auth.$fetch(path, { method: "GET", query: { user_code: userCode } }));
+  return { data: raw.data ?? null, error: raw.error ?? null };
+}
+async function claimDeviceRequest(auth, userCode) {
+  const claim = await getAuthEndpoint(auth, "/device", userCode);
+  if (claim.error || !deviceClaimSchema.safeParse(claim.data).success) {
+    return authError(claim.error, "DEVICE_CLAIM_FAILED", "Failed to claim device request");
+  }
+  return;
+}
 authCommand.command("device-approve", {
   description: "Approve a pending device-authorization request by its user code",
   args: object({
     userCode: string2().describe("User code displayed by the device requesting access")
   }),
+  options: object({
+    yes: boolean2().optional().describe("Skip the confirmation after the request details are shown")
+  }),
   async run(c) {
     const auth = createAuthClient2(c.var.apiUrl, { apiKey: c.var.credentials.apiKey });
+    const claimError = await claimDeviceRequest(auth, c.args.userCode);
+    if (claimError) {
+      return c.error(claimError);
+    }
+    const detailsResult = await getAuthEndpoint(auth, "/device/details", c.args.userCode);
+    const parsedDetails = deviceDetailsSchema.safeParse(detailsResult.data);
+    if (detailsResult.error || !parsedDetails.success) {
+      return c.error(authError(detailsResult.error, "DEVICE_DETAILS_FAILED", "Failed to load device request details"));
+    }
+    const details = parsedDetails.data;
+    const summary = describeDeviceRequest(details);
+    console.error(`
+${summary}
+`);
+    console.error(DEVICE_APPROVE_WARNING);
+    if (!c.options.yes) {
+      if (c.agent || !process.stdin.isTTY) {
+        return c.error({
+          code: "DEVICE_APPROVE_CONFIRMATION_REQUIRED",
+          message: `Approval needs confirmation.
+${summary}
+Check these details match a device you have in front of you right now, then re-run with --yes.`,
+          retryable: false
+        });
+      }
+      if (!await confirmYesNo("Approve this request? [y/N]")) {
+        return c.error({
+          code: "DEVICE_APPROVE_DECLINED",
+          message: "Device request was not approved.",
+          retryable: false
+        });
+      }
+    }
     const result = await auth.device.approve({ userCode: c.args.userCode });
     if (result.error) {
       return c.error(authError(result.error, "DEVICE_APPROVE_FAILED", "Failed to approve device"));
     }
-    return result.data;
+    return { success: true, ...details, userCode: formatUserCode(details.userCode), approved: true };
   }
 });
 authCommand.command("device-deny", {
@@ -202465,6 +202562,10 @@ authCommand.command("device-deny", {
   }),
   async run(c) {
     const auth = createAuthClient2(c.var.apiUrl, { apiKey: c.var.credentials.apiKey });
+    const claimError = await claimDeviceRequest(auth, c.args.userCode);
+    if (claimError) {
+      return c.error(claimError);
+    }
     const result = await auth.device.deny({ userCode: c.args.userCode });
     if (result.error) {
       return c.error(authError(result.error, "DEVICE_DENY_FAILED", "Failed to deny device"));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@settlemint/dalp-cli",
-  "version": "3.1.33-release.42636987002",
+  "version": "3.1.33-release.43440124932",
   "private": false,
   "description": "CLI for the Digital Asset Lifecycle Platform — manage tokens, identities, compliance, and more from the command line.",
   "homepage": "https://settlemint.com",
@@ -46,11 +46,11 @@
   },
   "devDependencies": {
     "@arethetypeswrong/cli": "0.18.3",
-    "@core/errors": "3.1.33-release.42636987002",
-    "@core/validation": "3.1.33-release.42636987002",
-    "@dalp/errors": "3.1.33-release.42636987002",
-    "@settlemint/dalp-sdk": "3.1.33-release.42636987002",
-    "@tools/typescript-config": "3.1.33-release.42636987002",
+    "@core/errors": "3.1.33-release.43440124932",
+    "@core/validation": "3.1.33-release.43440124932",
+    "@dalp/errors": "3.1.33-release.43440124932",
+    "@settlemint/dalp-sdk": "3.1.33-release.43440124932",
+    "@tools/typescript-config": "3.1.33-release.43440124932",
     "@types/bun": "1.4.4",
     "publint": "0.3.21"
   },