@zeroxyz/cli 1.29.0 → 1.29.1

package/dist/index.js

@@ -170257,7 +170257,7 @@ var placeholderFor = (fieldName, propSchema) => String(sampleValueFor(fieldName,
 
 // package.json
 var package_default2 = {
-  version: "1.29.0"};
+  version: "1.29.1"};
 
 // src/app.ts
 init_esm_shims();
@@ -170915,6 +170915,7 @@ var getConfigPath = () => join$1(homedir(), ".zero", "config.json");
 var CLAIM_NOT_CONFIRMED_RETRIES = 12;
 var CLAIM_NOT_CONFIRMED_INTERVAL_S = 5;
 var CONSENT_POLL_INTERVAL_S = 3;
+var FINISH_CONSENT_WAIT_MS = 6e4;
 var ASSERTION_EXPIRY_MARGIN_MS = 6e4;
 var sleep2 = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms));
 var normalizeUrl = (raw) => {
@@ -171056,10 +171057,21 @@ var authIdentityCommand = (appContext) => new Command("identity").description(
 ).argument("<url>", "The service host, or any URL on it").option(
   "--claim-code <code>",
   "Finish an interaction_required claim with the pairing code the account owner read off the claim page"
+).option(
+  "--start",
+  "Never wait on consent: if the user's approval is needed, print the approval link and exit (pair with --finish); otherwise proceed straight to the token. Default when stdin is not a TTY."
+).option(
+  "--finish",
+  "Complete a sign-in begun with --start: wait for the user's consent decision (up to a minute per run \u2014 re-run to keep waiting), then print the bearer token."
 ).option("--json", "Emit machine-readable JSON instead of human text").action(
   async (rawUrl, opts) => {
     const { client, analyticsService } = appContext.services;
     const json3 = opts.json ?? false;
+    if (opts.start && opts.finish) {
+      process.stderr.write("Pass either --start or --finish, not both.\n");
+      process.exitCode = 1;
+      return;
+    }
     const target = normalizeUrl(rawUrl);
     if (!target) {
       process.stderr.write(`Not a valid URL or host: ${rawUrl}
@@ -171163,41 +171175,110 @@ This host does not appear to support agent auth. If it serves an /auth.md, follo
       return;
     }
     if (outcome.status === "consent_required") {
-      const requested = await client.auth.identity.requestGrant({
-        audience: discovery.mintAudience,
-        resourceUrl: target.origin
-      }).catch((err) => {
-        process.stderr.write(
-          `Could not create the consent request: ${truncateError(err instanceof Error ? err.message : String(err))}
+      const storedConsent = readConfig(getConfigPath()).serviceIdentities?.[host]?.pendingConsent;
+      let pending = storedConsent && (!storedConsent.expiresAt || Date.parse(storedConsent.expiresAt) > Date.now()) ? storedConsent : null;
+      if (!pending) {
+        const requested = await client.auth.identity.requestGrant({
+          audience: discovery.mintAudience,
+          resourceUrl: target.origin
+        }).catch((err) => {
+          process.stderr.write(
+            `Could not create the consent request: ${truncateError(err instanceof Error ? err.message : String(err))}
 `
-        );
-        return null;
-      });
-      if (!requested) {
-        capture("error");
-        process.exitCode = 1;
+          );
+          return null;
+        });
+        if (!requested) {
+          capture("error");
+          process.exitCode = 1;
+          return;
+        }
+        pending = {
+          requestId: requested.requestId,
+          approveUrl: requested.approveUrl,
+          expiresAt: requested.expiresAt
+        };
+        const next = pending;
+        updateServiceIdentity(host, (current) => ({
+          ...current,
+          pendingConsent: next
+        }));
+      }
+      const waitsInline = opts.finish || !opts.start && process.stdin.isTTY;
+      if (!waitsInline) {
+        capture("consent_started");
+        if (json3) {
+          process.stdout.write(
+            `${JSON.stringify({
+              status: "consent_required",
+              approveUrl: pending.approveUrl,
+              expiresAt: pending.expiresAt,
+              next: `Send the user to approveUrl. Then run \`zero auth identity ${host} --finish\` \u2014 it waits for their decision and prints the bearer token.`
+            })}
+`
+          );
+        } else {
+          process.stderr.write(
+            [
+              "",
+              `Signing in to ${discovery.resourceName ?? host} needs the user's one-time consent.`,
+              `Send them here to approve: ${pending.approveUrl}`,
+              `(valid until ${pending.expiresAt}; the decision is remembered on their Zero account)`,
+              "",
+              `Then run: zero auth identity ${host} --finish`,
+              "It waits for their decision and prints the bearer token.",
+              ""
+            ].join("\n")
+          );
+        }
         return;
       }
       process.stderr.write(
         [
           "",
           `Signing in to ${discovery.resourceName ?? host} needs the user's one-time consent.`,
-          `Send them here to approve: ${requested.approveUrl}`,
-          `(valid until ${requested.expiresAt}; the decision is remembered on their Zero account)`,
+          `Send them here to approve: ${pending.approveUrl}`,
+          `(valid until ${pending.expiresAt}; the decision is remembered on their Zero account)`,
           "Waiting for their decision\u2026"
         ].join("\n")
       );
-      let decision = "expired";
+      const deadline = opts.finish ? Date.now() + FINISH_CONSENT_WAIT_MS : null;
+      let decision = "pending";
       for (; ; ) {
-        const status = await client.auth.identity.grantRequest(requested.requestId).catch(() => null);
+        const status = await client.auth.identity.grantRequest(pending.requestId).catch(() => null);
         if (status && status.status !== "pending") {
           decision = status.status;
           break;
         }
+        if (deadline !== null && Date.now() >= deadline) break;
         process.stderr.write(".");
         await sleep2(CONSENT_POLL_INTERVAL_S * 1e3);
       }
       process.stderr.write("\n");
+      if (decision === "pending") {
+        capture("consent_pending");
+        if (json3) {
+          process.stdout.write(
+            `${JSON.stringify({
+              status: "pending",
+              approveUrl: pending.approveUrl,
+              expiresAt: pending.expiresAt,
+              next: `The user has not decided yet. Re-run \`zero auth identity ${host} --finish\` to keep waiting.`
+            })}
+`
+          );
+        } else {
+          process.stderr.write(
+            `No decision yet. Re-run \`zero auth identity ${host} --finish\` to keep waiting.
+`
+          );
+        }
+        return;
+      }
+      updateServiceIdentity(
+        host,
+        ({ pendingConsent: _drop, ...rest }) => rest
+      );
       if (decision === "denied") {
         capture("consent_denied");
         process.stderr.write(
@@ -171230,20 +171311,27 @@ This host does not appear to support agent auth. If it serves an /auth.md, follo
     }
     switch (outcome.status) {
       case "ok": {
-        updateServiceIdentity(host, ({ pendingClaim: _drop, ...rest }) => ({
-          ...rest,
-          registrationId: outcome.registration.registrationId,
-          assertion: outcome.registration.identityAssertion,
-          ...outcome.registration.assertionExpires && {
-            assertionExpires: outcome.registration.assertionExpires
-          },
-          ...outcome.registration.refreshToken && {
-            refreshToken: outcome.registration.refreshToken
-          },
-          ...discovery.resourceName && {
-            resourceName: discovery.resourceName
-          }
-        }));
+        updateServiceIdentity(
+          host,
+          ({
+            pendingClaim: _dropClaim,
+            pendingConsent: _drop,
+            ...rest
+          }) => ({
+            ...rest,
+            registrationId: outcome.registration.registrationId,
+            assertion: outcome.registration.identityAssertion,
+            ...outcome.registration.assertionExpires && {
+              assertionExpires: outcome.registration.assertionExpires
+            },
+            ...outcome.registration.refreshToken && {
+              refreshToken: outcome.registration.refreshToken
+            },
+            ...discovery.resourceName && {
+              resourceName: discovery.resourceName
+            }
+          })
+        );
         const ok = await exchangeAndEmit(
           client,
           discovery,

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@zeroxyz/cli",
-	"version": "1.29.0",
+	"version": "1.29.1",
 	"type": "module",
 	"bin": {
 		"zero": "dist/index.js",