apiblaze 0.19.30 → 0.19.32

package/dist/index.js

@@ -932,7 +932,7 @@ var import_commander = require("commander");
 var import_chalk48 = __toESM(require("chalk"));
 
 // package.json
-var version = "0.19.30";
+var version = "0.19.32";
 
 // src/index.ts
 init_types();
@@ -2565,10 +2565,13 @@ async function deviceLogin(clientId, scope, onPrompt, resource) {
     const tokRes = await fetch(`${AUTH_BASE}/token`, {
       method: "POST",
       headers: { "Content-Type": "application/x-www-form-urlencoded" },
-      // RFC 8707 resource indicator: sets the access token's `aud` to the portal
-      // resource so the apikeys plane (which derives accepted auds as
-      // https://{tenant}.portal.apiblaze.com/{ver}) accepts this token. Without it the
-      // device grant falls back to aud=https://auth.apiblaze.com/device/callback → 401.
+      // RFC 8707 resource indicator, forwarded only when the caller asks for one.
+      // The device grant used to fall back to aud=https://auth.apiblaze.com/device/callback,
+      // which is registered nowhere and so accepted by nothing — every caller had to
+      // supply a resource just to get a usable token, and the one supplied here was
+      // a fabricated `…/1.0.0`. The token endpoint now floors the device grant on
+      // client_id (always an accepted audience), so omitting this is the correct
+      // default and a resource is only needed to CONFINE a token.
       body: new URLSearchParams({ grant_type: DEVICE_GRANT, device_code: deviceCode, code_verifier: verifier, ...resource ? { resource } : {} })
     });
     const tok = await tokRes.json().catch(() => ({}));
@@ -7959,7 +7962,6 @@ async function runConsumerLogin(opts) {
     }
     clientId = pick2.client_id ?? pick2.clientId;
   }
-  const portalResource = `https://${tenant2}.portal.apiblaze.com/1.0.0`;
   console.log(`${import_chalk44.default.cyan("\u2192")} Logging in to ${import_chalk44.default.bold(tenant2)} as a consumer...`);
   const result = await deviceLogin(clientId, DEFAULT_SCOPE, ({ verificationUri, userCode }) => {
     console.log(`
@@ -7967,7 +7969,7 @@ async function runConsumerLogin(opts) {
     console.log(`  Code: ${import_chalk44.default.bold(userCode)}
 `);
     console.log(import_chalk44.default.dim("  (opening your browser\u2026 waiting for you to finish)"));
-  }, portalResource);
+  });
   const claims = result.idToken && decodeJwt2(result.idToken) || (decodeJwt2(result.accessToken) ?? {});
   const creds = {
     tenant: tenant2,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apiblaze",
-  "version": "0.19.30",
+  "version": "0.19.32",
   "description": "APIblaze CLI — Chat with your APIs, Manage your API keys, users and groups with the APIblaze serverless proxy",
   "keywords": [
     "apiblaze",