@dmfaster/local-auth
Secure local authentication shared by the official DM Faster CLI and MCP
server. It implements DM Faster's browser-approved device authorization flow,
stores issued credentials in the operating system's credential store, and
supports DMFASTER_TOKEN for non-interactive CI environments.
Distribution note: the registry command below works only after this exact release is published. Before then, maintainers use the built package from an authorized source checkout.
npm install @dmfaster/[email protected]
Application integrations normally use @dmfaster/sdk directly. This package
is the lower-level authentication layer for DM Faster's official local clients.
It never stores an access token in the DM Faster config file.
Device authorization supports the read, plan, draft, and full access
profiles. beginDeviceAuthorization({ access: "plan" }) requests only the five
operational read scopes plus audiences:read; omitting access requests the
complete full Agent 2.0 scope set. The browser approval page remains the
authority for the workspace and permissions actually granted.
The supported runtime is Node.js 24. Browser sign-in defaults to
https://app.dmfaster.com; compatible loopback API endpoints are available for
local development and tests.
Direct campaign control (since 1.3.0)
An owner can grant campaigns:control once when connecting an agent with the
full profile. Explicit user instructions then suffice for launch or pause:
preflight returns ready and a version-bound authorization ID for immediate
execution. The normal action scope is still required. Existing credentials
retain per-action approval until the owner reconnects and grants this permission.
Planning or preparing a campaign never authorizes launch.