@buildinternet/uploads 0.5.0 → 0.7.0

package/dist/commands/admin-enrollment.js

@@ -19,6 +19,11 @@ Options:
   --separate-code        Two-channel output: non-secret page URL + separate code
   --api-url <url>        Default: https://api.uploads.sh
   --web-url <url>        Invite-page origin (defaults from --api-url)
+
+Examples:
+  uploads admin invite create --workspace acme --email user@example.com
+  uploads admin invite create --workspace acme --separate-code --json
+  uploads admin invite create --admin-token $ADMIN_TOKEN --workspace acme --label "onboarding"
 `;
 const FILE_SCOPES = new Set(["files:read", "files:write", "files:delete"]);
 export function invitePageUrl(apiUrl, pageId, webUrl) {

package/dist/commands/login.d.ts

@@ -5,7 +5,20 @@ export declare function resolveEnrollmentCode(parsed: ReturnType<typeof parseCom
     readLine: () => Promise<string>;
     hiddenPrompt: () => Promise<string>;
 }): Promise<string>;
+/**
+ * Auth worker base URL: explicit flag > UPLOADS_AUTH_URL > swap an `api.` host
+ * label for `auth.` > the production default. Local multi-worker dev (where
+ * auth runs on a different loopback port than the API) needs an explicit
+ * --auth-url / UPLOADS_AUTH_URL.
+ */
+export declare function resolveAuthUrl(parsed: ReturnType<typeof parseCommandArgs>, apiUrl: string): string;
+export interface DeviceLoginIo {
+    sleep: (ms: number) => Promise<void>;
+    now: () => number;
+    openUrl: (url: string) => void;
+    write: (text: string) => void;
+}
 export declare function runLogin(args: string[], opts: {
     json?: boolean;
     apiUrl?: string;
-}, help?: boolean): Promise<number>;
+}, help?: boolean, deviceIo?: DeviceLoginIo): Promise<number>;

package/dist/commands/login.js

@@ -1,20 +1,37 @@
+import { hostname } from "node:os";
+import { spawn } from "node:child_process";
 import { stdin, stdout } from "node:process";
 import { loadConfigFile, redactToken, resolveConfigPath, writeConfigKeys, workspaceFromToken, } from "../config.js";
-import { exchangeEnrollment, createUploadsClient } from "../client.js";
+import { createUploadsClient, exchangeEnrollment, listMintWorkspaces, mintWorkspaceToken, requestDeviceCode, requestDeviceToken, } from "../client.js";
 import { flagBool, flagString, parseCommandArgs, UsageError } from "../cli-args.js";
+import { parseScopes } from "./admin-enrollment.js";
 const HELP = `uploads login [options]
 
-Exchange a one-time enrollment code for workspace credentials, save them, and
-verify access. Ask your uploads.sh administrator for an enrollment code.
+Sign in and save workspace credentials. With no flags, opens a browser to
+authorize this device — the recommended way to sign in. Pass an enrollment
+code only if you were given one from before device login (fallback path).
 
 Options:
-  --code <code>       Code in argv (may be visible in shell history/process lists)
-  --code-stdin        Read one line from stdin
+  --workspace <name>  Workspace to mint a token for (device flow; required if
+                      your account can access more than one)
+  --scopes <list>     Comma-separated scopes (default: files:read,files:write)
+  --label <text>      Token label (default: this machine's hostname)
+  --auth-url <url>    Auth base (default: https://auth.uploads.sh)
+  --no-open           Don't try to open a browser automatically
+  --code <code>       Fallback: use a pre-existing enrollment code instead of
+                      device login (visible in shell history)
+  --code-stdin        Fallback: read a pre-existing enrollment code from stdin
   --non-interactive   Never prompt
   --api-url <url>     API base (default: https://api.uploads.sh)
   --path <file>       Config destination
   --force             Replace existing saved credentials
   --no-check          Skip doctor verification
+
+Examples:
+  uploads login
+  uploads login --workspace acme
+  uploads login --code upe_… --force              # fallback: pre-existing invite
+  printf '%s' upe_… | uploads login --code-stdin --non-interactive
 `;
 export function validateEnrollmentCode(raw) {
     const code = raw.trim();
@@ -98,7 +115,135 @@ export async function resolveEnrollmentCode(parsed, io = {
         return validateEnrollmentCode(await io.readLine());
     return validateEnrollmentCode(await io.hiddenPrompt());
 }
-export async function runLogin(args, opts, help = false) {
+/** True when the caller supplied an enrollment code (via flag, stdin, or env). */
+function hasEnrollmentSource(parsed) {
+    return (Boolean(flagString(parsed.flags, "--code")) ||
+        flagBool(parsed.flags, "--code-stdin") ||
+        Boolean(process.env.UPLOADS_ENROLLMENT_CODE));
+}
+/**
+ * Auth worker base URL: explicit flag > UPLOADS_AUTH_URL > swap an `api.` host
+ * label for `auth.` > the production default. Local multi-worker dev (where
+ * auth runs on a different loopback port than the API) needs an explicit
+ * --auth-url / UPLOADS_AUTH_URL.
+ */
+export function resolveAuthUrl(parsed, apiUrl) {
+    const explicit = flagString(parsed.flags, "--auth-url") ?? process.env.UPLOADS_AUTH_URL;
+    if (explicit)
+        return explicit.replace(/\/$/, "");
+    try {
+        const url = new URL(apiUrl);
+        if (url.hostname.startsWith("api.")) {
+            url.hostname = `auth.${url.hostname.slice(4)}`;
+            return url.origin;
+        }
+    }
+    catch {
+        // fall through to the default
+    }
+    return "https://auth.uploads.sh";
+}
+/** Best-effort browser open. The URL is always printed too, so failures are silent. */
+function openUrl(url) {
+    try {
+        const isWin = process.platform === "win32";
+        const command = process.platform === "darwin" ? "open" : isWin ? "cmd" : "xdg-open";
+        const args = isWin ? ["/c", "start", "", url] : [url];
+        const child = spawn(command, args, { stdio: "ignore", detached: true });
+        child.on("error", () => { });
+        child.unref();
+    }
+    catch {
+        // ignore — the URL is printed for manual navigation.
+    }
+}
+const defaultDeviceIo = {
+    sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+    now: () => Date.now(),
+    openUrl,
+    write: (text) => {
+        process.stderr.write(text);
+    },
+};
+/**
+ * Device-authorization login (RFC 8628): request a code, have the user approve
+ * it in a browser, poll for the session token, then mint a workspace token.
+ */
+async function runDeviceLogin(parsed, opts, io) {
+    const scopes = parseScopes(flagString(parsed.flags, "--scopes"));
+    const label = flagString(parsed.flags, "--label") ?? safeHostname();
+    const requestedWorkspace = flagString(parsed.flags, "--workspace");
+    const code = await requestDeviceCode(opts.authUrl);
+    const verifyUrl = code.verification_uri_complete ?? code.verification_uri;
+    io.write(`To sign in, open:\n\n  ${verifyUrl}\n\nand confirm this code:\n\n  ${code.user_code}\n\n`);
+    if (!opts.noOpen)
+        io.openUrl(verifyUrl);
+    io.write("Waiting for approval…\n");
+    const accessToken = await pollForDeviceToken(opts.authUrl, code, io);
+    const workspace = await resolveMintWorkspace(opts.apiUrl, accessToken, requestedWorkspace);
+    const minted = await mintWorkspaceToken(opts.apiUrl, accessToken, { workspace, scopes, label });
+    return { workspace: minted.workspace, token: minted.token, apiUrl: opts.apiUrl };
+}
+function safeHostname() {
+    try {
+        return hostname() || "cli";
+    }
+    catch {
+        return "cli";
+    }
+}
+/** Poll device/token honoring interval / slow_down / pending until approved or expired. */
+async function pollForDeviceToken(authUrl, code, io) {
+    let intervalMs = Math.max(1, code.interval) * 1000;
+    const deadline = io.now() + Math.max(1, code.expires_in) * 1000;
+    while (io.now() < deadline) {
+        await io.sleep(intervalMs);
+        let result;
+        try {
+            result = await requestDeviceToken(authUrl, { deviceCode: code.device_code });
+        }
+        catch {
+            // A transient network blip mid-poll shouldn't abort a login the user may
+            // already have approved — keep polling until the device code's deadline.
+            continue;
+        }
+        switch (result.status) {
+            case "ok":
+                return result.accessToken;
+            case "pending":
+                continue;
+            case "slow_down":
+                // RFC 8628 §3.5: back off by 5s and keep polling.
+                intervalMs += 5000;
+                continue;
+            case "denied":
+                throw new UsageError("device authorization was denied");
+            case "expired":
+                throw new UsageError("the device code expired before it was approved");
+            default:
+                throw new UsageError(`device authorization failed: ${result.error}${result.description ? ` — ${result.description}` : ""}`);
+        }
+    }
+    throw new UsageError("timed out waiting for device authorization");
+}
+/**
+ * Pick the workspace to mint for. An explicit --workspace wins; otherwise, if
+ * the account can access exactly one workspace, use it — and if it can access
+ * several, require the flag rather than guessing.
+ */
+async function resolveMintWorkspace(apiUrl, accessToken, requested) {
+    if (requested)
+        return requested;
+    const { workspaces } = await listMintWorkspaces(apiUrl, accessToken);
+    if (workspaces.length === 1)
+        return workspaces[0].workspace;
+    if (workspaces.length === 0) {
+        throw new UsageError("your account has no workspace access yet — ask an administrator for an invitation");
+    }
+    const names = workspaces.map((w) => w.workspace).join(", ");
+    throw new UsageError(`multiple workspaces available (${names}); pass --workspace <name>`);
+}
+export async function runLogin(args, opts, help = false, deviceIo = defaultDeviceIo) {
     const parsed = parseCommandArgs(args);
     if (help || parsed.help) {
         process.stderr.write(HELP);
@@ -112,11 +257,24 @@ export async function runLogin(args, opts, help = false) {
         throw new UsageError(`credentials already exist in ${path}; use --force to replace them`);
     if (process.env.UPLOADS_TOKEN && !force)
         throw new UsageError("UPLOADS_TOKEN is already set in the environment; unset it or use --force");
-    const code = await resolveEnrollmentCode(parsed);
-    const result = await exchangeEnrollment(apiUrl, code);
+    let result;
+    if (hasEnrollmentSource(parsed)) {
+        const code = await resolveEnrollmentCode(parsed);
+        result = await exchangeEnrollment(apiUrl, code);
+    }
+    else {
+        // The device flow is inherently interactive (browser approval, then a poll
+        // that runs to the device code's ~30-min deadline). Fail fast rather than
+        // hanging a non-interactive/CI invocation that has no code to fall back on.
+        if (flagBool(parsed.flags, "--non-interactive")) {
+            throw new UsageError("device login requires a browser; run interactively, or pass --code for the enrollment path");
+        }
+        const authUrl = resolveAuthUrl(parsed, apiUrl);
+        result = await runDeviceLogin(parsed, { apiUrl, authUrl, noOpen: flagBool(parsed.flags, "--no-open") }, deviceIo);
+    }
     const encoded = workspaceFromToken(result.token);
     if (!encoded || encoded !== result.workspace || /[\r\n]/.test(result.token))
-        throw new UsageError("enrollment returned invalid credentials");
+        throw new UsageError("login returned invalid credentials");
     const savedApiUrl = result.apiUrl ?? apiUrl;
     const write = writeConfigKeys(path, {
         UPLOADS_API_URL: savedApiUrl,

package/dist/commands/mcp.js

@@ -1,8 +1,8 @@
-import { createRequire } from "node:module";
 import { parseCommandArgs } from "../cli-args.js";
 import { createMcpServer } from "../mcp/server.js";
 import { serveStdio } from "../mcp/stdio.js";
 import { createUploadsMcpTools } from "../mcp/tools.js";
+import { packageVersion } from "../package-version.js";
 const MCP_HELP = `uploads [globals] mcp
 
 Serve the Model Context Protocol (MCP) over stdio for agent clients. Tools
@@ -22,16 +22,13 @@ Examples:
   uploads --env-file .env mcp
   uploads --token up_default_… mcp
 `;
-// Same relative depth from src/commands/ and dist/commands/, so this works
-// both under vitest (src) and at runtime (dist).
-const { version } = createRequire(import.meta.url)("../../package.json");
 export async function runMcp(args, opts, help = false) {
     if (help || parseCommandArgs(args).help) {
         process.stderr.write(MCP_HELP);
         return 0;
     }
     const server = createMcpServer({
-        serverInfo: { name: "uploads", version },
+        serverInfo: { name: "uploads", version: packageVersion() },
         tools: createUploadsMcpTools({ globals: opts.globals }),
     });
     await serveStdio(server);

package/dist/commands/setup.js

@@ -64,8 +64,10 @@ function formatWizard(status) {
     lines.push("");
     if (!status.token) {
         lines.push("Step 1 — Sign in");
-        lines.push("  Ask your uploads.sh administrator for a one-time enrollment code, then run:");
+        lines.push("  Run:");
         lines.push("    uploads login");
+        lines.push("  This opens a browser to authorize this device.");
+        lines.push("  Have a pre-existing enrollment code instead? uploads login --code upe_…");
         lines.push("  If you already have a bearer token:");
         lines.push("    uploads setup --token up_<workspace>_…");
         lines.push("");
@@ -207,7 +209,7 @@ export async function runSetup(args, opts, help = false) {
         process.stderr.write("hint: run uploads doctor to verify\n");
     }
     else {
-        process.stderr.write("hint: run uploads login with an admin-provided enrollment code\n");
+        process.stderr.write("hint: run uploads login (or uploads login --code <code> if you have one)\n");
     }
     return doctorOk === false ? 1 : 0;
 }

package/dist/commands.d.ts

@@ -41,6 +41,7 @@ export declare function syncAttachmentsComment(client: UploadsClient, target: Gh
 }>;
 export declare function runAttach(ctx: CliContext, args: string[], help?: boolean, run?: CommandRunner): Promise<number>;
 export declare function runPut(ctx: CliContext, args: string[], help?: boolean, run?: CommandRunner): Promise<number>;
+export declare function runGallery(ctx: CliContext, args: string[], help?: boolean): Promise<number>;
 export declare function runList(ctx: CliContext, args: string[], help?: boolean, run?: CommandRunner): Promise<number>;
 export declare function runDelete(ctx: CliContext, args: string[], help?: boolean): Promise<number>;
 export declare function runComment(ctx: CliContext, args: string[], help?: boolean, run?: CommandRunner): Promise<number>;
@@ -52,6 +53,8 @@ export declare function runHealth(ctx: Pick<CliContext, "json"> & {
 }, args: string[], help?: boolean): Promise<number>;
 export interface DoctorReport {
     ok: boolean;
+    /** Installed @buildinternet/uploads package version. */
+    cliVersion: string;
     apiUrl: string;
     workspace: string;
     workspaceSource: ResolvedConfig["workspaceSource"];