@buildinternet/uploads 0.6.0 → 0.8.0

package/dist/client.js

@@ -1,6 +1,8 @@
 import { inferContentType } from "./embed.js";
 import { UploadsError } from "./errors.js";
 import { buildScreenshotKey } from "./keys.js";
+import { packageVersion } from "./package-version.js";
+import { resolveEmbedUrl } from "./public-urls.js";
 async function jsonRequest(url, init) {
     let res;
     try {
@@ -27,6 +29,120 @@ export function createEnrollment(apiUrl, adminToken, input) {
         body: JSON.stringify(input),
     });
 }
+// --- Device authorization (RFC 8628) — the `uploads login` device flow ---
+//
+// The CLI speaks the auth worker's OAuth-shaped endpoints directly with plain
+// `fetch` (no better-auth client dependency in the published package, per plan
+// D5). Better Auth's `device.code`/`device.token` endpoints take
+// `application/json` bodies, NOT the RFC's form-encoding — the JSON shapes
+// below are what the worker expects.
+/** Static OAuth client id allowlisted by the auth worker's `validateClient`. */
+export const DEVICE_CLIENT_ID = "uploads-cli";
+/**
+ * User-Agent for device-flow requests. Stored on the Better Auth session row
+ * when `/device/token` creates the session, so the web account UI can tell a
+ * completed `uploads login` apart from a browser tab. Keep the
+ * `@buildinternet/uploads` prefix in sync with apps/web `CLI_USER_AGENT_RE`.
+ */
+export function cliUserAgent(purpose = "device-login") {
+    return `@buildinternet/uploads/${packageVersion()} (${purpose})`;
+}
+/** POST /api/auth/device/code — start a device flow. Throws on a non-2xx. */
+export function requestDeviceCode(authUrl, clientId = DEVICE_CLIENT_ID) {
+    return jsonRequest(`${authUrl.replace(/\/$/, "")}/api/auth/device/code`, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/json",
+            "User-Agent": cliUserAgent("device-code"),
+        },
+        body: JSON.stringify({ client_id: clientId }),
+    });
+}
+export async function requestDeviceToken(authUrl, input) {
+    let res;
+    try {
+        res = await fetch(`${authUrl.replace(/\/$/, "")}/api/auth/device/token`, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                // Session user_agent is taken from this request when the token is
+                // exchanged — identify as the CLI so /account can surface it.
+                "User-Agent": cliUserAgent("device-token"),
+            },
+            body: JSON.stringify({
+                grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+                device_code: input.deviceCode,
+                client_id: input.clientId ?? DEVICE_CLIENT_ID,
+            }),
+        });
+    }
+    catch (err) {
+        throw new UploadsError(err instanceof Error ? err.message : "network request failed", "NETWORK");
+    }
+    const body = (await res.json().catch(() => null));
+    if (res.ok && body?.access_token) {
+        return {
+            status: "ok",
+            accessToken: body.access_token,
+            tokenType: body.token_type ?? "Bearer",
+            expiresIn: typeof body.expires_in === "number" ? body.expires_in : 0,
+            scope: body.scope ?? "",
+        };
+    }
+    switch (body?.error) {
+        case "authorization_pending":
+            return { status: "pending" };
+        case "slow_down":
+            return { status: "slow_down" };
+        case "expired_token":
+            return { status: "expired" };
+        case "access_denied":
+            return { status: "denied" };
+        default:
+            return {
+                status: "error",
+                error: body?.error ?? "unknown",
+                description: body?.error_description,
+            };
+    }
+}
+/** GET /v1/tokens — workspaces the signed-in user can mint tokens for. */
+export function listMintWorkspaces(apiUrl, accessToken) {
+    return jsonRequest(`${apiUrl.replace(/\/$/, "")}/v1/tokens`, {
+        headers: { Authorization: `Bearer ${accessToken}` },
+    });
+}
+/**
+ * POST /me/workspaces/:name/invites — org invitation for a workspace.
+ * Requires a Better Auth session bearer (device flow), not a workspace token.
+ * Caller must be org admin|owner. `acceptUrl` is always returned so
+ * self-hosted deploys without email can still share the link.
+ */
+export function createWorkspaceInvite(apiUrl, accessToken, workspace, input) {
+    return jsonRequest(`${apiUrl.replace(/\/$/, "")}/me/workspaces/${encodeURIComponent(workspace)}/invites`, {
+        method: "POST",
+        headers: {
+            Authorization: `Bearer ${accessToken}`,
+            "Content-Type": "application/json",
+        },
+        body: JSON.stringify({ email: input.email, role: input.role ?? "member" }),
+    });
+}
+/**
+ * POST /v1/tokens — mint a `up_<workspace>_…` workspace token from a device-flow
+ * session (presented as a bearer). v1 sends exactly one grant.
+ */
+export function mintWorkspaceToken(apiUrl, accessToken, input) {
+    return jsonRequest(`${apiUrl.replace(/\/$/, "")}/v1/tokens`, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${accessToken}`, "Content-Type": "application/json" },
+        body: JSON.stringify({
+            grants: [{ workspace: input.workspace, ...(input.scopes ? { scopes: input.scopes } : {}) }],
+            ...(input.label ? { label: input.label } : {}),
+            ...(input.ttlSeconds ? { ttlSeconds: input.ttlSeconds } : {}),
+        }),
+    });
+}
 function encodeKeyPath(key) {
     return key.split("/").map(encodeURIComponent).join("/");
 }
@@ -125,7 +241,14 @@ export function createUploadsClient(config) {
         if (opts.cursor)
             params.set("cursor", opts.cursor);
         const qs = params.toString();
-        return request("GET", `${filesBase(config)}${qs ? `?${qs}` : ""}`);
+        const page = await request("GET", `${filesBase(config)}${qs ? `?${qs}` : ""}`);
+        return {
+            ...page,
+            items: page.items.map((item) => ({
+                ...item,
+                embedUrl: resolveEmbedUrl(item.url, item.embedUrl),
+            })),
+        };
     }
     async function getGallery(id) {
         return request("GET", `${galleriesBase(config)}/${encodeURIComponent(id)}`);
@@ -142,6 +265,20 @@ export function createUploadsClient(config) {
                     deriveRepoFromGit: opts.deriveRepoFromGit,
                 }));
             const contentType = opts.contentType ?? inferContentType(opts.filename);
+            if (opts.dryRun) {
+                const preview = await request("PUT", `${filesBase(config)}/${encodeKeyPath(key)}?dryRun=1`);
+                if (preview.url == null) {
+                    throw new UploadsError("workspace has no publicBaseUrl (cannot resolve a public URL)", "NO_PUBLIC_URL");
+                }
+                return {
+                    workspace: preview.workspace,
+                    key: preview.key,
+                    url: preview.url,
+                    embedUrl: resolveEmbedUrl(preview.url, preview.embedUrl),
+                    size: body.byteLength,
+                    contentType,
+                };
+            }
             const headers = { "Content-Type": contentType };
             if (opts.provenance) {
                 for (const [k, v] of Object.entries(opts.provenance)) {
@@ -149,6 +286,14 @@ export function createUploadsClient(config) {
                         headers[`X-Uploads-Meta-${k}`] = v;
                 }
             }
+            // Same header prefix as provenance above; the server splits allowlisted
+            // provenance keys (R2) from everything else (D1 file_metadata) by name.
+            if (opts.metadata) {
+                for (const [k, v] of Object.entries(opts.metadata)) {
+                    if (v !== undefined && v !== "")
+                        headers[`X-Uploads-Meta-${k}`] = v;
+                }
+            }
             const result = await request("PUT", `${filesBase(config)}/${encodeKeyPath(key)}`, {
                 body,
                 headers,
@@ -156,7 +301,11 @@ export function createUploadsClient(config) {
             if (result.url == null) {
                 throw new UploadsError("upload succeeded but workspace has no publicBaseUrl", "NO_PUBLIC_URL", 201);
             }
-            return { ...result, url: result.url };
+            return {
+                ...result,
+                url: result.url,
+                embedUrl: resolveEmbedUrl(result.url, result.embedUrl),
+            };
         },
         list,
         /** Follow cursors (optionally starting from one) and return every remaining item. */
@@ -173,8 +322,34 @@ export function createUploadsClient(config) {
         async delete(key) {
             return request("DELETE", `${filesBase(config)}/${encodeKeyPath(key)}`);
         },
+        /** `GET /v1/:workspace/files/:key?metadata=1` — the object's queryable metadata. */
+        async getMetadata(key) {
+            return request("GET", `${filesBase(config)}/${encodeKeyPath(key)}?metadata=1`);
+        },
+        /** `PATCH /v1/:workspace/files/:key` — merge `set`/`delete`; returns the merged map. */
+        async patchMetadata(key, opts) {
+            return request("PATCH", `${filesBase(config)}/${encodeKeyPath(key)}`, {
+                body: new TextEncoder().encode(JSON.stringify(opts)),
+                headers: { "Content-Type": "application/json" },
+            });
+        },
+        /**
+         * `GET /v1/:workspace/files?meta.<k>=<v>&…` — ANDed equality filter over
+         * queryable metadata. `filters` must be pre-validated (see `metadata.ts`).
+         */
+        async findFiles(filters, opts = {}) {
+            const params = new URLSearchParams();
+            for (const [k, v] of Object.entries(filters))
+                params.append(`meta.${k}`, v);
+            if (opts.prefix)
+                params.set("prefix", opts.prefix);
+            if (opts.limit != null)
+                params.set("limit", String(opts.limit));
+            return request("GET", `${filesBase(config)}?${params.toString()}`);
+        },
         async head(key) {
-            return request("GET", `${filesBase(config)}/${encodeKeyPath(key)}`);
+            const result = await request("GET", `${filesBase(config)}/${encodeKeyPath(key)}`);
+            return { ...result, embedUrl: resolveEmbedUrl(result.url, result.embedUrl) };
         },
         async createGallery(opts) {
             return request("POST", galleriesBase(config), {

package/dist/commands/install.js

@@ -13,26 +13,28 @@ bearer token, so only the token is needed.
 Usage:
   uploads install [skill|mcp|all]     (default: all)
 
-What runs:
-  skill   npx -y skills add ${SKILL_SOURCE} --skill ${SKILL_NAME}
+What it does:
+  skill   Agent skill (via npx skills) — when to host files / embed in PRs
+  mcp     Hosted MCP server in Claude Code — put, list, attach, galleries
+
+What runs under the hood:
+  skill   npx -y skills add ${SKILL_SOURCE} --skill ${SKILL_NAME} -g -y -a '*'
   mcp     claude mcp add --transport http uploads ${DEFAULT_MCP_URL} \\
             --header "Authorization: Bearer <token>"
 
 Options:
   --url <endpoint>    Remote MCP endpoint (default: ${DEFAULT_MCP_URL})
   --name <name>       MCP server name in the client (default: uploads)
-  --dry-run           Print the commands without running them
+  --dry-run           Print the plan without running anything
+  --verbose           Show underlying command output (default: errors only)
 
 Examples:
   uploads install
   uploads install skill
-  uploads install mcp --dry-run
+  uploads install mcp
+  uploads install --dry-run
 `;
-/**
- * Masks the configured token (and any Bearer credential) in text destined
- * for stdout/stderr/JSON — command echoes, child-process output, and error
- * messages can all embed it.
- */
+/** Mask Bearer credentials and the configured token in any printed text. */
 function redactor(token) {
     return (text) => {
         let out = text.replace(/Bearer \S+/g, "Bearer ***");
@@ -48,13 +50,76 @@ function runStep(run, command) {
     }
     catch (err) {
         const message = err instanceof Error ? err.message : String(err);
-        // execFileSync's ENOENT means the binary itself is missing.
         const hint = err.code === "ENOENT"
-            ? `${command[0]} not found on PATH — run manually: ${command.join(" ")}`
+            ? `${command[0]} not found on PATH — install it, or run manually: ${command.join(" ")}`
             : message;
         return { command, ok: false, error: hint };
     }
 }
+function skillCommand() {
+    // -g global, -y non-interactive, -a '*' every agent (skips the multi-select TUI)
+    return ["npx", "-y", "skills", "add", SKILL_SOURCE, "--skill", SKILL_NAME, "-g", "-y", "-a", "*"];
+}
+function mcpCommand(name, url, bearer) {
+    return [
+        "claude",
+        "mcp",
+        "add",
+        "--transport",
+        "http",
+        name,
+        url,
+        "--header",
+        `Authorization: Bearer ${bearer}`,
+    ];
+}
+function peekToken(globals) {
+    try {
+        const config = resolveConfig({
+            apiUrl: globals.apiUrl,
+            workspace: globals.workspace,
+            token: globals.token,
+            envFile: globals.envFile,
+            requireToken: false,
+        });
+        return config.token || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function printHumanSteps(results, redact, verbose) {
+    for (const [step, r] of Object.entries(results)) {
+        const cmd = redact(r.command.join(" "));
+        if (r.skipped === "dry-run") {
+            process.stdout.write(`${step}: would run — ${cmd}\n`);
+        }
+        else if (r.skipped === "sign-in") {
+            process.stdout.write(`${step}: skipped — ${redact(r.error ?? "needs sign-in")}\n`);
+        }
+        else if (r.ok) {
+            process.stdout.write(`${step}: ok\n`);
+            if (verbose && r.output) {
+                process.stdout.write(`  ${redact(r.output).split("\n").join("\n  ")}\n`);
+            }
+        }
+        else {
+            process.stderr.write(`${step}: failed — ${redact(r.error ?? "")}\n`);
+            if (verbose)
+                process.stderr.write(`  command: ${cmd}\n`);
+        }
+    }
+}
+function printSuccessFooter(steps, signedIn) {
+    process.stdout.write(`\nDone — ${steps.join(" and ")} ready.\n` +
+        "Restart your agent session so it picks up the new skill/server.\n" +
+        "Then ask it to host a screenshot or attach images to a PR — for example:\n" +
+        '  "upload this screenshot and put it in the PR description"\n' +
+        '  "attach before.png and after.png to this PR"\n');
+    if (!signedIn) {
+        process.stdout.write("\nNot signed in yet? Run `uploads login` once so put/attach/MCP can authenticate.\n");
+    }
+}
 export async function runInstall(args, opts, help = false) {
     const parsed = parseCommandArgs(args);
     if (help || parsed.help) {
@@ -68,66 +133,59 @@ export async function runInstall(args, opts, help = false) {
     const url = flagString(parsed.flags, "--url") ?? DEFAULT_MCP_URL;
     const name = flagString(parsed.flags, "--name") ?? "uploads";
     const dryRun = flagBool(parsed.flags, "--dry-run");
+    const verbose = flagBool(parsed.flags, "--verbose");
     const run = opts.runner ?? execRunner;
+    const human = !opts.json && !dryRun;
+    const token = peekToken(opts.globals);
+    const signedIn = Boolean(token);
+    const redact = redactor(token);
     const results = {};
-    let redact = redactor(undefined);
     if (target === "skill" || target === "all") {
-        const command = ["npx", "-y", "skills", "add", SKILL_SOURCE, "--skill", SKILL_NAME];
+        const command = skillCommand();
+        if (human)
+            process.stdout.write("Installing skill…\n");
         results.skill = dryRun ? { command, ok: true, skipped: "dry-run" } : runStep(run, command);
     }
     if (target === "mcp" || target === "all") {
-        const config = resolveConfig({
-            apiUrl: opts.globals.apiUrl,
-            workspace: opts.globals.workspace,
-            token: opts.globals.token,
-            envFile: opts.globals.envFile,
-            requireToken: !dryRun,
-        });
-        const bearer = config.token || "<token>";
-        redact = redactor(config.token || undefined);
-        const command = [
-            "claude",
-            "mcp",
-            "add",
-            "--transport",
-            "http",
-            name,
-            url,
-            "--header",
-            `Authorization: Bearer ${bearer}`,
-        ];
-        results.mcp = dryRun ? { command, ok: true, skipped: "dry-run" } : runStep(run, command);
+        if (!dryRun && !token) {
+            results.mcp = {
+                command: mcpCommand(name, url, "<token>"),
+                ok: false,
+                skipped: "sign-in",
+                error: "needs sign-in — run `uploads login`, then `uploads install mcp`",
+            };
+        }
+        else {
+            const command = mcpCommand(name, url, token || "<token>");
+            if (human)
+                process.stdout.write("Installing MCP server…\n");
+            results.mcp = dryRun ? { command, ok: true, skipped: "dry-run" } : runStep(run, command);
+        }
     }
     const failed = Object.values(results).some((r) => !r.ok);
     if (opts.json) {
-        // Never echo the token in structured output — commands, child output,
-        // and error text can all embed it.
-        const redacted = Object.fromEntries(Object.entries(results).map(([key, r]) => [
+        const steps = Object.fromEntries(Object.entries(results).map(([key, r]) => [
             key,
             {
-                ...r,
                 command: r.command.map(redact),
+                ok: r.ok,
+                skipped: r.skipped,
                 output: r.output === undefined ? undefined : redact(r.output),
                 error: r.error === undefined ? undefined : redact(r.error),
             },
         ]));
-        process.stdout.write(JSON.stringify({ ok: !failed, steps: redacted }, null, 2) + "\n");
+        process.stdout.write(JSON.stringify({ ok: !failed, steps }, null, 2) + "\n");
         return failed ? 1 : 0;
     }
-    for (const [step, r] of Object.entries(results)) {
-        const shown = redact(r.command.join(" "));
-        if (r.skipped)
-            process.stdout.write(`${step}: would run — ${shown}\n`);
-        else if (r.ok) {
-            process.stdout.write(`${step}: ok — ${shown}\n`);
-            if (r.output)
-                process.stdout.write(`  ${redact(r.output).split("\n").join("\n  ")}\n`);
-        }
-        else
-            process.stderr.write(`${step}: failed — ${redact(r.error ?? "")}\n`);
-    }
+    printHumanSteps(results, redact, verbose);
     if (!failed && !dryRun) {
-        process.stderr.write("hint: restart your agent session to pick up the new skill/server\n");
+        printSuccessFooter(Object.keys(results), signedIn);
+    }
+    else if (failed && !dryRun && results.skill?.ok && results.mcp && !results.mcp.ok) {
+        const next = results.mcp.skipped === "sign-in"
+            ? "Sign in with `uploads login`, then re-run `uploads install mcp`."
+            : "Fix the MCP step above, then re-run `uploads install mcp`.";
+        process.stdout.write(`\nSkill is installed. ${next}\n`);
     }
     return failed ? 1 : 0;
 }

package/dist/commands/invite.d.ts

@@ -0,0 +1,10 @@
+import { type DeviceLoginIo } from "./login.js";
+/** Exported for unit tests. */
+export declare function resolveInviteWorkspace(workspaces: Array<{
+    workspace: string;
+    role: string;
+}>, requested: string | undefined): string;
+export declare function runInvite(args: string[], opts: {
+    json?: boolean;
+    apiUrl?: string;
+}, help?: boolean, io?: DeviceLoginIo): Promise<number>;

package/dist/commands/invite.js

@@ -0,0 +1,102 @@
+/**
+ * Workspace-admin email invite via ephemeral device session.
+ * Not ADMIN_TOKEN, not a workspace upload token.
+ */
+import { createWorkspaceInvite, listMintWorkspaces } from "../client.js";
+import { flagBool, flagString, parseCommandArgs, UsageError } from "../cli-args.js";
+import { defaultDeviceIo, obtainDeviceAccessToken, resolveAuthUrl, } from "./login.js";
+const HELP = `uploads invite create [options]
+
+Invite someone to a workspace by email. Opens a browser so you approve as
+yourself (device login). You must be an admin or owner of that workspace.
+
+The invitee gets email when Email Sending is configured; either way the
+CLI prints an accept URL you can share. After accepting they run uploads login.
+
+Options:
+  --email <address>     Required
+  --workspace <name>    Required if you admin more than one workspace
+  --role member|admin   Invitee org role (default: member)
+  --auth-url <url>      Auth origin (default: derived from --api-url)
+  --api-url <url>       API origin (default: https://api.uploads.sh)
+  --no-open             Print the approval URL only
+
+Examples:
+  uploads invite create --email teammate@example.com
+  uploads invite create --workspace acme --email teammate@example.com
+`;
+/** Exported for unit tests. */
+export function resolveInviteWorkspace(workspaces, requested) {
+    const adminable = workspaces.filter((w) => w.role === "admin" || w.role === "owner");
+    if (requested) {
+        const hit = adminable.find((w) => w.workspace === requested);
+        if (!hit) {
+            const roles = workspaces
+                .filter((w) => w.workspace === requested)
+                .map((w) => w.role)
+                .join(", ");
+            if (roles) {
+                throw new UsageError(`you are ${roles} on ${requested}, not admin/owner — only workspace admins can invite`);
+            }
+            throw new UsageError(`no admin access to workspace ${requested}`);
+        }
+        return hit.workspace;
+    }
+    if (adminable.length === 1)
+        return adminable[0].workspace;
+    if (adminable.length === 0) {
+        throw new UsageError("your account has no workspace admin access — ask a site operator or existing admin");
+    }
+    const names = adminable.map((w) => w.workspace).join(", ");
+    throw new UsageError(`multiple workspaces you admin (${names}); pass --workspace <name>`);
+}
+export async function runInvite(args, opts, help = false, io = defaultDeviceIo) {
+    const parsed = parseCommandArgs(args);
+    if (help || parsed.help) {
+        process.stderr.write(HELP);
+        return 0;
+    }
+    if (parsed.positionals[0] !== "create") {
+        throw new UsageError("expected: uploads invite create");
+    }
+    const email = flagString(parsed.flags, "--email");
+    if (!email)
+        throw new UsageError("--email is required");
+    const roleRaw = flagString(parsed.flags, "--role") ?? "member";
+    if (roleRaw !== "member" && roleRaw !== "admin") {
+        throw new UsageError("--role must be member or admin");
+    }
+    const role = roleRaw;
+    const requestedWorkspace = flagString(parsed.flags, "--workspace");
+    const apiUrl = flagString(parsed.flags, "--api-url") ?? opts.apiUrl ?? "https://api.uploads.sh";
+    const authUrl = resolveAuthUrl(parsed, apiUrl);
+    if (flagBool(parsed.flags, "--non-interactive")) {
+        throw new UsageError("invite requires a browser for device approval");
+    }
+    const accessToken = await obtainDeviceAccessToken(authUrl, {
+        noOpen: flagBool(parsed.flags, "--no-open"),
+        prompt: "To invite as your account, open:",
+    }, io);
+    const { workspaces } = await listMintWorkspaces(apiUrl, accessToken);
+    const workspace = resolveInviteWorkspace(workspaces, requestedWorkspace);
+    const result = await createWorkspaceInvite(apiUrl, accessToken, workspace, { email, role });
+    const payload = {
+        ok: true,
+        workspace,
+        email: result.invitation.email,
+        role: result.invitation.role,
+        invitationId: result.invitation.id,
+        status: result.invitation.status,
+        acceptUrl: result.acceptUrl ?? null,
+    };
+    if (opts.json)
+        process.stdout.write(JSON.stringify(payload, null, 2) + "\n");
+    else {
+        process.stdout.write(`Invited ${email} to ${workspace} as ${role} (${result.invitation.status}).\n`);
+        if (result.acceptUrl) {
+            process.stdout.write(`Accept link (share if email isn't configured):\n  ${result.acceptUrl}\n`);
+        }
+        process.stdout.write("They accept, then run: uploads login\n");
+    }
+    return 0;
+}

package/dist/commands/login.d.ts

@@ -5,7 +5,35 @@ export declare function resolveEnrollmentCode(parsed: ReturnType<typeof parseCom
     readLine: () => Promise<string>;
     hiddenPrompt: () => Promise<string>;
 }): Promise<string>;
+/**
+ * Auth worker base URL: explicit flag > UPLOADS_AUTH_URL > swap an `api.` host
+ * label for `auth.` > the production default. Local multi-worker dev (where
+ * auth runs on a different loopback port than the API) needs an explicit
+ * --auth-url / UPLOADS_AUTH_URL.
+ */
+export declare function resolveAuthUrl(parsed: ReturnType<typeof parseCommandArgs>, apiUrl: string): string;
+export interface DeviceLoginIo {
+    sleep: (ms: number) => Promise<void>;
+    now: () => number;
+    openUrl: (url: string) => void;
+    write: (text: string) => void;
+}
+export declare const defaultDeviceIo: DeviceLoginIo;
+/**
+ * Browser device-authorization session only (no workspace token mint).
+ * Shared by `uploads login` and `uploads invite create`.
+ */
+export declare function obtainDeviceAccessToken(authUrl: string, opts?: {
+    noOpen?: boolean;
+    prompt?: string;
+}, io?: DeviceLoginIo): Promise<string>;
+/** Poll device/token honoring interval / slow_down / pending until approved or expired. */
+export declare function pollForDeviceToken(authUrl: string, code: {
+    device_code: string;
+    interval: number;
+    expires_in: number;
+}, io: DeviceLoginIo): Promise<string>;
 export declare function runLogin(args: string[], opts: {
     json?: boolean;
     apiUrl?: string;
-}, help?: boolean): Promise<number>;
+}, help?: boolean, deviceIo?: DeviceLoginIo): Promise<number>;