@letterstory/cli 0.145.2 → 0.145.3

package/lib/cli.mjs

@@ -64,13 +64,15 @@ import {
 } from "./commands.mjs";
 
 // Matches cli/package.json; publish-cli.yml rewrites both to the published version.
-export const VERSION = "0.145.2";
+export const VERSION = "0.145.3";
 
 // Flags that never take a value. Listing them explicitly means `deploy get --json <id>`
 // can't accidentally swallow the id as --json's value. Every `type: "bool"` flag (and its
 // `negate` spelling) in a command's ARGS map must be listed; boolean-flags.test.ts enforces it.
 export const BOOLEAN_FLAGS = new Set([
 	"remap",
+	// login: one-link device sign-in instead of the loopback browser flow.
+	"device",
 	"json",
 	// sim seed: make the new seed active; collections it doesn't cover start empty.
 	"activate",
@@ -366,6 +368,7 @@ Usage:
 
 Auth:
   login [--url <url>]                Sign in via your browser (default url: https://app.letterstory.com)
+  login --device [--url <url>]       Sign in with one link, opened in any browser (for agents and remote shells)
   login --key <ls_…> [--url <url>]   Save a static API key instead (for CI/automation)
   logout                             Forget saved credentials (revokes an OAuth session, if any)
   config                             Show the resolved url + credential source

package/lib/commands/auth.mjs

@@ -8,7 +8,7 @@
 
 import { LetterstoryClient, resolveConfig, writeConfigFile, clearConfigFile, configPath } from "../client.mjs";
 import { flagStr } from "./shared.mjs";
-import { browserLogin, revokeToken } from "../oauth.mjs";
+import { browserLogin, deviceLogin, revokeToken } from "../oauth.mjs";
 
 export async function cmdLogin(ctx) {
 	const { flags, io } = ctx;
@@ -39,7 +39,7 @@ export async function cmdLogin(ctx) {
 		}
 	}
 
-	const tokens = await browserLogin({ url, io });
+	const tokens = flags.device ? await deviceLogin({ url, io }) : await browserLogin({ url, io });
 	const oauth = {
 		access_token: tokens.access_token,
 		refresh_token: tokens.refresh_token,

package/lib/oauth.mjs

@@ -186,6 +186,71 @@ export async function browserLogin({ url, io, fetchImpl = globalThis.fetch }) {
 	}
 }
 
+export const DEVICE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+
+// RFC 8628 device sign-in: for a CLI whose browser is somewhere else (a cloud agent, a remote
+// box). Prints one link for the person to open and Allow, then polls /token until they do.
+export async function deviceLogin({
+	url,
+	io,
+	fetchImpl = globalThis.fetch,
+	sleep = (ms) => new Promise((r) => setTimeout(r, ms)),
+}) {
+	const base = url.replace(/\/+$/, "");
+	const endpoint = `${base}/api/oauth/device_authorization`;
+	let res;
+	try {
+		res = await fetchImpl(endpoint, {
+			method: "POST",
+			headers: { "content-type": "application/x-www-form-urlencoded" },
+			body: new URLSearchParams({ client_id: CLIENT_ID }).toString(),
+		});
+	} catch (err) {
+		throw new CliError(`Could not reach ${endpoint}: ${err.message}`);
+	}
+	const start = await res.json().catch(() => null);
+	if (!res.ok || !start?.device_code) {
+		const detail = start?.error_description || start?.error || `HTTP ${res.status}`;
+		throw new CliError(`Login failed: ${detail}`);
+	}
+
+	io.log(`Open this link, pick the organization and click Allow:\n  ${start.verification_uri_complete}\n`);
+	io.log(`Code: ${start.user_code} (the page shows the same one)`);
+	io.log("Waiting for approval…");
+
+	let intervalMs = (start.interval ?? 5) * 1000;
+	const deadline = Date.now() + (start.expires_in ?? 600) * 1000;
+	while (Date.now() < deadline) {
+		await sleep(intervalMs);
+		let poll;
+		try {
+			poll = await fetchImpl(`${base}/api/oauth/token`, {
+				method: "POST",
+				headers: { "content-type": "application/x-www-form-urlencoded" },
+				body: new URLSearchParams({
+					grant_type: DEVICE_GRANT_TYPE,
+					client_id: CLIENT_ID,
+					device_code: start.device_code,
+				}).toString(),
+			});
+		} catch {
+			continue;
+		}
+		const json = await poll.json().catch(() => null);
+		if (poll.ok && json?.access_token) return json;
+		const error = json?.error;
+		if (error === "authorization_pending") continue;
+		if (error === "slow_down") {
+			intervalMs += 5000;
+			continue;
+		}
+		if (error === "access_denied") throw new CliError("Sign-in was cancelled in the browser.");
+		if (error === "expired_token") throw new CliError("The link expired. Run `login --device` again.");
+		throw new CliError(`Login failed: ${json?.error_description || error || `HTTP ${poll.status}`}`);
+	}
+	throw new CliError("The link expired before it was approved. Run `login --device` again.");
+}
+
 export async function refreshAccessToken({ url, refreshToken, fetchImpl = globalThis.fetch }) {
 	return tokenRequest(
 		url,

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@letterstory/cli",
-	"version": "0.145.2",
+	"version": "0.145.3",
 	"description": "Spin up and manage Letterstory phantom blogs from your terminal.",
 	"type": "module",
 	"license": "UNLICENSED",