@moloodev/cli 0.2.2 → 0.4.0

package/src/dev-server.ts

@@ -1,82 +1,27 @@
+import { getWorkspaceHostUrl } from "@moloodev/platform";
 import { existsSync, watch, type FSWatcher } from "node:fs";
 import { createServer, type IncomingMessage, type Server, type ServerResponse } from "node:http";
-import { dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
-import esbuild from "esbuild";
+import { join } from "node:path";
 import {
-  allowedFrameAncestor,
   editorOriginHeaders,
   type EditorOriginHeaderPolicy,
 } from "@moloodev/editor-sdk/origin-headers";
-import { buildEditorScript, readPackageEditorView, styleHeader } from "./editor-views";
+import { buildEditorScript, readPackageEditorView } from "./editor-views";
 
 export type StartEditorDevServerOptions = {
   readonly packageRoot: string;
-  readonly hostPort?: number;
   readonly viewPort?: number;
   readonly watch?: boolean;
 };
 
 export type EditorDevServer = {
   readonly editorId: string;
-  readonly hostOrigin: string;
   readonly viewOrigin: string;
-  readonly hostPort: number;
   readonly viewPort: number;
   rebuild(): Promise<{ build: number }>;
   close(): Promise<void>;
 };
 
-let cachedHostScript: string | null = null;
-
-function packageSourceDir(specifier: string): string {
-  let dir = dirname(fileURLToPath(import.meta.resolve(specifier)));
-  while (!existsSync(join(dir, "package.json"))) {
-    const parent = dirname(dir);
-    if (parent === dir) throw new Error(`Cannot locate package root for ${specifier}`);
-    dir = parent;
-  }
-  return join(dir, "src");
-}
-
-async function buildHostClientScript(): Promise<string> {
-  if (cachedHostScript !== null) return cachedHostScript;
-  const here = dirname(fileURLToPath(import.meta.url));
-  const css = new Set<string>();
-  const built = await esbuild.build({
-    entryPoints: [join(here, "dev-host-entry.tsx")],
-    bundle: true,
-    format: "iife",
-    platform: "browser",
-    jsx: "automatic",
-    write: false,
-    logLevel: "error",
-    legalComments: "none",
-    define: { "process.env.NODE_ENV": '"development"' },
-    alias: { "lib0/logging": join(here, "yjs-log.ts") },
-    plugins: [
-      {
-        name: "collect-host-css",
-        setup(builder) {
-          builder.onLoad({ filter: /\.css$/ }, (args) => {
-            css.add(args.path);
-            return { contents: "", loader: "js" };
-          });
-        },
-      },
-    ],
-  });
-  const file = built.outputFiles?.[0];
-  if (!file) throw new Error("Failed to bundle dev-host-entry.tsx");
-  const header = await styleHeader(join(here, "dev-host.css"), [...css], [
-    here,
-    packageSourceDir("@moloodev/ui"),
-    packageSourceDir("@moloodev/editor-sdk/layout"),
-  ]);
-  cachedHostScript = header + file.text;
-  return cachedHostScript;
-}
-
 function viewDocumentCsp(network: readonly string[], ancestor: string | null): string {
   const connect = ["'self'", ...network];
   const frameAncestors = ancestor ? [ancestor] : ["'none'"];
@@ -136,8 +81,8 @@ function closeServer(server: Server): Promise<void> {
 export async function startEditorDevServer(
   options: StartEditorDevServerOptions,
 ): Promise<EditorDevServer> {
+  const appOrigin = getWorkspaceHostUrl("production");
   const initialView = readPackageEditorView(options.packageRoot);
-  const hostScript = await buildHostClientScript();
   let currentView = initialView;
   let currentEditorScript = await buildEditorScript(initialView);
   let buildCount = 1;
@@ -146,11 +91,32 @@ export async function startEditorDevServer(
   let watcher: FSWatcher | null = null;
   let watchTimer: ReturnType<typeof setTimeout> | null = null;
 
-  let hostOrigin = "";
   let viewOrigin = "";
 
   const viewServer = createServer((req: IncomingMessage, res: ServerResponse) => {
+    // Check the literal authority before handling requests to prevent DNS rebinding.
+    if (![`127.0.0.1:${boundViewPort}`, `localhost:${boundViewPort}`, `[::1]:${boundViewPort}`].includes(req.headers.host ?? "") ||
+      (req.headers.origin && req.headers.origin !== appOrigin)) {
+      res.writeHead(403);
+      res.end("forbidden");
+      return;
+    }
+    if (req.headers.origin === appOrigin) {
+      res.setHeader("access-control-allow-origin", appOrigin);
+      res.setHeader("vary", "Origin");
+    }
     const method = req.method ?? "GET";
+    if (method === "OPTIONS" && req.headers.origin === appOrigin) {
+      res.setHeader("access-control-allow-methods", "GET, HEAD");
+      // Manifest fetch has no custom headers; EventSource may resume with Last-Event-ID.
+      res.setHeader("access-control-allow-headers", "last-event-id");
+      if (req.headers["access-control-request-private-network"] === "true") {
+        res.setHeader("access-control-allow-private-network", "true");
+      }
+      res.writeHead(204, { "cache-control": "no-store" });
+      res.end();
+      return;
+    }
     const url = new URL(req.url ?? "/", viewOrigin || "http://127.0.0.1");
     const refused = editorOriginHeaders({ parent: null, verifiedOrigins: [] });
 
@@ -166,10 +132,10 @@ export async function startEditorDevServer(
 
     if (url.pathname === "/") {
       const parent = singleQueryParam(url, "parent");
-      const verifiedOrigins = [hostOrigin, `http://localhost:${String(boundHostPort)}`];
-      const ancestor = allowedFrameAncestor(parent, verifiedOrigins);
+      const verifiedOrigins: readonly string[] = [appOrigin];
+      const ancestor = parent === appOrigin ? appOrigin : null;
       const policy: EditorOriginHeaderPolicy = {
-        ...editorOriginHeaders({ parent, verifiedOrigins }),
+        ...editorOriginHeaders({ parent: ancestor, verifiedOrigins }),
         "content-security-policy": viewDocumentCsp(currentView.network, ancestor),
       };
       applyOriginPolicy(res, policy);
@@ -203,62 +169,8 @@ export async function startEditorDevServer(
       return;
     }
 
-    applyOriginPolicy(res, refused);
-    res.writeHead(404, {
-      "content-type": "text/plain; charset=utf-8",
-      "cache-control": "no-store",
-    });
-    res.end(method === "HEAD" ? undefined : "not found");
-  });
-
-  const hostServer = createServer((req: IncomingMessage, res: ServerResponse) => {
-    const method = req.method ?? "GET";
-    const url = new URL(req.url ?? "/", hostOrigin || "http://127.0.0.1");
-
-    if (method !== "GET" && method !== "HEAD") {
-      res.writeHead(405, { "content-type": "text/plain; charset=utf-8" });
-      res.end("method not allowed");
-      return;
-    }
-
-    if (url.pathname === "/") {
-      const bootstrap = {
-        editorId: currentView.id,
-        hostOrigin,
-        viewOrigin,
-        manifest: currentView.manifest,
-      };
-      const html = [
-        "<!doctype html>",
-        '<html lang="ko" class="dark">',
-        "<head>",
-        '<meta charset="utf-8">',
-        `<title>${String(currentView.manifest.title ?? currentView.id)} — moloo dev</title>`,
-        "</head>",
-        "<body>",
-        `<script>window.__MOLOO_DEV_HOST__ = ${JSON.stringify(bootstrap).replace(/</g, "\\u003c")};</script>`,
-        '<script src="/host.js"></script>',
-        "</body>",
-        "</html>",
-      ].join("\n");
-      res.writeHead(200, {
-        "content-type": "text/html; charset=utf-8",
-        "cache-control": "no-store",
-      });
-      res.end(method === "HEAD" ? undefined : html);
-      return;
-    }
-
-    if (url.pathname === "/host.js") {
-      res.writeHead(200, {
-        "content-type": "text/javascript; charset=utf-8",
-        "cache-control": "no-store",
-      });
-      res.end(method === "HEAD" ? undefined : hostScript);
-      return;
-    }
-
     if (url.pathname === "/manifest.json") {
+      applyOriginPolicy(res, refused);
       res.writeHead(200, {
         "content-type": "application/json; charset=utf-8",
         "cache-control": "no-store",
@@ -268,11 +180,16 @@ export async function startEditorDevServer(
     }
 
     if (url.pathname === "/events") {
+      applyOriginPolicy(res, refused);
       res.writeHead(200, {
         "content-type": "text/event-stream; charset=utf-8",
         "cache-control": "no-store",
         connection: "keep-alive",
       });
+      if (method === "HEAD") {
+        res.end();
+        return;
+      }
       res.write(`event: connected\ndata: ${JSON.stringify({ build: buildCount })}\n\n`);
       sseClients.add(res);
       req.on("close", () => {
@@ -281,27 +198,12 @@ export async function startEditorDevServer(
       return;
     }
 
+    applyOriginPolicy(res, refused);
     res.writeHead(404, { "content-type": "text/plain; charset=utf-8" });
-    res.end("not found");
+    res.end(method === "HEAD" ? undefined : "not found");
   });
 
-  const requestedHostPort = options.hostPort ?? 4300;
-  const boundHostPort = await listenOnLoopback(hostServer, requestedHostPort);
-  const requestedViewPort =
-    options.viewPort ?? (requestedHostPort === 0 ? 0 : boundHostPort + 1);
-  let boundViewPort: number;
-  try {
-    boundViewPort = await listenOnLoopback(viewServer, requestedViewPort);
-  } catch (err) {
-    if (options.viewPort === undefined) {
-      boundViewPort = await listenOnLoopback(viewServer, 0);
-    } else {
-      await closeServer(hostServer);
-      throw err;
-    }
-  }
-
-  hostOrigin = `http://127.0.0.1:${String(boundHostPort)}`;
+  const boundViewPort = await listenOnLoopback(viewServer, options.viewPort ?? 4310);
   viewOrigin = `http://127.0.0.1:${String(boundViewPort)}`;
 
   function broadcastSse(event: string, payload: unknown): void {
@@ -329,8 +231,7 @@ export async function startEditorDevServer(
 
   const srcDir = join(options.packageRoot, "src");
   if (options.watch !== false && existsSync(srcDir)) {
-    watcher = watch(srcDir, { recursive: true }, (_event, filename) => {
-      if (filename && String(filename).includes(".view-css-")) return;
+    watcher = watch(srcDir, { recursive: true }, () => {
       if (watchTimer !== null) clearTimeout(watchTimer);
       watchTimer = setTimeout(() => {
         watchTimer = null;
@@ -341,9 +242,7 @@ export async function startEditorDevServer(
 
   return {
     editorId: currentView.id,
-    hostOrigin,
     viewOrigin,
-    hostPort: boundHostPort,
     viewPort: boundViewPort,
     rebuild,
     async close() {
@@ -359,7 +258,7 @@ export async function startEditorDevServer(
         client.end();
       }
       sseClients.clear();
-      await Promise.all([closeServer(hostServer), closeServer(viewServer)]);
+      await closeServer(viewServer);
     },
   };
 }

package/src/editor-dev.ts

@@ -0,0 +1,38 @@
+import { getWorkspaceHostUrl } from "@moloodev/platform";
+import { startEditorDevServer, type StartEditorDevServerOptions } from "./dev-server";
+import { resolveWorkspace, type WorkspaceOptions } from "./workspace";
+
+async function openBrowser(url: string) {
+  const { default: open } = await import("open");
+  await open(url, { wait: false });
+}
+
+function waitForStop() {
+  return new Promise<void>((resolve) => {
+    const stop = () => {
+      process.off("SIGINT", stop);
+      process.off("SIGTERM", stop);
+      resolve();
+    };
+    process.on("SIGINT", stop);
+    process.on("SIGTERM", stop);
+  });
+}
+
+export async function runEditorDev(
+  options: StartEditorDevServerOptions & WorkspaceOptions & { workspace?: string },
+  deps = { resolve: resolveWorkspace, start: startEditorDevServer, open: openBrowser, stopped: waitForStop },
+): Promise<number> {
+  const slug = await deps.resolve({ ...options, flag: options.workspace });
+  const server = await deps.start(options);
+  try {
+    const destination = new URL(`/w/${encodeURIComponent(slug)}/dev-editor`, getWorkspaceHostUrl("production"));
+    destination.searchParams.set("view", server.viewOrigin);
+    console.log(`${server.editorId} view origin -> ${server.viewOrigin}`);
+    await deps.open(destination.href);
+    await deps.stopped();
+  } finally {
+    await server.close();
+  }
+  return 0;
+}

package/src/editor-views.ts

@@ -1,5 +1,6 @@
-import { existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
+import { findPackageJSON } from "node:module";
 import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import esbuild from "esbuild";
@@ -13,13 +14,10 @@ import { readEditorManifest } from "./read-editor-manifest";
 
 export type EditorView = {
   id: string;
-  editor: string;
   packageRoot: string;
   network: readonly string[];
 };
 
-const defaultFallback = join(dirname(fileURLToPath(import.meta.url)), "view-page.ts");
-
 export function readPackageEditorView(packageRoot: string): EditorView & { manifest: Record<string, unknown> } {
   const manifestPath = join(packageRoot, "src/manifest.ts");
   if (!existsSync(manifestPath)) {
@@ -35,41 +33,16 @@ export function readPackageEditorView(packageRoot: string): EditorView & { manif
     throw new Error(`Invalid editor id ${manifest.id}`);
   }
   const network = parseNetwork("network" in manifest ? manifest.network : undefined);
-  return { id: manifest.id, editor: parsed.editor, packageRoot, network, manifest };
+  return { id: manifest.id, packageRoot, network, manifest };
 }
 
-export function findEditorViews(repo: string): EditorView[] {
-  const singleManifest = join(repo, "src/manifest.ts");
-  if (existsSync(singleManifest)) {
-    const view = readPackageEditorView(repo);
-    return [{ id: view.id, editor: view.editor, packageRoot: view.packageRoot, network: view.network }];
-  }
-  const dir = join(repo, "editors");
-  if (!existsSync(dir)) return [];
-  const found: EditorView[] = [];
-  for (const name of readdirSync(dir)) {
-    const packageRoot = join(dir, name);
-    const manifestPath = join(packageRoot, "src/manifest.ts");
-    if (!existsSync(manifestPath)) continue;
-    const manifest: unknown = readEditorManifest(manifestPath);
-    if (!isRecord(manifest) || typeof manifest.id !== "string") continue;
-    const parsed = parseEditorId(manifest.id, true);
-    if (parsed === undefined || parsed.publisher !== "moloo") continue;
-    const network = parseNetwork("network" in manifest ? manifest.network : undefined);
-    if (found.some((entry) => entry.id === manifest.id)) throw new Error(`Duplicate editor ${manifest.id}`);
-    found.push({ id: manifest.id, editor: parsed.editor, packageRoot, network });
-  }
-  return found.sort((left, right) => left.editor.localeCompare(right.editor));
-}
-
-export function resolveViewEntry(packageRoot: string, fallback: string = defaultFallback): string {
+export function resolveViewEntry(packageRoot: string): string {
   const manifest: unknown = JSON.parse(readFileSync(join(packageRoot, "package.json"), "utf8"));
   if (!isRecord(manifest)) throw new Error("Invalid editor package.json");
   const exports = manifest.exports;
-  if (exports === undefined || typeof exports === "string") return fallback;
-  if (!isRecord(exports)) throw new Error("Invalid editor exports");
+  if (!isRecord(exports)) throw new Error("Editor package must export ./view");
   const target = exports["./view"];
-  if (target === undefined) return fallback;
+  if (target === undefined) throw new Error("Editor package must export ./view");
   if (
     typeof target !== "string" ||
     !target.startsWith("./") ||
@@ -122,14 +95,14 @@ export async function buildEditorView(entry: string, output: string, metafile: s
   writeFileSync(metafile, JSON.stringify(view.metafile));
 }
 
-export async function buildEditorScript(editor: EditorView, fallback: string = defaultFallback): Promise<string> {
+export async function buildEditorScript(editor: EditorView): Promise<string> {
   const directory = mkdtempSync(join(tmpdir(), "moloo-editor-"));
   try {
     const output = join(directory, "editor.js");
     const packageStyles = join(editor.packageRoot, "src/styles.css");
     const styles = existsSync(packageStyles) ? packageStyles : undefined;
     await buildEditorView(
-      resolveViewEntry(editor.packageRoot, fallback),
+      resolveViewEntry(editor.packageRoot),
       output,
       join(directory, "meta.json"),
       styles,
@@ -151,7 +124,7 @@ export async function buildEditorPackage(
   const metafilePath = join(outDir, "meta.json");
   const styles = join(packageRoot, "src/styles.css");
   await buildEditorView(
-    resolveViewEntry(packageRoot, defaultFallback),
+    resolveViewEntry(packageRoot),
     scriptPath,
     metafilePath,
     existsSync(styles) ? styles : undefined,
@@ -161,20 +134,27 @@ export async function buildEditorPackage(
   return { id: view.id, scriptPath, manifestPath, metafilePath, script, manifest: view.manifest };
 }
 
-export async function styleHeader(styles: string, collected: string[], sources: readonly string[] = []): Promise<string> {
-  const directory = mkdtempSync(join(dirname(styles), ".view-css-"));
+async function styleHeader(styles: string, collected: string[]): Promise<string> {
+  const animationPackage = findPackageJSON("tw-animate-css", import.meta.url);
+  if (!animationPackage) throw new Error("Missing CLI dependency: tw-animate-css");
+  const directory = mkdtempSync(join(tmpdir(), "moloo-view-css-"));
   try {
     const entry = join(directory, "input.css");
     writeFileSync(
       entry,
-      [
-        ...[styles, ...collected].map((file) => `@import ${JSON.stringify(file)};`),
-        ...sources.map((dir) => `@source ${JSON.stringify(dir)};`),
-      ].join("\n"),
+      [styles, ...collected].map((file) => `@import ${JSON.stringify(file)};`).join("\n"),
     );
     const compiled = await build({
       configFile: false,
-      root: directory,
+      root: dirname(styles),
+      cacheDir: join(directory, ".vite"),
+      resolve: {
+        alias: {
+          tailwindcss: dirname(fileURLToPath(import.meta.resolve("tailwindcss/package.json"))),
+          "tw-animate-css": dirname(animationPackage),
+          "shadcn/tailwind.css": fileURLToPath(import.meta.resolve("shadcn/tailwind.css")),
+        },
+      },
       plugins: [tailwind()],
       logLevel: "error",
       build: { write: false, cssMinify: false, rollupOptions: { input: entry } },

package/src/index.ts

@@ -2,7 +2,6 @@ export {
   buildEditorPackage,
   buildEditorScript,
   buildEditorView,
-  findEditorViews,
   readPackageEditorView,
   resolveViewEntry,
   type EditorView,
@@ -21,5 +20,4 @@ export {
   uploadEndpoint,
 } from "./publish";
 export { readEditorManifest } from "./read-editor-manifest";
-export { rewriteThreeLoaders } from "./three-local-loaders";
 export { runCli } from "./cli";

package/src/oauth.ts

@@ -0,0 +1,190 @@
+import { randomBytes, createHash, timingSafeEqual } from "node:crypto";
+import { createServer } from "node:http";
+import { setTimeout as delay } from "node:timers/promises";
+import type { Tokens } from "./credentials";
+
+export class BrowserUnavailable extends Error {}
+
+export const CLIENT_ID = "moloo-cli";
+export const SCOPE = "profile email offline_access workspace:read";
+export const DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+
+export async function oauthPost(issuer: string, path: string, body: Record<string, string>) {
+  return fetch(`${issuer}${path}`, {
+    method: "POST",
+    redirect: "error",
+    signal: AbortSignal.timeout(30_000),
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({ client_id: CLIENT_ID, ...body }),
+  });
+}
+
+export async function readTokens(response: Response, refreshToken?: string): Promise<Tokens> {
+  const value = (await response.json()) as Record<string, unknown>;
+  if (
+    !response.ok ||
+    typeof value.access_token !== "string" ||
+    typeof (value.refresh_token ?? refreshToken) !== "string" ||
+    typeof value.expires_in !== "number" ||
+    !Number.isFinite(value.expires_in) ||
+    value.expires_in <= 0 ||
+    typeof value.token_type !== "string" ||
+    value.token_type.toLowerCase() !== "bearer" ||
+    typeof value.scope !== "string"
+  ) {
+    throw new Error(
+      `OAuth token exchange failed (${String(value.error ?? response.status)}). Run moloo login.`,
+    );
+  }
+  return {
+    accessToken: value.access_token,
+    refreshToken: (value.refresh_token ?? refreshToken) as string,
+    expiresAt: Date.now() + value.expires_in * 1000,
+    scopes: value.scope.split(" ").filter(Boolean),
+  };
+}
+
+/** Bind before opening the browser; tolerate unrelated/forged requests without consuming the callback. */
+export async function loopbackCallback(state: string, timeout = 120_000) {
+  let accept!: (code: string) => void;
+  let fail!: (error: Error) => void;
+  const code = new Promise<string>((resolve, reject) => {
+    accept = resolve;
+    fail = reject;
+  });
+  // Opening a browser can fail before the caller starts awaiting the code.
+  void code.catch(() => {});
+  const server = createServer((req, res) => {
+    res.setHeader("Cache-Control", "no-store");
+    const url = new URL(req.url ?? "/", "http://127.0.0.1");
+    const received = Buffer.from(url.searchParams.get("state") ?? "");
+    const expected = Buffer.from(state);
+    if (
+      req.method !== "GET" ||
+      url.pathname !== "/callback" ||
+      received.length !== expected.length ||
+      !timingSafeEqual(received, expected)
+    ) {
+      res.writeHead(400).end("Invalid callback");
+      return;
+    }
+    const error = url.searchParams.get("error");
+    const value = url.searchParams.get("code");
+    if (error) {
+      res.end("Login declined. Return to the terminal.");
+      fail(new Error(`OAuth authorization failed: ${error}`));
+    } else if (value) {
+      res.end("Authorization received. Return to the terminal.");
+      accept(value);
+    } else {
+      res.writeHead(400).end("Missing authorization code");
+    }
+  });
+  await new Promise<void>((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => {
+      server.off("error", reject);
+      resolve();
+    });
+  });
+  const address = server.address();
+  if (!address || typeof address === "string") throw new Error("Cannot bind login callback");
+  const timer = setTimeout(
+    () => fail(new Error("Login timed out. Run moloo login again.")),
+    timeout,
+  );
+  return {
+    redirectUri: `http://127.0.0.1:${address.port}/callback`,
+    code,
+    close() {
+      clearTimeout(timer);
+      server.close();
+      server.closeAllConnections();
+    },
+  };
+}
+
+export async function browserLogin(
+  issuer: string,
+  openBrowser: (url: string) => Promise<unknown>,
+  scope = SCOPE,
+) {
+  const verifier = randomBytes(32).toString("base64url");
+  const state = randomBytes(32).toString("base64url");
+  const callback = await loopbackCallback(state);
+  try {
+    const url = new URL(`${issuer}/oauth2/authorize`);
+    url.search = new URLSearchParams({
+      client_id: CLIENT_ID,
+      response_type: "code",
+      scope,
+      redirect_uri: callback.redirectUri,
+      state,
+      code_challenge_method: "S256",
+      code_challenge: createHash("sha256").update(verifier).digest("base64url"),
+    }).toString();
+    const opened = openBrowser(url.href).catch(() => {
+      throw new BrowserUnavailable("Cannot open browser. Use device login.");
+    });
+    // Some desktop launchers stay alive for the browser's lifetime.
+    await Promise.race([opened, callback.code.then(() => undefined)]);
+    return await readTokens(
+      await oauthPost(issuer, "/oauth2/token", {
+        grant_type: "authorization_code",
+        code: await callback.code,
+        code_verifier: verifier,
+        redirect_uri: callback.redirectUri,
+      }),
+    );
+  } finally {
+    callback.close();
+  }
+}
+
+type DeviceCode = {
+  device_code: string;
+  user_code: string;
+  verification_uri: string;
+  expires_in: number;
+  interval?: number;
+};
+export async function pollDevice(
+  issuer: string,
+  device: DeviceCode,
+  wait: (ms: number) => Promise<void> = delay,
+  now = Date.now,
+) {
+  const deadline = now() + device.expires_in * 1000;
+  let interval = Math.max(1, device.interval ?? 5) * 1000;
+  while (now() + interval < deadline) {
+    await wait(interval);
+    const response = await oauthPost(issuer, "/oauth2/token", {
+      grant_type: DEVICE_GRANT,
+      device_code: device.device_code,
+    });
+    if (response.ok) return readTokens(response);
+    const value = (await response.json()) as { error?: string };
+    if (value.error === "slow_down") interval += 5000;
+    else if (value.error !== "authorization_pending")
+      throw new Error(`Device login failed: ${value.error ?? response.status}`);
+  }
+  throw new Error("Device code expired. Run moloo login again.");
+}
+
+export async function deviceLogin(issuer: string, scope = SCOPE) {
+  const response = await oauthPost(issuer, "/device/code", { scope });
+  const device = (await response.json()) as DeviceCode;
+  if (
+    !response.ok ||
+    !device.device_code ||
+    !device.user_code ||
+    !device.verification_uri ||
+    !Number.isFinite(device.expires_in) ||
+    device.expires_in <= 0 ||
+    (device.interval !== undefined && (!Number.isFinite(device.interval) || device.interval <= 0))
+  ) {
+    throw new Error("Cannot request a device code");
+  }
+  console.log(`Open ${device.verification_uri}\nEnter code: ${device.user_code}`);
+  return pollDevice(issuer, device);
+}