@pnpm/network.web-auth 1000.0.0 → 1101.0.0

package/lib/index.d.ts

@@ -1,4 +1,5 @@
 export { generateQrCode } from './generateQrCode.js';
 export { pollForWebAuthToken, type PollForWebAuthTokenParams, type WebAuthContext, type WebAuthFetchOptions, type WebAuthFetchResponse, type WebAuthFetchResponseHeaders, } from './pollForWebAuthToken.js';
+export { promptBrowserOpen, type PromptBrowserOpenContext, type PromptBrowserOpenParams, type PromptBrowserOpenReadlineInterface, } from './promptBrowserOpen.js';
 export { WebAuthTimeoutError } from './WebAuthTimeoutError.js';
-export { isOtpError, type OtpContext, type OtpEnquirer, type OtpHandlingParams, OtpNonInteractiveError, type OtpPromptOptions, type OtpPromptResponse, OtpSecondChallengeError, SyntheticOtpError, withOtpHandling, } from './withOtpHandling.js';
+export { isOtpError, type OtpContext, type OtpEnquirer, type OtpHandlingParams, OtpNonInteractiveError, type OtpProcess, type OtpPromptOptions, type OtpPromptResponse, OtpSecondChallengeError, SyntheticOtpError, withOtpHandling, } from './withOtpHandling.js';

package/lib/index.js

@@ -1,5 +1,6 @@
 export { generateQrCode } from './generateQrCode.js';
 export { pollForWebAuthToken, } from './pollForWebAuthToken.js';
+export { promptBrowserOpen, } from './promptBrowserOpen.js';
 export { WebAuthTimeoutError } from './WebAuthTimeoutError.js';
 export { isOtpError, OtpNonInteractiveError, OtpSecondChallengeError, SyntheticOtpError, withOtpHandling, } from './withOtpHandling.js';
 //# sourceMappingURL=index.js.map

package/lib/promptBrowserOpen.d.ts

@@ -0,0 +1,32 @@
+export interface PromptBrowserOpenReadlineInterface {
+    once: (event: string, listener: () => void) => void;
+    close: () => void;
+}
+export interface PromptBrowserOpenContext {
+    createReadlineInterface?: () => PromptBrowserOpenReadlineInterface;
+    globalInfo: (message: string) => void;
+    globalWarn: (message: string) => void;
+    process: {
+        stdin: {
+            isTTY?: boolean;
+        };
+    };
+}
+export interface PromptBrowserOpenParams {
+    authUrl: string;
+    context: PromptBrowserOpenContext;
+    pollPromise: Promise<string>;
+}
+/**
+ * Wraps a token-polling promise with an optional "Press ENTER to open in
+ * browser" prompt.
+ *
+ * While the poll runs in the background, listens for the user pressing Enter
+ * to open the authentication URL in their browser.  When the poll completes
+ * (regardless of whether the user pressed Enter), the keyboard listener is
+ * cleaned up.
+ *
+ * Error-tolerant: failures in the keyboard listener or browser opening are
+ * logged as warnings and do not interrupt the poll.
+ */
+export declare function promptBrowserOpen({ authUrl, context, pollPromise }: PromptBrowserOpenParams): Promise<string>;

package/lib/promptBrowserOpen.js

@@ -0,0 +1,69 @@
+import open from 'open';
+/**
+ * Wraps a token-polling promise with an optional "Press ENTER to open in
+ * browser" prompt.
+ *
+ * While the poll runs in the background, listens for the user pressing Enter
+ * to open the authentication URL in their browser.  When the poll completes
+ * (regardless of whether the user pressed Enter), the keyboard listener is
+ * cleaned up.
+ *
+ * Error-tolerant: failures in the keyboard listener or browser opening are
+ * logged as warnings and do not interrupt the poll.
+ */
+export async function promptBrowserOpen({ authUrl, context, pollPromise, }) {
+    const { createReadlineInterface, globalInfo, globalWarn, process } = context;
+    if (!createReadlineInterface || !process.stdin.isTTY) {
+        return pollPromise;
+    }
+    // The authUrl comes from an untrusted registry response, so only allow
+    // http(s) URLs through to `open()`.
+    let canonicalUrl;
+    try {
+        const parsed = new URL(authUrl);
+        if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+            return pollPromise;
+        }
+        canonicalUrl = parsed.href;
+    }
+    catch {
+        return pollPromise;
+    }
+    let rl;
+    try {
+        rl = createReadlineInterface();
+    }
+    catch (err) {
+        globalWarn(`Could not set up keyboard listener: ${String(err)}`);
+        return pollPromise;
+    }
+    globalInfo('Press ENTER to open the URL in your browser.');
+    rl.once('line', () => {
+        const handleOpenError = (err) => {
+            globalWarn(`Could not open browser automatically: ${String(err)}`);
+            globalInfo('Please open the URL shown above manually.');
+        };
+        try {
+            open(canonicalUrl).catch(handleOpenError);
+        }
+        catch (err) {
+            handleOpenError(err);
+        }
+    });
+    // Only await pollPromise — do NOT await the Enter keypress.
+    //
+    // The Enter listener is a fire-and-forget side effect. Users may authenticate
+    // on their phone (via QR code or pasted URL) without ever pressing Enter, so
+    // the poll must be able to complete independently.
+    //
+    // npm uses Promise.all([opener, poll]) which blocks the entire flow until the
+    // user presses Enter — even if authentication already succeeded on another
+    // device: <https://github.com/npm/npm-profile/blob/d1a48be4/lib/index.js#L85-L98>
+    try {
+        return await pollPromise;
+    }
+    finally {
+        rl.close();
+    }
+}
+//# sourceMappingURL=promptBrowserOpen.js.map

package/lib/withOtpHandling.d.ts

@@ -1,5 +1,6 @@
 import { PnpmError } from '@pnpm/error';
 import type { WebAuthFetchOptions, WebAuthFetchResponse } from './pollForWebAuthToken.js';
+import type { PromptBrowserOpenReadlineInterface } from './promptBrowserOpen.js';
 export interface OtpEnquirer {
     prompt: (options: OtpPromptOptions) => Promise<OtpPromptResponse | undefined>;
 }
@@ -14,16 +15,24 @@ export interface OtpPromptResponse {
 interface OtpDate {
     now: () => number;
 }
+export interface OtpProcess {
+    platform?: NodeJS.Platform;
+    stdin: {
+        isTTY?: boolean;
+    };
+    stdout: {
+        isTTY?: boolean;
+    };
+}
 export interface OtpContext {
     Date: OtpDate;
     setTimeout: (cb: () => void, ms: number) => void;
+    createReadlineInterface?: () => PromptBrowserOpenReadlineInterface;
     enquirer: OtpEnquirer;
     fetch: (url: string, options: WebAuthFetchOptions) => Promise<WebAuthFetchResponse>;
     globalInfo: (message: string) => void;
     globalWarn: (message: string) => void;
-    process: Record<'stdin' | 'stdout', {
-        isTTY?: boolean;
-    }>;
+    process: OtpProcess;
 }
 interface OtpErrorBody {
     authUrl?: string;

package/lib/withOtpHandling.js

@@ -1,6 +1,7 @@
 import { PnpmError } from '@pnpm/error';
 import { generateQrCode } from './generateQrCode.js';
 import { pollForWebAuthToken } from './pollForWebAuthToken.js';
+import { promptBrowserOpen } from './promptBrowserOpen.js';
 export const isOtpError = (error) => error != null &&
     typeof error === 'object' &&
     'code' in error &&
@@ -35,11 +36,16 @@ export async function withOtpHandling({ context, fetchOptions, operation, }) {
         if (error.body?.authUrl && error.body?.doneUrl) {
             const qrCode = generateQrCode(error.body.authUrl);
             globalInfo(`Authenticate your account at:\n${error.body.authUrl}\n\n${qrCode}`);
-            otp = await pollForWebAuthToken({
+            const pollPromise = pollForWebAuthToken({
                 context,
                 doneUrl: error.body.doneUrl,
                 fetchOptions,
             });
+            otp = await promptBrowserOpen({
+                authUrl: error.body.authUrl,
+                context,
+                pollPromise,
+            });
         }
         else {
             const enquirerResponse = await enquirer.prompt({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/network.web-auth",
-  "version": "1000.0.0",
+  "version": "1101.0.0",
   "description": "Web-based authentication flow with QR code display and token polling",
   "keywords": [
     "pnpm",
@@ -25,13 +25,14 @@
     "!*.map"
   ],
   "dependencies": {
+    "open": "^7.4.2",
     "qrcode-terminal": "^0.12.0",
-    "@pnpm/error": "1000.0.5"
+    "@pnpm/error": "1100.0.0"
   },
   "devDependencies": {
     "@jest/globals": "30.3.0",
     "@types/qrcode-terminal": "^0.12.2",
-    "@pnpm/network.web-auth": "1000.0.0"
+    "@pnpm/network.web-auth": "1101.0.0"
   },
   "engines": {
     "node": ">=22.13"