@ricsam/r5dctl 0.0.51 → 0.0.54

package/README.md

@@ -14,9 +14,13 @@ npm install -g @ricsam/r5dctl
 r5dctl auth login
 ```
 
-This starts a device-style flow and opens:
+This starts a device-authorization flow, prints an eight-character code and QR,
+and opens `https://r5d.dev/auth`. Approve the matching device details in the
+browser before the credential is saved.
 
-- `https://r5d.dev/r5dctl/login/<requestId>`
+Use `--no-open` when no host browser is available, `--no-qr` to print only the
+short code, `--device-name <name>` to label the authorized device, and
+`--worker-label <label>` to record the worker it is intended to run.
 
 Credentials are stored in:
 

package/dist/cjs/cli.cjs

@@ -28,6 +28,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var cli_exports = {};
 __export(cli_exports, {
+  advanceTransientDevicePollBackoff: () => advanceTransientDevicePollBackoff,
   collectK8sUsage: () => collectK8sUsage,
   formatK8sCpu: () => formatK8sCpu,
   formatK8sMemory: () => formatK8sMemory,
@@ -36,6 +37,8 @@ __export(cli_exports, {
   getK8sUsageState: () => getK8sUsageState,
   getProjectEnvValue: () => getProjectEnvValue,
   getR5dctlVersion: () => getR5dctlVersion,
+  getTransientDevicePollDelay: () => getTransientDevicePollDelay,
+  handleAuthLogin: () => handleAuthLogin,
   main: () => main,
   parseAnswerFlags: () => parseAnswerFlags,
   parseConversationRenderArgs: () => parseConversationRenderArgs,
@@ -55,6 +58,7 @@ __export(cli_exports, {
   renderConversationOverviewResponse: () => renderConversationOverviewResponse,
   renderConversationResponse: () => renderConversationResponse,
   renderConversationWorkResponse: () => renderConversationWorkResponse,
+  renderDeviceAuthorizationPrompt: () => renderDeviceAuthorizationPrompt,
   renderEnvValues: () => renderEnvValues,
   renderK8sUsageReport: () => renderK8sUsageReport,
   renderProcessHistory: () => renderProcessHistory,
@@ -64,13 +68,16 @@ __export(cli_exports, {
   renderWorkspaceSync: () => renderWorkspaceSync,
   resolveCommandExecution: () => resolveCommandExecution,
   runR5dctlCli: () => runR5dctlCli,
-  summarizeEnvData: () => summarizeEnvData
+  summarizeEnvData: () => summarizeEnvData,
+  writeConfig: () => writeConfig
 });
 module.exports = __toCommonJS(cli_exports);
 var import_node_fs = __toESM(require("node:fs"), 1);
 var import_node_os = __toESM(require("node:os"), 1);
 var import_node_path = __toESM(require("node:path"), 1);
 var import_node_child_process = require("node:child_process");
+var import_node_crypto = require("node:crypto");
+var import_qrcode = __toESM(require("qrcode"), 1);
 var import_promises = require("node:timers/promises");
 var import_dotenv = require("dotenv");
 var import_r5d_api = require("@ricsam/r5d-api");
@@ -105,7 +112,7 @@ const CLI_GLOBAL_OPTION_HELP = [
 const CLI_ONLY_HELP_ENTRIES = [
   {
     section: "auth",
-    usage: "auth login [--no-open]",
+    usage: "auth login [--no-open] [--no-qr] [--device-name <name>] [--worker-label <label>]",
     description: "Start the browser login flow."
   },
   {
@@ -117,7 +124,7 @@ const CLI_ONLY_HELP_ENTRIES = [
 const CLI_ONLY_COMMAND_HELP = [
   {
     path: ["auth", "login"],
-    usage: "auth login [--no-open]"
+    usage: "auth login [--no-open] [--no-qr] [--device-name <name>] [--worker-label <label>]"
   },
   {
     path: ["shell"],
@@ -449,6 +456,21 @@ function parseOptionalFlagValue(args, flag, shortFlag) {
 function hasBooleanFlag(args, flag) {
   return args.includes(flag);
 }
+function assertAuthLoginArgs(args) {
+  const valueFlags = /* @__PURE__ */ new Set(["--device-name", "--worker-label"]);
+  const booleanFlags = /* @__PURE__ */ new Set(["--no-open", "--no-qr"]);
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    if (booleanFlags.has(arg)) continue;
+    if (valueFlags.has(arg)) {
+      if (!args[index + 1]) throw new Error(`Missing value for ${arg}`);
+      index += 1;
+      continue;
+    }
+    if ([...valueFlags].some((flag) => arg.startsWith(`${flag}=`))) continue;
+    throw new Error(`Unknown auth login flag: ${arg}`);
+  }
+}
 function parseGlobalArgs(argv) {
   const options = {
     json: false,
@@ -580,12 +602,27 @@ function serializeConfig(config) {
 function writeConfig(configPath, config) {
   const dir = import_node_path.default.dirname(configPath);
   import_node_fs.default.mkdirSync(dir, { recursive: true, mode: 448 });
+  import_node_fs.default.chmodSync(dir, 448);
   const serialized = serializeConfig(config);
-  import_node_fs.default.writeFileSync(configPath, `${JSON.stringify(serialized, null, 2)}
-`, {
-    mode: 384
-  });
-  import_node_fs.default.chmodSync(configPath, 384);
+  const tempPath = import_node_path.default.join(dir, `.${import_node_path.default.basename(configPath)}.${process.pid}.${(0, import_node_crypto.randomUUID)()}.tmp`);
+  let descriptor;
+  try {
+    descriptor = import_node_fs.default.openSync(tempPath, "wx", 384);
+    import_node_fs.default.writeFileSync(descriptor, `${JSON.stringify(serialized, null, 2)}
+`, "utf8");
+    import_node_fs.default.fsyncSync(descriptor);
+    import_node_fs.default.closeSync(descriptor);
+    descriptor = void 0;
+    import_node_fs.default.renameSync(tempPath, configPath);
+    import_node_fs.default.chmodSync(configPath, 384);
+  } catch (error) {
+    if (descriptor !== void 0) import_node_fs.default.closeSync(descriptor);
+    try {
+      import_node_fs.default.unlinkSync(tempPath);
+    } catch {
+    }
+    throw error;
+  }
 }
 function resolveClientOptions(options, config) {
   return {
@@ -1019,41 +1056,89 @@ function createSavedApiKeyConfig(options, config, apiKey) {
     token: void 0
   };
 }
+function renderDeviceAuthorizationPrompt(input) {
+  const codeBorder = "\u2500".repeat(input.userCode.length + 4);
+  return `Authorize this device at:
+${input.verificationUri}
+
+\u250C${codeBorder}\u2510
+\u2502  ${input.userCode}  \u2502
+\u2514${codeBorder}\u2518
+`;
+}
+function getTransientDevicePollDelay(intervalMs, transientBackoffMs) {
+  return Math.min(3e4, Math.max(intervalMs, transientBackoffMs));
+}
+function advanceTransientDevicePollBackoff(intervalMs, transientBackoffMs) {
+  return {
+    delayMs: getTransientDevicePollDelay(intervalMs, transientBackoffMs),
+    nextBackoffMs: Math.min(3e4, transientBackoffMs * 2)
+  };
+}
 async function handleAuthLogin(client, options, commandArgs, config) {
+  assertAuthLoginArgs(commandArgs);
   const noOpen = hasBooleanFlag(commandArgs, "--no-open");
-  const start = await client.auth.loginStart({
-    baseUrl: options.baseUrl ?? config.baseUrl
-  });
+  const noQr = hasBooleanFlag(commandArgs, "--no-qr");
+  const deviceName = parseOptionalFlagValue(commandArgs, "--device-name") ?? `${import_node_os.default.hostname()} r5dctl`;
+  const workerLabel = parseOptionalFlagValue(commandArgs, "--worker-label");
+  const start = await client.auth.deviceStart({ deviceName, workerLabel });
   if (options.json) {
     writeDataOutput(
       true,
       {
         status: "pending",
         requestId: start.requestId,
-        loginUrl: start.loginUrl,
+        userCode: start.userCode,
+        verificationUri: start.verificationUri,
+        verificationUriComplete: start.verificationUriComplete,
         expiresAt: start.expiresAt,
         intervalMs: start.intervalMs
       },
       ""
     );
   } else {
-    process.stdout.write(`Open this URL to approve login:
-${start.loginUrl}
+    process.stdout.write(renderDeviceAuthorizationPrompt(start));
+    if (!noQr) {
+      process.stdout.write(`
+${await import_qrcode.default.toString(start.verificationUriComplete, { type: "terminal", small: true })}
 `);
+    }
   }
   if (!noOpen) {
     try {
-      await openInBrowser(start.loginUrl);
+      await openInBrowser(start.verificationUriComplete);
     } catch {
     }
   }
   const expiresAtMs = new Date(start.expiresAt).getTime();
   let intervalMs = start.intervalMs;
+  let nextDelayMs = intervalMs;
+  let transientBackoffMs = 1e3;
   while (Date.now() < expiresAtMs) {
-    await (0, import_promises.setTimeout)(intervalMs);
-    const polled = await client.auth.loginPoll(start.requestId, { pollCode: start.pollCode });
+    await (0, import_promises.setTimeout)(Math.min(nextDelayMs, Math.max(0, expiresAtMs - Date.now())));
+    let polled;
+    try {
+      polled = await client.auth.devicePoll(start.requestId, { deviceCode: start.deviceCode });
+    } catch (error) {
+      if (error instanceof import_r5d_api.R5dctlApiError && error.status === 429) {
+        const body = error.body;
+        if (typeof body?.intervalMs === "number") intervalMs = body.intervalMs;
+        nextDelayMs = intervalMs;
+        continue;
+      }
+      const transient = !(error instanceof import_r5d_api.R5dctlApiError) || error.status === 408 || error.status >= 500;
+      if (transient) {
+        const retry = advanceTransientDevicePollBackoff(intervalMs, transientBackoffMs);
+        nextDelayMs = retry.delayMs;
+        transientBackoffMs = retry.nextBackoffMs;
+        continue;
+      }
+      throw error;
+    }
+    transientBackoffMs = 1e3;
     if (polled.status === "pending") {
       intervalMs = polled.intervalMs;
+      nextDelayMs = intervalMs;
       continue;
     }
     if (polled.status === "approved") {
@@ -1078,6 +1163,9 @@ ${start.loginUrl}
     if (polled.status === "expired") {
       throw new Error("Login request expired. Run `r5dctl auth login` again.");
     }
+    if (polled.status === "denied") {
+      throw new Error("Device authorization denied.");
+    }
     if (polled.status === "consumed") {
       throw new Error("Login request was already consumed.");
     }
@@ -2584,6 +2672,7 @@ async function main(argv = process.argv.slice(2)) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  advanceTransientDevicePollBackoff,
   collectK8sUsage,
   formatK8sCpu,
   formatK8sMemory,
@@ -2592,6 +2681,8 @@ async function main(argv = process.argv.slice(2)) {
   getK8sUsageState,
   getProjectEnvValue,
   getR5dctlVersion,
+  getTransientDevicePollDelay,
+  handleAuthLogin,
   main,
   parseAnswerFlags,
   parseConversationRenderArgs,
@@ -2611,6 +2702,7 @@ async function main(argv = process.argv.slice(2)) {
   renderConversationOverviewResponse,
   renderConversationResponse,
   renderConversationWorkResponse,
+  renderDeviceAuthorizationPrompt,
   renderEnvValues,
   renderK8sUsageReport,
   renderProcessHistory,
@@ -2620,5 +2712,6 @@ async function main(argv = process.argv.slice(2)) {
   renderWorkspaceSync,
   resolveCommandExecution,
   runR5dctlCli,
-  summarizeEnvData
+  summarizeEnvData,
+  writeConfig
 });

package/dist/cjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5dctl",
-  "version": "0.0.51",
+  "version": "0.0.54",
   "type": "commonjs"
 }

package/dist/mjs/cli.mjs

@@ -2,6 +2,8 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { spawn } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import QRCode from "qrcode";
 import { setTimeout as sleep } from "node:timers/promises";
 import { parse as parseDotenv } from "dotenv";
 import {
@@ -39,7 +41,7 @@ const CLI_GLOBAL_OPTION_HELP = [
 const CLI_ONLY_HELP_ENTRIES = [
   {
     section: "auth",
-    usage: "auth login [--no-open]",
+    usage: "auth login [--no-open] [--no-qr] [--device-name <name>] [--worker-label <label>]",
     description: "Start the browser login flow."
   },
   {
@@ -51,7 +53,7 @@ const CLI_ONLY_HELP_ENTRIES = [
 const CLI_ONLY_COMMAND_HELP = [
   {
     path: ["auth", "login"],
-    usage: "auth login [--no-open]"
+    usage: "auth login [--no-open] [--no-qr] [--device-name <name>] [--worker-label <label>]"
   },
   {
     path: ["shell"],
@@ -383,6 +385,21 @@ function parseOptionalFlagValue(args, flag, shortFlag) {
 function hasBooleanFlag(args, flag) {
   return args.includes(flag);
 }
+function assertAuthLoginArgs(args) {
+  const valueFlags = /* @__PURE__ */ new Set(["--device-name", "--worker-label"]);
+  const booleanFlags = /* @__PURE__ */ new Set(["--no-open", "--no-qr"]);
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    if (booleanFlags.has(arg)) continue;
+    if (valueFlags.has(arg)) {
+      if (!args[index + 1]) throw new Error(`Missing value for ${arg}`);
+      index += 1;
+      continue;
+    }
+    if ([...valueFlags].some((flag) => arg.startsWith(`${flag}=`))) continue;
+    throw new Error(`Unknown auth login flag: ${arg}`);
+  }
+}
 function parseGlobalArgs(argv) {
   const options = {
     json: false,
@@ -514,12 +531,27 @@ function serializeConfig(config) {
 function writeConfig(configPath, config) {
   const dir = path.dirname(configPath);
   fs.mkdirSync(dir, { recursive: true, mode: 448 });
+  fs.chmodSync(dir, 448);
   const serialized = serializeConfig(config);
-  fs.writeFileSync(configPath, `${JSON.stringify(serialized, null, 2)}
-`, {
-    mode: 384
-  });
-  fs.chmodSync(configPath, 384);
+  const tempPath = path.join(dir, `.${path.basename(configPath)}.${process.pid}.${randomUUID()}.tmp`);
+  let descriptor;
+  try {
+    descriptor = fs.openSync(tempPath, "wx", 384);
+    fs.writeFileSync(descriptor, `${JSON.stringify(serialized, null, 2)}
+`, "utf8");
+    fs.fsyncSync(descriptor);
+    fs.closeSync(descriptor);
+    descriptor = void 0;
+    fs.renameSync(tempPath, configPath);
+    fs.chmodSync(configPath, 384);
+  } catch (error) {
+    if (descriptor !== void 0) fs.closeSync(descriptor);
+    try {
+      fs.unlinkSync(tempPath);
+    } catch {
+    }
+    throw error;
+  }
 }
 function resolveClientOptions(options, config) {
   return {
@@ -953,41 +985,89 @@ function createSavedApiKeyConfig(options, config, apiKey) {
     token: void 0
   };
 }
+function renderDeviceAuthorizationPrompt(input) {
+  const codeBorder = "\u2500".repeat(input.userCode.length + 4);
+  return `Authorize this device at:
+${input.verificationUri}
+
+\u250C${codeBorder}\u2510
+\u2502  ${input.userCode}  \u2502
+\u2514${codeBorder}\u2518
+`;
+}
+function getTransientDevicePollDelay(intervalMs, transientBackoffMs) {
+  return Math.min(3e4, Math.max(intervalMs, transientBackoffMs));
+}
+function advanceTransientDevicePollBackoff(intervalMs, transientBackoffMs) {
+  return {
+    delayMs: getTransientDevicePollDelay(intervalMs, transientBackoffMs),
+    nextBackoffMs: Math.min(3e4, transientBackoffMs * 2)
+  };
+}
 async function handleAuthLogin(client, options, commandArgs, config) {
+  assertAuthLoginArgs(commandArgs);
   const noOpen = hasBooleanFlag(commandArgs, "--no-open");
-  const start = await client.auth.loginStart({
-    baseUrl: options.baseUrl ?? config.baseUrl
-  });
+  const noQr = hasBooleanFlag(commandArgs, "--no-qr");
+  const deviceName = parseOptionalFlagValue(commandArgs, "--device-name") ?? `${os.hostname()} r5dctl`;
+  const workerLabel = parseOptionalFlagValue(commandArgs, "--worker-label");
+  const start = await client.auth.deviceStart({ deviceName, workerLabel });
   if (options.json) {
     writeDataOutput(
       true,
       {
         status: "pending",
         requestId: start.requestId,
-        loginUrl: start.loginUrl,
+        userCode: start.userCode,
+        verificationUri: start.verificationUri,
+        verificationUriComplete: start.verificationUriComplete,
         expiresAt: start.expiresAt,
         intervalMs: start.intervalMs
       },
       ""
     );
   } else {
-    process.stdout.write(`Open this URL to approve login:
-${start.loginUrl}
+    process.stdout.write(renderDeviceAuthorizationPrompt(start));
+    if (!noQr) {
+      process.stdout.write(`
+${await QRCode.toString(start.verificationUriComplete, { type: "terminal", small: true })}
 `);
+    }
   }
   if (!noOpen) {
     try {
-      await openInBrowser(start.loginUrl);
+      await openInBrowser(start.verificationUriComplete);
     } catch {
     }
   }
   const expiresAtMs = new Date(start.expiresAt).getTime();
   let intervalMs = start.intervalMs;
+  let nextDelayMs = intervalMs;
+  let transientBackoffMs = 1e3;
   while (Date.now() < expiresAtMs) {
-    await sleep(intervalMs);
-    const polled = await client.auth.loginPoll(start.requestId, { pollCode: start.pollCode });
+    await sleep(Math.min(nextDelayMs, Math.max(0, expiresAtMs - Date.now())));
+    let polled;
+    try {
+      polled = await client.auth.devicePoll(start.requestId, { deviceCode: start.deviceCode });
+    } catch (error) {
+      if (error instanceof R5dctlApiError && error.status === 429) {
+        const body = error.body;
+        if (typeof body?.intervalMs === "number") intervalMs = body.intervalMs;
+        nextDelayMs = intervalMs;
+        continue;
+      }
+      const transient = !(error instanceof R5dctlApiError) || error.status === 408 || error.status >= 500;
+      if (transient) {
+        const retry = advanceTransientDevicePollBackoff(intervalMs, transientBackoffMs);
+        nextDelayMs = retry.delayMs;
+        transientBackoffMs = retry.nextBackoffMs;
+        continue;
+      }
+      throw error;
+    }
+    transientBackoffMs = 1e3;
     if (polled.status === "pending") {
       intervalMs = polled.intervalMs;
+      nextDelayMs = intervalMs;
       continue;
     }
     if (polled.status === "approved") {
@@ -1012,6 +1092,9 @@ ${start.loginUrl}
     if (polled.status === "expired") {
       throw new Error("Login request expired. Run `r5dctl auth login` again.");
     }
+    if (polled.status === "denied") {
+      throw new Error("Device authorization denied.");
+    }
     if (polled.status === "consumed") {
       throw new Error("Login request was already consumed.");
     }
@@ -2517,6 +2600,7 @@ async function main(argv = process.argv.slice(2)) {
   }
 }
 export {
+  advanceTransientDevicePollBackoff,
   collectK8sUsage,
   formatK8sCpu,
   formatK8sMemory,
@@ -2525,6 +2609,8 @@ export {
   getK8sUsageState,
   getProjectEnvValue,
   getR5dctlVersion,
+  getTransientDevicePollDelay,
+  handleAuthLogin,
   main,
   parseAnswerFlags,
   parseConversationRenderArgs,
@@ -2544,6 +2630,7 @@ export {
   renderConversationOverviewResponse,
   renderConversationResponse,
   renderConversationWorkResponse,
+  renderDeviceAuthorizationPrompt,
   renderEnvValues,
   renderK8sUsageReport,
   renderProcessHistory,
@@ -2553,5 +2640,6 @@ export {
   renderWorkspaceSync,
   resolveCommandExecution,
   runR5dctlCli,
-  summarizeEnvData
+  summarizeEnvData,
+  writeConfig
 };

package/dist/mjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5dctl",
-  "version": "0.0.51",
+  "version": "0.0.54",
   "type": "module"
 }

package/dist/types/cli.d.ts

@@ -40,6 +40,7 @@ export declare function parseGlobalArgs(argv: string[]): {
     options: GlobalOptions;
     rest: string[];
 };
+export declare function writeConfig(configPath: string, config: R5dctlConfig): void;
 export declare function parseAnswerFlags(args: string[]): string[];
 export type SetEnvOptions = {
     assignments: string[];
@@ -72,6 +73,16 @@ export type K8sUsageOptions = {
     window: "24h" | "7d";
 };
 export declare function parseK8sUsageArgs(args: string[]): K8sUsageOptions;
+export declare function renderDeviceAuthorizationPrompt(input: {
+    verificationUri: string;
+    userCode: string;
+}): string;
+export declare function getTransientDevicePollDelay(intervalMs: number, transientBackoffMs: number): number;
+export declare function advanceTransientDevicePollBackoff(intervalMs: number, transientBackoffMs: number): {
+    delayMs: number;
+    nextBackoffMs: number;
+};
+export declare function handleAuthLogin(client: R5dctlClient, options: GlobalOptions, commandArgs: string[], config: R5dctlConfig): Promise<void>;
 export declare function renderWorkspaceStatus(status: R5dctlWorkspaceStatus): string;
 export declare function renderWorkspaceSync(result: R5dctlWorkspaceSyncResult): string;
 export type K8sUsageSummary = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ricsam/r5dctl",
-  "version": "0.0.51",
+  "version": "0.0.54",
   "type": "module",
   "main": "./dist/cjs/cli.cjs",
   "module": "./dist/mjs/cli.mjs",
@@ -26,8 +26,9 @@
     "r5dctl": "dist/cjs/main.cjs"
   },
   "dependencies": {
-    "@ricsam/r5d-api": "^0.0.51",
+    "@ricsam/r5d-api": "^0.0.54",
     "dotenv": "^17",
+    "qrcode": "^1.5.4",
     "ws": "^8.18.3"
   },
   "files": [