@secondlayer/cli 21.2.0 → 21.3.0

package/dist/cli.js

@@ -202692,7 +202692,7 @@ var {
 // package.json
 var package_default = {
   name: "@secondlayer/cli",
-  version: "21.2.0",
+  version: "21.3.0",
   description: "Run a Stacks index on your own hardware — set it up, restore verified history, and keep it current.",
   repository: {
     type: "git",
@@ -202732,7 +202732,7 @@ var package_default = {
     "@secondlayer/bundler": "^0.7.1",
     "@secondlayer/scaffold": "^1.6.2",
     "@secondlayer/sdk": "^15.1.0",
-    "@secondlayer/shared": "^13.1.0",
+    "@secondlayer/shared": "^13.7.0",
     "@secondlayer/stacks": "^6.4.0",
     "@secondlayer/subgraphs": "^7.2.0",
     "@secondlayer/verify": "^0.6.0",
@@ -207801,9 +207801,32 @@ function registerWhoamiCommand(program) {
 // src/commands/login.ts
 init_api_url();
 init_http();
+import { hostname } from "node:os";
+import { createInterface } from "node:readline";
+import { confirm as confirm3, input } from "@inquirer/prompts";
+
+// src/lib/open-browser.ts
+import { spawn as spawn3 } from "node:child_process";
+function browserCommand(url, platform = process.platform) {
+  if (platform === "darwin")
+    return { cmd: "open", args: [url] };
+  if (platform === "win32") {
+    return { cmd: "cmd", args: ["/c", "start", "", url] };
+  }
+  return { cmd: "xdg-open", args: [url] };
+}
+function openBrowser(url) {
+  try {
+    const { cmd, args } = browserCommand(url);
+    const child = spawn3(cmd, args, { detached: true, stdio: "ignore" });
+    child.on("error", () => {});
+    child.unref();
+  } catch {}
+}
+
+// src/commands/login.ts
 init_output();
 init_session();
-import { confirm as confirm3, input } from "@inquirer/prompts";
 function sessionExpiry() {
   return new Date(Date.now() + 90 * 24 * 60 * 60 * 1000).toISOString();
 }
@@ -207838,31 +207861,127 @@ async function runTokenLogin(opts) {
   }, target);
   success(`Logged in as ${account.email} (${target})`);
 }
-async function runLoginFlow(options = {}) {
-  const target = loginTarget(options);
-  if (!options.force) {
-    const existing = await readSession(target);
-    if (existing) {
-      info(`Already logged in as ${existing.email} (${target}).`);
-      if (!process.stdin.isTTY) {
-        info(dim("Run 'secondlayer logout' first, or re-run with --force to switch accounts."));
-        return;
-      }
-      try {
-        const proceed = await confirm3({
-          message: "Log in as a different user?",
-          default: false
-        });
-        if (!proceed) {
-          info(dim("Run 'secondlayer logout' to sign out."));
-          return;
+async function shouldContinueLogin(target, options) {
+  if (options.force)
+    return true;
+  const existing = await readSession(target);
+  if (!existing)
+    return true;
+  info(`Already logged in as ${existing.email} (${target}).`);
+  const hint = "Run 'secondlayer logout' first, or re-run with --force to switch accounts.";
+  if (!process.stdin.isTTY) {
+    info(dim(hint));
+    return false;
+  }
+  try {
+    const proceed = await confirm3({
+      message: "Log in as a different user?",
+      default: false
+    });
+    if (!proceed) {
+      info(dim("Run 'secondlayer logout' to sign out."));
+      return false;
+    }
+  } catch {
+    info(dim(hint));
+    return false;
+  }
+  return true;
+}
+async function pollDeviceToken(start, deps) {
+  const deadline = deps.now() + start.expiresIn * 1000;
+  let failures = 0;
+  while (deps.now() < deadline) {
+    await deps.sleep(start.interval * 1000);
+    try {
+      const res = await deps.post("/api/cli/device/token", { deviceCode: start.deviceCode });
+      return { kind: "approved", key: res.key, account: res.account };
+    } catch (err) {
+      if (err instanceof CliHttpError) {
+        if (err.status === 428) {
+          failures = 0;
+          continue;
         }
-      } catch {
-        info(dim("Run 'secondlayer logout' first, or re-run with --force to switch accounts."));
-        return;
+        if (err.status === 403 && err.body.error === "access_denied") {
+          return { kind: "denied" };
+        }
+        if (err.status === 409 && err.body.error === "key_limit") {
+          return { kind: "key_limit" };
+        }
+        if (err.status === 410)
+          return { kind: "expired" };
+        throw err;
       }
+      if (++failures >= 3)
+        throw err;
     }
   }
+  return { kind: "expired" };
+}
+var KEY_LIMIT_MESSAGE = "You have 50 keys. Revoke one under Keys, then run secondlayer login again.";
+function clientName() {
+  return hostname().trim().slice(0, 64) || "this machine";
+}
+async function runDeviceLogin(options = {}) {
+  const target = loginTarget(options);
+  if (!await shouldContinueLogin(target, options))
+    return;
+  let start;
+  try {
+    start = await httpAt(target, "/api/cli/device", {
+      method: "POST",
+      body: { clientName: clientName() }
+    });
+  } catch (err) {
+    error(err instanceof Error ? err.message : String(err));
+    process.exit(1);
+  }
+  info(`First copy your one-time code: ${start.userCode}`);
+  const readline = process.stdin.isTTY ? createInterface({ input: process.stdin }) : null;
+  if (readline) {
+    info("Press Enter to open secondlayer.tools in your browser...");
+    readline.once("line", () => openBrowser(start.verificationUrl));
+  }
+  info(dim(`Or open ${start.verificationUrl}`));
+  info(dim("Waiting for you to approve in the browser..."));
+  let outcome;
+  try {
+    outcome = await pollDeviceToken(start, {
+      post: (path, body) => httpAt(target, path, { method: "POST", body }),
+      sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+      now: Date.now
+    });
+  } catch (err) {
+    readline?.close();
+    error(err instanceof Error ? err.message : String(err));
+    process.exit(1);
+  }
+  readline?.close();
+  if (outcome.kind === "denied") {
+    error("Cancelled in the browser.");
+    process.exit(1);
+  }
+  if (outcome.kind === "key_limit") {
+    error(KEY_LIMIT_MESSAGE);
+    process.exit(1);
+  }
+  if (outcome.kind === "expired") {
+    error("The code expired. Run secondlayer login again.");
+    process.exit(1);
+  }
+  await writeSession({
+    token: outcome.key,
+    email: outcome.account.email,
+    accountId: outcome.account.id,
+    expiresAt: sessionExpiry()
+  }, target);
+  success(`Logged in as ${outcome.account.email} on ${clientName()}`);
+  info(dim("This machine has its own key. Revoke it under Keys."));
+}
+async function runLoginFlow(options = {}) {
+  const target = loginTarget(options);
+  if (!await shouldContinueLogin(target, options))
+    return;
   const email = await input({
     message: "Email",
     validate: (v) => /^.+@.+\..+$/.test(v) ? true : "Invalid email"
@@ -207911,10 +208030,12 @@ async function runLoginFlow(options = {}) {
   }
 }
 function registerLoginCommand(program) {
-  program.command("login").description("Log in to Secondlayer (magic-link email)").option("--force", "Skip the already-logged-in check and re-run the flow").option("--with-token", "Read an API key from stdin (non-interactive)").option("--credits", "Log in to the archive credits account used by bootstrap, repair, and credits").addHelpText("after", `
+  program.command("login").description("Log in to Secondlayer through your browser").option("--force", "Skip the already-logged-in check and re-run the flow").option("--email", "Sign in with an emailed 6-digit code instead of a browser").option("--with-token", "Read an API key from stdin (non-interactive)").option("--credits", "Log in to the archive credits account used by bootstrap, repair, and credits").addHelpText("after", `
 Examples:
+  $ secondlayer login
+  $ secondlayer login --email
   $ secondlayer login --credits
-  $ echo "$SECONDLAYER_API_KEY" | secondlayer login --with-token`).action((opts) => opts.withToken ? runTokenLogin({ credits: opts.credits }) : runLoginFlow({ force: opts.force, credits: opts.credits }));
+  $ echo "$SECONDLAYER_API_KEY" | secondlayer login --with-token`).action((opts) => opts.withToken ? runTokenLogin({ credits: opts.credits }) : opts.email ? runLoginFlow({ force: opts.force, credits: opts.credits }) : runDeviceLogin({ force: opts.force, credits: opts.credits }));
 }
 // src/commands/logout.ts
 init_http();
@@ -208543,5 +208664,5 @@ registerCreditsCommand(program);
 registerArchiveCommand(program);
 program.parse();
 
-//# debugId=FA7A9048A9D4FA1264756E2164756E21
+//# debugId=9552E9D4123BD8E564756E2164756E21
 //# sourceMappingURL=cli.js.map