@valbuild/cli 0.113.0 → 0.115.0

package/cli/dist/valbuild-cli-cli.cjs.dev.js

@@ -1069,18 +1069,20 @@ function tryGetGitConfig(root) {
  * Terminal wrapper around the login device flow in `@valbuild/server`.
  * The flow itself (polling, token persistence) is shared with
  * `@valbuild/language-server`.
+ *
+ * The user code is printed and the device code is not: the code on screen is
+ * the one to compare against the browser, and it cannot be used to collect a
+ * token on its own.
  */
 async function login(options) {
   try {
     console.log(pc__default["default"].cyan("\nStarting login process...\n"));
-    const {
-      nonce,
-      url
-    } = await server.startValLogin();
-    console.log(pc__default["default"].green("Open the following URL in your browser to log in:"));
-    console.log(pc__default["default"].underline(pc__default["default"].blue(url)));
-    console.log(pc__default["default"].dim("\nWaiting for login confirmation...\n"));
-    const result = await server.awaitValLoginConfirmation(nonce);
+    const authorization = await server.startValLogin();
+    console.log(pc__default["default"].green("Open this URL in your browser to approve the login:"));
+    console.log(pc__default["default"].underline(pc__default["default"].blue(authorization.verificationUriComplete)));
+    console.log(`\nThen check that it shows this code: ${pc__default["default"].bold(pc__default["default"].cyan(authorization.userCode))}`);
+    console.log(pc__default["default"].dim("\nApprove the login in the browser. Waiting for confirmation...\n"));
+    const result = await server.awaitValLoginConfirmation(authorization);
     const filePath = server.persistPersonalAccessToken(options.root || process.cwd(), result);
     console.log(pc__default["default"].green(`Token for ${pc__default["default"].cyan(result.profile.email)} saved to ${pc__default["default"].cyan(filePath)}`));
   } catch (error) {

package/cli/dist/valbuild-cli-cli.cjs.prod.js

@@ -1069,18 +1069,20 @@ function tryGetGitConfig(root) {
  * Terminal wrapper around the login device flow in `@valbuild/server`.
  * The flow itself (polling, token persistence) is shared with
  * `@valbuild/language-server`.
+ *
+ * The user code is printed and the device code is not: the code on screen is
+ * the one to compare against the browser, and it cannot be used to collect a
+ * token on its own.
  */
 async function login(options) {
   try {
     console.log(pc__default["default"].cyan("\nStarting login process...\n"));
-    const {
-      nonce,
-      url
-    } = await server.startValLogin();
-    console.log(pc__default["default"].green("Open the following URL in your browser to log in:"));
-    console.log(pc__default["default"].underline(pc__default["default"].blue(url)));
-    console.log(pc__default["default"].dim("\nWaiting for login confirmation...\n"));
-    const result = await server.awaitValLoginConfirmation(nonce);
+    const authorization = await server.startValLogin();
+    console.log(pc__default["default"].green("Open this URL in your browser to approve the login:"));
+    console.log(pc__default["default"].underline(pc__default["default"].blue(authorization.verificationUriComplete)));
+    console.log(`\nThen check that it shows this code: ${pc__default["default"].bold(pc__default["default"].cyan(authorization.userCode))}`);
+    console.log(pc__default["default"].dim("\nApprove the login in the browser. Waiting for confirmation...\n"));
+    const result = await server.awaitValLoginConfirmation(authorization);
     const filePath = server.persistPersonalAccessToken(options.root || process.cwd(), result);
     console.log(pc__default["default"].green(`Token for ${pc__default["default"].cyan(result.profile.email)} saved to ${pc__default["default"].cyan(filePath)}`));
   } catch (error) {

package/cli/dist/valbuild-cli-cli.esm.js

@@ -1037,18 +1037,20 @@ function tryGetGitConfig(root) {
  * Terminal wrapper around the login device flow in `@valbuild/server`.
  * The flow itself (polling, token persistence) is shared with
  * `@valbuild/language-server`.
+ *
+ * The user code is printed and the device code is not: the code on screen is
+ * the one to compare against the browser, and it cannot be used to collect a
+ * token on its own.
  */
 async function login(options) {
   try {
     console.log(pc.cyan("\nStarting login process...\n"));
-    const {
-      nonce,
-      url
-    } = await startValLogin();
-    console.log(pc.green("Open the following URL in your browser to log in:"));
-    console.log(pc.underline(pc.blue(url)));
-    console.log(pc.dim("\nWaiting for login confirmation...\n"));
-    const result = await awaitValLoginConfirmation(nonce);
+    const authorization = await startValLogin();
+    console.log(pc.green("Open this URL in your browser to approve the login:"));
+    console.log(pc.underline(pc.blue(authorization.verificationUriComplete)));
+    console.log(`\nThen check that it shows this code: ${pc.bold(pc.cyan(authorization.userCode))}`);
+    console.log(pc.dim("\nApprove the login in the browser. Waiting for confirmation...\n"));
+    const result = await awaitValLoginConfirmation(authorization);
     const filePath = persistPersonalAccessToken(options.root || process.cwd(), result);
     console.log(pc.green(`Token for ${pc.cyan(result.profile.email)} saved to ${pc.cyan(filePath)}`));
   } catch (error) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@valbuild/cli",
   "private": false,
-  "version": "0.113.0",
+  "version": "0.115.0",
   "description": "Val CLI tools",
   "repository": {
     "type": "git",
@@ -24,11 +24,11 @@
     "jszip": "^3.10.1",
     "meow": "^9.0.0",
     "picocolors": "^1.1.1",
-    "@valbuild/core": "0.111.0",
-    "@valbuild/language-server": "0.113.0",
     "@valbuild/eslint-plugin": "0.108.0",
-    "@valbuild/server": "0.113.0",
-    "@valbuild/shared": "0.113.0"
+    "@valbuild/server": "0.115.0",
+    "@valbuild/shared": "0.114.0",
+    "@valbuild/language-server": "0.115.0",
+    "@valbuild/core": "0.111.0"
   },
   "peerDependencies": {
     "prettier": "*",

package/src/login.ts

@@ -10,18 +10,33 @@ import {
  * Terminal wrapper around the login device flow in `@valbuild/server`.
  * The flow itself (polling, token persistence) is shared with
  * `@valbuild/language-server`.
+ *
+ * The user code is printed and the device code is not: the code on screen is
+ * the one to compare against the browser, and it cannot be used to collect a
+ * token on its own.
  */
 export async function login(options: { root?: string }) {
   try {
     console.log(pc.cyan("\nStarting login process...\n"));
 
-    const { nonce, url } = await startValLogin();
+    const authorization = await startValLogin();
 
-    console.log(pc.green("Open the following URL in your browser to log in:"));
-    console.log(pc.underline(pc.blue(url)));
-    console.log(pc.dim("\nWaiting for login confirmation...\n"));
+    console.log(
+      pc.green("Open this URL in your browser to approve the login:"),
+    );
+    console.log(pc.underline(pc.blue(authorization.verificationUriComplete)));
+    console.log(
+      `\nThen check that it shows this code: ${pc.bold(
+        pc.cyan(authorization.userCode),
+      )}`,
+    );
+    console.log(
+      pc.dim(
+        "\nApprove the login in the browser. Waiting for confirmation...\n",
+      ),
+    );
 
-    const result = await awaitValLoginConfirmation(nonce);
+    const result = await awaitValLoginConfirmation(authorization);
 
     const filePath = persistPersonalAccessToken(
       options.root || process.cwd(),