@vosjs/cli 0.48.0 → 0.48.1

package/README.md

@@ -270,6 +270,7 @@ Everything that runs on your machine is open source; [vos.so](https://vos.so) is
 
 ```bash
 vos login [--key <k>] [--label <name>] [--no-browser]   # browser sign-in: a code and a vos.so/cli/auth URL, a human approves, the key stores itself
+vos login --handoff https://vos.so/h/<token>           # the setup link a signed-in person's line carries: exchanged once for a key, no click
 vos fetch <vosId|url> [--out <slug>] [--media]         # a program writes config.json + vos.json; a take writes doc.json (+ the recording with --media)
 vos check bright-loop/config.json                      # full local validation
 vos push bright-loop/config.json                       # untracked: create a PRIVATE vos. Tracked (vos.json): add a version to it

package/dist/{chunk-ANKECV7F.js → chunk-RHPRZQRM.js}

@@ -9059,6 +9059,41 @@ async function browserLogin(origin, r, opts) {
     "no approval within 15 minutes \u2014 run `vos login` again, or mint a key at https://vos.so/app/api and pass --key"
   );
 }
+var HANDOFF_URL = /^(https?:\/\/[^/]+)\/h\/(vos_ho_[A-Za-z0-9_-]+)$/;
+function parseHandoffUrl(url) {
+  const m = HANDOFF_URL.exec(url.trim());
+  return m ? { origin: m[1], token: m[2] } : null;
+}
+async function handoffLogin(url, r, opts = {}) {
+  const parsed = parseHandoffUrl(url);
+  if (!parsed)
+    throw new Error(
+      "--handoff wants the link a person copied from vos.so, https://vos.so/h/vos_ho_\u2026"
+    );
+  r.log(`exchanging the setup link at ${parsed.origin}\u2026`);
+  const res = await apiJson(parsed.origin, "/api/cli/login/exchange", {
+    method: "POST",
+    body: { token: parsed.token, hostname: hostname().slice(0, 64) }
+  });
+  if (res.status === 200 && res.body.status === "ok") {
+    const path = (opts.store ?? writeCredential)(res.body.key);
+    const user = typeof res.body.user === "object" && res.body.user !== null ? res.body.user.name ?? "" : "";
+    return {
+      path,
+      user,
+      keyName: String(res.body.keyName ?? ""),
+      origin: parsed.origin
+    };
+  }
+  if (res.status === 404 && !res.body.status) {
+    throw new Error(
+      `${parsed.origin} does not support setup links yet \u2014 run \`vos login\` instead`
+    );
+  }
+  const said = typeof res.body.error === "string" ? res.body.error : apiError("exchange", res);
+  const hint = typeof res.body.hint === "string" ? ` ${res.body.hint}` : "";
+  throw new Error(`${said}${hint}`);
+}
 
 // src/plugin/program.ts
 var BOOLEAN_FLAGS2 = /* @__PURE__ */ new Set([
@@ -9605,6 +9640,21 @@ async function cmdLogin(argv) {
     origin: strFlag(flags, "origin"),
     api: strFlag(flags, "api")
   });
+  const handoffUrl = strFlag(flags, "handoff");
+  if (handoffUrl) {
+    const done = await handoffLogin(handoffUrl, r);
+    r.done(
+      {
+        path: done.path,
+        origin: done.origin,
+        user: done.user,
+        keyName: done.keyName,
+        next_step: "the link is spent; vos push when you want the work hosted"
+      },
+      `Signed in${done.user ? ` as ${done.user}` : ""} \u2014 key "${done.keyName}" stored at ${done.path} (used by every vos platform verb). The link is spent.`
+    );
+    return EXIT_OK;
+  }
   const explicit = strFlag(flags, "key") ?? process.env.VOS_API_KEY?.trim();
   if (explicit) return storeKey(explicit, origin, r);
   try {
@@ -11381,10 +11431,12 @@ This machine (no account)
             remove ~/.config/vos/credentials (VOS_API_KEY still resolves)
 
 Platform (vos.so) \u2014 fetch, edit, push, pull, repeat
-  vos login [--key <vos_sk_\u2026>] [--label <name>] [--no-browser]
+  vos login [--key <vos_sk_\u2026>] [--handoff <url>] [--label <name>] [--no-browser]
             sign in via the browser (approve at vos.so/cli/auth; works
             headless \u2014 print the URL, a human approves, the key stores
-            itself). --key skips the browser (mint at vos.so/app/api)
+            itself). --key skips the browser (mint at vos.so/app/api).
+            --handoff https://vos.so/h/\u2026 exchanges the setup link a
+            signed-in person's line carries for a key, once, no click
   vos fetch <vosId|watch-url> [--out dir] [--media] [--json]
             writes config.json + vos.json (no auth needed for public programs);
             a take vos also gets its doc.json, and --media its footage
@@ -13274,4 +13326,4 @@ export {
   verbHelp,
   run
 };
-//# sourceMappingURL=chunk-ANKECV7F.js.map
+//# sourceMappingURL=chunk-RHPRZQRM.js.map