acuvo-code 0.3.0 → 0.3.2

package/lib/device-login.mjs

@@ -149,3 +149,60 @@ export function openBrowser(url, { platform = process.platform, spawn } = {}) {
     return false;
   }
 }
+
+/**
+ * ── ⭐⭐⭐ ONE LOGIN FLOW, TWO DOORS ─────────────────────────────────────────
+ *
+ * Drives the whole grant: ask for a code, show it, open a browser, wait, save.
+ * Reached from `acuvo --login` AND from a bare `acuvo` that finds no
+ * credential — the second of which is what makes typing `acuvo` enough, the
+ * way typing `claude` is.
+ *
+ * ⚠️ IT LIVES HERE, NOT IN `bin/`. The first version was written inline inside
+ * the `--login` branch and was needed by a second caller within the hour. A fix
+ * that lives inside one caller is a fix for one caller — this codebase has paid
+ * for that three times today alone. Extracted before the second copy existed
+ * rather than after.
+ *
+ * ⚠️ IT THROWS RATHER THAN EXITING. `bin/` owns exit codes and phrasing; a
+ * library that calls `process.exit` cannot be tested and cannot be reused.
+ *
+ * @returns {Promise<{token: string, restricted: boolean|null, userCode: string}>}
+ */
+export async function runDeviceLogin({
+  gatewayUrl,
+  write = (s) => process.stderr.write(s),
+  spawn,
+  requestCode = requestDeviceCode,
+  poll = pollForKey,
+  open = openBrowser,
+  saveAccount,
+} = {}) {
+  const start = await requestCode(gatewayUrl);
+  const url = start.verification_uri_complete || start.verification_uri;
+
+  /**
+   * ⚠️ THE URL AND CODE ARE PRINTED WHETHER OR NOT THE BROWSER OPENS. This runs
+   * over SSH, in containers, and in terminals with no desktop session, where
+   * opening a browser is impossible by definition — a flow that assumes the
+   * open worked strands every remote user.
+   */
+  write(`\nYour code:  ${start.user_code}\n\n`);
+  const opened = open(url, { spawn });
+  write(opened
+    ? `Opened your browser to approve it. If nothing appeared:\n  ${url}\n\n`
+    : `Open this to approve it:\n  ${url}\n\n`);
+  write('Waiting for approval… (Ctrl-C to cancel)\n');
+
+  const granted = await poll(gatewayUrl, start.device_code, {
+    intervalMs: (start.interval ?? 2) * 1000,
+    expiresInMs: (start.expires_in ?? 600) * 1000,
+  });
+
+  const saved = saveAccount ? saveAccount(granted.api_key) : null;
+  return {
+    token: granted.api_key,
+    restricted: saved && typeof saved.restricted === 'boolean' ? saved.restricted : null,
+    userCode: start.user_code,
+  };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "acuvo-code",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "Acuvo Code — the terminal client for the Acuvo capability registry. Zero dependencies, by design.",
   "type": "module",
   "bin": {