nerdsystem 0.0.4 → 0.0.5

package/dist/api.js

@@ -10,7 +10,7 @@ export class ApiClient {
     static fromConfig(opts = {}) {
         const cfg = loadConfig();
         if (opts.requireAuth !== false && !cfg.token) {
-            throw new CliError("Not logged in. Run `nerd login --token nsk_...` (or set NERD_TOKEN).");
+            throw new CliError("Not logged in. Run `nerd login` (or set NERD_TOKEN).");
         }
         return new ApiClient(cfg.apiUrl, cfg.token);
     }

package/dist/commands/doctor.js

@@ -15,7 +15,7 @@ export async function doctor(opts) {
     const gh = await exec("gh", ["auth", "status"], process.cwd());
     checks.push({ name: "GitHub CLI signed in (optional)", ok: gh.code === 0, detail: gh.code === 0 ? "ok" : "not signed in", fix: "Only needed to create repos from the terminal: https://cli.github.com then `gh auth login`." });
     const cfg = loadConfig();
-    checks.push({ name: "nerd login", ok: Boolean(cfg.token), detail: cfg.token ? cfg.apiUrl : "no token saved", fix: "Create a token in the dashboard (API tokens), then `nerd login --token nsk_...`." });
+    checks.push({ name: "nerd login", ok: Boolean(cfg.token), detail: cfg.token ? cfg.apiUrl : "no token saved", fix: "Run `nerd login` and approve the link it prints." });
     let root = null;
     try {
         root = findProjectRoot();

package/dist/commands/init.js

@@ -104,4 +104,4 @@ export async function init(dir, args) {
     log.ok(`Ready. Next:\n  cd ${dir}\n  pnpm install\n  nerd dev\n\nThen open the folder in your coding agent and ask it to build the first feature; the nerdsystem skill walks it through.\nDeploys go to ${project.url}`);
 }
 // Kept in sync with packages/sdk/package.json by the release script.
-const SDK_VERSION = "0.0.4";
+const SDK_VERSION = "0.0.5";

package/dist/commands/login.d.ts

@@ -1,6 +1,14 @@
+/**
+ * `nerd login` with no token starts a device login: prints a link, the person approves it in the
+ * dashboard (or from the email when --email is given), and the token arrives here. `--token` still
+ * works for scripts. A pending login is remembered, so running `nerd login` again after approving
+ * picks it up instead of starting over.
+ */
 export declare function login(args: {
     token?: string;
     "api-url"?: string;
+    email?: string;
+    json?: boolean;
 }): Promise<void>;
 export declare function whoami(opts: {
     json: boolean;

package/dist/commands/login.js

@@ -1,13 +1,76 @@
+import os from "node:os";
 import { ApiClient } from "../api.js";
 import { DEFAULT_API_URL, loadConfig, saveConfig } from "../config.js";
 import { CliError, log, printJson } from "../util.js";
+/** How long one `nerd login` call waits before handing back; agents run commands with short timeouts, so a rerun resumes. */
+const WAIT_S = 90;
+/**
+ * `nerd login` with no token starts a device login: prints a link, the person approves it in the
+ * dashboard (or from the email when --email is given), and the token arrives here. `--token` still
+ * works for scripts. A pending login is remembered, so running `nerd login` again after approving
+ * picks it up instead of starting over.
+ */
 export async function login(args) {
+    const cfg = loadConfig();
+    const apiUrl = (args["api-url"] ?? cfg.apiUrl ?? DEFAULT_API_URL).replace(/\/$/, "");
     const token = args.token ?? process.env.NERD_TOKEN;
-    if (!token)
-        throw new CliError("Pass --token nsk_... (get one from the dashboard or `POST /v1/tokens`).");
-    const apiUrl = (args["api-url"] ?? loadConfig().apiUrl ?? DEFAULT_API_URL).replace(/\/$/, "");
+    if (token)
+        return finish(apiUrl, token, args.json);
+    const anon = new ApiClient(apiUrl, undefined);
+    let pending = cfg.pendingLogin && cfg.pendingLogin.apiUrl === apiUrl && cfg.pendingLogin.expiresAt > Date.now() ? cfg.pendingLogin : undefined;
+    if (!pending) {
+        const client = `nerd CLI on ${os.hostname()} (${os.platform()})`;
+        const start = await anon.post("/session/device", { client, ...(args.email ? { email: args.email } : {}) });
+        pending = { apiUrl, deviceCode: start.deviceCode, userCode: start.userCode, verificationUrl: start.verificationUrl, interval: start.interval, expiresAt: Date.now() + start.expiresIn * 1000 };
+        saveConfig({ ...cfg, pendingLogin: pending });
+        if (args.json)
+            printJson({ status: "pending", userCode: start.userCode, verificationUrl: start.verificationUrl, expiresIn: start.expiresIn });
+        else {
+            log.info(`Open this link in your browser and approve code ${start.userCode}:\n\n  ${start.verificationUrl}\n`);
+            if (args.email)
+                log.info(`An email with the same link went to ${args.email}.`);
+            log.info("Waiting for approval…");
+        }
+    }
+    else if (!args.json) {
+        log.info(`Still waiting for code ${pending.userCode} to be approved at:\n\n  ${pending.verificationUrl}\n`);
+    }
+    const deadline = Math.min(Date.now() + WAIT_S * 1000, pending.expiresAt);
+    while (Date.now() < deadline) {
+        let r;
+        try {
+            r = await anon.post("/session/device/token", { deviceCode: pending.deviceCode });
+        }
+        catch (err) {
+            // 410: expired or already collected. Forget it so the next run starts fresh.
+            clearPending();
+            throw err;
+        }
+        if (r.status === "ok") {
+            clearPending();
+            return finish(apiUrl, r.token, args.json);
+        }
+        await new Promise((res) => setTimeout(res, pending.interval * 1000));
+    }
+    if (pending.expiresAt <= Date.now()) {
+        clearPending();
+        throw new CliError("The login code expired before it was approved. Run `nerd login` again.");
+    }
+    const msg = `Not approved yet. Approve code ${pending.userCode} at ${pending.verificationUrl}, then run \`nerd login\` again to finish.`;
+    if (args.json)
+        printJson({ status: "pending", userCode: pending.userCode, verificationUrl: pending.verificationUrl });
+    else
+        log.warn(msg);
+}
+function clearPending() {
+    const { pendingLogin: _drop, ...rest } = loadConfig();
+    saveConfig(rest);
+}
+async function finish(apiUrl, token, json) {
     const me = await new ApiClient(apiUrl, token).get("/v1/me");
     const file = saveConfig({ apiUrl, token });
+    if (json)
+        return printJson({ status: "ok", apiUrl, user: me.user, file });
     log.ok(`Logged in as ${me.user.email} (${apiUrl}). Saved to ${file}`);
 }
 export async function whoami(opts) {

package/dist/config.d.ts

@@ -1,6 +1,15 @@
 export interface GlobalConfig {
     apiUrl: string;
     token?: string;
+    /** A device login that was started but not yet approved; `nerd login` resumes it. */
+    pendingLogin?: {
+        apiUrl: string;
+        deviceCode: string;
+        userCode: string;
+        verificationUrl: string;
+        interval: number;
+        expiresAt: number;
+    };
 }
 export declare const DEFAULT_API_URL = "https://api.nerdsystem.com";
 export declare function loadConfig(): GlobalConfig;

package/dist/config.js

@@ -12,11 +12,15 @@ export function loadConfig() {
     return {
         apiUrl: process.env.NERD_API_URL ?? file.apiUrl ?? DEFAULT_API_URL,
         ...(process.env.NERD_TOKEN ?? file.token ? { token: process.env.NERD_TOKEN ?? file.token } : {}),
+        ...(file.pendingLogin ? { pendingLogin: file.pendingLogin } : {}),
     };
 }
 export function saveConfig(cfg) {
     const p = configPath();
     mkdirSync(path.dirname(p), { recursive: true, mode: 0o700 });
-    writeFileSync(p, `${JSON.stringify(cfg, null, 2)}\n`, { mode: 0o600 });
+    const out = { ...cfg };
+    if (!out.pendingLogin)
+        delete out.pendingLogin;
+    writeFileSync(p, `${JSON.stringify(out, null, 2)}\n`, { mode: 0o600 });
     return p;
 }

package/dist/index.js

@@ -19,7 +19,7 @@ import { findProjectRoot } from "./project.js";
 import { CliError, log } from "./util.js";
 const HELP = `nerd — deploy apps to nerdsystem
 
-  nerd login --token nsk_...          Save an API token (also: NERD_TOKEN, NERD_API_URL)
+  nerd login [--email you@x.com]      Sign in: prints a link to approve in the browser (or --token nsk_...)
   nerd whoami                         Show the current user and orgs
   nerd doctor                         Check Node, pnpm, git, login, and the project
   nerd init <dir> [--org] [--name] [--describe "what it does"]   Create an app and a project for it
@@ -69,7 +69,7 @@ async function main(argv) {
     const parse = (options, allowPositionals = true) => parseArgs({ args: rest, options: { json: BOOL, ...options }, allowPositionals, strict: cmd !== "dev" });
     switch (cmd) {
         case "login": {
-            const { values } = parse({ token: STR, "api-url": STR });
+            const { values } = parse({ token: STR, "api-url": STR, email: STR });
             return login(values);
         }
         case "doctor": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nerdsystem",
-  "version": "0.0.4",
+  "version": "0.0.5",
   "description": "nerd: deploy apps to nerdsystem from the terminal or a coding agent.",
   "type": "module",
   "bin": {