@fluid-app/fluid-cli 0.1.63 → 0.1.65

package/dist/bin/fluid.mjs

@@ -1,14 +1,15 @@
 #!/usr/bin/env node
-import { F as walkCommands, M as rootCommand, N as visibleOptions, P as visibleSubcommands, _ as validateToken, a as readConfig, c as getConfigDir, d as FLUID_API_ERROR, f as confirmMfa, g as switchCompany, h as sendMfa, j as filterCatalog, m as getFluidApiBase, n as getAuthToken, o as updateConfig, p as fetchUserCompanies, s as writeConfig, t as getActiveProfile } from "../token-6SEVoGMw.mjs";
+import { F as walkCommands, M as rootCommand, N as visibleOptions, P as visibleSubcommands, _ as validateToken, a as readConfig, d as FLUID_API_ERROR, f as confirmMfa, g as switchCompany, h as sendMfa, j as filterCatalog, l as getConfigDir, m as getFluidApiBase, n as getAuthToken, o as updateConfig, p as fetchUserCompanies, s as writeConfig, t as getActiveProfile } from "../token-DnFYT9pe.mjs";
 import { createRequire } from "node:module";
-import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { Argument, Command, Option } from "commander";
+import { text } from "node:stream/consumers";
 import chalk from "chalk";
 import prompts from "prompts";
 import ora from "ora";
+import { createHash, randomBytes } from "node:crypto";
 import { dirname, join, sep } from "node:path";
-import { randomBytes } from "node:crypto";
 import { spawn } from "node:child_process";
 //#region src/commands/commands.ts
 /**
@@ -244,6 +245,93 @@ const completeCommand = new Command("__complete").description("Print completions
 	process.stdout.write(formatCandidates(completeWords(rootCommand(command), typed), opts.shell));
 });
 //#endregion
+//#region src/auth/pending-login.ts
+/**
+* Email sign-ins started with `fluid login --send-code` and not finished yet.
+*
+* The send and finish steps run as separate processes, and the finish step
+* needs the server's id for the sign-in (`uuid`), which only the send step
+* saw. Keeping it here means an agent carries the emailed code alone. The
+* uuid cannot sign anyone in without that code.
+*
+* One record per address, so a new send replaces the last one. Records live
+* under the config dir (`~/.fluid/pending-logins/`), each named by a hash of
+* the address so the file names do not list who is signing in.
+*/
+const STALE_AFTER_MS = 3600 * 1e3;
+/** The server compares addresses trimmed and lowercased; so does the store. */
+function normaliseEmail(email) {
+	return email.trim().toLowerCase();
+}
+function fileName(email) {
+	return `${createHash("sha256").update(normaliseEmail(email)).digest("hex")}.json`;
+}
+function isPendingLogin(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const record = value;
+	return typeof record["uuid"] === "string" && typeof record["email"] === "string" && typeof record["shop"] === "string" && typeof record["expiresAt"] === "string" && typeof record["baseUrl"] === "string";
+}
+function readRecord(path) {
+	try {
+		const parsed = JSON.parse(readFileSync(path, "utf8"));
+		return isPendingLogin(parsed) ? parsed : null;
+	} catch {
+		return null;
+	}
+}
+function removeStale(dir, now) {
+	let names;
+	try {
+		names = readdirSync(dir);
+	} catch {
+		return;
+	}
+	for (const name of names) {
+		if (!name.endsWith(".json")) continue;
+		const path = join(dir, name);
+		const record = readRecord(path);
+		const expiresAt = record ? Date.parse(record.expiresAt) : NaN;
+		if (!record || !(expiresAt + STALE_AFTER_MS > now)) rmSync(path, { force: true });
+	}
+}
+/**
+* The store, in `dir` or by default `<config dir>/pending-logins`, resolved
+* on each call so a changed `FLUID_CONFIG_DIR` is honoured.
+*/
+function createPendingLoginStore(dir) {
+	const storeDir = () => dir ?? join(getConfigDir(), "pending-logins");
+	return {
+		save(record) {
+			const base = storeDir();
+			mkdirSync(base, {
+				recursive: true,
+				mode: 448
+			});
+			removeStale(base, Date.now());
+			const tmpPath = join(base, `.pending-${randomBytes(6).toString("hex")}.tmp`);
+			try {
+				writeFileSync(tmpPath, JSON.stringify(record, null, 2) + "\n", {
+					encoding: "utf8",
+					mode: 384
+				});
+				renameSync(tmpPath, join(base, fileName(record.email)));
+			} catch (err) {
+				try {
+					unlinkSync(tmpPath);
+				} catch {}
+				throw err;
+			}
+		},
+		load(email) {
+			const record = readRecord(join(storeDir(), fileName(email)));
+			return record && record.email === normaliseEmail(email) ? record : null;
+		},
+		remove(email) {
+			rmSync(join(storeDir(), fileName(email)), { force: true });
+		}
+	};
+}
+//#endregion
 //#region src/auth/profiles.ts
 function createFluidProfile({ name, token, companyName, baseUrl, storedAt }) {
 	return {
@@ -258,19 +346,110 @@ function createFluidProfile({ name, token, companyName, baseUrl, storedAt }) {
 //#region src/commands/login.ts
 /**
 * fluid login — authenticate via email MFA or API token
+*
+* Besides the interactive sign-in, an email sign-in can run in two steps
+* with no terminal, for an agent: `--send-code` emails the code and saves
+* the server's sign-in id (auth/pending-login.ts), then `--code` redeems
+* it. `--send-code` requires `--shop`, which ties the code to one company:
+* only such a code lets an admin's sign-in confirm a new signup.
+*/
+const defaultLoginDeps = {
+	api: {
+		validateToken,
+		sendMfa,
+		confirmMfa
+	},
+	prompt: (question) => prompts(question),
+	spinner: (text) => ora(text).start(),
+	log: (line) => console.log(line),
+	err: (line) => console.error(line),
+	env: process.env,
+	isInteractive: () => Boolean(process.stdin.isTTY),
+	readStdin: () => text(process.stdin),
+	pending: createPendingLoginStore()
+};
+const SILENT_SPINNER = {
+	succeed: () => {},
+	fail: () => {}
+};
+const TWO_STEP_HINT = "Sign in in two steps instead:\n  fluid login --send-code --email <email> --shop <shop>\n  fluid login --code --email <email> --yes\nwith the emailed code in FLUID_LOGIN_CODE (or --code - to read it from stdin). --yes replaces a profile with the company's name; --name <profile> picks another. Or set FLUID_TOKEN.";
+function createUi(json, deps) {
+	return {
+		json,
+		spinner: (text) => json ? SILENT_SPINNER : deps.spinner(text),
+		result: (payload) => {
+			if (json) deps.log(JSON.stringify(payload, null, 2));
+		},
+		fail: (error, spinner) => {
+			if (json) {
+				deps.log(JSON.stringify({
+					status: "error",
+					code: error.code,
+					message: error.message,
+					...error.details ? { details: error.details } : {}
+				}, null, 2));
+				return 1;
+			}
+			if (spinner) spinner.fail(chalk.red(error.message));
+			else deps.log(chalk.red(error.message));
+			if (error.details) deps.log(chalk.dim(error.details));
+			return 1;
+		}
+	};
+}
+/** The shop option for an API call, or no argument at all without one. */
+function shopArgs(shop) {
+	return shop ? [{ fluidShop: shop }] : [];
+}
+/** The part of a shop the server matches on: "acme" in "acme.fluid.app". */
+function shopLabel(shop) {
+	return (shop.trim().toLowerCase().split(".")[0] ?? "").trim();
+}
+function findByShop(companies, shop) {
+	return companies.find((c) => shopLabel(c.shopName) === shopLabel(shop));
+}
+/**
+* Whether the entry's token is an admin or rep session, the only kind the
+* CLI's commands accept. A shopper's code returns a "member" or "customer"
+* token instead. The server types every entry, so one with no type is
+* refused rather than stored.
 */
-async function confirmOverwrite(profileName) {
+function isStaffSession(company) {
+	return company.authType === "rep";
+}
+function shopperSession(email, company) {
+	return {
+		code: "SHOPPER_SESSION",
+		message: `${email} does not sign in at ${company.shopName} as an admin or rep, so it cannot sign in to the CLI.`
+	};
+}
+/**
+* What to do about profile `profileName` before writing it: replace it when
+* it is new or with `--yes`, ask in a terminal, and refuse otherwise, since
+* no one could answer the question.
+*/
+function overwriteRule(profileName, opts) {
+	if (!readConfig().profiles[profileName] || opts.yes) return "replace";
+	return opts.interactive ? "ask" : "refuse";
+}
+async function overwriteDecision(profileName, opts, deps) {
+	const rule = overwriteRule(profileName, opts);
+	if (rule !== "ask") return rule;
 	const existing = readConfig().profiles[profileName];
-	if (!existing) return true;
-	const response = await prompts({
+	return (await deps.prompt({
 		type: "confirm",
 		name: "overwrite",
-		message: `Profile "${profileName}" already exists (${existing.companyName}). Overwrite?`,
+		message: `Profile "${profileName}" already exists (${existing?.companyName}). Overwrite?`,
 		initial: false
-	});
-	return Boolean(response["overwrite"]);
+	}))["overwrite"] ? "replace" : "keep";
+}
+function profileExists(profileName, codeUsed) {
+	return {
+		code: "PROFILE_EXISTS",
+		message: `Profile "${profileName}" already exists. Pass --yes to replace it` + (codeUsed ? "; the code is used, so send a new one first." : ".")
+	};
 }
-function storeProfile(profileName, token, companyName) {
+function storeProfile(profileName, token, companyName, baseUrl = getFluidApiBase()) {
 	updateConfig((config) => ({
 		...config,
 		activeProfile: profileName,
@@ -280,77 +459,76 @@ function storeProfile(profileName, token, companyName) {
 				name: profileName,
 				token,
 				companyName,
-				baseUrl: getFluidApiBase()
+				baseUrl
 			})
 		}
 	}));
 }
-async function loginWithToken(token, profileName) {
-	const spinner = ora("Validating token...").start();
-	const result = await validateToken(token);
-	if (!result.success) {
-		spinner.fail(chalk.red(result.error.message));
-		if (result.error.details) console.log(chalk.dim(result.error.details));
-		process.exitCode = 1;
-		return;
-	}
-	const name = profileName ?? result.value.name;
+function loggedIn(ui, deps, profileName, company) {
+	ui.result({
+		status: "signed_in",
+		profile: profileName,
+		company
+	});
+	if (!ui.json) deps.log(chalk.green(`Logged in as ${chalk.bold(company.name)} (profile: ${chalk.bold(profileName)})`));
+	return 0;
+}
+function cancelled(deps) {
+	deps.log(chalk.yellow("Login cancelled — existing profile not overwritten."));
+	return 0;
+}
+async function loginWithToken(token, opts, interactive, ui, deps) {
+	const spinner = ui.spinner("Validating token...");
+	const result = await deps.api.validateToken(token);
+	if (!result.success) return ui.fail(result.error, spinner);
+	const name = opts.name ?? result.value.name;
 	spinner.succeed(chalk.green(`Token valid — ${chalk.bold(result.value.name)}`));
-	if (!await confirmOverwrite(name)) {
-		console.log(chalk.yellow("Login cancelled — existing profile not overwritten."));
-		return;
-	}
+	const decision = await overwriteDecision(name, {
+		yes: Boolean(opts.yes),
+		interactive
+	}, deps);
+	if (decision === "refuse") return ui.fail(profileExists(name, false));
+	if (decision === "keep") return cancelled(deps);
 	storeProfile(name, token, result.value.name);
-	console.log(chalk.green(`Logged in as ${chalk.bold(result.value.name)} (profile: ${chalk.bold(name)})`));
+	return loggedIn(ui, deps, name, { name: result.value.name });
 }
-async function loginWithEmail(initialEmail, profileName) {
-	let email = initialEmail;
+async function loginWithEmail(opts, ui, deps) {
+	let email = opts.email;
 	if (!email) {
-		email = (await prompts({
+		email = (await deps.prompt({
 			type: "text",
 			name: "email",
 			message: "Enter your email"
 		}))["email"];
 		if (!email) {
-			console.log(chalk.red("No email provided. Aborting."));
-			process.exitCode = 1;
-			return;
+			deps.log(chalk.red("No email provided. Aborting."));
+			return 1;
 		}
 	}
-	const sendSpinner = ora("Sending verification code...").start();
-	const sendResult = await sendMfa(email);
-	if (!sendResult.success) {
-		sendSpinner.fail(chalk.red(sendResult.error.message));
-		if (sendResult.error.details) console.log(chalk.dim(sendResult.error.details));
-		process.exitCode = 1;
-		return;
-	}
-	const expiresInMs = new Date(sendResult.value.expiresAt).getTime() - Date.now();
-	const expiresInMin = Math.round(expiresInMs / 1e3 / 60);
-	const expiryNote = expiresInMin > 0 ? `expires in ~${expiresInMin} min` : "code may expire soon — check your email quickly";
-	sendSpinner.succeed(`Verification code sent — check your email (${expiryNote})`);
+	const sendSpinner = ui.spinner("Sending verification code...");
+	const sendResult = await deps.api.sendMfa(email, ...shopArgs(opts.shop));
+	if (!sendResult.success) return ui.fail(sendResult.error, sendSpinner);
+	sendSpinner.succeed(`Verification code sent — check your email (${expiryNote(sendResult.value.expiresAt)})`);
 	const MAX_CODE_ATTEMPTS = 3;
 	let confirmResult;
 	for (let attempt = 1; attempt <= MAX_CODE_ATTEMPTS; attempt++) {
-		const code = (await prompts({
+		const code = (await deps.prompt({
 			type: "text",
 			name: "code",
 			message: "Enter the 6-digit code"
 		}))["code"];
 		if (!code) {
-			console.log(chalk.red("No code provided. Aborting."));
-			process.exitCode = 1;
-			return;
+			deps.log(chalk.red("No code provided. Aborting."));
+			return 1;
 		}
 		if (!/^\d{6}$/.test(code)) {
-			console.log(chalk.red("Code must be exactly 6 digits."));
+			deps.log(chalk.red("Code must be exactly 6 digits."));
 			if (attempt < MAX_CODE_ATTEMPTS) continue;
-			console.log(chalk.red("Too many invalid attempts. Aborting."));
-			process.exitCode = 1;
-			return;
+			deps.log(chalk.red("Too many invalid attempts. Aborting."));
+			return 1;
 		}
-		const confirmSpinner = ora("Verifying code...").start();
-		confirmResult = await confirmMfa(sendResult.value.uuid, code);
+		const confirmSpinner = ui.spinner("Verifying code...");
+		confirmResult = await deps.api.confirmMfa(sendResult.value.uuid, code, ...shopArgs(opts.shop));
 		if (confirmResult.success) {
 			confirmSpinner.succeed("Verified");
 			break;
@@ -359,66 +537,256 @@ async function loginWithEmail(initialEmail, profileName) {
 			confirmSpinner.fail(chalk.red(`${confirmResult.error.message} (attempt ${attempt}/${MAX_CODE_ATTEMPTS})`));
 			continue;
 		}
-		confirmSpinner.fail(chalk.red(confirmResult.error.message));
-		if (confirmResult.error.details) console.log(chalk.dim(confirmResult.error.details));
-		process.exitCode = 1;
-		return;
+		return ui.fail(confirmResult.error, confirmSpinner);
 	}
-	if (!confirmResult?.success) return;
+	if (!confirmResult?.success) return 0;
 	const { companies } = confirmResult.value;
 	if (companies.length === 0) {
-		console.log(chalk.red("No companies found for this account."));
-		process.exitCode = 1;
-		return;
+		deps.log(chalk.red("No companies found for this account."));
+		return 1;
 	}
+	const named = opts.shop ? findByShop(companies, opts.shop) : void 0;
 	let selected;
-	if (companies.length === 1) {
+	if (named) selected = named;
+	else if (companies.length === 1) {
 		const first = companies[0];
 		if (!first) {
-			console.log(chalk.red("No companies found for this account."));
-			process.exitCode = 1;
-			return;
+			deps.log(chalk.red("No companies found for this account."));
+			return 1;
 		}
 		selected = first;
 	} else {
-		const companyId = (await prompts({
+		const companyChoices = companies.map((c) => ({
+			title: `${c.name} (${c.shopName})`,
+			value: c.id
+		}));
+		const companyId = (await deps.prompt({
 			type: "autocomplete",
 			name: "companyId",
 			message: "Select a company (type to search)",
-			choices: companies.map((c) => ({
-				title: `${c.name} (${c.shopName})`,
-				value: c.id
-			})),
+			choices: companyChoices,
 			suggest: (input, choices) => Promise.resolve(input ? choices.filter((c) => c.title.toLowerCase().includes(input.toLowerCase())) : choices)
 		}))["companyId"];
 		if (companyId === void 0) {
-			console.log(chalk.red("No company selected. Aborting."));
-			process.exitCode = 1;
-			return;
+			deps.log(chalk.red("No company selected. Aborting."));
+			return 1;
 		}
 		const choice = companies.find((c) => c.id === companyId);
 		if (!choice) {
-			console.log(chalk.red("Invalid selection. Aborting."));
-			process.exitCode = 1;
-			return;
+			deps.log(chalk.red("Invalid selection. Aborting."));
+			return 1;
 		}
 		selected = choice;
 	}
-	const name = profileName ?? selected.name;
-	if (!await confirmOverwrite(name)) {
-		console.log(chalk.yellow("Login cancelled — existing profile not overwritten."));
-		return;
-	}
+	if (!isStaffSession(selected)) return ui.fail(shopperSession(email, selected));
+	const name = opts.name ?? selected.name;
+	if (await overwriteDecision(name, {
+		yes: Boolean(opts.yes),
+		interactive: true
+	}, deps) !== "replace") return cancelled(deps);
 	storeProfile(name, selected.jwt, selected.name);
-	console.log(chalk.green(`Logged in as ${chalk.bold(selected.name)} (profile: ${chalk.bold(name)})`));
+	return loggedIn(ui, deps, name, { name: selected.name });
+}
+function expiryNote(expiresAtIso) {
+	const expiresInMs = new Date(expiresAtIso).getTime() - Date.now();
+	const expiresInMin = Math.round(expiresInMs / 1e3 / 60);
+	return expiresInMin > 0 ? `expires in ~${expiresInMin} min` : "code may expire soon — check your email quickly";
 }
-const loginCommand = new Command("login").description("Authenticate with the Fluid API").option("-t, --token <token>", "API token (skips email flow). Prefer FLUID_TOKEN env var to avoid shell history exposure").option("-e, --email <email>", "Email address for MFA login").option("-n, --name <name>", "Profile name (defaults to company name)").action(async (opts) => {
-	const token = opts.token ?? process.env["FLUID_TOKEN"];
+const SHELL_SAFE = /^[\w.@+-]+$/;
+/**
+* The command that finishes this sign-in, for a person or agent to run.
+* Values with characters a shell would act on are left as placeholders.
+*/
+function finishCommand(email, shop) {
+	const safe = (value, placeholder) => SHELL_SAFE.test(value) ? value : placeholder;
+	return `fluid login --code --email ${safe(email, "<email>")} --shop ${safe(shop, "<shop>")}`;
+}
+/** `fluid login --send-code`: email a code, save the sign-in, exit. */
+async function sendCodeStep(opts, ui, deps) {
+	if (!opts.email) return ui.fail({
+		code: "EMAIL_REQUIRED",
+		message: "--send-code needs --email <address>."
+	});
+	if (!opts.shop) return ui.fail({
+		code: "SHOP_REQUIRED",
+		message: "--send-code needs --shop <shop>, the company to sign in to (acme or acme.fluid.app). A new signup's response names it as fluid_shop."
+	});
+	const email = normaliseEmail(opts.email);
+	const shop = opts.shop;
+	const spinner = ui.spinner("Sending verification code...");
+	const sent = await deps.api.sendMfa(email, ...shopArgs(shop));
+	if (!sent.success) return ui.fail(sent.error, spinner);
+	deps.pending.save({
+		uuid: sent.value.uuid,
+		email,
+		shop,
+		expiresAt: sent.value.expiresAt,
+		baseUrl: getFluidApiBase()
+	});
+	spinner.succeed(`If ${email} can sign in at ${shop}, a code is on its way (${expiryNote(sent.value.expiresAt)})`);
+	ui.result({
+		status: "code_sent",
+		email,
+		shop,
+		expiresAt: sent.value.expiresAt
+	});
+	if (!ui.json) {
+		deps.log(`Finish with: ${finishCommand(email, shop)}`);
+		deps.log(chalk.dim("with the code in FLUID_LOGIN_CODE, or add - after --code to read it from stdin. With no terminal, add --yes to replace a profile with the company's name, or --name <profile>."));
+	}
+	return 0;
+}
+/**
+* The code for the finish step. A bare `--code` reads FLUID_LOGIN_CODE,
+* `--code -` reads stdin, and any other value is the code. Stdin is read
+* only when asked for: an agent's stdin may be a pipe that never closes,
+* and reading it uninvited would wait forever.
+*/
+async function readCode(opts, deps) {
+	if (opts.code === "-") return (await deps.readStdin()).trim() || void 0;
+	if (typeof opts.code === "string") {
+		deps.err(chalk.yellow("Warning: a code passed via --code is visible in shell history and process listings. Prefer FLUID_LOGIN_CODE, or --code - to read it from stdin."));
+		return opts.code.trim();
+	}
+	return deps.env["FLUID_LOGIN_CODE"]?.trim() || void 0;
+}
+/** The server's answer for a code that cannot finish, by error code. */
+function finishError(error, shop) {
+	if (error.code === "INVALID_CODE") return {
+		code: error.code,
+		message: `${error.message}. Five wrong codes lock this sign-in; then run --send-code again.`
+	};
+	if (error.code === "UUID_NOT_FOUND") return {
+		code: error.code,
+		message: `This sign-in can't be finished with a code: the shop "${shop}" is wrong, the address is not an admin or rep there, or the company signs in with an emailed link instead. Check them and run --send-code again.`
+	};
+	return error;
+}
+/** `fluid login --code`: redeem the code for the saved sign-in. */
+async function finishStep(opts, interactive, ui, deps) {
+	if (!opts.email) return ui.fail({
+		code: "EMAIL_REQUIRED",
+		message: "--code needs --email <address>, the one used with --send-code."
+	});
+	if (!interactive && !opts.yes && !opts.name) return ui.fail({
+		code: "YES_OR_NAME_REQUIRED",
+		message: "With no terminal, --code needs --yes, to replace a profile with the company's name, or --name <profile>."
+	});
+	const email = normaliseEmail(opts.email);
+	const record = deps.pending.load(email);
+	if (!record) return ui.fail({
+		code: "NO_PENDING_LOGIN",
+		message: `No sign-in is waiting for ${email}. Run fluid login --send-code --email ${email} first.`
+	});
+	const { shop } = record;
+	if (opts.shop && shopLabel(opts.shop) !== shopLabel(shop)) return ui.fail({
+		code: "SHOP_MISMATCH",
+		message: `The code for ${email} was sent for ${shop}, not ${opts.shop}.`
+	});
+	if (!(Date.parse(record.expiresAt) > Date.now())) {
+		deps.pending.remove(email);
+		return ui.fail({
+			code: "CODE_EXPIRED",
+			message: `The code for ${email} has expired. Run fluid login --send-code again.`
+		});
+	}
+	const code = await readCode(opts, deps);
+	if (!code) return ui.fail({
+		code: "NO_CODE",
+		message: "No code given. Put it in FLUID_LOGIN_CODE, pass --code - to read it from stdin, or pass it to --code."
+	});
+	if (!/^\d{6}$/.test(code)) return ui.fail({
+		code: "INVALID_CODE_FORMAT",
+		message: "The code must be exactly 6 digits."
+	});
+	const overwrite = {
+		yes: Boolean(opts.yes),
+		interactive
+	};
+	if (opts.name && overwriteRule(opts.name, overwrite) === "refuse") return ui.fail(profileExists(opts.name, false));
+	const spinner = ui.spinner("Verifying code...");
+	const confirmed = await deps.api.confirmMfa(record.uuid, code, {
+		fluidShop: shop,
+		baseUrl: record.baseUrl
+	});
+	if (!confirmed.success) {
+		if (![
+			"INVALID_CODE",
+			"RATE_LIMITED",
+			"API_UNREACHABLE"
+		].includes(confirmed.error.code)) deps.pending.remove(email);
+		return ui.fail(finishError(confirmed.error, shop), spinner);
+	}
+	spinner.succeed("Verified");
+	deps.pending.remove(email);
+	const { companies } = confirmed.value;
+	const selected = findByShop(companies, shop);
+	if (!selected) {
+		if (companies.length === 0) return ui.fail({
+			code: "NO_COMPANIES",
+			message: "No companies found for this account."
+		});
+		const shops = companies.map((c) => c.shopName).join(", ");
+		return ui.fail({
+			code: "SHOP_NOT_FOUND",
+			message: `This account has no company at ${shop}. It has: ${shops}.`
+		});
+	}
+	if (!isStaffSession(selected)) return ui.fail(shopperSession(email, selected));
+	const name = opts.name ?? selected.name;
+	const decision = await overwriteDecision(name, overwrite, deps);
+	if (decision === "refuse") return ui.fail(profileExists(name, true));
+	if (decision === "keep") return cancelled(deps);
+	storeProfile(name, selected.jwt, selected.name, record.baseUrl);
+	return loggedIn(ui, deps, name, {
+		id: selected.id,
+		name: selected.name,
+		shop: selected.shopName
+	});
+}
+/**
+* Run `fluid login` and return its exit code.
+*/
+async function runLogin(opts, deps = defaultLoginDeps) {
+	const json = Boolean(opts.json);
+	const ui = createUi(json, deps);
+	const interactive = deps.isInteractive() && !json && opts.code !== "-";
+	if (opts.sendCode || opts.code !== void 0) {
+		if (opts.token) return ui.fail({
+			code: "FLAG_CONFLICT",
+			message: "--token cannot be combined with --send-code or --code."
+		});
+		if (opts.sendCode && opts.code !== void 0) return ui.fail({
+			code: "FLAG_CONFLICT",
+			message: "Run --send-code and --code as two separate commands."
+		});
+		return opts.sendCode ? sendCodeStep(opts, ui, deps) : finishStep(opts, interactive, ui, deps);
+	}
+	const token = opts.token ?? deps.env["FLUID_TOKEN"];
 	if (token) {
-		if (opts.token) console.log(chalk.yellow("Warning: token passed via --token flag is visible in shell history and process listings. Prefer the FLUID_TOKEN environment variable."));
-		await loginWithToken(token, opts.name);
-	} else await loginWithEmail(opts.email, opts.name);
-});
+		if (opts.token) (json ? deps.err : deps.log)(chalk.yellow("Warning: token passed via --token flag is visible in shell history and process listings. Prefer the FLUID_TOKEN environment variable."));
+		return loginWithToken(token, opts, interactive, ui, deps);
+	}
+	if (!interactive) {
+		const why = json ? "fluid login --json cannot ask for the email and code." : "fluid login needs a terminal to ask for the email and code.";
+		return ui.fail({
+			code: "NOT_INTERACTIVE",
+			message: `${why}\n${TWO_STEP_HINT}`
+		});
+	}
+	return loginWithEmail(opts, ui, deps);
+}
+/**
+* The `login` command, running `run` with the parsed options. Built by a
+* function so a test can check the flag parsing without signing in.
+*/
+function buildLoginCommand(run = (opts) => runLogin(opts)) {
+	return new Command("login").description("Authenticate with the Fluid API").option("-t, --token <token>", "API token (skips email flow). Prefer FLUID_TOKEN env var to avoid shell history exposure").option("-e, --email <email>", "Email address for MFA login (required with --send-code and --code)").option("-n, --name <name>", "Profile name (defaults to company name)").option("--shop <shop>", "Sign in to this company (e.g. acme or acme.fluid.app); required with --send-code. An admin's emailed code also confirms a new signup").option("--send-code", "Email a sign-in code and exit, for use without a terminal; finish with --code").option("--code [code]", "Finish a sign-in started with --send-code. Reads the code from FLUID_LOGIN_CODE, or from stdin with --code -; a code given here is visible in shell history").option("-y, --yes", "Replace an existing profile without asking").option("--json", "Print the result as JSON").action(async (opts) => {
+		const exitCode = await run(opts);
+		if (exitCode !== 0) process.exitCode = exitCode;
+	});
+}
+const loginCommand = buildLoginCommand();
 //#endregion
 //#region src/commands/logout.ts
 /**