@ratio-app/cli 0.1.1

package/dist/commands/auth/login.js

@@ -0,0 +1,987 @@
+// src/commands/auth/login.ts
+import { Flags as Flags2, ux } from "@oclif/core";
+
+// src/lib/ratio-command.ts
+import { Command, Errors } from "@oclif/core";
+
+// src/lib/errors.ts
+var RatioCLIError = class extends Error {
+  code;
+  exitCode;
+  hint;
+  docsUrl;
+  constructor(opts) {
+    super(opts.message);
+    this.name = new.target.name;
+    this.code = opts.code;
+    this.exitCode = opts.exitCode;
+    if (opts.hint !== void 0) this.hint = opts.hint;
+    if (opts.docsUrl !== void 0) this.docsUrl = opts.docsUrl;
+  }
+};
+var NotLoggedInError = class extends RatioCLIError {
+  constructor(message, hint = "Run 'ratio auth login' to sign in.") {
+    super({ code: "NOT_LOGGED_IN", exitCode: 3, message, hint });
+  }
+};
+var TokenExpiredError = class extends RatioCLIError {
+  constructor(message, hint = "Run 'ratio auth login' to refresh your session.") {
+    super({ code: "TOKEN_EXPIRED", exitCode: 3, message, hint });
+  }
+};
+var NetworkError = class extends RatioCLIError {
+  constructor(message, hint = "Check your network and retry.") {
+    super({ code: "NETWORK_ERROR", exitCode: 5, message, hint });
+  }
+};
+var ValidationError = class extends RatioCLIError {
+  constructor(message, hint) {
+    const opts = {
+      code: "VALIDATION_ERROR",
+      exitCode: 8,
+      message
+    };
+    if (hint !== void 0) opts.hint = hint;
+    super(opts);
+  }
+};
+function isRatioCLIError(err) {
+  return err instanceof RatioCLIError;
+}
+
+// src/lib/render-error.ts
+function isOclifParserError(err) {
+  return err instanceof Error && "parse" in err && err.parse !== null && err.parse !== void 0;
+}
+function buildErrorEnvelope(code, message, hint, docsUrl) {
+  const obj = { ok: false, code, message };
+  if (hint !== void 0) obj["hint"] = hint;
+  if (docsUrl !== void 0) obj["docsUrl"] = docsUrl;
+  return JSON.stringify(obj) + "\n";
+}
+function renderError(input2) {
+  const { err, verbose, json } = input2;
+  if (isRatioCLIError(err)) {
+    const ratioErr = err;
+    if (ratioErr.exitCode === 0) {
+      if (json) {
+        return {
+          stdout: JSON.stringify({ ok: true, data: null }) + "\n",
+          stderr: "",
+          exitCode: 0
+        };
+      }
+      return {
+        stdout: ratioErr.message + "\n",
+        stderr: "",
+        exitCode: 0
+      };
+    }
+    let stderrLines = `${ratioErr.code}: ${ratioErr.message}
+`;
+    if (ratioErr.hint !== void 0) stderrLines += `${ratioErr.hint}
+`;
+    if (ratioErr.docsUrl !== void 0) stderrLines += `${ratioErr.docsUrl}
+`;
+    if (json) {
+      return {
+        stdout: buildErrorEnvelope(ratioErr.code, ratioErr.message, ratioErr.hint, ratioErr.docsUrl),
+        stderr: verbose && ratioErr.stack ? ratioErr.stack + "\n" : "",
+        exitCode: ratioErr.exitCode
+      };
+    }
+    if (verbose && ratioErr.stack) {
+      stderrLines += ratioErr.stack + "\n";
+    }
+    return { stdout: "", stderr: stderrLines, exitCode: ratioErr.exitCode };
+  }
+  if (isOclifParserError(err)) {
+    const parserErr = err;
+    const msg = parserErr.message || "Unknown parse error";
+    const coercedErr = new ValidationError(msg);
+    let stderrText2 = `${coercedErr.code}: ${msg}
+`;
+    if (json) {
+      return {
+        stdout: buildErrorEnvelope(coercedErr.code, msg),
+        stderr: verbose && parserErr.stack ? parserErr.stack + "\n" : "",
+        exitCode: 8
+      };
+    }
+    if (verbose && parserErr.stack) {
+      stderrText2 += parserErr.stack + "\n";
+    }
+    return { stdout: "", stderr: stderrText2, exitCode: 8 };
+  }
+  const message = err instanceof Error ? err.message : String(err);
+  const stack = err instanceof Error ? err.stack : void 0;
+  const stderrPrefix = `INTERNAL: ${message}
+`;
+  if (json) {
+    return {
+      stdout: buildErrorEnvelope("INTERNAL", message),
+      stderr: verbose && stack ? stack + "\n" : "",
+      exitCode: 1
+    };
+  }
+  let stderrText = stderrPrefix;
+  if (verbose && stack) {
+    stderrText += stack + "\n";
+  }
+  return { stdout: "", stderr: stderrText, exitCode: 1 };
+}
+
+// src/lib/ratio-command.ts
+var RatioCommand = class extends Command {
+  _getRenderFlags() {
+    const argv = this.argv;
+    return {
+      verbose: argv.includes("--verbose"),
+      json: argv.includes("--json")
+    };
+  }
+  async catch(err) {
+    const { verbose, json } = this._getRenderFlags();
+    const output2 = renderError({ err, verbose, json });
+    if (output2.stdout) process.stdout.write(output2.stdout);
+    if (output2.stderr) process.stderr.write(output2.stderr);
+    if (output2.exitCode === 0) {
+      throw new Errors.ExitError(0);
+    }
+    err.skipOclifErrorHandling = true;
+    err.oclif = { exit: output2.exitCode };
+    throw err;
+  }
+};
+
+// src/lib/verbose-flag.ts
+import { Flags } from "@oclif/core";
+var verboseFlag = {
+  verbose: Flags.boolean({
+    description: "Show diagnostic detail: HTTP status/timing lines for auth requests (stderr) and stack traces for internal errors."
+  })
+};
+var jsonFlag = {
+  json: Flags.boolean({
+    description: "Emit machine-readable JSON on stdout."
+  })
+};
+
+// src/lib/credentials/clock.ts
+var SystemClock = class {
+  now() {
+    return Date.now();
+  }
+};
+
+// src/lib/credentials/path.ts
+import os from "os";
+import path from "path";
+function snapshotPathEnv() {
+  const snapshot = {};
+  const xdgConfigHome = process.env["XDG_CONFIG_HOME"];
+  if (xdgConfigHome !== void 0) {
+    snapshot.XDG_CONFIG_HOME = xdgConfigHome;
+  }
+  const appData = process.env["APPDATA"];
+  if (appData !== void 0) {
+    snapshot.APPDATA = appData;
+  }
+  return snapshot;
+}
+function defaultCredentialsPath(platform, homedir, env) {
+  const resolvedPlatform = platform ?? process.platform;
+  const resolvedHome = homedir ?? os.homedir();
+  const resolvedEnv = env ?? snapshotPathEnv();
+  if (resolvedPlatform === "win32") {
+    const appData = resolvedEnv.APPDATA;
+    const base2 = appData !== void 0 && appData !== "" ? appData : path.win32.join(resolvedHome, "AppData", "Roaming");
+    return path.win32.join(base2, "ratio", "credentials");
+  }
+  const xdgConfigHome = resolvedEnv.XDG_CONFIG_HOME;
+  const base = typeof xdgConfigHome === "string" && xdgConfigHome !== "" ? xdgConfigHome : path.posix.join(resolvedHome, ".config");
+  return path.posix.join(base, "ratio", "credentials");
+}
+
+// src/lib/credentials/refresher.ts
+var NotImplementedRefresher = class {
+  async refresh(refreshToken) {
+    void refreshToken;
+    throw new NotLoggedInError(
+      "Token refresh is not available yet in this CLI version."
+    );
+  }
+};
+
+// src/lib/credentials/store.ts
+import crypto from "crypto";
+import fs from "fs";
+import { dirname } from "path";
+
+// src/lib/credentials/schema.ts
+import { z } from "zod";
+var identitySchema = z.object({
+  developerId: z.string(),
+  email: z.string(),
+  // Token-derived fields captured at login. Optional (additive) so files
+  // written before these fields existed still validate as version 1.
+  merchantId: z.string().optional(),
+  scopes: z.array(z.string()).optional()
+}).strict();
+var profileSchema = z.object({
+  accessToken: z.string(),
+  refreshToken: z.string(),
+  expiresAt: z.string().datetime({ offset: true }),
+  identity: identitySchema,
+  obtainedAt: z.string().datetime({ offset: true })
+}).strict();
+var developerSessionSchema = z.object({
+  jwt: z.string(),
+  developerId: z.string(),
+  email: z.string(),
+  expiresAt: z.string().datetime({ offset: true }),
+  obtainedAt: z.string().datetime({ offset: true })
+}).strict();
+var credentialsSchema = z.object({
+  version: z.literal(1),
+  server: z.string(),
+  clientId: z.string(),
+  profiles: z.record(z.string(), profileSchema),
+  // Optional cached developer session. Additive so files written before
+  // this field existed still validate as version 1.
+  developer: developerSessionSchema.optional()
+}).strict();
+function parseCredentials(input2) {
+  if (typeof input2 === "object" && input2 !== null && "version" in input2) {
+    const version = input2.version;
+    if (version !== 1) {
+      const label = typeof version === "number" ? String(version) : "unknown";
+      throw new ValidationError(
+        `credentials file version ${label} is unsupported by this CLI \u2014 upgrade the CLI or sign in again`
+      );
+    }
+  }
+  const result = credentialsSchema.safeParse(input2);
+  if (!result.success) {
+    throw new ValidationError(
+      "credentials file schema mismatch \u2014 expected v1 shape"
+    );
+  }
+  return result.data;
+}
+
+// src/lib/credentials/store.ts
+var REFRESH_WINDOW_MS = 3e5;
+var ENV_TOKEN_VAR = "RATIO_API_TOKEN";
+var ENV_DEVELOPER_TOKEN_VAR = "RATIO_DEVELOPER_TOKEN";
+function hasErrnoCode(err, code) {
+  return err instanceof Error && err.code === code;
+}
+var FileCredentialStore = class {
+  filePath;
+  clock;
+  refresher;
+  envReader;
+  platform;
+  constructor(opts) {
+    this.filePath = opts?.filePath ?? defaultCredentialsPath();
+    this.clock = opts?.clock ?? new SystemClock();
+    this.refresher = opts?.refresher ?? new NotImplementedRefresher();
+    this.envReader = opts?.envReader ?? (() => process.env);
+    this.platform = opts?.platform ?? process.platform;
+  }
+  async load() {
+    this.reapplyFileModeIfDrifted();
+    let raw;
+    try {
+      raw = fs.readFileSync(this.filePath, "utf8");
+    } catch (err) {
+      if (hasErrnoCode(err, "ENOENT")) {
+        throw new NotLoggedInError("You are not signed in.");
+      }
+      throw err;
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      throw new ValidationError(
+        'credentials file is not valid JSON \u2014 run "ratio auth login" to reset'
+      );
+    }
+    return parseCredentials(parsed);
+  }
+  async save(creds) {
+    const dir = dirname(this.filePath);
+    fs.mkdirSync(dir, { recursive: true, mode: 448 });
+    if (this.platform !== "win32") {
+      fs.chmodSync(dir, 448);
+    }
+    const tmpPath = `${this.filePath}.${process.pid}.${crypto.randomBytes(8).toString("hex")}.tmp`;
+    try {
+      fs.writeFileSync(tmpPath, JSON.stringify(creds, null, 2), {
+        mode: 384
+      });
+      fs.renameSync(tmpPath, this.filePath);
+    } catch (err) {
+      try {
+        fs.unlinkSync(tmpPath);
+      } catch {
+      }
+      throw err;
+    }
+    if (this.platform !== "win32") {
+      fs.chmodSync(this.filePath, 384);
+    }
+  }
+  async clear() {
+    try {
+      fs.unlinkSync(this.filePath);
+    } catch (err) {
+      if (hasErrnoCode(err, "ENOENT")) {
+        return;
+      }
+      throw err;
+    }
+  }
+  async getValidAccessToken(profileName) {
+    const envToken = this.envReader()[ENV_TOKEN_VAR];
+    if (typeof envToken === "string" && envToken.length > 0) {
+      return envToken;
+    }
+    const creds = await this.load();
+    const name = profileName ?? "default";
+    const profile = creds.profiles[name];
+    if (profile === void 0) {
+      throw new NotLoggedInError("You are not signed in.");
+    }
+    const msUntilExpiry = new Date(profile.expiresAt).getTime() - this.clock.now();
+    if (msUntilExpiry < REFRESH_WINDOW_MS) {
+      return this.refreshAndPersist(creds, name, profile);
+    }
+    return profile.accessToken;
+  }
+  async getValidDeveloperToken() {
+    const envToken = this.envReader()[ENV_DEVELOPER_TOKEN_VAR];
+    if (typeof envToken === "string" && envToken.length > 0) {
+      return envToken;
+    }
+    let creds;
+    try {
+      creds = await this.load();
+    } catch (err) {
+      if (err instanceof NotLoggedInError) {
+        throw new NotLoggedInError("Developer signin required.");
+      }
+      throw err;
+    }
+    const session = creds.developer;
+    if (session === void 0) {
+      throw new NotLoggedInError("Developer signin required.");
+    }
+    const msUntilExpiry = new Date(session.expiresAt).getTime() - this.clock.now();
+    if (msUntilExpiry < REFRESH_WINDOW_MS) {
+      throw new NotLoggedInError("Developer signin required.");
+    }
+    return session.jwt;
+  }
+  async saveDeveloperSession(session) {
+    let creds;
+    try {
+      creds = await this.load();
+    } catch (err) {
+      if (err instanceof NotLoggedInError) {
+        creds = { version: 1, server: "", clientId: "", profiles: {} };
+      } else {
+        throw err;
+      }
+    }
+    const updated = {
+      ...creds,
+      developer: session
+    };
+    await this.save(updated);
+  }
+  /**
+   * Exchange the profile's refresh token for a fresh token set, merge it
+   * into the loaded credentials (preserving every other profile), persist
+   * atomically, and return the new access token. A refresher failure is
+   * wrapped in TokenExpiredError; the underlying message is deliberately
+   * discarded so a secret can never leak through the error surface.
+   */
+  async refreshAndPersist(creds, name, profile) {
+    let refreshed;
+    try {
+      refreshed = await this.refresher.refresh(profile.refreshToken);
+    } catch {
+      throw new TokenExpiredError(
+        "Your session has expired and could not be refreshed."
+      );
+    }
+    const updated = {
+      ...creds,
+      profiles: {
+        ...creds.profiles,
+        [name]: {
+          ...profile,
+          accessToken: refreshed.accessToken,
+          refreshToken: refreshed.refreshToken,
+          expiresAt: refreshed.expiresAt
+        }
+      }
+    };
+    await this.save(updated);
+    return refreshed.accessToken;
+  }
+  /**
+   * POSIX-only startup permission check: if the file exists with a mode
+   * other than 0600, re-apply 0600 and emit a warning to stderr. Never
+   * runs on Windows (stat modes there do not map to POSIX bits and chmod
+   * must not be called). Missing file is NOT an error here — load()
+   * reports it as NotLoggedInError.
+   */
+  reapplyFileModeIfDrifted() {
+    if (this.platform === "win32") {
+      return;
+    }
+    let stat;
+    try {
+      stat = fs.statSync(this.filePath);
+    } catch (err) {
+      if (hasErrnoCode(err, "ENOENT")) {
+        return;
+      }
+      throw err;
+    }
+    const mode = stat.mode & 511;
+    if (mode !== 384) {
+      fs.chmodSync(this.filePath, 384);
+      process.stderr.write(
+        `[warn] credentials file permissions were 0o${mode.toString(8)}; corrected to 0600.
+`
+      );
+    }
+  }
+};
+
+// src/lib/auth/pkce.ts
+import crypto2 from "crypto";
+function computeS256Challenge(codeVerifier) {
+  return crypto2.createHash("sha256").update(codeVerifier, "ascii").digest("base64url");
+}
+function generatePkcePair() {
+  const codeVerifier = crypto2.randomBytes(96).toString("base64url");
+  const codeChallenge = computeS256Challenge(codeVerifier);
+  return { codeVerifier, codeChallenge, codeChallengeMethod: "S256" };
+}
+
+// src/lib/auth/state.ts
+import crypto3 from "crypto";
+function generateState() {
+  return crypto3.randomBytes(32).toString("base64url");
+}
+function timingSafeEqualState(a, b) {
+  const aBuf = Buffer.from(a, "utf8");
+  const bBuf = Buffer.from(b, "utf8");
+  if (aBuf.length !== bBuf.length) {
+    crypto3.timingSafeEqual(aBuf, aBuf);
+    return false;
+  }
+  return crypto3.timingSafeEqual(aBuf, bBuf);
+}
+
+// src/lib/auth/config.ts
+var DEFAULT_SERVER_URL = "https://gkx.ratio.win";
+var RATIO_CLI_MERCHANT_ID = "ratio-cli-dev";
+var RATIO_CLI_CLIENT_ID = "ratio-cli";
+function resolveServerUrl(opts) {
+  const env = opts?.env ?? process.env;
+  if (typeof env["RATIO_SERVER_URL"] === "string" && env["RATIO_SERVER_URL"].length > 0) {
+    return env["RATIO_SERVER_URL"];
+  }
+  if (typeof opts?.credentials?.server === "string" && opts.credentials.server.length > 0) {
+    return opts.credentials.server;
+  }
+  return DEFAULT_SERVER_URL;
+}
+
+// src/lib/auth/authorize-url.ts
+function buildBrowserAuthorizeUrl(o) {
+  const params = new URLSearchParams();
+  params.set("client_id", o.clientId);
+  params.set("merchant_id", o.merchantId ?? RATIO_CLI_MERCHANT_ID);
+  params.set("code_challenge", o.codeChallenge);
+  params.set("code_challenge_method", "S256");
+  params.set("state", o.state);
+  params.set("redirect_uri", o.redirectUri);
+  if (o.scopes && o.scopes.length > 0) {
+    params.set("scope", o.scopes.join(","));
+  }
+  return `${o.serverUrl}/oauth/authorize?${params.toString()}`;
+}
+function buildManualAuthorizeUrl(o) {
+  const params = new URLSearchParams();
+  params.set("client_id", o.clientId);
+  params.set("merchant_id", o.merchantId ?? RATIO_CLI_MERCHANT_ID);
+  params.set("code_challenge", o.codeChallenge);
+  params.set("code_challenge_method", "S256");
+  params.set("state", o.state);
+  params.set("display_code", "1");
+  if (o.scopes && o.scopes.length > 0) {
+    params.set("scope", o.scopes.join(","));
+  }
+  return `${o.serverUrl}/oauth/authorize?${params.toString()}`;
+}
+
+// src/lib/auth/authorize-code-exchange.ts
+import { z as z2 } from "zod";
+
+// src/lib/auth/verbose-trace.ts
+var noopTracer = () => {
+};
+function createVerboseTracer(verbose, write = (line) => {
+  process.stderr.write(line);
+}) {
+  if (!verbose) return noopTracer;
+  return (msg) => {
+    write(`[verbose] ${msg}
+`);
+  };
+}
+
+// src/lib/auth/authorize-code-exchange.ts
+var TokenResponseSchema = z2.object({
+  access_token: z2.string().min(1),
+  refresh_token: z2.string().min(1),
+  expires_in: z2.number().int().positive(),
+  token_type: z2.string().optional(),
+  scope: z2.string().optional(),
+  merchant_id: z2.string().optional()
+});
+function exchangeCodeForTokens(i) {
+  return _exchangeCodeForTokensImpl(i);
+}
+async function _exchangeCodeForTokensImpl(i) {
+  const fetchFn = i.fetchImpl ?? fetch;
+  const body = {
+    grant_type: "authorization_code",
+    code: i.code,
+    clientId: i.clientId,
+    codeVerifier: i.codeVerifier
+  };
+  if (i.redirectUri !== void 0) {
+    body["redirectUri"] = i.redirectUri;
+  }
+  const trace = i.trace ?? noopTracer;
+  const startedAt = Date.now();
+  let response;
+  try {
+    response = await fetchFn(`${i.serverUrl}/oauth/token`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body)
+    });
+  } catch {
+    trace(`POST /oauth/token \u2192 network error (${Date.now() - startedAt}ms)`);
+    throw new NetworkError("Failed to reach the Ratio server during token exchange.");
+  }
+  trace(`POST /oauth/token \u2192 ${response.status} (${Date.now() - startedAt}ms)`);
+  if (response.status >= 400 && response.status < 500) {
+    throw new ValidationError(
+      "The authorization code was rejected. Run 'ratio auth login' again."
+    );
+  }
+  if (response.status >= 500 || !response.ok) {
+    throw new NetworkError("The Ratio server returned an error during token exchange.");
+  }
+  let raw;
+  try {
+    raw = await response.json();
+  } catch {
+    throw new ValidationError("Token response was not valid JSON.");
+  }
+  const parsed = TokenResponseSchema.safeParse(raw);
+  if (!parsed.success) {
+    throw new ValidationError("Token response shape was unexpected. Run ratio auth login again.");
+  }
+  const data = parsed.data;
+  const expiresAt = new Date(Date.now() + data.expires_in * 1e3).toISOString();
+  const tokens = {
+    accessToken: data.access_token,
+    refreshToken: data.refresh_token,
+    expiresAt
+  };
+  const scopeStr = data.scope ?? "";
+  const scopes = scopeStr.length > 0 ? scopeStr.split(/[\s,]+/).filter(Boolean) : [];
+  const identity = {
+    clientId: i.clientId,
+    merchantId: data.merchant_id ?? "ratio-cli-dev",
+    scopes
+  };
+  return { tokens, identity };
+}
+
+// src/lib/auth/http-refresher.ts
+import { z as z3 } from "zod";
+var RefreshResponseSchema = z3.object({
+  access_token: z3.string().min(1),
+  refresh_token: z3.string().min(1),
+  expires_in: z3.number().int().positive()
+});
+var HttpTokenRefresher = class {
+  serverUrl;
+  clientId;
+  fetchImpl;
+  trace;
+  constructor(opts) {
+    this.serverUrl = opts.serverUrl;
+    this.clientId = opts.clientId;
+    this.fetchImpl = opts.fetchImpl ?? fetch;
+    this.trace = opts.trace ?? noopTracer;
+  }
+  async refresh(refreshToken) {
+    const body = {
+      grant_type: "refresh_token",
+      refresh_token: refreshToken,
+      clientId: this.clientId
+    };
+    this.trace("refresh: fired (access token expired or expiring)");
+    const startedAt = Date.now();
+    let response;
+    try {
+      response = await this.fetchImpl(`${this.serverUrl}/oauth/token`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(body)
+      });
+    } catch {
+      this.trace(`POST /oauth/token \u2192 network error (${Date.now() - startedAt}ms)`);
+      throw new NetworkError("Failed to reach the Ratio server during token refresh.");
+    }
+    this.trace(`POST /oauth/token \u2192 ${response.status} (${Date.now() - startedAt}ms)`);
+    if (response.status >= 400 && response.status < 500) {
+      throw new TokenExpiredError(
+        "Your session has expired and could not be refreshed."
+      );
+    }
+    if (response.status >= 500 || !response.ok) {
+      throw new NetworkError("The Ratio server returned an error during token refresh.");
+    }
+    let raw;
+    try {
+      raw = await response.json();
+    } catch {
+      throw new NetworkError("Token refresh response was not valid JSON.");
+    }
+    const parsed = RefreshResponseSchema.safeParse(raw);
+    if (!parsed.success) {
+      throw new TokenExpiredError(
+        "Your session has expired and could not be refreshed."
+      );
+    }
+    const data = parsed.data;
+    const expiresAt = new Date(Date.now() + data.expires_in * 1e3).toISOString();
+    return {
+      accessToken: data.access_token,
+      refreshToken: data.refresh_token,
+      expiresAt
+    };
+  }
+};
+
+// src/lib/auth/loopback-server.ts
+import http from "http";
+function buildLoopbackRedirectUri(port) {
+  return `http://127.0.0.1:${port}/callback`;
+}
+function startLoopbackSession(trace = noopTracer) {
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    function settle(fn) {
+      if (settled) return;
+      settled = true;
+      fn();
+    }
+    const server = http.createServer();
+    server.on("error", reject);
+    server.listen(0, "127.0.0.1", () => {
+      const addr = server.address();
+      const port = typeof addr === "object" && addr !== null ? addr.port : 0;
+      const redirectUri = buildLoopbackRedirectUri(port);
+      trace(`loopback: bound 127.0.0.1:${port}`);
+      resolve({
+        port,
+        redirectUri,
+        awaitCallback(opts) {
+          const timeoutMs = opts.timeoutMs ?? 3e4;
+          return new Promise((res, rej) => {
+            server.on("request", (req, response) => {
+              const reqUrl = new URL(req.url ?? "/", `http://127.0.0.1`);
+              if (reqUrl.pathname !== "/callback") {
+                response.writeHead(404, { "Content-Type": "text/plain" });
+                response.end("Not found");
+                return;
+              }
+              const code = reqUrl.searchParams.get("code");
+              const state = reqUrl.searchParams.get("state");
+              if (!state || !timingSafeEqualState(state, opts.expectedState)) {
+                trace("callback: state mismatch");
+                response.writeHead(400, { "Content-Type": "text/plain" });
+                response.end("State mismatch");
+                settle(() => {
+                  clearTimeout(timer);
+                  server.close(
+                    () => rej(new ValidationError("Authorization callback failed a security check."))
+                  );
+                });
+                return;
+              }
+              if (!code || code.length === 0) {
+                trace("callback: missing code");
+                response.writeHead(400, { "Content-Type": "text/plain" });
+                response.end("Missing code");
+                settle(() => {
+                  clearTimeout(timer);
+                  server.close(
+                    () => rej(new ValidationError("Authorization callback did not return a code."))
+                  );
+                });
+                return;
+              }
+              response.writeHead(200, { "Content-Type": "text/html" });
+              response.end(
+                "<html><body><h1>Signed in! You can close this tab.</h1></body></html>"
+              );
+              trace(`callback: received on port ${port} (state ok)`);
+              settle(() => {
+                clearTimeout(timer);
+                server.close(() => res({ code, redirectUri }));
+              });
+            });
+            const timer = setTimeout(() => {
+              trace(`callback: timeout fired after ${timeoutMs}ms`);
+              settle(() => {
+                server.close(
+                  () => rej(
+                    new NotLoggedInError(
+                      "Browser flow timed out. Run 'ratio auth login --manual' to complete without a browser."
+                    )
+                  )
+                );
+              });
+            }, timeoutMs);
+            if (typeof timer.unref === "function") {
+              timer.unref();
+            }
+            if (opts.signal) {
+              opts.signal.addEventListener("abort", () => {
+                trace("callback: cancelled");
+                clearTimeout(timer);
+                settle(() => {
+                  server.close(
+                    () => rej(
+                      new NotLoggedInError(
+                        "Browser flow was cancelled. Run 'ratio auth login --manual' to complete without a browser."
+                      )
+                    )
+                  );
+                });
+              });
+            }
+          });
+        }
+      });
+    });
+  });
+}
+
+// src/lib/auth/browser.ts
+function defaultBrowserOpener() {
+  return {
+    async open(url) {
+      let openFn;
+      try {
+        const mod = await import("open");
+        openFn = mod.default;
+      } catch {
+        throw new NotLoggedInError(
+          "Could not open a browser. Run 'ratio auth login --manual' to complete without a browser."
+        );
+      }
+      try {
+        await openFn(url);
+      } catch {
+        throw new NotLoggedInError(
+          "Could not open a browser. Run 'ratio auth login --manual' to complete without a browser."
+        );
+      }
+    }
+  };
+}
+
+// src/lib/auth/manual-prompt.ts
+import { createInterface } from "readline/promises";
+import { stdin as input, stdout as output } from "process";
+function defaultStdinPrompt() {
+  return {
+    async askForCode(prompt) {
+      const rl = createInterface({ input, output });
+      try {
+        const answer = await rl.question(prompt);
+        return answer.trim();
+      } finally {
+        rl.close();
+      }
+    }
+  };
+}
+
+// src/commands/auth/login.ts
+var AuthLogin = class _AuthLogin extends RatioCommand {
+  static description = "Sign in to Ratio.";
+  static examples = [
+    "<%= config.bin %> auth login",
+    "<%= config.bin %> auth login --manual"
+  ];
+  static args = {};
+  static flags = {
+    ...verboseFlag,
+    manual: Flags2.boolean({
+      description: "Use manual copy-paste flow instead of a browser."
+    }),
+    profile: Flags2.string({
+      description: "Credential profile name to write into.",
+      default: "default"
+    })
+  };
+  // Injectable seams (test doubles replace these).
+  browserOpener = defaultBrowserOpener();
+  stdinPrompt = defaultStdinPrompt();
+  spinner = ux.action;
+  /** Verbose diagnostic tracer — no-op unless --verbose; set in run(). */
+  trace = noopTracer;
+  async run() {
+    const { flags } = await this.parse(_AuthLogin);
+    if (flags.verbose) {
+      this.trace = createVerboseTracer(true);
+    }
+    const envToken = process.env["RATIO_API_TOKEN"];
+    if (typeof envToken === "string" && envToken.length > 0) {
+      this.log("Using RATIO_API_TOKEN \u2014 no login needed.");
+      return;
+    }
+    const serverUrl = resolveServerUrl();
+    const { codeVerifier, codeChallenge } = generatePkcePair();
+    const state = generateState();
+    const profileName = flags.profile ?? "default";
+    const refresher = new HttpTokenRefresher({
+      serverUrl,
+      clientId: RATIO_CLI_CLIENT_ID,
+      trace: this.trace
+    });
+    const store = new FileCredentialStore({ refresher });
+    if (flags.manual) {
+      await this._runManualFlow(serverUrl, codeVerifier, codeChallenge, state, store, profileName);
+    } else {
+      await this._runBrowserFlow(serverUrl, codeVerifier, codeChallenge, state, store, profileName);
+    }
+  }
+  async _runBrowserFlow(serverUrl, codeVerifier, codeChallenge, state, store, profileName) {
+    const session = await startLoopbackSession(this.trace);
+    const authorizeUrl = buildBrowserAuthorizeUrl({
+      serverUrl,
+      clientId: RATIO_CLI_CLIENT_ID,
+      codeChallenge,
+      state,
+      redirectUri: session.redirectUri
+    });
+    await this.browserOpener.open(authorizeUrl);
+    this.log("Opening your browser for Ratio sign-in...");
+    this.spinner.start("Waiting for browser sign-in");
+    let code;
+    let redirectUri;
+    try {
+      ({ code, redirectUri } = await session.awaitCallback({
+        expectedState: state,
+        timeoutMs: 3e4
+      }));
+    } finally {
+      this.spinner.stop();
+    }
+    const { tokens, identity } = await exchangeCodeForTokens({
+      serverUrl,
+      code,
+      codeVerifier,
+      redirectUri,
+      clientId: RATIO_CLI_CLIENT_ID,
+      trace: this.trace
+    });
+    await this._persistCredentials(store, serverUrl, profileName, tokens, identity);
+    this.log(`Logged in as clientId=${identity.clientId} merchantId=${identity.merchantId}`);
+  }
+  async _runManualFlow(serverUrl, codeVerifier, codeChallenge, state, store, profileName) {
+    const authorizeUrl = buildManualAuthorizeUrl({
+      serverUrl,
+      clientId: RATIO_CLI_CLIENT_ID,
+      codeChallenge,
+      state
+    });
+    this.log("Open this URL in your browser to sign in:");
+    this.log(authorizeUrl);
+    this.log("");
+    const code = await this.stdinPrompt.askForCode("Paste the code shown in the browser: ");
+    if (!code || code.length === 0) {
+      throw new ValidationError(
+        "The pasted code was empty or malformed. Try again."
+      );
+    }
+    const { tokens, identity } = await exchangeCodeForTokens({
+      serverUrl,
+      code,
+      codeVerifier,
+      clientId: RATIO_CLI_CLIENT_ID,
+      trace: this.trace
+      // redirectUri intentionally omitted for manual flow
+    });
+    await this._persistCredentials(store, serverUrl, profileName, tokens, identity);
+    this.log(`Logged in as clientId=${identity.clientId} merchantId=${identity.merchantId}`);
+  }
+  async _persistCredentials(store, serverUrl, profileName, tokens, identity) {
+    let existingCreds;
+    try {
+      existingCreds = await store.load();
+    } catch {
+      existingCreds = {
+        version: 1,
+        server: serverUrl,
+        clientId: RATIO_CLI_CLIENT_ID,
+        profiles: {}
+      };
+    }
+    const updated = {
+      ...existingCreds,
+      server: serverUrl,
+      clientId: RATIO_CLI_CLIENT_ID,
+      profiles: {
+        ...existingCreds.profiles,
+        [profileName]: {
+          accessToken: tokens.accessToken,
+          refreshToken: tokens.refreshToken,
+          expiresAt: tokens.expiresAt,
+          identity: {
+            developerId: identity.clientId,
+            email: "",
+            merchantId: identity.merchantId,
+            scopes: [...identity.scopes]
+          },
+          obtainedAt: (/* @__PURE__ */ new Date()).toISOString()
+        }
+      }
+    };
+    await store.save(updated);
+  }
+};
+export {
+  AuthLogin as default
+};
+//# sourceMappingURL=login.js.map