@ratio-app/cli 0.1.1

package/dist/commands/auth/login.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/commands/auth/login.ts","../../../src/lib/ratio-command.ts","../../../src/lib/errors.ts","../../../src/lib/render-error.ts","../../../src/lib/verbose-flag.ts","../../../src/lib/credentials/clock.ts","../../../src/lib/credentials/path.ts","../../../src/lib/credentials/refresher.ts","../../../src/lib/credentials/store.ts","../../../src/lib/credentials/schema.ts","../../../src/lib/auth/pkce.ts","../../../src/lib/auth/state.ts","../../../src/lib/auth/config.ts","../../../src/lib/auth/authorize-url.ts","../../../src/lib/auth/authorize-code-exchange.ts","../../../src/lib/auth/verbose-trace.ts","../../../src/lib/auth/http-refresher.ts","../../../src/lib/auth/loopback-server.ts","../../../src/lib/auth/browser.ts","../../../src/lib/auth/manual-prompt.ts"],"sourcesContent":["import { Flags, ux } from '@oclif/core';\nimport { RatioCommand } from '../../lib/ratio-command.js';\nimport { verboseFlag } from '../../lib/verbose-flag.js';\nimport { FileCredentialStore } from '../../lib/credentials/index.js';\nimport type { Credentials } from '../../lib/credentials/index.js';\nimport {\n  resolveServerUrl,\n  RATIO_CLI_CLIENT_ID,\n  generatePkcePair,\n  generateState,\n  buildBrowserAuthorizeUrl,\n  buildManualAuthorizeUrl,\n  startLoopbackSession,\n  exchangeCodeForTokens,\n  defaultBrowserOpener,\n  defaultStdinPrompt,\n  HttpTokenRefresher,\n  createVerboseTracer,\n  noopTracer,\n} from '../../lib/auth/index.js';\nimport type { BrowserOpener, StdinPrompt, VerboseTracer } from '../../lib/auth/index.js';\nimport { ValidationError } from '../../lib/errors.js';\n\n/**\n * Minimal spinner contract — satisfied by oclif's `ux.action`.\n * Injectable so tests can assert start/stop without a real TTY.\n * oclif's ux.action writes to STDERR and auto-degrades to plain\n * lines on non-TTY / CI, so stdout (incl. --json consumers of other\n * commands) is never corrupted.\n */\nexport interface SpinnerLike {\n  start(msg: string): void;\n  stop(msg?: string): void;\n}\n\nexport default class AuthLogin extends RatioCommand {\n  static override description = 'Sign in to Ratio.';\n\n  static override examples = [\n    '<%= config.bin %> auth login',\n    '<%= config.bin %> auth login --manual',\n  ];\n\n  static override args = {};\n\n  static override flags = {\n    ...verboseFlag,\n    manual: Flags.boolean({\n      description: 'Use manual copy-paste flow instead of a browser.',\n    }),\n    profile: Flags.string({\n      description: 'Credential profile name to write into.',\n      default: 'default',\n    }),\n  };\n\n  // Injectable seams (test doubles replace these).\n  browserOpener: BrowserOpener = defaultBrowserOpener();\n  stdinPrompt: StdinPrompt = defaultStdinPrompt();\n  spinner: SpinnerLike = ux.action;\n  /** Verbose diagnostic tracer — no-op unless --verbose; set in run(). */\n  trace: VerboseTracer = noopTracer;\n\n  public async run(): Promise<void> {\n    const { flags } = await this.parse(AuthLogin);\n\n    if (flags.verbose) {\n      this.trace = createVerboseTracer(true);\n    }\n\n    // RATIO_API_TOKEN env bypass — no login needed.\n    const envToken = process.env['RATIO_API_TOKEN'];\n    if (typeof envToken === 'string' && envToken.length > 0) {\n      this.log('Using RATIO_API_TOKEN — no login needed.');\n      return;\n    }\n\n    const serverUrl = resolveServerUrl();\n    const { codeVerifier, codeChallenge } = generatePkcePair();\n    const state = generateState();\n    const profileName = flags.profile ?? 'default';\n\n    const refresher = new HttpTokenRefresher({\n      serverUrl,\n      clientId: RATIO_CLI_CLIENT_ID,\n      trace: this.trace,\n    });\n    const store = new FileCredentialStore({ refresher });\n\n    if (flags.manual) {\n      await this._runManualFlow(serverUrl, codeVerifier, codeChallenge, state, store, profileName);\n    } else {\n      await this._runBrowserFlow(serverUrl, codeVerifier, codeChallenge, state, store, profileName);\n    }\n  }\n\n  async _runBrowserFlow(\n    serverUrl: string,\n    codeVerifier: string,\n    codeChallenge: string,\n    state: string,\n    store: FileCredentialStore,\n    profileName: string,\n  ): Promise<void> {\n    const session = await startLoopbackSession(this.trace);\n\n    const authorizeUrl = buildBrowserAuthorizeUrl({\n      serverUrl,\n      clientId: RATIO_CLI_CLIENT_ID,\n      codeChallenge,\n      state,\n      redirectUri: session.redirectUri,\n    });\n\n    await this.browserOpener.open(authorizeUrl);\n    this.log('Opening your browser for Ratio sign-in...');\n\n    // Spinner while blocked on the browser callback (up to 30s).\n    // try/finally guarantees the spinner clears on timeout, state\n    // mismatch, and cancel — so error output never renders on top of it.\n    this.spinner.start('Waiting for browser sign-in');\n    let code: string;\n    let redirectUri: string;\n    try {\n      ({ code, redirectUri } = await session.awaitCallback({\n        expectedState: state,\n        timeoutMs: 30_000,\n      }));\n    } finally {\n      this.spinner.stop();\n    }\n\n    const { tokens, identity } = await exchangeCodeForTokens({\n      serverUrl,\n      code,\n      codeVerifier,\n      redirectUri,\n      clientId: RATIO_CLI_CLIENT_ID,\n      trace: this.trace,\n    });\n\n    await this._persistCredentials(store, serverUrl, profileName, tokens, identity);\n    this.log(`Logged in as clientId=${identity.clientId} merchantId=${identity.merchantId}`);\n  }\n\n  async _runManualFlow(\n    serverUrl: string,\n    codeVerifier: string,\n    codeChallenge: string,\n    state: string,\n    store: FileCredentialStore,\n    profileName: string,\n  ): Promise<void> {\n    const authorizeUrl = buildManualAuthorizeUrl({\n      serverUrl,\n      clientId: RATIO_CLI_CLIENT_ID,\n      codeChallenge,\n      state,\n    });\n\n    this.log('Open this URL in your browser to sign in:');\n    this.log(authorizeUrl);\n    this.log('');\n\n    const code = await this.stdinPrompt.askForCode('Paste the code shown in the browser: ');\n\n    if (!code || code.length === 0) {\n      throw new ValidationError(\n        \"The pasted code was empty or malformed. Try again.\",\n      );\n    }\n\n    const { tokens, identity } = await exchangeCodeForTokens({\n      serverUrl,\n      code,\n      codeVerifier,\n      clientId: RATIO_CLI_CLIENT_ID,\n      trace: this.trace,\n      // redirectUri intentionally omitted for manual flow\n    });\n\n    await this._persistCredentials(store, serverUrl, profileName, tokens, identity);\n    this.log(`Logged in as clientId=${identity.clientId} merchantId=${identity.merchantId}`);\n  }\n\n  private async _persistCredentials(\n    store: FileCredentialStore,\n    serverUrl: string,\n    profileName: string,\n    tokens: { accessToken: string; refreshToken: string; expiresAt: string },\n    identity: { clientId: string; merchantId: string; scopes: readonly string[] },\n  ): Promise<void> {\n    let existingCreds: Credentials;\n    try {\n      existingCreds = await store.load();\n    } catch {\n      existingCreds = {\n        version: 1,\n        server: serverUrl,\n        clientId: RATIO_CLI_CLIENT_ID,\n        profiles: {},\n      };\n    }\n\n    // A-29 deviation: schema requires identity.{developerId, email}.\n    // Backend does not expose developer identity. We store clientId as\n    // developerId and empty string for email as a schema-compatible placeholder.\n    // Declared as deviation in TASK-1-dev-report.md §Deviations.\n    // The token-derived merchantId and scopes ARE persisted (additive optional\n    // schema fields) so `auth whoami` can render the token-derived view.\n    const updated: Credentials = {\n      ...existingCreds,\n      server: serverUrl,\n      clientId: RATIO_CLI_CLIENT_ID,\n      profiles: {\n        ...existingCreds.profiles,\n        [profileName]: {\n          accessToken: tokens.accessToken,\n          refreshToken: tokens.refreshToken,\n          expiresAt: tokens.expiresAt,\n          identity: {\n            developerId: identity.clientId,\n            email: '',\n            merchantId: identity.merchantId,\n            scopes: [...identity.scopes],\n          },\n          obtainedAt: new Date().toISOString(),\n        },\n      },\n    };\n\n    await store.save(updated);\n  }\n}\n","import { Command, Errors } from '@oclif/core';\nimport { renderError } from './render-error.js';\n\n/**\n * Base class for all Ratio CLI commands.\n *\n * Overrides catch() to intercept every error thrown from run(), render it\n * per the Ratio CLI error-UX spec (typed hierarchy -> structured stderr/stdout,\n * --verbose for stack traces, --json for machine-readable envelope), and then\n * suppress oclif's own double-render by setting skipOclifErrorHandling on the\n * re-thrown error.\n *\n * Path B: base-class override — no oclif.hooks wiring needed.\n * oclif v4 does not expose a command_error hook; the reliable interception\n * point is Command.catch(), which is called by Command._run() before the\n * error bubbles up to oclif's global handle() function.\n *\n * Double-render prevention:\n *   oclif's handle() checks err.skipOclifErrorHandling before printing.\n *   After rendering we set skipOclifErrorHandling = true so oclif's\n *   pretty-print is skipped. We also set err.oclif.exit = N so handle()\n *   calls process.exit(N) with the correct code.\n *\n * Exit-code routing:\n *   - exitCode === 0 (ComingSoonError): throw ExitError(0) so oclif calls\n *     process.exit(0) cleanly. ExitError has code 'EEXIT' and is treated as\n *     a clean exit — shouldPrint is false in handle().\n *   - exitCode > 0: mark err.skipOclifErrorHandling = true and set\n *     err.oclif = { exit: N }, then re-throw so handle() exits N.\n *\n * Verbose/json detection strategy:\n *   We scan this.argv directly. this.argv is set by oclif's Command before\n *   run() is called and always contains the raw argument list. This approach\n *   works both for:\n *   (a) post-parse errors (thrown after this.parse() succeeds) — argv has the\n *       flags that were successfully recognised.\n *   (b) pre-parse errors (thrown BY this.parse(), e.g. unknown flag) — argv\n *       still contains --verbose / --json even though parse() threw.\n *   Simple string scan is sufficient since --verbose and --json are boolean\n *   flags with no value argument.\n */\nexport abstract class RatioCommand extends Command {\n  private _getRenderFlags(): { verbose: boolean; json: boolean } {\n    const argv = this.argv as string[];\n    return {\n      verbose: argv.includes('--verbose'),\n      json: argv.includes('--json'),\n    };\n  }\n\n  override async catch(\n    err: Error & {\n      exitCode?: number;\n      oclif?: { exit?: number };\n      skipOclifErrorHandling?: boolean;\n    },\n  ): Promise<never> {\n    const { verbose, json } = this._getRenderFlags();\n\n    const output = renderError({ err, verbose, json });\n\n    // Write rendered output before any exit/throw\n    if (output.stdout) process.stdout.write(output.stdout);\n    if (output.stderr) process.stderr.write(output.stderr);\n\n    if (output.exitCode === 0) {\n      // ComingSoonError path — ExitError(0) causes oclif to call process.exit(0)\n      // cleanly. ExitError has code 'EEXIT'; handle() treats it as a clean exit\n      // (shouldPrint is false) so no additional output is written.\n      throw new Errors.ExitError(0);\n    }\n\n    // For non-zero exits: suppress oclif's pretty-print by marking the error,\n    // then route the correct exit code via oclif.exit so handle() calls process.exit(N).\n    err.skipOclifErrorHandling = true;\n    err.oclif = { exit: output.exitCode };\n    throw err;\n  }\n}\n","/**\n * Error hierarchy for the Ratio CLI. Every error thrown from a command's\n * run() is expected to be an instance of RatioCLIError so the global\n * render-error handler can map it to a deterministic stderr line and exit\n * code. Uncaught Error subclasses render as \"INTERNAL: <msg>\" with exit 1.\n *\n * No import from @oclif/core — this file is dependency-free so tests\n * can import it without oclif overhead.\n */\n\nexport class RatioCLIError extends Error {\n  readonly code: string;\n  readonly exitCode: number;\n  readonly hint?: string;\n  readonly docsUrl?: string;\n\n  constructor(opts: {\n    code: string;\n    exitCode: number;\n    message: string;\n    hint?: string;\n    docsUrl?: string;\n  }) {\n    super(opts.message);\n    this.name = new.target.name;\n    this.code = opts.code;\n    this.exitCode = opts.exitCode;\n    if (opts.hint !== undefined) this.hint = opts.hint;\n    if (opts.docsUrl !== undefined) this.docsUrl = opts.docsUrl;\n  }\n}\n\n/** Coming-soon stub UX. Renders on stdout with exit 0. */\nexport class ComingSoonError extends RatioCLIError {\n  constructor(message: string) {\n    super({ code: 'COMING_SOON', exitCode: 0, message });\n  }\n}\n\n/** User has no credentials and command requires auth. */\nexport class NotLoggedInError extends RatioCLIError {\n  constructor(\n    message: string,\n    hint: string = \"Run 'ratio auth login' to sign in.\",\n  ) {\n    super({ code: 'NOT_LOGGED_IN', exitCode: 3, message, hint });\n  }\n}\n\nexport class TokenExpiredError extends RatioCLIError {\n  constructor(\n    message: string,\n    hint: string = \"Run 'ratio auth login' to refresh your session.\",\n  ) {\n    super({ code: 'TOKEN_EXPIRED', exitCode: 3, message, hint });\n  }\n}\n\nexport class ScopeDeniedError extends RatioCLIError {\n  constructor(message: string, hint?: string) {\n    const opts: { code: string; exitCode: number; message: string; hint?: string } = {\n      code: 'SCOPE_DENIED',\n      exitCode: 4,\n      message,\n    };\n    if (hint !== undefined) opts.hint = hint;\n    super(opts);\n  }\n}\n\nexport class NetworkError extends RatioCLIError {\n  constructor(message: string, hint: string = 'Check your network and retry.') {\n    super({ code: 'NETWORK_ERROR', exitCode: 5, message, hint });\n  }\n}\n\nexport class RelayConnectError extends RatioCLIError {\n  constructor(\n    message: string,\n    hint: string = 'Verify the tunnel URL and that the auth-server is reachable.',\n  ) {\n    super({ code: 'RELAY_CONNECT', exitCode: 6, message, hint });\n  }\n}\n\nexport class TemplateExistsError extends RatioCLIError {\n  constructor(\n    message: string,\n    hint: string = 'Choose a different name or remove the existing directory.',\n  ) {\n    super({ code: 'TEMPLATE_EXISTS', exitCode: 7, message, hint });\n  }\n}\n\nexport class ValidationError extends RatioCLIError {\n  constructor(message: string, hint?: string) {\n    const opts: { code: string; exitCode: number; message: string; hint?: string } = {\n      code: 'VALIDATION_ERROR',\n      exitCode: 8,\n      message,\n    };\n    if (hint !== undefined) opts.hint = hint;\n    super(opts);\n  }\n}\n\nexport class RelayResumeGapError extends RatioCLIError {\n  constructor(\n    message: string,\n    hint: string = 'Reconnect from the current cursor; older events are outside the buffer window.',\n  ) {\n    super({ code: 'RELAY_RESUME_GAP', exitCode: 9, message, hint });\n  }\n}\n\nexport class OrchestratorSpawnError extends RatioCLIError {\n  constructor(\n    message: string,\n    hint: string = \"Could not start your app's dev command — check that the command in ratio.config.jsonc runs from this directory.\",\n  ) {\n    super({ code: 'ORCHESTRATOR_SPAWN', exitCode: 10, message, hint });\n  }\n}\n\nexport class OrchestratorDrainTimeoutError extends RatioCLIError {\n  constructor(\n    message: string,\n    hint: string = 'Your dev command did not exit cleanly within 5 seconds — it was forcibly terminated.',\n  ) {\n    super({ code: 'ORCHESTRATOR_DRAIN', exitCode: 11, message, hint });\n  }\n}\n\nexport function isRatioCLIError(err: unknown): err is RatioCLIError {\n  return err instanceof RatioCLIError;\n}\n","import { isRatioCLIError, RatioCLIError, ValidationError } from './errors.js';\n\nexport interface RenderInput {\n  err: unknown;\n  verbose: boolean;\n  json: boolean;\n}\n\nexport interface RenderOutput {\n  /** Text to write to stdout. Empty string means nothing to write. */\n  stdout: string;\n  /** Text to write to stderr. Empty string means nothing to write. */\n  stderr: string;\n  exitCode: number;\n}\n\n/**\n * Detects whether an error originates from the oclif argument/flag parser.\n * oclif's CLIParseError subclasses (NonExistentFlagsError, RequiredArgsError,\n * etc.) all carry a `parse` property set by CLIParseErrorOptions. This is the\n * stable structural signal — more reliable than checking the class name string.\n */\nfunction isOclifParserError(err: unknown): err is Error & { parse: unknown } {\n  return (\n    err instanceof Error &&\n    'parse' in err &&\n    err.parse !== null &&\n    err.parse !== undefined\n  );\n}\n\n/**\n * Builds the JSON error envelope. Fields with undefined values are omitted\n * so the consumer never sees `\"hint\": null` or `\"docsUrl\": null`.\n */\nfunction buildErrorEnvelope(\n  code: string,\n  message: string,\n  hint?: string,\n  docsUrl?: string,\n): string {\n  const obj: Record<string, unknown> = { ok: false, code, message };\n  if (hint !== undefined) obj['hint'] = hint;\n  if (docsUrl !== undefined) obj['docsUrl'] = docsUrl;\n  return JSON.stringify(obj) + '\\n';\n}\n\n/**\n * Pure rendering function — no side effects, no process.exit, no I/O.\n * The caller (RatioCommand.catch) is responsible for writing output and exiting.\n *\n * Rendering rules (all branches):\n *\n * | Error shape          | --json | --verbose | stdout                         | stderr                           | exit |\n * |----------------------|--------|-----------|--------------------------------|----------------------------------|------|\n * | ComingSoonError      | false  | any       | err.message + '\\n'            | ''                               | 0    |\n * | ComingSoonError      | true   | any       | '{\"ok\":true,\"data\":null}\\n'   | ''                               | 0    |\n * | RatioCLIError >0     | false  | false     | ''                            | code: msg [+ hint] [+ docsUrl]  | N    |\n * | RatioCLIError >0     | false  | true      | ''                            | above + stack                    | N    |\n * | RatioCLIError >0     | true   | false     | JSON envelope                  | ''                               | N    |\n * | RatioCLIError >0     | true   | true      | JSON envelope                  | stack only                       | N    |\n * | oclif ParserError    | false  | any       | ''                            | VALIDATION_ERROR: msg [+stack]  | 8    |\n * | oclif ParserError    | true   | any       | JSON VALIDATION_ERROR envelope | stack if verbose                 | 8    |\n * | Plain Error / other  | false  | false     | ''                            | INTERNAL: msg\\n                 | 1    |\n * | Plain Error / other  | false  | true      | ''                            | INTERNAL: msg\\n + stack\\n       | 1    |\n * | Plain Error / other  | true   | any       | JSON INTERNAL envelope         | stack if verbose                 | 1    |\n */\nexport function renderError(input: RenderInput): RenderOutput {\n  const { err, verbose, json } = input;\n\n  // ── Branch 1: our own typed hierarchy ───────────────────────────────────\n  if (isRatioCLIError(err)) {\n    const ratioErr = err as RatioCLIError;\n\n    // exitCode === 0 → coming-soon: render on stdout, no stderr, exit 0\n    if (ratioErr.exitCode === 0) {\n      if (json) {\n        return {\n          stdout: JSON.stringify({ ok: true, data: null }) + '\\n',\n          stderr: '',\n          exitCode: 0,\n        };\n      }\n      return {\n        stdout: ratioErr.message + '\\n',\n        stderr: '',\n        exitCode: 0,\n      };\n    }\n\n    // exitCode > 0 → error render\n    let stderrLines = `${ratioErr.code}: ${ratioErr.message}\\n`;\n    if (ratioErr.hint !== undefined) stderrLines += `${ratioErr.hint}\\n`;\n    if (ratioErr.docsUrl !== undefined) stderrLines += `${ratioErr.docsUrl}\\n`;\n\n    if (json) {\n      return {\n        stdout: buildErrorEnvelope(ratioErr.code, ratioErr.message, ratioErr.hint, ratioErr.docsUrl),\n        stderr: verbose && ratioErr.stack ? ratioErr.stack + '\\n' : '',\n        exitCode: ratioErr.exitCode,\n      };\n    }\n\n    if (verbose && ratioErr.stack) {\n      stderrLines += ratioErr.stack + '\\n';\n    }\n\n    return { stdout: '', stderr: stderrLines, exitCode: ratioErr.exitCode };\n  }\n\n  // ── Branch 2: oclif parser error (unknown flag, missing required arg, etc.) ──\n  if (isOclifParserError(err)) {\n    const parserErr = err as Error & { parse: unknown };\n    const msg = parserErr.message || 'Unknown parse error';\n\n    // Strip oclif's \"Unexpected argument: --foo\" or similar prefix noise where\n    // possible, but keep the core message as-is since it's already human-readable.\n    const coercedErr = new ValidationError(msg);\n\n    let stderrText = `${coercedErr.code}: ${msg}\\n`;\n\n    if (json) {\n      return {\n        stdout: buildErrorEnvelope(coercedErr.code, msg),\n        stderr: verbose && parserErr.stack ? parserErr.stack + '\\n' : '',\n        exitCode: 8,\n      };\n    }\n\n    if (verbose && parserErr.stack) {\n      stderrText += parserErr.stack + '\\n';\n    }\n\n    return { stdout: '', stderr: stderrText, exitCode: 8 };\n  }\n\n  // ── Branch 3: plain Error or non-Error throw ─────────────────────────────\n  const message = err instanceof Error ? err.message : String(err);\n  const stack = err instanceof Error ? err.stack : undefined;\n  const stderrPrefix = `INTERNAL: ${message}\\n`;\n\n  if (json) {\n    return {\n      stdout: buildErrorEnvelope('INTERNAL', message),\n      stderr: verbose && stack ? stack + '\\n' : '',\n      exitCode: 1,\n    };\n  }\n\n  let stderrText = stderrPrefix;\n  if (verbose && stack) {\n    stderrText += stack + '\\n';\n  }\n\n  return { stdout: '', stderr: stderrText, exitCode: 1 };\n}\n","import { Flags } from '@oclif/core';\n\n/** Global verbose flag — every command imports and spreads this. */\nexport const verboseFlag = {\n  verbose: Flags.boolean({\n    description:\n      'Show diagnostic detail: HTTP status/timing lines for auth requests (stderr) and stack traces for internal errors.',\n  }),\n};\n\n/** JSON envelope flag — read-style commands (whoami, dev trigger --list) import. */\nexport const jsonFlag = {\n  json: Flags.boolean({\n    description: 'Emit machine-readable JSON on stdout.',\n  }),\n};\n","/**\n * Injectable wall-clock seam for the credential store.\n *\n * This is the ONLY file in the credentials module allowed to sample the\n * real wall clock. Every other file receives a {@link Clock} instance so\n * tests can drive expiry-window logic deterministically with a fake.\n */\n\n/** Injectable time source. */\nexport interface Clock {\n  /** Milliseconds since Unix epoch. */\n  now(): number;\n}\n\n/** Production {@link Clock} backed by the system wall clock. */\nexport class SystemClock implements Clock {\n  now(): number {\n    return Date.now();\n  }\n}\n","/**\n * Pure path resolution for the credentials file.\n *\n * POSIX: `$XDG_CONFIG_HOME/ratio/credentials` when the override is a\n * non-empty string, otherwise `~/.config/ratio/credentials`.\n * Windows: `%APPDATA%\\ratio\\credentials`, falling back to\n * `<home>\\AppData\\Roaming\\ratio\\credentials` when APPDATA is unset.\n *\n * `path.win32.join` / `path.posix.join` are used explicitly (never bare\n * `path.join`) so the result is deterministic when a test running on a\n * POSIX host fakes `platform === 'win32'`.\n */\n\nimport os from 'node:os';\nimport path from 'node:path';\n\n/** The subset of environment variables the path algorithm consults. */\nexport interface PathEnv {\n  readonly XDG_CONFIG_HOME?: string;\n  readonly APPDATA?: string;\n}\n\n/** Snapshot the two relevant variables from the real process env. */\nfunction snapshotPathEnv(): PathEnv {\n  const snapshot: { XDG_CONFIG_HOME?: string; APPDATA?: string } = {};\n  const xdgConfigHome = process.env['XDG_CONFIG_HOME'];\n  if (xdgConfigHome !== undefined) {\n    snapshot.XDG_CONFIG_HOME = xdgConfigHome;\n  }\n  const appData = process.env['APPDATA'];\n  if (appData !== undefined) {\n    snapshot.APPDATA = appData;\n  }\n  return snapshot;\n}\n\n/**\n * Pure function. Returns the on-disk path for the credentials file.\n * platform defaults to process.platform, homedir defaults to os.homedir(),\n * env defaults to a snapshot of {XDG_CONFIG_HOME, APPDATA} from process.env.\n * All three are injectable so unit tests fake Windows without a Windows host.\n */\nexport function defaultCredentialsPath(\n  platform?: NodeJS.Platform,\n  homedir?: string,\n  env?: PathEnv,\n): string {\n  const resolvedPlatform = platform ?? process.platform;\n  const resolvedHome = homedir ?? os.homedir();\n  const resolvedEnv = env ?? snapshotPathEnv();\n\n  if (resolvedPlatform === 'win32') {\n    const appData = resolvedEnv.APPDATA;\n    const base =\n      appData !== undefined && appData !== ''\n        ? appData\n        : path.win32.join(resolvedHome, 'AppData', 'Roaming');\n    return path.win32.join(base, 'ratio', 'credentials');\n  }\n\n  const xdgConfigHome = resolvedEnv.XDG_CONFIG_HOME;\n  const base =\n    typeof xdgConfigHome === 'string' && xdgConfigHome !== ''\n      ? xdgConfigHome\n      : path.posix.join(resolvedHome, '.config');\n  return path.posix.join(base, 'ratio', 'credentials');\n}\n","/**\n * Injectable token-refresh seam for the credential store.\n *\n * The store never performs network I/O itself: when a stored token is\n * close to expiry the store calls the injected {@link TokenRefresher}\n * and persists whatever it returns. The concrete HTTP implementation is\n * wired in by the auth commands; this module only defines the seam plus\n * a throw-if-called placeholder used before sign-in support is wired.\n */\n\nimport { NotLoggedInError } from '../errors.js';\nimport type { TokenSet } from './types.js';\n\n/** Injectable seam that exchanges a refresh token for a fresh token set. */\nexport interface TokenRefresher {\n  refresh(refreshToken: string): Promise<TokenSet>;\n}\n\n/**\n * v1 stub. Always rejects with a static-message NotLoggedInError; it\n * never inspects, echoes, or logs the token it was handed. The real\n * HTTP implementation is supplied by the auth commands.\n */\nexport class NotImplementedRefresher implements TokenRefresher {\n  async refresh(refreshToken: string): Promise<TokenSet> {\n    // Deliberately unused: this placeholder must never touch the token.\n    void refreshToken;\n    throw new NotLoggedInError(\n      'Token refresh is not available yet in this CLI version.',\n    );\n  }\n}\n","/**\n * File-backed credential store.\n *\n * Token resolution precedence (highest first):\n *   1. `RATIO_API_TOKEN` from the injected env reader — returned as-is\n *      with ZERO filesystem access and ZERO refresher involvement.\n *   2. The requested profile (default: \"default\") from the credentials\n *      file, silently refreshed via the injected TokenRefresher when it\n *      is within 5 minutes of expiry.\n *\n * Write contract: atomic tmp + rename in the SAME directory, tmp created\n * with mode 0600 at open time (POSIX), parent directory created 0700,\n * belt-and-braces chmod 0600 after rename. On Windows no chmod / mode\n * checks are ever performed. Concurrent writers are last-writer-wins by\n * design — the atomic rename guarantees no half-written file, which is\n * sufficient for a single-developer CLI.\n *\n * No secret (access token, refresh token, raw file contents) is ever\n * included in an error message or a log line.\n */\n\nimport crypto from 'node:crypto';\nimport fs from 'node:fs';\nimport { dirname } from 'node:path';\nimport {\n  NotLoggedInError,\n  TokenExpiredError,\n  ValidationError,\n} from '../errors.js';\nimport { SystemClock } from './clock.js';\nimport type { Clock } from './clock.js';\nimport { defaultCredentialsPath } from './path.js';\nimport { NotImplementedRefresher } from './refresher.js';\nimport type { TokenRefresher } from './refresher.js';\nimport { parseCredentials } from './schema.js';\nimport type { Credentials, DeveloperSession, Profile, TokenSet } from './types.js';\n\n/** Milliseconds before expiry at which a silent refresh is triggered. */\nconst REFRESH_WINDOW_MS = 300_000;\n\n/** Env var that short-circuits all file access when set to a non-empty string. */\nconst ENV_TOKEN_VAR = 'RATIO_API_TOKEN';\n\n/**\n * Env var that short-circuits developer-session file access when set to a\n * non-empty string. Strictly separate from RATIO_API_TOKEN: this one carries\n * the developer sign-in bearer used for app-management calls, never the\n * OAuth access token.\n */\nconst ENV_DEVELOPER_TOKEN_VAR = 'RATIO_DEVELOPER_TOKEN';\n\nexport interface CredentialStoreOptions {\n  /** Defaults to defaultCredentialsPath(). */\n  readonly filePath?: string;\n  /** Defaults to new SystemClock(). */\n  readonly clock?: Clock;\n  /** Defaults to new NotImplementedRefresher(). */\n  readonly refresher?: TokenRefresher;\n  /** Defaults to () => process.env — injected for env-precedence tests. */\n  readonly envReader?: () => Readonly<Record<string, string | undefined>>;\n  /** Defaults to process.platform. */\n  readonly platform?: NodeJS.Platform;\n}\n\nexport interface CredentialStore {\n  /** Reads the full credentials file. Throws NotLoggedInError if missing. */\n  load(): Promise<Credentials>;\n  /** Atomic write with 0600 on POSIX. tmp + rename in same dir. */\n  save(creds: Credentials): Promise<void>;\n  /** Deletes the credentials file. Idempotent. */\n  clear(): Promise<void>;\n  /**\n   * Env precedence: if envReader().RATIO_API_TOKEN is set, returns it\n   * WITHOUT reading the file, WITHOUT touching the refresher, WITHOUT\n   * any fs I/O. This is the auditable \"no disk access\" path.\n   *\n   * Otherwise: reads the file, validates, computes\n   *   msUntilExpiry = new Date(profile.expiresAt).getTime() - clock.now()\n   * If msUntilExpiry < 300_000 (5 min), calls refresher.refresh(...),\n   * persists the new TokenSet atomically, returns the new accessToken.\n   * Otherwise returns profile.accessToken.\n   */\n  getValidAccessToken(profileName?: string): Promise<string>;\n  /**\n   * Env precedence: RATIO_DEVELOPER_TOKEN if set (no fs I/O).\n   * Otherwise: load(); if creds.developer is absent or within 5 minutes of\n   * expiry, throws NotLoggedInError ('Developer signin required.').\n   * Otherwise returns creds.developer.jwt.\n   * NO refresh attempt — the caller drives the re-prompt UX.\n   */\n  getValidDeveloperToken(): Promise<string>;\n  /**\n   * Merge a DeveloperSession into the loaded credentials (creating the file\n   * if absent), atomic tmp+rename, 0600.\n   */\n  saveDeveloperSession(session: DeveloperSession): Promise<void>;\n}\n\n/** Narrow an unknown thrown value to a Node errno error with the given code. */\nfunction hasErrnoCode(err: unknown, code: string): boolean {\n  return (\n    err instanceof Error &&\n    (err as NodeJS.ErrnoException).code === code\n  );\n}\n\nexport class FileCredentialStore implements CredentialStore {\n  private readonly filePath: string;\n  private readonly clock: Clock;\n  private readonly refresher: TokenRefresher;\n  private readonly envReader: () => Readonly<\n    Record<string, string | undefined>\n  >;\n  private readonly platform: NodeJS.Platform;\n\n  constructor(opts?: CredentialStoreOptions) {\n    this.filePath = opts?.filePath ?? defaultCredentialsPath();\n    this.clock = opts?.clock ?? new SystemClock();\n    this.refresher = opts?.refresher ?? new NotImplementedRefresher();\n    this.envReader = opts?.envReader ?? (() => process.env);\n    this.platform = opts?.platform ?? process.platform;\n  }\n\n  async load(): Promise<Credentials> {\n    this.reapplyFileModeIfDrifted();\n\n    let raw: string;\n    try {\n      raw = fs.readFileSync(this.filePath, 'utf8');\n    } catch (err) {\n      if (hasErrnoCode(err, 'ENOENT')) {\n        throw new NotLoggedInError('You are not signed in.');\n      }\n      throw err;\n    }\n\n    let parsed: unknown;\n    try {\n      parsed = JSON.parse(raw);\n    } catch {\n      // Never echo the raw contents — they may hold a truncated token.\n      throw new ValidationError(\n        'credentials file is not valid JSON — run \"ratio auth login\" to reset',\n      );\n    }\n\n    return parseCredentials(parsed);\n  }\n\n  async save(creds: Credentials): Promise<void> {\n    const dir = dirname(this.filePath);\n    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });\n    if (this.platform !== 'win32') {\n      // mkdirSync does not re-mode a pre-existing directory; re-apply.\n      fs.chmodSync(dir, 0o700);\n    }\n\n    const tmpPath = `${this.filePath}.${process.pid}.${crypto\n      .randomBytes(8)\n      .toString('hex')}.tmp`;\n    try {\n      // mode at open time closes the create-then-chmod race window.\n      fs.writeFileSync(tmpPath, JSON.stringify(creds, null, 2), {\n        mode: 0o600,\n      });\n      fs.renameSync(tmpPath, this.filePath);\n    } catch (err) {\n      try {\n        fs.unlinkSync(tmpPath);\n      } catch {\n        // Best-effort cleanup: the tmp file may never have been created.\n      }\n      throw err;\n    }\n\n    if (this.platform !== 'win32') {\n      // Belt-and-braces: rename may preserve a prior destination mode.\n      fs.chmodSync(this.filePath, 0o600);\n    }\n  }\n\n  async clear(): Promise<void> {\n    try {\n      fs.unlinkSync(this.filePath);\n    } catch (err) {\n      if (hasErrnoCode(err, 'ENOENT')) {\n        return; // Idempotent: already gone.\n      }\n      throw err;\n    }\n  }\n\n  async getValidAccessToken(profileName?: string): Promise<string> {\n    const envToken = this.envReader()[ENV_TOKEN_VAR];\n    if (typeof envToken === 'string' && envToken.length > 0) {\n      return envToken;\n    }\n\n    const creds = await this.load();\n    const name = profileName ?? 'default';\n    const profile = creds.profiles[name];\n    if (profile === undefined) {\n      throw new NotLoggedInError('You are not signed in.');\n    }\n\n    const msUntilExpiry =\n      new Date(profile.expiresAt).getTime() - this.clock.now();\n    if (msUntilExpiry < REFRESH_WINDOW_MS) {\n      return this.refreshAndPersist(creds, name, profile);\n    }\n\n    return profile.accessToken;\n  }\n\n  async getValidDeveloperToken(): Promise<string> {\n    const envToken = this.envReader()[ENV_DEVELOPER_TOKEN_VAR];\n    if (typeof envToken === 'string' && envToken.length > 0) {\n      return envToken;\n    }\n\n    let creds: Credentials;\n    try {\n      creds = await this.load();\n    } catch (err) {\n      if (err instanceof NotLoggedInError) {\n        throw new NotLoggedInError('Developer signin required.');\n      }\n      throw err;\n    }\n\n    const session = creds.developer;\n    if (session === undefined) {\n      throw new NotLoggedInError('Developer signin required.');\n    }\n\n    const msUntilExpiry =\n      new Date(session.expiresAt).getTime() - this.clock.now();\n    if (msUntilExpiry < REFRESH_WINDOW_MS) {\n      // No refresh endpoint exists for developer sessions — the caller\n      // drives a fresh interactive sign-in instead.\n      throw new NotLoggedInError('Developer signin required.');\n    }\n\n    return session.jwt;\n  }\n\n  async saveDeveloperSession(session: DeveloperSession): Promise<void> {\n    let creds: Credentials;\n    try {\n      creds = await this.load();\n    } catch (err) {\n      if (err instanceof NotLoggedInError) {\n        // Edge case: no prior credentials file. Create a fresh v1 shell so\n        // the merged write below still validates on the next load().\n        creds = { version: 1, server: '', clientId: '', profiles: {} };\n      } else {\n        throw err;\n      }\n    }\n\n    const updated: Credentials = {\n      ...creds,\n      developer: session,\n    };\n    await this.save(updated);\n  }\n\n  /**\n   * Exchange the profile's refresh token for a fresh token set, merge it\n   * into the loaded credentials (preserving every other profile), persist\n   * atomically, and return the new access token. A refresher failure is\n   * wrapped in TokenExpiredError; the underlying message is deliberately\n   * discarded so a secret can never leak through the error surface.\n   */\n  private async refreshAndPersist(\n    creds: Credentials,\n    name: string,\n    profile: Profile,\n  ): Promise<string> {\n    let refreshed: TokenSet;\n    try {\n      refreshed = await this.refresher.refresh(profile.refreshToken);\n    } catch {\n      throw new TokenExpiredError(\n        'Your session has expired and could not be refreshed.',\n      );\n    }\n\n    const updated: Credentials = {\n      ...creds,\n      profiles: {\n        ...creds.profiles,\n        [name]: {\n          ...profile,\n          accessToken: refreshed.accessToken,\n          refreshToken: refreshed.refreshToken,\n          expiresAt: refreshed.expiresAt,\n        },\n      },\n    };\n    await this.save(updated);\n    return refreshed.accessToken;\n  }\n\n  /**\n   * POSIX-only startup permission check: if the file exists with a mode\n   * other than 0600, re-apply 0600 and emit a warning to stderr. Never\n   * runs on Windows (stat modes there do not map to POSIX bits and chmod\n   * must not be called). Missing file is NOT an error here — load()\n   * reports it as NotLoggedInError.\n   */\n  private reapplyFileModeIfDrifted(): void {\n    if (this.platform === 'win32') {\n      return;\n    }\n\n    let stat: fs.Stats;\n    try {\n      stat = fs.statSync(this.filePath);\n    } catch (err) {\n      if (hasErrnoCode(err, 'ENOENT')) {\n        return; // load() turns the missing file into NotLoggedInError.\n      }\n      throw err;\n    }\n\n    const mode = stat.mode & 0o777;\n    if (mode !== 0o600) {\n      fs.chmodSync(this.filePath, 0o600);\n      process.stderr.write(\n        `[warn] credentials file permissions were 0o${mode.toString(8)}; corrected to 0600.\\n`,\n      );\n    }\n  }\n}\n","/**\n * Runtime validation for the on-disk credentials file.\n *\n * The parser is deliberately strict: unknown top-level keys, missing\n * fields, non-ISO timestamps, and any `version` other than `1` are all\n * rejected with a typed ValidationError. Error messages NEVER embed the\n * raw file contents — a malformed file may contain a truncated token.\n */\n\nimport { z } from 'zod';\nimport { ValidationError } from '../errors.js';\nimport type { Credentials } from './types.js';\n\nconst identitySchema = z\n  .object({\n    developerId: z.string(),\n    email: z.string(),\n    // Token-derived fields captured at login. Optional (additive) so files\n    // written before these fields existed still validate as version 1.\n    merchantId: z.string().optional(),\n    scopes: z.array(z.string()).optional(),\n  })\n  .strict();\n\nconst profileSchema = z\n  .object({\n    accessToken: z.string(),\n    refreshToken: z.string(),\n    expiresAt: z.string().datetime({ offset: true }),\n    identity: identitySchema,\n    obtainedAt: z.string().datetime({ offset: true }),\n  })\n  .strict();\n\nconst developerSessionSchema = z\n  .object({\n    jwt: z.string(),\n    developerId: z.string(),\n    email: z.string(),\n    expiresAt: z.string().datetime({ offset: true }),\n    obtainedAt: z.string().datetime({ offset: true }),\n  })\n  .strict();\n\n/** Strict zod schema for the version-1 credentials file. */\nexport const credentialsSchema = z\n  .object({\n    version: z.literal(1),\n    server: z.string(),\n    clientId: z.string(),\n    profiles: z.record(z.string(), profileSchema),\n    // Optional cached developer session. Additive so files written before\n    // this field existed still validate as version 1.\n    developer: developerSessionSchema.optional(),\n  })\n  .strict();\n\n/**\n * Validate an already-JSON-parsed value against the version-1 shape.\n *\n * Throws ValidationError on any mismatch. A recognisable-but-unsupported\n * `version` gets a dedicated upgrade message; the version label is only\n * echoed when it is a number so arbitrary file contents can never leak\n * into an error message.\n */\nexport function parseCredentials(input: unknown): Credentials {\n  if (typeof input === 'object' && input !== null && 'version' in input) {\n    const version = (input as { version: unknown }).version;\n    if (version !== 1) {\n      const label = typeof version === 'number' ? String(version) : 'unknown';\n      throw new ValidationError(\n        `credentials file version ${label} is unsupported by this CLI — upgrade the CLI or sign in again`,\n      );\n    }\n  }\n\n  const result = credentialsSchema.safeParse(input);\n  if (!result.success) {\n    throw new ValidationError(\n      'credentials file schema mismatch — expected v1 shape',\n    );\n  }\n  return result.data as Credentials;\n}\n","/**\n * PKCE (RFC 7636) helpers — S256 code challenge only.\n *\n * The \"plain\" method is rejected by the backend DTO validator and is\n * never generated here. All operations are synchronous and pure.\n */\n\nimport crypto from 'node:crypto';\n\nexport interface PkcePair {\n  readonly codeVerifier: string;   // 43-128 chars, unreserved-only (RFC 7636 §4.1)\n  readonly codeChallenge: string;  // base64url(SHA-256(codeVerifier))\n  readonly codeChallengeMethod: 'S256';\n}\n\n/**\n * Compute the S256 code challenge for a given code verifier.\n * BASE64URL-ENCODE(SHA256(ASCII(code_verifier))) without padding.\n * Algorithm matches the backend pkce utility byte-for-byte.\n */\nexport function computeS256Challenge(codeVerifier: string): string {\n  return crypto.createHash('sha256').update(codeVerifier, 'ascii').digest('base64url');\n}\n\n/**\n * Generate a fresh PKCE pair for one authorization request.\n * codeVerifier is 96 random base64url bytes → 128 chars (within RFC 7636 43-128 range).\n */\nexport function generatePkcePair(): PkcePair {\n  const codeVerifier = crypto.randomBytes(96).toString('base64url');\n  const codeChallenge = computeS256Challenge(codeVerifier);\n  return { codeVerifier, codeChallenge, codeChallengeMethod: 'S256' };\n}\n","/**\n * OAuth state parameter helpers.\n *\n * State is generated once per authorization request and must be compared\n * in constant time to prevent timing-oracle CSRF attacks.\n */\n\nimport crypto from 'node:crypto';\n\n/**\n * Generate a fresh state value: 32 random bytes encoded as base64url.\n * 32 bytes = 256 bits of entropy, well above the 128-bit minimum.\n */\nexport function generateState(): string {\n  return crypto.randomBytes(32).toString('base64url');\n}\n\n/**\n * Constant-time comparison of two state strings.\n * Returns true iff a === b without leaking timing information.\n * Both strings are converted to UTF-8 Buffers before comparison;\n * length-mismatch is handled without a fast-fail branch.\n */\nexport function timingSafeEqualState(a: string, b: string): boolean {\n  const aBuf = Buffer.from(a, 'utf8');\n  const bBuf = Buffer.from(b, 'utf8');\n  if (aBuf.length !== bBuf.length) {\n    // Perform a dummy comparison to avoid timing-observable fast-path.\n    crypto.timingSafeEqual(aBuf, aBuf);\n    return false;\n  }\n  return crypto.timingSafeEqual(aBuf, bBuf);\n}\n","/**\n * Server-URL resolution for the Ratio CLI auth flow.\n *\n * Resolution order (highest priority first):\n *   1. RATIO_SERVER_URL environment variable\n *   2. Credentials.server from the stored credential file (passed in as opts.credentials.server)\n *   3. The compiled-in default: https://gkx.ratio.win\n *\n * The default is the ONLY place this URL appears in non-config source files.\n * All other auth-library modules call resolveServerUrl() — never hardcode.\n *\n * A-28: the merchantId constant lives here so it appears in exactly ONE\n * production file and is grep-able.\n */\n\n/** Compiled-in default server URL. */\nexport const DEFAULT_SERVER_URL = 'https://gkx.ratio.win';\n\n/**\n * Synthetic merchantId sent in the authorize URL.\n * A-28 adjudication: backend auto-creates missing merchants via\n * ensureMerchantExists(); 'ratio-cli-dev' is the designated synthetic value.\n * Appears in exactly ONE production file (this one).\n */\nexport const RATIO_CLI_MERCHANT_ID = 'ratio-cli-dev';\n\n/** The fixed clientId for the ratio-cli public OAuth client. */\nexport const RATIO_CLI_CLIENT_ID = 'ratio-cli' as const;\n\nexport interface ServerConfig {\n  readonly url: string;\n}\n\nexport interface ResolveServerUrlOptions {\n  readonly credentials?: { readonly server?: string };\n  readonly env?: Readonly<Record<string, string | undefined>>;\n}\n\n/**\n * Resolve the backend server URL using the three-level precedence chain.\n * Injectable for tests: pass `env` to avoid reading `process.env` directly.\n */\nexport function resolveServerUrl(opts?: ResolveServerUrlOptions): string {\n  const env = opts?.env ?? process.env;\n  if (typeof env['RATIO_SERVER_URL'] === 'string' && env['RATIO_SERVER_URL'].length > 0) {\n    return env['RATIO_SERVER_URL'];\n  }\n  if (typeof opts?.credentials?.server === 'string' && opts.credentials.server.length > 0) {\n    return opts.credentials.server;\n  }\n  return DEFAULT_SERVER_URL;\n}\n","/**\n * Pure URL builders for the OAuth authorization step.\n *\n * The browser flow uses a redirectUri (loopback callback) so the portal\n * redirects back to the CLI. The manual flow uses ?display_code=1 so\n * the portal renders a copyable code for the user to paste.\n *\n * Zero network I/O in this module — pure string construction only.\n */\n\nimport { RATIO_CLI_CLIENT_ID, RATIO_CLI_MERCHANT_ID } from './config.js';\n\nexport interface AuthorizeUrlBrowserOptions {\n  readonly serverUrl: string;\n  readonly clientId: typeof RATIO_CLI_CLIENT_ID;\n  readonly codeChallenge: string;\n  readonly state: string;\n  readonly redirectUri: string;    // http://127.0.0.1:<port>/callback\n  readonly scopes?: readonly string[];\n  readonly merchantId?: string;\n}\n\nexport interface AuthorizeUrlManualOptions {\n  readonly serverUrl: string;\n  readonly clientId: typeof RATIO_CLI_CLIENT_ID;\n  readonly codeChallenge: string;\n  readonly state: string;\n  readonly scopes?: readonly string[];\n  readonly merchantId?: string;\n}\n\n/**\n * Build the authorize URL for the browser flow.\n * Includes redirect_uri for the loopback callback; does NOT include display_code.\n */\nexport function buildBrowserAuthorizeUrl(o: AuthorizeUrlBrowserOptions): string {\n  const params = new URLSearchParams();\n  params.set('client_id', o.clientId);\n  params.set('merchant_id', o.merchantId ?? RATIO_CLI_MERCHANT_ID);\n  params.set('code_challenge', o.codeChallenge);\n  params.set('code_challenge_method', 'S256');\n  params.set('state', o.state);\n  params.set('redirect_uri', o.redirectUri);\n  if (o.scopes && o.scopes.length > 0) {\n    params.set('scope', o.scopes.join(','));\n  }\n  return `${o.serverUrl}/oauth/authorize?${params.toString()}`;\n}\n\n/**\n * Build the authorize URL for the manual copy-paste flow.\n * Includes display_code=1 so the portal renders a copyable code.\n * Does NOT include redirect_uri.\n */\nexport function buildManualAuthorizeUrl(o: AuthorizeUrlManualOptions): string {\n  const params = new URLSearchParams();\n  params.set('client_id', o.clientId);\n  params.set('merchant_id', o.merchantId ?? RATIO_CLI_MERCHANT_ID);\n  params.set('code_challenge', o.codeChallenge);\n  params.set('code_challenge_method', 'S256');\n  params.set('state', o.state);\n  params.set('display_code', '1');\n  if (o.scopes && o.scopes.length > 0) {\n    params.set('scope', o.scopes.join(','));\n  }\n  return `${o.serverUrl}/oauth/authorize?${params.toString()}`;\n}\n","/**\n * OAuth authorization-code exchange step.\n *\n * Used by BOTH the browser flow (with redirectUri) and the manual flow\n * (without redirectUri). Returns typed tokens + identity derived from\n * the token response.\n *\n * A-29 adjudication: identity = token-derived {clientId, merchantId, scopes}.\n * The backend token envelope does not expose developerId/email. This is a\n * known ADR contradiction resolved pre-implementation; the schema tolerates\n * absence and additive identity fields can be added when a backend endpoint\n * for developer identity is available.\n *\n * Token response schema is pinned with zod for fast detection of envelope drift.\n * Any schema mismatch throws a static-message ValidationError — the raw body\n * is never included in any error message (secret-leak prevention).\n */\n\nimport { z } from 'zod';\nimport { NetworkError, ValidationError } from '../errors.js';\nimport type { TokenSet } from '../credentials/index.js';\nimport { RATIO_CLI_CLIENT_ID } from './config.js';\nimport { noopTracer } from './verbose-trace.js';\nimport type { VerboseTracer } from './verbose-trace.js';\n\n/** Token response envelope from POST /oauth/token (authorization_code grant). */\nconst TokenResponseSchema = z.object({\n  access_token: z.string().min(1),\n  refresh_token: z.string().min(1),\n  expires_in: z.number().int().positive(),\n  token_type: z.string().optional(),\n  scope: z.string().optional(),\n  merchant_id: z.string().optional(),\n});\n\n/** Token-derived identity (A-29 shape). */\nexport interface TokenDerivedIdentity {\n  readonly clientId: string;\n  readonly merchantId: string;\n  readonly scopes: readonly string[];\n}\n\nexport interface CodeExchangeInput {\n  readonly serverUrl: string;\n  readonly code: string;\n  readonly codeVerifier: string;\n  readonly redirectUri?: string;          // undefined for --manual\n  readonly clientId: typeof RATIO_CLI_CLIENT_ID;\n  readonly fetchImpl?: typeof fetch;      // injectable for tests\n  /** Verbose diagnostic sink — never receives token/code/verifier/state. */\n  readonly trace?: VerboseTracer;\n}\n\nexport interface CodeExchangeOutput {\n  readonly tokens: TokenSet;\n  readonly identity: TokenDerivedIdentity;\n}\n\n/**\n * Exchange an authorization code for tokens.\n * POSTs to /oauth/token with grant_type=authorization_code.\n * Never logs or includes token values in error messages.\n */\nexport function exchangeCodeForTokens(i: CodeExchangeInput): Promise<CodeExchangeOutput> {\n  return _exchangeCodeForTokensImpl(i);\n}\n\nasync function _exchangeCodeForTokensImpl(i: CodeExchangeInput): Promise<CodeExchangeOutput> {\n  const fetchFn = i.fetchImpl ?? fetch;\n\n  const body: Record<string, string> = {\n    grant_type: 'authorization_code',\n    code: i.code,\n    clientId: i.clientId,\n    codeVerifier: i.codeVerifier,\n  };\n  if (i.redirectUri !== undefined) {\n    body['redirectUri'] = i.redirectUri;\n  }\n\n  const trace = i.trace ?? noopTracer;\n  const startedAt = Date.now();\n\n  let response: Response;\n  try {\n    response = await fetchFn(`${i.serverUrl}/oauth/token`, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify(body),\n    });\n  } catch {\n    trace(`POST /oauth/token → network error (${Date.now() - startedAt}ms)`);\n    throw new NetworkError('Failed to reach the Ratio server during token exchange.');\n  }\n\n  trace(`POST /oauth/token → ${response.status} (${Date.now() - startedAt}ms)`);\n\n  if (response.status >= 400 && response.status < 500) {\n    throw new ValidationError(\n      \"The authorization code was rejected. Run 'ratio auth login' again.\",\n    );\n  }\n\n  if (response.status >= 500 || !response.ok) {\n    throw new NetworkError('The Ratio server returned an error during token exchange.');\n  }\n\n  let raw: unknown;\n  try {\n    raw = await response.json();\n  } catch {\n    throw new ValidationError('Token response was not valid JSON.');\n  }\n\n  const parsed = TokenResponseSchema.safeParse(raw);\n  if (!parsed.success) {\n    throw new ValidationError('Token response shape was unexpected. Run ratio auth login again.');\n  }\n\n  const data = parsed.data;\n  const expiresAt = new Date(Date.now() + data.expires_in * 1000).toISOString();\n\n  const tokens: TokenSet = {\n    accessToken: data.access_token,\n    refreshToken: data.refresh_token,\n    expiresAt,\n  };\n\n  const scopeStr = data.scope ?? '';\n  const scopes = scopeStr.length > 0 ? scopeStr.split(/[\\s,]+/).filter(Boolean) : [];\n\n  const identity: TokenDerivedIdentity = {\n    clientId: i.clientId,\n    merchantId: data.merchant_id ?? 'ratio-cli-dev',\n    scopes,\n  };\n\n  return { tokens, identity };\n}\n","/**\n * Minimal verbose diagnostic seam for the auth flow.\n *\n * When `--verbose` is on, the auth HTTP/loopback boundaries emit ONE line\n * per boundary crossing (method, path, status, timing, flow events) so a\n * failing login/refresh can be diagnosed from the CLI transcript alone.\n *\n * Safety contract (enforced by tests):\n *  - Lines go to STDERR only — never stdout — so `--json` consumers and\n *    shell pipelines are never corrupted.\n *  - NO secret material is ever passed to a tracer: no access/refresh\n *    token, no authorization code, no code_verifier, no state value.\n *    Only method, path, HTTP status, port numbers, and durations.\n */\n\n/** A tracer receives one pre-formatted diagnostic message per event. */\nexport type VerboseTracer = (msg: string) => void;\n\n/** Shared no-op used when `--verbose` is off (default everywhere). */\nexport const noopTracer: VerboseTracer = () => {};\n\n/**\n * Build a tracer. Returns the shared no-op unless `verbose` is true.\n * Output sink is injectable for tests; defaults to process.stderr.\n */\nexport function createVerboseTracer(\n  verbose: boolean,\n  write: (line: string) => void = (line) => {\n    process.stderr.write(line);\n  },\n): VerboseTracer {\n  if (!verbose) return noopTracer;\n  return (msg: string) => {\n    write(`[verbose] ${msg}\\n`);\n  };\n}\n","/**\n * HTTP implementation of the TokenRefresher interface.\n *\n * POSTs to /oauth/token with grant_type=refresh_token.\n * Maps 4xx → TokenExpiredError, 5xx/network → NetworkError.\n * Never logs or echoes the token value in any error message.\n */\n\nimport { z } from 'zod';\nimport { NetworkError, TokenExpiredError } from '../errors.js';\nimport type { TokenRefresher, TokenSet } from '../credentials/index.js';\nimport { RATIO_CLI_CLIENT_ID } from './config.js';\nimport { noopTracer } from './verbose-trace.js';\nimport type { VerboseTracer } from './verbose-trace.js';\n\n/** Refresh response envelope — subset of the full token response. */\nconst RefreshResponseSchema = z.object({\n  access_token: z.string().min(1),\n  refresh_token: z.string().min(1),\n  expires_in: z.number().int().positive(),\n});\n\nexport interface HttpTokenRefresherOptions {\n  readonly serverUrl: string;\n  readonly clientId: typeof RATIO_CLI_CLIENT_ID;\n  readonly fetchImpl?: typeof fetch;  // injectable for tests\n  /** Verbose diagnostic sink — never receives the refresh token value. */\n  readonly trace?: VerboseTracer;\n}\n\nexport class HttpTokenRefresher implements TokenRefresher {\n  private readonly serverUrl: string;\n  private readonly clientId: string;\n  private readonly fetchImpl: typeof fetch;\n  private readonly trace: VerboseTracer;\n\n  constructor(opts: HttpTokenRefresherOptions) {\n    this.serverUrl = opts.serverUrl;\n    this.clientId = opts.clientId;\n    this.fetchImpl = opts.fetchImpl ?? fetch;\n    this.trace = opts.trace ?? noopTracer;\n  }\n\n  async refresh(refreshToken: string): Promise<TokenSet> {\n    const body = {\n      grant_type: 'refresh_token',\n      refresh_token: refreshToken,\n      clientId: this.clientId,\n    };\n\n    this.trace('refresh: fired (access token expired or expiring)');\n    const startedAt = Date.now();\n\n    let response: Response;\n    try {\n      response = await this.fetchImpl(`${this.serverUrl}/oauth/token`, {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify(body),\n      });\n    } catch {\n      this.trace(`POST /oauth/token → network error (${Date.now() - startedAt}ms)`);\n      throw new NetworkError('Failed to reach the Ratio server during token refresh.');\n    }\n\n    this.trace(`POST /oauth/token → ${response.status} (${Date.now() - startedAt}ms)`);\n\n    if (response.status >= 400 && response.status < 500) {\n      throw new TokenExpiredError(\n        'Your session has expired and could not be refreshed.',\n      );\n    }\n\n    if (response.status >= 500 || !response.ok) {\n      throw new NetworkError('The Ratio server returned an error during token refresh.');\n    }\n\n    let raw: unknown;\n    try {\n      raw = await response.json();\n    } catch {\n      throw new NetworkError('Token refresh response was not valid JSON.');\n    }\n\n    const parsed = RefreshResponseSchema.safeParse(raw);\n    if (!parsed.success) {\n      throw new TokenExpiredError(\n        'Your session has expired and could not be refreshed.',\n      );\n    }\n\n    const data = parsed.data;\n    const expiresAt = new Date(Date.now() + data.expires_in * 1000).toISOString();\n\n    return {\n      accessToken: data.access_token,\n      refreshToken: data.refresh_token,\n      expiresAt,\n    };\n  }\n}\n","/**\n * Ephemeral loopback HTTP server for the OAuth browser callback.\n *\n * Binds 127.0.0.1:0 (OS-assigned port). Awaits ONE GET /callback\n * request with ?code=...&state=... query parameters, verifies the state\n * via timingSafeEqualState, closes the server, and resolves.\n *\n * Security properties:\n *  - Binds 127.0.0.1 only — never 0.0.0.0 or ::\n *  - Port is OS-assigned (listen(0)) — never hardcoded\n *  - State compared via timingSafeEqual — no fast-fail timing side channel\n *  - Server closes on success, timeout, or state mismatch — no port leak\n *  - Non-callback paths receive a 404 response\n */\n\nimport http from 'node:http';\nimport { NotLoggedInError, ValidationError } from '../errors.js';\nimport { timingSafeEqualState } from './state.js';\nimport { noopTracer } from './verbose-trace.js';\nimport type { VerboseTracer } from './verbose-trace.js';\n\nexport interface LoopbackAwaitOptions {\n  readonly expectedState: string;\n  readonly timeoutMs: number;   // default 30_000 for prod, injectable for tests\n  readonly signal?: AbortSignal;\n  /** Verbose diagnostic sink — never receives code/state values. */\n  readonly trace?: VerboseTracer;\n}\n\nexport interface LoopbackAwaitResult {\n  readonly code: string;\n  readonly redirectUri: string;  // http://127.0.0.1:<actualPort>/callback\n}\n\n/**\n * Binds 127.0.0.1:0, awaits ONE GET /callback?code=...&state=..., verifies\n * state via timingSafeEqual against expectedState, closes the server cleanly,\n * resolves with { code, redirectUri }. On timeout or state mismatch or\n * non-callback request path, rejects with the appropriate typed error.\n */\nexport function awaitLoopbackCallback(o: LoopbackAwaitOptions): Promise<LoopbackAwaitResult> {\n  const trace = o.trace ?? noopTracer;\n  return new Promise((resolve, reject) => {\n    let settled = false;\n\n    function settle(fn: () => void): void {\n      if (settled) return;\n      settled = true;\n      server.close(() => fn());\n    }\n\n    const server = http.createServer((req, res) => {\n      const reqUrl = new URL(req.url ?? '/', `http://127.0.0.1`);\n\n      if (reqUrl.pathname !== '/callback') {\n        res.writeHead(404, { 'Content-Type': 'text/plain' });\n        res.end('Not found');\n        return;\n      }\n\n      const code = reqUrl.searchParams.get('code');\n      const state = reqUrl.searchParams.get('state');\n\n      if (!state || !timingSafeEqualState(state, o.expectedState)) {\n        trace('callback: state mismatch');\n        res.writeHead(400, { 'Content-Type': 'text/plain' });\n        res.end('State mismatch');\n        settle(() =>\n          reject(\n            new ValidationError('Authorization callback failed a security check.'),\n          ),\n        );\n        return;\n      }\n\n      if (!code || code.length === 0) {\n        trace('callback: missing code');\n        res.writeHead(400, { 'Content-Type': 'text/plain' });\n        res.end('Missing code');\n        settle(() =>\n          reject(\n            new ValidationError('Authorization callback did not return a code.'),\n          ),\n        );\n        return;\n      }\n\n      res.writeHead(200, { 'Content-Type': 'text/html' });\n      res.end('<html><body><h1>Signed in! You can close this tab.</h1></body></html>');\n\n      const addr = server.address();\n      const port = typeof addr === 'object' && addr !== null ? addr.port : 0;\n      const redirectUri = `http://127.0.0.1:${port}/callback`;\n\n      trace(`callback: received on port ${port} (state ok)`);\n      settle(() => resolve({ code, redirectUri }));\n    });\n\n    server.on('error', (err) => {\n      settle(() => reject(err));\n    });\n\n    server.listen(0, '127.0.0.1', () => {\n      const boundAddr = server.address();\n      const boundPort =\n        typeof boundAddr === 'object' && boundAddr !== null ? boundAddr.port : 0;\n      trace(`loopback: bound 127.0.0.1:${boundPort}`);\n\n      const timer = setTimeout(() => {\n        trace(`callback: timeout fired after ${o.timeoutMs}ms`);\n        settle(() =>\n          reject(\n            new NotLoggedInError(\n              \"Browser flow timed out. Run 'ratio auth login --manual' to complete without a browser.\",\n            ),\n          ),\n        );\n      }, o.timeoutMs);\n\n      // Allow process to exit if only this timer remains.\n      if (typeof timer.unref === 'function') {\n        timer.unref();\n      }\n\n      if (o.signal) {\n        o.signal.addEventListener('abort', () => {\n          trace('callback: cancelled');\n          clearTimeout(timer);\n          settle(() =>\n            reject(\n              new NotLoggedInError(\n                \"Browser flow was cancelled. Run 'ratio auth login --manual' to complete without a browser.\",\n              ),\n            ),\n          );\n        });\n      }\n    });\n  });\n}\n\n/**\n * Return the loopback callback URI for a given port.\n */\nexport function buildLoopbackRedirectUri(port: number): string {\n  return `http://127.0.0.1:${port}/callback`;\n}\n\nexport interface LoopbackSession {\n  /** The OS-assigned port the server is bound to. */\n  readonly port: number;\n  /** The full redirect URI to send in the authorize URL. */\n  readonly redirectUri: string;\n  /**\n   * Await the single callback. Resolves with the code, rejects on timeout\n   * or state mismatch. The server is closed when this promise settles.\n   */\n  awaitCallback(opts: Omit<LoopbackAwaitOptions, 'timeoutMs'> & { timeoutMs?: number }): Promise<LoopbackAwaitResult>;\n}\n\n/**\n * Two-phase API: start the server first (to get the port for the authorize URL),\n * then await the callback after the browser has been opened.\n *\n * Usage:\n *   const session = await startLoopbackSession();\n *   const url = buildBrowserAuthorizeUrl({ redirectUri: session.redirectUri, ... });\n *   await opener.open(url);\n *   const { code } = await session.awaitCallback({ expectedState, timeoutMs: 30_000 });\n */\nexport function startLoopbackSession(trace: VerboseTracer = noopTracer): Promise<LoopbackSession> {\n  return new Promise((resolve, reject) => {\n    let settled = false;\n\n    function settle(fn: () => void): void {\n      if (settled) return;\n      settled = true;\n      fn();\n    }\n\n    const server = http.createServer();\n    server.on('error', reject);\n    server.listen(0, '127.0.0.1', () => {\n      const addr = server.address();\n      const port = typeof addr === 'object' && addr !== null ? addr.port : 0;\n      const redirectUri = buildLoopbackRedirectUri(port);\n\n      trace(`loopback: bound 127.0.0.1:${port}`);\n\n      resolve({\n        port,\n        redirectUri,\n        awaitCallback(\n          opts: Omit<LoopbackAwaitOptions, 'timeoutMs'> & { timeoutMs?: number },\n        ): Promise<LoopbackAwaitResult> {\n          const timeoutMs = opts.timeoutMs ?? 30_000;\n\n          return new Promise((res, rej) => {\n            server.on('request', (req, response) => {\n              const reqUrl = new URL(req.url ?? '/', `http://127.0.0.1`);\n\n              if (reqUrl.pathname !== '/callback') {\n                response.writeHead(404, { 'Content-Type': 'text/plain' });\n                response.end('Not found');\n                return;\n              }\n\n              const code = reqUrl.searchParams.get('code');\n              const state = reqUrl.searchParams.get('state');\n\n              if (!state || !timingSafeEqualState(state, opts.expectedState)) {\n                trace('callback: state mismatch');\n                response.writeHead(400, { 'Content-Type': 'text/plain' });\n                response.end('State mismatch');\n                settle(() => {\n                  clearTimeout(timer);\n                  server.close(() =>\n                    rej(new ValidationError('Authorization callback failed a security check.')),\n                  );\n                });\n                return;\n              }\n\n              if (!code || code.length === 0) {\n                trace('callback: missing code');\n                response.writeHead(400, { 'Content-Type': 'text/plain' });\n                response.end('Missing code');\n                settle(() => {\n                  clearTimeout(timer);\n                  server.close(() =>\n                    rej(new ValidationError('Authorization callback did not return a code.')),\n                  );\n                });\n                return;\n              }\n\n              response.writeHead(200, { 'Content-Type': 'text/html' });\n              response.end(\n                '<html><body><h1>Signed in! You can close this tab.</h1></body></html>',\n              );\n\n              trace(`callback: received on port ${port} (state ok)`);\n              settle(() => {\n                clearTimeout(timer);\n                server.close(() => res({ code, redirectUri }));\n              });\n            });\n\n            const timer = setTimeout(() => {\n              trace(`callback: timeout fired after ${timeoutMs}ms`);\n              settle(() => {\n                server.close(() =>\n                  rej(\n                    new NotLoggedInError(\n                      \"Browser flow timed out. Run 'ratio auth login --manual' to complete without a browser.\",\n                    ),\n                  ),\n                );\n              });\n            }, timeoutMs);\n\n            if (typeof timer.unref === 'function') {\n              timer.unref();\n            }\n\n            if (opts.signal) {\n              opts.signal.addEventListener('abort', () => {\n                trace('callback: cancelled');\n                clearTimeout(timer);\n                settle(() => {\n                  server.close(() =>\n                    rej(\n                      new NotLoggedInError(\n                        \"Browser flow was cancelled. Run 'ratio auth login --manual' to complete without a browser.\",\n                      ),\n                    ),\n                  );\n                });\n              });\n            }\n          });\n        },\n      });\n    });\n  });\n}\n","/**\n * Browser-launch wrapper for the OAuth browser flow.\n *\n * This is the SOLE file that imports from the 'open' npm package.\n * Injectable via the BrowserOpener interface for unit tests.\n */\n\nimport { NotLoggedInError } from '../errors.js';\n\nexport interface BrowserOpener {\n  open(url: string): Promise<void>;\n}\n\n/**\n * Create the default browser opener backed by the 'open' package.\n * Throws NotLoggedInError on failure with the --manual fallback hint.\n */\nexport function defaultBrowserOpener(): BrowserOpener {\n  return {\n    async open(url: string): Promise<void> {\n      // Dynamic import is used so the module is loadable in test environments\n      // that do not have a display (CI / SSH). The real 'open' call only fires\n      // in production use when this opener is not replaced by a test double.\n      let openFn: (url: string) => Promise<unknown>;\n      try {\n        const mod = await import('open');\n        openFn = mod.default as (url: string) => Promise<unknown>;\n      } catch {\n        throw new NotLoggedInError(\n          \"Could not open a browser. Run 'ratio auth login --manual' to complete without a browser.\",\n        );\n      }\n      try {\n        await openFn(url);\n      } catch {\n        throw new NotLoggedInError(\n          \"Could not open a browser. Run 'ratio auth login --manual' to complete without a browser.\",\n        );\n      }\n    },\n  };\n}\n","/**\n * Stdin prompt for the --manual copy-paste OAuth flow.\n *\n * Uses node:readline/promises so it is awaitable and testable with\n * an injectable interface. The defaultStdinPrompt() function is the\n * production implementation; tests inject a fake.\n */\n\nimport { createInterface } from 'node:readline/promises';\nimport { stdin as input, stdout as output } from 'node:process';\n\nexport interface StdinPrompt {\n  askForCode(prompt: string): Promise<string>;\n}\n\n/**\n * Create the default stdin prompter backed by node:readline/promises.\n * Trims whitespace from the pasted code.\n */\nexport function defaultStdinPrompt(): StdinPrompt {\n  return {\n    async askForCode(prompt: string): Promise<string> {\n      const rl = createInterface({ input, output });\n      try {\n        const answer = await rl.question(prompt);\n        return answer.trim();\n      } finally {\n        rl.close();\n      }\n    },\n  };\n}\n"],"mappings":";AAAA,SAAS,SAAAA,QAAO,UAAU;;;ACA1B,SAAS,SAAS,cAAc;;;ACUzB,IAAM,gBAAN,cAA4B,MAAM;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,MAMT;AACD,UAAM,KAAK,OAAO;AAClB,SAAK,OAAO,WAAW;AACvB,SAAK,OAAO,KAAK;AACjB,SAAK,WAAW,KAAK;AACrB,QAAI,KAAK,SAAS,OAAW,MAAK,OAAO,KAAK;AAC9C,QAAI,KAAK,YAAY,OAAW,MAAK,UAAU,KAAK;AAAA,EACtD;AACF;AAUO,IAAM,mBAAN,cAA+B,cAAc;AAAA,EAClD,YACE,SACA,OAAe,sCACf;AACA,UAAM,EAAE,MAAM,iBAAiB,UAAU,GAAG,SAAS,KAAK,CAAC;AAAA,EAC7D;AACF;AAEO,IAAM,oBAAN,cAAgC,cAAc;AAAA,EACnD,YACE,SACA,OAAe,mDACf;AACA,UAAM,EAAE,MAAM,iBAAiB,UAAU,GAAG,SAAS,KAAK,CAAC;AAAA,EAC7D;AACF;AAcO,IAAM,eAAN,cAA2B,cAAc;AAAA,EAC9C,YAAY,SAAiB,OAAe,iCAAiC;AAC3E,UAAM,EAAE,MAAM,iBAAiB,UAAU,GAAG,SAAS,KAAK,CAAC;AAAA,EAC7D;AACF;AAoBO,IAAM,kBAAN,cAA8B,cAAc;AAAA,EACjD,YAAY,SAAiB,MAAe;AAC1C,UAAM,OAA2E;AAAA,MAC/E,MAAM;AAAA,MACN,UAAU;AAAA,MACV;AAAA,IACF;AACA,QAAI,SAAS,OAAW,MAAK,OAAO;AACpC,UAAM,IAAI;AAAA,EACZ;AACF;AA6BO,SAAS,gBAAgB,KAAoC;AAClE,SAAO,eAAe;AACxB;;;ACjHA,SAAS,mBAAmB,KAAiD;AAC3E,SACE,eAAe,SACf,WAAW,OACX,IAAI,UAAU,QACd,IAAI,UAAU;AAElB;AAMA,SAAS,mBACP,MACA,SACA,MACA,SACQ;AACR,QAAM,MAA+B,EAAE,IAAI,OAAO,MAAM,QAAQ;AAChE,MAAI,SAAS,OAAW,KAAI,MAAM,IAAI;AACtC,MAAI,YAAY,OAAW,KAAI,SAAS,IAAI;AAC5C,SAAO,KAAK,UAAU,GAAG,IAAI;AAC/B;AAsBO,SAAS,YAAYC,QAAkC;AAC5D,QAAM,EAAE,KAAK,SAAS,KAAK,IAAIA;AAG/B,MAAI,gBAAgB,GAAG,GAAG;AACxB,UAAM,WAAW;AAGjB,QAAI,SAAS,aAAa,GAAG;AAC3B,UAAI,MAAM;AACR,eAAO;AAAA,UACL,QAAQ,KAAK,UAAU,EAAE,IAAI,MAAM,MAAM,KAAK,CAAC,IAAI;AAAA,UACnD,QAAQ;AAAA,UACR,UAAU;AAAA,QACZ;AAAA,MACF;AACA,aAAO;AAAA,QACL,QAAQ,SAAS,UAAU;AAAA,QAC3B,QAAQ;AAAA,QACR,UAAU;AAAA,MACZ;AAAA,IACF;AAGA,QAAI,cAAc,GAAG,SAAS,IAAI,KAAK,SAAS,OAAO;AAAA;AACvD,QAAI,SAAS,SAAS,OAAW,gBAAe,GAAG,SAAS,IAAI;AAAA;AAChE,QAAI,SAAS,YAAY,OAAW,gBAAe,GAAG,SAAS,OAAO;AAAA;AAEtE,QAAI,MAAM;AACR,aAAO;AAAA,QACL,QAAQ,mBAAmB,SAAS,MAAM,SAAS,SAAS,SAAS,MAAM,SAAS,OAAO;AAAA,QAC3F,QAAQ,WAAW,SAAS,QAAQ,SAAS,QAAQ,OAAO;AAAA,QAC5D,UAAU,SAAS;AAAA,MACrB;AAAA,IACF;AAEA,QAAI,WAAW,SAAS,OAAO;AAC7B,qBAAe,SAAS,QAAQ;AAAA,IAClC;AAEA,WAAO,EAAE,QAAQ,IAAI,QAAQ,aAAa,UAAU,SAAS,SAAS;AAAA,EACxE;AAGA,MAAI,mBAAmB,GAAG,GAAG;AAC3B,UAAM,YAAY;AAClB,UAAM,MAAM,UAAU,WAAW;AAIjC,UAAM,aAAa,IAAI,gBAAgB,GAAG;AAE1C,QAAIC,cAAa,GAAG,WAAW,IAAI,KAAK,GAAG;AAAA;AAE3C,QAAI,MAAM;AACR,aAAO;AAAA,QACL,QAAQ,mBAAmB,WAAW,MAAM,GAAG;AAAA,QAC/C,QAAQ,WAAW,UAAU,QAAQ,UAAU,QAAQ,OAAO;AAAA,QAC9D,UAAU;AAAA,MACZ;AAAA,IACF;AAEA,QAAI,WAAW,UAAU,OAAO;AAC9B,MAAAA,eAAc,UAAU,QAAQ;AAAA,IAClC;AAEA,WAAO,EAAE,QAAQ,IAAI,QAAQA,aAAY,UAAU,EAAE;AAAA,EACvD;AAGA,QAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,QAAM,QAAQ,eAAe,QAAQ,IAAI,QAAQ;AACjD,QAAM,eAAe,aAAa,OAAO;AAAA;AAEzC,MAAI,MAAM;AACR,WAAO;AAAA,MACL,QAAQ,mBAAmB,YAAY,OAAO;AAAA,MAC9C,QAAQ,WAAW,QAAQ,QAAQ,OAAO;AAAA,MAC1C,UAAU;AAAA,IACZ;AAAA,EACF;AAEA,MAAI,aAAa;AACjB,MAAI,WAAW,OAAO;AACpB,kBAAc,QAAQ;AAAA,EACxB;AAEA,SAAO,EAAE,QAAQ,IAAI,QAAQ,YAAY,UAAU,EAAE;AACvD;;;AFlHO,IAAe,eAAf,cAAoC,QAAQ;AAAA,EACzC,kBAAuD;AAC7D,UAAM,OAAO,KAAK;AAClB,WAAO;AAAA,MACL,SAAS,KAAK,SAAS,WAAW;AAAA,MAClC,MAAM,KAAK,SAAS,QAAQ;AAAA,IAC9B;AAAA,EACF;AAAA,EAEA,MAAe,MACb,KAKgB;AAChB,UAAM,EAAE,SAAS,KAAK,IAAI,KAAK,gBAAgB;AAE/C,UAAMC,UAAS,YAAY,EAAE,KAAK,SAAS,KAAK,CAAC;AAGjD,QAAIA,QAAO,OAAQ,SAAQ,OAAO,MAAMA,QAAO,MAAM;AACrD,QAAIA,QAAO,OAAQ,SAAQ,OAAO,MAAMA,QAAO,MAAM;AAErD,QAAIA,QAAO,aAAa,GAAG;AAIzB,YAAM,IAAI,OAAO,UAAU,CAAC;AAAA,IAC9B;AAIA,QAAI,yBAAyB;AAC7B,QAAI,QAAQ,EAAE,MAAMA,QAAO,SAAS;AACpC,UAAM;AAAA,EACR;AACF;;;AG9EA,SAAS,aAAa;AAGf,IAAM,cAAc;AAAA,EACzB,SAAS,MAAM,QAAQ;AAAA,IACrB,aACE;AAAA,EACJ,CAAC;AACH;AAGO,IAAM,WAAW;AAAA,EACtB,MAAM,MAAM,QAAQ;AAAA,IAClB,aAAa;AAAA,EACf,CAAC;AACH;;;ACAO,IAAM,cAAN,MAAmC;AAAA,EACxC,MAAc;AACZ,WAAO,KAAK,IAAI;AAAA,EAClB;AACF;;;ACNA,OAAO,QAAQ;AACf,OAAO,UAAU;AASjB,SAAS,kBAA2B;AAClC,QAAM,WAA2D,CAAC;AAClE,QAAM,gBAAgB,QAAQ,IAAI,iBAAiB;AACnD,MAAI,kBAAkB,QAAW;AAC/B,aAAS,kBAAkB;AAAA,EAC7B;AACA,QAAM,UAAU,QAAQ,IAAI,SAAS;AACrC,MAAI,YAAY,QAAW;AACzB,aAAS,UAAU;AAAA,EACrB;AACA,SAAO;AACT;AAQO,SAAS,uBACd,UACA,SACA,KACQ;AACR,QAAM,mBAAmB,YAAY,QAAQ;AAC7C,QAAM,eAAe,WAAW,GAAG,QAAQ;AAC3C,QAAM,cAAc,OAAO,gBAAgB;AAE3C,MAAI,qBAAqB,SAAS;AAChC,UAAM,UAAU,YAAY;AAC5B,UAAMC,QACJ,YAAY,UAAa,YAAY,KACjC,UACA,KAAK,MAAM,KAAK,cAAc,WAAW,SAAS;AACxD,WAAO,KAAK,MAAM,KAAKA,OAAM,SAAS,aAAa;AAAA,EACrD;AAEA,QAAM,gBAAgB,YAAY;AAClC,QAAM,OACJ,OAAO,kBAAkB,YAAY,kBAAkB,KACnD,gBACA,KAAK,MAAM,KAAK,cAAc,SAAS;AAC7C,SAAO,KAAK,MAAM,KAAK,MAAM,SAAS,aAAa;AACrD;;;AC3CO,IAAM,0BAAN,MAAwD;AAAA,EAC7D,MAAM,QAAQ,cAAyC;AAErD,SAAK;AACL,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;;;ACVA,OAAO,YAAY;AACnB,OAAO,QAAQ;AACf,SAAS,eAAe;;;ACdxB,SAAS,SAAS;AAIlB,IAAM,iBAAiB,EACpB,OAAO;AAAA,EACN,aAAa,EAAE,OAAO;AAAA,EACtB,OAAO,EAAE,OAAO;AAAA;AAAA;AAAA,EAGhB,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AACvC,CAAC,EACA,OAAO;AAEV,IAAM,gBAAgB,EACnB,OAAO;AAAA,EACN,aAAa,EAAE,OAAO;AAAA,EACtB,cAAc,EAAE,OAAO;AAAA,EACvB,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAC/C,UAAU;AAAA,EACV,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAClD,CAAC,EACA,OAAO;AAEV,IAAM,yBAAyB,EAC5B,OAAO;AAAA,EACN,KAAK,EAAE,OAAO;AAAA,EACd,aAAa,EAAE,OAAO;AAAA,EACtB,OAAO,EAAE,OAAO;AAAA,EAChB,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAC/C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAClD,CAAC,EACA,OAAO;AAGH,IAAM,oBAAoB,EAC9B,OAAO;AAAA,EACN,SAAS,EAAE,QAAQ,CAAC;AAAA,EACpB,QAAQ,EAAE,OAAO;AAAA,EACjB,UAAU,EAAE,OAAO;AAAA,EACnB,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,aAAa;AAAA;AAAA;AAAA,EAG5C,WAAW,uBAAuB,SAAS;AAC7C,CAAC,EACA,OAAO;AAUH,SAAS,iBAAiBC,QAA6B;AAC5D,MAAI,OAAOA,WAAU,YAAYA,WAAU,QAAQ,aAAaA,QAAO;AACrE,UAAM,UAAWA,OAA+B;AAChD,QAAI,YAAY,GAAG;AACjB,YAAM,QAAQ,OAAO,YAAY,WAAW,OAAO,OAAO,IAAI;AAC9D,YAAM,IAAI;AAAA,QACR,4BAA4B,KAAK;AAAA,MACnC;AAAA,IACF;AAAA,EACF;AAEA,QAAM,SAAS,kBAAkB,UAAUA,MAAK;AAChD,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO,OAAO;AAChB;;;AD7CA,IAAM,oBAAoB;AAG1B,IAAM,gBAAgB;AAQtB,IAAM,0BAA0B;AAkDhC,SAAS,aAAa,KAAc,MAAuB;AACzD,SACE,eAAe,SACd,IAA8B,SAAS;AAE5C;AAEO,IAAM,sBAAN,MAAqD;AAAA,EACzC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAGA;AAAA,EAEjB,YAAY,MAA+B;AACzC,SAAK,WAAW,MAAM,YAAY,uBAAuB;AACzD,SAAK,QAAQ,MAAM,SAAS,IAAI,YAAY;AAC5C,SAAK,YAAY,MAAM,aAAa,IAAI,wBAAwB;AAChE,SAAK,YAAY,MAAM,cAAc,MAAM,QAAQ;AACnD,SAAK,WAAW,MAAM,YAAY,QAAQ;AAAA,EAC5C;AAAA,EAEA,MAAM,OAA6B;AACjC,SAAK,yBAAyB;AAE9B,QAAI;AACJ,QAAI;AACF,YAAM,GAAG,aAAa,KAAK,UAAU,MAAM;AAAA,IAC7C,SAAS,KAAK;AACZ,UAAI,aAAa,KAAK,QAAQ,GAAG;AAC/B,cAAM,IAAI,iBAAiB,wBAAwB;AAAA,MACrD;AACA,YAAM;AAAA,IACR;AAEA,QAAI;AACJ,QAAI;AACF,eAAS,KAAK,MAAM,GAAG;AAAA,IACzB,QAAQ;AAEN,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,WAAO,iBAAiB,MAAM;AAAA,EAChC;AAAA,EAEA,MAAM,KAAK,OAAmC;AAC5C,UAAM,MAAM,QAAQ,KAAK,QAAQ;AACjC,OAAG,UAAU,KAAK,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AAClD,QAAI,KAAK,aAAa,SAAS;AAE7B,SAAG,UAAU,KAAK,GAAK;AAAA,IACzB;AAEA,UAAM,UAAU,GAAG,KAAK,QAAQ,IAAI,QAAQ,GAAG,IAAI,OAChD,YAAY,CAAC,EACb,SAAS,KAAK,CAAC;AAClB,QAAI;AAEF,SAAG,cAAc,SAAS,KAAK,UAAU,OAAO,MAAM,CAAC,GAAG;AAAA,QACxD,MAAM;AAAA,MACR,CAAC;AACD,SAAG,WAAW,SAAS,KAAK,QAAQ;AAAA,IACtC,SAAS,KAAK;AACZ,UAAI;AACF,WAAG,WAAW,OAAO;AAAA,MACvB,QAAQ;AAAA,MAER;AACA,YAAM;AAAA,IACR;AAEA,QAAI,KAAK,aAAa,SAAS;AAE7B,SAAG,UAAU,KAAK,UAAU,GAAK;AAAA,IACnC;AAAA,EACF;AAAA,EAEA,MAAM,QAAuB;AAC3B,QAAI;AACF,SAAG,WAAW,KAAK,QAAQ;AAAA,IAC7B,SAAS,KAAK;AACZ,UAAI,aAAa,KAAK,QAAQ,GAAG;AAC/B;AAAA,MACF;AACA,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAM,oBAAoB,aAAuC;AAC/D,UAAM,WAAW,KAAK,UAAU,EAAE,aAAa;AAC/C,QAAI,OAAO,aAAa,YAAY,SAAS,SAAS,GAAG;AACvD,aAAO;AAAA,IACT;AAEA,UAAM,QAAQ,MAAM,KAAK,KAAK;AAC9B,UAAM,OAAO,eAAe;AAC5B,UAAM,UAAU,MAAM,SAAS,IAAI;AACnC,QAAI,YAAY,QAAW;AACzB,YAAM,IAAI,iBAAiB,wBAAwB;AAAA,IACrD;AAEA,UAAM,gBACJ,IAAI,KAAK,QAAQ,SAAS,EAAE,QAAQ,IAAI,KAAK,MAAM,IAAI;AACzD,QAAI,gBAAgB,mBAAmB;AACrC,aAAO,KAAK,kBAAkB,OAAO,MAAM,OAAO;AAAA,IACpD;AAEA,WAAO,QAAQ;AAAA,EACjB;AAAA,EAEA,MAAM,yBAA0C;AAC9C,UAAM,WAAW,KAAK,UAAU,EAAE,uBAAuB;AACzD,QAAI,OAAO,aAAa,YAAY,SAAS,SAAS,GAAG;AACvD,aAAO;AAAA,IACT;AAEA,QAAI;AACJ,QAAI;AACF,cAAQ,MAAM,KAAK,KAAK;AAAA,IAC1B,SAAS,KAAK;AACZ,UAAI,eAAe,kBAAkB;AACnC,cAAM,IAAI,iBAAiB,4BAA4B;AAAA,MACzD;AACA,YAAM;AAAA,IACR;AAEA,UAAM,UAAU,MAAM;AACtB,QAAI,YAAY,QAAW;AACzB,YAAM,IAAI,iBAAiB,4BAA4B;AAAA,IACzD;AAEA,UAAM,gBACJ,IAAI,KAAK,QAAQ,SAAS,EAAE,QAAQ,IAAI,KAAK,MAAM,IAAI;AACzD,QAAI,gBAAgB,mBAAmB;AAGrC,YAAM,IAAI,iBAAiB,4BAA4B;AAAA,IACzD;AAEA,WAAO,QAAQ;AAAA,EACjB;AAAA,EAEA,MAAM,qBAAqB,SAA0C;AACnE,QAAI;AACJ,QAAI;AACF,cAAQ,MAAM,KAAK,KAAK;AAAA,IAC1B,SAAS,KAAK;AACZ,UAAI,eAAe,kBAAkB;AAGnC,gBAAQ,EAAE,SAAS,GAAG,QAAQ,IAAI,UAAU,IAAI,UAAU,CAAC,EAAE;AAAA,MAC/D,OAAO;AACL,cAAM;AAAA,MACR;AAAA,IACF;AAEA,UAAM,UAAuB;AAAA,MAC3B,GAAG;AAAA,MACH,WAAW;AAAA,IACb;AACA,UAAM,KAAK,KAAK,OAAO;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,kBACZ,OACA,MACA,SACiB;AACjB,QAAI;AACJ,QAAI;AACF,kBAAY,MAAM,KAAK,UAAU,QAAQ,QAAQ,YAAY;AAAA,IAC/D,QAAQ;AACN,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,UAAuB;AAAA,MAC3B,GAAG;AAAA,MACH,UAAU;AAAA,QACR,GAAG,MAAM;AAAA,QACT,CAAC,IAAI,GAAG;AAAA,UACN,GAAG;AAAA,UACH,aAAa,UAAU;AAAA,UACvB,cAAc,UAAU;AAAA,UACxB,WAAW,UAAU;AAAA,QACvB;AAAA,MACF;AAAA,IACF;AACA,UAAM,KAAK,KAAK,OAAO;AACvB,WAAO,UAAU;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,2BAAiC;AACvC,QAAI,KAAK,aAAa,SAAS;AAC7B;AAAA,IACF;AAEA,QAAI;AACJ,QAAI;AACF,aAAO,GAAG,SAAS,KAAK,QAAQ;AAAA,IAClC,SAAS,KAAK;AACZ,UAAI,aAAa,KAAK,QAAQ,GAAG;AAC/B;AAAA,MACF;AACA,YAAM;AAAA,IACR;AAEA,UAAM,OAAO,KAAK,OAAO;AACzB,QAAI,SAAS,KAAO;AAClB,SAAG,UAAU,KAAK,UAAU,GAAK;AACjC,cAAQ,OAAO;AAAA,QACb,8CAA8C,KAAK,SAAS,CAAC,CAAC;AAAA;AAAA,MAChE;AAAA,IACF;AAAA,EACF;AACF;;;AEvUA,OAAOC,aAAY;AAaZ,SAAS,qBAAqB,cAA8B;AACjE,SAAOA,QAAO,WAAW,QAAQ,EAAE,OAAO,cAAc,OAAO,EAAE,OAAO,WAAW;AACrF;AAMO,SAAS,mBAA6B;AAC3C,QAAM,eAAeA,QAAO,YAAY,EAAE,EAAE,SAAS,WAAW;AAChE,QAAM,gBAAgB,qBAAqB,YAAY;AACvD,SAAO,EAAE,cAAc,eAAe,qBAAqB,OAAO;AACpE;;;ACzBA,OAAOC,aAAY;AAMZ,SAAS,gBAAwB;AACtC,SAAOA,QAAO,YAAY,EAAE,EAAE,SAAS,WAAW;AACpD;AAQO,SAAS,qBAAqB,GAAW,GAAoB;AAClE,QAAM,OAAO,OAAO,KAAK,GAAG,MAAM;AAClC,QAAM,OAAO,OAAO,KAAK,GAAG,MAAM;AAClC,MAAI,KAAK,WAAW,KAAK,QAAQ;AAE/B,IAAAA,QAAO,gBAAgB,MAAM,IAAI;AACjC,WAAO;AAAA,EACT;AACA,SAAOA,QAAO,gBAAgB,MAAM,IAAI;AAC1C;;;AChBO,IAAM,qBAAqB;AAQ3B,IAAM,wBAAwB;AAG9B,IAAM,sBAAsB;AAe5B,SAAS,iBAAiB,MAAwC;AACvE,QAAM,MAAM,MAAM,OAAO,QAAQ;AACjC,MAAI,OAAO,IAAI,kBAAkB,MAAM,YAAY,IAAI,kBAAkB,EAAE,SAAS,GAAG;AACrF,WAAO,IAAI,kBAAkB;AAAA,EAC/B;AACA,MAAI,OAAO,MAAM,aAAa,WAAW,YAAY,KAAK,YAAY,OAAO,SAAS,GAAG;AACvF,WAAO,KAAK,YAAY;AAAA,EAC1B;AACA,SAAO;AACT;;;AChBO,SAAS,yBAAyB,GAAuC;AAC9E,QAAM,SAAS,IAAI,gBAAgB;AACnC,SAAO,IAAI,aAAa,EAAE,QAAQ;AAClC,SAAO,IAAI,eAAe,EAAE,cAAc,qBAAqB;AAC/D,SAAO,IAAI,kBAAkB,EAAE,aAAa;AAC5C,SAAO,IAAI,yBAAyB,MAAM;AAC1C,SAAO,IAAI,SAAS,EAAE,KAAK;AAC3B,SAAO,IAAI,gBAAgB,EAAE,WAAW;AACxC,MAAI,EAAE,UAAU,EAAE,OAAO,SAAS,GAAG;AACnC,WAAO,IAAI,SAAS,EAAE,OAAO,KAAK,GAAG,CAAC;AAAA,EACxC;AACA,SAAO,GAAG,EAAE,SAAS,oBAAoB,OAAO,SAAS,CAAC;AAC5D;AAOO,SAAS,wBAAwB,GAAsC;AAC5E,QAAM,SAAS,IAAI,gBAAgB;AACnC,SAAO,IAAI,aAAa,EAAE,QAAQ;AAClC,SAAO,IAAI,eAAe,EAAE,cAAc,qBAAqB;AAC/D,SAAO,IAAI,kBAAkB,EAAE,aAAa;AAC5C,SAAO,IAAI,yBAAyB,MAAM;AAC1C,SAAO,IAAI,SAAS,EAAE,KAAK;AAC3B,SAAO,IAAI,gBAAgB,GAAG;AAC9B,MAAI,EAAE,UAAU,EAAE,OAAO,SAAS,GAAG;AACnC,WAAO,IAAI,SAAS,EAAE,OAAO,KAAK,GAAG,CAAC;AAAA,EACxC;AACA,SAAO,GAAG,EAAE,SAAS,oBAAoB,OAAO,SAAS,CAAC;AAC5D;;;AChDA,SAAS,KAAAC,UAAS;;;ACCX,IAAM,aAA4B,MAAM;AAAC;AAMzC,SAAS,oBACd,SACA,QAAgC,CAAC,SAAS;AACxC,UAAQ,OAAO,MAAM,IAAI;AAC3B,GACe;AACf,MAAI,CAAC,QAAS,QAAO;AACrB,SAAO,CAAC,QAAgB;AACtB,UAAM,aAAa,GAAG;AAAA,CAAI;AAAA,EAC5B;AACF;;;ADTA,IAAM,sBAAsBC,GAAE,OAAO;AAAA,EACnC,cAAcA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC9B,eAAeA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC/B,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACtC,YAAYA,GAAE,OAAO,EAAE,SAAS;AAAA,EAChC,OAAOA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,aAAaA,GAAE,OAAO,EAAE,SAAS;AACnC,CAAC;AA8BM,SAAS,sBAAsB,GAAmD;AACvF,SAAO,2BAA2B,CAAC;AACrC;AAEA,eAAe,2BAA2B,GAAmD;AAC3F,QAAM,UAAU,EAAE,aAAa;AAE/B,QAAM,OAA+B;AAAA,IACnC,YAAY;AAAA,IACZ,MAAM,EAAE;AAAA,IACR,UAAU,EAAE;AAAA,IACZ,cAAc,EAAE;AAAA,EAClB;AACA,MAAI,EAAE,gBAAgB,QAAW;AAC/B,SAAK,aAAa,IAAI,EAAE;AAAA,EAC1B;AAEA,QAAM,QAAQ,EAAE,SAAS;AACzB,QAAM,YAAY,KAAK,IAAI;AAE3B,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,QAAQ,GAAG,EAAE,SAAS,gBAAgB;AAAA,MACrD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AAAA,EACH,QAAQ;AACN,UAAM,2CAAsC,KAAK,IAAI,IAAI,SAAS,KAAK;AACvE,UAAM,IAAI,aAAa,yDAAyD;AAAA,EAClF;AAEA,QAAM,4BAAuB,SAAS,MAAM,KAAK,KAAK,IAAI,IAAI,SAAS,KAAK;AAE5E,MAAI,SAAS,UAAU,OAAO,SAAS,SAAS,KAAK;AACnD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,MAAI,SAAS,UAAU,OAAO,CAAC,SAAS,IAAI;AAC1C,UAAM,IAAI,aAAa,2DAA2D;AAAA,EACpF;AAEA,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,SAAS,KAAK;AAAA,EAC5B,QAAQ;AACN,UAAM,IAAI,gBAAgB,oCAAoC;AAAA,EAChE;AAEA,QAAM,SAAS,oBAAoB,UAAU,GAAG;AAChD,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI,gBAAgB,kEAAkE;AAAA,EAC9F;AAEA,QAAM,OAAO,OAAO;AACpB,QAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,aAAa,GAAI,EAAE,YAAY;AAE5E,QAAM,SAAmB;AAAA,IACvB,aAAa,KAAK;AAAA,IAClB,cAAc,KAAK;AAAA,IACnB;AAAA,EACF;AAEA,QAAM,WAAW,KAAK,SAAS;AAC/B,QAAM,SAAS,SAAS,SAAS,IAAI,SAAS,MAAM,QAAQ,EAAE,OAAO,OAAO,IAAI,CAAC;AAEjF,QAAM,WAAiC;AAAA,IACrC,UAAU,EAAE;AAAA,IACZ,YAAY,KAAK,eAAe;AAAA,IAChC;AAAA,EACF;AAEA,SAAO,EAAE,QAAQ,SAAS;AAC5B;;;AElIA,SAAS,KAAAC,UAAS;AAQlB,IAAM,wBAAwBC,GAAE,OAAO;AAAA,EACrC,cAAcA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC9B,eAAeA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC/B,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACxC,CAAC;AAUM,IAAM,qBAAN,MAAmD;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,MAAiC;AAC3C,SAAK,YAAY,KAAK;AACtB,SAAK,WAAW,KAAK;AACrB,SAAK,YAAY,KAAK,aAAa;AACnC,SAAK,QAAQ,KAAK,SAAS;AAAA,EAC7B;AAAA,EAEA,MAAM,QAAQ,cAAyC;AACrD,UAAM,OAAO;AAAA,MACX,YAAY;AAAA,MACZ,eAAe;AAAA,MACf,UAAU,KAAK;AAAA,IACjB;AAEA,SAAK,MAAM,mDAAmD;AAC9D,UAAM,YAAY,KAAK,IAAI;AAE3B,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,KAAK,UAAU,GAAG,KAAK,SAAS,gBAAgB;AAAA,QAC/D,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU,IAAI;AAAA,MAC3B,CAAC;AAAA,IACH,QAAQ;AACN,WAAK,MAAM,2CAAsC,KAAK,IAAI,IAAI,SAAS,KAAK;AAC5E,YAAM,IAAI,aAAa,wDAAwD;AAAA,IACjF;AAEA,SAAK,MAAM,4BAAuB,SAAS,MAAM,KAAK,KAAK,IAAI,IAAI,SAAS,KAAK;AAEjF,QAAI,SAAS,UAAU,OAAO,SAAS,SAAS,KAAK;AACnD,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,QAAI,SAAS,UAAU,OAAO,CAAC,SAAS,IAAI;AAC1C,YAAM,IAAI,aAAa,0DAA0D;AAAA,IACnF;AAEA,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,SAAS,KAAK;AAAA,IAC5B,QAAQ;AACN,YAAM,IAAI,aAAa,4CAA4C;AAAA,IACrE;AAEA,UAAM,SAAS,sBAAsB,UAAU,GAAG;AAClD,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,OAAO,OAAO;AACpB,UAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,aAAa,GAAI,EAAE,YAAY;AAE5E,WAAO;AAAA,MACL,aAAa,KAAK;AAAA,MAClB,cAAc,KAAK;AAAA,MACnB;AAAA,IACF;AAAA,EACF;AACF;;;ACrFA,OAAO,UAAU;AAiIV,SAAS,yBAAyB,MAAsB;AAC7D,SAAO,oBAAoB,IAAI;AACjC;AAwBO,SAAS,qBAAqB,QAAuB,YAAsC;AAChG,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,QAAI,UAAU;AAEd,aAAS,OAAO,IAAsB;AACpC,UAAI,QAAS;AACb,gBAAU;AACV,SAAG;AAAA,IACL;AAEA,UAAM,SAAS,KAAK,aAAa;AACjC,WAAO,GAAG,SAAS,MAAM;AACzB,WAAO,OAAO,GAAG,aAAa,MAAM;AAClC,YAAM,OAAO,OAAO,QAAQ;AAC5B,YAAM,OAAO,OAAO,SAAS,YAAY,SAAS,OAAO,KAAK,OAAO;AACrE,YAAM,cAAc,yBAAyB,IAAI;AAEjD,YAAM,6BAA6B,IAAI,EAAE;AAEzC,cAAQ;AAAA,QACN;AAAA,QACA;AAAA,QACA,cACE,MAC8B;AAC9B,gBAAM,YAAY,KAAK,aAAa;AAEpC,iBAAO,IAAI,QAAQ,CAAC,KAAK,QAAQ;AAC/B,mBAAO,GAAG,WAAW,CAAC,KAAK,aAAa;AACtC,oBAAM,SAAS,IAAI,IAAI,IAAI,OAAO,KAAK,kBAAkB;AAEzD,kBAAI,OAAO,aAAa,aAAa;AACnC,yBAAS,UAAU,KAAK,EAAE,gBAAgB,aAAa,CAAC;AACxD,yBAAS,IAAI,WAAW;AACxB;AAAA,cACF;AAEA,oBAAM,OAAO,OAAO,aAAa,IAAI,MAAM;AAC3C,oBAAM,QAAQ,OAAO,aAAa,IAAI,OAAO;AAE7C,kBAAI,CAAC,SAAS,CAAC,qBAAqB,OAAO,KAAK,aAAa,GAAG;AAC9D,sBAAM,0BAA0B;AAChC,yBAAS,UAAU,KAAK,EAAE,gBAAgB,aAAa,CAAC;AACxD,yBAAS,IAAI,gBAAgB;AAC7B,uBAAO,MAAM;AACX,+BAAa,KAAK;AAClB,yBAAO;AAAA,oBAAM,MACX,IAAI,IAAI,gBAAgB,iDAAiD,CAAC;AAAA,kBAC5E;AAAA,gBACF,CAAC;AACD;AAAA,cACF;AAEA,kBAAI,CAAC,QAAQ,KAAK,WAAW,GAAG;AAC9B,sBAAM,wBAAwB;AAC9B,yBAAS,UAAU,KAAK,EAAE,gBAAgB,aAAa,CAAC;AACxD,yBAAS,IAAI,cAAc;AAC3B,uBAAO,MAAM;AACX,+BAAa,KAAK;AAClB,yBAAO;AAAA,oBAAM,MACX,IAAI,IAAI,gBAAgB,+CAA+C,CAAC;AAAA,kBAC1E;AAAA,gBACF,CAAC;AACD;AAAA,cACF;AAEA,uBAAS,UAAU,KAAK,EAAE,gBAAgB,YAAY,CAAC;AACvD,uBAAS;AAAA,gBACP;AAAA,cACF;AAEA,oBAAM,8BAA8B,IAAI,aAAa;AACrD,qBAAO,MAAM;AACX,6BAAa,KAAK;AAClB,uBAAO,MAAM,MAAM,IAAI,EAAE,MAAM,YAAY,CAAC,CAAC;AAAA,cAC/C,CAAC;AAAA,YACH,CAAC;AAED,kBAAM,QAAQ,WAAW,MAAM;AAC7B,oBAAM,iCAAiC,SAAS,IAAI;AACpD,qBAAO,MAAM;AACX,uBAAO;AAAA,kBAAM,MACX;AAAA,oBACE,IAAI;AAAA,sBACF;AAAA,oBACF;AAAA,kBACF;AAAA,gBACF;AAAA,cACF,CAAC;AAAA,YACH,GAAG,SAAS;AAEZ,gBAAI,OAAO,MAAM,UAAU,YAAY;AACrC,oBAAM,MAAM;AAAA,YACd;AAEA,gBAAI,KAAK,QAAQ;AACf,mBAAK,OAAO,iBAAiB,SAAS,MAAM;AAC1C,sBAAM,qBAAqB;AAC3B,6BAAa,KAAK;AAClB,uBAAO,MAAM;AACX,yBAAO;AAAA,oBAAM,MACX;AAAA,sBACE,IAAI;AAAA,wBACF;AAAA,sBACF;AAAA,oBACF;AAAA,kBACF;AAAA,gBACF,CAAC;AAAA,cACH,CAAC;AAAA,YACH;AAAA,UACF,CAAC;AAAA,QACH;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AAAA,EACH,CAAC;AACH;;;AC5QO,SAAS,uBAAsC;AACpD,SAAO;AAAA,IACL,MAAM,KAAK,KAA4B;AAIrC,UAAI;AACJ,UAAI;AACF,cAAM,MAAM,MAAM,OAAO,MAAM;AAC/B,iBAAS,IAAI;AAAA,MACf,QAAQ;AACN,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,UAAI;AACF,cAAM,OAAO,GAAG;AAAA,MAClB,QAAQ;AACN,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;;;ACjCA,SAAS,uBAAuB;AAChC,SAAS,SAAS,OAAO,UAAU,cAAc;AAU1C,SAAS,qBAAkC;AAChD,SAAO;AAAA,IACL,MAAM,WAAW,QAAiC;AAChD,YAAM,KAAK,gBAAgB,EAAE,OAAO,OAAO,CAAC;AAC5C,UAAI;AACF,cAAM,SAAS,MAAM,GAAG,SAAS,MAAM;AACvC,eAAO,OAAO,KAAK;AAAA,MACrB,UAAE;AACA,WAAG,MAAM;AAAA,MACX;AAAA,IACF;AAAA,EACF;AACF;;;AnBIA,IAAqB,YAArB,MAAqB,mBAAkB,aAAa;AAAA,EAClD,OAAgB,cAAc;AAAA,EAE9B,OAAgB,WAAW;AAAA,IACzB;AAAA,IACA;AAAA,EACF;AAAA,EAEA,OAAgB,OAAO,CAAC;AAAA,EAExB,OAAgB,QAAQ;AAAA,IACtB,GAAG;AAAA,IACH,QAAQC,OAAM,QAAQ;AAAA,MACpB,aAAa;AAAA,IACf,CAAC;AAAA,IACD,SAASA,OAAM,OAAO;AAAA,MACpB,aAAa;AAAA,MACb,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAAA;AAAA,EAGA,gBAA+B,qBAAqB;AAAA,EACpD,cAA2B,mBAAmB;AAAA,EAC9C,UAAuB,GAAG;AAAA;AAAA,EAE1B,QAAuB;AAAA,EAEvB,MAAa,MAAqB;AAChC,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,MAAM,UAAS;AAE5C,QAAI,MAAM,SAAS;AACjB,WAAK,QAAQ,oBAAoB,IAAI;AAAA,IACvC;AAGA,UAAM,WAAW,QAAQ,IAAI,iBAAiB;AAC9C,QAAI,OAAO,aAAa,YAAY,SAAS,SAAS,GAAG;AACvD,WAAK,IAAI,+CAA0C;AACnD;AAAA,IACF;AAEA,UAAM,YAAY,iBAAiB;AACnC,UAAM,EAAE,cAAc,cAAc,IAAI,iBAAiB;AACzD,UAAM,QAAQ,cAAc;AAC5B,UAAM,cAAc,MAAM,WAAW;AAErC,UAAM,YAAY,IAAI,mBAAmB;AAAA,MACvC;AAAA,MACA,UAAU;AAAA,MACV,OAAO,KAAK;AAAA,IACd,CAAC;AACD,UAAM,QAAQ,IAAI,oBAAoB,EAAE,UAAU,CAAC;AAEnD,QAAI,MAAM,QAAQ;AAChB,YAAM,KAAK,eAAe,WAAW,cAAc,eAAe,OAAO,OAAO,WAAW;AAAA,IAC7F,OAAO;AACL,YAAM,KAAK,gBAAgB,WAAW,cAAc,eAAe,OAAO,OAAO,WAAW;AAAA,IAC9F;AAAA,EACF;AAAA,EAEA,MAAM,gBACJ,WACA,cACA,eACA,OACA,OACA,aACe;AACf,UAAM,UAAU,MAAM,qBAAqB,KAAK,KAAK;AAErD,UAAM,eAAe,yBAAyB;AAAA,MAC5C;AAAA,MACA,UAAU;AAAA,MACV;AAAA,MACA;AAAA,MACA,aAAa,QAAQ;AAAA,IACvB,CAAC;AAED,UAAM,KAAK,cAAc,KAAK,YAAY;AAC1C,SAAK,IAAI,2CAA2C;AAKpD,SAAK,QAAQ,MAAM,6BAA6B;AAChD,QAAI;AACJ,QAAI;AACJ,QAAI;AACF,OAAC,EAAE,MAAM,YAAY,IAAI,MAAM,QAAQ,cAAc;AAAA,QACnD,eAAe;AAAA,QACf,WAAW;AAAA,MACb,CAAC;AAAA,IACH,UAAE;AACA,WAAK,QAAQ,KAAK;AAAA,IACpB;AAEA,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,sBAAsB;AAAA,MACvD;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,UAAU;AAAA,MACV,OAAO,KAAK;AAAA,IACd,CAAC;AAED,UAAM,KAAK,oBAAoB,OAAO,WAAW,aAAa,QAAQ,QAAQ;AAC9E,SAAK,IAAI,yBAAyB,SAAS,QAAQ,eAAe,SAAS,UAAU,EAAE;AAAA,EACzF;AAAA,EAEA,MAAM,eACJ,WACA,cACA,eACA,OACA,OACA,aACe;AACf,UAAM,eAAe,wBAAwB;AAAA,MAC3C;AAAA,MACA,UAAU;AAAA,MACV;AAAA,MACA;AAAA,IACF,CAAC;AAED,SAAK,IAAI,2CAA2C;AACpD,SAAK,IAAI,YAAY;AACrB,SAAK,IAAI,EAAE;AAEX,UAAM,OAAO,MAAM,KAAK,YAAY,WAAW,uCAAuC;AAEtF,QAAI,CAAC,QAAQ,KAAK,WAAW,GAAG;AAC9B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,sBAAsB;AAAA,MACvD;AAAA,MACA;AAAA,MACA;AAAA,MACA,UAAU;AAAA,MACV,OAAO,KAAK;AAAA;AAAA,IAEd,CAAC;AAED,UAAM,KAAK,oBAAoB,OAAO,WAAW,aAAa,QAAQ,QAAQ;AAC9E,SAAK,IAAI,yBAAyB,SAAS,QAAQ,eAAe,SAAS,UAAU,EAAE;AAAA,EACzF;AAAA,EAEA,MAAc,oBACZ,OACA,WACA,aACA,QACA,UACe;AACf,QAAI;AACJ,QAAI;AACF,sBAAgB,MAAM,MAAM,KAAK;AAAA,IACnC,QAAQ;AACN,sBAAgB;AAAA,QACd,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,UAAU;AAAA,QACV,UAAU,CAAC;AAAA,MACb;AAAA,IACF;AAQA,UAAM,UAAuB;AAAA,MAC3B,GAAG;AAAA,MACH,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,UAAU;AAAA,QACR,GAAG,cAAc;AAAA,QACjB,CAAC,WAAW,GAAG;AAAA,UACb,aAAa,OAAO;AAAA,UACpB,cAAc,OAAO;AAAA,UACrB,WAAW,OAAO;AAAA,UAClB,UAAU;AAAA,YACR,aAAa,SAAS;AAAA,YACtB,OAAO;AAAA,YACP,YAAY,SAAS;AAAA,YACrB,QAAQ,CAAC,GAAG,SAAS,MAAM;AAAA,UAC7B;AAAA,UACA,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,QACrC;AAAA,MACF;AAAA,IACF;AAEA,UAAM,MAAM,KAAK,OAAO;AAAA,EAC1B;AACF;","names":["Flags","input","stderrText","output","base","input","crypto","crypto","z","z","z","z","Flags"]}

package/dist/commands/auth/logout.d.ts

@@ -0,0 +1,15 @@
+import * as _oclif_core_interfaces from '@oclif/core/interfaces';
+import { RatioCommand } from '../../lib/ratio-command.js';
+import '@oclif/core';
+
+declare class AuthLogout extends RatioCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        profile: _oclif_core_interfaces.OptionFlag<string | undefined, _oclif_core_interfaces.CustomOptions>;
+        verbose: _oclif_core_interfaces.BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}
+
+export { AuthLogout as default };