@ratio-app/cli 0.1.1

package/dist/commands/auth/whoami.js

@@ -0,0 +1,531 @@
+// src/commands/auth/whoami.ts
+import { Flags as Flags2 } from "@oclif/core";
+
+// src/lib/ratio-command.ts
+import { Command, Errors } from "@oclif/core";
+
+// src/lib/errors.ts
+var RatioCLIError = class extends Error {
+  code;
+  exitCode;
+  hint;
+  docsUrl;
+  constructor(opts) {
+    super(opts.message);
+    this.name = new.target.name;
+    this.code = opts.code;
+    this.exitCode = opts.exitCode;
+    if (opts.hint !== void 0) this.hint = opts.hint;
+    if (opts.docsUrl !== void 0) this.docsUrl = opts.docsUrl;
+  }
+};
+var NotLoggedInError = class extends RatioCLIError {
+  constructor(message, hint = "Run 'ratio auth login' to sign in.") {
+    super({ code: "NOT_LOGGED_IN", exitCode: 3, message, hint });
+  }
+};
+var TokenExpiredError = class extends RatioCLIError {
+  constructor(message, hint = "Run 'ratio auth login' to refresh your session.") {
+    super({ code: "TOKEN_EXPIRED", exitCode: 3, message, hint });
+  }
+};
+var ValidationError = class extends RatioCLIError {
+  constructor(message, hint) {
+    const opts = {
+      code: "VALIDATION_ERROR",
+      exitCode: 8,
+      message
+    };
+    if (hint !== void 0) opts.hint = hint;
+    super(opts);
+  }
+};
+function isRatioCLIError(err) {
+  return err instanceof RatioCLIError;
+}
+
+// src/lib/render-error.ts
+function isOclifParserError(err) {
+  return err instanceof Error && "parse" in err && err.parse !== null && err.parse !== void 0;
+}
+function buildErrorEnvelope(code, message, hint, docsUrl) {
+  const obj = { ok: false, code, message };
+  if (hint !== void 0) obj["hint"] = hint;
+  if (docsUrl !== void 0) obj["docsUrl"] = docsUrl;
+  return JSON.stringify(obj) + "\n";
+}
+function renderError(input) {
+  const { err, verbose, json } = input;
+  if (isRatioCLIError(err)) {
+    const ratioErr = err;
+    if (ratioErr.exitCode === 0) {
+      if (json) {
+        return {
+          stdout: JSON.stringify({ ok: true, data: null }) + "\n",
+          stderr: "",
+          exitCode: 0
+        };
+      }
+      return {
+        stdout: ratioErr.message + "\n",
+        stderr: "",
+        exitCode: 0
+      };
+    }
+    let stderrLines = `${ratioErr.code}: ${ratioErr.message}
+`;
+    if (ratioErr.hint !== void 0) stderrLines += `${ratioErr.hint}
+`;
+    if (ratioErr.docsUrl !== void 0) stderrLines += `${ratioErr.docsUrl}
+`;
+    if (json) {
+      return {
+        stdout: buildErrorEnvelope(ratioErr.code, ratioErr.message, ratioErr.hint, ratioErr.docsUrl),
+        stderr: verbose && ratioErr.stack ? ratioErr.stack + "\n" : "",
+        exitCode: ratioErr.exitCode
+      };
+    }
+    if (verbose && ratioErr.stack) {
+      stderrLines += ratioErr.stack + "\n";
+    }
+    return { stdout: "", stderr: stderrLines, exitCode: ratioErr.exitCode };
+  }
+  if (isOclifParserError(err)) {
+    const parserErr = err;
+    const msg = parserErr.message || "Unknown parse error";
+    const coercedErr = new ValidationError(msg);
+    let stderrText2 = `${coercedErr.code}: ${msg}
+`;
+    if (json) {
+      return {
+        stdout: buildErrorEnvelope(coercedErr.code, msg),
+        stderr: verbose && parserErr.stack ? parserErr.stack + "\n" : "",
+        exitCode: 8
+      };
+    }
+    if (verbose && parserErr.stack) {
+      stderrText2 += parserErr.stack + "\n";
+    }
+    return { stdout: "", stderr: stderrText2, exitCode: 8 };
+  }
+  const message = err instanceof Error ? err.message : String(err);
+  const stack = err instanceof Error ? err.stack : void 0;
+  const stderrPrefix = `INTERNAL: ${message}
+`;
+  if (json) {
+    return {
+      stdout: buildErrorEnvelope("INTERNAL", message),
+      stderr: verbose && stack ? stack + "\n" : "",
+      exitCode: 1
+    };
+  }
+  let stderrText = stderrPrefix;
+  if (verbose && stack) {
+    stderrText += stack + "\n";
+  }
+  return { stdout: "", stderr: stderrText, exitCode: 1 };
+}
+
+// src/lib/ratio-command.ts
+var RatioCommand = class extends Command {
+  _getRenderFlags() {
+    const argv = this.argv;
+    return {
+      verbose: argv.includes("--verbose"),
+      json: argv.includes("--json")
+    };
+  }
+  async catch(err) {
+    const { verbose, json } = this._getRenderFlags();
+    const output = renderError({ err, verbose, json });
+    if (output.stdout) process.stdout.write(output.stdout);
+    if (output.stderr) process.stderr.write(output.stderr);
+    if (output.exitCode === 0) {
+      throw new Errors.ExitError(0);
+    }
+    err.skipOclifErrorHandling = true;
+    err.oclif = { exit: output.exitCode };
+    throw err;
+  }
+};
+
+// src/lib/verbose-flag.ts
+import { Flags } from "@oclif/core";
+var verboseFlag = {
+  verbose: Flags.boolean({
+    description: "Show diagnostic detail: HTTP status/timing lines for auth requests (stderr) and stack traces for internal errors."
+  })
+};
+var jsonFlag = {
+  json: Flags.boolean({
+    description: "Emit machine-readable JSON on stdout."
+  })
+};
+
+// src/lib/credentials/clock.ts
+var SystemClock = class {
+  now() {
+    return Date.now();
+  }
+};
+
+// src/lib/credentials/path.ts
+import os from "os";
+import path from "path";
+function snapshotPathEnv() {
+  const snapshot = {};
+  const xdgConfigHome = process.env["XDG_CONFIG_HOME"];
+  if (xdgConfigHome !== void 0) {
+    snapshot.XDG_CONFIG_HOME = xdgConfigHome;
+  }
+  const appData = process.env["APPDATA"];
+  if (appData !== void 0) {
+    snapshot.APPDATA = appData;
+  }
+  return snapshot;
+}
+function defaultCredentialsPath(platform, homedir, env) {
+  const resolvedPlatform = platform ?? process.platform;
+  const resolvedHome = homedir ?? os.homedir();
+  const resolvedEnv = env ?? snapshotPathEnv();
+  if (resolvedPlatform === "win32") {
+    const appData = resolvedEnv.APPDATA;
+    const base2 = appData !== void 0 && appData !== "" ? appData : path.win32.join(resolvedHome, "AppData", "Roaming");
+    return path.win32.join(base2, "ratio", "credentials");
+  }
+  const xdgConfigHome = resolvedEnv.XDG_CONFIG_HOME;
+  const base = typeof xdgConfigHome === "string" && xdgConfigHome !== "" ? xdgConfigHome : path.posix.join(resolvedHome, ".config");
+  return path.posix.join(base, "ratio", "credentials");
+}
+
+// src/lib/credentials/refresher.ts
+var NotImplementedRefresher = class {
+  async refresh(refreshToken) {
+    void refreshToken;
+    throw new NotLoggedInError(
+      "Token refresh is not available yet in this CLI version."
+    );
+  }
+};
+
+// src/lib/credentials/store.ts
+import crypto from "crypto";
+import fs from "fs";
+import { dirname } from "path";
+
+// src/lib/credentials/schema.ts
+import { z } from "zod";
+var identitySchema = z.object({
+  developerId: z.string(),
+  email: z.string(),
+  // Token-derived fields captured at login. Optional (additive) so files
+  // written before these fields existed still validate as version 1.
+  merchantId: z.string().optional(),
+  scopes: z.array(z.string()).optional()
+}).strict();
+var profileSchema = z.object({
+  accessToken: z.string(),
+  refreshToken: z.string(),
+  expiresAt: z.string().datetime({ offset: true }),
+  identity: identitySchema,
+  obtainedAt: z.string().datetime({ offset: true })
+}).strict();
+var developerSessionSchema = z.object({
+  jwt: z.string(),
+  developerId: z.string(),
+  email: z.string(),
+  expiresAt: z.string().datetime({ offset: true }),
+  obtainedAt: z.string().datetime({ offset: true })
+}).strict();
+var credentialsSchema = z.object({
+  version: z.literal(1),
+  server: z.string(),
+  clientId: z.string(),
+  profiles: z.record(z.string(), profileSchema),
+  // Optional cached developer session. Additive so files written before
+  // this field existed still validate as version 1.
+  developer: developerSessionSchema.optional()
+}).strict();
+function parseCredentials(input) {
+  if (typeof input === "object" && input !== null && "version" in input) {
+    const version = input.version;
+    if (version !== 1) {
+      const label = typeof version === "number" ? String(version) : "unknown";
+      throw new ValidationError(
+        `credentials file version ${label} is unsupported by this CLI \u2014 upgrade the CLI or sign in again`
+      );
+    }
+  }
+  const result = credentialsSchema.safeParse(input);
+  if (!result.success) {
+    throw new ValidationError(
+      "credentials file schema mismatch \u2014 expected v1 shape"
+    );
+  }
+  return result.data;
+}
+
+// src/lib/credentials/store.ts
+var REFRESH_WINDOW_MS = 3e5;
+var ENV_TOKEN_VAR = "RATIO_API_TOKEN";
+var ENV_DEVELOPER_TOKEN_VAR = "RATIO_DEVELOPER_TOKEN";
+function hasErrnoCode(err, code) {
+  return err instanceof Error && err.code === code;
+}
+var FileCredentialStore = class {
+  filePath;
+  clock;
+  refresher;
+  envReader;
+  platform;
+  constructor(opts) {
+    this.filePath = opts?.filePath ?? defaultCredentialsPath();
+    this.clock = opts?.clock ?? new SystemClock();
+    this.refresher = opts?.refresher ?? new NotImplementedRefresher();
+    this.envReader = opts?.envReader ?? (() => process.env);
+    this.platform = opts?.platform ?? process.platform;
+  }
+  async load() {
+    this.reapplyFileModeIfDrifted();
+    let raw;
+    try {
+      raw = fs.readFileSync(this.filePath, "utf8");
+    } catch (err) {
+      if (hasErrnoCode(err, "ENOENT")) {
+        throw new NotLoggedInError("You are not signed in.");
+      }
+      throw err;
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      throw new ValidationError(
+        'credentials file is not valid JSON \u2014 run "ratio auth login" to reset'
+      );
+    }
+    return parseCredentials(parsed);
+  }
+  async save(creds) {
+    const dir = dirname(this.filePath);
+    fs.mkdirSync(dir, { recursive: true, mode: 448 });
+    if (this.platform !== "win32") {
+      fs.chmodSync(dir, 448);
+    }
+    const tmpPath = `${this.filePath}.${process.pid}.${crypto.randomBytes(8).toString("hex")}.tmp`;
+    try {
+      fs.writeFileSync(tmpPath, JSON.stringify(creds, null, 2), {
+        mode: 384
+      });
+      fs.renameSync(tmpPath, this.filePath);
+    } catch (err) {
+      try {
+        fs.unlinkSync(tmpPath);
+      } catch {
+      }
+      throw err;
+    }
+    if (this.platform !== "win32") {
+      fs.chmodSync(this.filePath, 384);
+    }
+  }
+  async clear() {
+    try {
+      fs.unlinkSync(this.filePath);
+    } catch (err) {
+      if (hasErrnoCode(err, "ENOENT")) {
+        return;
+      }
+      throw err;
+    }
+  }
+  async getValidAccessToken(profileName) {
+    const envToken = this.envReader()[ENV_TOKEN_VAR];
+    if (typeof envToken === "string" && envToken.length > 0) {
+      return envToken;
+    }
+    const creds = await this.load();
+    const name = profileName ?? "default";
+    const profile = creds.profiles[name];
+    if (profile === void 0) {
+      throw new NotLoggedInError("You are not signed in.");
+    }
+    const msUntilExpiry = new Date(profile.expiresAt).getTime() - this.clock.now();
+    if (msUntilExpiry < REFRESH_WINDOW_MS) {
+      return this.refreshAndPersist(creds, name, profile);
+    }
+    return profile.accessToken;
+  }
+  async getValidDeveloperToken() {
+    const envToken = this.envReader()[ENV_DEVELOPER_TOKEN_VAR];
+    if (typeof envToken === "string" && envToken.length > 0) {
+      return envToken;
+    }
+    let creds;
+    try {
+      creds = await this.load();
+    } catch (err) {
+      if (err instanceof NotLoggedInError) {
+        throw new NotLoggedInError("Developer signin required.");
+      }
+      throw err;
+    }
+    const session = creds.developer;
+    if (session === void 0) {
+      throw new NotLoggedInError("Developer signin required.");
+    }
+    const msUntilExpiry = new Date(session.expiresAt).getTime() - this.clock.now();
+    if (msUntilExpiry < REFRESH_WINDOW_MS) {
+      throw new NotLoggedInError("Developer signin required.");
+    }
+    return session.jwt;
+  }
+  async saveDeveloperSession(session) {
+    let creds;
+    try {
+      creds = await this.load();
+    } catch (err) {
+      if (err instanceof NotLoggedInError) {
+        creds = { version: 1, server: "", clientId: "", profiles: {} };
+      } else {
+        throw err;
+      }
+    }
+    const updated = {
+      ...creds,
+      developer: session
+    };
+    await this.save(updated);
+  }
+  /**
+   * Exchange the profile's refresh token for a fresh token set, merge it
+   * into the loaded credentials (preserving every other profile), persist
+   * atomically, and return the new access token. A refresher failure is
+   * wrapped in TokenExpiredError; the underlying message is deliberately
+   * discarded so a secret can never leak through the error surface.
+   */
+  async refreshAndPersist(creds, name, profile) {
+    let refreshed;
+    try {
+      refreshed = await this.refresher.refresh(profile.refreshToken);
+    } catch {
+      throw new TokenExpiredError(
+        "Your session has expired and could not be refreshed."
+      );
+    }
+    const updated = {
+      ...creds,
+      profiles: {
+        ...creds.profiles,
+        [name]: {
+          ...profile,
+          accessToken: refreshed.accessToken,
+          refreshToken: refreshed.refreshToken,
+          expiresAt: refreshed.expiresAt
+        }
+      }
+    };
+    await this.save(updated);
+    return refreshed.accessToken;
+  }
+  /**
+   * POSIX-only startup permission check: if the file exists with a mode
+   * other than 0600, re-apply 0600 and emit a warning to stderr. Never
+   * runs on Windows (stat modes there do not map to POSIX bits and chmod
+   * must not be called). Missing file is NOT an error here — load()
+   * reports it as NotLoggedInError.
+   */
+  reapplyFileModeIfDrifted() {
+    if (this.platform === "win32") {
+      return;
+    }
+    let stat;
+    try {
+      stat = fs.statSync(this.filePath);
+    } catch (err) {
+      if (hasErrnoCode(err, "ENOENT")) {
+        return;
+      }
+      throw err;
+    }
+    const mode = stat.mode & 511;
+    if (mode !== 384) {
+      fs.chmodSync(this.filePath, 384);
+      process.stderr.write(
+        `[warn] credentials file permissions were 0o${mode.toString(8)}; corrected to 0600.
+`
+      );
+    }
+  }
+};
+
+// src/commands/auth/whoami.ts
+var AuthWhoami = class _AuthWhoami extends RatioCommand {
+  static description = "Show the currently signed-in Ratio user.";
+  static examples = [
+    "<%= config.bin %> auth whoami",
+    "<%= config.bin %> auth whoami --json"
+  ];
+  static flags = {
+    ...verboseFlag,
+    ...jsonFlag,
+    profile: Flags2.string({
+      description: "Credential profile name to read.",
+      default: "default"
+    })
+  };
+  async run() {
+    const { flags } = await this.parse(_AuthWhoami);
+    const envToken = process.env["RATIO_API_TOKEN"];
+    if (typeof envToken === "string" && envToken.length > 0) {
+      if (flags.json) {
+        this.log(JSON.stringify({ ok: true, data: { source: "env", identity: null } }));
+      } else {
+        this.log("Using RATIO_API_TOKEN (identity unknown)");
+      }
+      return;
+    }
+    const store = new FileCredentialStore();
+    const profileName = flags.profile ?? "default";
+    let creds;
+    try {
+      creds = await store.load();
+    } catch {
+      throw new NotLoggedInError("You are not signed in.");
+    }
+    const profile = creds.profiles[profileName];
+    if (!profile) {
+      throw new NotLoggedInError("You are not signed in.");
+    }
+    const identity = profile.identity;
+    const merchantId = identity.merchantId ?? null;
+    const scopes = identity.scopes ?? [];
+    if (flags.json) {
+      this.log(
+        JSON.stringify({
+          ok: true,
+          data: {
+            source: "file",
+            clientId: creds.clientId,
+            merchantId,
+            scopes,
+            expiresAt: profile.expiresAt,
+            profile: profileName
+          }
+        })
+      );
+    } else {
+      const emailPart = identity.email ? ` email=${identity.email}` : "";
+      this.log(
+        `Signed in as clientId=${creds.clientId}${emailPart} (profile: ${profileName})`
+      );
+      this.log(`  Merchant: ${merchantId ?? "unknown"}`);
+      this.log(`  Scopes: ${scopes.length > 0 ? scopes.join(", ") : "(none)"}`);
+      this.log(`  Token expires: ${profile.expiresAt}`);
+    }
+  }
+};
+export {
+  AuthWhoami as default
+};
+//# sourceMappingURL=whoami.js.map

package/dist/commands/auth/whoami.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/commands/auth/whoami.ts","../../../src/lib/ratio-command.ts","../../../src/lib/errors.ts","../../../src/lib/render-error.ts","../../../src/lib/verbose-flag.ts","../../../src/lib/credentials/clock.ts","../../../src/lib/credentials/path.ts","../../../src/lib/credentials/refresher.ts","../../../src/lib/credentials/store.ts","../../../src/lib/credentials/schema.ts"],"sourcesContent":["import { Flags } from '@oclif/core';\nimport { RatioCommand } from '../../lib/ratio-command.js';\nimport { jsonFlag, verboseFlag } from '../../lib/verbose-flag.js';\nimport { FileCredentialStore } from '../../lib/credentials/index.js';\nimport { NotLoggedInError } from '../../lib/errors.js';\n\nexport default class AuthWhoami extends RatioCommand {\n  static override description = 'Show the currently signed-in Ratio user.';\n\n  static override examples = [\n    '<%= config.bin %> auth whoami',\n    '<%= config.bin %> auth whoami --json',\n  ];\n\n  static override flags = {\n    ...verboseFlag,\n    ...jsonFlag,\n    profile: Flags.string({\n      description: 'Credential profile name to read.',\n      default: 'default',\n    }),\n  };\n\n  public async run(): Promise<void> {\n    const { flags } = await this.parse(AuthWhoami);\n\n    // RATIO_API_TOKEN env bypass — identity unknown (token is opaque to CLI).\n    const envToken = process.env['RATIO_API_TOKEN'];\n    if (typeof envToken === 'string' && envToken.length > 0) {\n      if (flags.json) {\n        this.log(JSON.stringify({ ok: true, data: { source: 'env', identity: null } }));\n      } else {\n        this.log('Using RATIO_API_TOKEN (identity unknown)');\n      }\n      return;\n    }\n\n    const store = new FileCredentialStore();\n    const profileName = flags.profile ?? 'default';\n\n    let creds;\n    try {\n      creds = await store.load();\n    } catch {\n      throw new NotLoggedInError('You are not signed in.');\n    }\n\n    const profile = creds.profiles[profileName];\n    if (!profile) {\n      throw new NotLoggedInError('You are not signed in.');\n    }\n\n    const identity = profile.identity;\n\n    // Token-derived view: {clientId, merchantId, scopes}. Files written\n    // before merchantId/scopes were persisted degrade gracefully.\n    const merchantId = identity.merchantId ?? null;\n    const scopes = identity.scopes ?? [];\n\n    if (flags.json) {\n      // SC-11: --json outputs {\"ok\":true,\"data\":{...}}\n      this.log(\n        JSON.stringify({\n          ok: true,\n          data: {\n            source: 'file',\n            clientId: creds.clientId,\n            merchantId,\n            scopes,\n            expiresAt: profile.expiresAt,\n            profile: profileName,\n          },\n        }),\n      );\n    } else {\n      const emailPart = identity.email ? ` email=${identity.email}` : '';\n      this.log(\n        `Signed in as clientId=${creds.clientId}${emailPart} (profile: ${profileName})`,\n      );\n      this.log(`  Merchant: ${merchantId ?? 'unknown'}`);\n      this.log(`  Scopes: ${scopes.length > 0 ? scopes.join(', ') : '(none)'}`);\n      this.log(`  Token expires: ${profile.expiresAt}`);\n    }\n  }\n}\n","import { Command, Errors } from '@oclif/core';\nimport { renderError } from './render-error.js';\n\n/**\n * Base class for all Ratio CLI commands.\n *\n * Overrides catch() to intercept every error thrown from run(), render it\n * per the Ratio CLI error-UX spec (typed hierarchy -> structured stderr/stdout,\n * --verbose for stack traces, --json for machine-readable envelope), and then\n * suppress oclif's own double-render by setting skipOclifErrorHandling on the\n * re-thrown error.\n *\n * Path B: base-class override — no oclif.hooks wiring needed.\n * oclif v4 does not expose a command_error hook; the reliable interception\n * point is Command.catch(), which is called by Command._run() before the\n * error bubbles up to oclif's global handle() function.\n *\n * Double-render prevention:\n *   oclif's handle() checks err.skipOclifErrorHandling before printing.\n *   After rendering we set skipOclifErrorHandling = true so oclif's\n *   pretty-print is skipped. We also set err.oclif.exit = N so handle()\n *   calls process.exit(N) with the correct code.\n *\n * Exit-code routing:\n *   - exitCode === 0 (ComingSoonError): throw ExitError(0) so oclif calls\n *     process.exit(0) cleanly. ExitError has code 'EEXIT' and is treated as\n *     a clean exit — shouldPrint is false in handle().\n *   - exitCode > 0: mark err.skipOclifErrorHandling = true and set\n *     err.oclif = { exit: N }, then re-throw so handle() exits N.\n *\n * Verbose/json detection strategy:\n *   We scan this.argv directly. this.argv is set by oclif's Command before\n *   run() is called and always contains the raw argument list. This approach\n *   works both for:\n *   (a) post-parse errors (thrown after this.parse() succeeds) — argv has the\n *       flags that were successfully recognised.\n *   (b) pre-parse errors (thrown BY this.parse(), e.g. unknown flag) — argv\n *       still contains --verbose / --json even though parse() threw.\n *   Simple string scan is sufficient since --verbose and --json are boolean\n *   flags with no value argument.\n */\nexport abstract class RatioCommand extends Command {\n  private _getRenderFlags(): { verbose: boolean; json: boolean } {\n    const argv = this.argv as string[];\n    return {\n      verbose: argv.includes('--verbose'),\n      json: argv.includes('--json'),\n    };\n  }\n\n  override async catch(\n    err: Error & {\n      exitCode?: number;\n      oclif?: { exit?: number };\n      skipOclifErrorHandling?: boolean;\n    },\n  ): Promise<never> {\n    const { verbose, json } = this._getRenderFlags();\n\n    const output = renderError({ err, verbose, json });\n\n    // Write rendered output before any exit/throw\n    if (output.stdout) process.stdout.write(output.stdout);\n    if (output.stderr) process.stderr.write(output.stderr);\n\n    if (output.exitCode === 0) {\n      // ComingSoonError path — ExitError(0) causes oclif to call process.exit(0)\n      // cleanly. ExitError has code 'EEXIT'; handle() treats it as a clean exit\n      // (shouldPrint is false) so no additional output is written.\n      throw new Errors.ExitError(0);\n    }\n\n    // For non-zero exits: suppress oclif's pretty-print by marking the error,\n    // then route the correct exit code via oclif.exit so handle() calls process.exit(N).\n    err.skipOclifErrorHandling = true;\n    err.oclif = { exit: output.exitCode };\n    throw err;\n  }\n}\n","/**\n * Error hierarchy for the Ratio CLI. Every error thrown from a command's\n * run() is expected to be an instance of RatioCLIError so the global\n * render-error handler can map it to a deterministic stderr line and exit\n * code. Uncaught Error subclasses render as \"INTERNAL: <msg>\" with exit 1.\n *\n * No import from @oclif/core — this file is dependency-free so tests\n * can import it without oclif overhead.\n */\n\nexport class RatioCLIError extends Error {\n  readonly code: string;\n  readonly exitCode: number;\n  readonly hint?: string;\n  readonly docsUrl?: string;\n\n  constructor(opts: {\n    code: string;\n    exitCode: number;\n    message: string;\n    hint?: string;\n    docsUrl?: string;\n  }) {\n    super(opts.message);\n    this.name = new.target.name;\n    this.code = opts.code;\n    this.exitCode = opts.exitCode;\n    if (opts.hint !== undefined) this.hint = opts.hint;\n    if (opts.docsUrl !== undefined) this.docsUrl = opts.docsUrl;\n  }\n}\n\n/** Coming-soon stub UX. Renders on stdout with exit 0. */\nexport class ComingSoonError extends RatioCLIError {\n  constructor(message: string) {\n    super({ code: 'COMING_SOON', exitCode: 0, message });\n  }\n}\n\n/** User has no credentials and command requires auth. */\nexport class NotLoggedInError extends RatioCLIError {\n  constructor(\n    message: string,\n    hint: string = \"Run 'ratio auth login' to sign in.\",\n  ) {\n    super({ code: 'NOT_LOGGED_IN', exitCode: 3, message, hint });\n  }\n}\n\nexport class TokenExpiredError extends RatioCLIError {\n  constructor(\n    message: string,\n    hint: string = \"Run 'ratio auth login' to refresh your session.\",\n  ) {\n    super({ code: 'TOKEN_EXPIRED', exitCode: 3, message, hint });\n  }\n}\n\nexport class ScopeDeniedError extends RatioCLIError {\n  constructor(message: string, hint?: string) {\n    const opts: { code: string; exitCode: number; message: string; hint?: string } = {\n      code: 'SCOPE_DENIED',\n      exitCode: 4,\n      message,\n    };\n    if (hint !== undefined) opts.hint = hint;\n    super(opts);\n  }\n}\n\nexport class NetworkError extends RatioCLIError {\n  constructor(message: string, hint: string = 'Check your network and retry.') {\n    super({ code: 'NETWORK_ERROR', exitCode: 5, message, hint });\n  }\n}\n\nexport class RelayConnectError extends RatioCLIError {\n  constructor(\n    message: string,\n    hint: string = 'Verify the tunnel URL and that the auth-server is reachable.',\n  ) {\n    super({ code: 'RELAY_CONNECT', exitCode: 6, message, hint });\n  }\n}\n\nexport class TemplateExistsError extends RatioCLIError {\n  constructor(\n    message: string,\n    hint: string = 'Choose a different name or remove the existing directory.',\n  ) {\n    super({ code: 'TEMPLATE_EXISTS', exitCode: 7, message, hint });\n  }\n}\n\nexport class ValidationError extends RatioCLIError {\n  constructor(message: string, hint?: string) {\n    const opts: { code: string; exitCode: number; message: string; hint?: string } = {\n      code: 'VALIDATION_ERROR',\n      exitCode: 8,\n      message,\n    };\n    if (hint !== undefined) opts.hint = hint;\n    super(opts);\n  }\n}\n\nexport class RelayResumeGapError extends RatioCLIError {\n  constructor(\n    message: string,\n    hint: string = 'Reconnect from the current cursor; older events are outside the buffer window.',\n  ) {\n    super({ code: 'RELAY_RESUME_GAP', exitCode: 9, message, hint });\n  }\n}\n\nexport class OrchestratorSpawnError extends RatioCLIError {\n  constructor(\n    message: string,\n    hint: string = \"Could not start your app's dev command — check that the command in ratio.config.jsonc runs from this directory.\",\n  ) {\n    super({ code: 'ORCHESTRATOR_SPAWN', exitCode: 10, message, hint });\n  }\n}\n\nexport class OrchestratorDrainTimeoutError extends RatioCLIError {\n  constructor(\n    message: string,\n    hint: string = 'Your dev command did not exit cleanly within 5 seconds — it was forcibly terminated.',\n  ) {\n    super({ code: 'ORCHESTRATOR_DRAIN', exitCode: 11, message, hint });\n  }\n}\n\nexport function isRatioCLIError(err: unknown): err is RatioCLIError {\n  return err instanceof RatioCLIError;\n}\n","import { isRatioCLIError, RatioCLIError, ValidationError } from './errors.js';\n\nexport interface RenderInput {\n  err: unknown;\n  verbose: boolean;\n  json: boolean;\n}\n\nexport interface RenderOutput {\n  /** Text to write to stdout. Empty string means nothing to write. */\n  stdout: string;\n  /** Text to write to stderr. Empty string means nothing to write. */\n  stderr: string;\n  exitCode: number;\n}\n\n/**\n * Detects whether an error originates from the oclif argument/flag parser.\n * oclif's CLIParseError subclasses (NonExistentFlagsError, RequiredArgsError,\n * etc.) all carry a `parse` property set by CLIParseErrorOptions. This is the\n * stable structural signal — more reliable than checking the class name string.\n */\nfunction isOclifParserError(err: unknown): err is Error & { parse: unknown } {\n  return (\n    err instanceof Error &&\n    'parse' in err &&\n    err.parse !== null &&\n    err.parse !== undefined\n  );\n}\n\n/**\n * Builds the JSON error envelope. Fields with undefined values are omitted\n * so the consumer never sees `\"hint\": null` or `\"docsUrl\": null`.\n */\nfunction buildErrorEnvelope(\n  code: string,\n  message: string,\n  hint?: string,\n  docsUrl?: string,\n): string {\n  const obj: Record<string, unknown> = { ok: false, code, message };\n  if (hint !== undefined) obj['hint'] = hint;\n  if (docsUrl !== undefined) obj['docsUrl'] = docsUrl;\n  return JSON.stringify(obj) + '\\n';\n}\n\n/**\n * Pure rendering function — no side effects, no process.exit, no I/O.\n * The caller (RatioCommand.catch) is responsible for writing output and exiting.\n *\n * Rendering rules (all branches):\n *\n * | Error shape          | --json | --verbose | stdout                         | stderr                           | exit |\n * |----------------------|--------|-----------|--------------------------------|----------------------------------|------|\n * | ComingSoonError      | false  | any       | err.message + '\\n'            | ''                               | 0    |\n * | ComingSoonError      | true   | any       | '{\"ok\":true,\"data\":null}\\n'   | ''                               | 0    |\n * | RatioCLIError >0     | false  | false     | ''                            | code: msg [+ hint] [+ docsUrl]  | N    |\n * | RatioCLIError >0     | false  | true      | ''                            | above + stack                    | N    |\n * | RatioCLIError >0     | true   | false     | JSON envelope                  | ''                               | N    |\n * | RatioCLIError >0     | true   | true      | JSON envelope                  | stack only                       | N    |\n * | oclif ParserError    | false  | any       | ''                            | VALIDATION_ERROR: msg [+stack]  | 8    |\n * | oclif ParserError    | true   | any       | JSON VALIDATION_ERROR envelope | stack if verbose                 | 8    |\n * | Plain Error / other  | false  | false     | ''                            | INTERNAL: msg\\n                 | 1    |\n * | Plain Error / other  | false  | true      | ''                            | INTERNAL: msg\\n + stack\\n       | 1    |\n * | Plain Error / other  | true   | any       | JSON INTERNAL envelope         | stack if verbose                 | 1    |\n */\nexport function renderError(input: RenderInput): RenderOutput {\n  const { err, verbose, json } = input;\n\n  // ── Branch 1: our own typed hierarchy ───────────────────────────────────\n  if (isRatioCLIError(err)) {\n    const ratioErr = err as RatioCLIError;\n\n    // exitCode === 0 → coming-soon: render on stdout, no stderr, exit 0\n    if (ratioErr.exitCode === 0) {\n      if (json) {\n        return {\n          stdout: JSON.stringify({ ok: true, data: null }) + '\\n',\n          stderr: '',\n          exitCode: 0,\n        };\n      }\n      return {\n        stdout: ratioErr.message + '\\n',\n        stderr: '',\n        exitCode: 0,\n      };\n    }\n\n    // exitCode > 0 → error render\n    let stderrLines = `${ratioErr.code}: ${ratioErr.message}\\n`;\n    if (ratioErr.hint !== undefined) stderrLines += `${ratioErr.hint}\\n`;\n    if (ratioErr.docsUrl !== undefined) stderrLines += `${ratioErr.docsUrl}\\n`;\n\n    if (json) {\n      return {\n        stdout: buildErrorEnvelope(ratioErr.code, ratioErr.message, ratioErr.hint, ratioErr.docsUrl),\n        stderr: verbose && ratioErr.stack ? ratioErr.stack + '\\n' : '',\n        exitCode: ratioErr.exitCode,\n      };\n    }\n\n    if (verbose && ratioErr.stack) {\n      stderrLines += ratioErr.stack + '\\n';\n    }\n\n    return { stdout: '', stderr: stderrLines, exitCode: ratioErr.exitCode };\n  }\n\n  // ── Branch 2: oclif parser error (unknown flag, missing required arg, etc.) ──\n  if (isOclifParserError(err)) {\n    const parserErr = err as Error & { parse: unknown };\n    const msg = parserErr.message || 'Unknown parse error';\n\n    // Strip oclif's \"Unexpected argument: --foo\" or similar prefix noise where\n    // possible, but keep the core message as-is since it's already human-readable.\n    const coercedErr = new ValidationError(msg);\n\n    let stderrText = `${coercedErr.code}: ${msg}\\n`;\n\n    if (json) {\n      return {\n        stdout: buildErrorEnvelope(coercedErr.code, msg),\n        stderr: verbose && parserErr.stack ? parserErr.stack + '\\n' : '',\n        exitCode: 8,\n      };\n    }\n\n    if (verbose && parserErr.stack) {\n      stderrText += parserErr.stack + '\\n';\n    }\n\n    return { stdout: '', stderr: stderrText, exitCode: 8 };\n  }\n\n  // ── Branch 3: plain Error or non-Error throw ─────────────────────────────\n  const message = err instanceof Error ? err.message : String(err);\n  const stack = err instanceof Error ? err.stack : undefined;\n  const stderrPrefix = `INTERNAL: ${message}\\n`;\n\n  if (json) {\n    return {\n      stdout: buildErrorEnvelope('INTERNAL', message),\n      stderr: verbose && stack ? stack + '\\n' : '',\n      exitCode: 1,\n    };\n  }\n\n  let stderrText = stderrPrefix;\n  if (verbose && stack) {\n    stderrText += stack + '\\n';\n  }\n\n  return { stdout: '', stderr: stderrText, exitCode: 1 };\n}\n","import { Flags } from '@oclif/core';\n\n/** Global verbose flag — every command imports and spreads this. */\nexport const verboseFlag = {\n  verbose: Flags.boolean({\n    description:\n      'Show diagnostic detail: HTTP status/timing lines for auth requests (stderr) and stack traces for internal errors.',\n  }),\n};\n\n/** JSON envelope flag — read-style commands (whoami, dev trigger --list) import. */\nexport const jsonFlag = {\n  json: Flags.boolean({\n    description: 'Emit machine-readable JSON on stdout.',\n  }),\n};\n","/**\n * Injectable wall-clock seam for the credential store.\n *\n * This is the ONLY file in the credentials module allowed to sample the\n * real wall clock. Every other file receives a {@link Clock} instance so\n * tests can drive expiry-window logic deterministically with a fake.\n */\n\n/** Injectable time source. */\nexport interface Clock {\n  /** Milliseconds since Unix epoch. */\n  now(): number;\n}\n\n/** Production {@link Clock} backed by the system wall clock. */\nexport class SystemClock implements Clock {\n  now(): number {\n    return Date.now();\n  }\n}\n","/**\n * Pure path resolution for the credentials file.\n *\n * POSIX: `$XDG_CONFIG_HOME/ratio/credentials` when the override is a\n * non-empty string, otherwise `~/.config/ratio/credentials`.\n * Windows: `%APPDATA%\\ratio\\credentials`, falling back to\n * `<home>\\AppData\\Roaming\\ratio\\credentials` when APPDATA is unset.\n *\n * `path.win32.join` / `path.posix.join` are used explicitly (never bare\n * `path.join`) so the result is deterministic when a test running on a\n * POSIX host fakes `platform === 'win32'`.\n */\n\nimport os from 'node:os';\nimport path from 'node:path';\n\n/** The subset of environment variables the path algorithm consults. */\nexport interface PathEnv {\n  readonly XDG_CONFIG_HOME?: string;\n  readonly APPDATA?: string;\n}\n\n/** Snapshot the two relevant variables from the real process env. */\nfunction snapshotPathEnv(): PathEnv {\n  const snapshot: { XDG_CONFIG_HOME?: string; APPDATA?: string } = {};\n  const xdgConfigHome = process.env['XDG_CONFIG_HOME'];\n  if (xdgConfigHome !== undefined) {\n    snapshot.XDG_CONFIG_HOME = xdgConfigHome;\n  }\n  const appData = process.env['APPDATA'];\n  if (appData !== undefined) {\n    snapshot.APPDATA = appData;\n  }\n  return snapshot;\n}\n\n/**\n * Pure function. Returns the on-disk path for the credentials file.\n * platform defaults to process.platform, homedir defaults to os.homedir(),\n * env defaults to a snapshot of {XDG_CONFIG_HOME, APPDATA} from process.env.\n * All three are injectable so unit tests fake Windows without a Windows host.\n */\nexport function defaultCredentialsPath(\n  platform?: NodeJS.Platform,\n  homedir?: string,\n  env?: PathEnv,\n): string {\n  const resolvedPlatform = platform ?? process.platform;\n  const resolvedHome = homedir ?? os.homedir();\n  const resolvedEnv = env ?? snapshotPathEnv();\n\n  if (resolvedPlatform === 'win32') {\n    const appData = resolvedEnv.APPDATA;\n    const base =\n      appData !== undefined && appData !== ''\n        ? appData\n        : path.win32.join(resolvedHome, 'AppData', 'Roaming');\n    return path.win32.join(base, 'ratio', 'credentials');\n  }\n\n  const xdgConfigHome = resolvedEnv.XDG_CONFIG_HOME;\n  const base =\n    typeof xdgConfigHome === 'string' && xdgConfigHome !== ''\n      ? xdgConfigHome\n      : path.posix.join(resolvedHome, '.config');\n  return path.posix.join(base, 'ratio', 'credentials');\n}\n","/**\n * Injectable token-refresh seam for the credential store.\n *\n * The store never performs network I/O itself: when a stored token is\n * close to expiry the store calls the injected {@link TokenRefresher}\n * and persists whatever it returns. The concrete HTTP implementation is\n * wired in by the auth commands; this module only defines the seam plus\n * a throw-if-called placeholder used before sign-in support is wired.\n */\n\nimport { NotLoggedInError } from '../errors.js';\nimport type { TokenSet } from './types.js';\n\n/** Injectable seam that exchanges a refresh token for a fresh token set. */\nexport interface TokenRefresher {\n  refresh(refreshToken: string): Promise<TokenSet>;\n}\n\n/**\n * v1 stub. Always rejects with a static-message NotLoggedInError; it\n * never inspects, echoes, or logs the token it was handed. The real\n * HTTP implementation is supplied by the auth commands.\n */\nexport class NotImplementedRefresher implements TokenRefresher {\n  async refresh(refreshToken: string): Promise<TokenSet> {\n    // Deliberately unused: this placeholder must never touch the token.\n    void refreshToken;\n    throw new NotLoggedInError(\n      'Token refresh is not available yet in this CLI version.',\n    );\n  }\n}\n","/**\n * File-backed credential store.\n *\n * Token resolution precedence (highest first):\n *   1. `RATIO_API_TOKEN` from the injected env reader — returned as-is\n *      with ZERO filesystem access and ZERO refresher involvement.\n *   2. The requested profile (default: \"default\") from the credentials\n *      file, silently refreshed via the injected TokenRefresher when it\n *      is within 5 minutes of expiry.\n *\n * Write contract: atomic tmp + rename in the SAME directory, tmp created\n * with mode 0600 at open time (POSIX), parent directory created 0700,\n * belt-and-braces chmod 0600 after rename. On Windows no chmod / mode\n * checks are ever performed. Concurrent writers are last-writer-wins by\n * design — the atomic rename guarantees no half-written file, which is\n * sufficient for a single-developer CLI.\n *\n * No secret (access token, refresh token, raw file contents) is ever\n * included in an error message or a log line.\n */\n\nimport crypto from 'node:crypto';\nimport fs from 'node:fs';\nimport { dirname } from 'node:path';\nimport {\n  NotLoggedInError,\n  TokenExpiredError,\n  ValidationError,\n} from '../errors.js';\nimport { SystemClock } from './clock.js';\nimport type { Clock } from './clock.js';\nimport { defaultCredentialsPath } from './path.js';\nimport { NotImplementedRefresher } from './refresher.js';\nimport type { TokenRefresher } from './refresher.js';\nimport { parseCredentials } from './schema.js';\nimport type { Credentials, DeveloperSession, Profile, TokenSet } from './types.js';\n\n/** Milliseconds before expiry at which a silent refresh is triggered. */\nconst REFRESH_WINDOW_MS = 300_000;\n\n/** Env var that short-circuits all file access when set to a non-empty string. */\nconst ENV_TOKEN_VAR = 'RATIO_API_TOKEN';\n\n/**\n * Env var that short-circuits developer-session file access when set to a\n * non-empty string. Strictly separate from RATIO_API_TOKEN: this one carries\n * the developer sign-in bearer used for app-management calls, never the\n * OAuth access token.\n */\nconst ENV_DEVELOPER_TOKEN_VAR = 'RATIO_DEVELOPER_TOKEN';\n\nexport interface CredentialStoreOptions {\n  /** Defaults to defaultCredentialsPath(). */\n  readonly filePath?: string;\n  /** Defaults to new SystemClock(). */\n  readonly clock?: Clock;\n  /** Defaults to new NotImplementedRefresher(). */\n  readonly refresher?: TokenRefresher;\n  /** Defaults to () => process.env — injected for env-precedence tests. */\n  readonly envReader?: () => Readonly<Record<string, string | undefined>>;\n  /** Defaults to process.platform. */\n  readonly platform?: NodeJS.Platform;\n}\n\nexport interface CredentialStore {\n  /** Reads the full credentials file. Throws NotLoggedInError if missing. */\n  load(): Promise<Credentials>;\n  /** Atomic write with 0600 on POSIX. tmp + rename in same dir. */\n  save(creds: Credentials): Promise<void>;\n  /** Deletes the credentials file. Idempotent. */\n  clear(): Promise<void>;\n  /**\n   * Env precedence: if envReader().RATIO_API_TOKEN is set, returns it\n   * WITHOUT reading the file, WITHOUT touching the refresher, WITHOUT\n   * any fs I/O. This is the auditable \"no disk access\" path.\n   *\n   * Otherwise: reads the file, validates, computes\n   *   msUntilExpiry = new Date(profile.expiresAt).getTime() - clock.now()\n   * If msUntilExpiry < 300_000 (5 min), calls refresher.refresh(...),\n   * persists the new TokenSet atomically, returns the new accessToken.\n   * Otherwise returns profile.accessToken.\n   */\n  getValidAccessToken(profileName?: string): Promise<string>;\n  /**\n   * Env precedence: RATIO_DEVELOPER_TOKEN if set (no fs I/O).\n   * Otherwise: load(); if creds.developer is absent or within 5 minutes of\n   * expiry, throws NotLoggedInError ('Developer signin required.').\n   * Otherwise returns creds.developer.jwt.\n   * NO refresh attempt — the caller drives the re-prompt UX.\n   */\n  getValidDeveloperToken(): Promise<string>;\n  /**\n   * Merge a DeveloperSession into the loaded credentials (creating the file\n   * if absent), atomic tmp+rename, 0600.\n   */\n  saveDeveloperSession(session: DeveloperSession): Promise<void>;\n}\n\n/** Narrow an unknown thrown value to a Node errno error with the given code. */\nfunction hasErrnoCode(err: unknown, code: string): boolean {\n  return (\n    err instanceof Error &&\n    (err as NodeJS.ErrnoException).code === code\n  );\n}\n\nexport class FileCredentialStore implements CredentialStore {\n  private readonly filePath: string;\n  private readonly clock: Clock;\n  private readonly refresher: TokenRefresher;\n  private readonly envReader: () => Readonly<\n    Record<string, string | undefined>\n  >;\n  private readonly platform: NodeJS.Platform;\n\n  constructor(opts?: CredentialStoreOptions) {\n    this.filePath = opts?.filePath ?? defaultCredentialsPath();\n    this.clock = opts?.clock ?? new SystemClock();\n    this.refresher = opts?.refresher ?? new NotImplementedRefresher();\n    this.envReader = opts?.envReader ?? (() => process.env);\n    this.platform = opts?.platform ?? process.platform;\n  }\n\n  async load(): Promise<Credentials> {\n    this.reapplyFileModeIfDrifted();\n\n    let raw: string;\n    try {\n      raw = fs.readFileSync(this.filePath, 'utf8');\n    } catch (err) {\n      if (hasErrnoCode(err, 'ENOENT')) {\n        throw new NotLoggedInError('You are not signed in.');\n      }\n      throw err;\n    }\n\n    let parsed: unknown;\n    try {\n      parsed = JSON.parse(raw);\n    } catch {\n      // Never echo the raw contents — they may hold a truncated token.\n      throw new ValidationError(\n        'credentials file is not valid JSON — run \"ratio auth login\" to reset',\n      );\n    }\n\n    return parseCredentials(parsed);\n  }\n\n  async save(creds: Credentials): Promise<void> {\n    const dir = dirname(this.filePath);\n    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });\n    if (this.platform !== 'win32') {\n      // mkdirSync does not re-mode a pre-existing directory; re-apply.\n      fs.chmodSync(dir, 0o700);\n    }\n\n    const tmpPath = `${this.filePath}.${process.pid}.${crypto\n      .randomBytes(8)\n      .toString('hex')}.tmp`;\n    try {\n      // mode at open time closes the create-then-chmod race window.\n      fs.writeFileSync(tmpPath, JSON.stringify(creds, null, 2), {\n        mode: 0o600,\n      });\n      fs.renameSync(tmpPath, this.filePath);\n    } catch (err) {\n      try {\n        fs.unlinkSync(tmpPath);\n      } catch {\n        // Best-effort cleanup: the tmp file may never have been created.\n      }\n      throw err;\n    }\n\n    if (this.platform !== 'win32') {\n      // Belt-and-braces: rename may preserve a prior destination mode.\n      fs.chmodSync(this.filePath, 0o600);\n    }\n  }\n\n  async clear(): Promise<void> {\n    try {\n      fs.unlinkSync(this.filePath);\n    } catch (err) {\n      if (hasErrnoCode(err, 'ENOENT')) {\n        return; // Idempotent: already gone.\n      }\n      throw err;\n    }\n  }\n\n  async getValidAccessToken(profileName?: string): Promise<string> {\n    const envToken = this.envReader()[ENV_TOKEN_VAR];\n    if (typeof envToken === 'string' && envToken.length > 0) {\n      return envToken;\n    }\n\n    const creds = await this.load();\n    const name = profileName ?? 'default';\n    const profile = creds.profiles[name];\n    if (profile === undefined) {\n      throw new NotLoggedInError('You are not signed in.');\n    }\n\n    const msUntilExpiry =\n      new Date(profile.expiresAt).getTime() - this.clock.now();\n    if (msUntilExpiry < REFRESH_WINDOW_MS) {\n      return this.refreshAndPersist(creds, name, profile);\n    }\n\n    return profile.accessToken;\n  }\n\n  async getValidDeveloperToken(): Promise<string> {\n    const envToken = this.envReader()[ENV_DEVELOPER_TOKEN_VAR];\n    if (typeof envToken === 'string' && envToken.length > 0) {\n      return envToken;\n    }\n\n    let creds: Credentials;\n    try {\n      creds = await this.load();\n    } catch (err) {\n      if (err instanceof NotLoggedInError) {\n        throw new NotLoggedInError('Developer signin required.');\n      }\n      throw err;\n    }\n\n    const session = creds.developer;\n    if (session === undefined) {\n      throw new NotLoggedInError('Developer signin required.');\n    }\n\n    const msUntilExpiry =\n      new Date(session.expiresAt).getTime() - this.clock.now();\n    if (msUntilExpiry < REFRESH_WINDOW_MS) {\n      // No refresh endpoint exists for developer sessions — the caller\n      // drives a fresh interactive sign-in instead.\n      throw new NotLoggedInError('Developer signin required.');\n    }\n\n    return session.jwt;\n  }\n\n  async saveDeveloperSession(session: DeveloperSession): Promise<void> {\n    let creds: Credentials;\n    try {\n      creds = await this.load();\n    } catch (err) {\n      if (err instanceof NotLoggedInError) {\n        // Edge case: no prior credentials file. Create a fresh v1 shell so\n        // the merged write below still validates on the next load().\n        creds = { version: 1, server: '', clientId: '', profiles: {} };\n      } else {\n        throw err;\n      }\n    }\n\n    const updated: Credentials = {\n      ...creds,\n      developer: session,\n    };\n    await this.save(updated);\n  }\n\n  /**\n   * Exchange the profile's refresh token for a fresh token set, merge it\n   * into the loaded credentials (preserving every other profile), persist\n   * atomically, and return the new access token. A refresher failure is\n   * wrapped in TokenExpiredError; the underlying message is deliberately\n   * discarded so a secret can never leak through the error surface.\n   */\n  private async refreshAndPersist(\n    creds: Credentials,\n    name: string,\n    profile: Profile,\n  ): Promise<string> {\n    let refreshed: TokenSet;\n    try {\n      refreshed = await this.refresher.refresh(profile.refreshToken);\n    } catch {\n      throw new TokenExpiredError(\n        'Your session has expired and could not be refreshed.',\n      );\n    }\n\n    const updated: Credentials = {\n      ...creds,\n      profiles: {\n        ...creds.profiles,\n        [name]: {\n          ...profile,\n          accessToken: refreshed.accessToken,\n          refreshToken: refreshed.refreshToken,\n          expiresAt: refreshed.expiresAt,\n        },\n      },\n    };\n    await this.save(updated);\n    return refreshed.accessToken;\n  }\n\n  /**\n   * POSIX-only startup permission check: if the file exists with a mode\n   * other than 0600, re-apply 0600 and emit a warning to stderr. Never\n   * runs on Windows (stat modes there do not map to POSIX bits and chmod\n   * must not be called). Missing file is NOT an error here — load()\n   * reports it as NotLoggedInError.\n   */\n  private reapplyFileModeIfDrifted(): void {\n    if (this.platform === 'win32') {\n      return;\n    }\n\n    let stat: fs.Stats;\n    try {\n      stat = fs.statSync(this.filePath);\n    } catch (err) {\n      if (hasErrnoCode(err, 'ENOENT')) {\n        return; // load() turns the missing file into NotLoggedInError.\n      }\n      throw err;\n    }\n\n    const mode = stat.mode & 0o777;\n    if (mode !== 0o600) {\n      fs.chmodSync(this.filePath, 0o600);\n      process.stderr.write(\n        `[warn] credentials file permissions were 0o${mode.toString(8)}; corrected to 0600.\\n`,\n      );\n    }\n  }\n}\n","/**\n * Runtime validation for the on-disk credentials file.\n *\n * The parser is deliberately strict: unknown top-level keys, missing\n * fields, non-ISO timestamps, and any `version` other than `1` are all\n * rejected with a typed ValidationError. Error messages NEVER embed the\n * raw file contents — a malformed file may contain a truncated token.\n */\n\nimport { z } from 'zod';\nimport { ValidationError } from '../errors.js';\nimport type { Credentials } from './types.js';\n\nconst identitySchema = z\n  .object({\n    developerId: z.string(),\n    email: z.string(),\n    // Token-derived fields captured at login. Optional (additive) so files\n    // written before these fields existed still validate as version 1.\n    merchantId: z.string().optional(),\n    scopes: z.array(z.string()).optional(),\n  })\n  .strict();\n\nconst profileSchema = z\n  .object({\n    accessToken: z.string(),\n    refreshToken: z.string(),\n    expiresAt: z.string().datetime({ offset: true }),\n    identity: identitySchema,\n    obtainedAt: z.string().datetime({ offset: true }),\n  })\n  .strict();\n\nconst developerSessionSchema = z\n  .object({\n    jwt: z.string(),\n    developerId: z.string(),\n    email: z.string(),\n    expiresAt: z.string().datetime({ offset: true }),\n    obtainedAt: z.string().datetime({ offset: true }),\n  })\n  .strict();\n\n/** Strict zod schema for the version-1 credentials file. */\nexport const credentialsSchema = z\n  .object({\n    version: z.literal(1),\n    server: z.string(),\n    clientId: z.string(),\n    profiles: z.record(z.string(), profileSchema),\n    // Optional cached developer session. Additive so files written before\n    // this field existed still validate as version 1.\n    developer: developerSessionSchema.optional(),\n  })\n  .strict();\n\n/**\n * Validate an already-JSON-parsed value against the version-1 shape.\n *\n * Throws ValidationError on any mismatch. A recognisable-but-unsupported\n * `version` gets a dedicated upgrade message; the version label is only\n * echoed when it is a number so arbitrary file contents can never leak\n * into an error message.\n */\nexport function parseCredentials(input: unknown): Credentials {\n  if (typeof input === 'object' && input !== null && 'version' in input) {\n    const version = (input as { version: unknown }).version;\n    if (version !== 1) {\n      const label = typeof version === 'number' ? String(version) : 'unknown';\n      throw new ValidationError(\n        `credentials file version ${label} is unsupported by this CLI — upgrade the CLI or sign in again`,\n      );\n    }\n  }\n\n  const result = credentialsSchema.safeParse(input);\n  if (!result.success) {\n    throw new ValidationError(\n      'credentials file schema mismatch — expected v1 shape',\n    );\n  }\n  return result.data as Credentials;\n}\n"],"mappings":";AAAA,SAAS,SAAAA,cAAa;;;ACAtB,SAAS,SAAS,cAAc;;;ACUzB,IAAM,gBAAN,cAA4B,MAAM;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,MAMT;AACD,UAAM,KAAK,OAAO;AAClB,SAAK,OAAO,WAAW;AACvB,SAAK,OAAO,KAAK;AACjB,SAAK,WAAW,KAAK;AACrB,QAAI,KAAK,SAAS,OAAW,MAAK,OAAO,KAAK;AAC9C,QAAI,KAAK,YAAY,OAAW,MAAK,UAAU,KAAK;AAAA,EACtD;AACF;AAUO,IAAM,mBAAN,cAA+B,cAAc;AAAA,EAClD,YACE,SACA,OAAe,sCACf;AACA,UAAM,EAAE,MAAM,iBAAiB,UAAU,GAAG,SAAS,KAAK,CAAC;AAAA,EAC7D;AACF;AAEO,IAAM,oBAAN,cAAgC,cAAc;AAAA,EACnD,YACE,SACA,OAAe,mDACf;AACA,UAAM,EAAE,MAAM,iBAAiB,UAAU,GAAG,SAAS,KAAK,CAAC;AAAA,EAC7D;AACF;AAsCO,IAAM,kBAAN,cAA8B,cAAc;AAAA,EACjD,YAAY,SAAiB,MAAe;AAC1C,UAAM,OAA2E;AAAA,MAC/E,MAAM;AAAA,MACN,UAAU;AAAA,MACV;AAAA,IACF;AACA,QAAI,SAAS,OAAW,MAAK,OAAO;AACpC,UAAM,IAAI;AAAA,EACZ;AACF;AA6BO,SAAS,gBAAgB,KAAoC;AAClE,SAAO,eAAe;AACxB;;;ACjHA,SAAS,mBAAmB,KAAiD;AAC3E,SACE,eAAe,SACf,WAAW,OACX,IAAI,UAAU,QACd,IAAI,UAAU;AAElB;AAMA,SAAS,mBACP,MACA,SACA,MACA,SACQ;AACR,QAAM,MAA+B,EAAE,IAAI,OAAO,MAAM,QAAQ;AAChE,MAAI,SAAS,OAAW,KAAI,MAAM,IAAI;AACtC,MAAI,YAAY,OAAW,KAAI,SAAS,IAAI;AAC5C,SAAO,KAAK,UAAU,GAAG,IAAI;AAC/B;AAsBO,SAAS,YAAY,OAAkC;AAC5D,QAAM,EAAE,KAAK,SAAS,KAAK,IAAI;AAG/B,MAAI,gBAAgB,GAAG,GAAG;AACxB,UAAM,WAAW;AAGjB,QAAI,SAAS,aAAa,GAAG;AAC3B,UAAI,MAAM;AACR,eAAO;AAAA,UACL,QAAQ,KAAK,UAAU,EAAE,IAAI,MAAM,MAAM,KAAK,CAAC,IAAI;AAAA,UACnD,QAAQ;AAAA,UACR,UAAU;AAAA,QACZ;AAAA,MACF;AACA,aAAO;AAAA,QACL,QAAQ,SAAS,UAAU;AAAA,QAC3B,QAAQ;AAAA,QACR,UAAU;AAAA,MACZ;AAAA,IACF;AAGA,QAAI,cAAc,GAAG,SAAS,IAAI,KAAK,SAAS,OAAO;AAAA;AACvD,QAAI,SAAS,SAAS,OAAW,gBAAe,GAAG,SAAS,IAAI;AAAA;AAChE,QAAI,SAAS,YAAY,OAAW,gBAAe,GAAG,SAAS,OAAO;AAAA;AAEtE,QAAI,MAAM;AACR,aAAO;AAAA,QACL,QAAQ,mBAAmB,SAAS,MAAM,SAAS,SAAS,SAAS,MAAM,SAAS,OAAO;AAAA,QAC3F,QAAQ,WAAW,SAAS,QAAQ,SAAS,QAAQ,OAAO;AAAA,QAC5D,UAAU,SAAS;AAAA,MACrB;AAAA,IACF;AAEA,QAAI,WAAW,SAAS,OAAO;AAC7B,qBAAe,SAAS,QAAQ;AAAA,IAClC;AAEA,WAAO,EAAE,QAAQ,IAAI,QAAQ,aAAa,UAAU,SAAS,SAAS;AAAA,EACxE;AAGA,MAAI,mBAAmB,GAAG,GAAG;AAC3B,UAAM,YAAY;AAClB,UAAM,MAAM,UAAU,WAAW;AAIjC,UAAM,aAAa,IAAI,gBAAgB,GAAG;AAE1C,QAAIC,cAAa,GAAG,WAAW,IAAI,KAAK,GAAG;AAAA;AAE3C,QAAI,MAAM;AACR,aAAO;AAAA,QACL,QAAQ,mBAAmB,WAAW,MAAM,GAAG;AAAA,QAC/C,QAAQ,WAAW,UAAU,QAAQ,UAAU,QAAQ,OAAO;AAAA,QAC9D,UAAU;AAAA,MACZ;AAAA,IACF;AAEA,QAAI,WAAW,UAAU,OAAO;AAC9B,MAAAA,eAAc,UAAU,QAAQ;AAAA,IAClC;AAEA,WAAO,EAAE,QAAQ,IAAI,QAAQA,aAAY,UAAU,EAAE;AAAA,EACvD;AAGA,QAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,QAAM,QAAQ,eAAe,QAAQ,IAAI,QAAQ;AACjD,QAAM,eAAe,aAAa,OAAO;AAAA;AAEzC,MAAI,MAAM;AACR,WAAO;AAAA,MACL,QAAQ,mBAAmB,YAAY,OAAO;AAAA,MAC9C,QAAQ,WAAW,QAAQ,QAAQ,OAAO;AAAA,MAC1C,UAAU;AAAA,IACZ;AAAA,EACF;AAEA,MAAI,aAAa;AACjB,MAAI,WAAW,OAAO;AACpB,kBAAc,QAAQ;AAAA,EACxB;AAEA,SAAO,EAAE,QAAQ,IAAI,QAAQ,YAAY,UAAU,EAAE;AACvD;;;AFlHO,IAAe,eAAf,cAAoC,QAAQ;AAAA,EACzC,kBAAuD;AAC7D,UAAM,OAAO,KAAK;AAClB,WAAO;AAAA,MACL,SAAS,KAAK,SAAS,WAAW;AAAA,MAClC,MAAM,KAAK,SAAS,QAAQ;AAAA,IAC9B;AAAA,EACF;AAAA,EAEA,MAAe,MACb,KAKgB;AAChB,UAAM,EAAE,SAAS,KAAK,IAAI,KAAK,gBAAgB;AAE/C,UAAM,SAAS,YAAY,EAAE,KAAK,SAAS,KAAK,CAAC;AAGjD,QAAI,OAAO,OAAQ,SAAQ,OAAO,MAAM,OAAO,MAAM;AACrD,QAAI,OAAO,OAAQ,SAAQ,OAAO,MAAM,OAAO,MAAM;AAErD,QAAI,OAAO,aAAa,GAAG;AAIzB,YAAM,IAAI,OAAO,UAAU,CAAC;AAAA,IAC9B;AAIA,QAAI,yBAAyB;AAC7B,QAAI,QAAQ,EAAE,MAAM,OAAO,SAAS;AACpC,UAAM;AAAA,EACR;AACF;;;AG9EA,SAAS,aAAa;AAGf,IAAM,cAAc;AAAA,EACzB,SAAS,MAAM,QAAQ;AAAA,IACrB,aACE;AAAA,EACJ,CAAC;AACH;AAGO,IAAM,WAAW;AAAA,EACtB,MAAM,MAAM,QAAQ;AAAA,IAClB,aAAa;AAAA,EACf,CAAC;AACH;;;ACAO,IAAM,cAAN,MAAmC;AAAA,EACxC,MAAc;AACZ,WAAO,KAAK,IAAI;AAAA,EAClB;AACF;;;ACNA,OAAO,QAAQ;AACf,OAAO,UAAU;AASjB,SAAS,kBAA2B;AAClC,QAAM,WAA2D,CAAC;AAClE,QAAM,gBAAgB,QAAQ,IAAI,iBAAiB;AACnD,MAAI,kBAAkB,QAAW;AAC/B,aAAS,kBAAkB;AAAA,EAC7B;AACA,QAAM,UAAU,QAAQ,IAAI,SAAS;AACrC,MAAI,YAAY,QAAW;AACzB,aAAS,UAAU;AAAA,EACrB;AACA,SAAO;AACT;AAQO,SAAS,uBACd,UACA,SACA,KACQ;AACR,QAAM,mBAAmB,YAAY,QAAQ;AAC7C,QAAM,eAAe,WAAW,GAAG,QAAQ;AAC3C,QAAM,cAAc,OAAO,gBAAgB;AAE3C,MAAI,qBAAqB,SAAS;AAChC,UAAM,UAAU,YAAY;AAC5B,UAAMC,QACJ,YAAY,UAAa,YAAY,KACjC,UACA,KAAK,MAAM,KAAK,cAAc,WAAW,SAAS;AACxD,WAAO,KAAK,MAAM,KAAKA,OAAM,SAAS,aAAa;AAAA,EACrD;AAEA,QAAM,gBAAgB,YAAY;AAClC,QAAM,OACJ,OAAO,kBAAkB,YAAY,kBAAkB,KACnD,gBACA,KAAK,MAAM,KAAK,cAAc,SAAS;AAC7C,SAAO,KAAK,MAAM,KAAK,MAAM,SAAS,aAAa;AACrD;;;AC3CO,IAAM,0BAAN,MAAwD;AAAA,EAC7D,MAAM,QAAQ,cAAyC;AAErD,SAAK;AACL,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;;;ACVA,OAAO,YAAY;AACnB,OAAO,QAAQ;AACf,SAAS,eAAe;;;ACdxB,SAAS,SAAS;AAIlB,IAAM,iBAAiB,EACpB,OAAO;AAAA,EACN,aAAa,EAAE,OAAO;AAAA,EACtB,OAAO,EAAE,OAAO;AAAA;AAAA;AAAA,EAGhB,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AACvC,CAAC,EACA,OAAO;AAEV,IAAM,gBAAgB,EACnB,OAAO;AAAA,EACN,aAAa,EAAE,OAAO;AAAA,EACtB,cAAc,EAAE,OAAO;AAAA,EACvB,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAC/C,UAAU;AAAA,EACV,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAClD,CAAC,EACA,OAAO;AAEV,IAAM,yBAAyB,EAC5B,OAAO;AAAA,EACN,KAAK,EAAE,OAAO;AAAA,EACd,aAAa,EAAE,OAAO;AAAA,EACtB,OAAO,EAAE,OAAO;AAAA,EAChB,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAC/C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAClD,CAAC,EACA,OAAO;AAGH,IAAM,oBAAoB,EAC9B,OAAO;AAAA,EACN,SAAS,EAAE,QAAQ,CAAC;AAAA,EACpB,QAAQ,EAAE,OAAO;AAAA,EACjB,UAAU,EAAE,OAAO;AAAA,EACnB,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,aAAa;AAAA;AAAA;AAAA,EAG5C,WAAW,uBAAuB,SAAS;AAC7C,CAAC,EACA,OAAO;AAUH,SAAS,iBAAiB,OAA6B;AAC5D,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,aAAa,OAAO;AACrE,UAAM,UAAW,MAA+B;AAChD,QAAI,YAAY,GAAG;AACjB,YAAM,QAAQ,OAAO,YAAY,WAAW,OAAO,OAAO,IAAI;AAC9D,YAAM,IAAI;AAAA,QACR,4BAA4B,KAAK;AAAA,MACnC;AAAA,IACF;AAAA,EACF;AAEA,QAAM,SAAS,kBAAkB,UAAU,KAAK;AAChD,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO,OAAO;AAChB;;;AD7CA,IAAM,oBAAoB;AAG1B,IAAM,gBAAgB;AAQtB,IAAM,0BAA0B;AAkDhC,SAAS,aAAa,KAAc,MAAuB;AACzD,SACE,eAAe,SACd,IAA8B,SAAS;AAE5C;AAEO,IAAM,sBAAN,MAAqD;AAAA,EACzC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAGA;AAAA,EAEjB,YAAY,MAA+B;AACzC,SAAK,WAAW,MAAM,YAAY,uBAAuB;AACzD,SAAK,QAAQ,MAAM,SAAS,IAAI,YAAY;AAC5C,SAAK,YAAY,MAAM,aAAa,IAAI,wBAAwB;AAChE,SAAK,YAAY,MAAM,cAAc,MAAM,QAAQ;AACnD,SAAK,WAAW,MAAM,YAAY,QAAQ;AAAA,EAC5C;AAAA,EAEA,MAAM,OAA6B;AACjC,SAAK,yBAAyB;AAE9B,QAAI;AACJ,QAAI;AACF,YAAM,GAAG,aAAa,KAAK,UAAU,MAAM;AAAA,IAC7C,SAAS,KAAK;AACZ,UAAI,aAAa,KAAK,QAAQ,GAAG;AAC/B,cAAM,IAAI,iBAAiB,wBAAwB;AAAA,MACrD;AACA,YAAM;AAAA,IACR;AAEA,QAAI;AACJ,QAAI;AACF,eAAS,KAAK,MAAM,GAAG;AAAA,IACzB,QAAQ;AAEN,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,WAAO,iBAAiB,MAAM;AAAA,EAChC;AAAA,EAEA,MAAM,KAAK,OAAmC;AAC5C,UAAM,MAAM,QAAQ,KAAK,QAAQ;AACjC,OAAG,UAAU,KAAK,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AAClD,QAAI,KAAK,aAAa,SAAS;AAE7B,SAAG,UAAU,KAAK,GAAK;AAAA,IACzB;AAEA,UAAM,UAAU,GAAG,KAAK,QAAQ,IAAI,QAAQ,GAAG,IAAI,OAChD,YAAY,CAAC,EACb,SAAS,KAAK,CAAC;AAClB,QAAI;AAEF,SAAG,cAAc,SAAS,KAAK,UAAU,OAAO,MAAM,CAAC,GAAG;AAAA,QACxD,MAAM;AAAA,MACR,CAAC;AACD,SAAG,WAAW,SAAS,KAAK,QAAQ;AAAA,IACtC,SAAS,KAAK;AACZ,UAAI;AACF,WAAG,WAAW,OAAO;AAAA,MACvB,QAAQ;AAAA,MAER;AACA,YAAM;AAAA,IACR;AAEA,QAAI,KAAK,aAAa,SAAS;AAE7B,SAAG,UAAU,KAAK,UAAU,GAAK;AAAA,IACnC;AAAA,EACF;AAAA,EAEA,MAAM,QAAuB;AAC3B,QAAI;AACF,SAAG,WAAW,KAAK,QAAQ;AAAA,IAC7B,SAAS,KAAK;AACZ,UAAI,aAAa,KAAK,QAAQ,GAAG;AAC/B;AAAA,MACF;AACA,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAM,oBAAoB,aAAuC;AAC/D,UAAM,WAAW,KAAK,UAAU,EAAE,aAAa;AAC/C,QAAI,OAAO,aAAa,YAAY,SAAS,SAAS,GAAG;AACvD,aAAO;AAAA,IACT;AAEA,UAAM,QAAQ,MAAM,KAAK,KAAK;AAC9B,UAAM,OAAO,eAAe;AAC5B,UAAM,UAAU,MAAM,SAAS,IAAI;AACnC,QAAI,YAAY,QAAW;AACzB,YAAM,IAAI,iBAAiB,wBAAwB;AAAA,IACrD;AAEA,UAAM,gBACJ,IAAI,KAAK,QAAQ,SAAS,EAAE,QAAQ,IAAI,KAAK,MAAM,IAAI;AACzD,QAAI,gBAAgB,mBAAmB;AACrC,aAAO,KAAK,kBAAkB,OAAO,MAAM,OAAO;AAAA,IACpD;AAEA,WAAO,QAAQ;AAAA,EACjB;AAAA,EAEA,MAAM,yBAA0C;AAC9C,UAAM,WAAW,KAAK,UAAU,EAAE,uBAAuB;AACzD,QAAI,OAAO,aAAa,YAAY,SAAS,SAAS,GAAG;AACvD,aAAO;AAAA,IACT;AAEA,QAAI;AACJ,QAAI;AACF,cAAQ,MAAM,KAAK,KAAK;AAAA,IAC1B,SAAS,KAAK;AACZ,UAAI,eAAe,kBAAkB;AACnC,cAAM,IAAI,iBAAiB,4BAA4B;AAAA,MACzD;AACA,YAAM;AAAA,IACR;AAEA,UAAM,UAAU,MAAM;AACtB,QAAI,YAAY,QAAW;AACzB,YAAM,IAAI,iBAAiB,4BAA4B;AAAA,IACzD;AAEA,UAAM,gBACJ,IAAI,KAAK,QAAQ,SAAS,EAAE,QAAQ,IAAI,KAAK,MAAM,IAAI;AACzD,QAAI,gBAAgB,mBAAmB;AAGrC,YAAM,IAAI,iBAAiB,4BAA4B;AAAA,IACzD;AAEA,WAAO,QAAQ;AAAA,EACjB;AAAA,EAEA,MAAM,qBAAqB,SAA0C;AACnE,QAAI;AACJ,QAAI;AACF,cAAQ,MAAM,KAAK,KAAK;AAAA,IAC1B,SAAS,KAAK;AACZ,UAAI,eAAe,kBAAkB;AAGnC,gBAAQ,EAAE,SAAS,GAAG,QAAQ,IAAI,UAAU,IAAI,UAAU,CAAC,EAAE;AAAA,MAC/D,OAAO;AACL,cAAM;AAAA,MACR;AAAA,IACF;AAEA,UAAM,UAAuB;AAAA,MAC3B,GAAG;AAAA,MACH,WAAW;AAAA,IACb;AACA,UAAM,KAAK,KAAK,OAAO;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,kBACZ,OACA,MACA,SACiB;AACjB,QAAI;AACJ,QAAI;AACF,kBAAY,MAAM,KAAK,UAAU,QAAQ,QAAQ,YAAY;AAAA,IAC/D,QAAQ;AACN,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,UAAuB;AAAA,MAC3B,GAAG;AAAA,MACH,UAAU;AAAA,QACR,GAAG,MAAM;AAAA,QACT,CAAC,IAAI,GAAG;AAAA,UACN,GAAG;AAAA,UACH,aAAa,UAAU;AAAA,UACvB,cAAc,UAAU;AAAA,UACxB,WAAW,UAAU;AAAA,QACvB;AAAA,MACF;AAAA,IACF;AACA,UAAM,KAAK,KAAK,OAAO;AACvB,WAAO,UAAU;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,2BAAiC;AACvC,QAAI,KAAK,aAAa,SAAS;AAC7B;AAAA,IACF;AAEA,QAAI;AACJ,QAAI;AACF,aAAO,GAAG,SAAS,KAAK,QAAQ;AAAA,IAClC,SAAS,KAAK;AACZ,UAAI,aAAa,KAAK,QAAQ,GAAG;AAC/B;AAAA,MACF;AACA,YAAM;AAAA,IACR;AAEA,UAAM,OAAO,KAAK,OAAO;AACzB,QAAI,SAAS,KAAO;AAClB,SAAG,UAAU,KAAK,UAAU,GAAK;AACjC,cAAQ,OAAO;AAAA,QACb,8CAA8C,KAAK,SAAS,CAAC,CAAC;AAAA;AAAA,MAChE;AAAA,IACF;AAAA,EACF;AACF;;;ARxUA,IAAqB,aAArB,MAAqB,oBAAmB,aAAa;AAAA,EACnD,OAAgB,cAAc;AAAA,EAE9B,OAAgB,WAAW;AAAA,IACzB;AAAA,IACA;AAAA,EACF;AAAA,EAEA,OAAgB,QAAQ;AAAA,IACtB,GAAG;AAAA,IACH,GAAG;AAAA,IACH,SAASC,OAAM,OAAO;AAAA,MACpB,aAAa;AAAA,MACb,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAAA,EAEA,MAAa,MAAqB;AAChC,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,MAAM,WAAU;AAG7C,UAAM,WAAW,QAAQ,IAAI,iBAAiB;AAC9C,QAAI,OAAO,aAAa,YAAY,SAAS,SAAS,GAAG;AACvD,UAAI,MAAM,MAAM;AACd,aAAK,IAAI,KAAK,UAAU,EAAE,IAAI,MAAM,MAAM,EAAE,QAAQ,OAAO,UAAU,KAAK,EAAE,CAAC,CAAC;AAAA,MAChF,OAAO;AACL,aAAK,IAAI,0CAA0C;AAAA,MACrD;AACA;AAAA,IACF;AAEA,UAAM,QAAQ,IAAI,oBAAoB;AACtC,UAAM,cAAc,MAAM,WAAW;AAErC,QAAI;AACJ,QAAI;AACF,cAAQ,MAAM,MAAM,KAAK;AAAA,IAC3B,QAAQ;AACN,YAAM,IAAI,iBAAiB,wBAAwB;AAAA,IACrD;AAEA,UAAM,UAAU,MAAM,SAAS,WAAW;AAC1C,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,iBAAiB,wBAAwB;AAAA,IACrD;AAEA,UAAM,WAAW,QAAQ;AAIzB,UAAM,aAAa,SAAS,cAAc;AAC1C,UAAM,SAAS,SAAS,UAAU,CAAC;AAEnC,QAAI,MAAM,MAAM;AAEd,WAAK;AAAA,QACH,KAAK,UAAU;AAAA,UACb,IAAI;AAAA,UACJ,MAAM;AAAA,YACJ,QAAQ;AAAA,YACR,UAAU,MAAM;AAAA,YAChB;AAAA,YACA;AAAA,YACA,WAAW,QAAQ;AAAA,YACnB,SAAS;AAAA,UACX;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF,OAAO;AACL,YAAM,YAAY,SAAS,QAAQ,UAAU,SAAS,KAAK,KAAK;AAChE,WAAK;AAAA,QACH,yBAAyB,MAAM,QAAQ,GAAG,SAAS,cAAc,WAAW;AAAA,MAC9E;AACA,WAAK,IAAI,eAAe,cAAc,SAAS,EAAE;AACjD,WAAK,IAAI,aAAa,OAAO,SAAS,IAAI,OAAO,KAAK,IAAI,IAAI,QAAQ,EAAE;AACxE,WAAK,IAAI,oBAAoB,QAAQ,SAAS,EAAE;AAAA,IAClD;AAAA,EACF;AACF;","names":["Flags","stderrText","base","Flags"]}