@ratio-app/cli 0.1.1

package/dist/index.js

@@ -0,0 +1,617 @@
+// src/lib/dev-store-gate.ts
+var NoopDevStoreGate = class {
+  // eslint-disable-next-line @typescript-eslint/no-unused-vars
+  assertAllowed(_context) {
+  }
+};
+var _defaultInstance = new NoopDevStoreGate();
+function getDevStoreGate() {
+  return _defaultInstance;
+}
+
+// src/lib/credentials/clock.ts
+var SystemClock = class {
+  now() {
+    return Date.now();
+  }
+};
+
+// src/lib/credentials/path.ts
+import os from "os";
+import path from "path";
+function snapshotPathEnv() {
+  const snapshot = {};
+  const xdgConfigHome = process.env["XDG_CONFIG_HOME"];
+  if (xdgConfigHome !== void 0) {
+    snapshot.XDG_CONFIG_HOME = xdgConfigHome;
+  }
+  const appData = process.env["APPDATA"];
+  if (appData !== void 0) {
+    snapshot.APPDATA = appData;
+  }
+  return snapshot;
+}
+function defaultCredentialsPath(platform, homedir, env) {
+  const resolvedPlatform = platform ?? process.platform;
+  const resolvedHome = homedir ?? os.homedir();
+  const resolvedEnv = env ?? snapshotPathEnv();
+  if (resolvedPlatform === "win32") {
+    const appData = resolvedEnv.APPDATA;
+    const base2 = appData !== void 0 && appData !== "" ? appData : path.win32.join(resolvedHome, "AppData", "Roaming");
+    return path.win32.join(base2, "ratio", "credentials");
+  }
+  const xdgConfigHome = resolvedEnv.XDG_CONFIG_HOME;
+  const base = typeof xdgConfigHome === "string" && xdgConfigHome !== "" ? xdgConfigHome : path.posix.join(resolvedHome, ".config");
+  return path.posix.join(base, "ratio", "credentials");
+}
+
+// src/lib/errors.ts
+var RatioCLIError = class extends Error {
+  code;
+  exitCode;
+  hint;
+  docsUrl;
+  constructor(opts) {
+    super(opts.message);
+    this.name = new.target.name;
+    this.code = opts.code;
+    this.exitCode = opts.exitCode;
+    if (opts.hint !== void 0) this.hint = opts.hint;
+    if (opts.docsUrl !== void 0) this.docsUrl = opts.docsUrl;
+  }
+};
+var NotLoggedInError = class extends RatioCLIError {
+  constructor(message, hint = "Run 'ratio auth login' to sign in.") {
+    super({ code: "NOT_LOGGED_IN", exitCode: 3, message, hint });
+  }
+};
+var TokenExpiredError = class extends RatioCLIError {
+  constructor(message, hint = "Run 'ratio auth login' to refresh your session.") {
+    super({ code: "TOKEN_EXPIRED", exitCode: 3, message, hint });
+  }
+};
+var ValidationError = class extends RatioCLIError {
+  constructor(message, hint) {
+    const opts = {
+      code: "VALIDATION_ERROR",
+      exitCode: 8,
+      message
+    };
+    if (hint !== void 0) opts.hint = hint;
+    super(opts);
+  }
+};
+
+// src/lib/credentials/refresher.ts
+var NotImplementedRefresher = class {
+  async refresh(refreshToken) {
+    void refreshToken;
+    throw new NotLoggedInError(
+      "Token refresh is not available yet in this CLI version."
+    );
+  }
+};
+
+// src/lib/credentials/store.ts
+import crypto from "crypto";
+import fs from "fs";
+import { dirname } from "path";
+
+// src/lib/credentials/schema.ts
+import { z } from "zod";
+var identitySchema = z.object({
+  developerId: z.string(),
+  email: z.string(),
+  // Token-derived fields captured at login. Optional (additive) so files
+  // written before these fields existed still validate as version 1.
+  merchantId: z.string().optional(),
+  scopes: z.array(z.string()).optional()
+}).strict();
+var profileSchema = z.object({
+  accessToken: z.string(),
+  refreshToken: z.string(),
+  expiresAt: z.string().datetime({ offset: true }),
+  identity: identitySchema,
+  obtainedAt: z.string().datetime({ offset: true })
+}).strict();
+var developerSessionSchema = z.object({
+  jwt: z.string(),
+  developerId: z.string(),
+  email: z.string(),
+  expiresAt: z.string().datetime({ offset: true }),
+  obtainedAt: z.string().datetime({ offset: true })
+}).strict();
+var credentialsSchema = z.object({
+  version: z.literal(1),
+  server: z.string(),
+  clientId: z.string(),
+  profiles: z.record(z.string(), profileSchema),
+  // Optional cached developer session. Additive so files written before
+  // this field existed still validate as version 1.
+  developer: developerSessionSchema.optional()
+}).strict();
+function parseCredentials(input) {
+  if (typeof input === "object" && input !== null && "version" in input) {
+    const version = input.version;
+    if (version !== 1) {
+      const label = typeof version === "number" ? String(version) : "unknown";
+      throw new ValidationError(
+        `credentials file version ${label} is unsupported by this CLI \u2014 upgrade the CLI or sign in again`
+      );
+    }
+  }
+  const result = credentialsSchema.safeParse(input);
+  if (!result.success) {
+    throw new ValidationError(
+      "credentials file schema mismatch \u2014 expected v1 shape"
+    );
+  }
+  return result.data;
+}
+
+// src/lib/credentials/store.ts
+var REFRESH_WINDOW_MS = 3e5;
+var ENV_TOKEN_VAR = "RATIO_API_TOKEN";
+var ENV_DEVELOPER_TOKEN_VAR = "RATIO_DEVELOPER_TOKEN";
+function hasErrnoCode(err, code) {
+  return err instanceof Error && err.code === code;
+}
+var FileCredentialStore = class {
+  filePath;
+  clock;
+  refresher;
+  envReader;
+  platform;
+  constructor(opts) {
+    this.filePath = opts?.filePath ?? defaultCredentialsPath();
+    this.clock = opts?.clock ?? new SystemClock();
+    this.refresher = opts?.refresher ?? new NotImplementedRefresher();
+    this.envReader = opts?.envReader ?? (() => process.env);
+    this.platform = opts?.platform ?? process.platform;
+  }
+  async load() {
+    this.reapplyFileModeIfDrifted();
+    let raw;
+    try {
+      raw = fs.readFileSync(this.filePath, "utf8");
+    } catch (err) {
+      if (hasErrnoCode(err, "ENOENT")) {
+        throw new NotLoggedInError("You are not signed in.");
+      }
+      throw err;
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      throw new ValidationError(
+        'credentials file is not valid JSON \u2014 run "ratio auth login" to reset'
+      );
+    }
+    return parseCredentials(parsed);
+  }
+  async save(creds) {
+    const dir = dirname(this.filePath);
+    fs.mkdirSync(dir, { recursive: true, mode: 448 });
+    if (this.platform !== "win32") {
+      fs.chmodSync(dir, 448);
+    }
+    const tmpPath = `${this.filePath}.${process.pid}.${crypto.randomBytes(8).toString("hex")}.tmp`;
+    try {
+      fs.writeFileSync(tmpPath, JSON.stringify(creds, null, 2), {
+        mode: 384
+      });
+      fs.renameSync(tmpPath, this.filePath);
+    } catch (err) {
+      try {
+        fs.unlinkSync(tmpPath);
+      } catch {
+      }
+      throw err;
+    }
+    if (this.platform !== "win32") {
+      fs.chmodSync(this.filePath, 384);
+    }
+  }
+  async clear() {
+    try {
+      fs.unlinkSync(this.filePath);
+    } catch (err) {
+      if (hasErrnoCode(err, "ENOENT")) {
+        return;
+      }
+      throw err;
+    }
+  }
+  async getValidAccessToken(profileName) {
+    const envToken = this.envReader()[ENV_TOKEN_VAR];
+    if (typeof envToken === "string" && envToken.length > 0) {
+      return envToken;
+    }
+    const creds = await this.load();
+    const name = profileName ?? "default";
+    const profile = creds.profiles[name];
+    if (profile === void 0) {
+      throw new NotLoggedInError("You are not signed in.");
+    }
+    const msUntilExpiry = new Date(profile.expiresAt).getTime() - this.clock.now();
+    if (msUntilExpiry < REFRESH_WINDOW_MS) {
+      return this.refreshAndPersist(creds, name, profile);
+    }
+    return profile.accessToken;
+  }
+  async getValidDeveloperToken() {
+    const envToken = this.envReader()[ENV_DEVELOPER_TOKEN_VAR];
+    if (typeof envToken === "string" && envToken.length > 0) {
+      return envToken;
+    }
+    let creds;
+    try {
+      creds = await this.load();
+    } catch (err) {
+      if (err instanceof NotLoggedInError) {
+        throw new NotLoggedInError("Developer signin required.");
+      }
+      throw err;
+    }
+    const session = creds.developer;
+    if (session === void 0) {
+      throw new NotLoggedInError("Developer signin required.");
+    }
+    const msUntilExpiry = new Date(session.expiresAt).getTime() - this.clock.now();
+    if (msUntilExpiry < REFRESH_WINDOW_MS) {
+      throw new NotLoggedInError("Developer signin required.");
+    }
+    return session.jwt;
+  }
+  async saveDeveloperSession(session) {
+    let creds;
+    try {
+      creds = await this.load();
+    } catch (err) {
+      if (err instanceof NotLoggedInError) {
+        creds = { version: 1, server: "", clientId: "", profiles: {} };
+      } else {
+        throw err;
+      }
+    }
+    const updated = {
+      ...creds,
+      developer: session
+    };
+    await this.save(updated);
+  }
+  /**
+   * Exchange the profile's refresh token for a fresh token set, merge it
+   * into the loaded credentials (preserving every other profile), persist
+   * atomically, and return the new access token. A refresher failure is
+   * wrapped in TokenExpiredError; the underlying message is deliberately
+   * discarded so a secret can never leak through the error surface.
+   */
+  async refreshAndPersist(creds, name, profile) {
+    let refreshed;
+    try {
+      refreshed = await this.refresher.refresh(profile.refreshToken);
+    } catch {
+      throw new TokenExpiredError(
+        "Your session has expired and could not be refreshed."
+      );
+    }
+    const updated = {
+      ...creds,
+      profiles: {
+        ...creds.profiles,
+        [name]: {
+          ...profile,
+          accessToken: refreshed.accessToken,
+          refreshToken: refreshed.refreshToken,
+          expiresAt: refreshed.expiresAt
+        }
+      }
+    };
+    await this.save(updated);
+    return refreshed.accessToken;
+  }
+  /**
+   * POSIX-only startup permission check: if the file exists with a mode
+   * other than 0600, re-apply 0600 and emit a warning to stderr. Never
+   * runs on Windows (stat modes there do not map to POSIX bits and chmod
+   * must not be called). Missing file is NOT an error here — load()
+   * reports it as NotLoggedInError.
+   */
+  reapplyFileModeIfDrifted() {
+    if (this.platform === "win32") {
+      return;
+    }
+    let stat2;
+    try {
+      stat2 = fs.statSync(this.filePath);
+    } catch (err) {
+      if (hasErrnoCode(err, "ENOENT")) {
+        return;
+      }
+      throw err;
+    }
+    const mode = stat2.mode & 511;
+    if (mode !== 384) {
+      fs.chmodSync(this.filePath, 384);
+      process.stderr.write(
+        `[warn] credentials file permissions were 0o${mode.toString(8)}; corrected to 0600.
+`
+      );
+    }
+  }
+};
+
+// src/scaffold/render.ts
+import { copyFile, mkdir, readFile, readdir, stat, writeFile } from "fs/promises";
+import { dirname as dirname2, join, resolve } from "path";
+import { fileURLToPath } from "url";
+var RatioTemplateError = class extends Error {
+  code;
+  templateName;
+  key;
+  constructor(opts) {
+    super(opts.message, opts.cause === void 0 ? void 0 : { cause: opts.cause });
+    this.name = "RatioTemplateError";
+    this.code = opts.code;
+    if (opts.templateName !== void 0) {
+      this.templateName = opts.templateName;
+    }
+    if (opts.key !== void 0) {
+      this.key = opts.key;
+    }
+  }
+};
+var PLACEHOLDER_REGEX = /\{\{([a-zA-Z][a-zA-Z0-9_]*)\}\}/g;
+var TMPL_SUFFIX = ".tmpl";
+async function isDirectory(path2) {
+  try {
+    return (await stat(path2)).isDirectory();
+  } catch {
+    return false;
+  }
+}
+async function discoverSourceRoot(sourceRootOverride) {
+  if (sourceRootOverride !== void 0) {
+    return sourceRootOverride;
+  }
+  const moduleDir = dirname2(fileURLToPath(import.meta.url));
+  const candidates = [join(moduleDir, "templates"), resolve(moduleDir, "..", "templates")];
+  for (const candidate of candidates) {
+    if (await isDirectory(candidate)) {
+      return candidate;
+    }
+  }
+  throw new RatioTemplateError({
+    code: "io_error",
+    message: `templates root not found (looked in: ${candidates.join(", ")})`
+  });
+}
+function assertManifestShape(raw, path2) {
+  if (typeof raw !== "object" || raw === null || typeof raw.name !== "string" || typeof raw.description !== "string" || !Array.isArray(raw.substitutionKeys) || !raw.substitutionKeys.every(
+    (k) => typeof k === "string"
+  )) {
+    throw new RatioTemplateError({
+      code: "io_error",
+      message: `invalid template manifest at ${path2}: expected { name, description, substitutionKeys[] }`
+    });
+  }
+  const shaped = raw;
+  return {
+    name: shaped.name,
+    description: shaped.description,
+    substitutionKeys: shaped.substitutionKeys
+  };
+}
+async function loadManifest(templateRoot) {
+  const manifestPath = join(templateRoot, "manifest.json");
+  let content;
+  try {
+    content = await readFile(manifestPath, "utf8");
+  } catch (err) {
+    throw new RatioTemplateError({
+      code: "io_error",
+      message: `failed to read template manifest at ${manifestPath}`,
+      cause: err
+    });
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(content);
+  } catch (err) {
+    throw new RatioTemplateError({
+      code: "io_error",
+      message: `template manifest at ${manifestPath} is not valid JSON`,
+      cause: err
+    });
+  }
+  return assertManifestShape(parsed, manifestPath);
+}
+function substituteContent(content, substitutions, allowedKeys, templateName) {
+  return content.replace(PLACEHOLDER_REGEX, (_match, key) => {
+    if (!allowedKeys.has(key)) {
+      throw new RatioTemplateError({
+        code: "unknown_substitution_key",
+        message: `placeholder {{${key}}} is not declared in the template manifest's substitutionKeys`,
+        templateName,
+        key
+      });
+    }
+    const value = substitutions[key];
+    if (value === void 0) {
+      throw new RatioTemplateError({
+        code: "missing_substitution_value",
+        message: `no substitution value provided for {{${key}}}`,
+        templateName,
+        key
+      });
+    }
+    return value;
+  });
+}
+async function walkTemplateTree(root, relative = "") {
+  const entries = await readdir(join(root, relative), { withFileTypes: true });
+  entries.sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+  const files = [];
+  for (const entry of entries) {
+    const rel = relative === "" ? entry.name : join(relative, entry.name);
+    if (entry.isDirectory()) {
+      files.push(...await walkTemplateTree(root, rel));
+    } else {
+      files.push({ relativePath: rel, absolutePath: join(root, rel) });
+    }
+  }
+  return files;
+}
+async function listTemplates(sourceRootOverride) {
+  const sourceRoot = await discoverSourceRoot(sourceRootOverride);
+  let entries;
+  try {
+    entries = await readdir(sourceRoot, { withFileTypes: true });
+  } catch (err) {
+    throw new RatioTemplateError({
+      code: "io_error",
+      message: `failed to read templates root at ${sourceRoot}`,
+      cause: err
+    });
+  }
+  const dirs = entries.filter((e) => e.isDirectory()).map((e) => e.name).sort();
+  const manifests = [];
+  for (const dir of dirs) {
+    manifests.push(await loadManifest(join(sourceRoot, dir)));
+  }
+  return manifests;
+}
+async function renderTemplate(input) {
+  const sourceRoot = await discoverSourceRoot(input.sourceRootOverride);
+  const templateRoot = join(sourceRoot, input.templateName);
+  if (!await isDirectory(templateRoot)) {
+    throw new RatioTemplateError({
+      code: "template_not_found",
+      message: `template '${input.templateName}' not found under ${sourceRoot}`,
+      templateName: input.templateName
+    });
+  }
+  const manifest = await loadManifest(templateRoot);
+  const allowedKeys = new Set(manifest.substitutionKeys);
+  try {
+    const existing = await readdir(input.destinationDir);
+    if (existing.length > 0) {
+      throw new RatioTemplateError({
+        code: "destination_not_empty",
+        message: `destination directory ${input.destinationDir} is not empty`,
+        templateName: input.templateName
+      });
+    }
+  } catch (err) {
+    if (err instanceof RatioTemplateError) {
+      throw err;
+    }
+    if (err.code !== "ENOENT") {
+      throw new RatioTemplateError({
+        code: "io_error",
+        message: `failed to inspect destination directory ${input.destinationDir}`,
+        templateName: input.templateName,
+        cause: err
+      });
+    }
+  }
+  let files;
+  try {
+    files = await walkTemplateTree(templateRoot);
+  } catch (err) {
+    throw new RatioTemplateError({
+      code: "io_error",
+      message: `failed to walk template tree at ${templateRoot}`,
+      templateName: input.templateName,
+      cause: err
+    });
+  }
+  const filesWritten = [];
+  let bytesWritten = 0;
+  for (const file of files) {
+    const isTmpl = file.relativePath.endsWith(TMPL_SUFFIX);
+    const outRelative = isTmpl ? file.relativePath.slice(0, -TMPL_SUFFIX.length) : file.relativePath;
+    const isTopLevelGitignore = file.relativePath === "gitignore";
+    const effectiveOutRelative = isTopLevelGitignore ? ".gitignore" : outRelative;
+    const outPath = join(input.destinationDir, effectiveOutRelative);
+    let perFileBytes = 0;
+    if (isTmpl) {
+      let raw;
+      try {
+        raw = await readFile(file.absolutePath, "utf8");
+      } catch (err) {
+        throw new RatioTemplateError({
+          code: "io_error",
+          message: `failed to read template file ${file.absolutePath}`,
+          templateName: input.templateName,
+          cause: err
+        });
+      }
+      const rendered = substituteContent(
+        raw,
+        input.substitutions,
+        allowedKeys,
+        input.templateName
+      );
+      try {
+        await mkdir(dirname2(outPath), { recursive: true });
+        await writeFile(outPath, rendered, "utf8");
+      } catch (err) {
+        throw new RatioTemplateError({
+          code: "io_error",
+          message: `failed to write rendered file ${outPath}`,
+          templateName: input.templateName,
+          cause: err
+        });
+      }
+      perFileBytes = Buffer.byteLength(rendered, "utf8");
+      bytesWritten += perFileBytes;
+    } else {
+      try {
+        await mkdir(dirname2(outPath), { recursive: true });
+        await copyFile(file.absolutePath, outPath);
+        perFileBytes = (await stat(outPath)).size;
+        bytesWritten += perFileBytes;
+      } catch (err) {
+        throw new RatioTemplateError({
+          code: "io_error",
+          message: `failed to copy file ${file.absolutePath} to ${outPath}`,
+          templateName: input.templateName,
+          cause: err
+        });
+      }
+    }
+    filesWritten.push(outPath);
+    if (input.onFile !== void 0) {
+      try {
+        input.onFile(effectiveOutRelative, perFileBytes);
+      } catch (err) {
+        throw new RatioTemplateError({
+          code: "io_error",
+          message: "onFile callback threw",
+          templateName: input.templateName,
+          cause: err
+        });
+      }
+    }
+  }
+  return { filesWritten, bytesWritten };
+}
+
+// src/index.ts
+var CLI_NAME = "@ratio-app/cli";
+export {
+  CLI_NAME,
+  FileCredentialStore,
+  NoopDevStoreGate,
+  NotImplementedRefresher,
+  RatioTemplateError,
+  SystemClock,
+  defaultCredentialsPath,
+  getDevStoreGate,
+  listTemplates,
+  renderTemplate
+};
+//# sourceMappingURL=index.js.map