@ratio-app/cli 0.1.1

package/dist/lib/auth/http-refresher.js

@@ -0,0 +1,103 @@
+// src/lib/auth/http-refresher.ts
+import { z } from "zod";
+
+// src/lib/errors.ts
+var RatioCLIError = class extends Error {
+  code;
+  exitCode;
+  hint;
+  docsUrl;
+  constructor(opts) {
+    super(opts.message);
+    this.name = new.target.name;
+    this.code = opts.code;
+    this.exitCode = opts.exitCode;
+    if (opts.hint !== void 0) this.hint = opts.hint;
+    if (opts.docsUrl !== void 0) this.docsUrl = opts.docsUrl;
+  }
+};
+var TokenExpiredError = class extends RatioCLIError {
+  constructor(message, hint = "Run 'ratio auth login' to refresh your session.") {
+    super({ code: "TOKEN_EXPIRED", exitCode: 3, message, hint });
+  }
+};
+var NetworkError = class extends RatioCLIError {
+  constructor(message, hint = "Check your network and retry.") {
+    super({ code: "NETWORK_ERROR", exitCode: 5, message, hint });
+  }
+};
+
+// src/lib/auth/verbose-trace.ts
+var noopTracer = () => {
+};
+
+// src/lib/auth/http-refresher.ts
+var RefreshResponseSchema = z.object({
+  access_token: z.string().min(1),
+  refresh_token: z.string().min(1),
+  expires_in: z.number().int().positive()
+});
+var HttpTokenRefresher = class {
+  serverUrl;
+  clientId;
+  fetchImpl;
+  trace;
+  constructor(opts) {
+    this.serverUrl = opts.serverUrl;
+    this.clientId = opts.clientId;
+    this.fetchImpl = opts.fetchImpl ?? fetch;
+    this.trace = opts.trace ?? noopTracer;
+  }
+  async refresh(refreshToken) {
+    const body = {
+      grant_type: "refresh_token",
+      refresh_token: refreshToken,
+      clientId: this.clientId
+    };
+    this.trace("refresh: fired (access token expired or expiring)");
+    const startedAt = Date.now();
+    let response;
+    try {
+      response = await this.fetchImpl(`${this.serverUrl}/oauth/token`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(body)
+      });
+    } catch {
+      this.trace(`POST /oauth/token \u2192 network error (${Date.now() - startedAt}ms)`);
+      throw new NetworkError("Failed to reach the Ratio server during token refresh.");
+    }
+    this.trace(`POST /oauth/token \u2192 ${response.status} (${Date.now() - startedAt}ms)`);
+    if (response.status >= 400 && response.status < 500) {
+      throw new TokenExpiredError(
+        "Your session has expired and could not be refreshed."
+      );
+    }
+    if (response.status >= 500 || !response.ok) {
+      throw new NetworkError("The Ratio server returned an error during token refresh.");
+    }
+    let raw;
+    try {
+      raw = await response.json();
+    } catch {
+      throw new NetworkError("Token refresh response was not valid JSON.");
+    }
+    const parsed = RefreshResponseSchema.safeParse(raw);
+    if (!parsed.success) {
+      throw new TokenExpiredError(
+        "Your session has expired and could not be refreshed."
+      );
+    }
+    const data = parsed.data;
+    const expiresAt = new Date(Date.now() + data.expires_in * 1e3).toISOString();
+    return {
+      accessToken: data.access_token,
+      refreshToken: data.refresh_token,
+      expiresAt
+    };
+  }
+};
+export {
+  HttpTokenRefresher
+};
+//# sourceMappingURL=http-refresher.js.map

package/dist/lib/auth/http-refresher.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/lib/auth/http-refresher.ts","../../../src/lib/errors.ts","../../../src/lib/auth/verbose-trace.ts"],"sourcesContent":["/**\n * HTTP implementation of the TokenRefresher interface.\n *\n * POSTs to /oauth/token with grant_type=refresh_token.\n * Maps 4xx → TokenExpiredError, 5xx/network → NetworkError.\n * Never logs or echoes the token value in any error message.\n */\n\nimport { z } from 'zod';\nimport { NetworkError, TokenExpiredError } from '../errors.js';\nimport type { TokenRefresher, TokenSet } from '../credentials/index.js';\nimport { RATIO_CLI_CLIENT_ID } from './config.js';\nimport { noopTracer } from './verbose-trace.js';\nimport type { VerboseTracer } from './verbose-trace.js';\n\n/** Refresh response envelope — subset of the full token response. */\nconst RefreshResponseSchema = z.object({\n  access_token: z.string().min(1),\n  refresh_token: z.string().min(1),\n  expires_in: z.number().int().positive(),\n});\n\nexport interface HttpTokenRefresherOptions {\n  readonly serverUrl: string;\n  readonly clientId: typeof RATIO_CLI_CLIENT_ID;\n  readonly fetchImpl?: typeof fetch;  // injectable for tests\n  /** Verbose diagnostic sink — never receives the refresh token value. */\n  readonly trace?: VerboseTracer;\n}\n\nexport class HttpTokenRefresher implements TokenRefresher {\n  private readonly serverUrl: string;\n  private readonly clientId: string;\n  private readonly fetchImpl: typeof fetch;\n  private readonly trace: VerboseTracer;\n\n  constructor(opts: HttpTokenRefresherOptions) {\n    this.serverUrl = opts.serverUrl;\n    this.clientId = opts.clientId;\n    this.fetchImpl = opts.fetchImpl ?? fetch;\n    this.trace = opts.trace ?? noopTracer;\n  }\n\n  async refresh(refreshToken: string): Promise<TokenSet> {\n    const body = {\n      grant_type: 'refresh_token',\n      refresh_token: refreshToken,\n      clientId: this.clientId,\n    };\n\n    this.trace('refresh: fired (access token expired or expiring)');\n    const startedAt = Date.now();\n\n    let response: Response;\n    try {\n      response = await this.fetchImpl(`${this.serverUrl}/oauth/token`, {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify(body),\n      });\n    } catch {\n      this.trace(`POST /oauth/token → network error (${Date.now() - startedAt}ms)`);\n      throw new NetworkError('Failed to reach the Ratio server during token refresh.');\n    }\n\n    this.trace(`POST /oauth/token → ${response.status} (${Date.now() - startedAt}ms)`);\n\n    if (response.status >= 400 && response.status < 500) {\n      throw new TokenExpiredError(\n        'Your session has expired and could not be refreshed.',\n      );\n    }\n\n    if (response.status >= 500 || !response.ok) {\n      throw new NetworkError('The Ratio server returned an error during token refresh.');\n    }\n\n    let raw: unknown;\n    try {\n      raw = await response.json();\n    } catch {\n      throw new NetworkError('Token refresh response was not valid JSON.');\n    }\n\n    const parsed = RefreshResponseSchema.safeParse(raw);\n    if (!parsed.success) {\n      throw new TokenExpiredError(\n        'Your session has expired and could not be refreshed.',\n      );\n    }\n\n    const data = parsed.data;\n    const expiresAt = new Date(Date.now() + data.expires_in * 1000).toISOString();\n\n    return {\n      accessToken: data.access_token,\n      refreshToken: data.refresh_token,\n      expiresAt,\n    };\n  }\n}\n","/**\n * Error hierarchy for the Ratio CLI. Every error thrown from a command's\n * run() is expected to be an instance of RatioCLIError so the global\n * render-error handler can map it to a deterministic stderr line and exit\n * code. Uncaught Error subclasses render as \"INTERNAL: <msg>\" with exit 1.\n *\n * No import from @oclif/core — this file is dependency-free so tests\n * can import it without oclif overhead.\n */\n\nexport class RatioCLIError extends Error {\n  readonly code: string;\n  readonly exitCode: number;\n  readonly hint?: string;\n  readonly docsUrl?: string;\n\n  constructor(opts: {\n    code: string;\n    exitCode: number;\n    message: string;\n    hint?: string;\n    docsUrl?: string;\n  }) {\n    super(opts.message);\n    this.name = new.target.name;\n    this.code = opts.code;\n    this.exitCode = opts.exitCode;\n    if (opts.hint !== undefined) this.hint = opts.hint;\n    if (opts.docsUrl !== undefined) this.docsUrl = opts.docsUrl;\n  }\n}\n\n/** Coming-soon stub UX. Renders on stdout with exit 0. */\nexport class ComingSoonError extends RatioCLIError {\n  constructor(message: string) {\n    super({ code: 'COMING_SOON', exitCode: 0, message });\n  }\n}\n\n/** User has no credentials and command requires auth. */\nexport class NotLoggedInError extends RatioCLIError {\n  constructor(\n    message: string,\n    hint: string = \"Run 'ratio auth login' to sign in.\",\n  ) {\n    super({ code: 'NOT_LOGGED_IN', exitCode: 3, message, hint });\n  }\n}\n\nexport class TokenExpiredError extends RatioCLIError {\n  constructor(\n    message: string,\n    hint: string = \"Run 'ratio auth login' to refresh your session.\",\n  ) {\n    super({ code: 'TOKEN_EXPIRED', exitCode: 3, message, hint });\n  }\n}\n\nexport class ScopeDeniedError extends RatioCLIError {\n  constructor(message: string, hint?: string) {\n    const opts: { code: string; exitCode: number; message: string; hint?: string } = {\n      code: 'SCOPE_DENIED',\n      exitCode: 4,\n      message,\n    };\n    if (hint !== undefined) opts.hint = hint;\n    super(opts);\n  }\n}\n\nexport class NetworkError extends RatioCLIError {\n  constructor(message: string, hint: string = 'Check your network and retry.') {\n    super({ code: 'NETWORK_ERROR', exitCode: 5, message, hint });\n  }\n}\n\nexport class RelayConnectError extends RatioCLIError {\n  constructor(\n    message: string,\n    hint: string = 'Verify the tunnel URL and that the auth-server is reachable.',\n  ) {\n    super({ code: 'RELAY_CONNECT', exitCode: 6, message, hint });\n  }\n}\n\nexport class TemplateExistsError extends RatioCLIError {\n  constructor(\n    message: string,\n    hint: string = 'Choose a different name or remove the existing directory.',\n  ) {\n    super({ code: 'TEMPLATE_EXISTS', exitCode: 7, message, hint });\n  }\n}\n\nexport class ValidationError extends RatioCLIError {\n  constructor(message: string, hint?: string) {\n    const opts: { code: string; exitCode: number; message: string; hint?: string } = {\n      code: 'VALIDATION_ERROR',\n      exitCode: 8,\n      message,\n    };\n    if (hint !== undefined) opts.hint = hint;\n    super(opts);\n  }\n}\n\nexport class RelayResumeGapError extends RatioCLIError {\n  constructor(\n    message: string,\n    hint: string = 'Reconnect from the current cursor; older events are outside the buffer window.',\n  ) {\n    super({ code: 'RELAY_RESUME_GAP', exitCode: 9, message, hint });\n  }\n}\n\nexport class OrchestratorSpawnError extends RatioCLIError {\n  constructor(\n    message: string,\n    hint: string = \"Could not start your app's dev command — check that the command in ratio.config.jsonc runs from this directory.\",\n  ) {\n    super({ code: 'ORCHESTRATOR_SPAWN', exitCode: 10, message, hint });\n  }\n}\n\nexport class OrchestratorDrainTimeoutError extends RatioCLIError {\n  constructor(\n    message: string,\n    hint: string = 'Your dev command did not exit cleanly within 5 seconds — it was forcibly terminated.',\n  ) {\n    super({ code: 'ORCHESTRATOR_DRAIN', exitCode: 11, message, hint });\n  }\n}\n\nexport function isRatioCLIError(err: unknown): err is RatioCLIError {\n  return err instanceof RatioCLIError;\n}\n","/**\n * Minimal verbose diagnostic seam for the auth flow.\n *\n * When `--verbose` is on, the auth HTTP/loopback boundaries emit ONE line\n * per boundary crossing (method, path, status, timing, flow events) so a\n * failing login/refresh can be diagnosed from the CLI transcript alone.\n *\n * Safety contract (enforced by tests):\n *  - Lines go to STDERR only — never stdout — so `--json` consumers and\n *    shell pipelines are never corrupted.\n *  - NO secret material is ever passed to a tracer: no access/refresh\n *    token, no authorization code, no code_verifier, no state value.\n *    Only method, path, HTTP status, port numbers, and durations.\n */\n\n/** A tracer receives one pre-formatted diagnostic message per event. */\nexport type VerboseTracer = (msg: string) => void;\n\n/** Shared no-op used when `--verbose` is off (default everywhere). */\nexport const noopTracer: VerboseTracer = () => {};\n\n/**\n * Build a tracer. Returns the shared no-op unless `verbose` is true.\n * Output sink is injectable for tests; defaults to process.stderr.\n */\nexport function createVerboseTracer(\n  verbose: boolean,\n  write: (line: string) => void = (line) => {\n    process.stderr.write(line);\n  },\n): VerboseTracer {\n  if (!verbose) return noopTracer;\n  return (msg: string) => {\n    write(`[verbose] ${msg}\\n`);\n  };\n}\n"],"mappings":";AAQA,SAAS,SAAS;;;ACEX,IAAM,gBAAN,cAA4B,MAAM;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,MAMT;AACD,UAAM,KAAK,OAAO;AAClB,SAAK,OAAO,WAAW;AACvB,SAAK,OAAO,KAAK;AACjB,SAAK,WAAW,KAAK;AACrB,QAAI,KAAK,SAAS,OAAW,MAAK,OAAO,KAAK;AAC9C,QAAI,KAAK,YAAY,OAAW,MAAK,UAAU,KAAK;AAAA,EACtD;AACF;AAmBO,IAAM,oBAAN,cAAgC,cAAc;AAAA,EACnD,YACE,SACA,OAAe,mDACf;AACA,UAAM,EAAE,MAAM,iBAAiB,UAAU,GAAG,SAAS,KAAK,CAAC;AAAA,EAC7D;AACF;AAcO,IAAM,eAAN,cAA2B,cAAc;AAAA,EAC9C,YAAY,SAAiB,OAAe,iCAAiC;AAC3E,UAAM,EAAE,MAAM,iBAAiB,UAAU,GAAG,SAAS,KAAK,CAAC;AAAA,EAC7D;AACF;;;ACvDO,IAAM,aAA4B,MAAM;AAAC;;;AFHhD,IAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC9B,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC/B,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACxC,CAAC;AAUM,IAAM,qBAAN,MAAmD;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,MAAiC;AAC3C,SAAK,YAAY,KAAK;AACtB,SAAK,WAAW,KAAK;AACrB,SAAK,YAAY,KAAK,aAAa;AACnC,SAAK,QAAQ,KAAK,SAAS;AAAA,EAC7B;AAAA,EAEA,MAAM,QAAQ,cAAyC;AACrD,UAAM,OAAO;AAAA,MACX,YAAY;AAAA,MACZ,eAAe;AAAA,MACf,UAAU,KAAK;AAAA,IACjB;AAEA,SAAK,MAAM,mDAAmD;AAC9D,UAAM,YAAY,KAAK,IAAI;AAE3B,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,KAAK,UAAU,GAAG,KAAK,SAAS,gBAAgB;AAAA,QAC/D,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU,IAAI;AAAA,MAC3B,CAAC;AAAA,IACH,QAAQ;AACN,WAAK,MAAM,2CAAsC,KAAK,IAAI,IAAI,SAAS,KAAK;AAC5E,YAAM,IAAI,aAAa,wDAAwD;AAAA,IACjF;AAEA,SAAK,MAAM,4BAAuB,SAAS,MAAM,KAAK,KAAK,IAAI,IAAI,SAAS,KAAK;AAEjF,QAAI,SAAS,UAAU,OAAO,SAAS,SAAS,KAAK;AACnD,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,QAAI,SAAS,UAAU,OAAO,CAAC,SAAS,IAAI;AAC1C,YAAM,IAAI,aAAa,0DAA0D;AAAA,IACnF;AAEA,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,SAAS,KAAK;AAAA,IAC5B,QAAQ;AACN,YAAM,IAAI,aAAa,4CAA4C;AAAA,IACrE;AAEA,UAAM,SAAS,sBAAsB,UAAU,GAAG;AAClD,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,OAAO,OAAO;AACpB,UAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,aAAa,GAAI,EAAE,YAAY;AAE5E,WAAO;AAAA,MACL,aAAa,KAAK;AAAA,MAClB,cAAc,KAAK;AAAA,MACnB;AAAA,IACF;AAAA,EACF;AACF;","names":[]}

package/dist/lib/auth/identity.d.ts

@@ -0,0 +1,26 @@
+export { TokenDerivedIdentity } from './authorize-code-exchange.js';
+import '../credentials/types.js';
+import './config.js';
+import './verbose-trace.js';
+
+/**
+ * Identity helpers for the auth flow.
+ *
+ * A-29 adjudication: the backend token envelope does not expose developerId/email.
+ * Identity is therefore token-derived: {clientId, merchantId, scopes}.
+ *
+ * This file re-exports the TokenDerivedIdentity type from authorize-code-exchange
+ * so consumers have a single import point. It is a null-object for the POST-token
+ * identity fetch originally envisioned (no GET /developer/me endpoint
+ * exists yet). The appName optional field is added if GET /oauth/app-info returns it.
+ */
+
+/** Rendered display string for the identity in whoami / login success. */
+declare function renderIdentity(identity: {
+    clientId: string;
+    merchantId: string;
+    scopes: readonly string[];
+    appName?: string;
+}): string;
+
+export { renderIdentity };

package/dist/lib/auth/identity.js

@@ -0,0 +1,10 @@
+// src/lib/auth/identity.ts
+function renderIdentity(identity) {
+  const scopePart = identity.scopes.length > 0 ? ` scopes=[${identity.scopes.join(", ")}]` : "";
+  const appPart = identity.appName ? ` app="${identity.appName}"` : "";
+  return `clientId=${identity.clientId} merchantId=${identity.merchantId}${appPart}${scopePart}`;
+}
+export {
+  renderIdentity
+};
+//# sourceMappingURL=identity.js.map

package/dist/lib/auth/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/lib/auth/identity.ts"],"sourcesContent":["/**\n * Identity helpers for the auth flow.\n *\n * A-29 adjudication: the backend token envelope does not expose developerId/email.\n * Identity is therefore token-derived: {clientId, merchantId, scopes}.\n *\n * This file re-exports the TokenDerivedIdentity type from authorize-code-exchange\n * so consumers have a single import point. It is a null-object for the POST-token\n * identity fetch originally envisioned (no GET /developer/me endpoint\n * exists yet). The appName optional field is added if GET /oauth/app-info returns it.\n */\n\nexport type { TokenDerivedIdentity } from './authorize-code-exchange.js';\n\n/** Rendered display string for the identity in whoami / login success. */\nexport function renderIdentity(identity: {\n  clientId: string;\n  merchantId: string;\n  scopes: readonly string[];\n  appName?: string;\n}): string {\n  const scopePart = identity.scopes.length > 0\n    ? ` scopes=[${identity.scopes.join(', ')}]`\n    : '';\n  const appPart = identity.appName ? ` app=\"${identity.appName}\"` : '';\n  return `clientId=${identity.clientId} merchantId=${identity.merchantId}${appPart}${scopePart}`;\n}\n"],"mappings":";AAeO,SAAS,eAAe,UAKpB;AACT,QAAM,YAAY,SAAS,OAAO,SAAS,IACvC,YAAY,SAAS,OAAO,KAAK,IAAI,CAAC,MACtC;AACJ,QAAM,UAAU,SAAS,UAAU,SAAS,SAAS,OAAO,MAAM;AAClE,SAAO,YAAY,SAAS,QAAQ,eAAe,SAAS,UAAU,GAAG,OAAO,GAAG,SAAS;AAC9F;","names":[]}

package/dist/lib/auth/index.d.ts

@@ -0,0 +1,13 @@
+export { PkcePair, computeS256Challenge, generatePkcePair } from './pkce.js';
+export { generateState, timingSafeEqualState } from './state.js';
+export { DEFAULT_SERVER_URL, RATIO_CLI_CLIENT_ID, RATIO_CLI_MERCHANT_ID, ResolveServerUrlOptions, ServerConfig, resolveServerUrl } from './config.js';
+export { AuthorizeUrlBrowserOptions, AuthorizeUrlManualOptions, buildBrowserAuthorizeUrl, buildManualAuthorizeUrl } from './authorize-url.js';
+export { CodeExchangeInput, CodeExchangeOutput, TokenDerivedIdentity, exchangeCodeForTokens } from './authorize-code-exchange.js';
+export { HttpTokenRefresher, HttpTokenRefresherOptions } from './http-refresher.js';
+export { LoopbackAwaitOptions, LoopbackAwaitResult, LoopbackSession, awaitLoopbackCallback, buildLoopbackRedirectUri, startLoopbackSession } from './loopback-server.js';
+export { BrowserOpener, defaultBrowserOpener } from './browser.js';
+export { StdinPrompt, defaultStdinPrompt } from './manual-prompt.js';
+export { renderIdentity } from './identity.js';
+export { VerboseTracer, createVerboseTracer, noopTracer } from './verbose-trace.js';
+import '../credentials/types.js';
+import '../credentials/refresher.js';