@ratio-app/cli 0.1.1

package/dist/lib/auth/index.js

@@ -0,0 +1,527 @@
+// src/lib/auth/pkce.ts
+import crypto from "crypto";
+function computeS256Challenge(codeVerifier) {
+  return crypto.createHash("sha256").update(codeVerifier, "ascii").digest("base64url");
+}
+function generatePkcePair() {
+  const codeVerifier = crypto.randomBytes(96).toString("base64url");
+  const codeChallenge = computeS256Challenge(codeVerifier);
+  return { codeVerifier, codeChallenge, codeChallengeMethod: "S256" };
+}
+
+// src/lib/auth/state.ts
+import crypto2 from "crypto";
+function generateState() {
+  return crypto2.randomBytes(32).toString("base64url");
+}
+function timingSafeEqualState(a, b) {
+  const aBuf = Buffer.from(a, "utf8");
+  const bBuf = Buffer.from(b, "utf8");
+  if (aBuf.length !== bBuf.length) {
+    crypto2.timingSafeEqual(aBuf, aBuf);
+    return false;
+  }
+  return crypto2.timingSafeEqual(aBuf, bBuf);
+}
+
+// src/lib/auth/config.ts
+var DEFAULT_SERVER_URL = "https://gkx.ratio.win";
+var RATIO_CLI_MERCHANT_ID = "ratio-cli-dev";
+var RATIO_CLI_CLIENT_ID = "ratio-cli";
+function resolveServerUrl(opts) {
+  const env = opts?.env ?? process.env;
+  if (typeof env["RATIO_SERVER_URL"] === "string" && env["RATIO_SERVER_URL"].length > 0) {
+    return env["RATIO_SERVER_URL"];
+  }
+  if (typeof opts?.credentials?.server === "string" && opts.credentials.server.length > 0) {
+    return opts.credentials.server;
+  }
+  return DEFAULT_SERVER_URL;
+}
+
+// src/lib/auth/authorize-url.ts
+function buildBrowserAuthorizeUrl(o) {
+  const params = new URLSearchParams();
+  params.set("client_id", o.clientId);
+  params.set("merchant_id", o.merchantId ?? RATIO_CLI_MERCHANT_ID);
+  params.set("code_challenge", o.codeChallenge);
+  params.set("code_challenge_method", "S256");
+  params.set("state", o.state);
+  params.set("redirect_uri", o.redirectUri);
+  if (o.scopes && o.scopes.length > 0) {
+    params.set("scope", o.scopes.join(","));
+  }
+  return `${o.serverUrl}/oauth/authorize?${params.toString()}`;
+}
+function buildManualAuthorizeUrl(o) {
+  const params = new URLSearchParams();
+  params.set("client_id", o.clientId);
+  params.set("merchant_id", o.merchantId ?? RATIO_CLI_MERCHANT_ID);
+  params.set("code_challenge", o.codeChallenge);
+  params.set("code_challenge_method", "S256");
+  params.set("state", o.state);
+  params.set("display_code", "1");
+  if (o.scopes && o.scopes.length > 0) {
+    params.set("scope", o.scopes.join(","));
+  }
+  return `${o.serverUrl}/oauth/authorize?${params.toString()}`;
+}
+
+// src/lib/auth/authorize-code-exchange.ts
+import { z } from "zod";
+
+// src/lib/errors.ts
+var RatioCLIError = class extends Error {
+  code;
+  exitCode;
+  hint;
+  docsUrl;
+  constructor(opts) {
+    super(opts.message);
+    this.name = new.target.name;
+    this.code = opts.code;
+    this.exitCode = opts.exitCode;
+    if (opts.hint !== void 0) this.hint = opts.hint;
+    if (opts.docsUrl !== void 0) this.docsUrl = opts.docsUrl;
+  }
+};
+var NotLoggedInError = class extends RatioCLIError {
+  constructor(message, hint = "Run 'ratio auth login' to sign in.") {
+    super({ code: "NOT_LOGGED_IN", exitCode: 3, message, hint });
+  }
+};
+var TokenExpiredError = class extends RatioCLIError {
+  constructor(message, hint = "Run 'ratio auth login' to refresh your session.") {
+    super({ code: "TOKEN_EXPIRED", exitCode: 3, message, hint });
+  }
+};
+var NetworkError = class extends RatioCLIError {
+  constructor(message, hint = "Check your network and retry.") {
+    super({ code: "NETWORK_ERROR", exitCode: 5, message, hint });
+  }
+};
+var ValidationError = class extends RatioCLIError {
+  constructor(message, hint) {
+    const opts = {
+      code: "VALIDATION_ERROR",
+      exitCode: 8,
+      message
+    };
+    if (hint !== void 0) opts.hint = hint;
+    super(opts);
+  }
+};
+
+// src/lib/auth/verbose-trace.ts
+var noopTracer = () => {
+};
+function createVerboseTracer(verbose, write = (line) => {
+  process.stderr.write(line);
+}) {
+  if (!verbose) return noopTracer;
+  return (msg) => {
+    write(`[verbose] ${msg}
+`);
+  };
+}
+
+// src/lib/auth/authorize-code-exchange.ts
+var TokenResponseSchema = z.object({
+  access_token: z.string().min(1),
+  refresh_token: z.string().min(1),
+  expires_in: z.number().int().positive(),
+  token_type: z.string().optional(),
+  scope: z.string().optional(),
+  merchant_id: z.string().optional()
+});
+function exchangeCodeForTokens(i) {
+  return _exchangeCodeForTokensImpl(i);
+}
+async function _exchangeCodeForTokensImpl(i) {
+  const fetchFn = i.fetchImpl ?? fetch;
+  const body = {
+    grant_type: "authorization_code",
+    code: i.code,
+    clientId: i.clientId,
+    codeVerifier: i.codeVerifier
+  };
+  if (i.redirectUri !== void 0) {
+    body["redirectUri"] = i.redirectUri;
+  }
+  const trace = i.trace ?? noopTracer;
+  const startedAt = Date.now();
+  let response;
+  try {
+    response = await fetchFn(`${i.serverUrl}/oauth/token`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body)
+    });
+  } catch {
+    trace(`POST /oauth/token \u2192 network error (${Date.now() - startedAt}ms)`);
+    throw new NetworkError("Failed to reach the Ratio server during token exchange.");
+  }
+  trace(`POST /oauth/token \u2192 ${response.status} (${Date.now() - startedAt}ms)`);
+  if (response.status >= 400 && response.status < 500) {
+    throw new ValidationError(
+      "The authorization code was rejected. Run 'ratio auth login' again."
+    );
+  }
+  if (response.status >= 500 || !response.ok) {
+    throw new NetworkError("The Ratio server returned an error during token exchange.");
+  }
+  let raw;
+  try {
+    raw = await response.json();
+  } catch {
+    throw new ValidationError("Token response was not valid JSON.");
+  }
+  const parsed = TokenResponseSchema.safeParse(raw);
+  if (!parsed.success) {
+    throw new ValidationError("Token response shape was unexpected. Run ratio auth login again.");
+  }
+  const data = parsed.data;
+  const expiresAt = new Date(Date.now() + data.expires_in * 1e3).toISOString();
+  const tokens = {
+    accessToken: data.access_token,
+    refreshToken: data.refresh_token,
+    expiresAt
+  };
+  const scopeStr = data.scope ?? "";
+  const scopes = scopeStr.length > 0 ? scopeStr.split(/[\s,]+/).filter(Boolean) : [];
+  const identity = {
+    clientId: i.clientId,
+    merchantId: data.merchant_id ?? "ratio-cli-dev",
+    scopes
+  };
+  return { tokens, identity };
+}
+
+// src/lib/auth/http-refresher.ts
+import { z as z2 } from "zod";
+var RefreshResponseSchema = z2.object({
+  access_token: z2.string().min(1),
+  refresh_token: z2.string().min(1),
+  expires_in: z2.number().int().positive()
+});
+var HttpTokenRefresher = class {
+  serverUrl;
+  clientId;
+  fetchImpl;
+  trace;
+  constructor(opts) {
+    this.serverUrl = opts.serverUrl;
+    this.clientId = opts.clientId;
+    this.fetchImpl = opts.fetchImpl ?? fetch;
+    this.trace = opts.trace ?? noopTracer;
+  }
+  async refresh(refreshToken) {
+    const body = {
+      grant_type: "refresh_token",
+      refresh_token: refreshToken,
+      clientId: this.clientId
+    };
+    this.trace("refresh: fired (access token expired or expiring)");
+    const startedAt = Date.now();
+    let response;
+    try {
+      response = await this.fetchImpl(`${this.serverUrl}/oauth/token`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(body)
+      });
+    } catch {
+      this.trace(`POST /oauth/token \u2192 network error (${Date.now() - startedAt}ms)`);
+      throw new NetworkError("Failed to reach the Ratio server during token refresh.");
+    }
+    this.trace(`POST /oauth/token \u2192 ${response.status} (${Date.now() - startedAt}ms)`);
+    if (response.status >= 400 && response.status < 500) {
+      throw new TokenExpiredError(
+        "Your session has expired and could not be refreshed."
+      );
+    }
+    if (response.status >= 500 || !response.ok) {
+      throw new NetworkError("The Ratio server returned an error during token refresh.");
+    }
+    let raw;
+    try {
+      raw = await response.json();
+    } catch {
+      throw new NetworkError("Token refresh response was not valid JSON.");
+    }
+    const parsed = RefreshResponseSchema.safeParse(raw);
+    if (!parsed.success) {
+      throw new TokenExpiredError(
+        "Your session has expired and could not be refreshed."
+      );
+    }
+    const data = parsed.data;
+    const expiresAt = new Date(Date.now() + data.expires_in * 1e3).toISOString();
+    return {
+      accessToken: data.access_token,
+      refreshToken: data.refresh_token,
+      expiresAt
+    };
+  }
+};
+
+// src/lib/auth/loopback-server.ts
+import http from "http";
+function awaitLoopbackCallback(o) {
+  const trace = o.trace ?? noopTracer;
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    function settle(fn) {
+      if (settled) return;
+      settled = true;
+      server.close(() => fn());
+    }
+    const server = http.createServer((req, res) => {
+      const reqUrl = new URL(req.url ?? "/", `http://127.0.0.1`);
+      if (reqUrl.pathname !== "/callback") {
+        res.writeHead(404, { "Content-Type": "text/plain" });
+        res.end("Not found");
+        return;
+      }
+      const code = reqUrl.searchParams.get("code");
+      const state = reqUrl.searchParams.get("state");
+      if (!state || !timingSafeEqualState(state, o.expectedState)) {
+        trace("callback: state mismatch");
+        res.writeHead(400, { "Content-Type": "text/plain" });
+        res.end("State mismatch");
+        settle(
+          () => reject(
+            new ValidationError("Authorization callback failed a security check.")
+          )
+        );
+        return;
+      }
+      if (!code || code.length === 0) {
+        trace("callback: missing code");
+        res.writeHead(400, { "Content-Type": "text/plain" });
+        res.end("Missing code");
+        settle(
+          () => reject(
+            new ValidationError("Authorization callback did not return a code.")
+          )
+        );
+        return;
+      }
+      res.writeHead(200, { "Content-Type": "text/html" });
+      res.end("<html><body><h1>Signed in! You can close this tab.</h1></body></html>");
+      const addr = server.address();
+      const port = typeof addr === "object" && addr !== null ? addr.port : 0;
+      const redirectUri = `http://127.0.0.1:${port}/callback`;
+      trace(`callback: received on port ${port} (state ok)`);
+      settle(() => resolve({ code, redirectUri }));
+    });
+    server.on("error", (err) => {
+      settle(() => reject(err));
+    });
+    server.listen(0, "127.0.0.1", () => {
+      const boundAddr = server.address();
+      const boundPort = typeof boundAddr === "object" && boundAddr !== null ? boundAddr.port : 0;
+      trace(`loopback: bound 127.0.0.1:${boundPort}`);
+      const timer = setTimeout(() => {
+        trace(`callback: timeout fired after ${o.timeoutMs}ms`);
+        settle(
+          () => reject(
+            new NotLoggedInError(
+              "Browser flow timed out. Run 'ratio auth login --manual' to complete without a browser."
+            )
+          )
+        );
+      }, o.timeoutMs);
+      if (typeof timer.unref === "function") {
+        timer.unref();
+      }
+      if (o.signal) {
+        o.signal.addEventListener("abort", () => {
+          trace("callback: cancelled");
+          clearTimeout(timer);
+          settle(
+            () => reject(
+              new NotLoggedInError(
+                "Browser flow was cancelled. Run 'ratio auth login --manual' to complete without a browser."
+              )
+            )
+          );
+        });
+      }
+    });
+  });
+}
+function buildLoopbackRedirectUri(port) {
+  return `http://127.0.0.1:${port}/callback`;
+}
+function startLoopbackSession(trace = noopTracer) {
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    function settle(fn) {
+      if (settled) return;
+      settled = true;
+      fn();
+    }
+    const server = http.createServer();
+    server.on("error", reject);
+    server.listen(0, "127.0.0.1", () => {
+      const addr = server.address();
+      const port = typeof addr === "object" && addr !== null ? addr.port : 0;
+      const redirectUri = buildLoopbackRedirectUri(port);
+      trace(`loopback: bound 127.0.0.1:${port}`);
+      resolve({
+        port,
+        redirectUri,
+        awaitCallback(opts) {
+          const timeoutMs = opts.timeoutMs ?? 3e4;
+          return new Promise((res, rej) => {
+            server.on("request", (req, response) => {
+              const reqUrl = new URL(req.url ?? "/", `http://127.0.0.1`);
+              if (reqUrl.pathname !== "/callback") {
+                response.writeHead(404, { "Content-Type": "text/plain" });
+                response.end("Not found");
+                return;
+              }
+              const code = reqUrl.searchParams.get("code");
+              const state = reqUrl.searchParams.get("state");
+              if (!state || !timingSafeEqualState(state, opts.expectedState)) {
+                trace("callback: state mismatch");
+                response.writeHead(400, { "Content-Type": "text/plain" });
+                response.end("State mismatch");
+                settle(() => {
+                  clearTimeout(timer);
+                  server.close(
+                    () => rej(new ValidationError("Authorization callback failed a security check."))
+                  );
+                });
+                return;
+              }
+              if (!code || code.length === 0) {
+                trace("callback: missing code");
+                response.writeHead(400, { "Content-Type": "text/plain" });
+                response.end("Missing code");
+                settle(() => {
+                  clearTimeout(timer);
+                  server.close(
+                    () => rej(new ValidationError("Authorization callback did not return a code."))
+                  );
+                });
+                return;
+              }
+              response.writeHead(200, { "Content-Type": "text/html" });
+              response.end(
+                "<html><body><h1>Signed in! You can close this tab.</h1></body></html>"
+              );
+              trace(`callback: received on port ${port} (state ok)`);
+              settle(() => {
+                clearTimeout(timer);
+                server.close(() => res({ code, redirectUri }));
+              });
+            });
+            const timer = setTimeout(() => {
+              trace(`callback: timeout fired after ${timeoutMs}ms`);
+              settle(() => {
+                server.close(
+                  () => rej(
+                    new NotLoggedInError(
+                      "Browser flow timed out. Run 'ratio auth login --manual' to complete without a browser."
+                    )
+                  )
+                );
+              });
+            }, timeoutMs);
+            if (typeof timer.unref === "function") {
+              timer.unref();
+            }
+            if (opts.signal) {
+              opts.signal.addEventListener("abort", () => {
+                trace("callback: cancelled");
+                clearTimeout(timer);
+                settle(() => {
+                  server.close(
+                    () => rej(
+                      new NotLoggedInError(
+                        "Browser flow was cancelled. Run 'ratio auth login --manual' to complete without a browser."
+                      )
+                    )
+                  );
+                });
+              });
+            }
+          });
+        }
+      });
+    });
+  });
+}
+
+// src/lib/auth/browser.ts
+function defaultBrowserOpener() {
+  return {
+    async open(url) {
+      let openFn;
+      try {
+        const mod = await import("open");
+        openFn = mod.default;
+      } catch {
+        throw new NotLoggedInError(
+          "Could not open a browser. Run 'ratio auth login --manual' to complete without a browser."
+        );
+      }
+      try {
+        await openFn(url);
+      } catch {
+        throw new NotLoggedInError(
+          "Could not open a browser. Run 'ratio auth login --manual' to complete without a browser."
+        );
+      }
+    }
+  };
+}
+
+// src/lib/auth/manual-prompt.ts
+import { createInterface } from "readline/promises";
+import { stdin as input, stdout as output } from "process";
+function defaultStdinPrompt() {
+  return {
+    async askForCode(prompt) {
+      const rl = createInterface({ input, output });
+      try {
+        const answer = await rl.question(prompt);
+        return answer.trim();
+      } finally {
+        rl.close();
+      }
+    }
+  };
+}
+
+// src/lib/auth/identity.ts
+function renderIdentity(identity) {
+  const scopePart = identity.scopes.length > 0 ? ` scopes=[${identity.scopes.join(", ")}]` : "";
+  const appPart = identity.appName ? ` app="${identity.appName}"` : "";
+  return `clientId=${identity.clientId} merchantId=${identity.merchantId}${appPart}${scopePart}`;
+}
+export {
+  DEFAULT_SERVER_URL,
+  HttpTokenRefresher,
+  RATIO_CLI_CLIENT_ID,
+  RATIO_CLI_MERCHANT_ID,
+  awaitLoopbackCallback,
+  buildBrowserAuthorizeUrl,
+  buildLoopbackRedirectUri,
+  buildManualAuthorizeUrl,
+  computeS256Challenge,
+  createVerboseTracer,
+  defaultBrowserOpener,
+  defaultStdinPrompt,
+  exchangeCodeForTokens,
+  generatePkcePair,
+  generateState,
+  noopTracer,
+  renderIdentity,
+  resolveServerUrl,
+  startLoopbackSession,
+  timingSafeEqualState
+};
+//# sourceMappingURL=index.js.map

package/dist/lib/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/lib/auth/pkce.ts","../../../src/lib/auth/state.ts","../../../src/lib/auth/config.ts","../../../src/lib/auth/authorize-url.ts","../../../src/lib/auth/authorize-code-exchange.ts","../../../src/lib/errors.ts","../../../src/lib/auth/verbose-trace.ts","../../../src/lib/auth/http-refresher.ts","../../../src/lib/auth/loopback-server.ts","../../../src/lib/auth/browser.ts","../../../src/lib/auth/manual-prompt.ts","../../../src/lib/auth/identity.ts"],"sourcesContent":["/**\n * PKCE (RFC 7636) helpers — S256 code challenge only.\n *\n * The \"plain\" method is rejected by the backend DTO validator and is\n * never generated here. All operations are synchronous and pure.\n */\n\nimport crypto from 'node:crypto';\n\nexport interface PkcePair {\n  readonly codeVerifier: string;   // 43-128 chars, unreserved-only (RFC 7636 §4.1)\n  readonly codeChallenge: string;  // base64url(SHA-256(codeVerifier))\n  readonly codeChallengeMethod: 'S256';\n}\n\n/**\n * Compute the S256 code challenge for a given code verifier.\n * BASE64URL-ENCODE(SHA256(ASCII(code_verifier))) without padding.\n * Algorithm matches the backend pkce utility byte-for-byte.\n */\nexport function computeS256Challenge(codeVerifier: string): string {\n  return crypto.createHash('sha256').update(codeVerifier, 'ascii').digest('base64url');\n}\n\n/**\n * Generate a fresh PKCE pair for one authorization request.\n * codeVerifier is 96 random base64url bytes → 128 chars (within RFC 7636 43-128 range).\n */\nexport function generatePkcePair(): PkcePair {\n  const codeVerifier = crypto.randomBytes(96).toString('base64url');\n  const codeChallenge = computeS256Challenge(codeVerifier);\n  return { codeVerifier, codeChallenge, codeChallengeMethod: 'S256' };\n}\n","/**\n * OAuth state parameter helpers.\n *\n * State is generated once per authorization request and must be compared\n * in constant time to prevent timing-oracle CSRF attacks.\n */\n\nimport crypto from 'node:crypto';\n\n/**\n * Generate a fresh state value: 32 random bytes encoded as base64url.\n * 32 bytes = 256 bits of entropy, well above the 128-bit minimum.\n */\nexport function generateState(): string {\n  return crypto.randomBytes(32).toString('base64url');\n}\n\n/**\n * Constant-time comparison of two state strings.\n * Returns true iff a === b without leaking timing information.\n * Both strings are converted to UTF-8 Buffers before comparison;\n * length-mismatch is handled without a fast-fail branch.\n */\nexport function timingSafeEqualState(a: string, b: string): boolean {\n  const aBuf = Buffer.from(a, 'utf8');\n  const bBuf = Buffer.from(b, 'utf8');\n  if (aBuf.length !== bBuf.length) {\n    // Perform a dummy comparison to avoid timing-observable fast-path.\n    crypto.timingSafeEqual(aBuf, aBuf);\n    return false;\n  }\n  return crypto.timingSafeEqual(aBuf, bBuf);\n}\n","/**\n * Server-URL resolution for the Ratio CLI auth flow.\n *\n * Resolution order (highest priority first):\n *   1. RATIO_SERVER_URL environment variable\n *   2. Credentials.server from the stored credential file (passed in as opts.credentials.server)\n *   3. The compiled-in default: https://gkx.ratio.win\n *\n * The default is the ONLY place this URL appears in non-config source files.\n * All other auth-library modules call resolveServerUrl() — never hardcode.\n *\n * A-28: the merchantId constant lives here so it appears in exactly ONE\n * production file and is grep-able.\n */\n\n/** Compiled-in default server URL. */\nexport const DEFAULT_SERVER_URL = 'https://gkx.ratio.win';\n\n/**\n * Synthetic merchantId sent in the authorize URL.\n * A-28 adjudication: backend auto-creates missing merchants via\n * ensureMerchantExists(); 'ratio-cli-dev' is the designated synthetic value.\n * Appears in exactly ONE production file (this one).\n */\nexport const RATIO_CLI_MERCHANT_ID = 'ratio-cli-dev';\n\n/** The fixed clientId for the ratio-cli public OAuth client. */\nexport const RATIO_CLI_CLIENT_ID = 'ratio-cli' as const;\n\nexport interface ServerConfig {\n  readonly url: string;\n}\n\nexport interface ResolveServerUrlOptions {\n  readonly credentials?: { readonly server?: string };\n  readonly env?: Readonly<Record<string, string | undefined>>;\n}\n\n/**\n * Resolve the backend server URL using the three-level precedence chain.\n * Injectable for tests: pass `env` to avoid reading `process.env` directly.\n */\nexport function resolveServerUrl(opts?: ResolveServerUrlOptions): string {\n  const env = opts?.env ?? process.env;\n  if (typeof env['RATIO_SERVER_URL'] === 'string' && env['RATIO_SERVER_URL'].length > 0) {\n    return env['RATIO_SERVER_URL'];\n  }\n  if (typeof opts?.credentials?.server === 'string' && opts.credentials.server.length > 0) {\n    return opts.credentials.server;\n  }\n  return DEFAULT_SERVER_URL;\n}\n","/**\n * Pure URL builders for the OAuth authorization step.\n *\n * The browser flow uses a redirectUri (loopback callback) so the portal\n * redirects back to the CLI. The manual flow uses ?display_code=1 so\n * the portal renders a copyable code for the user to paste.\n *\n * Zero network I/O in this module — pure string construction only.\n */\n\nimport { RATIO_CLI_CLIENT_ID, RATIO_CLI_MERCHANT_ID } from './config.js';\n\nexport interface AuthorizeUrlBrowserOptions {\n  readonly serverUrl: string;\n  readonly clientId: typeof RATIO_CLI_CLIENT_ID;\n  readonly codeChallenge: string;\n  readonly state: string;\n  readonly redirectUri: string;    // http://127.0.0.1:<port>/callback\n  readonly scopes?: readonly string[];\n  readonly merchantId?: string;\n}\n\nexport interface AuthorizeUrlManualOptions {\n  readonly serverUrl: string;\n  readonly clientId: typeof RATIO_CLI_CLIENT_ID;\n  readonly codeChallenge: string;\n  readonly state: string;\n  readonly scopes?: readonly string[];\n  readonly merchantId?: string;\n}\n\n/**\n * Build the authorize URL for the browser flow.\n * Includes redirect_uri for the loopback callback; does NOT include display_code.\n */\nexport function buildBrowserAuthorizeUrl(o: AuthorizeUrlBrowserOptions): string {\n  const params = new URLSearchParams();\n  params.set('client_id', o.clientId);\n  params.set('merchant_id', o.merchantId ?? RATIO_CLI_MERCHANT_ID);\n  params.set('code_challenge', o.codeChallenge);\n  params.set('code_challenge_method', 'S256');\n  params.set('state', o.state);\n  params.set('redirect_uri', o.redirectUri);\n  if (o.scopes && o.scopes.length > 0) {\n    params.set('scope', o.scopes.join(','));\n  }\n  return `${o.serverUrl}/oauth/authorize?${params.toString()}`;\n}\n\n/**\n * Build the authorize URL for the manual copy-paste flow.\n * Includes display_code=1 so the portal renders a copyable code.\n * Does NOT include redirect_uri.\n */\nexport function buildManualAuthorizeUrl(o: AuthorizeUrlManualOptions): string {\n  const params = new URLSearchParams();\n  params.set('client_id', o.clientId);\n  params.set('merchant_id', o.merchantId ?? RATIO_CLI_MERCHANT_ID);\n  params.set('code_challenge', o.codeChallenge);\n  params.set('code_challenge_method', 'S256');\n  params.set('state', o.state);\n  params.set('display_code', '1');\n  if (o.scopes && o.scopes.length > 0) {\n    params.set('scope', o.scopes.join(','));\n  }\n  return `${o.serverUrl}/oauth/authorize?${params.toString()}`;\n}\n","/**\n * OAuth authorization-code exchange step.\n *\n * Used by BOTH the browser flow (with redirectUri) and the manual flow\n * (without redirectUri). Returns typed tokens + identity derived from\n * the token response.\n *\n * A-29 adjudication: identity = token-derived {clientId, merchantId, scopes}.\n * The backend token envelope does not expose developerId/email. This is a\n * known ADR contradiction resolved pre-implementation; the schema tolerates\n * absence and additive identity fields can be added when a backend endpoint\n * for developer identity is available.\n *\n * Token response schema is pinned with zod for fast detection of envelope drift.\n * Any schema mismatch throws a static-message ValidationError — the raw body\n * is never included in any error message (secret-leak prevention).\n */\n\nimport { z } from 'zod';\nimport { NetworkError, ValidationError } from '../errors.js';\nimport type { TokenSet } from '../credentials/index.js';\nimport { RATIO_CLI_CLIENT_ID } from './config.js';\nimport { noopTracer } from './verbose-trace.js';\nimport type { VerboseTracer } from './verbose-trace.js';\n\n/** Token response envelope from POST /oauth/token (authorization_code grant). */\nconst TokenResponseSchema = z.object({\n  access_token: z.string().min(1),\n  refresh_token: z.string().min(1),\n  expires_in: z.number().int().positive(),\n  token_type: z.string().optional(),\n  scope: z.string().optional(),\n  merchant_id: z.string().optional(),\n});\n\n/** Token-derived identity (A-29 shape). */\nexport interface TokenDerivedIdentity {\n  readonly clientId: string;\n  readonly merchantId: string;\n  readonly scopes: readonly string[];\n}\n\nexport interface CodeExchangeInput {\n  readonly serverUrl: string;\n  readonly code: string;\n  readonly codeVerifier: string;\n  readonly redirectUri?: string;          // undefined for --manual\n  readonly clientId: typeof RATIO_CLI_CLIENT_ID;\n  readonly fetchImpl?: typeof fetch;      // injectable for tests\n  /** Verbose diagnostic sink — never receives token/code/verifier/state. */\n  readonly trace?: VerboseTracer;\n}\n\nexport interface CodeExchangeOutput {\n  readonly tokens: TokenSet;\n  readonly identity: TokenDerivedIdentity;\n}\n\n/**\n * Exchange an authorization code for tokens.\n * POSTs to /oauth/token with grant_type=authorization_code.\n * Never logs or includes token values in error messages.\n */\nexport function exchangeCodeForTokens(i: CodeExchangeInput): Promise<CodeExchangeOutput> {\n  return _exchangeCodeForTokensImpl(i);\n}\n\nasync function _exchangeCodeForTokensImpl(i: CodeExchangeInput): Promise<CodeExchangeOutput> {\n  const fetchFn = i.fetchImpl ?? fetch;\n\n  const body: Record<string, string> = {\n    grant_type: 'authorization_code',\n    code: i.code,\n    clientId: i.clientId,\n    codeVerifier: i.codeVerifier,\n  };\n  if (i.redirectUri !== undefined) {\n    body['redirectUri'] = i.redirectUri;\n  }\n\n  const trace = i.trace ?? noopTracer;\n  const startedAt = Date.now();\n\n  let response: Response;\n  try {\n    response = await fetchFn(`${i.serverUrl}/oauth/token`, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify(body),\n    });\n  } catch {\n    trace(`POST /oauth/token → network error (${Date.now() - startedAt}ms)`);\n    throw new NetworkError('Failed to reach the Ratio server during token exchange.');\n  }\n\n  trace(`POST /oauth/token → ${response.status} (${Date.now() - startedAt}ms)`);\n\n  if (response.status >= 400 && response.status < 500) {\n    throw new ValidationError(\n      \"The authorization code was rejected. Run 'ratio auth login' again.\",\n    );\n  }\n\n  if (response.status >= 500 || !response.ok) {\n    throw new NetworkError('The Ratio server returned an error during token exchange.');\n  }\n\n  let raw: unknown;\n  try {\n    raw = await response.json();\n  } catch {\n    throw new ValidationError('Token response was not valid JSON.');\n  }\n\n  const parsed = TokenResponseSchema.safeParse(raw);\n  if (!parsed.success) {\n    throw new ValidationError('Token response shape was unexpected. Run ratio auth login again.');\n  }\n\n  const data = parsed.data;\n  const expiresAt = new Date(Date.now() + data.expires_in * 1000).toISOString();\n\n  const tokens: TokenSet = {\n    accessToken: data.access_token,\n    refreshToken: data.refresh_token,\n    expiresAt,\n  };\n\n  const scopeStr = data.scope ?? '';\n  const scopes = scopeStr.length > 0 ? scopeStr.split(/[\\s,]+/).filter(Boolean) : [];\n\n  const identity: TokenDerivedIdentity = {\n    clientId: i.clientId,\n    merchantId: data.merchant_id ?? 'ratio-cli-dev',\n    scopes,\n  };\n\n  return { tokens, identity };\n}\n","/**\n * Error hierarchy for the Ratio CLI. Every error thrown from a command's\n * run() is expected to be an instance of RatioCLIError so the global\n * render-error handler can map it to a deterministic stderr line and exit\n * code. Uncaught Error subclasses render as \"INTERNAL: <msg>\" with exit 1.\n *\n * No import from @oclif/core — this file is dependency-free so tests\n * can import it without oclif overhead.\n */\n\nexport class RatioCLIError extends Error {\n  readonly code: string;\n  readonly exitCode: number;\n  readonly hint?: string;\n  readonly docsUrl?: string;\n\n  constructor(opts: {\n    code: string;\n    exitCode: number;\n    message: string;\n    hint?: string;\n    docsUrl?: string;\n  }) {\n    super(opts.message);\n    this.name = new.target.name;\n    this.code = opts.code;\n    this.exitCode = opts.exitCode;\n    if (opts.hint !== undefined) this.hint = opts.hint;\n    if (opts.docsUrl !== undefined) this.docsUrl = opts.docsUrl;\n  }\n}\n\n/** Coming-soon stub UX. Renders on stdout with exit 0. */\nexport class ComingSoonError extends RatioCLIError {\n  constructor(message: string) {\n    super({ code: 'COMING_SOON', exitCode: 0, message });\n  }\n}\n\n/** User has no credentials and command requires auth. */\nexport class NotLoggedInError extends RatioCLIError {\n  constructor(\n    message: string,\n    hint: string = \"Run 'ratio auth login' to sign in.\",\n  ) {\n    super({ code: 'NOT_LOGGED_IN', exitCode: 3, message, hint });\n  }\n}\n\nexport class TokenExpiredError extends RatioCLIError {\n  constructor(\n    message: string,\n    hint: string = \"Run 'ratio auth login' to refresh your session.\",\n  ) {\n    super({ code: 'TOKEN_EXPIRED', exitCode: 3, message, hint });\n  }\n}\n\nexport class ScopeDeniedError extends RatioCLIError {\n  constructor(message: string, hint?: string) {\n    const opts: { code: string; exitCode: number; message: string; hint?: string } = {\n      code: 'SCOPE_DENIED',\n      exitCode: 4,\n      message,\n    };\n    if (hint !== undefined) opts.hint = hint;\n    super(opts);\n  }\n}\n\nexport class NetworkError extends RatioCLIError {\n  constructor(message: string, hint: string = 'Check your network and retry.') {\n    super({ code: 'NETWORK_ERROR', exitCode: 5, message, hint });\n  }\n}\n\nexport class RelayConnectError extends RatioCLIError {\n  constructor(\n    message: string,\n    hint: string = 'Verify the tunnel URL and that the auth-server is reachable.',\n  ) {\n    super({ code: 'RELAY_CONNECT', exitCode: 6, message, hint });\n  }\n}\n\nexport class TemplateExistsError extends RatioCLIError {\n  constructor(\n    message: string,\n    hint: string = 'Choose a different name or remove the existing directory.',\n  ) {\n    super({ code: 'TEMPLATE_EXISTS', exitCode: 7, message, hint });\n  }\n}\n\nexport class ValidationError extends RatioCLIError {\n  constructor(message: string, hint?: string) {\n    const opts: { code: string; exitCode: number; message: string; hint?: string } = {\n      code: 'VALIDATION_ERROR',\n      exitCode: 8,\n      message,\n    };\n    if (hint !== undefined) opts.hint = hint;\n    super(opts);\n  }\n}\n\nexport class RelayResumeGapError extends RatioCLIError {\n  constructor(\n    message: string,\n    hint: string = 'Reconnect from the current cursor; older events are outside the buffer window.',\n  ) {\n    super({ code: 'RELAY_RESUME_GAP', exitCode: 9, message, hint });\n  }\n}\n\nexport class OrchestratorSpawnError extends RatioCLIError {\n  constructor(\n    message: string,\n    hint: string = \"Could not start your app's dev command — check that the command in ratio.config.jsonc runs from this directory.\",\n  ) {\n    super({ code: 'ORCHESTRATOR_SPAWN', exitCode: 10, message, hint });\n  }\n}\n\nexport class OrchestratorDrainTimeoutError extends RatioCLIError {\n  constructor(\n    message: string,\n    hint: string = 'Your dev command did not exit cleanly within 5 seconds — it was forcibly terminated.',\n  ) {\n    super({ code: 'ORCHESTRATOR_DRAIN', exitCode: 11, message, hint });\n  }\n}\n\nexport function isRatioCLIError(err: unknown): err is RatioCLIError {\n  return err instanceof RatioCLIError;\n}\n","/**\n * Minimal verbose diagnostic seam for the auth flow.\n *\n * When `--verbose` is on, the auth HTTP/loopback boundaries emit ONE line\n * per boundary crossing (method, path, status, timing, flow events) so a\n * failing login/refresh can be diagnosed from the CLI transcript alone.\n *\n * Safety contract (enforced by tests):\n *  - Lines go to STDERR only — never stdout — so `--json` consumers and\n *    shell pipelines are never corrupted.\n *  - NO secret material is ever passed to a tracer: no access/refresh\n *    token, no authorization code, no code_verifier, no state value.\n *    Only method, path, HTTP status, port numbers, and durations.\n */\n\n/** A tracer receives one pre-formatted diagnostic message per event. */\nexport type VerboseTracer = (msg: string) => void;\n\n/** Shared no-op used when `--verbose` is off (default everywhere). */\nexport const noopTracer: VerboseTracer = () => {};\n\n/**\n * Build a tracer. Returns the shared no-op unless `verbose` is true.\n * Output sink is injectable for tests; defaults to process.stderr.\n */\nexport function createVerboseTracer(\n  verbose: boolean,\n  write: (line: string) => void = (line) => {\n    process.stderr.write(line);\n  },\n): VerboseTracer {\n  if (!verbose) return noopTracer;\n  return (msg: string) => {\n    write(`[verbose] ${msg}\\n`);\n  };\n}\n","/**\n * HTTP implementation of the TokenRefresher interface.\n *\n * POSTs to /oauth/token with grant_type=refresh_token.\n * Maps 4xx → TokenExpiredError, 5xx/network → NetworkError.\n * Never logs or echoes the token value in any error message.\n */\n\nimport { z } from 'zod';\nimport { NetworkError, TokenExpiredError } from '../errors.js';\nimport type { TokenRefresher, TokenSet } from '../credentials/index.js';\nimport { RATIO_CLI_CLIENT_ID } from './config.js';\nimport { noopTracer } from './verbose-trace.js';\nimport type { VerboseTracer } from './verbose-trace.js';\n\n/** Refresh response envelope — subset of the full token response. */\nconst RefreshResponseSchema = z.object({\n  access_token: z.string().min(1),\n  refresh_token: z.string().min(1),\n  expires_in: z.number().int().positive(),\n});\n\nexport interface HttpTokenRefresherOptions {\n  readonly serverUrl: string;\n  readonly clientId: typeof RATIO_CLI_CLIENT_ID;\n  readonly fetchImpl?: typeof fetch;  // injectable for tests\n  /** Verbose diagnostic sink — never receives the refresh token value. */\n  readonly trace?: VerboseTracer;\n}\n\nexport class HttpTokenRefresher implements TokenRefresher {\n  private readonly serverUrl: string;\n  private readonly clientId: string;\n  private readonly fetchImpl: typeof fetch;\n  private readonly trace: VerboseTracer;\n\n  constructor(opts: HttpTokenRefresherOptions) {\n    this.serverUrl = opts.serverUrl;\n    this.clientId = opts.clientId;\n    this.fetchImpl = opts.fetchImpl ?? fetch;\n    this.trace = opts.trace ?? noopTracer;\n  }\n\n  async refresh(refreshToken: string): Promise<TokenSet> {\n    const body = {\n      grant_type: 'refresh_token',\n      refresh_token: refreshToken,\n      clientId: this.clientId,\n    };\n\n    this.trace('refresh: fired (access token expired or expiring)');\n    const startedAt = Date.now();\n\n    let response: Response;\n    try {\n      response = await this.fetchImpl(`${this.serverUrl}/oauth/token`, {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify(body),\n      });\n    } catch {\n      this.trace(`POST /oauth/token → network error (${Date.now() - startedAt}ms)`);\n      throw new NetworkError('Failed to reach the Ratio server during token refresh.');\n    }\n\n    this.trace(`POST /oauth/token → ${response.status} (${Date.now() - startedAt}ms)`);\n\n    if (response.status >= 400 && response.status < 500) {\n      throw new TokenExpiredError(\n        'Your session has expired and could not be refreshed.',\n      );\n    }\n\n    if (response.status >= 500 || !response.ok) {\n      throw new NetworkError('The Ratio server returned an error during token refresh.');\n    }\n\n    let raw: unknown;\n    try {\n      raw = await response.json();\n    } catch {\n      throw new NetworkError('Token refresh response was not valid JSON.');\n    }\n\n    const parsed = RefreshResponseSchema.safeParse(raw);\n    if (!parsed.success) {\n      throw new TokenExpiredError(\n        'Your session has expired and could not be refreshed.',\n      );\n    }\n\n    const data = parsed.data;\n    const expiresAt = new Date(Date.now() + data.expires_in * 1000).toISOString();\n\n    return {\n      accessToken: data.access_token,\n      refreshToken: data.refresh_token,\n      expiresAt,\n    };\n  }\n}\n","/**\n * Ephemeral loopback HTTP server for the OAuth browser callback.\n *\n * Binds 127.0.0.1:0 (OS-assigned port). Awaits ONE GET /callback\n * request with ?code=...&state=... query parameters, verifies the state\n * via timingSafeEqualState, closes the server, and resolves.\n *\n * Security properties:\n *  - Binds 127.0.0.1 only — never 0.0.0.0 or ::\n *  - Port is OS-assigned (listen(0)) — never hardcoded\n *  - State compared via timingSafeEqual — no fast-fail timing side channel\n *  - Server closes on success, timeout, or state mismatch — no port leak\n *  - Non-callback paths receive a 404 response\n */\n\nimport http from 'node:http';\nimport { NotLoggedInError, ValidationError } from '../errors.js';\nimport { timingSafeEqualState } from './state.js';\nimport { noopTracer } from './verbose-trace.js';\nimport type { VerboseTracer } from './verbose-trace.js';\n\nexport interface LoopbackAwaitOptions {\n  readonly expectedState: string;\n  readonly timeoutMs: number;   // default 30_000 for prod, injectable for tests\n  readonly signal?: AbortSignal;\n  /** Verbose diagnostic sink — never receives code/state values. */\n  readonly trace?: VerboseTracer;\n}\n\nexport interface LoopbackAwaitResult {\n  readonly code: string;\n  readonly redirectUri: string;  // http://127.0.0.1:<actualPort>/callback\n}\n\n/**\n * Binds 127.0.0.1:0, awaits ONE GET /callback?code=...&state=..., verifies\n * state via timingSafeEqual against expectedState, closes the server cleanly,\n * resolves with { code, redirectUri }. On timeout or state mismatch or\n * non-callback request path, rejects with the appropriate typed error.\n */\nexport function awaitLoopbackCallback(o: LoopbackAwaitOptions): Promise<LoopbackAwaitResult> {\n  const trace = o.trace ?? noopTracer;\n  return new Promise((resolve, reject) => {\n    let settled = false;\n\n    function settle(fn: () => void): void {\n      if (settled) return;\n      settled = true;\n      server.close(() => fn());\n    }\n\n    const server = http.createServer((req, res) => {\n      const reqUrl = new URL(req.url ?? '/', `http://127.0.0.1`);\n\n      if (reqUrl.pathname !== '/callback') {\n        res.writeHead(404, { 'Content-Type': 'text/plain' });\n        res.end('Not found');\n        return;\n      }\n\n      const code = reqUrl.searchParams.get('code');\n      const state = reqUrl.searchParams.get('state');\n\n      if (!state || !timingSafeEqualState(state, o.expectedState)) {\n        trace('callback: state mismatch');\n        res.writeHead(400, { 'Content-Type': 'text/plain' });\n        res.end('State mismatch');\n        settle(() =>\n          reject(\n            new ValidationError('Authorization callback failed a security check.'),\n          ),\n        );\n        return;\n      }\n\n      if (!code || code.length === 0) {\n        trace('callback: missing code');\n        res.writeHead(400, { 'Content-Type': 'text/plain' });\n        res.end('Missing code');\n        settle(() =>\n          reject(\n            new ValidationError('Authorization callback did not return a code.'),\n          ),\n        );\n        return;\n      }\n\n      res.writeHead(200, { 'Content-Type': 'text/html' });\n      res.end('<html><body><h1>Signed in! You can close this tab.</h1></body></html>');\n\n      const addr = server.address();\n      const port = typeof addr === 'object' && addr !== null ? addr.port : 0;\n      const redirectUri = `http://127.0.0.1:${port}/callback`;\n\n      trace(`callback: received on port ${port} (state ok)`);\n      settle(() => resolve({ code, redirectUri }));\n    });\n\n    server.on('error', (err) => {\n      settle(() => reject(err));\n    });\n\n    server.listen(0, '127.0.0.1', () => {\n      const boundAddr = server.address();\n      const boundPort =\n        typeof boundAddr === 'object' && boundAddr !== null ? boundAddr.port : 0;\n      trace(`loopback: bound 127.0.0.1:${boundPort}`);\n\n      const timer = setTimeout(() => {\n        trace(`callback: timeout fired after ${o.timeoutMs}ms`);\n        settle(() =>\n          reject(\n            new NotLoggedInError(\n              \"Browser flow timed out. Run 'ratio auth login --manual' to complete without a browser.\",\n            ),\n          ),\n        );\n      }, o.timeoutMs);\n\n      // Allow process to exit if only this timer remains.\n      if (typeof timer.unref === 'function') {\n        timer.unref();\n      }\n\n      if (o.signal) {\n        o.signal.addEventListener('abort', () => {\n          trace('callback: cancelled');\n          clearTimeout(timer);\n          settle(() =>\n            reject(\n              new NotLoggedInError(\n                \"Browser flow was cancelled. Run 'ratio auth login --manual' to complete without a browser.\",\n              ),\n            ),\n          );\n        });\n      }\n    });\n  });\n}\n\n/**\n * Return the loopback callback URI for a given port.\n */\nexport function buildLoopbackRedirectUri(port: number): string {\n  return `http://127.0.0.1:${port}/callback`;\n}\n\nexport interface LoopbackSession {\n  /** The OS-assigned port the server is bound to. */\n  readonly port: number;\n  /** The full redirect URI to send in the authorize URL. */\n  readonly redirectUri: string;\n  /**\n   * Await the single callback. Resolves with the code, rejects on timeout\n   * or state mismatch. The server is closed when this promise settles.\n   */\n  awaitCallback(opts: Omit<LoopbackAwaitOptions, 'timeoutMs'> & { timeoutMs?: number }): Promise<LoopbackAwaitResult>;\n}\n\n/**\n * Two-phase API: start the server first (to get the port for the authorize URL),\n * then await the callback after the browser has been opened.\n *\n * Usage:\n *   const session = await startLoopbackSession();\n *   const url = buildBrowserAuthorizeUrl({ redirectUri: session.redirectUri, ... });\n *   await opener.open(url);\n *   const { code } = await session.awaitCallback({ expectedState, timeoutMs: 30_000 });\n */\nexport function startLoopbackSession(trace: VerboseTracer = noopTracer): Promise<LoopbackSession> {\n  return new Promise((resolve, reject) => {\n    let settled = false;\n\n    function settle(fn: () => void): void {\n      if (settled) return;\n      settled = true;\n      fn();\n    }\n\n    const server = http.createServer();\n    server.on('error', reject);\n    server.listen(0, '127.0.0.1', () => {\n      const addr = server.address();\n      const port = typeof addr === 'object' && addr !== null ? addr.port : 0;\n      const redirectUri = buildLoopbackRedirectUri(port);\n\n      trace(`loopback: bound 127.0.0.1:${port}`);\n\n      resolve({\n        port,\n        redirectUri,\n        awaitCallback(\n          opts: Omit<LoopbackAwaitOptions, 'timeoutMs'> & { timeoutMs?: number },\n        ): Promise<LoopbackAwaitResult> {\n          const timeoutMs = opts.timeoutMs ?? 30_000;\n\n          return new Promise((res, rej) => {\n            server.on('request', (req, response) => {\n              const reqUrl = new URL(req.url ?? '/', `http://127.0.0.1`);\n\n              if (reqUrl.pathname !== '/callback') {\n                response.writeHead(404, { 'Content-Type': 'text/plain' });\n                response.end('Not found');\n                return;\n              }\n\n              const code = reqUrl.searchParams.get('code');\n              const state = reqUrl.searchParams.get('state');\n\n              if (!state || !timingSafeEqualState(state, opts.expectedState)) {\n                trace('callback: state mismatch');\n                response.writeHead(400, { 'Content-Type': 'text/plain' });\n                response.end('State mismatch');\n                settle(() => {\n                  clearTimeout(timer);\n                  server.close(() =>\n                    rej(new ValidationError('Authorization callback failed a security check.')),\n                  );\n                });\n                return;\n              }\n\n              if (!code || code.length === 0) {\n                trace('callback: missing code');\n                response.writeHead(400, { 'Content-Type': 'text/plain' });\n                response.end('Missing code');\n                settle(() => {\n                  clearTimeout(timer);\n                  server.close(() =>\n                    rej(new ValidationError('Authorization callback did not return a code.')),\n                  );\n                });\n                return;\n              }\n\n              response.writeHead(200, { 'Content-Type': 'text/html' });\n              response.end(\n                '<html><body><h1>Signed in! You can close this tab.</h1></body></html>',\n              );\n\n              trace(`callback: received on port ${port} (state ok)`);\n              settle(() => {\n                clearTimeout(timer);\n                server.close(() => res({ code, redirectUri }));\n              });\n            });\n\n            const timer = setTimeout(() => {\n              trace(`callback: timeout fired after ${timeoutMs}ms`);\n              settle(() => {\n                server.close(() =>\n                  rej(\n                    new NotLoggedInError(\n                      \"Browser flow timed out. Run 'ratio auth login --manual' to complete without a browser.\",\n                    ),\n                  ),\n                );\n              });\n            }, timeoutMs);\n\n            if (typeof timer.unref === 'function') {\n              timer.unref();\n            }\n\n            if (opts.signal) {\n              opts.signal.addEventListener('abort', () => {\n                trace('callback: cancelled');\n                clearTimeout(timer);\n                settle(() => {\n                  server.close(() =>\n                    rej(\n                      new NotLoggedInError(\n                        \"Browser flow was cancelled. Run 'ratio auth login --manual' to complete without a browser.\",\n                      ),\n                    ),\n                  );\n                });\n              });\n            }\n          });\n        },\n      });\n    });\n  });\n}\n","/**\n * Browser-launch wrapper for the OAuth browser flow.\n *\n * This is the SOLE file that imports from the 'open' npm package.\n * Injectable via the BrowserOpener interface for unit tests.\n */\n\nimport { NotLoggedInError } from '../errors.js';\n\nexport interface BrowserOpener {\n  open(url: string): Promise<void>;\n}\n\n/**\n * Create the default browser opener backed by the 'open' package.\n * Throws NotLoggedInError on failure with the --manual fallback hint.\n */\nexport function defaultBrowserOpener(): BrowserOpener {\n  return {\n    async open(url: string): Promise<void> {\n      // Dynamic import is used so the module is loadable in test environments\n      // that do not have a display (CI / SSH). The real 'open' call only fires\n      // in production use when this opener is not replaced by a test double.\n      let openFn: (url: string) => Promise<unknown>;\n      try {\n        const mod = await import('open');\n        openFn = mod.default as (url: string) => Promise<unknown>;\n      } catch {\n        throw new NotLoggedInError(\n          \"Could not open a browser. Run 'ratio auth login --manual' to complete without a browser.\",\n        );\n      }\n      try {\n        await openFn(url);\n      } catch {\n        throw new NotLoggedInError(\n          \"Could not open a browser. Run 'ratio auth login --manual' to complete without a browser.\",\n        );\n      }\n    },\n  };\n}\n","/**\n * Stdin prompt for the --manual copy-paste OAuth flow.\n *\n * Uses node:readline/promises so it is awaitable and testable with\n * an injectable interface. The defaultStdinPrompt() function is the\n * production implementation; tests inject a fake.\n */\n\nimport { createInterface } from 'node:readline/promises';\nimport { stdin as input, stdout as output } from 'node:process';\n\nexport interface StdinPrompt {\n  askForCode(prompt: string): Promise<string>;\n}\n\n/**\n * Create the default stdin prompter backed by node:readline/promises.\n * Trims whitespace from the pasted code.\n */\nexport function defaultStdinPrompt(): StdinPrompt {\n  return {\n    async askForCode(prompt: string): Promise<string> {\n      const rl = createInterface({ input, output });\n      try {\n        const answer = await rl.question(prompt);\n        return answer.trim();\n      } finally {\n        rl.close();\n      }\n    },\n  };\n}\n","/**\n * Identity helpers for the auth flow.\n *\n * A-29 adjudication: the backend token envelope does not expose developerId/email.\n * Identity is therefore token-derived: {clientId, merchantId, scopes}.\n *\n * This file re-exports the TokenDerivedIdentity type from authorize-code-exchange\n * so consumers have a single import point. It is a null-object for the POST-token\n * identity fetch originally envisioned (no GET /developer/me endpoint\n * exists yet). The appName optional field is added if GET /oauth/app-info returns it.\n */\n\nexport type { TokenDerivedIdentity } from './authorize-code-exchange.js';\n\n/** Rendered display string for the identity in whoami / login success. */\nexport function renderIdentity(identity: {\n  clientId: string;\n  merchantId: string;\n  scopes: readonly string[];\n  appName?: string;\n}): string {\n  const scopePart = identity.scopes.length > 0\n    ? ` scopes=[${identity.scopes.join(', ')}]`\n    : '';\n  const appPart = identity.appName ? ` app=\"${identity.appName}\"` : '';\n  return `clientId=${identity.clientId} merchantId=${identity.merchantId}${appPart}${scopePart}`;\n}\n"],"mappings":";AAOA,OAAO,YAAY;AAaZ,SAAS,qBAAqB,cAA8B;AACjE,SAAO,OAAO,WAAW,QAAQ,EAAE,OAAO,cAAc,OAAO,EAAE,OAAO,WAAW;AACrF;AAMO,SAAS,mBAA6B;AAC3C,QAAM,eAAe,OAAO,YAAY,EAAE,EAAE,SAAS,WAAW;AAChE,QAAM,gBAAgB,qBAAqB,YAAY;AACvD,SAAO,EAAE,cAAc,eAAe,qBAAqB,OAAO;AACpE;;;ACzBA,OAAOA,aAAY;AAMZ,SAAS,gBAAwB;AACtC,SAAOA,QAAO,YAAY,EAAE,EAAE,SAAS,WAAW;AACpD;AAQO,SAAS,qBAAqB,GAAW,GAAoB;AAClE,QAAM,OAAO,OAAO,KAAK,GAAG,MAAM;AAClC,QAAM,OAAO,OAAO,KAAK,GAAG,MAAM;AAClC,MAAI,KAAK,WAAW,KAAK,QAAQ;AAE/B,IAAAA,QAAO,gBAAgB,MAAM,IAAI;AACjC,WAAO;AAAA,EACT;AACA,SAAOA,QAAO,gBAAgB,MAAM,IAAI;AAC1C;;;AChBO,IAAM,qBAAqB;AAQ3B,IAAM,wBAAwB;AAG9B,IAAM,sBAAsB;AAe5B,SAAS,iBAAiB,MAAwC;AACvE,QAAM,MAAM,MAAM,OAAO,QAAQ;AACjC,MAAI,OAAO,IAAI,kBAAkB,MAAM,YAAY,IAAI,kBAAkB,EAAE,SAAS,GAAG;AACrF,WAAO,IAAI,kBAAkB;AAAA,EAC/B;AACA,MAAI,OAAO,MAAM,aAAa,WAAW,YAAY,KAAK,YAAY,OAAO,SAAS,GAAG;AACvF,WAAO,KAAK,YAAY;AAAA,EAC1B;AACA,SAAO;AACT;;;AChBO,SAAS,yBAAyB,GAAuC;AAC9E,QAAM,SAAS,IAAI,gBAAgB;AACnC,SAAO,IAAI,aAAa,EAAE,QAAQ;AAClC,SAAO,IAAI,eAAe,EAAE,cAAc,qBAAqB;AAC/D,SAAO,IAAI,kBAAkB,EAAE,aAAa;AAC5C,SAAO,IAAI,yBAAyB,MAAM;AAC1C,SAAO,IAAI,SAAS,EAAE,KAAK;AAC3B,SAAO,IAAI,gBAAgB,EAAE,WAAW;AACxC,MAAI,EAAE,UAAU,EAAE,OAAO,SAAS,GAAG;AACnC,WAAO,IAAI,SAAS,EAAE,OAAO,KAAK,GAAG,CAAC;AAAA,EACxC;AACA,SAAO,GAAG,EAAE,SAAS,oBAAoB,OAAO,SAAS,CAAC;AAC5D;AAOO,SAAS,wBAAwB,GAAsC;AAC5E,QAAM,SAAS,IAAI,gBAAgB;AACnC,SAAO,IAAI,aAAa,EAAE,QAAQ;AAClC,SAAO,IAAI,eAAe,EAAE,cAAc,qBAAqB;AAC/D,SAAO,IAAI,kBAAkB,EAAE,aAAa;AAC5C,SAAO,IAAI,yBAAyB,MAAM;AAC1C,SAAO,IAAI,SAAS,EAAE,KAAK;AAC3B,SAAO,IAAI,gBAAgB,GAAG;AAC9B,MAAI,EAAE,UAAU,EAAE,OAAO,SAAS,GAAG;AACnC,WAAO,IAAI,SAAS,EAAE,OAAO,KAAK,GAAG,CAAC;AAAA,EACxC;AACA,SAAO,GAAG,EAAE,SAAS,oBAAoB,OAAO,SAAS,CAAC;AAC5D;;;AChDA,SAAS,SAAS;;;ACRX,IAAM,gBAAN,cAA4B,MAAM;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,MAMT;AACD,UAAM,KAAK,OAAO;AAClB,SAAK,OAAO,WAAW;AACvB,SAAK,OAAO,KAAK;AACjB,SAAK,WAAW,KAAK;AACrB,QAAI,KAAK,SAAS,OAAW,MAAK,OAAO,KAAK;AAC9C,QAAI,KAAK,YAAY,OAAW,MAAK,UAAU,KAAK;AAAA,EACtD;AACF;AAUO,IAAM,mBAAN,cAA+B,cAAc;AAAA,EAClD,YACE,SACA,OAAe,sCACf;AACA,UAAM,EAAE,MAAM,iBAAiB,UAAU,GAAG,SAAS,KAAK,CAAC;AAAA,EAC7D;AACF;AAEO,IAAM,oBAAN,cAAgC,cAAc;AAAA,EACnD,YACE,SACA,OAAe,mDACf;AACA,UAAM,EAAE,MAAM,iBAAiB,UAAU,GAAG,SAAS,KAAK,CAAC;AAAA,EAC7D;AACF;AAcO,IAAM,eAAN,cAA2B,cAAc;AAAA,EAC9C,YAAY,SAAiB,OAAe,iCAAiC;AAC3E,UAAM,EAAE,MAAM,iBAAiB,UAAU,GAAG,SAAS,KAAK,CAAC;AAAA,EAC7D;AACF;AAoBO,IAAM,kBAAN,cAA8B,cAAc;AAAA,EACjD,YAAY,SAAiB,MAAe;AAC1C,UAAM,OAA2E;AAAA,MAC/E,MAAM;AAAA,MACN,UAAU;AAAA,MACV;AAAA,IACF;AACA,QAAI,SAAS,OAAW,MAAK,OAAO;AACpC,UAAM,IAAI;AAAA,EACZ;AACF;;;ACrFO,IAAM,aAA4B,MAAM;AAAC;AAMzC,SAAS,oBACd,SACA,QAAgC,CAAC,SAAS;AACxC,UAAQ,OAAO,MAAM,IAAI;AAC3B,GACe;AACf,MAAI,CAAC,QAAS,QAAO;AACrB,SAAO,CAAC,QAAgB;AACtB,UAAM,aAAa,GAAG;AAAA,CAAI;AAAA,EAC5B;AACF;;;AFTA,IAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC9B,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC/B,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACtC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,SAAS;AACnC,CAAC;AA8BM,SAAS,sBAAsB,GAAmD;AACvF,SAAO,2BAA2B,CAAC;AACrC;AAEA,eAAe,2BAA2B,GAAmD;AAC3F,QAAM,UAAU,EAAE,aAAa;AAE/B,QAAM,OAA+B;AAAA,IACnC,YAAY;AAAA,IACZ,MAAM,EAAE;AAAA,IACR,UAAU,EAAE;AAAA,IACZ,cAAc,EAAE;AAAA,EAClB;AACA,MAAI,EAAE,gBAAgB,QAAW;AAC/B,SAAK,aAAa,IAAI,EAAE;AAAA,EAC1B;AAEA,QAAM,QAAQ,EAAE,SAAS;AACzB,QAAM,YAAY,KAAK,IAAI;AAE3B,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,QAAQ,GAAG,EAAE,SAAS,gBAAgB;AAAA,MACrD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AAAA,EACH,QAAQ;AACN,UAAM,2CAAsC,KAAK,IAAI,IAAI,SAAS,KAAK;AACvE,UAAM,IAAI,aAAa,yDAAyD;AAAA,EAClF;AAEA,QAAM,4BAAuB,SAAS,MAAM,KAAK,KAAK,IAAI,IAAI,SAAS,KAAK;AAE5E,MAAI,SAAS,UAAU,OAAO,SAAS,SAAS,KAAK;AACnD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,MAAI,SAAS,UAAU,OAAO,CAAC,SAAS,IAAI;AAC1C,UAAM,IAAI,aAAa,2DAA2D;AAAA,EACpF;AAEA,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,SAAS,KAAK;AAAA,EAC5B,QAAQ;AACN,UAAM,IAAI,gBAAgB,oCAAoC;AAAA,EAChE;AAEA,QAAM,SAAS,oBAAoB,UAAU,GAAG;AAChD,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI,gBAAgB,kEAAkE;AAAA,EAC9F;AAEA,QAAM,OAAO,OAAO;AACpB,QAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,aAAa,GAAI,EAAE,YAAY;AAE5E,QAAM,SAAmB;AAAA,IACvB,aAAa,KAAK;AAAA,IAClB,cAAc,KAAK;AAAA,IACnB;AAAA,EACF;AAEA,QAAM,WAAW,KAAK,SAAS;AAC/B,QAAM,SAAS,SAAS,SAAS,IAAI,SAAS,MAAM,QAAQ,EAAE,OAAO,OAAO,IAAI,CAAC;AAEjF,QAAM,WAAiC;AAAA,IACrC,UAAU,EAAE;AAAA,IACZ,YAAY,KAAK,eAAe;AAAA,IAChC;AAAA,EACF;AAEA,SAAO,EAAE,QAAQ,SAAS;AAC5B;;;AGlIA,SAAS,KAAAC,UAAS;AAQlB,IAAM,wBAAwBC,GAAE,OAAO;AAAA,EACrC,cAAcA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC9B,eAAeA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC/B,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACxC,CAAC;AAUM,IAAM,qBAAN,MAAmD;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,MAAiC;AAC3C,SAAK,YAAY,KAAK;AACtB,SAAK,WAAW,KAAK;AACrB,SAAK,YAAY,KAAK,aAAa;AACnC,SAAK,QAAQ,KAAK,SAAS;AAAA,EAC7B;AAAA,EAEA,MAAM,QAAQ,cAAyC;AACrD,UAAM,OAAO;AAAA,MACX,YAAY;AAAA,MACZ,eAAe;AAAA,MACf,UAAU,KAAK;AAAA,IACjB;AAEA,SAAK,MAAM,mDAAmD;AAC9D,UAAM,YAAY,KAAK,IAAI;AAE3B,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,KAAK,UAAU,GAAG,KAAK,SAAS,gBAAgB;AAAA,QAC/D,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU,IAAI;AAAA,MAC3B,CAAC;AAAA,IACH,QAAQ;AACN,WAAK,MAAM,2CAAsC,KAAK,IAAI,IAAI,SAAS,KAAK;AAC5E,YAAM,IAAI,aAAa,wDAAwD;AAAA,IACjF;AAEA,SAAK,MAAM,4BAAuB,SAAS,MAAM,KAAK,KAAK,IAAI,IAAI,SAAS,KAAK;AAEjF,QAAI,SAAS,UAAU,OAAO,SAAS,SAAS,KAAK;AACnD,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,QAAI,SAAS,UAAU,OAAO,CAAC,SAAS,IAAI;AAC1C,YAAM,IAAI,aAAa,0DAA0D;AAAA,IACnF;AAEA,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,SAAS,KAAK;AAAA,IAC5B,QAAQ;AACN,YAAM,IAAI,aAAa,4CAA4C;AAAA,IACrE;AAEA,UAAM,SAAS,sBAAsB,UAAU,GAAG;AAClD,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,OAAO,OAAO;AACpB,UAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,aAAa,GAAI,EAAE,YAAY;AAE5E,WAAO;AAAA,MACL,aAAa,KAAK;AAAA,MAClB,cAAc,KAAK;AAAA,MACnB;AAAA,IACF;AAAA,EACF;AACF;;;ACrFA,OAAO,UAAU;AAyBV,SAAS,sBAAsB,GAAuD;AAC3F,QAAM,QAAQ,EAAE,SAAS;AACzB,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,QAAI,UAAU;AAEd,aAAS,OAAO,IAAsB;AACpC,UAAI,QAAS;AACb,gBAAU;AACV,aAAO,MAAM,MAAM,GAAG,CAAC;AAAA,IACzB;AAEA,UAAM,SAAS,KAAK,aAAa,CAAC,KAAK,QAAQ;AAC7C,YAAM,SAAS,IAAI,IAAI,IAAI,OAAO,KAAK,kBAAkB;AAEzD,UAAI,OAAO,aAAa,aAAa;AACnC,YAAI,UAAU,KAAK,EAAE,gBAAgB,aAAa,CAAC;AACnD,YAAI,IAAI,WAAW;AACnB;AAAA,MACF;AAEA,YAAM,OAAO,OAAO,aAAa,IAAI,MAAM;AAC3C,YAAM,QAAQ,OAAO,aAAa,IAAI,OAAO;AAE7C,UAAI,CAAC,SAAS,CAAC,qBAAqB,OAAO,EAAE,aAAa,GAAG;AAC3D,cAAM,0BAA0B;AAChC,YAAI,UAAU,KAAK,EAAE,gBAAgB,aAAa,CAAC;AACnD,YAAI,IAAI,gBAAgB;AACxB;AAAA,UAAO,MACL;AAAA,YACE,IAAI,gBAAgB,iDAAiD;AAAA,UACvE;AAAA,QACF;AACA;AAAA,MACF;AAEA,UAAI,CAAC,QAAQ,KAAK,WAAW,GAAG;AAC9B,cAAM,wBAAwB;AAC9B,YAAI,UAAU,KAAK,EAAE,gBAAgB,aAAa,CAAC;AACnD,YAAI,IAAI,cAAc;AACtB;AAAA,UAAO,MACL;AAAA,YACE,IAAI,gBAAgB,+CAA+C;AAAA,UACrE;AAAA,QACF;AACA;AAAA,MACF;AAEA,UAAI,UAAU,KAAK,EAAE,gBAAgB,YAAY,CAAC;AAClD,UAAI,IAAI,uEAAuE;AAE/E,YAAM,OAAO,OAAO,QAAQ;AAC5B,YAAM,OAAO,OAAO,SAAS,YAAY,SAAS,OAAO,KAAK,OAAO;AACrE,YAAM,cAAc,oBAAoB,IAAI;AAE5C,YAAM,8BAA8B,IAAI,aAAa;AACrD,aAAO,MAAM,QAAQ,EAAE,MAAM,YAAY,CAAC,CAAC;AAAA,IAC7C,CAAC;AAED,WAAO,GAAG,SAAS,CAAC,QAAQ;AAC1B,aAAO,MAAM,OAAO,GAAG,CAAC;AAAA,IAC1B,CAAC;AAED,WAAO,OAAO,GAAG,aAAa,MAAM;AAClC,YAAM,YAAY,OAAO,QAAQ;AACjC,YAAM,YACJ,OAAO,cAAc,YAAY,cAAc,OAAO,UAAU,OAAO;AACzE,YAAM,6BAA6B,SAAS,EAAE;AAE9C,YAAM,QAAQ,WAAW,MAAM;AAC7B,cAAM,iCAAiC,EAAE,SAAS,IAAI;AACtD;AAAA,UAAO,MACL;AAAA,YACE,IAAI;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF,GAAG,EAAE,SAAS;AAGd,UAAI,OAAO,MAAM,UAAU,YAAY;AACrC,cAAM,MAAM;AAAA,MACd;AAEA,UAAI,EAAE,QAAQ;AACZ,UAAE,OAAO,iBAAiB,SAAS,MAAM;AACvC,gBAAM,qBAAqB;AAC3B,uBAAa,KAAK;AAClB;AAAA,YAAO,MACL;AAAA,cACE,IAAI;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AACH;AAKO,SAAS,yBAAyB,MAAsB;AAC7D,SAAO,oBAAoB,IAAI;AACjC;AAwBO,SAAS,qBAAqB,QAAuB,YAAsC;AAChG,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,QAAI,UAAU;AAEd,aAAS,OAAO,IAAsB;AACpC,UAAI,QAAS;AACb,gBAAU;AACV,SAAG;AAAA,IACL;AAEA,UAAM,SAAS,KAAK,aAAa;AACjC,WAAO,GAAG,SAAS,MAAM;AACzB,WAAO,OAAO,GAAG,aAAa,MAAM;AAClC,YAAM,OAAO,OAAO,QAAQ;AAC5B,YAAM,OAAO,OAAO,SAAS,YAAY,SAAS,OAAO,KAAK,OAAO;AACrE,YAAM,cAAc,yBAAyB,IAAI;AAEjD,YAAM,6BAA6B,IAAI,EAAE;AAEzC,cAAQ;AAAA,QACN;AAAA,QACA;AAAA,QACA,cACE,MAC8B;AAC9B,gBAAM,YAAY,KAAK,aAAa;AAEpC,iBAAO,IAAI,QAAQ,CAAC,KAAK,QAAQ;AAC/B,mBAAO,GAAG,WAAW,CAAC,KAAK,aAAa;AACtC,oBAAM,SAAS,IAAI,IAAI,IAAI,OAAO,KAAK,kBAAkB;AAEzD,kBAAI,OAAO,aAAa,aAAa;AACnC,yBAAS,UAAU,KAAK,EAAE,gBAAgB,aAAa,CAAC;AACxD,yBAAS,IAAI,WAAW;AACxB;AAAA,cACF;AAEA,oBAAM,OAAO,OAAO,aAAa,IAAI,MAAM;AAC3C,oBAAM,QAAQ,OAAO,aAAa,IAAI,OAAO;AAE7C,kBAAI,CAAC,SAAS,CAAC,qBAAqB,OAAO,KAAK,aAAa,GAAG;AAC9D,sBAAM,0BAA0B;AAChC,yBAAS,UAAU,KAAK,EAAE,gBAAgB,aAAa,CAAC;AACxD,yBAAS,IAAI,gBAAgB;AAC7B,uBAAO,MAAM;AACX,+BAAa,KAAK;AAClB,yBAAO;AAAA,oBAAM,MACX,IAAI,IAAI,gBAAgB,iDAAiD,CAAC;AAAA,kBAC5E;AAAA,gBACF,CAAC;AACD;AAAA,cACF;AAEA,kBAAI,CAAC,QAAQ,KAAK,WAAW,GAAG;AAC9B,sBAAM,wBAAwB;AAC9B,yBAAS,UAAU,KAAK,EAAE,gBAAgB,aAAa,CAAC;AACxD,yBAAS,IAAI,cAAc;AAC3B,uBAAO,MAAM;AACX,+BAAa,KAAK;AAClB,yBAAO;AAAA,oBAAM,MACX,IAAI,IAAI,gBAAgB,+CAA+C,CAAC;AAAA,kBAC1E;AAAA,gBACF,CAAC;AACD;AAAA,cACF;AAEA,uBAAS,UAAU,KAAK,EAAE,gBAAgB,YAAY,CAAC;AACvD,uBAAS;AAAA,gBACP;AAAA,cACF;AAEA,oBAAM,8BAA8B,IAAI,aAAa;AACrD,qBAAO,MAAM;AACX,6BAAa,KAAK;AAClB,uBAAO,MAAM,MAAM,IAAI,EAAE,MAAM,YAAY,CAAC,CAAC;AAAA,cAC/C,CAAC;AAAA,YACH,CAAC;AAED,kBAAM,QAAQ,WAAW,MAAM;AAC7B,oBAAM,iCAAiC,SAAS,IAAI;AACpD,qBAAO,MAAM;AACX,uBAAO;AAAA,kBAAM,MACX;AAAA,oBACE,IAAI;AAAA,sBACF;AAAA,oBACF;AAAA,kBACF;AAAA,gBACF;AAAA,cACF,CAAC;AAAA,YACH,GAAG,SAAS;AAEZ,gBAAI,OAAO,MAAM,UAAU,YAAY;AACrC,oBAAM,MAAM;AAAA,YACd;AAEA,gBAAI,KAAK,QAAQ;AACf,mBAAK,OAAO,iBAAiB,SAAS,MAAM;AAC1C,sBAAM,qBAAqB;AAC3B,6BAAa,KAAK;AAClB,uBAAO,MAAM;AACX,yBAAO;AAAA,oBAAM,MACX;AAAA,sBACE,IAAI;AAAA,wBACF;AAAA,sBACF;AAAA,oBACF;AAAA,kBACF;AAAA,gBACF,CAAC;AAAA,cACH,CAAC;AAAA,YACH;AAAA,UACF,CAAC;AAAA,QACH;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AAAA,EACH,CAAC;AACH;;;AC5QO,SAAS,uBAAsC;AACpD,SAAO;AAAA,IACL,MAAM,KAAK,KAA4B;AAIrC,UAAI;AACJ,UAAI;AACF,cAAM,MAAM,MAAM,OAAO,MAAM;AAC/B,iBAAS,IAAI;AAAA,MACf,QAAQ;AACN,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,UAAI;AACF,cAAM,OAAO,GAAG;AAAA,MAClB,QAAQ;AACN,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;;;ACjCA,SAAS,uBAAuB;AAChC,SAAS,SAAS,OAAO,UAAU,cAAc;AAU1C,SAAS,qBAAkC;AAChD,SAAO;AAAA,IACL,MAAM,WAAW,QAAiC;AAChD,YAAM,KAAK,gBAAgB,EAAE,OAAO,OAAO,CAAC;AAC5C,UAAI;AACF,cAAM,SAAS,MAAM,GAAG,SAAS,MAAM;AACvC,eAAO,OAAO,KAAK;AAAA,MACrB,UAAE;AACA,WAAG,MAAM;AAAA,MACX;AAAA,IACF;AAAA,EACF;AACF;;;AChBO,SAAS,eAAe,UAKpB;AACT,QAAM,YAAY,SAAS,OAAO,SAAS,IACvC,YAAY,SAAS,OAAO,KAAK,IAAI,CAAC,MACtC;AACJ,QAAM,UAAU,SAAS,UAAU,SAAS,SAAS,OAAO,MAAM;AAClE,SAAO,YAAY,SAAS,QAAQ,eAAe,SAAS,UAAU,GAAG,OAAO,GAAG,SAAS;AAC9F;","names":["crypto","z","z"]}