@ratio-app/cli 0.1.1

package/dist/lib/auth/loopback-server.d.ts

@@ -0,0 +1,65 @@
+import { VerboseTracer } from './verbose-trace.js';
+
+/**
+ * Ephemeral loopback HTTP server for the OAuth browser callback.
+ *
+ * Binds 127.0.0.1:0 (OS-assigned port). Awaits ONE GET /callback
+ * request with ?code=...&state=... query parameters, verifies the state
+ * via timingSafeEqualState, closes the server, and resolves.
+ *
+ * Security properties:
+ *  - Binds 127.0.0.1 only — never 0.0.0.0 or ::
+ *  - Port is OS-assigned (listen(0)) — never hardcoded
+ *  - State compared via timingSafeEqual — no fast-fail timing side channel
+ *  - Server closes on success, timeout, or state mismatch — no port leak
+ *  - Non-callback paths receive a 404 response
+ */
+
+interface LoopbackAwaitOptions {
+    readonly expectedState: string;
+    readonly timeoutMs: number;
+    readonly signal?: AbortSignal;
+    /** Verbose diagnostic sink — never receives code/state values. */
+    readonly trace?: VerboseTracer;
+}
+interface LoopbackAwaitResult {
+    readonly code: string;
+    readonly redirectUri: string;
+}
+/**
+ * Binds 127.0.0.1:0, awaits ONE GET /callback?code=...&state=..., verifies
+ * state via timingSafeEqual against expectedState, closes the server cleanly,
+ * resolves with { code, redirectUri }. On timeout or state mismatch or
+ * non-callback request path, rejects with the appropriate typed error.
+ */
+declare function awaitLoopbackCallback(o: LoopbackAwaitOptions): Promise<LoopbackAwaitResult>;
+/**
+ * Return the loopback callback URI for a given port.
+ */
+declare function buildLoopbackRedirectUri(port: number): string;
+interface LoopbackSession {
+    /** The OS-assigned port the server is bound to. */
+    readonly port: number;
+    /** The full redirect URI to send in the authorize URL. */
+    readonly redirectUri: string;
+    /**
+     * Await the single callback. Resolves with the code, rejects on timeout
+     * or state mismatch. The server is closed when this promise settles.
+     */
+    awaitCallback(opts: Omit<LoopbackAwaitOptions, 'timeoutMs'> & {
+        timeoutMs?: number;
+    }): Promise<LoopbackAwaitResult>;
+}
+/**
+ * Two-phase API: start the server first (to get the port for the authorize URL),
+ * then await the callback after the browser has been opened.
+ *
+ * Usage:
+ *   const session = await startLoopbackSession();
+ *   const url = buildBrowserAuthorizeUrl({ redirectUri: session.redirectUri, ... });
+ *   await opener.open(url);
+ *   const { code } = await session.awaitCallback({ expectedState, timeoutMs: 30_000 });
+ */
+declare function startLoopbackSession(trace?: VerboseTracer): Promise<LoopbackSession>;
+
+export { type LoopbackAwaitOptions, type LoopbackAwaitResult, type LoopbackSession, awaitLoopbackCallback, buildLoopbackRedirectUri, startLoopbackSession };

package/dist/lib/auth/loopback-server.js

@@ -0,0 +1,245 @@
+// src/lib/auth/loopback-server.ts
+import http from "http";
+
+// src/lib/errors.ts
+var RatioCLIError = class extends Error {
+  code;
+  exitCode;
+  hint;
+  docsUrl;
+  constructor(opts) {
+    super(opts.message);
+    this.name = new.target.name;
+    this.code = opts.code;
+    this.exitCode = opts.exitCode;
+    if (opts.hint !== void 0) this.hint = opts.hint;
+    if (opts.docsUrl !== void 0) this.docsUrl = opts.docsUrl;
+  }
+};
+var NotLoggedInError = class extends RatioCLIError {
+  constructor(message, hint = "Run 'ratio auth login' to sign in.") {
+    super({ code: "NOT_LOGGED_IN", exitCode: 3, message, hint });
+  }
+};
+var ValidationError = class extends RatioCLIError {
+  constructor(message, hint) {
+    const opts = {
+      code: "VALIDATION_ERROR",
+      exitCode: 8,
+      message
+    };
+    if (hint !== void 0) opts.hint = hint;
+    super(opts);
+  }
+};
+
+// src/lib/auth/state.ts
+import crypto from "crypto";
+function timingSafeEqualState(a, b) {
+  const aBuf = Buffer.from(a, "utf8");
+  const bBuf = Buffer.from(b, "utf8");
+  if (aBuf.length !== bBuf.length) {
+    crypto.timingSafeEqual(aBuf, aBuf);
+    return false;
+  }
+  return crypto.timingSafeEqual(aBuf, bBuf);
+}
+
+// src/lib/auth/verbose-trace.ts
+var noopTracer = () => {
+};
+
+// src/lib/auth/loopback-server.ts
+function awaitLoopbackCallback(o) {
+  const trace = o.trace ?? noopTracer;
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    function settle(fn) {
+      if (settled) return;
+      settled = true;
+      server.close(() => fn());
+    }
+    const server = http.createServer((req, res) => {
+      const reqUrl = new URL(req.url ?? "/", `http://127.0.0.1`);
+      if (reqUrl.pathname !== "/callback") {
+        res.writeHead(404, { "Content-Type": "text/plain" });
+        res.end("Not found");
+        return;
+      }
+      const code = reqUrl.searchParams.get("code");
+      const state = reqUrl.searchParams.get("state");
+      if (!state || !timingSafeEqualState(state, o.expectedState)) {
+        trace("callback: state mismatch");
+        res.writeHead(400, { "Content-Type": "text/plain" });
+        res.end("State mismatch");
+        settle(
+          () => reject(
+            new ValidationError("Authorization callback failed a security check.")
+          )
+        );
+        return;
+      }
+      if (!code || code.length === 0) {
+        trace("callback: missing code");
+        res.writeHead(400, { "Content-Type": "text/plain" });
+        res.end("Missing code");
+        settle(
+          () => reject(
+            new ValidationError("Authorization callback did not return a code.")
+          )
+        );
+        return;
+      }
+      res.writeHead(200, { "Content-Type": "text/html" });
+      res.end("<html><body><h1>Signed in! You can close this tab.</h1></body></html>");
+      const addr = server.address();
+      const port = typeof addr === "object" && addr !== null ? addr.port : 0;
+      const redirectUri = `http://127.0.0.1:${port}/callback`;
+      trace(`callback: received on port ${port} (state ok)`);
+      settle(() => resolve({ code, redirectUri }));
+    });
+    server.on("error", (err) => {
+      settle(() => reject(err));
+    });
+    server.listen(0, "127.0.0.1", () => {
+      const boundAddr = server.address();
+      const boundPort = typeof boundAddr === "object" && boundAddr !== null ? boundAddr.port : 0;
+      trace(`loopback: bound 127.0.0.1:${boundPort}`);
+      const timer = setTimeout(() => {
+        trace(`callback: timeout fired after ${o.timeoutMs}ms`);
+        settle(
+          () => reject(
+            new NotLoggedInError(
+              "Browser flow timed out. Run 'ratio auth login --manual' to complete without a browser."
+            )
+          )
+        );
+      }, o.timeoutMs);
+      if (typeof timer.unref === "function") {
+        timer.unref();
+      }
+      if (o.signal) {
+        o.signal.addEventListener("abort", () => {
+          trace("callback: cancelled");
+          clearTimeout(timer);
+          settle(
+            () => reject(
+              new NotLoggedInError(
+                "Browser flow was cancelled. Run 'ratio auth login --manual' to complete without a browser."
+              )
+            )
+          );
+        });
+      }
+    });
+  });
+}
+function buildLoopbackRedirectUri(port) {
+  return `http://127.0.0.1:${port}/callback`;
+}
+function startLoopbackSession(trace = noopTracer) {
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    function settle(fn) {
+      if (settled) return;
+      settled = true;
+      fn();
+    }
+    const server = http.createServer();
+    server.on("error", reject);
+    server.listen(0, "127.0.0.1", () => {
+      const addr = server.address();
+      const port = typeof addr === "object" && addr !== null ? addr.port : 0;
+      const redirectUri = buildLoopbackRedirectUri(port);
+      trace(`loopback: bound 127.0.0.1:${port}`);
+      resolve({
+        port,
+        redirectUri,
+        awaitCallback(opts) {
+          const timeoutMs = opts.timeoutMs ?? 3e4;
+          return new Promise((res, rej) => {
+            server.on("request", (req, response) => {
+              const reqUrl = new URL(req.url ?? "/", `http://127.0.0.1`);
+              if (reqUrl.pathname !== "/callback") {
+                response.writeHead(404, { "Content-Type": "text/plain" });
+                response.end("Not found");
+                return;
+              }
+              const code = reqUrl.searchParams.get("code");
+              const state = reqUrl.searchParams.get("state");
+              if (!state || !timingSafeEqualState(state, opts.expectedState)) {
+                trace("callback: state mismatch");
+                response.writeHead(400, { "Content-Type": "text/plain" });
+                response.end("State mismatch");
+                settle(() => {
+                  clearTimeout(timer);
+                  server.close(
+                    () => rej(new ValidationError("Authorization callback failed a security check."))
+                  );
+                });
+                return;
+              }
+              if (!code || code.length === 0) {
+                trace("callback: missing code");
+                response.writeHead(400, { "Content-Type": "text/plain" });
+                response.end("Missing code");
+                settle(() => {
+                  clearTimeout(timer);
+                  server.close(
+                    () => rej(new ValidationError("Authorization callback did not return a code."))
+                  );
+                });
+                return;
+              }
+              response.writeHead(200, { "Content-Type": "text/html" });
+              response.end(
+                "<html><body><h1>Signed in! You can close this tab.</h1></body></html>"
+              );
+              trace(`callback: received on port ${port} (state ok)`);
+              settle(() => {
+                clearTimeout(timer);
+                server.close(() => res({ code, redirectUri }));
+              });
+            });
+            const timer = setTimeout(() => {
+              trace(`callback: timeout fired after ${timeoutMs}ms`);
+              settle(() => {
+                server.close(
+                  () => rej(
+                    new NotLoggedInError(
+                      "Browser flow timed out. Run 'ratio auth login --manual' to complete without a browser."
+                    )
+                  )
+                );
+              });
+            }, timeoutMs);
+            if (typeof timer.unref === "function") {
+              timer.unref();
+            }
+            if (opts.signal) {
+              opts.signal.addEventListener("abort", () => {
+                trace("callback: cancelled");
+                clearTimeout(timer);
+                settle(() => {
+                  server.close(
+                    () => rej(
+                      new NotLoggedInError(
+                        "Browser flow was cancelled. Run 'ratio auth login --manual' to complete without a browser."
+                      )
+                    )
+                  );
+                });
+              });
+            }
+          });
+        }
+      });
+    });
+  });
+}
+export {
+  awaitLoopbackCallback,
+  buildLoopbackRedirectUri,
+  startLoopbackSession
+};
+//# sourceMappingURL=loopback-server.js.map

package/dist/lib/auth/loopback-server.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/lib/auth/loopback-server.ts","../../../src/lib/errors.ts","../../../src/lib/auth/state.ts","../../../src/lib/auth/verbose-trace.ts"],"sourcesContent":["/**\n * Ephemeral loopback HTTP server for the OAuth browser callback.\n *\n * Binds 127.0.0.1:0 (OS-assigned port). Awaits ONE GET /callback\n * request with ?code=...&state=... query parameters, verifies the state\n * via timingSafeEqualState, closes the server, and resolves.\n *\n * Security properties:\n *  - Binds 127.0.0.1 only — never 0.0.0.0 or ::\n *  - Port is OS-assigned (listen(0)) — never hardcoded\n *  - State compared via timingSafeEqual — no fast-fail timing side channel\n *  - Server closes on success, timeout, or state mismatch — no port leak\n *  - Non-callback paths receive a 404 response\n */\n\nimport http from 'node:http';\nimport { NotLoggedInError, ValidationError } from '../errors.js';\nimport { timingSafeEqualState } from './state.js';\nimport { noopTracer } from './verbose-trace.js';\nimport type { VerboseTracer } from './verbose-trace.js';\n\nexport interface LoopbackAwaitOptions {\n  readonly expectedState: string;\n  readonly timeoutMs: number;   // default 30_000 for prod, injectable for tests\n  readonly signal?: AbortSignal;\n  /** Verbose diagnostic sink — never receives code/state values. */\n  readonly trace?: VerboseTracer;\n}\n\nexport interface LoopbackAwaitResult {\n  readonly code: string;\n  readonly redirectUri: string;  // http://127.0.0.1:<actualPort>/callback\n}\n\n/**\n * Binds 127.0.0.1:0, awaits ONE GET /callback?code=...&state=..., verifies\n * state via timingSafeEqual against expectedState, closes the server cleanly,\n * resolves with { code, redirectUri }. On timeout or state mismatch or\n * non-callback request path, rejects with the appropriate typed error.\n */\nexport function awaitLoopbackCallback(o: LoopbackAwaitOptions): Promise<LoopbackAwaitResult> {\n  const trace = o.trace ?? noopTracer;\n  return new Promise((resolve, reject) => {\n    let settled = false;\n\n    function settle(fn: () => void): void {\n      if (settled) return;\n      settled = true;\n      server.close(() => fn());\n    }\n\n    const server = http.createServer((req, res) => {\n      const reqUrl = new URL(req.url ?? '/', `http://127.0.0.1`);\n\n      if (reqUrl.pathname !== '/callback') {\n        res.writeHead(404, { 'Content-Type': 'text/plain' });\n        res.end('Not found');\n        return;\n      }\n\n      const code = reqUrl.searchParams.get('code');\n      const state = reqUrl.searchParams.get('state');\n\n      if (!state || !timingSafeEqualState(state, o.expectedState)) {\n        trace('callback: state mismatch');\n        res.writeHead(400, { 'Content-Type': 'text/plain' });\n        res.end('State mismatch');\n        settle(() =>\n          reject(\n            new ValidationError('Authorization callback failed a security check.'),\n          ),\n        );\n        return;\n      }\n\n      if (!code || code.length === 0) {\n        trace('callback: missing code');\n        res.writeHead(400, { 'Content-Type': 'text/plain' });\n        res.end('Missing code');\n        settle(() =>\n          reject(\n            new ValidationError('Authorization callback did not return a code.'),\n          ),\n        );\n        return;\n      }\n\n      res.writeHead(200, { 'Content-Type': 'text/html' });\n      res.end('<html><body><h1>Signed in! You can close this tab.</h1></body></html>');\n\n      const addr = server.address();\n      const port = typeof addr === 'object' && addr !== null ? addr.port : 0;\n      const redirectUri = `http://127.0.0.1:${port}/callback`;\n\n      trace(`callback: received on port ${port} (state ok)`);\n      settle(() => resolve({ code, redirectUri }));\n    });\n\n    server.on('error', (err) => {\n      settle(() => reject(err));\n    });\n\n    server.listen(0, '127.0.0.1', () => {\n      const boundAddr = server.address();\n      const boundPort =\n        typeof boundAddr === 'object' && boundAddr !== null ? boundAddr.port : 0;\n      trace(`loopback: bound 127.0.0.1:${boundPort}`);\n\n      const timer = setTimeout(() => {\n        trace(`callback: timeout fired after ${o.timeoutMs}ms`);\n        settle(() =>\n          reject(\n            new NotLoggedInError(\n              \"Browser flow timed out. Run 'ratio auth login --manual' to complete without a browser.\",\n            ),\n          ),\n        );\n      }, o.timeoutMs);\n\n      // Allow process to exit if only this timer remains.\n      if (typeof timer.unref === 'function') {\n        timer.unref();\n      }\n\n      if (o.signal) {\n        o.signal.addEventListener('abort', () => {\n          trace('callback: cancelled');\n          clearTimeout(timer);\n          settle(() =>\n            reject(\n              new NotLoggedInError(\n                \"Browser flow was cancelled. Run 'ratio auth login --manual' to complete without a browser.\",\n              ),\n            ),\n          );\n        });\n      }\n    });\n  });\n}\n\n/**\n * Return the loopback callback URI for a given port.\n */\nexport function buildLoopbackRedirectUri(port: number): string {\n  return `http://127.0.0.1:${port}/callback`;\n}\n\nexport interface LoopbackSession {\n  /** The OS-assigned port the server is bound to. */\n  readonly port: number;\n  /** The full redirect URI to send in the authorize URL. */\n  readonly redirectUri: string;\n  /**\n   * Await the single callback. Resolves with the code, rejects on timeout\n   * or state mismatch. The server is closed when this promise settles.\n   */\n  awaitCallback(opts: Omit<LoopbackAwaitOptions, 'timeoutMs'> & { timeoutMs?: number }): Promise<LoopbackAwaitResult>;\n}\n\n/**\n * Two-phase API: start the server first (to get the port for the authorize URL),\n * then await the callback after the browser has been opened.\n *\n * Usage:\n *   const session = await startLoopbackSession();\n *   const url = buildBrowserAuthorizeUrl({ redirectUri: session.redirectUri, ... });\n *   await opener.open(url);\n *   const { code } = await session.awaitCallback({ expectedState, timeoutMs: 30_000 });\n */\nexport function startLoopbackSession(trace: VerboseTracer = noopTracer): Promise<LoopbackSession> {\n  return new Promise((resolve, reject) => {\n    let settled = false;\n\n    function settle(fn: () => void): void {\n      if (settled) return;\n      settled = true;\n      fn();\n    }\n\n    const server = http.createServer();\n    server.on('error', reject);\n    server.listen(0, '127.0.0.1', () => {\n      const addr = server.address();\n      const port = typeof addr === 'object' && addr !== null ? addr.port : 0;\n      const redirectUri = buildLoopbackRedirectUri(port);\n\n      trace(`loopback: bound 127.0.0.1:${port}`);\n\n      resolve({\n        port,\n        redirectUri,\n        awaitCallback(\n          opts: Omit<LoopbackAwaitOptions, 'timeoutMs'> & { timeoutMs?: number },\n        ): Promise<LoopbackAwaitResult> {\n          const timeoutMs = opts.timeoutMs ?? 30_000;\n\n          return new Promise((res, rej) => {\n            server.on('request', (req, response) => {\n              const reqUrl = new URL(req.url ?? '/', `http://127.0.0.1`);\n\n              if (reqUrl.pathname !== '/callback') {\n                response.writeHead(404, { 'Content-Type': 'text/plain' });\n                response.end('Not found');\n                return;\n              }\n\n              const code = reqUrl.searchParams.get('code');\n              const state = reqUrl.searchParams.get('state');\n\n              if (!state || !timingSafeEqualState(state, opts.expectedState)) {\n                trace('callback: state mismatch');\n                response.writeHead(400, { 'Content-Type': 'text/plain' });\n                response.end('State mismatch');\n                settle(() => {\n                  clearTimeout(timer);\n                  server.close(() =>\n                    rej(new ValidationError('Authorization callback failed a security check.')),\n                  );\n                });\n                return;\n              }\n\n              if (!code || code.length === 0) {\n                trace('callback: missing code');\n                response.writeHead(400, { 'Content-Type': 'text/plain' });\n                response.end('Missing code');\n                settle(() => {\n                  clearTimeout(timer);\n                  server.close(() =>\n                    rej(new ValidationError('Authorization callback did not return a code.')),\n                  );\n                });\n                return;\n              }\n\n              response.writeHead(200, { 'Content-Type': 'text/html' });\n              response.end(\n                '<html><body><h1>Signed in! You can close this tab.</h1></body></html>',\n              );\n\n              trace(`callback: received on port ${port} (state ok)`);\n              settle(() => {\n                clearTimeout(timer);\n                server.close(() => res({ code, redirectUri }));\n              });\n            });\n\n            const timer = setTimeout(() => {\n              trace(`callback: timeout fired after ${timeoutMs}ms`);\n              settle(() => {\n                server.close(() =>\n                  rej(\n                    new NotLoggedInError(\n                      \"Browser flow timed out. Run 'ratio auth login --manual' to complete without a browser.\",\n                    ),\n                  ),\n                );\n              });\n            }, timeoutMs);\n\n            if (typeof timer.unref === 'function') {\n              timer.unref();\n            }\n\n            if (opts.signal) {\n              opts.signal.addEventListener('abort', () => {\n                trace('callback: cancelled');\n                clearTimeout(timer);\n                settle(() => {\n                  server.close(() =>\n                    rej(\n                      new NotLoggedInError(\n                        \"Browser flow was cancelled. Run 'ratio auth login --manual' to complete without a browser.\",\n                      ),\n                    ),\n                  );\n                });\n              });\n            }\n          });\n        },\n      });\n    });\n  });\n}\n","/**\n * Error hierarchy for the Ratio CLI. Every error thrown from a command's\n * run() is expected to be an instance of RatioCLIError so the global\n * render-error handler can map it to a deterministic stderr line and exit\n * code. Uncaught Error subclasses render as \"INTERNAL: <msg>\" with exit 1.\n *\n * No import from @oclif/core — this file is dependency-free so tests\n * can import it without oclif overhead.\n */\n\nexport class RatioCLIError extends Error {\n  readonly code: string;\n  readonly exitCode: number;\n  readonly hint?: string;\n  readonly docsUrl?: string;\n\n  constructor(opts: {\n    code: string;\n    exitCode: number;\n    message: string;\n    hint?: string;\n    docsUrl?: string;\n  }) {\n    super(opts.message);\n    this.name = new.target.name;\n    this.code = opts.code;\n    this.exitCode = opts.exitCode;\n    if (opts.hint !== undefined) this.hint = opts.hint;\n    if (opts.docsUrl !== undefined) this.docsUrl = opts.docsUrl;\n  }\n}\n\n/** Coming-soon stub UX. Renders on stdout with exit 0. */\nexport class ComingSoonError extends RatioCLIError {\n  constructor(message: string) {\n    super({ code: 'COMING_SOON', exitCode: 0, message });\n  }\n}\n\n/** User has no credentials and command requires auth. */\nexport class NotLoggedInError extends RatioCLIError {\n  constructor(\n    message: string,\n    hint: string = \"Run 'ratio auth login' to sign in.\",\n  ) {\n    super({ code: 'NOT_LOGGED_IN', exitCode: 3, message, hint });\n  }\n}\n\nexport class TokenExpiredError extends RatioCLIError {\n  constructor(\n    message: string,\n    hint: string = \"Run 'ratio auth login' to refresh your session.\",\n  ) {\n    super({ code: 'TOKEN_EXPIRED', exitCode: 3, message, hint });\n  }\n}\n\nexport class ScopeDeniedError extends RatioCLIError {\n  constructor(message: string, hint?: string) {\n    const opts: { code: string; exitCode: number; message: string; hint?: string } = {\n      code: 'SCOPE_DENIED',\n      exitCode: 4,\n      message,\n    };\n    if (hint !== undefined) opts.hint = hint;\n    super(opts);\n  }\n}\n\nexport class NetworkError extends RatioCLIError {\n  constructor(message: string, hint: string = 'Check your network and retry.') {\n    super({ code: 'NETWORK_ERROR', exitCode: 5, message, hint });\n  }\n}\n\nexport class RelayConnectError extends RatioCLIError {\n  constructor(\n    message: string,\n    hint: string = 'Verify the tunnel URL and that the auth-server is reachable.',\n  ) {\n    super({ code: 'RELAY_CONNECT', exitCode: 6, message, hint });\n  }\n}\n\nexport class TemplateExistsError extends RatioCLIError {\n  constructor(\n    message: string,\n    hint: string = 'Choose a different name or remove the existing directory.',\n  ) {\n    super({ code: 'TEMPLATE_EXISTS', exitCode: 7, message, hint });\n  }\n}\n\nexport class ValidationError extends RatioCLIError {\n  constructor(message: string, hint?: string) {\n    const opts: { code: string; exitCode: number; message: string; hint?: string } = {\n      code: 'VALIDATION_ERROR',\n      exitCode: 8,\n      message,\n    };\n    if (hint !== undefined) opts.hint = hint;\n    super(opts);\n  }\n}\n\nexport class RelayResumeGapError extends RatioCLIError {\n  constructor(\n    message: string,\n    hint: string = 'Reconnect from the current cursor; older events are outside the buffer window.',\n  ) {\n    super({ code: 'RELAY_RESUME_GAP', exitCode: 9, message, hint });\n  }\n}\n\nexport class OrchestratorSpawnError extends RatioCLIError {\n  constructor(\n    message: string,\n    hint: string = \"Could not start your app's dev command — check that the command in ratio.config.jsonc runs from this directory.\",\n  ) {\n    super({ code: 'ORCHESTRATOR_SPAWN', exitCode: 10, message, hint });\n  }\n}\n\nexport class OrchestratorDrainTimeoutError extends RatioCLIError {\n  constructor(\n    message: string,\n    hint: string = 'Your dev command did not exit cleanly within 5 seconds — it was forcibly terminated.',\n  ) {\n    super({ code: 'ORCHESTRATOR_DRAIN', exitCode: 11, message, hint });\n  }\n}\n\nexport function isRatioCLIError(err: unknown): err is RatioCLIError {\n  return err instanceof RatioCLIError;\n}\n","/**\n * OAuth state parameter helpers.\n *\n * State is generated once per authorization request and must be compared\n * in constant time to prevent timing-oracle CSRF attacks.\n */\n\nimport crypto from 'node:crypto';\n\n/**\n * Generate a fresh state value: 32 random bytes encoded as base64url.\n * 32 bytes = 256 bits of entropy, well above the 128-bit minimum.\n */\nexport function generateState(): string {\n  return crypto.randomBytes(32).toString('base64url');\n}\n\n/**\n * Constant-time comparison of two state strings.\n * Returns true iff a === b without leaking timing information.\n * Both strings are converted to UTF-8 Buffers before comparison;\n * length-mismatch is handled without a fast-fail branch.\n */\nexport function timingSafeEqualState(a: string, b: string): boolean {\n  const aBuf = Buffer.from(a, 'utf8');\n  const bBuf = Buffer.from(b, 'utf8');\n  if (aBuf.length !== bBuf.length) {\n    // Perform a dummy comparison to avoid timing-observable fast-path.\n    crypto.timingSafeEqual(aBuf, aBuf);\n    return false;\n  }\n  return crypto.timingSafeEqual(aBuf, bBuf);\n}\n","/**\n * Minimal verbose diagnostic seam for the auth flow.\n *\n * When `--verbose` is on, the auth HTTP/loopback boundaries emit ONE line\n * per boundary crossing (method, path, status, timing, flow events) so a\n * failing login/refresh can be diagnosed from the CLI transcript alone.\n *\n * Safety contract (enforced by tests):\n *  - Lines go to STDERR only — never stdout — so `--json` consumers and\n *    shell pipelines are never corrupted.\n *  - NO secret material is ever passed to a tracer: no access/refresh\n *    token, no authorization code, no code_verifier, no state value.\n *    Only method, path, HTTP status, port numbers, and durations.\n */\n\n/** A tracer receives one pre-formatted diagnostic message per event. */\nexport type VerboseTracer = (msg: string) => void;\n\n/** Shared no-op used when `--verbose` is off (default everywhere). */\nexport const noopTracer: VerboseTracer = () => {};\n\n/**\n * Build a tracer. Returns the shared no-op unless `verbose` is true.\n * Output sink is injectable for tests; defaults to process.stderr.\n */\nexport function createVerboseTracer(\n  verbose: boolean,\n  write: (line: string) => void = (line) => {\n    process.stderr.write(line);\n  },\n): VerboseTracer {\n  if (!verbose) return noopTracer;\n  return (msg: string) => {\n    write(`[verbose] ${msg}\\n`);\n  };\n}\n"],"mappings":";AAeA,OAAO,UAAU;;;ACLV,IAAM,gBAAN,cAA4B,MAAM;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,MAMT;AACD,UAAM,KAAK,OAAO;AAClB,SAAK,OAAO,WAAW;AACvB,SAAK,OAAO,KAAK;AACjB,SAAK,WAAW,KAAK;AACrB,QAAI,KAAK,SAAS,OAAW,MAAK,OAAO,KAAK;AAC9C,QAAI,KAAK,YAAY,OAAW,MAAK,UAAU,KAAK;AAAA,EACtD;AACF;AAUO,IAAM,mBAAN,cAA+B,cAAc;AAAA,EAClD,YACE,SACA,OAAe,sCACf;AACA,UAAM,EAAE,MAAM,iBAAiB,UAAU,GAAG,SAAS,KAAK,CAAC;AAAA,EAC7D;AACF;AA+CO,IAAM,kBAAN,cAA8B,cAAc;AAAA,EACjD,YAAY,SAAiB,MAAe;AAC1C,UAAM,OAA2E;AAAA,MAC/E,MAAM;AAAA,MACN,UAAU;AAAA,MACV;AAAA,IACF;AACA,QAAI,SAAS,OAAW,MAAK,OAAO;AACpC,UAAM,IAAI;AAAA,EACZ;AACF;;;ACjGA,OAAO,YAAY;AAgBZ,SAAS,qBAAqB,GAAW,GAAoB;AAClE,QAAM,OAAO,OAAO,KAAK,GAAG,MAAM;AAClC,QAAM,OAAO,OAAO,KAAK,GAAG,MAAM;AAClC,MAAI,KAAK,WAAW,KAAK,QAAQ;AAE/B,WAAO,gBAAgB,MAAM,IAAI;AACjC,WAAO;AAAA,EACT;AACA,SAAO,OAAO,gBAAgB,MAAM,IAAI;AAC1C;;;ACbO,IAAM,aAA4B,MAAM;AAAC;;;AHqBzC,SAAS,sBAAsB,GAAuD;AAC3F,QAAM,QAAQ,EAAE,SAAS;AACzB,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,QAAI,UAAU;AAEd,aAAS,OAAO,IAAsB;AACpC,UAAI,QAAS;AACb,gBAAU;AACV,aAAO,MAAM,MAAM,GAAG,CAAC;AAAA,IACzB;AAEA,UAAM,SAAS,KAAK,aAAa,CAAC,KAAK,QAAQ;AAC7C,YAAM,SAAS,IAAI,IAAI,IAAI,OAAO,KAAK,kBAAkB;AAEzD,UAAI,OAAO,aAAa,aAAa;AACnC,YAAI,UAAU,KAAK,EAAE,gBAAgB,aAAa,CAAC;AACnD,YAAI,IAAI,WAAW;AACnB;AAAA,MACF;AAEA,YAAM,OAAO,OAAO,aAAa,IAAI,MAAM;AAC3C,YAAM,QAAQ,OAAO,aAAa,IAAI,OAAO;AAE7C,UAAI,CAAC,SAAS,CAAC,qBAAqB,OAAO,EAAE,aAAa,GAAG;AAC3D,cAAM,0BAA0B;AAChC,YAAI,UAAU,KAAK,EAAE,gBAAgB,aAAa,CAAC;AACnD,YAAI,IAAI,gBAAgB;AACxB;AAAA,UAAO,MACL;AAAA,YACE,IAAI,gBAAgB,iDAAiD;AAAA,UACvE;AAAA,QACF;AACA;AAAA,MACF;AAEA,UAAI,CAAC,QAAQ,KAAK,WAAW,GAAG;AAC9B,cAAM,wBAAwB;AAC9B,YAAI,UAAU,KAAK,EAAE,gBAAgB,aAAa,CAAC;AACnD,YAAI,IAAI,cAAc;AACtB;AAAA,UAAO,MACL;AAAA,YACE,IAAI,gBAAgB,+CAA+C;AAAA,UACrE;AAAA,QACF;AACA;AAAA,MACF;AAEA,UAAI,UAAU,KAAK,EAAE,gBAAgB,YAAY,CAAC;AAClD,UAAI,IAAI,uEAAuE;AAE/E,YAAM,OAAO,OAAO,QAAQ;AAC5B,YAAM,OAAO,OAAO,SAAS,YAAY,SAAS,OAAO,KAAK,OAAO;AACrE,YAAM,cAAc,oBAAoB,IAAI;AAE5C,YAAM,8BAA8B,IAAI,aAAa;AACrD,aAAO,MAAM,QAAQ,EAAE,MAAM,YAAY,CAAC,CAAC;AAAA,IAC7C,CAAC;AAED,WAAO,GAAG,SAAS,CAAC,QAAQ;AAC1B,aAAO,MAAM,OAAO,GAAG,CAAC;AAAA,IAC1B,CAAC;AAED,WAAO,OAAO,GAAG,aAAa,MAAM;AAClC,YAAM,YAAY,OAAO,QAAQ;AACjC,YAAM,YACJ,OAAO,cAAc,YAAY,cAAc,OAAO,UAAU,OAAO;AACzE,YAAM,6BAA6B,SAAS,EAAE;AAE9C,YAAM,QAAQ,WAAW,MAAM;AAC7B,cAAM,iCAAiC,EAAE,SAAS,IAAI;AACtD;AAAA,UAAO,MACL;AAAA,YACE,IAAI;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF,GAAG,EAAE,SAAS;AAGd,UAAI,OAAO,MAAM,UAAU,YAAY;AACrC,cAAM,MAAM;AAAA,MACd;AAEA,UAAI,EAAE,QAAQ;AACZ,UAAE,OAAO,iBAAiB,SAAS,MAAM;AACvC,gBAAM,qBAAqB;AAC3B,uBAAa,KAAK;AAClB;AAAA,YAAO,MACL;AAAA,cACE,IAAI;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AACH;AAKO,SAAS,yBAAyB,MAAsB;AAC7D,SAAO,oBAAoB,IAAI;AACjC;AAwBO,SAAS,qBAAqB,QAAuB,YAAsC;AAChG,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,QAAI,UAAU;AAEd,aAAS,OAAO,IAAsB;AACpC,UAAI,QAAS;AACb,gBAAU;AACV,SAAG;AAAA,IACL;AAEA,UAAM,SAAS,KAAK,aAAa;AACjC,WAAO,GAAG,SAAS,MAAM;AACzB,WAAO,OAAO,GAAG,aAAa,MAAM;AAClC,YAAM,OAAO,OAAO,QAAQ;AAC5B,YAAM,OAAO,OAAO,SAAS,YAAY,SAAS,OAAO,KAAK,OAAO;AACrE,YAAM,cAAc,yBAAyB,IAAI;AAEjD,YAAM,6BAA6B,IAAI,EAAE;AAEzC,cAAQ;AAAA,QACN;AAAA,QACA;AAAA,QACA,cACE,MAC8B;AAC9B,gBAAM,YAAY,KAAK,aAAa;AAEpC,iBAAO,IAAI,QAAQ,CAAC,KAAK,QAAQ;AAC/B,mBAAO,GAAG,WAAW,CAAC,KAAK,aAAa;AACtC,oBAAM,SAAS,IAAI,IAAI,IAAI,OAAO,KAAK,kBAAkB;AAEzD,kBAAI,OAAO,aAAa,aAAa;AACnC,yBAAS,UAAU,KAAK,EAAE,gBAAgB,aAAa,CAAC;AACxD,yBAAS,IAAI,WAAW;AACxB;AAAA,cACF;AAEA,oBAAM,OAAO,OAAO,aAAa,IAAI,MAAM;AAC3C,oBAAM,QAAQ,OAAO,aAAa,IAAI,OAAO;AAE7C,kBAAI,CAAC,SAAS,CAAC,qBAAqB,OAAO,KAAK,aAAa,GAAG;AAC9D,sBAAM,0BAA0B;AAChC,yBAAS,UAAU,KAAK,EAAE,gBAAgB,aAAa,CAAC;AACxD,yBAAS,IAAI,gBAAgB;AAC7B,uBAAO,MAAM;AACX,+BAAa,KAAK;AAClB,yBAAO;AAAA,oBAAM,MACX,IAAI,IAAI,gBAAgB,iDAAiD,CAAC;AAAA,kBAC5E;AAAA,gBACF,CAAC;AACD;AAAA,cACF;AAEA,kBAAI,CAAC,QAAQ,KAAK,WAAW,GAAG;AAC9B,sBAAM,wBAAwB;AAC9B,yBAAS,UAAU,KAAK,EAAE,gBAAgB,aAAa,CAAC;AACxD,yBAAS,IAAI,cAAc;AAC3B,uBAAO,MAAM;AACX,+BAAa,KAAK;AAClB,yBAAO;AAAA,oBAAM,MACX,IAAI,IAAI,gBAAgB,+CAA+C,CAAC;AAAA,kBAC1E;AAAA,gBACF,CAAC;AACD;AAAA,cACF;AAEA,uBAAS,UAAU,KAAK,EAAE,gBAAgB,YAAY,CAAC;AACvD,uBAAS;AAAA,gBACP;AAAA,cACF;AAEA,oBAAM,8BAA8B,IAAI,aAAa;AACrD,qBAAO,MAAM;AACX,6BAAa,KAAK;AAClB,uBAAO,MAAM,MAAM,IAAI,EAAE,MAAM,YAAY,CAAC,CAAC;AAAA,cAC/C,CAAC;AAAA,YACH,CAAC;AAED,kBAAM,QAAQ,WAAW,MAAM;AAC7B,oBAAM,iCAAiC,SAAS,IAAI;AACpD,qBAAO,MAAM;AACX,uBAAO;AAAA,kBAAM,MACX;AAAA,oBACE,IAAI;AAAA,sBACF;AAAA,oBACF;AAAA,kBACF;AAAA,gBACF;AAAA,cACF,CAAC;AAAA,YACH,GAAG,SAAS;AAEZ,gBAAI,OAAO,MAAM,UAAU,YAAY;AACrC,oBAAM,MAAM;AAAA,YACd;AAEA,gBAAI,KAAK,QAAQ;AACf,mBAAK,OAAO,iBAAiB,SAAS,MAAM;AAC1C,sBAAM,qBAAqB;AAC3B,6BAAa,KAAK;AAClB,uBAAO,MAAM;AACX,yBAAO;AAAA,oBAAM,MACX;AAAA,sBACE,IAAI;AAAA,wBACF;AAAA,sBACF;AAAA,oBACF;AAAA,kBACF;AAAA,gBACF,CAAC;AAAA,cACH,CAAC;AAAA,YACH;AAAA,UACF,CAAC;AAAA,QACH;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AAAA,EACH,CAAC;AACH;","names":[]}

package/dist/lib/auth/manual-prompt.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Stdin prompt for the --manual copy-paste OAuth flow.
+ *
+ * Uses node:readline/promises so it is awaitable and testable with
+ * an injectable interface. The defaultStdinPrompt() function is the
+ * production implementation; tests inject a fake.
+ */
+interface StdinPrompt {
+    askForCode(prompt: string): Promise<string>;
+}
+/**
+ * Create the default stdin prompter backed by node:readline/promises.
+ * Trims whitespace from the pasted code.
+ */
+declare function defaultStdinPrompt(): StdinPrompt;
+
+export { type StdinPrompt, defaultStdinPrompt };

package/dist/lib/auth/manual-prompt.js

@@ -0,0 +1,20 @@
+// src/lib/auth/manual-prompt.ts
+import { createInterface } from "readline/promises";
+import { stdin as input, stdout as output } from "process";
+function defaultStdinPrompt() {
+  return {
+    async askForCode(prompt) {
+      const rl = createInterface({ input, output });
+      try {
+        const answer = await rl.question(prompt);
+        return answer.trim();
+      } finally {
+        rl.close();
+      }
+    }
+  };
+}
+export {
+  defaultStdinPrompt
+};
+//# sourceMappingURL=manual-prompt.js.map

package/dist/lib/auth/manual-prompt.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/lib/auth/manual-prompt.ts"],"sourcesContent":["/**\n * Stdin prompt for the --manual copy-paste OAuth flow.\n *\n * Uses node:readline/promises so it is awaitable and testable with\n * an injectable interface. The defaultStdinPrompt() function is the\n * production implementation; tests inject a fake.\n */\n\nimport { createInterface } from 'node:readline/promises';\nimport { stdin as input, stdout as output } from 'node:process';\n\nexport interface StdinPrompt {\n  askForCode(prompt: string): Promise<string>;\n}\n\n/**\n * Create the default stdin prompter backed by node:readline/promises.\n * Trims whitespace from the pasted code.\n */\nexport function defaultStdinPrompt(): StdinPrompt {\n  return {\n    async askForCode(prompt: string): Promise<string> {\n      const rl = createInterface({ input, output });\n      try {\n        const answer = await rl.question(prompt);\n        return answer.trim();\n      } finally {\n        rl.close();\n      }\n    },\n  };\n}\n"],"mappings":";AAQA,SAAS,uBAAuB;AAChC,SAAS,SAAS,OAAO,UAAU,cAAc;AAU1C,SAAS,qBAAkC;AAChD,SAAO;AAAA,IACL,MAAM,WAAW,QAAiC;AAChD,YAAM,KAAK,gBAAgB,EAAE,OAAO,OAAO,CAAC;AAC5C,UAAI;AACF,cAAM,SAAS,MAAM,GAAG,SAAS,MAAM;AACvC,eAAO,OAAO,KAAK;AAAA,MACrB,UAAE;AACA,WAAG,MAAM;AAAA,MACX;AAAA,IACF;AAAA,EACF;AACF;","names":[]}

package/dist/lib/auth/pkce.d.ts

@@ -0,0 +1,24 @@
+/**
+ * PKCE (RFC 7636) helpers — S256 code challenge only.
+ *
+ * The "plain" method is rejected by the backend DTO validator and is
+ * never generated here. All operations are synchronous and pure.
+ */
+interface PkcePair {
+    readonly codeVerifier: string;
+    readonly codeChallenge: string;
+    readonly codeChallengeMethod: 'S256';
+}
+/**
+ * Compute the S256 code challenge for a given code verifier.
+ * BASE64URL-ENCODE(SHA256(ASCII(code_verifier))) without padding.
+ * Algorithm matches the backend pkce utility byte-for-byte.
+ */
+declare function computeS256Challenge(codeVerifier: string): string;
+/**
+ * Generate a fresh PKCE pair for one authorization request.
+ * codeVerifier is 96 random base64url bytes → 128 chars (within RFC 7636 43-128 range).
+ */
+declare function generatePkcePair(): PkcePair;
+
+export { type PkcePair, computeS256Challenge, generatePkcePair };

package/dist/lib/auth/pkce.js

@@ -0,0 +1,15 @@
+// src/lib/auth/pkce.ts
+import crypto from "crypto";
+function computeS256Challenge(codeVerifier) {
+  return crypto.createHash("sha256").update(codeVerifier, "ascii").digest("base64url");
+}
+function generatePkcePair() {
+  const codeVerifier = crypto.randomBytes(96).toString("base64url");
+  const codeChallenge = computeS256Challenge(codeVerifier);
+  return { codeVerifier, codeChallenge, codeChallengeMethod: "S256" };
+}
+export {
+  computeS256Challenge,
+  generatePkcePair
+};
+//# sourceMappingURL=pkce.js.map

package/dist/lib/auth/pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/lib/auth/pkce.ts"],"sourcesContent":["/**\n * PKCE (RFC 7636) helpers — S256 code challenge only.\n *\n * The \"plain\" method is rejected by the backend DTO validator and is\n * never generated here. All operations are synchronous and pure.\n */\n\nimport crypto from 'node:crypto';\n\nexport interface PkcePair {\n  readonly codeVerifier: string;   // 43-128 chars, unreserved-only (RFC 7636 §4.1)\n  readonly codeChallenge: string;  // base64url(SHA-256(codeVerifier))\n  readonly codeChallengeMethod: 'S256';\n}\n\n/**\n * Compute the S256 code challenge for a given code verifier.\n * BASE64URL-ENCODE(SHA256(ASCII(code_verifier))) without padding.\n * Algorithm matches the backend pkce utility byte-for-byte.\n */\nexport function computeS256Challenge(codeVerifier: string): string {\n  return crypto.createHash('sha256').update(codeVerifier, 'ascii').digest('base64url');\n}\n\n/**\n * Generate a fresh PKCE pair for one authorization request.\n * codeVerifier is 96 random base64url bytes → 128 chars (within RFC 7636 43-128 range).\n */\nexport function generatePkcePair(): PkcePair {\n  const codeVerifier = crypto.randomBytes(96).toString('base64url');\n  const codeChallenge = computeS256Challenge(codeVerifier);\n  return { codeVerifier, codeChallenge, codeChallengeMethod: 'S256' };\n}\n"],"mappings":";AAOA,OAAO,YAAY;AAaZ,SAAS,qBAAqB,cAA8B;AACjE,SAAO,OAAO,WAAW,QAAQ,EAAE,OAAO,cAAc,OAAO,EAAE,OAAO,WAAW;AACrF;AAMO,SAAS,mBAA6B;AAC3C,QAAM,eAAe,OAAO,YAAY,EAAE,EAAE,SAAS,WAAW;AAChE,QAAM,gBAAgB,qBAAqB,YAAY;AACvD,SAAO,EAAE,cAAc,eAAe,qBAAqB,OAAO;AACpE;","names":[]}

package/dist/lib/auth/state.d.ts

@@ -0,0 +1,20 @@
+/**
+ * OAuth state parameter helpers.
+ *
+ * State is generated once per authorization request and must be compared
+ * in constant time to prevent timing-oracle CSRF attacks.
+ */
+/**
+ * Generate a fresh state value: 32 random bytes encoded as base64url.
+ * 32 bytes = 256 bits of entropy, well above the 128-bit minimum.
+ */
+declare function generateState(): string;
+/**
+ * Constant-time comparison of two state strings.
+ * Returns true iff a === b without leaking timing information.
+ * Both strings are converted to UTF-8 Buffers before comparison;
+ * length-mismatch is handled without a fast-fail branch.
+ */
+declare function timingSafeEqualState(a: string, b: string): boolean;
+
+export { generateState, timingSafeEqualState };

package/dist/lib/auth/state.js

@@ -0,0 +1,19 @@
+// src/lib/auth/state.ts
+import crypto from "crypto";
+function generateState() {
+  return crypto.randomBytes(32).toString("base64url");
+}
+function timingSafeEqualState(a, b) {
+  const aBuf = Buffer.from(a, "utf8");
+  const bBuf = Buffer.from(b, "utf8");
+  if (aBuf.length !== bBuf.length) {
+    crypto.timingSafeEqual(aBuf, aBuf);
+    return false;
+  }
+  return crypto.timingSafeEqual(aBuf, bBuf);
+}
+export {
+  generateState,
+  timingSafeEqualState
+};
+//# sourceMappingURL=state.js.map

package/dist/lib/auth/state.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/lib/auth/state.ts"],"sourcesContent":["/**\n * OAuth state parameter helpers.\n *\n * State is generated once per authorization request and must be compared\n * in constant time to prevent timing-oracle CSRF attacks.\n */\n\nimport crypto from 'node:crypto';\n\n/**\n * Generate a fresh state value: 32 random bytes encoded as base64url.\n * 32 bytes = 256 bits of entropy, well above the 128-bit minimum.\n */\nexport function generateState(): string {\n  return crypto.randomBytes(32).toString('base64url');\n}\n\n/**\n * Constant-time comparison of two state strings.\n * Returns true iff a === b without leaking timing information.\n * Both strings are converted to UTF-8 Buffers before comparison;\n * length-mismatch is handled without a fast-fail branch.\n */\nexport function timingSafeEqualState(a: string, b: string): boolean {\n  const aBuf = Buffer.from(a, 'utf8');\n  const bBuf = Buffer.from(b, 'utf8');\n  if (aBuf.length !== bBuf.length) {\n    // Perform a dummy comparison to avoid timing-observable fast-path.\n    crypto.timingSafeEqual(aBuf, aBuf);\n    return false;\n  }\n  return crypto.timingSafeEqual(aBuf, bBuf);\n}\n"],"mappings":";AAOA,OAAO,YAAY;AAMZ,SAAS,gBAAwB;AACtC,SAAO,OAAO,YAAY,EAAE,EAAE,SAAS,WAAW;AACpD;AAQO,SAAS,qBAAqB,GAAW,GAAoB;AAClE,QAAM,OAAO,OAAO,KAAK,GAAG,MAAM;AAClC,QAAM,OAAO,OAAO,KAAK,GAAG,MAAM;AAClC,MAAI,KAAK,WAAW,KAAK,QAAQ;AAE/B,WAAO,gBAAgB,MAAM,IAAI;AACjC,WAAO;AAAA,EACT;AACA,SAAO,OAAO,gBAAgB,MAAM,IAAI;AAC1C;","names":[]}

package/dist/lib/auth/verbose-trace.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Minimal verbose diagnostic seam for the auth flow.
+ *
+ * When `--verbose` is on, the auth HTTP/loopback boundaries emit ONE line
+ * per boundary crossing (method, path, status, timing, flow events) so a
+ * failing login/refresh can be diagnosed from the CLI transcript alone.
+ *
+ * Safety contract (enforced by tests):
+ *  - Lines go to STDERR only — never stdout — so `--json` consumers and
+ *    shell pipelines are never corrupted.
+ *  - NO secret material is ever passed to a tracer: no access/refresh
+ *    token, no authorization code, no code_verifier, no state value.
+ *    Only method, path, HTTP status, port numbers, and durations.
+ */
+/** A tracer receives one pre-formatted diagnostic message per event. */
+type VerboseTracer = (msg: string) => void;
+/** Shared no-op used when `--verbose` is off (default everywhere). */
+declare const noopTracer: VerboseTracer;
+/**
+ * Build a tracer. Returns the shared no-op unless `verbose` is true.
+ * Output sink is injectable for tests; defaults to process.stderr.
+ */
+declare function createVerboseTracer(verbose: boolean, write?: (line: string) => void): VerboseTracer;
+
+export { type VerboseTracer, createVerboseTracer, noopTracer };

package/dist/lib/auth/verbose-trace.js

@@ -0,0 +1,17 @@
+// src/lib/auth/verbose-trace.ts
+var noopTracer = () => {
+};
+function createVerboseTracer(verbose, write = (line) => {
+  process.stderr.write(line);
+}) {
+  if (!verbose) return noopTracer;
+  return (msg) => {
+    write(`[verbose] ${msg}
+`);
+  };
+}
+export {
+  createVerboseTracer,
+  noopTracer
+};
+//# sourceMappingURL=verbose-trace.js.map

package/dist/lib/auth/verbose-trace.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/lib/auth/verbose-trace.ts"],"sourcesContent":["/**\n * Minimal verbose diagnostic seam for the auth flow.\n *\n * When `--verbose` is on, the auth HTTP/loopback boundaries emit ONE line\n * per boundary crossing (method, path, status, timing, flow events) so a\n * failing login/refresh can be diagnosed from the CLI transcript alone.\n *\n * Safety contract (enforced by tests):\n *  - Lines go to STDERR only — never stdout — so `--json` consumers and\n *    shell pipelines are never corrupted.\n *  - NO secret material is ever passed to a tracer: no access/refresh\n *    token, no authorization code, no code_verifier, no state value.\n *    Only method, path, HTTP status, port numbers, and durations.\n */\n\n/** A tracer receives one pre-formatted diagnostic message per event. */\nexport type VerboseTracer = (msg: string) => void;\n\n/** Shared no-op used when `--verbose` is off (default everywhere). */\nexport const noopTracer: VerboseTracer = () => {};\n\n/**\n * Build a tracer. Returns the shared no-op unless `verbose` is true.\n * Output sink is injectable for tests; defaults to process.stderr.\n */\nexport function createVerboseTracer(\n  verbose: boolean,\n  write: (line: string) => void = (line) => {\n    process.stderr.write(line);\n  },\n): VerboseTracer {\n  if (!verbose) return noopTracer;\n  return (msg: string) => {\n    write(`[verbose] ${msg}\\n`);\n  };\n}\n"],"mappings":";AAmBO,IAAM,aAA4B,MAAM;AAAC;AAMzC,SAAS,oBACd,SACA,QAAgC,CAAC,SAAS;AACxC,UAAQ,OAAO,MAAM,IAAI;AAC3B,GACe;AACf,MAAI,CAAC,QAAS,QAAO;AACrB,SAAO,CAAC,QAAgB;AACtB,UAAM,aAAa,GAAG;AAAA,CAAI;AAAA,EAC5B;AACF;","names":[]}

package/dist/lib/credentials/clock.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Injectable wall-clock seam for the credential store.
+ *
+ * This is the ONLY file in the credentials module allowed to sample the
+ * real wall clock. Every other file receives a {@link Clock} instance so
+ * tests can drive expiry-window logic deterministically with a fake.
+ */
+/** Injectable time source. */
+interface Clock {
+    /** Milliseconds since Unix epoch. */
+    now(): number;
+}
+/** Production {@link Clock} backed by the system wall clock. */
+declare class SystemClock implements Clock {
+    now(): number;
+}
+
+export { type Clock, SystemClock };

package/dist/lib/credentials/clock.js

@@ -0,0 +1,10 @@
+// src/lib/credentials/clock.ts
+var SystemClock = class {
+  now() {
+    return Date.now();
+  }
+};
+export {
+  SystemClock
+};
+//# sourceMappingURL=clock.js.map

package/dist/lib/credentials/clock.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/lib/credentials/clock.ts"],"sourcesContent":["/**\n * Injectable wall-clock seam for the credential store.\n *\n * This is the ONLY file in the credentials module allowed to sample the\n * real wall clock. Every other file receives a {@link Clock} instance so\n * tests can drive expiry-window logic deterministically with a fake.\n */\n\n/** Injectable time source. */\nexport interface Clock {\n  /** Milliseconds since Unix epoch. */\n  now(): number;\n}\n\n/** Production {@link Clock} backed by the system wall clock. */\nexport class SystemClock implements Clock {\n  now(): number {\n    return Date.now();\n  }\n}\n"],"mappings":";AAeO,IAAM,cAAN,MAAmC;AAAA,EACxC,MAAc;AACZ,WAAO,KAAK,IAAI;AAAA,EAClB;AACF;","names":[]}

package/dist/lib/credentials/index.d.ts

@@ -0,0 +1,5 @@
+export { Credentials, DeveloperSession, Identity, Profile, TokenSet } from './types.js';
+export { Clock, SystemClock } from './clock.js';
+export { PathEnv, defaultCredentialsPath } from './path.js';
+export { NotImplementedRefresher, TokenRefresher } from './refresher.js';
+export { CredentialStore, CredentialStoreOptions, FileCredentialStore } from './store.js';