@ratio-app/cli 0.1.1

package/dist/lib/credentials/schema.d.ts

@@ -0,0 +1,138 @@
+import { z } from 'zod';
+import { Credentials } from './types.js';
+
+/**
+ * Runtime validation for the on-disk credentials file.
+ *
+ * The parser is deliberately strict: unknown top-level keys, missing
+ * fields, non-ISO timestamps, and any `version` other than `1` are all
+ * rejected with a typed ValidationError. Error messages NEVER embed the
+ * raw file contents — a malformed file may contain a truncated token.
+ */
+
+/** Strict zod schema for the version-1 credentials file. */
+declare const credentialsSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    server: z.ZodString;
+    clientId: z.ZodString;
+    profiles: z.ZodRecord<z.ZodString, z.ZodObject<{
+        accessToken: z.ZodString;
+        refreshToken: z.ZodString;
+        expiresAt: z.ZodString;
+        identity: z.ZodObject<{
+            developerId: z.ZodString;
+            email: z.ZodString;
+            merchantId: z.ZodOptional<z.ZodString>;
+            scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "strict", z.ZodTypeAny, {
+            developerId: string;
+            email: string;
+            merchantId?: string | undefined;
+            scopes?: string[] | undefined;
+        }, {
+            developerId: string;
+            email: string;
+            merchantId?: string | undefined;
+            scopes?: string[] | undefined;
+        }>;
+        obtainedAt: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        accessToken: string;
+        refreshToken: string;
+        expiresAt: string;
+        identity: {
+            developerId: string;
+            email: string;
+            merchantId?: string | undefined;
+            scopes?: string[] | undefined;
+        };
+        obtainedAt: string;
+    }, {
+        accessToken: string;
+        refreshToken: string;
+        expiresAt: string;
+        identity: {
+            developerId: string;
+            email: string;
+            merchantId?: string | undefined;
+            scopes?: string[] | undefined;
+        };
+        obtainedAt: string;
+    }>>;
+    developer: z.ZodOptional<z.ZodObject<{
+        jwt: z.ZodString;
+        developerId: z.ZodString;
+        email: z.ZodString;
+        expiresAt: z.ZodString;
+        obtainedAt: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        developerId: string;
+        email: string;
+        expiresAt: string;
+        obtainedAt: string;
+        jwt: string;
+    }, {
+        developerId: string;
+        email: string;
+        expiresAt: string;
+        obtainedAt: string;
+        jwt: string;
+    }>>;
+}, "strict", z.ZodTypeAny, {
+    version: 1;
+    server: string;
+    clientId: string;
+    profiles: Record<string, {
+        accessToken: string;
+        refreshToken: string;
+        expiresAt: string;
+        identity: {
+            developerId: string;
+            email: string;
+            merchantId?: string | undefined;
+            scopes?: string[] | undefined;
+        };
+        obtainedAt: string;
+    }>;
+    developer?: {
+        developerId: string;
+        email: string;
+        expiresAt: string;
+        obtainedAt: string;
+        jwt: string;
+    } | undefined;
+}, {
+    version: 1;
+    server: string;
+    clientId: string;
+    profiles: Record<string, {
+        accessToken: string;
+        refreshToken: string;
+        expiresAt: string;
+        identity: {
+            developerId: string;
+            email: string;
+            merchantId?: string | undefined;
+            scopes?: string[] | undefined;
+        };
+        obtainedAt: string;
+    }>;
+    developer?: {
+        developerId: string;
+        email: string;
+        expiresAt: string;
+        obtainedAt: string;
+        jwt: string;
+    } | undefined;
+}>;
+/**
+ * Validate an already-JSON-parsed value against the version-1 shape.
+ *
+ * Throws ValidationError on any mismatch. A recognisable-but-unsupported
+ * `version` gets a dedicated upgrade message; the version label is only
+ * echoed when it is a number so arbitrary file contents can never leak
+ * into an error message.
+ */
+declare function parseCredentials(input: unknown): Credentials;
+
+export { credentialsSchema, parseCredentials };

package/dist/lib/credentials/schema.js

@@ -0,0 +1,85 @@
+// src/lib/credentials/schema.ts
+import { z } from "zod";
+
+// src/lib/errors.ts
+var RatioCLIError = class extends Error {
+  code;
+  exitCode;
+  hint;
+  docsUrl;
+  constructor(opts) {
+    super(opts.message);
+    this.name = new.target.name;
+    this.code = opts.code;
+    this.exitCode = opts.exitCode;
+    if (opts.hint !== void 0) this.hint = opts.hint;
+    if (opts.docsUrl !== void 0) this.docsUrl = opts.docsUrl;
+  }
+};
+var ValidationError = class extends RatioCLIError {
+  constructor(message, hint) {
+    const opts = {
+      code: "VALIDATION_ERROR",
+      exitCode: 8,
+      message
+    };
+    if (hint !== void 0) opts.hint = hint;
+    super(opts);
+  }
+};
+
+// src/lib/credentials/schema.ts
+var identitySchema = z.object({
+  developerId: z.string(),
+  email: z.string(),
+  // Token-derived fields captured at login. Optional (additive) so files
+  // written before these fields existed still validate as version 1.
+  merchantId: z.string().optional(),
+  scopes: z.array(z.string()).optional()
+}).strict();
+var profileSchema = z.object({
+  accessToken: z.string(),
+  refreshToken: z.string(),
+  expiresAt: z.string().datetime({ offset: true }),
+  identity: identitySchema,
+  obtainedAt: z.string().datetime({ offset: true })
+}).strict();
+var developerSessionSchema = z.object({
+  jwt: z.string(),
+  developerId: z.string(),
+  email: z.string(),
+  expiresAt: z.string().datetime({ offset: true }),
+  obtainedAt: z.string().datetime({ offset: true })
+}).strict();
+var credentialsSchema = z.object({
+  version: z.literal(1),
+  server: z.string(),
+  clientId: z.string(),
+  profiles: z.record(z.string(), profileSchema),
+  // Optional cached developer session. Additive so files written before
+  // this field existed still validate as version 1.
+  developer: developerSessionSchema.optional()
+}).strict();
+function parseCredentials(input) {
+  if (typeof input === "object" && input !== null && "version" in input) {
+    const version = input.version;
+    if (version !== 1) {
+      const label = typeof version === "number" ? String(version) : "unknown";
+      throw new ValidationError(
+        `credentials file version ${label} is unsupported by this CLI \u2014 upgrade the CLI or sign in again`
+      );
+    }
+  }
+  const result = credentialsSchema.safeParse(input);
+  if (!result.success) {
+    throw new ValidationError(
+      "credentials file schema mismatch \u2014 expected v1 shape"
+    );
+  }
+  return result.data;
+}
+export {
+  credentialsSchema,
+  parseCredentials
+};
+//# sourceMappingURL=schema.js.map

package/dist/lib/credentials/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/lib/credentials/schema.ts","../../../src/lib/errors.ts"],"sourcesContent":["/**\n * Runtime validation for the on-disk credentials file.\n *\n * The parser is deliberately strict: unknown top-level keys, missing\n * fields, non-ISO timestamps, and any `version` other than `1` are all\n * rejected with a typed ValidationError. Error messages NEVER embed the\n * raw file contents — a malformed file may contain a truncated token.\n */\n\nimport { z } from 'zod';\nimport { ValidationError } from '../errors.js';\nimport type { Credentials } from './types.js';\n\nconst identitySchema = z\n  .object({\n    developerId: z.string(),\n    email: z.string(),\n    // Token-derived fields captured at login. Optional (additive) so files\n    // written before these fields existed still validate as version 1.\n    merchantId: z.string().optional(),\n    scopes: z.array(z.string()).optional(),\n  })\n  .strict();\n\nconst profileSchema = z\n  .object({\n    accessToken: z.string(),\n    refreshToken: z.string(),\n    expiresAt: z.string().datetime({ offset: true }),\n    identity: identitySchema,\n    obtainedAt: z.string().datetime({ offset: true }),\n  })\n  .strict();\n\nconst developerSessionSchema = z\n  .object({\n    jwt: z.string(),\n    developerId: z.string(),\n    email: z.string(),\n    expiresAt: z.string().datetime({ offset: true }),\n    obtainedAt: z.string().datetime({ offset: true }),\n  })\n  .strict();\n\n/** Strict zod schema for the version-1 credentials file. */\nexport const credentialsSchema = z\n  .object({\n    version: z.literal(1),\n    server: z.string(),\n    clientId: z.string(),\n    profiles: z.record(z.string(), profileSchema),\n    // Optional cached developer session. Additive so files written before\n    // this field existed still validate as version 1.\n    developer: developerSessionSchema.optional(),\n  })\n  .strict();\n\n/**\n * Validate an already-JSON-parsed value against the version-1 shape.\n *\n * Throws ValidationError on any mismatch. A recognisable-but-unsupported\n * `version` gets a dedicated upgrade message; the version label is only\n * echoed when it is a number so arbitrary file contents can never leak\n * into an error message.\n */\nexport function parseCredentials(input: unknown): Credentials {\n  if (typeof input === 'object' && input !== null && 'version' in input) {\n    const version = (input as { version: unknown }).version;\n    if (version !== 1) {\n      const label = typeof version === 'number' ? String(version) : 'unknown';\n      throw new ValidationError(\n        `credentials file version ${label} is unsupported by this CLI — upgrade the CLI or sign in again`,\n      );\n    }\n  }\n\n  const result = credentialsSchema.safeParse(input);\n  if (!result.success) {\n    throw new ValidationError(\n      'credentials file schema mismatch — expected v1 shape',\n    );\n  }\n  return result.data as Credentials;\n}\n","/**\n * Error hierarchy for the Ratio CLI. Every error thrown from a command's\n * run() is expected to be an instance of RatioCLIError so the global\n * render-error handler can map it to a deterministic stderr line and exit\n * code. Uncaught Error subclasses render as \"INTERNAL: <msg>\" with exit 1.\n *\n * No import from @oclif/core — this file is dependency-free so tests\n * can import it without oclif overhead.\n */\n\nexport class RatioCLIError extends Error {\n  readonly code: string;\n  readonly exitCode: number;\n  readonly hint?: string;\n  readonly docsUrl?: string;\n\n  constructor(opts: {\n    code: string;\n    exitCode: number;\n    message: string;\n    hint?: string;\n    docsUrl?: string;\n  }) {\n    super(opts.message);\n    this.name = new.target.name;\n    this.code = opts.code;\n    this.exitCode = opts.exitCode;\n    if (opts.hint !== undefined) this.hint = opts.hint;\n    if (opts.docsUrl !== undefined) this.docsUrl = opts.docsUrl;\n  }\n}\n\n/** Coming-soon stub UX. Renders on stdout with exit 0. */\nexport class ComingSoonError extends RatioCLIError {\n  constructor(message: string) {\n    super({ code: 'COMING_SOON', exitCode: 0, message });\n  }\n}\n\n/** User has no credentials and command requires auth. */\nexport class NotLoggedInError extends RatioCLIError {\n  constructor(\n    message: string,\n    hint: string = \"Run 'ratio auth login' to sign in.\",\n  ) {\n    super({ code: 'NOT_LOGGED_IN', exitCode: 3, message, hint });\n  }\n}\n\nexport class TokenExpiredError extends RatioCLIError {\n  constructor(\n    message: string,\n    hint: string = \"Run 'ratio auth login' to refresh your session.\",\n  ) {\n    super({ code: 'TOKEN_EXPIRED', exitCode: 3, message, hint });\n  }\n}\n\nexport class ScopeDeniedError extends RatioCLIError {\n  constructor(message: string, hint?: string) {\n    const opts: { code: string; exitCode: number; message: string; hint?: string } = {\n      code: 'SCOPE_DENIED',\n      exitCode: 4,\n      message,\n    };\n    if (hint !== undefined) opts.hint = hint;\n    super(opts);\n  }\n}\n\nexport class NetworkError extends RatioCLIError {\n  constructor(message: string, hint: string = 'Check your network and retry.') {\n    super({ code: 'NETWORK_ERROR', exitCode: 5, message, hint });\n  }\n}\n\nexport class RelayConnectError extends RatioCLIError {\n  constructor(\n    message: string,\n    hint: string = 'Verify the tunnel URL and that the auth-server is reachable.',\n  ) {\n    super({ code: 'RELAY_CONNECT', exitCode: 6, message, hint });\n  }\n}\n\nexport class TemplateExistsError extends RatioCLIError {\n  constructor(\n    message: string,\n    hint: string = 'Choose a different name or remove the existing directory.',\n  ) {\n    super({ code: 'TEMPLATE_EXISTS', exitCode: 7, message, hint });\n  }\n}\n\nexport class ValidationError extends RatioCLIError {\n  constructor(message: string, hint?: string) {\n    const opts: { code: string; exitCode: number; message: string; hint?: string } = {\n      code: 'VALIDATION_ERROR',\n      exitCode: 8,\n      message,\n    };\n    if (hint !== undefined) opts.hint = hint;\n    super(opts);\n  }\n}\n\nexport class RelayResumeGapError extends RatioCLIError {\n  constructor(\n    message: string,\n    hint: string = 'Reconnect from the current cursor; older events are outside the buffer window.',\n  ) {\n    super({ code: 'RELAY_RESUME_GAP', exitCode: 9, message, hint });\n  }\n}\n\nexport class OrchestratorSpawnError extends RatioCLIError {\n  constructor(\n    message: string,\n    hint: string = \"Could not start your app's dev command — check that the command in ratio.config.jsonc runs from this directory.\",\n  ) {\n    super({ code: 'ORCHESTRATOR_SPAWN', exitCode: 10, message, hint });\n  }\n}\n\nexport class OrchestratorDrainTimeoutError extends RatioCLIError {\n  constructor(\n    message: string,\n    hint: string = 'Your dev command did not exit cleanly within 5 seconds — it was forcibly terminated.',\n  ) {\n    super({ code: 'ORCHESTRATOR_DRAIN', exitCode: 11, message, hint });\n  }\n}\n\nexport function isRatioCLIError(err: unknown): err is RatioCLIError {\n  return err instanceof RatioCLIError;\n}\n"],"mappings":";AASA,SAAS,SAAS;;;ACCX,IAAM,gBAAN,cAA4B,MAAM;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,MAMT;AACD,UAAM,KAAK,OAAO;AAClB,SAAK,OAAO,WAAW;AACvB,SAAK,OAAO,KAAK;AACjB,SAAK,WAAW,KAAK;AACrB,QAAI,KAAK,SAAS,OAAW,MAAK,OAAO,KAAK;AAC9C,QAAI,KAAK,YAAY,OAAW,MAAK,UAAU,KAAK;AAAA,EACtD;AACF;AAgEO,IAAM,kBAAN,cAA8B,cAAc;AAAA,EACjD,YAAY,SAAiB,MAAe;AAC1C,UAAM,OAA2E;AAAA,MAC/E,MAAM;AAAA,MACN,UAAU;AAAA,MACV;AAAA,IACF;AACA,QAAI,SAAS,OAAW,MAAK,OAAO;AACpC,UAAM,IAAI;AAAA,EACZ;AACF;;;AD3FA,IAAM,iBAAiB,EACpB,OAAO;AAAA,EACN,aAAa,EAAE,OAAO;AAAA,EACtB,OAAO,EAAE,OAAO;AAAA;AAAA;AAAA,EAGhB,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AACvC,CAAC,EACA,OAAO;AAEV,IAAM,gBAAgB,EACnB,OAAO;AAAA,EACN,aAAa,EAAE,OAAO;AAAA,EACtB,cAAc,EAAE,OAAO;AAAA,EACvB,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAC/C,UAAU;AAAA,EACV,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAClD,CAAC,EACA,OAAO;AAEV,IAAM,yBAAyB,EAC5B,OAAO;AAAA,EACN,KAAK,EAAE,OAAO;AAAA,EACd,aAAa,EAAE,OAAO;AAAA,EACtB,OAAO,EAAE,OAAO;AAAA,EAChB,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAC/C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAClD,CAAC,EACA,OAAO;AAGH,IAAM,oBAAoB,EAC9B,OAAO;AAAA,EACN,SAAS,EAAE,QAAQ,CAAC;AAAA,EACpB,QAAQ,EAAE,OAAO;AAAA,EACjB,UAAU,EAAE,OAAO;AAAA,EACnB,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,aAAa;AAAA;AAAA;AAAA,EAG5C,WAAW,uBAAuB,SAAS;AAC7C,CAAC,EACA,OAAO;AAUH,SAAS,iBAAiB,OAA6B;AAC5D,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,aAAa,OAAO;AACrE,UAAM,UAAW,MAA+B;AAChD,QAAI,YAAY,GAAG;AACjB,YAAM,QAAQ,OAAO,YAAY,WAAW,OAAO,OAAO,IAAI;AAC9D,YAAM,IAAI;AAAA,QACR,4BAA4B,KAAK;AAAA,MACnC;AAAA,IACF;AAAA,EACF;AAEA,QAAM,SAAS,kBAAkB,UAAU,KAAK;AAChD,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO,OAAO;AAChB;","names":[]}

package/dist/lib/credentials/store.d.ts

@@ -0,0 +1,102 @@
+import { Clock } from './clock.js';
+import { TokenRefresher } from './refresher.js';
+import { Credentials, DeveloperSession } from './types.js';
+
+/**
+ * File-backed credential store.
+ *
+ * Token resolution precedence (highest first):
+ *   1. `RATIO_API_TOKEN` from the injected env reader — returned as-is
+ *      with ZERO filesystem access and ZERO refresher involvement.
+ *   2. The requested profile (default: "default") from the credentials
+ *      file, silently refreshed via the injected TokenRefresher when it
+ *      is within 5 minutes of expiry.
+ *
+ * Write contract: atomic tmp + rename in the SAME directory, tmp created
+ * with mode 0600 at open time (POSIX), parent directory created 0700,
+ * belt-and-braces chmod 0600 after rename. On Windows no chmod / mode
+ * checks are ever performed. Concurrent writers are last-writer-wins by
+ * design — the atomic rename guarantees no half-written file, which is
+ * sufficient for a single-developer CLI.
+ *
+ * No secret (access token, refresh token, raw file contents) is ever
+ * included in an error message or a log line.
+ */
+
+interface CredentialStoreOptions {
+    /** Defaults to defaultCredentialsPath(). */
+    readonly filePath?: string;
+    /** Defaults to new SystemClock(). */
+    readonly clock?: Clock;
+    /** Defaults to new NotImplementedRefresher(). */
+    readonly refresher?: TokenRefresher;
+    /** Defaults to () => process.env — injected for env-precedence tests. */
+    readonly envReader?: () => Readonly<Record<string, string | undefined>>;
+    /** Defaults to process.platform. */
+    readonly platform?: NodeJS.Platform;
+}
+interface CredentialStore {
+    /** Reads the full credentials file. Throws NotLoggedInError if missing. */
+    load(): Promise<Credentials>;
+    /** Atomic write with 0600 on POSIX. tmp + rename in same dir. */
+    save(creds: Credentials): Promise<void>;
+    /** Deletes the credentials file. Idempotent. */
+    clear(): Promise<void>;
+    /**
+     * Env precedence: if envReader().RATIO_API_TOKEN is set, returns it
+     * WITHOUT reading the file, WITHOUT touching the refresher, WITHOUT
+     * any fs I/O. This is the auditable "no disk access" path.
+     *
+     * Otherwise: reads the file, validates, computes
+     *   msUntilExpiry = new Date(profile.expiresAt).getTime() - clock.now()
+     * If msUntilExpiry < 300_000 (5 min), calls refresher.refresh(...),
+     * persists the new TokenSet atomically, returns the new accessToken.
+     * Otherwise returns profile.accessToken.
+     */
+    getValidAccessToken(profileName?: string): Promise<string>;
+    /**
+     * Env precedence: RATIO_DEVELOPER_TOKEN if set (no fs I/O).
+     * Otherwise: load(); if creds.developer is absent or within 5 minutes of
+     * expiry, throws NotLoggedInError ('Developer signin required.').
+     * Otherwise returns creds.developer.jwt.
+     * NO refresh attempt — the caller drives the re-prompt UX.
+     */
+    getValidDeveloperToken(): Promise<string>;
+    /**
+     * Merge a DeveloperSession into the loaded credentials (creating the file
+     * if absent), atomic tmp+rename, 0600.
+     */
+    saveDeveloperSession(session: DeveloperSession): Promise<void>;
+}
+declare class FileCredentialStore implements CredentialStore {
+    private readonly filePath;
+    private readonly clock;
+    private readonly refresher;
+    private readonly envReader;
+    private readonly platform;
+    constructor(opts?: CredentialStoreOptions);
+    load(): Promise<Credentials>;
+    save(creds: Credentials): Promise<void>;
+    clear(): Promise<void>;
+    getValidAccessToken(profileName?: string): Promise<string>;
+    getValidDeveloperToken(): Promise<string>;
+    saveDeveloperSession(session: DeveloperSession): Promise<void>;
+    /**
+     * Exchange the profile's refresh token for a fresh token set, merge it
+     * into the loaded credentials (preserving every other profile), persist
+     * atomically, and return the new access token. A refresher failure is
+     * wrapped in TokenExpiredError; the underlying message is deliberately
+     * discarded so a secret can never leak through the error surface.
+     */
+    private refreshAndPersist;
+    /**
+     * POSIX-only startup permission check: if the file exists with a mode
+     * other than 0600, re-apply 0600 and emit a warning to stderr. Never
+     * runs on Windows (stat modes there do not map to POSIX bits and chmod
+     * must not be called). Missing file is NOT an error here — load()
+     * reports it as NotLoggedInError.
+     */
+    private reapplyFileModeIfDrifted;
+}
+
+export { type CredentialStore, type CredentialStoreOptions, FileCredentialStore };

package/dist/lib/credentials/store.js

@@ -0,0 +1,337 @@
+// src/lib/credentials/store.ts
+import crypto from "crypto";
+import fs from "fs";
+import { dirname } from "path";
+
+// src/lib/errors.ts
+var RatioCLIError = class extends Error {
+  code;
+  exitCode;
+  hint;
+  docsUrl;
+  constructor(opts) {
+    super(opts.message);
+    this.name = new.target.name;
+    this.code = opts.code;
+    this.exitCode = opts.exitCode;
+    if (opts.hint !== void 0) this.hint = opts.hint;
+    if (opts.docsUrl !== void 0) this.docsUrl = opts.docsUrl;
+  }
+};
+var NotLoggedInError = class extends RatioCLIError {
+  constructor(message, hint = "Run 'ratio auth login' to sign in.") {
+    super({ code: "NOT_LOGGED_IN", exitCode: 3, message, hint });
+  }
+};
+var TokenExpiredError = class extends RatioCLIError {
+  constructor(message, hint = "Run 'ratio auth login' to refresh your session.") {
+    super({ code: "TOKEN_EXPIRED", exitCode: 3, message, hint });
+  }
+};
+var ValidationError = class extends RatioCLIError {
+  constructor(message, hint) {
+    const opts = {
+      code: "VALIDATION_ERROR",
+      exitCode: 8,
+      message
+    };
+    if (hint !== void 0) opts.hint = hint;
+    super(opts);
+  }
+};
+
+// src/lib/credentials/clock.ts
+var SystemClock = class {
+  now() {
+    return Date.now();
+  }
+};
+
+// src/lib/credentials/path.ts
+import os from "os";
+import path from "path";
+function snapshotPathEnv() {
+  const snapshot = {};
+  const xdgConfigHome = process.env["XDG_CONFIG_HOME"];
+  if (xdgConfigHome !== void 0) {
+    snapshot.XDG_CONFIG_HOME = xdgConfigHome;
+  }
+  const appData = process.env["APPDATA"];
+  if (appData !== void 0) {
+    snapshot.APPDATA = appData;
+  }
+  return snapshot;
+}
+function defaultCredentialsPath(platform, homedir, env) {
+  const resolvedPlatform = platform ?? process.platform;
+  const resolvedHome = homedir ?? os.homedir();
+  const resolvedEnv = env ?? snapshotPathEnv();
+  if (resolvedPlatform === "win32") {
+    const appData = resolvedEnv.APPDATA;
+    const base2 = appData !== void 0 && appData !== "" ? appData : path.win32.join(resolvedHome, "AppData", "Roaming");
+    return path.win32.join(base2, "ratio", "credentials");
+  }
+  const xdgConfigHome = resolvedEnv.XDG_CONFIG_HOME;
+  const base = typeof xdgConfigHome === "string" && xdgConfigHome !== "" ? xdgConfigHome : path.posix.join(resolvedHome, ".config");
+  return path.posix.join(base, "ratio", "credentials");
+}
+
+// src/lib/credentials/refresher.ts
+var NotImplementedRefresher = class {
+  async refresh(refreshToken) {
+    void refreshToken;
+    throw new NotLoggedInError(
+      "Token refresh is not available yet in this CLI version."
+    );
+  }
+};
+
+// src/lib/credentials/schema.ts
+import { z } from "zod";
+var identitySchema = z.object({
+  developerId: z.string(),
+  email: z.string(),
+  // Token-derived fields captured at login. Optional (additive) so files
+  // written before these fields existed still validate as version 1.
+  merchantId: z.string().optional(),
+  scopes: z.array(z.string()).optional()
+}).strict();
+var profileSchema = z.object({
+  accessToken: z.string(),
+  refreshToken: z.string(),
+  expiresAt: z.string().datetime({ offset: true }),
+  identity: identitySchema,
+  obtainedAt: z.string().datetime({ offset: true })
+}).strict();
+var developerSessionSchema = z.object({
+  jwt: z.string(),
+  developerId: z.string(),
+  email: z.string(),
+  expiresAt: z.string().datetime({ offset: true }),
+  obtainedAt: z.string().datetime({ offset: true })
+}).strict();
+var credentialsSchema = z.object({
+  version: z.literal(1),
+  server: z.string(),
+  clientId: z.string(),
+  profiles: z.record(z.string(), profileSchema),
+  // Optional cached developer session. Additive so files written before
+  // this field existed still validate as version 1.
+  developer: developerSessionSchema.optional()
+}).strict();
+function parseCredentials(input) {
+  if (typeof input === "object" && input !== null && "version" in input) {
+    const version = input.version;
+    if (version !== 1) {
+      const label = typeof version === "number" ? String(version) : "unknown";
+      throw new ValidationError(
+        `credentials file version ${label} is unsupported by this CLI \u2014 upgrade the CLI or sign in again`
+      );
+    }
+  }
+  const result = credentialsSchema.safeParse(input);
+  if (!result.success) {
+    throw new ValidationError(
+      "credentials file schema mismatch \u2014 expected v1 shape"
+    );
+  }
+  return result.data;
+}
+
+// src/lib/credentials/store.ts
+var REFRESH_WINDOW_MS = 3e5;
+var ENV_TOKEN_VAR = "RATIO_API_TOKEN";
+var ENV_DEVELOPER_TOKEN_VAR = "RATIO_DEVELOPER_TOKEN";
+function hasErrnoCode(err, code) {
+  return err instanceof Error && err.code === code;
+}
+var FileCredentialStore = class {
+  filePath;
+  clock;
+  refresher;
+  envReader;
+  platform;
+  constructor(opts) {
+    this.filePath = opts?.filePath ?? defaultCredentialsPath();
+    this.clock = opts?.clock ?? new SystemClock();
+    this.refresher = opts?.refresher ?? new NotImplementedRefresher();
+    this.envReader = opts?.envReader ?? (() => process.env);
+    this.platform = opts?.platform ?? process.platform;
+  }
+  async load() {
+    this.reapplyFileModeIfDrifted();
+    let raw;
+    try {
+      raw = fs.readFileSync(this.filePath, "utf8");
+    } catch (err) {
+      if (hasErrnoCode(err, "ENOENT")) {
+        throw new NotLoggedInError("You are not signed in.");
+      }
+      throw err;
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      throw new ValidationError(
+        'credentials file is not valid JSON \u2014 run "ratio auth login" to reset'
+      );
+    }
+    return parseCredentials(parsed);
+  }
+  async save(creds) {
+    const dir = dirname(this.filePath);
+    fs.mkdirSync(dir, { recursive: true, mode: 448 });
+    if (this.platform !== "win32") {
+      fs.chmodSync(dir, 448);
+    }
+    const tmpPath = `${this.filePath}.${process.pid}.${crypto.randomBytes(8).toString("hex")}.tmp`;
+    try {
+      fs.writeFileSync(tmpPath, JSON.stringify(creds, null, 2), {
+        mode: 384
+      });
+      fs.renameSync(tmpPath, this.filePath);
+    } catch (err) {
+      try {
+        fs.unlinkSync(tmpPath);
+      } catch {
+      }
+      throw err;
+    }
+    if (this.platform !== "win32") {
+      fs.chmodSync(this.filePath, 384);
+    }
+  }
+  async clear() {
+    try {
+      fs.unlinkSync(this.filePath);
+    } catch (err) {
+      if (hasErrnoCode(err, "ENOENT")) {
+        return;
+      }
+      throw err;
+    }
+  }
+  async getValidAccessToken(profileName) {
+    const envToken = this.envReader()[ENV_TOKEN_VAR];
+    if (typeof envToken === "string" && envToken.length > 0) {
+      return envToken;
+    }
+    const creds = await this.load();
+    const name = profileName ?? "default";
+    const profile = creds.profiles[name];
+    if (profile === void 0) {
+      throw new NotLoggedInError("You are not signed in.");
+    }
+    const msUntilExpiry = new Date(profile.expiresAt).getTime() - this.clock.now();
+    if (msUntilExpiry < REFRESH_WINDOW_MS) {
+      return this.refreshAndPersist(creds, name, profile);
+    }
+    return profile.accessToken;
+  }
+  async getValidDeveloperToken() {
+    const envToken = this.envReader()[ENV_DEVELOPER_TOKEN_VAR];
+    if (typeof envToken === "string" && envToken.length > 0) {
+      return envToken;
+    }
+    let creds;
+    try {
+      creds = await this.load();
+    } catch (err) {
+      if (err instanceof NotLoggedInError) {
+        throw new NotLoggedInError("Developer signin required.");
+      }
+      throw err;
+    }
+    const session = creds.developer;
+    if (session === void 0) {
+      throw new NotLoggedInError("Developer signin required.");
+    }
+    const msUntilExpiry = new Date(session.expiresAt).getTime() - this.clock.now();
+    if (msUntilExpiry < REFRESH_WINDOW_MS) {
+      throw new NotLoggedInError("Developer signin required.");
+    }
+    return session.jwt;
+  }
+  async saveDeveloperSession(session) {
+    let creds;
+    try {
+      creds = await this.load();
+    } catch (err) {
+      if (err instanceof NotLoggedInError) {
+        creds = { version: 1, server: "", clientId: "", profiles: {} };
+      } else {
+        throw err;
+      }
+    }
+    const updated = {
+      ...creds,
+      developer: session
+    };
+    await this.save(updated);
+  }
+  /**
+   * Exchange the profile's refresh token for a fresh token set, merge it
+   * into the loaded credentials (preserving every other profile), persist
+   * atomically, and return the new access token. A refresher failure is
+   * wrapped in TokenExpiredError; the underlying message is deliberately
+   * discarded so a secret can never leak through the error surface.
+   */
+  async refreshAndPersist(creds, name, profile) {
+    let refreshed;
+    try {
+      refreshed = await this.refresher.refresh(profile.refreshToken);
+    } catch {
+      throw new TokenExpiredError(
+        "Your session has expired and could not be refreshed."
+      );
+    }
+    const updated = {
+      ...creds,
+      profiles: {
+        ...creds.profiles,
+        [name]: {
+          ...profile,
+          accessToken: refreshed.accessToken,
+          refreshToken: refreshed.refreshToken,
+          expiresAt: refreshed.expiresAt
+        }
+      }
+    };
+    await this.save(updated);
+    return refreshed.accessToken;
+  }
+  /**
+   * POSIX-only startup permission check: if the file exists with a mode
+   * other than 0600, re-apply 0600 and emit a warning to stderr. Never
+   * runs on Windows (stat modes there do not map to POSIX bits and chmod
+   * must not be called). Missing file is NOT an error here — load()
+   * reports it as NotLoggedInError.
+   */
+  reapplyFileModeIfDrifted() {
+    if (this.platform === "win32") {
+      return;
+    }
+    let stat;
+    try {
+      stat = fs.statSync(this.filePath);
+    } catch (err) {
+      if (hasErrnoCode(err, "ENOENT")) {
+        return;
+      }
+      throw err;
+    }
+    const mode = stat.mode & 511;
+    if (mode !== 384) {
+      fs.chmodSync(this.filePath, 384);
+      process.stderr.write(
+        `[warn] credentials file permissions were 0o${mode.toString(8)}; corrected to 0600.
+`
+      );
+    }
+  }
+};
+export {
+  FileCredentialStore
+};
+//# sourceMappingURL=store.js.map