@wenrwa/marketplace-cli 0.5.24 → 0.6.3

package/dist/__tests__/apps.test.js

@@ -158,3 +158,25 @@ describe('apps export-github', () => {
         spy.mockRestore();
     });
 });
+describe('apps download', () => {
+    it('authenticates with the API key header, never the retired wallet header', async () => {
+        mockClient.getApiUrl = jest.fn(() => 'https://api.example/api/v1');
+        mockClient.getApiKey = jest.fn(() => 'wm_sk_testkey');
+        const fetchSpy = jest.spyOn(global, 'fetch').mockResolvedValue({
+            ok: true,
+            arrayBuffer: async () => new ArrayBuffer(3),
+        });
+        const fs = require('fs');
+        const writeSpy = jest.spyOn(fs, 'writeFileSync').mockImplementation(() => undefined);
+        const logSpy = jest.spyOn(console, 'log').mockImplementation();
+        await runCommand('download', 'proj-1', '-o', '/tmp/out.zip');
+        const [url, init] = fetchSpy.mock.calls[0];
+        expect(url).toBe('https://api.example/api/v1/projects/proj-1/source');
+        const headers = init.headers;
+        expect(headers['X-API-Key']).toBe('wm_sk_testkey');
+        expect(Object.keys(headers).map((h) => h.toLowerCase())).not.toContain('x-wallet-pubkey');
+        fetchSpy.mockRestore();
+        writeSpy.mockRestore();
+        logSpy.mockRestore();
+    });
+});

package/dist/__tests__/auth-api-key-format.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/auth-api-key-format.test.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * TDD — wha-08: distinguishing a real API key (`wm_sk_…`, matches
+ * ApiKeyService#generateKey in backend/src/services/api-key.service.ts) from
+ * the old habit of pasting a bare Solana wallet public key (base58,
+ * 32-44 chars) into --api-key.
+ */
+const apiKeyFormat_1 = require("../utils/apiKeyFormat");
+describe('isRealApiKey', () => {
+    it('accepts a key with the real wm_sk_ prefix', () => {
+        expect((0, apiKeyFormat_1.isRealApiKey)('wm_sk_' + 'a'.repeat(64))).toBe(true);
+    });
+    it('rejects a bare wallet public key', () => {
+        expect((0, apiKeyFormat_1.isRealApiKey)('AKnL4NNf3DGWZJS6cPknBuEGnVsV4A4m5tgebLHaRSZ9')).toBe(false);
+    });
+    it('rejects an empty or garbage string', () => {
+        expect((0, apiKeyFormat_1.isRealApiKey)('')).toBe(false);
+        expect((0, apiKeyFormat_1.isRealApiKey)('not-a-key')).toBe(false);
+    });
+});
+describe('looksLikeWalletPubkey', () => {
+    it('matches a base58 Solana public key', () => {
+        expect((0, apiKeyFormat_1.looksLikeWalletPubkey)('AKnL4NNf3DGWZJS6cPknBuEGnVsV4A4m5tgebLHaRSZ9')).toBe(true);
+    });
+    it('does not match a real API key', () => {
+        expect((0, apiKeyFormat_1.looksLikeWalletPubkey)('wm_sk_' + 'a'.repeat(64))).toBe(false);
+    });
+    it('does not match short or non-base58 strings', () => {
+        expect((0, apiKeyFormat_1.looksLikeWalletPubkey)('short')).toBe(false);
+        expect((0, apiKeyFormat_1.looksLikeWalletPubkey)('has-dashes-and-is-long-enough-0000000')).toBe(false);
+    });
+});
+describe('shortenKey', () => {
+    it('shows a short prefix and hides the rest', () => {
+        const shortened = (0, apiKeyFormat_1.shortenKey)('wm_sk_' + 'a'.repeat(64));
+        expect(shortened.startsWith('wm_sk_')).toBe(true);
+        expect(shortened.length).toBeLessThan(20);
+        expect(shortened).toContain('…');
+    });
+});

package/dist/__tests__/auth-identity.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/auth-identity.test.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * TDD — wha-08: resolveIdentity does the ONE authenticated call both `auth
+ * login` (device flow success) and `auth login --api-key` (CI) need: verify
+ * the key actually authenticates, and if so, try for a human-readable name
+ * (falling back to nothing — the caller decides the final display string).
+ * GET /agents/me is used because it works for every account (an account
+ * with no registered agent still gets `{ success: true, agent: null }`), so
+ * it doubles as a cheap "is this key valid" check.
+ */
+const identity_1 = require("../auth/identity");
+function fakeFetch(status, body) {
+    return jest.fn().mockResolvedValue({
+        ok: status >= 200 && status < 300,
+        status,
+        json: async () => body,
+    });
+}
+describe('resolveIdentity', () => {
+    it('sends the key as X-API-Key (never X-Wallet-Pubkey) and returns the agent name when present', async () => {
+        const fetchImpl = fakeFetch(200, { success: true, agent: { name: 'TestAgent' } });
+        const result = await (0, identity_1.resolveIdentity)({ apiUrl: 'https://api.x', apiKey: 'wm_sk_abc', fetchImpl });
+        expect(result).toEqual({ ok: true, name: 'TestAgent' });
+        const [url, init] = fetchImpl.mock.calls[0];
+        expect(url).toBe('https://api.x/agents/me');
+        expect(init.headers['X-API-Key']).toBe('wm_sk_abc');
+        expect(init.headers['X-Wallet-Pubkey']).toBeUndefined();
+    });
+    it('returns ok with no name when the account has no registered agent', async () => {
+        const fetchImpl = fakeFetch(200, { success: true, agent: null });
+        const result = await (0, identity_1.resolveIdentity)({ apiUrl: 'https://api.x', apiKey: 'wm_sk_abc', fetchImpl });
+        expect(result).toEqual({ ok: true, name: undefined });
+    });
+    it('returns ok:false with the server message for an invalid/revoked key', async () => {
+        const fetchImpl = fakeFetch(401, { success: false, error: { code: 'INVALID_API_KEY', message: 'Invalid, expired, or revoked API key' } });
+        const result = await (0, identity_1.resolveIdentity)({ apiUrl: 'https://api.x', apiKey: 'wm_sk_bad', fetchImpl });
+        expect(result).toEqual({ ok: false, message: 'Invalid, expired, or revoked API key' });
+    });
+    it('returns ok:false when the network call throws', async () => {
+        const fetchImpl = jest.fn().mockRejectedValue(new Error('ECONNREFUSED'));
+        const result = await (0, identity_1.resolveIdentity)({ apiUrl: 'https://api.x', apiKey: 'wm_sk_abc', fetchImpl });
+        expect(result.ok).toBe(false);
+        expect(result.message).toContain('ECONNREFUSED');
+    });
+});

package/dist/__tests__/auth-login-core.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/auth-login-core.test.js

@@ -0,0 +1,145 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * TDD — wha-08: `wen-market auth login` device-flow core. Mirrors
+ * bridge-pairing-loop.test.ts / bridge-pairing-core.test.ts's shape (pure
+ * poll loop + pure orchestrating core, network/clock/cancellation all
+ * injected) but is intentionally a SEPARATE module from bridge/pairing.ts —
+ * `wen-market pair` (bridge pairing) must keep working byte-for-byte
+ * unchanged, and cli_login has an outcome bridge pairing's loop never
+ * handles: the human can DENY a CLI login from the approval screen.
+ */
+const login_1 = require("../auth/login");
+describe('runLoginPoll', () => {
+    it('polls until approved and returns the freshly minted API key', async () => {
+        const poll = jest
+            .fn()
+            .mockResolvedValueOnce({ success: true, status: 'pending' })
+            .mockResolvedValueOnce({ success: true, status: 'pending' })
+            .mockResolvedValueOnce({ success: true, status: 'approved', purpose: 'cli_login', apiKey: 'wm_sk_freshkey' });
+        const sleep = jest.fn().mockResolvedValue(undefined);
+        const result = await (0, login_1.runLoginPoll)({
+            poll,
+            sleep,
+            intervalMs: 2000,
+            deadlineMs: 60000,
+            now: () => 0,
+            isCancelled: () => false,
+        });
+        expect(result).toEqual({ outcome: 'approved', apiKey: 'wm_sk_freshkey' });
+        expect(poll).toHaveBeenCalledTimes(3);
+        expect(sleep).toHaveBeenCalledTimes(2);
+        expect(sleep).toHaveBeenCalledWith(2000);
+    });
+    it('stops with a denied outcome as soon as the human declines in the browser', async () => {
+        const poll = jest.fn().mockResolvedValue({ success: true, status: 'denied' });
+        const result = await (0, login_1.runLoginPoll)({
+            poll,
+            sleep: jest.fn().mockResolvedValue(undefined),
+            intervalMs: 1000,
+            deadlineMs: 60000,
+            now: () => 0,
+            isCancelled: () => false,
+        });
+        expect(result).toEqual({ outcome: 'denied' });
+        expect(poll).toHaveBeenCalledTimes(1);
+    });
+    it('stops with an expired outcome as soon as the server reports expired', async () => {
+        const poll = jest.fn().mockResolvedValue({ success: true, status: 'expired' });
+        const result = await (0, login_1.runLoginPoll)({
+            poll,
+            sleep: jest.fn().mockResolvedValue(undefined),
+            intervalMs: 1000,
+            deadlineMs: 60000,
+            now: () => 0,
+            isCancelled: () => false,
+        });
+        expect(result).toEqual({ outcome: 'expired' });
+        expect(poll).toHaveBeenCalledTimes(1);
+    });
+    it('gives up with a timeout outcome once the overall deadline passes, without polling past it', async () => {
+        let elapsed = 0;
+        const poll = jest.fn().mockResolvedValue({ success: true, status: 'pending' });
+        const sleep = jest.fn().mockImplementation(async (ms) => {
+            elapsed += ms;
+        });
+        const result = await (0, login_1.runLoginPoll)({
+            poll,
+            sleep,
+            intervalMs: 2000,
+            deadlineMs: 5000,
+            now: () => elapsed,
+            isCancelled: () => false,
+        });
+        expect(result).toEqual({ outcome: 'timeout' });
+        expect(poll.mock.calls.length).toBeLessThanOrEqual(3);
+    });
+    it('is Ctrl-C safe — stops promptly and reports cancelled without an extra poll', async () => {
+        let cancelled = false;
+        const poll = jest.fn().mockImplementation(async () => {
+            cancelled = true; // simulate Ctrl-C arriving while the first poll is in flight
+            return { success: true, status: 'pending' };
+        });
+        const sleep = jest.fn().mockResolvedValue(undefined);
+        const result = await (0, login_1.runLoginPoll)({
+            poll,
+            sleep,
+            intervalMs: 2000,
+            deadlineMs: 60000,
+            now: () => 0,
+            isCancelled: () => cancelled,
+        });
+        expect(result).toEqual({ outcome: 'cancelled' });
+        expect(poll).toHaveBeenCalledTimes(1);
+        expect(sleep).not.toHaveBeenCalled();
+    });
+    it('treats an approved response with no apiKey as expired (defensive — should never happen server-side)', async () => {
+        const poll = jest.fn().mockResolvedValue({ success: true, status: 'approved', purpose: 'cli_login' });
+        const result = await (0, login_1.runLoginPoll)({
+            poll,
+            sleep: jest.fn(),
+            intervalMs: 1000,
+            deadlineMs: 60000,
+            now: () => 0,
+            isCancelled: () => false,
+        });
+        expect(result).toEqual({ outcome: 'expired' });
+    });
+});
+describe('loginCore', () => {
+    it('requests a cli_login code with the hostname, fires onCodeReady, and returns the poll outcome', async () => {
+        const requestPairingCode = jest.fn().mockResolvedValue({ code: 'HIVE-7K3Q', pollToken: 'pt', expiresAt: '2026-01-01T00:10:00Z' });
+        const pollPairingCode = jest.fn().mockResolvedValue({ success: true, status: 'approved', purpose: 'cli_login', apiKey: 'wm_sk_freshkey' });
+        const onCodeReady = jest.fn();
+        const outcome = await (0, login_1.loginCore)({ apiUrl: 'https://api.x' }, {
+            requestPairingCode,
+            pollPairingCode,
+            hostname: () => 'bunnys-macbook',
+            sleep: jest.fn().mockResolvedValue(undefined),
+            now: () => 0,
+            isCancelled: () => false,
+            onCodeReady,
+        });
+        expect(requestPairingCode).toHaveBeenCalledWith({ apiUrl: 'https://api.x', deviceLabel: 'bunnys-macbook', purpose: 'cli_login' });
+        expect(pollPairingCode).toHaveBeenCalledWith({ apiUrl: 'https://api.x', pollToken: 'pt' });
+        expect(onCodeReady).toHaveBeenCalledWith({ code: 'HIVE-7K3Q', expiresAt: '2026-01-01T00:10:00Z' });
+        expect(outcome).toEqual({
+            code: 'HIVE-7K3Q',
+            expiresAt: '2026-01-01T00:10:00Z',
+            result: { outcome: 'approved', apiKey: 'wm_sk_freshkey' },
+        });
+    });
+    it('propagates a denied outcome without touching disk (loginCore never saves — the command shell does)', async () => {
+        const requestPairingCode = jest.fn().mockResolvedValue({ code: 'HIVE-7K3Q', pollToken: 'pt', expiresAt: '2026-01-01T00:10:00Z' });
+        const pollPairingCode = jest.fn().mockResolvedValue({ success: true, status: 'denied' });
+        const outcome = await (0, login_1.loginCore)({ apiUrl: 'https://api.x' }, {
+            requestPairingCode,
+            pollPairingCode,
+            hostname: () => 'bunnys-macbook',
+            sleep: jest.fn().mockResolvedValue(undefined),
+            now: () => 0,
+            isCancelled: () => false,
+        });
+        expect(outcome.result).toEqual({ outcome: 'denied' });
+    });
+});

package/dist/__tests__/auth.test.js

@@ -3,92 +3,281 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * TDD — wha-08: `wen-market auth login` / `auth logout` / `auth whoami`.
+ * The device-flow poll loop itself is tested in auth-login-core.test.ts
+ * (runLoginPoll/loginCore) — here loginCore is mocked, and these tests cover
+ * the command shell: the already-signed-in prompt, reporting each outcome
+ * with the agreed message, the --api-key CI path (accept wm_sk_, refuse a
+ * wallet pubkey), logout's revoke-then-delete, and Ctrl+C wiring.
+ */
 const chalk_1 = __importDefault(require("chalk"));
+const REAL_KEY = 'wm_sk_' + 'a'.repeat(64);
+const WALLET_PUBKEY = 'AKnL4NNf3DGWZJS6cPknBuEGnVsV4A4m5tgebLHaRSZ9';
 const mockLoadConfig = jest.fn();
 const mockSaveConfig = jest.fn();
+const mockClearConfig = jest.fn();
 const mockGetApiUrl = jest.fn().mockReturnValue('http://test:3001/api/marketplace');
 jest.mock('../utils/config', () => ({
     loadConfig: (...args) => mockLoadConfig(...args),
     saveConfig: (...args) => mockSaveConfig(...args),
+    clearConfig: (...args) => mockClearConfig(...args),
     getApiUrl: (...args) => mockGetApiUrl(...args),
 }));
+const mockLoginCore = jest.fn();
+jest.mock('../auth/login', () => ({
+    loginCore: (...args) => mockLoginCore(...args),
+}));
+const mockResolveIdentity = jest.fn();
+jest.mock('../auth/identity', () => ({
+    resolveIdentity: (...args) => mockResolveIdentity(...args),
+}));
+const mockConfirm = jest.fn();
+const mockIsInteractive = jest.fn();
+jest.mock('../utils/prompt', () => ({
+    confirm: (...args) => mockConfirm(...args),
+    isInteractive: (...args) => mockIsInteractive(...args),
+}));
+const mockOpenBrowser = jest.fn();
+jest.mock('../utils/openBrowser', () => ({
+    openBrowser: (...args) => mockOpenBrowser(...args),
+}));
+const helpers_1 = require("./helpers");
+const mockClient = (0, helpers_1.createMockClient)();
+jest.mock('../utils/client', () => ({
+    getClient: () => mockClient,
+}));
 const auth_1 = require("../commands/auth");
-let mockFetch;
 beforeAll(() => {
     chalk_1.default.level = 0;
 });
 beforeEach(() => {
     jest.clearAllMocks();
-    mockFetch = jest.fn();
-    global.fetch = mockFetch;
+    mockGetApiUrl.mockReturnValue('http://test:3001/api/marketplace');
+    mockIsInteractive.mockReturnValue(true);
 });
 async function runCommand(...args) {
     await auth_1.authCommand.parseAsync(args, { from: 'user' });
 }
-describe('auth login', () => {
-    it('verifies agent and saves config', async () => {
-        mockFetch.mockResolvedValue({ ok: true, json: () => Promise.resolve({}) });
-        const spy = jest.spyOn(console, 'log').mockImplementation();
-        await runCommand('login', '--api-key', 'my-wallet-key');
-        expect(mockFetch).toHaveBeenCalledWith(expect.stringContaining('/agents/my-wallet-key'));
-        expect(mockSaveConfig).toHaveBeenCalledWith({
-            apiKey: 'my-wallet-key',
-            apiUrl: 'http://test:3001/api/marketplace',
+function captureLogs() {
+    const logs = [];
+    const spy = jest.spyOn(console, 'log').mockImplementation((...a) => { logs.push(a.join(' ')); });
+    const errSpy = jest.spyOn(console, 'error').mockImplementation((...a) => { logs.push(a.join(' ')); });
+    return { logs, restore: () => { spy.mockRestore(); errSpy.mockRestore(); } };
+}
+describe('auth login — device flow (no existing config)', () => {
+    beforeEach(() => {
+        mockLoadConfig.mockReturnValue(null);
+    });
+    it('signs in successfully, saves the key, and prints "Signed in as <name>"', async () => {
+        mockLoginCore.mockResolvedValue({
+            code: 'HIVE-7K3Q',
+            expiresAt: '2026-01-01T00:10:00Z',
+            result: { outcome: 'approved', apiKey: REAL_KEY },
+        });
+        mockResolveIdentity.mockResolvedValue({ ok: true, name: 'BunnyDAO' });
+        const { logs, restore } = captureLogs();
+        await runCommand('login');
+        expect(mockSaveConfig).toHaveBeenCalledWith({ apiKey: REAL_KEY, apiUrl: 'http://test:3001/api/marketplace' });
+        expect(logs.join('\n')).toContain('Signed in as BunnyDAO');
+        restore();
+    });
+    it('falls back to a shortened key identifier when no display name is available', async () => {
+        mockLoginCore.mockResolvedValue({
+            code: 'HIVE-7K3Q',
+            expiresAt: '2026-01-01T00:10:00Z',
+            result: { outcome: 'approved', apiKey: REAL_KEY },
+        });
+        mockResolveIdentity.mockResolvedValue({ ok: true, name: undefined });
+        const { logs, restore } = captureLogs();
+        await runCommand('login');
+        expect(logs.join('\n')).toMatch(/Signed in as wm_sk_/);
+        restore();
+    });
+    it('prints the code, the approval URL with ?code=, and tries to open the browser, as soon as the code is minted', async () => {
+        mockLoginCore.mockImplementation(async (_opts, deps) => {
+            deps.onCodeReady?.({ code: 'HIVE-7K3Q', expiresAt: '2026-01-01T00:10:00Z' });
+            return { code: 'HIVE-7K3Q', expiresAt: '2026-01-01T00:10:00Z', result: { outcome: 'cancelled' } };
         });
-        spy.mockRestore();
-    });
-    it('saves config even when fetch fails', async () => {
-        mockFetch.mockRejectedValue(new Error('Network error'));
-        const spy = jest.spyOn(console, 'log').mockImplementation();
-        await runCommand('login', '--api-key', 'offline-key');
-        expect(mockSaveConfig).toHaveBeenCalledWith(expect.objectContaining({ apiKey: 'offline-key' }));
-        spy.mockRestore();
-    });
-    it('saves config when agent not found (non-ok response)', async () => {
-        mockFetch.mockResolvedValue({ ok: false });
-        const spy = jest.spyOn(console, 'log').mockImplementation();
-        await runCommand('login', '--api-key', 'new-user');
-        expect(mockSaveConfig).toHaveBeenCalledWith(expect.objectContaining({ apiKey: 'new-user' }));
-        spy.mockRestore();
-    });
-    it('uses custom api-url when provided', async () => {
-        mockFetch.mockResolvedValue({ ok: true, json: () => Promise.resolve({}) });
-        const spy = jest.spyOn(console, 'log').mockImplementation();
-        await runCommand('login', '--api-key', 'key', '--api-url', 'http://custom:4000');
-        expect(mockFetch).toHaveBeenCalledWith(expect.stringContaining('http://custom:4000'));
-        expect(mockSaveConfig).toHaveBeenCalledWith(expect.objectContaining({ apiUrl: 'http://custom:4000' }));
-        spy.mockRestore();
+        const { logs, restore } = captureLogs();
+        await runCommand('login');
+        const output = logs.join('\n');
+        expect(output).toContain('HIVE-7K3Q');
+        expect(output).toContain('/settings/cli-login?code=HIVE-7K3Q');
+        expect(mockOpenBrowser).toHaveBeenCalledWith(expect.stringContaining('/settings/cli-login?code=HIVE-7K3Q'));
+        restore();
+    });
+    it('reports a denial with the agreed message and does not save anything', async () => {
+        mockLoginCore.mockResolvedValue({ code: 'HIVE-7K3Q', expiresAt: '2026-01-01T00:10:00Z', result: { outcome: 'denied' } });
+        const { logs, restore } = captureLogs();
+        await runCommand('login').catch(() => { });
+        expect(logs.join('\n')).toContain('Login denied in the browser.');
+        expect(mockSaveConfig).not.toHaveBeenCalled();
+        restore();
+    });
+    it('reports an expired code with the agreed message and does not save anything', async () => {
+        mockLoginCore.mockResolvedValue({ code: 'HIVE-7K3Q', expiresAt: '2026-01-01T00:10:00Z', result: { outcome: 'expired' } });
+        const { logs, restore } = captureLogs();
+        await runCommand('login').catch(() => { });
+        expect(logs.join('\n')).toContain('Code expired — run `wen-market auth login` again.');
+        expect(mockSaveConfig).not.toHaveBeenCalled();
+        restore();
+    });
+    it('reports a local timeout with the same "code expired" message and does not save anything', async () => {
+        mockLoginCore.mockResolvedValue({ code: 'HIVE-7K3Q', expiresAt: '2026-01-01T00:10:00Z', result: { outcome: 'timeout' } });
+        const { logs, restore } = captureLogs();
+        await runCommand('login').catch(() => { });
+        expect(logs.join('\n')).toContain('Code expired — run `wen-market auth login` again.');
+        expect(mockSaveConfig).not.toHaveBeenCalled();
+        restore();
+    });
+    it('reports a clean cancellation and does not save anything', async () => {
+        mockLoginCore.mockResolvedValue({ code: 'HIVE-7K3Q', expiresAt: '2026-01-01T00:10:00Z', result: { outcome: 'cancelled' } });
+        const { logs, restore } = captureLogs();
+        await runCommand('login');
+        expect(logs.join('\n')).toContain('Login cancelled — no changes made.');
+        expect(mockSaveConfig).not.toHaveBeenCalled();
+        restore();
+    });
+    it('Ctrl+C cancels cleanly — the isCancelled dep flips true the instant SIGINT fires', async () => {
+        let capturedIsCancelled;
+        let resolveLoginCore;
+        mockLoginCore.mockImplementation((_opts, deps) => {
+            capturedIsCancelled = deps.isCancelled;
+            return new Promise((resolve) => { resolveLoginCore = resolve; });
+        });
+        const { restore } = captureLogs();
+        const runPromise = runCommand('login');
+        // let the action reach the point where it has called loginCore
+        await Promise.resolve();
+        await Promise.resolve();
+        expect(capturedIsCancelled).toBeDefined();
+        expect(capturedIsCancelled()).toBe(false);
+        process.emit('SIGINT');
+        expect(capturedIsCancelled()).toBe(true);
+        resolveLoginCore({ code: 'HIVE-7K3Q', expiresAt: '2026-01-01T00:10:00Z', result: { outcome: 'cancelled' } });
+        await runPromise;
+        restore();
+    });
+});
+describe('auth login — already signed in', () => {
+    beforeEach(() => {
+        mockLoadConfig.mockReturnValue({ apiKey: REAL_KEY, apiUrl: 'http://test:3001/api/marketplace' });
+    });
+    it('defaults to No — declining leaves the existing login untouched and never starts the device flow', async () => {
+        mockIsInteractive.mockReturnValue(true);
+        mockConfirm.mockResolvedValue(false);
+        const { restore } = captureLogs();
+        await runCommand('login');
+        expect(mockConfirm).toHaveBeenCalledWith(expect.stringContaining('Sign in again?'), false);
+        expect(mockLoginCore).not.toHaveBeenCalled();
+        expect(mockSaveConfig).not.toHaveBeenCalled();
+        restore();
+    });
+    it('proceeds with a fresh device login when the human confirms yes', async () => {
+        mockIsInteractive.mockReturnValue(true);
+        mockConfirm.mockResolvedValue(true);
+        mockLoginCore.mockResolvedValue({ code: 'HIVE-7K3Q', expiresAt: '2026-01-01T00:10:00Z', result: { outcome: 'denied' } });
+        const { restore } = captureLogs();
+        await runCommand('login').catch(() => { });
+        expect(mockLoginCore).toHaveBeenCalled();
+        restore();
+    });
+    it('refuses with guidance in non-interactive mode (no TTY) rather than hanging on a prompt', async () => {
+        mockIsInteractive.mockReturnValue(false);
+        const { logs, restore } = captureLogs();
+        await runCommand('login').catch(() => { });
+        expect(mockConfirm).not.toHaveBeenCalled();
+        expect(mockLoginCore).not.toHaveBeenCalled();
+        expect(logs.join('\n')).toContain('Already signed in');
+        restore();
+    });
+});
+describe('auth login --api-key (CI)', () => {
+    beforeEach(() => {
+        mockLoadConfig.mockReturnValue(null);
+    });
+    it('accepts a real wm_sk_ key, verifies it, and saves it', async () => {
+        mockResolveIdentity.mockResolvedValue({ ok: true, name: 'CI Bot' });
+        const { logs, restore } = captureLogs();
+        await runCommand('login', '--api-key', REAL_KEY);
+        expect(mockResolveIdentity).toHaveBeenCalledWith(expect.objectContaining({ apiKey: REAL_KEY }));
+        expect(mockSaveConfig).toHaveBeenCalledWith({ apiKey: REAL_KEY, apiUrl: 'http://test:3001/api/marketplace' });
+        expect(logs.join('\n')).toContain('Signed in as CI Bot');
+        restore();
+    });
+    it('refuses a bare wallet public key with the exact guidance message, and does not save it', async () => {
+        const { logs, restore } = captureLogs();
+        const exitSpy = jest.spyOn(process, 'exit').mockImplementation(() => undefined);
+        await runCommand('login', '--api-key', WALLET_PUBKEY);
+        expect(logs.join('\n')).toContain("That's a wallet address, not an API key. Run `wen-market auth login` or create a key at https://marketplace.wenrwa.com/settings");
+        expect(mockSaveConfig).not.toHaveBeenCalled();
+        expect(mockResolveIdentity).not.toHaveBeenCalled();
+        expect(exitSpy).toHaveBeenCalledWith(1);
+        exitSpy.mockRestore();
+        restore();
+    });
+    it('refuses to save a key that fails server verification', async () => {
+        mockResolveIdentity.mockResolvedValue({ ok: false, message: 'Invalid, expired, or revoked API key' });
+        const { logs, restore } = captureLogs();
+        const exitSpy = jest.spyOn(process, 'exit').mockImplementation(() => undefined);
+        await runCommand('login', '--api-key', REAL_KEY);
+        expect(mockSaveConfig).not.toHaveBeenCalled();
+        expect(logs.join('\n')).toContain('Invalid, expired, or revoked API key');
+        expect(exitSpy).toHaveBeenCalledWith(1);
+        exitSpy.mockRestore();
+        restore();
+    });
+});
+describe('auth logout', () => {
+    it('revokes the key server-side (matched by prefix) then deletes it locally', async () => {
+        mockLoadConfig.mockReturnValue({ apiKey: REAL_KEY, apiUrl: 'http://test:3001/api/marketplace' });
+        mockClient.get.mockResolvedValue({ success: true, keys: [{ id: 'key-1', keyPrefix: REAL_KEY.slice(0, 16) }, { id: 'key-2', keyPrefix: 'wm_sk_other00000' }] });
+        mockClient.del.mockResolvedValue({ success: true });
+        const { logs, restore } = captureLogs();
+        await runCommand('logout');
+        expect(mockClient.del).toHaveBeenCalledWith('/keys/key-1');
+        // logout must happen AFTER the server revoke succeeds
+        const delIdx = mockClient.del.mock.invocationCallOrder[0];
+        const clearIdx = mockClearConfig.mock.invocationCallOrder[0];
+        expect(clearIdx).toBeGreaterThan(delIdx);
+        expect(logs.join('\n')).toMatch(/revoked/i);
+        restore();
+    });
+    it('still deletes the key locally, with a clear warning, when the server call fails', async () => {
+        mockLoadConfig.mockReturnValue({ apiKey: REAL_KEY, apiUrl: 'http://test:3001/api/marketplace' });
+        mockClient.get.mockRejectedValue(new Error('Network error'));
+        const { logs, restore } = captureLogs();
+        await runCommand('logout');
+        expect(mockClearConfig).toHaveBeenCalled();
+        expect(logs.join('\n')).toMatch(/could not revoke/i);
+        restore();
+    });
+    it('does nothing when not signed in', async () => {
+        mockLoadConfig.mockReturnValue(null);
+        const { restore } = captureLogs();
+        await runCommand('logout');
+        expect(mockClient.del).not.toHaveBeenCalled();
+        expect(mockClearConfig).not.toHaveBeenCalled();
+        restore();
     });
 });
 describe('auth whoami', () => {
-    it('displays current session when logged in', async () => {
-        mockLoadConfig.mockReturnValue({ apiKey: 'my-key', apiUrl: 'http://test' });
-        mockFetch.mockResolvedValue({
-            ok: true,
-            json: () => Promise.resolve({ agent: { name: 'TestAgent', status: 'active', weighted_reputation: 4.5 } }),
-        });
-        const spy = jest.spyOn(console, 'log').mockImplementation();
+    it('shows the stored identity when signed in', async () => {
+        mockLoadConfig.mockReturnValue({ apiKey: REAL_KEY, apiUrl: 'http://test:3001/api/marketplace' });
+        mockResolveIdentity.mockResolvedValue({ ok: true, name: 'BunnyDAO' });
+        const { logs, restore } = captureLogs();
         await runCommand('whoami');
-        const output = spy.mock.calls.map(c => c[0]).join('\n');
-        expect(output).toContain('my-key');
-        expect(output).toContain('TestAgent');
-        spy.mockRestore();
+        expect(logs.join('\n')).toContain('BunnyDAO');
+        restore();
     });
-    it('exits when not logged in', async () => {
+    it('exits when not signed in', async () => {
         mockLoadConfig.mockReturnValue(null);
         const exitSpy = jest.spyOn(process, 'exit').mockImplementation(() => undefined);
-        const errSpy = jest.spyOn(console, 'error').mockImplementation();
-        // Commander wraps action errors
+        const { restore } = captureLogs();
         await runCommand('whoami').catch(() => { });
         expect(exitSpy).toHaveBeenCalledWith(1);
         exitSpy.mockRestore();
-        errSpy.mockRestore();
-    });
-    it('handles API errors gracefully', async () => {
-        mockLoadConfig.mockReturnValue({ apiKey: 'key', apiUrl: 'http://test' });
-        mockFetch.mockRejectedValue(new Error('Connection refused'));
-        const spy = jest.spyOn(console, 'log').mockImplementation();
-        await runCommand('whoami');
-        spy.mockRestore();
+        restore();
     });
 });