vkusvill 0.0.0-dev.0 → 0.0.0-dev.1

package/src/auth.js

@@ -0,0 +1,457 @@
+// Signing in to VkusVill: OAuth 2.0 authorization code + PKCE, refresh, revocation.
+//
+// VkusVill has no dynamic client registration: every user registers a personal client
+// (vkusvill.ru/oauth/registration/) and gets its credentials by email. So the client id comes
+// from the user once, and is kept next to the tokens.
+//
+// - The authorization server is discovered from the MCP server (RFC 9728 → RFC 8414) and must be
+//   an https VkusVill host; nothing is ever sent elsewhere.
+// - The code comes back to a one-shot loopback listener on 127.0.0.1, or is pasted by hand
+//   (for clients registered without a redirect URI).
+// - Access tokens live 24 h. Refresh tokens rotate on every use and reusing an old one revokes the
+//   whole chain, so refreshes are serialised across processes (the TUI and `vv` in another
+//   terminal) with a lock file, and the token file is re-read under the lock.
+// - The client secret and the tokens go to the OS credential store (secrets.js): the macOS Keychain
+//   or the Linux Secret Service. auth.json (owner-only) keeps the rest and a revision number, so
+//   other processes know when to read the store again. Without a store, the secrets stay in auth.json.
+
+import { createHash, randomBytes } from "node:crypto";
+import http from "node:http";
+import { mkdirSync, openSync, closeSync, readFileSync, writeFileSync, renameSync, unlinkSync, statSync, chmodSync } from "node:fs";
+import path from "node:path";
+import { CONFIG_DIR } from "./paths.js";
+import * as secrets from "./secrets.js";
+
+// What VkusVill's registration form assigns when "my service has no public URI" is ticked
+export const DEFAULT_REDIRECT = "http://localhost:3000/callback";
+export const REGISTRATION_URL = "https://vkusvill.ru/oauth/registration/";
+const MCP_ORIGIN = "https://mcp.vkusvill.ru";
+const FILE = path.join(CONFIG_DIR, "auth.json");
+const LOCK = path.join(CONFIG_DIR, "auth.lock");
+const EARLY = 120e3;          // refresh this long before expiry
+const LOGIN_TIMEOUT = 5 * 60e3;
+
+// Known-good metadata, used when discovery is unreachable
+const FALLBACK = {
+  issuer: "https://oauth.vkusvill.ru/",
+  authorization_endpoint: "https://oauth.vkusvill.ru/oauth2/auth",
+  token_endpoint: "https://oauth.vkusvill.ru/oauth2/token",
+  revocation_endpoint: "https://oauth.vkusvill.ru/oauth2/revoke",
+  scopes: ["catalog.search", "purchase_history.read", "discounts.view", "recommendations.personalized"],
+};
+
+// Rights a client can be given, named as in VkusVill's registration form
+export const SCOPE_LABELS = {
+  "catalog.search": "Каталог: поиск с учётом адреса и рекомендаций",
+  "purchase_history.read": "История покупок",
+  "discounts.view": "Лояльность и скидки",
+  "recommendations.personalized": "Персональные рекомендации",
+  offline_access: "Продление входа",
+};
+export const scopeLabel = (s) => SCOPE_LABELS[s] ?? s;
+
+export class AuthError extends Error {
+  constructor(message, code) { super(message); this.code = code; }
+}
+
+const b64url = (buf) => buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+const isVkusvillHttps = (u) => { try { const x = new URL(u); return x.protocol === "https:" && (x.hostname === "vkusvill.ru" || x.hostname.endsWith(".vkusvill.ru")); } catch { return false; } };
+
+// ——— Discovery ———
+
+let metaOverride = null;
+let metaCache = null;
+
+// For tests only: point the flow at a local mock server
+export function _setMetadataForTests(meta) { metaOverride = meta; metaCache = null; }
+
+async function getJSON(url) {
+  const res = await fetch(url, { signal: AbortSignal.timeout(10e3), headers: { Accept: "application/json" } });
+  if (!res.ok) throw new Error(`${res.status}`);
+  return res.json();
+}
+
+export async function metadata() {
+  if (metaOverride) return metaOverride;
+  if (metaCache) return metaCache;
+  try {
+    const pr = await getJSON(`${MCP_ORIGIN}/.well-known/oauth-protected-resource`);
+    const issuer = pr.authorization_servers?.[0];
+    if (!isVkusvillHttps(issuer)) throw new Error("issuer");
+    const as = await getJSON(new URL(".well-known/oauth-authorization-server", issuer.endsWith("/") ? issuer : issuer + "/"));
+    const endpoints = [as.authorization_endpoint, as.token_endpoint, as.revocation_endpoint].filter(Boolean);
+    if (as.issuer !== issuer || !endpoints.every(isVkusvillHttps)) throw new Error("metadata");
+    metaCache = { ...as, scopes: Array.isArray(pr.scopes_supported) ? pr.scopes_supported : FALLBACK.scopes };
+  } catch {
+    metaCache = FALLBACK;
+  }
+  return metaCache;
+}
+
+// ——— Storage ———
+
+const SECRET_FIELDS = ["clientSecret", "accessToken", "refreshToken"];
+let vaultMemo = null; // { rev, data }: the store is asked again only when auth.json changes
+
+export function read() {
+  let r;
+  try { r = JSON.parse(readFileSync(FILE, "utf8")); } catch { return null; }
+  if (!r || typeof r !== "object" || typeof r.clientId !== "string") return null;
+  if (r.secrets !== "store") {
+    // A file from before the store existed: move its secrets over once. A file marked "file" already
+    // tried; the next write (sign-in, refresh) tries the store again, so a store set up later is picked up
+    if (r.secrets === undefined && SECRET_FIELDS.some((k) => r[k])) { const moved = write(r); if (moved.secrets === "store") return { ...moved, ...pickSecrets(r) }; }
+    return r;
+  }
+  if (vaultMemo?.rev !== r.rev) vaultMemo = { rev: r.rev, data: secrets.load() ?? {} };
+  return { ...r, ...pickSecrets(vaultMemo.data) };
+}
+
+const pickSecrets = (o) => Object.fromEntries(SECRET_FIELDS.map((k) => [k, o?.[k] ?? null]));
+
+// Writes metadata to auth.json and the secrets to the store when it takes them; returns what is in the file
+function write(rec) {
+  memo = null;
+  const meta = Object.fromEntries(Object.entries(rec).filter(([k]) => !SECRET_FIELDS.includes(k) && k !== "secrets" && k !== "rev"));
+  const rev = `${Date.now().toString(36)}.${randomBytes(4).toString("hex")}`;
+  const secretPart = pickSecrets(rec);
+  let file;
+  if (secrets.save(secretPart)) {
+    file = { ...meta, secrets: "store", rev };
+    vaultMemo = { rev, data: secretPart };
+  } else {
+    file = { ...meta, ...secretPart, secrets: "file" };
+  }
+  mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
+  const tmp = `${FILE}.${process.pid}.tmp`;
+  writeFileSync(tmp, JSON.stringify(file, null, 2), { mode: 0o600 });
+  renameSync(tmp, FILE);
+  try { chmodSync(FILE, 0o600); chmodSync(CONFIG_DIR, 0o700); } catch {}
+  return file;
+}
+
+// Cross-process lock: exclusive create; a lock older than 30 s is left over from a crash
+async function withLock(fn) {
+  mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
+  const deadline = Date.now() + 15e3;
+  for (;;) {
+    try {
+      closeSync(openSync(LOCK, "wx", 0o600));
+      break;
+    } catch (e) {
+      if (e.code !== "EEXIST") throw e;
+      try { if (Date.now() - statSync(LOCK).mtimeMs > 30e3) unlinkSync(LOCK); } catch {}
+      if (Date.now() > deadline) throw new AuthError("Вход занят другим процессом vkusvill", "lock");
+      await new Promise((r) => setTimeout(r, 150));
+    }
+  }
+  try { return await fn(); } finally { try { unlinkSync(LOCK); } catch {} }
+}
+
+// ——— Token endpoint ———
+
+async function tokenRequest(meta, rec, params) {
+  const body = new URLSearchParams({ ...params, client_id: rec.clientId });
+  if (rec.clientSecret) body.set("client_secret", rec.clientSecret);
+  let res;
+  try {
+    res = await fetch(meta.token_endpoint, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json" },
+      body,
+      signal: AbortSignal.timeout(20e3),
+      // A redirect would resend the client secret to wherever it points
+      redirect: "error",
+    });
+  } catch {
+    throw new AuthError("Нет связи с сервером входа ВкусВилла", "net");
+  }
+  let data = {};
+  try { data = await res.json(); } catch {}
+  if (!res.ok || !data.access_token) {
+    const code = typeof data.error === "string" ? data.error : `http_${res.status}`;
+    throw new AuthError(describe(code), code);
+  }
+  return data;
+}
+
+function describe(code) {
+  return {
+    invalid_grant: "Вход истёк — войдите заново",
+    invalid_client: "ВкусВилл не узнал клиента — проверьте client_id и секрет",
+    unauthorized_client: "Клиенту не разрешён этот способ входа",
+    invalid_scope: "Клиенту не выданы запрошенные права",
+    access_denied: "Вход отменён",
+  }[code] ?? `Сервер входа ответил: ${code}`;
+}
+
+// `fresh`: a new sign-in replaces the whole grant; a refresh without a new refresh token keeps the old one
+function store(rec, data, { fresh = false } = {}) {
+  const out = {
+    ...rec,
+    accessToken: data.access_token,
+    refreshToken: data.refresh_token ?? (fresh ? null : rec.refreshToken ?? null),
+    expiresAt: Date.now() + (Number(data.expires_in) > 0 ? Number(data.expires_in) * 1000 : 24 * 3600e3),
+    scope: typeof data.scope === "string" ? data.scope : rec.scope ?? "",
+  };
+  write(out);
+  return out;
+}
+
+// ——— Public API ———
+
+// For the UI, which asks on every frame: re-read at most once a second (other processes may sign in)
+let memo = null;
+export function cachedStatus() {
+  if (!memo || Date.now() - memo.at > 1000) memo = { at: Date.now(), value: status() };
+  return memo.value;
+}
+
+export function status() {
+  if (process.env.VV_TOKEN) return { signedIn: true, viaEnv: true };
+  const rec = read();
+  if (!rec) return { signedIn: false, configured: false };
+  const live = !!rec.accessToken && rec.expiresAt > Date.now();
+  return {
+    signedIn: live || !!rec.refreshToken,
+    configured: true,
+    clientId: rec.clientId,
+    expiresAt: rec.expiresAt ?? null,
+    refreshable: !!rec.refreshToken,
+    scope: rec.scope ?? "",
+    storage: rec.secrets === "store" ? secrets.storageLabel() : "файл auth.json (только для вас)",
+    storageHint: rec.secrets === "store" ? null : secrets.fileHint(),
+    granted: granted(rec),
+  };
+}
+
+// Scopes the current token was granted; null when unknown (a ready-made VV_TOKEN, or not said)
+export function granted(rec = read()) {
+  if (process.env.VV_TOKEN || !rec?.accessToken && !rec?.refreshToken) return null;
+  const s = (rec.scope ?? "").trim();
+  return s ? s.split(/\s+/) : null;
+}
+
+// Whether the signed-in token may use `scope`; unknown grants are given the benefit of the doubt
+export function allows(scope) {
+  const g = granted();
+  return !g || g.includes(scope);
+}
+
+// Saves (or replaces) the client the user registered at VkusVill; signs out of the previous one
+export function setClient({ clientId, clientSecret, redirectUri, scopes }) {
+  if (!/^[\w.:-]{4,200}$/.test(clientId ?? "")) throw new AuthError("client_id выглядит неправильно", "input");
+  const prev = read();
+  const same = prev?.clientId === clientId;
+  write({
+    v: 1,
+    clientId,
+    clientSecret: clientSecret || (same ? prev.clientSecret : null) || null,
+    redirectUri: redirectUri || (same ? prev.redirectUri : null) || DEFAULT_REDIRECT,
+    // Scopes to ask for; null means everything the server offers, trimmed on the first refusal
+    scopes: scopes !== undefined ? scopes : same ? prev.scopes ?? null : null,
+    ...(same ? { accessToken: prev.accessToken, refreshToken: prev.refreshToken, expiresAt: prev.expiresAt, scope: prev.scope } : {}),
+  });
+}
+
+let inflight = null;
+
+// A valid access token, refreshed if needed; null when not signed in
+export async function accessToken() {
+  if (process.env.VV_TOKEN) return process.env.VV_TOKEN;
+  const rec = read();
+  if (!rec?.accessToken && !rec?.refreshToken) return null;
+  if (rec.accessToken && rec.expiresAt - EARLY > Date.now()) return rec.accessToken;
+  if (!rec.refreshToken) return null;
+  return refresh();
+}
+
+// `rejected` is a token the server just refused: refresh even if it looks fresh,
+// unless another process has already replaced it
+export function refresh({ rejected } = {}) {
+  inflight ??= withLock(async () => {
+    const rec = read();
+    if (!rec?.refreshToken) throw new AuthError("Вход истёк — войдите заново", "invalid_grant");
+    const fresh = rec.accessToken && rec.expiresAt - EARLY > Date.now();
+    if (fresh && rec.accessToken !== rejected) return rec.accessToken;
+    const meta = await metadata();
+    try {
+      return store(rec, await tokenRequest(meta, rec, { grant_type: "refresh_token", refresh_token: rec.refreshToken })).accessToken;
+    } catch (e) {
+      // A dead refresh token stays dead: forget the tokens, keep the client for the next sign-in
+      if (e.code === "invalid_grant" || e.code === "invalid_client") write({ ...rec, accessToken: null, refreshToken: null, expiresAt: null });
+      throw e;
+    }
+  }).finally(() => { inflight = null; });
+  return inflight;
+}
+
+// Parses what the user pasted: the whole redirect URL, a query string, or the bare code
+export function parsePasted(text, state) {
+  const t = String(text).trim();
+  let params;
+  try { params = new URL(t).searchParams; } catch { params = new URLSearchParams(t.includes("=") ? t.replace(/^[?#]/, "") : `code=${t}`); }
+  if (params.get("error")) return { error: params.get("error"), description: params.get("error_description") ?? "" };
+  if (params.get("state") && params.get("state") !== state) return { error: "state_mismatch" };
+  const code = params.get("code");
+  return code ? { code } : null;
+}
+
+const PAGE = (title, text) => `<!doctype html><meta charset="utf-8"><title>${title}</title>
+<style>body{font:18px/1.5 system-ui,sans-serif;background:#0b130e;color:#e4eee6;display:grid;place-items:center;height:100vh;margin:0}
+main{max-width:28rem;padding:2rem;text-align:center}b{color:#b5e853}</style><main><b>ВкусВилл в терминале</b><h1>${title}</h1><p>${text}</p></main>`;
+
+// One-shot loopback listener for the redirect; resolves with { code } or { error }.
+// "localhost" is served on both 127.0.0.1 and ::1: browsers may try either.
+function listen(redirectUri, state, signal) {
+  const u = new URL(redirectUri);
+  const hosts = u.hostname === "localhost" ? ["127.0.0.1", "::1"] : [u.hostname.replace(/^\[|\]$/g, "")];
+  const port = Number(u.port) || 80;
+  return new Promise((resolve, reject) => {
+    const servers = [];
+    let listening = 0, failed = 0, lastError = null;
+    const closeAll = () => servers.forEach((s) => s.close());
+    const handler = (req, res) => {
+      const url = new URL(req.url, redirectUri);
+      if (req.method !== "GET" || url.pathname !== u.pathname) { res.writeHead(404).end(); return; }
+      const got = parsePasted(url.href, state);
+      if (!got) { res.writeHead(400).end(); return; }
+      const ok = !!got.code;
+      res.writeHead(ok || got.error === "invalid_scope" ? 200 : 400, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store" });
+      res.end(ok ? PAGE("Готово", "Можно закрыть вкладку и вернуться в терминал.")
+        : got.error === "invalid_scope" ? PAGE("Ещё секунду", "Уточняю права клиента — откроется ещё одна вкладка. Эту можно закрыть.")
+        : PAGE("Вход не удался", "Вернитесь в терминал — там подробности."));
+      closeAll();
+      resolve(got);
+    };
+    for (const host of hosts) {
+      const server = http.createServer(handler);
+      servers.push(server);
+      server.on("listening", () => { listening++; });
+      // A missing address family (no IPv6) is fine while another one listens. A taken port is not:
+      // half-listening would let whatever holds the other half (a dev server on :3000) receive the code
+      server.on("error", (e) => {
+        failed++;
+        lastError = e;
+        const fatal = e.code === "EADDRINUSE" || e.code === "EACCES";
+        if (fatal || (failed === hosts.length && !listening)) {
+          closeAll();
+          reject(new AuthError(e.code === "EADDRINUSE" ? `Порт ${port} занят другой программой`
+            : e.code === "EACCES" ? `Порт ${port} нельзя занять без прав администратора` : lastError.message, "listen"));
+        }
+      });
+      server.listen(port, host);
+    }
+    signal?.addEventListener("abort", closeAll);
+  });
+}
+
+const isLoopback = (uri) => { try { const u = new URL(uri); return u.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(u.hostname); } catch { return false; } };
+
+// Full sign-in. `open(url)` shows the authorization page; `paste()` (optional) resolves with text
+// the user pasted; `notice(text)` reports that the loopback receiver is unavailable. Retries once without offline_access if the client may not have refresh tokens.
+// Hydra names the refused scope: …not allowed to request scope "purchase_history.read".
+// A quoted name wins; otherwise any requested scope the description mentions.
+function refusedScope(description, wanted) {
+  const d = description ?? "";
+  const quoted = /scope\s+["'“«]([\w.:-]+)["'”»]/i.exec(d)?.[1];
+  if (quoted && wanted.includes(quoted)) return quoted;
+  return wanted.find((s) => new RegExp(`(^|[^\\w.])${s.replace(/\./g, "\\.")}([^\\w.]|$)`).test(d)) ?? null;
+}
+
+export async function login({ open, paste, signal, scope, notice = () => {} } = {}) {
+  const rec = read();
+  if (!rec?.clientId) throw new AuthError("Сначала укажите client_id своего клиента ВкусВилла", "no_client");
+  const meta = await metadata();
+  // Rights differ per client: start from what was asked last time (or everything) and drop
+  // each scope the server refuses, so a client with fewer boxes ticked still signs in
+  let wanted = scope ? scope.split(/\s+/) : ["offline_access", ...(rec.scopes ?? meta.scopes)];
+  for (let attempt = 0; attempt <= wanted.length + 1; attempt++) {
+    const verifier = b64url(randomBytes(48));
+    const state = b64url(randomBytes(16));
+    const auth = new URL(meta.authorization_endpoint);
+    auth.search = new URLSearchParams({
+      response_type: "code",
+      client_id: rec.clientId,
+      redirect_uri: rec.redirectUri,
+      scope: wanted.join(" "),
+      state,
+      code_challenge: b64url(createHash("sha256").update(verifier).digest()),
+      code_challenge_method: "S256",
+    }).toString();
+
+    const ctl = new AbortController();
+    const stop = () => ctl.abort();
+    signal?.addEventListener("abort", stop);
+    // Losers of the race reject after the abort below; mark them handled
+    const waiters = [];
+    const wait = (p) => { p.catch(() => {}); waiters.push(p); };
+    // If the port can't be taken, a paste still finishes the sign-in
+    if (isLoopback(rec.redirectUri)) {
+      wait(listen(rec.redirectUri, state, ctl.signal).catch((e) => {
+        if (!paste) throw e;
+        notice(`${e.message} — после входа вставьте адрес из строки браузера`);
+        return new Promise(() => {});
+      }));
+    }
+    if (paste) wait(paste(ctl.signal).then((text) => parsePasted(text, state) ?? { error: "no_code" }));
+    if (!waiters.length) throw new AuthError("Redirect URI не локальный — нужна вставка ссылки", "no_receiver");
+    wait(new Promise((_, reject) => {
+      const t = setTimeout(() => reject(new AuthError("Не дождался входа за 5 минут", "timeout")), LOGIN_TIMEOUT);
+      ctl.signal.addEventListener("abort", () => { clearTimeout(t); reject(new AuthError("Вход отменён", "access_denied")); });
+    }));
+    open(auth.href);
+    let got;
+    try { got = await Promise.race(waiters); } finally { ctl.abort(); signal?.removeEventListener("abort", stop); }
+
+    if (got.error === "invalid_scope") {
+      const refused = refusedScope(got.description, wanted);
+      // Unnamed refusal: refresh rights are the usual suspect, then give up
+      const drop = refused && wanted.includes(refused) ? refused : wanted.includes("offline_access") ? "offline_access" : null;
+      if (!drop) throw new AuthError(describe("invalid_scope"), "invalid_scope");
+      wanted = wanted.filter((s) => s !== drop);
+      if (!wanted.some((s) => s !== "offline_access")) throw new AuthError("Клиенту не выдано ни одного права — отметьте действия в настройках клиента на vkusvill.ru", "invalid_scope");
+      notice(`Клиенту не выдано «${scopeLabel(drop)}» — продолжаю без этого`);
+      continue;
+    }
+    if (got.error) throw new AuthError(got.error === "state_mismatch" ? "Ответ не от этой попытки входа" : describe(got.error), got.error);
+    const data = await tokenRequest(meta, rec, { grant_type: "authorization_code", code: got.code, redirect_uri: rec.redirectUri, code_verifier: verifier });
+    const scopes = wanted.filter((s) => s !== "offline_access");
+    // The server says what it granted; without that, assume what was asked
+    if (typeof data.scope !== "string") data.scope = wanted.join(" ");
+    return withLock(async () => store({ ...(read() ?? rec), scopes }, data, { fresh: true }));
+  }
+  throw new AuthError(describe("invalid_scope"), "invalid_scope");
+}
+
+// Signs out and removes every trace of the client: tokens, secret, auth.json
+export async function forget() {
+  const r = await logout().catch(() => null);
+  secrets.remove();
+  vaultMemo = null;
+  memo = null;
+  try { unlinkSync(FILE); } catch {}
+  return r;
+}
+
+// Revokes both tokens at VkusVill (best effort) and forgets them locally either way; the client stays.
+// Returns null when there was nothing to sign out of, otherwise { revoked } — whether VkusVill confirmed.
+export async function logout() {
+  const rec = read();
+  if (!rec?.accessToken && !rec?.refreshToken) return null;
+  const meta = await metadata();
+  let revoked = !!meta.revocation_endpoint;
+  if (meta.revocation_endpoint) {
+    for (const [token, hint] of [[rec.refreshToken, "refresh_token"], [rec.accessToken, "access_token"]]) {
+      if (!token) continue;
+      const body = new URLSearchParams({ token, token_type_hint: hint, client_id: rec.clientId });
+      if (rec.clientSecret) body.set("client_secret", rec.clientSecret);
+      try {
+        const res = await fetch(meta.revocation_endpoint, { method: "POST", headers: { "Content-Type": "application/x-www-form-urlencoded" }, body, signal: AbortSignal.timeout(10e3), redirect: "error" });
+        if (!res.ok) revoked = false;
+      } catch { revoked = false; }
+    }
+  }
+  write({ ...rec, accessToken: null, refreshToken: null, expiresAt: null, scope: "" });
+  return { revoked };
+}

package/src/cli.js

@@ -6,6 +6,9 @@ import { normalize, rub, compactNum, qtyText, lineTotal, plural } from "./produc
 import { store, CART_MAX, QTY_MAX } from "./store.js";
 import { padEnd, padStart } from "./term/width.js";
 import { openState } from "./views/shops.js";
+import * as auth from "./auth.js";
+import { openUrl } from "./sys.js";
+import { createInterface } from "node:readline";
 
 const color = process.stdout.isTTY && !process.env.NO_COLOR;
 const c = (code) => (s) => (color ? `\x1b[${code}m${s}\x1b[0m` : String(s));
@@ -14,15 +17,21 @@ const width = () => Math.min(process.stdout.columns || 100, 120);
 
 const out = (s = "") => process.stdout.write(s + "\n");
 
+// Stock at the signed-in user's address, when the answer carries it
+const stockText = (p) => (p.available == null ? null : p.available <= 0 ? "нет" : p.unit === "кг" ? `${+Number(p.available).toFixed(1)} кг` : `${p.available} шт`);
+
 function productTable(items) {
   const w = width();
-  const nameW = Math.max(20, w - 40);
-  for (const it of items) {
-    const p = normalize(it);
+  const ps = items.map(normalize);
+  const withStock = ps.some((p) => p.available != null);
+  const nameW = Math.max(20, w - 40 - (withStock ? 8 : 0));
+  for (const p of ps) {
     const price = p.old ? orange(padStart(rub(p.price), 9)) : bold(padStart(rub(p.price), 9));
     const off = p.off ? orange(padStart(`−${p.off}%`, 5)) : "     ";
     const rating = p.rating ? yellow("★") + padEnd(p.rating.toFixed(1).replace(".", ","), 4) : "     ";
-    out(`${dim(padStart(String(p.id), 7))}  ${padEnd(p.name, nameW)} ${rating} ${off} ${price}`);
+    const st = stockText(p);
+    const stock = withStock ? " " + (p.available > 0 ? green : red)(padStart(st ?? "", 7)) : "";
+    out(`${dim(padStart(String(p.id), 7))}  ${padEnd(p.name, nameW)} ${rating} ${off} ${price}${stock}`);
   }
 }
 
@@ -35,17 +44,38 @@ export async function search(q, { json, sort, page = 1 }) {
   if (d.meta?.has_more) out(dim(`  ещё: vv search ${q} --page ${page + 1}`));
 }
 
-export async function deals({ json, type }) {
+export async function deals({ json, type, personal }) {
+  if (personal) {
+    const d = await api.personalDiscounts();
+    if (json) return out(JSON.stringify(d, null, 2));
+    out(`${orange("%")} ${bold("6 скидок для меня")}`);
+    return productTable(d.products ?? d.items ?? []);
+  }
   const d = await api.discounts({ type });
   if (json) return out(JSON.stringify(d, null, 2));
   out(`${orange("%")} ${bold(type === "card" ? "Скидки по карте" : "Скидки от нескольких штук")} ${dim(`· ${d.meta?.total ?? 0}`)}`);
   productTable(d.items ?? []);
 }
 
+export async function orders({ json, page = 1 }) {
+  const d = await api.orders(page);
+  if (json) return out(JSON.stringify(d, null, 2));
+  const list = d.orders ?? d.items ?? [];
+  if (!list.length) return out(dim("Заказов за 30 дней нет"));
+  for (const o of list) {
+    const date = o.created_at ? new Date(o.created_at * (o.created_at < 1e12 ? 1000 : 1)).toLocaleDateString("ru-RU", { day: "numeric", month: "long" }) : "";
+    const sum = typeof o.price === "object" ? o.price?.price : o.price;
+    out(`${bold(`№ ${o.id_general ?? o.id}`)}  ${dim(`${date} · ${o.service ?? ""}`)}  ${o.status_name ?? ""}  ${lime(rub(sum))}`);
+    out(dim(`  ${(o.products ?? []).map((p) => p.name).join(" · ")}`));
+  }
+}
+
 function card(p) {
   out(bold(p.name));
   out(`${p.old ? orange(rub(p.price)) + " " + dim(`было ${rub(p.old)}`) : lime(rub(p.price))}${p.unit === "кг" ? dim(" за кг") : ""}  ${p.rating ? yellow("★ " + String(p.rating).replace(".", ",")) + dim(` · ${compactNum(p.votes)}`) : ""}`);
   if (p.offInfo) out(orange(p.offInfo));
+  const st = stockText(p);
+  if (st) out(p.available > 0 ? green(`● в наличии ${st}`) : red("○ нет в наличии"));
   if (p.kcal != null) out(`${dim("на 100 г")}  Б ${p.p ?? "—"} · Ж ${p.f ?? "—"} · У ${p.c ?? "—"} · ${lime(Math.round(p.kcal) + " ккал")}`);
   if (p.comp) out(`${dim("Состав:")} ${p.comp}`);
   out(dim(p.url));
@@ -150,10 +180,95 @@ export async function cart(args, { json }) {
     return;
   }
   if (json) return out(JSON.stringify(store.cart.map((l) => ({ id: l.p.id, name: l.p.name, q: l.q, price: l.p.price })), null, 2));
-  if (!store.cart.length) return out(dim("Корзина пуста — npx vkusvill-cli, чтобы набрать"));
+  if (!store.cart.length) return out(dim("Корзина пуста — npx vkusvill, чтобы набрать"));
   const nameW = Math.max(20, width() - 30);
   for (const l of store.cart) out(`${padEnd(l.p.name, nameW)} ${padStart(qtyText(l.p, l.q), 8)} ${bold(padStart(rub(lineTotal(l.p, l.q)), 10))}`);
   out(`${padEnd("Итого", nameW + 9)} ${lime(bold(padStart(rub(store.total), 10)))}`);
   out(dim("vv cart link — ссылка и QR-код"));
 }
 
+
+// ——— Sign-in ———
+
+// One line from the terminal; `hidden` does not echo (for the client secret)
+function ask(question, { hidden = false, signal } = {}) {
+  return new Promise((resolve, reject) => {
+    const rl = createInterface({ input: process.stdin, output: process.stdout, terminal: !!process.stdin.isTTY });
+    if (hidden) rl._writeToOutput = (s) => { if (s.includes(question)) process.stdout.write(s); };
+    signal?.addEventListener("abort", () => { rl.close(); reject(new Error("aborted")); });
+    rl.question(question, (answer) => { rl.close(); if (hidden) process.stdout.write("\n"); resolve(answer.trim()); });
+  });
+}
+
+const when = (t) => new Date(t).toLocaleString("ru-RU", { day: "numeric", month: "long", hour: "2-digit", minute: "2-digit" });
+
+export async function login({ clientId, clientSecret, redirect, scope, noBrowser }) {
+  const st = auth.status();
+  if (st.viaEnv) throw new Error("Задан VV_TOKEN — он важнее входа. Уберите его, чтобы войти");
+  if (clientId || !st.configured) {
+    if (!clientId) {
+      out(`Нужен персональный клиент ВкусВилла. Зарегистрируйте его: ${lime(auth.REGISTRATION_URL)}`);
+      out(dim(`  Отметьте «У моего сервиса нет публичного URI» — ВкусВилл подставит ${auth.DEFAULT_REDIRECT}, его и ловит vv login.`));
+      out(dim("  Данные клиента ВкусВилл пришлёт на почту."));
+      out();
+      clientId = await ask("client_id: ");
+      if (clientSecret === undefined) clientSecret = await ask("client_secret (если выдали; иначе Enter): ", { hidden: true });
+    }
+    auth.setClient({ clientId, clientSecret, redirectUri: redirect });
+  } else if (redirect || clientSecret) {
+    auth.setClient({ clientId: st.clientId, clientSecret, redirectUri: redirect });
+  }
+  // `--scope all` forgets the rights trimmed at earlier sign-ins; a list asks for exactly those
+  if (scope === "all") auth.setClient({ clientId: auth.read().clientId, scopes: null });
+  const rec = auth.read();
+  const loopback = /^http:\/\/(127\.0\.0\.1|localhost)[:/]/.test(rec.redirectUri);
+  const rec2 = await auth.login({
+    scope: scope && scope !== "all" ? scope : undefined,
+    notice: (text) => out(orange(text)),
+    open: (url) => {
+      out(`Страница входа ВкусВилла: ${dim(url)}`);
+      if (!noBrowser && openUrl(url)) out(dim("Открыл её в браузере."));
+      out(loopback ? dim("Жду подтверждения… Если браузер ушёл на адрес, который не открылся, вставьте его сюда и нажмите Enter.")
+        : "После входа скопируйте адрес из строки браузера и вставьте сюда:");
+    },
+    paste: (signal) => ask("> ", { signal }),
+  });
+  out(`${lime("✓")} Вход выполнен · до ${when(rec2.expiresAt)}${rec2.refreshToken ? dim(" · продлевается сам") : dim(" · без продления: через сутки vv login снова")}`);
+  printRights(rec2.scope);
+  process.exit(0); // stdin listeners from the race must not keep the process alive
+}
+
+// Granted rights in the words of VkusVill's registration form, and what is missing
+async function printRights(scope) {
+  const granted = (scope ?? "").split(/\s+/).filter(Boolean);
+  const all = (await auth.metadata()).scopes;
+  for (const s of all) out(`  ${granted.includes(s) ? lime("✓") : dim("·")} ${granted.includes(s) ? auth.scopeLabel(s) : dim(`${auth.scopeLabel(s)} — не выдано`)}`);
+  if (all.some((s) => !granted.includes(s))) out(dim("  Чтобы добавить: отметьте действие в настройках клиента на vkusvill.ru и vv login --scope all"));
+}
+
+export async function logout({ forget = false } = {}) {
+  if (forget) {
+    const had = auth.read();
+    const r = await auth.forget();
+    if (!had) return out(dim("Клиент и так не настроен"));
+    return out(`${lime("✓")} Клиент, секрет и токены стёрты${r && !r.revoked ? dim(" (ВкусВилл не подтвердил отзыв — доступ истечёт сам)") : ""}`);
+  }
+  const r = await auth.logout();
+  if (!r) return out(dim("Вход и так не выполнен"));
+  out(r.revoked ? `${lime("✓")} Вышли: токены отозваны у ВкусВилла и удалены`
+    : `${lime("✓")} Вышли: токены удалены с этого компьютера ${dim("(ВкусВилл не подтвердил отзыв — доступ истечёт сам)")}`);
+}
+
+export async function authStatus({ json }) {
+  const st = auth.status();
+  if (json) return out(JSON.stringify(st, null, 2));
+  if (st.viaEnv) return out("Вход: токен из VV_TOKEN");
+  if (!st.configured) return out(`Вход не настроен — ${lime("vv login")}`);
+  out(`Клиент: ${st.clientId}`);
+  out(`Секреты: ${st.storage}`);
+  if (st.storageHint) out(dim(`  ${st.storageHint}`));
+  if (!st.signedIn) return out(`Вход: истёк — ${lime("vv login")}`);
+  out(`Вход: до ${when(st.expiresAt)}${st.refreshable ? dim(" · продлевается сам") : ""}`);
+  out("Права:");
+  await printRights(st.scope);
+}