import {  AuthAdministrativeScopes,  AuthSessionId,  AuthStandardClientScopes,} from "@t3tools/contracts";import { resolveWorktreeT3Home } from "@t3tools/shared/devHome";import * as Console from "effect/Console";import * as Effect from "effect/Effect";import * as Layer from "effect/Layer";import * as Option from "effect/Option";import * as Path from "effect/Path";import * as References from "effect/References";import * as Schema from "effect/Schema";import { Argument, Command, Flag, GlobalFlag } from "effect/unstable/cli"; import * as EnvironmentAuth from "../auth/EnvironmentAuth.ts"; import {  formatIssuedPairingCredential,  formatIssuedSession,  formatPairingCredentialList,  formatSessionList,} from "../cliAuthFormat.ts";import * as ServerConfig from "../config.ts";import {  isPersistedServerRuntimeStateLive,  type PersistedServerRuntimeState,  readPersistedServerRuntimeState,} from "../serverRuntimeState.ts";import {  authLocationFlags,  type CliAuthLocationFlags,  DurationFromString,  resolveCliAuthConfig,} from "./config.ts"; class NoRunningServerError extends Schema.TaggedErrorClass<NoRunningServerError>()(  "NoRunningServerError",  { baseDir: Schema.String },) {  override get message(): string {    return [      `No running T3 Code server was found under ${this.baseDir}.`,      "Start one with `bun run dev`, or point at another directory with --base-dir.",    ].join("\n");  }} const environmentAuthLayer = (config: ServerConfig.ServerConfig["Service"], quietLogs: boolean) =>  EnvironmentAuth.runtimeLayer.pipe(    Layer.provide(ServerConfig.layer(config)),    Layer.provide(Layer.succeed(References.MinimumLogLevel, quietLogs ? "Error" : config.logLevel)),  ); const runWithEnvironmentAuth = <A, E>(  flags: CliAuthLocationFlags,  run: (environmentAuth: EnvironmentAuth.EnvironmentAuth["Service"]) => Effect.Effect<A, E>,  options?: {    readonly quietLogs?: boolean;  },) =>  Effect.gen(function* () {    const logLevel = yield* GlobalFlag.LogLevel;    const config = yield* resolveCliAuthConfig(flags, logLevel);    return yield* Effect.gen(function* () {      const environmentAuth = yield* EnvironmentAuth.EnvironmentAuth;      return yield* run(environmentAuth);    }).pipe(Effect.provide(environmentAuthLayer(config, options?.quietLogs ?? false)));  }); const ttlFlag = Flag.string("ttl").pipe(  Flag.withSchema(DurationFromString),  Flag.withDescription("TTL, for example `5m`, `1h`, `30d`, or `15 minutes`."),  Flag.optional,); const jsonFlag = Flag.boolean("json").pipe(  Flag.withDescription("Emit JSON instead of human-readable output."),  Flag.withDefault(false),); const labelFlag = Flag.string("label").pipe(  Flag.withDescription("Optional human-readable label."),  Flag.optional,); const subjectFlag = Flag.string("subject").pipe(  Flag.withDescription("Optional session subject."),  Flag.optional,); const baseUrlFlag = Flag.string("base-url").pipe(  Flag.withDescription("Optional public base URL used to print a ready `/pair#token=...` link."),  Flag.optional,); const tokenOnlyFlag = Flag.boolean("token-only").pipe(  Flag.withDescription("Print only the issued bearer token."),  Flag.withDefault(false),); const pairingCreateCommand = Command.make("create", {  ...authLocationFlags,  ttl: ttlFlag,  label: labelFlag,  baseUrl: baseUrlFlag,  json: jsonFlag,}).pipe(  Command.withDescription("Issue a new client pairing token."),  Command.withHandler((flags) =>    runWithEnvironmentAuth(      flags,      (environmentAuth) =>        Effect.gen(function* () {          const issued = yield* environmentAuth.createPairingLink({            scopes: AuthStandardClientScopes,            subject: "one-time-token",            ...(Option.isSome(flags.ttl) ? { ttl: flags.ttl.value } : {}),            ...(Option.isSome(flags.label) ? { label: flags.label.value } : {}),          });          const output = formatIssuedPairingCredential(issued, {            json: flags.json,            ...(Option.isSome(flags.baseUrl) ? { baseUrl: flags.baseUrl.value } : {}),          });          yield* Console.log(output);        }),      {        quietLogs: flags.json,      },    ),  ),); /** * The state directory is `<base>/dev` for an implicit dev home and * `<base>/userdata` otherwise — a split that depends on flags the caller of * this command should not have to reason about, and which silently mints * tokens into a database the running server never reads when guessed wrong. * So check both, and let the live server decide which one is right. */export const findLiveServerRuntimeState = Effect.fn("auth.findLiveServerRuntimeState")(function* (  config: Pick<ServerConfig.ServerConfig["Service"], "baseDir" | "serverRuntimeStatePath">,) {  const path = yield* Path.Path;  const candidatePaths = [    ...new Set([      config.serverRuntimeStatePath,      ...(["dev", "userdata"] as const).map((stateDir) =>        path.join(config.baseDir, stateDir, "server-runtime.json"),      ),    ]),  ];   const live: Array<{    readonly stateDir: string;    readonly state: PersistedServerRuntimeState;  }> = [];   for (const statePath of candidatePaths) {    const state = yield* readPersistedServerRuntimeState(statePath);    if (Option.isNone(state)) {      continue;    }    // A file left behind by a killed or crashed server describes a port    // nothing is listening on. Minting against it produces a token the live    // server rejects with `invalid_credential`.    if (yield* isPersistedServerRuntimeStateLive(state.value)) {      live.push({ stateDir: path.dirname(statePath), state: state.value });    }  }   // `devUrl` is only recorded by a server fronted by a web dev server, so it  // distinguishes the dev instance from a production-style one when both are  // running under the same base directory. Older runtime-state files predate  // that field, but an implicit dev server still lives in `<base>/dev`, which is  // enough to prefer it over a production-style `<base>/userdata` server.  const devStateDir = path.join(config.baseDir, "dev");  return Option.fromNullishOr(    live.find((candidate) => candidate.state.devUrl !== undefined) ??      live.find((candidate) => candidate.stateDir === devStateDir) ??      live[0],  );}); /** * `t3 auth pairing url` — print a ready-to-open pairing link for a dev server * that is already running, without having to know its port, its state * directory, or which of those two the `--base-dir`/`--dev-url` combination * happens to select. The running server records all of it in * `server-runtime.json`; this reads that back. * * The startup link printed in the server's own log is usually enough. This is * for when it has been consumed, scrolled away, or the log isn't at hand. */const pairingUrlCommand = Command.make("url", {  ...authLocationFlags,  ttl: ttlFlag,  json: jsonFlag,}).pipe(  Command.withDescription(    "Print a pairing URL for the dev server running against this data directory.",  ),  Command.withHandler((flags) =>    Effect.gen(function* () {      const logLevel = yield* GlobalFlag.LogLevel;      // Run from a worktree, this command means "the dev server I just started      // here" — which the dev runner puts in the worktree's own `.t3`. Falling      // through to the shared home would mint a credential into the database      // the user's installed T3 Code is running against.      const worktreeBaseDir = yield* resolveWorktreeT3Home(process.cwd());      const resolvedFlags =        Option.isSome(flags.baseDir) || worktreeBaseDir === undefined          ? flags          : { ...flags, baseDir: Option.some(worktreeBaseDir) };      const config = yield* resolveCliAuthConfig(resolvedFlags, logLevel);      // Quieted here rather than only around the issuing layer below: probing      // reads both state directories, and a corrupt file in the one *not* in      // use logs a Warn to stdout — ahead of the payload, breaking `--json`      // for any consumer piping it. The warning is about a file the command      // then ignores, so under --json it is noise either way.      const live = yield* findLiveServerRuntimeState(config).pipe(        Effect.provide(          Layer.succeed(References.MinimumLogLevel, flags.json ? "Error" : config.logLevel),        ),      );       if (Option.isNone(live)) {        return yield* new NoRunningServerError({ baseDir: config.baseDir });      }       // Issue against the same state directory the server is using, whichever      // of the two it turned out to be.      const derivedPaths = yield* ServerConfig.deriveServerPaths(config.baseDir, config.devUrl, {        stateDir: live.value.stateDir,      });       // Prefer the web origin the user actually opens; a server with no dev URL      // serves the app itself, so its own origin is the right target.      const baseUrl = live.value.state.devUrl ?? live.value.state.origin;       return yield* Effect.gen(function* () {        const environmentAuth = yield* EnvironmentAuth.EnvironmentAuth;        const issued = yield* environmentAuth.createPairingLink({          scopes: AuthStandardClientScopes,          subject: "one-time-token",          ...(Option.isSome(flags.ttl) ? { ttl: flags.ttl.value } : {}),          label: "cli-issued pairing url",        });        yield* Console.log(formatIssuedPairingCredential(issued, { json: flags.json, baseUrl }));      }).pipe(Effect.provide(environmentAuthLayer({ ...config, ...derivedPaths }, flags.json)));    }),  ),); const pairingListCommand = Command.make("list", {  ...authLocationFlags,  json: jsonFlag,}).pipe(  Command.withDescription("List active client pairing tokens without revealing their secrets."),  Command.withHandler((flags) =>    runWithEnvironmentAuth(      flags,      (environmentAuth) =>        Effect.gen(function* () {          const pairingLinks = yield* environmentAuth.listPairingLinks({            excludeSubjects: [EnvironmentAuth.INTERNAL_ADMINISTRATIVE_BOOTSTRAP_SUBJECT],          });          yield* Console.log(formatPairingCredentialList(pairingLinks, { json: flags.json }));        }),      {        quietLogs: flags.json,      },    ),  ),); const pairingRevokeCommand = Command.make("revoke", {  ...authLocationFlags,  id: Argument.string("id").pipe(Argument.withDescription("Pairing credential id to revoke.")),}).pipe(  Command.withDescription("Revoke an active client pairing token."),  Command.withHandler((flags) =>    runWithEnvironmentAuth(flags, (environmentAuth) =>      Effect.gen(function* () {        const revoked = yield* environmentAuth.revokePairingLink(flags.id);        yield* Console.log(          revoked            ? `Revoked pairing credential ${flags.id}.\n`            : `No active pairing credential found for ${flags.id}.\n`,        );      }),    ),  ),); const pairingCommand = Command.make("pairing").pipe(  Command.withDescription("Manage one-time client pairing tokens."),  Command.withSubcommands([    pairingCreateCommand,    pairingUrlCommand,    pairingListCommand,    pairingRevokeCommand,  ]),); const sessionIssueCommand = Command.make("issue", {  ...authLocationFlags,  ttl: ttlFlag,  label: labelFlag,  subject: subjectFlag,  tokenOnly: tokenOnlyFlag,  json: jsonFlag,}).pipe(  Command.withDescription("Issue a scoped bearer access token for headless or remote clients."),  Command.withHandler((flags) =>    runWithEnvironmentAuth(      flags,      (environmentAuth) =>        Effect.gen(function* () {          const issued = yield* environmentAuth.issueSession({            scopes: AuthAdministrativeScopes,            ...(Option.isSome(flags.ttl) ? { ttl: flags.ttl.value } : {}),            ...(Option.isSome(flags.label) ? { label: flags.label.value } : {}),            ...(Option.isSome(flags.subject) ? { subject: flags.subject.value } : {}),          });          yield* Console.log(            formatIssuedSession(issued, {              json: flags.json,              tokenOnly: flags.tokenOnly,            }),          );        }),      {        quietLogs: flags.json || flags.tokenOnly,      },    ),  ),); const sessionListCommand = Command.make("list", {  ...authLocationFlags,  json: jsonFlag,}).pipe(  Command.withDescription("List active sessions without revealing bearer tokens."),  Command.withHandler((flags) =>    runWithEnvironmentAuth(      flags,      (environmentAuth) =>        Effect.gen(function* () {          const sessions = yield* environmentAuth.listSessions();          yield* Console.log(formatSessionList(sessions, { json: flags.json }));        }),      {        quietLogs: flags.json,      },    ),  ),); const sessionRevokeCommand = Command.make("revoke", {  ...authLocationFlags,  sessionId: Argument.string("session-id").pipe(    Argument.withDescription("Session id to revoke."),    Argument.withSchema(AuthSessionId),  ),}).pipe(  Command.withDescription("Revoke an active session."),  Command.withHandler((flags) =>    runWithEnvironmentAuth(flags, (environmentAuth) =>      Effect.gen(function* () {        const revoked = yield* environmentAuth.revokeSession(flags.sessionId);        yield* Console.log(          revoked            ? `Revoked session ${flags.sessionId}.\n`            : `No active session found for ${flags.sessionId}.\n`,        );      }),    ),  ),); const sessionCommand = Command.make("session").pipe(  Command.withDescription("Manage bearer sessions."),  Command.withSubcommands([sessionIssueCommand, sessionListCommand, sessionRevokeCommand]),); export const authCommand = Command.make("auth").pipe(  Command.withDescription("Manage the local auth control plane for headless deployments."),  Command.withSubcommands([pairingCommand, sessionCommand]),);