@facilio/cli 0.3.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Facilio
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,120 @@
+# @facilio/cli
+
+The unified Facilio CLI — one login for every Facilio product.
+
+```bash
+npm install -g @facilio/cli
+facilio login
+facilio vibe deploy
+facilio connections search create xero invoice
+```
+
+> Migrating from `@facilio/vibe-cli`? The `vibe` binary is gone; every command
+> now lives under `facilio vibe …` (e.g. `vibe deploy` → `facilio vibe deploy`).
+> Your existing login session is migrated automatically on first run.
+
+## Universal commands
+
+| Command | What it does |
+|---|---|
+| `facilio login` | Sign in via the OAuth2 device-authorization flow (RFC 8628). Works on laptops, over SSH, and inside containers — no local callback port needed. One session covers every product namespace. |
+| `facilio login --api-key <key>` | Non-interactive sign-in for CI. Pass `-` to read the key from stdin (keeps it out of shell history). Use `--region <key>` (US, UK, AE, AU, …; default US) so vibe + MCP URLs resolve correctly. API-key sessions cover `vibe` commands only. |
+| `facilio logout` | Revoke the token server-side (best-effort) and clear it locally. |
+| `facilio whoami` | Show the active session: user, server, auth source, token expiry. |
+| `facilio help [command]` | Help for any command or namespace. |
+
+## `facilio vibe` — build and deploy Vibe apps
+
+| Command | What it does |
+|---|---|
+| `facilio vibe deploy` | Zip `build.publish`, upload, wait for deployment to finish. `--prod` marks production. Build your app yourself first (e.g. `npm run build`). |
+| `facilio vibe app create` / `app list` | Create a new app (prompts for name/description/logo) / list apps in your org. |
+| `facilio vibe db create\|import\|tables\|describe` | Provision the app database, import CSVs as tables, inspect schema. |
+| `facilio vibe function create\|update\|list\|get\|delete\|build\|run` | Manage an app's ai-studio functions (compiled to WASM). |
+
+Project config stays in `vibe.json` at your project root — unchanged from the
+old CLI (`build.publish` points at your build output folder).
+
+## `facilio connections` — 1000+ integrated apps
+
+Backed by the Facilio Connections MCP server; the CLI sends your login token
+directly, so there is no separate sign-in.
+
+| Command | What it does |
+|---|---|
+| `facilio connections search <query…>` | Find actions by use case, e.g. `search create xero invoice`. |
+| `facilio connections schemas <slug…>` | Show an action's input JSON Schema (`--with-output` adds the output schema). |
+| `facilio connections list <connection…>` | Show your connected accounts for connections (e.g. `list xero`). |
+| `facilio connections link <connection>` | Authorize a connection — opens the target app's OAuth page. `--wait` blocks until ACTIVE. |
+| `facilio connections unlink <connection>` | Remove your authorization (prompts to confirm; `--yes` to skip). |
+| `facilio connections wait <connection…>` | Poll until connection(s) become ACTIVE (`--mode all`, `--timeout <s>`). |
+| `facilio connections execute <action_slug…> --params '<json>'` | Run one or more actions. `--get-schema` prints the input schema instead of running; `--dry-run` validates args against the schema and previews the request without executing; repeat `--params` once per slug to run several in parallel; `--params -` reads stdin; `--account <slug>` targets a connected account; `--file batch.json` runs a batch. |
+
+Every connections command accepts `--json` (raw payloads for scripts/agents),
+`--mcp-url <url>` (non-production servers), and `--app <slug>` (scope all
+calls to one connection).
+
+A typical first run:
+
+```bash
+facilio connections search create xero invoice   # discover action slugs
+facilio connections link xero --wait             # authorize Xero, wait for ACTIVE
+facilio connections schemas xero.create_invoice  # see required arguments
+facilio connections execute xero.create_invoice --params '{"contact_id":"…","amount":100}'
+```
+
+## How login works
+
+`facilio login` uses the OAuth2 device-authorization grant (RFC 8628) — the
+same model GitHub CLI, `gcloud`, and AWS SSO use. Credentials land in the OS
+secret store (macOS Keychain / Linux secret-service / Windows DPAPI), with a
+0600 file fallback at `~/.facilio/credentials.json`. Access tokens refresh
+automatically; concurrent invocations coordinate through a lock file so the
+rotated refresh token is never burned twice.
+
+## Regions
+
+The token response carries your home region key (US, AE, AU, …). Product
+endpoints resolve per-region from the table in `src/core/regions.ts` at call
+time — no service key is sent at login and no product URL is baked into the
+session. Precedence: env override (`FACILIO_VIBE_SERVER_URL` /
+`FACILIO_CONNECTIONS_SERVER_URL`) → pinned `--server` (vibe only) → region
+table → default. `facilio whoami` shows the resolved endpoints.
+
+## Environment variables
+
+`FACILIO_*` is canonical; the legacy `VIBE_*` names still work as fallbacks.
+
+| Variable | Purpose |
+|---|---|
+| `FACILIO_API_KEY` | Zero-config CI auth (wins over any saved session). |
+| `FACILIO_REGION` | Region for `FACILIO_API_KEY` sessions (US, UK, AE, AU, …; default US). |
+| `FACILIO_IDENTITY_SERVER_URL` | Identity-service base URL override (was `FACILIO_IDENTITY_URL`, still honoured). |
+| `FACILIO_VIBE_SERVER_URL` | Vibe product-server URL override, beats the region table (was `FACILIO_SERVER_URL`, still honoured). |
+| `FACILIO_CONNECTIONS_SERVER_URL` | Connections MCP endpoint override, beats the region table (was `FACILIO_MCP_URL`, still honoured). |
+| `FACILIO_CLIENT_ID` | OAuth client id override. |
+| `FACILIO_NO_KEYCHAIN=1` | Force file-based credential storage (CI). |
+
+### Local development
+
+Point each backend at your local stack independently — set any subset:
+
+```bash
+export FACILIO_IDENTITY_SERVER_URL=http://localhost:8090/identity
+export FACILIO_VIBE_SERVER_URL=http://localhost:8080
+export FACILIO_CONNECTIONS_SERVER_URL=http://localhost:9000/mcp
+```
+
+## Development
+
+```bash
+npm install
+npm run dev -- --help    # run from source (tsx)
+npm test                 # vitest
+npm run build            # tsc → dist/
+```
+
+Product namespaces live under `src/products/<name>/` and register their
+command tree through the `ProductModule` contract in `src/products/types.ts` —
+adding a new Facilio product CLI is one folder plus one line in the registry
+in `src/index.ts`.

package/dist/commands/login.js

@@ -0,0 +1,75 @@
+import { logger } from '../core/logger.js';
+import { saveCredentials } from '../core/credentials.js';
+import { deviceLogin, resolveApiKey } from '../core/identity.js';
+import { VibeApi, ApiError } from '../core/api.js';
+import { DEFAULT_CLIENT_ID, DEFAULT_IDENTITY_URL } from '../core/constants.js';
+import { REGIONS, vibeUrlFor, normalizeRegion, regionKeys } from '../core/regions.js';
+/**
+ * Universal sign-in: one identity session covers every product namespace
+ * (vibe, connections, …). Device flow by default; `--api-key` for CI.
+ *
+ * The token response carries the user's home region key (US, AE, AU, …);
+ * product endpoints resolve from the region→URL table in core/regions.ts,
+ * so no service key is sent and no per-product URL is stored — except an
+ * explicit `--server`, which pins the vibe-server URL for the session.
+ */
+export async function loginCommand(opts) {
+    // ─── --api-key path: skip browser, validate against /api/cli/apps, save. ───
+    if (opts.apiKey !== undefined) {
+        // No token response here, so there's no home region to read — resolve it
+        // from --region (default US), then the region table gives vibe + MCP URLs.
+        const { key: region, known } = normalizeRegion(opts.region);
+        if (!known) {
+            throw new Error(`Unknown region '${opts.region}'. Valid regions: ${regionKeys().join(', ')}.`);
+        }
+        // Pin serverUrl only when --server is explicit; otherwise store it empty so
+        // the region table stays the source of truth (same as device-flow sessions).
+        const pinned = opts.server ? opts.server.replace(/\/+$/, '') : '';
+        const serverUrl = pinned || vibeUrlFor(region);
+        const apiKey = await resolveApiKey(opts.apiKey);
+        const api = new VibeApi(serverUrl, undefined, apiKey);
+        try {
+            // Cheap, side-effect-free call that exercises CliBearerAuthFilter.
+            await api.getJson('/api/cli/apps');
+        }
+        catch (err) {
+            if (err instanceof ApiError && err.statusCode === 401) {
+                throw new Error('API key rejected by server. Check the key and try again.');
+            }
+            throw err;
+        }
+        const creds = { apiKey, serverUrl: pinned, region, source: 'api-key' };
+        const sink = await saveCredentials(creds);
+        logger.success(`Logged in with API key.`);
+        logger.step(`Region: ${region}${pinned ? '' : ` → ${serverUrl}`}`);
+        logger.step(`Credentials saved to ${sink}.`);
+        logger.step(`Tip: for CI, prefer \`export FACILIO_API_KEY=…\` (and \`FACILIO_REGION=…\`) over saving to disk.`);
+        logger.warn('Note: API-key sessions cover vibe commands only; `facilio connections` needs a browser sign-in.');
+        return;
+    }
+    // ─── Device-authorization (RFC 8628) path: works on laptop, SSH, container ───
+    if (opts.region) {
+        logger.warn('--region is only used with --api-key; browser sign-in takes the region from your account.');
+    }
+    const clientId = (opts.clientId ?? DEFAULT_CLIENT_ID).trim();
+    const identityUrl = (opts.identityUrl ?? DEFAULT_IDENTITY_URL).replace(/\/+$/, '');
+    if (!clientId) {
+        throw new Error('Missing OAuth client id. Pass --client-id or set FACILIO_CLIENT_ID.');
+    }
+    const creds = await deviceLogin({ clientId, identityUrl });
+    if (opts.server) {
+        creds.serverUrl = opts.server.replace(/\/+$/, '');
+    }
+    const sink = await saveCredentials(creds);
+    const who = creds.user?.email ?? creds.user?.name ?? '(signed in)';
+    logger.success(`Logged in as ${who}.`);
+    if (creds.region) {
+        const known = creds.region in REGIONS;
+        logger.step(`Region: ${creds.region}${known ? '' : ' (unknown region — falling back to default URLs; check core/regions.ts)'}`);
+    }
+    else {
+        logger.warn('No region key in the token response — product URLs fall back to defaults/env overrides.');
+    }
+    logger.step(`Token saved to ${sink}.`);
+}
+//# sourceMappingURL=login.js.map

package/dist/commands/login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAoB,MAAM,wBAAwB,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAUtF;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAkB;IACnD,8EAA8E;IAC9E,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9B,yEAAyE;QACzE,2EAA2E;QAC3E,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,CAAC,MAAM,qBAAqB,UAAU,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjG,CAAC;QACD,4EAA4E;QAC5E,6EAA6E;QAC7E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,MAAM,SAAS,GAAG,MAAM,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QACtD,IAAI,CAAC;YACH,mEAAmE;YACnE,MAAM,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,QAAQ,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;gBACtD,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;YAC9E,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,KAAK,GAAgB,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACpF,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,WAAW,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,SAAS,EAAE,EAAE,CAAC,CAAC;QACnE,MAAM,CAAC,IAAI,CAAC,wBAAwB,IAAI,GAAG,CAAC,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC,kGAAkG,CAAC,CAAC;QAChH,MAAM,CAAC,IAAI,CAAC,iGAAiG,CAAC,CAAC;QAC/G,OAAO;IACT,CAAC;IAED,gFAAgF;IAChF,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,2FAA2F,CAAC,CAAC;IAC3G,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,iBAAiB,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7D,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,oBAAoB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACnF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;IAC3D,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,IAAI,IAAI,aAAa,CAAC;IACnE,MAAM,CAAC,OAAO,CAAC,gBAAgB,GAAG,GAAG,CAAC,CAAC;IACvC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,yEAAyE,EAAE,CAAC,CAAC;IAClI,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,yFAAyF,CAAC,CAAC;IACzG,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,kBAAkB,IAAI,GAAG,CAAC,CAAC;AACzC,CAAC"}

package/dist/commands/logout.js

@@ -0,0 +1,41 @@
+import { request } from 'undici';
+import { logger } from '../core/logger.js';
+import { clearCredentials, loadCredentials } from '../core/credentials.js';
+export async function logoutCommand() {
+    const existing = await loadCredentials();
+    if (!existing) {
+        logger.info('No active session.');
+        return;
+    }
+    // Device-flow sessions: best-effort server-side revoke against the home-DC
+    // revoke endpoint. Local removal still runs on failure so a user can always
+    // log out, and api-key / env sessions skip this entirely (no token to revoke).
+    if (existing.revokeUrl && (existing.refreshToken || existing.accessToken)) {
+        try {
+            const body = new URLSearchParams({
+                token: existing.refreshToken ?? existing.accessToken,
+            }).toString();
+            const res = await request(existing.revokeUrl, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/x-www-form-urlencoded',
+                    accept: 'application/json',
+                },
+                body,
+            });
+            if (res.statusCode === 200) {
+                logger.step('Token revoked on the server.');
+            }
+            else {
+                logger.warn(`Server revoke returned ${res.statusCode}; clearing local credentials anyway.`);
+            }
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            logger.warn(`Could not reach revoke endpoint (${msg}); clearing local credentials anyway.`);
+        }
+    }
+    await clearCredentials();
+    logger.success('Logged out.');
+}
+//# sourceMappingURL=logout.js.map

package/dist/commands/logout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout.js","sourceRoot":"","sources":["../../src/commands/logout.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE3E,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,QAAQ,GAAG,MAAM,eAAe,EAAE,CAAC;IACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAClC,OAAO;IACT,CAAC;IAED,2EAA2E;IAC3E,4EAA4E;IAC5E,+EAA+E;IAC/E,IAAI,QAAQ,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,YAAY,IAAI,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1E,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;gBAC/B,KAAK,EAAE,QAAQ,CAAC,YAAY,IAAI,QAAQ,CAAC,WAAY;aACtD,CAAC,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE;gBAC5C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,mCAAmC;oBACnD,MAAM,EAAE,kBAAkB;iBAC3B;gBACD,IAAI;aACL,CAAC,CAAC;YACH,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;gBAC3B,MAAM,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;YAC9C,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,0BAA0B,GAAG,CAAC,UAAU,sCAAsC,CAAC,CAAC;YAC9F,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,MAAM,CAAC,IAAI,CAAC,oCAAoC,GAAG,uCAAuC,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IAED,MAAM,gBAAgB,EAAE,CAAC;IACzB,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;AAChC,CAAC"}

package/dist/commands/whoami.js

@@ -0,0 +1,26 @@
+import { logger } from '../core/logger.js';
+import { loadCredentials } from '../core/credentials.js';
+import { mcpUrlFor, vibeUrlFor } from '../core/regions.js';
+export async function whoamiCommand() {
+    const creds = await loadCredentials();
+    if (!creds) {
+        logger.info('Not logged in. Run `facilio login` to sign in.');
+        process.exitCode = 1;
+        return;
+    }
+    const sourceLabel = creds.source === 'env' ? 'API key (FACILIO_API_KEY env)'
+        : creds.source === 'api-key' ? 'API key (saved)'
+            : creds.source === 'device' ? 'browser sign-in (OAuth device flow)'
+                : creds.apiKey ? 'API key'
+                    : 'browser sign-in';
+    const who = creds.user?.email
+        ?? creds.user?.name
+        ?? (creds.apiKey ? '(API key — no email)' : '(no email in token)');
+    logger.success(`Logged in as ${who}`);
+    logger.step(`Auth: ${sourceLabel}`);
+    if (creds.region)
+        logger.step(`Region: ${creds.region}`);
+    logger.step(`Vibe: ${vibeUrlFor(creds.region, creds.serverUrl)}`);
+    logger.step(`MCP: ${mcpUrlFor(creds.region)}`);
+}
+//# sourceMappingURL=whoami.js.map

package/dist/commands/whoami.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"whoami.js","sourceRoot":"","sources":["../../src/commands/whoami.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAE3D,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAC;IACtC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;QAC9D,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,MAAM,WAAW,GACf,KAAK,CAAC,MAAM,KAAK,KAAK,CAAM,CAAC,CAAC,+BAA+B;QAC/D,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAE,CAAC,CAAC,iBAAiB;YACjD,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAG,CAAC,CAAC,qCAAqC;gBACrE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAgB,CAAC,CAAC,SAAS;oBACzC,CAAC,CAAC,iBAAiB,CAAC;IAEpB,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,KAAK;WACxB,KAAK,CAAC,IAAI,EAAE,IAAI;WAChB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC;IACrE,MAAM,CAAC,OAAO,CAAC,gBAAgB,GAAG,EAAE,CAAC,CAAC;IACtC,MAAM,CAAC,IAAI,CAAC,SAAS,WAAW,EAAE,CAAC,CAAC;IACpC,IAAI,KAAK,CAAC,MAAM;QAAE,MAAM,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACzD,MAAM,CAAC,IAAI,CAAC,SAAS,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAClE,MAAM,CAAC,IAAI,CAAC,QAAQ,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AACjD,CAAC"}

package/dist/core/api.js

@@ -0,0 +1,158 @@
+import { request } from 'undici';
+import { refreshCredentials, SessionExpiredError, } from './credentials.js';
+import { vibeUrlFor } from './regions.js';
+export class ApiError extends Error {
+    statusCode;
+    body;
+    constructor(statusCode, message, body) {
+        // If the server returned a useful payload (error or message field), surface it.
+        const detail = extractDetail(body);
+        super(detail ? `${message} — ${detail}` : message);
+        this.statusCode = statusCode;
+        this.body = body;
+    }
+}
+function extractDetail(body) {
+    if (!body || typeof body !== 'object')
+        return undefined;
+    const b = body;
+    if (typeof b.error === 'string')
+        return b.error;
+    if (typeof b.message === 'string')
+        return b.message;
+    return undefined;
+}
+export class VibeApi {
+    serverUrl;
+    token;
+    apiKey;
+    refresh;
+    /**
+     * If both `apiKey` and `token` are supplied, `apiKey` wins — matches the
+     * vibe-server `CliBearerAuthFilter` precedence so the credential the CLI
+     * thinks is in use is the same one the server will validate.
+     *
+     * `refresh`, when provided, is called exactly once on the first 401 to
+     * obtain a new bearer token; the request is then retried with that token.
+     * API-key sessions don't pass a refresh callback, so they propagate 401s
+     * unchanged.
+     */
+    constructor(serverUrl, token, apiKey, refresh) {
+        this.serverUrl = serverUrl;
+        this.token = token;
+        this.apiKey = apiKey;
+        this.refresh = refresh;
+    }
+    url(path) {
+        const base = this.serverUrl.replace(/\/+$/, '');
+        return `${base}${path.startsWith('/') ? path : '/' + path}`;
+    }
+    headers(extra = {}) {
+        const h = { accept: 'application/json', ...extra };
+        if (this.apiKey) {
+            h['x-api-key'] = this.apiKey;
+        }
+        else if (this.token) {
+            h.authorization = `Bearer ${this.token}`;
+        }
+        return h;
+    }
+    /**
+     * Single send-with-retry path shared by getJson/postJson/uploadBinary.
+     * On 401 with a refresh callback in play, calls refresh() to rotate the
+     * access token, then retries once. If refresh raises SessionExpiredError
+     * the 401 surfaces with that message so the user is told to re-login.
+     */
+    async send(method, path, init = {}) {
+        const extra = {};
+        if (init.contentType)
+            extra['content-type'] = init.contentType;
+        if (init.body && Buffer.isBuffer(init.body)) {
+            extra['content-length'] = String(init.body.length);
+        }
+        const send = () => request(this.url(path), {
+            method,
+            headers: this.headers(extra),
+            body: init.body,
+        });
+        let res = await send();
+        if (res.statusCode === 401 && this.refresh && !this.apiKey) {
+            // Drain so undici can release the socket before we hit the same host
+            // again for the retry.
+            await res.body.dump();
+            try {
+                this.token = await this.refresh();
+            }
+            catch (err) {
+                if (err instanceof SessionExpiredError) {
+                    throw new ApiError(401, `${method} ${path} failed (401)`, { error: err.message });
+                }
+                throw err;
+            }
+            res = await send();
+        }
+        const body = await res.body.json().catch(() => null);
+        if (res.statusCode >= 400) {
+            throw new ApiError(res.statusCode, `${method} ${path} failed (${res.statusCode})`, body);
+        }
+        return body;
+    }
+    async getJson(path) {
+        return (await this.send('GET', path));
+    }
+    async postJson(path, payload) {
+        return (await this.send('POST', path, {
+            body: JSON.stringify(payload),
+            contentType: 'application/json',
+        }));
+    }
+    async putJson(path, payload) {
+        return (await this.send('PUT', path, {
+            body: JSON.stringify(payload),
+            contentType: 'application/json',
+        }));
+    }
+    async deleteJson(path) {
+        return (await this.send('DELETE', path));
+    }
+    async uploadBinary(path, data, contentType) {
+        return (await this.send('POST', path, { body: data, contentType }));
+    }
+}
+/**
+ * Refresh proactively when the access token has expired or will within this
+ * window. 60s covers small clock skew and avoids burning a 401 round trip on
+ * a token that's about to die mid-call. The reactive 401 path inside `send()`
+ * is the safety net for tokens revoked server-side ahead of `expiresAt`.
+ */
+const PROACTIVE_REFRESH_SKEW_MS = 60_000;
+export async function apiFromCredentials(creds) {
+    // Only device-flow sessions can refresh. Mutate the caller's creds in place
+    // after a successful refresh so any post-call inspection (e.g. logging the
+    // user's email) sees the rotated tokens.
+    const canRefresh = !creds.apiKey && !!creds.refreshToken && !!creds.tokenUrl && !!creds.clientId;
+    const refresh = canRefresh
+        ? async () => {
+            const fresh = await refreshCredentials(creds);
+            Object.assign(creds, fresh);
+            return fresh.accessToken;
+        }
+        : undefined;
+    // Proactive refresh. SessionExpiredError (refresh token rejected) surfaces
+    // immediately — no point making a call we know will 401. Transient errors
+    // (network / 5xx) fall through silently with the stale token; the reactive
+    // path retries on 401 if the server really does reject it.
+    if (refresh && creds.expiresAt && creds.expiresAt - Date.now() < PROACTIVE_REFRESH_SKEW_MS) {
+        try {
+            await refresh();
+        }
+        catch (err) {
+            if (err instanceof SessionExpiredError)
+                throw err;
+        }
+    }
+    // Endpoint comes from the region→URL table unless the session pinned an
+    // explicit serverUrl (--server / api-key / pre-region legacy sessions).
+    return new VibeApi(vibeUrlFor(creds.region, creds.serverUrl), creds.accessToken, creds.apiKey, refresh);
+}
+//# sourceMappingURL=api.js.map

package/dist/core/api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../../src/core/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AACjC,OAAO,EACL,kBAAkB,EAClB,mBAAmB,GAEpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,MAAM,OAAO,QAAS,SAAQ,KAAK;IACd;IAA4C;IAA/D,YAAmB,UAAkB,EAAE,OAAe,EAAS,IAAc;QAC3E,gFAAgF;QAChF,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACnC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,OAAO,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAHlC,eAAU,GAAV,UAAU,CAAQ;QAA0B,SAAI,GAAJ,IAAI,CAAU;IAI7E,CAAC;CACF;AAED,SAAS,aAAa,CAAC,IAAa;IAClC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACxD,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC,KAAK,CAAC;IAChD,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC,OAAO,CAAC;IACpD,OAAO,SAAS,CAAC;AACnB,CAAC;AAID,MAAM,OAAO,OAAO;IAYR;IACA;IACA;IACA;IAdV;;;;;;;;;OASG;IACH,YACU,SAAiB,EACjB,KAAc,EACd,MAAe,EACf,OAAmB;QAHnB,cAAS,GAAT,SAAS,CAAQ;QACjB,UAAK,GAAL,KAAK,CAAS;QACd,WAAM,GAAN,MAAM,CAAS;QACf,YAAO,GAAP,OAAO,CAAY;IAC1B,CAAC;IAEI,GAAG,CAAC,IAAY;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAChD,OAAO,GAAG,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,EAAE,CAAC;IAC9D,CAAC;IAEO,OAAO,CAAC,QAAgC,EAAE;QAChD,MAAM,CAAC,GAA2B,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,KAAK,EAAE,CAAC;QAC3E,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,CAAC,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;QAC/B,CAAC;aAAM,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACtB,CAAC,CAAC,aAAa,GAAG,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3C,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,IAAI,CAChB,MAAyC,EACzC,IAAY,EACZ,OAAyD,EAAE;QAE3D,MAAM,KAAK,GAA2B,EAAE,CAAC;QACzC,IAAI,IAAI,CAAC,WAAW;YAAE,KAAK,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC;QAC/D,IAAI,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5C,KAAK,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,EAAE,CAChB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;YACtB,MAAM;YACN,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;YAC5B,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC,CAAC;QAEL,IAAI,GAAG,GAAG,MAAM,IAAI,EAAE,CAAC;QAEvB,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAC3D,qEAAqE;YACrE,uBAAuB;YACvB,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACtB,IAAI,CAAC;gBACH,IAAI,CAAC,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACpC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;oBACvC,MAAM,IAAI,QAAQ,CAAC,GAAG,EAAE,GAAG,MAAM,IAAI,IAAI,eAAe,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBACpF,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,GAAG,GAAG,MAAM,IAAI,EAAE,CAAC;QACrB,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;YAC1B,MAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,MAAM,IAAI,IAAI,YAAY,GAAG,CAAC,UAAU,GAAG,EAAE,IAAI,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,OAAO,CAAc,IAAY;QACrC,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAM,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,QAAQ,CAAc,IAAY,EAAE,OAAgB;QACxD,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE;YACpC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;YAC7B,WAAW,EAAE,kBAAkB;SAChC,CAAC,CAAM,CAAC;IACX,CAAC;IAED,KAAK,CAAC,OAAO,CAAc,IAAY,EAAE,OAAgB;QACvD,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE;YACnC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;YAC7B,WAAW,EAAE,kBAAkB;SAChC,CAAC,CAAM,CAAC;IACX,CAAC;IAED,KAAK,CAAC,UAAU,CAAc,IAAY;QACxC,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAM,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,YAAY,CAAc,IAAY,EAAE,IAAY,EAAE,WAAmB;QAC7E,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAM,CAAC;IAC3E,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAEzC,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAAkB;IACzD,4EAA4E;IAC5E,2EAA2E;IAC3E,yCAAyC;IACzC,MAAM,UAAU,GACd,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;IAChF,MAAM,OAAO,GAA0B,UAAU;QAC/C,CAAC,CAAC,KAAK,IAAI,EAAE;YACT,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAC9C,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAC5B,OAAO,KAAK,CAAC,WAAY,CAAC;QAC5B,CAAC;QACH,CAAC,CAAC,SAAS,CAAC;IAEd,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,2DAA2D;IAC3D,IAAI,OAAO,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,yBAAyB,EAAE,CAAC;QAC3F,IAAI,CAAC;YACH,MAAM,OAAO,EAAE,CAAC;QAClB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,mBAAmB;gBAAE,MAAM,GAAG,CAAC;QACpD,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,wEAAwE;IACxE,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAC1G,CAAC"}

package/dist/core/constants.js

@@ -0,0 +1,53 @@
+/**
+ * Environment resolution: `FACILIO_*` is the canonical prefix for the unified
+ * CLI; the legacy `VIBE_*` names are still honoured as silent fallbacks so
+ * existing CI configurations keep working across the rename.
+ */
+export function env(name) {
+    const v = process.env[`FACILIO_${name}`] ?? process.env[`VIBE_${name}`];
+    const trimmed = (v ?? '').trim();
+    return trimmed || undefined;
+}
+/**
+ * Per-product base-URL overrides for local development. Each backend has one
+ * clearly-named env var — set any subset to point that service at localhost:
+ *
+ *   FACILIO_IDENTITY_SERVER_URL     e.g. http://localhost:8090/identity
+ *   FACILIO_VIBE_SERVER_URL         e.g. http://localhost:8080
+ *   FACILIO_CONNECTIONS_SERVER_URL  e.g. http://localhost:9000/mcp
+ *
+ * The older single-purpose names are still honoured as fallbacks so existing
+ * setups keep working: FACILIO_IDENTITY_URL, FACILIO_SERVER_URL, FACILIO_MCP_URL.
+ */
+export function identityServerEnv() {
+    return env('IDENTITY_SERVER_URL') || env('IDENTITY_URL');
+}
+export function vibeServerEnv() {
+    return env('VIBE_SERVER_URL') || env('SERVER_URL');
+}
+export function connectionsServerEnv() {
+    return env('CONNECTIONS_SERVER_URL') || env('MCP_URL');
+}
+/**
+ * Last-resort vibe-server URL: used only when no region is known (e.g. an
+ * `--api-key` / CI login) and no `--server` / env override is set. Device-flow
+ * sessions resolve their URL from the region table, so this fallback is prod
+ * (US) to match the global identity/MCP defaults — never localhost in a
+ * released build. Override with `FACILIO_VIBE_SERVER_URL` for local development.
+ */
+export const DEFAULT_SERVER_URL = vibeServerEnv() || 'https://us.vibes.facilio.studio';
+export const DEFAULT_CLIENT_ID = env('CLIENT_ID') || '354ea7cd2fa84bcc96a51bc2d96c5111';
+/**
+ * Identity-service base used to bootstrap the OAuth2 device flow. The CLI hits
+ * identity-service directly (not via a product server's proxy) so the
+ * post-login homing URLs returned in the token response are honoured verbatim.
+ * Override with `FACILIO_IDENTITY_SERVER_URL` for non-production deployments.
+ */
+export const DEFAULT_IDENTITY_URL = (identityServerEnv() || 'https://id.facilio.com/identity').replace(/\/+$/, '');
+/**
+ * Facilio Connections MCP endpoint (Streamable HTTP). The CLI authenticates
+ * with the raw identity access token as a direct bearer — no DCR/browser
+ * OAuth. Override with `FACILIO_CONNECTIONS_SERVER_URL` or `--mcp-url` per command.
+ */
+export const DEFAULT_MCP_URL = (connectionsServerEnv() || 'https://mcp.facilio.com/mcp').replace(/\/+$/, '');
+//# sourceMappingURL=constants.js.map

package/dist/core/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/core/constants.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,UAAU,GAAG,CAAC,IAAY;IAC9B,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACjC,OAAO,OAAO,IAAI,SAAS,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,GAAG,CAAC,qBAAqB,CAAC,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;AAC3D,CAAC;AACD,MAAM,UAAU,aAAa;IAC3B,OAAO,GAAG,CAAC,iBAAiB,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;AACrD,CAAC;AACD,MAAM,UAAU,oBAAoB;IAClC,OAAO,GAAG,CAAC,wBAAwB,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,EAAE,IAAI,iCAAiC,CAAC;AAEvF,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC,WAAW,CAAC,IAAI,kCAAkC,CAAC;AAExF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,iBAAiB,EAAE,IAAI,iCAAiC,CACzD,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAEtB;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,oBAAoB,EAAE,IAAI,6BAA6B,CACxD,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC"}