@facilio/cli 0.3.0

package/dist/core/credentials.js

@@ -0,0 +1,209 @@
+import { closeSync, openSync, statSync, unlinkSync } from 'node:fs';
+import path from 'node:path';
+import { request } from 'undici';
+import { env, vibeServerEnv } from './constants.js';
+import { setSecret, getSecret, deleteSecret, getLegacySecret, deleteLegacySecret, fallbackFilePath, stateDir, } from './secretStore.js';
+/**
+ * Persist credentials to the OS secret store (Keychain / Secret Service /
+ * Credential Manager-DPAPI) — or to ~/.facilio/credentials.json (mode 0600) as
+ * a fallback when no OS store is available. Returns a human-readable label of
+ * where the secret actually landed, so callers can show "saved to macOS
+ * Keychain" instead of guessing.
+ */
+export async function saveCredentials(creds) {
+    // Single-line: macOS `security -w` switches to hex output if the password
+    // contains control chars (e.g. \n from pretty-printing), which makes
+    // `security ... -w | jq` inscrutable. The file fallback isn't really meant
+    // for hand-editing either, so compact JSON everywhere.
+    return setSecret(JSON.stringify(creds));
+}
+/**
+ * Resolve credentials, preferring the `FACILIO_API_KEY` env var (legacy
+ * `VIBE_API_KEY` still honoured) over the on-disk store. The env-var path is
+ * the zero-config agent flow: `export FACILIO_API_KEY=…` then any command
+ * works with no prior `facilio login`. Env wins over the store so CI jobs
+ * don't accidentally inherit a developer's interactive session.
+ *
+ * A session saved by the pre-rename vibe CLI (old keychain entry / ~/.vibe
+ * file) is migrated into the new store on first read, then the legacy entry
+ * is removed so the two locations can't diverge.
+ */
+export async function loadCredentials() {
+    const envKey = env('API_KEY');
+    if (envKey) {
+        // Region (default US) drives the vibe/MCP URLs via the region table; an
+        // explicit FACILIO_SERVER_URL still pins it. Empty serverUrl → resolve from
+        // region, matching device-flow / `login --api-key` sessions.
+        return {
+            apiKey: envKey,
+            serverUrl: vibeServerEnv() || '',
+            region: (env('REGION') || 'US').trim().toUpperCase(),
+            source: 'env',
+        };
+    }
+    let raw = getSecret();
+    if (!raw) {
+        raw = getLegacySecret();
+        if (!raw)
+            return null;
+        try {
+            const migrated = JSON.parse(raw);
+            await saveCredentials(migrated);
+            deleteLegacySecret();
+            return migrated;
+        }
+        catch {
+            return null;
+        }
+    }
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+export async function clearCredentials() {
+    deleteSecret();
+}
+/**
+ * Thrown when refresh is impossible — no refresh token on file, or the
+ * refresh_token grant was definitively rejected (4xx from token endpoint).
+ * In both cases the right user action is `facilio login`, so the message is
+ * already phrased that way.
+ */
+export class SessionExpiredError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'SessionExpiredError';
+    }
+}
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+const LOCK_STALE_MS = 30_000;
+const LOCK_WAIT_MS = 30_000;
+/**
+ * Cross-process single-flight guard around token refresh. Identity-service
+ * rotates the refresh token on every exchange, so two concurrent `facilio`
+ * invocations refreshing the same grant would invalidate each other — the
+ * loser's (now-burned) refresh token 4xxes and nukes the session. The lock is
+ * a `wx`-created file in ~/.facilio; a crashed holder is broken after 30s.
+ */
+async function withRefreshLock(fn) {
+    const lockPath = path.join(stateDir(), 'refresh.lock');
+    const start = Date.now();
+    while (true) {
+        let fd;
+        try {
+            fd = openSync(lockPath, 'wx');
+        }
+        catch (err) {
+            if (err.code !== 'EEXIST')
+                throw err;
+            try {
+                if (Date.now() - statSync(lockPath).mtimeMs > LOCK_STALE_MS) {
+                    unlinkSync(lockPath);
+                    continue;
+                }
+            }
+            catch {
+                continue; // lock vanished between stat/unlink — retry immediately
+            }
+            if (Date.now() - start > LOCK_WAIT_MS) {
+                throw new Error('Timed out waiting for another facilio process to finish refreshing the session.');
+            }
+            await sleep(250);
+            continue;
+        }
+        try {
+            return await fn();
+        }
+        finally {
+            closeSync(fd);
+            try {
+                unlinkSync(lockPath);
+            }
+            catch {
+                /* best effort */
+            }
+        }
+    }
+}
+/**
+ * Exchange `refresh_token` for a fresh access_token at the home-DC token
+ * endpoint (RFC 6749 §6). On success, persists the rotated tokens via
+ * `saveCredentials` and returns the updated record.
+ *
+ * Runs under a cross-process lock; after acquiring it, re-reads the store
+ * first — if a concurrent invocation already refreshed, its rotated tokens
+ * are adopted instead of burning our stale refresh token.
+ *
+ * Failure handling distinguishes definitive from transient:
+ *  - 4xx (invalid_grant / refresh token revoked or expired): clears local
+ *    credentials and throws SessionExpiredError, so the next command starts
+ *    clean and the user is told to re-run `facilio login`.
+ *  - Network errors / 5xx: leaves credentials in place and throws a plain
+ *    Error, so a transient outage doesn't force the user to redo browser
+ *    sign-in.
+ */
+export async function refreshCredentials(creds) {
+    if (!creds.refreshToken || !creds.tokenUrl || !creds.clientId) {
+        throw new SessionExpiredError('No refresh token on file. Run `facilio login` to sign in again.');
+    }
+    return withRefreshLock(async () => {
+        // Another process may have rotated the tokens while we waited.
+        const stored = await loadCredentials();
+        if (stored?.accessToken &&
+            stored.accessToken !== creds.accessToken &&
+            (stored.expiresAt ?? 0) > Date.now()) {
+            return stored;
+        }
+        const effective = stored?.refreshToken ? stored : creds;
+        return doRefresh(effective);
+    });
+}
+async function doRefresh(creds) {
+    let res;
+    try {
+        res = await request(creds.tokenUrl, {
+            method: 'POST',
+            headers: {
+                'content-type': 'application/x-www-form-urlencoded',
+                accept: 'application/json',
+            },
+            body: new URLSearchParams({
+                grant_type: 'refresh_token',
+                refresh_token: creds.refreshToken,
+                client_id: creds.clientId,
+            }).toString(),
+        });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        throw new Error(`Could not reach token endpoint at ${creds.tokenUrl}: ${msg}`);
+    }
+    const parsed = (await res.body.json().catch(() => ({})));
+    if (res.statusCode === 200 && parsed.access_token) {
+        const updated = {
+            ...creds,
+            accessToken: parsed.access_token,
+            // Identity-service rotates the refresh token on every exchange; fall
+            // back to the prior value if a deployment ever stops doing that.
+            refreshToken: parsed.refresh_token ?? creds.refreshToken,
+            expiresAt: Date.now() + (parsed.expires_in ?? 3600) * 1000,
+        };
+        await saveCredentials(updated);
+        return updated;
+    }
+    if (res.statusCode >= 400 && res.statusCode < 500) {
+        await clearCredentials();
+        const detail = parsed.error_description || parsed.error || `HTTP ${res.statusCode}`;
+        throw new SessionExpiredError(`Session expired (${detail}). Run \`facilio login\` to sign in again.`);
+    }
+    const detail = parsed.error_description || parsed.error || `HTTP ${res.statusCode}`;
+    throw new Error(`Token endpoint returned ${res.statusCode}: ${detail}`);
+}
+/** Path of the file-fallback location (only used if the OS keychain is unavailable). */
+export function credentialsPath() {
+    return fallbackFilePath();
+}
+//# sourceMappingURL=credentials.js.map

package/dist/core/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/core/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACpE,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EACL,SAAS,EACT,SAAS,EACT,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,QAAQ,GAET,MAAM,kBAAkB,CAAC;AAoC1B;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAkB;IACtD,0EAA0E;IAC1E,qEAAqE;IACrE,2EAA2E;IAC3E,uDAAuD;IACvD,OAAO,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,MAAM,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;IAC9B,IAAI,MAAM,EAAE,CAAC;QACX,wEAAwE;QACxE,4EAA4E;QAC5E,6DAA6D;QAC7D,OAAO;YACL,MAAM,EAAE,MAAM;YACd,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE;YAChC,MAAM,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;YACpD,MAAM,EAAE,KAAK;SACd,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,GAAG,SAAS,EAAE,CAAC;IACtB,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,GAAG,eAAe,EAAE,CAAC;QACxB,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgB,CAAC;YAChD,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;YAChC,kBAAkB,EAAE,CAAC;YACrB,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgB,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,YAAY,EAAE,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAUD,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAEtF,MAAM,aAAa,GAAG,MAAM,CAAC;AAC7B,MAAM,YAAY,GAAG,MAAM,CAAC;AAE5B;;;;;;GAMG;AACH,KAAK,UAAU,eAAe,CAAI,EAAoB;IACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,cAAc,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,EAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAC;YAChE,IAAI,CAAC;gBACH,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,GAAG,aAAa,EAAE,CAAC;oBAC5D,UAAU,CAAC,QAAQ,CAAC,CAAC;oBACrB,SAAS;gBACX,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS,CAAC,wDAAwD;YACpE,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,GAAG,YAAY,EAAE,CAAC;gBACtC,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;YACjB,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,EAAE,CAAC;QACpB,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,EAAE,CAAC,CAAC;YACd,IAAI,CAAC;gBACH,UAAU,CAAC,QAAQ,CAAC,CAAC;YACvB,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAAkB;IACzD,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC9D,MAAM,IAAI,mBAAmB,CAC3B,iEAAiE,CAClE,CAAC;IACJ,CAAC;IAED,OAAO,eAAe,CAAC,KAAK,IAAI,EAAE;QAChC,+DAA+D;QAC/D,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAC;QACvC,IACE,MAAM,EAAE,WAAW;YACnB,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;YACxC,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,EACpC,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;QACxD,OAAO,SAAS,CAAC,SAAS,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,KAAkB;IACzC,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,QAAS,EAAE;YACnC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;gBACnD,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,KAAK,CAAC,YAAa;gBAClC,SAAS,EAAE,KAAK,CAAC,QAAS;aAC3B,CAAC,CAAC,QAAQ,EAAE;SACd,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,qCAAqC,KAAK,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAyB,CAAC;IAEjF,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QAClD,MAAM,OAAO,GAAgB;YAC3B,GAAG,KAAK;YACR,WAAW,EAAE,MAAM,CAAC,YAAY;YAChC,qEAAqE;YACrE,iEAAiE;YACjE,YAAY,EAAE,MAAM,CAAC,aAAa,IAAI,KAAK,CAAC,YAAY;YACxD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,IAAI;SAC3D,CAAC;QACF,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;QAC/B,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC;QAClD,MAAM,gBAAgB,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,KAAK,IAAI,QAAQ,GAAG,CAAC,UAAU,EAAE,CAAC;QACpF,MAAM,IAAI,mBAAmB,CAC3B,oBAAoB,MAAM,4CAA4C,CACvE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,KAAK,IAAI,QAAQ,GAAG,CAAC,UAAU,EAAE,CAAC;IACpF,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,UAAU,KAAK,MAAM,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,eAAe;IAC7B,OAAO,gBAAgB,EAAE,CAAC;AAC5B,CAAC"}

package/dist/core/identity.js

@@ -0,0 +1,162 @@
+/**
+ * Identity-service auth flows shared by every product namespace:
+ * RFC 8628 device-authorization login, `--api-key` resolution, and profile
+ * lookup. Extracted from the old vibe-cli login command so `facilio login`
+ * is product-agnostic — one session covers all Facilio services.
+ */
+import { request } from 'undici';
+import open from 'open';
+import { logger } from './logger.js';
+/**
+ * Resolve `--api-key` argument. Treats `-` as "read from stdin" so the key
+ * doesn't have to appear on the command line (and thus in shell history).
+ *   echo "$KEY" | facilio login --api-key -
+ */
+export async function resolveApiKey(arg) {
+    const trimmed = arg.trim();
+    if (trimmed !== '-' && trimmed !== '')
+        return trimmed;
+    if (process.stdin.isTTY) {
+        throw new Error('`--api-key -` requested but stdin is a TTY. Pipe the key in or pass it inline.');
+    }
+    const chunks = [];
+    for await (const chunk of process.stdin)
+        chunks.push(chunk);
+    const key = Buffer.concat(chunks).toString('utf8').trim();
+    if (!key)
+        throw new Error('No API key on stdin.');
+    return key;
+}
+async function postForm(url, form) {
+    const body = new URLSearchParams(form).toString();
+    const res = await request(url, {
+        method: 'POST',
+        headers: {
+            'content-type': 'application/x-www-form-urlencoded',
+            accept: 'application/json',
+        },
+        body,
+    });
+    const parsed = (await res.body.json().catch(() => ({})));
+    return { status: res.statusCode, body: parsed };
+}
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/**
+ * Fetch the connected user's name/email so `whoami` has something to show. Uses
+ * `Authorization: Bearer oauth2 <token>` because identity-service's IdentityFilter
+ * routes Bearer tokens with the `oauth2` marker through `validateOAuthToken` —
+ * product servers use plain `Bearer <token>`, but this call goes to
+ * identity-service directly.
+ */
+export async function fetchProfile(identityUrl, accessToken) {
+    try {
+        const res = await request(`${identityUrl.replace(/\/+$/, '')}/oauth2/profile`, {
+            method: 'GET',
+            headers: {
+                authorization: `Bearer oauth2 ${accessToken}`,
+                accept: 'application/json',
+            },
+        });
+        if (res.statusCode !== 200)
+            return undefined;
+        const body = (await res.body.json().catch(() => null));
+        const profile = body?.data?.profile;
+        if (!profile)
+            return undefined;
+        // orgId comes from the token claims (fetchProfile's caller has the token);
+        // identity's /oauth2/profile doesn't carry it.
+        return {
+            name: profile.name,
+            email: profile.email,
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * RFC 8628 device authorization grant.
+ *
+ *  1. POST /oauth2/device_authorization → device_code + user_code.
+ *  2. Show user_code + verification URL; auto-open the pre-filled URL in a browser.
+ *     User authenticates against identity-service's normal login UI on whichever
+ *     device has a browser, then approves the code.
+ *  3. Poll /oauth2/token with grant_type=device_code until APPROVED/DENIED/EXPIRED.
+ *     Respects RFC 8628 §3.5 polling errors (slow_down adds +5s to the interval).
+ *  4. On success, fetch the profile and persist homing URLs so refresh/revoke
+ *     hit the user's home DC directly (cross-DC).
+ */
+export async function deviceLogin(params) {
+    const da = await postForm(`${params.identityUrl}/oauth2/device_authorization`, { client_id: params.clientId });
+    if (da.status !== 200 || da.body.error || !da.body.device_code || !da.body.user_code) {
+        const detail = da.body.error_description || da.body.error || `HTTP ${da.status}`;
+        throw new Error(`Device authorization request failed: ${detail}`);
+    }
+    const deviceCode = da.body.device_code;
+    const userCode = da.body.user_code;
+    const verifyUri = da.body.verification_uri_complete || da.body.verification_uri || '';
+    const expiresIn = da.body.expires_in ?? 600;
+    let interval = (da.body.interval ?? 5) * 1000;
+    logger.info('To sign in, open this URL in a browser:');
+    logger.step(verifyUri);
+    logger.info('Then confirm this code matches:');
+    logger.step(userCode);
+    logger.step(`(code expires in ${Math.round(expiresIn / 60)} min)`);
+    if (verifyUri) {
+        await open(verifyUri).catch(() => {
+            logger.warn('Could not auto-open browser. Open the URL above manually.');
+        });
+    }
+    process.stdout.write('Waiting for approval');
+    while (true) {
+        await sleep(interval);
+        const poll = await postForm(`${params.identityUrl}/oauth2/token`, {
+            grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+            device_code: deviceCode,
+            client_id: params.clientId,
+        });
+        const accessToken = poll.body.access_token;
+        if (poll.status === 200 && accessToken) {
+            process.stdout.write('\n');
+            const t = poll.body;
+            const region = (t.region || t.region_key || '').trim().toUpperCase() || undefined;
+            const homedIdentity = (t.identity_url || params.identityUrl).replace(/\/+$/, '');
+            const profile = await fetchProfile(homedIdentity, accessToken);
+            return {
+                accessToken,
+                refreshToken: t.refresh_token,
+                expiresAt: Date.now() + (t.expires_in ?? 3600) * 1000,
+                region,
+                // Product URLs resolve from the region table (core/regions.ts) at
+                // call time — an explicit `--server` at login overwrites this after.
+                serverUrl: '',
+                identityUrl: homedIdentity,
+                tokenUrl: t.token_url || `${homedIdentity}/oauth2/token`,
+                revokeUrl: t.revoke_url || `${homedIdentity}/oauth2/revoke`,
+                clientId: params.clientId,
+                user: profile,
+                source: 'device',
+            };
+        }
+        const err = poll.body.error;
+        if (err === 'authorization_pending') {
+            process.stdout.write('.');
+            continue;
+        }
+        if (err === 'slow_down') {
+            interval += 5000;
+            process.stdout.write('.');
+            continue;
+        }
+        process.stdout.write('\n');
+        if (err === 'access_denied') {
+            throw new Error('Approval was denied in the browser.');
+        }
+        if (err === 'expired_token') {
+            throw new Error('The code expired before it was approved. Run `facilio login` again.');
+        }
+        const detail = poll.body.error_description || err || `HTTP ${poll.status}`;
+        throw new Error(`Unexpected response from token endpoint: ${detail}`);
+    }
+}
+//# sourceMappingURL=identity.js.map

package/dist/core/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/core/identity.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AACjC,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAsCrC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAW;IAC7C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,OAAO,CAAC;IAEtD,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK;QAAE,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1D,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAClD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,QAAQ,CAAI,GAAW,EAAE,IAA4B;IAClE,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;IAClD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;QAC7B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,mCAAmC;YACnD,MAAM,EAAE,kBAAkB;SAC3B;QACD,IAAI;KACL,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAM,CAAC;IAC9D,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAEtF;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,WAAmB,EAAE,WAAmB;IACzE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,iBAAiB,EAAE;YAC7E,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,aAAa,EAAE,iBAAiB,WAAW,EAAE;gBAC7C,MAAM,EAAE,kBAAkB;aAC3B;SACF,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG;YAAE,OAAO,SAAS,CAAC;QAC7C,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAA2B,CAAC;QACjF,MAAM,OAAO,GAAG,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC;QACpC,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAC/B,2EAA2E;QAC3E,+CAA+C;QAC/C,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAOD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAyB;IACzD,MAAM,EAAE,GAAG,MAAM,QAAQ,CACvB,GAAG,MAAM,CAAC,WAAW,8BAA8B,EACnD,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,CAC/B,CAAC;IACF,IAAI,EAAE,CAAC,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACrF,MAAM,MAAM,GAAG,EAAE,CAAC,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,QAAQ,EAAE,CAAC,MAAM,EAAE,CAAC;QACjF,MAAM,IAAI,KAAK,CAAC,wCAAwC,MAAM,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,UAAU,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC;IACvC,MAAM,QAAQ,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC;IACnC,MAAM,SAAS,GAAG,EAAE,CAAC,IAAI,CAAC,yBAAyB,IAAI,EAAE,CAAC,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAC;IACtF,MAAM,SAAS,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC;IAC5C,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IAE9C,MAAM,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;IACvD,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACvB,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IAC/C,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtB,MAAM,CAAC,IAAI,CAAC,oBAAoB,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;IACnE,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YAC/B,MAAM,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAE7C,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;QAEtB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAgB,GAAG,MAAM,CAAC,WAAW,eAAe,EAAE;YAC/E,UAAU,EAAE,8CAA8C;YAC1D,WAAW,EAAE,UAAU;YACvB,SAAS,EAAE,MAAM,CAAC,QAAQ;SAC3B,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC;QAC3C,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC;YACvC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3B,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC;YACpB,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,SAAS,CAAC;YAClF,MAAM,aAAa,GAAG,CAAC,CAAC,CAAC,YAAY,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACjF,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;YAC/D,OAAO;gBACL,WAAW;gBACX,YAAY,EAAE,CAAC,CAAC,aAAa;gBAC7B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,IAAI;gBACrD,MAAM;gBACN,kEAAkE;gBAClE,qEAAqE;gBACrE,SAAS,EAAE,EAAE;gBACb,WAAW,EAAE,aAAa;gBAC1B,QAAQ,EAAE,CAAC,CAAC,SAAS,IAAI,GAAG,aAAa,eAAe;gBACxD,SAAS,EAAE,CAAC,CAAC,UAAU,IAAI,GAAG,aAAa,gBAAgB;gBAC3D,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,IAAI,EAAE,OAAO;gBACb,MAAM,EAAE,QAAQ;aACjB,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QAC5B,IAAI,GAAG,KAAK,uBAAuB,EAAE,CAAC;YACpC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC1B,SAAS;QACX,CAAC;QACD,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;YACxB,QAAQ,IAAI,IAAI,CAAC;YACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC1B,SAAS;QACX,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,GAAG,KAAK,eAAe,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,GAAG,KAAK,eAAe,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,IAAI,GAAG,IAAI,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,4CAA4C,MAAM,EAAE,CAAC,CAAC;IACxE,CAAC;AACH,CAAC"}

package/dist/core/logger.js

@@ -0,0 +1,9 @@
+import pc from 'picocolors';
+export const logger = {
+    info: (msg) => console.log(pc.cyan('→'), msg),
+    success: (msg) => console.log(pc.green('✓'), msg),
+    warn: (msg) => console.log(pc.yellow('!'), msg),
+    error: (msg) => console.error(pc.red('✗'), msg),
+    step: (msg) => console.log(pc.dim('  ' + msg)),
+};
+//# sourceMappingURL=logger.js.map

package/dist/core/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/core/logger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,YAAY,CAAC;AAE5B,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,IAAI,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC;IACrD,OAAO,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC;IACzD,IAAI,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC;IACvD,KAAK,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC;IACvD,IAAI,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;CACvD,CAAC"}

package/dist/core/prompt.js

@@ -0,0 +1,29 @@
+import readline from 'node:readline/promises';
+import { stdin, stdout } from 'node:process';
+/**
+ * Minimal readline-based prompt. Returns the trimmed user input, or undefined
+ * when {@code optional} is true and the user just pressed Enter.
+ */
+export async function prompt(question, opts = {}) {
+    const rl = readline.createInterface({ input: stdin, output: stdout });
+    try {
+        const suffix = opts.default ? ` (${opts.default})` : opts.optional ? ' (optional)' : '';
+        const answer = (await rl.question(`? ${question}${suffix}: `)).trim();
+        if (!answer) {
+            if (opts.default)
+                return opts.default;
+            if (opts.optional)
+                return undefined;
+            // Required field — re-ask once
+            const retry = (await rl.question(`? ${question} (required): `)).trim();
+            if (!retry)
+                throw new Error(`${question} is required.`);
+            return retry;
+        }
+        return answer;
+    }
+    finally {
+        rl.close();
+    }
+}
+//# sourceMappingURL=prompt.js.map

package/dist/core/prompt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt.js","sourceRoot":"","sources":["../../src/core/prompt.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,wBAAwB,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAO7C;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,QAAgB,EAAE,OAAmB,EAAE;IAClE,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACtE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,QAAQ,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC,OAAO,CAAC;YACtC,IAAI,IAAI,CAAC,QAAQ;gBAAE,OAAO,SAAS,CAAC;YACpC,+BAA+B;YAC/B,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,QAAQ,eAAe,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACvE,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,eAAe,CAAC,CAAC;YACxD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;AACH,CAAC"}

package/dist/core/regions.js

@@ -0,0 +1,45 @@
+import { vibeServerEnv, connectionsServerEnv, DEFAULT_SERVER_URL, DEFAULT_MCP_URL } from './constants.js';
+export const REGIONS = {
+    US: { vibeUrl: 'https://us.vibes.facilio.studio', mcpUrl: 'https://mcp.facilio.com/mcp' },
+    UK: { vibeUrl: 'https://uk.vibes.facilio.studio', mcpUrl: 'https://mcp.facilio.co.uk/mcp' },
+    AE: { vibeUrl: 'https://ae.vibes.facilio.studio', mcpUrl: 'https://mcp.ae.facilio.ae/mcp' },
+    AU: { vibeUrl: 'https://au.vibes.facilio.studio', mcpUrl: 'https://mcp.facilio.com.au/mcp' },
+    AZURE: { vibeUrl: 'https://us2.vibes.facilio.studio', mcpUrl: 'https://mcp.facilio.us/mcp' },
+    'AZURE-AE': { vibeUrl: 'https://ae2.vibes.facilio.studio', mcpUrl: 'https://mcp.facilio.co.ae/mcp' },
+    ORACLE: { vibeUrl: 'https://sa.vibes.facilio.studio', mcpUrl: 'https://sa.mcp.facilio.com/mcp' },
+};
+function regionConfig(region) {
+    if (!region)
+        return undefined;
+    return REGIONS[region.trim().toUpperCase()];
+}
+/**
+ * Normalize a user-supplied region (case-insensitive) against the region
+ * table, applying {@code fallback} when none is given. `known` is false for a
+ * non-empty region that isn't in the table, so callers can reject it.
+ */
+export function normalizeRegion(input, fallback = 'US') {
+    const key = (input ?? fallback).trim().toUpperCase();
+    return { key, known: key in REGIONS };
+}
+/** Region keys the CLI knows about, for help text and error messages. */
+export function regionKeys() {
+    return Object.keys(REGIONS);
+}
+/**
+ * vibe-server URL. Precedence: env override → explicitly stored serverUrl
+ * (`facilio login --server …`, api-key sessions, or pre-region legacy
+ * sessions) → region table → default. New device-flow sessions store an
+ * empty serverUrl, so the region table is their effective source.
+ */
+export function vibeUrlFor(region, storedServerUrl) {
+    return (vibeServerEnv() ||
+        storedServerUrl ||
+        regionConfig(region)?.vibeUrl ||
+        DEFAULT_SERVER_URL).replace(/\/+$/, '');
+}
+/** Connections MCP endpoint: explicit env override → region table → default. */
+export function mcpUrlFor(region) {
+    return (connectionsServerEnv() || regionConfig(region)?.mcpUrl || DEFAULT_MCP_URL).replace(/\/+$/, '');
+}
+//# sourceMappingURL=regions.js.map

package/dist/core/regions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"regions.js","sourceRoot":"","sources":["../../src/core/regions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAkB1G,MAAM,CAAC,MAAM,OAAO,GAAiC;IACnD,EAAE,EAAE,EAAE,OAAO,EAAE,iCAAiC,EAAE,MAAM,EAAE,6BAA6B,EAAE;IACzF,EAAE,EAAE,EAAE,OAAO,EAAE,iCAAiC,EAAE,MAAM,EAAE,+BAA+B,EAAE;IAC3F,EAAE,EAAE,EAAE,OAAO,EAAE,iCAAiC,EAAE,MAAM,EAAE,+BAA+B,EAAE;IAC3F,EAAE,EAAE,EAAE,OAAO,EAAE,iCAAiC,EAAE,MAAM,EAAE,gCAAgC,EAAE;IAC5F,KAAK,EAAE,EAAE,OAAO,EAAE,kCAAkC,EAAE,MAAM,EAAE,4BAA4B,EAAE;IAC5F,UAAU,EAAE,EAAE,OAAO,EAAE,kCAAkC,EAAE,MAAM,EAAE,+BAA+B,EAAE;IACpG,MAAM,EAAE,EAAE,OAAO,EAAE,iCAAiC,EAAE,MAAM,EAAE,gCAAgC,EAAE;CACjG,CAAC;AAEF,SAAS,YAAY,CAAC,MAA0B;IAC9C,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,KAAyB,EACzB,QAAQ,GAAG,IAAI;IAEf,MAAM,GAAG,GAAG,CAAC,KAAK,IAAI,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrD,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,IAAI,OAAO,EAAE,CAAC;AACxC,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,UAAU;IACxB,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,MAA0B,EAAE,eAAwB;IAC7E,OAAO,CACL,aAAa,EAAE;QACf,eAAe;QACf,YAAY,CAAC,MAAM,CAAC,EAAE,OAAO;QAC7B,kBAAkB,CACnB,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACxB,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,SAAS,CAAC,MAA0B;IAClD,OAAO,CAAC,oBAAoB,EAAE,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,MAAM,IAAI,eAAe,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACzG,CAAC"}