@facilio/cli 0.3.0

package/dist/core/secretStore.js

@@ -0,0 +1,251 @@
+/*
+ * Cross-platform secret storage. Ported from identity-service's
+ * docs/device-auth/keychain.js — shells out to the OS-provided secret CLI so
+ * we don't need a native node module (no node-gyp, no prebuilds).
+ *
+ *   macOS   -> Keychain           via `security`
+ *   Linux   -> Secret Service     via `secret-tool` (libsecret; needs `libsecret-tools`)
+ *   Windows -> Credential Manager via `cmdkey` + DPAPI (per-user encryption, built-in)
+ *
+ * Falls back to a 0600 JSON file at ~/.facilio/credentials.json when no OS
+ * store is available (headless Linux, missing libsecret, etc.). Set
+ * `FACILIO_NO_KEYCHAIN=1` to force the file path (useful in CI).
+ *
+ * Stores ONE entry per (service, account) — the whole credentials JSON blob.
+ *
+ * Known caveat (matches the reference impl): on macOS, the secret is passed as
+ * `-w <secret>` on the argv of `security`, so it's briefly visible in `ps`.
+ * The macOS `security` CLI has no clean stdin-fed mode; if we ever care, the
+ * fix is a small Swift/Obj-C helper or a native module.
+ */
+import { execFileSync } from 'node:child_process';
+import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+const SERVICE = 'facilio-cli';
+const ACCOUNT = 'default';
+const DIR = path.join(os.homedir(), '.facilio');
+const FILE_FALLBACK = path.join(DIR, 'credentials.json');
+const WIN_FILE = path.join(DIR, 'credentials.dpapi');
+/* Pre-rename (@facilio/vibe-cli) locations — read/delete only, for one-time
+ * migration of an existing `vibe login` session into the new store. */
+const LEGACY_SERVICE = 'facilio-vibe-cli';
+const LEGACY_DIR = path.join(os.homedir(), '.vibe');
+const LEGACY_FILE_FALLBACK = path.join(LEGACY_DIR, 'credentials.json');
+const LEGACY_WIN_FILE = path.join(LEGACY_DIR, 'credentials.dpapi');
+const forceFileEnv = (process.env.FACILIO_NO_KEYCHAIN ??
+    process.env.VIBE_NO_KEYCHAIN ??
+    '').toLowerCase();
+const FORCE_FILE = forceFileEnv === '1' || forceFileEnv === 'true' || forceFileEnv === 'yes';
+function writeFileSecure(file, data) {
+    mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+    writeFileSync(file, data, { mode: 0o600 });
+}
+function fileSink() {
+    return `file (${FILE_FALLBACK})`;
+}
+/** Best-effort delete of the file fallback, used after a successful OS-store write. */
+function dropFileFallback() {
+    try {
+        if (existsSync(FILE_FALLBACK))
+            unlinkSync(FILE_FALLBACK);
+    }
+    catch {
+        /* leave the file in place if we can't remove it; not fatal */
+    }
+}
+export function setSecret(secret) {
+    if (!FORCE_FILE) {
+        try {
+            if (process.platform === 'darwin') {
+                execFileSync('security', ['add-generic-password', '-U', '-a', ACCOUNT, '-s', SERVICE, '-w', secret], { stdio: ['ignore', 'ignore', 'ignore'] });
+                dropFileFallback();
+                return 'macOS Keychain';
+            }
+            if (process.platform === 'linux') {
+                execFileSync('secret-tool', ['store', '--label=Facilio CLI', 'service', SERVICE, 'account', ACCOUNT], { input: secret, stdio: ['pipe', 'ignore', 'ignore'] });
+                dropFileFallback();
+                return 'Linux secret-service';
+            }
+            if (process.platform === 'win32') {
+                // DPAPI encrypts with a per-user key derived from the login credentials.
+                // The ciphertext is fine to keep on disk; only this user (on this machine)
+                // can decrypt it. `cmdkey` only registers a marker — not a real Credential
+                // Manager entry. For first-class Credential Manager storage, swap in a
+                // native module.
+                const enc = execFileSync('powershell', [
+                    '-NoProfile',
+                    '-Command',
+                    'ConvertTo-SecureString -String $env:FC_SECRET -AsPlainText -Force | ConvertFrom-SecureString',
+                ], {
+                    env: { ...process.env, FC_SECRET: secret },
+                    encoding: 'utf8',
+                }).trim();
+                writeFileSecure(WIN_FILE, enc);
+                try {
+                    execFileSync('cmdkey', [`/generic:${SERVICE}`, `/user:${ACCOUNT}`, '/pass:dpapi'], {
+                        stdio: 'ignore',
+                    });
+                }
+                catch {
+                    /* marker is best-effort */
+                }
+                dropFileFallback();
+                return 'Windows Credential Manager (DPAPI)';
+            }
+        }
+        catch {
+            /* OS store unavailable — fall through to file */
+        }
+    }
+    writeFileSecure(FILE_FALLBACK, secret);
+    return fileSink();
+}
+function readOsSecret(service) {
+    try {
+        if (process.platform === 'darwin') {
+            const out = execFileSync('security', ['find-generic-password', '-a', ACCOUNT, '-s', service, '-w'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+            return out.trim() || null;
+        }
+        if (process.platform === 'linux') {
+            const out = execFileSync('secret-tool', ['lookup', 'service', service, 'account', ACCOUNT], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+            return (out ? out.trim() : '') || null;
+        }
+    }
+    catch {
+        /* not found in OS store */
+    }
+    return null;
+}
+function readDpapiFile(file) {
+    if (process.platform !== 'win32' || !existsSync(file))
+        return null;
+    try {
+        const enc = readFileSync(file, 'utf8');
+        const out = execFileSync('powershell', [
+            '-NoProfile',
+            '-Command',
+            '$s = $env:FC_ENC | ConvertTo-SecureString; ' +
+                '[Runtime.InteropServices.Marshal]::PtrToStringAuto(' +
+                '[Runtime.InteropServices.Marshal]::SecureStringToBSTR($s))',
+        ], {
+            env: { ...process.env, FC_ENC: enc },
+            encoding: 'utf8',
+        });
+        return out.trim() || null;
+    }
+    catch {
+        return null;
+    }
+}
+export function getSecret() {
+    if (!FORCE_FILE) {
+        const v = readOsSecret(SERVICE) ?? readDpapiFile(WIN_FILE);
+        if (v)
+            return v;
+    }
+    if (existsSync(FILE_FALLBACK)) {
+        const v = readFileSync(FILE_FALLBACK, 'utf8').trim();
+        return v || null;
+    }
+    return null;
+}
+export function deleteSecret() {
+    if (!FORCE_FILE) {
+        try {
+            if (process.platform === 'darwin') {
+                execFileSync('security', ['delete-generic-password', '-a', ACCOUNT, '-s', SERVICE], {
+                    stdio: 'ignore',
+                });
+            }
+            else if (process.platform === 'linux') {
+                execFileSync('secret-tool', ['clear', 'service', SERVICE, 'account', ACCOUNT], {
+                    stdio: 'ignore',
+                });
+            }
+            else if (process.platform === 'win32') {
+                if (existsSync(WIN_FILE))
+                    unlinkSync(WIN_FILE);
+                try {
+                    execFileSync('cmdkey', [`/delete:${SERVICE}`], { stdio: 'ignore' });
+                }
+                catch {
+                    /* marker may not exist */
+                }
+            }
+        }
+        catch {
+            /* not present in OS store — fine */
+        }
+    }
+    if (existsSync(FILE_FALLBACK)) {
+        try {
+            unlinkSync(FILE_FALLBACK);
+        }
+        catch {
+            /* best effort */
+        }
+    }
+}
+/**
+ * Read a credentials blob left behind by @facilio/vibe-cli (old keychain
+ * service name, then ~/.vibe file fallbacks). Used once per machine to migrate
+ * an existing session into the new store; returns null when there's nothing.
+ */
+export function getLegacySecret() {
+    if (!FORCE_FILE) {
+        const v = readOsSecret(LEGACY_SERVICE) ?? readDpapiFile(LEGACY_WIN_FILE);
+        if (v)
+            return v;
+    }
+    if (existsSync(LEGACY_FILE_FALLBACK)) {
+        const v = readFileSync(LEGACY_FILE_FALLBACK, 'utf8').trim();
+        return v || null;
+    }
+    return null;
+}
+/** Remove the legacy entry after a successful migration so stores can't diverge. */
+export function deleteLegacySecret() {
+    try {
+        if (process.platform === 'darwin') {
+            execFileSync('security', ['delete-generic-password', '-a', ACCOUNT, '-s', LEGACY_SERVICE], {
+                stdio: 'ignore',
+            });
+        }
+        else if (process.platform === 'linux') {
+            execFileSync('secret-tool', ['clear', 'service', LEGACY_SERVICE, 'account', ACCOUNT], {
+                stdio: 'ignore',
+            });
+        }
+        else if (process.platform === 'win32') {
+            if (existsSync(LEGACY_WIN_FILE))
+                unlinkSync(LEGACY_WIN_FILE);
+            try {
+                execFileSync('cmdkey', [`/delete:${LEGACY_SERVICE}`], { stdio: 'ignore' });
+            }
+            catch {
+                /* marker may not exist */
+            }
+        }
+    }
+    catch {
+        /* not present — fine */
+    }
+    try {
+        if (existsSync(LEGACY_FILE_FALLBACK))
+            unlinkSync(LEGACY_FILE_FALLBACK);
+    }
+    catch {
+        /* best effort */
+    }
+}
+/** Path of the file-fallback location (only used if the OS keychain is unavailable). */
+export function fallbackFilePath() {
+    return FILE_FALLBACK;
+}
+/** Config/state directory for the unified CLI (~/.facilio), created on demand. */
+export function stateDir() {
+    mkdirSync(DIR, { recursive: true, mode: 0o700 });
+    return DIR;
+}
+//# sourceMappingURL=secretStore.js.map

package/dist/core/secretStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretStore.js","sourceRoot":"","sources":["../../src/core/secretStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACzF,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,OAAO,GAAG,aAAa,CAAC;AAC9B,MAAM,OAAO,GAAG,SAAS,CAAC;AAE1B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,CAAC;AAChD,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;AACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;AAErD;uEACuE;AACvE,MAAM,cAAc,GAAG,kBAAkB,CAAC;AAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;AACpD,MAAM,oBAAoB,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;AACvE,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;AAQnE,MAAM,YAAY,GAAG,CACnB,OAAO,CAAC,GAAG,CAAC,mBAAmB;IAC/B,OAAO,CAAC,GAAG,CAAC,gBAAgB;IAC5B,EAAE,CACH,CAAC,WAAW,EAAE,CAAC;AAChB,MAAM,UAAU,GAAG,YAAY,KAAK,GAAG,IAAI,YAAY,KAAK,MAAM,IAAI,YAAY,KAAK,KAAK,CAAC;AAE7F,SAAS,eAAe,CAAC,IAAY,EAAE,IAAY;IACjD,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAChE,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,QAAQ;IACf,OAAO,SAAS,aAAa,GAAG,CAAC;AACnC,CAAC;AAED,uFAAuF;AACvF,SAAS,gBAAgB;IACvB,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,aAAa,CAAC;YAAE,UAAU,CAAC,aAAa,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;IAChE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,MAAc;IACtC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAClC,YAAY,CACV,UAAU,EACV,CAAC,sBAAsB,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,EAC1E,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAC1C,CAAC;gBACF,gBAAgB,EAAE,CAAC;gBACnB,OAAO,gBAAgB,CAAC;YAC1B,CAAC;YACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACjC,YAAY,CACV,aAAa,EACb,CAAC,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,EACxE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CACvD,CAAC;gBACF,gBAAgB,EAAE,CAAC;gBACnB,OAAO,sBAAsB,CAAC;YAChC,CAAC;YACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACjC,yEAAyE;gBACzE,2EAA2E;gBAC3E,2EAA2E;gBAC3E,uEAAuE;gBACvE,iBAAiB;gBACjB,MAAM,GAAG,GAAG,YAAY,CACtB,YAAY,EACZ;oBACE,YAAY;oBACZ,UAAU;oBACV,8FAA8F;iBAC/F,EACD;oBACE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE;oBAC1C,QAAQ,EAAE,MAAM;iBACjB,CACF,CAAC,IAAI,EAAE,CAAC;gBACT,eAAe,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;gBAC/B,IAAI,CAAC;oBACH,YAAY,CAAC,QAAQ,EAAE,CAAC,YAAY,OAAO,EAAE,EAAE,SAAS,OAAO,EAAE,EAAE,aAAa,CAAC,EAAE;wBACjF,KAAK,EAAE,QAAQ;qBAChB,CAAC,CAAC;gBACL,CAAC;gBAAC,MAAM,CAAC;oBACP,2BAA2B;gBAC7B,CAAC;gBACD,gBAAgB,EAAE,CAAC;gBACnB,OAAO,oCAAoC,CAAC;YAC9C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,iDAAiD;QACnD,CAAC;IACH,CAAC;IACD,eAAe,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACvC,OAAO,QAAQ,EAAE,CAAC;AACpB,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,YAAY,CACtB,UAAU,EACV,CAAC,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAC7D,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAC1D,CAAC;YACF,OAAO,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;QAC5B,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,MAAM,GAAG,GAAG,YAAY,CACtB,aAAa,EACb,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,EAClD,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAC1D,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC;QACzC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,2BAA2B;IAC7B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,YAAY,CACtB,YAAY,EACZ;YACE,YAAY;YACZ,UAAU;YACV,6CAA6C;gBAC3C,qDAAqD;gBACrD,4DAA4D;SAC/D,EACD;YACE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE;YACpC,QAAQ,EAAE,MAAM;SACjB,CACF,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,CAAC,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC3D,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACrD,OAAO,CAAC,IAAI,IAAI,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAClC,YAAY,CAAC,UAAU,EAAE,CAAC,yBAAyB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE;oBAClF,KAAK,EAAE,QAAQ;iBAChB,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACxC,YAAY,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE;oBAC7E,KAAK,EAAE,QAAQ;iBAChB,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACxC,IAAI,UAAU,CAAC,QAAQ,CAAC;oBAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;gBAC/C,IAAI,CAAC;oBACH,YAAY,CAAC,QAAQ,EAAE,CAAC,WAAW,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACtE,CAAC;gBAAC,MAAM,CAAC;oBACP,0BAA0B;gBAC5B,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,oCAAoC;QACtC,CAAC;IACH,CAAC;IACD,IAAI,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,UAAU,CAAC,aAAa,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe;IAC7B,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,CAAC,GAAG,YAAY,CAAC,cAAc,CAAC,IAAI,aAAa,CAAC,eAAe,CAAC,CAAC;QACzE,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,YAAY,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5D,OAAO,CAAC,IAAI,IAAI,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,kBAAkB;IAChC,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClC,YAAY,CAAC,UAAU,EAAE,CAAC,yBAAyB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE;gBACzF,KAAK,EAAE,QAAQ;aAChB,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACxC,YAAY,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE;gBACpF,KAAK,EAAE,QAAQ;aAChB,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACxC,IAAI,UAAU,CAAC,eAAe,CAAC;gBAAE,UAAU,CAAC,eAAe,CAAC,CAAC;YAC7D,IAAI,CAAC;gBACH,YAAY,CAAC,QAAQ,EAAE,CAAC,WAAW,cAAc,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC7E,CAAC;YAAC,MAAM,CAAC;gBACP,0BAA0B;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,wBAAwB;IAC1B,CAAC;IACD,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,oBAAoB,CAAC;YAAE,UAAU,CAAC,oBAAoB,CAAC,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,gBAAgB;IAC9B,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,QAAQ;IACtB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/core/wrap.js

@@ -0,0 +1,17 @@
+import { logger } from './logger.js';
+/**
+ * Command-action wrapper: funnels thrown errors through the logger and sets a
+ * non-zero exit code instead of dumping a stack trace at the user.
+ */
+export function wrap(fn) {
+    return async (...args) => {
+        try {
+            await fn(...args);
+        }
+        catch (err) {
+            logger.error(err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    };
+}
+//# sourceMappingURL=wrap.js.map

package/dist/core/wrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wrap.js","sourceRoot":"","sources":["../../src/core/wrap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC;;;GAGG;AACH,MAAM,UAAU,IAAI,CAAsB,EAAiC;IACzE,OAAO,KAAK,EAAE,GAAG,IAAO,EAAE,EAAE;QAC1B,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/index.js

@@ -0,0 +1,53 @@
+#!/usr/bin/env node
+/**
+ * `facilio` — the unified Facilio CLI.
+ *
+ * Universal commands (login / logout / whoami) live here; every product
+ * contributes a namespace via the ProductModule contract in products/types.ts:
+ *
+ *   facilio vibe …          Vibe apps (deploy / app / db / function)
+ *   facilio connections …   Facilio Connections (search / execute / link …)
+ */
+import { Command } from 'commander';
+import { createRequire } from 'node:module';
+import { logger } from './core/logger.js';
+import { wrap } from './core/wrap.js';
+import { loginCommand } from './commands/login.js';
+import { logoutCommand } from './commands/logout.js';
+import { whoamiCommand } from './commands/whoami.js';
+import { vibeProduct } from './products/vibe/index.js';
+import { connectionsProduct } from './products/connections/index.js';
+const require = createRequire(import.meta.url);
+const pkg = require('../package.json');
+/** Product registry — add a new Facilio product CLI with one entry here. */
+const PRODUCTS = [vibeProduct, connectionsProduct];
+const program = new Command();
+program
+    .name('facilio')
+    .description('Facilio CLI — one login for every Facilio product')
+    .version(pkg.version);
+program
+    .command('login')
+    .description('Sign in to Facilio — OAuth2 device flow (works over SSH / headless), or --api-key for CI. One session covers every product.')
+    .option('--server <url>', 'Pin the vibe-server URL for this session (overrides the region table)')
+    .option('--region <key>', 'Region for --api-key logins (US, UK, AE, AU, …) — resolves vibe + MCP URLs. Defaults to US.')
+    .option('--api-key <key>', 'Log in with an API key instead of the browser flow. Use `-` to read the key from stdin so it is not stored in shell history.')
+    .option('--client-id <id>', 'Override the OAuth client id (default: FACILIO_CLIENT_ID)')
+    .option('--identity-url <url>', 'Identity-service base URL (default: FACILIO_IDENTITY_URL)')
+    .action(wrap(loginCommand));
+program
+    .command('logout')
+    .description('Revoke the session server-side (best effort) and remove stored credentials')
+    .action(wrap(logoutCommand));
+program
+    .command('whoami')
+    .description('Show the currently logged-in user')
+    .action(wrap(whoamiCommand));
+for (const product of PRODUCTS) {
+    product.register(program, { version: pkg.version });
+}
+program.parseAsync(process.argv).catch((err) => {
+    logger.error(err instanceof Error ? err.message : String(err));
+    process.exit(1);
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;;GAQG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAErE,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAwB,CAAC;AAE9D,4EAA4E;AAC5E,MAAM,QAAQ,GAAoB,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;AAEpE,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAC9B,OAAO;KACJ,IAAI,CAAC,SAAS,CAAC;KACf,WAAW,CAAC,mDAAmD,CAAC;KAChE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAExB,OAAO;KACJ,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CACV,6HAA6H,CAC9H;KACA,MAAM,CAAC,gBAAgB,EAAE,uEAAuE,CAAC;KACjG,MAAM,CACL,gBAAgB,EAChB,6FAA6F,CAC9F;KACA,MAAM,CACL,iBAAiB,EACjB,8HAA8H,CAC/H;KACA,MAAM,CAAC,kBAAkB,EAAE,2DAA2D,CAAC;KACvF,MAAM,CAAC,sBAAsB,EAAE,2DAA2D,CAAC;KAC3F,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;AAE9B,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,4EAA4E,CAAC;KACzF,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;AAE/B,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,mCAAmC,CAAC;KAChD,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;AAE/B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;IAC/B,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IAC7C,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/products/connections/client.js

@@ -0,0 +1,125 @@
+/**
+ * Thin MCP client for the Facilio Connections server (Streamable HTTP).
+ *
+ * Auth model: the raw identity access token goes up as a direct bearer —
+ * the server's `FacilioOAuthProxy` accepts identity-issued JWTs alongside its
+ * own DCR/OAuth-proxy tokens, so the CLI never runs a browser OAuth dance of
+ * its own. No transparent refresh server-side on this path: on a 401 the CLI
+ * refreshes against identity-service once (same semantics as core/api.ts)
+ * and retries.
+ */
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import { loadCredentials, refreshCredentials, SessionExpiredError, } from '../../core/credentials.js';
+import { mcpUrlFor } from '../../core/regions.js';
+/**
+ * `/mcp` → `/<slug>/mcp` on the same host, preserving any path prefix in
+ * front of the `/mcp` segment (reverse proxies may mount the server deeper).
+ */
+export function resolveMcpUrl(base, app) {
+    const normalized = base.replace(/\/+$/, '');
+    if (!app)
+        return normalized;
+    const u = new URL(normalized);
+    if (!/\/mcp$/.test(u.pathname)) {
+        throw new Error(`MCP URL must end in /mcp to be connection-scoped (got ${base}).`);
+    }
+    u.pathname = `${u.pathname.replace(/\/mcp$/, '')}/${app}/mcp`;
+    return u.toString();
+}
+/** Load stored credentials and insist on an OAuth (refreshable) session. */
+async function requireOAuthCredentials() {
+    const creds = await loadCredentials();
+    if (!creds) {
+        throw new Error('Not logged in. Run `facilio login` first.');
+    }
+    if (creds.apiKey && !creds.accessToken) {
+        throw new Error('`facilio connections` requires a browser sign-in (OAuth). API-key sessions only cover vibe commands — run `facilio login` without --api-key.');
+    }
+    return creds;
+}
+function is401(err) {
+    if (!(err instanceof Error))
+        return false;
+    const code = err.code;
+    if (code === 401)
+        return true;
+    return /\b401\b|unauthorized/i.test(err.message);
+}
+const PROACTIVE_REFRESH_SKEW_MS = 60_000;
+/**
+ * One tool call = one short-lived MCP session (the server runs stateless
+ * HTTP, so this is cheap and avoids keeping sockets open between commands).
+ * Returns the tool's structured payload.
+ */
+export async function callConnectionsTool(opts, toolName, args) {
+    let creds = await requireOAuthCredentials();
+    const canRefresh = !!creds.refreshToken && !!creds.tokenUrl && !!creds.clientId;
+    if (canRefresh &&
+        creds.expiresAt &&
+        creds.expiresAt - Date.now() < PROACTIVE_REFRESH_SKEW_MS) {
+        try {
+            creds = await refreshCredentials(creds);
+        }
+        catch (err) {
+            if (err instanceof SessionExpiredError)
+                throw err;
+            // Transient refresh failure — try the call with the stale token; the
+            // reactive 401 path below is the safety net.
+        }
+    }
+    // --mcp-url flag → FACILIO_MCP_URL env → region table → default.
+    const url = resolveMcpUrl(opts.mcpUrl || mcpUrlFor(creds.region), opts.app);
+    try {
+        return await callOnce(url, creds, opts.version, toolName, args);
+    }
+    catch (err) {
+        if (is401(err) && canRefresh) {
+            creds = await refreshCredentials(creds);
+            return await callOnce(url, creds, opts.version, toolName, args);
+        }
+        throw err;
+    }
+}
+async function callOnce(url, creds, version, toolName, args) {
+    const transport = new StreamableHTTPClientTransport(new URL(url), {
+        requestInit: {
+            headers: { authorization: `Bearer ${creds.accessToken}` },
+        },
+    });
+    const client = new Client({ name: 'facilio-cli', version });
+    try {
+        await client.connect(transport);
+        // Server tools take a single pydantic `payload` parameter.
+        const res = await client.callTool({ name: toolName, arguments: { payload: args } });
+        return parseToolResult(toolName, res);
+    }
+    finally {
+        await client.close().catch(() => {
+            /* socket already gone — fine */
+        });
+    }
+}
+/**
+ * FastMCP returns pydantic outputs both as `structuredContent` and as a JSON
+ * text block; prefer the structured form, fall back to parsing the text.
+ */
+export function parseToolResult(toolName, res) {
+    const text = res.content?.find((c) => c.type === 'text')?.text;
+    if (res.isError) {
+        throw new Error(`${toolName} failed: ${text || 'unknown tool error'}`);
+    }
+    if (res.structuredContent !== undefined && res.structuredContent !== null) {
+        return res.structuredContent;
+    }
+    if (text) {
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            return text;
+        }
+    }
+    throw new Error(`${toolName} returned no content.`);
+}
+//# sourceMappingURL=client.js.map

package/dist/products/connections/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../src/products/connections/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,mBAAmB,GAEpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAWlD;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,GAAY;IACtD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5C,IAAI,CAAC,GAAG;QAAE,OAAO,UAAU,CAAC;IAC5B,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAC9B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,yDAAyD,IAAI,IAAI,CAAC,CAAC;IACrF,CAAC;IACD,CAAC,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,GAAG,MAAM,CAAC;IAC9D,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;AACtB,CAAC;AAED,4EAA4E;AAC5E,KAAK,UAAU,uBAAuB;IACpC,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAC;IACtC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,8IAA8I,CAC/I,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,KAAK,CAAC,GAAY;IACzB,IAAI,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,IAAI,GAAI,GAA0B,CAAC,IAAI,CAAC;IAC9C,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC9B,OAAO,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAEzC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAA4B,EAC5B,QAAgB,EAChB,IAA6B;IAE7B,IAAI,KAAK,GAAG,MAAM,uBAAuB,EAAE,CAAC;IAE5C,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;IAChF,IACE,UAAU;QACV,KAAK,CAAC,SAAS;QACf,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,yBAAyB,EACxD,CAAC;QACD,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,mBAAmB;gBAAE,MAAM,GAAG,CAAC;YAClD,qEAAqE;YACrE,6CAA6C;QAC/C,CAAC;IACH,CAAC;IAED,iEAAiE;IACjE,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,IAAI,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5E,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAI,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,UAAU,EAAE,CAAC;YAC7B,KAAK,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,CAAC;YACxC,OAAO,MAAM,QAAQ,CAAI,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,GAAW,EACX,KAAkB,EAClB,OAAe,EACf,QAAgB,EAChB,IAA6B;IAE7B,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE;QAChE,WAAW,EAAE;YACX,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,WAAW,EAAE,EAAE;SAC1D;KACF,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,2DAA2D;QAC3D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QACpF,OAAO,eAAe,CAAI,QAAQ,EAAE,GAAqB,CAAC,CAAC;IAC7D,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;YAC9B,gCAAgC;QAClC,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAQD;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAI,QAAgB,EAAE,GAAmB;IACtE,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,IAAI,CAAC;IAC/D,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,YAAY,IAAI,IAAI,oBAAoB,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS,IAAI,GAAG,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC1E,OAAO,GAAG,CAAC,iBAAsB,CAAC;IACpC,CAAC;IACD,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAoB,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,uBAAuB,CAAC,CAAC;AACtD,CAAC"}