@undefineds.co/xpod 0.3.14 → 0.3.16

package/config/local.json

@@ -21,12 +21,12 @@
       }
     },
     {
-      "comment": "定义 oidcIssuer 变量（外部 IdP 基础 URL），设置后启用 SP 模式",
+      "comment": "定义 oidcIssuer 变量（外部 OIDC issuer 基础 URL），设置后本地仍提供 account/consent/SP 页面",
       "@id": "urn:solid-server:default:variable:oidcIssuer",
       "@type": "Variable"
     },
     {
-      "comment": "Auto-detect OIDC Handler - 有 oidcIssuer 时启用 SP 模式，代理 JWKS",
+      "comment": "Auto-detect OIDC Handler - 有 oidcIssuer 时代理外部 issuer 的 JWKS，其它 OIDC 路由保持 CSS 本地处理",
       "@id": "urn:undefineds:xpod:AutoDetectOidcHandler",
       "@type": "AutoDetectOidcHandler",
       "AutoDetectOidcHandler:_options_oidcIssuer": {
@@ -35,7 +35,7 @@
       "AutoDetectOidcHandler:_options_cacheMs": 300000
     },
     {
-      "comment": "原始 IdentityProviderHandler 实例（用于标准模式委托）",
+      "comment": "CSS 原生 IdentityProvider parsing handler，始终用于本地 account/consent/WebID 选择页面",
       "@id": "urn:undefineds:xpod:SourceIdentityProviderHandler",
       "@type": "RouterHandler",
       "baseUrl": {
@@ -52,7 +52,7 @@
       }
     },
     {
-      "comment": "Auto-detect Identity Provider Handler - 有 oidcIssuer 时禁用本地账户管理",
+      "comment": "Auto-detect Identity Provider Handler - 有 oidcIssuer 时仍委托本地 account/consent，避免 Local 登录漏到 Cloud Pod",
       "@id": "urn:undefineds:xpod:AutoDetectIdentityProviderHandler",
       "@type": "AutoDetectIdentityProviderHandler",
       "AutoDetectIdentityProviderHandler:_options_oidcIssuer": {
@@ -313,7 +313,7 @@
             "@id": "urn:solid-server:default:StaticAssetHandler"
           },
           {
-            "comment": "SP 模式下代理 JWKS，标准模式下透传",
+            "comment": "Local 模式下代理外部 issuer JWKS；其它 OIDC 路由由 CSS 默认 OIDC handler 处理",
             "@id": "urn:undefineds:xpod:AutoDetectOidcHandler"
           },
           {

package/config/xpod.json

@@ -11,12 +11,12 @@
   ],
   "@graph": [
     {
-      "comment": "Xpod 统一配置 - 通过环境变量切换 Cloud/SP 模式",
+      "comment": "Xpod 统一配置 - 通过环境变量切换 Cloud/Local/Standalone 模式",
       "@id": "urn:undefineds:xpod:Config",
       "@type": "Void"
     },
     {
-      "comment": "定义 oidcIssuer 变量（外部 IdP 基础 URL）- SP 模式必填",
+      "comment": "定义 oidcIssuer 变量（外部 OIDC issuer 基础 URL）；Local 模式仍由本地提供 account/consent/SP 页面",
       "@id": "urn:solid-server:default:variable:oidcIssuer",
       "@type": "Variable"
     },
@@ -52,7 +52,7 @@
       }
     },
     {
-      "comment": "Auto-detect OIDC Handler - 有 oidcIssuer 时启用 SP 模式",
+      "comment": "Auto-detect OIDC Handler - 有 oidcIssuer 时代理外部 issuer 的 JWKS，其它 OIDC 路由保持 CSS 本地处理",
       "@id": "urn:undefineds:xpod:AutoDetectOidcHandler",
       "@type": "AutoDetectOidcHandler",
       "options_oidcIssuer": {
@@ -61,13 +61,20 @@
       "options_cacheMs": 300000
     },
     {
-      "comment": "Override: 使用 AutoDetectOidcHandler 替换默认 OidcHandler",
-      "@type": "Override",
-      "overrideInstance": {
-        "@id": "urn:solid-server:default:OidcHandler"
+      "comment": "CSS 原生 IdentityProvider parsing handler，始终用于本地 account/consent/WebID 选择页面",
+      "@id": "urn:undefineds:xpod:SourceIdentityProviderHandler",
+      "@type": "RouterHandler",
+      "baseUrl": {
+        "@id": "urn:solid-server:default:variable:baseUrl"
       },
-      "overrideParameters": {
-        "@id": "urn:undefineds:xpod:AutoDetectOidcHandler"
+      "targetExtractor": {
+        "@id": "urn:solid-server:default:TargetExtractor"
+      },
+      "allowedPathNames": [
+        "^/.account(/.*)?$"
+      ],
+      "handler": {
+        "@id": "urn:solid-server:default:IdentityProviderParsingHandler"
       }
     },
     {
@@ -76,6 +83,9 @@
       "@type": "AutoDetectIdentityProviderHandler",
       "options_oidcIssuer": {
         "@id": "urn:solid-server:default:variable:oidcIssuer"
+      },
+      "options_source": {
+        "@id": "urn:undefineds:xpod:SourceIdentityProviderHandler"
       }
     },
     {
@@ -207,7 +217,7 @@
       }
     },
     {
-      "comment": "注册开关 - Cloud 模式启用，SP 模式禁用",
+      "comment": "注册开关 - Cloud/Standalone 可启用，Local 由本地 account/consent 流程决定",
       "@id": "urn:solid-server:default:variable:registration",
       "@type": "Variable"
     },
@@ -223,6 +233,10 @@
           { "@id": "urn:undefineds:xpod:TerminalHttpHandler" },
           { "@id": "urn:undefineds:xpod:AppStaticAssetHandler" },
           { "@id": "urn:solid-server:default:StaticAssetHandler" },
+          {
+            "comment": "Local 模式下代理外部 issuer JWKS；其它 OIDC 路由由 CSS 默认 OIDC handler 处理",
+            "@id": "urn:undefineds:xpod:AutoDetectOidcHandler"
+          },
           { "@id": "urn:solid-server:default:OidcHandler" },
           { "@id": "urn:solid-server:default:NotificationHttpHandler" },
           { "@id": "urn:solid-server:default:StorageDescriptionHandler" },

package/dist/cli/commands/auth.d.ts

@@ -1,6 +1,7 @@
 import type { CommandModule } from 'yargs';
 interface AuthArgs {
     url: string;
+    json?: boolean;
 }
 export declare const authCommand: CommandModule<object, AuthArgs>;
 export {};

package/dist/cli/commands/auth.js

@@ -4,21 +4,40 @@ exports.authCommand = void 0;
 const css_account_1 = require("../lib/css-account");
 const credentials_store_1 = require("../lib/credentials-store");
 const prompt_1 = require("../lib/prompt");
+const auth_context_1 = require("../lib/auth-context");
+const output_1 = require("../lib/output");
 function resolveUrl(url) {
     const raw = url || process.env.CSS_BASE_URL || 'http://localhost:3000';
     return raw.endsWith('/') ? raw : `${raw}/`;
 }
+async function resolveExplicitWebId(input) {
+    if (input.explicitWebId) {
+        return input.explicitWebId;
+    }
+    const accountData = await (0, css_account_1.getAccountData)(input.token, input.baseUrl);
+    const webIds = accountData ? Object.keys(accountData.webIds) : [];
+    if (webIds.length === 1 && webIds[0]) {
+        return webIds[0];
+    }
+    if (webIds.length > 1) {
+        throw new output_1.CliCommandError('webid_ambiguous', 'Multiple WebIDs are configured. Re-run with --web-id to select the acting identity.', 2, { webIds });
+    }
+    throw new output_1.CliCommandError('webid_missing', 'No WebID found. Specify --web-id explicitly.', 2);
+}
 const loginCommand = {
     command: 'login',
-    describe: 'Login and get an account token',
+    describe: 'Login and store CLI client credentials',
     builder: (yargs) => yargs
+        .option('issuer', { type: 'string', description: 'Issuer/base URL alias for --url' })
         .option('email', { type: 'string', description: 'Account email (will prompt if not provided)' })
-        .option('password', { type: 'string', description: 'Account password (will prompt securely if not provided)' }),
+        .option('password', { type: 'string', description: 'Account password (will prompt securely if not provided)' })
+        .option('web-id', { type: 'string', description: 'WebID to bind credentials to when multiple identities exist' })
+        .option('json', { type: 'boolean', default: false, description: 'Output JSON envelope' }),
     handler: async (argv) => {
-        const baseUrl = resolveUrl(argv.url);
+        const baseUrl = resolveUrl(argv.issuer ?? argv.url);
         if (!(await (0, css_account_1.checkServer)(baseUrl))) {
-            console.error(`Cannot reach server at ${baseUrl}`);
-            process.exit(1);
+            const error = new Error(`Cannot reach server at ${baseUrl}`);
+            (0, output_1.handleCliError)(error, argv.json === true, 'server_unreachable');
         }
         // Prompt for email if not provided
         let email = argv.email;
@@ -40,11 +59,38 @@ const loginCommand = {
         }
         const token = await (0, css_account_1.login)(email, password, baseUrl);
         if (!token) {
-            console.error('Login failed. Check email/password.');
-            process.exit(1);
+            (0, output_1.handleCliError)(new Error('Login failed. Check email/password.'), argv.json === true, 'auth_failed');
+        }
+        const controls = await (0, css_account_1.getAccountControls)(token, baseUrl);
+        if (!controls?.clientCredentials) {
+            (0, output_1.handleCliError)(new Error('Cannot find client credentials endpoint.'), argv.json === true, 'credentials_endpoint_missing');
         }
-        console.log('Login successful.');
-        console.log(`Token: ${token}`);
+        const webId = await resolveExplicitWebId({
+            token,
+            baseUrl,
+            explicitWebId: argv['web-id'],
+        }).catch((error) => (0, output_1.handleCliError)(error, argv.json === true));
+        const cred = await (0, css_account_1.createClientCredentials)(token, controls.clientCredentials, webId, 'xpod-cli');
+        if (!cred) {
+            (0, output_1.handleCliError)(new Error('Failed to create credentials.'), argv.json === true, 'credentials_create_failed');
+        }
+        (0, credentials_store_1.saveCredentials)({
+            url: baseUrl,
+            webId,
+            authType: 'client_credentials',
+            secrets: {
+                clientId: cred.id,
+                clientSecret: cred.secret ?? '',
+            },
+        });
+        const data = { baseUrl, webId, configPath: (0, credentials_store_1.getConfigPath)() };
+        if (argv.json) {
+            (0, output_1.writeJsonResult)(data);
+            return;
+        }
+        console.log('Login successful. Credentials saved.');
+        console.log(`  webId: ${webId}`);
+        console.log(`  config: ${(0, credentials_store_1.getConfigPath)().replace('/config.json', '/')}`);
     },
 };
 const createCredentialsCommand = {
@@ -55,7 +101,7 @@ const createCredentialsCommand = {
         .option('password', { type: 'string', description: 'Account password (will prompt securely if not provided)' })
         .option('web-id', { type: 'string', description: 'WebID to bind credentials to' })
         .option('name', { type: 'string', description: 'Credential label' })
-        .option('output', { type: 'boolean', default: false, description: 'Print credentials to terminal instead of saving to ~/.xpod/' }),
+        .option('output', { type: 'boolean', default: false, description: 'Do not save credentials; print non-secret metadata only' }),
     handler: async (argv) => {
         const baseUrl = resolveUrl(argv.url);
         if (!(await (0, css_account_1.checkServer)(baseUrl))) {
@@ -90,39 +136,22 @@ const createCredentialsCommand = {
             console.error('Cannot find client credentials endpoint.');
             process.exit(1);
         }
-        // Determine WebID: explicit flag > first pod's profile
-        let webId = argv['web-id'];
-        if (!webId) {
-            // Try to discover from account info
-            const accountRes = await fetch(`${baseUrl}.account/`, {
-                headers: {
-                    Accept: 'application/json',
-                    Authorization: `CSS-Account-Token ${token}`,
-                },
+        let webId;
+        try {
+            webId = await resolveExplicitWebId({
+                token,
+                baseUrl,
+                explicitWebId: argv['web-id'],
             });
-            if (accountRes.ok) {
-                const accountData = (await accountRes.json());
-                const webIds = accountData.webIds;
-                if (webIds && typeof webIds === 'object') {
-                    const firstUrl = Object.keys(webIds)[0];
-                    if (firstUrl)
-                        webId = firstUrl;
-                }
-            }
         }
-        if (!webId) {
-            console.error('No WebID found. Specify --web-id explicitly.');
-            process.exit(1);
+        catch (error) {
+            (0, output_1.handleCliError)(error, false);
         }
         const cred = await (0, css_account_1.createClientCredentials)(token, controls.clientCredentials, webId, argv.name);
         if (!cred) {
             console.error('Failed to create credentials.');
             process.exit(1);
         }
-        console.log('Credentials created:');
-        console.log(`  client_id:     ${cred.id}`);
-        console.log(`  client_secret: ${cred.secret}`);
-        console.log(`  webId:         ${webId}`);
         if (!argv.output) {
             (0, credentials_store_1.saveCredentials)({
                 url: baseUrl,
@@ -137,6 +166,11 @@ const createCredentialsCommand = {
             console.log('\n✓ Setup complete! You can now use xpod commands without entering password.');
             console.log('  Example: xpod backup export');
         }
+        else {
+            console.log('Credentials created.');
+        }
+        console.log(`  client_id: ${cred.id}`);
+        console.log(`  webId:     ${webId}`);
     },
 };
 const listCommand = {
@@ -236,12 +270,56 @@ const revokeCommand = {
 const logoutCommand = {
     command: 'logout',
     describe: 'Remove stored credentials from ~/.xpod/',
-    builder: (yargs) => yargs,
-    handler: async () => {
+    builder: (yargs) => yargs.option('json', { type: 'boolean', default: false, description: 'Output JSON envelope' }),
+    handler: async (argv) => {
         (0, credentials_store_1.clearCredentials)();
+        if (argv.json) {
+            (0, output_1.writeJsonResult)({ authenticated: false });
+            return;
+        }
         console.log('Credentials removed.');
     },
 };
+const statusCommand = {
+    command: 'status',
+    describe: 'Show stored authentication status',
+    builder: (yargs) => yargs.option('json', { type: 'boolean', default: false, description: 'Output JSON envelope' }),
+    handler: async (argv) => {
+        const status = (0, auth_context_1.getStoredAuthStatus)(argv.url);
+        if (argv.json) {
+            (0, output_1.writeJsonResult)(status);
+            return;
+        }
+        if (!status.authenticated) {
+            console.log('Not authenticated. Run `xpod auth login`.');
+            return;
+        }
+        console.log('Authenticated.');
+        console.log(`  webId:   ${status.webId}`);
+        console.log(`  podRoot: ${status.podRoot}`);
+        console.log(`  server:  ${status.baseUrl}`);
+    },
+};
+const whoamiCommand = {
+    command: 'whoami',
+    describe: 'Show acting WebID and Pod root',
+    builder: (yargs) => yargs.option('json', { type: 'boolean', default: false, description: 'Output JSON envelope' }),
+    handler: async (argv) => {
+        const status = (0, auth_context_1.getStoredAuthStatus)(argv.url);
+        if (!status.authenticated) {
+            if (argv.json) {
+                (0, output_1.handleCliError)(new output_1.CliCommandError('auth_required', 'No credentials found. Run `xpod auth login` first.', 2), true);
+            }
+            console.log('Not authenticated. Run `xpod auth login`.');
+            return;
+        }
+        if (argv.json) {
+            (0, output_1.writeJsonResult)(status);
+            return;
+        }
+        console.log(status.webId);
+    },
+};
 exports.authCommand = {
     command: 'auth',
     describe: 'Authentication and credential management',
@@ -252,9 +330,11 @@ exports.authCommand = {
         description: 'Server base URL',
         default: process.env.CSS_BASE_URL || 'http://localhost:3000',
     })
+        .command(statusCommand)
         .command(loginCommand)
         .command(createCredentialsCommand)
         .command(logoutCommand)
+        .command(whoamiCommand)
         .command(listCommand)
         .command(revokeCommand)
         .demandCommand(1, 'Please specify an auth subcommand'),

package/dist/cli/commands/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/cli/commands/auth.ts"],"names":[],"mappings":";;;AACA,oDAO4B;AAC5B,gEAA4F;AAC5F,0CAA2D;AA8B3D,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,GAAG,GAAG,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,uBAAuB,CAAC;IACvE,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC;AAC7C,CAAC;AAED,MAAM,YAAY,GAAuC;IACvD,OAAO,EAAE,OAAO;IAChB,QAAQ,EAAE,gCAAgC;IAC1C,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,KAAK;SACF,MAAM,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,6CAA6C,EAAE,CAAC;SAC/F,MAAM,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,yDAAyD,EAAE,CAAC;IACnH,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACtB,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAErC,IAAI,CAAC,CAAC,MAAM,IAAA,yBAAW,EAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,KAAK,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;YACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,mCAAmC;QACnC,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACvB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,MAAM,IAAA,mBAAU,EAAC,SAAS,CAAC,CAAC;YACpC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;gBACnC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,qDAAqD;QACrD,IAAI,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC7B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,QAAQ,GAAG,MAAM,IAAA,uBAAc,EAAC,YAAY,CAAC,CAAC;YAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;gBACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAA,mBAAK,EAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACrD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC;IACjC,CAAC;CACF,CAAC;AAEF,MAAM,wBAAwB,GAAmD;IAC/E,OAAO,EAAE,oBAAoB;IAC7B,QAAQ,EAAE,8CAA8C;IACxD,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,KAAK;SACF,MAAM,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,6CAA6C,EAAE,CAAC;SAC/F,MAAM,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,yDAAyD,EAAE,CAAC;SAC9G,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,8BAA8B,EAAE,CAAC;SACjF,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;SACnE,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,6DAA6D,EAAE,CAAC;IACtI,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACtB,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAErC,IAAI,CAAC,CAAC,MAAM,IAAA,yBAAW,EAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,KAAK,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;YACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,mCAAmC;QACnC,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACvB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,MAAM,IAAA,mBAAU,EAAC,SAAS,CAAC,CAAC;YACpC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;gBACnC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,qDAAqD;QACrD,IAAI,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC7B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,QAAQ,GAAG,MAAM,IAAA,uBAAc,EAAC,YAAY,CAAC,CAAC;YAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;gBACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAA,mBAAK,EAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAA,gCAAkB,EAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ,EAAE,iBAAiB,EAAE,CAAC;YACjC,OAAO,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;YAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,uDAAuD;QACvD,IAAI,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,oCAAoC;YACpC,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,WAAW,EAAE;gBACpD,OAAO,EAAE;oBACP,MAAM,EAAE,kBAAkB;oBAC1B,aAAa,EAAE,qBAAqB,KAAK,EAAE;iBAC5C;aACF,CAAC,CAAC;YACH,IAAI,UAAU,CAAC,EAAE,EAAE,CAAC;gBAClB,MAAM,WAAW,GAAG,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,CAAwC,CAAC;gBACrF,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC;gBAClC,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;oBACzC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;oBACxC,IAAI,QAAQ;wBAAE,KAAK,GAAG,QAAQ,CAAC;gBACjC,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;YAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAA,qCAAuB,EAAC,KAAK,EAAE,QAAQ,CAAC,iBAAiB,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAChG,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;YAC/C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,EAAE,CAAC,CAAC;QAEzC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,IAAA,mCAAe,EAAC;gBACd,GAAG,EAAE,OAAO;gBACZ,KAAK;gBACL,QAAQ,EAAE,oBAAoB;gBAC9B,OAAO,EAAE;oBACP,QAAQ,EAAE,IAAI,CAAC,EAAE;oBACjB,YAAY,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;iBAChC;aACF,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,cAAc,IAAA,iCAAa,GAAE,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YAC1E,OAAO,CAAC,GAAG,CAAC,8EAA8E,CAAC,CAAC;YAC5F,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;CACF,CAAC;AAEF,MAAM,WAAW,GAAsC;IACrD,OAAO,EAAE,MAAM;IACf,QAAQ,EAAE,yBAAyB;IACnC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,KAAK;SACF,MAAM,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,6CAA6C,EAAE,CAAC;SAC/F,MAAM,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,yDAAyD,EAAE,CAAC;IACnH,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACtB,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAErC,IAAI,CAAC,CAAC,MAAM,IAAA,yBAAW,EAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,KAAK,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;YACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,mCAAmC;QACnC,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACvB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,MAAM,IAAA,mBAAU,EAAC,SAAS,CAAC,CAAC;YACpC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;gBACnC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,qDAAqD;QACrD,IAAI,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC7B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,QAAQ,GAAG,MAAM,IAAA,uBAAc,EAAC,YAAY,CAAC,CAAC;YAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;gBACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAA,mBAAK,EAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAA,mCAAqB,EAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC1D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;YAC5C,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,SAAS,KAAK,CAAC,MAAM,mBAAmB,CAAC,CAAC;QACtD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACzB,IAAI,CAAC,CAAC,KAAK;gBAAE,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;CACF,CAAC;AAEF,MAAM,aAAa,GAAwC;IACzD,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,4BAA4B;IACtC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,KAAK;SACF,MAAM,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,6CAA6C,EAAE,CAAC;SAC/F,MAAM,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,yDAAyD,EAAE,CAAC;SAC9G,MAAM,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,qBAAqB,EAAE,CAAC;IACpG,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACtB,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAErC,IAAI,CAAC,CAAC,MAAM,IAAA,yBAAW,EAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,KAAK,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;YACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,mCAAmC;QACnC,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACvB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,MAAM,IAAA,mBAAU,EAAC,SAAS,CAAC,CAAC;YACpC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;gBACnC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,qDAAqD;QACrD,IAAI,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC7B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,QAAQ,GAAG,MAAM,IAAA,uBAAc,EAAC,YAAY,CAAC,CAAC;YAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;gBACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAA,mBAAK,EAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,IAAA,oCAAsB,EAAC,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,CAAC;QAC3E,IAAI,EAAE,EAAE,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QAC1D,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,+BAA+B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACnE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;CACF,CAAC;AAEF,MAAM,aAAa,GAAsC;IACvD,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,yCAAyC;IACnD,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;IACzB,OAAO,EAAE,KAAK,IAAI,EAAE;QAClB,IAAA,oCAAgB,GAAE,CAAC;QACnB,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACtC,CAAC;CACF,CAAC;AAEW,QAAA,WAAW,GAAoC;IAC1D,OAAO,EAAE,MAAM;IACf,QAAQ,EAAE,0CAA0C;IACpD,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,KAAK;SACF,MAAM,CAAC,KAAK,EAAE;QACb,KAAK,EAAE,GAAG;QACV,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,iBAAiB;QAC9B,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,uBAAuB;KAC7D,CAAC;SACD,OAAO,CAAC,YAAY,CAAC;SACrB,OAAO,CAAC,wBAAwB,CAAC;SACjC,OAAO,CAAC,aAAa,CAAC;SACtB,OAAO,CAAC,WAAW,CAAC;SACpB,OAAO,CAAC,aAAa,CAAC;SACtB,aAAa,CAAC,CAAC,EAAE,mCAAmC,CAAC;IAC1D,OAAO,EAAE,GAAG,EAAE;QACZ,wBAAwB;IAC1B,CAAC;CACF,CAAC","sourcesContent":["import type { CommandModule } from 'yargs';\nimport {\n  checkServer,\n  login,\n  getAccountControls,\n  createClientCredentials,\n  listClientCredentials,\n  revokeClientCredential,\n} from '../lib/css-account';\nimport { saveCredentials, clearCredentials, getConfigPath } from '../lib/credentials-store';\nimport { promptPassword, promptText } from '../lib/prompt';\n\ninterface AuthArgs {\n  url: string;\n}\n\ninterface LoginArgs extends AuthArgs {\n  email?: string;\n  password?: string;\n}\n\ninterface CreateCredentialsArgs extends AuthArgs {\n  email?: string;\n  password?: string;\n  'web-id'?: string;\n  name?: string;\n  output?: boolean;\n}\n\ninterface ListArgs extends AuthArgs {\n  email?: string;\n  password?: string;\n}\n\ninterface RevokeArgs extends AuthArgs {\n  email?: string;\n  password?: string;\n  'client-id': string;\n}\n\nfunction resolveUrl(url: string): string {\n  const raw = url || process.env.CSS_BASE_URL || 'http://localhost:3000';\n  return raw.endsWith('/') ? raw : `${raw}/`;\n}\n\nconst loginCommand: CommandModule<AuthArgs, LoginArgs> = {\n  command: 'login',\n  describe: 'Login and get an account token',\n  builder: (yargs) =>\n    yargs\n      .option('email', { type: 'string', description: 'Account email (will prompt if not provided)' })\n      .option('password', { type: 'string', description: 'Account password (will prompt securely if not provided)' }),\n  handler: async (argv) => {\n    const baseUrl = resolveUrl(argv.url);\n\n    if (!(await checkServer(baseUrl))) {\n      console.error(`Cannot reach server at ${baseUrl}`);\n      process.exit(1);\n    }\n\n    // Prompt for email if not provided\n    let email = argv.email;\n    if (!email) {\n      email = await promptText('Email: ');\n      if (!email) {\n        console.error('Email is required');\n        process.exit(1);\n      }\n    }\n\n    // Prompt for password if not provided (secure input)\n    let password = argv.password;\n    if (!password) {\n      password = await promptPassword('Password: ');\n      if (!password) {\n        console.error('Password is required');\n        process.exit(1);\n      }\n    }\n\n    const token = await login(email, password, baseUrl);\n    if (!token) {\n      console.error('Login failed. Check email/password.');\n      process.exit(1);\n    }\n\n    console.log('Login successful.');\n    console.log(`Token: ${token}`);\n  },\n};\n\nconst createCredentialsCommand: CommandModule<AuthArgs, CreateCredentialsArgs> = {\n  command: 'create-credentials',\n  describe: 'Create client credentials (client_id/secret)',\n  builder: (yargs) =>\n    yargs\n      .option('email', { type: 'string', description: 'Account email (will prompt if not provided)' })\n      .option('password', { type: 'string', description: 'Account password (will prompt securely if not provided)' })\n      .option('web-id', { type: 'string', description: 'WebID to bind credentials to' })\n      .option('name', { type: 'string', description: 'Credential label' })\n      .option('output', { type: 'boolean', default: false, description: 'Print credentials to terminal instead of saving to ~/.xpod/' }),\n  handler: async (argv) => {\n    const baseUrl = resolveUrl(argv.url);\n\n    if (!(await checkServer(baseUrl))) {\n      console.error(`Cannot reach server at ${baseUrl}`);\n      process.exit(1);\n    }\n\n    // Prompt for email if not provided\n    let email = argv.email;\n    if (!email) {\n      email = await promptText('Email: ');\n      if (!email) {\n        console.error('Email is required');\n        process.exit(1);\n      }\n    }\n\n    // Prompt for password if not provided (secure input)\n    let password = argv.password;\n    if (!password) {\n      password = await promptPassword('Password: ');\n      if (!password) {\n        console.error('Password is required');\n        process.exit(1);\n      }\n    }\n\n    const token = await login(email, password, baseUrl);\n    if (!token) {\n      console.error('Login failed.');\n      process.exit(1);\n    }\n\n    const controls = await getAccountControls(token, baseUrl);\n    if (!controls?.clientCredentials) {\n      console.error('Cannot find client credentials endpoint.');\n      process.exit(1);\n    }\n\n    // Determine WebID: explicit flag > first pod's profile\n    let webId = argv['web-id'];\n    if (!webId) {\n      // Try to discover from account info\n      const accountRes = await fetch(`${baseUrl}.account/`, {\n        headers: {\n          Accept: 'application/json',\n          Authorization: `CSS-Account-Token ${token}`,\n        },\n      });\n      if (accountRes.ok) {\n        const accountData = (await accountRes.json()) as { webIds?: Record<string, string> };\n        const webIds = accountData.webIds;\n        if (webIds && typeof webIds === 'object') {\n          const firstUrl = Object.keys(webIds)[0];\n          if (firstUrl) webId = firstUrl;\n        }\n      }\n    }\n\n    if (!webId) {\n      console.error('No WebID found. Specify --web-id explicitly.');\n      process.exit(1);\n    }\n\n    const cred = await createClientCredentials(token, controls.clientCredentials, webId, argv.name);\n    if (!cred) {\n      console.error('Failed to create credentials.');\n      process.exit(1);\n    }\n\n    console.log('Credentials created:');\n    console.log(`  client_id:     ${cred.id}`);\n    console.log(`  client_secret: ${cred.secret}`);\n    console.log(`  webId:         ${webId}`);\n\n    if (!argv.output) {\n      saveCredentials({\n        url: baseUrl,\n        webId,\n        authType: 'client_credentials',\n        secrets: {\n          clientId: cred.id,\n          clientSecret: cred.secret ?? '',\n        },\n      });\n      console.log(`\\nSaved to ${getConfigPath().replace('/config.json', '/')}`);\n      console.log('\\n✓ Setup complete! You can now use xpod commands without entering password.');\n      console.log('  Example: xpod backup export');\n    }\n  },\n};\n\nconst listCommand: CommandModule<AuthArgs, ListArgs> = {\n  command: 'list',\n  describe: 'List client credentials',\n  builder: (yargs) =>\n    yargs\n      .option('email', { type: 'string', description: 'Account email (will prompt if not provided)' })\n      .option('password', { type: 'string', description: 'Account password (will prompt securely if not provided)' }),\n  handler: async (argv) => {\n    const baseUrl = resolveUrl(argv.url);\n\n    if (!(await checkServer(baseUrl))) {\n      console.error(`Cannot reach server at ${baseUrl}`);\n      process.exit(1);\n    }\n\n    // Prompt for email if not provided\n    let email = argv.email;\n    if (!email) {\n      email = await promptText('Email: ');\n      if (!email) {\n        console.error('Email is required');\n        process.exit(1);\n      }\n    }\n\n    // Prompt for password if not provided (secure input)\n    let password = argv.password;\n    if (!password) {\n      password = await promptPassword('Password: ');\n      if (!password) {\n        console.error('Password is required');\n        process.exit(1);\n      }\n    }\n\n    const token = await login(email, password, baseUrl);\n    if (!token) {\n      console.error('Login failed.');\n      process.exit(1);\n    }\n\n    const creds = await listClientCredentials(token, baseUrl);\n    if (creds.length === 0) {\n      console.log('No client credentials found.');\n      return;\n    }\n\n    console.log(`Found ${creds.length} credential(s):\\n`);\n    for (const c of creds) {\n      console.log(`  ${c.id}`);\n      if (c.webId) console.log(`    webId: ${c.webId}`);\n    }\n  },\n};\n\nconst revokeCommand: CommandModule<AuthArgs, RevokeArgs> = {\n  command: 'revoke',\n  describe: 'Revoke a client credential',\n  builder: (yargs) =>\n    yargs\n      .option('email', { type: 'string', description: 'Account email (will prompt if not provided)' })\n      .option('password', { type: 'string', description: 'Account password (will prompt securely if not provided)' })\n      .option('client-id', { type: 'string', demandOption: true, description: 'Client ID to revoke' }),\n  handler: async (argv) => {\n    const baseUrl = resolveUrl(argv.url);\n\n    if (!(await checkServer(baseUrl))) {\n      console.error(`Cannot reach server at ${baseUrl}`);\n      process.exit(1);\n    }\n\n    // Prompt for email if not provided\n    let email = argv.email;\n    if (!email) {\n      email = await promptText('Email: ');\n      if (!email) {\n        console.error('Email is required');\n        process.exit(1);\n      }\n    }\n\n    // Prompt for password if not provided (secure input)\n    let password = argv.password;\n    if (!password) {\n      password = await promptPassword('Password: ');\n      if (!password) {\n        console.error('Password is required');\n        process.exit(1);\n      }\n    }\n\n    const token = await login(email, password, baseUrl);\n    if (!token) {\n      console.error('Login failed.');\n      process.exit(1);\n    }\n\n    const ok = await revokeClientCredential(token, argv['client-id'], baseUrl);\n    if (ok) {\n      console.log(`Credential ${argv['client-id']} revoked.`);\n    } else {\n      console.error(`Failed to revoke credential ${argv['client-id']}.`);\n      process.exit(1);\n    }\n  },\n};\n\nconst logoutCommand: CommandModule<AuthArgs, AuthArgs> = {\n  command: 'logout',\n  describe: 'Remove stored credentials from ~/.xpod/',\n  builder: (yargs) => yargs,\n  handler: async () => {\n    clearCredentials();\n    console.log('Credentials removed.');\n  },\n};\n\nexport const authCommand: CommandModule<object, AuthArgs> = {\n  command: 'auth',\n  describe: 'Authentication and credential management',\n  builder: (yargs) =>\n    yargs\n      .option('url', {\n        alias: 'u',\n        type: 'string',\n        description: 'Server base URL',\n        default: process.env.CSS_BASE_URL || 'http://localhost:3000',\n      })\n      .command(loginCommand)\n      .command(createCredentialsCommand)\n      .command(logoutCommand)\n      .command(listCommand)\n      .command(revokeCommand)\n      .demandCommand(1, 'Please specify an auth subcommand'),\n  handler: () => {\n    // parent command, no-op\n  },\n};\n"]}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/cli/commands/auth.ts"],"names":[],"mappings":";;;AACA,oDAQ4B;AAC5B,gEAA4F;AAC5F,0CAA2D;AAC3D,sDAA0D;AAC1D,0CAAiF;AAiCjF,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,GAAG,GAAG,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,uBAAuB,CAAC;IACvE,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC;AAC7C,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,KAInC;IACC,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC,aAAa,CAAC;IAC7B,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,IAAA,4BAAc,EAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACrE,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,wBAAe,CACvB,iBAAiB,EACjB,qFAAqF,EACrF,CAAC,EACD,EAAE,MAAM,EAAE,CACX,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,wBAAe,CAAC,eAAe,EAAE,8CAA8C,EAAE,CAAC,CAAC,CAAC;AAChG,CAAC;AAED,MAAM,YAAY,GAAuC;IACvD,OAAO,EAAE,OAAO;IAChB,QAAQ,EAAE,wCAAwC;IAClD,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,KAAK;SACF,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,iCAAiC,EAAE,CAAC;SACpF,MAAM,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,6CAA6C,EAAE,CAAC;SAC/F,MAAM,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,yDAAyD,EAAE,CAAC;SAC9G,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,6DAA6D,EAAE,CAAC;SAChH,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,sBAAsB,EAAE,CAAC;IAC7F,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACtB,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;QAEpD,IAAI,CAAC,CAAC,MAAM,IAAA,yBAAW,EAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;YAC7D,IAAA,uBAAc,EAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,oBAAoB,CAAC,CAAC;QAClE,CAAC;QAED,mCAAmC;QACnC,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACvB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,MAAM,IAAA,mBAAU,EAAC,SAAS,CAAC,CAAC;YACpC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;gBACnC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,qDAAqD;QACrD,IAAI,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC7B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,QAAQ,GAAG,MAAM,IAAA,uBAAc,EAAC,YAAY,CAAC,CAAC;YAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;gBACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAA,mBAAK,EAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAA,uBAAc,EAAC,IAAI,KAAK,CAAC,qCAAqC,CAAC,EAAE,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,aAAa,CAAC,CAAC;QACtG,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAA,gCAAkB,EAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ,EAAE,iBAAiB,EAAE,CAAC;YACjC,IAAA,uBAAc,EAAC,IAAI,KAAK,CAAC,0CAA0C,CAAC,EAAE,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,8BAA8B,CAAC,CAAC;QAC5H,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC;YACvC,KAAK;YACL,OAAO;YACP,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC;SAC9B,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAA,uBAAc,EAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC;QAE/D,MAAM,IAAI,GAAG,MAAM,IAAA,qCAAuB,EAAC,KAAK,EAAE,QAAQ,CAAC,iBAAiB,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;QACjG,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAA,uBAAc,EAAC,IAAI,KAAK,CAAC,+BAA+B,CAAC,EAAE,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,2BAA2B,CAAC,CAAC;QAC9G,CAAC;QAED,IAAA,mCAAe,EAAC;YACd,GAAG,EAAE,OAAO;YACZ,KAAK;YACL,QAAQ,EAAE,oBAAoB;YAC9B,OAAO,EAAE;gBACP,QAAQ,EAAE,IAAI,CAAC,EAAE;gBACjB,YAAY,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;aAChC;SACF,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAA,iCAAa,GAAE,EAAE,CAAC;QAC7D,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,IAAA,wBAAe,EAAC,IAAI,CAAC,CAAC;YACtB,OAAO;QACT,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,EAAE,CAAC,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAA,iCAAa,GAAE,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;CACF,CAAC;AAEF,MAAM,wBAAwB,GAAmD;IAC/E,OAAO,EAAE,oBAAoB;IAC7B,QAAQ,EAAE,8CAA8C;IACxD,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,KAAK;SACF,MAAM,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,6CAA6C,EAAE,CAAC;SAC/F,MAAM,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,yDAAyD,EAAE,CAAC;SAC9G,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,8BAA8B,EAAE,CAAC;SACjF,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;SACnE,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,yDAAyD,EAAE,CAAC;IAClI,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACtB,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAErC,IAAI,CAAC,CAAC,MAAM,IAAA,yBAAW,EAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,KAAK,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;YACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,mCAAmC;QACnC,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACvB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,MAAM,IAAA,mBAAU,EAAC,SAAS,CAAC,CAAC;YACpC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;gBACnC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,qDAAqD;QACrD,IAAI,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC7B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,QAAQ,GAAG,MAAM,IAAA,uBAAc,EAAC,YAAY,CAAC,CAAC;YAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;gBACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAA,mBAAK,EAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAA,gCAAkB,EAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ,EAAE,iBAAiB,EAAE,CAAC;YACjC,OAAO,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;YAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,KAAa,CAAC;QAClB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,oBAAoB,CAAC;gBACjC,KAAK;gBACL,OAAO;gBACP,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC;aAC9B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAA,uBAAc,EAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAA,qCAAuB,EAAC,KAAK,EAAE,QAAQ,CAAC,iBAAiB,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAChG,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;YAC/C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,IAAA,mCAAe,EAAC;gBACd,GAAG,EAAE,OAAO;gBACZ,KAAK;gBACL,QAAQ,EAAE,oBAAoB;gBAC9B,OAAO,EAAE;oBACP,QAAQ,EAAE,IAAI,CAAC,EAAE;oBACjB,YAAY,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;iBAChC;aACF,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,cAAc,IAAA,iCAAa,GAAE,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YAC1E,OAAO,CAAC,GAAG,CAAC,8EAA8E,CAAC,CAAC;YAC5F,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;QAC/C,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,EAAE,CAAC,CAAC;IACvC,CAAC;CACF,CAAC;AAEF,MAAM,WAAW,GAAsC;IACrD,OAAO,EAAE,MAAM;IACf,QAAQ,EAAE,yBAAyB;IACnC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,KAAK;SACF,MAAM,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,6CAA6C,EAAE,CAAC;SAC/F,MAAM,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,yDAAyD,EAAE,CAAC;IACnH,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACtB,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAErC,IAAI,CAAC,CAAC,MAAM,IAAA,yBAAW,EAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,KAAK,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;YACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,mCAAmC;QACnC,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACvB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,MAAM,IAAA,mBAAU,EAAC,SAAS,CAAC,CAAC;YACpC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;gBACnC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,qDAAqD;QACrD,IAAI,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC7B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,QAAQ,GAAG,MAAM,IAAA,uBAAc,EAAC,YAAY,CAAC,CAAC;YAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;gBACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAA,mBAAK,EAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAA,mCAAqB,EAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC1D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;YAC5C,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,SAAS,KAAK,CAAC,MAAM,mBAAmB,CAAC,CAAC;QACtD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACzB,IAAI,CAAC,CAAC,KAAK;gBAAE,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;CACF,CAAC;AAEF,MAAM,aAAa,GAAwC;IACzD,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,4BAA4B;IACtC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,KAAK;SACF,MAAM,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,6CAA6C,EAAE,CAAC;SAC/F,MAAM,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,yDAAyD,EAAE,CAAC;SAC9G,MAAM,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,qBAAqB,EAAE,CAAC;IACpG,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACtB,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAErC,IAAI,CAAC,CAAC,MAAM,IAAA,yBAAW,EAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,KAAK,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;YACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,mCAAmC;QACnC,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACvB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,MAAM,IAAA,mBAAU,EAAC,SAAS,CAAC,CAAC;YACpC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;gBACnC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,qDAAqD;QACrD,IAAI,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC7B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,QAAQ,GAAG,MAAM,IAAA,uBAAc,EAAC,YAAY,CAAC,CAAC;YAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;gBACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAA,mBAAK,EAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,IAAA,oCAAsB,EAAC,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,CAAC;QAC3E,IAAI,EAAE,EAAE,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QAC1D,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,+BAA+B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACnE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;CACF,CAAC;AAEF,MAAM,aAAa,GAAsC;IACvD,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,yCAAyC;IACnD,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,sBAAsB,EAAE,CAAC;IAClH,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACtB,IAAA,oCAAgB,GAAE,CAAC;QACnB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,IAAA,wBAAe,EAAC,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACtC,CAAC;CACF,CAAC;AAEF,MAAM,aAAa,GAAsC;IACvD,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,mCAAmC;IAC7C,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,sBAAsB,EAAE,CAAC;IAClH,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACtB,MAAM,MAAM,GAAG,IAAA,kCAAmB,EAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,IAAA,wBAAe,EAAC,MAAM,CAAC,CAAC;YACxB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;YAC1B,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;YACzD,OAAO;QACT,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,cAAc,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,cAAc,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,cAAc,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9C,CAAC;CACF,CAAC;AAEF,MAAM,aAAa,GAAsC;IACvD,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,gCAAgC;IAC1C,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,sBAAsB,EAAE,CAAC;IAClH,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACtB,MAAM,MAAM,GAAG,IAAA,kCAAmB,EAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;YAC1B,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,IAAA,uBAAc,EAAC,IAAI,wBAAe,CAAC,eAAe,EAAE,oDAAoD,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YACtH,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;YACzD,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,IAAA,wBAAe,EAAC,MAAM,CAAC,CAAC;YACxB,OAAO;QACT,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;CACF,CAAC;AAEW,QAAA,WAAW,GAAoC;IAC1D,OAAO,EAAE,MAAM;IACf,QAAQ,EAAE,0CAA0C;IACpD,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,KAAK;SACF,MAAM,CAAC,KAAK,EAAE;QACb,KAAK,EAAE,GAAG;QACV,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,iBAAiB;QAC9B,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,uBAAuB;KAC7D,CAAC;SACD,OAAO,CAAC,aAAa,CAAC;SACtB,OAAO,CAAC,YAAY,CAAC;SACrB,OAAO,CAAC,wBAAwB,CAAC;SACjC,OAAO,CAAC,aAAa,CAAC;SACtB,OAAO,CAAC,aAAa,CAAC;SACtB,OAAO,CAAC,WAAW,CAAC;SACpB,OAAO,CAAC,aAAa,CAAC;SACtB,aAAa,CAAC,CAAC,EAAE,mCAAmC,CAAC;IAC1D,OAAO,EAAE,GAAG,EAAE;QACZ,wBAAwB;IAC1B,CAAC;CACF,CAAC","sourcesContent":["import type { CommandModule } from 'yargs';\nimport {\n  checkServer,\n  login,\n  getAccountControls,\n  getAccountData,\n  createClientCredentials,\n  listClientCredentials,\n  revokeClientCredential,\n} from '../lib/css-account';\nimport { saveCredentials, clearCredentials, getConfigPath } from '../lib/credentials-store';\nimport { promptPassword, promptText } from '../lib/prompt';\nimport { getStoredAuthStatus } from '../lib/auth-context';\nimport { CliCommandError, handleCliError, writeJsonResult } from '../lib/output';\n\ninterface AuthArgs {\n  url: string;\n  json?: boolean;\n}\n\ninterface LoginArgs extends AuthArgs {\n  email?: string;\n  password?: string;\n  issuer?: string;\n  'web-id'?: string;\n}\n\ninterface CreateCredentialsArgs extends AuthArgs {\n  email?: string;\n  password?: string;\n  'web-id'?: string;\n  name?: string;\n  output?: boolean;\n}\n\ninterface ListArgs extends AuthArgs {\n  email?: string;\n  password?: string;\n}\n\ninterface RevokeArgs extends AuthArgs {\n  email?: string;\n  password?: string;\n  'client-id': string;\n}\n\nfunction resolveUrl(url: string): string {\n  const raw = url || process.env.CSS_BASE_URL || 'http://localhost:3000';\n  return raw.endsWith('/') ? raw : `${raw}/`;\n}\n\nasync function resolveExplicitWebId(input: {\n  token: string;\n  baseUrl: string;\n  explicitWebId?: string;\n}): Promise<string> {\n  if (input.explicitWebId) {\n    return input.explicitWebId;\n  }\n\n  const accountData = await getAccountData(input.token, input.baseUrl);\n  const webIds = accountData ? Object.keys(accountData.webIds) : [];\n  if (webIds.length === 1 && webIds[0]) {\n    return webIds[0];\n  }\n  if (webIds.length > 1) {\n    throw new CliCommandError(\n      'webid_ambiguous',\n      'Multiple WebIDs are configured. Re-run with --web-id to select the acting identity.',\n      2,\n      { webIds },\n    );\n  }\n  throw new CliCommandError('webid_missing', 'No WebID found. Specify --web-id explicitly.', 2);\n}\n\nconst loginCommand: CommandModule<AuthArgs, LoginArgs> = {\n  command: 'login',\n  describe: 'Login and store CLI client credentials',\n  builder: (yargs) =>\n    yargs\n      .option('issuer', { type: 'string', description: 'Issuer/base URL alias for --url' })\n      .option('email', { type: 'string', description: 'Account email (will prompt if not provided)' })\n      .option('password', { type: 'string', description: 'Account password (will prompt securely if not provided)' })\n      .option('web-id', { type: 'string', description: 'WebID to bind credentials to when multiple identities exist' })\n      .option('json', { type: 'boolean', default: false, description: 'Output JSON envelope' }),\n  handler: async (argv) => {\n    const baseUrl = resolveUrl(argv.issuer ?? argv.url);\n\n    if (!(await checkServer(baseUrl))) {\n      const error = new Error(`Cannot reach server at ${baseUrl}`);\n      handleCliError(error, argv.json === true, 'server_unreachable');\n    }\n\n    // Prompt for email if not provided\n    let email = argv.email;\n    if (!email) {\n      email = await promptText('Email: ');\n      if (!email) {\n        console.error('Email is required');\n        process.exit(1);\n      }\n    }\n\n    // Prompt for password if not provided (secure input)\n    let password = argv.password;\n    if (!password) {\n      password = await promptPassword('Password: ');\n      if (!password) {\n        console.error('Password is required');\n        process.exit(1);\n      }\n    }\n\n    const token = await login(email, password, baseUrl);\n    if (!token) {\n      handleCliError(new Error('Login failed. Check email/password.'), argv.json === true, 'auth_failed');\n    }\n\n    const controls = await getAccountControls(token, baseUrl);\n    if (!controls?.clientCredentials) {\n      handleCliError(new Error('Cannot find client credentials endpoint.'), argv.json === true, 'credentials_endpoint_missing');\n    }\n\n    const webId = await resolveExplicitWebId({\n      token,\n      baseUrl,\n      explicitWebId: argv['web-id'],\n    }).catch((error) => handleCliError(error, argv.json === true));\n\n    const cred = await createClientCredentials(token, controls.clientCredentials, webId, 'xpod-cli');\n    if (!cred) {\n      handleCliError(new Error('Failed to create credentials.'), argv.json === true, 'credentials_create_failed');\n    }\n\n    saveCredentials({\n      url: baseUrl,\n      webId,\n      authType: 'client_credentials',\n      secrets: {\n        clientId: cred.id,\n        clientSecret: cred.secret ?? '',\n      },\n    });\n\n    const data = { baseUrl, webId, configPath: getConfigPath() };\n    if (argv.json) {\n      writeJsonResult(data);\n      return;\n    }\n    console.log('Login successful. Credentials saved.');\n    console.log(`  webId: ${webId}`);\n    console.log(`  config: ${getConfigPath().replace('/config.json', '/')}`);\n  },\n};\n\nconst createCredentialsCommand: CommandModule<AuthArgs, CreateCredentialsArgs> = {\n  command: 'create-credentials',\n  describe: 'Create client credentials (client_id/secret)',\n  builder: (yargs) =>\n    yargs\n      .option('email', { type: 'string', description: 'Account email (will prompt if not provided)' })\n      .option('password', { type: 'string', description: 'Account password (will prompt securely if not provided)' })\n      .option('web-id', { type: 'string', description: 'WebID to bind credentials to' })\n      .option('name', { type: 'string', description: 'Credential label' })\n      .option('output', { type: 'boolean', default: false, description: 'Do not save credentials; print non-secret metadata only' }),\n  handler: async (argv) => {\n    const baseUrl = resolveUrl(argv.url);\n\n    if (!(await checkServer(baseUrl))) {\n      console.error(`Cannot reach server at ${baseUrl}`);\n      process.exit(1);\n    }\n\n    // Prompt for email if not provided\n    let email = argv.email;\n    if (!email) {\n      email = await promptText('Email: ');\n      if (!email) {\n        console.error('Email is required');\n        process.exit(1);\n      }\n    }\n\n    // Prompt for password if not provided (secure input)\n    let password = argv.password;\n    if (!password) {\n      password = await promptPassword('Password: ');\n      if (!password) {\n        console.error('Password is required');\n        process.exit(1);\n      }\n    }\n\n    const token = await login(email, password, baseUrl);\n    if (!token) {\n      console.error('Login failed.');\n      process.exit(1);\n    }\n\n    const controls = await getAccountControls(token, baseUrl);\n    if (!controls?.clientCredentials) {\n      console.error('Cannot find client credentials endpoint.');\n      process.exit(1);\n    }\n\n    let webId: string;\n    try {\n      webId = await resolveExplicitWebId({\n        token,\n        baseUrl,\n        explicitWebId: argv['web-id'],\n      });\n    } catch (error) {\n      handleCliError(error, false);\n    }\n\n    const cred = await createClientCredentials(token, controls.clientCredentials, webId, argv.name);\n    if (!cred) {\n      console.error('Failed to create credentials.');\n      process.exit(1);\n    }\n\n    if (!argv.output) {\n      saveCredentials({\n        url: baseUrl,\n        webId,\n        authType: 'client_credentials',\n        secrets: {\n          clientId: cred.id,\n          clientSecret: cred.secret ?? '',\n        },\n      });\n      console.log(`\\nSaved to ${getConfigPath().replace('/config.json', '/')}`);\n      console.log('\\n✓ Setup complete! You can now use xpod commands without entering password.');\n      console.log('  Example: xpod backup export');\n    } else {\n      console.log('Credentials created.');\n    }\n    console.log(`  client_id: ${cred.id}`);\n    console.log(`  webId:     ${webId}`);\n  },\n};\n\nconst listCommand: CommandModule<AuthArgs, ListArgs> = {\n  command: 'list',\n  describe: 'List client credentials',\n  builder: (yargs) =>\n    yargs\n      .option('email', { type: 'string', description: 'Account email (will prompt if not provided)' })\n      .option('password', { type: 'string', description: 'Account password (will prompt securely if not provided)' }),\n  handler: async (argv) => {\n    const baseUrl = resolveUrl(argv.url);\n\n    if (!(await checkServer(baseUrl))) {\n      console.error(`Cannot reach server at ${baseUrl}`);\n      process.exit(1);\n    }\n\n    // Prompt for email if not provided\n    let email = argv.email;\n    if (!email) {\n      email = await promptText('Email: ');\n      if (!email) {\n        console.error('Email is required');\n        process.exit(1);\n      }\n    }\n\n    // Prompt for password if not provided (secure input)\n    let password = argv.password;\n    if (!password) {\n      password = await promptPassword('Password: ');\n      if (!password) {\n        console.error('Password is required');\n        process.exit(1);\n      }\n    }\n\n    const token = await login(email, password, baseUrl);\n    if (!token) {\n      console.error('Login failed.');\n      process.exit(1);\n    }\n\n    const creds = await listClientCredentials(token, baseUrl);\n    if (creds.length === 0) {\n      console.log('No client credentials found.');\n      return;\n    }\n\n    console.log(`Found ${creds.length} credential(s):\\n`);\n    for (const c of creds) {\n      console.log(`  ${c.id}`);\n      if (c.webId) console.log(`    webId: ${c.webId}`);\n    }\n  },\n};\n\nconst revokeCommand: CommandModule<AuthArgs, RevokeArgs> = {\n  command: 'revoke',\n  describe: 'Revoke a client credential',\n  builder: (yargs) =>\n    yargs\n      .option('email', { type: 'string', description: 'Account email (will prompt if not provided)' })\n      .option('password', { type: 'string', description: 'Account password (will prompt securely if not provided)' })\n      .option('client-id', { type: 'string', demandOption: true, description: 'Client ID to revoke' }),\n  handler: async (argv) => {\n    const baseUrl = resolveUrl(argv.url);\n\n    if (!(await checkServer(baseUrl))) {\n      console.error(`Cannot reach server at ${baseUrl}`);\n      process.exit(1);\n    }\n\n    // Prompt for email if not provided\n    let email = argv.email;\n    if (!email) {\n      email = await promptText('Email: ');\n      if (!email) {\n        console.error('Email is required');\n        process.exit(1);\n      }\n    }\n\n    // Prompt for password if not provided (secure input)\n    let password = argv.password;\n    if (!password) {\n      password = await promptPassword('Password: ');\n      if (!password) {\n        console.error('Password is required');\n        process.exit(1);\n      }\n    }\n\n    const token = await login(email, password, baseUrl);\n    if (!token) {\n      console.error('Login failed.');\n      process.exit(1);\n    }\n\n    const ok = await revokeClientCredential(token, argv['client-id'], baseUrl);\n    if (ok) {\n      console.log(`Credential ${argv['client-id']} revoked.`);\n    } else {\n      console.error(`Failed to revoke credential ${argv['client-id']}.`);\n      process.exit(1);\n    }\n  },\n};\n\nconst logoutCommand: CommandModule<AuthArgs, AuthArgs> = {\n  command: 'logout',\n  describe: 'Remove stored credentials from ~/.xpod/',\n  builder: (yargs) => yargs.option('json', { type: 'boolean', default: false, description: 'Output JSON envelope' }),\n  handler: async (argv) => {\n    clearCredentials();\n    if (argv.json) {\n      writeJsonResult({ authenticated: false });\n      return;\n    }\n    console.log('Credentials removed.');\n  },\n};\n\nconst statusCommand: CommandModule<AuthArgs, AuthArgs> = {\n  command: 'status',\n  describe: 'Show stored authentication status',\n  builder: (yargs) => yargs.option('json', { type: 'boolean', default: false, description: 'Output JSON envelope' }),\n  handler: async (argv) => {\n    const status = getStoredAuthStatus(argv.url);\n    if (argv.json) {\n      writeJsonResult(status);\n      return;\n    }\n    if (!status.authenticated) {\n      console.log('Not authenticated. Run `xpod auth login`.');\n      return;\n    }\n    console.log('Authenticated.');\n    console.log(`  webId:   ${status.webId}`);\n    console.log(`  podRoot: ${status.podRoot}`);\n    console.log(`  server:  ${status.baseUrl}`);\n  },\n};\n\nconst whoamiCommand: CommandModule<AuthArgs, AuthArgs> = {\n  command: 'whoami',\n  describe: 'Show acting WebID and Pod root',\n  builder: (yargs) => yargs.option('json', { type: 'boolean', default: false, description: 'Output JSON envelope' }),\n  handler: async (argv) => {\n    const status = getStoredAuthStatus(argv.url);\n    if (!status.authenticated) {\n      if (argv.json) {\n        handleCliError(new CliCommandError('auth_required', 'No credentials found. Run `xpod auth login` first.', 2), true);\n      }\n      console.log('Not authenticated. Run `xpod auth login`.');\n      return;\n    }\n    if (argv.json) {\n      writeJsonResult(status);\n      return;\n    }\n    console.log(status.webId);\n  },\n};\n\nexport const authCommand: CommandModule<object, AuthArgs> = {\n  command: 'auth',\n  describe: 'Authentication and credential management',\n  builder: (yargs) =>\n    yargs\n      .option('url', {\n        alias: 'u',\n        type: 'string',\n        description: 'Server base URL',\n        default: process.env.CSS_BASE_URL || 'http://localhost:3000',\n      })\n      .command(statusCommand)\n      .command(loginCommand)\n      .command(createCredentialsCommand)\n      .command(logoutCommand)\n      .command(whoamiCommand)\n      .command(listCommand)\n      .command(revokeCommand)\n      .demandCommand(1, 'Please specify an auth subcommand'),\n  handler: () => {\n    // parent command, no-op\n  },\n};\n"]}

package/dist/cli/commands/login.js

@@ -4,6 +4,7 @@ exports.loginCommandModule = void 0;
 const css_account_1 = require("../lib/css-account");
 const credentials_store_1 = require("../lib/credentials-store");
 const prompt_1 = require("../lib/prompt");
+const output_1 = require("../lib/output");
 function resolveUrl(url) {
     const raw = url || process.env.CSS_BASE_URL || 'http://localhost:3000';
     return raw.endsWith('/') ? raw : `${raw}/`;
@@ -12,21 +13,15 @@ async function resolveWebId(baseUrl, token, explicitWebId) {
     if (explicitWebId) {
         return explicitWebId;
     }
-    const accountRes = await fetch(`${baseUrl}.account/`, {
-        headers: {
-            Accept: 'application/json',
-            Authorization: `CSS-Account-Token ${token}`,
-        },
-    });
-    if (!accountRes.ok) {
-        return undefined;
+    const accountData = await (0, css_account_1.getAccountData)(token, baseUrl);
+    const webIds = accountData ? Object.keys(accountData.webIds) : [];
+    if (webIds.length === 1 && webIds[0]) {
+        return webIds[0];
     }
-    const accountData = await accountRes.json();
-    const webIds = accountData.webIds;
-    if (!webIds || typeof webIds !== 'object') {
-        return undefined;
+    if (webIds.length > 1) {
+        throw new output_1.CliCommandError('webid_ambiguous', 'Multiple WebIDs are configured. Re-run with --web-id to select the acting identity.', 2, { webIds });
     }
-    return Object.keys(webIds)[0];
+    throw new output_1.CliCommandError('webid_missing', 'No WebID found. Specify --web-id explicitly.', 2);
 }
 exports.loginCommandModule = {
     command: 'login',
@@ -42,7 +37,7 @@ exports.loginCommandModule = {
         .option('password', { type: 'string', description: 'Account password (will prompt securely if not provided)' })
         .option('web-id', { type: 'string', description: 'WebID to bind credentials to' })
         .option('name', { type: 'string', description: 'Credential label' })
-        .option('output', { type: 'boolean', default: false, description: 'Print credentials instead of saving to ~/.xpod/' }),
+        .option('output', { type: 'boolean', default: false, description: 'Do not save credentials; print non-secret metadata only' }),
     handler: async (argv) => {
         const baseUrl = resolveUrl(argv.url);
         if (!(await (0, css_account_1.checkServer)(baseUrl))) {
@@ -75,20 +70,13 @@ exports.loginCommandModule = {
             console.error('Cannot find client credentials endpoint.');
             process.exit(1);
         }
-        const webId = await resolveWebId(baseUrl, token, argv['web-id']);
-        if (!webId) {
-            console.error('No WebID found. Specify --web-id explicitly.');
-            process.exit(1);
-        }
+        const webId = await resolveWebId(baseUrl, token, argv['web-id'])
+            .catch((error) => (0, output_1.handleCliError)(error, false));
         const credential = await (0, css_account_1.createClientCredentials)(token, controls.clientCredentials, webId, argv.name);
         if (!credential) {
             console.error('Failed to create client credentials.');
             process.exit(1);
         }
-        console.log('Credentials created:');
-        console.log(`  client_id:     ${credential.id}`);
-        console.log(`  client_secret: ${credential.secret}`);
-        console.log(`  webId:         ${webId}`);
         if (!argv.output) {
             (0, credentials_store_1.saveCredentials)({
                 url: baseUrl,
@@ -101,6 +89,11 @@ exports.loginCommandModule = {
             });
             console.log(`\nSaved to ${(0, credentials_store_1.getConfigPath)().replace('/config.json', '/')}`);
         }
+        else {
+            console.log('Credentials created.');
+        }
+        console.log(`  client_id: ${credential.id}`);
+        console.log(`  webId:     ${webId}`);
     },
 };
 //# sourceMappingURL=login.js.map

package/dist/cli/commands/login.js.map

@@ -1 +1 @@
-{"version":3,"file":"login.js","sourceRoot":"","sources":["../../../src/cli/commands/login.ts"],"names":[],"mappings":";;;AACA,oDAK4B;AAC5B,gEAA0E;AAC1E,0CAA2D;AAW3D,SAAS,UAAU,CAAC,GAAY;IAC9B,MAAM,GAAG,GAAG,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,uBAAuB,CAAC;IACvE,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC;AAC7C,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,OAAe,EAAE,KAAa,EAAE,aAAsB;IAChF,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,WAAW,EAAE;QACpD,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,aAAa,EAAE,qBAAqB,KAAK,EAAE;SAC5C;KACF,CAAC,CAAC;IACH,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,IAAI,EAAyC,CAAC;IACnF,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC;IAClC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAChC,CAAC;AAEY,QAAA,kBAAkB,GAAqC;IAClE,OAAO,EAAE,OAAO;IAChB,QAAQ,EAAE,sDAAsD;IAChE,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,KAAK;SACF,MAAM,CAAC,KAAK,EAAE;QACb,KAAK,EAAE,GAAG;QACV,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,iBAAiB;QAC9B,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,uBAAuB;KAC7D,CAAC;SACD,MAAM,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,6CAA6C,EAAE,CAAC;SAC/F,MAAM,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,yDAAyD,EAAE,CAAC;SAC9G,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,8BAA8B,EAAE,CAAC;SACjF,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;SACnE,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,iDAAiD,EAAE,CAAC;IAC1H,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACtB,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAErC,IAAI,CAAC,CAAC,MAAM,IAAA,yBAAW,EAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,KAAK,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;YACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACvB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,MAAM,IAAA,mBAAU,EAAC,SAAS,CAAC,CAAC;YACpC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;gBACnC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC7B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,QAAQ,GAAG,MAAM,IAAA,uBAAc,EAAC,YAAY,CAAC,CAAC;YAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;gBACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAA,mBAAK,EAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAA,gCAAkB,EAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ,EAAE,iBAAiB,EAAE,CAAC;YACjC,OAAO,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;YAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QACjE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;YAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAA,qCAAuB,EAAC,KAAK,EAAE,QAAQ,CAAC,iBAAiB,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACtG,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;YACtD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,oBAAoB,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,oBAAoB,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,EAAE,CAAC,CAAC;QAEzC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,IAAA,mCAAe,EAAC;gBACd,GAAG,EAAE,OAAO;gBACZ,KAAK;gBACL,QAAQ,EAAE,oBAAoB;gBAC9B,OAAO,EAAE;oBACP,QAAQ,EAAE,UAAU,CAAC,EAAE;oBACvB,YAAY,EAAE,UAAU,CAAC,MAAM,IAAI,EAAE;iBACtC;aACF,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,cAAc,IAAA,iCAAa,GAAE,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;CACF,CAAC","sourcesContent":["import type { CommandModule } from 'yargs';\nimport {\n  checkServer,\n  login,\n  getAccountControls,\n  createClientCredentials,\n} from '../lib/css-account';\nimport { saveCredentials, getConfigPath } from '../lib/credentials-store';\nimport { promptPassword, promptText } from '../lib/prompt';\n\ninterface LoginArgs {\n  url?: string;\n  email?: string;\n  password?: string;\n  'web-id'?: string;\n  name?: string;\n  output?: boolean;\n}\n\nfunction resolveUrl(url?: string): string {\n  const raw = url || process.env.CSS_BASE_URL || 'http://localhost:3000';\n  return raw.endsWith('/') ? raw : `${raw}/`;\n}\n\nasync function resolveWebId(baseUrl: string, token: string, explicitWebId?: string): Promise<string | undefined> {\n  if (explicitWebId) {\n    return explicitWebId;\n  }\n\n  const accountRes = await fetch(`${baseUrl}.account/`, {\n    headers: {\n      Accept: 'application/json',\n      Authorization: `CSS-Account-Token ${token}`,\n    },\n  });\n  if (!accountRes.ok) {\n    return undefined;\n  }\n\n  const accountData = await accountRes.json() as { webIds?: Record<string, string> };\n  const webIds = accountData.webIds;\n  if (!webIds || typeof webIds !== 'object') {\n    return undefined;\n  }\n\n  return Object.keys(webIds)[0];\n}\n\nexport const loginCommandModule: CommandModule<object, LoginArgs> = {\n  command: 'login',\n  describe: 'Login to xpod/Solid and store CLI client credentials',\n  builder: (yargs) =>\n    yargs\n      .option('url', {\n        alias: 'u',\n        type: 'string',\n        description: 'Server base URL',\n        default: process.env.CSS_BASE_URL || 'http://localhost:3000',\n      })\n      .option('email', { type: 'string', description: 'Account email (will prompt if not provided)' })\n      .option('password', { type: 'string', description: 'Account password (will prompt securely if not provided)' })\n      .option('web-id', { type: 'string', description: 'WebID to bind credentials to' })\n      .option('name', { type: 'string', description: 'Credential label' })\n      .option('output', { type: 'boolean', default: false, description: 'Print credentials instead of saving to ~/.xpod/' }),\n  handler: async (argv) => {\n    const baseUrl = resolveUrl(argv.url);\n\n    if (!(await checkServer(baseUrl))) {\n      console.error(`Cannot reach server at ${baseUrl}`);\n      process.exit(1);\n    }\n\n    let email = argv.email;\n    if (!email) {\n      email = await promptText('Email: ');\n      if (!email) {\n        console.error('Email is required');\n        process.exit(1);\n      }\n    }\n\n    let password = argv.password;\n    if (!password) {\n      password = await promptPassword('Password: ');\n      if (!password) {\n        console.error('Password is required');\n        process.exit(1);\n      }\n    }\n\n    const token = await login(email, password, baseUrl);\n    if (!token) {\n      console.error('Login failed.');\n      process.exit(1);\n    }\n\n    const controls = await getAccountControls(token, baseUrl);\n    if (!controls?.clientCredentials) {\n      console.error('Cannot find client credentials endpoint.');\n      process.exit(1);\n    }\n\n    const webId = await resolveWebId(baseUrl, token, argv['web-id']);\n    if (!webId) {\n      console.error('No WebID found. Specify --web-id explicitly.');\n      process.exit(1);\n    }\n\n    const credential = await createClientCredentials(token, controls.clientCredentials, webId, argv.name);\n    if (!credential) {\n      console.error('Failed to create client credentials.');\n      process.exit(1);\n    }\n\n    console.log('Credentials created:');\n    console.log(`  client_id:     ${credential.id}`);\n    console.log(`  client_secret: ${credential.secret}`);\n    console.log(`  webId:         ${webId}`);\n\n    if (!argv.output) {\n      saveCredentials({\n        url: baseUrl,\n        webId,\n        authType: 'client_credentials',\n        secrets: {\n          clientId: credential.id,\n          clientSecret: credential.secret ?? '',\n        },\n      });\n      console.log(`\\nSaved to ${getConfigPath().replace('/config.json', '/')}`);\n    }\n  },\n};\n"]}
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../../src/cli/commands/login.ts"],"names":[],"mappings":";;;AACA,oDAM4B;AAC5B,gEAA0E;AAC1E,0CAA2D;AAC3D,0CAAgE;AAWhE,SAAS,UAAU,CAAC,GAAY;IAC9B,MAAM,GAAG,GAAG,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,uBAAuB,CAAC;IACvE,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC;AAC7C,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,OAAe,EAAE,KAAa,EAAE,aAAsB;IAChF,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,IAAA,4BAAc,EAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,wBAAe,CACvB,iBAAiB,EACjB,qFAAqF,EACrF,CAAC,EACD,EAAE,MAAM,EAAE,CACX,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,wBAAe,CAAC,eAAe,EAAE,8CAA8C,EAAE,CAAC,CAAC,CAAC;AAChG,CAAC;AAEY,QAAA,kBAAkB,GAAqC;IAClE,OAAO,EAAE,OAAO;IAChB,QAAQ,EAAE,sDAAsD;IAChE,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,KAAK;SACF,MAAM,CAAC,KAAK,EAAE;QACb,KAAK,EAAE,GAAG;QACV,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,iBAAiB;QAC9B,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,uBAAuB;KAC7D,CAAC;SACD,MAAM,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,6CAA6C,EAAE,CAAC;SAC/F,MAAM,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,yDAAyD,EAAE,CAAC;SAC9G,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,8BAA8B,EAAE,CAAC;SACjF,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;SACnE,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,yDAAyD,EAAE,CAAC;IAClI,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACtB,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAErC,IAAI,CAAC,CAAC,MAAM,IAAA,yBAAW,EAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,KAAK,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;YACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACvB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,MAAM,IAAA,mBAAU,EAAC,SAAS,CAAC,CAAC;YACpC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;gBACnC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC7B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,QAAQ,GAAG,MAAM,IAAA,uBAAc,EAAC,YAAY,CAAC,CAAC;YAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;gBACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAA,mBAAK,EAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAA,gCAAkB,EAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ,EAAE,iBAAiB,EAAE,CAAC;YACjC,OAAO,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;YAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;aAC7D,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAA,uBAAc,EAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;QAElD,MAAM,UAAU,GAAG,MAAM,IAAA,qCAAuB,EAAC,KAAK,EAAE,QAAQ,CAAC,iBAAiB,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACtG,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;YACtD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,IAAA,mCAAe,EAAC;gBACd,GAAG,EAAE,OAAO;gBACZ,KAAK;gBACL,QAAQ,EAAE,oBAAoB;gBAC9B,OAAO,EAAE;oBACP,QAAQ,EAAE,UAAU,CAAC,EAAE;oBACvB,YAAY,EAAE,UAAU,CAAC,MAAM,IAAI,EAAE;iBACtC;aACF,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,cAAc,IAAA,iCAAa,GAAE,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,gBAAgB,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,EAAE,CAAC,CAAC;IACvC,CAAC;CACF,CAAC","sourcesContent":["import type { CommandModule } from 'yargs';\nimport {\n  checkServer,\n  login,\n  getAccountControls,\n  createClientCredentials,\n  getAccountData,\n} from '../lib/css-account';\nimport { saveCredentials, getConfigPath } from '../lib/credentials-store';\nimport { promptPassword, promptText } from '../lib/prompt';\nimport { CliCommandError, handleCliError } from '../lib/output';\n\ninterface LoginArgs {\n  url?: string;\n  email?: string;\n  password?: string;\n  'web-id'?: string;\n  name?: string;\n  output?: boolean;\n}\n\nfunction resolveUrl(url?: string): string {\n  const raw = url || process.env.CSS_BASE_URL || 'http://localhost:3000';\n  return raw.endsWith('/') ? raw : `${raw}/`;\n}\n\nasync function resolveWebId(baseUrl: string, token: string, explicitWebId?: string): Promise<string> {\n  if (explicitWebId) {\n    return explicitWebId;\n  }\n\n  const accountData = await getAccountData(token, baseUrl);\n  const webIds = accountData ? Object.keys(accountData.webIds) : [];\n  if (webIds.length === 1 && webIds[0]) {\n    return webIds[0];\n  }\n  if (webIds.length > 1) {\n    throw new CliCommandError(\n      'webid_ambiguous',\n      'Multiple WebIDs are configured. Re-run with --web-id to select the acting identity.',\n      2,\n      { webIds },\n    );\n  }\n  throw new CliCommandError('webid_missing', 'No WebID found. Specify --web-id explicitly.', 2);\n}\n\nexport const loginCommandModule: CommandModule<object, LoginArgs> = {\n  command: 'login',\n  describe: 'Login to xpod/Solid and store CLI client credentials',\n  builder: (yargs) =>\n    yargs\n      .option('url', {\n        alias: 'u',\n        type: 'string',\n        description: 'Server base URL',\n        default: process.env.CSS_BASE_URL || 'http://localhost:3000',\n      })\n      .option('email', { type: 'string', description: 'Account email (will prompt if not provided)' })\n      .option('password', { type: 'string', description: 'Account password (will prompt securely if not provided)' })\n      .option('web-id', { type: 'string', description: 'WebID to bind credentials to' })\n      .option('name', { type: 'string', description: 'Credential label' })\n      .option('output', { type: 'boolean', default: false, description: 'Do not save credentials; print non-secret metadata only' }),\n  handler: async (argv) => {\n    const baseUrl = resolveUrl(argv.url);\n\n    if (!(await checkServer(baseUrl))) {\n      console.error(`Cannot reach server at ${baseUrl}`);\n      process.exit(1);\n    }\n\n    let email = argv.email;\n    if (!email) {\n      email = await promptText('Email: ');\n      if (!email) {\n        console.error('Email is required');\n        process.exit(1);\n      }\n    }\n\n    let password = argv.password;\n    if (!password) {\n      password = await promptPassword('Password: ');\n      if (!password) {\n        console.error('Password is required');\n        process.exit(1);\n      }\n    }\n\n    const token = await login(email, password, baseUrl);\n    if (!token) {\n      console.error('Login failed.');\n      process.exit(1);\n    }\n\n    const controls = await getAccountControls(token, baseUrl);\n    if (!controls?.clientCredentials) {\n      console.error('Cannot find client credentials endpoint.');\n      process.exit(1);\n    }\n\n    const webId = await resolveWebId(baseUrl, token, argv['web-id'])\n      .catch((error) => handleCliError(error, false));\n\n    const credential = await createClientCredentials(token, controls.clientCredentials, webId, argv.name);\n    if (!credential) {\n      console.error('Failed to create client credentials.');\n      process.exit(1);\n    }\n\n    if (!argv.output) {\n      saveCredentials({\n        url: baseUrl,\n        webId,\n        authType: 'client_credentials',\n        secrets: {\n          clientId: credential.id,\n          clientSecret: credential.secret ?? '',\n        },\n      });\n      console.log(`\\nSaved to ${getConfigPath().replace('/config.json', '/')}`);\n    } else {\n      console.log('Credentials created.');\n    }\n    console.log(`  client_id: ${credential.id}`);\n    console.log(`  webId:     ${webId}`);\n  },\n};\n"]}

package/dist/cli/commands/logs.d.ts

@@ -5,6 +5,8 @@ interface LogsArgs {
     service?: string;
     level?: string;
     limit: number;
+    env?: string;
+    json: boolean;
 }
 export declare const logsCommand: CommandModule<object, LogsArgs>;
 export {};