saasignal 0.9.13 → 0.9.15

package/dist/auth.d.ts

@@ -0,0 +1,79 @@
+interface ProtectedResourceMetadata {
+    resource?: string;
+    authorization_servers?: string[];
+}
+interface AuthorizationServerMetadata {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    registration_endpoint?: string;
+    revocation_endpoint?: string;
+}
+export interface StoredAuthProfile {
+    access_token: string;
+    refresh_token: string;
+    expires_at: string;
+    client_id: string;
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    registration_endpoint?: string;
+    revocation_endpoint?: string;
+    resource: string;
+    base_url: string;
+    org_id: string | null;
+    project_id: string | null;
+    scopes: string[];
+}
+export interface ResolvedCliAuth {
+    token: string;
+    baseUrl: string;
+    source: "env_token" | "stored_oauth" | "env_api_key";
+    profile?: StoredAuthProfile;
+}
+type FetchLike = typeof fetch;
+export declare function getAuthConfigPath(platform?: NodeJS.Platform, env?: NodeJS.ProcessEnv, home?: string): string;
+export declare function loadAuthProfile(path?: string): Promise<StoredAuthProfile | null>;
+export declare function saveAuthProfile(profile: StoredAuthProfile, path?: string): Promise<void>;
+export declare function deleteAuthProfile(path?: string): Promise<void>;
+export declare function createPkcePair(): {
+    codeVerifier: string;
+    codeChallenge: string;
+};
+export declare function discoverOAuthConfiguration(baseUrl: string, fetchImpl?: FetchLike): Promise<{
+    baseUrl: string;
+    protectedResource: ProtectedResourceMetadata;
+    metadata: AuthorizationServerMetadata;
+}>;
+export declare function authorizeWithBrowser(options?: {
+    baseUrl?: string;
+    fetchImpl?: FetchLike;
+    onAuthorizeUrl?: (url: string) => void;
+    openBrowser?: (url: string) => void | Promise<void>;
+    timeoutMs?: number;
+}): Promise<StoredAuthProfile>;
+export declare function refreshAuthProfile(profile: StoredAuthProfile, fetchImpl?: FetchLike): Promise<StoredAuthProfile>;
+export declare function shouldRefreshProfile(profile: StoredAuthProfile, now?: number): boolean;
+export declare function resolveCliAuth(options?: {
+    baseUrl?: string;
+    fetchImpl?: FetchLike;
+    profilePath?: string;
+}): Promise<{
+    token: string;
+    baseUrl: string;
+    source: "env_token";
+    profile?: undefined;
+} | {
+    token: string;
+    baseUrl: string;
+    source: "stored_oauth";
+    profile: StoredAuthProfile;
+} | {
+    token: string;
+    baseUrl: string;
+    source: "env_api_key";
+    profile?: undefined;
+}>;
+export declare function revokeAndDeleteAuthProfile(profile: StoredAuthProfile | null, fetchImpl?: FetchLike, path?: string): Promise<void>;
+export {};
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAWA,UAAU,yBAAyB;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAA;CACjC;AAED,UAAU,2BAA2B;IACnC,MAAM,EAAE,MAAM,CAAA;IACd,sBAAsB,EAAE,MAAM,CAAA;IAC9B,cAAc,EAAE,MAAM,CAAA;IACtB,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAC7B;AAiBD,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,sBAAsB,EAAE,MAAM,CAAA;IAC9B,cAAc,EAAE,MAAM,CAAA;IACtB,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,WAAW,GAAG,cAAc,GAAG,aAAa,CAAA;IACpD,OAAO,CAAC,EAAE,iBAAiB,CAAA;CAC5B;AAED,KAAK,SAAS,GAAG,OAAO,KAAK,CAAA;AA4D7B,wBAAgB,iBAAiB,CAC/B,QAAQ,kBAAmB,EAC3B,GAAG,oBAAc,EACjB,IAAI,SAAY,UASjB;AAED,wBAAsB,eAAe,CAAC,IAAI,SAAsB,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAgCnG;AAED,wBAAsB,eAAe,CAAC,OAAO,EAAE,iBAAiB,EAAE,IAAI,SAAsB,iBAQ3F;AAED,wBAAsB,iBAAiB,CAAC,IAAI,SAAsB,iBAEjE;AAED,wBAAgB,cAAc;;;EAI7B;AAED,wBAAsB,0BAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,GAAE,SAAiB;;;;GAiC7F;AAsID,wBAAsB,oBAAoB,CAAC,OAAO,CAAC,EAAE;IACnD,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,SAAS,CAAA;IACrB,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;IACtC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnD,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,8BA4CA;AAED,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,iBAAiB,EAAE,SAAS,GAAE,SAAiB,8BAmBhG;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,iBAAiB,EAAE,GAAG,SAAa,WAEhF;AAED,wBAAsB,cAAc,CAAC,OAAO,CAAC,EAAE;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,SAAS,CAAA;IACrB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;;;;;;;;;;;;;;;GAuCA;AAED,wBAAsB,0BAA0B,CAAC,OAAO,EAAE,iBAAiB,GAAG,IAAI,EAAE,SAAS,GAAE,SAAiB,EAAE,IAAI,SAAsB,iBAY3I"}

package/dist/auth.js

@@ -0,0 +1,365 @@
+import { spawn } from "node:child_process";
+import { createHash, randomBytes } from "node:crypto";
+import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { createServer } from "node:http";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+const DEFAULT_BASE_URL = "https://api.saasignal.saastemly.com";
+const CALLBACK_TIMEOUT_MS = 5 * 60 * 1000;
+const REFRESH_SKEW_MS = 60 * 1000;
+function normalizeBaseUrl(value) {
+    return (value ?? process.env.SAASIGNAL_API_URL ?? DEFAULT_BASE_URL).replace(/\/$/, "");
+}
+function parseScope(scope) {
+    return (scope ?? "").split(/\s+/).filter(Boolean);
+}
+function profileFromTokenResponse(response, metadata, baseUrl, clientId) {
+    return {
+        access_token: response.access_token,
+        refresh_token: response.refresh_token,
+        expires_at: new Date(Date.now() + response.expires_in * 1000).toISOString(),
+        client_id: clientId,
+        issuer: metadata.issuer,
+        authorization_endpoint: metadata.authorization_endpoint,
+        token_endpoint: metadata.token_endpoint,
+        registration_endpoint: metadata.registration_endpoint,
+        revocation_endpoint: metadata.revocation_endpoint,
+        resource: response.resource ?? baseUrl,
+        base_url: baseUrl,
+        org_id: response.org_id ?? null,
+        project_id: response.project_id ?? null,
+        scopes: parseScope(response.scope),
+    };
+}
+async function readJsonFile(path) {
+    const raw = await readFile(path, "utf8");
+    return JSON.parse(raw);
+}
+async function postForm(fetchImpl, url, body) {
+    const response = await fetchImpl(url, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/x-www-form-urlencoded",
+            Accept: "application/json",
+        },
+        body,
+    });
+    const json = await response.json().catch(() => null);
+    if (!response.ok) {
+        const message = typeof json === "object" && json && "error_description" in json
+            ? String(json.error_description)
+            : `HTTP ${response.status}`;
+        throw new Error(message);
+    }
+    return json;
+}
+export function getAuthConfigPath(platform = process.platform, env = process.env, home = homedir()) {
+    if (platform === "win32") {
+        return join(env.APPDATA ?? join(home, "AppData", "Roaming"), "saasignal", "auth.json");
+    }
+    if (platform === "darwin") {
+        return join(home, "Library", "Application Support", "saasignal", "auth.json");
+    }
+    return join(env.XDG_CONFIG_HOME ?? join(home, ".config"), "saasignal", "auth.json");
+}
+export async function loadAuthProfile(path = getAuthConfigPath()) {
+    try {
+        const json = await readJsonFile(path);
+        if (typeof json.access_token !== "string" ||
+            typeof json.refresh_token !== "string" ||
+            typeof json.client_id !== "string" ||
+            typeof json.token_endpoint !== "string" ||
+            typeof json.resource !== "string") {
+            return null;
+        }
+        return {
+            access_token: json.access_token,
+            refresh_token: json.refresh_token,
+            expires_at: typeof json.expires_at === "string" ? json.expires_at : new Date(0).toISOString(),
+            client_id: json.client_id,
+            issuer: typeof json.issuer === "string" ? json.issuer : "",
+            authorization_endpoint: typeof json.authorization_endpoint === "string" ? json.authorization_endpoint : "",
+            token_endpoint: json.token_endpoint,
+            registration_endpoint: typeof json.registration_endpoint === "string" ? json.registration_endpoint : undefined,
+            revocation_endpoint: typeof json.revocation_endpoint === "string" ? json.revocation_endpoint : undefined,
+            resource: json.resource,
+            base_url: typeof json.base_url === "string" ? json.base_url : normalizeBaseUrl(json.resource),
+            org_id: typeof json.org_id === "string" ? json.org_id : null,
+            project_id: typeof json.project_id === "string" ? json.project_id : null,
+            scopes: Array.isArray(json.scopes) ? json.scopes.filter((scope) => typeof scope === "string") : [],
+        };
+    }
+    catch {
+        return null;
+    }
+}
+export async function saveAuthProfile(profile, path = getAuthConfigPath()) {
+    const dir = dirname(path);
+    await mkdir(dir, { recursive: true, mode: 0o700 });
+    await writeFile(path, JSON.stringify(profile, null, 2), { mode: 0o600 });
+    if (process.platform !== "win32") {
+        await chmod(dir, 0o700).catch(() => { });
+        await chmod(path, 0o600).catch(() => { });
+    }
+}
+export async function deleteAuthProfile(path = getAuthConfigPath()) {
+    await rm(path, { force: true });
+}
+export function createPkcePair() {
+    const codeVerifier = randomBytes(48).toString("base64url");
+    const codeChallenge = createHash("sha256").update(codeVerifier).digest("base64url");
+    return { codeVerifier, codeChallenge };
+}
+export async function discoverOAuthConfiguration(baseUrl, fetchImpl = fetch) {
+    const normalizedBaseUrl = normalizeBaseUrl(baseUrl);
+    const protectedResource = await fetchImpl(`${normalizedBaseUrl}/.well-known/oauth-protected-resource`, {
+        headers: { Accept: "application/json" },
+    }).then(async (response) => {
+        const json = await response.json().catch(() => null);
+        if (!response.ok || !json) {
+            throw new Error("Unable to discover SaaSignal protected-resource metadata");
+        }
+        return json;
+    });
+    const authorizationServer = protectedResource.authorization_servers?.[0];
+    if (!authorizationServer) {
+        throw new Error("Protected-resource metadata did not advertise an authorization server");
+    }
+    const metadataUrl = `${authorizationServer.replace(/\/$/, "")}/.well-known/oauth-authorization-server`;
+    const metadata = await fetchImpl(metadataUrl, {
+        headers: { Accept: "application/json" },
+    }).then(async (response) => {
+        const json = await response.json().catch(() => null);
+        if (!response.ok || !json) {
+            throw new Error("Unable to discover SaaSignal authorization-server metadata");
+        }
+        return json;
+    });
+    return {
+        baseUrl: normalizedBaseUrl,
+        protectedResource,
+        metadata,
+    };
+}
+async function registerDynamicClient(metadata, redirectUri, fetchImpl) {
+    if (!metadata.registration_endpoint) {
+        throw new Error("Authorization server does not support dynamic client registration");
+    }
+    const response = await fetchImpl(metadata.registration_endpoint, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/json",
+            Accept: "application/json",
+        },
+        body: JSON.stringify({
+            redirect_uris: [redirectUri],
+            token_endpoint_auth_method: "none",
+            grant_types: ["authorization_code", "refresh_token"],
+            response_types: ["code"],
+            client_name: "SaaSignal CLI",
+        }),
+    });
+    const json = await response.json().catch(() => null);
+    if (!response.ok || !json || typeof json.client_id !== "string") {
+        throw new Error("Unable to register the SaaSignal CLI with the authorization server");
+    }
+    return json;
+}
+function openSystemBrowser(url) {
+    return new Promise((resolve, reject) => {
+        const platform = process.platform;
+        const child = platform === "darwin"
+            ? spawn("open", [url], { stdio: "ignore" })
+            : platform === "win32"
+                ? spawn("cmd", ["/c", "start", "", url], { stdio: "ignore", windowsHide: true })
+                : spawn("xdg-open", [url], { stdio: "ignore" });
+        child.once("error", reject);
+        child.once("spawn", () => {
+            child.unref();
+            resolve();
+        });
+    });
+}
+async function createLoopbackListener(expectedState, timeoutMs = CALLBACK_TIMEOUT_MS) {
+    let settled = false;
+    let rejectPending = () => { };
+    let resolvePending = () => { };
+    const result = new Promise((resolve, reject) => {
+        resolvePending = resolve;
+        rejectPending = reject;
+    });
+    const server = createServer((req, res) => {
+        const requestUrl = new URL(req.url ?? "/", `http://${req.headers.host}`);
+        if (requestUrl.pathname !== "/callback") {
+            res.writeHead(404, { "Content-Type": "text/plain; charset=utf-8" });
+            res.end("Not found");
+            return;
+        }
+        const finish = (callback) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+            callback();
+            server.close();
+        };
+        const error = requestUrl.searchParams.get("error");
+        if (error) {
+            const description = requestUrl.searchParams.get("error_description") ?? error;
+            finish(() => {
+                res.end(`<p>SaaSignal authorization failed: ${description}</p>`);
+                rejectPending(new Error(description));
+            });
+            return;
+        }
+        const code = requestUrl.searchParams.get("code");
+        const state = requestUrl.searchParams.get("state");
+        if (!code || state !== expectedState) {
+            finish(() => {
+                res.end("<p>SaaSignal authorization failed: state mismatch.</p>");
+                rejectPending(new Error("OAuth state mismatch"));
+            });
+            return;
+        }
+        finish(() => {
+            res.end("<p>SaaSignal authorization complete. You can return to the terminal.</p>");
+            resolvePending({ code });
+        });
+    });
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(0, "127.0.0.1", () => resolve());
+    });
+    const address = server.address();
+    if (!address || typeof address === "string") {
+        server.close();
+        throw new Error("Unable to start the OAuth callback listener");
+    }
+    const timer = setTimeout(() => {
+        if (settled)
+            return;
+        settled = true;
+        server.close();
+        rejectPending(new Error("Timed out waiting for the SaaSignal browser authorization callback"));
+    }, timeoutMs);
+    return {
+        redirectUri: `http://127.0.0.1:${address.port}/callback`,
+        waitForCode: () => result,
+        close: () => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            server.close();
+        },
+    };
+}
+export async function authorizeWithBrowser(options) {
+    const fetchImpl = options?.fetchImpl ?? fetch;
+    const baseUrl = normalizeBaseUrl(options?.baseUrl);
+    const { metadata, protectedResource } = await discoverOAuthConfiguration(baseUrl, fetchImpl);
+    const state = randomBytes(24).toString("base64url");
+    const { codeVerifier, codeChallenge } = createPkcePair();
+    const listener = await createLoopbackListener(state, options?.timeoutMs);
+    try {
+        const client = await registerDynamicClient(metadata, listener.redirectUri, fetchImpl);
+        const authorizeUrl = new URL(metadata.authorization_endpoint);
+        authorizeUrl.searchParams.set("client_id", client.client_id);
+        authorizeUrl.searchParams.set("redirect_uri", listener.redirectUri);
+        authorizeUrl.searchParams.set("response_type", "code");
+        authorizeUrl.searchParams.set("code_challenge", codeChallenge);
+        authorizeUrl.searchParams.set("code_challenge_method", "S256");
+        authorizeUrl.searchParams.set("state", state);
+        authorizeUrl.searchParams.set("resource", protectedResource.resource ?? baseUrl);
+        options?.onAuthorizeUrl?.(authorizeUrl.toString());
+        try {
+            await (options?.openBrowser ?? openSystemBrowser)(authorizeUrl.toString());
+        }
+        catch {
+            // If opening the browser fails we still keep waiting so the user can open the URL manually.
+        }
+        const { code } = await listener.waitForCode();
+        const tokenResponse = await postForm(fetchImpl, metadata.token_endpoint, new URLSearchParams({
+            grant_type: "authorization_code",
+            client_id: client.client_id,
+            code,
+            code_verifier: codeVerifier,
+            redirect_uri: listener.redirectUri,
+            resource: protectedResource.resource ?? baseUrl,
+        }));
+        return profileFromTokenResponse(tokenResponse, metadata, baseUrl, client.client_id);
+    }
+    finally {
+        listener.close();
+    }
+}
+export async function refreshAuthProfile(profile, fetchImpl = fetch) {
+    const tokenResponse = await postForm(fetchImpl, profile.token_endpoint, new URLSearchParams({
+        grant_type: "refresh_token",
+        client_id: profile.client_id,
+        refresh_token: profile.refresh_token,
+        resource: profile.resource,
+    }));
+    return profileFromTokenResponse(tokenResponse, {
+        issuer: profile.issuer,
+        authorization_endpoint: profile.authorization_endpoint,
+        token_endpoint: profile.token_endpoint,
+        registration_endpoint: profile.registration_endpoint,
+        revocation_endpoint: profile.revocation_endpoint,
+    }, profile.base_url, profile.client_id);
+}
+export function shouldRefreshProfile(profile, now = Date.now()) {
+    return new Date(profile.expires_at).getTime() - now <= REFRESH_SKEW_MS;
+}
+export async function resolveCliAuth(options) {
+    const baseUrl = normalizeBaseUrl(options?.baseUrl);
+    const envToken = process.env.SAASIGNAL_TOKEN?.trim();
+    if (envToken) {
+        return { token: envToken, baseUrl, source: "env_token" };
+    }
+    const storedProfile = await loadAuthProfile(options?.profilePath);
+    if (storedProfile && storedProfile.base_url === baseUrl && storedProfile.resource === baseUrl) {
+        try {
+            const profile = shouldRefreshProfile(storedProfile)
+                ? await refreshAuthProfile(storedProfile, options?.fetchImpl ?? fetch)
+                : storedProfile;
+            if (profile !== storedProfile) {
+                await saveAuthProfile(profile, options?.profilePath);
+            }
+            return {
+                token: profile.access_token,
+                baseUrl,
+                source: "stored_oauth",
+                profile,
+            };
+        }
+        catch (error) {
+            const apiKey = process.env.SAASIGNAL_API_KEY?.trim();
+            if (apiKey) {
+                return { token: apiKey, baseUrl, source: "env_api_key" };
+            }
+            throw new Error(`Stored SaaSignal login could not be refreshed. Run \`saasignal auth login\` again. ${error.message}`);
+        }
+    }
+    const apiKey = process.env.SAASIGNAL_API_KEY?.trim();
+    if (apiKey) {
+        return { token: apiKey, baseUrl, source: "env_api_key" };
+    }
+    throw new Error("No SaaSignal credentials found. Run `saasignal auth login`, set SAASIGNAL_TOKEN, or set SAASIGNAL_API_KEY.");
+}
+export async function revokeAndDeleteAuthProfile(profile, fetchImpl = fetch, path = getAuthConfigPath()) {
+    if (profile?.revocation_endpoint) {
+        try {
+            await postForm(fetchImpl, profile.revocation_endpoint, new URLSearchParams({
+                token: profile.refresh_token,
+                client_id: profile.client_id,
+            }));
+        }
+        catch {
+            // Best-effort revoke.
+        }
+    }
+    await deleteAuthProfile(path);
+}
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACxE,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AACxC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEzC,MAAM,gBAAgB,GAAG,qCAAqC,CAAA;AAC9D,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;AACzC,MAAM,eAAe,GAAG,EAAE,GAAG,IAAI,CAAA;AAwDjC,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AACxF,CAAC;AAED,SAAS,UAAU,CAAC,KAAyB;IAC3C,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;AACnD,CAAC;AAED,SAAS,wBAAwB,CAC/B,QAA+B,EAC/B,QAAqC,EACrC,OAAe,EACf,QAAgB;IAEhB,OAAO;QACL,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;QAC3E,SAAS,EAAE,QAAQ;QACnB,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,sBAAsB,EAAE,QAAQ,CAAC,sBAAsB;QACvD,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,qBAAqB,EAAE,QAAQ,CAAC,qBAAqB;QACrD,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;QACjD,QAAQ,EAAE,QAAQ,CAAC,QAAQ,IAAI,OAAO;QACtC,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,IAAI;QAC/B,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,IAAI;QACvC,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;KACnC,CAAA;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAY;IACtC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACxC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAA;AACnD,CAAC;AAED,KAAK,UAAU,QAAQ,CAAI,SAAoB,EAAE,GAAW,EAAE,IAAqB;IACjF,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;QACpC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,mCAAmC;YACnD,MAAM,EAAE,kBAAkB;SAC3B;QACD,IAAI;KACL,CAAC,CAAA;IAEF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IACpD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,OAAO,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,IAAI,mBAAmB,IAAI,IAAI;YAC7E,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC;YAChC,CAAC,CAAC,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAA;QAC7B,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAA;IAC1B,CAAC;IAED,OAAO,IAAS,CAAA;AAClB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAC3B,GAAG,GAAG,OAAO,CAAC,GAAG,EACjB,IAAI,GAAG,OAAO,EAAE;IAEhB,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,CAAA;IACxF,CAAC;IACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,qBAAqB,EAAE,WAAW,EAAE,WAAW,CAAC,CAAA;IAC/E,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,CAAA;AACrF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAI,GAAG,iBAAiB,EAAE;IAC9D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAA;QACrC,IACE,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ;YACrC,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ;YACtC,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ;YAClC,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ;YACvC,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EACjC,CAAC;YACD,OAAO,IAAI,CAAA;QACb,CAAC;QAED,OAAO;YACL,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,UAAU,EAAE,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;YAC7F,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;YAC1D,sBAAsB,EAAE,OAAO,IAAI,CAAC,sBAAsB,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE;YAC1G,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,qBAAqB,EAAE,OAAO,IAAI,CAAC,qBAAqB,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,SAAS;YAC9G,mBAAmB,EAAE,OAAO,IAAI,CAAC,mBAAmB,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,SAAS;YACxG,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC;YAC7F,MAAM,EAAE,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;YAC5D,UAAU,EAAE,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;YACxE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;SACpH,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAA0B,EAAE,IAAI,GAAG,iBAAiB,EAAE;IAC1F,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACzB,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAClD,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACxE,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QACvC,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IAC1C,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAI,GAAG,iBAAiB,EAAE;IAChE,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;AACjC,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,MAAM,YAAY,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IAC1D,MAAM,aAAa,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IACnF,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,CAAA;AACxC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,OAAe,EAAE,YAAuB,KAAK;IAC5F,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAA;IACnD,MAAM,iBAAiB,GAAG,MAAM,SAAS,CAAC,GAAG,iBAAiB,uCAAuC,EAAE;QACrG,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;KACxC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;QACzB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;QACpD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;QAC7E,CAAC;QACD,OAAO,IAAiC,CAAA;IAC1C,CAAC,CAAC,CAAA;IAEF,MAAM,mBAAmB,GAAG,iBAAiB,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,CAAA;IACxE,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAA;IAC1F,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,mBAAmB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,yCAAyC,CAAA;IACtG,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,WAAW,EAAE;QAC5C,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;KACxC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;QACzB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;QACpD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAA;QAC/E,CAAC;QACD,OAAO,IAAmC,CAAA;IAC5C,CAAC,CAAC,CAAA;IAEF,OAAO;QACL,OAAO,EAAE,iBAAiB;QAC1B,iBAAiB;QACjB,QAAQ;KACT,CAAA;AACH,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,QAAqC,EACrC,WAAmB,EACnB,SAAoB;IAEpB,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAA;IACtF,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,qBAAqB,EAAE;QAC/D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,kBAAkB;SAC3B;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,aAAa,EAAE,CAAC,WAAW,CAAC;YAC5B,0BAA0B,EAAE,MAAM;YAClC,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACpD,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,WAAW,EAAE,eAAe;SAC7B,CAAC;KACH,CAAC,CAAA;IAEF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IACpD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,IAAI,IAAI,OAAQ,IAAiC,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC9F,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAA;IACvF,CAAC;IAED,OAAO,IAAgC,CAAA;AACzC,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW;IACpC,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;QACjC,MAAM,KAAK,GAAG,QAAQ,KAAK,QAAQ;YACjC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;YAC3C,CAAC,CAAC,QAAQ,KAAK,OAAO;gBACpB,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;gBAChF,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;QAEnD,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC3B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACvB,KAAK,CAAC,KAAK,EAAE,CAAA;YACb,OAAO,EAAE,CAAA;QACX,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,aAAqB,EAAE,SAAS,GAAG,mBAAmB;IAC1F,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,IAAI,aAAa,GAA2B,GAAG,EAAE,GAAE,CAAC,CAAA;IACpD,IAAI,cAAc,GAAsC,GAAG,EAAE,GAAE,CAAC,CAAA;IAEhE,MAAM,MAAM,GAAG,IAAI,OAAO,CAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC/D,cAAc,GAAG,OAAO,CAAA;QACxB,aAAa,GAAG,MAAM,CAAA;IACxB,CAAC,CAAC,CAAA;IAEF,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACvC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;QACxE,IAAI,UAAU,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;YACxC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAA;YACnE,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;YACpB,OAAM;QACR,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,QAAoB,EAAE,EAAE;YACtC,IAAI,OAAO;gBAAE,OAAM;YACnB,OAAO,GAAG,IAAI,CAAA;YACd,YAAY,CAAC,KAAK,CAAC,CAAA;YACnB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAA;YAClE,QAAQ,EAAE,CAAA;YACV,MAAM,CAAC,KAAK,EAAE,CAAA;QAChB,CAAC,CAAA;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAClD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,WAAW,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,KAAK,CAAA;YAC7E,MAAM,CAAC,GAAG,EAAE;gBACV,GAAG,CAAC,GAAG,CAAC,sCAAsC,WAAW,MAAM,CAAC,CAAA;gBAChE,aAAa,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC,CAAA;YACvC,CAAC,CAAC,CAAA;YACF,OAAM;QACR,CAAC;QAED,MAAM,IAAI,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAChD,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAClD,IAAI,CAAC,IAAI,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;YACrC,MAAM,CAAC,GAAG,EAAE;gBACV,GAAG,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAA;gBACjE,aAAa,CAAC,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAA;YAClD,CAAC,CAAC,CAAA;YACF,OAAM;QACR,CAAC;QAED,MAAM,CAAC,GAAG,EAAE;YACV,GAAG,CAAC,GAAG,CAAC,0EAA0E,CAAC,CAAA;YACnF,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;QAC1B,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC5B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA;IAChD,CAAC,CAAC,CAAA;IAEF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAA;IAChC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,CAAC,KAAK,EAAE,CAAA;QACd,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;IAChE,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;QAC5B,IAAI,OAAO;YAAE,OAAM;QACnB,OAAO,GAAG,IAAI,CAAA;QACd,MAAM,CAAC,KAAK,EAAE,CAAA;QACd,aAAa,CAAC,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC,CAAA;IAChG,CAAC,EAAE,SAAS,CAAC,CAAA;IAEb,OAAO;QACL,WAAW,EAAE,oBAAoB,OAAO,CAAC,IAAI,WAAW;QACxD,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM;QACzB,KAAK,EAAE,GAAG,EAAE;YACV,IAAI,OAAO;gBAAE,OAAM;YACnB,OAAO,GAAG,IAAI,CAAA;YACd,YAAY,CAAC,KAAK,CAAC,CAAA;YACnB,MAAM,CAAC,KAAK,EAAE,CAAA;QAChB,CAAC;KACF,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAM1C;IACC,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,KAAK,CAAA;IAC7C,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IAClD,MAAM,EAAE,QAAQ,EAAE,iBAAiB,EAAE,GAAG,MAAM,0BAA0B,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;IAC5F,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IACnD,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,cAAc,EAAE,CAAA;IACxD,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA;IAExE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC,CAAA;QACrF,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAA;QAC7D,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,CAAA;QAC5D,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAA;QACnE,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAA;QACtD,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAA;QAC9D,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAA;QAC9D,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QAC7C,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,iBAAiB,CAAC,QAAQ,IAAI,OAAO,CAAC,CAAA;QAEhF,OAAO,EAAE,cAAc,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAA;QAClD,IAAI,CAAC;YACH,MAAM,CAAC,OAAO,EAAE,WAAW,IAAI,iBAAiB,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAA;QAC5E,CAAC;QAAC,MAAM,CAAC;YACP,4FAA4F;QAC9F,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAA;QAC7C,MAAM,aAAa,GAAG,MAAM,QAAQ,CAClC,SAAS,EACT,QAAQ,CAAC,cAAc,EACvB,IAAI,eAAe,CAAC;YAClB,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,IAAI;YACJ,aAAa,EAAE,YAAY;YAC3B,YAAY,EAAE,QAAQ,CAAC,WAAW;YAClC,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,IAAI,OAAO;SAChD,CAAC,CACH,CAAA;QAED,OAAO,wBAAwB,CAAC,aAAa,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,CAAA;IACrF,CAAC;YAAS,CAAC;QACT,QAAQ,CAAC,KAAK,EAAE,CAAA;IAClB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAA0B,EAAE,YAAuB,KAAK;IAC/F,MAAM,aAAa,GAAG,MAAM,QAAQ,CAClC,SAAS,EACT,OAAO,CAAC,cAAc,EACtB,IAAI,eAAe,CAAC;QAClB,UAAU,EAAE,eAAe;QAC3B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CACH,CAAA;IAED,OAAO,wBAAwB,CAAC,aAAa,EAAE;QAC7C,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;QACtD,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;KACjD,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;AACzC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAA0B,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC/E,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,GAAG,GAAG,IAAI,eAAe,CAAA;AACxE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAIpC;IACC,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,CAAA;IACpD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAoB,EAAE,CAAA;IACnE,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;IACjE,IAAI,aAAa,IAAI,aAAa,CAAC,QAAQ,KAAK,OAAO,IAAI,aAAa,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC9F,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,oBAAoB,CAAC,aAAa,CAAC;gBACjD,CAAC,CAAC,MAAM,kBAAkB,CAAC,aAAa,EAAE,OAAO,EAAE,SAAS,IAAI,KAAK,CAAC;gBACtE,CAAC,CAAC,aAAa,CAAA;YAEjB,IAAI,OAAO,KAAK,aAAa,EAAE,CAAC;gBAC9B,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,CAAA;YACtD,CAAC;YAED,OAAO;gBACL,KAAK,EAAE,OAAO,CAAC,YAAY;gBAC3B,OAAO;gBACP,MAAM,EAAE,cAAuB;gBAC/B,OAAO;aACR,CAAA;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAA;YACpD,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,aAAsB,EAAE,CAAA;YACnE,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,sFAAuF,KAAe,CAAC,OAAO,EAAE,CAAC,CAAA;QACnI,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAA;IACpD,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,aAAsB,EAAE,CAAA;IACnE,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,4GAA4G,CAAC,CAAA;AAC/H,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,OAAiC,EAAE,YAAuB,KAAK,EAAE,IAAI,GAAG,iBAAiB,EAAE;IAC1I,IAAI,OAAO,EAAE,mBAAmB,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,mBAAmB,EAAE,IAAI,eAAe,CAAC;gBACzE,KAAK,EAAE,OAAO,CAAC,aAAa;gBAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;aAC7B,CAAC,CAAC,CAAA;QACL,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB;QACxB,CAAC;IACH,CAAC;IACD,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAA;AAC/B,CAAC"}

package/dist/cli.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { authorizeWithBrowser, loadAuthProfile, refreshAuthProfile, resolveCliAuth, revokeAndDeleteAuthProfile, saveAuthProfile } from "./auth.js";
 import { SaaSignalClient, SaaSignalError } from "./client.js";
 const USAGE = `
 saasignal — CLI for the SaaSignal API
@@ -7,10 +8,12 @@ Usage:
   saasignal <namespace> <command> [args...]
 
 Environment:
-  SAASIGNAL_API_KEY    API key (required)
+  SAASIGNAL_TOKEN      Bearer token override (highest precedence)
+  SAASIGNAL_API_KEY    API key fallback
   SAASIGNAL_API_URL    Base URL (default: https://api.saasignal.saastemly.com)
 
 Namespaces:
+  auth        Browser login, logout, and status
   kv          Key-value store
   channels    Real-time pub/sub
   jobs        Task / queue / cron
@@ -71,6 +74,11 @@ Delivery Commands:
   delivery eta-fences delete <fence_id>
   delivery settings
   delivery analytics [--from <date>] [--to <date>]
+
+Auth Commands:
+  auth login
+  auth logout
+  auth status
 `.trim();
 function parseArgs(args) {
     const positional = [];
@@ -95,55 +103,124 @@ function parseArgs(args) {
 function out(data) {
     console.log(JSON.stringify(data, null, 2));
 }
+async function handleAuth(command) {
+    switch (command) {
+        case "login": {
+            let printedUrl = false;
+            const profile = await authorizeWithBrowser({
+                onAuthorizeUrl: (url) => {
+                    printedUrl = true;
+                    console.error("Opening the SaaSignal browser authorization flow...");
+                    console.error(`If the browser does not open automatically, visit:\n${url}`);
+                },
+            });
+            await saveAuthProfile(profile);
+            out({
+                logged_in: true,
+                base_url: profile.base_url,
+                resource: profile.resource,
+                org_id: profile.org_id,
+                project_id: profile.project_id,
+                scopes: profile.scopes,
+                expires_at: profile.expires_at,
+            });
+            if (!printedUrl) {
+                console.error("SaaSignal browser authorization completed.");
+            }
+            break;
+        }
+        case "logout": {
+            const profile = await loadAuthProfile();
+            await revokeAndDeleteAuthProfile(profile);
+            out({ logged_in: false });
+            break;
+        }
+        case "status": {
+            const profile = await loadAuthProfile();
+            if (!profile) {
+                out({ logged_in: false });
+                break;
+            }
+            out({
+                logged_in: true,
+                base_url: profile.base_url,
+                resource: profile.resource,
+                org_id: profile.org_id,
+                project_id: profile.project_id,
+                scopes: profile.scopes,
+                expires_at: profile.expires_at,
+                expired: new Date(profile.expires_at).getTime() <= Date.now(),
+            });
+            break;
+        }
+        default:
+            console.error(`Unknown auth command: ${command}`);
+            process.exit(1);
+    }
+}
+async function executeNamespaceCommand(client, namespace, command, positional, flags) {
+    switch (namespace) {
+        case "kv":
+            await handleKv(client, command, positional, flags);
+            break;
+        case "channels":
+            await handleChannels(client, command, positional, flags);
+            break;
+        case "jobs":
+            await handleJobs(client, command, positional, flags);
+            break;
+        case "billing":
+            await handleBilling(client, command, positional, flags);
+            break;
+        case "storage":
+            await handleStorage(client, command, positional, flags);
+            break;
+        case "delivery":
+            await handleDelivery(client, command, positional, flags);
+            break;
+        default:
+            console.error(`Unknown namespace: ${namespace}\n`);
+            console.log(USAGE);
+            process.exit(1);
+    }
+}
 async function main() {
     const args = process.argv.slice(2);
     if (args.length === 0 || args[0] === "--help" || args[0] === "-h") {
         console.log(USAGE);
         process.exit(0);
     }
-    let client;
-    try {
-        client = new SaaSignalClient();
-    }
-    catch (e) {
-        console.error(`Error: ${e.message}`);
-        process.exit(1);
-        return; // unreachable but satisfies TS control flow
-    }
     const [namespace, command, ...rest] = args;
     const { positional, flags } = parseArgs(rest);
     try {
-        switch (namespace) {
-            case "kv":
-                await handleKv(client, command, positional, flags);
-                break;
-            case "channels":
-                await handleChannels(client, command, positional, flags);
-                break;
-            case "jobs":
-                await handleJobs(client, command, positional, flags);
-                break;
-            case "billing":
-                await handleBilling(client, command, positional, flags);
-                break;
-            case "storage":
-                await handleStorage(client, command, positional, flags);
-                break;
-            case "delivery":
-                await handleDelivery(client, command, positional, flags);
-                break;
-            default:
-                console.error(`Unknown namespace: ${namespace}\n`);
-                console.log(USAGE);
-                process.exit(1);
+        if (namespace === "auth") {
+            await handleAuth(command);
+            return;
+        }
+        const resolvedAuth = await resolveCliAuth();
+        let client = new SaaSignalClient({ token: resolvedAuth.token, baseUrl: resolvedAuth.baseUrl });
+        try {
+            await executeNamespaceCommand(client, namespace, command, positional, flags);
+        }
+        catch (error) {
+            if (error instanceof SaaSignalError && error.status === 401 && resolvedAuth.profile) {
+                const refreshedProfile = await refreshAuthProfile(resolvedAuth.profile);
+                await saveAuthProfile(refreshedProfile);
+                client = new SaaSignalClient({ token: refreshedProfile.access_token, baseUrl: resolvedAuth.baseUrl });
+                await executeNamespaceCommand(client, namespace, command, positional, flags);
+                return;
+            }
+            throw error;
         }
     }
     catch (e) {
         if (e instanceof SaaSignalError) {
             console.error(JSON.stringify({ error: e.code, message: e.message, status: e.status }, null, 2));
             process.exit(1);
+            return;
         }
-        throw e;
+        console.error(`Error: ${e.message}`);
+        process.exit(1);
     }
 }
 async function handleKv(client, cmd, pos, flags) {