@arnaudjnn/billing-tools 0.14.0

package/dist/agent-auth/index.d.ts

@@ -0,0 +1,65 @@
+import type { BillingAdapter, ResolvedConfig } from "../types.js";
+import { type ClaimStore } from "./claim-store.js";
+export declare const CLAIM_GRANT_TYPE = "urn:workos:agent-auth:grant-type:claim";
+export type AgentIdentityType = "anonymous" | "verified_email";
+export interface AgentAuthBranding {
+    /** Human-facing resource name (RFC 9728 resource_name, auth.md title). */
+    productName: string;
+    /** Absolute logo URL (RFC 9728 resource_logo_uri). Optional. */
+    logoUri?: string;
+}
+export interface AgentAuthPaths {
+    mcp?: string;
+    rest?: string;
+    authMd?: string;
+    protectedResource?: string;
+    authServer?: string;
+    identity?: string;
+    claim?: string;
+    token?: string;
+    revoke?: string;
+}
+export interface AgentAuthPolicy {
+    accessTokenTtl?: number;
+    interval?: number;
+    userCodeLength?: number;
+    scopes?: string[];
+    /** Domain for the synthetic anonymous email (anonymous+<stub>@<domain>). */
+    anonymousEmailDomain?: string;
+    /** Extra grant types to advertise in AS metadata (e.g. an app's MCP OAuth
+     *  proxy adds "authorization_code"/"refresh_token"). */
+    extraGrantTypes?: string[];
+}
+export interface AgentAuthOptions {
+    adapter: BillingAdapter;
+    config: ResolvedConfig;
+    branding: AgentAuthBranding;
+    paths?: AgentAuthPaths;
+    /** Which identity types are enabled + advertised. Default both. "anonymous"
+     *  additionally requires adapter.createAnonymousOrg. */
+    identityTypes?: AgentIdentityType[];
+    /** Base URL for absolute links. String, per-request resolver, or omitted to
+     *  derive from the request's forwarded host/proto headers. */
+    baseUrl?: string | ((request: Request) => string);
+    claimStore?: ClaimStore;
+    policy?: AgentAuthPolicy;
+    /** Extra fields merged into the AS-metadata response (spread last, so they
+     *  override defaults). Use for capabilities layered on top of auth.md — e.g.
+     *  an MCP OAuth proxy's `authorization_endpoint` / `registration_endpoint`. */
+    asMetadataExtra?: Record<string, unknown>;
+}
+export declare function createAgentAuth(opts: AgentAuthOptions): {
+    protectedResource: (request: Request) => Response;
+    authorizationServer: (request: Request) => Response;
+    authMd: (request: Request) => Response;
+    identity: (request: Request) => Promise<Response>;
+    claim: (request: Request) => Promise<Response>;
+    token: (request: Request) => Promise<Response>;
+    handleClaimGrant: (params: Record<string, string>) => Promise<Response>;
+    revoke: (request: Request) => Promise<Response>;
+    /** Bare PRM discovery URL — pass as the REST/MCP factory `resourceMetadata`. */
+    resourceMetadataUrl: (request: Request) => string;
+    /** Full `WWW-Authenticate` value advertising the PRM discovery doc on a 401. */
+    wwwAuthenticate: (request: Request) => string;
+};
+//# sourceMappingURL=index.d.ts.map

package/dist/agent-auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/agent-auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAGlE,OAAO,EAAsB,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAavE,eAAO,MAAM,gBAAgB,2CAA2C,CAAC;AAEzE,MAAM,MAAM,iBAAiB,GAAG,WAAW,GAAG,gBAAgB,CAAC;AAE/D,MAAM,WAAW,iBAAiB;IAChC,0EAA0E;IAC1E,WAAW,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,4EAA4E;IAC5E,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;4DACwD;IACxD,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,cAAc,CAAC;IACvB,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB;4DACwD;IACxD,aAAa,CAAC,EAAE,iBAAiB,EAAE,CAAC;IACpC;kEAC8D;IAC9D,OAAO,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,KAAK,MAAM,CAAC,CAAC;IAClD,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB;;mFAE+E;IAC/E,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3C;AAiCD,wBAAgB,eAAe,CAAC,IAAI,EAAE,gBAAgB;iCA2BhB,OAAO,KAAG,QAAQ;mCAehB,OAAO,KAAG,QAAQ;sBAiC/B,OAAO,KAAG,QAAQ;wBAgDV,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC;qBA8B9B,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC;qBAsD3B,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC;+BAvBjB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAG,OAAO,CAAC,QAAQ,CAAC;sBAkCnD,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC;IAuBxD,gFAAgF;mCACjD,OAAO;IACtC,gFAAgF;+BACrD,OAAO;EAGrC"}

package/dist/agent-auth/index.js

@@ -0,0 +1,365 @@
+import { sendMagicAuth, verifyMagicAuth } from "../magic-auth.js";
+import { ensureStripeCustomer } from "../billing.js";
+import { inMemoryClaimStore } from "./claim-store.js";
+// auth.md — the WorkOS agent-registration protocol (https://workos.com/auth-md),
+// as reusable framework-agnostic handlers. An autonomous agent can self-register
+// and obtain an API key with no human signup. Everything flows through the
+// BillingAdapter + magic-auth (no direct WorkOS calls here), so any Stripe+WorkOS
+// app mounts these by re-exporting them from its route files.
+//
+// Identity types (advertised + enabled via `identityTypes`):
+//   - "anonymous": mint a fresh org + key immediately (needs adapter.createAnonymousOrg).
+//   - "verified_email": email OTP ceremony → key bound to the user's workspace.
+// ID-JAG is deferred (returns issuer_not_enabled) until agent providers ship it.
+export const CLAIM_GRANT_TYPE = "urn:workos:agent-auth:grant-type:claim";
+const YEAR = 365 * 24 * 60 * 60;
+function jsonError(error, description, status = 400) {
+    return Response.json({ error, error_description: description }, { status });
+}
+function baseUrlFromRequest(request) {
+    const h = request.headers;
+    const host = h.get("x-forwarded-host") ?? h.get("host");
+    const proto = h.get("x-forwarded-proto") ?? (host?.startsWith("localhost") ? "http" : "https");
+    if (host)
+        return `${proto}://${host}`;
+    return new URL(request.url).origin;
+}
+async function readBody(request) {
+    const ct = request.headers.get("content-type") ?? "";
+    try {
+        if (ct.includes("application/x-www-form-urlencoded")) {
+            const form = await request.formData();
+            const out = {};
+            form.forEach((v, k) => {
+                out[k] = String(v);
+            });
+            return out;
+        }
+        return (await request.json());
+    }
+    catch {
+        return null;
+    }
+}
+export function createAgentAuth(opts) {
+    const { adapter, config, branding } = opts;
+    const store = opts.claimStore ?? inMemoryClaimStore();
+    const types = new Set(opts.identityTypes ?? ["anonymous", "verified_email"]);
+    const p = {
+        mcp: "/mcp",
+        rest: "/api/v0",
+        authMd: "/auth.md",
+        protectedResource: "/.well-known/oauth-protected-resource",
+        authServer: "/.well-known/oauth-authorization-server",
+        identity: "/agent/identity",
+        claim: "/agent/identity/claim",
+        token: "/oauth/token",
+        revoke: "/oauth/revoke",
+        ...opts.paths,
+    };
+    const policy = opts.policy ?? {};
+    const ttl = policy.accessTokenTtl ?? YEAR;
+    const scopes = policy.scopes ?? ["openid", "profile", "email"];
+    const baseUrlOf = (request) => typeof opts.baseUrl === "function"
+        ? opts.baseUrl(request)
+        : (opts.baseUrl ?? baseUrlFromRequest(request));
+    // ── Discovery ────────────────────────────────────────────────────────────
+    function protectedResource(request) {
+        const b = baseUrlOf(request);
+        return Response.json({
+            resource: `${b}${p.mcp}`,
+            resource_name: branding.productName,
+            ...(branding.logoUri ? { resource_logo_uri: branding.logoUri } : {}),
+            authorization_servers: [b],
+            scopes_supported: scopes,
+            bearer_methods_supported: ["header"],
+        }, { headers: { "Cache-Control": "public, max-age=3600" } });
+    }
+    function authorizationServer(request) {
+        const b = baseUrlOf(request);
+        const assertionTypes = types.has("verified_email") ? ["verified_email"] : [];
+        const identityTypesSupported = [
+            ...(types.has("anonymous") ? ["anonymous"] : []),
+            ...(types.has("verified_email") ? ["identity_assertion"] : []),
+        ];
+        return Response.json({
+            issuer: b,
+            authorization_endpoint: `${b}/oauth/authorize`,
+            token_endpoint: `${b}${p.token}`,
+            revocation_endpoint: `${b}${p.revoke}`,
+            response_types_supported: ["code"],
+            grant_types_supported: [...(policy.extraGrantTypes ?? []), CLAIM_GRANT_TYPE],
+            token_endpoint_auth_methods_supported: ["none"],
+            code_challenge_methods_supported: ["S256", "plain"],
+            scopes_supported: scopes,
+            agent_auth: {
+                skill: `${b}${p.authMd}`,
+                identity_endpoint: `${b}${p.identity}`,
+                claim_endpoint: `${b}${p.claim}`,
+                identity_types_supported: identityTypesSupported,
+                ...(assertionTypes.length
+                    ? { identity_assertion: { assertion_types_supported: assertionTypes } }
+                    : {}),
+            },
+            ...(opts.asMetadataExtra ?? {}),
+        }, { headers: { "Cache-Control": "public, max-age=3600" } });
+    }
+    function authMd(request) {
+        return new Response(renderAuthMd(baseUrlOf(request), branding.productName, p, types, ttl), {
+            headers: {
+                "content-type": "text/markdown; charset=utf-8",
+                "cache-control": "public, max-age=3600",
+            },
+        });
+    }
+    // ── Registration ──────────────────────────────────────────────────────────
+    async function handleAnonymous() {
+        if (!types.has("anonymous") || !adapter.createAnonymousOrg) {
+            return jsonError("anonymous_not_enabled", "Anonymous registration is not enabled", 400);
+        }
+        const stub = `anon-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
+        const { orgId } = await adapter.createAnonymousOrg({
+            name: `Anonymous agent (${stub})`,
+            metadata: { authMd: "anonymous" },
+        });
+        const domain = policy.anonymousEmailDomain ?? "example.invalid";
+        await ensureStripeCustomer(adapter, orgId, `anonymous+${stub}@${domain}`, config);
+        const key = await adapter.mintApiKey(orgId, `auth.md anonymous (${today()})`);
+        return Response.json({
+            access_token: key.value,
+            token_type: "bearer",
+            expires_in: ttl,
+            scope: "api",
+            organization_id: orgId,
+        });
+    }
+    async function handleVerifiedEmail(email) {
+        try {
+            await sendMagicAuth(email);
+        }
+        catch (e) {
+            return jsonError("server_error", `Failed to send verification code: ${msg(e)}`, 500);
+        }
+        const { claimToken, expiresIn } = await store.create(email);
+        return Response.json({
+            claim_token: claimToken,
+            expires_in: expiresIn,
+            interval: policy.interval ?? 2,
+            verification_uri: `${p.claim}`,
+            user_code_length: policy.userCodeLength ?? 6,
+        });
+    }
+    async function identity(request) {
+        const body = await readBody(request);
+        if (!body)
+            return jsonError("invalid_request", "Body must be JSON");
+        const type = body.type;
+        if (type === "anonymous") {
+            try {
+                return await handleAnonymous();
+            }
+            catch (e) {
+                return jsonError("server_error", msg(e), 500);
+            }
+        }
+        if (type === "identity_assertion") {
+            const at = body.assertion_type;
+            const assertion = body.assertion;
+            if (typeof at !== "string")
+                return jsonError("invalid_request", "assertion_type is required");
+            if (at === "urn:ietf:params:oauth:token-type:id-jag") {
+                return jsonError("issuer_not_enabled", "ID-JAG assertions are not yet accepted");
+            }
+            if (at !== "verified_email" || !types.has("verified_email")) {
+                return jsonError("invalid_request", `Unsupported assertion_type: ${at}`);
+            }
+            if (typeof assertion !== "string" || !assertion.includes("@")) {
+                return jsonError("invalid_request", "assertion must be a valid email for verified_email");
+            }
+            return handleVerifiedEmail(assertion);
+        }
+        return jsonError("invalid_request", "type must be one of: anonymous, identity_assertion");
+    }
+    async function claim(request) {
+        const body = await readBody(request);
+        if (!body)
+            return jsonError("invalid_request", "Body must be JSON");
+        const claimToken = body.claim_token;
+        const userCode = body.user_code;
+        if (typeof claimToken !== "string" || typeof userCode !== "string") {
+            return jsonError("invalid_request", "claim_token and user_code are required");
+        }
+        const entry = await store.get(claimToken);
+        if (entry.status === "not_found")
+            return jsonError("invalid_claim_token", "Unknown or expired claim_token");
+        if (entry.status === "ready")
+            return Response.json({ status: "ready" });
+        if (entry.status === "error")
+            return jsonError("invalid_grant", entry.error);
+        try {
+            const user = await verifyMagicAuth(entry.email, userCode);
+            const { orgId } = await adapter.ensureOrgForUser(user);
+            await ensureStripeCustomer(adapter, orgId, entry.email, config);
+            const key = await adapter.mintApiKey(orgId, `auth.md (${today()})`);
+            await store.markReady(claimToken, { apiKey: key.value, organizationId: orgId });
+            return Response.json({ status: "ready" });
+        }
+        catch (e) {
+            await store.markError(claimToken, msg(e));
+            return jsonError("invalid_grant", msg(e));
+        }
+    }
+    // ── Token (claim polling grant) ─────────────────────────────────────────────
+    /** Handle the claim polling grant. Call from an app's existing /oauth/token
+     *  route when grant_type === CLAIM_GRANT_TYPE, or use the `token` handler. */
+    async function handleClaimGrant(params) {
+        const claimToken = params.claim_token;
+        if (!claimToken)
+            return jsonError("invalid_request", "claim_token is required");
+        const peek = await store.get(claimToken);
+        if (peek.status === "not_found")
+            return jsonError("invalid_grant", "Unknown or expired claim_token");
+        if (peek.status === "pending") {
+            return jsonError("authorization_pending", "Waiting for the user to confirm the code");
+        }
+        const consumed = await store.consume(claimToken);
+        if (consumed.status === "ready") {
+            return Response.json({
+                access_token: consumed.apiKey,
+                token_type: "bearer",
+                expires_in: ttl,
+                scope: "api",
+                organization_id: consumed.organizationId,
+            });
+        }
+        if (consumed.status === "error")
+            return jsonError("invalid_grant", consumed.error);
+        return jsonError("authorization_pending", "Retry");
+    }
+    async function token(request) {
+        const params = await readBody(request);
+        if (!params)
+            return jsonError("invalid_request", "Invalid request body");
+        if (params.grant_type !== CLAIM_GRANT_TYPE) {
+            return jsonError("unsupported_grant_type", `Supported grant type: ${CLAIM_GRANT_TYPE}`);
+        }
+        return handleClaimGrant(params);
+    }
+    // ── Revocation (RFC 7009) ────────────────────────────────────────────────
+    async function revoke(request) {
+        const params = await readBody(request);
+        const t = params?.token;
+        // Per RFC 7009, always 200 (never leak token existence). Best-effort revoke.
+        if (t && adapter.revokeApiKeyByToken) {
+            try {
+                await adapter.revokeApiKeyByToken(t);
+            }
+            catch {
+                /* swallow — spec mandates 200 regardless */
+            }
+        }
+        return new Response(null, { status: 200 });
+    }
+    return {
+        protectedResource,
+        authorizationServer,
+        authMd,
+        identity,
+        claim,
+        token,
+        handleClaimGrant,
+        revoke,
+        /** Bare PRM discovery URL — pass as the REST/MCP factory `resourceMetadata`. */
+        resourceMetadataUrl: (request) => `${baseUrlOf(request)}${p.protectedResource}`,
+        /** Full `WWW-Authenticate` value advertising the PRM discovery doc on a 401. */
+        wwwAuthenticate: (request) => `Bearer resource_metadata="${baseUrlOf(request)}${p.protectedResource}"`,
+    };
+}
+function today() {
+    // Callers pass a name only for display; avoid Date in a way that's fine here.
+    return new Date().toISOString().slice(0, 10);
+}
+function msg(e) {
+    return e instanceof Error ? e.message : String(e);
+}
+function renderAuthMd(baseUrl, product, p, types, ttl) {
+    const rows = [];
+    if (types.has("anonymous")) {
+        rows.push(`| \`anonymous\` | — | You have no user context. You get a working API key immediately. |`);
+    }
+    if (types.has("verified_email")) {
+        rows.push(`| \`identity_assertion\` | \`verified_email\` | You know the user's email. They confirm a 6-digit code; you get a key bound to their workspace. |`);
+    }
+    return `# ${product} — auth.md
+
+This service implements the [auth.md](https://workos.com/auth-md) agent-registration protocol.
+You (an autonomous agent) can register and obtain an API key without a human filling out a form.
+
+## Step 1 — Discover
+
+\`\`\`http
+GET ${baseUrl}${p.authServer}
+\`\`\`
+
+The response includes an \`agent_auth\` block with the endpoints below.
+
+## Step 2 — Pick a method
+
+| \`type\` | \`assertion_type\` | When to use |
+|---|---|---|
+${rows.join("\n")}
+
+## Step 3 — Register
+
+\`\`\`http
+POST ${baseUrl}${p.identity}
+Content-Type: application/json
+\`\`\`
+${types.has("anonymous")
+        ? `
+**Anonymous:** \`{ "type": "anonymous" }\` → \`{ "access_token": "sk_…", "token_type": "bearer", "expires_in": ${ttl}, "scope": "api" }\`. Use the key directly in \`Authorization: Bearer …\` against \`${baseUrl}${p.mcp}\` or \`${baseUrl}${p.rest}/{tool_name}\`.
+`
+        : ""}${types.has("verified_email")
+        ? `
+**Verified email:** \`{ "type": "identity_assertion", "assertion_type": "verified_email", "assertion": "user@example.com" }\` → the service emails the user a 6-digit code and returns \`{ "claim_token": "clm_…", "interval": 2, "user_code_length": 6 }\`. Continue to Step 4.
+
+## Step 4 — Claim ceremony
+
+The user reads back the code; submit it:
+
+\`\`\`http
+POST ${baseUrl}${p.claim}
+Content-Type: application/json
+
+{ "claim_token": "clm_…", "user_code": "123456" }
+\`\`\`
+
+## Step 5 — Exchange the claim for an access token
+
+\`\`\`http
+POST ${baseUrl}${p.token}
+Content-Type: application/x-www-form-urlencoded
+
+grant_type=${CLAIM_GRANT_TYPE}&claim_token=clm_…
+\`\`\`
+
+Returns \`{ "error": "authorization_pending" }\` until the code is entered, then \`{ "access_token": "sk_…", "token_type": "bearer", "expires_in": ${ttl}, "scope": "api" }\`.
+`
+        : ""}
+## Use the access token
+
+All MCP (\`${baseUrl}${p.mcp}\`) and REST (\`${baseUrl}${p.rest}/{tool_name}\`) endpoints accept the same key. Free tools work immediately; paid tools require a token balance.
+
+## Revocation
+
+\`\`\`http
+POST ${baseUrl}${p.revoke}
+Content-Type: application/x-www-form-urlencoded
+
+token=sk_…&token_type_hint=access_token
+\`\`\`
+
+Returns 200 (per RFC 7009; same response whether or not the token existed).
+`;
+}
+//# sourceMappingURL=index.js.map

package/dist/agent-auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/agent-auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAmB,MAAM,kBAAkB,CAAC;AAEvE,iFAAiF;AACjF,iFAAiF;AACjF,2EAA2E;AAC3E,kFAAkF;AAClF,8DAA8D;AAC9D,EAAE;AACF,6DAA6D;AAC7D,0FAA0F;AAC1F,gFAAgF;AAChF,iFAAiF;AAEjF,MAAM,CAAC,MAAM,gBAAgB,GAAG,wCAAwC,CAAC;AAsDzE,MAAM,IAAI,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAEhC,SAAS,SAAS,CAAC,KAAa,EAAE,WAAmB,EAAE,MAAM,GAAG,GAAG;IACjE,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAgB;IAC1C,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAC1B,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC/F,IAAI,IAAI;QAAE,OAAO,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC;IACtC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;AACrC,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,OAAgB;IACtC,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IACrD,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtC,MAAM,GAAG,GAA2B,EAAE,CAAC;YACvC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;gBACpB,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;YACH,OAAO,GAAG,CAAC;QACb,CAAC;QACD,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAA2B,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAsB;IACpD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,IAAI,kBAAkB,EAAE,CAAC;IACtD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAoB,IAAI,CAAC,aAAa,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAChG,MAAM,CAAC,GAA6B;QAClC,GAAG,EAAE,MAAM;QACX,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,UAAU;QAClB,iBAAiB,EAAE,uCAAuC;QAC1D,UAAU,EAAE,yCAAyC;QACrD,QAAQ,EAAE,iBAAiB;QAC3B,KAAK,EAAE,uBAAuB;QAC9B,KAAK,EAAE,cAAc;QACrB,MAAM,EAAE,eAAe;QACvB,GAAG,IAAI,CAAC,KAAK;KACd,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,MAAM,CAAC,cAAc,IAAI,IAAI,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAE/D,MAAM,SAAS,GAAG,CAAC,OAAgB,EAAU,EAAE,CAC7C,OAAO,IAAI,CAAC,OAAO,KAAK,UAAU;QAChC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QACvB,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;IAEpD,4EAA4E;IAE5E,SAAS,iBAAiB,CAAC,OAAgB;QACzC,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QAC7B,OAAO,QAAQ,CAAC,IAAI,CAClB;YACE,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE;YACxB,aAAa,EAAE,QAAQ,CAAC,WAAW;YACnC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,qBAAqB,EAAE,CAAC,CAAC,CAAC;YAC1B,gBAAgB,EAAE,MAAM;YACxB,wBAAwB,EAAE,CAAC,QAAQ,CAAC;SACrC,EACD,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,sBAAsB,EAAE,EAAE,CACzD,CAAC;IACJ,CAAC;IAED,SAAS,mBAAmB,CAAC,OAAgB;QAC3C,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,cAAc,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,MAAM,sBAAsB,GAAG;YAC7B,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D,CAAC;QACF,OAAO,QAAQ,CAAC,IAAI,CAClB;YACE,MAAM,EAAE,CAAC;YACT,sBAAsB,EAAE,GAAG,CAAC,kBAAkB;YAC9C,cAAc,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE;YAChC,mBAAmB,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE;YACtC,wBAAwB,EAAE,CAAC,MAAM,CAAC;YAClC,qBAAqB,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC,EAAE,gBAAgB,CAAC;YAC5E,qCAAqC,EAAE,CAAC,MAAM,CAAC;YAC/C,gCAAgC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;YACnD,gBAAgB,EAAE,MAAM;YACxB,UAAU,EAAE;gBACV,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE;gBACxB,iBAAiB,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;gBACtC,cAAc,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE;gBAChC,wBAAwB,EAAE,sBAAsB;gBAChD,GAAG,CAAC,cAAc,CAAC,MAAM;oBACvB,CAAC,CAAC,EAAE,kBAAkB,EAAE,EAAE,yBAAyB,EAAE,cAAc,EAAE,EAAE;oBACvE,CAAC,CAAC,EAAE,CAAC;aACR;YACD,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC;SAChC,EACD,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,sBAAsB,EAAE,EAAE,CACzD,CAAC;IACJ,CAAC;IAED,SAAS,MAAM,CAAC,OAAgB;QAC9B,OAAO,IAAI,QAAQ,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE;YACzF,OAAO,EAAE;gBACP,cAAc,EAAE,8BAA8B;gBAC9C,eAAe,EAAE,sBAAsB;aACxC;SACF,CAAC,CAAC;IACL,CAAC;IAED,6EAA6E;IAE7E,KAAK,UAAU,eAAe;QAC5B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;YAC3D,OAAO,SAAS,CAAC,uBAAuB,EAAE,uCAAuC,EAAE,GAAG,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,IAAI,GAAG,QAAQ,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QACzF,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC;YACjD,IAAI,EAAE,oBAAoB,IAAI,GAAG;YACjC,QAAQ,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE;SAClC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,oBAAoB,IAAI,iBAAiB,CAAC;QAChE,MAAM,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,aAAa,IAAI,IAAI,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;QAClF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE,sBAAsB,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9E,OAAO,QAAQ,CAAC,IAAI,CAAC;YACnB,YAAY,EAAE,GAAG,CAAC,KAAK;YACvB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,GAAG;YACf,KAAK,EAAE,KAAK;YACZ,eAAe,EAAE,KAAK;SACvB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,mBAAmB,CAAC,KAAa;QAC9C,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,SAAS,CAAC,cAAc,EAAE,qCAAqC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5D,OAAO,QAAQ,CAAC,IAAI,CAAC;YACnB,WAAW,EAAE,UAAU;YACvB,UAAU,EAAE,SAAS;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,CAAC;YAC9B,gBAAgB,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE;YAC9B,gBAAgB,EAAE,MAAM,CAAC,cAAc,IAAI,CAAC;SAC7C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,QAAQ,CAAC,OAAgB;QACtC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;QACpE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QAEvB,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,OAAO,MAAM,eAAe,EAAE,CAAC;YACjC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,SAAS,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QACD,IAAI,IAAI,KAAK,oBAAoB,EAAE,CAAC;YAClC,MAAM,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC;YAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;YACjC,IAAI,OAAO,EAAE,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAC,iBAAiB,EAAE,4BAA4B,CAAC,CAAC;YAC9F,IAAI,EAAE,KAAK,yCAAyC,EAAE,CAAC;gBACrD,OAAO,SAAS,CAAC,oBAAoB,EAAE,wCAAwC,CAAC,CAAC;YACnF,CAAC;YACD,IAAI,EAAE,KAAK,gBAAgB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAC5D,OAAO,SAAS,CAAC,iBAAiB,EAAE,+BAA+B,EAAE,EAAE,CAAC,CAAC;YAC3E,CAAC;YACD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC9D,OAAO,SAAS,CAAC,iBAAiB,EAAE,oDAAoD,CAAC,CAAC;YAC5F,CAAC;YACD,OAAO,mBAAmB,CAAC,SAAS,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,SAAS,CAAC,iBAAiB,EAAE,oDAAoD,CAAC,CAAC;IAC5F,CAAC;IAED,KAAK,UAAU,KAAK,CAAC,OAAgB;QACnC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;QACpE,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACnE,OAAO,SAAS,CAAC,iBAAiB,EAAE,wCAAwC,CAAC,CAAC;QAChF,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW;YAAE,OAAO,SAAS,CAAC,qBAAqB,EAAE,gCAAgC,CAAC,CAAC;QAC5G,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO;YAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACxE,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO;YAAE,OAAO,SAAS,CAAC,eAAe,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAE7E,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YAC1D,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACvD,MAAM,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAChE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE,YAAY,KAAK,EAAE,GAAG,CAAC,CAAC;YACpE,MAAM,KAAK,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;YAChF,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,KAAK,CAAC,SAAS,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1C,OAAO,SAAS,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,+EAA+E;IAE/E;kFAC8E;IAC9E,KAAK,UAAU,gBAAgB,CAAC,MAA8B;QAC5D,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC;QACtC,IAAI,CAAC,UAAU;YAAE,OAAO,SAAS,CAAC,iBAAiB,EAAE,yBAAyB,CAAC,CAAC;QAEhF,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACzC,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW;YAAE,OAAO,SAAS,CAAC,eAAe,EAAE,gCAAgC,CAAC,CAAC;QACrG,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC,uBAAuB,EAAE,0CAA0C,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACjD,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAChC,OAAO,QAAQ,CAAC,IAAI,CAAC;gBACnB,YAAY,EAAE,QAAQ,CAAC,MAAM;gBAC7B,UAAU,EAAE,QAAQ;gBACpB,UAAU,EAAE,GAAG;gBACf,KAAK,EAAE,KAAK;gBACZ,eAAe,EAAE,QAAQ,CAAC,cAAc;aACzC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO;YAAE,OAAO,SAAS,CAAC,eAAe,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;QACnF,OAAO,SAAS,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,UAAU,KAAK,CAAC,OAAgB;QACnC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC,iBAAiB,EAAE,sBAAsB,CAAC,CAAC;QACzE,IAAI,MAAM,CAAC,UAAU,KAAK,gBAAgB,EAAE,CAAC;YAC3C,OAAO,SAAS,CAAC,wBAAwB,EAAE,yBAAyB,gBAAgB,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IAED,4EAA4E;IAE5E,KAAK,UAAU,MAAM,CAAC,OAAgB;QACpC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,CAAC,GAAG,MAAM,EAAE,KAAK,CAAC;QACxB,6EAA6E;QAC7E,IAAI,CAAC,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;YACrC,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,4CAA4C;YAC9C,CAAC;QACH,CAAC;QACD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,OAAO;QACL,iBAAiB;QACjB,mBAAmB;QACnB,MAAM;QACN,QAAQ;QACR,KAAK;QACL,KAAK;QACL,gBAAgB;QAChB,MAAM;QACN,gFAAgF;QAChF,mBAAmB,EAAE,CAAC,OAAgB,EAAE,EAAE,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,iBAAiB,EAAE;QACxF,gFAAgF;QAChF,eAAe,EAAE,CAAC,OAAgB,EAAE,EAAE,CACpC,6BAA6B,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,iBAAiB,GAAG;KAC3E,CAAC;AACJ,CAAC;AAED,SAAS,KAAK;IACZ,8EAA8E;IAC9E,OAAO,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC/C,CAAC;AACD,SAAS,GAAG,CAAC,CAAU;IACrB,OAAO,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,YAAY,CACnB,OAAe,EACf,OAAe,EACf,CAA2B,EAC3B,KAA6B,EAC7B,GAAW;IAEX,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAI,CACP,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAChC,IAAI,CAAC,IAAI,CACP,mJAAmJ,CACpJ,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,OAAO;;;;;;;;MAQf,OAAO,GAAG,CAAC,CAAC,UAAU;;;;;;;;;EAS1B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;;;;;OAKV,OAAO,GAAG,CAAC,CAAC,QAAQ;;;EAIzB,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC;QACpB,CAAC,CAAC;iHAC2G,GAAG,uFAAuF,OAAO,GAAG,CAAC,CAAC,GAAG,WAAW,OAAO,GAAG,CAAC,CAAC,IAAI;CACpP;QACG,CAAC,CAAC,EACN,GACI,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC;QACzB,CAAC,CAAC;;;;;;;;OAQD,OAAO,GAAG,CAAC,CAAC,KAAK;;;;;;;;;OASjB,OAAO,GAAG,CAAC,CAAC,KAAK;;;aAGX,gBAAgB;;;qJAGwH,GAAG;CACvJ;QACK,CAAC,CAAC,EACN;;;aAGW,OAAO,GAAG,CAAC,CAAC,GAAG,mBAAmB,OAAO,GAAG,CAAC,CAAC,IAAI;;;;;OAKxD,OAAO,GAAG,CAAC,CAAC,MAAM;;;;;;;CAOxB,CAAC;AACF,CAAC"}

package/dist/auth.d.ts

@@ -0,0 +1,16 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import type { BillingAdapter, ResolvedConfig, ToolErrorResult } from "./types.js";
+interface AuthStore {
+    authHeader: string | null;
+    orgId?: string;
+}
+export declare const authContext: AsyncLocalStorage<AuthStore>;
+export declare function runWithAuth<T>(header: string | null, fn: () => T): T;
+export declare function runWithResolvedOrg<T>(header: string | null, orgId: string, fn: () => T): T;
+export declare function enforceAccess(adapter: BillingAdapter): Promise<{
+    authorized: true;
+    orgId: string;
+} | ToolErrorResult>;
+export declare function enforceTokens(adapter: BillingAdapter, config: ResolvedConfig, orgId: string, toolName: string, cost: number): Promise<ToolErrorResult | null>;
+export {};
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AASlF,UAAU,SAAS;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAG1B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,WAAW,8BAAqC,CAAC;AAE9D,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAEpE;AAGD,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAE1F;AAKD,wBAAsB,aAAa,CACjC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC;IAAE,UAAU,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,eAAe,CAAC,CAyBhE;AAgBD,wBAAsB,aAAa,CACjC,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CA2BjC"}

package/dist/auth.js

@@ -0,0 +1,80 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import { getBillingCustomerId, getTokenBalance, deductTokens, tryAutoReload, stripeConfigured, } from "./billing.js";
+export const authContext = new AsyncLocalStorage();
+export function runWithAuth(header, fn) {
+    return authContext.run({ authHeader: header }, fn);
+}
+// Used by the MCP transport's OAuth path: run with a pre-resolved org.
+export function runWithResolvedOrg(header, orgId, fn) {
+    return authContext.run({ authHeader: header, orgId }, fn);
+}
+// Resolve the caller's org from the Bearer API key (via the adapter). Returns
+// the org id or a parseable 401 envelope (REST/MCP layers sniff "Unauthorized
+// (401)" to map to HTTP 401 + WWW-Authenticate).
+export async function enforceAccess(adapter) {
+    const store = authContext.getStore();
+    if (store?.orgId)
+        return { authorized: true, orgId: store.orgId };
+    const header = store?.authHeader;
+    if (!header || !header.startsWith("Bearer ")) {
+        return {
+            isError: true,
+            content: [
+                {
+                    type: "text",
+                    text: "Unauthorized (401): Missing or malformed Authorization header. Use get_api_key to obtain an API key.",
+                },
+            ],
+        };
+    }
+    const token = header.slice("Bearer ".length).trim();
+    const resolved = await adapter.validateApiKey(token);
+    if (!resolved) {
+        return {
+            isError: true,
+            content: [{ type: "text", text: "Unauthorized (401): Invalid API key." }],
+        };
+    }
+    return { authorized: true, orgId: resolved.orgId };
+}
+async function isInternalOrg(adapter, orgId, internalDomains) {
+    if (internalDomains.length === 0)
+        return false;
+    const set = new Set(internalDomains.map((d) => d.toLowerCase()));
+    const domains = await adapter.getOrgDomains(orgId);
+    return domains.some((d) => set.has(d.toLowerCase()));
+}
+// Metering gate for paid tools. Free (cost 0), Stripe-unset, and internal orgs
+// are skipped. Otherwise deduct from the org's token balance and fire
+// auto-reload in the background.
+export async function enforceTokens(adapter, config, orgId, toolName, cost) {
+    if (!cost)
+        return null;
+    if (!stripeConfigured())
+        return null;
+    if (await isInternalOrg(adapter, orgId, config.internalDomains))
+        return null;
+    const customerId = await getBillingCustomerId(adapter, orgId);
+    if (!customerId) {
+        return {
+            isError: true,
+            content: [{ type: "text", text: "No billing account found. Please contact support." }],
+        };
+    }
+    const balance = await getTokenBalance(customerId);
+    if (balance < cost) {
+        return {
+            isError: true,
+            content: [
+                {
+                    type: "text",
+                    text: `Insufficient tokens. This tool costs ${cost} tokens but you only have ${balance}. Use buy_tokens to purchase more.`,
+                },
+            ],
+        };
+    }
+    await deductTokens(customerId, toolName, cost, config.currency);
+    tryAutoReload(customerId, config.currency).catch(() => { });
+    return null;
+}
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErD,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,YAAY,EACZ,aAAa,EACb,gBAAgB,GACjB,MAAM,cAAc,CAAC;AAStB,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,iBAAiB,EAAa,CAAC;AAE9D,MAAM,UAAU,WAAW,CAAI,MAAqB,EAAE,EAAW;IAC/D,OAAO,WAAW,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,kBAAkB,CAAI,MAAqB,EAAE,KAAa,EAAE,EAAW;IACrF,OAAO,WAAW,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,8EAA8E;AAC9E,8EAA8E;AAC9E,iDAAiD;AACjD,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAuB;IAEvB,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,EAAE,CAAC;IACrC,IAAI,KAAK,EAAE,KAAK;QAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IAElE,MAAM,MAAM,GAAG,KAAK,EAAE,UAAU,CAAC;IACjC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7C,OAAO;YACL,OAAO,EAAE,IAAI;YACb,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,sGAAsG;iBAC7G;aACF;SACF,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACrD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,sCAAsC,EAAE,CAAC;SAC1E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;AACrD,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,OAAuB,EACvB,KAAa,EACb,eAAyB;IAEzB,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IACnD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,+EAA+E;AAC/E,sEAAsE;AACtE,iCAAiC;AACjC,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAuB,EACvB,MAAsB,EACtB,KAAa,EACb,QAAgB,EAChB,IAAY;IAEZ,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC,gBAAgB,EAAE;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,MAAM,aAAa,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,eAAe,CAAC;QAAE,OAAO,IAAI,CAAC;IAE7E,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC9D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;YACL,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,mDAAmD,EAAE,CAAC;SACvF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,UAAU,CAAC,CAAC;IAClD,IAAI,OAAO,GAAG,IAAI,EAAE,CAAC;QACnB,OAAO;YACL,OAAO,EAAE,IAAI;YACb,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,wCAAwC,IAAI,6BAA6B,OAAO,oCAAoC;iBAC3H;aACF;SACF,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChE,aAAa,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC3D,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/billing.d.ts

@@ -0,0 +1,59 @@
+import Stripe from "stripe";
+import type { BillingAdapter, ResolvedConfig } from "./types.js";
+export declare function getStripe(): Stripe;
+export declare function stripeConfigured(): boolean;
+export interface StripePrice {
+    id: string;
+    productId: string | null;
+    productName: string | null;
+    lookupKey: string | null;
+    nickname: string | null;
+    unitAmount: number | null;
+    currency: string;
+    interval: string | null;
+    intervalCount: number | null;
+}
+/** All active recurring (subscription) prices on the Stripe account. Uses the
+ *  SDK's async auto-pagination so accounts with >1 page of prices aren't
+ *  silently truncated. */
+export declare function listSubscriptionPrices(): Promise<StripePrice[]>;
+/** Resolve a single subscription price without any env config. Resolution
+ *  order: explicit `priceId` → matching `lookupKey` → the sole recurring price.
+ *  Returns null if nothing matches or the choice is ambiguous (multiple prices,
+ *  no lookupKey) — the caller can then list options via listSubscriptionPrices.
+ *  The priceId/lookupKey paths query Stripe directly (no full-list scan). */
+export declare function resolveSubscriptionPrice(opts?: {
+    priceId?: string;
+    lookupKey?: string;
+}): Promise<StripePrice | null>;
+export declare function getBillingCustomerId(adapter: BillingAdapter, orgId: string): Promise<string | null>;
+export declare function ensureStripeCustomer(adapter: BillingAdapter, orgId: string, email: string | undefined, config: ResolvedConfig): Promise<string>;
+export declare function getTokenBalance(stripeCustomerId: string): Promise<number>;
+export declare function deductTokens(stripeCustomerId: string, toolName: string, cost: number, currency: string): Promise<void>;
+export declare function creditTokens(stripeCustomerId: string, amount: number, description: string, currency: string, 
+/** Pass a stable key (e.g. the source invoice/session id) so replayed events
+ *  — a re-delivered webhook, an overlapping poll — credit exactly once. */
+idempotencyKey?: string): Promise<void>;
+export declare function createTokenCheckoutSession(stripeCustomerId: string, orgId: string, amountMajor: number, config: ResolvedConfig): Promise<string>;
+/** A Stripe Billing Portal session URL — the no-code self-serve surface where a
+ *  customer manages their subscription (upgrade/downgrade/cancel), updates the
+ *  payment method (fixes a failing card), and views invoices. */
+export declare function createBillingPortalSession(stripeCustomerId: string, returnUrl: string): Promise<string>;
+export declare function getAutoReloadSettings(stripeCustomerId: string): Promise<{
+    enabled: boolean;
+    threshold: number;
+    reload_to: number;
+} | null>;
+export declare function setAutoReloadSettings(stripeCustomerId: string, threshold: number, reloadTo: number, enabled: boolean): Promise<void>;
+export declare function tryAutoReload(stripeCustomerId: string, currency: string): Promise<void>;
+export declare function listInvoices(stripeCustomerId: string, limit?: number): Promise<Array<{
+    id: string;
+    type: string;
+    number: string | null;
+    amount: number;
+    status: string | null;
+    created: string;
+    invoice_url: string | null;
+    invoice_pdf: string | null;
+}>>;
+//# sourceMappingURL=billing.d.ts.map

package/dist/billing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"billing.d.ts","sourceRoot":"","sources":["../src/billing.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAUjE,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAED,wBAAgB,gBAAgB,IAAI,OAAO,CAE1C;AAQD,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAoBD;;0BAE0B;AAC1B,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAWrE;AAED;;;;6EAI6E;AAC7E,wBAAsB,wBAAwB,CAC5C,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAClD,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAsB7B;AAED,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAExB;AAID,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,MAAM,CAAC,CAwBjB;AAED,wBAAsB,eAAe,CAAC,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAI/E;AAED,wBAAsB,YAAY,CAChC,gBAAgB,EAAE,MAAM,EACxB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAMf;AAED,wBAAsB,YAAY,CAChC,gBAAgB,EAAE,MAAM,EACxB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM;AAChB;2EAC2E;AAC3E,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,IAAI,CAAC,CAUf;AAED,wBAAsB,0BAA0B,CAC9C,gBAAgB,EAAE,MAAM,EACxB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,MAAM,CAAC,CA+BjB;AAED;;iEAEiE;AACjE,wBAAsB,0BAA0B,CAC9C,gBAAgB,EAAE,MAAM,EACxB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,CAMjB;AAED,wBAAsB,qBAAqB,CAAC,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC;IAC7E,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,IAAI,CAAC,CAUR;AAED,wBAAsB,qBAAqB,CACzC,gBAAgB,EAAE,MAAM,EACxB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,IAAI,CAAC,CAQf;AAED,wBAAsB,aAAa,CACjC,gBAAgB,EAAE,MAAM,EACxB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAmCf;AAED,wBAAsB,YAAY,CAChC,gBAAgB,EAAE,MAAM,EACxB,KAAK,SAAK,GACT,OAAO,CACR,KAAK,CAAC;IACJ,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,CAAC,CACH,CAkCA"}