@noodleseed/one 0.76.1 → 0.77.1

package/dist/commands/auth-live-doctor.d.ts

@@ -0,0 +1,11 @@
+import type { ConfigLocation } from '../config.js';
+import type { AuthDoctorCheck } from './auth-metadata-readiness.js';
+interface LiveAuthDoctorArgs {
+    readonly org?: string;
+    readonly app?: string;
+    readonly targetEnv?: string;
+    readonly service?: string;
+}
+export declare function liveAuthDoctorChecks(args: LiveAuthDoctorArgs, env: NodeJS.ProcessEnv, home: ConfigLocation): Promise<AuthDoctorCheck[]>;
+export {};
+//# sourceMappingURL=auth-live-doctor.d.ts.map

package/dist/commands/auth-live-doctor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-live-doctor.d.ts","sourceRoot":"","sources":["../../src/commands/auth-live-doctor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAInD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAGpE,UAAU,kBAAkB;IAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAgBD,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,kBAAkB,EACxB,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,eAAe,EAAE,CAAC,CA8F5B"}

package/dist/commands/auth-live-doctor.js

@@ -0,0 +1,97 @@
+import { readConfig, resolveServiceUrl } from '../config.js';
+import { DEFAULT_SERVICE_URL } from '../deploy.js';
+import { currentCliVersion } from '../update.js';
+import { resolveTenantTarget } from './shared.js';
+export async function liveAuthDoctorChecks(args, env, home) {
+    const target = resolveTenantTarget(args, home);
+    if (!target.ok) {
+        return [
+            {
+                code: 'live_target',
+                level: 'FAIL',
+                name: 'Live exchange',
+                message: target.error.message,
+                fix: target.error.fix,
+            },
+        ];
+    }
+    const token = env.NOODLE_CUSTOMER_TOKEN;
+    if (!token) {
+        return [
+            {
+                code: 'live_customer_token',
+                level: 'FAIL',
+                name: 'Live customer token',
+                message: 'NOODLE_CUSTOMER_TOKEN is not set',
+                fix: 'Set NOODLE_CUSTOMER_TOKEN to a short-lived bearer token for a real customer caller.',
+            },
+        ];
+    }
+    const service = target.serviceUrl ??
+        resolveServiceUrl(args.service, env, readConfig(home)) ??
+        DEFAULT_SERVICE_URL;
+    const url = `${service.replace(/\/+$/, '')}/v1/orgs/${encodeURIComponent(target.org)}` +
+        `/apps/${encodeURIComponent(target.app)}/envs/${encodeURIComponent(target.env)}/auth/doctor`;
+    let response;
+    try {
+        response = await fetch(url, {
+            method: 'POST',
+            headers: {
+                authorization: `Bearer ${token}`,
+                accept: 'application/json',
+                'x-noodle-cli-version': currentCliVersion(),
+            },
+        });
+    }
+    catch (error) {
+        return [
+            {
+                code: 'live_exchange',
+                level: 'FAIL',
+                name: 'Live exchange',
+                message: error instanceof Error ? error.message : String(error),
+                fix: 'Check the service URL and network connection.',
+            },
+        ];
+    }
+    const body = (await response.json().catch(() => ({})));
+    if (!response.ok) {
+        return [
+            {
+                code: 'live_exchange',
+                level: 'FAIL',
+                name: 'Live exchange',
+                message: body.error ?? `HTTP ${response.status}`,
+                fix: response.status === 401
+                    ? 'Mint a fresh customer token for the deployed MCP audience.'
+                    : 'Check the deployed customer auth and delegated connector configuration.',
+            },
+        ];
+    }
+    const checks = (body.checks ?? []).map((check) => ({
+        code: 'live_delegated_exchange',
+        level: check.ok ? 'PASS' : 'FAIL',
+        name: `Live ${check.authKind ?? 'delegated credential'}`,
+        message: [check.connectorId, check.operation].filter(Boolean).join('.') +
+            (check.reason ? `: ${check.reason}` : ''),
+        ...(check.fix ? { fix: check.fix } : {}),
+    }));
+    if (checks.length === 0) {
+        checks.push({
+            code: 'live_exchange',
+            level: 'PASS',
+            name: 'Live exchange',
+            message: 'customer identity verified; no delegated connector bindings are configured',
+        });
+    }
+    if (body.audience) {
+        checks.unshift({
+            code: 'live_customer_audience',
+            level: 'PASS',
+            name: 'Live customer audience',
+            message: body.audience,
+        });
+    }
+    return checks;
+}
+//# sourceMappingURL=auth-live-doctor.js.map

package/dist/commands/auth-live-doctor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-live-doctor.js","sourceRoot":"","sources":["../../src/commands/auth-live-doctor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAuBlD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAwB,EACxB,GAAsB,EACtB,IAAoB;IAEpB,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO;YACL;gBACE,IAAI,EAAE,aAAa;gBACnB,KAAK,EAAE,MAAM;gBACb,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;gBAC7B,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG;aACtB;SACF,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,qBAAqB,CAAC;IACxC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL;gBACE,IAAI,EAAE,qBAAqB;gBAC3B,KAAK,EAAE,MAAM;gBACb,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,kCAAkC;gBAC3C,GAAG,EAAE,qFAAqF;aAC3F;SACF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GACX,MAAM,CAAC,UAAU;QACjB,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;QACtD,mBAAmB,CAAC;IACtB,MAAM,GAAG,GACP,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,YAAY,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;QAC1E,SAAS,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC;IAC/F,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC1B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,MAAM,EAAE,kBAAkB;gBAC1B,sBAAsB,EAAE,iBAAiB,EAAE;aAC5C;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL;gBACE,IAAI,EAAE,eAAe;gBACrB,KAAK,EAAE,MAAM;gBACb,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC/D,GAAG,EAAE,+CAA+C;aACrD;SACF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA2B,CAAC;IACjF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO;YACL;gBACE,IAAI,EAAE,eAAe;gBACrB,KAAK,EAAE,MAAM;gBACb,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,IAAI,CAAC,KAAK,IAAI,QAAQ,QAAQ,CAAC,MAAM,EAAE;gBAChD,GAAG,EACD,QAAQ,CAAC,MAAM,KAAK,GAAG;oBACrB,CAAC,CAAC,4DAA4D;oBAC9D,CAAC,CAAC,yEAAyE;aAChF;SACF,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAsB,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACpE,IAAI,EAAE,yBAAyB;QAC/B,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;QACjC,IAAI,EAAE,QAAQ,KAAK,CAAC,QAAQ,IAAI,sBAAsB,EAAE;QACxD,OAAO,EACL,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAC9D,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzC,CAAC,CAAC,CAAC;IACJ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,eAAe;YACrB,KAAK,EAAE,MAAM;YACb,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,4EAA4E;SACtF,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,MAAM,CAAC,OAAO,CAAC;YACb,IAAI,EAAE,wBAAwB;YAC9B,KAAK,EAAE,MAAM;YACb,IAAI,EAAE,wBAAwB;YAC9B,OAAO,EAAE,IAAI,CAAC,QAAQ;SACvB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/commands/auth-metadata-readiness.d.ts

@@ -1,8 +1,11 @@
 export interface AuthDoctorCheck {
+    readonly code: string;
     readonly level: 'PASS' | 'WARN' | 'FAIL';
     readonly name: string;
+    readonly issuer?: string;
     readonly message: string;
     readonly fix?: string;
 }
-export declare function oidcMetadataChecks(issuer: string, requireGenericHost?: boolean): Promise<AuthDoctorCheck[]>;
+export declare function oidcMetadataChecks(issuer: string): Promise<AuthDoctorCheck[]>;
+export declare function authDiagnosticUrl(value: string): string;
 //# sourceMappingURL=auth-metadata-readiness.d.ts.map

package/dist/commands/auth-metadata-readiness.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-metadata-readiness.d.ts","sourceRoot":"","sources":["../../src/commands/auth-metadata-readiness.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,kBAAkB,UAAQ,GACzB,OAAO,CAAC,eAAe,EAAE,CAAC,CAqF5B"}
+{"version":3,"file":"auth-metadata-readiness.d.ts","sourceRoot":"","sources":["../../src/commands/auth-metadata-readiness.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAiHnF;AAyTD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEvD"}

package/dist/commands/auth-metadata-readiness.js

@@ -1,164 +1,278 @@
-import { discoverIssuerMetadata, issuerMetadataCandidates, } from '@noodle-borg/auth';
-export async function oidcMetadataChecks(issuer, requireGenericHost = false) {
-    let metadata;
-    let candidate;
-    if (requireGenericHost) {
-        const primary = issuerMetadataCandidates(issuer)[0];
-        if (primary === undefined)
-            return [metadataFailure('no issuer metadata candidate')];
-        const loaded = await loadStrictHostMetadata(primary, issuer);
-        if (!loaded.ok)
-            return [loaded.check];
-        metadata = loaded.metadata;
-        candidate = primary;
-    }
-    else {
-        try {
-            const discovered = await discoverIssuerMetadata(issuer, loadMetadata);
-            metadata = discovered.metadata;
-            candidate = discovered;
-        }
-        catch (error) {
-            return [metadataFailure(error instanceof Error ? error.message : String(error))];
-        }
-    }
+import { issuerMetadataCandidates } from '@noodle-borg/auth';
+const MAX_JSON_BYTES = 256 * 1024;
+const FETCH_TIMEOUT_MS = 5_000;
+export async function oidcMetadataChecks(issuer) {
+    const primary = issuerMetadataCandidates(issuer)[0];
+    if (primary === undefined)
+        return [metadataFailure(issuer, 'no issuer metadata candidate')];
+    const loaded = await loadStrictHostMetadata(primary, issuer);
+    if (!loaded.ok)
+        return [loaded.check];
+    const metadata = loaded.metadata;
+    const issuerMatches = metadata.issuer === issuer;
     const checks = [
-        {
-            level: 'PASS',
-            name: requireGenericHost ? 'MCP host discovery' : 'OIDC metadata',
-            message: `${candidate.kind === 'oauth-authorization-server' ? 'RFC 8414 authorization-server metadata' : 'OpenID Connect discovery'} (${candidate.url})`,
-        },
+        pass('oauth_metadata_discovery', 'MCP host discovery', issuer, `RFC 8414 authorization-server metadata (${safeUrl(primary.url)})`),
+        issuerMatches
+            ? pass('oauth_issuer_match', 'Issuer metadata', issuer, 'issuer matches exactly')
+            : fail('oauth_issuer_match', 'Issuer metadata', issuer, 'configured issuer and metadata issuer do not match exactly', 'Publish the exact configured issuer value in the RFC 8414 metadata response.'),
+        endpointCheck(metadata, 'authorization_endpoint', 'oauth_authorization_endpoint', 'Authorization endpoint', issuer, 'Publish an HTTPS authorization_endpoint in RFC 8414 metadata.'),
+        endpointCheck(metadata, 'token_endpoint', 'oauth_token_endpoint', 'Token endpoint', issuer, 'Publish an HTTPS token_endpoint in RFC 8414 metadata.'),
+        endpointCheck(metadata, 'registration_endpoint', 'oauth_registration_endpoint', 'Dynamic client registration', issuer, 'Publish an HTTPS RFC 7591 registration_endpoint so remote MCP clients can register a public OAuth client.'),
+        supportedValueCheck(metadata, 'response_types_supported', 'code', 'oauth_response_type_code', 'Authorization code flow', issuer, 'Advertise "code" in response_types_supported.'),
+        supportedValueCheck(metadata, 'grant_types_supported', 'authorization_code', 'oauth_authorization_code', 'Authorization code grant', issuer, 'Advertise "authorization_code" in grant_types_supported.'),
+        supportedValueCheck(metadata, 'grant_types_supported', 'refresh_token', 'oauth_refresh_token', 'Refresh token grant', issuer, 'Advertise and implement "refresh_token" in grant_types_supported.'),
+        supportedValueCheck(metadata, 'code_challenge_methods_supported', 'S256', 'oauth_pkce_s256', 'PKCE', issuer, 'Advertise and require "S256" in code_challenge_methods_supported.'),
+        supportedValueCheck(metadata, 'token_endpoint_auth_methods_supported', 'none', 'oauth_public_client', 'Public OAuth clients', issuer, 'Advertise and accept "none" in token_endpoint_auth_methods_supported for PKCE public clients.'),
     ];
-    if (requireGenericHost) {
-        const registrationEndpoint = typeof metadata.registration_endpoint === 'string' &&
-            metadata.registration_endpoint.trim().length > 0
-            ? metadata.registration_endpoint
-            : undefined;
-        checks.push(registrationEndpoint === undefined
-            ? {
-                level: 'FAIL',
-                name: 'Dynamic client registration',
-                message: 'missing registration_endpoint',
-                fix: 'Publish an RFC 7591 registration_endpoint so generic MCP hosts such as ChatGPT and Claude can create an OAuth client.',
-            }
-            : {
-                level: 'PASS',
-                name: 'Dynamic client registration',
-                message: registrationEndpoint,
-            });
-    }
-    const jwksUri = typeof metadata.jwks_uri === 'string' ? metadata.jwks_uri : undefined;
+    // Do not follow a JWKS URL supplied by metadata that does not belong to the configured issuer.
+    if (!issuerMatches)
+        return checks;
+    const jwksUri = httpsEndpoint(metadata.jwks_uri);
     if (jwksUri === undefined) {
-        checks.push({
-            level: 'FAIL',
-            name: 'JWKS',
-            message: 'missing jwks_uri',
-            fix: 'Publish a public JWKS URI in issuer metadata.',
-        });
+        checks.push(fail('oauth_jwks', 'JWKS', issuer, 'missing or invalid HTTPS jwks_uri', 'Publish an HTTPS jwks_uri and a public JSON Web Key Set in issuer metadata.'));
         return checks;
     }
-    try {
-        const response = await fetch(jwksUri, {
-            headers: { accept: 'application/json' },
-            redirect: 'manual',
-        });
-        checks.push(response.ok
-            ? { level: 'PASS', name: 'JWKS', message: jwksUri }
-            : {
-                level: 'FAIL',
-                name: 'JWKS',
-                message: `HTTP ${response.status}`,
-                fix: 'Make the JWKS endpoint publicly reachable.',
-            });
-    }
-    catch (error) {
-        checks.push({
-            level: 'FAIL',
-            name: 'JWKS',
-            message: error instanceof Error ? error.message : String(error),
-            fix: 'Make the JWKS endpoint publicly reachable.',
-        });
-    }
+    checks.push(await jwksCheck(jwksUri, issuer));
     return checks;
 }
-async function loadMetadata(url) {
-    const response = await fetch(url, {
-        headers: { accept: 'application/json' },
-        redirect: 'manual',
-    });
-    if (!response.ok)
-        throw new Error(`${url}: HTTP ${response.status}`);
-    const metadata = (await response.json());
-    if (typeof metadata !== 'object' || metadata === null || Array.isArray(metadata)) {
-        throw new Error(`${url}: metadata must be a JSON object`);
-    }
-    return metadata;
-}
 async function loadStrictHostMetadata(candidate, issuer) {
     let response;
     try {
-        response = await fetch(candidate.url, {
-            headers: { accept: 'application/json' },
-            redirect: 'manual',
-        });
+        response = await fetch(candidate.url, requestInit());
     }
     catch (error) {
         return {
             ok: false,
-            check: hostFailure(candidate.url, error instanceof Error ? error.message : String(error)),
+            check: hostFailure(issuer, candidate.url, safeErrorMessage(error, 'metadata request failed')),
         };
     }
     if (response.status !== 200) {
         const location = safeRedirectLocation(response.headers.get('location'), candidate.url);
+        await cancelResponseBody(response);
         return {
             ok: false,
-            check: hostFailure(candidate.url, `HTTP ${response.status}${location === undefined ? '' : ` → ${location}`}`),
+            check: hostFailure(issuer, candidate.url, `HTTP ${response.status}${location === undefined ? '' : ` → ${location}`}`),
         };
     }
-    let metadata;
+    const parsed = await readJsonObject(response);
+    if (!parsed.ok) {
+        return { ok: false, check: hostFailure(issuer, candidate.url, parsed.reason) };
+    }
+    return { ok: true, metadata: parsed.value };
+}
+async function jwksCheck(jwksUri, issuer) {
+    let response;
+    try {
+        response = await fetch(jwksUri, requestInit());
+    }
+    catch (error) {
+        return fail('oauth_jwks', 'JWKS', issuer, safeErrorMessage(error, 'JWKS request failed'), 'Make the public JWKS endpoint directly reachable as HTTP 200 JSON.');
+    }
+    if (response.status !== 200) {
+        await cancelResponseBody(response);
+        return fail('oauth_jwks', 'JWKS', issuer, `${safeUrl(jwksUri)}: HTTP ${response.status}`, 'Make the public JWKS endpoint directly reachable as HTTP 200 JSON.');
+    }
+    const parsed = await readJsonObject(response);
+    if (!parsed.ok) {
+        return fail('oauth_jwks', 'JWKS', issuer, `${safeUrl(jwksUri)}: ${parsed.reason}`, 'Return a bounded JSON Web Key Set with at least one public signing key.');
+    }
+    const keys = Array.isArray(parsed.value.keys) ? parsed.value.keys : [];
+    const publicKeys = keys.filter(isPublicJwk);
+    if (publicKeys.length === 0) {
+        return fail('oauth_jwks', 'JWKS', issuer, `${safeUrl(jwksUri)}: no valid public signing keys`, 'Publish at least one public RSA, EC, or OKP signing key; never publish private key material.');
+    }
+    return pass('oauth_jwks', 'JWKS', issuer, `${safeUrl(jwksUri)} (${publicKeys.length} public signing key${publicKeys.length === 1 ? '' : 's'})`);
+}
+function endpointCheck(metadata, field, code, name, issuer, fix) {
+    const endpoint = httpsEndpoint(metadata[field]);
+    return endpoint === undefined
+        ? fail(code, name, issuer, `missing or invalid HTTPS ${field}`, fix)
+        : pass(code, name, issuer, safeUrl(endpoint));
+}
+function supportedValueCheck(metadata, field, required, code, name, issuer, fix) {
+    const values = Array.isArray(metadata[field])
+        ? metadata[field].filter((value) => typeof value === 'string')
+        : [];
+    return values.includes(required)
+        ? pass(code, name, issuer, `${field} includes "${required}"`)
+        : fail(code, name, issuer, `${field} does not include "${required}"`, fix);
+}
+async function readJsonObject(response) {
+    const contentLength = response.headers.get('content-length');
+    const declaredLength = contentLength === null ? undefined : Number(contentLength);
+    if (declaredLength !== undefined &&
+        Number.isFinite(declaredLength) &&
+        declaredLength > MAX_JSON_BYTES) {
+        await cancelResponseBody(response);
+        return { ok: false, reason: `JSON response exceeds ${MAX_JSON_BYTES} bytes` };
+    }
+    const loaded = await readBoundedText(response);
+    if (!loaded.ok)
+        return loaded;
+    let value;
     try {
-        metadata = await response.json();
+        value = JSON.parse(loaded.text);
     }
     catch {
-        return { ok: false, check: hostFailure(candidate.url, 'metadata is not valid JSON') };
+        return { ok: false, reason: 'response is not valid JSON' };
+    }
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        return { ok: false, reason: 'JSON response must be an object' };
     }
-    if (typeof metadata !== 'object' || metadata === null || Array.isArray(metadata)) {
-        return { ok: false, check: hostFailure(candidate.url, 'metadata must be a JSON object') };
+    return { ok: true, value: value };
+}
+async function readBoundedText(response) {
+    if (response.body === null)
+        return { ok: true, text: '' };
+    const reader = response.body.getReader();
+    const decoder = new TextDecoder();
+    const chunks = [];
+    let bytes = 0;
+    try {
+        while (true) {
+            const chunk = await reader.read();
+            if (chunk.done)
+                break;
+            bytes += chunk.value.byteLength;
+            if (bytes > MAX_JSON_BYTES) {
+                await reader.cancel().catch(() => undefined);
+                return { ok: false, reason: `JSON response exceeds ${MAX_JSON_BYTES} bytes` };
+            }
+            chunks.push(decoder.decode(chunk.value, { stream: true }));
+        }
+        chunks.push(decoder.decode());
+        return { ok: true, text: chunks.join('') };
+    }
+    catch {
+        await reader.cancel().catch(() => undefined);
+        return { ok: false, reason: 'could not read JSON response' };
     }
-    const record = metadata;
-    if (typeof record.issuer !== 'string' ||
-        record.issuer.replace(/\/+$/, '') !== issuer.replace(/\/+$/, '')) {
-        return { ok: false, check: hostFailure(candidate.url, 'issuer metadata mismatch') };
+    finally {
+        reader.releaseLock();
     }
-    return { ok: true, metadata: record };
 }
-function metadataFailure(message) {
-    return {
-        level: 'FAIL',
-        name: 'OIDC metadata',
-        message,
-        fix: 'Expose OpenID Connect or RFC 8414 issuer metadata over HTTPS.',
-    };
+async function cancelResponseBody(response) {
+    await response.body?.cancel().catch(() => undefined);
+}
+function isPublicJwk(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return false;
+    const key = value;
+    if (['d', 'p', 'q', 'dp', 'dq', 'qi', 'oth', 'k'].some((field) => field in key))
+        return false;
+    if (key.use !== undefined && key.use !== 'sig')
+        return false;
+    if (key.key_ops !== undefined &&
+        (!Array.isArray(key.key_ops) || !key.key_ops.includes('verify'))) {
+        return false;
+    }
+    if (key.kty === 'RSA')
+        return validRsaPublicKey(key.n, key.e);
+    if (key.kty === 'EC') {
+        const coordinateBytes = key.crv === 'P-256' ? 32 : key.crv === 'P-384' ? 48 : key.crv === 'P-521' ? 66 : undefined;
+        return (coordinateBytes !== undefined &&
+            base64UrlBytes(key.x)?.byteLength === coordinateBytes &&
+            base64UrlBytes(key.y)?.byteLength === coordinateBytes);
+    }
+    if (key.kty === 'OKP') {
+        const coordinateBytes = key.crv === 'Ed25519' ? 32 : key.crv === 'Ed448' ? 57 : undefined;
+        return coordinateBytes !== undefined && base64UrlBytes(key.x)?.byteLength === coordinateBytes;
+    }
+    return false;
+}
+function validRsaPublicKey(modulusValue, exponentValue) {
+    const modulus = base64UrlBytes(modulusValue);
+    const exponent = base64UrlBytes(exponentValue);
+    if (modulus === undefined || exponent === undefined || exponent.byteLength > 8)
+        return false;
+    if (modulus.byteLength < 256)
+        return false;
+    if (modulus.byteLength === 256 && (modulus[0] ?? 0) < 0x80)
+        return false;
+    if (((modulus.at(-1) ?? 0) & 1) === 0)
+        return false;
+    let exponentNumber = 0n;
+    for (const byte of exponent)
+        exponentNumber = (exponentNumber << 8n) | BigInt(byte);
+    return exponentNumber >= 3n && (exponentNumber & 1n) === 1n;
+}
+function base64UrlBytes(value) {
+    if (!nonEmpty(value) || !/^[A-Za-z0-9_-]+$/u.test(value) || value.length % 4 === 1) {
+        return undefined;
+    }
+    const decoded = Buffer.from(value, 'base64url');
+    return decoded.byteLength > 0 && decoded.toString('base64url') === value ? decoded : undefined;
+}
+function httpsEndpoint(value) {
+    if (!nonEmpty(value))
+        return undefined;
+    try {
+        const parsed = new URL(value);
+        if (parsed.protocol !== 'https:' || parsed.username || parsed.password)
+            return undefined;
+        return parsed.toString();
+    }
+    catch {
+        return undefined;
+    }
 }
-function hostFailure(url, reason) {
+function nonEmpty(value) {
+    return typeof value === 'string' && value.trim().length > 0;
+}
+function requestInit() {
     return {
-        level: 'FAIL',
-        name: 'MCP host discovery',
-        message: `${url}: ${reason}`,
-        fix: 'Serve this path-inserted RFC 8414 metadata URL directly as HTTP 200 JSON without redirecting to login.',
+        headers: { accept: 'application/json' },
+        redirect: 'manual',
+        signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
     };
 }
+function pass(code, name, issuer, message) {
+    return { code, level: 'PASS', name, issuer: authDiagnosticUrl(issuer), message };
+}
+function fail(code, name, issuer, message, fix) {
+    return { code, level: 'FAIL', name, issuer: authDiagnosticUrl(issuer), message, fix };
+}
+function metadataFailure(issuer, message) {
+    return hostFailure(issuer, issuer, message);
+}
+function hostFailure(issuer, url, reason) {
+    return fail('oauth_metadata_discovery', 'MCP host discovery', issuer, `${safeUrl(url)}: ${reason}`, 'Serve this path-inserted RFC 8414 metadata URL directly as HTTP 200 JSON without redirecting to login.');
+}
 function safeRedirectLocation(location, base) {
     if (location === null)
         return undefined;
     try {
-        const parsed = new URL(location, base);
+        return safeUrl(new URL(location, base).toString());
+    }
+    catch {
+        return undefined;
+    }
+}
+function safeUrl(value) {
+    try {
+        const parsed = new URL(value);
+        const hadCredentials = parsed.username.length > 0 || parsed.password.length > 0;
+        parsed.username = '';
+        parsed.password = '';
         parsed.search = '';
         parsed.hash = '';
-        return parsed.toString();
+        const sanitized = parsed.toString();
+        const firstSensitiveDelimiter = value.search(/[?#]/u);
+        const originalWithoutQuery = firstSensitiveDelimiter === -1 ? value : value.slice(0, firstSensitiveDelimiter);
+        return !hadCredentials && sanitized === `${originalWithoutQuery}/`
+            ? originalWithoutQuery
+            : sanitized;
     }
     catch {
-        return undefined;
+        return 'invalid URL';
     }
 }
+export function authDiagnosticUrl(value) {
+    return safeUrl(value);
+}
+function safeErrorMessage(error, fallback) {
+    const message = error instanceof Error ? error.message : String(error);
+    const withoutUrls = message.replace(/https?:\/\/\S+/gu, '[URL]');
+    return withoutUrls.trim().slice(0, 240) || fallback;
+}
 //# sourceMappingURL=auth-metadata-readiness.js.map

package/dist/commands/auth-metadata-readiness.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-metadata-readiness.js","sourceRoot":"","sources":["../../src/commands/auth-metadata-readiness.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EAEtB,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAS3B,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc,EACd,kBAAkB,GAAG,KAAK;IAE1B,IAAI,QAAiC,CAAC;IACtC,IAAI,SAAkC,CAAC;IAEvC,IAAI,kBAAkB,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,CAAC,eAAe,CAAC,8BAA8B,CAAC,CAAC,CAAC;QACpF,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC3B,SAAS,GAAG,OAAO,CAAC;IACtB,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YACtE,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;YAC/B,SAAS,GAAG,UAAU,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,eAAe,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAsB;QAChC;YACE,KAAK,EAAE,MAAM;YACb,IAAI,EAAE,kBAAkB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,eAAe;YACjE,OAAO,EAAE,GAAG,SAAS,CAAC,IAAI,KAAK,4BAA4B,CAAC,CAAC,CAAC,wCAAwC,CAAC,CAAC,CAAC,0BAA0B,KAAK,SAAS,CAAC,GAAG,GAAG;SACzJ;KACF,CAAC;IAEF,IAAI,kBAAkB,EAAE,CAAC;QACvB,MAAM,oBAAoB,GACxB,OAAO,QAAQ,CAAC,qBAAqB,KAAK,QAAQ;YAClD,QAAQ,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAC9C,CAAC,CAAC,QAAQ,CAAC,qBAAqB;YAChC,CAAC,CAAC,SAAS,CAAC;QAChB,MAAM,CAAC,IAAI,CACT,oBAAoB,KAAK,SAAS;YAChC,CAAC,CAAC;gBACE,KAAK,EAAE,MAAM;gBACb,IAAI,EAAE,6BAA6B;gBACnC,OAAO,EAAE,+BAA+B;gBACxC,GAAG,EAAE,uHAAuH;aAC7H;YACH,CAAC,CAAC;gBACE,KAAK,EAAE,MAAM;gBACb,IAAI,EAAE,6BAA6B;gBACnC,OAAO,EAAE,oBAAoB;aAC9B,CACN,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IACtF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,MAAM;YACb,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,kBAAkB;YAC3B,GAAG,EAAE,+CAA+C;SACrD,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE;YACpC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CACT,QAAQ,CAAC,EAAE;YACT,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE;YACnD,CAAC,CAAC;gBACE,KAAK,EAAE,MAAM;gBACb,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE,QAAQ,QAAQ,CAAC,MAAM,EAAE;gBAClC,GAAG,EAAE,4CAA4C;aAClD,CACN,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,MAAM;YACb,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAC/D,GAAG,EAAE,4CAA4C;SAClD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,GAAW;IACrC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAChC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;QACvC,QAAQ,EAAE,QAAQ;KACnB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,UAAU,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAY,CAAC;IACpD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,kCAAkC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,QAAmC,CAAC;AAC7C,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,SAAkC,EAClC,MAAc;IAKd,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE;YACpC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,WAAW,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;SAC1F,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,oBAAoB,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC;QACvF,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,WAAW,CAChB,SAAS,CAAC,GAAG,EACb,QAAQ,QAAQ,CAAC,MAAM,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,QAAQ,EAAE,EAAE,CAC3E;SACF,CAAC;IACJ,CAAC;IACD,IAAI,QAAiB,CAAC;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,SAAS,CAAC,GAAG,EAAE,4BAA4B,CAAC,EAAE,CAAC;IACxF,CAAC;IACD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,SAAS,CAAC,GAAG,EAAE,gCAAgC,CAAC,EAAE,CAAC;IAC5F,CAAC;IACD,MAAM,MAAM,GAAG,QAAmC,CAAC;IACnD,IACE,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;QACjC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAChE,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,SAAS,CAAC,GAAG,EAAE,0BAA0B,CAAC,EAAE,CAAC;IACtF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,eAAe,CAAC,OAAe;IACtC,OAAO;QACL,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,eAAe;QACrB,OAAO;QACP,GAAG,EAAE,+DAA+D;KACrE,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,GAAW,EAAE,MAAc;IAC9C,OAAO;QACL,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,GAAG,GAAG,KAAK,MAAM,EAAE;QAC5B,GAAG,EAAE,wGAAwG;KAC9G,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAuB,EAAE,IAAY;IACjE,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACvC,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACjB,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}
+{"version":3,"file":"auth-metadata-readiness.js","sourceRoot":"","sources":["../../src/commands/auth-metadata-readiness.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgC,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAE3F,MAAM,cAAc,GAAG,GAAG,GAAG,IAAI,CAAC;AAClC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAW/B,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAAc;IACrD,MAAM,OAAO,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,CAAC,eAAe,CAAC,MAAM,EAAE,8BAA8B,CAAC,CAAC,CAAC;IAC5F,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7D,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEtC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC;IACjD,MAAM,MAAM,GAAsB;QAChC,IAAI,CACF,0BAA0B,EAC1B,oBAAoB,EACpB,MAAM,EACN,2CAA2C,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CACnE;QACD,aAAa;YACX,CAAC,CAAC,IAAI,CAAC,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,EAAE,wBAAwB,CAAC;YACjF,CAAC,CAAC,IAAI,CACF,oBAAoB,EACpB,iBAAiB,EACjB,MAAM,EACN,4DAA4D,EAC5D,8EAA8E,CAC/E;QACL,aAAa,CACX,QAAQ,EACR,wBAAwB,EACxB,8BAA8B,EAC9B,wBAAwB,EACxB,MAAM,EACN,+DAA+D,CAChE;QACD,aAAa,CACX,QAAQ,EACR,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,MAAM,EACN,uDAAuD,CACxD;QACD,aAAa,CACX,QAAQ,EACR,uBAAuB,EACvB,6BAA6B,EAC7B,6BAA6B,EAC7B,MAAM,EACN,2GAA2G,CAC5G;QACD,mBAAmB,CACjB,QAAQ,EACR,0BAA0B,EAC1B,MAAM,EACN,0BAA0B,EAC1B,yBAAyB,EACzB,MAAM,EACN,+CAA+C,CAChD;QACD,mBAAmB,CACjB,QAAQ,EACR,uBAAuB,EACvB,oBAAoB,EACpB,0BAA0B,EAC1B,0BAA0B,EAC1B,MAAM,EACN,0DAA0D,CAC3D;QACD,mBAAmB,CACjB,QAAQ,EACR,uBAAuB,EACvB,eAAe,EACf,qBAAqB,EACrB,qBAAqB,EACrB,MAAM,EACN,mEAAmE,CACpE;QACD,mBAAmB,CACjB,QAAQ,EACR,kCAAkC,EAClC,MAAM,EACN,iBAAiB,EACjB,MAAM,EACN,MAAM,EACN,mEAAmE,CACpE;QACD,mBAAmB,CACjB,QAAQ,EACR,uCAAuC,EACvC,MAAM,EACN,qBAAqB,EACrB,sBAAsB,EACtB,MAAM,EACN,+FAA+F,CAChG;KACF,CAAC;IAEF,+FAA+F;IAC/F,IAAI,CAAC,aAAa;QAAE,OAAO,MAAM,CAAC;IAElC,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CACT,IAAI,CACF,YAAY,EACZ,MAAM,EACN,MAAM,EACN,mCAAmC,EACnC,6EAA6E,CAC9E,CACF,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,SAAkC,EAClC,MAAc;IAKd,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,EAAE,gBAAgB,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAAC;SAC9F,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,oBAAoB,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC;QACvF,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACnC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,WAAW,CAChB,MAAM,EACN,SAAS,CAAC,GAAG,EACb,QAAQ,QAAQ,CAAC,MAAM,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,QAAQ,EAAE,EAAE,CAC3E;SACF,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;IACjF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AAC9C,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,OAAe,EAAE,MAAc;IACtD,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,IAAI,CACT,YAAY,EACZ,MAAM,EACN,MAAM,EACN,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,CAAC,EAC9C,oEAAoE,CACrE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACnC,OAAO,IAAI,CACT,YAAY,EACZ,MAAM,EACN,MAAM,EACN,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,QAAQ,CAAC,MAAM,EAAE,EAC9C,oEAAoE,CACrE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,IAAI,CACT,YAAY,EACZ,MAAM,EACN,MAAM,EACN,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,EACvC,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC5C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CACT,YAAY,EACZ,MAAM,EACN,MAAM,EACN,GAAG,OAAO,CAAC,OAAO,CAAC,gCAAgC,EACnD,8FAA8F,CAC/F,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CACT,YAAY,EACZ,MAAM,EACN,MAAM,EACN,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,UAAU,CAAC,MAAM,sBAAsB,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CACrG,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,QAAiC,EACjC,KAAa,EACb,IAAY,EACZ,IAAY,EACZ,MAAc,EACd,GAAW;IAEX,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAChD,OAAO,QAAQ,KAAK,SAAS;QAC3B,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,4BAA4B,KAAK,EAAE,EAAE,GAAG,CAAC;QACpE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,mBAAmB,CAC1B,QAAiC,EACjC,KAAa,EACb,QAAgB,EAChB,IAAY,EACZ,IAAY,EACZ,MAAc,EACd,GAAW;IAEX,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;QAC/E,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC9B,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,cAAc,QAAQ,GAAG,CAAC;QAC7D,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,sBAAsB,QAAQ,GAAG,EAAE,GAAG,CAAC,CAAC;AAC/E,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,QAAkB;IAKlB,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC7D,MAAM,cAAc,GAAG,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAClF,IACE,cAAc,KAAK,SAAS;QAC5B,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC/B,cAAc,GAAG,cAAc,EAC/B,CAAC;QACD,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,cAAc,QAAQ,EAAE,CAAC;IAChF,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC;IAC9B,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IAC7D,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;IAClE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAgC,EAAE,CAAC;AAC/D,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,QAAkB;IAIlB,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAC1D,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAClC,IAAI,KAAK,CAAC,IAAI;gBAAE,MAAM;YACtB,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC;YAChC,IAAI,KAAK,GAAG,cAAc,EAAE,CAAC;gBAC3B,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAC7C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,cAAc,QAAQ,EAAE,CAAC;YAChF,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC7C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IAC/D,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,QAAkB;IAClD,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtF,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9F,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAC7D,IACE,GAAG,CAAC,OAAO,KAAK,SAAS;QACzB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAChE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK;QAAE,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IAC9D,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,eAAe,GACnB,GAAG,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7F,OAAO,CACL,eAAe,KAAK,SAAS;YAC7B,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,KAAK,eAAe;YACrD,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,KAAK,eAAe,CACtD,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;QACtB,MAAM,eAAe,GAAG,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1F,OAAO,eAAe,KAAK,SAAS,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,KAAK,eAAe,CAAC;IAChG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,YAAqB,EAAE,aAAsB;IACtE,MAAM,OAAO,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,cAAc,CAAC,aAAa,CAAC,CAAC;IAC/C,IAAI,OAAO,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,UAAU,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7F,IAAI,OAAO,CAAC,UAAU,GAAG,GAAG;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,OAAO,CAAC,UAAU,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI;QAAE,OAAO,KAAK,CAAC;IACzE,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,cAAc,GAAG,EAAE,CAAC;IACxB,KAAK,MAAM,IAAI,IAAI,QAAQ;QAAE,cAAc,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACpF,OAAO,cAAc,IAAI,EAAE,IAAI,CAAC,cAAc,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC;AAC9D,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACnF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAChD,OAAO,OAAO,CAAC,UAAU,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACjG,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC;QACzF,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,WAAW;IAClB,OAAO;QACL,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;QACvC,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;KAC9C,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,IAAY,EAAE,IAAY,EAAE,MAAc,EAAE,OAAe;IACvE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;AACnF,CAAC;AAED,SAAS,IAAI,CACX,IAAY,EACZ,IAAY,EACZ,MAAc,EACd,OAAe,EACf,GAAW;IAEX,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AACxF,CAAC;AAED,SAAS,eAAe,CAAC,MAAc,EAAE,OAAe;IACtD,OAAO,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,GAAW,EAAE,MAAc;IAC9D,OAAO,IAAI,CACT,0BAA0B,EAC1B,oBAAoB,EACpB,MAAM,EACN,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,EAAE,EAC5B,wGAAwG,CACzG,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAuB,EAAE,IAAY;IACjE,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QAChF,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAC;QACrB,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAC;QACrB,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACjB,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpC,MAAM,uBAAuB,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,oBAAoB,GACxB,uBAAuB,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,uBAAuB,CAAC,CAAC;QACnF,OAAO,CAAC,cAAc,IAAI,SAAS,KAAK,GAAG,oBAAoB,GAAG;YAChE,CAAC,CAAC,oBAAoB;YACtB,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,aAAa,CAAC;IACvB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAE,QAAgB;IACxD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;IACjE,OAAO,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,QAAQ,CAAC;AACtD,CAAC"}

package/dist/commands/auth-ops.d.ts

@@ -1,6 +1,22 @@
 import type { ConfigLocation } from '../config.js';
 import { type AuthDoctorCheck } from './auth-metadata-readiness.js';
+interface AuthDoctorArgs {
+    readonly entrypoint?: string;
+    readonly json: boolean;
+    readonly live: boolean;
+    readonly org?: string;
+    readonly app?: string;
+    readonly targetEnv?: string;
+    readonly service?: string;
+}
 export declare function runAuth(rest: readonly string[], env?: NodeJS.ProcessEnv, home?: ConfigLocation): Promise<number>;
+export declare function staticAuthDoctor(args: AuthDoctorArgs): Promise<AuthDoctorCheck[]>;
 /** Failures that must be cleared before an interactive local host preview can claim OAuth readiness. */
 export declare function genericHostAuthReadiness(entrypoint: string): Promise<readonly AuthDoctorCheck[]>;
+export interface AuthReadiness {
+    readonly ready: boolean;
+    readonly checks: readonly AuthDoctorCheck[];
+}
+export declare function authReadinessForEntrypoint(entrypoint: string): Promise<AuthReadiness>;
+export {};
 //# sourceMappingURL=auth-ops.d.ts.map

package/dist/commands/auth-ops.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-ops.d.ts","sourceRoot":"","sources":["../../src/commands/auth-ops.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAMnD,OAAO,EAAE,KAAK,eAAe,EAAsB,MAAM,8BAA8B,CAAC;AAexF,wBAAsB,OAAO,CAC3B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,IAAI,CAAC,EAAE,cAAc,GACpB,OAAO,CAAC,MAAM,CAAC,CASjB;AAuPD,wGAAwG;AACxG,wBAAsB,wBAAwB,CAC5C,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,SAAS,eAAe,EAAE,CAAC,CAQrC"}
+{"version":3,"file":"auth-ops.d.ts","sourceRoot":"","sources":["../../src/commands/auth-ops.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAKnD,OAAO,EACL,KAAK,eAAe,EAGrB,MAAM,8BAA8B,CAAC;AAGtC,UAAU,cAAc;IACtB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,wBAAsB,OAAO,CAC3B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,IAAI,CAAC,EAAE,cAAc,GACpB,OAAO,CAAC,MAAM,CAAC,CASjB;AAeD,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAqRvF;AAED,wGAAwG;AACxG,wBAAsB,wBAAwB,CAC5C,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,SAAS,eAAe,EAAE,CAAC,CAGrC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,CAAC;CAC7C;AAED,wBAAsB,0BAA0B,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAM3F"}