authflow-cli 0.1.0

package/dist/integration.js

@@ -0,0 +1,247 @@
+import { originApiKeyConfigKey, originApiKeyEnvVar } from "./secrets.js";
+/**
+ * Framework-specific integration instructions, emitted as structured data rather than prose.
+ *
+ * The consumer is usually not a human: it is the creator's own coding agent, which already has the
+ * codebase open. The rail cannot see their files and should not try to — it supplies the plan, the
+ * agent applies it. That split is also what keeps this honest as a public contract: everything here
+ * is derived from the receipt and the published spec, never from rail internals.
+ */
+export const integrationFrameworks = ["dotnet", "typescript", "python", "proxy"];
+export function isIntegrationFramework(value) {
+    return integrationFrameworks.includes(value);
+}
+export function buildIntegrationPlan(framework, receipt) {
+    return {
+        ...frameworkPlan(framework, receipt),
+        metering: meteringAdvice(receipt.metering_mode === "gateway_metered"),
+    };
+}
+function frameworkPlan(framework, receipt) {
+    const issuer = receipt.issuer ?? "";
+    const resource = receipt.resource ?? receipt.gateway_url ?? "";
+    const slug = receipt.slug ?? "";
+    const configuration = {
+        AUTHFLOW_ISSUER: issuer,
+        AUTHFLOW_RESOURCE: resource,
+    };
+    const secrets = {
+        key: originApiKeyConfigKey,
+        envVar: originApiKeyEnvVar,
+        note: "Shown once at registration. Store it in a secret store (dotnet user-secrets locally, Key " +
+            "Vault in Azure) — never in a committed config file or a receipt left on disk.",
+    };
+    const invariants = [
+        "Serve MCP at /mcp on the origin. The gateway appends /mcp to the origin base URI, so an " +
+            "origin base URI that already ends in /mcp would be called at /mcp/mcp.",
+        "Verify X-Authflow-Identity on every request to /mcp and fail closed with HTTP 403 and no " +
+            "WWW-Authenticate. Never 401 from the origin: that kicks clients into OAuth against you.",
+        "Never return a payment URL as tool output. Credit exhaustion is a plain tool error.",
+        "Never cache remaining_credits or infer entitlements. The rail's counter is the only source.",
+        "Publish only the gateway URL to clients. The origin hostname is never client-facing.",
+        "Every MCP tool must declare title and readOnlyHint/destructiveHint.",
+    ];
+    const verification = [
+        "Unauthenticated POST to the origin's /mcp returns 403 with no WWW-Authenticate.",
+        `Run the conformance probe (authflow probe) — it must pass before the resource takes paid traffic.`,
+        `Add the gateway URL ${resource} to Claude or Cursor. First connect must 401 from the gateway, not from the origin.`,
+    ];
+    switch (framework) {
+        case "dotnet":
+            return {
+                framework,
+                summary: "ASP.NET Core origin using the Authflow.Origin package, which implements identity-header " +
+                    "verification and the usage-reporting client from the published spec.",
+                configuration,
+                secrets,
+                steps: [
+                    {
+                        title: "Add the package",
+                        action: "Add the Authflow.Origin NuGet package to the MCP server project.",
+                        command: "dotnet add package Authflow.Origin",
+                    },
+                    {
+                        title: "Wire the middleware",
+                        action: "Register Authflow services, warm the key ring at startup, and add the middleware " +
+                            "before the MCP endpoints are mapped so unsigned requests never reach a tool.",
+                        file: "Program.cs",
+                        snippet: [
+                            "builder.Services.AddAuthflowOrigin(builder.Configuration);",
+                            "",
+                            "var app = builder.Build();",
+                            "",
+                            "await app.WarmAuthflowOriginKeysAsync();",
+                            "app.UseAuthflowOrigin();",
+                            "app.MapMcp(\"/mcp\");",
+                        ].join("\n"),
+                    },
+                    {
+                        title: "Configure issuer and resource",
+                        action: "Add the Authflow section to appsettings.json (these are not secrets).",
+                        file: "appsettings.json",
+                        snippet: JSON.stringify({ Authflow: { Issuer: issuer, Resource: resource } }, null, 2),
+                    },
+                    {
+                        title: "Store the origin API key",
+                        action: "Put the origin API key in user-secrets. The CLI can do this for you at registration " +
+                            "with --write-secrets user-secrets.",
+                        command: `dotnet user-secrets set "${originApiKeyConfigKey}" "<origin-api-key>"`,
+                    },
+                    {
+                        title: "Read the verified caller",
+                        action: "In each billable tool, take the caller from the verified identity rather than from " +
+                            "anything client-supplied.",
+                        snippet: "var identity = context.RequireAuthflowIdentity(); // identity.Subject, identity.Tier",
+                    },
+                ],
+                verification,
+                invariants,
+            };
+        case "typescript":
+            return {
+                framework,
+                summary: "TypeScript/Node origin implementing Origin Protocol v1 in-process. There is no published " +
+                    "npm middleware yet, so the verification steps are implemented against the spec.",
+                configuration,
+                secrets,
+                steps: [
+                    {
+                        title: "Fetch and cache the verification keys",
+                        action: `At startup, GET ${issuer}${"/.well-known/authflow-origin-keys"} and cache it. Cap the ` +
+                            "cache at 3600s, refresh once on an unknown kid, and keep the last good document if a " +
+                            "refresh fails. Reject any document whose issuer is not exactly your configured issuer.",
+                    },
+                    {
+                        title: "Verify the identity header on every /mcp request",
+                        action: "Parse X-Authflow-Identity as v1;<claims_b64>;<signature_b64>. Verify the Ed25519 " +
+                            "signature over the ASCII bytes of \"v1;\" + claims_b64. Then check the claims: issuer " +
+                            "and resource byte-equal to your configuration, iat/exp within 60s leeway, TTL <= 300s, " +
+                            "and the nonce unseen. Reject with 403 and the exact spec §6.2 body.",
+                        snippet: [
+                            "// Node has Ed25519 built in — no dependency needed.",
+                            "import { verify, createPublicKey } from \"node:crypto\";",
+                            "",
+                            "const signingInput = Buffer.from(`v1;${claimsB64}`, \"ascii\");",
+                            "const ok = verify(null, signingInput, publicKey, signature);",
+                        ].join("\n"),
+                    },
+                    {
+                        title: "Return the fail-closed 403",
+                        action: "On any verification failure, return this exact shape. No WWW-Authenticate header.",
+                        snippet: JSON.stringify({ error: "invalid_origin_identity", error_code: "<spec §6.2 code>" }, null, 2),
+                    },
+                    {
+                        title: "Debit before calling your provider",
+                        action: `POST ${issuer}${"/origin/v1/usage"} with Authorization: Bearer <origin API key> and an ` +
+                            "Idempotency-Key header equal to the body's idempotency_key. Do this BEFORE the provider " +
+                            "call. On 409 insufficient_credits, return a tool error with no payment URL.",
+                    },
+                    {
+                        title: "Compensate on failure",
+                        action: "If the provider call or artifact persistence fails after a successful debit, POST a " +
+                            "credit whose compensates field is the debit's idempotency key.",
+                    },
+                ],
+                verification,
+                invariants,
+            };
+        case "python":
+            return {
+                framework,
+                summary: "Python origin implementing Origin Protocol v1 in-process. No published package yet, so " +
+                    "verification is implemented against the spec.",
+                configuration,
+                secrets,
+                steps: [
+                    {
+                        title: "Install an Ed25519 implementation",
+                        action: "Python has no stdlib Ed25519 verifier.",
+                        command: "pip install cryptography",
+                    },
+                    {
+                        title: "Fetch and cache the verification keys",
+                        action: `At startup, GET ${issuer}${"/.well-known/authflow-origin-keys"} and cache it (cap 3600s, ` +
+                            "one forced refresh on unknown kid, keep last good on failure). Reject a document whose " +
+                            "issuer is not exactly your configured issuer.",
+                    },
+                    {
+                        title: "Verify the identity header on every /mcp request",
+                        action: "Parse v1;<claims_b64>;<signature_b64>, verify Ed25519 over b\"v1;\" + claims_b64, then " +
+                            "validate issuer, resource, iat/exp (60s leeway), TTL <= 300s, and nonce replay.",
+                        snippet: [
+                            "from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey",
+                            "",
+                            "signing_input = b\"v1;\" + claims_b64.encode(\"ascii\")",
+                            "Ed25519PublicKey.from_public_bytes(x).verify(signature, signing_input)",
+                        ].join("\n"),
+                    },
+                    {
+                        title: "Return the fail-closed 403",
+                        action: "On any verification failure return the spec §6.2 body with HTTP 403 and no WWW-Authenticate.",
+                    },
+                    {
+                        title: "Debit before the provider, compensate on failure",
+                        action: `POST ${issuer}${"/origin/v1/usage"} with a Bearer origin API key and an Idempotency-Key ` +
+                            "header matching the body. Debit before the provider call; credit with compensates set " +
+                            "if the user does not get a successful result.",
+                    },
+                ],
+                verification,
+                invariants,
+            };
+        case "proxy":
+            return {
+                framework,
+                summary: "Language-agnostic: run the authflow-origin-proxy sidecar in front of the existing MCP " +
+                    "server. The proxy verifies the identity header and forwards plain headers upstream, so " +
+                    "the MCP server itself needs no changes.",
+                configuration: {
+                    ...configuration,
+                    AUTHFLOW_UPSTREAM_BASE_URI: "http://upstream:3000",
+                },
+                secrets,
+                steps: [
+                    {
+                        title: "Register the proxy as the origin",
+                        action: "The proxy is what the gateway talks to, so origin_base_uri must be the proxy's URL, " +
+                            "not the upstream MCP server's.",
+                        command: `authflow set-origin --slug ${slug} --origin-url https://your-proxy.example`,
+                    },
+                    {
+                        title: "Generate the compose and env files",
+                        action: "Scaffold the sidecar configuration from the receipt.",
+                        command: "authflow scaffold --receipt receipt.json --upstream http://upstream:3000",
+                    },
+                    {
+                        title: "Consume the forwarded identity",
+                        action: "Upstream receives X-Authflow-User, X-Authflow-Tier, and X-Authflow-Nonce after " +
+                            "verification. Trust these only because the proxy is the sole ingress — do not expose " +
+                            "the upstream directly.",
+                    },
+                    {
+                        title: "Set a shared nonce cache before scaling",
+                        action: "Replay protection is process-local by default, so more than one replica reopens a " +
+                            "replay window. Set Authflow__NonceCacheRedis before raising replicas above 1.",
+                    },
+                ],
+                verification,
+                invariants,
+            };
+    }
+}
+/**
+ * Origins that bill exactly one unit per tool call can skip debit/compensate entirely by declaring
+ * per-tool costs at registration. It is the largest and subtlest part of the integration, so the
+ * plan should say so rather than leaving it to be discovered in §9 of the quickstart.
+ */
+export function meteringAdvice(gatewayMetered) {
+    return gatewayMetered
+        ? "This resource is gateway_metered: the rail debits before forwarding, returns the credit-exhaustion " +
+            "tool error itself, and compensates automatically on a transport error or an isError result. " +
+            "Do not write any billing code in the origin. Verify the identity header and serve MCP."
+        : "This resource is origin_reported: the origin must debit before calling its provider and post a " +
+            "compensating credit when the user does not get a successful result. If you bill one unit per " +
+            "tool call and do not stream responses, re-registering as gateway_metered removes all of that " +
+            "code — it is a registration change, not an origin change.";
+}
+//# sourceMappingURL=integration.js.map

package/dist/integration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integration.js","sourceRoot":"","sources":["../src/integration.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEzE;;;;;;;GAOG;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,CAAU,CAAC;AA2B1F,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,OAAQ,qBAA2C,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,SAA+B,EAC/B,OAA4B;IAE5B,OAAO;QACL,GAAG,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC;QACpC,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,aAAa,KAAK,iBAAiB,CAAC;KACtE,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,SAA+B,EAC/B,OAA4B;IAE5B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC;IAC/D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;IAEhC,MAAM,aAAa,GAAG;QACpB,eAAe,EAAE,MAAM;QACvB,iBAAiB,EAAE,QAAQ;KAC5B,CAAC;IAEF,MAAM,OAAO,GAAG;QACd,GAAG,EAAE,qBAAqB;QAC1B,MAAM,EAAE,kBAAkB;QAC1B,IAAI,EACF,2FAA2F;YAC3F,+EAA+E;KAClF,CAAC;IAEF,MAAM,UAAU,GAAG;QACjB,0FAA0F;YACxF,wEAAwE;QAC1E,2FAA2F;YACzF,yFAAyF;QAC3F,qFAAqF;QACrF,6FAA6F;QAC7F,sFAAsF;QACtF,qEAAqE;KACtE,CAAC;IAEF,MAAM,YAAY,GAAG;QACnB,iFAAiF;QACjF,mGAAmG;QACnG,uBAAuB,QAAQ,qFAAqF;KACrH,CAAC;IAEF,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,QAAQ;YACX,OAAO;gBACL,SAAS;gBACT,OAAO,EACL,0FAA0F;oBAC1F,sEAAsE;gBACxE,aAAa;gBACb,OAAO;gBACP,KAAK,EAAE;oBACL;wBACE,KAAK,EAAE,iBAAiB;wBACxB,MAAM,EAAE,kEAAkE;wBAC1E,OAAO,EAAE,oCAAoC;qBAC9C;oBACD;wBACE,KAAK,EAAE,qBAAqB;wBAC5B,MAAM,EACJ,mFAAmF;4BACnF,8EAA8E;wBAChF,IAAI,EAAE,YAAY;wBAClB,OAAO,EAAE;4BACP,4DAA4D;4BAC5D,EAAE;4BACF,4BAA4B;4BAC5B,EAAE;4BACF,0CAA0C;4BAC1C,0BAA0B;4BAC1B,uBAAuB;yBACxB,CAAC,IAAI,CAAC,IAAI,CAAC;qBACb;oBACD;wBACE,KAAK,EAAE,+BAA+B;wBACtC,MAAM,EAAE,uEAAuE;wBAC/E,IAAI,EAAE,kBAAkB;wBACxB,OAAO,EAAE,IAAI,CAAC,SAAS,CACrB,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EACpD,IAAI,EACJ,CAAC,CACF;qBACF;oBACD;wBACE,KAAK,EAAE,0BAA0B;wBACjC,MAAM,EACJ,sFAAsF;4BACtF,oCAAoC;wBACtC,OAAO,EAAE,4BAA4B,qBAAqB,sBAAsB;qBACjF;oBACD;wBACE,KAAK,EAAE,0BAA0B;wBACjC,MAAM,EACJ,qFAAqF;4BACrF,2BAA2B;wBAC7B,OAAO,EAAE,sFAAsF;qBAChG;iBACF;gBACD,YAAY;gBACZ,UAAU;aACX,CAAC;QAEJ,KAAK,YAAY;YACf,OAAO;gBACL,SAAS;gBACT,OAAO,EACL,2FAA2F;oBAC3F,iFAAiF;gBACnF,aAAa;gBACb,OAAO;gBACP,KAAK,EAAE;oBACL;wBACE,KAAK,EAAE,uCAAuC;wBAC9C,MAAM,EACJ,mBAAmB,MAAM,GAAG,mCAAmC,yBAAyB;4BACxF,uFAAuF;4BACvF,wFAAwF;qBAC3F;oBACD;wBACE,KAAK,EAAE,kDAAkD;wBACzD,MAAM,EACJ,mFAAmF;4BACnF,wFAAwF;4BACxF,yFAAyF;4BACzF,qEAAqE;wBACvE,OAAO,EAAE;4BACP,sDAAsD;4BACtD,0DAA0D;4BAC1D,EAAE;4BACF,iEAAiE;4BACjE,8DAA8D;yBAC/D,CAAC,IAAI,CAAC,IAAI,CAAC;qBACb;oBACD;wBACE,KAAK,EAAE,4BAA4B;wBACnC,MAAM,EAAE,mFAAmF;wBAC3F,OAAO,EAAE,IAAI,CAAC,SAAS,CACrB,EAAE,KAAK,EAAE,yBAAyB,EAAE,UAAU,EAAE,kBAAkB,EAAE,EACpE,IAAI,EACJ,CAAC,CACF;qBACF;oBACD;wBACE,KAAK,EAAE,oCAAoC;wBAC3C,MAAM,EACJ,QAAQ,MAAM,GAAG,kBAAkB,sDAAsD;4BACzF,0FAA0F;4BAC1F,6EAA6E;qBAChF;oBACD;wBACE,KAAK,EAAE,uBAAuB;wBAC9B,MAAM,EACJ,sFAAsF;4BACtF,gEAAgE;qBACnE;iBACF;gBACD,YAAY;gBACZ,UAAU;aACX,CAAC;QAEJ,KAAK,QAAQ;YACX,OAAO;gBACL,SAAS;gBACT,OAAO,EACL,yFAAyF;oBACzF,+CAA+C;gBACjD,aAAa;gBACb,OAAO;gBACP,KAAK,EAAE;oBACL;wBACE,KAAK,EAAE,mCAAmC;wBAC1C,MAAM,EAAE,wCAAwC;wBAChD,OAAO,EAAE,0BAA0B;qBACpC;oBACD;wBACE,KAAK,EAAE,uCAAuC;wBAC9C,MAAM,EACJ,mBAAmB,MAAM,GAAG,mCAAmC,4BAA4B;4BAC3F,yFAAyF;4BACzF,+CAA+C;qBAClD;oBACD;wBACE,KAAK,EAAE,kDAAkD;wBACzD,MAAM,EACJ,yFAAyF;4BACzF,iFAAiF;wBACnF,OAAO,EAAE;4BACP,gFAAgF;4BAChF,EAAE;4BACF,yDAAyD;4BACzD,wEAAwE;yBACzE,CAAC,IAAI,CAAC,IAAI,CAAC;qBACb;oBACD;wBACE,KAAK,EAAE,4BAA4B;wBACnC,MAAM,EAAE,8FAA8F;qBACvG;oBACD;wBACE,KAAK,EAAE,kDAAkD;wBACzD,MAAM,EACJ,QAAQ,MAAM,GAAG,kBAAkB,uDAAuD;4BAC1F,wFAAwF;4BACxF,+CAA+C;qBAClD;iBACF;gBACD,YAAY;gBACZ,UAAU;aACX,CAAC;QAEJ,KAAK,OAAO;YACV,OAAO;gBACL,SAAS;gBACT,OAAO,EACL,wFAAwF;oBACxF,yFAAyF;oBACzF,yCAAyC;gBAC3C,aAAa,EAAE;oBACb,GAAG,aAAa;oBAChB,0BAA0B,EAAE,sBAAsB;iBACnD;gBACD,OAAO;gBACP,KAAK,EAAE;oBACL;wBACE,KAAK,EAAE,kCAAkC;wBACzC,MAAM,EACJ,sFAAsF;4BACtF,gCAAgC;wBAClC,OAAO,EAAE,8BAA8B,IAAI,0CAA0C;qBACtF;oBACD;wBACE,KAAK,EAAE,oCAAoC;wBAC3C,MAAM,EAAE,sDAAsD;wBAC9D,OAAO,EAAE,0EAA0E;qBACpF;oBACD;wBACE,KAAK,EAAE,gCAAgC;wBACvC,MAAM,EACJ,iFAAiF;4BACjF,uFAAuF;4BACvF,wBAAwB;qBAC3B;oBACD;wBACE,KAAK,EAAE,yCAAyC;wBAChD,MAAM,EACJ,oFAAoF;4BACpF,+EAA+E;qBAClF;iBACF;gBACD,YAAY;gBACZ,UAAU;aACX,CAAC;IACN,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,cAAuB;IACpD,OAAO,cAAc;QACnB,CAAC,CAAC,qGAAqG;YACnG,8FAA8F;YAC9F,wFAAwF;QAC5F,CAAC,CAAC,iGAAiG;YAC/F,+FAA+F;YAC/F,+FAA+F;YAC/F,2DAA2D,CAAC;AACpE,CAAC"}

package/dist/mcp/server.d.ts

@@ -0,0 +1,3 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+export declare function createOnboardingServer(): McpServer;
+export declare function runStdioServer(): Promise<void>;

package/dist/mcp/server.js

@@ -0,0 +1,362 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { z } from "zod";
+import { requireAdminKey, requireIssuer } from "../config.js";
+import { formatDoctorReport, runDoctor } from "../doctor.js";
+import { buildIntegrationPlan, integrationFrameworks, isIntegrationFramework, } from "../integration.js";
+import { describePending, getResource, mintDevHeader, probeConformance, registerResource, rotateOriginKey, setConnectedAccount, setOrigin, signupTenant, startConnect, } from "../rail.js";
+import { secretTargets, writeAdminApiKey, writeOriginApiKey } from "../secrets.js";
+function ok(payload) {
+    const text = typeof payload === "string" ? payload : JSON.stringify(payload, null, 2);
+    return { content: [{ type: "text", text }] };
+}
+/**
+ * Failures come back as tool errors with the rail's own message rather than thrown exceptions:
+ * the agent can act on "connected_account_id is required" but not on a stack trace.
+ */
+function fail(message) {
+    return { content: [{ type: "text", text: message }], isError: true };
+}
+async function attempt(run) {
+    try {
+        return await run();
+    }
+    catch (err) {
+        return fail(err instanceof Error ? err.message : String(err));
+    }
+}
+/** Resolved per call, so a credential that appears after startup is picked up without a restart. */
+function adminAuth(issuer, adminKey) {
+    return { issuer: requireIssuer(issuer), adminKey: requireAdminKey(adminKey) };
+}
+/** The receipt plus the one thing an agent actually needs next. */
+function withNextSteps(receipt) {
+    const pending = receipt.pending_requirements ?? [];
+    return {
+        ...receipt,
+        next_steps: pending.map((requirement) => describePending(requirement, receipt.slug ?? "")),
+        ready_for_traffic: pending.length === 0 && receipt.status === "live",
+    };
+}
+const issuerArg = z
+    .string()
+    .optional()
+    .describe("Authflow issuer base URL. Defaults to the AUTHFLOW_ISSUER environment variable.");
+const adminKeyArg = z
+    .string()
+    .optional()
+    .describe("Admin API key. Defaults to the AUTHFLOW_ADMIN_API_KEY environment variable.");
+export function createOnboardingServer() {
+    const server = new McpServer({ name: "authflow-onboarding", version: "0.1.0" }, {
+        instructions: "Onboard an MCP server onto the Authflow rail. Typical order: authflow_doctor to confirm " +
+            "the rail is reachable, authflow_signup if AUTHFLOW_ADMIN_API_KEY is missing, " +
+            "authflow_register_resource to create a draft and capture the origin API key, " +
+            "authflow_integration_plan to get framework-specific code to apply to the user's " +
+            "codebase, authflow_start_stripe_connect for the hosted KYC link, authflow_set_origin once " +
+            "the origin is deployed, then authflow_probe before real traffic. Read pending_requirements " +
+            "on any receipt to see what still blocks go-live.",
+    });
+    server.registerTool("authflow_signup", {
+        title: "Mint a per-tenant admin API key",
+        description: "Create a tenant and return an afa_ admin API key shown once. No existing credential is " +
+            "required. Prefer write_secrets so the key lands in an env file instead of the chat. Tell " +
+            "the user to put AUTHFLOW_ADMIN_API_KEY in their MCP config and restart the server before " +
+            "calling register. Duplicate emails return already_registered — the previous key is not " +
+            "re-issued.",
+        inputSchema: {
+            email: z.string().describe("Email that owns the tenant."),
+            write_secrets: z
+                .boolean()
+                .optional()
+                .describe("Write AUTHFLOW_ADMIN_API_KEY to an env file. Strongly preferred."),
+            secret_destination: z.string().optional().describe("Env-file path. Defaults to .env.local."),
+            issuer: issuerArg,
+        },
+        annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true },
+    }, async ({ email, write_secrets, secret_destination, issuer }) => attempt(async () => {
+        const receipt = await signupTenant(requireIssuer(issuer), email);
+        if (write_secrets !== false) {
+            const storedAt = await writeAdminApiKey({
+                value: receipt.admin_api_key,
+                destination: secret_destination,
+            });
+            receipt.admin_api_key = `<stored in ${storedAt}>`;
+        }
+        return ok({
+            ...receipt,
+            next_steps: [
+                "Put AUTHFLOW_ADMIN_API_KEY in the MCP server env (or load the env file) and restart it.",
+                "Then call authflow_register_resource with a slug.",
+            ],
+        });
+    }));
+    server.registerTool("authflow_doctor", {
+        title: "Check the Authflow rail is reachable and correctly configured",
+        description: "Preflight a rail deployment: issuer reachable, Origin Protocol keys document served and " +
+            "self-consistent, and (with a slug) the resource's PRM document and gateway 401 challenge. " +
+            "Run this first, and run it again whenever something looks broken — it distinguishes a " +
+            "misconfigured hostname from an actual rail outage, which look identical from the outside.",
+        inputSchema: {
+            issuer: issuerArg,
+            slug: z
+                .string()
+                .optional()
+                .describe("Resource slug. Adds PRM and gateway-challenge checks for that resource."),
+        },
+        annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: true },
+    }, async ({ issuer, slug }) => attempt(async () => {
+        const report = await runDoctor(requireIssuer(issuer), slug);
+        return ok(`${formatDoctorReport(report)}\n\n${JSON.stringify(report, null, 2)}`);
+    }));
+    server.registerTool("authflow_register_resource", {
+        title: "Register a resource on the rail",
+        description: "Create a resource and return its registration receipt: canonical resource URI, gateway " +
+            "URL, PRM URL, issuer, keys URL, usage URL, and the origin API key (shown once). Neither a " +
+            "Stripe account nor a deployed origin is required — omit them to register a draft and fill " +
+            "them in later. Prices and per-tool credit costs live in the rail registry, never in the " +
+            "creator's Stripe account. Set write_secrets to store the origin API key in a real secret " +
+            "store instead of returning it in the response.",
+        inputSchema: {
+            slug: z
+                .string()
+                .describe("URL path segment under the gateway. 1-32 chars, ^[a-z0-9](?:[a-z0-9-]{0,30}[a-z0-9])?$"),
+            display_name: z.string().optional().describe("Name shown on Checkout and the subscriptions page."),
+            price_amount_minor: z
+                .number()
+                .int()
+                .nonnegative()
+                .default(900)
+                .describe("Subscription price in minor units. 900 = $9.00."),
+            credits_per_period: z
+                .number()
+                .int()
+                .nonnegative()
+                .default(12)
+                .describe("Credits granted each billing period."),
+            currency: z.string().default("usd").describe("ISO 4217, lowercase."),
+            connected_account_id: z
+                .string()
+                .optional()
+                .describe("Existing Stripe Standard account (acct_...). Omit to connect Stripe later."),
+            origin_base_uri: z
+                .string()
+                .optional()
+                .describe("Origin scheme+host, no path and no /mcp suffix. Omit if not deployed yet."),
+            metering_mode: z
+                .enum(["origin_reported", "gateway_metered"])
+                .optional()
+                .describe("gateway_metered lets the rail debit and compensate so the origin needs no billing " +
+                "code. Only valid when billing one unit per tool call and not streaming responses."),
+            metering_default_units: z
+                .number()
+                .int()
+                .nonnegative()
+                .optional()
+                .describe("Credits charged for a tool not named in tool_units."),
+            tool_units: z
+                .record(z.string(), z.number().int().nonnegative())
+                .optional()
+                .describe("Per-tool credit costs. 0 declares a tool free (read-only)."),
+            write_secrets: z
+                .enum(secretTargets)
+                .optional()
+                .describe("Where to store the origin API key. Strongly preferred over returning it."),
+            secret_destination: z
+                .string()
+                .optional()
+                .describe("user-secrets: project directory. env-file: file path. keyvault: vault name."),
+            issuer: issuerArg,
+            admin_key: adminKeyArg,
+        },
+        annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true },
+    }, async (args) => attempt(async () => {
+        const auth = adminAuth(args.issuer, args.admin_key);
+        const receipt = await registerResource(auth, {
+            slug: args.slug,
+            display_name: args.display_name ?? args.slug,
+            currency: args.currency,
+            price_amount_minor: args.price_amount_minor,
+            credits_per_period: args.credits_per_period,
+            connected_account_id: args.connected_account_id ?? null,
+            origin_base_uri: args.origin_base_uri ?? null,
+            metering_mode: args.metering_mode,
+            metering_default_units: args.metering_default_units,
+            tool_units: args.tool_units,
+        });
+        // Store before returning: an origin API key that reaches the transcript is a credential in
+        // a chat log, and it is shown exactly once so there is no second chance to place it well.
+        const originApiKey = receipt.origin_api_key;
+        if (args.write_secrets && originApiKey) {
+            const storedAt = await writeOriginApiKey({
+                target: args.write_secrets,
+                value: originApiKey,
+                destination: args.secret_destination,
+            });
+            receipt.origin_api_key = `<stored in ${storedAt}>`;
+        }
+        return ok(withNextSteps(receipt));
+    }));
+    server.registerTool("authflow_get_resource", {
+        title: "Get a resource's registration receipt",
+        description: "Return the current receipt for a slug, including status and pending_requirements. Does " +
+            "not include the origin API key — rotate it if it was lost.",
+        inputSchema: { slug: z.string(), issuer: issuerArg, admin_key: adminKeyArg },
+        annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: true },
+    }, async ({ slug, issuer, admin_key }) => attempt(async () => ok(withNextSteps(await getResource(adminAuth(issuer, admin_key), slug)))));
+    server.registerTool("authflow_integration_plan", {
+        title: "Get framework-specific code and configuration for the origin",
+        description: "Return the exact configuration, code snippets, verification steps, and hard invariants " +
+            "for wiring an origin MCP server to this resource. Apply the result to the user's codebase " +
+            "yourself — this tool has no access to their files. Use framework 'proxy' when the origin " +
+            "is in a language with no in-process option or should not be modified at all.",
+        inputSchema: {
+            slug: z.string(),
+            framework: z
+                .enum(integrationFrameworks)
+                .describe("Origin implementation: dotnet, typescript, python, or proxy."),
+            issuer: issuerArg,
+            admin_key: adminKeyArg,
+        },
+        annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: true },
+    }, async ({ slug, framework, issuer, admin_key }) => attempt(async () => {
+        if (!isIntegrationFramework(framework)) {
+            return fail(`Unknown framework '${framework}'. Use one of: ${integrationFrameworks.join(", ")}.`);
+        }
+        const receipt = await getResource(adminAuth(issuer, admin_key), slug);
+        return ok(buildIntegrationPlan(framework, receipt));
+    }));
+    server.registerTool("authflow_start_stripe_connect", {
+        title: "Start or resume Stripe Connect onboarding",
+        description: "Return a Stripe-hosted onboarding URL for the creator to open in a browser and complete " +
+            "KYC. Give them the URL — do not attempt to fill the form. Account links are single-use and " +
+            "expire in minutes, so call this again for a fresh link; it resumes the same Stripe account " +
+            "rather than creating another. Call it again after they finish to confirm charges_enabled " +
+            "and promote the resource. onboarding_url is null once there is nothing left to do.",
+        inputSchema: {
+            slug: z.string(),
+            email: z.string().optional().describe("Pre-fills the Stripe form. Optional."),
+            issuer: issuerArg,
+            admin_key: adminKeyArg,
+        },
+        annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true },
+    }, async ({ slug, email, issuer, admin_key }) => attempt(async () => {
+        const result = await startConnect(adminAuth(issuer, admin_key), slug, email);
+        return ok({
+            ...result,
+            next_steps: result.charges_enabled
+                ? result.pending_requirements.map((r) => describePending(r, slug))
+                : [`Open ${result.onboarding_url} in a browser and complete Stripe onboarding, then call this tool again.`],
+        });
+    }));
+    server.registerTool("authflow_set_connected_account", {
+        title: "Attach an existing Stripe account to a resource",
+        description: "Use when the creator already has a Stripe Standard account connected to the platform. For " +
+            "a creator who has not onboarded yet, use authflow_start_stripe_connect instead.",
+        inputSchema: {
+            slug: z.string(),
+            connected_account_id: z.string().describe("Stripe Standard account id (acct_...)."),
+            issuer: issuerArg,
+            admin_key: adminKeyArg,
+        },
+        annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true },
+    }, async ({ slug, connected_account_id, issuer, admin_key }) => attempt(async () => ok(withNextSteps(await setConnectedAccount(adminAuth(issuer, admin_key), slug, connected_account_id)))));
+    server.registerTool("authflow_set_origin", {
+        title: "Point the rail at the deployed origin",
+        description: "Supply the origin base URI and promote the resource to live if nothing else is pending. " +
+            "The URL is scheme and host only — no path, and no /mcp suffix, because the gateway appends " +
+            "it. Also the supported way to move a live origin to a new hostname.",
+        inputSchema: {
+            slug: z.string(),
+            origin_base_uri: z.string().describe("e.g. https://video-xyz.azurecontainerapps.io"),
+            issuer: issuerArg,
+            admin_key: adminKeyArg,
+        },
+        annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true },
+    }, async ({ slug, origin_base_uri, issuer, admin_key }) => attempt(async () => ok(withNextSteps(await setOrigin(adminAuth(issuer, admin_key), slug, origin_base_uri)))));
+    server.registerTool("authflow_probe", {
+        title: "Verify the origin fails closed before it takes paid traffic",
+        description: "The rail posts valid and deliberately broken identity headers at the origin's /mcp path " +
+            "and reports pass/fail per spec §6.2. A failure means the origin would serve MCP to " +
+            "unauthenticated callers — a paywall bypass. Do not cut over on a failing probe. " +
+            "Authenticates with the origin API key, which is bound to one resource.",
+        inputSchema: {
+            origin_api_key: z
+                .string()
+                .optional()
+                .describe("Defaults to the AUTHFLOW_ORIGIN_API_KEY environment variable."),
+            issuer: issuerArg,
+        },
+        annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: true },
+    }, async ({ origin_api_key, issuer }) => attempt(async () => {
+        const key = (origin_api_key ?? process.env.AUTHFLOW_ORIGIN_API_KEY ?? "").trim();
+        if (!key) {
+            return fail("Set AUTHFLOW_ORIGIN_API_KEY or pass origin_api_key.");
+        }
+        const report = await probeConformance(requireIssuer(issuer), key);
+        return ok(report);
+    }));
+    server.registerTool("authflow_mint_test_header", {
+        title: "Mint a signed identity header for local testing",
+        description: "Local and staging only: mint a real X-Authflow-Identity header so the origin's verifier " +
+            "can be exercised without the OAuth and Checkout loop. Refuses live keys. This is a test " +
+            "aid, not a substitute for the paid flow.",
+        inputSchema: {
+            origin_api_key: z
+                .string()
+                .optional()
+                .describe("Defaults to the AUTHFLOW_ORIGIN_API_KEY environment variable."),
+            tier: z.string().optional(),
+            ttl_seconds: z.number().int().min(1).max(300).optional(),
+            grant_credits: z.number().int().nonnegative().optional(),
+            subject: z.string().optional(),
+            issuer: issuerArg,
+        },
+        annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true },
+    }, async (args) => attempt(async () => {
+        const key = (args.origin_api_key ?? process.env.AUTHFLOW_ORIGIN_API_KEY ?? "").trim();
+        if (!key) {
+            return fail("Set AUTHFLOW_ORIGIN_API_KEY or pass origin_api_key.");
+        }
+        return ok(await mintDevHeader(requireIssuer(args.issuer), key, {
+            subject: args.subject,
+            tier: args.tier,
+            ttlSeconds: args.ttl_seconds,
+            grantCredits: args.grant_credits,
+        }));
+    }));
+    server.registerTool("authflow_rotate_origin_key", {
+        title: "Rotate a resource's origin API key",
+        description: "Issue a new origin API key and invalidate the previous one immediately. Usage reports, " +
+            "probes, and mint-header calls with the old key stop working the moment this returns, so " +
+            "update the origin's secret store straight away. The new key is shown once.",
+        inputSchema: {
+            slug: z.string(),
+            write_secrets: z
+                .enum(secretTargets)
+                .optional()
+                .describe("Where to store the new key."),
+            secret_destination: z.string().optional(),
+            issuer: issuerArg,
+            admin_key: adminKeyArg,
+        },
+        annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
+    }, async (args) => attempt(async () => {
+        const receipt = await rotateOriginKey(adminAuth(args.issuer, args.admin_key), args.slug);
+        const key = receipt.origin_api_key;
+        if (args.write_secrets && key) {
+            const storedAt = await writeOriginApiKey({
+                target: args.write_secrets,
+                value: key,
+                destination: args.secret_destination,
+            });
+            receipt.origin_api_key = `<stored in ${storedAt}>`;
+        }
+        return ok(receipt);
+    }));
+    return server;
+}
+export async function runStdioServer() {
+    const server = createOnboardingServer();
+    await server.connect(new StdioServerTransport());
+}
+//# sourceMappingURL=server.js.map

package/dist/mcp/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,aAAa,EAA4B,MAAM,cAAc,CAAC;AACxF,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAEL,eAAe,EACf,WAAW,EACX,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,SAAS,EACT,YAAY,EACZ,YAAY,GACb,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,iBAAiB,EAAqB,MAAM,eAAe,CAAC;AAmBtG,SAAS,EAAE,CAAC,OAAgB;IAC1B,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACtF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACH,SAAS,IAAI,CAAC,OAAe;IAC3B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACvE,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,GAA8B;IACnD,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,EAAE,CAAC;IACrB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,oGAAoG;AACpG,SAAS,SAAS,CAAC,MAAe,EAAE,QAAiB;IACnD,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;AAChF,CAAC;AAED,mEAAmE;AACnE,SAAS,aAAa,CAAC,OAA4B;IACjD,MAAM,OAAO,GAAG,OAAO,CAAC,oBAAoB,IAAI,EAAE,CAAC;IACnD,OAAO;QACL,GAAG,OAAO;QACV,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,eAAe,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC1F,iBAAiB,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;KACrE,CAAC;AACJ,CAAC;AAED,MAAM,SAAS,GAAG,CAAC;KAChB,MAAM,EAAE;KACR,QAAQ,EAAE;KACV,QAAQ,CAAC,iFAAiF,CAAC,CAAC;AAE/F,MAAM,WAAW,GAAG,CAAC;KAClB,MAAM,EAAE;KACR,QAAQ,EAAE;KACV,QAAQ,CAAC,6EAA6E,CAAC,CAAC;AAE3F,MAAM,UAAU,sBAAsB;IACpC,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,OAAO,EAAE,EACjD;QACE,YAAY,EACV,0FAA0F;YAC1F,+EAA+E;YAC/E,+EAA+E;YAC/E,kFAAkF;YAClF,4FAA4F;YAC5F,6FAA6F;YAC7F,kDAAkD;KACrD,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,iBAAiB,EACjB;QACE,KAAK,EAAE,iCAAiC;QACxC,WAAW,EACT,yFAAyF;YACzF,2FAA2F;YAC3F,2FAA2F;YAC3F,yFAAyF;YACzF,YAAY;QACd,WAAW,EAAE;YACX,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6BAA6B,CAAC;YACzD,aAAa,EAAE,CAAC;iBACb,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,QAAQ,CAAC,kEAAkE,CAAC;YAC/E,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;YAC5F,MAAM,EAAE,SAAS;SAClB;QACD,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE;KAClF,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,EAAE,EAAE,EAAE,CAC7D,OAAO,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;QACjE,IAAI,aAAa,KAAK,KAAK,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC;gBACtC,KAAK,EAAE,OAAO,CAAC,aAAa;gBAC5B,WAAW,EAAE,kBAAkB;aAChC,CAAC,CAAC;YACH,OAAO,CAAC,aAAa,GAAG,cAAc,QAAQ,GAAG,CAAC;QACpD,CAAC;QACD,OAAO,EAAE,CAAC;YACR,GAAG,OAAO;YACV,UAAU,EAAE;gBACV,yFAAyF;gBACzF,mDAAmD;aACpD;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CACL,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,iBAAiB,EACjB;QACE,KAAK,EAAE,+DAA+D;QACtE,WAAW,EACT,0FAA0F;YAC1F,4FAA4F;YAC5F,wFAAwF;YACxF,2FAA2F;QAC7F,WAAW,EAAE;YACX,MAAM,EAAE,SAAS;YACjB,IAAI,EAAE,CAAC;iBACJ,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,yEAAyE,CAAC;SACvF;QACD,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE;KACjF,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CACzB,OAAO,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;QAC5D,OAAO,EAAE,CAAC,GAAG,kBAAkB,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC,CAAC,CACL,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,4BAA4B,EAC5B;QACE,KAAK,EAAE,iCAAiC;QACxC,WAAW,EACT,yFAAyF;YACzF,4FAA4F;YAC5F,4FAA4F;YAC5F,0FAA0F;YAC1F,2FAA2F;YAC3F,gDAAgD;QAClD,WAAW,EAAE;YACX,IAAI,EAAE,CAAC;iBACJ,MAAM,EAAE;iBACR,QAAQ,CAAC,wFAAwF,CAAC;YACrG,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oDAAoD,CAAC;YAClG,kBAAkB,EAAE,CAAC;iBAClB,MAAM,EAAE;iBACR,GAAG,EAAE;iBACL,WAAW,EAAE;iBACb,OAAO,CAAC,GAAG,CAAC;iBACZ,QAAQ,CAAC,iDAAiD,CAAC;YAC9D,kBAAkB,EAAE,CAAC;iBAClB,MAAM,EAAE;iBACR,GAAG,EAAE;iBACL,WAAW,EAAE;iBACb,OAAO,CAAC,EAAE,CAAC;iBACX,QAAQ,CAAC,sCAAsC,CAAC;YACnD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC;YACpE,oBAAoB,EAAE,CAAC;iBACpB,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,4EAA4E,CAAC;YACzF,eAAe,EAAE,CAAC;iBACf,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,2EAA2E,CAAC;YACxF,aAAa,EAAE,CAAC;iBACb,IAAI,CAAC,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;iBAC5C,QAAQ,EAAE;iBACV,QAAQ,CACP,oFAAoF;gBAClF,mFAAmF,CACtF;YACH,sBAAsB,EAAE,CAAC;iBACtB,MAAM,EAAE;iBACR,GAAG,EAAE;iBACL,WAAW,EAAE;iBACb,QAAQ,EAAE;iBACV,QAAQ,CAAC,qDAAqD,CAAC;YAClE,UAAU,EAAE,CAAC;iBACV,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;iBAClD,QAAQ,EAAE;iBACV,QAAQ,CAAC,4DAA4D,CAAC;YACzE,aAAa,EAAE,CAAC;iBACb,IAAI,CAAC,aAA6D,CAAC;iBACnE,QAAQ,EAAE;iBACV,QAAQ,CAAC,0EAA0E,CAAC;YACvF,kBAAkB,EAAE,CAAC;iBAClB,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,6EAA6E,CAAC;YAC1F,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,WAAW;SACvB;QACD,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE;KAClF,EACD,KAAK,EAAE,IAAI,EAAE,EAAE,CACb,OAAO,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE;YAC3C,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI;YAC5C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,oBAAoB,EAAE,IAAI,CAAC,oBAAoB,IAAI,IAAI;YACvD,eAAe,EAAE,IAAI,CAAC,eAAe,IAAI,IAAI;YAC7C,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;YACnD,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC;QAEH,2FAA2F;QAC3F,0FAA0F;QAC1F,MAAM,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC;QAC5C,IAAI,IAAI,CAAC,aAAa,IAAI,YAAY,EAAE,CAAC;YACvC,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC;gBACvC,MAAM,EAAE,IAAI,CAAC,aAAa;gBAC1B,KAAK,EAAE,YAAY;gBACnB,WAAW,EAAE,IAAI,CAAC,kBAAkB;aACrC,CAAC,CAAC;YACH,OAAO,CAAC,cAAc,GAAG,cAAc,QAAQ,GAAG,CAAC;QACrD,CAAC;QAED,OAAO,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IACpC,CAAC,CAAC,CACL,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,uBAAuB,EACvB;QACE,KAAK,EAAE,uCAAuC;QAC9C,WAAW,EACT,yFAAyF;YACzF,4DAA4D;QAC9D,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE;QAC5E,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE;KACjF,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,CACpC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC,aAAa,CAAC,MAAM,WAAW,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAChG,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,2BAA2B,EAC3B;QACE,KAAK,EAAE,8DAA8D;QACrE,WAAW,EACT,yFAAyF;YACzF,4FAA4F;YAC5F,2FAA2F;YAC3F,8EAA8E;QAChF,WAAW,EAAE;YACX,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;YAChB,SAAS,EAAE,CAAC;iBACT,IAAI,CAAC,qBAAyD,CAAC;iBAC/D,QAAQ,CAAC,8DAA8D,CAAC;YAC3E,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,WAAW;SACvB;QACD,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE;KACjF,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,CAC/C,OAAO,CAAC,KAAK,IAAI,EAAE;QACjB,IAAI,CAAC,sBAAsB,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC,sBAAsB,SAAS,kBAAkB,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpG,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC;QACtE,OAAO,EAAE,CAAC,oBAAoB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC,CACL,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,+BAA+B,EAC/B;QACE,KAAK,EAAE,2CAA2C;QAClD,WAAW,EACT,0FAA0F;YAC1F,6FAA6F;YAC7F,6FAA6F;YAC7F,2FAA2F;YAC3F,oFAAoF;QACtF,WAAW,EAAE;YACX,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;YAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sCAAsC,CAAC;YAC7E,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,WAAW;SACvB;QACD,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE;KAClF,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,CAC3C,OAAO,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC7E,OAAO,EAAE,CAAC;YACR,GAAG,MAAM;YACT,UAAU,EAAE,MAAM,CAAC,eAAe;gBAChC,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;gBAClE,CAAC,CAAC,CAAC,QAAQ,MAAM,CAAC,cAAc,0EAA0E,CAAC;SAC9G,CAAC,CAAC;IACL,CAAC,CAAC,CACL,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,gCAAgC,EAChC;QACE,KAAK,EAAE,iDAAiD;QACxD,WAAW,EACT,4FAA4F;YAC5F,iFAAiF;QACnF,WAAW,EAAE;YACX,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;YAChB,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;YACnF,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,WAAW;SACvB;QACD,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE;KAClF,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,CAC1D,OAAO,CAAC,KAAK,IAAI,EAAE,CACjB,EAAE,CACA,aAAa,CACX,MAAM,mBAAmB,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,IAAI,EAAE,oBAAoB,CAAC,CACpF,CACF,CACF,CACJ,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,qBAAqB,EACrB;QACE,KAAK,EAAE,uCAAuC;QAC9C,WAAW,EACT,0FAA0F;YAC1F,6FAA6F;YAC7F,qEAAqE;QACvE,WAAW,EAAE;YACX,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;YAChB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;YACpF,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,WAAW;SACvB;QACD,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE;KAClF,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,CACrD,OAAO,CAAC,KAAK,IAAI,EAAE,CACjB,EAAE,CAAC,aAAa,CAAC,MAAM,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC,CACxF,CACJ,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;QACE,KAAK,EAAE,6DAA6D;QACpE,WAAW,EACT,0FAA0F;YAC1F,qFAAqF;YACrF,kFAAkF;YAClF,wEAAwE;QAC1E,WAAW,EAAE;YACX,cAAc,EAAE,CAAC;iBACd,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,+DAA+D,CAAC;YAC5E,MAAM,EAAE,SAAS;SAClB;QACD,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE;KACjF,EACD,KAAK,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,CACnC,OAAO,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,GAAG,GAAG,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACjF,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC,qDAAqD,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;QAClE,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC,CAAC,CACL,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,2BAA2B,EAC3B;QACE,KAAK,EAAE,iDAAiD;QACxD,WAAW,EACT,0FAA0F;YAC1F,0FAA0F;YAC1F,0CAA0C;QAC5C,WAAW,EAAE;YACX,cAAc,EAAE,CAAC;iBACd,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,+DAA+D,CAAC;YAC5E,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC3B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;YACxD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;YACxD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC9B,MAAM,EAAE,SAAS;SAClB;QACD,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE;KAClF,EACD,KAAK,EAAE,IAAI,EAAE,EAAE,CACb,OAAO,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACtF,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC,qDAAqD,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,EAAE,CACP,MAAM,aAAa,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE;YACnD,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,YAAY,EAAE,IAAI,CAAC,aAAa;SACjC,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CACL,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,4BAA4B,EAC5B;QACE,KAAK,EAAE,oCAAoC;QAC3C,WAAW,EACT,yFAAyF;YACzF,0FAA0F;YAC1F,4EAA4E;QAC9E,WAAW,EAAE;YACX,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;YAChB,aAAa,EAAE,CAAC;iBACb,IAAI,CAAC,aAA6D,CAAC;iBACnE,QAAQ,EAAE;iBACV,QAAQ,CAAC,6BAA6B,CAAC;YAC1C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACzC,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,WAAW;SACvB;QACD,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE;KACjF,EACD,KAAK,EAAE,IAAI,EAAE,EAAE,CACb,OAAO,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACzF,MAAM,GAAG,GAAG,OAAO,CAAC,cAAc,CAAC;QACnC,IAAI,IAAI,CAAC,aAAa,IAAI,GAAG,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC;gBACvC,MAAM,EAAE,IAAI,CAAC,aAAa;gBAC1B,KAAK,EAAE,GAAG;gBACV,WAAW,EAAE,IAAI,CAAC,kBAAkB;aACrC,CAAC,CAAC;YACH,OAAO,CAAC,cAAc,GAAG,cAAc,QAAQ,GAAG,CAAC;QACrD,CAAC;QACD,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC,CAAC,CACL,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,MAAM,MAAM,GAAG,sBAAsB,EAAE,CAAC;IACxC,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC;AACnD,CAAC"}