authflow-cli 0.2.0 → 0.4.0

package/README.md

@@ -43,11 +43,11 @@ npm run authflow -- --help
 | Env | Flag | Used by |
 | --- | --- | --- |
 | `AUTHFLOW_ISSUER` | `--issuer` | all HTTP commands |
-| `AUTHFLOW_ADMIN_API_KEY` | `--admin-key` | `init`, `register`, `connect`, `set-origin`, `status`, `get`, `list`, `rotate-origin-key` (mint with `authflow signup`) |
+| `AUTHFLOW_ADMIN_API_KEY` | `--admin-key` | `init`, `register`, `connect`, `set-connected-account`, `set-origin`, `status`, `get`, `list`, `plan`, `rotate-origin-key` (mint with `authflow signup`) |
 | `AUTHFLOW_ORIGIN_API_KEY` | `--origin-key` | `mint-header`, `probe`, `set-origin` (for its probe) |
 | `AUTHFLOW_RESOURCE` / `AUTHFLOW_GATEWAY_URL` | `--gateway-url` / `--receipt` | curl hint on `mint-header` |
 
-Issuer is the Origin Protocol issuer origin, with no trailing slash: staging is `https://staging.rails.authflow.ai`, local is typically `https://localhost:7175`. For an already-registered resource it is the `issuer` field of the receipt. See [tenant quickstart §1](../../docs/onboarding/tenant-quickstart.md#environments-and-hostnames).
+Issuer is the Origin Protocol issuer origin, with no trailing slash: staging is `https://staging.rails.authflow.ai`, local is typically `https://localhost:7062`. For an already-registered resource it is the `issuer` field of the receipt. See [tenant quickstart §1](../../docs/onboarding/tenant-quickstart.md#environments-and-hostnames).
 
 ## Commands
 
@@ -84,9 +84,13 @@ The receipt's `pending_requirements` lists what is still outstanding:
 | Requirement | Clear it with |
 | --- | --- |
 | `origin_base_uri` | `authflow set-origin --slug video --origin-url https://…` |
-| `connected_account_id` | `authflow connect --slug video` |
+| `connected_account_id` | `authflow connect --slug video` (hosted KYC) or `authflow set-connected-account --slug video --account acct_…` (you already have the id) |
 | `stripe_onboarding_complete` | finish Stripe's form, then `authflow connect --slug video` again |
 
+Re-running `init` against a slug this admin key already owns resumes it: `409 slug_owned_by_caller`
+is not a dead end. `--connected-account` and `--origin-url` then attach instead of failing. A slug
+owned by someone else still returns `slug_taken`.
+
 The resource goes live once the list is empty. Add `--connect` to `init` to get the Stripe
 onboarding link from the first command instead of running `connect` separately.
 
@@ -110,6 +114,7 @@ complete KYC.
 ```bash
 authflow connect --slug video
 authflow connect --slug video --wait   # poll until Stripe reports the account can take charges
+authflow connect --slug video --connected-account acct_…   # attach an account you already have
 ```
 
 Account links are single-use and expire in minutes. Re-running is the expected way to get a fresh
@@ -117,6 +122,18 @@ one: it resumes the same Stripe account rather than creating another, so retryin
 abandoned accounts behind. Run it again after the form is submitted to confirm `charges_enabled` and
 promote the resource.
 
+`--connected-account` skips hosted KYC and is the same PUT as `authflow set-connected-account`.
+
+### `authflow set-connected-account`
+
+Attach a Stripe Standard account id the platform already has. This is the CLI twin of
+`authflow_set_connected_account` and of `PUT /admin/resources/{slug}/connected-account`. Use it when
+`connect` would otherwise start a new hosted onboarding you do not need.
+
+```bash
+authflow set-connected-account --slug video --account acct_…
+```
+
 ### `authflow set-origin`
 
 Points a draft at its origin, promoting it to live if nothing else is pending, then runs the
@@ -155,15 +172,32 @@ gateway:  https://staging.rails.authflow.ai/video/mcp
       no origin — the gateway has nowhere to forward to
       next: authflow set-origin --slug video --origin-url https://your-origin.example
   [ ] Stripe connected
-      next: authflow connect --slug video
+      no connected account — nothing can be charged
+      next: authflow connect --slug video  (or authflow set-connected-account --slug video --account acct_…)
+  [ ] Stripe onboarding complete
+      no connected account — attach one before Stripe can confirm charges
+      next: authflow connect --slug video  (or authflow set-connected-account --slug video --account acct_…)
 ```
 
+"Stripe onboarding complete" is ticked only when this resource has an account attached **and** Stripe
+has not listed `stripe_onboarding_complete` as pending. No account is not "charges enabled."
+
 Use it to resume an onboarding whose earlier steps may or may not have finished — a deploy that got
 backgrounded, a terminal that was closed. `doctor` answers "is the rail up", which is a different
 question: the rail can be perfectly healthy while a resource sits half-configured and rejects every
 request. Exit code is non-zero until the resource can take paid traffic, so it works as a deploy
 gate. `--json` emits the report for scripting.
 
+### `authflow plan`
+
+Prints the same framework-specific origin integration plan as `authflow_integration_plan`.
+
+```bash
+authflow plan --slug video --framework dotnet
+```
+
+`--framework` is one of `dotnet`, `typescript`, `python`, or `proxy`.
+
 ### `authflow get` / `authflow list`
 
 ```bash
@@ -203,6 +237,19 @@ Run this first when anything looks broken. It separates the two failures that ar
 from the outside: a hostname that is not bound to the rail returns `404` on every path including
 `/healthz`, which reads exactly like a broken endpoint. Exit code is non-zero on any failure.
 
+`--client cursor|claude|chatgpt|all` additionally replays that MCP client's real OAuth registration
+against the authorization server (the failure that presents as "this server does not work in
+Cursor"). `--dry-run` is discovery only and does not POST DCR. Live DCR registrations are stamped
+`authflow-cli doctor-connect` so a cleanup sweep can reclaim them.
+
+A `400` from the rail's DCR endpoint is the interesting result: paste `error=` and
+`error_description=` verbatim into a rail bug. Do not work around it client-side.
+
+```bash
+authflow doctor --issuer https://staging.rails.authflow.ai --slug video --client cursor
+authflow doctor --client all --dry-run
+```
+
 ### `authflow register`
 
 ```bash
@@ -264,9 +311,12 @@ Asks the rail to probe the registered origin with valid and deliberately broken
 
 ```bash
 authflow probe
+authflow probe --slug video
 ```
 
-Renders a pass/fail table. Exit code is non-zero when any check fails or the origin is unreachable.
+The origin API key is bound to one resource, so `--slug` is optional and ignored. It exists so a
+documented `authflow probe --slug …` does not fail. Renders a pass/fail table. Exit code is
+non-zero when any check fails or the origin is unreachable.
 
 ### `authflow scaffold`
 

package/dist/cli.js

@@ -1,39 +1,8 @@
 #!/usr/bin/env node
-import { Command } from "commander";
-import { connectCommand } from "./commands/connect.js";
-import { doctorCommand } from "./commands/doctor.js";
-import { getCommand } from "./commands/get.js";
-import { initCommand } from "./commands/init.js";
-import { listCommand } from "./commands/list.js";
-import { mcpCommand } from "./commands/mcp.js";
-import { signupCommand } from "./commands/signup.js";
-import { registerCommand } from "./commands/register.js";
-import { rotateOriginKeyCommand } from "./commands/rotate-origin-key.js";
-import { setOriginCommand } from "./commands/set-origin.js";
-import { mintHeaderCommand } from "./commands/mint-header.js";
-import { probeCommand } from "./commands/probe.js";
-import { scaffoldCommand } from "./commands/scaffold.js";
-import { statusCommand } from "./commands/status.js";
-const program = new Command();
-program
-    .name("authflow")
-    .description("Authflow Rail onboarding CLI")
-    .version("0.1.0");
-signupCommand(program);
-initCommand(program);
-registerCommand(program);
-connectCommand(program);
-setOriginCommand(program);
-statusCommand(program);
-getCommand(program);
-listCommand(program);
-rotateOriginKeyCommand(program);
-mintHeaderCommand(program);
-probeCommand(program);
-doctorCommand(program);
-scaffoldCommand(program);
-mcpCommand(program);
-program.parseAsync(process.argv).catch((err) => {
+import { createProgram } from "./program.js";
+createProgram()
+    .parseAsync(process.argv)
+    .catch((err) => {
     const message = err instanceof Error ? err.message : String(err);
     console.error(message);
     process.exit(1);

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,UAAU,CAAC;KAChB,WAAW,CAAC,8BAA8B,CAAC;KAC3C,OAAO,CAAC,OAAO,CAAC,CAAC;AAEpB,aAAa,CAAC,OAAO,CAAC,CAAC;AACvB,WAAW,CAAC,OAAO,CAAC,CAAC;AACrB,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,gBAAgB,CAAC,OAAO,CAAC,CAAC;AAC1B,aAAa,CAAC,OAAO,CAAC,CAAC;AACvB,UAAU,CAAC,OAAO,CAAC,CAAC;AACpB,WAAW,CAAC,OAAO,CAAC,CAAC;AACrB,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAC3B,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,aAAa,CAAC,OAAO,CAAC,CAAC;AACvB,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,UAAU,CAAC,OAAO,CAAC,CAAC;AAEpB,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IACtD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,aAAa,EAAE;KACZ,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC;KACxB,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IACtB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/client-conformance.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Replay what real MCP clients send at the authorization server, from a tenant's point of view.
+ *
+ * This exists because of a real connect failure: tenant #1 could not connect from Cursor because
+ * our DCR endpoint rejected Cursor's actual redirect_uris (private-use `cursor://` scheme,
+ * omitted application_type, three callbacks at once). We only found out because they filed a bug.
+ * Nothing on the rail tested against what clients actually send. These checks do.
+ *
+ * DCR replay creates a real OAuth client row. Registrations are stamped with
+ * `client_name` prefix `authflow-cli doctor-connect` so a cleanup sweep can reclaim them; this
+ * harness does not delete them. Use `--dry-run` to skip POSTs.
+ */
+import { type ClientId } from "./client-fixtures.js";
+import { type DoctorReport } from "./doctor.js";
+export type ClientConformanceOptions = {
+    issuer: string;
+    clients: ClientId[];
+    dryRun?: boolean;
+    slug?: string;
+};
+export type AuthorizationServerMetadata = {
+    issuer?: string;
+    registration_endpoint?: string;
+    client_id_metadata_document_supported?: boolean;
+    token_endpoint_auth_methods_supported?: unknown;
+    code_challenge_methods_supported?: unknown;
+    authorization_response_iss_parameter_supported?: unknown;
+};
+export declare function runDoctorAndConnect(issuer: string, options?: {
+    slug?: string;
+    client?: string;
+    dryRun?: boolean;
+}): Promise<DoctorReport>;
+export declare function runClientConformance(options: ClientConformanceOptions): Promise<DoctorReport>;

package/dist/client-conformance.js

@@ -0,0 +1,379 @@
+/**
+ * Replay what real MCP clients send at the authorization server, from a tenant's point of view.
+ *
+ * This exists because of a real connect failure: tenant #1 could not connect from Cursor because
+ * our DCR endpoint rejected Cursor's actual redirect_uris (private-use `cursor://` scheme,
+ * omitted application_type, three callbacks at once). We only found out because they filed a bug.
+ * Nothing on the rail tested against what clients actually send. These checks do.
+ *
+ * DCR replay creates a real OAuth client row. Registrations are stamped with
+ * `client_name` prefix `authflow-cli doctor-connect` so a cleanup sweep can reclaim them; this
+ * harness does not delete them. Use `--dry-run` to skip POSTs.
+ */
+import { chatgptCallbackCimdDocument, chatgptDcrVariants, chatgptStableCimdDocument, cursorDcrVariants, parseClientOption, probeClientName, } from "./client-fixtures.js";
+import { checkGatewayChallenge, fetchOrNull, runDoctor, } from "./doctor.js";
+import { checkGoogleRedirectUri } from "./google-redirect.js";
+const metadataPath = "/.well-known/oauth-authorization-server";
+const cimdNoneRemedy = 'Claude uses CIMD only when the AS advertises both client_id_metadata_document_supported: true ' +
+    'AND "none" in token_endpoint_auth_methods_supported. Missing "none" means Claude silently ' +
+    "ignores CIMD, with no error pointing at the cause.";
+const cimdFetchAdvisoryDetail = "Advisory — not proven. This CLI cannot host a publicly-reachable Client ID Metadata Document " +
+    "(HTTPS URL with a path), which is what Claude sends as client_id. AS advertisement of CIMD " +
+    "support is checked separately. A pass here does not mean the rail fetches, caches, or " +
+    "validates a document.";
+const cimdFetchAdvisoryRemedy = "To fully prove CIMD, host a document at an HTTPS URL whose path is non-empty, use that URL as " +
+    "client_id at /authorize, and confirm the AS fetches it and matches redirect_uris. Until then " +
+    "this check is advisory and does not fail the run.";
+const chatgptCimdFetchAdvisoryDetail = `Advisory — not proven. ChatGPT's CIMD client_id is ${chatgptStableCimdDocument} when this AS ` +
+    `advertises RFC 9207 issuer identification, or ${chatgptCallbackCimdDocument} otherwise. This ` +
+    "CLI does not fetch those documents on the AS's behalf. A pass here does not mean the rail " +
+    "fetches, caches, or validates ChatGPT's document.";
+const dcr400Footer = "A DCR 400 is the interesting result. Paste error= and error_description= verbatim into a rail " +
+    "bug; do not work around it client-side.";
+export async function runDoctorAndConnect(issuer, options = {}) {
+    const report = await runDoctor(issuer, options.slug);
+    if (!options.client) {
+        return report;
+    }
+    const clients = parseClientOption(options.client);
+    const reachable = report.checks.find((c) => c.name === "issuer reachable");
+    if (reachable && !reachable.pass) {
+        return { ...report, clients, dryRun: options.dryRun };
+    }
+    const extra = await runClientConformance({
+        issuer: report.issuer,
+        clients,
+        dryRun: options.dryRun,
+    });
+    const google = await checkGoogleRedirectUri(report.issuer, {
+        slug: options.slug,
+        dryRun: options.dryRun,
+    });
+    const checks = [...report.checks, ...extra.checks, ...google];
+    return {
+        ...report,
+        clients,
+        dryRun: extra.dryRun,
+        checks,
+        pass: checks.every((c) => c.pass),
+    };
+}
+export async function runClientConformance(options) {
+    const base = options.issuer.trim().replace(/\/+$/, "");
+    const dryRun = !!options.dryRun;
+    const checks = [];
+    const metadata = await fetchMetadata(base);
+    checks.push(metadata.check);
+    if (!metadata.document) {
+        return {
+            issuer: base,
+            slug: options.slug,
+            clients: options.clients,
+            dryRun,
+            pass: false,
+            checks,
+        };
+    }
+    const document = metadata.document;
+    const selected = new Set(options.clients);
+    checks.push(checkPkceS256(document));
+    checks.push(checkRfc9207Iss(document));
+    if (selected.has("cursor")) {
+        checks.push(checkRegistrationEndpoint(document, "cursor"));
+    }
+    if (selected.has("chatgpt")) {
+        checks.push(checkRegistrationEndpoint(document, "chatgpt"));
+        checks.push(...checkChatgptCimd(document));
+    }
+    if (selected.has("claude")) {
+        checks.push(...checkClaudeCimd(document));
+    }
+    if (!dryRun) {
+        const endpoint = resolveRegistrationEndpoint(base, document.registration_endpoint);
+        if (selected.has("cursor") && endpoint) {
+            for (const variant of cursorDcrVariants) {
+                checks.push(await replayDcr(endpoint, "cursor", variant));
+            }
+        }
+        if (selected.has("chatgpt") && endpoint) {
+            for (const variant of chatgptDcrVariants) {
+                checks.push(await replayDcr(endpoint, "chatgpt", variant));
+            }
+        }
+    }
+    if (options.slug) {
+        checks.push(await checkGatewayChallenge(base, options.slug));
+    }
+    return {
+        issuer: base,
+        slug: options.slug,
+        clients: options.clients,
+        dryRun,
+        pass: checks.every((c) => c.pass),
+        checks,
+    };
+}
+async function fetchMetadata(base) {
+    const url = `${base}${metadataPath}`;
+    const response = await fetchOrNull(url);
+    if (!response.ok && response.error) {
+        return {
+            check: {
+                name: "authorization server metadata",
+                pass: false,
+                detail: `${url} could not be reached: ${response.error}`,
+                remedy: "Check the hostname and DNS. MCP clients cannot start OAuth without this document.",
+            },
+        };
+    }
+    if (response.status !== 200) {
+        return {
+            check: {
+                name: "authorization server metadata",
+                pass: false,
+                detail: `${url} returned ${response.status ?? response.error}, expected 200.`,
+                remedy: "MCP clients discover DCR and CIMD from this document. File a rail bug.",
+            },
+        };
+    }
+    let document;
+    try {
+        document = JSON.parse(response.body ?? "");
+    }
+    catch {
+        return {
+            check: {
+                name: "authorization server metadata",
+                pass: false,
+                detail: `${url} did not return JSON.`,
+                remedy: "File this against the rail.",
+            },
+        };
+    }
+    return {
+        check: {
+            name: "authorization server metadata",
+            pass: true,
+            detail: `${url} returned 200.`,
+        },
+        document,
+    };
+}
+function checkPkceS256(document) {
+    const methods = asStringArray(document.code_challenge_methods_supported);
+    if (methods.includes("S256")) {
+        return {
+            name: "PKCE S256",
+            pass: true,
+            detail: `code_challenge_methods_supported includes S256 (${methods.join(", ")}).`,
+        };
+    }
+    return {
+        name: "PKCE S256",
+        pass: false,
+        detail: `code_challenge_methods_supported is [${methods.join(", ")}], expected to include S256.`,
+        remedy: "MCP clients require S256 PKCE. Advertise it in AS metadata.",
+    };
+}
+function checkRfc9207Iss(document) {
+    if (document.authorization_response_iss_parameter_supported === true) {
+        return {
+            name: "RFC 9207 iss parameter",
+            pass: true,
+            detail: "authorization_response_iss_parameter_supported is true.",
+        };
+    }
+    return {
+        name: "RFC 9207 iss parameter",
+        pass: false,
+        detail: `authorization_response_iss_parameter_supported is ${JSON.stringify(document.authorization_response_iss_parameter_supported)}, expected true.`,
+        remedy: "Advertise authorization_response_iss_parameter_supported: true and return iss on every " +
+            "authorization response. ChatGPT uses this flag to choose connector_platform_oauth_redirect " +
+            "versus connector/oauth/{callback_id}; a regression silently changes the redirect URI.",
+    };
+}
+function checkRegistrationEndpoint(document, client) {
+    const endpoint = (document.registration_endpoint ?? "").trim();
+    const name = `${client}: registration_endpoint`;
+    if (endpoint) {
+        return {
+            name,
+            pass: true,
+            detail: `registration_endpoint is ${endpoint}.`,
+        };
+    }
+    const remedy = client === "cursor"
+        ? "Cursor is DCR-only and has no CIMD timeline. Without registration_endpoint in AS metadata, Cursor cannot connect at all."
+        : "ChatGPT prefers CIMD when advertised, but still uses DCR when the plugin builder chooses it or CIMD is unavailable. Without registration_endpoint that fallback cannot register.";
+    return {
+        name,
+        pass: false,
+        detail: "AS metadata has no registration_endpoint.",
+        remedy,
+    };
+}
+function checkClaudeCimd(document) {
+    const advertised = document.client_id_metadata_document_supported === true;
+    const methods = asStringArray(document.token_endpoint_auth_methods_supported);
+    const hasNone = methods.includes("none");
+    const advertisement = advertised
+        ? {
+            name: "claude: CIMD advertisement",
+            pass: true,
+            detail: "client_id_metadata_document_supported is true.",
+        }
+        : {
+            name: "claude: CIMD advertisement",
+            pass: false,
+            detail: `client_id_metadata_document_supported is ${JSON.stringify(document.client_id_metadata_document_supported)}, expected true.`,
+            remedy: cimdNoneRemedy,
+        };
+    const noneMethod = hasNone
+        ? {
+            name: "claude: token endpoint auth none",
+            pass: true,
+            detail: `token_endpoint_auth_methods_supported includes "none" (${methods.join(", ")}).`,
+        }
+        : {
+            name: "claude: token endpoint auth none",
+            pass: false,
+            detail: `token_endpoint_auth_methods_supported is [${methods.join(", ")}], expected to include "none".`,
+            remedy: cimdNoneRemedy,
+        };
+    const fetchValidate = {
+        name: "claude: CIMD fetch-and-validate",
+        pass: true,
+        detail: cimdFetchAdvisoryDetail,
+        remedy: cimdFetchAdvisoryRemedy,
+    };
+    return [advertisement, noneMethod, fetchValidate];
+}
+function checkChatgptCimd(document) {
+    const advertised = document.client_id_metadata_document_supported === true;
+    const advertisement = advertised
+        ? {
+            name: "chatgpt: CIMD advertisement",
+            pass: true,
+            detail: "client_id_metadata_document_supported is true. ChatGPT prefers CIMD when advertised " +
+                `(stable document ${chatgptStableCimdDocument} if RFC 9207 iss is also true).`,
+        }
+        : {
+            name: "chatgpt: CIMD advertisement",
+            pass: false,
+            detail: `client_id_metadata_document_supported is ${JSON.stringify(document.client_id_metadata_document_supported)}, expected true.`,
+            remedy: "ChatGPT prefers CIMD when the AS advertises client_id_metadata_document_supported: true. " +
+                "Without it ChatGPT falls back to DCR (or cannot register if registration_endpoint is also missing).",
+        };
+    const fetchValidate = {
+        name: "chatgpt: CIMD fetch-and-validate",
+        pass: true,
+        detail: chatgptCimdFetchAdvisoryDetail,
+        remedy: cimdFetchAdvisoryRemedy,
+    };
+    return [advertisement, fetchValidate];
+}
+async function replayDcr(endpoint, client, variant) {
+    const sent = variant.payload.redirect_uris;
+    const body = {
+        ...variant.payload,
+        client_name: probeClientName(client, variant.id),
+    };
+    const response = await fetchOrNull(endpoint, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", Accept: "application/json" },
+        body: JSON.stringify(body),
+    });
+    if (!response.ok && response.error) {
+        return {
+            name: variant.checkName,
+            pass: false,
+            detail: `POST ${endpoint} could not be reached: ${response.error}`,
+            remedy: "The registration_endpoint was advertised but did not respond. File a rail bug.",
+        };
+    }
+    if (response.status === 400) {
+        return {
+            name: variant.checkName,
+            pass: false,
+            detail: `DCR 400: ${formatDcrError(response.body)}`,
+            remedy: dcr400Footer,
+        };
+    }
+    if (response.status !== 201) {
+        return {
+            name: variant.checkName,
+            pass: false,
+            detail: `POST ${endpoint} returned ${response.status ?? response.error}, expected 201. ${formatDcrError(response.body)}`,
+            remedy: "DCR must succeed with 201 for this client's real payload. File a rail bug.",
+        };
+    }
+    let echoed;
+    try {
+        echoed = JSON.parse(response.body ?? "");
+    }
+    catch {
+        return {
+            name: variant.checkName,
+            pass: false,
+            detail: "DCR returned 201 but the body was not JSON.",
+            remedy: "File this against the rail.",
+        };
+    }
+    const dropped = missingRedirectUris(sent, echoed.redirect_uris);
+    if (dropped.length > 0) {
+        return {
+            name: variant.checkName,
+            pass: false,
+            detail: `DCR returned 201 but dropped redirect_uris: ${dropped.join(", ")}. ` +
+                `Sent [${sent.join(", ")}]; echoed ${JSON.stringify(echoed.redirect_uris)}.`,
+            remedy: "A silently dropped callback fails later at /authorize with a confusing redirect_uri " +
+                "mismatch. Echo every registered URI.",
+        };
+    }
+    const clientId = typeof echoed.client_id === "string" ? echoed.client_id : "(none)";
+    return {
+        name: variant.checkName,
+        pass: true,
+        detail: `DCR 201; client_id=${clientId}; redirect_uris echoed in full. Stamped client_name for cleanup sweep.`,
+    };
+}
+function missingRedirectUris(sent, echoed) {
+    if (!Array.isArray(echoed)) {
+        return [...sent];
+    }
+    const got = new Set(echoed.map((value) => String(value)));
+    return sent.filter((uri) => !got.has(uri));
+}
+function formatDcrError(raw) {
+    if (!raw) {
+        return "error=(empty) error_description=(empty)";
+    }
+    try {
+        const body = JSON.parse(raw);
+        const error = body.error !== undefined ? String(body.error) : "(none)";
+        const description = body.error_description !== undefined ? String(body.error_description) : "(none)";
+        return `error=${error} error_description=${description}`;
+    }
+    catch {
+        return raw.slice(0, 300);
+    }
+}
+function resolveRegistrationEndpoint(base, value) {
+    const endpoint = (value ?? "").trim();
+    if (!endpoint) {
+        return undefined;
+    }
+    try {
+        return new URL(endpoint, `${base}/`).href;
+    }
+    catch {
+        return undefined;
+    }
+}
+function asStringArray(value) {
+    if (!Array.isArray(value)) {
+        return [];
+    }
+    return value.map((entry) => String(entry));
+}
+//# sourceMappingURL=client-conformance.js.map

package/dist/client-conformance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-conformance.js","sourceRoot":"","sources":["../src/client-conformance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,GAGhB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,qBAAqB,EACrB,WAAW,EACX,SAAS,GAGV,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAkB9D,MAAM,YAAY,GAAG,yCAAyC,CAAC;AAE/D,MAAM,cAAc,GAClB,gGAAgG;IAChG,4FAA4F;IAC5F,oDAAoD,CAAC;AAEvD,MAAM,uBAAuB,GAC3B,+FAA+F;IAC/F,6FAA6F;IAC7F,wFAAwF;IACxF,uBAAuB,CAAC;AAE1B,MAAM,uBAAuB,GAC3B,gGAAgG;IAChG,+FAA+F;IAC/F,mDAAmD,CAAC;AAEtD,MAAM,8BAA8B,GAClC,sDAAsD,yBAAyB,gBAAgB;IAC/F,iDAAiD,2BAA2B,mBAAmB;IAC/F,4FAA4F;IAC5F,mDAAmD,CAAC;AAEtD,MAAM,YAAY,GAChB,gGAAgG;IAChG,yCAAyC,CAAC;AAE5C,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,UAAgE,EAAE;IAElE,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACpB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC;IAC3E,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACjC,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IACxD,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC;QACvC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,OAAO;QACP,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,MAAM,CAAC,MAAM,EAAE;QACzD,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC;IAC9D,OAAO;QACL,GAAG,MAAM;QACT,OAAO;QACP,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,MAAM;QACN,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAiC;IAEjC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAChC,MAAM,MAAM,GAAkB,EAAE,CAAC;IAEjC,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5B,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACvB,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM;YACN,IAAI,EAAE,KAAK;YACX,MAAM;SACP,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAE1C,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEvC,IAAI,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;QAC5D,MAAM,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,QAAQ,GAAG,2BAA2B,CAAC,IAAI,EAAE,QAAQ,CAAC,qBAAqB,CAAC,CAAC;QACnF,IAAI,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,QAAQ,EAAE,CAAC;YACvC,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;gBACxC,MAAM,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,QAAQ,EAAE,CAAC;YACxC,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;gBACzC,MAAM,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,CAAC,IAAI,CAAC,MAAM,qBAAqB,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED,OAAO;QACL,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM;QACN,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACjC,MAAM;KACP,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,IAAY;IAEZ,MAAM,GAAG,GAAG,GAAG,IAAI,GAAG,YAAY,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IAExC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnC,OAAO;YACL,KAAK,EAAE;gBACL,IAAI,EAAE,+BAA+B;gBACrC,IAAI,EAAE,KAAK;gBACX,MAAM,EAAE,GAAG,GAAG,0BAA0B,QAAQ,CAAC,KAAK,EAAE;gBACxD,MAAM,EAAE,mFAAmF;aAC5F;SACF,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO;YACL,KAAK,EAAE;gBACL,IAAI,EAAE,+BAA+B;gBACrC,IAAI,EAAE,KAAK;gBACX,MAAM,EAAE,GAAG,GAAG,aAAa,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,KAAK,iBAAiB;gBAC7E,MAAM,EAAE,wEAAwE;aACjF;SACF,CAAC;IACJ,CAAC;IAED,IAAI,QAAqC,CAAC;IAC1C,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAgC,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,KAAK,EAAE;gBACL,IAAI,EAAE,+BAA+B;gBACrC,IAAI,EAAE,KAAK;gBACX,MAAM,EAAE,GAAG,GAAG,uBAAuB;gBACrC,MAAM,EAAE,6BAA6B;aACtC;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,EAAE;YACL,IAAI,EAAE,+BAA+B;YACrC,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,GAAG,GAAG,gBAAgB;SAC/B;QACD,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,QAAqC;IAC1D,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,gCAAgC,CAAC,CAAC;IACzE,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,mDAAmD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;SAClF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,wCAAwC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,8BAA8B;QAChG,MAAM,EAAE,6DAA6D;KACtE,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,QAAqC;IAC5D,IAAI,QAAQ,CAAC,8CAA8C,KAAK,IAAI,EAAE,CAAC;QACrE,OAAO;YACL,IAAI,EAAE,wBAAwB;YAC9B,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,yDAAyD;SAClE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,wBAAwB;QAC9B,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,qDAAqD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,8CAA8C,CAAC,kBAAkB;QACtJ,MAAM,EACJ,yFAAyF;YACzF,6FAA6F;YAC7F,uFAAuF;KAC1F,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,QAAqC,EACrC,MAA4B;IAE5B,MAAM,QAAQ,GAAG,CAAC,QAAQ,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/D,MAAM,IAAI,GAAG,GAAG,MAAM,yBAAyB,CAAC;IAChD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO;YACL,IAAI;YACJ,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,4BAA4B,QAAQ,GAAG;SAChD,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GACV,MAAM,KAAK,QAAQ;QACjB,CAAC,CAAC,0HAA0H;QAC5H,CAAC,CAAC,kLAAkL,CAAC;IAEzL,OAAO;QACL,IAAI;QACJ,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,2CAA2C;QACnD,MAAM;KACP,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,QAAqC;IAC5D,MAAM,UAAU,GAAG,QAAQ,CAAC,qCAAqC,KAAK,IAAI,CAAC;IAC3E,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,qCAAqC,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEzC,MAAM,aAAa,GAAgB,UAAU;QAC3C,CAAC,CAAC;YACE,IAAI,EAAE,4BAA4B;YAClC,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,gDAAgD;SACzD;QACH,CAAC,CAAC;YACE,IAAI,EAAE,4BAA4B;YAClC,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,4CAA4C,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,qCAAqC,CAAC,kBAAkB;YACpI,MAAM,EAAE,cAAc;SACvB,CAAC;IAEN,MAAM,UAAU,GAAgB,OAAO;QACrC,CAAC,CAAC;YACE,IAAI,EAAE,kCAAkC;YACxC,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,0DAA0D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;SACzF;QACH,CAAC,CAAC;YACE,IAAI,EAAE,kCAAkC;YACxC,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,6CAA6C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,gCAAgC;YACvG,MAAM,EAAE,cAAc;SACvB,CAAC;IAEN,MAAM,aAAa,GAAgB;QACjC,IAAI,EAAE,iCAAiC;QACvC,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,uBAAuB;QAC/B,MAAM,EAAE,uBAAuB;KAChC,CAAC;IAEF,OAAO,CAAC,aAAa,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAqC;IAC7D,MAAM,UAAU,GAAG,QAAQ,CAAC,qCAAqC,KAAK,IAAI,CAAC;IAE3E,MAAM,aAAa,GAAgB,UAAU;QAC3C,CAAC,CAAC;YACE,IAAI,EAAE,6BAA6B;YACnC,IAAI,EAAE,IAAI;YACV,MAAM,EACJ,sFAAsF;gBACtF,oBAAoB,yBAAyB,iCAAiC;SACjF;QACH,CAAC,CAAC;YACE,IAAI,EAAE,6BAA6B;YACnC,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,4CAA4C,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,qCAAqC,CAAC,kBAAkB;YACpI,MAAM,EACJ,2FAA2F;gBAC3F,qGAAqG;SACxG,CAAC;IAEN,MAAM,aAAa,GAAgB;QACjC,IAAI,EAAE,kCAAkC;QACxC,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,8BAA8B;QACtC,MAAM,EAAE,uBAAuB;KAChC,CAAC;IAEF,OAAO,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;AACxC,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,QAAgB,EAChB,MAAgB,EAChB,OAAmB;IAEnB,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;IAC3C,MAAM,IAAI,GAAG;QACX,GAAG,OAAO,CAAC,OAAO;QAClB,WAAW,EAAE,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;KACjD,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE;QAC3C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnC,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,SAAS;YACvB,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,QAAQ,QAAQ,0BAA0B,QAAQ,CAAC,KAAK,EAAE;YAClE,MAAM,EAAE,gFAAgF;SACzF,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,SAAS;YACvB,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,YAAY,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;YACnD,MAAM,EAAE,YAAY;SACrB,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,SAAS;YACvB,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,QAAQ,QAAQ,aAAa,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,KAAK,mBAAmB,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;YACxH,MAAM,EAAE,4EAA4E;SACrF,CAAC;IACJ,CAAC;IAED,IAAI,MAAwD,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAqD,CAAC;IAC/F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,SAAS;YACvB,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,6CAA6C;YACrD,MAAM,EAAE,6BAA6B;SACtC,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAChE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,SAAS;YACvB,IAAI,EAAE,KAAK;YACX,MAAM,EACJ,+CAA+C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBACrE,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG;YAC9E,MAAM,EACJ,sFAAsF;gBACtF,sCAAsC;SACzC,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;IACpF,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,SAAS;QACvB,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,sBAAsB,QAAQ,wEAAwE;KAC/G,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAc,EAAE,MAAe;IAC1D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,cAAc,CAAC,GAAuB;IAC7C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,yCAAyC,CAAC;IACnD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAqD,CAAC;QACjF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QACvE,MAAM,WAAW,GACf,IAAI,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QACnF,OAAO,SAAS,KAAK,sBAAsB,WAAW,EAAE,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B,CAAC,IAAY,EAAE,KAAyB;IAC1E,MAAM,QAAQ,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7C,CAAC"}