authflow-cli 0.3.0 → 0.4.0

package/dist/commands/doctor.js

@@ -1,14 +1,24 @@
+import { runDoctorAndConnect } from "../client-conformance.js";
 import { requireIssuer } from "../config.js";
-import { formatDoctorReport, runDoctor } from "../doctor.js";
+import { formatDoctorReport } from "../doctor.js";
 export function doctorCommand(program) {
     program
         .command("doctor")
-        .description("Check that the rail is reachable and serving a consistent Origin Protocol surface")
+        .description("Check that the rail is reachable, serving a consistent Origin Protocol surface, and (with --client) accepts real MCP client OAuth registration. With --client and --slug (not --dry-run), also drive authorize through login and ask Google whether the rail's redirect_uri is registered")
         .option("--issuer <url>", "Authflow issuer (default: AUTHFLOW_ISSUER)")
         .option("--slug <slug>", "Also check this resource's PRM document and gateway 401 challenge")
+        .option("--client <name>", "Replay MCP client OAuth registration: cursor, claude, chatgpt, or all")
+        .option("--dry-run", "With --client: discovery only, do not POST DCR registrations")
         .option("--json", "Emit the report as JSON")
         .action(async (opts) => {
-        const report = await runDoctor(requireIssuer(opts.issuer), opts.slug);
+        if (opts.dryRun && !opts.client) {
+            throw new Error("--dry-run only applies with --client.");
+        }
+        const report = await runDoctorAndConnect(requireIssuer(opts.issuer), {
+            slug: opts.slug,
+            client: opts.client,
+            dryRun: opts.dryRun,
+        });
         console.log(opts.json ? JSON.stringify(report, null, 2) : formatDoctorReport(report));
         process.exitCode = report.pass ? 0 : 1;
     });

package/dist/commands/doctor.js.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE7D,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,mFAAmF,CAAC;SAChG,MAAM,CAAC,gBAAgB,EAAE,4CAA4C,CAAC;SACtE,MAAM,CAAC,eAAe,EAAE,mEAAmE,CAAC;SAC5F,MAAM,CAAC,QAAQ,EAAE,yBAAyB,CAAC;SAC3C,MAAM,CAAC,KAAK,EAAE,IAAwD,EAAE,EAAE;QACzE,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAEtE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;QACtF,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAElD,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CACV,2RAA2R,CAC5R;SACA,MAAM,CAAC,gBAAgB,EAAE,4CAA4C,CAAC;SACtE,MAAM,CAAC,eAAe,EAAE,mEAAmE,CAAC;SAC5F,MAAM,CAAC,iBAAiB,EAAE,uEAAuE,CAAC;SAClG,MAAM,CAAC,WAAW,EAAE,8DAA8D,CAAC;SACnF,MAAM,CAAC,QAAQ,EAAE,yBAAyB,CAAC;SAC3C,MAAM,CACL,KAAK,EAAE,IAMN,EAAE,EAAE;QACH,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;YACnE,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;QACtF,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC,CACF,CAAC;AACN,CAAC"}

package/dist/doctor.d.ts

@@ -4,8 +4,9 @@
  * This exists because of a real onboarding failure: tenant #1 was given a staging hostname whose
  * DNS resolved but which was never bound to the App Service, so Azure answered `404 Site Not Found`
  * on every path. They read the 404 on the keys document as "the rail's keys endpoint is broken" and
- * filed it, while the rail was healthy the whole time on a different hostname. Nothing in the
- * onboarding path told either side which of the two it was. These checks do.
+ * filed it, while the rail was healthy the whole time on a different hostname. The same class
+ * showed up again as 500 HTML on /login (and the other consumer pages) when returnUrl is
+ * missing — it looks like an outage, it is an unhandled throw. These checks do.
  */
 export type DoctorCheck = {
     name: string;
@@ -17,8 +18,31 @@ export type DoctorCheck = {
 export type DoctorReport = {
     issuer: string;
     slug?: string;
+    /** MCP clients whose OAuth registration was replayed; absent when `--client` was not passed. */
+    clients?: string[];
+    dryRun?: boolean;
     pass: boolean;
     checks: DoctorCheck[];
 };
 export declare function runDoctor(issuer: string, slug?: string): Promise<DoctorReport>;
+export declare function checkConsumerPages(base: string): Promise<DoctorCheck>;
+/**
+ * The paywall is a transport-level 401 carrying `resource_metadata`. If this is not exactly right,
+ * MCP clients never prompt for auth, which presents as "the server just does not work in Claude".
+ */
+/**
+ * The paywall is a transport-level 401 carrying `resource_metadata`. If this is not exactly right,
+ * MCP clients never prompt for auth, which presents as "the server just does not work in Claude".
+ */
+export declare function checkGatewayChallenge(base: string, slug: string): Promise<DoctorCheck>;
+export type FetchOutcome = {
+    ok: boolean;
+    status?: number;
+    body?: string;
+    headers?: Headers;
+    location?: string;
+    error?: string;
+};
+/** Network failures are a diagnosis here, not an exception — every one of them is a real finding. */
+export declare function fetchOrNull(url: string, init?: RequestInit): Promise<FetchOutcome>;
 export declare function formatDoctorReport(report: DoctorReport): string;

package/dist/doctor.js

@@ -12,8 +12,9 @@ export async function runDoctor(issuer, slug) {
         return { issuer: base, slug, pass: false, checks };
     }
     checks.push(...(await checkOriginKeys(base)));
+    checks.push(await checkConsumerPages(base));
     if (slug) {
-        checks.push(await checkProtectedResourceMetadata(base, slug));
+        checks.push(...(await checkProtectedResourceMetadata(base, slug)));
         checks.push(await checkGatewayChallenge(base, slug));
     }
     return { issuer: base, slug, pass: checks.every((c) => c.pass), checks };
@@ -137,33 +138,131 @@ async function checkOriginKeys(base) {
     }
     return checks;
 }
+/**
+ * A missing returnUrl (or session) on these pages currently throws and becomes 500 HTML that
+ * looks like a rail outage — the same failure class as the unbound-hostname incident. 4xx is
+ * the correct answer for "you did not start an authorize flow."
+ */
+const consumerPagePaths = ["/login", "/consent", "/paywall/return", "/paywall/cancelled"];
+export async function checkConsumerPages(base) {
+    const results = [];
+    for (const path of consumerPagePaths) {
+        const response = await fetchOrNull(`${base}${path}`);
+        results.push({ path, status: response.status, error: response.error });
+    }
+    const crashed = results.filter((row) => row.error || (row.status ?? 0) >= 500 || row.status === 404);
+    if (crashed.length === 0) {
+        return {
+            name: "consumer pages",
+            pass: true,
+            detail: results.map((row) => `${row.path} ${row.status}`).join("; "),
+        };
+    }
+    return {
+        name: "consumer pages",
+        pass: false,
+        detail: crashed
+            .map((row) => `${row.path} returned ${row.status ?? row.error}`)
+            .join("; "),
+        remedy: "These paths throw when returnUrl or a session is missing, which surfaces as 500 HTML " +
+            "that looks like a rail outage. They should return 4xx. File a rail bug — this is not " +
+            "an unbound hostname. /login is AuthServerOptions.LoginPath (default); it is not advertised " +
+            "in AS metadata.",
+    };
+}
 async function checkProtectedResourceMetadata(base, slug) {
     const url = `${base}/.well-known/oauth-protected-resource/${encodeURIComponent(slug)}/mcp`;
     const response = await fetchOrNull(url);
-    if (response.status === 200) {
-        return { name: "protected resource metadata", pass: true, detail: `${url} returned 200.` };
-    }
     if (response.status === 404) {
+        return [
+            {
+                name: "protected resource metadata",
+                pass: false,
+                detail: `${url} returned 404.`,
+                remedy: `No live resource is registered at slug '${slug}'. A draft resource 404s here by design — ` +
+                    "check its pending_requirements.",
+            },
+        ];
+    }
+    if (response.status !== 200) {
+        return [
+            {
+                name: "protected resource metadata",
+                pass: false,
+                detail: `${url} returned ${response.status ?? response.error}, expected 200.`,
+                remedy: "MCP clients discover the authorization server from this document. File a rail bug.",
+            },
+        ];
+    }
+    const checks = [
+        { name: "protected resource metadata", pass: true, detail: `${url} returned 200.` },
+    ];
+    checks.push(checkPrmResourceIdentifier(base, url, response.body));
+    return checks;
+}
+/**
+ * Tokens are audience-bound to the PRM `resource`. If that origin is not the issuer the client
+ * connected to, /authorize rejects the request as invalid_target — which reads as a rail outage.
+ */
+function checkPrmResourceIdentifier(base, url, body) {
+    let resource;
+    try {
+        const document = JSON.parse(body ?? "");
+        resource = typeof document.resource === "string" ? document.resource.trim() : "";
+    }
+    catch {
         return {
-            name: "protected resource metadata",
+            name: "protected resource identifier",
             pass: false,
-            detail: `${url} returned 404.`,
-            remedy: `No live resource is registered at slug '${slug}'. A draft resource 404s here by design — ` +
-                "check its pending_requirements.",
+            detail: `${url} did not return JSON.`,
+            remedy: "File this against the rail.",
+        };
+    }
+    if (!resource) {
+        return {
+            name: "protected resource identifier",
+            pass: false,
+            detail: `${url} has no resource identifier.`,
+            remedy: "PRM must name the RFC 8707 resource clients send at /authorize. File a rail bug.",
+        };
+    }
+    try {
+        const resourceOrigin = new URL(resource).origin;
+        const issuerOrigin = new URL(base).origin;
+        if (resourceOrigin === issuerOrigin) {
+            return {
+                name: "protected resource identifier",
+                pass: true,
+                detail: `PRM resource is ${resource}.`,
+            };
+        }
+        return {
+            name: "protected resource identifier",
+            pass: false,
+            detail: `PRM resource is '${resource}', but the issuer is '${base}'.`,
+            remedy: "Audience-bound tokens will not match a client that connected at the issuer host, and " +
+                "/authorize with the issuer-shaped resource fails as invalid_target. Register the " +
+                "resource URI clients actually connect to, or point doctor at the hostname in the PRM.",
+        };
+    }
+    catch {
+        return {
+            name: "protected resource identifier",
+            pass: false,
+            detail: `PRM resource '${resource}' is not an absolute URI.`,
+            remedy: "File this against the rail.",
         };
     }
-    return {
-        name: "protected resource metadata",
-        pass: false,
-        detail: `${url} returned ${response.status ?? response.error}, expected 200.`,
-        remedy: "MCP clients discover the authorization server from this document. File a rail bug.",
-    };
 }
 /**
  * The paywall is a transport-level 401 carrying `resource_metadata`. If this is not exactly right,
  * MCP clients never prompt for auth, which presents as "the server just does not work in Claude".
  */
-async function checkGatewayChallenge(base, slug) {
+/**
+ * The paywall is a transport-level 401 carrying `resource_metadata`. If this is not exactly right,
+ * MCP clients never prompt for auth, which presents as "the server just does not work in Claude".
+ */
+export async function checkGatewayChallenge(base, slug) {
     const url = `${base}/${encodeURIComponent(slug)}/mcp`;
     const response = await fetchOrNull(url, {
         method: "POST",
@@ -196,7 +295,7 @@ async function checkGatewayChallenge(base, slug) {
     };
 }
 /** Network failures are a diagnosis here, not an exception — every one of them is a real finding. */
-async function fetchOrNull(url, init = {}) {
+export async function fetchOrNull(url, init = {}) {
     try {
         const response = await fetch(url, { ...init, signal: AbortSignal.timeout(timeoutMs) });
         return {
@@ -204,6 +303,7 @@ async function fetchOrNull(url, init = {}) {
             status: response.status,
             body: await response.text(),
             headers: response.headers,
+            location: response.headers.get("location") ?? undefined,
         };
     }
     catch (err) {
@@ -215,6 +315,12 @@ export function formatDoctorReport(report) {
     if (report.slug) {
         lines.push(`slug:   ${report.slug}`);
     }
+    if (report.clients && report.clients.length > 0) {
+        lines.push(`client: ${report.clients.join(", ")}`);
+    }
+    if (report.dryRun) {
+        lines.push("mode:   dry-run (discovery only; no DCR POST)");
+    }
     lines.push("");
     for (const check of report.checks) {
         lines.push(`${check.pass ? "PASS" : "FAIL"}  ${check.name}`);
@@ -225,6 +331,11 @@ export function formatDoctorReport(report) {
     }
     lines.push("");
     lines.push(report.pass ? "Overall: PASS" : "Overall: FAIL");
+    if (report.checks.some((c) => !c.pass && c.detail.startsWith("DCR 400:"))) {
+        lines.push("");
+        lines.push("A DCR 400 is the interesting result. Paste error= and error_description= verbatim into a " +
+            "rail bug; do not work around it client-side.");
+    }
     return lines.join("\n");
 }
 //# sourceMappingURL=doctor.js.map

package/dist/doctor.js.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAiChD,MAAM,SAAS,GAAG,MAAM,CAAC;AAEzB,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,MAAc,EAAE,IAAa;IAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAkB,EAAE,CAAC;IAEjC,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAEvB,iGAAiG;IACjG,+FAA+F;IAC/F,sDAAsD;IACtD,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACpB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACrD,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAE9C,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,CAAC,IAAI,CAAC,MAAM,8BAA8B,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QAC9D,MAAM,CAAC,IAAI,CAAC,MAAM,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;AAC3E,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,cAAc,CAAC,IAAY;IACxC,MAAM,GAAG,GAAG,GAAG,IAAI,UAAU,CAAC;IAC9B,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IAExC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnC,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,GAAG,GAAG,0BAA0B,QAAQ,CAAC,KAAK,EAAE;YACxD,MAAM,EACJ,0FAA0F;gBAC1F,2CAA2C;SAC9C,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;IACpC,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,GAAG,GAAG,gGAAgG;YAC9G,MAAM,EACJ,mFAAmF;gBACnF,kFAAkF;gBAClF,4CAA4C;SAC/C,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,GAAG,GAAG,aAAa,MAAM,iBAAiB;YAClD,MAAM,EAAE,8EAA8E;SACvF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,GAAG,gBAAgB,EAAE,CAAC;AAClF,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAY;IACzC,MAAM,GAAG,GAAG,GAAG,IAAI,GAAG,cAAc,CAAC,oBAAoB,EAAE,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,MAAM,GAAkB,EAAE,CAAC;IAEjC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,sBAAsB;YAC5B,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,GAAG,GAAG,aAAa,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,KAAK,iBAAiB;YAC7E,MAAM,EACJ,0FAA0F;gBAC1F,0EAA0E;SAC7E,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,QAA4B,CAAC;IACjC,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAuB,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,sBAAsB;YAC5B,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,GAAG,GAAG,uBAAuB;YACrC,MAAM,EAAE,6BAA6B;SACtC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,GAAG,gBAAgB,EAAE,CAAC,CAAC;IAE1F,+FAA+F;IAC/F,6EAA6E;IAC7E,MAAM,cAAc,GAAG,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtD,MAAM,CAAC,IAAI,CACT,cAAc,KAAK,IAAI;QACrB,CAAC,CAAC;YACE,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,sBAAsB,cAAc,GAAG;SAChD;QACH,CAAC,CAAC;YACE,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,uBAAuB,cAAc,0BAA0B,IAAI,IAAI;YAC/E,MAAM,EACJ,2BAA2B,cAAc,gDAAgD;gBACzF,sFAAsF;SACzF,CACN,CAAC;IAEF,MAAM,OAAO,GAAG,QAAQ,CAAC,gBAAgB,IAAI,EAAE,CAAC;IAChD,MAAM,CAAC,IAAI,CACT,OAAO,KAAK,cAAc,CAAC,QAAQ;QACjC,CAAC,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,uBAAuB,OAAO,GAAG,EAAE;QACrF,CAAC,CAAC;YACE,IAAI,EAAE,kBAAkB;YACxB,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,wBAAwB,OAAO,gBAAgB,cAAc,CAAC,QAAQ,IAAI;YAClF,MAAM,EAAE,8DAA8D;SACvE,CACN,CAAC;IAEF,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,MAAM,CAAC,IAAI,CACT,OAAO,CAAC,MAAM,GAAG,CAAC;QAChB,CAAC,CAAC;YACE,IAAI,EAAE,0BAA0B;YAChC,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,YAAY,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;SACpF;QACH,CAAC,CAAC;YACE,IAAI,EAAE,0BAA0B;YAChC,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,wCAAwC;YAChD,MAAM,EAAE,8EAA8E;SACvF,CACN,CAAC;IAEF,+FAA+F;IAC/F,sEAAsE;IACtE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,yBAAyB;YAC/B,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,+BAA+B;YACvD,MAAM,EACJ,2FAA2F;gBAC3F,6BAA6B;SAChC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,8BAA8B,CAAC,IAAY,EAAE,IAAY;IACtE,MAAM,GAAG,GAAG,GAAG,IAAI,yCAAyC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC;IAC3F,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IAExC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC7F,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO;YACL,IAAI,EAAE,6BAA6B;YACnC,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,GAAG,GAAG,gBAAgB;YAC9B,MAAM,EACJ,2CAA2C,IAAI,4CAA4C;gBAC3F,iCAAiC;SACpC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,6BAA6B;QACnC,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,GAAG,GAAG,aAAa,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,KAAK,iBAAiB;QAC7E,MAAM,EAAE,oFAAoF;KAC7F,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,qBAAqB,CAAC,IAAY,EAAE,IAAY;IAC7D,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC;IACtD,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE;QACtC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,qCAAqC,EAAE;QAC9F,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;KAClF,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO;YACL,IAAI,EAAE,uBAAuB;YAC7B,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,wBAAwB,GAAG,aAAa,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,KAAK,iBAAiB;YAClG,MAAM,EACJ,QAAQ,CAAC,MAAM,KAAK,GAAG;gBACrB,CAAC,CAAC,6BAA6B,IAAI,+CAA+C;gBAClF,CAAC,CAAC,oFAAoF;SAC3F,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;IAClE,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3C,OAAO;YACL,IAAI,EAAE,uBAAuB;YAC7B,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,2EAA2E,SAAS,IAAI;YAChG,MAAM,EAAE,wEAAwE;SACjF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,uBAAuB;QAC7B,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,yCAAyC;KAClD,CAAC;AACJ,CAAC;AAUD,qGAAqG;AACrG,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,OAAoB,EAAE;IAC5D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACvF,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,IAAI,EAAE,MAAM,QAAQ,CAAC,IAAI,EAAE;YAC3B,OAAO,EAAE,QAAQ,CAAC,OAAO;SAC1B,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IAChF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAoB;IACrD,MAAM,KAAK,GAAa,CAAC,WAAW,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,KAAK,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACvC,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7D,KAAK,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YAChC,KAAK,CAAC,IAAI,CAAC,YAAY,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;IAC5D,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAqChD,MAAM,SAAS,GAAG,MAAM,CAAC;AAEzB,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,MAAc,EAAE,IAAa;IAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAkB,EAAE,CAAC;IAEjC,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAEvB,iGAAiG;IACjG,+FAA+F;IAC/F,sDAAsD;IACtD,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACpB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACrD,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9C,MAAM,CAAC,IAAI,CAAC,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;IAE5C,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,8BAA8B,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACnE,MAAM,CAAC,IAAI,CAAC,MAAM,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;AAC3E,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,cAAc,CAAC,IAAY;IACxC,MAAM,GAAG,GAAG,GAAG,IAAI,UAAU,CAAC;IAC9B,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IAExC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnC,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,GAAG,GAAG,0BAA0B,QAAQ,CAAC,KAAK,EAAE;YACxD,MAAM,EACJ,0FAA0F;gBAC1F,2CAA2C;SAC9C,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;IACpC,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,GAAG,GAAG,gGAAgG;YAC9G,MAAM,EACJ,mFAAmF;gBACnF,kFAAkF;gBAClF,4CAA4C;SAC/C,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,GAAG,GAAG,aAAa,MAAM,iBAAiB;YAClD,MAAM,EAAE,8EAA8E;SACvF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,GAAG,gBAAgB,EAAE,CAAC;AAClF,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAY;IACzC,MAAM,GAAG,GAAG,GAAG,IAAI,GAAG,cAAc,CAAC,oBAAoB,EAAE,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,MAAM,GAAkB,EAAE,CAAC;IAEjC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,sBAAsB;YAC5B,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,GAAG,GAAG,aAAa,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,KAAK,iBAAiB;YAC7E,MAAM,EACJ,0FAA0F;gBAC1F,0EAA0E;SAC7E,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,QAA4B,CAAC;IACjC,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAuB,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,sBAAsB;YAC5B,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,GAAG,GAAG,uBAAuB;YACrC,MAAM,EAAE,6BAA6B;SACtC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,GAAG,gBAAgB,EAAE,CAAC,CAAC;IAE1F,+FAA+F;IAC/F,6EAA6E;IAC7E,MAAM,cAAc,GAAG,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtD,MAAM,CAAC,IAAI,CACT,cAAc,KAAK,IAAI;QACrB,CAAC,CAAC;YACE,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,sBAAsB,cAAc,GAAG;SAChD;QACH,CAAC,CAAC;YACE,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,uBAAuB,cAAc,0BAA0B,IAAI,IAAI;YAC/E,MAAM,EACJ,2BAA2B,cAAc,gDAAgD;gBACzF,sFAAsF;SACzF,CACN,CAAC;IAEF,MAAM,OAAO,GAAG,QAAQ,CAAC,gBAAgB,IAAI,EAAE,CAAC;IAChD,MAAM,CAAC,IAAI,CACT,OAAO,KAAK,cAAc,CAAC,QAAQ;QACjC,CAAC,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,uBAAuB,OAAO,GAAG,EAAE;QACrF,CAAC,CAAC;YACE,IAAI,EAAE,kBAAkB;YACxB,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,wBAAwB,OAAO,gBAAgB,cAAc,CAAC,QAAQ,IAAI;YAClF,MAAM,EAAE,8DAA8D;SACvE,CACN,CAAC;IAEF,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,MAAM,CAAC,IAAI,CACT,OAAO,CAAC,MAAM,GAAG,CAAC;QAChB,CAAC,CAAC;YACE,IAAI,EAAE,0BAA0B;YAChC,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,YAAY,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;SACpF;QACH,CAAC,CAAC;YACE,IAAI,EAAE,0BAA0B;YAChC,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,wCAAwC;YAChD,MAAM,EAAE,8EAA8E;SACvF,CACN,CAAC;IAEF,+FAA+F;IAC/F,sEAAsE;IACtE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,yBAAyB;YAC/B,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,+BAA+B;YACvD,MAAM,EACJ,2FAA2F;gBAC3F,6BAA6B;SAChC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,iBAAiB,EAAE,oBAAoB,CAAU,CAAC;AAEnG,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAY;IACnD,MAAM,OAAO,GAAwD,EAAE,CAAC;IACxE,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;QACrD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC;IACrG,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;SACrE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,OAAO;aACZ,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,IAAI,aAAa,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;aAC/D,IAAI,CAAC,IAAI,CAAC;QACb,MAAM,EACJ,uFAAuF;YACvF,uFAAuF;YACvF,6FAA6F;YAC7F,iBAAiB;KACpB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,8BAA8B,CAAC,IAAY,EAAE,IAAY;IACtE,MAAM,GAAG,GAAG,GAAG,IAAI,yCAAyC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC;IAC3F,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IAExC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO;YACL;gBACE,IAAI,EAAE,6BAA6B;gBACnC,IAAI,EAAE,KAAK;gBACX,MAAM,EAAE,GAAG,GAAG,gBAAgB;gBAC9B,MAAM,EACJ,2CAA2C,IAAI,4CAA4C;oBAC3F,iCAAiC;aACpC;SACF,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO;YACL;gBACE,IAAI,EAAE,6BAA6B;gBACnC,IAAI,EAAE,KAAK;gBACX,MAAM,EAAE,GAAG,GAAG,aAAa,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,KAAK,iBAAiB;gBAC7E,MAAM,EAAE,oFAAoF;aAC7F;SACF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAkB;QAC5B,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,GAAG,gBAAgB,EAAE;KACpF,CAAC;IACF,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAClE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,SAAS,0BAA0B,CAAC,IAAY,EAAE,GAAW,EAAE,IAAa;IAC1E,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAA2B,CAAC;QAClE,QAAQ,GAAG,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,IAAI,EAAE,+BAA+B;YACrC,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,GAAG,GAAG,uBAAuB;YACrC,MAAM,EAAE,6BAA6B;SACtC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,IAAI,EAAE,+BAA+B;YACrC,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,GAAG,GAAG,8BAA8B;YAC5C,MAAM,EAAE,kFAAkF;SAC3F,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;QAChD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;QAC1C,IAAI,cAAc,KAAK,YAAY,EAAE,CAAC;YACpC,OAAO;gBACL,IAAI,EAAE,+BAA+B;gBACrC,IAAI,EAAE,IAAI;gBACV,MAAM,EAAE,mBAAmB,QAAQ,GAAG;aACvC,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI,EAAE,+BAA+B;YACrC,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,oBAAoB,QAAQ,yBAAyB,IAAI,IAAI;YACrE,MAAM,EACJ,uFAAuF;gBACvF,mFAAmF;gBACnF,uFAAuF;SAC1F,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,IAAI,EAAE,+BAA+B;YACrC,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,iBAAiB,QAAQ,2BAA2B;YAC5D,MAAM,EAAE,6BAA6B;SACtC,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAY,EAAE,IAAY;IACpE,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC;IACtD,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE;QACtC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,qCAAqC,EAAE;QAC9F,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;KAClF,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO;YACL,IAAI,EAAE,uBAAuB;YAC7B,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,wBAAwB,GAAG,aAAa,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,KAAK,iBAAiB;YAClG,MAAM,EACJ,QAAQ,CAAC,MAAM,KAAK,GAAG;gBACrB,CAAC,CAAC,6BAA6B,IAAI,+CAA+C;gBAClF,CAAC,CAAC,oFAAoF;SAC3F,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;IAClE,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3C,OAAO;YACL,IAAI,EAAE,uBAAuB;YAC7B,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,2EAA2E,SAAS,IAAI;YAChG,MAAM,EAAE,wEAAwE;SACjF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,uBAAuB;QAC7B,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,yCAAyC;KAClD,CAAC;AACJ,CAAC;AAWD,qGAAqG;AACrG,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,OAAoB,EAAE;IACnE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACvF,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,IAAI,EAAE,MAAM,QAAQ,CAAC,IAAI,EAAE;YAC3B,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,SAAS;SACxD,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IAChF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAoB;IACrD,MAAM,KAAK,GAAa,CAAC,WAAW,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,KAAK,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,KAAK,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;IAC9D,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7D,KAAK,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YAChC,KAAK,CAAC,IAAI,CAAC,YAAY,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;IAE5D,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QAC1E,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CACR,2FAA2F;YACzF,8CAA8C,CACjD,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/google-redirect.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Drive the real Google sign-in challenge, then ask Google whether the rail's redirect_uri
+ * is registered on the OAuth client.
+ *
+ * This exists because a misregistered Google callback surfaces at the very end of the paid
+ * loop — after DCR, after authorize — as a Google error page that reads like a rail outage.
+ * Nothing else in the product verified it, so both sides argued from prose.
+ *
+ * A bare GET /login cannot provoke the challenge: OnGet only renders, OnPost issues the
+ * Google ChallengeResult, and both require a live authorize returnUrl (a registered client,
+ * RFC 8707 resource, and the mcp scope). That is why this probe POSTs DCR, starts /authorize,
+ * then POSTs the login form. A GET /login that 500s on a missing returnUrl is a different
+ * check, in doctor.ts.
+ *
+ * Google's registered-vs-not signal is the first 302 off accounts.google.com (do not follow
+ * it): identifier/consent means the URI is accepted; /signin/oauth/error plus the OAuth error
+ * code redirect_uri_mismatch means it is not. Status is 302 in both cases.
+ */
+import { type DoctorCheck } from "./doctor.js";
+/** ASP.NET Google handler default CallbackPath; the rail does not override it. */
+export declare const googleCallbackPath = "/signin-google";
+export declare function expectedGoogleCallbackUri(issuer: string): string;
+export declare function checkGoogleRedirectUri(issuer: string, options?: {
+    slug?: string;
+    dryRun?: boolean;
+}): Promise<DoctorCheck[]>;
+export declare function probeGoogleRedirectUri(issuer: string, slug: string): Promise<DoctorCheck[]>;
+/** OAuth error code, not UI copy — present in the URL even when the HTML is localized. */
+export declare function googleRedirectUriRejected(location?: string, body?: string): boolean;
+export declare function googleRedirectUriAccepted(location?: string): boolean;
+export declare function sameCallbackUri(emitted: string, expected: string): boolean;