authflow-cli 0.4.0 → 0.5.0

package/dist/commands/set-domain.js

@@ -0,0 +1,162 @@
+import { requireAdminKey, requireIssuer } from "../config.js";
+import { assertCustomDomainReturned, assertCustomDomainSet, customDomainState, defaultPublicPath, defaultWaitTimeoutSeconds, describeCustomDomainState, dnsInstructions, formatDuration, isCustomDomainFailure, parsePublicHost, parsePublicPath, setDomainCommandLine, summarizeCustomDomain, waitForCustomDomain, waitIntervalMs, } from "../custom-domain.js";
+import { describePending, getResource, setCustomDomain, verifyCustomDomain } from "../rail.js";
+import { formatCursorMcpConfig } from "../status.js";
+/**
+ * Serve a resource on the tenant's own hostname: the "bring your existing MCP URL" step.
+ *
+ * Setting the host is the easy half. The rail answers with the DNS records the tenant has to create
+ * at a registrar this CLI cannot reach, so the command's job is to put those records on screen
+ * exactly as the rail issued them and then, with --wait, to confirm they took.
+ *
+ * There is no separate verify command, so this is also how a tenant re-checks after adding the
+ * records: with no --host it verifies the host already set on the resource instead of setting one.
+ */
+export function setDomainCommand(program, env = {}) {
+    program
+        .command("set-domain")
+        .description("Serve a resource on your own hostname, or re-verify the one already set: print the DNS records to add and, with --wait, poll until the domain is ready")
+        .requiredOption("--slug <slug>", "Resource slug")
+        .option("--host <host>", "Your hostname, e.g. mcp.example.com (a subdomain; no scheme, path or port). Omit it to re-verify the host already set on the resource")
+        .option("--path <path>", "Public MCP path on that host. Sent only when given: the rail uses /mcp the first time and keeps the stored path afterwards. Needs --host")
+        .option("--wait", "Poll verification until the domain is ready, fails, or --timeout passes")
+        .option("--timeout <seconds>", `With --wait: how long to keep polling before giving up (default ${defaultWaitTimeoutSeconds})`)
+        .option("--issuer <url>", "Authflow issuer (default: AUTHFLOW_ISSUER)")
+        .option("--admin-key <key>", "Admin API key (default: AUTHFLOW_ADMIN_API_KEY)")
+        .action(async (opts) => {
+        process.exitCode = await runSetDomain(opts, env);
+    });
+}
+/**
+ * Returns the exit code instead of setting it: 0 when the domain is ready (or, without --wait,
+ * when it was set or re-checked and is not in a failure state), 1 when it timed out or is blocked,
+ * moved, or removed.
+ */
+export async function runSetDomain(opts, env = {}) {
+    const log = env.log ?? ((line) => console.log(line));
+    const timeoutMs = resolveTimeoutMs(opts);
+    // A path belongs to a host being set. Re-verifying sends nothing, so a --path there would be
+    // silently ignored, and someone who typed it believes they changed the path.
+    if (opts.host === undefined && opts.path !== undefined) {
+        throw new Error("--path only applies with --host. Without a host this re-verifies the one already set, and the " +
+            "rail keeps its stored path.");
+    }
+    const host = opts.host === undefined ? undefined : parsePublicHost(opts.host);
+    const path = opts.path === undefined ? undefined : parsePublicPath(opts.path);
+    const auth = { issuer: requireIssuer(opts.issuer), adminKey: requireAdminKey(opts.adminKey) };
+    // Both routes end with a receipt to show and, with --wait, to poll from.
+    let receipt;
+    let hostName;
+    if (host !== undefined) {
+        receipt = await setCustomDomain(auth, opts.slug, host, path);
+        hostName = host;
+    }
+    else {
+        // Ask the receipt first. Verifying a resource with no host would fail with an error that does
+        // not say how to fix it; this says to pass --host.
+        hostName = assertCustomDomainSet(await getResource(auth, opts.slug), opts.slug);
+        receipt = await verifyCustomDomain(auth, opts.slug);
+    }
+    assertCustomDomainReturned(receipt, hostName, opts.slug);
+    const url = receipt.gateway_url ??
+        receipt.resource ??
+        `https://${hostName}${receipt.public_path ?? path ?? defaultPublicPath}`;
+    log(`${receipt.slug ?? opts.slug} -> ${url}`);
+    log(`state:  ${summarizeCustomDomain(receipt)}`);
+    const instructions = dnsInstructions(receipt);
+    if (instructions.length > 0) {
+        log("");
+        for (const line of instructions) {
+            log(line);
+        }
+    }
+    const state = customDomainState(receipt);
+    if (state === "ready") {
+        return reportReady(receipt, opts.slug, log);
+    }
+    if (isCustomDomainFailure(state)) {
+        return reportFailure(receipt, opts.slug, log);
+    }
+    if (!opts.wait) {
+        log("");
+        log(host === undefined
+            ? `Still not ready. To keep checking (now, then every ${formatDuration(waitIntervalMs)} until ready):`
+            : `Once the records are in place, verify (re-checks now, then every ${formatDuration(waitIntervalMs)} until ready):`);
+        log(`  ${setDomainCommandLine(opts.slug)}`);
+        return 0;
+    }
+    log("");
+    log("Add the records above. This keeps checking and says when the domain is ready.");
+    const result = await waitForCustomDomain(receipt, {
+        verify: () => verifyCustomDomain(auth, opts.slug),
+        timeoutMs,
+        sleep: env.sleep,
+        now: env.now,
+        onProgress: (line) => log(`  ${line}`),
+    });
+    switch (result.outcome) {
+        case "ready":
+            return reportReady(result.receipt, opts.slug, log);
+        case "failed":
+            return reportFailure(result.receipt, opts.slug, log);
+        case "timeout":
+            return reportTimeout(result.receipt, opts.slug, timeoutMs, log);
+    }
+}
+function resolveTimeoutMs(opts) {
+    if (opts.timeout === undefined) {
+        return defaultWaitTimeoutSeconds * 1000;
+    }
+    if (!opts.wait) {
+        throw new Error("--timeout only applies with --wait.");
+    }
+    const seconds = Number(opts.timeout);
+    if (!Number.isFinite(seconds) || seconds <= 0) {
+        throw new Error(`--timeout must be a positive number of seconds (got '${opts.timeout}').`);
+    }
+    return seconds * 1000;
+}
+function reportReady(receipt, slug, log) {
+    log("");
+    log(`Ready. ${receipt.gateway_url ?? receipt.resource ?? "The hostname"} is serving this resource.`);
+    const config = formatCursorMcpConfig(receipt);
+    if (config.length > 0) {
+        log("");
+        for (const line of config) {
+            log(line);
+        }
+    }
+    // A ready hostname is one requirement, not the whole go-live. Say what is left rather than let
+    // "Ready" read as "live".
+    const pending = receipt.pending_requirements ?? [];
+    if (pending.length > 0) {
+        log("");
+        log("Still pending before go-live:");
+        for (const requirement of pending) {
+            log(`  ${requirement}`);
+            log(`    ${describePending(requirement, slug)}`);
+        }
+    }
+    return 0;
+}
+function reportFailure(receipt, slug, log) {
+    const state = customDomainState(receipt);
+    log("");
+    log(`The custom domain is ${state}: ${describeCustomDomainState(state)}.`);
+    log(`last error: ${receipt.custom_domain?.last_error?.trim() || "(the rail gave no detail)"}`);
+    log("");
+    log(`Fix the cause, then re-run: ${setDomainCommandLine(slug)}`);
+    return 1;
+}
+function reportTimeout(receipt, slug, timeoutMs, log) {
+    log("");
+    log(`Still ${customDomainState(receipt) ?? "unknown"} after ${formatDuration(timeoutMs)}.`);
+    const error = receipt.custom_domain?.last_error?.trim();
+    if (error) {
+        log(`last error: ${error}`);
+    }
+    log("Nothing is lost. Add or fix the records above, then re-run:");
+    log(`  ${setDomainCommandLine(slug)}`);
+    return 1;
+}
+//# sourceMappingURL=set-domain.js.map

package/dist/commands/set-domain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"set-domain.js","sourceRoot":"","sources":["../../src/commands/set-domain.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,aAAa,EAA4B,MAAM,cAAc,CAAC;AACxF,OAAO,EACL,0BAA0B,EAC1B,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EACjB,yBAAyB,EACzB,yBAAyB,EACzB,eAAe,EACf,cAAc,EACd,qBAAqB,EACrB,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC/F,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAoBrD;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAgB,EAAE,MAA4B,EAAE;IAC/E,OAAO;SACJ,OAAO,CAAC,YAAY,CAAC;SACrB,WAAW,CACV,wJAAwJ,CACzJ;SACA,cAAc,CAAC,eAAe,EAAE,eAAe,CAAC;SAChD,MAAM,CACL,eAAe,EACf,uIAAuI,CACxI;SACA,MAAM,CACL,eAAe,EACf,0IAA0I,CAC3I;SACA,MAAM,CAAC,QAAQ,EAAE,yEAAyE,CAAC;SAC3F,MAAM,CACL,qBAAqB,EACrB,mEAAmE,yBAAyB,GAAG,CAChG;SACA,MAAM,CAAC,gBAAgB,EAAE,4CAA4C,CAAC;SACtE,MAAM,CAAC,mBAAmB,EAAE,iDAAiD,CAAC;SAC9E,MAAM,CAAC,KAAK,EAAE,IAAsB,EAAE,EAAE;QACvC,OAAO,CAAC,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAsB,EACtB,MAA4B,EAAE;IAE9B,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAEzC,6FAA6F;IAC7F,6EAA6E;IAC7E,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CACb,gGAAgG;YAC9F,6BAA6B,CAChC,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;IAE9F,yEAAyE;IACzE,IAAI,OAA4B,CAAC;IACjC,IAAI,QAAgB,CAAC;IACrB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAC7D,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,8FAA8F;QAC9F,mDAAmD;QACnD,QAAQ,GAAG,qBAAqB,CAAC,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAChF,OAAO,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC;IACD,0BAA0B,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAEzD,MAAM,GAAG,GACP,OAAO,CAAC,WAAW;QACnB,OAAO,CAAC,QAAQ;QAChB,WAAW,QAAQ,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,IAAI,iBAAiB,EAAE,CAAC;IAC3E,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,OAAO,GAAG,EAAE,CAAC,CAAC;IAC9C,GAAG,CAAC,WAAW,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAEjD,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,GAAG,CAAC,EAAE,CAAC,CAAC;QACR,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;YAChC,GAAG,CAAC,IAAI,CAAC,CAAC;QACZ,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACtB,OAAO,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,GAAG,CAAC,EAAE,CAAC,CAAC;QACR,GAAG,CACD,IAAI,KAAK,SAAS;YAChB,CAAC,CAAC,sDAAsD,cAAc,CAAC,cAAc,CAAC,gBAAgB;YACtG,CAAC,CAAC,oEAAoE,cAAc,CAAC,cAAc,CAAC,gBAAgB,CACvH,CAAC;QACF,GAAG,CAAC,KAAK,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,CAAC;IACX,CAAC;IAED,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,+EAA+E,CAAC,CAAC;IACrF,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE;QAChD,MAAM,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC;QACjD,SAAS;QACT,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;KACvC,CAAC,CAAC;IAEH,QAAQ,MAAM,CAAC,OAAO,EAAE,CAAC;QACvB,KAAK,OAAO;YACV,OAAO,WAAW,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACrD,KAAK,QAAQ;YACX,OAAO,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACvD,KAAK,SAAS;YACZ,OAAO,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IACpE,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAsB;IAC9C,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,yBAAyB,GAAG,IAAI,CAAC;IAC1C,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,wDAAwD,IAAI,CAAC,OAAO,KAAK,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,OAAO,GAAG,IAAI,CAAC;AACxB,CAAC;AAED,SAAS,WAAW,CAAC,OAA4B,EAAE,IAAY,EAAE,GAA2B;IAC1F,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,UAAU,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,QAAQ,IAAI,cAAc,4BAA4B,CAAC,CAAC;IAErG,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,GAAG,CAAC,EAAE,CAAC,CAAC;QACR,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;YAC1B,GAAG,CAAC,IAAI,CAAC,CAAC;QACZ,CAAC;IACH,CAAC;IAED,+FAA+F;IAC/F,0BAA0B;IAC1B,MAAM,OAAO,GAAG,OAAO,CAAC,oBAAoB,IAAI,EAAE,CAAC;IACnD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,GAAG,CAAC,EAAE,CAAC,CAAC;QACR,GAAG,CAAC,+BAA+B,CAAC,CAAC;QACrC,KAAK,MAAM,WAAW,IAAI,OAAO,EAAE,CAAC;YAClC,GAAG,CAAC,KAAK,WAAW,EAAE,CAAC,CAAC;YACxB,GAAG,CAAC,OAAO,eAAe,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,aAAa,CAAC,OAA4B,EAAE,IAAY,EAAE,GAA2B;IAC5F,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACzC,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,wBAAwB,KAAK,KAAK,yBAAyB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3E,GAAG,CAAC,eAAe,OAAO,CAAC,aAAa,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,2BAA2B,EAAE,CAAC,CAAC;IAC/F,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,+BAA+B,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjE,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,aAAa,CACpB,OAA4B,EAC5B,IAAY,EACZ,SAAiB,EACjB,GAA2B;IAE3B,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,SAAS,iBAAiB,CAAC,OAAO,CAAC,IAAI,SAAS,UAAU,cAAc,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC5F,MAAM,KAAK,GAAG,OAAO,CAAC,aAAa,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACxD,IAAI,KAAK,EAAE,CAAC;QACV,GAAG,CAAC,eAAe,KAAK,EAAE,CAAC,CAAC;IAC9B,CAAC;IACD,GAAG,CAAC,6DAA6D,CAAC,CAAC;IACnE,GAAG,CAAC,KAAK,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvC,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/config.d.ts

@@ -8,13 +8,39 @@ export type CliConfig = {
 export declare function requireIssuer(flag?: string): string;
 export declare function requireAdminKey(flag?: string): string;
 export declare function requireOriginKey(flag?: string): string;
+/** One DNS record a tenant must create for a custom domain (`purpose`: ownership, traffic, certificate). */
+export type CustomDomainRecord = {
+    type: string;
+    name: string;
+    value: string;
+    purpose: string;
+};
+/**
+ * The claim on a tenant-owned hostname. `state` is one of awaiting_ownership, provisioning,
+ * awaiting_traffic, ready, moved, blocked, removed; it stays a plain string so a state a newer rail
+ * adds is shown rather than rejected.
+ */
+export type CustomDomainStatus = {
+    state: string;
+    cname_target?: string | null;
+    records?: CustomDomainRecord[];
+    last_error?: string | null;
+    checked_at?: string | null;
+};
 /** Registration receipt fields (snake_case) from RegistryAdminEndpoints. */
 export type RegistrationReceipt = {
     slug?: string;
     display_name?: string;
+    /** Canonical resource URI. `https://{public_host}{public_path}` once a custom host is set. */
     resource?: string;
     gateway_url?: string;
     prm_url?: string;
+    /** Tenant hostname when the resource is served on its own host (omitted otherwise). */
+    public_host?: string;
+    /** Public MCP path on that host, `/mcp` unless the tenant chose another. */
+    public_path?: string;
+    /** DNS records and claim state for the custom host (omitted when there is no host). */
+    custom_domain?: CustomDomainStatus;
     issuer?: string;
     keys_url?: string;
     usage_url?: string;
@@ -29,8 +55,13 @@ export type RegistrationReceipt = {
     gateway_egress_cidrs?: string[];
     status?: string;
     metering_mode?: string;
-    /** What still blocks go-live: origin_base_uri, connected_account_id, stripe_onboarding_complete. */
+    /**
+     * What still blocks go-live: origin_base_uri, connected_account_id, stripe_onboarding_complete,
+     * and custom_domain_dns while a custom host is set but not yet ready.
+     */
     pending_requirements?: string[];
+    last_probe_at_utc?: string | null;
+    last_probe_passed?: boolean | null;
 };
 export declare function readReceipt(path: string): Promise<RegistrationReceipt>;
 export declare function resolveGatewayUrl(opts: {

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAU5C,MAAM,UAAU,aAAa,CAAC,IAAa;IACzC,MAAM,MAAM,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAa;IAC3C,MAAM,GAAG,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAa;IAC5C,MAAM,GAAG,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AA2BD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAY;IAC5C,MAAM,GAAG,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAClE,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAwB,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAGjC;IACC,OAAO,CACL,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE;QACvB,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE;QACxC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE;QACrC,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE;QACjC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC9B,SAAS,CACV,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,GAAW,EACX,OAAsD,EAAE;IAExD,MAAM,EAAE,gBAAgB,EAAE,GAAG,SAAS,EAAE,GAAG,IAAI,CAAC;IAChD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,IAAO,CAAC;IACZ,IAAI,CAAC;QACH,IAAI,GAAG,GAAG,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAO,CAAC,CAAC,CAAE,EAAQ,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,KAAK,QAAQ,CAAC,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,IAAI,gBAAgB,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACpE,MAAM,GAAG,GAAG,IAAsD,CAAC;QACnE,MAAM,MAAM,GAAG,GAAG,CAAC,iBAAiB,IAAI,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,aAAa,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,KAAa;IAClC,OAAO,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC;AAC9C,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAU5C,MAAM,UAAU,aAAa,CAAC,IAAa;IACzC,MAAM,MAAM,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAa;IAC3C,MAAM,GAAG,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAa;IAC5C,MAAM,GAAG,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AA4DD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAY;IAC5C,MAAM,GAAG,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAClE,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAwB,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAGjC;IACC,OAAO,CACL,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE;QACvB,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE;QACxC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE;QACrC,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE;QACjC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC9B,SAAS,CACV,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,GAAW,EACX,OAAsD,EAAE;IAExD,MAAM,EAAE,gBAAgB,EAAE,GAAG,SAAS,EAAE,GAAG,IAAI,CAAC;IAChD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,IAAO,CAAC;IACZ,IAAI,CAAC;QACH,IAAI,GAAG,GAAG,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAO,CAAC,CAAC,CAAE,EAAQ,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,KAAK,QAAQ,CAAC,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,IAAI,gBAAgB,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACpE,MAAM,GAAG,GAAG,IAAsD,CAAC;QACnE,MAAM,MAAM,GAAG,GAAG,CAAC,iBAAiB,IAAI,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,aAAa,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,KAAa;IAClC,OAAO,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC;AAC9C,CAAC"}

package/dist/custom-domain.d.ts

@@ -0,0 +1,96 @@
+import type { CustomDomainRecord, RegistrationReceipt } from "./config.js";
+/**
+ * Everything about a tenant-owned hostname that more than one front end needs: validating what the
+ * user typed, showing the DNS records they have to create, and waiting for the rail to confirm them.
+ * `set-domain`, the `authflow_set_custom_domain` tool, `status`, and `register` all render the same
+ * records, so they render them from here; a table that differs between the CLI and the agent path is
+ * how a tenant ends up adding the wrong record.
+ */
+/** The public MCP path when a tenant does not choose one. */
+export declare const defaultPublicPath = "/mcp";
+/** How often verification is re-checked while waiting. Each call makes the rail do real DNS lookups. */
+export declare const waitIntervalMs = 15000;
+/** Default `set-domain --wait` budget: DNS propagation plus certificate issuance. */
+export declare const defaultWaitTimeoutSeconds = 1800;
+/**
+ * How long the MCP tool waits. A tool call that outlives the client's request timeout (60 s is the
+ * SDK default and common in hosts) is dropped along with its result, so the tool waits less than
+ * that, reports where things stand, and tells the agent to call again. The client's clock also
+ * covers the request that sets the host and the last verification still in flight when the wait
+ * ends, which is why this is well short of 60 s rather than just under it.
+ */
+export declare const mcpWaitTimeoutMs = 45000;
+/**
+ * Normalises a hostname the user typed and rejects the things that are not one. The rail validates
+ * too; this exists because the likeliest mistake is pasting the MCP URL, and the rail's 400 does not
+ * say that.
+ */
+export declare function parsePublicHost(input: string, flag?: string, 
+/** Where the path goes, for the error. Null when the caller has no path to offer. */
+pathFlag?: string | null): string;
+export declare function parsePublicPath(input: string, flag?: string): string;
+/**
+ * A 200 from the rail that carries no `custom_domain` has nothing to show or wait on. It means the
+ * rail predates custom domains or something upstream dropped the object; either way, say so rather
+ * than print an empty table and report success.
+ */
+export declare function assertCustomDomainReturned(receipt: RegistrationReceipt, host: string, slug: string): void;
+/**
+ * Re-verifying means re-checking a host that is already there. A resource with none has nothing to
+ * verify, and the bare error from asking the rail anyway would not say how to fix it, so say that
+ * plainly and name the argument that sets one. Returns the host the resource is registered on.
+ */
+export declare function assertCustomDomainSet(receipt: RegistrationReceipt, slug: string, hostFlag?: string): string;
+export declare function customDomainState(receipt: RegistrationReceipt): string | undefined;
+export declare function isCustomDomainFailure(state: string | undefined): boolean;
+/** One line on what a state means, for the person staring at it. */
+export declare function describeCustomDomainState(state: string | undefined): string;
+/** `awaiting_traffic (waiting for the traffic and certificate CNAMEs)`, plus the rail's last error. */
+export declare function summarizeCustomDomain(receipt: RegistrationReceipt): string;
+/** The records as an aligned TYPE / NAME / VALUE / PURPOSE table, in the order the rail listed them. */
+export declare function formatDnsRecords(records: readonly CustomDomainRecord[]): string[];
+/**
+ * Registrars disagree about the Name column. GoDaddy and several others append the domain
+ * themselves, so a full name there produces `mcp.example.com.example.com` and a record that
+ * silently never matches.
+ */
+export declare function registrarNameHint(host: string): string[];
+/** The "add these records" block shared by every front end. Empty when the rail listed none. */
+export declare function dnsInstructions(receipt: RegistrationReceipt): string[];
+/**
+ * The command that re-checks the host already set on a resource. It names no host and no path: the
+ * rail keeps both, so there is nothing to retype and nothing to get wrong on a re-run.
+ */
+export declare function setDomainCommandLine(slug: string): string;
+export type WaitOutcome = "ready" | "failed" | "timeout";
+export type WaitResult = {
+    outcome: WaitOutcome;
+    /** The last receipt seen: the one that settled it, or the last one before giving up. */
+    receipt: RegistrationReceipt;
+    /** Verification calls that returned a receipt. */
+    polls: number;
+    elapsedMs: number;
+    /** The lines that were reported, in order, for callers that cannot stream them. */
+    progress: string[];
+};
+export type WaitOptions = {
+    /** Re-checks the domain now and returns the fresh receipt. */
+    verify: () => Promise<RegistrationReceipt>;
+    timeoutMs: number;
+    intervalMs?: number;
+    /** Injectable so tests do not wait in real time. */
+    sleep?: (ms: number) => Promise<void>;
+    now?: () => number;
+    onProgress?: (line: string) => void;
+};
+/**
+ * Polls verification until the domain is ready, fails, or the budget runs out. Verifies straight
+ * away and then every interval: a tenant who re-runs after adding their records should not wait a
+ * full interval to hear it worked.
+ *
+ * `ready` and the failure states settle it. Anything else, including a state this CLI has never
+ * heard of, keeps waiting, so a rail that adds a state does not break an old CLI.
+ */
+export declare function waitForCustomDomain(initial: RegistrationReceipt, options: WaitOptions): Promise<WaitResult>;
+/** `15s`, `50s`, `30m`. */
+export declare function formatDuration(ms: number): string;

package/dist/custom-domain.js

@@ -0,0 +1,289 @@
+/**
+ * Everything about a tenant-owned hostname that more than one front end needs: validating what the
+ * user typed, showing the DNS records they have to create, and waiting for the rail to confirm them.
+ * `set-domain`, the `authflow_set_custom_domain` tool, `status`, and `register` all render the same
+ * records, so they render them from here; a table that differs between the CLI and the agent path is
+ * how a tenant ends up adding the wrong record.
+ */
+/** The public MCP path when a tenant does not choose one. */
+export const defaultPublicPath = "/mcp";
+/** How often verification is re-checked while waiting. Each call makes the rail do real DNS lookups. */
+export const waitIntervalMs = 15_000;
+/** Default `set-domain --wait` budget: DNS propagation plus certificate issuance. */
+export const defaultWaitTimeoutSeconds = 1800;
+/**
+ * How long the MCP tool waits. A tool call that outlives the client's request timeout (60 s is the
+ * SDK default and common in hosts) is dropped along with its result, so the tool waits less than
+ * that, reports where things stand, and tells the agent to call again. The client's clock also
+ * covers the request that sets the host and the last verification still in flight when the wait
+ * ends, which is why this is well short of 60 s rather than just under it.
+ */
+export const mcpWaitTimeoutMs = 45_000;
+const failureStates = new Set(["moved", "blocked", "removed"]);
+/** Consecutive verification errors tolerated while waiting before the error is surfaced. */
+const maxConsecutiveFailures = 3;
+/** While nothing changes, say so about once a minute at the default interval. */
+const heartbeatEveryPolls = 4;
+/**
+ * Normalises a hostname the user typed and rejects the things that are not one. The rail validates
+ * too; this exists because the likeliest mistake is pasting the MCP URL, and the rail's 400 does not
+ * say that.
+ */
+export function parsePublicHost(input, flag = "--host", 
+/** Where the path goes, for the error. Null when the caller has no path to offer. */
+pathFlag = "--path") {
+    const host = input.trim().toLowerCase().replace(/\.$/, "");
+    if (host.length === 0 || /[/:?#@*\s]/.test(host)) {
+        throw new Error(`${flag} must be a bare hostname such as mcp.example.com, with no scheme, path, port or ` +
+            `wildcard (got '${input.trim()}').${pathFlag ? ` The path goes in ${pathFlag}.` : ""}`);
+    }
+    if (!/^[a-z0-9_]([a-z0-9_.-]*[a-z0-9_])?$/.test(host)) {
+        throw new Error(`${flag} '${input.trim()}' is not a plain ASCII hostname. Use the punycode (xn--) form for a ` +
+            "non-ASCII name.");
+    }
+    if (!host.includes(".")) {
+        throw new Error(`${flag} must be the full hostname, such as mcp.example.com, not just '${host}'. ` +
+            "(The short form belongs in your registrar's Name column, not here.)");
+    }
+    return host;
+}
+export function parsePublicPath(input, flag = "--path") {
+    const path = input.trim();
+    if (!path.startsWith("/")) {
+        throw new Error(`${flag} must start with '/', for example ${defaultPublicPath} (got '${path}').`);
+    }
+    return path;
+}
+/**
+ * A 200 from the rail that carries no `custom_domain` has nothing to show or wait on. It means the
+ * rail predates custom domains or something upstream dropped the object; either way, say so rather
+ * than print an empty table and report success.
+ */
+export function assertCustomDomainReturned(receipt, host, slug) {
+    if (!receipt.custom_domain) {
+        throw new Error(`The rail returned no custom_domain for ${host} on ${slug}, so there are no records to show. ` +
+            "Is the rail new enough to support custom domains?");
+    }
+}
+/**
+ * Re-verifying means re-checking a host that is already there. A resource with none has nothing to
+ * verify, and the bare error from asking the rail anyway would not say how to fix it, so say that
+ * plainly and name the argument that sets one. Returns the host the resource is registered on.
+ */
+export function assertCustomDomainSet(receipt, slug, hostFlag = "--host") {
+    const host = receipt.public_host?.trim();
+    if (!host) {
+        throw new Error(`no custom domain set on ${slug}; pass ${hostFlag}`);
+    }
+    return host;
+}
+export function customDomainState(receipt) {
+    return receipt.custom_domain?.state?.trim().toLowerCase() || undefined;
+}
+export function isCustomDomainFailure(state) {
+    return state !== undefined && failureStates.has(state);
+}
+/** One line on what a state means, for the person staring at it. */
+export function describeCustomDomainState(state) {
+    switch (state) {
+        case "awaiting_ownership":
+            return "waiting for the ownership TXT record";
+        case "provisioning":
+            return "ownership verified; provisioning the hostname and certificate";
+        case "awaiting_traffic":
+            return "waiting for the traffic and certificate CNAMEs";
+        case "ready":
+            return "the hostname is serving traffic";
+        case "moved":
+            return "DNS no longer points at Authflow";
+        case "blocked":
+            return "the hostname is blocked";
+        case "removed":
+            return "the hostname was removed";
+        case undefined:
+            return "the rail reported no custom-domain state";
+        default:
+            return "a state this CLI does not know; see last_error";
+    }
+}
+/** `awaiting_traffic (waiting for the traffic and certificate CNAMEs)`, plus the rail's last error. */
+export function summarizeCustomDomain(receipt) {
+    const state = customDomainState(receipt);
+    const error = receipt.custom_domain?.last_error?.trim();
+    return `${state ?? "unknown"} (${describeCustomDomainState(state)})${error ? ` - ${error}` : ""}`;
+}
+/** The records as an aligned TYPE / NAME / VALUE / PURPOSE table, in the order the rail listed them. */
+export function formatDnsRecords(records) {
+    const rows = [
+        ["TYPE", "NAME", "VALUE", "PURPOSE"],
+        ...records.map((record) => [
+            String(record.type ?? ""),
+            String(record.name ?? ""),
+            String(record.value ?? ""),
+            String(record.purpose ?? ""),
+        ]),
+    ];
+    const widths = [0, 1, 2].map((column) => Math.max(...rows.map((row) => row[column].length)));
+    return rows.map((row) => `${row[0].padEnd(widths[0])}  ${row[1].padEnd(widths[1])}  ${row[2].padEnd(widths[2])}  ${row[3]}`.trimEnd());
+}
+/**
+ * Registrars disagree about the Name column. GoDaddy and several others append the domain
+ * themselves, so a full name there produces `mcp.example.com.example.com` and a record that
+ * silently never matches.
+ */
+export function registrarNameHint(host) {
+    const labels = host.split(".");
+    const intro = "Registrars such as GoDaddy usually want only the host part of the name, not the full name";
+    if (labels.length < 3) {
+        return [`${intro}: leave your domain off.`];
+    }
+    const relative = labels.slice(0, -2).join(".");
+    return [
+        `${intro}:`,
+        `for ${host} enter "${relative}", and for _authflow-verify.${host} enter "_authflow-verify.${relative}".`,
+    ];
+}
+/** The "add these records" block shared by every front end. Empty when the rail listed none. */
+export function dnsInstructions(receipt) {
+    const records = receipt.custom_domain?.records ?? [];
+    if (records.length === 0) {
+        return [];
+    }
+    const lines = [
+        "Add these DNS records at your registrar:",
+        "",
+        ...formatDnsRecords(records).map((line) => `  ${line}`),
+        "",
+    ];
+    const host = receipt.public_host?.trim();
+    if (host) {
+        lines.push(...registrarNameHint(host));
+    }
+    // The certificate record only exists once provisioning has begun, which is after ownership is
+    // verified. Without saying so, a tenant who sees two records adds two and wonders about the third.
+    const state = customDomainState(receipt);
+    if (!records.some((record) => record.purpose === "certificate") &&
+        state !== "ready" &&
+        !isCustomDomainFailure(state)) {
+        lines.push("", "The certificate record (_acme-challenge) is listed once provisioning begins, after ownership", "is verified. Check again once the ownership TXT record is in place.");
+    }
+    return lines;
+}
+/**
+ * The command that re-checks the host already set on a resource. It names no host and no path: the
+ * rail keeps both, so there is nothing to retype and nothing to get wrong on a re-run.
+ */
+export function setDomainCommandLine(slug) {
+    return `authflow set-domain --slug ${slug} --wait`;
+}
+/**
+ * Polls verification until the domain is ready, fails, or the budget runs out. Verifies straight
+ * away and then every interval: a tenant who re-runs after adding their records should not wait a
+ * full interval to hear it worked.
+ *
+ * `ready` and the failure states settle it. Anything else, including a state this CLI has never
+ * heard of, keeps waiting, so a rail that adds a state does not break an old CLI.
+ */
+export async function waitForCustomDomain(initial, options) {
+    const intervalMs = options.intervalMs ?? waitIntervalMs;
+    const sleep = options.sleep ?? defaultSleep;
+    const now = options.now ?? Date.now;
+    const started = now();
+    const deadline = started + options.timeoutMs;
+    const progress = [];
+    const emit = (line) => {
+        progress.push(line);
+        options.onProgress?.(line);
+    };
+    const stamp = () => `[${formatClock(now() - started)}]`;
+    const finish = (outcome, receipt, polls) => ({
+        outcome,
+        receipt,
+        polls,
+        elapsedMs: now() - started,
+        progress,
+    });
+    let receipt = initial;
+    const already = verdict(receipt);
+    if (already) {
+        return finish(already, receipt, 0);
+    }
+    emit(`Checking every ${formatDuration(intervalMs)}, giving up after ${formatDuration(options.timeoutMs)}.`);
+    const seen = new Set((receipt.custom_domain?.records ?? []).map(recordKey));
+    let lastSummary = summarizeCustomDomain(receipt);
+    let polls = 0;
+    let failures = 0;
+    for (;;) {
+        let fresh;
+        try {
+            fresh = await options.verify();
+        }
+        catch (err) {
+            // A 30-minute wait should not die on one dropped connection, but a persistent error (a bad
+            // key, a rail that is down) must not be retried until the deadline either.
+            failures += 1;
+            if (failures >= maxConsecutiveFailures) {
+                throw err;
+            }
+            emit(`${stamp()} verification failed (${errorMessage(err)}); will retry`);
+        }
+        if (fresh) {
+            failures = 0;
+            polls += 1;
+            receipt = fresh;
+            const summary = summarizeCustomDomain(receipt);
+            if (summary !== lastSummary || polls === 1 || polls % heartbeatEveryPolls === 0) {
+                emit(`${stamp()} ${summary}`);
+                lastSummary = summary;
+            }
+            // The certificate record appears mid-wait, after ownership verifies. Saying so here is the
+            // difference between "waiting on DNS" and "waiting on a record nobody knows to add".
+            const appeared = (receipt.custom_domain?.records ?? []).filter((record) => !seen.has(recordKey(record)));
+            if (appeared.length > 0) {
+                for (const record of appeared) {
+                    seen.add(recordKey(record));
+                }
+                emit(`${stamp()} new DNS record${appeared.length === 1 ? "" : "s"} to add:`);
+                for (const line of formatDnsRecords(appeared)) {
+                    emit(`  ${line}`);
+                }
+            }
+            const outcome = verdict(receipt);
+            if (outcome) {
+                return finish(outcome, receipt, polls);
+            }
+        }
+        const remaining = deadline - now();
+        if (remaining <= 0) {
+            return finish("timeout", receipt, polls);
+        }
+        await sleep(Math.min(intervalMs, remaining));
+    }
+}
+function verdict(receipt) {
+    const state = customDomainState(receipt);
+    if (state === "ready") {
+        return "ready";
+    }
+    return isCustomDomainFailure(state) ? "failed" : undefined;
+}
+function recordKey(record) {
+    return `${record.type}|${record.name}|${record.value}`;
+}
+function errorMessage(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+function defaultSleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/** `1:05` for 65 seconds. */
+function formatClock(ms) {
+    const total = Math.max(0, Math.floor(ms / 1000));
+    return `${Math.floor(total / 60)}:${String(total % 60).padStart(2, "0")}`;
+}
+/** `15s`, `50s`, `30m`. */
+export function formatDuration(ms) {
+    const seconds = Math.round(ms / 1000);
+    return seconds >= 120 && seconds % 60 === 0 ? `${seconds / 60}m` : `${seconds}s`;
+}
+//# sourceMappingURL=custom-domain.js.map

package/dist/custom-domain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-domain.js","sourceRoot":"","sources":["../src/custom-domain.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AAEH,6DAA6D;AAC7D,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAExC,wGAAwG;AACxG,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC;AAErC,qFAAqF;AACrF,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAE9C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEvC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;AAE/D,4FAA4F;AAC5F,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAEjC,iFAAiF;AACjF,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAE9B;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,KAAa,EACb,IAAI,GAAG,QAAQ;AACf,qFAAqF;AACrF,WAA0B,QAAQ;IAElC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAE3D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,kFAAkF;YACvF,kBAAkB,KAAK,CAAC,IAAI,EAAE,MAAM,QAAQ,CAAC,CAAC,CAAC,qBAAqB,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACzF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,qCAAqC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,KAAK,KAAK,CAAC,IAAI,EAAE,sEAAsE;YAC5F,iBAAiB,CACpB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,kEAAkE,IAAI,KAAK;YAChF,qEAAqE,CACxE,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,IAAI,GAAG,QAAQ;IAC5D,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,qCAAqC,iBAAiB,UAAU,IAAI,KAAK,CAAC,CAAC;IACpG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAA4B,EAAE,IAAY,EAAE,IAAY;IACjG,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,0CAA0C,IAAI,OAAO,IAAI,qCAAqC;YAC5F,mDAAmD,CACtD,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAA4B,EAAE,IAAY,EAAE,QAAQ,GAAG,QAAQ;IACnG,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;IACzC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,UAAU,QAAQ,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAA4B;IAC5D,OAAO,OAAO,CAAC,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,SAAS,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAyB;IAC7D,OAAO,KAAK,KAAK,SAAS,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,yBAAyB,CAAC,KAAyB;IACjE,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,oBAAoB;YACvB,OAAO,sCAAsC,CAAC;QAChD,KAAK,cAAc;YACjB,OAAO,+DAA+D,CAAC;QACzE,KAAK,kBAAkB;YACrB,OAAO,gDAAgD,CAAC;QAC1D,KAAK,OAAO;YACV,OAAO,iCAAiC,CAAC;QAC3C,KAAK,OAAO;YACV,OAAO,kCAAkC,CAAC;QAC5C,KAAK,SAAS;YACZ,OAAO,yBAAyB,CAAC;QACnC,KAAK,SAAS;YACZ,OAAO,0BAA0B,CAAC;QACpC,KAAK,SAAS;YACZ,OAAO,0CAA0C,CAAC;QACpD;YACE,OAAO,gDAAgD,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,qBAAqB,CAAC,OAA4B;IAChE,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,OAAO,CAAC,aAAa,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACxD,OAAO,GAAG,KAAK,IAAI,SAAS,KAAK,yBAAyB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACpG,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,gBAAgB,CAAC,OAAsC;IACrE,MAAM,IAAI,GAAG;QACX,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC;QACpC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YACzB,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACzB,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACzB,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;SAC7B,CAAC;KACH,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAE7F,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CACtB,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,CAC7G,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,2FAA2F,CAAC;IAC1G,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,KAAK,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/C,OAAO;QACL,GAAG,KAAK,GAAG;QACX,OAAO,IAAI,WAAW,QAAQ,+BAA+B,IAAI,4BAA4B,QAAQ,IAAI;KAC1G,CAAC;AACJ,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,eAAe,CAAC,OAA4B;IAC1D,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,EAAE,OAAO,IAAI,EAAE,CAAC;IACrD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAG;QACZ,0CAA0C;QAC1C,EAAE;QACF,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;QACvD,EAAE;KACH,CAAC;IAEF,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;IACzC,IAAI,IAAI,EAAE,CAAC;QACT,KAAK,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,8FAA8F;IAC9F,mGAAmG;IACnG,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACzC,IACE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,KAAK,aAAa,CAAC;QAC3D,KAAK,KAAK,OAAO;QACjB,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAC7B,CAAC;QACD,KAAK,CAAC,IAAI,CACR,EAAE,EACF,8FAA8F,EAC9F,qEAAqE,CACtE,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,OAAO,8BAA8B,IAAI,SAAS,CAAC;AACrD,CAAC;AA0BD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAA4B,EAC5B,OAAoB;IAEpB,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,cAAc,CAAC;IACxD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,YAAY,CAAC;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC;IACtB,MAAM,QAAQ,GAAG,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC;IAC7C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,MAAM,IAAI,GAAG,CAAC,IAAY,EAAQ,EAAE;QAClC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,GAAW,EAAE,CAAC,IAAI,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC;IAChE,MAAM,MAAM,GAAG,CAAC,OAAoB,EAAE,OAA4B,EAAE,KAAa,EAAc,EAAE,CAAC,CAAC;QACjG,OAAO;QACP,OAAO;QACP,KAAK;QACL,SAAS,EAAE,GAAG,EAAE,GAAG,OAAO;QAC1B,QAAQ;KACT,CAAC,CAAC;IAEH,IAAI,OAAO,GAAG,OAAO,CAAC;IACtB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,CAAC,kBAAkB,cAAc,CAAC,UAAU,CAAC,qBAAqB,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAE5G,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5E,IAAI,WAAW,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,SAAS,CAAC;QACR,IAAI,KAAsC,CAAC;QAC3C,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,2FAA2F;YAC3F,2EAA2E;YAC3E,QAAQ,IAAI,CAAC,CAAC;YACd,IAAI,QAAQ,IAAI,sBAAsB,EAAE,CAAC;gBACvC,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,IAAI,CAAC,GAAG,KAAK,EAAE,yBAAyB,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC5E,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACV,QAAQ,GAAG,CAAC,CAAC;YACb,KAAK,IAAI,CAAC,CAAC;YACX,OAAO,GAAG,KAAK,CAAC;YAEhB,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;YAC/C,IAAI,OAAO,KAAK,WAAW,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,GAAG,mBAAmB,KAAK,CAAC,EAAE,CAAC;gBAChF,IAAI,CAAC,GAAG,KAAK,EAAE,IAAI,OAAO,EAAE,CAAC,CAAC;gBAC9B,WAAW,GAAG,OAAO,CAAC;YACxB,CAAC;YAED,2FAA2F;YAC3F,qFAAqF;YACrF,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAC5D,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CACzC,CAAC;YACF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;oBAC9B,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC9B,CAAC;gBACD,IAAI,CAAC,GAAG,KAAK,EAAE,kBAAkB,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC;gBAC7E,KAAK,MAAM,IAAI,IAAI,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC9C,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;gBACpB,CAAC;YACH,CAAC;YAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YACjC,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,QAAQ,GAAG,GAAG,EAAE,CAAC;QACnC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACnB,OAAO,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,OAA4B;IAC3C,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACtB,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAED,SAAS,SAAS,CAAC,MAA0B;IAC3C,OAAO,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;AACzD,CAAC;AAED,SAAS,YAAY,CAAC,GAAY;IAChC,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,YAAY,CAAC,EAAU;IAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,6BAA6B;AAC7B,SAAS,WAAW,CAAC,EAAU;IAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IACjD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED,2BAA2B;AAC3B,MAAM,UAAU,cAAc,CAAC,EAAU;IACvC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IACtC,OAAO,OAAO,IAAI,GAAG,IAAI,OAAO,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,OAAO,GAAG,CAAC;AACnF,CAAC"}