authflow-cli 0.4.1 → 0.6.0

package/README.md

@@ -1,387 +1,108 @@
 # Authflow CLI
 
-License: Apache-2.0. See [LICENSE](LICENSE).
-
-Minimal TypeScript CLI for Authflow Rail onboarding. Wraps the public admin and Origin Protocol surfaces so a tenant can register a resource, connect Stripe, mint a local identity header, run the conformance probe, and scaffold the origin sidecar — without reading rail source.
-
-`authflow mcp` exposes the same operations as an MCP server, so a coding agent can onboard a server against the codebase it already has open. The tenant-facing walkthrough is [Onboard with your agent](../../docs/onboarding/agent.md). Command reference: [`authflow mcp`](#authflow-mcp).
-
-## Install
-
-The command is `authflow`. The npm package is [`authflow-cli`](https://www.npmjs.com/package/authflow-cli) (npm blocked the unscoped name `authflow`). No repo checkout is required:
-
-```bash
-npx -y -p authflow-cli authflow --help
-npx -y -p authflow-cli authflow init --slug video --price 900 --credits 12
-```
-
-Or install globally and drop the `npx` prefix:
-
-```bash
-npm install -g authflow-cli
-authflow --help
-```
-
-## From this repo (development)
-
-```bash
-cd sdk/cli
-npm install
-npm run build
-npx authflow --help
-```
+Browser-authorized creator management and an optional local MCP adapter. The primary entry point is the hosted management MCP at `https://staging.rails.authflow.ai/management/mcp`. It includes onboarding, resource management, integration guidance, and documentation. See [Onboard with your agent](../../docs/onboarding/agent.md).
 
-During development (no build step):
+## Verified workspace onboarding
 
-```bash
-npx tsx src/cli.ts --help
-npm run authflow -- --help
-```
-
-## Config
-
-| Env | Flag | Used by |
-| --- | --- | --- |
-| `AUTHFLOW_ISSUER` | `--issuer` | all HTTP commands |
-| `AUTHFLOW_ADMIN_API_KEY` | `--admin-key` | `init`, `register`, `connect`, `set-connected-account`, `set-origin`, `status`, `get`, `list`, `plan`, `rotate-origin-key` (mint with `authflow signup`) |
-| `AUTHFLOW_ORIGIN_API_KEY` | `--origin-key` | `mint-header`, `probe`, `set-origin` (for its probe) |
-| `AUTHFLOW_RESOURCE` / `AUTHFLOW_GATEWAY_URL` | `--gateway-url` / `--receipt` | curl hint on `mint-header` |
-
-Issuer is the Origin Protocol issuer origin, with no trailing slash: staging is `https://staging.rails.authflow.ai`, local is typically `https://localhost:7062`. For an already-registered resource it is the `issuer` field of the receipt. See [tenant quickstart §1](../../docs/onboarding/tenant-quickstart.md#environments-and-hostnames).
-
-## Commands
-
-### `authflow signup`
-
-Mints a per-tenant admin API key. This is how a creator gets `AUTHFLOW_ADMIN_API_KEY` without the rail operator handing them one.
+Install the pinned adapter and sign in. First-time authorization creates your personal workspace when you approve consent; no portal setup or admin key is required.
 
 ```bash
+npm install -g authflow-cli@0.6.0
 export AUTHFLOW_ISSUER=https://staging.rails.authflow.ai
-npx -y -p authflow-cli authflow signup --email you@example.com
-```
-
-The key (`afa_test_` on staging, `afa_live_` in production) is shown once and written to `.env.local` by default. It can only register and manage slugs created with that key. The operator bearer still exists as a super-admin.
-
-### `authflow init`
-
-The whole onboarding path in one command: register the resource, put the origin API key in a secret
-store, print the config to paste into your MCP server, and probe the origin if it is already up.
-
-```bash
-export AUTHFLOW_ISSUER=https://staging.rails.authflow.ai
-export AUTHFLOW_ADMIN_API_KEY=…
-
-authflow init --slug video --price 900 --credits 12
+authflow login
+authflow workspace list
+authflow resource create --file resource.json
+authflow plan --slug my-mcp --framework typescript
+authflow resource origin my-mcp --file origin.json
+authflow resource verify my-mcp
+authflow resource publish my-mcp
 ```
 
-Neither a Stripe account nor a deployed origin is required. Both are deferrable, in any order, and
-omitting either registers a **draft**: priced and registered, with a receipt you can build against,
-but not routable. That is the normal case — you rarely have a connected Stripe account or an origin
-URL before you have built anything.
-
-The receipt's `pending_requirements` lists what is still outstanding:
-
-| Requirement | Clear it with |
-| --- | --- |
-| `origin_base_uri` | `authflow set-origin --slug video --origin-url https://…` |
-| `connected_account_id` | `authflow connect --slug video` (hosted KYC) or `authflow set-connected-account --slug video --account acct_…` (you already have the id) |
-| `stripe_onboarding_complete` | finish Stripe's form, then `authflow connect --slug video` again |
-
-Re-running `init` against a slug this admin key already owns resumes it: `409 slug_owned_by_caller`
-is not a dead end. `--connected-account` and `--origin-url` then attach instead of failing. A slug
-owned by someone else still returns `slug_taken`.
-
-The resource goes live once the list is empty. Add `--connect` to `init` to get the Stripe
-onboarding link from the first command instead of running `connect` separately.
-
-Useful flags:
-
-| Flag | Default | Meaning |
-| --- | --- | --- |
-| `--integration <dotnet\|proxy>` | `dotnet` | Which origin config to print |
-| `--write-secrets <target>` | `user-secrets` | `user-secrets`, `env-file`, or `keyvault` |
-| `--secret-destination <value>` | — | Project dir, env-file path, or vault name |
-| `--connected-account <acct>` | — | Attach a Stripe account you already have |
-| `--connect` | — | Start Stripe onboarding and print the hosted link |
-| `--origin-url <url>` | — | Supply the origin now instead of later |
-| `--no-probe` | — | Skip the conformance probe |
-
-### `authflow connect`
-
-Starts or resumes Stripe Connect Standard onboarding and prints the hosted link the creator opens to
-complete KYC.
-
-```bash
-authflow connect --slug video
-authflow connect --slug video --wait   # poll until Stripe reports the account can take charges
-authflow connect --slug video --connected-account acct_…   # attach an account you already have
-```
-
-Account links are single-use and expire in minutes. Re-running is the expected way to get a fresh
-one: it resumes the same Stripe account rather than creating another, so retrying never leaves
-abandoned accounts behind. Run it again after the form is submitted to confirm `charges_enabled` and
-promote the resource.
-
-`--connected-account` skips hosted KYC and is the same PUT as `authflow set-connected-account`.
-
-### `authflow set-connected-account`
-
-Attach a Stripe Standard account id the platform already has. This is the CLI twin of
-`authflow_set_connected_account` and of `PUT /admin/resources/{slug}/connected-account`. Use it when
-`connect` would otherwise start a new hosted onboarding you do not need.
-
-```bash
-authflow set-connected-account --slug video --account acct_…
-```
-
-### `authflow set-origin`
-
-Points a draft at its origin, promoting it to live if nothing else is pending, then runs the
-conformance probe.
-
-```bash
-authflow set-origin --slug video --origin-url https://video-xyz.azurecontainerapps.io
-```
-
-Pass the base URI without `/mcp`; the gateway appends it.
-
-The probe runs automatically because this is the moment the resource starts accepting traffic, and a
-closing "remember to verify" is a step that gets skipped. It needs `AUTHFLOW_ORIGIN_API_KEY` (or
-`--origin-key`) — the admin key cannot stand in, because the probe authenticates as the origin. If
-the key is not available the command says so and completes; `--no-probe` skips it deliberately.
-
-The command also prints the client MCP config for the gateway URL. Use it verbatim: an MCP client
-pointed at the origin's own hostname gets `403 invalid_origin_identity`, which is the origin
-correctly refusing an unsigned request, not an auth bug.
-
-### `authflow status`
-
-Where onboarding actually got to, and the command that clears each remaining step.
-
-```bash
-authflow status --slug video
-```
-
-```
-resource: video
-status:   draft
-gateway:  https://staging.rails.authflow.ai/video/mcp
-
-  [x] resource registered
-  [ ] origin URI set
-      no origin — the gateway has nowhere to forward to
-      next: authflow set-origin --slug video --origin-url https://your-origin.example
-  [ ] Stripe connected
-      no connected account — nothing can be charged
-      next: authflow connect --slug video  (or authflow set-connected-account --slug video --account acct_…)
-  [ ] Stripe onboarding complete
-      no connected account — attach one before Stripe can confirm charges
-      next: authflow connect --slug video  (or authflow set-connected-account --slug video --account acct_…)
-```
-
-"Stripe onboarding complete" is ticked only when this resource has an account attached **and** Stripe
-has not listed `stripe_onboarding_complete` as pending. No account is not "charges enabled."
-
-Use it to resume an onboarding whose earlier steps may or may not have finished — a deploy that got
-backgrounded, a terminal that was closed. `doctor` answers "is the rail up", which is a different
-question: the rail can be perfectly healthy while a resource sits half-configured and rejects every
-request. Exit code is non-zero until the resource can take paid traffic, so it works as a deploy
-gate. `--json` emits the report for scripting.
-
-### `authflow plan`
-
-Prints the same framework-specific origin integration plan as `authflow_integration_plan`.
-
-```bash
-authflow plan --slug video --framework dotnet
-```
-
-`--framework` is one of `dotnet`, `typescript`, `python`, or `proxy`.
-
-### `authflow get` / `authflow list`
-
-```bash
-authflow get --slug video          # one receipt, plus the client MCP config
-authflow list                      # every resource this admin key owns
-```
-
-`list` is the recovery path for a forgotten slug, which `get` cannot be — it needs the slug you are
-trying to remember. If a registration reported the slug was taken and it is not in `list`, another
-tenant owns it and you need a different name; slugs are global because they are the gateway path
-segment.
-
-### `authflow rotate-origin-key`
-
-```bash
-authflow rotate-origin-key --slug video --write-secrets user-secrets
-```
-
-The recovery path for a lost origin API key, which is shown only once. The previous key stops working
-the moment the command returns, so update the origin's secret store immediately or its usage reports
-and probes will start failing.
-
-### `authflow doctor`
-
-Preflights a rail deployment before you spend time debugging your own origin.
-
-```bash
-authflow doctor --issuer https://staging.rails.authflow.ai --slug video
-```
-
-Checks that the issuer is reachable, that the Origin Protocol keys document is served and
-self-consistent (issuer byte-match, protocol version, a usable Ed25519 key, no private key
-material), and — with `--slug` — that the resource's PRM document resolves and the gateway answers
-an unauthenticated connect with a `401` carrying `resource_metadata`.
-
-Run this first when anything looks broken. It separates the two failures that are indistinguishable
-from the outside: a hostname that is not bound to the rail returns `404` on every path including
-`/healthz`, which reads exactly like a broken endpoint. Exit code is non-zero on any failure.
-
-`--client cursor|claude|chatgpt|all` additionally replays that MCP client's real OAuth registration
-against the authorization server (the failure that presents as "this server does not work in
-Cursor"). `--dry-run` is discovery only and does not POST DCR. Live DCR registrations are stamped
-`authflow-cli doctor-connect` so a cleanup sweep can reclaim them.
-
-A `400` from the rail's DCR endpoint is the interesting result: paste `error=` and
-`error_description=` verbatim into a rail bug. Do not work around it client-side.
-
-```bash
-authflow doctor --issuer https://staging.rails.authflow.ai --slug video --client cursor
-authflow doctor --client all --dry-run
-```
-
-### `authflow register`
-
-```bash
-export AUTHFLOW_ISSUER=https://staging.rails.authflow.ai
-export AUTHFLOW_ADMIN_API_KEY=…
-authflow register --file resource.json --out receipt.json
-```
-
-`resource.json` uses the same snake_case fields as `POST /admin/resources` (see [tenant quickstart](../../docs/onboarding/tenant-quickstart.md) §3):
+`resource.json` for free authenticated access:
 
 ```json
-{
-  "slug": "video",
-  "origin_base_uri": "https://video-xyz.azurecontainerapps.io",
-  "display_name": "Snyder Video",
-  "connected_account_id": "acct_…",
-  "currency": "usd",
-  "price_amount_minor": 900,
-  "credits_per_period": 12,
-  "price_version": 1
-}
+{ "slug": "my-mcp", "display_name": "My MCP", "access_mode": "free" }
 ```
 
-`origin_base_uri` may be `null` or omitted, which registers a draft — see `authflow set-origin`.
+`origin.json`:
 
-Writes the registration receipt to `--out` (default `receipt.json`). The one-time `origin_api_key` is
-**not** written to that file: receipts get committed, pasted into issues, and handed to agents, and
-the key is a live bearer credential for the usage endpoint. It is printed to the terminal instead, so
-nothing is lost. `--keep-secret-in-receipt` restores the old behaviour if you really need it.
-
-Better still, have the CLI store it for you:
-
-```bash
-authflow register --file resource.json --write-secrets user-secrets --secret-destination ./src/MyMcpServer
+```json
+{ "origin_base_uri": "https://my-origin.example.com" }
 ```
 
-`env-file` writes `.env.local` (and adds it to `.gitignore`); `keyvault` calls
-`az keyvault secret set` and needs `--secret-destination <vault>`.
+Free and gateway-metered origins verify signed identity with public keys. They do not require an origin credential. Every resource starts as a draft and requires conformance verification and explicit publication.
 
-Lost the key? `authflow rotate-origin-key --slug <slug>`.
+For paid access, include `access_mode: "paid"`, `currency: "usd"`, `price_amount_minor: 900`, and `credits_per_period: 12`. Gateway metering is the default, with `metering_default_units: 1` and `tool_units: {}`. Configure per-tool costs by supplying a replacement map such as `{ "preview": 0, "generate": 3 }`. Use `metering_mode: "origin_reported"` when your origin must determine completion or report variable costs. Never charge one call through both mechanisms.
 
-Registration also prints the client MCP config and, for a draft, the remaining steps — a registered
-resource is not yet a reachable one, and from the outside the two are indistinguishable.
+Connect Stripe with `authflow stripe onboard` or `authflow stripe connect-existing`. These return authenticated Authflow links for the owner's browser. Then refresh status; returning from Stripe alone does not prove readiness. Authflow charges a 9% fee on paid sales; monthly platform plans are not implemented.
 
-### `authflow mint-header`
+## Creator commands
 
-Dev/staging only (`OriginProtocol:EnableDevEndpoints`). Mints a signed `X-Authflow-Identity` without OAuth.
-
-```bash
-export AUTHFLOW_ORIGIN_API_KEY=afo_test_…
-authflow mint-header --tier standard --ttl 90 --grant-credits 3 --receipt receipt.json
-```
+| Command | Purpose |
+| --- | --- |
+| `login [--workspace <id>] [--no-browser]` | Browser authorization with PKCE and workspace consent |
+| `logout` | Revoke authorization and remove the OS-stored credential |
+| `logout --local-only` | Clear this device only |
+| `workspace list`, `workspace overview` | Workspace and recent activity |
+| `resource list`, `resource get <slug>` | Receipts, status, and requirements |
+| `resource create --file <json>` | Create a draft; keys are never printed |
+| `resource update <slug> --file <json>` | Patch supplied name, offer, and metering fields |
+| `resource origin <slug> --file <json>` | Set the private origin base URL without `/mcp` |
+| `resource domain <slug> --file <json>` | Set `public_host` and `public_path` before first publication |
+| `resource domain-refresh <slug>` | Refresh DNS/certificate readiness |
+| `resource verify <slug>` | Probe the exact current configuration |
+| `resource publish <slug>`, `resource disable <slug>` | Explicitly change traffic availability |
+| `resource rotate-key <slug> --write-secrets <target> --secret-destination <value>` | Deliver an origin-reported usage credential |
+| `stripe status`, `stripe onboard`, `stripe connect-existing` | Readiness and authenticated owner actions |
+| `plan --slug <slug> --framework <framework>` | Resource-specific plan from Rail's canonical templates |
+| `mcp` | Local management MCP with the protected CLI login |
 
-Prints the header and, when a gateway URL is known, a ready-to-paste `curl` against it.
+Management commands accept `--issuer`; workspace operations also accept `--workspace`. Omitted PATCH fields preserve values. A supplied `tool_units` map replaces the old map. Actual offer/access/metering changes invalidate verification and publication; re-verify and explicitly publish. A name-only update preserves the policy.
 
-### `authflow probe`
+## Direct secret delivery
 
-Asks the rail to probe the registered origin with valid and deliberately broken identity headers.
+Paid origin-reported resources need a credential for the usage endpoint. Choose an explicit destination before issuance:
 
 ```bash
-authflow probe
-authflow probe --slug video
+authflow resource rotate-key my-mcp --write-secrets keyvault --secret-destination my-vault
+authflow resource rotate-key my-mcp --write-secrets user-secrets --secret-destination ./MyOrigin.csproj
+authflow resource rotate-key my-mcp --write-secrets env-file --secret-destination ./.env.local
 ```
 
-The origin API key is bound to one resource, so `--slug` is optional and ignored. It exists so a
-documented `authflow probe --slug …` does not fail. Renders a pass/fail table. Exit code is
-non-zero when any check fails or the origin is unreachable.
-
-### `authflow scaffold`
-
-```bash
-authflow scaffold --receipt receipt.json --upstream http://upstream:3000
-```
+Use only the command for your destination. Key Vault secret names include the resource identity, avoiding collisions across workspaces/resources/environments. Destination preflight happens before rotation. Free/gateway resources return `not_required` without rotating. For origin-reported creation, the same destination flags can store the one-time key directly.
 
-Writes:
+Key values stay out of normal output and errors. Secret writers avoid process arguments containing values where supported. Env files are plaintext development storage: exclude them from source control. Azure delivery uses the signed-in Azure CLI identity. A bounded metadata check confirms destination reachability and catches known authentication/network failures before rotation. It cannot prove `secrets/set` permission without writing: identities with write-only permission remain supported, and actual delivery determines write access.
 
-- `.env` — `AUTHFLOW_ISSUER`, `AUTHFLOW_RESOURCE`, `AUTHFLOW_ORIGIN_API_KEY`, `AUTHFLOW_UPSTREAM_BASE_URI`
-- `docker-compose.authflow.yml` — `authflow-origin-proxy` in front of an upstream placeholder
+`origin_key_stored_at` confirms storage only, and `deployment_updated: false` means application bindings and deployment still need work. If delivery fails after issuance, the old key may already be revoked. Repair access, inspect state, and explicitly rotate again; the command never retries that mutation silently.
 
-See [origin-proxy.md](../../docs/onboarding/origin-proxy.md) for the forwarded-header contract and the
-nonce-cache options.
+## Authflow MCP
 
-### `authflow mcp`
-
-Runs the onboarding operations as an MCP server on stdio, so a coding agent can do the onboarding
-instead of a human running commands. The agent already has the creator's codebase; what it lacks is
-a way to talk to the rail. This supplies exactly that, and nothing more — the server never reads or
-writes source files. It hands back an integration plan and the agent applies it.
-
-Add it to Cursor or Claude Desktop:
+For a remote client, add `https://staging.rails.authflow.ai/management/mcp` and complete browser consent. For a local adapter, run `authflow login` first, then configure:
 
 ```json
 {
   "mcpServers": {
     "authflow": {
       "command": "npx",
-      "args": ["-y", "-p", "authflow-cli", "authflow", "mcp"],
-      "env": {
-        "AUTHFLOW_ISSUER": "https://staging.rails.authflow.ai",
-        "AUTHFLOW_ADMIN_API_KEY": "…"
-      }
+      "args": ["-y", "-p", "authflow-cli@0.6.0", "authflow", "mcp"],
+      "env": { "AUTHFLOW_ISSUER": "https://staging.rails.authflow.ai" }
     }
   }
 }
 ```
 
-Tools:
+Both expose workspace overview/rename, resource lifecycle, usage, earnings, Stripe actions, integration plans, and docs search/read. Tools require their authorized workspace and scope; read-only consent cannot write. Personal identity/security and consumer billing are outside this creator tool surface. Tool results never include origin keys or OAuth credentials.
 
-| Tool | Does |
-| --- | --- |
-| `authflow_signup` | Mint a per-tenant admin API key (no existing credential) |
-| `authflow_doctor` | Preflight the rail; distinguishes a bad hostname from an outage |
-| `authflow_register_resource` | Register and price a resource; optionally store the key in a secret store |
-| `authflow_get_resource` | Current receipt, `status`, and `pending_requirements` |
-| `authflow_list_resources` | Every resource this key owns — how an agent recovers an unknown slug |
-| `authflow_status` | Per-step readiness with the command that clears each one; use it to resume |
-| `authflow_integration_plan` | Config, snippets, verification steps, and invariants for `dotnet`, `typescript`, `python`, or `proxy` |
-| `authflow_start_stripe_connect` | Hosted Stripe onboarding link; resumable |
-| `authflow_set_connected_account` | Attach an existing `acct_…` |
-| `authflow_set_origin` | Supply the origin and promote to live |
-| `authflow_probe` | Conformance probe against the origin |
-| `authflow_mint_test_header` | Signed identity header for local verifier testing |
-| `authflow_rotate_origin_key` | Rotate the origin API key (invalidates the old one immediately) |
+Integration templates are versioned in `rail/docs/onboarding/integration-plans.json`. Rail's resource-specific endpoint, hosted/local MCP, and modern `plan` consume this source; generic documentation is generated from it.
+
+## Runtime and verification
 
-Every tool takes `issuer` and `admin_key` optionally, falling back to the environment, so credentials
-stay in the MCP client config rather than in the conversation. `write_secrets` is available on both
-tools that issue a key; prefer it, because a key returned in a tool result is a credential in a chat
-transcript.
+Credentials use Windows Credential Manager, macOS Keychain, or an available unlocked Linux secret service. There is no plaintext login fallback. Browser login uses a local callback. Refresh is serialized across processes; writes are not automatically retried. Read resource/Stripe state after interruptions.
 
-Every receipt a tool returns carries `client_mcp_config` — the config for reaching the resource
-through the gateway. Hand the user that, never the origin's hostname, which rejects unsigned requests
-by design.
+Staging issuer: `https://staging.rails.authflow.ai`. Local Compose defaults to `http://127.0.0.1:8080` (respect a configured `RAIL_PORT`). Production Rail provisioning is separate from this release.
 
-Authentication is a per-tenant `afa_` admin API key from `authflow signup` (or `authflow_signup`).
-The operator bearer still works as a super-admin. Per-creator OAuth is not required for onboarding.
+Origin diagnostics such as `doctor`, `probe`, `mint-header`, and `scaffold` remain available via command help for operators. They are not prerequisites for normal creator onboarding. Use `resource verify` with your scoped login; never ask a new creator for a tenant admin credential.
+
+Gateway metering cannot infer all failures after a streamed response begins. Use origin-reported debit/compensation when provider completion determines the charge. The [tenant quickstart](../../docs/onboarding/tenant-quickstart.md) and [Origin Protocol v1](../../docs/origin-protocol/v1.md) define the integration contract.
+
+License: Apache-2.0. See [LICENSE](LICENSE).

package/dist/checks.d.ts

@@ -0,0 +1,30 @@
+/**
+ * What every doctor-style check produces, and the one network helper they share.
+ *
+ * These lived in doctor.ts. They moved here so doctor.ts can call the tenant-host checks without
+ * those checks importing doctor.ts back: that import cycle was the only reason they could not be
+ * their own module. doctor.ts re-exports all three, so existing imports keep working.
+ */
+export type DoctorCheck = {
+    name: string;
+    pass: boolean;
+    skipped?: boolean;
+    detail: string;
+    /** What to do about it. Empty when the check passed. */
+    remedy?: string;
+};
+export type FetchOutcome = {
+    ok: boolean;
+    status?: number;
+    body?: string;
+    headers?: Headers;
+    location?: string;
+    error?: string;
+};
+/**
+ * An MCP `initialize` with no credentials: what a client sends first, and what the paywall has to
+ * answer with a 401. Shared so the gateway check and the tenant-host check cannot drift apart.
+ */
+export declare function unauthenticatedInitialize(): RequestInit;
+/** Network failures are a diagnosis here, not an exception — every one of them is a real finding. */
+export declare function fetchOrNull(url: string, init?: RequestInit): Promise<FetchOutcome>;

package/dist/checks.js

@@ -0,0 +1,36 @@
+/**
+ * What every doctor-style check produces, and the one network helper they share.
+ *
+ * These lived in doctor.ts. They moved here so doctor.ts can call the tenant-host checks without
+ * those checks importing doctor.ts back: that import cycle was the only reason they could not be
+ * their own module. doctor.ts re-exports all three, so existing imports keep working.
+ */
+const timeoutMs = 15_000;
+/**
+ * An MCP `initialize` with no credentials: what a client sends first, and what the paywall has to
+ * answer with a 401. Shared so the gateway check and the tenant-host check cannot drift apart.
+ */
+export function unauthenticatedInitialize() {
+    return {
+        method: "POST",
+        headers: { "Content-Type": "application/json", Accept: "application/json, text/event-stream" },
+        body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "initialize", params: {} }),
+    };
+}
+/** Network failures are a diagnosis here, not an exception — every one of them is a real finding. */
+export async function fetchOrNull(url, init = {}) {
+    try {
+        const response = await fetch(url, { ...init, signal: AbortSignal.timeout(timeoutMs) });
+        return {
+            ok: true,
+            status: response.status,
+            body: await response.text(),
+            headers: response.headers,
+            location: response.headers.get("location") ?? undefined,
+        };
+    }
+    catch (err) {
+        return { ok: false, error: err instanceof Error ? err.message : String(err) };
+    }
+}
+//# sourceMappingURL=checks.js.map

package/dist/checks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checks.js","sourceRoot":"","sources":["../src/checks.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAoBH,MAAM,SAAS,GAAG,MAAM,CAAC;AAEzB;;;GAGG;AACH,MAAM,UAAU,yBAAyB;IACvC,OAAO;QACL,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,qCAAqC,EAAE;QAC9F,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;KAClF,CAAC;AACJ,CAAC;AAED,qGAAqG;AACrG,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,OAAoB,EAAE;IACnE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACvF,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,IAAI,EAAE,MAAM,QAAQ,CAAC,IAAI,EAAE;YAC3B,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,SAAS;SACxD,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IAChF,CAAC;AACH,CAAC"}

package/dist/client-conformance.d.ts

@@ -12,6 +12,7 @@
  */
 import { type ClientId } from "./client-fixtures.js";
 import { type DoctorReport } from "./doctor.js";
+import type { HostProbes } from "./tenant-host.js";
 export type ClientConformanceOptions = {
     issuer: string;
     clients: ClientId[];
@@ -30,5 +31,8 @@ export declare function runDoctorAndConnect(issuer: string, options?: {
     slug?: string;
     client?: string;
     dryRun?: boolean;
-}): Promise<DoctorReport>;
+    adminKey?: string;
+    /** A tenant's own hostname to verify end to end; see `DoctorOptions.host`. */
+    host?: string;
+} & HostProbes): Promise<DoctorReport>;
 export declare function runClientConformance(options: ClientConformanceOptions): Promise<DoctorReport>;

package/dist/client-conformance.js

@@ -31,7 +31,13 @@ const chatgptCimdFetchAdvisoryDetail = `Advisory — not proven. ChatGPT's CIMD
 const dcr400Footer = "A DCR 400 is the interesting result. Paste error= and error_description= verbatim into a rail " +
     "bug; do not work around it client-side.";
 export async function runDoctorAndConnect(issuer, options = {}) {
-    const report = await runDoctor(issuer, options.slug);
+    const report = await runDoctor(issuer, options.slug, {
+        adminKey: options.adminKey,
+        host: options.host,
+        dns: options.dns,
+        tls: options.tls,
+        now: options.now,
+    });
     if (!options.client) {
         return report;
     }
@@ -48,6 +54,8 @@ export async function runDoctorAndConnect(issuer, options = {}) {
     const google = await checkGoogleRedirectUri(report.issuer, {
         slug: options.slug,
         dryRun: options.dryRun,
+        // Read the resource identifier from where the receipt says the PRM lives.
+        prmUrl: report.endpoints?.prmUrl,
     });
     const checks = [...report.checks, ...extra.checks, ...google];
     return {

package/dist/client-conformance.js.map

@@ -1 +1 @@
-{"version":3,"file":"client-conformance.js","sourceRoot":"","sources":["../src/client-conformance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,GAGhB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,qBAAqB,EACrB,WAAW,EACX,SAAS,GAGV,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAkB9D,MAAM,YAAY,GAAG,yCAAyC,CAAC;AAE/D,MAAM,cAAc,GAClB,gGAAgG;IAChG,4FAA4F;IAC5F,oDAAoD,CAAC;AAEvD,MAAM,uBAAuB,GAC3B,+FAA+F;IAC/F,6FAA6F;IAC7F,wFAAwF;IACxF,uBAAuB,CAAC;AAE1B,MAAM,uBAAuB,GAC3B,gGAAgG;IAChG,+FAA+F;IAC/F,mDAAmD,CAAC;AAEtD,MAAM,8BAA8B,GAClC,sDAAsD,yBAAyB,gBAAgB;IAC/F,iDAAiD,2BAA2B,mBAAmB;IAC/F,4FAA4F;IAC5F,mDAAmD,CAAC;AAEtD,MAAM,YAAY,GAChB,gGAAgG;IAChG,yCAAyC,CAAC;AAE5C,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,UAAgE,EAAE;IAElE,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACpB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC;IAC3E,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACjC,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IACxD,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC;QACvC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,OAAO;QACP,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,MAAM,CAAC,MAAM,EAAE;QACzD,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC;IAC9D,OAAO;QACL,GAAG,MAAM;QACT,OAAO;QACP,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,MAAM;QACN,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAiC;IAEjC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAChC,MAAM,MAAM,GAAkB,EAAE,CAAC;IAEjC,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5B,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACvB,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM;YACN,IAAI,EAAE,KAAK;YACX,MAAM;SACP,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAE1C,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEvC,IAAI,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;QAC5D,MAAM,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,QAAQ,GAAG,2BAA2B,CAAC,IAAI,EAAE,QAAQ,CAAC,qBAAqB,CAAC,CAAC;QACnF,IAAI,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,QAAQ,EAAE,CAAC;YACvC,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;gBACxC,MAAM,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,QAAQ,EAAE,CAAC;YACxC,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;gBACzC,MAAM,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,CAAC,IAAI,CAAC,MAAM,qBAAqB,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED,OAAO;QACL,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM;QACN,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACjC,MAAM;KACP,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,IAAY;IAEZ,MAAM,GAAG,GAAG,GAAG,IAAI,GAAG,YAAY,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IAExC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnC,OAAO;YACL,KAAK,EAAE;gBACL,IAAI,EAAE,+BAA+B;gBACrC,IAAI,EAAE,KAAK;gBACX,MAAM,EAAE,GAAG,GAAG,0BAA0B,QAAQ,CAAC,KAAK,EAAE;gBACxD,MAAM,EAAE,mFAAmF;aAC5F;SACF,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO;YACL,KAAK,EAAE;gBACL,IAAI,EAAE,+BAA+B;gBACrC,IAAI,EAAE,KAAK;gBACX,MAAM,EAAE,GAAG,GAAG,aAAa,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,KAAK,iBAAiB;gBAC7E,MAAM,EAAE,wEAAwE;aACjF;SACF,CAAC;IACJ,CAAC;IAED,IAAI,QAAqC,CAAC;IAC1C,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAgC,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,KAAK,EAAE;gBACL,IAAI,EAAE,+BAA+B;gBACrC,IAAI,EAAE,KAAK;gBACX,MAAM,EAAE,GAAG,GAAG,uBAAuB;gBACrC,MAAM,EAAE,6BAA6B;aACtC;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,EAAE;YACL,IAAI,EAAE,+BAA+B;YACrC,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,GAAG,GAAG,gBAAgB;SAC/B;QACD,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,QAAqC;IAC1D,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,gCAAgC,CAAC,CAAC;IACzE,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,mDAAmD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;SAClF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,wCAAwC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,8BAA8B;QAChG,MAAM,EAAE,6DAA6D;KACtE,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,QAAqC;IAC5D,IAAI,QAAQ,CAAC,8CAA8C,KAAK,IAAI,EAAE,CAAC;QACrE,OAAO;YACL,IAAI,EAAE,wBAAwB;YAC9B,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,yDAAyD;SAClE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,wBAAwB;QAC9B,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,qDAAqD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,8CAA8C,CAAC,kBAAkB;QACtJ,MAAM,EACJ,yFAAyF;YACzF,6FAA6F;YAC7F,uFAAuF;KAC1F,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,QAAqC,EACrC,MAA4B;IAE5B,MAAM,QAAQ,GAAG,CAAC,QAAQ,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/D,MAAM,IAAI,GAAG,GAAG,MAAM,yBAAyB,CAAC;IAChD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO;YACL,IAAI;YACJ,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,4BAA4B,QAAQ,GAAG;SAChD,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GACV,MAAM,KAAK,QAAQ;QACjB,CAAC,CAAC,0HAA0H;QAC5H,CAAC,CAAC,kLAAkL,CAAC;IAEzL,OAAO;QACL,IAAI;QACJ,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,2CAA2C;QACnD,MAAM;KACP,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,QAAqC;IAC5D,MAAM,UAAU,GAAG,QAAQ,CAAC,qCAAqC,KAAK,IAAI,CAAC;IAC3E,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,qCAAqC,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEzC,MAAM,aAAa,GAAgB,UAAU;QAC3C,CAAC,CAAC;YACE,IAAI,EAAE,4BAA4B;YAClC,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,gDAAgD;SACzD;QACH,CAAC,CAAC;YACE,IAAI,EAAE,4BAA4B;YAClC,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,4CAA4C,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,qCAAqC,CAAC,kBAAkB;YACpI,MAAM,EAAE,cAAc;SACvB,CAAC;IAEN,MAAM,UAAU,GAAgB,OAAO;QACrC,CAAC,CAAC;YACE,IAAI,EAAE,kCAAkC;YACxC,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,0DAA0D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;SACzF;QACH,CAAC,CAAC;YACE,IAAI,EAAE,kCAAkC;YACxC,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,6CAA6C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,gCAAgC;YACvG,MAAM,EAAE,cAAc;SACvB,CAAC;IAEN,MAAM,aAAa,GAAgB;QACjC,IAAI,EAAE,iCAAiC;QACvC,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,uBAAuB;QAC/B,MAAM,EAAE,uBAAuB;KAChC,CAAC;IAEF,OAAO,CAAC,aAAa,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAqC;IAC7D,MAAM,UAAU,GAAG,QAAQ,CAAC,qCAAqC,KAAK,IAAI,CAAC;IAE3E,MAAM,aAAa,GAAgB,UAAU;QAC3C,CAAC,CAAC;YACE,IAAI,EAAE,6BAA6B;YACnC,IAAI,EAAE,IAAI;YACV,MAAM,EACJ,sFAAsF;gBACtF,oBAAoB,yBAAyB,iCAAiC;SACjF;QACH,CAAC,CAAC;YACE,IAAI,EAAE,6BAA6B;YACnC,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,4CAA4C,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,qCAAqC,CAAC,kBAAkB;YACpI,MAAM,EACJ,2FAA2F;gBAC3F,qGAAqG;SACxG,CAAC;IAEN,MAAM,aAAa,GAAgB;QACjC,IAAI,EAAE,kCAAkC;QACxC,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,8BAA8B;QACtC,MAAM,EAAE,uBAAuB;KAChC,CAAC;IAEF,OAAO,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;AACxC,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,QAAgB,EAChB,MAAgB,EAChB,OAAmB;IAEnB,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;IAC3C,MAAM,IAAI,GAAG;QACX,GAAG,OAAO,CAAC,OAAO;QAClB,WAAW,EAAE,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;KACjD,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE;QAC3C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnC,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,SAAS;YACvB,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,QAAQ,QAAQ,0BAA0B,QAAQ,CAAC,KAAK,EAAE;YAClE,MAAM,EAAE,gFAAgF;SACzF,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,SAAS;YACvB,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,YAAY,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;YACnD,MAAM,EAAE,YAAY;SACrB,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,SAAS;YACvB,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,QAAQ,QAAQ,aAAa,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,KAAK,mBAAmB,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;YACxH,MAAM,EAAE,4EAA4E;SACrF,CAAC;IACJ,CAAC;IAED,IAAI,MAAwD,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAqD,CAAC;IAC/F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,SAAS;YACvB,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,6CAA6C;YACrD,MAAM,EAAE,6BAA6B;SACtC,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAChE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,SAAS;YACvB,IAAI,EAAE,KAAK;YACX,MAAM,EACJ,+CAA+C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBACrE,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG;YAC9E,MAAM,EACJ,sFAAsF;gBACtF,sCAAsC;SACzC,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;IACpF,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,SAAS;QACvB,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,sBAAsB,QAAQ,wEAAwE;KAC/G,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAc,EAAE,MAAe;IAC1D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,cAAc,CAAC,GAAuB;IAC7C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,yCAAyC,CAAC;IACnD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAqD,CAAC;QACjF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QACvE,MAAM,WAAW,GACf,IAAI,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QACnF,OAAO,SAAS,KAAK,sBAAsB,WAAW,EAAE,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B,CAAC,IAAY,EAAE,KAAyB;IAC1E,MAAM,QAAQ,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7C,CAAC"}
+{"version":3,"file":"client-conformance.js","sourceRoot":"","sources":["../src/client-conformance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,GAGhB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,qBAAqB,EACrB,WAAW,EACX,SAAS,GAGV,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAmB9D,MAAM,YAAY,GAAG,yCAAyC,CAAC;AAE/D,MAAM,cAAc,GAClB,gGAAgG;IAChG,4FAA4F;IAC5F,oDAAoD,CAAC;AAEvD,MAAM,uBAAuB,GAC3B,+FAA+F;IAC/F,6FAA6F;IAC7F,wFAAwF;IACxF,uBAAuB,CAAC;AAE1B,MAAM,uBAAuB,GAC3B,gGAAgG;IAChG,+FAA+F;IAC/F,mDAAmD,CAAC;AAEtD,MAAM,8BAA8B,GAClC,sDAAsD,yBAAyB,gBAAgB;IAC/F,iDAAiD,2BAA2B,mBAAmB;IAC/F,4FAA4F;IAC5F,mDAAmD,CAAC;AAEtD,MAAM,YAAY,GAChB,gGAAgG;IAChG,yCAAyC,CAAC;AAE5C,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,UAOiB,EAAE;IAEnB,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE;QACnD,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACpB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC;IAC3E,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACjC,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IACxD,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC;QACvC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,OAAO;QACP,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,MAAM,CAAC,MAAM,EAAE;QACzD,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,0EAA0E;QAC1E,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM;KACjC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC;IAC9D,OAAO;QACL,GAAG,MAAM;QACT,OAAO;QACP,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,MAAM;QACN,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAiC;IAEjC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAChC,MAAM,MAAM,GAAkB,EAAE,CAAC;IAEjC,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5B,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACvB,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM;YACN,IAAI,EAAE,KAAK;YACX,MAAM;SACP,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAE1C,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEvC,IAAI,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;QAC5D,MAAM,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,QAAQ,GAAG,2BAA2B,CAAC,IAAI,EAAE,QAAQ,CAAC,qBAAqB,CAAC,CAAC;QACnF,IAAI,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,QAAQ,EAAE,CAAC;YACvC,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;gBACxC,MAAM,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,QAAQ,EAAE,CAAC;YACxC,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;gBACzC,MAAM,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,CAAC,IAAI,CAAC,MAAM,qBAAqB,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED,OAAO;QACL,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM;QACN,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACjC,MAAM;KACP,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,IAAY;IAEZ,MAAM,GAAG,GAAG,GAAG,IAAI,GAAG,YAAY,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IAExC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnC,OAAO;YACL,KAAK,EAAE;gBACL,IAAI,EAAE,+BAA+B;gBACrC,IAAI,EAAE,KAAK;gBACX,MAAM,EAAE,GAAG,GAAG,0BAA0B,QAAQ,CAAC,KAAK,EAAE;gBACxD,MAAM,EAAE,mFAAmF;aAC5F;SACF,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO;YACL,KAAK,EAAE;gBACL,IAAI,EAAE,+BAA+B;gBACrC,IAAI,EAAE,KAAK;gBACX,MAAM,EAAE,GAAG,GAAG,aAAa,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,KAAK,iBAAiB;gBAC7E,MAAM,EAAE,wEAAwE;aACjF;SACF,CAAC;IACJ,CAAC;IAED,IAAI,QAAqC,CAAC;IAC1C,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAgC,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,KAAK,EAAE;gBACL,IAAI,EAAE,+BAA+B;gBACrC,IAAI,EAAE,KAAK;gBACX,MAAM,EAAE,GAAG,GAAG,uBAAuB;gBACrC,MAAM,EAAE,6BAA6B;aACtC;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,EAAE;YACL,IAAI,EAAE,+BAA+B;YACrC,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,GAAG,GAAG,gBAAgB;SAC/B;QACD,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,QAAqC;IAC1D,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,gCAAgC,CAAC,CAAC;IACzE,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,mDAAmD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;SAClF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,wCAAwC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,8BAA8B;QAChG,MAAM,EAAE,6DAA6D;KACtE,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,QAAqC;IAC5D,IAAI,QAAQ,CAAC,8CAA8C,KAAK,IAAI,EAAE,CAAC;QACrE,OAAO;YACL,IAAI,EAAE,wBAAwB;YAC9B,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,yDAAyD;SAClE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,wBAAwB;QAC9B,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,qDAAqD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,8CAA8C,CAAC,kBAAkB;QACtJ,MAAM,EACJ,yFAAyF;YACzF,6FAA6F;YAC7F,uFAAuF;KAC1F,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,QAAqC,EACrC,MAA4B;IAE5B,MAAM,QAAQ,GAAG,CAAC,QAAQ,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/D,MAAM,IAAI,GAAG,GAAG,MAAM,yBAAyB,CAAC;IAChD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO;YACL,IAAI;YACJ,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,4BAA4B,QAAQ,GAAG;SAChD,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GACV,MAAM,KAAK,QAAQ;QACjB,CAAC,CAAC,0HAA0H;QAC5H,CAAC,CAAC,kLAAkL,CAAC;IAEzL,OAAO;QACL,IAAI;QACJ,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,2CAA2C;QACnD,MAAM;KACP,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,QAAqC;IAC5D,MAAM,UAAU,GAAG,QAAQ,CAAC,qCAAqC,KAAK,IAAI,CAAC;IAC3E,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,qCAAqC,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEzC,MAAM,aAAa,GAAgB,UAAU;QAC3C,CAAC,CAAC;YACE,IAAI,EAAE,4BAA4B;YAClC,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,gDAAgD;SACzD;QACH,CAAC,CAAC;YACE,IAAI,EAAE,4BAA4B;YAClC,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,4CAA4C,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,qCAAqC,CAAC,kBAAkB;YACpI,MAAM,EAAE,cAAc;SACvB,CAAC;IAEN,MAAM,UAAU,GAAgB,OAAO;QACrC,CAAC,CAAC;YACE,IAAI,EAAE,kCAAkC;YACxC,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,0DAA0D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;SACzF;QACH,CAAC,CAAC;YACE,IAAI,EAAE,kCAAkC;YACxC,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,6CAA6C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,gCAAgC;YACvG,MAAM,EAAE,cAAc;SACvB,CAAC;IAEN,MAAM,aAAa,GAAgB;QACjC,IAAI,EAAE,iCAAiC;QACvC,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,uBAAuB;QAC/B,MAAM,EAAE,uBAAuB;KAChC,CAAC;IAEF,OAAO,CAAC,aAAa,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAqC;IAC7D,MAAM,UAAU,GAAG,QAAQ,CAAC,qCAAqC,KAAK,IAAI,CAAC;IAE3E,MAAM,aAAa,GAAgB,UAAU;QAC3C,CAAC,CAAC;YACE,IAAI,EAAE,6BAA6B;YACnC,IAAI,EAAE,IAAI;YACV,MAAM,EACJ,sFAAsF;gBACtF,oBAAoB,yBAAyB,iCAAiC;SACjF;QACH,CAAC,CAAC;YACE,IAAI,EAAE,6BAA6B;YACnC,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,4CAA4C,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,qCAAqC,CAAC,kBAAkB;YACpI,MAAM,EACJ,2FAA2F;gBAC3F,qGAAqG;SACxG,CAAC;IAEN,MAAM,aAAa,GAAgB;QACjC,IAAI,EAAE,kCAAkC;QACxC,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,8BAA8B;QACtC,MAAM,EAAE,uBAAuB;KAChC,CAAC;IAEF,OAAO,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;AACxC,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,QAAgB,EAChB,MAAgB,EAChB,OAAmB;IAEnB,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;IAC3C,MAAM,IAAI,GAAG;QACX,GAAG,OAAO,CAAC,OAAO;QAClB,WAAW,EAAE,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;KACjD,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE;QAC3C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnC,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,SAAS;YACvB,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,QAAQ,QAAQ,0BAA0B,QAAQ,CAAC,KAAK,EAAE;YAClE,MAAM,EAAE,gFAAgF;SACzF,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,SAAS;YACvB,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,YAAY,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;YACnD,MAAM,EAAE,YAAY;SACrB,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,SAAS;YACvB,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,QAAQ,QAAQ,aAAa,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,KAAK,mBAAmB,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;YACxH,MAAM,EAAE,4EAA4E;SACrF,CAAC;IACJ,CAAC;IAED,IAAI,MAAwD,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAqD,CAAC;IAC/F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,SAAS;YACvB,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,6CAA6C;YACrD,MAAM,EAAE,6BAA6B;SACtC,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAChE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,SAAS;YACvB,IAAI,EAAE,KAAK;YACX,MAAM,EACJ,+CAA+C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBACrE,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG;YAC9E,MAAM,EACJ,sFAAsF;gBACtF,sCAAsC;SACzC,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;IACpF,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,SAAS;QACvB,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,sBAAsB,QAAQ,wEAAwE;KAC/G,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAc,EAAE,MAAe;IAC1D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,cAAc,CAAC,GAAuB;IAC7C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,yCAAyC,CAAC;IACnD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAqD,CAAC;QACjF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QACvE,MAAM,WAAW,GACf,IAAI,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QACnF,OAAO,SAAS,KAAK,sBAAsB,WAAW,EAAE,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B,CAAC,IAAY,EAAE,KAAyB;IAC1E,MAAM,QAAQ,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7C,CAAC"}

package/dist/commands/account.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from "commander";
+export declare function accountCommands(program: Command): void;