authflow-cli 0.4.1 → 0.6.0

package/dist/tenant-host.js

@@ -0,0 +1,367 @@
+import { resolveCname, resolveTxt } from "node:dns/promises";
+import { connect as tlsConnect } from "node:tls";
+import { fetchOrNull, unauthenticatedInitialize } from "./checks.js";
+import { customDomainState, defaultPublicPath, setDomainCommandLine, summarizeCustomDomain, } from "./custom-domain.js";
+import { publicResourceUrl } from "./resource-urls.js";
+export const systemDnsResolver = { resolveCname, resolveTxt };
+const tlsTimeoutMs = 15_000;
+const httpsPort = 443;
+const msPerDay = 86_400_000;
+/**
+ * Renewal is automatic once the _acme-challenge CNAME validates, and starts well before expiry. A
+ * certificate this close to the end means it has been failing to renew for weeks.
+ */
+const certExpiryFailDays = 7;
+const prmRootPath = "/.well-known/oauth-protected-resource";
+export async function runTenantHostChecks(options) {
+    const host = options.host;
+    const dns = options.dns ?? systemDnsResolver;
+    const tls = options.tls ?? probeTls;
+    const now = options.now ?? (() => new Date());
+    // A receipt registered on a different host says nothing about this one, so it supplies no
+    // expectations; the first check reports the mismatch.
+    const receipt = options.receipt?.public_host?.trim().toLowerCase() === host ? options.receipt : undefined;
+    const expected = expectations(host, receipt);
+    const note = options.receiptNote ?? "no receipt for this host";
+    const checks = [checkRegistration(host, options.receipt, receipt, options.receiptNote)];
+    checks.push(...(await checkDns(host, expected, dns, note)));
+    const handshake = await checkTls(host, tls, now, receipt);
+    checks.push(handshake.check);
+    checks.push(await checkHttpRedirect(host, expected.path));
+    // Fetch refuses an untrusted certificate, so with a failed handshake every https check below
+    // would fail with the same unhelpful "fetch failed". The TLS check already says why.
+    if (!handshake.usable) {
+        checks.push({
+            name: "host https checks",
+            pass: true,
+            skipped: true,
+            detail: `Skipped the PRM and 401 checks: the TLS check failed, so https requests to ${host} would ` +
+                "fail with misleading errors.",
+        });
+        return checks;
+    }
+    checks.push(await checkPrm("path", `https://${host}${prmRootPath}${expected.path}`, expected.resource), await checkPrm("root", `https://${host}${prmRootPath}`, expected.resource), await checkChallenge(host, expected.path));
+    return checks;
+}
+function expectations(host, receipt) {
+    const path = receipt?.public_path?.trim() || defaultPublicPath;
+    const records = receipt?.custom_domain?.records ?? [];
+    return {
+        path,
+        resource: receipt?.resource?.trim() || publicResourceUrl(host, path),
+        fromReceipt: receipt !== undefined,
+        state: receipt ? customDomainState(receipt) : undefined,
+        cnameTarget: receipt?.custom_domain?.cname_target?.trim() ||
+            records.find((record) => record.purpose === "traffic")?.value,
+        ownership: records.find((record) => record.purpose === "ownership"),
+        certificate: records.find((record) => record.purpose === "certificate"),
+    };
+}
+function checkRegistration(host, given, matched, note) {
+    const name = "host custom domain";
+    if (!given) {
+        return skip(name, `No receipt for ${host} (${note ?? "none was supplied"}), so the expected DNS targets are ` +
+            "unknown: records are checked for presence only, not compared.");
+    }
+    const slug = given.slug ?? "<slug>";
+    if (!matched) {
+        const registeredOn = given.public_host ? `'${given.public_host}'` : "the gateway host";
+        return fail(name, `Resource '${slug}' is registered on ${registeredOn}, not on ${host}.`, `Check --host, or point the resource at this host: authflow set-domain --slug ${slug} --host ${host}`);
+    }
+    const summary = summarizeCustomDomain(matched);
+    if (customDomainState(matched) === "ready") {
+        return pass(name, `${host} is registered on '${slug}': ${summary}.`);
+    }
+    return fail(name, `${host} is registered on '${slug}', but the rail reports ${summary}.`, `Finish the DNS records, then have the rail re-check: ${setDomainCommandLine(slug)}`);
+}
+async function checkDns(host, expected, dns, note) {
+    return [
+        await checkTrafficCname(host, expected, dns, note),
+        await checkCertificateCname(host, expected, dns, note),
+        await checkOwnershipTxt(host, expected, dns, note),
+    ];
+}
+async function checkTrafficCname(host, expected, dns, note) {
+    const name = "host DNS: traffic CNAME";
+    const lookup = await lookupCname(dns, host);
+    if (lookup.kind === "error") {
+        return dnsLookupFailed(name, `CNAME for ${host}`, lookup.message);
+    }
+    if (lookup.kind === "missing") {
+        return fail(name, `${host} has no CNAME record.`, `Add a CNAME for ${host} pointing at ${expected.cnameTarget ?? "the cname_target in your receipt (authflow status shows it)"}. ` +
+            "Until it points at the edge, traffic never reaches Authflow.");
+    }
+    const target = expected.cnameTarget ? normalizeDnsName(expected.cnameTarget) : undefined;
+    if (!target) {
+        return skip(name, `${host} CNAME -> ${lookup.values[0]}. Not compared: ${note}.`);
+    }
+    if (lookup.values.includes(target)) {
+        return pass(name, `${host} CNAME -> ${target}.`);
+    }
+    return fail(name, `${host} CNAME points at ${lookup.values.join(", ")}, expected ${target}.`, `Change the CNAME for ${host} to ${target}. A CNAME to anywhere else sends traffic past Authflow.`);
+}
+async function checkCertificateCname(host, expected, dns, note) {
+    const name = "host DNS: _acme-challenge CNAME";
+    const record = expected.certificate;
+    const recordName = record?.name ?? `_acme-challenge.${host}`;
+    // The rail issues this record only once provisioning has begun. Until then there is nothing for
+    // the tenant to have added, and calling its absence a failure would send them hunting for it.
+    if (expected.fromReceipt && !record) {
+        return skip(name, `The rail has not issued a certificate record yet (state: ${expected.state ?? "unknown"}), so there is nothing to check.`);
+    }
+    const lookup = await lookupCname(dns, recordName);
+    if (lookup.kind === "error") {
+        return dnsLookupFailed(name, `CNAME for ${recordName}`, lookup.message);
+    }
+    if (lookup.kind === "missing") {
+        return fail(name, `${recordName} has no CNAME record.`, record
+            ? `Add CNAME ${recordName} -> ${record.value}. Without it the certificate cannot be validated or renewed.`
+            : "Add the certificate CNAME the rail issued (authflow status lists it). Without it the certificate " +
+                "cannot be validated or renewed.");
+    }
+    if (!record) {
+        return skip(name, `${recordName} CNAME -> ${lookup.values[0]}. Not compared: ${note}.`);
+    }
+    const target = normalizeDnsName(record.value);
+    if (lookup.values.includes(target)) {
+        return pass(name, `${recordName} CNAME -> ${target}.`);
+    }
+    return fail(name, `${recordName} CNAME points at ${lookup.values.join(", ")}, expected ${target}.`, `Change it to ${target}, exactly as the rail issued it.`);
+}
+async function checkOwnershipTxt(host, expected, dns, note) {
+    const name = "host DNS: _authflow-verify TXT";
+    const record = expected.ownership;
+    const recordName = record?.name ?? `_authflow-verify.${host}`;
+    let values;
+    try {
+        values = (await dns.resolveTxt(recordName)).map((chunks) => chunks.join(""));
+    }
+    catch (err) {
+        if (!isMissingRecord(err)) {
+            return dnsLookupFailed(name, `TXT for ${recordName}`, errorMessage(err));
+        }
+        values = [];
+    }
+    if (values.length === 0) {
+        return fail(name, `${recordName} has no TXT record.`, record
+            ? `Add TXT ${recordName} = ${record.value}. It proves you own the host, and the rail will not provision it without.`
+            : "Add the ownership TXT record the rail issued (authflow status lists it).");
+    }
+    if (record) {
+        return values.some((value) => value.trim() === record.value.trim())
+            ? pass(name, `${recordName} TXT matches the receipt.`)
+            : fail(name, `${recordName} has TXT ${values.map((value) => `'${value}'`).join(", ")}, expected '${record.value}'.`, `Replace it with exactly ${record.value}.`);
+    }
+    return values.some((value) => value.trim().startsWith("authflow-verify="))
+        ? skip(name, `${recordName} has an authflow-verify= TXT record. Not compared: ${note}.`)
+        : fail(name, `${recordName} has TXT records, but none starts with authflow-verify=.`, "Add the ownership TXT record the rail issued (authflow status lists it).");
+}
+async function lookupCname(dns, name) {
+    try {
+        const values = (await dns.resolveCname(name)).map(normalizeDnsName);
+        return values.length > 0 ? { kind: "found", values } : { kind: "missing" };
+    }
+    catch (err) {
+        return isMissingRecord(err) ? { kind: "missing" } : { kind: "error", message: errorMessage(err) };
+    }
+}
+function dnsLookupFailed(name, what, message) {
+    return fail(name, `Looking up the ${what} failed: ${message}`, "This is a resolver problem, not proof the record is missing. Retry, or check the domain's nameservers.");
+}
+/** NXDOMAIN and "name exists, no such record" both mean the record is not there. */
+function isMissingRecord(err) {
+    const code = err?.code;
+    return code === "ENODATA" || code === "ENOTFOUND";
+}
+function normalizeDnsName(value) {
+    return value.trim().toLowerCase().replace(/\.$/, "");
+}
+// ---------------------------------------------------------------------------------------------
+// TLS
+// ---------------------------------------------------------------------------------------------
+async function checkTls(host, probe, now, receipt) {
+    const name = "host TLS certificate";
+    let peer;
+    try {
+        peer = await probe(host, httpsPort);
+    }
+    catch (err) {
+        return {
+            usable: false,
+            check: fail(name, `Could not complete a TLS handshake with ${host}:${httpsPort}: ${errorMessage(err)}`, "Either DNS does not point at the edge yet, or the edge has no certificate for the host. " +
+                "Check the DNS results above, then wait for the certificate."),
+        };
+    }
+    const days = Math.floor((peer.validTo.getTime() - now().getTime()) / msPerDay);
+    const expiry = describeExpiry(peer.validTo, days);
+    const who = `issuer ${peer.issuer}, subject ${peer.subject}`;
+    if (!peer.authorized) {
+        return {
+            usable: false,
+            check: fail(name, `The certificate ${host} presents is not trusted: ${peer.authorizationError ?? "unknown error"} (${who}; expires ${expiry}).`, tlsRemedy(host, peer.authorizationError, receipt)),
+        };
+    }
+    if (days < certExpiryFailDays) {
+        return {
+            usable: true,
+            check: fail(name, `The certificate is about to expire (${who}; expires ${expiry}).`, "Renewal is automatic once the _acme-challenge CNAME validates. A certificate this close to " +
+                "expiry means that record is missing or wrong."),
+        };
+    }
+    return { usable: true, check: pass(name, `Issued by ${peer.issuer} to ${peer.subject}; expires ${expiry}.`) };
+}
+/** `2027-01-01, in 89 days` or, for a lapsed certificate, `2026-01-01, 3 days ago`. */
+function describeExpiry(validTo, days) {
+    const date = validTo.toISOString().slice(0, 10);
+    const unit = Math.abs(days) === 1 ? "day" : "days";
+    return days >= 0 ? `${date}, in ${days} ${unit}` : `${date}, ${-days} ${unit} ago`;
+}
+function tlsRemedy(host, code, receipt) {
+    const recheck = receipt ? ` Then: ${setDomainCommandLine(receipt.slug ?? "<slug>")}` : "";
+    if (code === "ERR_TLS_CERT_ALTNAME_INVALID") {
+        return (`The edge answered with a certificate that does not cover ${host}. Its certificate for the host ` +
+            `is not active yet, or the traffic CNAME does not point at the edge. Check the DNS results above.${recheck}`);
+    }
+    if (code === "CERT_HAS_EXPIRED") {
+        return "The certificate has expired. Renewal is automatic once the _acme-challenge CNAME validates; check that record.";
+    }
+    return `Clients will refuse this certificate. Check the DNS results above, then wait for the edge to issue one.${recheck}`;
+}
+/** The certificate a server presents, whether or not Node trusts it. */
+export const probeTls = (host, port) => new Promise((resolve, reject) => {
+    // Untrusted certificates are the finding here, not a reason to refuse the connection.
+    const socket = tlsConnect({ host, port, servername: host, rejectUnauthorized: false });
+    socket.setTimeout(tlsTimeoutMs, () => {
+        socket.destroy(new Error(`timed out after ${tlsTimeoutMs / 1000}s`));
+    });
+    socket.once("error", reject);
+    socket.once("secureConnect", () => {
+        try {
+            resolve(describePeer(socket.getPeerCertificate(), socket.authorized, socket.authorized ? undefined : String(socket.authorizationError)));
+        }
+        catch (err) {
+            reject(err);
+        }
+        finally {
+            socket.end();
+        }
+    });
+});
+export function describePeer(cert, authorized, authorizationError) {
+    const validTo = new Date(cert.valid_to);
+    if (!cert.valid_to || Number.isNaN(validTo.getTime())) {
+        throw new Error("the server presented no usable certificate");
+    }
+    return {
+        authorized,
+        authorizationError,
+        issuer: describeName(cert.issuer),
+        subject: describeName(cert.subject),
+        validTo,
+    };
+}
+/** `Let's Encrypt (E8)`: organisation and common name, whichever the certificate has. */
+function describeName(name) {
+    const first = (value) => {
+        const single = Array.isArray(value) ? value[0] : value;
+        return typeof single === "string" && single.length > 0 ? single : undefined;
+    };
+    const organisation = first(name?.O);
+    const common = first(name?.CN);
+    if (organisation && common) {
+        return `${organisation} (${common})`;
+    }
+    return common ?? organisation ?? "unknown";
+}
+// ---------------------------------------------------------------------------------------------
+// HTTP
+// ---------------------------------------------------------------------------------------------
+async function checkHttpRedirect(host, path) {
+    const name = "host http redirects to https";
+    const url = `http://${host}${path}`;
+    const response = await fetchOrNull(url, { redirect: "manual" });
+    if (!response.ok) {
+        return fail(name, `GET ${url} could not be reached: ${response.error}`, "Port 80 is not answering. The edge redirects plain http for proxied hostnames, so the traffic " +
+            "CNAME is probably not in place yet.");
+    }
+    const status = response.status ?? 0;
+    if ([301, 302, 303, 307, 308].includes(status)) {
+        const target = parseUrl(response.location ?? "", url);
+        return target?.protocol === "https:" && target.host === host
+            ? pass(name, `GET ${url} returned ${status} to ${response.location}.`)
+            : fail(name, `GET ${url} returned ${status} to '${response.location ?? ""}', not to https://${host}.`, "The redirect has to stay on the tenant host and switch to https, or a client following it " +
+                "connects somewhere else or stays unencrypted.");
+    }
+    return fail(name, `GET ${url} returned ${status} over plain http instead of redirecting to https.`, "Enable Always Use HTTPS on the edge zone. Without it, a client configured with an http:// URL " +
+        "talks to the server unencrypted.");
+}
+async function checkPrm(label, url, expectedResource) {
+    const name = `host PRM (${label})`;
+    const response = await fetchOrNull(url);
+    if (!response.ok) {
+        return fail(name, `GET ${url} could not be reached: ${response.error}`, "Check the host's DNS and certificate above.");
+    }
+    if (response.status !== 200) {
+        return fail(name, `GET ${url} returned ${response.status}, expected 200.`, response.status === 404
+            ? "The host answers but the rail does not recognise it: the custom domain is not ready, or the " +
+                "edge is not forwarding the host. Clients discover the authorization server here (Claude Code " +
+                "probes the root path)."
+            : "Clients discover the authorization server from this document. File a rail bug.");
+    }
+    let resource;
+    try {
+        resource = JSON.parse(response.body ?? "").resource;
+    }
+    catch {
+        return fail(name, `${url} did not return JSON.`, "Something other than the rail is answering on the host.");
+    }
+    if (resource !== expectedResource) {
+        return fail(name, `${url} names resource '${String(resource)}', expected '${expectedResource}'.`, "Tokens are audience-bound to this value. A client that connected at the host would be refused at " +
+            "/authorize as invalid_target.");
+    }
+    return pass(name, `GET ${url} returned 200 with resource ${resource}.`);
+}
+async function checkChallenge(host, path) {
+    const name = "host 401 challenge";
+    const url = `https://${host}${path}`;
+    const response = await fetchOrNull(url, unauthenticatedInitialize());
+    if (!response.ok) {
+        return fail(name, `Unauthenticated POST ${url} could not be reached: ${response.error}`, "Check the host's DNS and certificate above.");
+    }
+    if (response.status !== 401) {
+        return fail(name, `Unauthenticated POST ${url} returned ${response.status}, expected 401.`, response.status === 404
+            ? "The host answers but the rail does not recognise it: the custom domain is not ready, or the edge is not forwarding the host."
+            : "An unauthenticated connect that does not 401 means clients will never start OAuth.");
+    }
+    const challenge = response.headers?.get("www-authenticate") ?? "";
+    const metadata = resourceMetadataValue(challenge);
+    if (!metadata) {
+        return fail(name, `401 returned, but WWW-Authenticate has no resource_metadata parameter: '${challenge}'.`, "MCP clients cannot discover the authorization server. File a rail bug.");
+    }
+    const target = parseUrl(metadata);
+    if (target?.protocol !== "https:" || target.host !== host) {
+        return fail(name, `The 401's resource_metadata is '${metadata}', which is not an https URL on ${host}.`, "Clients fetch protected resource metadata from this URL. It has to name the host they connected " +
+            "to; pointing it at the gateway host sends them to the wrong audience.");
+    }
+    return pass(name, `401 with resource_metadata=${metadata}.`);
+}
+/** The `resource_metadata` parameter of a Bearer challenge, quoted or bare. */
+function resourceMetadataValue(challenge) {
+    const match = /resource_metadata\s*=\s*(?:"([^"]*)"|([^\s,]+))/i.exec(challenge);
+    return match?.[1] ?? match?.[2] ?? undefined;
+}
+function parseUrl(value, base) {
+    try {
+        return new URL(value, base);
+    }
+    catch {
+        return undefined;
+    }
+}
+function errorMessage(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+const pass = (name, detail) => ({ name, pass: true, detail });
+const skip = (name, detail) => ({ name, pass: true, skipped: true, detail });
+const fail = (name, detail, remedy) => ({ name, pass: false, detail, remedy });
+//# sourceMappingURL=tenant-host.js.map

package/dist/tenant-host.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-host.js","sourceRoot":"","sources":["../src/tenant-host.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,OAAO,IAAI,UAAU,EAAwB,MAAM,UAAU,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,yBAAyB,EAAoB,MAAM,aAAa,CAAC;AAEvF,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAmBvD,MAAM,CAAC,MAAM,iBAAiB,GAAgB,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;AAgC3E,MAAM,YAAY,GAAG,MAAM,CAAC;AAC5B,MAAM,SAAS,GAAG,GAAG,CAAC;AACtB,MAAM,QAAQ,GAAG,UAAU,CAAC;AAE5B;;;GAGG;AACH,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAE7B,MAAM,WAAW,GAAG,uCAAuC,CAAC;AAc5D,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAA0B;IAClE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,iBAAiB,CAAC;IAC7C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,QAAQ,CAAC;IACpC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAE9C,0FAA0F;IAC1F,sDAAsD;IACtD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1G,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,IAAI,0BAA0B,CAAC;IAE/D,MAAM,MAAM,GAAkB,CAAC,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;IACvG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAE5D,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAC1D,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,CAAC,IAAI,CAAC,MAAM,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAE1D,6FAA6F;IAC7F,qFAAqF;IACrF,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,IAAI;YACb,MAAM,EACJ,8EAA8E,IAAI,SAAS;gBAC3F,8BAA8B;SACjC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,CAAC,IAAI,CACT,MAAM,QAAQ,CAAC,MAAM,EAAE,WAAW,IAAI,GAAG,WAAW,GAAG,QAAQ,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAC1F,MAAM,QAAQ,CAAC,MAAM,EAAE,WAAW,IAAI,GAAG,WAAW,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAC1E,MAAM,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,CAC1C,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,OAAwC;IAC1E,MAAM,IAAI,GAAG,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,iBAAiB,CAAC;IAC/D,MAAM,OAAO,GAAG,OAAO,EAAE,aAAa,EAAE,OAAO,IAAI,EAAE,CAAC;IACtD,OAAO;QACL,IAAI;QACJ,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC;QACpE,WAAW,EAAE,OAAO,KAAK,SAAS;QAClC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;QACvD,WAAW,EACT,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,IAAI,EAAE;YAC5C,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,EAAE,KAAK;QAC/D,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,KAAK,WAAW,CAAC;QACnE,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,KAAK,aAAa,CAAC;KACxE,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,IAAY,EACZ,KAAsC,EACtC,OAAwC,EACxC,IAAwB;IAExB,MAAM,IAAI,GAAG,oBAAoB,CAAC;IAClC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CACT,IAAI,EACJ,kBAAkB,IAAI,KAAK,IAAI,IAAI,mBAAmB,qCAAqC;YACzF,+DAA+D,CAClE,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,QAAQ,CAAC;IACpC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,YAAY,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,kBAAkB,CAAC;QACvF,OAAO,IAAI,CACT,IAAI,EACJ,aAAa,IAAI,sBAAsB,YAAY,YAAY,IAAI,GAAG,EACtE,gFAAgF,IAAI,WAAW,IAAI,EAAE,CACtG,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,iBAAiB,CAAC,OAAO,CAAC,KAAK,OAAO,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,sBAAsB,IAAI,MAAM,OAAO,GAAG,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,IAAI,CACT,IAAI,EACJ,GAAG,IAAI,sBAAsB,IAAI,2BAA2B,OAAO,GAAG,EACtE,wDAAwD,oBAAoB,CAAC,IAAI,CAAC,EAAE,CACrF,CAAC;AACJ,CAAC;AAQD,KAAK,UAAU,QAAQ,CACrB,IAAY,EACZ,QAA0B,EAC1B,GAAgB,EAChB,IAAY;IAEZ,OAAO;QACL,MAAM,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC;QAClD,MAAM,qBAAqB,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC;QACtD,MAAM,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC;KACnD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,IAAY,EACZ,QAA0B,EAC1B,GAAgB,EAChB,IAAY;IAEZ,MAAM,IAAI,GAAG,yBAAyB,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAE5C,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC5B,OAAO,eAAe,CAAC,IAAI,EAAE,aAAa,IAAI,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,IAAI,CACT,IAAI,EACJ,GAAG,IAAI,uBAAuB,EAC9B,mBAAmB,IAAI,gBAAgB,QAAQ,CAAC,WAAW,IAAI,6DAA6D,IAAI;YAC9H,8DAA8D,CACjE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,aAAa,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,mBAAmB,IAAI,GAAG,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,aAAa,MAAM,GAAG,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,IAAI,CACT,IAAI,EACJ,GAAG,IAAI,oBAAoB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,MAAM,GAAG,EAC1E,wBAAwB,IAAI,OAAO,MAAM,yDAAyD,CACnG,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,IAAY,EACZ,QAA0B,EAC1B,GAAgB,EAChB,IAAY;IAEZ,MAAM,IAAI,GAAG,iCAAiC,CAAC;IAC/C,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,CAAC;IACpC,MAAM,UAAU,GAAG,MAAM,EAAE,IAAI,IAAI,mBAAmB,IAAI,EAAE,CAAC;IAE7D,gGAAgG;IAChG,8FAA8F;IAC9F,IAAI,QAAQ,CAAC,WAAW,IAAI,CAAC,MAAM,EAAE,CAAC;QACpC,OAAO,IAAI,CACT,IAAI,EACJ,4DAA4D,QAAQ,CAAC,KAAK,IAAI,SAAS,kCAAkC,CAC1H,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAElD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC5B,OAAO,eAAe,CAAC,IAAI,EAAE,aAAa,UAAU,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,IAAI,CACT,IAAI,EACJ,GAAG,UAAU,uBAAuB,EACpC,MAAM;YACJ,CAAC,CAAC,aAAa,UAAU,OAAO,MAAM,CAAC,KAAK,8DAA8D;YAC1G,CAAC,CAAC,mGAAmG;gBACjG,iCAAiC,CACxC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC,IAAI,EAAE,GAAG,UAAU,aAAa,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,mBAAmB,IAAI,GAAG,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC,IAAI,EAAE,GAAG,UAAU,aAAa,MAAM,GAAG,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,IAAI,CACT,IAAI,EACJ,GAAG,UAAU,oBAAoB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,MAAM,GAAG,EAChF,gBAAgB,MAAM,kCAAkC,CACzD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,IAAY,EACZ,QAA0B,EAC1B,GAAgB,EAChB,IAAY;IAEZ,MAAM,IAAI,GAAG,gCAAgC,CAAC;IAC9C,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC;IAClC,MAAM,UAAU,GAAG,MAAM,EAAE,IAAI,IAAI,oBAAoB,IAAI,EAAE,CAAC;IAE9D,IAAI,MAAgB,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,eAAe,CAAC,IAAI,EAAE,WAAW,UAAU,EAAE,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,GAAG,EAAE,CAAC;IACd,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CACT,IAAI,EACJ,GAAG,UAAU,qBAAqB,EAClC,MAAM;YACJ,CAAC,CAAC,WAAW,UAAU,MAAM,MAAM,CAAC,KAAK,2EAA2E;YACpH,CAAC,CAAC,0EAA0E,CAC/E,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACjE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,UAAU,2BAA2B,CAAC;YACtD,CAAC,CAAC,IAAI,CACF,IAAI,EACJ,GAAG,UAAU,YAAY,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,KAAK,IAAI,EACtG,2BAA2B,MAAM,CAAC,KAAK,GAAG,CAC3C,CAAC;IACR,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;QACxE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,UAAU,sDAAsD,IAAI,GAAG,CAAC;QACxF,CAAC,CAAC,IAAI,CACF,IAAI,EACJ,GAAG,UAAU,0DAA0D,EACvE,0EAA0E,CAC3E,CAAC;AACR,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,GAAgB,EAAE,IAAY;IACvD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QACpE,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;IACpG,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,IAAY,EAAE,OAAe;IAClE,OAAO,IAAI,CACT,IAAI,EACJ,kBAAkB,IAAI,YAAY,OAAO,EAAE,EAC3C,wGAAwG,CACzG,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,SAAS,eAAe,CAAC,GAAY;IACnC,MAAM,IAAI,GAAI,GAAiC,EAAE,IAAI,CAAC;IACtD,OAAO,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,WAAW,CAAC;AACpD,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACvD,CAAC;AAED,gGAAgG;AAChG,MAAM;AACN,gGAAgG;AAEhG,KAAK,UAAU,QAAQ,CACrB,IAAY,EACZ,KAAe,EACf,GAAe,EACf,OAAwC;IAExC,MAAM,IAAI,GAAG,sBAAsB,CAAC;IAEpC,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,IAAI,CACT,IAAI,EACJ,2CAA2C,IAAI,IAAI,SAAS,KAAK,YAAY,CAAC,GAAG,CAAC,EAAE,EACpF,0FAA0F;gBACxF,6DAA6D,CAChE;SACF,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC;IAC/E,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,UAAU,IAAI,CAAC,MAAM,aAAa,IAAI,CAAC,OAAO,EAAE,CAAC;IAE7D,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QACrB,OAAO;YACL,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,IAAI,CACT,IAAI,EACJ,mBAAmB,IAAI,6BAA6B,IAAI,CAAC,kBAAkB,IAAI,eAAe,KAAK,GAAG,aAAa,MAAM,IAAI,EAC7H,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAClD;SACF,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,GAAG,kBAAkB,EAAE,CAAC;QAC9B,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,IAAI,CACT,IAAI,EACJ,uCAAuC,GAAG,aAAa,MAAM,IAAI,EACjE,6FAA6F;gBAC3F,+CAA+C,CAClD;SACF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,aAAa,IAAI,CAAC,MAAM,OAAO,IAAI,CAAC,OAAO,aAAa,MAAM,GAAG,CAAC,EAAE,CAAC;AAChH,CAAC;AAED,uFAAuF;AACvF,SAAS,cAAc,CAAC,OAAa,EAAE,IAAY;IACjD,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IACnD,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC,IAAI,IAAI,IAAI,MAAM,CAAC;AACrF,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,IAAwB,EAAE,OAAwC;IACjG,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,UAAU,oBAAoB,CAAC,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAE1F,IAAI,IAAI,KAAK,8BAA8B,EAAE,CAAC;QAC5C,OAAO,CACL,4DAA4D,IAAI,iCAAiC;YACjG,mGAAmG,OAAO,EAAE,CAC7G,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;QAChC,OAAO,gHAAgH,CAAC;IAC1H,CAAC;IACD,OAAO,0GAA0G,OAAO,EAAE,CAAC;AAC7H,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,MAAM,QAAQ,GAAa,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAC/C,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IACvC,sFAAsF;IACtF,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,CAAC;IACvF,MAAM,CAAC,UAAU,CAAC,YAAY,EAAE,GAAG,EAAE;QACnC,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,mBAAmB,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7B,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE;QAChC,IAAI,CAAC;YACH,OAAO,CACL,YAAY,CACV,MAAM,CAAC,kBAAkB,EAAE,EAC3B,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAClE,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,GAAG,EAAE,CAAC;QACf,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,MAAM,UAAU,YAAY,CAC1B,IAAqB,EACrB,UAAmB,EACnB,kBAA2B;IAE3B,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,OAAO;QACL,UAAU;QACV,kBAAkB;QAClB,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC;QACjC,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC;QACnC,OAAO;KACR,CAAC;AACJ,CAAC;AAED,yFAAyF;AACzF,SAAS,YAAY,CAAC,IAA+C;IACnE,MAAM,KAAK,GAAG,CAAC,KAAc,EAAsB,EAAE;QACnD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACvD,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC/B,IAAI,YAAY,IAAI,MAAM,EAAE,CAAC;QAC3B,OAAO,GAAG,YAAY,KAAK,MAAM,GAAG,CAAC;IACvC,CAAC;IACD,OAAO,MAAM,IAAI,YAAY,IAAI,SAAS,CAAC;AAC7C,CAAC;AAED,gGAAgG;AAChG,OAAO;AACP,gGAAgG;AAEhG,KAAK,UAAU,iBAAiB,CAAC,IAAY,EAAE,IAAY;IACzD,MAAM,IAAI,GAAG,8BAA8B,CAAC;IAC5C,MAAM,GAAG,GAAG,UAAU,IAAI,GAAG,IAAI,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IAEhE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,IAAI,CACT,IAAI,EACJ,OAAO,GAAG,0BAA0B,QAAQ,CAAC,KAAK,EAAE,EACpD,gGAAgG;YAC9F,qCAAqC,CACxC,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;QACtD,OAAO,MAAM,EAAE,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;YAC1D,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,GAAG,aAAa,MAAM,OAAO,QAAQ,CAAC,QAAQ,GAAG,CAAC;YACtE,CAAC,CAAC,IAAI,CACF,IAAI,EACJ,OAAO,GAAG,aAAa,MAAM,QAAQ,QAAQ,CAAC,QAAQ,IAAI,EAAE,qBAAqB,IAAI,GAAG,EACxF,4FAA4F;gBAC1F,+CAA+C,CAClD,CAAC;IACR,CAAC;IAED,OAAO,IAAI,CACT,IAAI,EACJ,OAAO,GAAG,aAAa,MAAM,mDAAmD,EAChF,gGAAgG;QAC9F,kCAAkC,CACrC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,KAAsB,EAAE,GAAW,EAAE,gBAAwB;IACnF,MAAM,IAAI,GAAG,aAAa,KAAK,GAAG,CAAC;IACnC,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IAExC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC,IAAI,EAAE,OAAO,GAAG,0BAA0B,QAAQ,CAAC,KAAK,EAAE,EAAE,6CAA6C,CAAC,CAAC;IACzH,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO,IAAI,CACT,IAAI,EACJ,OAAO,GAAG,aAAa,QAAQ,CAAC,MAAM,iBAAiB,EACvD,QAAQ,CAAC,MAAM,KAAK,GAAG;YACrB,CAAC,CAAC,8FAA8F;gBAC5F,+FAA+F;gBAC/F,wBAAwB;YAC5B,CAAC,CAAC,gFAAgF,CACrF,CAAC;IACJ,CAAC;IAED,IAAI,QAAiB,CAAC;IACtB,IAAI,CAAC;QACH,QAAQ,GAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC,QAAQ,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,uBAAuB,EAAE,yDAAyD,CAAC,CAAC;IAC9G,CAAC;IAED,IAAI,QAAQ,KAAK,gBAAgB,EAAE,CAAC;QAClC,OAAO,IAAI,CACT,IAAI,EACJ,GAAG,GAAG,oBAAoB,MAAM,CAAC,QAAQ,CAAC,gBAAgB,gBAAgB,IAAI,EAC9E,mGAAmG;YACjG,+BAA+B,CAClC,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC,IAAI,EAAE,OAAO,GAAG,+BAA+B,QAAQ,GAAG,CAAC,CAAC;AAC1E,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,IAAY;IACtD,MAAM,IAAI,GAAG,oBAAoB,CAAC;IAClC,MAAM,GAAG,GAAG,WAAW,IAAI,GAAG,IAAI,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,yBAAyB,EAAE,CAAC,CAAC;IAErE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC,IAAI,EAAE,wBAAwB,GAAG,0BAA0B,QAAQ,CAAC,KAAK,EAAE,EAAE,6CAA6C,CAAC,CAAC;IAC1I,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO,IAAI,CACT,IAAI,EACJ,wBAAwB,GAAG,aAAa,QAAQ,CAAC,MAAM,iBAAiB,EACxE,QAAQ,CAAC,MAAM,KAAK,GAAG;YACrB,CAAC,CAAC,8HAA8H;YAChI,CAAC,CAAC,oFAAoF,CACzF,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;IAClE,MAAM,QAAQ,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CACT,IAAI,EACJ,2EAA2E,SAAS,IAAI,EACxF,wEAAwE,CACzE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,MAAM,EAAE,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC1D,OAAO,IAAI,CACT,IAAI,EACJ,mCAAmC,QAAQ,mCAAmC,IAAI,GAAG,EACrF,kGAAkG;YAChG,uEAAuE,CAC1E,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC,IAAI,EAAE,8BAA8B,QAAQ,GAAG,CAAC,CAAC;AAC/D,CAAC;AAED,+EAA+E;AAC/E,SAAS,qBAAqB,CAAC,SAAiB;IAC9C,MAAM,KAAK,GAAG,kDAAkD,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACjF,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;AAC/C,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAE,IAAa;IAC5C,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,GAAY;IAChC,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,MAAc,EAAe,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;AAC3F,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,MAAc,EAAe,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;AAC1G,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,MAAc,EAAE,MAAc,EAAe,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC"}

package/dist/version.d.ts

@@ -0,0 +1,10 @@
+/**
+ * The CLI's version, read from package.json rather than restated in source. It used to be typed
+ * out in program.ts and in the MCP server, and both copies drifted from package.json.
+ *
+ * Read at runtime instead of imported: package.json sits outside tsconfig's `rootDir` (src), so a
+ * JSON import would either break the build or force a layout change. `../package.json` is the same
+ * relative path from `src/` (tsx, tests) and from `dist/` (the published build), and npm always
+ * ships package.json with the package.
+ */
+export declare const cliVersion: string;

package/dist/version.js

@@ -0,0 +1,27 @@
+import { readFileSync } from "node:fs";
+/**
+ * The CLI's version, read from package.json rather than restated in source. It used to be typed
+ * out in program.ts and in the MCP server, and both copies drifted from package.json.
+ *
+ * Read at runtime instead of imported: package.json sits outside tsconfig's `rootDir` (src), so a
+ * JSON import would either break the build or force a layout change. `../package.json` is the same
+ * relative path from `src/` (tsx, tests) and from `dist/` (the published build), and npm always
+ * ships package.json with the package.
+ */
+export const cliVersion = readCliVersion();
+function readCliVersion() {
+    const manifest = new URL("../package.json", import.meta.url);
+    let version;
+    try {
+        version = JSON.parse(readFileSync(manifest, "utf8")).version;
+    }
+    catch (err) {
+        const reason = err instanceof Error ? err.message : String(err);
+        throw new Error(`Cannot read the CLI version from package.json: ${reason}`);
+    }
+    if (typeof version !== "string" || version.length === 0) {
+        throw new Error("package.json has no version, so the CLI cannot report one.");
+    }
+    return version;
+}
+//# sourceMappingURL=version.js.map

package/dist/version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,UAAU,GAAW,cAAc,EAAE,CAAC;AAEnD,SAAS,cAAc;IACrB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7D,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAI,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAA2B,CAAC,OAAO,CAAC;IAC1F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,kDAAkD,MAAM,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "authflow-cli",
-  "version": "0.4.1",
+  "version": "0.6.0",
   "description": "Authflow Rail onboarding CLI — register, mint-header, probe, scaffold",
   "type": "module",
   "bin": {
@@ -12,7 +12,7 @@
     "README.md"
   ],
   "scripts": {
-    "build": "tsc",
+    "build": "tsc && node scripts/copy-integration-plans.mjs",
     "start": "node dist/cli.js",
     "authflow": "tsx src/cli.ts",
     "test": "node --import tsx --test \"test/**/*.test.ts\"",
@@ -23,6 +23,7 @@
     "node": ">=20"
   },
   "dependencies": {
+    "@napi-rs/keyring": "2.1.0",
     "@modelcontextprotocol/sdk": "^1.30.0",
     "commander": "^13.1.0",
     "zod": "^4.5.4"
@@ -34,12 +35,12 @@
   },
   "homepage": "https://docs.authflow.ai/docs/tools/cli",
   "bugs": {
-    "url": "https://github.com/Snyder-Technology-LLC/Authflow.Rail/issues"
+    "url": "https://github.com/Snyder-Technology-LLC/Authflow/issues"
   },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/Snyder-Technology-LLC/Authflow.Rail.git",
-    "directory": "sdk/cli"
+    "url": "git+https://github.com/Snyder-Technology-LLC/Authflow.git",
+    "directory": "rail/sdk/cli"
   },
   "keywords": [
     "mcp",