authflow-cli 0.4.1 → 0.6.0

package/dist/custom-domain.js

@@ -0,0 +1,289 @@
+/**
+ * Everything about a tenant-owned hostname that more than one front end needs: validating what the
+ * user typed, showing the DNS records they have to create, and waiting for the rail to confirm them.
+ * `set-domain`, the `authflow_set_custom_domain` tool, `status`, and `register` all render the same
+ * records, so they render them from here; a table that differs between the CLI and the agent path is
+ * how a tenant ends up adding the wrong record.
+ */
+/** The public MCP path when a tenant does not choose one. */
+export const defaultPublicPath = "/mcp";
+/** How often verification is re-checked while waiting. Each call makes the rail do real DNS lookups. */
+export const waitIntervalMs = 15_000;
+/** Default `set-domain --wait` budget: DNS propagation plus certificate issuance. */
+export const defaultWaitTimeoutSeconds = 1800;
+/**
+ * How long the MCP tool waits. A tool call that outlives the client's request timeout (60 s is the
+ * SDK default and common in hosts) is dropped along with its result, so the tool waits less than
+ * that, reports where things stand, and tells the agent to call again. The client's clock also
+ * covers the request that sets the host and the last verification still in flight when the wait
+ * ends, which is why this is well short of 60 s rather than just under it.
+ */
+export const mcpWaitTimeoutMs = 45_000;
+const failureStates = new Set(["moved", "blocked", "removed"]);
+/** Consecutive verification errors tolerated while waiting before the error is surfaced. */
+const maxConsecutiveFailures = 3;
+/** While nothing changes, say so about once a minute at the default interval. */
+const heartbeatEveryPolls = 4;
+/**
+ * Normalises a hostname the user typed and rejects the things that are not one. The rail validates
+ * too; this exists because the likeliest mistake is pasting the MCP URL, and the rail's 400 does not
+ * say that.
+ */
+export function parsePublicHost(input, flag = "--host", 
+/** Where the path goes, for the error. Null when the caller has no path to offer. */
+pathFlag = "--path") {
+    const host = input.trim().toLowerCase().replace(/\.$/, "");
+    if (host.length === 0 || /[/:?#@*\s]/.test(host)) {
+        throw new Error(`${flag} must be a bare hostname such as mcp.example.com, with no scheme, path, port or ` +
+            `wildcard (got '${input.trim()}').${pathFlag ? ` The path goes in ${pathFlag}.` : ""}`);
+    }
+    if (!/^[a-z0-9_]([a-z0-9_.-]*[a-z0-9_])?$/.test(host)) {
+        throw new Error(`${flag} '${input.trim()}' is not a plain ASCII hostname. Use the punycode (xn--) form for a ` +
+            "non-ASCII name.");
+    }
+    if (!host.includes(".")) {
+        throw new Error(`${flag} must be the full hostname, such as mcp.example.com, not just '${host}'. ` +
+            "(The short form belongs in your registrar's Name column, not here.)");
+    }
+    return host;
+}
+export function parsePublicPath(input, flag = "--path") {
+    const path = input.trim();
+    if (!path.startsWith("/")) {
+        throw new Error(`${flag} must start with '/', for example ${defaultPublicPath} (got '${path}').`);
+    }
+    return path;
+}
+/**
+ * A 200 from the rail that carries no `custom_domain` has nothing to show or wait on. It means the
+ * rail predates custom domains or something upstream dropped the object; either way, say so rather
+ * than print an empty table and report success.
+ */
+export function assertCustomDomainReturned(receipt, host, slug) {
+    if (!receipt.custom_domain) {
+        throw new Error(`The rail returned no custom_domain for ${host} on ${slug}, so there are no records to show. ` +
+            "Is the rail new enough to support custom domains?");
+    }
+}
+/**
+ * Re-verifying means re-checking a host that is already there. A resource with none has nothing to
+ * verify, and the bare error from asking the rail anyway would not say how to fix it, so say that
+ * plainly and name the argument that sets one. Returns the host the resource is registered on.
+ */
+export function assertCustomDomainSet(receipt, slug, hostFlag = "--host") {
+    const host = receipt.public_host?.trim();
+    if (!host) {
+        throw new Error(`no custom domain set on ${slug}; pass ${hostFlag}`);
+    }
+    return host;
+}
+export function customDomainState(receipt) {
+    return receipt.custom_domain?.state?.trim().toLowerCase() || undefined;
+}
+export function isCustomDomainFailure(state) {
+    return state !== undefined && failureStates.has(state);
+}
+/** One line on what a state means, for the person staring at it. */
+export function describeCustomDomainState(state) {
+    switch (state) {
+        case "awaiting_ownership":
+            return "waiting for the ownership TXT record";
+        case "provisioning":
+            return "ownership verified; provisioning the hostname and certificate";
+        case "awaiting_traffic":
+            return "waiting for the traffic and certificate CNAMEs";
+        case "ready":
+            return "the hostname is serving traffic";
+        case "moved":
+            return "DNS no longer points at Authflow";
+        case "blocked":
+            return "the hostname is blocked";
+        case "removed":
+            return "the hostname was removed";
+        case undefined:
+            return "the rail reported no custom-domain state";
+        default:
+            return "a state this CLI does not know; see last_error";
+    }
+}
+/** `awaiting_traffic (waiting for the traffic and certificate CNAMEs)`, plus the rail's last error. */
+export function summarizeCustomDomain(receipt) {
+    const state = customDomainState(receipt);
+    const error = receipt.custom_domain?.last_error?.trim();
+    return `${state ?? "unknown"} (${describeCustomDomainState(state)})${error ? ` - ${error}` : ""}`;
+}
+/** The records as an aligned TYPE / NAME / VALUE / PURPOSE table, in the order the rail listed them. */
+export function formatDnsRecords(records) {
+    const rows = [
+        ["TYPE", "NAME", "VALUE", "PURPOSE"],
+        ...records.map((record) => [
+            String(record.type ?? ""),
+            String(record.name ?? ""),
+            String(record.value ?? ""),
+            String(record.purpose ?? ""),
+        ]),
+    ];
+    const widths = [0, 1, 2].map((column) => Math.max(...rows.map((row) => row[column].length)));
+    return rows.map((row) => `${row[0].padEnd(widths[0])}  ${row[1].padEnd(widths[1])}  ${row[2].padEnd(widths[2])}  ${row[3]}`.trimEnd());
+}
+/**
+ * Registrars disagree about the Name column. GoDaddy and several others append the domain
+ * themselves, so a full name there produces `mcp.example.com.example.com` and a record that
+ * silently never matches.
+ */
+export function registrarNameHint(host) {
+    const labels = host.split(".");
+    const intro = "Registrars such as GoDaddy usually want only the host part of the name, not the full name";
+    if (labels.length < 3) {
+        return [`${intro}: leave your domain off.`];
+    }
+    const relative = labels.slice(0, -2).join(".");
+    return [
+        `${intro}:`,
+        `for ${host} enter "${relative}", and for _authflow-verify.${host} enter "_authflow-verify.${relative}".`,
+    ];
+}
+/** The "add these records" block shared by every front end. Empty when the rail listed none. */
+export function dnsInstructions(receipt) {
+    const records = receipt.custom_domain?.records ?? [];
+    if (records.length === 0) {
+        return [];
+    }
+    const lines = [
+        "Add these DNS records at your registrar:",
+        "",
+        ...formatDnsRecords(records).map((line) => `  ${line}`),
+        "",
+    ];
+    const host = receipt.public_host?.trim();
+    if (host) {
+        lines.push(...registrarNameHint(host));
+    }
+    // The certificate record only exists once provisioning has begun, which is after ownership is
+    // verified. Without saying so, a tenant who sees two records adds two and wonders about the third.
+    const state = customDomainState(receipt);
+    if (!records.some((record) => record.purpose === "certificate") &&
+        state !== "ready" &&
+        !isCustomDomainFailure(state)) {
+        lines.push("", "The certificate record (_acme-challenge) is listed once provisioning begins, after ownership", "is verified. Check again once the ownership TXT record is in place.");
+    }
+    return lines;
+}
+/**
+ * The command that re-checks the host already set on a resource. It names no host and no path: the
+ * rail keeps both, so there is nothing to retype and nothing to get wrong on a re-run.
+ */
+export function setDomainCommandLine(slug) {
+    return `authflow set-domain --slug ${slug} --wait`;
+}
+/**
+ * Polls verification until the domain is ready, fails, or the budget runs out. Verifies straight
+ * away and then every interval: a tenant who re-runs after adding their records should not wait a
+ * full interval to hear it worked.
+ *
+ * `ready` and the failure states settle it. Anything else, including a state this CLI has never
+ * heard of, keeps waiting, so a rail that adds a state does not break an old CLI.
+ */
+export async function waitForCustomDomain(initial, options) {
+    const intervalMs = options.intervalMs ?? waitIntervalMs;
+    const sleep = options.sleep ?? defaultSleep;
+    const now = options.now ?? Date.now;
+    const started = now();
+    const deadline = started + options.timeoutMs;
+    const progress = [];
+    const emit = (line) => {
+        progress.push(line);
+        options.onProgress?.(line);
+    };
+    const stamp = () => `[${formatClock(now() - started)}]`;
+    const finish = (outcome, receipt, polls) => ({
+        outcome,
+        receipt,
+        polls,
+        elapsedMs: now() - started,
+        progress,
+    });
+    let receipt = initial;
+    const already = verdict(receipt);
+    if (already) {
+        return finish(already, receipt, 0);
+    }
+    emit(`Checking every ${formatDuration(intervalMs)}, giving up after ${formatDuration(options.timeoutMs)}.`);
+    const seen = new Set((receipt.custom_domain?.records ?? []).map(recordKey));
+    let lastSummary = summarizeCustomDomain(receipt);
+    let polls = 0;
+    let failures = 0;
+    for (;;) {
+        let fresh;
+        try {
+            fresh = await options.verify();
+        }
+        catch (err) {
+            // A 30-minute wait should not die on one dropped connection, but a persistent error (a bad
+            // key, a rail that is down) must not be retried until the deadline either.
+            failures += 1;
+            if (failures >= maxConsecutiveFailures) {
+                throw err;
+            }
+            emit(`${stamp()} verification failed (${errorMessage(err)}); will retry`);
+        }
+        if (fresh) {
+            failures = 0;
+            polls += 1;
+            receipt = fresh;
+            const summary = summarizeCustomDomain(receipt);
+            if (summary !== lastSummary || polls === 1 || polls % heartbeatEveryPolls === 0) {
+                emit(`${stamp()} ${summary}`);
+                lastSummary = summary;
+            }
+            // The certificate record appears mid-wait, after ownership verifies. Saying so here is the
+            // difference between "waiting on DNS" and "waiting on a record nobody knows to add".
+            const appeared = (receipt.custom_domain?.records ?? []).filter((record) => !seen.has(recordKey(record)));
+            if (appeared.length > 0) {
+                for (const record of appeared) {
+                    seen.add(recordKey(record));
+                }
+                emit(`${stamp()} new DNS record${appeared.length === 1 ? "" : "s"} to add:`);
+                for (const line of formatDnsRecords(appeared)) {
+                    emit(`  ${line}`);
+                }
+            }
+            const outcome = verdict(receipt);
+            if (outcome) {
+                return finish(outcome, receipt, polls);
+            }
+        }
+        const remaining = deadline - now();
+        if (remaining <= 0) {
+            return finish("timeout", receipt, polls);
+        }
+        await sleep(Math.min(intervalMs, remaining));
+    }
+}
+function verdict(receipt) {
+    const state = customDomainState(receipt);
+    if (state === "ready") {
+        return "ready";
+    }
+    return isCustomDomainFailure(state) ? "failed" : undefined;
+}
+function recordKey(record) {
+    return `${record.type}|${record.name}|${record.value}`;
+}
+function errorMessage(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+function defaultSleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/** `1:05` for 65 seconds. */
+function formatClock(ms) {
+    const total = Math.max(0, Math.floor(ms / 1000));
+    return `${Math.floor(total / 60)}:${String(total % 60).padStart(2, "0")}`;
+}
+/** `15s`, `50s`, `30m`. */
+export function formatDuration(ms) {
+    const seconds = Math.round(ms / 1000);
+    return seconds >= 120 && seconds % 60 === 0 ? `${seconds / 60}m` : `${seconds}s`;
+}
+//# sourceMappingURL=custom-domain.js.map

package/dist/custom-domain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-domain.js","sourceRoot":"","sources":["../src/custom-domain.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AAEH,6DAA6D;AAC7D,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAExC,wGAAwG;AACxG,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC;AAErC,qFAAqF;AACrF,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAE9C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEvC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;AAE/D,4FAA4F;AAC5F,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAEjC,iFAAiF;AACjF,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAE9B;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,KAAa,EACb,IAAI,GAAG,QAAQ;AACf,qFAAqF;AACrF,WAA0B,QAAQ;IAElC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAE3D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,kFAAkF;YACvF,kBAAkB,KAAK,CAAC,IAAI,EAAE,MAAM,QAAQ,CAAC,CAAC,CAAC,qBAAqB,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACzF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,qCAAqC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,KAAK,KAAK,CAAC,IAAI,EAAE,sEAAsE;YAC5F,iBAAiB,CACpB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,kEAAkE,IAAI,KAAK;YAChF,qEAAqE,CACxE,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,IAAI,GAAG,QAAQ;IAC5D,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,qCAAqC,iBAAiB,UAAU,IAAI,KAAK,CAAC,CAAC;IACpG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAA4B,EAAE,IAAY,EAAE,IAAY;IACjG,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,0CAA0C,IAAI,OAAO,IAAI,qCAAqC;YAC5F,mDAAmD,CACtD,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAA4B,EAAE,IAAY,EAAE,QAAQ,GAAG,QAAQ;IACnG,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;IACzC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,UAAU,QAAQ,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAA4B;IAC5D,OAAO,OAAO,CAAC,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,SAAS,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAyB;IAC7D,OAAO,KAAK,KAAK,SAAS,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,yBAAyB,CAAC,KAAyB;IACjE,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,oBAAoB;YACvB,OAAO,sCAAsC,CAAC;QAChD,KAAK,cAAc;YACjB,OAAO,+DAA+D,CAAC;QACzE,KAAK,kBAAkB;YACrB,OAAO,gDAAgD,CAAC;QAC1D,KAAK,OAAO;YACV,OAAO,iCAAiC,CAAC;QAC3C,KAAK,OAAO;YACV,OAAO,kCAAkC,CAAC;QAC5C,KAAK,SAAS;YACZ,OAAO,yBAAyB,CAAC;QACnC,KAAK,SAAS;YACZ,OAAO,0BAA0B,CAAC;QACpC,KAAK,SAAS;YACZ,OAAO,0CAA0C,CAAC;QACpD;YACE,OAAO,gDAAgD,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,qBAAqB,CAAC,OAA4B;IAChE,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,OAAO,CAAC,aAAa,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACxD,OAAO,GAAG,KAAK,IAAI,SAAS,KAAK,yBAAyB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACpG,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,gBAAgB,CAAC,OAAsC;IACrE,MAAM,IAAI,GAAG;QACX,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC;QACpC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YACzB,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACzB,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACzB,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;SAC7B,CAAC;KACH,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAE7F,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CACtB,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,CAC7G,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,2FAA2F,CAAC;IAC1G,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,KAAK,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/C,OAAO;QACL,GAAG,KAAK,GAAG;QACX,OAAO,IAAI,WAAW,QAAQ,+BAA+B,IAAI,4BAA4B,QAAQ,IAAI;KAC1G,CAAC;AACJ,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,eAAe,CAAC,OAA4B;IAC1D,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,EAAE,OAAO,IAAI,EAAE,CAAC;IACrD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAG;QACZ,0CAA0C;QAC1C,EAAE;QACF,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;QACvD,EAAE;KACH,CAAC;IAEF,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;IACzC,IAAI,IAAI,EAAE,CAAC;QACT,KAAK,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,8FAA8F;IAC9F,mGAAmG;IACnG,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACzC,IACE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,KAAK,aAAa,CAAC;QAC3D,KAAK,KAAK,OAAO;QACjB,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAC7B,CAAC;QACD,KAAK,CAAC,IAAI,CACR,EAAE,EACF,8FAA8F,EAC9F,qEAAqE,CACtE,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,OAAO,8BAA8B,IAAI,SAAS,CAAC;AACrD,CAAC;AA0BD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAA4B,EAC5B,OAAoB;IAEpB,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,cAAc,CAAC;IACxD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,YAAY,CAAC;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC;IACtB,MAAM,QAAQ,GAAG,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC;IAC7C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,MAAM,IAAI,GAAG,CAAC,IAAY,EAAQ,EAAE;QAClC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,GAAW,EAAE,CAAC,IAAI,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC;IAChE,MAAM,MAAM,GAAG,CAAC,OAAoB,EAAE,OAA4B,EAAE,KAAa,EAAc,EAAE,CAAC,CAAC;QACjG,OAAO;QACP,OAAO;QACP,KAAK;QACL,SAAS,EAAE,GAAG,EAAE,GAAG,OAAO;QAC1B,QAAQ;KACT,CAAC,CAAC;IAEH,IAAI,OAAO,GAAG,OAAO,CAAC;IACtB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,CAAC,kBAAkB,cAAc,CAAC,UAAU,CAAC,qBAAqB,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAE5G,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5E,IAAI,WAAW,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,SAAS,CAAC;QACR,IAAI,KAAsC,CAAC;QAC3C,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,2FAA2F;YAC3F,2EAA2E;YAC3E,QAAQ,IAAI,CAAC,CAAC;YACd,IAAI,QAAQ,IAAI,sBAAsB,EAAE,CAAC;gBACvC,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,IAAI,CAAC,GAAG,KAAK,EAAE,yBAAyB,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC5E,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACV,QAAQ,GAAG,CAAC,CAAC;YACb,KAAK,IAAI,CAAC,CAAC;YACX,OAAO,GAAG,KAAK,CAAC;YAEhB,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;YAC/C,IAAI,OAAO,KAAK,WAAW,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,GAAG,mBAAmB,KAAK,CAAC,EAAE,CAAC;gBAChF,IAAI,CAAC,GAAG,KAAK,EAAE,IAAI,OAAO,EAAE,CAAC,CAAC;gBAC9B,WAAW,GAAG,OAAO,CAAC;YACxB,CAAC;YAED,2FAA2F;YAC3F,qFAAqF;YACrF,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAC5D,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CACzC,CAAC;YACF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;oBAC9B,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC9B,CAAC;gBACD,IAAI,CAAC,GAAG,KAAK,EAAE,kBAAkB,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC;gBAC7E,KAAK,MAAM,IAAI,IAAI,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC9C,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;gBACpB,CAAC;YACH,CAAC;YAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YACjC,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,QAAQ,GAAG,GAAG,EAAE,CAAC;QACnC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACnB,OAAO,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,OAA4B;IAC3C,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACtB,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAED,SAAS,SAAS,CAAC,MAA0B;IAC3C,OAAO,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;AACzD,CAAC;AAED,SAAS,YAAY,CAAC,GAAY;IAChC,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,YAAY,CAAC,EAAU;IAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,6BAA6B;AAC7B,SAAS,WAAW,CAAC,EAAU;IAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IACjD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED,2BAA2B;AAC3B,MAAM,UAAU,cAAc,CAAC,EAAU;IACvC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IACtC,OAAO,OAAO,IAAI,GAAG,IAAI,OAAO,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,OAAO,GAAG,CAAC;AACnF,CAAC"}

package/dist/doctor.d.ts

@@ -1,3 +1,8 @@
+import { fetchOrNull, type DoctorCheck } from "./checks.js";
+import { type ResourceEndpoints } from "./resource-urls.js";
+import { type HostProbes } from "./tenant-host.js";
+export { fetchOrNull };
+export type { DoctorCheck, FetchOutcome } from "./checks.js";
 /**
  * Preflight against a rail deployment, from a tenant's point of view.
  *
@@ -8,41 +13,44 @@
  * showed up again as 500 HTML on /login (and the other consumer pages) when returnUrl is
  * missing — it looks like an outage, it is an unhandled throw. These checks do.
  */
-export type DoctorCheck = {
-    name: string;
-    pass: boolean;
-    detail: string;
-    /** What to do about it. Empty when the check passed. */
-    remedy?: string;
-};
 export type DoctorReport = {
     issuer: string;
     slug?: string;
+    /** Tenant hostname whose DNS, certificate and discovery documents were checked (`--host`). */
+    host?: string;
+    /**
+     * Where the resource's PRM and 401 challenge were probed, so the checks that follow (the Google
+     * redirect) look at the same URLs. Only present when a slug was given.
+     */
+    endpoints?: ResourceEndpoints;
     /** MCP clients whose OAuth registration was replayed; absent when `--client` was not passed. */
     clients?: string[];
     dryRun?: boolean;
+    /** True when the slug is a correct draft: paywall 404s are expected, not a rail outage. */
+    draft?: boolean;
     pass: boolean;
     checks: DoctorCheck[];
 };
-export declare function runDoctor(issuer: string, slug?: string): Promise<DoctorReport>;
+export type DoctorOptions = HostProbes & {
+    adminKey?: string;
+    /**
+     * A tenant's own hostname to verify end to end (DNS, TLS, redirect, PRM, 401). It supersedes the
+     * slug's own PRM and challenge checks, which would probe the same URLs a second time; the slug
+     * then only selects the receipt the host is compared against.
+     */
+    host?: string;
+};
+export declare function runDoctor(issuer: string, slug?: string, options?: DoctorOptions): Promise<DoctorReport>;
 export declare function checkConsumerPages(base: string): Promise<DoctorCheck>;
 /**
  * The paywall is a transport-level 401 carrying `resource_metadata`. If this is not exactly right,
  * MCP clients never prompt for auth, which presents as "the server just does not work in Claude".
+ *
+ * `target` is where the resource actually answers (from the receipt). Without it the slug URL on
+ * the issuer is assumed, which is only true for a resource on the gateway host.
  */
-/**
- * The paywall is a transport-level 401 carrying `resource_metadata`. If this is not exactly right,
- * MCP clients never prompt for auth, which presents as "the server just does not work in Claude".
- */
-export declare function checkGatewayChallenge(base: string, slug: string): Promise<DoctorCheck>;
-export type FetchOutcome = {
-    ok: boolean;
-    status?: number;
-    body?: string;
-    headers?: Headers;
-    location?: string;
-    error?: string;
-};
-/** Network failures are a diagnosis here, not an exception — every one of them is a real finding. */
-export declare function fetchOrNull(url: string, init?: RequestInit): Promise<FetchOutcome>;
+export declare function checkGatewayChallenge(base: string, slug: string, draft?: boolean, target?: {
+    url: string;
+    publicHost?: string;
+}): Promise<DoctorCheck>;
 export declare function formatDoctorReport(report: DoctorReport): string;