authflow-cli 0.4.1 → 0.6.0

package/dist/secrets.js

@@ -1,117 +1,228 @@
 import { spawn } from "node:child_process";
-import { appendFile, chmod, readFile, writeFile } from "node:fs/promises";
-import { dirname, resolve } from "node:path";
+import { createHash, randomBytes } from "node:crypto";
+import { constants } from "node:fs";
+import { access, appendFile, lstat, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
+import { basename, dirname, join, resolve } from "node:path";
 export const secretTargets = ["user-secrets", "env-file", "keyvault"];
-/** Config key the .NET verifier and the origin proxy both read the usage-reporting key from. */
 export const originApiKeyConfigKey = "Authflow:OriginApiKey";
-/** Environment variable form of the same setting, for non-.NET origins. */
 export const originApiKeyEnvVar = "AUTHFLOW_ORIGIN_API_KEY";
-/** Per-tenant admin key used by `init`, `register`, and `authflow mcp`. */
 export const adminApiKeyEnvVar = "AUTHFLOW_ADMIN_API_KEY";
-/** Human-readable description of where the secret landed, for the receipt and console. */
-/** Writes AUTHFLOW_ADMIN_API_KEY to an env file. Signup's default so the key is not only in stdout. */
-export async function writeAdminApiKey(request) {
-    return writeNamedEnvVar(adminApiKeyEnvVar, request.value, request.destination);
+/** Resolve the destination before a one-time key is issued. Never prints child output or secrets. */
+export async function prepareOriginApiKey(request) {
+    if (!secretTargets.includes(request.target))
+        throw new Error("Choose user-secrets, env-file, or keyvault.");
+    if (!request.destination?.trim())
+        throw new Error("Choose an explicit --secret-destination before issuing an origin key.");
+    if (request.target === "user-secrets") {
+        const path = resolve(request.destination);
+        let project = path;
+        if ((await stat(path)).isDirectory()) {
+            const projects = (await readdir(path)).filter(name => /\.(cs|fs|vb)proj$/i.test(name));
+            if (projects.length !== 1)
+                throw new Error("The user-secrets destination must identify one .NET project.");
+            project = join(path, projects[0]);
+        }
+        const inspected = await secretProcess.run("dotnet", ["msbuild", project, "-getProperty:UserSecretsId", "-nologo"]);
+        if (inspected.code !== 0 || !inspected.stdout.trim() || /[\r\n]/.test(inspected.stdout.trim()))
+            throw new Error("The project must have a UserSecretsId. Initialize user-secrets in that project before issuing the key.");
+        return {
+            description: `dotnet user-secrets (${originApiKeyConfigKey}) in ${project}`,
+            write: async (value) => {
+                const result = await secretProcess.run("dotnet", ["user-secrets", "set", "--project", project], JSON.stringify({ [originApiKeyConfigKey]: value }));
+                if (result.code !== 0)
+                    throw new Error("The origin key could not be saved to .NET user-secrets.");
+            },
+        };
+    }
+    if (request.target === "env-file")
+        return prepareEnvFile(originApiKeyEnvVar, request.destination);
+    const vault = request.destination.toLowerCase();
+    if (!/^[a-z][a-z0-9-]{1,22}[a-z0-9]$/.test(vault) || vault.includes("--"))
+        throw new Error("The Key Vault destination must be an Azure vault name, not a URL.");
+    if (!request.resource)
+        throw new Error("Key Vault delivery requires a workspace-scoped resource command.");
+    const name = originSecretName(request.resource);
+    const login = await secretProcess.run("az", ["account", "get-access-token", "--resource", "https://vault.azure.net", "--query", "accessToken", "--output", "tsv", "--only-show-errors"]);
+    const token = login.stdout.trim();
+    if (login.code !== 0 || !token || /\s/.test(token))
+        throw new Error("Sign in to the intended Azure account before issuing the origin key.");
+    const reference = `https://${vault}.vault.azure.net/secrets/${name}`;
+    await preflightVault(reference, token);
+    return {
+        description: reference,
+        write: async (value) => {
+            let response;
+            try {
+                response = await fetch(`${reference}?api-version=7.4`, {
+                    method: "PUT", redirect: "error", signal: AbortSignal.timeout(30_000),
+                    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+                    body: JSON.stringify({ value }),
+                });
+            }
+            catch {
+                throw new Error("Key Vault delivery failed. The key may not have been saved; inspect the destination before rotating again.");
+            }
+            // Key Vault responses can include the secret value. Neither success nor error bodies are printed.
+            if (!response.ok)
+                throw new Error(`Key Vault refused secret delivery (${response.status}). Check the selected account, vault and secret-write permission.`);
+            await response.body?.cancel();
+        },
+    };
 }
-export async function writeOriginApiKey(request) {
-    switch (request.target) {
-        case "user-secrets":
-            return writeUserSecret(request);
-        case "env-file":
-            return writeEnvFile(request);
-        case "keyvault":
-            return writeKeyVault(request);
+async function preflightVault(reference, token) {
+    let response;
+    try {
+        // Versions list returns metadata only. Never retrieve the existing secret value.
+        response = await fetch(`${reference}/versions?api-version=7.4&maxresults=1`, {
+            method: "GET", redirect: "error", signal: AbortSignal.timeout(15_000),
+            headers: { Authorization: `Bearer ${token}` },
+        });
+    }
+    catch {
+        throw new Error("The selected Key Vault could not be reached. Fix the destination before issuing the origin key.");
+    }
+    if (response.ok) {
+        await response.body?.cancel();
+        return;
+    }
+    const codes = [];
+    try {
+        const reader = response.body?.getReader();
+        const chunks = [];
+        let length = 0;
+        if (reader) {
+            try {
+                for (;;) {
+                    const { value, done } = await reader.read();
+                    if (done)
+                        break;
+                    length += value.byteLength;
+                    if (length > 16_384)
+                        throw new Error("Oversized metadata error.");
+                    chunks.push(value);
+                }
+            }
+            finally {
+                await reader.cancel();
+            }
+        }
+        let error = JSON.parse(Buffer.concat(chunks).toString("utf8")).error;
+        for (let depth = 0; depth < 4 && error && typeof error === "object"; depth++) {
+            const current = error;
+            if (typeof current.code === "string")
+                codes.push(current.code.toLowerCase());
+            error = current.innererror;
+        }
     }
+    catch { /* No response content or diagnostic message is ever exposed. */ }
+    if (codes.some(code => ["vaultnotfound", "forbiddenbyfirewall", "forbiddenbyconnection"].includes(code)))
+        throw new Error("The selected Key Vault is unavailable or blocks this connection. Fix the destination before issuing the origin key.");
+    if (response.status === 404 && codes.includes("secretnotfound"))
+        return;
+    // Listing and writing have separate permissions; a valid write-only principal may receive 403.
+    // This probe establishes reachability, not secrets/set authorization. Delivery still may fail.
+    if (response.status === 403)
+        return;
+    throw new Error(`Key Vault destination preflight failed (${response.status}). Check the selected account and vault before issuing the origin key.`);
 }
-async function writeUserSecret(request) {
-    const project = request.destination ?? ".";
-    await run("dotnet", ["user-secrets", "set", originApiKeyConfigKey, request.value, "--project", project]);
-    return `dotnet user-secrets (${originApiKeyConfigKey}) in ${resolve(project)}`;
+/** Stable across retries; separates resources, workspaces and staging/production issuers. */
+export function originSecretName(resource) {
+    if (!/^[a-z0-9][a-z0-9-]{0,31}$/.test(resource.slug) || !resource.issuer || !resource.workspaceId)
+        throw new Error("A scoped resource is required to name its origin secret.");
+    const scope = createHash("sha256").update(JSON.stringify([resource.issuer.replace(/\/+$/, ""), resource.workspaceId, resource.slug])).digest("hex").slice(0, 16);
+    return `authflow-${resource.slug}-origin-${scope}`;
 }
-async function writeEnvFile(request) {
-    return writeNamedEnvVar(originApiKeyEnvVar, request.value, request.destination);
+export async function writeOriginApiKey(request) {
+    const prepared = await prepareOriginApiKey({ ...request, destination: request.destination ?? (request.target === "user-secrets" ? "." : request.target === "env-file" ? ".env.local" : undefined) });
+    await prepared.write(request.value);
+    return prepared.description;
 }
-async function writeNamedEnvVar(name, value, destination) {
-    const path = resolve(destination ?? ".env.local");
-    const line = `${name}=${value}\n`;
-    const existing = await readFileOrEmpty(path);
-    const next = existing ? `${stripVar(existing, name)}${line}` : line;
-    await writeFile(path, next, "utf8");
-    // Best-effort: a no-op on Windows, which is exactly why this is not the recommended target.
-    await chmod(path, 0o600).catch(() => undefined);
-    await ensureGitIgnored(path);
-    return path;
+export async function writeAdminApiKey(request) {
+    const prepared = await prepareEnvFile(adminApiKeyEnvVar, request.destination ?? ".env.local");
+    await prepared.write(request.value);
+    return prepared.description;
 }
-async function writeKeyVault(request) {
-    const vault = request.destination;
-    if (!vault) {
-        throw new Error("--secret-destination <vault-name> is required for --write-secrets keyvault.");
-    }
-    // Key Vault names cannot contain ':'; keep the mapping mechanical so it is guessable from config.
-    const name = originApiKeyConfigKey.replace(/:/g, "--");
-    await run("az", ["keyvault", "secret", "set", "--vault-name", vault, "--name", name, "--value", request.value]);
-    return `Azure Key Vault ${vault}/${name}`;
+async function prepareEnvFile(name, destination) {
+    const path = resolve(destination);
+    await access(dirname(path), constants.W_OK);
+    const existing = await lstat(path).catch((error) => { if (error.code === "ENOENT")
+        return undefined; throw error; });
+    if (existing && (!existing.isFile() || existing.isSymbolicLink()))
+        throw new Error("The env-file destination must be a regular file, not a symbolic link.");
+    if (existing)
+        await access(path, constants.W_OK);
+    const tracked = await secretProcess.run("git", ["-C", dirname(path), "ls-files", "--error-unmatch", "--", basename(path)]);
+    if (tracked.code === 0)
+        throw new Error("The env-file destination is tracked by git. Choose an untracked local secret file.");
+    if (tracked.code !== 1 && tracked.code !== 128)
+        throw new Error("Could not verify that the env-file destination is untracked.");
+    await readFileOrEmpty(path); // Permission/read failures must happen before key issuance where possible.
+    return {
+        description: path,
+        write: async (value) => {
+            if (/[\r\n]/.test(value))
+                throw new Error("An origin credential must fit on one env-file line.");
+            const current = await lstat(path).catch((error) => { if (error.code === "ENOENT")
+                return undefined; throw error; });
+            if (current && (!current.isFile() || current.isSymbolicLink()))
+                throw new Error("The env-file destination changed. Secret delivery stopped.");
+            const contents = await readFileOrEmpty(path);
+            const kept = contents.split(/\r?\n/).filter(line => !line.startsWith(`${name}=`)).join("\n").replace(/\n+$/, "");
+            const next = `${kept ? kept + "\n" : ""}${name}=${value}\n`;
+            await ensureGitIgnored(path);
+            const temporary = join(dirname(path), `.authflow-secret-${randomBytes(16).toString("hex")}`);
+            try {
+                await writeFile(temporary, next, { encoding: "utf8", mode: 0o600, flag: "wx" });
+                await rename(temporary, path);
+            }
+            finally {
+                await rm(temporary, { force: true });
+            }
+        },
+    };
 }
-/**
- * Adds the secret file to .gitignore if it is not already covered.
- *
- * Deliberately conservative: it only appends when the exact pattern is absent, because a
- * false-negative here costs one duplicate line and a false-positive leaks a credential.
- */
 async function ensureGitIgnored(secretPath) {
-    const gitignore = resolve(dirname(secretPath), ".gitignore");
-    const pattern = secretPath.split(/[/\\]/).pop();
-    if (!pattern) {
-        return;
-    }
+    const gitignore = join(dirname(secretPath), ".gitignore");
+    const pattern = `/${basename(secretPath).replace(/([*?\[\]\\])/g, "\\$1")}`;
     const existing = await readFileOrEmpty(gitignore);
-    if (existing.split(/\r?\n/).some((line) => line.trim() === pattern)) {
-        return;
-    }
-    const prefix = existing && !existing.endsWith("\n") ? "\n" : "";
-    await appendFile(gitignore, `${prefix}${pattern}\n`, "utf8");
+    if (!existing.split(/\r?\n/).some(line => line.trim() === pattern))
+        await appendFile(gitignore, `${existing && !existing.endsWith("\n") ? "\n" : ""}${pattern}\n`, "utf8");
 }
 async function readFileOrEmpty(path) {
     try {
         return await readFile(path, "utf8");
     }
-    catch {
-        return "";
+    catch (error) {
+        if (error.code === "ENOENT")
+            return "";
+        throw error;
     }
 }
-function stripVar(contents, name) {
-    const kept = contents
-        .split(/\r?\n/)
-        .filter((line) => !line.startsWith(`${name}=`))
-        .join("\n")
-        .replace(/\n+$/, "");
-    return kept ? `${kept}\n` : "";
-}
-/**
- * Runs a tool with the secret in argv.
- *
- * `shell: false` matters: the secret is passed as a discrete argument, so no shell ever parses it
- * and a value containing quotes or `$` cannot turn into a command.
- */
-function run(command, args) {
+/** One subprocess boundary for destination preflight and stdin delivery; all diagnostics are sanitized. */
+async function run(command, args, stdin) {
     return new Promise((resolvePromise, reject) => {
-        const child = spawn(command, [...args], { stdio: ["ignore", "ignore", "pipe"], shell: false });
-        let stderr = "";
-        child.stderr?.on("data", (chunk) => {
-            stderr += chunk.toString();
-        });
-        child.on("error", (err) => {
-            reject(err.code === "ENOENT"
-                ? new Error(`${command} was not found on PATH. Install it or use --write-secrets env-file.`)
-                : err);
-        });
-        child.on("close", (code) => {
-            if (code === 0) {
-                resolvePromise();
-                return;
+        // Azure CLI ships az.cmd on Windows. Its only invocation here has fixed, nonsecret arguments.
+        const windowsAzure = process.platform === "win32" && command === "az";
+        if (windowsAzure && args.some(arg => !/^[a-zA-Z0-9.:/-]+$/.test(arg))) {
+            reject(new Error("Unsafe Azure CLI arguments."));
+            return;
+        }
+        const child = spawn(windowsAzure ? (process.env.ComSpec ?? "cmd.exe") : command, windowsAzure ? ["/d", "/s", "/c", "az", ...args] : [...args], { stdio: ["pipe", "pipe", "ignore"], shell: false, windowsHide: true });
+        let stdout = "";
+        const timeout = setTimeout(() => { child.kill(); reject(new Error(`${command} timed out while preparing or writing the secret destination.`)); }, 60_000);
+        child.stdout.on("data", (chunk) => {
+            stdout += chunk.toString();
+            if (stdout.length > 1_048_576) {
+                child.kill();
+                reject(new Error(`${command} returned an unexpectedly large response.`));
             }
-            reject(new Error(`${command} exited with ${code}: ${stderr.trim().slice(0, 400)}`));
         });
+        child.stdin.on("error", () => { });
+        child.on("error", () => { clearTimeout(timeout); reject(new Error(`${command} is unavailable. Fix the destination before issuing the key.`)); });
+        child.on("close", code => { clearTimeout(timeout); resolvePromise({ code, stdout }); });
+        child.stdin.end(stdin);
     });
 }
+export const secretProcess = { run };
+export const secretDelivery = { prepare: prepareOriginApiKey };
 //# sourceMappingURL=secrets.js.map

package/dist/secrets.js.map

@@ -1 +1 @@
-{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAW7C,MAAM,CAAC,MAAM,aAAa,GAA4B,CAAC,cAAc,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;AAE/F,gGAAgG;AAChG,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AAE7D,2EAA2E;AAC3E,MAAM,CAAC,MAAM,kBAAkB,GAAG,yBAAyB,CAAC;AAE5D,2EAA2E;AAC3E,MAAM,CAAC,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AAS1D,0FAA0F;AAC1F,uGAAuG;AACvG,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAgD;IACrF,OAAO,gBAAgB,CAAC,iBAAiB,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAA2B;IACjE,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;QACvB,KAAK,cAAc;YACjB,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;QAClC,KAAK,UAAU;YACb,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;QAC/B,KAAK,UAAU;YACb,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,OAA2B;IACxD,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,IAAI,GAAG,CAAC;IAC3C,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,KAAK,EAAE,qBAAqB,EAAE,OAAO,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IACzG,OAAO,wBAAwB,qBAAqB,QAAQ,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,OAA2B;IACrD,OAAO,gBAAgB,CAAC,kBAAkB,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;AAClF,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,KAAa,EAAE,WAAoB;IAC/E,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,IAAI,YAAY,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC;IAElC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAEpE,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,4FAA4F;IAC5F,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAChD,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAE7B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,OAA2B;IACtD,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC;IAClC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IACjG,CAAC;IAED,kGAAkG;IAClG,MAAM,IAAI,GAAG,qBAAqB,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACvD,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAChH,OAAO,mBAAmB,KAAK,IAAI,IAAI,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,gBAAgB,CAAC,UAAkB;IAChD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,YAAY,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC;IAChD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;IAClD,IAAI,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC;QACpE,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,MAAM,UAAU,CAAC,SAAS,EAAE,GAAG,MAAM,GAAG,OAAO,IAAI,EAAE,MAAM,CAAC,CAAC;AAC/D,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAY;IACzC,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,QAAgB,EAAE,IAAY;IAC9C,MAAM,IAAI,GAAG,QAAQ;SAClB,KAAK,CAAC,OAAO,CAAC;SACd,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;SAC9C,IAAI,CAAC,IAAI,CAAC;SACV,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvB,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,SAAS,GAAG,CAAC,OAAe,EAAE,IAAuB;IACnD,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAE/F,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC7B,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;YAC/C,MAAM,CACJ,GAAG,CAAC,IAAI,KAAK,QAAQ;gBACnB,CAAC,CAAC,IAAI,KAAK,CAAC,GAAG,OAAO,qEAAqE,CAAC;gBAC5F,CAAC,CAAC,GAAG,CACR,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gBACf,cAAc,EAAE,CAAC;gBACjB,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,OAAO,gBAAgB,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACtF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7G,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAG7D,MAAM,CAAC,MAAM,aAAa,GAA4B,CAAC,cAAc,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;AAC/F,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AAC7D,MAAM,CAAC,MAAM,kBAAkB,GAAG,yBAAyB,CAAC;AAC5D,MAAM,CAAC,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AAe1D,qGAAqG;AACrG,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAA0C;IAClF,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAC5G,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IAC3H,IAAI,OAAO,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,OAAO,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACrC,MAAM,QAAQ,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACvF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;YAC3G,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,4BAA4B,EAAE,SAAS,CAAC,CAAC,CAAC;QACnH,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5F,MAAM,IAAI,KAAK,CAAC,wGAAwG,CAAC,CAAC;QAC5H,OAAO;YACL,WAAW,EAAE,wBAAwB,qBAAqB,QAAQ,OAAO,EAAE;YAC3E,KAAK,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;gBACnB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,qBAAqB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;gBACpJ,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;YACpG,CAAC;SACF,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU;QAAE,OAAO,cAAc,CAAC,kBAAkB,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAElG,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC;IAChD,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,IAAI,CAAC,OAAO,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IAC3G,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,SAAS,EAAE,kBAAkB,EAAE,YAAY,EAAE,yBAAyB,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,KAAK,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACzL,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC5I,MAAM,SAAS,GAAG,WAAW,KAAK,4BAA4B,IAAI,EAAE,CAAC;IACrE,MAAM,cAAc,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACvC,OAAO;QACL,WAAW,EAAE,SAAS;QACtB,KAAK,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;YACnB,IAAI,QAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,SAAS,kBAAkB,EAAE;oBACrD,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;oBACrE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBACjF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;iBAChC,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBAAC,MAAM,IAAI,KAAK,CAAC,4GAA4G,CAAC,CAAC;YAAC,CAAC;YAC1I,kGAAkG;YAClG,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,QAAQ,CAAC,MAAM,mEAAmE,CAAC,CAAC;YAC5J,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAChC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,SAAiB,EAAE,KAAa;IAC5D,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,iFAAiF;QACjF,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,SAAS,wCAAwC,EAAE;YAC3E,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;YACrE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;SAC9C,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,iGAAiG,CAAC,CAAC;IAAC,CAAC;IAC/H,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;QAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO;IAAC,CAAC;IAE3D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAiB,EAAE,CAAC;QAChC,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC;gBACH,SAAS,CAAC;oBACR,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;oBAC5C,IAAI,IAAI;wBAAE,MAAM;oBAChB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;oBAC3B,IAAI,MAAM,GAAG,MAAM;wBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;oBAClE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACrB,CAAC;YACH,CAAC;oBAAS,CAAC;gBAAC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;YAAC,CAAC;QACtC,CAAC;QACD,IAAI,KAAK,GAAa,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAyB,CAAC,KAAK,CAAC;QACvG,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC;YAC7E,MAAM,OAAO,GAAG,KAAiD,CAAC;YAClE,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YAC7E,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC;QAC7B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,gEAAgE,CAAC,CAAC;IAC5E,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE,qBAAqB,EAAE,uBAAuB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACtG,MAAM,IAAI,KAAK,CAAC,qHAAqH,CAAC,CAAC;IACzI,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAAE,OAAO;IACxE,+FAA+F;IAC/F,+FAA+F;IAC/F,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO;IACpC,MAAM,IAAI,KAAK,CAAC,2CAA2C,QAAQ,CAAC,MAAM,wEAAwE,CAAC,CAAC;AACtJ,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,gBAAgB,CAAC,QAAwB;IACvD,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW;QAC/F,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjK,OAAO,YAAY,QAAQ,CAAC,IAAI,WAAW,KAAK,EAAE,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAA2B;IACjE,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACrM,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACpC,OAAO,QAAQ,CAAC,WAAW,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAgD;IACrF,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,iBAAiB,EAAE,OAAO,CAAC,WAAW,IAAI,YAAY,CAAC,CAAC;IAC9F,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACpC,OAAO,QAAQ,CAAC,WAAW,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,WAAmB;IAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAClC,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,KAA4B,EAAE,EAAE,GAAG,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5I,IAAI,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IAC5J,IAAI,QAAQ;QAAE,MAAM,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,iBAAiB,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3H,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oFAAoF,CAAC,CAAC;IAC9H,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAChI,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,2EAA2E;IACxG,OAAO;QACL,WAAW,EAAE,IAAI;QACjB,KAAK,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;YACnB,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;YACjG,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,KAA4B,EAAE,EAAE,GAAG,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3I,IAAI,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;YAC9I,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;YAC7C,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACjH,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC;YAC5D,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,oBAAoB,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC7F,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChF,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YAChC,CAAC;oBAAS,CAAC;gBAAC,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,CAAC;QACrD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,UAAkB;IAChD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,YAAY,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,MAAM,CAAC,EAAE,CAAC;IAC5E,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;IAClD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,OAAO,CAAC;QAChE,MAAM,UAAU,CAAC,SAAS,EAAE,GAAG,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,IAAI,EAAE,MAAM,CAAC,CAAC;AAC3G,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAY;IACzC,IAAI,CAAC;QAAC,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;IAC5C,OAAO,KAAK,EAAE,CAAC;QAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAAC,MAAM,KAAK,CAAC;IAAC,CAAC;AACnG,CAAC;AAGD,2GAA2G;AAC3G,KAAK,UAAU,GAAG,CAAC,OAAe,EAAE,IAAuB,EAAE,KAAc;IACzE,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE;QAC5C,8FAA8F;QAC9F,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,KAAK,IAAI,CAAC;QACtE,IAAI,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACtE,MAAM,CAAC,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC,CAAC;YAAC,OAAO;QAC3D,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,EAC7E,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,EAC5D,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,OAAO,+DAA+D,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC1J,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC3B,IAAI,MAAM,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;gBAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,OAAO,2CAA2C,CAAC,CAAC,CAAC;YAAC,CAAC;QAC5H,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAiF,CAAC,CAAC,CAAC;QACjH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,OAAO,8DAA8D,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjJ,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxF,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,GAAG,EAAE,CAAC;AACrC,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC"}

package/dist/status.d.ts

@@ -1,4 +1,4 @@
-import type { RegistrationReceipt } from "./config.js";
+import type { CustomDomainRecord, RegistrationReceipt } from "./config.js";
 /**
  * Turning a receipt into "what is done, what is left, and what do I type next".
  *
@@ -20,14 +20,28 @@ export type ReadinessStep = {
     name: string;
     done: boolean;
     detail: string;
+    /** Extra lines printed under the detail, such as the DNS records still to add. */
+    lines?: string[];
     /** What to run next. Absent once the step is done. */
     command?: string;
 };
+/** The custom-domain claim, structured for `status --json` and for agents. */
+export type ReadinessCustomDomain = {
+    host?: string;
+    path: string;
+    state?: string;
+    cnameTarget?: string;
+    records: CustomDomainRecord[];
+    lastError?: string;
+    checkedAt?: string;
+};
 export type Readiness = {
     slug: string;
     status: string;
     ready: boolean;
     gatewayUrl?: string;
+    /** Present when the resource is, or is becoming, served on the tenant's own hostname. */
+    customDomain?: ReadinessCustomDomain;
     steps: ReadinessStep[];
 };
 export declare function resourceReadiness(receipt: RegistrationReceipt): Readiness;

package/dist/status.js

@@ -1,3 +1,4 @@
+import { customDomainState, defaultPublicPath, formatDnsRecords, registrarNameHint, setDomainCommandLine, summarizeCustomDomain, } from "./custom-domain.js";
 /**
  * Turning a receipt into "what is done, what is left, and what do I type next".
  *
@@ -77,24 +78,77 @@ export function resourceReadiness(receipt) {
                     : undefined,
         },
     ];
-    // Conformance is not a receipt field: the rail records registration state, not whether the origin
-    // has been exercised. Prompt for it whenever the origin exists so it is not silently skipped.
+    if (receipt.access_mode === "free")
+        steps.splice(2, 2);
+    if (blocked("paid_offer"))
+        steps.push({
+            name: "paid offer configured", done: false,
+            detail: "A paid MCP needs a positive price and credit allowance.",
+            command: `authflow resource update ${slug} --file offer.json`,
+        });
+    // A custom host is a requirement of its own: until the tenant's DNS is in place and the edge has
+    // a certificate, the resource's URL does not answer, and from the outside that looks exactly like
+    // an origin that was never wired up.
+    const customDomain = customDomainReadiness(receipt);
+    if (customDomain || blocked("custom_domain_dns")) {
+        const done = customDomain?.state === "ready" && !blocked("custom_domain_dns");
+        const records = customDomain?.records ?? [];
+        steps.push({
+            name: "custom domain DNS",
+            done,
+            detail: `${customDomain?.host ?? "(host not reported)"}: ${summarizeCustomDomain(receipt)}`,
+            lines: records.length > 0
+                ? [
+                    "",
+                    ...formatDnsRecords(records),
+                    ...(!done && customDomain?.host ? ["", ...registrarNameHint(customDomain.host)] : []),
+                ]
+                : undefined,
+            command: done ? undefined : setDomainCommandLine(slug),
+        });
+    }
+    // Conformance is recorded on the receipt after POST /origin/v1/conformance. Prompt until
+    // a run has passed so it is not silently skipped, and stop prompting after a pass.
     if (receipt.origin_base_uri) {
+        const probed = receipt.last_probe_passed === true && !blocked("origin_verification");
+        const at = receipt.last_probe_at_utc?.trim();
         steps.push({
             name: "conformance probed",
-            done: false,
-            detail: "run the probe to confirm the origin fails closed on a bad identity header",
-            command: "authflow probe",
+            done: probed,
+            detail: probed
+                ? `passed${at ? ` at ${at}` : ""}`
+                : at
+                    ? `last run failed at ${at}`
+                    : "run the probe to confirm the origin fails closed on a bad identity header",
+            command: probed ? undefined : "authflow probe",
         });
     }
     return {
         slug,
-        status: receipt.status ?? (pending.length === 0 ? "live" : "draft"),
+        status: receipt.status ?? "draft",
         ready: pending.length === 0 && receipt.status === "live",
         gatewayUrl: receipt.gateway_url ?? receipt.resource,
+        customDomain,
         steps,
     };
 }
+/** Undefined for a resource on the gateway host, so its status output does not change at all. */
+function customDomainReadiness(receipt) {
+    const domain = receipt.custom_domain;
+    const host = receipt.public_host?.trim();
+    if (!domain && !host) {
+        return undefined;
+    }
+    return {
+        host,
+        path: receipt.public_path?.trim() || defaultPublicPath,
+        state: customDomainState(receipt),
+        cnameTarget: domain?.cname_target ?? undefined,
+        records: domain?.records ?? [],
+        lastError: domain?.last_error ?? undefined,
+        checkedAt: domain?.checked_at ?? undefined,
+    };
+}
 function attachStripeCommand(slug) {
     return (`authflow connect --slug ${slug}` +
         `  (or authflow set-connected-account --slug ${slug} --account acct_…)`);
@@ -111,7 +165,15 @@ export function formatReadiness(readiness) {
     for (const step of readiness.steps) {
         lines.push(`  ${step.done ? "[x]" : "[ ]"} ${step.name}`);
         lines.push(`      ${step.detail}`);
+        const extras = step.lines ?? [];
+        for (const extra of extras) {
+            lines.push(extra ? `      ${extra}` : "");
+        }
         if (step.command) {
+            // Keep the command visually apart from a block of records it refers to.
+            if (extras.length > 0) {
+                lines.push("");
+            }
             lines.push(`      next: ${step.command}`);
         }
     }

package/dist/status.js.map

@@ -1 +1 @@
-{"version":3,"file":"status.js","sourceRoot":"","sources":["../src/status.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AAEH,iGAAiG;AACjG,MAAM,UAAU,eAAe,CAAC,OAA4B;IAC1D,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;IACpE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI,mBAAmB,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAA4B;IAChE,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO;QACL,qEAAqE;QACrE,EAAE;QACF,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;aAC/B,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;QAC7B,EAAE;QACF,2FAA2F;QAC3F,0FAA0F;KAC3F,CAAC;AACJ,CAAC;AAkBD,MAAM,UAAU,iBAAiB,CAAC,OAA4B;IAC5D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAC;IACtC,MAAM,OAAO,GAAG,OAAO,CAAC,oBAAoB,IAAI,EAAE,CAAC;IACnD,MAAM,OAAO,GAAG,CAAC,WAAmB,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAEvE,MAAM,KAAK,GAAoB;QAC7B;YACE,IAAI,EAAE,qBAAqB;YAC3B,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;YAC3B,MAAM,EAAE,OAAO,CAAC,QAAQ,IAAI,gBAAgB;SAC7C;QACD;YACE,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC;YACrE,MAAM,EAAE,OAAO,CAAC,eAAe,IAAI,mDAAmD;YACtF,OAAO,EAAE,OAAO,CAAC,eAAe;gBAC9B,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,8BAA8B,IAAI,2CAA2C;SAClF;QACD;YACE,IAAI,EAAE,kBAAkB;YACxB,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC;YAC/E,MAAM,EAAE,OAAO,CAAC,oBAAoB,IAAI,+CAA+C;YACvF,OAAO,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC;SAC9E;QACD;YACE,IAAI,EAAE,4BAA4B;YAClC,IAAI,EACF,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC;gBACrC,CAAC,OAAO,CAAC,sBAAsB,CAAC;gBAChC,CAAC,OAAO,CAAC,4BAA4B,CAAC;YACxC,MAAM,EAAE,CAAC,OAAO,CAAC,oBAAoB;gBACnC,CAAC,CAAC,qEAAqE;gBACvE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC;oBACrC,CAAC,CAAC,8CAA8C;oBAChD,CAAC,CAAC,iBAAiB;YACvB,OAAO,EAAE,CAAC,OAAO,CAAC,oBAAoB;gBACpC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC;gBAC3B,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC;oBACrC,CAAC,CAAC,2BAA2B,IAAI,EAAE;oBACnC,CAAC,CAAC,SAAS;SAChB;KACF,CAAC;IAEF,kGAAkG;IAClG,8FAA8F;IAC9F,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,oBAAoB;YAC1B,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,2EAA2E;YACnF,OAAO,EAAE,gBAAgB;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QACnE,KAAK,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;QACxD,UAAU,EAAE,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,QAAQ;QACnD,KAAK;KACN,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY;IACvC,OAAO,CACL,2BAA2B,IAAI,EAAE;QACjC,+CAA+C,IAAI,oBAAoB,CACxE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,SAAoB;IAClD,MAAM,KAAK,GAAa;QACtB,aAAa,SAAS,CAAC,IAAI,EAAE;QAC7B,aAAa,SAAS,CAAC,MAAM,EAAE;KAChC,CAAC;IAEF,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,aAAa,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1D,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,KAAK,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CACR,SAAS,CAAC,KAAK;QACb,CAAC,CAAC,yEAAyE;QAC3E,CAAC,CAAC,+EAA+E,CACpF,CAAC;IAEF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../src/status.ts"],"names":[],"mappings":"AACA,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAE5B;;;;;;;GAOG;AAEH,iGAAiG;AACjG,MAAM,UAAU,eAAe,CAAC,OAA4B;IAC1D,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;IACpE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI,mBAAmB,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAA4B;IAChE,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO;QACL,qEAAqE;QACrE,EAAE;QACF,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;aAC/B,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;QAC7B,EAAE;QACF,2FAA2F;QAC3F,0FAA0F;KAC3F,CAAC;AACJ,CAAC;AAiCD,MAAM,UAAU,iBAAiB,CAAC,OAA4B;IAC5D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAC;IACtC,MAAM,OAAO,GAAG,OAAO,CAAC,oBAAoB,IAAI,EAAE,CAAC;IACnD,MAAM,OAAO,GAAG,CAAC,WAAmB,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAEvE,MAAM,KAAK,GAAoB;QAC7B;YACE,IAAI,EAAE,qBAAqB;YAC3B,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;YAC3B,MAAM,EAAE,OAAO,CAAC,QAAQ,IAAI,gBAAgB;SAC7C;QACD;YACE,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC;YACrE,MAAM,EAAE,OAAO,CAAC,eAAe,IAAI,mDAAmD;YACtF,OAAO,EAAE,OAAO,CAAC,eAAe;gBAC9B,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,8BAA8B,IAAI,2CAA2C;SAClF;QACD;YACE,IAAI,EAAE,kBAAkB;YACxB,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC;YAC/E,MAAM,EAAE,OAAO,CAAC,oBAAoB,IAAI,+CAA+C;YACvF,OAAO,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC;SAC9E;QACD;YACE,IAAI,EAAE,4BAA4B;YAClC,IAAI,EACF,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC;gBACrC,CAAC,OAAO,CAAC,sBAAsB,CAAC;gBAChC,CAAC,OAAO,CAAC,4BAA4B,CAAC;YACxC,MAAM,EAAE,CAAC,OAAO,CAAC,oBAAoB;gBACnC,CAAC,CAAC,qEAAqE;gBACvE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC;oBACrC,CAAC,CAAC,8CAA8C;oBAChD,CAAC,CAAC,iBAAiB;YACvB,OAAO,EAAE,CAAC,OAAO,CAAC,oBAAoB;gBACpC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC;gBAC3B,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC;oBACrC,CAAC,CAAC,2BAA2B,IAAI,EAAE;oBACnC,CAAC,CAAC,SAAS;SAChB;KACF,CAAC;IAEF,IAAI,OAAO,CAAC,WAAW,KAAK,MAAM;QAAE,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,YAAY,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC;YACpC,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,KAAK;YAC1C,MAAM,EAAE,yDAAyD;YACjE,OAAO,EAAE,4BAA4B,IAAI,oBAAoB;SAC9D,CAAC,CAAC;IAEH,iGAAiG;IACjG,kGAAkG;IAClG,qCAAqC;IACrC,MAAM,YAAY,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,YAAY,IAAI,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,YAAY,EAAE,KAAK,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QAC9E,MAAM,OAAO,GAAG,YAAY,EAAE,OAAO,IAAI,EAAE,CAAC;QAC5C,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,mBAAmB;YACzB,IAAI;YACJ,MAAM,EAAE,GAAG,YAAY,EAAE,IAAI,IAAI,qBAAqB,KAAK,qBAAqB,CAAC,OAAO,CAAC,EAAE;YAC3F,KAAK,EACH,OAAO,CAAC,MAAM,GAAG,CAAC;gBAChB,CAAC,CAAC;oBACE,EAAE;oBACF,GAAG,gBAAgB,CAAC,OAAO,CAAC;oBAC5B,GAAG,CAAC,CAAC,IAAI,IAAI,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,iBAAiB,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;iBACtF;gBACH,CAAC,CAAC,SAAS;YACf,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC;SACvD,CAAC,CAAC;IACL,CAAC;IAED,yFAAyF;IACzF,mFAAmF;IACnF,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,iBAAiB,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;QACrF,MAAM,EAAE,GAAG,OAAO,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,oBAAoB;YAC1B,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,MAAM;gBACZ,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;gBAClC,CAAC,CAAC,EAAE;oBACF,CAAC,CAAC,sBAAsB,EAAE,EAAE;oBAC5B,CAAC,CAAC,2EAA2E;YACjF,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB;SAC/C,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO;QACjC,KAAK,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;QACxD,UAAU,EAAE,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,QAAQ;QACnD,YAAY;QACZ,KAAK;KACN,CAAC;AACJ,CAAC;AAED,iGAAiG;AACjG,SAAS,qBAAqB,CAAC,OAA4B;IACzD,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IACrC,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;IACzC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO;QACL,IAAI;QACJ,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,iBAAiB;QACtD,KAAK,EAAE,iBAAiB,CAAC,OAAO,CAAC;QACjC,WAAW,EAAE,MAAM,EAAE,YAAY,IAAI,SAAS;QAC9C,OAAO,EAAE,MAAM,EAAE,OAAO,IAAI,EAAE;QAC9B,SAAS,EAAE,MAAM,EAAE,UAAU,IAAI,SAAS;QAC1C,SAAS,EAAE,MAAM,EAAE,UAAU,IAAI,SAAS;KAC3C,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY;IACvC,OAAO,CACL,2BAA2B,IAAI,EAAE;QACjC,+CAA+C,IAAI,oBAAoB,CACxE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,SAAoB;IAClD,MAAM,KAAK,GAAa;QACtB,aAAa,SAAS,CAAC,IAAI,EAAE;QAC7B,aAAa,SAAS,CAAC,MAAM,EAAE;KAChC,CAAC;IAEF,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,aAAa,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1D,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QAChC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,wEAAwE;YACxE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjB,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CACR,SAAS,CAAC,KAAK;QACb,CAAC,CAAC,yEAAyE;QAC3E,CAAC,CAAC,+EAA+E,CACpF,CAAC;IAEF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/surface.d.ts

@@ -15,6 +15,7 @@ export declare const mcpToolToCliCommand: {
     readonly authflow_start_stripe_connect: "connect";
     readonly authflow_set_connected_account: "set-connected-account";
     readonly authflow_set_origin: "set-origin";
+    readonly authflow_set_custom_domain: "set-domain";
     readonly authflow_probe: "probe";
     readonly authflow_mint_test_header: "mint-header";
     readonly authflow_rotate_origin_key: "rotate-origin-key";

package/dist/surface.js

@@ -15,6 +15,7 @@ export const mcpToolToCliCommand = {
     authflow_start_stripe_connect: "connect",
     authflow_set_connected_account: "set-connected-account",
     authflow_set_origin: "set-origin",
+    authflow_set_custom_domain: "set-domain",
     authflow_probe: "probe",
     authflow_mint_test_header: "mint-header",
     authflow_rotate_origin_key: "rotate-origin-key",

package/dist/surface.js.map

@@ -1 +1 @@
-{"version":3,"file":"surface.js","sourceRoot":"","sources":["../src/surface.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,eAAe,EAAE,QAAQ;IACzB,eAAe,EAAE,QAAQ;IACzB,0BAA0B,EAAE,UAAU;IACtC,qBAAqB,EAAE,KAAK;IAC5B,uBAAuB,EAAE,MAAM;IAC/B,eAAe,EAAE,QAAQ;IACzB,yBAAyB,EAAE,MAAM;IACjC,6BAA6B,EAAE,SAAS;IACxC,8BAA8B,EAAE,uBAAuB;IACvD,mBAAmB,EAAE,YAAY;IACjC,cAAc,EAAE,OAAO;IACvB,yBAAyB,EAAE,aAAa;IACxC,0BAA0B,EAAE,mBAAmB;CACvC,CAAC"}
+{"version":3,"file":"surface.js","sourceRoot":"","sources":["../src/surface.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,eAAe,EAAE,QAAQ;IACzB,eAAe,EAAE,QAAQ;IACzB,0BAA0B,EAAE,UAAU;IACtC,qBAAqB,EAAE,KAAK;IAC5B,uBAAuB,EAAE,MAAM;IAC/B,eAAe,EAAE,QAAQ;IACzB,yBAAyB,EAAE,MAAM;IACjC,6BAA6B,EAAE,SAAS;IACxC,8BAA8B,EAAE,uBAAuB;IACvD,mBAAmB,EAAE,YAAY;IACjC,0BAA0B,EAAE,YAAY;IACxC,cAAc,EAAE,OAAO;IACvB,yBAAyB,EAAE,aAAa;IACxC,0BAA0B,EAAE,mBAAmB;CACvC,CAAC"}

package/dist/tenant-host.d.ts

@@ -0,0 +1,49 @@
+import { type PeerCertificate } from "node:tls";
+import { type DoctorCheck } from "./checks.js";
+import type { RegistrationReceipt } from "./config.js";
+/**
+ * `authflow doctor --host`: does a tenant's own hostname work, end to end, from outside?
+ *
+ * The rail can report a custom domain as ready while a tenant's registrar still serves a stale
+ * record, and a rail-side check cannot tell, because the rail is not the one resolving the name.
+ * These checks look the way a client does: resolve the three records, handshake TLS, follow a plain
+ * http request, then fetch the discovery documents and the 401 challenge on the tenant host.
+ *
+ * Every lookup goes through an injectable seam (DNS, TLS) or the shared fetch, so none of this
+ * needs a network to test.
+ */
+export type DnsResolver = {
+    resolveCname(hostname: string): Promise<string[]>;
+    resolveTxt(hostname: string): Promise<string[][]>;
+};
+export declare const systemDnsResolver: DnsResolver;
+export type TlsPeer = {
+    authorized: boolean;
+    /** Why the certificate is not trusted, as Node reports it (a code such as CERT_HAS_EXPIRED). */
+    authorizationError?: string;
+    issuer: string;
+    subject: string;
+    validTo: Date;
+};
+export type TlsProbe = (host: string, port: number) => Promise<TlsPeer>;
+/** The network seams, injectable so tests never touch DNS or open a socket. */
+export type HostProbes = {
+    dns?: DnsResolver;
+    tls?: TlsProbe;
+    now?: () => Date;
+};
+export type TenantHostOptions = HostProbes & {
+    /** Lowercase hostname, already validated. */
+    host: string;
+    /** The receipt to compare against. Without one, records are checked for presence only. */
+    receipt?: RegistrationReceipt;
+    /**
+     * Why there is no receipt, as a short phrase ("no admin key to read it"), so the report says so
+     * instead of quietly comparing nothing.
+     */
+    receiptNote?: string;
+};
+export declare function runTenantHostChecks(options: TenantHostOptions): Promise<DoctorCheck[]>;
+/** The certificate a server presents, whether or not Node trusts it. */
+export declare const probeTls: TlsProbe;
+export declare function describePeer(cert: PeerCertificate, authorized: boolean, authorizationError?: string): TlsPeer;